Function at 0x180002780
Capabilities:
Access peb ldr_data
Create thread
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xe0
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
movaps xmmword [rax - 0x68], xmm8
mov rax, qword [0x1801165d8]
xor rax, rsp
mov qword [rbp - 0x11], rax
mov qword [rbp - 0x51], rdx
mov r13, rcx
mov qword [rbp - 0x39], rcx
xor ebx, ebx
mov dword [rbp - 0x79], ebx
mov rcx, qword [rcx]
mov qword [rbp - 0x59], rcx
test rcx, rcx
je 0x180003088
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180003088
movsxd rax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x180003088
lea r15, [rcx + rax]
mov qword [rbp - 0x31], r15
cmp dword [r15], 0x4550
jne 0x180003088
lea r12, [r15 + 0xb0]
cmp dword [r12], ebx
cmove r12, rbx
mov r14, qword [r15 + 0x30]
mov qword [rbp - 0x69], r14
mov rdx, qword [0x1802db4a8]
test rdx, rdx
jne 0x1800028e9
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1800028c6
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1800028c6
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
mov r8d, 0x285953ad
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1800028c1
nop
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x1800028a0
cmp r8d, 0x5dd3da87
je 0x1800028cb
test r9d, r9d
jne 0x180002880
mov rax, qword [rax]
jmp 0x180002850
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rbx + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov qword [0x1802db4a8], rdx
movsd xmm0, qword [str.__QZ_]
movsd qword [rsp + 0x30], xmm0
movzx eax, word [0x1800df0e8]
mov word [rsp + 0x38], ax
cmp byte [reloc.WLDAP32.dll_Ordinal_60], 0
je 0x18000293d
mov byte [rsp + 0x30], WSASetLastError
xor byte [rsp + 0x31], 0x34
xor byte [rsp + 0x32], 0x35
xor byte [rsp + 0x33], 0x36
xor byte [rsp + 0x34], 0x37
xor byte [rsp + 0x35], 0x38
xor byte [rsp + 0x36], 0x39
xor byte [rsp + 0x37], 0x3a
xor byte [rsp + 0x38], 0x3b
xor byte [rbp - 0x80], 0x3c
lea rcx, [rsp + 0x30]
call rdx
mov rsi, rax
movups xmm0, xmmword [str.__XZYIlRYJqY]
movups xmmword [rbp - 0x29], xmm0
mov ecx, dword [0x1800df0d8]
mov dword [rbp - 0x19], ecx
movzx ecx, byte [0x1800df0dc]
mov byte [rbp - 0x15], cl
mov r11, qword [0x1802dbd38]
test r11, r11
jne 0x180002a2a
mov rcx, qword gs:[0x60]
mov rax, qword [rcx + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x180002a06
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x180002a06
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rdi]
add rdx, r10
mov r8d, 0x9b53f888
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180002a01
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1800029e0
cmp r8d, 0x7d826924
je 0x180002a0b
test r9d, r9d
jne 0x1800029c0
mov rax, qword [rax]
jmp 0x180002990
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rbx + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov r11d, dword [rcx + rax*4]
add r11, r10
mov qword [0x1802dbd38], r11
xor r8d, r8d
lea eax, [r8 + 5]
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x180002b8f
movdqa xmm5, xmmword [0x180104490]
movdqa xmm4, xmmword [0x180104980]
movd xmm6, eax
movdqa xmm7, xmmword [0x1801044f0]
mov eax, Ordinal_33
movd xmm8, eax
movdqa xmm0, xmmword [0x1801045f0]
movdqa xmmword [rbp - 0x49], xmm0
lea rcx, [rbp - 0x29]
mov edx, dword [rbp - 0x49]
nop dword [rax + rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x1801045a0]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
pxor xmm2, xmm0
movd dword [rcx], xmm2
lea eax, [r8 + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x1801045a0]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx + 4]
pxor xmm2, xmm0
movd dword [rcx + 4], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x10
jl 0x180002a80
cmp r8d, 0x15
jge 0x180002bd3
movsxd rax, r8d
lea r9, [rbp - 0x29]
add r9, rax
nop dword [rax]
mov eax, 0x8fb823ef
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x39
movzx eax, r8b
sub al, cl
add al, 0x33
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x15
jl 0x180002ba0
lea rdx, [rbp - 0x29]
mov rcx, rsi
call r11
mov rdx, qword [r15 + 0x30]
mov rcx, 0xffffffffffffffff
call rax
mov rax, qword [0x1802db4a0]
test rax, rax
jne 0x180002ca9
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x180002c86
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x180002c86
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rdi]
add rdx, r10
mov r8d, 0x8e4f66e3
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180002c81
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x180002c60
cmp r8d, 0x7ae91f37
je 0x180002c8b
test r9d, r9d
jne 0x180002c40
mov rax, qword [rax]
jmp 0x180002c10
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rbx + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov eax, dword [rcx + rax*4]
add rax, r10
mov qword [0x1802db4a0], rax
mov edx, dword [r15 + 0x50]
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, r14
call rax
mov rbx, rax
test rax, rax
jne 0x180002e04
test r12, r12
je 0x180002e04
mov rax, qword [0x1802dbd40]
test rax, rax
jne 0x180002d99
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x180002d76
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x180002d76
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rdi]
add rdx, r10
mov r8d, 0x28dcf8ec
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180002d71
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x180002d50
cmp r8d, 0xceb37b4
je 0x180002d7b
test r9d, r9d
jne 0x180002d30
mov rax, qword [rax]
jmp 0x180002d00
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rbx + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov eax, dword [rcx + rax*4]
add rax, r10
mov qword [0x1802dbd40], rax
mov edx, dword [r15 + 0x50]
xor ecx, ecx
lea r9d, [rcx + 0x40]
mov r8d, 0x3000
call rax
mov rbx, rax
test rax, rax
jne 0x180002e04
mov rcx, qword [r13]
test rcx, rcx
je 0x1800030ca
mov rdx, qword [r13 + 0x10]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x180002dec
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180003102
mov rcx, r8
call fcn.1800ac234
xor eax, eax
mov qword [r13], rax
mov qword [r13 + 8], rax
mov qword [r13 + 0x10], rax
jmp 0x1800030ca
mov qword [r15 + 0x30], rbx
mov r8d, dword [r15 + 0x54]
mov r12, qword [rbp - 0x59]
mov rdx, r12
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
xor eax, eax
mov esi, eax
cmp ax, word [r15 + 6]
jae 0x180002e53
lea rdi, [r15 + 0x11c]
nop dword [rax]
mov r8d, dword [rdi - 4]
mov edx, dword [rdi]
add rdx, r12
mov ecx, dword [rdi - 8]
add rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
inc esi
lea rdi, [rdi + 0x28]
movzx eax, word [r15 + 6]
cmp esi, eax
jl 0x180002e30
mov rcx, qword [rbp - 0x51]
call fcn.1800019d0
mov rcx, rbx
call fcn.180001e00
cmp rbx, r14
je 0x180002f5f
mov r14d, dword [r15 + 0x50]
test rbx, rbx
je 0x180002f5f
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x180002f5f
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x180002f5f
cmp dword [rax + rbx], 0x4550
jne 0x180002f5f
mov ecx, dword [rax + rbx + 0xb0]
test ecx, ecx
je 0x180002f5f
mov r15d, dword [rax + rbx + 0xb4]
mov r12d, ecx
xor edx, edx
mov esi, edx
test r15, r15
je 0x180002f5b
nop dword [rax + rax]
lea r11, [rsi + r12]
add r11, rbx
mov eax, dword [r11]
test eax, eax
je 0x180002f5b
mov ecx, dword [r11 + 4]
test ecx, ecx
je 0x180002f5b
lea r10, [rcx - 8]
shr r10, 1
mov edi, eax
lea r8, [r11 + 8]
je 0x180002f3c
nop word [rax + rax]
movzx ecx, word [r8]
mov r9d, ecx
and r9d, 0xfff
shr rcx, 0xc
add r9, rdi
test rcx, rcx
je 0x180002f3c
cmp rcx, 3
jne 0x180002f5b
cmp r9, r14
jae 0x180002f4c
mov rax, rbx
sub rax, qword [rbp - 0x69]
add qword [r9 + rbx], rax
add r8, 2
inc rdx
cmp rdx, r10
jb 0x180002f00
mov eax, dword [r11 + 4]
add rsi, rax
cmp rsi, r15
jae 0x180002f5b
xor edx, edx
jmp 0x180002ed0
mov rdx, r9
lea rcx, str.________Out_of_Bound_Field:__lx_n
call fcn.180001620
mov r15, qword [rbp - 0x31]
mov edi, dword [r15 + 0x28]
add rdi, rbx
mov rax, qword [r13]
cmp rax, qword [r13 + 8]
je 0x180002f74
mov qword [r13 + 8], rax
xor ebx, ebx
mov qword [rbp - 0x31], rbx
lea ecx, [rbx + 8]
call fcn.1800ac1f0
mov qword [rax], rdi
mov qword [rbp - 0x31], rax
mov dword [rbp - 0x79], 1
lea rcx, [rbp - 0x61]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x1800034e0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x69], rax
test rax, rax
je 0x180003079
mov qword [rbp - 0x31], rbx
mov eax, 1
and eax, 0xfffffffe
mov dword [rbp - 0x79], eax
cmp dword [rbp - 0x61], ebx
jne 0x180002fdc
lea ecx, [rbx + 1]
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
call qword [sym.imp.MSVCP140.dll__Thrd_id]
cmp dword [rbp - 0x61], eax
jne 0x180002ff3
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
movaps xmm0, xmmword [rbp - 0x69]
movdqa xmmword [rbp - 0x49], xmm0
xor edx, edx
lea rcx, [rbp - 0x49]
call qword [sym.imp.MSVCP140.dll__Thrd_join]
test eax, eax
je 0x180003018
mov ecx, 2
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x69], xmm0
cmp dword [rbp - 0x61], 0
je 0x18000302d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
nop
mov rcx, qword [r13]
test rcx, rcx
je 0x1800030cc
mov rdx, qword [r13 + 0x10]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x180003066
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180003102
mov rcx, r8
call fcn.1800ac234
mov qword [r13], rbx
mov qword [r13 + 8], rbx
mov qword [r13 + 0x10], rbx
jmp 0x1800030cc
mov dword [rbp - 0x61], ebx
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov rcx, qword [r13]
test rcx, rcx
je 0x1800030ca
mov rdx, qword [r13 + 0x10]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x1800030b9
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180003102
mov rcx, r8
call fcn.1800ac234
mov qword [r13], rbx
mov qword [r13 + 8], rbx
mov qword [r13 + 0x10], rbx
xor al, al
mov rcx, qword [rbp - 0x11]
xor rcx, rsp
call fcn.1800ac1d0
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x50]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3