Function at 0x140196a00
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
xchg r13, rbx
mov qword [rsp + 0x18], r13
xchg r13, rbx
xchg r13, rsi
mov qword [rsp + 0x20], r13
xchg r13, rsi
nop
mov qword [rsp - 8], rbp
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], rdi
push r12
nop
push 0x7a0dfea3
mov qword [rsp], r14
nop
sub rsp, 8
mov qword [rsp], r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rbx, rcx
xor r14d, r14d
mov qword [rcx + 0x10], r14
mov qword [rcx + 0x20], r14
xchg r14, r9
mov qword [rcx + 0x30], r9
xchg r9, r14
mov qword [rcx + 0x40], r14
mov qword [rcx + 0x50], r14
xchg rdi, r14
mov qword [rcx + 0x60], rdi
xchg r14, rdi
xchg r12, r14
mov qword [rcx + 0x70], r12
xchg r12, r14
mov qword [rcx + 0x80], r14
xchg r14, rdx
mov qword [rcx + 0x90], rdx
xchg r14, rdx
mov qword [rcx + 0xa0], r14
mov qword [rcx + 0xb0], r14
mov qword [rcx + 0xc0], r14
xchg r8, r14
mov qword [rcx + 0xd0], r8
xchg r14, r8
mov qword [rcx + 0xe0], r14
mov qword [rcx + 0xf0], r14
xchg r8, r14
mov qword [rcx + 0x100], r8
xchg r14, r8
mov rax, qword gs:[0x30]
xchg r12, rcx
mov r12, qword [rax + 0x60]
xchg r12, rcx
mov rax, qword [rcx + 0x18]
mov rcx, qword [rax + 0x20]
mov rax, qword [rcx]
mov rdx, qword [rax + 0x20]
mov qword [rbx], rdx
lea r15, [0x140003e38]
mov qword [rbp - 0x70], r15
lea r12, [0x140198950]
mov qword [rbp - 0x68], r12
lea rax, [rbp - 0x70]
xchg rdx, rax
mov qword [rbp - 0x38], rdx
xchg rdx, rax
lea r9, [rbp - 0x70]
xor r8d, r8d
xchg rbx, r10
mov rcx, r10
xchg rbx, r10
call fcn.1401986b0
mov dword [rsp + 0x30], 0x566e4b74
xor dword [rsp + 0x30], 0x18c2cc82
xor dword [rsp + 0x30], 0x12611b7b
xor dword [rsp + 0x30], 0x1dd255ff
xor dword [rsp + 0x30], 0x295029d6
sub dword [rsp + 0x30], 0x18861bf
add dword [rsp + 0x30], 0x902f7811
mov dword [rsp + 0x50], 0x7004b809
xor dword [rsp + 0x50], 0xd2f558c
sub dword [rsp + 0x50], 0x6cd7b539
add dword [rsp + 0x50], 0x4c457cd
sub dword [rsp + 0x50], 0x8ae4b09
add dword [rsp + 0x50], 0x6246e4f3
sub dword [rsp + 0x50], 0xaacf25a
sub dword [rsp + 0x50], 0x616fa3a6
add dword [rsp + 0x50], 0xfcc96b63
mov dword [rsp + 0x54], 0x57be518f
sub dword [rsp + 0x54], 0x1fd1c8c
sub dword [rsp + 0x54], 0x539cab21
add dword [rsp + 0x54], 0x4352e1c2
sub dword [rsp + 0x54], 0x1815d5a8
add dword [rsp + 0x54], 0x15b2df2
add dword [rsp + 0x54], 0x26983d3a
xor dword [rsp + 0x54], 0x65292402
add dword [rsp + 0x54], 0xcf01da59
mov dword [rsp + 0x34], 0x5a7079a3
xor dword [rsp + 0x34], 0x3fcc47dd
add dword [rsp + 0x34], 0x149fa828
sub dword [rsp + 0x34], 0x2edf3829
xor dword [rsp + 0x34], 0x34fd2ec
add dword [rsp + 0x34], 0x12cd47ee
sub dword [rsp + 0x34], 0x92853f1
sub dword [rsp + 0x34], 0x3f62ce99
xor dword [rsp + 0x34], 0xe4835703
mov dword [rsp + 0x58], 0x4c6c6420
xor dword [rsp + 0x58], 0x159e7bf8
sub dword [rsp + 0x58], 0x40176249
add dword [rsp + 0x58], 0x4219d943
add dword [rsp + 0x58], 0x1c5bed82
add dword [rsp + 0x58], 0x871f7b2a
mov dword [rsp + 0x5c], 0x21dc6f2a
add dword [rsp + 0x5c], 0x5028f710
add dword [rsp + 0x5c], 0x81203b5
xor dword [rsp + 0x5c], 0x727eaf04
xor dword [rsp + 0x5c], 0x3796f135
xor dword [rsp + 0x5c], 0x3848afaa
add dword [rsp + 0x5c], 0x61d31881
sub dword [rsp + 0x5c], 0x156d2145
xor dword [rsp + 0x5c], 0xab4170c7
mov dword [rsp + 0x38], 0x7ba01f94
sub dword [rsp + 0x38], 0xaa52643
sub dword [rsp + 0x38], 0x3ee7b9f8
sub dword [rsp + 0x38], 0x2d1906e4
add dword [rsp + 0x38], 0x712f919c
sub dword [rsp + 0x38], 0x324f3ece
add dword [rsp + 0x38], 0x3bd5964f
sub dword [rsp + 0x38], 0x4b1a3225
add dword [rsp + 0x38], 0xc2610789
mov dword [rsp + 0x60], 0x5acbb899
xor dword [rsp + 0x60], 0x3bea09e1
xor dword [rsp + 0x60], 0x361f550d
sub dword [rsp + 0x60], 0x134da070
add dword [rsp + 0x60], 0x2c43a657
xor dword [rsp + 0x60], 0x3571cda2
add dword [rsp + 0x60], 0x17470d8e
add dword [rsp + 0x60], 0x96a52ab
xor dword [rsp + 0x60], 0x9a8f774e
mov dword [rsp + 0x64], 0x3dcb0808
xor dword [rsp + 0x64], 0x45cd736b
xor dword [rsp + 0x64], 0x76cfb44
xor dword [rsp + 0x64], 0x622699df
add dword [rsp + 0x64], 0x37a9674d
add dword [rsp + 0x64], 0x1180d951
sub dword [rsp + 0x64], 0x377588d2
add dword [rsp + 0x64], 0xcc209b1
add dword [rsp + 0x64], 0xc3a42409
mov dword [rsp + 0x3c], 0x1ba0d40b
xor dword [rsp + 0x3c], 0x2f67c1e5
xor dword [rsp + 0x3c], 0x2814f506
xor dword [rsp + 0x3c], 0x3b183f8b
add dword [rsp + 0x3c], 0xa779ee5
add dword [rsp + 0x3c], 0x2dbd55f3
xor dword [rsp + 0x3c], 0x790f8e97
add dword [rsp + 0x3c], 0xdde79c4a
mov dword [rsp + 0x68], 0x1fbb9242
sub dword [rsp + 0x68], 0x1c72e1c7
xor dword [rsp + 0x68], 0x5f6ea5ef
xor dword [rsp + 0x68], 0x5c625205
add dword [rsp + 0x68], 0x439c1c3e
add dword [rsp + 0x68], 0x113ef6c7
add dword [rsp + 0x68], 0x171b88a7
sub dword [rsp + 0x68], 0x6682337b
xor dword [rsp + 0x68], 0xfa3b50bf
mov dword [rsp + 0x6c], 0x4e36ac0a
xor dword [rsp + 0x6c], 0x421181e5
add dword [rsp + 0x6c], 0x20e828e4
sub dword [rsp + 0x6c], 0xc63aed8
add dword [rsp + 0x6c], 0x362072d8
xor dword [rsp + 0x6c], 0x1882a88d
xor dword [rsp + 0x6c], 0x1c0d1db4
sub dword [rsp + 0x6c], 0x2d73d8a5
add dword [rsp + 0x6c], 0xdaaf2838
mov dword [rsp + 0x40], 0x65fc3f3f
xor dword [rsp + 0x40], 0x16826efa
xor dword [rsp + 0x40], 0x68c5ddc3
sub dword [rsp + 0x40], 0xe424abf
add dword [rsp + 0x40], 0x4e467a7a
sub dword [rsp + 0x40], 0x366850c7
add dword [rsp + 0x40], 0x23cadd8c
sub dword [rsp + 0x40], 0x447040e7
add dword [rsp + 0x40], 0xf244ef57
mov dword [rsp + 0x70], 0x59756319
sub dword [rsp + 0x70], 0xdab44bc
xor dword [rsp + 0x70], 0x59a1b511
add dword [rsp + 0x70], 0x1ae49375
add dword [rsp + 0x70], 0xcda5642
add dword [rsp + 0x70], 0x255da8fa
sub dword [rsp + 0x70], 0x5b0c2699
add dword [rsp + 0x70], 0x1b23e79b
xor dword [rsp + 0x70], 0xe0e80190
mov dword [rsp + 0x74], 0x4ab7896b
sub dword [rsp + 0x74], 0x9945eb4
xor dword [rsp + 0x74], 0x59d2446d
xor dword [rsp + 0x74], 0xa7dd514
add dword [rsp + 0x74], 0x65cb3c2c
sub dword [rsp + 0x74], 0x6edca03c
add dword [rsp + 0x74], 0x763140ad
xor dword [rsp + 0x74], 0x959b00d
xor dword [rsp + 0x74], 0x89c9d75b
mov dword [rsp + 0x44], 0x513c322b
add dword [rsp + 0x44], 0xb89fc30
sub dword [rsp + 0x44], 0x355fa796
xor dword [rsp + 0x44], 0x681521cb
xor dword [rsp + 0x44], 0xf0771ea
xor dword [rsp + 0x44], 0x7eb26aca
xor dword [rsp + 0x44], 0xc8304ad8
mov dword [rsp + 0x78], 0x3cf72164
add dword [rsp + 0x78], 0x2351f90a
sub dword [rsp + 0x78], 0x26d61829
xor dword [rsp + 0x78], 0x9a943ab
add dword [rsp + 0x78], 0x9398d6a
add dword [rsp + 0x78], 0x1d2b5945
add dword [rsp + 0x78], 0xa839d6c9
mov dword [rsp + 0x7c], 0x6743f237
add dword [rsp + 0x7c], 0x35666e8
xor dword [rsp + 0x7c], 0x7483388e
sub dword [rsp + 0x7c], 0x97edaf9
add dword [rsp + 0x7c], 0x46b9baf9
xor dword [rsp + 0x7c], 0xa43abeef
mov dword [rsp + 0x48], 0x7c79ace3
xor dword [rsp + 0x48], 0x3314e865
xor dword [rsp + 0x48], 0x3fed48eb
sub dword [rsp + 0x48], 0x3c377bf4
xor dword [rsp + 0x48], 0x1009e2fc
add dword [rsp + 0x48], 0x204e9475
add dword [rsp + 0x48], 0x34bfad82
sub dword [rsp + 0x48], 0x47e4d187
add dword [rsp + 0x48], 0xc58c1401
mov dword [rbp - 0x80], 0x3714cac
xor dword [rbp - 0x80], 0x728608ea
sub dword [rbp - 0x80], 0x266c2cdd
sub dword [rbp - 0x80], 0x3b883822
xor dword [rbp - 0x80], 0x42b7dd1d
add dword [rbp - 0x80], 0xacc1fd1c
mov dword [rbp - 0x7c], 0x4f5d7987
sub dword [rbp - 0x7c], 0x3528bb16
add dword [rbp - 0x7c], 0x26521cf
add dword [rbp - 0x7c], 0x5d8a7f9
add dword [rbp - 0x7c], 0x252feef4
xor dword [rbp - 0x7c], 0xb8cc8815
mov word [rsp + 0x4c], 0x72a
add word [rsp + 0x4c], 0x454d
xor word [rsp + 0x4c], 0x7a0a
sub word [rsp + 0x4c], 0x1243
xor word [rsp + 0x4c], 0x3401
xor word [rsp + 0x4c], 0x82f
add word [rsp + 0x4c], 0x34ec
add word [rsp + 0x4c], 0xa9f6
mov dword [rbp - 0x78], 0x72246ce
add dword [rbp - 0x78], 0x21cf5fb3
sub dword [rbp - 0x78], 0x26d9b5f4
add dword [rbp - 0x78], 0x3016f865
xor dword [rbp - 0x78], 0x73a7efaf
add dword [rbp - 0x78], 0x75b1f96
xor dword [rbp - 0x78], 0x361664ee
xor dword [rbp - 0x78], 0x2129ba67
xor dword [rbp - 0x78], 0xa0ad070c
xor eax, eax
mov word [rbp - 0x74], ax
nop word [rax + rax]
movzx ecx, word [rsp + rax*2 + 0x50]
movzx edx, byte [rsp + rax + 0x30]
add dx, cx
mov word [rsp + rax*2 + 0x50], dx
mov byte [rsp + rax + 0x30], r14b
inc rax
cmp rax, 0x1e
jb 0x1401970f7
xor r8d, r8d
lea rdx, [rsp + 0x50]
xchg rbx, r9
mov rcx, r9
xchg r9, rbx
call fcn.1401993f0
mov rdi, rax
xchg rcx, r14
mov r14, rcx
xchg r14, rcx
nop word [rax + rax]
mov byte [rsp + rcx + 0x50], 0x52
xor byte [rsp + rcx + 0x50], 0x16
sub byte [rsp + rcx + 0x50], 0xa
xor byte [rsp + rcx + 0x50], 0x5a
add byte [rsp + rcx + 0x50], 0x15
sub byte [rsp + rcx + 0x50], 0x1a
xor byte [rsp + rcx + 0x50], 0x5b
inc rcx
cmp rcx, 0x3c
jb 0x140197147
mov qword [rsp + 0x28], r14
mov byte [rsp + 0x20], 0x5a
xor byte [rsp + 0x20], 0x4f
xor byte [rsp + 0x20], 0x6d
sub byte [rsp + 0x20], 0x6e
add byte [rsp + 0x20], 0x21
xor byte [rsp + 0x20], 0x2b
xor r9d, r9d
xor r8d, r8d
xchg rbp, rdi
mov rdx, rbp
xchg rdi, rbp
xchg r9, rbx
mov rcx, r9
xchg r9, rbx
call fcn.14019a520
xchg r14, rax
mov qword [rbx + 8], r14
xchg r14, rax
mov qword [rbp + 0x40], rdi
test rdi, rdi
je 0x140197228
mov dword [rsp + 0x20], 0x2fb85f9
add dword [rsp + 0x20], 0x2626f5d5
add dword [rsp + 0x20], 0x4122d460
xor dword [rsp + 0x20], 0x3e7fb541
xor dword [rsp + 0x20], 0x7cf0b862
xor dword [rsp + 0x20], 0x31a0fe85
xor dword [rsp + 0x20], 0x5c3878da
add dword [rsp + 0x20], 0x311130c7
sub dword [rsp + 0x20], 0x76638c19
xor r9d, r9d
lea r8, [rbp + 0x40]
lea rdx, [r9 - 1]
lea rcx, [rbx + 0x70]
call fcn.1401975d0
xchg r15, r11
mov qword [rbp - 0x30], r11
xchg r11, r15
xchg r9, r12
mov qword [rbp - 0x28], r9
xchg r9, r12
lea rax, [rbp - 0x30]
mov qword [rbp + 8], rax
lea r9, [rbp - 0x30]
xor r8d, r8d
mov rdx, qword [rbx + 8]
xchg rdi, rcx
mov rdi, rbx
xchg rcx, rdi
call fcn.1401986b0
xchg r13, rbx
mov rax, r13
xchg r13, rbx
lea r11, [rsp + 0x110]
xchg rbx, rcx
mov rcx, qword [r11 + 0x40]
xchg rbx, rcx
xchg rsi, r8
mov r8, qword [r11 + 0x48]
xchg r8, rsi
mov rsp, r11
nop
add rsp, 8
mov r15, qword [rsp - 8]
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
add rsp, 8
xchg qword [rsp - 8], r12
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
mov rbp, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]