Function at 0x140196540
Capabilities:
Access peb ldr_data
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
xchg rsi, r12
mov qword [rsp + 0x20], r12
xchg r12, rsi
nop
sub rsp, 8
mov qword [rsp], rbp
nop
sub rsp, 8
mov qword [rsp], rdi
push r12
nop
sub rsp, 8
mov qword [rsp], r14
nop
mov qword [rsp - 8], r15
sub rsp, 8
lea rbp, [rsp - 0x10]
sub rsp, 0x110
xchg r12, rbx
mov r12, rcx
xchg rbx, r12
xor r14d, r14d
mov qword [rcx + 0x10], r14
mov qword [rcx + 0x20], r14
mov qword [rcx + 0x30], r14
xchg r14, r11
mov qword [rcx + 0x40], r11
xchg r11, r14
mov qword [rcx + 0x50], r14
mov qword [rcx + 0x60], r14
xchg r8, r14
mov qword [rcx + 0x70], r8
xchg r14, r8
xchg r14, rsi
mov qword [rcx + 0x80], rsi
xchg r14, rsi
mov qword [rcx + 0x90], r14
xchg r14, rdi
mov qword [rcx + 0xa0], rdi
xchg r14, rdi
xchg rdi, r14
mov qword [rcx + 0xb0], rdi
xchg rdi, r14
mov qword [rcx + 0xc0], r14
xchg r14, rsi
mov qword [rcx + 0xd0], rsi
xchg r14, rsi
mov qword [rcx + 0xe0], r14
mov qword [rcx + 0xf0], r14
xchg rbp, r14
mov qword [rcx + 0x100], rbp
xchg r14, rbp
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x18]
xchg r8, rcx
mov r8, qword [rax + 0x20]
xchg rcx, r8
mov rax, qword [rcx]
mov rdx, qword [rax + 0x20]
xchg rdx, r9
mov qword [rbx], r9
xchg rdx, r9
lea r15, [0x140003e38]
xchg r15, rbx
mov qword [rbp - 0x70], rbx
xchg r15, rbx
lea r12, [0x140198390]
mov qword [rbp - 0x68], r12
lea rax, [rbp - 0x70]
xchg r14, rax
mov qword [rbp - 0x38], r14
xchg r14, rax
lea r9, [rbp - 0x70]
xor r8d, r8d
xchg rbp, rcx
mov rbp, rbx
xchg rcx, rbp
call fcn.1401980f0
mov dword [rsp + 0x30], 0x45576774
add dword [rsp + 0x30], 0x16a81962
xor dword [rsp + 0x30], 0x3eccd59b
xor dword [rsp + 0x30], 0x235a7787
sub dword [rsp + 0x30], 0x4609bcd0
add dword [rsp + 0x30], 0xf69790fc
mov dword [rsp + 0x50], 0x19d98de1
add dword [rsp + 0x50], 0x1e48c0bf
sub dword [rsp + 0x50], 0x8dc0f76
add dword [rsp + 0x50], 0x6e73a5e
add dword [rsp + 0x50], 0x2fe7cfe8
add dword [rsp + 0x50], 0x9948b5f6
mov dword [rsp + 0x54], 0x1ca98297
sub dword [rsp + 0x54], 0xda510b
add dword [rsp + 0x54], 0x3d9dc0bc
add dword [rsp + 0x54], 0x55d88b9
xor dword [rsp + 0x54], 0x44d1d22c
add dword [rsp + 0x54], 0x4f480997
add dword [rsp + 0x54], 0x961a4cbf
mov dword [rsp + 0x34], 0x2e4318f3
add dword [rsp + 0x34], 0x90417a2
add dword [rsp + 0x34], 0x1d07c1fa
sub dword [rsp + 0x34], 0x98f94a8
add dword [rsp + 0x34], 0x1f8f9c87
add dword [rsp + 0x34], 0x8ca7fc88
mov dword [rsp + 0x58], 0x54de592a
xor dword [rsp + 0x58], 0x292da347
sub dword [rsp + 0x58], 0x48952aca
xor dword [rsp + 0x58], 0xb93c1bd
add dword [rsp + 0x58], 0x2d768849
sub dword [rsp + 0x58], 0x39813644
add dword [rsp + 0x58], 0xccad9f5b
mov dword [rsp + 0x5c], 0x6c0a0d03
sub dword [rsp + 0x5c], 0x30f05c88
sub dword [rsp + 0x5c], 0x9a9bc99
add dword [rsp + 0x5c], 0x202770b0
sub dword [rsp + 0x5c], 0x17778373
add dword [rsp + 0x5c], 0xc53d1e58
mov dword [rsp + 0x38], 0x4a1597c4
sub dword [rsp + 0x38], 0x1f18e2d0
add dword [rsp + 0x38], 0x2ffbb7ce
sub dword [rsp + 0x38], 0x2e836d6c
xor dword [rsp + 0x38], 0x4c10cbb2
sub dword [rsp + 0x38], 0x40dcbf31
xor dword [rsp + 0x38], 0x4920e0ad
sub dword [rsp + 0x38], 0x17fae47f
xor dword [rsp + 0x38], 0xc85a4669
mov dword [rsp + 0x60], 0x3ee26cf4
add dword [rsp + 0x60], 0x377587c9
xor dword [rsp + 0x60], 0x69702717
add dword [rsp + 0x60], 0x2ea491a7
add dword [rsp + 0x60], 0x159050dc
xor dword [rsp + 0x60], 0x24aced24
add dword [rsp + 0x60], 0xb789a470
mov dword [rsp + 0x64], 0x352fb3a8
sub dword [rsp + 0x64], 0x2228388d
add dword [rsp + 0x64], 0xb0b5192
xor dword [rsp + 0x64], 0x557d73e5
add dword [rsp + 0x64], 0x1622c4db
add dword [rsp + 0x64], 0x9dd47b5b
mov dword [rsp + 0x3c], 0x3a0ad8a5
sub dword [rsp + 0x3c], 0x20941f9a
xor dword [rsp + 0x3c], 0x63f29a1d
sub dword [rsp + 0x3c], 0x45291949
sub dword [rsp + 0x3c], 0x333705e8
xor dword [rsp + 0x3c], 0x6c90cb5b
xor dword [rsp + 0x3c], 0x73c874f0
add dword [rsp + 0x3c], 0x327bbb8
add dword [rsp + 0x3c], 0xd6527ef0
mov dword [rsp + 0x68], 0x34e0c5fe
add dword [rsp + 0x68], 0x48e01343
xor dword [rsp + 0x68], 0x1814a1f0
xor dword [rsp + 0x68], 0x7176ac4b
xor dword [rsp + 0x68], 0x108e087d
add dword [rsp + 0x68], 0x5de12d5a
xor dword [rsp + 0x68], 0x9d8df69c
mov dword [rsp + 0x6c], 0x6a84ef08
sub dword [rsp + 0x6c], 0x45511a25
xor dword [rsp + 0x6c], 0x345960c9
add dword [rsp + 0x6c], 0x6abf8d18
xor dword [rsp + 0x6c], 0x1aa5f839
xor dword [rsp + 0x6c], 0x3bb81d21
sub dword [rsp + 0x6c], 0x12b21a6a
sub dword [rsp + 0x6c], 0x15b5bb43
xor dword [rsp + 0x6c], 0xcbb131d0
mov dword [rsp + 0x40], 0x43aef9dc
add dword [rsp + 0x40], 0x1fc0fd7d
sub dword [rsp + 0x40], 0x5ad6c3ac
xor dword [rsp + 0x40], 0x1b8865e4
add dword [rsp + 0x40], 0x57dce742
add dword [rsp + 0x40], 0x8c08b96b
mov dword [rsp + 0x70], 0x5fe7b478
xor dword [rsp + 0x70], 0x40b85d4
sub dword [rsp + 0x70], 0x4d23c440
add dword [rsp + 0x70], 0x3f320050
xor dword [rsp + 0x70], 0x653e0c17
add dword [rsp + 0x70], 0x552710b2
add dword [rsp + 0x70], 0x2e68f8
xor dword [rsp + 0x70], 0x816e243a
mov dword [rsp + 0x74], 0x358f13fb
xor dword [rsp + 0x74], 0x69e1127e
sub dword [rsp + 0x74], 0x516559e1
add dword [rsp + 0x74], 0x6ba05d69
sub dword [rsp + 0x74], 0x6e04a8c6
add dword [rsp + 0x74], 0x5e99f299
sub dword [rsp + 0x74], 0x214483c3
xor dword [rsp + 0x74], 0xbac53420
mov dword [rsp + 0x44], 0x191c65cb
add dword [rsp + 0x44], 0xe1de4d2
add dword [rsp + 0x44], 0x2e1ec6bd
add dword [rsp + 0x44], 0x201f4d32
xor dword [rsp + 0x44], 0x27c14e74
xor dword [rsp + 0x44], 0xa44fe60e
mov dword [rsp + 0x78], 0x32be2998
add dword [rsp + 0x78], 0x1ba49cc8
add dword [rsp + 0x78], 0xdbca2e5
sub dword [rsp + 0x78], 0x343d1754
add dword [rsp + 0x78], 0x46c4a23d
sub dword [rsp + 0x78], 0x143066ad
xor dword [rsp + 0x78], 0xa50e72e7
mov dword [rsp + 0x7c], 0x76c1c5ee
sub dword [rsp + 0x7c], 0x211a4d54
sub dword [rsp + 0x7c], 0x21426b2c
xor dword [rsp + 0x7c], 0x2af5e5c6
add dword [rsp + 0x7c], 0x46af898d
xor dword [rsp + 0x7c], 0x15dc6ba8
sub dword [rsp + 0x7c], 0x1fd31f16
add dword [rsp + 0x7c], 0x889a4e3
add dword [rsp + 0x7c], 0xa61c6014
mov dword [rsp + 0x48], 0x6f4c3ff4
add dword [rsp + 0x48], 0x23b2847
sub dword [rsp + 0x48], 0x12c586b2
sub dword [rsp + 0x48], 0x75c8e7b
xor dword [rsp + 0x48], 0x152774b9
xor dword [rsp + 0x48], 0x6d159d61
xor dword [rsp + 0x48], 0x3294a419
sub dword [rsp + 0x48], 0x10319997
add dword [rsp + 0x48], 0xe96571be
mov dword [rbp - 0x80], 0xe3f9cde
xor dword [rbp - 0x80], 0x7c518be2
sub dword [rbp - 0x80], 0x6bb28cc
xor dword [rbp - 0x80], 0x45ed4f3f
sub dword [rbp - 0x80], 0x20c52349
xor dword [rbp - 0x80], 0xf2ec8170
mov dword [rbp - 0x7c], 0x1fa44f51
add dword [rbp - 0x7c], 0x14b23b1b
add dword [rbp - 0x7c], 0x8b50c3f
sub dword [rbp - 0x7c], 0x2d873fe6
add dword [rbp - 0x7c], 0x615ba59b
sub dword [rbp - 0x7c], 0x461437e5
add dword [rbp - 0x7c], 0xd4a33abd
mov word [rsp + 0x4c], 0x511c
xor word [rsp + 0x4c], 0x5244
xor word [rsp + 0x4c], 0x4b9b
add word [rsp + 0x4c], 0x9da
sub word [rsp + 0x4c], 0xc44
add word [rsp + 0x4c], 0x1fd3
add word [rsp + 0x4c], 0x90ca
mov dword [rbp - 0x78], 0x2fc3c1d5
sub dword [rbp - 0x78], 0x2aa50c1f
add dword [rbp - 0x78], 0x245b1fa5
xor dword [rbp - 0x78], 0x1bf7be02
add dword [rbp - 0x78], 0x10ae1d60
add dword [rbp - 0x78], 0x10e48d90
add dword [rbp - 0x78], 0xab55e92d
xor eax, eax
mov word [rbp - 0x74], ax
nop word [rax + rax]
movzx ecx, word [rsp + rax*2 + 0x50]
movzx edx, byte [rsp + rax + 0x30]
add dx, cx
mov word [rsp + rax*2 + 0x50], dx
mov byte [rsp + rax + 0x30], r14b
inc rax
cmp rax, 0x1e
jb 0x140196b9a
xor r8d, r8d
lea rdx, [rsp + 0x50]
xchg rbx, rcx
mov rbx, rcx
xchg rbx, rcx
call fcn.140198df0
mov rdi, rax
xchg rcx, rdi
mov rdi, r14
xchg rdi, rcx
nop word [rax + rax]
mov byte [rsp + rcx + 0x50], 0x56
add byte [rsp + rcx + 0x50], 0x1e
sub byte [rsp + rcx + 0x50], 0x60
add byte [rsp + rcx + 0x50], 0x3f
xor byte [rsp + rcx + 0x50], 0xc
xor byte [rsp + rcx + 0x50], 0x5f
inc rcx
cmp rcx, 0x3c
jb 0x140196bea
xchg r11, r14
mov qword [rsp + 0x28], r11
xchg r14, r11
mov byte [rsp + 0x20], 4
add byte [rsp + 0x20], 0x3a
sub byte [rsp + 0x20], 0x30
add byte [rsp + 0x20], 0x44
xor byte [rsp + 0x20], 0x2e
sub byte [rsp + 0x20], 0x44
sub byte [rsp + 0x20], 0x38
xor r9d, r9d
xor r8d, r8d
xchg r12, rdi
mov rdx, r12
xchg rdi, r12
xchg rbx, r15
mov rcx, r15
xchg r15, rbx
call fcn.140199f80
xchg rsi, rax
mov qword [rbx + 8], rsi
xchg rsi, rax
xchg rdi, rdx
mov qword [rbp + 0x40], rdx
xchg rdi, rdx
test rdi, rdi
je 0x140196ccf
mov dword [rsp + 0x20], 0x606ac04a
sub dword [rsp + 0x20], 0x33fe1f4a
add dword [rsp + 0x20], 0x2d66ac62
add dword [rsp + 0x20], 0x8089e0
add dword [rsp + 0x20], 0x8588da1
sub dword [rsp + 0x20], 0x53f19e63
xor dword [rsp + 0x20], 0x5e85083
xor dword [rsp + 0x20], 0xb521603
xor r9d, r9d
lea r8, [rbp + 0x40]
lea rdx, [r9 - 1]
lea rcx, [rbx + 0x70]
call fcn.140197040
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x28], r12
lea rax, [rbp - 0x30]
mov qword [rbp + 8], rax
lea r9, [rbp - 0x30]
xor r8d, r8d
xchg rdx, r9
mov r9, qword [rbx + 8]
xchg rdx, r9
xchg rcx, rbx
mov rbx, rcx
xchg rbx, rcx
call fcn.1401980f0
mov rax, rbx
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
push rdx
push rdx
push rcx
push rdx
xchg qword [rsp + 0x20], r15
pop rdx
pop rcx
pop rdx
pop rdx
add rsp, 8
nop
add rsp, 8
xchg qword [rsp - 8], r14
nop
mov r12, qword [rsp]
add rsp, 8
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
xchg qword [rsp - 8], rbp
ret