Function at 0x14005b8f0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xc0
mov rax, qword [0x1400af040]
xor rax, rsp
mov qword [rbp - 1], rax
mov r13, qword [rbp + 0x8f]
xor ebx, ebx
mov eax, 0x5a4d
mov qword [rbp - 0x61], rcx
mov r15, rdx
mov r14, rcx
mov qword [rbp - 0x49], rbx
mov qword [rbp - 0x39], rbx
cmp word [rdx], ax
jne 0x14005be43
movsxd rsi, dword [rdx + 0x3c]
add rsi, rdx
cmp dword [rsi], 0x4550
jne 0x14005be43
mov eax, 0x20b
cmp word [rsi + 0x18], ax
jne 0x14005be43
mov r12d, dword [rsi + 0x50]
lea r9d, [rbx + 4]
mov edx, r12d
xor ecx, ecx
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp - 0x79], rax
test rax, rax
je 0x14005be43
movzx ecx, word [rsi + 0x14]
lea r8, [rbx - 1]
mov r9d, ebx
mov edx, ebx
mov eax, dword [rcx + rsi + 0x24]
sub r12d, eax
mov ecx, r12d
and rcx, 0xfffffffffffff000
mov dword [rbp - 0x51], eax
add rcx, 0x1000
mov edi, r12d
mov qword [rsp + 0x20], rcx
mov rcx, r14
call fcn.140053fb0
mov qword [rbp - 0x71], rax
test rax, rax
je 0x14005ba3f
lea r8, [rax + 0x28]
mov dword [rbp - 0x59], ebx
lea r9d, [rbx + 4]
mov rcx, r14
lea rdx, [rbp - 0x59]
call fcn.140053d40
test al, al
je 0x14005ba3f
mov ecx, dword [rbp - 0x59]
cmp rcx, rdi
mov rdi, qword [rbp - 0x71]
jb 0x14005ba29
mov rdx, rdi
mov rcx, r14
call fcn.140054180
mov qword [rbp - 0x69], rax
test rax, rax
je 0x14005ba29
mov rdx, rdi
mov rcx, r14
call fcn.140054350
test al, al
jne 0x14005bad0
mov rdx, qword [rbp - 0x69]
mov r8, rdi
mov rcx, r14
call fcn.140054510
mov rdx, rdi
mov rcx, r14
call fcn.1400546b0
mov rdx, rdi
mov rcx, r14
call fcn.140054850
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14005bacb
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14005bacb
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x996957b4
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14005bac6
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x14005baa0
cmp r8d, 0x47c31295
je 0x14005be1e
test r9d, r9d
jne 0x14005ba80
mov rax, qword [rax]
jmp 0x14005ba50
mov r8d, dword [rsi + 0x54]
mov rdx, r15
mov rcx, qword [rbp - 0x79]
call sub.VCRUNTIME140.dll_memcpy
movzx edi, word [rsi + 0x14]
mov r14d, ebx
add rdi, 0x28
cmp bx, word [rsi + 6]
jae 0x14005bb2f
mov rbx, qword [rbp - 0x79]
add rdi, rsi
nop dword [rax + rax]
test dword [rdi + 0x14], 0x80
ja 0x14005bb1d
mov edx, dword [rdi + 4]
mov ecx, dword [rdi - 4]
add rdx, r15
mov r8d, dword [rdi]
add rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
movzx eax, word [rsi + 6]
inc r14d
add rdi, 0x28
cmp r14d, eax
jl 0x14005bb00
xor ebx, ebx
mov r15d, dword [rbp - 0x51]
lea rcx, [rbp - 0x29]
mov r14, qword [rbp - 0x69]
mov rdx, qword [rbp - 0x79]
sub r14, r15
mov rdi, r14
sub rdi, qword [rsi + 0x30]
call fcn.14005ca50
mov rdx, rdi
mov rcx, rax
call fcn.14005be70
mov rdi, qword [rbp - 0x79]
mov rdx, r14
mov rcx, rdi
call fcn.14005bf70
test al, al
je 0x14005be43
mov rdx, rdi
lea rcx, [rbp - 0x29]
call fcn.14005cba0
mov rcx, qword [rbp - 0x61]
mov rdx, rax
call fcn.14005c1a0
test al, al
je 0x14005bd19
mov rax, qword [rbp - 0x79]
add rax, r15
mov edi, r12d
mov r15, qword [rbp - 0x61]
je 0x14005bd27
test r12d, r12d
mov r12, qword [rbp - 0x69]
je 0x14005bd2b
mov qword [rsp + 0x38], rbx
lea r8, [rbp - 0x29]
mov qword [rbp - 0x19], rax
mov r9d, 0x28
lea rax, [rbp - 0x51]
mov qword [rbp - 0x21], rbx
mov qword [rsp + 0x30], rax
mov edx, 0x80862007
mov dword [rsp + 0x28], ebx
mov rcx, r15
mov qword [rsp + 0x20], rbx
mov qword [rbp - 0x29], 0x33
mov qword [rbp - 0x11], r12
mov qword [rbp - 9], rdi
mov dword [rbp - 0x51], ebx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x14005bd2b
mov esi, dword [rsi + 0x28]
lea rdx, [rbp - 0x49]
add rsi, r14
lea rcx, [rbp - 0x39]
mov r14, qword [rbp - 0x71]
mov r9d, edi
mov r8, r12
mov qword [rsp + 0x20], r14
call fcn.14006dba0
test al, al
je 0x14005bd2f
mov rax, qword [rbp - 0x49]
lea rdx, [rbp - 0x59]
mov r9, r12
mov qword [rsp + 0x20], rax
mov r8, rsi
mov dword [rbp - 0x59], ebx
mov rcx, r15
call fcn.14005c400
test al, al
je 0x14005bd2f
test r13, r13
je 0x14005bc5f
mov eax, dword [rbp - 0x59]
mov dword [r13], eax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov r11d, dword [rcx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x14005bce5
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x14005bce5
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [rbx + r9*4]
mov r8d, dword [rdx + r10]
mov edx, 0x13835969
add r8, r10
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x14005bce0
nop
movsx ecx, cl
lea r8, [r8 + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8 - 1]
test cl, cl
jne 0x14005bcc0
cmp edx, 0xe228f826
je 0x14005bcea
test r9d, r9d
jne 0x14005bca0
mov rax, qword [rax]
jmp 0x14005bc70
mov eax, dword [r11 + 0x24]
mov r8d, 0x8000
mov ecx, dword [r11 + 0x1c]
add rax, r10
add rcx, r10
movzx edx, word [rax + r9*2]
mov eax, dword [rcx + rdx*4]
xor edx, edx
mov rcx, qword [rbp - 0x79]
add rax, r10
call rax
mov rax, r12
jmp 0x14005be45
mov r15, qword [rbp - 0x61]
mov r14, qword [rbp - 0x71]
mov r12, qword [rbp - 0x69]
jmp 0x14005bd33
mov r12, qword [rbp - 0x69]
mov r14, qword [rbp - 0x71]
mov rdi, qword [rbp - 0x79]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov r11d, dword [rcx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x14005bdc5
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x14005bdc5
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [rbx + r9*4]
mov r8d, dword [rdx + r10]
mov edx, 0xf6f57db8
add r8, r10
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x14005bdc0
nop
movsx ecx, cl
lea r8, [r8 + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8 - 1]
test cl, cl
jne 0x14005bda0
cmp edx, 0x4a13c239
je 0x14005bdca
test r9d, r9d
jne 0x14005bd80
mov rax, qword [rax]
jmp 0x14005bd50
mov eax, dword [r11 + 0x24]
mov r8d, 0x8000
mov ecx, dword [r11 + 0x1c]
add rax, r10
add rcx, r10
movzx edx, word [rax + r9*2]
mov eax, dword [rcx + rdx*4]
xor edx, edx
add rax, r10
mov rcx, rdi
call rax
mov r8, r14
mov rdx, r12
mov rcx, r15
call fcn.140054510
test al, al
je 0x14005be43
mov rdx, r14
mov rcx, r15
call fcn.1400546b0
test al, al
je 0x14005be43
mov rdx, r14
mov rcx, r15
call fcn.140054850
jmp 0x14005be43
mov ecx, dword [rbx + 0x24]
mov r8d, 0x8000
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor edx, edx
mov rcx, qword [rbp - 0x79]
add rax, r10
call rax
xor eax, eax
mov rcx, qword [rbp - 1]
xor rcx, rsp
call fcn.14007f7f0
mov rbx, qword [rsp + 0x110]
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret