Function at 0x180013170
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x180233168]
mov r15, rcx
test rax, rax
jne 0x180013259
mov rax, qword gs:[0x60]
mov rdx, qword [rax + 0x18]
mov rax, qword [rdx + 0x10]
mov rbp, qword [rax]
mov rsi, rbp
mov r11, qword [rsi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov edi, dword [rax + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x18001323a
mov r10d, dword [rdi + 0x18]
test r10d, r10d
je 0x18001323a
mov r14d, dword [rdi + 0x20]
nop word [rax + rax]
dec r10d
mov r9d, 0xf75d0ac9
lea rax, [r14 + r10*4]
mov r8d, dword [rax + r11]
add r8, r11
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x180013235
nop
movsx eax, dl
lea r8, [r8 + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [r8 - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test dl, dl
jne 0x180013200
cmp r9d, 0x18c50fa9
je 0x180013441
test r10d, r10d
jne 0x1800131e0
mov rax, qword [rsi]
mov rsi, rax
cmp rax, rbp
je 0x180013250
cmp qword [rax + 0x30], 0
jne 0x1800131b0
xor eax, eax
mov qword [0x180233168], rax
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call rax
mov r13, rax
test rax, rax
je 0x180013996
mov rax, qword [0x180233040]
mov qword [rsp + 0x90], r12
test rax, rax
jne 0x180013349
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov rsi, rbp
mov r11, qword [rsi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov edi, dword [rax + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x18001332a
mov r10d, dword [rdi + 0x18]
test r10d, r10d
je 0x18001332a
mov r14d, dword [rdi + 0x20]
nop word [rax + rax]
dec r10d
mov r9d, 0xd3628641
lea rax, [r14 + r10*4]
mov r8d, dword [rax + r11]
add r8, r11
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x180013325
nop
movsx eax, dl
lea r8, [r8 + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [r8 - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test dl, dl
jne 0x1800132f0
cmp r9d, 0x149fcf7
je 0x18001345d
test r10d, r10d
jne 0x1800132d0
mov rax, qword [rsi]
mov rsi, rax
cmp rax, rbp
je 0x180013340
cmp qword [rax + 0x30], 0
jne 0x1800132a0
xor eax, eax
mov qword [0x180233040], rax
mov r8d, 4
mov rdx, r15
mov rcx, r13
call rax
mov r12, rax
test rax, rax
jne 0x1800134a3
mov rax, qword [0x180233030]
test rax, rax
jne 0x180013435
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov rsi, rbp
nop word [rax + rax]
mov r11, qword [rsi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov edi, dword [rax + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x180013416
mov r10d, dword [rdi + 0x18]
test r10d, r10d
je 0x180013416
mov r14d, dword [rdi + 0x20]
nop word [rax + rax]
dec r10d
mov r9d, 0xf0f89575
lea rax, [r14 + r10*4]
mov r8d, dword [rax + r11]
add r8, r11
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x180013411
nop
movsx eax, dl
lea r8, [r8 + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [r8 - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test dl, dl
jne 0x1800133e0
cmp r9d, 0xa3f46b0
je 0x180013479
test r10d, r10d
jne 0x1800133c0
mov rax, qword [rsi]
mov rsi, rax
cmp rax, rbp
je 0x18001342c
cmp qword [rax + 0x30], 0
jne 0x180013390
xor eax, eax
mov qword [0x180233030], rax
mov rcx, r13
call rax
xor al, al
jmp 0x18001398e
mov ecx, dword [rdi + 0x24]
add rcx, r11
movzx edx, word [rcx + r10*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rcx + rdx*4]
add rax, r11
jmp 0x180013252
mov ecx, dword [rdi + 0x24]
add rcx, r11
movzx edx, word [rcx + r10*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rcx + rdx*4]
add rax, r11
jmp 0x180013342
mov ecx, dword [rdi + 0x24]
add rcx, r11
movzx edx, word [rcx + r10*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rcx + rdx*4]
mov rcx, r13
add rax, r11
mov qword [0x180233030], rax
call rax
xor al, al
jmp 0x18001398e
mov rax, qword [0x180232f80]
test rax, rax
jne 0x180013579
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov rsi, rbp
nop word [rax + rax]
mov r11, qword [rsi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov edi, dword [rax + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x18001355a
mov r10d, dword [rdi + 0x18]
test r10d, r10d
je 0x18001355a
mov r14d, dword [rdi + 0x20]
nop word [rax + rax]
dec r10d
mov r9d, 0x42c20cbe
lea rax, [r14 + r10*4]
mov r8d, dword [rax + r11]
add r8, r11
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x180013555
nop
movsx eax, dl
lea r8, [r8 + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [r8 - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test dl, dl
jne 0x180013520
cmp r9d, 0x6b8b5f76
je 0x18001375f
test r10d, r10d
jne 0x180013500
mov rax, qword [rsi]
mov rsi, rax
cmp rax, rbp
je 0x180013570
cmp qword [rax + 0x30], 0
jne 0x1800134d0
xor eax, eax
mov qword [0x180232f80], rax
lea rcx, [rsp + 0x98]
mov r9d, 0x24
mov qword [rsp + 0x20], rcx
lea r8, [rsp + 0x30]
mov rcx, r12
xor edx, edx
call rax
test eax, eax
jne 0x1800137c1
mov rax, qword [0x180233028]
test rax, rax
jne 0x180013679
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r14, qword [rax]
mov rsi, r14
nop word [rax + rax]
mov r11, qword [rsi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov edi, dword [rax + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x18001365a
mov r10d, dword [rdi + 0x18]
test r10d, r10d
je 0x18001365a
mov ebp, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r10d
mov r9d, 0xc3654e80
lea rax, [r11 + r10*4]
mov r8d, dword [rax + rbp]
add r8, r11
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x180013655
nop
movsx eax, dl
lea r8, [r8 + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [r8 - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test dl, dl
jne 0x180013620
cmp r9d, 0x6654f179
je 0x18001377b
test r10d, r10d
jne 0x180013600
mov rax, qword [rsi]
mov rsi, rax
cmp rax, r14
je 0x180013670
cmp qword [rax + 0x30], 0
jne 0x1800135d0
xor eax, eax
mov qword [0x180233028], rax
mov rcx, r12
call rax
mov rax, qword [0x180233178]
test rax, rax
jne 0x180013753
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r14, qword [rax]
mov rsi, r14
nop word [rax + rax]
mov r11, qword [rsi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov edi, dword [rax + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x180013734
mov r10d, dword [rdi + 0x18]
test r10d, r10d
je 0x180013734
mov ebp, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r10d
mov r9d, 0xbf1e0976
lea rax, [r11 + r10*4]
mov r8d, dword [rax + rbp]
add r8, r11
movzx eax, byte [r8]
inc r8
test al, al
je 0x18001372f
nop
movsx ecx, al
lea r8, [r8 + 1]
sub al, 0x41
mov edx, ecx
or edx, 0x20
cmp al, 0x19
movzx eax, byte [r8 - 1]
cmova edx, ecx
xor edx, r9d
imul r9d, edx, 0x1000193
test al, al
jne 0x180013700
cmp r9d, 0xcbe7ac77
je 0x180013797
test r10d, r10d
jne 0x1800136e0
mov rax, qword [rsi]
mov rsi, rax
cmp rax, r14
je 0x18001374a
cmp qword [rax + 0x30], 0
jne 0x1800136b0
xor eax, eax
mov qword [0x180233178], rax
mov rcx, r13
call rax
xor al, al
jmp 0x18001398e
mov ecx, dword [rdi + 0x24]
add rcx, r11
movzx edx, word [rcx + r10*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rcx + rdx*4]
add rax, r11
jmp 0x180013572
mov ecx, dword [rdi + 0x24]
add rcx, r11
movzx edx, word [rcx + r10*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rcx + rdx*4]
add rax, r11
jmp 0x180013672
mov ecx, dword [rdi + 0x24]
add rcx, r11
movzx edx, word [rcx + r10*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rcx + rdx*4]
mov rcx, r13
add rax, r11
mov qword [0x180233178], rax
call rax
xor al, al
jmp 0x18001398e
cmp dword [rsp + 0x34], 4
mov rax, qword [0x180232fa0]
sete r15b
test rax, rax
jne 0x1800138ad
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r14, qword [rax]
mov rsi, r14
nop dword [rax]
nop word [rax + rax]
mov r11, qword [rsi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov edi, dword [rax + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x18001388e
mov r10d, dword [rdi + 0x18]
test r10d, r10d
je 0x18001388e
mov ebp, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r10d
mov r9d, 0x8e537883
lea rax, [r11 + r10*4]
mov edx, dword [rax + rbp]
add rdx, r11
movzx r8d, byte [rdx]
inc rdx
test r8b, r8b
je 0x180013889
nop
movsx eax, r8b
lea rdx, [rdx + 1]
sub r8b, 0x41
mov ecx, eax
or ecx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rdx - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test r8b, r8b
jne 0x180013850
cmp r9d, 0xfea3c1de
je 0x1800139af
test r10d, r10d
jne 0x180013830
mov rax, qword [rsi]
mov rsi, rax
cmp rax, r14
je 0x1800138a4
cmp qword [rax + 0x30], 0
jne 0x180013800
xor eax, eax
mov qword [0x180232fa0], rax
mov rcx, r12
call rax
mov rax, qword [0x180233200]
test rax, rax
jne 0x180013985
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r14, qword [rax]
mov rsi, r14
nop dword [rax]
mov r11, qword [rsi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov edi, dword [rax + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x180013966
mov r10d, dword [rdi + 0x18]
test r10d, r10d
je 0x180013966
mov ebp, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r10d
mov r9d, 0x42b98e60
lea rax, [r11 + r10*4]
mov r8d, dword [rax + rbp]
add r8, r11
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x180013961
nop
movsx eax, dl
lea r8, [r8 + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [r8 - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test dl, dl
jne 0x180013930
cmp r9d, 0xa767d559
je 0x1800139cb
test r10d, r10d
jne 0x180013910
mov rax, qword [rsi]
mov rsi, rax
cmp rax, r14
je 0x18001397c
cmp qword [rax + 0x30], 0
jne 0x1800138e0
xor eax, eax
mov qword [0x180233200], rax
mov rcx, r13
call rax
movzx eax, r15b
mov r12, qword [rsp + 0x90]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
mov ecx, dword [rdi + 0x24]
add rcx, r11
movzx edx, word [rcx + r10*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rcx + rdx*4]
add rax, r11
jmp 0x1800138a6
mov ecx, dword [rdi + 0x24]
add rcx, r11
movzx edx, word [rcx + r10*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rcx + rdx*4]
add rax, r11
jmp 0x18001397e