Function at 0x7ff70b50b5e0
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r13d, ecx
mov qword [rax + 0x18], 0
mov qword [rax + 0x20], 0
xor r14d, r14d
mov edi, 0x3c60a16d
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
movups xmm0, xmmword [rax + 0x58]
movups xmmword [rsp + 0x40], xmm0
movd ecx, xmm0
sub cx, 8
test r14d, r14d
je 0x7ff70b50b693
mov r9, qword [rsp + 0x48]
movzx ecx, cx
shr rcx, 1
lea r11, [r9 + rcx*2]
mov r10d, 0x811c9dc5
cmp r9, r11
je 0x7ff70b50b68a
nop dword [rax]
nop word [rax + rax]
movsx ecx, byte [r9]
mov edx, ecx
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
add r9, 2
cmp r9, r11
jne 0x7ff70b50b660
cmp r10d, r14d
jne 0x7ff70b50b7d8
mov rbx, qword [rax + 0x30]
test rbx, rbx
je 0x7ff70b50b7e0
movsxd rcx, dword [rbx + 0x3c]
mov rdx, qword [rcx + rbx + 0x88]
mov r12, rdx
shr r12, 0x20
mov esi, edx
add rsi, rbx
cmp rsi, rbx
je 0x7ff70b50b7d8
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x7ff70b50b7d8
mov r15d, dword [rsi + 0x20]
dec r11d
lea rcx, [r15 + r11*4]
mov r8d, dword [rcx + rbx]
add r8, rbx
mov r10d, 0x811c9dc5
movzx r9d, byte [r8]
inc r8
test r9b, r9b
je 0x7ff70b50b71d
movsx ecx, r9b
sub r9b, 0x41
mov edx, ecx
or edx, 0x20
cmp r9b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r9d, byte [r8]
lea r8, [r8 + 1]
test r9b, r9b
jne 0x7ff70b50b6f2
cmp r10d, edi
je 0x7ff70b50b72f
test r11d, r11d
jne 0x7ff70b50b6d2
mov rax, qword [rax]
jmp 0x7ff70b50b622
mov ecx, dword [rsi + 0x1c]
add rcx, rbx
mov eax, dword [rsi + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov r9d, dword [rcx + rax*4]
add r9, rbx
cmp r9, rsi
jbe 0x7ff70b50b7e3
lea rax, [rsi + r12]
cmp r9, rax
jae 0x7ff70b50b7e3
mov edi, 0x811c9dc5
mov r14d, edi
movzx edx, byte [r9]
cmp dl, 0x2e
je 0x7ff70b50b797
nop
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, r14d
imul r14d, ecx, 0x1000193
inc r9
movzx edx, byte [r9]
cmp dl, 0x2e
jne 0x7ff70b50b770
inc r9
movzx edx, byte [r9]
test dl, dl
je 0x7ff70b50b7c7
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, edi
imul edi, ecx, 0x1000193
lea r9, [r9 + 1]
movzx edx, byte [r9]
test dl, dl
jne 0x7ff70b50b7a2
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rax, qword [rax]
jmp 0x7ff70b50b622
xor r9d, r9d
lea r8, [rsp + 0xa8]
mov edx, 0x20
mov rcx, 0xffffffffffffffff
call r9
test eax, eax
js 0x7ff70b50b80e
mov rcx, qword [rsp + 0xa8]
mov qword [rsp + 0xa0], rcx
test eax, eax
jns 0x7ff70b50b819
xor bl, bl
jmp 0x7ff70b50ba51
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x34], r13d
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x3c], 2
xor ebp, ebp
mov edi, 0x61766c5
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
movups xmm0, xmmword [rax + 0x58]
movups xmmword [rsp + 0x40], xmm0
movd ecx, xmm0
sub cx, 8
test ebp, ebp
je 0x7ff70b50b8b3
mov r9, qword [rsp + 0x48]
movzx ecx, cx
shr rcx, 1
lea r11, [r9 + rcx*2]
mov r10d, 0x811c9dc5
cmp r9, r11
je 0x7ff70b50b8aa
nop
movsx ecx, byte [r9]
mov edx, ecx
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
add r9, 2
cmp r9, r11
jne 0x7ff70b50b880
cmp r10d, ebp
jne 0x7ff70b50ba06
mov rbx, qword [rax + 0x30]
test rbx, rbx
je 0x7ff70b50ba0e
movsxd rcx, dword [rbx + 0x3c]
mov rdx, qword [rcx + rbx + 0x88]
mov r12, rdx
shr r12, 0x20
mov esi, edx
add rsi, rbx
cmp rsi, rbx
je 0x7ff70b50ba06
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x7ff70b50ba06
mov r15d, dword [rsi + 0x20]
dec r11d
lea rcx, [r15 + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0x811c9dc5
movzx ecx, byte [r9]
inc r9
test cl, cl
je 0x7ff70b50b94a
nop dword [rax]
nop word [rax + rax]
movsx edx, cl
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
movzx ecx, byte [r9]
lea r9, [r9 + 1]
test cl, cl
jne 0x7ff70b50b920
cmp r10d, edi
je 0x7ff70b50b95c
test r11d, r11d
jne 0x7ff70b50b8f2
mov rax, qword [rax]
jmp 0x7ff70b50b850
mov ecx, dword [rsi + 0x1c]
add rcx, rbx
mov eax, dword [rsi + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov r10d, dword [rcx + rax*4]
add r10, rbx
cmp r10, rsi
jbe 0x7ff70b50ba11
lea rax, [rsi + r12]
cmp r10, rax
jae 0x7ff70b50ba11
mov ebp, 0x811c9dc5
mov edi, ebp
movzx edx, byte [r10]
cmp dl, 0x2e
je 0x7ff70b50b9c5
nop word [rax + rax]
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, ebp
imul ebp, ecx, 0x1000193
inc r10
movzx edx, byte [r10]
cmp dl, 0x2e
jne 0x7ff70b50b9a0
inc r10
movzx edx, byte [r10]
test dl, dl
je 0x7ff70b50b9f5
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, edi
imul edi, ecx, 0x1000193
lea r10, [r10 + 1]
movzx edx, byte [r10]
test dl, dl
jne 0x7ff70b50b9d0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rax, qword [rax]
jmp 0x7ff70b50b850
xor r10d, r10d
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0x10
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, qword [rsp + 0xa0]
call r10
mov ebx, eax
mov eax, 0xc0000061
cmp ebx, 0x106
cmove ebx, eax
shr ebx, 0x1f
xor bl, 1
lea rcx, [rsp + 0xa0]
call fcn.7ff70b4fd930
movzx eax, bl
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret