Function at 0x18000609c
Capabilities:
Allocate or change rwx memory
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov esi, dword [rsp + 0x88]
lea r15d, [rcx - 0x96a]
mov eax, dword [rsp + 0x80]
mov r14d, esi
mov rbx, r9
mov r9d, 0x96a
xor r14d, r9d
lea r10d, [rsi - 0x248]
lea edi, [rsi + 0x33f]
xor esi, 0x1eac
lea r8d, [rax + 0x5ce]
lea ebp, [rax + 0xd1f]
cmp r15d, r10d
je 0x180006655
lea eax, [r15 + 0x1790]
cmp esi, eax
jl 0x1800065b0
cmp r14d, r10d
je 0x1800067a2
mov rdx, qword [section..data]
mov eax, dword [0x18015e088]
add eax, 0x12b3b5
mov ecx, dword [rdx + 4]
imul ecx, eax
mov dword [rdx + 4], ecx
cmp dword [rbx + 0x15c], 0x7fcb
je 0x18000615e
mov rcx, qword [section..data]
mov eax, dword [rcx + 0xf4]
add eax, 0xc48
mov dword [rcx + 0x104], eax
jmp 0x18000617a
mov rdx, qword [section..data]
mov ecx, dword [0x18015e17c]
sub ecx, dword [rbx + 0x150]
mov eax, dword [rdx + 0x50]
imul eax, ecx
mov dword [rdx + 0x50], eax
mov eax, dword [rbx + 0x6c]
cmp dword [rbx + 0xdc], eax
jbe 0x1800061a7
mov rax, qword [section..data]
mov ecx, dword [rax + 0x16c]
xor ecx, dword [rbx + 4]
xor ecx, dword [rbx + 0x144]
xor ecx, 0x7c3f8
mov dword [rbx + 0x144], ecx
mov edx, dword [0x18015e160]
mov r8, qword [section..data]
lea eax, [rdx + 0x12c358]
or dword [0x18015e178], eax
cmp dword [0x18015e0c4], 0xcbbe
jb 0x1800061e7
mov ecx, dword [r8 + 0x1c]
mov eax, 0xfffeefeb
xor ecx, dword [rbx + 0x16c]
sub eax, ecx
add edx, eax
mov dword [0x18015e160], edx
jmp 0x1800061f1
or dword [0x18015e09c], 0x67340
mov eax, dword [r8 + 0x48]
xor eax, dword [r8 + 0x38]
add eax, 0x6def4
xor dword [r8 + 0x38], eax
mov eax, dword [rbx + 0x50]
sub eax, dword [rbx + 0x94]
mov rcx, qword [section..data]
add eax, 0x31a11f1d
or dword [rcx + 0x14], eax
cmp dword [rbx + 0x1c], 0x9a95
jne 0x18000623f
mov rcx, qword [section..data]
mov eax, dword [rcx + 0x94]
imul eax, dword [0x18015e0c4]
mov dword [rcx + 0x94], eax
jmp 0x180006255
mov eax, dword [0x18015e058]
mov ecx, dword [rbx + 0x50]
add eax, 0x20738
add ecx, eax
add dword [rbx + 0x94], ecx
cmp dword [0x18015e060], 0x5009
jae 0x18000626b
add dword [rbx + 0x104], 0x70abb
mov edx, dword [0x18015e058]
mov eax, dword [rbx + 0xf4]
add edx, 0xfff8c7e0
add edx, dword [rbx + 0x14]
imul eax, edx
mov dword [rbx + 0xf4], eax
mov rcx, qword [section..data]
cmp dword [rcx + 0x10], 0xbd3c
ja 0x1800062b8
mov edx, dword [0x18015e110]
add edx, dword [rbx + 0x94]
xor edx, 0x3195274f
add dword [rbx + 0x16c], edx
mov rcx, qword [section..data]
mov eax, dword [0x18015e178]
cmp dword [rbx + 0x1c], eax
je 0x1800062cd
xor dword [rcx + 0x104], 0x3efc
mov eax, r10d
lea r8d, [r15 + 0xe88]
xor r10d, 0xe48
lea ecx, [r14 + 0x1790]
xor eax, 0x163f
lea r9, [0x18015e010]
mov edx, r10d
mov dword [rsp + 0x20], eax
call fcn.180003948
mov rcx, qword [section..data]
mov eax, dword [rcx + 0xb4]
add eax, dword [rbx + 0x5c]
xor eax, 0xac8
sub dword [rcx + 0x3c], eax
mov rax, qword [section..data]
add dword [rax + 0x3c], 0x236e8
mov rcx, qword [section..data]
mov eax, dword [rcx + 0x38]
xor eax, dword [rcx + 0x3c]
xor eax, 0x27eeb6
mov dword [rcx + 0x3c], eax
xor ecx, ecx
mov eax, dword [rbx + 0x168]
sub eax, dword [rbx + 0x1c]
xor eax, 0x12c6ed
sub dword [0x18015e04c], eax
lea r9d, [rcx + 0x40]
mov rax, qword [section..data]
mov edx, dword [rbx + 0x3c]
mov r8d, dword [rax + 0x48]
add r8d, 0x11e677
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
add rax, 0x1000
mov qword [rbx + 0xe8], rax
mov eax, dword [0x18015e09c]
mov dword [0x18015e098], 0x6d
cmp dword [rbx + 0xdc], eax
je 0x1800063b1
mov rax, qword [section..data]
mov ecx, dword [rax + 0x16c]
xor ecx, dword [0x18015e108]
xor ecx, 0x5cf25
sub dword [rbx + 0x88], ecx
mov rax, qword [rbx + 0xe8]
mov qword [0x18015e0e0], rax
mov eax, dword [rbx + 0x28]
sub eax, dword [0x18015e16c]
add eax, 0x1447
mov dword [rbx + 0x84], eax
mov rdx, qword [section..data]
mov eax, dword [rdx + 0xb4]
cmp dword [0x18015e09c], eax
ja 0x1800063fc
mov eax, dword [0x18015e130]
sub eax, dword [rdx + 4]
sub eax, dword [rbx + 4]
mov dword [rbx + 0x8c], eax
jmp 0x180006415
mov ecx, dword [0x18015e0b4]
mov eax, 0xa4fa3baa
xor ecx, dword [0x18015e144]
sub eax, ecx
add dword [rdx + 0x84], eax
cmp dword [rbx + 0x94], 0x135c3
je 0x18000642f
lea rax, [0x18002b540]
mov qword [rbx + 0xc8], rax
xor r9d, r9d
mov rax, qword [rbx + 0xc8]
mov r8d, dword [r9 + rax]
add r9, 4
mov rax, qword [section..data]
imul r8d, dword [rbx + 0x84]
mov ecx, dword [rax + 0xdc]
mov eax, dword [0x18015e154]
dec eax
mov edx, r8d
add ecx, eax
shr edx, 0x10
mov rax, qword [0x18015e0e0]
mov dword [0x18015e154], ecx
movsxd rcx, dword [rbx + 0x88]
mov byte [rcx + rax], dl
mov edx, r8d
inc dword [rbx + 0x88]
movsxd rcx, dword [rbx + 0x88]
mov rax, qword [rbx + 0xd0]
shr edx, 8
mov byte [rcx + rax], dl
inc dword [rbx + 0x88]
mov ecx, dword [0x18015e038]
mov eax, dword [0x18015e088]
add eax, 0xffffffef
imul ecx, eax
mov dword [0x18015e038], ecx
mov ecx, dword [rbx + 0xb4]
mov eax, dword [rbx + 0xa4]
xor eax, ecx
sub ecx, dword [rbx + 0x50]
sub eax, 0x14
add dword [rbx + 0x10], eax
mov eax, dword [0x18015e130]
mov dword [rbx + 0xb4], ecx
dec eax
add dword [rbx + 0xf8], eax
mov rax, qword [section..data]
movsxd rcx, dword [rax + 0x88]
mov rax, qword [rbx + 0xd0]
mov byte [rcx + rax], r8b
mov rax, qword [section..data]
inc dword [rax + 0x88]
mov eax, 1
mov ecx, dword [rbx + 0x108]
xor ecx, dword [rbx + 0x10]
sub eax, ecx
add dword [rbx + 0xb4], eax
mov eax, dword [rbx + 0x16c]
xor eax, dword [0x18015e118]
sub eax, 0xfbe87
xor dword [rbx + 0x5c], eax
mov rcx, qword [section..data]
mov eax, dword [0x18015e154]
add eax, 0x40923b0
or dword [rcx + 0x15c], eax
mov rcx, qword [section..data]
mov eax, dword [rcx + 4]
add dword [rcx + 0x1c], eax
mov rdx, qword [section..data]
mov eax, dword [0x18015e144]
add eax, 0xffffffba
mov ecx, dword [rdx + 0x16c]
imul ecx, eax
mov dword [rdx + 0x16c], ecx
mov rcx, qword [section..data]
mov eax, dword [rcx + 0xf4]
xor eax, dword [rbx + 0x100]
sub eax, 0x1c55d0
or dword [rcx + 0x14], eax
cmp r9, 0x128b60
jl 0x180006432
xor edi, 0x323
sub edi, 0x2e1
jmp 0x1800067a2
imul esi, r8d
cmp edi, esi
jle 0x1800065e9
mov eax, dword [0x18015e028]
or eax, dword [0x18015e064]
cmp edi, eax
je 0x1800065e9
mov eax, dword [0x18015e11c]
mov rcx, qword [section..data]
or eax, r9d
sub dword [rcx + 0x50], eax
mov eax, dword [rbx + 0x16c]
and eax, edi
xor dword [rbx + 0x134], eax
mov eax, dword [0x18015e020]
sub eax, r8d
add eax, 0x17c6
cmp edi, eax
jbe 0x18000663f
xor ebp, 0x852
imul ebp, dword [0x18015e0ac]
cmp dword [rbx + 0x114], ebp
je 0x180006627
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
jmp 0x1800067a2
mov ecx, dword [rbx + 0xf8]
imul ecx, dword [rbx + 0x8c]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
jmp 0x1800067a2
sub r8d, dword [rbx + 0xe4]
and r8d, r9d
sub dword [rbx + 0x114], r8d
jmp 0x1800067a2
mov rcx, qword [section..data]
mov eax, dword [rcx + 0x6c]
add eax, dword [0x18015e09c]
or eax, edi
add edi, eax
mov eax, dword [rcx + 0x16c]
sub eax, dword [rbx + 0x10]
sub eax, 0x106a
or eax, dword [rbx + 0x38]
add eax, esi
sub dword [0x18015e064], eax
mov ecx, dword [rbx + 0xf8]
sub ecx, dword [rbx + 0x108]
xor rcx, r9
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov rax, qword [section..data]
lea rdx, [0x18015e010]
mov ecx, dword [0x18015e01c]
mov r9d, edi
or ecx, dword [0x18015e168]
mov r8d, dword [rbx + 0x16c]
xor ecx, dword [rax + 0x114]
or r8d, r15d
sub r9d, dword [0x18015e110]
lea eax, [r14 + 0xe20]
or r9d, 0xc46
mov dword [rsp + 0x20], eax
call fcn.180004214
mov r15d, dword [rbx + 0xf8]
mov r13d, eax
mov rax, qword [section..data]
mov ecx, dword [rax + 0x110]
and ecx, esi
imul eax, ecx, 0xfffff076
add dword [rbx + 0x168], eax
mov rax, qword [section..data]
mov ecx, dword [rax + 0x148]
sub ecx, dword [rbx + 0x48]
add dword [rbx + 0x68], ecx
mov rdx, qword [section..data]
mov eax, dword [rdx + 0xf8]
or eax, dword [rbx + 0x100]
cmp r15d, eax
ja 0x1800067a2
mov esi, ebp
and esi, 0xca9
mov r14d, dword [0x18015e118]
cmp r14d, esi
jl 0x18000678e
mov eax, r13d
sub eax, edi
movsxd r12, eax
mov eax, dword [rbx + 0x120]
mov ecx, dword [rdx + 0x16c]
add eax, 0xffffe83a
add ecx, eax
or dword [0x18015e020], ecx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x18015e0c4]
mov rdx, r12
add ecx, ebp
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov rdx, qword [section..data]
add r14d, 4
cmp r14d, esi
jge 0x18000674e
mov ecx, dword [rdx + 0xf8]
inc r15d
or ecx, dword [rbx + 0x100]
cmp r15d, ecx
jbe 0x18000673a
mov rbx, qword [rsp + 0x60]
xor edi, 0x192d
mov rbp, qword [rsp + 0x68]
mov eax, edi
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret