Function at 0x1800015b0
Capabilities:
Access peb ldr_data
Encode data using xor
Get process filename
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x180009010]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r15d, edx
mov r14, rcx
mov qword [rsp + 0x60], rcx
movabs rax, 0x701a400a0567c782
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x50], rax
movabs rax, 0x2b39ba8e72b81fd8
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x58], rax
movabs rax, 0x42292c6f6b15a2e9
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x70], rax
movabs rax, 0x2b39ba8e1ed47bf6
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x78], rax
movdqa xmm0, xmmword [rsp + 0x50]
pxor xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x50], xmm0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1800016e6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1800016e6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
mov r8d, 0x34bad42b
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1800016e1
nop
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x1800016c0
cmp r8d, 0x9203af0e
je 0x1800016eb
test r9d, r9d
jne 0x1800016a0
mov rax, qword [rax]
jmp 0x180001670
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
lea rcx, [rsp + 0x50]
call rdx
mov rsi, r14
cmp qword [r14 + 0x18], 0x10
jb 0x180001716
mov rsi, qword [r14]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov edi, dword [rcx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x1800017a6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1800017a6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r11 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r11
mov r8d, 0x25a3a871
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1800017a1
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x180001780
cmp r8d, 0xf4b5a672
je 0x1800017ab
test r9d, r9d
jne 0x180001760
mov rax, qword [rax]
jmp 0x180001730
mov edx, dword [rdi + 0x1c]
add rdx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + r9*2]
mov r10d, dword [rdx + rax*4]
add r10, r11
xor r12d, r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r12 + 1]
mov rcx, rsi
call r10
mov rsi, rax
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop
mov r11, qword [rcx + 0x30]
movsxd rdx, dword [r11 + 0x3c]
mov edi, dword [rdx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x180001876
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x180001876
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rax, [r11 + r9*4]
mov edx, dword [rax + rbx]
add rdx, r11
mov r8d, 0x2496daeb
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x180001871
nop dword [rax]
movsx eax, al
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
test al, al
jne 0x180001850
cmp r8d, 0x874a0a66
je 0x18000187b
test r9d, r9d
jne 0x180001830
mov rcx, qword [rcx]
jmp 0x180001800
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor edx, edx
mov r8d, 0x1000002
mov rcx, rsi
call r10
mov rsi, rax
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r11, qword [rcx + 0x30]
movsxd rdx, dword [r11 + 0x3c]
mov edi, dword [rdx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x180001946
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x180001946
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rax, [r11 + r9*4]
mov edx, dword [rax + rbx]
add rdx, r11
mov r8d, 0x23949ac1
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x180001941
nop dword [rax]
movsx eax, al
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
test al, al
jne 0x180001920
cmp r8d, 0x280046e7
je 0x18000194b
test r9d, r9d
jne 0x180001900
mov rcx, qword [rcx]
jmp 0x1800018d0
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
mov rcx, rsi
call r10
mov r11, rax
test rax, rax
je 0x180001cb9
mov eax, 0x5a4d
cmp word [r11], ax
jne 0x180001cb9
movsxd rax, dword [r11 + 0x3c]
add rax, r11
je 0x180001cb9
add rax, 0x18
je 0x180001cb9
mov eax, dword [rax + 0x70]
add rax, r11
je 0x180001cb9
mov edi, dword [rax + 0x1c]
add rdi, r11
mov r9d, dword [rax + 0x20]
add r9, r11
mov esi, dword [rax + 0x24]
add rsi, r11
mov r10d, r12d
mov ebx, dword [rax + 0x18]
test ebx, ebx
je 0x180001cb9
nop word [rax + rax]
mov edx, dword [r9]
add rdx, r11
mov r8d, 0x25
movzx eax, byte [rdx]
test al, al
je 0x180001a1e
nop dword [rax]
nop word [rax + rax]
movsx eax, al
imul ecx, eax, 0x12ca3
imul r8d, r8d, 0xd32b
xor r8d, ecx
lea rdx, [rdx + 1]
movzx eax, byte [rdx]
test al, al
jne 0x180001a00
cmp r8d, r15d
je 0x180001a34
inc r10d
add r9, 4
cmp r10d, ebx
jb 0x1800019e0
jmp 0x180001cb9
mov eax, r10d
movzx ecx, word [rsi + rax*2]
mov ebp, dword [rdi + rcx*4]
add rbp, r11
je 0x180001cb9
mov rsi, r14
cmp qword [r14 + 0x18], 0x10
jb 0x180001a54
mov rsi, qword [r14]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x180001ae6
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x180001ae6
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rdi]
add rdx, r10
mov r8d, 0xbd42c483
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180001ae1
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x180001ac0
cmp r8d, 0x43f51826
je 0x180001aeb
test r9d, r9d
jne 0x180001aa0
mov rax, qword [rax]
jmp 0x180001a70
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov eax, dword [rbx + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rdx + rax*4]
add rdx, r10
mov rcx, rsi
call rdx
test rax, rax
je 0x180001cb9
mov edx, r15d
mov rcx, rax
call fcn.1800014c0
mov rsi, rax
mov rcx, qword [rax]
cmp rcx, qword [rbp]
jne 0x180001b35
mov rcx, qword [rax + 8]
cmp rcx, qword [rbp + 8]
je 0x180001cb9
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop word [rax + rax]
mov r11, qword [rcx + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov edi, dword [rax + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x180001bc6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x180001bc6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rax, [r11 + r9*4]
mov edx, dword [rax + rbx]
add rdx, r11
mov r8d, 0x5fa953b4
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x180001bc1
nop dword [rax]
movsx eax, al
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
test al, al
jne 0x180001ba0
cmp r8d, 0x7be6f566
je 0x180001bcb
test r9d, r9d
jne 0x180001b80
mov rcx, qword [rcx]
jmp 0x180001b50
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
lea r9, [rsp + 0x68]
mov edx, 0x10
lea r8d, [rdx + 0x30]
mov rcx, rsi
call r10
movups xmm0, xmmword [rbp]
movups xmmword [rsi], xmm0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov ebx, dword [rcx + r11 + 0x88]
add rbx, r11
cmp rbx, r11
je 0x180001c86
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x180001c86
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r11 + r9*4]
mov edx, dword [rcx + rdi]
add rdx, r11
mov r8d, 0x62add59b
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180001c81
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x180001c60
cmp r8d, 0x28689f75
je 0x180001c8b
test r9d, r9d
jne 0x180001c40
mov rax, qword [rax]
jmp 0x180001c10
mov ecx, dword [rbx + 0x1c]
add rcx, r11
mov eax, dword [rbx + 0x24]
add rax, r11
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
lea r9, [rsp + 0x6c]
mov r8d, dword [rsp + 0x68]
mov edx, 0x10
mov rcx, rsi
call r10
nop
mov rdx, qword [r14 + 0x18]
cmp rdx, 0x10
jb 0x180001cef
inc rdx
mov rcx, qword [r14]
cmp rdx, 0x1000
jb 0x180001cea
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180001d2b
mov rcx, r8
call fcn.180005010
mov byte [r14], 0
mov qword [r14 + 0x18], 0xf
mov qword [r14 + 0x10], r12
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.180004ff0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3