Function at 0x14001f360
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x100
mov ecx, 1
xor eax, eax
lock cmpxchg dword [0x14007711c], ecx
jne 0x14001f784
mov ecx, 0x61
mov dword [rsp + 0x20], 0x320061
mov dword [rsp + 0x24], 0x250004
mov dword [rsp + 0x28], 0x30004
mov dword [rbp - 0x7d], 0x60014
mov dword [rbp - 0x79], 0x130031
mov dword [rbp - 0x75], 0x170008
mov dword [rbp - 0x71], 0xd0008
mov dword [rbp - 0x6d], 0x60004
mov dword [rbp - 0x69], 0x610004
movzx eax, word [0x140061072]
xor ax, cx
mov word [rbp - 0x65], ax
movzx eax, word [0x140061074]
xor ax, cx
mov word [rbp - 0x63], ax
movzx eax, word [0x140061076]
xor ax, cx
mov word [rbp - 0x61], ax
movzx eax, word [str.SeLoadDriverPrivilege]
xor ax, cx
mov word [rbp - 0x5f], ax
movzx eax, word [0x14006107a]
xor ax, cx
mov word [rbp - 0x5d], ax
movzx eax, word [0x14006107c]
xor ax, cx
mov word [rbp - 0x5b], ax
movzx eax, word [0x14006107e]
xor ax, cx
mov word [rbp - 0x59], ax
movzx eax, word [0x140061080]
xor ax, cx
mov word [rbp - 0x57], ax
movzx eax, word [0x140061082]
xor ax, cx
mov word [rbp - 0x55], ax
movzx eax, word [reloc.SHELL32.dll_SHGetSetSettings]
xor ax, cx
mov word [rbp - 0x53], ax
movzx eax, word [0x140061086]
xor ax, cx
mov word [rbp - 0x51], ax
movzx eax, word [0x140061088]
xor ax, cx
mov word [rbp - 0x4f], ax
movzx eax, word [0x14006108a]
xor ax, cx
mov word [rbp - 0x4d], ax
movzx eax, word [0x14006108c]
xor ax, cx
mov word [rbp - 0x4b], ax
movzx eax, word [0x14006108e]
xor ax, cx
mov word [rbp - 0x49], ax
movzx eax, word [0x140061090]
xor ax, cx
mov word [rbp - 0x47], ax
xor eax, eax
mov word [rbp - 0x45], ax
xor edi, edi
nop dword [rax + rax]
xor word [rsp + rax*2 + 0x22], cx
inc rax
cmp rax, 0x21
jae 0x14001f4d5
movzx ecx, word [rsp + 0x20]
jmp 0x14001f4c0
mov word [rbp - 0x45], di
mov qword [rbp + 0x17], rdi
mov qword [rbp + 0x27], rdi
mov qword [rbp + 0x2f], 7
lea rax, [rsp + 0x22]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14001f500
lea rdx, [rsp + 0x22]
lea rcx, [rbp + 0x17]
call fcn.140010450
lea rcx, [rbp + 0x17]
call fcn.14001f7b0
mov rdx, qword [rbp + 0x2f]
cmp rdx, 8
jb 0x14001f562
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x17]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f55d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001f7a1
call fcn.140021138
mov ecx, 0x3a
mov dword [rbp - 0x43], 0x69003a
mov dword [rbp - 0x3f], 0x76005f
mov dword [rbp - 0x3b], 0x5b0055
mov dword [rbp - 0x37], 0x7e005e
mov dword [rbp - 0x33], 0x530048
mov dword [rbp - 0x2f], 0x5f004c
mov dword [rbp - 0x2b], 0x6a0048
mov dword [rbp - 0x27], 0x530048
mov dword [rbp - 0x23], 0x53004c
mov dword [rbp - 0x1f], 0x5f0056
mov dword [rbp - 0x1b], 0x5f005d
mov word [rbp - 0x17], cx
movzx eax, word [0x1400610a4]
xor ax, cx
mov word [rbp - 0x15], ax
movzx eax, word [0x1400610a6]
xor ax, cx
mov word [rbp - 0x13], ax
movzx eax, word [str.ntdll.dll]
xor ax, cx
mov word [rbp - 0x11], ax
movzx eax, word [0x1400610aa]
xor ax, cx
mov word [rbp - 0xf], ax
movzx eax, word [0x1400610ac]
xor ax, cx
mov word [rbp - 0xd], ax
movzx eax, word [0x1400610ae]
xor ax, cx
mov word [rbp - 0xb], ax
movzx eax, word [0x1400610b0]
xor ax, cx
mov word [rbp - 9], ax
movzx eax, word [0x1400610b2]
xor ax, cx
mov word [rbp - 7], ax
movzx eax, word [0x1400610b4]
xor ax, cx
mov word [rbp - 5], ax
movzx eax, word [0x1400610b6]
xor ax, cx
mov word [rbp - 3], ax
movzx eax, word [0x1400610b8]
xor ax, cx
mov word [rbp - 1], ax
movzx eax, word [0x1400610ba]
xor ax, cx
mov word [rbp + 1], ax
movzx eax, word [0x1400610bc]
xor ax, cx
mov word [rbp + 3], ax
movzx eax, word [0x1400610be]
xor ax, cx
mov word [rbp + 5], ax
movzx eax, word [str.RtlDosPathNameToNtPathName_U]
xor ax, cx
mov word [rbp + 7], ax
movzx eax, word [0x1400610c2]
xor ax, cx
mov word [rbp + 9], ax
movzx eax, word [0x1400610c4]
xor ax, cx
mov word [rbp + 0xb], ax
movzx eax, word [0x1400610c6]
xor ax, cx
mov word [rbp + 0xd], ax
movzx eax, word [0x1400610c8]
xor ax, cx
mov word [rbp + 0xf], ax
movzx eax, word [0x1400610ca]
xor ax, cx
mov word [rbp + 0x11], ax
movzx eax, word [0x1400610cc]
xor ax, cx
mov word [rbp + 0x13], ax
xor eax, eax
mov word [rbp + 0x15], ax
mov rax, rdi
nop word [rax + rax]
xor word [rbp + rax*2 - 0x41], cx
inc rax
cmp rax, 0x2b
jae 0x14001f704
movzx ecx, word [rbp - 0x43]
jmp 0x14001f6f0
mov word [rbp + 0x15], di
mov qword [rbp + 0x37], rdi
mov qword [rbp + 0x47], rdi
mov qword [rbp + 0x4f], 7
lea rax, [rbp - 0x41]
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x14001f720
mov r8, rbx
lea rdx, [rbp - 0x41]
lea rcx, [rbp + 0x37]
call fcn.140010450
lea rcx, [rbp + 0x37]
call fcn.14001f7b0
mov rdx, qword [rbp + 0x4f]
cmp rdx, 8
jb 0x14001f77f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x37]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f77a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001f79b
call fcn.140021138
call fcn.14001f8a0
mov al, 1
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
call fcn.14002e15c
int3
call fcn.14002e15c
int3