Function at 0x140196cf0
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
xchg r12, rbx
mov qword [rsp + 0x18], r12
xchg rbx, r12
xchg rbp, rsi
mov qword [rsp + 0x20], rbp
xchg rsi, rbp
nop
push 0xd78fdfd
mov qword [rsp], rbp
nop
mov qword [rsp - 8], rdi
sub rsp, 8
push r12
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
xchg rcx, rbx
mov rcx, rbx
xchg rbx, rcx
xor r14d, r14d
xchg r14, rdx
mov qword [rcx + 0x10], rdx
xchg r14, rdx
mov qword [rcx + 0x20], r14
mov qword [rcx + 0x30], r14
mov qword [rcx + 0x40], r14
mov qword [rcx + 0x50], r14
mov qword [rcx + 0x60], r14
mov qword [rcx + 0x70], r14
xchg r15, r14
mov qword [rcx + 0x80], r15
xchg r14, r15
xchg r14, r8
mov qword [rcx + 0x90], r8
xchg r8, r14
mov qword [rcx + 0xa0], r14
mov qword [rcx + 0xb0], r14
mov qword [rcx + 0xc0], r14
mov qword [rcx + 0xd0], r14
mov qword [rcx + 0xe0], r14
mov qword [rcx + 0xf0], r14
xchg r15, r14
mov qword [rcx + 0x100], r15
xchg r14, r15
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x18]
xchg rcx, r11
mov r11, qword [rax + 0x20]
xchg rcx, r11
xchg rbx, rax
mov rbx, qword [rcx]
xchg rbx, rax
xchg rdi, rdx
mov rdi, qword [rax + 0x20]
xchg rdi, rdx
xchg rdx, r15
mov qword [rbx], r15
xchg rdx, r15
lea r15, [0x140003e38]
mov qword [rbp - 0x70], r15
lea r12, [0x140198c80]
xchg r12, rdx
mov qword [rbp - 0x68], rdx
xchg r12, rdx
lea rax, [rbp - 0x70]
xchg r9, rax
mov qword [rbp - 0x38], r9
xchg r9, rax
lea r9, [rbp - 0x70]
xor r8d, r8d
xchg rbp, rbx
mov rcx, rbp
xchg rbp, rbx
call fcn.1401989c0
mov dword [rsp + 0x30], 0x75a2be68
xor dword [rsp + 0x30], 0x7533ffe0
xor dword [rsp + 0x30], 0x42df01e8
xor dword [rsp + 0x30], 0xe69ff35
xor dword [rsp + 0x30], 0x34d2931d
sub dword [rsp + 0x30], 0x5c3c9b85
sub dword [rsp + 0x30], 0xf3726c5
add dword [rsp + 0x30], 0xe9758cf8
mov dword [rsp + 0x50], 0x3062c146
sub dword [rsp + 0x50], 0xfad4bac
sub dword [rsp + 0x50], 0x4d85290
add dword [rsp + 0x50], 0x4343048f
add dword [rsp + 0x50], 0x3b0f410
add dword [rsp + 0x50], 0x46b44c1
xor dword [rsp + 0x50], 0x98619f0c
mov dword [rsp + 0x54], 0x4249fa7f
xor dword [rsp + 0x54], 0x5c94359b
add dword [rsp + 0x54], 0x8a38157
add dword [rsp + 0x54], 0x3df650b1
sub dword [rsp + 0x54], 0x5cb7e38a
xor dword [rsp + 0x54], 0x44259a41
add dword [rsp + 0x54], 0x45d1009
sub dword [rsp + 0x54], 0x3a4543ab
add dword [rsp + 0x54], 0xe8cc0f02
mov dword [rsp + 0x34], 0x3d90b86b
xor dword [rsp + 0x34], 0x41c1271d
sub dword [rsp + 0x34], 0x5c4cb6cf
sub dword [rsp + 0x34], 0x8780533
add dword [rsp + 0x34], 0xf79c202
add dword [rsp + 0x34], 0x37516538
add dword [rsp + 0x34], 0x989eec48
mov dword [rsp + 0x58], 0x7208ea59
sub dword [rsp + 0x58], 0x5c78c005
xor dword [rsp + 0x58], 0x2701181b
add dword [rsp + 0x58], 0x21738287
add dword [rsp + 0x58], 0x21371d4c
sub dword [rsp + 0x58], 0x305f695c
xor dword [rsp + 0x58], 0x246be07b
add dword [rsp + 0x58], 0x19b31a79
add dword [rsp + 0x58], 0x85055c48
mov dword [rsp + 0x5c], 0x335a5229
sub dword [rsp + 0x5c], 0x43e9616
add dword [rsp + 0x5c], 0x1a2bc024
add dword [rsp + 0x5c], 0x175d24ef
xor dword [rsp + 0x5c], 0x402873cb
add dword [rsp + 0x5c], 0x1dfc881f
add dword [rsp + 0x5c], 0xc0d3a46b
mov dword [rsp + 0x38], 0x2ef8af0b
add dword [rsp + 0x38], 0x1988239b
sub dword [rsp + 0x38], 0x30478e0
sub dword [rsp + 0x38], 0x3002bd8b
add dword [rsp + 0x38], 0x3de18904
sub dword [rsp + 0x38], 0x4f385868
add dword [rsp + 0x38], 0x22b859d8
add dword [rsp + 0x38], 0x4a6598bc
xor dword [rsp + 0x38], 0x87b6499d
mov dword [rsp + 0x60], 0x18c20acc
add dword [rsp + 0x60], 0x3a1725d4
add dword [rsp + 0x60], 0x23468726
xor dword [rsp + 0x60], 0x7af1f353
add dword [rsp + 0x60], 0x23674cc4
add dword [rsp + 0x60], 0x2ad1d8f3
add dword [rsp + 0x60], 0x1585d4
xor dword [rsp + 0x60], 0x468e0d53
xor dword [rsp + 0x60], 0xe2cb020a
mov dword [rsp + 0x64], 0x556e3168
add dword [rsp + 0x64], 0x17873389
sub dword [rsp + 0x64], 0x34f44d8e
xor dword [rsp + 0x64], 0x57286beb
sub dword [rsp + 0x64], 0x296b5fdd
xor dword [rsp + 0x64], 0x6a40599d
add dword [rsp + 0x64], 0x2fd0daf0
xor dword [rsp + 0x64], 0xa0a9df58
mov dword [rsp + 0x3c], 0x26b787e5
add dword [rsp + 0x3c], 0x2ddef65d
add dword [rsp + 0x3c], 0x179ede72
sub dword [rsp + 0x3c], 0x4792681b
sub dword [rsp + 0x3c], 0x8c5ae86
xor dword [rsp + 0x3c], 0x7f92b452
add dword [rsp + 0x3c], 0x92a704b5
mov dword [rsp + 0x68], 0x5142e73b
sub dword [rsp + 0x68], 0x2f3597d4
add dword [rsp + 0x68], 0x2752c26b
add dword [rsp + 0x68], 0x28d232ce
xor dword [rsp + 0x68], 0x4846851b
add dword [rsp + 0x68], 0xc50f3dc2
mov dword [rsp + 0x6c], 0x4b7d0bf
xor dword [rsp + 0x6c], 0x16688c97
add dword [rsp + 0x6c], 0x5b3bdfa9
xor dword [rsp + 0x6c], 0x7e0a4778
add dword [rsp + 0x6c], 0x2cae579f
add dword [rsp + 0x6c], 0x33da5ee4
xor dword [rsp + 0x6c], 0x680011d4
sub dword [rsp + 0x6c], 0xd799d9
xor dword [rsp + 0x6c], 0xe8bc7662
mov dword [rsp + 0x40], 0x377f1d85
xor dword [rsp + 0x40], 0x298411f9
add dword [rsp + 0x40], 0x4018f71f
sub dword [rsp + 0x40], 0x4a6ec40f
xor dword [rsp + 0x40], 0xfa8842e
sub dword [rsp + 0x40], 0xb930322
add dword [rsp + 0x40], 0x563584c8
add dword [rsp + 0x40], 0x12170f63
add dword [rsp + 0x40], 0x7f2faa4b
mov dword [rsp + 0x70], 0x13ae6385
add dword [rsp + 0x70], 0x4a7aa4e3
sub dword [rsp + 0x70], 0x42675654
add dword [rsp + 0x70], 0x23ac9f2
xor dword [rsp + 0x70], 0x6f4b840f
add dword [rsp + 0x70], 0x8cc00766
mov dword [rsp + 0x74], 0x76cf147
xor dword [rsp + 0x74], 0x47a6be10
sub dword [rsp + 0x74], 0x25ae9454
add dword [rsp + 0x74], 0x1ef6e8fc
add dword [rsp + 0x74], 0x22fe06e
sub dword [rsp + 0x74], 0x30d30e34
sub dword [rsp + 0x74], 0x28f96a0
xor dword [rsp + 0x74], 0x338e6930
xor dword [rsp + 0x74], 0xc46d4994
mov dword [rsp + 0x44], 0x25496633
sub dword [rsp + 0x44], 0x1576ed2e
xor dword [rsp + 0x44], 0x7a9cc2d
sub dword [rsp + 0x44], 0x3193036
xor dword [rsp + 0x44], 0xbde7ab1
xor dword [rsp + 0x44], 0x2d99ca26
xor dword [rsp + 0x44], 0x308dcfea
add dword [rsp + 0x44], 0x1668a025
add dword [rsp + 0x44], 0xcce55b42
mov dword [rsp + 0x78], 0x26146796
xor dword [rsp + 0x78], 0x2527e47c
add dword [rsp + 0x78], 0x6fa5df6b
sub dword [rsp + 0x78], 0x19c094e1
xor dword [rsp + 0x78], 0x4cef9f6a
add dword [rsp + 0x78], 0x17c58e9f
add dword [rsp + 0x78], 0xd1bc1fa9
mov dword [rsp + 0x7c], 0xdfd878c
add dword [rsp + 0x7c], 0x4af6bf84
sub dword [rsp + 0x7c], 0x38971a7a
add dword [rsp + 0x7c], 0x48b53244
xor dword [rsp + 0x7c], 0x67954aa1
add dword [rsp + 0x7c], 0x1a35df6b
sub dword [rsp + 0x7c], 0xa6ced38
add dword [rsp + 0x7c], 0xe11ef8d0
mov dword [rsp + 0x48], 0x23eedba4
add dword [rsp + 0x48], 0x159f78cd
add dword [rsp + 0x48], 0x39089501
sub dword [rsp + 0x48], 0x2288afd0
xor dword [rsp + 0x48], 0x7a8b0bf0
sub dword [rsp + 0x48], 0x1e3c2829
add dword [rsp + 0x48], 0x68b89d91
sub dword [rsp + 0x48], 0xfd1b1ef
xor dword [rsp + 0x48], 0x93d9033d
mov dword [rbp - 0x80], 0x6c52d8f1
xor dword [rbp - 0x80], 0x274cfe99
xor dword [rbp - 0x80], 0x3180f3c6
sub dword [rbp - 0x80], 0x606aa773
add dword [rbp - 0x80], 0x56b6b34a
sub dword [rbp - 0x80], 0x9ea0c7c
xor dword [rbp - 0x80], 0x6ae29181
xor dword [rbp - 0x80], 0xb22b449
add dword [rbp - 0x80], 0xf8b60eb5
mov dword [rbp - 0x7c], 0x11144220
add dword [rbp - 0x7c], 0x3071c368
sub dword [rbp - 0x7c], 0x27de64b4
add dword [rbp - 0x7c], 0x56cedbf4
xor dword [rbp - 0x7c], 0x771fd33f
add dword [rbp - 0x7c], 0x2858d81c
xor dword [rbp - 0x7c], 0xbb7e79a
add dword [rbp - 0x7c], 0xdaf98faf
mov word [rsp + 0x4c], 0x57bd
add word [rsp + 0x4c], 0x237e
sub word [rsp + 0x4c], 0x3d98
xor word [rsp + 0x4c], 0x10f2
add word [rsp + 0x4c], 0x24cb
sub word [rsp + 0x4c], 0x59b
add word [rsp + 0x4c], 0x332e
sub word [rsp + 0x4c], 0x3b0a
add word [rsp + 0x4c], 0xb251
mov dword [rbp - 0x78], 0x1120cd13
xor dword [rbp - 0x78], 0x5313418f
sub dword [rbp - 0x78], 0x3b78ba6d
xor dword [rbp - 0x78], 0x7df49b57
sub dword [rbp - 0x78], 0x45f3f494
sub dword [rbp - 0x78], 0x4b7dfc6
add dword [rbp - 0x78], 0x6b5fa91
xor dword [rbp - 0x78], 0x76fb5ee8
add dword [rbp - 0x78], 0xbdd3ce2f
xor eax, eax
mov word [rbp - 0x74], ax
nop word [rax + rax]
movzx ecx, word [rsp + rax*2 + 0x50]
movzx edx, byte [rsp + rax + 0x30]
add dx, cx
mov word [rsp + rax*2 + 0x50], dx
mov byte [rsp + rax + 0x30], r14b
inc rax
cmp rax, 0x1e
jb 0x1401973e3
xor r8d, r8d
lea rdx, [rsp + 0x50]
xchg rbx, rsi
mov rcx, rsi
xchg rsi, rbx
call fcn.1401996b0
xchg r8, rax
mov rdi, r8
xchg r8, rax
mov rcx, r14
nop word [rax + rax]
mov byte [rsp + rcx + 0x50], 0x38
add byte [rsp + rcx + 0x50], 4
sub byte [rsp + rcx + 0x50], 0x25
xor byte [rsp + rcx + 0x50], 0x5d
xor byte [rsp + rcx + 0x50], 0xe
sub byte [rsp + rcx + 0x50], 0x3e
add byte [rsp + rcx + 0x50], 0x60
sub byte [rsp + rcx + 0x50], 0x66
inc rcx
cmp rcx, 0x3c
jb 0x140197431
mov qword [rsp + 0x28], r14
mov byte [rsp + 0x20], 0x28
sub byte [rsp + 0x20], 0xf
add byte [rsp + 0x20], 0x57
sub byte [rsp + 0x20], 6
add byte [rsp + 0x20], 0x10
xor byte [rsp + 0x20], 0xd
sub byte [rsp + 0x20], 0x31
sub byte [rsp + 0x20], 0x46
xor r9d, r9d
xor r8d, r8d
xchg r10, rdx
mov r10, rdi
xchg rdx, r10
xchg rcx, r13
mov r13, rbx
xchg rcx, r13
call fcn.14019a810
xchg rcx, rax
mov qword [rbx + 8], rcx
xchg rcx, rax
mov qword [rbp + 0x40], rdi
test rdi, rdi
je 0x140197521
mov dword [rsp + 0x20], 0x62c1f8a8
sub dword [rsp + 0x20], 0x4b3cf70
add dword [rsp + 0x20], 0x55d24ab
xor dword [rsp + 0x20], 0x3dbf7505
xor dword [rsp + 0x20], 0x7390f25c
xor dword [rsp + 0x20], 0x16c8cb27
add dword [rsp + 0x20], 0x29c7b34
xor dword [rsp + 0x20], 0x73753439
xor dword [rsp + 0x20], 0x4d5dc8e8
xor r9d, r9d
lea r8, [rbp + 0x40]
lea rdx, [r9 - 1]
lea rcx, [rbx + 0x70]
call fcn.1401978b0
mov qword [rbp - 0x30], r15
xchg r12, r15
mov qword [rbp - 0x28], r15
xchg r12, r15
lea rax, [rbp - 0x30]
mov qword [rbp + 8], rax
lea r9, [rbp - 0x30]
xor r8d, r8d
mov rdx, qword [rbx + 8]
mov rcx, rbx
call fcn.1401989c0
xchg r13, rax
mov r13, rbx
xchg r13, rax
lea r11, [rsp + 0x110]
xchg rdi, rbx
mov rdi, qword [r11 + 0x40]
xchg rdi, rbx
xchg r13, rsi
mov r13, qword [r11 + 0x48]
xchg rsi, r13
mov rsp, r11
push rax
push rbx
push rdx
push rcx
push rcx
push rcx
push rax
push rdx
xchg qword [rsp + 0x40], r15
add rsp, 0x48
push rbx
push rcx
push rax
xchg qword [rsp + 0x18], r14
pop rax
pop rcx
pop rbx
add rsp, 8
push rcx
push rbx
push rax
push rdx
push rdx
xchg qword [rsp + 0x28], r12
add rsp, 0x30
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov rbp, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]