Function at 0x18004f340
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
mov dword [rax + 8], ecx
push r13
sub rsp, 0x60
mov qword [rax + 0x20], rbx
mov r13, rdx
mov qword [rax - 0x10], rbp
mov qword [rax - 0x18], rsi
mov qword [rax - 0x20], rdi
mov qword [rax - 0x28], r12
mov qword [rax - 0x30], r14
mov qword [rax - 0x38], r15
mov eax, dword [0x1802ea7a8]
test al, 1
jne 0x18004f7bb
mov rsi, qword [0x1802ea7b0]
or eax, 1
mov dword [0x1802ea7a8], eax
test rsi, rsi
jne 0x18004f583
mov esi, 0xb8e4e945
xor ebp, ebp
nop dword [rax]
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x18]
mov r15, qword [rax + 0x10]
nop word [rax + rax]
movups xmm0, xmmword [r15 + 0x58]
movd eax, xmm0
movups xmmword [rsp + 0x20], xmm0
sub ax, 8
test ebp, ebp
je 0x18004f41d
mov rdi, qword [rsp + 0x28]
mov r8d, 0x811c9dc5
movzx eax, ax
shr rax, 1
lea r9, [rdi + rax*2]
cmp rdi, r9
je 0x18004f414
movsx eax, byte [rdi]
mov ecx, eax
sub al, 0x41
mov edx, ecx
or edx, 0x20
cmp al, 0x19
cmova edx, ecx
add rdi, 2
xor edx, r8d
imul r8d, edx, 0x1000193
cmp rdi, r9
jne 0x18004f3f0
cmp r8d, ebp
jne 0x18004f4a7
mov r11, qword [r15 + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov rcx, qword [rax + r11 + 0x88]
mov r12, rcx
mov r14d, ecx
shr r12, 0x20
add r14, r11
cmp r14, r11
je 0x18004f4a7
mov ebx, dword [r14 + 0x18]
xor r10d, r10d
test ebx, ebx
je 0x18004f4a7
mov r9d, dword [r14 + 0x20]
add r9, r11
mov edi, dword [r9]
mov r8d, 0x811c9dc5
add rdi, r11
movzx edx, byte [rdi]
test dl, dl
je 0x18004f496
nop dword [rax]
nop dword [rax + rax]
movsx eax, dl
lea rdi, [rdi + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [rdi]
cmova ecx, eax
xor ecx, r8d
imul r8d, ecx, 0x1000193
test dl, dl
jne 0x18004f470
cmp r8d, esi
je 0x18004f4af
inc r10d
add r9, 4
cmp r10d, ebx
jb 0x18004f451
mov r15, qword [r15]
jmp 0x18004f3c0
mov eax, dword [r14 + 0x24]
mov ecx, dword [r14 + 0x1c]
add rax, r11
add rcx, r11
movzx edx, word [rax + r10*2]
mov esi, dword [rcx + rdx*4]
add rsi, r11
cmp rsi, r14
jbe 0x18004f57c
lea rax, [r14 + r12]
cmp rsi, rax
jae 0x18004f57c
movzx edx, byte [rsi]
mov ebp, 0x811c9dc5
mov dword [rsp + 0x80], ebp
mov edi, ebp
mov dword [rsp + 0x84], ebp
cmp dl, 0x2e
je 0x18004f52c
nop dword [rax + rax]
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [rsi + 1]
cmova ecx, eax
inc rsi
xor ecx, ebp
imul ebp, ecx, 0x1000193
cmp dl, 0x2e
jne 0x18004f500
mov dword [rsp + 0x80], ebp
movzx edx, byte [rsi + 1]
inc rsi
test dl, dl
je 0x18004f56b
nop word [rax + rax]
movsx eax, dl
lea rsi, [rsi + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [rsi]
cmova ecx, eax
xor ecx, edi
imul edi, ecx, 0x1000193
test dl, dl
jne 0x18004f540
mov dword [rsp + 0x84], edi
mov rsi, qword [rsp + 0x80]
shr rsi, 0x20
jmp 0x18004f3a0
mov qword [0x1802ea7b0], rsi
mov rdx, qword [0x1802ea7b8]
test rdx, rdx
jne 0x18004f79f
mov ebp, 0xbd28aabc
xor r12d, r12d
nop dword [rax + rax]
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x18]
mov r15, qword [rax + 0x10]
nop word [rax + rax]
movups xmm0, xmmword [r15 + 0x58]
movd eax, xmm0
movups xmmword [rsp + 0x20], xmm0
sub ax, 8
test r12d, r12d
je 0x18004f61e
mov rdi, qword [rsp + 0x28]
mov r8d, 0x811c9dc5
movzx eax, ax
shr rax, 1
lea r9, [rdi + rax*2]
cmp rdi, r9
je 0x18004f615
movsx eax, byte [rdi]
mov ecx, eax
sub al, 0x41
mov edx, ecx
or edx, 0x20
cmp al, 0x19
cmova edx, ecx
add rdi, 2
xor edx, r8d
imul r8d, edx, 0x1000193
cmp rdi, r9
jne 0x18004f5f1
cmp r8d, r12d
jne 0x18004f6b7
mov r11, qword [r15 + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov rcx, qword [rax + r11 + 0x88]
mov r13, rcx
mov r14d, ecx
shr r13, 0x20
add r14, r11
cmp r14, r11
je 0x18004f6b7
mov ebx, dword [r14 + 0x18]
xor r10d, r10d
test ebx, ebx
je 0x18004f6b7
mov r9d, dword [r14 + 0x20]
add r9, r11
nop dword [rax]
nop word [rax + rax]
mov edi, dword [r9]
mov r8d, 0x811c9dc5
add rdi, r11
movzx edx, byte [rdi]
test dl, dl
je 0x18004f6a6
nop dword [rax]
nop word [rax + rax]
movsx eax, dl
lea rdi, [rdi + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [rdi]
cmova ecx, eax
xor ecx, r8d
imul r8d, ecx, 0x1000193
test dl, dl
jne 0x18004f680
cmp r8d, ebp
je 0x18004f6bf
inc r10d
add r9, 4
cmp r10d, ebx
jb 0x18004f660
mov r15, qword [r15]
jmp 0x18004f5c0
mov eax, dword [r14 + 0x24]
mov ecx, dword [r14 + 0x1c]
add rax, r11
add rcx, r11
movzx edx, word [rax + r10*2]
mov edx, dword [rcx + rdx*4]
add rdx, r11
cmp rdx, r14
jbe 0x18004f793
lea rax, [r14 + r13]
cmp rdx, rax
jae 0x18004f793
movzx edi, byte [rdx]
mov r12d, 0x811c9dc5
mov dword [rsp + 0x80], r12d
mov r8d, r12d
mov dword [rsp + 0x84], r12d
cmp dil, 0x2e
je 0x18004f743
movsx eax, dil
sub dil, 0x41
mov ecx, eax
or ecx, 0x20
cmp dil, 0x19
movzx edi, byte [rdx + 1]
cmova ecx, eax
inc rdx
xor ecx, r12d
imul r12d, ecx, 0x1000193
cmp dil, 0x2e
jne 0x18004f710
mov dword [rsp + 0x80], r12d
movzx edi, byte [rdx + 1]
inc rdx
test dil, dil
je 0x18004f782
nop
movsx eax, dil
lea rdx, [rdx + 1]
sub dil, 0x41
mov ecx, eax
or ecx, 0x20
cmp dil, 0x19
movzx edi, byte [rdx]
cmova ecx, eax
xor ecx, r8d
imul r8d, ecx, 0x1000193
test dil, dil
jne 0x18004f750
mov dword [rsp + 0x84], r8d
mov rbp, qword [rsp + 0x80]
shr rbp, 0x20
jmp 0x18004f5a0
mov r13, qword [rsp + 0x78]
mov qword [0x1802ea7b8], rdx
lea rcx, str.ntdll.dll
call rdx
lea rdx, str.NtApphelpCacheControl
mov rcx, rax
call rsi
mov qword [0x1802ea7a0], rax
mov rax, qword [0x1802ea788]
test rax, rax
jne 0x18004f9fb
mov rdi, qword [0x1802ea7c0]
test rdi, rdi
jne 0x18004f9c0
mov ebp, 0x700da41
xor r15d, r15d
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x18]
mov r14, qword [rax + 0x10]
nop dword [rax + rax]
movups xmm0, xmmword [r14 + 0x58]
movd eax, xmm0
movups xmmword [rsp + 0x20], xmm0
sub ax, 8
test r15d, r15d
je 0x18004f85e
mov rdi, qword [rsp + 0x28]
mov r8d, 0x811c9dc5
movzx eax, ax
shr rax, 1
lea r9, [rdi + rax*2]
cmp rdi, r9
je 0x18004f855
movsx eax, byte [rdi]
mov ecx, eax
sub al, 0x41
mov edx, ecx
or edx, 0x20
cmp al, 0x19
cmova edx, ecx
add rdi, 2
xor edx, r8d
imul r8d, edx, 0x1000193
cmp rdi, r9
jne 0x18004f831
cmp r8d, r15d
jne 0x18004f8e5
mov r11, qword [r14 + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov rcx, qword [rax + r11 + 0x88]
mov r12, rcx
mov esi, ecx
shr r12, 0x20
add rsi, r11
cmp rsi, r11
je 0x18004f8e5
mov ebx, dword [rsi + 0x18]
xor r10d, r10d
test ebx, ebx
je 0x18004f8e5
mov r9d, dword [rsi + 0x20]
add r9, r11
mov edi, dword [r9]
mov r8d, 0x811c9dc5
add rdi, r11
movzx eax, byte [rdi]
test al, al
je 0x18004f8d4
nop dword [rax]
nop word [rax + rax]
movsx ecx, al
lea rdi, [rdi + 1]
sub al, 0x41
mov edx, ecx
or edx, 0x20
cmp al, 0x19
movzx eax, byte [rdi]
cmova edx, ecx
xor edx, r8d
imul r8d, edx, 0x1000193
test al, al
jne 0x18004f8b0
cmp r8d, ebp
je 0x18004f8ed
inc r10d
add r9, 4
cmp r10d, ebx
jb 0x18004f890
mov r14, qword [r14]
jmp 0x18004f800
mov eax, dword [rsi + 0x24]
mov ecx, dword [rsi + 0x1c]
add rax, r11
add rcx, r11
movzx edx, word [rax + r10*2]
mov edi, dword [rcx + rdx*4]
add rdi, r11
cmp rdi, rsi
jbe 0x18004f9b9
lea rax, [rsi + r12]
cmp rdi, rax
jae 0x18004f9b9
movzx edx, byte [rdi]
mov r15d, 0x811c9dc5
mov dword [rsp + 0x78], r15d
mov r8d, r15d
mov dword [rsp + 0x7c], r15d
cmp dl, 0x2e
je 0x18004f96c
nop word [rax + rax]
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [rdi + 1]
cmova ecx, eax
inc rdi
xor ecx, r15d
imul r15d, ecx, 0x1000193
cmp dl, 0x2e
jne 0x18004f940
mov dword [rsp + 0x78], r15d
movzx edx, byte [rdi + 1]
inc rdi
test dl, dl
je 0x18004f9ab
nop word [rax + rax]
movsx eax, dl
lea rdi, [rdi + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [rdi]
cmova ecx, eax
xor ecx, r8d
imul r8d, ecx, 0x1000193
test dl, dl
jne 0x18004f980
mov dword [rsp + 0x7c], r8d
mov rbp, qword [rsp + 0x78]
shr rbp, 0x20
jmp 0x18004f7e3
mov qword [0x1802ea7c0], rdi
xor ecx, ecx
mov edx, 0x28000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call rdi
mov qword [0x1802ea788], rax
mov rdi, rax
xor eax, eax
mov ecx, 0x28000
rep stosb byte [rdi], al
mov rax, qword [0x1802ea7a0]
mov qword [0x1802ea780], rax
mov rax, qword [0x1802ea788]
mov r15, qword [rsp + 0x30]
movabs rcx, 0xb19d1ccacab
mov r14, qword [rsp + 0x38]
mov r12, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x88]
mov qword [rax + 0x10], 0
mov rax, qword [0x1802ea788]
mov qword [rax], rcx
test r13, r13
je 0x18004faaf
mov rax, qword [0x1802ea788]
movups xmm0, xmmword [r13]
movsxd rcx, dword [rsp + 0x70]
movups xmmword [rax + 0x18], xmm0
movsd xmm1, qword [r13 + 0x10]
movsd qword [rax + 0x28], xmm1
mov rax, qword [0x1802ea788]
mov qword [rax + 0x10], 0x18
mov rax, qword [0x1802ea788]
mov qword [rax + 8], rcx
mov ecx, 0xb
mov rdx, qword [0x1802ea788]
call fcn.180082540
mov rcx, qword [0x1802ea788]
movups xmm0, xmmword [rcx + 0x18]
movups xmmword [r13], xmm0
movsd xmm1, qword [rcx + 0x28]
movsd qword [r13 + 0x10], xmm1
add rsp, 0x60
pop r13
ret
mov rdx, qword [0x1802ea788]
mov ecx, 0xb
add rsp, 0x60
pop r13
jmp fcn.180082540