Function at 0x140105380
Capabilities:
Access peb ldr_data
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov r9, rdx
mov rsi, rcx
mov eax, dword [0x141f44448]
or eax, dword [0x141f4444c]
imul rax, rax, 0x28a01619
shr rax, 0x3d
imul eax, eax, 0xdd0ae030
or eax, 0x5414049b
cmp eax, 0xf872c6cf
jbe 0x1401053e0
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0xa0
call fcn.1400f4d10
sub rsp, rax
nop dword [rax]
mov ecx, dword [0x141f44450]
sub ecx, dword [0x141f44454]
and ecx, 0x80a118b
or ecx, 0xf6b0ec30
xor ecx, 0x4894f80d
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov rbx, rsp
mov eax, 0xa0
call fcn.1400f4d10
sub rsp, rax
mov rdi, rsp
cmp ecx, 0x314e3af9
jb 0x1401053e0
nop word cs:[rax + rax]
mov eax, dword [0x141f44458]
sub eax, dword [0x141f4445c]
add eax, 0x91fcad95
shr eax, 1
imul rax, rax, 0x2374a7e9
shr rax, 0x3b
add eax, 0xd51cc1ce
cmp eax, 0x35917b14
jb 0x140105430
mov eax, dword [0x141f4907c]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp dword [rax + 0x28], 0
jne 0x140105543
mov eax, dword [0x141f4907c]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov ecx, dword [0x141f44460]
and ecx, dword [0x141f44464]
mov dword [rax + 0x28], 1
add ecx, 0x7827d0fb
or ecx, 0x2f13b055
cmp ecx, 0xb1b71c13
ja 0x1401054fb
mov eax, dword [0x141f4907c]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov ecx, dword [0x141f44468]
xor ecx, dword [0x141f4446c]
imul ecx, ecx, 0xa343327d
or ecx, 0xcfe14b68
xor ecx, 0x7b0154dd
mov qword [rax + 0x2c], 0
cmp ecx, 0x43eb9082
jae 0x140105520
mov eax, dword [0x141f4907c]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x2c], 0
jmp 0x1401054b7
mov eax, dword [0x141f44470]
xor eax, dword [0x141f44474]
add eax, 0x8272ccf9
imul rax, rax, 0x651e8155
shr rax, 0x3d
cmp eax, 0xee394bf8
je 0x140105520
mov rax, qword [r8 + 0x50]
mov qword [rdi + 0x58], rax
movups xmm0, xmmword [r8 + 0x40]
movups xmmword [rdi + 0x48], xmm0
movups xmm0, xmmword [r8]
movups xmm1, xmmword [r8 + 0x10]
movups xmm2, xmmword [r8 + 0x20]
movups xmm3, xmmword [r8 + 0x30]
movups xmmword [rdi + 0x38], xmm3
movups xmmword [rdi + 0x28], xmm2
movups xmmword [rdi + 0x18], xmm1
movups xmmword [rdi + 8], xmm0
mov eax, dword [0x141f4907c]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
lea rax, [rax + 0x2c]
mov qword [rdi], rax
mov qword [rdi + 0x60], 0
sub rsp, 0x20
lea rdx, [0x1400d5cd0]
mov rcx, r9
mov r8, rdi
call fcn.140087e20
add rsp, 0x20
mov eax, dword [0x141f44478]
xor eax, dword [0x141f4447c]
add eax, 0xa662100
and eax, 0xe0706c9
cmp eax, 0x3b5c84ba
jne 0x1401055df
mov rcx, qword [rdi]
mov dl, 1
xor eax, eax
lock cmpxchg byte [rcx + 4], dl
mov cl, 1
nop word cs:[rax + rax]
mov edx, dword [0x141f44480]
xor edx, dword [0x141f44484]
or edx, 0x605b210a
add edx, 0xe26f9787
and edx, 0xf68a8b57
mov r15, qword [rdi]
xor eax, eax
lock cmpxchg byte [r15 + 4], cl
sete al
cmp edx, 0x61ba21da
jb 0x1401055f0
lea r14, [r15 + 4]
test al, al
je 0x140105a4d
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x140105640
nop word cs:[rax + rax]
mov eax, dword [0x141f44490]
sub eax, dword [0x141f44494]
and eax, 0x9cef6dd8
imul eax, eax, 0x6cef3598
imul rax, rax, 0x22f2da67
shr rax, 0x3b
cmp eax, 0xd12bd96b
je 0x140105650
movzx eax, byte [r15 + 5]
mov qword [rbp], rsi
xor ecx, ecx
nop word cs:[rax + rax]
test cl, cl
jne 0x140105690
test al, al
je 0x14010572b
mov eax, dword [0x141f44518]
imul eax, dword [0x141f4451c]
and eax, 0xb0c80cae
xor eax, 0x23437056
add eax, 0xc828bd3c
cmp eax, 0xa022ec43
jbe 0x1401056c4
mov byte [r15 + 5], 0
mov rsi, qword [rbp]
nop dword [rax + rax]
mov eax, dword [0x141f44520]
mov ecx, dword [0x141f44524]
add eax, ecx
add eax, 0xab85512c
or eax, 0x327fcc85
imul rax, rax, 0x6570f353
shr rax, 0x3e
mov byte [r15 + 5], 0
cmp eax, 0xf6ac1681
ja 0x1401056d0
mov eax, dword [0x141f44528]
and eax, dword [0x141f4452c]
or eax, 0x2da3b9e7
imul eax, eax, 0x5183ee20
or eax, 0xd79f2ba8
cmp eax, 0xca463a02
jne 0x140105a85
jmp 0x140105aac
mov esi, 0xaf66cd13
mov eax, dword [0x141f44498]
xor eax, dword [0x141f4449c]
xor eax, 0x5f271273
imul eax, eax, 0x7c557e36
cmp eax, 0x1faa5746
jne 0x140105760
mov eax, dword [r15]
xor eax, eax
xchg byte [r15 + 4], al
nop word [rax + rax]
mov eax, dword [0x141f444a0]
add eax, dword [0x141f444a4]
and eax, 0x4042
add eax, 0x2e89774a
mov r13d, dword [r15]
mov ecx, 0
xchg byte [r15 + 4], cl
cmp eax, 0x7e7d86f7
ja 0x140105760
mov eax, dword [0x141f444a8]
xor edx, edx
div dword [0x141f444ac]
mov eax, dword [0x141f444b0]
and eax, dword [0x141f444b4]
or eax, 0x3fb1d7b8
cmp eax, 0xdbf265a9
je 0x140105797
nop
mov eax, dword [0x141f444b8]
xor edx, edx
div dword [0x141f444bc]
or eax, 0xadb42f3d
add eax, 0x417bd1a4
and eax, 0xab300180
cmp eax, 0x51f9985f
jb 0x1401057b0
cmp cl, 2
jne 0x14010587e
mov eax, dword [0x141f444c0]
xor edx, edx
div dword [0x141f444c4]
imul eax, eax, 0x87386a3a
cmp eax, 0xa26307c
mov rsi, qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WakeByAddressSingle]
je 0x140105835
nop
mov eax, dword [0x141f444c8]
or eax, dword [0x141f444cc]
or eax, 0xe3981382
imul r12d, eax, 0x9579fabb
add r12d, 0xc43da81b
sub rsp, 0x20
mov rcx, r14
call rsi
add rsp, 0x20
cmp r12d, 0x6c1f5864
jae 0x140105850
sub rsp, 0x20
mov rcx, r14
call rsi
add rsp, 0x20
jmp 0x140105800
mov esi, 0xaf66cd13
nop word cs:[rax + rax]
mov eax, dword [0x141f444d0]
or eax, dword [0x141f444d4]
xor eax, 0x60462b58
imul eax, eax, 0x4b1f897f
cmp eax, 0x71eba47d
je 0x140105860
mov eax, dword [0x141f444d8]
sub eax, dword [0x141f444dc]
imul eax, eax, 0x7ce36ebc
or eax, 0x2b78a479
cmp eax, 0x4c458205
ja 0x1401058cb
nop dword [rax]
mov eax, dword [0x141f444e0]
add eax, dword [0x141f444e4]
and eax, 0x61ef5fc4
imul rax, rax, 0x4dd9d117
shr rax, 0x3c
or eax, 0xf4dc4486
mov dword [rbx], r13d
cmp eax, 0x54226027
jae 0x1401058d0
mov dword [rbx], r13d
jmp 0x1401058a0
mov eax, dword [0x141f444e8]
imul eax, dword [0x141f444ec]
imul rax, rsi
shr rax, 0x3e
or eax, 0xbeecfef9
cmp eax, 0xf5b47f26
mov r13, qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitOnAddress]
je 0x1401059e0
nop dword [rax]
mov eax, dword [0x141f444f0]
xor eax, dword [0x141f444f4]
imul r12d, eax, 0xdcd2d621
or r12d, 0x3e7d3a2f
and r12d, 0xbe7dbbaf
sub rsp, 0x20
mov r8d, 4
mov rcx, r15
mov rdx, rbx
mov r9d, 0xffffffff
call r13
add rsp, 0x20
cmp r12d, 0x8019d4e4
jb 0x1401059e0
cmp eax, 1
je 0x14010595e
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
xor eax, eax
mov cl, 1
lock cmpxchg byte [r14], cl
sete al
mov ecx, dword [0x141f444f8]
add ecx, dword [0x141f444fc]
imul ecx, ecx, 0xce75f41f
add ecx, 0x18975b88
xor ecx, 0x645fed3e
cmp ecx, 0x95bb7442
ja 0x14010596a
mov ecx, dword [0x141f44500]
and ecx, dword [0x141f44504]
cmp ecx, 0xf349e430
je 0x140105990
test al, al
je 0x140105a02
movzx eax, byte [r15 + 5]
nop dword [rax]
mov ecx, dword [0x141f44510]
xor ecx, dword [0x141f44514]
imul ecx, ecx, 0x2b9a89a0
cmp ecx, 0xa3539ca6
ja 0x1401059b0
test al, al
je 0x140105730
jmp 0x14010569c
sub rsp, 0x20
mov r8d, 4
mov rcx, r15
mov rdx, rbx
mov r9d, 0xffffffff
call r13
add rsp, 0x20
jmp 0x140105900
sub rsp, 0x20
mov rcx, r14
call fcn.140101410
add rsp, 0x20
nop word cs:[rax + rax]
mov eax, dword [0x141f44508]
or eax, dword [0x141f4450c]
imul rax, rax, 0x7cb80dfd
shr rax, 0x3d
add eax, 0xb2c596a1
and eax, 0x12858622
cmp eax, 0xec5eb3ff
ja 0x140105a20
jmp 0x1401059a8
sub rsp, 0x20
mov rcx, r14
call fcn.140101410
add rsp, 0x20
nop dword [rax]
mov eax, dword [0x141f44488]
xor edx, edx
div dword [0x141f4448c]
imul eax, eax, 0xde8ae5e8
or eax, 0xb0f4e693
cmp eax, 0x52c392ff
jb 0x140105a60
jmp 0x140105630
mov eax, dword [0x141f44530]
or eax, dword [0x141f44534]
add eax, 0x474f738a
xor eax, 0x120aa
or eax, 0xa6fad141
xor ecx, ecx
xchg byte [r14], cl
cmp eax, 0x5a2bad3a
jae 0x140105ab3
xor eax, eax
xchg byte [r14], al
jmp 0x140105a85
mov eax, dword [0x141f44538]
xor edx, edx
div dword [0x141f4453c]
nop word cs:[rax + rax]
mov eax, dword [0x141f44540]
sub eax, dword [0x141f44544]
cmp eax, 0x73f2c978
je 0x140105ad0
cmp cl, 2
jne 0x140105b64
mov eax, dword [0x141f44548]
and eax, dword [0x141f4454c]
and eax, 0x52ee898c
add eax, 0xb87d1187
xor eax, 0x5b467b64
cmp eax, 0x4cca1736
jb 0x140105b3f
mov eax, dword [0x141f44550]
xor edx, edx
div dword [0x141f44554]
mov ebx, eax
add ebx, 0x91a75e9f
xor ebx, 0x485e7cf5
sub rsp, 0x20
mov rcx, r14
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WakeByAddressSingle]
add rsp, 0x20
cmp ebx, 0x5a90e7d4
jae 0x140105b52
sub rsp, 0x20
mov rcx, r14
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WakeByAddressSingle]
add rsp, 0x20
jmp 0x140105b0a
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x140105b60
mov rax, qword [rdi + 0x60]
nop dword [rax + rax]
mov ecx, dword [0x141f44558]
imul ecx, dword [0x141f4455c]
imul ecx, ecx, 0x6e16a3ac
or ecx, 0x73c90f87
and ecx, 0xffddafc7
cmp ecx, 0x6301a9b2
jb 0x140105b70
movups xmm0, xmmword [rdi + 0x68]
nop dword [rax + rax]
mov ecx, dword [0x141f44560]
and ecx, dword [0x141f44564]
or ecx, 0x7f4406c5
imul ecx, ecx, 0x182f7d1b
xor ecx, 0x6dc380c8
cmp ecx, 0x16f06c31
jb 0x140105ba0
cmp rax, 1
jne 0x140105c3a
mov eax, dword [0x141f44580]
xor ecx, ecx
xor edx, edx
div dword [0x141f44584]
add rdi, 0x78
test cl, cl
jne 0x140105be0
mov ecx, 0xbd0a3d37
lea rax, [rsi + 0x10]
nop dword [rax]
mov edx, dword [0x141f44588]
xor edx, dword [0x141f4458c]
xor edx, 0xba80ba9c
add edx, 0xb4ad3834
imul rdx, rcx
shr rdx, 0x3f
cmp edx, 0x7a24002a
ja 0x140105bf0
movups xmm1, xmmword [rdi]
movups xmm2, xmmword [rdi + 0x10]
movups xmmword [rax + 0x10], xmm2
movups xmmword [rax], xmm1
movups xmmword [rsi], xmm0
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
test rax, rax
jne 0x140105c56
ud2
cmp rax, 2
jne 0x140105c7d
mov eax, dword [0x141f44570]
mov ecx, dword [0x141f44574]
add eax, ecx
add eax, 0xe51099a
xor eax, 0xba32f040
cmp eax, 0x58808596
jbe 0x140105c99
jmp 0x140105ccd
mov eax, dword [0x141f44568]
xor edx, edx
div dword [0x141f4456c]
or eax, 0x4c301d6d
cmp eax, 0xf83c7f0a
je 0x140105c7d
ud2
mov eax, dword [0x141f44578]
imul eax, dword [0x141f4457c]
imul esi, eax, 0x2c751ae
add esi, 0x3a038e0
or esi, 0x8073a8ed
sub rsp, 0x20
call fcn.140078ab0
add rsp, 0x20
cmp esi, 0x3be57f29
jae 0x140105c97
sub rsp, 0x20
call fcn.140078ab0
add rsp, 0x20
jmp 0x140105c99