Function at 0x140041100
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x580]
sub rsp, 0x680
movaps xmmword [rsp + 0x670], xmm6
lea rax, [rbp]
mov qword [rbp + 0x5c0], rax
movdqa xmm0, xmmword [0x140120e50]
movdqa xmm1, xmmword [0x140120d90]
movaps xmmword [rbp - 0x80], xmm0
movaps xmmword [rbp - 0x70], xmm1
mov byte [rbp - 0x60], 0x73
xor r14d, r14d
lea ebx, [r14 + 2]
mov rdx, qword [0x14013aba0]
test rdx, rdx
jne 0x1400411f3
mov edi, 0x21
mov ecx, edi
call fcn.140075634
mov rdx, rax
mov qword [0x14013aba0], rax
mov r9d, r14d
add rax, 0x20
lea rcx, [rbp - 0x60]
cmp rdx, rcx
ja 0x140041194
lea rcx, [rbp - 0x80]
cmp rax, rcx
jae 0x1400411c8
movdqa xmm1, xmmword [0x140121110]
mov rax, rdx
lea r8, [rbp - 0x80]
sub r8, rdx
mov rcx, rbx
mov r9d, 0x20
nop
movdqu xmm0, xmmword [r8 + rax]
pxor xmm0, xmm1
movdqu xmmword [rax], xmm0
lea rax, [rax + 0x10]
sub rcx, 1
jne 0x1400411b0
lea rcx, [r9 + rdx]
lea r8, [rbp - 0x80]
sub r8, rdx
sub rdi, r9
nop word [rax + rax]
movzx eax, byte [rcx + r8]
xor al, 0x73
mov byte [rcx], al
lea rcx, [rcx + 1]
sub rdi, 1
jne 0x1400411e0
mov qword [rbp + 0x10], r14
mov r15d, 0xf
mov qword [rbp + 0x18], r15
mov byte [rbp], r14b
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop
inc r8
cmp byte [rdx + r8], r14b
jne 0x140041210
lea rcx, [rbp]
call fcn.1400064d0
nop
lea rax, [rbp + 0x20]
mov qword [rbp + 0x5c8], rax
movdqa xmm6, xmmword [0x140120de0]
movaps xmmword [rsp + 0x60], xmm6
mov byte [rsp + 0x70], 0x71
mov r12d, 0x10
mov rdx, qword [0x14013aa78]
test rdx, rdx
jne 0x1400412c3
mov edi, 0x11
mov ecx, edi
call fcn.140075634
mov rdx, rax
mov qword [0x14013aa78], rax
mov rax, r14
lea rcx, [rdx + 0x10]
lea r8, [rsp + 0x70]
cmp rdx, r8
ja 0x140041283
lea r8, [rsp + 0x60]
cmp rcx, r8
jae 0x140041296
movdqa xmm0, xmmword [0x1401210f0]
pxor xmm0, xmm6
movdqu xmmword [rdx], xmm0
mov rax, r12
lea rcx, [rax + rdx]
lea r8, [rsp + 0x60]
sub r8, rdx
sub rdi, rax
nop word [rax + rax]
movzx eax, byte [r8 + rcx]
xor al, 0x71
mov byte [rcx], al
lea rcx, [rcx + 1]
sub rdi, 1
jne 0x1400412b0
mov qword [rbp + 0x30], r14
mov qword [rbp + 0x38], r15
mov byte [rbp + 0x20], 0
mov r8, rbx
inc r8
cmp byte [rdx + r8], 0
jne 0x1400412d2
lea rcx, [rbp + 0x20]
call fcn.1400064d0
nop
mov qword [rbp + 0x50], r14
mov qword [rbp + 0x58], r15
mov byte [rbp + 0x40], 0
mov r8d, 0x27a0
lea rdx, [0x140134d80]
lea rcx, [rbp + 0x40]
call fcn.1400064d0
nop
mov dword [rsp + 0x20], 4
lea r9, [rbp]
lea r8, [rbp + 0x20]
lea rdx, [rbp + 0x40]
lea rcx, [rbp - 0x20]
call fcn.14003af30
nop
cmp qword [rbp - 0x10], 0
je 0x140041951
lea rdi, [rbp + 0x160]
xor eax, eax
mov ecx, 0x410
rep stosb byte [rdi], al
lea rax, [rbp - 0x50]
mov qword [rbp + 0x5c0], rax
movdqa xmm6, xmmword [0x140120ba0]
mov dword [rsp + 0x70], 0x77200e05
movaps xmmword [rsp + 0x40], xmm6
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x50], eax
mov rdx, qword [0x14013ab78]
test rdx, rdx
jne 0x1400413e3
mov edi, 0x14
mov ecx, edi
call fcn.140075634
mov rdx, rax
mov qword [0x14013ab78], rax
mov rax, r14
lea rcx, [rdx + 0x13]
lea r8, [rsp + 0x53]
cmp rdx, r8
ja 0x1400413a7
lea r8, [rsp + 0x40]
cmp rcx, r8
jae 0x1400413ba
movdqa xmm0, xmmword [0x140121130]
pxor xmm0, xmm6
movdqu xmmword [rdx], xmm0
mov rax, r12
lea rcx, [rax + rdx]
lea r8, [rsp + 0x40]
sub r8, rdx
sub rdi, rax
nop dword [rax]
movzx eax, byte [r8 + rcx]
xor al, 0x77
mov byte [rcx], al
lea rcx, [rcx + 1]
sub rdi, 1
jne 0x1400413d0
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x38], r15
mov byte [rbp - 0x50], 0
mov r8, rbx
inc r8
cmp byte [rdx + r8], 0
jne 0x1400413f2
lea rcx, [rbp - 0x50]
call fcn.1400064d0
nop
mov dword [rsp + 0x40], 0x3b27303e
mov dword [rsp + 0x44], 0x47463930
mov dword [rsp + 0x48], 0x1919115b
movsd xmm0, qword [rsp + 0x40]
movsd qword [rsp + 0x60], xmm0
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x68], eax
mov byte [rsp + 0x6c], 0x75
mov esi, 0xd
mov rdx, qword [0x14013aa70]
test rdx, rdx
jne 0x140041483
mov ecx, esi
call fcn.140075634
mov rdx, rax
mov qword [0x14013aa70], rax
mov rcx, rax
lea r8, [rsp + 0x60]
sub r8, rax
mov edi, esi
nop word [rax + rax]
movzx eax, byte [r8 + rcx]
xor al, 0x75
mov byte [rcx], al
lea rcx, [rcx + 1]
sub rdi, 1
jne 0x140041470
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], r15
mov byte [rbp - 0x80], 0
mov r8, rbx
inc r8
cmp byte [rdx + r8], 0
jne 0x140041492
lea rcx, [rbp - 0x80]
call fcn.1400064d0
nop
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x80]
call fcn.140046bf0
mov edx, 0x104
lea rcx, [rbp + 0x160]
call rax
test eax, eax
je 0x140041951
mov r13d, 0x12
mov rax, qword [0x14013ac20]
test rax, rax
jne 0x14004150a
mov ecx, r13d
call fcn.140075634
mov qword [0x14013ac20], rax
mov dword [rax], 0x6e0050
mov dword [rax + 4], 0x42006b
mov dword [rax + 8], 0x740073
mov dword [rax + 0xc], 0x4b0072
mov word [rax + 0x10], r14w
mov rdx, rax
mov rcx, qword [0x14013b1d8]
call fcn.14003f2d0
mov dword [rbp - 0x80], 0x1f0027
mov dword [rbp - 0x7c], 0x120009
mov dword [rbp - 0x78], 0x1e000d
mov dword [rbp - 0x74], 0x80009
mov dword [rbp - 0x70], 0x2b0027
mov dword [rbp - 0x6c], 0x100015
mov dword [rbp - 0x68], 0x80039
mov dword [rbp - 0x64], 0x9000f
mov dword [rbp - 0x60], 0x550030
mov dword [rbp - 0x5c], 0x20008
mov edi, 2
mov dword [rbp - 0x58], 0x7b0008
movups xmm0, xmmword [rbp - 0x80]
movaps xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [rbp - 0x70]
movaps xmmword [rbp - 0x40], xmm1
movsd xmm0, qword [rbp - 0x60]
movsd qword [rbp - 0x30], xmm0
mov eax, dword [rbp - 0x58]
mov dword [rbp - 0x28], eax
mov r8, qword [0x14013adb8]
test r8, r8
jne 0x140041625
lea ecx, [rdi + 0x2a]
call fcn.140075634
mov r8, rax
mov qword [0x14013adb8], rax
mov r9, r14
add rax, 0x2a
lea rcx, [rbp - 0x26]
cmp r8, rcx
ja 0x1400415c6
lea rcx, [rbp - 0x50]
cmp rax, rcx
jae 0x1400415f7
movdqa xmm1, xmmword [0x140120a10]
mov rax, r8
lea rdx, [rbp - 0x50]
sub rdx, r8
mov rcx, rdi
mov r9, r12
nop
movdqu xmm0, xmmword [rdx + rax]
pxor xmm0, xmm1
movdqu xmmword [rax], xmm0
lea rax, [rax + 0x10]
sub rcx, 1
jne 0x1400415e0
lea rcx, [r8 + r9*2]
lea rdi, [rbp - 0x50]
sub rdi, r8
mov edx, 0x16
sub rdx, r9
nop word [rax + rax]
movzx eax, word [rcx + rdi]
xor ax, 0x7b
mov word [rcx], ax
lea rcx, [rcx + 2]
sub rdx, 1
jne 0x140041610
mov edx, 0x208
lea rcx, [rbp + 0x160]
call fcn.140089f0c
lea rcx, [rbp + 0x160]
call fcn.140040170
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rdx, qword [rbp - 0x20]
mov dword [rsp + 0x20], r14d
xor r9d, r9d
mov r8, qword [rbp - 0x10]
lea rcx, [rbp + 0x160]
call fcn.14003ca50
mov eax, eax
cmp rax, qword [rbp - 0x10]
jne 0x140041944
lea rax, [rbp - 0x80]
mov qword [rbp + 0x5c0], rax
movdqa xmm6, xmmword [0x140120c00]
mov word [rsp + 0x50], 0x280c
movaps xmmword [rsp + 0x60], xmm6
movzx eax, word [rsp + 0x50]
mov word [rsp + 0x70], ax
mov byte [rsp + 0x72], 0x7f
mov rdx, qword [0x14013a9e0]
test rdx, rdx
jne 0x140041714
mov edi, 0x13
mov ecx, edi
call fcn.140075634
mov rdx, rax
mov qword [0x14013a9e0], rax
mov rax, r14
lea rcx, [rdx + 0x12]
lea r8, [rsp + 0x72]
cmp rdx, r8
ja 0x1400416df
lea r8, [rsp + 0x60]
cmp rcx, r8
jae 0x1400416f2
movdqa xmm0, xmmword [0x1401211b0]
pxor xmm0, xmm6
movdqu xmmword [rdx], xmm0
mov rax, r12
lea rcx, [rax + rdx]
lea r8, [rsp + 0x60]
sub r8, rdx
sub rdi, rax
movzx eax, byte [r8 + rcx]
xor al, 0x7f
mov byte [rcx], al
lea rcx, [rcx + 1]
sub rdi, 1
jne 0x140041701
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], r15
mov byte [rbp - 0x80], 0
mov r8, rbx
inc r8
cmp byte [rdx + r8], 0
jne 0x140041723
lea rcx, [rbp - 0x80]
call fcn.1400064d0
nop
mov dword [rsp + 0x40], 0x332f3836
mov dword [rsp + 0x44], 0x4f4e3138
mov dword [rsp + 0x48], 0x11111953
movsd xmm0, qword [rsp + 0x40]
movsd qword [rsp + 0x60], xmm0
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x68], eax
mov byte [rsp + 0x6c], 0x7d
mov rdx, qword [0x14013a9f0]
test rdx, rdx
jne 0x1400417b2
mov rcx, rsi
call fcn.140075634
mov rdx, rax
mov qword [0x14013a9f0], rax
mov rcx, rax
lea rdi, [rsp + 0x60]
sub rdi, rax
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdi + rcx]
xor al, 0x7d
mov byte [rcx], al
lea rcx, [rcx + 1]
sub rsi, 1
jne 0x1400417a0
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x38], r15
mov byte [rbp - 0x50], 0
mov r8, rbx
inc r8
cmp byte [rdx + r8], 0
jne 0x1400417c1
lea rcx, [rbp - 0x50]
call fcn.1400064d0
nop
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x50]
call fcn.140046e40
mov edx, 2
lea rcx, [rbp + 0x160]
call rax
mov rax, qword [0x14013ad18]
test rax, rax
jne 0x14004182b
mov rcx, r13
call fcn.140075634
mov qword [0x14013ad18], rax
mov dword [rax], 0x6e0050
mov dword [rax + 4], 0x42006b
mov dword [rax + 8], 0x740073
mov dword [rax + 0xc], 0x4b0072
mov word [rax + 0x10], r14w
mov rdx, rax
mov rcx, qword [0x14013b1d8]
call fcn.14003f6b0
test eax, eax
js 0x1400418fa
mov rdx, qword [0x14013b1d8]
lea rcx, [rbp - 0x80]
call fcn.1400060d0
mov rdi, rax
mov r8, rax
cmp qword [rax + 0x18], 8
jb 0x140041862
mov r8, qword [rax]
lea rdx, str.._s
lea rcx, [rbp + 0x60]
call qword [sym.imp.USER32.dll_wsprintfW]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r9 + 3]
lea rcx, [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
cmove rbx, r14
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x1400418e8
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x1400418e3
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140041980
mov rcx, r8
call fcn.14007562c
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], 7
mov word [rdi], r14w
jmp 0x140041951
mov rax, qword [0x14013aaa0]
test rax, rax
jne 0x140041935
mov rcx, r13
call fcn.140075634
mov qword [0x14013aaa0], rax
mov dword [rax], 0x6e0050
mov dword [rax + 4], 0x42006b
mov dword [rax + 8], 0x740073
mov dword [rax + 0xc], 0x4b0072
mov word [rax + 0x10], r14w
mov rdx, rax
mov rcx, qword [0x14013b1d8]
call fcn.14003f2d0
lea rcx, [rbp + 0x160]
call fcn.140040170
nop
lea rcx, [rbp - 0x20]
call fcn.140006470
mov rax, rbx
mov rbx, qword [rsp + 0x6d8]
movaps xmm6, xmmword [rsp + 0x670]
add rsp, 0x680
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14008592c
nop
int3