Function at 0x140196950
Capabilities:
Access peb ldr_data
Encode data using xor

Disassembly:
xchg rsi, rbx
mov qword [rsp + 0x18], rsi
xchg rbx, rsi
mov qword [rsp + 0x20], rsi
push rbp
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r12
push r14
nop
sub rsp, 8
mov qword [rsp], r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
xchg r8, rbx
mov r8, rcx
xchg rbx, r8
xor r14d, r14d
mov qword [rcx + 0x10], r14
mov qword [rcx + 0x20], r14
xchg r14, rdi
mov qword [rcx + 0x30], rdi
xchg r14, rdi
mov qword [rcx + 0x40], r14
mov qword [rcx + 0x50], r14
xchg r8, r14
mov qword [rcx + 0x60], r8
xchg r14, r8
mov qword [rcx + 0x70], r14
xchg r14, r12
mov qword [rcx + 0x80], r12
xchg r14, r12
mov qword [rcx + 0x90], r14
mov qword [rcx + 0xa0], r14
xchg rbp, r14
mov qword [rcx + 0xb0], rbp
xchg r14, rbp
xchg r14, r11
mov qword [rcx + 0xc0], r11
xchg r11, r14
mov qword [rcx + 0xd0], r14
xchg r10, r14
mov qword [rcx + 0xe0], r10
xchg r14, r10
mov qword [rcx + 0xf0], r14
mov qword [rcx + 0x100], r14
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
xchg rbx, rax
mov rbx, qword [rcx + 0x18]
xchg rbx, rax
mov rcx, qword [rax + 0x20]
mov rax, qword [rcx]
xchg rdx, r9
mov r9, qword [rax + 0x20]
xchg rdx, r9
xchg rdx, r12
mov qword [rbx], r12
xchg r12, rdx
lea r15, [0x140003e38]
mov qword [rbp - 0x70], r15
lea r12, [0x140198820]
mov qword [rbp - 0x68], r12
lea rax, [rbp - 0x70]
mov qword [rbp - 0x38], rax
lea r9, [rbp - 0x70]
xor r8d, r8d
xchg rcx, rbx
mov rbx, rcx
xchg rbx, rcx
call fcn.140198570
mov dword [rsp + 0x30], 0x481bea88
add dword [rsp + 0x30], 0x1daf1dd8
xor dword [rsp + 0x30], 0x5b921b9c
xor dword [rsp + 0x30], 0x2beb84c8
add dword [rsp + 0x30], 0x1079f389
xor dword [rsp + 0x30], 0xd0da7c4b
mov dword [rsp + 0x50], 0x270a37d7
sub dword [rsp + 0x50], 0xb7daaa3
add dword [rsp + 0x50], 0x1de52f6e
xor dword [rsp + 0x50], 0xdb63782
sub dword [rsp + 0x50], 0x155e0312
xor dword [rsp + 0x50], 0xe0347768
mov dword [rsp + 0x54], 0x10c242eb
add dword [rsp + 0x54], 0x2d4edfb7
sub dword [rsp + 0x54], 0x162096d8
xor dword [rsp + 0x54], 0x72027853
sub dword [rsp + 0x54], 0xa307d3
xor dword [rsp + 0x54], 0x7f286c44
add dword [rsp + 0x54], 0xd5167801
mov dword [rsp + 0x34], 0x4f0870ff
add dword [rsp + 0x34], 0x3050189e
sub dword [rsp + 0x34], 0x1bf3a78e
sub dword [rsp + 0x34], 0x33a321cc
add dword [rsp + 0x34], 0x467dcfd3
xor dword [rsp + 0x34], 0x49b25655
sub dword [rsp + 0x34], 0x269d380b
add dword [rsp + 0x34], 0xde0668be
mov dword [rsp + 0x58], 0x7241f8f2
sub dword [rsp + 0x58], 0x6638e85c
xor dword [rsp + 0x58], 0x694c0974
sub dword [rsp + 0x58], 0x556c4ff1
add dword [rsp + 0x58], 0x45c691d5
xor dword [rsp + 0x58], 0xf1246e9
xor dword [rsp + 0x58], 0x74a1b10
add dword [rsp + 0x58], 0xa1a8f93f
mov dword [rsp + 0x5c], 0x5e6af18a
add dword [rsp + 0x5c], 0xdbb0b4f
xor dword [rsp + 0x5c], 0x5bd7b226
add dword [rsp + 0x5c], 0x41f7aa86
sub dword [rsp + 0x5c], 0x55ab2b54
sub dword [rsp + 0x5c], 0xfd5f06c
add dword [rsp + 0x5c], 0x5b763a72
sub dword [rsp + 0x5c], 0x1f9ad14e
xor dword [rsp + 0x5c], 0xaf18b99e
mov dword [rsp + 0x38], 0x2a055380
xor dword [rsp + 0x38], 0x55c1606c
sub dword [rsp + 0x38], 0x2bf87f94
add dword [rsp + 0x38], 0x1ffec4fc
xor dword [rsp + 0x38], 0x5f05a3de
add dword [rsp + 0x38], 0xca271c6c
mov dword [rsp + 0x60], 0x14bfacd7
add dword [rsp + 0x60], 0x4be3d9db
add dword [rsp + 0x60], 0x1aba8bd0
xor dword [rsp + 0x60], 0x3dceb017
xor dword [rsp + 0x60], 0x21542634
xor dword [rsp + 0x60], 0x175ab1bf
xor dword [rsp + 0x60], 0x6673a5e7
add dword [rsp + 0x60], 0xe88c6e80
mov dword [rsp + 0x64], 0x183ebd8e
add dword [rsp + 0x64], 0x13bac8ec
xor dword [rsp + 0x64], 0x28fdf42b
xor dword [rsp + 0x64], 0x57aaea54
sub dword [rsp + 0x64], 0xa4c1408
add dword [rsp + 0x64], 0xb5047b81
mov dword [rsp + 0x3c], 0x1166a6a7
add dword [rsp + 0x3c], 0x51addf39
sub dword [rsp + 0x3c], 0x2d880b35
add dword [rsp + 0x3c], 0x3e21f1d1
add dword [rsp + 0x3c], 0x5cb39b
sub dword [rsp + 0x3c], 0x555e2e8b
add dword [rsp + 0x3c], 0xd84a056a
mov dword [rsp + 0x68], 0x6a7777b4
xor dword [rsp + 0x68], 0x36ff996f
xor dword [rsp + 0x68], 0x3c1cb3d2
xor dword [rsp + 0x68], 0x4b9f3b98
xor dword [rsp + 0x68], 0x74a0a1a5
add dword [rsp + 0x68], 0x9fd83849
mov dword [rsp + 0x6c], 0x26b259e8
xor dword [rsp + 0x6c], 0x1c2d884e
add dword [rsp + 0x6c], 0x4163da10
sub dword [rsp + 0x6c], 0x71af66ab
add dword [rsp + 0x6c], 0x3c3aa404
sub dword [rsp + 0x6c], 0x22fd193b
add dword [rsp + 0x6c], 0xdbed2fa9
mov dword [rsp + 0x40], 0x5b7b1d17
sub dword [rsp + 0x40], 0x1bc75b63
sub dword [rsp + 0x40], 0x8e652bf
add dword [rsp + 0x40], 0x43d8e1ca
sub dword [rsp + 0x40], 0x1a7c4cfb
add dword [rsp + 0x40], 0x9995600
add dword [rsp + 0x40], 0x6acce85
add dword [rsp + 0x40], 0x8686cead
mov dword [rsp + 0x70], 0x643415a7
add dword [rsp + 0x70], 0xa04e275
xor dword [rsp + 0x70], 0x2085b4d0
sub dword [rsp + 0x70], 0x2159b0bb
add dword [rsp + 0x70], 0x152d28f4
xor dword [rsp + 0x70], 0x53fb7055
add dword [rsp + 0x70], 0x321c2919
xor dword [rsp + 0x70], 0xe645489
add dword [rsp + 0x70], 0xb194748f
mov dword [rsp + 0x74], 0x66f9d37d
sub dword [rsp + 0x74], 0xa541b01
add dword [rsp + 0x74], 0x213b3e02
sub dword [rsp + 0x74], 0x3f979c29
add dword [rsp + 0x74], 0x33d454e9
add dword [rsp + 0x74], 0x8d1f4fff
mov dword [rsp + 0x44], 0x7c473afc
sub dword [rsp + 0x44], 0x4a903059
add dword [rsp + 0x44], 0xe50adf5
sub dword [rsp + 0x44], 0x18111d20
sub dword [rsp + 0x44], 0x1d2a1b88
add dword [rsp + 0x44], 0x6a454b6c
sub dword [rsp + 0x44], 0x3a7b0448
sub dword [rsp + 0x44], 0x7222aa1
add dword [rsp + 0x44], 0xc3825a83
mov dword [rsp + 0x78], 0x8ebc05e
xor dword [rsp + 0x78], 0x570ea1a1
xor dword [rsp + 0x78], 0x7fc5d507
xor dword [rsp + 0x78], 0x666e9dab
add dword [rsp + 0x78], 0xe6c025e
xor dword [rsp + 0x78], 0x2a196c4b
add dword [rsp + 0x78], 0x80d5b76c
mov dword [rsp + 0x7c], 0x414f92b1
sub dword [rsp + 0x7c], 0x4081f8f4
xor dword [rsp + 0x7c], 0x6f9c9d36
xor dword [rsp + 0x7c], 0x7038795c
sub dword [rsp + 0x7c], 0x155280ea
add dword [rsp + 0x7c], 0xf5580291
mov dword [rsp + 0x48], 0x1c32f5ff
add dword [rsp + 0x48], 0x165940da
add dword [rsp + 0x48], 0x34bf04
add dword [rsp + 0x48], 0xda33907
xor dword [rsp + 0x48], 0x2f876151
xor dword [rsp + 0x48], 0x43c553b9
xor dword [rsp + 0x48], 0x5a3aa5a5
xor dword [rsp + 0x48], 0x7eaac76
add dword [rsp + 0x48], 0x8500e117
mov dword [rbp - 0x80], 0x5924a8ed
sub dword [rbp - 0x80], 0x49d12065
xor dword [rbp - 0x80], 0x2af03f84
xor dword [rbp - 0x80], 0x61ee01c4
sub dword [rbp - 0x80], 0x41977553
xor dword [rbp - 0x80], 0x4ce3bc1e
add dword [rbp - 0x80], 0xb121020b
mov dword [rbp - 0x7c], 0x24ff5a23
xor dword [rbp - 0x7c], 0x37fa6a0b
sub dword [rbp - 0x7c], 0x457f35c
sub dword [rbp - 0x7c], 0x90ccbe5
add dword [rbp - 0x7c], 0x120520f3
add dword [rbp - 0x7c], 0x201396b6
xor dword [rbp - 0x7c], 0x11cedacd
add dword [rbp - 0x7c], 0xd8f70cdb
mov word [rsp + 0x4c], 0x7797
sub word [rsp + 0x4c], 0x514d
xor word [rsp + 0x4c], 0x98
sub word [rsp + 0x4c], 0x1a47
add word [rsp + 0x4c], 0x4453
sub word [rsp + 0x4c], 0x251c
add word [rsp + 0x4c], 0x401c
add word [rsp + 0x4c], 0x8b18
mov dword [rbp - 0x78], 0x27613ac9
xor dword [rbp - 0x78], 0x1e243d15
sub dword [rbp - 0x78], 0x347ffd19
sub dword [rbp - 0x78], 0x573fc4
add dword [rbp - 0x78], 0x29e54d37
add dword [rbp - 0x78], 0xd123e740
xor eax, eax
mov word [rbp - 0x74], ax
nop word [rax + rax]
movzx ecx, word [rsp + rax*2 + 0x50]
movzx edx, byte [rsp + rax + 0x30]
add dx, cx
mov word [rsp + rax*2 + 0x50], dx
mov byte [rsp + rax + 0x30], r14b
inc rax
cmp rax, 0x1e
jb 0x140196fa4
xor r8d, r8d
lea rdx, [rsp + 0x50]
xchg rdi, rcx
mov rdi, rbx
xchg rcx, rdi
call fcn.140199290
xchg rdi, rcx
mov rcx, rax
xchg rcx, rdi
xchg r15, rcx
mov r15, r14
xchg rcx, r15
nop word [rax + rax]
mov byte [rsp + rcx + 0x50], 0xe
xor byte [rsp + rcx + 0x50], 0xf
add byte [rsp + rcx + 0x50], 0x1c
add byte [rsp + rcx + 0x50], 0x18
xor byte [rsp + rcx + 0x50], 0x34
add byte [rsp + rcx + 0x50], 0x44
sub byte [rsp + rcx + 0x50], 0x45
inc rcx
cmp rcx, 0x3c
jb 0x140196ffa
xchg r14, rcx
mov qword [rsp + 0x28], rcx
xchg r14, rcx
mov byte [rsp + 0x20], 0x1c
xor byte [rsp + 0x20], 0x64
add byte [rsp + 0x20], 2
xor byte [rsp + 0x20], 0xa
sub byte [rsp + 0x20], 0x49
xor byte [rsp + 0x20], 0x4d
add byte [rsp + 0x20], 0
sub byte [rsp + 0x20], 0x6a
xor r9d, r9d
xor r8d, r8d
xchg rdx, rdi
mov rdi, rdx
xchg rdx, rdi
xchg r13, rcx
mov r13, rbx
xchg rcx, r13
call fcn.14019a400
xchg r15, rax
mov qword [rbx + 8], r15
xchg r15, rax
mov qword [rbp + 0x40], rdi
test rdi, rdi
je 0x1401970db
mov dword [rsp + 0x20], 0x5e8a8652
add dword [rsp + 0x20], 0x1c2ba44f
sub dword [rsp + 0x20], 0x5ad1287d
sub dword [rsp + 0x20], 0x18719803
add dword [rsp + 0x20], 0xcd1fd6d
add dword [rsp + 0x20], 0x5dca03e0
sub dword [rsp + 0x20], 0x720eeb6e
xor r9d, r9d
lea r8, [rbp + 0x40]
lea rdx, [r9 - 1]
lea rcx, [rbx + 0x70]
call fcn.140197480
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x28], r12
lea rax, [rbp - 0x30]
mov qword [rbp + 8], rax
lea r9, [rbp - 0x30]
xor r8d, r8d
xchg r13, rdx
mov r13, qword [rbx + 8]
xchg r13, rdx
xchg rsi, rcx
mov rsi, rbx
xchg rsi, rcx
call fcn.140198570
xchg rbx, rax
mov rbx, rax
xchg rbx, rax
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
push rax
xchg qword [rsp + 8], r15
add rsp, 0x10
nop
add rsp, 8
xchg qword [rsp - 8], r14
nop
add rsp, 8
mov r12, qword [rsp - 8]
push rcx
push rdx
push rdx
push rdx
push rcx
push rbx
push rbx
xchg qword [rsp + 0x38], rdi
pop rbx
pop rbx
pop rcx
pop rdx
pop rdx
pop rdx
pop rcx
add rsp, 8
push rax
push rbx
push rcx
push rbx
push rbx
xchg qword [rsp + 0x28], rbp
add rsp, 0x30
nop
add rsp, 8
jmp qword [rsp - 8]