Function at 0x14000af14
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1400399a8]
xor rax, rsp
mov qword [rbp - 8], rax
movzx r11d, word [0x1400390e0]
mov r13, rdx
mov dword [rbp - 0x44], 0xf4
xor ebx, ebx
mov dword [rbp - 0x44], 0xe626
mov r12d, r8d
mov r10d, dword [0x1400390e4]
mov r9d, dword [0x140039128]
mov qword [rbp - 0x38], 0xafd
mov al, byte [0x140039066]
mov byte [rbp - 0x60], al
movdqa xmm0, xmmword [str.cm_a_ocsm_a12]
mov qword [rbp - 0x30], 0x165c7ac5
mov byte [rbp - 0x50], 0xd7
mov dword [rbp - 0x48], 0x6ba695c2
mov rdx, qword [0x140039100]
movzx eax, word [0x140039118]
movzx r8d, word [0x14003912c]
mov word [rbp - 0x54], ax
mov eax, 0x7f93
mov word [rbp - 0x5c], ax
mov eax, 0xc5
mov word [rbp - 0x58], ax
mov r15d, dword [0x140039170]
movzx eax, word [0x140039160]
movzx r14d, word [0x140039164]
mov word [rbp - 0x48], ax
movsxd rax, dword [0x140039128]
mov qword [rbp - 0x40], rax
mov rax, qword [0x1400390d8]
mov qword [rbp - 0x50], rax
mov eax, 0xd0
mov word [rbp - 0x50], ax
mov eax, 0xf6fa
mov word [rbp - 0x50], ax
mov byte [rbp - 0x50], 0x44
mov eax, dword [0x1400390f8]
mov qword [rbp - 0x50], 0xd600
mov eax, dword [0x140039128]
mov word [rbp - 0x50], ax
mov rax, qword [0x1400390f0]
mov word [rbp - 0x50], ax
mov byte [rbp - 0x50], 0x89
mov rax, qword [0x140039110]
mov byte [rbp - 0x50], al
mov eax, dword [0x140039148]
mov dword [rbp - 0x50], 0x9f
mov eax, dword [0x1400390f8]
add eax, 0x6ae4
mov dword [rbp - 0x18], 0x6d5c2d2c
movdqu xmmword [rbp - 0x28], xmm0
mov dword [rbp - 0x14], 0x5c645e5b
mov word [rbp - 0x10], 0x5e6d
mov byte [rbp - 0xe], bl
mov dword [0x140039170], eax
movzx eax, word [0x14003911c]
mov rax, qword gs:[0x30]
movsx esi, dl
shl esi, 5
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x18]
mov rcx, qword [rax + 0x20]
mov rdi, qword [rcx]
test r9d, r9d
je 0x14000b0ac
lea eax, [rbx + 3]
mov word [rbp - 0x58], ax
jmp 0x14000b0ee
movsx ecx, word [rbp - 0x5c]
mov eax, r11d
not eax
cmp ecx, eax
jne 0x14000b0cc
movzx eax, r10w
mov ecx, 0xbc98
sub ecx, eax
add dword [0x140039108], ecx
jmp 0x14000b0ee
cmp word [0x140039118], bx
mov edx, ebx
movsx eax, word [rbp - 0x5c]
sete dl
cmp eax, edx
je 0x14000b0ee
lea eax, [r8 - 0x35e37896]
mov qword [0x140039158], rax
mov eax, 4
lea rbx, [rdi - 0x10]
mov word [0x1400390fc], ax
mov r9d, dword [0x140039148]
movsx eax, word [0x1400390fc]
mov ecx, eax
test eax, eax
je 0x14000b164
sub ecx, 1
je 0x14000b14c
sub ecx, 1
je 0x14000b182
sub ecx, 1
je 0x14000b13c
cmp ecx, 1
jne 0x14000b182
movsx ecx, word [rbp - 0x48]
add ecx, 0x30
dec qword [0x140039120]
mov dword [0x140039150], ecx
jmp 0x14000b182
mov rax, qword [0x140039110]
xor word [0x140039154], ax
jmp 0x14000b182
movzx eax, word [0x14003912c]
mov ecx, 0x5fd5
sub ax, cx
mov word [0x140039160], ax
jmp 0x14000b182
mov eax, dword [rbp - 0x44]
mov rcx, qword [0x140039100]
mov rax, qword [0x140039100]
add rcx, rax
add rcx, r14
mov qword [0x140039100], rcx
test esi, esi
je 0x14000b18b
test r15, r15
jne 0x14000b1c3
mov r8, qword [rbp - 0x30]
xor edx, edx
movzx ecx, word [0x140039154]
mov eax, 0x1c95
cmp r9w, ax
movzx eax, word [0x140039118]
sete dl
sub ecx, eax
or eax, 0xffffffff
cmp rdx, r8
cmove eax, ecx
test eax, eax
je 0x14000b1c3
mov eax, 0xffff8e58
mov word [rbp - 0x58], ax
movzx eax, word [rbp - 0x54]
jmp 0x14000b1eb
mov rcx, qword [rbx + 0x60]
call fcn.14000a778
cmp eax, 0x18cf5f14
je 0x14000b21f
mov rcx, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rbx, qword [rbx]
add rcx, rax
mov qword [rbp - 0x40], rcx
cmp qword [rbx], rdi
jne 0x14000b1c9
xor eax, eax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14001e2d0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
movzx eax, word [rbp - 0x5c]
mov al, byte [0x140039015]
movzx eax, word [rbp - 0x58]
mov rax, qword [rbp - 0x38]
mov eax, dword [0x1400390f8]
mov rcx, qword [rbp - 0x38]
mov edx, dword [0x140039130]
mov eax, edx
sub eax, ecx
mov byte [0x14003903e], 1
movsx ecx, byte [0x14003903e]
or edx, eax
mov dword [0x140039130], edx
test ecx, ecx
je 0x14000b28b
cmp ecx, 1
jne 0x14000b293
movzx eax, word [rbp - 0x54]
mov ecx, 0x2b8d
add eax, 0x2ad5bb75
mov dword [0x140039128], eax
mov rax, qword [0x140039100]
sub ax, cx
mov word [0x140039160], ax
jmp 0x14000b293
mov qword [rbp - 0x40], 0x49702568
mov edx, dword [rbx + 0x40]
mov r9d, r12d
mov rcx, qword [rbx + 0x30]
mov r8, r13
call fcn.14000a140
mov cl, byte [rbp - 0x60]
jmp 0x14000b1f2