Function at 0x140196a50
Capabilities:
Access peb ldr_data
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
xchg rsi, rdi
mov qword [rsp + 0x20], rdi
xchg rdi, rsi
nop
mov qword [rsp - 8], rbp
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], rdi
push r12
nop
mov qword [rsp - 8], r14
sub rsp, 8
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
xchg r8, rcx
mov rbx, r8
xchg r8, rcx
xor r14d, r14d
xchg r14, r8
mov qword [rcx + 0x10], r8
xchg r14, r8
mov qword [rcx + 0x20], r14
xchg r14, rsi
mov qword [rcx + 0x30], rsi
xchg r14, rsi
mov qword [rcx + 0x40], r14
xchg r14, rbx
mov qword [rcx + 0x50], rbx
xchg rbx, r14
mov qword [rcx + 0x60], r14
mov qword [rcx + 0x70], r14
mov qword [rcx + 0x80], r14
mov qword [rcx + 0x90], r14
xchg r13, r14
mov qword [rcx + 0xa0], r13
xchg r14, r13
xchg rdx, r14
mov qword [rcx + 0xb0], rdx
xchg r14, rdx
mov qword [rcx + 0xc0], r14
mov qword [rcx + 0xd0], r14
xchg r11, r14
mov qword [rcx + 0xe0], r11
xchg r11, r14
mov qword [rcx + 0xf0], r14
xchg r8, r14
mov qword [rcx + 0x100], r8
xchg r8, r14
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
xchg rbp, rax
mov rbp, qword [rcx + 0x18]
xchg rbp, rax
xchg r12, rcx
mov r12, qword [rax + 0x20]
xchg r12, rcx
xchg r15, rax
mov r15, qword [rcx]
xchg r15, rax
mov rdx, qword [rax + 0x20]
xchg rdx, r9
mov qword [rbx], r9
xchg rdx, r9
lea r15, [0x140003e38]
xchg r15, rdx
mov qword [rbp - 0x70], rdx
xchg r15, rdx
lea r12, [0x140198940]
xchg rdx, r12
mov qword [rbp - 0x68], rdx
xchg rdx, r12
lea rax, [rbp - 0x70]
mov qword [rbp - 0x38], rax
lea r9, [rbp - 0x70]
xor r8d, r8d
xchg r14, rcx
mov r14, rbx
xchg r14, rcx
call fcn.1401986a0
mov dword [rsp + 0x30], 0x4c63ca16
sub dword [rsp + 0x30], 0x205c6ee
sub dword [rsp + 0x30], 0x29b5ee4
sub dword [rsp + 0x30], 0x393a2090
add dword [rsp + 0x30], 0x1a6ddc07
xor dword [rsp + 0x30], 0xde901f6
xor dword [rsp + 0x30], 0x4eb565f1
sub dword [rsp + 0x30], 0x2d8c1dba
xor dword [rsp + 0x30], 0xc8e8e8f4
mov dword [rsp + 0x50], 0x3780f976
xor dword [rsp + 0x50], 0x51d8aa68
xor dword [rsp + 0x50], 0x65e1de9d
add dword [rsp + 0x50], 0x2e51b470
add dword [rsp + 0x50], 0x1a7801bd
add dword [rsp + 0x50], 0xb2dabbb6
mov dword [rsp + 0x54], 0x7308b400
sub dword [rsp + 0x54], 0xb349617
xor dword [rsp + 0x54], 0x525b0baa
sub dword [rsp + 0x54], 0x2ba54e43
xor dword [rsp + 0x54], 0x6b347c25
xor dword [rsp + 0x54], 0x39ebb3fd
xor dword [rsp + 0x54], 0x71140066
xor dword [rsp + 0x54], 0xd55ff83d
mov dword [rsp + 0x34], 0x28009e4e
sub dword [rsp + 0x34], 0x14a69625
xor dword [rsp + 0x34], 0x5bd80c80
xor dword [rsp + 0x34], 0x2e5a834d
add dword [rsp + 0x34], 0x10e6fa6a
sub dword [rsp + 0x34], 0x5f1dfeae
add dword [rsp + 0x34], 0x33920920
xor dword [rsp + 0x34], 0xbac57a36
mov dword [rsp + 0x58], 0x51ba1548
sub dword [rsp + 0x58], 0x517d4659
add dword [rsp + 0x58], 0x49bd1da0
sub dword [rsp + 0x58], 0x1a002145
xor dword [rsp + 0x58], 0x153718b3
add dword [rsp + 0x58], 0xc4a12b85
mov dword [rsp + 0x5c], 0x18629eb3
xor dword [rsp + 0x5c], 0x348422d6
add dword [rsp + 0x5c], 0x9d4c855
add dword [rsp + 0x5c], 0xedf2615
xor dword [rsp + 0x5c], 0x6bcc78a6
add dword [rsp + 0x5c], 0xd1062d0e
mov dword [rsp + 0x38], 0x734327a8
xor dword [rsp + 0x38], 0xab1876e
sub dword [rsp + 0x38], 0x4afbfe4e
sub dword [rsp + 0x38], 0x2291c6e2
xor dword [rsp + 0x38], 0x3daef484
add dword [rsp + 0x38], 0x3a9eafc
add dword [rsp + 0x38], 0xc182dce8
mov dword [rsp + 0x60], 0x588ef4bd
add dword [rsp + 0x60], 0x6878933
sub dword [rsp + 0x60], 0x320e70eb
add dword [rsp + 0x60], 0x2540764f
sub dword [rsp + 0x60], 0x47821de4
add dword [rsp + 0x60], 0x70f2d70a
sub dword [rsp + 0x60], 0xa8f9286
sub dword [rsp + 0x60], 0x3a487a83
xor dword [rsp + 0x60], 0xc998d008
mov dword [rsp + 0x64], 0x504b4580
add dword [rsp + 0x64], 0x1655aff7
sub dword [rsp + 0x64], 0x617f6e
add dword [rsp + 0x64], 0x157f754
sub dword [rsp + 0x64], 0x55d46b20
add dword [rsp + 0x64], 0x3ad101f1
xor dword [rsp + 0x64], 0x79385118
xor dword [rsp + 0x64], 0xcacaaa48
mov dword [rsp + 0x3c], 0x31590667
add dword [rsp + 0x3c], 0x4536c8e2
xor dword [rsp + 0x3c], 0x452ef9f2
sub dword [rsp + 0x3c], 0x34cff42
xor dword [rsp + 0x3c], 0x2e5a7716
sub dword [rsp + 0x3c], 0x97b17e7
add dword [rsp + 0x3c], 0x6a7402a6
add dword [rsp + 0x3c], 0x77efcbc8
mov dword [rsp + 0x68], 0xfe1b0c7
add dword [rsp + 0x68], 0x22999b64
xor dword [rsp + 0x68], 0x15c827ac
sub dword [rsp + 0x68], 0x1de44a8e
add dword [rsp + 0x68], 0x33baf276
add dword [rsp + 0x68], 0x630eb7c
add dword [rsp + 0x68], 0xbbc90092
mov dword [rsp + 0x6c], 0x266fd836
add dword [rsp + 0x6c], 0x57b94c4e
sub dword [rsp + 0x6c], 0x48013e72
sub dword [rsp + 0x6c], 0x31c6c9bc
add dword [rsp + 0x6c], 0x2d21ede1
xor dword [rsp + 0x6c], 0x616fd9e
add dword [rsp + 0x6c], 0xc7e907d4
mov dword [rsp + 0x40], 0xee02cfc
add dword [rsp + 0x40], 0x20035f70
add dword [rsp + 0x40], 0x8a2ab10
add dword [rsp + 0x40], 0x1faf408c
add dword [rsp + 0x40], 0x2769739b
xor dword [rsp + 0x40], 0x6987c37f
add dword [rsp + 0x40], 0x87ac987
xor dword [rsp + 0x40], 0x484b385b
add dword [rsp + 0x40], 0x9f1e2cbe
mov dword [rsp + 0x70], 0x312f6eee
sub dword [rsp + 0x70], 0x1c275aa7
add dword [rsp + 0x70], 0x57a436cd
add dword [rsp + 0x70], 0x776fc09
xor dword [rsp + 0x70], 0x352b5321
sub dword [rsp + 0x70], 0x105cc1a
sub dword [rsp + 0x70], 0x20a39714
xor dword [rsp + 0x70], 0x653ab56e
xor dword [rsp + 0x70], 0x8513fb0f
mov dword [rsp + 0x74], 0x45fe3b38
sub dword [rsp + 0x74], 0x159b1df0
sub dword [rsp + 0x74], 0x1994e812
xor dword [rsp + 0x74], 0xb3a55ab
xor dword [rsp + 0x74], 0x6b1a974d
xor dword [rsp + 0x74], 0x89d208ed
mov dword [rsp + 0x44], 0x3a7a0011
add dword [rsp + 0x44], 0x311dff2b
xor dword [rsp + 0x44], 0x2337ab9a
xor dword [rsp + 0x44], 0x280003f7
xor dword [rsp + 0x44], 0x62deff5
add dword [rsp + 0x44], 0xb584db2
xor dword [rsp + 0x44], 0x51d6f456
add dword [rsp + 0x44], 0xd6c604f6
mov dword [rsp + 0x78], 0x4c5dd8f5
add dword [rsp + 0x78], 0x2908e9eb
sub dword [rsp + 0x78], 0x12d1dfcb
sub dword [rsp + 0x78], 0x1279f3e9
xor dword [rsp + 0x78], 0x52b7b8d9
xor dword [rsp + 0x78], 0x317c0435
xor dword [rsp + 0x78], 0x7306bc15
sub dword [rsp + 0x78], 0xa833f4e
xor dword [rsp + 0x78], 0xc92c4fe1
mov dword [rsp + 0x7c], 0x3adf1fc9
sub dword [rsp + 0x7c], 0x1af3881f
xor dword [rsp + 0x7c], 0xb655b54
xor dword [rsp + 0x7c], 0x105c2c94
add dword [rsp + 0x7c], 0x743b99d1
sub dword [rsp + 0x7c], 0x6df19ee5
xor dword [rsp + 0x7c], 0x64096664
sub dword [rsp + 0x7c], 0x354302a0
add dword [rsp + 0x7c], 0xc59c44ec
mov dword [rsp + 0x48], 0x4d33bce2
add dword [rsp + 0x48], 0x2cb2dcbf
sub dword [rsp + 0x48], 0x2fc4f368
sub dword [rsp + 0x48], 0x46e8d0a1
add dword [rsp + 0x48], 0x44980afe
add dword [rsp + 0x48], 0xaf261660
mov dword [rbp - 0x80], 0x5a3eda36
sub dword [rbp - 0x80], 0x2bf539f0
add dword [rbp - 0x80], 0xd45c3a6
add dword [rbp - 0x80], 0x38938af8
sub dword [rbp - 0x80], 0x55a52777
xor dword [rbp - 0x80], 0x73018dc4
xor dword [rbp - 0x80], 0x920ab5df
mov dword [rbp - 0x7c], 0x4762b248
sub dword [rbp - 0x7c], 0x31385328
add dword [rbp - 0x7c], 0x68fc2d43
sub dword [rbp - 0x7c], 0x3afadffa
add dword [rbp - 0x7c], 0xb80a244
sub dword [rbp - 0x7c], 0x3cac9886
add dword [rbp - 0x7c], 0xafd5b90
add dword [rbp - 0x7c], 0xe171ed81
mov word [rsp + 0x4c], 0x3757
sub word [rsp + 0x4c], 0x2ca5
add word [rsp + 0x4c], 0x71e1
sub word [rsp + 0x4c], 0x1a1a
sub word [rsp + 0x4c], 0x2502
xor word [rsp + 0x4c], 0xcb81
mov dword [rbp - 0x78], 0x6c4b8876
add dword [rbp - 0x78], 0x20d2b38
sub dword [rbp - 0x78], 0x23fc2fa6
add dword [rbp - 0x78], 0x3276bceb
sub dword [rbp - 0x78], 0x5b434fc9
xor dword [rbp - 0x78], 0x49c27da1
add dword [rbp - 0x78], 0xd42d6f0
add dword [rbp - 0x78], 0x89e69bfb
xor eax, eax
mov word [rbp - 0x74], ax
nop word [rax + rax]
movzx ecx, word [rsp + rax*2 + 0x50]
movzx edx, byte [rsp + rax + 0x30]
add dx, cx
mov word [rsp + rax*2 + 0x50], dx
mov byte [rsp + rax + 0x30], r14b
inc rax
cmp rax, 0x1e
jb 0x1401970f4
xor r8d, r8d
lea rdx, [rsp + 0x50]
xchg r11, rbx
mov rcx, r11
xchg r11, rbx
call fcn.1401993e0
mov rdi, rax
xchg rcx, r14
mov r14, rcx
xchg r14, rcx
nop word [rax + rax]
mov byte [rsp + rcx + 0x50], 5
add byte [rsp + rcx + 0x50], 0x54
xor byte [rsp + rcx + 0x50], 0x3e
sub byte [rsp + rcx + 0x50], 0x4e
xor byte [rsp + rcx + 0x50], 0x6f
xor byte [rsp + rcx + 0x50], 0x7b
add byte [rsp + rcx + 0x50], 0x20
sub byte [rsp + rcx + 0x50], 0x2d
inc rcx
cmp rcx, 0x3c
jb 0x140197144
mov qword [rsp + 0x28], r14
mov byte [rsp + 0x20], 0x7d
sub byte [rsp + 0x20], 4
sub byte [rsp + 0x20], 0x5e
xor byte [rsp + 0x20], 0xf
add byte [rsp + 0x20], 0x1e
add byte [rsp + 0x20], 0x2e
sub byte [rsp + 0x20], 0x60
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call fcn.14019a4f0
xchg rcx, rax
mov qword [rbx + 8], rcx
xchg rcx, rax
mov qword [rbp + 0x40], rdi
test rdi, rdi
je 0x14019721b
mov dword [rsp + 0x20], 0x5d54c8d1
sub dword [rsp + 0x20], 0x4afb47d2
xor dword [rsp + 0x20], 0x6da3a84f
xor dword [rsp + 0x20], 0x44de2449
sub dword [rsp + 0x20], 0xb870907
xor dword [rsp + 0x20], 0x68fcb5c1
xor dword [rsp + 0x20], 0x75a510ba
xor dword [rsp + 0x20], 0x32c42689
xor r9d, r9d
lea r8, [rbp + 0x40]
lea rdx, [r9 - 1]
lea rcx, [rbx + 0x70]
call fcn.1401975e0
xchg r15, rdi
mov qword [rbp - 0x30], rdi
xchg rdi, r15
mov qword [rbp - 0x28], r12
lea rax, [rbp - 0x30]
mov qword [rbp + 8], rax
lea r9, [rbp - 0x30]
xor r8d, r8d
xchg rdx, rbp
mov rbp, qword [rbx + 8]
xchg rdx, rbp
xchg rbx, r8
mov rcx, r8
xchg rbx, r8
call fcn.1401986a0
xchg rbx, rax
mov rbx, rax
xchg rbx, rax
lea r11, [rsp + 0x110]
xchg rbx, rsi
mov rsi, qword [r11 + 0x40]
xchg rsi, rbx
xchg rsi, rbx
mov rbx, qword [r11 + 0x48]
xchg rbx, rsi
mov rsp, r11
nop
mov r15, qword [rsp]
add rsp, 8
push rax
push rcx
push rdx
push rbx
push rbx
push rdx
push rcx
push rcx
xchg qword [rsp + 0x40], r14
add rsp, 0x48
nop
add rsp, 8
xchg qword [rsp - 8], r12
nop
xchg qword [rsp], rdi
add rsp, 8
push rbx
push rcx
xchg qword [rsp + 0x10], rbp
add rsp, 0x18
nop
add rsp, 8
jmp qword [rsp - 8]