Function at 0x140071e50
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf0]
sub rsp, 0x1f0
mov rax, qword [0x1403e7140]
xor rax, rsp
mov qword [rbp + 0xe0], rax
movzx ebx, r9b
mov r12, r8
mov r13, rdx
mov qword [rbp + 0x38], rdx
mov qword [rbp + 0x40], r8
xor r15d, r15d
mov dword [rsp + 0x30], r15d
mov byte [rbp + 0x48], r15b
mov qword [rbp + 0x50], r15
mov qword [rbp + 0x30], r15
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x48]
mov r8, rdx
lea rdx, [rbp + 0x60]
lea rcx, [0x1403ec198]
call fcn.14007d9c0
nop
cmp byte [rbp + 0x48], r15b
je 0x140071f83
mov rdi, qword [r12 + 0x10]
mov rcx, r12
mov r11, qword [r12 + 0x18]
cmp r11, 7
jbe 0x140071ef1
mov rcx, qword [r12]
lea rdx, [rbp + 0x60]
cmp qword [rbp + 0x78], 7
cmova rdx, qword [rbp + 0x60]
mov r10, qword [rbp + 0x70]
cmp r10, rdi
jne 0x140071f46
mov r8, r10
test r10, r10
je 0x140071f26
sub rcx, rdx
movzx eax, word [rdx]
cmp ax, word [rcx + rdx]
jne 0x140071f46
add rdx, 2
sub r8, 1
jne 0x140071f13
lea rcx, [rbp + 0x60]
call fcn.1400808f0
nop
mov rcx, r13
call fcn.1400808f0
nop
mov rcx, r12
call fcn.1400808f0
jmp 0x140072a21
mov rdx, qword [rbp + 0x50]
test bl, bl
je 0x140071f55
inc rdx
mov qword [rbp + 0x50], rdx
mov rcx, qword [rbp + 0x30]
shl rcx, 5
add rcx, qword [0x1403ec198]
mov r9, r12
cmp r11, 7
jbe 0x140071f71
mov r9, qword [r12]
mov qword [rsp + 0x20], rdi
mov r8, r10
call fcn.140071c70
jmp 0x1400722f9
mov r14d, 4
test bl, bl
je 0x140071fdd
mov r8, r12
lea rcx, [rbp - 0x10]
call fcn.14007d710
mov rbx, rax
mov dword [rsp + 0x30], 1
lea edx, [r14 + 0x1e]
mov rcx, rax
call fcn.14008e390
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 0x30], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp - 0x20], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
lea rsi, [rbp - 0x30]
mov ebx, 0x1003
jmp 0x14007208c
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x80], r15
mov rdi, qword [r12 + 0x10]
mov rsi, r12
cmp qword [r12 + 0x18], 7
jbe 0x140072002
mov rsi, qword [r12]
movabs rbx, 0x7ffffffffffffffe
cmp rdi, rbx
ja 0x140072a4d
cmp rdi, 7
ja 0x140072032
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x80], 7
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x68], xmm0
jmp 0x140072084
mov rax, rdi
or rax, 7
cmp rax, rbx
ja 0x14007204d
mov rbx, rax
mov ecx, 0xa
cmp rax, rcx
cmovb rbx, rcx
lea rax, [rbx + 1]
mov qword [rbp - 0x78], rax
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x68]
call fcn.14008eb60
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x80], rbx
lea r8, [rdi*2 + 2]
mov rdx, rsi
mov rcx, rax
call fcn.1403934b0
lea rsi, [rsp + 0x68]
mov ebx, r14d
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x38], 0x4006d
mov dword [rsp + 0x3c], 0x760010
mov dword [rsp + 0x40], 4
mov dword [rsp + 0x44], 0x61
mov qword [rsp + 0x48], 0x6a0010
mov qword [rsp + 0x50], r15
mov dword [rsp + 0x58], 0xa93b0000
mov dword [rsp + 0x5c], 0x30500ef
mov word [rsp + 0x60], Ordinal_217
mov r10d, r15d
lea r11, [rsp + 0x50]
nop dword [rax]
lea edx, [r10 + r10*2]
movzx ecx, word [rsp + rdx*2 + 0x38]
mov word [r11], cx
movzx eax, r10w
add ax, ax
lea edi, [rax + r10]
movzx r9d, byte [rsp + 0x5c]
add r9w, di
xor r9w, cx
mov word [r11], r9w
xor r8b, r8b
lea eax, [rdx + 1]
movzx edx, word [rsp + rax*2 + 0x38]
nop word [rax + rax]
movzx ecx, r8b
movzx eax, dx
shr ax, cl
test al, 1
jne 0x140072139
inc r8b
cmp r8b, 4
jne 0x140072120
jmp 0x14007214a
movzx r9d, r9w
movzx eax, byte [rsp + 0x5f]
btc r9d, eax
mov word [r11], r9w
mov dl, 5
lea eax, [r10 + 1]
lea eax, [r10 + rax*2]
movzx r8d, word [rsp + rax*2 + 0x38]
nop word [rax + rax]
movzx ecx, dl
movzx eax, r8w
shr ax, cl
test al, 1
jne 0x140072177
inc dl
cmp dl, 8
jne 0x140072160
jmp 0x14007218b
movzx ecx, r9w
movzx eax, byte [rsp + 0x5e]
btc ecx, eax
movzx r9d, cx
mov word [r11], cx
xor dl, dl
lea eax, [r10 + 1]
lea eax, [r10 + rax*2]
movzx r8d, word [rsp + rax*2 + 0x38]
nop dword [rax + rax]
movzx ecx, dl
movzx eax, r8w
shr ax, cl
test al, 1
jne 0x1400721b7
inc dl
cmp dl, 5
jne 0x1400721a0
jmp 0x1400721cb
movzx ecx, r9w
movzx eax, byte [rsp + 0x5d]
btc ecx, eax
movzx r9d, cx
mov word [r11], cx
movzx eax, byte [rsp + 0x5b]
add ax, di
xor ax, r9w
mov word [r11], ax
inc r10d
add r11, 2
cmp r10d, 4
jne 0x1400720e0
mov r8, r13
lea rcx, [rbp + 0x10]
call fcn.14007d710
nop
lea rcx, [rsp + 0x50]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rcx + r8*2], 0
jne 0x140072205
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.14008ed30
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x40], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
bts ebx, 0xa
mov dword [rsp + 0x30], ebx
mov r9, rsi
lea r8, [rbp - 0x50]
lea rcx, [rbp - 0x70]
call fcn.140074320
bts ebx, 0xb
mov dword [rsp + 0x30], ebx
mov rdx, qword [0x1403ec1a0]
cmp rdx, qword [0x1403ec1a8]
je 0x140072297
movups xmm0, xmmword [rbp - 0x70]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp - 0x60]
movups xmmword [rdx + 0x10], xmm1
movdqa xmm0, xmmword [0x1403c5110]
movdqu xmmword [rbp - 0x60], xmm0
mov word [rbp - 0x70], r15w
add qword [0x1403ec1a0], 0x20
jmp 0x1400722a8
lea r8, [rbp - 0x70]
lea rcx, [0x1403ec198]
call fcn.14008e180
nop
lea rcx, [rbp - 0x70]
call fcn.1400808f0
nop
lea rcx, [rbp - 0x50]
call fcn.1400808f0
nop
lea rcx, [rbp + 0x10]
call fcn.1400808f0
nop
test bl, 4
je 0x1400722d9
and ebx, 0xfffffffb
lea rcx, [rsp + 0x68]
call fcn.1400808f0
nop
test bl, 2
je 0x1400722eb
and ebx, 0xfffffffd
lea rcx, [rbp - 0x30]
call fcn.1400808f0
nop
test bl, 1
je 0x1400722f9
lea rcx, [rbp - 0x10]
call fcn.1400808f0
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xb0], xmm1
xor r8d, r8d
lea rdx, [0x1403c2538]
lea rcx, [rbp + 0xa0]
call fcn.14008e5f0
nop
mov rbx, qword [0x1403ec198]
mov rdi, qword [0x1403ec1a0]
cmp rbx, rdi
je 0x140072384
nop dword [rax + rax]
lea r8, [0x1403c1dd0]
mov rdx, rbx
lea rcx, [rbp - 0x10]
call fcn.14007ead0
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x140072362
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rbp + 0xa0]
call fcn.14008ed30
nop
lea rcx, [rbp - 0x10]
call fcn.1400808f0
add rbx, 0x20
cmp rbx, rdi
jne 0x140072340
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x80]
call fcn.14008d970
nop
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov r14d, dword [rcx + rbx + 0x88]
add r14, rbx
cmp r14, rbx
je 0x140072439
mov r11d, dword [r14 + 0x18]
test r11d, r11d
je 0x140072439
mov esi, dword [r14 + 0x20]
nop word [rax + rax]
dec r11d
lea rcx, [rsi + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0xe93d5d63
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x140072434
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x140072400
cmp r10d, 0xcac24fb4
je 0x140072441
test r11d, r11d
jne 0x1400723e0
mov rax, qword [rax]
jmp 0x1400723b0
mov ecx, dword [r14 + 0x1c]
add rcx, rbx
mov eax, dword [r14 + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov r10d, dword [rcx + rax*4]
add r10, rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x1403ec1b0]
call r10
cmp eax, 0xffffffff
je 0x14007276d
xorps xmm0, xmm0
movups xmmword [rbp + 0xc0], xmm0
movups xmmword [rbp + 0xd0], xmm0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov r14d, dword [rcx + rbx + 0x88]
add r14, rbx
cmp r14, rbx
je 0x140072529
mov r11d, dword [r14 + 0x18]
test r11d, r11d
je 0x140072529
mov esi, dword [r14 + 0x20]
nop word [rax + rax]
dec r11d
lea rcx, [rsi + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0x5484f3c5
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x140072524
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x1400724f0
cmp r10d, 0x329b4491
je 0x140072531
test r11d, r11d
jne 0x1400724d0
mov rax, qword [rax]
jmp 0x1400724a0
mov ecx, dword [r14 + 0x1c]
add rcx, rbx
mov eax, dword [r14 + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov r10d, dword [rcx + rax*4]
add r10, rbx
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xffffffff
mov r9d, 0xffffffff
xor r8d, r8d
lea edx, [r8 + 2]
mov rcx, qword [0x1403ec1b0]
call r10
mov dword [rbp + 0x58], r15d
lea r15, [rbp + 0x80]
cmp qword [rbp + 0x98], 0xf
cmova r15, qword [rbp + 0x80]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov r14d, dword [rcx + rbx + 0x88]
add r14, rbx
cmp r14, rbx
je 0x140072639
mov r11d, dword [r14 + 0x18]
test r11d, r11d
je 0x140072639
mov esi, dword [r14 + 0x20]
nop word [rax + rax]
dec r11d
lea rcx, [rsi + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0x2a398e7c
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x140072634
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x140072600
cmp r10d, 0xbfc36f05
je 0x140072641
test r11d, r11d
jne 0x1400725e0
mov rax, qword [rax]
jmp 0x1400725b0
mov ecx, dword [r14 + 0x1c]
add rcx, rbx
mov eax, dword [r14 + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov r10d, dword [rcx + rax*4]
add r10, rbx
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x58]
mov r8d, dword [rbp + 0x90]
mov rdx, r15
mov rcx, qword [0x1403ec1b0]
call r10
mov rcx, qword gs:[0x60]
test eax, eax
mov rax, qword [rcx + 0x18]
mov rax, qword [rax + 0x10]
jne 0x1400727b0
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov r14d, dword [rcx + rbx + 0x88]
add r14, rbx
cmp r14, rbx
je 0x140072729
mov r11d, dword [r14 + 0x18]
test r11d, r11d
je 0x140072729
mov esi, dword [r14 + 0x20]
nop word [rax + rax]
dec r11d
lea rcx, [rsi + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0x6846c631
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x140072724
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x1400726f0
cmp r10d, 0x7db5e62a
je 0x140072731
test r11d, r11d
jne 0x1400726d0
mov rax, qword [rax]
jmp 0x1400726a0
mov ecx, dword [r14 + 0x1c]
add rcx, rbx
mov eax, dword [r14 + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov r10d, dword [rcx + rax*4]
add r10, rbx
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x20], rax
xor edx, edx
mov r9d, 0xffffffff
mov r8d, r9d
mov rcx, qword [0x1403ec1b0]
call r10
nop
lea rcx, [rbp + 0x80]
call fcn.140090020
nop
lea rcx, [rbp + 0xa0]
call fcn.1400808f0
nop
lea rcx, [rbp + 0x60]
call fcn.1400808f0
nop
mov rcx, r13
call fcn.1400808f0
nop
mov rcx, r12
call fcn.1400808f0
xor al, al
jmp 0x140072a23
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov r14d, dword [rcx + rbx + 0x88]
add r14, rbx
cmp r14, rbx
je 0x140072839
mov r11d, dword [r14 + 0x18]
test r11d, r11d
je 0x140072839
mov esi, dword [r14 + 0x20]
nop word [rax + rax]
dec r11d
lea rcx, [rsi + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0xd6107c10
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x140072834
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x140072800
cmp r10d, 0xea50025e
je 0x140072841
test r11d, r11d
jne 0x1400727e0
mov rax, qword [rax]
jmp 0x1400727b0
mov ecx, dword [r14 + 0x1c]
add rcx, rbx
mov eax, dword [r14 + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov edx, dword [rcx + rax*4]
add rdx, rbx
mov rcx, qword [0x1403ec1b0]
call rdx
mov rcx, qword gs:[0x60]
test eax, eax
mov rax, qword [rcx + 0x18]
mov rax, qword [rax + 0x10]
jne 0x140072920
nop dword [rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov r14d, dword [rcx + rbx + 0x88]
add r14, rbx
cmp r14, rbx
je 0x14007290d
mov r11d, dword [r14 + 0x18]
test r11d, r11d
je 0x14007290d
mov esi, dword [r14 + 0x20]
nop word [rax + rax]
dec r11d
lea rcx, [rsi + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0x68d18369
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x140072908
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x1400728d0
cmp r10d, 0xdb980bf2
je 0x140072731
test r11d, r11d
jne 0x1400728b0
mov rax, qword [rax]
jmp 0x140072880
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov r14d, dword [rcx + rbx + 0x88]
add r14, rbx
cmp r14, rbx
je 0x1400729a8
mov r11d, dword [r14 + 0x18]
test r11d, r11d
je 0x1400729a8
mov esi, dword [r14 + 0x20]
nop word [rax + rax]
dec r11d
lea rcx, [rsi + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0xa11cfebc
movzx ecx, byte [r9]
inc r9
test cl, cl
je 0x1400729a3
nop
movsx edx, cl
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
movzx ecx, byte [r9]
lea r9, [r9 + 1]
test cl, cl
jne 0x140072970
cmp r10d, 0x724b920b
je 0x1400729b0
test r11d, r11d
jne 0x140072950
mov rax, qword [rax]
jmp 0x140072920
mov ecx, dword [r14 + 0x1c]
add rcx, rbx
mov eax, dword [r14 + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov r10d, dword [rcx + rax*4]
add r10, rbx
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x20], rax
xor edx, edx
mov r9d, 0xffffffff
mov r8d, r9d
mov rcx, qword [0x1403ec1b0]
call r10
nop
lea rcx, [rbp + 0x80]
call fcn.140090020
nop
lea rcx, [rbp + 0xa0]
call fcn.1400808f0
nop
lea rcx, [rbp + 0x60]
call fcn.1400808f0
nop
mov rcx, r13
call fcn.1400808f0
nop
mov rcx, r12
call fcn.1400808f0
mov al, 1
mov rcx, qword [rbp + 0xe0]
xor rcx, rsp
call fcn.140360560
mov rbx, qword [rsp + 0x230]
add rsp, 0x1f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14008fac0
nop
int3