Function at 0x14002e8b0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov r14, rcx
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rdx, qword gs:[0x60]
xor ebx, ebx
mov rbp, rax
mov rdx, qword [rdx + 0x18]
mov rdx, qword [rdx + 0x10]
mov r9, qword [rdx + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov r10d, dword [rcx + r9 + 0x88]
add r10, r9
cmp r10, r9
je 0x14002e94c
mov r8d, dword [r10 + 0x18]
test r8d, r8d
je 0x14002e94c
mov edi, dword [r10 + 0x20]
dec r8d
mov r11d, 0xb9c1e856
lea rax, [rdi + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
mov al, byte [rcx]
inc rcx
test al, al
je 0x14002e947
movsx eax, al
xor eax, r11d
imul r11d, eax, 0x1000193
mov al, byte [rcx]
inc rcx
test al, al
jne 0x14002e928
cmp r11d, 0xd275e110
je 0x14002e951
test r8d, r8d
jne 0x14002e90b
mov rdx, qword [rdx]
jmp 0x14002e8e6
mov ecx, dword [r10 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
mov edx, 7
add rax, r9
mov rcx, rbp
call rax
mov eax, dword [0x140042314]
lea r9, [rsp + 0x48]
mov dword [rsp + 0x48], eax
mov r8d, ebx
movzx eax, word [0x140042318]
mov word [rsp + 0x4c], ax
mov eax, 0x29e4129f
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x37
mov al, r8b
inc r8d
sub al, cl
add al, 0x33
xor byte [r9], al
inc r9
cmp r8d, 6
jl 0x14002e992
lea rcx, [rsp + 0x48]
call fcn.1400013f8
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, qword gs:[0x60]
mov rbp, rax
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
mov r9, qword [rcx + 0x30]
movsxd rdx, dword [r9 + 0x3c]
mov r10d, dword [rdx + r9 + 0x88]
add r10, r9
cmp r10, r9
je 0x14002ea51
mov r8d, dword [r10 + 0x18]
test r8d, r8d
je 0x14002ea51
mov esi, dword [r10 + 0x20]
dec r8d
mov r11d, 0xa7fbf142
lea rax, [rsi + r8*4]
mov edx, dword [rax + r9]
add rdx, r9
mov al, byte [rdx]
inc rdx
test al, al
je 0x14002ea4c
movsx eax, al
xor eax, r11d
imul r11d, eax, 0x1000193
mov al, byte [rdx]
inc rdx
test al, al
jne 0x14002ea2d
cmp r11d, 0xe2bbac9c
je 0x14002ea56
test r8d, r8d
jne 0x14002ea10
mov rcx, qword [rcx]
jmp 0x14002e9eb
mov ecx, dword [r10 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
mov edx, 1
add rax, r9
mov rcx, rbp
call rax
cmp byte [0x140042291], bl
movzx eax, word [0x140042290]
mov word [rsp + 0x48], ax
je 0x14002eac5
mov r8d, ebx
lea r9, [rsp + 0x48]
mov eax, 0x29e4129f
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul edx, eax, 0x37
mov al, r8b
inc r8d
sub al, dl
add al, 0x33
xor byte [r9], al
inc r9
cmp r8d, 2
jl 0x14002ea95
lea rcx, [rsp + 0x48]
call fcn.1400013f8
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, qword gs:[0x60]
mov rbp, rax
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
mov r9, qword [rcx + 0x30]
movsxd rdx, dword [r9 + 0x3c]
mov r10d, dword [rdx + r9 + 0x88]
add r10, r9
cmp r10, r9
je 0x14002eb54
mov r8d, dword [r10 + 0x18]
test r8d, r8d
je 0x14002eb54
mov esi, dword [r10 + 0x20]
dec r8d
mov r11d, 0xb700860d
lea rax, [rsi + r8*4]
mov edx, dword [rax + r9]
add rdx, r9
mov al, byte [rdx]
inc rdx
test al, al
je 0x14002eb4f
movsx eax, al
xor eax, r11d
imul r11d, eax, 0x1000193
mov al, byte [rdx]
inc rdx
test al, al
jne 0x14002eb30
cmp r11d, 0xaecd18d
je 0x14002eb59
test r8d, r8d
jne 0x14002eb13
mov rcx, qword [rcx]
jmp 0x14002eaee
mov ecx, dword [r10 + 0x24]
mov edx, 7
add rcx, r9
movzx r8d, word [rcx + r8*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r9
mov eax, dword [rcx + r8*4]
mov rcx, rbp
add rax, r9
call rax
movzx eax, word [0x140042364]
lea r8, [rsp + 0x50]
mov word [rsp + 0x50], ax
mov al, byte [0x140042366]
mov byte [rsp + 0x52], al
mov eax, 0x29e4129f
mul ebx
mov eax, ebx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x37
mov al, bl
inc ebx
sub al, cl
add al, 0x33
xor byte [r8], al
inc r8
cmp ebx, 3
jl 0x14002eb98
lea rcx, [rsp + 0x50]
call fcn.1400013f8
mov rcx, r14
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
jmp fcn.1400013f8