Function at 0x140197240
Capabilities:
Access peb ldr_data
Encode data using xor

Disassembly:
xchg rbx, r11
mov qword [rsp + 0x18], r11
xchg rbx, r11
mov qword [rsp + 0x20], rsi
push rbp
nop
mov qword [rsp - 8], rdi
sub rsp, 8
push r12
push r14
nop
mov qword [rsp - 8], r15
sub rsp, 8
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rbx, rcx
xor r14d, r14d
xchg rbx, r14
mov qword [rcx + 0x10], rbx
xchg r14, rbx
xchg rdx, r14
mov qword [rcx + 0x20], rdx
xchg r14, rdx
mov qword [rcx + 0x30], r14
xchg r14, rsi
mov qword [rcx + 0x40], rsi
xchg r14, rsi
mov qword [rcx + 0x50], r14
mov qword [rcx + 0x60], r14
mov qword [rcx + 0x70], r14
mov qword [rcx + 0x80], r14
xchg rdi, r14
mov qword [rcx + 0x90], rdi
xchg r14, rdi
mov qword [rcx + 0xa0], r14
mov qword [rcx + 0xb0], r14
mov qword [rcx + 0xc0], r14
xchg r9, r14
mov qword [rcx + 0xd0], r9
xchg r14, r9
xchg r14, rbp
mov qword [rcx + 0xe0], rbp
xchg r14, rbp
xchg rbx, r14
mov qword [rcx + 0xf0], rbx
xchg r14, rbx
mov qword [rcx + 0x100], r14
mov rax, qword gs:[0x30]
xchg rcx, r13
mov r13, qword [rax + 0x60]
xchg r13, rcx
xchg r14, rax
mov r14, qword [rcx + 0x18]
xchg r14, rax
xchg rdi, rcx
mov rdi, qword [rax + 0x20]
xchg rcx, rdi
xchg rdx, rax
mov rdx, qword [rcx]
xchg rdx, rax
xchg rdx, rdi
mov rdi, qword [rax + 0x20]
xchg rdx, rdi
mov qword [rbx], rdx
lea r15, [0x140003e38]
mov qword [rbp - 0x70], r15
lea r12, [0x140199120]
mov qword [rbp - 0x68], r12
lea rax, [rbp - 0x70]
mov qword [rbp - 0x38], rax
lea r9, [rbp - 0x70]
xor r8d, r8d
xchg rbx, r10
mov rcx, r10
xchg rbx, r10
call fcn.140198e60
mov dword [rsp + 0x30], 0x6efb4186
sub dword [rsp + 0x30], 0x63dd3366
add dword [rsp + 0x30], 0x4578d2de
xor dword [rsp + 0x30], 0x548066d6
xor dword [rsp + 0x30], 0x69fcbf8a
xor dword [rsp + 0x30], 0xf47e0c9
add dword [rsp + 0x30], 0x94491d8b
mov dword [rsp + 0x50], 0x3eefa882
sub dword [rsp + 0x50], 0x2f2d5875
add dword [rsp + 0x50], 0x189efcc5
xor dword [rsp + 0x50], 0x781e3700
sub dword [rsp + 0x50], 0x2592cdb8
add dword [rsp + 0x50], 0x43f9c4f5
sub dword [rsp + 0x50], 0x17fe5aaa
add dword [rsp + 0x50], 0xa875e701
mov dword [rsp + 0x54], 0x44df4d56
sub dword [rsp + 0x54], 0x16b4d1ee
add dword [rsp + 0x54], 0xea811b3
xor dword [rsp + 0x54], 0x53d7dc79
sub dword [rsp + 0x54], 0x5f2b0bea
xor dword [rsp + 0x54], 0x6bcae329
xor dword [rsp + 0x54], 0x1a5b6f5b
add dword [rsp + 0x54], 0x81323679
mov dword [rsp + 0x34], 0x1d317dfa
sub dword [rsp + 0x34], 0x20eeb7b
add dword [rsp + 0x34], 0x149b6d06
sub dword [rsp + 0x34], 0x906924a
sub dword [rsp + 0x34], 0x12cbc8f2
add dword [rsp + 0x34], 0xe30b52ad
mov dword [rsp + 0x58], 0x74c3dce5
sub dword [rsp + 0x58], 0x65607ba1
sub dword [rsp + 0x58], 0xa823c6d
add dword [rsp + 0x58], 0x7abfe1c5
xor dword [rsp + 0x58], 0x295d4712
sub dword [rsp + 0x58], 0x48b67328
xor dword [rsp + 0x58], 0x36a3b27d
xor dword [rsp + 0x58], 0x3c999dbc
add dword [rsp + 0x58], 0xfaf01dd7
mov dword [rsp + 0x5c], 0x5d078918
sub dword [rsp + 0x5c], 0x330e1133
add dword [rsp + 0x5c], 0x32c39c43
sub dword [rsp + 0x5c], 0x1cbd64ec
sub dword [rsp + 0x5c], 0x14d7ce07
sub dword [rsp + 0x5c], 0x29992a5
add dword [rsp + 0x5c], 0xd6ceb0e7
mov dword [rsp + 0x38], 0x25daae93
xor dword [rsp + 0x38], 0x269b4bd1
add dword [rsp + 0x38], 0x1483b867
sub dword [rsp + 0x38], 0x6e61518
add dword [rsp + 0x38], 0x1063700c
xor dword [rsp + 0x38], 0x6162a37d
add dword [rsp + 0x38], 0xb6d69b16
mov dword [rsp + 0x60], 0x5ed6485a
sub dword [rsp + 0x60], 0x37d7ebcb
add dword [rsp + 0x60], 0x4224a45c
sub dword [rsp + 0x60], 0x1d5874ad
add dword [rsp + 0x60], 0x2390d32
xor dword [rsp + 0x60], 0x8013bb0
add dword [rsp + 0x60], 0x54f94f2
sub dword [rsp + 0x60], 0x2a027dbd
add dword [rsp + 0x60], 0xde2a4584
mov dword [rsp + 0x64], 0x2f5ae913
add dword [rsp + 0x64], 0xbbc74ae
add dword [rsp + 0x64], 0x2c9dc736
add dword [rsp + 0x64], 0x363621
sub dword [rsp + 0x64], 0x4419b83f
add dword [rsp + 0x64], 0x1a2a0753
add dword [rsp + 0x64], 0x37afe416
sub dword [rsp + 0x64], 0x56d86aca
add dword [rsp + 0x64], 0xe093dc06
mov dword [rsp + 0x3c], 0x78f0c097
xor dword [rsp + 0x3c], 0x245cd1de
add dword [rsp + 0x3c], 0x2ce1fe0
xor dword [rsp + 0x3c], 0x407c6ad3
add dword [rsp + 0x3c], 0x26e8f9bc
xor dword [rsp + 0x3c], 0x678198a8
xor dword [rsp + 0x3c], 0xd4983be8
mov dword [rsp + 0x68], 0x1dd5f9e4
add dword [rsp + 0x68], 0x24530729
xor dword [rsp + 0x68], 0x165aaa00
xor dword [rsp + 0x68], 0x44ef0330
add dword [rsp + 0x68], 0x4e541ca6
xor dword [rsp + 0x68], 0x3e2a04a9
sub dword [rsp + 0x68], 0x253bf8c3
xor dword [rsp + 0x68], 0xc41d38fa
mov dword [rsp + 0x6c], 0x5def97ce
xor dword [rsp + 0x6c], 0x5c7c350a
xor dword [rsp + 0x6c], 0x6fd053d6
sub dword [rsp + 0x6c], 0x512a0b72
add dword [rsp + 0x6c], 0x2c0e7d5d
add dword [rsp + 0x6c], 0x95c6b32
add dword [rsp + 0x6c], 0xacfa314e
mov dword [rsp + 0x40], 0x7e0faf92
sub dword [rsp + 0x40], 0x6097991f
add dword [rsp + 0x40], 0x3aac2b09
sub dword [rsp + 0x40], 0x4d0425ca
add dword [rsp + 0x40], 0x3586e073
sub dword [rsp + 0x40], 0x172942ae
add dword [rsp + 0x40], 0x39b3f661
xor dword [rsp + 0x40], 0x95c7592e
mov dword [rsp + 0x70], 0x73032852
sub dword [rsp + 0x70], 0x3f6d7acd
xor dword [rsp + 0x70], 0x2a8ac6d4
sub dword [rsp + 0x70], 0x4987d9a
add dword [rsp + 0x70], 0x2c8bf09c
add dword [rsp + 0x70], 0xb451adb
add dword [rsp + 0x70], 0x1a40f03e
add dword [rsp + 0x70], 0x98df1603
mov dword [rsp + 0x74], 0x59d32330
sub dword [rsp + 0x74], 0x4acade7b
xor dword [rsp + 0x74], 0x33985b1
add dword [rsp + 0x74], 0x3b27cbc4
xor dword [rsp + 0x74], 0x3fe1237
add dword [rsp + 0x74], 0xba95603e
mov dword [rsp + 0x44], 0x46dba295
sub dword [rsp + 0x44], 0x9e6ca88
add dword [rsp + 0x44], 0x259c4c9b
sub dword [rsp + 0x44], 0x148bc513
sub dword [rsp + 0x44], 0x30fcdfcf
add dword [rsp + 0x44], 0xd9ee7730
mov dword [rsp + 0x78], 0x5e806f88
sub dword [rsp + 0x78], 0xaebb825
xor dword [rsp + 0x78], 0x3f52d635
sub dword [rsp + 0x78], 0x30ae5db9
xor dword [rsp + 0x78], 0x4b832199
add dword [rsp + 0x78], 0x87dddd62
mov dword [rsp + 0x7c], 0x32ae13f4
add dword [rsp + 0x7c], 0x3e0fc71a
sub dword [rsp + 0x7c], 0x52146068
add dword [rsp + 0x7c], 0x3dc2ce2
add dword [rsp + 0x7c], 0x434ca699
sub dword [rsp + 0x7c], 0xd9b3ded
xor dword [rsp + 0x7c], 0x4a9c37f8
add dword [rsp + 0x7c], 0x1a6ccd30
add dword [rsp + 0x7c], 0xd2570a82
mov dword [rsp + 0x48], 0x7c5100d0
xor dword [rsp + 0x48], 0x6c9a940e
add dword [rsp + 0x48], 0x4a26db98
sub dword [rsp + 0x48], 0x2d86d184
add dword [rsp + 0x48], 0x4f7a5d76
xor dword [rsp + 0x48], 0x4396dff3
xor dword [rsp + 0x48], 0x12dccc9c
add dword [rsp + 0x48], 0xc94707ef
mov dword [rbp - 0x80], 0x1d6b78a3
xor dword [rbp - 0x80], 0x59a7f4df
xor dword [rbp - 0x80], 0x7392ef54
sub dword [rbp - 0x80], 0x41d8c96
add dword [rbp - 0x80], 0x486227ad
xor dword [rbp - 0x80], 0x28fc0c27
add dword [rbp - 0x80], 0x1cd2061
add dword [rbp - 0x80], 0xaa4aecfd
mov dword [rbp - 0x7c], 0x23bf619f
add dword [rbp - 0x7c], 0x4a88aa39
xor dword [rbp - 0x7c], 0xb772074
sub dword [rbp - 0x7c], 0x3a5c7033
xor dword [rbp - 0x7c], 0x6f341e5e
sub dword [rbp - 0x7c], 0x3214c6f0
xor dword [rbp - 0x7c], 0xecaf210f
mov word [rsp + 0x4c], 0x5148
sub word [rsp + 0x4c], 0x4a9c
sub word [rsp + 0x4c], 0x5d
add word [rsp + 0x4c], 0x3c91
add word [rsp + 0x4c], 0x2741
add word [rsp + 0x4c], 0x8cd5
mov dword [rbp - 0x78], 0x7b6c000e
add dword [rbp - 0x78], 0x314db04
xor dword [rbp - 0x78], 0x557bf62d
xor dword [rbp - 0x78], 0x6102cf71
xor dword [rbp - 0x78], 0xc2465fc
sub dword [rbp - 0x78], 0x338d12d2
add dword [rbp - 0x78], 0x3b972360
xor dword [rbp - 0x78], 0xb1916736
xor eax, eax
mov word [rbp - 0x74], ax
nop word [rax + rax]
movzx ecx, word [rsp + rax*2 + 0x50]
movzx edx, byte [rsp + rax + 0x30]
add dx, cx
mov word [rsp + rax*2 + 0x50], dx
mov byte [rsp + rax + 0x30], r14b
inc rax
cmp rax, 0x1e
jb 0x1401978bf
xor r8d, r8d
lea rdx, [rsp + 0x50]
xchg rcx, r8
mov r8, rbx
xchg rcx, r8
call fcn.140199ba0
mov rdi, rax
xchg r12, rcx
mov r12, r14
xchg r12, rcx
nop word [rax + rax]
mov byte [rsp + rcx + 0x50], 0x4c
add byte [rsp + rcx + 0x50], 0xf
add byte [rsp + rcx + 0x50], 0x1a
xor byte [rsp + rcx + 0x50], 0x73
xor byte [rsp + rcx + 0x50], 0x4a
add byte [rsp + rcx + 0x50], 0x23
sub byte [rsp + rcx + 0x50], 0x2c
sub byte [rsp + rcx + 0x50], 0x43
inc rcx
cmp rcx, 0x3c
jb 0x14019790f
mov qword [rsp + 0x28], r14
mov byte [rsp + 0x20], 8
add byte [rsp + 0x20], 0x6a
sub byte [rsp + 0x20], 0x2d
sub byte [rsp + 0x20], 0x3a
xor byte [rsp + 0x20], 0x17
xor byte [rsp + 0x20], 0x1c
xor r9d, r9d
xor r8d, r8d
xchg rdi, r12
mov rdx, r12
xchg rdi, r12
xchg rcx, rbp
mov rbp, rbx
xchg rbp, rcx
call fcn.14019aca0
xchg rdx, rax
mov qword [rbx + 8], rdx
xchg rdx, rax
xchg rsi, rdi
mov qword [rbp + 0x40], rsi
xchg rsi, rdi
test rdi, rdi
je 0x1401979eb
mov dword [rsp + 0x20], 0x6e532a1e
sub dword [rsp + 0x20], 0x27ce866a
add dword [rsp + 0x20], 0x3597f624
sub dword [rsp + 0x20], 0x2a5cd461
sub dword [rsp + 0x20], 0x2be46179
xor dword [rsp + 0x20], 0x3d729149
sub dword [rsp + 0x20], 0x18a972b7
xor r9d, r9d
lea r8, [rbp + 0x40]
lea rdx, [r9 - 1]
lea rcx, [rbx + 0x70]
call fcn.140197da0
xchg r15, r13
mov qword [rbp - 0x30], r13
xchg r13, r15
mov qword [rbp - 0x28], r12
lea rax, [rbp - 0x30]
xchg rsi, rax
mov qword [rbp + 8], rsi
xchg rsi, rax
lea r9, [rbp - 0x30]
xor r8d, r8d
xchg r15, rdx
mov r15, qword [rbx + 8]
xchg rdx, r15
xchg rbx, rcx
mov rbx, rcx
xchg rbx, rcx
call fcn.140198e60
xchg rbx, r13
mov rax, r13
xchg rbx, r13
lea r11, [rsp + 0x110]
xchg rbx, r10
mov r10, qword [r11 + 0x40]
xchg rbx, r10
xchg rsi, rdi
mov rdi, qword [r11 + 0x48]
xchg rsi, rdi
mov rsp, r11
push rbx
push rax
push rcx
push rax
push rax
push rax
push rdx
xchg qword [rsp + 0x38], r15
add rsp, 0x40
push rbx
push rbx
push rbx
push rax
push rbx
push rdx
xchg qword [rsp + 0x30], r14
pop rdx
pop rbx
pop rax
pop rbx
pop rbx
pop rbx
add rsp, 8
nop
mov r12, qword [rsp]
add rsp, 8
nop
xchg qword [rsp], rdi
add rsp, 8
push rbx
push rdx
push rcx
push rdx
xchg qword [rsp + 0x20], rbp
add rsp, 0x28
ret