Function at 0x1400079a0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Get storage device properties

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xd0
mov rax, qword [0x140081060]
xor rax, rsp
mov qword [rbp + 0x2f], rax
xor r14d, r14d
lea r12, [0x140082370]
xorps xmm0, xmm0
movups xmmword [rbp - 0x11], xmm0
lea r13, [rbp + 0x5f]
movabs rbx, 0xff00ff00ff00ff00
mov qword [rbp - 9], rbx
mov qword [rbp - 1], r13
mov rax, qword [r13]
xor rax, rbx
mov qword [rbp - 0x11], rax
mov qword [r13], r14
mov byte [rbp - 0x49], 0x7c
mov byte [rbp - 0x48], 0x77
mov byte [rbp - 0x47], 3
mov byte [rbp - 0x46], 0x7d
mov byte [rbp - 0x45], 0x77
mov byte [rbp - 0x44], Ordinal_79
mov byte [rbp - 0x43], 0x57
mov byte [rbp - 0x42], 0x57
mov byte [rbp - 0x41], 0x50
mov byte [rbp - 0x40], 0x51
mov byte [rbp - 0x3f], 0x5b
mov byte [rbp - 0x3e], 0x54
mov byte [rbp - 0x3d], 0x76
mov byte [rbp - 0x3c], 0x4b
mov byte [rbp - 0x3b], 0x5c
mov byte [rbp - 0x3a], 0x4b
mov byte [rbp - 0x39], 0x55
mov byte [rbp - 0x38], listen
mov byte [rbp - 0x37], 0x3d
movzx eax, byte [rbp - 0x49]
mov r9d, r14d
movabs r11, 0xa3c6b839b09ba728
mov r10, r11
lea rax, [rbp - 0x49]
sub r10, rax
lea r15d, [r14 + 0xf]
nop dword [rax]
nop word [rax + rax]
lea rdx, [rbp - 0x49]
add rdx, r9
movsx r8, byte [rdx]
mov rcx, r9
and ecx, r15d
cmp rcx, r15
cmovae rcx, r15
shl cl, 2
mov rax, r11
shr rax, cl
and al, r15b
add dl, r10b
xor al, dl
xor al, r8b
mov byte [rbp + r9 - 0x49], al
inc r9
cmp r9, 0x13
jb 0x140007a80
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 3]
lea rcx, [rbp - 0x49]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140007b97
mov byte [rbp - 0x59], reloc.WLDAP32.dll_Ordinal_79
mov byte [rbp - 0x58], 0x76
movzx eax, byte [rbp - 0x59]
mov r9, r14
movabs r10, 0x7f294a8f75a74670
mov r11, r10
lea rax, [rbp - 0x59]
sub r11, rax
lea rdx, [rbp - 0x59]
add rdx, r9
movsx r8, byte [rdx]
mov rcx, r9
and ecx, r15d
cmp rcx, r15
cmovae rcx, r15
shl cl, 2
mov rax, r10
shr rax, cl
and al, r15b
add dl, r11b
xor al, dl
xor al, r8b
mov byte [rbp + r9 - 0x59], al
inc r9
cmp r9, 2
jb 0x140007b12
xorps xmm0, xmm0
movups xmmword [0x140082370], xmm0
mov qword [0x140082380], r14
mov qword [0x140082388], r14
lea rax, [rbp - 0x59]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140007b70
lea rdx, [rbp - 0x59]
mov rcx, r12
call fcn.140023e10
nop
mov rax, qword [rbp - 0x11]
xor rax, rbx
mov qword [r13], rax
jmp 0x140007da7
mov qword [rbp - 0x1d], r14
mov dword [rbp - 0x21], r14d
mov qword [rbp - 0x29], r14
mov dword [rbp - 0x2d], r14d
mov qword [rsp + 0x38], r14
lea rax, [rbp - 0x2d]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 8
lea rax, [rbp - 0x29]
mov qword [rsp + 0x20], rax
mov r9d, listen
lea r8, [rbp - 0x21]
mov edx, 0x2d1400
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x140007c83
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [rbp - 0x55], reloc.WLDAP32.dll_Ordinal_79
mov byte [rbp - 0x54], 0x76
movzx eax, byte [rbp - 0x55]
mov r9, r14
movabs r10, 0x7f294a8f75a74670
mov r11, r10
lea rax, [rbp - 0x55]
sub r11, rax
lea rdx, [rbp - 0x55]
add rdx, r9
movsx r8, byte [rdx]
mov rcx, r9
and ecx, r15d
cmp rcx, r15
cmovae rcx, r15
shl cl, 2
mov rax, r10
shr rax, cl
and al, r15b
add dl, r11b
xor al, dl
xor al, r8b
mov byte [rbp + r9 - 0x55], al
inc r9
cmp r9, 2
jb 0x140007c12
xorps xmm0, xmm0
movups xmmword [0x140082370], xmm0
mov qword [0x140082380], r14
mov qword [0x140082388], r14
lea rax, [rbp - 0x55]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140007c70
lea rdx, [rbp - 0x55]
jmp 0x140007b7e
mov ebx, dword [rbp - 0x25]
mov ecx, ebx
call fcn.140067eb4
mov rsi, rax
mov qword [rbp + 0x27], rax
mov qword [rsp + 0x38], r14
lea rax, [rbp - 0x2d]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rsi
mov r9d, listen
lea r8, [rbp - 0x21]
mov edx, 0x2d1400
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x140007d3a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [rbp - 0x51], reloc.WLDAP32.dll_Ordinal_79
mov byte [rbp - 0x50], 0x76
movzx eax, byte [rbp - 0x51]
mov r9, r14
movabs r10, 0x7f294a8f75a74670
mov r11, r10
lea rax, [rbp - 0x51]
sub r11, rax
nop dword [rax]
nop word [rax + rax]
lea rdx, [rbp - 0x51]
add rdx, r9
movsx r8, byte [rdx]
mov rcx, r9
and ecx, 0xf
cmp rcx, 0xf
cmovae rcx, r15
shl cl, 2
mov rax, r10
shr rax, cl
and al, 0xf
add dl, r11b
xor al, dl
xor al, r8b
mov byte [rbp + r9 - 0x51], al
inc r9
cmp r9, 2
jb 0x140007d00
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [rsi + 0x18]
add rdx, rsi
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
mov qword [rbp + 0x17], r14
mov qword [rbp + 0x1f], r14
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rdx + r8], 0
jne 0x140007d60
lea rcx, [rbp + 7]
call fcn.140023e10
movups xmm0, xmmword [rbp + 7]
movups xmmword [0x140082370], xmm0
movups xmm1, xmmword [rbp + 0x17]
movups xmmword [0x140082380], xmm1
mov rcx, rsi
call fcn.140067b00
nop
mov rcx, qword [rbp - 0x11]
movabs rax, 0xff00ff00ff00ff00
xor rcx, rax
mov qword [r13], rcx
mov rax, r12
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.140067ae0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret