Function at 0x1401962d0
Capabilities:
Access peb ldr_data
Encode data using xor

Disassembly:
xchg rsi, rbx
mov qword [rsp + 0x18], rsi
xchg rbx, rsi
mov qword [rsp + 0x20], rsi
push rdi
mov qword [rsp], rbp
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
mov qword [rsp - 8], r12
sub rsp, 8
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
xchg rdx, rcx
mov rbx, rdx
xchg rdx, rcx
xor r14d, r14d
xchg r14, r9
mov qword [rcx + 0x10], r9
xchg r14, r9
mov qword [rcx + 0x20], r14
mov qword [rcx + 0x30], r14
mov qword [rcx + 0x40], r14
mov qword [rcx + 0x50], r14
xchg r14, r8
mov qword [rcx + 0x60], r8
xchg r8, r14
mov qword [rcx + 0x70], r14
xchg rbx, r14
mov qword [rcx + 0x80], rbx
xchg r14, rbx
mov qword [rcx + 0x90], r14
mov qword [rcx + 0xa0], r14
mov qword [rcx + 0xb0], r14
xchg r14, rsi
mov qword [rcx + 0xc0], rsi
xchg r14, rsi
xchg r9, r14
mov qword [rcx + 0xd0], r9
xchg r14, r9
xchg rbx, r14
mov qword [rcx + 0xe0], rbx
xchg rbx, r14
mov qword [rcx + 0xf0], r14
mov qword [rcx + 0x100], r14
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x18]
mov rcx, qword [rax + 0x20]
mov rax, qword [rcx]
mov rdx, qword [rax + 0x20]
mov qword [rbx], rdx
lea r15, [0x140003e38]
mov qword [rbp - 0x70], r15
lea r12, [0x140198190]
xchg r9, r12
mov qword [rbp - 0x68], r9
xchg r12, r9
lea rax, [rbp - 0x70]
mov qword [rbp - 0x38], rax
lea r9, [rbp - 0x70]
xor r8d, r8d
xchg rcx, rbx
mov rbx, rcx
xchg rbx, rcx
call fcn.140197ec0
mov dword [rsp + 0x30], 0x3dc25ed9
add dword [rsp + 0x30], 0x4082c567
sub dword [rsp + 0x30], 0x1f4ae9cb
add dword [rsp + 0x30], 0x678a33e
xor dword [rsp + 0x30], 0x2da3bbfa
add dword [rsp + 0x30], 0x255431c
add dword [rsp + 0x30], 0xabd04d91
mov dword [rsp + 0x50], 0x69f6723
xor dword [rsp + 0x50], 0x4432b6d3
xor dword [rsp + 0x50], 0x73302fae
add dword [rsp + 0x50], 0x21c140cb
xor dword [rsp + 0x50], 0x4c8ad78b
sub dword [rsp + 0x50], 0x1eb5ae70
add dword [rsp + 0x50], 0x45c65a9c
sub dword [rsp + 0x50], 0xd52aa7f
add dword [rsp + 0x50], 0xc5ca1517
mov dword [rsp + 0x54], 0x39163f9c
sub dword [rsp + 0x54], 0x22d301af
xor dword [rsp + 0x54], 0x24153544
add dword [rsp + 0x54], 0x152a0134
xor dword [rsp + 0x54], 0x70d13cf4
xor dword [rsp + 0x54], 0x3a3700ee
add dword [rsp + 0x54], 0xf217c9bc
mov dword [rsp + 0x34], 0x173d5608
xor dword [rsp + 0x34], 0x74da4519
sub dword [rsp + 0x34], 0x5ed9f1e9
add dword [rsp + 0x34], 0x60d06b3c
sub dword [rsp + 0x34], 0x223835a4
xor dword [rsp + 0x34], 0xb553a036
mov dword [rsp + 0x58], 0x41e66164
sub dword [rsp + 0x58], 0x1676c46e
add dword [rsp + 0x58], 0x25f32582
sub dword [rsp + 0x58], 0x37f9da9d
xor dword [rsp + 0x58], 0x4117830a
sub dword [rsp + 0x58], 0xdc85545
sub dword [rsp + 0x58], 0x3535b6ec
add dword [rsp + 0x58], 0x41c627d9
xor dword [rsp + 0x58], 0xa8287f07
mov dword [rsp + 0x5c], 0x8478ef3
sub dword [rsp + 0x5c], 0x65afa5
add dword [rsp + 0x5c], 0x55ee857c
sub dword [rsp + 0x5c], 0x55498b69
add dword [rsp + 0x5c], 0x38b136a0
add dword [rsp + 0x5c], 0x1e5513fe
sub dword [rsp + 0x5c], 0x24c5e7
add dword [rsp + 0x5c], 0x9ff4a15f
mov dword [rsp + 0x38], 0x193098b1
add dword [rsp + 0x38], 0x5accd52a
sub dword [rsp + 0x38], 0x6c992e11
xor dword [rsp + 0x38], 0x40704ce4
xor dword [rsp + 0x38], 0x5c61b7b1
add dword [rsp + 0x38], 0x1afe2fc9
add dword [rsp + 0x38], 0x327b59a1
sub dword [rsp + 0x38], 0x1f4f6109
add dword [rsp + 0x38], 0xad5709f6
mov dword [rsp + 0x60], 0x1d607ecc
add dword [rsp + 0x60], 0x362a70dd
xor dword [rsp + 0x60], 0x1b3774bc
xor dword [rsp + 0x60], 0x57e7d0a1
xor dword [rsp + 0x60], 0x38342ce1
sub dword [rsp + 0x60], 0x148f4354
add dword [rsp + 0x60], 0xec9adb78
mov dword [rsp + 0x64], 0x6a099359
add dword [rsp + 0x64], 0x8aaf4a
sub dword [rsp + 0x64], 0x23e9f982
sub dword [rsp + 0x64], 0x1e291f15
xor dword [rsp + 0x64], 0x6e7b1822
xor dword [rsp + 0x64], 0x1df9846c
add dword [rsp + 0x64], 0xa463493c
mov dword [rsp + 0x3c], 0xc8cf83f
sub dword [rsp + 0x3c], 0x27620cb
add dword [rsp + 0x3c], 0x62fc7a0f
sub dword [rsp + 0x3c], 0x6b1a941
xor dword [rsp + 0x3c], 0x663ec78f
add dword [rsp + 0x3c], 0x3ae62b44
add dword [rsp + 0x3c], 0xbbb15be5
mov dword [rsp + 0x68], 0x75a7f1e0
sub dword [rsp + 0x68], 0x5150c919
xor dword [rsp + 0x68], 0x439d93f
sub dword [rsp + 0x68], 0x80a4099
add dword [rsp + 0x68], 0x4780e0da
sub dword [rsp + 0x68], 0x434a1787
add dword [rsp + 0x68], 0x5125673f
add dword [rsp + 0x68], 0x91c31d8c
mov dword [rsp + 0x6c], 0x5c76beb4
add dword [rsp + 0x6c], 0x6d69610
xor dword [rsp + 0x6c], 0xa3a4760
sub dword [rsp + 0x6c], 0x5a64799c
add dword [rsp + 0x6c], 0x4dbb09c2
add dword [rsp + 0x6c], 0xa2b15bb3
mov dword [rsp + 0x40], 0x34aa09b0
sub dword [rsp + 0x40], 0x2eb4e192
xor dword [rsp + 0x40], 0x1b2e82a2
add dword [rsp + 0x40], 0x60eec86c
sub dword [rsp + 0x40], 0x75a94af2
sub dword [rsp + 0x40], 0x2653a49
xor dword [rsp + 0x40], 0x30144069
add dword [rsp + 0x40], 0xbf474972
mov dword [rsp + 0x70], 0x1859b4cf
sub dword [rsp + 0x70], 0x71b5984
xor dword [rsp + 0x70], 0x1b88a67d
add dword [rsp + 0x70], 0x6150980b
xor dword [rsp + 0x70], 0x46e56a44
xor dword [rsp + 0x70], 0x2a3c0f39
add dword [rsp + 0x70], 0xfe990f33
mov dword [rsp + 0x74], 0x58b789a1
add dword [rsp + 0x74], 0x20ecb854
xor dword [rsp + 0x74], 0x2d6f0123
xor dword [rsp + 0x74], 0x3d040f7
xor dword [rsp + 0x74], 0x38a8c4bc
sub dword [rsp + 0x74], 0x22081d38
add dword [rsp + 0x74], 0xb19157d8
mov dword [rsp + 0x44], 0x481e5a37
xor dword [rsp + 0x44], 0x12a199c9
sub dword [rsp + 0x44], 0x2654875b
sub dword [rsp + 0x44], 0x2606701
sub dword [rsp + 0x44], 0x1e37518
add dword [rsp + 0x44], 0xc6cf966c
mov dword [rsp + 0x78], 0x48d5cd86
sub dword [rsp + 0x78], 0x7258649
add dword [rsp + 0x78], 0xc1bdfb3
sub dword [rsp + 0x78], 0x4264d5e6
xor dword [rsp + 0x78], 0x243815be
add dword [rsp + 0x78], 0x469e3c6d
add dword [rsp + 0x78], 0x897b7e45
mov dword [rsp + 0x7c], 0x3aef2dc9
sub dword [rsp + 0x7c], 0x1a572c0e
add dword [rsp + 0x7c], 0x123a79bc
sub dword [rsp + 0x7c], 0x160e79bf
add dword [rsp + 0x7c], 0x809f53b
sub dword [rsp + 0x7c], 0x24cdf6c8
add dword [rsp + 0x7c], 0x71fb020f
sub dword [rsp + 0x7c], 0x5fef28ac
add dword [rsp + 0x7c], 0xed6325f0
mov dword [rsp + 0x48], 0x78ab2c8b
sub dword [rsp + 0x48], 0x4b1cabfd
sub dword [rsp + 0x48], 0x22455195
add dword [rsp + 0x48], 0xc44095e
xor dword [rsp + 0x48], 0x7a60350b
xor dword [rsp + 0x48], 0x41d93b32
add dword [rsp + 0x48], 0xcac2c088
mov dword [rbp - 0x80], 0x3fa43599
xor dword [rbp - 0x80], 0xd56251f
sub dword [rbp - 0x80], 0x2d45d412
add dword [rbp - 0x80], 0x5ddd69f2
add dword [rbp - 0x80], 0x16a1aa65
add dword [rbp - 0x80], 0x854baeab
mov dword [rbp - 0x7c], 0x32320dd0
add dword [rbp - 0x7c], 0x677f409
sub dword [rbp - 0x7c], 0x1391f3c1
add dword [rbp - 0x7c], 0x41444e48
sub dword [rbp - 0x7c], 0x2c0758c6
add dword [rbp - 0x7c], 0xbb90f2a
add dword [rbp - 0x7c], 0x36a9cc81
add dword [rbp - 0x7c], 0x82b71ff3
mov word [rsp + 0x4c], 0x10df
add word [rsp + 0x4c], 0x53c8
xor word [rsp + 0x4c], 0x646
sub word [rsp + 0x4c], 0x5716
xor word [rsp + 0x4c], 0x1e8e
xor word [rsp + 0x4c], 0xe3b3
mov dword [rbp - 0x78], 0x30dcf6f
add dword [rbp - 0x78], 0x7c6c8529
xor dword [rbp - 0x78], 0xea5680f
sub dword [rbp - 0x78], 0x7904ba8
sub dword [rbp - 0x78], 0x13b3ec59
sub dword [rbp - 0x78], 0x13c7bd
add dword [rbp - 0x78], 0xa8efc29d
xor eax, eax
mov word [rbp - 0x74], ax
nop word [rax + rax]
movzx ecx, word [rsp + rax*2 + 0x50]
movzx edx, byte [rsp + rax + 0x30]
add dx, cx
mov word [rsp + rax*2 + 0x50], dx
mov byte [rsp + rax + 0x30], r14b
inc rax
cmp rax, 0x1e
jb 0x140196931
xor r8d, r8d
lea rdx, [rsp + 0x50]
xchg rbx, rdi
mov rcx, rdi
xchg rdi, rbx
call fcn.140198c30
xchg rcx, rax
mov rdi, rcx
xchg rcx, rax
xchg r14, rcx
mov r14, rcx
xchg r14, rcx
nop word [rax + rax]
mov byte [rsp + rcx + 0x50], 0x51
sub byte [rsp + rcx + 0x50], 9
add byte [rsp + rcx + 0x50], 3
add byte [rsp + rcx + 0x50], 0x22
add byte [rsp + rcx + 0x50], 0x11
sub byte [rsp + rcx + 0x50], 0x40
sub byte [rsp + rcx + 0x50], 0x1b
xor byte [rsp + rcx + 0x50], 0x3c
sub byte [rsp + rcx + 0x50], 0x1f
inc rcx
cmp rcx, 0x3c
jb 0x140196985
xchg r9, r14
mov qword [rsp + 0x28], r9
xchg r9, r14
mov byte [rsp + 0x20], 0x23
xor byte [rsp + 0x20], 0x6c
add byte [rsp + 0x20], 5
sub byte [rsp + 0x20], 0x31
add byte [rsp + 0x20], 0x22
sub byte [rsp + 0x20], 0x20
sub byte [rsp + 0x20], 0x25
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
xchg rbx, rcx
mov rbx, rcx
xchg rbx, rcx
call fcn.140199d60
xchg r13, rax
mov qword [rbx + 8], r13
xchg r13, rax
mov qword [rbp + 0x40], rdi
test rdi, rdi
je 0x140196a65
mov dword [rsp + 0x20], 0xb5353b3
xor dword [rsp + 0x20], 0x1bcea37f
add dword [rsp + 0x20], 0x1cc3f1aa
add dword [rsp + 0x20], 0xf99f875
sub dword [rsp + 0x20], 0x57fe52
sub dword [rsp + 0x20], 0x638f938
sub dword [rsp + 0x20], 0x366a6361
xor r9d, r9d
lea r8, [rbp + 0x40]
lea rdx, [r9 - 1]
lea rcx, [rbx + 0x70]
call fcn.140196df0
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x28], r12
lea rax, [rbp - 0x30]
mov qword [rbp + 8], rax
lea r9, [rbp - 0x30]
xor r8d, r8d
mov rdx, qword [rbx + 8]
mov rcx, rbx
call fcn.140197ec0
xchg rbx, rax
mov rbx, rax
xchg rbx, rax
lea r11, [rsp + 0x110]
xchg rbx, rsi
mov rsi, qword [r11 + 0x40]
xchg rsi, rbx
mov rsi, qword [r11 + 0x48]
mov rsp, r11
push rbx
xchg qword [rsp + 8], r15
pop rbx
add rsp, 8
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
mov r12, qword [rsp]
add rsp, 8
push rax
push rcx
push rax
push rdx
push rax
push rcx
xchg qword [rsp + 0x30], rdi
pop rcx
pop rax
pop rdx
pop rax
pop rcx
pop rax
add rsp, 8
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret