Function at 0x180059e80
Capabilities:
Allocate or change rwx memory
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf]
sub rsp, 0xd0
mov rsi, r9
mov r12, rcx
xor eax, eax
mov dword [rbp + 0x5f], eax
mov dword [rbp + 0x57], eax
mov rcx, qword [rbp + 0x6f]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__msize]
mov qword [rbp - 0x11], rax
test eax, eax
jg 0x180059ed2
xor al, al
jmp 0x18005a5d3
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
xor r13d, r13d
mov qword [rsp + 0x30], r13
mov qword [rbp - 0x79], r13
movdqu xmmword [rbp - 9], xmm0
mov qword [rbp + 7], r13
mov rbx, qword [rbp + 0x7f]
mov r8, qword [rbx + 0x10]
mov rdx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x180059f05
mov rdx, qword [rbx]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x180059f33
movabs r10, 0x100000001b3
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x180059f20
mov r8, rbx
lea rdx, [rbp - 0x71]
call fcn.180071380
cmp qword [rax + 8], 0
je 0x180059f97
mov r8, rbx
lea rdx, [rbp - 0x71]
call fcn.18006ba70
mov r8, qword [rax]
add r8, 0x30
lea rax, [rsp + 0x38]
cmp rax, r8
je 0x180059f84
mov rdx, qword [r8]
mov r8, qword [r8 + 8]
sub r8, rdx
sar r8, 3
lea rcx, [rsp + 0x38]
call fcn.18006c520
mov r13, qword [rbp - 0x79]
mov qword [rsp + 0x30], r13
lea rax, [r12 + 8]
mov qword [rbp + 0x57], rax
mov rdi, qword [rsp + 0x40]
jmp 0x18005a183
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__msize]
mov r14, rax
xor eax, eax
lea rbx, [r12 + 8]
mov qword [rbp + 0x57], rbx
movabs r15, 0x7fffffffffff
mov rdi, qword [rsp + 0x40]
nop dword [rax]
mov r9d, 0x30
lea r8, [rbp - 0x59]
mov rdx, rax
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
cmp rax, 0x30
jne 0x18005a136
cmp dword [rbp - 0x39], 0x1000
jne 0x18005a125
mov eax, dword [rbp - 0x35]
bt eax, 8
jb 0x18005a125
cmp eax, 1
je 0x18005a125
cmp eax, 0x10
je 0x18005a125
mov rcx, qword [rbp - 0x41]
call fcn.180096fd0
mov r13, rax
lea rax, [rbp - 0x21]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp - 0x41]
mov r8, r13
mov rdx, qword [rbp - 0x59]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x18005a11d
mov rbx, r13
mov rdx, qword [rbp - 0x21]
mov r9, rdx
sub r9, r14
inc r9
add r9, r13
mov qword [rbp - 0x71], r9
lea r8, [r13 - 1]
add r8, r14
mov r12, r8
lea r15, [rdx - 1]
add r15, r13
cmp r13, r9
jae 0x18005a10f
nop
test r14, r14
je 0x18005a09b
mov rax, rsi
mov rdx, rbx
sub rdx, rsi
nop
movzx ecx, byte [rax]
cmp cl, 0x3f
je 0x18005a08d
cmp cl, byte [rdx + rax]
jne 0x18005a0e8
inc rax
mov rcx, rax
sub rcx, rsi
cmp rcx, r14
jb 0x18005a080
mov rax, rbx
sub rax, r13
add rax, qword [rbp - 0x59]
mov qword [rbp - 0x19], rax
cmp rdi, qword [rsp + 0x30]
je 0x18005a0be
mov qword [rdi], rax
add rdi, 8
mov qword [rsp + 0x40], rdi
jmp 0x18005a0e8
lea r8, [rbp - 0x19]
mov rdx, rdi
lea rcx, [rsp + 0x38]
call fcn.180071de0
mov rax, qword [rbp - 0x79]
mov qword [rsp + 0x30], rax
mov rdi, qword [rsp + 0x40]
lea r8, [r13 - 1]
add r8, r14
mov r9, qword [rbp - 0x71]
inc rbx
cmp rbx, r15
jb 0x18005a106
add r12, 0x1000
add r15, 0x1000
cmp r12, r8
jae 0x18005a10f
mov rbx, r8
cmp rbx, r9
jb 0x18005a070
movabs r15, 0x7fffffffffff
mov rbx, qword [rbp + 0x57]
mov rcx, r13
call fcn.180096ef4
mov rax, qword [rbp - 0x59]
add rax, qword [rbp - 0x41]
cmp rax, r15
jb 0x180059fc0
mov r8, qword [rbp + 0x7f]
lea rdx, [rbp - 0x71]
call fcn.18006ba70
mov rcx, qword [rax]
add rcx, 0x30
lea rax, [rsp + 0x38]
cmp rcx, rax
je 0x18005a17a
mov r8, rdi
mov r15, qword [rsp + 0x38]
sub r8, r15
sar r8, 3
mov rdx, r15
call fcn.18006c520
mov qword [rbp + 0x57], rbx
mov r13, qword [rsp + 0x30]
mov r12, qword [rbp + 0x4f]
jmp 0x18005a188
mov r13, qword [rsp + 0x30]
mov r12, qword [rbp + 0x4f]
mov r15, qword [rsp + 0x38]
lea rsi, [r12 + 0x18]
mov r12, rdi
sub r12, r15
sar r12, 3
mov qword [rbp - 0x71], r12
mov rax, qword [rsi + 0x10]
sub rax, qword [rsi]
cmp r12, rax
jbe 0x18005a1c6
movabs rax, 0x7fffffffffffffff
cmp r12, rax
ja 0x18005a5ee
lea rdx, [rbp - 0x71]
mov rcx, rsi
call fcn.18006c430
mov rbx, r15
cmp r15, rdi
je 0x18005a23a
mov r14, qword [rbp + 0x4f]
mov r13, qword [rbp + 0x57]
nop word [rax + rax]
mov qword [rsp + 0x20], 0
mov r9d, 1
lea r8, [r14 + 0x16]
mov rdx, qword [rbx]
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x18005a227
mov rdx, qword [rsi + 8]
cmp rdx, qword [rsi + 0x10]
je 0x18005a21b
movzx eax, byte [r14 + 0x16]
mov byte [rdx], al
inc qword [rsi + 8]
jmp 0x18005a227
lea r8, [r14 + 0x16]
mov rcx, rsi
call fcn.180071c60
add rbx, 8
cmp rbx, rdi
jne 0x18005a1e0
mov r13, qword [rsp + 0x30]
cmp r15, rdi
jne 0x18005a241
xor bl, bl
jmp 0x18005a591
xor edi, edi
test r12, r12
je 0x18005a36c
movsxd r14, dword [rbp - 0x11]
mov rbx, r15
mov r8, qword [rbx]
lea r9, [rbp - 0x5c]
test r8d, r8d
jns 0x18005a2a0
neg r8d
dec r9
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r9], r8b
mov r8d, edx
test edx, edx
jne 0x18005a262
dec r9
mov byte [r9], 0x2d
jmp 0x18005a2ca
dec r9
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r9], r8b
mov r8d, edx
test edx, edx
jne 0x18005a2a0
lea r8, [rbp - 0x5c]
mov rdx, r9
lea rcx, [rbp - 0x59]
call fcn.18003ecb0
or dword [rbp + 0x5f], 0xc
mov edx, dword [rbx]
lea rax, [rbp - 0x29]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
mov r8, r14
mov rax, qword [rbp + 0x57]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov qword [rsp + 0x20], 0
mov r9, r14
mov r8, qword [rbp + 0x6f]
mov rdx, qword [rbx]
mov rax, qword [rbp + 0x57]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [rbp - 0x41]
cmp rdx, 0xf
jbe 0x18005a35a
inc rdx
mov rcx, qword [rbp - 0x59]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005a355
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005a583
call fcn.180096ef4
inc edi
add rbx, 8
movsxd rax, edi
cmp rax, r12
jb 0x18005a253
mov rax, qword [rbp + 0x7f]
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x18005a37e
mov rax, qword [rax]
cmp r8, 5
jne 0x18005a58f
lea rdx, str.NpcDE
mov rcx, rax
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x18005a58f
xor ebx, ebx
test r12, r12
je 0x18005a4a8
mov r13, qword [rbp + 0x57]
nop
mov qword [rsp + 0x20], 0
mov r9d, 1
lea r8, [rbp + 0x77]
mov rdx, qword [r15 + rbx*8]
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdi, qword [rbp + 0x4f]
add rdi, 0x30
test eax, eax
je 0x18005a495
lea rdx, [0x1800a3d4a]
mov rcx, rdi
call fcn.18006b350
lea rdx, [0x180049b10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rdx, qword [r15 + rbx*8]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x1800b3ca8]
call fcn.18006b350
lea rdx, [0x1800a3d4a]
mov rcx, rdi
call fcn.18006b350
lea rdx, [0x180049b10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, qword [rsi]
movzx edx, byte [rcx + rbx]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x1800b4850]
call fcn.18006b350
lea rdx, [0x1800a3d4a]
mov rcx, rdi
call fcn.18006b350
lea rdx, [0x180049b10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
movzx edx, byte [rbp + 0x77]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x1800a8588]
call fcn.18006b350
inc rbx
cmp rbx, r12
jb 0x18005a3b0
mov r13, qword [rsp + 0x30]
jmp 0x18005a4b0
mov rdi, qword [rbp + 0x4f]
add rdi, 0x30
xorps xmm0, xmm0
movups xmmword [rbp - 0x59], xmm0
mov qword [rbp - 0x49], 0
mov r9d, 0xf
mov qword [rbp - 0x41], r9
mov byte [rbp - 0x59], 0
mov eax, dword [rbp + 0x5f]
or eax, 2
mov dword [rbp + 0x57], eax
movups xmmword [rbp - 0x71], xmm0
mov ecx, dword [rdi + 0x78]
mov eax, ecx
and al, 0x22
cmp al, 2
je 0x18005a513
mov rax, qword [rdi + 0x48]
mov r8, qword [rax]
test r8, r8
je 0x18005a513
mov rax, qword [rdi + 0x28]
mov rdx, qword [rax]
mov qword [rbp + 0x5f], r8
lea rax, [rdi + 0x70]
lea rcx, [rbp + 0x5f]
cmp r8, qword [rax]
cmovb rcx, rax
mov r8, qword [rcx]
sub r8, rdx
jmp 0x18005a542
test cl, 4
jne 0x18005a53a
mov rax, qword [rdi + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x18005a53a
mov rax, qword [rdi + 0x20]
mov rdx, qword [rax]
mov rax, qword [rdi + 0x58]
movsxd r8, dword [rax]
add r8, rcx
sub r8, rdx
jmp 0x18005a542
mov r8, qword [rbp - 0x69]
mov rdx, qword [rbp - 0x71]
test rdx, rdx
je 0x18005a554
lea rcx, [rbp - 0x59]
call fcn.18003dd20
mov r9, qword [rbp - 0x41]
cmp r9, 0xf
jbe 0x18005a58f
lea rdx, [r9 + 1]
mov rcx, qword [rbp - 0x59]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005a58a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18005a58a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180096ef4
mov bl, 1
test r15, r15
je 0x18005a5d0
sub r13, r15
and r13, 0xfffffffffffffff8
mov rax, r15
cmp r13, 0x1000
jb 0x18005a5c5
add r13, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18005a5c5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, r13
mov rcx, r15
call fcn.180096ef4
movzx eax, bl
mov rbx, qword [rsp + 0x128]
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.18003f230
nop
int3