Function at 0x140196e60
Capabilities:
Access peb ldr_data
Encode data using xor

Disassembly:
xchg rbx, r14
mov qword [rsp + 0x18], r14
xchg r14, rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
nop
sub rsp, 8
mov qword [rsp], r12
nop
mov qword [rsp - 8], r14
sub rsp, 8
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
xchg rbx, rcx
mov rcx, rbx
xchg rbx, rcx
xor r14d, r14d
mov qword [rcx + 0x10], r14
xchg r14, rdi
mov qword [rcx + 0x20], rdi
xchg r14, rdi
xchg r14, rdi
mov qword [rcx + 0x30], rdi
xchg rdi, r14
xchg r12, r14
mov qword [rcx + 0x40], r12
xchg r12, r14
xchg r14, rdi
mov qword [rcx + 0x50], rdi
xchg r14, rdi
xchg r14, r15
mov qword [rcx + 0x60], r15
xchg r15, r14
xchg r14, r12
mov qword [rcx + 0x70], r12
xchg r12, r14
xchg rdi, r14
mov qword [rcx + 0x80], rdi
xchg rdi, r14
xchg r14, r13
mov qword [rcx + 0x90], r13
xchg r14, r13
mov qword [rcx + 0xa0], r14
xchg r15, r14
mov qword [rcx + 0xb0], r15
xchg r15, r14
xchg r12, r14
mov qword [rcx + 0xc0], r12
xchg r12, r14
xchg r14, r15
mov qword [rcx + 0xd0], r15
xchg r14, r15
xchg rdx, r14
mov qword [rcx + 0xe0], rdx
xchg rdx, r14
mov qword [rcx + 0xf0], r14
mov qword [rcx + 0x100], r14
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x18]
xchg rcx, rdi
mov rdi, qword [rax + 0x20]
xchg rdi, rcx
mov rax, qword [rcx]
mov rdx, qword [rax + 0x20]
mov qword [rbx], rdx
lea r15, [0x140003e38]
mov qword [rbp - 0x70], r15
lea r12, [0x140198d10]
mov qword [rbp - 0x68], r12
lea rax, [rbp - 0x70]
mov qword [rbp - 0x38], rax
lea r9, [rbp - 0x70]
xor r8d, r8d
xchg r11, rcx
mov r11, rbx
xchg r11, rcx
call fcn.140198a70
mov dword [rsp + 0x30], 0x54be1ddc
sub dword [rsp + 0x30], 0x410320f9
add dword [rsp + 0x30], 0x150595b3
add dword [rsp + 0x30], 0x2e030382
add dword [rsp + 0x30], 0xfe10c24
add dword [rsp + 0x30], 0x905254ba
mov dword [rsp + 0x50], 0x5b4dbdf2
sub dword [rsp + 0x50], 0x36a5d87f
add dword [rsp + 0x50], 0xbd949d3
xor dword [rsp + 0x50], 0x223bc240
add dword [rsp + 0x50], 0x3fc98f45
xor dword [rsp + 0x50], 0x5d815f79
xor dword [rsp + 0x50], 0xf058dc54
mov dword [rsp + 0x54], 0x5c556549
xor dword [rsp + 0x54], 0x71eecebe
xor dword [rsp + 0x54], 0x257a85e7
add dword [rsp + 0x54], 0x183ca2a3
xor dword [rsp + 0x54], 0x23df924c
xor dword [rsp + 0x54], 0x39680685
sub dword [rsp + 0x54], 0x1ed14879
xor dword [rsp + 0x54], 0x30a71601
add dword [rsp + 0x54], 0xd39e1583
mov dword [rsp + 0x34], 0x49861e67
add dword [rsp + 0x34], 0x214e621
xor dword [rsp + 0x34], 0x2e220194
xor dword [rsp + 0x34], 0x5c63d892
xor dword [rsp + 0x34], 0x10250910
xor dword [rsp + 0x34], 0x108c0f07
sub dword [rsp + 0x34], 0x36f86c23
add dword [rsp + 0x34], 0x5ffc59af
xor dword [rsp + 0x34], 0x94813fd3
mov dword [rsp + 0x58], 0x6209257
sub dword [rsp + 0x58], 0x5cac894
xor dword [rsp + 0x58], 0x2d1026c0
add dword [rsp + 0x58], 0x45031389
xor dword [rsp + 0x58], 0x77fc3064
xor dword [rsp + 0x58], 0x41ffc22c
add dword [rsp + 0x58], 0xbb250eba
mov dword [rsp + 0x5c], 0x44a43a14
add dword [rsp + 0x5c], 0x252b2fc1
sub dword [rsp + 0x5c], 0x57d1566b
add dword [rsp + 0x5c], 0x10f136a
add dword [rsp + 0x5c], 0xc00d1de
add dword [rsp + 0x5c], 0x47f3a01c
sub dword [rsp + 0x5c], 0x423c30eb
add dword [rsp + 0x5c], 0x4a4387cf
add dword [rsp + 0x5c], 0x90540fc5
mov dword [rsp + 0x38], 0x59b9ab83
sub dword [rsp + 0x38], 0x4165d38
xor dword [rsp + 0x38], 0x7df35c37
sub dword [rsp + 0x38], 0x1f9937e4
add dword [rsp + 0x38], 0x89b2b5c
add dword [rsp + 0x38], 0x25b56797
xor dword [rsp + 0x38], 0xc1f19b7d
mov dword [rsp + 0x60], 0x57216b6f
xor dword [rsp + 0x60], 0x37d8379a
xor dword [rsp + 0x60], 0x6b301fb6
add dword [rsp + 0x60], 0x3e45f1f2
sub dword [rsp + 0x60], 0x1d67f8d7
xor dword [rsp + 0x60], 0xd3dec327
mov dword [rsp + 0x64], 0x4ec7a049
xor dword [rsp + 0x64], 0x25b7a7e4
xor dword [rsp + 0x64], 0x66884335
xor dword [rsp + 0x64], 0x5391fda9
sub dword [rsp + 0x64], 0x254b22b8
add dword [rsp + 0x64], 0x23c390c1
xor dword [rsp + 0x64], 0x684cc616
xor dword [rsp + 0x64], 0xcbc81e52
mov dword [rsp + 0x3c], 0x11867040
add dword [rsp + 0x3c], 0x4a73d5e8
sub dword [rsp + 0x3c], 0x43caeec8
add dword [rsp + 0x3c], 0x3d005471
sub dword [rsp + 0x3c], 0x50172a75
add dword [rsp + 0x3c], 0x1b32f8df
add dword [rsp + 0x3c], 0xd6ab7cbb
mov dword [rsp + 0x68], 0x405ec15e
sub dword [rsp + 0x68], 0x9e111a3
xor dword [rsp + 0x68], 0x471204e2
sub dword [rsp + 0x68], 0x3d0cc727
xor dword [rsp + 0x68], 0x119a3c81
add dword [rsp + 0x68], 0xd98b26ca
mov dword [rsp + 0x6c], 0xba918a5
add dword [rsp + 0x6c], 0x4106c48d
sub dword [rsp + 0x6c], 0x26ea025b
xor dword [rsp + 0x6c], 0x7a4ba001
sub dword [rsp + 0x6c], 0x2cdd688b
add dword [rsp + 0x6c], 0x421244b
add dword [rsp + 0x6c], 0xc8acc8e7
mov dword [rsp + 0x40], 0x37bc1ef5
add dword [rsp + 0x40], 0x1314a3b0
add dword [rsp + 0x40], 0x2e6c4b82
xor dword [rsp + 0x40], 0x711be54b
add dword [rsp + 0x40], 0x6b28e489
xor dword [rsp + 0x40], 0x85b93903
mov dword [rsp + 0x70], 0x5a39b324
add dword [rsp + 0x70], 0x20388dfb
xor dword [rsp + 0x70], 0x394f985b
add dword [rsp + 0x70], 0x17eb24c3
xor dword [rsp + 0x70], 0x682f3ccc
add dword [rsp + 0x70], 0xcc703ca4
mov dword [rsp + 0x74], 0x25d39779
add dword [rsp + 0x74], 0x312e07a3
xor dword [rsp + 0x74], 0xccfb299
xor dword [rsp + 0x74], 0x7b8144f
add dword [rsp + 0x74], 0x7ab319
add dword [rsp + 0x74], 0xa24c125a
mov dword [rsp + 0x44], 0x63e7d076
xor dword [rsp + 0x44], 0x3600c7df
add dword [rsp + 0x44], 0x99cad9d
sub dword [rsp + 0x44], 0x46757642
sub dword [rsp + 0x44], 0x18c156a5
add dword [rsp + 0x44], 0x4cd51c76
add dword [rsp + 0x44], 0x2a5237c8
xor dword [rsp + 0x44], 0x8182ba6b
mov dword [rsp + 0x78], 0x6b12ee0f
sub dword [rsp + 0x78], 0xc0d7aa9
add dword [rsp + 0x78], 0x13b94a6e
xor dword [rsp + 0x78], 0x6776fb5d
add dword [rsp + 0x78], 0x4df537b3
xor dword [rsp + 0x78], 0x9cc5815a
mov dword [rsp + 0x7c], 0x64108cba
add dword [rsp + 0x7c], 0xeb3157a
xor dword [rsp + 0x7c], 0x57e52193
add dword [rsp + 0x7c], 0xd7d5c82
sub dword [rsp + 0x7c], 0x193ca19c
add dword [rsp + 0x7c], 0x60e612fe
xor dword [rsp + 0x7c], 0x8523aef5
mov dword [rsp + 0x48], 0x53f9d602
add dword [rsp + 0x48], 0x1b564a01
sub dword [rsp + 0x48], 0x5f55e33c
add dword [rsp + 0x48], 0x6b71644b
xor dword [rsp + 0x48], 0x5e8333b9
xor dword [rsp + 0x48], 0xd31e645d
mov dword [rbp - 0x80], 0x1ad7744e
add dword [rbp - 0x80], 0x61c1e7b6
sub dword [rbp - 0x80], 0x7c952144
add dword [rbp - 0x80], 0x71dfd4e1
sub dword [rbp - 0x80], 0x6815a66e
add dword [rbp - 0x80], 0x22cddf02
xor dword [rbp - 0x80], 0x2fa397e8
add dword [rbp - 0x80], 0xfc371f99
mov dword [rbp - 0x7c], 0x162898d8
add dword [rbp - 0x7c], 0x23a31d3f
add dword [rbp - 0x7c], 0x11974484
sub dword [rbp - 0x7c], 0x3d27d7c4
xor dword [rbp - 0x7c], 0x4028509
xor dword [rbp - 0x7c], 0x7d024347
add dword [rbp - 0x7c], 0x88331a9f
mov word [rsp + 0x4c], 0x2ace
xor word [rsp + 0x4c], 0x7d8d
add word [rsp + 0x4c], 0x1b51
sub word [rsp + 0x4c], 0x6323
add word [rsp + 0x4c], 0x3064
add word [rsp + 0x4c], 0x39ee
sub word [rsp + 0x4c], 0x3f1f
xor word [rsp + 0x4c], 0xcc52
mov dword [rbp - 0x78], 0x7274b454
sub dword [rbp - 0x78], 0x195fb00a
sub dword [rbp - 0x78], 0x3bf7e59f
xor dword [rbp - 0x78], 0x371cbea7
add dword [rbp - 0x78], 0x5531473f
sub dword [rbp - 0x78], 0x51c24f76
add dword [rbp - 0x78], 0x25a97f54
sub dword [rbp - 0x78], 0x357a09cb
xor dword [rbp - 0x78], 0xe2d6f228
xor eax, eax
mov word [rbp - 0x74], ax
nop word [rax + rax]
movzx ecx, word [rsp + rax*2 + 0x50]
movzx edx, byte [rsp + rax + 0x30]
add dx, cx
mov word [rsp + rax*2 + 0x50], dx
mov byte [rsp + rax + 0x30], r14b
inc rax
cmp rax, 0x1e
jb 0x1401974b3
xor r8d, r8d
lea rdx, [rsp + 0x50]
xchg rdx, rbx
mov rcx, rdx
xchg rdx, rbx
call fcn.1401997c0
xchg rdi, rax
mov rax, rdi
xchg rdi, rax
mov rcx, r14
nop word [rax + rax]
mov byte [rsp + rcx + 0x50], 0x50
sub byte [rsp + rcx + 0x50], 0x11
xor byte [rsp + rcx + 0x50], 0x5a
sub byte [rsp + rcx + 0x50], 0x4f
add byte [rsp + rcx + 0x50], 0x49
sub byte [rsp + rcx + 0x50], 0x5f
inc rcx
cmp rcx, 0x3c
jb 0x140197501
xchg rbx, r14
mov qword [rsp + 0x28], rbx
xchg r14, rbx
mov byte [rsp + 0x20], 0x36
sub byte [rsp + 0x20], 0xb
add byte [rsp + 0x20], 0x24
xor byte [rsp + 0x20], 0x73
add byte [rsp + 0x20], 0x36
sub byte [rsp + 0x20], 0x55
sub byte [rsp + 0x20], 0x1d
xor r9d, r9d
xor r8d, r8d
xchg rdx, r11
mov r11, rdi
xchg rdx, r11
xchg rbx, rcx
mov rbx, rcx
xchg rbx, rcx
call fcn.14019a920
mov qword [rbx + 8], rax
mov qword [rbp + 0x40], rdi
test rdi, rdi
je 0x1401975e4
mov dword [rsp + 0x20], 0x76237474
sub dword [rsp + 0x20], 0x445f8741
add dword [rsp + 0x20], 0x2cecf220
add dword [rsp + 0x20], 0x176361b6
sub dword [rsp + 0x20], 0x46a374be
add dword [rsp + 0x20], 0x12d72fff
sub dword [rsp + 0x20], 0x21c90f7
xor dword [rsp + 0x20], 0x4bb648f
sub dword [rsp + 0x20], 0x448f8fdc
xor r9d, r9d
lea r8, [rbp + 0x40]
lea rdx, [r9 - 1]
lea rcx, [rbx + 0x70]
call fcn.140197960
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x28], r12
lea rax, [rbp - 0x30]
xchg r12, rax
mov qword [rbp + 8], r12
xchg r12, rax
lea r9, [rbp - 0x30]
xor r8d, r8d
xchg r11, rdx
mov r11, qword [rbx + 8]
xchg r11, rdx
mov rcx, rbx
call fcn.140198a70
xchg rdx, rax
mov rdx, rbx
xchg rdx, rax
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
nop
add rsp, 8
xchg qword [rsp - 8], r15
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
add rsp, 8
xchg qword [rsp - 8], r12
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret