Function at 0x140042a40
Capabilities:
Accept command line arguments
Access peb ldr_data
Encode data using xor
Get process filename
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push r14
sub rsp, 0x1a0
mov rax, qword [0x1400b2040]
xor rax, rsp
mov qword [rsp + 0x190], rax
xor eax, eax
lea rcx, [rsp + 0x70]
xorps xmm0, xmm0
mov qword [rsp + 0x60], rax
xor edx, edx
movups xmmword [rsp + 0x50], xmm0
lea r8d, [rax + 0x68]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rsp + 0xe0]
mov r8d, 0xb0
call sub.VCRUNTIME140.dll_memset
mov rax, qword gs:[0x60]
or r14d, 0xffffffff
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x140042b14
mov r9d, dword [r10 + 0x18]
test r9d, r9d
je 0x140042b14
mov edi, dword [r10 + 0x20]
add r9d, r14d
mov r11d, 0x811c9dc5
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r8]
add rdx, r8
mov cl, byte [rdx]
inc rdx
test cl, cl
je 0x140042b0f
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
inc rdx
test cl, cl
jne 0x140042af0
cmp r11d, 0x57ecbc3f
je 0x140042b19
test r9d, r9d
jne 0x140042ad3
mov rax, qword [rax]
jmp 0x140042aae
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx edx, word [rcx + r9*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
lea rcx, [rsp + 0x70]
add rax, r8
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x140042baf
mov r9d, dword [r10 + 0x18]
test r9d, r9d
je 0x140042baf
mov ebx, dword [r10 + 0x20]
add r9d, r14d
mov r11d, 0x811c9dc5
lea rcx, [r8 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r8
mov cl, byte [rdx]
inc rdx
test cl, cl
je 0x140042baa
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
inc rdx
test cl, cl
jne 0x140042b8b
cmp r11d, 0x4a7c0a09
je 0x140042bb4
test r9d, r9d
jne 0x140042b6f
mov rax, qword [rax]
jmp 0x140042b4a
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx edx, word [rcx + r9*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov ebx, dword [rcx + rdx*4]
add rbx, r8
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea rcx, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rcx
xor r8d, r8d
lea rcx, [rsp + 0x70]
mov rdx, rax
mov qword [rsp + 0x40], rcx
xor ecx, ecx
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 1
and dword [rsp + 0x20], 0
call rbx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x140042c84
mov r9d, dword [r10 + 0x18]
test r9d, r9d
je 0x140042c84
mov edi, dword [r10 + 0x20]
add r9d, r14d
mov r11d, 0x811c9dc5
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r8]
add rdx, r8
mov cl, byte [rdx]
inc rdx
test cl, cl
je 0x140042c7f
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
inc rdx
test cl, cl
jne 0x140042c60
cmp r11d, 0x785c251
je 0x140042c89
test r9d, r9d
jne 0x140042c43
mov rax, qword [rax]
jmp 0x140042c1e
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx edx, word [rcx + r9*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
mov edx, dword [rsp + 0x64]
add rax, r8
mov ecx, dword [rsp + 0x60]
mov r8d, 0x10002
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov r10d, dword [rcx + r9 + 0x88]
add r10, r9
cmp r10, r9
je 0x140042d29
mov r8d, dword [r10 + 0x18]
test r8d, r8d
je 0x140042d29
mov edi, dword [r10 + 0x20]
add r8d, r14d
mov r11d, 0x811c9dc5
lea rcx, [rdi + r8*4]
mov edx, dword [rcx + r9]
add rdx, r9
mov cl, byte [rdx]
inc rdx
test cl, cl
je 0x140042d24
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
inc rdx
test cl, cl
jne 0x140042d05
cmp r11d, 0xe20d8c9a
je 0x140042d2e
test r8d, r8d
jne 0x140042ce8
mov rax, qword [rax]
jmp 0x140042cc3
mov ecx, dword [r10 + 0x24]
mov edx, r14d
add rcx, r9
movzx r8d, word [rcx + r8*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r9
mov eax, dword [rcx + r8*4]
lea rcx, [rsp + 0xe0]
add rax, r9
call rax
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.140061e40
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop r14
ret