Function at 0x4176f0
Capabilities:
Access peb ldr_data
Encrypt data using rc4 prga
Get ntdll base address
Populate syswhispers2 syscall list
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x18
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov r8, qword [rax + 0x10]
mov rcx, qword [r8 + 0x30]
test rcx, rcx
je 0x4179b9
xor r10d, r10d
mov rdx, rcx
movsxd rcx, dword [rcx + 0x3c]
mov eax, dword [rdx + rcx + 0x88]
test eax, eax
je 0x417760
lea r10, [rdx + rax]
mov ecx, dword [r10 + 0xc]
add rcx, rdx
mov r9d, dword [rcx]
or r9d, 0x20202020
cmp r9d, 0x6c64746e
jne 0x417760
mov eax, dword [rcx + 4]
or eax, 0x20202020
cmp eax, 0x6c642e6c
je 0x417775
mov r8, qword [r8]
mov rcx, qword [r8 + 0x30]
test rcx, rcx
jne 0x417721
test r10, r10
je 0x4179b9
mov eax, dword [r10 + 0x18]
lea r12, [0x004220a8]
xor r9d, r9d
mov ebx, dword [r10 + 0x24]
lea rdi, [rdx + 0x12]
mov esi, dword [r10 + 0x1c]
lea ecx, [rax - 1]
mov eax, dword [r10 + 0x20]
add rbx, rdx
lea r8, [rbx + rcx*2]
add rsi, rdx
add rax, rdx
lea r10, [rax + rcx*4]
jmp 0x4177c4
lea rax, [r8 - 2]
sub r10, 4
cmp rbx, r8
je 0x4178e1
mov r8, rax
mov eax, dword [r10]
add rax, rdx
cmp word [rax], 0x775a
jne 0x4177b0
mov r11d, r9d
shl r11, 4
add r11, r12
cmp byte [rax], 0
je 0x4179ae
cmp byte [rax + 1], 0
mov r13d, 0xc55c2dca
je 0x41781e
mov ecx, 1
mov r14d, 1
nop dword [rax + rax]
movzx ecx, word [rax + rcx]
mov r15d, r13d
add r14d, 1
ror r15d, 8
add ecx, r15d
xor r13d, ecx
mov ecx, r14d
cmp byte [rax + rcx], 0
jne 0x417800
mov dword [r11], r13d
movzx eax, word [r8]
lea r13, [rsp + 0xd]
mov byte [rsp + 0xf], 0xc3
mov r14d, dword [rsi + rax*4]
mov eax, 0x50f
mov word [rsp + 0xd], ax
mov dword [r11 + 4], r14d
add r14, rdi
cmp word [r14], 0x50f
mov rcx, r14
je 0x4178d0
lea rax, [r14 + 0x20]
lea r15, [r14 + 0x4000]
add r14, r14
jmp 0x41787c
mov rcx, r14
sub rcx, rax
movzx ebp, word [rcx]
cmp word [r13], bp
je 0x4178b4
add rax, 0x20
cmp r15, rax
je 0x4178c7
movzx ebp, word [rax]
mov rcx, rax
cmp word [r13], bp
jne 0x417863
movzx ebp, byte [rax + 2]
cmp byte [r13 + 2], bpl
jne 0x417863
add r9d, 1
mov qword [r11 + 8], rcx
cmp r9d, 0x1f4
jne 0x4177b0
mov dword [0x004220a0], 0x1f4
jmp 0x4178f2
movzx ebp, byte [rcx + 2]
cmp byte [r13 + 2], bpl
je 0x417893
add rax, 0x20
cmp r15, rax
jne 0x41787c
xor ecx, ecx
jmp 0x417893
movzx eax, byte [r14 + 2]
cmp byte [rsp + 0xf], al
jne 0x417853
jmp 0x417893
cmp r9d, 1
mov dword [0x004220a0], r9d
je 0x417972
lea r10, [0x004220a8]
xor r11d, r11d
sub r9d, 1
xor ecx, ecx
xor r8d, r8d
cmp r11d, r9d
je 0x417969
nop word [rax + rax]
mov rdx, r8
lea r8d, [rcx + 1]
shl rdx, 4
mov rax, r8
add rdx, r10
mov rcx, r8
shl rax, 4
add rax, r10
mov edi, dword [rax + 4]
cmp dword [rdx + 4], edi
jbe 0x417990
mov esi, dword [rax]
mov rbx, qword [rdx]
mov r9, qword [rdx + 8]
mov dword [rdx], esi
mov esi, dword [rax + 4]
mov dword [rdx + 4], esi
mov rdi, qword [rax + 8]
mov qword [rdx + 8], rdi
mov qword [rax], rbx
mov qword [rax + 8], r9
mov r9d, dword [0x004220a0]
sub r9d, 1
mov eax, r9d
sub eax, r11d
cmp eax, r8d
ja 0x417910
add r11d, 1
cmp r11d, r9d
jb 0x417900
mov eax, 1
add rsp, 0x18
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov eax, r9d
sub eax, r11d
cmp r8d, eax
jb 0x417910
add r11d, 1
cmp r11d, r9d
jb 0x417900
jmp 0x417972
mov r13d, 0x2f73c6ea
jmp 0x41781e
xor eax, eax
jmp 0x417977