Function at 0x4177b0
Capabilities:
Access peb ldr_data
Encrypt data using rc4 prga
Get ntdll base address
Populate syswhispers2 syscall list
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x18
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov r8, qword [rax + 0x10]
mov rcx, qword [r8 + 0x30]
test rcx, rcx
je 0x417a79
xor r10d, r10d
mov rdx, rcx
movsxd rcx, dword [rcx + 0x3c]
mov eax, dword [rdx + rcx + 0x88]
test eax, eax
je 0x417820
lea r10, [rdx + rax]
mov ecx, dword [r10 + 0xc]
add rcx, rdx
mov r9d, dword [rcx]
or r9d, 0x20202020
cmp r9d, 0x6c64746e
jne 0x417820
mov eax, dword [rcx + 4]
or eax, 0x20202020
cmp eax, 0x6c642e6c
je 0x417835
mov r8, qword [r8]
mov rcx, qword [r8 + 0x30]
test rcx, rcx
jne 0x4177e1
test r10, r10
je 0x417a79
mov eax, dword [r10 + 0x18]
lea r12, [0x004220a8]
xor r9d, r9d
mov ebx, dword [r10 + 0x24]
lea rdi, [rdx + 0x12]
mov esi, dword [r10 + 0x1c]
lea ecx, [rax - 1]
mov eax, dword [r10 + 0x20]
add rbx, rdx
lea r8, [rbx + rcx*2]
add rsi, rdx
add rax, rdx
lea r10, [rax + rcx*4]
jmp 0x417884
lea rax, [r8 - 2]
sub r10, 4
cmp rbx, r8
je 0x4179a1
mov r8, rax
mov eax, dword [r10]
add rax, rdx
cmp word [rax], 0x775a
jne 0x417870
mov r11d, r9d
shl r11, 4
add r11, r12
cmp byte [rax], 0
je 0x417a6e
cmp byte [rax + 1], 0
mov r13d, 0xc55c2dca
je 0x4178de
mov ecx, 1
mov r14d, 1
nop dword [rax + rax]
movzx ecx, word [rax + rcx]
mov r15d, r13d
add r14d, 1
ror r15d, 8
add ecx, r15d
xor r13d, ecx
mov ecx, r14d
cmp byte [rax + rcx], 0
jne 0x4178c0
mov dword [r11], r13d
movzx eax, word [r8]
lea r13, [rsp + 0xd]
mov byte [rsp + 0xf], 0xc3
mov r14d, dword [rsi + rax*4]
mov eax, 0x50f
mov word [rsp + 0xd], ax
mov dword [r11 + 4], r14d
add r14, rdi
cmp word [r14], 0x50f
mov rcx, r14
je 0x417990
lea rax, [r14 + 0x20]
lea r15, [r14 + 0x4000]
add r14, r14
jmp 0x41793c
mov rcx, r14
sub rcx, rax
movzx ebp, word [rcx]
cmp word [r13], bp
je 0x417974
add rax, 0x20
cmp r15, rax
je 0x417987
movzx ebp, word [rax]
mov rcx, rax
cmp word [r13], bp
jne 0x417923
movzx ebp, byte [rax + 2]
cmp byte [r13 + 2], bpl
jne 0x417923
add r9d, 1
mov qword [r11 + 8], rcx
cmp r9d, 0x1f4
jne 0x417870
mov dword [0x004220a0], 0x1f4
jmp 0x4179b2
movzx ebp, byte [rcx + 2]
cmp byte [r13 + 2], bpl
je 0x417953
add rax, 0x20
cmp r15, rax
jne 0x41793c
xor ecx, ecx
jmp 0x417953
movzx eax, byte [r14 + 2]
cmp byte [rsp + 0xf], al
jne 0x417913
jmp 0x417953
cmp r9d, 1
mov dword [0x004220a0], r9d
je 0x417a32
lea r10, [0x004220a8]
xor r11d, r11d
sub r9d, 1
xor ecx, ecx
xor r8d, r8d
cmp r11d, r9d
je 0x417a29
nop word [rax + rax]
mov rdx, r8
lea r8d, [rcx + 1]
shl rdx, 4
mov rax, r8
add rdx, r10
mov rcx, r8
shl rax, 4
add rax, r10
mov edi, dword [rax + 4]
cmp dword [rdx + 4], edi
jbe 0x417a50
mov esi, dword [rax]
mov rbx, qword [rdx]
mov r9, qword [rdx + 8]
mov dword [rdx], esi
mov esi, dword [rax + 4]
mov dword [rdx + 4], esi
mov rdi, qword [rax + 8]
mov qword [rdx + 8], rdi
mov qword [rax], rbx
mov qword [rax + 8], r9
mov r9d, dword [0x004220a0]
sub r9d, 1
mov eax, r9d
sub eax, r11d
cmp eax, r8d
ja 0x4179d0
add r11d, 1
cmp r11d, r9d
jb 0x4179c0
mov eax, 1
add rsp, 0x18
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov eax, r9d
sub eax, r11d
cmp r8d, eax
jb 0x4179d0
add r11d, 1
cmp r11d, r9d
jb 0x4179c0
jmp 0x417a32
mov r13d, 0x2f73c6ea
jmp 0x4178de
xor eax, eax
jmp 0x417a37