Function at 0x180002b00
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov rbx, rdx
mov r14, rcx
lea rcx, str.login_user
call qword [sym.imp.VMProtectSDK64.dll_VMProtectBeginUltra]
call qword [sym.imp.VMProtectSDK64.dll_VMProtectIsValidImageCRC]
test al, al
je 0x180002e47
call qword [sym.imp.VMProtectSDK64.dll_VMProtectIsVirtualMachinePresent]
test al, al
jne 0x180002e47
xor esi, esi
cmp qword [rdi + 0x10], 0x40
jne 0x180002d3f
cmp qword [0x1800a9c00], 0x40
jne 0x180002d3f
cmp qword [rdi + 0x18], 0x10
mov rcx, rdi
jb 0x180002b7b
mov rcx, qword [rdi]
cmp qword [0x1800a9c08], 0x10
jb 0x180002b8e
mov rsi, qword [0x1800a9bf0]
jmp 0x180002b95
lea rsi, [0x1800a9bf0]
mov r8d, 0x40
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x180002bae
xor esi, esi
jmp 0x180002d3f
mov qword [rbp - 0x20], rdi
mov qword [0x1800a9c00], 0
mov byte [rsi], 0
xorps xmm0, xmm0
movaps xmmword [rbp - 0x30], xmm0
movaps xmmword [rbp - 0x40], xmm0
mov rsi, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
mov rdi, rbx
jb 0x180002bdc
mov rdi, qword [rbx]
test rsi, rsi
mov qword [rbp - 0x18], rbx
mov qword [rbp - 0x10], r14
js 0x180003152
cmp rsi, 0xf
ja 0x180002c08
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], reloc.WS2_32.dll_ntohs
movups xmm0, xmmword [rdi]
movaps xmmword [rbp - 0x40], xmm0
jmp 0x180002c69
mov rax, rsi
or rax, 0xf
cmp rax, 0x17
mov ebx, reloc.WLDAP32.dll_Ordinal_22
cmovae rbx, rax
cmp rbx, 0xfff
jb 0x180002c3f
lea rcx, [rbx + 0x28]
call fcn.18003f254
mov rcx, rax
add rcx, 0x27
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x180002c4b
lea rcx, [rbx + 1]
call fcn.18003f254
mov rcx, rax
mov qword [rbp - 0x40], rcx
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], rbx
inc rsi
mov rdx, rdi
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r14, qword [rbp - 0x10]
xorps xmm0, xmm0
movaps xmmword [rbp - 0x50], xmm0
movaps xmmword [rbp - 0x60], xmm0
mov rsi, qword [r14 + 0x10]
cmp qword [r14 + 0x18], 0x10
mov rdi, r14
jb 0x180002c85
mov rdi, qword [r14]
test rsi, rsi
js 0x180003157
cmp rsi, 0xf
ja 0x180002ca9
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], reloc.WS2_32.dll_ntohs
movups xmm0, xmmword [rdi]
movaps xmmword [rbp - 0x60], xmm0
jmp 0x180002d06
mov rax, rsi
or rax, 0xf
cmp rax, 0x17
mov ebx, reloc.WLDAP32.dll_Ordinal_22
cmovae rbx, rax
cmp rbx, 0xfff
jb 0x180002ce0
lea rcx, [rbx + 0x28]
call fcn.18003f254
mov rcx, rax
add rcx, 0x27
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x180002cec
lea rcx, [rbx + 1]
call fcn.18003f254
mov rcx, rax
mov qword [rbp - 0x60], rcx
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], rbx
inc rsi
mov rdx, rdi
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [0x1800a9938]
lea rdx, [rbp - 0x60]
lea r8, [rbp - 0x40]
call fcn.18000b1d0
cmp byte [0x1800a9b48], 0
setne al
cmp qword [0x1800a9ac8], 0
setne sil
or sil, al
mov rdi, qword [rbp - 0x20]
mov rbx, qword [rbp - 0x18]
mov r14, qword [rbp - 0x10]
mov rax, qword [r14 + 0x18]
cmp rax, 0x10
jb 0x180002d7d
mov rcx, qword [r14]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x180002d78
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x18000314c
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.18003f298
mov qword [r14 + 0x10], 0
mov qword [r14 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r14], 0
mov rax, qword [rbx + 0x18]
cmp rax, 0x10
jb 0x180002dcf
mov rcx, qword [rbx]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x180002dca
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x18000314c
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.18003f298
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rax, qword [rdi + 0x18]
cmp rax, 0x10
jb 0x180002e20
mov rcx, qword [rdi]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x180002e1b
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x18000314c
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.18003f298
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
mov eax, esi
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
mov qword [rbp - 0x10], r14
mov qword [rbp - 0x18], rbx
mov qword [rbp - 0x20], rdi
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
add rax, 0x10
nop word cs:[rax + rax]
mov rax, qword [rax]
mov rdi, qword [rax + 0x30]
movsxd rcx, dword [rdi + 0x3c]
mov ecx, dword [rdi + rcx + 0x88]
test rcx, rcx
je 0x180002e70
mov edx, dword [rdi + rcx + 0x18]
test rdx, rdx
je 0x180002e70
mov r8d, dword [rdi + rcx + 0x20]
add r8, rdi
lea r9, [rdi + 1]
jmp 0x180002ea5
test r10, r10
je 0x180002e70
dec rdx
mov r10d, edx
mov r11d, dword [r8 + r10*4]
movzx ebx, byte [rdi + r11]
test bl, bl
je 0x180002ea0
add r11, r9
mov esi, 0x462cd022
movsx ebx, bl
xor ebx, esi
imul esi, ebx, 0x1000193
movzx ebx, byte [r11]
inc r11
test bl, bl
jne 0x180002ec0
cmp esi, 0x95bfee6a
jne 0x180002ea0
mov eax, dword [rdi + rcx + 0x1c]
mov ecx, dword [rdi + rcx + 0x24]
add rax, rdi
add rcx, rdi
movzx ecx, word [rcx + r10*2]
mov ebx, dword [rax + rcx*4]
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
nop word cs:[rax + rax]
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x180002f10
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x180002f10
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
jmp 0x180002f45
test r11, r11
je 0x180002f10
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
movzx r14d, byte [rax + rsi]
test r14b, r14b
je 0x180002f40
add rsi, r10
mov r15d, 0x442cccfc
nop word cs:[rax + rax]
movsx r14d, r14b
xor r14d, r15d
imul r15d, r14d, 0x1000193
movzx r14d, byte [rsi]
inc rsi
test r14b, r14b
jne 0x180002f70
cmp r15d, 0x9a57088b
jne 0x180002f40
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov ecx, dword [rcx + rdx*4]
add rcx, rax
call rcx
mov esi, eax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x180002fc1
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x180002fc1
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
jmp 0x180002ff5
test r11, r11
je 0x180002fc1
dec r8
mov r11d, r8d
mov r14d, dword [r9 + r11*4]
movzx r15d, byte [rax + r14]
test r15b, r15b
je 0x180002ff0
add r14, r10
mov r12d, 0x472cd1b5
nop word cs:[rax + rax]
movsx r15d, r15b
xor r15d, r12d
imul r12d, r15d, 0x1000193
movzx r15d, byte [r14]
inc r14
test r15b, r15b
jne 0x180003020
cmp r12d, 0xfce1e6f5
jne 0x180002ff0
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov ecx, dword [rcx + rdx*4]
add rcx, rax
call rcx
movsxd rcx, esi
imul rdx, rcx, 0xffffffff80010003
shr rdx, 0x20
add edx, ecx
mov r8d, edx
shr r8d, 0x1f
sar edx, 0xe
add edx, r8d
mov r8d, edx
shl r8d, 0xf
sub edx, r8d
add edx, ecx
add rdi, rbx
mov rcx, rax
call rdi
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x1800030a0
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x1800030a0
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
jmp 0x1800030d5
test r11, r11
je 0x1800030a0
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
movzx ebx, byte [rax + rsi]
test bl, bl
je 0x1800030d0
add rsi, r10
mov edi, 0x4d2f19be
nop
movsx ebx, bl
xor ebx, edi
imul edi, ebx, 0x1000193
movzx ebx, byte [rsi]
inc rsi
test bl, bl
jne 0x1800030f0
cmp edi, 0xd311ac05
jne 0x1800030d0
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov ecx, dword [rcx + rdx*4]
add rcx, rax
call rcx
cdqe
imul rcx, rax, 0xffffffff80010003
shr rcx, 0x20
add ecx, eax
mov edx, ecx
shr edx, 0x1f
sar ecx, 0xe
add ecx, edx
mov edx, ecx
shl edx, 0xf
sub ecx, edx
add ecx, eax
int 0x29
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
call fcn.1800031f0
call fcn.1800031f0
int3