Function at 0x18005de10
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
movabs rsi, 0x4e94914f0000
movabs rbp, 0x431bde82d7b634db
movabs r15, 0x7fffffffe2329aff
movabs r14, 0x7fffffffffffffff
nop dword [rax]
call fcn.18005fd30
test al, al
je 0x18005df0a
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x18005dee7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x18005dee7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x54faea5c
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x18005dee2
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x18005dec0
cmp r8d, 0xea4b198c
je 0x18005deec
test r9d, r9d
jne 0x18005dea0
mov rax, qword [rax]
jmp 0x18005de70
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov ecx, 1
add rax, r10
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x18005df97
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x18005df97
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x51df0f26
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rdi]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x18005df92
nop dword [rax]
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x18005df70
cmp r8d, 0x902dee08
je 0x18005df9c
test r9d, r9d
jne 0x18005df50
mov rax, qword [rax]
jmp 0x18005df20
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
call rax
test eax, eax
je 0x18005e06a
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x18005e047
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x18005e047
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x7ef8026
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rdi]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x18005e042
nop dword [rax]
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x18005e020
cmp r8d, 0xadd7e08e
je 0x18005e04c
test r9d, r9d
jne 0x18005e000
mov rax, qword [rax]
jmp 0x18005dfd0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov ecx, 1
add rax, r10
call rax
call fcn.18005e340
test eax, eax
je 0x18005e12a
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x18005e107
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x18005e107
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x20fc7374
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rdi]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x18005e102
nop dword [rax]
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x18005e0e0
cmp r8d, 0x8def2e84
je 0x18005e10c
test r9d, r9d
jne 0x18005e0c0
mov rax, qword [rax]
jmp 0x18005e090
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov ecx, 1
add rax, r10
call rax
call fcn.18005f110
test al, al
je 0x18005e1ea
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x18005e1c7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x18005e1c7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x8886e977
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rdi]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x18005e1c2
nop dword [rax]
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x18005e1a0
cmp r8d, 0xe85dc3b7
je 0x18005e1cc
test r9d, r9d
jne 0x18005e180
mov rax, qword [rax]
jmp 0x18005e150
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov ecx, 1
add rax, r10
call rax
call fcn.18005edf0
test eax, eax
je 0x18005e2aa
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x18005e287
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x18005e287
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xfb8e5a45
lea rcx, [r10 + r9*4]
mov ecx, dword [rcx + rdi]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x18005e282
nop dword [rax]
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x18005e260
cmp r8d, 0x52de1f05
je 0x18005e28c
test r9d, r9d
jne 0x18005e240
mov rax, qword [rax]
jmp 0x18005e210
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov ecx, 1
add rax, r10
call rax
lea rcx, [rsp + 0x58]
call fcn.18005dd30
mov rbx, qword [rsp + 0x58]
cmp rbx, r15
jge 0x18005e2c7
add rbx, 0x1dcd6500
jmp 0x18005e2ca
mov rbx, r14
lea rcx, [rsp + 0x50]
call fcn.18005dd30
mov rax, qword [rsp + 0x50]
cmp rax, rbx
jge 0x18005de50
mov rcx, rbx
sub rcx, rax
cmp rcx, rsi
jl 0x18005e2f4
mov ecx, 0x5265c00
jmp 0x18005e319
mov rax, rbp
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x18005e317
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
lea rcx, [rsp + 0x50]
call fcn.18005dd30
mov rax, qword [rsp + 0x50]
cmp rax, rbx
jl 0x18005e2e2
jmp 0x18005de50