Function at 0x14001b030
Capabilities:
Access peb ldr_data
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov rax, qword [0x140058040]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov dword [rbp - 0x39], ecx
xor esi, esi
mov rax, qword gs:[0x30]
mov rdx, qword [rax + 0x60]
mov r13, qword [rdx + 0x18]
add r13, 0x20
mov r12, qword [r13]
mov rdi, qword [r12 + 0x40]
test rdi, rdi
jne 0x14001b08f
mov r15, rsi
jmp 0x14001b0f6
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x14001b096
inc ebx
lea esi, [rbx + rbx]
mov ecx, esi
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov r15, rax
test rax, rax
je 0x14001b0f4
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, ebx
mov r8, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x14001b0f4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, r15
call qword [sym.imp.ole32.dll_CoTaskMemFree]
xor esi, esi
mov r15d, esi
jmp 0x14001b0f6
xor esi, esi
mov qword [rbp + 0xf], rsi
mov qword [rbp + 0x27], 0xf
mov qword [rbp + 0x1f], 1
mov word [rbp + 0xf], 0x5c
mov qword [rbp - 0x11], rsi
mov qword [rbp - 1], rsi
mov qword [rbp + 7], 0xf
mov byte [rbp - 0x11], 0
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [r15 + r8], 0
jne 0x14001b130
mov rdx, r15
lea rcx, [rbp - 0x11]
call fcn.140013e70
nop
lea r8, [rbp - 0x11]
cmp qword [rbp + 7], 0x10
setae r9b
cmovae r8, qword [rbp - 0x11]
mov r14, qword [rbp - 1]
cmp r14, 1
jb 0x14001b2ba
lea rcx, [r14 - 1]
mov rax, 0xffffffffffffffff
cmp rcx, rax
cmovb rax, rcx
add rax, r8
nop dword [rax]
cmp byte [rax], 0x5c
jne 0x14001b18b
mov ecx, esi
test ecx, ecx
je 0x14001b199
cmp rax, r8
je 0x14001b2ba
dec rax
jmp 0x14001b180
sub rax, r8
cmp rax, 0xffffffffffffffff
je 0x14001b2ba
lea rcx, [rax + 1]
mov qword [rbp - 0x31], rsi
mov qword [rbp - 0x21], rsi
mov qword [rbp - 0x19], 0xf
cmp r14, rcx
jb 0x14001b4b3
sub r14, rcx
mov rsi, 0xffffffffffffffff
cmp r14, rsi
cmovb rsi, r14
lea r14, [rbp - 0x11]
test r9b, r9b
cmovne r14, qword [rbp - 0x11]
add r14, rcx
cmp rsi, 0xf
ja 0x14001b20a
mov qword [rbp - 0x21], rsi
mov r8, rsi
mov rdx, r14
lea rcx, [rbp - 0x31]
call fcn.14001eba0
mov byte [rbp + rsi - 0x31], 0
mov rbx, qword [rbp - 0x19]
jmp 0x14001b364
movabs rax, 0x7fffffffffffffff
cmp rsi, rax
ja 0x14001b4ad
mov rbx, rsi
or rbx, 0xf
cmp rbx, rax
jbe 0x14001b23c
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x14001b263
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14001b282
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14001b4b9
mov rcx, rax
call fcn.14001c8d0
test rax, rax
je 0x14001b4bf
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14001b293
test rcx, rcx
je 0x14001b291
call fcn.14001c8d0
mov rdi, rax
jmp 0x14001b293
xor edi, edi
mov qword [rbp - 0x21], rsi
mov qword [rbp - 0x19], rbx
mov r8, rsi
mov rdx, r14
mov rcx, rdi
call fcn.14001eba0
mov byte [rdi + rsi], 0
mov qword [rbp - 0x31], rdi
mov rbx, qword [rbp - 0x19]
jmp 0x14001b364
mov qword [rbp - 0x31], rsi
mov qword [rbp - 0x21], rsi
mov qword [rbp - 0x19], rsi
mov rbx, r14
lea rdi, [rbp - 0x11]
test r9b, r9b
cmovne rdi, qword [rbp - 0x11]
cmp r14, 0x10
jae 0x14001b2e9
movups xmm0, xmmword [rdi]
movups xmmword [rbp - 0x31], xmm0
mov ebx, 0xf
jmp 0x14001b35c
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
cmova rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14001b33a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14001b4b9
mov rcx, rax
call fcn.14001c8d0
mov rcx, rax
test rax, rax
je 0x14001b4bf
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14001b349
test rcx, rcx
je 0x14001b346
call fcn.14001c8d0
jmp 0x14001b349
mov rax, rsi
mov qword [rbp - 0x31], rax
lea r8, [r14 + 1]
mov rdx, rdi
mov rcx, rax
call fcn.14001eba0
mov qword [rbp - 0x19], rbx
mov qword [rbp - 0x21], r14
cmp rbx, 0x10
setae sil
lea r9, [rbp - 0x31]
cmovae r9, qword [rbp - 0x31]
xor r10d, r10d
mov r11, qword [rbp - 0x21]
add r11, r9
cmp r9, r11
je 0x14001b3c4
nop dword [rax]
nop dword [rax + rax]
movzx r8d, byte [r9]
lea edx, [r8 - 0x41]
lea eax, [r8 + 0x20]
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movsx eax, cl
add eax, r10d
imul r10d, eax, 0x401
mov eax, r10d
shr eax, 6
xor r10d, eax
inc r9
cmp r9, r11
jne 0x14001b390
lea eax, [r10 + r10*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul edi, ecx, 0x8001
test sil, sil
je 0x14001b40c
lea rdx, [rbx + 1]
mov rcx, qword [rbp - 0x31]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b407
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b4bf
call fcn.14001c90c
xor esi, esi
mov qword [rbp - 0x21], rsi
mov qword [rbp - 0x19], 0xf
mov byte [rbp - 0x31], sil
mov rdx, qword [rbp + 7]
cmp rdx, 0x10
jb 0x14001b456
inc rdx
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b450
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b4a7
call fcn.14001c90c
nop
mov rcx, r15
call qword [sym.imp.ole32.dll_CoTaskMemFree]
cmp edi, dword [rbp - 0x39]
je 0x14001b475
mov r12, qword [r12]
cmp r12, r13
jne 0x14001b080
xor eax, eax
jmp 0x14001b47a
mov rax, qword [r12 + 0x20]
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.14001ca20
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14002324c
nop
call fcn.140013d40
int3
call fcn.140013d60
int3
call fcn.140013d00
int3
call fcn.14002324c
int3