Function at 0x18000d298
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Parse pe header
Resolve function by hash
Resolve function by parsing pe exports

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x58
xor r14d, r14d
mov r9d, r14d
mov qword [rbp + 0x48], r14
mov qword [rbp + 0x50], r14
mov r15d, r14d
mov r10d, r14d
mov qword [rbp + 0x58], r14
mov r13d, r14d
mov r12d, r14d
mov qword [rbp - 0x28], r14
call fcn.18000d808
lea edi, [r14 + 1]
mov rbx, rax
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x18000d2fe
movsxd rax, dword [rbx + 0x3c]
lea rcx, [rax - 0x40]
cmp rcx, 0x3bf
ja 0x18000d2fe
cmp dword [rax + rbx], 0x4550
je 0x18000d303
sub rbx, rdi
jmp 0x18000d2da
mov rax, qword gs:[0x60]
mov qword [rbp - 0x20], rbx
mov rcx, qword [rax + 0x18]
mov rsi, qword [rcx + 0x20]
mov qword [rbp + 0x60], rsi
test rsi, rsi
je 0x18000d53c
mov r11d, 0xffff
mov rbx, r9
mov rdx, qword [rsi + 0x50]
movzx r8d, word [rsi + 0x48]
mov rcx, r14
ror ecx, 0xd
cmp byte [rdx], 0x61
jb 0x18000d34c
movzx eax, byte [rdx]
sub eax, 0x20
cdqe
jmp 0x18000d34f
movzx eax, byte [rdx]
add rcx, rax
add rdx, rdi
add r8w, r11w
jne 0x18000d33a
cmp ecx, 0x6a4abc5b
jne 0x18000d46d
mov rdx, qword [rsi + 0x20]
mov edi, 5
mov esi, 0xffff
movsxd rax, dword [rdx + 0x3c]
mov r14d, dword [rax + rdx + 0x88]
mov r10d, dword [r14 + rdx + 0x20]
mov r11d, dword [r14 + rdx + 0x24]
add r10, rdx
add r11, rdx
mov r8d, dword [r10]
add r8, rdx
xor r9d, r9d
mov al, byte [r8]
mov ecx, r9d
ror ecx, 0xd
movsx eax, al
inc r8
add ecx, eax
mov al, byte [r8]
test al, al
jne 0x18000d3a0
cmp ecx, 0xec0e4e8e
je 0x18000d3da
cmp ecx, 0x7c0dfcaa
je 0x18000d3da
cmp ecx, 0x91afca54
je 0x18000d3da
cmp ecx, 0x56c61229
je 0x18000d3da
cmp ecx, 0x7b073c59
jne 0x18000d446
mov r9d, dword [r14 + rdx + 0x1c]
movzx r8d, word [r11]
add r9, rdx
cmp ecx, 0xec0e4e8e
jne 0x18000d3fb
mov r9d, dword [r9 + r8*4]
add r9, rdx
mov qword [rbp + 0x48], r9
jmp 0x18000d441
cmp ecx, 0x7c0dfcaa
jne 0x18000d40c
mov ebx, dword [r9 + r8*4]
add rbx, rdx
jmp 0x18000d43d
cmp ecx, 0x91afca54
jne 0x18000d41d
mov r15d, dword [r9 + r8*4]
add r15, rdx
jmp 0x18000d43d
cmp ecx, 0x56c61229
jne 0x18000d42e
mov r13d, dword [r9 + r8*4]
add r13, rdx
jmp 0x18000d43d
cmp ecx, 0x7b073c59
jne 0x18000d43d
mov r12d, dword [r9 + r8*4]
add r12, rdx
mov r9, qword [rbp + 0x48]
add di, si
jmp 0x18000d44a
mov r9, qword [rbp + 0x48]
add r10, 4
add r11, 2
xor eax, eax
test di, di
jne 0x18000d391
mov qword [rbp + 0x50], rbx
mov qword [rbp - 0x28], r12
xor r14d, r14d
jmp 0x18000d501
cmp ecx, 0x3cfa685d
jne 0x18000d514
mov r8, qword [rsi + 0x20]
mov ebx, 1
mov esi, 0xffff
movsxd rax, dword [r8 + 0x3c]
lea r12d, [rbx + 1]
mov r11d, dword [rax + r8 + 0x88]
mov r9d, dword [r11 + r8 + 0x20]
mov r10d, dword [r11 + r8 + 0x24]
add r9, r8
add r10, r8
mov ecx, dword [r9]
mov edx, r14d
add rcx, r8
mov al, byte [rcx]
ror edx, 0xd
movsx eax, al
add rcx, rbx
add edx, eax
mov al, byte [rcx]
test al, al
jne 0x18000d4b2
cmp edx, 0x534c0ab8
jne 0x18000d4e9
mov eax, dword [r11 + r8 + 0x1c]
movzx edx, word [r10]
add di, si
lea rcx, [r8 + rax]
mov r14d, dword [rcx + rdx*4]
add r14, r8
mov qword [rbp + 0x58], r14
xor r14d, r14d
add r9, 4
add r10, r12
test di, di
jne 0x18000d4a7
mov r12, qword [rbp - 0x28]
mov r9, qword [rbp + 0x48]
mov rbx, qword [rbp + 0x50]
mov r10, qword [rbp + 0x58]
mov rsi, qword [rbp + 0x60]
mov r11d, 0xffff
mov edi, 1
test r9, r9
je 0x18000d528
test rbx, rbx
je 0x18000d528
test r15, r15
je 0x18000d528
test r10, r10
jne 0x18000d538
mov rsi, qword [rsi]
mov qword [rbp + 0x60], rsi
test rsi, rsi
jne 0x18000d32e
mov rbx, qword [rbp - 0x20]
movsxd rdi, dword [rbx + 0x3c]
xor ecx, ecx
mov r8d, 0x3000
add rdi, rbx
lea r9d, [rcx + 0x40]
mov edx, dword [rdi + 0x50]
mov qword [rbp + 0x60], rdi
call r15
mov edx, dword [rdi + 0x54]
mov rsi, rax
mov rax, rbx
test rdx, rdx
je 0x18000d581
mov r8, rsi
mov r9d, 1
sub r8, rbx
mov cl, byte [rax]
mov byte [r8 + rax], cl
add rax, r9
sub rdx, r9
jne 0x18000d573
mov r14d, dword [rbx + 2]
xor r9d, r9d
lea rax, [rbp - 0x18]
mov qword [rsp + 0x28], rax
lea r15d, [r14 + 4]
lea r8d, [r9 + 4]
xor edx, edx
or rcx, 0xffffffffffffffff
mov dword [rbp - 0x18], 0x666c6553
mov dword [rsp + 0x20], r15d
mov dword [rbp - 0x14], 0x6c666552
mov dword [rbp - 0x10], 0x69746365
mov word [rbp - 0xc], 0x6576
call r13
xor r13d, r13d
test rax, rax
je 0x18000d60f
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf001f
mov rcx, rax
mov dword [rsp + 0x20], r15d
call r12
test rax, rax
je 0x18000d60f
mov dword [rax], r14d
mov edx, r14d
lea r11d, [r13 + 1]
test r14d, r14d
je 0x18000d615
mov r8, rbx
lea rcx, [rax + 4]
sub r8, rax
mov al, byte [r8 + rcx - 4]
mov byte [rcx], al
add rcx, r11
sub rdx, r11
jne 0x18000d5fe
jmp 0x18000d615
mov r11d, 1
movzx r9d, word [rdi + 6]
movzx eax, word [rdi + 0x14]
test r9, r9
je 0x18000d65b
lea rcx, [rdi + 0x2c]
add rcx, rax
mov edx, dword [rcx - 8]
mov r8d, dword [rcx]
mov r10d, dword [rcx - 4]
add rdx, rsi
add r8, rbx
sub r9, r11
test r10, r10
je 0x18000d652
mov al, byte [r8]
add r8, r11
mov byte [rdx], al
add rdx, r11
sub r10, r11
jne 0x18000d642
add rcx, 0x28
test r9, r9
jne 0x18000d62a
mov ebx, dword [rdi + 0x90]
add rbx, rsi
mov eax, dword [rbx + 0xc]
test eax, eax
je 0x18000d712
mov r13, qword [rbp + 0x48]
mov ecx, eax
add rcx, rsi
call r13
mov r14d, dword [rbx + 0x10]
mov r15d, dword [rbx]
add r14, rsi
xor r8d, r8d
add r15, rsi
mov r12, rax
cmp qword [r14], r8
je 0x18000d700
mov r13, qword [rbp + 0x50]
test r15, r15
je 0x18000d6d4
movabs rax, 0x8000000000000000
test qword [r15], rax
je 0x18000d6d4
movsxd rax, dword [r12 + 0x3c]
movzx edx, word [r15]
mov ecx, dword [rax + r12 + 0x88]
mov eax, dword [rcx + r12 + 0x10]
mov ecx, dword [rcx + r12 + 0x1c]
add rcx, r12
sub rdx, rax
mov eax, dword [rcx + rdx*4]
add rax, r12
jmp 0x18000d6e7
mov rdx, qword [r14]
mov rcx, r12
add rdx, 2
add rdx, rsi
call r13
xor r8d, r8d
mov qword [r14], rax
add r14, 8
test r15, r15
je 0x18000d6f7
add r15, 8
cmp qword [r14], r8
jne 0x18000d697
mov r13, qword [rbp + 0x48]
mov eax, dword [rbx + 0x20]
add rbx, 0x14
test eax, eax
jne 0x18000d673
xor r13d, r13d
mov r10, rsi
sub r10, qword [rdi + 0x30]
cmp dword [rdi + 0xb4], r13d
je 0x18000d7cd
mov edx, dword [rdi + 0xb0]
add rdx, rsi
mov eax, dword [rdx + 4]
test eax, eax
je 0x18000d7cd
mov ebx, 0xfff
mov edi, 2
mov r8d, dword [rdx]
mov r9d, eax
lea r11, [rdx + 8]
sub r9, 8
add r8, rsi
shr r9, 1
je 0x18000d7b8
mov r14d, 1
movzx ecx, word [r11]
sub r9, r14
movzx eax, cx
shr ax, 0xc
cmp ax, 0xa
jne 0x18000d77d
and rcx, rbx
add qword [rcx + r8], r10
jmp 0x18000d7b0
cmp ax, 3
jne 0x18000d78c
and rcx, rbx
add dword [rcx + r8], r10d
jmp 0x18000d7b0
cmp ax, r14w
jne 0x18000d7a3
mov rax, r10
and rcx, rbx
shr rax, 0x10
add word [rcx + r8], ax
jmp 0x18000d7b0
cmp ax, di
jne 0x18000d7b0
and rcx, rbx
add word [rcx + r8], r10w
add r11, rdi
test r9, r9
jne 0x18000d760
mov eax, dword [rdx + 4]
add rdx, rax
mov eax, dword [rdx + 4]
test eax, eax
jne 0x18000d744
mov rdi, qword [rbp + 0x60]
mov ebx, dword [rdi + 0x28]
xor r8d, r8d
xor edx, edx
or rcx, 0xffffffffffffffff
add rbx, rsi
call qword [rbp + 0x58]
xor r8d, r8d
mov rcx, rsi
lea edx, [r8 + 1]
call rbx
mov rax, rbx
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret