Function at 0x18000d560
Capabilities:
Access peb ldr_data
Encode data using xor
Get kernel32 base address
Get number of processors
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
mov ebx, r9d
mov esi, r8d
mov r14, rdx
xor edi, edi
xor ecx, ecx
call fcn.18000c8ea
test rax, rax
je 0x18000d9d2
mov byte [rsp + 0x2f], bl
mov dword [rsp + 0x5c], esi
movsxd rcx, dword [rax + 0x3c]
lea rdx, [rax + rcx]
mov qword [rsp + 0x48], rax
movzx eax, word [rax + rcx + 0x14]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rax
mov eax, dword [rax + rdx + 0x28]
mov qword [rsp + 0x30], rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0xa0], 0
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x18000d5e3
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x18000d5e3
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov r15d, dword [r9 + r11*4]
mov bpl, byte [rax + r15]
test bpl, bpl
je 0x18000d65e
add r15, r10
mov edi, 0xa71e657e
movsx esi, bpl
lea ebp, [rsi - 0x41]
mov r12d, esi
or r12d, 0x20
cmp bpl, 0x1a
cmovae r12d, esi
xor r12d, edi
imul edi, r12d, 0x1000193
mov bpl, byte [r15]
inc r15
test bpl, bpl
jne 0x18000d62b
cmp edi, 0x45a94c38
je 0x18000d668
test r11, r11
jne 0x18000d610
jmp 0x18000d5e3
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
mov rcx, r14
call rdx
mov qword [rsp + 0x60], r14
test rax, rax
jle 0x18000d7c2
mov r15, rax
add r15, r14
lea r12, [rsp + 0x90]
cmp byte [r14], 0x3f
jne 0x18000d6cf
lea rax, [r14 + 1]
mov qword [rsp + 0x60], rax
mov edx, 0xffffffff
cmp byte [r14 + 1], 0x3f
jne 0x18000d792
add r14, 2
mov qword [rsp + 0x60], r14
jmp 0x18000d792
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x18000d6e0
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x18000d6e0
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov ebp, dword [r9 + r11*4]
mov sil, byte [rax + rbp]
test sil, sil
je 0x18000d75b
add rbp, r10
mov edi, 0x510c3158
movsx esi, sil
lea ebx, [rsi - 0x41]
mov r13d, esi
or r13d, 0x20
cmp bl, 0x1a
cmovae r13d, esi
xor r13d, edi
imul edi, r13d, 0x1000193
mov sil, byte [rbp]
inc rbp
test sil, sil
jne 0x18000d728
cmp edi, 0x9c4fe1bb
je 0x18000d765
test r11, r11
jne 0x18000d70d
jmp 0x18000d6e0
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov r9d, dword [rcx + rdx*4]
add r9, rax
mov rcx, r14
lea rdx, [rsp + 0x60]
mov r8d, 0x10
call r9
mov edx, eax
mov rcx, r12
call fcn.18000dab4
mov r14, qword [rsp + 0x60]
inc r14
mov qword [rsp + 0x60], r14
cmp r14, r15
jb 0x18000d6a2
mov r9, qword [rsp + 0x90]
mov r10, qword [rsp + 0xa0]
jmp 0x18000d7c8
xor r9d, r9d
xor r10d, r10d
mov rbx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov r8, qword [rsp + 0x38]
mov eax, dword [rax + r8 + 0x24]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
xor edi, edi
sub rcx, r10
je 0x18000d9c5
add rbx, rax
xor r8d, r8d
xor r11d, r11d
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0xb0], r9
mov qword [rsp + 0xa8], r10
mov eax, r8d
mov qword [rsp + 0x50], rax
test r10, r10
je 0x18000d9a1
mov rax, qword [rsp + 0x50]
lea rsi, [rbx + rax]
xor r15d, r15d
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x38], rsi
lea rcx, [rsi + r15]
cmp rcx, r11
jb 0x18000d956
mov qword [rsp + 0x48], r11
mov rax, qword gs:[0x60]
mov rdx, qword [rax + 0x18]
add rdx, 0x10
mov rdx, qword [rdx]
mov rax, qword [rdx + 0x30]
movsxd r8, dword [rax + 0x3c]
mov r8d, dword [rax + r8 + 0x88]
test r8, r8
je 0x18000d869
mov r9d, dword [rax + r8 + 0x18]
test r9, r9
je 0x18000d869
mov r10d, dword [rax + r8 + 0x20]
add r10, rax
lea r11, [rax + 1]
dec r9
mov ebp, r9d
mov edi, dword [r10 + rbp*4]
mov r13b, byte [rax + rdi]
test r13b, r13b
je 0x18000d8e7
add rdi, r11
mov r12d, 0xe583f3a0
movsx r13d, r13b
lea r14d, [r13 - 0x41]
mov esi, r13d
or esi, 0x20
cmp r14b, 0x1a
cmovae esi, r13d
xor esi, r12d
imul r12d, esi, 0x1000193
mov r13b, byte [rdi]
inc rdi
test r13b, r13b
jne 0x18000d8b3
cmp r12d, 0x3d71dd39
je 0x18000d8f1
test rbp, rbp
jne 0x18000d897
jmp 0x18000d869
mov edx, dword [rax + r8 + 0x1c]
mov r8d, dword [rax + r8 + 0x24]
add rdx, rax
add r8, rax
movzx r8d, word [r8 + rbp*2]
mov r9d, dword [rdx + r8*4]
add r9, rax
mov r8d, 0x30
lea rdx, [rsp + 0x60]
call r9
test rax, rax
mov r9, qword [rsp + 0xb0]
mov r10, qword [rsp + 0xa8]
mov r8, qword [rsp + 0x40]
mov r11, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x38]
je 0x18000d9a1
cmp dword [rsp + 0x84], 1
mov rax, qword [rsp + 0x60]
je 0x18000d979
add rax, qword [rsp + 0x78]
mov r11, rax
lea eax, [r15 + r8]
movzx ecx, byte [rbx + rax]
mov eax, dword [r9 + r15*4]
cmp eax, ecx
je 0x18000d96b
cmp eax, 0xffffffff
jne 0x18000d98c
inc r15d
cmp r10, r15
ja 0x18000d846
jmp 0x18000d9a1
mov rcx, qword [rsp + 0x50]
add ecx, ebx
sub eax, ecx
add eax, dword [rsp + 0x78]
add r8d, eax
dec r8d
mov rcx, qword [rsp + 0x30]
xor edi, edi
inc r8d
cmp rcx, r8
ja 0x18000d81f
jmp 0x18000d9c5
add rbx, qword [rsp + 0x50]
cmp byte [rsp + 0x2f], 0
je 0x18000d9c2
movsxd rax, dword [rsp + 0x5c]
mov rcx, rbx
add rcx, rax
movsxd rdi, dword [rbx + rax - 4]
add rdi, rcx
jmp 0x18000d9c5
mov rdi, rbx
lea rcx, [rsp + 0x90]
call fcn.18000d9ea
mov rax, rdi
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret