Function at 0x180015090
Capabilities:
Access peb ldr_data
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x40
mov ecx, dword [rsp + 0xa0]
lea eax, [rdx - 0x3c12]
mov esi, dword [rsp + 0xc0]
lea r9d, [rdx + 0xa1]
mov r15d, dword [rsp + 0xd0]
lea r14d, [rdx + 0x7ba]
mov r12d, dword [rsp + 0xb0]
add esi, 0xfffff846
mov rdi, qword [rsp + 0xa8]
lea ebx, [rcx + 0xa18]
add r15d, 0xffffcc74
lea ebp, [rcx + 0x139]
add r12d, 0xffffcadd
cmp esi, eax
je 0x1800152dc
mov r8, qword [rdi + 0x510]
mov r9d, 0x605
mov edx, 0x3655
mov eax, dword [r8 + 0x280]
xor eax, r9d
cmp eax, edx
je 0x18001514e
inc edx
mov qword [rdi + 0x230], 1
mov ecx, dword [r8 + 0x280]
xor rcx, r9
movsxd rax, edx
cmp rax, rcx
jne 0x18001512f
mov eax, dword [r8 + 0x280]
add eax, 0x350
cmp rax, qword [rdi + 0x270]
je 0x180015175
imul rax, qword [rdi + 0x250], 0x37b1
mov qword [rdi + 0x250], rax
mov rax, qword [rdi + 0x18]
mov ebx, 0x362a
mov edx, ebx
mov qword [rdi + 0x130], rax
mov r8d, 0x3415
mov rcx, rdi
call fcn.1800036a8
mov r8, qword [rdi + 0xe8]
lea rcx, [rdi + 0x380]
lea rax, [rdi + 0xc0]
mov dword [rdi + 0x27c], 0x160000
add qword [rcx], rax
mov edx, 0x318a
movabs rax, 0x180000000
mov qword [rdi + 0x88], rax
movzx eax, word [r8 + 0x168]
or qword [rdi + 0x2c0], rcx
xor ax, dx
mov word [rdi + 0xa8], ax
mov rax, qword [rdi + 0x28]
add rax, rbx
mov dword [rdi + 0x288], 0x400
mov qword [rdi + 0x188], rax
lea rax, section..text
mov qword [rdi + 0x238], rax
lea rax, [0x180016134]
mov qword [rdi + 0x240], rax
lea eax, [rdx + 3]
mov ecx, dword [r8 + 0x290]
add ecx, 0x139
cmp ecx, eax
je 0x18001523e
sub eax, ecx
imul rcx, rax, 0xb98
add qword [rdi + 0xa0], rcx
add qword [rdi + 0x160], 0x3597
lea rax, [0x180003c84]
mov qword [rdi + 0x248], rax
mov r10d, 0x8de
mov eax, dword [r8 + 0x168]
mov edx, 0x3a6b
add eax, r10d
cmp eax, edx
je 0x18001529f
mov r9, qword [rdi + 0xf8]
inc edx
mov rax, 0xffffffffffffffd0
sub rax, rdi
add r9, rax
movsxd rax, edx
mov qword [rdi + 0xf8], r9
mov ecx, dword [r8 + 0x168]
add ecx, r10d
cmp rax, rcx
jne 0x180015277
mov qword [rdi + 0xf8], 0x488
mov rax, qword gs:[0x60]
mov qword [rdi + 0x560], rax
mov rax, qword [rax + 0x18]
mov rcx, qword [rax + 0x10]
lea rax, [rdi + 0x138]
mov qword [rdi + 0x358], rax
mov qword [rdi + 0x568], rcx
jmp 0x1800153e7
mov rcx, qword [rdi + 0x4b8]
add rcx, qword [rdi + 0x1e0]
movsxd rax, ebx
cmp rax, rcx
ja 0x1800153e7
mov r11d, dword [rdi + 0x210]
lea eax, [r9 - 0x33a3]
mov r10d, dword [rdi + 0x548]
lea edx, [r14 + r15]
mov r8d, dword [rdi + 0x270]
and r10d, r9d
mov dword [rsp + 0x38], eax
xor r11d, ebp
xor r11d, r9d
mov dword [rsp + 0x30], r10d
mov r9d, r14d
mov qword [rsp + 0x28], rdi
xor r8d, 0x318c
mov dword [rsp + 0x20], r11d
or r15d, 0x3a05
xor r9d, ebx
add r8d, 0x3182
and edx, 0x3c32
mov ecx, r15d
call fcn.180015d48
mov rcx, qword [rdi + 0x2c0]
mov ebp, eax
or rcx, qword [rdi + 0xd8]
mov eax, 0x37b1
xor qword [rdi + 0x210], rcx
mov r10, qword [rdi + 0x510]
mov r8, qword [rdi + 0x30]
mov edx, dword [rdi + 0x70]
xor r8, 0x3a05
xor r14d, dword [rdi + 0x30]
mov rcx, qword [rdi + 0x340]
add r14d, eax
mov r9, qword [rdi + 0x290]
xor rcx, rax
xor edx, dword [rdi + 0x548]
add r9, qword [rdi + 0xf8]
xor edx, 0x3a05
movsxd rbx, r12d
xor r10, rbx
or r8, rbx
mov qword [rsp + 0x28], r10
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
mov rax, qword [rdi + 0xc0]
xor rax, rbx
xor rax, 0x324b
or qword [rdi + 0x2d8], rax
lea eax, [rbp + 0x217]
cmp esi, eax
jg 0x180015431
lea eax, [rbp + 0xaa6]
cmp esi, eax
jge 0x180015431
mov rax, qword [rdi + 0xe8]
imul ecx, dword [rax + 0x280], 0xb9f3cc89
mov rax, qword [rdi + 0x358]
mov dword [rax], ecx
imul eax, dword [rdi + 0x290], 0xe4301783
cmp eax, 0x2f79
je 0x180015431
mov qword [rdi + 0x198], 0x378a
mov eax, dword [rsp + 0xb8]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
ret