Function at 0x180001240
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xd0
mov rax, qword [0x180008040]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov rsi, rdx
mov edi, ecx
mov qword [rbp - 0x21], rdx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [rax + 0x60]
movzx edx, word [rax + 0x58]
shr rdx, 1
lea r9, [rcx + rdx*2]
mov r8d, 0x1cc57d01
cmp rcx, r9
je 0x1800012cf
nop word [rax + rax]
movsx edx, byte [rcx]
xor edx, r8d
imul r8d, edx, 0x1000193
add rcx, 2
cmp rcx, r9
jne 0x1800012b0
cmp r8d, 0xb94214f7
je 0x1800012d4
mov rax, qword [rax]
jmp 0x180001290
mov rdx, qword [rax + 0x30]
movsxd rax, dword [rdx + 0x3c]
mov ebx, dword [rax + rdx + 0x88]
xor r13d, r13d
mov r9d, r13d
mov r11d, dword [rbx + rdx + 0x20]
nop
mov r10d, r9d
lea rax, [r11 + r10*4]
mov ecx, dword [rax + rdx]
add rcx, rdx
mov r8d, 0x87caa2a0
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x180001331
nop dword [rax]
movsx eax, al
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x180001310
cmp r8d, 0xe542a774
je 0x180001336
inc r9d
jmp 0x1800012f0
mov ecx, dword [rbx + rdx + 0x1c]
add rcx, rdx
mov eax, dword [rbx + rdx + 0x24]
add rax, rdx
movzx eax, word [rax + r10*2]
mov eax, dword [rcx + rax*4]
add rax, rdx
movups xmm0, xmmword [rax]
movaps xmmword [section..syscall], xmm0
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [0x1800fa010], xmm1
movups xmm0, xmmword [rax + 0x20]
movaps xmmword [0x1800fa020], xmm0
movups xmm1, xmmword [rax + 0x30]
movaps xmmword [0x1800fa030], xmm1
movups xmm0, xmmword [rax + 0x40]
movaps xmmword [0x1800fa040], xmm0
movups xmm1, xmmword [rax + 0x50]
movaps xmmword [0x1800fa050], xmm1
mov eax, dword [rax + 0x60]
mov dword [0x1800fa060], eax
movsxd rax, dword [rdx + 0x3c]
mov ebx, dword [rax + rdx + 0x88]
mov r9d, r13d
mov r11d, dword [rbx + rdx + 0x20]
nop dword [rax]
mov r10d, r9d
lea rax, [r11 + r10*4]
mov ecx, dword [rax + rdx]
add rcx, rdx
mov r8d, 0xa0b980da
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1800013f1
nop dword [rax]
movsx eax, al
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x1800013d0
cmp r8d, 0x8ebdeb53
je 0x1800013f6
inc r9d
jmp 0x1800013b0
mov ecx, dword [rbx + rdx + 0x1c]
add rcx, rdx
mov eax, dword [rbx + rdx + 0x24]
add rax, rdx
movzx eax, word [rax + r10*2]
mov eax, dword [rcx + rax*4]
add rax, rdx
movups xmm0, xmmword [rax]
movups xmmword [0x1800fa064], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [0x1800fa074], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [0x1800fa084], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [0x1800fa094], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [0x1800fa0a4], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [0x1800fa0b4], xmm1
mov eax, dword [rax + 0x60]
mov dword [0x1800fa0c4], eax
movsxd rax, dword [rdx + 0x3c]
mov ebx, dword [rax + rdx + 0x88]
mov r9d, r13d
mov r11d, dword [rbx + rdx + 0x20]
nop dword [rax]
mov r10d, r9d
lea rax, [r11 + r10*4]
mov ecx, dword [rax + rdx]
add rcx, rdx
mov r8d, 0xa1bbc104
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1800014b1
nop dword [rax]
movsx eax, al
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x180001490
cmp r8d, 0xdfd3caf0
je 0x1800014b6
inc r9d
jmp 0x180001470
mov ecx, dword [rbx + rdx + 0x1c]
add rcx, rdx
mov eax, dword [rbx + rdx + 0x24]
add rax, rdx
movzx eax, word [rax + r10*2]
mov eax, dword [rcx + rax*4]
add rax, rdx
movups xmm0, xmmword [rax]
movups xmmword [0x1800fa0c8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [0x1800fa0d8], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [0x1800fa0e8], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [0x1800fa0f8], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [0x1800fa108], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [0x1800fa118], xmm1
mov eax, dword [rax + 0x60]
mov dword [0x1800fa128], eax
movsxd rax, dword [rdx + 0x3c]
mov ebx, dword [rax + rdx + 0x88]
mov r9d, r13d
mov r11d, dword [rbx + rdx + 0x20]
nop dword [rax]
mov r10d, r9d
lea rax, [r11 + r10*4]
mov ecx, dword [rax + rdx]
add rcx, rdx
mov r8d, 0xaa1809b
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x180001571
nop dword [rax]
movsx eax, al
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x180001550
cmp r8d, 0xaab338d2
je 0x180001576
inc r9d
jmp 0x180001530
mov ecx, dword [rbx + rdx + 0x1c]
add rcx, rdx
mov eax, dword [rbx + rdx + 0x24]
add rax, rdx
movzx eax, word [rax + r10*2]
mov eax, dword [rcx + rax*4]
add rax, rdx
movups xmm0, xmmword [rax]
movups xmmword [0x1800fa12c], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [0x1800fa13c], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [0x1800fa14c], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [0x1800fa15c], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [0x1800fa16c], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [0x1800fa17c], xmm1
mov eax, dword [rax + 0x60]
mov dword [0x1800fa18c], eax
movsxd rax, dword [rdx + 0x3c]
mov ebx, dword [rax + rdx + 0x88]
mov r9d, r13d
mov r11d, dword [rbx + rdx + 0x20]
nop dword [rax]
mov r10d, r9d
lea rax, [r11 + r10*4]
mov ecx, dword [rax + rdx]
add rcx, rdx
mov r8d, 0xd9f46bd
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x180001631
nop dword [rax]
movsx eax, al
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x180001610
cmp r8d, 0x9a8c6693
je 0x180001636
inc r9d
jmp 0x1800015f0
mov ecx, dword [rbx + rdx + 0x1c]
add rcx, rdx
mov eax, dword [rbx + rdx + 0x24]
add rax, rdx
movzx eax, word [rax + r10*2]
mov eax, dword [rcx + rax*4]
add rax, rdx
movups xmm0, xmmword [rax]
movaps xmmword [0x1800fa190], xmm0
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [0x1800fa1a0], xmm1
movups xmm0, xmmword [rax + 0x20]
movaps xmmword [0x1800fa1b0], xmm0
movups xmm1, xmmword [rax + 0x30]
movaps xmmword [0x1800fa1c0], xmm1
movups xmm0, xmmword [rax + 0x40]
movaps xmmword [0x1800fa1d0], xmm0
movups xmm1, xmmword [rax + 0x50]
movaps xmmword [0x1800fa1e0], xmm1
mov eax, dword [rax + 0x60]
mov dword [0x1800fa1f0], eax
movsxd rax, dword [rdx + 0x3c]
mov ebx, dword [rax + rdx + 0x88]
mov r9d, r13d
mov r11d, dword [rbx + rdx + 0x20]
nop dword [rax]
mov r10d, r9d
lea rax, [r11 + r10*4]
mov ecx, dword [rax + rdx]
add rcx, rdx
mov r8d, 0xfc9ced63
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1800016f1
nop dword [rax]
movsx eax, al
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x1800016d0
cmp r8d, 0x63b83e85
je 0x1800016f6
inc r9d
jmp 0x1800016b0
mov ecx, dword [rbx + rdx + 0x1c]
add rcx, rdx
mov eax, dword [rbx + rdx + 0x24]
add rax, rdx
movzx eax, word [rax + r10*2]
mov eax, dword [rcx + rax*4]
add rax, rdx
movups xmm0, xmmword [rax]
movups xmmword [0x1800fa1f4], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [0x1800fa204], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [0x1800fa214], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [0x1800fa224], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [0x1800fa234], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [0x1800fa244], xmm1
mov eax, dword [rax + 0x60]
mov dword [0x1800fa254], eax
movsxd rax, dword [rdx + 0x3c]
mov ebx, dword [rax + rdx + 0x88]
mov r9d, r13d
mov r11d, dword [rbx + rdx + 0x20]
nop dword [rax]
mov r10d, r9d
lea rax, [r11 + r10*4]
mov ecx, dword [rax + rdx]
add rcx, rdx
mov r8d, 0x7b99e3b9
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1800017b1
nop dword [rax]
movsx eax, al
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x180001790
cmp r8d, 0x44154cb9
je 0x1800017b6
inc r9d
jmp 0x180001770
mov ecx, dword [rbx + rdx + 0x1c]
add rcx, rdx
mov eax, dword [rbx + rdx + 0x24]
add rax, rdx
movzx eax, word [rax + r10*2]
mov eax, dword [rcx + rax*4]
add rax, rdx
movups xmm0, xmmword [rax]
movups xmmword [0x1800fa258], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [0x1800fa268], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [0x1800fa278], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [0x1800fa288], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [0x1800fa298], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [0x1800fa2a8], xmm1
mov eax, dword [rax + 0x60]
mov dword [0x1800fa2b8], eax
mov qword [rbp - 0x49], r13
xorps xmm0, xmm0
movups xmmword [rbp - 0x11], xmm0
movups xmmword [rbp - 1], xmm0
movups xmmword [rbp + 0xf], xmm0
mov qword [rbp - 0x29], r13
mov qword [rbp - 0x31], rdi
lea r12, [section..syscall]
lea r9, [rbp - 0x31]
lea r8, [rbp - 0x11]
mov edx, 0x1fffff
lea rcx, [rbp - 0x49]
call r12
lea r15, [0x1800fa064]
test eax, eax
jns 0x18000186d
mov edx, eax
lea rcx, str.ZwOpenProcess_failed:__08X_n
call fcn.180001020
jmp 0x1800019ea
mov qword [rbp - 0x41], r13
mov rax, qword [rsi + 8]
sub rax, qword [rsi]
add rax, 0x434
and rax, 0xfffffffffffff000
add rax, 0x2000
mov qword [rbp - 0x19], rax
lea rax, [0x1800fa0c8]
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x3000
lea r9, [rbp - 0x19]
xor r8d, r8d
lea rdx, [rbp - 0x41]
mov rcx, qword [rbp - 0x49]
call rax
test eax, eax
jns 0x1800018cd
mov edx, eax
lea rcx, str.ZwAllocateVirtualMemory_failed:__08X_n
call fcn.180001020
jmp 0x1800019ea
mov rbx, qword [rbp - 0x41]
lea rdi, [rbx + 0x1000]
lea r14, [0x1800fa190]
mov qword [rsp + 0x20], r13
mov r9d, 0x434
lea r8, str._SUWH
mov rdx, rbx
mov rcx, qword [rbp - 0x49]
call r14
test eax, eax
jns 0x180001912
mov edx, eax
lea rcx, str.ZwWriteVirtualMemory1_failed:__08X_n
call fcn.180001020
jmp 0x1800019ea
mov r8, qword [rsi]
mov r9, qword [rsi + 8]
sub r9, r8
mov qword [rsp + 0x20], r13
mov rdx, rdi
mov rcx, qword [rbp - 0x49]
call r14
test eax, eax
jns 0x180001942
mov edx, eax
lea rcx, str.ZwWriteVirtualMemory2_failed:__08X_n
call fcn.180001020
jmp 0x1800019ea
mov qword [rbp - 0x39], r13
lea rax, [0x1800fa1f4]
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x30], r13d
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9, qword [rbp - 0x49]
xor r8d, r8d
mov edx, 0x1fffff
lea rcx, [rbp - 0x39]
call rax
test eax, eax
jns 0x180001996
mov edx, eax
lea rcx, str.ZwCreateThreadEx_failed:__08X_n
call fcn.180001020
jmp 0x1800019ea
lea rax, [0x1800fa258]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x39]
call rax
lea rax, [0x1800fa12c]
mov r9d, 0x8000
lea r8, [rbp - 0x19]
lea rdx, [rbp - 0x41]
mov rcx, qword [rbp - 0x49]
call rax
test eax, eax
jns 0x1800019d7
mov edx, eax
lea rcx, str.ZwFreeVirtualMemory_failed:__08X_n
call fcn.180001020
jmp 0x1800019ea
mov rcx, qword [rbp - 0x39]
call r15
lea rcx, str.Start_succeeded._n
call fcn.180001020
mov rcx, qword [rbp - 0x49]
call r15
xor edx, edx
mov r8d, 0x1000
mov rcx, r12
call sub.VCRUNTIME140.dll_memset
nop
mov rcx, qword [rsi]
test rcx, rcx
je 0x180001a42
mov rdx, qword [rsi + 0x10]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x180001a32
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180001a69
mov rcx, r8
call fcn.180002f94
mov qword [rsi], r13
mov qword [rsi + 8], r13
mov qword [rsi + 0x10], r13
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.180002f30
mov rbx, qword [rsp + 0x120]
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3