Function at 0x180016ff4
Capabilities:
Access peb ldr_data
Encode data using xor
Parse pe header
Resolve function by hash
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x68
xor ebx, ebx
mov r8d, ebx
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0xc0], ebx
call fcn.1800175e4
lea ebp, [rbx + 1]
mov r14, rax
mov eax, 0x5a4d
cmp word [r14], ax
jne 0x18001704b
movsxd rax, dword [r14 + 0x3c]
lea rcx, [rax - 0x40]
cmp rcx, 0x3bf
ja 0x18001704b
cmp dword [rax + r14], 0x4550
je 0x180017050
sub r14, rbp
jmp 0x180017025
mov rax, qword gs:[0x60]
mov qword [rsp + 0xb8], r14
mov r12d, 0xffff
mov rdi, qword [rax + 0x18]
mov rdx, qword [rdi + 0x20]
jmp 0x1800170a9
mov rsi, qword [rdx + 0x50]
movzx r8d, word [rdx + 0x48]
mov rcx, rbx
ror ecx, 0xd
cmp byte [rsi], 0x61
jb 0x18001708f
movzx eax, byte [rsi]
sub eax, 0x20
cdqe
jmp 0x180017092
movzx eax, byte [rsi]
add rcx, rax
add rsi, rbp
add r8w, r12w
jne 0x18001707d
cmp ecx, 0x6a4abc5b
je 0x1800170b0
mov rdx, qword [rdx]
test rdx, rdx
jne 0x180017071
jmp 0x1800170b4
mov rdi, qword [rdx + 0x20]
movsxd rax, dword [rdi + 0x3c]
mov r13, qword [rsp + 0xb8]
mov r15, qword [rsp + 0xb8]
mov r11d, dword [rax + rdi + 0x88]
mov r9, qword [rsp + 0xb8]
mov r10d, 6
mov esi, dword [r11 + rdi + 0x20]
mov r8d, dword [r11 + rdi + 0x24]
lea r14d, [r10 - 4]
add rsi, rdi
add r8, rdi
mov edx, dword [rsi]
mov ecx, ebx
add rdx, rdi
mov al, byte [rdx]
ror ecx, 0xd
movsx eax, al
add rdx, rbp
add ecx, eax
mov al, byte [rdx]
test al, al
jne 0x1800170fb
cmp ecx, 0xec0e4e8e
je 0x180017140
cmp ecx, 0x7c0dfcaa
je 0x180017140
cmp ecx, 0x91afca54
je 0x180017140
cmp ecx, 0x7946c61b
je 0x180017140
cmp ecx, 0x753a4fc
je 0x180017140
cmp ecx, 0xd3324904
jne 0x1800171c7
mov eax, dword [r11 + rdi + 0x1c]
movzx edx, word [r8]
add rax, rdi
cmp ecx, 0xec0e4e8e
jne 0x180017161
mov eax, dword [rax + rdx*4]
add rax, rdi
mov qword [rsp + 0x50], rax
jmp 0x1800171c3
cmp ecx, 0x7c0dfcaa
jne 0x18001717d
mov r14d, dword [rax + rdx*4]
add r14, rdi
mov qword [rsp + 0x28], r14
mov r14d, 2
jmp 0x1800171c3
cmp ecx, 0x91afca54
jne 0x18001718e
mov r13d, dword [rax + rdx*4]
add r13, rdi
jmp 0x1800171c3
cmp ecx, 0x7946c61b
jne 0x1800171a3
mov eax, dword [rax + rdx*4]
add rax, rdi
mov qword [rsp + 0x48], rax
jmp 0x1800171c3
cmp ecx, 0x753a4fc
jne 0x1800171b4
mov r15d, dword [rax + rdx*4]
add r15, rdi
jmp 0x1800171c3
cmp ecx, 0xd3324904
jne 0x1800171c3
mov r9d, dword [rax + rdx*4]
add r9, rdi
add r10w, r12w
add rsi, 4
add r8, r14
test r10w, r10w
jne 0x1800170f2
mov r14, qword [rsp + 0xb8]
mov ecx, 0x8000
movsxd rbp, dword [r14 + 0x3c]
add rbp, r14
mov qword [rsp + 0x58], rbp
movzx eax, word [rbp + 0x16]
and ax, cx
neg ax
mov eax, 0x4000
sbb r12d, r12d
and r12d, 0x3c
add r12d, 4
mov dword [rsp + 0x20], r12d
test word [rbp + 0x16], ax
je 0x1800172b3
lea rcx, [r14 + 0x40]
call r9
test rax, rax
jne 0x1800172b3
lea r8d, [rax + 1]
lea rcx, [r14 + 0x40]
xor edx, edx
call r15
mov edi, 1
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1800172b3
mov r15, qword [rsp + 0x28]
cmp rdi, 0x10
jae 0x180017266
test rbx, rbx
jne 0x18001726b
mov rdx, rdi
mov rcx, rsi
call r15
inc rdi
mov rbx, rax
jmp 0x18001724a
test rbx, rbx
je 0x1800172b3
mov edx, dword [rbp + 0x50]
mov rsi, qword [rsp + 0x48]
mov rax, rbx
and eax, 0xfff
lea r9, [rsp + 0xc8]
mov r8d, r12d
sub rbx, rax
mov rcx, rbx
call rsi
mov ecx, dword [rbp + 0x50]
xor eax, eax
mov rdi, rbx
lea r9, [rsp + 0xc8]
mov r8d, r12d
rep stosb byte [rdi], al
mov edx, dword [rbp + 0x50]
mov rcx, rbx
call rsi
xor r11d, r11d
test rbx, rbx
jne 0x1800172d4
mov edx, dword [rbp + 0x50]
mov r9d, r12d
xor ecx, ecx
mov r8d, 0x3000
call r13
mov ecx, dword [rbp + 0x50]
mov rdi, rax
mov rbx, rax
xor eax, eax
rep stosb byte [rdi], al
xor r11d, r11d
mov r8b, byte [rbp + 0x10]
mov r10d, dword [rbp + 0x50]
mov r13d, 1
add r10, 0xffffffffffffffc0
mov byte [rsp + 0xb8], r8b
add r10, rbx
mov qword [rsp + 0x38], r10
test r8b, r8b
je 0x180017303
mov eax, dword [rbp + 0x38]
sub rbx, rax
jmp 0x180017324
mov ecx, dword [rbp + 0x54]
mov rdi, rbx
mov rsi, r14
rep movsb byte [rdi], byte [rsi]
test byte [rbp + 0x16], r13b
je 0x180017324
movsxd rax, dword [rbx + 0x3c]
mov dword [rax + rbx], r11d
mov word [rbx], r11w
mov dword [rbx + 0x3c], r11d
movzx edx, word [rbp + 6]
movzx eax, word [rbp + 0x14]
test rdx, rdx
je 0x18001737a
add rax, 0x28
add rax, rbp
mov r8d, dword [rax - 4]
mov r9d, dword [rax]
mov esi, dword [rax + 4]
add r8, rbx
add rsi, r14
mov ecx, r9d
mov rdi, r8
sub rdx, r13
rep movsb byte [rdi], byte [rsi]
test dword [rax + 0x14], 0x20000000
je 0x180017369
mov qword [rsp + 0x40], r8
mov dword [rsp + 0xc0], r9d
add rax, 0x28
test rdx, rdx
jne 0x180017338
mov r8b, byte [rsp + 0xb8]
mov r15d, dword [rbp + 0x90]
add r15, rbx
mov qword [rsp + 0x30], r15
mov eax, dword [r15 + 0xc]
test eax, eax
je 0x1800174ad
mov rbp, r10
jmp 0x1800173a0
mov r13d, 1
mov esi, eax
mov rdi, rbp
mov ecx, 0x40
add rsi, rbx
mov rax, rbp
rep movsb byte [rdi], byte [rsi]
mov ecx, 0x40
xor byte [rax], r8b
add rax, r13
sub rcx, r13
jne 0x1800173b7
mov rcx, rbp
call qword [rsp + 0x50]
mov r14d, dword [r15 + 0x10]
mov r12d, dword [r15]
add r14, rbx
xor r11d, r11d
add r12, rbx
mov r13, rax
cmp qword [r14], r11
je 0x180017481
mov r15, qword [rsp + 0x28]
test r12, r12
je 0x180017428
movabs rax, 0x8000000000000000
test qword [r12], rax
je 0x180017428
movsxd rax, dword [r13 + 0x3c]
movzx edx, word [r12]
mov ecx, dword [rax + r13 + 0x88]
mov eax, dword [rcx + r13 + 0x10]
mov ecx, dword [rcx + r13 + 0x1c]
add rcx, r13
sub rdx, rax
mov eax, dword [rcx + rdx*4]
add rax, r13
jmp 0x180017463
mov rsi, qword [r14]
mov edx, 0x40
mov rdi, rbp
add rsi, 2
mov ecx, edx
mov rax, rbp
add rsi, rbx
rep movsb byte [rdi], byte [rsi]
mov ecx, edx
mov dl, byte [rsp + 0xb8]
lea edi, [rcx - 0x3f]
xor byte [rax], dl
add rax, rdi
sub rcx, rdi
jne 0x18001744d
mov rdx, rbp
mov rcx, r13
call r15
xor r11d, r11d
mov qword [r14], rax
add r14, 8
test r12, r12
je 0x180017473
add r12, 8
cmp qword [r14], r11
jne 0x1800173ea
mov r15, qword [rsp + 0x30]
mov eax, dword [r15 + 0x20]
mov r8b, byte [rsp + 0xb8]
add r15, 0x14
mov qword [rsp + 0x30], r15
test eax, eax
jne 0x18001739a
mov rbp, qword [rsp + 0x58]
mov r10, qword [rsp + 0x38]
mov r12d, dword [rsp + 0x20]
xor eax, eax
mov rdi, r10
mov r8, rbx
lea ecx, [rax + 0x40]
rep stosb byte [rdi], al
sub r8, qword [rbp + 0x30]
cmp dword [rbp + 0xb4], r11d
je 0x180017574
mov edi, dword [rbp + 0xb0]
add rdi, rbx
mov eax, dword [rdi + 4]
test eax, eax
je 0x180017574
mov r14d, 2
mov edx, dword [rdi]
mov esi, eax
lea r9, [rdi + 8]
sub rsi, 8
add rdx, rbx
shr rsi, 1
je 0x180017563
mov r10d, 1
movzx ecx, word [r9]
sub rsi, r10
movzx eax, cx
shr ax, 0xc
cmp ax, 0xa
jne 0x18001751f
and ecx, 0xfff
add qword [rcx + rdx], r8
jmp 0x18001755b
cmp ax, 3
jne 0x180017531
and ecx, 0xfff
add dword [rcx + rdx], r8d
jmp 0x18001755b
cmp ax, r10w
jne 0x18001754a
mov rax, r8
and ecx, 0xfff
shr rax, 0x10
add word [rcx + rdx], ax
jmp 0x18001755b
cmp ax, r14w
jne 0x18001755b
and ecx, 0xfff
add word [rcx + rdx], r8w
add r9, r14
test rsi, rsi
jne 0x1800174ff
mov eax, dword [rdi + 4]
add rdi, rax
mov eax, dword [rdi + 4]
test eax, eax
jne 0x1800174e5
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x1800175a5
mov ecx, dword [rsp + 0xc0]
test ecx, ecx
je 0x1800175a5
cmp r12d, 4
jne 0x1800175a5
mov edx, ecx
lea r9, [rsp + 0xc8]
lea r8d, [r12 + 0x1c]
mov rcx, rax
call qword [rsp + 0x48]
mov eax, 0x1000
test word [rbp + 0x16], ax
je 0x1800175b8
mov edi, dword [rbp + 0x80]
jmp 0x1800175bb
mov edi, dword [rbp + 0x28]
mov r8, qword [rsp + 0xb0]
add rdi, rbx
mov edx, 1
mov rcx, rbx
call rdi
mov rax, rdi
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret