Function at 0x1403973a0
Capabilities:
Access peb ldr_data
Encode data using xor
Generate random numbers using a mersenne twister
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x1430]
mov eax, 0x1530
call fcn.140419e10
sub rsp, rax
mov rdi, rdx
xor r12d, r12d
mov dword [rsp + 0x30], r12d
call fcn.140418f04
mov dword [rbp + 0x1424], 0xffffffff
mov dword [rbp + 0xa4], eax
lea edx, [r12 + 1]
nop dword [rax]
nop word [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rbp + rdx*4 + 0xa4], eax
inc rdx
cmp rdx, 0x270
jb 0x140397400
mov dword [rbp + 0xa0], 0x270
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r12
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], r12b
mov dword [rsp + 0x30], 1
mov esi, 0xc8
movzx ebx, byte [rbp + 0x1480]
nop word [rax + rax]
lea rcx, [rbp + 0xa0]
call fcn.14039b8e0
mov ecx, eax
imul rdx, rcx, 0x5e
cmp edx, 0x29
ja 0x140397497
nop word [rax + rax]
lea rcx, [rbp + 0xa0]
call fcn.14039b8e0
mov ecx, eax
imul rdx, rcx, 0x5e
cmp edx, 0x2a
jb 0x140397480
shr rdx, 0x20
add dl, 0x21
mov rcx, qword [rdi + 0x10]
mov r8, qword [rdi + 0x18]
cmp rcx, r8
jae 0x1403974c9
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp r8, 0x10
jb 0x1403974bf
mov rax, qword [rdi]
mov byte [rax + rcx], dl
mov byte [rax + rcx + 1], 0
jmp 0x1403974de
movzx r9d, dl
movzx r8d, bl
mov edx, 1
mov rcx, rdi
call fcn.14035d130
sub rsi, 1
jne 0x140397460
cmp qword [rdi + 0x10], 0xc8
je 0x140397c0a
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], r12
mov qword [rbp + 0x48], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x30], sil
movabs rax, 0xaaaf1044c46d906
mov qword [rbp + 0x1470], rax
mov rax, qword [rbp + 0x1470]
mov qword [rsp + 0x70], rax
movabs rax, 0xf9b2c4036dbd008d
mov qword [rbp + 0x1470], rax
mov rax, qword [rbp + 0x1470]
mov qword [rsp + 0x78], rax
movabs r14, 0xf6324b730ee9812f
mov qword [rbp + 0x1470], r14
mov rax, qword [rbp + 0x1470]
mov qword [rbp - 0x80], rax
movabs r15, 0xdec0f87aa29b7310
mov qword [rbp + 0x1470], r15
mov rax, qword [rbp + 0x1470]
mov qword [rbp - 0x78], rax
movabs rbx, 0x2ade92653828b645
mov qword [rbp + 0x1470], rbx
mov rax, qword [rbp + 0x1470]
mov qword [rbp + 0x10], rax
movabs rsi, 0xd7c6b66c1dcd75fe
mov qword [rbp + 0x1470], rsi
mov rax, qword [rbp + 0x1470]
mov qword [rbp + 0x18], rax
mov qword [rbp + 0x1470], r14
mov rax, qword [rbp + 0x1470]
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x1470], r15
mov rax, qword [rbp + 0x1470]
mov qword [rbp + 0x28], rax
movdqa xmm0, xmmword [rsp + 0x70]
pxor xmm0, xmmword [rbp + 0x10]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [rbp - 0x80]
pxor xmm1, xmmword [rbp + 0x20]
movdqa xmmword [rbp - 0x80], xmm1
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], r12
lea rax, [rsp + 0x70]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140397620
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14035aa00
nop
mov rcx, qword [0x14049bfa8]
movabs rax, 0x59acf7166d748c06
mov qword [rbp + 0x1470], rax
mov rax, qword [rbp + 0x1470]
mov qword [rbp - 0x70], rax
movabs rax, 0xb282ea1e78be20a2
mov qword [rbp + 0x1470], rax
mov rax, qword [rbp + 0x1470]
mov qword [rbp - 0x68], rax
movabs rax, 0x83531703619dea5c
mov qword [rbp + 0x1470], rax
mov rax, qword [rbp + 0x1470]
mov qword [rbp - 0x60], rax
movabs rax, 0x82b3880ac3bb1b64
mov qword [rbp + 0x1470], rax
mov rax, qword [rbp + 0x1470]
mov qword [rbp - 0x58], rax
movabs rax, 0x3d76346948f226a8
mov qword [rbp + 0x1470], rax
mov rax, qword [rbp + 0x1470]
mov qword [rbp - 0x50], rax
movabs rax, 0x9ee5275c77b2d636
mov qword [rbp + 0x1470], rax
mov rax, qword [rbp + 0x1470]
mov qword [rbp - 0x48], rax
movabs rax, 0x4b0081e48b5c6e07
mov qword [rbp + 0x1470], rax
mov rax, qword [rbp + 0x1470]
mov qword [rbp - 0x40], rax
movabs rax, 0x12f7997743e7a2c1
mov qword [rbp + 0x1470], rax
mov rax, qword [rbp + 0x1470]
mov qword [rbp - 0x38], rax
movabs rax, 0x78a9df348a72ddfe
mov qword [rbp + 0x1470], rax
mov rax, qword [rbp + 0x1470]
mov qword [rbp - 0x30], rax
movabs rax, 0x5e0b42a7ebe82dcf
mov qword [rbp + 0x1470], rax
mov rax, qword [rbp + 0x1470]
mov qword [rbp - 0x28], rax
mov qword [rbp + 0x1470], rbx
mov rax, qword [rbp + 0x1470]
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x1470], rsi
mov rax, qword [rbp + 0x1470]
mov qword [rbp + 0x58], rax
mov qword [rbp + 0x1470], r14
mov rax, qword [rbp + 0x1470]
mov qword [rbp + 0x60], rax
mov qword [rbp + 0x1470], r15
mov rax, qword [rbp + 0x1470]
mov qword [rbp + 0x68], rax
movabs rax, 0x55561949208653c9
mov qword [rbp + 0x1470], rax
mov rax, qword [rbp + 0x1470]
mov qword [rbp + 0x70], rax
movabs rax, 0xff8a4b0004c2a242
mov qword [rbp + 0x1470], rax
mov rax, qword [rbp + 0x1470]
mov qword [rbp + 0x78], rax
movabs rax, 0x1763f397d72e0b63
mov qword [rbp + 0x1470], rax
mov rax, qword [rbp + 0x1470]
mov qword [rbp + 0x80], rax
movabs rax, 0x779eed1e2f8ed6b4
mov qword [rbp + 0x1470], rax
mov rax, qword [rbp + 0x1470]
mov qword [rbp + 0x88], rax
movabs rax, 0xcc0b35dfe07818d
mov qword [rbp + 0x1470], rax
mov rax, qword [rbp + 0x1470]
mov qword [rbp + 0x90], rax
movabs rax, 0x5e7b32c4c59b48a6
mov qword [rbp + 0x1470], rax
mov rax, qword [rbp + 0x1470]
mov qword [rbp + 0x98], rax
movdqa xmm0, xmmword [rbp - 0x70]
pxor xmm0, xmmword [rbp + 0x50]
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [rbp - 0x60]
pxor xmm1, xmmword [rbp + 0x60]
movdqa xmmword [rbp - 0x60], xmm1
movdqa xmm0, xmmword [rbp - 0x50]
pxor xmm0, xmmword [rbp + 0x70]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [rbp - 0x40]
pxor xmm1, xmmword [rbp + 0x80]
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmm0, xmmword [rbp + 0x90]
pxor xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp - 0x30], xmm0
mov r9d, 0xfc
lea r8, [rbp - 0x70]
lea rdx, [rbp - 0x20]
call fcn.140398980
nop
lea rdx, [rbp - 0x20]
mov rcx, qword [0x14049bfc0]
call fcn.14035b6c0
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x140397906
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140397901
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140397c25
call fcn.140419458
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x20], 0
movabs rax, 0x4ffefc005c4cc316
mov qword [rbp + 0x1470], rax
mov rax, qword [rbp + 0x1470]
mov qword [rsp + 0x60], rax
movabs rax, 0xd7c6b6426fa2078c
mov qword [rbp + 0x1470], rax
mov rax, qword [rbp + 0x1470]
mov qword [rsp + 0x68], rax
mov qword [rbp + 0x1470], rbx
mov rax, qword [rbp + 0x1470]
mov qword [rbp], rax
mov qword [rbp + 0x1470], rsi
mov rax, qword [rbp + 0x1470]
mov qword [rbp + 8], rax
movdqa xmm0, xmmword [rsp + 0x60]
pxor xmm0, xmmword [rbp]
movdqa xmmword [rsp + 0x60], xmm0
lea r14, [rsp + 0x38]
cmp qword [rsp + 0x50], 0x10
cmovae r14, qword [rsp + 0x38]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov esi, dword [rcx + r11 + 0x88]
add rsi, r11
cmp rsi, r11
je 0x140397a26
mov r9d, dword [rsi + 0x18]
test r9d, r9d
je 0x140397a26
mov ebx, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r11]
add rdx, r11
mov r8d, 0x9c0180c6
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140397a21
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140397a00
cmp r8d, 0x787bef8c
je 0x140397a2b
test r9d, r9d
jne 0x1403979e0
mov rax, qword [rax]
jmp 0x1403979b0
mov ecx, dword [rsi + 0x1c]
add rcx, r11
mov eax, dword [rsi + 0x24]
add rax, r11
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
mov dword [rsp + 0x28], 0xbb8
mov word [rsp + 0x20], r12w
mov r9d, reloc.WS2_32.dll_recv
lea r8, [rsp + 0x60]
mov rdx, r14
xor ecx, ecx
call r10
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov esi, dword [rcx + r10 + 0x88]
add rsi, r10
cmp rsi, r10
je 0x140397af6
mov r9d, dword [rsi + 0x18]
test r9d, r9d
je 0x140397af6
mov ebx, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov ecx, dword [rcx + rbx]
add rcx, r10
mov r8d, 0x9d018259
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140397af1
nop dword [rax]
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x140397ad0
cmp r8d, 0x1f010a6b
je 0x140397afb
test r9d, r9d
jne 0x140397ab0
mov rax, qword [rax]
jmp 0x140397a80
mov edx, dword [rsi + 0x1c]
add rdx, r10
mov eax, dword [rsi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov r8d, dword [rdx + rax*4]
add r8, r10
mov edx, dword [0x7ffe0014]
mov rcx, 0xffffffffffffffff
call r8
mov ecx, 0xa
call fcn.140419954
lea rcx, [rax + 1]
call fcn.140419458
mov ecx, 4
call fcn.1404196c8
mov rbx, rax
mov edx, 4
mov rcx, rax
call fcn.140419458
mov dword [rbx], 0xa
mov ecx, 4
call fcn.1404196c8
mov rbx, rax
mov edx, 4
mov rcx, rax
call fcn.140419458
mov edx, 4
mov rcx, rbx
call fcn.140419458
mov ecx, dword [0x7ffe0014]
int 0x29
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x140397bc0
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140397bbb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140397c2b
call fcn.140419458
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x38], 0
mov rdx, qword [rbp + 0x48]
cmp rdx, 0x10
jb 0x140397c0a
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140397c05
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140397c1f
call fcn.140419458
mov rax, rdi
add rsp, 0x1530
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140428d2c
nop
call fcn.140428d2c
nop
call fcn.140428d2c
int3