Function at 0x140078510
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x320]
sub rsp, 0x420
mov rax, qword [0x14007f040]
xor rax, rsp
mov qword [rbp + 0x310], rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov r14d, dword [rcx + rbx + 0x88]
add r14, rbx
cmp r14, rbx
je 0x1400785da
mov r11d, dword [r14 + 0x18]
test r11d, r11d
je 0x1400785da
mov esi, dword [r14 + 0x20]
nop word [rax + rax]
dec r11d
mov r10d, 0x992d13f9
lea rcx, [rsi + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x1400785d5
movsx ecx, r8b
lea r9, [r9 + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [r9 - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x1400785a0
cmp r10d, 0x7840c309
je 0x1400785e2
test r11d, r11d
jne 0x140078580
mov rax, qword [rax]
jmp 0x140078550
mov ecx, dword [r14 + 0x24]
add rcx, rbx
mov qword [rsp + 0x450], r12
mov qword [rsp + 0x458], r13
movzx edx, word [rcx + r11*2]
mov ecx, dword [r14 + 0x1c]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
xor edx, edx
add rax, rbx
mov ecx, 2
call rax
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x140078bd2
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x130
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140078a3c
movabs r13, 0x9ca177b059008007
movabs r12, 0xf44fe60fe054f386
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov r14d, dword [rcx + rbx + 0x88]
add r14, rbx
cmp r14, rbx
je 0x1400786fa
mov r11d, dword [r14 + 0x18]
test r11d, r11d
je 0x1400786fa
mov esi, dword [r14 + 0x20]
nop word [rax + rax]
dec r11d
mov r10d, 0x92b86fd2
lea rcx, [rsi + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x1400786f5
movsx ecx, r8b
lea r9, [r9 + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [r9 - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x1400786c0
cmp r10d, 0xcc99446
je 0x140078702
test r11d, r11d
jne 0x1400786a0
mov rax, qword [rax]
jmp 0x140078670
mov ecx, dword [r14 + 0x24]
mov r8d, 0x104
add rcx, rbx
movzx edx, word [rcx + r11*2]
mov ecx, dword [r14 + 0x1c]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
lea rdx, [rsp + 0x7c]
add rax, rbx
lea rcx, [rbp + 0x100]
call rax
movabs rcx, 0x9cc277df59728057
mov qword [rbp + 0xd0], r13
mov qword [rsp + 0x20], rcx
lea rdx, [rbp + 0xa0]
movabs rcx, 0x1d5815e2884546e9
mov qword [rbp + 0xe8], r12
mov qword [rsp + 0x28], rcx
movabs rax, 0x3b1a8eb49c0f895b
movdqu xmm0, xmmword [rsp + 0x20]
mov qword [rbp + 0xf0], rax
movabs rcx, 0xe69c7f256df50488
mov qword [rsp + 0x30], rcx
movabs rax, 0xeb9db905739e5570
movabs rcx, 0xf437e66ae07af3f4
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x38], rcx
movabs rbx, 0x1d1015918836468c
movups xmm1, xmmword [rsp + 0x30]
movabs rcx, 0x3b1a8eb49c0f893e
mov qword [rbp + 0xf8], rax
mov qword [rsp + 0x40], rcx
movabs rdi, 0xe6f97f4e6d9604e9
movups xmm2, xmmword [rsp + 0x40]
mov qword [rbp + 0xd8], rbx
lea rcx, [rbp + 0x100]
xorps xmm0, xmmword [rbp + 0xd0]
xorps xmm2, xmmword [rbp + 0xf0]
mov qword [rbp + 0xe0], rdi
xorps xmm1, xmmword [rbp + 0xe0]
movdqa xmmword [rbp + 0xc0], xmm2
movdqa xmmword [rbp + 0xa0], xmm0
movdqa xmmword [rbp + 0xb0], xmm1
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140078962
movabs rax, 0x9cc577845936807f
mov qword [rbp + 0x98], r12
mov qword [rbp + 0x80], rax
lea rdx, [rbp + 0xd0]
movabs rax, 0x1d7515bf885146ee
mov qword [rbp + 0xa0], r13
mov qword [rbp + 0x88], rax
lea rcx, [rbp + 0x100]
movdqu xmm0, xmmword [rbp + 0x80]
movabs rax, 0xe6f97f4e6df30491
mov qword [rbp + 0xa8], rbx
mov qword [rbp + 0x90], rax
movups xmm1, xmmword [rbp + 0x90]
mov qword [rbp + 0xb0], rdi
xorps xmm0, xmmword [rbp + 0xa0]
mov qword [rbp + 0xb8], r12
xorps xmm1, xmmword [rbp + 0xb0]
movdqa xmmword [rbp + 0xe0], xmm1
movdqa xmmword [rbp + 0xd0], xmm0
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140078962
movabs rax, 0x9c9777d15964806e
mov qword [rbp + 0xb8], r12
mov qword [rbp + 0xa0], rax
lea rdx, [rsp + 0x20]
movabs rax, 0x1d6815f4881846b8
mov qword [rbp + 0x80], r13
mov qword [rbp + 0xa8], rax
lea rcx, [rbp + 0x100]
movdqu xmm0, xmmword [rbp + 0xa0]
movabs rax, 0xe6f97f4e6d96048c
mov qword [rbp + 0x88], rbx
mov qword [rbp + 0xb0], rax
movups xmm1, xmmword [rbp + 0xb0]
mov qword [rbp + 0x90], rdi
xorps xmm0, xmmword [rbp + 0x80]
mov qword [rbp + 0x98], r12
xorps xmm1, xmmword [rbp + 0x90]
movdqa xmmword [rsp + 0x30], xmm1
movdqa xmmword [rsp + 0x20], xmm0
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140078ae6
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov r14d, dword [rcx + rbx + 0x88]
add r14, rbx
cmp r14, rbx
je 0x140078a09
mov r11d, dword [r14 + 0x18]
test r11d, r11d
je 0x140078a09
mov esi, dword [r14 + 0x20]
nop word [rax + rax]
dec r11d
mov r10d, 0xf988213f
lea rcx, [rsi + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
movzx ecx, byte [r9]
inc r9
test cl, cl
je 0x140078a04
nop
movsx edx, cl
lea r9, [r9 + 1]
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
movzx ecx, byte [r9 - 1]
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
test cl, cl
jne 0x1400789d0
cmp r10d, 0xa406a7f0
je 0x140078a11
test r11d, r11d
jne 0x1400789b0
mov rax, qword [rax]
jmp 0x140078980
mov ecx, dword [r14 + 0x24]
add rcx, rbx
movzx edx, word [rcx + r11*2]
mov ecx, dword [r14 + 0x1c]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
lea rdx, [rsp + 0x50]
add rax, rbx
mov rcx, r15
call rax
test eax, eax
jne 0x140078653
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov r14d, dword [rcx + rbx + 0x88]
add r14, rbx
cmp r14, rbx
je 0x140078ade
mov r11d, dword [r14 + 0x18]
test r11d, r11d
je 0x140078ade
mov esi, dword [r14 + 0x20]
nop word [rax + rax]
dec r11d
mov r10d, 0xf58ca07b
lea rcx, [rbx + r11*4]
mov r9d, dword [rcx + rsi]
add r9, rbx
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x140078ad9
movsx ecx, r8b
lea r9, [r9 + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [r9 - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x140078aa0
cmp r10d, 0x1b0a71ef
je 0x140078bb4
test r11d, r11d
jne 0x140078a80
mov rax, qword [rax]
jmp 0x140078a50
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov r14d, dword [rcx + rbx + 0x88]
add r14, rbx
cmp r14, rbx
je 0x140078b8a
mov r11d, dword [r14 + 0x18]
test r11d, r11d
je 0x140078b8a
mov esi, dword [r14 + 0x20]
nop word [rax + rax]
dec r11d
mov r10d, 0x13bff6aa
lea rcx, [rsi + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x140078b85
movsx ecx, r8b
lea r9, [r9 + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [r9 - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x140078b50
cmp r10d, 0x52eeb490
je 0x140078b92
test r11d, r11d
jne 0x140078b30
mov rax, qword [rax]
jmp 0x140078b00
mov ecx, dword [r14 + 0x24]
add rcx, rbx
movzx edx, word [rcx + r11*2]
mov ecx, dword [r14 + 0x1c]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
mov rcx, r15
add rax, rbx
call rax
mov al, 1
jmp 0x140078bd4
mov ecx, dword [r14 + 0x24]
add rcx, rbx
movzx edx, word [rcx + r11*2]
mov ecx, dword [r14 + 0x1c]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
mov rcx, r15
add rax, rbx
call rax
xor al, al
mov r13, qword [rsp + 0x458]
mov r12, qword [rsp + 0x450]
mov rcx, qword [rbp + 0x310]
xor rcx, rsp
call fcn.14007a950
mov rbx, qword [rsp + 0x460]
add rsp, 0x420
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret