Function at 0x1401330af
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov dword [rbp + 0x230], esi
invalid
js 0x14013233d
cmp dword [rcx - 0x6fc5c80e], eax
invalid
push qword [rsi]
out 0x54, al
mul rbp
popf
rcl r8d, 0x27
call fcn.140131bf4
rcr esi, 0x9f
rol r13d, 0x10
jmp 0x1401319bd
invalid
mov dl, 0xe7
xchg edx, eax
mov bl, 0xf
test byte [rcx], ah
idiv edi
dec dword [rcx - 0x7b]
jmp 0x140132703
push rcx
invalid
and al, 0xff
inc ecx
iretd
sar edi, 1
loope 0x140132980
mul r10
inc r11
ret 0x10
mov r11, qword [rax + 0x30]
xchg r11, r10
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
jmp 0x140132dc7
xchg r11, r10
jmp 0x140132cde
dec r9d
lea rdx, [r11 + r9*4]
mov r8d, dword [rdx + r10]
mov edx, 0xaeccacc
add r8, r10
je 0x140132d6f
jne 0x140132d6f
rol r12d, 0xf6
int3
jmp 0x140132e0b
cmp edx, 0x7f3819e0
je 0x140132e6c
test r9d, r9d
jne 0x140132d1a
mov rax, qword [rax]
jmp 0x140132d12
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8 - 1]
test cl, cl
jne 0x140132e1c
add byte [rax], al
invalid
jmp 0x140132d90
cmp rbx, r10
je 0x140132da5
inc dword [rbx + rcx*4 + 0x4b]
sbb byte [rbp - 0x7b], al
leave
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140132da5
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
jmp 0x140132d1a
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x140132d9c
nop
movsx ecx, cl
lea r8, [r8 + 1]
jne 0x140132e5f
je 0x140132e5f
mul rbp
div rbp
cmc
or ecx, 0xb8afe57
jne 0x1401329df
lea r13d, [rbx + 0x5585]
call fcn.140132d5a
inc r14
ror ebx, 0xf0
jae 0x140132dcf
lea ecx, [rdx + 0xe930]
ror r12d, 0x20
bswap rcx
cmp r9, rdi
movabs r14, 0x141fdaffffff49e9
jmp 0x14013270c
jmp 0x140132dad
mov eax, dword [rbx + 0x24]
mov ecx, dword [rbx + 0x1c]
add rax, r10
jmp 0x140132f2c
movzx eax, byte [rcx - 1]
test al, al
jne 0x140132e9a
cmp edx, 0x958e292b
je 0x140133073
jmp 0x140132ee7
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
je 0x140132eaf
jne 0x140132eaf
movabs r12, 0x2665e8ed3d21c9eb
inc rbx
dec rcx
test edi, 0x4a096edd
cpuid
call 0x1401329a8
jmp 0x140132e7a
call rdi
xchg rdi, rax
mov r9, rdi
xchg rdi, rax
mov r8d, r15d
movsxd rcx, dword [rax + 0x3c]
mov r10d, dword [rcx + rax + 0x88]
jmp 0x140132f06
inc r8d
jmp 0x140132f17
xchg rdx, rbx
mov rbx, r15
xchg rbx, rdx
add r12, r10
xor eax, eax
mov byte [rsp + 0x71], al
jmp 0x14013304f
mov r11d, dword [r10 + rax + 0x20]
nop dword [rax]
nop dword [rax + rax]
mov ecx, r8d
lea rdx, [r9 + rcx*4]
mov ecx, dword [rdx + r11]
mov edx, 0x161d8820
jmp 0x140132fe5
add rcx, r10
mov dword [rsp + 0x5c], 0xf6f6f6f6
mov dword [rsp + 0x67], 0x7c6f7d7f
mov dword [rsp + 0x60], 0xf6f6f6f6
movzx edx, word [rax + r9*2]
mov dword [rsp + 0x6b], 0x6e383c3d
je 0x140132f80
jne 0x140132f80
rcr ebp, 0x75
rol edx, 0x57
sub r12d, 0x1996078c
lea r11d, [rcx - 0xddd5]
rcr r8d, 0xf0
call rcx
rcl r11d, 0x9e
call 0x1401330af
bswap rbx
movabs rdi, 0x7593569107ef79eb
lea r9d, [rbp + 0xd00]
test edx, 0xaa675611
ret 0x28
jmp 0x140132ffb
cmp rdx, 0xa
jb 0x140133056
xor edx, edx
lea rcx, [rsp + 0x67]
mov r8d, 0x800
je 0x140132fd5
jne 0x140132fd5
add esi, 0x8362adc4
syscall
mov r14d, 0xe8d9bff7
jmp rcx
jmp 0x140132eca
add rcx, r9
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140132ee7
jmp 0x140132e97
mov word [rsp + 0x64], 0xf6f6
mov word [rsp + 0x6f], 0x7676
mov r12d, dword [rcx + rdx*4]
jne 0x14013303b
je 0x14013303b
jmp rcx
jmp 0x140132eef
nop dword [rax]
movzx eax, byte [rsp + rdx + 0x67]
movzx ecx, byte [rsp + rdx + 0x5c]
add cl, al
mov byte [rsp + rdx + 0x67], cl
mov byte [rsp + rdx + 0x5c], r15b
inc rdx
jmp 0x140132f98
mov eax, dword [r10 + r9 + 0x24]
add rax, r9
mov ecx, r8d
movzx edx, word [rax + rcx*2]
xchg r15, rbx
mov rax, rbx
jmp 0x140133232
test ecx, ecx
jne 0x140133099
mov ecx, dword [r14 + 0x10]
mov ebx, ecx
lea rax, [0x140000000]
add rbx, rax
jmp 0x14013320f
xchg r8, rdx
nop
neg rax
add rax, 0xfffffffffffffffe
neg rax
add rax, rdx
movzx edx, dx
jmp 0x1401330c3
test rcx, rcx
xchg rcx, rsi
mov rsi, rcx
xchg rcx, rsi
cmovns rdx, rax
jmp 0x140133200
lea rax, [0x140000000]
mov qword [rdx + rax], r8
jmp 0x1401332b2
lea rax, [0x140000000]
nop
mov ecx, dword [r14 + 0xc]
xor r8d, r8d
add rcx, rax
xor edx, edx
je 0x14013313d
jne 0x14013313d
mov r15d, 0xa6b4b75f
push r14
syscall
call rcx
dec r15
rcr r8d, 0xf8
call rax
lea r14d, [rdi + 0x905c]
jnp 0x140132e2c
pop r11
mov r15d, 0x231f8139
lea ecx, [rdi - 0x3485]
div rsi
js 0x140132358
syscall
movabs r9, 0xa8e8a000000b1e9
js 0x140132801
jmp 0x1401331f3
lea r14d, [rbp + 0xcbb]
rcl edx, 0x3a
pop rbx
ret
mov byte [rsp + rax + 0x67], r15b
inc rax
cmp rax, 0xa
jb 0x140133157
cmp dword [r14 + 0xc], r15d
je 0x1401339d0
jne 0x1401331b4
je 0x1401331b4
popfq
call rax
dec rcx
int3
jmp 0x1401330e8
test eax, eax
je 0x140133268
mov edx, edi
add rdx, rax
jmp 0x1401330d8
test rcx, rcx
je 0x140133290
xchg rdx, r8
mov r8, rcx
jmp 0x1401330aa
call rdi
xchg rsi, r8
mov r8, rax
jmp 0x140133254
call r12
xchg r8, rax
mov rax, r8
xchg r8, rax
jmp 0x140133220
mov edi, r15d
xchg r13, rcx
mov r13, qword [rbx]
xchg rcx, r13
jmp 0x1401331df
test rax, rax
je 0x140133337
mov eax, dword [r14 + 0x10]
jmp 0x1401331cd
xchg r15, rbx
mov ecx, dword [r10 + r9 + 0x1c]
add rcx, r9
mov r13d, dword [rcx + rdx*4]
add r13, r9
nop word [rax + rax]
jmp 0x140133157
xchg r8, rsi
test rax, rax
je 0x140133633
mov ecx, dword [r14]
jmp 0x14013308d
xchg rdi, rax
mov rdi, qword [rbx]
xchg rdi, rax
jmp 0x140133321
xchg rbx, rdi
jmp 0x1401330f0
mov rcx, rdx
xchg rdx, rcx
test rcx, rcx
jmp 0x14013328a
jne 0x1401330ae
sub r14, 0xffffffffffffffec
cmp dword [r14 + 0xc], r15d
je 0x1401339d0
xchg rdi, rbx
mov rbx, qword [rsp + 0x30]
jmp 0x140133274
lea rax, [0x140000000]
xchg rsi, rcx
mov rsi, qword [rbx + 8]
xchg rcx, rsi
je 0x1401332ec
jne 0x1401332ec
cmp rdi, rdi
cpuid
add esi, 0xab6e0e2d
mov r10d, 0x553e56de
pushf
jmp rax
jmp 0x1401332f5
neg rbx
add rbx, 0xfffffffffffffff8
neg rbx
sub edi, 0xfffffff8
xchg rcx, rdx
je 0x14013330b
jne 0x14013330b
movabs r14, 0x1eed43ffffff6ce9
ja 0x140132391
jmp 0x14013327c
lea r15d, [rdi + 0xdc7f]
ret
lea rcx, [0x140000000]
xchg r13, r8
mov qword [rcx + rax], r13
xchg r13, r8
jmp 0x1401332ab
mov dword [rsp + 0x30], 0xf6f6f6f6
xchg r15, rcx
xor dh, dh
div dh
test byte [rcx - 0x79], 0xcf
mov rdx, rcx
xchg r15, rcx
mov dword [rsp + 0x36], 0x797c7c4f
jmp 0x14013342c
jl 0x1401333cb
jns 0x14013333a
xlatb
add byte [rax], al
add bh, al
outsd dx, dword fs:[rsi]
outsb dx, byte [rsi]
cmp byte [rax], al
mov dword [rbp + 0x64], 0x386e6f
mov byte [rbp + 0x12], 0xf6
nop word [rax + rax]
movzx eax, byte [rbp + rdx + 0x14]
movzx ecx, byte [rbp + rdx - 0x40]
add cl, al
mov byte [rbp + rdx + 0x14], cl
jmp 0x1401335d4
mov byte [rbp + rax + 0x14], r15b
inc rax
cmp rax, 0x53
jb 0x14013337b
jmp 0x140133392
nop
mov byte [rsp + r15 + 0x36], 0
inc r15
jmp 0x14013361f
mov dword [rbp + 0x44], 0x2a35354d
mov dword [rbp - 0xc], 0xf6f6f6f6
mov dword [rbp + 0x48], 0x736e6f5c
mov dword [rbp - 8], 0xf6f6f6f6
mov dword [rbp + 0x4c], 0x737c7e7d
jmp 0x1401333ca
mov dword [rbp - 4], 0xf6f6f6f6
cld
div dh
div dh
mov dword [rbp + 0x50], 0x6b7e7f6c
mov dword [rbp], 0xf6f6f6f6
mov dword [rbp + 0x54], 0x7d6f766c
mov dword [rbp + 4], 0xf6f6f6f6
mov dword [rbp + 0x58], 0x6f7c6b2a
je 0x140133419
jne 0x140133419
cmp ebx, 0xa7de58e6
rcr r11d, 0xc5
xor ebp, 0x830b4c1b
xor edi, 0x8bed1f7d
test r12, rbx
mov r14d, 0x770fb84f
movabs rcx, 0x3549330000018fe9
and esi, 0xe9291103
jmp 0x140133a90
jmp 0x1401335ad
mov byte [rsp + 0x34], 0xf6
mov word [rsp + 0x3a], 0x7c
nop dword [rax + rax]
movzx eax, byte [rsp + rdx + 0x36]
jmp 0x1401334b2
lea rdx, [rbp + 0x14]
xor ecx, ecx
call r13
xchg r15, rax
mov r15, rax
xchg r15, rax
nop word [rax + rax]
je 0x1401334a0
jne 0x1401334a0
jmp rax
jmp 0x14013337b
movzx ecx, byte [rsp + rdx + 0x30]
add cl, al
mov byte [rsp + rdx + 0x36], cl
mov byte [rsp + rdx + 0x30], r15b
inc rdx
cmp rdx, 5
jmp 0x1401335f6
jmp 0x140131597
mov dword [rbp - 0x2c], 0xf6f6f6f6
mov dword [rbp + 0x28], 0x55572a44
mov dword [rbp - 0x28], 0xf6f6f6f6
jmp 0x140133564
mov dword [rbp + 0x18], 0x7e2a6e6f
mov dword [rbp - 0x38], 0xf6f6f6f6
mov dword [rbp + 0x1c], 0x78732a79
mov dword [rbp - 0x34], 0xf6f6f6f6
mov dword [rbp + 0x20], 0x6b737e73
mov dword [rbp - 0x30], 0xf6f6f6f6
mov dword [rbp + 0x24], 0x6f847376
je 0x140133527
jne 0x140133527
add eax, 0x49f98549
mov ebp, 0x12c4aaeb
pop rdx
cmp dword [r10 + 0x2c4af82e], edi
test r9, rdi
movabs r13, 0x3941415a12c4aaeb
mov edx, 0x2c4af82e
jmp 0x1401334d3
rol edx, 0xe
jnp 0x14013334c
and ebp, 0x14482398
jmp rax
mov dword [rbp + 0x34], 0x6f7c7f7d
mov dword [rbp - 0x1c], 0xf6f6f6f6
mov dword [rbp + 0x38], 0x6f727e2a
jmp 0x140133585
mov dword [rbp + 0x2c], 0x57143c4c
mov dword [rbp - 0x24], 0xf6f6f6f6
mov dword [rbp + 0x30], 0x2a6f756b
mov dword [rbp - 0x20], 0xf6f6f6f6
jmp 0x14013354a
mov dword [rbp - 0x18], 0xf6f6f6f6
mov dword [rbp + 0x3c], 0x7d73602a
mov dword [rbp - 0x14], 0xf6f6f6f6
mov dword [rbp + 0x40], 0x2a766b7f
mov dword [rbp - 0x10], 0xf6f6f6f6
jmp 0x1401333a2
mov dword [rbp + 8], 0xf6f6f6f6
mov dword [rbp + 0x5c], 0x7d78732a
mov dword [rbp + 0xc], 0xf6f6f6f6
mov dword [rbp + 0x60], 0x76766b7e
mov word [rbp + 0x10], 0xf6f6
jmp 0x140133355
mov byte [rbp + rdx - 0x40], r15b
inc rdx
cmp rdx, 0x53
jb 0x140133366
mov r9d, 0x10
lea r8, [rsp + 0x36]
jmp 0x14013344a
jb 0x140133440
mov dword [rbp - 0x40], 0xf6f6f6f6
xchg rdx, r15
mov r15, rdx
xchg r15, rdx
mov dword [rbp + 0x14], 0x76736b50
mov dword [rbp - 0x3c], 0xf6f6f6f6
jmp 0x1401334ed
cmp r15, 5
jb 0x140133394
mov eax, 0xfffffffe
jmp 0x1401334ce
mov dword [rsp + 0x40], 0xf6f6f6f6
xchg r15, rdx
mov r15, rdx
xchg rdx, r15
jmp 0x140133961
cmp r15, 5
jb 0x140133692
mov eax, 0xfffffffe
jmp 0x140131597
mov dword [rbp + 0xc0], 0x7e2a6e6f
mov dword [rbp + 0x70], 0xf6f6f6f6
mov dword [rbp + 0xc4], 0x78732a79
jmp 0x140133878
mov byte [rbp + rax + 0xbc], r15b
inc rax
cmp rax, 0x53
jb 0x14013367d
mov byte [rsp + r15 + 0x46], 0
inc r15
jmp 0x140133649
mov dword [rbp + 0xf0], 0x736e6f5c
mov dword [rbp + 0xa0], 0xf6f6f6f6
mov dword [rbp + 0xf4], 0x737c7e7d
mov dword [rbp + 0xa4], 0xf6f6f6f6
mov dword [rbp + 0xf8], 0x6b7e7f6c
mov dword [rbp + 0xa8], 0xf6f6f6f6
mov dword [rbp + 0xfc], 0x7d6f766c
je 0x1401336fd
jne 0x1401336fd
lea r15d, [rdi - 0x90c5]
test r8d, 0xdb000aec
cmp r9, rbx
movabs r10, 0x5e1c3a000000b0e9
jmp rax
jmp 0x1401337b2
mov dword [rbp + 0x80], 0xf6f6f6f6
mov dword [rbp + 0xd4], 0x57143b4c
mov dword [rbp + 0x84], 0xf6f6f6f6
mov dword [rbp + 0xd8], 0x2a6f756b
mov dword [rbp + 0x88], 0xf6f6f6f6
mov dword [rbp + 0xdc], 0x6f7c7f7d
mov dword [rbp + 0x8c], 0xf6f6f6f6
jmp 0x1401338e2
nop dword [rax + rax]
movzx eax, byte [rsp + rdx + 0x46]
movzx ecx, byte [rsp + rdx + 0x40]
add cl, al
mov byte [rsp + rdx + 0x46], cl
mov byte [rsp + rdx + 0x40], r15b
inc rdx
jmp 0x1401337ff
mov dword [rbp + 0x10c], 0x386e6f
mov byte [rbp + 0xba], 0xf6
nop dword [rax]
movzx eax, byte [rbp + rdx + 0xbc]
movzx ecx, byte [rbp + rdx + 0x68]
add cl, al
mov byte [rbp + rdx + 0xbc], cl
jmp 0x14013397a
mov dword [rbp + 0xac], 0xf6f6f6f6
mov dword [rbp + 0x100], 0x6f7c6b2a
mov dword [rbp + 0xb0], 0xf6f6f6f6
jmp 0x14013384c
mov r9d, 0x10
lea r8, [rsp + 0x46]
lea rdx, [rbp + 0xbc]
jmp 0x1401337ec
xor ecx, ecx
call r13
xchg rsi, rax
mov rsi, r15
xchg rsi, rax
nop
jmp 0x14013367d
cmp rdx, 5
jb 0x140133762
mov dword [rbp + 0x68], 0xf6f6f6f6
mov rdx, r15
mov dword [rbp + 0xbc], 0x76736b50
mov dword [rbp + 0x6c], 0xf6f6f6f6
jmp 0x14013365d
mov dword [rbp + 0x98], 0xf6f6f6f6
mov dword [rbp + 0xec], 0x2a35354d
mov dword [rbp + 0x9c], 0xf6f6f6f6
jmp 0x1401336a0
mov dword [rbp + 0x104], 0x7d78732a
mov dword [rbp + 0xb4], 0xf6f6f6f6
mov dword [rbp + 0x108], 0x76766b7e
mov word [rbp + 0xb8], 0xf6f6
jmp 0x14013377f
mov dword [rbp + 0x74], 0xf6f6f6f6
mov dword [rbp + 0xc8], 0x6b737e73
mov dword [rbp + 0x78], 0xf6f6f6f6
mov dword [rbp + 0xcc], 0x6f847376
mov dword [rbp + 0x7c], 0xf6f6f6f6
mov dword [rbp + 0xd0], 0x55572a44
je 0x1401338cb
jne 0x1401338cb
cmp rdi, rbp
lea esi, [rdx + 0x825c]
rol r8d, 0x78
jge 0x140133856
ret
jmp 0x14013370f
mov dword [rbp + 0xe0], 0x6f727e2a
mov dword [rbp + 0x90], 0xf6f6f6f6
mov dword [rbp + 0xe4], 0x7d73602a
mov dword [rbp + 0x94], 0xf6f6f6f6
mov dword [rbp + 0xe8], 0x2a766b7f
je 0x14013394b
jne 0x14013394b
cpuid
sub r15d, 0xb7afb24b
add r13d, 0x51bd8cf2
lea r13d, [rcx - 0x20a]
jl 0x140133521
test r15d, 0x3978c598
lea r15d, [rdi - 0x33ba]
neg rbx
test rcx, rdi
movabs r11, 0x531089fffffed9e9
jmp rcx
jmp 0x140133829
mov dword [rsp + 0x46], 0x797c7c4f
mov byte [rsp + 0x44], 0xf6
mov word [rsp + 0x4a], 0x7c
jmp 0x14013375a
mov byte [rbp + rdx + 0x68], r15b
inc rdx
cmp rdx, 0x53
jb 0x140133797
invalid