Function at 0x1401ecae0
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rbp
push rbx
push r12
push r13
push r15
lea rbp, [r11 - 0x3f8]
sub rsp, 0x4d0
mov rbx, qword [rcx + 0x18]
xor r13d, r13d
mov rdx, qword [rcx + 0x20]
movabs rax, 0x6d3a06d3a06d3a07
sub rdx, rbx
mov qword [rbp + 0x408], r13
imul rdx
mov r15, rcx
mov r12d, r13d
sar rdx, 8
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x1401ed093
mov qword [r11 + 0x18], rsi
lea esi, [r13 + 0x72]
mov qword [r11 - 0x30], rdi
mov qword [r11 - 0x38], r14
lea r14d, [r13 + 0x6f]
nop dword [rax]
xor edx, edx
lea rcx, [rbp + 0x1c0]
mov r8d, 0x200
call fcn.1403ccc50
imul rdi, r12, 0x258
lea rdx, [rbp + 0x1c0]
lea rcx, [rdi + 4]
add rcx, rbx
sub rdx, rcx
nop dword [rax]
movzx eax, word [rcx]
mov word [rdx + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x1401ecb80
xor eax, eax
mov dword [rsp + 0x20], 0x790065
mov word [rsp + 0x38], ax
mov ebx, 0x77
mov dword [rsp + 0x24], 0x6f0072
mov ecx, r13d
mov dword [rsp + 0x28], 0x77006b
mov dword [rsp + 0x2c], 0x750063
mov dword [rsp + 0x30], 0x6c0026
mov dword [rsp + 0x34], 0x6e0072
nop
movsxd rax, ecx
xor word [rsp + rax*2 + 0x20], cx
inc ecx
cmp ecx, 0xc
jb 0x1401ecbd0
lea rdx, [rsp + 0x20]
mov word [rsp + 0x38], r13w
lea rcx, [rbp + 0x1c0]
call fcn.1403cbeb0
test rax, rax
je 0x1401ed042
mov rdx, qword [r15 + 0x18]
lea rcx, [rsp + 0x60]
add rdx, rdi
call fcn.1401ed0b0
mov rcx, qword [rbp + 0x1a8]
movabs rax, 0xe38e38e38e38e39
mov r8, qword [rbp + 0x1a0]
sub rcx, r8
imul rcx
mov r14, rdx
sar r14, 2
mov rax, r14
shr rax, 0x3f
add r14, rax
je 0x1401ed018
lea rsi, [r8 + 0x28]
nop dword [rax]
xor eax, eax
mov dword [rsp + 0x3a], 0x640054
mov word [rsp + 0x42], ax
mov ecx, r13d
mov dword [rsp + 0x3e], 0x73006f
nop word [rax + rax]
movsxd rax, ecx
xor word [rsp + rax*2 + 0x3a], cx
inc ecx
cmp ecx, 4
jb 0x1401ecc70
mov word [rsp + 0x42], r13w
lea rcx, [rsp + 0x3a]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r13w
jne 0x1401ecc91
mov r11, qword [rsi + 0x18]
mov r9, rsi
mov r10, qword [rsi + 0x10]
cmp r11, 8
jb 0x1401eccaf
mov r9, qword [rsi]
cmp r10, rax
jne 0x1401ecd04
lea rdx, [rsp + 0x3a]
mov r8, r10
test r10, r10
je 0x1401ecf39
movzx eax, word [r9]
movzx ecx, word [rsp + 0x3a]
cmp ax, cx
jb 0x1401ecd04
lea rbx, [rsp + 0x3a]
sub r9, rbx
cmp ax, cx
ja 0x1401eccff
cmp r8, 1
je 0x1401ecf39
movzx eax, word [rdx + r9 + 2]
add rdx, 2
dec r8
movzx ecx, word [rdx]
cmp ax, cx
jae 0x1401eccde
mov ebx, 0x77
mov dword [rsp + 0x50], 0x680057
mov ecx, r13d
mov dword [rsp + 0x54], 0x67006c
mov dword [rsp + 0x58], 0x72006b
mov dword [rsp + 0x5c], 0x75
nop word [rax + rax]
movsxd rax, ecx
xor word [rsp + rax*2 + 0x50], cx
inc ecx
cmp ecx, 7
jb 0x1401ecd30
mov word [rsp + 0x5e], r13w
lea rcx, [rsp + 0x50]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r13w
jne 0x1401ecd51
mov r9, rsi
cmp r11, 8
jb 0x1401ecd67
mov r9, qword [rsi]
cmp r10, rax
jne 0x1401ecdbc
lea rdx, [rsp + 0x50]
mov r8, r10
test r10, r10
je 0x1401ecf39
movzx eax, word [r9]
movzx ecx, word [rsp + 0x50]
cmp ax, cx
jb 0x1401ecdbc
lea rbx, [rsp + 0x50]
sub r9, rbx
cmp ax, cx
ja 0x1401ecdb7
cmp r8, 1
je 0x1401ecf39
movzx eax, word [rdx + r9 + 2]
add rdx, 2
dec r8
movzx ecx, word [rdx]
cmp ax, cx
jae 0x1401ecd96
mov ebx, 0x77
mov dword [rsp + 0x44], 0x720055
mov ecx, r13d
mov dword [rsp + 0x48], 0x710067
mov dword [rsp + 0x4c], 0x77
nop word [rax + rax]
movsxd rax, ecx
xor word [rsp + rax*2 + 0x44], cx
inc ecx
cmp ecx, 5
jb 0x1401ecde0
mov word [rsp + 0x4e], r13w
lea rcx, [rsp + 0x44]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r13w
jne 0x1401ece01
mov r9, rsi
cmp r11, 8
jb 0x1401ece17
mov r9, qword [rsi]
cmp r10, rax
jne 0x1401ece6c
lea rdx, [rsp + 0x44]
mov r8, r10
test r10, r10
je 0x1401ecf32
movzx eax, word [r9]
movzx ecx, word [rsp + 0x44]
cmp ax, cx
jb 0x1401ece6c
lea rbx, [rsp + 0x44]
sub r9, rbx
cmp ax, cx
ja 0x1401ece67
cmp r8, 1
je 0x1401ecf2d
movzx eax, word [rdx + r9 + 2]
add rdx, 2
dec r8
movzx ecx, word [rdx]
cmp ax, cx
jae 0x1401ece46
mov ebx, 0x77
xor al, al
test al, al
jne 0x1401ecf39
xor eax, eax
mov dword [rsp + 0x20], 0x780053
mov word [rsp + 0x30], ax
mov ecx, r13d
mov dword [rsp + 0x24], 0x770071
mov dword [rsp + 0x28], 0x680061
mov dword [rsp + 0x2c], 0x350035
movsxd rax, ecx
xor word [rsp + rax*2 + 0x20], cx
inc ecx
cmp ecx, 8
jb 0x1401ecea0
mov word [rsp + 0x30], r13w
lea rcx, [rsp + 0x20]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r13w
jne 0x1401ecec1
mov r8, rsi
cmp r11, 8
jb 0x1401eced7
mov r8, qword [rsi]
cmp r10, rax
jne 0x1401ecff8
lea rdx, [rsp + 0x20]
test r10, r10
je 0x1401ecf39
movzx eax, word [r8]
movzx ecx, word [rsp + 0x20]
cmp ax, cx
jb 0x1401ecff8
lea r9, [rsp + 0x20]
sub r8, r9
cmp ax, cx
ja 0x1401ecff8
cmp r10, 1
je 0x1401ecf39
movzx eax, word [rdx + r8 + 2]
add rdx, 2
dec r10
movzx ecx, word [rdx]
cmp ax, cx
jae 0x1401ecf07
jmp 0x1401ecff8
mov ebx, 0x77
mov al, 1
jmp 0x1401ece6e
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1401ecfc7
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1401ecfc7
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xd39e8558
lea rcx, [rbx + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1401ecfc2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x1401ecfa0
cmp r8d, 0x7806f1c
je 0x1401ecfcc
test r9d, r9d
jne 0x1401ecf80
mov rax, qword [rax]
jmp 0x1401ecf50
mov ecx, dword [rdi + 0x24]
xor r8d, r8d
add rcx, r10
movzx edx, word [rcx + r9*2]
xor r9d, r9d
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea edx, [r9 + 0x10]
mov rcx, qword [rsi - 0x28]
add rax, r10
call rax
mov ebx, 0x77
add rsi, 0x48
sub r14, 1
jne 0x1401ecc50
mov r15, qword [rbp + 0x400]
lea esi, [r14 + 0x72]
mov r12, qword [rbp + 0x408]
lea rcx, [rbp + 0x1a0]
call fcn.1401f4460
lea rcx, [rbp + 0x188]
call fcn.140194884
lea rcx, [rbp + 0x168]
call fcn.14013ed68
mov r14d, 0x6f
mov rbx, qword [r15 + 0x18]
inc r12
mov rcx, qword [r15 + 0x20]
movabs rax, 0x6d3a06d3a06d3a07
sub rcx, rbx
mov qword [rbp + 0x408], r12
imul rcx
sar rdx, 8
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp r12, rdx
jb 0x1401ecb50
mov r14, qword [rsp + 0x4c0]
mov rdi, qword [rsp + 0x4c8]
mov rsi, qword [rsp + 0x510]
add rsp, 0x4d0
pop r15
pop r13
pop r12
pop rbx
pop rbp
ret