Function at 0x140003070
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xd8
movaps xmmword [rsp + 0x90], xmm6
movaps xmmword [rsp + 0xa0], xmm7
movaps xmmword [rsp + 0xb0], xmm8
movaps xmmword [rsp + 0xc0], xmm9
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r14, qword [rax + 0x30]
mov qword [rsp + 0x20], rax
test r14, r14
je 0x140003634
lea rax, [0x140022b50]
movdqa xmm7, xmmword [0x1403e7240]
movdqa xmm9, xmmword [0x1403e7220]
mov qword [rsp + 0x68], rax
movdqa xmm6, xmmword [0x1403e7250]
movdqa xmm8, xmmword [0x1403e7230]
jmp 0x1400031b2
lea rcx, [0x1403e5c60]
call fcn.14000ff50
lea rcx, [0x1403e5c40]
mov rbx, rax
call fcn.14000ff50
cmp byte [rbx], 0
mov r12, rax
jne 0x140003150
mov rax, qword [0x1403e7210]
mov r9d, 0xffffa9e5
xor r8d, r8d
mov rdx, r12
mov word [r12 + 8], r9w
lea rcx, [0x140022b10]
mov qword [r12], rax
mov byte [r12 + 0xa], 1
mov byte [rbx], 1
call fcn.14000ec60
cmp byte [r12 + 0xa], 0
je 0x14000317e
movq xmm0, qword [r12]
xor word [r12 + 8], 0xa9a9
movq xmm1, qword [0x1403e7218]
mov byte [r12 + 0xa], 0
pxor xmm0, xmm1
movq qword [r12], xmm0
mov rdx, r13
mov rcx, r12
call sub.msvcrt.dll__stricmp
test eax, eax
je 0x14000326e
nop dword [rax]
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov r14, qword [rax + 0x30]
mov qword [rsp + 0x20], rax
test r14, r14
je 0x140003634
movsxd rax, dword [r14 + 0x3c]
mov esi, dword [r14 + rax + 0x88]
test esi, esi
je 0x140003198
add rsi, r14
je 0x140003198
lea rcx, [0x1403e5c20]
mov r13d, dword [rsi + 0xc]
call fcn.14000ff50
lea rcx, [0x1403e5c00]
mov rbx, rax
add r13, r14
call fcn.14000ff50
cmp byte [rbx], 0
mov r12, rax
jne 0x140003226
mov rax, qword [0x1403e7200]
mov r10d, 0x1a1
xor r8d, r8d
mov rdx, r12
mov dword [r12 + 8], 0x4577071f
lea rcx, [0x140022b20]
mov qword [r12], rax
mov word [r12 + 0xc], r10w
mov byte [rbx], 1
call fcn.14000ec60
cmp byte [r12 + 0xd], 0
je 0x14000325b
movq xmm0, qword [r12]
xor byte [r12 + 0xc], 0xa1
movq xmm1, qword [str.1C__t]
mov byte [r12 + 0xd], 0
xor dword [r12 + 8], 0x93b4331
pxor xmm0, xmm1
movq qword [r12], xmm0
mov rdx, r13
mov rcx, r12
call sub.msvcrt.dll__stricmp
test eax, eax
jne 0x1400030fb
mov eax, dword [rsi + 0x1c]
lea rcx, [0x1403e5ca0]
add rax, r14
mov qword [rsp + 0x30], rax
mov eax, dword [rsi + 0x24]
lea rbp, [r14 + rax]
mov qword [rsp + 0x28], rbp
call fcn.14000ff50
lea rcx, [0x1403e5c80]
mov qword [rsp + 0x38], rax
call fcn.14000ff50
lea rcx, [0x1403e5ce0]
mov rbx, rax
call fcn.14000ff50
lea rcx, [0x1403e5cc0]
mov qword [rsp + 0x40], rax
call fcn.14000ff50
lea rcx, [0x1403e5d20]
mov rdi, rax
call fcn.14000ff50
lea rcx, [0x1403e5d00]
mov qword [rsp + 0x48], rax
call fcn.14000ff50
lea rcx, [0x1403e5d60]
mov r13, rax
call fcn.14000ff50
lea rcx, [0x1403e5d40]
mov qword [rsp + 0x50], rax
call fcn.14000ff50
mov qword [rsp + 0x58], r14
mov r15, rax
mov eax, dword [rsi + 0x18]
lea edx, [rax - 1]
mov eax, dword [rsi + 0x20]
lea rsi, [0x140022b70]
mov qword [rsp + 0x60], rsi
lea rbp, [rbp + rdx*2]
add rax, r14
mov r14, r15
mov r15, r13
mov r13, rdi
lea rax, [rax + rdx*4]
mov rdi, rax
nop word [rax + rax]
movzx eax, word [rbp]
mov rsi, qword [rsp + 0x30]
mov r8d, 0xfffff2a9
mov dword [rsp + 0x80], 0x64f5a570
mov rdx, qword [rsp + 0x58]
mov r12d, dword [rdi]
mov word [rsp + 0x84], r8w
mov esi, dword [rsi + rax*4]
mov byte [rsp + 0x86], 0x3f
add r12, rdx
movaps xmmword [rsp + 0x70], xmm9
add rsi, rdx
mov rdx, qword [rsp + 0x38]
cmp byte [rdx], 0
jne 0x1400033c5
mov eax, 0x64f5a570
movdqa xmm2, xmmword [rsp + 0x70]
mov byte [rbx + 0x17], 1
xor r8d, r8d
mov dword [rbx + 0x10], eax
mov eax, 0xfffff2a9
mov rcx, qword [rsp + 0x60]
mov word [rbx + 0x14], ax
mov eax, 0x3f
mov byte [rbx + 0x16], al
movups xmmword [rbx], xmm2
mov byte [rdx], 1
mov rdx, rbx
call fcn.14000ec60
cmp byte [rbx + 0x17], 0
je 0x1400033f8
xor eax, eax
nop dword [rax]
movabs rdx, 0x213fa5c5059bd715
mov rcx, rax
and ecx, 7
shl rcx, 3
shr rdx, cl
xor byte [rbx + rax], dl
add rax, 1
cmp rax, 0x17
jne 0x1400033d0
mov byte [rbx + 0x17], 0
mov rdx, rbx
mov rcx, r12
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x14000340e
mov qword [0x1403f4068], rsi
mov rdx, qword [rsp + 0x40]
mov ecx, 0x976
mov dword [rsp + 0x80], 0xe32e7150
mov word [rsp + 0x84], cx
cmp byte [rdx], 0
movaps xmmword [rsp + 0x70], xmm8
jne 0x14000346c
mov eax, 0xe32e7150
movdqa xmm3, xmmword [rsp + 0x70]
mov byte [r13 + 0x16], 1
xor r8d, r8d
mov dword [r13 + 0x10], eax
mov eax, 0x976
mov rcx, qword [rsp + 0x68]
mov word [r13 + 0x14], ax
movups xmmword [r13], xmm3
mov byte [rdx], 1
mov rdx, r13
call fcn.14000ec60
cmp byte [r13 + 0x16], 0
je 0x1400034a4
movabs rdx, 0x31070921874b0533
xor eax, eax
nop
mov rcx, rax
mov r9, rdx
and ecx, 7
shl rcx, 3
shr r9, cl
xor byte [r13 + rax], r9b
add rax, 1
cmp rax, 0x16
jne 0x140003480
mov byte [r13 + 0x16], 0
mov rdx, r13
mov rcx, r12
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x1400034ba
mov qword [0x1403f4060], rsi
mov edx, 0x7ca8
mov byte [rsp + 0x82], 0x9f
mov word [rsp + 0x80], dx
mov rdx, qword [rsp + 0x48]
movaps xmmword [rsp + 0x70], xmm7
cmp byte [rdx], 0
jne 0x140003515
mov eax, 0x7ca8
movdqa xmm4, xmmword [rsp + 0x70]
mov byte [r15 + 0x13], 1
xor r8d, r8d
mov word [r15 + 0x10], ax
mov eax, 0xffffff9f
lea rcx, [0x140022b40]
mov byte [r15 + 0x12], al
movups xmmword [r15], xmm4
mov byte [rdx], 1
mov rdx, r15
call fcn.14000ec60
cmp byte [r15 + 0x13], 0
je 0x140003553
movabs rdx, 0xdbaf4383c59f19cf
xor eax, eax
nop dword [rax + rax]
mov rcx, rax
mov r10, rdx
and ecx, 7
shl rcx, 3
shr r10, cl
xor byte [r15 + rax], r10b
add rax, 1
cmp rax, 0x13
jne 0x140003530
mov byte [r15 + 0x13], 0
mov rdx, r15
mov rcx, r12
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x140003569
mov qword [0x1403f4058], rsi
mov rdx, qword [rsp + 0x50]
mov eax, 0xffffce6a
movaps xmmword [rsp + 0x70], xmm6
mov word [rsp + 0x80], ax
cmp byte [rdx], 0
mov byte [rsp + 0x82], 0x51
jne 0x1400035c4
mov eax, 0xffffce6a
movdqa xmm5, xmmword [rsp + 0x70]
mov byte [r14 + 0x13], 1
xor r8d, r8d
mov word [r14 + 0x10], ax
mov eax, 0x51
lea rcx, [0x140022b30]
mov byte [r14 + 0x12], al
movups xmmword [r14], xmm5
mov byte [rdx], 1
mov rdx, r14
call fcn.14000ec60
cmp byte [r14 + 0x13], 0
je 0x140003603
movabs rdx, 0xcf2529af23519919
xor eax, eax
nop word [rax + rax]
mov rcx, rax
mov r11, rdx
and ecx, 7
shl rcx, 3
shr r11, cl
xor byte [r14 + rax], r11b
add rax, 1
cmp rax, 0x13
jne 0x1400035e0
mov byte [r14 + 0x13], 0
mov rdx, r14
mov rcx, r12
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x140003619
mov qword [0x1403f4050], rsi
sub rdi, 4
lea rax, [rbp - 2]
cmp qword [rsp + 0x28], rbp
je 0x140003198
mov rbp, rax
jmp 0x140003340
movaps xmm6, xmmword [rsp + 0x90]
movaps xmm7, xmmword [rsp + 0xa0]
movaps xmm8, xmmword [rsp + 0xb0]
movaps xmm9, xmmword [rsp + 0xc0]
add rsp, 0xd8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret