Function at 0x140002be1
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Parse pe header

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa8
mov rax, qword [0x140190f10]
mov r9, qword [rax + 0x48]
mov word [rsp + 0x40], 0x58
mov word [rsp + 0x42], 0x5e
mov word [rsp + 0x44], 0x4d
mov word [rsp + 0x46], 0x5d
mov word [rsp + 0x48], 0x4d
mov word [rsp + 0x4a], 0x57
mov word [rsp + 0x4c], 0xc
mov word [rsp + 0x4e], 0x72
mov word [rsp + 0x50], 0x6f
mov word [rsp + 0x52], 0x26
mov word [rsp + 0x54], 0x2f
mov word [rsp + 0x56], 0x28
mov word [rsp + 0x58], 0x45
lea rcx, [rsp + 0x40]
mov edx, 0
movsxd rax, edx
imul rax, rax, 0x94f2095
sar rax, 0x21
mov r8d, edx
sar r8d, 0x1f
sub eax, r8d
imul eax, eax, 0x37
mov r8d, edx
sub r8d, eax
lea eax, [r8 + 0x39]
xor word [rcx], ax
add edx, 1
add rcx, 2
cmp edx, 0xd
jne 0x140002c5c
lea rcx, [rsp + 0x40]
call r9
mov rbx, rax
mov edi, 0
test rax, rax
je 0x140002ee5
mov rax, qword [0x140190f10]
mov r9, qword [rax + 0x58]
mov byte [rsp + 0x60], 0x76
mov byte [rsp + 0x61], 0x4a
mov byte [rsp + 0x62], 0x5e
mov byte [rsp + 0x63], 0x52
mov byte [rsp + 0x64], 0x6d
mov byte [rsp + 0x65], 0x4c
mov byte [rsp + 0x66], 0x50
mov byte [rsp + 0x67], 0x23
mov byte [rsp + 0x68], 0x24
mov byte [rsp + 0x69], 0x31
mov byte [rsp + 0x6a], 0x30
mov byte [rsp + 0x6b], 0x10
mov byte [rsp + 0x6c], 0x2a
mov byte [rsp + 0x6d], 0x2d
mov byte [rsp + 0x6e], 0x22
mov byte [rsp + 0x6f], 0x26
mov byte [rsp + 0x70], 0x49
lea rcx, [rsp + 0x60]
mov edx, 0
movsxd rax, edx
imul rax, rax, 0x94f2095
sar rax, 0x21
mov r8d, edx
sar r8d, 0x1f
sub eax, r8d
imul eax, eax, 0x37
mov r8d, edx
sub r8d, eax
lea eax, [r8 + 0x39]
xor byte [rcx], al
add edx, 1
add rcx, 1
cmp edx, 0x11
jne 0x140002d13
lea rdx, [rsp + 0x60]
mov rcx, rbx
call r9
mov rsi, rax
mov rax, qword [0x140190f10]
mov r9, qword [rax + 0x58]
mov byte [rsp + 0x80], 0x7e
mov byte [rsp + 0x81], 0x5f
mov byte [rsp + 0x82], 0x4f
mov byte [rsp + 0x83], 0x68
mov byte [rsp + 0x84], 0x52
mov byte [rsp + 0x85], 0x55
mov byte [rsp + 0x86], 0x5a
mov byte [rsp + 0x87], 0x2e
mov byte [rsp + 0x88], 8
mov byte [rsp + 0x89], 0x2c
mov byte [rsp + 0x8a], 0x25
mov byte [rsp + 0x8b], 0x2b
mov byte [rsp + 0x8c], 0x37
mov byte [rsp + 0x8d], 0x2b
mov byte [rsp + 0x8e], 0x26
mov byte [rsp + 0x8f], 0x3c
mov byte [rsp + 0x90], 0x20
mov byte [rsp + 0x91], 0x25
mov byte [rsp + 0x92], 0x25
mov byte [rsp + 0x93], 0x4c
lea rcx, [rsp + 0x80]
mov edx, 0
movsxd rax, edx
imul rax, rax, 0x94f2095
sar rax, 0x21
mov r8d, edx
sar r8d, 0x1f
sub eax, r8d
imul eax, eax, 0x37
mov r8d, edx
sub r8d, eax
lea eax, [r8 + 0x39]
xor byte [rcx], al
add edx, 1
add rcx, 1
cmp edx, 0x14
jne 0x140002e0c
lea rdx, [rsp + 0x80]
mov rcx, rbx
call r9
mov rbp, rax
test rsi, rsi
setne dil
test rax, rax
setne al
and dil, al
je 0x140002ed8
mov qword [rsp + 0x38], 0
mov rax, qword [0x140190f10]
call qword [rax + 0xc8]
mov rcx, rax
lea r8, [rsp + 0x38]
mov edx, 8
call rsi
mov edi, 0
test eax, eax
je 0x140002ed8
mov dword [rsp + 0x34], 4
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rsp + 0x30]
mov edx, 0x14
mov rcx, qword [rsp + 0x38]
call rbp
test eax, eax
je 0x140002ec6
cmp dword [rsp + 0x30], 0
setne dil
mov rcx, qword [rsp + 0x38]
mov rax, qword [0x140190f10]
call qword [rax + 0xc0]
mov rcx, rbx
mov rax, qword [0x140190f10]
call qword [rax + 0x60]
mov eax, edi
add rsp, 0xa8
pop rbx
pop rsi
pop rdi
pop rbp
ret