Function at 0x1401968e0
Capabilities:
Access peb ldr_data
Encode data using xor

Disassembly:
xchg rbx, rcx
mov qword [rsp + 0x18], rcx
xchg rcx, rbx
xchg r11, rsi
mov qword [rsp + 0x20], r11
xchg r11, rsi
push rbp
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r12
push rbx
mov qword [rsp], r14
nop
mov qword [rsp - 8], r15
sub rsp, 8
lea rbp, [rsp - 0x10]
sub rsp, 0x110
xchg rbx, rcx
mov rcx, rbx
xchg rcx, rbx
xor r14d, r14d
xchg r14, rbp
mov qword [rcx + 0x10], rbp
xchg rbp, r14
xchg r14, r9
mov qword [rcx + 0x20], r9
xchg r9, r14
xchg r14, r10
mov qword [rcx + 0x30], r10
xchg r10, r14
xchg r14, r10
mov qword [rcx + 0x40], r10
xchg r14, r10
mov qword [rcx + 0x50], r14
mov qword [rcx + 0x60], r14
mov qword [rcx + 0x70], r14
mov qword [rcx + 0x80], r14
mov qword [rcx + 0x90], r14
mov qword [rcx + 0xa0], r14
mov qword [rcx + 0xb0], r14
xchg r14, r11
mov qword [rcx + 0xc0], r11
xchg r14, r11
mov qword [rcx + 0xd0], r14
xchg r14, rdx
mov qword [rcx + 0xe0], rdx
xchg rdx, r14
mov qword [rcx + 0xf0], r14
xchg r13, r14
mov qword [rcx + 0x100], r13
xchg r13, r14
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x18]
mov rcx, qword [rax + 0x20]
xchg r13, rax
mov r13, qword [rcx]
xchg r13, rax
mov rdx, qword [rax + 0x20]
mov qword [rbx], rdx
lea r15, [0x140003e38]
xchg r15, r8
mov qword [rbp - 0x70], r8
xchg r15, r8
lea r12, [0x1401987a0]
mov qword [rbp - 0x68], r12
lea rax, [rbp - 0x70]
mov qword [rbp - 0x38], rax
lea r9, [rbp - 0x70]
xor r8d, r8d
xchg rbx, r12
mov rcx, r12
xchg rbx, r12
call fcn.1401984f0
mov dword [rsp + 0x30], 0x172f05d6
xor dword [rsp + 0x30], 0x3fd3ae1
add dword [rsp + 0x30], 0x15cabdee
xor dword [rsp + 0x30], 0x2b0962dc
add dword [rsp + 0x30], 0x77771c34
sub dword [rsp + 0x30], 0x46f85dec
add dword [rsp + 0x30], 0xc4e298b5
mov dword [rsp + 0x50], 0xc0fc5ca
add dword [rsp + 0x50], 0x4a29c468
sub dword [rsp + 0x50], 0x52d9ce96
add dword [rsp + 0x50], 0x5c7e9bbe
xor dword [rsp + 0x50], 0x128004b2
xor dword [rsp + 0x50], 0xb203ac8e
mov dword [rsp + 0x54], 0x28446c6a
xor dword [rsp + 0x54], 0x27f9848e
add dword [rsp + 0x54], 0x584116c9
sub dword [rsp + 0x54], 0x384ca4df
add dword [rsp + 0x54], 0x17821dc1
xor dword [rsp + 0x54], 0x7ed9e31e
sub dword [rsp + 0x54], 0x2f1956fc
xor dword [rsp + 0x54], 0x2227fc82
xor dword [rsp + 0x54], 0xd78e4794
mov dword [rsp + 0x34], 0x7c0924ee
xor dword [rsp + 0x34], 0x1ba94ed8
sub dword [rsp + 0x34], 0x305383f4
add dword [rsp + 0x34], 0x3951f42b
sub dword [rsp + 0x34], 0x3c37a8b9
xor dword [rsp + 0x34], 0x41219396
xor dword [rsp + 0x34], 0x60a8a04d
xor dword [rsp + 0x34], 0x184a3660
xor dword [rsp + 0x34], 0xfb52c2f9
mov dword [rsp + 0x58], 0x34f938f0
xor dword [rsp + 0x58], 0x7af16d90
sub dword [rsp + 0x58], 0x11b7a4e5
sub dword [rsp + 0x58], 0x93e274e
xor dword [rsp + 0x58], 0x1c6f6d52
add dword [rsp + 0x58], 0xcff21aff
mov dword [rsp + 0x5c], 0x4d47d52f
add dword [rsp + 0x5c], 0x31131179
sub dword [rsp + 0x5c], 0x519ee90
sub dword [rsp + 0x5c], 0x2b90c156
add dword [rsp + 0x5c], 0x28212801
sub dword [rsp + 0x5c], 0x3e3be075
sub dword [rsp + 0x5c], 0x34cb85db
add dword [rsp + 0x5c], 0x65fc441c
add dword [rsp + 0x5c], 0x9696c2e8
mov dword [rsp + 0x38], 0x399e72e4
xor dword [rsp + 0x38], 0x7cc0f4b3
sub dword [rsp + 0x38], 0x3def70fa
add dword [rsp + 0x38], 0x1ada1c65
xor dword [rsp + 0x38], 0x250c3dce
add dword [rsp + 0x38], 0x719fc18b
add dword [rsp + 0x38], 0x7e12295f
mov dword [rsp + 0x60], 0x128938cb
xor dword [rsp + 0x60], 0x4949417f
xor dword [rsp + 0x60], 0x2fbbef9
sub dword [rsp + 0x60], 0x397b95d0
add dword [rsp + 0x60], 0x2d5645a
xor dword [rsp + 0x60], 0x11590955
xor dword [rsp + 0x60], 0xccb563fb
mov dword [rsp + 0x64], 0x386ff6d6
add dword [rsp + 0x64], 0x4454fe25
xor dword [rsp + 0x64], 0x40051c66
add dword [rsp + 0x64], 0x3d0d034
sub dword [rsp + 0x64], 0x234ccb23
xor dword [rsp + 0x64], 0x57a988ea
xor dword [rsp + 0x64], 0x4fca47b7
add dword [rsp + 0x64], 0xfa40dc8b
mov dword [rsp + 0x3c], 0x75c13983
xor dword [rsp + 0x3c], 0x52d35352
add dword [rsp + 0x3c], 0x15f2a8ff
sub dword [rsp + 0x3c], 0x110067de
sub dword [rsp + 0x3c], 0xdea6d2f
xor dword [rsp + 0x3c], 0x3430c71b
sub dword [rsp + 0x3c], 0xbb682ed
add dword [rsp + 0x3c], 0x1506068a
add dword [rsp + 0x3c], 0xc37c7981
mov dword [rsp + 0x68], 0x4fe9ffcf
xor dword [rsp + 0x68], 0x72893cbb
add dword [rsp + 0x68], 0x3153459
add dword [rsp + 0x68], 0x1a8520e8
sub dword [rsp + 0x68], 0x5a550982
add dword [rsp + 0x68], 0x71c6a02b
add dword [rsp + 0x68], 0x8d17501f
mov dword [rsp + 0x6c], 0x7d221a93
sub dword [rsp + 0x6c], 0x178e689e
sub dword [rsp + 0x6c], 0x28dc4dde
add dword [rsp + 0x6c], 0x1e49f28b
sub dword [rsp + 0x6c], 0x3dd3d2f2
xor dword [rsp + 0x6c], 0x32f23d6a
sub dword [rsp + 0x6c], 0x1f7f74a0
add dword [rsp + 0x6c], 0xef1eb543
mov dword [rsp + 0x40], 0x39a8f057
add dword [rsp + 0x40], 0x1197730d
xor dword [rsp + 0x40], 0x26860b21
sub dword [rsp + 0x40], 0x39f9865d
add dword [rsp + 0x40], 0x3db3c1eb
xor dword [rsp + 0x40], 0x87765525
mov dword [rsp + 0x70], 0x72e3119e
sub dword [rsp + 0x70], 0xeba5ef0
xor dword [rsp + 0x70], 0x6e1e1efb
add dword [rsp + 0x70], 0x2061ae98
sub dword [rsp + 0x70], 0x22082cbd
add dword [rsp + 0x70], 0x5f828139
sub dword [rsp + 0x70], 0x279eb9e
add dword [rsp + 0x70], 0x99df3ba4
mov dword [rsp + 0x74], 0x4ae4de21
xor dword [rsp + 0x74], 0x49756adc
xor dword [rsp + 0x74], 0x328de87f
add dword [rsp + 0x74], 0x45292efa
sub dword [rsp + 0x74], 0x6e39dfa4
add dword [rsp + 0x74], 0x468424a3
add dword [rsp + 0x74], 0x2163d679
xor dword [rsp + 0x74], 0x90cf59c9
mov dword [rsp + 0x44], 0x711f7376
sub dword [rsp + 0x44], 0x6ab41bc1
xor dword [rsp + 0x44], 0x1d1c2111
xor dword [rsp + 0x44], 0x32d7b761
add dword [rsp + 0x44], 0x246e6557
add dword [rsp + 0x44], 0xa8e7cfda
mov dword [rsp + 0x78], 0x1b5014ef
xor dword [rsp + 0x78], 0x43e6e6d0
sub dword [rsp + 0x78], 0x2dcef0a8
add dword [rsp + 0x78], 0x6f59155
xor dword [rsp + 0x78], 0x3660ac12
add dword [rsp + 0x78], 0xf7bbc068
mov dword [rsp + 0x7c], 0x33937acf
add dword [rsp + 0x7c], 0x1a57ff85
xor dword [rsp + 0x7c], 0xa11b631
add dword [rsp + 0x7c], 0x12d99998
sub dword [rsp + 0x7c], 0x409acb9e
xor dword [rsp + 0x7c], 0x7f5ea956
sub dword [rsp + 0x7c], 0x30f4a8fc
add dword [rsp + 0x7c], 0xcafc7571
mov dword [rsp + 0x48], 0x5cad3d80
xor dword [rsp + 0x48], 0x7ed97e59
sub dword [rsp + 0x48], 0x155f7c70
xor dword [rsp + 0x48], 0x6b594fac
xor dword [rsp + 0x48], 0x25d0e177
xor dword [rsp + 0x48], 0x6e880859
add dword [rsp + 0x48], 0x2b2f19a1
xor dword [rsp + 0x48], 0x45e453b4
add dword [rsp + 0x48], 0xd956cebe
mov dword [rbp - 0x80], 0x1f382083
xor dword [rbp - 0x80], 0x4167e4f2
sub dword [rbp - 0x80], 0x1c251ffc
xor dword [rbp - 0x80], 0x4d6bfe64
add dword [rbp - 0x80], 0x104fb5e7
add dword [rbp - 0x80], 0xdfd5ef7e
mov dword [rbp - 0x7c], 0x4eaa926f
xor dword [rbp - 0x7c], 0x7677cd7d
xor dword [rbp - 0x7c], 0x63eaa00c
sub dword [rbp - 0x7c], 0x473e7f70
sub dword [rbp - 0x7c], 0xe1bdeb0
add dword [rbp - 0x7c], 0x11711c12
add dword [rbp - 0x7c], 0x254e8587
add dword [rbp - 0x7c], 0x10daf6ce
add dword [rbp - 0x7c], 0xb1f6c5d3
mov word [rsp + 0x4c], 0x2eff
add word [rsp + 0x4c], 0x10f7
add word [rsp + 0x4c], 0x1e5a
sub word [rsp + 0x4c], 0x3adb
xor word [rsp + 0x4c], 0x132e
xor word [rsp + 0x4c], 0xc6ad
mov dword [rbp - 0x78], 0x799eecff
sub dword [rbp - 0x78], 0x3337aab8
xor dword [rbp - 0x78], 0x7c790835
add dword [rbp - 0x78], 0x420dfd45
xor dword [rbp - 0x78], 0x7cb2cce4
add dword [rbp - 0x78], 0x5c6abc53
add dword [rbp - 0x78], 0xa26db7d0
xor eax, eax
mov word [rbp - 0x74], ax
nop word [rax + rax]
movzx ecx, word [rsp + rax*2 + 0x50]
movzx edx, byte [rsp + rax + 0x30]
add dx, cx
mov word [rsp + rax*2 + 0x50], dx
mov byte [rsp + rax + 0x30], r14b
inc rax
cmp rax, 0x1e
jb 0x140196f5f
xor r8d, r8d
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140199200
mov rdi, rax
xchg r14, rbp
mov rcx, rbp
xchg rbp, r14
nop word [rax + rax]
mov byte [rsp + rcx + 0x50], 0x76
sub byte [rsp + rcx + 0x50], 2
xor byte [rsp + rcx + 0x50], 0x7a
xor byte [rsp + rcx + 0x50], 0x7a
sub byte [rsp + rcx + 0x50], 0x60
xor byte [rsp + rcx + 0x50], 0x29
sub byte [rsp + rcx + 0x50], 0x3d
inc rcx
cmp rcx, 0x3c
jb 0x140196fa9
mov qword [rsp + 0x28], r14
mov byte [rsp + 0x20], 0x63
xor byte [rsp + 0x20], 0x5a
sub byte [rsp + 0x20], 0x37
xor byte [rsp + 0x20], 0x54
sub byte [rsp + 0x20], 0x26
sub byte [rsp + 0x20], 0x27
add byte [rsp + 0x20], 2
sub byte [rsp + 0x20], 0xb
xor r9d, r9d
xor r8d, r8d
xchg rcx, rdx
mov rcx, rdi
xchg rcx, rdx
xchg rbx, rcx
mov rbx, rcx
xchg rbx, rcx
call fcn.14019a340
xchg r10, rax
mov qword [rbx + 8], r10
xchg r10, rax
xchg rcx, rdi
mov qword [rbp + 0x40], rcx
xchg rcx, rdi
test rdi, rdi
je 0x140197092
mov dword [rsp + 0x20], 0xa0ed5b8
add dword [rsp + 0x20], 0x1a08b690
add dword [rsp + 0x20], 0x11494279
add dword [rsp + 0x20], 0x2bc9b05e
add dword [rsp + 0x20], 0x4e77725
add dword [rsp + 0x20], 0x50cb4b1
sub dword [rsp + 0x20], 0xefa6468
xor dword [rsp + 0x20], 0x5c24c68d
xor r9d, r9d
lea r8, [rbp + 0x40]
lea rdx, [r9 - 1]
lea rcx, [rbx + 0x70]
call fcn.140197410
mov qword [rbp - 0x30], r15
xchg r8, r12
mov qword [rbp - 0x28], r8
xchg r8, r12
lea rax, [rbp - 0x30]
mov qword [rbp + 8], rax
lea r9, [rbp - 0x30]
xor r8d, r8d
mov rdx, qword [rbx + 8]
xchg rbx, rdi
mov rcx, rdi
xchg rbx, rdi
call fcn.1401984f0
xchg rbx, rax
mov rbx, rax
xchg rbx, rax
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x40]
xchg rsi, r13
mov r13, qword [r11 + 0x48]
xchg r13, rsi
mov rsp, r11
push rdx
xchg qword [rsp + 8], r15
pop rdx
add rsp, 8
push rax
push rax
push rdx
push rdx
push rcx
xchg qword [rsp + 0x28], r14
add rsp, 0x30
nop
add rsp, 8
xchg qword [rsp - 8], r12
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
xchg qword [rsp], rbp
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]