Function at 0x180005d5c
Capabilities:
Access peb ldr_data
Encode data using xor
Parse pe header
Resolve function by hash
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x58
xor r13d, r13d
mov r15d, r13d
mov qword [rsp + 0x28], r13
mov r12d, r13d
mov qword [rsp + 0x20], r13
mov r10d, r13d
mov r14d, r13d
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x40], r13
mov dword [rsp + 0xb0], r13d
call fcn.180005d54
lea r8d, [r13 + 1]
mov rbx, rax
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x180005dcc
movsxd rax, dword [rbx + 0x3c]
lea rcx, [rax - 0x40]
cmp rcx, 0x3bf
ja 0x180005dcc
cmp dword [rax + rbx], 0x4550
je 0x180005dd1
sub rbx, r8
jmp 0x180005da8
cmp dword [rbx + 0x3f8], 0xf00d
mov qword [rsp + 0xa8], rbx
mov r11d, 4
jne 0x180005e1b
mov rax, qword [rbx + 0x3e0]
mov r15, qword [rbx + 0x3d8]
mov r10, qword [rbx + 0x3e8]
mov qword [rsp + 0x20], rax
mov rax, qword [rbx + 0x3f0]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x30], rax
jmp 0x180005f7a
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rsi, qword [rcx + 0x20]
test rsi, rsi
je 0x180005f7a
mov r9d, 0xffff
mov rdx, qword [rsi + 0x50]
movzx edi, word [rsi + 0x48]
mov rcx, r13
ror ecx, 0xd
cmp byte [rdx], 0x61
jb 0x180005e58
movzx eax, byte [rdx]
sub eax, 0x20
cdqe
jmp 0x180005e5b
movzx eax, byte [rdx]
add rcx, rax
add rdx, r8
add di, r9w
jne 0x180005e46
cmp ecx, 0x6a4abc5b
jne 0x180005f52
mov rdx, qword [rsi + 0x20]
mov ebx, 0xffff
movsxd rax, dword [rdx + 0x3c]
mov ebp, dword [rax + rdx + 0x88]
mov r8d, dword [rbp + rdx + 0x20]
mov r9d, dword [rbp + rdx + 0x24]
add r8, rdx
add r9, rdx
mov edi, dword [r8]
mov ecx, r13d
add rdi, rdx
mov al, byte [rdi]
ror ecx, 0xd
movsx eax, al
inc rdi
add ecx, eax
mov al, byte [rdi]
test al, al
jne 0x180005ea2
cmp ecx, 0xec0e4e8e
je 0x180005ed3
cmp ecx, 0x7c0dfcaa
je 0x180005ed3
cmp ecx, 0x91afca54
je 0x180005ed3
cmp ecx, 0x7946c61b
jne 0x180005f24
mov eax, dword [rbp + rdx + 0x1c]
movzx edi, word [r9]
add rax, rdx
cmp ecx, 0xec0e4e8e
jne 0x180005eef
mov r15d, dword [rax + rdi*4]
add r15, rdx
jmp 0x180005f20
cmp ecx, 0x7c0dfcaa
jne 0x180005f00
mov r12d, dword [rax + rdi*4]
add r12, rdx
jmp 0x180005f20
cmp ecx, 0x91afca54
jne 0x180005f11
mov r10d, dword [rax + rdi*4]
add r10, rdx
jmp 0x180005f20
cmp ecx, 0x7946c61b
jne 0x180005f20
mov r14d, dword [rax + rdi*4]
add r14, rdx
add r11w, bx
add r8, 4
add r9, 2
test r11w, r11w
jne 0x180005e97
mov r8d, 1
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x28], r15
mov r9d, ebx
lea r11d, [r8 + 3]
test r15, r15
je 0x180005f66
test r12, r12
je 0x180005f66
test r10, r10
je 0x180005f66
test r14, r14
jne 0x180005f72
mov rsi, qword [rsi]
test rsi, rsi
jne 0x180005e3b
mov rbx, qword [rsp + 0xa8]
movsxd r14, dword [rbx + 0x3c]
mov edi, 0x800
mov r8d, 0x3000
add r14, rbx
movzx eax, word [r14 + 0x16]
mov edx, dword [r14 + 0x50]
and ax, di
neg ax
sbb r13d, r13d
xor ecx, ecx
and r13d, 0xffffffc4
add r13d, 0x40
mov r9d, r13d
mov dword [rsp + 0xa8], r13d
call r10
mov rbp, rax
test word [r14 + 0x16], di
je 0x180005fc9
mov ecx, dword [r14 + 0x38]
sub rbp, rcx
jmp 0x180005fd5
mov ecx, dword [r14 + 0x54]
mov rdi, rax
mov rsi, rbx
rep movsb byte [rdi], byte [rsi]
movzx r8d, word [r14 + 6]
movzx eax, word [r14 + 0x14]
test r8, r8
je 0x180006037
lea rcx, [r14 + 0x2c]
mov r9d, 1
add rcx, rax
mov edx, dword [rcx - 8]
mov esi, dword [rcx]
mov edi, dword [rcx - 4]
add rdx, rbp
add rsi, rbx
sub r8, r9
test dword [rcx + 0x10], 0x20000000
je 0x180006017
mov qword [rsp + 0x40], rdx
mov dword [rsp + 0xb0], edi
test rdi, rdi
je 0x18000602e
mov al, byte [rcx + 0xc]
xor al, byte [rsi]
add rsi, r9
mov byte [rdx], al
add rdx, r9
sub rdi, r9
jne 0x18000601c
add rcx, 0x28
test r8, r8
jne 0x180005ff1
mov edi, dword [r14 + 0x90]
add rdi, rbp
mov qword [rsp + 0x38], rdi
mov eax, dword [rdi + 0xc]
test eax, eax
je 0x18000613b
mov r13, qword [rsp + 0x20]
mov ecx, eax
add rcx, rbp
call r15
mov r12, rax
mov eax, 0x800
test word [r14 + 0x16], ax
je 0x180006080
mov ecx, dword [rdi + 0xc]
add rcx, rbp
jmp 0x18000607b
mov byte [rcx], 0
inc rcx
cmp byte [rcx], 0
jne 0x180006075
mov esi, dword [rdi + 0x10]
mov ebx, dword [rdi]
add rsi, rbp
add rbx, rbp
cmp qword [rsi], 0
je 0x18000611f
mov edi, eax
test rbx, rbx
je 0x1800060d6
movabs rax, 0x8000000000000000
test qword [rbx], rax
je 0x1800060d6
movsxd rax, dword [r12 + 0x3c]
movzx edx, word [rbx]
mov ecx, dword [rax + r12 + 0x88]
mov eax, dword [rcx + r12 + 0x10]
mov ecx, dword [rcx + r12 + 0x1c]
add rcx, r12
sub rdx, rax
mov eax, dword [rcx + rdx*4]
add rax, r12
mov qword [rsi], rax
jmp 0x180006102
mov r15, qword [rsi]
mov rcx, r12
add r15, 2
add r15, rbp
mov rdx, r15
call r13
mov qword [rsi], rax
test word [r14 + 0x16], di
je 0x180006102
jmp 0x1800060fc
mov byte [r15], 0
inc r15
cmp byte [r15], 0
jne 0x1800060f5
add rsi, 8
test rbx, rbx
je 0x18000610f
add rbx, 8
cmp qword [rsi], 0
jne 0x180006097
mov rdi, qword [rsp + 0x38]
mov r15, qword [rsp + 0x28]
mov eax, dword [rdi + 0x20]
add rdi, 0x14
mov qword [rsp + 0x38], rdi
test eax, eax
jne 0x180006056
mov r13d, dword [rsp + 0xa8]
mov rsi, rbp
sub rsi, qword [r14 + 0x30]
cmp dword [r14 + 0xb4], 0
je 0x1800061f7
mov edi, dword [r14 + 0xb0]
add rdi, rbp
mov eax, dword [rdi + 4]
test eax, eax
je 0x1800061f7
mov r10d, 0xfff
mov r13d, 2
mov edx, dword [rdi]
mov r8d, eax
lea r9, [rdi + 8]
sub r8, 8
add rdx, rbp
shr r8, 1
je 0x1800061e2
mov r11d, 1
movzx ecx, word [r9]
sub r8, r11
movzx eax, cx
shr ax, 0xc
cmp ax, 0xa
jne 0x1800061a9
and rcx, r10
add qword [rcx + rdx], rsi
jmp 0x1800061da
cmp ax, 3
jne 0x1800061b7
and rcx, r10
add dword [rcx + rdx], esi
jmp 0x1800061da
cmp ax, r11w
jne 0x1800061cd
mov rax, rsi
and rcx, r10
shr rax, 0x10
add word [rcx + rdx], ax
jmp 0x1800061da
cmp ax, r13w
jne 0x1800061da
and rcx, r10
add word [rcx + rdx], si
add r9, r13
test r8, r8
jne 0x18000618c
mov eax, dword [rdi + 4]
add rdi, rax
mov eax, dword [rdi + 4]
test eax, eax
jne 0x180006171
mov r13d, dword [rsp + 0xa8]
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x180006227
mov ecx, dword [rsp + 0xb0]
test ecx, ecx
je 0x180006227
cmp r13d, 4
jne 0x180006227
mov edx, ecx
lea r9, [rsp + 0xb8]
lea r8d, [r13 + 0x1c]
mov rcx, rax
call qword [rsp + 0x30]
mov edi, dword [r14 + 0x28]
mov r8, qword [rsp + 0xa0]
mov edx, 1
add rdi, rbp
mov rcx, rbp
call rdi
mov rax, rdi
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret