Function at 0x1800e9330
Capabilities:
Access peb ldr_data
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov byte [rsp + 0x18], r8b
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xc8
mov ebx, edx
mov r15, rcx
test rcx, rcx
je 0x1800e9872
movsxd r9, dword [rcx + 0x3c]
add r9, rcx
mov qword [rsp + 0x28], r9
cmp dword [r9 + 0x1c], 0
je 0x1800e9872
mov eax, dword [r9 + 0x88]
test eax, eax
je 0x1800e9872
cmp dword [r9 + 0x8c], 0
je 0x1800e9872
lea rdi, [rcx + rax]
mov qword [rbp - 0x49], rdi
mov r10d, dword [rdi + 0x1c]
add r10, rcx
mov qword [rbp - 0x79], r10
mov r8d, dword [rdi + 0x20]
add r8, rcx
mov qword [rbp + 7], r8
mov r11d, dword [rdi + 0x24]
add r11, rcx
mov qword [rbp - 0x71], r11
xor eax, eax
mov dword [rsp + 0x20], eax
cmp dword [rdi + 0x18], eax
jbe 0x1800e9872
xor ecx, ecx
mov qword [rbp - 1], rcx
xor edx, edx
mov qword [rbp - 9], rdx
movabs rsi, 0x1f2612ab48b276e
lea r14, [rax - 1]
movabs r12, 0x63c1d737d517c7df
nop dword [rax]
nop dword [rax + rax]
movzx eax, word [rdx + r11]
mov edx, dword [r10 + rax*4]
add rdx, r15
mov ecx, dword [r8 + rcx]
add rcx, r15
mov r8d, 0x84222325
movzx eax, byte [rcx]
test al, al
je 0x1800e9438
movsx eax, al
xor eax, r8d
imul r8d, eax, 0x1b3
lea rcx, [rcx + 1]
movzx eax, byte [rcx]
test al, al
jne 0x1800e9420
cmp ebx, r8d
jne 0x1800e961d
cmp rdx, rdi
jbe 0x1800e9459
mov eax, dword [r9 + 0x8c]
add rax, rdi
cmp rdx, rax
jae 0x1800e9459
mov al, 1
jmp 0x1800e945b
xor al, al
test al, al
je 0x1800e9859
mov qword [rbp - 0x69], 0
mov qword [rbp - 0x59], 0
mov qword [rbp - 0x51], 0xf
mov byte [rbp - 0x69], 0
mov r8, r14
inc r8
cmp byte [rdx + r8], 0
jne 0x1800e9482
lea rcx, [rbp - 0x69]
call fcn.18005d8e0
nop
mov r13, qword [rbp - 0x59]
test r13, r13
jne 0x1800e94e3
mov rdx, qword [rbp - 0x51]
cmp rdx, 0x10
jb 0x1800e9610
inc rdx
mov rcx, qword [rbp - 0x69]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800e94d9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800e9888
call fcn.1800e6850
jmp 0x1800e9610
mov qword [rbp - 0x39], r12
mov qword [rbp - 0x31], rsi
movabs rax, 0x63c1d737d517c7f1
mov qword [rbp - 0x29], rax
mov qword [rbp - 0x21], rsi
movdqa xmm0, xmmword [rbp - 0x39]
pxor xmm0, xmmword [rbp - 0x29]
movdqa xmmword [rbp - 0x39], xmm0
lea rax, [rbp - 0x39]
mov rbx, r14
inc rbx
cmp byte [rax + rbx], 0
jne 0x1800e9513
lea r12, [rbp - 0x69]
mov rax, qword [rbp - 0x51]
cmp rax, 0x10
setae byte [rbp + 0x7f]
mov rsi, qword [rbp - 0x69]
cmovae r12, rsi
cmp rbx, r13
ja 0x1800e95c2
mov rax, r13
sub rax, rbx
test rbx, rbx
je 0x1800e9651
lea r14, [rax + r12]
movsx r15d, byte [rbp - 0x39]
lea r8, [r14 + 1]
sub r8, r12
mov edx, r15d
mov rcx, r12
call fcn.1800e8c60
mov rdi, rax
test rax, rax
je 0x1800e95af
nop
mov r8, rbx
lea rdx, [rbp - 0x39]
mov rcx, rdi
call fcn.1800e8c90
test eax, eax
je 0x1800e95a2
inc rdi
lea r8, [r14 + 1]
sub r8, rdi
mov edx, r15d
mov rcx, rdi
call fcn.1800e8c60
mov rdi, rax
test rax, rax
jne 0x1800e9570
jmp 0x1800e95af
sub rdi, r12
cmp rdi, 0xffffffffffffffff
jne 0x1800e9655
mov rax, qword [rbp - 0x51]
mov r14, 0xffffffffffffffff
mov r15, qword [rbp + 0x67]
mov rdi, qword [rbp - 0x49]
cmp byte [rbp + 0x7f], 0
je 0x1800e95f9
lea rdx, [rax + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1800e95f1
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800e9888
mov rcx, rsi
call fcn.1800e6850
movabs r12, 0x63c1d737d517c7df
movabs rsi, 0x1f2612ab48b276e
mov ebx, dword [rbp + 0x6f]
mov r11, qword [rbp - 0x71]
mov r10, qword [rbp - 0x79]
mov r9, qword [rsp + 0x28]
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rdx, qword [rbp - 9]
add rdx, 2
mov qword [rbp - 9], rdx
mov rcx, qword [rbp - 1]
add rcx, 4
mov qword [rbp - 1], rcx
cmp eax, dword [rdi + 0x18]
jae 0x1800e9872
mov r8, qword [rbp + 7]
jmp 0x1800e9400
xor edi, edi
jmp 0x1800e9660
mov r14, 0xffffffffffffffff
mov r15, qword [rbp + 0x67]
inc rdi
mov qword [rbp - 0x29], 0
mov qword [rbp - 0x11], 0xf
cmp r13, rdi
jb 0x1800e9894
sub r13, rdi
cmp r13, 0xffffffffffffffff
cmovb r14, r13
lea rbx, [rbp - 0x69]
cmp byte [rbp + 0x7f], 0
cmovne rbx, rsi
add rbx, rdi
cmp r14, 0xf
ja 0x1800e96c2
mov qword [rbp - 0x19], r14
mov r8, r14
mov rdx, rbx
lea rcx, [rbp - 0x29]
call fcn.1800e8cd0
mov byte [rbp + r14 - 0x29], 0
mov rdi, qword [rbp - 0x11]
mov rsi, qword [rbp - 0x29]
jmp 0x1800e9769
movabs rdi, 0x7fffffffffffffff
cmp r14, rdi
ja 0x1800e989a
mov rax, r14
or rax, 0xf
cmp rax, rdi
jbe 0x1800e970e
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1800e6830
test rax, rax
je 0x1800e98a0
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x1800e974a
mov rdi, rax
mov ecx, 0x16
cmp rax, rcx
cmovb rdi, rcx
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x1800e9739
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1800e988e
jmp 0x1800e96ef
test rcx, rcx
je 0x1800e9748
call fcn.1800e6830
mov rsi, rax
jmp 0x1800e974a
xor esi, esi
mov qword [rbp - 0x19], r14
mov qword [rbp - 0x11], rdi
mov r8, r14
mov rdx, rbx
mov rcx, rsi
call fcn.1800e8cd0
mov byte [rsi + r14], 0
mov qword [rbp - 0x29], rsi
lea rcx, [rbp - 0x29]
cmp rdi, 0x10
jb 0x1800e97b0
mov rcx, rsi
call fcn.18002bd40
mov ebx, eax
lea rdx, [rdi + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1800e97a6
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800e98a0
mov rcx, rsi
call fcn.1800e6850
jmp 0x1800e97b7
call fcn.18002bd40
mov ebx, eax
mov rcx, qword gs:[0x30]
mov rdx, qword [rcx + 0x60]
mov r14, qword [rdx + 0x18]
add r14, 0x20
mov rdi, qword [r14]
cmp rdi, r14
je 0x1800e981b
nop dword [rax]
nop dword [rax + rax]
xor ecx, ecx
movzx edx, word [rdi + 0x48]
shr rdx, 1
add rdx, 0xfffffffffffffffc
je 0x1800e97f8
nop
inc rcx
cmp rcx, rdx
jne 0x1800e97f0
mov rcx, qword [rdi + 0x20]
cmp r15, rcx
je 0x1800e9813
xor r8d, r8d
mov edx, ebx
call fcn.1800e9330
mov rsi, rax
test rax, rax
jne 0x1800e981d
mov rdi, qword [rdi]
cmp rdi, r14
jne 0x1800e97e0
xor esi, esi
mov rdx, qword [rbp - 0x51]
cmp rdx, 0x10
jb 0x1800e9854
inc rdx
mov rcx, qword [rbp - 0x69]
mov r8, rcx
cmp rdx, 0x1000
jb 0x1800e984f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub r8, rcx
add r8, 0xfffffffffffffff8
cmp r8, 0x1f
ja 0x1800e9888
call fcn.1800e6850
mov rax, rsi
jmp 0x1800e9874
cmp byte [rbp + 0x77], 0
je 0x1800e986d
movsxd rax, dword [rsp + 0x20]
movzx ecx, word [r11 + rax*2]
mov edx, dword [r10 + rcx*4]
mov rax, rdx
jmp 0x1800e9874
xor eax, eax
add rsp, 0xc8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.18005beb0
nop
call fcn.18005c550
nop
call fcn.1800d5d00
int3
call fcn.18005ccc0
int3
call fcn.18005beb0
int3