Function at 0x140001190
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
push rax
mov eax, 1
cmp dword [0x140004148], 0
jne 0x140001390
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
mov r10, qword [rcx + 0x30]
test r10, r10
je 0x14000138e
xor r9d, r9d
mov r8d, 0xdfdfdfdf
jmp 0x1400011ef
mov r9, r11
mov rcx, qword [rcx]
mov r10, qword [rcx + 0x30]
test r10, r10
je 0x140001231
mov rdx, r10
movsxd r10, dword [r10 + 0x3c]
mov r11d, dword [r10 + rdx + 0x88]
test r11, r11
je 0x1400011e3
mov r9d, dword [r11 + rdx + 0xc]
add r11, rdx
mov r10d, dword [r9 + rdx]
and r10d, r8d
cmp r10d, 0x4c44544e
jne 0x1400011e0
mov r10d, dword [r9 + rdx + 4]
and r10d, r8d
mov r9, r11
cmp r10d, 0x4c440e4c
jne 0x1400011e3
jmp 0x14000123d
mov r11, r9
test r9, r9
je 0x14000138e
mov r8d, dword [r11 + 0x18]
mov r9d, dword [r11 + 0x1c]
add r9, rdx
mov r10d, dword [r11 + 0x20]
add r10, rdx
mov r11d, dword [r11 + 0x24]
add r11, rdx
lea rsi, [rdx + 0x12]
lea rax, [rdx - 0xe]
mov qword [rsp], rax
lea rbx, [rdx + 0x32]
xor ecx, ecx
lea r14, [0x140004148]
jmp 0x140001290
add r12, rsi
mov qword [r15 + r14 + 0x10], r12
inc ecx
cmp ecx, 0x1f4
je 0x1400013b4
test r8, r8
je 0x1400013a1
dec r8d
mov r15d, dword [r10 + r8*4]
movzx ebp, word [rdx + r15]
cmp ebp, 0x775a
jne 0x140001287
add r15, rdx
mov ebp, 0x4552ac07
mov r12d, 1
xor r13d, r13d
nop word cs:[rax + rax]
mov edi, ebp
movzx r13d, word [r13 + r15]
rol ebp, 0x18
add ebp, r13d
xor ebp, edi
mov r13d, r12d
inc r12d
cmp byte [r15 + r13], 0
jne 0x1400012c0
mov r15d, ecx
shl r15, 4
mov dword [r15 + r14 + 8], ebp
movzx edi, word [r11 + r8*2]
mov r12d, dword [r9 + rdi*4]
mov dword [r15 + r14 + 0xc], r12d
movzx edi, word [rsi + r12]
xor edi, 0x50f
movzx ebp, byte [rsi + r12 + 2]
xor ebp, 0xc3
or bp, di
je 0x140001271
mov rax, qword [rsp]
lea r13, [rax + r12]
add r12, rbx
xor ebp, ebp
nop word cs:[rax + rax]
movzx edi, word [r12 + rbp]
xor edi, 0x50f
movzx eax, byte [r12 + rbp + 2]
xor eax, 0xc3
or ax, di
je 0x14000137e
movzx eax, word [r13]
xor eax, 0x50f
movzx edi, byte [r13 + 2]
xor edi, 0xc3
or di, ax
je 0x140001386
add r13, 0xffffffffffffffe0
add rbp, 0x20
cmp rbp, 0x3fe0
jne 0x140001330
xor r12d, r12d
jmp 0x140001274
add r12, rbp
jmp 0x140001274
mov r12, r13
jmp 0x140001274
xor eax, eax
add rsp, 8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov dword [0x140004148], ecx
mov edx, ecx
dec edx
mov eax, 1
jne 0x1400013cd
jmp 0x140001390
mov dword [0x140004148], 0x1f4
mov ecx, 0x1f4
mov edx, 0x1f3
mov eax, 1
xor r8d, r8d
lea r9, [0x140004168]
mov r10d, edx
jmp 0x1400013e8
dec r10d
cmp r8d, edx
je 0x140001390
mov r10d, r10d
inc r8d
cmp ecx, r8d
je 0x1400013e0
mov r11, r10
mov rsi, r9
jmp 0x140001409
add rsi, 0x10
dec r11
je 0x1400013e0
mov edi, dword [rsi - 0x14]
mov ebx, dword [rsi - 4]
cmp edi, ebx
jbe 0x140001400
mov r15d, dword [rsi - 0x18]
mov r14, qword [rsi - 0x10]
mov ebp, dword [rsi - 8]
mov dword [rsi - 0x18], ebp
mov dword [rsi - 0x14], ebx
mov rbx, qword [rsi]
mov qword [rsi - 0x10], rbx
mov dword [rsi - 8], r15d
mov dword [rsi - 4], edi
mov qword [rsi], r14
jmp 0x140001400