Function at 0x140001b70
Capabilities:
Access peb ldr_data
Check os version
Encode data using xor
Encrypt data using rc4 prga
Get kernel32 base address
Get process filename

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x200
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
lea rbp, [rax + 0x20]
mov qword [rsp], 0
mov esi, ecx
mov r9, rsp
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], 0
mov qword [rsp + 0x18], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x90], 0
mov qword [rsp + 0x98], 0
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0xa8], 0
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0xb8], 0
mov qword [rsp + 0xc0], 0
mov qword [rsp + 0xc8], 0
mov qword [rsp + 0xd0], 0
mov qword [rsp + 0xd8], 0
mov qword [rsp + 0xe0], 0
mov qword [rsp + 0xe8], 0
mov qword [rsp + 0xf0], 0
mov qword [rsp + 0xf8], 0
mov r11, qword [rax + 0x20]
cmp rbp, r11
je 0x140001f95
movq xmm3, qword [0x1402aa850]
movdqu xmm2, xmmword [0x1402aa850]
xor eax, eax
mov ebx, 0x100
lea r10, [rsp + 0x100]
nop word [rax + rax]
movzx r8d, word [r11 + 0x48]
mov rcx, qword [r11 + 0x50]
mov edx, r8d
add r8d, r8d
test dx, dx
je 0x140002110
lea edi, [r8 - 1]
cmp edi, 6
jbe 0x140001d55
movsxd rdx, r8d
lea r12, [rcx + rdx*2]
cmp r9, r12
jae 0x140001fb0
add rdx, r9
cmp rcx, rdx
jae 0x140001fb0
mov edi, r8d
xor edx, edx
nop word [rax + rax]
movzx r8d, word [rcx + rdx*2]
mov byte [r9 + rdx], r8b
add rdx, 1
cmp rdx, rdi
jne 0x140001d60
add rdi, r9
mov byte [rdi], 0
mov qword [rsp + 0x100], 0
mov qword [rsp + 0x108], 0
mov qword [rsp + 0x110], 0
mov qword [rsp + 0x118], 0
mov qword [rsp + 0x120], 0
mov qword [rsp + 0x128], 0
mov qword [rsp + 0x130], 0
mov qword [rsp + 0x138], 0
mov qword [rsp + 0x140], 0
mov qword [rsp + 0x148], 0
mov qword [rsp + 0x150], 0
mov qword [rsp + 0x158], 0
mov qword [rsp + 0x160], 0
mov qword [rsp + 0x168], 0
mov qword [rsp + 0x170], 0
mov qword [rsp + 0x178], 0
mov qword [rsp + 0x180], 0
mov qword [rsp + 0x188], 0
mov qword [rsp + 0x190], 0
mov qword [rsp + 0x198], 0
mov qword [rsp + 0x1a0], 0
mov qword [rsp + 0x1a8], 0
mov qword [rsp + 0x1b0], 0
mov qword [rsp + 0x1b8], 0
mov qword [rsp + 0x1c0], 0
mov qword [rsp + 0x1c8], 0
mov qword [rsp + 0x1d0], 0
mov qword [rsp + 0x1d8], 0
mov qword [rsp + 0x1e0], 0
mov qword [rsp + 0x1e8], 0
mov qword [rsp + 0x1f0], 0
mov qword [rsp + 0x1f8], 0
movzx edx, byte [rsp]
test dl, dl
je 0x1400020f0
mov rcx, r9
nop word [rax + rax]
add rcx, 1
cmp byte [rcx], 0
jne 0x140001f10
sub rcx, r9
xor edi, edi
xor r8d, r8d
nop dword [rax]
lea r13d, [rdx - 0x41]
lea r12d, [rdx + 0x20]
cmp r13b, 0x1a
cmovb edx, r12d
mov byte [r10 + r8], dl
lea r8d, [rdi + 1]
movzx edx, byte [rsp + r8]
mov rdi, r8
test dl, dl
jne 0x140001f28
test ecx, ecx
je 0x1400020f0
mov ecx, ecx
mov rdi, r10
mov edx, 0xc
lea r8, [r10 + rcx]
nop word [rax + rax]
movzx ecx, byte [rdi]
add rdi, 1
xor edx, ecx
imul edx, edx, 0x65
cmp r8, rdi
jne 0x140001f68
cmp esi, edx
je 0x1400020fd
mov rdi, r9
mov rcx, rbx
rep stosb byte [rdi], al
mov r11, qword [r11]
cmp rbp, r11
jne 0x140001d18
xor eax, eax
add rsp, 0x200
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
cmp edi, 0xe
jbe 0x140002118
mov edi, r8d
xor edx, edx
shr edi, 4
shl rdi, 4
nop dword [rax]
movdqu xmm0, xmmword [rcx + rdx*2]
movdqu xmm1, xmmword [rcx + rdx*2 + 0x10]
pand xmm0, xmm2
pand xmm1, xmm2
packuswb xmm0, xmm1
movups xmmword [r9 + rdx], xmm0
add rdx, 0x10
cmp rdi, rdx
jne 0x140001fc8
mov edx, r8d
mov edi, r8d
and edx, 0xfffffff0
mov r13d, edx
lea r12, [r9 + r13]
cmp r8d, edx
je 0x140001d72
mov r14d, r8d
and r14d, 0xf
lea edi, [r14 - 1]
cmp edi, 6
jbe 0x140002055
lea rdi, [rcx + r13*2]
movq xmm0, qword [rdi]
movq xmm1, qword [rdi + 8]
mov edi, r14d
and edi, 0xfffffff8
pand xmm0, xmm3
pand xmm1, xmm3
add edx, edi
add r12, rdi
packuswb xmm0, xmm1
and r14d, 6
mov edi, r8d
pshufd xmm0, xmm0, 8
movq qword [rsp + r13], xmm0
je 0x140001d72
mov r13d, edx
movzx edi, word [rcx + r13*2]
lea r13d, [rdx + 1]
mov byte [r12], dil
mov edi, r8d
cmp r13d, r8d
jae 0x140001d72
movzx r13d, word [rcx + r13*2]
mov byte [r12 + 1], r13b
lea r13d, [rdx + 2]
cmp r13d, r8d
jae 0x140001d72
movzx r13d, word [rcx + r13*2]
mov byte [r12 + 2], r13b
lea r13d, [rdx + 3]
cmp r13d, r8d
jae 0x140001d72
movzx r13d, word [rcx + r13*2]
mov byte [r12 + 3], r13b
lea r13d, [rdx + 4]
cmp r13d, r8d
jae 0x140001d72
movzx r13d, word [rcx + r13*2]
mov byte [r12 + 4], r13b
lea r13d, [rdx + 5]
cmp r13d, r8d
jae 0x140001d72
movzx r13d, word [rcx + r13*2]
add edx, 6
mov byte [r12 + 5], r13b
cmp edx, r8d
jae 0x140001d72
movzx edx, word [rcx + rdx*2]
mov byte [r12 + 6], dl
jmp 0x140001d72
mov edx, 0xc
cmp esi, edx
jne 0x140001f81
mov rax, qword [r11 + 0x20]
jmp 0x140001f97
mov rdi, r9
jmp 0x140001d75
mov r14d, r8d
mov r12, r9
xor edx, edx
xor r13d, r13d
jmp 0x140002016