Function at 0x140002b54
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Create thread
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x68]
sub rsp, 0x140
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x30], rax
xor esi, esi
lea rcx, [rbp - 0x60]
call fcn.1400025c0
mov rdx, qword [rbp - 0x48]
lea r15d, [rsi + 0xf]
cmp rdx, r15
jbe 0x140002bd1
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002bcc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002bcc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003dc4
mov r12d, 1
mov ecx, r12d
call fcn.140003d80
mov qword [rbp + 0x20], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x140003d08]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400031ea
cmp dword [rsp + 0x38], esi
je 0x1400031e0
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp + 0x20], xmm0
lea rcx, [rbp + 0x20]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x1400031e0
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
cmp dword [0x140007660], 8
jne 0x140002ce6
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x140002cc4
mov r11d, dword [r9 + 0x18]
test r11d, r11d
je 0x140002cc4
mov ebx, dword [r9 + 0x20]
dec r11d
lea rdx, [rbx + r11*4]
mov r10d, dword [rdx + r8]
add r10, r8
mov edx, 0x94cdf2b7
mov cl, byte [r10]
add r10, r12
test cl, cl
je 0x140002cbf
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
mov cl, byte [r10]
add r10, r12
test cl, cl
jne 0x140002ca2
cmp edx, 0xd611b9f7
je 0x140002cc9
test r11d, r11d
jne 0x140002c85
mov rax, qword [rax]
jmp 0x140002c60
mov edx, dword [r9 + 0x1c]
add rdx, r8
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx ecx, word [rcx + r11*2]
mov eax, dword [rdx + rcx*4]
add rax, r8
xor ecx, ecx
call rax
lea rcx, [rbp]
call fcn.1400025c0
mov rdi, rax
mov dword [rsp + 0x30], 0xbbd4b0a2
mov dword [rsp + 0x34], 0xc39d9a97
mov word [rsp + 0x38], 0xda
mov byte [rsp + 0x3a], r12b
mov rcx, rsi
lea eax, [rcx - 0xe]
xor byte [rsp + rcx + 0x30], al
add rcx, r12
cmp rcx, 9
jb 0x140002d11
mov byte [rsp + 0x3a], sil
mov word [rbp + 0x20], 0xa
mov byte [rbp + 0x22], sil
lea rcx, [rbp - 0x60]
call fcn.140001a88
mov r14, rax
movdqa xmm0, xmmword [0x1400052d0]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0x7651232c
mov dword [rsp + 0x54], 0x68667563
mov dword [rsp + 0x58], 0x2d366e67
mov word [rsp + 0x5c], 0x100
mov rcx, rsi
lea eax, [rcx - 0xe]
xor byte [rsp + rcx + 0x40], al
add rcx, r12
cmp rcx, 0x1c
jb 0x140002d6c
mov byte [rsp + 0x5d], sil
lea rax, [rsp + 0x40]
or rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], sil
jne 0x140002d8a
mov r8, qword [r14 + 0x10]
mov rax, qword [r14 + 0x18]
sub rax, r8
cmp rbx, rax
ja 0x140002e37
lea rax, [rbx + r8]
mov qword [r14 + 0x10], rax
mov rsi, r14
cmp qword [r14 + 0x18], r15
jbe 0x140002dbb
mov rsi, qword [r14]
lea rax, [rsp + 0x40]
add rax, rbx
cmp rax, rsi
jbe 0x140002df2
lea rax, [r8 + rsi]
lea rcx, [rsp + 0x40]
cmp rcx, rax
ja 0x140002df2
lea rax, [rsp + 0x40]
cmp rsi, rax
ja 0x140002de5
xor r15d, r15d
jmp 0x140002df5
lea rax, [rsp + 0x40]
mov r15, rsi
sub r15, rax
jmp 0x140002df5
mov r15, rbx
inc r8
lea rcx, [rbx + rsi]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memmove
mov r8, r15
lea rdx, [rsp + 0x40]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8, rbx
sub r8, r15
lea rax, [rbx + r15]
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [r15 + rsi]
call sub.VCRUNTIME140.dll_memcpy
xor esi, esi
lea r15d, [rsi + 0xf]
jmp 0x140002e54
mov qword [rsp + 0x28], rbx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov rcx, r14
call fcn.140003b08
mov r14, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x68], rsi
movups xmm0, xmmword [r14]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [r14 + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [r14 + 0x10], rsi
mov qword [r14 + 0x18], r15
mov byte [r14], sil
lea r8, [rbp + 0x20]
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x20]
call fcn.14000377c
nop
lea r8, [rsp + 0x30]
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.14000377c
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rsi
mov r14, qword [rax + 0x10]
mov r13, qword [rdi + 0x10]
mov rcx, qword [rdi + 0x18]
lea r12, [r14 + r13]
mov rax, qword [rax + 0x18]
sub rax, r14
cmp r13, rax
ja 0x140002f28
cmp rcx, qword [rbx + 0x18]
ja 0x140002f28
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], r15
mov byte [rbx], sil
lea rax, [rsp + 0x60]
cmp qword [rsp + 0x78], r15
cmova rax, qword [rsp + 0x60]
cmp qword [rdi + 0x18], r15
jbe 0x140002f0e
mov rdi, qword [rdi]
lea r8, [r13 + 1]
lea rcx, [r14 + rax]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0x70], r12
jmp 0x140003049
sub rcx, r13
cmp r14, rcx
ja 0x140002f75
movups xmm0, xmmword [rdi]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], r15
mov byte [rdi], sil
mov rdi, qword [rsp + 0x60]
lea r8, [r13 + 1]
lea rcx, [r14 + rdi]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memmove
cmp qword [rbx + 0x18], r15
jbe 0x140002f6a
mov rbx, qword [rbx]
mov r8, r14
mov rdx, rbx
mov rcx, rdi
jmp 0x140002f19
movabs r15, 0x7fffffffffffffff
mov rax, r15
sub rax, r14
cmp rax, r13
jb 0x1400031fa
mov rax, r12
or rax, 0xf
cmp rax, r15
jbe 0x140002fc3
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140003d80
test rax, rax
je 0x140002ff3
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140003002
mov ecx, 0x16
cmp rax, rcx
cmovb rax, rcx
mov r15, rax
lea rcx, [rax + 1]
test rcx, rcx
je 0x140003002
cmp rcx, 0x1000
jb 0x140002ffa
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003200
jmp 0x140002fa8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003d80
mov rsi, rax
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r15
mov r15d, 0xf
cmp qword [rbx + 0x18], r15
jbe 0x140003020
mov rbx, qword [rbx]
mov r8, r14
mov rdx, rbx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
cmp qword [rdi + 0x18], r15
jbe 0x140003037
mov rdi, qword [rdi]
lea r8, [r13 + 1]
lea rcx, [r14 + rsi]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
xor esi, esi
lea rcx, [rsp + 0x60]
call fcn.140001178
nop
mov rdx, qword [rbp - 0x28]
mov ebx, 0x1000
cmp rdx, r15
jbe 0x140003092
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, rbx
jb 0x14000308d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000308d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003dc4
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], r15
mov byte [rbp - 0x40], sil
mov rdx, qword [rbp - 8]
cmp rdx, r15
jbe 0x1400030d7
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, rbx
jb 0x1400030d2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400030d2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003dc4
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], r15
mov byte [rbp - 0x20], sil
mov rdx, qword [rbp - 0x68]
cmp rdx, r15
jbe 0x14000311c
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, rbx
jb 0x140003117
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003117
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003dc4
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x68], r15
mov byte [rbp - 0x80], sil
mov rdx, qword [rbp - 0x48]
cmp rdx, r15
jbe 0x140003161
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, rbx
jb 0x14000315c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000315c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003dc4
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], r15
mov byte [rbp - 0x60], sil
mov rdx, qword [rbp + 0x18]
cmp rdx, r15
jbe 0x1400031a6
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, rbx
jb 0x1400031a1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400031a1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003dc4
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.140003d60
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, r12d
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x38], esi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
call fcn.140001164
int3
call fcn.1400010c4
int3