Function at 0x1401973f0
Capabilities:
Access peb ldr_data
Encode data using xor

Disassembly:
xchg r15, rbx
mov qword [rsp + 0x18], r15
xchg rbx, r15
xchg r9, rsi
mov qword [rsp + 0x20], r9
xchg rsi, r9
push rbp
nop
sub rsp, 8
mov qword [rsp], rdi
nop
mov qword [rsp - 8], r12
sub rsp, 8
push r14
nop
sub rsp, 8
mov qword [rsp], r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
xchg rbx, rcx
mov rcx, rbx
xchg rbx, rcx
xor r14d, r14d
mov qword [rcx + 0x10], r14
xchg r14, r12
mov qword [rcx + 0x20], r12
xchg r12, r14
mov qword [rcx + 0x30], r14
xchg r8, r14
mov qword [rcx + 0x40], r8
xchg r8, r14
mov qword [rcx + 0x50], r14
xchg r15, r14
mov qword [rcx + 0x60], r15
xchg r14, r15
xchg r14, rbx
mov qword [rcx + 0x70], rbx
xchg r14, rbx
xchg r14, r9
mov qword [rcx + 0x80], r9
xchg r14, r9
xchg r14, r9
mov qword [rcx + 0x90], r9
xchg r14, r9
xchg r14, r8
mov qword [rcx + 0xa0], r8
xchg r8, r14
xchg r14, r8
mov qword [rcx + 0xb0], r8
xchg r8, r14
mov qword [rcx + 0xc0], r14
xchg r12, r14
mov qword [rcx + 0xd0], r12
xchg r12, r14
mov qword [rcx + 0xe0], r14
xchg r8, r14
mov qword [rcx + 0xf0], r8
xchg r8, r14
xchg r10, r14
mov qword [rcx + 0x100], r10
xchg r14, r10
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
xchg rbx, rax
mov rbx, qword [rcx + 0x18]
xchg rbx, rax
xchg r14, rcx
mov r14, qword [rax + 0x20]
xchg rcx, r14
mov rax, qword [rcx]
xchg rdx, r15
mov r15, qword [rax + 0x20]
xchg r15, rdx
xchg r9, rdx
mov qword [rbx], r9
xchg r9, rdx
lea r15, [0x140003e38]
mov qword [rbp - 0x70], r15
lea r12, [0x140199310]
mov qword [rbp - 0x68], r12
lea rax, [rbp - 0x70]
mov qword [rbp - 0x38], rax
lea r9, [rbp - 0x70]
xor r8d, r8d
xchg rdi, rcx
mov rdi, rbx
xchg rcx, rdi
call fcn.140199080
mov dword [rsp + 0x30], 0x29eee112
sub dword [rsp + 0x30], 0x1132f87
add dword [rsp + 0x30], 0x1247ddff
xor dword [rsp + 0x30], 0x7106c41
add dword [rsp + 0x30], 0x344fdf7e
add dword [rsp + 0x30], 0x867333ad
mov dword [rsp + 0x50], 0x3012a08a
add dword [rsp + 0x50], 0x911fb06
add dword [rsp + 0x50], 0x164c9cf6
add dword [rsp + 0x50], 0x133686db
xor dword [rsp + 0x50], 0x6b10800e
xor dword [rsp + 0x50], 0x5547f6e9
sub dword [rsp + 0x50], 0x30b3585a
xor dword [rsp + 0x50], 0xd3608e4a
mov dword [rsp + 0x54], 0x7bd44f81
xor dword [rsp + 0x54], 0x2edd5a61
sub dword [rsp + 0x54], 0x232429c9
sub dword [rsp + 0x54], 0x2a31f5d0
add dword [rsp + 0x54], 0x412cd4d0
add dword [rsp + 0x54], 0xb69e346c
mov dword [rsp + 0x34], 0x1551419e
xor dword [rsp + 0x34], 0x39a0d319
xor dword [rsp + 0x34], 0x6875a6db
add dword [rsp + 0x34], 0x928a395
add dword [rsp + 0x34], 0x172c1036
sub dword [rsp + 0x34], 0x2d0e44b7
sub dword [rsp + 0x34], 0x1a05b386
add dword [rsp + 0x34], 0x1f4fbda2
add dword [rsp + 0x34], 0xb9e2496a
mov dword [rsp + 0x58], 0x1fef0b55
add dword [rsp + 0x58], 0x58b2adb6
xor dword [rsp + 0x58], 0x14b25ede
xor dword [rsp + 0x58], 0x588a8c36
add dword [rsp + 0x58], 0x20fd69b9
sub dword [rsp + 0x58], 0x2e876ca4
xor dword [rsp + 0x58], 0x370233a5
xor dword [rsp + 0x58], 0x2fe9302d
add dword [rsp + 0x58], 0xbf8b940e
mov dword [rsp + 0x5c], 0x48167cac
add dword [rsp + 0x5c], 0x21c3fc7e
sub dword [rsp + 0x5c], 0x1704941f
sub dword [rsp + 0x5c], 0x2b57356a
xor dword [rsp + 0x5c], 0x737254d5
xor dword [rsp + 0x5c], 0x7fa5e230
add dword [rsp + 0x5c], 0x5c5c1ac
xor dword [rsp + 0x5c], 0x6d1ea2ba
add dword [rsp + 0x5c], 0xa2ec872d
mov dword [rsp + 0x38], 0x51cab677
sub dword [rsp + 0x38], 0x8ee5791
add dword [rsp + 0x38], 0xb1de748
sub dword [rsp + 0x38], 0x17a9b24f
add dword [rsp + 0x38], 0xb0a6dba
add dword [rsp + 0x38], 0xe4bcac0
add dword [rsp + 0x38], 0xa1502a9d
mov dword [rsp + 0x60], 0x5f125e9f
sub dword [rsp + 0x60], 0x35975e98
xor dword [rsp + 0x60], 0x7f23eaf
sub dword [rsp + 0x60], 0x22d4640c
xor dword [rsp + 0x60], 0x5a221d5b
xor dword [rsp + 0x60], 0x5cce5705
xor dword [rsp + 0x60], 0x2672e9b5
add dword [rsp + 0x60], 0xed42eee
add dword [rsp + 0x60], 0xc57b5714
mov dword [rsp + 0x64], 0x6279a070
xor dword [rsp + 0x64], 0x1116cafe
sub dword [rsp + 0x64], 0x70503cad
add dword [rsp + 0x64], 0x4eeef5a8
xor dword [rsp + 0x64], 0x6d4acb26
sub dword [rsp + 0x64], 0x3b16e689
xor dword [rsp + 0x64], 0xfb48fd58
mov dword [rsp + 0x3c], 0x7446e712
sub dword [rsp + 0x3c], 0x18c99324
xor dword [rsp + 0x3c], 0x1fd224aa
xor dword [rsp + 0x3c], 0x678603c8
xor dword [rsp + 0x3c], 0x42f9db20
xor dword [rsp + 0x3c], 0x47e15c04
add dword [rsp + 0x3c], 0x329ccc4e
sub dword [rsp + 0x3c], 0x400180fa
add dword [rsp + 0x3c], 0xde29b7fa
mov dword [rsp + 0x68], 0x5debae06
add dword [rsp + 0x68], 0x15c91889
add dword [rsp + 0x68], 0xaa2fdc9
sub dword [rsp + 0x68], 0x12348787
sub dword [rsp + 0x68], 0x266b9e0b
sub dword [rsp + 0x68], 0x3b6ea825
add dword [rsp + 0x68], 0x25c805e
add dword [rsp + 0x68], 0x10418a32
add dword [rsp + 0x68], 0xe29cfe4c
mov dword [rsp + 0x6c], 0x435d0466
xor dword [rsp + 0x6c], 0x1977cf49
sub dword [rsp + 0x6c], 0x2b87341f
xor dword [rsp + 0x6c], 0x42f07654
sub dword [rsp + 0x6c], 0x2c1e6af6
sub dword [rsp + 0x6c], 0x1787690
xor dword [rsp + 0x6c], 0x23c87bc3
xor dword [rsp + 0x6c], 0xe20a7b00
mov dword [rsp + 0x40], 0x4e5a313b
sub dword [rsp + 0x40], 0x25f6ad30
add dword [rsp + 0x40], 0x21e461de
add dword [rsp + 0x40], 0x147d7da
xor dword [rsp + 0x40], 0x2ddd9a19
add dword [rsp + 0x40], 0xde53297
sub dword [rsp + 0x40], 0x7086ba74
add dword [rsp + 0x40], 0x4ba80677
add dword [rsp + 0x40], 0xa79e5082
mov dword [rsp + 0x70], 0x55cd23ec
sub dword [rsp + 0x70], 0x2e426176
add dword [rsp + 0x70], 0x174d7854
add dword [rsp + 0x70], 0x1223bda1
xor dword [rsp + 0x70], 0x3c4e3b1f
sub dword [rsp + 0x70], 0x4b054b22
add dword [rsp + 0x70], 0xddc7871d
mov dword [rsp + 0x74], 0x525cf247
xor dword [rsp + 0x74], 0x4aa8cc08
add dword [rsp + 0x74], 0x5739f113
sub dword [rsp + 0x74], 0x2eaf7c3c
add dword [rsp + 0x74], 0x123b78a6
xor dword [rsp + 0x74], 0xac86d4f1
mov dword [rsp + 0x44], 0x185b093
add dword [rsp + 0x44], 0x7c90b390
sub dword [rsp + 0x44], 0x448a6522
xor dword [rsp + 0x44], 0x69a6333c
xor dword [rsp + 0x44], 0x544a0897
xor dword [rsp + 0x44], 0xfb19c6a
add dword [rsp + 0x44], 0x5082bd94
add dword [rsp + 0x44], 0x9a9de0a2
mov dword [rsp + 0x78], 0x5fca6ba7
sub dword [rsp + 0x78], 0x49fa8dc8
xor dword [rsp + 0x78], 0x2e0ed2f
xor dword [rsp + 0x78], 0x6fa5b6da
xor dword [rsp + 0x78], 0x5e18f120
add dword [rsp + 0x78], 0xd8e6885c
mov dword [rsp + 0x7c], 0x787802d5
sub dword [rsp + 0x7c], 0x35bee028
add dword [rsp + 0x7c], 0x13f84312
add dword [rsp + 0x7c], 0x1311a06a
sub dword [rsp + 0x7c], 0x3f86f026
add dword [rsp + 0x7c], 0xd532e97b
mov dword [rsp + 0x48], 0x35d8634
add dword [rsp + 0x48], 0x51dcaa3e
sub dword [rsp + 0x48], 0x40cab13e
add dword [rsp + 0x48], 0x60ac72f8
sub dword [rsp + 0x48], 0x4162e6e1
xor dword [rsp + 0x48], 0xd9ed2e2
xor dword [rsp + 0x48], 0x682769b9
sub dword [rsp + 0x48], 0x2a76d9cc
xor dword [rsp + 0x48], 0xdd7f20b2
mov dword [rbp - 0x80], 0x46b15537
xor dword [rbp - 0x80], 0x7c35eebc
add dword [rbp - 0x80], 0x105d0eed
xor dword [rbp - 0x80], 0x3b1a81e5
xor dword [rbp - 0x80], 0x8ff3e04
xor dword [rbp - 0x80], 0x86728aef
mov dword [rbp - 0x7c], 0x633c39b8
xor dword [rbp - 0x7c], 0x2da93b7e
xor dword [rbp - 0x7c], 0x410ff5d1
xor dword [rbp - 0x7c], 0x575c9961
add dword [rbp - 0x7c], 0x1bba1861
sub dword [rbp - 0x7c], 0xae43303
sub dword [rbp - 0x7c], 0x57b7e7a2
add dword [rbp - 0x7c], 0x63dd6ab9
add dword [rbp - 0x7c], 0x89ad284d
mov word [rsp + 0x4c], 0x2ede
add word [rsp + 0x4c], 0x3a37
sub word [rsp + 0x4c], 0x37fa
sub word [rsp + 0x4c], 0x2941
add word [rsp + 0x4c], 0x442e
add word [rsp + 0x4c], 0x1d2c
sub word [rsp + 0x4c], 0x417c
add word [rsp + 0x4c], 0xcf3e
mov dword [rbp - 0x78], 0xaf7d079
add dword [rbp - 0x78], 0x7b6ed32
add dword [rbp - 0x78], 0x29835637
add dword [rbp - 0x78], 0x3a0a53cc
sub dword [rbp - 0x78], 0x638cb0c2
add dword [rbp - 0x78], 0xecc7488a
xor eax, eax
mov word [rbp - 0x74], ax
nop word [rax + rax]
movzx ecx, word [rsp + rax*2 + 0x50]
movzx edx, byte [rsp + rax + 0x30]
add dx, cx
mov word [rsp + rax*2 + 0x50], dx
mov byte [rsp + rax + 0x30], r14b
inc rax
cmp rax, 0x1e
jb 0x140197ab6
xor r8d, r8d
lea rdx, [rsp + 0x50]
xchg rbx, rcx
mov rbx, rcx
xchg rcx, rbx
call fcn.140199da0
xchg r11, rax
mov rdi, r11
xchg r11, rax
xchg rsi, r14
mov rcx, rsi
xchg r14, rsi
nop word [rax + rax]
mov byte [rsp + rcx + 0x50], 0x27
xor byte [rsp + rcx + 0x50], 0x4a
sub byte [rsp + rcx + 0x50], 0x49
add byte [rsp + rcx + 0x50], 0x4e
sub byte [rsp + rcx + 0x50], 0x1d
sub byte [rsp + rcx + 0x50], 1
sub byte [rsp + rcx + 0x50], 0x37
add byte [rsp + rcx + 0x50], 0x11
sub byte [rsp + rcx + 0x50], 0x2e
inc rcx
cmp rcx, 0x3c
jb 0x140197b0a
xchg r15, r14
mov qword [rsp + 0x28], r15
xchg r15, r14
mov byte [rsp + 0x20], 0x16
xor byte [rsp + 0x20], 0x23
add byte [rsp + 0x20], 1
xor byte [rsp + 0x20], 0x41
xor byte [rsp + 0x20], 0x44
xor byte [rsp + 0x20], 0x2e
add byte [rsp + 0x20], 0x15
xor byte [rsp + 0x20], 0x32
xor r9d, r9d
xor r8d, r8d
xchg rdi, r14
mov rdx, r14
xchg rdi, r14
xchg r8, rbx
mov rcx, r8
xchg r8, rbx
call fcn.14019aed0
mov qword [rbx + 8], rax
xchg rdi, r11
mov qword [rbp + 0x40], r11
xchg r11, rdi
test rdi, rdi
je 0x140197bef
mov dword [rsp + 0x20], 0x1db33644
add dword [rsp + 0x20], 0x22030552
add dword [rsp + 0x20], 0x33b558ca
sub dword [rsp + 0x20], 0x4433dcff
add dword [rsp + 0x20], 0x48aeb128
sub dword [rsp + 0x20], 0x77e5e889
xor r9d, r9d
lea r8, [rbp + 0x40]
lea rdx, [r9 - 1]
lea rcx, [rbx + 0x70]
call fcn.140197f90
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x28], r12
lea rax, [rbp - 0x30]
mov qword [rbp + 8], rax
lea r9, [rbp - 0x30]
xor r8d, r8d
xchg rdx, r15
mov r15, qword [rbx + 8]
xchg rdx, r15
xchg rcx, rsi
mov rsi, rbx
xchg rcx, rsi
call fcn.140199080
xchg rbx, rax
mov rbx, rax
xchg rbx, rax
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x40]
xchg rsi, rdx
mov rdx, qword [r11 + 0x48]
xchg rsi, rdx
mov rsp, r11
push rdx
push rcx
push rbx
push rax
push rax
xchg qword [rsp + 0x28], r15
add rsp, 0x30
nop
mov r14, qword [rsp]
add rsp, 8
push rcx
push rcx
push rbx
push rcx
push rax
xchg qword [rsp + 0x28], r12
pop rax
pop rcx
pop rbx
pop rcx
pop rcx
add rsp, 8
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
mov rbp, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]