Function at 0x1400df364
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov eax, dword [0x1401efea0]
xor esi, esi
cmp word [0x1401efea2], si
mov ebx, 0x29e4129f
vpxor xmm0, xmm0, xmm0
vmovups ymmword [rbp + 0x27], ymm0
vmovups xmmword [rbp + 0x47], xmm0
vmovups xmm0, xmmword [0x1401efe90]
vmovups xmmword [rbp - 9], xmm0
mov dword [rbp + 0x67], esi
mov dword [rbp + 7], eax
je 0x1400df3f0
mov r8d, esi
lea r9, [rbp - 9]
mov eax, ebx
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movzx eax, ax
imul ecx, eax, 0x37
movzx eax, r8w
inc r8d
sub ax, cx
add ax, 0x34
xor word [r9], ax
lea r9, [r9 + 2]
cmp r8d, 0xa
jl 0x1400df3bd
lea rcx, [rbp - 9]
vzeroupper
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r8, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x1400df6a3
cmp byte [0x1401efec1], sil
vmovups xmm0, xmmword [0x1401efea8]
movzx ecx, word [0x1401efec0]
vmovups xmmword [rbp + 0xb], xmm0
vmovsd xmm0, qword [0x1401efeb8]
vmovsd qword [rbp + 0x1b], xmm0
mov word [rbp + 0x23], cx
je 0x1400df470
mov r9d, esi
lea r10, [rbp + 0xb]
mov eax, ebx
mul r9d
mov eax, r9d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x37
mov al, r9b
inc r9d
sub al, cl
add al, 0x34
xor byte [r10], al
inc r10
cmp r9d, 0x1a
jl 0x1400df443
lea rdx, [rbp + 0xb]
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x1400df6a3
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rcx, [rbp + 0x67]
mov r9d, Ordinal_50
mov qword [rsp + 0x20], rcx
lea r8, [rbp + 0x27]
mov rcx, rax
xor edx, edx
call rbx
test eax, eax
js 0x1400df6a3
mov rax, qword [rbp + 0x2f]
test rax, rax
je 0x1400df6a3
cmp byte [rax + 2], sil
je 0x1400df6a3
mov byte [0x1403460f0], 1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x1400df546
mov r9d, dword [r10 + 0x18]
test r9d, r9d
je 0x1400df546
mov edi, dword [r10 + 0x20]
dec r9d
mov r11d, 0x811c9dc5
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r8]
add rdx, r8
mov cl, byte [rdx]
inc rdx
test cl, cl
je 0x1400df541
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
inc rdx
test cl, cl
jne 0x1400df522
cmp r11d, 0xcded1a85
je 0x1400df54b
test r9d, r9d
jne 0x1400df505
mov rax, qword [rax]
jmp 0x1400df4e0
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx edx, word [rcx + r9*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r8
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x1400df5df
mov r9d, dword [r10 + 0x18]
test r9d, r9d
je 0x1400df5df
mov edi, dword [r10 + 0x20]
dec r9d
mov r11d, 0x811c9dc5
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r8]
add rdx, r8
mov cl, byte [rdx]
inc rdx
test cl, cl
je 0x1400df5da
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
inc rdx
test cl, cl
jne 0x1400df5bb
cmp r11d, 0xe80fd3a
je 0x1400df5e4
test r9d, r9d
jne 0x1400df59e
mov rax, qword [rax]
jmp 0x1400df579
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx edx, word [rcx + r9*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r8
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x1400df678
mov r10d, dword [r9 + 0x18]
test r10d, r10d
je 0x1400df678
mov edi, dword [r9 + 0x20]
dec r10d
mov r11d, 0x811c9dc5
lea rcx, [rdi + r10*4]
mov edx, dword [rcx + r8]
add rdx, r8
mov cl, byte [rdx]
inc rdx
test cl, cl
je 0x1400df673
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
inc rdx
test cl, cl
jne 0x1400df654
cmp r11d, 0xa52bcaf9
je 0x1400df67d
test r10d, r10d
jne 0x1400df637
mov rax, qword [rax]
jmp 0x1400df612
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + r10*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
call rax
mov dword [0], 0xdead
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret