Function at 0x180010ab4
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x90
cmp edx, 1
jne 0x180011179
mov rdx, qword [0x1800f5fc8]
xor ebx, ebx
test rdx, rdx
jne 0x180010c9a
mov rax, qword gs:[0x60]
mov r14d, ebx
mov r12d, 0x6f2ff109
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rax, qword [rax]
mov qword [rbp + 0x7f], rax
mov r11, rax
mov eax, dword [r11 + 0x58]
sub ax, 8
test r14d, r14d
je 0x180010b60
mov r8, qword [r11 + 0x60]
mov r9d, 0xfcf20e08
movzx eax, ax
shr rax, 1
lea r10, [r8 + rax*2]
jmp 0x180010b52
movsx eax, byte [r8]
mov ecx, eax
sub al, 0x41
mov edx, ecx
or edx, 0x20
cmp al, 0x19
cmova edx, ecx
xor edx, r9d
imul r9d, edx, 0x1000193
add r8, 2
cmp r8, r10
jne 0x180010b32
cmp r9d, r14d
jne 0x180010c7a
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov rax, qword [rax + r9 + 0x88]
mov r10d, eax
add r10, r9
shr rax, 0x20
cmp r10, r9
je 0x180010c7a
mov edi, dword [r10 + 0x18]
test edi, edi
je 0x180010c7a
mov ecx, dword [r10 + 0x20]
dec edi
mov r15d, 0xfcf20e08
lea rcx, [rcx + rdi*4]
mov r8d, dword [rcx + r9]
add r8, r9
jmp 0x180010bc6
movsx ecx, sil
sub sil, 0x41
mov edx, ecx
or edx, 0x20
cmp sil, 0x19
cmova edx, ecx
xor edx, r15d
imul r15d, edx, 0x1000193
mov sil, byte [r8]
inc r8
test sil, sil
jne 0x180010ba8
cmp r15d, r12d
je 0x180010be3
mov ecx, dword [r10 + 0x20]
test edi, edi
jne 0x180010b93
jmp 0x180010c7a
mov edx, dword [r10 + 0x24]
add rdx, r9
movzx r8d, word [rdx + rdi*2]
mov edx, dword [r10 + 0x1c]
add rdx, r9
mov edx, dword [rdx + r8*4]
add rdx, r9
cmp rdx, r10
jbe 0x180010c93
lea rcx, [rax + r10]
cmp rdx, rcx
jae 0x180010c93
mov r14d, 0xfcf20e08
mov r12d, r14d
jmp 0x180010c3f
movsx eax, r8b
sub r8b, 0x41
mov ecx, eax
or ecx, 0x20
cmp r8b, 0x19
cmova ecx, eax
xor ecx, r14d
imul r14d, ecx, 0x1000193
inc rdx
mov r8b, byte [rdx]
cmp r8b, 0x2e
jne 0x180010c1e
jmp 0x180010c68
movsx eax, r8b
sub r8b, 0x41
mov ecx, eax
or ecx, 0x20
cmp r8b, 0x19
cmova ecx, eax
xor ecx, r12d
imul r12d, ecx, 0x1000193
inc rdx
mov r8b, byte [rdx]
test r8b, r8b
jne 0x180010c4a
mov rax, qword [rbp + 0x7f]
mov r11, qword [rax]
mov rax, qword [r11]
mov r11, rax
cmp rax, qword [rbp + 0x7f]
je 0x180010c90
cmp qword [rax + 0x30], rbx
jne 0x180010b0f
mov rdx, rbx
mov qword [0x1800f5fc8], rdx
mov dword [rbp - 9], 0x2f26352e
mov r8d, ebx
mov dword [rbp - 5], 0x2b226b28
mov word [rbp - 1], 0x24
movsxd rcx, r8d
lea eax, [r8 + 0x40]
inc r8d
xor byte [rbp + rcx - 9], al
cmp r8d, 9
jb 0x180010cb1
lea rcx, [rbp - 9]
mov byte [rbp], bl
call rdx
mov r12, rax
test rax, rax
jne 0x180010ee4
mov rdx, qword [0x1800f5fc0]
test rdx, rdx
jne 0x180010ea4
mov rax, qword gs:[0x60]
mov edi, 0x9d485e8d
mov r13d, ebx
mov dword [rbp + 0x6f], edi
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rax, qword [rax]
mov qword [rbp + 0x7f], rax
mov r11, rax
mov eax, dword [r11 + 0x58]
sub ax, 8
test r13d, r13d
je 0x180010d61
mov r8, qword [r11 + 0x60]
mov r9d, 0x61c10eeb
movzx eax, ax
shr rax, 1
lea r10, [r8 + rax*2]
jmp 0x180010d53
movsx eax, byte [r8]
mov ecx, eax
sub al, 0x41
mov edx, ecx
or edx, 0x20
cmp al, 0x19
cmova edx, ecx
xor edx, r9d
imul r9d, edx, 0x1000193
add r8, 2
cmp r8, r10
jne 0x180010d33
cmp r9d, r13d
jne 0x180010e84
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov rax, qword [rax + r9 + 0x88]
mov r10d, eax
add r10, r9
shr rax, 0x20
cmp r10, r9
je 0x180010e84
mov edi, dword [r10 + 0x18]
test edi, edi
je 0x180010e84
mov r12d, dword [r10 + 0x20]
dec edi
mov r14d, 0x61c10eeb
lea rcx, [r12 + rdi*4]
mov r8d, dword [rcx + r9]
add r8, r9
jmp 0x180010dc7
movsx ecx, sil
sub sil, 0x41
mov edx, ecx
or edx, 0x20
cmp sil, 0x19
cmova edx, ecx
xor edx, r14d
imul r14d, edx, 0x1000193
mov sil, byte [r8]
inc r8
test sil, sil
jne 0x180010da9
cmp r14d, dword [rbp + 0x6f]
je 0x180010de1
test edi, edi
jne 0x180010d94
jmp 0x180010e84
mov edx, dword [r10 + 0x24]
add rdx, r9
movzx r8d, word [rdx + rdi*2]
mov edx, dword [r10 + 0x1c]
add rdx, r9
mov edx, dword [rdx + r8*4]
add rdx, r9
cmp rdx, r10
jbe 0x180010e9d
lea rcx, [rax + r10]
cmp rdx, rcx
jae 0x180010e9d
mov edi, 0x61c10eeb
mov r13d, edi
mov dword [rbp + 0x6f], edi
jmp 0x180010e3f
movsx eax, r8b
sub r8b, 0x41
mov ecx, eax
or ecx, 0x20
cmp r8b, 0x19
cmova ecx, eax
xor ecx, r13d
imul r13d, ecx, 0x1000193
inc rdx
mov r8b, byte [rdx]
cmp r8b, 0x2e
jne 0x180010e1e
inc rdx
mov r8b, byte [rdx]
test r8b, r8b
je 0x180010e7d
movsx eax, r8b
sub r8b, 0x41
mov ecx, eax
or ecx, 0x20
cmp r8b, 0x19
cmova ecx, eax
inc rdx
xor ecx, edi
imul edi, ecx, 0x1000193
mov r8b, byte [rdx]
test r8b, r8b
jne 0x180010e53
mov dword [rbp + 0x6f], edi
mov rax, qword [rbp + 0x7f]
mov r11, qword [rax]
mov rax, qword [r11]
mov r11, rax
cmp rax, qword [rbp + 0x7f]
je 0x180010e9a
cmp qword [rax + 0x30], rbx
jne 0x180010d10
mov rdx, rbx
mov qword [0x1800f5fc0], rdx
mov dword [rbp + 1], 0x2f26352e
mov r8d, ebx
mov dword [rbp + 5], 0x2b226b28
mov word [rbp + 9], 0x24
movsxd rcx, r8d
lea eax, [r8 + 0x40]
inc r8d
xor byte [rbp + rcx + 1], al
cmp r8d, 9
jb 0x180010ebb
lea rcx, [rbp + 1]
mov byte [rbp + 0xa], bl
call rdx
mov r12, rax
test rax, rax
je 0x180011175
mov r8, qword [0x1800f5fb8]
test r8, r8
jne 0x1800110a9
mov rax, qword gs:[0x60]
mov edi, 0xe5ede08d
mov r14d, ebx
mov dword [rbp + 0x6f], edi
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rax, qword [rax]
mov qword [rbp + 0x7f], rax
mov r11, rax
mov eax, dword [r11 + 0x58]
sub ax, 8
test r14d, r14d
je 0x180010f6b
mov r8, qword [r11 + 0x60]
mov r9d, 0xdb0b159d
movzx eax, ax
shr rax, 1
lea r10, [r8 + rax*2]
jmp 0x180010f5d
movsx eax, byte [r8]
mov ecx, eax
sub al, 0x41
mov edx, ecx
or edx, 0x20
cmp al, 0x19
cmova edx, ecx
xor edx, r9d
imul r9d, edx, 0x1000193
add r8, 2
cmp r8, r10
jne 0x180010f3d
cmp r9d, r14d
jne 0x180011089
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov rax, qword [rax + r9 + 0x88]
mov r10d, eax
add r10, r9
shr rax, 0x20
cmp r10, r9
je 0x180011089
mov edi, dword [r10 + 0x18]
test edi, edi
je 0x180011089
mov ecx, dword [r10 + 0x20]
dec edi
mov r15d, 0xdb0b159d
lea rcx, [rcx + rdi*4]
mov r8d, dword [rcx + r9]
add r8, r9
jmp 0x180010fd1
movsx ecx, sil
sub sil, 0x41
mov edx, ecx
or edx, 0x20
cmp sil, 0x19
cmova edx, ecx
xor edx, r15d
imul r15d, edx, 0x1000193
mov sil, byte [r8]
inc r8
test sil, sil
jne 0x180010fb3
cmp r15d, dword [rbp + 0x6f]
je 0x180010fef
mov ecx, dword [r10 + 0x20]
test edi, edi
jne 0x180010f9e
jmp 0x180011089
mov edx, dword [r10 + 0x24]
add rdx, r9
movzx r8d, word [rdx + rdi*2]
mov edx, dword [r10 + 0x1c]
add rdx, r9
mov r8d, dword [rdx + r8*4]
add r8, r9
cmp r8, r10
jbe 0x1800110a2
lea rcx, [rax + r10]
cmp r8, rcx
jae 0x1800110a2
mov edi, 0xdb0b159d
mov r14d, edi
mov dword [rbp + 0x6f], edi
jmp 0x18001104a
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, r14d
imul r14d, ecx, 0x1000193
inc r8
mov dl, byte [r8]
cmp dl, 0x2e
jne 0x18001102c
inc r8
mov dl, byte [r8]
test dl, dl
je 0x180011082
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
inc r8
xor ecx, edi
imul edi, ecx, 0x1000193
mov dl, byte [r8]
test dl, dl
jne 0x18001105c
mov dword [rbp + 0x6f], edi
mov rax, qword [rbp + 0x7f]
mov r11, qword [rax]
mov rax, qword [r11]
mov r11, rax
cmp rax, qword [rbp + 0x7f]
je 0x18001109f
cmp qword [rax + 0x30], rbx
jne 0x180010f1a
mov r8, rbx
mov qword [0x1800f5fb8], r8
movdqa xmm0, xmmword [0x18009daf0]
xor eax, eax
movdqu xmmword [rbp + 0xb], xmm0
mov byte [rbp + 0x1b], al
mov edx, ebx
movsxd rcx, edx
lea eax, [rdx + 0x40]
inc edx
xor byte [rbp + rcx + 0xb], al
cmp edx, 0x10
jb 0x1800110bd
lea rdx, [rbp + 0xb]
mov byte [rbp + 0x1b], bl
mov rcx, r12
call r8
mov rdi, rax
test rax, rax
je 0x180011175
mov qword [rsp + 0x50], rbx
lea r15, [0x18000c01c]
mov qword [rsp + 0x48], rbx
lea rcx, [0x1800f5fb0]
mov qword [rsp + 0x40], rbx
or rsi, 0xffffffffffffffff
mov qword [rsp + 0x38], rbx
mov r14d, 0x1fffff
mov dword [rsp + 0x30], 0x44
mov r9, rsi
mov qword [rsp + 0x28], rbx
xor r8d, r8d
mov edx, r14d
mov qword [rsp + 0x20], r15
call rdi
test eax, eax
jns 0x180011179
mov qword [rsp + 0x50], rbx
lea rcx, [0x1800f5fb0]
mov qword [rsp + 0x48], rbx
mov r9, rsi
mov qword [rsp + 0x40], rbx
xor r8d, r8d
mov qword [rsp + 0x38], rbx
mov edx, r14d
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r15
call rdi
test eax, eax
setns bl
mov eax, ebx
jmp 0x18001117e
xor eax, eax
jmp 0x18001117e
mov eax, 1
mov rbx, qword [rsp + 0xd0]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret