Function at 0x140036390
Capabilities:
Access peb ldr_data
Encode data using xor
Get kernel32 base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x170
mov rax, qword [0x140090040]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov r12, rcx
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0x130
mov rax, qword gs:[0x60]
mov rdx, qword [rax + 0x18]
mov r14, qword [rdx + 0x10]
mov rsi, r14
nop word [rax + rax]
mov r11, qword [rsi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov ebp, dword [rax + r11 + 0x88]
add rbp, r11
cmp rbp, r11
je 0x140036479
mov r10d, dword [rbp + 0x18]
test r10d, r10d
je 0x140036479
mov edi, dword [rbp + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r10d
lea rax, [rdi + r10*4]
mov r8d, dword [rax + r11]
add r8, r11
mov r9d, 0x811c9dc5
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x140036474
nop
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
movzx edx, byte [r8]
lea r8, [r8 + 1]
test dl, dl
jne 0x140036440
cmp r9d, 0x7f8fe695
je 0x140036af0
test r10d, r10d
jne 0x140036420
mov rax, qword [rsi]
mov rsi, rax
cmp rax, r14
je 0x14003648f
cmp qword [rax + 0x30], 0
jne 0x1400363f0
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0xf]
call r8
mov r13, rax
mov rcx, qword gs:[0x60]
mov rdx, qword [rcx + 0x18]
mov rbp, qword [rdx + 0x10]
mov r14, rbp
nop dword [rax]
nop word [rax + rax]
mov r11, qword [r14 + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov esi, dword [rcx + r11 + 0x88]
add rsi, r11
cmp rsi, r11
je 0x140036549
mov r10d, dword [rsi + 0x18]
test r10d, r10d
je 0x140036549
mov edi, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r10d
lea rax, [r11 + r10*4]
mov r8d, dword [rax + rdi]
add r8, r11
mov r9d, 0x811c9dc5
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x140036544
nop
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
movzx edx, byte [r8]
lea r8, [r8 + 1]
test dl, dl
jne 0x140036510
cmp r9d, 0x4767c60f
je 0x140036b0d
test r10d, r10d
jne 0x1400364f0
mov rax, qword [r14]
mov r14, rax
cmp rax, rbp
je 0x14003655f
cmp qword [rax + 0x30], 0
jne 0x1400364c0
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, r13
call r8
test eax, eax
je 0x1400369a9
nop word [rax + rax]
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rbp, qword [rcx + 0x10]
mov r14, rbp
nop dword [rax]
nop dword [rax + rax]
mov r11, qword [r14 + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov esi, dword [rax + r11 + 0x88]
add rsi, r11
cmp rsi, r11
je 0x14003662d
mov r10d, dword [rsi + 0x18]
test r10d, r10d
je 0x14003662d
mov edi, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r10d
lea rax, [rdi + r10*4]
mov edx, dword [rax + r11]
add rdx, r11
mov r9d, 0x811c9dc5
movzx r8d, byte [rdx]
inc rdx
test r8b, r8b
je 0x140036628
movsx eax, r8b
sub r8b, 0x41
mov ecx, eax
or ecx, 0x20
cmp r8b, 0x19
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
movzx r8d, byte [rdx]
lea rdx, [rdx + 1]
test r8b, r8b
jne 0x1400365f0
cmp r9d, 0x9d367094
je 0x140036b2a
test r10d, r10d
jne 0x1400365d0
mov rax, qword [r14]
mov r14, rax
cmp rax, rbp
je 0x140036643
cmp qword [rax + 0x30], 0
jne 0x1400365a0
xor r8d, r8d
mov rdx, r12
cmp qword [r12 + 0x18], 0xf
jbe 0x140036655
mov rdx, qword [r12]
lea rcx, [rsp + 0x5c]
call r8
test eax, eax
jne 0x140036bba
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rbp, qword [rcx + 0x10]
mov r14, rbp
nop dword [rax]
mov r11, qword [r14 + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov esi, dword [rax + r11 + 0x88]
add rsi, r11
cmp rsi, r11
je 0x14003670d
mov r10d, dword [rsi + 0x18]
test r10d, r10d
je 0x14003670d
mov edi, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r10d
lea rax, [rdi + r10*4]
mov edx, dword [rax + r11]
add rdx, r11
mov r9d, 0x811c9dc5
movzx r8d, byte [rdx]
inc rdx
test r8b, r8b
je 0x140036708
movsx eax, r8b
sub r8b, 0x41
mov ecx, eax
or ecx, 0x20
cmp r8b, 0x19
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
movzx r8d, byte [rdx]
lea rdx, [rdx + 1]
test r8b, r8b
jne 0x1400366d0
cmp r9d, 0x6e477856
je 0x140036b47
test r10d, r10d
jne 0x1400366b0
mov rax, qword [r14]
mov r14, rax
cmp rax, rbp
je 0x140036723
cmp qword [rax + 0x30], 0
jne 0x140036680
xor r9d, r9d
mov r8d, dword [rsp + 0x38]
xor edx, edx
lea ecx, [rdx + 1]
call r9
mov r15, rax
test rax, rax
je 0x140036bba
mov rcx, qword gs:[0x60]
mov rdx, qword [rcx + 0x18]
mov rbp, qword [rdx + 0x10]
mov r14, rbp
nop dword [rax]
nop word [rax + rax]
mov r11, qword [r14 + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov esi, dword [rcx + r11 + 0x88]
add rsi, r11
cmp rsi, r11
je 0x1400367ed
mov r10d, dword [rsi + 0x18]
test r10d, r10d
je 0x1400367ed
mov edi, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r10d
lea rax, [rdi + r10*4]
mov edx, dword [rax + r11]
add rdx, r11
mov r9d, 0x811c9dc5
movzx r8d, byte [rdx]
inc rdx
test r8b, r8b
je 0x1400367e8
movsx eax, r8b
sub r8b, 0x41
mov ecx, eax
or ecx, 0x20
cmp r8b, 0x19
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
movzx r8d, byte [rdx]
lea rdx, [rdx + 1]
test r8b, r8b
jne 0x1400367b0
cmp r9d, 0xf38219d9
je 0x140036b64
test r10d, r10d
jne 0x140036790
mov rax, qword [r14]
mov r14, rax
cmp rax, rbp
je 0x140036803
cmp qword [rax + 0x30], 0
jne 0x140036760
xor r8d, r8d
mov edx, 9
mov rcx, r15
call r8
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rbp, qword [rcx + 0x10]
mov r14, rbp
nop word [rax + rax]
mov r11, qword [r14 + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov esi, dword [rax + r11 + 0x88]
add rsi, r11
cmp rsi, r11
je 0x1400368bd
mov r10d, dword [rsi + 0x18]
test r10d, r10d
je 0x1400368bd
mov edi, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r10d
lea rax, [rdi + r10*4]
mov edx, dword [rax + r11]
add rdx, r11
mov r9d, 0x811c9dc5
movzx r8d, byte [rdx]
inc rdx
test r8b, r8b
je 0x1400368b8
movsx eax, r8b
sub r8b, 0x41
mov ecx, eax
or ecx, 0x20
cmp r8b, 0x19
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
movzx r8d, byte [rdx]
lea rdx, [rdx + 1]
test r8b, r8b
jne 0x140036880
cmp r9d, 0x8285aca5
je 0x140036b81
test r10d, r10d
jne 0x140036860
mov rax, qword [r14]
mov r14, rax
cmp rax, rbp
je 0x1400368d3
cmp qword [rax + 0x30], 0
jne 0x140036830
xor edx, edx
mov rcx, r15
call rdx
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rbp, qword [rcx + 0x10]
mov r14, rbp
nop
mov r11, qword [r14 + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov esi, dword [rax + r11 + 0x88]
add rsi, r11
cmp rsi, r11
je 0x14003697d
mov r10d, dword [rsi + 0x18]
test r10d, r10d
je 0x14003697d
mov edi, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r10d
lea rax, [rdi + r10*4]
mov eax, dword [rax + r11]
add rax, r11
mov r9d, 0x811c9dc5
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x140036978
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r9d
imul r9d, edx, 0x1000193
movzx r8d, byte [rax]
lea rax, [rax + 1]
test r8b, r8b
jne 0x140036940
cmp r9d, 0xdab098f2
je 0x140036b9d
test r10d, r10d
jne 0x140036920
mov rax, qword [r14]
mov r14, rax
cmp rax, rbp
je 0x140036993
cmp qword [rax + 0x30], 0
jne 0x1400368f0
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, r13
call r8
test eax, eax
jne 0x140036580
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rbp, qword [rcx + 0x10]
mov r14, rbp
nop dword [rax]
mov r11, qword [r14 + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov edi, dword [rax + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x140036a49
mov r10d, dword [rdi + 0x18]
test r10d, r10d
je 0x140036a49
mov esi, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r10d
lea rax, [r11 + r10*4]
mov r8d, dword [rax + rsi]
add r8, r11
mov r9d, 0x811c9dc5
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x140036a44
nop
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
movzx edx, byte [r8]
lea r8, [r8 + 1]
test dl, dl
jne 0x140036a10
cmp r9d, 0x8285aca5
je 0x140036bf9
test r10d, r10d
jne 0x1400369f0
mov rax, qword [r14]
mov r14, rax
cmp rax, rbp
je 0x140036a5f
cmp qword [rax + 0x30], 0
jne 0x1400369c0
xor edx, edx
mov rcx, r13
call rdx
nop
mov rdx, qword [r12 + 0x18]
cmp rdx, 0xf
jbe 0x140036aa3
inc rdx
mov rcx, qword [r12]
cmp rdx, 0x1000
jb 0x140036a9e
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140036c15
mov rcx, r8
call fcn.1400491b0
mov eax, 1
mov byte [r12], 0
mov qword [r12 + 0x18], 0xf
mov qword [r12 + 0x10], 0
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140049190
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ecx, dword [rbp + 0x1c]
add rcx, r11
mov eax, dword [rbp + 0x24]
add rax, r11
movzx eax, word [rax + r10*2]
mov r8d, dword [rcx + rax*4]
add r8, r11
jmp 0x140036492
mov ecx, dword [rsi + 0x1c]
add rcx, r11
mov eax, dword [rsi + 0x24]
add rax, r11
movzx eax, word [rax + r10*2]
mov r8d, dword [rcx + rax*4]
add r8, r11
jmp 0x140036562
mov ecx, dword [rsi + 0x1c]
add rcx, r11
mov eax, dword [rsi + 0x24]
add rax, r11
movzx eax, word [rax + r10*2]
mov r8d, dword [rcx + rax*4]
add r8, r11
jmp 0x140036646
mov ecx, dword [rsi + 0x1c]
add rcx, r11
mov eax, dword [rsi + 0x24]
add rax, r11
movzx eax, word [rax + r10*2]
mov r9d, dword [rcx + rax*4]
add r9, r11
jmp 0x140036726
mov ecx, dword [rsi + 0x1c]
add rcx, r11
mov eax, dword [rsi + 0x24]
add rax, r11
movzx eax, word [rax + r10*2]
mov r8d, dword [rcx + rax*4]
add r8, r11
jmp 0x140036806
mov ecx, dword [rsi + 0x1c]
add rcx, r11
mov eax, dword [rsi + 0x24]
add rax, r11
movzx eax, word [rax + r10*2]
mov edx, dword [rcx + rax*4]
add rdx, r11
jmp 0x1400368d5
mov ecx, dword [rsi + 0x1c]
add rcx, r11
mov eax, dword [rsi + 0x24]
add rax, r11
movzx eax, word [rax + r10*2]
mov r8d, dword [rcx + rax*4]
add r8, r11
jmp 0x140036996
mov rdx, qword [r12 + 0x18]
cmp rdx, 0xf
jbe 0x140036bf2
inc rdx
cmp rdx, 0x1000
mov rcx, qword [r12]
jb 0x140036bed
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140036c15
mov rcx, r8
call fcn.1400491b0
xor eax, eax
jmp 0x140036aa8
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + r10*2]
mov edx, dword [rcx + rax*4]
add rdx, r11
jmp 0x140036a61
call fcn.1400500ac
int3