Function at 0x180001000
Capabilities:
Access peb ldr_data
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x10
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x18]
mov rdx, qword [rax + 0x20]
mov r11, rdx
mov r8, qword [rdx]
cmp rdx, r8
je 0x180001255
or rbp, 0xffffffffffffffff
movups xmm0, xmmword [rdx + 0x48]
xor r10d, r10d
mov r9, rbp
movd eax, xmm0
movaps xmmword [rsp], xmm0
movzx ebx, ax
test rbx, rbx
je 0x18000108f
mov rdi, qword [rsp + 8]
movsx eax, byte [rdi + r10]
inc r10
add eax, 0x20
movsxd rcx, eax
imul rcx, r9
xor rcx, rbx
xor r9, rcx
cmp r10, rbx
jl 0x180001063
movabs rax, 0x264b88830fb8680
cmp r9, rax
je 0x1800010a0
mov rdx, r8
mov r8, qword [r8]
cmp r11, r8
je 0x180001255
jmp 0x180001044
mov r9, qword [rdx + 0x20]
test r9, r9
je 0x180001255
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x18]
mov rdx, qword [rax + 0x20]
mov rdi, rdx
mov r8, qword [rdx]
cmp rdx, r8
je 0x180001255
movups xmm0, xmmword [rdx + 0x48]
xor r11d, r11d
mov r10, rbp
movd eax, xmm0
movaps xmmword [rsp], xmm0
movzx ebx, ax
test rbx, rbx
je 0x18000111c
mov rsi, qword [rsp + 8]
movsx eax, byte [rsi + r11]
inc r11
add eax, 0x20
movsxd rcx, eax
imul rcx, r10
xor rcx, rbx
xor r10, rcx
cmp r11, rbx
jl 0x1800010f0
movabs rax, 0xb82139f399edc000
cmp r10, rax
je 0x180001127
mov rdx, r8
mov r8, qword [r8]
cmp rdi, r8
jmp 0x1800010cb
mov r14, qword [rdx + 0x20]
test r14, r14
je 0x180001255
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x18]
mov rdx, qword [rax + 0x20]
mov rdi, rdx
mov r8, qword [rdx]
cmp rdx, r8
je 0x180001255
movups xmm0, xmmword [rdx + 0x48]
xor r11d, r11d
mov r10, rbp
movd eax, xmm0
movaps xmmword [rsp], xmm0
movzx ebx, ax
test rbx, rbx
je 0x1800011a3
mov rsi, qword [rsp + 8]
movsx eax, byte [rsi + r11]
inc r11
add eax, 0x20
movsxd rcx, eax
imul rcx, r10
xor rcx, rbx
xor r10, rcx
cmp r11, rbx
jl 0x180001177
movabs rax, 0x4232380d9740f640
cmp r10, rax
je 0x1800011ae
mov rdx, r8
mov r8, qword [r8]
cmp rdi, r8
jmp 0x180001152
mov rax, qword [rdx + 0x20]
mov qword [rsp + 0x40], rax
cmp rax, 0
je 0x180001255
movsxd rax, dword [r9 + 0x3c]
xor r11d, r11d
mov r12d, dword [rax + r9 + 0x88]
mov ebp, dword [r12 + r9 + 0x20]
mov r13d, dword [r12 + r9 + 0x24]
add rbp, r9
mov r15d, dword [r12 + r9 + 0x18]
add r13, r9
test r15d, r15d
je 0x18000124d
mov rbx, rbp
mov edi, dword [rbx]
xor ecx, ecx
add rdi, r9
cmp byte [rdi], cl
je 0x180001205
mov rax, rdi
inc rax
inc ecx
cmp byte [rax], 0
jne 0x1800011fb
movzx r8d, cx
or rdx, 0xffffffffffffffff
xor r10d, r10d
test r8, r8
je 0x180001241
movsx eax, byte [rdi + r10]
inc r10
add eax, 0x20
movsxd rcx, eax
imul rcx, rdx
xor rcx, r8
xor rdx, rcx
cmp r10, r8
jl 0x180001215
movabs rax, 0xfcb103feb50988
cmp rdx, rax
je 0x180001274
inc r11d
add rbx, 4
cmp r11d, r15d
jb 0x1800011ed
and qword [0x180022e08], 0
xor al, al
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x10
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ecx, dword [r12 + r9 + 0x1c]
movzx edx, word [r13 + r11*2]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
mov qword [0x180022e08], rax
je 0x180001255
xor edx, edx
mov rbx, rbp
mov edi, dword [rbx]
xor ecx, ecx
add rdi, r9
cmp byte [rdi], cl
je 0x1800012ae
mov rax, rdi
inc rax
inc ecx
cmp byte [rax], 0
jne 0x1800012a4
movzx r10d, cx
or r8, 0xffffffffffffffff
xor r11d, r11d
test r10, r10
je 0x1800012ea
movsx eax, byte [rdi + r11]
inc r11
add eax, 0x20
movsxd rcx, eax
imul rcx, r8
xor rcx, r10
xor r8, rcx
cmp r11, r10
jl 0x1800012be
movabs rax, 0xeef020d77de05613
cmp r8, rax
je 0x180001302
inc edx
add rbx, 4
cmp edx, r15d
jb 0x180001296
and qword [0x180022e00], 0
jmp 0x180001255
mov ecx, dword [r12 + r9 + 0x1c]
movzx edx, word [r13 + rdx*2]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
mov qword [0x180022e00], rax
je 0x180001255
xor edx, edx
mov rbx, rbp
mov edi, dword [rbx]
xor ecx, ecx
add rdi, r9
cmp byte [rdi], cl
je 0x180001340
mov rax, rdi
inc rax
inc ecx
cmp byte [rax], 0
jne 0x180001336
movzx r10d, cx
or r8, 0xffffffffffffffff
xor r11d, r11d
test r10, r10
je 0x18000137c
movsx eax, byte [rdi + r11]
inc r11
add eax, 0x20
movsxd rcx, eax
imul rcx, r8
xor rcx, r10
xor r8, rcx
cmp r11, r10
jl 0x180001350
movabs rax, 0xa67419ebe96ada6b
cmp r8, rax
je 0x180001394
inc edx
add rbx, 4
cmp edx, r15d
jb 0x180001328
and qword [0x180022df8], 0
jmp 0x180001255
mov ecx, dword [r12 + r9 + 0x1c]
movzx edx, word [r13 + rdx*2]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
mov qword [0x180022df8], rax
je 0x180001255
xor edx, edx
mov ebx, dword [rbp]
xor ecx, ecx
add rbx, r9
cmp byte [rbx], cl
je 0x1800013d0
mov rax, rbx
inc rax
inc ecx
cmp byte [rax], 0
jne 0x1800013c6
movzx r11d, cx
or r8, 0xffffffffffffffff
xor r10d, r10d
test r11, r11
je 0x18000140c
movsx eax, byte [rbx + r10]
inc r10
add eax, 0x20
movsxd rcx, eax
imul rcx, r8
xor rcx, r11
xor r8, rcx
cmp r10, r11
jl 0x1800013e0
movabs rax, 0x9bc3e166e6e07483
cmp r8, rax
je 0x180001424
inc edx
add rbp, 4
cmp edx, r15d
jb 0x1800013b7
and qword [0x180022dc8], 0
jmp 0x180001255
movzx edx, word [r13 + rdx*2]
xor r13d, r13d
mov ecx, dword [r12 + r9 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
mov qword [0x180022dc8], rax
je 0x180001255
movsxd rax, dword [r14 + 0x3c]
mov r10d, r13d
mov r15d, dword [rax + r14 + 0x88]
mov esi, dword [r15 + r14 + 0x20]
mov r12d, dword [r15 + r14 + 0x24]
add rsi, r14
mov ebp, dword [r15 + r14 + 0x18]
add r12, r14
test ebp, ebp
je 0x1800014d6
mov r11, rsi
mov ebx, dword [r11]
mov ecx, r13d
add rbx, r14
cmp byte [rbx], r13b
je 0x18000148e
mov rax, rbx
inc rax
inc ecx
cmp byte [rax], r13b
jne 0x180001484
movzx r9d, cx
or rdx, 0xffffffffffffffff
mov r8, r13
test r9, r9
je 0x1800014ca
movsx eax, byte [rbx + r8]
inc r8
add eax, 0x20
movsxd rcx, eax
imul rcx, rdx
xor rcx, r9
xor rdx, rcx
cmp r8, r9
jl 0x18000149e
movabs rax, 0x5252e0aef01b35f3
cmp rdx, rax
je 0x1800014e2
inc r10d
add r11, 4
cmp r10d, ebp
jb 0x180001473
mov qword [0x180022e10], r13
jmp 0x180001255
mov ecx, dword [r15 + r14 + 0x1c]
mov eax, r10d
add rcx, r14
movzx edx, word [r12 + rax*2]
mov eax, dword [rcx + rdx*4]
add rax, r14
mov qword [0x180022e10], rax
je 0x180001255
mov edx, r13d
mov r10, rsi
mov ebx, dword [r10]
mov ecx, r13d
add rbx, r14
cmp byte [rbx], r13b
je 0x180001526
mov rax, rbx
inc rax
inc ecx
cmp byte [rax], r13b
jne 0x18000151c
movzx r9d, cx
or r8, 0xffffffffffffffff
mov r11, r13
test r9, r9
je 0x180001562
movsx eax, byte [rbx + r11]
inc r11
add eax, 0x20
movsxd rcx, eax
imul rcx, r8
xor r8, rcx
xor r8, r9
cmp r11, r9
jl 0x180001536
movabs rax, 0xf2ca155b47a3b810
cmp r8, rax
je 0x180001578
inc edx
add r10, 4
cmp edx, ebp
jb 0x18000150b
mov qword [0x180022e28], r13
jmp 0x180001255
mov ecx, dword [r15 + r14 + 0x1c]
mov eax, edx
add rcx, r14
movzx edx, word [r12 + rax*2]
mov eax, dword [rcx + rdx*4]
add rax, r14
mov qword [0x180022e28], rax
je 0x180001255
mov edx, r13d
mov r11, rsi
mov ebx, dword [r11]
mov ecx, r13d
add rbx, r14
cmp byte [rbx], r13b
je 0x1800015bb
mov rax, rbx
inc rax
inc ecx
cmp byte [rax], r13b
jne 0x1800015b1
movzx r10d, cx
or r8, 0xffffffffffffffff
mov r9, r13
test r10, r10
je 0x1800015f7
movsx eax, byte [r9 + rbx]
inc r9
add eax, 0x20
movsxd rcx, eax
imul rcx, r8
xor rcx, r10
xor r8, rcx
cmp r9, r10
jl 0x1800015cb
movabs rax, 0x3c837d8777c4be17
cmp r8, rax
je 0x18000160d
inc edx
add r11, 4
cmp edx, ebp
jb 0x1800015a0
mov qword [0x180022df0], r13
jmp 0x180001255
mov ecx, dword [r15 + r14 + 0x1c]
mov eax, edx
add rcx, r14
movzx edx, word [r12 + rax*2]
mov eax, dword [rcx + rdx*4]
add rax, r14
mov qword [0x180022df0], rax
je 0x180001255
mov edx, r13d
mov r11, rsi
mov ebx, dword [r11]
mov ecx, r13d
add rbx, r14
cmp byte [rbx], r13b
je 0x180001650
mov rax, rbx
inc rax
inc ecx
cmp byte [rax], r13b
jne 0x180001646
movzx r10d, cx
or r8, 0xffffffffffffffff
mov r9, r13
test r10, r10
je 0x18000168c
movsx eax, byte [r9 + rbx]
inc r9
add eax, 0x20
movsxd rcx, eax
imul rcx, r8
xor rcx, r10
xor r8, rcx
cmp r9, r10
jl 0x180001660
movabs rax, 0xffb9958e5219503e
cmp r8, rax
je 0x1800016a2
inc edx
add r11, 4
cmp edx, ebp
jb 0x180001635
mov qword [0x180022e30], r13
jmp 0x180001255
mov ecx, dword [r15 + r14 + 0x1c]
mov eax, edx
add rcx, r14
movzx edx, word [r12 + rax*2]
mov eax, dword [rcx + rdx*4]
add rax, r14
mov qword [0x180022e30], rax
je 0x180001255
mov r8d, r13d
mov r11d, dword [rsi]
mov ecx, r13d
add r11, r14
cmp byte [r11], r13b
je 0x1800016e2
mov rax, r11
inc rax
inc ecx
cmp byte [rax], r13b
jne 0x1800016d8
movzx r9d, cx
or rdx, 0xffffffffffffffff
mov r10, r13
test r9, r9
je 0x18000171e
movsx eax, byte [r10 + r11]
inc r10
add eax, 0x20
movsxd rcx, eax
imul rcx, rdx
xor rdx, rcx
xor rdx, r9
cmp r10, r9
jl 0x1800016f2
movabs rax, 0xb90697965ac74e8d
cmp rdx, rax
je 0x180001736
inc r8d
add rsi, 4
cmp r8d, ebp
jb 0x1800016c7
mov qword [0x180022e20], r13
jmp 0x180001255
mov ecx, dword [r15 + r14 + 0x1c]
mov eax, r8d
add rcx, r14
movzx edx, word [r12 + rax*2]
mov eax, dword [rcx + rdx*4]
add rax, r14
mov qword [0x180022e20], rax
je 0x180001255
mov r12, qword [rsp + 0x40]
mov r8d, r13d
movsxd rax, dword [r12 + 0x3c]
mov r14d, dword [rax + r12 + 0x88]
mov esi, dword [r14 + r12 + 0x20]
mov r15d, dword [r14 + r12 + 0x24]
add rsi, r12
mov ebp, dword [r14 + r12 + 0x18]
add r15, r12
test ebp, ebp
je 0x1800017ed
mov r10, rsi
mov ebx, dword [r10]
mov ecx, r13d
add rbx, r12
cmp byte [rbx], r13b
je 0x1800017a5
mov rax, rbx
inc rax
inc ecx
cmp byte [rax], r13b
jne 0x18000179b
movzx r9d, cx
or rdx, 0xffffffffffffffff
mov r11, r13
test r9, r9
je 0x1800017e1
movsx eax, byte [r11 + rbx]
inc r11
add eax, 0x20
movsxd rcx, eax
imul rcx, rdx
xor rdx, rcx
xor rdx, r9
cmp r11, r9
jl 0x1800017b5
movabs rax, 0x7caa77f052777f49
cmp rdx, rax
je 0x1800017f9
inc r8d
add r10, 4
cmp r8d, ebp
jb 0x18000178a
mov qword [0x180022dd8], r13
jmp 0x180001255
mov ecx, dword [r14 + r12 + 0x1c]
mov eax, r8d
add rcx, r12
movzx edx, word [r15 + rax*2]
mov eax, dword [rcx + rdx*4]
add rax, r12
mov qword [0x180022dd8], rax
je 0x180001255
mov edx, r13d
mov r10, rsi
mov ebx, dword [r10]
mov ecx, r13d
add rbx, r12
cmp byte [rbx], r13b
je 0x18000183d
mov rax, rbx
inc rax
inc ecx
cmp byte [rax], r13b
jne 0x180001833
movzx r9d, cx
or r8, 0xffffffffffffffff
mov r11, r13
test r9, r9
je 0x180001879
movsx eax, byte [r11 + rbx]
inc r11
add eax, 0x20
movsxd rcx, eax
imul rcx, r8
xor r8, rcx
xor r8, r9
cmp r11, r9
jl 0x18000184d
movabs rax, 0x3ced91967f16cdb0
cmp r8, rax
je 0x18000188f
inc edx
add r10, 4
cmp edx, ebp
jb 0x180001822
mov qword [0x180022de0], r13
jmp 0x180001255
mov ecx, dword [r14 + r12 + 0x1c]
mov eax, edx
add rcx, r12
movzx edx, word [r15 + rax*2]
mov eax, dword [rcx + rdx*4]
add rax, r12
mov qword [0x180022de0], rax
je 0x180001255
mov edx, r13d
mov r10, rsi
mov ebx, dword [r10]
mov ecx, r13d
add rbx, r12
cmp byte [rbx], r13b
je 0x1800018d2
mov rax, rbx
inc rax
inc ecx
cmp byte [rax], r13b
jne 0x1800018c8
movzx r9d, cx
or r8, 0xffffffffffffffff
mov r11, r13
test r9, r9
je 0x18000190e
movsx eax, byte [r11 + rbx]
inc r11
add eax, 0x20
movsxd rcx, eax
imul rcx, r8
xor r8, rcx
xor r8, r9
cmp r11, r9
jl 0x1800018e2
movabs rax, 0xd2b2289db62a0860
cmp r8, rax
je 0x180001924
inc edx
add r10, 4
cmp edx, ebp
jb 0x1800018b7
mov qword [0x180022dd0], r13
jmp 0x180001255
mov ecx, dword [r14 + r12 + 0x1c]
mov eax, edx
add rcx, r12
movzx edx, word [r15 + rax*2]
mov eax, dword [rcx + rdx*4]
add rax, r12
mov qword [0x180022dd0], rax
je 0x180001255
mov edx, r13d
mov r10, rsi
mov ebx, dword [r10]
mov ecx, r13d
add rbx, r12
cmp byte [rbx], r13b
je 0x180001967
mov rax, rbx
inc rax
inc ecx
cmp byte [rax], r13b
jne 0x18000195d
movzx r9d, cx
or r8, 0xffffffffffffffff
mov r11, r13
test r9, r9
je 0x1800019a3
movsx eax, byte [r11 + rbx]
inc r11
add eax, 0x20
movsxd rcx, eax
imul rcx, r8
xor r8, rcx
xor r8, r9
cmp r11, r9
jl 0x180001977
movabs rax, 0x16e550391363d4bf
cmp r8, rax
je 0x1800019b9
inc edx
add r10, 4
cmp edx, ebp
jb 0x18000194c
mov qword [0x180022e18], r13
jmp 0x180001255
mov ecx, dword [r14 + r12 + 0x1c]
mov eax, edx
add rcx, r12
movzx edx, word [r15 + rax*2]
mov eax, dword [rcx + rdx*4]
add rax, r12
mov qword [0x180022e18], rax
je 0x180001255
mov r8d, r13d
mov r11d, dword [rsi]
mov ecx, r13d
add r11, r12
cmp byte [r11], r13b
je 0x1800019f9
mov rax, r11
inc rax
inc ecx
cmp byte [rax], r13b
jne 0x1800019ef
movzx r9d, cx
or rdx, 0xffffffffffffffff
mov r10, r13
test r9, r9
je 0x180001a35
movsx eax, byte [r10 + r11]
inc r10
add eax, 0x20
movsxd rcx, eax
imul rcx, rdx
xor rdx, rcx
xor rdx, r9
cmp r10, r9
jl 0x180001a09
movabs rax, 0x3a61ef39a3b0ca22
cmp rdx, rax
je 0x180001a4d
inc r8d
add rsi, 4
cmp r8d, ebp
jb 0x1800019de
mov qword [0x180022de8], r13
jmp 0x180001255
mov ecx, dword [r14 + r12 + 0x1c]
mov eax, r8d
add rcx, r12
movzx edx, word [r15 + rax*2]
mov eax, dword [rcx + rdx*4]
add rax, r12
mov qword [0x180022de8], rax
setne al
jmp 0x180001257