Function at 0x140004090
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov r14, rdx
mov qword [rsp + 0x20], rdx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x140004159
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x140004159
mov ebp, dword [rsi + 0x20]
nop dword [rax]
nop word [rax + rax]
dec r11d
lea rcx, [rbx + r11*4]
mov r9d, dword [rcx + rbp]
add r9, rbx
mov r10d, 0xa4656dd5
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x140004154
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x140004120
cmp r10d, 0xe2aa3b1f
je 0x140004161
test r11d, r11d
jne 0x140004100
mov rax, qword [rax]
jmp 0x1400040d0
mov ecx, dword [rsi + 0x1c]
add rcx, rbx
mov eax, dword [rsi + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov edx, dword [rcx + rax*4]
add rdx, rbx
lea rcx, str.user32.dll
call rdx
mov r15, rax
mov qword [rsp + 0x28], rax
mov rbx, qword [0x140161e90]
test rbx, rbx
jne 0x140004381
xor ebp, ebp
mov edi, 0xfb297f00
mov rcx, qword gs:[0x60]
mov rdx, qword [rcx + 0x18]
mov rcx, qword [rdx + 0x10]
mov r13, qword [rcx]
mov r14, r13
nop word [rax + rax]
movups xmm0, xmmword [r14 + 0x58]
movups xmmword [rsp + 0x30], xmm0
movd eax, xmm0
sub ax, 8
test ebp, ebp
je 0x14000421e
mov r8, qword [rsp + 0x38]
movzx eax, ax
shr rax, 1
lea r10, [r8 + rax*2]
mov r9d, 0x335372d1
cmp r8, r10
je 0x140004215
movsx eax, byte [r8]
mov ecx, eax
sub al, 0x41
mov edx, ecx
or edx, 0x20
cmp al, 0x19
cmova edx, ecx
xor edx, r9d
imul r9d, edx, 0x1000193
add r8, 2
cmp r8, r10
jne 0x1400041f0
cmp r9d, ebp
jne 0x140004358
mov r11, qword [r14 + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov rcx, qword [rax + r11 + 0x88]
mov r12, rcx
shr r12, 0x20
mov esi, ecx
add rsi, r11
cmp rsi, r11
je 0x140004358
mov r10d, dword [rsi + 0x18]
test r10d, r10d
je 0x140004358
mov r15d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r10d
lea rax, [r11 + r10*4]
mov edx, dword [rax + r15]
add rdx, r11
mov r9d, 0x335372d1
movzx r8d, byte [rdx]
inc rdx
test r8b, r8b
je 0x1400042ab
movsx eax, r8b
sub r8b, 0x41
mov ecx, eax
or ecx, 0x20
cmp r8b, 0x19
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
movzx r8d, byte [rdx]
lea rdx, [rdx + 1]
test r8b, r8b
jne 0x140004280
cmp r9d, edi
je 0x1400042ba
test r10d, r10d
jne 0x140004260
jmp 0x140004358
mov ecx, dword [rsi + 0x1c]
add rcx, r11
mov eax, dword [rsi + 0x24]
add rax, r11
movzx eax, word [rax + r10*2]
mov ebx, dword [rcx + rax*4]
add rbx, r11
cmp rbx, rsi
jbe 0x140004370
lea rax, [r12 + rsi]
cmp rbx, rax
jae 0x140004370
mov ebp, 0x335372d1
mov edi, ebp
movzx edx, byte [rbx]
cmp dl, 0x2e
je 0x140004324
nop word [rax + rax]
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, ebp
imul ebp, ecx, 0x1000193
inc rbx
movzx edx, byte [rbx]
cmp dl, 0x2e
jne 0x140004300
inc rbx
movzx edx, byte [rbx]
test dl, dl
je 0x140004354
nop
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, edi
imul edi, ecx, 0x1000193
lea rbx, [rbx + 1]
movzx edx, byte [rbx]
test dl, dl
jne 0x140004330
mov r14, qword [r13]
mov rax, qword [r14]
mov r14, rax
cmp rax, r13
je 0x14000436e
cmp qword [rax + 0x30], 0
jne 0x1400041c0
xor ebx, ebx
mov qword [0x140161e90], rbx
mov r14, qword [rsp + 0x20]
mov r15, qword [rsp + 0x28]
lea rdx, [rsp + 0x40]
call fcn.140003c40
nop
cmp qword [rax + 0x18], 0x10
jb 0x140004396
mov rax, qword [rax]
mov r9d, 0x1010
mov r8, rax
mov rdx, r14
xor ecx, ecx
call rbx
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x1400043e7
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400043e2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400043e2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005267c
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x140004488
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x140004488
mov ebp, dword [rsi + 0x20]
nop dword [rax]
nop word [rax + rax]
dec r11d
lea rcx, [rbx + r11*4]
mov r9d, dword [rcx + rbp]
add r9, rbx
mov r10d, 0xb2567955
movzx ecx, byte [r9]
inc r9
test cl, cl
je 0x140004483
nop
movsx edx, cl
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
movzx ecx, byte [r9]
lea r9, [r9 + 1]
test cl, cl
jne 0x140004450
cmp r10d, 0xca20eede
je 0x140004490
test r11d, r11d
jne 0x140004430
mov rax, qword [rax]
jmp 0x140004400
mov ecx, dword [rsi + 0x24]
add rcx, rbx
movzx edx, word [rcx + r11*2]
mov ecx, dword [rsi + 0x1c]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
add rax, rbx
mov rcx, r15
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
jmp rax