Function at 0x18001eb44
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x28], r8
mov rsi, rdx
mov rax, qword [rdx]
test rax, rax
je 0x18001eba3
movabs rcx, 0x7ffffffdfffe
mov rdx, 0xfffffffffffeffff
mov r8, qword [rax]
add r8, rdx
cmp r8, rcx
jae 0x18001eba3
add rax, 8
xor r8d, r8d
inc r8
mov r9, qword [rax]
add r9, rdx
add rax, 8
cmp r9, rcx
jb 0x18001eb8c
mov r15d, r8d
jmp 0x18001eba6
xor r15d, r15d
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x18001ebb7
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x18001ebb7
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov r14d, dword [r9 + r11*4]
mov r13b, byte [rax + r14]
test r13b, r13b
je 0x18001ec34
add r14, r10
mov r12d, 0xf7bc1f61
movsx r13d, r13b
lea ebp, [r13 - 0x41]
mov edi, r13d
or edi, 0x20
cmp bpl, 0x1a
cmovae edi, r13d
xor edi, r12d
imul r12d, edi, 0x1000193
mov r13b, byte [r14]
inc r14
test r13b, r13b
jne 0x18001ec00
cmp r12d, 0x1b0d5bf5
je 0x18001ec3e
test r11, r11
jne 0x18001ebe4
jmp 0x18001ebb7
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov r10d, dword [rcx + rdx*4]
add r10, rax
xor ecx, ecx
mov rdx, r15
mov r8d, 0x1000
mov r9d, 0x40
call r10
mov r14, rax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x18001ec80
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x18001ec80
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov r12d, dword [r9 + r11*4]
mov bpl, byte [rax + r12]
test bpl, bpl
je 0x18001ecfb
add r12, r10
mov r13d, 0x5903ff80
movsx edi, bpl
lea ebp, [rdi - 0x41]
mov ebx, edi
or ebx, 0x20
cmp bpl, 0x1a
cmovae ebx, edi
xor ebx, r13d
imul r13d, ebx, 0x1000193
mov bpl, byte [r12]
inc r12
test bpl, bpl
jne 0x18001ecc9
cmp r13d, 0x394ab9a
je 0x18001ed05
test r11, r11
jne 0x18001ecad
jmp 0x18001ec80
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov r8d, dword [rcx + rdx*4]
add r8, rax
mov edx, 8
mov rcx, r15
call r8
mov r12, rax
test rax, rax
je 0x18001edac
mov rdx, qword [rsi]
shl r15, 3
mov rcx, r12
mov r8, r15
call fcn.18001e6ec
lea r15, [rsp + 0x38]
mov word [r15 + 4], 0
mov dword [r15], 0x25ff
mov rax, qword [rsp + 0x28]
mov qword [r15 + 6], rax
mov r8d, 0xe
mov rcx, r14
mov rdx, r15
call fcn.18001e6ec
mov edi, dword [rsp + 0xb0]
mov rax, qword [r12 + rdi*8]
mov qword [r15 + 6], rax
mov rbx, r14
add rbx, 0xe
mov r8d, 0xe
mov rcx, rbx
mov rdx, r15
call fcn.18001e6ec
mov rax, qword [rsp + 0x30]
mov qword [rax], rbx
mov qword [r12 + rdi*8], r14
mov qword [rsi], r12
jmp 0x18001ee62
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x18001edbd
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x18001edbd
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
mov bl, byte [rax + rsi]
test bl, bl
je 0x18001ee33
add rsi, r10
mov edi, 0x6729c3b4
movsx ebx, bl
lea ebp, [rbx - 0x41]
mov r15d, ebx
or r15d, 0x20
cmp bpl, 0x1a
cmovae r15d, ebx
xor r15d, edi
imul edi, r15d, 0x1000193
mov bl, byte [rsi]
inc rsi
test bl, bl
jne 0x18001ee03
cmp edi, 0xd27b1c55
je 0x18001ee3a
test r11, r11
jne 0x18001edea
jmp 0x18001edbd
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov r9d, dword [rcx + rdx*4]
add r9, rax
mov rcx, r14
xor edx, edx
mov r8d, 0x8000
call r9
test r12, r12
setne al
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret