Function at 0x1182c
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xe0
mov rax, qword [0x0001c170]
xor rax, rsp
mov qword [rsp + 0xd8], rax
xor edx, edx
mov r8, rcx
mov qword [rsp + 0x50], rcx
mov dword [rsp + 0x3c], edx
cmp dword [rcx + 0x18], edx
jne 0x120b4
mov eax, dword [rcx + 0x14]
xor ebx, ebx
xor r15d, r15d
xor esi, esi
xor ebp, ebp
xor edi, edi
sub eax, 1
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x68], r15
movsxd rcx, eax
mov qword [rsp + 0x60], rsi
mov dword [rsp + 0x38], ebp
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x58], rdi
js 0x120b4
mov rax, rcx
add rax, rax
lea r13, [r8 + rax*8 + 0x24]
mov qword [rsp + 0x70], r13
mov r12d, dword [r13 + 4]
mov r14d, dword [r13]
lea rax, [0x00010000]
shr r14, 1
and r12d, 0xfffffff
add r12, rax
and r14d, 0xfffffff
mov qword [rsp + 0x98], r12
mov qword [rsp + 0x90], r14
cmp r12, rbx
jb 0x11907
lea rcx, [r15 + rbx]
lea rax, [r14 + r12]
cmp rax, rcx
jbe 0x11a10
test ebp, ebp
je 0x11919
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_MmUnlockPages]
and dword [rsp + 0x38], 0
test rsi, rsi
je 0x11927
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
and qword [rsp + 0x20], 0
mov edx, 0xfff
mov ecx, r12d
and ecx, edx
mov eax, r14d
mov rbx, r12
and eax, edx
and rbx, 0xfffffffffffff000
xor r9d, r9d
lea r15d, [rcx + rax + 0xfff]
mov rax, r14
xor r8d, r8d
shr r15d, 0xc
shr rax, 0xc
mov rcx, rbx
add r15d, eax
mov qword [rsp + 0x80], rbx
shl r15d, 0xc
mov edx, r15d
mov qword [rsp + 0x68], r15
mov qword [rsp + 0xb0], r15
call qword [sym.imp.ntoskrnl.exe_IoAllocateMdl]
mov rsi, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x12085
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 2]
call fcn.0001176c
test eax, eax
je 0x1207a
test byte [rsi + 0xa], 5
mov dword [rsp + 0x38], 1
je 0x119c2
mov rdi, qword [rsi + 0x18]
jmp 0x119e4
xor r9d, r9d
xor edx, edx
mov rcx, rsi
lea r8d, [r9 + 1]
mov dword [rsp + 0x28], 0x20
and dword [rsp + 0x20], 0
call qword [sym.imp.ntoskrnl.exe_MmMapLockedPagesSpecifyCache]
mov rdi, rax
test rdi, rdi
je 0x1206c
mov edx, 4
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_MmProtectMdlSystemAddress]
test eax, eax
js 0x1206c
mov r8, qword [rsp + 0x50]
sub rdi, rbx
mov qword [rsp + 0x58], rdi
lea rcx, [rdi + r12]
mov qword [rsp + 0xa0], rcx
test rcx, rcx
je 0x12085
test byte [r13], 1
je 0x1202c
mov r9d, dword [r13 + 4]
mov rax, qword [r8 + 8]
mov r15, r14
xor dl, dl
and r9d, 0xfffffff
and r15d, 7
mov qword [rsp + 0xd0], rax
mov r11, r12
mov qword [rsp + 0x48], r12
mov rbx, rcx
mov qword [rsp + 0x40], rcx
je 0x11f84
xor r10d, r10d
mov edi, r9d
xor ebp, ebp
and dword [rsp + 0x34], r10d
not edi
mov dword [rsp + 0x30], r10d
test r15d, r15d
jle 0x11ab7
lea ebx, [rbp + 0x38]
cmp ebp, 4
movzx r8d, byte [r11]
jge 0x11a98
lea ecx, [rbx - 0x20]
shl r8d, cl
or dword [rsp + 0x34], r8d
jmp 0x11aa0
mov ecx, ebx
shl r8d, cl
or r10d, r8d
inc ebp
inc r11
sub ebx, 8
cmp ebp, r15d
jl 0x11a82
mov dword [rsp + 0x30], r10d
mov qword [rsp + 0x48], r11
movzx r11d, word [rsp + 0xd6]
mov r8d, dword [rsp + 0xd4]
mov ebp, edi
movzx r10d, r8w
movzx ebx, ax
sub ebp, ebx
xor ebp, r8d
xor ebp, r9d
movzx r9d, word [rsp + 0xd2]
mov ecx, ebp
sub ecx, r11d
sub ecx, eax
xor edi, ecx
mov r8d, edi
mov ecx, edi
sub r8d, eax
ror r8d, 0xe
imul r8d, r10d
rol ecx, 0xa
add r8d, ecx
xor ebp, r8d
mov r8d, r11d
xor r8d, ebp
mov ecx, ebp
shr ecx, 7
imul r8d, r9d
xor r8d, ecx
xor edi, r8d
mov r8d, dword [rsp + 0xd4]
sub r8d, edi
mov ecx, edi
ror r8d, 0xd
imul r8d, ebx
ror ecx, 0x10
xor r8d, ecx
xor ebp, r8d
mov r8d, ebp
mov ecx, ebp
sub r8d, eax
rol r8d, 7
imul r8d, r11d
rol ecx, 4
xor r8d, ecx
mov ecx, eax
xor ecx, dword [rsp + 0xd4]
xor edi, r8d
xor ecx, edi
xor ebp, ecx
mov r8d, ebp
mov ecx, ebp
sub r8d, ebx
shr ecx, 1
rol r8d, 3
imul r8d, r9d
xor r8d, ecx
xor edi, r8d
mov r8d, dword [rsp + 0xd4]
xor r8d, edi
mov ecx, edi
rol r8d, 0xa
imul r8d, ebx
ror ecx, 0xc
xor r8d, ecx
mov ecx, eax
xor ebp, r8d
mov r8d, dword [rsp + 0xd4]
xor r8d, ebp
sub ecx, r8d
mov r8d, r11d
xor edi, ecx
xor r8d, edi
mov ecx, edi
rol r8d, 3
imul r8d, r10d
ror ecx, 4
xor r8d, ecx
xor ebp, r8d
xor r11d, ebp
mov ecx, ebp
rol r11d, 2
imul r11d, r9d
mov r8d, dword [rsp + 0xd4]
rol ecx, 0xc
xor r10d, r10d
sub r11d, ecx
xor edi, r11d
add r8d, edi
mov ecx, edi
xor edi, dword [rsp + 0x30]
ror r8d, 8
imul r8d, ebx
rol ecx, 2
sub r8d, ecx
xor r8d, dword [rsp + 0x34]
xor ebp, r8d
mov r8d, edi
mov ecx, ebp
test r15d, r15d
jle 0x11c3a
mov r9, qword [rsp + 0x40]
cmp r10d, 4
jge 0x11c20
rol ecx, 8
mov byte [r9], cl
inc r9
xor dl, cl
jmp 0x11c2d
rol r8d, 8
mov byte [r9], r8b
inc r9
xor dl, r8b
inc r10d
cmp r10d, r15d
jl 0x11c0d
mov qword [rsp + 0x40], r9
lea r8d, [r15 - 4]
test r8d, r8d
jle 0x11f66
mov ecx, 4
sub ecx, r8d
shl ecx, 3
shr edi, cl
shl edi, cl
mov r11, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov r15d, dword [rsp + 0x30]
mov rcx, r14
shr rcx, 3
mov qword [rsp + 0x88], rcx
test rcx, rcx
je 0x11ee1
mov r14d, dword [rsp + 0xd4]
movzx r8d, word [rsp + 0xd6]
mov rsi, qword [rsp + 0x88]
mov r13d, dword [rsp + 0x34]
mov ecx, eax
xor ecx, r14d
mov dword [rsp + 0x40], ecx
movzx ecx, r14w
mov r12d, dword [rsp + 0x40]
mov dword [rsp + 0x48], ecx
movzx ecx, ax
mov dword [rsp + 0x30], ecx
movzx ecx, byte [r11 + 1]
movzx r10d, byte [r11]
movzx r9d, byte [r11 + 4]
shl r10d, 8
shl r9d, 8
add r11, 8
or r10d, ecx
movzx ecx, byte [r11 - 6]
shl r10d, 8
or r10d, ecx
movzx ecx, byte [r11 - 5]
shl r10d, 8
or r10d, ecx
movzx ecx, byte [r11 - 3]
or r9d, ecx
movzx ecx, byte [r11 - 2]
shl r9d, 8
or r9d, ecx
movzx ecx, byte [r11 - 1]
shl r9d, 8
or r9d, ecx
xor edi, r9d
mov ecx, edi
sub ecx, dword [rsp + 0x30]
xor ecx, r14d
xor ecx, r10d
xor ebp, ecx
mov ecx, ebp
sub ecx, r8d
sub ecx, eax
xor edi, ecx
mov r8d, edi
mov ecx, edi
sub r8d, eax
ror r8d, 0xe
imul r8d, dword [rsp + 0x48]
rol ecx, 0xa
add r8d, ecx
movzx ecx, word [rsp + 0xd2]
xor ebp, r8d
movzx r8d, word [rsp + 0xd6]
xor r8d, ebp
imul r8d, ecx
mov ecx, ebp
shr ecx, 7
xor r8d, ecx
xor edi, r8d
mov r8d, r14d
sub r8d, edi
mov ecx, edi
ror r8d, 0xd
imul r8d, dword [rsp + 0x30]
ror ecx, 0x10
xor r8d, ecx
movzx ecx, word [rsp + 0xd6]
xor ebp, r8d
mov r8d, ebp
sub r8d, eax
rol r8d, 7
imul r8d, ecx
mov ecx, ebp
rol ecx, 4
xor r8d, ecx
mov ecx, r12d
xor edi, r8d
xor ecx, edi
xor ebp, ecx
movzx ecx, word [rsp + 0xd2]
mov r8d, ebp
sub r8d, dword [rsp + 0x30]
rol r8d, 3
imul r8d, ecx
mov ecx, ebp
shr ecx, 1
xor r8d, ecx
xor edi, r8d
mov r8d, r14d
xor r8d, edi
mov ecx, edi
rol r8d, 0xa
imul r8d, dword [rsp + 0x30]
ror ecx, 0xc
xor r8d, ecx
mov ecx, eax
xor ebp, r8d
mov r8d, r14d
xor r8d, ebp
sub ecx, r8d
movzx r8d, word [rsp + 0xd6]
xor edi, ecx
xor r8d, edi
mov ecx, edi
rol r8d, 3
imul r8d, dword [rsp + 0x48]
ror ecx, 4
xor r8d, ecx
movzx ecx, word [rsp + 0xd2]
xor ebp, r8d
movzx r8d, word [rsp + 0xd6]
xor r8d, ebp
rol r8d, 2
imul r8d, ecx
mov ecx, ebp
rol ecx, 0xc
sub r8d, ecx
xor edi, r8d
mov ecx, edi
lea r8d, [r14 + rdi]
xor edi, r15d
mov r15d, r9d
ror r8d, 8
mov byte [rbx + 7], dil
imul r8d, dword [rsp + 0x30]
rol ecx, 2
sub r8d, ecx
xor r8d, r13d
mov r13d, r10d
xor ebp, r8d
movzx r8d, word [rsp + 0xd6]
xor dl, bpl
mov byte [rbx + 3], bpl
ror ebp, 8
xor dl, dil
ror edi, 8
mov byte [rbx + 2], bpl
xor dl, bpl
ror ebp, 8
mov byte [rbx + 6], dil
xor dl, dil
ror edi, 8
mov byte [rbx + 1], bpl
xor dl, bpl
ror ebp, 8
mov byte [rbx + 5], dil
xor dl, dil
ror edi, 8
mov byte [rbx], bpl
mov cl, dil
mov byte [rbx + 4], dil
add rbx, 8
xor cl, bpl
xor dl, cl
ror ebp, 8
ror edi, 8
sub rsi, 1
jne 0x11cb8
mov rsi, qword [rsp + 0x60]
mov r12, qword [rsp + 0x98]
mov r13, qword [rsp + 0x70]
mov r14, qword [rsp + 0x90]
mov al, byte [r13 - 4]
and dword [r13], 0xfffffffe
xor al, dl
jne 0x12062
test byte [r13 - 8], 1
jne 0x12027
mov rax, qword [0x000192b8]
lea r15, [0x00010000]
mov rbx, r15
sub rbx, rax
je 0x12022
mov rcx, qword [0x000192b0]
mov rdi, qword [rsp + 0xa0]
xor r8d, r8d
sub rdi, r12
sub r12d, r15d
lea r9d, [rcx - 1]
lea ebp, [r12 + r14]
lea r11, [0x000192b0]
test r9d, r9d
js 0x11fa3
lea eax, [r9 + r8]
cdq
sub eax, edx
sar eax, 1
movsxd rdx, eax
mov r10d, dword [r11 + rdx*4 + 4]
and r10d, 0xfffffff
cmp r12d, r10d
jae 0x11f98
lea r9d, [rdx - 1]
jmp 0x11f9e
xor edi, edi
test r8d, r8d
jns 0x11c56
neg r8d
shl r8d, 3
mov ecx, r8d
shr ebp, cl
shl ebp, cl
jmp 0x11c56
mov r15d, r9d
xor edi, edi
mov dword [rsp + 0x34], r9d
not r15d
xor ebp, ebp
jmp 0x11c65
jbe 0x11fa8
lea r8d, [rdx + 1]
cmp r9d, r8d
jge 0x11f43
movsxd r10, r8d
jmp 0x1201b
mov r10, rdx
jmp 0x1201b
mov edx, dword [r11 + r10*4 + 4]
mov eax, edx
and eax, 0xfffffff
cmp eax, ebp
jae 0x12022
mov r8, rdx
mov r9d, edx
shl edx, 2
and r8d, 0xfffffff
sar edx, 0x1e
sar r9d, 0x1e
add r8, rdi
and edx, 3
and r9d, 3
add r8, r15
xor r11d, r11d
sub edx, 1
je 0x11ff3
sub edx, 1
je 0x11ff6
sub edx, 1
jne 0x11ff6
mov r11, rbx
sub r9d, 2
je 0x12007
cmp r9d, 1
jne 0x12011
add qword [r8], r11
jmp 0x1200a
add dword [r8], r11d
mov rcx, qword [0x000192b0]
inc r10
lea r11, [0x000192b0]
mov eax, ecx
cmp r10, rax
jb 0x11fad
or dword [r13 - 8], 1
mov rdi, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x78]
sub r13, 0x10
dec rcx
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], rcx
test rcx, rcx
js 0x1208d
mov rbx, qword [rsp + 0x80]
mov r8, qword [rsp + 0x50]
mov ebp, dword [rsp + 0x38]
mov r15, qword [rsp + 0x68]
jmp 0x118be
mov dword [rsp + 0x3c], 0x80004005
jmp 0x1208d
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_MmUnlockPages]
and dword [rsp + 0x38], 0
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
xor esi, esi
mov dword [rsp + 0x3c], 0x8007000e
cmp dword [rsp + 0x38], 0
je 0x1209d
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_MmUnlockPages]
test rsi, rsi
je 0x120ab
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
mov edx, dword [rsp + 0x3c]
mov r8, qword [rsp + 0x50]
inc dword [r8 + 0x18]
mov eax, edx
mov rcx, qword [rsp + 0xd8]
xor rcx, rsp
call fcn.000110ac
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret