Function at 0x140004370
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x258
mov rdi, rdx
mov rsi, rcx
movabs rcx, 0xc1b9a74ddd607fbd
mov byte [rsp + 0x40], 0
xor r14d, r14d
cmp qword [0x14000e870], rcx
jne 0x1400043ad
mov ecx, 0xcc1
xor eax, eax
jmp 0x1400043d8
xor eax, eax
lea rdx, [0x140008270]
nop word cs:[rax + rax]
mov r8, rax
add rax, 2
cmp qword [rdx + r8*8 + 0x6610], rcx
jne 0x1400043c0
lea rcx, [rax + 0xcc1]
movabs r10, 0x97676092132
lea rbp, [0x140008270]
mov r8, qword [rbp + rcx*8]
mov rdx, r8
movzx ecx, r8w
xor rcx, 0x2132
bswap rcx
shr rdx, 0x38
mov r9d, r8d
and r9d, 0xff0000
shl r9, 0x18
or r9, rdx
mov edx, r8d
and edx, 0xff000000
shl rdx, 8
or rdx, r9
mov r9, r8
shr r9, 8
and r9d, 0xff000000
or r9, rdx
mov rdx, r8
shr rdx, 0x18
and edx, 0xff0000
or rdx, r9
shr r8, 0x28
and r8d, 0xff00
or r8, rdx
or r8, rcx
xor r8, r10
sub r8, rax
add r8, 0xffffffffffffffcd
lea rbx, [rsp + 0x40]
mov ecx, 0x103
mov rdx, rbx
call r8
test eax, eax
je 0x1400047b7
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rsi
movabs rsi, 0x86a58962b4395e08
mov byte [rsp + 0x2e], 0
mov word [rsp + 0x2c], 0x3a20
movzx eax, byte [rsp + 0x40]
lea r15, [rsp + 0x150]
nop word cs:[rax + rax]
mov byte [rsp + 0x2c], al
xor eax, eax
nop word cs:[rax + rax]
cmp qword [rbp + rax*8 + 0x6800], rsi
je 0x140004510
cmp qword [rbp + rax*8 + 0x6810], rsi
je 0x140004520
cmp qword [rbp + rax*8 + 0x6820], rsi
je 0x140004530
cmp qword [rbp + rax*8 + 0x6830], rsi
je 0x140004540
lea rcx, [rax + 8]
add rax, 6
cmp rax, 0x3e
mov rax, rcx
jb 0x1400044c0
xor r9d, r9d
jmp 0x1400045e3
lea rcx, [rax + 0xd00]
jmp 0x14000454e
mov rcx, rax
add rax, 2
add rcx, 0xd02
jmp 0x14000454e
mov rcx, rax
add rax, 4
add rcx, 0xd04
jmp 0x14000454e
mov rcx, rax
add rax, 6
add rcx, 0xd06
shl rcx, 3
or rcx, 8
mov r9, qword [rcx + rbp]
mov rdx, r9
movzx ecx, r9w
xor rcx, 0x2132
bswap rcx
shr rdx, 0x38
mov r8, r9
shl r8, 0x18
movabs r10, 0xff0000000000
and r8, r10
or r8, rdx
mov rdx, r9
shl rdx, 8
movabs r10, 0xff00000000
and rdx, r10
mov r10, r9
shr r10, 8
and r10d, 0xff000000
or r10, rdx
or r10, r8
mov rdx, r9
shr rdx, 0x18
and edx, 0xff0000
shr r9, 0x28
and r9d, 0xff00
or r9, rdx
or r9, r10
or r9, rcx
movabs rcx, 0x97676092132
xor r9, rcx
sub r9, rax
add r9, 0xffffffffffffffcc
lea rcx, [rsp + 0x2c]
mov rdx, r15
mov r8d, 0x104
call r9
test eax, eax
je 0x1400047a0
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
nop dword [rax]
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x140004610
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x140004610
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
jmp 0x140004645
test r11, r11
je 0x140004610
dec r8
mov r11d, r8d
mov r12d, dword [r9 + r11*4]
movzx edi, byte [rax + r12]
test dil, dil
je 0x140004640
add r12, r10
mov r13d, 0x39283adc
nop word cs:[rax + rax]
movsx edi, dil
xor edi, r13d
imul r13d, edi, 0x1000193
movzx edi, byte [r12]
inc r12
test dil, dil
jne 0x140004670
cmp r13d, 0x178f28da
jne 0x140004640
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
mov rcx, r15
call rdx
cmp rax, 0x103
ja 0x1400047a0
mov r12, rax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
nop word cs:[rax + rax]
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x1400046e0
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x1400046e0
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
jmp 0x140004715
test r11, r11
je 0x1400046e0
dec r8
mov r11d, r8d
mov edi, dword [r9 + r11*4]
movzx r13d, byte [rax + rdi]
test r13b, r13b
je 0x140004710
add rdi, r10
mov r14d, 0x6afbf71a
nop word cs:[rax + rax]
movsx r13d, r13b
xor r13d, r14d
imul r14d, r13d, 0x1000193
movzx r13d, byte [rdi]
inc rdi
test r13b, r13b
jne 0x140004740
cmp r14d, 0x427c1fc5
jne 0x140004710
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov r9d, dword [rcx + rdx*4]
add r9, rax
mov rdi, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, r15
mov r8, r12
call r9
test eax, eax
jne 0x1400047a0
cmp byte [rdi + r12], 0x5c
je 0x1400047ce
nop dword [rax]
cmp byte [rbx], 0
lea rbx, [rbx + 1]
jne 0x1400047a0
movzx eax, byte [rbx]
test al, al
jne 0x1400044b0
xor r14d, r14d
mov eax, r14d
add rsp, 0x258
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movabs r8, 0x418101d4db8cce3b
mov r9, qword [rsp + 0x38]
add r9, r12
cmp qword [0x14000e870], r8
jne 0x1400047f7
mov edx, 0xcc1
xor eax, eax
mov rcx, qword [rsp + 0x30]
jmp 0x140004818
xor eax, eax
mov rcx, qword [rsp + 0x30]
nop
mov rdx, rax
add rax, 2
cmp qword [rbp + rdx*8 + 0x6610], r8
jne 0x140004800
lea rdx, [rax + 0xcc1]
mov r10, qword [rbp + rdx*8]
mov rdx, r10
movzx esi, r10w
xor rsi, 0x2132
bswap rsi
shr rdx, 0x38
mov r8, r10
shl r8, 0x18
movabs r11, 0xff0000000000
and r8, r11
or r8, rdx
mov rdx, r10
shl rdx, 8
movabs r11, 0xff00000000
and rdx, r11
mov r11, r10
shr r11, 8
and r11d, 0xff000000
or r11, rdx
or r11, r8
mov rdx, r10
shr rdx, 0x18
and edx, 0xff0000
shr r10, 0x28
and r10d, 0xff00
or r10, rdx
or r10, r11
or r10, rsi
movabs rdx, 0x97676092132
xor r10, rdx
sub r10, rax
add r10, 0xffffffffffffffcd
lea rdx, str._s_s
lea r8, [rsp + 0x2c]
call r10
mov r14d, 1
jmp 0x1400047b7