Function at 0x140020ae0
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Get process filename

Disassembly:
sub rsp, 0xd8
mov rax, qword [0x1400a3110]
xor rax, rsp
mov qword [rsp + 0x80], rax
call rcx
cmp eax, 1
jne 0x140020f23
movups xmm0, xmmword [str.sWTLH_]
mov r9d, dword [0x1400a3128]
lea r10d, [rax + 0x1e]
mov qword [rsp + 0xe8], rbx
lea ebx, [rax + 3]
mov qword [rsp + 0xd0], rdi
movaps xmmword [rsp + 0xc0], xmm6
pextrw eax, xmm0, 7
movaps xmmword [rsp + 0xb0], xmm7
movaps xmmword [rsp + 0xa0], xmm8
movups xmmword [rsp + 0x40], xmm0
test ax, ax
je 0x140020c82
xor edi, edi
cmp r9d, 2
jl 0x140020c4a
movdqa xmm2, xmmword [0x140098cd0]
movdqa xmm3, xmmword [0x140098ce0]
movdqa xmm1, xmm2
movdqa xmm4, xmmword [0x140098e60]
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
movd xmm6, ebx
movd xmm5, r10d
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x140098cf0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [str.sWTLH_]
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
paddw xmm2, xmmword [0x140098d20]
pxor xmm2, xmm0
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movq qword [rsp + 0x40], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x140098cf0]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rsp + 0x48]
pshufd xmm2, xmm1, 0xd8
paddw xmm2, xmmword [0x140098d20]
pxor xmm2, xmm0
movq qword [rsp + 0x48], xmm2
jmp 0x140020c82
lea r8, [rsp + 0x40]
nop
mov eax, 0x2f684bdb
lea r8, [r8 + 2]
mul edi
mov eax, edi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movzx eax, ax
imul ecx, eax, 0x36
movzx eax, di
inc edi
sub ax, cx
add ax, 0x35
xor word [r8 - 2], ax
cmp edi, 8
jl 0x140020c50
movups xmm0, xmmword [str.eDXLYOURP]
mov eax, dword [0x14008b430]
xor ecx, ecx
mov dword [rsp + 0x78], eax
movzx eax, word [0x14008b434]
mov word [rsp + 0x7c], ax
movups xmm1, xmmword [0x14008b418]
movups xmmword [rsp + 0x50], xmm0
movsd xmm0, qword [0x14008b428]
movsd qword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x60], xmm1
cmp r9d, 2
jl 0x140020e07
movdqa xmm5, xmmword [0x140098cd0]
lea rdx, [rsp + 0x50]
movdqa xmm4, xmmword [0x140098e60]
movdqa xmm7, xmmword [0x140098cf0]
movaps xmmword [rsp + 0x90], xmm9
movdqa xmm9, xmmword [0x140098d20]
movd xmm6, ebx
movd xmm8, r10d
nop dword [rax]
nop word [rax + rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 0x10]
paddd xmm2, xmm5
add ecx, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm9
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rdx - 0x10]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
pxor xmm3, xmm0
movq qword [rdx - 0x10], xmm3
paddd xmm2, xmm5
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm9
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rdx - 8]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
pxor xmm3, xmm0
movq qword [rdx - 8], xmm3
cmp ecx, 0x10
jl 0x140020d10
movaps xmm9, xmmword [rsp + 0x90]
cmp ecx, 0x17
jge 0x140020e50
movsxd rax, ecx
lea rdi, [rsp + 0x50]
lea rdi, [rdi + rax*2]
nop dword [rax]
nop word [rax + rax]
mov eax, 0x4bda12f7
lea rdi, [rdi + 2]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul edx, eax, 0x36
movzx eax, cx
inc ecx
sub ax, dx
add ax, 0x35
xor word [rdi - 2], ax
cmp ecx, 0x17
jl 0x140020e20
mov r9d, 0x10
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [0x14007d570]
mov ecx, 0x1388
call qword [0x14007d110]
xor ecx, ecx
mov dword [rsp + 0x34], 0
call qword [0x14007d280]
lea r9, [rsp + 0x34]
mov r8d, ebx
mov rcx, rax
mov edx, 0x1000
mov rdi, rax
call qword [0x14007d3c8]
xor eax, eax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov ecx, 0x1000
rep stosb byte [rdi], al
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x10]
lea ecx, [r8 + 0x13]
mov eax, dword [rdx + 0x30]
add eax, 0x100000
mov dword [rdx + 0x40], eax
mov dl, 1
call qword [0x14007db10]
lea rax, [rsp + 0x38]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 6
mov ecx, 0xc0000420
call qword [0x14007db20]
movaps xmm8, xmmword [rsp + 0xa0]
movaps xmm7, xmmword [rsp + 0xb0]
movaps xmm6, xmmword [rsp + 0xc0]
mov rdi, qword [rsp + 0xd0]
mov rbx, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14007b0a0
add rsp, 0xd8
ret