Function at 0x18002871c
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov rax, qword gs:[0x60]
mov ecx, 0x6e
or qword [0x1800509b0], 0xffffffffffffffff
xor edx, edx
mov qword [0x1800509b8], rax
call fcn.180028710
lea ecx, [rdx + 0x74]
mov word [rbp - 0x1b], ax
lea edi, [rdx + 1]
mov edx, edi
call fcn.180028710
lea r9d, [rcx - 0x10]
mov word [rbp - 0x19], ax
lea r14d, [rdi + 1]
mov ecx, r9d
mov edx, r14d
call fcn.180028710
lea r8d, [rdi + 0x6b]
mov word [rbp - 0x17], ax
mov ecx, r8d
lea edx, [rdi + 2]
call fcn.180028710
lea r15d, [rdi + 3]
mov word [rbp - 0x15], ax
mov edx, r15d
call fcn.180028710
lea r13d, [rdi + 4]
mov word [rbp - 0x13], ax
mov edx, r13d
lea ecx, [rdi + 0x2d]
call fcn.180028710
mov ecx, r9d
mov word [rbp - 0x11], ax
lea edx, [rdi + 5]
call fcn.180028710
mov ecx, r8d
mov word [rbp - 0xf], ax
lea edx, [rdi + 6]
movzx r12d, ax
call fcn.180028710
lea edx, [rdi + 7]
mov word [rbp - 0xd], ax
movzx ebx, ax
call fcn.180028710
xor ecx, ecx
mov word [rbp - 0xb], ax
lea edx, [rdi + 8]
movzx esi, ax
call fcn.180028710
movzx ecx, word [0x18004a724]
lea edx, [rdi + 9]
mov word [rbp - 9], ax
call fcn.180028710
movzx ecx, word [0x18004a726]
lea edx, [rdi + 0xa]
mov word [rbp - 7], ax
call fcn.180028710
movzx ecx, word [str.Deceit.exe]
lea edx, [rdi + 0xb]
mov word [rbp - 5], ax
call fcn.180028710
movzx ecx, word [0x18004a72a]
lea edx, [rdi + 0xc]
mov word [rbp - 3], ax
call fcn.180028710
movzx ecx, word [0x18004a72c]
lea edx, [rdi + 0xd]
mov word [rbp - 1], ax
call fcn.180028710
movzx ecx, word [0x18004a72e]
lea edx, [rdi + 0xe]
mov word [rbp + 1], ax
call fcn.180028710
movzx ecx, word [0x18004a730]
lea edx, [rdi + 0xf]
mov word [rbp + 3], ax
call fcn.180028710
movzx ecx, word [0x18004a732]
lea edx, [rdi + 0x10]
mov word [rbp + 5], ax
call fcn.180028710
movzx ecx, word [0x18004a734]
lea edx, [rdi + 0x11]
mov word [rbp + 7], ax
call fcn.180028710
mov word [rbp + 9], ax
mov r9d, 0x133
xor eax, eax
xor r8d, r8d
mov word [rbp + 0xb], ax
mov edx, r8d
movsxd rcx, edx
lea eax, [r9 + rdx]
add edx, edi
xor word [rbp + rcx*2 - 0x1b], ax
cmp edx, 0x13
jb 0x1800288c4
lea rcx, [rbp - 0x1b]
mov word [rbp + 0xb], r8w
call fcn.18002933c
mov qword [0x180050968], rax
xor edx, edx
movsxd rcx, dword [rax + 0x3c]
mov eax, dword [rcx + rax + 0x50]
mov ecx, 0x44
mov dword [0x180050970], eax
call fcn.180028710
lea r8d, [rcx + 0x21]
mov word [rbp - 0x1b], ax
mov ecx, r8d
mov edx, edi
call fcn.180028710
lea ecx, [r8 - 2]
mov word [rbp - 0x19], ax
mov edx, r14d
call fcn.180028710
mov ecx, r8d
mov word [rbp - 0x17], ax
lea edx, [r8 - 0x62]
call fcn.180028710
lea ecx, [rdx + 0x66]
mov word [rbp - 0x15], ax
mov edx, r15d
movzx edi, ax
call fcn.180028710
lea ecx, [r8 + 0xf]
mov word [rbp - 0x13], ax
mov edx, r13d
call fcn.180028710
lea ecx, [r8 - 0x37]
mov word [rbp - 0x11], ax
lea edx, [rcx - 0x28]
call fcn.180028710
mov ecx, r8d
mov word [rbp - 0xf], ax
lea edx, [r8 - 0x5e]
movzx r14d, ax
call fcn.180028710
lea ecx, [rdx + 0x71]
mov word [rbp - 0xd], ax
lea edx, [rcx - 0x70]
movzx r13d, ax
call fcn.180028710
mov ecx, r8d
mov word [rbp - 0xb], ax
lea edx, [r8 - 0x5c]
call fcn.180028710
xor ecx, ecx
mov word [rbp - 9], ax
lea edx, [rcx + 0xa]
call fcn.180028710
lea edx, [rcx + 0xb]
mov word [rbp - 7], ax
movzx ecx, word [0x18004a73e]
movzx r15d, ax
call fcn.180028710
movzx ecx, word [str.CryRenderD3D11.dll]
lea edx, [r8 - 0x59]
mov word [rbp - 5], ax
call fcn.180028710
movzx ecx, word [0x18004a742]
lea edx, [r8 - 0x58]
mov word [rbp - 3], ax
call fcn.180028710
movzx ecx, word [0x18004a744]
lea edx, [r8 - 0x57]
mov word [rbp - 1], ax
call fcn.180028710
movzx ecx, word [0x18004a746]
lea edx, [r8 - 0x56]
mov word [rbp + 1], ax
call fcn.180028710
movzx ecx, word [0x18004a748]
lea edx, [r8 - 0x55]
mov word [rbp + 3], ax
call fcn.180028710
mov word [rbp + 5], ax
lea edx, [r8 - 0x54]
movzx ecx, word [0x18004a74a]
call fcn.180028710
movzx ecx, word [0x18004a74c]
lea edx, [r8 - 0x53]
mov word [rbp + 7], ax
call fcn.180028710
movzx ecx, word [0x18004a74e]
lea edx, [r8 - 0x52]
mov word [rbp + 9], ax
call fcn.180028710
movzx ecx, word [0x18004a750]
lea edx, [r8 - 0x51]
mov word [rbp + 0xb], ax
call fcn.180028710
mov word [rbp + 0xd], ax
mov r9d, 0x133
xor eax, eax
xor r8d, r8d
mov word [rbp + 0xf], ax
mov edx, r8d
movsxd rcx, edx
lea eax, [r9 + rdx]
inc edx
xor word [rbp + rcx*2 - 0x1b], ax
cmp edx, 0x15
jb 0x180028a90
lea rcx, [rbp - 0x1b]
mov word [rbp + 0xf], r8w
call fcn.18002933c
mov qword [0x180050900], rax
xor edx, edx
movsxd rcx, dword [rax + 0x3c]
mov eax, dword [rcx + rax + 0x50]
mov ecx, 0x43
mov dword [0x180050908], eax
call fcn.180028710
lea r8d, [rcx + 0x2f]
mov word [rbp - 0x1b], ax
mov ecx, r8d
lea edx, [r8 - 0x71]
call fcn.180028710
lea ecx, [rdx + 0x78]
mov word [rbp - 0x19], ax
lea edx, [rcx - 0x77]
call fcn.180028710
lea ecx, [rdx + 0x50]
mov word [rbp - 0x17], ax
lea edx, [rcx - 0x4f]
call fcn.180028710
lea ecx, [rdx + 0x62]
mov word [rbp - 0x15], ax
lea edx, [rcx - 0x61]
call fcn.180028710
lea ecx, [rdx + 0x6a]
mov word [rbp - 0x13], ax
lea edx, [rcx - 0x69]
call fcn.180028710
mov ecx, r8d
mov word [rbp - 0x11], ax
lea edx, [r8 - 0x6a]
mov word [rbp - 0xf], r12w
mov word [rbp - 0xd], r13w
call fcn.180028710
lea r8d, [rcx - 0x2e]
mov word [rbp - 0xb], ax
mov ecx, r8d
lea edx, [r8 - 0x3b]
call fcn.180028710
lea ecx, [rdx + 0x2a]
mov word [rbp - 9], ax
lea edx, [rcx - 0x29]
call fcn.180028710
mov ecx, r8d
mov word [rbp - 7], ax
lea edx, [r8 - 0x39]
call fcn.180028710
lea ecx, [rdx + 0x26]
mov word [rbp - 5], ax
lea edx, [rcx - 0x25]
call fcn.180028710
lea edx, [rcx - 0x24]
mov word [rbp - 3], ax
call fcn.180028710
lea ecx, [rdx + 0x21]
mov word [rbp - 1], ax
lea edx, [rcx - 0x20]
call fcn.180028710
lea ecx, [rdx + 0x56]
mov word [rbp + 1], ax
lea edx, [rcx - 0x55]
call fcn.180028710
lea ecx, [rdx + 0x5d]
mov word [rbp + 3], ax
lea edx, [rcx - 0x5c]
call fcn.180028710
lea edx, [rcx - 0x5b]
mov word [rbp + 5], ax
call fcn.180028710
xor ecx, ecx
mov word [rbp + 7], ax
lea edx, [rcx + 0x12]
call fcn.180028710
lea edx, [rcx + 0x13]
mov word [rbp + 9], ax
movzx ecx, word [0x18004a766]
call fcn.180028710
mov word [rbp + 0xb], ax
movzx ecx, word [str.Game.dll]
lea edx, [r8 - 0x30]
call fcn.180028710
movzx ecx, word [0x18004a76a]
lea edx, [r8 - 0x2f]
mov word [rbp + 0xd], ax
call fcn.180028710
movzx ecx, word [0x18004a76c]
lea edx, [r8 - 0x2e]
mov word [rbp + 0xf], ax
call fcn.180028710
movzx ecx, word [0x18004a76e]
lea edx, [r8 - 0x2d]
mov word [rbp + 0x11], ax
call fcn.180028710
movzx ecx, word [0x18004a770]
lea edx, [r8 - 0x2c]
mov word [rbp + 0x13], ax
call fcn.180028710
movzx ecx, word [0x18004a772]
lea edx, [r8 - 0x2b]
mov word [rbp + 0x15], ax
call fcn.180028710
movzx ecx, word [0x18004a774]
lea edx, [r8 - 0x2a]
mov word [rbp + 0x17], ax
call fcn.180028710
movzx ecx, word [0x18004a776]
lea edx, [r8 - 0x29]
mov word [rbp + 0x19], ax
call fcn.180028710
movzx ecx, word [0x18004a778]
lea edx, [r8 - 0x28]
mov word [rbp + 0x1b], ax
call fcn.180028710
movzx ecx, word [0x18004a77a]
lea edx, [r8 - 0x27]
mov word [rbp + 0x1d], ax
call fcn.180028710
movzx ecx, word [0x18004a77c]
lea edx, [r8 - 0x26]
mov word [rbp + 0x1f], ax
call fcn.180028710
movzx ecx, word [0x18004a77e]
lea edx, [r8 - 0x25]
mov word [rbp + 0x21], ax
call fcn.180028710
movzx ecx, word [str.user32.dll]
lea edx, [r8 - 0x24]
mov word [rbp + 0x23], ax
call fcn.180028710
movzx ecx, word [0x18004a782]
lea edx, [r8 - 0x23]
mov word [rbp + 0x25], ax
call fcn.180028710
movzx ecx, word [0x18004a784]
lea edx, [r8 - 0x22]
mov word [rbp + 0x27], ax
call fcn.180028710
movzx ecx, word [0x18004a786]
lea edx, [r8 - 0x21]
mov word [rbp + 0x29], ax
call fcn.180028710
movzx ecx, word [0x18004a788]
lea edx, [r8 - 0x20]
mov word [rbp + 0x2b], ax
call fcn.180028710
mov word [rbp + 0x2d], ax
lea r13d, [r8 - 0x43]
xor eax, eax
mov r8d, 0x133
xor r12d, r12d
mov word [rbp + 0x2f], ax
mov edx, r12d
movsxd rcx, edx
lea eax, [r8 + rdx]
add edx, r13d
xor word [rbp + rcx*2 - 0x1b], ax
cmp edx, 0x25
jb 0x180028d52
lea rcx, [rbp - 0x1b]
mov word [rbp + 0x2f], r12w
call fcn.18002933c
mov qword [0x180050920], rax
xor edx, edx
movsxd rcx, dword [rax + 0x3c]
mov eax, dword [rcx + rax + 0x50]
mov ecx, 0x47
mov dword [0x180050928], eax
call fcn.180028710
lea ecx, [rdx + 0x61]
mov word [rbp - 0x1b], ax
mov edx, r13d
call fcn.180028710
mov ecx, 0x6d
mov word [rbp - 0x19], ax
lea edx, [rcx - 0x6b]
call fcn.180028710
lea ecx, [rdx + 0x2c]
mov word [rbp - 0x17], ax
lea edx, [rcx - 0x2a]
mov word [rbp - 0x15], di
call fcn.180028710
lea ecx, [rdx + 0x60]
mov word [rbp - 0x13], ax
lea edx, [rcx - 0x5f]
call fcn.180028710
lea edi, [rcx + 8]
mov word [rbp - 0x11], ax
mov ecx, edi
lea edx, [rdi - 0x66]
call fcn.180028710
xor ecx, ecx
mov word [rbp - 0xf], ax
lea edx, [rdi - 0x64]
mov word [rbp - 0xd], bx
call fcn.180028710
movzx ecx, word [0x18004a77a]
lea edx, [rdi - 0x63]
mov word [rbp - 0xb], ax
call fcn.180028710
movzx ecx, word [0x18004a77c]
lea edx, [rdi - 0x62]
mov word [rbp - 9], ax
call fcn.180028710
movzx ecx, word [0x18004a77e]
lea edx, [rdi - 0x61]
mov word [rbp - 7], ax
call fcn.180028710
movzx ecx, word [str.user32.dll]
lea edx, [rdi - 0x60]
mov word [rbp - 5], ax
call fcn.180028710
movzx ecx, word [0x18004a782]
lea edx, [rdi - 0x5f]
mov word [rbp - 3], ax
call fcn.180028710
movzx ecx, word [0x18004a784]
lea edx, [rdi - 0x5e]
mov word [rbp - 1], ax
call fcn.180028710
movzx ecx, word [0x18004a786]
lea edx, [rdi - 0x5d]
mov word [rbp + 1], ax
call fcn.180028710
movzx ecx, word [0x18004a788]
lea edx, [rdi - 0x5c]
mov word [rbp + 3], ax
call fcn.180028710
mov word [rbp + 5], ax
mov edx, r12d
xor eax, eax
mov r8d, 0x133
mov word [rbp + 7], ax
movsxd rcx, edx
lea eax, [r8 + rdx]
add edx, r13d
xor word [rbp + rcx*2 - 0x1b], ax
cmp edx, 0x11
jb 0x180028ea5
lea rcx, [rbp - 0x1b]
mov word [rbp + 7], r12w
call fcn.18002933c
mov qword [0x180050910], rax
xor edx, edx
movsxd rcx, dword [rax + 0x3c]
mov eax, dword [rcx + rax + 0x50]
mov ecx, 0x75
mov dword [0x180050918], eax
call fcn.180028710
lea ecx, [rdx + 0x73]
mov word [rbp - 0x1b], ax
mov edx, r13d
call fcn.180028710
mov ecx, 0x65
mov word [rbp - 0x19], ax
lea edx, [rcx - 0x63]
call fcn.180028710
lea ecx, [rdx + 0x70]
mov word [rbp - 0x17], ax
lea edx, [rcx - 0x6f]
call fcn.180028710
lea ecx, [rdx + 0x30]
mov word [rbp - 0x15], ax
lea edx, [rcx - 0x2f]
call fcn.180028710
lea ecx, [rdx + 0x2e]
mov word [rbp - 0x13], ax
lea edx, [rcx - 0x2d]
call fcn.180028710
lea ecx, [rdx + 0x5f]
mov word [rbp - 0x11], ax
lea edx, [rcx - 0x5d]
mov word [rbp - 0xf], r14w
call fcn.180028710
mov ecx, edi
mov word [rbp - 0xd], ax
mov edx, 9
mov word [rbp - 0xb], si
movzx ebx, ax
call fcn.180028710
movzx ecx, word [0x18004a796]
mov edx, 0xb
movzx edi, ax
mov word [rbp - 9], ax
mov word [rbp - 7], r15w
call fcn.180028710
movzx ecx, word [str.win32u.dll]
mov edx, 0xc
mov word [rbp - 5], ax
call fcn.180028710
movzx ecx, word [0x18004a79a]
mov edx, 0xd
mov word [rbp - 3], ax
call fcn.180028710
movzx ecx, word [0x18004a79c]
mov edx, 0xe
mov word [rbp - 1], ax
call fcn.180028710
movzx ecx, word [0x18004a79e]
mov edx, 0xf
mov word [rbp + 1], ax
call fcn.180028710
movzx ecx, word [0x18004a7a0]
mov edx, 0x10
mov word [rbp + 3], ax
call fcn.180028710
movzx ecx, word [0x18004a7a2]
mov edx, 0x11
mov word [rbp + 5], ax
call fcn.180028710
movzx ecx, word [0x18004a7a4]
mov edx, 0x12
mov word [rbp + 7], ax
call fcn.180028710
movzx ecx, word [0x18004a7a6]
mov edx, 0x13
mov word [rbp + 9], ax
call fcn.180028710
mov word [rbp + 0xb], ax
mov edx, 0x14
movzx ecx, word [0x18004a7a8]
call fcn.180028710
mov word [rbp + 0xd], ax
mov edx, r12d
xor eax, eax
mov r8d, 0x133
mov word [rbp + 0xf], ax
movsxd rcx, edx
lea eax, [r8 + rdx]
add edx, r13d
xor word [rbp + rcx*2 - 0x1b], ax
cmp edx, 0x15
jb 0x18002904d
lea rcx, [rbp - 0x1b]
mov word [rbp + 0xf], r12w
call fcn.18002933c
mov qword [0x180050958], rax
mov ecx, 0x77
movsxd rdx, dword [rax + 0x3c]
mov eax, dword [rdx + rax + 0x50]
xor edx, edx
mov dword [0x180050960], eax
call fcn.180028710
lea ecx, [rdx + 0x69]
mov word [rbp - 0x1b], ax
mov edx, r13d
call fcn.180028710
mov ecx, 0x6e
mov word [rbp - 0x19], ax
lea edx, [rcx - 0x6c]
call fcn.180028710
lea ecx, [rdx + 0x31]
mov word [rbp - 0x17], ax
lea edx, [rcx - 0x30]
call fcn.180028710
lea ecx, [rdx + 0x2f]
mov word [rbp - 0x15], ax
lea edx, [rcx - 0x2e]
call fcn.180028710
lea ecx, [rdx + 0x71]
mov word [rbp - 0x13], ax
lea edx, [rcx - 0x70]
call fcn.180028710
mov word [rbp - 0xd], bx
lea ebx, [rcx - 0x6a]
movzx ecx, word [0x18004a7ae]
mov edx, ebx
mov word [rbp - 0x11], ax
mov word [rbp - 0xf], r14w
mov word [rbp - 0xb], si
mov word [rbp - 9], di
mov word [rbp - 7], r15w
call fcn.180028710
movzx ecx, word [0x18004a7b0]
lea edi, [rbx + 1]
mov edx, edi
mov word [rbp - 5], ax
call fcn.180028710
movzx ecx, word [0x18004a7b2]
lea edx, [rbx + 2]
mov word [rbp - 3], ax
call fcn.180028710
movzx ecx, word [0x18004a7b4]
lea edx, [rbx + 3]
mov word [rbp - 1], ax
call fcn.180028710
movzx ecx, word [0x18004a7b6]
lea edx, [rbx + 4]
mov word [rbp + 1], ax
call fcn.180028710
movzx ecx, word [0x18004a7b8]
lea edx, [rbx + 5]
mov word [rbp + 3], ax
call fcn.180028710
movzx ecx, word [0x18004a7ba]
lea edx, [rbx + 6]
mov word [rbp + 5], ax
call fcn.180028710
movzx ecx, word [0x18004a7bc]
lea edx, [rbx + 7]
mov word [rbp + 7], ax
call fcn.180028710
movzx ecx, word [0x18004a7be]
lea edx, [rbx + 8]
mov word [rbp + 9], ax
call fcn.180028710
movzx ecx, word [0x18004a7c0]
lea edx, [rbx + 9]
mov word [rbp + 0xb], ax
call fcn.180028710
mov word [rbp + 0xd], ax
mov edx, r12d
xor eax, eax
mov word [rbp + 0xf], ax
mov r8d, 0x133
movsxd rcx, edx
lea eax, [r8 + rdx]
add edx, r13d
xor word [rbp + rcx*2 - 0x1b], ax
cmp edx, 0x15
jb 0x1800291c8
lea rcx, [rbp - 0x1b]
mov word [rbp + 0xf], r12w
call fcn.18002933c
mov qword [0x180050978], rax
movsxd rdx, dword [rax + 0x3c]
mov eax, dword [rdx + rax + 0x50]
mov dword [0x180050980], eax
mov rax, qword [0x180050950]
test rax, rax
jne 0x1800292fc
xor edx, edx
mov cl, 0x52
call fcn.180001060
mov edx, r13d
mov byte [rbp - 0x29], al
mov cl, 0x74
call fcn.180001060
mov edx, 2
mov byte [rbp - 0x28], al
mov cl, 0x6c
call fcn.180001060
mov edx, 3
mov byte [rbp - 0x27], al
mov cl, 0x43
call fcn.180001060
mov edx, 4
mov byte [rbp - 0x26], al
mov cl, 0x72
call fcn.180001060
mov edx, 5
mov byte [rbp - 0x25], al
mov cl, 0x65
call fcn.180001060
mov edx, 6
mov byte [rbp - 0x24], al
mov cl, 0x61
call fcn.180001060
mov edx, 7
mov byte [rbp - 0x23], al
mov cl, 0x74
call fcn.180001060
mov edx, 8
mov byte [rbp - 0x22], al
mov cl, 0x65
call fcn.180001060
mov edx, 9
mov byte [rbp - 0x21], al
mov cl, 0x48
call fcn.180001060
mov edx, 0xa
mov byte [rbp - 0x20], al
mov cl, 0x65
call fcn.180001060
mov edx, ebx
mov byte [rbp - 0x1f], al
mov cl, 0x61
call fcn.180001060
mov edx, edi
mov byte [rbp - 0x1e], al
mov cl, 0x70
call fcn.180001060
mov byte [rbp - 0x1d], al
mov edx, r12d
xor eax, eax
mov byte [rbp - 0x1c], al
movsxd rcx, edx
lea eax, [rdx + 0x13]
add edx, r13d
xor byte [rbp + rcx - 0x29], al
cmp edx, 0xd
jb 0x1800292cf
mov rcx, qword [0x180050968]
lea rdx, [rbp - 0x29]
mov byte [rbp - 0x1c], r12b
call fcn.18002952c
mov qword [0x180050950], rax
xor edx, edx
mov qword [rsp + 0x28], r12
xor r9d, r9d
mov qword [rsp + 0x20], r12
xor r8d, r8d
lea ecx, [rdx + 2]
call rax
lea r11, [rsp + 0x90]
mov qword [0x1800509c0], rax
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret