Function at 0x180001000
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Resolve function by parsing pe exports

Disassembly:
push rbp
sub rsp, 0x40
mov rax, qword [0x18001c018]
xor rax, rsp
mov qword [rsp + 0x10], rax
cmp dword [0x18003bfb0], 0
jne 0x180001386
mov rax, qword gs:[0x60]
xor r8d, r8d
mov rcx, qword [rax + 0x18]
mov r9, qword [rcx + 0x10]
mov rax, qword [r9 + 0x30]
test rax, rax
je 0x18000139e
mov rbp, rax
mov qword [rsp], rax
movsxd rax, dword [rax + 0x3c]
mov ecx, dword [rax + rbp + 0x88]
test ecx, ecx
je 0x18000108e
lea r8, [rcx + rbp]
mov edx, 0xedec4
mov ecx, dword [r8 + 0xc]
add rcx, rbp
movzx eax, byte [rcx]
test al, al
je 0x18000108e
movzx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x13cc4
movzx eax, byte [rcx]
test al, al
jne 0x180001070
cmp edx, 0x613a2970
je 0x18000109a
mov r9, qword [r9]
mov rax, qword [r9 + 0x30]
test rax, rax
jne 0x180001043
test r8, r8
je 0x18000139e
mov r10d, dword [r8 + 0x18]
mov qword [rsp + 0x50], rbx
mov ebx, dword [r8 + 0x20]
mov qword [rsp + 0x58], rsi
add rbx, rbp
mov esi, dword [r8 + 0x24]
mov qword [rsp + 0x60], rdi
add rsi, rbp
mov edi, dword [r8 + 0x1c]
mov qword [rsp + 0x38], r12
add rdi, rbp
mov qword [rsp + 0x28], r14
xor edx, edx
mov qword [rsp + 0x20], r15
mov r14d, 0x775a
lea r15, [0x18003bfb0]
nop dword [rax]
lea eax, [r10 - 1]
mov ecx, dword [rbx + rax*4]
mov r10d, eax
add rcx, rbp
mov r11d, eax
movzx r8d, word [rcx]
cmp r8w, r14w
jne 0x180001153
mov r9d, 0xedec4
test r8b, r8b
je 0x180001132
movzx eax, r8b
lea rcx, [rcx + 1]
xor eax, r9d
imul r9d, eax, 0x13cc4
movzx eax, byte [rcx]
movzx r8d, al
test al, al
jne 0x180001115
mov ecx, edx
inc edx
add rcx, rcx
mov dword [r15 + rcx*8 + 8], r9d
movzx eax, word [rsi + r11*2]
mov eax, dword [rdi + rax*4]
mov dword [r15 + rcx*8 + 0xc], eax
cmp edx, 0x226
je 0x180001158
test r10d, r10d
jne 0x1800010f0
xor r8d, r8d
mov dword [0x18003bfb0], edx
lea eax, [rdx - 1]
test eax, eax
je 0x1800011da
nop dword [rax + rax]
mov eax, edx
xor bl, bl
sub eax, r8d
xor ecx, ecx
cmp eax, 1
je 0x1800011da
nop
lea r11d, [rcx + 1]
mov r10d, ecx
mov r9d, r11d
add r10, r10
add r9, r9
mov eax, dword [r15 + r9*8 + 0xc]
cmp dword [r15 + r10*8 + 0xc], eax
jbe 0x1800011bc
movups xmm1, xmmword [r15 + r10*8 + 8]
mov bl, 1
movups xmm0, xmmword [r15 + r9*8 + 8]
movups xmmword [r15 + r9*8 + 8], xmm1
movups xmmword [r15 + r10*8 + 8], xmm0
mov edx, dword [0x18003bfb0]
mov eax, edx
mov ecx, r11d
sub eax, r8d
dec eax
cmp r11d, eax
jb 0x180001180
test bl, bl
je 0x1800011da
inc r8d
lea eax, [rdx - 1]
cmp r8d, eax
jb 0x180001170
mov r15d, dword [0x18003bfcc]
xor r12d, r12d
sub r15d, dword [0x18003bfbc]
test edx, edx
je 0x180001368
mov qword [rsp + 0x30], r13
lea esi, [r15 - 2]
mov word [rsp + 8], 0x50f
lea rax, [0x18003bfb0]
mov byte [rsp + 0xa], 0xc3
nop
mov r13d, r12d
xor r10d, r10d
add r13, r13
mov r14d, dword [rax + r13*8 + 0xc]
add r14, rbp
test esi, esi
je 0x180001275
nop word [rax + rax]
mov r11d, r10d
lea rax, [rsp + 8]
add r11, r14
lea rdx, [rsp + 8]
mov r9, r11
mov r8d, 3
sub r9, rax
nop dword [rax]
movzx ecx, byte [rdx]
dec r8
movzx eax, byte [rdx + r9]
lea rdx, [rdx + 1]
cmp cl, al
jne 0x18000126d
test r8, r8
jne 0x180001250
jmp 0x180001347
inc r10d
cmp r10d, esi
jb 0x180001230
mov ebp, 1
nop word [rax + rax]
mov ebx, r15d
xor r10d, r10d
imul ebx, ebp
test esi, esi
je 0x180001332
mov edi, ebx
nop dword [rax]
nop word [rax + rax]
mov r11d, r10d
lea rax, [rsp + 8]
add r11, rdi
lea rdx, [rsp + 8]
add r11, r14
mov r8d, 3
mov r9, r11
sub r9, rax
nop
movzx ecx, byte [rdx]
dec r8
movzx eax, byte [rdx + r9]
lea rdx, [rdx + 1]
cmp cl, al
jne 0x1800012da
test r8, r8
jne 0x1800012c0
jmp 0x180001343
inc r10d
cmp r10d, esi
jb 0x1800012a0
xor r10d, r10d
nop word [rax + rax]
mov r11d, r10d
lea rcx, [rsp + 8]
sub r11, rbx
lea rax, [rsp + 8]
add r11, r14
mov r8d, 3
mov r9, r11
sub r9, rcx
nop
movzx edx, byte [rax]
dec r8
movzx ecx, byte [rax + r9]
lea rax, [rax + 1]
cmp dl, cl
jne 0x18000132a
test r8, r8
jne 0x180001310
jmp 0x180001343
inc r10d
cmp r10d, esi
jb 0x1800012f0
inc ebp
cmp ebp, 0x226
jb 0x180001280
xor r11d, r11d
mov rbp, qword [rsp]
lea rax, [0x18003bfb0]
inc r12d
mov qword [rax + r13*8 + 0x10], r11
cmp r12d, dword [0x18003bfb0]
jb 0x180001210
mov r13, qword [rsp + 0x30]
mov r14, qword [rsp + 0x28]
mov r12, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r15, qword [rsp + 0x20]
mov eax, 1
mov rcx, qword [rsp + 0x10]
xor rcx, rsp
call fcn.180006660
add rsp, 0x40
pop rbp
ret
xor eax, eax
mov rcx, qword [rsp + 0x10]
xor rcx, rsp
call fcn.180006660
add rsp, 0x40
pop rbp
ret