Function at 0x14003c240
Capabilities:
Access peb ldr_data
Encode data using xor
Get kernel32 base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xf0
mov rax, qword [0x14004f010]
xor rax, rsp
mov qword [rbp + 0x27], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x49], xmm0
lea rcx, [rbp + 0x5f]
movabs rdx, 0xff00ff00ff00ff00
mov qword [rbp - 0x41], rdx
mov qword [rbp - 0x39], rcx
mov rax, qword [rcx]
xor rax, rdx
mov qword [rbp - 0x49], rax
mov qword [rcx], 0
movabs rbx, 0xf373dbce0ecf1aa6
mov qword [rbp - 0x29], rbx
movabs r13, 0x665378897d42e51f
mov qword [rbp - 0x21], r13
movabs r15, 0x9607b2a07abd75e0
mov qword [rsp + 0x20], r15
movabs r12, 0x665378897d42c53f
mov qword [rsp + 0x28], r12
movdqa xmm0, xmmword [rsp + 0x20]
xorps xmm0, xmmword [rbp - 0x29]
movdqa xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x140121820], rax
test rax, rax
jne 0x14003c428
nop word [rax + rax]
mov qword [rbp - 0x19], rbx
mov qword [rbp - 0x11], r13
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x38], r12
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rbp - 0x19]
movdqa xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x140121820], rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov r14d, dword [rcx + rbx + 0x88]
add r14, rbx
cmp r14, rbx
je 0x14003c3e8
mov r11d, dword [r14 + 0x18]
test r11d, r11d
je 0x14003c3e8
mov esi, dword [r14 + 0x20]
nop word [rax + rax]
dec r11d
lea rcx, [rsi + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0x811c9dc5
movzx ecx, byte [r9]
inc r9
test cl, cl
je 0x14003c3e3
nop
movsx edx, cl
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
movzx ecx, byte [r9]
lea r9, [r9 + 1]
test cl, cl
jne 0x14003c3b0
cmp r10d, 0x89eabb08
je 0x14003c3f0
test r11d, r11d
jne 0x14003c390
mov rax, qword [rax]
jmp 0x14003c360
mov ecx, dword [r14 + 0x1c]
add rcx, rbx
mov eax, dword [r14 + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov edx, dword [rcx + rax*4]
add rdx, rbx
mov ecx, 0x1f4
call rdx
cmp qword [0x140121820], 0
movabs rbx, 0xf373dbce0ecf1aa6
je 0x14003c310
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov r14d, dword [rcx + rbx + 0x88]
add r14, rbx
cmp r14, rbx
je 0x14003c4c9
mov r11d, dword [r14 + 0x18]
test r11d, r11d
je 0x14003c4c9
mov esi, dword [r14 + 0x20]
nop word [rax + rax]
dec r11d
lea rcx, [rbx + r11*4]
mov r9d, dword [rcx + rsi]
add r9, rbx
mov r10d, 0x811c9dc5
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x14003c4c4
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x14003c490
cmp r10d, 0x89eabb08
je 0x14003c4d1
test r11d, r11d
jne 0x14003c470
mov rax, qword [rax]
jmp 0x14003c440
mov ecx, dword [r14 + 0x1c]
add rcx, rbx
mov eax, dword [r14 + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov edx, dword [rcx + rax*4]
add rdx, rbx
mov ecx, 0xbb8
call rdx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov r14d, dword [rcx + rbx + 0x88]
add r14, rbx
cmp r14, rbx
je 0x14003c599
mov r11d, dword [r14 + 0x18]
test r11d, r11d
je 0x14003c599
mov esi, dword [r14 + 0x20]
nop word [rax + rax]
dec r11d
lea rcx, [rbx + r11*4]
mov r9d, dword [rcx + rsi]
add r9, rbx
mov r10d, 0x811c9dc5
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x14003c594
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x14003c560
cmp r10d, 0x491e0a9c
je 0x14003c5a1
test r11d, r11d
jne 0x14003c540
mov rax, qword [rax]
jmp 0x14003c510
mov ecx, dword [r14 + 0x1c]
add rcx, rbx
mov eax, dword [r14 + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov edx, dword [rcx + rax*4]
add rdx, rbx
lea rcx, [0x140047938]
call rdx
movabs rcx, 0xf373dbce0ecf1aa6
mov qword [rbp + 7], rcx
mov qword [rbp + 0xf], r13
movabs rax, 0x848c23cc5752e3d0
mov qword [rbp + 0x17], rax
movabs rax, 0x37b2a80f7488f621
mov qword [rbp + 0x1f], rax
movabs rax, 0xba24fbbd7daa68f6
mov qword [rbp - 0x69], rax
movabs rax, 0x92758c35d69c551
mov qword [rbp - 0x61], rax
movabs rax, 0xf1e24ab8393d80f0
mov qword [rbp - 0x59], rax
movabs rax, 0x37b2a80f7488d844
mov qword [rbp - 0x51], rax
movdqa xmm0, xmmword [rbp - 0x69]
xorps xmm0, xmmword [rbp + 7]
movdqa xmmword [rbp - 0x69], xmm0
movdqa xmm1, xmmword [rbp - 0x59]
xorps xmm1, xmmword [rbp + 0x17]
movdqa xmmword [rbp - 0x59], xmm1
mov qword [rbp - 9], rcx
mov qword [rbp - 1], r13
movabs rax, 0xf373dbce0ecf1a87
mov qword [rbp - 0x79], rax
mov qword [rbp - 0x71], r13
movdqa xmm0, xmmword [rbp - 0x79]
xorps xmm0, xmmword [rbp - 9]
movdqa xmmword [rbp - 0x79], xmm0
lea r8, [rbp - 0x69]
lea rdx, [rbp - 0x79]
call fcn.14003b9d0
nop word [rax + rax]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov r14d, dword [rcx + rbx + 0x88]
add r14, rbx
cmp r14, rbx
je 0x14003c729
mov r11d, dword [r14 + 0x18]
test r11d, r11d
je 0x14003c729
mov esi, dword [r14 + 0x20]
nop word [rax + rax]
dec r11d
lea rcx, [rsi + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0x811c9dc5
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x14003c724
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x14003c6f0
cmp r10d, 0x7e1b3ec5
je 0x14003c731
test r11d, r11d
jne 0x14003c6d0
mov rax, qword [rax]
jmp 0x14003c6a0
mov ecx, dword [r14 + 0x1c]
add rcx, rbx
mov eax, dword [r14 + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov edx, dword [rcx + rax*4]
add rdx, rbx
mov ecx, 0x5b
call rdx
test ax, ax
jns 0x14003c82a
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov r14d, dword [rcx + rbx + 0x88]
add r14, rbx
cmp r14, rbx
je 0x14003c7f9
mov r11d, dword [r14 + 0x18]
test r11d, r11d
je 0x14003c7f9
mov esi, dword [r14 + 0x20]
nop word [rax + rax]
dec r11d
lea rcx, [rsi + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0x811c9dc5
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x14003c7f4
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x14003c7c0
cmp r10d, 0x7e1b3ec5
je 0x14003c801
test r11d, r11d
jne 0x14003c7a0
mov rax, qword [rax]
jmp 0x14003c770
mov ecx, dword [r14 + 0x1c]
add rcx, rbx
mov eax, dword [r14 + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov edx, dword [rcx + rax*4]
add rdx, rbx
mov ecx, 0x4a
call rdx
test ax, ax
js 0x14003c8f6
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov r14d, dword [rcx + rbx + 0x88]
add r14, rbx
cmp r14, rbx
je 0x14003c8c9
mov r11d, dword [r14 + 0x18]
test r11d, r11d
je 0x14003c8c9
mov esi, dword [r14 + 0x20]
nop word [rax + rax]
dec r11d
lea rcx, [rsi + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0x811c9dc5
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x14003c8c4
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x14003c890
cmp r10d, 0x89eabb08
je 0x14003c8d1
test r11d, r11d
jne 0x14003c870
mov rax, qword [rax]
jmp 0x14003c840
mov ecx, dword [r14 + 0x24]
add rcx, rbx
movzx edx, word [rcx + r11*2]
mov ecx, dword [r14 + 0x1c]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
add rax, rbx
mov ecx, 0x64
call rax
jmp 0x14003c680
mov edx, 0x1f4
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov r14d, dword [rcx + rbx + 0x88]
add r14, rbx
cmp r14, rbx
je 0x14003c9a9
mov r11d, dword [r14 + 0x18]
test r11d, r11d
je 0x14003c9a9
mov esi, dword [r14 + 0x20]
nop word [rax + rax]
dec r11d
lea rcx, [rbx + r11*4]
mov r9d, dword [rcx + rsi]
add r9, rbx
mov r10d, 0x811c9dc5
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x14003c9a4
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x14003c970
cmp r10d, 0x491e0a9c
je 0x14003c9b1
test r11d, r11d
jne 0x14003c950
mov rax, qword [rax]
jmp 0x14003c920
mov edx, dword [r14 + 0x1c]
add rdx, rbx
mov eax, dword [r14 + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov edx, dword [rdx + rax*4]
add rdx, rbx
lea rcx, [0x140047938]
call rdx
nop
mov rax, qword [rbp - 0x49]
movabs rcx, 0xff00ff00ff00ff00
xor rax, rcx
lea rcx, [rbp + 0x5f]
mov qword [rcx], rax
xor eax, eax
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.14003e5e0
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret