Function at 0x1401a118c
Capabilities:
Access peb ldr_data
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
xor ebx, ebx
mov edi, 0x44eb948e
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r13d, 0x4764996c
movups xmm0, xmmword [rax + 0x58]
movd ecx, xmm0
sub cx, 8
test ebx, ebx
je 0x1401a121d
psrldq xmm0, 8
movq r9, xmm0
movzx ecx, cx
shr rcx, 1
lea r11, [r9 + rcx*2]
mov r10d, 0xdc215032
jmp 0x1401a120f
movsx edx, byte [r9]
mov r8d, edx
imul r8d, edx
add r8d, 0x31
xor r8d, r13d
mov ecx, r10d
xor ecx, edx
mov r10d, r8d
imul r10d, ecx
add r9, 2
cmp r9, r11
jne 0x1401a11ed
cmp r10d, ebx
jne 0x1401a131d
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov rcx, qword [rcx + r10 + 0x88]
mov r11d, ecx
add r11, r10
shr rcx, 0x20
cmp r11, r10
je 0x1401a131d
mov esi, dword [r11 + 0x18]
test esi, esi
je 0x1401a131d
mov r12d, dword [r11 + 0x20]
dec esi
lea rdx, [r12 + rsi*4]
mov r9d, dword [rdx + r10]
add r9, r10
mov r14d, 0xdc215032
jmp 0x1401a1280
movsx r8d, dl
mov edx, r8d
imul edx, r8d
add edx, 0x31
xor edx, r13d
xor r8d, r14d
mov r14d, edx
imul r14d, r8d
mov dl, byte [r9]
inc r9
test dl, dl
jne 0x1401a1265
cmp r14d, edi
je 0x1401a1298
test esi, esi
jne 0x1401a1250
jmp 0x1401a131d
mov edx, dword [r11 + 0x1c]
add rdx, r10
mov eax, dword [r11 + 0x24]
add rax, r10
movzx eax, word [rax + rsi*2]
mov r9d, dword [rdx + rax*4]
add r9, r10
cmp r9, r11
jbe 0x1401a1325
lea rax, [r11 + rcx]
cmp r9, rax
jae 0x1401a1325
mov ebx, 0xdc215032
mov edi, ebx
jmp 0x1401a12e2
movsx ecx, al
mov edx, ecx
imul edx, ecx
add edx, 0x31
xor edx, r13d
mov eax, ebx
xor eax, ecx
mov ebx, edx
imul ebx, eax
inc r9
mov al, byte [r9]
cmp al, 0x2e
jne 0x1401a12c8
jmp 0x1401a1302
movsx ecx, al
mov edx, ecx
imul edx, ecx
add edx, 0x31
xor edx, r13d
mov eax, edi
xor eax, ecx
mov edi, edx
imul edi, eax
inc r9
mov al, byte [r9]
test al, al
jne 0x1401a12eb
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rax, qword [rax]
jmp 0x1401a11c1
and dword [rbp + 0x48], 0
mov dword [rbp + 0x48], 0x2d6b30f
mov eax, 0xff284927
sub eax, dword [0x1402b2058]
sub eax, dword [0x1402b2050]
xor eax, 0x75ec16ed
sub eax, dword [0x1402b2048]
mov rdx, qword [0x1402b2040]
lea ecx, [rdx + 0x406d7ac4]
add ecx, eax
xor ecx, 0x445bfecf
add ecx, 0x720cd6d3
xor ecx, 0xb15e15d9
mov r8d, dword [0x1402b2030]
xor r8d, 0x2401429d
sub r8d, ecx
mov eax, dword [0x1402b2038]
xor eax, 0xdbfebd62
sub r8d, eax
sub r8d, edx
sub r8d, 0x4bbd9409
xor r8d, 0x1d6f691a
mov dword [rbp + 0x48], r8d
movsxd rcx, r8d
call r9
mov qword [rbp - 0x38], rax
and dword [rbp + 0x48], 0
movabs rbx, 0xf278bc67954e47ee
movabs rsi, 0xd371ba2ba3eaf84d
movabs rax, 0x7c63296000000000
mov rdi, qword [0x1402b2080]
imul rdi, rax
movabs rax, 0xc939b11000000000
xor rdi, rax
mov rcx, rdi
imul rcx, rsi
mov qword [rbp - 0x40], rcx
movabs r8, 0xaaaaaaaaaaaaaaab
mov rax, r8
mul rcx
shr rdx, 2
lea rax, [rdx + rdx*2]
add rax, rax
sub rcx, rax
lea r9, [0x1402b2060]
mov r11, rdi
and r11, rsi
imul r11, qword [r9 + rcx*8]
movabs rax, 0x2b8ef29b928784c4
imul r11, rax
shr r11, 3
movabs rax, 0x39b67017a735560a
xor r11, rax
movabs rax, 0xffffff57c8ffea3d
mov r15, rdi
imul r15, rax
sub r15, 0xbebd2
xor r15, r11
xor r15, qword [0x1402b2060]
mov rax, r11
imul rax, qword [0x1402b2070]
movabs rcx, 0xb9de928bc14c551c
imul rax, rcx
not rax
and r15, rax
ror r15, 0x20
shr r15, 8
movabs r10, 0x2c8e45d45c1507b3
lea rcx, [rdi + r10]
xor rcx, 0xffffffffffc25e11
mov rax, r8
mul rcx
shr rdx, 2
lea rax, [rdx + rdx*2]
add rax, rax
sub rcx, rax
movabs rax, 0xbc01be215c5682a8
mov r14, qword [r9 + rcx*8]
imul r14, rax
sub r14, r10
movabs rcx, 0xb82d58801f18ca58
mov rax, r11
imul rax, rcx
xor r14, rax
shr r14, 0x1f
not r14
mov r12, r14
xor r12, rdi
lea rcx, [r14 + r10]
mov rax, r8
mul rcx
shr rdx, 2
lea rax, [rdx + rdx*2]
add rax, rax
sub rcx, rax
movzx eax, r14b
movzx ecx, byte [r9 + rcx*8]
imul ecx, eax
movzx ecx, cl
xor ecx, 0xd
mov eax, 0x8000003f
and ecx, eax
jge 0x1401a1521
dec ecx
or ecx, 0xffffffc0
inc ecx
ror r12, cl
not r12
imul r12, r11
imul r13, r12, 0xfffffffffff4142e
add r10, r13
mov r9, r14
imul r9, r15
sub r9, r10
xor r9, rbx
movzx r8d, r10b
mov ecx, r8d
xor ecx, 2
and ecx, 0xf
and ecx, eax
jge 0x1401a155a
dec ecx
or ecx, 0xffffffc0
inc ecx
rol r9, cl
movabs rax, 0x26ef2da22c02a1d6
imul r12, rax
movabs rax, 0xcae5dbaeb994729
sub r12, rax
xor r9, r12
mov rax, r10
sub rax, qword [0x1402b2078]
xor r9, rax
xor r9, r11
xor r9, rdi
mov rax, r9
and eax, 1
xor rax, 2
je 0x1401a18fa
sub rax, 1
je 0x1401a17b6
sub rax, 1
je 0x1401a16ba
cmp rax, 1
jne 0x1401a19b0
mov rbx, r10
imul rbx, r14
movabs rax, 0x3f9651cca85271a7
add rax, r9
xor rbx, rax
ror rbx, 0x1a
shr rbx, 0xc
xor rbx, rdi
not rbx
movabs rcx, 0x835723bd5b1a
mov r8, qword [0x1402b2088]
add r8, rcx
movabs rax, 0x2c0cc0ac34b37c2f
xor r8, rax
mov eax, ebx
imul eax, r9d
and eax, 0x3f
mov ecx, 0x40
sub ecx, eax
mov rdx, r8
shl rdx, cl
mov ecx, eax
shr r8, cl
or rdx, r8
shl rdx, 0xf
movabs rax, 0xf7ca7db97b5db7e5
sub rax, r14
mov r14, rdx
xor r14, rax
mov rcx, r14
imul rcx, rsi
mov eax, 0xaa86650f
add rcx, rax
movabs r12, 0xaaaaaaaaaaaaaaab
mov rax, r12
mul rcx
shr rdx, 2
lea rax, [rdx + rdx*2]
add rax, rax
sub rcx, rax
lea r8, [0x1402b2060]
mov cl, byte [r8 + rcx*8]
and cl, 0xf
movabs rsi, 0x40b2d0fffb49d52e
sub rsi, rbx
shr rsi, cl
movabs rcx, 0x2c966a5cb4171d77
add rcx, r13
mov rax, r12
mul rcx
shr rdx, 2
lea rax, [rdx + rdx*2]
add rax, rax
sub rcx, rax
mov rax, r9
imul rax, qword [r8 + rcx*8]
imul rax, r9
sub rax, r15
xor rsi, rax
jmp 0x1401a19ba
movabs rax, 0xaaaaaa1aaa9f9831
mov rcx, r9
xor rcx, rax
movabs rax, 0x1206ed6892447d
imul rcx, rax
movabs rdx, 0xfff17ca87dfdae4d
mov rax, r11
xor rax, rdx
sub rcx, rax
movabs rax, 0xffff7e8a8c8faaed
imul r13, rax
movabs r14, 0xd37d59bcf421a9a4
add r14, rcx
add r14, r13
movabs rax, 0x277cd7be784f4f51
mov rcx, r14
xor rcx, rax
movabs r12, 0xaaaaaaaaaaaaaaab
mov rax, r12
mul rcx
shr rdx, 2
lea rax, [rdx + rdx*2]
add rax, rax
sub rcx, rax
mov r10, r14
not r10
lea r8, [0x1402b2060]
imul r10, qword [r8 + rcx*8]
xor r10, 0xffffffffffca4ee1
lea ecx, [r9 - 0xd]
and cl, 0x3f
rol r10, cl
movabs rcx, 0xc52350200000000
mov rax, qword [rbp - 0x40]
xor rax, rcx
movabs rcx, 0x7c7a7dc696cd4450
and rax, rcx
imul r10, rax
mov rcx, r10
ror rcx, 2
not rcx
movabs rax, 0x9b2de6b2de8f35d8
imul rcx, rax
mov rax, r14
sub rax, r10
lea rdx, [rcx + rax*4]
mov cl, r15b
and cl, 0x3f
ror rdx, cl
mov rax, rsi
mov rsi, rdx
imul rsi, rax
jmp 0x1401a19ba
movabs rax, 0xbd4076eea4eebdf1
imul r9, rax
movabs rax, 0xd79435e50d79435f
mul r9
shr rdx, 4
movzx eax, dl
imul edx, eax, 0x13
mov cl, r9b
sub cl, dl
movabs rdx, 0x2c8e45d45c1507b2
mov rax, rdi
imul rax, rdx
xor rax, rbx
not rax
shl rax, cl
xor r11, rax
and r8d, 0x8000003f
jge 0x1401a1810
dec r8d
or r8d, 0xffffffc0
inc r8d
mov cl, r8b
rol r11, cl
movabs rcx, 0x2c8e45d45c1507b3
add rcx, r9
movabs r12, 0xaaaaaaaaaaaaaaab
mov rax, r12
mul rcx
shr rdx, 2
lea rax, [rdx + rdx*2]
add rax, rax
sub rcx, rax
movabs rdx, 0xfffffa2ba3eaf84d
lea r8, [0x1402b2060]
mov rax, qword [r8 + rcx*8]
imul rax, rdx
xor r11, rax
movabs rax, 0xffffc7a7f65bee1c
or r11, rax
mov rsi, qword [0x1402b2070]
imul rsi, rbx
sub rsi, r10
mov rax, r15
sub rax, r11
xor rsi, rax
movabs rax, 0xc7a7c6a6a753ee11
xor rsi, rax
movabs rax, 0xcccccccccccccccd
mul rdi
shr rdx, 3
lea rax, [rdx + rdx*4]
add rax, rax
mov rcx, rdi
sub rcx, rax
or rcx, 1
xor edx, edx
mov rax, rsi
div rcx
mov rcx, rdx
mov rdx, r9
imul rdx, r10
imul rdx, rsi
shr rdx, cl
mov rax, r14
sub rax, rdx
sub rax, rdi
movabs rdi, 0x78958946801a20b
add rdi, rax
xor rdi, r15
movzx eax, r14b
imul ecx, eax, 0xf4
and cl, 0x3f
rol rdi, cl
not rdi
jmp 0x1401a19ba
movabs r12, 0xaaaaaaaaaaaaaaab
mov rax, r12
mul r11
shr rdx, 2
lea rax, [rdx + rdx*2]
add rax, rax
mov rcx, r11
sub rcx, rax
mov rax, r9
imul rax, qword [0x1402b2080]
lea r8, [0x1402b2060]
mov rdx, qword [r8 + rcx*8]
and rdx, rax
xor rdx, r11
and r11b, 0x3f
mov cl, r11b
mov r11, rdx
ror r11, cl
imul r11, r10
not r15
imul r15, r14
movabs rax, 0x7cd8a7de7aa2bff0
imul r15, rax
mov rax, r11
imul rax, rdi
mov rdi, r15
xor rdi, rax
imul r8, qword [0x1402b2060], 0xfffffffffff4142e
mov rdx, qword [0x1402b2068]
sub r8, rdx
mov al, dil
not al
movzx ecx, al
movzx eax, dl
xor ecx, eax
and ecx, 0x8000003f
jge 0x1401a199b
dec ecx
or ecx, 0xffffffc0
inc ecx
ror r8, cl
movabs r15, 0x2c8e45d45c1507b3
add r15, r8
add r15, r13
jmp 0x1401a19ba
movabs r12, 0xaaaaaaaaaaaaaaab
movabs rcx, 0xff055d7b8ae9b53d
xor rbx, rcx
mov rax, r12
mul rbx
shr rdx, 2
lea rax, [rdx + rdx*2]
add rax, rax
sub rbx, rax
xor r11, rdi
lea rax, [0x1402b2060]
imul r11, qword [rax + rbx*8]
not r10
imul r10, r9
imul r10, r15
imul r10, rsi
movabs rcx, 0xf5ed7e878d5affe1
xor rcx, r14
not rcx
xor rcx, r10
sub rcx, r11
call fcn.14016e320
mov qword [0x1402b3158], rax
mov r9d, dword [0x1402b2090]
movdqa xmm0, xmmword [0x140293b90]
movdqu xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x140293c40]
movdqu xmmword [rbp - 0x10], xmm1
xor r12d, r12d
mov r13, qword [0x1402b2040]
xor edx, edx
mov rax, r12
movabs rcx, 0x13cce94adbe8f3f8
div rcx
add dl, 0x37
mov r15b, dl
sar r15b, 7
or r15b, dl
mov al, r15b
sar al, 2
mov r14b, r15b
shl r14b, 6
mov sil, r14b
or sil, al
movsx rcx, r15b
or r14b, al
mov r10b, r15b
sar r10b, 5
mov al, r15b
shl al, 3
or r10b, al
mov r11b, r15b
sar r11b, 3
mov al, r15b
shl al, 5
or r11b, al
mov r8b, r15b
sar r8b, 4
mov al, r15b
shl al, 4
or r8b, al
mov bl, r15b
not bl
mov dil, r15b
ror dil, 7
lea eax, [r11 - 0x50]
add dil, al
mov dl, byte [rbp + r12 - 0x20]
sub dl, sil
sub dl, 2
mov eax, 4
sub al, r14b
xor dl, al
sar rcx, 1
mov al, r15b
shl al, 7
or cl, al
sub dl, cl
sub dl, byte [0x1402b2050]
sub dl, byte [0x1402b2058]
sub dl, 0x3f
add dl, r14b
add dl, r15b
lea eax, [rsi + 7]
add al, r15b
xor dl, al
sub dl, r10b
sub dl, r15b
sub dl, byte [0x1402b2048]
sub dl, 0x50
add dl, r14b
add dl, r13b
mov al, sil
sub al, r10b
add al, r15b
add al, r8b
xor dl, al
mov al, r15b
sub al, r8b
xor al, r15b
sub dl, al
sub dl, r11b
add dl, 0x30
add dl, r15b
xor dil, dl
mov al, r15b
add al, al
sub dil, al
add dil, 0x51
add dil, r14b
add dil, sil
add dil, r13b
not dil
mov al, r15b
sar al, 7
or al, r15b
sub dil, al
mov al, byte [0x1402b2038]
xor al, bl
sub dil, al
mov al, r15b
xor al, byte [0x1402b2030]
add dil, al
mov al, r15b
xor al, 0x40
sub dil, al
movsx eax, bl
movsx ecx, r15b
imul ecx, eax
xor dil, cl
mov byte [rbp + r12 - 0x20], dil
inc r12
cmp r12, 0x20
jb 0x1401a1a46
lea rax, [rbp - 0x20]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 0x20
and dword [rbp + 0x50], 0
mov dword [rbp + 0x50], 0x8fc2f19a
mov eax, 0x8207912a
sub eax, dword [0x1402b2058]
sub eax, dword [0x1402b2050]
xor eax, 0x787aaf87
sub eax, dword [0x1402b2048]
mov rdx, qword [0x1402b2040]
lea ecx, [rdx + 0x3d85f57]
add ecx, eax
xor ecx, 0x473b2839
add ecx, 0x7163a211
xor ecx, 0xe6a06d3d
mov r8d, dword [0x1402b2030]
xor r8d, 0x240b54b7
sub r8d, ecx
mov eax, dword [0x1402b2038]
xor eax, 0xdbf4ab48
sub r8d, eax
sub r8d, edx
add r8d, 0x27b3210b
xor r8d, 0x321078
mov dword [rbp + 0x50], r8d
movsxd rdx, r8d
mov dword [rsp + 0x20], r9d
lea r8, [rbp - 0x20]
mov r13, qword [rbp - 0x38]
mov rcx, r13
call fcn.14008c3c0
nop
and dword [rbp + 0x50], 0
and dword [rbp + 0x58], 0
mov dword [rbp + 0x58], 0x1273ed3c
mov eax, 0x1c1d7e71
sub eax, dword [0x1402b2058]
sub eax, dword [0x1402b2050]
xor eax, 0x76876aad
sub eax, dword [0x1402b2048]
mov r8, qword [0x1402b2040]
lea edx, [r8 + 0x413d148c]
add edx, eax
xor edx, 0x450a708f
add edx, 0x71e43613
xor edx, 0x31aa92a0
mov ecx, dword [0x1402b2030]
xor ecx, 0x2403a65d
sub ecx, edx
mov eax, dword [0x1402b2038]
xor eax, 0xdbfc59a2
sub ecx, eax
sub ecx, r8d
sub ecx, 0x4ebab0b9
xor ecx, 0x61b19bda
mov dword [rbp + 0x58], ecx
call fcn.140227c2c
mov rdx, rax
mov rcx, r13
call fcn.140227d78
nop
and dword [rbp + 0x58], 0
xor ebx, ebx
mov edi, 0x9802479a
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
movups xmm0, xmmword [rax + 0x58]
movd ecx, xmm0
sub cx, 8
test ebx, ebx
je 0x1401a1d49
psrldq xmm0, 8
movq r9, xmm0
movzx ecx, cx
shr rcx, 1
lea r11, [r9 + rcx*2]
mov r10d, 0x5db6b13e
jmp 0x1401a1d3b
movsx edx, byte [r9]
mov r8d, edx
imul r8d, edx
add r8d, 0x31
xor r8d, 0x4764996c
mov ecx, r10d
xor ecx, edx
mov r10d, r8d
imul r10d, ecx
add r9, 2
cmp r9, r11
jne 0x1401a1d15
cmp r10d, ebx
jne 0x1401a1e4d
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov rcx, qword [rcx + r10 + 0x88]
mov r11d, ecx
add r11, r10
shr rcx, 0x20
cmp r11, r10
je 0x1401a1e4d
mov esi, dword [r11 + 0x18]
test esi, esi
je 0x1401a1e4d
mov r12d, dword [r11 + 0x20]
dec esi
lea rdx, [r10 + rsi*4]
mov r9d, dword [rdx + r12]
add r9, r10
mov r14d, 0x5db6b13e
jmp 0x1401a1daf
movsx r8d, dl
mov edx, r8d
imul edx, r8d
add edx, 0x31
xor edx, 0x4764996c
xor r8d, r14d
mov r14d, edx
imul r14d, r8d
mov dl, byte [r9]
inc r9
test dl, dl
jne 0x1401a1d91
cmp r14d, edi
je 0x1401a1dc7
test esi, esi
jne 0x1401a1d7c
jmp 0x1401a1e4d
mov edx, dword [r11 + 0x24]
add rdx, r10
movzx r8d, word [rdx + rsi*2]
mov edx, dword [r11 + 0x1c]
add rdx, r10
mov r9d, dword [rdx + r8*4]
add r9, r10
cmp r9, r11
jbe 0x1401a1e55
lea rax, [r11 + rcx]
cmp r9, rax
jae 0x1401a1e55
mov ebx, 0x5db6b13e
mov edi, ebx
jmp 0x1401a1e12
movsx ecx, al
mov eax, ecx
imul eax, ecx
add eax, 0x31
xor eax, 0x4764996c
xor ecx, ebx
mov ebx, eax
imul ebx, ecx
inc r9
mov al, byte [r9]
cmp al, 0x2e
jne 0x1401a1df8
jmp 0x1401a1e32
movsx ecx, al
mov eax, ecx
imul eax, ecx
add eax, 0x31
xor eax, 0x4764996c
xor ecx, edi
mov edi, eax
imul edi, ecx
inc r9
mov al, byte [r9]
test al, al
jne 0x1401a1e1b
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rax, qword [rax]
jmp 0x1401a1ce9
mov rcx, r13
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
jmp r9