Function at 0x140196580
Capabilities:
Access peb ldr_data
Encode data using xor

Disassembly:
xchg rbx, r13
mov qword [rsp + 0x18], r13
xchg r13, rbx
xchg rdx, rsi
mov qword [rsp + 0x20], rdx
xchg rdx, rsi
push rbp
nop
sub rsp, 8
mov qword [rsp], rdi
push r12
nop
mov qword [rsp - 8], r14
sub rsp, 8
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
xchg r9, rcx
mov rbx, r9
xchg rcx, r9
xor r14d, r14d
xchg r14, r15
mov qword [rcx + 0x10], r15
xchg r15, r14
mov qword [rcx + 0x20], r14
mov qword [rcx + 0x30], r14
mov qword [rcx + 0x40], r14
mov qword [rcx + 0x50], r14
xchg r14, r15
mov qword [rcx + 0x60], r15
xchg r15, r14
mov qword [rcx + 0x70], r14
xchg r14, r15
mov qword [rcx + 0x80], r15
xchg r14, r15
xchg rdi, r14
mov qword [rcx + 0x90], rdi
xchg rdi, r14
mov qword [rcx + 0xa0], r14
xchg rsi, r14
mov qword [rcx + 0xb0], rsi
xchg r14, rsi
xchg r8, r14
mov qword [rcx + 0xc0], r8
xchg r14, r8
mov qword [rcx + 0xd0], r14
xchg r14, rdi
mov qword [rcx + 0xe0], rdi
xchg rdi, r14
mov qword [rcx + 0xf0], r14
mov qword [rcx + 0x100], r14
mov rax, qword gs:[0x30]
xchg rbp, rcx
mov rbp, qword [rax + 0x60]
xchg rbp, rcx
xchg r8, rax
mov r8, qword [rcx + 0x18]
xchg r8, rax
mov rcx, qword [rax + 0x20]
mov rax, qword [rcx]
xchg r15, rdx
mov r15, qword [rax + 0x20]
xchg rdx, r15
mov qword [rbx], rdx
lea r15, [0x140003e38]
xchg r15, r10
mov qword [rbp - 0x70], r10
xchg r15, r10
lea r12, [0x140198450]
xchg r12, rbx
mov qword [rbp - 0x68], rbx
xchg r12, rbx
lea rax, [rbp - 0x70]
xchg rbx, rax
mov qword [rbp - 0x38], rbx
xchg rbx, rax
lea r9, [rbp - 0x70]
xor r8d, r8d
xchg rcx, r9
mov r9, rbx
xchg r9, rcx
call fcn.1401981b0
mov dword [rsp + 0x30], 0x19ab61e
add dword [rsp + 0x30], 0x2deccfa9
add dword [rsp + 0x30], 0x3be95c2c
xor dword [rsp + 0x30], 0x1cc3cd48
sub dword [rsp + 0x30], 0x140856fe
sub dword [rsp + 0x30], 0x4c6be9dd
add dword [rsp + 0x30], 0xdfb80b16
mov dword [rsp + 0x50], 0x79ea17c2
xor dword [rsp + 0x50], 0x11cab937
add dword [rsp + 0x50], 0x1090ccc7
xor dword [rsp + 0x50], 0x442d208d
add dword [rsp + 0x50], 0x1d009ed4
sub dword [rsp + 0x50], 0x1966e6fc
sub dword [rsp + 0x50], 0x22c9c0bf
add dword [rsp + 0x50], 0xe1f1ad1c
mov dword [rsp + 0x54], 0x74a5db4f
xor dword [rsp + 0x54], 0x2edfe588
add dword [rsp + 0x54], 0x11dac466
sub dword [rsp + 0x54], 0x73e1061
xor dword [rsp + 0x54], 0x1246a814
sub dword [rsp + 0x54], 0x31fdf45
sub dword [rsp + 0x54], 0x44bb01e8
add dword [rsp + 0x54], 0x30d80b88
add dword [rsp + 0x54], 0x9f307a50
mov dword [rsp + 0x34], 0x64017ce6
sub dword [rsp + 0x34], 0x15ee69b8
sub dword [rsp + 0x34], 0x2af14ff1
add dword [rsp + 0x34], 0x595b77d
add dword [rsp + 0x34], 0x37eb0d85
xor dword [rsp + 0x34], 0x14993d8a
add dword [rsp + 0x34], 0x82bb4141
mov dword [rsp + 0x58], 0x1e6560e2
sub dword [rsp + 0x58], 0xf8accee
sub dword [rsp + 0x58], 0x38a363
add dword [rsp + 0x58], 0x5824da88
sub dword [rsp + 0x58], 0x4a1dbdb
add dword [rsp + 0x58], 0x26ca881
sub dword [rsp + 0x58], 0x17be61e3
add dword [rsp + 0x58], 0xb29cc9a2
mov dword [rsp + 0x5c], 0x268dd6c6
xor dword [rsp + 0x5c], 0x78959b71
sub dword [rsp + 0x5c], 0x3c95f387
xor dword [rsp + 0x5c], 0x63b87fd
add dword [rsp + 0x5c], 0x3e5d2ec4
sub dword [rsp + 0x5c], 0x56f8b11c
sub dword [rsp + 0x5c], 0xcfb751c
add dword [rsp + 0x5c], 0x18b3a297
add dword [rsp + 0x5c], 0xe4867687
mov dword [rsp + 0x38], 0x3b2f1062
xor dword [rsp + 0x38], 0x37c23257
add dword [rsp + 0x38], 0x71d81881
xor dword [rsp + 0x38], 0x55f9de51
add dword [rsp + 0x38], 0x2cf27d50
sub dword [rsp + 0x38], 0x517264ce
add dword [rsp + 0x38], 0x3fb0e496
xor dword [rsp + 0x38], 0xb09b1709
mov dword [rsp + 0x60], 0x3c695720
add dword [rsp + 0x60], 0x2bf5daa3
sub dword [rsp + 0x60], 0x61e10fa3
add dword [rsp + 0x60], 0x40139
add dword [rsp + 0x60], 0x656ed807
sub dword [rsp + 0x60], 0x1cedfbcc
xor dword [rsp + 0x60], 0x27837525
add dword [rsp + 0x60], 0x96f874c8
mov dword [rsp + 0x64], 0x51f23171
sub dword [rsp + 0x64], 0x15a251df
xor dword [rsp + 0x64], 0x26bd21e7
add dword [rsp + 0x64], 0x3de4ef09
xor dword [rsp + 0x64], 0x24ad37b8
xor dword [rsp + 0x64], 0x831c25b8
mov dword [rsp + 0x3c], 0x374fa9f0
xor dword [rsp + 0x3c], 0x161802e0
xor dword [rsp + 0x3c], 0x3bb5b853
xor dword [rsp + 0x3c], 0x52feaf16
add dword [rsp + 0x3c], 0xc7aabd
add dword [rsp + 0x3c], 0x222d511c
sub dword [rsp + 0x3c], 0x2b3662e2
add dword [rsp + 0x3c], 0x267dde88
add dword [rsp + 0x3c], 0x909dc322
mov dword [rsp + 0x68], 0x19400abf
sub dword [rsp + 0x68], 0x13c85a57
xor dword [rsp + 0x68], 0x57ebe8cb
xor dword [rsp + 0x68], 0x2e1bff79
xor dword [rsp + 0x68], 0x5d02080e
xor dword [rsp + 0x68], 0x4dcd327e
add dword [rsp + 0x68], 0x933b61d3
mov dword [rsp + 0x6c], 0x39d5dadf
add dword [rsp + 0x6c], 0x37a867ee
sub dword [rsp + 0x6c], 0x9d66c2f
sub dword [rsp + 0x6c], 0x2e343cf
sub dword [rsp + 0x6c], 0x3d24f679
add dword [rsp + 0x6c], 0x28bf9791
add dword [rsp + 0x6c], 0x6ad7fb
xor dword [rsp + 0x6c], 0x74d4c1e5
add dword [rsp + 0x6c], 0xdb603576
mov dword [rsp + 0x40], 0x3460ba37
sub dword [rsp + 0x40], 0x244be44c
xor dword [rsp + 0x40], 0x6bfe7de3
xor dword [rsp + 0x40], 0x27004602
sub dword [rsp + 0x40], 0xcf378f7
sub dword [rsp + 0x40], 0x3b0b30d8
add dword [rsp + 0x40], 0x694e6c61
add dword [rsp + 0x40], 0x78bc465a
mov dword [rsp + 0x70], 0x734a61c4
sub dword [rsp + 0x70], 0x4222e0fc
add dword [rsp + 0x70], 0x1edc09da
xor dword [rsp + 0x70], 0x7ee4f0ad
add dword [rsp + 0x70], 0xde0c244
xor dword [rsp + 0x70], 0x289a2053
xor dword [rsp + 0x70], 0xeb25e36f
mov dword [rsp + 0x74], 0x403829ca
xor dword [rsp + 0x74], 0x3ece5f82
sub dword [rsp + 0x74], 0x105d634c
sub dword [rsp + 0x74], 0x1f9e60ea
add dword [rsp + 0x74], 0x2ab10969
xor dword [rsp + 0x74], 0x1e8af011
xor dword [rsp + 0x74], 0x63d2c2c0
add dword [rsp + 0x74], 0xfa497593
mov dword [rsp + 0x44], 0x4f02dd3c
xor dword [rsp + 0x44], 0x1df0dc4b
add dword [rsp + 0x44], 0x12884c20
xor dword [rsp + 0x44], 0x34a883dd
add dword [rsp + 0x44], 0x31afcee
add dword [rsp + 0x44], 0xa2092bbe
mov dword [rsp + 0x78], 0x7d3a5903
sub dword [rsp + 0x78], 0x7639f617
add dword [rsp + 0x78], 0x10295a4d
add dword [rsp + 0x78], 0xc389a2e
add dword [rsp + 0x78], 0x33575928
add dword [rsp + 0x78], 0xa8bf4ed7
mov dword [rsp + 0x7c], 0x567eb51c
add dword [rsp + 0x7c], 0x2500129b
sub dword [rsp + 0x7c], 0x2c9ed88a
xor dword [rsp + 0x7c], 0x3d5eea50
sub dword [rsp + 0x7c], 0x4bda667c
add dword [rsp + 0x7c], 0x359aa47
xor dword [rsp + 0x7c], 0x3693636b
xor dword [rsp + 0x7c], 0x2dedb2a7
add dword [rsp + 0x7c], 0xcef066fa
mov dword [rsp + 0x48], 0x70c6b89
xor dword [rsp + 0x48], 0x5051ad1d
xor dword [rsp + 0x48], 0x6397aaa0
add dword [rsp + 0x48], 0x1f0a722d
sub dword [rsp + 0x48], 0x354451bf
add dword [rsp + 0x48], 0x23bc0438
xor dword [rsp + 0x48], 0xb4ba662c
mov dword [rbp - 0x80], 0x3d9c127b
xor dword [rbp - 0x80], 0x62106eb2
xor dword [rbp - 0x80], 0x732f5e91
sub dword [rbp - 0x80], 0x14639b6b
sub dword [rbp - 0x80], 0x12ce4f35
xor dword [rbp - 0x80], 0x63be1a04
add dword [rbp - 0x80], 0x98a7d1ba
mov dword [rbp - 0x7c], 0xc36ea45
add dword [rbp - 0x7c], 0x26219321
xor dword [rbp - 0x7c], 0x22b15714
add dword [rbp - 0x7c], 0x3d8694be
sub dword [rbp - 0x7c], 0xd5c1b80
sub dword [rbp - 0x7c], 0x11a18ecb
xor dword [rbp - 0x7c], 0x13cc79e
xor dword [rbp - 0x7c], 0xd1202c43
mov word [rsp + 0x4c], 0x6897
xor word [rsp + 0x4c], 0x4b67
sub word [rsp + 0x4c], 0x1750
add word [rsp + 0x4c], 0x6021
sub word [rsp + 0x4c], 0x288
sub word [rsp + 0x4c], 0xd97
sub word [rsp + 0x4c], 0x4358
add word [rsp + 0x4c], 0xddac
mov dword [rbp - 0x78], 0x746b9972
sub dword [rbp - 0x78], 0x366db96c
add dword [rbp - 0x78], 0x9543e01
add dword [rbp - 0x78], 0x21079cdf
xor dword [rbp - 0x78], 0x7288c75a
add dword [rbp - 0x78], 0xe4a581ba
xor eax, eax
mov word [rbp - 0x74], ax
nop word [rax + rax]
movzx ecx, word [rsp + rax*2 + 0x50]
movzx edx, byte [rsp + rax + 0x30]
add dx, cx
mov word [rsp + rax*2 + 0x50], dx
mov byte [rsp + rax + 0x30], r14b
inc rax
cmp rax, 0x1e
jb 0x140196c29
xor r8d, r8d
lea rdx, [rsp + 0x50]
xchg rdi, rbx
mov rcx, rdi
xchg rdi, rbx
call fcn.140198f00
xchg rdx, rax
mov rdi, rdx
xchg rdx, rax
xchg r14, rcx
mov r14, rcx
xchg rcx, r14
nop word [rax + rax]
mov byte [rsp + rcx + 0x50], 0x4c
add byte [rsp + rcx + 0x50], 0x2e
xor byte [rsp + rcx + 0x50], 0x6d
xor byte [rsp + rcx + 0x50], 6
add byte [rsp + rcx + 0x50], 0x3c
add byte [rsp + rcx + 0x50], 0x1d
sub byte [rsp + rcx + 0x50], 0x6a
inc rcx
cmp rcx, 0x3c
jb 0x140196c7d
mov qword [rsp + 0x28], r14
mov byte [rsp + 0x20], 0x36
sub byte [rsp + 0x20], 0xd
sub byte [rsp + 0x20], 0x19
add byte [rsp + 0x20], 5
add byte [rsp + 0x20], 0x35
xor byte [rsp + 0x20], 0xc
sub byte [rsp + 0x20], 7
sub byte [rsp + 0x20], 0x3f
xor r9d, r9d
xor r8d, r8d
xchg rdx, rdi
mov rdi, rdx
xchg rdx, rdi
xchg rcx, rbx
mov rbx, rcx
xchg rbx, rcx
call fcn.14019a070
xchg rbp, rax
mov qword [rbx + 8], rbp
xchg rbp, rax
mov qword [rbp + 0x40], rdi
test rdi, rdi
je 0x140196d50
mov dword [rsp + 0x20], 0x67d4ad6d
add dword [rsp + 0x20], 0x359f7b4
xor dword [rsp + 0x20], 0x6fb698af
xor dword [rsp + 0x20], 0x20c4b28
xor dword [rsp + 0x20], 0x127a96e1
sub dword [rsp + 0x20], 0x14ee6047
xor r9d, r9d
lea r8, [rbp + 0x40]
lea rdx, [r9 - 1]
lea rcx, [rbx + 0x70]
call fcn.1401970c0
xchg r8, r15
mov qword [rbp - 0x30], r8
xchg r15, r8
mov qword [rbp - 0x28], r12
lea rax, [rbp - 0x30]
xchg r13, rax
mov qword [rbp + 8], r13
xchg r13, rax
lea r9, [rbp - 0x30]
xor r8d, r8d
xchg r11, rdx
mov r11, qword [rbx + 8]
xchg r11, rdx
xchg rbx, r13
mov rcx, r13
xchg r13, rbx
call fcn.1401981b0
xchg r15, rax
mov r15, rbx
xchg r15, rax
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
nop
add rsp, 8
xchg qword [rsp - 8], r15
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
add rsp, 8
mov r12, qword [rsp - 8]
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret