Function at 0x140057a40
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140141480]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword gs:[0x60]
mov r15, rcx
mov r12, rdx
mov r13, r9
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rdi, qword [rax]
mov rdx, rdi
cmp r8b, 1
jne 0x140057b4e
mov r8, qword [rdx + 0x30]
movsxd rax, dword [r8 + 0x3c]
mov r9d, dword [rax + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x140057af2
mov ecx, dword [r9 + 0x18]
test ecx, ecx
je 0x140057af2
mov r14d, dword [r9 + 0x20]
dec ecx
mov r11d, 0x7cb9e41f
mov esi, ecx
lea rax, [r14 + rcx*4]
mov r10d, dword [rax + r8]
add r10, r8
mov al, byte [r10]
inc r10
test al, al
je 0x140057aee
movsx eax, al
xor eax, r11d
imul r11d, eax, 0x1000193
mov al, byte [r10]
inc r10
test al, al
jne 0x140057ace
cmp r11d, 0xd24a25bb
je 0x140057b2a
test ecx, ecx
jne 0x140057aaf
mov rax, qword [rdx]
mov rdx, rax
cmp rax, rdi
je 0x140057b04
cmp qword [rax + 0x30], 0
jne 0x140057a8b
xor r10d, r10d
mov cl, 0x66
mov dword [rbp - 0x40], 0x13141266
mov word [rbp - 0x3c], 3
xor eax, eax
xor byte [rbp + rax - 0x3f], cl
inc rax
cmp rax, 4
jae 0x140057b45
mov cl, byte [rbp - 0x40]
jmp 0x140057b18
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rsi*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov r10d, dword [rcx + rdx*4]
add r10, r8
jmp 0x140057b07
mov byte [rbp - 0x3b], 0
jmp 0x140057c0f
mov r8, qword [rdx + 0x30]
movsxd rax, dword [r8 + 0x3c]
mov r9d, dword [rax + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x140057bb5
mov ecx, dword [r9 + 0x18]
test ecx, ecx
je 0x140057bb5
mov r14d, dword [r9 + 0x20]
dec ecx
mov r11d, 0xf62f3c5c
mov esi, ecx
lea rax, [r14 + rcx*4]
mov r10d, dword [rax + r8]
add r10, r8
mov al, byte [r10]
inc r10
test al, al
je 0x140057bb1
movsx eax, al
xor eax, r11d
imul r11d, eax, 0x1000193
mov al, byte [r10]
inc r10
test al, al
jne 0x140057b91
cmp r11d, 0x7cd1bb34
je 0x140057bf0
test ecx, ecx
jne 0x140057b72
mov rax, qword [rdx]
mov rdx, rax
cmp rax, rdi
je 0x140057bc7
cmp qword [rax + 0x30], 0
jne 0x140057b4e
xor r10d, r10d
xor eax, eax
mov dword [rbp - 0x40], 0x14191e78
mov byte [rbp - 0x3a], al
mov cl, 0x78
mov word [rbp - 0x3c], 0x1d0b
xor byte [rbp + rax - 0x3f], cl
inc rax
cmp rax, 5
jae 0x140057c0b
mov cl, byte [rbp - 0x40]
jmp 0x140057bde
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rsi*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov r10d, dword [rcx + rdx*4]
add r10, r8
jmp 0x140057bca
mov byte [rbp - 0x3a], 0
lea rdx, [r15 + 8]
cmp qword [rdx + 0x18], 0xf
jbe 0x140057c1d
mov rdx, qword [rdx]
mov qword [rsp + 0x28], r13
lea r9, [rbp - 0x30]
lea r8, [rbp - 0x3f]
mov dword [rsp + reloc.WLDAP32.dll_Ordinal_32], 0x20
mov rcx, r12
call r10
test eax, eax
mov dword [rbp - 0x38], 0x292e285c
mov cl, 0x5c
mov word [rbp - 0x34], reloc.WS2_32.dll_gethostname
setne dil
xor eax, eax
xor byte [rbp + rax - 0x37], cl
inc rax
cmp rax, 4
jae 0x140057c61
mov cl, byte [rbp - 0x38]
jmp 0x140057c4f
lea rdx, [rbp - 0x37]
mov byte [rbp - 0x33], 0
lea rcx, [rbp - 0x30]
call fcn.14005b284
test rax, rax
mov al, dil
setne cl
mov byte [r15], cl
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400c1f80
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret