Function at 0x140005940
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov rcx, qword [0x140097150]
test rcx, rcx
jne 0x140005b0c
mov rax, qword gs:[0x60]
xor r11d, r11d
mov qword [rsp + 0x60], rbp
mov r9d, 0x31292418
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov rdi, rbp
nop word [rax + rax]
movups xmm0, xmmword [rdi + 0x58]
movd eax, xmm0
sub ax, 8
test r11d, r11d
je 0x1400059dd
psrldq xmm0, 8
mov edx, 0xe0c4c7f5
movq rcx, xmm0
movzx eax, ax
shr rax, 1
lea r8, [rcx + rax*2]
cmp rcx, r8
je 0x1400059d4
nop
movsx eax, byte [rcx]
add rcx, 2
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r8
jne 0x1400059c0
cmp edx, r11d
jne 0x140005ade
mov r10, qword [rdi + 0x30]
movsxd rax, dword [r10 + 0x3c]
mov rcx, qword [rax + r10 + 0x88]
mov r15, rcx
mov ebx, ecx
shr r15, 0x20
add rbx, r10
cmp rbx, r10
je 0x140005ade
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140005ade
mov r14d, dword [rbx + 0x20]
nop dword [rax]
nop word [rax + rax]
dec r8d
mov edx, 0xe0c4c7f5
lea rax, [r14 + r8*4]
mov ecx, dword [rax + r10]
add rcx, r10
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140005a57
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x140005a40
cmp edx, r9d
je 0x140005a63
test r8d, r8d
jne 0x140005a20
jmp 0x140005ade
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov ecx, dword [rcx + rdx*4]
add rcx, r10
cmp rcx, rbx
jbe 0x140005af6
lea rax, [r15 + rbx]
cmp rcx, rax
jae 0x140005af6
movzx eax, byte [rcx]
mov r11d, 0xe0c4c7f5
mov r9d, r11d
cmp al, 0x2e
je 0x140005ab7
nop dword [rax + rax]
movsx eax, al
inc rcx
xor eax, r11d
imul r11d, eax, 0x1000193
movzx eax, byte [rcx]
cmp al, 0x2e
jne 0x140005aa0
movzx eax, byte [rcx + 1]
inc rcx
test al, al
je 0x140005ada
movsx eax, al
lea rcx, [rcx + 1]
xor eax, r9d
imul r9d, eax, 0x1000193
movzx eax, byte [rcx]
test al, al
jne 0x140005ac2
mov rdi, qword [rbp]
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rbp
je 0x140005af4
cmp qword [rax + 0x30], 0
jne 0x140005990
xor ecx, ecx
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x60]
mov qword [0x140097150], rcx
call fcn.1400041e0
call fcn.140004970
test eax, eax
je 0x140005b26
mov qword [0], 1
call fcn.140004dd0
test eax, eax
je 0x140005b3b
mov qword [0], 1
call fcn.140005190
test eax, eax
je 0x140005b50
mov qword [0], 1
call fcn.140005390
test al, al
je 0x140005b65
mov qword [0], 1
lea rcx, [rsp + 0x58]
call fcn.140002400
mov rbx, qword [rsp + 0x58]
movabs rax, 0x7ffffffffeced2ff
cmp rbx, rax
jge 0x140005b8c
add rbx, 0x1312d00
jmp 0x140005b96
movabs rbx, 0x7fffffffffffffff
lea rcx, [rsp + 0x50]
call fcn.140002400
mov rax, qword [rsp + 0x50]
cmp rax, rbx
jge 0x140005c10
movabs rdi, 0x4e94914f0000
movabs rsi, 0x431bde82d7b634db
nop
mov rcx, rbx
sub rcx, rax
cmp rcx, rdi
jl 0x140005bd2
mov ecx, 0x5265c00
jmp 0x140005bf7
mov rax, rsi
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x140005bf5
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
lea rcx, [rsp + 0x50]
call fcn.140002400
mov rax, qword [rsp + 0x50]
cmp rax, rbx
jl 0x140005bc0
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret