Function at 0x140001798
Capabilities:
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
lea r13, [rsp + 0x48]
xor ebx, ebx
mov r15, qword [r13]
mov rdi, rcx
mov qword [r13], rbx
cmp dword [rcx], ebx
je 0x1400019ea
mov qword [rax + 8], rbx
lea r12, [rsp + 0x48]
mov r14, qword [r12]
movabs r10, 0xcbf29ce484222325
mov qword [r12], rbx
mov rax, qword [0x140005060]
test rax, rax
jne 0x1400018c1
mov rdx, qword [0x140011088]
lea r9, [rsp + 0x48]
test rdx, rdx
jne 0x140001818
mov rdx, qword [0x140011080]
mov qword [0x140011088], rdx
movsxd rax, dword [rdx + 0x3c]
mov ecx, dword [rax + rdx + 0x88]
add rcx, rdx
mov esi, dword [rcx + 0x1c]
mov r8d, dword [rcx + 0x20]
add rsi, rdx
mov ebp, dword [rcx + 0x24]
add r8, rdx
mov r11d, dword [rcx + 0x18]
add rbp, rdx
mov edx, ebx
test r11d, r11d
je 0x1400018b0
mov ecx, dword [r8]
add rcx, qword [0x140011088]
mov al, byte [rcx]
test al, al
je 0x140001886
movabs r13, 0x100000001b3
inc rcx
movsx rax, al
xor r10, rax
imul r10, r13
mov al, byte [rcx]
test al, al
jne 0x14000185e
movabs rax, 0x8a9495b5004b3e52
lea r13, [rsp + 0x48]
cmp r10, rax
je 0x14000189d
inc edx
add r8, 4
cmp edx, r11d
jae 0x1400018b0
movabs r10, 0xcbf29ce484222325
jmp 0x140001844
mov eax, edx
movzx ecx, word [rbp + rax*2]
mov eax, dword [rsi + rcx*4]
add rax, qword [0x140011088]
jmp 0x1400018b4
int3
mov qword [r9], rbx
mov rcx, rbx
mov qword [0x140005060], rax
mov qword [r12], r14
lea rdx, [rsp + 0x50]
movsxd rcx, dword [rdi]
call qword [0x1400040b0]
cmp qword [rsp + 0x50], rbx
je 0x1400019ea
lea r12, [rsp + 0x48]
mov r14, qword [r12]
mov qword [r12], rbx
mov rax, qword [0x140005078]
test rax, rax
jne 0x1400019ac
mov rdx, qword [0x140011088]
lea r8, [rsp + 0x48]
test rdx, rdx
jne 0x14000191a
mov rdx, qword [0x140011080]
mov qword [0x140011088], rdx
movsxd rax, dword [rdx + 0x3c]
mov ecx, dword [rax + rdx + 0x88]
add rcx, rdx
mov r11d, dword [rcx + 0x1c]
mov r9d, dword [rcx + 0x20]
add r11, rdx
mov esi, dword [rcx + 0x24]
add r9, rdx
mov ebp, dword [rcx + 0x18]
add rsi, rdx
mov edx, ebx
test ebp, ebp
je 0x14000199b
mov ecx, dword [r9]
movabs r10, 0xcbf29ce484222325
add rcx, qword [0x140011088]
mov al, byte [rcx]
test al, al
je 0x140001991
movabs r13, 0x100000001b3
inc rcx
movsx rax, al
xor r10, rax
imul r10, r13
mov al, byte [rcx]
test al, al
jne 0x140001969
movabs rax, 0x64311a9f7f16d39f
lea r13, [rsp + 0x48]
cmp r10, rax
je 0x1400019d7
inc edx
add r9, 4
cmp edx, ebp
jb 0x140001945
int3
mov qword [r8], rbx
mov rcx, rbx
mov qword [0x140005078], rax
mov qword [r12], r14
mov rcx, qword [rsp + 0x50]
call qword [0x1400040b0]
mov rcx, rax
test rax, rax
je 0x1400019ea
mov rax, qword [rdi + 8]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x1400019ef
mov eax, edx
movzx ecx, word [rsi + rax*2]
mov eax, dword [r11 + rcx*4]
add rax, qword [0x140011088]
jmp 0x14000199f
mov ebx, 0xc0000001
mov rbp, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
mov qword [r13], r15
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret