Function at 0x140046530
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports
Terminate process

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xf0
mov rax, qword [0x14013b080]
xor rax, rsp
mov qword [rsp + 0xe8], rax
mov rbx, rcx
mov qword [r11 - 0x38], rcx
mov rdx, rcx
lea rcx, [r11 - 0x90]
call fcn.140044d10
mov rdx, rax
lea rcx, [0x1406e7610]
call fcn.140056ed0
cmp byte [0x1406e7820], 0
je 0x14004662f
mov byte [0x1406e5355], 1
call fcn.1400479d0
call fcn.140047830
call fcn.140047900
call fcn.1400464d0
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1400465e5
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x1400465e0
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140046628
mov rcx, r8
call fcn.1400ab700
xor r8d, r8d
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
mov rcx, qword [rsp + 0xe8]
xor rcx, rsp
call fcn.1400ab610
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rdx, [rsp + 0x88]
call fcn.140046a80
mov rdx, rax
mov qword [rsp + 0x20], rax
movzx ecx, byte [rax + 1]
xor cl, 0x33
mov byte [rsp + 0x50], cl
movzx ecx, byte [rax + 2]
xor cl, 0x33
mov byte [rsp + 0x58], cl
movzx ecx, byte [rax + 3]
xor cl, 0x33
mov byte [rsp + 0x60], cl
movzx eax, byte [rax + 4]
xor al, 0x33
mov byte [rsp + 0x68], al
movzx eax, byte [rdx + 5]
xor al, 0x33
mov byte [rsp + 0x70], al
movzx eax, byte [rdx + 6]
xor al, 0x33
mov byte [rsp + 0x30], al
movzx eax, byte [rdx + 7]
xor al, 0x33
mov byte [rsp + 0x38], al
movzx eax, byte [rdx + 8]
xor al, 0x33
mov byte [rsp + 0x40], al
movzx r13d, byte [rdx + 9]
xor r13b, 0x33
mov qword [rsp + 0x48], r13
movzx r12d, byte [rdx + 0xa]
xor r12b, 0x33
mov qword [rsp + 0x28], r12
movzx r15d, byte [rdx + 0xb]
xor r15b, 0x33
movzx r14d, byte [rdx + 0xc]
xor r14b, 0x33
movzx ebp, byte [rdx + 0xd]
xor bpl, 0x33
movzx ecx, byte [rdx + 0xe]
xor cl, 0x33
movzx esi, byte [rdx + 0xf]
xor sil, 0x33
movzx edi, byte [rdx + 0x10]
xor dil, 0x33
movzx ebx, byte [rdx + 0x11]
xor bl, 0x33
movzx r11d, byte [rdx + 0x12]
xor r11b, 0x33
movzx r10d, byte [rdx + 0x13]
xor r10b, 0x33
movzx r9d, byte [rdx + 0x14]
xor r9b, 0x33
movzx r8d, byte [rdx + 0x15]
xor r8b, 0x33
movzx edx, byte [rdx + 0x16]
xor dl, 0x33
mov r13, qword [rsp + 0x20]
movzx eax, byte [r13 + 0x17]
xor al, 0x33
xor byte [r13], 0x33
mov r13, qword [rsp + 0x50]
mov r12, qword [rsp + 0x20]
mov byte [r12 + 1], r13b
mov r13, qword [rsp + 0x58]
mov byte [r12 + 2], r13b
mov r13, qword [rsp + 0x60]
mov byte [r12 + 3], r13b
mov r13, qword [rsp + 0x68]
mov byte [r12 + 4], r13b
mov r13, qword [rsp + 0x70]
mov byte [r12 + 5], r13b
mov r13, qword [rsp + 0x30]
mov byte [r12 + 6], r13b
mov r13, qword [rsp + 0x38]
mov byte [r12 + 7], r13b
mov r13, qword [rsp + 0x40]
mov byte [r12 + 8], r13b
mov r13, qword [rsp + 0x48]
mov byte [r12 + 9], r13b
mov r12, qword [rsp + 0x28]
mov r13, qword [rsp + 0x20]
mov byte [r13 + 0xa], r12b
mov byte [r13 + 0xb], r15b
mov byte [r13 + 0xc], r14b
mov byte [r13 + 0xd], bpl
mov byte [r13 + 0xe], cl
mov byte [r13 + 0xf], sil
mov byte [r13 + 0x10], dil
mov byte [r13 + 0x11], bl
mov byte [r13 + 0x12], r11b
mov byte [r13 + 0x13], r10b
mov byte [r13 + 0x14], r9b
mov byte [r13 + 0x15], r8b
mov byte [r13 + 0x16], dl
mov byte [r13 + 0x17], al
mov rdx, r13
lea rcx, [rsp + 0xa8]
call fcn.140044bf0
mov rdx, rax
lea rcx, [0x1406e7610]
call fcn.140058160
mov r9, qword [0x1406e7a60]
test r9, r9
jne 0x14004685f
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [rax + 0x60]
movzx edx, word [rax + 0x58]
shr rdx, 1
lea r9, [rcx + rdx*2]
mov r8d, 0xd938f60
cmp rcx, r9
je 0x14004684f
nop word [rax + rax]
movsx edx, byte [rcx]
xor edx, r8d
imul r8d, edx, 0x1000193
add rcx, 2
cmp rcx, r9
jne 0x140046830
cmp r8d, 0x312c872c
je 0x140046854
mov rax, qword [rax]
jmp 0x140046810
mov r9, qword [rax + 0x30]
mov qword [0x1406e7a60], r9
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
xor r8d, r8d
mov r11d, dword [rbx + r9 + 0x20]
nop dword [rax]
nop word [rax + rax]
mov r10d, r8d
lea rax, [r11 + r10*4]
mov ecx, dword [rax + r9]
add rcx, r9
mov edx, 0xe9390f3
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1400468be
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x1400468a0
cmp edx, 0xe1d60412
je 0x1400468c3
inc r8d
jmp 0x140046880
mov ecx, dword [rbx + r9 + 0x24]
add rcx, r9
movzx edx, word [rcx + r10*2]
mov ecx, dword [rbx + r9 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x78]
call fcn.140046ae0
mov rdi, rax
mov qword [rsp + 0x38], rax
movzx ebx, byte [rax + 1]
xor bl, 0x34
movzx r11d, byte [rax + 2]
xor r11b, 0x34
movzx r10d, byte [rax + 3]
xor r10b, 0x34
movzx r9d, byte [rax + 4]
xor r9b, 0x34
movzx r8d, byte [rax + 5]
xor r8b, 0x34
movzx edx, byte [rax + 6]
xor dl, 0x34
movzx ecx, byte [rax + 7]
xor cl, 0x34
movzx eax, byte [rax + 8]
xor al, 0x34
xor byte [rdi], 0x34
mov byte [rdi + 1], bl
mov byte [rdi + 2], r11b
mov byte [rdi + 3], r10b
mov byte [rdi + 4], r9b
mov byte [rdi + 5], r8b
mov byte [rdi + 6], dl
mov byte [rdi + 7], cl
mov byte [rdi + 8], al
lea rdx, [rsp + 0xc8]
call fcn.140046ab0
mov qword [rsp + 0x20], rax
movzx ecx, byte [rax + 1]
xor cl, 0x34
mov byte [rsp + 0x28], cl
movzx r13d, byte [rax + 2]
xor r13b, 0x34
mov qword [rsp + 0x48], r13
movzx r12d, byte [rax + 3]
xor r12b, 0x34
mov qword [rsp + 0x40], r12
movzx r15d, byte [rax + 4]
xor r15b, 0x34
movzx r14d, byte [rax + 5]
xor r14b, 0x34
movzx ebp, byte [rax + 6]
xor bpl, 0x34
movzx esi, byte [rax + 7]
xor sil, 0x34
movzx edi, byte [rax + 8]
xor dil, 0x34
movzx ebx, byte [rax + 9]
xor bl, 0x34
movzx r11d, byte [rax + 0xa]
xor r11b, 0x34
movzx r10d, byte [rax + 0xb]
xor r10b, 0x34
movzx r9d, byte [rax + 0xc]
xor r9b, 0x34
movzx r8d, byte [rax + 0xd]
xor r8b, 0x34
movzx edx, byte [rax + 0xe]
xor dl, 0x34
mov r13, rax
movzx ecx, byte [rax + 0xf]
xor cl, 0x34
movzx eax, byte [rax + 0x10]
xor al, 0x34
xor byte [r13], 0x34
mov r13, qword [rsp + 0x28]
mov r12, qword [rsp + 0x20]
mov byte [r12 + 1], r13b
mov r13, qword [rsp + 0x48]
mov byte [r12 + 2], r13b
mov r12, qword [rsp + 0x40]
mov r13, qword [rsp + 0x20]
mov byte [r13 + 3], r12b
mov byte [r13 + 4], r15b
mov byte [r13 + 5], r14b
mov byte [r13 + 6], bpl
mov byte [r13 + 7], sil
mov byte [r13 + 8], dil
mov byte [r13 + 9], bl
mov byte [r13 + 0xa], r11b
mov byte [r13 + 0xb], r10b
mov byte [r13 + 0xc], r9b
mov byte [r13 + 0xd], r8b
mov byte [r13 + 0xe], dl
mov byte [r13 + 0xf], cl
mov byte [r13 + 0x10], al
xor r9d, r9d
mov r8, qword [rsp + 0x38]
mov rdx, r13
xor ecx, ecx
call qword [rsp + Ordinal_50]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3