Function at 0x14000b710
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x140155010]
xor rax, rsp
mov qword [rbp + 0x70], rax
mov rbx, rdx
mov r12, rcx
mov qword [rsp + 0x20], rcx
mov qword [rbp + 0x50], rdx
xor r13d, r13d
xorps xmm0, xmm0
movups xmmword [rbp + 0x58], xmm0
lea rax, [rbp + 0xb8]
movabs rcx, 0xff00ff00ff00ff00
mov qword [rbp + 0x60], rcx
mov qword [rbp + 0x68], rax
mov r15, qword [rax]
xor r15, rcx
mov qword [rbp + 0x58], r15
mov qword [rax], r13
lea rcx, [rsp + 0x68]
call fcn.140003110
nop
mov rcx, rax
cmp qword [rax + 0x18], 8
jb 0x14000b791
mov rcx, qword [rax]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rax
call fcn.140059dd4
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
lea r8, [rsp + 0x20]
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.140008e10
mov rdx, qword [0x14016d758]
cmp rdx, 0x10
jb 0x14000b7fd
mov rcx, qword [0x14016d740]
inc rdx
cmp rdx, 0x1000
jb 0x14000b7f8
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000b867
mov rcx, r8
call fcn.14005a938
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [0x14016d740], xmm0
movups xmm1, xmmword [rsp + 0x50]
movups xmmword [0x14016d750], xmm1
movdqa xmm0, xmmword [0x1401486f0]
movdqu xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x40], 0
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x14000b873
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b86e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b86e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.14005a938
mov dword [rsp + 0x20], 0x69622e26
mov word [rsp + 0x24], 0x6e
lea rcx, [rsp + 0x68]
call fcn.14000abd0
mov rdi, rax
mov r8, qword [rax + 0x10]
mov qword [rax + 0x10], r8
mov rsi, rax
cmp qword [rax + 0x18], 0x10
jb 0x14000b8a4
mov rsi, qword [rax]
lea rcx, [0x14005ddb3]
cmp rcx, rsi
jbe 0x14000b8c6
lea rax, [rsi + r8]
cmp rcx, rax
ja 0x14000b8c6
cmp rsi, rcx
jbe 0x14000b8c6
mov r14, rsi
sub r14, rcx
jmp 0x14000b8c9
mov r14, r13
inc r8
mov rdx, rsi
mov rcx, rsi
call sub.VCRUNTIME140.dll_memmove
mov r8, r14
lea rdx, [0x14005ddb3]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rsi + r14]
mov r8, r14
neg r8
lea rdx, [0x14005ddb3]
add rdx, r14
call sub.VCRUNTIME140.dll_memcpy
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
movups xmm0, xmmword [rdi]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rdi + 0x10], r13
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
lea rax, [rsp + 0x21]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x14000b940
lea rdx, [rsp + 0x21]
lea rcx, [rsp + 0x40]
call fcn.140008ab0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x30], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rsp + 0x20]
movq rcx, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 0x10
cmovae rdx, rcx
movq r8, xmm1
lea rcx, [0x14016d740]
call fcn.140008ab0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14000b9ec
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b9e6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b9e6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005a938
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14000ba2c
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ba27
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000ba27
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005a938
movdqa xmm0, xmmword [0x1401486f0]
movdqu xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x40], 0
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x14000ba7e
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ba79
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000ba79
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005a938
lea rdx, [0x14016d740]
mov rcx, rbx
call fcn.1400050f0
test al, al
je 0x14000bb2f
lea rdx, [0x14016d740]
mov rcx, r12
call fcn.140008550
nop
movabs rax, 0xff00ff00ff00ff00
xor r15, rax
lea rax, [rbp + 0xb8]
mov qword [rax], r15
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x14000baf6
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14000baf1
add rdx, 0x27
mov rax, qword [rcx - 8]
sub rcx, rax
add rcx, 0xfffffffffffffff8
cmp rcx, 0x1f
ja 0x14000bd89
mov rcx, rax
call fcn.14005a938
mov rax, r12
mov byte [rbx], 0
mov qword [rbx + 0x18], 0xf
mov qword [rbx + 0x10], r13
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.14005a640
mov rbx, qword [rsp + 0x1d0]
add rsp, 0x180
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
movdqa xmm0, xmmword [0x140149210]
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], 0x2064616f
mov dword [rsp + 0x34], 0x656c6966
mov word [rsp + 0x38], 0x21
lea rdx, [rsp + 0x21]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400092c0
lea rdx, [0x140009490]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov cl, 0x32
mov word [rsp + 0x20], 0x32
movsx ecx, cl
movzx eax, cx
xor ax, 0x77
mov word [rsp + 0x22], ax
movzx eax, cx
xor ax, 0x40
mov word [rsp + 0x24], ax
mov word [rsp + 0x26], ax
xor cx, 0x5d
mov word [rsp + 0x28], cx
mov word [rsp + 0x2a], ax
mov word [rsp + 0x2c], r13w
lea rdx, [rbp - 0x70]
call fcn.14000bd90
mov r9, rax
lea rdx, [rax + 2]
lea r8, [rax + 4]
mov r10d, 3
nop dword [rax]
movsx ecx, byte [r9]
xor word [r8 - 2], cx
movsx ecx, byte [r9]
xor word [r8], cx
movsx ecx, byte [r9]
xor word [r8 + 2], cx
movsx eax, byte [r9]
xor word [r8 + 4], ax
movsx eax, byte [r9]
xor word [r8 + 6], ax
movsx eax, byte [r9]
xor word [r8 + 8], ax
movsx eax, byte [r9]
xor word [r8 + 0xa], ax
movsx eax, byte [r9]
xor word [r8 + 0xc], ax
movsx eax, byte [r9]
xor word [r8 + 0xe], ax
movsx eax, byte [r9]
xor word [r8 + 0x10], ax
movsx eax, byte [r9]
xor word [r8 + 0x12], ax
movsx eax, byte [r9]
xor word [r8 + 0x14], ax
movsx eax, byte [r9]
xor word [r8 + 0x16], ax
movsx eax, byte [r9]
xor word [r8 + 0x18], ax
movsx eax, byte [r9]
xor word [r8 + 0x1a], ax
movsx eax, byte [r9]
xor word [r8 + 0x1c], ax
movsx eax, byte [r9]
xor word [r8 + 0x1e], ax
movsx eax, byte [r9]
xor word [r8 + 0x20], ax
movsx eax, byte [r9]
xor word [r8 + 0x22], ax
movsx eax, byte [r9]
xor word [r8 + 0x24], ax
movsx eax, byte [r9]
xor word [r8 + 0x26], ax
movsx eax, byte [r9]
xor word [r8 + 0x28], ax
movsx eax, byte [r9]
xor word [r8 + 0x2a], ax
movsx eax, byte [r9]
xor word [r8 + 0x2c], ax
movsx eax, byte [r9]
xor word [r8 + 0x2e], ax
movsx eax, byte [r9]
xor word [r8 + 0x30], ax
movsx eax, byte [r9]
xor word [r8 + 0x32], ax
movsx eax, byte [r9]
xor word [r8 + 0x34], ax
movsx eax, byte [r9]
xor word [r8 + 0x36], ax
movsx eax, byte [r9]
xor word [r8 + 0x38], ax
lea r8, [r8 + 0x3c]
sub r10, 1
jne 0x14000bbd0
mov word [rdx + 0xb4], r13w
xor r9d, r9d
lea r8, [rsp + 0x22]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rax, [0x14016d740]
cmp qword [0x14016d758], 0x10
cmovae rax, qword [0x14016d740]
mov qword [0x14016d750], r13
mov byte [rax], 0
lea rdx, [0x14016d740]
mov rcx, r12
call fcn.140008550
nop
movabs rax, 0xff00ff00ff00ff00
xor r15, rax
lea rax, [rbp + 0xb8]
mov qword [rax], r15
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x14000baf6
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14000baf1
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000bd89
mov rcx, r8
jmp 0x14000baf1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3