Function at 0x1400916b0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xa8
mov r9, rcx
xor ebx, ebx
mov dword [rbp - 0x45], ebx
mov dword [rbp + 0x77], ebx
mov dword [rbp + 0x77], 0xd578a6e4
mov eax, 0x3af07fc7
sub eax, dword [0x140333058]
sub eax, dword [0x140333050]
xor eax, 0x489034f8
sub eax, dword [0x140333048]
mov rdx, qword [0x140333040]
lea ecx, [rdx - 0x7c323f8b]
add ecx, eax
xor ecx, 0x116af53a
sub ecx, 0x7d8f3409
xor ecx, 0xb308120f
mov r8d, dword [0x140333030]
xor r8d, 0x234e9da9
sub r8d, ecx
mov eax, dword [0x140333038]
xor eax, 0xdcb16256
sub r8d, eax
sub r8d, edx
sub r8d, 0x6cf596be
xor r8d, 0x329ca8c6
mov dword [rbp + 0x77], r8d
movsxd rax, r8d
mov qword [rbp - 0x21], rax
mov dword [rbp + 0x77], ebx
lea r8, [rbp - 0x21]
lea rdx, [rbp + 0x6f]
mov rcx, r9
call fcn.140081538
mov dword [rbp - 0x3d], ebx
mov dword [rbp - 0x3d], 0x5e25f2ca
mov eax, 0xf98be6cf
sub eax, dword [0x140333058]
sub eax, dword [0x140333050]
xor eax, 0x399cd997
sub eax, dword [0x140333048]
mov rcx, qword [0x140333040]
add eax, 0x5f9ba05
add eax, ecx
xor eax, 0x202282c9
add eax, 0x4add2f81
xor eax, 0x65bb2089
lea edx, [rcx + 0x97ba73d]
add edx, eax
not edx
mov eax, dword [0x140333038]
xor eax, 0xd8fc0538
sub edx, eax
mov eax, dword [0x140333030]
xor eax, 0x2703fac7
add eax, 0x7c97e952
add eax, edx
xor eax, 0x60a8be88
mov dword [rbp - 0x31], eax
mov dword [rbp - 0x3d], eax
mov dword [rbp + 0x7f], ebx
mov dword [rbp + 0x7f], 0xd706f5c8
mov eax, 0x298c2630
sub eax, dword [0x140333058]
sub eax, dword [0x140333050]
xor eax, 0x8ff3b72
sub eax, dword [0x140333048]
mov rdx, qword [0x140333040]
lea ecx, [rdx + 0x28986a8]
add ecx, eax
xor ecx, 0x8b033794
sub ecx, 0x729553f
xor ecx, 0x8f9b4bdd
mov r8d, dword [0x140333030]
xor r8d, 0x1a73c525
sub r8d, ecx
mov eax, dword [0x140333038]
xor eax, 0xe58c3ada
sub r8d, eax
sub r8d, edx
sub r8d, 0x61ccd416
xor r8d, 0xaa7c4382
mov dword [rbp - 0x35], r8d
mov dword [rbp + 0x7f], r8d
mov dword [rbp + 0x7f], ebx
mov qword [rbp - 0x29], rbx
movabs rax, 0x373f1b2a8dbd58dd
mov qword [rbp - 0x29], rax
movabs rax, 0xeacd573e48bb0d36
sub rax, qword [0x140333050]
sub rax, qword [0x140333058]
movabs rcx, 0xf8f8cd991667fa73
xor rax, rcx
sub rax, qword [0x140333048]
movabs rcx, 0x7d654ba6d130fca
add rcx, rax
mov rdx, qword [0x140333040]
add rcx, rdx
movabs rax, 0x5a9179a9181a54fb
xor rcx, rax
movabs rax, 0x5f627dc736615c3e
sub rcx, rax
movabs rax, 0x6a3b3cd2ae74b10e
xor rcx, rax
movabs rax, 0xb483ce455cef6b26
add rax, rcx
add rdx, rax
not rdx
movabs rcx, 0x13cce94ad5966f0e
mov rax, qword [0x140333038]
xor rax, rcx
sub rdx, rax
movabs rax, 0xec3316b52a6990f1
mov rcx, qword [0x140333030]
xor rcx, rax
movabs rax, 0xe0b56d8b33dbe863
add rax, rdx
add rax, rcx
movabs rcx, 0xd68fb96989d46c2e
xor rax, rcx
mov qword [rbp - 0x19], rax
mov qword [rbp - 0x29], rax
mov dword [rbp - 0x49], ebx
mov dword [rbp - 0x49], 0x33612b7
mov eax, 0x64d45b5
sub eax, dword [0x140333058]
sub eax, dword [0x140333050]
xor eax, 0x219bdd52
sub eax, dword [0x140333048]
mov rcx, qword [0x140333040]
add eax, 0xfc0c1a15
add eax, ecx
xor eax, 0x24af3054
sub eax, 0x3daf2de2
xor eax, 0x4bf8eb35
lea edx, [rcx + 0x67a9f899]
add edx, eax
not edx
mov eax, dword [0x140333038]
xor eax, 0xd56a4ffe
sub edx, eax
mov ecx, dword [0x140333030]
xor ecx, 0x2a95b001
add ecx, 0x750f995
add ecx, edx
xor ecx, 0x273eeffe
mov dword [rbp - 0x49], ecx
mov dword [rbp - 0x39], ecx
mov dword [rbp - 0x49], ebx
xorps xmm0, xmm0
movups xmmword [rbp - 0x11], xmm0
movups xmmword [rbp - 1], xmm0
mov esi, ebx
mov r13d, 0xd2e68a3a
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
lea r12d, [rbx + 2]
movups xmm0, xmmword [rax + 0x58]
movd ecx, xmm0
sub cx, 8
test esi, esi
je 0x140091a4b
psrldq xmm0, 8
movq r9, xmm0
movzx ecx, cx
shr rcx, 1
lea r11, [r9 + rcx*2]
mov r10d, 0xe9fc21d6
jmp 0x140091a3d
movsx edx, byte [r9]
mov r8d, edx
imul r8d, edx
add r8d, 0x31
xor r8d, 0x4764996c
mov ecx, r10d
xor ecx, edx
mov r10d, r8d
imul r10d, ecx
add r9, r12
cmp r9, r11
jne 0x140091a18
cmp r10d, esi
jne 0x140091b70
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov rcx, qword [rcx + r11 + 0x88]
mov edi, ecx
add rdi, r11
shr rcx, 0x20
cmp rdi, r11
je 0x140091b70
mov r14d, dword [rdi + 0x18]
test r14d, r14d
je 0x140091b70
mov r9d, dword [rdi + 0x20]
dec r14d
mov r8d, r14d
lea rdx, [r11 + r14*4]
mov r10d, dword [rdx + r9]
add r10, r11
mov r15d, 0xe9fc21d6
mov dl, byte [r10]
inc r10
test dl, dl
je 0x140091ad3
movsx r8d, dl
mov r9d, r8d
imul r9d, r8d
add r9d, 0x31
xor r9d, 0x4764996c
mov edx, r15d
xor edx, r8d
mov r15d, r9d
imul r15d, edx
mov dl, byte [r10]
inc r10
test dl, dl
jne 0x140091a9f
mov r8d, r14d
mov r9d, dword [rdi + 0x20]
cmp r15d, r13d
je 0x140091ae2
test r14d, r14d
jne 0x140091a7e
jmp 0x140091b70
mov edx, dword [rdi + 0x1c]
add rdx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + r8*2]
mov r10d, dword [rdx + rax*4]
add r10, r11
cmp r10, rdi
jbe 0x140091b78
lea rax, [rdi + rcx]
cmp r10, rax
jae 0x140091b78
mov esi, 0xe9fc21d6
mov r13d, esi
jmp 0x140091b2f
movsx ecx, al
mov edx, ecx
imul edx, ecx
add edx, 0x31
xor edx, 0x4764996c
mov eax, esi
xor eax, ecx
mov esi, edx
imul esi, eax
inc r10
mov al, byte [r10]
cmp al, 0x2e
jne 0x140091b12
jmp 0x140091b55
movsx ecx, al
mov edx, ecx
imul edx, ecx
add edx, 0x31
xor edx, 0x4764996c
mov eax, r13d
xor eax, ecx
mov r13d, edx
imul r13d, eax
inc r10
mov al, byte [r10]
test al, al
jne 0x140091b38
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rax, qword [rax]
jmp 0x1400919ec
lea rax, [rbp - 0x11]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x39]
mov qword [rsp + 0x30], rax
mov eax, dword [rbp - 0x35]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov rsi, qword [rbp - 0x19]
mov r9d, esi
lea r8, [rbp + 0x6f]
mov edi, dword [rbp - 0x31]
mov edx, edi
mov rcx, qword [rbp + 0x67]
mov rcx, qword [rcx]
call r10
test eax, eax
je 0x140091c44
mov dword [rbp - 0x41], ebx
mov dword [rbp - 0x41], 0xa029944d
mov r8d, 1
mov dword [rbp - 0x45], r8d
mov eax, 0xff6dc0fb
sub eax, dword [0x140333058]
sub eax, dword [0x140333050]
xor eax, 0x15c72a63
sub eax, dword [0x140333048]
mov rcx, qword [0x140333040]
add eax, 0x5614be9f
add eax, ecx
xor eax, 0xf7e3c1f5
add eax, 0x543c706d
xor eax, 0xec15bfc5
lea edx, [rcx - 0x18d5e9e8]
add edx, eax
not edx
mov eax, dword [0x140333038]
xor eax, 0xd989276c
sub edx, eax
mov ecx, dword [0x140333030]
xor ecx, 0x2676d893
add ecx, 0xa88ff07
add ecx, edx
xor ecx, 0xd6ccc304
mov dword [rbp - 0x41], ecx
movsxd rax, ecx
cmp qword [rbp - 0x11], rax
jne 0x140091c48
jmp 0x140091c4a
mov r8d, dword [rbp - 0x45]
mov edi, ebx
lea eax, [rsi + rdi]
test r8b, 1
je 0x140091c5e
and r8d, 0xfffffffe
mov dword [rbp - 0x45], r8d
mov dword [rbp - 0x41], ebx
mov qword [rbp - 0x29], rbx
mov dword [rbp - 0x3d], ebx
test eax, eax
jne 0x140091c70
xor eax, eax
jmp 0x140091fe2
movabs rsi, 0xf27f9bbf9a0f2cc4
movabs rdi, 0xd488ab728e70c09c
movabs rax, 0x1954a8784bad5ba0
movabs r14, 0xf15b06fcac8614e7
mov r15, qword [0x140333070]
imul r15, rax
not r15
movabs rcx, 0x2b77548d72d52992
mov rax, qword [0x140333060]
xor rax, rcx
and r15, rax
ror r15, 0x2d
shr r15, 8
movabs rax, 0xf3e2006752f20450
mov r10, qword [0x140333088]
imul r10, rax
movabs r8, 0xd80644065f0d33c
sub r10, r8
movabs rax, 0xfb0b85667fffffff
xor r10, rax
shr r10, 0x1f
not r10
lea rcx, [r10 + r8]
movabs rax, 0xaaaaaaaaaaaaaaab
mul rcx
shr rdx, 2
lea rax, [rdx + rdx*2]
add rax, rax
sub rcx, rax
lea rdx, [0x140333060]
movzx eax, r10b
movzx ecx, byte [rdx + rcx*8]
imul ecx, eax
movzx ecx, cl
xor ecx, 0xc9
and ecx, 0x8000003f
jge 0x140091d44
dec ecx
or ecx, 0xffffffc0
inc ecx
mov rdx, r10
ror rdx, cl
not rdx
movabs rax, 0xba20af921e048488
mov r13, rdx
imul r13, rax
lea r9, [r8 + r13]
movzx ecx, r9b
xor cl, 6
and cl, 0xf
mov r11, r10
imul r11, r15
sub r11, r9
xor r11, r14
rol r11, cl
mov rax, r9
sub rax, qword [0x140333078]
xor r11, rax
movabs rax, 0xbfe73c7d5634d820
imul rdx, rax
movabs rax, 0x65f798c5e93409f0
add rdx, rax
xor r11, rdx
xor r11, rdi
dec r12
sub r12, 1
je 0x140091eac
cmp r12, 1
movabs r12, 0xaaaaaaaaaaaaaaab
jne 0x140091f7c
mov r14, r10
imul r14, r9
movabs rax, 0xbf12ab01caa9495c
add rax, r11
xor r14, rax
ror r14, 0x16
shr r14, 0xc
not r14
movzx eax, r11b
movzx ecx, r14b
imul ecx, eax
and cl, 0x3f
movabs rdx, 0x83573eb254de
add rdx, qword [0x140333088]
movabs rax, 0xd02e1381059a762
xor rdx, rax
ror rdx, cl
shl rdx, 0xf
movabs rax, 0xf7ca7db96652b821
sub rax, r10
mov r10, rdx
xor r10, rax
mov rcx, r10
imul rcx, rsi
mov eax, 0xb7896acb
add rcx, rax
mov rax, r12
mul rcx
shr rdx, 2
lea rax, [rdx + rdx*2]
add rax, rax
sub rcx, rax
lea r8, [0x140333060]
mov cl, byte [r8 + rcx*8]
and cl, 0xf
movabs rsi, 0x304bc888258cc985
sub rsi, r14
shr rsi, cl
movabs rcx, 0xd8888c8aafded44
add rcx, r13
mov rax, r12
mul rcx
shr rdx, 2
lea rax, [rdx + rdx*2]
add rax, rax
sub rcx, rax
mov rax, r11
imul rax, qword [r8 + rcx*8]
imul rax, r11
sub rax, r15
xor rsi, rax
jmp 0x140091f7c
movabs rcx, 0xaaaaaa1ab79097f5
mov r10, r11
xor r10, rcx
movabs rcx, 0x1206ed759d4bb9
imul r10, rcx
movabs rcx, 0xffff7e8a9180a529
imul r13, rcx
movabs rcx, 0x130fd1ac8b5c4b0
add r10, rcx
add r10, r13
lea ecx, [r11 - 9]
and cl, 0x3f
movabs rax, 0x277cd7be65404095
mov r8, r10
xor r8, rax
movabs r12, 0xaaaaaaaaaaaaaaab
mov rax, r12
mul r8
shr rdx, 2
lea rax, [rdx + rdx*2]
add rax, rax
sub r8, rax
mov r9, r10
not r9
lea rax, [0x140333060]
imul r9, qword [rax + r8*8]
xor r9, 0xffffffffe2c54125
rol r9, cl
movabs rax, 0x686a3d4200000000
imul r9, rax
mov cl, r15b
and cl, 0x3f
mov rdx, r9
ror rdx, 0xf
not rdx
movabs rax, 0x9b2de6b2aab30ac8
imul rdx, rax
mov rax, r10
sub rax, r9
lea rdx, [rdx + rax*4]
ror rdx, cl
mov rax, rsi
mov rsi, rdx
imul rsi, rax
movabs rcx, 0xff055d7b97e6baf9
xor r14, rcx
mov rax, r12
mul r14
shr rdx, 2
lea rax, [rdx + rdx*2]
add rax, rax
sub r14, rax
xor rdi, rbx
lea rax, [0x140333060]
imul rdi, qword [rax + r14*8]
not r9
imul r9, r11
imul r9, r15
imul r9, rsi
movabs rcx, 0xf5ed7e879055f025
xor rcx, r10
not rcx
xor rcx, r9
sub rcx, rdi
call fcn.14008073c
mov qword [0x140337f70], rax
mov eax, 1
add rsp, 0xa8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret