Function at 0x140001010
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x140007040]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rax, qword gs:[0x58]
mov ebx, 4
add rbx, qword [rax]
mov eax, dword [rbx]
cmp dword [0x14000771c], eax
jle 0x1400010ae
lea rcx, [0x14000771c]
call fcn.1400031fc
cmp dword [0x14000771c], 0xffffffff
jne 0x1400010ae
lea rcx, [0x140004050]
mov dword [0x140007732], 0x169739f
mov dword [0x140007728], 0x71819e7c
mov dword [0x14000772c], 0xd914f70c
mov word [0x140007730], 0x9f19
call fcn.14000349c
lea rcx, [0x14000771c]
call fcn.140003190
cmp byte [0x140007735], 0
je 0x140001119
xor byte [0x140007728], 0x37
xor byte [0x140007729], 0xfb
xor byte [0x14000772a], 0xf3
xor byte [0x14000772b], 0x1f
xor byte [0x14000772c], 0x69
xor byte [0x14000772d], 0x9b
xor byte [0x14000772e], 0x27
xor byte [0x14000772f], 0xeb
xor byte [0x140007730], 0x37
xor byte [0x140007731], 0xfb
xor byte [0x140007732], 0xf3
xor byte [0x140007733], 0x1f
xor byte [0x140007734], 0x69
mov byte [0x140007735], 0
lea rax, [0x140007728]
mov qword [rbp + 7], rax
mov eax, dword [rbx]
cmp dword [0x1400076f0], eax
jle 0x140001179
lea rcx, [0x1400076f0]
call fcn.1400031fc
cmp dword [0x1400076f0], 0xffffffff
jne 0x140001179
lea rcx, [0x140004030]
mov dword [0x140007718], 0x1677959
mov dword [0x140007710], 0x11026660
mov dword [0x140007714], 0x917dd754
call fcn.14000349c
lea rcx, [0x1400076f0]
call fcn.140003190
cmp byte [0x14000771b], 0
je 0x1400011d6
xor byte [0x140007710], 0x35
xor byte [0x140007711], 0x15
xor byte [0x140007712], 0x67
xor byte [0x140007713], 0x63
xor byte [0x140007714], 0x67
xor byte [0x140007715], 0xe5
xor byte [0x140007716], 0x53
xor byte [0x140007717], 0xf5
xor byte [0x140007718], 0x35
xor byte [0x140007719], 0x15
xor byte [0x14000771a], 0x67
mov byte [0x14000771b], 0
lea rax, [0x140007710]
mov qword [rbp + 0xf], rax
mov eax, dword [rbx]
cmp dword [0x1400076d8], eax
jle 0x14000123f
lea rcx, [0x1400076d8]
call fcn.1400031fc
cmp dword [0x1400076d8], 0xffffffff
jne 0x14000123f
lea rcx, [0x140004010]
mov dword [0x140007742], 0x18ba5e3
mov dword [0x140007738], 0xa8f937d8
mov dword [0x14000773c], 0xcdf0fefb
mov word [0x140007740], 0x37b7
call fcn.14000349c
lea rcx, [0x1400076d8]
call fcn.140003190
cmp byte [0x140007745], 0
je 0x1400012a9
xor byte [0x140007738], 0x99
xor byte [0x140007739], 0x53
xor byte [0x14000773a], 0x8f
xor byte [0x14000773b], 0xc9
xor byte [0x14000773c], 0x8b
xor byte [0x14000773d], 0x97
xor byte [0x14000773e], 0xc3
xor byte [0x140007740], 0x99
xor byte [0x140007741], 0x53
xor byte [0x140007742], 0x8f
xor byte [0x140007743], 0xc9
xor byte [0x140007744], 0x8b
not byte [0x14000773f]
mov byte [0x140007745], 0
lea rax, [0x140007738]
mov qword [rbp + 0x17], rax
mov eax, dword [rbx]
cmp dword [0x140007720], eax
jle 0x140001312
lea rcx, [0x140007720]
call fcn.1400031fc
cmp dword [0x140007720], 0xffffffff
jne 0x140001312
lea rcx, [0x140003ff0]
mov dword [0x1400076ea], 0x1afe971
mov dword [0x1400076e0], 0xe975fbae
mov dword [0x1400076e4], 0xf2a5f4df
mov word [0x1400076e8], 0xefc9
call fcn.14000349c
lea rcx, [0x140007720]
call fcn.140003190
cmp byte [0x1400076ed], 0
je 0x14000137d
xor byte [0x1400076e0], 0xe7
xor byte [0x1400076e1], 0x8b
xor byte [0x1400076e2], 0x1d
xor byte [0x1400076e3], 0x85
xor byte [0x1400076e4], 0xaf
xor byte [0x1400076e5], 0x95
xor byte [0x1400076e6], 0xd5
xor byte [0x1400076e7], 0x9b
xor byte [0x1400076e8], 0xe7
xor byte [0x1400076e9], 0x8b
xor byte [0x1400076ea], 0x1d
xor byte [0x1400076eb], 0x85
xor byte [0x1400076ec], 0xaf
mov byte [0x1400076ed], 0
lea rax, [0x1400076e0]
xor r14d, r14d
mov qword [rbp + 0x1f], rax
lea rsi, [rbp + 7]
nop
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140001427
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140001427
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xc0e1285c
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140001422
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x140001400
cmp r8d, 0x8c98214e
je 0x14000142c
test r9d, r9d
jne 0x1400013e0
mov rax, qword [rax]
jmp 0x1400013b0
mov edx, dword [rbx + 0x24]
mov rcx, qword [rsi]
add rdx, r10
movzx r8d, word [rdx + r9*2]
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov eax, dword [rdx + r8*4]
add rax, r10
call rax
test rax, rax
jne 0x140001c65
mov dword [rbp - 0x18], r14d
mov rdx, r14
mov byte [rbp - 0x14], r14b
mov word [rbp + 0x2c], 0x72
mov dword [rbp + 0x27], 0x7206ae72
mov byte [rbp + 0x2b], 0xff
nop
movzx eax, byte [rbp + rdx + 0x28]
movzx ecx, byte [rbp + rdx + 0x27]
mov byte [rbp + rdx + 0x27], al
mov byte [rbp + rdx + 0x28], cl
add rdx, 2
cmp rdx, 6
jb 0x140001470
movzx eax, byte [rbp + 0x27]
mov r8d, r14d
not al
mov edx, 7
movzx r9d, al
shr al, 1
and r9b, 0xd5
and al, 0x55
add r9b, r9b
or r9b, al
xor r10b, r10b
nop
movzx ecx, r8b
movzx eax, r9b
shr al, cl
inc r8d
and al, 1
mov ecx, edx
shl al, cl
dec edx
or r10b, al
cmp edx, 0xffffffff
jg 0x1400014b0
movzx eax, byte [rbp + 0x28]
mov r8d, r14d
mov byte [rbp - 0x19], r10b
not al
movzx r10d, al
mov edx, 7
and r10b, 0xd5
shr al, 1
add r10b, r10b
and al, 0x55
or r10b, al
xor r9b, r9b
nop dword [rax]
nop dword [rax + rax]
movzx ecx, r8b
movzx eax, r10b
shr al, cl
inc r8d
and al, 1
mov ecx, edx
shl al, cl
dec edx
or r9b, al
cmp edx, 0xffffffff
jg 0x140001500
movzx eax, byte [rbp + 0x29]
mov r8d, r14d
not al
mov byte [rbp - 0x18], r9b
movzx r10d, al
mov edx, 7
and r10b, 0xd5
shr al, 1
add r10b, r10b
and al, 0x55
or r10b, al
xor r9b, r9b
nop dword [rax]
nop dword [rax + rax]
movzx ecx, r8b
movzx eax, r10b
shr al, cl
inc r8d
and al, 1
mov ecx, edx
shl al, cl
dec edx
or r9b, al
cmp edx, 0xffffffff
jg 0x140001550
movzx eax, byte [rbp + 0x2a]
mov r8d, r14d
not al
mov byte [rbp - 0x17], r9b
movzx r10d, al
mov edx, 7
and r10b, 0xd5
shr al, 1
add r10b, r10b
and al, 0x55
or r10b, al
xor r9b, r9b
nop dword [rax]
nop dword [rax + rax]
movzx ecx, r8b
movzx eax, r10b
shr al, cl
inc r8d
and al, 1
mov ecx, edx
shl al, cl
dec edx
or r9b, al
cmp edx, 0xffffffff
jg 0x1400015a0
movzx eax, byte [rbp + 0x2b]
mov r8d, r14d
not al
mov byte [rbp - 0x16], r9b
movzx r10d, al
mov edx, 7
and r10b, 0xd5
shr al, 1
add r10b, r10b
and al, 0x55
or r10b, al
xor r9b, r9b
nop dword [rax]
nop dword [rax + rax]
movzx ecx, r8b
movzx eax, r10b
shr al, cl
inc r8d
and al, 1
mov ecx, edx
shl al, cl
dec edx
or r9b, al
cmp edx, 0xffffffff
jg 0x1400015f0
movzx eax, byte [rbp + 0x2c]
mov r8d, r14d
not al
mov byte [rbp - 0x15], r9b
movzx r10d, al
mov edx, 7
and r10b, 0xd5
shr al, 1
add r10b, r10b
and al, 0x55
or r10b, al
xor r9b, r9b
nop dword [rax]
nop dword [rax + rax]
movzx ecx, r8b
movzx eax, r10b
shr al, cl
inc r8d
and al, 1
mov ecx, edx
shl al, cl
dec edx
or r9b, al
cmp edx, 0xffffffff
jg 0x140001640
xorps xmm0, xmm0
mov byte [rbp - 0x14], r9b
xor eax, eax
mov byte [rbp - 0x13], r14b
movups xmmword [rbp - 0x11], xmm0
mov rdx, r14
mov byte [rbp - 1], al
movdqa xmm0, xmmword [0x140005290]
movdqu xmmword [rbp + 0x2f], xmm0
mov byte [rbp + 0x3f], al
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rbp + rdx + 0x30]
movzx ecx, byte [rbp + rdx + 0x2f]
mov byte [rbp + rdx + 0x2f], al
mov byte [rbp + rdx + 0x30], cl
add rdx, 2
cmp rdx, 0x10
jb 0x140001690
movzx eax, byte [rbp + 0x2f]
mov r8d, r14d
not al
mov edx, 7
movzx r9d, al
shr al, 1
and r9b, 0xd5
and al, 0x55
add r9b, r9b
or r9b, al
xor r10b, r10b
nop
movzx ecx, r8b
movzx eax, r9b
shr al, cl
inc r8d
and al, 1
mov ecx, edx
shl al, cl
dec edx
or r10b, al
cmp edx, 0xffffffff
jg 0x1400016d0
movzx eax, byte [rbp + 0x30]
mov r8d, r14d
mov byte [rbp - 0x11], r10b
not al
movzx r10d, al
mov edx, 7
and r10b, 0xd5
shr al, 1
add r10b, r10b
and al, 0x55
or r10b, al
xor r9b, r9b
nop dword [rax]
nop dword [rax + rax]
movzx ecx, r8b
movzx eax, r10b
shr al, cl
inc r8d
and al, 1
mov ecx, edx
shl al, cl
dec edx
or r9b, al
cmp edx, 0xffffffff
jg 0x140001720
movzx eax, byte [rbp + 0x31]
mov r8d, r14d
not al
mov byte [rbp - 0x10], r9b
movzx r10d, al
mov edx, 7
and r10b, 0xd5
shr al, 1
add r10b, r10b
and al, 0x55
or r10b, al
xor r9b, r9b
nop dword [rax]
nop dword [rax + rax]
movzx ecx, r8b
movzx eax, r10b
shr al, cl
inc r8d
and al, 1
mov ecx, edx
shl al, cl
dec edx
or r9b, al
cmp edx, 0xffffffff
jg 0x140001770
movzx eax, byte [rbp + 0x32]
mov r8d, r14d
not al
mov byte [rbp - 0xf], r9b
movzx r10d, al
mov edx, 7
and r10b, 0xd5
shr al, 1
add r10b, r10b
and al, 0x55
or r10b, al
xor r9b, r9b
nop dword [rax]
nop dword [rax + rax]
movzx ecx, r8b
movzx eax, r10b
shr al, cl
inc r8d
and al, 1
mov ecx, edx
shl al, cl
dec edx
or r9b, al
cmp edx, 0xffffffff
jg 0x1400017c0
movzx eax, byte [rbp + 0x33]
mov r8d, r14d
not al
mov byte [rbp - 0xe], r9b
movzx r10d, al
mov edx, 7
and r10b, 0xd5
shr al, 1
add r10b, r10b
and al, 0x55
or r10b, al
xor r9b, r9b
nop dword [rax]
nop dword [rax + rax]
movzx ecx, r8b
movzx eax, r10b
shr al, cl
inc r8d
and al, 1
mov ecx, edx
shl al, cl
dec edx
or r9b, al
cmp edx, 0xffffffff
jg 0x140001810
movzx eax, byte [rbp + 0x34]
mov r8d, r14d
not al
mov byte [rbp - 0xd], r9b
movzx r10d, al
mov edx, 7
and r10b, 0xd5
shr al, 1
add r10b, r10b
and al, 0x55
or r10b, al
xor r9b, r9b
nop dword [rax]
nop dword [rax + rax]
movzx ecx, r8b
movzx eax, r10b
shr al, cl
inc r8d
and al, 1
mov ecx, edx
shl al, cl
dec edx
or r9b, al
cmp edx, 0xffffffff
jg 0x140001860
movzx eax, byte [rbp + 0x35]
mov r8d, r14d
not al
mov byte [rbp - 0xc], r9b
movzx r10d, al
mov edx, 7
and r10b, 0xd5
shr al, 1
add r10b, r10b
and al, 0x55
or r10b, al
xor r9b, r9b
nop dword [rax]
nop dword [rax + rax]
movzx ecx, r8b
movzx eax, r10b
shr al, cl
inc r8d
and al, 1
mov ecx, edx
shl al, cl
dec edx
or r9b, al
cmp edx, 0xffffffff
jg 0x1400018b0
movzx eax, byte [rbp + 0x36]
mov r8d, r14d
not al
mov byte [rbp - 0xb], r9b
movzx r10d, al
mov edx, 7
and r10b, 0xd5
shr al, 1
add r10b, r10b
and al, 0x55
or r10b, al
xor r9b, r9b
nop dword [rax]
nop dword [rax + rax]
movzx ecx, r8b
movzx eax, r10b
shr al, cl
inc r8d
and al, 1
mov ecx, edx
shl al, cl
dec edx
or r9b, al
cmp edx, 0xffffffff
jg 0x140001900
movzx eax, byte [rbp + 0x37]
mov r8d, r14d
not al
mov byte [rbp - 0xa], r9b
movzx r10d, al
mov edx, 7
and r10b, 0xd5
shr al, 1
add r10b, r10b
and al, 0x55
or r10b, al
xor r9b, r9b
nop dword [rax]
nop dword [rax + rax]
movzx ecx, r8b
movzx eax, r10b
shr al, cl
inc r8d
and al, 1
mov ecx, edx
shl al, cl
dec edx
or r9b, al
cmp edx, 0xffffffff
jg 0x140001950
movzx eax, byte [rbp + 0x38]
mov r8d, r14d
not al
mov byte [rbp - 9], r9b
movzx r10d, al
mov edx, 7
and r10b, 0xd5
shr al, 1
add r10b, r10b
and al, 0x55
or r10b, al
xor r9b, r9b
nop dword [rax]
nop dword [rax + rax]
movzx ecx, r8b
movzx eax, r10b
shr al, cl
inc r8d
and al, 1
mov ecx, edx
shl al, cl
dec edx
or r9b, al
cmp edx, 0xffffffff
jg 0x1400019a0
movzx eax, byte [rbp + 0x39]
mov r8d, r14d
not al
mov byte [rbp - 8], r9b
movzx r10d, al
mov edx, 7
and r10b, 0xd5
shr al, 1
add r10b, r10b
and al, 0x55
or r10b, al
xor r9b, r9b
nop dword [rax]
nop dword [rax + rax]
movzx ecx, r8b
movzx eax, r10b
shr al, cl
inc r8d
and al, 1
mov ecx, edx
shl al, cl
dec edx
or r9b, al
cmp edx, 0xffffffff
jg 0x1400019f0
movzx eax, byte [rbp + 0x3a]
mov r8d, r14d
not al
mov byte [rbp - 7], r9b
movzx r10d, al
mov edx, 7
and r10b, 0xd5
shr al, 1
add r10b, r10b
and al, 0x55
or r10b, al
xor r9b, r9b
nop dword [rax]
nop dword [rax + rax]
movzx ecx, r8b
movzx eax, r10b
shr al, cl
inc r8d
and al, 1
mov ecx, edx
shl al, cl
dec edx
or r9b, al
cmp edx, 0xffffffff
jg 0x140001a40
movzx eax, byte [rbp + 0x3b]
mov r8d, r14d
not al
mov byte [rbp - 6], r9b
movzx r10d, al
mov edx, 7
and r10b, 0xd5
shr al, 1
add r10b, r10b
and al, 0x55
or r10b, al
xor r9b, r9b
nop dword [rax]
nop dword [rax + rax]
movzx ecx, r8b
movzx eax, r10b
shr al, cl
inc r8d
and al, 1
mov ecx, edx
shl al, cl
dec edx
or r9b, al
cmp edx, 0xffffffff
jg 0x140001a90
movzx eax, byte [rbp + 0x3c]
mov r8d, r14d
not al
mov byte [rbp - 5], r9b
movzx r10d, al
mov edx, 7
and r10b, 0xd5
shr al, 1
add r10b, r10b
and al, 0x55
or r10b, al
xor r9b, r9b
nop dword [rax]
nop dword [rax + rax]
movzx ecx, r8b
movzx eax, r10b
shr al, cl
inc r8d
and al, 1
mov ecx, edx
shl al, cl
dec edx
or r9b, al
cmp edx, 0xffffffff
jg 0x140001ae0
movzx eax, byte [rbp + 0x3d]
mov r8d, r14d
not al
mov byte [rbp - 4], r9b
movzx r10d, al
mov edx, 7
and r10b, 0xd5
shr al, 1
add r10b, r10b
and al, 0x55
or r10b, al
xor r9b, r9b
nop dword [rax]
nop dword [rax + rax]
movzx ecx, r8b
movzx eax, r10b
shr al, cl
inc r8d
and al, 1
mov ecx, edx
shl al, cl
dec edx
or r9b, al
cmp edx, 0xffffffff
jg 0x140001b30
movzx eax, byte [rbp + 0x3e]
mov r8d, r14d
not al
mov byte [rbp - 3], r9b
movzx r10d, al
mov edx, 7
and r10b, 0xd5
shr al, 1
add r10b, r10b
and al, 0x55
or r10b, al
xor r9b, r9b
nop dword [rax]
nop dword [rax + rax]
movzx ecx, r8b
movzx eax, r10b
shr al, cl
inc r8d
and al, 1
mov ecx, edx
shl al, cl
dec edx
or r9b, al
cmp edx, 0xffffffff
jg 0x140001b80
mov byte [rbp - 2], r9b
mov byte [rbp - 1], r14b
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140001c37
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140001c37
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xb9c30843
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140001c32
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x140001c10
cmp r8d, 0xa4de32e2
je 0x140001c3c
test r9d, r9d
jne 0x140001bf0
mov rax, qword [rax]
jmp 0x140001bc0
mov ecx, dword [rbx + 0x24]
lea r8, [rbp - 0x19]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov r9d, 0x10
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rdx, [rbp - 0x11]
add rax, r10
xor ecx, ecx
call rax
add rsi, 8
lea rax, [rbp + 0x27]
cmp rsi, rax
jne 0x140001390
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140003170
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret