Function at 0x1400315c0
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x18]
sub rsp, 0x118
mov rbx, r9
mov r14, r8
mov r12, rdx
cmp byte [rcx + 8], 0
je 0x140031606
mov rdi, r8
mov rsi, rdx
mov rcx, rbx
rep movsb byte [rdi], byte [rsi]
jmp 0x140031aed
mov rdx, qword [0x1401c5120]
add rdx, 0x210
mov qword [rbp + 0x60], rdx
mov rax, qword gs:[0x30]
mov esi, dword [rax + 0x48]
mov rax, qword [rbp + 0x60]
mov ecx, dword [rax + 4]
cmp esi, ecx
jne 0x14003163f
mov rax, qword [rbp + 0x60]
mov ecx, dword [rax]
inc ecx
mov rax, qword [rbp + 0x60]
mov dword [rax], ecx
jmp 0x140031680
mov rdi, qword [rbp + 0x60]
mov r8d, 1
nop dword [rax]
mov eax, dword [rdi + 8]
cmp eax, r8d
je 0x140031665
xor eax, eax
lock cmpxchg dword [rdi + 8], r8d
cmp eax, r8d
jne 0x14003167d
mov ecx, dword [rdx + 0xc]
mov eax, dword [rdx + 0xc]
inc eax
mov dword [rdx + 0xc], eax
cmp ecx, 0x1fffffff
jbe 0x140031679
int3
pause
jmp 0x140031650
mov dword [rdx + 4], esi
cmp rbx, 0x200
jbe 0x140031841
movabs rax, 0xebea563a7b517acf
mov qword [rbp - 0x50], rax
movabs rax, 0x431848db133c7ab4
mov qword [rbp - 0x48], rax
movabs rax, 0xb3eb14e0d12fe141
mov qword [rbp - 0x40], rax
movabs rax, 0xd7fc17c948748cbe
mov qword [rbp - 0x38], rax
movabs rax, 0xe6d3bebe3969cdb3
mov qword [rbp - 0x30], rax
movabs rax, 0x39ffc77fa5708238
mov qword [rbp - 0x28], rax
movabs rax, 0xc87caa8402803cf5
mov qword [rbp - 0x20], rax
movabs rax, 0x68c327fdf0aa8292
mov qword [rbp - 0x18], rax
movabs rax, 0x2298ec0266701457
mov qword [rbp - 0x10], rax
movabs rax, 0xd5d676e308eabd1c
mov qword [rbp - 8], rax
movabs rax, 0xb546c0288b3d8769
mov qword [rbp], rax
movabs rcx, 0x68b2129104db0266
mov qword [rbp + 8], rcx
movabs rax, 0x8a8c3f51416b18bd
mov qword [rsp + 0x40], rax
movabs rax, 0x27792da929061fd7
mov qword [rsp + 0x48], rax
movabs rax, 0xd28728daeb42971e
mov qword [rsp + 0x50], rax
movabs rax, 0xedc226962910eed3
mov qword [rsp + 0x58], rax
movabs rax, 0x89a7dfcc5c19a289
mov qword [rsp + 0x60], rax
movabs rax, 0x4b9e905f8c58a24a
mov qword [rsp + 0x68], rax
movabs rax, 0xad2e8aa565ee559b
mov qword [rsp + 0x70], rax
movabs rax, 0x48b1428b9f8ae6f3
mov qword [rsp + 0x78], rax
movabs rax, 0x47ec956046422562
mov qword [rbp - 0x80], rax
movabs rax, 0xb0b8048663ca916f
mov qword [rbp - 0x78], rax
movabs rax, 0xb546ac44e24aa705
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rcx
movdqa xmm0, xmmword [rsp + 0x40]
xorps xmm0, xmmword [rbp - 0x50]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [rsp + 0x50]
xorps xmm1, xmmword [rbp - 0x40]
movdqa xmmword [rsp + 0x50], xmm1
movdqa xmm0, xmmword [rsp + 0x60]
xorps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [rsp + 0x70]
xorps xmm1, xmmword [rbp - 0x20]
movdqa xmmword [rsp + 0x70], xmm1
movdqa xmm0, xmmword [rbp - 0x80]
xorps xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [rbp - 0x70]
xorps xmm1, xmmword [rbp]
movdqa xmmword [rbp - 0x70], xmm1
lea rcx, [rsp + 0x40]
call fcn.1400311c0
xor r13d, r13d
mov qword [rbp - 0x60], r13
mov rsi, qword [0x1401c5368]
test rsi, rsi
jne 0x140031aa1
mov r11d, r13d
mov r15d, 0xaedfae25
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
movups xmm0, xmmword [rax + 0x58]
movd ecx, xmm0
sub cx, 8
test r11d, r11d
je 0x1400318df
psrldq xmm0, 8
movq rsi, xmm0
movzx ecx, cx
shr rcx, 1
lea r9, [rsi + rcx*2]
mov r8d, 0x811c9dc5
cmp rsi, r9
je 0x1400318d6
movsx ecx, byte [rsi]
mov edx, ecx
sub cl, 0x41
mov edi, edx
or edi, 0x20
cmp cl, 0x19
cmova edi, edx
xor edi, r8d
imul r8d, edi, 0x1000193
add rsi, 2
cmp rsi, r9
jne 0x1400318b0
cmp r8d, r11d
jne 0x140031a42
mov r10, qword [rax + 0x30]
test r10, r10
je 0x140031a4f
movsxd rcx, dword [r10 + 0x3c]
mov rdx, qword [rcx + r10 + 0x88]
mov r13, rdx
shr r13, 0x20
mov ebx, edx
add rbx, r10
cmp rbx, r10
je 0x140031a42
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140031a42
mov r12d, dword [rbx + 0x20]
nop
dec r9d
lea rcx, [r10 + r9*4]
mov esi, dword [rcx + r12]
add rsi, r10
mov r8d, 0x811c9dc5
movzx ecx, byte [rsi]
inc rsi
test cl, cl
je 0x140031966
nop
movsx edx, cl
sub cl, 0x41
mov edi, edx
or edi, 0x20
cmp cl, 0x19
cmova edi, edx
xor edi, r8d
imul r8d, edi, 0x1000193
movzx ecx, byte [rsi]
lea rsi, [rsi + 1]
test cl, cl
jne 0x140031940
cmp r8d, r15d
je 0x140031978
test r9d, r9d
jne 0x140031920
mov rax, qword [rax]
jmp 0x140031880
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rbx + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edi, dword [rcx + rax*4]
add rdi, r10
cmp rdi, rbx
jbe 0x140031a4a
lea rax, [rbx + r13]
cmp rdi, rax
jae 0x140031a4a
mov r11d, 0x811c9dc5
mov dword [rsp + 0x30], r11d
mov esi, r11d
mov dword [rsp + 0x34], r11d
movzx edx, byte [rdi]
cmp dl, 0x2e
je 0x1400319eb
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, r11d
imul r11d, ecx, 0x1000193
inc rdi
movzx edx, byte [rdi]
cmp dl, 0x2e
jne 0x1400319c0
mov dword [rsp + 0x30], r11d
inc rdi
movzx edx, byte [rdi]
test dl, dl
je 0x140031a28
nop word [rax + rax]
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, esi
imul esi, ecx, 0x1000193
lea rdi, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
jne 0x140031a00
mov dword [rsp + 0x34], esi
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r15, qword [rsp + 0x30]
shr r15, 0x20
mov rax, qword [rax]
jmp 0x140031880
xor r13d, r13d
jmp 0x140031a55
xor r13d, r13d
mov edi, r13d
mov qword [0x1401c5368], rdi
nop dword [rax]
rdtsc
shl rdx, 0x20
or rax, rdx
lea rcx, [rax + rax*4]
mov qword [0x1401c5370], rcx
cmp rcx, rdi
je 0x140031a60
mov rsi, rcx
xor rsi, rdi
mov qword [0x1401c5368], rsi
mov eax, ecx
xor eax, 0xaedfae25
mov dword [0x1401c5360], eax
mov rbx, qword [rbp + 0x78]
mov r14, qword [rbp + 0x70]
mov r12, qword [rbp + 0x68]
jmp 0x140031aa8
mov rcx, qword [0x1401c5370]
xor rsi, rcx
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
mov r9, rbx
mov r8, r14
mov rdx, r12
mov rcx, qword [0x1401c0e80]
call rsi
nop
mov rax, qword [rbp + 0x60]
mov ecx, dword [rax]
mov rax, qword [rbp + 0x60]
test ecx, ecx
je 0x140031ae1
mov ecx, dword [rax]
dec ecx
mov rax, qword [rbp + 0x60]
mov dword [rax], ecx
jmp 0x140031aed
mov dword [rax + 4], r13d
mov dword [rax + 8], r13d
mov dword [rax + 0xc], r13d
mov al, 1
add rsp, 0x118
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret