Function at 0x140196910
Capabilities:
Access peb ldr_data
Encode data using xor

Disassembly:
xchg rbx, rsi
mov qword [rsp + 0x18], rsi
xchg rbx, rsi
mov qword [rsp + 0x20], rsi
nop
sub rsp, 8
mov qword [rsp], rbp
nop
sub rsp, 8
mov qword [rsp], rdi
nop
mov qword [rsp - 8], r12
sub rsp, 8
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
mov qword [rsp - 8], r15
sub rsp, 8
lea rbp, [rsp - 0x10]
sub rsp, 0x110
xchg rcx, rbx
mov rcx, rbx
xchg rcx, rbx
xor r14d, r14d
mov qword [rcx + 0x10], r14
mov qword [rcx + 0x20], r14
mov qword [rcx + 0x30], r14
mov qword [rcx + 0x40], r14
mov qword [rcx + 0x50], r14
mov qword [rcx + 0x60], r14
xchg r9, r14
mov qword [rcx + 0x70], r9
xchg r9, r14
mov qword [rcx + 0x80], r14
mov qword [rcx + 0x90], r14
xchg r10, r14
mov qword [rcx + 0xa0], r10
xchg r14, r10
xchg r15, r14
mov qword [rcx + 0xb0], r15
xchg r14, r15
mov qword [rcx + 0xc0], r14
mov qword [rcx + 0xd0], r14
xchg r14, rdi
mov qword [rcx + 0xe0], rdi
xchg rdi, r14
xchg r14, rsi
mov qword [rcx + 0xf0], rsi
xchg r14, rsi
mov qword [rcx + 0x100], r14
mov rax, qword gs:[0x30]
xchg rcx, rbp
mov rbp, qword [rax + 0x60]
xchg rbp, rcx
xchg r8, rax
mov r8, qword [rcx + 0x18]
xchg r8, rax
mov rcx, qword [rax + 0x20]
mov rax, qword [rcx]
mov rdx, qword [rax + 0x20]
xchg r12, rdx
mov qword [rbx], r12
xchg r12, rdx
lea r15, [0x140003e38]
xchg r15, rbx
mov qword [rbp - 0x70], rbx
xchg rbx, r15
lea r12, [0x140198840]
mov qword [rbp - 0x68], r12
lea rax, [rbp - 0x70]
mov qword [rbp - 0x38], rax
lea r9, [rbp - 0x70]
xor r8d, r8d
mov rcx, rbx
call fcn.140198570
mov dword [rsp + 0x30], 0x147dd3fb
xor dword [rsp + 0x30], 0x96070b6
xor dword [rsp + 0x30], 0x75512f44
sub dword [rsp + 0x30], 0x20678982
sub dword [rsp + 0x30], 0x3196617a
xor dword [rsp + 0x30], 0x595f876c
xor dword [rsp + 0x30], 0x548c5076
add dword [rsp + 0x30], 0xdb5980df
mov dword [rsp + 0x50], 0x46b872af
add dword [rsp + 0x50], 0xfbdadaf
xor dword [rsp + 0x50], 0x54406ece
add dword [rsp + 0x50], 0x1a8412e1
sub dword [rsp + 0x50], 0xeae196a
xor dword [rsp + 0x50], 0x6c4a2ce2
add dword [rsp + 0x50], 0xd8d1cd5
sub dword [rsp + 0x50], 0x69e5e8ee
add dword [rsp + 0x50], 0xf970669a
mov dword [rsp + 0x54], 0x609a423d
sub dword [rsp + 0x54], 0x1d94e806
xor dword [rsp + 0x54], 0xf1ecbf6
xor dword [rsp + 0x54], 0x7fa3d6ec
add dword [rsp + 0x54], 0x27f0c2fd
add dword [rsp + 0x54], 0xa3d4f559
mov dword [rsp + 0x34], 0x7fb04228
sub dword [rsp + 0x34], 0x62eba438
sub dword [rsp + 0x34], 0x18b79d98
xor dword [rsp + 0x34], 0x3feefdb9
sub dword [rsp + 0x34], 0xd035956
add dword [rsp + 0x34], 0xc816526b
mov dword [rsp + 0x58], 0x14d1e2f5
add dword [rsp + 0x58], 0x1b99b01b
add dword [rsp + 0x58], 0x3d903112
sub dword [rsp + 0x58], 0x215cd82a
sub dword [rsp + 0x58], 0x34b82984
add dword [rsp + 0x58], 0xe7893d0a
mov dword [rsp + 0x5c], 0x284b793c
add dword [rsp + 0x5c], 0x3f30cb6e
sub dword [rsp + 0x5c], 0x4ec7039c
xor dword [rsp + 0x5c], 0x69d838ec
sub dword [rsp + 0x5c], 0x3c2c44a5
add dword [rsp + 0x5c], 0xca1bca3a
mov dword [rsp + 0x38], 0x52bf17df
sub dword [rsp + 0x38], 0x9c88ae
xor dword [rsp + 0x38], 0xf027bad
xor dword [rsp + 0x38], 0x1f039e21
sub dword [rsp + 0x38], 0xde88a3f
add dword [rsp + 0x38], 0x411ef71c
xor dword [rsp + 0x38], 0x83af216c
mov dword [rsp + 0x60], 0x7f89429
xor dword [rsp + 0x60], 0x791beffb
xor dword [rsp + 0x60], 0x21d084df
sub dword [rsp + 0x60], 0x438ee2f9
add dword [rsp + 0x60], 0x39fc89c7
xor dword [rsp + 0x60], 0x3915d060
sub dword [rsp + 0x60], 0x563a4447
sub dword [rsp + 0x60], 0x3cc1e1
add dword [rsp + 0x60], 0xe93c8fe6
mov dword [rsp + 0x64], 0x731a7eef
xor dword [rsp + 0x64], 0x270245e3
xor dword [rsp + 0x64], 0x28611af3
sub dword [rsp + 0x64], 0x5b41326d
xor dword [rsp + 0x64], 0x60e90e2f
add dword [rsp + 0x64], 0x2f93298b
add dword [rsp + 0x64], 0x8df4f436
mov dword [rsp + 0x3c], 0x424c0d59
sub dword [rsp + 0x3c], 0x2f13cbc7
add dword [rsp + 0x3c], 0x6048b6bb
xor dword [rsp + 0x3c], 0x3248963e
sub dword [rsp + 0x3c], 0xf130df6
xor dword [rsp + 0x3c], 0x4af5cb6
sub dword [rsp + 0x3c], 0x2910620c
xor dword [rsp + 0x3c], 0x5269574d
add dword [rsp + 0x3c], 0x97966904
mov dword [rsp + 0x68], 0x670f22d7
sub dword [rsp + 0x68], 0x2599745f
xor dword [rsp + 0x68], 0x20de5e7e
xor dword [rsp + 0x68], 0x28730458
xor dword [rsp + 0x68], 0x200b1d17
add dword [rsp + 0x68], 0x95b01634
mov dword [rsp + 0x6c], 0x380dc73c
xor dword [rsp + 0x6c], 0x42899ebb
sub dword [rsp + 0x6c], 0xbb7b14e
sub dword [rsp + 0x6c], 0x45283aba
xor dword [rsp + 0x6c], 0x1cb2c208
xor dword [rsp + 0x6c], 0xca68500a
mov dword [rsp + 0x40], 0x416ac540
sub dword [rsp + 0x40], 0x32f6b921
sub dword [rsp + 0x40], 0x2aa0d89
add dword [rsp + 0x40], 0x1b59f8d5
add dword [rsp + 0x40], 0x1e947c7e
add dword [rsp + 0x40], 0x27a72b73
xor dword [rsp + 0x40], 0x46d07f18
add dword [rsp + 0x40], 0x1f940420
xor dword [rsp + 0x40], 0xbdd51292
mov dword [rsp + 0x70], 0x317e3a88
sub dword [rsp + 0x70], 0x1bbd5714
add dword [rsp + 0x70], 0xc6a3bc2
add dword [rsp + 0x70], 0x43aaa325
xor dword [rsp + 0x70], 0x76950e6e
xor dword [rsp + 0x70], 0x6d3462d8
sub dword [rsp + 0x70], 0x4127ab09
add dword [rsp + 0x70], 0x3e509ffe
add dword [rsp + 0x70], 0x83da5b8d
mov dword [rsp + 0x74], 0x6dfba800
sub dword [rsp + 0x74], 0x2b9e7c52
sub dword [rsp + 0x74], 0x324274d5
add dword [rsp + 0x74], 0x6c3a4e9a
xor dword [rsp + 0x74], 0x6d0b4f5a
add dword [rsp + 0x74], 0x744a11f
xor dword [rsp + 0x74], 0x17a3ca90
add dword [rsp + 0x74], 0xf03bdd65
mov dword [rsp + 0x44], 0x917790d
add dword [rsp + 0x44], 0x16e2e6b0
xor dword [rsp + 0x44], 0x371f1231
sub dword [rsp + 0x44], 0x734da61
xor dword [rsp + 0x44], 0xcfcd91a
add dword [rsp + 0x44], 0x17c52eb4
add dword [rsp + 0x44], 0x63a2c76
add dword [rsp + 0x44], 0xabaaf19b
mov dword [rsp + 0x78], 0x2ffd843d
xor dword [rsp + 0x78], 0x4d86283b
sub dword [rsp + 0x78], 0x9b1669c
sub dword [rsp + 0x78], 0x23c21119
xor dword [rsp + 0x78], 0x1a075f5b
xor dword [rsp + 0x78], 0x46441483
add dword [rsp + 0x78], 0x962d7fdd
mov dword [rsp + 0x7c], 0x6efa3537
sub dword [rsp + 0x7c], 0x96e39bf
sub dword [rsp + 0x7c], 0x3788a22e
add dword [rsp + 0x7c], 0x12e2c16e
xor dword [rsp + 0x7c], 0x5a20958e
xor dword [rsp + 0x7c], 0x53d7be62
add dword [rsp + 0x7c], 0x99d2b3a
xor dword [rsp + 0x7c], 0xadc0a3f0
mov dword [rsp + 0x48], 0x5dd2f98c
sub dword [rsp + 0x48], 0x384552d5
sub dword [rsp + 0x48], 0x5cd7994
add dword [rsp + 0x48], 0x193846cc
add dword [rsp + 0x48], 0xda2f147
xor dword [rsp + 0x48], 0xb06d93c0
mov dword [rbp - 0x80], 0x1e03fc6b
add dword [rbp - 0x80], 0x5fea4edd
sub dword [rbp - 0x80], 0x24ee095b
sub dword [rbp - 0x80], 0x515c8f18
add dword [rbp - 0x80], 0x3ff81d58
xor dword [rbp - 0x80], 0x42e929fe
add dword [rbp - 0x80], 0x121a0009
xor dword [rbp - 0x80], 0x5ccfd5e0
add dword [rbp - 0x80], 0xb433d33a
mov dword [rbp - 0x7c], 0x2d1d70b0
add dword [rbp - 0x7c], 0x31ff514f
xor dword [rbp - 0x7c], 0x567d7fc2
add dword [rbp - 0x7c], 0x1e4c100a
add dword [rbp - 0x7c], 0x19001952
add dword [rbp - 0x7c], 0xbec1179f
mov word [rsp + 0x4c], 0x7996
xor word [rsp + 0x4c], 0x6b23
add word [rsp + 0x4c], 0x3165
add word [rsp + 0x4c], 0x26f2
xor word [rsp + 0x4c], 0x3d78
xor word [rsp + 0x4c], 0xa082
mov dword [rbp - 0x78], 0x882bc08
xor dword [rbp - 0x78], 0x49fd4a47
sub dword [rbp - 0x78], 0x2ddc2dc1
sub dword [rbp - 0x78], 0x13181c2f
xor dword [rbp - 0x78], 0x714329e1
sub dword [rbp - 0x78], 0x9694f26
sub dword [rbp - 0x78], 0x60a33ef5
xor dword [rbp - 0x78], 0xf8cd08d5
xor eax, eax
mov word [rbp - 0x74], ax
nop word [rax + rax]
movzx ecx, word [rsp + rax*2 + 0x50]
movzx edx, byte [rsp + rax + 0x30]
add dx, cx
mov word [rsp + rax*2 + 0x50], dx
mov byte [rsp + rax + 0x30], r14b
inc rax
cmp rax, 0x1e
jb 0x140196f7f
xor r8d, r8d
lea rdx, [rsp + 0x50]
xchg rbx, rcx
mov rbx, rcx
xchg rbx, rcx
call fcn.1401992d0
xchg rdi, r13
mov r13, rax
xchg r13, rdi
mov rcx, r14
nop word [rax + rax]
mov byte [rsp + rcx + 0x50], 0x3d
add byte [rsp + rcx + 0x50], 0x34
sub byte [rsp + rcx + 0x50], 3
add byte [rsp + rcx + 0x50], 5
sub byte [rsp + rcx + 0x50], 0xa
xor byte [rsp + rcx + 0x50], 0x44
xor byte [rsp + rcx + 0x50], 0x2d
inc rcx
cmp rcx, 0x3c
jb 0x140196fcf
xchg r8, r14
mov qword [rsp + 0x28], r8
xchg r14, r8
mov byte [rsp + 0x20], 0x11
xor byte [rsp + 0x20], 3
xor byte [rsp + 0x20], 0x2c
sub byte [rsp + 0x20], 0xa
sub byte [rsp + 0x20], 0x2a
add byte [rsp + 0x20], 0xd
sub byte [rsp + 0x20], 0x17
xor r9d, r9d
xor r8d, r8d
xchg rdx, rdi
mov rdi, rdx
xchg rdx, rdi
xchg rcx, rbx
mov rbx, rcx
xchg rbx, rcx
call fcn.14019a400
mov qword [rbx + 8], rax
mov qword [rbp + 0x40], rdi
test rdi, rdi
je 0x1401970b7
mov dword [rsp + 0x20], 0x3eb62b09
sub dword [rsp + 0x20], 0xe8e1cc2
add dword [rsp + 0x20], 0x2965ffe4
sub dword [rsp + 0x20], 0xdebeefc
add dword [rsp + 0x20], 0x199e58c5
sub dword [rsp + 0x20], 0xee278a8
sub dword [rsp + 0x20], 0x7225cd4
xor dword [rsp + 0x20], 0x2119f90
sub dword [rsp + 0x20], 0x4d29bde8
xor r9d, r9d
lea r8, [rbp + 0x40]
lea rdx, [r9 - 1]
lea rcx, [rbx + 0x70]
call fcn.140197450
mov qword [rbp - 0x30], r15
xchg r8, r12
mov qword [rbp - 0x28], r8
xchg r8, r12
lea rax, [rbp - 0x30]
xchg rsi, rax
mov qword [rbp + 8], rsi
xchg rsi, rax
lea r9, [rbp - 0x30]
xor r8d, r8d
mov rdx, qword [rbx + 8]
xchg r11, rcx
mov r11, rbx
xchg rcx, r11
call fcn.140198570
xchg rbx, r12
mov rax, r12
xchg r12, rbx
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x40]
xchg r13, rsi
mov r13, qword [r11 + 0x48]
xchg rsi, r13
mov rsp, r11
nop
xchg qword [rsp], r15
add rsp, 8
nop
add rsp, 8
xchg qword [rsp - 8], r14
nop
add rsp, 8
xchg qword [rsp - 8], r12
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
xchg qword [rsp], rbp
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]