Function at 0x1400016d4
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x68], rax
cmp qword [0x140004058], 0
mov r14, rcx
mov qword [rsp + 0x38], rcx
jne 0x140001716
call fcn.140001b78
cmp qword [0x140004080], 0
jne 0x140001725
call fcn.140001b44
mov rax, qword [0x1400040a8]
mov ecx, 0x5a4d
movabs rdi, 0x100000001b3
mov r8d, 0x8664
movabs r9, 0xcbf29ce484222325
movabs r10, 0x9be7f70164f3dbf0
test rax, rax
jne 0x14000188a
mov rdx, qword [0x140004088]
test rdx, rdx
jne 0x1400017f9
sidt [rsp + 0x48]
mov rax, qword [rsp + 0x4a]
test rax, rax
jne 0x14000177e
int3
mov edx, dword [rax + 8]
movzx eax, word [rax + 6]
shl rdx, 0x10
or rdx, rax
and rdx, 0xffffffffffffffe0
shl rdx, 0x10
cmp word [rdx], cx
jne 0x1400017e9
movsxd rax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x1400017e9
cmp word [rax + rdx + 4], r8w
jne 0x1400017e9
mov eax, dword [rax + rdx + 0x88]
mov r8, r9
mov ecx, dword [rax + rdx + 0xc]
add rcx, rdx
mov al, byte [rcx]
test al, al
je 0x1400017de
inc rcx
movsx rax, al
xor r8, rax
imul r8, rdi
mov al, byte [rcx]
test al, al
jne 0x1400017c5
cmp r8, r10
je 0x1400017f2
mov r8d, 0x8664
mov ecx, 0x5a4d
sub rdx, 0x200000
jmp 0x140001794
mov qword [0x140004088], rdx
movsxd rax, dword [rdx + 0x3c]
mov ecx, dword [rax + rdx + 0x88]
add rcx, rdx
mov r10d, dword [rcx + 0x1c]
mov r8d, dword [rcx + 0x20]
add r10, rdx
mov r11d, dword [rcx + 0x24]
add r8, rdx
mov ebx, dword [rcx + 0x18]
add r11, rdx
xor edx, edx
test ebx, ebx
je 0x140001880
mov ecx, dword [r8]
add rcx, qword [0x140004088]
mov al, byte [rcx]
test al, al
je 0x140001858
inc rcx
movsx rax, al
xor r9, rax
imul r9, rdi
mov al, byte [rcx]
test al, al
jne 0x140001835
movabs rax, 0x8a0ab57e2bf51c65
cmp r9, rax
je 0x14000186e
inc edx
add r8, 4
cmp edx, ebx
jae 0x140001880
movabs r9, 0xcbf29ce484222325
jmp 0x140001825
movzx ecx, word [r11 + rdx*2]
mov eax, dword [r10 + rcx*4]
add rax, qword [0x140004088]
jmp 0x140001883
int3
mov qword [0x1400040a8], rax
call qword [0x140003078]
mov rdx, qword [0x140004078]
xor r12d, r12d
mov rcx, qword [0x140004070]
mov dword [rsp + 0x20], r12d
lea r15, [rax + 8]
lea r13, [rcx + rdx*8]
mov qword [rsp + 0x28], r13
mov rbx, qword [r15 - 8]
test rbx, rbx
jne 0x1400018c5
cmp qword [r15], rbx
je 0x140001b17
mov rbp, qword [r15]
sar rbp, 0xc
sar rbx, 0xc
add rbp, rbx
mov qword [rsp + 0x30], rbp
cmp rbx, rbp
jge 0x140001af3
lea rdi, [rbx + rbx*2]
shl rdi, 4
mov rax, qword [0x140004080]
mov rsi, qword [rdi + rax]
cmp rsi, 2
jb 0x140001ac3
cmp qword [rdi + rax + 8], r13
jne 0x140001ac3
shr rsi, 0xd
movabs rax, 0xffff800000000000
or rsi, rax
mov rax, rbx
shl rax, 0xc
mov qword [0x140004050], rax
mov rax, qword [0x1400040b0]
test rax, rax
jne 0x140001aa1
mov rdx, qword [0x140004088]
test rdx, rdx
jne 0x140001a0d
sidt [rsp + 0x58]
mov rax, qword [rsp + 0x5a]
test rax, rax
jne 0x140001958
int3
mov edx, dword [rax + 8]
mov ebp, 0x8664
movzx eax, word [rax + 6]
movabs r13, 0xcbf29ce484222325
shl rdx, 0x10
movabs r12, 0x9be7f70164f3dbf0
or rdx, rax
mov eax, 0x5a4d
and rdx, 0xffffffffffffffe0
shl rdx, 0x10
cmp word [rdx], ax
jne 0x1400019ee
movsxd rax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x1400019e9
cmp word [rax + rdx + 4], bp
jne 0x1400019e9
mov eax, dword [rax + rdx + 0x88]
mov r8, r13
mov ecx, dword [rax + rdx + 0xc]
add rcx, rdx
mov al, byte [rcx]
test al, al
je 0x1400019e9
movabs r13, 0x100000001b3
inc rcx
movsx rax, al
xor r8, rax
imul r8, r13
mov al, byte [rcx]
test al, al
jne 0x1400019c6
movabs r13, 0xcbf29ce484222325
cmp r8, r12
je 0x1400019f7
mov eax, 0x5a4d
sub rdx, 0x200000
jmp 0x14000198c
mov rbp, qword [rsp + 0x30]
mov r12d, dword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov qword [0x140004088], rdx
movsxd rax, dword [rdx + 0x3c]
mov ecx, dword [rax + rdx + 0x88]
add rcx, rdx
mov r10d, dword [rcx + 0x1c]
mov r8d, dword [rcx + 0x20]
add r10, rdx
mov r11d, dword [rcx + 0x24]
add r8, rdx
mov r14d, dword [rcx + 0x18]
add r11, rdx
xor edx, edx
test r14d, r14d
je 0x140001a92
mov ecx, dword [r8]
movabs r9, 0xcbf29ce484222325
add rcx, qword [0x140004088]
mov al, byte [rcx]
test al, al
je 0x140001a87
movabs r13, 0x100000001b3
inc rcx
movsx rax, al
xor r9, rax
imul r9, r13
mov al, byte [rcx]
test al, al
jne 0x140001a5f
mov r13, qword [rsp + 0x28]
movabs rax, 0x8a9495b5004b3e52
cmp r9, rax
je 0x140001ad5
inc edx
add r8, 4
cmp edx, r14d
jb 0x140001a3b
int3
mov r14, qword [rsp + 0x38]
mov qword [0x1400040b0], rax
mov ecx, dword [r14]
lea rdx, [rsp + 0x40]
call qword [0x140003078]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140001ac3
cmp rsi, qword [rsp + 0x40]
je 0x140001ae7
inc rbx
add rdi, 0x30
cmp rbx, rbp
jl 0x1400018e9
jmp 0x140001af3
movzx ecx, word [r11 + rdx*2]
mov eax, dword [r10 + rcx*4]
add rax, qword [0x140004088]
jmp 0x140001a95
mov rcx, qword [0x140004050]
test rcx, rcx
jne 0x140001b0e
inc r12d
add r15, 0x10
mov dword [rsp + 0x20], r12d
cmp r12d, 0xc8
jl 0x1400018b3
jmp 0x140001b17
mov rax, qword [r14 + 8]
mov qword [rax], rcx
xor eax, eax
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400024b0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret