Function at 0x140196d20
Capabilities:
Access peb ldr_data
Encode data using xor

Disassembly:
xchg r15, rbx
mov qword [rsp + 0x18], r15
xchg rbx, r15
xchg rsi, r11
mov qword [rsp + 0x20], r11
xchg rsi, r11
nop
sub rsp, 8
mov qword [rsp], rbp
push rdi
nop
mov qword [rsp - 8], r12
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r14
nop
sub rsp, 8
mov qword [rsp], r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
xchg rcx, rbp
mov rbx, rbp
xchg rcx, rbp
xor r14d, r14d
mov qword [rcx + 0x10], r14
mov qword [rcx + 0x20], r14
xchg r14, rbp
mov qword [rcx + 0x30], rbp
xchg rbp, r14
xchg r15, r14
mov qword [rcx + 0x40], r15
xchg r14, r15
xchg rsi, r14
mov qword [rcx + 0x50], rsi
xchg r14, rsi
xchg r14, rsi
mov qword [rcx + 0x60], rsi
xchg rsi, r14
xchg r14, r8
mov qword [rcx + 0x70], r8
xchg r8, r14
xchg r14, rsi
mov qword [rcx + 0x80], rsi
xchg r14, rsi
xchg r14, rbp
mov qword [rcx + 0x90], rbp
xchg r14, rbp
xchg r11, r14
mov qword [rcx + 0xa0], r11
xchg r11, r14
xchg r14, r15
mov qword [rcx + 0xb0], r15
xchg r14, r15
xchg r8, r14
mov qword [rcx + 0xc0], r8
xchg r8, r14
xchg r14, rdx
mov qword [rcx + 0xd0], rdx
xchg r14, rdx
xchg r8, r14
mov qword [rcx + 0xe0], r8
xchg r14, r8
mov qword [rcx + 0xf0], r14
xchg rbx, r14
mov qword [rcx + 0x100], rbx
xchg r14, rbx
mov rax, qword gs:[0x30]
xchg rsi, rcx
mov rsi, qword [rax + 0x60]
xchg rsi, rcx
mov rax, qword [rcx + 0x18]
xchg r8, rcx
mov r8, qword [rax + 0x20]
xchg rcx, r8
xchg rdx, rax
mov rdx, qword [rcx]
xchg rdx, rax
mov rdx, qword [rax + 0x20]
mov qword [rbx], rdx
lea r15, [0x140003e38]
mov qword [rbp - 0x70], r15
lea r12, [0x140198be0]
xchg r12, r11
mov qword [rbp - 0x68], r11
xchg r12, r11
lea rax, [rbp - 0x70]
xchg r9, rax
mov qword [rbp - 0x38], r9
xchg r9, rax
lea r9, [rbp - 0x70]
xor r8d, r8d
xchg rsi, rbx
mov rcx, rsi
xchg rbx, rsi
call fcn.140198950
mov dword [rsp + 0x30], 0x6ed91f62
sub dword [rsp + 0x30], 0x52d95a39
add dword [rsp + 0x30], 0x4fe41e2b
xor dword [rsp + 0x30], 0x6de96773
xor dword [rsp + 0x30], 0x2b7184b8
add dword [rsp + 0x30], 0x2e60562e
xor dword [rsp + 0x30], 0xad2da03b
mov dword [rsp + 0x50], 0x75a229cd
sub dword [rsp + 0x50], 0x37e7de2a
xor dword [rsp + 0x50], 0x54ee0e8d
sub dword [rsp + 0x50], 0x2ffd399d
add dword [rsp + 0x50], 0x82688b3
add dword [rsp + 0x50], 0x331abf15
add dword [rsp + 0x50], 0x8ac5ac0d
mov dword [rsp + 0x54], 0x114a23ef
add dword [rsp + 0x54], 0x3baa357
add dword [rsp + 0x54], 0x5eeab5e0
sub dword [rsp + 0x54], 0x1a3ea920
xor dword [rsp + 0x54], 0x5b0dedf1
xor dword [rsp + 0x54], 0x1f6bc972
add dword [rsp + 0x54], 0x478ae0db
add dword [rsp + 0x54], 0x9a1c2e23
mov dword [rsp + 0x34], 0xb855fd7
xor dword [rsp + 0x34], 0x6e5bdcbb
sub dword [rsp + 0x34], 0x442081b3
sub dword [rsp + 0x34], 0x195ba6f7
xor dword [rsp + 0x34], 0xe0f7db1
add dword [rsp + 0x34], 0xf089cf83
mov dword [rsp + 0x58], 0x6a9ae50a
xor dword [rsp + 0x58], 0x5909abc3
xor dword [rsp + 0x58], 0x7d0967c
add dword [rsp + 0x58], 0x45bd616b
xor dword [rsp + 0x58], 0x2f7e6960
xor dword [rsp + 0x58], 0x100bef6d
add dword [rsp + 0x58], 0xb9fb4351
mov dword [rsp + 0x5c], 0x52bccb85
add dword [rsp + 0x5c], 0x118b713a
sub dword [rsp + 0x5c], 0x2ec8e2ac
add dword [rsp + 0x5c], 0x19eddd88
xor dword [rsp + 0x5c], 0x286b1c00
xor dword [rsp + 0x5c], 0x7497ec0d
add dword [rsp + 0x5c], 0xebcb37e1
mov dword [rsp + 0x38], 0x9bacaea
add dword [rsp + 0x38], 0x65d65a6
add dword [rsp + 0x38], 0x4a5372a6
sub dword [rsp + 0x38], 0x4837047f
add dword [rsp + 0x38], 0x604bed10
xor dword [rsp + 0x38], 0x84767d31
mov dword [rsp + 0x60], 0x65ffc294
add dword [rsp + 0x60], 0xf8a4ab8
add dword [rsp + 0x60], 0x81a265f
sub dword [rsp + 0x60], 0x762bb50f
xor dword [rsp + 0x60], 0x6a75027c
add dword [rsp + 0x60], 0x28e8463
sub dword [rsp + 0x60], 0x167d20d5
xor dword [rsp + 0x60], 0x9f52a2b
xor dword [rsp + 0x60], 0xaf92353c
mov dword [rsp + 0x64], 0x4bf6a56a
xor dword [rsp + 0x64], 0x7e68b047
sub dword [rsp + 0x64], 0x2f6a3cf9
add dword [rsp + 0x64], 0x527e6d69
add dword [rsp + 0x64], 0x27087fcc
xor dword [rsp + 0x64], 0x52a5e787
add dword [rsp + 0x64], 0xd247dc90
mov dword [rsp + 0x3c], 0x31c56bee
add dword [rsp + 0x3c], 0x1a21f336
sub dword [rsp + 0x3c], 0x2dd6177a
add dword [rsp + 0x3c], 0x595955c3
sub dword [rsp + 0x3c], 0x36914d87
add dword [rsp + 0x3c], 0xb61da710
mov dword [rsp + 0x68], 0x791fa637
sub dword [rsp + 0x68], 0xe042ebc
sub dword [rsp + 0x68], 0x18d4f476
xor dword [rsp + 0x68], 0x19a2c686
xor dword [rsp + 0x68], 0x56c7f3d
sub dword [rsp + 0x68], 0x1fc30caa
xor dword [rsp + 0x68], 0x5ba3995b
add dword [rsp + 0x68], 0x8a1d482e
mov dword [rsp + 0x6c], 0x7f2b7a32
sub dword [rsp + 0x6c], 0x70a6e2
sub dword [rsp + 0x6c], 0x5b908981
add dword [rsp + 0x6c], 0x3bc6abd
xor dword [rsp + 0x6c], 0x38e4b963
add dword [rsp + 0x6c], 0x2971ba63
sub dword [rsp + 0x6c], 0x43053b79
xor dword [rsp + 0x6c], 0x703c31e9
add dword [rsp + 0x6c], 0x8b2c424d
mov dword [rsp + 0x40], 0x17e6f0e4
xor dword [rsp + 0x40], 0x781601a4
sub dword [rsp + 0x40], 0x4ad41ac
sub dword [rsp + 0x40], 0xc5c7274
sub dword [rsp + 0x40], 0x20635b95
sub dword [rsp + 0x40], 0x193718fc
xor dword [rsp + 0x40], 0xd3ba3e79
mov dword [rsp + 0x70], 0x762d3809
sub dword [rsp + 0x70], 0x208c01ac
xor dword [rsp + 0x70], 0x1c54c283
xor dword [rsp + 0x70], 0x43831878
add dword [rsp + 0x70], 0x56ba20b0
add dword [rsp + 0x70], 0x9e46f219
mov dword [rsp + 0x74], 0x3ada4899
sub dword [rsp + 0x74], 0x2b0c77bb
add dword [rsp + 0x74], 0x12cb0bbf
sub dword [rsp + 0x74], 0x165b8668
xor dword [rsp + 0x74], 0x7e112e0a
sub dword [rsp + 0x74], 0x1405e72c
sub dword [rsp + 0x74], 0x40765b97
xor dword [rsp + 0x74], 0x626a2b4c
xor dword [rsp + 0x74], 0x80e6e10d
mov dword [rsp + 0x44], 0x66df9a5f
xor dword [rsp + 0x44], 0x2c462825
sub dword [rsp + 0x44], 0x47e6ba37
add dword [rsp + 0x44], 0x669b8bab
xor dword [rsp + 0x44], 0x1f398c77
xor dword [rsp + 0x44], 0x390912fe
add dword [rsp + 0x44], 0x2d11db1e
xor dword [rsp + 0x44], 0x231a4a38
add dword [rsp + 0x44], 0x97614439
mov dword [rsp + 0x78], 0x1a8f162
xor dword [rsp + 0x78], 0x777830a4
sub dword [rsp + 0x78], 0x4df424e9
xor dword [rsp + 0x78], 0x245acb08
xor dword [rsp + 0x78], 0x6ff31a76
sub dword [rsp + 0x78], 0x62c4618a
add dword [rsp + 0x78], 0x389b8b0d
add dword [rsp + 0x78], 0x1f5a1e34
add dword [rsp + 0x78], 0xa6d26a0c
mov dword [rsp + 0x7c], 0x3b221848
sub dword [rsp + 0x7c], 0x7d47c69
xor dword [rsp + 0x7c], 0x7a658f64
xor dword [rsp + 0x7c], 0x3e2de9e5
xor dword [rsp + 0x7c], 0x781fd382
xor dword [rsp + 0x7c], 0x4bfe01f6
xor dword [rsp + 0x7c], 0x628411a5
add dword [rsp + 0x7c], 0xd90ec0ef
mov dword [rsp + 0x48], 0x261daa84
add dword [rsp + 0x48], 0x2be0e32c
add dword [rsp + 0x48], 0x2834fe8a
sub dword [rsp + 0x48], 0x4bc561e0
sub dword [rsp + 0x48], 0x241efbbb
xor dword [rsp + 0x48], 0x5b218384
add dword [rsp + 0x48], 0xa58849db
mov dword [rbp - 0x80], 0x34cc6947
sub dword [rbp - 0x80], 0x10d34fc9
add dword [rbp - 0x80], 0x32368116
sub dword [rbp - 0x80], 0x39b37b04
add dword [rbp - 0x80], 0x28c121c2
add dword [rbp - 0x80], 0xba39be24
mov dword [rbp - 0x7c], 0x1f74237d
xor dword [rbp - 0x7c], 0x1018b180
sub dword [rbp - 0x7c], 0x4baae5f
add dword [rbp - 0x7c], 0xd00bde4
xor dword [rbp - 0x7c], 0x332687e5
xor dword [rbp - 0x7c], 0x6d7b441e
xor dword [rbp - 0x7c], 0xb6819e41
mov word [rsp + 0x4c], 0x5348
xor word [rsp + 0x4c], 0xf75
add word [rsp + 0x4c], 0x1987
sub word [rsp + 0x4c], 0x42e7
add word [rsp + 0x4c], 0x809
add word [rsp + 0x4c], 0x317d
add word [rsp + 0x4c], 0x3dc
xor word [rsp + 0x4c], 0x6e4c
xor word [rsp + 0x4c], 0xe885
mov dword [rbp - 0x78], 0x210f3185
xor dword [rbp - 0x78], 0x75f8a66e
xor dword [rbp - 0x78], 0x51c2fcab
xor dword [rbp - 0x78], 0x20fca60e
add dword [rbp - 0x78], 0x48b4e93d
sub dword [rbp - 0x78], 0x216145ee
add dword [rbp - 0x78], 0xdeae2eb
sub dword [rbp - 0x78], 0x22b46308
xor dword [rbp - 0x78], 0xc7250ff6
xor eax, eax
mov word [rbp - 0x74], ax
nop word [rax + rax]
movzx ecx, word [rsp + rax*2 + 0x50]
movzx edx, byte [rsp + rax + 0x30]
add dx, cx
mov word [rsp + rax*2 + 0x50], dx
mov byte [rsp + rax + 0x30], r14b
inc rax
cmp rax, 0x1e
jb 0x1401973e3
xor r8d, r8d
lea rdx, [rsp + 0x50]
xchg rcx, rdx
mov rdx, rbx
xchg rcx, rdx
call fcn.140199670
xchg rdi, rax
mov rax, rdi
xchg rdi, rax
xchg r14, rbp
mov rcx, rbp
xchg r14, rbp
nop word [rax + rax]
mov byte [rsp + rcx + 0x50], 0x5e
add byte [rsp + rcx + 0x50], 0x1b
add byte [rsp + rcx + 0x50], 4
xor byte [rsp + rcx + 0x50], 0x69
xor byte [rsp + rcx + 0x50], 0x29
add byte [rsp + rcx + 0x50], 0x27
sub byte [rsp + rcx + 0x50], 0x64
inc rcx
cmp rcx, 0x3c
jb 0x140197437
xchg r14, r10
mov qword [rsp + 0x28], r10
xchg r14, r10
mov byte [rsp + 0x20], 0x34
add byte [rsp + 0x20], 0x3a
xor byte [rsp + 0x20], 0x17
xor byte [rsp + 0x20], 0xb
xor byte [rsp + 0x20], 0x5a
xor byte [rsp + 0x20], 0x55
xor byte [rsp + 0x20], 6
sub byte [rsp + 0x20], 0x2e
sub byte [rsp + 0x20], 0x4d
xor r9d, r9d
xor r8d, r8d
xchg rdx, rdi
mov rdi, rdx
xchg rdx, rdi
mov rcx, rbx
call fcn.14019a7b0
xchg r12, rax
mov qword [rbx + 8], r12
xchg r12, rax
xchg rdi, r11
mov qword [rbp + 0x40], r11
xchg r11, rdi
test rdi, rdi
je 0x14019751d
mov dword [rsp + 0x20], 0x45b80fd3
xor dword [rsp + 0x20], 0x28acd10f
sub dword [rsp + 0x20], 0x1a311e4b
add dword [rsp + 0x20], 0x2b4ed12
sub dword [rsp + 0x20], 0x182a7a0b
add dword [rsp + 0x20], 0x515a269
sub dword [rsp + 0x20], 0x42835601
xor r9d, r9d
lea r8, [rbp + 0x40]
lea rdx, [r9 - 1]
lea rcx, [rbx + 0x70]
call fcn.1401978b0
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x28], r12
lea rax, [rbp - 0x30]
xchg rdi, rax
mov qword [rbp + 8], rdi
xchg rdi, rax
lea r9, [rbp - 0x30]
xor r8d, r8d
mov rdx, qword [rbx + 8]
xchg r12, rbx
mov rcx, r12
xchg rbx, r12
call fcn.140198950
mov rax, rbx
lea r11, [rsp + 0x110]
xchg r9, rbx
mov r9, qword [r11 + 0x40]
xchg rbx, r9
xchg r12, rsi
mov r12, qword [r11 + 0x48]
xchg rsi, r12
mov rsp, r11
push rax
xchg qword [rsp + 8], r15
add rsp, 0x10
nop
xchg qword [rsp], r14
add rsp, 8
nop
add rsp, 8
xchg qword [rsp - 8], r12
nop
mov rdi, qword [rsp]
add rsp, 8
push rbx
xchg qword [rsp + 8], rbp
add rsp, 0x10
nop
add rsp, 8
jmp qword [rsp - 8]