Function at 0x140001570
Capabilities:
Access peb ldr_data
Encode data using xor
Encrypt data using rc4 prga
Get kernel32 base address
Resolve function by parsing pe exports

Disassembly:
push rbp
push r12
sub rsp, 0x28
mov rax, qword [0x140022008]
xor rax, rsp
mov qword [rsp + 8], rax
cmp dword [0x140023ce0], 0
jne 0x1400017fc
mov rax, qword gs:[0x60]
xor r12d, r12d
mov edx, r12d
mov word [rsp], 0x50f
mov rcx, qword [rax + 0x18]
mov r8, qword [rcx + 0x10]
mov rax, qword [r8 + 0x30]
test rax, rax
je 0x1400018c0
nop
mov rbp, rax
movsxd rax, dword [rax + 0x3c]
mov ecx, dword [rax + rbp + 0x88]
test ecx, ecx
je 0x1400015f9
lea rdx, [rcx + rbp]
mov ecx, dword [rcx + rbp + 0xc]
mov eax, dword [rcx + rbp]
or eax, 0x20202020
cmp eax, 0x6c64746e
jne 0x1400015f9
mov eax, dword [rcx + rbp + 4]
or eax, 0x20202020
cmp eax, 0x6c642e6c
je 0x140001605
mov r8, qword [r8]
mov rax, qword [r8 + 0x30]
test rax, rax
jne 0x1400015c0
test rdx, rdx
je 0x1400018c0
mov r11d, dword [rdx + 0x18]
mov r8d, r12d
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
mov esi, dword [rdx + 0x1c]
mov qword [rsp + 0x50], rdi
add rsi, rbp
mov edi, dword [rdx + 0x20]
mov qword [rsp + 0x20], r13
add rdi, rbp
mov qword [rsp + 0x18], r14
mov r13d, 0x775a
mov r14d, dword [rdx + 0x24]
mov qword [rsp + 0x10], r15
add r14, rbp
lea r15, [0x140023ce0]
nop dword [rax]
nop word [rax + rax]
lea eax, [r11 - 1]
mov r10d, dword [rdi + rax*4]
mov r11d, eax
add r10, rbp
mov ebx, eax
cmp word [r10], r13w
jne 0x1400016cb
mov r9d, r12d
mov edx, 0x867543ac
mov rax, r10
movzx eax, word [rax]
mov ecx, edx
ror ecx, 8
inc r9d
add ecx, eax
mov eax, r9d
add rax, r10
xor edx, ecx
cmp byte [rax], r12b
jne 0x140001681
mov eax, r8d
inc r8d
lea rcx, [rax + rax*2]
mov dword [r15 + rcx*8 + 8], edx
mov byte [r15 + rcx*8 + 0x18], 1
movzx eax, word [r14 + rbx*2]
mov eax, dword [rsi + rax*4]
mov dword [r15 + rcx*8 + 0x1c], eax
mov qword [r15 + rcx*8 + 0x10], r12
cmp r8d, 0x1f4
je 0x1400016d0
test r11d, r11d
jne 0x140001660
mov r14, qword [rsp + 0x18]
lea eax, [r8 - 1]
mov r13, qword [rsp + 0x20]
mov r9d, r12d
mov dword [0x140023ce0], r8d
test eax, eax
je 0x1400017a1
mov eax, r8d
mov edx, r12d
sub eax, r9d
cmp eax, 1
je 0x140001791
lea r10d, [rdx + 1]
mov eax, edx
lea rcx, [r10 + r10*2]
lea r11, [rcx*8]
mov edi, dword [r11 + r15 + 0x1c]
lea rcx, [rax + rax*2]
lea rbx, [rcx*8]
mov esi, dword [rbx + r15 + 0x1c]
cmp esi, edi
jbe 0x14000177d
mov eax, dword [r11 + r15 + 8]
mov r8d, dword [rbx + r15 + 8]
movzx edx, byte [rbx + r15 + 0x18]
mov rcx, qword [rbx + r15 + 0x10]
mov dword [rbx + r15 + 8], eax
movzx eax, byte [r11 + r15 + 0x18]
mov byte [rbx + r15 + 0x18], al
mov rax, qword [r11 + r15 + 0x10]
mov qword [rbx + r15 + 0x10], rax
mov dword [rbx + r15 + 0x1c], edi
mov dword [r11 + r15 + 8], r8d
mov byte [r11 + r15 + 0x18], dl
mov dword [r11 + r15 + 0x1c], esi
mov qword [r11 + r15 + 0x10], rcx
mov r8d, dword [0x140023ce0]
mov eax, r8d
mov edx, r10d
sub eax, r9d
dec eax
cmp r10d, eax
jb 0x140001702
inc r9d
lea eax, [r8 - 1]
cmp r9d, eax
jb 0x1400016f0
mov edx, dword [0x140023cfc]
mov r11d, dword [0x140023d14]
sub r11d, edx
add rdx, rbp
cmp byte [0x140023cf8], 1
jne 0x1400017e8
mov ecx, r12d
test r11d, r11d
je 0x1400017e8
movzx r9d, word [rsp]
mov r10b, 0xc3
nop dword [rax]
movsxd rax, ecx
cmp r9w, word [rax + rdx]
jne 0x1400017e1
cmp r10b, byte [rax + rdx + 2]
je 0x140001816
inc ecx
cmp ecx, r11d
jb 0x1400017d0
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov r15, qword [rsp + 0x10]
mov eax, 1
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.1400023c0
add rsp, 0x28
pop r12
pop rbp
ret
test ecx, ecx
je 0x1400017e8
mov ebx, r12d
test r8d, r8d
je 0x1400017e8
mov word [rsp + 4], 0x50f
movzx esi, r10b
movzx r10d, word [rsp + 4]
mov r9d, ecx
nop word [rax + rax]
mov eax, ebx
lea rcx, [rax + rax*2]
lea rdi, [rcx*8]
mov r8d, dword [rdi + r15 + 0x1c]
add r8, rbp
cmp r10w, word [r9 + r8]
lea rax, [r9 + r8]
jne 0x140001867
cmp sil, byte [rax + 2]
je 0x1400018ac
mov ecx, 1
nop dword [rax]
mov eax, ecx
imul eax, r11d
mov edx, eax
add rax, r9
add rax, r8
cmp r10w, word [rax]
jne 0x14000188a
cmp sil, byte [rax + 2]
je 0x1400018ac
mov rax, r9
sub rax, rdx
add rax, r8
cmp r10w, word [rax]
jne 0x14000189f
cmp sil, byte [rax + 2]
je 0x1400018ac
inc ecx
cmp ecx, 0x200
jb 0x140001870
mov rax, r12
inc ebx
mov qword [rdi + r15 + 0x10], rax
cmp ebx, dword [0x140023ce0]
jb 0x140001840
jmp 0x1400017e8
xor eax, eax
jmp 0x140001801