Function at 0x14007a5d4
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x14019d0c0]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov r14, rdx
mov rbx, rcx
xor r12d, r12d
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov r10d, dword [rcx + r9 + 0x88]
add r10, r9
cmp r10, r9
je 0x14007a686
mov r8d, dword [r10 + 0x18]
test r8d, r8d
je 0x14007a686
mov esi, dword [r10 + 0x20]
dec r8d
lea rcx, [rsi + r8*4]
mov edx, dword [rcx + r9]
add rdx, r9
mov r11d, 0xba61d9b5
mov cl, byte [rdx]
inc rdx
test cl, cl
je 0x14007a681
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
inc rdx
test cl, cl
jne 0x14007a662
cmp r11d, 0xe33b7465
je 0x14007a68b
test r8d, r8d
jne 0x14007a645
mov rax, qword [rax]
jmp 0x14007a620
mov ecx, dword [r10 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r9
mov r8d, dword [rcx + rdx*4]
add r8, r9
xor edx, edx
lea ecx, [rdx + 2]
call r8
mov r15, rax
mov qword [rbx], r12
mov qword [rbx + 8], r12
mov qword [rbx + 0x10], r12
cmp rax, 0xffffffffffffffff
je 0x14007a9a1
xor edx, edx
mov r8d, 0x234
lea rcx, [rsp + 0x34]
call fcn.1400ceb20
mov dword [rsp + 0x30], 0x238
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x14007a756
mov r9d, dword [r10 + 0x18]
test r9d, r9d
je 0x14007a756
mov esi, dword [r10 + 0x20]
dec r9d
lea rcx, [rsi + r9*4]
mov edx, dword [rcx + r8]
add rdx, r8
mov r11d, 0x63623a1a
mov cl, byte [rdx]
inc rdx
test cl, cl
je 0x14007a751
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
inc rdx
test cl, cl
jne 0x14007a732
cmp r11d, 0xb8e4a305
je 0x14007a75b
test r9d, r9d
jne 0x14007a715
mov rax, qword [rax]
jmp 0x14007a6f0
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx edx, word [rcx + r9*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
lea rdx, [rsp + 0x30]
mov rcx, r15
call rax
test eax, eax
je 0x14007a907
lea rcx, [rsp + 0x5c]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r12w
jne 0x14007a78f
mov rcx, qword [r14 + 0x10]
mov r8, r14
cmp qword [r14 + 0x18], 7
jbe 0x14007a7aa
mov r8, qword [r14]
cmp rcx, rax
jne 0x14007a7eb
lea rdx, [rsp + 0x5c]
test rcx, rcx
je 0x14007a8e5
lea rax, [rsp + 0x5c]
sub r8, rax
movzx eax, word [r8 + rdx]
cmp ax, word [rdx]
jne 0x14007a7eb
add rdx, 2
sub rcx, 1
jne 0x14007a7c5
jmp 0x14007a8e5
lea r8, [rsp + 0x20]
mov rcx, rbx
call fcn.1400652dc
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x14007a862
mov r9d, dword [r10 + 0x18]
test r9d, r9d
je 0x14007a862
mov esi, dword [r10 + 0x20]
dec r9d
lea rcx, [rsi + r9*4]
mov edx, dword [rcx + r8]
add rdx, r8
mov r11d, 0xffc8ae9
mov cl, byte [rdx]
inc rdx
test cl, cl
je 0x14007a85d
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
inc rdx
test cl, cl
jne 0x14007a83e
cmp r11d, 0x10a4bf93
je 0x14007a867
test r9d, r9d
jne 0x14007a821
mov rax, qword [rax]
jmp 0x14007a7fc
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx edx, word [rcx + r9*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
lea rdx, [rsp + 0x30]
mov rcx, r15
call rax
test eax, eax
je 0x14007a907
lea rcx, [rsp + 0x5c]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r12w
jne 0x14007a897
mov rcx, qword [r14 + 0x10]
mov r8, r14
cmp qword [r14 + 0x18], 7
jbe 0x14007a8b2
mov r8, qword [r14]
cmp rcx, rax
jne 0x14007a7eb
lea rdx, [rsp + 0x5c]
test rcx, rcx
je 0x14007a8e5
lea rax, [rsp + 0x5c]
sub r8, rax
movzx eax, word [r8 + rdx]
cmp ax, word [rdx]
jne 0x14007a7eb
add rdx, 2
sub rcx, 1
jne 0x14007a8cd
mov rdx, qword [rbx + 8]
mov eax, dword [rsp + 0x38]
cmp rdx, qword [rbx + 0x10]
mov dword [rsp + 0x20], eax
je 0x14007a7de
mov dword [rdx], eax
add qword [rbx + 8], 4
jmp 0x14007a7eb
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x14007a97e
mov r10d, dword [r9 + 0x18]
test r10d, r10d
je 0x14007a97e
mov esi, dword [r9 + 0x20]
dec r10d
lea rcx, [rsi + r10*4]
mov edx, dword [rcx + r8]
add rdx, r8
mov r11d, 0x5dc960c1
mov cl, byte [rdx]
inc rdx
test cl, cl
je 0x14007a979
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
inc rdx
test cl, cl
jne 0x14007a95a
cmp r11d, 0xeac19e61
je 0x14007a983
test r10d, r10d
jne 0x14007a93d
mov rax, qword [rax]
jmp 0x14007a918
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + r10*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
mov rcx, r15
call rax
mov rax, rbx
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.14009e210
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret