Function at 0x140044048
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
mov eax, 0x2870
call fcn.140062f00
sub rsp, rax
mov rax, qword [0x1400b2040]
xor rax, rsp
mov qword [rsp + 0x2860], rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x1400440f3
mov r9d, dword [r10 + 0x18]
test r9d, r9d
je 0x1400440f3
mov edi, dword [r10 + 0x20]
dec r9d
mov r11d, 0x811c9dc5
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r8]
add rdx, r8
mov cl, byte [rdx]
inc rdx
test cl, cl
je 0x1400440ee
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
inc rdx
test cl, cl
jne 0x1400440cf
cmp r11d, 0xbc25fccb
je 0x1400440f8
test r9d, r9d
jne 0x1400440b2
mov rax, qword [rax]
jmp 0x14004408d
mov ecx, dword [r10 + 0x24]
mov ebx, 0x2000
add rcx, r8
movzx edx, word [rcx + r9*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
mov edx, ebx
add rax, r8
lea rcx, [rsp + 0x30]
lea r8, [rsp + 0x20]
call rax
test eax, eax
je 0x1400442e1
cmp dword [rsp + 0x20], ebx
jae 0x1400442e1
movups xmm0, xmmword [str.kprocesshacker2.sys]
mov edi, dword [rsp + 0x20]
movups xmm1, xmmword [0x1400ab3e0]
shr rdi, 3
movups xmmword [rsp + 0x2030], xmm0
movsd xmm0, qword [0x1400ab3f0]
movsd qword [rsp + 0x2050], xmm0
movups xmmword [rsp + 0x2040], xmm1
test rdi, rdi
je 0x1400442e1
xor ebx, ebx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x1400441ef
mov r9d, dword [r10 + 0x18]
test r9d, r9d
je 0x1400441ef
mov esi, dword [r10 + 0x20]
dec r9d
mov r11d, 0x811c9dc5
lea rcx, [rsi + r9*4]
mov edx, dword [rcx + r8]
add rdx, r8
mov cl, byte [rdx]
inc rdx
test cl, cl
je 0x1400441ea
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
inc rdx
test cl, cl
jne 0x1400441cb
cmp r11d, 0x46edcbd0
je 0x1400441f4
test r9d, r9d
jne 0x1400441ae
mov rax, qword [rax]
jmp 0x140044189
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx edx, word [rcx + r9*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
lea rdx, [rsp + 0x2060]
mov rcx, qword [rsp + rbx*8 + 0x30]
add rax, r8
mov r8d, 0x400
call rax
test eax, eax
je 0x1400442d5
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x1400442a1
mov r9d, dword [r10 + 0x18]
test r9d, r9d
je 0x1400442a1
mov r14d, dword [r10 + 0x20]
dec r9d
mov r11d, 0x811c9dc5
lea rcx, [r14 + r9*4]
mov edx, dword [rcx + r8]
add rdx, r8
mov cl, byte [rdx]
inc rdx
test cl, cl
je 0x14004429c
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
inc rdx
test cl, cl
jne 0x14004427d
cmp r11d, 0x28976ce8
je 0x1400442a6
test r9d, r9d
jne 0x140044260
mov rax, qword [rax]
jmp 0x14004423b
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx edx, word [rcx + r9*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
lea rdx, [rsp + 0x2030]
add rax, r8
lea rcx, [rsp + 0x2060]
call rax
test eax, eax
je 0x140044311
inc rbx
cmp rbx, rdi
jl 0x140044178
xor eax, eax
mov rcx, qword [rsp + 0x2860]
xor rcx, rsp
call fcn.140061e40
lea r11, [rsp + 0x2870]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
mov eax, 0x3002
jmp 0x1400442e3