Function at 0x140079c98
Capabilities:
Access peb ldr_data
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xd8
mov rbx, rcx
xor r14d, r14d
mov dword [rbp - 0x75], r14d
call fcn.140079ad8
test rax, rax
je 0x14007a937
lea r8, [rbp + 0x77]
lea rdx, [rbp + 0x6f]
mov rcx, rbx
call fcn.140071edc
mov qword [rbp - 0x41], rax
mov qword [rbp - 0x39], r14
mov dword [rbp - 0x29], r14d
mov rcx, qword [rbp + 0x6f]
mov qword [rbp - 0x31], rcx
mov ecx, dword [rbp + 0x77]
mov dword [rbp - 0x25], ecx
xorps xmm0, xmm0
movups xmmword [rbp - 0x21], xmm0
mov dword [rbp - 0x6d], r14d
mov dword [rbp - 0x6d], 0x876c4d43
mov edx, 0xdde85f29
sub edx, dword [0x14031d050]
sub edx, dword [0x14031d058]
xor edx, 0x28931e95
sub edx, dword [0x14031d048]
mov rcx, qword [0x14031d040]
lea eax, [rcx + 0x2f341b27]
add eax, edx
xor eax, 0xcfff3b7
add eax, 0x4852de1b
xor eax, 0x59574a14
lea edx, [rcx + 0x792a7521]
add edx, eax
not edx
mov eax, dword [0x14031d038]
xor eax, 0xd93f1fba
sub edx, eax
mov r13d, dword [0x14031d030]
xor r13d, 0x26c0e045
add r13d, 0xbff745d5
add r13d, edx
xor r13d, 0x31464d22
mov dword [rbp - 0x6d], r13d
mov dword [rbp + 0x7f], r14d
mov dword [rbp + 0x7f], 0x7a1e25f3
mov eax, 0xc90f24fd
sub eax, dword [0x14031d050]
sub eax, dword [0x14031d058]
xor eax, 0x29100fa9
sub eax, dword [0x14031d048]
mov rcx, qword [0x14031d040]
add eax, 0xafdb1870
add eax, ecx
xor eax, 0xd8c456b
add eax, 0x4834b8c7
xor eax, 0x8194d06c
lea edx, [rcx + 0x79a21cfe]
add edx, eax
not edx
mov eax, dword [0x14031d038]
xor eax, 0xd93d33a6
sub edx, eax
mov ecx, dword [0x14031d030]
xor ecx, 0x26c2cc59
add ecx, 0xbe098dc1
add ecx, edx
xor ecx, 0x133b3cb6
mov dword [rbp + 0x7f], ecx
mov dword [rbp + 0x7f], r14d
mov qword [rbp - 0x61], r14
movabs rax, 0xd56bacbc4f2f0230
mov qword [rbp - 0x61], rax
movabs rax, 0xcd11c4907539e944
sub rax, qword [0x14031d050]
sub rax, qword [0x14031d058]
movabs rcx, 0xf8f8cd9d484fc3f5
xor rax, rcx
sub rax, qword [0x14031d048]
movabs rcx, 0xc7d654c00863ee58
add rcx, rax
mov rdx, qword [0x14031d040]
add rcx, rdx
movabs rax, 0x5a9179adce2e668d
xor rcx, rax
movabs rax, 0x5f627dc63de645a0
sub rcx, rax
movabs rax, 0x6e3b3cd4bf46dc60
xor rcx, rax
movabs rax, 0x3483ce496167fbe2
add rax, rcx
add rdx, rax
not rdx
movabs rcx, 0x13cce94ac510e60c
mov rax, qword [0x14031d038]
xor rax, rcx
sub rdx, rax
movabs rax, 0xec3316b53aef19f3
mov rcx, qword [0x14031d030]
xor rcx, rax
movabs rax, 0xe0b56d7abdcf5d61
add rax, rdx
add rax, rcx
movabs rcx, 0x38d93c9932b58964
xor rax, rcx
mov qword [rbp - 0x51], rax
mov qword [rbp - 0x61], rax
mov qword [rbp - 0x61], r14
mov qword [rbp - 0x59], r14
movabs rax, 0x3ced0bf8b305bde
mov qword [rbp - 0x59], rax
movabs rax, 0xaafd10956d717ec4
sub rax, qword [0x14031d050]
sub rax, qword [0x14031d058]
movabs rcx, 0xf8f8cd9767898987
xor rax, rcx
sub rax, qword [0x14031d048]
movabs rcx, 0x87d654b82d339b54
add rcx, rax
mov rdx, qword [0x14031d040]
add rcx, rdx
movabs rax, 0x5a9179a7343434af
xor rcx, rax
movabs rax, 0x5f627dc68420f52a
sub rcx, rax
movabs rax, 0x923b3cd1da48b1a3
xor rcx, rax
movabs rax, 0xb483ce43c04b9e83
add rax, rcx
add rdx, rax
not rdx
movabs rcx, 0x13cce94adc3764fa
mov rax, qword [0x14031d038]
xor rax, rcx
sub rdx, rax
movabs rax, 0xec3316b523c89b05
mov rcx, qword [0x14031d030]
xor rcx, rax
movabs rax, 0xe0b56d91bb34d1cf
add rax, rdx
add rax, rcx
movabs rcx, 0xfe7e60a2e88856e2
xor rax, rcx
mov qword [rbp - 0x49], rax
mov qword [rbp - 0x59], rax
mov dword [rbp - 0x79], r14d
mov dword [rbp - 0x79], 0x3f31c3f6
mov eax, 0x4ac2bdc2
sub eax, dword [0x14031d050]
sub eax, dword [0x14031d058]
xor eax, 0x31bbffcd
sub eax, dword [0x14031d048]
mov rcx, qword [0x14031d040]
add eax, 0x3b7220c8
add eax, ecx
xor eax, 0x17496eaf
add eax, 0x41f57d33
xor eax, 0xcdd9f93a
lea edx, [rcx - 0x7e0fde81]
add edx, eax
not edx
mov eax, dword [0x14031d038]
xor eax, 0xd91b0c82
sub edx, eax
mov ecx, dword [0x14031d030]
xor ecx, 0x26e4f37d
add ecx, 0x9c00429d
add ecx, edx
xor ecx, 0x1edc817a
mov dword [rbp - 0x79], ecx
mov dword [rbp - 0x69], ecx
mov dword [rbp - 0x79], r14d
movups xmmword [rbp - 0x11], xmm0
movups xmmword [rbp - 1], xmm0
mov edi, r14d
mov r15d, 0x9c3c5a3a
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
movups xmm0, xmmword [rax + 0x58]
movd ecx, xmm0
sub cx, 8
test edi, edi
je 0x14007a0c6
psrldq xmm0, 8
movq r9, xmm0
movzx ecx, cx
shr rcx, 1
lea r11, [r9 + rcx*2]
mov r10d, 0xb818315e
jmp 0x14007a0b8
movsx edx, byte [r9]
mov r8d, edx
imul r8d, edx
add r8d, 0x31
xor r8d, 0x4764996c
mov ecx, r10d
xor ecx, edx
mov r10d, r8d
imul r10d, ecx
add r9, 2
cmp r9, r11
jne 0x14007a092
cmp r10d, edi
jne 0x14007a1e9
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov rcx, qword [rcx + r11 + 0x88]
mov ebx, ecx
add rbx, r11
shr rcx, 0x20
cmp rbx, r11
je 0x14007a1e9
mov esi, dword [rbx + 0x18]
test esi, esi
je 0x14007a1e9
mov r8d, dword [rbx + 0x20]
dec esi
lea rdx, [r11 + rsi*4]
mov r10d, dword [rdx + r8]
add r10, r11
mov r14d, 0xb818315e
mov dl, byte [r10]
inc r10
test dl, dl
je 0x14007a145
movsx r8d, dl
mov r9d, r8d
imul r9d, r8d
add r9d, 0x31
xor r9d, 0x4764996c
mov edx, r14d
xor edx, r8d
mov r14d, r9d
imul r14d, edx
mov dl, byte [r10]
inc r10
test dl, dl
jne 0x14007a114
mov r8d, dword [rbx + 0x20]
cmp r14d, r15d
je 0x14007a156
xor r14d, r14d
test esi, esi
jne 0x14007a0f7
jmp 0x14007a1e9
mov edx, dword [rbx + 0x1c]
add rdx, r11
mov eax, dword [rbx + 0x24]
add rax, r11
movzx eax, word [rax + rsi*2]
mov r10d, dword [rdx + rax*4]
add r10, r11
cmp r10, rbx
jbe 0x14007a1f1
lea rax, [rbx + rcx]
cmp r10, rax
jae 0x14007a1f1
mov edi, 0xb818315e
mov r15d, edi
jmp 0x14007a1a2
movsx ecx, al
mov edx, ecx
imul edx, ecx
add edx, 0x31
xor edx, 0x4764996c
mov eax, edi
xor eax, ecx
mov edi, edx
imul edi, eax
inc r10
mov al, byte [r10]
cmp al, 0x2e
jne 0x14007a185
inc r10
xor r14d, r14d
jmp 0x14007a1d1
movsx ecx, al
mov edx, ecx
imul edx, ecx
add edx, 0x31
xor edx, 0x4764996c
mov eax, r15d
xor eax, ecx
mov r15d, edx
imul r15d, eax
inc r10
mov al, byte [r10]
test al, al
jne 0x14007a1b1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rax, qword [rax]
jmp 0x14007a066
lea rax, [rbp - 0x11]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x69]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp - 0x51]
mov dword [rsp + 0x28], eax
lea rax, [rbp - 0x21]
mov qword [rsp + 0x20], rax
mov rbx, qword [rbp - 0x49]
mov r9d, ebx
lea r8, [rbp - 0x39]
mov edx, r13d
mov rcx, qword [rbp + 0x67]
mov rcx, qword [rcx]
call r10
xor r9d, r9d
test eax, eax
je 0x14007a2c2
mov dword [rbp - 0x71], r9d
mov dword [rbp - 0x71], 0x8057ef76
lea r8d, [r9 + 1]
mov dword [rbp - 0x75], r8d
mov eax, 0xa4866c0b
sub eax, dword [0x14031d050]
sub eax, dword [0x14031d058]
xor eax, 0x28609817
sub eax, dword [0x14031d048]
mov rcx, qword [0x14031d040]
add eax, 0xeef093b5
add eax, ecx
xor eax, 0xcc73549
add eax, 0x485e9501
xor eax, 0x5d3e68c6
lea edx, [rcx - 0x705ee23]
add edx, eax
not edx
mov eax, dword [0x14031d038]
xor eax, 0xd93fe6b8
sub edx, eax
mov ecx, dword [0x14031d030]
xor ecx, 0x26c01947
add ecx, 0xc0bd0ad3
add ecx, edx
xor ecx, 0xd840f508
mov dword [rbp - 0x71], ecx
movsxd rax, ecx
cmp qword [rbp - 0x11], rax
jne 0x14007a2c6
jmp 0x14007a2c9
mov r8d, dword [rbp - 0x75]
mov r13d, r9d
lea eax, [rbx + r13]
test r8b, 1
je 0x14007a2df
and r8d, 0xfffffffe
mov dword [rbp - 0x75], r8d
mov dword [rbp - 0x71], r9d
mov qword [rbp - 0x59], r9
mov dword [rbp - 0x6d], r9d
test eax, eax
je 0x14007a937
movabs rsi, 0xfa45548056bc269e
movabs rax, 0xd2a714770d642000
movabs r15, 0x532c859f30f9be8f
mov r14, qword [0x14031d060]
imul r14, rax
movabs rax, 0x8a9dcde1851a1000
xor r14, rax
mov r12, r14
imul r12, r15
movabs r9, 0xaaaaaaaaaaaaaaab
mov rax, r9
mul r12
shr rdx, 2
lea rax, [rdx + rdx*2]
add rax, rax
mov rcx, r12
sub rcx, rax
lea r11, [0x14031d060]
mov r10, r14
and r10, r15
imul r10, qword [r11 + rcx*8]
movabs rax, 0x14ab6a528cbef904
imul r10, rax
shr r10, 3
movabs rax, 0x765623e784aaf088
xor r10, rax
movabs rax, 0xffffff57ca74208d
mov rdi, r14
imul rdi, rax
sub rdi, 0xd6e1d22
xor rdi, r10
xor rdi, qword [0x14031d060]
mov rax, r10
imul rax, qword [0x14031d070]
movabs rcx, 0xb9de928bc3c79fac
imul rax, rcx
not rax
and rdi, rax
ror rdi, 0x12
shr rdi, 8
movabs r8, 0xacd37a60cf064171
lea rcx, [r14 + r8]
xor rcx, 0xfffffffffd4994a1
mov rax, r9
mul rcx
shr rdx, 2
lea rax, [rdx + rdx*2]
add rax, rax
sub rcx, rax
movabs rax, 0x74891d6139a1aec8
mov rbx, qword [r11 + rcx*8]
imul rbx, rax
add rbx, r15
movabs rcx, 0xfa74a9c51dc35908
mov rax, r10
imul rax, rcx
xor rbx, rax
shr rbx, 0x1f
not rbx
lea rcx, [rbx + r8]
mov rax, r9
mul rcx
shr rdx, 2
lea rax, [rdx + rdx*2]
add rax, rax
sub rcx, rax
movzx eax, bl
movzx ecx, byte [r11 + rcx*8]
imul ecx, eax
movzx ecx, cl
xor ecx, 0xbd
and ecx, 0x8000003f
jge 0x14007a45b
dec ecx
or ecx, 0xffffffc0
inc ecx
mov rdx, rbx
xor rdx, r14
ror rdx, cl
not rdx
imul rdx, r10
imul r13, rdx, 0xfffffffff291e2de
lea r9, [r8 + r13]
movzx r8d, r9b
mov cl, r8b
xor cl, 2
and cl, 0xf
mov r11, rbx
imul r11, rdi
sub r11, r9
xor r11, rsi
rol r11, cl
mov rax, r9
sub rax, qword [0x14031d078]
xor r11, rax
movabs rax, 0x690f7e520fcc7e02
imul rdx, rax
movabs rax, 0x653e19441ff96c1f
add rdx, rax
xor r11, rdx
xor r11, r10
xor r11, r14
mov rax, r11
xor rax, 0xfffffffffffffffe
and eax, 3
je 0x14007a817
sub rax, 1
je 0x14007a6d5
sub rax, 1
je 0x14007a5e0
cmp rax, 1
jne 0x14007a8c5
mov rsi, rbx
imul rsi, r9
movabs rax, 0x1525ab1498f3693d
add rax, r11
xor rsi, rax
ror rsi, 0x2a
shr rsi, 0xc
xor rsi, r14
not rsi
movzx eax, sil
movzx ecx, r11b
imul ecx, eax
and cl, 0x3f
movabs rdx, 0x8357213691aa
add rdx, qword [0x14031d088]
movabs rax, 0xac51ff18a52bf05d
xor rdx, rax
ror rdx, cl
shl rdx, 0xf
movabs rax, 0xf7ca7db979d67d55
sub rax, rbx
mov rbx, rdx
xor rbx, rax
mov rcx, rbx
imul rcx, r15
mov eax, 0xa80dafbf
add rcx, rax
movabs r8, 0xaaaaaaaaaaaaaaab
mov rax, r8
mul rcx
shr rdx, 2
lea rax, [rdx + rdx*2]
add rax, rax
sub rcx, rax
lea r12, [0x14031d060]
mov cl, byte [r12 + rcx*8]
and cl, 0xf
movabs r15, 0xfde53e3b0ba15f48
sub r15, rsi
shr r15, cl
movabs rcx, 0xacdb9ee9299020e5
add rcx, r13
mov rax, r8
mul rcx
shr rdx, 2
lea rax, [rdx + rdx*2]
add rax, rax
sub rcx, rax
mov rax, r11
imul rax, qword [r12 + rcx*8]
imul rax, r11
sub rax, rdi
xor r15, rax
jmp 0x14007a8c5
movabs rax, 0xaaaaaa1aa8145281
mov rcx, r11
xor rcx, rax
movabs rax, 0x1206ed6a198ecd
imul rcx, rax
movabs rdx, 0xfff17ca87f7664fd
mov rax, r10
xor rax, rdx
sub rcx, rax
movabs rax, 0xffff7e8a8e04605d
imul r13, rax
movabs rbx, 0x1f33daa7cf98866a
add rbx, rcx
add rbx, r13
lea ecx, [r11 + 3]
and cl, 0x3f
movabs rax, 0x277cd7be7ac485e1
mov r8, rbx
xor r8, rax
movabs rax, 0xaaaaaaaaaaaaaaab
mul r8
shr rdx, 2
lea rax, [rdx + rdx*2]
add rax, rax
sub r8, rax
mov r9, rbx
not r9
lea rax, [0x14031d060]
imul r9, qword [rax + r8*8]
xor r9, 0xfffffffffd418451
rol r9, cl
movabs rax, 0xf7adfb3d6bb9711f
xor r12, rax
movabs rax, 0x7c7a7dc694468ee0
and r12, rax
imul r9, r12
mov cl, dil
and cl, 0x3f
mov rdx, r9
ror rdx, 2
not rdx
movabs rax, 0x9b2de6b2d4a01f18
imul rdx, rax
mov rax, rbx
sub rax, r9
lea rdx, [rdx + rax*4]
ror rdx, cl
mov rax, r15
mov r15, rdx
imul r15, rax
jmp 0x14007a8c5
movabs rax, 0x45e5cf0318730ae9
imul r11, rax
and r8d, 0x8000003f
jge 0x14007a6f6
dec r8d
or r8d, 0xffffffc0
inc r8d
movabs rax, 0xd79435e50d79435f
mul r11
shr rdx, 4
movzx eax, dl
imul edx, eax, 0x13
mov cl, r11b
sub cl, dl
movabs rdx, 0xacd37a60cf064170
mov rax, r14
imul rax, rdx
xor rax, rsi
not rax
shl rax, cl
xor r10, rax
mov cl, r8b
rol r10, cl
movabs rcx, 0xacd37a60cf064171
add rcx, r11
movabs rax, 0xaaaaaaaaaaaaaaab
mul rcx
shr rdx, 2
lea rax, [rdx + rdx*2]
add rax, rax
sub rcx, rax
movabs rdx, 0x59f30f9be8f
lea rax, [0x14031d060]
mov rax, qword [rax + rcx*8]
imul rax, rdx
xor r10, rax
movabs rax, 0xffffc7a7f4d024ac
or r10, rax
mov r15, qword [0x14031d070]
imul r15, rsi
sub r15, r9
mov rax, rdi
sub rax, r10
xor r15, rax
movabs rax, 0xc7a7c6a6a5d824a1
xor r15, rax
mov r8b, bl
shl r8b, 2
and r8b, 0x3f
movabs rax, 0xcccccccccccccccd
mul r14
shr rdx, 3
lea rax, [rdx + rdx*4]
add rax, rax
mov rcx, r14
sub rcx, rax
or rcx, 1
xor edx, edx
mov rax, r15
div rcx
mov rcx, rdx
mov rdx, r11
imul rdx, r15
imul rdx, r9
shr rdx, cl
mov rax, rbx
sub rax, rdx
sub rax, r14
movabs r14, 0x78958946a8a68bb
add r14, rax
xor r14, rdi
mov cl, r8b
rol r14, cl
not r14
jmp 0x14007a8c5
mov cl, r10b
and cl, 0x3f
movabs rax, 0xaaaaaaaaaaaaaaab
mul r10
shr rdx, 2
lea rax, [rdx + rdx*2]
add rax, rax
mov rdx, r10
sub rdx, rax
mov rax, r11
imul rax, qword [0x14031d080]
lea r8, [0x14031d060]
mov r8, qword [r8 + rdx*8]
and r8, rax
xor r10, r8
ror r10, cl
imul r10, r9
not rdi
imul rdi, rbx
movabs rax, 0x7cd8a7de78297540
imul rdi, rax
mov rax, r10
imul rax, r14
mov r14, rdi
xor r14, rax
mov al, r14b
not al
movzx ecx, al
mov r8, qword [0x14031d068]
movzx eax, r8b
xor ecx, eax
and ecx, 0x8000003f
jge 0x14007a8a4
dec ecx
or ecx, 0xffffffc0
inc ecx
imul rdi, qword [0x14031d060], 0xfffffffff291e2de
sub rdi, r8
ror rdi, cl
movabs rax, 0xacd37a60cf064171
add rdi, rax
add rdi, r13
movabs rcx, 0xff055d7b88627f8d
xor rsi, rcx
movabs rax, 0xaaaaaaaaaaaaaaab
mul rsi
shr rdx, 2
lea rax, [rdx + rdx*2]
add rax, rax
sub rsi, rax
xor r10, r14
lea rax, [0x14031d060]
imul r10, qword [rax + rsi*8]
not r9
imul r9, r11
imul r9, rdi
imul r9, r15
movabs rcx, 0xf5ed7e878fd13551
xor rcx, rbx
not rcx
xor rcx, r9
sub rcx, r10
call fcn.14000135c
mov qword [0x140321f78], rax
mov rax, qword [rbp - 0x21]
add rax, qword [rbp - 0x41]
jmp 0x14007a939
xor eax, eax
add rsp, 0xd8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret