Function at 0x140036f00
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x140090040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x70], 1
xor r15d, r15d
mov qword [rsp + 0x60], r15
mov dword [rsp + 0x68], r15d
mov word [rsp + 0x6c], 0x500
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rbp, qword [rcx + 0x10]
mov rdi, rbp
nop word [rax + rax]
mov r11, qword [rdi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov esi, dword [rax + r11 + 0x88]
add rsi, r11
cmp rsi, r11
je 0x140036fee
mov r10d, dword [rsi + 0x18]
test r10d, r10d
je 0x140036fee
mov r14d, dword [rsi + 0x20]
nop word [rax + rax]
dec r10d
mov r9d, 0x811c9dc5
lea rax, [r14 + r10*4]
mov edx, dword [rax + r11]
add rdx, r11
movzx r8d, byte [rdx]
inc rdx
test r8b, r8b
je 0x140036fe9
movsx eax, r8b
lea rdx, [rdx + 1]
sub r8b, 0x41
mov ecx, eax
or ecx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rdx - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test r8b, r8b
jne 0x140036fb0
cmp r9d, 0xdb3de4b3
je 0x140037146
test r10d, r10d
jne 0x140036f90
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rbp
je 0x140037003
cmp qword [rax + 0x30], r15
jne 0x140036f60
mov rax, r15
lea rcx, [rsp + 0x60]
mov r9d, 0x220
mov qword [rsp + 0x50], rcx
mov r8d, 0x20
mov dword [rsp + 0x48], r15d
lea rcx, [rsp + 0x68]
mov dword [rsp + 0x40], r15d
mov dl, 2
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
call rax
test eax, eax
je 0x14003711c
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rbp, qword [rcx + 0x10]
mov rdi, rbp
nop
mov r11, qword [rdi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov esi, dword [rax + r11 + 0x88]
add rsi, r11
cmp rsi, r11
je 0x1400370ea
mov r10d, dword [rsi + 0x18]
test r10d, r10d
je 0x1400370ea
mov r14d, dword [rsi + 0x20]
nop word [rax + rax]
dec r10d
mov r9d, 0x811c9dc5
lea rax, [r14 + r10*4]
mov eax, dword [rax + r11]
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x1400370e5
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r9d
imul r9d, edx, 0x1000193
test r8b, r8b
jne 0x1400370b0
cmp r9d, 0x3b137204
je 0x140037162
test r10d, r10d
jne 0x140037090
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rbp
je 0x1400370ff
cmp qword [rax + 0x30], r15
jne 0x140037060
mov rax, r15
mov rdx, qword [rsp + 0x60]
lea r8, [rsp + 0x70]
xor ecx, ecx
call rax
test eax, eax
je 0x140037119
mov r15d, dword [rsp + 0x70]
mov eax, r15d
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140049190
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
mov ecx, dword [rsi + 0x24]
add rcx, r11
movzx edx, word [rcx + r10*2]
mov ecx, dword [rsi + 0x1c]
add rcx, r11
mov eax, dword [rcx + rdx*4]
add rax, r11
jmp 0x140037006
mov ecx, dword [rsi + 0x24]
add rcx, r11
movzx edx, word [rcx + r10*2]
mov ecx, dword [rsi + 0x1c]
add rcx, r11
mov eax, dword [rcx + rdx*4]
add rax, r11
jmp 0x140037102