Function at 0x1400b5d20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x170
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x140292cc0]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbx, rcx
xor ecx, ecx
call fcn.1400ba470
mov r12, rax
mov ecx, 2
call fcn.1400ba470
mov rsi, rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov edx, 0x80010000
lea r8d, [r9 + 3]
mov rcx, rbx
call fcn.1400b5c30
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x1400b5d9d
xor al, al
jmp 0x1400b61dd
mov qword [rsp + 0x78], r14
mov ebx, 0x29c
mov qword [rsp + 0x48], rbx
mov ecx, ebx
call fcn.140155e7c
mov rdi, rax
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
lea r9d, [rbx - 0x6c]
mov r8, rdi
mov edx, 1
mov rcx, r14
call rsi
test eax, eax
je 0x1400b5e3a
mov ebx, dword [rsp + 0x34]
add rbx, 0x7c
mov r15, rdi
mov rcx, rbx
call fcn.140155e7c
mov rdi, rax
mov qword [rsp + 0x50], rax
mov rcx, r15
call fcn.140155e38
mov qword [rsp + 0x48], rbx
lea r9d, [rbx - 0x6c]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
mov r8, rdi
mov edx, 1
mov rcx, r14
call rsi
test eax, eax
je 0x1400b5e3a
mov rcx, rdi
call fcn.140155e38
nop
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x1400b61dd
mov r13d, ebx
lea r15, [r13 - 0x14]
shr r15, 1
movzx r8d, word [rdi]
lea rcx, [rdi + 0x14]
mov rdx, qword [rdi + 8]
call fcn.140189a60
movzx ebx, word [rdi]
shr rbx, 1
mov rcx, rbx
je 0x1400b5e85
lea rax, [rbx + 0xa]
lea rax, [rdi + rax*2]
nop dword [rax + rax]
dec rcx
sub rax, 2
cmp word [rax], 0x5c
je 0x1400b5e85
dec rbx
test rcx, rcx
jne 0x1400b5e70
sub r15, rbx
lea rsi, [rbx + 0xa]
lea rsi, [rdi + rsi*2]
cmp r15, 0x20
jb 0x1400b61c5
mov ecx, 1
call fcn.1400ba470
lea r9, [rsp + 0x58]
mov r8d, 0x30
lea rdx, [rsp + 0xd0]
lea ecx, [r8 - 0x2d]
call rax
test eax, eax
jne 0x1400b61c5
mov dword [rsp + 0x100], 0x310030
mov dword [rsp + 0x104], 0x330032
mov dword [rsp + 0x108], 0x350034
mov dword [rsp + 0x10c], 0x370036
mov dword [rsp + 0x110], 0x390038
mov dword [rsp + 0x114], 0x420041
mov dword [rsp + 0x118], 0x440043
mov dword [rsp + 0x11c], 0x460045
xor r15d, r15d
mov edx, r15d
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [rsp + rdx + 0xd0]
mov eax, ecx
shr rax, 4
movzx eax, word [rsp + rax*2 + 0x100]
mov word [rsi], ax
movsx rax, cl
and eax, 0xf
movzx eax, word [rsp + rax*2 + 0x100]
mov word [rsi + 2], ax
lea rsi, [rsi + 4]
inc rdx
cmp rdx, 0x10
jne 0x1400b5f30
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x38], eax
lea rdx, [rbx + 0x2a]
lea rdx, [rdi + rdx*2]
mov dword [rsp + 0x120], 0x310030
mov dword [rsp + 0x124], 0x330032
mov dword [rsp + 0x128], 0x350034
mov dword [rsp + 0x12c], 0x370036
mov dword [rsp + 0x130], 0x390038
mov dword [rsp + 0x134], 0x420041
mov dword [rsp + 0x138], 0x440043
mov dword [rsp + 0x13c], 0x460045
mov r8, r15
nop word [rax + rax]
movzx ecx, byte [rsp + r8 + 0x38]
mov eax, ecx
shr rax, 4
movzx eax, word [rsp + rax*2 + 0x120]
mov word [rdx], ax
movsx rax, cl
and eax, 0xf
movzx eax, word [rsp + rax*2 + 0x120]
mov word [rdx + 2], ax
lea rdx, [rdx + 4]
inc r8
cmp r8, 4
jne 0x1400b5fe0
add rbx, 0x28
lock dec dword [0x1402a9570]
mov rsi, qword [rsp + 0x50]
lea rcx, [rsi + 0x14]
lea rcx, [rcx + rbx*2]
mov dword [rsp + 0x140], 0x310030
mov dword [rsp + 0x144], 0x330032
mov dword [rsp + 0x148], 0x350034
mov dword [rsp + 0x14c], 0x370036
mov dword [rsp + 0x150], 0x390038
mov dword [rsp + 0x154], 0x420041
mov dword [rsp + 0x158], 0x440043
mov dword [rsp + 0x15c], 0x460045
mov rdx, r15
lea r8, [0x1402a9570]
movzx eax, byte [rdx + r8]
shr rax, 4
movzx eax, word [rsp + rax*2 + 0x140]
mov word [rcx], ax
movsx rax, byte [rdx + r8]
and eax, 0xf
movzx eax, word [rsp + rax*2 + 0x140]
mov word [rcx + 2], ax
lea rcx, [rcx + 4]
inc rdx
cmp rdx, 4
jne 0x1400b6091
add rbx, 8
lea eax, [rbx + rbx]
mov dword [rsi + 0x10], eax
mov dword [rsi], 1
mov qword [rdi + 8], r15
mov dword [rsp + 0x20], 0xa
mov r9d, r13d
mov r8, rsi
lea rdx, [rsp + 0xb0]
mov rcx, r14
call r12
nop
mov rcx, rsi
test eax, eax
je 0x1400b6114
call fcn.140155e38
nop
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x1400b61dd
call fcn.140155e38
mov ecx, 5
call fcn.1400ba470
mov rbx, rax
mov ecx, 6
call fcn.1400ba470
mov rdi, rax
mov word [rsp + 0x30], r15w
mov dword [rsp + 0x60], 0x20000
lea rax, [rsp + 0x30]
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x80], 0x30
mov qword [rsp + 0x88], r14
mov dword [rsp + 0x98], r15d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x90], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x28], 0x1000
mov dword [rsp + 0x20], 7
lea r9, [rsp + 0xc0]
lea r8, [rsp + 0x80]
mov edx, 0x10000
lea rcx, [rsp + 0x40]
call rbx
mov rcx, qword [rsp + 0x40]
call rdi
nop
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x1400b61dd
mov rcx, rdi
call fcn.140155e38
nop
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x1400b61dd
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1401557c0
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret