Function at 0x180070b60
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov rdi, rdx
mov rbx, rcx
mov rcx, rdi
lea rdx, str.attacker
call fcn.1800528d0
lea rdx, str.userid
mov rcx, rdi
mov rsi, rax
call fcn.1800528d0
mov r14, rax
test rsi, rsi
je 0x180070fe5
call fcn.180054670
mov ecx, dword [rax + rsi]
mov dword [rbp + 0x77], ecx
lea rcx, [rbp + 0x77]
call fcn.1800525e0
test rax, rax
je 0x180070fe5
test r14, r14
je 0x180070fe5
call fcn.180054670
mov ecx, dword [rax + r14]
mov dword [rbp + 0x7f], ecx
lea rcx, [rbp + 0x7f]
call fcn.1800525e0
test rax, rax
je 0x180070fe5
lea rcx, [0x1802eab00]
call fcn.180055780
cmp rsi, rax
jne 0x180071041
xor edx, edx
lea rcx, [0x180086a38]
call fcn.18007e100
test al, al
je 0x180070d0c
mov rax, qword [0x1802ea778]
mov ecx, dword [rax + 0xa0]
mov dword [rbp - 0x35], ecx
call fcn.180054670
mov ecx, dword [rax + r14]
mov dword [rbp - 0x49], ecx
lea rcx, [rbp - 0x49]
call fcn.1800525e0
lea rdx, str.dmg_health
mov qword [rbp - 0x31], rax
mov rcx, rdi
call fcn.1800528e0
mov qword [rbp - 0x21], rax
lea rdx, [rbp - 0x21]
mov rax, qword [0x1802ec1c8]
mov esi, 1
mov qword [rbp - 0x11], rax
xor r9d, r9d
mov rax, qword [rdi]
mov r8d, esi
mov rcx, qword [rax + 0x38]
xor eax, eax
mov qword [rsp + 0x28], rax
mov qword [rbp - 1], rax
lea rax, [rbp - 0x11]
mov qword [rbp - 9], rcx
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.180082560
mov dword [rbp - 0x39], eax
mov ecx, esi
xor eax, eax
mov qword [rbp - 0x41], 0
mov dword [rbp - 0x29], 0x3e8
lock cmpxchg byte [rbx + 0x68], sil
je 0x180070cdb
mov edx, 0x10000
test ecx, ecx
je 0x180070cc7
mov eax, ecx
nop dword [rax + rax]
pause
sub rax, rsi
jne 0x180070cc0
lea eax, [rcx + rcx]
cmp eax, edx
mov ecx, eax
cmova ecx, edx
xor eax, eax
lock cmpxchg byte [rbx + 0x68], sil
jne 0x180070cb5
mov rdx, qword [rbx + 0x18]
lea rcx, [rbx + 0x10]
cmp rdx, qword [rbx + 0x20]
je 0x180070cff
movups xmm0, xmmword [rbp - 0x41]
movups xmm1, xmmword [rbp - 0x31]
movups xmmword [rdx], xmm0
movups xmmword [rdx + 0x10], xmm1
add qword [rbx + 0x18], 0x20
jmp 0x180070d08
lea r8, [rbp - 0x41]
call fcn.18006fd30
mov byte [rbx + 0x68], 0
xor edx, edx
lea rcx, [0x180086a3c]
call fcn.18007e100
test al, al
je 0x180070d3f
mov rcx, qword [0x1802ea778]
mov eax, dword [rcx + 0xa0]
mov dword [rcx + 0xa8], eax
mov rax, qword [0x1802ea778]
mov byte [rax + 0xa4], 1
xor edx, edx
lea rcx, [0x180086a40]
call fcn.18007e100
test al, al
je 0x180071041
mov r9, qword [0x1802ebce0]
test r9, r9
jne 0x180070fc8
mov qword [rsp + 0xe0], r12
xor r14d, r14d
mov qword [rsp + 0xa8], r13
mov qword [rsp + 0xa0], r15
mov r15d, 0x820cb3f9
nop word [rax + rax]
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x18]
mov r12, qword [rax + 0x10]
nop word [rax + rax]
movups xmm0, xmmword [r12 + 0x58]
movd eax, xmm0
movups xmmword [rbp - 0x21], xmm0
sub ax, 8
test r14d, r14d
je 0x180070e0e
mov r8, qword [rbp - 0x19]
mov r9d, 0x811c9dc5
movzx eax, ax
shr rax, 1
lea r10, [r8 + rax*2]
cmp r8, r10
je 0x180070e05
movsx eax, byte [r8]
mov ecx, eax
sub al, 0x41
mov edx, ecx
or edx, 0x20
cmp al, 0x19
cmova edx, ecx
add r8, 2
xor edx, r9d
imul r9d, edx, 0x1000193
cmp r8, r10
jne 0x180070de0
cmp r9d, r14d
jne 0x180070ea8
mov rbx, qword [r12 + 0x30]
movsxd rax, dword [rbx + 0x3c]
mov rcx, qword [rax + rbx + 0x88]
mov r13, rcx
mov esi, ecx
shr r13, 0x20
add rsi, rbx
cmp rsi, rbx
je 0x180070ea8
mov edi, dword [rsi + 0x18]
xor r11d, r11d
test edi, edi
je 0x180070ea8
mov r10d, dword [rsi + 0x20]
add r10, rbx
nop dword [rax]
nop word [rax + rax]
mov r8d, dword [r10]
mov r9d, 0x811c9dc5
add r8, rbx
movzx edx, byte [r8]
test dl, dl
je 0x180070e97
nop dword [rax]
nop dword [rax + rax]
movsx eax, dl
lea r8, [r8 + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [r8]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test dl, dl
jne 0x180070e70
cmp r9d, r15d
je 0x180070eb1
inc r11d
add r10, 4
cmp r11d, edi
jb 0x180070e50
mov r12, qword [r12]
jmp 0x180070db0
mov eax, dword [rsi + 0x24]
mov ecx, dword [rsi + 0x1c]
add rax, rbx
add rcx, rbx
movzx edx, word [rax + r11*2]
mov r9d, dword [rcx + rdx*4]
add r9, rbx
cmp r9, rsi
jbe 0x180070f78
lea rax, [rsi + r13]
cmp r9, rax
jae 0x180070f78
movzx edx, byte [r9]
mov r14d, 0x811c9dc5
mov dword [rbp + 0x77], r14d
mov r8d, r14d
mov dword [rbp + 0x7b], r14d
cmp dl, 0x2e
je 0x180070f2c
nop dword [rax]
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [r9 + 1]
cmova ecx, eax
inc r9
xor ecx, r14d
imul r14d, ecx, 0x1000193
cmp dl, 0x2e
jne 0x180070f00
mov dword [rbp + 0x77], r14d
movzx edx, byte [r9 + 1]
inc r9
test dl, dl
je 0x180070f6b
nop dword [rax + rax]
movsx eax, dl
lea r9, [r9 + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [r9]
cmova ecx, eax
xor ecx, r8d
imul r8d, ecx, 0x1000193
test dl, dl
jne 0x180070f40
mov dword [rbp + 0x7b], r8d
mov r15, qword [rbp + 0x77]
shr r15, 0x20
jmp 0x180070d90
mov r15, qword [rsp + 0xa0]
mov r13, qword [rsp + 0xa8]
mov r12, qword [rsp + 0xe0]
mov qword [0x1802ebce0], r9
test r9, r9
jne 0x180070fc8
mov r8d, 0x820cb3f9
lea rdx, str.tried_to_resolve_invalid_import_0x_X_n
lea rcx, [0x1802ecc10]
call fcn.180044770
lea rcx, [0x1802ecc10]
call fcn.180081550
mov r9, qword [0x1802ebce0]
xor edx, edx
lea rcx, str.RIFFV.
lea r8d, [rdx + 5]
add rsp, 0xb0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
jmp r9
mov rax, qword [0x1802ec1c8]
xor r9d, r9d
mov qword [rbp + 7], rax
xor r8d, r8d
mov rax, qword [rdi]
xor edx, edx
mov rcx, qword [rax + 8]
xor eax, eax
mov qword [rsp + 0x28], rax
mov qword [rbp + 0x17], rax
lea rax, [rbp + 7]
mov qword [rbp + 0xf], rcx
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.180082560
mov r8, rax
lea rdx, str.failed_to_resolve_emitting_entity_for__s
lea rcx, [0x1802ecc10]
call fcn.180044770
lea rcx, [0x1802ecc10]
call fcn.180081b50
add rsp, 0xb0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret