Function at 0x14005b8e0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xc0
mov rax, qword [0x1400af040]
xor rax, rsp
mov qword [rbp - 1], rax
mov r13, qword [rbp + 0x8f]
xor ebx, ebx
mov eax, 0x5a4d
mov qword [rbp - 0x61], rcx
mov r15, rdx
mov r14, rcx
mov qword [rbp - 0x49], rbx
mov qword [rbp - 0x39], rbx
cmp word [rdx], ax
jne 0x14005be33
movsxd rsi, dword [rdx + 0x3c]
add rsi, rdx
cmp dword [rsi], 0x4550
jne 0x14005be33
mov eax, 0x20b
cmp word [rsi + 0x18], ax
jne 0x14005be33
mov r12d, dword [rsi + 0x50]
lea r9d, [rbx + 4]
mov edx, r12d
xor ecx, ecx
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp - 0x79], rax
test rax, rax
je 0x14005be33
movzx ecx, word [rsi + 0x14]
lea r8, [rbx - 1]
mov r9d, ebx
mov edx, ebx
mov eax, dword [rcx + rsi + 0x24]
sub r12d, eax
mov ecx, r12d
and rcx, 0xfffffffffffff000
mov dword [rbp - 0x51], eax
add rcx, 0x1000
mov edi, r12d
mov qword [rsp + 0x20], rcx
mov rcx, r14
call fcn.140053fa0
mov qword [rbp - 0x71], rax
test rax, rax
je 0x14005ba2f
lea r8, [rax + 0x28]
mov dword [rbp - 0x59], ebx
lea r9d, [rbx + 4]
mov rcx, r14
lea rdx, [rbp - 0x59]
call fcn.140053d30
test al, al
je 0x14005ba2f
mov ecx, dword [rbp - 0x59]
cmp rcx, rdi
mov rdi, qword [rbp - 0x71]
jb 0x14005ba19
mov rdx, rdi
mov rcx, r14
call fcn.140054170
mov qword [rbp - 0x69], rax
test rax, rax
je 0x14005ba19
mov rdx, rdi
mov rcx, r14
call fcn.140054340
test al, al
jne 0x14005bac0
mov rdx, qword [rbp - 0x69]
mov r8, rdi
mov rcx, r14
call fcn.140054500
mov rdx, rdi
mov rcx, r14
call fcn.1400546a0
mov rdx, rdi
mov rcx, r14
call fcn.140054840
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14005babb
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14005babb
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x996957b4
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14005bab6
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x14005ba90
cmp r8d, 0x47c31295
je 0x14005be0e
test r9d, r9d
jne 0x14005ba70
mov rax, qword [rax]
jmp 0x14005ba40
mov r8d, dword [rsi + 0x54]
mov rdx, r15
mov rcx, qword [rbp - 0x79]
call sub.VCRUNTIME140.dll_memcpy
movzx edi, word [rsi + 0x14]
mov r14d, ebx
add rdi, 0x28
cmp bx, word [rsi + 6]
jae 0x14005bb1f
mov rbx, qword [rbp - 0x79]
add rdi, rsi
nop dword [rax + rax]
test dword [rdi + 0x14], 0x80
ja 0x14005bb0d
mov edx, dword [rdi + 4]
mov ecx, dword [rdi - 4]
add rdx, r15
mov r8d, dword [rdi]
add rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
movzx eax, word [rsi + 6]
inc r14d
add rdi, 0x28
cmp r14d, eax
jl 0x14005baf0
xor ebx, ebx
mov r15d, dword [rbp - 0x51]
lea rcx, [rbp - 0x29]
mov r14, qword [rbp - 0x69]
mov rdx, qword [rbp - 0x79]
sub r14, r15
mov rdi, r14
sub rdi, qword [rsi + 0x30]
call fcn.14005ca40
mov rdx, rdi
mov rcx, rax
call fcn.14005be60
mov rdi, qword [rbp - 0x79]
mov rdx, r14
mov rcx, rdi
call fcn.14005bf60
test al, al
je 0x14005be33
mov rdx, rdi
lea rcx, [rbp - 0x29]
call fcn.14005cb90
mov rcx, qword [rbp - 0x61]
mov rdx, rax
call fcn.14005c190
test al, al
je 0x14005bd09
mov rax, qword [rbp - 0x79]
add rax, r15
mov edi, r12d
mov r15, qword [rbp - 0x61]
je 0x14005bd17
test r12d, r12d
mov r12, qword [rbp - 0x69]
je 0x14005bd1b
mov qword [rsp + 0x38], rbx
lea r8, [rbp - 0x29]
mov qword [rbp - 0x19], rax
mov r9d, 0x28
lea rax, [rbp - 0x51]
mov qword [rbp - 0x21], rbx
mov qword [rsp + 0x30], rax
mov edx, 0x80862007
mov dword [rsp + 0x28], ebx
mov rcx, r15
mov qword [rsp + 0x20], rbx
mov qword [rbp - 0x29], 0x33
mov qword [rbp - 0x11], r12
mov qword [rbp - 9], rdi
mov dword [rbp - 0x51], ebx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x14005bd1b
mov esi, dword [rsi + 0x28]
lea rdx, [rbp - 0x49]
add rsi, r14
lea rcx, [rbp - 0x39]
mov r14, qword [rbp - 0x71]
mov r9d, edi
mov r8, r12
mov qword [rsp + 0x20], r14
call fcn.14006df40
test al, al
je 0x14005bd1f
mov rax, qword [rbp - 0x49]
lea rdx, [rbp - 0x59]
mov r9, r12
mov qword [rsp + 0x20], rax
mov r8, rsi
mov dword [rbp - 0x59], ebx
mov rcx, r15
call fcn.14005c3f0
test al, al
je 0x14005bd1f
test r13, r13
je 0x14005bc4f
mov eax, dword [rbp - 0x59]
mov dword [r13], eax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov r11d, dword [rcx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x14005bcd5
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x14005bcd5
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [rbx + r9*4]
mov r8d, dword [rdx + r10]
mov edx, 0x13835969
add r8, r10
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x14005bcd0
nop
movsx ecx, cl
lea r8, [r8 + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8 - 1]
test cl, cl
jne 0x14005bcb0
cmp edx, 0xe228f826
je 0x14005bcda
test r9d, r9d
jne 0x14005bc90
mov rax, qword [rax]
jmp 0x14005bc60
mov eax, dword [r11 + 0x24]
mov r8d, 0x8000
mov ecx, dword [r11 + 0x1c]
add rax, r10
add rcx, r10
movzx edx, word [rax + r9*2]
mov eax, dword [rcx + rdx*4]
xor edx, edx
mov rcx, qword [rbp - 0x79]
add rax, r10
call rax
mov rax, r12
jmp 0x14005be35
mov r15, qword [rbp - 0x61]
mov r14, qword [rbp - 0x71]
mov r12, qword [rbp - 0x69]
jmp 0x14005bd23
mov r12, qword [rbp - 0x69]
mov r14, qword [rbp - 0x71]
mov rdi, qword [rbp - 0x79]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov r11d, dword [rcx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x14005bdb5
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x14005bdb5
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [rbx + r9*4]
mov r8d, dword [rdx + r10]
mov edx, 0xf6f57db8
add r8, r10
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x14005bdb0
nop
movsx ecx, cl
lea r8, [r8 + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8 - 1]
test cl, cl
jne 0x14005bd90
cmp edx, 0x4a13c239
je 0x14005bdba
test r9d, r9d
jne 0x14005bd70
mov rax, qword [rax]
jmp 0x14005bd40
mov eax, dword [r11 + 0x24]
mov r8d, 0x8000
mov ecx, dword [r11 + 0x1c]
add rax, r10
add rcx, r10
movzx edx, word [rax + r9*2]
mov eax, dword [rcx + rdx*4]
xor edx, edx
add rax, r10
mov rcx, rdi
call rax
mov r8, r14
mov rdx, r12
mov rcx, r15
call fcn.140054500
test al, al
je 0x14005be33
mov rdx, r14
mov rcx, r15
call fcn.1400546a0
test al, al
je 0x14005be33
mov rdx, r14
mov rcx, r15
call fcn.140054840
jmp 0x14005be33
mov ecx, dword [rbx + 0x24]
mov r8d, 0x8000
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor edx, edx
mov rcx, qword [rbp - 0x79]
add rax, r10
call rax
xor eax, eax
mov rcx, qword [rbp - 1]
xor rcx, rsp
call fcn.14007fe40
mov rbx, qword [rsp + 0x110]
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret