Function at 0x140197010
Capabilities:
Access peb ldr_data
Encode data using xor

Disassembly:
xchg rbx, r15
mov qword [rsp + 0x18], r15
xchg r15, rbx
mov qword [rsp + 0x20], rsi
nop
mov qword [rsp - 8], rbp
sub rsp, 8
push rdi
push r12
nop
sub rsp, 8
mov qword [rsp], r14
push r9
mov qword [rsp], r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
xchg rcx, rbx
mov rcx, rbx
xchg rbx, rcx
xor r14d, r14d
xchg r14, r12
mov qword [rcx + 0x10], r12
xchg r12, r14
mov qword [rcx + 0x20], r14
mov qword [rcx + 0x30], r14
mov qword [rcx + 0x40], r14
xchg r14, r11
mov qword [rcx + 0x50], r11
xchg r14, r11
mov qword [rcx + 0x60], r14
xchg r14, r10
mov qword [rcx + 0x70], r10
xchg r14, r10
mov qword [rcx + 0x80], r14
mov qword [rcx + 0x90], r14
mov qword [rcx + 0xa0], r14
mov qword [rcx + 0xb0], r14
mov qword [rcx + 0xc0], r14
xchg r11, r14
mov qword [rcx + 0xd0], r11
xchg r11, r14
xchg rsi, r14
mov qword [rcx + 0xe0], rsi
xchg r14, rsi
xchg r10, r14
mov qword [rcx + 0xf0], r10
xchg r14, r10
xchg r14, rdx
mov qword [rcx + 0x100], rdx
xchg r14, rdx
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
xchg r14, rax
mov r14, qword [rcx + 0x18]
xchg r14, rax
mov rcx, qword [rax + 0x20]
mov rax, qword [rcx]
xchg rdx, rbp
mov rbp, qword [rax + 0x20]
xchg rdx, rbp
mov qword [rbx], rdx
lea r15, [0x140003e38]
xchg r15, rdx
mov qword [rbp - 0x70], rdx
xchg r15, rdx
lea r12, [0x140198ea0]
xchg r12, r8
mov qword [rbp - 0x68], r8
xchg r12, r8
lea rax, [rbp - 0x70]
mov qword [rbp - 0x38], rax
lea r9, [rbp - 0x70]
xor r8d, r8d
xchg rbx, rcx
mov rbx, rcx
xchg rcx, rbx
call fcn.140198be0
mov dword [rsp + 0x30], 0x78d9aae4
xor dword [rsp + 0x30], 0x788a97fe
xor dword [rsp + 0x30], 0x2bd1494
add dword [rsp + 0x30], 0x34efe71d
xor dword [rsp + 0x30], 0x30c17575
add dword [rsp + 0x30], 0x57abb44b
xor dword [rsp + 0x30], 0xa83decdf
mov dword [rsp + 0x50], 0xed1b66f
xor dword [rsp + 0x50], 0x29e53697
xor dword [rsp + 0x50], 0x4993db50
xor dword [rsp + 0x50], 0x712d61d1
add dword [rsp + 0x50], 0x4b662126
sub dword [rsp + 0x50], 0x4dcb46d
add dword [rsp + 0x50], 0x994a5834
mov dword [rsp + 0x54], 0x1a69b7db
add dword [rsp + 0x54], 0x4c57732b
add dword [rsp + 0x54], 0x75e5f38
sub dword [rsp + 0x54], 0x5197c7a7
xor dword [rsp + 0x54], 0x25efdcf3
sub dword [rsp + 0x54], 0xeafc366
add dword [rsp + 0x54], 0xe7ff768
xor dword [rsp + 0x54], 0x8adacbb
xor dword [rsp + 0x54], 0xcee8015e
mov dword [rsp + 0x34], 0x4c193974
add dword [rsp + 0x34], 0x15e4de56
add dword [rsp + 0x34], 0x19108ed8
sub dword [rsp + 0x34], 0x251f0384
sub dword [rsp + 0x34], 0x50d280e
add dword [rsp + 0x34], 0x2eb31101
add dword [rsp + 0x34], 0x77616ae5
mov dword [rsp + 0x58], 0x1b357b35
sub dword [rsp + 0x58], 0x1669688d
xor dword [rsp + 0x58], 0x56819aba
sub dword [rsp + 0x58], 0x307d2fca
xor dword [rsp + 0x58], 0x261bf93e
xor dword [rsp + 0x58], 0x24174625
xor dword [rsp + 0x58], 0xdcb3182d
mov dword [rsp + 0x5c], 0x3db9aae
xor dword [rsp + 0x5c], 0x4e7469fd
add dword [rsp + 0x5c], 0x5294ac6
sub dword [rsp + 0x5c], 0x50ea5d1b
add dword [rsp + 0x5c], 0x27ec6b1e
xor dword [rsp + 0x5c], 0xd687b36b
mov dword [rsp + 0x38], 0x337212d8
sub dword [rsp + 0x38], 0x24ea4099
add dword [rsp + 0x38], 0x525373c9
sub dword [rsp + 0x38], 0x556adf94
sub dword [rsp + 0x38], 0x1403e4b
add dword [rsp + 0x38], 0x42795966
add dword [rsp + 0x38], 0xaa4d7567
mov dword [rsp + 0x60], 0x2fb9af2d
xor dword [rsp + 0x60], 0x546d330b
add dword [rsp + 0x60], 0x305e132
xor dword [rsp + 0x60], 0x1e03aba0
sub dword [rsp + 0x60], 0x1498ceb9
sub dword [rsp + 0x60], 0x3f730545
xor dword [rsp + 0x60], 0xd0b17a6
add dword [rsp + 0x60], 0xfdb4ea1d
mov dword [rsp + 0x64], 0x727d62a
add dword [rsp + 0x64], 0x58308d4b
sub dword [rsp + 0x64], 0x3cc19b60
add dword [rsp + 0x64], 0x2f548d73
xor dword [rsp + 0x64], 0x52452a48
xor dword [rsp + 0x64], 0x1513798c
add dword [rsp + 0x64], 0x2cc87e6d
sub dword [rsp + 0x64], 0x3aa847f7
add dword [rsp + 0x64], 0xf689c2bc
mov dword [rsp + 0x3c], 0x5caacd51
sub dword [rsp + 0x3c], 0x2422f33c
sub dword [rsp + 0x3c], 0xfacec26
xor dword [rsp + 0x3c], 0x2acc8308
add dword [rsp + 0x3c], 0x54d1fb3b
xor dword [rsp + 0x3c], 0x72df0550
sub dword [rsp + 0x3c], 0x20224ead
add dword [rsp + 0x3c], 0xf2e1d631
mov dword [rsp + 0x68], 0x30c363a9
add dword [rsp + 0x68], 0x111579b5
sub dword [rsp + 0x68], 0x1efb5e3f
xor dword [rsp + 0x68], 0x324698fb
xor dword [rsp + 0x68], 0x42bfaf
add dword [rsp + 0x68], 0xeeaaa732
mov dword [rsp + 0x6c], 0x1a7a20b5
xor dword [rsp + 0x6c], 0x6076b24a
sub dword [rsp + 0x6c], 0x7685e5ad
add dword [rsp + 0x6c], 0x73497f15
xor dword [rsp + 0x6c], 0x45cdb9de
xor dword [rsp + 0x6c], 0x512a34a3
sub dword [rsp + 0x6c], 0x4edd1ea2
add dword [rsp + 0x6c], 0xec247d05
mov dword [rsp + 0x40], 0x6e2dbfb7
sub dword [rsp + 0x40], 0x6770503f
add dword [rsp + 0x40], 0x19ba031d
add dword [rsp + 0x40], 0x5957988
xor dword [rsp + 0x40], 0x6d4a29b6
sub dword [rsp + 0x40], 0x4310b524
xor dword [rsp + 0x40], 0xfec0e671
mov dword [rsp + 0x70], 0x7c8bf667
xor dword [rsp + 0x70], 0x5ae1df13
add dword [rsp + 0x70], 0x524a0a
xor dword [rsp + 0x70], 0x56a12f1
xor dword [rsp + 0x70], 0x1f40435
add dword [rsp + 0x70], 0xdd5599b5
mov dword [rsp + 0x74], 0x552ac23c
xor dword [rsp + 0x74], 0x4928c2ed
add dword [rsp + 0x74], 0x5f49bf7f
sub dword [rsp + 0x74], 0x4d5658a5
sub dword [rsp + 0x74], 0x2124035a
xor dword [rsp + 0x74], 0xf3ed9b6c
mov dword [rsp + 0x44], 0x3da4a50d
sub dword [rsp + 0x44], 0x9d5b767
xor dword [rsp + 0x44], 0x1d0cc785
add dword [rsp + 0x44], 0x46debb4c
sub dword [rsp + 0x44], 0x1b507244
sub dword [rsp + 0x44], 0x41f11f16
add dword [rsp + 0x44], 0x2cbd2f9b
sub dword [rsp + 0x44], 0x33c78fe5
add dword [rsp + 0x44], 0xe5a2032b
mov dword [rsp + 0x78], 0x27b3ca1f
sub dword [rsp + 0x78], 0x1dd7c146
xor dword [rsp + 0x78], 0x4511eca0
sub dword [rsp + 0x78], 0x46411b94
xor dword [rsp + 0x78], 0x22fe888f
xor dword [rsp + 0x78], 0x697f19f6
xor dword [rsp + 0x78], 0x1230eb65
add dword [rsp + 0x78], 0xa03b4c6d
mov dword [rsp + 0x7c], 0x7e3df87
add dword [rsp + 0x7c], 0x20e00f1c
add dword [rsp + 0x7c], 0xf9f25f5
xor dword [rsp + 0x7c], 0x34f0e6fc
xor dword [rsp + 0x7c], 0x5edf293b
sub dword [rsp + 0x7c], 0x46b25af3
xor dword [rsp + 0x7c], 0xf4f47f12
mov dword [rsp + 0x48], 0x5db1ae7b
add dword [rsp + 0x48], 0x8ee8d1c
sub dword [rsp + 0x48], 0x4c1f05c1
sub dword [rsp + 0x48], 0x1560c89
add dword [rsp + 0x48], 0x34cb37bb
xor dword [rsp + 0x48], 0x7b8cd34e
sub dword [rsp + 0x48], 0x5d788eb
add dword [rsp + 0x48], 0xc653cd9b
mov dword [rbp - 0x80], 0x4b578fa8
xor dword [rbp - 0x80], 0x3c1d7ee3
add dword [rbp - 0x80], 0x3d5ea98
sub dword [rbp - 0x80], 0x1c96d871
add dword [rbp - 0x80], 0x8c25fa4
sub dword [rbp - 0x80], 0x55d2325c
add dword [rbp - 0x80], 0x273886d7
add dword [rbp - 0x80], 0xc6c447e5
mov dword [rbp - 0x7c], 0x60b9f55b
xor dword [rbp - 0x7c], 0x6d6f499f
xor dword [rbp - 0x7c], 0x5e259d3
xor dword [rbp - 0x7c], 0x3ddd73f9
xor dword [rbp - 0x7c], 0x437f4452
add dword [rbp - 0x7c], 0x88d82c7c
mov word [rsp + 0x4c], 0x6816
sub word [rsp + 0x4c], 0x4ec4
add word [rsp + 0x4c], 0x51df
sub word [rsp + 0x4c], 0x119
xor word [rsp + 0x4c], 0xd09
sub word [rsp + 0x4c], 0x1027
xor word [rsp + 0x4c], 0x2bae
add word [rsp + 0x4c], 0x79b2
mov dword [rbp - 0x78], 0x5e5306f9
xor dword [rbp - 0x78], 0x5d20f744
add dword [rbp - 0x78], 0x480ae9b6
add dword [rbp - 0x78], 0x1e63b61b
sub dword [rbp - 0x78], 0x683ec4d9
xor dword [rbp - 0x78], 0x418d2148
sub dword [rbp - 0x78], 0x1bd192a
add dword [rbp - 0x78], 0xc1052aa3
xor eax, eax
mov word [rbp - 0x74], ax
nop word [rax + rax]
movzx ecx, word [rsp + rax*2 + 0x50]
movzx edx, byte [rsp + rax + 0x30]
add dx, cx
mov word [rsp + rax*2 + 0x50], dx
mov byte [rsp + rax + 0x30], r14b
inc rax
cmp rax, 0x1e
jb 0x140197684
xor r8d, r8d
lea rdx, [rsp + 0x50]
xchg r10, rbx
mov rcx, r10
xchg rbx, r10
call fcn.1401998e0
xchg r10, rdi
mov r10, rax
xchg rdi, r10
xchg r14, r13
mov rcx, r13
xchg r13, r14
nop word [rax + rax]
mov byte [rsp + rcx + 0x50], 0x2c
xor byte [rsp + rcx + 0x50], 0x19
xor byte [rsp + rcx + 0x50], 0x5b
sub byte [rsp + rcx + 0x50], 0x18
add byte [rsp + rcx + 0x50], 8
sub byte [rsp + rcx + 0x50], 0x2b
add byte [rsp + rcx + 0x50], 1
sub byte [rsp + rcx + 0x50], 0x34
inc rcx
cmp rcx, 0x3c
jb 0x1401976da
mov qword [rsp + 0x28], r14
mov byte [rsp + 0x20], 0x2f
add byte [rsp + 0x20], 0xb
add byte [rsp + 0x20], 0x13
add byte [rsp + 0x20], 0x23
add byte [rsp + 0x20], 0xc
xor byte [rsp + 0x20], 0x63
add byte [rsp + 0x20], 0x35
sub byte [rsp + 0x20], 0x54
xor r9d, r9d
xor r8d, r8d
xchg r8, rdi
mov rdx, r8
xchg rdi, r8
mov rcx, rbx
call fcn.14019a9c0
mov qword [rbx + 8], rax
xchg rdi, r8
mov qword [rbp + 0x40], r8
xchg r8, rdi
test rdi, rdi
je 0x1401977ae
mov dword [rsp + 0x20], 0x7cbf4813
sub dword [rsp + 0x20], 0x2cdb4271
sub dword [rsp + 0x20], 0x1e387f3c
add dword [rsp + 0x20], 0x2b93ed7a
xor dword [rsp + 0x20], 0x1fcf63ae
sub dword [rsp + 0x20], 0x42ef904e
xor r9d, r9d
lea r8, [rbp + 0x40]
lea rdx, [r9 - 1]
lea rcx, [rbx + 0x70]
call fcn.140197b20
xchg r15, r11
mov qword [rbp - 0x30], r11
xchg r15, r11
xchg r8, r12
mov qword [rbp - 0x28], r8
xchg r12, r8
lea rax, [rbp - 0x30]
xchg rbx, rax
mov qword [rbp + 8], rbx
xchg rbx, rax
lea r9, [rbp - 0x30]
xor r8d, r8d
mov rdx, qword [rbx + 8]
xchg rbx, rcx
mov rbx, rcx
xchg rbx, rcx
call fcn.140198be0
xchg rbp, rax
mov rbp, rbx
xchg rbp, rax
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
push rax
push rdx
xchg qword [rsp + 0x10], r15
add rsp, 0x18
push rcx
push rax
push rbx
push rbx
push rcx
push rdx
xchg qword [rsp + 0x30], r14
add rsp, 0x38
nop
add rsp, 8
mov r12, qword [rsp - 8]
nop
xchg qword [rsp], rdi
add rsp, 8
push rdx
push rdx
push rax
xchg qword [rsp + 0x18], rbp
pop rax
pop rdx
pop rdx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]