Function at 0x1400022e0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Link many functions at runtime

Disassembly:
push rbp
push rbx
push rdi
push r13
lea rbp, [rsp - 0x1e8]
sub rsp, 0x2e8
mov rax, qword [0x140008040]
xor rax, rsp
mov qword [rbp + 0x1d8], rax
xor ebx, ebx
mov dword [rbp + 0x160], 0x4e52454b
mov r13, rcx
mov dword [rbp + 0x164], 0x32334c45
mov ecx, ebx
mov dword [rbp + 0x168], 0x4c4c442e
mov byte [rbp + 0x16c], 0
lea rax, [rbp + 0x160]
nop dword [rax]
xor byte [rax], 0x11
lea rax, [rax + 1]
inc ecx
cmp ecx, 0xc
jb 0x140002340
mov qword [rsp + 0x318], rsi
lea rcx, [rbp + 0x160]
mov qword [rsp + 0x320], r12
mov qword [rsp + 0x328], r14
mov qword [rsp + 0x2e0], r15
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
test rax, rax
je 0x14000266b
movdqa xmm2, xmmword [0x1400058d0]
lea rcx, [rbp + 0x190]
mov dword [rbp + 0x190], 0x61657254
mov eax, ebx
mov dword [rbp + 0x194], 0x6f536574
mov dword [rbp + 0x198], 0x65686c6f
mov dword [rbp + 0x19c], 0x3233706c
mov dword [rbp + 0x1a0], 0x70616e53
mov dword [rbp + 0x1a4], 0x746f6873
mov byte [rbp + 0x1a8], bl
mov dword [rbp + 0x180], 0x636f7250
mov dword [rbp + 0x184], 0x33737365
mov dword [rbp + 0x188], 0x72694632
mov dword [rbp + 0x18c], 0x577473
mov dword [rbp + 0x170], 0x636f7250
mov dword [rbp + 0x174], 0x33737365
mov dword [rbp + 0x178], 0x78654e32
mov word [rbp + 0x17c], 0x5774
mov byte [rbp + 0x17e], bl
mov byte [rbp + 0x1d3], bl
mov dword [rbp + 0x1b0], 0x6d726554
mov dword [rbp + 0x1b4], 0x74616e69
mov dword [rbp + 0x1b8], 0x6f725065
mov dword [rbp + 0x1bc], 0x73736563
mov byte [rbp + 0x1c0], bl
nop dword [rax]
nop word [rax + rax]
movdqu xmm0, xmmword [rcx]
add eax, 0x10
lea rcx, [rcx + 0x10]
xorps xmm0, xmm2
movdqu xmmword [rcx - 0x10], xmm0
cmp eax, 0x10
jb 0x140002470
movsxd rcx, eax
cmp rcx, 0x18
jae 0x1400024ae
lea rcx, [rbp + rcx + 0x190]
nop dword [rax]
xor byte [rcx], 0x11
lea rcx, [rcx + 1]
inc eax
cmp eax, 0x18
jb 0x1400024a0
mov ecx, ebx
lea rax, [rbp + 0x180]
nop word [rax + rax]
xor byte [rax], 0x11
lea rax, [rax + 1]
inc ecx
cmp ecx, 0xf
jb 0x1400024c0
mov ecx, ebx
lea rax, [rbp + 0x170]
nop word [rax + rax]
xor byte [rax], 0x11
lea rax, [rax + 1]
inc ecx
cmp ecx, 0xe
jb 0x1400024e0
mov dword [rbp + 0x1c8], 0x7f74615e
lea rax, [rbp + 0x1b0]
mov dword [rbp + 0x1cc], 0x727e6341
mov word [rbp + 0x1d0], 0x6274
mov byte [rbp + 0x1d2], 0x62
nop dword [rax]
movdqu xmm0, xmmword [rax]
lea rax, [rax + 0x10]
add ebx, 0x10
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rax - 0x10], xmm1
cmp ebx, 0x10
jb 0x140002520
lea rdx, [rbp + 0x190]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rbp + 0x180]
mov rcx, rdi
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rbp + 0x170]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rbp + 0x1c8]
mov rcx, rdi
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rbp + 0x1b0]
mov rcx, rdi
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
test rsi, rsi
je 0x14000266b
test rbx, rbx
je 0x14000266b
test r14, r14
je 0x14000266b
test r12, r12
je 0x14000266b
test rax, rax
je 0x14000266b
xor edx, edx
mov ecx, 2
call rsi
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14000266b
xor edx, edx
mov dword [rsp + 0x20], 0x238
mov r8d, 0x234
lea rcx, [rsp + 0x24]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x20]
mov rcx, rdi
xor sil, sil
call rbx
test eax, eax
je 0x14000265c
nop dword [rax]
mov rdx, r13
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x14000264d
mov r8d, dword [rsp + 0x28]
xor edx, edx
mov ecx, 1
call r12
mov rbx, rax
test rax, rax
je 0x14000264d
xor edx, edx
mov rcx, rax
call r15
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov sil, 1
lea rdx, [rsp + 0x20]
mov rcx, rdi
call r14
test eax, eax
jne 0x140002610
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, sil
jmp 0x14000266d
xor al, al
mov r15, qword [rsp + 0x2e0]
mov r14, qword [rsp + 0x328]
mov r12, qword [rsp + 0x320]
mov rsi, qword [rsp + 0x318]
mov rcx, qword [rbp + 0x1d8]
xor rcx, rsp
call fcn.140003220
add rsp, 0x2e8
pop r13
pop rdi
pop rbx
pop rbp
ret