Function at 0x1400069d0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x240
lea rbp, [rsp + 0x50]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x14002b040]
xor rax, rsp
mov qword [rbp + 0x1e0], rax
mov dword [rbp], 1
movabs rsi, 0x1fcd8cdccff8044
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
movabs r15, 0x6c20203827743287
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
movabs rax, 0x6d98f6a1a09bf42a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x140], rax
movabs rax, 0x6c202038277432eb
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x148], rax
movdqa xmm0, xmmword [rbp + 0x60]
xorps xmm0, xmmword [rbp + 0x140]
movdqa xmmword [rbp + 0x60], xmm0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140006b06
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140006b06
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x58825fb7
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140006b01
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140006ae0
cmp r8d, 0xf4a40da9
je 0x140006b0b
test r9d, r9d
jne 0x140006ac0
mov rax, qword [rax]
jmp 0x140006a90
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
lea rcx, [rbp + 0x60]
call rdx
mov rcx, rax
lea r14, [0x1402af5e8]
movabs rdi, 0x3ef99c5d4ee9c59
movabs rax, 0x24e184c4d5ca8064
movabs rdx, 0x5544155551b5485
movabs r8, 0x51b1a758113b7083
movabs r9, 0x568121ceac43e0de
movabs r12, 0x22d4c437636b1eec
movabs r13, 0x568121ceac43e0ad
test rcx, rcx
je 0x140006e6b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
mov qword [rbp], r8
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
mov qword [rbp], r9
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
movabs rax, 0x6d98f6a1a09bf42a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x160], rax
movabs rax, 0x6c202038277432eb
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x168], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x170], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x178], rax
vmovdqu ymm0, ymmword [rbp + 0x80]
vpxor ymm1, ymm0, ymmword [rbp + 0x160]
vmovdqa ymmword [rbp + 0x80], ymm1
lea rdx, [rbp + 0x80]
vzeroupper
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140006e6b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rax, [rbp + 0xe8]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp + 0xf0]
lea edx, [r9 + 0x1b]
call rbx
test eax, eax
js 0x140006e6b
cmp dword [rbp + 0xf0], 0
jne 0x140006e6b
mov rdx, r14
lea rcx, [rbp + 0xc0]
call fcn.140003900
mov r8, rax
lea rdx, [rbp + 0xf8]
lea rcx, [0x1402af448]
call fcn.140002120
nop
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
movabs rax, 0x5d00541507071fcb
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
movabs rax, 0x6d98f6a1a09bf42a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x180], rax
movabs rax, 0x6c202038277432eb
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x188], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x190], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x198], rax
vmovdqu ymm0, ymmword [rbp + 0xa0]
vpxor ymm1, ymm0, ymmword [rbp + 0x180]
vmovdqa ymmword [rbp + 0xa0], ymm1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
vzeroupper
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140006de6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140006de6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0xee6a4119
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140006de1
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140006dc0
cmp r8d, 0x9d511aec
je 0x140006deb
test r9d, r9d
jne 0x140006da0
mov rax, qword [rax]
jmp 0x140006d70
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov r8d, dword [rcx + rax*4]
add r8, r10
xor edx, edx
lea rcx, [rbp + 0xa0]
call r8
nop
mov rdx, qword [rbp + 0x110]
cmp rdx, 0xf
jbe 0x140006e54
inc rdx
mov rcx, qword [rbp + 0xf8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006e4f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006e4f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140017770
movdqa xmm0, xmmword [0x140027060]
movdqu xmmword [rbp + 0x108], xmm0
mov byte [rbp + 0xf8], 0
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x70], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
movabs r15, 0x6d98f6a1a09bf42a
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x150], rax
movabs rsi, 0x6c202038277432eb
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x158], rax
movdqa xmm0, xmmword [rbp + 0x70]
xorps xmm0, xmmword [rbp + 0x150]
movdqa xmmword [rbp + 0x70], xmm0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140006f56
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140006f56
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x65e14894
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140006f51
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140006f30
cmp r8d, 0xc74b0396
je 0x140006f5b
test r9d, r9d
jne 0x140006f10
mov rax, qword [rax]
jmp 0x140006ee0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
lea rcx, [rbp + 0x70]
call rdx
mov r8, rax
test rax, rax
je 0x140007381
movabs rax, 0x24e184c4d5ca8064
mov qword [rbp + 0xe0], rax
mov rcx, qword [rbp + 0xe0]
mov qword [rbp + 0x20], rcx
movabs rax, 0x5544155551b5485
mov qword [rbp + 0xe0], rax
mov rcx, qword [rbp + 0xe0]
mov qword [rbp + 0x28], rcx
movabs rax, 0x51b1a758113b7083
mov qword [rbp + 0xe0], rax
mov rax, qword [rbp + 0xe0]
mov qword [rbp + 0x30], rax
movabs rax, 0x568121ceac43e0de
mov qword [rbp + 0xe0], rax
mov rax, qword [rbp + 0xe0]
mov qword [rbp + 0x38], rax
mov qword [rbp + 0xe0], r15
mov rax, qword [rbp + 0xe0]
mov qword [rbp + 0x1a0], rax
mov qword [rbp + 0xe0], rsi
mov rax, qword [rbp + 0xe0]
mov qword [rbp + 0x1a8], rax
mov qword [rbp + 0xe0], r12
mov rax, qword [rbp + 0xe0]
mov qword [rbp + 0x1b0], rax
mov qword [rbp + 0xe0], r13
mov rax, qword [rbp + 0xe0]
mov qword [rbp + 0x1b8], rax
vmovdqu ymm0, ymmword [rbp + 0x20]
vpxor ymm1, ymm0, ymmword [rbp + 0x1a0]
vmovdqa ymmword [rbp + 0x20], ymm1
lea rdx, [rbp + 0x20]
mov rcx, r8
vzeroupper
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140007381
xor edi, edi
mov qword [rbp + 0xe0], rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rax, [rbp + 0xf4]
mov qword [rsp + 0x20], rax
lea r9d, [rdi + 8]
lea r8, [rbp + 0xe0]
lea edx, [rdi + 0x1e]
call rbx
test eax, eax
js 0x140007381
cmp qword [rbp + 0xe0], rdi
je 0x140007381
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], rdi
mov qword [rbp + 0x58], rdi
mov rsi, qword [0x1402af5f8]
cmp qword [0x1402af600], 0xf
cmova r14, qword [0x1402af5e8]
movabs rbx, 0x7fffffffffffffff
cmp rsi, rbx
ja 0x1400073b1
mov qword [rbp + 0x58], 0xf
cmp rsi, 0xf
ja 0x140007111
mov qword [rbp + 0x50], rsi
movups xmm0, xmmword [r14]
movups xmmword [rbp + 0x40], xmm0
jmp 0x1400071a0
mov rax, rsi
or rax, 0xf
cmp rax, rbx
jbe 0x140007146
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400178f4
test rax, rax
je 0x140007171
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140007185
mov rbx, rax
mov ecx, 0x16
cmp rax, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140007178
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400073b7
jmp 0x14000712b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140007185
call fcn.1400178f4
mov rdi, rax
mov qword [rbp + 0x40], rdi
mov qword [rbp + 0x50], rsi
mov qword [rbp + 0x58], rbx
lea r8, [rsi + 1]
mov rdx, r14
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
lea r8, [rbp + 0x40]
lea rdx, [rbp + 0x118]
lea rcx, [0x1402af448]
call fcn.140002120
nop
movabs rax, 0x3ef99c5d4ee9c59
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x20], rax
movabs rax, 0x5d00541507071fcb
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x28], rax
mov qword [rbp + 0xe8], r12
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x30], rax
mov qword [rbp + 0xe8], r13
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x38], rax
mov qword [rbp + 0xe8], r15
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x1c0], rax
movabs rax, 0x6c202038277432eb
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x1c8], rax
mov qword [rbp + 0xe8], r12
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x1d0], rax
mov qword [rbp + 0xe8], r13
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x1d8], rax
vmovdqu ymm0, ymmword [rbp + 0x1c0]
vpxor ymm0, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
vzeroupper
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140007316
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140007316
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
mov r8d, 0x2da8fb7e
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140007311
nop
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x1400072f0
cmp r8d, 0x1722aca1
je 0x14000731b
test r9d, r9d
jne 0x1400072d0
mov rax, qword [rax]
jmp 0x1400072a0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov r8d, dword [rcx + rax*4]
add r8, r10
xor edx, edx
lea rcx, [rbp + 0x20]
call r8
nop
mov rdx, qword [rbp + 0x130]
cmp rdx, 0xf
jbe 0x140007381
inc rdx
mov rcx, qword [rbp + 0x118]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000737c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000737c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140017770
mov rcx, qword [rbp + 0x1e0]
xor rcx, rsp
call fcn.140017750
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140002000
int3
call fcn.140001f60
int3