Function at 0x1400468e4
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Get process filename
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x148]
sub rsp, 0x220
mov rax, qword [0x14006e030]
xor rax, rsp
mov qword [rbp + 0x110], rax
mov rdi, qword [0x14006f9a8]
xor r15d, r15d
mov qword [rsp + 0x30], rcx
mov rbx, rcx
mov dword [rsp + 0x40], r15d
test rdi, rdi
jne 0x140046b8c
mov rax, qword gs:[0x60]
mov edx, r15d
mov r8d, 0x57960f16
mov qword [rsp + 0x30], rdx
mov r12d, r15d
mov dword [rsp + 0x20], r8d
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
movups xmm0, xmmword [rax + 0x58]
movd ecx, xmm0
movups xmmword [rbp - 0x80], xmm0
sub cx, 8
test r12d, r12d
je 0x1400469d3
cmp rdx, qword [rax + 0x30]
je 0x1400469d3
mov r9, qword [rbp - 0x78]
mov r10d, 0x9fc644b
movzx ecx, cx
shr rcx, 1
lea r11, [r9 + rcx*2]
cmp r9, r11
je 0x1400469ca
movsx ecx, byte [r9]
mov edx, ecx
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
add r9, 2
xor r8d, r10d
imul r10d, r8d, 0x1000193
cmp r9, r11
jne 0x140046996
mov rdx, qword [rsp + 0x30]
mov r8d, dword [rsp + 0x20]
cmp r10d, r12d
jne 0x140046a5e
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov rcx, qword [rcx + r9 + 0x88]
mov r10d, ecx
add r10, r9
shr rcx, 0x20
cmp r10, r9
je 0x140046a59
mov edi, dword [r10 + 0x18]
test edi, edi
je 0x140046a59
mov r13d, dword [r10 + 0x20]
dec edi
mov r14d, 0x9fc644b
lea rdx, [r9 + rdi*4]
mov r11d, dword [rdx + r13]
add r11, r9
mov sil, byte [r11]
inc r11
test sil, sil
je 0x140046a4d
movsx edx, sil
sub sil, 0x41
mov r8d, edx
or r8d, 0x20
cmp sil, 0x19
mov sil, byte [r11]
cmova r8d, edx
inc r11
xor r8d, r14d
imul r14d, r8d, 0x1000193
test sil, sil
jne 0x140046a1c
mov r8d, dword [rsp + 0x20]
cmp r14d, r8d
je 0x140046a66
xor r15d, r15d
test edi, edi
jne 0x1400469fe
mov rdx, qword [rsp + 0x30]
mov rax, qword [rax]
jmp 0x140046962
mov edx, dword [r10 + 0x24]
add rdx, r9
movzx r8d, word [rdx + rdi*2]
mov edx, dword [r10 + 0x1c]
add rdx, r9
mov edi, dword [rdx + r8*4]
add rdi, r9
cmp rdi, r10
jbe 0x140046b82
lea rax, [rcx + r10]
cmp rdi, rax
jae 0x140046b82
mov r14d, 0x9fc644b
lea rcx, [rbp - 0x70]
xor r15d, r15d
mov dword [rsp + 0x58], r14d
xor edx, edx
mov qword [rsp + 0x50], r15
mov esi, r14d
mov dword [rsp + 0x5c], r14d
lea r8d, [r15 + 0x40]
call sub.msvcrt.dll_memset
mov al, byte [rdi]
cmp al, 0x2e
je 0x140046ae8
lea rcx, [rbp - 0x70]
sub rcx, rdi
mov byte [rcx + rdi], al
inc rdi
movsx eax, al
xor eax, esi
imul esi, eax, 0x1000193
mov al, byte [rdi]
cmp al, 0x2e
jne 0x140046acd
mov dword [rsp + 0x58], esi
mov eax, dword [rbp - 0x70]
cmp eax, 0x2d697061
je 0x140046b07
cmp eax, 0x2d495041
je 0x140046b07
cmp eax, 0x2d747865
je 0x140046b07
cmp eax, 0x2d545845
jne 0x140046b16
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x50], rax
inc rdi
mov dl, byte [rdi]
test dl, dl
je 0x140046b48
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
inc rdi
xor ecx, r14d
imul r14d, ecx, 0x1000193
mov dl, byte [rdi]
test dl, dl
jne 0x140046b1f
mov dword [rsp + 0x5c], r14d
mov rax, qword gs:[0x60]
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x30], xmm0
mov rdx, qword [rsp + 0x30]
mov rax, qword [rax + 0x18]
mov r8d, dword [rsp + 0x3c]
mov r12d, dword [rsp + 0x38]
mov dword [rsp + 0x20], r8d
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x30], rdx
jmp 0x140046a5e
mov qword [0x14006f9a8], rdi
xor r15d, r15d
lea rdx, [rsp + 0x40]
mov ecx, 0x8080808
call rdi
test eax, eax
jne 0x140046e60
mov edi, 0x100
lea rcx, [rbp + 0x10]
mov r8d, edi
xor edx, edx
call sub.msvcrt.dll_memset
mov dword [rsp + 0x60], edi
mov rdi, qword [0x14006f9b0]
test rdi, rdi
jne 0x140046e18
mov rax, qword gs:[0x60]
mov rdx, r15
mov r8d, 0x572366f8
mov qword [rsp + 0x30], rdx
mov r12d, r15d
mov dword [rsp + 0x20], r8d
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
movups xmm0, xmmword [rax + 0x58]
movd ecx, xmm0
movups xmmword [rbp - 0x80], xmm0
sub cx, 8
test r12d, r12d
je 0x140046c5f
cmp rdx, qword [rax + 0x30]
je 0x140046c5f
mov r9, qword [rbp - 0x78]
mov r10d, 0x1500f2ca
movzx ecx, cx
shr rcx, 1
lea r11, [r9 + rcx*2]
cmp r9, r11
je 0x140046c56
movsx ecx, byte [r9]
mov edx, ecx
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
add r9, 2
xor r8d, r10d
imul r10d, r8d, 0x1000193
cmp r9, r11
jne 0x140046c22
mov rdx, qword [rsp + 0x30]
mov r8d, dword [rsp + 0x20]
cmp r10d, r12d
jne 0x140046cea
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov rcx, qword [rcx + r9 + 0x88]
mov r10d, ecx
add r10, r9
shr rcx, 0x20
cmp r10, r9
je 0x140046ce5
mov edi, dword [r10 + 0x18]
test edi, edi
je 0x140046ce5
mov r13d, dword [r10 + 0x20]
dec edi
mov r14d, 0x1500f2ca
lea rdx, [r9 + rdi*4]
mov r11d, dword [rdx + r13]
add r11, r9
mov sil, byte [r11]
inc r11
test sil, sil
je 0x140046cd9
movsx edx, sil
sub sil, 0x41
mov r8d, edx
or r8d, 0x20
cmp sil, 0x19
mov sil, byte [r11]
cmova r8d, edx
inc r11
xor r8d, r14d
imul r14d, r8d, 0x1000193
test sil, sil
jne 0x140046ca8
mov r8d, dword [rsp + 0x20]
cmp r14d, r8d
je 0x140046cf2
xor r15d, r15d
test edi, edi
jne 0x140046c8a
mov rdx, qword [rsp + 0x30]
mov rax, qword [rax]
jmp 0x140046bee
mov edx, dword [r10 + 0x24]
add rdx, r9
movzx r8d, word [rdx + rdi*2]
mov edx, dword [r10 + 0x1c]
add rdx, r9
mov edi, dword [rdx + r8*4]
add rdi, r9
cmp rdi, r10
jbe 0x140046e0e
lea rax, [rcx + r10]
cmp rdi, rax
jae 0x140046e0e
mov r14d, 0x1500f2ca
lea rcx, [rbp - 0x30]
xor r15d, r15d
mov dword [rsp + 0x78], r14d
xor edx, edx
mov qword [rsp + 0x70], r15
mov esi, r14d
mov dword [rsp + 0x7c], r14d
lea r8d, [r15 + 0x40]
call sub.msvcrt.dll_memset
mov al, byte [rdi]
cmp al, 0x2e
je 0x140046d74
lea rcx, [rbp - 0x30]
sub rcx, rdi
mov byte [rcx + rdi], al
inc rdi
movsx eax, al
xor eax, esi
imul esi, eax, 0x1000193
mov al, byte [rdi]
cmp al, 0x2e
jne 0x140046d59
mov dword [rsp + 0x78], esi
mov eax, dword [rbp - 0x30]
cmp eax, 0x2d697061
je 0x140046d93
cmp eax, 0x2d495041
je 0x140046d93
cmp eax, 0x2d747865
je 0x140046d93
cmp eax, 0x2d545845
jne 0x140046da2
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x70], rax
inc rdi
mov dl, byte [rdi]
test dl, dl
je 0x140046dd4
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
inc rdi
xor ecx, r14d
imul r14d, ecx, 0x1000193
mov dl, byte [rdi]
test dl, dl
jne 0x140046dab
mov dword [rsp + 0x7c], r14d
mov rax, qword gs:[0x60]
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x50], xmm0
mov rdx, qword [rsp + 0x50]
mov rax, qword [rax + 0x18]
mov r8d, dword [rsp + 0x5c]
mov r12d, dword [rsp + 0x58]
mov dword [rsp + 0x20], r8d
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x30], rdx
jmp 0x140046cea
mov qword [0x14006f9b0], rdi
xor r15d, r15d
mov ecx, dword [rsp + 0x40]
lea r8, [rsp + 0x60]
lea rdx, [rbp + 0x10]
call rdi
test eax, eax
jne 0x140046e60
mov rdx, qword [rbp + 0x18]
test rdx, rdx
je 0x140046e54
add rdx, 8
mov qword [rbx], r15
mov rcx, rbx
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 0xf
mov byte [rbx], r15b
call fcn.1400066d8
jmp 0x140046e72
cmp byte [rbp + 0x28], r15b
je 0x140046e60
lea rdx, [rbp + 0x28]
jmp 0x140046e38
mov qword [rbx], r15
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 0xf
mov byte [rbx], r15b
mov rax, rbx
mov rcx, qword [rbp + 0x110]
xor rcx, rsp
call fcn.140051b80
lea r11, [rsp + 0x220]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret