Function at 0x14001a170
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Get storage device properties

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xd0
mov rax, qword [0x140081060]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rdi, rcx
mov qword [rbp - 0x29], rcx
xor r15d, r15d
xorps xmm0, xmm0
movups xmmword [rbp - 0x11], xmm0
lea r13, [rbp + 0x5f]
movabs rbx, 0xff00ff00ff00ff00
mov qword [rbp - 9], rbx
mov qword [rbp - 1], r13
mov rax, qword [r13]
xor rax, rbx
mov qword [rbp - 0x11], rax
mov qword [r13], r15
mov byte [rbp - 0x49], 0x7c
mov byte [rbp - 0x48], 0x77
mov byte [rbp - 0x47], 3
mov byte [rbp - 0x46], 0x7d
mov byte [rbp - 0x45], 0x77
mov byte [rbp - 0x44], Ordinal_79
mov byte [rbp - 0x43], 0x57
mov byte [rbp - 0x42], 0x57
mov byte [rbp - 0x41], 0x50
mov byte [rbp - 0x40], 0x51
mov byte [rbp - 0x3f], 0x5b
mov byte [rbp - 0x3e], 0x54
mov byte [rbp - 0x3d], 0x76
mov byte [rbp - 0x3c], 0x4b
mov byte [rbp - 0x3b], 0x5c
mov byte [rbp - 0x3a], 0x4b
mov byte [rbp - 0x39], 0x55
mov byte [rbp - 0x38], listen
mov byte [rbp - 0x37], 0x3d
movzx eax, byte [rbp - 0x49]
mov r9d, r15d
movabs r11, 0xa3c6b839b09ba728
mov r10, r11
lea rax, [rbp - 0x49]
sub r10, rax
lea r12d, [r15 + 0xf]
nop dword [rax]
nop word [rax + rax]
lea rdx, [rbp - 0x49]
add rdx, r9
movsx r8, byte [rdx]
mov rcx, r9
and ecx, r12d
cmp rcx, r12
cmovae rcx, r12
shl cl, 2
mov rax, r11
shr rax, cl
and al, r12b
add dl, r10b
xor al, dl
xor al, r8b
mov byte [rbp + r9 - 0x49], al
inc r9
cmp r9, 0x13
jb 0x14001a250
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 3]
lea rcx, [rbp - 0x49]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x14001a35c
mov byte [rbp - 0x59], reloc.WLDAP32.dll_Ordinal_79
mov byte [rbp - 0x58], 0x76
movzx eax, byte [rbp - 0x59]
mov r9, r15
movabs r10, 0x7f294a8f75a74670
mov r11, r10
lea rax, [rbp - 0x59]
sub r11, rax
lea rdx, [rbp - 0x59]
add rdx, r9
movsx r8, byte [rdx]
mov rcx, r9
and ecx, r12d
cmp rcx, r12
cmovae rcx, r12
shl cl, 2
mov rax, r10
shr rax, cl
and al, r12b
add dl, r11b
xor al, dl
xor al, r8b
mov byte [rbp + r9 - 0x59], al
inc r9
cmp r9, 2
jb 0x14001a2e2
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], r15
lea rax, [rbp - 0x59]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x14001a335
lea rdx, [rbp - 0x59]
mov rcx, rdi
call fcn.140023e10
nop
mov rcx, qword [rbp - 0x11]
xor rcx, rbx
mov qword [r13], rcx
jmp 0x14001a570
mov qword [rbp - 0x1d], r15
mov dword [rbp - 0x21], r15d
mov qword [rbp - 0x29], r15
mov dword [rbp - 0x2d], r15d
mov qword [rsp + 0x38], r15
lea rax, [rbp - 0x2d]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 8
lea rax, [rbp - 0x29]
mov qword [rsp + 0x20], rax
mov r9d, listen
lea r8, [rbp - 0x21]
mov edx, 0x2d1400
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x14001a456
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [rbp - 0x55], reloc.WLDAP32.dll_Ordinal_79
mov byte [rbp - 0x54], 0x76
movzx eax, byte [rbp - 0x55]
mov r9, r15
movabs r10, 0x7f294a8f75a74670
mov r11, r10
lea rax, [rbp - 0x55]
sub r11, rax
nop word [rax + rax]
lea rdx, [rbp - 0x55]
add rdx, r9
movsx r8, byte [rdx]
mov rcx, r9
and ecx, r12d
cmp rcx, r12
cmovae rcx, r12
shl cl, 2
mov rax, r10
shr rax, cl
and al, r12b
add dl, r11b
xor al, dl
xor al, r8b
mov byte [rbp + r9 - 0x55], al
inc r9
cmp r9, 2
jb 0x14001a3e0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], r15
lea rax, [rbp - 0x55]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x14001a433
lea rdx, [rbp - 0x55]
mov rcx, rdi
call fcn.140023e10
nop
mov rax, qword [rbp - 0x11]
xor rax, rbx
jmp 0x14001a56c
mov ebx, dword [rbp - 0x25]
mov ecx, ebx
call fcn.140067eb4
mov r14, rax
mov qword [rbp + 0x27], rax
mov qword [rsp + 0x38], r15
lea rax, [rbp - 0x2d]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r14
mov r9d, listen
lea r8, [rbp - 0x21]
mov edx, 0x2d1400
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x14001a50a
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [rbp - 0x51], reloc.WLDAP32.dll_Ordinal_79
mov byte [rbp - 0x50], 0x76
movzx eax, byte [rbp - 0x51]
mov r9, r15
movabs r10, 0x7f294a8f75a74670
mov r11, r10
lea rax, [rbp - 0x51]
sub r11, rax
nop word [rax + rax]
lea rdx, [rbp - 0x51]
add rdx, r9
movsx r8, byte [rdx]
mov rcx, r9
and ecx, 0xf
cmp rcx, 0xf
cmovae rcx, r12
shl cl, 2
mov rax, r10
shr rax, cl
and al, 0xf
add dl, r11b
xor al, dl
xor al, r8b
mov byte [rbp + r9 - 0x51], al
inc r9
cmp r9, 2
jb 0x14001a4d0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [r14 + 0x18]
add rdx, r14
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
mov qword [rbp + 0x17], r15
mov qword [rbp + 0x1f], r15
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x14001a530
lea rcx, [rbp + 7]
call fcn.140023e10
movups xmm0, xmmword [rbp + 7]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbp + 0x17]
movups xmmword [rdi + 0x10], xmm1
mov rcx, r14
call fcn.140067b00
nop
mov rax, qword [rbp - 0x11]
movabs rcx, 0xff00ff00ff00ff00
xor rax, rcx
mov qword [r13], rax
mov rax, rdi
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.140067ae0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret