Function at 0x140196c80
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
xchg rbx, r10
mov qword [rsp + 0x18], r10
xchg r10, rbx
mov qword [rsp + 0x20], rsi
push rbp
nop
push 0x862a095
mov qword [rsp], rdi
push r12
push r13
mov qword [rsp], r14
nop
mov qword [rsp - 8], r15
sub rsp, 8
lea rbp, [rsp - 0x10]
sub rsp, 0x110
xchg rcx, rbx
mov rcx, rbx
xchg rcx, rbx
xor r14d, r14d
mov qword [rcx + 0x10], r14
xchg r14, r9
mov qword [rcx + 0x20], r9
xchg r9, r14
mov qword [rcx + 0x30], r14
xchg r12, r14
mov qword [rcx + 0x40], r12
xchg r14, r12
mov qword [rcx + 0x50], r14
mov qword [rcx + 0x60], r14
mov qword [rcx + 0x70], r14
mov qword [rcx + 0x80], r14
xchg r11, r14
mov qword [rcx + 0x90], r11
xchg r14, r11
xchg r9, r14
mov qword [rcx + 0xa0], r9
xchg r9, r14
xchg r14, r13
mov qword [rcx + 0xb0], r13
xchg r13, r14
xchg r13, r14
mov qword [rcx + 0xc0], r13
xchg r13, r14
mov qword [rcx + 0xd0], r14
xchg r14, rbp
mov qword [rcx + 0xe0], rbp
xchg r14, rbp
mov qword [rcx + 0xf0], r14
mov qword [rcx + 0x100], r14
mov rax, qword gs:[0x30]
xchg rcx, r11
mov r11, qword [rax + 0x60]
xchg rcx, r11
mov rax, qword [rcx + 0x18]
mov rcx, qword [rax + 0x20]
xchg r11, rax
mov r11, qword [rcx]
xchg r11, rax
xchg rdx, r14
mov r14, qword [rax + 0x20]
xchg rdx, r14
mov qword [rbx], rdx
lea r15, [0x140003e38]
xchg r15, rcx
mov qword [rbp - 0x70], rcx
xchg rcx, r15
lea r12, [0x140198b50]
xchg r13, r12
mov qword [rbp - 0x68], r13
xchg r13, r12
lea rax, [rbp - 0x70]
mov qword [rbp - 0x38], rax
lea r9, [rbp - 0x70]
xor r8d, r8d
xchg rbx, rcx
mov rbx, rcx
xchg rcx, rbx
call fcn.1401988a0
mov dword [rsp + 0x30], 0x31a2216f
sub dword [rsp + 0x30], 0xe3bd8ae
add dword [rsp + 0x30], 0x55c64210
sub dword [rsp + 0x30], 0x46ad1945
xor dword [rsp + 0x30], 0x4d917479
add dword [rsp + 0x30], 0x7708f101
mov dword [rsp + 0x50], 0x3f231900
xor dword [rsp + 0x50], 0x7dc4f6f7
sub dword [rsp + 0x50], 0x1d89dbe2
add dword [rsp + 0x50], 0xeb00e7b
add dword [rsp + 0x50], 0x28612c72
sub dword [rsp + 0x50], 0x1ea00b8b
sub dword [rsp + 0x50], 0x345bcbc8
add dword [rsp + 0x50], 0x505186b6
add dword [rsp + 0x50], 0xa5990101
mov dword [rsp + 0x54], 0x1441928
add dword [rsp + 0x54], 0x6a778281
sub dword [rsp + 0x54], 0x13f0a70f
sub dword [rsp + 0x54], 0x512a70ca
add dword [rsp + 0x54], 0x5349b197
sub dword [rsp + 0x54], 0x2740a22e
xor dword [rsp + 0x54], 0x1582bf9f
add dword [rsp + 0x54], 0xd852d2dd
mov dword [rsp + 0x34], 0x541eef0e
xor dword [rsp + 0x34], 0x23919efe
sub dword [rsp + 0x34], 0x134b252c
sub dword [rsp + 0x34], 0x2ad294b8
sub dword [rsp + 0x34], 0x9888b09
sub dword [rsp + 0x34], 0x12fce9c1
add dword [rsp + 0x34], 0x1675990c
add dword [rsp + 0x34], 0xa1affbc
add dword [rsp + 0x34], 0xb97a1aec
mov dword [rsp + 0x58], 0x325010a2
add dword [rsp + 0x58], 0x4d20ac07
sub dword [rsp + 0x58], 0xf4eda47
sub dword [rsp + 0x58], 0x21a04933
xor dword [rsp + 0x58], 0x76c4b139
xor dword [rsp + 0x58], 0x75a6e073
xor dword [rsp + 0x58], 0x66d71cd3
add dword [rsp + 0x58], 0xd43b2ac8
mov dword [rsp + 0x5c], 0x2c4bcd6a
sub dword [rsp + 0x5c], 0x2bc50356
add dword [rsp + 0x5c], 0x7d9674b6
xor dword [rsp + 0x5c], 0x311c066e
sub dword [rsp + 0x5c], 0x33dfe54
xor dword [rsp + 0x5c], 0x4d0d3ac4
add dword [rsp + 0x5c], 0x467eb46
add dword [rsp + 0x5c], 0x5fca21fe
add dword [rsp + 0x5c], 0x945cf19f
mov dword [rsp + 0x38], 0xa186aff
add dword [rsp + 0x38], 0x6586c9b6
sub dword [rsp + 0x38], 0x4c6d0ca0
sub dword [rsp + 0x38], 0xe6509b0
xor dword [rsp + 0x38], 0x3d9fd6eb
add dword [rsp + 0x38], 0x1c72a690
sub dword [rsp + 0x38], 0x21b183e2
add dword [rsp + 0x38], 0xd2e30bba
mov dword [rsp + 0x60], 0x3be07030
add dword [rsp + 0x60], 0x43d13aa8
sub dword [rsp + 0x60], 0x4a97e328
add dword [rsp + 0x60], 0x3216ab2c
xor dword [rsp + 0x60], 0x4dc20073
add dword [rsp + 0x60], 0x1be3f188
add dword [rsp + 0x60], 0xb8a39b42
mov dword [rsp + 0x64], 0x3669e3d5
xor dword [rsp + 0x64], 0x37359fae
add dword [rsp + 0x64], 0x662af05f
sub dword [rsp + 0x64], 0x3cb18f54
sub dword [rsp + 0x64], 0x1177e73e
sub dword [rsp + 0x64], 0x1a543fd
xor dword [rsp + 0x64], 0xe8de4d35
mov dword [rsp + 0x3c], 0x332f71e
add dword [rsp + 0x3c], 0x6497ba4f
sub dword [rsp + 0x3c], 0x1ed4cc2a
xor dword [rsp + 0x3c], 0x7a3c592a
add dword [rsp + 0x3c], 0x16f36fc3
sub dword [rsp + 0x3c], 0x1a98f934
sub dword [rsp + 0x3c], 0x11d92a42
sub dword [rsp + 0x3c], 0x11854ce7
add dword [rsp + 0x3c], 0xeb313b27
mov dword [rsp + 0x68], 0x31086e69
add dword [rsp + 0x68], 0xbda3806
xor dword [rsp + 0x68], 0x36af386d
add dword [rsp + 0x68], 0x6b602739
xor dword [rsp + 0x68], 0xce1276c
xor dword [rsp + 0x68], 0x62c974cc
sub dword [rsp + 0x68], 0xe2253d5
add dword [rsp + 0x68], 0x32422d56
add dword [rsp + 0x68], 0xbfde8f61
mov dword [rsp + 0x6c], 0xf6d8826
add dword [rsp + 0x6c], 0x506c800d
sub dword [rsp + 0x6c], 0x30c2d6bc
add dword [rsp + 0x6c], 0x24be7885
xor dword [rsp + 0x6c], 0x47fe0767
add dword [rsp + 0x6c], 0x60c692d
add dword [rsp + 0x6c], 0xe546e7b5
mov dword [rsp + 0x40], 0x546727f8
add dword [rsp + 0x40], 0x1c6507c
sub dword [rsp + 0x40], 0x219a44a6
sub dword [rsp + 0x40], 0x6b33b9e
xor dword [rsp + 0x40], 0x3c480ce3
add dword [rsp + 0x40], 0x321eb9b1
sub dword [rsp + 0x40], 0x3a0e87ad
xor dword [rsp + 0x40], 0xff5ed021
mov dword [rsp + 0x70], 0x352aee7d
xor dword [rsp + 0x70], 0x1bf0ad7a
xor dword [rsp + 0x70], 0x44b9f96d
xor dword [rsp + 0x70], 0x49ca36f0
sub dword [rsp + 0x70], 0x1e85f703
add dword [rsp + 0x70], 0x14d94fca
add dword [rsp + 0x70], 0x14ad3bc8
add dword [rsp + 0x70], 0xd0cdde46
mov dword [rsp + 0x74], 0x3e6ebd2e
add dword [rsp + 0x74], 0x3154fde7
sub dword [rsp + 0x74], 0x4ba86f38
xor dword [rsp + 0x74], 0x30f0b25d
xor dword [rsp + 0x74], 0x39b59560
add dword [rsp + 0x74], 0x334efda3
sub dword [rsp + 0x74], 0x1828ef3a
add dword [rsp + 0x74], 0xb6b883f4
mov dword [rsp + 0x44], 0x7778a718
sub dword [rsp + 0x44], 0x2c61c015
xor dword [rsp + 0x44], 0x1af46869
sub dword [rsp + 0x44], 0x4dd6e127
add dword [rsp + 0x44], 0x49c01c33
xor dword [rsp + 0x44], 0xbb3d3c80
mov dword [rsp + 0x78], 0x2ae710b2
add dword [rsp + 0x78], 0x1eb7676
add dword [rsp + 0x78], 0x776ef9a
xor dword [rsp + 0x78], 0x343060ca
add dword [rsp + 0x78], 0x1f7bd63c
xor dword [rsp + 0x78], 0xe08c1322
mov dword [rsp + 0x7c], 0x790d3a4e
sub dword [rsp + 0x7c], 0x4e463a72
add dword [rsp + 0x7c], 0x10cc77e
add dword [rsp + 0x7c], 0x18afe40d
add dword [rsp + 0x7c], 0x56fc288
sub dword [rsp + 0x7c], 0x19fc53d4
xor dword [rsp + 0x7c], 0xd099e565
mov dword [rsp + 0x48], 0x3f24ca15
sub dword [rsp + 0x48], 0x2bc57d76
add dword [rsp + 0x48], 0x4e0e31de
sub dword [rsp + 0x48], 0x933efe5
sub dword [rsp + 0x48], 0x18349254
xor dword [rsp + 0x48], 0x3a59036
add dword [rsp + 0x48], 0xb3558a84
mov dword [rbp - 0x80], 0x62474745
xor dword [rbp - 0x80], 0x2fc70ee2
xor dword [rbp - 0x80], 0x1d5d947e
xor dword [rbp - 0x80], 0x1ae8bb1f
sub dword [rbp - 0x80], 0x7cc6fd9
add dword [rbp - 0x80], 0x202c3dce
sub dword [rbp - 0x80], 0x2d7b060d
xor dword [rbp - 0x80], 0xca6cd1d8
mov dword [rbp - 0x7c], 0x9be38af
xor dword [rbp - 0x7c], 0x786c04a8
xor dword [rbp - 0x7c], 0x639d5422
xor dword [rbp - 0x7c], 0x121d92f1
add dword [rbp - 0x7c], 0x23bfaa46
add dword [rbp - 0x7c], 0x2343bd9d
add dword [rbp - 0x7c], 0x2c8e2613
xor dword [rbp - 0x7c], 0x8c8a77f2
mov word [rsp + 0x4c], 0x362b
sub word [rsp + 0x4c], 0x748
add word [rsp + 0x4c], 0xb6a
add word [rsp + 0x4c], 0x2cd
xor word [rsp + 0x4c], 0xf2e
add word [rsp + 0x4c], 0x218d
add word [rsp + 0x4c], 0x13f6
xor word [rsp + 0x4c], 0x9141
mov dword [rbp - 0x78], 0x5db15a7e
xor dword [rbp - 0x78], 0x514dbab5
xor dword [rbp - 0x78], 0x620e56c1
xor dword [rbp - 0x78], 0x7888a64
sub dword [rbp - 0x78], 0x39d093d2
sub dword [rbp - 0x78], 0x256e5485
add dword [rbp - 0x78], 0x3dbec81f
add dword [rbp - 0x78], 0xd15caee
add dword [rbp - 0x78], 0xaa671852
xor eax, eax
mov word [rbp - 0x74], ax
nop word [rax + rax]
movzx ecx, word [rsp + rax*2 + 0x50]
movzx edx, byte [rsp + rax + 0x30]
add dx, cx
mov word [rsp + rax*2 + 0x50], dx
mov byte [rsp + rax + 0x30], r14b
inc rax
cmp rax, 0x1e
jb 0x140197340
xor r8d, r8d
lea rdx, [rsp + 0x50]
xchg rbx, rbp
mov rcx, rbp
xchg rbp, rbx
call fcn.140199570
xchg rdx, rax
mov rdi, rdx
xchg rdx, rax
xchg r14, r8
mov rcx, r8
xchg r8, r14
nop word [rax + rax]
mov byte [rsp + rcx + 0x50], 0x3f
xor byte [rsp + rcx + 0x50], 0x17
xor byte [rsp + rcx + 0x50], 0x45
xor byte [rsp + rcx + 0x50], 0x1c
xor byte [rsp + rcx + 0x50], 0x35
sub byte [rsp + rcx + 0x50], 0x31
add byte [rsp + rcx + 0x50], 0x4d
sub byte [rsp + rcx + 0x50], 8
xor byte [rsp + rcx + 0x50], 0x58
inc rcx
cmp rcx, 0x3c
jb 0x140197394
xchg rsi, r14
mov qword [rsp + 0x28], rsi
xchg rsi, r14
mov byte [rsp + 0x20], 0x11
xor byte [rsp + 0x20], 0x77
sub byte [rsp + 0x20], 0x14
sub byte [rsp + 0x20], 0x2d
sub byte [rsp + 0x20], 7
add byte [rsp + 0x20], 0x35
xor byte [rsp + 0x20], 0x3f
xor byte [rsp + 0x20], 0x50
sub byte [rsp + 0x20], 0x3c
xor r9d, r9d
xor r8d, r8d
xchg r13, rdx
mov r13, rdi
xchg r13, rdx
xchg rdi, rbx
mov rcx, rdi
xchg rbx, rdi
call fcn.14019a670
xchg r14, rax
mov qword [rbx + 8], r14
xchg r14, rax
mov qword [rbp + 0x40], rdi
test rdi, rdi
je 0x140197484
mov dword [rsp + 0x20], 0x508ddba
add dword [rsp + 0x20], 0xb4704b2
add dword [rsp + 0x20], 0xba80a3b
xor dword [rsp + 0x20], 0x215ed48e
add dword [rsp + 0x20], 0x3ccaf488
xor dword [rsp + 0x20], 0x473712e3
sub dword [rsp + 0x20], 0x3042be52
xor r9d, r9d
lea r8, [rbp + 0x40]
lea rdx, [r9 - 1]
lea rcx, [rbx + 0x70]
call fcn.140197820
xchg rbx, r15
mov qword [rbp - 0x30], rbx
xchg rbx, r15
xchg rbx, r12
mov qword [rbp - 0x28], rbx
xchg rbx, r12
lea rax, [rbp - 0x30]
mov qword [rbp + 8], rax
lea r9, [rbp - 0x30]
xor r8d, r8d
mov rdx, qword [rbx + 8]
xchg rbx, rcx
mov rbx, rcx
xchg rcx, rbx
call fcn.1401988a0
xchg rbx, rax
mov rbx, rax
xchg rbx, rax
lea r11, [rsp + 0x110]
xchg r9, rbx
mov r9, qword [r11 + 0x40]
xchg rbx, r9
xchg rsi, rbp
mov rbp, qword [r11 + 0x48]
xchg rsi, rbp
mov rsp, r11
nop
mov r15, qword [rsp]
add rsp, 8
push rax
push rdx
push rax
push rdx
push rdx
push rdx
push rcx
xchg qword [rsp + 0x38], r14
add rsp, 0x40
push rcx
push rbx
push rbx
push rbx
push rcx
push rcx
push rax
push rcx
xchg qword [rsp + 0x40], r12
add rsp, 0x48
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
xchg qword [rsp - 8], rbp
nop
add rsp, 8
jmp qword [rsp - 8]