Function at 0x1400856fc
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x1401af100]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov r14, rdx
mov rbx, rcx
xor r12d, r12d
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov r10d, dword [rcx + r9 + 0x88]
add r10, r9
cmp r10, r9
je 0x1400857ae
mov r8d, dword [r10 + 0x18]
test r8d, r8d
je 0x1400857ae
mov esi, dword [r10 + 0x20]
dec r8d
lea rcx, [rsi + r8*4]
mov edx, dword [rcx + r9]
add rdx, r9
mov r11d, 0x67fa4b60
mov cl, byte [rdx]
inc rdx
test cl, cl
je 0x1400857a9
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
inc rdx
test cl, cl
jne 0x14008578a
cmp r11d, 0x74dc6108
je 0x1400857b3
test r8d, r8d
jne 0x14008576d
mov rax, qword [rax]
jmp 0x140085748
mov ecx, dword [r10 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r9
mov r8d, dword [rcx + rdx*4]
add r8, r9
xor edx, edx
lea ecx, [rdx + 2]
call r8
mov r15, rax
mov qword [rbx], r12
mov qword [rbx + 8], r12
mov qword [rbx + 0x10], r12
cmp rax, 0xffffffffffffffff
je 0x140085ac9
xor edx, edx
mov r8d, 0x234
lea rcx, [rsp + 0x34]
call fcn.1400db080
mov dword [rsp + 0x30], 0x238
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x14008587e
mov r9d, dword [r10 + 0x18]
test r9d, r9d
je 0x14008587e
mov esi, dword [r10 + 0x20]
dec r9d
lea rcx, [rsi + r9*4]
mov edx, dword [rcx + r8]
add rdx, r8
mov r11d, 0xc2184903
mov cl, byte [rdx]
inc rdx
test cl, cl
je 0x140085879
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
inc rdx
test cl, cl
jne 0x14008585a
cmp r11d, 0x3fc1b1ce
je 0x140085883
test r9d, r9d
jne 0x14008583d
mov rax, qword [rax]
jmp 0x140085818
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx edx, word [rcx + r9*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
lea rdx, [rsp + 0x30]
mov rcx, r15
call rax
test eax, eax
je 0x140085a2f
lea rcx, [rsp + 0x5c]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r12w
jne 0x1400858b7
mov rcx, qword [r14 + 0x10]
mov r8, r14
cmp qword [r14 + 0x18], 7
jbe 0x1400858d2
mov r8, qword [r14]
cmp rcx, rax
jne 0x140085913
lea rdx, [rsp + 0x5c]
test rcx, rcx
je 0x140085a0d
lea rax, [rsp + 0x5c]
sub r8, rax
movzx eax, word [r8 + rdx]
cmp ax, word [rdx]
jne 0x140085913
add rdx, 2
sub rcx, 1
jne 0x1400858ed
jmp 0x140085a0d
lea r8, [rsp + 0x20]
mov rcx, rbx
call fcn.14007242c
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x14008598a
mov r9d, dword [r10 + 0x18]
test r9d, r9d
je 0x14008598a
mov esi, dword [r10 + 0x20]
dec r9d
lea rcx, [rsi + r9*4]
mov edx, dword [rcx + r8]
add rdx, r8
mov r11d, 0xfcb3795c
mov cl, byte [rdx]
inc rdx
test cl, cl
je 0x140085985
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
inc rdx
test cl, cl
jne 0x140085966
cmp r11d, 0xddca2986
je 0x14008598f
test r9d, r9d
jne 0x140085949
mov rax, qword [rax]
jmp 0x140085924
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx edx, word [rcx + r9*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
lea rdx, [rsp + 0x30]
mov rcx, r15
call rax
test eax, eax
je 0x140085a2f
lea rcx, [rsp + 0x5c]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r12w
jne 0x1400859bf
mov rcx, qword [r14 + 0x10]
mov r8, r14
cmp qword [r14 + 0x18], 7
jbe 0x1400859da
mov r8, qword [r14]
cmp rcx, rax
jne 0x140085913
lea rdx, [rsp + 0x5c]
test rcx, rcx
je 0x140085a0d
lea rax, [rsp + 0x5c]
sub r8, rax
movzx eax, word [r8 + rdx]
cmp ax, word [rdx]
jne 0x140085913
add rdx, 2
sub rcx, 1
jne 0x1400859f5
mov rdx, qword [rbx + 8]
mov eax, dword [rsp + 0x38]
cmp rdx, qword [rbx + 0x10]
mov dword [rsp + 0x20], eax
je 0x140085906
mov dword [rdx], eax
add qword [rbx + 8], 4
jmp 0x140085913
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x140085aa6
mov r10d, dword [r9 + 0x18]
test r10d, r10d
je 0x140085aa6
mov esi, dword [r9 + 0x20]
dec r10d
lea rcx, [rsi + r10*4]
mov edx, dword [rcx + r8]
add rdx, r8
mov r11d, 0x7f7b2f50
mov cl, byte [rdx]
inc rdx
test cl, cl
je 0x140085aa1
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
inc rdx
test cl, cl
jne 0x140085a82
cmp r11d, 0x8b05289a
je 0x140085aab
test r10d, r10d
jne 0x140085a65
mov rax, qword [rax]
jmp 0x140085a40
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + r10*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
mov rcx, r15
call rax
mov rax, rbx
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.1400a94d0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret