Function at 0x140003840
Capabilities:
Access peb ldr_data
Encode data using xor
Get kernel32 base address
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov ecx, 0xe22eceb2
mov rax, qword gs:[0x60]
mov r8d, 0x20b
mov r9d, 0x5a4d
mov qword [rsp + 0x20], rdx
mov rax, qword [rax + 0x18]
add rax, 0x10
mov qword [rsp + 0x30], rax
xor r14d, r14d
mov r12, qword [rax]
nop
cmp r12, rax
je 0x140003aca
cmp qword [r12 + 0x60], 0
je 0x1400039e8
mov rsi, qword [r12 + 0x30]
test rsi, rsi
je 0x1400039e8
movsxd r13, dword [rsi + 0x3c]
add r13, rsi
mov r15d, dword [r13 + 0x88]
add r15, rsi
cmp word [rsi], r9w
jne 0x140003aa7
cmp word [r13 + 0x18], r8w
jne 0x1400038e3
cmp dword [r13 + 0x8c], 0
jbe 0x1400039e3
mov ebp, dword [r15 + 0x18]
xor edi, edi
test ebp, ebp
je 0x1400039da
mov ebx, dword [r15 + 0x20]
add rbx, rsi
nop dword [rax + rax]
mov r11d, dword [rbx]
xor r10d, r10d
add r11, rsi
mov eax, ecx
movzx r9d, byte [r11]
test r9b, r9b
je 0x140003972
mov ebp, 0xe22eceb2
nop dword [rax]
movzx r8d, r9b
sub r9b, 0x41
cmp r9b, 0x19
lea ecx, [r8 + 0x20]
movzx edx, cl
mov ecx, r10d
cmova edx, r8d
movsx r8d, dl
lea edx, [r10 - 0x1dd1314e]
xor eax, r8d
imul edx, r8d
add eax, edx
test r10d, r10d
cmove ecx, ebp
inc r10d
xor ecx, ebp
imul eax, ecx
movzx r9d, byte [r10 + r11]
add eax, r8d
test r9b, r9b
jne 0x140003920
mov ebp, dword [r15 + 0x18]
mov rdx, qword [rsp + 0x20]
mov ecx, eax
cmp rdx, rcx
je 0x14000398e
inc edi
add rbx, 4
mov ecx, 0xe22eceb2
cmp edi, ebp
jb 0x140003900
jmp 0x1400039ce
mov eax, dword [r15 + 0x24]
mov ecx, dword [r15 + 0x1c]
add rax, rsi
add rcx, rsi
movzx edx, word [rax + rdi*2]
mov rax, qword [r13 + 0x88]
mov r14d, dword [rcx + rdx*4]
mov ecx, eax
add r14, rsi
add rcx, rsi
cmp r14, rcx
jb 0x1400039c4
shr rax, 0x20
add rax, rcx
cmp r14, rax
jb 0x1400039f1
mov rdx, qword [rsp + 0x20]
mov ecx, 0xe22eceb2
mov r8d, 0x20b
mov r9d, 0x5a4d
test r14, r14
jne 0x140003a84
mov rax, qword [rsp + 0x30]
mov r12, qword [r12]
jmp 0x140003890
movzx r8d, byte [r14]
mov r10, r14
test r8b, r8b
je 0x140003a1e
nop dword [rax]
inc r14
cmp r8b, 0x2e
mov rax, r14
cmovne rax, r10
movzx r8d, byte [r14]
mov r10, rax
test r8b, r8b
jne 0x140003a00
movzx r8d, byte [rax]
xor r11d, r11d
mov ecx, 0xe22eceb2
mov r9d, ecx
test r8b, r8b
je 0x140003a7c
nop
movzx edx, r8b
sub r8b, 0x41
cmp r8b, 0x19
lea eax, [rdx + 0x20]
movzx ecx, al
mov eax, r11d
cmova ecx, edx
movsx edx, cl
lea ecx, [r11 - 0x1dd1314e]
xor r9d, edx
imul ecx, edx
add r9d, ecx
mov ecx, 0xe22eceb2
test r11d, r11d
cmove eax, ecx
inc r11d
xor eax, ecx
imul r9d, eax
movzx r8d, byte [r11 + r10]
add r9d, edx
test r8b, r8b
jne 0x140003a30
mov edx, r9d
jmp 0x140003861
mov rbx, qword [rsp + 0x70]
mov rax, r14
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rdx, str.DOS_header_e_magic_mismatch
lea rcx, [rsp + 0x28]
call fcn.1400012c0
lea rdx, [0x1400072d8]
lea rcx, [rsp + 0x28]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
lea rdx, str.Cannot_find_desired_import.
lea rcx, [rsp + 0x28]
call fcn.1400012c0
lea rdx, [0x1400072d8]
lea rcx, [rsp + 0x28]
call sub.VCRUNTIME140.dll__CxxThrowException
int3