Function at 0x313304870
Capabilities:
Access peb ldr_data
Encode data using xor
Encrypt data using rc4 prga
Get ntdll base address
Populate syswhispers2 syscall list
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x18
mov r9d, dword [0x3133d0020]
test r9d, r9d
jne 0x313304afe
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx + 0x30]
test rax, rax
je 0x313304b54
xor r10d, r10d
nop dword [rax]
mov rdx, rax
movsxd rax, dword [rax + 0x3c]
mov eax, dword [rdx + rax + 0x88]
test eax, eax
je 0x3133048f7
lea r10, [rdx + rax]
mov eax, dword [r10 + 0xc]
add rax, rdx
mov r8d, dword [rax]
or r8d, 0x20202020
cmp r8d, 0x6c64746e
jne 0x3133048f7
mov eax, dword [rax + 4]
or eax, 0x20202020
cmp eax, 0x6c642e6c
je 0x31330490c
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
test rax, rax
jne 0x3133048b8
test r10, r10
je 0x313304b54
mov eax, dword [r10 + 0x18]
lea rbp, [rdx + 0x12]
mov esi, dword [r10 + 0x24]
mov edi, dword [r10 + 0x1c]
lea ecx, [rax - 1]
mov eax, dword [r10 + 0x20]
xor r10d, r10d
add rsi, rdx
lea r8, [rsi + rcx*2]
add rdi, rdx
add rax, rdx
lea r11, [rax + rcx*4]
jmp 0x313304954
lea rax, [r8 - 2]
sub r11, 4
cmp rsi, r8
je 0x313304a68
mov r8, rax
mov eax, dword [r11]
add rax, rdx
cmp word [rax], 0x775a
jne 0x313304940
lea rcx, [0x3133d0028]
mov ebx, r10d
shl rbx, 4
add rbx, rcx
cmp byte [rax], 0
je 0x313304b58
cmp byte [rax + 1], 0
mov r13d, 0x30fc192b
mov ecx, 1
mov r14d, 1
je 0x3133049b6
nop word [rax + rax]
movzx ecx, word [rax + rcx]
mov r15d, r13d
add r14d, 1
ror r15d, 8
add ecx, r15d
xor r13d, ecx
mov ecx, r14d
cmp byte [rax + rcx], 0
jne 0x313304998
movzx eax, word [r8]
mov dword [rbx], r13d
lea r13, [rsp + 0xd]
mov byte [rsp + 0xf], 0xc3
mov r14d, dword [rdi + rax*4]
mov eax, 0x50f
mov word [rsp + 0xd], ax
mov dword [rbx + 4], r14d
add r14, rbp
cmp word [r14], 0x50f
mov rcx, r14
je 0x313304b40
lea rax, [r14 + 0x20]
lea r15, [r14 + 0x4000]
add r14, r14
jmp 0x313304a22
mov rcx, r14
sub rcx, rax
movzx r12d, word [rcx]
cmp word [r13], r12w
je 0x313304b18
add rax, 0x20
cmp r15, rax
je 0x313304b34
movzx r12d, word [rax]
mov rcx, rax
cmp word [r13], r12w
jne 0x313304a00
movzx r12d, byte [rax + 2]
cmp byte [r13 + 2], r12b
jne 0x313304a00
add r10d, 1
mov qword [rbx + 8], rcx
cmp r10d, 0x258
jne 0x313304940
mov dword [0x3133d0020], 0x258
mov r11d, 0x257
jmp 0x313304a7d
lea r11d, [r10 - 1]
cmp r10d, 1
mov dword [0x3133d0020], r10d
je 0x313304afe
lea esi, [r10 - 2]
lea rbx, [0x3133d0038]
nop dword [rax + rax]
mov eax, r10d
sub eax, r9d
cmp eax, 1
je 0x313304af5
lea rax, [0x3133d0028]
mov r8d, esi
sub r8d, r9d
shl r8, 4
add r8, rbx
nop
mov edx, dword [rax + 4]
mov ecx, dword [rax + 0x14]
cmp ecx, edx
jae 0x313304aec
movd xmm2, edx
movd xmm3, ecx
mov rdx, qword [rax + 8]
mov rcx, qword [rax + 0x18]
movd xmm0, dword [rax]
movd xmm1, dword [rax + 0x10]
punpckldq xmm0, xmm2
mov qword [rax + 0x18], rdx
punpckldq xmm1, xmm3
mov qword [rax + 8], rcx
movq qword [rax], xmm1
movq qword [rax + 0x10], xmm0
add rax, 0x10
cmp r8, rax
jne 0x313304ab0
add r9d, 1
cmp r9d, r11d
jb 0x313304a90
mov eax, 1
add rsp, 0x18
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
movzx r12d, byte [rcx + 2]
cmp byte [r13 + 2], r12b
je 0x313304a3b
add rax, 0x20
cmp r15, rax
jne 0x313304a22
xor ecx, ecx
jmp 0x313304a3b
movzx eax, byte [r14 + 2]
cmp byte [rsp + 0xf], al
jne 0x3133049eb
jmp 0x313304a3b
xor eax, eax
jmp 0x313304b03
mov r13d, 0x6a97175a
jmp 0x3133049b6