Function at 0x14018276c
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rax - 0x768]
sub rsp, 0x840
mov rbx, rdx
lea rsi, [rbp + 0x780]
mov edi, ecx
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x800
call fcn.1403ccc50
mov r8, rsi
lea rcx, [rsp + 0x40]
mov rdx, rbx
call qword [sym.imp.user32.dll_wvsprintfW]
xor r14d, r14d
test edi, edi
jne 0x1401828a6
mov dword [rsp + 0x30], 0x730045
mov ecx, r14d
mov dword [rsp + 0x34], 0x6c0070
mov dword [rsp + 0x38], 0x76
movsxd rax, ecx
xor word [rsp + rax*2 + 0x30], cx
inc ecx
cmp ecx, 5
jb 0x1401827e4
mov word [rsp + 0x3a], r14w
call qword [sym.imp.user32.dll_GetForegroundWindow]
mov rcx, qword gs:[0x60]
mov rsi, rax
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
mov r9, qword [rcx + 0x30]
movsxd rdx, dword [r9 + 0x3c]
mov r10d, dword [rdx + r9 + 0x88]
add r10, r9
cmp r10, r9
je 0x140182878
mov r8d, dword [r10 + 0x18]
test r8d, r8d
je 0x140182878
mov edi, dword [r10 + 0x20]
dec r8d
mov r11d, 0x52c85887
lea rax, [r9 + r8*4]
mov edx, dword [rax + rdi]
add rdx, r9
mov al, byte [rdx]
inc rdx
test al, al
je 0x140182873
movsx eax, al
xor eax, r11d
imul r11d, eax, 0x1000193
mov al, byte [rdx]
inc rdx
test al, al
jne 0x140182854
cmp r11d, 0x769072ac
je 0x14018287d
test r8d, r8d
jne 0x140182838
mov rcx, qword [rcx]
jmp 0x140182813
mov ecx, dword [r10 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
lea r8, [rsp + 0x30]
mov ecx, dword [r10 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
mov r9d, 0x10
jmp 0x140182987
cmp edi, 1
jne 0x14018299a
xor eax, eax
mov dword [rsp + 0x30], 0x6f0049
mov word [rsp + 0x38], ax
mov ecx, r14d
mov dword [rsp + 0x34], 0x6c0064
movsxd rax, ecx
xor word [rsp + rax*2 + 0x30], cx
inc ecx
cmp ecx, 4
jb 0x1401828c9
mov word [rsp + 0x38], r14w
call qword [sym.imp.user32.dll_GetForegroundWindow]
mov rcx, qword gs:[0x60]
mov rsi, rax
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
mov r9, qword [rcx + 0x30]
movsxd rdx, dword [r9 + 0x3c]
mov r10d, dword [rdx + r9 + 0x88]
add r10, r9
cmp r10, r9
je 0x14018295e
mov r8d, dword [r10 + 0x18]
test r8d, r8d
je 0x14018295e
mov edi, dword [r10 + 0x20]
dec r8d
mov r11d, 0xd121e319
lea rax, [rdi + r8*4]
mov edx, dword [rax + r9]
add rdx, r9
mov al, byte [rdx]
inc rdx
test al, al
je 0x140182959
movsx eax, al
xor eax, r11d
imul r11d, eax, 0x1000193
mov al, byte [rdx]
inc rdx
test al, al
jne 0x14018293a
cmp r11d, 0x91da2eea
je 0x140182963
test r8d, r8d
jne 0x14018291d
mov rcx, qword [rcx]
jmp 0x1401828f8
mov ecx, dword [r10 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
lea r8, [rsp + 0x30]
mov ecx, dword [r10 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
mov r9d, 0x40
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [case.0x140173169.0]
jmp 0x140182b69
cmp edi, 2
jne 0x140182a7a
xor eax, eax
mov dword [rsp + 0x30], 0x6f0049
mov word [rsp + 0x38], ax
mov ecx, r14d
mov dword [rsp + 0x34], 0x6c0064
movsxd rax, ecx
xor word [rsp + rax*2 + 0x30], cx
inc ecx
cmp ecx, 4
jb 0x1401829bd
mov word [rsp + 0x38], r14w
call qword [sym.imp.user32.dll_GetForegroundWindow]
mov rcx, qword gs:[0x60]
mov rsi, rax
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
mov r9, qword [rcx + 0x30]
movsxd rdx, dword [r9 + 0x3c]
mov r10d, dword [rdx + r9 + 0x88]
add r10, r9
cmp r10, r9
je 0x140182a51
mov r8d, dword [r10 + 0x18]
test r8d, r8d
je 0x140182a51
mov ebx, dword [r10 + 0x20]
dec r8d
mov r11d, 0x5618271c
lea rax, [r9 + r8*4]
mov edx, dword [rax + rbx]
add rdx, r9
mov al, byte [rdx]
inc rdx
test al, al
je 0x140182a4c
movsx eax, al
xor eax, r11d
imul r11d, eax, 0x1000193
mov al, byte [rdx]
inc rdx
test al, al
jne 0x140182a2d
cmp r11d, 0xbdb3ad21
je 0x140182a56
test r8d, r8d
jne 0x140182a11
mov rcx, qword [rcx]
jmp 0x1401829ec
mov ecx, dword [r10 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
mov r9d, 0x41
jmp 0x140182b56
cmp edi, 3
jne 0x140182b69
xor eax, eax
mov dword [rsp + 0x30], 0x6f0049
mov word [rsp + 0x38], ax
mov ecx, r14d
mov dword [rsp + 0x34], 0x6c0064
movsxd rax, ecx
xor word [rsp + rax*2 + 0x30], cx
inc ecx
cmp ecx, 4
jb 0x140182a9d
mov word [rsp + 0x38], r14w
call qword [sym.imp.user32.dll_GetForegroundWindow]
mov rcx, qword gs:[0x60]
mov rsi, rax
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
mov r9, qword [rcx + 0x30]
movsxd rdx, dword [r9 + 0x3c]
mov r10d, dword [rdx + r9 + 0x88]
add r10, r9
cmp r10, r9
je 0x140182b32
mov r8d, dword [r10 + 0x18]
test r8d, r8d
je 0x140182b32
mov ebx, dword [r10 + 0x20]
dec r8d
mov r11d, 0x8ab14d38
lea rax, [rbx + r8*4]
mov edx, dword [rax + r9]
add rdx, r9
mov al, byte [rdx]
inc rdx
test al, al
je 0x140182b2d
movsx eax, al
xor eax, r11d
imul r11d, eax, 0x1000193
mov al, byte [rdx]
inc rdx
test al, al
jne 0x140182b0e
cmp r11d, 0x1e17d225
je 0x140182b37
test r8d, r8d
jne 0x140182af1
mov rcx, qword [rcx]
jmp 0x140182acc
mov ecx, dword [r10 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
mov r9d, 0x44
lea r8, [rsp + 0x30]
mov rcx, rsi
lea rdx, [rsp + 0x40]
call qword [case.0x140173169.0]
add rsp, 0x840
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret