Function at 0x1400015f0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by fnv-1a hash
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rax, qword [0x140071d68]
test rax, rax
jne 0x1400016f8
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rdx, qword [rax]
mov rcx, qword [rdx + 0x30]
xor eax, eax
mov r8, rdx
nop dword [rax]
movsxd r9, dword [rcx + 0x3c]
mov r9d, dword [rcx + r9 + 0x88]
test r9, r9
je 0x1400016c0
mov r10d, dword [rcx + r9 + 0x18]
test r10, r10
je 0x1400016c0
mov r11d, dword [rcx + r9 + 0x20]
add r11, rcx
lea rsi, [rcx + 1]
jmp 0x140001665
test rdi, rdi
je 0x1400016c0
dec r10
mov edi, r10d
mov ebx, dword [r11 + rdi*4]
movzx ebp, byte [rcx + rbx]
test bpl, bpl
je 0x140001660
add rbx, rsi
mov r14d, 0x811c9dc5
nop word cs:[rax + rax]
movsx ebp, bpl
xor ebp, r14d
imul r14d, ebp, 0x1000193
movzx ebp, byte [rbx]
inc rbx
test bpl, bpl
jne 0x140001690
cmp r14d, 0x53b2070f
jne 0x140001660
jmp 0x1400016d7
mov r8, qword [r8]
cmp r8, rdx
je 0x1400016f1
mov rcx, qword [r8 + 0x30]
test rcx, rcx
jne 0x140001630
jmp 0x1400016f1
mov eax, dword [rcx + r9 + 0x1c]
mov edx, dword [rcx + r9 + 0x24]
add rax, rcx
add rdx, rcx
movzx edx, word [rdx + rdi*2]
mov eax, dword [rax + rdx*4]
add rax, rcx
mov qword [0x140071d68], rax
lea rcx, str.win32u.dll
call rax
mov rsi, rax
mov rax, qword [0x140071d70]
test rax, rax
jne 0x140001808
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rdx, qword [rax]
mov rcx, qword [rdx + 0x30]
xor eax, eax
mov r8, rdx
nop word cs:[rax + rax]
movsxd r9, dword [rcx + 0x3c]
mov r9d, dword [rcx + r9 + 0x88]
test r9, r9
je 0x1400017d0
mov r10d, dword [rcx + r9 + 0x18]
test r10, r10
je 0x1400017d0
mov r11d, dword [rcx + r9 + 0x20]
add r11, rcx
lea rdi, [rcx + 1]
jmp 0x140001775
test rbx, rbx
je 0x1400017d0
dec r10
mov ebx, r10d
mov r14d, dword [r11 + rbx*4]
movzx ebp, byte [rcx + r14]
test bpl, bpl
je 0x140001770
add r14, rdi
mov r15d, 0x811c9dc5
nop word cs:[rax + rax]
movsx ebp, bpl
xor ebp, r15d
imul r15d, ebp, 0x1000193
movzx ebp, byte [r14]
inc r14
test bpl, bpl
jne 0x1400017a0
cmp r15d, 0xf8f45725
jne 0x140001770
jmp 0x1400017e7
mov r8, qword [r8]
cmp r8, rdx
je 0x140001801
mov rcx, qword [r8 + 0x30]
test rcx, rcx
jne 0x140001740
jmp 0x140001801
mov eax, dword [rcx + r9 + 0x1c]
mov edx, dword [rcx + r9 + 0x24]
add rax, rcx
add rdx, rcx
movzx edx, word [rdx + rbx*2]
mov eax, dword [rax + rdx*4]
add rax, rcx
mov qword [0x140071d70], rax
lea rdx, str.NtUserInjectMouseInput
mov rcx, rsi
call rax
mov rdi, rax
test rax, rax
je 0x1400018e0
mov qword [0x140071d50], rdi
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
nop dword [rax + rax]
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x140001840
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x140001840
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
jmp 0x140001875
test r11, r11
je 0x140001840
dec r8
mov r11d, r8d
mov ebx, dword [r9 + r11*4]
movzx ebp, byte [rax + rbx]
test bpl, bpl
je 0x140001870
add rbx, r10
mov r14d, 0x811c9dc5
nop word cs:[rax + rax]
movsx ebp, bpl
xor ebp, r14d
imul r14d, ebp, 0x1000193
movzx ebp, byte [rbx]
inc rbx
test bpl, bpl
jne 0x1400018a0
cmp r14d, 0xab45c5ee
jne 0x140001870
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
mov rcx, rsi
call rdx
test rdi, rdi
setne al
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret