Function at 0x1401c8630
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov rax, qword [0x140398130]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
mov r13, r9
mov qword [rsp + 0x68], r8
mov r14, rdx
xor r12d, r12d
mov dword [rsp + 0x60], r12d
lea rcx, [r9 + 0xa8]
lea r15, [rdx + 0x10]
mov qword [rsp + 0x58], r15
cmp rcx, rdx
je 0x1401c869c
cmp qword [rdx + 0x18], 8
jb 0x1401c8692
mov rdx, qword [rdx]
mov r8, qword [r15]
call fcn.1400858d0
jmp 0x1401c86a1
mov qword [rsp + 0x58], r15
cmp byte [r13 + 0xca], r12b
je 0x1401c877f
lea rdx, [r13 + 0x68]
lea rax, [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x1401c86c8
mov r8, qword [rdx]
mov rdx, r8
add r8, qword [rax]
jmp 0x1401c86ce
mov r8, qword [rax]
add r8, rdx
lea rcx, [rsp + 0x70]
call fcn.140064e80
nop
cmp qword [r14 + 0x18], 8
jb 0x1401c86e3
mov r14, qword [r14]
mov r9, qword [r15]
mov r8, r14
xor edx, edx
mov rcx, rax
call fcn.1400d3ca0
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], r12
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x48], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea r8, [rsp + 0x38]
lea rdx, [rbp - 0x70]
call fcn.1401c7800
lea rdx, [r13 + 8]
mov rcx, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x1401c8746
mov rdx, qword [rdx]
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0x10
jb 0x1401c8754
mov rax, qword [rax]
cmp r8, rcx
jne 0x1401c8769
mov rcx, rax
call fcn.140316790
test eax, eax
jne 0x1401c8769
xor bl, bl
jmp 0x1401c876b
mov bl, 1
lea rcx, [rbp - 0x70]
call fcn.140087070
nop
lea rcx, [rsp + 0x70]
jmp 0x1401c8f26
cmp byte [r13 + 0xc9], r12b
je 0x1401c8a39
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x50]
call fcn.1403163f0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov r14d, dword [rcx + rbx + 0x88]
add r14, rbx
cmp r14, rbx
je 0x1401c8838
mov r11d, dword [r14 + 0x18]
test r11d, r11d
je 0x1401c8838
mov esi, dword [r14 + 0x20]
nop word [rax + rax]
dec r11d
lea rcx, [rsi + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0x8d56c5fa
movzx ecx, byte [r9]
inc r9
test cl, cl
je 0x1401c8833
nop
movsx edx, cl
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
movzx ecx, byte [r9]
lea r9, [r9 + 1]
test cl, cl
jne 0x1401c8800
cmp r10d, 0x7ae134f8
je 0x1401c8840
test r11d, r11d
jne 0x1401c87e0
mov rax, qword [rax]
jmp 0x1401c87b0
mov ecx, dword [r14 + 0x1c]
add rcx, rbx
mov eax, dword [r14 + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov r9d, dword [rcx + rax*4]
add r9, rbx
mov r8d, 0x104
lea rdx, [rbp - 0x50]
xor ecx, ecx
call r9
cmp eax, 0x104
je 0x1401c8a32
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x60], xmm1
lea rax, [rbp - 0x50]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp word [rax + r8*2], r12w
jne 0x1401c8891
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x70]
call fcn.1400855f0
nop
mov rcx, qword [r15]
mov rax, qword [rbp - 0x60]
cmp rcx, rax
jae 0x1401c89ab
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
ja 0x1401c8f5e
sub rax, rcx
mov r8, rdi
cmp rax, rdi
cmovb r8, rax
lea rax, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae rax, qword [rbp - 0x70]
lea rdx, [rax + rcx*2]
lea rcx, [rsp + 0x38]
call fcn.1400855f0
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x1401c8939
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401c8934
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401c8f58
call fcn.1403139e0
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rbp - 0x70], xmm0
movups xmm1, xmmword [rsp + 0x48]
movups xmmword [rbp - 0x60], xmm1
movdqa xmm0, xmmword [0x140377120]
movdqu xmmword [rsp + 0x48], xmm0
mov word [rsp + 0x38], r12w
lea rcx, [rsp + 0x38]
call fcn.140085e10
lea rdx, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae rdx, qword [rbp - 0x70]
mov rax, qword [rbp - 0x60]
lea r8, [rdx + rax*2]
lea rdx, [rbp - 0x70]
cmovae rdx, qword [rbp - 0x70]
lea rcx, [rsp + 0x70]
call fcn.140065090
lea rcx, [r13 + 0x88]
mov rdx, rax
call fcn.140086fe0
lea rcx, [rsp + 0x70]
call fcn.140087070
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], r12
lea rax, [rbp - 0x50]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x1401c89c1
mov r8, rdi
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x38]
call fcn.1400855f0
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x70]
call fcn.1401c7800
lea rdx, [r13 + 8]
mov rcx, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x1401c89fd
mov rdx, qword [rdx]
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0x10
jb 0x1401c8a0b
mov rax, qword [rax]
cmp r8, rcx
jne 0x1401c8a20
mov rcx, rax
call fcn.140316790
test eax, eax
jne 0x1401c8a20
xor bl, bl
jmp 0x1401c8a22
mov bl, 1
lea rcx, [rsp + 0x70]
call fcn.140087070
nop
jmp 0x1401c8f22
xor al, al
jmp 0x1401c8f2e
mov byte [rsp + 0x30], r12b
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x30]
call fcn.1400a1560
mov r10, rax
mov byte [rax + 0x160], r12b
mov ebx, r12d
lea r8, [rax + 0x108]
lea esi, [rbx + rbx*2]
movzx edx, byte [rsi + r10]
mov byte [r8], dl
movzx eax, bl
add al, al
lea edi, [rax + rbx]
movzx r11d, dil
add r11b, byte [r10 + 0x163]
xor r11b, dl
mov byte [r8], r11b
xor dl, dl
lea eax, [rsi + 1]
movzx r9d, byte [rax + r10]
nop
movzx eax, r9b
movzx ecx, dl
sar al, cl
test al, 1
jne 0x1401c8aa6
inc dl
cmp dl, 4
jne 0x1401c8a90
jmp 0x1401c8ab8
movsx ecx, r11b
movzx eax, byte [r10 + 0x166]
btc ecx, eax
mov byte [r8], cl
mov dl, 5
lea eax, [rsi + 2]
mov r11d, eax
movzx r9d, byte [rax + r10]
nop word [rax + rax]
movzx eax, r9b
movzx ecx, dl
sar al, cl
test al, 1
jne 0x1401c8ae6
inc dl
cmp dl, 8
jne 0x1401c8ad0
jmp 0x1401c8af8
movsx ecx, byte [r8]
movzx eax, byte [r10 + 0x165]
btc ecx, eax
mov byte [r8], cl
xor cl, cl
movzx edx, byte [r11 + r10]
nop
movzx eax, dl
sar al, cl
test al, 1
jne 0x1401c8b12
inc cl
cmp cl, 5
jne 0x1401c8b00
jmp 0x1401c8b24
movsx ecx, byte [r8]
movzx eax, byte [r10 + 0x164]
btc ecx, eax
mov byte [r8], cl
add dil, byte [r10 + 0x162]
xor byte [r8], dil
inc ebx
inc r8
cmp ebx, 0x58
jne 0x1401c8a60
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x60], xmm1
mov rdi, 0xffffffffffffffff
mov r8, rdi
nop word [rax + rax]
inc r8
cmp byte [r10 + r8 + 0x108], r12b
jne 0x1401c8b60
lea rdx, [r10 + 0x108]
lea rcx, [rbp - 0x70]
call fcn.140086c40
nop
mov rbx, qword [0x14039d200]
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
xor r8d, r8d
lea rdx, [0x140375240]
lea rcx, [rsp + 0x38]
call fcn.140086c40
mov dword [rsp + 0x60], 2
lea r9, [rsp + 0x38]
lea r8, [rbp - 0x70]
mov rdx, qword [rsp + 0x68]
mov rcx, rbx
call fcn.1400818c0
lea r15, [r13 + 0x88]
lea rdx, [rsp + 0x38]
mov rcx, r15
call fcn.140086fe0
nop
lea rcx, [rsp + 0x38]
call fcn.140087070
nop
lea rcx, [rbp - 0x70]
call fcn.140087070
cmp qword [r13 + 0x98], 0
jne 0x1401c8e56
lea rcx, [rsp + 0x70]
call fcn.14010b160
mov rbx, rax
mov rax, qword [rax + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rax, rdx
jae 0x1401c8c35
lea rcx, [rax + 1]
mov qword [rbx + 0x10], rcx
mov rcx, rbx
cmp rdx, 0x10
jb 0x1401c8c2d
mov rcx, qword [rbx]
mov word [rcx + rax], reloc.WLDAP32.dll_Ordinal_46
jmp 0x1401c8c47
mov r9b, reloc.WLDAP32.dll_Ordinal_46
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rbx
call fcn.140084c50
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x38], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x48], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
lea rdx, [r13 + 0x48]
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x1401c8c8a
mov rdx, qword [rdx]
lea rcx, [rsp + 0x38]
call fcn.140086080
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x60], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rdx, [rbp - 0x70]
mov rcx, r15
call fcn.140086fe0
lea rcx, [rbp - 0x70]
call fcn.140087070
nop
lea rcx, [rsp + 0x38]
call fcn.140087070
nop
lea rcx, [rsp + 0x70]
call fcn.140087070
mov byte [rsp + 0x30], 0
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x30]
call fcn.140059550
mov r10, rax
mov byte [rax + 0x160], 0
lea r8, [rax + 0x108]
nop dword [rax]
nop word [rax + rax]
lea esi, [r12 + r12*2]
movzx edx, byte [rsi + r10]
mov byte [r8], dl
movzx eax, r12b
add al, al
lea ebx, [rax + r12]
movzx r11d, bl
add r11b, byte [r10 + 0x163]
xor r11b, dl
mov byte [r8], r11b
xor dl, dl
lea eax, [rsi + 1]
movzx r9d, byte [rax + r10]
movzx eax, r9b
movzx ecx, dl
sar al, cl
test al, 1
jne 0x1401c8d57
inc dl
cmp dl, 4
jne 0x1401c8d41
jmp 0x1401c8d69
movsx ecx, r11b
movzx eax, byte [r10 + 0x166]
btc ecx, eax
mov byte [r8], cl
mov dl, 5
lea eax, [rsi + 2]
mov r11d, eax
movzx r9d, byte [rax + r10]
nop word [rax + rax]
movzx eax, r9b
movzx ecx, dl
sar al, cl
test al, 1
jne 0x1401c8d96
inc dl
cmp dl, 8
jne 0x1401c8d80
jmp 0x1401c8da8
movsx ecx, byte [r8]
movzx eax, byte [r10 + 0x165]
btc ecx, eax
mov byte [r8], cl
xor cl, cl
movzx edx, byte [r11 + r10]
nop
movzx eax, dl
sar al, cl
test al, 1
jne 0x1401c8dc2
inc cl
cmp cl, 5
jne 0x1401c8db0
jmp 0x1401c8dd4
movsx ecx, byte [r8]
movzx eax, byte [r10 + 0x164]
btc ecx, eax
mov byte [r8], cl
add bl, byte [r10 + 0x162]
xor byte [r8], bl
inc r12d
inc r8
cmp r12d, 0x58
jne 0x1401c8d10
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
nop
inc rdi
cmp byte [r10 + rdi + 0x108], 0
jne 0x1401c8e00
mov r8, rdi
lea rdx, [r10 + 0x108]
lea rcx, [rsp + 0x38]
call fcn.140086c40
nop
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9b, 1
mov r8, r15
mov rdx, qword [rsp + 0x68]
mov rcx, qword [0x14039d200]
call fcn.14007e540
nop
lea rcx, [rsp + 0x38]
call fcn.140087070
mov al, 1
jmp 0x1401c8f2e
lea rax, [r15 + 0x10]
cmp qword [r15 + 0x18], 0x10
jb 0x1401c8e6c
mov r8, qword [r15]
mov r15, r8
add r8, qword [rax]
jmp 0x1401c8e72
mov r8, qword [rax]
add r8, r15
mov rdx, r15
lea rcx, [rbp - 0x70]
call fcn.140064e80
nop
cmp qword [r14 + 0x18], 8
jb 0x1401c8e89
mov r14, qword [r14]
mov r9, qword [rsp + 0x58]
mov r9, qword [r9]
mov r8, r14
xor edx, edx
mov rcx, rax
call fcn.1400d3ca0
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], r12
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x48], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x70]
call fcn.1401c7800
lea rdx, [r13 + 8]
mov rcx, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x1401c8ef2
mov rdx, qword [rdx]
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0x10
jb 0x1401c8f00
mov rax, qword [rax]
cmp r8, rcx
jne 0x1401c8f15
mov rcx, rax
call fcn.140316790
test eax, eax
jne 0x1401c8f15
xor bl, bl
jmp 0x1401c8f17
mov bl, 1
lea rcx, [rsp + 0x70]
call fcn.140087070
nop
lea rcx, [rbp - 0x70]
call fcn.140085e10
movzx eax, bl
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.1403139c0
mov rbx, qword [rsp + 0x310]
add rsp, 0x2d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14031a62c
nop
call fcn.1400769b0
int3