Function at 0x140100da0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports
Terminate process

Disassembly:
mov r11, rsp
sub rsp, 0x548
mov rax, qword [0x14041d0c0]
xor rax, rsp
mov qword [rsp + 0x510], rax
mov qword [r11 + 8], rbx
lea rcx, [0x1404b98c7]
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 - 8], rdi
mov qword [r11 - 0x10], r12
mov qword [r11 - 0x18], r13
mov qword [r11 - 0x20], r14
mov qword [r11 - 0x28], r15
call fcn.1402b13b0
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x4d0
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [0x1404930c8]
test rcx, rcx
jne 0x140100f9a
mov rax, qword gs:[0x60]
xor r11d, r11d
mov r10d, 0x8859047e
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rdi, qword [rax]
mov r15, rdi
mov r12, rdi
nop dword [rax]
movups xmm0, xmmword [rdi + 0x58]
movd eax, xmm0
movups xmmword [rsp + 0x20], xmm0
sub ax, 8
mov word [rsp + 0x20], ax
test r11d, r11d
je 0x140100e8d
mov rcx, qword [rsp + 0x28]
mov edx, 0x572cdf0b
movzx eax, ax
shr rax, 1
lea r8, [rcx + rax*2]
cmp rcx, r8
je 0x140100e84
nop dword [rax]
nop dword [rax + rax]
movsx eax, byte [rcx]
add rcx, 2
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r8
jne 0x140100e70
cmp edx, r11d
jne 0x140100f7e
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov r14, qword [rax + r9 + 0x88]
mov ebx, r14d
add rbx, r9
shr r14, 0x20
cmp rbx, r9
je 0x140100f7e
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140100f7e
mov ebp, dword [rbx + 0x20]
dec r8d
mov edx, 0x572cdf0b
lea rax, [r9 + r8*4]
mov eax, dword [rax + rbp]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x140100ef7
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x140100ee0
cmp edx, r10d
je 0x140100f03
test r8d, r8d
jne 0x140100ec0
jmp 0x140100f7e
mov eax, dword [rbx + 0x24]
mov ecx, dword [rbx + 0x1c]
add rax, r9
add rcx, r9
movzx eax, word [rax + r8*2]
mov ecx, dword [rcx + rax*4]
add rcx, r9
cmp rcx, rbx
jbe 0x140100f93
lea rax, [r14 + rbx]
cmp rcx, rax
jae 0x140100f93
movzx eax, byte [rcx]
mov r11d, 0x572cdf0b
mov r10d, r11d
cmp al, 0x2e
je 0x140100f57
nop dword [rax + rax]
movsx eax, al
inc rcx
xor eax, r11d
imul r11d, eax, 0x1000193
movzx eax, byte [rcx]
cmp al, 0x2e
jne 0x140100f40
movzx eax, byte [rcx + 1]
inc rcx
test al, al
je 0x140100f7a
movsx eax, al
lea rcx, [rcx + 1]
xor eax, r10d
imul r10d, eax, 0x1000193
movzx eax, byte [rcx]
test al, al
jne 0x140100f62
mov rdi, qword [r12]
mov rdi, qword [rdi]
cmp rdi, r15
je 0x140100f91
cmp qword [rdi + 0x30], 0
jne 0x140100e30
xor ecx, ecx
mov qword [0x1404930c8], rcx
call rcx
mov r8, qword [0x1404930f0]
mov r13, rax
mov dword [rsp + 0x70], 0x100010
test r8, r8
jne 0x14010114e
mov rcx, qword gs:[0x60]
xor r11d, r11d
mov r10d, 0x4da775a7
mov rdx, qword [rcx + 0x18]
mov rcx, qword [rdx + 0x10]
mov rdi, qword [rcx]
mov r15, rdi
mov r12, rdi
nop word [rax + rax]
movups xmm0, xmmword [rdi + 0x58]
movd eax, xmm0
movups xmmword [rsp + 0x20], xmm0
sub ax, 8
mov word [rsp + 0x20], ax
test r11d, r11d
je 0x14010103d
mov rcx, qword [rsp + 0x28]
mov edx, 0x8ea3ed80
movzx eax, ax
shr rax, 1
lea r8, [rcx + rax*2]
cmp rcx, r8
je 0x140101034
nop dword [rax]
nop dword [rax + rax]
movsx eax, byte [rcx]
add rcx, 2
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r8
jne 0x140101020
cmp edx, r11d
jne 0x140101131
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov r14, qword [rax + r9 + 0x88]
mov ebx, r14d
add rbx, r9
shr r14, 0x20
cmp rbx, r9
je 0x140101131
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140101131
mov ebp, dword [rbx + 0x20]
dec r8d
mov edx, 0x8ea3ed80
lea rax, [r9 + r8*4]
mov ecx, dword [rax + rbp]
add rcx, r9
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1401010a7
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x140101090
cmp edx, r10d
je 0x1401010b3
test r8d, r8d
jne 0x140101070
jmp 0x140101131
mov eax, dword [rbx + 0x24]
mov ecx, dword [rbx + 0x1c]
add rax, r9
add rcx, r9
movzx eax, word [rax + r8*2]
mov r8d, dword [rcx + rax*4]
add r8, r9
cmp r8, rbx
jbe 0x140101147
lea rax, [r14 + rbx]
cmp r8, rax
jae 0x140101147
movzx eax, byte [r8]
mov r11d, 0x8ea3ed80
mov r10d, r11d
cmp al, 0x2e
je 0x140101108
nop word [rax + rax]
movsx eax, al
inc r8
xor eax, r11d
imul r11d, eax, 0x1000193
movzx eax, byte [r8]
cmp al, 0x2e
jne 0x1401010f0
movzx eax, byte [r8 + 1]
inc r8
test al, al
je 0x14010112d
movsx eax, al
lea r8, [r8 + 1]
xor eax, r10d
imul r10d, eax, 0x1000193
movzx eax, byte [r8]
test al, al
jne 0x140101114
mov rdi, qword [r12]
mov rdi, qword [rdi]
cmp rdi, r15
je 0x140101144
cmp qword [rdi + 0x30], 0
jne 0x140100fe0
xor r8d, r8d
mov qword [0x1404930f0], r8
lea rdx, [rsp + 0x40]
mov rcx, r13
call r8
mov r15, qword [rsp + 0x520]
mov r14, qword [rsp + 0x528]
mov r13, qword [rsp + 0x530]
mov r12, qword [rsp + 0x538]
mov rdi, qword [rsp + 0x540]
mov rsi, qword [rsp + 0x560]
mov rbp, qword [rsp + 0x558]
mov rbx, qword [rsp + 0x550]
test eax, eax
je 0x140101285
cmp qword [rsp + 0x88], 0
jne 0x1401011e7
cmp qword [rsp + 0x90], 0
jne 0x1401011e7
cmp qword [rsp + 0x98], 0
jne 0x1401011e7
cmp qword [rsp + 0xa0], 0
jne 0x1401011e7
cmp qword [rsp + 0xa8], 0
jne 0x1401011e7
cmp qword [rsp + 0xb0], 0
je 0x140101285
lea rdx, [rsp + 0x20]
call fcn.1401012a0
movzx r8d, byte [rax]
lea rdx, [rax + 1]
xor byte [rdx], r8b
xor byte [rax + 2], r8b
xor byte [rax + 3], r8b
xor byte [rax + 4], r8b
xor byte [rax + 5], r8b
xor byte [rax + 6], r8b
xor byte [rax + 7], r8b
xor byte [rax + 8], r8b
xor byte [rax + 9], r8b
xor byte [rax + 0xa], r8b
xor byte [rax + 0xb], r8b
xor byte [rax + 0xc], r8b
xor byte [rax + 0xd], r8b
xor byte [rax + 0xe], r8b
xor byte [rax + 0xf], r8b
xor byte [rax + 0x10], r8b
xor byte [rax + 0x11], r8b
xor byte [rax + 0x12], r8b
xor byte [rax + 0x13], r8b
xor byte [rax + 0x14], r8b
xor byte [rax + 0x15], r8b
xor byte [rax + 0x16], r8b
xor byte [rax + 0x17], r8b
xor byte [rax + 0x18], r8b
xor byte [rax + 0x19], r8b
xor byte [rax + 0x1a], r8b
xor byte [rax + 0x1b], r8b
xor byte [rax + 0x1c], r8b
xor byte [rax + 0x1d], r8b
xor byte [rdx + 0x1d], r8b
mov byte [rdx + 0x1e], 0
call fcn.1401001f0
mov ecx, 0x5001
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [rsp + 0x510]
xor rcx, rsp
call fcn.1402aff00
add rsp, 0x548
ret