Function at 0x18005b9c0
Capabilities:
Allocate or change rwx memory
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf]
sub rsp, 0xd0
mov rsi, r9
mov r12, rcx
xor eax, eax
mov dword [rbp + 0x5f], eax
mov dword [rbp + 0x57], eax
mov rcx, qword [rbp + 0x6f]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__msize]
mov qword [rbp - 0x11], rax
test eax, eax
jg 0x18005ba12
xor al, al
jmp 0x18005c113
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
xor r13d, r13d
mov qword [rsp + 0x30], r13
mov qword [rbp - 0x79], r13
movdqu xmmword [rbp - 9], xmm0
mov qword [rbp + 7], r13
mov rbx, qword [rbp + 0x7f]
mov r8, qword [rbx + 0x10]
mov rdx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x18005ba45
mov rdx, qword [rbx]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x18005ba73
movabs r10, 0x100000001b3
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x18005ba60
mov r8, rbx
lea rdx, [rbp - 0x71]
call fcn.1800716c0
cmp qword [rax + 8], 0
je 0x18005bad7
mov r8, rbx
lea rdx, [rbp - 0x71]
call fcn.18006bea0
mov r8, qword [rax]
add r8, 0x30
lea rax, [rsp + 0x38]
cmp rax, r8
je 0x18005bac4
mov rdx, qword [r8]
mov r8, qword [r8 + 8]
sub r8, rdx
sar r8, 3
lea rcx, [rsp + 0x38]
call fcn.18006c950
mov r13, qword [rbp - 0x79]
mov qword [rsp + 0x30], r13
lea rax, [r12 + 8]
mov qword [rbp + 0x57], rax
mov rdi, qword [rsp + 0x40]
jmp 0x18005bcc3
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__msize]
mov r14, rax
xor eax, eax
lea rbx, [r12 + 8]
mov qword [rbp + 0x57], rbx
movabs r15, 0x7fffffffffff
mov rdi, qword [rsp + 0x40]
nop dword [rax]
mov r9d, 0x30
lea r8, [rbp - 0x59]
mov rdx, rax
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
cmp rax, 0x30
jne 0x18005bc76
cmp dword [rbp - 0x39], 0x1000
jne 0x18005bc65
mov eax, dword [rbp - 0x35]
bt eax, 8
jb 0x18005bc65
cmp eax, 1
je 0x18005bc65
cmp eax, 0x10
je 0x18005bc65
mov rcx, qword [rbp - 0x41]
call fcn.180097158
mov r13, rax
lea rax, [rbp - 0x21]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp - 0x41]
mov r8, r13
mov rdx, qword [rbp - 0x59]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x18005bc5d
mov rbx, r13
mov rdx, qword [rbp - 0x21]
mov r9, rdx
sub r9, r14
inc r9
add r9, r13
mov qword [rbp - 0x71], r9
lea r8, [r13 - 1]
add r8, r14
mov r12, r8
lea r15, [rdx - 1]
add r15, r13
cmp r13, r9
jae 0x18005bc4f
nop
test r14, r14
je 0x18005bbdb
mov rax, rsi
mov rdx, rbx
sub rdx, rsi
nop
movzx ecx, byte [rax]
cmp cl, 0x3f
je 0x18005bbcd
cmp cl, byte [rdx + rax]
jne 0x18005bc28
inc rax
mov rcx, rax
sub rcx, rsi
cmp rcx, r14
jb 0x18005bbc0
mov rax, rbx
sub rax, r13
add rax, qword [rbp - 0x59]
mov qword [rbp - 0x19], rax
cmp rdi, qword [rsp + 0x30]
je 0x18005bbfe
mov qword [rdi], rax
add rdi, 8
mov qword [rsp + 0x40], rdi
jmp 0x18005bc28
lea r8, [rbp - 0x19]
mov rdx, rdi
lea rcx, [rsp + 0x38]
call fcn.180071f70
mov rax, qword [rbp - 0x79]
mov qword [rsp + 0x30], rax
mov rdi, qword [rsp + 0x40]
lea r8, [r13 - 1]
add r8, r14
mov r9, qword [rbp - 0x71]
inc rbx
cmp rbx, r15
jb 0x18005bc46
add r12, 0x1000
add r15, 0x1000
cmp r12, r8
jae 0x18005bc4f
mov rbx, r8
cmp rbx, r9
jb 0x18005bbb0
movabs r15, 0x7fffffffffff
mov rbx, qword [rbp + 0x57]
mov rcx, r13
call fcn.18009707c
mov rax, qword [rbp - 0x59]
add rax, qword [rbp - 0x41]
cmp rax, r15
jb 0x18005bb00
mov r8, qword [rbp + 0x7f]
lea rdx, [rbp - 0x71]
call fcn.18006bea0
mov rcx, qword [rax]
add rcx, 0x30
lea rax, [rsp + 0x38]
cmp rcx, rax
je 0x18005bcba
mov r8, rdi
mov r15, qword [rsp + 0x38]
sub r8, r15
sar r8, 3
mov rdx, r15
call fcn.18006c950
mov qword [rbp + 0x57], rbx
mov r13, qword [rsp + 0x30]
mov r12, qword [rbp + 0x4f]
jmp 0x18005bcc8
mov r13, qword [rsp + 0x30]
mov r12, qword [rbp + 0x4f]
mov r15, qword [rsp + 0x38]
lea rsi, [r12 + 0x18]
mov r12, rdi
sub r12, r15
sar r12, 3
mov qword [rbp - 0x71], r12
mov rax, qword [rsi + 0x10]
sub rax, qword [rsi]
cmp r12, rax
jbe 0x18005bd06
movabs rax, 0x7fffffffffffffff
cmp r12, rax
ja 0x18005c12e
lea rdx, [rbp - 0x71]
mov rcx, rsi
call fcn.18006c860
mov rbx, r15
cmp r15, rdi
je 0x18005bd7a
mov r14, qword [rbp + 0x4f]
mov r13, qword [rbp + 0x57]
nop word [rax + rax]
mov qword [rsp + 0x20], 0
mov r9d, 1
lea r8, [r14 + 0x16]
mov rdx, qword [rbx]
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x18005bd67
mov rdx, qword [rsi + 8]
cmp rdx, qword [rsi + 0x10]
je 0x18005bd5b
movzx eax, byte [r14 + 0x16]
mov byte [rdx], al
inc qword [rsi + 8]
jmp 0x18005bd67
lea r8, [r14 + 0x16]
mov rcx, rsi
call fcn.180071df0
add rbx, 8
cmp rbx, rdi
jne 0x18005bd20
mov r13, qword [rsp + 0x30]
cmp r15, rdi
jne 0x18005bd81
xor bl, bl
jmp 0x18005c0d1
xor edi, edi
test r12, r12
je 0x18005beac
movsxd r14, dword [rbp - 0x11]
mov rbx, r15
mov r8, qword [rbx]
lea r9, [rbp - 0x5c]
test r8d, r8d
jns 0x18005bde0
neg r8d
dec r9
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r9], r8b
mov r8d, edx
test edx, edx
jne 0x18005bda2
dec r9
mov byte [r9], 0x2d
jmp 0x18005be0a
dec r9
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r9], r8b
mov r8d, edx
test edx, edx
jne 0x18005bde0
lea r8, [rbp - 0x5c]
mov rdx, r9
lea rcx, [rbp - 0x59]
call fcn.18003fed0
or dword [rbp + 0x5f], 0xc
mov edx, dword [rbx]
lea rax, [rbp - 0x29]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
mov r8, r14
mov rax, qword [rbp + 0x57]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov qword [rsp + 0x20], 0
mov r9, r14
mov r8, qword [rbp + 0x6f]
mov rdx, qword [rbx]
mov rax, qword [rbp + 0x57]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [rbp - 0x41]
cmp rdx, 0xf
jbe 0x18005be9a
inc rdx
mov rcx, qword [rbp - 0x59]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005be95
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005c0c3
call fcn.18009707c
inc edi
add rbx, 8
movsxd rax, edi
cmp rax, r12
jb 0x18005bd93
mov rax, qword [rbp + 0x7f]
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x18005bebe
mov rax, qword [rax]
cmp r8, 5
jne 0x18005c0cf
lea rdx, str.NpcDE
mov rcx, rax
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x18005c0cf
xor ebx, ebx
test r12, r12
je 0x18005bfe8
mov r13, qword [rbp + 0x57]
nop
mov qword [rsp + 0x20], 0
mov r9d, 1
lea r8, [rbp + 0x77]
mov rdx, qword [r15 + rbx*8]
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdi, qword [rbp + 0x4f]
add rdi, 0x30
test eax, eax
je 0x18005bfd5
lea rdx, [0x1800a3c5a]
mov rcx, rdi
call fcn.18006b7c0
lea rdx, [0x18004ad30]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rdx, qword [r15 + rbx*8]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x1800b3878]
call fcn.18006b7c0
lea rdx, [0x1800a3c5a]
mov rcx, rdi
call fcn.18006b7c0
lea rdx, [0x18004ad30]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, qword [rsi]
movzx edx, byte [rcx + rbx]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x1800b470c]
call fcn.18006b7c0
lea rdx, [0x1800a3c5a]
mov rcx, rdi
call fcn.18006b7c0
lea rdx, [0x18004ad30]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
movzx edx, byte [rbp + 0x77]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x1800a84b8]
call fcn.18006b7c0
inc rbx
cmp rbx, r12
jb 0x18005bef0
mov r13, qword [rsp + 0x30]
jmp 0x18005bff0
mov rdi, qword [rbp + 0x4f]
add rdi, 0x30
xorps xmm0, xmm0
movups xmmword [rbp - 0x59], xmm0
mov qword [rbp - 0x49], 0
mov r9d, 0xf
mov qword [rbp - 0x41], r9
mov byte [rbp - 0x59], 0
mov eax, dword [rbp + 0x5f]
or eax, 2
mov dword [rbp + 0x57], eax
movups xmmword [rbp - 0x71], xmm0
mov ecx, dword [rdi + 0x78]
mov eax, ecx
and al, 0x22
cmp al, 2
je 0x18005c053
mov rax, qword [rdi + 0x48]
mov r8, qword [rax]
test r8, r8
je 0x18005c053
mov rax, qword [rdi + 0x28]
mov rdx, qword [rax]
mov qword [rbp + 0x5f], r8
lea rax, [rdi + 0x70]
lea rcx, [rbp + 0x5f]
cmp r8, qword [rax]
cmovb rcx, rax
mov r8, qword [rcx]
sub r8, rdx
jmp 0x18005c082
test cl, 4
jne 0x18005c07a
mov rax, qword [rdi + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x18005c07a
mov rax, qword [rdi + 0x20]
mov rdx, qword [rax]
mov rax, qword [rdi + 0x58]
movsxd r8, dword [rax]
add r8, rcx
sub r8, rdx
jmp 0x18005c082
mov r8, qword [rbp - 0x69]
mov rdx, qword [rbp - 0x71]
test rdx, rdx
je 0x18005c094
lea rcx, [rbp - 0x59]
call fcn.18003ef60
mov r9, qword [rbp - 0x41]
cmp r9, 0xf
jbe 0x18005c0cf
lea rdx, [r9 + 1]
mov rcx, qword [rbp - 0x59]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005c0ca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18005c0ca
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18009707c
mov bl, 1
test r15, r15
je 0x18005c110
sub r13, r15
and r13, 0xfffffffffffffff8
mov rax, r15
cmp r13, 0x1000
jb 0x18005c105
add r13, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18005c105
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, r13
mov rcx, r15
call fcn.18009707c
movzx eax, bl
mov rbx, qword [rsp + 0x128]
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.180040450
nop
int3