Function at 0x1400aa6a0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x2410]
mov eax, 0x2510
call fcn.1400ebf90
sub rsp, rax
lea r8, [rbp + 0x2448]
mov edx, 0x2000
lea rcx, [rbp + 0x410]
call qword [sym.imp.KERNEL32.dll_K32EnumDeviceDrivers]
test eax, eax
je 0x1400aab91
mov edx, dword [rbp + 0x2448]
cmp edx, 0x2000
jae 0x1400aab91
shr edx, 3
mov dword [rsp + 0x30], 0x5844455f
mov dword [rsp + 0x34], 0x48495c5b
mov dword [rsp + 0x38], 0x545d5c54
mov dword [rsp + 0x3c], 0x1003325
xor r14d, r14d
mov ecx, r14d
nop dword [rax]
lea eax, [rcx + 0x34]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0xe
jb 0x1400aa720
lea rax, [rsp + 0x30]
mov qword [rbp - 0x50], rax
movdqa xmm0, xmmword [0x14013e7d0]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x40], 0x100
mov rcx, r14
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x46]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0x10
jb 0x1400aa760
lea rax, [rsp + 0x30]
mov qword [rbp - 0x48], rax
movdqa xmm0, xmmword [0x14013e230]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x40], 1
mov rcx, r14
nop
lea eax, [rcx + 0x34]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0xf
jb 0x1400aa790
lea rax, [rsp + 0x30]
mov qword [rbp - 0x40], rax
movdqa xmm0, xmmword [0x14013e7d0]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x40], 0x100
mov rcx, r14
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x46]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0x10
jb 0x1400aa7d0
lea rax, [rsp + 0x30]
mov qword [rbp - 0x38], rax
mov dword [rsp + 0x30], 0x4742417c
mov dword [rsp + 0x34], 0x4e585c7c
mov word [rsp + 0x38], 0x5b
mov byte [rsp + 0x3a], 1
mov rcx, r14
nop dword [rax + rax]
lea eax, [rcx + 0x34]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 9
jb 0x1400aa810
lea rax, [rsp + 0x30]
mov qword [rbp - 0x30], rax
mov dword [rsp + 0x30], 0x7f404770
mov dword [rsp + 0x34], 0x7f4a4d4c
mov dword [rsp + 0x38], 0x584b5f59
mov word [rsp + 0x3c], 0x100
mov rcx, r14
nop dword [rax + rax]
lea eax, [rcx + 0x34]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0xc
jb 0x1400aa850
lea rax, [rsp + 0x30]
mov qword [rbp - 0x28], rax
movdqa xmm0, xmmword [0x14013e6f0]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0xaa9ebeae
mov word [rsp + 0x44], 0xa4
mov byte [rsp + 0x46], 1
mov rcx, r14
nop
lea eax, [rcx - 0x45]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0x15
jb 0x1400aa890
lea rax, [rsp + 0x30]
mov qword [rbp - 0x20], rax
mov dword [rbp + 0x2440], 0xeecac9fe
mov dword [rbp + 0x2444], 0x100d4da
mov rcx, r14
lea eax, [rcx - 0x46]
xor byte [rbp + rcx + 0x2440], al
inc rcx
cmp rcx, 6
jb 0x1400aa8c0
lea rax, [rbp + 0x2440]
mov qword [rbp - 0x18], rax
mov dword [rsp + 0x30], 0x56425c60
mov dword [rsp + 0x34], 0x5f537156
mov word [rsp + 0x38], 0x59
mov byte [rsp + 0x3a], 1
mov rcx, r14
nop dword [rax]
lea eax, [rcx + 0x34]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 9
jb 0x1400aa900
lea rax, [rsp + 0x30]
mov qword [rbp - 0x10], rax
mov dword [rsp + 0x30], 0x63404770
mov dword [rsp + 0x34], 0x555b4d51
mov dword [rsp + 0x38], 0x5a5a5474
mov word [rsp + 0x3c], 0x100
mov rcx, r14
nop dword [rax + rax]
lea eax, [rcx + 0x34]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0xc
jb 0x1400aa940
lea rax, [rsp + 0x30]
mov qword [rbp - 8], rax
mov dword [rsp + 0x30], 0x45575d67
mov dword [rsp + 0x34], 0x647e7648
mov dword [rsp + 0x38], 0x484f78
mov byte [rsp + 0x3c], 1
mov rcx, r14
nop dword [rax]
lea eax, [rcx + 0x34]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0xb
jb 0x1400aa980
lea rax, [rsp + 0x30]
mov qword [rbp], rax
mov dword [rsp + 0x30], 0x64404770
mov dword [rsp + 0x34], 0x4b485850
mov word [rsp + 0x38], 0x100
mov rcx, r14
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x34]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 8
jb 0x1400aa9c0
lea rax, [rsp + 0x30]
mov qword [rbp + 8], rax
mov esi, edx
test edx, edx
je 0x1400aab91
mov rdi, r14
mov r8d, 0x400
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + rdi*8 + 0x410]
call qword [sym.imp.KERNEL32.dll_K32GetDeviceDriverBaseNameA]
test eax, eax
je 0x1400aab85
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], r14
lea rax, [rbp + 0x10]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x1400aaa23
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x48]
call fcn.140061160
nop
lea rbx, [rbp - 0x50]
mov r9, qword [rbx]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [r9 + rax], 0
jne 0x1400aaa50
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 0xf
cmova rcx, qword [rsp + 0x48]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
call fcn.14009c510
cmp rax, 0xffffffffffffffff
je 0x1400aab6a
mov rdx, qword [rbx + 8]
test rdx, rdx
je 0x1400aab6a
lea rax, [rsp + 0x68]
mov qword [rbp + 0x2458], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x80], r14
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x1400aaac0
lea rcx, [rsp + 0x68]
call fcn.140061160
nop
mov rdx, qword [0x1402442c8]
add rdx, 0x100
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x60], r14
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x1400aab00
lea rcx, [rbp - 0x78]
call fcn.140061160
nop
lea r8, [rsp + 0x68]
lea rdx, [rbp - 0x78]
call fcn.140098570
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r9, [rbp + 0x2440]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call qword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
lea rax, [rbp + 0x2450]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc0000420
call qword [sym.imp.ntdll.dll_NtRaiseHardError]
add rbx, 0x10
lea rax, [rbp + 0x10]
cmp rbx, rax
jne 0x1400aaa40
lea rcx, [rsp + 0x48]
call fcn.14005ed40
inc rdi
cmp rdi, rsi
jl 0x1400aa9e6
add rsp, 0x2510
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret