Function at 0x140196a20
Capabilities:
Access peb ldr_data
Encode data using xor

Disassembly:
xchg rsi, rbx
mov qword [rsp + 0x18], rsi
xchg rsi, rbx
xchg rbx, rsi
mov qword [rsp + 0x20], rbx
xchg rbx, rsi
nop
push 0xef5a74a
mov qword [rsp], rbp
push rdi
push r11
mov qword [rsp], r12
nop
sub rsp, 8
mov qword [rsp], r14
nop
sub rsp, 8
mov qword [rsp], r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rbx, rcx
xor r14d, r14d
mov qword [rcx + 0x10], r14
mov qword [rcx + 0x20], r14
mov qword [rcx + 0x30], r14
xchg r8, r14
mov qword [rcx + 0x40], r8
xchg r14, r8
mov qword [rcx + 0x50], r14
mov qword [rcx + 0x60], r14
mov qword [rcx + 0x70], r14
xchg rbx, r14
mov qword [rcx + 0x80], rbx
xchg r14, rbx
mov qword [rcx + 0x90], r14
mov qword [rcx + 0xa0], r14
mov qword [rcx + 0xb0], r14
xchg r15, r14
mov qword [rcx + 0xc0], r15
xchg r15, r14
mov qword [rcx + 0xd0], r14
xchg r14, r10
mov qword [rcx + 0xe0], r10
xchg r10, r14
mov qword [rcx + 0xf0], r14
xchg rbp, r14
mov qword [rcx + 0x100], rbp
xchg r14, rbp
mov rax, qword gs:[0x30]
xchg rcx, r14
mov r14, qword [rax + 0x60]
xchg rcx, r14
xchg r14, rax
mov r14, qword [rcx + 0x18]
xchg r14, rax
mov rcx, qword [rax + 0x20]
xchg rdx, rax
mov rdx, qword [rcx]
xchg rdx, rax
mov rdx, qword [rax + 0x20]
mov qword [rbx], rdx
lea r15, [0x140003e38]
xchg r15, r13
mov qword [rbp - 0x70], r13
xchg r13, r15
lea r12, [0x140198880]
mov qword [rbp - 0x68], r12
lea rax, [rbp - 0x70]
xchg r12, rax
mov qword [rbp - 0x38], r12
xchg r12, rax
lea r9, [rbp - 0x70]
xor r8d, r8d
xchg rdi, rbx
mov rcx, rdi
xchg rdi, rbx
call fcn.1401985f0
mov dword [rsp + 0x30], 0x69e6660a
xor dword [rsp + 0x30], 0x2a19cfa3
sub dword [rsp + 0x30], 0xe009ab7
xor dword [rsp + 0x30], 0x5b7583f8
add dword [rsp + 0x30], 0x7c51fe6
add dword [rsp + 0x30], 0xf6bd6a
xor dword [rsp + 0x30], 0x81b09cac
mov dword [rsp + 0x50], 0x12a17190
xor dword [rsp + 0x50], 0x58b56abb
sub dword [rsp + 0x50], 0x21ac2ef4
add dword [rsp + 0x50], 0x4245b068
add dword [rsp + 0x50], 0x127ac138
add dword [rsp + 0x50], 0x8235a18f
mov dword [rsp + 0x54], 0x79b58034
sub dword [rsp + 0x54], 0x3cfee6b
sub dword [rsp + 0x54], 0x6d976e78
add dword [rsp + 0x54], 0x400d4a3b
xor dword [rsp + 0x54], 0x4d60d8cd
add dword [rsp + 0x54], 0x5cde0401
sub dword [rsp + 0x54], 0x48afcff7
add dword [rsp + 0x54], 0xe6141638
mov dword [rsp + 0x34], 0x3e181288
sub dword [rsp + 0x34], 0x1927c9ee
xor dword [rsp + 0x34], 0x3d900830
sub dword [rsp + 0x34], 0x5e418a9
add dword [rsp + 0x34], 0x115bf77b
add dword [rsp + 0x34], 0xd21ed77a
mov dword [rsp + 0x58], 0x57fb9b1a
sub dword [rsp + 0x58], 0xb290157
sub dword [rsp + 0x58], 0x4995b8d8
xor dword [rsp + 0x58], 0x427dc0b7
add dword [rsp + 0x58], 0x7c6cd29
add dword [rsp + 0x58], 0x32ad2573
add dword [rsp + 0x58], 0x83baec86
mov dword [rsp + 0x5c], 0x4a430ca4
sub dword [rsp + 0x5c], 0x2fbba97b
xor dword [rsp + 0x5c], 0x2d634db1
add dword [rsp + 0x5c], 0x3ee343cf
sub dword [rsp + 0x5c], 0x6c792391
add dword [rsp + 0x5c], 0x53fe7e63
sub dword [rsp + 0x5c], 0x7bdb0fe
sub dword [rsp + 0x5c], 0x4cedb06b
xor dword [rsp + 0x5c], 0xf6fd94a7
mov dword [rsp + 0x38], 0x6b6c149d
sub dword [rsp + 0x38], 0x9b86a40
add dword [rsp + 0x38], 0x7f36689
sub dword [rsp + 0x38], 0x25910f85
sub dword [rsp + 0x38], 0x1d582476
xor dword [rsp + 0x38], 0x657dee6
add dword [rsp + 0x38], 0xd60cf4e9
mov dword [rsp + 0x60], 0x1575dea8
add dword [rsp + 0x60], 0x32793f70
sub dword [rsp + 0x60], 0xba8d2c7
add dword [rsp + 0x60], 0x202e92bf
add dword [rsp + 0x60], 0x641a18b
xor dword [rsp + 0x60], 0xbf6d1ea
add dword [rsp + 0x60], 0xcd66c5b
sub dword [rsp + 0x60], 0x6d740250
xor dword [rsp + 0x60], 0xf7dae705
mov dword [rsp + 0x64], 0x4ed9c91f
sub dword [rsp + 0x64], 0x3bde78c4
xor dword [rsp + 0x64], 0x7533a044
sub dword [rsp + 0x64], 0x28e60b4c
xor dword [rsp + 0x64], 0x454018e6
xor dword [rsp + 0x64], 0x79d52fc9
add dword [rsp + 0x64], 0xede5920
add dword [rsp + 0x64], 0x68527259
add dword [rsp + 0x64], 0x85be6009
mov dword [rsp + 0x3c], 0x69ec5286
sub dword [rsp + 0x3c], 0x66ac8394
add dword [rsp + 0x3c], 0x70d1972b
sub dword [rsp + 0x3c], 0xeedc9ed
xor dword [rsp + 0x3c], 0x61261f73
add dword [rsp + 0x3c], 0x67a59a8
xor dword [rsp + 0x3c], 0xfc892a1d
mov dword [rsp + 0x68], 0x7fe1a24e
sub dword [rsp + 0x68], 0xa46462a
xor dword [rsp + 0x68], 0x7de17243
add dword [rsp + 0x68], 0x377a0472
sub dword [rsp + 0x68], 0x16003483
xor dword [rsp + 0x68], 0x433f5328
sub dword [rsp + 0x68], 0x119e49ef
add dword [rsp + 0x68], 0x10680f08
add dword [rsp + 0x68], 0x95ed8ce6
mov dword [rsp + 0x6c], 0x7ceb03f3
xor dword [rsp + 0x6c], 0x7962cf34
add dword [rsp + 0x6c], 0x9eb6ff9
add dword [rsp + 0x6c], 0x434d66dc
sub dword [rsp + 0x6c], 0x197d27d7
add dword [rsp + 0x6c], 0x3fb044fa
xor dword [rsp + 0x6c], 0x3bc1be2b
add dword [rsp + 0x6c], 0xbc4a80e9
mov dword [rsp + 0x40], 0x64e02c7b
xor dword [rsp + 0x40], 0x30a02f29
xor dword [rsp + 0x40], 0x16be8ed
sub dword [rsp + 0x40], 0x4a2b1083
add dword [rsp + 0x40], 0x4e1b6ca2
xor dword [rsp + 0x40], 0xafeab128
mov dword [rsp + 0x70], 0x7fa8ef33
sub dword [rsp + 0x70], 0x5a17c23
sub dword [rsp + 0x70], 0x6ec0e82f
xor dword [rsp + 0x70], 0x7f0ebc09
sub dword [rsp + 0x70], 0x698a5c60
add dword [rsp + 0x70], 0x3e9a6fe0
sub dword [rsp + 0x70], 0x1d477996
add dword [rsp + 0x70], 0x2b5096da
xor dword [rsp + 0x70], 0xa81698c3
mov dword [rsp + 0x74], 0x666256cd
sub dword [rsp + 0x74], 0x57fa32c4
add dword [rsp + 0x74], 0x573c5b0b
xor dword [rsp + 0x74], 0x65cc5828
xor dword [rsp + 0x74], 0x36c98e34
xor dword [rsp + 0x74], 0x7c0bc31d
sub dword [rsp + 0x74], 0x114df6e7
add dword [rsp + 0x74], 0xc5e08c0f
mov dword [rsp + 0x44], 0x1b25abc5
add dword [rsp + 0x44], 0x16de9930
add dword [rsp + 0x44], 0x4cc36a2a
sub dword [rsp + 0x44], 0x27c72a27
xor dword [rsp + 0x44], 0x16df2726
sub dword [rsp + 0x44], 0x300a842e
xor dword [rsp + 0x44], 0x2b600562
add dword [rsp + 0x44], 0xbc41dc24
mov dword [rsp + 0x78], 0x57dc5360
sub dword [rsp + 0x78], 0x507dc40b
add dword [rsp + 0x78], 0x77611f5e
sub dword [rsp + 0x78], 0x600bca4
sub dword [rsp + 0x78], 0x3349c1aa
add dword [rsp + 0x78], 0x7810c7d
xor dword [rsp + 0x78], 0xb38ec384
mov dword [rsp + 0x7c], 0x26098fe3
sub dword [rsp + 0x7c], 0x3984d2f
add dword [rsp + 0x7c], 0x1c5d214
add dword [rsp + 0x7c], 0x1f2202b6
add dword [rsp + 0x7c], 0x19dc29a8
add dword [rsp + 0x7c], 0xa239be58
mov dword [rsp + 0x48], 0x518365e1
sub dword [rsp + 0x48], 0x12dd60fb
xor dword [rsp + 0x48], 0x492d7c5c
sub dword [rsp + 0x48], 0x131fce0f
xor dword [rsp + 0x48], 0x543f2809
add dword [rsp + 0x48], 0xc6a27454
mov dword [rbp - 0x80], 0x2093fb1
add dword [rbp - 0x80], 0x9c81b98
xor dword [rbp - 0x80], 0x1ba08d53
xor dword [rbp - 0x80], 0x5ccfc98b
xor dword [rbp - 0x80], 0x50393356
add dword [rbp - 0x80], 0xe2efd2af
mov dword [rbp - 0x7c], 0x24aa6b76
add dword [rbp - 0x7c], 0x14a45d58
sub dword [rbp - 0x7c], 0x373a2632
add dword [rbp - 0x7c], 0x435688bd
add dword [rbp - 0x7c], 0x2b40e31
sub dword [rbp - 0x7c], 0x22cb16ef
add dword [rbp - 0x7c], 0x1d962011
sub dword [rbp - 0x7c], 0x3db4f5c4
add dword [rbp - 0x7c], 0xfa39b250
mov word [rsp + 0x4c], 0x6d08
xor word [rsp + 0x4c], 0x1c99
xor word [rsp + 0x4c], 0xa40
sub word [rsp + 0x4c], 0xd4b
xor word [rsp + 0x4c], 0x1bdd
add word [rsp + 0x4c], 0x819b
mov dword [rbp - 0x78], 0x6795df73
add dword [rbp - 0x78], 0x8cb3e69
sub dword [rbp - 0x78], 0x430d7159
add dword [rbp - 0x78], 0x106dd7b0
sub dword [rbp - 0x78], 0x1d89cb30
xor dword [rbp - 0x78], 0x3bc492c0
xor dword [rbp - 0x78], 0xe485d4b5
xor eax, eax
mov word [rbp - 0x74], ax
nop word [rax + rax]
movzx ecx, word [rsp + rax*2 + 0x50]
movzx edx, byte [rsp + rax + 0x30]
add dx, cx
mov word [rsp + rax*2 + 0x50], dx
mov byte [rsp + rax + 0x30], r14b
inc rax
cmp rax, 0x1e
jb 0x140197093
xor r8d, r8d
lea rdx, [rsp + 0x50]
xchg rbx, rdx
mov rcx, rdx
xchg rdx, rbx
call fcn.1401992e0
xchg r9, rax
mov rdi, r9
xchg r9, rax
mov rcx, r14
nop word [rax + rax]
mov byte [rsp + rcx + 0x50], 0x37
sub byte [rsp + rcx + 0x50], 6
add byte [rsp + rcx + 0x50], 0x30
sub byte [rsp + rcx + 0x50], 1
xor byte [rsp + rcx + 0x50], 0x49
sub byte [rsp + rcx + 0x50], 0x29
inc rcx
cmp rcx, 0x3c
jb 0x1401970e1
xchg rdi, r14
mov qword [rsp + 0x28], rdi
xchg r14, rdi
mov byte [rsp + 0x20], 0x18
xor byte [rsp + 0x20], 0x26
xor byte [rsp + 0x20], 5
sub byte [rsp + 0x20], 0x1d
add byte [rsp + 0x20], 0x1b
add byte [rsp + 0x20], 0x1b
add byte [rsp + 0x20], 0x12
sub byte [rsp + 0x20], 0x66
xor r9d, r9d
xor r8d, r8d
xchg rdi, rdx
mov rdi, rdx
xchg rdx, rdi
xchg r8, rcx
mov r8, rbx
xchg r8, rcx
call fcn.14019a400
xchg r11, rax
mov qword [rbx + 8], r11
xchg r11, rax
xchg r10, rdi
mov qword [rbp + 0x40], r10
xchg r10, rdi
test rdi, rdi
je 0x1401971bb
mov dword [rsp + 0x20], 0x1bbd89b5
xor dword [rsp + 0x20], 0x26b07d4
add dword [rsp + 0x20], 0x11abfd36
xor dword [rsp + 0x20], 0x2078b581
add dword [rsp + 0x20], 0x3af1c82
sub dword [rsp + 0x20], 0xfa8da98
xor r9d, r9d
lea r8, [rbp + 0x40]
lea rdx, [r9 - 1]
lea rcx, [rbx + 0x70]
call fcn.140197530
xchg rdx, r15
mov qword [rbp - 0x30], rdx
xchg rdx, r15
xchg r12, rdi
mov qword [rbp - 0x28], rdi
xchg r12, rdi
lea rax, [rbp - 0x30]
mov qword [rbp + 8], rax
lea r9, [rbp - 0x30]
xor r8d, r8d
mov rdx, qword [rbx + 8]
xchg rcx, r9
mov r9, rbx
xchg rcx, r9
call fcn.1401985f0
xchg rbx, rax
mov rbx, rax
xchg rbx, rax
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x40]
xchg rbx, rsi
mov rbx, qword [r11 + 0x48]
xchg rsi, rbx
mov rsp, r11
nop
mov r15, qword [rsp]
add rsp, 8
nop
xchg qword [rsp], r14
add rsp, 8
nop
add rsp, 8
mov r12, qword [rsp - 8]
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov rbp, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]