Function at 0x14007dfd0
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xc8]
sub rsp, 0x1c8
xor edi, edi
mov dword [rbp + 0x128], edi
mov r15d, 0x2c334564
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
movups xmm0, xmmword [rax + 0x58]
movd ecx, xmm0
sub cx, 8
test edi, edi
je 0x14007e073
psrldq xmm0, 8
movq r9, xmm0
movzx ecx, cx
shr rcx, 1
lea r11, [r9 + rcx*2]
mov r10d, 0x811c9dc5
cmp r9, r11
je 0x14007e06a
nop
movsx ecx, byte [r9]
mov edx, ecx
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
add r9, 2
cmp r9, r11
jne 0x14007e040
cmp r10d, edi
jne 0x14007e1fa
mov rbx, qword [rax + 0x30]
test rbx, rbx
je 0x14007e207
movsxd rcx, dword [rbx + 0x3c]
mov rdx, qword [rcx + rbx + 0x88]
mov r13, rdx
shr r13, 0x20
mov r14d, edx
add r14, rbx
cmp r14, rbx
je 0x14007e1fa
mov r11d, dword [r14 + 0x18]
test r11d, r11d
je 0x14007e1fa
mov r12d, dword [r14 + 0x20]
nop dword [rax]
nop word [rax + rax]
dec r11d
lea rcx, [r12 + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0x811c9dc5
movzx ecx, byte [r9]
inc r9
test cl, cl
je 0x14007e10a
nop
movsx edx, cl
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
movzx ecx, byte [r9]
lea r9, [r9 + 1]
test cl, cl
jne 0x14007e0e0
cmp r10d, r15d
je 0x14007e11c
test r11d, r11d
jne 0x14007e0c0
mov rax, qword [rax]
jmp 0x14007e010
mov ecx, dword [r14 + 0x1c]
add rcx, rbx
mov eax, dword [r14 + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov r9d, dword [rcx + rax*4]
add r9, rbx
cmp r9, r14
jbe 0x14007e202
lea rax, [r14 + r13]
cmp r9, rax
jae 0x14007e202
mov edi, 0x811c9dc5
mov dword [rbp + 0x118], edi
mov r8d, edi
mov dword [rbp + 0x11c], edi
movzx edx, byte [r9]
cmp dl, 0x2e
je 0x14007e19b
nop dword [rax]
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, edi
imul edi, ecx, 0x1000193
inc r9
movzx edx, byte [r9]
cmp dl, 0x2e
jne 0x14007e170
mov dword [rbp + 0x118], edi
inc r9
movzx edx, byte [r9]
test dl, dl
je 0x14007e1de
nop word [rax + rax]
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, r8d
imul r8d, ecx, 0x1000193
lea r9, [r9 + 1]
movzx edx, byte [r9]
test dl, dl
jne 0x14007e1b0
mov dword [rbp + 0x11c], r8d
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r15, qword [rbp + 0x118]
shr r15, 0x20
mov rax, qword [rax]
jmp 0x14007e010
xor r12d, r12d
jmp 0x14007e20d
xor r12d, r12d
mov r9d, r12d
lea r8, [rbp + 0x128]
mov rdx, qword [rbp + 0x110]
mov ecx, 2
call r9
mov esi, eax
mov dword [rbp + 0x118], esi
test eax, eax
je 0x14007eaeb
mov rcx, rsi
call fcn.14000d790
mov r13, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x14007e257
mov r8, rsi
xor edx, edx
mov rcx, rax
call fcn.1400a6950
jmp 0x14007e25f
mov r13, r12
mov qword [rsp + 0x38], r12
mov qword [rbp + 0x10], r13
mov edi, r12d
mov r15d, 0x4688edf7
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
movups xmm0, xmmword [rax + 0x58]
movd ecx, xmm0
sub cx, 8
test edi, edi
je 0x14007e2e3
psrldq xmm0, 8
movq r9, xmm0
movzx ecx, cx
shr rcx, 1
lea r11, [r9 + rcx*2]
mov r10d, 0x811c9dc5
cmp r9, r11
je 0x14007e2da
nop
movsx ecx, byte [r9]
mov edx, ecx
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
add r9, 2
cmp r9, r11
jne 0x14007e2b0
cmp r10d, edi
jne 0x14007e466
mov rbx, qword [rax + 0x30]
test rbx, rbx
je 0x14007e473
movsxd rcx, dword [rbx + 0x3c]
mov rdx, qword [rcx + rbx + 0x88]
mov r13, rdx
shr r13, 0x20
mov r14d, edx
add r14, rbx
cmp r14, rbx
je 0x14007e466
mov r11d, dword [r14 + 0x18]
test r11d, r11d
je 0x14007e466
mov r12d, dword [r14 + 0x20]
nop dword [rax]
nop word [rax + rax]
dec r11d
lea rcx, [rbx + r11*4]
mov r9d, dword [rcx + r12]
add r9, rbx
mov r10d, 0x811c9dc5
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x14007e37b
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x14007e350
cmp r10d, r15d
je 0x14007e38d
test r11d, r11d
jne 0x14007e330
mov rax, qword [rax]
jmp 0x14007e280
mov ecx, dword [r14 + 0x1c]
add rcx, rbx
mov eax, dword [r14 + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov r10d, dword [rcx + rax*4]
add r10, rbx
cmp r10, r14
jbe 0x14007e46e
lea rax, [r14 + r13]
cmp r10, rax
jae 0x14007e46e
mov edi, 0x811c9dc5
mov dword [rsp + 0x30], edi
mov r8d, edi
mov dword [rsp + 0x34], edi
movzx edx, byte [r10]
cmp dl, 0x2e
je 0x14007e409
nop word [rax + rax]
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, edi
imul edi, ecx, 0x1000193
inc r10
movzx edx, byte [r10]
cmp dl, 0x2e
jne 0x14007e3e0
mov dword [rsp + 0x30], edi
inc r10
movzx edx, byte [r10]
test dl, dl
je 0x14007e44c
nop dword [rax]
nop dword [rax + rax]
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, r8d
imul r8d, ecx, 0x1000193
lea r10, [r10 + 1]
movzx edx, byte [r10]
test dl, dl
jne 0x14007e420
mov dword [rsp + 0x34], r8d
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r15, qword [rsp + 0x30]
shr r15, 0x20
mov rax, qword [rax]
jmp 0x14007e280
xor r12d, r12d
jmp 0x14007e479
xor r12d, r12d
mov r10d, r12d
mov r13, qword [rsp + 0x38]
mov qword [rsp + 0x20], r13
mov r9d, dword [rbp + 0x118]
xor r8d, r8d
mov rdx, qword [rbp + 0x110]
mov ecx, 2
call r10
test eax, eax
je 0x14007ead8
mov qword [rsp + 0x40], r12
mov dword [rbp + 0x120], r12d
mov edi, r12d
mov r15d, 0xb38d9868
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
movups xmm0, xmmword [rax + 0x58]
movd ecx, xmm0
sub cx, 8
test edi, edi
je 0x14007e533
psrldq xmm0, 8
movq r9, xmm0
movzx ecx, cx
shr rcx, 1
lea r11, [r9 + rcx*2]
mov r10d, 0x811c9dc5
cmp r9, r11
je 0x14007e52a
nop
movsx ecx, byte [r9]
mov edx, ecx
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
add r9, 2
cmp r9, r11
jne 0x14007e500
cmp r10d, edi
jne 0x14007e6b6
mov rbx, qword [rax + 0x30]
test rbx, rbx
je 0x14007e6c3
movsxd rcx, dword [rbx + 0x3c]
mov rdx, qword [rcx + rbx + 0x88]
mov r13, rdx
shr r13, 0x20
mov r14d, edx
add r14, rbx
cmp r14, rbx
je 0x14007e6b6
mov r11d, dword [r14 + 0x18]
test r11d, r11d
je 0x14007e6b6
mov r12d, dword [r14 + 0x20]
nop dword [rax]
nop word [rax + rax]
dec r11d
lea rcx, [rbx + r11*4]
mov r9d, dword [rcx + r12]
add r9, rbx
mov r10d, 0x811c9dc5
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x14007e5cb
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x14007e5a0
cmp r10d, r15d
je 0x14007e5dd
test r11d, r11d
jne 0x14007e580
mov rax, qword [rax]
jmp 0x14007e4d0
mov ecx, dword [r14 + 0x1c]
add rcx, rbx
mov eax, dword [r14 + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov r10d, dword [rcx + rax*4]
add r10, rbx
cmp r10, r14
jbe 0x14007e6be
lea rax, [r14 + r13]
cmp r10, rax
jae 0x14007e6be
mov edi, 0x811c9dc5
mov dword [rsp + 0x30], edi
mov r8d, edi
mov dword [rsp + 0x34], edi
movzx edx, byte [r10]
cmp dl, 0x2e
je 0x14007e659
nop word [rax + rax]
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, edi
imul edi, ecx, 0x1000193
inc r10
movzx edx, byte [r10]
cmp dl, 0x2e
jne 0x14007e630
mov dword [rsp + 0x30], edi
inc r10
movzx edx, byte [r10]
test dl, dl
je 0x14007e69c
nop dword [rax]
nop dword [rax + rax]
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, r8d
imul r8d, ecx, 0x1000193
lea r10, [r10 + 1]
movzx edx, byte [r10]
test dl, dl
jne 0x14007e670
mov dword [rsp + 0x34], r8d
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r15, qword [rsp + 0x30]
shr r15, 0x20
mov rax, qword [rax]
jmp 0x14007e4d0
xor r12d, r12d
jmp 0x14007e6d0
xor r12d, r12d
mov r10d, r12d
nop dword [rax]
movabs rdi, 0x48e474d03c220f17
mov qword [rbp - 0x60], rdi
movabs r14, 0x4e1440a1fe7b034c
mov qword [rbp - 0x58], r14
movabs r15, 0xd49dbd8ee9e444c9
mov qword [rbp - 0x50], r15
movabs rax, 0xaf7aff4fce60a836
mov qword [rbp - 0x48], rax
movabs rax, 0x450b11d4a968da5b
mov qword [rbp - 0x40], rax
movabs rax, 0x44fbbf457ad14150
mov qword [rbp - 0x38], rax
movabs rax, 0x8907aca2bdf3cf5d
mov qword [rbp - 0x30], rax
movabs rax, 0x9f2c819381eb164a
mov qword [rbp - 0x28], rax
movabs rax, 0x3fe257b8c7f7fc1f
mov qword [rbp - 0x20], rax
movabs rbx, 0x20832189442a2114
mov qword [rbp - 0x18], rbx
movabs rax, 0x489674a43c710f4b
mov qword [rsp + 0x50], rax
movabs rax, 0x4e5240c6fe150325
mov qword [rsp + 0x58], rax
movabs rax, 0xd4d4bdebe98844a0
mov qword [rsp + 0x60], rax
movabs rax, 0xaf26ff20ce06a858
mov qword [rsp + 0x68], rax
movabs rax, 0x453211e4a95cda6b
mov qword [rsp + 0x70], rax
movabs rax, 0x44cbbf077ae54160
mov qword [rsp + 0x78], rax
movabs rax, 0x8968acd0bda3cf01
mov qword [rbp - 0x80], rax
movabs rax, 0x9f5881f0819e162e
mov qword [rbp - 0x78], rax
movabs rax, 0x3f8757d5c796fc51
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rbx
movups xmm2, xmmword [rbp - 0x80]
movups xmm3, xmmword [rbp - 0x70]
movdqa xmm0, xmmword [rbp - 0x60]
xorps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rbp + 0x70], xmm0
movdqa xmm1, xmmword [rbp - 0x50]
xorps xmm1, xmmword [rsp + 0x60]
movdqa xmmword [rbp + 0x80], xmm1
movdqa xmm0, xmmword [rbp - 0x40]
xorps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rbp + 0x90], xmm0
xorps xmm2, xmmword [rbp - 0x30]
movdqa xmmword [rbp + 0xa0], xmm2
xorps xmm3, xmmword [rbp - 0x20]
movdqa xmmword [rbp + 0xb0], xmm3
lea r9, [rbp + 0x120]
lea r8, [rsp + 0x40]
lea rdx, [rbp + 0x70]
mov r13, qword [rsp + 0x38]
mov rcx, r13
call r10
test eax, eax
je 0x14007ead8
mov rdx, qword [rsp + 0x40]
test rdx, rdx
je 0x14007ead8
mov esi, dword [rbp + 0x118]
shr esi, 1
mov eax, dword [rbp + 0x120]
cmp esi, eax
jb 0x14007ead8
mov r8d, eax
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp], r12
mov qword [rbp + 8], r12
lea rcx, [rbp - 0x10]
call fcn.140030bc0
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], r15
movabs rax, 0xaf7aff4fce60a836
mov qword [rsp + 0x68], rax
movabs rax, 0x450b11d4a968da5b
mov qword [rsp + 0x70], rax
movabs rax, 0x44fbbf457ad14150
mov qword [rsp + 0x78], rax
movabs rax, 0x8907aca2bdf3cf5d
mov qword [rbp - 0x80], rax
movabs rax, 0x9f2c819381eb164a
mov qword [rbp - 0x78], rax
movabs rax, 0x3fe257b8c7f7fc1f
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rbx
movabs rax, 0x489674b33c4b0f5a
mov qword [rbp - 0x60], rax
movabs rax, 0x4e7240cefe080323
mov qword [rbp - 0x58], rax
movabs rax, 0xd4cabdaee94a44bd
mov qword [rbp - 0x50], rax
movabs rax, 0xaf15ff2bce0ea85f
mov qword [rbp - 0x48], rax
movabs rax, 0x452b117aa91bda2c
mov qword [rbp - 0x40], rax
movabs rax, 0x4489bf207aa1411f
mov qword [rbp - 0x38], rax
movabs rax, 0x8969accbbd87cf3c
mov qword [rbp - 0x30], rax
movabs rax, 0x9f5581c081cb162d
mov qword [rbp - 0x28], rax
movabs rax, 0x3f8f57ddc783fc6c
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rbx
movups xmm1, xmmword [rbp - 0x50]
movups xmm2, xmmword [rbp - 0x40]
movups xmm3, xmmword [rbp - 0x30]
movups xmm4, xmmword [rbp - 0x20]
movdqa xmm0, xmmword [rsp + 0x50]
xorps xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rbp + 0x20], xmm0
xorps xmm1, xmmword [rsp + 0x60]
movdqa xmmword [rbp + 0x30], xmm1
xorps xmm2, xmmword [rsp + 0x70]
movdqa xmmword [rbp + 0x40], xmm2
xorps xmm3, xmmword [rbp - 0x80]
movdqa xmmword [rbp + 0x50], xmm3
xorps xmm4, xmmword [rbp - 0x70]
movdqa xmmword [rbp + 0x60], xmm4
lea rax, [rbp + 0x20]
mov r10, 0xffffffffffffffff
inc r10
cmp word [rax + r10*2], 0
jne 0x14007e9d5
lea rbx, [rbp - 0x10]
mov rdi, qword [rbp - 0x10]
mov r14, qword [rbp + 8]
cmp r14, 7
cmova rbx, rdi
mov rax, qword [rbp]
cmp r10, rax
ja 0x14007ea95
sub rax, r10
test r10, r10
je 0x14007ea9c
lea rsi, [rbx + 2]
lea rsi, [rsi + rax*2]
mov rcx, rbx
movzx r11d, word [rbp + 0x20]
nop dword [rax]
mov rax, rsi
sub rax, rcx
sar rax, 1
mov rdx, r12
je 0x14007ea4a
cmp word [rcx], r11w
je 0x14007ea47
cmp rax, 1
je 0x14007ea4a
dec rax
add rcx, 2
cmp word [rcx], r11w
jne 0x14007ea34
mov rdx, rcx
mov rcx, rdx
test rdx, rdx
je 0x14007ea95
mov r8, r10
lea rdx, [rbp + 0x20]
test r10, r10
je 0x14007ea84
lea rax, [rbp + 0x20]
mov r9, rcx
sub r9, rax
nop dword [rax + rax]
movzx eax, word [rdx + r9]
cmp ax, word [rdx]
jne 0x14007ea8f
add rdx, 2
sub r8, 1
jne 0x14007ea70
mov r12, rcx
sub r12, rbx
sar r12, 1
jmp 0x14007ea9c
add rcx, 2
jmp 0x14007ea20
mov r12, 0xffffffffffffffff
cmp r12, 0xffffffffffffffff
setne bl
cmp r14, 7
jbe 0x14007eada
lea rax, [r14*2 + 2]
mov rcx, rdi
cmp rax, 0x1000
jb 0x14007eacd
mov rdi, qword [rdi - 8]
sub rcx, rdi
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14007eaff
mov rcx, rdi
call fcn.14000da60
nop
jmp 0x14007eada
xor bl, bl
test r13, r13
je 0x14007eae8
mov rcx, r13
call fcn.14000da60
nop
movzx eax, bl
add rsp, 0x1c8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140087d64
nop
int3