Function at 0x140005ad0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x390
lea rbp, [rsp + 0x40]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x1400341a0]
xor rax, rsp
mov qword [rbp + 0x340], rax
movabs rax, 0x9cd2f1c8d1af9015
movabs r12, 0x9cb789adffcbf17a
mov qword [rbp + 0x18], rax
movabs r13, 0xe0693edb381f87dc
mov qword [rbp], r13
movabs rax, 0x8f0d50b26f43bd9f
mov qword [rbp + 0x260], rax
movabs r14, 0x9b9734fa1c9af3a7
mov qword [rbp + 8], r14
movabs rax, 0xfee347834fc680d0
mov qword [rbp + 0x268], rax
movabs rsi, 0x16e598d3c1cddef4
mov qword [rbp + 0x10], rsi
movabs rax, 0x7a8bf1a49dffed99
mov qword [rbp + 0x270], rax
mov qword [rbp + 0x278], r12
vmovdqu ymm0, ymmword [rbp + 0x260]
vpxor ymm1, ymm0, ymmword [rbp]
vmovdqa ymmword [rbp], ymm1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
vzeroupper
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140005c27
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140005c27
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140005c22
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x140005c00
cmp r8d, 0x82417177
je 0x140005c2c
test r9d, r9d
jne 0x140005be0
mov rax, qword [rax]
jmp 0x140005bb0
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rcx, [rbp]
add rax, r10
call rax
mov qword [rbp + 0xe8], r14
movabs rax, 0x9e485cac1cddef4
mov qword [rbp + 0xf0], rax
movabs r14, 0xd2f81d46addd4e03
mov qword [rbp + 0x100], r14
movabs rax, 0xf9cfec8393a58311
mov qword [rbp + 0xf8], rax
movabs r15, 0xad5d6f37dfd3c3f4
mov qword [rbp + 0x108], r15
movabs rax, 0x8f0d50b26f43bd9f
movdqa xmm2, xmmword [rbp + 0x100]
mov qword [rbp + 0x1a0], rax
movabs rax, 0xfee347834fc680d0
mov qword [rbp + 0x1a8], rax
movabs rax, 0x7a8bf1a49dffed99
mov qword [rbp + 0xe0], r13
mov qword [rbp + 0x1b0], rax
mov qword [rbp + 0x1b8], r12
vmovdqu ymm0, ymmword [rbp + 0x1a0]
vpxor ymm1, ymm0, ymmword [rbp + 0xe0]
vmovdqa ymmword [rbp + 0xe0], ymm1
mov qword [rbp + 0x1c0], r14
mov qword [rbp + 0x1c8], r15
vpxor xmm2, xmm2, xmmword [rbp + 0x1c0]
vmovdqa xmmword [rbp + 0x100], xmm2
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
vzeroupper
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140005da7
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140005da7
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140005da2
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x140005d80
cmp r8d, 0x82417177
je 0x140005dac
test r9d, r9d
jne 0x140005d60
mov rax, qword [rax]
jmp 0x140005d30
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rcx, [rbp + 0xe0]
add rax, r10
call rax
mov qword [rbp + 0x20], r13
movabs rax, 0x9b9734fa1c9af3a7
mov qword [rbp + 0x28], rax
movabs rax, 0x9cdeefc8d1af9015
mov qword [rbp + 0x38], rax
movabs rax, 0x8f0d50b26f43bd9f
mov qword [rbp + 0x280], rax
movabs rax, 0xfee347834fc680d0
mov qword [rbp + 0x288], rax
movabs rax, 0x7a8bf1a49dffed99
mov qword [rbp + 0x30], rsi
mov qword [rbp + 0x290], rax
mov qword [rbp + 0x298], r12
vmovdqu ymm0, ymmword [rbp + 0x280]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
vzeroupper
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140005ec7
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140005ec7
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140005ec2
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x140005ea0
cmp r8d, 0x82417177
je 0x140005ecc
test r9d, r9d
jne 0x140005e80
mov rax, qword [rax]
jmp 0x140005e50
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rcx, [rbp + 0x20]
add rax, r10
call rax
mov qword [rbp + 0x40], r13
movabs rax, 0x54e790ccc1cddef4
mov qword [rbp + 0x50], rax
movabs rsi, 0x9b9734fa1c9af3a7
mov qword [rbp + 0x48], rsi
movabs rax, 0x9cb789adffa79d1e
mov qword [rbp + 0x58], rax
movabs rax, 0x8f0d50b26f43bd9f
mov qword [rbp + 0x2a0], rax
movabs rax, 0xfee347834fc680d0
mov qword [rbp + 0x2a8], rax
movabs rax, 0x7a8bf1a49dffed99
mov qword [rbp + 0x2b0], rax
mov qword [rbp + 0x2b8], r12
vmovdqu ymm0, ymmword [rbp + 0x2a0]
vpxor ymm1, ymm0, ymmword [rbp + 0x40]
vmovdqa ymmword [rbp + 0x40], ymm1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
vzeroupper
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140005ff7
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140005ff7
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140005ff2
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x140005fd0
cmp r8d, 0x82417177
je 0x140005ffc
test r9d, r9d
jne 0x140005fb0
mov rax, qword [rax]
jmp 0x140005f80
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rcx, [rbp + 0x40]
add rax, r10
call rax
mov qword [rbp + 0x60], r13
movabs rax, 0x15ec9ee8c1cddef4
mov qword [rbp + 0x70], rax
movabs rax, 0x9cd2f1c8d182a414
mov qword [rbp + 0x78], rax
movabs rax, 0x8f0d50b26f43bd9f
mov qword [rbp + 0x2c0], rax
movabs rax, 0xfee347834fc680d0
mov qword [rbp + 0x2c8], rax
movabs rax, 0x7a8bf1a49dffed99
mov qword [rbp + 0x68], rsi
mov qword [rbp + 0x2d0], rax
mov qword [rbp + 0x2d8], r12
vmovdqu ymm0, ymmword [rbp + 0x2c0]
vpxor ymm1, ymm0, ymmword [rbp + 0x60]
vmovdqa ymmword [rbp + 0x60], ymm1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
vzeroupper
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140006117
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140006117
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140006112
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x1400060f0
cmp r8d, 0x82417177
je 0x14000611c
test r9d, r9d
jne 0x1400060d0
mov rax, qword [rax]
jmp 0x1400060a0
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rcx, [rbp + 0x60]
add rax, r10
call rax
mov qword [rbp + 0x80], r13
movabs rax, 0xee49ee6c1cddef4
mov qword [rbp + 0x90], rax
movabs rax, 0x8f0d50b26f43bd9f
mov qword [rbp + 0x2e0], rax
movabs rax, 0xfee347834fc680d0
mov qword [rbp + 0x2e8], rax
movabs rax, 0x7a8bf1a49dffed99
mov qword [rbp + 0x88], rsi
mov qword [rbp + 0x98], r12
mov qword [rbp + 0x2f0], rax
mov qword [rbp + 0x2f8], r12
vmovdqu ymm0, ymmword [rbp + 0x2e0]
vpxor ymm1, ymm0, ymmword [rbp + 0x80]
vmovdqa ymmword [rbp + 0x80], ymm1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
vzeroupper
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140006247
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140006247
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140006242
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x140006220
cmp r8d, 0x3bee2f3
je 0x14000624c
test r9d, r9d
jne 0x140006200
mov rax, qword [rax]
jmp 0x1400061d0
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rcx, [rbp + 0x80]
add rax, r10
call rax
mov qword [rbp + 0xa0], r13
movabs rdx, 0x8f0d50b26f43bd9f
mov qword [rbp + 0xa8], rsi
movabs r8, 0xfee347834fc680d0
mov qword [rbp + 0xc0], r13
movabs r9, 0x7a8bf1a49dffed99
mov qword [rbp + 0xc8], rsi
movabs rcx, 0x8ee82d1c1cddef4
mov qword [rbp + 0xb0], rcx
movabs rax, 0x9cb7e2ca89e5c349
mov qword [rbp + 0xb8], rax
movabs rax, 0x9cb7e5c19be5c349
mov qword [rbp + 0xd0], rcx
mov qword [rbp + 0xd8], rax
mov qword [rbp + 0x300], rdx
mov qword [rbp + 0x308], r8
mov qword [rbp + 0x310], r9
mov qword [rbp + 0x318], r12
vmovdqu ymm0, ymmword [rbp + 0x300]
vpxor ymm1, ymm0, ymmword [rbp + 0xa0]
vmovdqa ymmword [rbp + 0xa0], ymm1
mov qword [rbp + 0x320], rdx
mov qword [rbp + 0x328], r8
mov qword [rbp + 0x330], r9
mov qword [rbp + 0x338], r12
vmovdqu ymm0, ymmword [rbp + 0x320]
vpxor ymm1, ymm0, ymmword [rbp + 0xc0]
vmovdqa ymmword [rbp + 0xc0], ymm1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
vzeroupper
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400063d7
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400063d7
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400063d2
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x1400063b0
cmp r8d, 0x81f2b7d3
je 0x1400063dc
test r9d, r9d
jne 0x140006390
mov rax, qword [rax]
jmp 0x140006360
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rdx, [rbp + 0xa0]
add rax, r10
lea rcx, [rbp + 0xc0]
call rax
mov qword [rbp + 0x140], r14
movabs rdx, 0x8f0d50b26f43bd9f
mov qword [rbp + 0x148], r15
movabs r8, 0xfee347834fc680d0
movdqa xmm2, xmmword [rbp + 0x140]
movabs r9, 0x7a8bf1a49dffed99
mov qword [rbp + 0x120], r13
movabs rcx, 0x1bfd95c5c1cddef4
mov qword [rbp + 0x128], rsi
movabs rax, 0xf7d0ff83cdf8980a
mov qword [rbp + 0x138], rax
movabs rax, 0xf0dbed83cdf8980a
mov qword [rbp + 0x130], rcx
mov qword [rbp + 0x180], r14
mov qword [rbp + 0x188], r15
mov qword [rbp + 0x160], r13
mov qword [rbp + 0x168], rsi
mov qword [rbp + 0x170], rcx
mov qword [rbp + 0x178], rax
mov qword [rbp + 0x1e0], rdx
mov qword [rbp + 0x1e8], r8
mov qword [rbp + 0x1f0], r9
mov qword [rbp + 0x1f8], r12
vmovdqu ymm0, ymmword [rbp + 0x1e0]
vpxor ymm1, ymm0, ymmword [rbp + 0x120]
vmovdqa ymmword [rbp + 0x120], ymm1
mov qword [rbp + 0x200], r14
mov qword [rbp + 0x208], r15
vpxor xmm2, xmm2, xmmword [rbp + 0x200]
vmovdqa xmmword [rbp + 0x140], xmm2
vmovdqa xmm2, xmmword [rbp + 0x180]
mov qword [rbp + 0x220], rdx
mov qword [rbp + 0x228], r8
mov qword [rbp + 0x230], r9
mov qword [rbp + 0x238], r12
vmovdqu ymm0, ymmword [rbp + 0x220]
vpxor ymm1, ymm0, ymmword [rbp + 0x160]
vmovdqa ymmword [rbp + 0x160], ymm1
mov qword [rbp + 0x240], r14
mov qword [rbp + 0x248], r15
vpxor xmm2, xmm2, xmmword [rbp + 0x240]
vmovdqa xmmword [rbp + 0x180], xmm2
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
vzeroupper
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400065d7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400065d7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1400065d2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x1400065b0
cmp r8d, 0x81f2b7d3
je 0x1400065dc
test r9d, r9d
jne 0x140006590
mov rax, qword [rax]
jmp 0x140006560
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rdx, [rbp + 0x120]
add rax, r10
lea rcx, [rbp + 0x160]
call rax
mov rcx, qword [rbp + 0x340]
xor rcx, rsp
call fcn.140011530
lea r11, [rsp + 0x390]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret