Function at 0x14007fec0
Capabilities:
Access peb ldr_data
Encode data using xor
Encrypt data using rc4 prga
Get ntdll base address
Resolve function by parsing pe exports

Disassembly:
push rbp
push r13
sub rsp, 0x18
cmp dword [0x1402ca9b0], 0
jne 0x14008011a
mov rax, qword gs:[0x60]
xor r13d, r13d
mov edx, r13d
mov rcx, qword [rax + 0x18]
mov r8, qword [rcx + 0x10]
mov rax, qword [r8 + 0x30]
test rax, rax
je 0x1400801b7
nop dword [rax]
mov rbp, rax
movsxd rax, dword [rax + 0x3c]
mov ecx, dword [rax + rbp + 0x88]
test ecx, ecx
je 0x14007ff39
lea rdx, [rcx + rbp]
mov ecx, dword [rcx + rbp + 0xc]
mov eax, dword [rcx + rbp]
or eax, 0x20202020
cmp eax, 0x6c64746e
jne 0x14007ff39
mov eax, dword [rcx + rbp + 4]
or eax, 0x20202020
cmp eax, 0x6c642e6c
je 0x14007ff45
mov r8, qword [r8]
mov rax, qword [r8 + 0x30]
test rax, rax
jne 0x14007ff00
test rdx, rdx
je 0x1400801b7
mov r11d, dword [rdx + 0x18]
mov qword [rsp + 0x30], rbx
mov ebx, r13d
mov qword [rsp + 0x38], rsi
mov esi, dword [rdx + 0x1c]
mov qword [rsp + 0x40], rdi
add rsi, rbp
mov edi, dword [rdx + 0x20]
mov qword [rsp + 0x10], r12
add rdi, rbp
mov qword [rsp + 8], r14
mov r12d, 0x775a
mov r14d, dword [rdx + 0x24]
mov qword [rsp], r15
add r14, rbp
lea r15, [0x1402ca9b0]
nop dword [rax]
nop word [rax + rax]
lea eax, [r11 - 1]
mov edx, dword [rdi + rax*4]
add rdx, rbp
cmp word [rdx], r12w
jne 0x140080015
mov r9d, r13d
mov r8d, 0x6b005edf
mov r10, rdx
nop dword [rax]
mov ecx, r8d
mov eax, r8d
shr ecx, 8
inc r9d
or ecx, r8d
shl eax, 0x18
shr ecx, 8
or ecx, eax
movzx eax, word [r10]
add ecx, eax
mov r10d, r9d
add r10, rdx
xor r8d, ecx
cmp byte [r10], r13b
jne 0x14007ffc0
mov edx, ebx
lea eax, [r11 - 1]
add rdx, rdx
inc ebx
mov dword [r15 + rdx*8 + 8], r8d
movzx eax, word [r14 + rax*2]
mov eax, dword [rsi + rax*4]
mov dword [r15 + rdx*8 + 0xc], eax
mov qword [r15 + rdx*8 + 0x10], r13
cmp ebx, 0x226
je 0x14008001b
add r11d, 0xffffffff
jne 0x14007ffa0
mov r14, qword [rsp + 8]
lea eax, [rbx - 1]
mov r12, qword [rsp + 0x10]
mov r11d, r13d
mov dword [0x1402ca9b0], ebx
test eax, eax
je 0x1400800c0
nop dword [rax]
mov eax, ebx
mov ecx, r13d
sub eax, r11d
cmp eax, 1
je 0x1400800b5
nop dword [rax]
lea r10d, [rcx + 1]
mov r9d, ecx
add r9, r9
mov r8d, r10d
add r8, r8
mov esi, dword [r15 + r9*8 + 0xc]
mov edi, dword [r15 + r8*8 + 0xc]
cmp esi, edi
jbe 0x1400800a6
mov eax, dword [r15 + r8*8 + 8]
mov edx, dword [r15 + r9*8 + 8]
mov rcx, qword [r15 + r9*8 + 0x10]
mov dword [r15 + r9*8 + 8], eax
mov rax, qword [r15 + r8*8 + 0x10]
mov qword [r15 + r9*8 + 0x10], rax
mov dword [r15 + r9*8 + 0xc], edi
mov dword [r15 + r8*8 + 8], edx
mov dword [r15 + r8*8 + 0xc], esi
mov qword [r15 + r8*8 + 0x10], rcx
mov ebx, dword [0x1402ca9b0]
mov eax, ebx
mov ecx, r10d
sub eax, r11d
dec eax
cmp r10d, eax
jb 0x140080050
inc r11d
lea eax, [rbx - 1]
cmp r11d, eax
jb 0x140080040
mov edx, dword [0x1402ca9bc]
mov eax, r13d
mov edi, dword [0x1402ca9cc]
sub edi, edx
add rdx, rbp
test edi, edi
je 0x140080107
movzx r9d, byte [0x1400ca962]
movzx r10d, word [0x1400ca960]
nop dword [rax + rax]
movsxd rcx, eax
cmp r10w, word [rcx + rdx]
jne 0x140080101
cmp r9b, byte [rcx + rdx + 2]
je 0x140080127
inc eax
cmp eax, edi
jb 0x1400800f0
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r15, qword [rsp]
mov eax, 1
add rsp, 0x18
pop r13
pop rbp
ret
test eax, eax
je 0x140080107
mov esi, r13d
test ebx, ebx
je 0x140080107
mov r11d, eax
nop word [rax + rax]
mov eax, esi
add rax, rax
mov r8d, dword [r15 + rax*8 + 0xc]
add r8, rbp
cmp r10w, word [r11 + r8]
lea rax, [r11 + r8]
jne 0x14008015e
cmp r9b, byte [rax + 2]
je 0x14008019e
mov ecx, 1
mov eax, ecx
imul eax, edi
mov edx, eax
add rax, r11
add rax, r8
cmp r10w, word [rax]
jne 0x14008017c
cmp r9b, byte [rax + 2]
je 0x14008019e
mov rax, r8
sub rax, rdx
add rax, r11
cmp r10w, word [rax]
jne 0x140080191
cmp r9b, byte [rax + 2]
je 0x14008019e
inc ecx
cmp ecx, 0x200
jb 0x140080163
mov rax, r13
mov ecx, esi
inc esi
add rcx, rcx
mov qword [r15 + rcx*8 + 0x10], rax
cmp esi, dword [0x1402ca9b0]
jb 0x140080140
jmp 0x140080107
xor eax, eax
add rsp, 0x18
pop r13
pop rbp
ret