Function at 0x18002e23c
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r13
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1802107c0]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [0x180216818]
or r13d, 0xffffffff
mov rdi, 0xffffffff80000001
mov r14, r8
mov qword [rbp - 0x20], rdi
test rax, rax
jne 0x18002e324
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r11d, dword [rcx + r8 + 0x88]
add r11, r8
cmp r11, r8
je 0x18002e2ff
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x18002e2ff
mov ebx, dword [r11 + 0x20]
add r9d, r13d
lea rdx, [r8 + r9*4]
mov r10d, dword [rdx + rbx]
mov edx, 0x80fd1281
add r10, r8
mov cl, byte [r10]
inc r10
test cl, cl
je 0x18002e2fa
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
mov cl, byte [r10]
inc r10
test cl, cl
jne 0x18002e2dd
cmp edx, 0xa4d1cf6c
je 0x18002e304
test r9d, r9d
jne 0x18002e2c0
mov rax, qword [rax]
jmp 0x18002e29b
mov ecx, dword [r11 + 0x24]
mov edx, dword [r11 + 0x1c]
add rcx, r8
add rdx, r8
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r8
mov qword [0x180216818], rax
mov rdx, r14
mov rcx, rdi
call rax
test eax, eax
jne 0x18002e337
mov al, 1
jmp 0x18002e8e2
mov rax, qword [0x180216820]
test rax, rax
jne 0x18002e3e1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r11d, dword [rcx + r8 + 0x88]
add r11, r8
cmp r11, r8
je 0x18002e3bc
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x18002e3bc
mov ebx, dword [r11 + 0x20]
add r9d, r13d
lea rdx, [r8 + r9*4]
mov r10d, dword [rdx + rbx]
mov edx, 0x6fe7316f
add r10, r8
mov cl, byte [r10]
inc r10
test cl, cl
je 0x18002e3b7
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
mov cl, byte [r10]
inc r10
test cl, cl
jne 0x18002e39a
cmp edx, 0x61894f6
je 0x18002e3c1
test r9d, r9d
jne 0x18002e37d
mov rax, qword [rax]
jmp 0x18002e358
mov ecx, dword [r11 + 0x24]
mov edx, dword [r11 + 0x1c]
add rcx, r8
add rdx, r8
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r8
mov qword [0x180216820], rax
lea rcx, [rbp - 0x20]
mov r9d, 0x20019
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, qword [rbp - 0x20]
mov rdx, r14
call rax
cmp eax, 2
je 0x18002e8e0
mov rax, qword [0x180216828]
test rax, rax
jne 0x18002e4af
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r11d, dword [rcx + r8 + 0x88]
add r11, r8
cmp r11, r8
je 0x18002e48a
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x18002e48a
mov ebx, dword [r11 + 0x20]
add r9d, r13d
lea rdx, [rbx + r9*4]
mov r10d, dword [rdx + r8]
mov edx, 0x59645a57
add r10, r8
mov cl, byte [r10]
inc r10
test cl, cl
je 0x18002e485
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
mov cl, byte [r10]
inc r10
test cl, cl
jne 0x18002e468
cmp edx, 0xd8a64cde
je 0x18002e48f
test r9d, r9d
jne 0x18002e44b
mov rax, qword [rax]
jmp 0x18002e426
mov ecx, dword [r11 + 0x24]
mov edx, dword [r11 + 0x1c]
add rcx, r8
add rdx, r8
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r8
mov qword [0x180216828], rax
lea rcx, [rbp - 0x20]
mov r9d, 0xf003f
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, rdi
mov rdx, r14
call rax
mov rax, qword [0x180216830]
test rax, rax
jne 0x18002e573
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r11d, dword [rcx + r8 + 0x88]
add r11, r8
cmp r11, r8
je 0x18002e54e
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x18002e54e
mov ebx, dword [r11 + 0x20]
add r9d, r13d
lea rdx, [rbx + r9*4]
mov r10d, dword [rdx + r8]
mov edx, 0xcc5cc09b
add r10, r8
mov cl, byte [r10]
inc r10
test cl, cl
je 0x18002e549
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
mov cl, byte [r10]
inc r10
test cl, cl
jne 0x18002e52c
cmp edx, 0x4cb23cff
je 0x18002e553
test r9d, r9d
jne 0x18002e50f
mov rax, qword [rax]
jmp 0x18002e4ea
mov ecx, dword [r11 + 0x24]
mov edx, dword [r11 + 0x1c]
add rcx, r8
add rdx, r8
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r8
mov qword [0x180216830], rax
and qword [rsp + 0x58], 0
lea rcx, [rbp - 0x18]
and qword [rsp + 0x50], 0
xor r9d, r9d
and qword [rsp + 0x48], 0
xor r8d, r8d
mov qword [rsp + 0x40], rcx
xor edx, edx
lea rcx, [rbp - 0x14]
mov qword [rsp + 0x38], rcx
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
mov rcx, qword [rbp - 0x20]
and qword [rsp + 0x20], 0
call rax
test eax, eax
jne 0x18002e405
mov ecx, dword [rbp - 0x18]
inc ecx
call fcn.180118b00
mov ebx, dword [rbp - 0x14]
mov rsi, rax
jmp 0x18002e76b
mov ecx, dword [rbp - 0x18]
mov r10, qword [0x180216838]
inc ecx
mov dword [rbp - 0x10], ecx
test r10, r10
jne 0x18002e687
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x18002e661
mov r10d, dword [r9 + 0x18]
test r10d, r10d
je 0x18002e661
mov edi, dword [r9 + 0x20]
add r10d, r13d
lea rdx, [rdi + r10*4]
mov r11d, dword [rdx + r8]
mov edx, 0xe5921127
add r11, r8
mov cl, byte [r11]
inc r11
test cl, cl
je 0x18002e65c
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
mov cl, byte [r11]
inc r11
test cl, cl
jne 0x18002e63f
cmp edx, 0x7fab150e
je 0x18002e666
test r10d, r10d
jne 0x18002e622
mov rax, qword [rax]
jmp 0x18002e5fd
mov eax, dword [r9 + 0x24]
mov ecx, dword [r9 + 0x1c]
add rax, r8
add rcx, r8
movzx edx, word [rax + r10*2]
mov r10d, dword [rcx + rdx*4]
add r10, r8
mov qword [0x180216838], r10
and qword [rsp + 0x38], 0
lea r9, [rbp - 0x10]
and qword [rsp + 0x30], 0
mov r8, rsi
and qword [rsp + 0x28], 0
mov edx, ebx
mov rcx, qword [rbp - 0x20]
and qword [rsp + 0x20], 0
call r10
test eax, eax
jne 0x18002e76b
mov rax, qword [0x180216840]
test rax, rax
jne 0x18002e762
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov r10d, dword [rcx + r9 + 0x88]
add r10, r9
cmp r10, r9
je 0x18002e73c
mov r8d, dword [r10 + 0x18]
test r8d, r8d
je 0x18002e73c
mov edi, dword [r10 + 0x20]
add r8d, r13d
lea rdx, [rdi + r8*4]
mov r11d, dword [rdx + r9]
mov edx, 0x5e6f52e6
add r11, r9
mov cl, byte [r11]
inc r11
test cl, cl
je 0x18002e737
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
mov cl, byte [r11]
inc r11
test cl, cl
jne 0x18002e71a
cmp edx, 0x91e7930f
je 0x18002e741
test r8d, r8d
jne 0x18002e6fd
mov rax, qword [rax]
jmp 0x18002e6d8
mov ecx, dword [r10 + 0x24]
add rcx, r9
movzx r8d, word [rcx + r8*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r9
mov eax, dword [rcx + r8*4]
add rax, r9
mov qword [0x180216840], rax
mov rcx, qword [rbp - 0x20]
mov rdx, rsi
call rax
sub ebx, 1
jns 0x18002e5d4
mov rax, qword [0x180216848]
test rax, rax
jne 0x18002e81f
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov r10d, dword [rcx + r9 + 0x88]
add r10, r9
cmp r10, r9
je 0x18002e7f9
mov r8d, dword [r10 + 0x18]
test r8d, r8d
je 0x18002e7f9
mov ebx, dword [r10 + 0x20]
add r8d, r13d
lea rdx, [rbx + r8*4]
mov r11d, dword [rdx + r9]
mov edx, 0x8240ba83
add r11, r9
mov cl, byte [r11]
inc r11
test cl, cl
je 0x18002e7f4
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
mov cl, byte [r11]
inc r11
test cl, cl
jne 0x18002e7d7
cmp edx, 0x74a5c7bc
je 0x18002e7fe
test r8d, r8d
jne 0x18002e7ba
mov rax, qword [rax]
jmp 0x18002e795
mov ecx, dword [r10 + 0x24]
add rcx, r9
movzx r8d, word [rcx + r8*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r9
mov eax, dword [rcx + r8*4]
add rax, r9
mov qword [0x180216848], rax
mov rcx, qword [rbp - 0x20]
call rax
mov rax, qword [0x180216850]
test rax, rax
jne 0x18002e8d0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov r11d, dword [rcx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x18002e8aa
mov r8d, dword [r11 + 0x18]
test r8d, r8d
je 0x18002e8aa
mov ebx, dword [r11 + 0x20]
add r8d, r13d
lea rdx, [rbx + r8*4]
mov r9d, dword [rdx + r10]
mov edx, 0x5d88208
add r9, r10
mov cl, byte [r9]
inc r9
test cl, cl
je 0x18002e8a5
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
mov cl, byte [r9]
inc r9
test cl, cl
jne 0x18002e888
cmp edx, 0xcc14a4af
je 0x18002e8af
test r8d, r8d
jne 0x18002e86b
mov rax, qword [rax]
jmp 0x18002e846
mov ecx, dword [r11 + 0x24]
add rcx, r10
movzx r9d, word [rcx + r8*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r10
mov eax, dword [rcx + r9*4]
add rax, r10
mov qword [0x180216850], rax
mov rcx, qword [rbp - 0x20]
mov rdx, r14
call rax
test eax, eax
sete al
jmp 0x18002e8e2
xor al, al
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180118240
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop rbp
ret