Function at 0x18007e000
Capabilities:
Access peb ldr_data
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], r8
push rsi
push r15
sub rsp, 0x98
movsxd rax, dword [rcx + 0x3c]
xor r15d, r15d
add rax, rcx
mov dword [rsp + 0xb0], r15d
mov dword [rsp + 0xb8], r15d
mov rsi, rcx
mov qword [rsp + 0x28], rax
cmp edx, 1
jne 0x18007ea94
mov rax, qword gs:[0x60]
mov qword [r11 - 0x18], rbx
mov qword [r11 - 0x20], rbp
mov qword [r11 - 0x38], r13
mov rcx, qword [rax + 0x18]
mov dword [rsp + 0x20], 0x7865742e
mov word [rsp + 0x24], 0x74
mov r11, qword [rcx + 0x10]
mov r9, qword [r11 + 0x60]
test r9, r9
je 0x18007e0bc
mov r10, qword [r11 + 0x30]
mov r8d, 0xf26a0bc2
nop dword [rax + rax]
movzx ecx, word [r9]
lea r9, [r9 + 2]
lea eax, [rcx - 0x41]
cmp ax, 0x19
lea edx, [rcx + 0x20]
cmova dx, cx
test dx, dx
je 0x18007e0a7
rol r8d, 5
movzx eax, dx
add r8d, eax
jmp 0x18007e080
cmp r8d, 0xcf81efeb
je 0x18007e0bf
mov r11, qword [r11]
mov r9, qword [r11 + 0x60]
test r9, r9
jne 0x18007e071
mov r10, r15
movsxd rax, dword [r10 + 0x3c]
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x78], r12
mov qword [rsp + 0x68], r14
mov r13d, dword [rax + r10 + 0x88]
test r13d, r13d
je 0x18007e15e
mov r8d, dword [r13 + r10 + 0x20]
mov edi, r13d
mov r11d, dword [r13 + r10 + 0x24]
add r8, r10
mov ebp, dword [r13 + r10 + 0x1c]
add r11, r10
mov ebx, dword [r13 + r10 + 0x18]
add rbp, r10
mov r9, r15
test rbx, rbx
je 0x18007e15e
nop word [rax + rax]
mov ecx, dword [r8]
mov edx, 0xe1bf6360
add rcx, r10
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x18007e14e
nop word [rax + rax]
movsx eax, al
lea rcx, [rcx + 1]
lea edx, [rax + rdx*2]
movzx eax, byte [rcx - 1]
test al, al
jne 0x18007e130
cmp edx, 0xf63b9ba3
je 0x18007e82d
inc r9
add r8, 4
add r11, 2
cmp r9, rbx
jb 0x18007e110
mov qword [rsp + 0x50], r15
mov rdi, r13
mov r14, r13
test r13d, r13d
je 0x18007e1ee
mov r8d, dword [rdi + r10 + 0x20]
lea r11, [rdi + r10]
mov ebx, dword [r11 + 0x24]
add r8, r10
mov ebp, dword [r11 + 0x1c]
add rbx, r10
mov edi, dword [r11 + 0x18]
add rbp, r10
mov r9, r15
test rdi, rdi
je 0x18007e1ee
nop dword [rax + rax]
mov ecx, dword [r8]
mov edx, 0xe1bf6360
add rcx, r10
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x18007e1de
nop word [rax + rax]
movsx eax, al
lea rcx, [rcx + 1]
lea edx, [rax + rdx*2]
movzx eax, byte [rcx - 1]
test al, al
jne 0x18007e1c0
cmp edx, 0xd8edbdfd
je 0x18007e845
inc r9
add r8, 4
add rbx, 2
cmp r9, rdi
jb 0x18007e1a0
mov qword [rsp + 0x48], r15
lea r11, [r14 + r10]
mov r12, r15
test r13d, r13d
je 0x18007e26e
mov r8d, dword [r11 + 0x20]
mov r9, r15
mov ebx, dword [r11 + 0x24]
add r8, r10
mov ebp, dword [r11 + 0x1c]
add rbx, r10
mov edi, dword [r11 + 0x18]
add rbp, r10
test rdi, rdi
je 0x18007e26e
mov ecx, dword [r8]
mov edx, 0xe1bf6360
add rcx, r10
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x18007e25e
nop word [rax + rax]
movsx eax, al
lea rcx, [rcx + 1]
lea edx, [rax + rdx*2]
movzx eax, byte [rcx - 1]
test al, al
jne 0x18007e240
cmp edx, 0xd8f0609e
je 0x18007e85a
inc r9
add r8, 4
add rbx, 2
cmp r9, rdi
jb 0x18007e220
mov qword [rsp + 0x38], r15
test r13d, r13d
je 0x18007e2ee
mov r8d, dword [r11 + 0x20]
mov r9, r15
mov ebx, dword [r11 + 0x24]
add r8, r10
mov ebp, dword [r11 + 0x1c]
add rbx, r10
mov edi, dword [r11 + 0x18]
add rbp, r10
test rdi, rdi
je 0x18007e2ee
nop dword [rax]
mov ecx, dword [r8]
mov edx, 0xe1bf6360
add rcx, r10
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x18007e2de
nop word [rax + rax]
movsx eax, al
lea rcx, [rcx + 1]
lea edx, [rax + rdx*2]
movzx eax, byte [rcx - 1]
test al, al
jne 0x18007e2c0
cmp edx, 0xf63c16a1
je 0x18007e86e
inc r9
add r8, 4
add rbx, 2
cmp r9, rdi
jb 0x18007e2a0
mov qword [rsp + 0x40], r15
test r13d, r13d
je 0x18007e36e
mov r8d, dword [r11 + 0x20]
mov r9, r15
mov ebx, dword [r11 + 0x24]
add r8, r10
mov ebp, dword [r11 + 0x1c]
add rbx, r10
mov edi, dword [r11 + 0x18]
add rbp, r10
test rdi, rdi
je 0x18007e36e
nop dword [rax]
mov ecx, dword [r8]
mov edx, 0xe1bf6360
add rcx, r10
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x18007e35e
nop word [rax + rax]
movsx eax, al
lea rcx, [rcx + 1]
lea edx, [rax + rdx*2]
movzx eax, byte [rcx - 1]
test al, al
jne 0x18007e340
cmp edx, 0xfb1e0b47
je 0x18007e882
inc r9
add r8, 4
add rbx, 2
cmp r9, rdi
jb 0x18007e320
mov qword [rsp + 0x30], r15
test r13d, r13d
je 0x18007e3ee
mov r8d, dword [r11 + 0x20]
mov r9, r15
mov ebx, dword [r11 + 0x24]
add r8, r10
mov edi, dword [r11 + 0x1c]
add rbx, r10
mov r11d, dword [r11 + 0x18]
add rdi, r10
test r11, r11
je 0x18007e3ee
nop dword [rax]
mov ecx, dword [r8]
mov edx, 0xe1bf6360
add rcx, r10
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x18007e3de
nop word [rax + rax]
movsx eax, al
lea rcx, [rcx + 1]
lea edx, [rax + rdx*2]
movzx eax, byte [rcx - 1]
test al, al
jne 0x18007e3c0
cmp edx, 0x37ec775e
je 0x18007e896
inc r9
add r8, 4
add rbx, 2
cmp r9, r11
jb 0x18007e3a0
mov r14, r15
mov rcx, qword [rsp + 0x28]
mov r9, r15
movzx eax, word [rcx + 0x14]
lea r10, [rcx + 0x18]
movzx r11d, word [rcx + 6]
add r10, rax
test r11, r11
je 0x18007e464
lea rax, [rsp + 0x20]
mov r8, r10
sub r8, rax
nop dword [rax]
mov rdx, r15
nop dword [rax]
nop word [rax + rax]
lea rcx, [rsp + 0x20]
add rcx, rdx
movzx eax, byte [rcx]
cmp byte [r8 + rcx], al
jne 0x18007e8a5
inc rdx
cmp rdx, 6
jb 0x18007e430
mov eax, dword [r10 + 0xc]
mov dword [rsp + 0xb0], eax
mov eax, dword [r10 + 8]
mov dword [rsp + 0xb8], eax
call fcn.18007eb50
mov r13d, dword [rsp + 0xb8]
mov rbx, rax
mov ebp, dword [rsp + 0xb0]
lea rax, [rsi + r13]
add rax, rbp
cmp rbx, rax
ja 0x18007e8ca
nop dword [rax + rax]
mov rcx, r15
cmp byte [rcx + rbx], r15b
jne 0x18007e8be
inc rcx
cmp rcx, 0x80
jb 0x18007e493
mov ecx, 0x3e8
call r14
mov eax, esi
lea rdi, [rbx + 0x100]
sub eax, edi
mov r9d, 4
add eax, r13d
mov r8d, 0x3000
add eax, ebp
xor ecx, ecx
mov edx, eax
mov ebp, eax
call qword [rsp + 0x40]
mov qword [rsp + 0xb0], rax
mov r13, rax
test rax, rax
je 0x18007e8ca
mov ecx, 0x3e8
call r14
mov rdx, r15
test rbp, rbp
je 0x18007e51f
sub rdi, r13
nop
mov rax, rdx
lea rcx, [rdx + r13]
and eax, 0x7f
inc rdx
movzx eax, byte [rax + rbx + 0x80]
xor al, byte [rdi + rcx]
mov byte [rcx], al
cmp rdx, rbp
jb 0x18007e500
movsxd r14, dword [r13 + 0x3c]
mov rbp, r15
mov rax, qword [rsp + 0x28]
add r14, r13
mov qword [rsp + 0x40], r14
movzx edi, word [r14 + 0x14]
movzx ebx, word [rax + 0x14]
add rdi, 0x28
add rbx, 0x20
cmp r15w, word [r14 + 6]
jae 0x18007e5de
mov r12, qword [rsp + 0x38]
add rbx, rax
add rdi, r14
nop word [rax + rax]
mov ecx, dword [rbx + 4]
lea r9, [rsp + 0x58]
mov edx, dword [rbx]
add rcx, rsi
mov r8d, 4
call r12
mov eax, dword [rdi]
mov rdx, r15
test eax, eax
je 0x18007e59e
nop
mov eax, dword [rdi + 4]
mov ecx, dword [rbx + 4]
add rax, rdx
add rcx, rdx
inc rdx
movzx eax, byte [rax + r13]
mov byte [rcx + rsi], al
mov eax, dword [rdi]
cmp rdx, rax
jb 0x18007e580
mov ecx, eax
mov eax, dword [rbx]
cmp rcx, rax
jae 0x18007e5c4
nop word [rax + rax]
mov eax, dword [rbx + 4]
add rax, rcx
inc rcx
mov byte [rax + rsi], r15b
mov eax, dword [rbx]
cmp rcx, rax
jb 0x18007e5b0
movzx eax, word [r14 + 6]
add rdi, 0x28
add rbx, 0x28
inc rbp
cmp rbp, rax
jb 0x18007e560
mov r12, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x28]
lea r9, [rsp + 0xc8]
mov rbp, qword [rsp + 0x38]
mov r8d, 4
mov rcx, rbx
movzx edx, word [rbx + 0x14]
add rdx, 0x18
call rbp
mov eax, dword [r14 + 0x28]
lea r9, [rsp + 0xc8]
mov dword [rbx + 0x28], eax
mov rcx, rbx
mov eax, dword [r14 + 0x88]
mov r8d, dword [rsp + 0xc8]
mov dword [rbx + 0x88], eax
mov eax, dword [r14 + 0x8c]
mov dword [rbx + 0x8c], eax
mov eax, dword [r14 + 0x90]
mov dword [rbx + 0x90], eax
mov eax, dword [r14 + 0x94]
mov dword [rbx + 0x94], eax
mov eax, dword [r14 + 0x98]
mov dword [rbx + 0x98], eax
mov eax, dword [r14 + 0x9c]
mov dword [rbx + 0x9c], eax
mov eax, dword [r14 + 0xa0]
mov dword [rbx + 0xa0], eax
mov eax, dword [r14 + 0xa4]
mov dword [rbx + 0xa4], eax
mov eax, dword [r14 + 0xa8]
mov dword [rbx + 0xa8], eax
mov eax, dword [r14 + 0xac]
mov dword [rbx + 0xac], eax
mov eax, dword [r14 + 0xb0]
mov dword [rbx + 0xb0], eax
mov eax, dword [r14 + 0xb4]
mov dword [rbx + 0xb4], eax
mov eax, dword [r14 + 0xb8]
mov dword [rbx + 0xb8], eax
mov eax, dword [r14 + 0xbc]
mov dword [rbx + 0xbc], eax
mov eax, dword [r14 + 0xc0]
mov dword [rbx + 0xc0], eax
mov eax, dword [r14 + 0xc4]
mov dword [rbx + 0xc4], eax
mov eax, dword [r14 + 0xc8]
mov dword [rbx + 0xc8], eax
mov eax, dword [r14 + 0xcc]
mov dword [rbx + 0xcc], eax
mov eax, dword [r14 + 0xd0]
mov dword [rbx + 0xd0], eax
mov eax, dword [r14 + 0xd4]
mov dword [rbx + 0xd4], eax
mov eax, dword [r14 + 0xd8]
mov dword [rbx + 0xd8], eax
mov eax, dword [r14 + 0xdc]
mov dword [rbx + 0xdc], eax
mov eax, dword [r14 + 0xe0]
mov dword [rbx + 0xe0], eax
mov eax, dword [r14 + 0xe4]
mov dword [rbx + 0xe4], eax
mov eax, dword [r14 + 0xe8]
mov dword [rbx + 0xe8], eax
mov eax, dword [r14 + 0xec]
mov dword [rbx + 0xec], eax
mov eax, dword [r14 + 0xf0]
mov dword [rbx + 0xf0], eax
mov eax, dword [r14 + 0xf4]
mov dword [rbx + 0xf4], eax
mov eax, dword [r14 + 0xf8]
mov dword [rbx + 0xf8], eax
mov eax, dword [r14 + 0xfc]
mov dword [rbx + 0xfc], eax
movzx edx, word [rbx + 0x14]
add rdx, 0x18
call rbp
mov eax, dword [rbx + 0x90]
lea r14, [rax + rsi]
test rax, rax
je 0x18007e939
cmp dword [r14 + 0xc], r15d
je 0x18007e939
mov r13, qword [rsp + 0x50]
nop
cmp dword [r14 + 0x10], r15d
je 0x18007e927
mov ecx, dword [r14 + 0xc]
add rcx, rsi
call r13
mov rbp, rax
test rax, rax
je 0x18007e919
mov eax, dword [r14]
test eax, eax
jne 0x18007e7fb
mov eax, dword [r14 + 0x10]
mov edi, dword [r14 + 0x10]
add rdi, rsi
mov ebx, eax
add rbx, rsi
je 0x18007e919
nop dword [rax]
mov rax, qword [rbx]
test rax, rax
je 0x18007e919
mov rcx, rbp
jns 0x18007e8fe
movzx edx, ax
jmp 0x18007e905
movzx eax, word [r11]
mov r14, r13
mov eax, dword [rbp + rax*4]
add rax, r10
mov qword [rsp + 0x50], rax
jmp 0x18007e172
movzx eax, word [rbx]
mov r12d, dword [rbp + rax*4]
add r12, r10
mov qword [rsp + 0x48], r12
jmp 0x18007e1ff
movzx eax, word [rbx]
mov eax, dword [rbp + rax*4]
add rax, r10
mov qword [rsp + 0x38], rax
jmp 0x18007e278
movzx eax, word [rbx]
mov eax, dword [rbp + rax*4]
add rax, r10
mov qword [rsp + 0x40], rax
jmp 0x18007e2f8
movzx eax, word [rbx]
mov eax, dword [rbp + rax*4]
add rax, r10
mov qword [rsp + 0x30], rax
jmp 0x18007e378
movzx eax, word [rbx]
mov r14d, dword [rdi + rax*4]
add r14, r10
jmp 0x18007e3f1
add r10, 0x28
add r8, 0x28
inc r9
cmp r9, r11
jb 0x18007e420
jmp 0x18007e464
inc rbx
cmp rbx, rax
jbe 0x18007e490
xor eax, eax
mov rdi, qword [rsp + 0x80]
mov r12, qword [rsp + 0x78]
mov r14, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x90]
mov r13, qword [rsp + 0x70]
add rsp, 0x98
pop r15
pop rsi
ret
lea rdx, [rsi + 2]
add rdx, rax
call r12
mov qword [rdi], rax
add rdi, 8
add rbx, 8
jne 0x18007e810
add r14, 0x14
cmp dword [r14 + 0xc], r15d
jne 0x18007e7d0
mov r13, qword [rsp + 0xb0]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
mov eax, dword [rbx + 0xb0]
mov r9, rsi
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x28]
lea rbx, [rax + rsi]
sub r9, qword [rdi + 0x30]
test rax, rax
je 0x18007ea17
cmp dword [r14 + 0xb4], r15d
je 0x18007ea17
mov eax, dword [rbx + 4]
test eax, eax
je 0x18007ea17
nop word [rax + rax]
mov r8d, dword [rbx]
lea r10, [rbx + 8]
sub rax, 8
add r8, rsi
shr rax, 1
mov r11d, eax
test eax, eax
je 0x18007ea06
nop dword [rax + rax]
movzx edx, word [r10]
movzx ecx, dx
movzx eax, dx
shr cx, 0xc
cmp cx, 0xa
jne 0x18007e9c0
and edx, 0xfff
add qword [rdx + r8], r9
jmp 0x18007e9fc
cmp cx, 3
jne 0x18007e9d1
and eax, 0xfff
add dword [rax + r8], r9d
jmp 0x18007e9fc
cmp cx, 1
jne 0x18007e9ec
and eax, 0xfff
lea rcx, [rax + r8]
mov rax, r9
shr rax, 0x10
add word [rcx], ax
jmp 0x18007e9fc
cmp cx, 2
jne 0x18007e9fc
and eax, 0xfff
add word [rax + r8], r9w
add r10, 2
sub r11, 1
jne 0x18007e9a0
mov eax, dword [rbx + 4]
add rbx, rax
mov eax, dword [rbx + 4]
test eax, eax
jne 0x18007e980
movzx ebx, word [r14 + 0x14]
add rbx, 0x24
cmp r15w, word [rdi + 6]
jae 0x18007ea67
add rbx, r14
nop word [rax + rax]
test r15, r15
je 0x18007ea42
mov ecx, dword [rbx + 0x18]
call fcn.18007eab0
mov r8d, eax
jmp 0x18007ea48
mov r8d, 0x40
mov ecx, dword [rbx]
lea r9, [rsp + 0x28]
mov edx, dword [rbx - 4]
add rcx, rsi
call rbp
movzx eax, word [rdi + 6]
add rbx, 0x28
inc r15
cmp r15, rax
jb 0x18007ea30
xor edx, edx
mov r8d, 0x8000
mov rcx, r13
call qword [rsp + 0x30]
mov eax, dword [r14 + 0x28]
mov edx, 1
mov r8, qword [rsp + 0xc0]
add rax, rsi
mov rcx, rsi
call rax
jmp 0x18007e8cc
mov eax, dword [rax + 0x28]
add rax, rsi
add rsp, 0x98
pop r15
pop rsi
jmp rax