Function at 0x14021b9c0
Capabilities:
Access pe header
Allocate or change rwx memory
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
movzx r13d, r9b
mov word [rsp + 0x40], 0xb948
mov r15, r8
mov word [rsp + 0x4a], 0xba48
mov rbx, rdx
mov word [rsp + 0x54], 0xb848
mov rdi, rcx
mov word [rsp + 0x5e], 0xe0ff
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov rsi, rax
mov ecx, dword [rax + 0x50]
call fcn.140219cb0
mov r12d, dword [rsi + 0x28]
mov r14, rax
add r12, rax
mov dword [rsp + 0x30], 0x859a809d
xor eax, eax
mov dword [rsp + 0x34], 0x96978a9c
xor r8d, r8d
mov dword [rsp + 0x38], 0x9b8599d5
mov edx, r8d
mov byte [rsp + 0x3c], al
nop
movsxd rax, edx
lea rcx, [rsp + 0x30]
add rcx, rax
lea eax, [rdx - 0xd]
inc edx
xor byte [rcx], al
cmp edx, 0xc
jb 0x14021ba50
lea rdx, [rsp + 0x30]
mov byte [rsp + 0x3c], r8b
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x78], 0xf
call fcn.14013eec4
lea rcx, [rsp + 0x60]
call fcn.140219120
mov rdx, qword [rsp + 0x78]
mov qword [r15], rax
cmp rdx, 0x10
jb 0x14021bad8
mov rcx, qword [rsp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14021bad3
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14021bda2
call fcn.1403cad84
xorps xmm0, xmm0
lea rcx, [rbp - 0x60]
xor eax, eax
xor edx, edx
mov r8d, 0x200
mov qword [rbp - 0x70], rax
movups xmmword [rsp + 0x60], xmm0
mov dword [rbp - 0x68], eax
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
call fcn.1403ccc50
lea r8, [0x140548ab0]
mov r9, 0xffffffffffffffff
inc r9
cmp byte [r8 + r9], 0
jne 0x14021bb11
lea rax, [rbp - 0x60]
mov dword [rsp + 0x28], 0x200
xor edx, edx
mov qword [rsp + 0x20], rax
xor ecx, ecx
call qword [sym.imp.kernel32.dll_MultiByteToWideChar]
xor ecx, ecx
nop dword [rax + rax]
movzx eax, word [rbp + rcx - 0x60]
mov word [rsp + rcx + 0x60], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x14021bb40
lea rdx, [rsp + 0x60]
mov rax, r15
sub rax, rdx
lea rcx, [rsp + 0x60]
lea rdx, [rax + 0x144]
nop word [rax + rax]
movzx eax, word [rcx]
mov word [rdx + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x14021bb70
test rbx, rbx
je 0x14021bb88
mov qword [rbx], r14
movzx eax, word [rsi + 0x14]
movzx ecx, word [rsi + 6]
add rax, 0x18
mov r8d, dword [rsi + 0x90]
add rax, rsi
lea rdx, [rcx + rcx*4]
lea r9, [rax + rdx*8]
cmp rax, r9
jae 0x14021bbcf
nop dword [rax + rax]
mov edx, dword [rax + 0xc]
cmp r8, rdx
jb 0x14021bbc6
mov ecx, dword [rax + 8]
add ecx, edx
cmp r8, rcx
jb 0x14021bd91
add rax, 0x28
cmp rax, r9
jb 0x14021bbb0
xor ecx, ecx
mov r8, rcx
mov rdx, rsi
mov rcx, rdi
call fcn.14021b4a0
mov r8, rsi
mov rdx, r14
mov rcx, rdi
call fcn.14021b690
mov rdx, rsi
call fcn.14021b720
mov edx, dword [rsi + 0x54]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.kernel32.dll_VirtualAlloc]
mov rbx, rax
xor r8d, r8d
mov eax, dword [rsi + 0x54]
test eax, eax
je 0x14021bc4d
nop word [rax + rax]
rdtsc
shl rdx, 0x20
or rax, rdx
movzx ecx, al
mov eax, 0x80808081
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
mov byte [r8 + rbx], cl
inc r8
mov eax, dword [rsi + 0x54]
cmp r8, rax
jb 0x14021bc20
mov r8d, eax
mov rdx, rbx
mov rcx, r14
call fcn.140219bb0
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.kernel32.dll_VirtualFree]
mov ecx, 0x1a0
call fcn.140219cb0
mov r8d, 0x180
mov rdx, r15
mov rdi, rax
lea rbx, [rax + 0x20]
mov rcx, rbx
call fcn.140219bb0
mov r8d, 0x20
mov qword [rsp + 0x42], rbx
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x4c], 0
mov rcx, rdi
mov qword [rsp + 0x56], r12
call fcn.140219bb0
mov rcx, rdi
call fcn.140219ed0
mov ecx, 0x7d0
call qword [sym.imp.kernel32.dll_Sleep]
xor ecx, ecx
mov edx, 0x1a0
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.kernel32.dll_VirtualAlloc]
xor edx, edx
mov r8d, 0x1a0
mov rcx, rax
mov rbx, rax
call fcn.1403ccc50
mov r8d, 0x1a0
mov rdx, rbx
mov rcx, rdi
call fcn.140219bb0
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.kernel32.dll_VirtualFree]
mov rcx, rdi
call fcn.140219d50
test r13b, r13b
je 0x14021bd70
mov ebx, dword [rsi + 0x50]
mov r9d, 4
mov edx, ebx
mov r8d, 0x3000
xor ecx, ecx
call qword [sym.imp.kernel32.dll_VirtualAlloc]
mov r8d, ebx
xor edx, edx
mov rcx, rax
mov rdi, rax
call fcn.1403ccc50
mov r8d, ebx
mov rdx, rdi
mov rcx, r14
call fcn.140219bb0
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.kernel32.dll_VirtualFree]
mov rcx, r14
call fcn.140219d50
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, dword [rax + 0x14]
sub rcx, rdx
add rcx, r8
add rcx, rdi
jmp 0x14021bbd1
call fcn.1403d7020
int3