Function at 0x1400f0000
Capabilities:
Access peb ldr_data
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x68
mov rax, qword gs:[0x60]
xor r15d, r15d
mov dword [rsp + 0x20], 0x7865742e
mov word [rsp + 0x24], 0x74
mov rcx, qword [rax + 0x18]
mov r11, qword [rcx + 0x10]
mov r9, qword [r11 + 0x60]
test r9, r9
je 0x1400f008c
nop dword [rax]
mov r10, qword [r11 + 0x30]
mov r8d, 0xf26a0bc2
nop word [rax + rax]
movzx ecx, word [r9]
lea r9, [r9 + 2]
lea eax, [rcx - 0x41]
cmp ax, 0x19
lea edx, [rcx + 0x20]
cmova dx, cx
test dx, dx
je 0x1400f0077
rol r8d, 5
movzx eax, dx
add r8d, eax
jmp 0x1400f0050
cmp r8d, 0xcf81efeb
je 0x1400f008f
mov r11, qword [r11]
mov r9, qword [r11 + 0x60]
test r9, r9
jne 0x1400f0040
mov r10, r15
movsxd rax, dword [r10 + 0x3c]
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x58], r13
mov ebp, dword [rax + r10 + 0x88]
test ebp, ebp
je 0x1400f011e
mov r8d, dword [rbp + r10 + 0x20]
mov edi, ebp
mov r11d, dword [rbp + r10 + 0x24]
add r8, r10
mov esi, dword [rbp + r10 + 0x1c]
add r11, r10
mov ebx, dword [rbp + r10 + 0x18]
add rsi, r10
mov r9, r15
test rbx, rbx
je 0x1400f011e
mov ecx, dword [r8]
mov edx, 0xe1bf6360
add rcx, r10
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1400f010e
nop word [rax + rax]
movsx eax, al
lea rcx, [rcx + 1]
lea edx, [rax + rdx*2]
movzx eax, byte [rcx - 1]
test al, al
jne 0x1400f00f0
cmp edx, 0xf63b9ba3
je 0x1400f086e
inc r9
add r8, 4
add r11, 2
cmp r9, rbx
jb 0x1400f00d0
mov qword [rsp + 0x48], r15
mov rdi, rbp
mov r14, rbp
test ebp, ebp
je 0x1400f01ae
mov r8d, dword [rdi + r10 + 0x20]
lea r9, [rdi + r10]
mov ebx, dword [r9 + 0x24]
add r8, r10
mov esi, dword [r9 + 0x1c]
add rbx, r10
mov edi, dword [r9 + 0x18]
add rsi, r10
mov r11, r15
test rdi, rdi
je 0x1400f01ae
nop word [rax + rax]
mov ecx, dword [r8]
mov edx, 0xe1bf6360
add rcx, r10
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1400f019e
nop word [rax + rax]
movsx eax, al
lea rcx, [rcx + 1]
lea edx, [rax + rdx*2]
movzx eax, byte [rcx - 1]
test al, al
jne 0x1400f0180
cmp edx, 0xd8edbdfd
je 0x1400f0885
inc r11
add r8, 4
add rbx, 2
cmp r11, rdi
jb 0x1400f0160
mov qword [rsp + 0x40], r15
lea r9, [r14 + r10]
mov r12, r15
test ebp, ebp
je 0x1400f022e
mov r8d, dword [r9 + 0x20]
mov r11, r15
mov ebx, dword [r9 + 0x24]
add r8, r10
mov esi, dword [r9 + 0x1c]
add rbx, r10
mov edi, dword [r9 + 0x18]
add rsi, r10
test rdi, rdi
je 0x1400f022e
nop
mov ecx, dword [r8]
mov edx, 0xe1bf6360
add rcx, r10
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1400f021e
nop word [rax + rax]
movsx eax, al
lea rcx, [rcx + 1]
lea edx, [rax + rdx*2]
movzx eax, byte [rcx - 1]
test al, al
jne 0x1400f0200
cmp edx, 0xd8f0609e
je 0x1400f0899
inc r11
add r8, 4
add rbx, 2
cmp r11, rdi
jb 0x1400f01e0
mov qword [rsp + 0x28], r15
test ebp, ebp
je 0x1400f02ae
mov r8d, dword [r9 + 0x20]
mov r11, r15
mov ebx, dword [r9 + 0x24]
add r8, r10
mov esi, dword [r9 + 0x1c]
add rbx, r10
mov edi, dword [r9 + 0x18]
add rsi, r10
test rdi, rdi
je 0x1400f02ae
nop dword [rax + rax]
mov ecx, dword [r8]
mov edx, 0xe1bf6360
add rcx, r10
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1400f029e
nop word [rax + rax]
movsx eax, al
lea rcx, [rcx + 1]
lea edx, [rax + rdx*2]
movzx eax, byte [rcx - 1]
test al, al
jne 0x1400f0280
cmp edx, 0xf63c16a1
je 0x1400f08ac
inc r11
add r8, 4
add rbx, 2
cmp r11, rdi
jb 0x1400f0260
mov qword [rsp + 0x38], r15
test ebp, ebp
je 0x1400f038e
mov r8d, dword [r9 + 0x20]
mov r11, r15
mov ebx, dword [r9 + 0x18]
add r8, r10
test rbx, rbx
je 0x1400f031a
nop
mov ecx, dword [r8]
mov edx, 0xe1bf6360
add rcx, r10
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1400f030a
nop word [rax + rax]
movsx eax, al
lea rcx, [rcx + 1]
lea edx, [rax + rdx*2]
movzx eax, byte [rcx - 1]
test al, al
jne 0x1400f02f0
cmp edx, 0xfb1e0b47
je 0x1400f031a
inc r11
add r8, 4
cmp r11, rbx
jb 0x1400f02d0
test ebp, ebp
je 0x1400f038e
mov r8d, dword [r9 + 0x20]
mov r11, r15
mov ebx, dword [r9 + 0x24]
add r8, r10
mov esi, dword [r9 + 0x1c]
add rbx, r10
mov edi, dword [r9 + 0x18]
add rsi, r10
test rdi, rdi
je 0x1400f038e
nop dword [rax + rax]
mov ecx, dword [r8]
mov edx, 0xe1bf6360
add rcx, r10
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1400f037e
nop word [rax + rax]
movsx eax, al
lea rcx, [rcx + 1]
lea edx, [rax + rdx*2]
movzx eax, byte [rcx - 1]
test al, al
jne 0x1400f0360
cmp edx, 0x37ec775e
je 0x1400f08bf
inc r11
add r8, 4
add rbx, 2
cmp r11, rdi
jb 0x1400f0340
mov dword [rsp + 0xa0], r15d
mov r14d, r15d
mov esi, r15d
mov r13, r15
test ebp, ebp
je 0x1400f041e
mov r8d, dword [r9 + 0x20]
mov r11, r15
mov ebx, dword [r9 + 0x24]
add r8, r10
mov edi, dword [r9 + 0x1c]
add rbx, r10
mov r9d, dword [r9 + 0x18]
add rdi, r10
test r9, r9
je 0x1400f041e
nop dword [rax]
nop dword [rax + rax]
mov ecx, dword [r8]
mov edx, 0xe1bf6360
add rcx, r10
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1400f040e
nop word [rax + rax]
movsx eax, al
lea rcx, [rcx + 1]
lea edx, [rax + rdx*2]
movzx eax, byte [rcx - 1]
test al, al
jne 0x1400f03f0
cmp edx, 0x63b6cb5b
je 0x1400f08dc
inc r11
add r8, 4
add rbx, 2
cmp r11, r9
jb 0x1400f03d0
mov rdx, r15
xor ecx, ecx
call rdx
mov rdi, rax
mov r9, r15
movsxd rax, dword [rax + 0x3c]
add rax, rdi
mov qword [rsp + 0x30], rax
movzx ecx, word [rax + 0x14]
lea r10, [rax + 0x18]
movzx r11d, word [rax + 6]
add r10, rcx
test r11, r11
je 0x1400f049d
lea rax, [rsp + 0x20]
mov r8, r10
sub r8, rax
nop word [rax + rax]
mov rdx, r15
nop dword [rax]
nop word [rax + rax]
lea rcx, [rsp + 0x20]
add rcx, rdx
movzx eax, byte [rcx]
cmp byte [r8 + rcx], al
jne 0x1400f08ea
inc rdx
cmp rdx, 6
jb 0x1400f0470
mov esi, dword [r10 + 8]
mov r14d, dword [r10 + 0xc]
mov dword [rsp + 0xa0], esi
call fcn.1400f0b30
mov rbx, rax
mov ecx, esi
add rcx, rdi
mov eax, r14d
add rax, rcx
cmp rbx, rax
ja 0x1400f090f
nop dword [rax]
mov rcx, r15
cmp byte [rcx + rbx], r15b
jne 0x1400f0903
inc rcx
cmp rcx, 0x80
jb 0x1400f04c3
mov ecx, 0x3e8
call r13
mov eax, edi
lea rsi, [rbx + 0x100]
sub eax, esi
mov r9d, 4
add eax, dword [rsp + 0xa0]
mov r8d, 0x3000
add eax, r14d
xor ecx, ecx
mov edx, eax
mov r14d, eax
call qword [rsp + 0x38]
mov rbp, rax
test rax, rax
je 0x1400f090f
mov ecx, 0x3e8
call r13
mov rdx, r15
test r14, r14
je 0x1400f054f
sub rsi, rbp
nop dword [rax]
mov rax, rdx
lea rcx, [rdx + rbp]
and eax, 0x7f
inc rdx
movzx eax, byte [rax + rbx + 0x80]
xor al, byte [rsi + rcx]
mov byte [rcx], al
cmp rdx, r14
jb 0x1400f0530
movsxd r13, dword [rbp + 0x3c]
mov r14, r15
mov rax, qword [rsp + 0x30]
add r13, rbp
movzx esi, word [r13 + 0x14]
movzx ebx, word [rax + 0x14]
add rsi, 0x28
add rbx, 0x20
cmp r15w, word [r13 + 6]
jae 0x1400f0622
mov r12, qword [rsp + 0x28]
add rbx, rax
add rsi, r13
nop word [rax + rax]
mov ecx, dword [rbx + 4]
lea r9, [rsp + 0xb8]
mov edx, dword [rbx]
add rcx, rdi
mov r8d, 4
call r12
mov eax, dword [rsi]
mov rdx, r15
test eax, eax
je 0x1400f05dd
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rsi + 4]
mov ecx, dword [rbx + 4]
add rax, rdx
add rcx, rdx
inc rdx
movzx eax, byte [rax + rbp]
mov byte [rcx + rdi], al
mov eax, dword [rsi]
cmp rdx, rax
jb 0x1400f05c0
mov ecx, eax
mov eax, dword [rbx]
cmp rcx, rax
jae 0x1400f0604
nop word [rax + rax]
mov eax, dword [rbx + 4]
add rax, rcx
inc rcx
mov byte [rax + rdi], r15b
mov eax, dword [rbx]
cmp rcx, rax
jb 0x1400f05f0
movzx eax, word [r13 + 6]
add rsi, 0x28
add rbx, 0x28
inc r14
cmp r14, rax
jb 0x1400f0590
mov r12, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x30]
lea r9, [rsp + 0xa8]
mov rbp, qword [rsp + 0x28]
mov r8d, 4
mov rcx, rsi
movzx edx, word [rsi + 0x14]
add rdx, 0x18
call rbp
mov eax, dword [r13 + 0x28]
lea r9, [rsp + 0xa8]
mov dword [rsi + 0x28], eax
mov rcx, rsi
mov eax, dword [r13 + 0x88]
mov dword [rsi + 0x88], eax
mov eax, dword [r13 + 0x8c]
mov dword [rsi + 0x8c], eax
mov eax, dword [r13 + 0x90]
mov dword [rsi + 0x90], eax
mov eax, dword [r13 + 0x94]
mov dword [rsi + 0x94], eax
mov eax, dword [r13 + 0x98]
mov dword [rsi + 0x98], eax
mov eax, dword [r13 + 0x9c]
mov dword [rsi + 0x9c], eax
mov eax, dword [r13 + 0xa0]
mov dword [rsi + 0xa0], eax
mov eax, dword [r13 + 0xa4]
mov dword [rsi + 0xa4], eax
mov eax, dword [r13 + 0xa8]
mov dword [rsi + 0xa8], eax
mov eax, dword [r13 + 0xac]
mov dword [rsi + 0xac], eax
mov eax, dword [r13 + 0xb0]
mov dword [rsi + 0xb0], eax
mov eax, dword [r13 + 0xb4]
mov dword [rsi + 0xb4], eax
mov eax, dword [r13 + 0xb8]
mov dword [rsi + 0xb8], eax
mov eax, dword [r13 + 0xbc]
mov dword [rsi + 0xbc], eax
mov eax, dword [r13 + 0xc0]
mov dword [rsi + 0xc0], eax
mov eax, dword [r13 + 0xc4]
mov dword [rsi + 0xc4], eax
mov eax, dword [r13 + 0xc8]
mov dword [rsi + 0xc8], eax
mov eax, dword [r13 + 0xcc]
mov dword [rsi + 0xcc], eax
mov eax, dword [r13 + 0xd0]
mov dword [rsi + 0xd0], eax
mov eax, dword [r13 + 0xd4]
mov dword [rsi + 0xd4], eax
mov eax, dword [r13 + 0xd8]
mov dword [rsi + 0xd8], eax
mov eax, dword [r13 + 0xdc]
mov dword [rsi + 0xdc], eax
mov eax, dword [r13 + 0xe0]
mov dword [rsi + 0xe0], eax
mov eax, dword [r13 + 0xe4]
mov dword [rsi + 0xe4], eax
mov eax, dword [r13 + 0xe8]
mov dword [rsi + 0xe8], eax
mov eax, dword [r13 + 0xec]
mov dword [rsi + 0xec], eax
mov eax, dword [r13 + 0xf0]
mov dword [rsi + 0xf0], eax
mov eax, dword [r13 + 0xf4]
mov dword [rsi + 0xf4], eax
mov eax, dword [r13 + 0xf8]
mov dword [rsi + 0xf8], eax
mov eax, dword [r13 + 0xfc]
mov dword [rsi + 0xfc], eax
movzx edx, word [rsi + 0x14]
mov r8d, dword [rsp + 0xa8]
add rdx, 0x18
call rbp
mov eax, dword [rsi + 0x90]
lea r14, [rax + rdi]
test rax, rax
je 0x1400f095f
cmp dword [r14 + 0xc], r15d
je 0x1400f095f
mov r15, qword [rsp + 0x48]
cmp dword [r14 + 0x10], 0
je 0x1400f0952
mov ecx, dword [r14 + 0xc]
add rcx, rdi
call r15
mov rbp, rax
test rax, rax
je 0x1400f0943
mov eax, dword [r14]
test eax, eax
jne 0x1400f083f
mov eax, dword [r14 + 0x10]
mov esi, dword [r14 + 0x10]
add rsi, rdi
mov ebx, eax
add rbx, rdi
je 0x1400f0943
mov rax, qword [rbx]
test rax, rax
je 0x1400f0943
mov rcx, rbp
jns 0x1400f0928
movzx edx, ax
jmp 0x1400f092f
movzx eax, word [r11]
mov r14, rbp
mov eax, dword [rsi + rax*4]
add rax, r10
mov qword [rsp + 0x48], rax
jmp 0x1400f0131
movzx eax, word [rbx]
mov r12d, dword [rsi + rax*4]
add r12, r10
mov qword [rsp + 0x40], r12
jmp 0x1400f01be
movzx eax, word [rbx]
mov eax, dword [rsi + rax*4]
add rax, r10
mov qword [rsp + 0x28], rax
jmp 0x1400f0237
movzx eax, word [rbx]
mov eax, dword [rsi + rax*4]
add rax, r10
mov qword [rsp + 0x38], rax
jmp 0x1400f02bb
movzx eax, word [rbx]
mov r14d, r15d
mov dword [rsp + 0xa0], r15d
mov r13d, dword [rsi + rax*4]
mov esi, r15d
add r13, r10
jmp 0x1400f03a3
movzx eax, word [rbx]
mov edx, dword [rdi + rax*4]
add rdx, r10
jmp 0x1400f0421
add r10, 0x28
add r8, 0x28
inc r9
cmp r9, r11
jb 0x1400f0460
jmp 0x1400f049d
inc rbx
cmp rbx, rax
jbe 0x1400f04c0
xor eax, eax
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
add rsp, 0x68
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea rdx, [rax + 2]
add rdx, rdi
call r12
mov qword [rsi], rax
add rsi, 8
add rbx, 8
jne 0x1400f0851
add r14, 0x14
cmp dword [r14 + 0xc], 0
jne 0x1400f0813
mov rsi, qword [rsp + 0x30]
xor r15d, r15d
mov rbp, qword [rsp + 0x28]
mov eax, dword [rsi + 0xb0]
mov r9, rdi
sub r9, qword [r13 + 0x30]
lea rbx, [rax + rdi]
test rax, rax
je 0x1400f0a27
cmp dword [rsi + 0xb4], 0
je 0x1400f0a27
mov eax, dword [rbx + 4]
test eax, eax
je 0x1400f0a27
mov r8d, dword [rbx]
lea r10, [rbx + 8]
sub rax, 8
add r8, rdi
shr rax, 1
mov r11d, eax
test eax, eax
je 0x1400f0a16
nop dword [rax]
movzx edx, word [r10]
movzx ecx, dx
movzx eax, dx
shr cx, 0xc
cmp cx, 0xa
jne 0x1400f09d0
and edx, 0xfff
add qword [rdx + r8], r9
jmp 0x1400f0a0c
cmp cx, 3
jne 0x1400f09e1
and eax, 0xfff
add dword [rax + r8], r9d
jmp 0x1400f0a0c
cmp cx, 1
jne 0x1400f09fc
and eax, 0xfff
lea rcx, [rax + r8]
mov rax, r9
shr rax, 0x10
add word [rcx], ax
jmp 0x1400f0a0c
cmp cx, 2
jne 0x1400f0a0c
and eax, 0xfff
add word [rax + r8], r9w
add r10, 2
sub r11, 1
jne 0x1400f09b0
mov eax, dword [rbx + 4]
add rbx, rax
mov eax, dword [rbx + 4]
test eax, eax
jne 0x1400f0991
movzx ebx, word [rsi + 0x14]
add rbx, 0x24
cmp r15w, word [r13 + 6]
jae 0x1400f0a7b
add rbx, rsi
nop dword [rax]
test r15, r15
je 0x1400f0a52
mov ecx, dword [rbx + 0x18]
call fcn.1400f0a90
mov r8d, eax
jmp 0x1400f0a58
mov r8d, 0x40
mov ecx, dword [rbx]
lea r9, [rsp + 0xb0]
mov edx, dword [rbx - 4]
add rcx, rdi
call rbp
movzx eax, word [r13 + 6]
add rbx, 0x28
inc r15
cmp r15, rax
jb 0x1400f0a40
mov eax, dword [rsi + 0x28]
add rax, rdi
call rax
jmp 0x1400f0911