Function at 0x140071670
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r13, rcx
call fcn.140073a80
mov rax, qword [r13 + 0x18]
test rax, rax
je 0x1400718de
mov r8, qword [0x1401bf460]
test r8, r8
jne 0x1400718c6
xor r14d, r14d
mov edi, 0x8285aca5
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
movups xmm0, xmmword [rax + 0x58]
movups xmmword [rsp + 0x20], xmm0
movd ecx, xmm0
sub cx, 8
test r14d, r14d
je 0x140071733
mov r9, qword [rsp + 0x28]
movzx ecx, cx
shr rcx, 1
lea r11, [r9 + rcx*2]
mov r10d, 0x811c9dc5
cmp r9, r11
je 0x14007172a
movsx ecx, byte [r9]
mov edx, ecx
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
add r9, 2
cmp r9, r11
jne 0x140071700
cmp r10d, r14d
jne 0x140071878
mov rbx, qword [rax + 0x30]
test rbx, rbx
je 0x140071880
movsxd rcx, dword [rbx + 0x3c]
mov rdx, qword [rcx + rbx + 0x88]
mov r12, rdx
shr r12, 0x20
mov esi, edx
add rsi, rbx
cmp rsi, rbx
je 0x140071878
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x140071878
mov r15d, dword [rsi + 0x20]
dec r11d
lea rcx, [rbx + r11*4]
mov r8d, dword [rcx + r15]
add r8, rbx
mov r10d, 0x811c9dc5
movzx r9d, byte [r8]
inc r8
test r9b, r9b
je 0x1400717bd
movsx ecx, r9b
sub r9b, 0x41
mov edx, ecx
or edx, 0x20
cmp r9b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r9d, byte [r8]
lea r8, [r8 + 1]
test r9b, r9b
jne 0x140071792
cmp r10d, edi
je 0x1400717cf
test r11d, r11d
jne 0x140071772
mov rax, qword [rax]
jmp 0x1400716d0
mov ecx, dword [rsi + 0x24]
add rcx, rbx
movzx edx, word [rcx + r11*2]
mov ecx, dword [rsi + 0x1c]
add rcx, rbx
mov r8d, dword [rcx + rdx*4]
add r8, rbx
cmp r8, rsi
jbe 0x140071883
lea rax, [r12 + rsi]
cmp r8, rax
jae 0x140071883
mov edi, 0x811c9dc5
mov r14d, edi
movzx edx, byte [r8]
cmp dl, 0x2e
je 0x140071837
nop
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, r14d
imul r14d, ecx, 0x1000193
inc r8
movzx edx, byte [r8]
cmp dl, 0x2e
jne 0x140071810
inc r8
movzx edx, byte [r8]
test dl, dl
je 0x140071867
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, edi
imul edi, ecx, 0x1000193
lea r8, [r8 + 1]
movzx edx, byte [r8]
test dl, dl
jne 0x140071842
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rax, qword [rax]
jmp 0x1400716d0
xor r8d, r8d
mov qword [0x1401bf460], r8
nop word [rax + rax]
rdtsc
shl rdx, 0x20
or rax, rdx
lea rcx, [rax + rax*4]
mov qword [0x1401bf468], rcx
cmp rcx, r8
je 0x140071890
xor r8, rcx
mov qword [0x1401bf460], r8
mov eax, ecx
xor eax, 0x8285aca5
mov dword [0x1401bf458], eax
mov rax, qword [r13 + 0x18]
jmp 0x1400718cd
mov rcx, qword [0x1401bf468]
xor r8, rcx
mov rcx, rax
call r8
mov qword [r13 + 0x18], 0
mov rcx, r13
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
jmp 0x140074410
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx]
test rcx, rcx
je 0x140074479
mov rdx, qword [rbx + 0x10]
sub rdx, rcx
movabs rax, 0xf83e0f83e0f83e1
imul rdx
sar rdx, 6
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0x420
cmp rax, 0x1000
jb 0x140074466
mov rdx, qword [rcx - 8]
sub rcx, rdx
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14007447f
mov rcx, rdx
call fcn.14000d9c0
nop
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
add rsp, 0x20
pop rbx
ret
call fcn.14007f764
int3