Function at 0x14002b640
Capabilities:
Access peb ldr_data
Encode data using xor
Get kernel32 base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
mov rax, qword [0x1400c9438]
xor rax, rsp
mov qword [rbp + 0xb0], rax
mov r13, rcx
mov rax, qword [rcx]
cmp byte [rax + 0xc], 0
jne 0x14002b693
call fcn.140015630
mov byte [r13 + 0x20], 0
jmp 0x14002bdec
mov r12, qword [rcx + 0x10]
sub r12, qword [rcx + 8]
sar r12, 3
test r12, r12
jne 0x14002b7d6
movabs rax, 0x3cd9550c47ad983b
mov qword [rbp + 0x30], rax
movabs rax, 0x58d0558d5f4a8ca4
mov qword [rbp + 0x38], rax
movabs rax, 0x4e9fb0cec7abfe85
mov qword [rbp + 0x40], rax
movabs rax, 0x4d7edfd743ab33fe
mov qword [rbp + 0x48], rax
movabs rax, 0x834d2ef0713e8acf
mov qword [rbp + 0x50], rax
movabs rax, 0x7036dac1cc653ab8
mov qword [rbp + 0x58], rax
movabs rax, 0x7bb13732cec5e779
mov qword [rbp + 0x60], rax
movabs rax, 0xc01ba67bef0f50c2
mov qword [rbp + 0x68], rax
movabs rax, 0x53a975e567c27b75
mov qword [rsp + 0x40], rax
movabs rax, 0x31f039e829a7ffd7
mov qword [rsp + 0x48], rax
movabs rax, 0x3ebfc2afb3ce94eb
mov qword [rsp + 0x50], rax
movabs rax, 0x6d113cb963d85a91
mov qword [rsp + 0x58], rax
movabs rax, 0xf62540951f1e6ba7
mov qword [rsp + 0x60], rax
movabs rax, 0x255bfafa5081ad5
mov qword [rsp + 0x68], rax
movabs rax, 0x9d45553eeb18118
mov qword [rsp + 0x70], rax
movabs rax, 0xc01ba67bef2e3fb6
mov qword [rsp + 0x78], rax
movups xmm0, xmmword [rsp + 0x40]
movups xmm1, xmmword [rsp + 0x50]
movups xmm2, xmmword [rsp + 0x60]
movups xmm3, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rbp + 0x30]
movdqa xmmword [rbp - 0x80], xmm0
xorps xmm1, xmmword [rbp + 0x40]
movdqa xmmword [rbp - 0x70], xmm1
xorps xmm2, xmmword [rbp + 0x50]
movdqa xmmword [rbp - 0x60], xmm2
xorps xmm3, xmmword [rbp + 0x60]
movdqa xmmword [rbp - 0x50], xmm3
lea rcx, [rbp - 0x80]
call fcn.140015b10
jmp 0x14002bdec
xor eax, eax
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x18], xmm1
mov qword [rbp - 8], rax
movabs rax, 0x1fffffffffffffff
cmp r12, rax
ja 0x14002be22
lea rbx, [r12*8]
cmp rbx, 0x1000
jb 0x14002b831
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x14002be1c
call fcn.1400790f0
test rax, rax
je 0x14002bde0
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14002b845
test rbx, rbx
je 0x14002b843
mov rcx, rbx
call fcn.1400790f0
mov rdi, rax
jmp 0x14002b845
xor edi, edi
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x10], rdi
lea rax, [rdi + rbx]
mov qword [rbp - 8], rax
mov rbx, qword [r13 + 0x10]
mov rdx, qword [r13 + 8]
sub rbx, rdx
mov r8, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
sar rbx, 3
lea rax, [rdi + rbx*8]
mov qword [rbp - 0x10], rax
call fcn.140025340
movabs rax, 0x3cd9550c47ad983b
mov qword [rbp + 0x20], rax
movabs rax, 0x58d0558d5f4a8ca4
mov qword [rbp + 0x28], rax
movabs rax, 0x5bb634622ed8e95a
mov qword [rsp + 0x30], rax
movabs rax, 0x58d0558d3824e5d6
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rsp + 0x30], xmm0
lea rcx, [rbp - 0x40]
call fcn.140019c90
nop
lea r8, [rsp + 0x30]
mov rdx, rax
lea rcx, [rbp + 0x30]
call fcn.1400118e0
mov rdx, rax
lea rcx, [rbp]
call fcn.140067820
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x14002b92b
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002b926
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002b926
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140079384
movdqa xmm0, xmmword [0x1400bcc90]
movdqu xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x40], 0
mov dword [rsp + 0x20], 0
test r12, r12
je 0x14002bce5
xor edx, edx
mov qword [rbp + 0x20], rdx
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rbp - 0x18]
add rax, rdx
mov qword [rsp + 0x30], rax
xor r11d, r11d
mov r14d, 0xf50944d9
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov ecx, dword [rax + 0x58]
sub cx, 8
test r11d, r11d
je 0x14002b9df
mov rdx, qword [rax + 0x60]
movzx ecx, cx
shr rcx, 1
lea r9, [rdx + rcx*2]
mov r8d, 0x811c9dc5
cmp rdx, r9
je 0x14002b9d6
nop word [rax + rax]
movsx ecx, byte [rdx]
xor ecx, r8d
imul r8d, ecx, 0x1000193
add rdx, 2
cmp rdx, r9
jne 0x14002b9c0
cmp r8d, r11d
jne 0x14002bb25
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov rdx, qword [rcx + r10 + 0x88]
mov r15, rdx
shr r15, 0x20
mov edi, edx
add rdi, r10
cmp rdi, r10
je 0x14002bb25
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14002bb25
mov esi, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rsi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
mov r8d, 0x811c9dc5
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14002ba58
nop
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x14002ba40
cmp r8d, r14d
je 0x14002ba6a
test r9d, r9d
jne 0x14002ba20
mov rax, qword [rax]
jmp 0x14002b990
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov r8d, dword [rcx + rax*4]
add r8, r10
cmp r8, rdi
jbe 0x14002bb2d
lea rax, [r15 + rdi]
cmp r8, rax
jae 0x14002bb2d
mov r11d, 0x811c9dc5
mov dword [rsp + 0x28], r11d
mov ecx, r11d
mov dword [rsp + 0x2c], ecx
movzx eax, byte [r8]
cmp al, 0x2e
je 0x14002badd
nop dword [rax]
nop word [rax + rax]
movsx eax, al
xor eax, r11d
imul r11d, eax, 0x1000193
inc r8
movzx eax, byte [r8]
cmp al, 0x2e
jne 0x14002bac0
mov dword [rsp + 0x28], r11d
inc r8
movzx eax, byte [r8]
test al, al
je 0x14002bb0b
nop dword [rax + rax]
movsx eax, al
xor eax, ecx
imul ecx, eax, 0x1000193
lea r8, [r8 + 1]
movzx eax, byte [r8]
test al, al
jne 0x14002baf0
mov dword [rsp + 0x2c], ecx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r14, qword [rsp + 0x28]
shr r14, 0x20
mov rax, qword [rax]
jmp 0x14002b990
lea rdx, [rbp - 0x20]
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx]
call r8
mov r8d, dword [rbp - 0x20]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
lea rdx, [rbp]
lea rcx, [rsp + 0x40]
call fcn.140022010
mov r9, rax
mov r8d, 0x37ba00
lea rdx, [0x1400ca320]
mov rcx, rbx
call fcn.14003b560
test al, al
je 0x14002bb88
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14002bcc3
movabs rax, 0x3cd9550c47ad983b
mov qword [rbp + 0x70], rax
movabs rax, 0x58d0558d5f4a8ca4
mov qword [rbp + 0x78], rax
movabs rax, 0x4e9fb0cec7abfe85
mov qword [rbp + 0x80], rax
movabs rax, 0x4d7edfd743ab33fe
mov qword [rbp + 0x88], rax
movabs rax, 0x834d2ef0713e8acf
mov qword [rbp + 0x90], rax
movabs rax, 0x7036dac1cc653ab8
mov qword [rbp + 0x98], rax
movabs rbx, 0x7bb13732cec5e779
mov qword [rbp + 0xa0], rbx
movabs rdi, 0xc01ba67bef0f50c2
mov qword [rbp + 0xa8], rdi
movabs rax, 0x1cac307e35c2fb74
mov qword [rsp + 0x40], rax
movabs rax, 0x78bf27ff3a6ae1d1
mov qword [rsp + 0x48], rax
movabs rax, 0x3afadaa0ae8b91e4
mov qword [rsp + 0x50], rax
movabs rax, 0x200bffba268b419f
mov qword [rsp + 0x58], rax
movabs rax, 0xed240e83105aaaae
mov qword [rsp + 0x60], rax
movabs rax, 0x5145bba8af0bd8cc
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rdi
movdqu xmm0, xmmword [rsp + 0x40]
movups xmm1, xmmword [rsp + 0x50]
movups xmm2, xmmword [rsp + 0x60]
movups xmm3, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rbp + 0x70]
movdqa xmmword [rbp - 0x80], xmm0
xorps xmm1, xmmword [rbp + 0x80]
movdqa xmmword [rbp - 0x70], xmm1
xorps xmm2, xmmword [rbp + 0x90]
movdqa xmmword [rbp - 0x60], xmm2
xorps xmm3, xmmword [rbp + 0xa0]
movdqa xmmword [rbp - 0x50], xmm3
lea rcx, [rbp - 0x80]
call fcn.140015b10
call fcn.140015630
mov byte [r13 + 0x20], 0
mov ecx, dword [rsp + 0x20]
inc ecx
mov dword [rsp + 0x20], ecx
mov rdx, qword [rbp + 0x20]
add rdx, 8
mov qword [rbp + 0x20], rdx
movsxd rax, ecx
cmp rax, r12
jb 0x14002b960
mov rax, qword [r13]
mov dword [rax + 8], 3
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x14002bd0e
imul rax, rax, 0x64
jmp 0x14002bd29
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
movabs rcx, 0x7ffffffed5fa0dff
cmp rax, rcx
jge 0x14002bd4b
movabs rcx, 0x12a05f200
add rcx, rax
mov qword [rbp + 0x20], rcx
jmp 0x14002bd59
movabs rax, 0x7fffffffffffffff
mov qword [rbp + 0x20], rax
lea rcx, [rbp + 0x20]
call fcn.1400243c0
call fcn.140015630
mov byte [r13 + 0x20], 0
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x10
jb 0x14002bdab
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002bda5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002bda5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140079384
nop
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x14002bdec
mov rdx, qword [rbp - 8]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002bde7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002bde7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140079384
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.1400790d0
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140009df0
int3
call fcn.1400222f0
int3