Function at 0x14008af10
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
xor r14d, r14d
mov dword [rbp - 1], 0x5602561d
mov ecx, r14d
mov dword [rbp + 3], 0x56085603
mov dword [rbp + 7], 0x563f561d
mov esi, 0x5655
mov dword [rbp + 0xb], 0x56295639
mov dword [rbp + 0xf], 0x5639563a
mov dword [rbp + 0x13], 0x5612563a
mov dword [rbp + 0x17], 0x56145632
mov dword [rbp + 0x1b], 0x564a5600
mov dword [rbp + 0x1f], 0x561e5600
mov dword [rbp + 0x23], 0x5602
mov byte [rbp + 0x27], 1
nop dword [rax]
lea eax, [rsi + rcx]
xor word [rbp + rcx*2 - 1], ax
inc rcx
cmp rcx, 0x13
jb 0x14008af90
xorps xmm0, xmm0
mov byte [rbp + 0x27], r14b
mov rbx, 0xffffffffffffffff
mov qword [rbp - 0x19], r14
movups xmmword [rbp - 0x29], xmm0
mov r8, rbx
mov qword [rbp - 0x11], r14
lea rax, [rbp - 1]
inc r8
cmp word [rax + r8*2], r14w
jne 0x14008afc2
lea rdx, [rbp - 1]
lea rcx, [rbp - 0x29]
call fcn.140082e60
lea rcx, [rbp - 0x29]
call fcn.140088250
test eax, eax
je 0x14008b0ba
mov dword [rbp - 0x59], 0x5602561d
mov rcx, r14
mov dword [rbp - 0x55], 0x56085603
mov dword [rbp - 0x51], 0x563f561d
mov dword [rbp - 0x4d], 0x56295639
mov dword [rbp - 0x49], 0x5639563a
mov dword [rbp - 0x45], 0x5612563a
mov dword [rbp - 0x41], 0x56145632
mov dword [rbp - 0x3d], 0x564a5600
mov dword [rbp - 0x39], 0x561e5600
mov dword [rbp - 0x35], 0x5602
mov byte [rbp - 0x31], 1
nop word [rax + rax]
lea eax, [rsi + rcx]
xor word [rbp + rcx*2 - 0x59], ax
inc rcx
cmp rcx, 0x13
jb 0x14008b040
xorps xmm0, xmm0
mov byte [rbp - 0x31], r14b
movups xmmword [rbp - 1], xmm0
mov qword [rbp + 0xf], r14
lea rax, [rbp - 0x59]
mov qword [rbp + 0x17], r14
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], r14w
jne 0x14008b070
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 1]
call fcn.140082e60
lea rcx, [rbp - 1]
call fcn.140088250
xor edx, edx
mov r8d, eax
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x14008b0ba
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp - 0x29], 0x5602561d
mov rcx, r14
mov dword [rbp - 0x25], 0x56085603
mov dword [rbp - 0x21], 0x563f561d
mov dword [rbp - 0x1d], 0x56295639
mov dword [rbp - 0x19], 0x5639563a
mov dword [rbp - 0x15], 0x5612563a
mov dword [rbp - 0x11], 0x562b5634
mov dword [rbp - 0xd], 0x5601564d
mov dword [rbp - 9], 0x5603561d
mov word [rbp - 5], r14w
mov byte [rbp - 3], 1
nop word [rax + rax]
lea eax, [rsi + rcx]
xor word [rbp + rcx*2 - 0x29], ax
inc rcx
cmp rcx, 0x12
jb 0x14008b110
xorps xmm0, xmm0
mov byte [rbp - 3], r14b
movups xmmword [rbp - 1], xmm0
mov qword [rbp + 0xf], r14
lea rax, [rbp - 0x29]
mov qword [rbp + 0x17], r14
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], r14w
jne 0x14008b140
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 1]
call fcn.140082e60
lea rcx, [rbp - 1]
call fcn.140088250
test eax, eax
je 0x14008b23a
mov dword [rbp - 0x59], 0x5602561d
mov rcx, r14
mov dword [rbp - 0x55], 0x56085603
mov dword [rbp - 0x51], 0x563f561d
mov dword [rbp - 0x4d], 0x56295639
mov dword [rbp - 0x49], 0x5639563a
mov dword [rbp - 0x45], 0x5612563a
mov dword [rbp - 0x41], 0x56145632
mov dword [rbp - 0x3d], 0x564a5600
mov dword [rbp - 0x39], 0x561e5600
mov dword [rbp - 0x35], 0x5602
mov byte [rbp - 0x31], 1
nop word [rax + rax]
lea eax, [rsi + rcx]
xor word [rbp + rcx*2 - 0x59], ax
inc rcx
cmp rcx, 0x13
jb 0x14008b1c0
xorps xmm0, xmm0
mov byte [rbp - 0x31], r14b
movups xmmword [rbp - 0x29], xmm0
mov qword [rbp - 0x19], r14
lea rax, [rbp - 0x59]
mov qword [rbp - 0x11], r14
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], r14w
jne 0x14008b1f0
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x29]
call fcn.140082e60
lea rcx, [rbp - 0x29]
call fcn.140088250
xor edx, edx
mov r8d, eax
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x14008b23a
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp - 0x59], 0x5602561d
mov rcx, r14
mov dword [rbp - 0x55], 0x56085603
mov dword [rbp - 0x51], 0x563f561d
mov dword [rbp - 0x4d], 0x56295639
mov dword [rbp - 0x49], 0x5639563a
mov dword [rbp - 0x45], 0x5612563a
mov dword [rbp - 0x41], 0x56145632
mov dword [rbp - 0x3d], 0x564a5600
mov dword [rbp - 0x39], 0x561e5600
mov dword [rbp - 0x35], 0x5602
mov byte [rbp - 0x31], 1
nop word [rax + rax]
lea eax, [rsi + rcx]
xor word [rbp + rcx*2 - 0x59], ax
inc rcx
cmp rcx, 0x13
jb 0x14008b290
xorps xmm0, xmm0
mov byte [rbp - 0x31], r14b
movups xmmword [rbp - 1], xmm0
mov qword [rbp + 0xf], r14
lea rax, [rbp - 0x59]
mov qword [rbp + 0x17], r14
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], r14w
jne 0x14008b2c0
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 1]
call fcn.140082e60
lea rcx, [rbp - 1]
call fcn.140088250
test eax, eax
je 0x14008b3ba
mov dword [rbp - 0x59], 0x5602561d
mov rcx, r14
mov dword [rbp - 0x55], 0x56085603
mov dword [rbp - 0x51], 0x563f561d
mov dword [rbp - 0x4d], 0x56295639
mov dword [rbp - 0x49], 0x5639563a
mov dword [rbp - 0x45], 0x5612563a
mov dword [rbp - 0x41], 0x56145632
mov dword [rbp - 0x3d], 0x564a5600
mov dword [rbp - 0x39], 0x561e5600
mov dword [rbp - 0x35], 0x5602
mov byte [rbp - 0x31], 1
nop word [rax + rax]
lea eax, [rsi + rcx]
xor word [rbp + rcx*2 - 0x59], ax
inc rcx
cmp rcx, 0x13
jb 0x14008b340
xorps xmm0, xmm0
mov byte [rbp - 0x31], r14b
movups xmmword [rbp - 0x29], xmm0
mov qword [rbp - 0x19], r14
lea rax, [rbp - 0x59]
mov qword [rbp - 0x11], r14
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], r14w
jne 0x14008b370
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x29]
call fcn.140082e60
lea rcx, [rbp - 0x29]
call fcn.140088250
xor edx, edx
mov r8d, eax
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x14008b3ba
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp - 0x29], 0x5602561d
mov rcx, r14
mov dword [rbp - 0x25], 0x56085603
mov dword [rbp - 0x21], 0x563f561d
mov dword [rbp - 0x1d], 0x56295639
mov dword [rbp - 0x19], 0x5639563a
mov dword [rbp - 0x15], 0x5612563a
mov dword [rbp - 0x11], 0x562b5634
mov dword [rbp - 0xd], 0x5601564d
mov dword [rbp - 9], 0x5603561d
mov word [rbp - 5], r14w
mov byte [rbp - 3], 1
nop word [rax + rax]
lea eax, [rsi + rcx]
xor word [rbp + rcx*2 - 0x29], ax
inc rcx
cmp rcx, 0x12
jb 0x14008b410
xorps xmm0, xmm0
mov byte [rbp - 3], r14b
movups xmmword [rbp - 1], xmm0
mov qword [rbp + 0xf], r14
lea rax, [rbp - 0x29]
mov qword [rbp + 0x17], r14
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], r14w
jne 0x14008b440
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 1]
call fcn.140082e60
lea rcx, [rbp - 1]
call fcn.140088250
test eax, eax
je 0x14008b53d
mov dword [rbp - 0x59], 0x5602561d
mov rcx, r14
mov dword [rbp - 0x55], 0x56085603
mov dword [rbp - 0x51], 0x563f561d
mov dword [rbp - 0x4d], 0x56295639
mov dword [rbp - 0x49], 0x5639563a
mov dword [rbp - 0x45], 0x5612563a
mov dword [rbp - 0x41], 0x56145632
mov dword [rbp - 0x3d], 0x564a5600
mov dword [rbp - 0x39], 0x561e5600
mov dword [rbp - 0x35], 0x5602
mov byte [rbp - 0x31], 1
nop word [rax + rax]
lea eax, [rsi + rcx]
xor word [rbp + rcx*2 - 0x59], ax
inc rcx
cmp rcx, 0x13
jb 0x14008b4c0
xorps xmm0, xmm0
mov byte [rbp - 0x31], r14b
movups xmmword [rbp - 0x29], xmm0
mov qword [rbp - 0x19], r14
lea rax, [rbp - 0x59]
mov qword [rbp - 0x11], r14
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], r14w
jne 0x14008b4f0
mov r8, rbx
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x29]
call fcn.140082e60
lea rcx, [rbp - 0x29]
call fcn.140088250
xor edx, edx
mov r8d, eax
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14008b53d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret