Function at 0x140020440
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0xb0
mov rax, qword [0x1400c9438]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rax, qword gs:[0x60]
xor edi, edi
mov r9d, edi
mov esi, 0xb6fb6126
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov ecx, dword [rax + 0x58]
sub cx, 8
test r9d, r9d
je 0x1400204d4
mov rdx, qword [rax + 0x60]
mov r8d, 0x811c9dc5
movzx ecx, cx
shr rcx, 1
lea r10, [rdx + rcx*2]
cmp rdx, r10
je 0x1400204cb
movsx ecx, byte [rdx]
add rdx, 2
xor ecx, r8d
imul r8d, ecx, 0x1000193
cmp rdx, r10
jne 0x1400204b5
cmp r8d, r9d
jne 0x140020615
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov rdx, qword [rcx + r11 + 0x88]
mov r15, rdx
mov ebx, edx
shr r15, 0x20
add rbx, r11
cmp rbx, r11
je 0x140020615
mov r10d, dword [rbx + 0x18]
test r10d, r10d
je 0x140020615
mov r14d, dword [rbx + 0x20]
nop word [rax + rax]
dec r10d
mov r8d, 0x811c9dc5
lea rcx, [r14 + r10*4]
mov edx, dword [rcx + r11]
add rdx, r11
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140020549
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x140020530
cmp r8d, esi
je 0x14002055b
test r10d, r10d
jne 0x140020510
mov rax, qword [rax]
jmp 0x140020490
mov ecx, dword [rbx + 0x24]
add rcx, r11
movzx edx, word [rcx + r10*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r11
mov r8d, dword [rcx + rdx*4]
add r8, r11
cmp r8, rbx
jbe 0x14002061d
lea rax, [rbx + r15]
cmp r8, rax
jae 0x14002061d
movzx eax, byte [r8]
mov r9d, 0x811c9dc5
mov dword [rsp + 0x20], r9d
mov ecx, r9d
mov dword [rsp + 0x24], ecx
cmp al, 0x2e
je 0x1400205cd
nop dword [rax]
nop word [rax + rax]
movsx eax, al
inc r8
xor eax, r9d
imul r9d, eax, 0x1000193
movzx eax, byte [r8]
cmp al, 0x2e
jne 0x1400205b0
mov dword [rsp + 0x20], r9d
movzx eax, byte [r8 + 1]
inc r8
test al, al
je 0x1400205fb
nop dword [rax]
movsx eax, al
lea r8, [r8 + 1]
xor eax, ecx
imul ecx, eax, 0x1000193
movzx eax, byte [r8]
test al, al
jne 0x1400205e0
mov dword [rsp + 0x24], ecx
mov rax, qword gs:[0x60]
mov rsi, qword [rsp + 0x20]
shr rsi, 0x20
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rax, qword [rax]
jmp 0x140020490
lea rcx, [rsp + 0x70]
call r8
cmp dword [rsp + 0x90], 2
jb 0x1400207e6
mov dword [rsp + 0x30], 0x40
mov ebx, 0x845ddef6
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov ecx, dword [rax + 0x58]
sub cx, 8
test edi, edi
je 0x140020694
mov rdx, qword [rax + 0x60]
mov r8d, 0x811c9dc5
movzx ecx, cx
shr rcx, 1
lea r9, [rdx + rcx*2]
cmp rdx, r9
je 0x14002068b
movsx ecx, byte [rdx]
add rdx, 2
xor ecx, r8d
imul r8d, ecx, 0x1000193
cmp rdx, r9
jne 0x140020675
cmp r8d, edi
jne 0x1400207c4
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov rdx, qword [rcx + r10 + 0x88]
mov rbp, rdx
mov r11d, edx
shr rbp, 0x20
add r11, r10
cmp r11, r10
je 0x1400207c4
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x1400207c4
mov r14d, dword [r11 + 0x20]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [r14 + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140020709
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x1400206f0
cmp r8d, ebx
je 0x14002071b
test r9d, r9d
jne 0x1400206d0
mov rax, qword [rax]
jmp 0x140020651
mov ecx, dword [r11 + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
cmp rax, r11
jbe 0x1400207cc
lea rcx, [r11 + rbp]
cmp rax, rcx
jae 0x1400207cc
movzx ecx, byte [rax]
mov edi, 0x811c9dc5
mov dword [rsp + 0x20], edi
mov edx, edi
mov dword [rsp + 0x24], edx
cmp cl, 0x2e
je 0x14002077b
movsx ecx, cl
inc rax
xor ecx, edi
imul edi, ecx, 0x1000193
movzx ecx, byte [rax]
cmp cl, 0x2e
jne 0x140020761
mov dword [rsp + 0x20], edi
movzx ecx, byte [rax + 1]
inc rax
test cl, cl
je 0x1400207aa
nop word [rax + rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax]
test cl, cl
jne 0x140020790
mov dword [rsp + 0x24], edx
mov rax, qword gs:[0x60]
mov rbx, qword [rsp + 0x20]
shr rbx, 0x20
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rax, qword [rax]
jmp 0x140020651
lea rcx, [rsp + 0x30]
call rax
mov rax, qword [rsp + 0x38]
shr rax, 0x14
cmp eax, 0x800
setb al
jmp 0x1400207e8
mov al, 1
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400790d0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret