Function at 0x140002350
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x440]
sub rsp, 0x540
mov rax, qword [0x14000a010]
xor rax, rsp
mov qword [rbp + 0x430], rax
mov r12, rcx
mov qword [rbp - 0x80], rcx
mov qword [rsp + 0x68], rcx
lea rcx, [rbp - 0x78]
call fcn.140001b30
nop
mov r13, qword [rbp - 0x68]
mov qword [rsp + 0x58], r13
lea rcx, [r13 + 1]
call fcn.14000369c
mov r15, rax
mov qword [rsp + 0x60], rax
lea rsi, [rbp - 0x78]
cmp qword [rbp - 0x60], 0x10
cmovae rsi, qword [rbp - 0x78]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140002446
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140002446
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140002441
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140002420
cmp r8d, 0xa45cec64
je 0x14000244b
test r9d, r9d
jne 0x140002400
mov rax, qword [rax]
jmp 0x1400023d0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov r9d, dword [rcx + rax*4]
add r9, r10
lea r8, [r13 + 1]
mov rdx, rsi
mov rcx, r15
call r9
lea rcx, [r13 + 1]
call fcn.14000369c
mov r15, rax
mov qword [rsp + 0x68], rax
lea rsi, [rbp - 0x78]
cmp qword [rbp - 0x60], 0x10
cmovae rsi, qword [rbp - 0x78]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140002516
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140002516
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140002511
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400024f0
cmp r8d, 0xa45cec64
je 0x14000251b
test r9d, r9d
jne 0x1400024d0
mov rax, qword [rax]
jmp 0x1400024a0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov r9d, dword [rcx + rax*4]
add r9, r10
lea r8, [r13 + 1]
mov rdx, rsi
mov rcx, r15
call r9
lea rax, vtable.AES.0
mov qword [rbp - 0x50], rax
mov byte [rbp - 0x48], 0
xor eax, eax
mov qword [rbp + 0x37c], rax
mov dword [rbp + 0x384], eax
lea rcx, [rbp - 0x50]
call fcn.1400014c0
cmp byte [rbp - 0x48], 0
je 0x1400029e0
test r13, r13
je 0x1400029e0
movsxd r10, dword [rbp + 0x380]
xor edx, edx
mov rax, r13
div r10
test rdx, rdx
jne 0x1400029e0
xor esi, esi
mov dword [rsp + 0x30], esi
mov rdi, qword [rsp + 0x60]
mov qword [rsp + 0x50], rdi
mov rbx, r15
mov qword [rsp + 0x40], rbx
test rax, rax
je 0x1400029e0
lea r12, [0x140000000]
nop word [rax + rax]
mov r9, rdi
cmp byte [rbp - 0x48], 0
je 0x1400028ad
cmp r10d, 0x10
jne 0x1400025ee
mov r8, rbx
mov rdx, rdi
lea rcx, [rbp - 0x50]
call fcn.1400010b0
mov r10d, dword [rbp + 0x380]
jmp 0x1400028ad
mov eax, r10d
cdq
and edx, 3
add eax, edx
sar eax, 2
movsxd r13, eax
xor eax, eax
cmp r13d, 4
je 0x14000260f
cmp r13d, 6
setne al
inc rax
shl rax, 5
mov r15d, dword [rax + r12 + 0x7dbc]
mov dword [rsp + 0x48], r15d
mov esi, dword [rax + r12 + 0x7dc4]
mov dword [rsp + 0x34], esi
mov r14d, dword [rax + r12 + 0x7dcc]
mov dword [rsp + 0x38], r14d
lea r11, [rbp + 0x408]
xor ebx, ebx
test r13d, r13d
jle 0x1400026a0
nop word [rax + rax]
movzx r8d, byte [r9]
movzx eax, byte [r9 + 1]
movzx ecx, byte [r9 + 2]
mov rdx, r11
shl r8d, 8
or r8d, eax
shl r8d, 8
or r8d, ecx
shl r8d, 8
movzx eax, byte [r9 + 3]
or r8d, eax
mov dword [r11], r8d
lea r9, [r9 + 4]
add r11, 4
xor r8d, dword [rbp + rbx*4 + 0x19c]
mov dword [rdx], r8d
inc rbx
cmp rbx, r13
jl 0x140002650
mov r10d, dword [rbp + 0x380]
mov r12d, 1
mov eax, dword [rbp + 0x384]
cmp eax, r12d
jle 0x1400027c6
lea eax, [r13*4]
cdqe
mov qword [rsp + 0x78], rax
mov r14, 0xfffffffffffffdb4
nop dword [rax + rax]
xor esi, esi
test r13d, r13d
jle 0x140002788
mov ebx, r15d
mov r10d, dword [rsp + 0x34]
sub r10d, r15d
mov r11d, dword [rsp + 0x38]
sub r11d, r15d
lea r15, [0x140000000]
lea eax, [r10 + rbx]
cdq
idiv r13d
movsxd rax, edx
mov ecx, dword [rbp + rax*4 + 0x408]
sar rcx, 8
movzx r8d, cl
lea eax, [r11 + rbx]
cdq
idiv r13d
movsxd rax, edx
movzx ecx, byte [rbp + rax*4 + 0x408]
mov r9d, dword [r15 + r8*4 + 0x64a0]
xor r9d, dword [r15 + rcx*4 + 0x75a0]
mov eax, ebx
cdq
idiv r13d
movsxd rax, edx
mov ecx, dword [rbp + rax*4 + 0x408]
sar rcx, 0x10
movzx eax, cl
xor r9d, dword [r15 + rax*4 + 0x54a0]
movzx eax, byte [rbp + rsi*4 + 0x40b]
xor r9d, dword [r15 + rax*4 + 0x79b0]
lea rax, [r14 + rsi*4]
xor r9d, dword [rbp + rax + 0x408]
mov dword [rbp + rsi*4 + 0x3e8], r9d
inc ebx
inc rsi
cmp rsi, r13
jl 0x1400026f5
mov r15d, dword [rsp + 0x48]
mov r8, qword [rsp + 0x78]
lea rdx, [rbp + 0x3e8]
lea rcx, [rbp + 0x408]
call sub.VCRUNTIME140.dll_memcpy
inc r12d
add r14, 0x20
mov eax, dword [rbp + 0x384]
cmp r12d, eax
jl 0x1400026d0
mov r10d, dword [rbp + 0x380]
mov esi, dword [rsp + 0x34]
mov r14d, dword [rsp + 0x38]
xor ebx, ebx
lea r12, [0x140000000]
test r13d, r13d
jle 0x14000289a
movsxd r11, eax
mov r9, qword [rsp + 0x40]
shl r11, 5
sub r15d, esi
sub r14d, esi
nop word [rax + rax]
lea rax, [r11 + rbx*4]
mov r8d, dword [rbp + rax + 0x19c]
movzx ecx, byte [rbp + rbx*4 + 0x40b]
mov eax, r8d
sar eax, 0x18
xor al, byte [rcx + r12 + 0x53a0]
mov byte [r9], al
lea eax, [r15 + rsi]
cdq
idiv r13d
movsxd rax, edx
mov ecx, dword [rbp + rax*4 + 0x408]
sar rcx, 0x10
movzx edx, cl
mov eax, r8d
sar eax, 0x10
xor al, byte [rdx + r12 + 0x53a0]
mov byte [r9 + 1], al
mov eax, esi
cdq
idiv r13d
movsxd rax, edx
mov ecx, dword [rbp + rax*4 + 0x408]
sar rcx, 8
movzx edx, cl
mov eax, r8d
sar eax, 8
xor al, byte [rdx + r12 + 0x53a0]
mov byte [r9 + 2], al
lea eax, [r14 + rsi]
cdq
idiv r13d
movsxd rax, edx
movzx ecx, byte [rbp + rax*4 + 0x408]
xor r8b, byte [rcx + r12 + 0x53a0]
mov byte [r9 + 3], r8b
lea r9, [r9 + 4]
inc esi
inc rbx
cmp rbx, r13
jl 0x1400027f0
mov r13, qword [rsp + 0x58]
mov esi, dword [rsp + 0x30]
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
lea r8, [rbp + 0x3a8]
mov rdx, rbx
cmp byte [rbp - 0x48], 0
je 0x140002991
xor r9d, r9d
test r10d, r10d
jle 0x140002991
cmp r10d, 0x40
jb 0x140002971
lea eax, [r10 - 1]
movsxd rcx, eax
lea r11, [rcx + rbx]
lea rax, [rbp + 0x3a8]
add rax, rcx
cmp rbx, rax
ja 0x1400028fd
lea rax, [rbp + 0x3a8]
cmp r11, rax
jae 0x140002971
mov eax, r10d
and eax, 0x8000003f
jge 0x14000290e
dec eax
or eax, 0xffffffc0
inc eax
mov ecx, r10d
sub ecx, eax
movdqu xmm1, xmmword [r8]
movdqu xmm0, xmmword [rdx]
pxor xmm1, xmm0
movdqu xmmword [rdx], xmm1
movdqu xmm1, xmmword [r8 + 0x10]
movdqu xmm0, xmmword [rdx + 0x10]
pxor xmm1, xmm0
movdqu xmmword [rdx + 0x10], xmm1
movdqu xmm1, xmmword [r8 + 0x20]
movdqu xmm0, xmmword [rdx + 0x20]
pxor xmm1, xmm0
movdqu xmmword [rdx + 0x20], xmm1
movdqu xmm1, xmmword [r8 + 0x30]
movdqu xmm0, xmmword [rdx + 0x30]
pxor xmm1, xmm0
movdqu xmmword [rdx + 0x30], xmm1
add r8, 0x40
add rdx, 0x40
add r9d, 0x40
cmp r9d, ecx
jl 0x140002913
cmp r9d, r10d
jge 0x140002991
sub r8, rdx
mov ecx, r10d
sub ecx, r9d
nop
movzx eax, byte [rdx + r8]
xor byte [rdx], al
lea rdx, [rdx + 1]
sub rcx, 1
jne 0x140002980
movsxd r8, r10d
mov rdx, rdi
lea rcx, [rbp + 0x3a8]
call sub.VCRUNTIME140.dll_memcpy
movsxd r10, dword [rbp + 0x380]
add rdi, r10
mov qword [rsp + 0x50], rdi
add rbx, r10
mov qword [rsp + 0x40], rbx
inc esi
mov dword [rsp + 0x30], esi
xor edx, edx
mov rax, r13
div r10
mov rcx, rax
movsxd rax, esi
cmp rax, rcx
jb 0x1400025c0
mov r15, qword [rsp + 0x68]
mov r12, qword [rbp - 0x80]
movzx r9d, byte [r15 + r13 - 1]
lea edx, [r13 - 1]
movsx rax, r9b
mov r8, r13
sub r8, rax
movsxd rax, edx
cmp rax, r8
jb 0x140002ace
lea rcx, [rax + r15]
cmp byte [rcx], r9b
jne 0x140002a1e
mov byte [rcx], 0
dec edx
dec rcx
movsxd rax, edx
cmp rax, r8
jae 0x140002a04
jmp 0x140002ace
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140002aa6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140002aa6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
mov r8d, 0x811c9dc5
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140002aa1
nop
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x140002a80
cmp r8d, 0xcb80cc06
je 0x140002aab
test r9d, r9d
jne 0x140002a60
mov rax, qword [rax]
jmp 0x140002a30
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov r9d, dword [rcx + rax*4]
add r9, r10
mov r8, r13
xor edx, edx
mov rcx, r15
call r9
mov rdx, r15
mov rcx, r12
call fcn.140001ff0
mov rcx, qword [rsp + 0x60]
call fcn.140003140
mov rcx, r15
call fcn.140003140
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x140002b2a
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002b25
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002b25
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003140
mov rax, r12
mov rcx, qword [rbp + 0x430]
xor rcx, rsp
call fcn.140003120
mov rbx, qword [rsp + 0x590]
add rsp, 0x540
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret