Function at 0x140203f90
Capabilities:
Access peb ldr_data
Encode data using xor
Get file attributes
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x140549248]
xor edi, edi
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x100
mov dword [rsp + 0x20], 3
mov rbx, rcx
call rax
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x14020401e
mov rcx, rbx
call qword [sym.imp.kernel32.dll_GetFileAttributesW]
shr eax, 4
test al, 1
je 0x140204526
mov rax, qword [0x140549248]
xor r9d, r9d
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov dword [rsp + 0x28], 0x2000000
mov edx, 0x100
mov rcx, rbx
mov dword [rsp + 0x20], 3
call rax
mov rsi, rax
lea rax, [rsi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140204526
movaps xmmword [rsp + 0x90], xmm6
xor ecx, ecx
movaps xmmword [rsp + 0x80], xmm7
call fcn.1403e0c10
mov rcx, rax
call fcn.1403df874
call fcn.1403df848
mov r8d, eax
mov eax, 0x2aaaaaab
imul r8d
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*2]
shl ecx, 2
sub r8d, ecx
cmp r8d, 1
jne 0x14020407d
mov ebx, 0x31315
jmp 0x14020426b
call fcn.1403df848
mov r8d, eax
mov eax, 0x2aaaaaab
imul r8d
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*2]
shl ecx, 2
sub r8d, ecx
cmp r8d, 2
jne 0x1402040ac
mov eax, edi
jmp 0x140204265
call fcn.1403df848
mov r8d, eax
mov eax, 0x2aaaaaab
imul r8d
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*2]
shl ecx, 2
sub r8d, ecx
cmp r8d, 3
jne 0x1402040dd
lea eax, [r8 + 0x19]
jmp 0x140204265
call fcn.1403df848
mov r8d, eax
mov eax, 0x2aaaaaab
imul r8d
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*2]
shl ecx, 2
sub r8d, ecx
cmp r8d, 4
jne 0x14020410c
mov eax, edi
jmp 0x140204262
call fcn.1403df848
mov r8d, eax
mov eax, 0x2aaaaaab
imul r8d
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*2]
shl ecx, 2
sub r8d, ecx
cmp r8d, 5
jne 0x14020413d
lea eax, [r8 + 0x19]
jmp 0x140204262
call fcn.1403df848
mov r8d, eax
mov eax, 0x2aaaaaab
imul r8d
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*2]
shl ecx, 2
sub r8d, ecx
cmp r8d, 6
jne 0x14020416c
mov eax, edi
jmp 0x14020425f
call fcn.1403df848
mov r8d, eax
mov eax, 0x2aaaaaab
imul r8d
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*2]
shl ecx, 2
sub r8d, ecx
cmp r8d, 7
jne 0x14020419d
lea eax, [r8 + 0x17]
jmp 0x14020425f
call fcn.1403df848
mov r8d, eax
mov eax, 0x2aaaaaab
imul r8d
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*2]
shl ecx, 2
sub r8d, ecx
cmp r8d, 8
jne 0x1402041cc
mov eax, edi
jmp 0x14020425c
call fcn.1403df848
mov r8d, eax
mov eax, 0x2aaaaaab
imul r8d
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*2]
shl ecx, 2
sub r8d, ecx
cmp r8d, 9
jne 0x1402041fa
lea eax, [r8 + 0x16]
jmp 0x14020425c
call fcn.1403df848
mov r8d, eax
mov eax, 0x2aaaaaab
imul r8d
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*2]
shl ecx, 2
sub r8d, ecx
cmp r8d, 0xa
jne 0x140204226
mov ecx, edi
jmp 0x140204259
call fcn.1403df848
mov r8d, eax
mov eax, 0x2aaaaaab
imul r8d
mov eax, 0x1f
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*2]
shl ecx, 2
sub r8d, ecx
mov ecx, 0x3d
cmp r8d, 0xb
cmove ecx, eax
lea eax, [rcx + 0x3d]
add eax, 0x3d
add eax, 0x3d
add eax, 0x3b
lea ebx, [rax + 0x31334]
call fcn.1403df848
mov r8d, eax
mov eax, 0x84210843
imul r8d
add edx, r8d
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x1f
sub r8d, ecx
add r8d, ebx
lea ebx, [r8 + r8*2]
shl ebx, 3
call fcn.1403df848
mov r8d, eax
mov eax, 0x2aaaaaab
imul r8d
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*2]
shl ecx, 3
sub r8d, ecx
add r8d, ebx
imul ebx, r8d, 0x3c
call fcn.1403df848
mov r8d, eax
mov eax, 0x88888889
imul r8d
add edx, r8d
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x3c
sub r8d, ecx
add r8d, ebx
imul ebx, r8d, 0x3c
call fcn.1403df848
mov r8d, eax
mov eax, 0x88888889
imul r8d
add edx, r8d
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x3c
sub r8d, ecx
lea eax, [r8 + 0x57e87f80]
add eax, ebx
movsxd rcx, eax
mov qword [rbp + 0x77], rcx
lea rcx, [rbp + 0x77]
call fcn.1403e249c
xor ecx, ecx
movups xmm7, xmmword [rax]
movups xmm6, xmmword [rax + 0x10]
call fcn.1403e0c10
mov rcx, rax
call fcn.1403df874
call fcn.140141104
rdtsc
shl rdx, 0x20
lea rcx, [rbp + 0x7f]
or rax, rdx
mov qword [rbp + 0x7f], rax
call qword [sym.imp.ntdll.dll_RtlRandom]
mov r8d, eax
mov eax, 0x3521cfb3
mul r8d
mov ecx, r8d
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 5
imul ecx, ecx, 0x35
sub r8d, ecx
mov ecx, 0x7b3
add r8w, cx
movd ecx, xmm6
mov word [rbp - 0x19], r8w
mov word [rbp - 0x17], cx
pextrw ecx, xmm6, 4
mov word [rbp - 0x15], cx
pextrw ecx, xmm7, 6
mov word [rbp - 0x13], cx
call fcn.1403df848
mov r8d, eax
mov eax, 0x2aaaaaab
imul r8d
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*2]
shl ecx, 2
sub r8d, ecx
mov word [rbp - 0x11], r8w
call fcn.1403df848
mov r8d, eax
mov eax, 0x22b63cbf
imul r8d
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x3b
sub r8d, ecx
mov word [rbp - 0xf], r8w
call fcn.1403df848
mov r8d, eax
mov eax, 0x22b63cbf
imul r8d
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x3b
sub r8d, ecx
mov word [rbp - 0xd], r8w
call fcn.1403df848
mov r8d, eax
mov qword [rbp + 0x6f], rdi
mov eax, 0x88888889
imul r8d
add edx, r8d
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x3c
lea rdx, [rbp + 0x6f]
sub r8d, ecx
lea rcx, [rbp - 0x19]
mov word [rbp - 0xb], r8w
call qword [sym.imp.kernel32.dll_SystemTimeToFileTime]
movaps xmm7, xmmword [rsp + 0x80]
movaps xmm6, xmmword [rsp + 0x90]
test eax, eax
je 0x14020456e
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1402044f7
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1402044f7
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x3afbe5c4
lea rcx, [rbx + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1402044f2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x1402044d0
cmp r8d, 0x43f218fb
je 0x1402044fc
test r9d, r9d
jne 0x1402044b0
mov rax, qword [rax]
jmp 0x140204480
mov ecx, dword [rdi + 0x24]
lea r8, [rbp + 0x6f]
add rcx, r10
movzx edx, word [rcx + r9*2]
lea r9, [rbp + 0x6f]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rdx, [rbp + 0x6f]
add rax, r10
mov rcx, rsi
call rax
jmp 0x14020456e
call qword [sym.imp.kernel32.dll_GetLastError]
movdqa xmm0, xmmword [0x1404d0300]
mov r8d, eax
xor eax, eax
mov dword [rbp + 7], 0x337a6579
mov byte [rbp + 0xf], al
movdqu xmmword [rbp - 9], xmm0
mov dword [rbp + 0xb], 0x4f336d24
nop
movsxd rax, edi
xor byte [rbp + rax - 9], dil
inc edi
cmp edi, 0x18
jb 0x140204550
lea rdx, [rbp - 9]
mov byte [rbp + 0xf], 0
xor ecx, ecx
call fcn.1401a7f70
mov rbx, qword [rsp + 0xc0]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret