Function at 0x14004c27c
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xa0
mov rax, qword [0x140093028]
xor rax, rsp
mov qword [rbp - 9], rax
mov rax, qword [rbp + 0x8f]
xor r15d, r15d
mov qword [rbp - 0x51], rax
mov rdi, rdx
mov eax, 0x5a4d
mov qword [rbp - 0x61], rcx
mov r12, rcx
mov qword [rbp - 0x29], r15
mov qword [rbp - 0x19], r15
cmp word [rdx], ax
jne 0x14004c6ee
movsxd rbx, dword [rdx + 0x3c]
add rbx, rdx
cmp dword [rbx], 0x4550
jne 0x14004c6ee
mov eax, 0x20b
cmp word [rbx + 0x18], ax
jne 0x14004c6ee
mov r14d, dword [rbx + 0x50]
lea r9d, [r15 + 4]
mov edx, r14d
xor ecx, ecx
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp - 0x59], rax
mov rsi, rax
test rax, rax
je 0x14004c6ee
movzx ecx, word [rbx + 0x14]
mov eax, dword [rcx + rbx + 0x24]
sub r14d, eax
mov edx, r14d
mov dword [rbp - 0x69], eax
mov rcx, r12
call fcn.140046348
mov r13, rax
test rax, rax
je 0x14004c364
mov r8d, r14d
mov rdx, rax
mov rcx, r12
call fcn.14004668c
test al, al
jne 0x14004c3e3
mov r8d, r14d
mov rdx, r13
mov rcx, r12
call fcn.140046500
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x14004c3de
mov r10d, dword [r9 + 0x18]
test r10d, r10d
je 0x14004c3de
mov edi, dword [r9 + 0x20]
dec r10d
mov r11d, 0xa8bebcdf
lea rcx, [r8 + r10*4]
mov edx, dword [rcx + rdi]
add rdx, r8
mov cl, byte [rdx]
inc rdx
test cl, cl
je 0x14004c3d9
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
inc rdx
test cl, cl
jne 0x14004c3b6
cmp r11d, 0xb3acc940
je 0x14004c6c8
test r10d, r10d
jne 0x14004c39a
mov rax, qword [rax]
jmp 0x14004c375
mov r8d, dword [rbx + 0x54]
mov rdx, rdi
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
movzx esi, word [rbx + 0x14]
xor ecx, ecx
add rsi, 0x28
cmp cx, word [rbx + 6]
jae 0x14004c43a
mov r12, qword [rbp - 0x59]
add rsi, rbx
test dword [rsi + 0x14], 0x80
ja 0x14004c426
mov edx, dword [rsi + 4]
mov ecx, dword [rsi - 4]
add rdx, rdi
mov r8d, dword [rsi]
add rcx, r12
call sub.VCRUNTIME140.dll_memcpy
movzx eax, word [rbx + 6]
inc r15d
add rsi, 0x28
cmp r15d, eax
jl 0x14004c409
mov r12, qword [rbp - 0x61]
mov eax, dword [rbp - 0x69]
lea rcx, [rbp - 0x49]
mov r15, qword [rbp - 0x59]
mov rsi, r13
sub rsi, rax
mov rdx, r15
mov rdi, rsi
sub rdi, qword [rbx + 0x30]
call fcn.14004d13c
mov r11, rax
mov r10, qword [rax + 8]
mov rdx, qword [rax]
cmp rdx, r10
je 0x14004c4b7
xor eax, eax
mov r8d, eax
cmp dword [rdx + 0x10], eax
jbe 0x14004c4ae
mov rax, qword [rdx + 8]
mov ecx, r8d
movzx r9d, word [rax + rcx*2]
mov ecx, 0xf000
movzx eax, r9w
and ax, cx
mov ecx, 0xa000
cmp ax, cx
jne 0x14004c4a3
mov rax, qword [rdx]
and r9d, 0xfff
add qword [r9 + rax], rdi
inc r8d
cmp r8d, dword [rdx + 0x10]
jb 0x14004c473
xor eax, eax
add rdx, 0x18
cmp rdx, r10
jne 0x14004c46b
mov rcx, r11
call fcn.14004ca78
mov rdx, rsi
mov rcx, r15
call fcn.14004c718
test al, al
je 0x14004c6ee
mov rdx, r15
lea rcx, [rbp - 0x49]
call fcn.14004d28c
mov rdx, rax
mov rcx, r12
call fcn.14004c8f8
test al, al
je 0x14004c617
mov r8d, dword [rbp - 0x69]
mov rdx, r13
add r8, r15
mov r9d, r14d
mov rcx, r12
mov edi, r14d
call fcn.140046138
test al, al
je 0x14004c617
mov ebx, dword [rbx + 0x28]
lea rdx, [rbp - 0x29]
add rbx, rsi
lea rcx, [rbp - 0x19]
xor esi, esi
mov r9d, edi
mov r8, r13
mov qword [rsp + 0x20], rsi
call fcn.140059fe0
test al, al
je 0x14004c617
mov rax, qword [rbp - 0x29]
lea rdx, [rbp - 0x69]
mov r9, r13
mov qword [rsp + 0x20], rax
mov r8, rbx
mov dword [rbp - 0x69], esi
mov rcx, r12
call fcn.14004cb34
test al, al
je 0x14004c617
mov rcx, qword [rbp - 0x51]
test rcx, rcx
je 0x14004c56d
mov eax, dword [rbp - 0x69]
mov dword [rcx], eax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x14004c5e4
mov r10d, dword [r9 + 0x18]
test r10d, r10d
je 0x14004c5e4
mov edi, dword [r9 + 0x20]
dec r10d
mov r11d, 0x8324fb58
lea rcx, [rdi + r10*4]
mov edx, dword [rcx + r8]
add rdx, r8
mov cl, byte [rdx]
inc rdx
test cl, cl
je 0x14004c5df
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
inc rdx
test cl, cl
jne 0x14004c5c0
cmp r11d, 0x761f57d9
je 0x14004c5e9
test r10d, r10d
jne 0x14004c5a3
mov rax, qword [rax]
jmp 0x14004c57e
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + r10*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
xor edx, edx
add rax, r8
mov rcx, r15
mov r8d, 0x8000
call rax
mov rax, r13
jmp 0x14004c6f0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x14004c68d
mov r9d, dword [r10 + 0x18]
test r9d, r9d
je 0x14004c68d
mov edi, dword [r10 + 0x20]
dec r9d
mov r11d, 0x590c80a9
lea rcx, [r8 + r9*4]
mov edx, dword [rcx + rdi]
add rdx, r8
mov cl, byte [rdx]
inc rdx
test cl, cl
je 0x14004c688
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
inc rdx
test cl, cl
jne 0x14004c669
cmp r11d, 0xda79eb66
je 0x14004c692
test r9d, r9d
jne 0x14004c64d
mov rax, qword [rax]
jmp 0x14004c628
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx edx, word [rcx + r9*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
xor edx, edx
add rax, r8
mov rcx, r15
mov r8d, 0x8000
call rax
mov r8d, r14d
mov rdx, r13
mov rcx, r12
call fcn.140046500
jmp 0x14004c6ee
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + r10*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
xor edx, edx
add rax, r8
mov rcx, rsi
mov r8d, 0x8000
call rax
xor eax, eax
mov rcx, qword [rbp - 9]
xor rcx, rsp
call fcn.140069020
mov rbx, qword [rsp + 0xf0]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret