Function at 0x1400102d0
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Populate syswhispers2 syscall list
Resolve function by parsing pe exports

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
xchg r11, r11
cmova r12, r12
mov r9d, dword [0x140028040]
test r9d, r9d
jne 0x140010587
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rdx, qword [rax + 0x10]
mov rax, qword [rdx + 0x30]
test rax, rax
je 0x140010692
xor r8d, r8d
nop dword [rax]
mov rbx, rax
movsxd rax, dword [rax + 0x3c]
mov eax, dword [rbx + rax + 0x88]
test eax, eax
je 0x140010390
jmp 0x140010341
lea r8, [rbx + rax]
xchg r14, r14
cmovl r14, r14
cmovb rcx, rcx
cmove r10, r10
mov eax, dword [r8 + 0xc]
add rax, rbx
mov ecx, dword [rax]
or ecx, 0x20202020
cmp ecx, 0x6c64746e
jne 0x140010390
jmp 0x140010381
mov eax, dword [rax + 4]
or eax, 0x20202020
cmp eax, 0x6c642e6c
je 0x1400103a9
mov rdx, qword [rdx]
mov rax, qword [rdx + 0x30]
test rax, rax
jne 0x140010318
test r8, r8
je 0x140010692
mov eax, dword [r8 + 0x18]
jmp 0x1400103c4
mov edi, dword [r8 + 0x24]
lea r12, [0x140028048]
cmovg rax, rax
cmovg r9, r9
cmovl r12, r12
cmovl r10, r10
cmova rax, rax
cmovb r14, r14
cmovg r9, r9
mov ebp, dword [r8 + 0x1c]
lea edx, [rax - 1]
mov eax, dword [r8 + 0x20]
add rdi, rbx
add rbp, rbx
lea r11, [rdi + rdx*2]
jmp 0x140010413
add rax, rbx
lea rsi, [rax + rdx*4]
jmp 0x140010434
sub rsi, 4
lea rax, [r11 - 2]
cmp rdi, r11
je 0x1400105a8
mov r11, rax
mov eax, dword [rsi]
add rax, rbx
cmp word [rax], 0x775a
jmp 0x140010450
jne 0x140010420
mov r13d, r9d
shl r13, 4
add r13, r12
cmp byte [rax], 0
je 0x1400106d3
cmp byte [rax + 1], 0
cmovb rdx, rdx
cmovb rdx, rdx
xchg r10, r10
cmove rdi, rdi
cmovb rax, rax
push rcx
pop rcx
cmove r11, r11
mov ecx, 0xcd246fc4
mov edx, 1
mov r8d, 1
je 0x1400104b5
nop dword [rax]
mov r10d, ecx
movzx edx, word [rax + rdx]
add r8d, 1
ror r10d, 8
add edx, r10d
xor ecx, edx
mov edx, r8d
cmp byte [rax + rdx], 0
jne 0x140010498
jmp 0x1400104d1
movzx eax, word [r11]
mov dword [r13], ecx
add r9d, 1
cmovb rdx, rdx
cmovb r11, r11
mov eax, dword [rbp + rax*4]
mov dword [r13 + 4], eax
cmovb rdi, rdi
push r14
pop r14
xchg rdx, rdx
cmp r9d, 0x226
jne 0x140010420
cmovl rdx, rdx
cmovb r9, r9
mov dword [0x140028040], 0x226
mov edi, 0x225
jmp 0x140010527
mov r10d, 0x225
jmp 0x1400105d2
push rax
pop rax
nop
lea rsi, [0x14002804c]
shl rdi, 4
mov ebp, dword [0x14002805c]
sub ebp, dword [0x14002804c]
add rdi, rsi
nop dword [rax]
mov ecx, dword [rsi]
mov edx, ebp
add rsi, 0x10
add rcx, rbx
call fcn.140010040
jmp 0x14001057e
mov qword [rsi - 0xc], rax
cmp rsi, rdi
jne 0x140010558
mov eax, 1
add rsp, 0x28
pop rbx
pop rsi
add rsp, 8
mov rdi, qword [rsp - 8]
pop rbp
pop r12
pop r13
ret
lea r10d, [r9 - 1]
mov dword [0x140028040], r9d
mov edi, r10d
push r8
pop r8
xchg rdx, rdx
cmovb r9, r9
push r9
pop r9
nop
xchg r13, r13
cmova r8, r8
test r10d, r10d
je 0x140010587
mov r11d, r9d
lea rsi, [0x140028058]
sub r11d, edi
nop
cmp r9d, 1
je 0x140010662
lea r8d, [r9 - 2]
lea rax, [0x140028048]
shl r8, 4
push rax
pop rax
nop
cmovb r13, r13
add r8, rsi
nop
mov edx, dword [rax + 4]
nop
nop
cmovl r13, r13
cmovb rsi, rsi
push r8
pop r8
mov ecx, dword [rax + 0x14]
cmp ecx, edx
jae 0x140010659
movd xmm0, dword [rax]
movd xmm1, dword [rax + 0x10]
movd xmm2, edx
movd xmm3, ecx
push r15
pop r15
push r13
pop r13
cmovb rcx, rcx
cmovg r11, r11
punpckldq xmm0, xmm2
punpckldq xmm1, xmm3
jmp 0x140010650
movq qword [rax], xmm1
movq qword [rax + 0x10], xmm0
add rax, 0x10
cmp rax, r8
jne 0x140010600
mov r9d, r10d
jmp 0x140010680
cmp r11d, r10d
je 0x140010538
sub r10d, 1
jmp 0x1400105e0
jmp 0x1400106a2
xor eax, eax
push rcx
pop rcx
cmova r11, r11
xchg r15, r15
xchg rbx, rbx
cmovb r9, r9
cmova r15, r15
add rsp, 0x28
pop rbx
mov rsi, qword [rsp]
add rsp, 8
pop rdi
pop rbp
add rsp, 8
mov r12, qword [rsp - 8]
pop r13
ret
mov ecx, 0x1337c0de
jmp 0x1400104b5