Function at 0x1408b83f3
Capabilities:
Access peb ldr_data
Encode data using xor
Execute anti-debugging instructions
Get kernel32 base address

Disassembly:
push rbp
and bpl, spl
sal r8, 0x24
mov r8w, r8w
push rbx
shrd r8w, bp, 0x3f
rcr ebp, 0x9f
shr bp, cl
push rsi
inc bh
push rdi
dec bl
push r12
movsx di, r15b
btr r8, 0xf5
xor bl, spl
push r13
xor di, di
push r14
bswap ebx
push r15
lea rbp, [rsp - 0x48]
rcr rbx, 0x7d
sub rsp, 0x148
mov rbx, rcx
add dil, 0xf7
ror cx, cl
jmp 0x1408b844c
mov edi, 0x40
btr cx, 0x2f
test bx, ax
mov r8d, edi
ror rcx, 0x2d
bsf cx, si
add ch, 0x49
lea rcx, [rbp]
cmp r13b, 8
xor edx, edx
call fcn.1408bb5b1
mov rcx, qword [rbx]
btc r8w, di
cmc
inc r8w
lea r8, [rbp]
shrd r9d, esp, 0xfa
adc r9b, 0x85
sub r13d, r13d
mov qword [rbp], rdi
movsxd r9, edx
mov r9d, edi
clc
jmp 0x1408b84a6
mov qword [rbp + 0xa8], r13
test ebp, ecx
jmp 0x1408b84b5
sub edx, edx
jmp 0x1408b84bc
mov qword [rsp + 0x20], r13
jmp 0x1408b84c6
call fcn.140330c88
lea r12d, [rdi - 0x3f]
ror dl, cl
mov edx, eax
stc
jmp 0x1408b84d9
test eax, eax
jmp 0x1408b84e0
js 0x1408b84ff
mov ecx, dword [rbp + 0x38]
shr ecx, 1
test rcx, 0x67711205
and cl, r12b
jmp 0x1408b84fa
jmp 0x1408b8541
mov rcx, qword [rbx]
movsx r8d, r11w
lea r8, [rbp + 0xa8]
movsxd r9, r11d
mov r9d, 8
mov qword [rsp + 0x20], r13
bswap edx
movsx dx, dil
movsx edx, r14w
lea edx, [r9 + 0x12]
jmp 0x1408b852f
call fcn.140867404
cmp qword [rbp + 0xa8], r13
mov edx, r13d
setne cl
test edx, edx
jmp 0x1408b8548
js 0x1408b8c6a
test cl, cl
jmp 0x1408b8555
je 0x1408b8cc3
mov rcx, rbx
call fcn.1408b8de8
mov qword [rbp + 0xa0], r13
rdtsc
bt rsi, rsp
test dil, cl
sub ecx, 0x4c73470c
shl rdx, 0x20
lea r15, [rbx + 0x138]
mov sil, al
or rax, rdx
movzx cx, dh
mov dword [rsp + 0x48], 0x20
xchg dh, cl
rol cl, 0x5e
mov rcx, rax
rol sil, cl
mov dword [rsp + 0x40], r13d
mov rdx, rax
btc r8d, 0xeb
ror rcx, 3
xor rdx, rcx
sar eax, cl
inc ax
movabs rsi, 0x7010008004002001
rcr rax, 0x8d
cbw
mov rcx, qword [rbx + 0x108]
bswap r8w
bts eax, edi
add dil, 0x7b
mov rax, rsi
rcr r8b, cl
movzx rdi, r11w
xchg r8b, r8b
mul rdx
mov edi, 2
xor r9d, r9d
not r8
xadd r8b, r8b
xor rdx, rax
bts r8w, bp
clc
rcl r8d, 0xdc
mov dword [rsp + 0x38], edi
and edx, 7
lea rax, [rbp + 0x98]
mov qword [rsp + 0x30], rax
shl ah, 0x22
clc
or ah, 0xd3
add rdx, 8
bswap r8d
xor ax, r9w
sub rax, r13
shl rdx, 0xc
movzx eax, r15w
cwde
jmp 0x1408b863e
lea rax, [rbp + 0xa0]
mov qword [rbp + 0x98], rdx
movzx r8d, r13w
mov r8, r15
not dl
mov rdx, qword [rbx]
jmp 0x1408b865d
mov qword [rsp + 0x28], rax
jmp 0x1408b8667
mov qword [rsp + 0x20], r13
call fcn.140186cdd
mov ecx, eax
test rax, r8
cmp r11d, 0x63dc318f
test eax, eax
jmp 0x1408b8684
js 0x1408b8d2e
mov rax, qword [rbp + 0x98]
btc ecx, 0xb
seto dh
adc r8d, r13d
mov qword [rbx + 0x140], rax
mov qword [rbp + 0xa0], 0x10000
bt ecx, esi
rdtsc
rcl r8, cl
add r8b, r15b
not r8b
shl rdx, 0x20
lea r8, [rbx + 0x130]
or rax, rdx
btc ecx, 0x42
ror cl, 0xb7
mov dword [rsp + 0x48], 4
ror cx, 0xa8
movzx dx, bh
mov rcx, rax
rcr edx, cl
mov dword [rsp + 0x40], r13d
bts rdx, r10
rcr dl, 0x67
mov rdx, rax
ror rcx, 3
cwde
sar ax, 0x87
xor rdx, rcx
sub cx, 0x4c6c
rol al, cl
mov dword [rsp + 0x38], edi
rcl ah, cl
mov rcx, qword [rbx + 0x108]
adc ax, 0x38f3
mov rax, rsi
mul rdx
cmp r12w, r13w
cmc
stc
xor r9d, r9d
cmp bp, 0x297f
xor rdx, rax
sbb ax, 0x7254
lea rax, [rbp + 0x98]
test ebx, esp
and edx, 7
cmp dl, 0xce
mov qword [rsp + 0x30], rax
rcr ah, 0xc4
adc al, bh
add rdx, 8
lea rax, [rbp + 0xa0]
test r12d, 0x1dea4308
shl rdx, 0xc
jmp 0x1408b8767
mov qword [rbp + 0x98], rdx
movzx rdx, r11w
cdq
jmp 0x1408b8778
mov rdx, qword [rbx]
jmp 0x1408b8780
mov qword [rsp + 0x28], rax
jmp 0x1408b878a
mov qword [rsp + 0x20], r13
jmp 0x1408b8794
call fcn.1402effd8
mov ecx, eax
cmp r9b, r13b
test rcx, rbx
test eax, eax
jmp 0x1408b87a8
js 0x1408b8d8c
mov rcx, qword [rbx + 0x118]
cmc
btc r14w, 0x8c
dec ax
mov qword [rbx + 0x128], rcx
shr r14w, 0x2a
shr r14b, cl
add rcx, qword [rbp + 0xa0]
rol r14w, cl
sal ah, cl
mov qword [rbx + 0x120], rcx
jmp 0x1408b87e7
mov rax, qword gs:[0x60]
mov ecx, eax
not cx
movzx cx, r11b
mov rcx, qword [rax + 0x18]
sal eax, 0xb6
inc r14b
rcl rax, 0x66
mov rax, qword [rcx + 0x10]
mov r14, r14
sub r14b, r14b
btr r14w, r11w
mov rcx, qword [rax]
xor r14d, edi
cmp r11d, 0x182037fa
shr r14w, cl
mov r14, qword [rcx + 0x30]
test cx, 0x7d86
cmp r15b, 0xbf
test r14, r14
jmp 0x1408b883d
jne 0x1408b8850
mov rcx, r13
jmp 0x1408b884b
jmp 0x1408b8863
movsxd rcx, dword [r14 + 0x3c]
cmp r15b, spl
test r13b, 0xab
add rcx, r14
jmp 0x1408b8863
call fcn.140007ca0
mov rsi, rax
clc
cmp ah, 0x59
cmp bpl, r15b
test rax, rax
jmp 0x1408b887a
je 0x1408b899a
mov r8d, dword [rax + 0x10]
cmp bp, 0x6205
clc
test r8d, r8d
jmp 0x1408b8892
jne 0x1408b88a2
mov r8d, dword [rax + 8]
setno dil
dec cl
rdtsc
shld r9w, si, 0xe8
shl ecx, cl
xchg r9b, cl
mov r9, qword [rbx + 0x140]
bts r10w, r15w
movabs r10, 0x7010008004002001
adc dil, r13b
movsx edi, si
mov rdi, qword [rbx + 0x128]
sar cx, cl
shl rdx, 0x20
bsr rcx, r13
adc rcx, r12
or rax, rdx
movzx rcx, r15w
mov rcx, rax
not dx
movsx dx, sil
rcr dh, 0xf5
mov rdx, rax
rcr eax, 0x2d
nop
jmp 0x1408b8901
ror rcx, 3
mov rax, r10
xor rdx, rcx
mov ecx, r8d
cmp r9d, esi
cmp r9w, 0x7cbb
mul rdx
stc
clc
sub rcx, r9
cmp cl, r15b
test r9b, spl
xor rax, rdx
sub rcx, 0x10
cmp ch, 0x7f
xor edx, edx
div rcx
cmp r10b, 0x93
ror al, cl
mov eax, dword [rsi + 0xc]
lea rdx, [rdx + rax]
and rdx, 0xfffffffffffffff0
cmp cx, di
cmc
test sil, 0xb6
lea rdx, [rdx + r14]
test r14w, 0x2b45
test r14d, r8d
test rdi, rdi
jmp 0x1408b8962
je 0x1408b89c5
test rdx, rdx
je 0x1408b89c5
test r9, r9
jmp 0x1408b8979
je 0x1408b89c5
mov rsi, rdx
movsx ecx, r8w
cmovno cx, r13w
movzx cx, r11b
mov rcx, r9
rep movsb byte [rdi], byte [rsi]
jmp 0x1408b89c5
mov edx, dword [rbx + 0x140]
mov ch, 0x81
movsx cx, r12b
movzx rcx, sp
mov rcx, qword [rbx + 0x128]
call fcn.14089619a
movabs r10, 0x7010008004002001
add dl, spl
rdtsc
bts cx, r13w
shl rdx, 0x20
test spl, 0x41
add ecx, eax
or rax, rdx
bswap dx
mov rcx, rax
btr rdx, rax
movzx edx, bp
cmc
mov rdx, rax
cmc
ror rcx, 3
or al, 0xfd
rcr ah, cl
bswap rax
mov rax, r10
cmc
xor rdx, rcx
ror cl, 0xa1
mov rcx, qword [rbx + 0x140]
mul rdx
sub rcx, 0x2000
jmp 0x1408b8a17
xor rax, rdx
sub edx, edx
jmp 0x1408b8a27
div rcx
btr cx, r14w
bsr ecx, dword [r15]
add rdx, 0x1000
cmp ecx, 0x277a3b7f
shl r12d, cl
ror ch, 0x79
shl cx, 0xa2
movsx cx, r9b
and rdx, 0xfffffffffffffff0
movzx rcx, cx
seto cl
mov cx, r13w
mov rcx, rbx
jmp 0x1408b8a66
mov qword [rbx + 0x158], rdx
jmp 0x1408b8a72
mov dword [rbx + 0x170], r12d
jmp 0x1408b8a7e
call fcn.1408b96d7
mov rcx, qword [rbx + 0x120]
mov edi, 0x2e8
shr rdx, cl
or dl, r13b
xchg rdx, rdx
add rcx, rdi
mov edx, 0x4000
jmp 0x1408b8aa5
call fcn.14089619a
mov eax, dword [rbx + 0x170]
xor cl, r15b
or cx, r8w
movzx ecx, bp
mov rcx, qword [rbx + 0x120]
not eax
and dword [rdi + rcx], eax
stc
add rdi, 4
stc
test r11w, r11w
cmp rdi, 0x42e8
jb 0x1408b8aaa
mov r8, qword [rbx + 0x120]
xor dl, dil
sbb ax, si
rol dh, 0x27
lea rax, [rsp + 0x50]
cqo
mov rdx, qword [rbx + 0x148]
add cl, r8b
add r8, 0x160
mov rcx, 0x60465c81
movsxd rcx, r15d
movsx r9w, cl
mov rcx, qword [rbx]
bswap r9w
mov r9d, 0x188
jmp 0x1408b8b26
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x20], rax
jmp 0x1408b8b35
call fcn.1407c2601
mov ecx, eax
test r10, rdi
test eax, eax
js 0x1408b8c08
mov rax, qword [rbx + 0x120]
rol r13b, 0xc0
bsr r12d, ecx
rcl r12w, cl
mov rcx, qword [rbx + 0x150]
jmp 0x1408b8b66
add rcx, qword [r15]
rcr rbp, 0x8d
sar ebp, 0xd9
ror di, cl
mov qword [rax + 0x160], rcx
shrd cx, r11w, 0x55
mov rcx, qword [rbx + 0x120]
shl r13d, 0x81
mov rax, qword [rbx + 0x148]
shl r13w, 0xa5
mov r13b, 0xe9
mov qword [rcx], rax
xor r14b, 0xe9
mov rcx, qword [rbx + 0x120]
dec bx
bswap bx
mov rax, qword [r15]
mov qword [rcx + 8], rax
add rsp, 0x148
setle r15b
movsx r13d, cx
pop r15
sete r13b
movzx r12w, r13b
movsx r13d, r14w
pop r14
mov r13b, r10b
pop r13
jmp 0x1408b8bdf
pop r12
mov bpl, 0x7d
movzx si, dl
pop rdi
cmovae bp, r9w
movsx ebp, r8w
pop rsi
movzx bx, r15b
pop rbx
movzx bp, sil
mov bp, 0x6ef0
movzx ebp, r11w
pop rbp
ret
sub eax, eax
not edx
mov dword [rbp - 0xc], ecx
movzx dx, spl
movsx edx, r8w
mov qword [rbp - 0x20], rax
bswap cx
lea rdx, [0x140068a88]
not cl
movzx rcx, ax
mov qword [rbp - 0x18], rax
sets al
movsx eax, bx
lea rcx, [rbp - 0x28]
movzx eax, r12w
movzx ax, r10b
lea rax, [0x14005b4d8]
jmp 0x1408b8c4f
mov dword [rbp - 0x10], 0xd0001b06
mov qword [rbp - 0x28], rax
jmp 0x1408b8c5f
call 0x14048247b
int3
sub eax, eax
mov dword [rsp + 0x74], edx
mov rdx, 0x5c7d3fbc
cmove dx, r10w
mov qword [rsp + 0x60], rax
mov dl, r14b
lea rdx, [0x140068a88]
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x58]
movsxd rax, r11d
xchg al, al
lea rax, [0x14005b4d8]
jmp 0x1408b8ca6
mov dword [rsp + 0x70], 0xd0001b15
mov qword [rsp + 0x58], rax
jmp 0x1408b8cb8
call 0x1403c81c0
int3
sub eax, eax
jmp 0x1408b8cca
mov dword [rbp - 0x70], 0xd0001500
movsx dx, sil
movzx ecx, r10w
not cx
mov qword [rbp - 0x80], rax
movsx rcx, r11w
lea rdx, [0x140068a88]
mov cx, 0x47a0
movzx cx, r11b
mov qword [rbp - 0x78], rax
cdqe
movsx rax, r12w
lea rcx, [rsp + 0x78]
lea rax, [0x14005b4d8]
jmp 0x1408b8d10
mov dword [rbp - 0x6c], r13d
jmp 0x1408b8d19
mov qword [rsp + 0x78], rax
jmp 0x1408b8d23
call 0x1408092d6
int3
sub eax, eax
mov dword [rbp - 0x4c], ecx
mov qword [rbp - 0x60], rax
movzx edx, r11w
movsx rcx, bp
cmovp dx, cx
lea rdx, [0x140068a88]
xchg ecx, ecx
mov cx, bx
mov qword [rbp - 0x58], rax
cwde
movzx rcx, r8w
xchg rcx, rax
lea rcx, [rbp - 0x68]
movsx rax, r8w
bswap rax
lea rax, [0x14005b4d8]
mov dword [rbp - 0x50], 0xd0001d01
jmp 0x1408b8d78
mov qword [rbp - 0x68], rax
jmp 0x1408b8d81
call 0x14043f764
int3
xor eax, eax
jmp 0x1408b8d95
mov dword [rbp - 0x2c], ecx
setnp ch
bswap ecx
mov qword [rbp - 0x40], rax
lea rdx, [0x140068a88]
mov cx, 0x3b3
movsx rcx, dx
not ch
mov qword [rbp - 0x38], rax
lea rcx, [rbp - 0x48]
not al
lea rax, [0x14005b4d8]
jmp 0x1408b8dc8
mov dword [rbp - 0x30], 0xd0001d01
jmp 0x1408b8dd4
mov qword [rbp - 0x48], rax
jmp 0x1408b8ddd
call 0x14029d62e
int3