Function at 0x1800522e0
Capabilities:
Access peb ldr_data
Encode data using xor
Get storage device properties
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x78]
sub rsp, 0x150
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
mov rax, qword [0x1801165d8]
xor rax, rsp
mov qword [rbp], rax
mov r13, rdx
mov r8d, ecx
xor r14d, r14d
movups xmm0, xmmword [0x180104298]
movups xmmword [rbp - 0x68], xmm0
movups xmm1, xmmword [0x1801042a8]
movups xmmword [rbp - 0x58], xmm1
mov eax, dword [0x1801042b8]
mov dword [rbp - 0x48], eax
lea r9, [rbp - 6]
test ecx, ecx
jns 0x1800523a0
neg r8d
nop word [rax + rax]
sub r9, 2
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dx
shl ax, 2
lea ecx, [rax + rdx]
add cx, cx
sub r8w, cx
add r8w, 0x30
mov word [r9], r8w
mov r8d, edx
test edx, edx
jne 0x180052360
add r9, 0xfffffffffffffffe
mov eax, reloc.WLDAP32.dll_Ordinal_45
mov word [r9], ax
jmp 0x1800523d0
sub r9, 2
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dx
shl ax, 2
lea ecx, [rax + rdx]
add cx, cx
sub r8w, cx
add r8w, 0x30
mov word [r9], r8w
mov r8d, edx
test edx, edx
jne 0x1800523a0
lea r8, [rbp - 6]
mov rdx, r9
lea rcx, [rsp + 0x40]
call fcn.180052fc0
nop
cmp word [rbp - 0x46], 0
je 0x180052574
mov r8d, r14d
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x180052531
movdqa xmm5, xmmword [0x180104490]
movdqa xmm4, xmmword [0x180104910]
mov eax, 4
movd xmm6, eax
movdqa xmm7, xmmword [0x1801044c0]
mov eax, Ordinal_33
movd xmm8, eax
movdqa xmm9, xmmword [0x180104590]
lea rcx, [rbp - 0x68]
nop word [rax + rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm9
paddw xmm3, xmm2
movq xmm0, qword [rcx]
pxor xmm3, xmm0
movq qword [rcx], xmm3
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm9
paddw xmm3, xmm2
movq xmm0, qword [rcx + 8]
pxor xmm3, xmm0
movq qword [rcx + 8], xmm3
add r8d, 8
lea rcx, [rcx + 0x10]
cmp r8d, 0x10
jl 0x180052440
cmp r8d, 0x12
jge 0x180052574
movsxd rax, r8d
lea r9, [rbp - 0x68]
lea r9, [r9 + rax*2]
nop dword [rax]
mov eax, 0x51eb851f
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x32
movzx eax, r8w
sub ax, cx
add ax, 0x36
xor word [r9], ax
inc r8d
lea r9, [r9 + 2]
cmp r8d, 0x12
jl 0x180052540
lea rax, [rbp - 0x68]
mov r15, 0xffffffffffffffff
mov rdi, r15
inc rdi
cmp word [rax + rdi*2], 0
jne 0x180052582
mov r8, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
sub rax, r8
cmp rdi, rax
ja 0x180052641
lea rax, [r8 + rdi]
mov qword [rsp + 0x50], rax
lea rsi, [rsp + 0x40]
cmp rcx, 8
cmovae rsi, qword [rsp + 0x40]
lea rax, [rbp - 0x68]
lea rax, [rax + rdi*2]
cmp rax, rsi
jbe 0x1800525ef
lea rax, [rsi + r8*2]
lea rcx, [rbp - 0x68]
cmp rcx, rax
ja 0x1800525ef
lea rax, [rbp - 0x68]
cmp rsi, rax
jbe 0x1800525f2
lea rax, [rbp - 0x68]
mov r14, rsi
sub r14, rax
sar r14, 1
jmp 0x1800525f2
mov r14, rdi
lea rcx, [rsi + rdi*2]
lea r8, [r8*2 + 2]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memmove
lea rbx, [r14 + r14]
mov r8, rbx
lea rdx, [rbp - 0x68]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8, rdi
sub r8, r14
lea rax, [r14 + rdi]
lea rdx, [rbp - 0x68]
lea rdx, [rdx + rax*2]
lea rcx, [rbx + rsi]
add r8, r8
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsp + 0x40]
xor r14d, r14d
jmp 0x18005265c
mov qword [rsp + 0x28], rdi
lea rax, [rbp - 0x68]
mov qword [rsp + 0x20], rax
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.180053110
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x80], r14
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x78], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
lea rcx, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
cmovae rcx, qword [rsp + 0x68]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x180052706
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180052701
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180052701
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800ac234
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], r14w
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x18005275e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180052759
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180052759
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800ac234
cmp r12, 0xffffffffffffffff
jne 0x18005276b
xor al, al
jmp 0x1800529f6
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
lea rax, [0x180052a40]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], r12
mov qword [rbp - 0x74], 0
mov dword [rbp - 0x78], r14d
mov qword [rbp - 0x40], r14
mov dword [rsp + 0x60], r14d
mov rax, qword [0x1802dbd78]
test rax, rax
jne 0x180052859
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x180052836
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x180052836
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
mov r8d, 0x23193637
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x180052831
nop
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x180052810
cmp r8d, 0xa8b92842
je 0x18005283b
test r9d, r9d
jne 0x1800527f0
mov rax, qword [rax]
jmp 0x1800527c0
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rbx + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov eax, dword [rcx + rax*4]
add rax, r10
mov qword [0x1802dbd78], rax
mov qword [rsp + 0x38], r14
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 8
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x20], rcx
mov r9d, listen
lea r8, [rbp - 0x78]
mov edx, 0x2d1400
mov rcx, r12
call rax
test eax, eax
jne 0x180052898
xor bl, bl
jmp 0x1800529e4
mov r14d, dword [rbp - 0x3c]
mov ecx, r14d
call fcn.1800ac23c
mov rsi, rax
mov r8d, r14d
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov qword [rbp - 0x38], rsi
mov r11, qword [0x1802dbd70]
test r11, r11
jne 0x18005297a
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax]
mov r10, qword [rcx + 0x30]
movsxd rax, dword [r10 + 0x3c]
mov ebx, dword [rax + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x180052956
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x180052956
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rax, [rdi + r9*4]
mov edx, dword [rax + r10]
add rdx, r10
mov r8d, 0x6b379f8
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x180052951
nop
movsx eax, al
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
test al, al
jne 0x180052930
cmp r8d, 0xf4c7590f
je 0x18005295b
test r9d, r9d
jne 0x180052910
mov rcx, qword [rcx]
jmp 0x1800528e0
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rbx + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov r11d, dword [rcx + rax*4]
add r11, r10
mov qword [0x1802dbd70], r11
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rsi
mov r9d, listen
lea r8, [rbp - 0x78]
mov edx, 0x2d1400
mov rcx, r12
call r11
test eax, eax
je 0x1800529d9
mov eax, dword [rsi + 0x18]
test eax, eax
je 0x1800529d9
lea rdx, [rsi + rax]
nop dword [rax + rax]
inc r15
cmp byte [rdx + r15], 0
jne 0x1800529c0
mov r8, r15
mov rcx, r13
call fcn.180007d70
mov bl, 1
jmp 0x1800529db
xor bl, bl
mov rcx, rsi
call fcn.1800ac234
nop
test r12, r12
je 0x1800529f3
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
movzx eax, bl
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.1800ac1d0
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret