Function at 0x1406d2000
Capabilities:
Access peb ldr_data
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x260
mov rax, qword gs:[0x60]
mov qword [0x1406d41c8], rax
mov rax, qword [rax + 0x10]
mov qword [0x1406d41c0], rax
movabs rax, 0x8136f2f2dbea57a0
mov qword [rsp + 0x2a0], rax
mov rax, qword [rsp + 0x2a0]
mov qword [rsp + 0x60], rax
movabs rax, 0xac65044095029495
mov qword [rsp + 0x2a0], rax
mov rax, qword [rsp + 0x2a0]
mov qword [rsp + 0x68], rax
movabs rax, 0xaf27a96565801e1b
mov qword [rsp + 0x2a0], rax
mov rax, qword [rsp + 0x2a0]
mov qword [rsp + 0x70], rax
movabs rax, 0x4b6e9f5c2f8b9b98
mov qword [rsp + 0x2a0], rax
mov rax, qword [rsp + 0x2a0]
mov qword [rsp + 0x78], rax
mov rax, qword [0x1406d41c8]
mov rax, qword [rax + 0x18]
add rax, 0x20
mov qword [rsp + 0x2a0], rax
mov r15, qword [rax]
cmp r15, rax
je 0x1406d214a
nop dword [rax]
mov rsi, qword [r15 + 0x20]
movsxd rax, dword [rsi + 0x3c]
mov ecx, dword [rax + rsi + 0x88]
test ecx, ecx
je 0x1406d213d
mov r12d, dword [rsi + rcx + 0x1c]
lea rax, [rsi + rcx]
mov ebx, dword [rax + 0x20]
add r12, rsi
mov r13d, dword [rax + 0x24]
add rbx, rsi
mov r14d, dword [rax + 0x18]
add r13, rsi
xor edi, edi
test r14d, r14d
je 0x1406d213d
nop word [rax + rax]
mov ecx, dword [rbx]
add rcx, rsi
call fcn.1406d2b20
cmp eax, 0x266089c2
je 0x1406d212e
inc edi
add rbx, 4
cmp edi, r14d
jb 0x1406d2110
jmp 0x1406d213d
movzx ecx, word [r13 + rdi*2]
mov edx, dword [r12 + rcx*4]
add rdx, rsi
jne 0x1406d214c
mov r15, qword [r15]
cmp r15, qword [rsp + 0x2a0]
jne 0x1406d20d0
xor edx, edx
movabs rsi, 0x8144f297db9957d5
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x2a0], rsi
movabs rdi, 0xac01046e953094a6
mov rax, qword [rsp + 0x2a0]
movabs rbx, 0xaf27a96565ec1e77
mov qword [rsp + 0x20], rax
movabs r14, 0x4b6e9f5c2f8b9b98
mov qword [rsp + 0x2a0], rdi
mov rax, qword [rsp + 0x2a0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x2a0], rbx
mov rax, qword [rsp + 0x2a0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x2a0], r14
mov rax, qword [rsp + 0x2a0]
mov qword [rsp + 0x38], rax
vmovdqu ymm0, ymmword [rsp + 0x20]
vpxor ymm1, ymm0, ymmword [rsp + 0x60]
vmovdqu ymmword [rsp + 0x60], ymm1
vzeroupper
call rdx
mov qword [rsp + 0x2a0], rsi
lea rcx, [0x1406d4000]
mov rax, qword [rsp + 0x2a0]
mov edx, 3
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x2a0], rdi
mov rax, qword [rsp + 0x2a0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x2a0], rbx
mov rax, qword [rsp + 0x2a0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x2a0], r14
mov rax, qword [rsp + 0x2a0]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x90]
vmovdqu ymm0, ymmword [rsp + 0x20]
vpxor ymm1, ymm0, ymmword [rsp + 0x60]
vmovdqu ymmword [rsp + 0x60], ymm1
vzeroupper
lea rax, [rax + 0x80]
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rax - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rax - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rax - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rax - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rax - 0x30], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rax - 0x20], xmm0
movups xmmword [rax - 0x10], xmm1
sub rdx, 1
jne 0x1406d2261
movups xmm0, xmmword [rcx]
mov r10, qword [0x1406d41c0]
mov edx, 0x64
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
mov rcx, r10
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm1
xor eax, eax
nop dword [rax]
nop word [rax + rax]
crc32 eax, byte [rcx]
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x1406d22f0
lea rcx, [rsp + 0x90]
mov edx, 0x1c0
nop dword [rax]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x1406d2310
movzx eax, byte [rsp + 0xa5]
mov r9, qword [0x1406d41c8]
test al, 2
je 0x1406d23e5
cmp byte [r9 + 2], dl
je 0x1406d23e5
mov rax, qword [r9 + 0x18]
add rax, 0x20
mov qword [rsp + 0x2a0], rax
mov r15, qword [rax]
cmp r15, rax
je 0x1406d23da
nop dword [rax]
mov rsi, qword [r15 + 0x20]
movsxd rax, dword [rsi + 0x3c]
mov ecx, dword [rax + rsi + 0x88]
test ecx, ecx
je 0x1406d23cd
mov r12d, dword [rsi + rcx + 0x1c]
lea rax, [rsi + rcx]
mov ebx, dword [rax + 0x20]
add r12, rsi
mov r13d, dword [rax + 0x24]
add rbx, rsi
mov r14d, dword [rax + 0x18]
add r13, rsi
xor edi, edi
test r14d, r14d
je 0x1406d23cd
nop word [rax + rax]
mov ecx, dword [rbx]
add rcx, rsi
call fcn.1406d2b20
cmp eax, 0x5588c932
je 0x1406d23be
inc edi
add rbx, 4
cmp edi, r14d
jb 0x1406d23a0
jmp 0x1406d23cd
movzx ecx, word [r13 + rdi*2]
mov eax, dword [r12 + rcx*4]
add rax, rsi
jne 0x1406d23dc
mov r15, qword [r15]
cmp r15, qword [rsp + 0x2a0]
jne 0x1406d2360
xor eax, eax
xor ecx, ecx
call rax
jmp 0x1406d2b0c
test al, 1
je 0x1406d26f3
mov rax, qword [r9 + 0x18]
add rax, 0x20
mov qword [rsp + 0x2a0], rax
mov r15, qword [rax]
cmp r15, rax
je 0x1406d248a
nop dword [rax]
mov rsi, qword [r15 + 0x20]
movsxd rax, dword [rsi + 0x3c]
mov ecx, dword [rax + rsi + 0x88]
test ecx, ecx
je 0x1406d247d
mov r12d, dword [rsi + rcx + 0x1c]
lea rax, [rsi + rcx]
mov ebx, dword [rax + 0x20]
add r12, rsi
mov r13d, dword [rax + 0x24]
add rbx, rsi
mov r14d, dword [rax + 0x18]
add r13, rsi
xor edi, edi
test r14d, r14d
je 0x1406d247d
nop word [rax + rax]
mov ecx, dword [rbx]
add rcx, rsi
call fcn.1406d2b20
cmp eax, 0xede7343e
je 0x1406d246e
inc edi
add rbx, 4
cmp edi, r14d
jb 0x1406d2450
jmp 0x1406d247d
movzx ecx, word [r13 + rdi*2]
mov eax, dword [r12 + rcx*4]
add rax, rsi
jne 0x1406d248c
mov r15, qword [r15]
cmp r15, qword [rsp + 0x2a0]
jne 0x1406d2410
xor eax, eax
call rax
mov rcx, qword [0x1406d41c8]
mov qword [rsp + 0x2b0], rax
mov rax, qword [rcx + 0x18]
add rax, 0x20
mov qword [rsp + 0x2a0], rax
mov r15, qword [rax]
cmp r15, rax
je 0x1406d252f
nop word [rax + rax]
mov rsi, qword [r15 + 0x20]
movsxd rcx, dword [rsi + 0x3c]
mov eax, dword [rcx + rsi + 0x88]
test eax, eax
je 0x1406d2522
add rax, rsi
xor edi, edi
mov r12d, dword [rax + 0x1c]
mov ebx, dword [rax + 0x20]
add r12, rsi
mov r13d, dword [rax + 0x24]
add rbx, rsi
mov r14d, dword [rax + 0x18]
add r13, rsi
test r14d, r14d
je 0x1406d2522
mov ecx, dword [rbx]
add rcx, rsi
call fcn.1406d2b20
cmp eax, 0x88f1ee12
je 0x1406d2513
inc edi
add rbx, 4
cmp edi, r14d
jb 0x1406d24f5
jmp 0x1406d2522
movzx ecx, word [r13 + rdi*2]
mov eax, dword [r12 + rcx*4]
add rax, rsi
jne 0x1406d2531
mov r15, qword [r15]
cmp r15, qword [rsp + 0x2a0]
jne 0x1406d24c0
xor eax, eax
mov rcx, qword [rsp + 0x2b0]
call rax
mov rcx, qword [0x1406d41c8]
mov dword [rsp + 0x2a0], eax
mov rcx, qword [rcx + 0x18]
add rcx, 0x20
mov qword [rsp + reloc.SHELL32.dll_IsUserAnAdmin], rcx
mov r15, qword [rcx]
cmp r15, rcx
je 0x1406d25ed
mov rax, rcx
nop dword [rax + rax]
mov rsi, qword [r15 + 0x20]
movsxd rcx, dword [rsi + 0x3c]
mov edx, dword [rcx + rsi + 0x88]
test edx, edx
je 0x1406d25e5
mov r12d, dword [rsi + rdx + 0x1c]
lea rax, [rsi + rdx]
mov ebx, dword [rax + 0x20]
add r12, rsi
mov r13d, dword [rax + 0x24]
add rbx, rsi
mov r14d, dword [rax + 0x18]
add r13, rsi
xor edi, edi
test r14d, r14d
je 0x1406d25dd
nop word [rax + rax]
mov ecx, dword [rbx]
add rcx, rsi
call fcn.1406d2b20
cmp eax, 0x42b2c9b6
je 0x1406d25ce
inc edi
add rbx, 4
cmp edi, r14d
jb 0x1406d25b0
jmp 0x1406d25dd
movzx ecx, word [r13 + rdi*2]
mov eax, dword [r12 + rcx*4]
add rax, rsi
jne 0x1406d25ef
mov rax, qword [rsp + reloc.SHELL32.dll_IsUserAnAdmin]
mov r15, qword [r15]
cmp r15, rax
jne 0x1406d2570
xor eax, eax
mov rcx, qword [rsp + 0x2b0]
mov edx, 0xf
call rax
mov r8d, 0xc350
nop dword [rax]
nop dword [rax + rax]
xor eax, eax
xor ecx, ecx
cpuid
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x24], ebx
sub r8, 1
jne 0x1406d2610
mov rax, qword [0x1406d41c8]
mov rax, qword [rax + 0x18]
add rax, 0x20
mov qword [rsp + reloc.SHELL32.dll_IsUserAnAdmin], rax
mov r15, qword [rax]
cmp r15, rax
je 0x1406d26ca
nop word [rax + rax]
mov rsi, qword [r15 + 0x20]
movsxd rax, dword [rsi + 0x3c]
mov ecx, dword [rax + rsi + 0x88]
test ecx, ecx
je 0x1406d26bd
mov r12d, dword [rsi + rcx + 0x1c]
lea rax, [rsi + rcx]
mov ebx, dword [rax + 0x20]
add r12, rsi
mov r13d, dword [rax + 0x24]
add rbx, rsi
mov r14d, dword [rax + 0x18]
add r13, rsi
xor edi, edi
test r14d, r14d
je 0x1406d26bd
nop word [rax + rax]
mov ecx, dword [rbx]
add rcx, rsi
call fcn.1406d2b20
cmp eax, 0x42b2c9b6
je 0x1406d26ae
inc edi
add rbx, 4
cmp edi, r14d
jb 0x1406d2690
jmp 0x1406d26bd
movzx ecx, word [r13 + rdi*2]
mov eax, dword [r12 + rcx*4]
add rax, rsi
jne 0x1406d26cc
mov r15, qword [r15]
cmp r15, qword [rsp + reloc.SHELL32.dll_IsUserAnAdmin]
jne 0x1406d2650
xor eax, eax
mov edx, dword [rsp + 0x2a0]
mov rcx, qword [rsp + 0x2b0]
call rax
mov r9, qword [0x1406d41c8]
mov r10, qword [0x1406d41c0]
movzx eax, byte [rsp + 0xa5]
movzx r15d, byte [rsp + 0xa4]
xor sil, sil
mov r11, qword [rsp + 0x90]
movaps xmmword [rsp + 0x250], xmm6
mov byte [rsp + 0x2a0], sil
test r15b, r15b
je 0x1406d2af2
movaps xmm6, xmmword [rsp + 0x90]
movzx edx, al
shr dl, 3
mov r12d, 0x40
and dl, 1
shr al, 2
and al, 1
mov byte [rsp + 0x2b0], dl
mov byte [rsp + reloc.SHELL32.dll_IsUserAnAdmin], al
nop word [rax + rax]
movzx eax, sil
lea rdi, [rsp + 0xa6]
imul rcx, rax, 0xd
add rdi, rcx
mov qword [rsp + 0x50], rdi
mov r14d, dword [rdi + 5]
add r14, r10
mov qword [rsp + 0x20], r14
test dl, dl
je 0x1406d2998
movzx eax, byte [rdi]
test al, 4
jne 0x1406d2998
test al, 1
je 0x1406d2998
mov dword [rsp + 0x2b8], 0
mov rax, qword [r9 + 0x18]
add rax, 0x20
mov qword [rsp + 0x40], rax
mov r12, qword [rax]
cmp r12, rax
je 0x1406d283f
nop dword [rax]
nop word [rax + rax]
mov rsi, qword [r12 + 0x20]
movsxd rax, dword [rsi + 0x3c]
mov ecx, dword [rax + rsi + 0x88]
test ecx, ecx
je 0x1406d2834
mov r13d, dword [rsi + rcx + 0x1c]
lea rax, [rsi + rcx]
mov ebx, dword [rax + 0x20]
add r13, rsi
mov ecx, dword [rax + 0x24]
add rbx, rsi
mov r15d, dword [rax + 0x18]
add rcx, rsi
xor edi, edi
mov qword [rsp + 0x80], rcx
test r15d, r15d
je 0x1406d2834
nop
mov ecx, dword [rbx]
add rcx, rsi
call fcn.1406d2b20
cmp eax, 0xa2b3228a
je 0x1406d281e
inc edi
add rbx, 4
cmp edi, r15d
jb 0x1406d2800
jmp 0x1406d2834
mov rcx, qword [rsp + 0x80]
movzx ecx, word [rcx + rdi*2]
mov eax, dword [r13 + rcx*4]
add rax, rsi
jne 0x1406d2841
mov r12, qword [r12]
cmp r12, qword [rsp + 0x40]
jne 0x1406d27c0
xor eax, eax
mov rcx, qword [rsp + 0x50]
lea r9, [rsp + 0x2b8]
mov r8d, 4
mov edi, dword [rcx + 9]
mov rcx, r14
mov edx, edi
call rax
lea r8, [rdi + r14]
mov rbx, r14
cmp r14, r8
jae 0x1406d28a9
mov r9, qword [rsp + 0x90]
mov r10d, 0x40
mov r14, qword [rsp + 0x98]
movzx edx, byte [rbx]
mov ecx, r10d
and ecx, 0x3f
movdqa xmmword [rsp + 0x40], xmm6
mov rax, r14
shr rax, cl
sub dl, al
xor dl, r9b
mov byte [rbx], dl
inc rbx
cmp rbx, r8
jb 0x1406d2880
mov r14, qword [rsp + 0x20]
mov rax, qword [0x1406d41c8]
mov rax, qword [rax + 0x18]
add rax, 0x20
mov qword [rsp + 0x40], rax
mov r12, qword [rax]
cmp r12, rax
je 0x1406d294c
nop dword [rax]
mov rsi, qword [r12 + 0x20]
movsxd rax, dword [rsi + 0x3c]
mov ecx, dword [rax + rsi + 0x88]
test ecx, ecx
je 0x1406d2941
mov r13d, dword [rsi + rcx + 0x1c]
lea rax, [rsi + rcx]
mov ebx, dword [rax + 0x20]
add r13, rsi
mov ecx, dword [rax + 0x24]
add rbx, rsi
mov r15d, dword [rax + 0x18]
add rcx, rsi
xor edi, edi
mov qword [rsp + 0x20], rcx
test r15d, r15d
je 0x1406d2941
nop dword [rax]
mov ecx, dword [rbx]
add rcx, rsi
call fcn.1406d2b20
cmp eax, 0xa2b3228a
je 0x1406d292e
inc edi
add rbx, 4
cmp edi, r15d
jb 0x1406d2910
jmp 0x1406d2941
mov rcx, qword [rsp + 0x20]
movzx ecx, word [rcx + rdi*2]
mov eax, dword [r13 + rcx*4]
add rax, rsi
jne 0x1406d294e
mov r12, qword [r12]
cmp r12, qword [rsp + 0x40]
jne 0x1406d28d0
xor eax, eax
mov rdi, qword [rsp + 0x50]
lea r9, [rsp + 0x2b8]
mov r8d, dword [rsp + 0x2b8]
mov rcx, r14
mov edx, dword [rdi + 9]
call rax
mov r9, qword [0x1406d41c8]
mov r12d, 0x40
mov r10, qword [0x1406d41c0]
mov r11, qword [rsp + 0x90]
movzx esi, byte [rsp + 0x2a0]
movzx r15d, byte [rsp + 0xa4]
cmp byte [rsp + reloc.SHELL32.dll_IsUserAnAdmin], 0
je 0x1406d2a34
movzx ecx, byte [rdi]
test cl, 2
je 0x1406d2a34
mov r8d, dword [rdi + 9]
xor eax, eax
add r8, r14
cmp r14, r8
jae 0x1406d2a2f
test cl, 4
je 0x1406d2a21
mov r9, qword [rsp + 0x98]
nop dword [rax]
movzx ebx, byte [r14]
movdqa xmmword [rsp + 0x20], xmm6
test r12b, r12b
je 0x1406d2a01
cmp r12b, 0x40
jb 0x1406d29f4
movzx ecx, r12b
mov rdx, r9
and ecx, 0x3f
shr rdx, cl
jmp 0x1406d2a06
mov rdx, r11
movzx ecx, r12b
shrd rdx, r9, cl
jmp 0x1406d2a06
mov rdx, qword [rsp + 0x20]
sub bl, dl
inc r14
xor bl, r11b
crc32 eax, bl
cmp r14, r8
jb 0x1406d29d0
mov r9, qword [0x1406d41c8]
jmp 0x1406d2a2f
crc32 eax, byte [r14]
inc r14
cmp r14, r8
jb 0x1406d2a21
cmp dword [rdi + 1], eax
jne 0x1406d2a55
inc sil
mov byte [rsp + 0x2a0], sil
cmp sil, r15b
jae 0x1406d2af2
movzx edx, byte [rsp + 0x2b0]
jmp 0x1406d2750
mov rax, qword [r9 + 0x18]
add rax, 0x20
mov qword [rsp + 0x2a0], rax
mov r15, qword [rax]
cmp r15, rax
je 0x1406d2aea
mov rsi, qword [r15 + 0x20]
movsxd rax, dword [rsi + 0x3c]
mov ecx, dword [rax + rsi + 0x88]
test ecx, ecx
je 0x1406d2add
mov r12d, dword [rsi + rcx + 0x1c]
lea rax, [rsi + rcx]
mov ebx, dword [rax + 0x20]
add r12, rsi
mov r13d, dword [rax + 0x24]
add rbx, rsi
mov r14d, dword [rax + 0x18]
add r13, rsi
xor edi, edi
test r14d, r14d
je 0x1406d2add
nop dword [rax + rax]
mov ecx, dword [rbx]
add rcx, rsi
call fcn.1406d2b20
cmp eax, 0x5588c932
je 0x1406d2ace
inc edi
add rbx, 4
cmp edi, r14d
jb 0x1406d2ab0
jmp 0x1406d2add
movzx ecx, word [r13 + rdi*2]
mov eax, dword [r12 + rcx*4]
add rax, rsi
jne 0x1406d2aec
mov r15, qword [r15]
cmp r15, qword [rsp + 0x2a0]
jne 0x1406d2a71
xor eax, eax
xor ecx, ecx
call rax
jmp 0x1406d2b04
mov eax, dword [rsp + 0xa0]
mov ecx, r11d
xor rcx, rax
add rcx, r10
call rcx
movaps xmm6, xmmword [rsp + 0x250]
add rsp, 0x260
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret