Function at 0x140196270
Capabilities:
Access peb ldr_data
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
xchg r13, rsi
mov qword [rsp + 0x20], r13
xchg r13, rsi
nop
sub rsp, 8
mov qword [rsp], rbp
nop
mov qword [rsp - 8], rdi
sub rsp, 8
push r12
nop
sub rsp, 8
mov qword [rsp], r14
nop
mov qword [rsp - 8], r15
sub rsp, 8
lea rbp, [rsp - 0x10]
sub rsp, 0x110
xchg rcx, r8
mov rbx, r8
xchg r8, rcx
xor r14d, r14d
xchg r14, rdx
mov qword [rcx + 0x10], rdx
xchg rdx, r14
mov qword [rcx + 0x20], r14
xchg r14, r9
mov qword [rcx + 0x30], r9
xchg r9, r14
xchg r14, rbx
mov qword [rcx + 0x40], rbx
xchg r14, rbx
mov qword [rcx + 0x50], r14
mov qword [rcx + 0x60], r14
mov qword [rcx + 0x70], r14
mov qword [rcx + 0x80], r14
xchg rdi, r14
mov qword [rcx + 0x90], rdi
xchg r14, rdi
mov qword [rcx + 0xa0], r14
xchg rbp, r14
mov qword [rcx + 0xb0], rbp
xchg r14, rbp
xchg r9, r14
mov qword [rcx + 0xc0], r9
xchg r14, r9
xchg r13, r14
mov qword [rcx + 0xd0], r13
xchg r14, r13
mov qword [rcx + 0xe0], r14
xchg r14, r12
mov qword [rcx + 0xf0], r12
xchg r12, r14
mov qword [rcx + 0x100], r14
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x18]
xchg rcx, rsi
mov rsi, qword [rax + 0x20]
xchg rcx, rsi
mov rax, qword [rcx]
mov rdx, qword [rax + 0x20]
mov qword [rbx], rdx
lea r15, [0x140003e38]
mov qword [rbp - 0x70], r15
lea r12, [0x140198160]
mov qword [rbp - 0x68], r12
lea rax, [rbp - 0x70]
mov qword [rbp - 0x38], rax
lea r9, [rbp - 0x70]
xor r8d, r8d
xchg rcx, rbx
mov rbx, rcx
xchg rbx, rcx
call fcn.140197ea0
mov dword [rsp + 0x30], 0x5b5d2025
xor dword [rsp + 0x30], 0x3912d393
xor dword [rsp + 0x30], 0x60589f62
add dword [rsp + 0x30], 0x456ade8d
xor dword [rsp + 0x30], 0x29e00a1a
sub dword [rsp + 0x30], 0x1409d90d
xor dword [rsp + 0x30], 0x4a2113aa
add dword [rsp + 0x30], 0xe67d7b32
mov dword [rsp + 0x50], 0x17a7e879
add dword [rsp + 0x50], 0x5d8e0154
sub dword [rsp + 0x50], 0x64380668
add dword [rsp + 0x50], 0x47598a17
xor dword [rsp + 0x50], 0x34930622
xor dword [rsp + 0x50], 0x39551f46
xor dword [rsp + 0x50], 0x4d27a7e1
add dword [rsp + 0x50], 0xe6a72b6d
mov dword [rsp + 0x54], 0x6b7ac43e
sub dword [rsp + 0x54], 0x944a79d
add dword [rsp + 0x54], 0x1a63dbb2
add dword [rsp + 0x54], 0x348bf87
sub dword [rsp + 0x54], 0x6eeeaeb9
xor dword [rsp + 0x54], 0x7a5968c0
sub dword [rsp + 0x54], 0x449ab6fe
xor dword [rsp + 0x54], 0x1c3e861e
xor dword [rsp + 0x54], 0xc551d37e
mov dword [rsp + 0x34], 0x3e4ee87f
xor dword [rsp + 0x34], 0x29b64e2b
xor dword [rsp + 0x34], 0x6ad0f021
sub dword [rsp + 0x34], 0x7327c1b4
xor dword [rsp + 0x34], 0x3b334a4f
sub dword [rsp + 0x34], 0x2a4760de
add dword [rsp + 0x34], 0xf00a7946
mov dword [rsp + 0x58], 0x77fd38b
add dword [rsp + 0x58], 0x4af8f405
add dword [rsp + 0x58], 0x1116cd8
xor dword [rsp + 0x58], 0x273897d0
sub dword [rsp + 0x58], 0xc4afcce
add dword [rsp + 0x58], 0x846c0c0
add dword [rsp + 0x58], 0x7b87ac0
add dword [rsp + 0x58], 0x87091d14
mov dword [rsp + 0x5c], 0x6632158a
sub dword [rsp + 0x5c], 0x45e69128
sub dword [rsp + 0x5c], 0xacae503
xor dword [rsp + 0x5c], 0x486cc3c0
xor dword [rsp + 0x5c], 0x53fd2d7c
xor dword [rsp + 0x5c], 0x5b1d0d7a
xor dword [rsp + 0x5c], 0x76ec6d7e
add dword [rsp + 0x5c], 0x1aa16d96
xor dword [rsp + 0x5c], 0xc1dd800a
mov dword [rsp + 0x38], 0x42a6e842
add dword [rsp + 0x38], 0x1532571
add dword [rsp + 0x38], 0x1871c0f5
add dword [rsp + 0x38], 0xbf9170f
xor dword [rsp + 0x38], 0x4ee3369f
xor dword [rsp + 0x38], 0xd07125de
mov dword [rsp + 0x60], 0x58429614
sub dword [rsp + 0x60], 0x540def7a
add dword [rsp + 0x60], 0x4f3df91d
sub dword [rsp + 0x60], 0x341b0947
xor dword [rsp + 0x60], 0x2df8ecc6
sub dword [rsp + 0x60], 0x2f13abd8
add dword [rsp + 0x60], 0x2a8ee910
add dword [rsp + 0x60], 0xd14f478b
mov dword [rsp + 0x64], 0x112748e1
add dword [rsp + 0x64], 0x41ca7d71
sub dword [rsp + 0x64], 0x3c4f0473
add dword [rsp + 0x64], 0x2db02a07
add dword [rsp + 0x64], 0x22c52793
sub dword [rsp + 0x64], 0x35a3a552
xor dword [rsp + 0x64], 0xce129159
mov dword [rsp + 0x3c], 0x33945bc4
sub dword [rsp + 0x3c], 0x32975517
add dword [rsp + 0x3c], 0x697b8b8f
xor dword [rsp + 0x3c], 0x2e38b909
sub dword [rsp + 0x3c], 0x3e5d46e2
add dword [rsp + 0x3c], 0x341ba454
xor dword [rsp + 0x3c], 0x23f05347
add dword [rsp + 0x3c], 0x5652e97b
add dword [rsp + 0x3c], 0x8695319b
mov dword [rsp + 0x68], 0x489c7b19
sub dword [rsp + 0x68], 0x36ef1554
add dword [rsp + 0x68], 0x4679656a
add dword [rsp + 0x68], 0x114b20a8
add dword [rsp + 0x68], 0x816ee9c
xor dword [rsp + 0x68], 0x510194ad
xor dword [rsp + 0x68], 0x5b6fec26
sub dword [rsp + 0x68], 0x752becc4
add dword [rsp + 0x68], 0xf8c94949
mov dword [rsp + 0x6c], 0x39a0f13c
xor dword [rsp + 0x6c], 0x737a6266
sub dword [rsp + 0x6c], 0x16966509
xor dword [rsp + 0x6c], 0x6e8ef143
sub dword [rsp + 0x6c], 0x1cf26e01
xor dword [rsp + 0x6c], 0x27b8017c
add dword [rsp + 0x6c], 0x416b2559
xor dword [rsp + 0x6c], 0x5fc37aa1
add dword [rsp + 0x6c], 0xfb761016
mov dword [rsp + 0x40], 0x14fffbd8
xor dword [rsp + 0x40], 0x146ce395
add dword [rsp + 0x40], 0x132666b0
xor dword [rsp + 0x40], 0x43d349c2
sub dword [rsp + 0x40], 0x107e073a
sub dword [rsp + 0x40], 0x29a34609
xor dword [rsp + 0x40], 0x4293d693
add dword [rsp + 0x40], 0xa21bb787
mov dword [rsp + 0x70], 0x196c5aa5
add dword [rsp + 0x70], 0x453285ec
sub dword [rsp + 0x70], 0x51736a93
xor dword [rsp + 0x70], 0x5e653b6a
add dword [rsp + 0x70], 0x1311376c
add dword [rsp + 0x70], 0x9918796f
mov dword [rsp + 0x74], 0x4f78e664
sub dword [rsp + 0x74], 0x24fd540d
add dword [rsp + 0x74], 0x1d1ae65c
xor dword [rsp + 0x74], 0x5b8c4d52
add dword [rsp + 0x74], 0x39601b69
xor dword [rsp + 0x74], 0x70da436e
add dword [rsp + 0x74], 0x420c18d4
add dword [rsp + 0x74], 0x9790d445
mov dword [rsp + 0x44], 0x236c00e8
xor dword [rsp + 0x44], 0x2f9475d2
add dword [rsp + 0x44], 0xa8d39a9
add dword [rsp + 0x44], 0x46f6ae78
xor dword [rsp + 0x44], 0xdf418b0
xor dword [rsp + 0x44], 0x409f2c70
xor dword [rsp + 0x44], 0x2bc77359
xor dword [rsp + 0x44], 0x27d39c75
add dword [rsp + 0x44], 0xd7f3703f
mov dword [rsp + 0x78], 0x1acee6fc
add dword [rsp + 0x78], 0x2eac4e2a
sub dword [rsp + 0x78], 0x1ac44e47
add dword [rsp + 0x78], 0x421cf4c5
sub dword [rsp + 0x78], 0x84dda12
xor dword [rsp + 0x78], 0x1e568890
xor dword [rsp + 0x78], 0x89a87664
mov dword [rsp + 0x7c], 0x7ea75dc9
xor dword [rsp + 0x7c], 0x73ecfeaf
add dword [rsp + 0x7c], 0x61daffbb
xor dword [rsp + 0x7c], 0x5a7bdccf
add dword [rsp + 0x7c], 0xeb8e707
sub dword [rsp + 0x7c], 0x29703919
xor dword [rsp + 0x7c], 0x72a4cf21
sub dword [rsp + 0x7c], 0x619ba26f
xor dword [rsp + 0x7c], 0xf909bff0
mov dword [rsp + 0x48], 0x6735f58e
sub dword [rsp + 0x48], 0xaa3776e
sub dword [rsp + 0x48], 0x4521dc64
add dword [rsp + 0x48], 0x62df5247
sub dword [rsp + 0x48], 0x248c1488
add dword [rsp + 0x48], 0x20458164
xor dword [rsp + 0x48], 0x775d8c85
xor dword [rsp + 0x48], 0x5ae49316
add dword [rsp + 0x48], 0x9b4677aa
mov dword [rbp - 0x80], 0x4d9cd0d5
sub dword [rbp - 0x80], 0x5979ad0
xor dword [rbp - 0x80], 0x660a038a
xor dword [rbp - 0x80], 0x68a8ee45
xor dword [rbp - 0x80], 0x683cc0e2
add dword [rbp - 0x80], 0xd0dbe44e
mov dword [rbp - 0x7c], 0x7d37bd42
xor dword [rbp - 0x7c], 0x13e3424d
xor dword [rbp - 0x7c], 0x6fe970ab
xor dword [rbp - 0x7c], 0x218ae159
sub dword [rbp - 0x7c], 0x1e7aabf0
xor dword [rbp - 0x7c], 0xfd523c35
mov word [rsp + 0x4c], 0x322a
add word [rsp + 0x4c], 0x4a36
sub word [rsp + 0x4c], 0x28a6
sub word [rsp + 0x4c], 0x41ed
xor word [rsp + 0x4c], 0x66ef
add word [rsp + 0x4c], 0x7fd4
mov dword [rbp - 0x78], 0x6566a1ac
xor dword [rbp - 0x78], 0xcc86dcf
sub dword [rbp - 0x78], 0x110a1c7e
xor dword [rbp - 0x78], 0x11bc9ab2
xor dword [rbp - 0x78], 0x1327c514
add dword [rbp - 0x78], 0xa5370f33
xor eax, eax
mov word [rbp - 0x74], ax
nop word [rax + rax]
movzx ecx, word [rsp + rax*2 + 0x50]
movzx edx, byte [rsp + rax + 0x30]
add dx, cx
mov word [rsp + rax*2 + 0x50], dx
mov byte [rsp + rax + 0x30], r14b
inc rax
cmp rax, 0x1e
jb 0x140196924
xor r8d, r8d
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140198c00
xchg r10, rax
mov rdi, r10
xchg r10, rax
xchg r14, rcx
mov r14, rcx
xchg r14, rcx
nop word [rax + rax]
mov byte [rsp + rcx + 0x50], 7
add byte [rsp + rcx + 0x50], 0x59
add byte [rsp + rcx + 0x50], 8
xor byte [rsp + rcx + 0x50], 0x26
add byte [rsp + rcx + 0x50], 0x10
xor byte [rsp + rcx + 0x50], 0x51
add byte [rsp + rcx + 0x50], 9
sub byte [rsp + rcx + 0x50], 0x18
inc rcx
cmp rcx, 0x3c
jb 0x140196972
xchg r12, r14
mov qword [rsp + 0x28], r12
xchg r14, r12
mov byte [rsp + 0x20], 0x15
add byte [rsp + 0x20], 0x1e
xor byte [rsp + 0x20], 0x36
add byte [rsp + 0x20], 0xb
add byte [rsp + 0x20], 0x2c
xor byte [rsp + 0x20], 0x54
xor byte [rsp + 0x20], 0x68
xor r9d, r9d
xor r8d, r8d
xchg r13, rdx
mov r13, rdi
xchg r13, rdx
xchg rcx, rbx
mov rbx, rcx
xchg rcx, rbx
call fcn.140199d10
xchg rdx, rax
mov qword [rbx + 8], rdx
xchg rdx, rax
mov qword [rbp + 0x40], rdi
test rdi, rdi
je 0x140196a53
mov dword [rsp + 0x20], 0x4d65944b
add dword [rsp + 0x20], 0x1b47c19e
sub dword [rsp + 0x20], 0x2934a7b9
sub dword [rsp + 0x20], 0x183a10ac
add dword [rsp + 0x20], 0x73a4a60
xor dword [rsp + 0x20], 0x63df62c0
sub dword [rsp + 0x20], 0x4da70524
xor r9d, r9d
lea r8, [rbp + 0x40]
lea rdx, [r9 - 1]
lea rcx, [rbx + 0x70]
call fcn.140196dc0
xchg r8, r15
mov qword [rbp - 0x30], r8
xchg r15, r8
mov qword [rbp - 0x28], r12
lea rax, [rbp - 0x30]
xchg r15, rax
mov qword [rbp + 8], r15
xchg r15, rax
lea r9, [rbp - 0x30]
xor r8d, r8d
xchg rdx, rbp
mov rbp, qword [rbx + 8]
xchg rbp, rdx
xchg rcx, rbx
mov rbx, rcx
xchg rcx, rbx
call fcn.140197ea0
xchg rdx, rbx
mov rax, rdx
xchg rdx, rbx
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
nop
xchg qword [rsp], r15
add rsp, 8
nop
add rsp, 8
xchg qword [rsp - 8], r14
nop
mov r12, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
mov rbp, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]