Function at 0x140001654
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov esi, ecx
mov qword [rsp + 0x30], 0
mov word [rsp + 0x28], 2
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x140001687
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x140001687
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov edi, dword [r9 + r11*4]
mov bl, byte [rax + rdi]
test bl, bl
je 0x1400016e9
add rdi, r10
mov ebp, 0x7adc62fa
movsx ebx, bl
xor ebx, ebp
imul ebp, ebx, 0x1000193
mov bl, byte [rdi]
inc rdi
test bl, bl
jne 0x1400016cd
cmp ebp, 0x615002a4
je 0x1400016f0
test r11, r11
jne 0x1400016b4
jmp 0x140001687
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
mov ecx, esi
call rdx
lea rdi, [rsp + 0x28]
mov word [rdi + 2], ax
call fcn.140002f00
mov dword [rdi + 4], eax
xor ebp, ebp
mov ecx, dword [section..data]
cmp ebp, 6
mov r14d, 5
cmovge r14d, ebp
mov ebx, ebp
cmp ecx, 0xffffffff
je 0x1400017e4
mov rax, qword gs:[0x60]
mov rdx, qword [rax + 0x18]
add rdx, 0x10
mov rdx, qword [rdx]
mov rax, qword [rdx + 0x30]
movsxd r8, dword [rax + 0x3c]
mov r8d, dword [rax + r8 + 0x88]
test r8, r8
je 0x14000174f
mov r9d, dword [rax + r8 + 0x18]
test r9, r9
je 0x14000174f
mov r10d, dword [rax + r8 + 0x20]
add r10, rax
lea r11, [rax + 1]
dec r9
mov r15d, r9d
mov r12d, dword [r10 + r15*4]
mov bpl, byte [rax + r12]
test bpl, bpl
je 0x1400017bc
add r12, r11
mov r13d, 0xe7d4bfcc
movsx ebp, bpl
xor ebp, r13d
imul r13d, ebp, 0x1000193
mov bpl, byte [r12]
inc r12
test bpl, bpl
jne 0x140001799
cmp r13d, 0x1327ad19
je 0x1400017c3
test r15, r15
jne 0x14000177d
jmp 0x14000174f
mov edx, dword [rax + r8 + 0x1c]
mov r8d, dword [rax + r8 + 0x24]
add rdx, rax
add r8, rax
movzx r8d, word [r8 + r15*2]
mov edx, dword [rdx + r8*4]
add rdx, rax
movsxd rcx, ecx
call rdx
mov dword [section..data], 0xffffffff
cmp ebx, r14d
je 0x140001b8d
lea ebp, [rbx + 1]
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x14000180b
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x14000180b
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov r15d, dword [r9 + r11*4]
mov r12b, byte [rax + r15]
test r12b, r12b
je 0x140001876
add r15, r10
mov r13d, 0xd66ddf0c
movsx r12d, r12b
xor r12d, r13d
imul r13d, r12d, 0x1000193
mov r12b, byte [r15]
inc r15
test r12b, r12b
jne 0x140001854
cmp r13d, 0x3f9ce61d
je 0x14000187d
test r11, r11
jne 0x140001838
jmp 0x14000180b
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov r9d, dword [rcx + rdx*4]
add r9, rax
mov ecx, 2
mov edx, 2
mov r8d, 0x11
call r9
mov dword [section..data], eax
mov ecx, 0xffffffff
cmp eax, 0xffffffff
je 0x140001733
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x1400018cf
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x1400018cf
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov r14d, dword [r9 + r11*4]
mov r15b, byte [rax + r14]
test r15b, r15b
je 0x14000193a
add r14, r10
mov r12d, 0x6773407d
movsx r15d, r15b
xor r15d, r12d
imul r12d, r15d, 0x1000193
mov r15b, byte [r14]
inc r14
test r15b, r15b
jne 0x140001918
cmp r12d, 0xba568eb0
je 0x140001941
test r11, r11
jne 0x1400018fc
jmp 0x1400018cf
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
xor ecx, ecx
call rdx
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x14000196f
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x14000196f
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov r14d, dword [r9 + r11*4]
mov r15b, byte [rax + r14]
test r15b, r15b
je 0x1400019da
add r14, r10
mov r12d, 0xd27aa4b3
movsx r15d, r15b
xor r15d, r12d
imul r12d, r15d, 0x1000193
mov r15b, byte [r14]
inc r14
test r15b, r15b
jne 0x1400019b8
cmp r12d, 0xab01229c
je 0x1400019e1
test r11, r11
jne 0x14000199c
jmp 0x14000196f
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov r9d, dword [rcx + rdx*4]
add r9, rax
movsxd rcx, dword [section..data]
mov rdx, rdi
mov r8d, 0x10
call r9
cmp eax, 0xffffffff
jne 0x140001ad8
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x140001a28
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x140001a28
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov ebx, dword [r9 + r11*4]
mov r14b, byte [rax + rbx]
test r14b, r14b
je 0x140001a93
add rbx, r10
mov r15d, 0xe57f3fca
movsx r14d, r14b
xor r14d, r15d
imul r15d, r14d, 0x1000193
mov r14b, byte [rbx]
inc rbx
test r14b, r14b
jne 0x140001a71
cmp r15d, 0x1e432631
je 0x140001a9a
test r11, r11
jne 0x140001a55
jmp 0x140001a28
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov ecx, dword [rcx + rdx*4]
add rcx, rax
call rcx
cmp eax, 0x65
jne 0x140001acc
xor eax, eax
cmp dword [rsp + 0x2c], 0
jne 0x140001ac8
call fcn.140002f00
mov dword [rsp + 0x2c], eax
mov ecx, esi
call fcn.140001293
jmp 0x140001720
mov dword [rsp + 0x24], 1
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x140001af1
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x140001af1
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
mov dil, byte [rax + rsi]
test dil, dil
je 0x140001b58
add rsi, r10
mov ebp, 0xc11976f3
movsx edi, dil
xor edi, ebp
imul ebp, edi, 0x1000193
mov dil, byte [rsi]
inc rsi
test dil, dil
jne 0x140001b39
cmp ebp, 0xfc3f3709
je 0x140001b5f
test r11, r11
jne 0x140001b1e
jmp 0x140001af1
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov r9d, dword [rcx + rdx*4]
add r9, rax
movsxd rcx, dword [section..data]
lea r8, [rsp + 0x24]
mov edx, 0x8004667e
call r9
cmp ebx, 5
setl al
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret