Function at 0x140010b80
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xe0
mov rax, qword gs:[0x58]
lea r12, str.sZrrA
mov ebx, 4
xor r15d, r15d
mov rsi, rdx
mov r14, rcx
mov rax, qword [rax]
mov eax, dword [rbx + rax]
cmp dword [0x14005f498], eax
jle 0x140010ccf
lea rcx, [0x14005f498]
call fcn.14001da38
cmp dword [0x14005f498], 0xffffffff
jne 0x140010ccf
xor eax, eax
mov dword [rsp + 0x20], 0x41437443
xorps xmm0, xmm0
mov dword [rbp - 0x70], eax
movups xmmword [rbp - 0x80], xmm0
mov byte [rbp - 0x6c], al
mov edx, r15d
mov dword [rsp + 0x24], 0x50233b72
mov ecx, r15d
mov byte [rsp + 0x28], 0x78
nop dword [rax]
cdqe
movsxd rcx, ecx
movzx eax, byte [rax + r12]
xor byte [rsp + rcx + 0x20], al
lea eax, [rdx + 1]
mov edx, eax
mov ecx, eax
cmp eax, 9
jb 0x140010c10
xorps xmm0, xmm0
mov dword [0x14005eb78], eax
xorps xmm1, xmm1
mov byte [rbp - 0x80], r15b
movups xmmword [rbp - 0x69], xmm0
lea rax, [rsp + 0x20]
mov r8, 0xffffffffffffffff
movdqu xmmword [rbp - 0x59], xmm1
nop
inc r8
cmp byte [rax + r8], r15b
jne 0x140010c50
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x69]
call fcn.14001b810
cmp qword [rbp - 0x51], 0xf
lea rcx, [rbp - 0x69]
cmova rcx, qword [rbp - 0x69]
call fcn.14002cf8c
mov rdx, qword [rbp - 0x51]
cvttsd2si eax, xmm0
movsxd rcx, eax
mov qword [0x14005f3e0], rcx
cmp rdx, 0xf
jbe 0x140010cc3
mov rcx, qword [rbp - 0x69]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010cbe
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001177d
call fcn.14001dd34
lea rcx, [0x14005f498]
call fcn.14001d9cc
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rbx + rcx]
cmp dword [0x14005f4d8], eax
jle 0x140010def
lea rcx, [0x14005f4d8]
call fcn.14001da38
cmp dword [0x14005f4d8], 0xffffffff
jne 0x140010def
xor eax, eax
mov dword [rsp + 0x20], 0x41437443
xorps xmm0, xmm0
mov dword [rbp - 0x70], eax
movups xmmword [rbp - 0x80], xmm0
mov byte [rbp - 0x6c], al
mov edx, r15d
mov dword [rsp + 0x24], 0x50233b72
mov ecx, r15d
mov byte [rsp + 0x28], 0x78
nop dword [rax]
cdqe
movsxd rcx, ecx
movzx eax, byte [rax + r12]
xor byte [rsp + rcx + 0x20], al
lea eax, [rdx + 1]
mov edx, eax
mov ecx, eax
cmp eax, 9
jb 0x140010d30
xorps xmm0, xmm0
mov dword [0x14005eb78], eax
xorps xmm1, xmm1
mov byte [rbp - 0x80], r15b
movups xmmword [rbp - 0x69], xmm0
lea rax, [rsp + 0x20]
mov r8, 0xffffffffffffffff
movdqu xmmword [rbp - 0x59], xmm1
nop
inc r8
cmp byte [rax + r8], r15b
jne 0x140010d70
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x69]
call fcn.14001b810
cmp qword [rbp - 0x51], 0xf
lea rcx, [rbp - 0x69]
cmova rcx, qword [rbp - 0x69]
call fcn.14002cf8c
mov rdx, qword [rbp - 0x51]
cvttsd2si eax, xmm0
movsxd rcx, eax
mov qword [0x14005f6a8], rcx
cmp rdx, 0xf
jbe 0x140010de3
mov rcx, qword [rbp - 0x69]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010dde
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011783
call fcn.14001dd34
lea rcx, [0x14005f4d8]
call fcn.14001d9cc
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rbx + rcx]
cmp dword [0x14005f4e8], eax
jle 0x140010e33
lea rcx, [0x14005f4e8]
call fcn.14001da38
cmp dword [0x14005f4e8], 0xffffffff
jne 0x140010e33
lea rcx, [0x1400447e0]
call fcn.14001dd14
lea rcx, [0x14005f4e8]
call fcn.14001d9cc
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rbx + rcx]
cmp dword [0x14005f4fc], eax
jle 0x140010e77
lea rcx, [0x14005f4fc]
call fcn.14001da38
cmp dword [0x14005f4fc], 0xffffffff
jne 0x140010e77
lea rcx, [0x140044760]
call fcn.14001dd14
lea rcx, [0x14005f4fc]
call fcn.14001d9cc
xor eax, eax
mov dword [rsp + 0x20], 0x41437443
xorps xmm0, xmm0
mov dword [rbp - 0x70], eax
movups xmmword [rbp - 0x80], xmm0
mov byte [rbp - 0x6c], al
mov edx, r15d
mov dword [rsp + 0x24], 0x50233b72
mov ecx, r15d
mov byte [rsp + 0x28], 0x78
cdqe
movsxd rcx, ecx
movzx eax, byte [rax + r12]
xor byte [rsp + rcx + 0x20], al
lea eax, [rdx + 1]
mov edx, eax
mov ecx, eax
cmp eax, 9
jb 0x140010ea1
xorps xmm0, xmm0
mov dword [0x14005eb78], eax
xorps xmm1, xmm1
mov byte [rbp - 0x80], r15b
movups xmmword [rbp - 0x69], xmm0
lea rax, [rsp + 0x20]
mov r8, 0xffffffffffffffff
movdqu xmmword [rbp - 0x59], xmm1
inc r8
cmp byte [rax + r8], r15b
jne 0x140010ee0
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x69]
call fcn.14001b810
cmp qword [rbp - 0x51], 0xf
lea rcx, [rbp - 0x69]
cmova rcx, qword [rbp - 0x69]
call fcn.14002cf8c
mov rdx, qword [rbp - 0x51]
cvttsd2si eax, xmm0
movsxd rcx, eax
mov qword [0x14005f3e0], rcx
cmp rdx, 0xf
jbe 0x140010f53
mov rcx, qword [rbp - 0x69]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010f4e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011789
call fcn.14001dd34
mov rax, qword [0x14005f398]
mov rcx, qword [0x14005f390]
cmp rcx, rax
je 0x140010f7f
mov rdx, rax
call fcn.14001a830
mov rcx, qword [0x14005f390]
mov qword [0x14005f398], rcx
mov rax, rcx
cmp rax, qword [0x14005f3a0]
mov qword [rsp + 0x118], rdi
mov qword [rsp + 0x120], r13
je 0x14001101f
cmp rcx, rax
jne 0x140011004
test rcx, rcx
je 0x14001101f
mov rdx, rax
call fcn.14001a830
mov rcx, qword [0x14005f390]
mov rdx, qword [0x14005f3a0]
mov rax, rcx
sub rdx, rcx
and rdx, 0xffffffffffffffe0
cmp rdx, 0x1000
jb 0x140010fe8
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400117b3
call fcn.14001dd34
mov qword [0x14005f390], r15
mov qword [0x14005f398], r15
mov qword [0x14005f3a0], r15
jmp 0x14001101f
sub rax, rcx
lea rdx, [rbp + 0x67]
sar rax, 5
lea rcx, [0x14005f390]
mov qword [rbp + 0x67], rax
call fcn.14001a8c0
xor r8d, r8d
lea rcx, [0x14005f390]
xor edx, edx
call fcn.14001aa30
lea r13, [0x140056de0]
nop word [rax + rax]
xorps xmm0, xmm0
mov word [rbp - 0x49], 0x7442
xor eax, eax
mov byte [rbp - 0x47], 0x47
movups xmmword [rbp - 0x46], xmm0
mov word [rbp + 0x2a], ax
mov edx, r15d
movups xmmword [rbp - 0x36], xmm0
mov ecx, r15d
movups xmmword [rbp - 0x26], xmm0
movups xmmword [rbp - 0x16], xmm0
movups xmmword [rbp - 6], xmm0
movups xmmword [rbp + 0xa], xmm0
movups xmmword [rbp + 0x1a], xmm0
nop word [rax + rax]
cdqe
movsxd rcx, ecx
movzx eax, byte [rax + r12]
xor byte [rbp + rcx - 0x49], al
lea eax, [rdx + 1]
mov edx, eax
mov ecx, eax
cmp eax, 3
jb 0x140011080
xorps xmm0, xmm0
mov dword [0x14005e350], eax
movups xmmword [rsp + 0x20], xmm0
mov byte [rbp - 0x46], r15b
lea rax, [rbp - 0x49]
mov qword [rbp - 0x79], r15
mov r8, 0xffffffffffffffff
mov qword [rbp - 0x71], r15
nop
inc r8
cmp byte [rax + r8], r15b
jne 0x1400110c0
lea rdx, [rbp - 0x49]
lea rcx, [rsp + 0x20]
call fcn.14001b810
cmp qword [rbp - 0x71], 0xf
lea rcx, [rsp + 0x20]
cmova rcx, qword [rsp + 0x20]
call fcn.14002cf8c
mov rdx, qword [rbp - 0x71]
cvttsd2si ebx, xmm0
cmp rdx, 0xf
jbe 0x14001112c
mov rcx, qword [rsp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011127
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001178f
call fcn.14001dd34
test ebx, ebx
je 0x14001164f
mov rdx, qword [0x14005f3e0]
lea rcx, [rbp - 0x69]
call fcn.14000e920
mov rbx, rax
cmp r13, rax
je 0x1400111d5
mov rdx, qword [reloc.OLEAUT32.dll_VariantInit]
cmp rdx, 7
jbe 0x140011196
mov rcx, qword [0x140056de0]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011191
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011795
call fcn.14001dd34
mov qword [0x140056df0], r15
mov qword [reloc.OLEAUT32.dll_VariantInit], 7
mov word [0x140056de0], r15w
movups xmm0, xmmword [rbx]
movups xmmword [0x140056de0], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [0x140056df0], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
mov rdx, qword [rbp - 0x51]
cmp rdx, 7
jbe 0x140011215
mov rcx, qword [rbp - 0x69]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011210
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011795
call fcn.14001dd34
xorps xmm0, xmm0
mov word [rbp - 0x49], 0x7442
xor eax, eax
mov byte [rbp - 0x47], 0x47
cmp qword [0x140056df0], rax
mov edx, r15d
movups xmmword [rbp - 0x46], xmm0
sete dil
mov word [rbp + 0x2a], ax
movups xmmword [rbp - 0x36], xmm0
mov ecx, r15d
movups xmmword [rbp - 0x26], xmm0
movups xmmword [rbp - 0x16], xmm0
movups xmmword [rbp - 6], xmm0
movups xmmword [rbp + 0xa], xmm0
movups xmmword [rbp + 0x1a], xmm0
nop word [rax + rax]
cdqe
movsxd rcx, ecx
movzx eax, byte [rax + r12]
xor byte [rbp + rcx - 0x49], al
lea eax, [rdx + 1]
mov edx, eax
mov ecx, eax
cmp eax, 3
jb 0x140011260
xorps xmm0, xmm0
mov dword [0x14005e350], eax
movups xmmword [rsp + 0x20], xmm0
mov byte [rbp - 0x46], r15b
lea rax, [rbp - 0x49]
mov qword [rbp - 0x79], r15
mov r8, 0xffffffffffffffff
mov qword [rbp - 0x71], r15
nop
inc r8
cmp byte [rax + r8], r15b
jne 0x1400112a0
lea rdx, [rbp - 0x49]
lea rcx, [rsp + 0x20]
call fcn.14001b810
cmp qword [rbp - 0x71], 0xf
lea rcx, [rsp + 0x20]
cmova rcx, qword [rsp + 0x20]
call fcn.14002cf8c
mov rdx, qword [rbp - 0x71]
cvttsd2si eax, xmm0
test eax, eax
sete bl
cmp rdx, 0xf
jbe 0x140011311
mov rcx, qword [rsp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001130c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001179b
call fcn.14001dd34
cmp bl, dil
je 0x14001151f
xorps xmm0, xmm0
mov word [rbp - 0x49], 0x7442
xor eax, eax
mov byte [rbp - 0x47], 0x47
movups xmmword [rbp - 0x46], xmm0
mov word [rbp + 0x2a], ax
mov edx, r15d
movups xmmword [rbp - 0x36], xmm0
mov ecx, r15d
movups xmmword [rbp - 0x26], xmm0
movups xmmword [rbp - 0x16], xmm0
movups xmmword [rbp - 6], xmm0
movups xmmword [rbp + 0xa], xmm0
movups xmmword [rbp + 0x1a], xmm0
nop
cdqe
movsxd rcx, ecx
movzx eax, byte [rax + r12]
xor byte [rbp + rcx - 0x49], al
lea eax, [rdx + 1]
mov edx, eax
mov ecx, eax
cmp eax, 3
jb 0x140011350
xorps xmm0, xmm0
mov dword [0x14005e350], eax
movups xmmword [rsp + 0x20], xmm0
mov byte [rbp - 0x46], r15b
lea rax, [rbp - 0x49]
mov qword [rbp - 0x79], r15
mov r8, 0xffffffffffffffff
mov qword [rbp - 0x71], r15
nop
inc r8
cmp byte [rax + r8], r15b
jne 0x140011390
lea rdx, [rbp - 0x49]
lea rcx, [rsp + 0x20]
call fcn.14001b810
cmp qword [rbp - 0x71], 0xf
lea rcx, [rsp + 0x20]
cmova rcx, qword [rsp + 0x20]
call fcn.14002cf8c
mov rdx, qword [rbp - 0x71]
cvttsd2si eax, xmm0
movsxd rcx, eax
mov rax, qword [0x14005f6a8]
add rax, rcx
mov qword [0x14005f6a8], rax
cmp rdx, 0xf
jbe 0x140011417
mov rcx, qword [rsp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001140b
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400117a1
call fcn.14001dd34
mov rax, qword [0x14005f6a8]
cmp rax, rsi
jae 0x14001164f
xorps xmm0, xmm0
mov word [rbp - 0x49], 0x7442
xor eax, eax
mov byte [rbp - 0x47], 0x47
movups xmmword [rbp - 0x46], xmm0
mov word [rbp + 0x2a], ax
mov edx, r15d
movups xmmword [rbp - 0x36], xmm0
mov ecx, r15d
movups xmmword [rbp - 0x26], xmm0
movups xmmword [rbp - 0x16], xmm0
movups xmmword [rbp - 6], xmm0
movups xmmword [rbp + 0xa], xmm0
movups xmmword [rbp + 0x1a], xmm0
nop word [rax + rax]
cdqe
movsxd rcx, ecx
movzx eax, byte [rax + r12]
xor byte [rbp + rcx - 0x49], al
lea eax, [rdx + 1]
mov edx, eax
mov ecx, eax
cmp eax, 3
jb 0x140011460
xorps xmm0, xmm0
mov dword [0x14005e350], eax
movups xmmword [rsp + 0x20], xmm0
mov byte [rbp - 0x46], r15b
lea rax, [rbp - 0x49]
mov qword [rbp - 0x79], r15
mov r8, 0xffffffffffffffff
mov qword [rbp - 0x71], r15
nop
inc r8
cmp byte [rax + r8], r15b
jne 0x1400114a0
lea rdx, [rbp - 0x49]
lea rcx, [rsp + 0x20]
call fcn.14001b810
cmp qword [rbp - 0x71], 0xf
lea rcx, [rsp + 0x20]
cmova rcx, qword [rsp + 0x20]
call fcn.14002cf8c
mov rdx, qword [rbp - 0x71]
cvttsd2si eax, xmm0
movsxd rcx, eax
add qword [0x14005f3e0], rcx
cmp rdx, 0xf
jbe 0x140011040
mov rcx, qword [rsp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011515
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400117a7
call fcn.14001dd34
jmp 0x140011040
mov rax, qword [0x14005f398]
cmp rax, qword [0x14005f3a0]
je 0x140011544
mov rdx, r13
mov rcx, rax
call fcn.1400190e0
add qword [0x14005f398], 0x20
jmp 0x140011556
mov r8, r13
lea rcx, [0x14005f390]
mov rdx, rax
call fcn.14001c370
xorps xmm0, xmm0
mov word [rbp - 0x49], 0x7442
xor eax, eax
mov byte [rbp - 0x47], 0x47
movups xmmword [rbp - 0x46], xmm0
mov word [rbp + 0x2a], ax
mov edx, r15d
movups xmmword [rbp - 0x36], xmm0
mov ecx, r15d
movups xmmword [rbp - 0x26], xmm0
movups xmmword [rbp - 0x16], xmm0
movups xmmword [rbp - 6], xmm0
movups xmmword [rbp + 0xa], xmm0
movups xmmword [rbp + 0x1a], xmm0
nop dword [rax + rax]
cdqe
movsxd rcx, ecx
movzx eax, byte [rax + r12]
xor byte [rbp + rcx - 0x49], al
lea eax, [rdx + 1]
mov edx, eax
mov ecx, eax
cmp eax, 3
jb 0x140011590
xorps xmm0, xmm0
mov dword [0x14005e350], eax
movups xmmword [rsp + 0x20], xmm0
mov byte [rbp - 0x46], r15b
lea rax, [rbp - 0x49]
mov qword [rbp - 0x79], r15
mov r8, 0xffffffffffffffff
mov qword [rbp - 0x71], r15
nop
inc r8
cmp byte [rax + r8], r15b
jne 0x1400115d0
lea rdx, [rbp - 0x49]
lea rcx, [rsp + 0x20]
call fcn.14001b810
cmp qword [rbp - 0x71], 0xf
lea rcx, [rsp + 0x20]
cmova rcx, qword [rsp + 0x20]
call fcn.14002cf8c
mov rdx, qword [rbp - 0x71]
cvttsd2si eax, xmm0
movsxd rcx, eax
add qword [0x14005f3e0], rcx
cmp rdx, 0xf
jbe 0x140011040
mov rcx, qword [rsp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011645
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400117ad
call fcn.14001dd34
jmp 0x140011040
mov rax, qword [0x14005f398]
mov rdx, qword [0x14005f3a0]
cmp rax, rdx
je 0x1400116d6
mov rcx, qword [0x14005f390]
cmp rcx, rax
jne 0x1400116bb
test rcx, rcx
je 0x1400116d6
sub rdx, rcx
mov rax, rcx
and rdx, 0xffffffffffffffe0
cmp rdx, 0x1000
jb 0x14001169f
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400117b3
call fcn.14001dd34
mov qword [0x14005f390], r15
mov qword [0x14005f398], r15
mov qword [0x14005f3a0], r15
jmp 0x1400116d6
sub rax, rcx
lea rdx, [rbp + 0x67]
sar rax, 5
lea rcx, [0x14005f390]
mov qword [rbp + 0x67], rax
call fcn.14001a8c0
mov qword [r14], r15
mov qword [r14 + 8], r15
mov qword [r14 + 0x10], r15
mov rdx, qword [0x14005f398]
sub rdx, qword [0x14005f390]
sar rdx, 5
test rdx, rdx
je 0x14001174c
movabs rax, 0x7ffffffffffffff
cmp rdx, rax
ja 0x140011777
mov rcx, r14
call fcn.14001c000
mov rsi, qword [0x14005f398]
mov rbx, qword [0x14005f390]
mov rdi, qword [r14]
cmp rbx, rsi
je 0x14001173d
mov rdx, rbx
mov rcx, rdi
call fcn.1400190e0
add rdi, 0x20
add rbx, 0x20
cmp rbx, rsi
jne 0x140011725
mov rdx, rdi
mov rcx, rdi
call fcn.14001a830
mov qword [r14 + 8], rdi
mov rdi, qword [rsp + 0x118]
mov rax, r14
mov r13, qword [rsp + 0x120]
mov rbx, qword [rsp + 0x128]
add rsp, 0xe0
pop r15
pop r14
pop r12
pop rsi
pop rbp
ret
call fcn.14001bfe0
int3
call fcn.140023db8
int3
call fcn.140023db8
int3
call fcn.140023db8
int3
call fcn.140023db8
int3
call fcn.140023db8
int3
call fcn.140023db8
int3
call fcn.140023db8
int3
call fcn.140023db8
int3
call fcn.140023db8
int3
call fcn.140023db8
int3