Function at 0x18001f7a0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rdi
sub rsp, 0x68
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r9, qword [rax + 0x60]
mov r10d, 0x33e4b81c
movzx ecx, word [rax + 0x58]
shr rcx, 1
lea r11, [r9 + rcx*2]
cmp r9, r11
je 0x18001f813
nop word [rax + rax]
movsx ecx, byte [r9]
mov edx, ecx
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
add r9, 2
xor r8d, r10d
imul r10d, r8d, 0x1000193
cmp r9, r11
jne 0x18001f7e0
cmp r10d, 0x25865f73
je 0x18001f818
mov rax, qword [rax]
jmp 0x18001f7c0
mov r11, qword [rax + 0x30]
xor ebx, ebx
mov qword [rsp + 0x88], rbp
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x60], r14
test r11, r11
je 0x18001f8bd
movsxd rax, dword [r11 + 0x3c]
mov ebp, dword [rax + r11 + 0x88]
add rbp, r11
cmp rbp, r11
je 0x18001f8bd
mov esi, dword [rbp + 0x18]
mov r10d, ebx
test esi, esi
je 0x18001f8bd
mov r14d, dword [rbp + 0x20]
nop
mov edi, r10d
mov r9d, 0x1663582c
lea rax, [r14 + rdi*4]
mov r8d, dword [rax + r11]
add r8, r11
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x18001f8b5
nop
movsx eax, dl
lea r8, [r8 + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [r8 - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test dl, dl
jne 0x18001f880
cmp r9d, 0x7d717793
je 0x18001f938
inc r10d
cmp r10d, esi
jne 0x18001f860
mov rax, rbx
call rax
mov qword [0x1800e8418], rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r9, qword [rax + 0x60]
mov r10d, 0x33e4b81c
movzx ecx, word [rax + 0x58]
shr rcx, 1
lea r11, [r9 + rcx*2]
cmp r9, r11
je 0x18001f933
nop word [rax + rax]
movsx ecx, byte [r9]
mov edx, ecx
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
add r9, 2
xor r8d, r10d
imul r10d, r8d, 0x1000193
cmp r9, r11
jne 0x18001f900
cmp r10d, 0x25865f73
je 0x18001f953
mov rax, qword [rax]
jmp 0x18001f8e0
mov ecx, dword [rbp + 0x24]
add rcx, r11
movzx edx, word [rcx + rdi*2]
mov ecx, dword [rbp + 0x1c]
add rcx, r11
mov eax, dword [rcx + rdx*4]
add rax, r11
jmp 0x18001f8c0
mov r11, qword [rax + 0x30]
test r11, r11
je 0x18001f9de
movsxd rax, dword [r11 + 0x3c]
mov ebp, dword [rax + r11 + 0x88]
add rbp, r11
cmp rbp, r11
je 0x18001f9de
mov esi, dword [rbp + 0x18]
mov r10d, ebx
test esi, esi
je 0x18001f9de
mov r14d, dword [rbp + 0x20]
mov edi, r10d
mov r9d, 0xcebee90b
lea rax, [r14 + rdi*4]
mov r8d, dword [rax + r11]
add r8, r11
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x18001f9d6
movsx eax, dl
lea r8, [r8 + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [r8 - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test dl, dl
jne 0x18001f9a1
cmp r9d, 0xd2d1f45b
je 0x18001fa58
inc r10d
cmp r10d, esi
jne 0x18001f982
mov rax, rbx
call rax
mov qword [0x1800e8420], rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r9, qword [rax + 0x60]
mov r10d, 0x33e4b81c
movzx ecx, word [rax + 0x58]
shr rcx, 1
lea r11, [r9 + rcx*2]
cmp r9, r11
je 0x18001fa53
nop word [rax + rax]
movsx ecx, byte [r9]
mov edx, ecx
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
add r9, 2
xor r8d, r10d
imul r10d, r8d, 0x1000193
cmp r9, r11
jne 0x18001fa20
cmp r10d, 0x25865f73
je 0x18001fa73
mov rax, qword [rax]
jmp 0x18001fa00
mov ecx, dword [rbp + 0x24]
add rcx, r11
movzx edx, word [rcx + rdi*2]
mov ecx, dword [rbp + 0x1c]
add rcx, r11
mov eax, dword [rcx + rdx*4]
add rax, r11
jmp 0x18001f9e1
mov r11, qword [rax + 0x30]
test r11, r11
je 0x18001fb1f
movsxd rax, dword [r11 + 0x3c]
mov ebp, dword [rax + r11 + 0x88]
add rbp, r11
cmp rbp, r11
je 0x18001fb1f
mov esi, dword [rbp + 0x18]
mov r10d, ebx
test esi, esi
je 0x18001fb1f
mov r14d, dword [rbp + 0x20]
nop word [rax + rax]
mov edi, r10d
mov r9d, 0x97b716d3
lea rax, [r14 + rdi*4]
mov r8d, dword [rax + r11]
add r8, r11
movzx eax, byte [r8]
inc r8
test al, al
je 0x18001faff
nop
movsx ecx, al
lea r8, [r8 + 1]
sub al, 0x41
mov edx, ecx
or edx, 0x20
cmp al, 0x19
movzx eax, byte [r8 - 1]
cmova edx, ecx
xor edx, r9d
imul r9d, edx, 0x1000193
test al, al
jne 0x18001fad0
cmp r9d, 0xc3cae86c
je 0x18001fb09
inc r10d
cmp r10d, esi
jne 0x18001fab0
jmp 0x18001fb1f
mov ecx, dword [rbp + 0x24]
add rcx, r11
movzx edx, word [rcx + rdi*2]
mov ecx, dword [rbp + 0x1c]
add rcx, r11
mov ebx, dword [rcx + rdx*4]
add rbx, r11
call rbx
mov qword [0x1800e8428], rax
lea r9, [rsp + 0x40]
mov rax, qword [0x1800e8418]
movabs rdi, 0x2334c284a561622b
movabs rbx, 0xc6343b319ce2fa00
mov rcx, qword [rax]
movabs rax, 0x77608ac9e4243678
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x40], rax
movabs rax, 0x80667e65d2aba550
mov r10, qword [rcx + 0xb8]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x48], rax
movabs rax, 0xed6072d470b3faec
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x50], rax
movabs rax, 0xbda5da1feafd49b3
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x80], rdi
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x80], rbx
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x28], rax
movabs rax, 0xbe3237822ff6b9ad
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x30], rax
movabs rax, 0xbda5e92fdab306fa
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
movdqa xmm0, xmmword [rsp + 0x40]
movdqa xmm1, xmmword [rsp + 0x50]
xorps xmm0, xmmword [rsp + 0x20]
mov r8, qword [0x1800e8428]
mov rdx, qword [0x1800e8420]
mov rcx, qword [0x1800e8418]
mov qword [rsp + 0x38], rax
xorps xmm1, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmmword [rsp + 0x50], xmm1
call r10
mov qword [0x1800e8430], rax
lea r8, [rsp + 0x20]
mov rax, qword [0x1800e8418]
mov rcx, qword [rax]
movabs rax, 0x4a4097e9c4041678
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
movabs rax, 0xc6343b01add2896c
mov r9, qword [rcx + 0x48]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x80], rdi
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x80], rbx
mov rax, qword [rsp + 0x80]
movdqa xmm0, xmmword [rsp + 0x20]
mov rdx, qword [0x1800e8428]
mov rcx, qword [0x1800e8418]
mov qword [rsp + 0x48], rax
xorps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x20], xmm0
call r9
mov r14, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x88]
mov qword [0x1800e8438], rax
add rsp, 0x68
pop rdi
pop rbx
ret