Function at 0x140002218
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x278
mov dword [rsp + 0x54], edx
mov rbx, rcx
xor eax, eax
mov dword [rsp + 0x3c], eax
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x5c], eax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x14000225a
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x14000225a
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov edi, dword [r9 + r11*4]
mov bpl, byte [rax + rdi]
test bpl, bpl
je 0x1400022c5
add rdi, r10
mov r14d, 0x57491872
movsx esi, bpl
xor esi, r14d
imul r14d, esi, 0x1000193
mov bpl, byte [rdi]
inc rdi
test bpl, bpl
jne 0x1400022a3
cmp r14d, 0xf936d25d
je 0x1400022cc
test r11, r11
jne 0x140002287
jmp 0x14000225a
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov r10d, dword [rcx + rdx*4]
add r10, rax
lea r14, [rsp + 0x3c]
mov qword [rsp + 0x20], r14
mov rcx, rbx
mov edx, 7
xor r8d, r8d
xor r9d, r9d
call r10
test eax, eax
jne 0x1400023b0
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x14000231a
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x14000231a
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov edi, dword [r9 + r11*4]
mov bpl, byte [rax + rdi]
test bpl, bpl
je 0x140002385
add rdi, r10
mov r15d, 0x58491a05
movsx esi, bpl
xor esi, r15d
imul r15d, esi, 0x1000193
mov bpl, byte [rdi]
inc rdi
test bpl, bpl
jne 0x140002363
cmp r15d, 0xa5a1dd77
je 0x14000238c
test r11, r11
jne 0x140002347
jmp 0x14000231a
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov ecx, dword [rcx + rdx*4]
add rcx, rax
call rcx
cmp eax, 0x7a
jne 0x140002a55
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x1400023c1
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x1400023c1
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov edi, dword [r9 + r11*4]
mov bpl, byte [rax + rdi]
test bpl, bpl
je 0x14000242c
add rdi, r10
mov r15d, 0x488d97c
movsx esi, bpl
xor esi, r15d
imul r15d, esi, 0x1000193
mov bpl, byte [rdi]
inc rdi
test bpl, bpl
jne 0x14000240a
cmp r15d, 0x73b7de1c
je 0x140002433
test r11, r11
jne 0x1400023ee
jmp 0x1400023c1
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov r8d, dword [rcx + rdx*4]
add r8, rax
mov edx, dword [rsp + 0x3c]
mov ecx, 0x40
call r8
test rax, rax
je 0x140002a55
mov rdi, rax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x140002476
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x140002476
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov r15d, dword [r9 + r11*4]
mov bpl, byte [rax + r15]
test bpl, bpl
je 0x1400024e1
add r15, r10
mov r12d, 0x33f9e0d2
movsx esi, bpl
xor esi, r12d
imul r12d, esi, 0x1000193
mov bpl, byte [r15]
inc r15
test bpl, bpl
jne 0x1400024bf
cmp r12d, 0xc898edbd
je 0x1400024e8
test r11, r11
jne 0x1400024a3
jmp 0x140002476
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov r10d, dword [rcx + rdx*4]
add r10, rax
mov r9d, dword [rsp + 0x3c]
mov qword [rsp + 0x20], r14
mov rcx, rbx
mov edx, 7
mov r8, rdi
call r10
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
add rcx, 0x10
test eax, eax
je 0x1400025a1
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x14000252f
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x14000252f
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov ebx, dword [r9 + r11*4]
mov bpl, byte [rax + rbx]
test bpl, bpl
je 0x14000259a
add rbx, r10
mov r14d, 0x78b14d2e
movsx esi, bpl
xor esi, r14d
imul r14d, esi, 0x1000193
mov bpl, byte [rbx]
inc rbx
test bpl, bpl
jne 0x140002578
cmp r14d, 0xed8c1a89
je 0x14000260e
test r11, r11
jne 0x14000255c
jmp 0x14000252f
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x1400025a1
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x1400025a1
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
mov bl, byte [rax + rsi]
test bl, bl
je 0x140002607
add rsi, r10
mov ebp, 0xd2082e5
movsx ebx, bl
xor ebx, ebp
imul ebp, ebx, 0x1000193
mov bl, byte [rsi]
inc rsi
test bl, bl
jne 0x1400025e7
cmp ebp, 0x80e3ad96
je 0x140002a37
test r11, r11
jne 0x1400025ce
jmp 0x1400025a1
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov r10d, dword [rcx + rdx*4]
add r10, rax
lea rdx, [rsp + 0x44]
lea r8, [rsp + 0x48]
lea r9, [rsp + 0x5c]
mov rcx, rdi
call r10
test eax, eax
je 0x1400029bd
cmp dword [rsp + 0x44], 0
je 0x140002912
mov rcx, qword [rsp + 0x48]
xor r14d, r14d
cmp word [rcx + 4], 0
je 0x140002912
lea rsi, [rsp + 0x70]
xor ebx, ebx
mov r15, rsi
mov rax, qword gs:[0x60]
mov rdx, qword [rax + 0x18]
add rdx, 0x10
mov rdx, qword [rdx]
mov rax, qword [rdx + 0x30]
movsxd r8, dword [rax + 0x3c]
mov r8d, dword [rax + r8 + 0x88]
test r8, r8
je 0x14000267e
mov r9d, dword [rax + r8 + 0x18]
test r9, r9
je 0x14000267e
mov r10d, dword [rax + r8 + 0x20]
add r10, rax
lea r11, [rax + 1]
dec r9
mov ebp, r9d
mov r12d, dword [r10 + rbp*4]
mov r13b, byte [rax + r12]
test r13b, r13b
je 0x1400026e9
add r12, r11
mov esi, 0xaf65973e
movsx r13d, r13b
xor r13d, esi
imul esi, r13d, 0x1000193
mov r13b, byte [r12]
inc r12
test r13b, r13b
jne 0x1400026c7
cmp esi, 0xa6c02aa9
je 0x1400026f0
test rbp, rbp
jne 0x1400026ac
jmp 0x14000267e
mov edx, dword [rax + r8 + 0x1c]
mov r8d, dword [rax + r8 + 0x24]
add rdx, rax
add r8, rax
movzx r8d, word [r8 + rbp*2]
mov r9d, dword [rdx + r8*4]
add r9, rax
mov edx, r14d
lea r8, [rsp + 0x60]
call r9
test eax, eax
mov rsi, r15
je 0x1400028fb
mov rbp, qword [rsp + 0x60]
cmp byte [rbp], 0
jne 0x1400028fb
mov eax, dword [rbp + 4]
not eax
test dword [rsp + 0x54], eax
jne 0x1400028fb
add rbp, 8
mov eax, 0x100
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x58], eax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x140002762
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x140002762
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov r12d, dword [r9 + r11*4]
mov r13b, byte [rax + r12]
test r13b, r13b
je 0x1400027cc
add r12, r10
mov esi, 0x6b838af8
movsx r13d, r13b
xor r13d, esi
imul esi, r13d, 0x1000193
mov r13b, byte [r12]
inc r12
test r13b, r13b
jne 0x1400027aa
cmp esi, 0x363cad6e
je 0x1400027d3
test r11, r11
jne 0x14000278f
jmp 0x140002762
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov r10d, dword [rcx + rdx*4]
add r10, rax
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x170]
mov qword [rsp + 0x20], rax
xor ecx, ecx
mov rdx, rbp
mov rsi, r15
mov r8, r15
lea r9, [rsp + 0x40]
call r10
test eax, eax
je 0x1400028fb
mov eax, dword [rsp + 0x40]
mov byte [rsp + rax + 0x70], 0
mov rcx, rsi
lea rdx, [0x140006120]
call fcn.140004622
test eax, eax
jne 0x1400028f9
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x14000285a
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x14000285a
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov r12d, dword [r9 + r11*4]
mov r13b, byte [rax + r12]
test r13b, r13b
je 0x1400028c4
add r12, r10
mov esi, 0xa332564c
movsx r13d, r13b
xor r13d, esi
imul esi, r13d, 0x1000193
mov r13b, byte [r12]
inc r12
test r13b, r13b
jne 0x1400028a2
cmp esi, 0x7af90d70
je 0x1400028cb
test r11, r11
jne 0x140002887
jmp 0x14000285a
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov r8d, dword [rcx + rdx*4]
add r8, rax
mov rcx, qword [0x140006090]
mov rdx, rbp
call r8
test eax, eax
mov rsi, r15
je 0x1400028fb
mov bl, 1
inc r14d
mov rcx, qword [rsp + 0x48]
movzx eax, word [rcx + 4]
cmp r14d, eax
jb 0x14000266a
jmp 0x140002914
xor ebx, ebx
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x140002925
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x140002925
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
mov bpl, byte [rax + rsi]
test bpl, bpl
je 0x140002990
add rsi, r10
mov r14d, 0x53bb3926
movsx ebp, bpl
xor ebp, r14d
imul r14d, ebp, 0x1000193
mov bpl, byte [rsi]
inc rsi
test bpl, bpl
jne 0x14000296e
cmp r14d, 0x52f14683
je 0x140002997
test r11, r11
jne 0x140002952
jmp 0x140002925
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
mov rcx, rdi
call rdx
and bl, 1
jmp 0x140002a57
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x1400029ce
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x1400029ce
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
mov bl, byte [rax + rsi]
test bl, bl
je 0x140002a30
add rsi, r10
mov ebp, 0xf2d62866
movsx ebx, bl
xor ebx, ebp
imul ebp, ebx, 0x1000193
mov bl, byte [rsi]
inc rsi
test bl, bl
jne 0x140002a14
cmp ebp, 0x7f6e07c3
je 0x140002a37
test r11, r11
jne 0x1400029fb
jmp 0x1400029ce
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
mov rcx, rdi
call rdx
xor ebx, ebx
mov eax, ebx
add rsp, 0x278
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret