Function at 0x14004dcb0
Capabilities:
Access peb ldr_data
Encode data using xor
Get kernel32 base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x290
mov rax, qword [0x140099040]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rbp, r9
mov r12, r8
mov r15, rdx
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor r14d, r14d
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov edi, dword [rcx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x14004dd76
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14004dd76
mov esi, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rsi + r9*4]
mov ecx, dword [rcx + r11]
add rcx, r11
mov r8d, 0x3d4e7957
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14004dd71
nop
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x14004dd50
cmp r8d, 0x2ab89de
je 0x14004dd7b
test r9d, r9d
jne 0x14004dd30
mov rax, qword [rax]
jmp 0x14004dd00
mov r8d, dword [rdi + 0x1c]
add r8, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + r9*2]
mov r10d, dword [r8 + rax*4]
add r10, r11
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x101
xor r8d, r8d
mov rdx, r12
mov rcx, r15
call r10
test eax, eax
jne 0x14004df27
mov dword [rsp + 0x30], 0x104
mov rax, qword [0x140963b68]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov rdx, rbp
mov rcx, qword [rsp + 0x40]
call rax
test eax, eax
jne 0x14004df27
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.140059ff0
nop
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 7
cmova rdx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x58]
lea rbp, [rdx + rax*2]
lea rdi, [rsp + 0x48]
cmova rdi, qword [rsp + 0x48]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
cmp rdi, rbp
jne 0x14004de47
mov byte [rbx], 0
jmp 0x14004df1a
mov rax, rbp
sub rax, rdi
sar rax, 1
movabs rsi, 0x7fffffffffffffff
cmp rax, rsi
ja 0x14004df49
cmp rax, 0xf
jbe 0x14004dee1
or rax, 0xf
cmp rax, rsi
jbe 0x14004de9b
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400760fc
test rax, rax
je 0x14004dec6
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x14004deda
mov rsi, rax
mov ecx, reloc.WS2_32.dll_shutdown
cmp rax, rcx
cmovb rsi, rcx
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x14004decd
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14004df4f
jmp 0x14004de80
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14004deda
call fcn.1400760fc
mov r14, rax
mov qword [rbx], r14
mov qword [rbx + 0x18], rsi
mov rdx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x14004deee
mov rdx, qword [rbx]
movzx ecx, byte [rdi]
mov rax, qword [rbx + 0x10]
mov byte [rdx + rax], cl
inc qword [rbx + 0x10]
mov rax, qword [rbx + 0x10]
add rdi, 2
cmp rdi, rbp
jne 0x14004dee1
mov rcx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x14004df16
mov rcx, qword [rbx]
mov byte [rcx + rax], 0
lea rcx, [rsp + 0x48]
call fcn.140059f80
mov rax, rbx
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140075d20
add rsp, 0x290
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.14003ab20
nop
call fcn.1400067b0
int3