Function at 0x180001960
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Hash data with crc32
Resolve function by parsing pe exports

Disassembly:
push rdi
sub rsp, 0x10
cmp dword [0x180058bf0], 0
jne 0x180001bf8
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov r9, qword [rcx + 0x10]
mov rcx, qword [r9 + 0x30]
test rcx, rcx
je 0x1800019f1
nop dword [rax]
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x1800019f1
mov r8d, dword [rax + rcx + 0x88]
add r8, rcx
mov eax, dword [r8 + 0xc]
mov ecx, dword [rax + rcx]
mov eax, dword [str.cAAFv]
or ecx, 0x20202020
xor eax, 0x2a25350d
cmp ecx, eax
jne 0x1800019e5
mov rax, qword [r9 + 0x30]
mov ecx, dword [r8 + 0xc]
mov edx, dword [rcx + rax + 4]
mov eax, dword [0x180058004]
or edx, 0x20202020
xor eax, 0x2a27c51a
cmp edx, eax
je 0x1800019f9
mov r9, qword [r9]
mov rcx, qword [r9 + 0x30]
test rcx, rcx
jne 0x180001990
xor eax, eax
add rsp, 0x10
pop rdi
ret
mov rdi, qword [r9 + 0x30]
test rdi, rdi
je 0x1800019f1
mov r10d, dword [r8 + 0x20]
mov r11d, dword [r8 + 0x24]
add r10, rdi
mov edx, dword [0x180058bf0]
add r11, rdi
mov qword [rsp + 0x20], rbx
xor ebx, ebx
mov qword [rsp + 0x28], rbp
mov ebp, dword [r8 + 0x1c]
add rbp, rdi
cmp dword [r8 + 0x18], ebx
jbe 0x180001b72
mov qword [rsp + 0x30], rsi
mov qword [rsp + 8], r14
lea r14, [0x180058bf0]
mov qword [rsp], r15
mov r15d, 0x775a
nop
mov r9d, dword [r10]
add r9, rdi
movzx esi, word [r9]
cmp si, r15w
jne 0x180001b50
cmp edx, 0x258
ja 0x180001b50
mov ecx, 0xffffefff
nop word [rax + rax]
movsx eax, sil
lea r9, [r9 + 1]
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
movzx eax, byte [r9]
movzx esi, al
test al, al
jne 0x180001a80
mov eax, edx
not ecx
add rax, rax
mov dword [r14 + rax*8 + 8], ecx
movzx eax, word [r11]
mov ecx, dword [rbp + rax*4]
mov eax, dword [0x180058bf0]
add rcx, rdi
add rax, rax
mov qword [r14 + rax*8 + 0x10], rcx
mov edx, dword [0x180058bf0]
inc edx
mov dword [0x180058bf0], edx
inc ebx
add r10, 4
add r11, 2
cmp ebx, dword [r8 + 0x18]
jb 0x180001a50
mov r15, qword [rsp]
mov r14, qword [rsp + 8]
mov rsi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x28]
lea eax, [rdx - 1]
xor ebx, ebx
test eax, eax
je 0x180001bf3
lea rdi, [0x180058c00]
nop word [rax + rax]
mov eax, edx
xor r11d, r11d
sub eax, ebx
cmp eax, 1
je 0x180001bea
mov r8, qword [0x180058c00]
mov rax, rdi
nop word [rax + rax]
mov r10, r8
mov r8, qword [rax + 0x10]
cmp r10, r8
jbe 0x180001bd8
mov edx, dword [rax - 8]
mov ecx, dword [rax + 8]
mov qword [rax], r8
mov r8, r10
mov dword [rax - 8], ecx
mov dword [rax + 8], edx
mov qword [rax + 0x10], r10
mov edx, dword [0x180058bf0]
mov ecx, edx
inc r11d
sub ecx, ebx
add rax, 0x10
dec ecx
cmp r11d, ecx
jb 0x180001bb0
inc ebx
lea eax, [rdx - 1]
cmp ebx, eax
jb 0x180001b90
mov rbx, qword [rsp + 0x20]
mov eax, 1
add rsp, 0x10
pop rdi
ret