Function at 0x140022290
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x198]
sub rsp, 0x270
mov rax, qword [0x14006e030]
xor rax, rsp
mov qword [rbp + 0x160], rax
and dword [rsp + 0x40], 0
movabs rax, 0xd26dffbe64630b4e
mov qword [rsp + 0x70], rax
movabs rax, 0xc1aabb2f7d92483e
mov qword [rsp + 0x78], rax
movabs rax, 0xbb1d9ece080b7b27
mov qword [rsp + 0x30], rax
movabs rax, 0xc1aabb2f11fe2c10
mov qword [rsp + 0x38], rax
movdqa xmm0, xmmword [rsp + 0x70]
pxor xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x70], xmm0
lea rcx, [rsp + 0x70]
call fcn.140027798
mov ebx, 0x100
mov r8d, ebx
xor edx, edx
lea rcx, [rbp + 0x60]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x20], ebx
mov rbx, qword [0x14006f6b8]
test rbx, rbx
jne 0x140022566
xor r13d, r13d
xor r14d, r14d
mov dword [rsp + 0x24], 0xc657221
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
movups xmm0, xmmword [rax + 0x58]
movups xmmword [rsp + 0x30], xmm0
movd ecx, xmm0
sub cx, 8
test r14d, r14d
je 0x1400223d0
cmp r13, qword [rax + 0x30]
je 0x1400223d0
mov r9, qword [rsp + 0x38]
movzx ecx, cx
shr rcx, 1
lea r11, [r9 + rcx*2]
mov r10d, 0x195b5e07
jmp 0x1400223c2
movsx ecx, byte [r9]
mov edx, ecx
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
add r9, 2
cmp r9, r11
jne 0x14002239d
cmp r10d, r14d
jne 0x140022557
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov rcx, qword [rcx + r10 + 0x88]
mov r9d, ecx
add r9, r10
shr rcx, 0x20
cmp r9, r10
je 0x140022557
mov ebx, dword [r9 + 0x18]
test ebx, ebx
je 0x140022557
mov r12d, dword [r9 + 0x20]
dec ebx
lea rdx, [r12 + rbx*4]
mov r11d, dword [rdx + r10]
add r11, r10
mov esi, 0x195b5e07
jmp 0x140022438
movsx edx, dil
sub dil, 0x41
mov r8d, edx
or r8d, 0x20
cmp dil, 0x19
cmova r8d, edx
xor r8d, esi
imul esi, r8d, 0x1000193
mov dil, byte [r11]
inc r11
test dil, dil
jne 0x140022417
cmp esi, dword [rsp + 0x24]
je 0x140022452
test ebx, ebx
jne 0x140022403
jmp 0x140022557
mov edx, dword [r9 + 0x1c]
add rdx, r10
mov eax, dword [r9 + 0x24]
add rax, r10
movzx eax, word [rax + rbx*2]
mov ebx, dword [rdx + rax*4]
add rbx, r10
cmp rbx, r9
jbe 0x14002255f
lea rax, [rcx + r9]
cmp rbx, rax
jae 0x14002255f
and qword [rsp + 0x50], 0
mov edi, 0x195b5e07
mov dword [rsp + 0x58], edi
mov esi, edi
mov dword [rsp + 0x5c], edi
xor edx, edx
lea r8d, [rdx + 0x40]
lea rcx, [rbp - 0x60]
call sub.msvcrt.dll_memset
mov al, byte [rbx]
cmp al, 0x2e
je 0x1400224cc
lea rcx, [rbp - 0x60]
sub rcx, rbx
mov byte [rbx + rcx], al
movsx eax, al
xor eax, edi
imul edi, eax, 0x1000193
inc rbx
mov al, byte [rbx]
cmp al, 0x2e
jne 0x1400224b1
mov dword [rsp + 0x58], edi
mov eax, dword [rbp - 0x60]
cmp eax, 0x2d697061
je 0x1400224eb
cmp eax, 0x2d495041
je 0x1400224eb
cmp eax, 0x2d747865
je 0x1400224eb
cmp eax, 0x2d545845
jne 0x1400224fa
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x50], rax
inc rbx
mov dl, byte [rbx]
test dl, dl
je 0x140022529
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, esi
imul esi, ecx, 0x1000193
inc rbx
mov dl, byte [rbx]
test dl, dl
jne 0x140022503
mov dword [rsp + 0x5c], esi
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x30], xmm0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov ecx, dword [rsp + 0x3c]
mov dword [rsp + 0x24], ecx
mov r14d, dword [rsp + 0x38]
mov r13, qword [rsp + 0x30]
mov rax, qword [rax]
jmp 0x14002236a
mov qword [0x14006f6b8], rbx
lea r8, [rsp + 0x20]
lea rdx, [rbp + 0x60]
mov ecx, 1
call rbx
test eax, eax
je 0x140022596
lea rcx, [rbp + 0x60]
call qword [sym.imp.msvcrt.dll_strlen]
mov r8, rax
lea rdx, [rbp + 0x60]
xor ecx, ecx
call fcn.140022268
mov dword [rsp + 0x40], eax
and dword [rsp + 0x24], 0
mov rbx, qword [0x14006f6c8]
test rbx, rbx
jne 0x1400227c4
xor r13d, r13d
xor r14d, r14d
mov dword [rsp + 0x20], 0x95a9a8a7
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
movups xmm0, xmmword [rcx + 0x58]
movups xmmword [rsp + 0x30], xmm0
movd eax, xmm0
sub ax, 8
test r14d, r14d
je 0x14002262e
cmp r13, qword [rcx + 0x30]
je 0x14002262e
mov r9, qword [rsp + 0x38]
movzx eax, ax
shr rax, 1
lea r11, [r9 + rax*2]
mov r10d, 0x4b0a1fe9
jmp 0x140022620
movsx eax, byte [r9]
mov edx, eax
sub al, 0x41
mov r8d, edx
or r8d, 0x20
cmp al, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
add r9, 2
cmp r9, r11
jne 0x1400225fd
cmp r10d, r14d
jne 0x1400227b5
mov r10, qword [rcx + 0x30]
movsxd rax, dword [r10 + 0x3c]
mov rax, qword [rax + r10 + 0x88]
mov r9d, eax
add r9, r10
shr rax, 0x20
cmp r9, r10
je 0x1400227b5
mov ebx, dword [r9 + 0x18]
test ebx, ebx
je 0x1400227b5
mov r12d, dword [r9 + 0x20]
dec ebx
lea rdx, [r12 + rbx*4]
mov r11d, dword [rdx + r10]
add r11, r10
mov esi, 0x4b0a1fe9
jmp 0x140022696
movsx edx, dil
sub dil, 0x41
mov r8d, edx
or r8d, 0x20
cmp dil, 0x19
cmova r8d, edx
xor r8d, esi
imul esi, r8d, 0x1000193
mov dil, byte [r11]
inc r11
test dil, dil
jne 0x140022675
cmp esi, dword [rsp + 0x20]
je 0x1400226b0
test ebx, ebx
jne 0x140022661
jmp 0x1400227b5
mov edx, dword [r9 + 0x1c]
add rdx, r10
mov ecx, dword [r9 + 0x24]
add rcx, r10
movzx ecx, word [rcx + rbx*2]
mov ebx, dword [rdx + rcx*4]
add rbx, r10
cmp rbx, r9
jbe 0x1400227bd
lea rcx, [rax + r9]
cmp rbx, rcx
jae 0x1400227bd
and qword [rsp + 0x60], 0
mov edi, 0x4b0a1fe9
mov dword [rsp + 0x68], edi
mov esi, edi
mov dword [rsp + 0x6c], edi
xor edx, edx
lea r8d, [rdx + 0x40]
lea rcx, [rbp - 0x20]
call sub.msvcrt.dll_memset
mov al, byte [rbx]
cmp al, 0x2e
je 0x14002272a
lea rcx, [rbp - 0x20]
sub rcx, rbx
mov byte [rbx + rcx], al
movsx eax, al
xor eax, edi
imul edi, eax, 0x1000193
inc rbx
mov al, byte [rbx]
cmp al, 0x2e
jne 0x14002270f
mov dword [rsp + 0x68], edi
mov eax, dword [rbp - 0x20]
cmp eax, 0x2d697061
je 0x140022749
cmp eax, 0x2d495041
je 0x140022749
cmp eax, 0x2d747865
je 0x140022749
cmp eax, 0x2d545845
jne 0x140022758
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x60], rax
inc rbx
mov dl, byte [rbx]
test dl, dl
je 0x140022787
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, esi
imul esi, ecx, 0x1000193
inc rbx
mov dl, byte [rbx]
test dl, dl
jne 0x140022761
mov dword [rsp + 0x6c], esi
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x30], xmm0
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rcx, qword [rcx + 0x10]
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x20], eax
mov r14d, dword [rsp + 0x38]
mov r13, qword [rsp + 0x30]
mov rcx, qword [rcx]
jmp 0x1400225ca
mov qword [0x14006f6c8], rbx
lea rdx, [rsp + 0x24]
xor ecx, ecx
call rbx
mov eax, dword [rsp + 0x24]
test eax, eax
je 0x1400228bf
and qword [rbp - 0x80], 0
and qword [rbp - 0x70], 0
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], 0
mov edi, eax
mov r14d, 0x1000
test eax, eax
jne 0x140022805
mov qword [rbp - 0x70], rax
mov byte [rbp + rax - 0x80], al
jmp 0x140022823
cmp rdi, 0xf
ja 0x140022829
mov qword [rbp - 0x70], rdi
mov r8, rdi
xor edx, edx
lea rcx, [rbp - 0x80]
call qword [sym.imp.msvcrt.dll_memset]
mov byte [rbp + rdi - 0x80], 0
mov rbx, qword [rbp - 0x80]
jmp 0x140022882
mov rsi, rdi
or rsi, 0xf
mov eax, 0x16
cmp rsi, rax
cmovb rsi, rax
lea rcx, [rsi + 1]
cmp rcx, r14
jb 0x14002284c
call fcn.140007b5c
jmp 0x140022851
call fcn.140051e08
mov rbx, rax
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], rsi
xor r8d, r8d
lea rdx, [rbp - 0x80]
mov rcx, rax
call qword [sym.imp.msvcrt.dll_memcpy]
mov r8, rdi
xor edx, edx
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_memset]
mov byte [rbx + rdi], 0
mov qword [rbp - 0x80], rbx
cmp qword [rbp - 0x70], 0
jne 0x1400228f3
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x1400228bf
inc rdx
mov rax, rbx
cmp rdx, r14
jb 0x1400228b7
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140022b71
mov rcx, rbx
call fcn.14005209c
mov eax, dword [rsp + 0x40]
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.140051b80
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rdi, qword [0x14006f6c0]
test rdi, rdi
jne 0x140022b22
xor r13d, r13d
xor r15d, r15d
mov dword [rsp + 0x20], 0x166a3356
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
movups xmm0, xmmword [rax + 0x58]
movups xmmword [rsp + 0x30], xmm0
movd ecx, xmm0
sub cx, 8
test r15d, r15d
je 0x140022988
cmp r13, qword [rax + 0x30]
je 0x140022988
mov r9, qword [rsp + 0x38]
movzx ecx, cx
shr rcx, 1
lea r11, [r9 + rcx*2]
mov r10d, 0x5b6b4c16
jmp 0x14002297a
movsx ecx, byte [r9]
mov edx, ecx
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
add r9, 2
cmp r9, r11
jne 0x140022955
cmp r10d, r15d
jne 0x140022b0f
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov rcx, qword [rcx + r10 + 0x88]
mov r9d, ecx
add r9, r10
shr rcx, 0x20
cmp r9, r10
je 0x140022b0f
mov ebx, dword [r9 + 0x18]
test ebx, ebx
je 0x140022b0f
mov r12d, dword [r9 + 0x20]
dec ebx
lea rdx, [r10 + rbx*4]
mov r11d, dword [rdx + r12]
add r11, r10
mov esi, 0x5b6b4c16
jmp 0x1400229f0
movsx edx, dil
sub dil, 0x41
mov r8d, edx
or r8d, 0x20
cmp dil, 0x19
cmova r8d, edx
xor r8d, esi
imul esi, r8d, 0x1000193
mov dil, byte [r11]
inc r11
test dil, dil
jne 0x1400229cf
cmp esi, dword [rsp + 0x20]
je 0x140022a0a
test ebx, ebx
jne 0x1400229bb
jmp 0x140022b0f
mov edx, dword [r9 + 0x1c]
add rdx, r10
mov eax, dword [r9 + 0x24]
add rax, r10
movzx eax, word [rax + rbx*2]
mov edi, dword [rdx + rax*4]
add rdi, r10
cmp rdi, r9
jbe 0x140022b17
lea rax, [rcx + r9]
cmp rdi, rax
jae 0x140022b17
and qword [rsp + 0x70], 0
mov ebx, 0x5b6b4c16
mov dword [rsp + 0x78], ebx
mov esi, ebx
mov dword [rsp + 0x7c], ebx
xor edx, edx
lea r8d, [rdx + 0x40]
lea rcx, [rbp + 0x20]
call sub.msvcrt.dll_memset
mov al, byte [rdi]
cmp al, 0x2e
je 0x140022a84
lea rcx, [rbp + 0x20]
sub rcx, rdi
mov byte [rdi + rcx], al
movsx eax, al
xor eax, ebx
imul ebx, eax, 0x1000193
inc rdi
mov al, byte [rdi]
cmp al, 0x2e
jne 0x140022a69
mov dword [rsp + 0x78], ebx
mov eax, dword [rbp + 0x20]
cmp eax, 0x2d697061
je 0x140022aa3
cmp eax, 0x2d495041
je 0x140022aa3
cmp eax, 0x2d747865
je 0x140022aa3
cmp eax, 0x2d545845
jne 0x140022ab2
lea rcx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x70], rax
inc rdi
mov dl, byte [rdi]
test dl, dl
je 0x140022ae1
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, esi
imul esi, ecx, 0x1000193
inc rdi
mov dl, byte [rdi]
test dl, dl
jne 0x140022abb
mov dword [rsp + 0x7c], esi
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x30], xmm0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov ecx, dword [rsp + 0x3c]
mov dword [rsp + 0x20], ecx
mov r15d, dword [rsp + 0x38]
mov r13, qword [rsp + 0x30]
mov rax, qword [rax]
jmp 0x140022922
mov qword [0x14006f6c0], rdi
mov rbx, qword [rbp - 0x80]
lea rcx, [rbp - 0x80]
cmp qword [rbp - 0x68], 0x10
cmovae rcx, rbx
lea rdx, [rsp + 0x24]
call rdi
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x1400228bf
inc rdx
mov rcx, qword [rbp - 0x80]
cmp rdx, r14
mov rax, rcx
jb 0x1400228ba
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400228ba
call fcn.140055e50
int3