Function at 0x140002260
Capabilities:
Access peb ldr_data
Encode data using xor
Encrypt data using rc4 prga
Get ntdll base address
Resolve function by parsing pe exports

Disassembly:
push rsi
push r13
sub rsp, 0x18
cmp dword [0x14007a4e0], 0
jne 0x14000249a
mov rax, qword gs:[0x60]
xor r13d, r13d
mov edx, r13d
mov rcx, qword [rax + 0x18]
mov r8, qword [rcx + 0x10]
mov rax, qword [r8 + 0x30]
test rax, rax
je 0x14000252f
nop dword [rax]
mov rsi, rax
movsxd rax, dword [rax + 0x3c]
mov ecx, dword [rax + rsi + 0x88]
test ecx, ecx
je 0x1400022d9
lea rdx, [rsi + rcx]
mov ecx, dword [rsi + rcx + 0xc]
mov eax, dword [rcx + rsi]
or eax, 0x20202020
cmp eax, 0x6c64746e
jne 0x1400022d9
mov eax, dword [rcx + rsi + 4]
or eax, 0x20202020
cmp eax, 0x6c642e6c
je 0x1400022e5
mov r8, qword [r8]
mov rax, qword [r8 + 0x30]
test rax, rax
jne 0x1400022a0
test rdx, rdx
je 0x14000252f
mov r11d, dword [rdx + 0x18]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
mov ebp, dword [rdx + 0x24]
mov qword [rsp + 0x40], rdi
mov edi, dword [rdx + 0x20]
mov qword [rsp + 0x10], r12
add rdi, rsi
mov qword [rsp + 8], r14
mov r12d, 0x775a
mov r14d, dword [rdx + 0x1c]
mov edx, r13d
add r14, rsi
mov qword [rsp], r15
add rbp, rsi
lea r15, [0x14007a4e0]
nop dword [rax]
nop word [rax + rax]
dec r11d
mov r10d, dword [rdi + r11*4]
add r10, rsi
cmp word [r10], r12w
jne 0x1400023a4
mov r9d, r13d
mov r8d, 0xa6161bd2
mov rax, r10
nop dword [rax]
movzx eax, word [rax]
mov ecx, r8d
ror ecx, 8
inc r9d
add ecx, eax
mov eax, r9d
add rax, r10
xor r8d, ecx
cmp byte [rax], r13b
jne 0x140002360
mov ecx, edx
inc edx
add rcx, rcx
mov dword [r15 + rcx*8 + 8], r8d
movzx eax, word [rbp + r11*2]
mov eax, dword [r14 + rax*4]
mov dword [r15 + rcx*8 + 0xc], eax
mov qword [r15 + rcx*8 + 0x10], r13
cmp edx, 0x226
je 0x1400023a9
test r11d, r11d
jne 0x140002340
mov r14, qword [rsp + 8]
lea eax, [rdx - 1]
mov r12, qword [rsp + 0x10]
mov r11d, r13d
mov dword [0x14007a4e0], edx
test eax, eax
je 0x140002440
mov eax, edx
mov ecx, r13d
sub eax, r11d
cmp eax, 1
je 0x140002435
lea r10d, [rcx + 1]
mov r9d, ecx
add r9, r9
mov r8d, r10d
add r8, r8
mov edi, dword [r15 + r9*8 + 0xc]
mov ebx, dword [r15 + r8*8 + 0xc]
cmp edi, ebx
jbe 0x140002426
mov edx, dword [r15 + r9*8 + 8]
mov eax, dword [r15 + r8*8 + 8]
mov rcx, qword [r15 + r9*8 + 0x10]
mov dword [r15 + r9*8 + 8], eax
mov rax, qword [r15 + r8*8 + 0x10]
mov qword [r15 + r9*8 + 0x10], rax
mov dword [r15 + r9*8 + 0xc], ebx
mov dword [r15 + r8*8 + 8], edx
mov dword [r15 + r8*8 + 0xc], edi
mov qword [r15 + r8*8 + 0x10], rcx
mov edx, dword [0x14007a4e0]
mov eax, edx
mov ecx, r10d
sub eax, r11d
dec eax
cmp r10d, eax
jb 0x1400023d0
inc r11d
lea eax, [rdx - 1]
cmp r11d, eax
jb 0x1400023c3
mov ecx, dword [0x14007a4ec]
mov eax, r13d
mov ebx, dword [0x14007a4fc]
sub ebx, ecx
add rcx, rsi
test ebx, ebx
je 0x140002487
movzx r9d, byte [0x140079c5e]
movzx r11d, word [0x140079c5c]
nop dword [rax + rax]
mov r10d, eax
cmp r11w, word [r10 + rcx]
jne 0x140002481
cmp r9b, byte [r10 + rcx + 2]
je 0x1400024a7
inc eax
cmp eax, ebx
jb 0x140002470
mov rdi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r15, qword [rsp]
mov eax, 1
add rsp, 0x18
pop r13
pop rsi
ret
test eax, eax
je 0x140002487
mov edi, r13d
test edx, edx
je 0x140002487
mov ebp, edi
add rbp, rbp
mov r8d, dword [r15 + rbp*8 + 0xc]
add r8, rsi
cmp r11w, word [r10 + r8]
lea rax, [r10 + r8]
jne 0x1400024d0
cmp r9b, byte [rax + 2]
je 0x14000251b
mov ecx, 1
nop word [rax + rax]
mov eax, ecx
imul eax, ebx
mov edx, eax
add rax, r10
add rax, r8
cmp r11w, word [rax]
jne 0x1400024f9
cmp r9b, byte [rax + 2]
je 0x14000251b
mov rax, r10
sub rax, rdx
add rax, r8
cmp r11w, word [rax]
jne 0x14000250e
cmp r9b, byte [rax + 2]
je 0x14000251b
inc ecx
cmp ecx, 0x200
jb 0x1400024e0
mov rax, r13
inc edi
mov qword [r15 + rbp*8 + 0x10], rax
cmp edi, dword [0x14007a4e0]
jb 0x1400024b2
jmp 0x140002487
xor eax, eax
add rsp, 0x18
pop r13
pop rsi
ret