Function at 0x14002c394
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x68]
sub rsp, 0x140
mov rax, qword [0x14006e030]
xor rax, rsp
mov qword [rbp + 0x30], rax
movabs rax, 0xd2a9f234d93f2fd8
lea rcx, [rbp - 0x70]
mov qword [rbp - 0x70], rax
movabs rax, 0xaa6c2cf70d3a0f44
mov qword [rbp - 0x68], rax
movabs rax, 0xbecddc06ea5a43b7
movdqa xmm0, xmmword [rbp - 0x70]
mov qword [rsp + 0x40], rax
movabs rax, 0xaa6c2cf70d3a0f28
mov qword [rsp + 0x48], rax
pxor xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rbp - 0x70], xmm0
call fcn.140027798
mov rbx, qword [0x14006f7a8]
xor r14d, r14d
test rbx, rbx
jne 0x14002c650
mov rax, qword gs:[0x60]
mov r13d, r14d
mov r15d, r14d
mov dword [rsp + 0x34], 0x1d81d388
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
movups xmm0, xmmword [rax + 0x58]
movd ecx, xmm0
movups xmmword [rsp + 0x40], xmm0
sub cx, 8
test r15d, r15d
je 0x14002c4b0
cmp r13, qword [rax + 0x30]
je 0x14002c4b0
mov r9, qword [rsp + 0x48]
mov r10d, 0xadbbf7d
movzx ecx, cx
shr rcx, 1
lea r11, [r9 + rcx*2]
jmp 0x14002c4a2
movsx ecx, byte [r9]
mov edx, ecx
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
add r9, 2
cmp r9, r11
jne 0x14002c47d
cmp r10d, r15d
jne 0x14002c63e
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov rcx, qword [rcx + r9 + 0x88]
mov r10d, ecx
add r10, r9
shr rcx, 0x20
cmp r10, r9
je 0x14002c63e
mov ebx, dword [r10 + 0x18]
test ebx, ebx
je 0x14002c63e
mov r12d, dword [r10 + 0x20]
dec ebx
mov esi, 0xadbbf7d
lea rdx, [r9 + rbx*4]
mov r11d, dword [rdx + r12]
add r11, r9
jmp 0x14002c518
movsx edx, dil
sub dil, 0x41
mov r8d, edx
or r8d, 0x20
cmp dil, 0x19
cmova r8d, edx
xor r8d, esi
imul esi, r8d, 0x1000193
mov dil, byte [r11]
inc r11
test dil, dil
jne 0x14002c4f7
cmp esi, dword [rsp + 0x34]
je 0x14002c535
xor r14d, r14d
test ebx, ebx
jne 0x14002c4e3
jmp 0x14002c63e
mov edx, dword [r10 + 0x24]
add rdx, r9
movzx r8d, word [rdx + rbx*2]
mov edx, dword [r10 + 0x1c]
add rdx, r9
mov ebx, dword [rdx + r8*4]
add rbx, r9
cmp rbx, r10
jbe 0x14002c646
lea rax, [rcx + r10]
cmp rbx, rax
jae 0x14002c646
mov esi, 0xadbbf7d
lea rcx, [rbp - 0x50]
xor r14d, r14d
mov dword [rsp + 0x68], esi
xor edx, edx
mov qword [rsp + 0x60], r14
mov edi, esi
mov dword [rsp + 0x6c], esi
lea r8d, [r14 + 0x40]
call sub.msvcrt.dll_memset
mov al, byte [rbx]
cmp al, 0x2e
je 0x14002c5b3
lea rcx, [rbp - 0x50]
sub rcx, rbx
mov byte [rcx + rbx], al
inc rbx
movsx eax, al
xor eax, edi
imul edi, eax, 0x1000193
mov al, byte [rbx]
cmp al, 0x2e
jne 0x14002c598
mov dword [rsp + 0x68], edi
mov eax, dword [rbp - 0x50]
cmp eax, 0x2d697061
je 0x14002c5d2
cmp eax, 0x2d495041
je 0x14002c5d2
cmp eax, 0x2d747865
je 0x14002c5d2
cmp eax, 0x2d545845
jne 0x14002c5e1
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x60], rax
inc rbx
mov dl, byte [rbx]
test dl, dl
je 0x14002c610
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
inc rbx
xor ecx, esi
imul esi, ecx, 0x1000193
mov dl, byte [rbx]
test dl, dl
jne 0x14002c5ea
mov dword [rsp + 0x6c], esi
mov rax, qword gs:[0x60]
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x40], xmm0
mov ecx, dword [rsp + 0x4c]
mov rax, qword [rax + 0x18]
mov r15d, dword [rsp + 0x48]
mov r13, qword [rsp + 0x40]
mov dword [rsp + 0x34], ecx
mov rax, qword [rax + 0x10]
mov rax, qword [rax]
jmp 0x14002c44a
mov qword [0x14006f7a8], rbx
xor r14d, r14d
mov edx, 2
xor ecx, ecx
call rbx
test eax, eax
js 0x14002c987
mov rbx, qword [0x14006f7b0]
mov qword [rsp + 0x50], r14
test rbx, rbx
jne 0x14002c894
mov rax, qword gs:[0x60]
mov r13, r14
mov r15d, r14d
mov dword [rsp + 0x34], 0xb4e2088
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
movups xmm0, xmmword [rax + 0x58]
movd ecx, xmm0
movups xmmword [rsp + 0x40], xmm0
sub cx, 8
test r15d, r15d
je 0x14002c6fb
cmp r13, qword [rax + 0x30]
je 0x14002c6fb
mov r9, qword [rsp + 0x48]
mov r10d, 0x95898c01
movzx ecx, cx
shr rcx, 1
lea r11, [r9 + rcx*2]
jmp 0x14002c6ed
movsx ecx, byte [r9]
mov edx, ecx
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
add r9, 2
cmp r9, r11
jne 0x14002c6c8
cmp r10d, r15d
jne 0x14002c882
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov rcx, qword [rcx + r9 + 0x88]
mov r10d, ecx
add r10, r9
shr rcx, 0x20
cmp r10, r9
je 0x14002c882
mov ebx, dword [r10 + 0x18]
test ebx, ebx
je 0x14002c882
mov r12d, dword [r10 + 0x20]
dec ebx
mov esi, 0x95898c01
lea rdx, [r9 + rbx*4]
mov r11d, dword [rdx + r12]
add r11, r9
jmp 0x14002c763
movsx edx, dil
sub dil, 0x41
mov r8d, edx
or r8d, 0x20
cmp dil, 0x19
cmova r8d, edx
xor r8d, esi
imul esi, r8d, 0x1000193
mov dil, byte [r11]
inc r11
test dil, dil
jne 0x14002c742
cmp esi, dword [rsp + 0x34]
je 0x14002c780
xor r14d, r14d
test ebx, ebx
jne 0x14002c72e
jmp 0x14002c882
mov edx, dword [r10 + 0x24]
add rdx, r9
movzx r8d, word [rdx + rbx*2]
mov edx, dword [r10 + 0x1c]
add rdx, r9
mov ebx, dword [rdx + r8*4]
add rbx, r9
cmp rbx, r10
jbe 0x14002c88a
lea rax, [rcx + r10]
cmp rbx, rax
jae 0x14002c88a
mov esi, 0x95898c01
lea rcx, [rbp - 0x10]
xor r14d, r14d
mov dword [rbp - 0x68], esi
xor edx, edx
mov qword [rbp - 0x70], r14
mov edi, esi
mov dword [rbp - 0x64], esi
lea r8d, [r14 + 0x40]
call sub.msvcrt.dll_memset
mov al, byte [rbx]
cmp al, 0x2e
je 0x14002c7fa
lea rcx, [rbp - 0x10]
sub rcx, rbx
mov byte [rbx + rcx], al
inc rbx
movsx eax, al
xor eax, edi
imul edi, eax, 0x1000193
mov al, byte [rbx]
cmp al, 0x2e
jne 0x14002c7e0
mov dword [rbp - 0x68], edi
mov eax, dword [rbp - 0x10]
cmp eax, 0x2d697061
je 0x14002c819
cmp eax, 0x2d495041
je 0x14002c819
cmp eax, 0x2d747865
je 0x14002c819
cmp eax, 0x2d545845
jne 0x14002c827
lea rcx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rbp - 0x70], rax
inc rbx
mov dl, byte [rbx]
test dl, dl
je 0x14002c855
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
inc rbx
xor ecx, esi
imul esi, ecx, 0x1000193
mov dl, byte [rbx]
test dl, dl
jne 0x14002c830
mov dword [rbp - 0x64], esi
mov rax, qword gs:[0x60]
movaps xmm0, xmmword [rbp - 0x70]
movdqa xmmword [rsp + 0x40], xmm0
mov ecx, dword [rsp + 0x4c]
mov rax, qword [rax + 0x18]
mov r15d, dword [rsp + 0x48]
mov r13, qword [rsp + 0x40]
mov dword [rsp + 0x34], ecx
mov rax, qword [rax + 0x10]
mov rax, qword [rax]
jmp 0x14002c695
mov qword [0x14006f7b0], rbx
xor r14d, r14d
xor edx, edx
lea rax, [rsp + 0x50]
lea r9, [0x1400607e0]
mov qword [rsp + 0x20], rax
lea rcx, [0x1400607f0]
lea r8d, [rdx + 1]
call rbx
test eax, eax
js 0x14002c987
mov rcx, qword [rsp + 0x50]
movabs rdx, 0xbef3dc29ea22438b
mov word [rsp + 0x30], r14w
movabs r8, 0xbecddc06ea5a43b7
mov qword [rbp - 0x80], r8
lea r8, [rsp + 0x30]
mov rax, qword [rcx]
mov qword [rbp - 0x60], rdx
movabs rdx, 0xaa6c2cf70d3a0f28
mov qword [rbp - 0x58], rdx
movdqa xmm0, xmmword [rbp - 0x60]
mov qword [rbp - 0x78], rdx
lea rdx, [rbp - 0x60]
pxor xmm0, xmmword [rbp - 0x80]
movdqa xmmword [rbp - 0x60], xmm0
call qword [rax + 0x208]
test eax, eax
js 0x14002c94d
cmp word [rsp + 0x30], 0xffff
jne 0x14002c94d
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x58], r14
mov r8, qword [rcx]
call qword [r8 + 0x68]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
jne 0x14002c951
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov al, 1
jmp 0x14002c989
mov qword [rsp + 0x70], r14
lea rdx, [rsp + 0x70]
mov rax, qword [rcx]
call qword [rax + 0x38]
mov rax, qword [rsp + 0x70]
test rax, rax
je 0x14002c9b6
cmp word [rax], 0x78
jne 0x14002c9b6
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + 0x10]
xor al, al
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.140051b80
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x14002c94d