Function at 0x1400791e4
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x14019b100]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov r14, rdx
mov rbx, rcx
xor r12d, r12d
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov r10d, dword [rcx + r9 + 0x88]
add r10, r9
cmp r10, r9
je 0x140079296
mov r8d, dword [r10 + 0x18]
test r8d, r8d
je 0x140079296
mov esi, dword [r10 + 0x20]
dec r8d
lea rcx, [rsi + r8*4]
mov edx, dword [rcx + r9]
add rdx, r9
mov r11d, 0xf41b16e2
mov cl, byte [rdx]
inc rdx
test cl, cl
je 0x140079291
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
inc rdx
test cl, cl
jne 0x140079272
cmp r11d, 0x18c1786a
je 0x14007929b
test r8d, r8d
jne 0x140079255
mov rax, qword [rax]
jmp 0x140079230
mov ecx, dword [r10 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r9
mov r8d, dword [rcx + rdx*4]
add r8, r9
xor edx, edx
lea ecx, [rdx + 2]
call r8
mov r15, rax
mov qword [rbx], r12
mov qword [rbx + 8], r12
mov qword [rbx + 0x10], r12
cmp rax, 0xffffffffffffffff
je 0x1400795b1
xor edx, edx
mov r8d, 0x234
lea rcx, [rsp + 0x34]
call fcn.1400cc970
mov dword [rsp + 0x30], 0x238
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x140079366
mov r9d, dword [r10 + 0x18]
test r9d, r9d
je 0x140079366
mov esi, dword [r10 + 0x20]
dec r9d
lea rcx, [rsi + r9*4]
mov edx, dword [rcx + r8]
add rdx, r8
mov r11d, 0x76f7d231
mov cl, byte [rdx]
inc rdx
test cl, cl
je 0x140079361
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
inc rdx
test cl, cl
jne 0x140079342
cmp r11d, 0xad7767e4
je 0x14007936b
test r9d, r9d
jne 0x140079325
mov rax, qword [rax]
jmp 0x140079300
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx edx, word [rcx + r9*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
lea rdx, [rsp + 0x30]
mov rcx, r15
call rax
test eax, eax
je 0x140079517
lea rcx, [rsp + 0x5c]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r12w
jne 0x14007939f
mov rcx, qword [r14 + 0x10]
mov r8, r14
cmp qword [r14 + 0x18], 7
jbe 0x1400793ba
mov r8, qword [r14]
cmp rcx, rax
jne 0x1400793fb
lea rdx, [rsp + 0x5c]
test rcx, rcx
je 0x1400794f5
lea rax, [rsp + 0x5c]
sub r8, rax
movzx eax, word [r8 + rdx]
cmp ax, word [rdx]
jne 0x1400793fb
add rdx, 2
sub rcx, 1
jne 0x1400793d5
jmp 0x1400794f5
lea r8, [rsp + 0x20]
mov rcx, rbx
call fcn.140064ae0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x140079472
mov r9d, dword [r10 + 0x18]
test r9d, r9d
je 0x140079472
mov esi, dword [r10 + 0x20]
dec r9d
lea rcx, [rsi + r9*4]
mov edx, dword [rcx + r8]
add rdx, r8
mov r11d, 0x3192390a
mov cl, byte [rdx]
inc rdx
test cl, cl
je 0x14007946d
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
inc rdx
test cl, cl
jne 0x14007944e
cmp r11d, 0x56e9d640
je 0x140079477
test r9d, r9d
jne 0x140079431
mov rax, qword [rax]
jmp 0x14007940c
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx edx, word [rcx + r9*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
lea rdx, [rsp + 0x30]
mov rcx, r15
call rax
test eax, eax
je 0x140079517
lea rcx, [rsp + 0x5c]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r12w
jne 0x1400794a7
mov rcx, qword [r14 + 0x10]
mov r8, r14
cmp qword [r14 + 0x18], 7
jbe 0x1400794c2
mov r8, qword [r14]
cmp rcx, rax
jne 0x1400793fb
lea rdx, [rsp + 0x5c]
test rcx, rcx
je 0x1400794f5
lea rax, [rsp + 0x5c]
sub r8, rax
movzx eax, word [r8 + rdx]
cmp ax, word [rdx]
jne 0x1400793fb
add rdx, 2
sub rcx, 1
jne 0x1400794dd
mov rdx, qword [rbx + 8]
mov eax, dword [rsp + 0x38]
cmp rdx, qword [rbx + 0x10]
mov dword [rsp + 0x20], eax
je 0x1400793ee
mov dword [rdx], eax
add qword [rbx + 8], 4
jmp 0x1400793fb
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x14007958e
mov r10d, dword [r9 + 0x18]
test r10d, r10d
je 0x14007958e
mov esi, dword [r9 + 0x20]
dec r10d
lea rcx, [rsi + r10*4]
mov edx, dword [rcx + r8]
add rdx, r8
mov r11d, 0xd108bfa6
mov cl, byte [rdx]
inc rdx
test cl, cl
je 0x140079589
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
inc rdx
test cl, cl
jne 0x14007956a
cmp r11d, 0xc7ea8e7c
je 0x140079593
test r10d, r10d
jne 0x14007954d
mov rax, qword [rax]
jmp 0x140079528
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + r10*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
mov rcx, r15
call rax
mov rax, rbx
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.14009cfc0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret