Function at 0x14000ca54
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xd8
mov rax, qword [0x14006e030]
xor rax, rsp
mov qword [rbp + 7], rax
cmp qword [rcx + 0x18], 0x10
mov rsi, r9
mov rdi, r8
mov rbx, rdx
jb 0x14000ca8e
mov rcx, qword [rcx]
and qword [rsp + 0x30], 0
mov r8d, 3
and dword [rsp + 0x28], 0
xor r9d, r9d
mov edx, 0x100
mov dword [rsp + 0x20], r8d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rbp - 0x59], rax
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x14000cac6
xor al, al
jmp 0x14000cd2b
mov rcx, rbx
call fcn.14000c2c8
mov rcx, rdi
mov qword [rbp - 0x41], rax
call fcn.14000c2c8
mov rcx, rsi
mov qword [rbp - 0x49], rax
call fcn.14000c2c8
mov rbx, qword [0x14006f6a0]
mov qword [rbp - 0x51], rax
test rbx, rbx
jne 0x14000cd0a
mov rax, qword gs:[0x60]
xor r12d, r12d
xor esi, esi
mov r13d, 0x9523e1cf
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
movups xmm0, xmmword [rax + 0x58]
movd ecx, xmm0
movups xmmword [rbp - 0x69], xmm0
sub cx, 8
test esi, esi
je 0x14000cb79
cmp r12, qword [rax + 0x30]
je 0x14000cb79
mov r9, qword [rbp - 0x61]
mov r10d, 0x83697710
movzx ecx, cx
shr rcx, 1
lea r11, [r9 + rcx*2]
jmp 0x14000cb6b
movsx ecx, byte [r9]
mov edx, ecx
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
add r9, 2
cmp r9, r11
jne 0x14000cb46
cmp r10d, esi
jne 0x14000ccf7
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov rcx, qword [rcx + r9 + 0x88]
mov r10d, ecx
add r10, r9
shr rcx, 0x20
cmp r10, r9
je 0x14000ccf7
mov ebx, dword [r10 + 0x18]
test ebx, ebx
je 0x14000ccf7
mov edx, dword [r10 + 0x20]
dec ebx
mov r14d, 0x83697710
lea rdx, [rdx + rbx*4]
mov r11d, dword [rdx + r9]
add r11, r9
jmp 0x14000cbe2
movsx edx, dil
sub dil, 0x41
mov r8d, edx
or r8d, 0x20
cmp dil, 0x19
cmova r8d, edx
xor r8d, r14d
imul r14d, r8d, 0x1000193
mov dil, byte [r11]
inc r11
test dil, dil
jne 0x14000cbc1
cmp r14d, r13d
je 0x14000cbff
mov edx, dword [r10 + 0x20]
test ebx, ebx
jne 0x14000cbac
jmp 0x14000ccf7
mov edx, dword [r10 + 0x24]
add rdx, r9
movzx r8d, word [rdx + rbx*2]
mov edx, dword [r10 + 0x1c]
add rdx, r9
mov ebx, dword [rdx + r8*4]
add rbx, r9
cmp rbx, r10
jbe 0x14000ccff
lea rax, [r10 + rcx]
cmp rbx, rax
jae 0x14000ccff
and qword [rbp - 0x79], 0
lea rcx, [rbp - 0x39]
mov edi, 0x83697710
xor edx, edx
mov dword [rbp - 0x71], edi
mov esi, edi
mov dword [rbp - 0x6d], edi
lea r8d, [rdx + 0x40]
call sub.msvcrt.dll_memset
mov al, byte [rbx]
cmp al, 0x2e
je 0x14000cc77
lea rcx, [rbp - 0x39]
sub rcx, rbx
mov byte [rcx + rbx], al
inc rbx
movsx eax, al
xor eax, edi
imul edi, eax, 0x1000193
mov al, byte [rbx]
cmp al, 0x2e
jne 0x14000cc5d
mov dword [rbp - 0x71], edi
mov eax, dword [rbp - 0x39]
cmp eax, 0x2d697061
je 0x14000cc96
cmp eax, 0x2d495041
je 0x14000cc96
cmp eax, 0x2d747865
je 0x14000cc96
cmp eax, 0x2d545845
jne 0x14000cca4
lea rcx, [rbp - 0x39]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rbp - 0x79], rax
inc rbx
mov dl, byte [rbx]
test dl, dl
je 0x14000ccd2
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
inc rbx
xor ecx, esi
imul esi, ecx, 0x1000193
mov dl, byte [rbx]
test dl, dl
jne 0x14000ccad
mov dword [rbp - 0x6d], esi
mov rax, qword gs:[0x60]
movaps xmm0, xmmword [rbp - 0x79]
movdqa xmmword [rbp - 0x69], xmm0
mov r13d, dword [rbp - 0x5d]
mov rax, qword [rax + 0x18]
mov esi, dword [rbp - 0x61]
mov r12, qword [rbp - 0x69]
mov rax, qword [rax + 0x10]
mov rax, qword [rax]
jmp 0x14000cb16
mov r14, qword [rbp - 0x59]
mov qword [0x14006f6a0], rbx
lea r9, [rbp - 0x51]
mov rcx, r14
lea r8, [rbp - 0x49]
lea rdx, [rbp - 0x41]
call rbx
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
setne al
mov rcx, qword [rbp + 7]
xor rcx, rsp
call fcn.140051b80
add rsp, 0xd8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret