Function at 0x140196440
Capabilities:
Access peb ldr_data
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
xchg rsi, r13
mov qword [rsp + 0x20], r13
xchg r13, rsi
nop
mov qword [rsp - 8], rbp
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], rdi
nop
push 0x5d1a1b71
mov qword [rsp], r12
push r14
nop
sub rsp, 8
mov qword [rsp], r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
xchg rcx, rbx
mov rcx, rbx
xchg rbx, rcx
xor r14d, r14d
mov qword [rcx + 0x10], r14
mov qword [rcx + 0x20], r14
mov qword [rcx + 0x30], r14
xchg r14, rsi
mov qword [rcx + 0x40], rsi
xchg r14, rsi
xchg r14, r12
mov qword [rcx + 0x50], r12
xchg r12, r14
mov qword [rcx + 0x60], r14
xchg r15, r14
mov qword [rcx + 0x70], r15
xchg r14, r15
xchg r14, r15
mov qword [rcx + 0x80], r15
xchg r15, r14
xchg r14, rdx
mov qword [rcx + 0x90], rdx
xchg r14, rdx
xchg rdx, r14
mov qword [rcx + 0xa0], rdx
xchg rdx, r14
xchg rbx, r14
mov qword [rcx + 0xb0], rbx
xchg rbx, r14
mov qword [rcx + 0xc0], r14
mov qword [rcx + 0xd0], r14
mov qword [rcx + 0xe0], r14
xchg rbp, r14
mov qword [rcx + 0xf0], rbp
xchg rbp, r14
mov qword [rcx + 0x100], r14
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
xchg rsi, rax
mov rsi, qword [rcx + 0x18]
xchg rsi, rax
xchg rcx, r8
mov r8, qword [rax + 0x20]
xchg r8, rcx
xchg r14, rax
mov r14, qword [rcx]
xchg r14, rax
mov rdx, qword [rax + 0x20]
xchg rdx, r11
mov qword [rbx], r11
xchg rdx, r11
lea r15, [0x140003e38]
xchg r14, r15
mov qword [rbp - 0x70], r14
xchg r15, r14
lea r12, [0x140198350]
mov qword [rbp - 0x68], r12
lea rax, [rbp - 0x70]
mov qword [rbp - 0x38], rax
lea r9, [rbp - 0x70]
xor r8d, r8d
xchg rbx, rcx
mov rbx, rcx
xchg rbx, rcx
call fcn.1401980b0
mov dword [rsp + 0x30], 0x691065f5
sub dword [rsp + 0x30], 0x5fa3ea56
xor dword [rsp + 0x30], 0x6baa9fc8
sub dword [rsp + 0x30], 0x2be12d6d
add dword [rsp + 0x30], 0x4730be62
sub dword [rsp + 0x30], 0xa1970c8
sub dword [rsp + 0x30], 0x269ba1e0
sub dword [rsp + 0x30], 0xb197fa1
add dword [rsp + 0x30], 0xb4af13f3
mov dword [rsp + 0x50], 0x1c6f0335
add dword [rsp + 0x50], 0xa652729
xor dword [rsp + 0x50], 0x5598bc14
xor dword [rsp + 0x50], 0x1957cdca
sub dword [rsp + 0x50], 0x1e796ae3
sub dword [rsp + 0x50], 0x2d06d198
xor dword [rsp + 0x50], 0x68a66735
xor dword [rsp + 0x50], 0x89608756
mov dword [rsp + 0x54], 0x77d3347e
sub dword [rsp + 0x54], 0x598f22b
xor dword [rsp + 0x54], 0x1dbfcb9f
sub dword [rsp + 0x54], 0x17221a6a
xor dword [rsp + 0x54], 0x31faff4b
sub dword [rsp + 0x54], 0x167a5118
xor dword [rsp + 0x54], 0x726a67e5
add dword [rsp + 0x54], 0xde08a68f
mov dword [rsp + 0x34], 0x27e0b1b
add dword [rsp + 0x34], 0xa85eb88
add dword [rsp + 0x34], 0x2c94a16b
sub dword [rsp + 0x34], 0x34db5eeb
xor dword [rsp + 0x34], 0x2a95255
add dword [rsp + 0x34], 0x27ea231f
xor dword [rsp + 0x34], 0x594b95fb
add dword [rsp + 0x34], 0x8241db88
mov dword [rsp + 0x58], 0x6c920db2
sub dword [rsp + 0x58], 0x6753beaf
add dword [rsp + 0x58], 0x67f242a8
xor dword [rsp + 0x58], 0x3819022e
add dword [rsp + 0x58], 0x9e41f20
sub dword [rsp + 0x58], 0x24e6c0b
sub dword [rsp + 0x58], 0x1b0b274a
add dword [rsp + 0x58], 0xbdbbe02e
mov dword [rsp + 0x5c], 0x586f14d9
add dword [rsp + 0x5c], 0xfd9785e
xor dword [rsp + 0x5c], 0x55954242
add dword [rsp + 0x5c], 0x3aa77fe2
sub dword [rsp + 0x5c], 0x1d7bb33d
sub dword [rsp + 0x5c], 0x1b706c83
xor dword [rsp + 0x5c], 0x349a3522
add dword [rsp + 0x5c], 0x194e03ef
xor dword [rsp + 0x5c], 0xdb0de1d3
mov dword [rsp + 0x38], 0x670e43ed
sub dword [rsp + 0x38], 0x5c70cbf8
xor dword [rsp + 0x38], 0x323535ff
xor dword [rsp + 0x38], 0x67437bb4
sub dword [rsp + 0x38], 0x22d5de89
add dword [rsp + 0x38], 0x23640fca
add dword [rsp + 0x38], 0x34004f7
xor dword [rsp + 0x38], 0x1c52f77
xor dword [rsp + 0x38], 0x948ab677
mov dword [rsp + 0x60], 0x34a7a3d9
xor dword [rsp + 0x60], 0x5b7b365f
xor dword [rsp + 0x60], 0x2180db21
xor dword [rsp + 0x60], 0x5d146386
add dword [rsp + 0x60], 0x4656a6f2
add dword [rsp + 0x60], 0x1fda7ec0
sub dword [rsp + 0x60], 0x2a6241c4
sub dword [rsp + 0x60], 0x720a9df
add dword [rsp + 0x60], 0xb7839849
mov dword [rsp + 0x64], 0xc8ef9
add dword [rsp + 0x64], 0x4bea4b0f
sub dword [rsp + 0x64], 0x11653d4b
add dword [rsp + 0x64], 0x2fdf9e08
sub dword [rsp + 0x64], 0x4d31f2d5
add dword [rsp + 0x64], 0x2ee49e66
sub dword [rsp + 0x64], 0xb2e43f9
xor dword [rsp + 0x64], 0xbf935d23
mov dword [rsp + 0x3c], 0x3936f9f4
sub dword [rsp + 0x3c], 0x84b0443
xor dword [rsp + 0x3c], 0x239a038b
add dword [rsp + 0x3c], 0x16fa996b
add dword [rsp + 0x3c], 0x24167005
sub dword [rsp + 0x3c], 0x3e80829
xor dword [rsp + 0x3c], 0x1d98c142
add dword [rsp + 0x3c], 0x9ff4c033
mov dword [rsp + 0x68], 0x141e8120
xor dword [rsp + 0x68], 0xa8ad3d0
xor dword [rsp + 0x68], 0x5a07b8b9
sub dword [rsp + 0x68], 0x14918688
sub dword [rsp + 0x68], 0xbf94ba7
sub dword [rsp + 0x68], 0x16da2f5b
add dword [rsp + 0x68], 0x44ca735d
xor dword [rsp + 0x68], 0x563f1595
add dword [rsp + 0x68], 0xf7bdb5f4
mov dword [rsp + 0x6c], 0xbda85ed
add dword [rsp + 0x6c], 0x530a4af9
add dword [rsp + 0x6c], 0x11b510b0
sub dword [rsp + 0x6c], 0x62a6d829
xor dword [rsp + 0x6c], 0x7fbfef56
add dword [rsp + 0x6c], 0x13427c
sub dword [rsp + 0x6c], 0x71570408
add dword [rsp + 0x6c], 0xfe75dace
mov dword [rsp + 0x40], 0x3f15faa5
add dword [rsp + 0x40], 0x3ff7d833
xor dword [rsp + 0x40], 0x445ed777
sub dword [rsp + 0x40], 0xd133f64
add dword [rsp + 0x40], 0xed113e8
xor dword [rsp + 0x40], 0xcbe62cc5
mov dword [rsp + 0x70], 0x4cd356d9
xor dword [rsp + 0x70], 0x18077929
sub dword [rsp + 0x70], 0x39f020b4
add dword [rsp + 0x70], 0x59bedce9
sub dword [rsp + 0x70], 0x56bf7834
add dword [rsp + 0x70], 0xe1948b7e
mov dword [rsp + 0x74], 0x6297f618
sub dword [rsp + 0x74], 0x151d0546
xor dword [rsp + 0x74], 0x50986f7a
add dword [rsp + 0x74], 0x16bbad76
sub dword [rsp + 0x74], 0x1dfce264
add dword [rsp + 0x74], 0x42db1001
add dword [rsp + 0x74], 0x1908fdf
sub dword [rsp + 0x74], 0x260fe04b
xor dword [rsp + 0x74], 0xcbc1d572
mov dword [rsp + 0x44], 0x5cea174c
sub dword [rsp + 0x44], 0x2b17ee31
add dword [rsp + 0x44], 0x3c18a79a
add dword [rsp + 0x44], 0x1fbfffa
sub dword [rsp + 0x44], 0x21fe9bf6
xor dword [rsp + 0x44], 0xbb1ec24f
mov dword [rsp + 0x78], 0x1491f615
add dword [rsp + 0x78], 0x240edd65
xor dword [rsp + 0x78], 0x6d46525b
xor dword [rsp + 0x78], 0x285c288f
sub dword [rsp + 0x78], 0x18ede061
add dword [rsp + 0x78], 0x9aac3619
mov dword [rsp + 0x7c], 0x4421b09e
sub dword [rsp + 0x7c], 0x231c2ed6
add dword [rsp + 0x7c], 0x1359ed8c
sub dword [rsp + 0x7c], 0xe9a3de5
add dword [rsp + 0x7c], 0x50532cbe
xor dword [rsp + 0x7c], 0x101b5dcc
xor dword [rsp + 0x7c], 0x996dfc9f
mov dword [rsp + 0x48], 0x6f3dd31c
sub dword [rsp + 0x48], 0x259e64d7
xor dword [rsp + 0x48], 0x25cc32ad
sub dword [rsp + 0x48], 0x1f4b9eb6
add dword [rsp + 0x48], 0x10e28a23
sub dword [rsp + 0x48], 0x49412afd
add dword [rsp + 0x48], 0x338b73ea
xor dword [rsp + 0x48], 0xeb10f52
xor dword [rsp + 0x48], 0xb07368e6
mov dword [rbp - 0x80], 0x7a031857
sub dword [rbp - 0x80], 0x3e17906d
sub dword [rbp - 0x80], 0x26b73fd4
add dword [rbp - 0x80], 0x3c8ef041
sub dword [rbp - 0x80], 0xaad9310
add dword [rbp - 0x80], 0x48749b7
add dword [rbp - 0x80], 0x2ec40aae
xor dword [rbp - 0x80], 0x1505dd34
add dword [rbp - 0x80], 0x9011dade
mov dword [rbp - 0x7c], 0x743fa3e0
sub dword [rbp - 0x7c], 0x44be540f
sub dword [rbp - 0x7c], 0x17be7d14
add dword [rbp - 0x7c], 0x16db1575
add dword [rbp - 0x7c], 0x2d698acb
add dword [rbp - 0x7c], 0xa3678c3b
mov word [rsp + 0x4c], 0x636a
sub word [rsp + 0x4c], 0x5a98
xor word [rsp + 0x4c], 0x4ad5
sub word [rsp + 0x4c], 0x182f
sub word [rsp + 0x4c], 0xdcc
add word [rsp + 0x4c], 0x5de8
xor word [rsp + 0x4c], 0x8f02
mov dword [rbp - 0x78], 0x1a2008e1
xor dword [rbp - 0x78], 0x4030891c
xor dword [rbp - 0x78], 0x3fa0253a
xor dword [rbp - 0x78], 0x626f4e2b
xor dword [rbp - 0x78], 0x4427e8b3
sub dword [rbp - 0x78], 0xf3a0362
xor dword [rbp - 0x78], 0x7dbf33af
add dword [rbp - 0x78], 0xb6743224
xor eax, eax
mov word [rbp - 0x74], ax
nop word [rax + rax]
movzx ecx, word [rsp + rax*2 + 0x50]
movzx edx, byte [rsp + rax + 0x30]
add dx, cx
mov word [rsp + rax*2 + 0x50], dx
mov byte [rsp + rax + 0x30], r14b
inc rax
cmp rax, 0x1e
jb 0x140196b1a
xor r8d, r8d
lea rdx, [rsp + 0x50]
xchg rcx, rbx
mov rbx, rcx
xchg rbx, rcx
call fcn.140198e00
xchg rcx, rdi
mov rcx, rax
xchg rcx, rdi
xchg rcx, r14
mov r14, rcx
xchg rcx, r14
nop word [rax + rax]
mov byte [rsp + rcx + 0x50], 0x72
add byte [rsp + rcx + 0x50], 4
sub byte [rsp + rcx + 0x50], 5
sub byte [rsp + rcx + 0x50], 0x28
xor byte [rsp + rcx + 0x50], 0x1c
sub byte [rsp + rcx + 0x50], 0x4e
add byte [rsp + rcx + 0x50], 9
sub byte [rsp + rcx + 0x50], 0x10
inc rcx
cmp rcx, 0x3c
jb 0x140196b70
mov qword [rsp + 0x28], r14
mov byte [rsp + 0x20], 0
xor byte [rsp + 0x20], 0x4f
xor byte [rsp + 0x20], 0x13
xor byte [rsp + 0x20], 0x3b
sub byte [rsp + 0x20], 0x4a
add byte [rsp + 0x20], 2
xor byte [rsp + 0x20], 0x5a
sub byte [rsp + 0x20], 0x45
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
xchg r9, rcx
mov r9, rbx
xchg rcx, r9
call fcn.140199eb0
xchg rsi, rax
mov qword [rbx + 8], rsi
xchg rsi, rax
mov qword [rbp + 0x40], rdi
test rdi, rdi
je 0x140196c5a
mov dword [rsp + 0x20], 0x3f59517b
add dword [rsp + 0x20], 0x2990443a
xor dword [rsp + 0x20], 0x7247cc56
xor dword [rsp + 0x20], 0x4848a8db
add dword [rsp + 0x20], 0x2abf2d5c
sub dword [rsp + 0x20], 0x6d156d7a
xor dword [rsp + 0x20], 0x7a890089
sub dword [rsp + 0x20], 0x3ccda872
xor dword [rsp + 0x20], 0x2d4c8921
xor r9d, r9d
lea r8, [rbp + 0x40]
lea rdx, [r9 - 1]
lea rcx, [rbx + 0x70]
call fcn.140196fd0
xchg r9, r15
mov qword [rbp - 0x30], r9
xchg r9, r15
mov qword [rbp - 0x28], r12
lea rax, [rbp - 0x30]
xchg rdi, rax
mov qword [rbp + 8], rdi
xchg rdi, rax
lea r9, [rbp - 0x30]
xor r8d, r8d
xchg rdx, rsi
mov rsi, qword [rbx + 8]
xchg rdx, rsi
mov rcx, rbx
call fcn.1401980b0
xchg rbx, r15
mov rax, r15
xchg rbx, r15
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
push rcx
xchg qword [rsp + 8], r15
add rsp, 0x10
nop
mov r14, qword [rsp]
add rsp, 8
nop
add rsp, 8
xchg qword [rsp - 8], r12
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
xchg qword [rsp], rbp
add rsp, 8
ret