Function at 0x140032140
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x4790]
mov eax, 0x4890
call fcn.1400a2e50
sub rsp, rax
mov rax, qword [0x14022a960]
test rax, rax
jne 0x14003221a
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400321f7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400321f7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400321f2
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x1400321d0
cmp r8d, 0xbc25fccb
je 0x1400321fc
test r9d, r9d
jne 0x1400321b0
mov rax, qword [rax]
jmp 0x140032180
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov qword [0x14022a960], rax
mov qword [rsp + 0x48c0], rsi
lea r8, [rbp + 0x47b0]
mov qword [rsp + 0x4888], r12
lea rcx, [rbp + 0x770]
mov qword [rsp + 0x4880], r13
mov edx, 0x4000
mov qword [rsp + 0x4878], r14
mov qword [rsp + 0x4870], r15
call rax
test eax, eax
je 0x14003249c
mov eax, dword [rbp + 0x47b0]
cmp eax, 0x4000
jae 0x14003249c
mov r14d, eax
shr r14, 3
test r14, r14
je 0x14003249c
xor r15d, r15d
movabs rbx, 0x539c30b2537ba75b
mov esi, r15d
movabs rdi, 0xae7fad3f0b7fcd08
movabs r12, 0x26fe55f6230fd313
movabs r13, 0xae7fad3f0b7fcd6f
nop
mov rax, qword [0x14022a938]
test rax, rax
jne 0x14003238e
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140032357
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140032357
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140032352
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x140032330
cmp r8d, 0x3cedbc12
je 0x14003235c
test r9d, r9d
jne 0x140032310
mov rax, qword [rax]
jmp 0x1400322e0
mov ecx, dword [rbx + 0x24]
movabs rdi, 0xae7fad3f0b7fcd08
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
movabs rbx, 0x539c30b2537ba75b
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov qword [0x14022a938], rax
mov rcx, qword [rbp + rsi*8 + 0x770]
lea rdx, [rsp + 0x70]
mov r8d, 0x800
call rax
test eax, eax
je 0x140032490
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x70]
mov qword [rsp + 0x50], r15
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
nop word [rax + rax]
inc r8
cmp byte [rax + r8], r15b
jne 0x1400323d0
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call fcn.140007e60
mov qword [rbp + 0x47b8], r12
lea rcx, [rsp + 0x30]
mov rax, qword [rbp + 0x47b8]
mov qword [rsp + 0x30], rax
mov qword [rbp + 0x47b8], r13
mov rax, qword [rbp + 0x47b8]
mov qword [rsp + 0x38], rax
mov qword [rbp + 0x47b8], rbx
mov rax, qword [rbp + 0x47b8]
mov qword [rsp + 0x60], rax
mov qword [rbp + 0x47b8], rdi
mov rax, qword [rbp + 0x47b8]
movdqa xmm0, xmmword [rsp + 0x30]
mov qword [rsp + 0x68], rax
mov rax, 0xffffffffffffffff
pxor xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x30], xmm0
inc rax
cmp byte [rcx + rax], r15b
jne 0x140032452
cmp qword [rsp + 0x58], 0x10
lea rcx, [rsp + 0x40]
mov rdx, qword [rsp + 0x50]
lea r9, [rsp + 0x30]
cmovae rcx, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
call fcn.1400081c0
lea rcx, [rsp + 0x40]
cmp rax, 0xffffffffffffffff
jne 0x1400324d1
call fcn.140007de0
inc rsi
cmp rsi, r14
jl 0x1400322b0
xor al, al
mov r15, qword [rsp + 0x4870]
mov r14, qword [rsp + 0x4878]
mov r13, qword [rsp + 0x4880]
mov r12, qword [rsp + 0x4888]
mov rsi, qword [rsp + 0x48c0]
add rsp, 0x4890
pop rdi
pop rbx
pop rbp
ret
call fcn.140007de0
mov al, 1
jmp 0x14003249e