Function at 0x14009c000
Capabilities:
Access peb ldr_data
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x260
mov rax, qword gs:[0x60]
xor r12d, r12d
mov qword [0x14009f1d8], rax
movaps xmmword [rsp + 0x250], xmm6
mov rax, qword [rax + 0x10]
mov qword [0x14009f1d0], rax
movabs rax, 0xeb999818397a2870
mov qword [rsp + 0x2a0], rax
mov rax, qword [rsp + 0x2a0]
mov qword [rsp + 0x60], rax
movabs rax, 0xc7f3c06aef616841
mov qword [rsp + 0x2a0], rax
mov rax, qword [rsp + 0x2a0]
mov qword [rsp + 0x68], rax
movabs rax, 0xe3c7e60fbccbcc4b
mov qword [rsp + 0x2a0], rax
mov rax, qword [rsp + 0x2a0]
mov qword [rsp + 0x70], rax
movabs rax, 0xce730876fcae1854
mov qword [rsp + 0x2a0], rax
mov rax, qword [rsp + 0x2a0]
mov qword [rsp + 0x78], rax
mov rax, qword [0x14009f1d8]
mov rax, qword [rax + 0x18]
add rax, 0x20
mov qword [rsp + 0x2a0], rax
mov r15, qword [rax]
cmp r15, rax
je 0x14009c161
nop dword [rax + rax]
mov rsi, qword [r15 + 0x20]
movsxd rax, dword [rsi + 0x3c]
mov ecx, dword [rax + rsi + 0x88]
test ecx, ecx
je 0x14009c151
mov r12d, dword [rsi + rcx + 0x1c]
lea rax, [rsi + rcx]
mov ebx, dword [rax + 0x20]
add r12, rsi
mov r13d, dword [rax + 0x24]
add rbx, rsi
mov r14d, dword [rax + 0x18]
add r13, rsi
xor edi, edi
test r14d, r14d
je 0x14009c151
nop word [rax + rax]
mov ecx, dword [rbx]
add rcx, rsi
call fcn.14009d170
cmp eax, 0x266089c2
je 0x14009c13e
inc edi
add rbx, 4
cmp edi, r14d
jb 0x14009c120
jmp 0x14009c151
movzx ecx, word [r13 + rdi*2]
mov edx, dword [r12 + rcx*4]
add rdx, rsi
jne 0x14009c49e
mov r15, qword [r15]
cmp r15, qword [rsp + 0x2a0]
jne 0x14009c0e0
xor r12d, r12d
mov rdx, r12
movabs rsi, 0xebeb987d39092805
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x2a0], rsi
movabs rdi, 0xc797c044ef536872
mov rax, qword [rsp + 0x2a0]
movabs rbx, 0xe3c7e60fbca7cc27
mov qword [rsp + 0x40], rax
movabs r14, 0xce730876fcae1854
mov qword [rsp + 0x2a0], rdi
mov rax, qword [rsp + 0x2a0]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x2a0], rbx
mov rax, qword [rsp + 0x2a0]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x2a0], r14
mov rax, qword [rsp + 0x2a0]
mov qword [rsp + 0x58], rax
vmovdqu ymm0, ymmword [rsp + 0x40]
vpxor ymm1, ymm0, ymmword [rsp + 0x60]
vmovdqu ymmword [rsp + 0x60], ymm1
vzeroupper
call rdx
mov qword [rsp + 0x2a0], rsi
lea rcx, [0x14009f000]
mov rax, qword [rsp + 0x2a0]
mov edx, 3
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x2a0], rdi
mov rax, qword [rsp + 0x2a0]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x2a0], rbx
mov rax, qword [rsp + 0x2a0]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x2a0], r14
mov rax, qword [rsp + 0x2a0]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x80]
vmovdqu ymm0, ymmword [rsp + 0x40]
vpxor ymm1, ymm0, ymmword [rsp + 0x60]
vmovdqu ymmword [rsp + 0x60], ymm1
vzeroupper
nop dword [rax]
lea rax, [rax + 0x80]
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rax - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rax - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rax - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rax - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rax - 0x30], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rax - 0x20], xmm0
movups xmmword [rax - 0x10], xmm1
sub rdx, 1
jne 0x14009c280
movups xmm0, xmmword [rcx]
mov rdi, qword [0x14009f1d0]
xor r8b, r8b
movups xmm1, xmmword [rcx + 0x10]
mov byte [rsp + 0x2a0], r8b
xor r13b, r13b
movups xmmword [rax], xmm0
mov r15d, 0x64
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x30], xmm1
movups xmmword [rax + 0x40], xmm0
movaps xmm6, xmmword [rsp + 0x90]
mov byte [rsp + 0x2a8], r13b
mov eax, r12d
mov rcx, rdi
mov rdx, r15
nop dword [rax]
crc32 eax, byte [rcx]
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x14009c330
xor al, byte [rsp + 0xa4]
cmp r13b, al
jae 0x14009c830
mov edx, r12d
mov rax, rdi
mov rcx, r15
nop dword [rax + rax]
crc32 edx, byte [rax]
lea rax, [rax + 1]
sub rcx, 1
jne 0x14009c360
movzx eax, r13b
imul rcx, rax, 0xd
mov eax, dword [rsp + rcx + 0xad]
movsd xmm0, qword [rsp + rcx + 0xa5]
mov dword [rsp + 0x28], eax
movzx eax, byte [rsp + rcx + 0xb1]
mov ecx, 0xd
mov byte [rsp + 0x2c], al
lea rax, [rsp + 0x20]
movsd qword [rsp + 0x20], xmm0
nop word [rax + rax]
xor byte [rax], dl
lea rax, [rax + 1]
sub rcx, 1
jne 0x14009c3b0
mov r14d, dword [rsp + 0x25]
mov eax, r12d
add r14, rdi
mov rcx, rdi
mov qword [rsp + 0x2b8], r14
mov rdx, r15
nop word [rax + rax]
crc32 eax, byte [rcx]
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x14009c3e0
xor al, byte [rsp + 0x84]
mov r9d, dword [rsp + 0x29]
movzx r8d, byte [rsp + 0x20]
je 0x14009c67f
movzx eax, r8b
and al, 5
cmp al, 1
jne 0x14009c67f
mov rax, qword [0x14009f1d8]
mov dword [rsp + 0x2b0], r12d
mov rax, qword [rax + 0x18]
add rax, 0x20
mov qword [rsp + 0x30], rax
mov r15, qword [rax]
cmp r15, rax
je 0x14009c4ca
nop dword [rax]
mov rsi, qword [r15 + 0x20]
movsxd rax, dword [rsi + 0x3c]
mov ecx, dword [rax + rsi + 0x88]
test ecx, ecx
je 0x14009c4b9
mov r12d, dword [rsi + rcx + 0x1c]
lea rax, [rsi + rcx]
mov ebx, dword [rax + 0x20]
add r12, rsi
mov r13d, dword [rax + 0x24]
add rbx, rsi
mov r14d, dword [rax + 0x18]
add r13, rsi
xor edi, edi
test r14d, r14d
je 0x14009c4b9
nop word [rax + rax]
mov ecx, dword [rbx]
add rcx, rsi
call fcn.14009d170
cmp eax, 0xa2b3228a
je 0x14009c4a6
inc edi
add rbx, 4
cmp edi, r14d
jb 0x14009c480
jmp 0x14009c4b9
xor r12d, r12d
jmp 0x14009c164
movzx ecx, word [r13 + rdi*2]
mov eax, dword [r12 + rcx*4]
add rax, rsi
jne 0x14009c60e
mov r15, qword [r15]
cmp r15, qword [rsp + 0x30]
jne 0x14009c440
xor r12d, r12d
mov rax, r12
mov ebx, dword [rsp + 0x29]
lea r9, [rsp + 0x2b0]
mov rdi, qword [rsp + 0x2b8]
mov edx, ebx
mov rcx, rdi
mov r8d, 4
call rax
lea r11, [rbx + rdi]
mov r10, rdi
cmp rdi, r11
jae 0x14009c586
mov rbx, qword [0x14009f1d0]
mov edi, 0x64
nop word [rax + rax]
mov eax, r12d
mov rcx, rbx
mov rdx, rdi
nop dword [rax]
crc32 eax, byte [rcx]
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x14009c520
movdqa xmmword [rsp + 0x30], xmm6
lea rcx, [rsp + 0x30]
mov edx, 0x10
nop
xor byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x14009c540
movaps xmm0, xmmword [rsp + 0x30]
mov ecx, 0x40
movzx r8d, byte [r10]
movq r9, xmm0
and ecx, 0x3f
movdqa xmmword [rsp + 0x30], xmm0
psrldq xmm0, 8
movq rdx, xmm0
shr rdx, cl
sub r8b, dl
xor r8b, r9b
mov byte [r10], r8b
inc r10
cmp r10, r11
jb 0x14009c510
mov rax, qword [0x14009f1d8]
mov rax, qword [rax + 0x18]
add rax, 0x20
mov qword [rsp + 0x30], rax
mov r15, qword [rax]
cmp r15, rax
je 0x14009c63a
nop word [rax + rax]
mov rsi, qword [r15 + 0x20]
movsxd rax, dword [rsi + 0x3c]
mov ecx, dword [rax + rsi + 0x88]
test ecx, ecx
je 0x14009c629
mov r12d, dword [rsi + rcx + 0x1c]
lea rax, [rsi + rcx]
mov ebx, dword [rax + 0x20]
add r12, rsi
mov r13d, dword [rax + 0x24]
add rbx, rsi
mov r14d, dword [rax + 0x18]
add r13, rsi
xor edi, edi
test r14d, r14d
je 0x14009c629
nop word [rax + rax]
mov ecx, dword [rbx]
add rcx, rsi
call fcn.14009d170
cmp eax, 0xa2b3228a
je 0x14009c616
inc edi
add rbx, 4
cmp edi, r14d
jb 0x14009c5f0
jmp 0x14009c629
xor r12d, r12d
jmp 0x14009c4cd
movzx ecx, word [r13 + rdi*2]
mov eax, dword [r12 + rcx*4]
add rax, rsi
jne 0x14009c805
mov r15, qword [r15]
cmp r15, qword [rsp + 0x30]
jne 0x14009c5b0
xor r12d, r12d
mov rax, r12
mov r14, qword [rsp + 0x2b8]
lea r9, [rsp + 0x2b0]
mov r8d, dword [rsp + 0x2b0]
mov rcx, r14
mov edx, dword [rsp + 0x29]
call rax
movzx r8d, byte [rsp + 0x20]
mov r15d, 0x64
mov r9d, dword [rsp + 0x29]
mov rdi, qword [0x14009f1d0]
movzx r13d, byte [rsp + 0x2a8]
mov eax, r12d
mov rcx, rdi
mov rdx, r15
nop dword [rax + rax]
crc32 eax, byte [rcx]
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x14009c690
xor al, byte [rsp + 0x82]
je 0x14009c78e
test r8b, 2
je 0x14009c78e
mov esi, r9d
mov r11d, r12d
add rsi, r14
mov r10, r14
cmp r14, rsi
jae 0x14009c783
movzx ebx, r8b
mov r14d, 0x10
shr bl, 2
mov r13d, 0x40
and bl, 1
movzx r8d, byte [r10]
test bl, bl
je 0x14009c755
mov eax, r12d
mov rcx, rdi
mov rdx, r15
nop dword [rax]
nop word [rax + rax]
crc32 eax, byte [rcx]
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x14009c700
movdqa xmmword [rsp + 0x30], xmm6
lea rcx, [rsp + 0x30]
mov rdx, r14
nop dword [rax]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x14009c720
movaps xmm0, xmmword [rsp + 0x30]
mov ecx, r13d
movq r9, xmm0
movdqa xmmword [rsp + 0x30], xmm0
and ecx, 0x3f
psrldq xmm0, 8
movq rdx, xmm0
shr rdx, cl
sub r8b, dl
xor r8b, r9b
inc r10
crc32 r11d, r8b
cmp r10, rsi
jb 0x14009c6e1
mov r14, qword [rsp + 0x2b8]
movzx r8d, byte [rsp + 0x20]
mov r9d, dword [rsp + 0x29]
movzx r13d, byte [rsp + 0x2a8]
cmp dword [rsp + 0x21], r11d
jne 0x14009c81e
mov eax, r12d
mov rcx, rdi
mov rdx, r15
nop word [rax + rax]
crc32 eax, byte [rcx]
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x14009c7a0
xor al, byte [rsp + 0x83]
je 0x14009c80d
test r8b, 4
je 0x14009c80d
mov ebx, r9d
add rbx, 0xfff
add rbx, r14
and rbx, 0xfffffffffffff000
cmp r14, rbx
jae 0x14009c7f2
mov rcx, r14
call fcn.14009d340
add r14, 0x1000
cmp r14, rbx
jb 0x14009c7d7
mov rdi, qword [0x14009f1d0]
mov r8b, 1
inc r13b
mov byte [rsp + 0x2a0], r8b
jmp 0x14009c31c
xor r12d, r12d
jmp 0x14009c63d
movzx r8d, byte [rsp + 0x2a0]
inc r13b
jmp 0x14009c31c
lea rcx, [rsp + 0x2a0]
call fcn.14009c950
jmp 0x14009c933
test r8b, r8b
je 0x14009c89e
mov eax, r12d
mov rcx, r15
nop dword [rax + rax]
crc32 eax, byte [rdi]
lea rdi, [rdi + 1]
sub rcx, 1
jne 0x14009c840
movdqa xmmword [rsp + 0x20], xmm6
lea rcx, [rsp + 0x20]
mov edx, 0x10
nop
xor byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x14009c860
movaps xmm0, xmmword [rsp + 0x20]
lea rcx, [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
call fcn.14009d410
test al, al
jne 0x14009c897
lea rcx, [rsp + 0x2a0]
call fcn.14009cd20
jmp 0x14009c933
mov rdi, qword [0x14009f1d0]
mov eax, r12d
mov rcx, rdi
mov rdx, r15
nop word [rax + rax]
crc32 eax, byte [rcx]
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x14009c8b0
movdqa xmmword [rsp + 0x20], xmm6
lea rcx, [rsp + 0x20]
mov r8d, 0x10
xor byte [rcx], al
lea rcx, [rcx + 1]
sub r8, 1
jne 0x14009c8d0
mov rax, rdi
nop
crc32 r12d, byte [rax]
lea rax, [rax + 1]
sub r15, 1
jne 0x14009c8e0
mov eax, dword [rsp + 0xa0]
mov r9d, 4
mov dword [rsp + 0x2a0], eax
lea rax, [rsp + 0x2a0]
nop dword [rax]
xor byte [rax], r12b
lea rax, [rax + 1]
sub r9, 1
jne 0x14009c910
mov eax, dword [rsp + 0x20]
mov ecx, dword [rsp + 0x2a0]
xor rcx, rax
add rcx, rdi
call fcn.14009d7d0
movaps xmm6, xmmword [rsp + 0x250]
add rsp, 0x260
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret