Function at 0x7ff70b542c20
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx]
test rcx, rcx
je 0x7ff70b51f969
mov rdx, qword [rbx + 0x10]
sub rdx, rcx
movabs rax, 0xf83e0f83e0f83e1
imul rdx
sar rdx, 6
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0x420
cmp rax, 0x1000
jb 0x7ff70b51f956
mov rdx, qword [rcx - 8]
sub rcx, rdx
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x7ff70b51f96f
mov rcx, rdx
call fcn.7ff70b4dd700
nop
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
add rsp, 0x20
pop rbx
ret
call fcn.7ff70b5526b4
int3
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r13, rcx
call fcn.7ff70b545750
mov rax, qword [r13 + 0x18]
test rax, rax
je 0x7ff70b542e8e
mov r8, qword [0x7ff70b692418]
test r8, r8
jne 0x7ff70b542e76
xor r14d, r14d
mov edi, 0x8285aca5
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
movups xmm0, xmmword [rax + 0x58]
movups xmmword [rsp + 0x20], xmm0
movd ecx, xmm0
sub cx, 8
test r14d, r14d
je 0x7ff70b542ce3
mov r9, qword [rsp + 0x28]
movzx ecx, cx
shr rcx, 1
lea r11, [r9 + rcx*2]
mov r10d, 0x811c9dc5
cmp r9, r11
je 0x7ff70b542cda
movsx ecx, byte [r9]
mov edx, ecx
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
add r9, 2
cmp r9, r11
jne 0x7ff70b542cb0
cmp r10d, r14d
jne 0x7ff70b542e28
mov rbx, qword [rax + 0x30]
test rbx, rbx
je 0x7ff70b542e30
movsxd rcx, dword [rbx + 0x3c]
mov rdx, qword [rcx + rbx + 0x88]
mov r12, rdx
shr r12, 0x20
mov esi, edx
add rsi, rbx
cmp rsi, rbx
je 0x7ff70b542e28
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x7ff70b542e28
mov r15d, dword [rsi + 0x20]
dec r11d
lea rcx, [rbx + r11*4]
mov r8d, dword [rcx + r15]
add r8, rbx
mov r10d, 0x811c9dc5
movzx r9d, byte [r8]
inc r8
test r9b, r9b
je 0x7ff70b542d6d
movsx ecx, r9b
sub r9b, 0x41
mov edx, ecx
or edx, 0x20
cmp r9b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r9d, byte [r8]
lea r8, [r8 + 1]
test r9b, r9b
jne 0x7ff70b542d42
cmp r10d, edi
je 0x7ff70b542d7f
test r11d, r11d
jne 0x7ff70b542d22
mov rax, qword [rax]
jmp 0x7ff70b542c80
mov ecx, dword [rsi + 0x24]
add rcx, rbx
movzx edx, word [rcx + r11*2]
mov ecx, dword [rsi + 0x1c]
add rcx, rbx
mov r8d, dword [rcx + rdx*4]
add r8, rbx
cmp r8, rsi
jbe 0x7ff70b542e33
lea rax, [r12 + rsi]
cmp r8, rax
jae 0x7ff70b542e33
mov edi, 0x811c9dc5
mov r14d, edi
movzx edx, byte [r8]
cmp dl, 0x2e
je 0x7ff70b542de7
nop
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, r14d
imul r14d, ecx, 0x1000193
inc r8
movzx edx, byte [r8]
cmp dl, 0x2e
jne 0x7ff70b542dc0
inc r8
movzx edx, byte [r8]
test dl, dl
je 0x7ff70b542e17
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, edi
imul edi, ecx, 0x1000193
lea r8, [r8 + 1]
movzx edx, byte [r8]
test dl, dl
jne 0x7ff70b542df2
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rax, qword [rax]
jmp 0x7ff70b542c80
xor r8d, r8d
mov qword [0x7ff70b692418], r8
nop word [rax + rax]
rdtsc
shl rdx, 0x20
or rax, rdx
lea rcx, [rax + rax*4]
mov qword [0x7ff70b692420], rcx
cmp rcx, r8
je 0x7ff70b542e40
xor r8, rcx
mov qword [0x7ff70b692418], r8
mov eax, ecx
xor eax, 0x8285aca5
mov dword [0x7ff70b692410], eax
mov rax, qword [r13 + 0x18]
jmp 0x7ff70b542e7d
mov rcx, qword [0x7ff70b692420]
xor r8, rcx
mov rcx, rax
call r8
mov qword [r13 + 0x18], 0
mov rcx, r13
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
jmp 0x7ff70b51f900