Function at 0x180001000
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
push rbx
push r12
sub rsp, 0x478
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x460], rax
cmp byte [0x180004680], 0
mov r12d, edx
mov dword [rsp + 0x30], edx
mov ebx, 1
jne 0x1800016ac
mov rax, qword gs:[0x60]
mov qword [r11 + 8], rbp
mov qword [r11 + 0x18], rdi
mov qword [r11 + 0x20], r14
mov rax, qword [rax + 0x18]
mov qword [r11 - 0x18], r15
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1800010d7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1800010d7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x44d1b097
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1800010d2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x1800010b0
cmp r8d, 0xadf96c75
je 0x1800010dc
test r9d, r9d
jne 0x180001090
mov rax, qword [rax]
jmp 0x180001060
mov ecx, dword [rbx + 0x24]
lea r14, str.FF_23
add rcx, r10
mov qword [rsp + 0x498], rsi
movabs r15, 0x100002600
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov ebp, dword [rcx + rdx*4]
mov rcx, qword [0x180004678]
add rbp, r10
test rcx, rcx
jne 0x18000132d
mov rsi, qword [0x180004670]
test rsi, rsi
jne 0x18000119b
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r10, qword [rax]
mov r9, r10
nop
mov rcx, qword [r9 + 0x60]
mov edx, 0xded74612
movzx eax, word [r9 + 0x58]
shr rax, 1
lea r8, [rcx + rax*2]
cmp rcx, r8
je 0x180001180
nop word [rax + rax]
movsx eax, byte [rcx]
add rcx, 2
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r8
jne 0x180001160
cmp edx, 0xcf821cf9
je 0x1800011fd
mov rax, qword [r9]
mov r9, rax
cmp rax, r10
je 0x180001192
cmp qword [rax + 0x30], 0
jne 0x180001140
xor esi, esi
mov qword [0x180004670], rsi
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x200
call sub.VCRUNTIME140.dll_memset
xor ebx, ebx
xor eax, eax
lea rax, [rax + 1]
cmp byte [rax + r14], bl
lea r11, [rax + r14]
jne 0x1800011b1
mov rax, r14
cmp r14, r11
jae 0x1800012c7
mov rcx, r14
lea rdi, [rsp + 0x60]
mov rdx, r14
mov r12d, 1
nop dword [rax]
cmp byte [rax], 0x3f
jne 0x180001203
cmp byte [rcx + 1], 0x3f
lea rdx, [rcx + 1]
jne 0x1800011f2
inc rdx
mov r9d, 0xffffffff
jmp 0x1800012a6
mov rsi, qword [r9 + 0x30]
jmp 0x180001194
xor r9d, r9d
mov r10d, r12d
nop dword [rax]
movsx rcx, byte [rdx]
cmp cl, 0x20
ja 0x180001224
bt r15, rcx
jae 0x180001224
inc rdx
jmp 0x180001210
cmp cl, 0x2b
je 0x18000122e
cmp cl, 0x2d
jne 0x180001241
inc rdx
mov r10d, 0xffffffff
cmp cl, 0x2d
cmovne r10d, r12d
movzx ecx, byte [rdx]
cmp cl, 0x30
jne 0x180001254
movzx eax, byte [rdx + 1]
sub al, 0x58
test al, 0xdf
jne 0x180001254
add rdx, 2
movsx ecx, byte [rdx]
lea eax, [rcx - 0x30]
cmp al, 9
jbe 0x18000126c
lea eax, [rcx - 0x41]
cmp al, 5
jbe 0x18000126c
lea eax, [rcx - 0x61]
cmp al, 5
ja 0x18000129e
lea eax, [rcx - 0x30]
mov r8d, ecx
cmp al, 9
ja 0x18000127b
lea eax, [rcx - 0x30]
jmp 0x18000128b
sub cl, 0x41
lea eax, [r8 - 0x37]
cmp cl, 5
jbe 0x18000128b
lea eax, [r8 - 0x57]
cmp eax, 0x10
jge 0x18000129e
shl r9, 4
cdqe
add r9, rax
inc rdx
jmp 0x180001254
test r10d, r10d
jg 0x1800012a6
neg r9
lea rax, [rdx + 1]
mov dword [rdi], r9d
add rdi, 4
inc ebx
mov rcx, rax
mov rdx, rax
cmp rax, r11
jb 0x1800011e0
mov r12d, dword [rsp + 0x30]
movsxd rax, dword [rsi + 0x3c]
mov r11d, dword [rax + rsi + 0x50]
sub r11d, ebx
je 0x180001324
xor edx, edx
xor r10d, r10d
test ebx, ebx
je 0x180001310
nop
lea r8, [rsp + 0x60]
nop word [rax + rax]
mov r9d, dword [r8]
lea eax, [rdx + r10]
movzx eax, byte [rax + rsi]
cmp eax, r9d
je 0x180001306
cmp r9d, 0xffffffff
jne 0x180001318
inc edx
add r8, 4
cmp edx, ebx
jb 0x1800012f0
mov ecx, r10d
add rcx, rsi
jmp 0x180001326
inc r10d
cmp r10d, r11d
jae 0x180001324
xor edx, edx
jmp 0x1800012e0
xor ecx, ecx
mov qword [0x180004678], rcx
mov rdx, rbp
call fcn.180001770
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, qword gs:[0x60]
mov r15, rax
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rcx + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov ebx, dword [rdx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1800013d7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1800013d7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xc7ecc24d
lea rax, [rdi + r9*4]
mov edx, dword [rax + r10]
add rdx, r10
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x1800013d2
nop
movsx eax, al
lea rdx, [rdx + 1]
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx - 1]
test al, al
jne 0x1800013b0
cmp r8d, 0x9a68f026
je 0x1800013dc
test r9d, r9d
jne 0x180001390
mov rcx, qword [rcx]
jmp 0x180001360
mov ecx, dword [rbx + 0x24]
mov rax, qword [0x180004678]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov ebp, dword [rcx + rdx*4]
add rbp, r10
test rax, rax
jne 0x18000163d
mov rdi, qword [0x180004670]
test rdi, rdi
jne 0x18000148b
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r10, qword [rax]
mov r9, r10
nop word [rax + rax]
mov rcx, qword [r9 + 0x60]
mov edx, 0xded74612
movzx eax, word [r9 + 0x58]
shr rax, 1
lea r8, [rcx + rax*2]
cmp rcx, r8
je 0x180001470
nop word [rax + rax]
movsx eax, byte [rcx]
add rcx, 2
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r8
jne 0x180001450
cmp edx, 0xcf821cf9
je 0x1800014fe
mov rax, qword [r9]
mov r9, rax
cmp rax, r10
je 0x180001482
cmp qword [rax + 0x30], 0
jne 0x180001430
xor edi, edi
mov qword [0x180004670], rdi
xor edx, edx
lea rcx, [rsp + 0x260]
mov r8d, 0x200
call sub.VCRUNTIME140.dll_memset
xor ebx, ebx
xor eax, eax
nop dword [rax]
nop dword [rax + rax]
lea rax, [rax + 1]
cmp byte [rax + r14], bl
lea r11, [rax + r14]
jne 0x1800014b0
cmp r14, r11
jae 0x1800015d3
mov rax, r14
lea rsi, [rsp + 0x260]
mov rdx, r14
mov r12d, 1
nop dword [rax + rax]
cmp byte [r14], 0x3f
jne 0x180001504
cmp byte [rax + 1], 0x3f
lea rdx, [rax + 1]
jne 0x1800014f3
inc rdx
mov r8d, 0xffffffff
jmp 0x1800015b2
mov rdi, qword [r9 + 0x30]
jmp 0x180001484
xor r8d, r8d
mov r10d, r12d
movabs r9, 0x100002600
movsx rcx, byte [rdx]
cmp cl, 0x20
ja 0x180001528
bt r9, rcx
jae 0x180001528
inc rdx
jmp 0x180001514
cmp cl, 0x2b
je 0x180001532
cmp cl, 0x2d
jne 0x180001545
inc rdx
mov r10d, 0xffffffff
cmp cl, 0x2d
cmovne r10d, r12d
movzx ecx, byte [rdx]
cmp cl, 0x30
jne 0x180001560
movzx eax, byte [rdx + 1]
sub al, 0x58
test al, 0xdf
jne 0x180001560
add rdx, 2
nop dword [rax + rax]
movsx ecx, byte [rdx]
lea eax, [rcx - 0x30]
cmp al, 9
jbe 0x180001578
lea eax, [rcx - 0x41]
cmp al, 5
jbe 0x180001578
lea eax, [rcx - 0x61]
cmp al, 5
ja 0x1800015aa
lea eax, [rcx - 0x30]
mov r9d, ecx
cmp al, 9
ja 0x180001587
lea eax, [rcx - 0x30]
jmp 0x180001597
sub cl, 0x41
lea eax, [r9 - 0x37]
cmp cl, 5
jbe 0x180001597
lea eax, [r9 - 0x57]
cmp eax, 0x10
jge 0x1800015aa
shl r8, 4
cdqe
add r8, rax
inc rdx
jmp 0x180001560
test r10d, r10d
jg 0x1800015b2
neg r8
lea r14, [rdx + 1]
mov dword [rsi], r8d
add rsi, 4
inc ebx
mov rax, r14
mov rdx, r14
cmp r14, r11
jb 0x1800014e0
mov r12d, dword [rsp + 0x30]
movsxd rax, dword [rdi + 0x3c]
mov r11d, dword [rax + rdi + 0x50]
sub r11d, ebx
je 0x180001634
xor edx, edx
xor r10d, r10d
test ebx, ebx
je 0x180001620
nop word [rax + rax]
lea r8, [rsp + 0x260]
nop dword [rax + rax]
mov r9d, dword [r8]
lea eax, [rdx + r10]
movzx eax, byte [rax + rdi]
cmp eax, r9d
je 0x180001616
cmp r9d, 0xffffffff
jne 0x180001628
inc edx
add r8, 4
cmp edx, ebx
jb 0x180001600
mov eax, r10d
add rax, rdi
jmp 0x180001636
inc r10d
cmp r10d, r11d
jae 0x180001634
xor edx, edx
jmp 0x1800015f0
xor eax, eax
mov qword [0x180004678], rax
mov qword [rsp + 0x38], rax
lea r8, [0x1800031b0]
xor eax, eax
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x28], rax
lea rdx, str.CONOUT_
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x50]
lea rax, [rsp + 0x38]
mov r9, r15
mov qword [rsp + 0x20], rax
call fcn.1800017d0
mov r15, qword [rsp + 0x470]
mov ebx, 1
mov r14, qword [rsp + 0x4a8]
mov rdi, qword [rsp + 0x4a0]
mov rsi, qword [rsp + 0x498]
mov rbp, qword [rsp + 0x490]
mov byte [0x180004680], 1
test r12d, r12d
je 0x1800016d5
sub r12d, 1
je 0x1800016cc
sub r12d, 1
je 0x1800016cc
cmp r12d, 1
jne 0x1800016e1
lea rcx, str.DLL_THREAD_DETACH_n
jmp 0x1800016dc
lea rcx, str.DLL_PROCESS_ATTACH_n
jmp 0x1800016dc
lea rcx, str.DLL_PROCESS_DETACH_n
call fcn.180001710
mov eax, ebx
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.180001820
add rsp, 0x478
pop r12
pop rbx
ret