Function at 0x1400026c8
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x4f], rax
movdqa xmm0, xmmword [0x1400053c0]
xor ecx, ecx
movdqa xmm1, xmmword [str._mnn___r_r]
movdqu xmmword [rbp - 1], xmm0
mov dword [rbp + 0x2f], 0x313f353f
movdqa xmm0, xmmword [0x1400053a0]
movdqu xmmword [rbp + 0x1f], xmm0
mov dword [rbp + 0x33], 0xcec4ce
movdqu xmmword [rbp + 0xf], xmm1
mov byte [rbp + 0x37], 1
lea eax, [rcx + 0x4c]
xor byte [rbp + rcx - 1], al
inc rcx
cmp rcx, 0x37
jb 0x14000272c
mov byte [rbp + 0x37], 0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x1400027b7
mov r9d, dword [r10 + 0x18]
test r9d, r9d
je 0x1400027b7
mov edi, dword [r10 + 0x20]
dec r9d
mov r11d, 0x5322d4de
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r8]
add rdx, r8
mov cl, byte [rdx]
inc rdx
test cl, cl
je 0x1400027b2
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
inc rdx
test cl, cl
jne 0x140002793
cmp r11d, 0x74030275
je 0x1400027bc
test r9d, r9d
jne 0x140002776
mov rax, qword [rax]
jmp 0x140002751
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx edx, word [rcx + r9*2]
mov r9d, 0x20019
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
lea rcx, [rbp + 0x3f]
mov qword [rsp + 0x20], rcx
lea rdx, [rbp - 1]
add rax, r8
mov rcx, 0xffffffff80000002
xor r8d, r8d
call rax
test eax, eax
jne 0x1400029fa
movdqa xmm0, xmmword [0x140005390]
xor ecx, ecx
movdqu xmmword [rbp - 0x19], xmm0
mov dword [rbp + 0x47], 4
mov dword [rbp - 9], 0x2b302833
mov word [rbp - 5], 0x100
lea eax, [rcx + 0x4c]
xor byte [rbp + rcx - 0x19], al
inc rcx
cmp rcx, 0x14
jb 0x14000281f
mov byte [rbp - 4], 0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x1400028a9
mov r9d, dword [r10 + 0x18]
test r9d, r9d
je 0x1400028a9
mov ebx, dword [r10 + 0x20]
dec r9d
mov r11d, 0x41feda0b
lea rcx, [r8 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r8
mov cl, byte [rdx]
inc rdx
test cl, cl
je 0x1400028a4
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
inc rdx
test cl, cl
jne 0x140002885
cmp r11d, 0x4bf1d742
je 0x1400028ae
test r9d, r9d
jne 0x140002869
mov rax, qword [rax]
jmp 0x140002844
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx edx, word [rcx + r9*2]
xor r9d, r9d
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
lea rcx, [rbp + 0x47]
mov qword [rsp + 0x28], rcx
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 0x4b]
add rax, r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, qword [rbp + 0x3f]
call rax
mov rcx, qword gs:[0x60]
mov ebx, eax
mov rax, qword [rcx + 0x18]
mov rax, qword [rax + 0x10]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov r8d, dword [rcx + r9 + 0x88]
add r8, r9
cmp r8, r9
je 0x140002961
mov r10d, dword [r8 + 0x18]
test r10d, r10d
je 0x140002961
mov esi, dword [r8 + 0x20]
dec r10d
mov r11d, 0xb2f97bc0
lea rcx, [r9 + r10*4]
mov edx, dword [rcx + rsi]
add rdx, r9
mov cl, byte [rdx]
inc rdx
test cl, cl
je 0x14000295c
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
inc rdx
test cl, cl
jne 0x14000293d
cmp r11d, 0x6718aecd
je 0x140002966
test r10d, r10d
jne 0x140002921
mov rax, qword [rax]
jmp 0x1400028fc
mov ecx, dword [r8 + 0x24]
add rcx, r9
movzx edx, word [rcx + r10*2]
mov ecx, dword [r8 + 0x1c]
add rcx, r9
mov r8d, dword [rcx + rdx*4]
mov rcx, qword [rbp + 0x3f]
add r8, r9
call r8
test ebx, ebx
jne 0x1400029b2
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Registry_value_UserContextListCount_exists.
call fcn.140003794
lea rdx, [0x140003904]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov al, 1
jmp 0x1400029fc
cmp ebx, 2
jne 0x1400029cc
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Registry_value_UserContextListCount_does_not_exist.
call fcn.140003794
jmp 0x1400029ea
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_query_registry_value._Error_code:
call fcn.140003794
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
lea rdx, [0x140003904]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor al, al
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140004150
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret