Function at 0x1400011d0
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push r14
mov eax, 0x25840
call fcn.14000fa10
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x25830], rax
cmp ecx, 3
je 0x140001208
or eax, 0xffffffff
jmp 0x140001498
mov rcx, qword [rdx + 0x10]
mov rbx, qword [rdx + 8]
call fcn.140005550
mov edx, eax
mov rcx, rbx
call section..text
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.140001108
and dword [rsp + 0x28], 0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x1400012a9
mov r11d, dword [r10 + 0x18]
test r11d, r11d
je 0x1400012a9
mov ebx, dword [r10 + 0x20]
dec r11d
mov ecx, r11d
lea rdx, [rbx + r11*4]
mov r9d, dword [rdx + r8]
mov edx, 0xbd0b581e
add r9, r8
mov cl, byte [r9]
inc r9
test cl, cl
je 0x1400012a4
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
mov cl, byte [r9]
inc r9
test cl, cl
jne 0x140001287
cmp edx, 0x138db73e
je 0x1400012ae
test r11d, r11d
jne 0x140001267
mov rax, qword [rax]
jmp 0x140001242
mov eax, dword [r10 + 0x24]
mov r14d, 0x195ff
mov ecx, dword [r10 + 0x1c]
add rax, r8
add rcx, r8
mov r9d, 4
movzx edx, word [rax + r11*2]
mov eax, dword [rcx + rdx*4]
mov edx, r14d
add rax, r8
xor ecx, ecx
mov r8d, 0x3000
call rax
mov r8d, r14d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.140002240
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x14000136d
mov r11d, dword [r10 + 0x18]
test r11d, r11d
je 0x14000136d
mov ebx, dword [r10 + 0x20]
dec r11d
mov ecx, r11d
lea rdx, [rbx + r11*4]
mov r9d, dword [rdx + r8]
mov edx, 0x3206001f
add r9, r8
mov cl, byte [r9]
inc r9
test cl, cl
je 0x140001368
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
mov cl, byte [r9]
inc r9
test cl, cl
jne 0x14000134b
cmp edx, 0x85c34769
je 0x140001372
test r11d, r11d
jne 0x14000132b
mov rax, qword [rax]
jmp 0x140001306
mov eax, dword [r10 + 0x24]
lea r9, [rsp + 0x28]
mov ecx, dword [r10 + 0x1c]
add rax, r8
add rcx, r8
movzx edx, word [rax + r11*2]
mov eax, dword [rcx + rdx*4]
mov rdx, r14
mov rcx, qword [rsp + 0x20]
add rax, r8
mov r8d, 0x40
call rax
mov ecx, 0xb6ede93
call fcn.1400050ec
mov rbx, qword [rsp + 0x20]
mov rsi, r14
call fcn.1400050c0
mov r8d, eax
mov eax, 0x142d72df
imul r8d
sar edx, 0xd
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x195ff
sub r8d, ecx
inc r8b
xor r8b, byte [rbx]
xor r8b, 0x93
mov byte [rbx], r8b
inc rbx
sub rsi, 1
jne 0x1400013b2
call qword [rsp + 0x20]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov r10d, dword [rcx + r9 + 0x88]
add r10, r9
cmp r10, r9
je 0x140001467
mov r11d, dword [r10 + 0x18]
test r11d, r11d
je 0x140001467
mov ebx, dword [r10 + 0x20]
dec r11d
mov ecx, r11d
lea rdx, [rbx + r11*4]
mov r8d, dword [rdx + r9]
mov edx, 0x3d8dcf76
add r8, r9
mov cl, byte [r8]
inc r8
test cl, cl
je 0x140001462
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
mov cl, byte [r8]
inc r8
test cl, cl
jne 0x140001445
cmp edx, 0xaa3bad8b
je 0x14000146c
test r11d, r11d
jne 0x140001425
mov rax, qword [rax]
jmp 0x140001400
mov eax, dword [r10 + 0x24]
mov rdx, r14
mov ecx, dword [r10 + 0x1c]
add rax, r9
add rcx, r9
movzx r8d, word [rax + r11*2]
mov eax, dword [rcx + r8*4]
mov r8d, 0x8000
mov rcx, qword [rsp + 0x20]
add rax, r9
call rax
xor eax, eax
mov rcx, qword [rsp + 0x25830]
xor rcx, rsp
call fcn.1400014d0
lea r11, [rsp + 0x25840]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop r14
ret