Function at 0x140001460
Capabilities:
Access peb ldr_data
Encode data using xor
Encrypt data using rc4 prga
Get ntdll base address
Resolve function by parsing pe exports

Disassembly:
push rsi
push r13
sub rsp, 0x18
cmp dword [0x140005680], 0
jne 0x1400016aa
mov rax, qword gs:[0x60]
xor r13d, r13d
mov edx, r13d
mov rcx, qword [rax + 0x18]
mov r8, qword [rcx + 0x10]
mov rax, qword [r8 + 0x30]
test rax, rax
je 0x140001742
nop dword [rax]
mov rsi, rax
movsxd rax, dword [rax + 0x3c]
mov ecx, dword [rax + rsi + 0x88]
test ecx, ecx
je 0x1400014d9
lea rdx, [rsi + rcx]
mov ecx, dword [rsi + rcx + 0xc]
mov eax, dword [rcx + rsi]
or eax, 0x20202020
cmp eax, 0x6c64746e
jne 0x1400014d9
mov eax, dword [rcx + rsi + 4]
or eax, 0x20202020
cmp eax, 0x6c642e6c
je 0x1400014e5
mov r8, qword [r8]
mov rax, qword [r8 + 0x30]
test rax, rax
jne 0x1400014a0
test rdx, rdx
je 0x140001742
mov r11d, dword [rdx + 0x18]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
mov ebp, dword [rdx + 0x24]
mov qword [rsp + 0x40], rdi
mov edi, dword [rdx + 0x20]
mov qword [rsp + 0x10], r12
add rdi, rsi
mov qword [rsp + 8], r14
mov r12d, 0x775a
mov r14d, dword [rdx + 0x1c]
mov edx, r13d
add r14, rsi
mov qword [rsp], r15
add rbp, rsi
lea r15, [0x140005680]
nop dword [rax]
nop word [rax + rax]
lea eax, [r11 - 1]
mov r10d, dword [rdi + rax*4]
mov r11d, eax
add r10, rsi
mov ebx, eax
cmp word [r10], r12w
jne 0x1400015a5
mov r9d, r13d
mov r8d, 0xc654d4f4
mov rax, r10
movzx eax, word [rax]
mov ecx, r8d
ror ecx, 8
inc r9d
add ecx, eax
mov eax, r9d
add rax, r10
xor r8d, ecx
cmp byte [rax], r13b
jne 0x140001562
mov ecx, edx
inc edx
add rcx, rcx
mov dword [r15 + rcx*8 + 8], r8d
movzx eax, word [rbp + rbx*2]
mov eax, dword [r14 + rax*4]
mov dword [r15 + rcx*8 + 0xc], eax
mov qword [r15 + rcx*8 + 0x10], r13
cmp edx, 0x1f4
je 0x1400015aa
test r11d, r11d
jne 0x140001540
mov r14, qword [rsp + 8]
lea eax, [rdx - 1]
mov r12, qword [rsp + 0x10]
mov r8d, r13d
mov dword [0x140005680], edx
test eax, eax
je 0x140001650
nop dword [rax + rax]
mov eax, edx
mov ecx, r13d
sub eax, r8d
cmp eax, 1
je 0x140001645
nop dword [rax]
lea r11d, [rcx + 1]
mov r10d, ecx
add r10, r10
mov r9d, r11d
add r9, r9
mov edi, dword [r15 + r10*8 + 0xc]
mov ebx, dword [r15 + r9*8 + 0xc]
cmp edi, ebx
jbe 0x140001636
mov edx, dword [r15 + r10*8 + 8]
mov eax, dword [r15 + r9*8 + 8]
mov rcx, qword [r15 + r10*8 + 0x10]
mov dword [r15 + r10*8 + 8], eax
mov rax, qword [r15 + r9*8 + 0x10]
mov qword [r15 + r10*8 + 0x10], rax
mov dword [r15 + r10*8 + 0xc], ebx
mov dword [r15 + r9*8 + 8], edx
mov dword [r15 + r9*8 + 0xc], edi
mov qword [r15 + r9*8 + 0x10], rcx
mov edx, dword [0x140005680]
mov eax, edx
mov ecx, r11d
sub eax, r8d
dec eax
cmp r11d, eax
jb 0x1400015e0
inc r8d
lea eax, [rdx - 1]
cmp r8d, eax
jb 0x1400015d0
mov r8d, dword [0x14000568c]
mov eax, r13d
mov ebx, dword [0x14000569c]
sub ebx, r8d
add r8, rsi
test ebx, ebx
je 0x140001697
movzx r9d, byte [0x14000505a]
movzx r10d, word [0x140005058]
nop word [rax + rax]
movsxd rcx, eax
cmp r10w, word [rcx + r8]
jne 0x140001691
cmp r9b, byte [rcx + r8 + 2]
je 0x1400016b7
inc eax
cmp eax, ebx
jb 0x140001680
mov rdi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r15, qword [rsp]
mov eax, 1
add rsp, 0x18
pop r13
pop rsi
ret
test eax, eax
je 0x140001697
mov edi, r13d
test edx, edx
je 0x140001697
mov r11d, eax
nop word [rax + rax]
mov ebp, edi
add rbp, rbp
mov r8d, dword [r15 + rbp*8 + 0xc]
add r8, rsi
cmp r10w, word [r11 + r8]
lea rax, [r11 + r8]
jne 0x1400016ee
cmp r9b, byte [rax + 2]
je 0x14000172e
mov ecx, 1
mov eax, ecx
imul eax, ebx
mov edx, eax
add rax, r11
add rax, r8
cmp r10w, word [rax]
jne 0x14000170c
cmp r9b, byte [rax + 2]
je 0x14000172e
mov rax, r11
sub rax, rdx
add rax, r8
cmp r10w, word [rax]
jne 0x140001721
cmp r9b, byte [rax + 2]
je 0x14000172e
inc ecx
cmp ecx, 0x200
jb 0x1400016f3
mov rax, r13
inc edi
mov qword [r15 + rbp*8 + 0x10], rax
cmp edi, dword [0x140005680]
jb 0x1400016d0
jmp 0x140001697
xor eax, eax
add rsp, 0x18
pop r13
pop rsi
ret