Function at 0x180017a3c
Capabilities:
Access peb ldr_data
Encode data using xor
Parse pe header
Resolve function by hash
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x68
xor ebx, ebx
mov r8d, ebx
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0xc0], ebx
call fcn.18001802c
lea ebp, [rbx + 1]
mov r14, rax
mov eax, 0x5a4d
cmp word [r14], ax
jne 0x180017a93
movsxd rax, dword [r14 + 0x3c]
lea rcx, [rax - 0x40]
cmp rcx, 0x3bf
ja 0x180017a93
cmp dword [rax + r14], 0x4550
je 0x180017a98
sub r14, rbp
jmp 0x180017a6d
mov rax, qword gs:[0x60]
mov qword [rsp + 0xb8], r14
mov r12d, 0xffff
mov rdi, qword [rax + 0x18]
mov rdx, qword [rdi + 0x20]
jmp 0x180017af1
mov rsi, qword [rdx + 0x50]
movzx r8d, word [rdx + 0x48]
mov rcx, rbx
ror ecx, 0xd
cmp byte [rsi], 0x61
jb 0x180017ad7
movzx eax, byte [rsi]
sub eax, 0x20
cdqe
jmp 0x180017ada
movzx eax, byte [rsi]
add rcx, rax
add rsi, rbp
add r8w, r12w
jne 0x180017ac5
cmp ecx, 0x6a4abc5b
je 0x180017af8
mov rdx, qword [rdx]
test rdx, rdx
jne 0x180017ab9
jmp 0x180017afc
mov rdi, qword [rdx + 0x20]
movsxd rax, dword [rdi + 0x3c]
mov r13, qword [rsp + 0xb8]
mov r15, qword [rsp + 0xb8]
mov r11d, dword [rax + rdi + 0x88]
mov r9, qword [rsp + 0xb8]
mov r10d, 6
mov esi, dword [r11 + rdi + 0x20]
mov r8d, dword [r11 + rdi + 0x24]
lea r14d, [r10 - 4]
add rsi, rdi
add r8, rdi
mov edx, dword [rsi]
mov ecx, ebx
add rdx, rdi
mov al, byte [rdx]
ror ecx, 0xd
movsx eax, al
add rdx, rbp
add ecx, eax
mov al, byte [rdx]
test al, al
jne 0x180017b43
cmp ecx, 0xec0e4e8e
je 0x180017b88
cmp ecx, 0x7c0dfcaa
je 0x180017b88
cmp ecx, 0x91afca54
je 0x180017b88
cmp ecx, 0x7946c61b
je 0x180017b88
cmp ecx, 0x753a4fc
je 0x180017b88
cmp ecx, 0xd3324904
jne 0x180017c0f
mov eax, dword [r11 + rdi + 0x1c]
movzx edx, word [r8]
add rax, rdi
cmp ecx, 0xec0e4e8e
jne 0x180017ba9
mov eax, dword [rax + rdx*4]
add rax, rdi
mov qword [rsp + 0x50], rax
jmp 0x180017c0b
cmp ecx, 0x7c0dfcaa
jne 0x180017bc5
mov r14d, dword [rax + rdx*4]
add r14, rdi
mov qword [rsp + 0x28], r14
mov r14d, 2
jmp 0x180017c0b
cmp ecx, 0x91afca54
jne 0x180017bd6
mov r13d, dword [rax + rdx*4]
add r13, rdi
jmp 0x180017c0b
cmp ecx, 0x7946c61b
jne 0x180017beb
mov eax, dword [rax + rdx*4]
add rax, rdi
mov qword [rsp + 0x48], rax
jmp 0x180017c0b
cmp ecx, 0x753a4fc
jne 0x180017bfc
mov r15d, dword [rax + rdx*4]
add r15, rdi
jmp 0x180017c0b
cmp ecx, 0xd3324904
jne 0x180017c0b
mov r9d, dword [rax + rdx*4]
add r9, rdi
add r10w, r12w
add rsi, 4
add r8, r14
test r10w, r10w
jne 0x180017b3a
mov r14, qword [rsp + 0xb8]
mov ecx, 0x8000
movsxd rbp, dword [r14 + 0x3c]
add rbp, r14
mov qword [rsp + 0x58], rbp
movzx eax, word [rbp + 0x16]
and ax, cx
neg ax
mov eax, 0x4000
sbb r12d, r12d
and r12d, 0x3c
add r12d, 4
mov dword [rsp + 0x20], r12d
test word [rbp + 0x16], ax
je 0x180017cfb
lea rcx, [r14 + 0x40]
call r9
test rax, rax
jne 0x180017cfb
lea r8d, [rax + 1]
lea rcx, [r14 + 0x40]
xor edx, edx
call r15
mov edi, 1
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x180017cfb
mov r15, qword [rsp + 0x28]
cmp rdi, 0x10
jae 0x180017cae
test rbx, rbx
jne 0x180017cb3
mov rdx, rdi
mov rcx, rsi
call r15
inc rdi
mov rbx, rax
jmp 0x180017c92
test rbx, rbx
je 0x180017cfb
mov edx, dword [rbp + 0x50]
mov rsi, qword [rsp + 0x48]
mov rax, rbx
and eax, 0xfff
lea r9, [rsp + 0xc8]
mov r8d, r12d
sub rbx, rax
mov rcx, rbx
call rsi
mov ecx, dword [rbp + 0x50]
xor eax, eax
mov rdi, rbx
lea r9, [rsp + 0xc8]
mov r8d, r12d
rep stosb byte [rdi], al
mov edx, dword [rbp + 0x50]
mov rcx, rbx
call rsi
xor r11d, r11d
test rbx, rbx
jne 0x180017d1c
mov edx, dword [rbp + 0x50]
mov r9d, r12d
xor ecx, ecx
mov r8d, 0x3000
call r13
mov ecx, dword [rbp + 0x50]
mov rdi, rax
mov rbx, rax
xor eax, eax
rep stosb byte [rdi], al
xor r11d, r11d
mov r8b, byte [rbp + 0x10]
mov r10d, dword [rbp + 0x50]
mov r13d, 1
add r10, 0xffffffffffffffc0
mov byte [rsp + 0xb8], r8b
add r10, rbx
mov qword [rsp + 0x38], r10
test r8b, r8b
je 0x180017d4b
mov eax, dword [rbp + 0x38]
sub rbx, rax
jmp 0x180017d6c
mov ecx, dword [rbp + 0x54]
mov rdi, rbx
mov rsi, r14
rep movsb byte [rdi], byte [rsi]
test byte [rbp + 0x16], r13b
je 0x180017d6c
movsxd rax, dword [rbx + 0x3c]
mov dword [rax + rbx], r11d
mov word [rbx], r11w
mov dword [rbx + 0x3c], r11d
movzx edx, word [rbp + 6]
movzx eax, word [rbp + 0x14]
test rdx, rdx
je 0x180017dc2
add rax, 0x28
add rax, rbp
mov r8d, dword [rax - 4]
mov r9d, dword [rax]
mov esi, dword [rax + 4]
add r8, rbx
add rsi, r14
mov ecx, r9d
mov rdi, r8
sub rdx, r13
rep movsb byte [rdi], byte [rsi]
test dword [rax + 0x14], 0x20000000
je 0x180017db1
mov qword [rsp + 0x40], r8
mov dword [rsp + 0xc0], r9d
add rax, 0x28
test rdx, rdx
jne 0x180017d80
mov r8b, byte [rsp + 0xb8]
mov r15d, dword [rbp + 0x90]
add r15, rbx
mov qword [rsp + 0x30], r15
mov eax, dword [r15 + 0xc]
test eax, eax
je 0x180017ef5
mov rbp, r10
jmp 0x180017de8
mov r13d, 1
mov esi, eax
mov rdi, rbp
mov ecx, 0x40
add rsi, rbx
mov rax, rbp
rep movsb byte [rdi], byte [rsi]
mov ecx, 0x40
xor byte [rax], r8b
add rax, r13
sub rcx, r13
jne 0x180017dff
mov rcx, rbp
call qword [rsp + 0x50]
mov r14d, dword [r15 + 0x10]
mov r12d, dword [r15]
add r14, rbx
xor r11d, r11d
add r12, rbx
mov r13, rax
cmp qword [r14], r11
je 0x180017ec9
mov r15, qword [rsp + 0x28]
test r12, r12
je 0x180017e70
movabs rax, 0x8000000000000000
test qword [r12], rax
je 0x180017e70
movsxd rax, dword [r13 + 0x3c]
movzx edx, word [r12]
mov ecx, dword [rax + r13 + 0x88]
mov eax, dword [rcx + r13 + 0x10]
mov ecx, dword [rcx + r13 + 0x1c]
add rcx, r13
sub rdx, rax
mov eax, dword [rcx + rdx*4]
add rax, r13
jmp 0x180017eab
mov rsi, qword [r14]
mov edx, 0x40
mov rdi, rbp
add rsi, 2
mov ecx, edx
mov rax, rbp
add rsi, rbx
rep movsb byte [rdi], byte [rsi]
mov ecx, edx
mov dl, byte [rsp + 0xb8]
lea edi, [rcx - 0x3f]
xor byte [rax], dl
add rax, rdi
sub rcx, rdi
jne 0x180017e95
mov rdx, rbp
mov rcx, r13
call r15
xor r11d, r11d
mov qword [r14], rax
add r14, 8
test r12, r12
je 0x180017ebb
add r12, 8
cmp qword [r14], r11
jne 0x180017e32
mov r15, qword [rsp + 0x30]
mov eax, dword [r15 + 0x20]
mov r8b, byte [rsp + 0xb8]
add r15, 0x14
mov qword [rsp + 0x30], r15
test eax, eax
jne 0x180017de2
mov rbp, qword [rsp + 0x58]
mov r10, qword [rsp + 0x38]
mov r12d, dword [rsp + 0x20]
xor eax, eax
mov rdi, r10
mov r8, rbx
lea ecx, [rax + 0x40]
rep stosb byte [rdi], al
sub r8, qword [rbp + 0x30]
cmp dword [rbp + 0xb4], r11d
je 0x180017fbc
mov edi, dword [rbp + 0xb0]
add rdi, rbx
mov eax, dword [rdi + 4]
test eax, eax
je 0x180017fbc
mov r14d, 2
mov edx, dword [rdi]
mov esi, eax
lea r9, [rdi + 8]
sub rsi, 8
add rdx, rbx
shr rsi, 1
je 0x180017fab
mov r10d, 1
movzx ecx, word [r9]
sub rsi, r10
movzx eax, cx
shr ax, 0xc
cmp ax, 0xa
jne 0x180017f67
and ecx, 0xfff
add qword [rcx + rdx], r8
jmp 0x180017fa3
cmp ax, 3
jne 0x180017f79
and ecx, 0xfff
add dword [rcx + rdx], r8d
jmp 0x180017fa3
cmp ax, r10w
jne 0x180017f92
mov rax, r8
and ecx, 0xfff
shr rax, 0x10
add word [rcx + rdx], ax
jmp 0x180017fa3
cmp ax, r14w
jne 0x180017fa3
and ecx, 0xfff
add word [rcx + rdx], r8w
add r9, r14
test rsi, rsi
jne 0x180017f47
mov eax, dword [rdi + 4]
add rdi, rax
mov eax, dword [rdi + 4]
test eax, eax
jne 0x180017f2d
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x180017fed
mov ecx, dword [rsp + 0xc0]
test ecx, ecx
je 0x180017fed
cmp r12d, 4
jne 0x180017fed
mov edx, ecx
lea r9, [rsp + 0xc8]
lea r8d, [r12 + 0x1c]
mov rcx, rax
call qword [rsp + 0x48]
mov eax, 0x1000
test word [rbp + 0x16], ax
je 0x180018000
mov edi, dword [rbp + 0x80]
jmp 0x180018003
mov edi, dword [rbp + 0x28]
mov r8, qword [rsp + 0xb0]
add rdi, rbx
mov edx, 1
mov rcx, rbx
call rdi
mov rax, rdi
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret