Function at 0x140002474
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov esi, ecx
mov qword [rsp + 0x30], 0
mov word [rsp + 0x28], 2
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x1400024a7
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x1400024a7
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov edi, dword [r9 + r11*4]
mov bl, byte [rax + rdi]
test bl, bl
je 0x140002509
add rdi, r10
mov ebp, 0x9db874b4
movsx ebx, bl
xor ebx, ebp
imul ebp, ebx, 0x1000193
mov bl, byte [rdi]
inc rdi
test bl, bl
jne 0x1400024ed
cmp ebp, 0xb5484e8e
je 0x140002510
test r11, r11
jne 0x1400024d4
jmp 0x1400024a7
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
mov ecx, esi
call rdx
lea rdi, [rsp + 0x28]
mov word [rdi + 2], ax
call fcn.1400042b0
mov dword [rdi + 4], eax
xor ebp, ebp
mov ecx, dword [section..data]
cmp ebp, 6
mov r14d, 5
cmovge r14d, ebp
mov ebx, ebp
cmp ecx, 0xffffffff
je 0x140002604
mov rax, qword gs:[0x60]
mov rdx, qword [rax + 0x18]
add rdx, 0x10
mov rdx, qword [rdx]
mov rax, qword [rdx + 0x30]
movsxd r8, dword [rax + 0x3c]
mov r8d, dword [rax + r8 + 0x88]
test r8, r8
je 0x14000256f
mov r9d, dword [rax + r8 + 0x18]
test r9, r9
je 0x14000256f
mov r10d, dword [rax + r8 + 0x20]
add r10, rax
lea r11, [rax + 1]
dec r9
mov r15d, r9d
mov r12d, dword [r10 + r15*4]
mov bpl, byte [rax + r12]
test bpl, bpl
je 0x1400025dc
add r12, r11
mov r13d, 0x1ac4726e
movsx ebp, bpl
xor ebp, r13d
imul r13d, ebp, 0x1000193
mov bpl, byte [r12]
inc r12
test bpl, bpl
jne 0x1400025b9
cmp r13d, 0x502d00c3
je 0x1400025e3
test r15, r15
jne 0x14000259d
jmp 0x14000256f
mov edx, dword [rax + r8 + 0x1c]
mov r8d, dword [rax + r8 + 0x24]
add rdx, rax
add r8, rax
movzx r8d, word [r8 + r15*2]
mov edx, dword [rdx + r8*4]
add rdx, rax
movsxd rcx, ecx
call rdx
mov dword [section..data], 0xffffffff
cmp ebx, r14d
je 0x1400029ad
lea ebp, [rbx + 1]
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x14000262b
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x14000262b
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov r15d, dword [r9 + r11*4]
mov r12b, byte [rax + r15]
test r12b, r12b
je 0x140002696
add r15, r10
mov r13d, 0xf57b8746
movsx r12d, r12b
xor r12d, r13d
imul r13d, r12d, 0x1000193
mov r12b, byte [r15]
inc r15
test r12b, r12b
jne 0x140002674
cmp r13d, 0x50eacae7
je 0x14000269d
test r11, r11
jne 0x140002658
jmp 0x14000262b
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov r9d, dword [rcx + rdx*4]
add r9, rax
mov ecx, 2
mov edx, 2
mov r8d, 0x11
call r9
mov dword [section..data], eax
mov ecx, 0xffffffff
cmp eax, 0xffffffff
je 0x140002553
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x1400026ef
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x1400026ef
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov r14d, dword [r9 + r11*4]
mov r15b, byte [rax + r14]
test r15b, r15b
je 0x14000275a
add r14, r10
mov r12d, 0xf68a9363
movsx r15d, r15b
xor r15d, r12d
imul r12d, r15d, 0x1000193
mov r15b, byte [r14]
inc r14
test r15b, r15b
jne 0x140002738
cmp r12d, 0xbc89807a
je 0x140002761
test r11, r11
jne 0x14000271c
jmp 0x1400026ef
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
xor ecx, ecx
call rdx
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x14000278f
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x14000278f
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov r14d, dword [r9 + r11*4]
mov r15b, byte [rax + r14]
test r15b, r15b
je 0x1400027fa
add r14, r10
mov r12d, 0x8d87af81
movsx r15d, r15b
xor r15d, r12d
imul r12d, r15d, 0x1000193
mov r15b, byte [r14]
inc r14
test r15b, r15b
jne 0x1400027d8
cmp r12d, 0x1b6d411a
je 0x140002801
test r11, r11
jne 0x1400027bc
jmp 0x14000278f
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov r9d, dword [rcx + rdx*4]
add r9, rax
movsxd rcx, dword [section..data]
mov rdx, rdi
mov r8d, 0x10
call r9
cmp eax, 0xffffffff
jne 0x1400028f8
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x140002848
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x140002848
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov ebx, dword [r9 + r11*4]
mov r14b, byte [rax + rbx]
test r14b, r14b
je 0x1400028b3
add rbx, r10
mov r15d, 0x789698fc
movsx r14d, r14b
xor r14d, r15d
imul r15d, r14d, 0x1000193
mov r14b, byte [rbx]
inc rbx
test r14b, r14b
jne 0x140002891
cmp r15d, 0x249d5977
je 0x1400028ba
test r11, r11
jne 0x140002875
jmp 0x140002848
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov ecx, dword [rcx + rdx*4]
add rcx, rax
call rcx
cmp eax, 0x65
jne 0x1400028ec
xor eax, eax
cmp dword [rsp + 0x2c], 0
jne 0x1400028e8
call fcn.1400042b0
mov dword [rsp + 0x2c], eax
mov ecx, esi
call fcn.1400020b3
jmp 0x140002540
mov dword [rsp + 0x24], 1
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x140002911
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x140002911
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
mov dil, byte [rax + rsi]
test dil, dil
je 0x140002978
add rsi, r10
mov ebp, 0x9b7c6315
movsx edi, dil
xor edi, ebp
imul ebp, edi, 0x1000193
mov dil, byte [rsi]
inc rsi
test dil, dil
jne 0x140002959
cmp ebp, 0xdf7e12ef
je 0x14000297f
test r11, r11
jne 0x14000293e
jmp 0x140002911
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov r9d, dword [rcx + rdx*4]
add r9, rax
movsxd rcx, dword [section..data]
lea r8, [rsp + 0x24]
mov edx, 0x8004667e
call r9
cmp ebx, 5
setl al
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret