Function at 0x18004fad0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
mov dword [rax + 8], ecx
push r13
sub rsp, 0x60
mov qword [rax + 0x20], rbx
mov r13, rdx
mov qword [rax - 0x10], rbp
mov qword [rax - 0x18], rsi
mov qword [rax - 0x20], rdi
mov qword [rax - 0x28], r12
mov qword [rax - 0x30], r14
mov qword [rax - 0x38], r15
mov eax, dword [0x1802ea798]
test al, 1
jne 0x18004ff4b
mov rsi, qword [0x1802ea7b0]
or eax, 1
mov dword [0x1802ea798], eax
test rsi, rsi
jne 0x18004fd13
mov esi, 0xb8e4e945
xor ebp, ebp
nop dword [rax]
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x18]
mov r15, qword [rax + 0x10]
nop word [rax + rax]
movups xmm0, xmmword [r15 + 0x58]
movd eax, xmm0
movups xmmword [rsp + 0x20], xmm0
sub ax, 8
test ebp, ebp
je 0x18004fbad
mov rdi, qword [rsp + 0x28]
mov r8d, 0x811c9dc5
movzx eax, ax
shr rax, 1
lea r9, [rdi + rax*2]
cmp rdi, r9
je 0x18004fba4
movsx eax, byte [rdi]
mov ecx, eax
sub al, 0x41
mov edx, ecx
or edx, 0x20
cmp al, 0x19
cmova edx, ecx
add rdi, 2
xor edx, r8d
imul r8d, edx, 0x1000193
cmp rdi, r9
jne 0x18004fb80
cmp r8d, ebp
jne 0x18004fc37
mov r11, qword [r15 + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov rcx, qword [rax + r11 + 0x88]
mov r12, rcx
mov r14d, ecx
shr r12, 0x20
add r14, r11
cmp r14, r11
je 0x18004fc37
mov ebx, dword [r14 + 0x18]
xor r10d, r10d
test ebx, ebx
je 0x18004fc37
mov r9d, dword [r14 + 0x20]
add r9, r11
mov edi, dword [r9]
mov r8d, 0x811c9dc5
add rdi, r11
movzx edx, byte [rdi]
test dl, dl
je 0x18004fc26
nop dword [rax]
nop dword [rax + rax]
movsx eax, dl
lea rdi, [rdi + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [rdi]
cmova ecx, eax
xor ecx, r8d
imul r8d, ecx, 0x1000193
test dl, dl
jne 0x18004fc00
cmp r8d, esi
je 0x18004fc3f
inc r10d
add r9, 4
cmp r10d, ebx
jb 0x18004fbe1
mov r15, qword [r15]
jmp 0x18004fb50
mov eax, dword [r14 + 0x24]
mov ecx, dword [r14 + 0x1c]
add rax, r11
add rcx, r11
movzx edx, word [rax + r10*2]
mov esi, dword [rcx + rdx*4]
add rsi, r11
cmp rsi, r14
jbe 0x18004fd0c
lea rax, [r14 + r12]
cmp rsi, rax
jae 0x18004fd0c
movzx edx, byte [rsi]
mov ebp, 0x811c9dc5
mov dword [rsp + 0x80], ebp
mov edi, ebp
mov dword [rsp + 0x84], ebp
cmp dl, 0x2e
je 0x18004fcbc
nop dword [rax + rax]
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [rsi + 1]
cmova ecx, eax
inc rsi
xor ecx, ebp
imul ebp, ecx, 0x1000193
cmp dl, 0x2e
jne 0x18004fc90
mov dword [rsp + 0x80], ebp
movzx edx, byte [rsi + 1]
inc rsi
test dl, dl
je 0x18004fcfb
nop word [rax + rax]
movsx eax, dl
lea rsi, [rsi + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [rsi]
cmova ecx, eax
xor ecx, edi
imul edi, ecx, 0x1000193
test dl, dl
jne 0x18004fcd0
mov dword [rsp + 0x84], edi
mov rsi, qword [rsp + 0x80]
shr rsi, 0x20
jmp 0x18004fb30
mov qword [0x1802ea7b0], rsi
mov rdx, qword [0x1802ea7b8]
test rdx, rdx
jne 0x18004ff2f
mov ebp, 0xbd28aabc
xor r12d, r12d
nop dword [rax + rax]
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x18]
mov r15, qword [rax + 0x10]
nop word [rax + rax]
movups xmm0, xmmword [r15 + 0x58]
movd eax, xmm0
movups xmmword [rsp + 0x20], xmm0
sub ax, 8
test r12d, r12d
je 0x18004fdae
mov rdi, qword [rsp + 0x28]
mov r8d, 0x811c9dc5
movzx eax, ax
shr rax, 1
lea r9, [rdi + rax*2]
cmp rdi, r9
je 0x18004fda5
movsx eax, byte [rdi]
mov ecx, eax
sub al, 0x41
mov edx, ecx
or edx, 0x20
cmp al, 0x19
cmova edx, ecx
add rdi, 2
xor edx, r8d
imul r8d, edx, 0x1000193
cmp rdi, r9
jne 0x18004fd81
cmp r8d, r12d
jne 0x18004fe47
mov r11, qword [r15 + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov rcx, qword [rax + r11 + 0x88]
mov r13, rcx
mov r14d, ecx
shr r13, 0x20
add r14, r11
cmp r14, r11
je 0x18004fe47
mov ebx, dword [r14 + 0x18]
xor r10d, r10d
test ebx, ebx
je 0x18004fe47
mov r9d, dword [r14 + 0x20]
add r9, r11
nop dword [rax]
nop word [rax + rax]
mov edi, dword [r9]
mov r8d, 0x811c9dc5
add rdi, r11
movzx edx, byte [rdi]
test dl, dl
je 0x18004fe36
nop dword [rax]
nop word [rax + rax]
movsx eax, dl
lea rdi, [rdi + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [rdi]
cmova ecx, eax
xor ecx, r8d
imul r8d, ecx, 0x1000193
test dl, dl
jne 0x18004fe10
cmp r8d, ebp
je 0x18004fe4f
inc r10d
add r9, 4
cmp r10d, ebx
jb 0x18004fdf0
mov r15, qword [r15]
jmp 0x18004fd50
mov eax, dword [r14 + 0x24]
mov ecx, dword [r14 + 0x1c]
add rax, r11
add rcx, r11
movzx edx, word [rax + r10*2]
mov edx, dword [rcx + rdx*4]
add rdx, r11
cmp rdx, r14
jbe 0x18004ff23
lea rax, [r14 + r13]
cmp rdx, rax
jae 0x18004ff23
movzx edi, byte [rdx]
mov r12d, 0x811c9dc5
mov dword [rsp + 0x80], r12d
mov r8d, r12d
mov dword [rsp + 0x84], r12d
cmp dil, 0x2e
je 0x18004fed3
movsx eax, dil
sub dil, 0x41
mov ecx, eax
or ecx, 0x20
cmp dil, 0x19
movzx edi, byte [rdx + 1]
cmova ecx, eax
inc rdx
xor ecx, r12d
imul r12d, ecx, 0x1000193
cmp dil, 0x2e
jne 0x18004fea0
mov dword [rsp + 0x80], r12d
movzx edi, byte [rdx + 1]
inc rdx
test dil, dil
je 0x18004ff12
nop
movsx eax, dil
lea rdx, [rdx + 1]
sub dil, 0x41
mov ecx, eax
or ecx, 0x20
cmp dil, 0x19
movzx edi, byte [rdx]
cmova ecx, eax
xor ecx, r8d
imul r8d, ecx, 0x1000193
test dil, dil
jne 0x18004fee0
mov dword [rsp + 0x84], r8d
mov rbp, qword [rsp + 0x80]
shr rbp, 0x20
jmp 0x18004fd30
mov r13, qword [rsp + 0x78]
mov qword [0x1802ea7b8], rdx
lea rcx, str.ntdll.dll
call rdx
lea rdx, str.NtApphelpCacheControl
mov rcx, rax
call rsi
mov qword [0x1802ea790], rax
mov rax, qword [0x1802ea788]
test rax, rax
jne 0x18005018b
mov rdi, qword [0x1802ea7c0]
test rdi, rdi
jne 0x180050150
mov ebp, 0x700da41
xor r15d, r15d
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x18]
mov r14, qword [rax + 0x10]
nop dword [rax + rax]
movups xmm0, xmmword [r14 + 0x58]
movd eax, xmm0
movups xmmword [rsp + 0x20], xmm0
sub ax, 8
test r15d, r15d
je 0x18004ffee
mov rdi, qword [rsp + 0x28]
mov r8d, 0x811c9dc5
movzx eax, ax
shr rax, 1
lea r9, [rdi + rax*2]
cmp rdi, r9
je 0x18004ffe5
movsx eax, byte [rdi]
mov ecx, eax
sub al, 0x41
mov edx, ecx
or edx, 0x20
cmp al, 0x19
cmova edx, ecx
add rdi, 2
xor edx, r8d
imul r8d, edx, 0x1000193
cmp rdi, r9
jne 0x18004ffc1
cmp r8d, r15d
jne 0x180050075
mov r11, qword [r14 + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov rcx, qword [rax + r11 + 0x88]
mov r12, rcx
mov esi, ecx
shr r12, 0x20
add rsi, r11
cmp rsi, r11
je 0x180050075
mov ebx, dword [rsi + 0x18]
xor r10d, r10d
test ebx, ebx
je 0x180050075
mov r9d, dword [rsi + 0x20]
add r9, r11
mov edi, dword [r9]
mov r8d, 0x811c9dc5
add rdi, r11
movzx eax, byte [rdi]
test al, al
je 0x180050064
nop dword [rax]
nop word [rax + rax]
movsx ecx, al
lea rdi, [rdi + 1]
sub al, 0x41
mov edx, ecx
or edx, 0x20
cmp al, 0x19
movzx eax, byte [rdi]
cmova edx, ecx
xor edx, r8d
imul r8d, edx, 0x1000193
test al, al
jne 0x180050040
cmp r8d, ebp
je 0x18005007d
inc r10d
add r9, 4
cmp r10d, ebx
jb 0x180050020
mov r14, qword [r14]
jmp 0x18004ff90
mov eax, dword [rsi + 0x24]
mov ecx, dword [rsi + 0x1c]
add rax, r11
add rcx, r11
movzx edx, word [rax + r10*2]
mov edi, dword [rcx + rdx*4]
add rdi, r11
cmp rdi, rsi
jbe 0x180050149
lea rax, [rsi + r12]
cmp rdi, rax
jae 0x180050149
movzx edx, byte [rdi]
mov r15d, 0x811c9dc5
mov dword [rsp + 0x78], r15d
mov r8d, r15d
mov dword [rsp + 0x7c], r15d
cmp dl, 0x2e
je 0x1800500fc
nop word [rax + rax]
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [rdi + 1]
cmova ecx, eax
inc rdi
xor ecx, r15d
imul r15d, ecx, 0x1000193
cmp dl, 0x2e
jne 0x1800500d0
mov dword [rsp + 0x78], r15d
movzx edx, byte [rdi + 1]
inc rdi
test dl, dl
je 0x18005013b
nop word [rax + rax]
movsx eax, dl
lea rdi, [rdi + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [rdi]
cmova ecx, eax
xor ecx, r8d
imul r8d, ecx, 0x1000193
test dl, dl
jne 0x180050110
mov dword [rsp + 0x7c], r8d
mov rbp, qword [rsp + 0x78]
shr rbp, 0x20
jmp 0x18004ff73
mov qword [0x1802ea7c0], rdi
xor ecx, ecx
mov edx, 0x28000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call rdi
mov qword [0x1802ea788], rax
mov rdi, rax
xor eax, eax
mov ecx, 0x28000
rep stosb byte [rdi], al
mov rax, qword [0x1802ea790]
mov qword [0x1802ea780], rax
mov rax, qword [0x1802ea788]
mov r15, qword [rsp + 0x30]
movabs rcx, 0xb19d1ccacab
mov r14, qword [rsp + 0x38]
mov r12, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x88]
mov qword [rax + 0x10], 0
mov rax, qword [0x1802ea788]
mov qword [rax], rcx
test r13, r13
je 0x18005023b
mov rcx, qword [0x1802ea788]
movsd xmm0, qword [r13]
movsd qword [rcx + 0x18], xmm0
mov eax, dword [r13 + 8]
mov dword [rcx + 0x20], eax
mov rax, qword [0x1802ea788]
movsxd rcx, dword [rsp + 0x70]
mov qword [rax + 0x10], 0xc
mov rax, qword [0x1802ea788]
mov qword [rax + 8], rcx
mov ecx, 0xb
mov rdx, qword [0x1802ea788]
call fcn.180082540
mov rcx, qword [0x1802ea788]
movsd xmm0, qword [rcx + 0x18]
movsd qword [r13], xmm0
mov ecx, dword [rcx + 0x20]
mov dword [r13 + 8], ecx
add rsp, 0x60
pop r13
ret
mov rdx, qword [0x1802ea788]
mov ecx, 0xb
add rsp, 0x60
pop r13
jmp fcn.180082540