Function at 0x1401b8d98
Capabilities:
Access peb ldr_data
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
xor r9d, r9d
mov edi, r9d
mov esi, 0xa790670e
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
movups xmm0, xmmword [rax + 0x58]
movd ecx, xmm0
sub cx, 8
test edi, edi
je 0x1401b8e28
psrldq xmm0, 8
movq r8, xmm0
movzx ecx, cx
shr rcx, 1
lea r10, [r8 + rcx*2]
mov r9d, 0xff6562ea
jmp 0x1401b8e17
movsx edx, byte [r8]
mov ecx, edx
imul ecx, edx
add ecx, 0x31
xor ecx, 0x4764996c
xor edx, r9d
mov r9d, ecx
imul r9d, edx
add r8, 2
cmp r8, r10
jne 0x1401b8df7
cmp r9d, edi
jne 0x1401b8f4d
xor r9d, r9d
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov rcx, qword [rcx + r10 + 0x88]
mov ebx, ecx
add rbx, r10
shr rcx, 0x20
cmp rbx, r10
je 0x1401b8f4d
mov r14d, dword [rbx + 0x18]
test r14d, r14d
je 0x1401b8f4d
mov r13d, dword [rbx + 0x20]
dec r14d
lea rdx, [r14*4]
add rdx, r13
mov r11d, dword [rdx + r10]
add r11, r10
mov r15d, 0xff6562ea
mov dl, byte [r11]
inc r11
test dl, dl
je 0x1401b8eb4
movsx r8d, dl
mov r9d, r8d
imul r9d, r8d
add r9d, 0x31
xor r9d, 0x4764996c
mov edx, r15d
xor edx, r8d
mov r15d, r9d
imul r15d, edx
mov dl, byte [r11]
inc r11
test dl, dl
jne 0x1401b8e80
mov r13d, dword [rbx + 0x20]
xor r9d, r9d
cmp r15d, esi
je 0x1401b8ec3
test r14d, r14d
jne 0x1401b8e5b
jmp 0x1401b8f4d
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov eax, dword [rbx + 0x24]
add rax, r10
movzx eax, word [rax + r14*2]
mov r8d, dword [rdx + rax*4]
add r8, r10
cmp r8, rbx
jbe 0x1401b8f58
lea rax, [rcx + rbx]
cmp r8, rax
jae 0x1401b8f58
mov edi, 0xff6562ea
mov esi, edi
jmp 0x1401b8f0f
movsx ecx, al
mov edx, ecx
imul edx, ecx
add edx, 0x31
xor edx, 0x4764996c
mov eax, edi
xor eax, ecx
mov edi, edx
imul edi, eax
inc r8
mov al, byte [r8]
cmp al, 0x2e
jne 0x1401b8ef2
jmp 0x1401b8f32
movsx ecx, al
mov edx, ecx
imul edx, ecx
add edx, 0x31
xor edx, 0x4764996c
mov eax, esi
xor eax, ecx
mov esi, edx
imul esi, eax
inc r8
mov al, byte [r8]
test al, al
jne 0x1401b8f18
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rax, qword [rax]
xor r9d, r9d
jmp 0x1401b8dcb
mov dword [rbp + 0x48], r9d
mov dword [rbp + 0x48], 0xd4810803
mov eax, 0x702888e0
sub eax, dword [0x1402b2058]
sub eax, dword [0x1402b2050]
xor eax, 0xcd4c6b81
sub eax, dword [0x1402b2048]
mov rcx, qword [0x1402b2040]
add eax, 0xab5cff81
add eax, ecx
xor eax, 0x5f98eb95
sub eax, 0x65d14b65
xor eax, 0xcd416dc6
lea edx, [rcx + 0xa1edf4a]
add edx, eax
not edx
mov eax, dword [0x1402b2038]
xor eax, 0xa3832a5c
sub edx, eax
mov ecx, dword [0x1402b2030]
xor ecx, 0x5c7cd5a3
add ecx, 0xce45f9c1
add ecx, edx
xor ecx, 0xd3528494
mov dword [rbp + 0x48], ecx
movsxd rcx, ecx
call r8
mov r15, rax
mov qword [rbp - 0x30], rax
xor eax, eax
mov dword [rbp + 0x48], eax
movabs rax, 0x6e0c000000000000
mov r13, qword [0x1402b2060]
mov r12, r13
imul r12, rax
movabs rax, 0x878f000000000000
xor r12, rax
movabs r8, 0xffb4ea594b726b24
mov rcx, r12
imul rcx, r8
movabs r14, 0xaaaaaaaaaaaaaaab
mov rax, r14
mul rcx
shr rdx, 2
lea rax, [rdx + rdx*2]
add rax, rax
sub rcx, rax
lea r10, [0x1402b2060]
mov rdi, r12
and rdi, r8
imul rdi, qword [r10 + rcx*8]
movabs rax, 0x44c5f578ef7f0084
imul rdi, rax
shr rdi, 3
movabs rax, 0xf9e1d777d55233ff
xor rdi, rax
movabs rax, 0xffffff57ff0ff6a3
mov rbx, r12
imul rbx, rax
sub rbx, 0x18361374
xor rbx, rdi
xor rbx, r13
mov rax, rdi
imul rax, qword [0x1402b2070]
movabs rcx, 0xb9de928bf6bc4982
imul rax, rcx
not rax
and rbx, rax
ror rbx, 0x17
shr rbx, 8
movabs r8, 0x4b15a6b48d94dc
lea rcx, [r12 + r8]
xor rcx, 0xffffffffc832428f
mov rax, r14
mul rcx
shr rdx, 2
lea rax, [rdx + rdx*2]
add rax, rax
sub rcx, rax
movabs rax, 0xd5d141e443106e88
mov r11, qword [r10 + rcx*8]
imul r11, rax
sub r11, r8
movabs rcx, 0xee92bf8cc041b830
mov rax, rdi
imul rax, rcx
xor r11, rax
shr r11, 0x1f
not r11
mov r9, r11
xor r9, r12
lea rcx, [r11 + r8]
mov rax, r14
mul rcx
shr rdx, 2
lea rax, [rdx + rdx*2]
add rax, rax
sub rcx, rax
movzx eax, r11b
movzx ecx, byte [r10 + rcx*8]
imul ecx, eax
movzx ecx, cl
xor ecx, 0x93
and ecx, 0x8000003f
jge 0x1401b9147
dec ecx
or ecx, 0xffffffc0
inc ecx
ror r9, cl
not r9
imul r9, rdi
imul rsi, r9, 0xffffffffe7c9ec8c
add r8, rsi
mov r10, r11
imul r10, rbx
sub r10, r8
movabs rax, 0x24d3e304998f5deb
xor r10, rax
mov cl, r8b
xor cl, 0xfc
and cl, 0xf
rol r10, cl
movabs rax, 0xe6b88ac2589bc7b0
imul r9, rax
movabs rax, 0x1a488cf2b0e71d10
sub r9, rax
xor r10, r9
mov rcx, r8
sub rcx, qword [0x1402b2078]
xor r10, rcx
xor r10, rdi
xor r10, r12
mov rax, r14
mul rdi
shr rdx, 2
lea rax, [rdx + rdx*2]
add rax, rax
mov rdx, rdi
sub rdx, rax
mov rax, r10
mov r14, qword [0x1402b2080]
imul rax, r14
lea r9, [0x1402b2060]
mov r9, qword [r9 + rdx*8]
and r9, rax
xor r9, rdi
and dil, 0x3f
mov cl, dil
ror r9, cl
imul r9, r8
not rbx
imul rbx, r11
movabs rax, 0x7cd8a7de4d52a36e
imul rbx, rax
mov rax, r9
imul rax, r12
xor rbx, rax
imul r8, r13, 0xffffffffe7c9ec8c
mov rdx, qword [0x1402b2068]
sub r8, rdx
mov al, bl
not al
movzx ecx, al
movzx eax, dl
xor ecx, eax
and ecx, 0x8000003f
jge 0x1401b923e
dec ecx
or ecx, 0xffffffc0
inc ecx
ror r8, cl
lea rcx, [rsi + r8]
movabs rax, 0xffb4ea594b726b24
imul rcx, rax
movabs rax, 0x1a488cf2b0e71d10
sub rcx, rax
movabs rax, 0xffb4ea594b726b23
sub rax, rsi
imul rcx, rax
imul rcx, r10
movabs rax, 0xf5ed7e87baaae37f
xor r11, rax
not r11
xor rcx, r11
xor r9, rbx
imul r9, r14
sub rcx, r9
call fcn.14016f5f8
mov qword [0x1402b3158], rax
mov dword [rbp - 0x28], 0xfe00695c
xor eax, eax
mov dword [rbp - 0x24], 0x1596c922
mov dword [rbp - 0x20], 0x3da8bb13
mov word [rbp - 0x1c], 0x884c
mov r12d, eax
mov r13, qword [0x1402b2040]
xor edx, edx
mov rax, r12
movabs rcx, 0x13cce94adbe8f3f8
div rcx
add dl, 0x37
mov r14b, dl
sar r14b, 7
or r14b, dl
mov al, r14b
sar al, 2
mov sil, r14b
shl sil, 6
mov dil, sil
or dil, al
movsx rcx, r14b
or sil, al
mov r9b, r14b
sar r9b, 5
mov al, r14b
shl al, 3
or r9b, al
mov r10b, r14b
sar r10b, 3
mov al, r14b
shl al, 5
or r10b, al
mov r8b, r14b
sar r8b, 4
mov al, r14b
shl al, 4
or r8b, al
mov r11b, r14b
not r11b
mov bl, r14b
ror bl, 7
lea eax, [r10 - 0x50]
add bl, al
mov dl, byte [rbp + r12 - 0x28]
sub dl, dil
sub dl, 2
mov eax, 4
sub al, sil
xor dl, al
sar rcx, 1
mov al, r14b
shl al, 7
or cl, al
sub dl, cl
sub dl, byte [0x1402b2050]
sub dl, byte [0x1402b2058]
sub dl, 0x3f
add dl, sil
add dl, r14b
lea eax, [rdi + 7]
add al, r14b
xor dl, al
sub dl, r9b
sub dl, r14b
sub dl, byte [0x1402b2048]
sub dl, 0x50
add dl, sil
add dl, r13b
mov al, r8b
sub al, r9b
add al, dil
add al, r14b
xor dl, al
mov al, r14b
sub al, r8b
xor al, r14b
sub dl, al
sub dl, r10b
add dl, 0x30
add dl, r14b
xor bl, dl
mov al, r14b
add al, al
sub bl, al
add bl, 0x51
add bl, sil
add bl, dil
add bl, r13b
not bl
mov al, r14b
sar al, 7
or al, r14b
sub bl, al
mov al, r11b
xor al, byte [0x1402b2038]
sub bl, al
mov al, r14b
xor al, 0x40
sub bl, al
mov al, r14b
xor al, byte [0x1402b2030]
add bl, al
movsx eax, r14b
movsx ecx, r11b
imul ecx, eax
xor bl, cl
mov byte [rbp + r12 - 0x28], bl
inc r12
cmp r12, 0xe
jb 0x1401b92c5
lea rax, [rbp - 0x28]
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], 0xe
xor r12d, r12d
mov dword [rbp + 0x50], r12d
mov dword [rbp + 0x50], 0xd84c5f9a
mov eax, 0x85fdace3
sub eax, dword [0x1402b2058]
sub eax, dword [0x1402b2050]
xor eax, 0x2e082e4f
sub eax, dword [0x1402b2048]
mov rcx, qword [0x1402b2040]
add eax, 0xd0843e29
add eax, ecx
xor eax, 0xdc6e0147
add eax, 0x728e4381
xor eax, 0xf6a69bad
lea edx, [rcx + 0xb0369fa]
add edx, eax
not edx
mov eax, dword [0x1402b2038]
xor eax, 0x2391feae
sub edx, eax
mov ecx, dword [0x1402b2030]
xor ecx, 0xdc6e0151
add ecx, 0xcb68aa13
add ecx, edx
xor ecx, 0xc9f4430e
mov dword [rbp + 0x50], ecx
movsxd rdx, ecx
lea r8, [rbp - 0x28]
mov rcx, r15
call fcn.14008c3c0
nop
mov dword [rbp + 0x50], r12d
mov dword [rbp + 0x58], r12d
mov dword [rbp + 0x58], 0xd7b3f67f
mov eax, 0xa7815029
sub eax, dword [0x1402b2058]
sub eax, dword [0x1402b2050]
xor eax, 0xa470825
sub eax, dword [0x1402b2048]
mov rcx, qword [0x1402b2040]
add eax, 0xcba21ab5
add eax, ecx
xor eax, 0xa8051598
sub eax, 0x4c27357b
xor eax, 0x52ca7fa5
lea edx, [rcx - 0x64d58cab]
add edx, eax
not edx
mov eax, dword [0x1402b2038]
xor eax, 0xc214f8b0
sub edx, eax
mov ecx, dword [0x1402b2030]
xor ecx, 0x3deb074f
add ecx, 0xbee654b4
add ecx, edx
xor ecx, 0xb0d58e50
mov dword [rbp + 0x58], ecx
call fcn.140227c2c
mov rdx, rax
mov rcx, r15
call fcn.140227d78
nop
mov dword [rbp + 0x58], r12d
mov edi, r12d
mov esi, 0x108464fa
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
movups xmm0, xmmword [rax + 0x58]
movd ecx, xmm0
sub cx, 8
test edi, edi
je 0x1401b95b9
psrldq xmm0, 8
movq r9, xmm0
movzx ecx, cx
shr rcx, 1
lea r11, [r9 + rcx*2]
mov r10d, 0xe7199776
jmp 0x1401b95ab
movsx edx, byte [r9]
mov r8d, edx
imul r8d, edx
add r8d, 0x31
xor r8d, 0x4764996c
mov ecx, r10d
xor ecx, edx
mov r10d, r8d
imul r10d, ecx
add r9, 2
cmp r9, r11
jne 0x1401b9585
cmp r10d, edi
jne 0x1401b96d2
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov rcx, qword [rcx + r10 + 0x88]
mov ebx, ecx
add rbx, r10
shr rcx, 0x20
cmp rbx, r10
je 0x1401b96d2
mov r14d, dword [rbx + 0x18]
test r14d, r14d
je 0x1401b96d2
mov r13d, dword [rbx + 0x20]
dec r14d
lea rdx, [r14*4]
add rdx, r13
mov r11d, dword [rdx + r10]
add r11, r10
mov r15d, 0xe7199776
jmp 0x1401b962c
movsx r8d, dl
mov r9d, r8d
imul r9d, r8d
add r9d, 0x31
xor r9d, 0x4764996c
mov edx, r15d
xor edx, r8d
mov r15d, r9d
imul r15d, edx
mov dl, byte [r11]
inc r11
test dl, dl
jne 0x1401b9609
cmp r15d, esi
je 0x1401b9648
xor r12d, r12d
test r14d, r14d
jne 0x1401b95ec
jmp 0x1401b96d2
mov edx, dword [rbx + 0x24]
add rdx, r10
movzx r8d, word [rdx + r14*2]
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov r9d, dword [rdx + r8*4]
add r9, r10
cmp r9, rbx
jbe 0x1401b96da
lea rax, [rbx + rcx]
cmp r9, rax
jae 0x1401b96da
mov edi, 0xe7199776
mov esi, edi
jmp 0x1401b9691
movsx ecx, al
mov eax, ecx
imul eax, ecx
add eax, 0x31
xor eax, 0x4764996c
xor ecx, edi
mov edi, eax
imul edi, ecx
inc r9
mov al, byte [r9]
cmp al, 0x2e
jne 0x1401b9677
inc r9
xor r12d, r12d
jmp 0x1401b96ba
movsx ecx, al
mov eax, ecx
imul eax, ecx
add eax, 0x31
xor eax, 0x4764996c
xor ecx, esi
mov esi, eax
imul esi, ecx
inc r9
mov al, byte [r9]
test al, al
jne 0x1401b96a0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rax, qword [rax]
jmp 0x1401b9559
mov rcx, qword [rbp - 0x30]
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
jmp r9