Function at 0x14000b700
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x140155010]
xor rax, rsp
mov qword [rbp + 0x70], rax
mov rbx, rdx
mov r12, rcx
mov qword [rsp + 0x20], rcx
mov qword [rbp + 0x50], rdx
xor r13d, r13d
xorps xmm0, xmm0
movups xmmword [rbp + 0x58], xmm0
lea rax, [rbp + 0xb8]
movabs rcx, 0xff00ff00ff00ff00
mov qword [rbp + 0x60], rcx
mov qword [rbp + 0x68], rax
mov r15, qword [rax]
xor r15, rcx
mov qword [rbp + 0x58], r15
mov qword [rax], r13
lea rcx, [rsp + 0x68]
call fcn.140003110
nop
mov rcx, rax
cmp qword [rax + 0x18], 8
jb 0x14000b781
mov rcx, qword [rax]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rax
call fcn.140059d34
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
lea r8, [rsp + 0x20]
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.140008e00
mov rdx, qword [0x14016d758]
cmp rdx, 0x10
jb 0x14000b7ed
mov rcx, qword [0x14016d740]
inc rdx
cmp rdx, 0x1000
jb 0x14000b7e8
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000b857
mov rcx, r8
call fcn.14005a898
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [0x14016d740], xmm0
movups xmm1, xmmword [rsp + 0x50]
movups xmmword [0x14016d750], xmm1
movdqa xmm0, xmmword [0x1401486f0]
movdqu xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x40], 0
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x14000b863
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b85e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b85e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.14005a898
mov dword [rsp + 0x20], 0x69622e09
mov word [rsp + 0x24], 0x6e
lea rcx, [rsp + 0x68]
call fcn.14000abc0
mov rdi, rax
mov r8, qword [rax + 0x10]
mov qword [rax + 0x10], r8
mov rsi, rax
cmp qword [rax + 0x18], 0x10
jb 0x14000b894
mov rsi, qword [rax]
lea rcx, [0x14005ddb3]
cmp rcx, rsi
jbe 0x14000b8b6
lea rax, [rsi + r8]
cmp rcx, rax
ja 0x14000b8b6
cmp rsi, rcx
jbe 0x14000b8b6
mov r14, rsi
sub r14, rcx
jmp 0x14000b8b9
mov r14, r13
inc r8
mov rdx, rsi
mov rcx, rsi
call sub.VCRUNTIME140.dll_memmove
mov r8, r14
lea rdx, [0x14005ddb3]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rsi + r14]
mov r8, r14
neg r8
lea rdx, [0x14005ddb3]
add rdx, r14
call sub.VCRUNTIME140.dll_memcpy
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
movups xmm0, xmmword [rdi]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rdi + 0x10], r13
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
lea rax, [rsp + 0x21]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x14000b930
lea rdx, [rsp + 0x21]
lea rcx, [rsp + 0x40]
call fcn.140008aa0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x30], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rsp + 0x20]
movq rcx, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 0x10
cmovae rdx, rcx
movq r8, xmm1
lea rcx, [0x14016d740]
call fcn.140008aa0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14000b9dc
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b9d6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b9d6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005a898
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14000ba1c
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ba17
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000ba17
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005a898
movdqa xmm0, xmmword [0x1401486f0]
movdqu xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x40], 0
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x14000ba6e
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ba69
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000ba69
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005a898
lea rdx, [0x14016d740]
mov rcx, rbx
call fcn.1400050e0
test al, al
je 0x14000bb1f
lea rdx, [0x14016d740]
mov rcx, r12
call fcn.140008540
nop
movabs rax, 0xff00ff00ff00ff00
xor r15, rax
lea rax, [rbp + 0xb8]
mov qword [rax], r15
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x14000bae6
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14000bae1
add rdx, 0x27
mov rax, qword [rcx - 8]
sub rcx, rax
add rcx, 0xfffffffffffffff8
cmp rcx, 0x1f
ja 0x14000bd79
mov rcx, rax
call fcn.14005a898
mov rax, r12
mov byte [rbx], 0
mov qword [rbx + 0x18], 0xf
mov qword [rbx + 0x10], r13
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.14005a5a0
mov rbx, qword [rsp + 0x1d0]
add rsp, 0x180
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
movdqa xmm0, xmmword [0x140149280]
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], 0x2064616f
mov dword [rsp + 0x34], 0x656c6966
mov word [rsp + 0x38], 0x21
lea rdx, [rsp + 0x21]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400092b0
lea rdx, [0x140009480]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov cl, 0x60
mov word [rsp + 0x20], 0x60
movsx ecx, cl
movzx eax, cx
xor ax, 0x25
mov word [rsp + 0x22], ax
movzx eax, cx
xor ax, 0x12
mov word [rsp + 0x24], ax
mov word [rsp + 0x26], ax
xor cx, 0xf
mov word [rsp + 0x28], cx
mov word [rsp + 0x2a], ax
mov word [rsp + 0x2c], r13w
lea rdx, [rbp - 0x70]
call fcn.14000bd80
mov r9, rax
lea rdx, [rax + 2]
lea r8, [rax + 4]
mov r10d, 3
nop dword [rax]
movsx ecx, byte [r9]
xor word [r8 - 2], cx
movsx ecx, byte [r9]
xor word [r8], cx
movsx ecx, byte [r9]
xor word [r8 + 2], cx
movsx eax, byte [r9]
xor word [r8 + 4], ax
movsx eax, byte [r9]
xor word [r8 + 6], ax
movsx eax, byte [r9]
xor word [r8 + 8], ax
movsx eax, byte [r9]
xor word [r8 + 0xa], ax
movsx eax, byte [r9]
xor word [r8 + 0xc], ax
movsx eax, byte [r9]
xor word [r8 + 0xe], ax
movsx eax, byte [r9]
xor word [r8 + 0x10], ax
movsx eax, byte [r9]
xor word [r8 + 0x12], ax
movsx eax, byte [r9]
xor word [r8 + 0x14], ax
movsx eax, byte [r9]
xor word [r8 + 0x16], ax
movsx eax, byte [r9]
xor word [r8 + 0x18], ax
movsx eax, byte [r9]
xor word [r8 + 0x1a], ax
movsx eax, byte [r9]
xor word [r8 + 0x1c], ax
movsx eax, byte [r9]
xor word [r8 + 0x1e], ax
movsx eax, byte [r9]
xor word [r8 + 0x20], ax
movsx eax, byte [r9]
xor word [r8 + 0x22], ax
movsx eax, byte [r9]
xor word [r8 + 0x24], ax
movsx eax, byte [r9]
xor word [r8 + 0x26], ax
movsx eax, byte [r9]
xor word [r8 + 0x28], ax
movsx eax, byte [r9]
xor word [r8 + 0x2a], ax
movsx eax, byte [r9]
xor word [r8 + 0x2c], ax
movsx eax, byte [r9]
xor word [r8 + 0x2e], ax
movsx eax, byte [r9]
xor word [r8 + 0x30], ax
movsx eax, byte [r9]
xor word [r8 + 0x32], ax
movsx eax, byte [r9]
xor word [r8 + 0x34], ax
movsx eax, byte [r9]
xor word [r8 + 0x36], ax
movsx eax, byte [r9]
xor word [r8 + 0x38], ax
lea r8, [r8 + 0x3c]
sub r10, 1
jne 0x14000bbc0
mov word [rdx + 0xb4], r13w
xor r9d, r9d
lea r8, [rsp + 0x22]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rax, [0x14016d740]
cmp qword [0x14016d758], 0x10
cmovae rax, qword [0x14016d740]
mov qword [0x14016d750], r13
mov byte [rax], 0
lea rdx, [0x14016d740]
mov rcx, r12
call fcn.140008540
nop
movabs rax, 0xff00ff00ff00ff00
xor r15, rax
lea rax, [rbp + 0xb8]
mov qword [rax], r15
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x14000bae6
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14000bae1
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000bd79
mov rcx, r8
jmp 0x14000bae1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3