Function at 0x18001b440
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x4e0
lea rbp, [rsp + 0x50]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x18025a080]
xor rax, rsp
mov qword [rbp + 0x468], rax
mov qword [rbp], rcx
movabs rax, 0xe097a45d7856117c
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x70], rax
movabs r15, 0x52c80699998995a4
mov qword [rbp + 8], r15
mov rax, qword [rbp + 8]
mov qword [rbp + 0x78], rax
movabs r12, 0xe0f2dc385664621f
mov qword [rbp + 8], r12
mov rax, qword [rbp + 8]
mov qword [rbp + 0x2c0], rax
mov qword [rbp + 8], r15
mov rax, qword [rbp + 8]
mov qword [rbp + 0x2c8], rax
vmovdqu xmm0, xmmword [rbp + 0x70]
vpxor xmm1, xmm0, xmmword [rbp + 0x2c0]
vmovdqu xmmword [rbp + 0x70], xmm1
vpxor xmm2, xmm2, xmm2
vmovups xmmword [rbp + 0x90], xmm2
xor r13d, r13d
mov qword [rbp + 0xa0], r13
mov qword [rbp + 0xa8], r13
lea rax, [rbp + 0x70]
mov r14, 0xffffffffffffffff
mov r8, r14
nop
inc r8
cmp byte [rax + r8], r13b
jne 0x18001b510
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x90]
call fcn.180005d80
lea rdx, [rbp + 0x90]
lea rcx, [0x18025ac00]
call fcn.18001a980
mov edi, eax
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop
mov r9, qword [rcx + 0x30]
movsxd rdx, dword [r9 + 0x3c]
mov ebx, dword [rdx + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x18001b8ff
mov r10d, dword [rbx + 0x18]
test r10d, r10d
je 0x18001b8ff
mov esi, dword [rbx + 0x20]
nop dword [rax]
dec r10d
lea rax, [rsi + r10*4]
mov edx, dword [rax + r9]
add rdx, r9
mov r8d, 0xc27e3d19
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x18001b8f6
nop dword [rax + rax]
movsx eax, al
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
test al, al
jne 0x18001b5b0
cmp r8d, 0xc18f089c
jne 0x18001b8f6
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rbx + 0x24]
add rax, r9
movzx eax, word [rax + r10*2]
mov r10d, dword [rcx + rax*4]
add r10, r9
lea rax, [rbp + 0x340]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x1a]
xor ecx, ecx
call r10
test eax, eax
je 0x18001b611
jmp 0x18001baa6
lea rax, [rbp + 0x340]
mov rsi, r14
nop dword [rax + rax]
inc rsi
cmp byte [rax + rsi], r13b
jne 0x18001b620
mov rax, qword [0x18012c018]
cmp rsi, rax
ja 0x18001b66b
lea rbx, [section..data]
cmp rax, 0xf
cmova rbx, qword [section..data]
mov qword [0x18012c010], rsi
mov r8, rsi
lea rdx, [rbp + 0x340]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rsi], r13b
jmp 0x18001b686
lea r9, [rbp + 0x340]
movzx r8d, byte [rbp + 0x10]
mov rdx, rsi
lea rcx, [section..data]
call fcn.18000a3c0
movabs rax, 0x8196b05d310a0343
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xb0], rax
movabs rax, 0x52c80699c5f0f6ca
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xb8], rax
mov qword [rbp + 8], r12
mov rax, qword [rbp + 8]
mov qword [rbp + 0x2e0], rax
mov qword [rbp + 8], r15
mov rax, qword [rbp + 8]
mov qword [rbp + 0x2e8], rax
vmovdqu xmm0, xmmword [rbp + 0xb0]
vpxor xmm1, xmm0, xmmword [rbp + 0x2e0]
vmovdqu xmmword [rbp + 0xb0], xmm1
lea rax, [rbp + 0xb0]
inc r14
cmp byte [rax + r14], r13b
jne 0x18001b6f5
mov r8, r14
lea rdx, [rbp + 0xb0]
lea rcx, [section..data]
call fcn.1800075c0
sub edi, 1
je 0x18001b8f1
nop dword [rax]
sub edi, 1
je 0x18001b8ec
cmp edi, 1
je 0x18001b8e7
call fcn.18001c560
test al, al
jne 0x18001b745
nop dword [rax + rax]
jmp 0x18001baa6
mov rax, qword [0x18025aea0]
cmp byte [rax + 0x129], r13b
je 0x18001b771
lea rcx, [0x18025b830]
nop dword [rax]
call fcn.18001f100
lea rcx, [0x18025b830]
call fcn.18001f240
call fcn.180005cb0
lea rcx, [0x18025ada0]
nop dword [rax]
call fcn.180019210
test al, al
jne 0x18001b78e
jmp 0x18001baa6
xor r8d, r8d
lea rdx, [section..data]
lea rcx, [rbp + 0xd0]
call fcn.180019420
nop
lea rcx, [rbp + 0xd0]
cmp qword [rbp + 0xe8], 7
cmova rcx, qword [rbp + 0xd0]
mov r9d, 0xffffffff
mov r8d, 3
lea rdx, [rbp + 0x260]
call fcn.18007fabc
mov edx, eax
test eax, eax
jne 0x18001b81d
mov eax, dword [rbp + 0x270]
bt eax, 0xa
jae 0x18001b80f
mov ecx, dword [rbp + 0x274]
cmp ecx, 0xa000000c
jne 0x18001b7fa
lea eax, [rdx + 4]
jmp 0x18001b843
nop word [rax + rax]
cmp ecx, 0xa0000003
jne 0x18001b80f
mov eax, 0xa
jmp 0x18001b843
movzx eax, al
and eax, 0x10
or eax, 0x20
shr eax, 4
jmp 0x18001b843
mov dword [rbp + 0x114], 0xffff
sub eax, 2
je 0x18001b83e
sub eax, 1
je 0x18001b83e
sub eax, 0x32
je 0x18001b83e
cmp eax, 0x46
mov eax, r13d
jne 0x18001b843
mov eax, 1
mov dword [rbp + 0x60], edx
lea rcx, [0x180242188]
mov qword [rbp + 0x68], rcx
vmovups xmm0, xmmword [rbp + 0x60]
vmovdqa xmmword [rbp + 0x50], xmm0
test eax, eax
je 0x18001b8c2
mov dword [rbp + 0x50], r13d
mov qword [rbp + 0x58], rcx
cmp eax, 1
setne bl
lea rcx, [rbp + 0xd0]
call fcn.180007500
test bl, bl
jne 0x18001b8e5
xor r8d, r8d
lea rdx, [section..data]
lea rcx, [rbp + 0xf0]
call fcn.180019420
nop
lea rcx, [rbp + 0xf0]
cmp qword [rbp + 0x108], 7
cmova rcx, qword [rbp + 0xf0]
call fcn.18007f990
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x18001bb8f
nop
jmp 0x18001b8ce
xor bl, bl
test edx, edx
jne 0x18001bba9
jmp 0x18001b86d
lea rcx, [rbp + 0xf0]
call fcn.180007500
test bl, bl
jne 0x18001b8e5
nop
jmp 0x18001baa6
jmp 0x18001b91b
jmp 0x18001baa6
jmp 0x18001baa6
jmp 0x18001baa6
test r10d, r10d
jne 0x18001b580
mov rcx, qword [rcx]
jmp 0x18001b550
lea rax, [rbp + 0x160]
mov qword [rbp + 8], rax
lea rax, vtable.std::_Func_impl_no_alloc_void____cdecl___void___void___.0
mov qword [rbp + 0x160], rax
lea rax, [0x180015aa0]
mov qword [rbp + 0x168], rax
lea rax, [rbp + 0x160]
mov qword [rbp + 0x198], rax
lea rax, [rbp + 0x1e0]
mov qword [rbp + 0x40], rax
movabs rax, 0xe082ac590928264c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x120], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x128], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x300], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x308], rax
vmovdqu xmm0, xmmword [rbp + 0x120]
vpxor xmm1, xmm0, xmmword [rbp + 0x300]
vmovdqu xmmword [rbp + 0x120], xmm1
lea rdx, [rbp + 0x120]
lea rcx, [rbp + 0x1e0]
call fcn.180019c20
mov rbx, rax
movabs rax, 0xcd80b94c38110d5c
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x20], rcx
movabs rax, 0x60e863f2f0fbe1f7
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x28], rcx
movabs rdx, 0xef6e02965c816409
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rcx, 0xf30b99cf1da0500e
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x280], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x288], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x290], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x298], rax
vmovdqu ymm0, ymmword [rbp + 0x20]
vpxor ymm1, ymm0, ymmword [rbp + 0x280]
vmovdqu ymmword [rbp + 0x20], ymm1
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x200]
vzeroupper
call fcn.180019c20
nop
lea r9, [rbp + 0x160]
mov r8, rbx
mov rdx, rax
mov rcx, qword [0x18025ad90]
call fcn.180079000
nop
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov r11d, dword [rcx + r9 + 0x88]
add r11, r9
cmp r11, r9
je 0x18001bb36
mov r10d, dword ds:[r11 + 0x18]
test r10d, r10d
je 0x18001bb36
mov edi, dword [r11 + 0x20]
nop dword [rax]
dec r10d
lea rcx, [rdi + r10*4]
mov edx, dword [rcx + r9]
add rdx, r9
mov r8d, 0x1bcf050d
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x18001bb31
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x18001bb10
cmp r8d, 0x898c3a4
je 0x18001bb3b
test r10d, r10d
jne 0x18001baf0
mov rax, qword [rax]
jmp 0x18001bac0
mov ecx, dword [r11 + 0x24]
add rcx, r9
movzx edx, word [rcx + r10*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
lea rcx, str.pause
call rax
xor al, al
mov rcx, qword [rbp + 0x468]
xor rcx, rsp
call fcn.180080a90
lea r11, [rsp + 0x4e0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
shr rbx, 0x20
lea r8, [rbp + 0xf0]
mov edx, ebx
lea rcx, str.create_directory
call fcn.18001a880
nop
lea r8, ds:[rbp + 0xd0]
lea rdx, [rbp + 0x50]
lea rcx, str.exists
call fcn.18001a820
int3