Function at 0x180016960
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Encode data using xor
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x260]
sub rsp, 0x360
mov rsi, rcx
mov ebx, 1
test edx, edx
je 0x1800173c8
sub edx, ebx
je 0x1800169b2
sub edx, ebx
je 0x180017348
cmp edx, ebx
je 0x180017348
xor eax, eax
jmp 0x18001734a
xor ecx, ecx
mov qword [0x180039f98], rsi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, qword [0x180039f98]
lea r14, [0x180039fc0]
mov qword [0x180039fa8], rax
mov qword [0x180039f90], r14
call fcn.1800081d0
mov rcx, qword [0x180039fa8]
mov qword [0x180039fa0], rax
call fcn.1800081d0
mov qword [0x180039fb0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x180039ee8], eax
xor r15d, r15d
movabs rax, 0x5b42976365669443
movabs rbx, 0x549a2d1f135dad7a
mov qword [rsp + 0x58], rax
mov r10d, r15d
movabs rax, 0x50d96cde5c339426
mov r11, rbx
mov qword [rsp + 0x60], rax
movabs rax, 0x42d5b2e970765145
mov qword [rsp + 0x68], rax
nop dword [rax + rax]
mov rax, qword [rsp + r10*8 + 0x58]
mov r9d, r10d
neg r9d
mov r8, r11
and r9d, 0xf
rol r8, 3
not r8
rol r11, 1
mov rdx, r8
mov ecx, r9d
neg ecx
and ecx, 0x3f
shl rdx, cl
mov ecx, r9d
shr r8, cl
or rdx, r8
xor rdx, rax
mov qword [rsp + r10*8 + 0x58], rdx
inc r10
cmp r10, 3
jb 0x180016a50
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rsi
mov qword [0x180039f20], rax
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
lea r12, [0x18003a1d0]
mov rcx, r12
call fcn.18000f840
mov r8, rax
mov rdx, r12
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edx, 0xffffffff
mov rcx, r12
call fcn.18000a9b0
mov rdi, rax
lea rdx, [rbp + 0x2a8]
movabs rax, 0x5b2e976b657e9449
movabs r13, 0x5b2e97076512942d
mov qword [rbp + 0x2a8], rax
mov r8, 0xffffffffffffffff
mov rcx, qword [rbp + 0x2a8]
xor rcx, r13
mov qword [rbp + 0x2a8], rcx
mov rcx, rdi
call fcn.18000ae80
test al, al
jne 0x180016b5b
movabs rax, 0x5b2e977165609449
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov r8, 0xffffffffffffffff
mov rax, qword [rsp + 0x20]
mov rcx, rdi
xor rax, r13
mov qword [rsp + 0x20], rax
call fcn.18000ae80
test al, al
jne 0x180016b5b
mov al, 1
jmp 0x180016b5d
xor al, al
mov rcx, r14
mov byte [0x180039ed9], al
call fcn.18000f840
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rdx, [0x180044090]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov edx, 0xffffffff
mov rcx, r12
call fcn.18000aaf0
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rcx, r12
call fcn.18000f840
mov rcx, qword [0x180039fa8]
mov r8d, eax
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea r14, [0x18003a5f0]
mov rdx, r12
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
movabs rax, 0x5b4f97756577946e
mov r10, r15
mov qword [rsp + 0x70], rax
mov r11, rbx
movabs rax, 0x50d96cd65c749427
mov qword [rsp + 0x78], rax
movabs rax, 0x42d5b2e970765129
mov qword [rbp - 0x80], rax
mov rax, qword [rsp + r10*8 + 0x70]
mov r9d, r10d
neg r9d
mov r8, r11
and r9d, 0xf
rol r8, 3
not r8
rol r11, 1
mov rdx, r8
mov ecx, r9d
neg ecx
and ecx, 0x3f
shl rdx, cl
mov ecx, r9d
shr r8, cl
or rdx, r8
xor rdx, rax
mov qword [rsp + r10*8 + 0x70], rdx
inc r10
cmp r10, 3
jb 0x180016c00
lea rdx, [rsp + 0x70]
mov rcx, r12
call fcn.18000ad90
mov byte [0x180039e29], al
mov r10, r15
movabs rax, 0x5b47977d657b9479
mov r11, rbx
mov qword [rsp + 0x38], rax
movabs rax, 0x50b56cba5c73942b
mov qword [rsp + 0x40], rax
nop dword [rax + rax]
mov rax, qword [rsp + r10*8 + 0x38]
mov r9d, r10d
neg r9d
mov r8, r11
and r9d, 0xf
rol r8, 3
not r8
rol r11, 1
mov rdx, r8
mov ecx, r9d
neg ecx
and ecx, 0x3f
shl rdx, cl
mov ecx, r9d
shr r8, cl
or rdx, r8
xor rdx, rax
mov qword [rsp + r10*8 + 0x38], rdx
inc r10
cmp r10, 2
jb 0x180016c80
lea rdx, [rsp + 0x38]
mov rcx, r12
call fcn.18000ad90
mov byte [0x180039e2a], al
mov r10, r15
movabs rax, 0x5b429777657f9464
mov r11, rbx
mov qword [rbp - 0x30], rax
movabs rax, 0x50e56cce5c73942b
mov qword [rbp - 0x28], rax
movabs rax, 0x42bbb28770175145
mov qword [rbp - 0x20], rax
movabs rax, 0xb56cbc2c1b744cc
mov qword [rbp - 0x18], rax
nop word [rax + rax]
mov rax, qword [rbp + r10*8 - 0x30]
mov r9d, r10d
neg r9d
mov r8, r11
and r9d, 0xf
rol r8, 3
not r8
rol r11, 1
mov rdx, r8
mov ecx, r9d
neg ecx
and ecx, 0x3f
shl rdx, cl
mov ecx, r9d
shr r8, cl
or rdx, r8
xor rdx, rax
mov qword [rbp + r10*8 - 0x30], rdx
inc r10
cmp r10, 4
jb 0x180016d20
lea rdx, [rbp - 0x30]
mov rcx, r12
call fcn.18000ad90
mov byte [0x180039e2b], al
mov r10, r15
movabs rax, 0x5b479766657a946e
mov r11, rbx
mov qword [rbp - 0x78], rax
movabs rax, 0x50d16cd35c6e9438
mov qword [rbp - 0x70], rax
movabs rax, 0x42d5b2e97076514c
mov qword [rbp - 0x68], rax
nop word [rax + rax]
mov rax, qword [rbp + r10*8 - 0x78]
mov r9d, r10d
neg r9d
mov r8, r11
and r9d, 0xf
rol r8, 3
not r8
rol r11, 1
mov rdx, r8
mov ecx, r9d
neg ecx
and ecx, 0x3f
shl rdx, cl
mov ecx, r9d
shr r8, cl
or rdx, r8
xor rdx, rax
mov qword [rbp + r10*8 - 0x78], rdx
inc r10
cmp r10, 3
jb 0x180016db0
lea rdx, [rbp - 0x78]
mov rcx, r12
call fcn.18000ad90
mov byte [0x180039e2d], al
mov r10, r15
movabs rax, 0x5b5a97756573947d
mov r11, rbx
mov qword [rbp - 0x10], rax
movabs rax, 0x50f66cd65c7c9423
mov qword [rbp - 8], rax
movabs rax, 0x42a5b2a870325168
mov qword [rbp], rax
movabs rax, 0xb56cba5c1d944d5
mov qword [rbp + 8], rax
nop dword [rax]
nop dword [rax + rax]
mov rax, qword [rbp + r10*8 - 0x10]
mov r9d, r10d
neg r9d
mov r8, r11
and r9d, 0xf
rol r8, 3
not r8
rol r11, 1
mov rdx, r8
mov ecx, r9d
neg ecx
and ecx, 0x3f
shl rdx, cl
mov ecx, r9d
shr r8, cl
or rdx, r8
xor rdx, rax
mov qword [rbp + r10*8 - 0x10], rdx
inc r10
cmp r10, 4
jb 0x180016e50
lea rdx, [rbp - 0x10]
mov rcx, r12
call fcn.18000ad90
mov byte [0x180039e2c], al
mov r10, r15
movabs rax, 0x5b459775657b9477
mov r11, rbx
mov qword [rbp - 0x60], rax
movabs rax, 0x50d46cc05c739425
mov qword [rbp - 0x58], rax
movabs rax, 0x42d5b2e970185141
mov qword [rbp - 0x50], rax
nop word [rax + rax]
mov rax, qword [rbp + r10*8 - 0x60]
mov r9d, r10d
neg r9d
mov r8, r11
and r9d, 0xf
rol r8, 3
not r8
rol r11, 1
mov rdx, r8
mov ecx, r9d
neg ecx
and ecx, 0x3f
shl rdx, cl
mov ecx, r9d
shr r8, cl
or rdx, r8
xor rdx, rax
mov qword [rbp + r10*8 - 0x60], rdx
inc r10
cmp r10, 3
jb 0x180016ee0
lea rdx, [rbp - 0x60]
mov rcx, r12
call fcn.18000ad90
cmp byte [0x180039e2d], r15b
mov byte [0x180039e2e], al
jne 0x180017006
movabs rax, 0x5b4097666571947e
mov r10, r15
mov qword [rbp + 0x10], rax
mov r11, rbx
movabs rax, 0x50f96cc85c789424
mov qword [rbp + 0x18], rax
movabs rax, 0x42b6b28770035148
mov qword [rbp + 0x20], rax
movabs rax, 0xb02cbd7c1bc44cd
mov qword [rbp + 0x28], rax
movabs rax, 0x2d182efb070a12fb
mov qword [rbp + 0x30], rax
movabs rax, 0xb51dba3f1dd54a03
mov qword [rbp + 0x38], rax
movabs rax, 0xd5b2e97076512942
mov qword [rbp + 0x40], rax
nop dword [rax + rax]
mov rax, qword [rbp + r10*8 + 0x10]
mov r9d, r10d
neg r9d
mov r8, r11
and r9d, 0xf
rol r8, 3
not r8
rol r11, 1
mov rdx, r8
mov ecx, r9d
neg ecx
and ecx, 0x3f
shl rdx, cl
mov ecx, r9d
shr r8, cl
or rdx, r8
xor rdx, rax
mov qword [rbp + r10*8 + 0x10], rdx
inc r10
cmp r10, 7
jb 0x180016fb0
lea rdx, [rbp + 0x10]
mov rcx, r12
call fcn.18000ad90
mov byte [0x180039e2d], al
cmp byte [0x180039e29], r15b
mov ecx, 1
movzx eax, byte [0x180039fbf]
cmovne eax, ecx
cmp byte [0x180039ed9], r15b
mov byte [0x180039fbf], al
jne 0x1800171b4
mov rcx, r14
call fcn.18000f6c0
dec eax
mov edx, 0xffffffff
mov rcx, r14
mov word [r14 + rax*2], r15w
call fcn.18000aaf0
mov rdi, rax
cmp word [rax], 0x7b
jne 0x180017077
lea rdx, [0x180044090]
mov byte [0x180039e28], 1
mov rcx, r14
mov byte [0x180039fbf], 1
call qword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x18001711b
movabs rax, 0x5b2e9769657b944f
lea rdx, [rsp + 0x28]
mov qword [rsp + 0x28], rax
mov r8, 0xffffffffffffffff
mov rax, qword [rsp + 0x28]
mov rcx, rdi
xor rax, r13
mov qword [rsp + 0x28], rax
call fcn.18000ae80
test al, al
jne 0x18001710c
movabs rax, 0x5b2e973365249455
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
mov r8, 0xffffffffffffffff
mov rax, qword [rsp + 0x30]
mov rcx, rdi
xor rax, r13
mov qword [rsp + 0x30], rax
call fcn.18000ae80
test al, al
je 0x18001711b
mov rcx, r14
call fcn.18000f6c0
dec eax
mov rcx, r14
mov word [r14 + rax*2], r15w
call fcn.18000f6c0
dec eax
mov rcx, r14
mov word [r14 + rax*2], r15w
call fcn.18000f6c0
dec eax
mov word [r14 + rax*2], r15w
mov rcx, r14
call fcn.18000f6c0
dec eax
mov word [r14 + rax*2], r15w
cmp byte [0x180039fbf], r15b
jne 0x180017133
mov rcx, r14
call fcn.18000f6c0
dec eax
mov word [r14 + rax*2], r15w
mov rcx, r14
call fcn.18000f6c0
movabs rax, 0x5b68974465579403
mov r10, r15
mov qword [rsp + 0x48], rax
mov r11, rbx
movabs rax, 0x50b56cba5c41940d
mov qword [rsp + 0x50], rax
nop
mov rax, qword [rsp + r10*8 + 0x48]
mov r9d, r10d
neg r9d
mov r8, r11
and r9d, 0xf
rol r8, 3
not r8
rol r11, 1
mov rdx, r8
mov ecx, r9d
neg ecx
and ecx, 0x3f
shl rdx, cl
mov ecx, r9d
shr r8, cl
or rdx, r8
xor rdx, rax
mov qword [rsp + r10*8 + 0x48], rdx
inc r10
cmp r10, 2
jb 0x180017160
lea rdx, [rsp + 0x48]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x1800171e3
mov rcx, r12
call fcn.180021570
test al, al
je 0x1800169ab
mov rcx, r14
call fcn.18000f840
mov r8, rax
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rcx, r14
call fcn.18000f6c0
mov rdx, r14
lea rcx, [0x18003a3e0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
movabs rax, 0x5b629772657f9468
mov r10, r15
mov qword [rbp - 0x48], rax
movabs rax, 0x50df6c945c7f9423
mov qword [rbp - 0x40], rax
movabs rax, 0x42d5b2e97018515a
mov qword [rbp - 0x38], rax
mov rax, qword [rbp + r10*8 - 0x48]
mov r9d, r10d
neg r9d
mov r8, rbx
and r9d, 0xf
rol r8, 3
not r8
rol rbx, 1
mov rdx, r8
mov ecx, r9d
neg ecx
and ecx, 0x3f
shl rdx, cl
mov ecx, r9d
shr r8, cl
or rdx, r8
xor rdx, rax
mov qword [rbp + r10*8 - 0x48], rdx
inc r10
cmp r10, 3
jb 0x180017220
lea rdx, [rbp - 0x48]
lea rcx, [0x18003a3e0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rdx, eax
mov rcx, r14
movzx eax, byte [r12 + rdx*2 - 0xa]
sub al, 0x41
add al, byte [0x180039ee8]
mov byte [0x180039edd], al
call fcn.180009730
call fcn.180022b60
test byte [section..bss], 2
je 0x1800172b1
call qword [sym.imp.KERNEL32.dll_AllocConsole]
mov rcx, r12
call fcn.18000f6c0
lea rcx, [rbp + 0x50]
call fcn.18000f840
mov rcx, rax
lea rdx, [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
cmp byte [rcx + 2], r15b
setne byte [0x180039eda]
cmp dword [0x18003a3d8], 1
jbe 0x180017301
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov byte [rcx + 2], r15b
call fcn.18001cef0
test al, al
je 0x1800169ab
mov rax, qword gs:[0x30]
mov rdx, qword [0x180039f98]
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x18]
add rax, 0x10
mov rbx, qword [rax]
cmp rbx, rax
je 0x180017343
mov rcx, qword [rbx]
cmp rdx, qword [rbx + 0x30]
je 0x18001736b
mov rbx, rcx
cmp rcx, rax
jne 0x180017332
mov ebx, 1
mov eax, ebx
lea r11, [rsp + 0x360]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rax, qword [rbx + 8]
xor edx, edx
mov qword [rax], rcx
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
mov rcx, qword [rbx + 0x18]
mov rax, qword [rbx + 0x10]
mov qword [rcx], rax
mov rcx, qword [rbx + 0x10]
mov rax, qword [rbx + 0x18]
mov qword [rcx + 8], rax
mov rcx, qword [rbx + 0x28]
mov rax, qword [rbx + 0x20]
mov qword [rcx], rax
mov rcx, qword [rbx + 0x20]
mov rax, qword [rbx + 0x28]
mov qword [rcx + 8], rax
movzx r8d, word [rbx + 0x48]
mov rcx, qword [rbx + 0x50]
call fcn.180008e20
mov qword [rbx + 0x30], r15
mov qword [rbx + 0x38], r15
jmp 0x180017343
mov rcx, qword [0x180039ef8]
mov byte [0x180039ef4], 0
call qword [sym.imp.WS2_32.dll_closesocket]
jmp 0x180017348