Function at 0x1800017a0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x120
lea rbp, [rsp + 0x80]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x180073040]
xor rax, rsp
mov qword [rbp + 0x90], rax
mov rax, qword [sym.imp.USER32.dll_DefWindowProcW]
mov qword [0x180094ce0], rax
mov dword [0x180094cd8], 0x50
mov rax, qword gs:[0x30]
mov qword [rbp + 0x28], 0
mov rdi, qword [rax + 0x60]
test rdi, rdi
je 0x1800018ac
mov rdi, qword [rdi + 0x18]
test rdi, rdi
je 0x1800018ac
mov r10, qword [rdi + 0x10]
add rdi, 0x10
cmp r10, rdi
je 0x1800018ac
movabs rsi, 0x100000001b3
movabs r14, 0xcbf29ce484222325
test r10, r10
je 0x1800018a4
movzx eax, word [r10 + 0x58]
test ax, ax
je 0x1800018a4
mov rbx, qword [r10 + 0x60]
mov r11d, eax
shr r11, 1
mov rax, r14
mov r9d, 0
je 0x180001bbc
nop dword [rax]
movzx r8d, word [rbx + r9*2]
lea ecx, [r8 - 0x41]
cmp cx, 0x19
lea edx, [r8 + 0x20]
cmova dx, r8w
inc r9
imul rax, rsi
movzx ecx, dx
xor rcx, rax
mov rax, rcx
cmp r9, r11
jb 0x180001870
cmp rcx, r14
je 0x180001bbc
mov r10, qword [r10]
cmp r10, rdi
jne 0x180001844
xor eax, eax
mov qword [0x180094cf0], rax
lea rcx, [rbp + 0x20]
mov qword [0x180094d00], 0
lea rax, str.Sync
mov qword [0x180094d18], rax
movabs r13, 0x63b503e6b7efa044
mov qword [0x180094ce8], 0
movabs r12, 0x4bd6c134d98e8268
mov qword [rbp], r12
movabs r15, 0xc5055cae77f87b1
mov rax, qword [rbp]
movabs r14, 0xc8a8639b5b5b9d23
mov qword [rbp + 0x20], rax
movabs rdi, 0x4ba4c151d9fd821d
mov qword [rbp], r15
movabs rbx, 0xc3455e4e74d8782
mov rax, qword [rbp]
movabs rsi, 0xc8a8639b5b379d4f
mov qword [rbp + 0x28], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqu ymmword [rbp + 0x20], ymm1
vzeroupper
call fcn.180003280
mov r8, rax
lea rdx, [rbp + 0x40]
movabs rax, 0x39c1b522b09ae74f
mov qword [rbp], rax
movabs rax, 0x5b4c1097942cebc1
mov rcx, qword [rbp]
mov qword [rbp + 0x40], rcx
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x48], rcx
mov qword [rbp], rsi
mov rcx, qword [rbp]
mov qword [rbp + 0x50], rcx
mov rcx, r8
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x70], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
vmovdqu ymm0, ymmword [rbp + 0x60]
vpxor ymm1, ymm0, ymmword [rbp + 0x40]
vmovdqa ymmword [rbp + 0x40], ymm1
vzeroupper
call fcn.180003360
lea rcx, [0x180094cd8]
call rax
mov rbx, qword [0x180094cf0]
mov rdi, qword [0x180094d18]
mov qword [rbp], r12
mov rax, qword [rbp]
lea rcx, [rbp + 0x40]
mov qword [rbp + 0x40], rax
mov qword [rbp], r15
movabs r15, 0x4ba4c151d9fd821d
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
mov qword [rbp], r14
movabs r14, 0xc3455e4e74d8782
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x70], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
vmovdqu ymm0, ymmword [rbp + 0x60]
vpxor ymm1, ymm0, ymmword [rbp + 0x40]
vmovdqu ymmword [rbp + 0x40], ymm1
vzeroupper
call fcn.180003280
mov r8, rax
lea rdx, [rbp + 0x10]
movabs rax, 0x22f3a425b898f05e
mov qword [rbp], rax
movabs rax, 0xc632da19022e3ec
mov rcx, qword [rbp]
mov qword [rbp + 0x10], rcx
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x18], rcx
mov qword [rbp], r15
mov rcx, qword [rbp]
mov qword [rbp + 0x80], rcx
mov rcx, r8
mov qword [rbp], r14
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x10]
mov qword [rbp + 0x88], rax
xorps xmm0, xmmword [rbp + 0x80]
movdqa xmmword [rbp + 0x10], xmm0
call fcn.180003360
xor ecx, ecx
lea r8, str.Apex
mov qword [rsp + 0x58], rcx
mov r9d, 0xcf0000
mov qword [rsp + 0x50], rbx
mov rdx, rdi
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x38], 0x64
mov dword [rsp + 0x30], 0x64
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], ecx
call rax
test rax, rax
mov qword [0x180094cd0], rax
setne al
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.18002c2d0
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rax, qword [r10 + 0x30]
jmp 0x1800018ae