Function at 0x1400315c0
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x18]
sub rsp, 0x118
mov rbx, r9
mov r14, r8
mov r12, rdx
cmp byte [rcx + 8], 0
je 0x140031606
mov rdi, r8
mov rsi, rdx
mov rcx, rbx
rep movsb byte [rdi], byte [rsi]
jmp 0x140031aed
mov rdx, qword [0x1401c5120]
add rdx, 0x210
mov qword [rbp + 0x60], rdx
mov rax, qword gs:[0x30]
mov esi, dword [rax + 0x48]
mov rax, qword [rbp + 0x60]
mov ecx, dword [rax + 4]
cmp esi, ecx
jne 0x14003163f
mov rax, qword [rbp + 0x60]
mov ecx, dword [rax]
inc ecx
mov rax, qword [rbp + 0x60]
mov dword [rax], ecx
jmp 0x140031680
mov rdi, qword [rbp + 0x60]
mov r8d, 1
nop dword [rax]
mov eax, dword [rdi + 8]
cmp eax, r8d
je 0x140031665
xor eax, eax
lock cmpxchg dword [rdi + 8], r8d
cmp eax, r8d
jne 0x14003167d
mov ecx, dword [rdx + 0xc]
mov eax, dword [rdx + 0xc]
inc eax
mov dword [rdx + 0xc], eax
cmp ecx, 0x1fffffff
jbe 0x140031679
int3
pause
jmp 0x140031650
mov dword [rdx + 4], esi
cmp rbx, 0x200
jbe 0x140031841
movabs rax, 0xe1ae060ef568b2ff
mov qword [rbp - 0x50], rax
movabs rax, 0x13b4dec7aca8dd64
mov qword [rbp - 0x48], rax
movabs rax, 0xd632a648f241d19
mov qword [rbp - 0x40], rax
movabs rax, 0x7e89e5f58bd2bb9e
mov qword [rbp - 0x38], rax
movabs rax, 0x445cc2daed76e5c3
mov qword [rbp - 0x30], rax
movabs rax, 0x618ce993994fae88
mov qword [rbp - 0x28], rax
movabs rax, 0x2d7603701f194c6d
mov qword [rbp - 0x20], rax
movabs rax, 0x9df93fb1464e1c32
mov qword [rbp - 0x18], rax
movabs rax, 0x4e1e58c690995fc7
mov qword [rbp - 0x10], rax
movabs rax, 0xab32be3f0e9ce0cc
mov qword [rbp - 8], rax
movabs rax, 0xa93d037c040f0c41
mov qword [rbp], rax
movabs rcx, 0x4183ec0dacdd9f86
mov qword [rbp + 8], rcx
movabs rax, 0x80c86f65cf52d08d
mov qword [rsp + 0x40], rax
movabs rax, 0x77d5bbb59692b807
mov qword [rsp + 0x48], rax
movabs rax, 0x6c0f165eb5496b46
mov qword [rsp + 0x50], rax
movabs rax, 0x44b7d4aaeab6d9f3
mov qword [rsp + 0x58], rax
movabs rax, 0x2b28a3a888068af9
mov qword [rsp + 0x60], rax
movabs rax, 0x13edbeb3b0678efa
mov qword [rsp + 0x68], rax
movabs rax, 0x4824235178772503
mov qword [rsp + 0x70], rax
movabs rax, 0xbd8b5ac7296e7853
mov qword [rsp + 0x78], rax
movabs rax, 0x2b6a21a4b0ab6ef2
mov qword [rbp - 0x80], rax
movabs rax, 0xce5ccc5a65bcccbf
mov qword [rbp - 0x78], rax
movabs rax, 0xa93d6f106d782c2d
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rcx
movdqa xmm0, xmmword [rsp + 0x40]
xorps xmm0, xmmword [rbp - 0x50]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [rsp + 0x50]
xorps xmm1, xmmword [rbp - 0x40]
movdqa xmmword [rsp + 0x50], xmm1
movdqa xmm0, xmmword [rsp + 0x60]
xorps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [rsp + 0x70]
xorps xmm1, xmmword [rbp - 0x20]
movdqa xmmword [rsp + 0x70], xmm1
movdqa xmm0, xmmword [rbp - 0x80]
xorps xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [rbp - 0x70]
xorps xmm1, xmmword [rbp]
movdqa xmmword [rbp - 0x70], xmm1
lea rcx, [rsp + 0x40]
call fcn.1400311c0
xor r13d, r13d
mov qword [rbp - 0x60], r13
mov rsi, qword [0x1401c5368]
test rsi, rsi
jne 0x140031aa1
mov r11d, r13d
mov r15d, 0xaedfae25
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
movups xmm0, xmmword [rax + 0x58]
movd ecx, xmm0
sub cx, 8
test r11d, r11d
je 0x1400318df
psrldq xmm0, 8
movq rsi, xmm0
movzx ecx, cx
shr rcx, 1
lea r9, [rsi + rcx*2]
mov r8d, 0x811c9dc5
cmp rsi, r9
je 0x1400318d6
movsx ecx, byte [rsi]
mov edx, ecx
sub cl, 0x41
mov edi, edx
or edi, 0x20
cmp cl, 0x19
cmova edi, edx
xor edi, r8d
imul r8d, edi, 0x1000193
add rsi, 2
cmp rsi, r9
jne 0x1400318b0
cmp r8d, r11d
jne 0x140031a42
mov r10, qword [rax + 0x30]
test r10, r10
je 0x140031a4f
movsxd rcx, dword [r10 + 0x3c]
mov rdx, qword [rcx + r10 + 0x88]
mov r13, rdx
shr r13, 0x20
mov ebx, edx
add rbx, r10
cmp rbx, r10
je 0x140031a42
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140031a42
mov r12d, dword [rbx + 0x20]
nop
dec r9d
lea rcx, [r10 + r9*4]
mov esi, dword [rcx + r12]
add rsi, r10
mov r8d, 0x811c9dc5
movzx ecx, byte [rsi]
inc rsi
test cl, cl
je 0x140031966
nop
movsx edx, cl
sub cl, 0x41
mov edi, edx
or edi, 0x20
cmp cl, 0x19
cmova edi, edx
xor edi, r8d
imul r8d, edi, 0x1000193
movzx ecx, byte [rsi]
lea rsi, [rsi + 1]
test cl, cl
jne 0x140031940
cmp r8d, r15d
je 0x140031978
test r9d, r9d
jne 0x140031920
mov rax, qword [rax]
jmp 0x140031880
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rbx + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edi, dword [rcx + rax*4]
add rdi, r10
cmp rdi, rbx
jbe 0x140031a4a
lea rax, [rbx + r13]
cmp rdi, rax
jae 0x140031a4a
mov r11d, 0x811c9dc5
mov dword [rsp + 0x30], r11d
mov esi, r11d
mov dword [rsp + 0x34], r11d
movzx edx, byte [rdi]
cmp dl, 0x2e
je 0x1400319eb
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, r11d
imul r11d, ecx, 0x1000193
inc rdi
movzx edx, byte [rdi]
cmp dl, 0x2e
jne 0x1400319c0
mov dword [rsp + 0x30], r11d
inc rdi
movzx edx, byte [rdi]
test dl, dl
je 0x140031a28
nop word [rax + rax]
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, esi
imul esi, ecx, 0x1000193
lea rdi, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
jne 0x140031a00
mov dword [rsp + 0x34], esi
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r15, qword [rsp + 0x30]
shr r15, 0x20
mov rax, qword [rax]
jmp 0x140031880
xor r13d, r13d
jmp 0x140031a55
xor r13d, r13d
mov edi, r13d
mov qword [0x1401c5368], rdi
nop dword [rax]
rdtsc
shl rdx, 0x20
or rax, rdx
lea rcx, [rax + rax*4]
mov qword [0x1401c5370], rcx
cmp rcx, rdi
je 0x140031a60
mov rsi, rcx
xor rsi, rdi
mov qword [0x1401c5368], rsi
mov eax, ecx
xor eax, 0xaedfae25
mov dword [0x1401c5360], eax
mov rbx, qword [rbp + 0x78]
mov r14, qword [rbp + 0x70]
mov r12, qword [rbp + 0x68]
jmp 0x140031aa8
mov rcx, qword [0x1401c5370]
xor rsi, rcx
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
mov r9, rbx
mov r8, r14
mov rdx, r12
mov rcx, qword [0x1401c0e80]
call rsi
nop
mov rax, qword [rbp + 0x60]
mov ecx, dword [rax]
mov rax, qword [rbp + 0x60]
test ecx, ecx
je 0x140031ae1
mov ecx, dword [rax]
dec ecx
mov rax, qword [rbp + 0x60]
mov dword [rax], ecx
jmp 0x140031aed
mov dword [rax + 4], r13d
mov dword [rax + 8], r13d
mov dword [rax + 0xc], r13d
mov al, 1
add rsp, 0x118
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret