Function at 0x1401967f0
Capabilities:
Access peb ldr_data
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
xchg r9, rsi
mov qword [rsp + 0x20], r9
xchg rsi, r9
nop
push r10
mov qword [rsp], rbp
nop
sub rsp, 8
mov qword [rsp], rdi
push r12
nop
sub rsp, 8
mov qword [rsp], r14
nop
sub rsp, 8
mov qword [rsp], r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
xchg rbx, rbp
mov rbp, rcx
xchg rbp, rbx
xor r14d, r14d
xchg r11, r14
mov qword [rcx + 0x10], r11
xchg r14, r11
xchg r10, r14
mov qword [rcx + 0x20], r10
xchg r10, r14
xchg r14, rbp
mov qword [rcx + 0x30], rbp
xchg rbp, r14
mov qword [rcx + 0x40], r14
mov qword [rcx + 0x50], r14
mov qword [rcx + 0x60], r14
xchg r14, r8
mov qword [rcx + 0x70], r8
xchg r14, r8
xchg r13, r14
mov qword [rcx + 0x80], r13
xchg r14, r13
mov qword [rcx + 0x90], r14
mov qword [rcx + 0xa0], r14
xchg r11, r14
mov qword [rcx + 0xb0], r11
xchg r14, r11
mov qword [rcx + 0xc0], r14
xchg r13, r14
mov qword [rcx + 0xd0], r13
xchg r13, r14
xchg rbx, r14
mov qword [rcx + 0xe0], rbx
xchg rbx, r14
xchg r14, r15
mov qword [rcx + 0xf0], r15
xchg r14, r15
xchg r14, rdi
mov qword [rcx + 0x100], rdi
xchg r14, rdi
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x18]
mov rcx, qword [rax + 0x20]
mov rax, qword [rcx]
mov rdx, qword [rax + 0x20]
mov qword [rbx], rdx
lea r15, [0x140003e38]
mov qword [rbp - 0x70], r15
lea r12, [0x1401986f0]
mov qword [rbp - 0x68], r12
lea rax, [rbp - 0x70]
mov qword [rbp - 0x38], rax
lea r9, [rbp - 0x70]
xor r8d, r8d
xchg r8, rbx
mov rcx, r8
xchg rbx, r8
call fcn.140198420
mov dword [rsp + 0x30], 0x6a2e946d
sub dword [rsp + 0x30], 0x257f5f36
sub dword [rsp + 0x30], 0x27d99533
add dword [rsp + 0x30], 0x22ed00d8
xor dword [rsp + 0x30], 0x10e77554
xor dword [rsp + 0x30], 0x6b50eeed
sub dword [rsp + 0x30], 0x2eb2f343
add dword [rsp + 0x30], 0x4c10b1cc
add dword [rsp + 0x30], 0x9523fd08
mov dword [rsp + 0x50], 0x79d21139
xor dword [rsp + 0x50], 0x2a45d012
sub dword [rsp + 0x50], 0x18b92944
add dword [rsp + 0x50], 0x1c0eebc6
xor dword [rsp + 0x50], 0x7ade8b47
add dword [rsp + 0x50], 0x30c7934a
xor dword [rsp + 0x50], 0x2b349ca
sub dword [rsp + 0x50], 0x215046c5
add dword [rsp + 0x50], 0xc264702d
mov dword [rsp + 0x54], 0x3f69307c
add dword [rsp + 0x54], 0x1db66b2a
sub dword [rsp + 0x54], 0x3773ac85
sub dword [rsp + 0x54], 0x2331957d
xor dword [rsp + 0x54], 0x6a0d7506
sub dword [rsp + 0x54], 0x3135b4ec
xor dword [rsp + 0x54], 0x60b06ec9
add dword [rsp + 0x54], 0xa78ce604
mov dword [rsp + 0x34], 0x462a1d89
xor dword [rsp + 0x34], 0x20b0cae9
sub dword [rsp + 0x34], 0x288cc593
sub dword [rsp + 0x34], 0x3ba3af68
xor dword [rsp + 0x34], 0x188458ea
xor dword [rsp + 0x34], 0x106a4a18
xor dword [rsp + 0x34], 0xfc728661
mov dword [rsp + 0x58], 0x221ab398
add dword [rsp + 0x58], 0x4d10104c
sub dword [rsp + 0x58], 0x64251ec0
add dword [rsp + 0x58], 0x1565059a
xor dword [rsp + 0x58], 0x18479180
add dword [rsp + 0x58], 0x3367dd85
xor dword [rsp + 0x58], 0x94fae7bd
mov dword [rsp + 0x5c], 0x6fe8fe0d
sub dword [rsp + 0x5c], 0x4fca7b01
add dword [rsp + 0x5c], 0x3313f2e4
add dword [rsp + 0x5c], 0x513045c
add dword [rsp + 0x5c], 0x3b5dd13
sub dword [rsp + 0x5c], 0x43c82155
add dword [rsp + 0x5c], 0x318aba58
add dword [rsp + 0x5c], 0xb59f0f15
mov dword [rsp + 0x38], 0x23d86b89
add dword [rsp + 0x38], 0xa558f98
xor dword [rsp + 0x38], 0x66ee191
xor dword [rsp + 0x38], 0x1559eda3
sub dword [rsp + 0x38], 0x3881b547
xor dword [rsp + 0x38], 0xf26fb73a
mov dword [rsp + 0x60], 0x4ec16a7b
xor dword [rsp + 0x60], 0x12eb3739
sub dword [rsp + 0x60], 0x1e448eeb
add dword [rsp + 0x60], 0x335fafba
sub dword [rsp + 0x60], 0x1b4363e9
sub dword [rsp + 0x60], 0x2e37a6e2
add dword [rsp + 0x60], 0xd7af8c33
mov dword [rsp + 0x64], 0x402fe82d
sub dword [rsp + 0x64], 0x23001e10
xor dword [rsp + 0x64], 0x18651c3
xor dword [rsp + 0x64], 0x292b94e8
sub dword [rsp + 0x64], 0x1e844eb7
xor dword [rsp + 0x64], 0x758e1b3d
sub dword [rsp + 0x64], 0x47e369a7
xor dword [rsp + 0x64], 0xe4f68ee5
mov dword [rsp + 0x3c], 0x62ae21d7
sub dword [rsp + 0x3c], 0x5e124ed5
add dword [rsp + 0x3c], 0x4e8fb90f
xor dword [rsp + 0x3c], 0x6b5607c8
add dword [rsp + 0x3c], 0x23c9ac3a
xor dword [rsp + 0x3c], 0xaab1cee5
mov dword [rsp + 0x68], 0x24b64c7a
add dword [rsp + 0x68], 0x54ed15ee
sub dword [rsp + 0x68], 0x6311da2b
add dword [rsp + 0x68], 0x651d971b
sub dword [rsp + 0x68], 0x26aaff0c
sub dword [rsp + 0x68], 0x54ab13b8
add dword [rsp + 0x68], 0x4a5fac29
add dword [rsp + 0x68], 0xb4cb46c0
mov dword [rsp + 0x6c], 0x3f8cdc9b
add dword [rsp + 0x6c], 0x31351ade
sub dword [rsp + 0x6c], 0x3ed840c1
add dword [rsp + 0x6c], 0x1dc159eb
xor dword [rsp + 0x6c], 0x27b6d052
sub dword [rsp + 0x6c], 0x622db1a7
xor dword [rsp + 0x6c], 0x7a5c3fec
add dword [rsp + 0x6c], 0x7fd2ced7
mov dword [rsp + 0x40], 0x4505b4c9
sub dword [rsp + 0x40], 0x2001d76
sub dword [rsp + 0x40], 0x147dd973
xor dword [rsp + 0x40], 0x70902c5b
sub dword [rsp + 0x40], 0x3ff908
xor dword [rsp + 0x40], 0x74818d3b
xor dword [rsp + 0x40], 0x74cf1623
add dword [rsp + 0x40], 0x995df34b
mov dword [rsp + 0x70], 0x6206fa1d
xor dword [rsp + 0x70], 0x6b9bdace
xor dword [rsp + 0x70], 0x5ae4b87a
xor dword [rsp + 0x70], 0x69dfdc50
sub dword [rsp + 0x70], 0x40aa371
add dword [rsp + 0x70], 0x2b368a50
sub dword [rsp + 0x70], 0x6110638
xor dword [rsp + 0x70], 0xa4b6dacf
mov dword [rsp + 0x74], 0x53931ec4
sub dword [rsp + 0x74], 0x3b9f1dee
add dword [rsp + 0x74], 0x468478b8
sub dword [rsp + 0x74], 0x1c7bd864
sub dword [rsp + 0x74], 0x1aaedb8c
add dword [rsp + 0x74], 0x1195124c
sub dword [rsp + 0x74], 0x19b6a07f
add dword [rsp + 0x74], 0x153b1607
add dword [rsp + 0x74], 0xcad5b1cb
mov dword [rsp + 0x44], 0x5fda5b2e
xor dword [rsp + 0x44], 0x64120c3f
xor dword [rsp + 0x44], 0x3dc2872c
add dword [rsp + 0x44], 0x3ddfab6
xor dword [rsp + 0x44], 0x7ce8f3a6
sub dword [rsp + 0x44], 0x4274cd8d
add dword [rsp + 0x44], 0x2fc1de2c
add dword [rsp + 0x44], 0xa75b6c
xor dword [rsp + 0x44], 0x94025396
mov dword [rsp + 0x78], 0x163b04ff
add dword [rsp + 0x78], 0x51372999
sub dword [rsp + 0x78], 0x2a5991e0
add dword [rsp + 0x78], 0x15600f32
xor dword [rsp + 0x78], 0x352cbb32
sub dword [rsp + 0x78], 0x1c328915
add dword [rsp + 0x78], 0x2dca5d00
sub dword [rsp + 0x78], 0x81db08d
add dword [rsp + 0x78], 0x8eaacb30
mov dword [rsp + 0x7c], 0x1a447e7a
xor dword [rsp + 0x7c], 0x607ec41d
sub dword [rsp + 0x7c], 0x2abd5da4
sub dword [rsp + 0x7c], 0x1afe6b86
xor dword [rsp + 0x7c], 0x6c476c47
add dword [rsp + 0x7c], 0xa7356204
mov dword [rsp + 0x48], 0x1bc66f8c
add dword [rsp + 0x48], 0x4e1fd711
add dword [rsp + 0x48], 0x3638fa5
xor dword [rsp + 0x48], 0x4f05adb8
xor dword [rsp + 0x48], 0x78035f7a
add dword [rsp + 0x48], 0x9ca7d276
mov dword [rbp - 0x80], 0x17f88b07
xor dword [rbp - 0x80], 0xb571105
add dword [rbp - 0x80], 0x5c4281cf
xor dword [rbp - 0x80], 0x4b405ad9
xor dword [rbp - 0x80], 0x42c1232c
add dword [rbp - 0x80], 0x8e039d52
mov dword [rbp - 0x7c], 0x5c9f8fc9
sub dword [rbp - 0x7c], 0x1c924b13
xor dword [rbp - 0x7c], 0x323876aa
xor dword [rbp - 0x7c], 0x1353fd35
sub dword [rbp - 0x7c], 0x3d720d6a
xor dword [rbp - 0x7c], 0x44da4da1
add dword [rbp - 0x7c], 0xacb140c
add dword [rbp - 0x7c], 0x8d755f0e
mov word [rsp + 0x4c], 0x566c
add word [rsp + 0x4c], 0x7de
sub word [rsp + 0x4c], 0x1090
xor word [rsp + 0x4c], 0x6f08
xor word [rsp + 0x4c], 0x7df0
sub word [rsp + 0x4c], 0x40bf
add word [rsp + 0x4c], 0x4199
add word [rsp + 0x4c], 0x96da
mov dword [rbp - 0x78], 0x10236bbc
add dword [rbp - 0x78], 0x26ba2d1e
add dword [rbp - 0x78], 0x26918e16
sub dword [rbp - 0x78], 0x174d5164
add dword [rbp - 0x78], 0xf07947e
sub dword [rbp - 0x78], 0x51ab775d
xor dword [rbp - 0x78], 0xfc0b0ddb
xor eax, eax
mov word [rbp - 0x74], ax
nop word [rax + rax]
movzx ecx, word [rsp + rax*2 + 0x50]
movzx edx, byte [rsp + rax + 0x30]
add dx, cx
mov word [rsp + rax*2 + 0x50], dx
mov byte [rsp + rax + 0x30], r14b
inc rax
cmp rax, 0x1e
jb 0x140196e91
xor r8d, r8d
lea rdx, [rsp + 0x50]
xchg rbx, rbp
mov rcx, rbp
xchg rbp, rbx
call fcn.140199170
mov rdi, rax
xchg rcx, r10
mov r10, r14
xchg rcx, r10
nop word [rax + rax]
mov byte [rsp + rcx + 0x50], 0x4b
sub byte [rsp + rcx + 0x50], 0x4b
add byte [rsp + rcx + 0x50], 0x59
sub byte [rsp + rcx + 0x50], 1
sub byte [rsp + rcx + 0x50], 0x44
add byte [rsp + rcx + 0x50], 0x56
xor byte [rsp + rcx + 0x50], 0x3c
sub byte [rsp + rcx + 0x50], 0x35
xor byte [rsp + rcx + 0x50], 0x21
inc rcx
cmp rcx, 0x3c
jb 0x140196ee1
mov qword [rsp + 0x28], r14
mov byte [rsp + 0x20], 0x1e
add byte [rsp + 0x20], 0x13
xor byte [rsp + 0x20], 0x3c
add byte [rsp + 0x20], 0x64
xor byte [rsp + 0x20], 0x1c
xor byte [rsp + 0x20], 0x3b
xor byte [rsp + 0x20], 0x47
sub byte [rsp + 0x20], 0x11
xor r9d, r9d
xor r8d, r8d
xchg rdx, rdi
mov rdi, rdx
xchg rdi, rdx
xchg rbx, rcx
mov rbx, rcx
xchg rcx, rbx
call fcn.14019a2f0
xchg r12, rax
mov qword [rbx + 8], r12
xchg r12, rax
mov qword [rbp + 0x40], rdi
test rdi, rdi
je 0x140196fc6
mov dword [rsp + 0x20], 0x5bf879b9
xor dword [rsp + 0x20], 0x6fde5904
xor dword [rsp + 0x20], 0x310be216
add dword [rsp + 0x20], 0x5ccdb5ce
sub dword [rsp + 0x20], 0x5b067721
add dword [rsp + 0x20], 0x60fd2854
sub dword [rsp + 0x20], 0x67f1a9ac
xor r9d, r9d
lea r8, [rbp + 0x40]
lea rdx, [r9 - 1]
lea rcx, [rbx + 0x70]
call fcn.140197350
xchg rbx, r15
mov qword [rbp - 0x30], rbx
xchg rbx, r15
mov qword [rbp - 0x28], r12
lea rax, [rbp - 0x30]
xchg r15, rax
mov qword [rbp + 8], r15
xchg r15, rax
lea r9, [rbp - 0x30]
xor r8d, r8d
mov rdx, qword [rbx + 8]
xchg rbx, r13
mov rcx, r13
xchg rbx, r13
call fcn.140198420
xchg rdi, rbx
mov rax, rdi
xchg rbx, rdi
lea r11, [rsp + 0x110]
xchg r10, rbx
mov r10, qword [r11 + 0x40]
xchg rbx, r10
xchg r13, rsi
mov r13, qword [r11 + 0x48]
xchg r13, rsi
mov rsp, r11
nop
mov r15, qword [rsp]
add rsp, 8
nop
xchg qword [rsp], r14
add rsp, 8
nop
mov r12, qword [rsp]
add rsp, 8
push rax
push rax
push rax
xchg qword [rsp + 0x18], rdi
pop rax
pop rax
pop rax
add rsp, 8
nop
add rsp, 8
mov rbp, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]