Function at 0x180001350
Capabilities:
Access peb ldr_data
Encode data using xor
Get kernel32 base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x680
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x670], rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x180001407
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x180001407
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x44d1b097
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x180001402
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x1800013e0
cmp r8d, 0xadf96c75
je 0x18000140c
test r9d, r9d
jne 0x1800013c0
mov rax, qword [rax]
jmp 0x180001390
mov ecx, dword [rbx + 0x24]
lea r15, str.FF_23
add rcx, r10
mov qword [rsp + 0x6b0], rsi
xor r12d, r12d
movabs r13, 0x100002600
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
lea r14d, [r12 + 1]
add rcx, r10
mov ebp, dword [rcx + rdx*4]
mov rcx, qword [0x180007768]
add rbp, r10
test rcx, rcx
jne 0x18000165f
mov rsi, qword [0x180007760]
test rsi, rsi
jne 0x1800014d7
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r10, qword [rax]
mov r9, r10
nop word [rax + rax]
mov rcx, qword [r9 + 0x60]
mov edx, 0xded74612
movzx eax, word [r9 + 0x58]
shr rax, 1
lea r8, [rcx + rax*2]
cmp rcx, r8
je 0x1800014bc
nop word [rax + rax]
movsx eax, byte [rcx]
add rcx, 2
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r8
jne 0x1800014a0
cmp edx, 0xcf821cf9
je 0x180001532
mov rax, qword [r9]
mov r9, rax
cmp rax, r10
je 0x1800014cd
cmp qword [rax + 0x30], r12
jne 0x180001480
mov rsi, r12
mov qword [0x180007760], rsi
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0x200
call sub.VCRUNTIME140.dll_memset
mov rax, r12
mov ebx, r12d
nop
lea rax, [rax + 1]
cmp byte [rax + r15], bl
lea r11, [rax + r15]
jne 0x1800014f0
mov rax, r15
cmp r15, r11
jae 0x1800015f2
mov rcx, r15
lea rdi, [rsp + 0x70]
mov rdx, r15
cmp byte [rax], 0x3f
jne 0x180001538
cmp byte [rcx + 1], 0x3f
lea rdx, [rcx + 1]
jne 0x180001527
inc rdx
mov r9d, 0xffffffff
jmp 0x1800015d6
mov rsi, qword [r9 + 0x30]
jmp 0x1800014d0
mov r9, r12
mov r10d, r14d
nop
movsx rcx, byte [rdx]
cmp cl, 0x20
ja 0x180001554
bt r13, rcx
jae 0x180001554
inc rdx
jmp 0x180001540
cmp cl, 0x2b
je 0x18000155e
cmp cl, 0x2d
jne 0x180001571
inc rdx
mov r10d, 0xffffffff
cmp cl, 0x2d
cmovne r10d, r14d
movzx ecx, byte [rdx]
cmp cl, 0x30
jne 0x180001584
movzx eax, byte [rdx + 1]
sub al, 0x58
test al, 0xdf
jne 0x180001584
add rdx, 2
movsx ecx, byte [rdx]
lea eax, [rcx - 0x30]
cmp al, 9
jbe 0x18000159c
lea eax, [rcx - 0x41]
cmp al, 5
jbe 0x18000159c
lea eax, [rcx - 0x61]
cmp al, 5
ja 0x1800015ce
lea eax, [rcx - 0x30]
mov r8d, ecx
cmp al, 9
ja 0x1800015ab
lea eax, [rcx - 0x30]
jmp 0x1800015bb
sub cl, 0x41
lea eax, [r8 - 0x37]
cmp cl, 5
jbe 0x1800015bb
lea eax, [r8 - 0x57]
cmp eax, 0x10
jge 0x1800015ce
shl r9, 4
cdqe
add r9, rax
inc rdx
jmp 0x180001584
test r10d, r10d
jg 0x1800015d6
neg r9
lea rax, [rdx + 1]
mov dword [rdi], r9d
add rdi, 4
inc ebx
mov rcx, rax
mov rdx, rax
cmp rax, r11
jb 0x180001515
movsxd rax, dword [rsi + 0x3c]
mov r11d, dword [rax + rsi + 0x50]
sub r11d, ebx
je 0x180001655
mov edx, r12d
mov r10d, r12d
test ebx, ebx
je 0x180001640
nop word [rax + rax]
lea r8, [rsp + 0x70]
nop word [rax + rax]
mov r9d, dword [r8]
lea eax, [rdx + r10]
movzx eax, byte [rax + rsi]
cmp eax, r9d
je 0x180001636
cmp r9d, 0xffffffff
jne 0x180001648
inc edx
add r8, 4
cmp edx, ebx
jb 0x180001620
mov ecx, r10d
add rcx, rsi
jmp 0x180001658
inc r10d
cmp r10d, r11d
jae 0x180001655
mov edx, r12d
jmp 0x180001610
mov rcx, r12
mov qword [0x180007768], rcx
mov rdx, rbp
call fcn.1800048f0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1800016f7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1800016f7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x777efa03
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1800016f2
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x1800016d0
cmp r8d, 0x59e0a3dd
je 0x1800016fc
test r9d, r9d
jne 0x1800016b0
mov rax, qword [rax]
jmp 0x180001680
mov ecx, dword [rbx + 0x24]
mov rax, qword [0x180007768]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov ebp, dword [rcx + rdx*4]
add rbp, r10
test rax, rax
jne 0x18000193f
mov rsi, qword [0x180007760]
test rsi, rsi
jne 0x1800017ab
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r10, qword [rax]
mov r9, r10
nop word [rax + rax]
mov rcx, qword [r9 + 0x60]
mov edx, 0xded74612
movzx eax, word [r9 + 0x58]
shr rax, 1
lea r8, [rcx + rax*2]
cmp rcx, r8
je 0x180001790
nop word [rax + rax]
movsx eax, byte [rcx]
add rcx, 2
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r8
jne 0x180001770
cmp edx, 0xcf821cf9
je 0x180001815
mov rax, qword [r9]
mov r9, rax
cmp rax, r10
je 0x1800017a1
cmp qword [rax + 0x30], r12
jne 0x180001750
mov rsi, r12
mov qword [0x180007760], rsi
xor edx, edx
lea rcx, [rsp + 0x270]
mov r8d, 0x200
call sub.VCRUNTIME140.dll_memset
mov rax, r12
mov ebx, r12d
nop word [rax + rax]
lea rax, [rax + 1]
cmp byte [rax + r15], bl
lea r11, [rax + r15]
jne 0x1800017d0
mov rax, r15
cmp r15, r11
jae 0x1800018d3
mov rcx, r15
lea rdi, [rsp + 0x270]
mov rdx, r15
cmp byte [rax], 0x3f
jne 0x18000181b
cmp byte [rcx + 1], 0x3f
lea rdx, [rcx + 1]
jne 0x18000180a
inc rdx
mov r9d, 0xffffffff
jmp 0x1800018b7
mov rsi, qword [r9 + 0x30]
jmp 0x1800017a4
mov r9, r12
mov r10d, r14d
movsx rcx, byte [rdx]
cmp cl, 0x20
ja 0x180001835
bt r13, rcx
jae 0x180001835
inc rdx
jmp 0x180001821
cmp cl, 0x2b
je 0x18000183f
cmp cl, 0x2d
jne 0x180001852
inc rdx
mov r10d, 0xffffffff
cmp cl, 0x2d
cmovne r10d, r14d
movzx ecx, byte [rdx]
cmp cl, 0x30
jne 0x180001865
movzx eax, byte [rdx + 1]
sub al, 0x58
test al, 0xdf
jne 0x180001865
add rdx, 2
movsx ecx, byte [rdx]
lea eax, [rcx - 0x30]
cmp al, 9
jbe 0x18000187d
lea eax, [rcx - 0x41]
cmp al, 5
jbe 0x18000187d
lea eax, [rcx - 0x61]
cmp al, 5
ja 0x1800018af
lea eax, [rcx - 0x30]
mov r8d, ecx
cmp al, 9
ja 0x18000188c
lea eax, [rcx - 0x30]
jmp 0x18000189c
sub cl, 0x41
lea eax, [r8 - 0x37]
cmp cl, 5
jbe 0x18000189c
lea eax, [r8 - 0x57]
cmp eax, 0x10
jge 0x1800018af
shl r9, 4
cdqe
add r9, rax
inc rdx
jmp 0x180001865
test r10d, r10d
jg 0x1800018b7
neg r9
lea rax, [rdx + 1]
mov dword [rdi], r9d
add rdi, 4
inc ebx
mov rcx, rax
mov rdx, rax
cmp rax, r11
jb 0x1800017f8
movsxd rax, dword [rsi + 0x3c]
mov r11d, dword [rax + rsi + 0x50]
sub r11d, ebx
je 0x180001935
mov edx, r12d
mov r10d, r12d
test ebx, ebx
je 0x180001920
nop dword [rax + rax]
lea r8, [rsp + 0x270]
nop dword [rax + rax]
mov r9d, dword [r8]
lea eax, [rdx + r10]
movzx eax, byte [rax + rsi]
cmp eax, r9d
je 0x180001916
cmp r9d, 0xffffffff
jne 0x180001928
inc edx
add r8, 4
cmp edx, ebx
jb 0x180001900
mov eax, r10d
add rax, rsi
jmp 0x180001938
inc r10d
cmp r10d, r11d
jae 0x180001935
mov edx, r12d
jmp 0x1800018f0
mov rax, r12
mov qword [0x180007768], rax
mov qword [rsp + 0x38], rax
xor r9d, r9d
xor eax, eax
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [rsp + 0x38]
mov qword [rsp + 0x40], rbp
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, r14d
call fcn.180004e20
mov rcx, qword gs:[0x60]
mov r14, rax
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax + rax]
mov r10, qword [rcx + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov r11d, dword [rdx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x180001a05
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x180001a05
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [rbx + r9*4]
mov r8d, dword [rdx + r10]
mov edx, 0xc7ecc24d
add r8, r10
movzx eax, byte [r8]
inc r8
test al, al
je 0x180001a00
nop
movsx eax, al
lea r8, [r8 + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [r8 - 1]
test al, al
jne 0x1800019e0
cmp edx, 0x9a68f026
je 0x180001a0a
test r9d, r9d
jne 0x1800019c0
mov rcx, qword [rcx]
jmp 0x180001990
mov eax, dword [r11 + 0x24]
mov ecx, dword [r11 + 0x1c]
add rax, r10
add rcx, r10
movzx edx, word [rax + r9*2]
mov rax, qword [0x180007768]
mov ebp, dword [rcx + rdx*4]
add rbp, r10
test rax, rax
jne 0x180001c5f
mov rdi, qword [0x180007760]
test rdi, rdi
jne 0x180001abb
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r10, qword [rax]
mov r9, r10
nop word [rax + rax]
mov rcx, qword [r9 + 0x60]
mov edx, 0xded74612
movzx eax, word [r9 + 0x58]
shr rax, 1
lea r8, [rcx + rax*2]
cmp rcx, r8
je 0x180001aa0
nop word [rax + rax]
movsx eax, byte [rcx]
add rcx, 2
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r8
jne 0x180001a80
cmp edx, 0xcf821cf9
je 0x180001b2e
mov rax, qword [r9]
mov r9, rax
cmp rax, r10
je 0x180001ab1
cmp qword [rax + 0x30], r12
jne 0x180001a60
mov rdi, r12
mov qword [0x180007760], rdi
xor edx, edx
lea rcx, [rsp + 0x470]
mov r8d, 0x200
call sub.VCRUNTIME140.dll_memset
mov rax, r12
mov ebx, r12d
nop word [rax + rax]
lea rax, [rax + 1]
cmp byte [rax + r15], bl
lea r11, [rax + r15]
jne 0x180001ae0
cmp r15, r11
jae 0x180001bf7
mov rax, r15
lea rsi, [rsp + 0x470]
mov rdx, r15
mov r14d, 1
nop dword [rax + rax]
cmp byte [r15], 0x3f
jne 0x180001b34
cmp byte [rax + 1], 0x3f
lea rdx, [rax + 1]
jne 0x180001b23
inc rdx
mov r8d, 0xffffffff
jmp 0x180001bd6
mov rdi, qword [r9 + 0x30]
jmp 0x180001ab4
mov r8, r12
mov r10d, r14d
nop word [rax + rax]
movsx rcx, byte [rdx]
cmp cl, 0x20
ja 0x180001b54
bt r13, rcx
jae 0x180001b54
inc rdx
jmp 0x180001b40
cmp cl, 0x2b
je 0x180001b5e
cmp cl, 0x2d
jne 0x180001b71
inc rdx
mov r10d, 0xffffffff
cmp cl, 0x2d
cmovne r10d, r14d
movzx ecx, byte [rdx]
cmp cl, 0x30
jne 0x180001b84
movzx eax, byte [rdx + 1]
sub al, 0x58
test al, 0xdf
jne 0x180001b84
add rdx, 2
movsx ecx, byte [rdx]
lea eax, [rcx - 0x30]
cmp al, 9
jbe 0x180001b9c
lea eax, [rcx - 0x41]
cmp al, 5
jbe 0x180001b9c
lea eax, [rcx - 0x61]
cmp al, 5
ja 0x180001bce
lea eax, [rcx - 0x30]
mov r9d, ecx
cmp al, 9
ja 0x180001bab
lea eax, [rcx - 0x30]
jmp 0x180001bbb
sub cl, 0x41
lea eax, [r9 - 0x37]
cmp cl, 5
jbe 0x180001bbb
lea eax, [r9 - 0x57]
cmp eax, 0x10
jge 0x180001bce
shl r8, 4
cdqe
add r8, rax
inc rdx
jmp 0x180001b84
test r10d, r10d
jg 0x180001bd6
neg r8
lea r15, [rdx + 1]
mov dword [rsi], r8d
add rsi, 4
inc ebx
mov rax, r15
mov rdx, r15
cmp r15, r11
jb 0x180001b10
mov r14, qword [rsp + 0x30]
movsxd rax, dword [rdi + 0x3c]
mov r11d, dword [rax + rdi + 0x50]
sub r11d, ebx
je 0x180001c55
mov edx, r12d
mov r10d, r12d
test ebx, ebx
je 0x180001c40
nop
lea r8, [rsp + 0x470]
nop dword [rax + rax]
mov r9d, dword [r8]
lea eax, [rdx + r10]
movzx eax, byte [rax + rdi]
cmp eax, r9d
je 0x180001c36
cmp r9d, 0xffffffff
jne 0x180001c48
inc edx
add r8, 4
cmp edx, ebx
jb 0x180001c20
mov eax, r10d
add rax, rdi
jmp 0x180001c58
inc r10d
cmp r10d, r11d
jae 0x180001c55
mov edx, r12d
jmp 0x180001c10
mov rax, r12
mov qword [0x180007768], rax
mov qword [rsp + 0x50], rax
lea r8, [0x180006190]
xor eax, eax
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x60], rax
lea rdx, str.CONOUT_
lea rax, [rsp + 0x50]
mov qword [rsp + 0x58], rbp
mov r9, r14
mov qword [rsp + 0x20], rax
lea rcx, [0x180007770]
call fcn.180004e20
mov rsi, qword [rsp + 0x6b0]
mov rcx, qword [rsp + 0x670]
xor rcx, rsp
call fcn.180004e70
lea r11, [rsp + 0x680]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret