Function at 0x140001fa0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov qword [rsp + 0x30], rcx
xor r15d, r15d
lea r14, [rsp + 0x38]
mov r13, qword [sym.imp.USER32.dll_PeekMessageW]
mov r12d, 1
jmp 0x140002006
mov ecx, dword [rax + rbp + 0x1c]
mov ebp, dword [rax + rbp + 0x24]
add rcx, rax
add rbp, rax
mov edx, edx
movzx edx, word [rbp + rdx*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
mov rcx, r14
call rdx
mov rcx, r14
call qword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [rsp + 0x40], 0x12
movzx r15d, r15b
cmove r15d, r12d
mov dword [rsp + 0x20], 1
mov rcx, r14
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call r13
test eax, eax
je 0x1400020a8
mov rax, qword gs:[0x60]
mov r8, qword [rax + 0x18]
add r8, 0x10
mov r8, qword [r8]
mov rax, qword [r8 + 0x30]
movsxd rcx, dword [rax + 0x3c]
mov ebp, dword [rcx + rax + 0x88]
test rbp, rbp
je 0x140002035
mov edx, dword [rax + rbp + 0x18]
lea rsi, [rax + 1]
jmp 0x140002071
mov ebx, 0xb710950d
cmp ebx, 0xeb5dbb8c
je 0x140001fd0
sub rdx, 1
jb 0x140002035
mov ecx, dword [rax + rbp + 0x20]
add rcx, rax
mov edi, dword [rcx + rdx*4]
mov cl, byte [rax + rdi]
test cl, cl
je 0x140002060
add rdi, rsi
mov ebx, 0xb710950d
movsx ecx, cl
xor ecx, ebx
imul ebx, ecx, 0x1000193
movzx ecx, byte [rdi]
add rdi, 1
test cl, cl
jne 0x140002090
jmp 0x140002065
test r15b, 1
jne 0x1400020f8
call fcn.140080ce0
call fcn.1400814f0
call fcn.14003dd30
mov rsi, qword [rsp + 0x30]
mov rcx, rsi
call fcn.14002b720
mov rcx, rsi
call fcn.140001e50
mov rcx, qword [0x140113ae8]
mov rax, qword [rcx]
mov qword [rsp + 0x20], 0
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [rax + 0x88]
jmp 0x140002006
call fcn.140080610
call fcn.140081470
xor ecx, ecx
call fcn.140036570
mov rcx, qword [0x140113ae8]
test rcx, rcx
je 0x140002126
mov rax, qword [rcx]
call qword [rax + select]
mov qword [0x140113ae8], 0
mov rcx, qword [0x140113aa0]
test rcx, rcx
je 0x140002143
mov rax, qword [rcx]
call qword [rax + select]
mov qword [0x140113aa0], 0
mov rax, qword gs:[0x60]
mov r8, qword [rax + 0x18]
add r8, 0x10
mov r8, qword [r8]
mov rax, qword [r8 + 0x30]
movsxd rcx, dword [rax + 0x3c]
mov ebp, dword [rcx + rax + 0x88]
test rbp, rbp
je 0x140002154
mov edx, dword [rax + rbp + 0x18]
lea rbx, [rax + 1]
jmp 0x14000218d
mov esi, 0x6e522e47
cmp esi, 0x7d58bbb7
je 0x1400021c8
sub rdx, 1
jb 0x140002154
mov ecx, dword [rax + rbp + 0x20]
add rcx, rax
mov edi, dword [rcx + rdx*4]
mov cl, byte [rax + rdi]
test cl, cl
je 0x140002180
add rdi, rbx
mov esi, 0x6e522e47
nop dword [rax]
movsx ecx, cl
xor ecx, esi
imul esi, ecx, 0x1000193
movzx ecx, byte [rdi]
add rdi, 1
test cl, cl
jne 0x1400021b0
jmp 0x140002185
mov ecx, dword [rax + rbp + 0x1c]
mov ebp, dword [rax + rbp + 0x24]
add rcx, rax
add rbp, rax
mov edx, edx
movzx edx, word [rbp + rdx*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 0x50]
call rdx
mov rax, qword gs:[0x60]
mov r8, qword [rax + 0x18]
add r8, 0x10
mov r8, qword [r8]
mov rax, qword [r8 + 0x30]
movsxd rcx, dword [rax + 0x3c]
mov ebp, dword [rcx + rax + 0x88]
test rbp, rbp
je 0x1400021ff
mov edx, dword [rax + rbp + 0x18]
lea rbx, [rax + 1]
jmp 0x14000222d
mov esi, 0x3c7565d
cmp esi, 0xd05c5a6e
je 0x140002268
sub rdx, 1
jb 0x1400021ff
mov ecx, dword [rax + rbp + 0x20]
add rcx, rax
mov edi, dword [rcx + rdx*4]
mov cl, byte [rax + rdi]
test cl, cl
je 0x140002220
add rdi, rbx
mov esi, 0x3c7565d
nop dword [rax]
movsx ecx, cl
xor ecx, esi
imul esi, ecx, 0x1000193
movzx ecx, byte [rdi]
add rdi, 1
test cl, cl
jne 0x140002250
jmp 0x140002225
mov ecx, dword [rax + rbp + 0x1c]
mov ebp, dword [rax + rbp + 0x24]
add rcx, rax
add rbp, rax
mov edx, edx
movzx edx, word [rbp + rdx*2]
mov ebp, dword [rcx + rdx*4]
add rbp, rax
mov rax, qword [rsp + 0x30]
mov rdx, qword [rax + 0x70]
mov rcx, qword [rax + 0x98]
call rbp
nop
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret