Function at 0x140020f10
Capabilities:
Access peb ldr_data
Encode data using xor
Get system firmware table
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x1400c9438]
xor rax, rsp
mov qword [rsp + 0x70], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x54455048
mov ecx, 0x41435049
call qword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
mov rcx, qword gs:[0x60]
xor r12d, r12d
mov r15d, 0x86fe8652
mov r13d, eax
mov r10d, r12d
mov esi, r15d
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop word [rax + rax]
mov eax, dword [rcx + 0x58]
sub ax, 8
test r10d, r10d
je 0x140020fc4
mov rdx, qword [rcx + 0x60]
mov r8d, 0x811c9dc5
movzx eax, ax
shr rax, 1
lea r9, [rdx + rax*2]
cmp rdx, r9
je 0x140020fbb
movsx eax, byte [rdx]
add rdx, 2
xor eax, r8d
imul r8d, eax, 0x1000193
cmp rdx, r9
jne 0x140020fa5
cmp r8d, r10d
jne 0x140021105
mov r11, qword [rcx + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov rdx, qword [rax + r11 + 0x88]
mov rbp, rdx
mov ebx, edx
shr rbp, 0x20
add rbx, r11
cmp rbx, r11
je 0x140021105
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140021105
mov r14d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rax, [r14 + r9*4]
mov edx, dword [rax + r11]
add rdx, r11
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x140021039
nop
movsx eax, al
lea rdx, [rdx + 1]
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx - 1]
test al, al
jne 0x140021020
cmp r8d, esi
je 0x14002104b
test r9d, r9d
jne 0x140021000
mov rcx, qword [rcx]
jmp 0x140020f80
mov ecx, dword [rbx + 0x24]
add rcx, r11
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r11
mov r8d, dword [rcx + rdx*4]
add r8, r11
cmp r8, rbx
jbe 0x14002110d
lea rax, [rbx + rbp]
cmp r8, rax
jae 0x14002110d
movzx eax, byte [r8]
mov r10d, 0x811c9dc5
mov dword [rsp + 0x20], r10d
mov ecx, r10d
mov dword [rsp + 0x24], ecx
cmp al, 0x2e
je 0x1400210bd
nop dword [rax]
nop word [rax + rax]
movsx eax, al
inc r8
xor eax, r10d
imul r10d, eax, 0x1000193
movzx eax, byte [r8]
cmp al, 0x2e
jne 0x1400210a0
mov dword [rsp + 0x20], r10d
movzx eax, byte [r8 + 1]
inc r8
test al, al
je 0x1400210eb
nop dword [rax]
movsx eax, al
lea r8, [r8 + 1]
xor eax, ecx
imul ecx, eax, 0x1000193
movzx eax, byte [r8]
test al, al
jne 0x1400210d0
mov dword [rsp + 0x24], ecx
mov rax, qword gs:[0x60]
mov rsi, qword [rsp + 0x20]
shr rsi, 0x20
mov rcx, qword [rax + 0x18]
mov rcx, qword [rcx + 0x10]
mov rcx, qword [rcx]
jmp 0x140020f80
call r8
mov r8, r13
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
test rax, rax
jne 0x1400212d8
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov ecx, dword [rax + 0x58]
sub cx, 8
test r12d, r12d
je 0x140021184
mov rdx, qword [rax + 0x60]
mov r8d, 0x811c9dc5
movzx ecx, cx
shr rcx, 1
lea r9, [rdx + rcx*2]
cmp rdx, r9
je 0x14002117b
movsx ecx, byte [rdx]
add rdx, 2
xor ecx, r8d
imul r8d, ecx, 0x1000193
cmp rdx, r9
jne 0x140021165
cmp r8d, r12d
jne 0x1400212b8
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov rdx, qword [rcx + r10 + 0x88]
mov rsi, rdx
mov r11d, edx
shr rsi, 0x20
add r11, r10
cmp r11, r10
je 0x1400212b8
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x1400212b8
mov edi, dword [r11 + 0x20]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1400211f9
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x1400211e0
cmp r8d, r15d
je 0x14002120b
test r9d, r9d
jne 0x1400211c0
mov rax, qword [rax]
jmp 0x140021140
mov ecx, dword [r11 + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r10
mov r8d, dword [rcx + rdx*4]
add r8, r10
cmp r8, r11
jbe 0x1400212c0
lea rax, [r11 + rsi]
cmp r8, rax
jae 0x1400212c0
movzx eax, byte [r8]
mov ecx, 0x811c9dc5
mov dword [rsp + 0x20], ecx
mov edx, ecx
mov dword [rsp + 0x24], ecx
cmp al, 0x2e
je 0x14002126c
movsx eax, al
inc r8
xor eax, ecx
imul ecx, eax, 0x1000193
movzx eax, byte [r8]
cmp al, 0x2e
jne 0x140021252
mov dword [rsp + 0x20], ecx
movzx eax, byte [r8 + 1]
inc r8
test al, al
je 0x14002129b
nop dword [rax + rax]
movsx eax, al
lea r8, [r8 + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [r8]
test al, al
jne 0x140021280
mov dword [rsp + 0x24], edx
mov rax, qword gs:[0x60]
mov r12d, ecx
mov r15, qword [rsp + 0x20]
shr r15, 0x20
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rax, qword [rax]
jmp 0x140021140
call r8
mov rcx, rax
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov al, 1
jmp 0x140021611
mov r9d, r13d
mov r8, rbp
mov edx, 0x54455048
mov ecx, 0x41435049
call qword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
mov ecx, eax
cmp eax, r13d
je 0x1400214a8
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov ecx, dword [rax + 0x58]
sub cx, 8
test r12d, r12d
je 0x140021354
mov rdx, qword [rax + 0x60]
mov r8d, 0x811c9dc5
movzx ecx, cx
shr rcx, 1
lea r9, [rdx + rcx*2]
cmp rdx, r9
je 0x14002134b
movsx ecx, byte [rdx]
add rdx, 2
xor ecx, r8d
imul r8d, ecx, 0x1000193
cmp rdx, r9
jne 0x140021335
cmp r8d, r12d
jne 0x140021488
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov rdx, qword [rcx + r10 + 0x88]
mov rsi, rdx
mov r11d, edx
shr rsi, 0x20
add r11, r10
cmp r11, r10
je 0x140021488
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x140021488
mov edi, dword [r11 + 0x20]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400213c9
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x1400213b0
cmp r8d, r15d
je 0x1400213db
test r9d, r9d
jne 0x140021390
mov rax, qword [rax]
jmp 0x140021310
mov ecx, dword [r11 + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r10
mov r8d, dword [rcx + rdx*4]
add r8, r10
cmp r8, r11
jbe 0x140021490
lea rax, [r11 + rsi]
cmp r8, rax
jae 0x140021490
movzx eax, byte [r8]
mov edx, 0x811c9dc5
mov dword [rsp + 0x20], edx
mov ecx, edx
mov dword [rsp + 0x24], edx
cmp al, 0x2e
je 0x14002143c
movsx eax, al
inc r8
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [r8]
cmp al, 0x2e
jne 0x140021422
mov dword [rsp + 0x20], edx
movzx eax, byte [r8 + 1]
inc r8
test al, al
je 0x14002146b
nop dword [rax + rax]
movsx eax, al
lea r8, [r8 + 1]
xor eax, ecx
imul ecx, eax, 0x1000193
movzx eax, byte [r8]
test al, al
jne 0x140021450
mov dword [rsp + 0x24], ecx
mov rax, qword gs:[0x60]
mov r12d, edx
mov r15, qword [rsp + 0x20]
shr r15, 0x20
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rax, qword [rax]
jmp 0x140021310
call r8
mov rcx, rax
mov r8, rbp
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov al, 1
jmp 0x140021611
lea r8, [rcx + rbp]
mov qword [rsp + 0x58], r12
xorps xmm0, xmm0
mov rax, r12
mov qword [rsp + 0x50], rax
mov r9, rcx
movups xmmword [rsp + 0x40], xmm0
cmp rbp, r8
jne 0x1400214d9
mov edi, select
mov byte [rsp + 0x40], al
mov qword [rsp + 0x58], rdi
jmp 0x1400214f0
mov rdx, rbp
lea rcx, [rsp + 0x40]
call fcn.1400242a0
mov rax, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
movabs rcx, 0xa46e3b3f4b9c241
movabs rdx, 0xec8663526ab07156
mov qword [rsp + 0x60], rcx
mov rbx, 0xffffffffffffffff
movabs rcx, 0xa46a6e1b5ee8f17
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x38], rdx
movaps xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
nop
inc rbx
cmp byte [rcx + rbx], r12b
jne 0x140021540
mov rsi, qword [rsp + 0x40]
lea rbp, [rsp + 0x40]
cmp rdi, 0x10
cmovae rbp, rsi
cmp rbx, rax
ja 0x1400215c1
sub rax, rbx
test rbx, rbx
je 0x1400215c8
lea r14, [rax + rbp]
mov rcx, rbp
movd eax, xmm0
lea r8, [r14 + 1]
sub r8, rbp
movsx r15d, al
mov edx, r15d
call fcn.14007a3ad
mov r12, rax
test rax, rax
je 0x1400215c1
nop
mov r8, rbx
lea rdx, [rsp + 0x60]
mov rcx, r12
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140021601
inc r12
lea r8, [r14 + 1]
sub r8, r12
mov rcx, r12
mov edx, r15d
call fcn.14007a3ad
mov r12, rax
test rax, rax
jne 0x140021590
mov r12, 0xffffffffffffffff
cmp r12, 0xffffffffffffffff
setne bl
cmp rdi, 0x10
jb 0x14002160e
lea rdx, [rdi + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140021606
mov rsi, qword [rsi - 8]
add rdx, 0x27
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140021606
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub r12, rbp
jmp 0x1400215c8
mov rcx, rsi
call fcn.140079384
movzx eax, bl
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400790d0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret