Function at 0x140001170
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
push rax
mov eax, 1
cmp dword [0x140004148], 0
jne 0x140001370
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
mov r10, qword [rcx + 0x30]
test r10, r10
je 0x14000136e
xor r9d, r9d
mov r8d, 0xdfdfdfdf
jmp 0x1400011cf
mov r9, r11
mov rcx, qword [rcx]
mov r10, qword [rcx + 0x30]
test r10, r10
je 0x140001211
mov rdx, r10
movsxd r10, dword [r10 + 0x3c]
mov r11d, dword [r10 + rdx + 0x88]
test r11, r11
je 0x1400011c3
mov r9d, dword [r11 + rdx + 0xc]
add r11, rdx
mov r10d, dword [r9 + rdx]
and r10d, r8d
cmp r10d, 0x4c44544e
jne 0x1400011c0
mov r10d, dword [r9 + rdx + 4]
and r10d, r8d
mov r9, r11
cmp r10d, 0x4c440e4c
jne 0x1400011c3
jmp 0x14000121d
mov r11, r9
test r9, r9
je 0x14000136e
mov r8d, dword [r11 + 0x18]
mov r9d, dword [r11 + 0x1c]
add r9, rdx
mov r10d, dword [r11 + 0x20]
add r10, rdx
mov r11d, dword [r11 + 0x24]
add r11, rdx
lea rsi, [rdx + 0x12]
lea rax, [rdx - 0xe]
mov qword [rsp], rax
lea rbx, [rdx + 0x32]
xor ecx, ecx
lea r14, [0x140004148]
jmp 0x140001270
add r12, rsi
mov qword [r15 + r14 + 0x10], r12
inc ecx
cmp ecx, 0x1f4
je 0x140001394
test r8, r8
je 0x140001381
dec r8d
mov r15d, dword [r10 + r8*4]
movzx ebp, word [rdx + r15]
cmp ebp, 0x775a
jne 0x140001267
add r15, rdx
mov ebp, 0x4552ac07
mov r12d, 1
xor r13d, r13d
nop word cs:[rax + rax]
mov edi, ebp
movzx r13d, word [r13 + r15]
rol ebp, 0x18
add ebp, r13d
xor ebp, edi
mov r13d, r12d
inc r12d
cmp byte [r15 + r13], 0
jne 0x1400012a0
mov r15d, ecx
shl r15, 4
mov dword [r15 + r14 + 8], ebp
movzx edi, word [r11 + r8*2]
mov r12d, dword [r9 + rdi*4]
mov dword [r15 + r14 + 0xc], r12d
movzx edi, word [rsi + r12]
xor edi, 0x50f
movzx ebp, byte [rsi + r12 + 2]
xor ebp, 0xc3
or bp, di
je 0x140001251
mov rax, qword [rsp]
lea r13, [rax + r12]
add r12, rbx
xor ebp, ebp
nop word cs:[rax + rax]
movzx edi, word [r12 + rbp]
xor edi, 0x50f
movzx eax, byte [r12 + rbp + 2]
xor eax, 0xc3
or ax, di
je 0x14000135e
movzx eax, word [r13]
xor eax, 0x50f
movzx edi, byte [r13 + 2]
xor edi, 0xc3
or di, ax
je 0x140001366
add r13, 0xffffffffffffffe0
add rbp, 0x20
cmp rbp, 0x3fe0
jne 0x140001310
xor r12d, r12d
jmp 0x140001254
add r12, rbp
jmp 0x140001254
mov r12, r13
jmp 0x140001254
xor eax, eax
add rsp, 8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov dword [0x140004148], ecx
mov edx, ecx
dec edx
mov eax, 1
jne 0x1400013ad
jmp 0x140001370
mov dword [0x140004148], 0x1f4
mov ecx, 0x1f4
mov edx, 0x1f3
mov eax, 1
xor r8d, r8d
lea r9, [0x140004168]
mov r10d, edx
jmp 0x1400013c8
dec r10d
cmp r8d, edx
je 0x140001370
mov r10d, r10d
inc r8d
cmp ecx, r8d
je 0x1400013c0
mov r11, r10
mov rsi, r9
jmp 0x1400013e9
add rsi, 0x10
dec r11
je 0x1400013c0
mov edi, dword [rsi - 0x14]
mov ebx, dword [rsi - 4]
cmp edi, ebx
jbe 0x1400013e0
mov r15d, dword [rsi - 0x18]
mov r14, qword [rsi - 0x10]
mov ebp, dword [rsi - 8]
mov dword [rsi - 0x18], ebp
mov dword [rsi - 0x14], ebx
mov rbx, qword [rsi]
mov qword [rsi - 0x10], rbx
mov dword [rsi - 8], r15d
mov dword [rsi - 4], edi
mov qword [rsi], r14
jmp 0x1400013e0