Function at 0x18001be60
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x30
mov rax, qword gs:[0x58]
mov rsi, rcx
mov ecx, dword [0x180291d08]
mov ebx, edx
mov edx, 0x28
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x18025b848], ecx
jg 0x18001c2b7
cmp ebx, 1
jne 0x18001c2a7
mov rax, qword gs:[0x60]
mov qword [rsp + 0x48], rdi
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x18001bf37
mov r9d, dword ds:[rbx + 0x18]
test r9d, r9d
je 0x18001bf37
mov edi, dword [rbx + 0x20]
nop dword [rax + rax]
dec r9d
mov r8d, 0xa948fae7
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x18001bf32
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x18001bf10
cmp r8d, 0x43d62b61
je 0x18001bf3c
test r9d, r9d
jne 0x18001bef0
mov rax, qword [rax]
jmp 0x18001bec0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov rcx, rsi
add rax, r10
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x18001bfee
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x18001bfee
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x244e39b6
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x18001bfe9
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x18001bfc0
nop dword [rax]
cmp r8d, 0xf97ad286
je 0x18001bff6
test r9d, r9d
jne 0x18001bfa0
mov rax, qword [rax]
jmp 0x18001bf70
mov ecx, dword [rbx + 0x24]
lea r8, [0x18001a4d0]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov r9, rsi
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
mov qword [rsp + 0x28], rcx
add rax, r10
xor edx, edx
mov dword [rsp + 0x20], ecx
call rax
mov rsi, rax
test rax, rax
je 0x18001c0f2
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rcx + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov ebx, dword [rdx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x18001c0ce
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x18001c0ce
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xc968edc1
lea rax, [rdi + r9*4]
mov edx, dword [rax + r10]
add rdx, r10
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x18001c0c9
nop
movsx eax, al
lea rdx, [rdx + 1]
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx - 1]
test al, al
jne 0x18001c0a0
nop dword [rax]
cmp r8d, 0xf211cd61
je 0x18001c0d6
test r9d, r9d
jne 0x18001c080
mov rcx, qword [rcx]
jmp 0x18001c050
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov rcx, rsi
add rax, r10
call rax
mov rax, qword [0x18025b858]
nop dword [rax]
test rax, rax
jne 0x18001c1ba
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x18001c197
mov r9d, dword ds:[rbx + 0x18]
test r9d, r9d
je 0x18001c197
mov edi, dword [rbx + 0x20]
nop dword [rax + rax]
dec r9d
mov r8d, 0x1f9547ee
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x18001c192
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x18001c170
cmp r8d, 0xaeac6696
je 0x18001c19c
test r9d, r9d
jne 0x18001c150
mov rax, qword [rax]
jmp 0x18001c120
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov qword [0x18025b858], rax
mov edx, 0x96
lea ecx, [rdx + 0x68]
call rax
mov rax, qword [0x18025b850]
test rax, rax
jne 0x18001c297
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x18001c26e
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x18001c26e
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x926550f4
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x18001c269
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x18001c240
nop dword [rax]
cmp r8d, 0x2a26b290
je 0x18001c276
test r9d, r9d
jne 0x18001c220
mov rax, qword [rax]
jmp 0x18001c1f0
mov r8d, dword [rbx + 0x24]
add r8, r10
movzx r9d, word [r8 + r9*2]
mov r8d, dword [rbx + 0x1c]
add r8, r10
mov eax, dword [r8 + r9*4]
add rax, r10
mov qword [0x18025b850], rax
mov edx, 0x96
lea ecx, [rdx + 0x68]
call rax
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
mov eax, 1
add rsp, 0x30
pop rsi
ret
lea rcx, [0x18025b848]
nop
call fcn.180080450
cmp dword [0x18025b848], 0xffffffff
jne 0x18001be96
lea rcx, [0x1800eb9c0]
call fcn.180080960
lea rcx, [0x18025b848]
call fcn.1800803e4
jmp 0x18001be96