Function at 0x14003b030
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xchg rdi, rbx
mov qword [rsp + 8], rdi
xchg rdi, rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
nop
mov qword [rsp - 8], rbp
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r12
nop
mov qword [rsp - 8], r13
sub rsp, 8
push rdi
mov qword [rsp], r14
nop
sub rsp, 8
mov qword [rsp], r15
lea rbp, [rsp - 0x30]
sub rsp, 0x130
xchg rdi, r9
mov r9, rdi
xchg r9, rdi
movzx r14d, r8w
mov r12d, edx
xchg rbx, r15
mov r15, rcx
xchg rbx, r15
mov r15b, 0x5a
sub r15b, 0x15
sub r15b, 0x2d
add r15b, 0x53
sub r15b, 0x65
xor r15b, 0x24
add r15b, 0x27
sub r15b, 0x48
xor r13d, r13d
movzx esi, r13w
cmp r13w, r8w
jae 0x14003b637
inc qword [rbx + 0x18]
mov rax, qword [rbx]
cmp rax, qword [rbx + 8]
je 0x14003b0e8
movzx ecx, byte [rax]
inc rax
xchg r11, rax
mov qword [rbx], r11
xchg r11, rax
jmp 0x14003b111
mov ecx, 0x442badfd
add ecx, 0x147a7a41
sub ecx, 0x2a3cd76b
xor ecx, 0x13197492
xor ecx, 0x27d1c4a1
sub ecx, 0x1082386f
add ecx, 0xf5e0578e
mov dword [rbx + 0x10], ecx
cmp ecx, 0xffffffff
je 0x14003b15e
mov byte [rbp + 0x70], cl
xchg rdx, rbx
mov rbx, qword [rdi + 8]
xchg rbx, rdx
cmp rdx, qword [rdi + 0x10]
je 0x14003b146
mov byte [rdx], cl
inc qword [rdi + 8]
inc si
cmp si, r14w
jmp 0x14003b0bf
lea r8, [rbp + 0x70]
mov rcx, rdi
call fcn.140032e20
inc si
cmp si, r14w
jmp 0x14003b0bf
mov rdi, qword [rbx + 0x28]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0xa10373d
add qword [rsp + 0x40], 0x17559d1
add qword [rsp + 0x40], 0x395f3b89
xor qword [rsp + 0x40], 0x403d8454
add qword [rsp + 0x40], 0x392f3eb1
xor qword [rsp + 0x40], 0x3e088772
mov qword [rsp + 0x48], 0x3830cc72
xor qword [rsp + 0x48], 0x7b2d3451
xor qword [rsp + 0x48], 0x65b3a1bc
sub qword [rsp + 0x48], 0xa6f4d44
add qword [rsp + 0x48], 0x6a8a247
add qword [rsp + 0x48], 0x55edf0c4
xor qword [rsp + 0x48], 0x78d59f69
mov eax, dword [0x1400017a0]
mov dword [rsp + 0x30], eax
movzx eax, word [0x1400017a4]
mov word [rsp + 0x34], ax
mov byte [rsp + 0x36], r13b
movups xmmword [rsp + 0x50], xmm0
mov edx, 0x2033c171
add edx, 0x3a016e87
xor edx, 0x59e26233
add edx, 0x5d44934c
add edx, 0xeb605bc
xor edx, 0x7b56a338
xor edx, 0x148745cb
lea rcx, [rsp + 0x50]
call fcn.140053490
xchg rcx, rbx
mov rbx, rax
xchg rcx, rbx
xchg r12, rax
mov qword [rsp + 0x50], r12
xchg r12, rax
mov qword [rsp + 0x60], 0x503d8e52
xor qword [rsp + 0x60], 0x46677c55
xor qword [rsp + 0x60], 0x47dab708
xor qword [rsp + 0x60], 0x550c3bb5
xor qword [rsp + 0x60], 0x25bfacd3
sub qword [rsp + 0x60], 0xbb056b1
add qword [rsp + 0x60], 0x2cbacab7
sub qword [rsp + 0x60], 0x23371039
xor qword [rsp + 0x60], 0x1f073621
mov qword [rsp + 0x68], 0x41443133
sub qword [rsp + 0x68], 0x2bc3d3e
xor qword [rsp + 0x68], 0x4986d09e
xor qword [rsp + 0x68], 0x7ec41377
xor qword [rsp + 0x68], 0x2470ec56
sub qword [rsp + 0x68], 0x12c56ab
add qword [rsp + 0x68], 0x18ba568d
xor qword [rsp + 0x68], 0x3bb61023
sub qword [rsp + 0x68], 0x7ef5cbf0
movups xmm0, xmmword [0x140001948]
xchg rbp, rax
movups xmmword [rbp], xmm0
xchg rbp, rax
mov eax, dword [0x140001958]
mov dword [rcx + 0x10], eax
movzx eax, word [0x14000195c]
mov word [rcx + 0x14], ax
movzx eax, byte [0x14000195e]
mov byte [rcx + 0x16], al
mov byte [rcx + 0x17], reloc.SHLWAPI.dll_SHCreateMemStream
xor byte [rcx + 0x17], 0x26
sub byte [rcx + 0x17], 6
sub byte [rcx + 0x17], 0x14
add byte [rcx + 0x17], 0x6b
sub byte [rcx + 0x17], 0x1e
sub byte [rcx + 0x17], 0x32
add byte [rcx + 0x17], 0x2c
sub byte [rcx + 0x17], 0x57
lea rax, [rsp + 0x30]
xchg rbx, rax
mov qword [rsp + 0x20], rbx
xchg rbx, rax
lea r9, [rsp + 0x50]
mov r8d, r12d
lea rdx, [rbp - 0x70]
mov rcx, rbx
call fcn.140055360
nop
mov qword [rsp + 0x20], r13
xchg r9, r15
mov r15, rax
xchg r15, r9
xchg r8, r15
mov r15, qword [rbx + 0x18]
xchg r15, r8
mov edx, 0x4bc28a5e
sub edx, 0x44ca5d32
xor edx, 0x7b6a860e
xor edx, 0x3281bbcf
sub edx, 0x20df08cb
sub edx, 0x2e3407b4
lea rcx, [rbp - 0x50]
call fcn.140038d00
xchg r9, rax
mov rdx, r9
xchg r9, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], 0x735c300c
sub qword [rbp - 0x80], 0x441c954c
sub qword [rbp - 0x80], 0xa202b5a
add qword [rbp - 0x80], 0x20076646
add qword [rbp - 0x80], 0x27013206
xor qword [rbp - 0x80], 0x42c384b8
add qword [rbp - 0x80], 0x93830da
xor qword [rbp - 0x80], 0x3823b3e9
mov qword [rbp - 0x78], 0x64bbf6da
sub qword [rbp - 0x78], 0x31b1ed29
xor qword [rbp - 0x78], 0x17e2ad65
xor qword [rbp - 0x78], 0x126a7c58
xor qword [rbp - 0x78], 0x52890f58
xor qword [rbp - 0x78], 0x3f1239f1
sub qword [rbp - 0x78], 0x5b19ee16
movsd xmm0, qword [0x140001960]
movsd qword [rsp + 0x70], xmm0
mov eax, dword [0x140001968]
mov dword [rsp + 0x78], eax
movzx eax, byte [0x14000196c]
mov byte [rsp + 0x7c], al
mov byte [rsp + 0x7d], 0x76
sub byte [rsp + 0x7d], 0x1f
add byte [rsp + 0x7d], 0x1b
xor byte [rsp + 0x7d], 0x35
sub byte [rsp + 0x7d], 0x14
sub byte [rsp + 0x7d], 0x2d
sub byte [rsp + 0x7d], 6
mov byte [rdi + 0x28], 0x64
add byte [rdi + 0x28], 0x16
sub byte [rdi + 0x28], 0x3f
sub byte [rdi + 0x28], 0x3a
add byte [rdi + 0x28], 0x60
sub byte [rdi + 0x28], 0x15
sub byte [rdi + 0x28], 0x4b
cmp byte [rdi + 0x29], 0
jne 0x14003b6b0
lea rbx, [0x140004a88]
mov qword [rbp - 0x30], rbx
lea rcx, [rbp - 0x28]
call fcn.1401fd688
mov qword [rbp - 0x50], rbx
lea rcx, [rbp - 0x48]
call fcn.1401fd688
nop
xchg r10, rdx
mov r10, qword [rbp - 0x58]
xchg r10, rdx
cmp rdx, 0x10
jb 0x14003b512
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003b50d
neg rdx
add rdx, 0xffffffffffffffd9
neg rdx
mov rcx, qword [rcx - 8]
sub rax, rcx
nop
add rax, 0xffffffff9e03a9c9
sub rax, 0xffffffff9e03a9d1
cmp rax, 0x1f
jbe 0x14003b50d
call 0x140d44c65
int3
call fcn.1401fc608
xchg r13, r10
mov qword [rbp - 0x60], r10
xchg r13, r10
mov qword [rbp - 0x58], 0x28b0a9ca
add qword [rbp - 0x58], 0x120eafdf
add qword [rbp - 0x58], 0x446d0342
xor qword [rbp - 0x58], 0x66065db7
xor qword [rbp - 0x58], 0xccd9109
sub qword [rbp - 0x58], 0x15e79046
mov byte [rbp - 0x70], 0x40
xor byte [rbp - 0x70], 0x52
xor byte [rbp - 0x70], 0x3c
xor byte [rbp - 0x70], 0x29
add byte [rbp - 0x70], 0x76
sub byte [rbp - 0x70], 0x37
sub byte [rbp - 0x70], 0x46
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x14003b5ca
inc rdx
mov rcx, qword [rsp + 0x50]
xchg r11, rax
mov r11, rcx
xchg r11, rax
cmp rdx, 0x1000
jb 0x14003b5c4
nop
add rdx, 0x36029e3f
sub rdx, 0x36029e18
mov rcx, qword [rcx - 8]
sub rax, rcx
neg rax
add rax, 8
neg rax
cmp rax, 0x1f
jbe 0x14003b5c4
call 0x140c32903
int3
call fcn.1401fc608
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14003b634
inc rdx
xchg rcx, rsi
mov rsi, qword [rsp + 0x30]
xchg rcx, rsi
xchg r8, rax
mov r8, rcx
xchg r8, rax
cmp rdx, 0x1000
jb 0x14003b62f
nop
add rdx, 0x42f56990
sub rdx, 0x42f56969
mov rcx, qword [rcx - 8]
sub rax, rcx
nop
add rax, 0xffffffffe655359a
sub rax, 0xffffffffe65535a2
cmp rax, 0x1f
jbe 0x14003b62f
call 0x14034a985
int3
call fcn.1401fc608
xor r15b, r15b
movzx eax, r15b
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x30]
xchg rsi, r10
mov r10, qword [r11 + 0x38]
xchg rsi, r10
xchg rdi, rbp
mov rbp, qword [r11 + 0x48]
xchg rbp, rdi
mov rsp, r11
push rax
push rdx
push rbx
xchg qword [rsp + 0x18], r15
pop rbx
pop rdx
pop rax
add rsp, 8
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
add rsp, 8
xchg qword [rsp - 8], r13
push rdx
push rbx
push rbx
push rbx
push rdx
push rax
xchg qword [rsp + 0x30], r12
add rsp, 0x38
push rdx
push rbx
push rax
push rdx
push rdx
push rdx
push rax
xchg qword [rsp + 0x38], rbp
pop rax
pop rdx
pop rdx
pop rdx
pop rax
pop rbx
pop rdx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
lea rcx, [rbp - 0x10]
call fcn.14004be20
lea rdx, [0x140214ee8]
lea rcx, [rbp - 0x10]
call fcn.1401fd68e
int3