Function at 0x1401972f0
Capabilities:
Access peb ldr_data
Encode data using xor

Disassembly:
xchg rbx, r9
mov qword [rsp + 0x18], r9
xchg r9, rbx
mov qword [rsp + 0x20], rsi
push rbp
nop
push 0x5e258bcc
mov qword [rsp], rdi
nop
mov qword [rsp - 8], r12
sub rsp, 8
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
xchg rcx, rbx
mov rcx, rbx
xchg rbx, rcx
xor r14d, r14d
mov qword [rcx + 0x10], r14
mov qword [rcx + 0x20], r14
xchg r14, rdx
mov qword [rcx + 0x30], rdx
xchg rdx, r14
xchg r14, r11
mov qword [rcx + 0x40], r11
xchg r14, r11
mov qword [rcx + 0x50], r14
xchg r14, r8
mov qword [rcx + 0x60], r8
xchg r14, r8
mov qword [rcx + 0x70], r14
mov qword [rcx + 0x80], r14
mov qword [rcx + 0x90], r14
mov qword [rcx + 0xa0], r14
mov qword [rcx + 0xb0], r14
xchg r14, r12
mov qword [rcx + 0xc0], r12
xchg r12, r14
xchg rbx, r14
mov qword [rcx + 0xd0], rbx
xchg r14, rbx
xchg r14, r13
mov qword [rcx + 0xe0], r13
xchg r13, r14
xchg r14, r11
mov qword [rcx + 0xf0], r11
xchg r14, r11
xchg r14, r8
mov qword [rcx + 0x100], r8
xchg r14, r8
mov rax, qword gs:[0x30]
xchg rcx, r12
mov r12, qword [rax + 0x60]
xchg r12, rcx
mov rax, qword [rcx + 0x18]
mov rcx, qword [rax + 0x20]
xchg r11, rax
mov r11, qword [rcx]
xchg r11, rax
xchg rdx, r11
mov r11, qword [rax + 0x20]
xchg r11, rdx
mov qword [rbx], rdx
lea r15, [0x140003e38]
mov qword [rbp - 0x70], r15
lea r12, [0x140199180]
mov qword [rbp - 0x68], r12
lea rax, [rbp - 0x70]
xchg r14, rax
mov qword [rbp - 0x38], r14
xchg r14, rax
lea r9, [rbp - 0x70]
xor r8d, r8d
xchg rbx, rcx
mov rbx, rcx
xchg rbx, rcx
call fcn.140198ee0
mov dword [rsp + 0x30], 0x2be18061
sub dword [rsp + 0x30], 0x26463a8e
add dword [rsp + 0x30], 0x6dfd700c
sub dword [rsp + 0x30], 0x6ecb2f85
add dword [rsp + 0x30], 0x299d2b4e
xor dword [rsp + 0x30], 0x2f88617f
add dword [rsp + 0x30], 0xf514261f
mov dword [rsp + 0x50], 0x504dba25
xor dword [rsp + 0x50], 0x148cb8b
sub dword [rsp + 0x50], 0x2e3a70c5
add dword [rsp + 0x50], 0x2c07995f
sub dword [rsp + 0x50], 0x56f1b97
add dword [rsp + 0x50], 0x2002ce2
add dword [rsp + 0x50], 0x2a7a93ab
add dword [rsp + 0x50], 0x897fc028
mov dword [rsp + 0x54], 0x1d3cbc6e
add dword [rsp + 0x54], 0x21b696a6
add dword [rsp + 0x54], 0x1656ee1a
add dword [rsp + 0x54], 0x1149ccd2
sub dword [rsp + 0x54], 0x3317d6f3
sub dword [rsp + 0x54], 0x19e4b58c
add dword [rsp + 0x54], 0xe5e67e02
mov dword [rsp + 0x34], 0x6c525055
sub dword [rsp + 0x34], 0x560fba69
xor dword [rsp + 0x34], 0x4b2056e9
sub dword [rsp + 0x34], 0x4898d55b
add dword [rsp + 0x34], 0x51ec106e
xor dword [rsp + 0x34], 0x6bc77050
xor dword [rsp + 0x34], 0x1abab1ac
xor dword [rsp + 0x34], 0xe13ec912
mov dword [rsp + 0x58], 0x79c67214
sub dword [rsp + 0x58], 0x5f8b5e0d
add dword [rsp + 0x58], 0x15612263
xor dword [rsp + 0x58], 0x34bf1bfe
xor dword [rsp + 0x58], 0x4596f2f8
xor dword [rsp + 0x58], 0xa1da2012
mov dword [rsp + 0x5c], 0x30675987
sub dword [rsp + 0x5c], 0x13605e3b
add dword [rsp + 0x5c], 0xbca62b2
add dword [rsp + 0x5c], 0x3fc61341
xor dword [rsp + 0x5c], 0x501c4385
xor dword [rsp + 0x5c], 0x2b28567e
add dword [rsp + 0x5c], 0xebb99ab3
mov dword [rsp + 0x38], 0x7a564952
sub dword [rsp + 0x38], 0x2609856b
xor dword [rsp + 0x38], 0x122143f3
xor dword [rsp + 0x38], 0x5f5cd8d4
add dword [rsp + 0x38], 0x32b2499f
add dword [rsp + 0x38], 0xab135497
mov dword [rsp + 0x60], 0x465b986b
sub dword [rsp + 0x60], 0x1c13508d
sub dword [rsp + 0x60], 0x1cc026ab
xor dword [rsp + 0x60], 0x675b5ee2
xor dword [rsp + 0x60], 0x1e24f762
xor dword [rsp + 0x60], 0x4eaa9c88
xor dword [rsp + 0x60], 0x22fe6b4a
add dword [rsp + 0x60], 0x55a589fe
add dword [rsp + 0x60], 0x9130f60a
mov dword [rsp + 0x64], 0x4dbf6407
sub dword [rsp + 0x64], 0x2f998bc
xor dword [rsp + 0x64], 0x43cdc2db
add dword [rsp + 0x64], 0x121bb68b
add dword [rsp + 0x64], 0xd079f19
xor dword [rsp + 0x64], 0x2a51e670
xor dword [rsp + 0x64], 0x2a5bea4d
add dword [rsp + 0x64], 0xd745ac75
mov dword [rsp + 0x3c], 0x162cf980
add dword [rsp + 0x3c], 0x2613f26c
xor dword [rsp + 0x3c], 0x60247212
add dword [rsp + 0x3c], 0xe59afac
sub dword [rsp + 0x3c], 0x17f5ff55
sub dword [rsp + 0x3c], 0x47272485
add dword [rsp + 0x3c], 0x40c9431
xor dword [rsp + 0x3c], 0xf95b4cf7
mov dword [rsp + 0x68], 0x6a18d6a4
sub dword [rsp + 0x68], 0x102b4348
add dword [rsp + 0x68], 0x11e4f435
sub dword [rsp + 0x68], 0x5675ae53
add dword [rsp + 0x68], 0x238a62a0
xor dword [rsp + 0x68], 0xc764c4a3
mov dword [rsp + 0x6c], 0x37916446
xor dword [rsp + 0x6c], 0x4d1438fe
sub dword [rsp + 0x6c], 0x17affd4d
sub dword [rsp + 0x6c], 0x54d92488
add dword [rsp + 0x6c], 0x6f9a3ee8
xor dword [rsp + 0x6c], 0x46efe900
xor dword [rsp + 0x6c], 0xc4076fb6
mov dword [rsp + 0x40], 0x79fad73f
xor dword [rsp + 0x40], 0xa7dbeda
sub dword [rsp + 0x40], 0x4b859cf1
add dword [rsp + 0x40], 0x306f1df6
sub dword [rsp + 0x40], 0x432a84ec
xor dword [rsp + 0x40], 0x7ba7b6cc
add dword [rsp + 0x40], 0x881523c4
mov dword [rsp + 0x70], 0x55399bcc
sub dword [rsp + 0x70], 0x43d8f79f
add dword [rsp + 0x70], 0x688397b3
add dword [rsp + 0x70], 0x5a3c8e2
sub dword [rsp + 0x70], 0x5d684689
xor dword [rsp + 0x70], 0xdd684156
mov dword [rsp + 0x74], 0x7a1a1a5
xor dword [rsp + 0x74], 0x1108bcc0
xor dword [rsp + 0x74], 0x546fbf8
add dword [rsp + 0x74], 0x5206a4d7
add dword [rsp + 0x74], 0x14d7dcae
xor dword [rsp + 0x74], 0x57dbc341
add dword [rsp + 0x74], 0xfacd640
add dword [rsp + 0x74], 0xc27a7d9a
mov dword [rsp + 0x44], 0x63dc80a4
sub dword [rsp + 0x44], 0x596a5a7f
add dword [rsp + 0x44], 0x3b2c6154
sub dword [rsp + 0x44], 0x30cd018
xor dword [rsp + 0x44], 0x651bb5ce
add dword [rsp + 0x44], 0xcdf54a1
xor dword [rsp + 0x44], 0xc29fa1a6
mov dword [rsp + 0x78], 0x63163c7f
xor dword [rsp + 0x78], 0x37bd99ae
add dword [rsp + 0x78], 0x215f3b93
sub dword [rsp + 0x78], 0x328473ee
add dword [rsp + 0x78], 0x30c2d633
xor dword [rsp + 0x78], 0x404a2e52
xor dword [rsp + 0x78], 0x4021dd38
add dword [rsp + 0x78], 0x8b564ea3
mov dword [rsp + 0x7c], 0x213f0
xor dword [rsp + 0x7c], 0x1dd5b4e1
sub dword [rsp + 0x7c], 0x1199f4fb
xor dword [rsp + 0x7c], 0x1f7490e
add dword [rsp + 0x7c], 0x35df9200
xor dword [rsp + 0x7c], 0x29e6ba9c
xor dword [rsp + 0x7c], 0x315694f9
add dword [rsp + 0x7c], 0xa4545c01
mov dword [rsp + 0x48], 0xdde8b4a
add dword [rsp + 0x48], 0x136c3ce5
add dword [rsp + 0x48], 0x4c0471cc
sub dword [rsp + 0x48], 0x29686a20
xor dword [rsp + 0x48], 0x4a9064d8
add dword [rsp + 0x48], 0xed804bf3
mov dword [rbp - 0x80], 0x3c36348e
sub dword [rbp - 0x80], 0x25cf5d59
add dword [rbp - 0x80], 0x169675e6
sub dword [rbp - 0x80], 0xa9e9f45
add dword [rbp - 0x80], 0x53fdfa1b
xor dword [rbp - 0x80], 0x32289724
xor dword [rbp - 0x80], 0xbb02cfa3
mov dword [rbp - 0x7c], 0x2e5bee47
sub dword [rbp - 0x7c], 0xa152c77
sub dword [rbp - 0x7c], 0xaca6b12
add dword [rbp - 0x7c], 0x2f354eec
xor dword [rbp - 0x7c], 0x29b66af2
add dword [rbp - 0x7c], 0x9e672fe0
mov word [rsp + 0x4c], 0x4de2
xor word [rsp + 0x4c], 0x50b0
add word [rsp + 0x4c], 0x30d1
add word [rsp + 0x4c], 0x2151
sub word [rsp + 0x4c], 0x350a
sub word [rsp + 0x4c], 0x1e2d
add word [rsp + 0x4c], 0x5906
add word [rsp + 0x4c], 0x35f
xor word [rsp + 0x4c], 0x8e54
mov dword [rbp - 0x78], 0x1018b908
xor dword [rbp - 0x78], 0x308f1fcb
sub dword [rbp - 0x78], 0x10a1d3c3
add dword [rbp - 0x78], 0x13f03f40
add dword [rbp - 0x78], 0x58b0cb8e
sub dword [rbp - 0x78], 0x23a241a5
sub dword [rbp - 0x78], 0x53348124
add dword [rbp - 0x78], 0x332155ce
add dword [rbp - 0x78], 0xc6958ea3
xor eax, eax
mov word [rbp - 0x74], ax
nop word [rax + rax]
movzx ecx, word [rsp + rax*2 + 0x50]
movzx edx, byte [rsp + rax + 0x30]
add dx, cx
mov word [rsp + rax*2 + 0x50], dx
mov byte [rsp + rax + 0x30], r14b
inc rax
cmp rax, 0x1e
jb 0x140197954
xor r8d, r8d
lea rdx, [rsp + 0x50]
xchg r10, rcx
mov r10, rbx
xchg r10, rcx
call fcn.140199c30
xchg rdi, rax
mov rax, rdi
xchg rdi, rax
xchg r12, rcx
mov r12, r14
xchg r12, rcx
nop word [rax + rax]
mov byte [rsp + rcx + 0x50], 0x63
sub byte [rsp + rcx + 0x50], 0x5f
xor byte [rsp + rcx + 0x50], 0x68
sub byte [rsp + rcx + 0x50], 7
xor byte [rsp + rcx + 0x50], 0x1e
sub byte [rsp + rcx + 0x50], 0x7b
inc rcx
cmp rcx, 0x3c
jb 0x1401979a8
mov qword [rsp + 0x28], r14
mov byte [rsp + 0x20], 0x66
xor byte [rsp + 0x20], 0x10
sub byte [rsp + 0x20], 0x22
xor byte [rsp + 0x20], 0x26
sub byte [rsp + 0x20], 0x27
xor byte [rsp + 0x20], 0x4b
xor r9d, r9d
xor r8d, r8d
xchg rdi, rdx
mov rdi, rdx
xchg rdx, rdi
xchg rbx, rcx
mov rbx, rcx
xchg rbx, rcx
call fcn.14019ad60
mov qword [rbx + 8], rax
mov qword [rbp + 0x40], rdi
test rdi, rdi
je 0x140197a80
mov dword [rsp + 0x20], 0x64b4108f
add dword [rsp + 0x20], 0xe3b522d
xor dword [rsp + 0x20], 0x5d10058d
xor dword [rsp + 0x20], 0x72395c88
sub dword [rsp + 0x20], 0xbd0718
add dword [rsp + 0x20], 0x17058aa4
sub dword [rsp + 0x20], 0x2797e668
xor dword [rsp + 0x20], 0xaa73e85
sub dword [rsp + 0x20], 0x46d16658
xor r9d, r9d
lea r8, [rbp + 0x40]
lea rdx, [r9 - 1]
lea rcx, [rbx + 0x70]
call fcn.140197e10
xchg r12, r15
mov qword [rbp - 0x30], r12
xchg r15, r12
xchg rdi, r12
mov qword [rbp - 0x28], rdi
xchg r12, rdi
lea rax, [rbp - 0x30]
xchg r13, rax
mov qword [rbp + 8], r13
xchg r13, rax
lea r9, [rbp - 0x30]
xor r8d, r8d
xchg rdx, r10
mov r10, qword [rbx + 8]
xchg r10, rdx
xchg r11, rcx
mov r11, rbx
xchg r11, rcx
call fcn.140198ee0
xchg rbx, rax
mov rbx, rax
xchg rbx, rax
lea r11, [rsp + 0x110]
xchg r12, rbx
mov r12, qword [r11 + 0x40]
xchg r12, rbx
xchg r8, rsi
mov r8, qword [r11 + 0x48]
xchg r8, rsi
mov rsp, r11
nop
mov r15, qword [rsp]
add rsp, 8
nop
add rsp, 8
xchg qword [rsp - 8], r14
push rcx
push rax
push rcx
xchg qword [rsp + 0x18], r12
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
xchg qword [rsp - 8], rbp
ret