Function at 0x18005e880
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x2c8]
sub rsp, 0x3a0
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [0x1801f5b80]
xor rax, rsp
mov qword [rbp + 0x270], rax
mov r14, rcx
xor r12d, r12d
mov dword [rsp + 0x34], r12d
cmp edx, 1
jne 0x18005f045
call fcn.1800aa3f0
call fcn.1800a51c0
test al, al
jne 0x18005e984
movdqa xmm0, xmmword [0x1801cfae0]
movdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], 0xf3e2c2f
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x58], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x70], al
mov dword [rsp + 0x34], 4
mov byte [rsp + 0x20], al
mov r9d, reloc.WS2_32.dll_sendto
movzx r8d, byte [rsp + 0x30]
mov edx, r9d
lea rcx, [rbp - 0x70]
call fcn.180015110
mov ecx, r12d
cmp rcx, 0x14
jae 0x18005f0c7
movzx edx, byte [rbp + rcx - 0x30]
xor dl, 0xf
cmp qword [rbp - 0x60], rcx
jbe 0x18005f0c1
lea rax, [rbp - 0x70]
cmp qword [rbp - 0x58], 0x10
cmovae rax, qword [rbp - 0x70]
mov byte [rax + rcx], dl
inc rcx
cmp rcx, 0x14
jl 0x18005e935
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 0x10
cmovae rcx, qword [rbp - 0x70]
call fcn.1800aa200
nop
lea rcx, [rbp - 0x70]
call fcn.180014c00
call fcn.1800a44b0
test al, al
jne 0x18005ea35
movdqa xmm0, xmmword [0x1801cfd70]
movdqu xmmword [rbp - 0x18], xmm0
mov dword [rbp - 8], 0x10223330
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x50], al
mov dword [rsp + 0x34], 1
mov byte [rsp + 0x20], al
mov r9d, reloc.WS2_32.dll_sendto
movzx r8d, byte [rsp + 0x30]
mov edx, r9d
lea rcx, [rbp - 0x50]
call fcn.180015110
mov rcx, r12
cmp rcx, 0x14
jae 0x18005f0d3
movzx edx, byte [rbp + rcx - 0x18]
xor dl, 0x10
cmp qword [rbp - 0x40], rcx
jbe 0x18005f0cd
lea rax, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rax, qword [rbp - 0x50]
mov byte [rax + rcx], dl
inc rcx
cmp rcx, 0x14
jl 0x18005e9e6
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rcx, qword [rbp - 0x50]
call fcn.1800aa200
nop
lea rcx, [rbp - 0x50]
call fcn.180014c00
mov rax, qword [0x1805e4960]
test rax, rax
jne 0x18005eaf7
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov r11, rsi
nop dword [rax]
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x18005ead7
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x18005ead7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
lea rax, [rdi + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
mov edx, 0x8b381a7
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x18005ead2
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x18005eab0
cmp edx, 0x591eecb7
je 0x18005ebb4
test r8d, r8d
jne 0x18005ea90
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x18005eaed
cmp qword [rax + 0x30], 0
jne 0x18005ea60
mov rax, r12
mov qword [0x1805e4960], rax
mov r8d, 0x104
lea rdx, [rbp + 0x160]
mov rcx, r14
call rax
test eax, eax
je 0x18005ee3a
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x58], r12
mov r8d, 0x104
lea rdx, [rbp + 0x160]
lea rcx, [rbp + 0x40]
call fcn.180014fd0
nop
mov word [rsp + 0x38], 0x675
mov byte [rsp + 0x3a], 0x29
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov r8d, reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x78], r8
mov byte [rsp + 0x70], 0
mov dword [rsp + 0x34], 2
mov eax, 3
mov qword [rbp - 0x80], rax
xor ecx, ecx
mov dword [rsp + 0x70], ecx
mov rcx, r12
cmp rcx, 3
jae 0x18005f0bb
movzx edx, byte [rsp + rcx + 0x38]
xor dl, 0x29
cmp rax, rcx
jbe 0x18005f0eb
lea rax, [rsp + 0x70]
cmp r8, 0x10
cmovae rax, qword [rsp + 0x70]
mov byte [rax + rcx], dl
inc rcx
cmp rcx, 3
jge 0x18005ebd0
mov r8, qword [rbp - 0x78]
mov rax, qword [rbp - 0x80]
jmp 0x18005eb74
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rbx + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov eax, dword [rcx + rax*4]
add rax, r9
jmp 0x18005eaf0
lea rbx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0x10
cmovae rbx, qword [rsp + 0x70]
mov rsi, 0xffffffffffffffff
mov rdi, rsi
nop word [rax + rax]
inc rdi
cmp byte [rbx + rdi], 0
jne 0x18005ebf0
lea r14, [rbp + 0x40]
cmp qword [rbp + 0x58], 0x10
cmovae r14, qword [rbp + 0x40]
test rdi, rdi
je 0x18005ec77
mov r15, qword [rbp + 0x50]
test r15, r15
je 0x18005ec77
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x60]
call fcn.1801582b0
lea rcx, [rbx + rdi]
cmp rbx, rcx
je 0x18005ec40
nop
movzx eax, byte [rbx]
mov byte [rbp + rax + 0x60], 1
inc rbx
cmp rbx, rcx
jne 0x18005ec30
lea rax, [r15 - 1]
mov rbx, rsi
cmp rax, rsi
cmovb rbx, rax
add rbx, r14
movzx eax, byte [rbx]
cmp byte [rbp + rax + 0x60], 0
jne 0x18005ec72
nop dword [rax + rax]
cmp rbx, r14
je 0x18005ec77
dec rbx
movzx eax, byte [rbx]
cmp byte [rbp + rax + 0x60], 0
je 0x18005ec60
sub rbx, r14
jmp 0x18005ec7a
mov rbx, rsi
lea rcx, [rsp + 0x70]
call fcn.180014c00
cmp rbx, 0xffffffffffffffff
je 0x18005ee31
mov dword [rsp + 0x40], 0x7d717a63
mov dword [rsp + 0x44], 0x564d5a6c
mov dword [rsp + 0x48], 0x56114c5a
mov word [rsp + 0x4c], 0x5651
mov byte [rsp + 0x4e], 0x3f
mov qword [rsp + 0x58], 0
mov r9d, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x68], r9
mov byte [rsp + 0x50], 0
mov dword [rsp + 0x34], 8
mov eax, r9d
mov qword [rsp + 0x60], rax
xor r8d, r8d
mov qword [rsp + 0x50], r8
mov byte [rsp + 0x5f], r8b
mov rcx, r12
nop dword [rax + rax]
cmp rcx, 0xf
jae 0x18005f0e5
movzx edx, byte [rsp + rcx + 0x40]
xor dl, 0x3f
cmp rax, rcx
jbe 0x18005f0df
lea rax, [rsp + 0x50]
cmp r9, 0x10
cmovae rax, r8
mov byte [rax + rcx], dl
inc rcx
cmp rcx, 0xf
jge 0x18005ed35
mov r9, qword [rsp + 0x68]
mov rax, qword [rsp + 0x60]
mov r8, qword [rsp + 0x50]
jmp 0x18005ecf0
lea rdi, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae rdi, qword [rsp + 0x50]
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x10], xmm1
cmp qword [rbp + 0x50], rbx
cmovb rbx, qword [rbp + 0x50]
lea rdx, [rbp + 0x40]
cmp qword [rbp + 0x58], 0x10
cmovae rdx, qword [rbp + 0x40]
mov r8, rbx
lea rcx, [rbp]
call fcn.180014fd0
mov dword [rsp + 0x34], 0x18
inc rsi
cmp byte [rdi + rsi], 0
jne 0x18005ed80
mov r8, rsi
mov rdx, rdi
lea rcx, [rbp]
call fcn.18001e660
movups xmm6, xmmword [rax]
movups xmmword [rbp + 0x20], xmm6
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [reloc.WS2_32.dll_ntohs]
cmp rdx, 0x10
jb 0x18005edf3
mov rcx, qword [0x1805ddd70]
inc rdx
cmp rdx, 0x1000
jb 0x18005edee
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18005f0d9
mov rcx, r8
call fcn.180155a9c
movups xmmword [0x1805ddd70], xmm6
movups xmmword [0x1805ddd80], xmm7
movdqa xmm0, xmmword [0x1801ce930]
movdqu xmmword [rbp + 0x30], xmm0
mov byte [rbp + 0x20], 0
lea rcx, [rbp + 0x20]
call fcn.180014c00
nop
lea rcx, [rbp]
call fcn.180014c00
nop
lea rcx, [rsp + 0x50]
call fcn.180014c00
nop
lea rcx, [rbp + 0x40]
call fcn.180014c00
mov rax, qword [0x1805e4940]
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
xor r9d, r9d
lea r8, [0x18005dbe0]
xor edx, edx
xor ecx, ecx
call rax
mov r14, rax
mov rdx, qword [0x1805e4968]
test rdx, rdx
jne 0x18005ef27
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rbx, rsi
nop word [rax + rax]
mov r9, qword [rbx + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov r11d, dword [rax + r9 + 0x88]
add r11, r9
cmp r11, r9
je 0x18005ef07
mov r8d, dword [r11 + 0x18]
test r8d, r8d
je 0x18005ef07
mov edi, dword [r11 + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [rdi + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
mov edx, 0x2d612253
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x18005ef02
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x18005eee0
cmp edx, 0xf599d327
je 0x18005f07f
test r8d, r8d
jne 0x18005eec0
mov rax, qword [rbx]
mov rbx, rax
cmp rax, rsi
je 0x18005ef1d
cmp qword [rax + 0x30], 0
jne 0x18005ee90
mov rdx, r12
mov qword [0x1805e4968], rdx
mov rcx, r14
call rdx
mov rax, qword [0x1805e4940]
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
xor r9d, r9d
lea r8, [0x180013140]
xor edx, edx
xor ecx, ecx
call rax
mov r14, rax
mov rdx, qword [0x1805e4958]
test rdx, rdx
jne 0x18005f017
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rbx, rsi
nop word [rax + rax]
mov r9, qword [rbx + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov r11d, dword [rax + r9 + 0x88]
add r11, r9
cmp r11, r9
je 0x18005eff7
mov r8d, dword [r11 + 0x18]
test r8d, r8d
je 0x18005eff7
mov edi, dword [r11 + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [rdi + r8*4]
mov eax, dword [rax + r9]
add rax, r9
mov edx, 0xd036de1b
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x18005eff2
nop dword [rax]
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax]
lea rax, [rax + 1]
test cl, cl
jne 0x18005efd0
cmp edx, 0x1fd131cf
je 0x18005f09d
test r8d, r8d
jne 0x18005efb0
mov rax, qword [rbx]
mov rbx, rax
cmp rax, rsi
je 0x18005f00d
cmp qword [rax + 0x30], 0
jne 0x18005ef80
mov rdx, r12
mov qword [0x1805e4958], rdx
mov rcx, r14
call rdx
mov r10, qword [0x1805e4940]
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
xor r9d, r9d
lea r8, [0x18005e0a0]
xor edx, edx
xor ecx, ecx
call r10
xchg qword [0x1805e4970], rax
mov eax, 1
mov rcx, qword [rbp + 0x270]
xor rcx, rsp
call fcn.1801554d0
lea r11, [rsp + 0x3a0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov ecx, dword [r11 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r9
mov edx, dword [rcx + rdx*4]
add rdx, r9
jmp 0x18005ef20
mov ecx, dword [r11 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r9
mov edx, dword [rcx + rdx*4]
add rdx, r9
jmp 0x18005f010
call fcn.180014d90
nop
call fcn.180014f60
int3
call fcn.180014d90
nop
call fcn.180014f60
int3
call fcn.180014d90
nop
call fcn.18015c514
nop
call fcn.180014f60
int3
call fcn.180014d90
nop
call fcn.180014f60
int3