Function at 0x140167af0
Capabilities:
Access peb ldr_data
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
xor ebx, ebx
mov edi, 0x3eac7a8e
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r13d, 0x4764996c
movups xmm0, xmmword [rax + 0x58]
movd ecx, xmm0
sub cx, 8
test ebx, ebx
je 0x140167b81
psrldq xmm0, 8
movq r9, xmm0
movzx ecx, cx
shr rcx, 1
lea r11, [r9 + rcx*2]
mov r10d, 0xd644d192
jmp 0x140167b73
movsx edx, byte [r9]
mov r8d, edx
imul r8d, edx
add r8d, 0x31
xor r8d, r13d
mov ecx, r10d
xor ecx, edx
mov r10d, r8d
imul r10d, ecx
add r9, 2
cmp r9, r11
jne 0x140167b51
cmp r10d, ebx
jne 0x140167c81
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov rcx, qword [rcx + r10 + 0x88]
mov r11d, ecx
add r11, r10
shr rcx, 0x20
cmp r11, r10
je 0x140167c81
mov esi, dword [r11 + 0x18]
test esi, esi
je 0x140167c81
mov r12d, dword [r11 + 0x20]
dec esi
lea rdx, [r12 + rsi*4]
mov r9d, dword [rdx + r10]
add r9, r10
mov r14d, 0xd644d192
jmp 0x140167be4
movsx r8d, dl
mov edx, r8d
imul edx, r8d
add edx, 0x31
xor edx, r13d
xor r8d, r14d
mov r14d, edx
imul r14d, r8d
mov dl, byte [r9]
inc r9
test dl, dl
jne 0x140167bc9
cmp r14d, edi
je 0x140167bfc
test esi, esi
jne 0x140167bb4
jmp 0x140167c81
mov edx, dword [r11 + 0x1c]
add rdx, r10
mov eax, dword [r11 + 0x24]
add rax, r10
movzx eax, word [rax + rsi*2]
mov r9d, dword [rdx + rax*4]
add r9, r10
cmp r9, r11
jbe 0x140167c89
lea rax, [r11 + rcx]
cmp r9, rax
jae 0x140167c89
mov ebx, 0xd644d192
mov edi, ebx
jmp 0x140167c46
movsx ecx, al
mov edx, ecx
imul edx, ecx
add edx, 0x31
xor edx, r13d
mov eax, ebx
xor eax, ecx
mov ebx, edx
imul ebx, eax
inc r9
mov al, byte [r9]
cmp al, 0x2e
jne 0x140167c2c
jmp 0x140167c66
movsx ecx, al
mov edx, ecx
imul edx, ecx
add edx, 0x31
xor edx, r13d
mov eax, edi
xor eax, ecx
mov edi, edx
imul edi, eax
inc r9
mov al, byte [r9]
test al, al
jne 0x140167c4f
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rax, qword [rax]
jmp 0x140167b25
and dword [rbp + 0x48], 0
mov dword [rbp + 0x48], 0x101eec1b
mov eax, 0x703f81bf
sub eax, dword [0x140278058]
sub eax, dword [0x140278050]
xor eax, 0x8ba6ce79
sub eax, dword [0x140278048]
mov rdx, qword [0x140278040]
lea ecx, [rdx - 0x2287bc3a]
add ecx, eax
xor ecx, 0x5cc35abb
add ecx, 0x34dc8077
xor ecx, 0xd4115282
mov r8d, dword [0x140278030]
xor r8d, 0x2456d729
sub r8d, ecx
mov eax, dword [0x140278038]
xor eax, 0xdba928d6
sub r8d, eax
sub r8d, edx
add r8d, 0x4988ac60
xor r8d, 0xf474446
mov dword [rbp + 0x48], r8d
movsxd rcx, r8d
call r9
mov qword [rbp - 0x38], rax
and dword [rbp + 0x48], 0
movabs rbx, 0xf278bc67954e47ee
movabs rsi, 0xd371ba2ba3eaf84d
movabs rax, 0x7c63296000000000
mov rdi, qword [0x140278080]
imul rdi, rax
movabs rax, 0xc939b11000000000
xor rdi, rax
mov rcx, rdi
imul rcx, rsi
mov qword [rbp - 0x40], rcx
movabs r8, 0xaaaaaaaaaaaaaaab
mov rax, r8
mul rcx
shr rdx, 2
lea rax, [rdx + rdx*2]
add rax, rax
sub rcx, rax
lea r9, [0x140278060]
mov r11, rdi
and r11, rsi
imul r11, qword [r9 + rcx*8]
movabs rax, 0x2b8ef29b928784c4
imul r11, rax
shr r11, 3
movabs rax, 0x39b67017a735560a
xor r11, rax
movabs rax, 0xffffff57c8ffea3d
mov r15, rdi
imul r15, rax
sub r15, 0xbebd2
xor r15, r11
xor r15, qword [0x140278060]
mov rax, r11
imul rax, qword [0x140278070]
movabs rcx, 0xb9de928bc14c551c
imul rax, rcx
not rax
and r15, rax
ror r15, 0x20
shr r15, 8
movabs r10, 0x2c8e45d45c1507b3
lea rcx, [rdi + r10]
xor rcx, 0xffffffffffc25e11
mov rax, r8
mul rcx
shr rdx, 2
lea rax, [rdx + rdx*2]
add rax, rax
sub rcx, rax
movabs rax, 0xbc01be215c5682a8
mov r14, qword [r9 + rcx*8]
imul r14, rax
sub r14, r10
movabs rcx, 0xb82d58801f18ca58
mov rax, r11
imul rax, rcx
xor r14, rax
shr r14, 0x1f
not r14
mov r12, r14
xor r12, rdi
lea rcx, [r14 + r10]
mov rax, r8
mul rcx
shr rdx, 2
lea rax, [rdx + rdx*2]
add rax, rax
sub rcx, rax
movzx eax, r14b
movzx ecx, byte [r9 + rcx*8]
imul ecx, eax
movzx ecx, cl
xor ecx, 0xd
mov eax, 0x8000003f
and ecx, eax
jge 0x140167e85
dec ecx
or ecx, 0xffffffc0
inc ecx
ror r12, cl
not r12
imul r12, r11
imul r13, r12, 0xfffffffffff4142e
add r10, r13
mov r9, r14
imul r9, r15
sub r9, r10
xor r9, rbx
movzx r8d, r10b
mov ecx, r8d
xor ecx, 2
and ecx, 0xf
and ecx, eax
jge 0x140167ebe
dec ecx
or ecx, 0xffffffc0
inc ecx
rol r9, cl
movabs rax, 0x26ef2da22c02a1d6
imul r12, rax
movabs rax, 0xcae5dbaeb994729
sub r12, rax
xor r9, r12
mov rax, r10
sub rax, qword [0x140278078]
xor r9, rax
xor r9, r11
xor r9, rdi
mov rax, r9
and eax, 1
xor rax, 2
je 0x14016825e
sub rax, 1
je 0x14016811a
sub rax, 1
je 0x14016801e
cmp rax, 1
jne 0x140168314
mov rbx, r10
imul rbx, r14
movabs rax, 0x3f9651cca85271a7
add rax, r9
xor rbx, rax
ror rbx, 0x1a
shr rbx, 0xc
xor rbx, rdi
not rbx
movabs rcx, 0x835723bd5b1a
mov r8, qword [0x140278088]
add r8, rcx
movabs rax, 0x2c0cc0ac34b37c2f
xor r8, rax
mov eax, ebx
imul eax, r9d
and eax, 0x3f
mov ecx, 0x40
sub ecx, eax
mov rdx, r8
shl rdx, cl
mov ecx, eax
shr r8, cl
or rdx, r8
shl rdx, 0xf
movabs rax, 0xf7ca7db97b5db7e5
sub rax, r14
mov r14, rdx
xor r14, rax
mov rcx, r14
imul rcx, rsi
mov eax, 0xaa86650f
add rcx, rax
movabs r12, 0xaaaaaaaaaaaaaaab
mov rax, r12
mul rcx
shr rdx, 2
lea rax, [rdx + rdx*2]
add rax, rax
sub rcx, rax
lea r8, [0x140278060]
mov cl, byte [r8 + rcx*8]
and cl, 0xf
movabs rsi, 0x40b2d0fffb49d52e
sub rsi, rbx
shr rsi, cl
movabs rcx, 0x2c966a5cb4171d77
add rcx, r13
mov rax, r12
mul rcx
shr rdx, 2
lea rax, [rdx + rdx*2]
add rax, rax
sub rcx, rax
mov rax, r9
imul rax, qword [r8 + rcx*8]
imul rax, r9
sub rax, r15
xor rsi, rax
jmp 0x14016831e
movabs rax, 0xaaaaaa1aaa9f9831
mov rcx, r9
xor rcx, rax
movabs rax, 0x1206ed6892447d
imul rcx, rax
movabs rdx, 0xfff17ca87dfdae4d
mov rax, r11
xor rax, rdx
sub rcx, rax
movabs rax, 0xffff7e8a8c8faaed
imul r13, rax
movabs r14, 0xd37d59bcf421a9a4
add r14, rcx
add r14, r13
movabs rax, 0x277cd7be784f4f51
mov rcx, r14
xor rcx, rax
movabs r12, 0xaaaaaaaaaaaaaaab
mov rax, r12
mul rcx
shr rdx, 2
lea rax, [rdx + rdx*2]
add rax, rax
sub rcx, rax
mov r10, r14
not r10
lea r8, [0x140278060]
imul r10, qword [r8 + rcx*8]
xor r10, 0xffffffffffca4ee1
lea ecx, [r9 - 0xd]
and cl, 0x3f
rol r10, cl
movabs rcx, 0xc52350200000000
mov rax, qword [rbp - 0x40]
xor rax, rcx
movabs rcx, 0x7c7a7dc696cd4450
and rax, rcx
imul r10, rax
mov rcx, r10
ror rcx, 2
not rcx
movabs rax, 0x9b2de6b2de8f35d8
imul rcx, rax
mov rax, r14
sub rax, r10
lea rdx, [rcx + rax*4]
mov cl, r15b
and cl, 0x3f
ror rdx, cl
mov rax, rsi
mov rsi, rdx
imul rsi, rax
jmp 0x14016831e
movabs rax, 0xbd4076eea4eebdf1
imul r9, rax
movabs rax, 0xd79435e50d79435f
mul r9
shr rdx, 4
movzx eax, dl
imul edx, eax, 0x13
mov cl, r9b
sub cl, dl
movabs rdx, 0x2c8e45d45c1507b2
mov rax, rdi
imul rax, rdx
xor rax, rbx
not rax
shl rax, cl
xor r11, rax
and r8d, 0x8000003f
jge 0x140168174
dec r8d
or r8d, 0xffffffc0
inc r8d
mov cl, r8b
rol r11, cl
movabs rcx, 0x2c8e45d45c1507b3
add rcx, r9
movabs r12, 0xaaaaaaaaaaaaaaab
mov rax, r12
mul rcx
shr rdx, 2
lea rax, [rdx + rdx*2]
add rax, rax
sub rcx, rax
movabs rdx, 0xfffffa2ba3eaf84d
lea r8, [0x140278060]
mov rax, qword [r8 + rcx*8]
imul rax, rdx
xor r11, rax
movabs rax, 0xffffc7a7f65bee1c
or r11, rax
mov rsi, qword [0x140278070]
imul rsi, rbx
sub rsi, r10
mov rax, r15
sub rax, r11
xor rsi, rax
movabs rax, 0xc7a7c6a6a753ee11
xor rsi, rax
movabs rax, 0xcccccccccccccccd
mul rdi
shr rdx, 3
lea rax, [rdx + rdx*4]
add rax, rax
mov rcx, rdi
sub rcx, rax
or rcx, 1
xor edx, edx
mov rax, rsi
div rcx
mov rcx, rdx
mov rdx, r9
imul rdx, r10
imul rdx, rsi
shr rdx, cl
mov rax, r14
sub rax, rdx
sub rax, rdi
movabs rdi, 0x78958946801a20b
add rdi, rax
xor rdi, r15
movzx eax, r14b
imul ecx, eax, 0xf4
and cl, 0x3f
rol rdi, cl
not rdi
jmp 0x14016831e
movabs r12, 0xaaaaaaaaaaaaaaab
mov rax, r12
mul r11
shr rdx, 2
lea rax, [rdx + rdx*2]
add rax, rax
mov rcx, r11
sub rcx, rax
mov rax, r9
imul rax, qword [0x140278080]
lea r8, [0x140278060]
mov rdx, qword [r8 + rcx*8]
and rdx, rax
xor rdx, r11
and r11b, 0x3f
mov cl, r11b
mov r11, rdx
ror r11, cl
imul r11, r10
not r15
imul r15, r14
movabs rax, 0x7cd8a7de7aa2bff0
imul r15, rax
mov rax, r11
imul rax, rdi
mov rdi, r15
xor rdi, rax
imul r8, qword [0x140278060], 0xfffffffffff4142e
mov rdx, qword [0x140278068]
sub r8, rdx
mov al, dil
not al
movzx ecx, al
movzx eax, dl
xor ecx, eax
and ecx, 0x8000003f
jge 0x1401682ff
dec ecx
or ecx, 0xffffffc0
inc ecx
ror r8, cl
movabs r15, 0x2c8e45d45c1507b3
add r15, r8
add r15, r13
jmp 0x14016831e
movabs r12, 0xaaaaaaaaaaaaaaab
movabs rcx, 0xff055d7b8ae9b53d
xor rbx, rcx
mov rax, r12
mul rbx
shr rdx, 2
lea rax, [rdx + rdx*2]
add rax, rax
sub rbx, rax
xor r11, rdi
lea rax, [0x140278060]
imul r11, qword [rax + rbx*8]
not r10
imul r10, r9
imul r10, r15
imul r10, rsi
movabs rcx, 0xf5ed7e878d5affe1
xor rcx, r14
not rcx
xor rcx, r10
sub rcx, r11
call fcn.140134c38
mov qword [0x140279158], rax
mov r9d, dword [0x140278090]
movdqa xmm0, xmmword [0x14025aa80]
movdqu xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x14025ab40]
movdqu xmmword [rbp - 0x10], xmm1
xor r12d, r12d
mov r13, qword [0x140278040]
xor edx, edx
mov rax, r12
movabs rcx, 0x13cce94adbbf6644
div rcx
add dl, 0x34
mov r15b, dl
sar r15b, 7
or r15b, dl
mov al, r15b
sar al, 2
mov r14b, r15b
shl r14b, 6
mov sil, r14b
or sil, al
movsx rcx, r15b
or r14b, al
mov r10b, r15b
sar r10b, 5
mov al, r15b
shl al, 3
or r10b, al
mov r11b, r15b
sar r11b, 3
mov al, r15b
shl al, 5
or r11b, al
mov r8b, r15b
sar r8b, 4
mov al, r15b
shl al, 4
or r8b, al
mov bl, r15b
not bl
mov dil, r15b
ror dil, 7
lea eax, [r11 - 0x50]
add dil, al
mov dl, byte [rbp + r12 - 0x20]
sub dl, sil
sub dl, 2
mov eax, 4
sub al, r14b
xor dl, al
sar rcx, 1
mov al, r15b
shl al, 7
or cl, al
sub dl, cl
sub dl, byte [0x140278050]
sub dl, byte [0x140278058]
sub dl, 0x3f
add dl, r14b
add dl, r15b
lea eax, [rsi + 7]
add al, r15b
xor dl, al
sub dl, r10b
sub dl, r15b
sub dl, byte [0x140278048]
sub dl, 0x50
add dl, r14b
add dl, r13b
mov al, sil
sub al, r10b
add al, r15b
add al, r8b
xor dl, al
mov al, r15b
sub al, r8b
xor al, r15b
sub dl, al
sub dl, r11b
add dl, 0x30
add dl, r15b
xor dil, dl
mov al, r15b
add al, al
sub dil, al
add dil, 0x51
add dil, r14b
add dil, sil
add dil, r13b
not dil
mov al, r15b
sar al, 7
or al, r15b
sub dil, al
mov al, byte [0x140278038]
xor al, bl
sub dil, al
mov al, r15b
xor al, byte [0x140278030]
add dil, al
mov al, r15b
xor al, 0x40
sub dil, al
movsx eax, bl
movsx ecx, r15b
imul ecx, eax
xor dil, cl
mov byte [rbp + r12 - 0x20], dil
inc r12
cmp r12, 0x20
jb 0x1401683aa
lea rax, [rbp - 0x20]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 0x20
and dword [rbp + 0x50], 0
mov dword [rbp + 0x50], 0x5337016
mov eax, 0x7569e122
sub eax, dword [0x140278058]
sub eax, dword [0x140278050]
xor eax, 0x8d272ed3
sub eax, dword [0x140278048]
mov rdx, qword [0x140278040]
lea ecx, [rdx - 0x6086005f]
add ecx, eax
xor ecx, 0x5e7309e5
add ecx, 0x341870fd
xor ecx, 0x88ce9996
mov r8d, dword [0x140278030]
xor r8d, 0x245cc103
sub r8d, ecx
mov eax, dword [0x140278038]
xor eax, 0xdba33efc
sub r8d, eax
sub r8d, edx
sub r8d, 0x3d96f4bc
xor r8d, 0xb7f5b8f4
mov dword [rbp + 0x50], r8d
movsxd rdx, r8d
mov dword [rsp + 0x20], r9d
lea r8, [rbp - 0x20]
mov r13, qword [rbp - 0x38]
mov rcx, r13
call fcn.14006180c
nop
and dword [rbp + 0x50], 0
and dword [rbp + 0x58], 0
mov dword [rbp + 0x58], 0x34e74e42
mov eax, 0xbdaa58bf
sub eax, dword [0x140278058]
sub eax, dword [0x140278050]
xor eax, 0x8afb5b39
sub eax, dword [0x140278048]
mov r8, qword [0x140278040]
lea edx, [r8 - 0x236ce292]
add edx, eax
xor edx, 0x5c02cd7b
add edx, 0x34a93237
xor edx, 0x53bce53b
mov ecx, dword [0x140278030]
xor ecx, 0x245433e9
sub ecx, edx
mov eax, dword [0x140278038]
xor eax, 0xdbabcc16
sub ecx, eax
sub ecx, r8d
add ecx, 0x4cd10a70
xor ecx, 0x383d2206
mov dword [rbp + 0x58], ecx
call fcn.1401ee548
mov rdx, rax
mov rcx, r13
call fcn.1401ee694
nop
and dword [rbp + 0x58], 0
xor ebx, ebx
mov edi, 0x4618969a
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
movups xmm0, xmmword [rax + 0x58]
movd ecx, xmm0
sub cx, 8
test ebx, ebx
je 0x1401686ad
psrldq xmm0, 8
movq r9, xmm0
movzx ecx, cx
shr rcx, 1
lea r11, [r9 + rcx*2]
mov r10d, 0x9bfef7e
jmp 0x14016869f
movsx edx, byte [r9]
mov r8d, edx
imul r8d, edx
add r8d, 0x31
xor r8d, 0x4764996c
mov ecx, r10d
xor ecx, edx
mov r10d, r8d
imul r10d, ecx
add r9, 2
cmp r9, r11
jne 0x140168679
cmp r10d, ebx
jne 0x1401687b1
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov rcx, qword [rcx + r10 + 0x88]
mov r11d, ecx
add r11, r10
shr rcx, 0x20
cmp r11, r10
je 0x1401687b1
mov esi, dword [r11 + 0x18]
test esi, esi
je 0x1401687b1
mov r12d, dword [r11 + 0x20]
dec esi
lea rdx, [r10 + rsi*4]
mov r9d, dword [rdx + r12]
add r9, r10
mov r14d, 0x9bfef7e
jmp 0x140168713
movsx r8d, dl
mov edx, r8d
imul edx, r8d
add edx, 0x31
xor edx, 0x4764996c
xor r8d, r14d
mov r14d, edx
imul r14d, r8d
mov dl, byte [r9]
inc r9
test dl, dl
jne 0x1401686f5
cmp r14d, edi
je 0x14016872b
test esi, esi
jne 0x1401686e0
jmp 0x1401687b1
mov edx, dword [r11 + 0x24]
add rdx, r10
movzx r8d, word [rdx + rsi*2]
mov edx, dword [r11 + 0x1c]
add rdx, r10
mov r9d, dword [rdx + r8*4]
add r9, r10
cmp r9, r11
jbe 0x1401687b9
lea rax, [r11 + rcx]
cmp r9, rax
jae 0x1401687b9
mov ebx, 0x9bfef7e
mov edi, ebx
jmp 0x140168776
movsx ecx, al
mov eax, ecx
imul eax, ecx
add eax, 0x31
xor eax, 0x4764996c
xor ecx, ebx
mov ebx, eax
imul ebx, ecx
inc r9
mov al, byte [r9]
cmp al, 0x2e
jne 0x14016875c
jmp 0x140168796
movsx ecx, al
mov eax, ecx
imul eax, ecx
add eax, 0x31
xor eax, 0x4764996c
xor ecx, edi
mov edi, eax
imul edi, ecx
inc r9
mov al, byte [r9]
test al, al
jne 0x14016877f
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rax, qword [rax]
jmp 0x14016864d
mov rcx, r13
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
jmp r9