Function at 0x1401dad80
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0xb0
mov r13, r9
mov r15, r8
mov r12, rdx
mov r14, r8
lea ecx, [r14 + 0x3fff]
test ecx, ecx
jns 0x1401dadc1
add ecx, 0x3fff
sar ecx, 0xe
lea edi, [rcx*4 + 6]
add edi, r14d
add edi, ecx
mov ebx, edi
jne 0x1401dadd8
xor esi, esi
jmp 0x1401dadff
mov r9d, 4
mov r8d, 0x3000
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.kernel32.dll_VirtualAlloc]
mov r8, rbx
xor edx, edx
mov rcx, rax
mov rsi, rax
call fcn.1403ccc50
mov r8, rbx
xor edx, edx
mov rcx, rsi
call fcn.1403ccc50
xorps xmm0, xmm0
mov dword [rbp - 0x29], r15d
movups xmmword [rbp - 9], xmm0
xor ebx, ebx
mov dword [rbp - 0x25], r15d
movups xmmword [rbp + 7], xmm0
mov dword [rbp - 0x19], edi
movups xmmword [rbp + 0x17], xmm0
mov dword [rbp - 0x15], edi
psrldq xmm0, 8
movq r9, xmm0
mov qword [rbp - 0x31], r12
mov qword [rbp - 0x21], rsi
mov qword [rbp - 0x11], rbx
mov qword [rbp - 1], r9
test r9, r9
jne 0x1401dae5d
lea r9, [0x1402166b0]
mov qword [rbp + 0xf], rbx
mov qword [rbp - 1], r9
mov ecx, ebx
jmp 0x1401dae61
mov rcx, qword [rbp + 0xf]
mov rax, qword [rbp + 7]
lea rdx, [0x1402166d0]
test rax, rax
mov r8d, 0x1bf0
cmove rax, rdx
mov edx, 1
mov qword [rbp + 7], rax
call r9
mov rdi, rax
test rax, rax
je 0x1401dafdd
mov qword [rbp - 9], rax
lea rax, [rbp - 0x31]
mov qword [rdi], rax
mov qword [rdi + 0x40], rbx
mov dword [rdi + 8], 0x3f34
mov r8, qword [rbp + 7]
cmp qword [rbp - 1], rbx
je 0x1401dafcf
test r8, r8
je 0x1401dafcf
mov rbx, qword [rbp - 9]
test rbx, rbx
je 0x1401dafcd
lea rax, [rbp - 0x31]
cmp qword [rbx], rax
jne 0x1401dafcd
mov eax, dword [rbx + 8]
sub eax, 0x3f34
cmp eax, 0x1f
ja 0x1401dafcd
mov rdx, qword [rbx + 0x40]
test rdx, rdx
je 0x1401daf07
cmp dword [rbx + 0x30], 0xf
je 0x1401daf07
mov rcx, qword [rbp + 0xf]
call r8
mov qword [rbx + 0x40], 0
lea rcx, [rbp - 0x31]
mov dword [rbx + 0x10], 5
mov dword [rbx + 0x30], 0xf
call fcn.1402109f0
test eax, eax
jne 0x1401dafbf
lea edx, [rax + 4]
lea rcx, [rbp - 0x31]
call fcn.140210c00
cmp eax, 1
je 0x1401daf59
cmp eax, 0xfffffffb
jne 0x1401db03e
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.kernel32.dll_VirtualFree]
add r14, r14
jmp 0x1401dadb0
cmp qword [rbp - 1], 0
je 0x1401dafaa
mov r8, qword [rbp + 7]
test r8, r8
je 0x1401dafaa
mov rdx, qword [rbp - 9]
test rdx, rdx
je 0x1401dafaa
lea rax, [rbp - 0x31]
cmp qword [rdx], rax
jne 0x1401dafaa
mov eax, dword [rdx + 8]
sub eax, 0x3f34
cmp eax, 0x1f
ja 0x1401dafaa
mov rax, qword [rdx + 0x40]
test rax, rax
je 0x1401dafa3
mov rcx, qword [rbp + 0xf]
mov rdx, rax
call r8
mov r8, qword [rbp + 7]
mov rdx, qword [rbp - 9]
mov rcx, qword [rbp + 0xf]
call r8
mov rax, qword [rbp + 0x7f]
mov ecx, dword [rbp - 0x15]
mov qword [r13], rsi
mov qword [rax], rcx
mov al, 1
jmp 0x1401db040
mov rcx, qword [rbp + 0xf]
mov rdx, rdi
call qword [rbp + 7]
xor ebx, ebx
jmp 0x1401dafd9
xor ebx, ebx
mov rcx, qword [rbp + 0xf]
mov rdx, rdi
call r8
mov qword [rbp - 9], rbx
xor eax, eax
mov dword [rbp - 0x61], 0x6f0075
mov word [rbp - 0x41], ax
mov ecx, ebx
mov dword [rbp - 0x5d], 0x6c0061
mov dword [rbp - 0x59], 0x750069
mov dword [rbp - 0x55], 0x620074
mov dword [rbp - 0x51], 0x7a007b
mov dword [rbp - 0x4d], 0x6e002a
mov dword [rbp - 0x49], 0x7f007e
mov dword [rbp - 0x45], 0x7d0061
nop dword [rax]
movsxd rax, ecx
xor word [rbp + rax*2 - 0x61], cx
inc ecx
cmp ecx, 0x10
jb 0x1401db020
lea rdx, [rbp - 0x61]
mov word [rbp - 0x41], bx
xor ecx, ecx
call fcn.1401a8110
xor al, al
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret