Function at 0x140001c70
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
xor eax, eax
mov dword [rbp + 0x18], 0x4949576d
xor ebx, ebx
mov byte [rbp + 0x1c], al
mov edx, ebx
mov rdi, rcx
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rbp + 0x18]
add rcx, rax
lea eax, [rdx + 0x24]
inc edx
xor byte [rcx], al
cmp edx, 4
jb 0x140001ca0
mov rcx, rdi
mov byte [rbp + 0x1c], bl
call fcn.140001b90
lea rdx, [rbp + 0x18]
mov rcx, rax
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x140001ce8
mov eax, 9
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret
mov dword [rbp + 0x18], 0x49495760
mov edx, ebx
mov word [rbp + 0x1c], 0x4d
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rbp + 0x18]
add rcx, rax
lea eax, [rdx + 0x24]
inc edx
xor byte [rcx], al
cmp edx, 5
jb 0x140001d00
mov rcx, rdi
mov byte [rbp + 0x1d], bl
call fcn.140001b90
lea rdx, [rbp + 0x18]
mov rcx, rax
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x140001d48
mov eax, 0xc
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret
xor eax, eax
mov dword [rbp - 0x30], 0x55545070
mov byte [rbp - 0x26], al
mov edx, ebx
mov dword [rbp - 0x2c], 0x4a7d5d4d
mov word [rbp - 0x28], 0x4140
nop dword [rax]
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rbp - 0x30]
add rcx, rax
lea eax, [rdx + 0x24]
inc edx
xor byte [rcx], al
cmp edx, 0xa
jb 0x140001d70
mov rcx, rdi
mov byte [rbp - 0x26], bl
call fcn.140001b90
lea rdx, [rbp - 0x30]
mov rcx, rax
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x140001db8
mov eax, 0x2f
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret
xor eax, eax
mov dword [rbp - 0x30], 0x55545070
mov byte [rbp - 0x26], al
mov edx, ebx
mov dword [rbp - 0x2c], 0x4e695d4d
mov word [rbp - 0x28], 0x4145
nop dword [rax]
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rbp - 0x30]
add rcx, rax
lea eax, [rdx + 0x24]
inc edx
xor byte [rcx], al
cmp edx, 0xa
jb 0x140001de0
mov rcx, rdi
mov byte [rbp - 0x26], bl
call fcn.140001b90
lea rdx, [rbp - 0x30]
mov rcx, rax
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x140001e28
mov eax, 0x4e
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret
movdqa xmm0, xmmword [str.pPTUM_lGCBpqb_]
mov edx, ebx
movdqu xmmword [rbp - 0x30], xmm0
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rbp - 0x30]
add rcx, rax
lea eax, [rdx + 0x24]
inc edx
xor byte [rcx], al
cmp edx, 0xf
jb 0x140001e40
mov rcx, rdi
mov byte [rbp - 0x21], bl
call fcn.140001b90
lea rdx, [rbp - 0x30]
mov rcx, rax
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
jne 0x140002328
movdqa xmm0, xmmword [str.pPTUM_uj]
mov edx, ebx
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x10], 0x40
nop dword [rax]
movsxd rax, edx
lea rcx, [rbp - 0x20]
add rcx, rax
lea eax, [rdx + 0x24]
inc edx
xor byte [rcx], al
cmp edx, 0x11
jb 0x140001e90
mov rcx, rdi
mov byte [rbp - 0xf], bl
call fcn.140001b90
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
jne 0x140002328
mov dword [rbp - 0x30], 0x6f647467
mov edx, ebx
mov dword [rbp - 0x2c], 0x525c484d
mov byte [rbp - 0x28], al
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rbp - 0x30]
add rcx, rax
lea eax, [rdx + 0x24]
inc edx
xor byte [rcx], al
cmp edx, 8
jb 0x140001ee0
mov rcx, rdi
mov byte [rbp - 0x28], bl
call fcn.140001b90
lea rdx, [rbp - 0x30]
mov rcx, rax
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
jne 0x140002313
mov dword [rbp - 0x30], 0x6f616877
mov edx, ebx
mov dword [rbp - 0x2c], 0x525c484d
mov byte [rbp - 0x28], al
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rbp - 0x30]
add rcx, rax
lea eax, [rdx + 0x24]
inc edx
xor byte [rcx], al
cmp edx, 8
jb 0x140001f30
mov rcx, rdi
mov byte [rbp - 0x28], bl
call fcn.140001b90
lea rdx, [rbp - 0x30]
mov rcx, rax
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
jne 0x140002313
movdqa xmm0, xmmword [0x14000bc40]
mov edx, ebx
movdqu xmmword [rbp - 0x30], xmm0
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rbp - 0x30]
add rcx, rax
lea eax, [rdx + 0x24]
inc edx
xor byte [rcx], al
cmp edx, 0xf
jb 0x140001f80
mov rcx, rdi
mov byte [rbp - 0x21], bl
call fcn.140001b90
lea rdx, [rbp - 0x30]
mov rcx, rax
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
jne 0x1400022fe
movdqa xmm0, xmmword [str.pPTUM_lGCBps_p]
mov edx, ebx
movdqu xmmword [rbp - 0x30], xmm0
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rbp - 0x30]
add rcx, rax
lea eax, [rdx + 0x24]
inc edx
xor byte [rcx], al
cmp edx, 0xf
jb 0x140001fd0
mov rcx, rdi
mov byte [rbp - 0x21], bl
call fcn.140001b90
lea rdx, [rbp - 0x30]
mov rcx, rax
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
jne 0x1400022fe
mov dword [rbp - 0x30], 0x55545070
mov edx, ebx
mov dword [rbp - 0x2c], 0x5e625d4d
mov dword [rbp - 0x28], 0x6c715942
mov word [rbp - 0x24], 0x7361
mov byte [rbp - 0x22], al
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rbp - 0x30]
add rcx, rax
lea eax, [rdx + 0x24]
inc edx
xor byte [rcx], al
cmp edx, 0xe
jb 0x140002030
mov rcx, rdi
mov byte [rbp - 0x22], bl
call fcn.140001b90
lea rdx, [rbp - 0x30]
mov rcx, rax
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
jne 0x1400022fe
mov dword [rbp - 0x30], 0x55545070
mov edx, ebx
mov dword [rbp - 0x2c], 0x476c5d4d
mov dword [rbp - 0x28], 0x705c4243
mov word [rbp - 0x24], 0x565d
mov byte [rbp - 0x22], al
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rbp - 0x30]
add rcx, rax
lea eax, [rdx + 0x24]
inc edx
xor byte [rcx], al
cmp edx, 0xe
jb 0x140002090
mov rcx, rdi
mov byte [rbp - 0x22], bl
call fcn.140001b90
lea rdx, [rbp - 0x30]
mov rcx, rax
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
jne 0x1400022e9
mov dword [rbp - 0x30], 0x55545070
mov edx, ebx
mov dword [rbp - 0x2c], 0x476c5d4d
mov dword [rbp - 0x28], 0x705c4243
mov word [rbp - 0x24], 0x767d
mov byte [rbp - 0x22], al
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rbp - 0x30]
add rcx, rax
lea eax, [rdx + 0x24]
inc edx
xor byte [rcx], al
cmp edx, 0xe
jb 0x1400020f0
mov rcx, rdi
mov byte [rbp - 0x22], bl
call fcn.140001b90
lea rdx, [rbp - 0x30]
mov rcx, rax
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
jne 0x1400022e9
mov dword [rbp - 0x30], 0x55545070
mov edx, ebx
mov dword [rbp - 0x2c], 0x5e625d4d
mov dword [rbp - 0x28], 0x62715942
mov word [rbp - 0x24], 0x77
nop dword [rax]
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rbp - 0x30]
add rcx, rax
lea eax, [rdx + 0x24]
inc edx
xor byte [rcx], al
cmp edx, 0xd
jb 0x140002150
mov rcx, rdi
mov byte [rbp - 0x23], bl
call fcn.140001b90
lea rdx, [rbp - 0x30]
mov rcx, rax
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
jne 0x1400022e9
mov dword [rbp - 0x30], 0x55545070
mov edx, ebx
mov dword [rbp - 0x2c], 0x4a785d4d
mov dword [rbp - 0x28], 0x42714145
mov word [rbp - 0x24], 0x57
nop dword [rax]
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rbp - 0x30]
add rcx, rax
lea eax, [rdx + 0x24]
inc edx
xor byte [rcx], al
cmp edx, 0xd
jb 0x1400021b0
mov rcx, rdi
mov byte [rbp - 0x23], bl
call fcn.140001b90
lea rdx, [rbp - 0x30]
mov rcx, rax
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
jne 0x1400022e9
mov dword [rbp - 0x30], 0x55545070
mov edx, ebx
mov dword [rbp - 0x2c], 0x66755d4d
mov word [rbp - 0x28], 0x6b
nop dword [rax]
movsxd rax, edx
lea rcx, [rbp - 0x30]
add rcx, rax
lea eax, [rdx + 0x24]
inc edx
xor byte [rcx], al
cmp edx, 9
jb 0x140002200
mov rcx, rdi
mov byte [rbp - 0x27], bl
call fcn.140001b90
lea rdx, [rbp - 0x30]
mov rcx, rax
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
jne 0x1400022e9
movdqa xmm0, xmmword [str.l_GQQ_YHZQX]
mov edx, ebx
movdqu xmmword [rbp - 0x30], xmm0
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rbp - 0x30]
add rcx, rax
lea eax, [rdx + 0x24]
inc edx
xor byte [rcx], al
cmp edx, 0xf
jb 0x140002250
mov rcx, rdi
mov byte [rbp - 0x21], bl
call fcn.140001b90
lea rdx, [rbp - 0x30]
mov rcx, rax
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x140002298
mov eax, 0x34
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret
mov dword [rbp + 0x18], 0x626077
nop
movsxd rax, ebx
lea rcx, [rbp + 0x18]
add rcx, rax
lea eax, [rbx + 0x24]
inc ebx
xor byte [rcx], al
cmp ebx, 3
jb 0x1400022a0
mov rcx, rdi
mov byte [rbp + 0x1b], 0
call fcn.140001b90
lea rdx, [rbp + 0x18]
mov rcx, rax
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
jne 0x1400022fe
mov eax, 0xb
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret
mov eax, 0xf
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret
mov eax, 0x3a
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret
mov eax, 0xd
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret
mov rbx, qword [rsp + 0x60]
mov eax, 0x3e
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret