Function at 0x140015330
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x140
lea rbp, [rsp + 0x50]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x14004b040]
xor rax, rsp
mov qword [rbp + 0xe0], rax
mov dword [rbp + 0xa0], 1
movabs rsi, 0x54b483e07143fafc
mov qword [rbp + 0x60], rsi
mov rax, qword [rbp + 0x60]
mov qword [rbp], rax
movabs r14, 0x8ec22a259951205f
mov qword [rbp + 0x60], r14
mov rax, qword [rbp + 0x60]
mov qword [rbp + 8], rax
movabs rax, 0x38d0ad8c1d278e92
mov qword [rbp + 0x60], rax
mov rax, qword [rbp + 0x60]
mov qword [rbp + 0xa0], rax
movabs rax, 0x8ec22a2599512033
mov qword [rbp + 0x60], rax
mov rax, qword [rbp + 0x60]
mov qword [rbp + 0xa8], rax
movdqa xmm0, xmmword [rbp + 0xa0]
xorps xmm0, xmmword [rbp]
movdqa xmmword [rbp], xmm0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140015476
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140015476
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0xafbfbd44
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140015471
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140015450
cmp r8d, 0x4e2e7a66
je 0x14001547b
test r9d, r9d
jne 0x140015430
mov rax, qword [rax]
jmp 0x140015400
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
lea rcx, [rbp]
call rdx
mov rcx, rax
movabs rdi, 0x56a7c2e86952e6e1
movabs rdx, 0xe7b64b48eb3e465d
movabs r13, 0x71a9dfe96876fadc
movabs r8, 0x267da3b57872797b
movabs r9, 0x1844987368f054c6
movabs r15, 0x5518c0da0a221714
movabs r12, 0x1844987368f054b5
test rax, rax
je 0x1400157a8
mov qword [rbp + 0x60], r13
mov rax, qword [rbp + 0x60]
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x60], rdx
mov rax, qword [rbp + 0x60]
mov qword [rbp + 0x28], rax
mov qword [rbp + 0x60], r8
mov rax, qword [rbp + 0x60]
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x60], r9
mov rax, qword [rbp + 0x60]
mov qword [rbp + 0x38], rax
movabs rax, 0x38d0ad8c1d278e92
mov qword [rbp + 0x60], rax
mov rax, qword [rbp + 0x60]
mov qword [rbp + 0xa0], rax
movabs rax, 0x8ec22a2599512033
mov qword [rbp + 0x60], rax
mov rax, qword [rbp + 0x60]
mov qword [rbp + 0xa8], rax
mov qword [rbp + 0x60], r15
mov rax, qword [rbp + 0x60]
mov qword [rbp + 0xb0], rax
mov qword [rbp + 0x60], r12
mov rax, qword [rbp + 0x60]
mov qword [rbp + 0xb8], rax
vmovdqu ymm0, ymmword [rbp + 0x20]
vpxor ymm1, ymm0, ymmword [rbp + 0xa0]
vmovdqa ymmword [rbp + 0x20], ymm1
lea rdx, [rbp + 0x20]
vzeroupper
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x1400157a8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rax, [rbp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp + 0xa0]
mov edx, 0x1f
call rbx
test eax, eax
js 0x1400157a8
cmp dword [rbp + 0xa0], 0
jne 0x1400157a8
lea rdx, [0x1402c3598]
lea rcx, [rbp + 0x40]
call fcn.1400108d0
mov r8, rax
lea rdx, [rbp + 0xc0]
lea rcx, [0x1402c33e4]
call fcn.14000b350
nop
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0xbfe25e08b9220d13
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0x38d0ad8c1d278e92
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
movabs rax, 0x8ec22a2599512033
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
vmovdqu ymm0, ymmword [rbp + 0x80]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
vzeroupper
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140015726
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140015726
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x798fafc1
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140015721
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140015700
cmp r8d, 0xe1574194
je 0x14001572b
test r9d, r9d
jne 0x1400156e0
mov rax, qword [rax]
jmp 0x1400156b0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov r8d, dword [rcx + rax*4]
add r8, r10
xor edx, edx
lea rcx, [rbp + 0x20]
call r8
nop
mov rdx, qword [rbp + 0xd8]
cmp rdx, 0xf
jbe 0x140015791
inc rdx
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001578c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001578c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400275d0
movdqa xmm0, xmmword [0x140044540]
movdqu xmmword [rbp + 0xd0], xmm0
mov byte [rbp + 0xc0], 0
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
movabs rsi, 0x38d0ad8c1d278e92
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
movabs r14, 0x8ec22a2599512033
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
movdqa xmm0, xmmword [rbp + 0x60]
xorps xmm0, xmmword [rbp + 0xa0]
movdqa xmmword [rbp + 0x60], xmm0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140015896
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140015896
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x611aef44
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140015891
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140015870
cmp r8d, 0x7e830c66
je 0x14001589b
test r9d, r9d
jne 0x140015850
mov rax, qword [rax]
jmp 0x140015820
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
lea rcx, [rbp + 0x60]
call rdx
mov r8, rax
test rax, rax
je 0x140015b71
mov qword [rbp], r13
mov rcx, qword [rbp]
mov qword [rbp + 0x20], rcx
movabs rax, 0xe7b64b48eb3e465d
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x28], rcx
movabs rax, 0x267da3b57872797b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rax, 0x1844987368f054c6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0xd0], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0xd8], rax
vmovdqu ymm0, ymmword [rbp + 0x20]
vpxor ymm1, ymm0, ymmword [rbp + 0xc0]
vmovdqa ymmword [rbp + 0x20], ymm1
lea rdx, [rbp + 0x20]
mov rcx, r8
vzeroupper
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140015b71
mov qword [rbp + 0xa0], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rax, [rbp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 8
lea r8, [rbp + 0xa0]
mov edx, 0x1e
call rbx
test eax, eax
js 0x140015b71
cmp qword [rbp + 0xa0], 0
je 0x140015b71
lea rdx, [0x1402c3598]
lea rcx, [rbp + 0x40]
call fcn.1400108d0
mov r8, rax
lea rdx, [rbp + 0x80]
lea rcx, [0x1402c33e4]
call fcn.14000b350
nop
movabs rax, 0x56a7c2e86952e6e1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0xbfe25e08b9220d13
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0xd0], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0xd8], rax
vmovdqu ymm0, ymmword [rbp + 0xc0]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
vzeroupper
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140015b06
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140015b06
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
mov r8d, 0xad4eb525
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140015b01
nop
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x140015ae0
cmp r8d, 0xd5c2f8b0
je 0x140015b0b
test r9d, r9d
jne 0x140015ac0
mov rax, qword [rax]
jmp 0x140015a90
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov r8d, dword [rcx + rax*4]
add r8, r10
xor edx, edx
lea rcx, [rbp + 0x20]
call r8
nop
mov rdx, qword [rbp + 0x98]
cmp rdx, 0xf
jbe 0x140015b71
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015b6c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140015b6c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400275d0
mov rcx, qword [rbp + 0xe0]
xor rcx, rsp
call fcn.1400275b0
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret