Function at 0x41b160
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Check os version
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0x30]
sub esp, 0x36c
test byte [eax + 0x68], 0x70
push ebx
push esi
push edi
jne 0x41b38a
mov esi, dword fs:[0x30]
lea eax, [esp + 0x170]
push 0x208
push 0
push eax
call 0xfcfcb1ab
mov eax, dword [esi + 0x10]
add esp, 0xc
xor ecx, ecx
mov edx, dword [eax + 0x3c]
mov eax, edx
test eax, eax
je 0x41b1ba
cmp word [eax], cx
je 0x41b1ba
lea eax, [eax + 2]
inc ecx
cmp word [eax], 0
jne 0x41b1b0
lea eax, [ecx + ecx]
push eax
push edx
lea eax, [esp + 0x178]
push eax
call 0xdcfcb1dd
add esp, 0xc
mov dword [esp + 0x24], 0
lea eax, [esp + 0x38]
mov word [esp + 0x28], 0x500
push eax
push 8
push 0xffffffffffffffff
call dword [0x420324]
mov ebx, dword [0x420158]
test eax, eax
je 0x41b27f
lea eax, [esp + 0x40]
push eax
push 0x4c
lea eax, [esp + 0x128]
push eax
push 1
push dword [esp + 0x48]
call dword [0x420038]
push dword [esp + 0x38]
test eax, eax
jne 0x41b222
call ebx
jmp 0x41b27f
call ebx
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x12
push 1
lea eax, [esp + 0x4c]
push eax
call dword [0x420020]
test eax, eax
je 0x41b27f
push dword [esp + 0x1c]
push dword [esp + 0x124]
call dword [0x42001c]
push dword [esp + 0x1c]
mov esi, eax
call dword [0x420028]
test esi, esi
je 0x41b27f
lea ecx, [esp + 0x170]
call 0x9cefb388
test eax, eax
jne 0x41b38a
push 0x427948
call dword [0x420314]
call dword [0x42013c]
push eax
call dword [0x4202f0]
mov edi, dword [0x4202fc]
add esp, 4
xor esi, esi
lea ebx, [esi + 0x19]
call edi
cdq
idiv ebx
add dl, 0x61
mov byte [esp + esi + 0x6c], dl
inc esi
cmp esi, 0xf
jl 0x41b2a5
mov eax, dword [esp + 0x74]
lea ecx, [esp + 0x18]
movq xmm0, qword [esp + 0x6c]
mov dword [0x427928], eax
mov ax, word [esp + 0x78]
mov word [0x42792c], ax
mov al, byte [esp + 0x7a]
mov byte [0x42792e], al
mov eax, dword fs:[0x30]
mov byte [0x42792f], 0
movq qword [0x427920], xmm0
mov dword [esp + 0x18], 0
mov eax, dword [eax + 0x10]
push ecx
push dword [eax + 0x44]
call dword [0x4201c0]
cmp dword [esp + 0x18], 2
mov ebx, dword [0x420158]
mov dword [esp + 0xc], eax
jge 0x41b819
xor edx, edx
mov ecx, 0x409810
call 0x1cfdb33a
push 0xc8
call dword [0x420188]
mov edi, dword [section..rdata]
push 0xf003f
push 0
push 0
call edi
mov esi, dword [0x420048]
test eax, eax
jne 0x41b3e7
cmp dword fs:[0x34], 5
jne 0x41b3e7
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], 0
call 0x4cffb383
cmp dword [esp + 0x20], 0
je 0x41b392
call 0x7d2bb48f
lea ecx, [esp + 0x170]
call 0x9d1db49b
push 0
call dword [0x420150]
movaps xmm0, xmmword [0x4245f0]
xor ecx, ecx
movups xmmword [esp + 0x7e], xmm0
mov dword [esp + 0x9e], 0x1061a15
movaps xmm0, xmmword [0x424640]
movups xmmword [esp + 0x8e], xmm0
mov byte [esp + 0xa2], 0
mov al, byte [esp + 0x7e]
xor byte [esp + ecx + 0x7f], al
inc ecx
cmp ecx, 0x23
jb 0x41b3c2
lea eax, [esp + 0x7f]
mov byte [esp + 0xa2], 0
push eax
call 0xacd1b3f3
add esp, 4
jmp 0x41b3ea
push eax
call esi
call 0x3d01b400
test eax, eax
jne 0x41b38a
xor ecx, ecx
call 0xcd5b50b
mov eax, dword fs:[0x20]
xorps xmm0, xmm0
mov dword [esp + 0x58], eax
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x10c]
mov dword [esp + 0x40], 0
push eax
push 0x60000
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0
push eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x3c], 0
mov word [esp + 0x40], 0x100
mov dword [esp + 0x118], 0x18
movups xmmword [esp + 0x11c], xmm0
mov dword [esp + 0x12c], 0
mov dword [esp + 0x6c], 0
call dword [0x420334]
and eax, 0xc0000000
cmp eax, 0xc0000000
je 0x41b5aa
mov eax, dword [esp + 0x14]
test eax, eax
je 0x41b5b5
push 0
push 0
lea ecx, [esp + 0x44]
push ecx
push 0
push 0
push 4
push 6
push eax
call dword [0x420040]
test eax, eax
jne 0x41b5aa
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
lea eax, [esp + 0x54]
push eax
call dword [0x42033c]
test eax, eax
je 0x41b5aa
push 2
push 0xc
lea eax, [esp + 0x68]
push eax
push dword [esp + 0x48]
call dword [0x420338]
push dword [esp + 0xc]
call dword [0x420344]
mov ecx, dword [esp + 0x64]
add ecx, 0x10
lea esi, [ecx + eax*2]
push esi
call dword [0x4202f4]
mov edi, eax
add esp, 4
test edi, edi
je 0x41b59e
push 4
push esi
push edi
call dword [0x420354]
test eax, eax
je 0x41b58e
push dword [esp + 0xc]
push 1
push 4
push edi
call dword [0x420350]
test eax, eax
je 0x41b58e
xor esi, esi
cmp dword [esp + 0x60], esi
jbe 0x41b579
mov ebx, dword [0x420330]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
push esi
push dword [esp + 0x44]
call ebx
test eax, eax
je 0x41b58e
mov ecx, dword [esp + 0x10]
movzx eax, word [ecx + 2]
push eax
push ecx
push 0xffffffffffffffff
push 4
push edi
call dword [0x420340]
test eax, eax
je 0x41b58e
inc esi
cmp esi, dword [esp + 0x60]
jb 0x41b541
push 0
push edi
push 0
push 0
push 4
push 6
push dword [esp + 0x2c]
call dword [0x42003c]
push edi
call dword [0x4202f8]
mov ebx, dword [0x420158]
add esp, 4
mov edi, dword [section..rdata]
mov esi, dword [0x420048]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x41b5b5
push eax
call ebx
mov eax, dword [esp + 0xc]
test eax, eax
je 0x41b5c4
push eax
call dword [0x42034c]
lea eax, [esp + 0x37]
push eax
push 0
push 1
push 9
call dword [0x420348]
push 0xf003f
push 0
push 0
call edi
test eax, eax
jne 0x41b5f2
cmp dword fs:[0x34], 5
jne 0x41b5f2
xor ebx, ebx
jmp 0x41b5fa
push eax
call esi
mov ebx, 1
xor edx, edx
mov ecx, 0x41bbe0
call 0x1cfdb617
test ebx, ebx
je 0x41b618
xor edx, edx
mov ecx, 0x40db80
call 0x1cfdb627
jmp 0x41b61c
mov eax, dword [esp + 0x40]
mov dword [esp + 0x10], eax
call 0xdd03b736
test eax, eax
jne 0x41b694
movaps xmm0, xmmword [0x424560]
xor ecx, ecx
movups xmmword [esp + 0xa3], xmm0
mov word [esp + 0xc3], 0x16
movaps xmm0, xmmword [0x424620]
movups xmmword [esp + 0xb3], xmm0
nop dword [eax]
nop word [eax + eax]
mov al, byte [esp + 0xa3]
xor byte [esp + ecx + 0xa4], al
inc ecx
cmp ecx, 0x20
jb 0x41b660
lea eax, [esp + 0xa4]
mov byte [esp + 0xc4], 0
push eax
call 0xacd1b69a
add esp, 4
push 0
call dword [0x420150]
xor edx, edx
mov ecx, 0x409990
call 0x1cfdb6b1
xor edx, edx
mov ecx, 0x40a290
call 0x1cfdb6bd
mov edi, dword [0x42013c]
call edi
mov esi, eax
call 0x6cd7b6cc
call edi
mov edi, eax
mov eax, 0x31b5d43b
sub edi, esi
mul edi
mov eax, 0x95217cb1
mov esi, edx
shr esi, 0x18
imul ecx, esi, 0xfad9a400
add edi, ecx
mov ecx, 1
mul edi
mov eax, edx
shr eax, 0x15
mov dword [esp + 0x1c], eax
imul eax, eax, 0xffc91180
add edi, eax
mov eax, 0x45e7b273
mul edi
mov eax, edx
shr eax, 0xe
mov dword [esp + 0x20], eax
imul eax, eax, 0xea60
sub edi, eax
mov eax, 0x10624dd3
mul edi
mov edi, edx
shr edi, 6
call 0xcd5b82c
call dword [0x4200e8]
push eax
call dword [0x4201f4]
test eax, eax
je 0x41b7c1
movaps xmm0, xmmword [0x4249f0]
xor ecx, ecx
movups xmmword [esp + 0xc5], xmm0
mov word [esp + 0x105], 0x4651
movaps xmm0, xmmword [0x424900]
movups xmmword [esp + 0xd5], xmm0
mov byte [esp + 0x107], 0
movaps xmm0, xmmword [0x424b50]
movups xmmword [esp + 0xe5], xmm0
movaps xmm0, xmmword [0x424be0]
movups xmmword [esp + 0xf5], xmm0
mov al, byte [esp + 0xc5]
xor byte [esp + ecx + 0xc6], al
inc ecx
cmp ecx, 0x41
jb 0x41b780
push edi
push dword [esp + 0x24]
lea eax, [esp + 0xce]
mov byte [esp + 0x10f], 0
push dword [esp + 0x24]
push esi
push eax
call 0xacd1b7c4
add esp, 0x14
push 0xea60
call dword [0x420188]
test ebx, ebx
je 0x41b7d1
push 0xffffffffffffffff
push dword [esp + 0x14]
call dword [0x4200f8]
movaps xmm0, xmmword [0x4249a0]
xor ecx, ecx
movups xmmword [esp + 0x47], xmm0
mov byte [esp + 0x57], 0
mov al, byte [esp + 0x47]
xor byte [esp + ecx + 0x48], al
inc ecx
cmp ecx, 0xf
jb 0x41b7e4
lea eax, [esp + 0x48]
mov byte [esp + 0x57], 0
push eax
call 0xacd1b812
add esp, 4
call 0xfcf2b81a
call 0x4cd8b91f
push 0x309
call dword [0x420150]
call 0xdd03b92f
test eax, eax
je 0x41b89d
mov esi, 1
cmp dword [esp + 0x18], esi
jle 0x41b888
mov ebx, dword [0x4200a0]
mov edi, dword [0x420190]
nop dword [eax]
mov eax, dword [esp + 0xc]
push dword [eax + esi*4]
call ebx
cmp eax, 0xffffffff
je 0x41b881
mov edx, eax
and edx, 0x10
je 0x41b863
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + esi*4]
call 0xecddb872
jmp 0x41b881
test al, 1
je 0x41b875
mov eax, dword [esp + 0xc]
push 0x80
push dword [eax + esi*4]
call edi
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + esi*4]
call 0xed05b992
inc esi
cmp esi, dword [esp + 0x18]
jl 0x41b840
mov esi, dword [0x420188]
nop
push 0xa
call esi
cmp dword [0x429330], 0
jne 0x41b890
push 0
call dword [0x420150]
int3