Function at 0x18001315c
Capabilities:
Access peb ldr_data
Encode data using xor
Get kernel32 base address
Get number of processors
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
mov ebx, r9d
mov esi, r8d
mov r14, rdx
xor edi, edi
xor ecx, ecx
call fcn.1800124e6
test rax, rax
je 0x1800135ce
mov byte [rsp + 0x2f], bl
mov dword [rsp + 0x5c], esi
movsxd rcx, dword [rax + 0x3c]
lea rdx, [rax + rcx]
mov qword [rsp + 0x48], rax
movzx eax, word [rax + rcx + 0x14]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rax
mov eax, dword [rax + rdx + 0x28]
mov qword [rsp + 0x30], rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0xa0], 0
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x1800131df
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x1800131df
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov r15d, dword [r9 + r11*4]
mov bpl, byte [rax + r15]
test bpl, bpl
je 0x18001325a
add r15, r10
mov edi, 0x1a888a73
movsx esi, bpl
lea ebp, [rsi - 0x41]
mov r12d, esi
or r12d, 0x20
cmp bpl, 0x1a
cmovae r12d, esi
xor r12d, edi
imul edi, r12d, 0x1000193
mov bpl, byte [r15]
inc r15
test bpl, bpl
jne 0x180013227
cmp edi, 0x1583b181
je 0x180013264
test r11, r11
jne 0x18001320c
jmp 0x1800131df
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
mov rcx, r14
call rdx
mov qword [rsp + 0x60], r14
test rax, rax
jle 0x1800133be
mov r15, rax
add r15, r14
lea r12, [rsp + 0x90]
cmp byte [r14], 0x3f
jne 0x1800132cb
lea rax, [r14 + 1]
mov qword [rsp + 0x60], rax
mov edx, 0xffffffff
cmp byte [r14 + 1], 0x3f
jne 0x18001338e
add r14, 2
mov qword [rsp + 0x60], r14
jmp 0x18001338e
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x1800132dc
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x1800132dc
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov ebp, dword [r9 + r11*4]
mov sil, byte [rax + rbp]
test sil, sil
je 0x180013357
add rbp, r10
mov edi, 0x62c56de7
movsx esi, sil
lea ebx, [rsi - 0x41]
mov r13d, esi
or r13d, 0x20
cmp bl, 0x1a
cmovae r13d, esi
xor r13d, edi
imul edi, r13d, 0x1000193
mov sil, byte [rbp]
inc rbp
test sil, sil
jne 0x180013324
cmp edi, 0x60c9054a
je 0x180013361
test r11, r11
jne 0x180013309
jmp 0x1800132dc
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov r9d, dword [rcx + rdx*4]
add r9, rax
mov rcx, r14
lea rdx, [rsp + 0x60]
mov r8d, 0x10
call r9
mov edx, eax
mov rcx, r12
call fcn.1800136b0
mov r14, qword [rsp + 0x60]
inc r14
mov qword [rsp + 0x60], r14
cmp r14, r15
jb 0x18001329e
mov r9, qword [rsp + 0x90]
mov r10, qword [rsp + 0xa0]
jmp 0x1800133c4
xor r9d, r9d
xor r10d, r10d
mov rbx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov r8, qword [rsp + 0x38]
mov eax, dword [rax + r8 + 0x24]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
xor edi, edi
sub rcx, r10
je 0x1800135c1
add rbx, rax
xor r8d, r8d
xor r11d, r11d
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0xb0], r9
mov qword [rsp + 0xa8], r10
mov eax, r8d
mov qword [rsp + 0x50], rax
test r10, r10
je 0x18001359d
mov rax, qword [rsp + 0x50]
lea rsi, [rbx + rax]
xor r15d, r15d
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x38], rsi
lea rcx, [rsi + r15]
cmp rcx, r11
jb 0x180013552
mov qword [rsp + 0x48], r11
mov rax, qword gs:[0x60]
mov rdx, qword [rax + 0x18]
add rdx, 0x10
mov rdx, qword [rdx]
mov rax, qword [rdx + 0x30]
movsxd r8, dword [rax + 0x3c]
mov r8d, dword [rax + r8 + 0x88]
test r8, r8
je 0x180013465
mov r9d, dword [rax + r8 + 0x18]
test r9, r9
je 0x180013465
mov r10d, dword [rax + r8 + 0x20]
add r10, rax
lea r11, [rax + 1]
dec r9
mov ebp, r9d
mov edi, dword [r10 + rbp*4]
mov r13b, byte [rax + rdi]
test r13b, r13b
je 0x1800134e3
add rdi, r11
mov r12d, 0xe7ffe5a5
movsx r13d, r13b
lea r14d, [r13 - 0x41]
mov esi, r13d
or esi, 0x20
cmp r14b, 0x1a
cmovae esi, r13d
xor esi, r12d
imul r12d, esi, 0x1000193
mov r13b, byte [rdi]
inc rdi
test r13b, r13b
jne 0x1800134af
cmp r12d, 0xfcecea18
je 0x1800134ed
test rbp, rbp
jne 0x180013493
jmp 0x180013465
mov edx, dword [rax + r8 + 0x1c]
mov r8d, dword [rax + r8 + 0x24]
add rdx, rax
add r8, rax
movzx r8d, word [r8 + rbp*2]
mov r9d, dword [rdx + r8*4]
add r9, rax
mov r8d, 0x30
lea rdx, [rsp + 0x60]
call r9
test rax, rax
mov r9, qword [rsp + 0xb0]
mov r10, qword [rsp + 0xa8]
mov r8, qword [rsp + 0x40]
mov r11, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x38]
je 0x18001359d
cmp dword [rsp + 0x84], 1
mov rax, qword [rsp + 0x60]
je 0x180013575
add rax, qword [rsp + 0x78]
mov r11, rax
lea eax, [r15 + r8]
movzx ecx, byte [rbx + rax]
mov eax, dword [r9 + r15*4]
cmp eax, ecx
je 0x180013567
cmp eax, 0xffffffff
jne 0x180013588
inc r15d
cmp r10, r15
ja 0x180013442
jmp 0x18001359d
mov rcx, qword [rsp + 0x50]
add ecx, ebx
sub eax, ecx
add eax, dword [rsp + 0x78]
add r8d, eax
dec r8d
mov rcx, qword [rsp + 0x30]
xor edi, edi
inc r8d
cmp rcx, r8
ja 0x18001341b
jmp 0x1800135c1
add rbx, qword [rsp + 0x50]
cmp byte [rsp + 0x2f], 0
je 0x1800135be
movsxd rax, dword [rsp + 0x5c]
mov rcx, rbx
add rcx, rax
movsxd rdi, dword [rbx + rax - 4]
add rdi, rcx
jmp 0x1800135c1
mov rdi, rbx
lea rcx, [rsp + 0x90]
call fcn.1800135e6
mov rax, rdi
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret