Function at 0x140002b34
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Create thread
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x68]
sub rsp, 0x140
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x30], rax
xor esi, esi
lea rcx, [rbp - 0x60]
call fcn.1400025c0
mov rdx, qword [rbp - 0x48]
lea r15d, [rsi + 0xf]
cmp rdx, r15
jbe 0x140002bb1
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002bac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002bac
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003da4
mov r12d, 1
mov ecx, r12d
call fcn.140003d60
mov qword [rbp + 0x20], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x140003ce8]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400031ca
cmp dword [rsp + 0x38], esi
je 0x1400031c0
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp + 0x20], xmm0
lea rcx, [rbp + 0x20]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x1400031c0
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
cmp dword [0x140007660], 8
jne 0x140002cc6
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x140002ca4
mov r11d, dword [r9 + 0x18]
test r11d, r11d
je 0x140002ca4
mov ebx, dword [r9 + 0x20]
dec r11d
lea rdx, [rbx + r11*4]
mov r10d, dword [rdx + r8]
add r10, r8
mov edx, 0x33243b8d
mov cl, byte [r10]
add r10, r12
test cl, cl
je 0x140002c9f
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
mov cl, byte [r10]
add r10, r12
test cl, cl
jne 0x140002c82
cmp edx, 0x1d0363ed
je 0x140002ca9
test r11d, r11d
jne 0x140002c65
mov rax, qword [rax]
jmp 0x140002c40
mov edx, dword [r9 + 0x1c]
add rdx, r8
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx ecx, word [rcx + r11*2]
mov eax, dword [rdx + rcx*4]
add rax, r8
xor ecx, ecx
call rax
lea rcx, [rbp]
call fcn.1400025c0
mov rdi, rax
mov dword [rsp + 0x30], 0x76177565
mov dword [rsp + 0x34], 0x65e5758
mov word [rsp + 0x38], 0x1d
mov byte [rsp + 0x3a], r12b
mov rcx, rsi
lea eax, [rcx + 0x35]
xor byte [rsp + rcx + 0x30], al
add rcx, r12
cmp rcx, 9
jb 0x140002cf1
mov byte [rsp + 0x3a], sil
mov word [rbp + 0x20], 0xa
mov byte [rbp + 0x22], sil
lea rcx, [rbp - 0x60]
call fcn.140001a88
mov r14, rax
movdqa xmm0, xmmword [0x140005260]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0x3b12666b
mov dword [rsp + 0x54], 0x2d25382c
mov dword [rsp + 0x58], 0x70752b20
mov word [rsp + 0x5c], 0x100
mov rcx, rsi
lea eax, [rcx + 0x35]
xor byte [rsp + rcx + 0x40], al
add rcx, r12
cmp rcx, 0x1c
jb 0x140002d4c
mov byte [rsp + 0x5d], sil
lea rax, [rsp + 0x40]
or rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], sil
jne 0x140002d6a
mov r8, qword [r14 + 0x10]
mov rax, qword [r14 + 0x18]
sub rax, r8
cmp rbx, rax
ja 0x140002e17
lea rax, [rbx + r8]
mov qword [r14 + 0x10], rax
mov rsi, r14
cmp qword [r14 + 0x18], r15
jbe 0x140002d9b
mov rsi, qword [r14]
lea rax, [rsp + 0x40]
add rax, rbx
cmp rax, rsi
jbe 0x140002dd2
lea rax, [r8 + rsi]
lea rcx, [rsp + 0x40]
cmp rcx, rax
ja 0x140002dd2
lea rax, [rsp + 0x40]
cmp rsi, rax
ja 0x140002dc5
xor r15d, r15d
jmp 0x140002dd5
lea rax, [rsp + 0x40]
mov r15, rsi
sub r15, rax
jmp 0x140002dd5
mov r15, rbx
inc r8
lea rcx, [rbx + rsi]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memmove
mov r8, r15
lea rdx, [rsp + 0x40]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8, rbx
sub r8, r15
lea rax, [rbx + r15]
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [r15 + rsi]
call sub.VCRUNTIME140.dll_memcpy
xor esi, esi
lea r15d, [rsi + 0xf]
jmp 0x140002e34
mov qword [rsp + 0x28], rbx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov rcx, r14
call fcn.140003ae8
mov r14, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x68], rsi
movups xmm0, xmmword [r14]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [r14 + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [r14 + 0x10], rsi
mov qword [r14 + 0x18], r15
mov byte [r14], sil
lea r8, [rbp + 0x20]
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x20]
call fcn.14000375c
nop
lea r8, [rsp + 0x30]
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.14000375c
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rsi
mov r14, qword [rax + 0x10]
mov r13, qword [rdi + 0x10]
mov rcx, qword [rdi + 0x18]
lea r12, [r14 + r13]
mov rax, qword [rax + 0x18]
sub rax, r14
cmp r13, rax
ja 0x140002f08
cmp rcx, qword [rbx + 0x18]
ja 0x140002f08
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], r15
mov byte [rbx], sil
lea rax, [rsp + 0x60]
cmp qword [rsp + 0x78], r15
cmova rax, qword [rsp + 0x60]
cmp qword [rdi + 0x18], r15
jbe 0x140002eee
mov rdi, qword [rdi]
lea r8, [r13 + 1]
lea rcx, [r14 + rax]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0x70], r12
jmp 0x140003029
sub rcx, r13
cmp r14, rcx
ja 0x140002f55
movups xmm0, xmmword [rdi]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], r15
mov byte [rdi], sil
mov rdi, qword [rsp + 0x60]
lea r8, [r13 + 1]
lea rcx, [r14 + rdi]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memmove
cmp qword [rbx + 0x18], r15
jbe 0x140002f4a
mov rbx, qword [rbx]
mov r8, r14
mov rdx, rbx
mov rcx, rdi
jmp 0x140002ef9
movabs r15, 0x7fffffffffffffff
mov rax, r15
sub rax, r14
cmp rax, r13
jb 0x1400031da
mov rax, r12
or rax, 0xf
cmp rax, r15
jbe 0x140002fa3
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140003d60
test rax, rax
je 0x140002fd3
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140002fe2
mov ecx, 0x16
cmp rax, rcx
cmovb rax, rcx
mov r15, rax
lea rcx, [rax + 1]
test rcx, rcx
je 0x140002fe2
cmp rcx, 0x1000
jb 0x140002fda
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400031e0
jmp 0x140002f88
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003d60
mov rsi, rax
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r15
mov r15d, 0xf
cmp qword [rbx + 0x18], r15
jbe 0x140003000
mov rbx, qword [rbx]
mov r8, r14
mov rdx, rbx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
cmp qword [rdi + 0x18], r15
jbe 0x140003017
mov rdi, qword [rdi]
lea r8, [r13 + 1]
lea rcx, [r14 + rsi]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
xor esi, esi
lea rcx, [rsp + 0x60]
call fcn.140001178
nop
mov rdx, qword [rbp - 0x28]
mov ebx, 0x1000
cmp rdx, r15
jbe 0x140003072
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, rbx
jb 0x14000306d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000306d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003da4
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], r15
mov byte [rbp - 0x40], sil
mov rdx, qword [rbp - 8]
cmp rdx, r15
jbe 0x1400030b7
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, rbx
jb 0x1400030b2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400030b2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003da4
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], r15
mov byte [rbp - 0x20], sil
mov rdx, qword [rbp - 0x68]
cmp rdx, r15
jbe 0x1400030fc
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, rbx
jb 0x1400030f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400030f7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003da4
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x68], r15
mov byte [rbp - 0x80], sil
mov rdx, qword [rbp - 0x48]
cmp rdx, r15
jbe 0x140003141
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, rbx
jb 0x14000313c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000313c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003da4
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], r15
mov byte [rbp - 0x60], sil
mov rdx, qword [rbp + 0x18]
cmp rdx, r15
jbe 0x140003186
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, rbx
jb 0x140003181
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003181
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003da4
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.140003d40
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, r12d
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x38], esi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
call fcn.140001164
int3
call fcn.1400010c4
int3