Function at 0x1401e9310
Capabilities:
Access peb ldr_data
Encode data using xor
Get kernel32 base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
push rbp
push rbx
push rdi
push r15
lea rbp, [rax - 0x6c8]
sub rsp, 0x7a8
mov qword [rax + 0x20], r12
xorps xmm0, xmm0
mov qword [rax - 0x28], r14
xor r12d, r12d
mov qword [rsp + 0x30], r12
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rbp + 0x6d0], 0x10000
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1401e93d7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1401e93d7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x3d69094e
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1401e93d2
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x1401e93b0
cmp r8d, 0x8ab16c8d
je 0x1401e93dc
test r9d, r9d
jne 0x1401e9390
mov rax, qword [rax]
jmp 0x1401e9360
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
call rax
mov ecx, dword [rbp + 0x6d0]
mov r14d, eax
nop
mov ebx, ecx
test ecx, ecx
jne 0x1401e940b
mov r15, r12
jmp 0x1401e9438
mov r9d, 4
mov r8d, 0x3000
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.kernel32.dll_VirtualAlloc]
mov r8, rbx
xor edx, edx
mov rcx, rax
mov r15, rax
call fcn.1403ccc50
mov ecx, dword [rbp + 0x6d0]
mov rax, qword [0x1405491e0]
lea r9, [rbp + 0x6d0]
mov r8d, ecx
mov rdx, r15
mov ecx, 0x39
call rax
cmp eax, 0xc0000004
jne 0x1401e9525
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1401e94e7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1401e94e7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x47fc8aff
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1401e94e2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x1401e94c0
cmp r8d, 0x327fa7e0
je 0x1401e94ec
test r9d, r9d
jne 0x1401e94a0
mov rax, qword [rax]
jmp 0x1401e9470
mov edx, dword [rbx + 0x24]
mov rcx, r15
add rdx, r10
movzx r8d, word [rdx + r9*2]
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov eax, dword [rdx + r8*4]
xor edx, edx
add rax, r10
mov r8d, 0x8000
call rax
mov eax, dword [rbp + 0x6d0]
lea ecx, [rax + rax]
mov dword [rbp + 0x6d0], ecx
jmp 0x1401e9400
test eax, eax
jne 0x1401e9710
mov eax, dword [r15]
mov qword [rsp + 0x7e0], rsi
mov rsi, r15
nop dword [rax + rax]
add rsi, rax
mov edi, dword [rsi + 0x50]
cmp edi, 4
jbe 0x1401e96fe
cmp r14d, edi
je 0x1401e96fe
mov rax, qword [0x140549230]
lea rdx, [rbp + 0x6d8]
mov ecx, edi
mov dword [rbp + 0x6d8], r12d
call rax
test eax, eax
je 0x1401e96fe
cmp dword [rbp + 0x6d8], r12d
je 0x1401e96fe
xor edx, edx
lea rcx, [rbp - 0x7c]
mov r8d, 0x254
call fcn.1403ccc50
xor edx, edx
mov dword [rbp - 0x80], edi
mov r8d, 0x200
lea rcx, [rbp - 0x7c]
call fcn.1403ccc50
movzx r8d, word [rsi + 0x38]
lea rcx, [rsp + 0x38]
mov rdx, qword [rsi + 0x40]
shr r8, 1
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], 7
call fcn.14013ee4c
cmp qword [rsp + 0x50], 8
lea rcx, [rsp + 0x38]
lea rdx, [rbp - 0x7c]
cmovae rcx, qword [rsp + 0x38]
sub rdx, rcx
nop dword [rax]
movzx eax, word [rcx]
mov word [rcx + rdx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x1401e95f0
lea rcx, [rsp + 0x38]
call fcn.14013ed68
call fcn.1401418e8
mov r8d, edi
lea rdx, [rsp + 0x58]
call fcn.1401f0b70
mov rbx, rax
lea rax, [rbp + 0x188]
cmp rax, rbx
je 0x1401e9660
lea rcx, [rbp + 0x188]
call fcn.14013ed68
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x188], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x198], xmm1
mov qword [rbx + 0x10], r12
mov word [rbx], r12w
mov qword [rbx + 0x18], 7
nop dword [rax]
lea rcx, [rsp + 0x58]
call fcn.14013ed68
call fcn.1401418e8
lea r9, [rbp + 0x1a8]
mov r8d, edi
lea rdx, [rsp + 0x38]
mov rcx, rax
call fcn.1401f0da0
lea rcx, [rsp + 0x38]
call fcn.14013ed68
call fcn.1401418e8
lea r8, [rbp + 0x1c0]
mov edx, edi
mov rcx, rax
call fcn.1401f1300
mov rax, qword [rsp + 0x28]
cmp rax, qword [rsp + 0x30]
je 0x1401e96c9
lea rdx, [rbp - 0x80]
mov rcx, rax
call fcn.1401ed0b0
add qword [rsp + 0x28], 0x258
jmp 0x1401e96da
lea r8, [rbp - 0x80]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.1401f4d20
lea rcx, [rbp + 0x1c0]
call fcn.1401f4460
lea rcx, [rbp + 0x1a8]
call fcn.140194884
lea rcx, [rbp + 0x188]
call fcn.14013ed68
mov eax, dword [rsi]
test eax, eax
jne 0x1401e9540
mov rsi, qword [rsp + 0x7e0]
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
mov r14, qword [rsp + 0x7a0]
mov r12, qword [rsp + 0x7e8]
cmp rdi, rbx
je 0x1401e97ba
sub rbx, 0x258
cmp rdi, rbx
je 0x1401e97ba
mov rdx, rdi
lea rcx, [rbp + 0x1e0]
call fcn.1401ed0b0
mov rdx, rbx
lea rcx, [rbp + 0x440]
call fcn.1401ed0b0
mov rdx, rax
mov rcx, rdi
call fcn.1401e9010
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0x440]
call fcn.1401ed0b0
mov rdx, rax
mov rcx, rbx
call fcn.1401e9010
lea rcx, [rbp + 0x420]
call fcn.1401f4460
lea rcx, [rbp + 0x408]
call fcn.140194884
lea rcx, [rbp + 0x3e8]
call fcn.14013ed68
add rdi, 0x258
cmp rdi, rbx
jne 0x1401e9733
call fcn.1401418e8
add rax, 0x18
lea rcx, [rsp + 0x20]
cmp rax, rcx
je 0x1401e97df
mov r8, qword [rsp + 0x28]
mov rcx, rax
mov rdx, qword [rsp + 0x20]
call fcn.1401f5ec0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1401e9867
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1401e9867
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xec679a84
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rdi]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1401e9862
nop dword [rax]
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x1401e9840
cmp r8d, 0x900854e5
je 0x1401e986c
test r9d, r9d
jne 0x1401e9820
mov rax, qword [rax]
jmp 0x1401e97f0
mov ecx, dword [rbx + 0x24]
mov r8d, 0x8000
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor edx, edx
add rax, r10
mov rcx, r15
call rax
lea rcx, [rsp + 0x20]
call fcn.1401f4250
add rsp, 0x7a8
pop r15
pop rdi
pop rbx
pop rbp
ret