Function at 0x18001d3ac
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
cmp rcx, qword [r8]
je 0x18001d487
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x18001d467
mov r10d, dword [r9 + 0x18]
test r10d, r10d
je 0x18001d467
mov r12d, dword [r9 + 0x20]
dec r10d
mov r14d, 0x7d6ca01d
lea rcx, [r12 + r10*4]
mov r11d, dword [rcx + r8]
add r11, r8
mov bpl, byte [r11]
inc r11
test bpl, bpl
je 0x18001d462
movsx ecx, bpl
sub bpl, 0x41
mov edx, ecx
or edx, 0x20
cmp bpl, 0x19
mov bpl, byte [r11]
cmova edx, ecx
inc r11
xor edx, r14d
imul r14d, edx, 0x1000193
test bpl, bpl
jne 0x18001d430
cmp r14d, 0xe550a631
je 0x18001d46c
test r10d, r10d
jne 0x18001d411
mov rax, qword [rax]
jmp 0x18001d3ec
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + r10*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
call rax
mov qword [rsi], rbx
movabs rax, 0x8000000000000000
and qword [rsi + 8], 0
and qword [rsi + 0x10], 0
mov qword [rsi + 0x18], rax
mov rdx, qword [rsi]
movzx ecx, byte [rdx]
cmp ecx, 5
ja 0x18001d4d8
je 0x18001d4d8
test ecx, ecx
je 0x18001d4d8
sub ecx, 1
je 0x18001d4cb
sub ecx, 1
jne 0x18001d4d8
mov rax, qword [rdx + 8]
mov rcx, qword [rax + 8]
mov qword [rsi + 0x10], rcx
jmp 0x18001d4e0
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rsi + 8], rcx
jmp 0x18001d4e0
mov qword [rsi + 0x18], 1
movzx ecx, byte [rbx]
cmp ecx, 5
ja 0x18001d548
je 0x18001d60b
test ecx, ecx
je 0x18001d563
sub ecx, 1
je 0x18001d532
sub ecx, 1
jne 0x18001d551
mov rdi, qword [rdi + 0x10]
mov rbx, qword [rbx + 8]
mov r8, rdi
lea rcx, [rdi + 0x10]
mov rdx, qword [rbx + 8]
call fcn.18001b6a8
mov rdx, qword [rbx + 8]
lea rcx, [rdx - 8]
mov dl, byte [rdx - 0x10]
call fcn.1800412a8
add qword [rbx + 8], 0xfffffffffffffff0
mov qword [rsi + 0x10], rdi
jmp 0x18001d6ff
mov rdx, qword [rdi + 8]
mov rcx, qword [rbx + 8]
call fcn.180040120
mov qword [rsi + 8], rax
jmp 0x18001d6ff
sub ecx, 6
je 0x18001d60b
sub ecx, 1
je 0x18001d60b
cmp ecx, 1
je 0x18001d60b
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x18001d5e6
mov r11d, dword [r9 + 0x18]
test r11d, r11d
je 0x18001d5e6
mov r14d, dword [r9 + 0x20]
dec r11d
mov ebp, 0xd7921125
lea rcx, [r14 + r11*4]
mov r10d, dword [rcx + r8]
add r10, r8
mov bl, byte [r10]
inc r10
test bl, bl
je 0x18001d5e1
movsx ecx, bl
sub bl, 0x41
mov edx, ecx
or edx, 0x20
cmp bl, 0x19
mov bl, byte [r10]
cmova edx, ecx
inc r10
xor edx, ebp
imul ebp, edx, 0x1000193
test bl, bl
jne 0x18001d5b6
cmp ebp, 0xc66fd3d9
je 0x18001d5eb
test r11d, r11d
jne 0x18001d599
mov rax, qword [rax]
jmp 0x18001d574
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + r11*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
call rax
jmp 0x18001d6ff
cmp qword [rdi + 0x18], 0
je 0x18001d6c2
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x18001d6a2
mov r11d, dword [r9 + 0x18]
test r11d, r11d
je 0x18001d6a2
mov r15d, dword [r9 + 0x20]
dec r11d
mov r14d, 0xafea734e
lea rcx, [r15 + r11*4]
mov r10d, dword [rcx + r8]
add r10, r8
mov dil, byte [r10]
inc r10
test dil, dil
je 0x18001d69d
movsx ecx, dil
sub dil, 0x41
mov edx, ecx
or edx, 0x20
cmp dil, 0x19
mov dil, byte [r10]
cmova edx, ecx
inc r10
xor edx, r14d
imul r14d, edx, 0x1000193
test dil, dil
jne 0x18001d66b
cmp r14d, 0xa34290b8
je 0x18001d6a7
test r11d, r11d
jne 0x18001d64c
mov rax, qword [rax]
jmp 0x18001d627
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + r11*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
call rax
cmp byte [rbx], 3
jne 0x18001d6d9
mov rcx, qword [rbx + 8]
xor edx, edx
call fcn.180022a00
mov edx, 0x20
jmp 0x18001d6ee
cmp byte [rbx], 8
jne 0x18001d6fc
mov rcx, qword [rbx + 8]
xor edx, edx
call fcn.180022a7c
mov edx, 0x28
mov rcx, qword [rbx + 8]
call fcn.1800471e8
and qword [rbx + 8], 0
mov byte [rbx], 0
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret