Function at 0x14005adf0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
mov rax, qword [0x1400ad028]
xor rax, rsp
mov qword [rsp + 0xa8], rax
mov r15, qword [rsp + 0x138]
xor eax, eax
mov qword [rsp + 0x60], rax
mov rbp, rdx
mov qword [rsp + 0x70], rax
mov r13, rcx
mov eax, 0x5a4d
mov qword [rsp + 0x50], r15
cmp word [rdx], ax
jne 0x14005b2d6
movsxd rdi, dword [rdx + 0x3c]
add rdi, rdx
cmp dword [rdi], 0x4550
jne 0x14005b2d6
mov eax, 0x20b
cmp word [rdi + 0x18], ax
jne 0x14005b2d6
mov r12d, dword [rdi + 0x50]
xor ecx, ecx
mov edx, r12d
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x40], rax
mov rsi, rax
test rax, rax
je 0x14005b2d6
movzx ecx, word [rdi + 0x14]
mov r14d, dword [rcx + rdi + 0x24]
mov rcx, r13
sub r12d, r14d
mov edx, r12d
call fcn.140054290
mov qword [rsp + 0x48], rax
mov rbx, rax
test rax, rax
je 0x14005aeda
mov r8d, r12d
mov rdx, rax
mov rcx, r13
call fcn.140054770
test al, al
jne 0x14005af70
mov r8d, r12d
mov rdx, rbx
mov rcx, r13
call fcn.140054570
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14005af6b
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14005af6b
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x4504fe60
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14005af66
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x14005af40
cmp r8d, 0x8b194c31
je 0x14005b2b2
test r9d, r9d
jne 0x14005af20
mov rax, qword [rax]
jmp 0x14005aef0
mov r8d, dword [rdi + 0x54]
mov rdx, rbp
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
movzx ebx, word [rdi + 0x14]
xor eax, eax
add rbx, 0x28
mov esi, eax
cmp ax, word [rdi + 6]
jae 0x14005afd0
mov r15, qword [rsp + 0x40]
add rbx, rdi
nop dword [rax]
test dword [rbx + 0x14], 0x80
ja 0x14005afbd
mov edx, dword [rbx + 4]
mov ecx, dword [rbx - 4]
add rdx, rbp
mov r8d, dword [rbx]
add rcx, r15
call sub.VCRUNTIME140.dll_memcpy
movzx eax, word [rdi + 6]
inc esi
add rbx, 0x28
cmp esi, eax
jl 0x14005afa0
mov r15, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
lea rcx, [rsp + 0x80]
mov rdx, qword [rsp + 0x40]
mov rsi, rbp
sub rsi, r14
mov rbx, rsi
sub rbx, qword [rdi + 0x30]
call fcn.14005bef0
mov rdx, rbx
mov rcx, rax
call fcn.14005b310
mov rbx, qword [rsp + 0x40]
mov rdx, rsi
mov rcx, rbx
call fcn.14005b410
test al, al
je 0x14005b2d6
mov rdx, rbx
lea rcx, [rsp + 0x80]
call fcn.14005c040
mov rdx, rax
mov rcx, r13
call fcn.14005b640
test al, al
je 0x14005b1ea
mov rax, qword [rsp + 0x40]
mov ebx, r12d
add rax, r14
je 0x14005b1ea
test r12d, r12d
je 0x14005b1ea
xor r14d, r14d
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x38], r14
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x80]
mov dword [rsp + 0x28], r14d
mov edx, 0x80862007
lea r9d, [r14 + 0x28]
mov qword [rsp + 0x88], r14
mov rcx, r13
mov qword [rsp + 0x80], 0x33
mov qword [rsp + 0x98], rbp
mov qword [rsp + 0xa0], rbx
mov dword [rsp + 0x50], r14d
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x14005b1ea
mov edi, dword [rdi + 0x28]
lea rdx, [rsp + 0x60]
mov r9d, ebx
mov qword [rsp + 0x20], r14
mov r8, rbp
lea rcx, [rsp + 0x70]
add rdi, rsi
call fcn.14006d130
test al, al
je 0x14005b1ea
mov rax, qword [rsp + 0x60]
lea rdx, [rsp + 0x50]
mov r9, rbp
mov qword [rsp + 0x20], rax
mov r8, rdi
mov dword [rsp + 0x50], r14d
mov rcx, r13
call fcn.14005b8a0
test al, al
je 0x14005b1ea
test r15, r15
je 0x14005b121
mov eax, dword [rsp + 0x50]
mov dword [r15], eax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14005b1b7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14005b1b7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xa3bcd71d
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14005b1b2
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x14005b190
cmp r8d, 0x22036d7a
je 0x14005b1bc
test r9d, r9d
jne 0x14005b170
mov rax, qword [rax]
jmp 0x14005b140
mov ecx, dword [rbx + 0x24]
mov r8d, 0x8000
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor edx, edx
mov rcx, qword [rsp + 0x40]
add rax, r10
call rax
mov rax, rbp
jmp 0x14005b2d8
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14005b277
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14005b277
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x24bbd164
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14005b272
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x14005b250
cmp r8d, 0x4f0c1645
je 0x14005b27c
test r9d, r9d
jne 0x14005b230
mov rax, qword [rax]
jmp 0x14005b200
mov ecx, dword [rbx + 0x24]
mov r8d, 0x8000
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor edx, edx
mov rcx, qword [rsp + 0x40]
add rax, r10
call rax
mov r8d, r12d
mov rdx, rbp
mov rcx, r13
call fcn.140054570
jmp 0x14005b2d6
mov ecx, dword [rbx + 0x24]
mov r8d, 0x8000
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor edx, edx
add rax, r10
mov rcx, rsi
call rax
xor eax, eax
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.14007e1c0
mov rbx, qword [rsp + 0x100]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret