Function at 0x140002590
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x68
xor eax, eax
xor r15d, r15d
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov rax, qword gs:[0x60]
or esi, 0xffffffff
lea r13d, [r15 + 1]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x140002631
mov r9d, dword [r10 + 0x18]
test r9d, r9d
je 0x140002631
mov edi, dword [r10 + 0x20]
add r9d, esi
mov r11d, 0x76c7f0d7
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r8]
add rdx, r8
mov cl, byte [rdx]
add rdx, r13
test cl, cl
je 0x14000262c
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
add rdx, r13
test cl, cl
jne 0x14000260d
cmp r11d, 0xd0bda142
je 0x140002636
test r9d, r9d
jne 0x1400025f0
mov rax, qword [rax]
jmp 0x1400025cb
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx edx, word [rcx + r9*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
lea rcx, str.ntdll.dll
add rax, r8
call rax
mov r9d, 0x18
mov qword [rsp + 0xc8], rax
lea r8, [rsp + 0x40]
mov rdx, rax
or rcx, 0xffffffffffffffff
mov r14, rax
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
mov rcx, qword gs:[0x60]
mov r12, qword [rsp + 0x40]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
mov r8, qword [rcx + 0x30]
movsxd rdx, dword [r8 + 0x3c]
mov r10d, dword [rdx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x1400026f7
mov r9d, dword [r10 + 0x18]
test r9d, r9d
je 0x1400026f7
mov edi, dword [r10 + 0x20]
add r9d, esi
mov r11d, 0x7fdf97c1
lea rax, [rdi + r9*4]
mov edx, dword [rax + r8]
add rdx, r8
mov al, byte [rdx]
add rdx, r13
test al, al
je 0x1400026f2
movsx eax, al
xor eax, r11d
imul r11d, eax, 0x1000193
mov al, byte [rdx]
add rdx, r13
test al, al
jne 0x1400026d3
cmp r11d, 0x47b14d62
je 0x1400026fc
test r9d, r9d
jne 0x1400026b6
mov rcx, qword [rcx]
jmp 0x140002691
mov ecx, dword [r10 + 0x24]
add rcx, r8
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 3
movzx edx, word [rcx + r9*2]
xor r9d, r9d
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
mov edx, 0x80000000
add rax, r8
lea rcx, str.c:windows_system32_ntdll.dll
mov r8d, r13d
call rax
xor r9d, r9d
mov qword [rsp + 0x28], r15
xor edx, edx
mov qword [rsp + 0xb8], rax
mov r8d, 0x1000002
mov dword [rsp + 0x20], r15d
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rcx, qword gs:[0x60]
mov rbp, rax
mov qword [rsp + 0xc0], rax
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
mov r9, qword [rcx + 0x30]
movsxd rdx, dword [r9 + 0x3c]
mov r10d, dword [rdx + r9 + 0x88]
add r10, r9
cmp r10, r9
je 0x1400027e6
mov r8d, dword [r10 + 0x18]
test r8d, r8d
je 0x1400027e6
mov edi, dword [r10 + 0x20]
dec r8d
mov r11d, 0x6f28576a
lea rax, [rdi + r8*4]
mov edx, dword [rax + r9]
add rdx, r9
mov al, byte [rdx]
add rdx, r13
test al, al
je 0x1400027e1
movsx eax, al
xor eax, r11d
imul r11d, eax, 0x1000193
mov al, byte [rdx]
add rdx, r13
test al, al
jne 0x1400027c2
cmp r11d, 0x4ad22696
je 0x1400027eb
test r8d, r8d
jne 0x1400027a5
mov rcx, qword [rcx]
jmp 0x140002780
mov ecx, dword [r10 + 0x24]
add rcx, r9
mov qword [rsp + 0x20], r15
movzx edx, word [rcx + r8*2]
xor r8d, r8d
mov ecx, dword [r10 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
mov rcx, rbp
add rax, r9
xor r9d, r9d
lea edx, [r9 + 4]
call rax
movsxd rbx, dword [r12 + 0x3c]
mov r13, rax
add rbx, r12
movzx edi, r15w
cmp r15w, word [rbx + 6]
jae 0x140002a0a
movzx ecx, word [rbx + 0x14]
add rcx, rbx
movzx eax, di
lea rdx, [rax + rax*4]
lea rbp, [rcx + rdx*8]
lea rcx, [rbp + 0x18]
lea rdx, str..text
call fcn.14002b480
test eax, eax
jne 0x1400029e5
mov esi, dword [rbp + 0x24]
mov dword [rsp + 0xb0], r15d
add rsi, r12
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov r10d, dword [rcx + r9 + 0x88]
add r10, r9
cmp r10, r9
je 0x1400028e4
mov r8d, dword [r10 + 0x18]
test r8d, r8d
je 0x1400028e4
mov r15d, dword [r10 + 0x20]
dec r8d
mov r11d, 0xba639ec0
lea rcx, [r15 + r8*4]
mov edx, dword [rcx + r9]
add rdx, r9
mov cl, byte [rdx]
inc rdx
test cl, cl
je 0x1400028dc
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
inc rdx
test cl, cl
jne 0x1400028bd
cmp r11d, 0x552067a2
je 0x1400028e9
test r8d, r8d
jne 0x1400028a0
xor r15d, r15d
mov rax, qword [rax]
jmp 0x14000287b
mov edx, dword [r10 + 0x24]
mov rcx, rsi
add rdx, r9
movzx r8d, word [rdx + r8*2]
mov edx, dword [r10 + 0x1c]
add rdx, r9
mov eax, dword [rdx + r8*4]
mov r8d, 0x40
mov edx, dword [rbp + 0x20]
add rax, r9
lea r9, [rsp + 0xb0]
call rax
mov eax, dword [rbp + 0x24]
mov r8d, dword [rbp + 0x20]
lea rdx, [rax + r13]
lea rcx, [rax + r12]
call fcn.14000aab0
mov rax, qword gs:[0x60]
mov r15d, dword [rbp + 0x24]
add r15, r12
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov r10d, dword [rcx + r9 + 0x88]
add r10, r9
cmp r10, r9
je 0x1400029ab
mov r8d, dword [r10 + 0x18]
test r8d, r8d
je 0x1400029ab
mov r14d, dword [r10 + 0x20]
dec r8d
mov r11d, 0xec870cde
lea rcx, [r14 + r8*4]
mov edx, dword [rcx + r9]
add rdx, r9
mov cl, byte [rdx]
inc rdx
test cl, cl
je 0x1400029a6
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
inc rdx
test cl, cl
jne 0x140002987
cmp r11d, 0xfb4f9774
je 0x1400029b0
test r8d, r8d
jne 0x14000296a
mov rax, qword [rax]
jmp 0x140002945
mov edx, dword [r10 + 0x24]
mov rcx, r15
add rdx, r9
movzx r8d, word [rdx + r8*2]
mov edx, dword [r10 + 0x1c]
add rdx, r9
mov eax, dword [rdx + r8*4]
mov edx, dword [rbp + 0x20]
add rax, r9
mov r8d, dword [rsp + 0xb0]
lea r9, [rsp + 0xb0]
call rax
xor r15d, r15d
inc di
cmp di, word [rbx + 6]
jb 0x140002832
mov rsi, qword [rsp + 0xb8]
mov rbp, qword [rsp + 0xc0]
mov r14, qword [rsp + 0xc8]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x140002a8b
mov r9d, dword [r10 + 0x18]
test r9d, r9d
je 0x140002a8b
mov edi, dword [r10 + 0x20]
mov r12d, 1
or r13d, 0xffffffff
add r9d, r13d
mov r11d, 0x964c5104
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r8]
add rdx, r8
mov cl, byte [rdx]
add rdx, r12
test cl, cl
je 0x140002a86
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
add rdx, r12
test cl, cl
jne 0x140002a67
cmp r11d, 0x7361804e
je 0x140002a90
test r9d, r9d
jne 0x140002a4a
mov rax, qword [rax]
jmp 0x140002a1b
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx edx, word [rcx + r9*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
mov rcx, rsi
add rax, r8
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x140002b25
mov r9d, dword [r10 + 0x18]
test r9d, r9d
je 0x140002b25
mov edi, dword [r10 + 0x20]
add r9d, r13d
mov r11d, 0xa2ab384e
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r8]
add rdx, r8
mov cl, byte [rdx]
add rdx, r12
test cl, cl
je 0x140002b20
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
add rdx, r12
test cl, cl
jne 0x140002b01
cmp r11d, 0xeb9b7704
je 0x140002b2a
test r9d, r9d
jne 0x140002ae4
mov rax, qword [rax]
jmp 0x140002abf
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx edx, word [rcx + r9*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
mov rcx, rbp
add rax, r8
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x140002bbf
mov r10d, dword [r9 + 0x18]
test r10d, r10d
je 0x140002bbf
mov edi, dword [r9 + 0x20]
add r10d, r13d
mov r11d, 0xbf133324
lea rcx, [rdi + r10*4]
mov edx, dword [rcx + r8]
add rdx, r8
mov cl, byte [rdx]
add rdx, r12
test cl, cl
je 0x140002bba
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
add rdx, r12
test cl, cl
jne 0x140002b9b
cmp r11d, 0x692c3e3d
je 0x140002bc4
test r10d, r10d
jne 0x140002b7e
mov rax, qword [rax]
jmp 0x140002b59
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + r10*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
mov rcx, r14
add rax, r8
call rax
xor eax, eax
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret