Function at 0x18001b130
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Parse pe header
Resolve function by hash
Resolve function by parsing pe exports

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x68
xor esi, esi
mov qword [rbp - 0x38], rsi
mov r14d, esi
mov qword [rbp + 0x58], rsi
mov edi, esi
mov qword [rbp + 0x50], rsi
mov r15d, esi
mov qword [rbp + 0x60], rsi
mov qword [rbp - 0x20], rsi
mov r12d, esi
mov qword [rbp - 0x28], rsi
call fcn.18001b654
lea edx, [rsi + 1]
mov rbx, rax
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x18001b198
movsxd rax, dword [rbx + 0x3c]
lea rcx, [rax - 0x40]
cmp rcx, 0x3bf
ja 0x18001b198
cmp dword [rax + rbx], 0x4550
je 0x18001b19d
sub rbx, rdx
jmp 0x18001b174
mov rax, qword gs:[0x60]
mov qword [rbp - 0x30], rbx
mov rcx, qword [rax + 0x18]
mov r13, qword [rcx + 0x20]
mov qword [rbp + 0x48], r13
test r13, r13
je 0x18001b3a0
mov r12d, 0xffff
mov rbx, rsi
mov rdi, qword [r13 + 0x50]
movzx esi, word [r13 + 0x48]
xor ecx, ecx
lea r13d, [rcx + 1]
call fcn.18001b694
cmp byte [rdi], 0x61
mov ecx, eax
jb 0x18001b1ed
movzx eax, byte [rdi]
sub eax, 0x20
cdqe
jmp 0x18001b1f0
movzx eax, byte [rdi]
add rcx, rax
add rdi, r13
add si, r12w
jne 0x18001b1d7
mov r13, qword [rbp + 0x48]
cmp ecx, 0x6a4abc5b
jne 0x18001b2ea
mov rdi, qword [r13 + 0x20]
mov r15d, 5
movsxd rax, dword [rdi + 0x3c]
mov r12d, dword [rax + rdi + 0x88]
mov esi, dword [r12 + rdi + 0x20]
mov r14d, dword [r12 + rdi + 0x24]
add rsi, rdi
add r14, rdi
mov ecx, dword [rsi]
add rcx, rdi
call fcn.18001b65c
cmp eax, 0xec0e4e8e
je 0x18001b25f
cmp eax, 0x7c0dfcaa
je 0x18001b25f
cmp eax, 0x91afca54
je 0x18001b25f
cmp eax, 0x56c61229
je 0x18001b25f
cmp eax, 0x7b073c59
jne 0x18001b2d2
mov r8d, dword [r12 + rdi + 0x1c]
movzx edx, word [r14]
add r8, rdi
cmp eax, 0xec0e4e8e
jne 0x18001b27f
mov eax, dword [r8 + rdx*4]
add rax, rdi
mov qword [rbp - 0x38], rax
jmp 0x18001b2c9
cmp eax, 0x7c0dfcaa
jne 0x18001b293
mov eax, dword [r8 + rdx*4]
add rax, rdi
mov qword [rbp + 0x58], rax
jmp 0x18001b2c9
cmp eax, 0x91afca54
jne 0x18001b2a3
mov ebx, dword [r8 + rdx*4]
add rbx, rdi
jmp 0x18001b2c9
cmp eax, 0x56c61229
jne 0x18001b2b7
mov eax, dword [r8 + rdx*4]
add rax, rdi
mov qword [rbp - 0x20], rax
jmp 0x18001b2c9
cmp eax, 0x7b073c59
jne 0x18001b2c9
mov r13d, dword [r8 + rdx*4]
add r13, rdi
mov qword [rbp - 0x28], r13
mov eax, 0xffff
add r15w, ax
add rsi, 4
add r14, 2
test r15w, r15w
jne 0x18001b232
mov qword [rbp + 0x50], rbx
jmp 0x18001b35a
cmp ecx, 0x3cfa685d
jne 0x18001b36c
mov rdi, qword [r13 + 0x20]
mov r12d, 1
movsxd rax, dword [rdi + 0x3c]
mov r15d, dword [rax + rdi + 0x88]
mov esi, dword [r15 + rdi + 0x20]
mov r14d, dword [r15 + rdi + 0x24]
add rsi, rdi
add r14, rdi
mov ecx, dword [rsi]
add rcx, rdi
call fcn.18001b65c
cmp eax, 0x534c0ab8
jne 0x18001b348
mov ecx, dword [r15 + rdi + 0x1c]
movzx edx, word [r14]
mov eax, 0xffff
add rcx, rdi
mov ebx, dword [rcx + rdx*4]
add rbx, rdi
add r12w, ax
mov qword [rbp + 0x60], rbx
add rsi, 4
add r14, 2
test r12w, r12w
jne 0x18001b318
mov rbx, qword [rbp + 0x50]
mov r15, qword [rbp + 0x60]
mov r14, qword [rbp + 0x58]
mov r13, qword [rbp + 0x48]
mov r12d, 0xffff
xor edi, edi
cmp qword [rbp - 0x38], rdi
je 0x18001b383
test r14, r14
je 0x18001b383
test rbx, rbx
je 0x18001b383
test r15, r15
jne 0x18001b394
mov r13, qword [r13]
mov qword [rbp + 0x48], r13
test r13, r13
jne 0x18001b1c8
mov rbx, qword [rbp - 0x30]
mov rdi, qword [rbp + 0x50]
mov r12, qword [rbp - 0x28]
movsxd rsi, dword [rbx + 0x3c]
xor ecx, ecx
mov r8d, 0x3000
add rsi, rbx
lea r9d, [rcx + 0x40]
mov edx, dword [rsi + 0x50]
mov qword [rbp + 0x48], rsi
call rdi
mov edx, dword [rsi + 0x54]
xor r13d, r13d
mov r14, rax
mov rax, rbx
test rdx, rdx
je 0x18001b3e5
mov r8, r14
lea r9d, [r13 + 1]
sub r8, rbx
mov cl, byte [rax]
mov byte [r8 + rax], cl
add rax, r9
sub rdx, r9
jne 0x18001b3d7
mov edi, dword [rbx + 2]
xor r9d, r9d
lea rax, [rbp - 0x18]
mov qword [rsp + 0x28], rax
lea r15d, [rdi + 4]
lea r8d, [r9 + 4]
xor edx, edx
or rcx, 0xffffffffffffffff
mov dword [rbp - 0x18], 0x666c6553
mov dword [rsp + 0x20], r15d
mov dword [rbp - 0x14], 0x6c666552
mov dword [rbp - 0x10], 0x69746365
mov word [rbp - 0xc], 0x6576
call qword [rbp - 0x20]
test rax, rax
je 0x18001b46e
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf001f
mov rcx, rax
mov dword [rsp + 0x20], r15d
call r12
test rax, rax
je 0x18001b46e
mov dword [rax], edi
mov edx, edi
mov r11d, 1
test edi, edi
je 0x18001b474
mov r8, rbx
lea rcx, [rax + 4]
sub r8, rax
mov al, byte [r8 + rcx - 4]
mov byte [rcx], al
add rcx, r11
sub rdx, r11
jne 0x18001b45d
jmp 0x18001b474
mov r11d, 1
movzx r9d, word [rsi + 6]
movzx eax, word [rsi + 0x14]
test r9, r9
je 0x18001b4ba
lea rcx, [rsi + 0x2c]
add rcx, rax
mov edx, dword [rcx - 8]
mov r8d, dword [rcx]
mov r10d, dword [rcx - 4]
add rdx, r14
add r8, rbx
sub r9, r11
test r10, r10
je 0x18001b4b1
mov al, byte [r8]
add r8, r11
mov byte [rdx], al
add rdx, r11
sub r10, r11
jne 0x18001b4a1
add rcx, 0x28
test r9, r9
jne 0x18001b489
mov ebx, dword [rsi + 0x90]
add rbx, r14
mov eax, dword [rbx + 0xc]
test eax, eax
je 0x18001b56c
mov rsi, qword [rbp - 0x38]
mov r13, qword [rbp + 0x58]
mov ecx, eax
add rcx, r14
call rsi
mov r15d, dword [rbx]
mov edi, dword [rbx + 0x10]
add r15, r14
add rdi, r14
mov r12, rax
xor r8d, r8d
jmp 0x18001b551
test r15, r15
je 0x18001b52e
movabs rax, 0x8000000000000000
test qword [r15], rax
je 0x18001b52e
movsxd rax, dword [r12 + 0x3c]
movzx edx, word [r15]
mov ecx, dword [rax + r12 + 0x88]
mov eax, dword [rcx + r12 + 0x10]
mov ecx, dword [rcx + r12 + 0x1c]
add rcx, r12
sub rdx, rax
mov eax, dword [rcx + rdx*4]
add rax, r12
jmp 0x18001b541
mov rdx, qword [rdi]
mov rcx, r12
add rdx, 2
add rdx, r14
call r13
xor r8d, r8d
mov qword [rdi], rax
add rdi, 8
test r15, r15
je 0x18001b551
add r15, 8
cmp qword [rdi], r8
jne 0x18001b4f1
mov eax, dword [rbx + 0x20]
add rbx, 0x14
test eax, eax
jne 0x18001b4d6
mov rsi, qword [rbp + 0x48]
xor r13d, r13d
mov r9, r14
mov r12d, 1
sub r9, qword [rsi + 0x30]
cmp dword [rsi + 0xb4], r13d
je 0x18001b623
mov edx, dword [rsi + 0xb0]
add rdx, r14
mov eax, dword [rdx + 4]
test eax, eax
je 0x18001b623
mov ebx, 0xfff
lea esi, [r12 + 1]
mov r8d, dword [rdx]
mov r10d, eax
lea r11, [rdx + 8]
sub r10, 8
add r8, r14
shr r10, 1
je 0x18001b612
movzx ecx, word [r11]
sub r10, r12
movzx eax, cx
shr ax, 0xc
cmp ax, 0xa
jne 0x18001b5d7
and rcx, rbx
add qword [rcx + r8], r9
jmp 0x18001b60a
cmp ax, 3
jne 0x18001b5e6
and rcx, rbx
add dword [rcx + r8], r9d
jmp 0x18001b60a
cmp ax, r12w
jne 0x18001b5fd
mov rax, r9
and rcx, rbx
shr rax, 0x10
add word [rcx + r8], ax
jmp 0x18001b60a
cmp ax, si
jne 0x18001b60a
and rcx, rbx
add word [rcx + r8], r9w
add r11, rsi
test r10, r10
jne 0x18001b5ba
mov eax, dword [rdx + 4]
add rdx, rax
mov eax, dword [rdx + 4]
test eax, eax
jne 0x18001b5a4
mov rsi, qword [rbp + 0x48]
mov ebx, dword [rsi + 0x28]
xor r8d, r8d
xor edx, edx
or rcx, 0xffffffffffffffff
add rbx, r14
call qword [rbp + 0x60]
xor r8d, r8d
mov edx, r12d
mov rcx, r14
call rbx
mov rax, rbx
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret