Function at 0x1400035c0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by fnv-1a hash
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x160
mov rax, qword [0x14016e040]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rax, qword gs:[0x60]
xor ebx, ebx
mov r12, rcx
or r13d, 0xffffffff
mov rdx, qword [rax + 0x18]
mov rax, qword [rdx + 0x10]
mov rdi, qword [rax]
mov rdx, rdi
mov r8, qword [rdx + 0x30]
movsxd rax, dword [r8 + 0x3c]
mov r9d, dword [rax + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x140003677
mov r10d, dword [r9 + 0x18]
test r10d, r10d
je 0x140003677
mov r14d, dword [r9 + 0x20]
add r10d, r13d
mov r11d, 0x811c9dc5
lea rax, [r14 + r10*4]
mov ecx, dword [rax + r8]
add rcx, r8
mov al, byte [rcx]
inc rcx
test al, al
je 0x140003672
movsx eax, al
xor eax, r11d
imul r11d, eax, 0x1000193
mov al, byte [rcx]
inc rcx
test al, al
jne 0x140003653
cmp r11d, 0x185776b5
je 0x1400036a2
test r10d, r10d
jne 0x140003636
mov rax, qword [rdx]
mov rdx, rax
cmp rax, rdi
je 0x140003688
cmp qword [rax + 0x30], rbx
jne 0x140003611
mov rax, rbx
xor edx, edx
lea ecx, [rdx + 2]
call rax
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x1400036bd
xor al, al
jmp 0x1400038fc
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + r10*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
jmp 0x14000368b
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x12c
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x20], 0x130
mov r15b, bl
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rdi, qword [rax]
mov rdx, rdi
mov r8, qword [rdx + 0x30]
movsxd rax, dword [r8 + 0x3c]
mov r9d, dword [rax + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x14000375d
mov ecx, dword [r9 + 0x18]
test ecx, ecx
je 0x14000375d
mov r14d, dword [r9 + 0x20]
add ecx, r13d
mov r11d, 0x811c9dc5
mov esi, ecx
lea rax, [r14 + rcx*4]
mov r10d, dword [rax + r8]
add r10, r8
mov al, byte [r10]
inc r10
test al, al
je 0x140003759
movsx eax, al
xor eax, r11d
imul r11d, eax, 0x1000193
mov al, byte [r10]
inc r10
test al, al
jne 0x140003735
cmp r11d, 0xa4c8c8f
je 0x140003826
test ecx, ecx
jne 0x140003715
mov rax, qword [rdx]
mov rdx, rax
cmp rax, rdi
je 0x14000376e
cmp qword [rax + 0x30], rbx
jne 0x1400036f1
mov rax, rbx
lea rdx, [rsp + 0x20]
mov rcx, rbp
call rax
test eax, eax
je 0x140003846
lea rax, [rsp + 0x4c]
cmp r12, rax
je 0x140003843
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r11, qword [rax]
mov rdx, r11
mov r8, qword [rdx + 0x30]
movsxd rax, dword [r8 + 0x3c]
mov r9d, dword [rax + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x14000380c
mov ecx, dword [r9 + 0x18]
test ecx, ecx
je 0x14000380c
mov r14d, dword [r9 + 0x20]
add ecx, r13d
mov edi, 0x811c9dc5
mov esi, ecx
lea rax, [r14 + rcx*4]
mov r10d, dword [rax + r8]
add r10, r8
mov al, byte [r10]
inc r10
test al, al
je 0x140003808
movsx eax, al
xor eax, edi
imul edi, eax, 0x1000193
mov al, byte [r10]
inc r10
test al, al
jne 0x1400037eb
cmp edi, 0x15eec872
je 0x140003826
test ecx, ecx
jne 0x1400037cc
mov rax, qword [rdx]
mov rdx, rax
cmp rax, r11
je 0x14000376e
cmp qword [rax + 0x30], rbx
jne 0x1400037a8
jmp 0x14000376e
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rsi*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
jmp 0x140003771
mov r15b, 1
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r11, qword [rax]
mov rdx, r11
mov r8, qword [rdx + 0x30]
movsxd rax, dword [r8 + 0x3c]
mov r9d, dword [rax + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x1400038bf
mov r10d, dword [r9 + 0x18]
test r10d, r10d
je 0x1400038bf
mov r14d, dword [r9 + 0x20]
add r10d, r13d
mov edi, 0x811c9dc5
lea rax, [r14 + r10*4]
mov ecx, dword [rax + r8]
add rcx, r8
mov al, byte [rcx]
inc rcx
test al, al
je 0x1400038ba
movsx eax, al
xor eax, edi
imul edi, eax, 0x1000193
mov al, byte [rcx]
inc rcx
test al, al
jne 0x14000389e
cmp edi, 0xfaba0065
je 0x1400038d2
test r10d, r10d
jne 0x140003882
mov rax, qword [rdx]
mov rdx, rax
cmp rax, r11
je 0x1400038eb
cmp qword [rax + 0x30], rbx
jne 0x14000385d
jmp 0x1400038eb
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + r10*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov ebx, dword [rcx + rdx*4]
add rbx, r8
mov rcx, rbp
call rbx
neg r15b
sbb eax, eax
test dword [rsp + 0x28], eax
setne al
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140118ad0
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret