Function at 0x140196620
Capabilities:
Access peb ldr_data
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
nop
sub rsp, 8
mov qword [rsp], rdi
nop
mov qword [rsp - 8], r12
sub rsp, 8
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
xchg rbx, r10
mov r10, rcx
xchg r10, rbx
xor r14d, r14d
xchg r14, rsi
mov qword [rcx + 0x10], rsi
xchg rsi, r14
mov qword [rcx + 0x20], r14
xchg r14, rdx
mov qword [rcx + 0x30], rdx
xchg rdx, r14
xchg r14, rsi
mov qword [rcx + 0x40], rsi
xchg r14, rsi
xchg r15, r14
mov qword [rcx + 0x50], r15
xchg r15, r14
mov qword [rcx + 0x60], r14
mov qword [rcx + 0x70], r14
xchg r15, r14
mov qword [rcx + 0x80], r15
xchg r15, r14
mov qword [rcx + 0x90], r14
mov qword [rcx + 0xa0], r14
xchg r9, r14
mov qword [rcx + 0xb0], r9
xchg r9, r14
xchg r12, r14
mov qword [rcx + 0xc0], r12
xchg r12, r14
mov qword [rcx + 0xd0], r14
mov qword [rcx + 0xe0], r14
xchg r14, r9
mov qword [rcx + 0xf0], r9
xchg r9, r14
xchg r14, r15
mov qword [rcx + 0x100], r15
xchg r15, r14
mov rax, qword gs:[0x30]
xchg rbp, rcx
mov rbp, qword [rax + 0x60]
xchg rcx, rbp
mov rax, qword [rcx + 0x18]
xchg r15, rcx
mov r15, qword [rax + 0x20]
xchg rcx, r15
mov rax, qword [rcx]
mov rdx, qword [rax + 0x20]
xchg rsi, rdx
mov qword [rbx], rsi
xchg rdx, rsi
lea r15, [0x140003e38]
xchg r14, r15
mov qword [rbp - 0x70], r14
xchg r14, r15
lea r12, [0x140198540]
mov qword [rbp - 0x68], r12
lea rax, [rbp - 0x70]
mov qword [rbp - 0x38], rax
lea r9, [rbp - 0x70]
xor r8d, r8d
xchg r11, rcx
mov r11, rbx
xchg rcx, r11
call fcn.140198290
mov dword [rsp + 0x30], 0x4968a401
xor dword [rsp + 0x30], 0x519012c1
xor dword [rsp + 0x30], 0x2c2e09e0
xor dword [rsp + 0x30], 0x2a943930
add dword [rsp + 0x30], 0x3f316c90
add dword [rsp + 0x30], 0x219aa4ec
sub dword [rsp + 0x30], 0x3243502c
add dword [rsp + 0x30], 0xaa2baf96
mov dword [rsp + 0x50], 0x69daf8ef
sub dword [rsp + 0x50], 0x12c78569
sub dword [rsp + 0x50], 0x1065f3d1
add dword [rsp + 0x50], 0x1f961a85
sub dword [rsp + 0x50], 0x21a2d208
add dword [rsp + 0x50], 0xbabd3734
mov dword [rsp + 0x54], 0x1bda2247
xor dword [rsp + 0x54], 0x6016e683
xor dword [rsp + 0x54], 0x3e1662d7
sub dword [rsp + 0x54], 0x173470bf
xor dword [rsp + 0x54], 0x39c82553
add dword [rsp + 0x54], 0x2e548b58
xor dword [rsp + 0x54], 0xbabf64dc
mov dword [rsp + 0x34], 0x51f161fc
xor dword [rsp + 0x34], 0x76fc270f
add dword [rsp + 0x34], 0x16a6d554
xor dword [rsp + 0x34], 0x7405991b
add dword [rsp + 0x34], 0x26f3e857
xor dword [rsp + 0x34], 0x7c7a53ed
add dword [rsp + 0x34], 0x34c8b18
add dword [rsp + 0x34], 0xe6cb2d80
mov dword [rsp + 0x58], 0x15ca03d5
xor dword [rsp + 0x58], 0x3dae356
xor dword [rsp + 0x58], 0x2bbd6635
add dword [rsp + 0x58], 0x350c47d8
xor dword [rsp + 0x58], 0x1e532536
sub dword [rsp + 0x58], 0x11a68155
sub dword [rsp + 0x58], 0x116c5bc5
sub dword [rsp + 0x58], 0x42c5ecfc
xor dword [rsp + 0x58], 0xf87ddedc
mov dword [rsp + 0x5c], 0x2c7ac77e
xor dword [rsp + 0x5c], 0x43cd7ef
add dword [rsp + 0x5c], 0x4a1c8ce8
xor dword [rsp + 0x5c], 0x32ff2edd
sub dword [rsp + 0x5c], 0x367ed921
add dword [rsp + 0x5c], 0xf53e24f4
mov dword [rsp + 0x38], 0x6ca145f6
xor dword [rsp + 0x38], 0x10687dce
add dword [rsp + 0x38], 0x264a2f9
xor dword [rsp + 0x38], 0x49f4a28f
add dword [rsp + 0x38], 0x136cb8ed
sub dword [rsp + 0x38], 0xb1eb7b4
add dword [rsp + 0x38], 0x26d42cc2
xor dword [rsp + 0x38], 0x930d514f
mov dword [rsp + 0x60], 0x7acf5f76
sub dword [rsp + 0x60], 0x54a1a527
sub dword [rsp + 0x60], 0xcb71f43
xor dword [rsp + 0x60], 0x186cd3b7
add dword [rsp + 0x60], 0xd9b0c03
add dword [rsp + 0x60], 0x2092b176
add dword [rsp + 0x60], 0x274d6926
add dword [rsp + 0x60], 0x2388189a
add dword [rsp + 0x60], 0x855c7785
mov dword [rsp + 0x64], 0x70ad38f5
sub dword [rsp + 0x64], 0x393ef917
sub dword [rsp + 0x64], 0x345985b6
add dword [rsp + 0x64], 0x28bf5921
add dword [rsp + 0x64], 0x6ac9628
add dword [rsp + 0x64], 0x2b0d9e41
sub dword [rsp + 0x64], 0x138a9bc2
add dword [rsp + 0x64], 0xb563538e
mov dword [rsp + 0x3c], 0x28a8ad55
sub dword [rsp + 0x3c], 0x1ae88da4
add dword [rsp + 0x3c], 0x28abfd1
add dword [rsp + 0x3c], 0x24b314d1
add dword [rsp + 0x3c], 0x6e01cd
xor dword [rsp + 0x3c], 0x51a98071
sub dword [rsp + 0x3c], 0x50e130af
add dword [rsp + 0x3c], 0x1dc59ae5
xor dword [rsp + 0x3c], 0xc7501671
mov dword [rsp + 0x68], 0x44e7f9d3
add dword [rsp + 0x68], 0x164e5fa8
add dword [rsp + 0x68], 0x13a033b0
sub dword [rsp + 0x68], 0x7a58495
xor dword [rsp + 0x68], 0x3b0fa32a
xor dword [rsp + 0x68], 0xa3bd54c1
mov dword [rsp + 0x6c], 0x6777ab9d
sub dword [rsp + 0x6c], 0x46a198f6
add dword [rsp + 0x6c], 0x3d5915d6
sub dword [rsp + 0x6c], 0x1d84dfc4
xor dword [rsp + 0x6c], 0x2e6a785d
sub dword [rsp + 0x6c], 0xcc9faa2
sub dword [rsp + 0x6c], 0x4dc7b5bd
xor dword [rsp + 0x6c], 0x674daf3
add dword [rsp + 0x6c], 0xed24a507
mov dword [rsp + 0x40], 0x798f30ff
sub dword [rsp + 0x40], 0x218f873c
xor dword [rsp + 0x40], 0x22981307
sub dword [rsp + 0x40], 0x5aa92cd2
add dword [rsp + 0x40], 0x4cf213dd
add dword [rsp + 0x40], 0x8f465527
mov dword [rsp + 0x70], 0x192a002a
add dword [rsp + 0x70], 0x466537ae
add dword [rsp + 0x70], 0x17db02eb
sub dword [rsp + 0x70], 0xd0ec74c
xor dword [rsp + 0x70], 0x5fda6524
add dword [rsp + 0x70], 0x3b5ec3f2
sub dword [rsp + 0x70], 0x69586997
add dword [rsp + 0x70], 0xf7f08ec1
mov dword [rsp + 0x74], 0x3c8a4541
add dword [rsp + 0x74], 0x2414eb89
sub dword [rsp + 0x74], 0x521e69b0
add dword [rsp + 0x74], 0x5ef4fe89
sub dword [rsp + 0x74], 0x2a01e862
add dword [rsp + 0x74], 0xbbc921fc
mov dword [rsp + 0x44], 0x5d97daeb
xor dword [rsp + 0x44], 0x5966d4e4
add dword [rsp + 0x44], 0x3213b4f2
sub dword [rsp + 0x44], 0x1ea43bbe
add dword [rsp + 0x44], 0x48aa1283
add dword [rsp + 0x44], 0xe4a2b4e
add dword [rsp + 0x44], 0x87a231e2
mov dword [rsp + 0x78], 0x4b979958
add dword [rsp + 0x78], 0x14adaa44
sub dword [rsp + 0x78], 0x5f54980f
add dword [rsp + 0x78], 0x5ca6a400
sub dword [rsp + 0x78], 0x17c307dd
add dword [rsp + 0x78], 0x116d61bd
add dword [rsp + 0x78], 0x25993320
sub dword [rsp + 0x78], 0x7abf91e5
add dword [rsp + 0x78], 0xfd5db4be
mov dword [rsp + 0x7c], 0x2a0f835a
sub dword [rsp + 0x7c], 0x59a291d
sub dword [rsp + 0x7c], 0x457a0dd
sub dword [rsp + 0x7c], 0xec0972a
xor dword [rsp + 0x7c], 0x5d8f6086
xor dword [rsp + 0x7c], 0x2b6486ba
xor dword [rsp + 0x7c], 0x5de1e32
add dword [rsp + 0x7c], 0x9d062546
mov dword [rsp + 0x48], 0x102efabd
xor dword [rsp + 0x48], 0x4a1fa6d7
xor dword [rsp + 0x48], 0x74d0f71e
sub dword [rsp + 0x48], 0x28746529
add dword [rsp + 0x48], 0x78be946e
xor dword [rsp + 0x48], 0x6d0ff27a
xor dword [rsp + 0x48], 0xe4d2de35
mov dword [rbp - 0x80], 0x1798e7a3
add dword [rbp - 0x80], 0x6818fd27
sub dword [rbp - 0x80], 0x5bc5228d
add dword [rbp - 0x80], 0x379cb129
sub dword [rbp - 0x80], 0xb1e9dd7
sub dword [rbp - 0x80], 0x323c1b4d
sub dword [rbp - 0x80], 0xce8716e
xor dword [rbp - 0x80], 0xee30b7a2
mov dword [rbp - 0x7c], 0x468ef2d6
xor dword [rbp - 0x7c], 0x3632bd50
sub dword [rbp - 0x7c], 0x4c9663db
xor dword [rbp - 0x7c], 0x57c1993b
sub dword [rbp - 0x7c], 0x705294e6
xor dword [rbp - 0x7c], 0x18a1c6f
add dword [rbp - 0x7c], 0x54e66b80
add dword [rbp - 0x7c], 0x1cbebb36
xor dword [rbp - 0x7c], 0x8cae1743
mov word [rsp + 0x4c], 0x2ca9
sub word [rsp + 0x4c], 0x112f
add word [rsp + 0x4c], 0x414a
xor word [rsp + 0x4c], 0x402b
add word [rsp + 0x4c], 0x42ca
sub word [rsp + 0x4c], 0x14cc
add word [rsp + 0x4c], 0xef1
xor word [rsp + 0x4c], 0x4ff9
add word [rsp + 0x4c], 0xe0cf
mov dword [rbp - 0x78], 0x3e14dd36
sub dword [rbp - 0x78], 0x79d81d
add dword [rbp - 0x78], 0x17bf39aa
sub dword [rbp - 0x78], 0x5016aee5
add dword [rbp - 0x78], 0x35985d53
sub dword [rbp - 0x78], 0x1d28f930
xor dword [rbp - 0x78], 0xe2c40b77
xor eax, eax
mov word [rbp - 0x74], ax
nop word [rax + rax]
movzx ecx, word [rsp + rax*2 + 0x50]
movzx edx, byte [rsp + rax + 0x30]
add dx, cx
mov word [rsp + rax*2 + 0x50], dx
mov byte [rsp + rax + 0x30], r14b
inc rax
cmp rax, 0x1e
jb 0x140196ccd
xor r8d, r8d
lea rdx, [rsp + 0x50]
xchg rbx, rcx
mov rbx, rcx
xchg rbx, rcx
call fcn.140199010
xchg rdi, r15
mov r15, rax
xchg rdi, r15
xchg rbp, r14
mov rcx, rbp
xchg rbp, r14
nop word [rax + rax]
mov byte [rsp + rcx + 0x50], 0x28
add byte [rsp + rcx + 0x50], 2
add byte [rsp + rcx + 0x50], 0x4e
sub byte [rsp + rcx + 0x50], 0x1f
xor byte [rsp + rcx + 0x50], 0
sub byte [rsp + rcx + 0x50], 0x26
xor byte [rsp + rcx + 0x50], 0x2d
sub byte [rsp + rcx + 0x50], 0x1e
inc rcx
cmp rcx, 0x3c
jb 0x140196d23
xchg r14, r11
mov qword [rsp + 0x28], r11
xchg r14, r11
mov byte [rsp + 0x20], 0x69
sub byte [rsp + 0x20], 0x2a
add byte [rsp + 0x20], 2
add byte [rsp + 0x20], 0x2e
add byte [rsp + 0x20], 4
sub byte [rsp + 0x20], 0x6e
add byte [rsp + 0x20], 0x3d
sub byte [rsp + 0x20], 0x42
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
xchg rcx, r11
mov r11, rbx
xchg r11, rcx
call fcn.14019a170
xchg r11, rax
mov qword [rbx + 8], r11
xchg r11, rax
mov qword [rbp + 0x40], rdi
test rdi, rdi
je 0x140196e13
mov dword [rsp + 0x20], 0x77031e30
sub dword [rsp + 0x20], 0x6d0a805d
xor dword [rsp + 0x20], 0x543d55a9
add dword [rsp + 0x20], 0x1d93703f
xor dword [rsp + 0x20], 0x3ad0a9dd
add dword [rsp + 0x20], 0x254e3b4
xor dword [rsp + 0x20], 0x153e18bb
add dword [rsp + 0x20], 0x74ad393
sub dword [rsp + 0x20], 0x5e2ac136
xor r9d, r9d
lea r8, [rbp + 0x40]
lea rdx, [r9 - 1]
lea rcx, [rbx + 0x70]
call fcn.1401971b0
xchg r15, rcx
mov qword [rbp - 0x30], rcx
xchg r15, rcx
xchg r15, r12
mov qword [rbp - 0x28], r15
xchg r12, r15
lea rax, [rbp - 0x30]
mov qword [rbp + 8], rax
lea r9, [rbp - 0x30]
xor r8d, r8d
xchg r8, rdx
mov r8, qword [rbx + 8]
xchg r8, rdx
xchg r10, rbx
mov rcx, r10
xchg rbx, r10
call fcn.140198290
xchg r13, rax
mov r13, rbx
xchg r13, rax
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x40]
xchg rbp, rsi
mov rbp, qword [r11 + 0x48]
xchg rbp, rsi
mov rsp, r11
push rax
push rdx
xchg qword [rsp + 0x10], r15
add rsp, 0x18
nop
add rsp, 8
xchg qword [rsp - 8], r14
nop
add rsp, 8
mov r12, qword [rsp - 8]
nop
mov rdi, qword [rsp]
add rsp, 8
push rax
push rcx
xchg qword [rsp + 0x10], rbp
pop rcx
pop rax
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]