Function at 0x140196600
Capabilities:
Access peb ldr_data
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
xchg rsi, r11
mov qword [rsp + 0x20], r11
xchg rsi, r11
push rbp
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
mov qword [rsp - 8], r12
sub rsp, 8
push r14
nop
sub rsp, 8
mov qword [rsp], r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
xchg r10, rcx
mov rbx, r10
xchg r10, rcx
xor r14d, r14d
mov qword [rcx + 0x10], r14
mov qword [rcx + 0x20], r14
xchg r9, r14
mov qword [rcx + 0x30], r9
xchg r9, r14
mov qword [rcx + 0x40], r14
mov qword [rcx + 0x50], r14
xchg r14, rsi
mov qword [rcx + 0x60], rsi
xchg r14, rsi
xchg r14, rbx
mov qword [rcx + 0x70], rbx
xchg rbx, r14
xchg r15, r14
mov qword [rcx + 0x80], r15
xchg r15, r14
xchg rdx, r14
mov qword [rcx + 0x90], rdx
xchg rdx, r14
xchg r14, r11
mov qword [rcx + 0xa0], r11
xchg r14, r11
xchg rdx, r14
mov qword [rcx + 0xb0], rdx
xchg r14, rdx
xchg rdx, r14
mov qword [rcx + 0xc0], rdx
xchg rdx, r14
xchg r13, r14
mov qword [rcx + 0xd0], r13
xchg r14, r13
xchg r14, r10
mov qword [rcx + 0xe0], r10
xchg r10, r14
xchg r14, r9
mov qword [rcx + 0xf0], r9
xchg r14, r9
mov qword [rcx + 0x100], r14
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
xchg r12, rax
mov r12, qword [rcx + 0x18]
xchg r12, rax
xchg rcx, r11
mov r11, qword [rax + 0x20]
xchg r11, rcx
mov rax, qword [rcx]
xchg rdx, rcx
mov rcx, qword [rax + 0x20]
xchg rdx, rcx
xchg rdx, r13
mov qword [rbx], r13
xchg rdx, r13
lea r15, [0x140003e38]
mov qword [rbp - 0x70], r15
lea r12, [0x140198560]
mov qword [rbp - 0x68], r12
lea rax, [rbp - 0x70]
xchg r15, rax
mov qword [rbp - 0x38], r15
xchg r15, rax
lea r9, [rbp - 0x70]
xor r8d, r8d
mov rcx, rbx
call fcn.140198280
mov dword [rsp + 0x30], 0x60ec5013
xor dword [rsp + 0x30], 0x51a3bdfd
add dword [rsp + 0x30], 0x42a0848e
xor dword [rsp + 0x30], 0x27fd1058
sub dword [rsp + 0x30], 0x3ecc5951
xor dword [rsp + 0x30], 0x237d9d5e
add dword [rsp + 0x30], 0xc0ba6169
mov dword [rsp + 0x50], 0x64f98fe2
sub dword [rsp + 0x50], 0x5bc4dcbc
xor dword [rsp + 0x50], 0x13d22a19
xor dword [rsp + 0x50], 0x6e3fbeed
sub dword [rsp + 0x50], 0x1eee5abb
sub dword [rsp + 0x50], 0x3d99459f
xor dword [rsp + 0x50], 0xe70c781e
mov dword [rsp + 0x54], 0x20295de1
xor dword [rsp + 0x54], 0x34c87c58
add dword [rsp + 0x54], 0x8cc7eb0
xor dword [rsp + 0x54], 0x5387bd9f
xor dword [rsp + 0x54], 0x3388c641
xor dword [rsp + 0x54], 0x4200c086
xor dword [rsp + 0x54], 0x4aa32dda
add dword [rsp + 0x54], 0x8a7cc898
mov dword [rsp + 0x34], 0x3cbbca4e
xor dword [rsp + 0x34], 0x7513a53b
add dword [rsp + 0x34], 0x207fecd4
sub dword [rsp + 0x34], 0x1d31c7f5
sub dword [rsp + 0x34], 0x2d848bcd
sub dword [rsp + 0x34], 0x999cb1a
add dword [rsp + 0x34], 0xe11eb989
mov dword [rsp + 0x58], 0x5480c770
xor dword [rsp + 0x58], 0x7edeb2f9
sub dword [rsp + 0x58], 0x2db7ecc
xor dword [rsp + 0x58], 0x1b972ac0
add dword [rsp + 0x58], 0x2cd24afa
add dword [rsp + 0x58], 0x9687d807
mov dword [rsp + 0x5c], 0x7ab972b
xor dword [rsp + 0x5c], 0x3a9cedc8
sub dword [rsp + 0x5c], 0x155cc9b1
xor dword [rsp + 0x5c], 0x76bc838
xor dword [rsp + 0x5c], 0x1a79c755
sub dword [rsp + 0x5c], 0x32cab437
xor dword [rsp + 0x5c], 0x5b3fb4a2
add dword [rsp + 0x5c], 0x11004387
add dword [rsp + 0x5c], 0x919afd66
mov dword [rsp + 0x38], 0x33735dc2
sub dword [rsp + 0x38], 0x2f5d7710
xor dword [rsp + 0x38], 0x37365ac0
xor dword [rsp + 0x38], 0x45bc053f
sub dword [rsp + 0x38], 0x88ea57d
xor dword [rsp + 0x38], 0x4c938749
add dword [rsp + 0x38], 0x566216
add dword [rsp + 0x38], 0xd41e0047
mov dword [rsp + 0x60], 0x308419c6
add dword [rsp + 0x60], 0x1162a82e
add dword [rsp + 0x60], 0x1ed012d4
add dword [rsp + 0x60], 0x19d88bcc
sub dword [rsp + 0x60], 0x51b5dff1
add dword [rsp + 0x60], 0x42f455d6
xor dword [rsp + 0x60], 0x94b42900
mov dword [rsp + 0x64], 0x5d67a5c6
sub dword [rsp + 0x64], 0x44dc9c35
add dword [rsp + 0x64], 0x6315e741
sub dword [rsp + 0x64], 0x4dcf434a
xor dword [rsp + 0x64], 0x6e839359
add dword [rsp + 0x64], 0x39296f4a
sub dword [rsp + 0x64], 0x27f61e27
add dword [rsp + 0x64], 0xaae16f8a
mov dword [rsp + 0x3c], 0x70e289d3
sub dword [rsp + 0x3c], 0x1007f69e
add dword [rsp + 0x3c], 0x17110e86
sub dword [rsp + 0x3c], 0x124c70e7
sub dword [rsp + 0x3c], 0x603641d9
xor dword [rsp + 0x3c], 0x6c648878
xor dword [rsp + 0x3c], 0x9ffa9075
mov dword [rsp + 0x68], 0x2fc68914
add dword [rsp + 0x68], 0x4c3b8414
sub dword [rsp + 0x68], 0x2a5f574a
xor dword [rsp + 0x68], 0x395d8f97
xor dword [rsp + 0x68], 0x2b5e46e7
xor dword [rsp + 0x68], 0xbc2283d3
mov dword [rsp + 0x6c], 0x44729aa2
xor dword [rsp + 0x6c], 0x57d2c28c
add dword [rsp + 0x6c], 0x55456b5c
sub dword [rsp + 0x6c], 0x24715ac9
xor dword [rsp + 0x6c], 0x5ca091d8
add dword [rsp + 0x6c], 0x42e31c85
add dword [rsp + 0x6c], 0xa3c6e9df
mov dword [rsp + 0x40], 0x764539b4
xor dword [rsp + 0x40], 0xcf7185d
sub dword [rsp + 0x40], 0x6da0c948
xor dword [rsp + 0x40], 0x10c9ac5c
xor dword [rsp + 0x40], 0x57f720df
sub dword [rsp + 0x40], 0x2703bd77
xor dword [rsp + 0x40], 0xd5dae05d
mov dword [rsp + 0x70], 0x734df025
sub dword [rsp + 0x70], 0x1a6e1b2a
sub dword [rsp + 0x70], 0x464fddb8
add dword [rsp + 0x70], 0x1a70a642
add dword [rsp + 0x70], 0x8613496
sub dword [rsp + 0x70], 0x1f22c42
add dword [rsp + 0x70], 0x64795db
add dword [rsp + 0x70], 0xc5c0c3bb
mov dword [rsp + 0x74], 0x31ff9a00
add dword [rsp + 0x74], 0x1db48227
xor dword [rsp + 0x74], 0x556eb3ce
sub dword [rsp + 0x74], 0x162f4bf5
add dword [rsp + 0x74], 0x6203d76e
add dword [rsp + 0x74], 0xe6ea905
add dword [rsp + 0x74], 0x8a1f1ad6
mov dword [rsp + 0x44], 0x185fe0c4
xor dword [rsp + 0x44], 0x7013b34c
sub dword [rsp + 0x44], 0x32f4fc7b
sub dword [rsp + 0x44], 0x2d5cf2d8
add dword [rsp + 0x44], 0x69ced63d
sub dword [rsp + 0x44], 0x238ee8da
add dword [rsp + 0x44], 0xa8bca55e
mov dword [rsp + 0x78], 0x1c1a5b1c
sub dword [rsp + 0x78], 0x12ed9694
add dword [rsp + 0x78], 0x606529f
xor dword [rsp + 0x78], 0x773032b
add dword [rsp + 0x78], 0x62167a1
add dword [rsp + 0x78], 0x68c68115
sub dword [rsp + 0x78], 0x5c00ec49
add dword [rsp + 0x78], 0xe451eeed
mov dword [rsp + 0x7c], 0x6bcc3627
sub dword [rsp + 0x7c], 0x36040d98
sub dword [rsp + 0x7c], 0x18ac0a2b
xor dword [rsp + 0x7c], 0xa4c1553
add dword [rsp + 0x7c], 0xb57d65c
add dword [rsp + 0x7c], 0x3e9caa9a
sub dword [rsp + 0x7c], 0x2b3a921f
add dword [rsp + 0x7c], 0xc9650570
mov dword [rsp + 0x48], 0x6b8c4a97
xor dword [rsp + 0x48], 0x3299c9c0
sub dword [rsp + 0x48], 0x10dfd977
xor dword [rsp + 0x48], 0x725944b9
add dword [rsp + 0x48], 0x3b73ea4
sub dword [rsp + 0x48], 0x276a4eba
xor dword [rsp + 0x48], 0x2d54f05d
sub dword [rsp + 0x48], 0x163b8e22
xor dword [rsp + 0x48], 0xd347680a
mov dword [rbp - 0x80], 0x61073d1b
add dword [rbp - 0x80], 0x1e02dca7
sub dword [rbp - 0x80], 0x1c72fbb3
xor dword [rbp - 0x80], 0x4025e727
xor dword [rbp - 0x80], 0x1d113f1a
xor dword [rbp - 0x80], 0x605203dd
add dword [rbp - 0x80], 0x9f853987
mov dword [rbp - 0x7c], 0x4d5fc0ef
xor dword [rbp - 0x7c], 0x4999a99d
add dword [rbp - 0x7c], 0x524b766e
sub dword [rbp - 0x7c], 0x174e1f17
sub dword [rbp - 0x7c], 0x18c01f93
add dword [rbp - 0x7c], 0xd86b5e02
mov word [rsp + 0x4c], 0x78c5
sub word [rsp + 0x4c], 0x54da
sub word [rsp + 0x4c], 0x10e6
add word [rsp + 0x4c], 0x5cca
sub word [rsp + 0x4c], 0x6b11
add word [rsp + 0x4c], 0x5621
sub word [rsp + 0x4c], 0x2438
xor word [rsp + 0x4c], 0x33b7
add word [rsp + 0x4c], 0xf1e6
mov dword [rbp - 0x78], 0x265da66e
add dword [rbp - 0x78], 0x367814f7
add dword [rbp - 0x78], 0x114477a3
xor dword [rbp - 0x78], 0x49f9f367
sub dword [rbp - 0x78], 0x1b5e73cf
add dword [rbp - 0x78], 0xf2f1b2d6
xor eax, eax
mov word [rbp - 0x74], ax
nop word [rax + rax]
movzx ecx, word [rsp + rax*2 + 0x50]
movzx edx, byte [rsp + rax + 0x30]
add dx, cx
mov word [rsp + rax*2 + 0x50], dx
mov byte [rsp + rax + 0x30], r14b
inc rax
cmp rax, 0x1e
jb 0x140196c88
xor r8d, r8d
lea rdx, [rsp + 0x50]
xchg rbx, rbp
mov rcx, rbp
xchg rbp, rbx
call fcn.140198f90
xchg rdi, r9
mov r9, rax
xchg r9, rdi
xchg rcx, r14
mov r14, rcx
xchg r14, rcx
nop word [rax + rax]
mov byte [rsp + rcx + 0x50], 0xa
xor byte [rsp + rcx + 0x50], 0x79
xor byte [rsp + rcx + 0x50], 0x56
add byte [rsp + rcx + 0x50], 0x34
sub byte [rsp + rcx + 0x50], 0x11
xor byte [rsp + rcx + 0x50], 0x28
xor byte [rsp + rcx + 0x50], 0x60
inc rcx
cmp rcx, 0x3c
jb 0x140196cde
mov qword [rsp + 0x28], r14
mov byte [rsp + 0x20], 0x6a
sub byte [rsp + 0x20], 0x63
xor byte [rsp + 0x20], 0x21
add byte [rsp + 0x20], 0x1a
xor byte [rsp + 0x20], 5
sub byte [rsp + 0x20], 0x23
sub byte [rsp + 0x20], 0xd
sub byte [rsp + 0x20], 0x15
xor r9d, r9d
xor r8d, r8d
xchg r12, rdx
mov r12, rdi
xchg rdx, r12
xchg rbx, rcx
mov rbx, rcx
xchg rcx, rbx
call fcn.14019a0c0
mov qword [rbx + 8], rax
mov qword [rbp + 0x40], rdi
test rdi, rdi
je 0x140196dc5
mov dword [rsp + 0x20], 0x3f3465af
add dword [rsp + 0x20], 0x2035d6b6
sub dword [rsp + 0x20], 0x35d856ac
xor dword [rsp + 0x20], 0xc666715
xor dword [rsp + 0x20], 0x2da166d2
add dword [rsp + 0x20], 0x1823164
xor dword [rsp + 0x20], 0x79d09277
add dword [rsp + 0x20], 0xbea83a
sub dword [rsp + 0x20], 0x70c7afcf
xor r9d, r9d
lea r8, [rbp + 0x40]
lea rdx, [r9 - 1]
lea rcx, [rbx + 0x70]
call fcn.140197170
xchg r12, r15
mov qword [rbp - 0x30], r12
xchg r12, r15
mov qword [rbp - 0x28], r12
lea rax, [rbp - 0x30]
xchg r12, rax
mov qword [rbp + 8], r12
xchg r12, rax
lea r9, [rbp - 0x30]
xor r8d, r8d
mov rdx, qword [rbx + 8]
xchg rcx, rbx
mov rbx, rcx
xchg rbx, rcx
call fcn.140198280
mov rax, rbx
lea r11, [rsp + 0x110]
xchg rbx, rcx
mov rcx, qword [r11 + 0x40]
xchg rcx, rbx
xchg r14, rsi
mov r14, qword [r11 + 0x48]
xchg rsi, r14
mov rsp, r11
push rcx
xchg qword [rsp + 8], r15
add rsp, 0x10
push rdx
push rdx
push rbx
push rcx
xchg qword [rsp + 0x20], r14
pop rcx
pop rbx
pop rdx
pop rdx
add rsp, 8
nop
xchg qword [rsp], r12
add rsp, 8
push rax
push rax
xchg qword [rsp + 0x10], rdi
pop rax
pop rax
add rsp, 8
push rcx
push rcx
push rax
push rdx
xchg qword [rsp + 0x20], rbp
pop rdx
pop rax
pop rcx
pop rcx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]