Function at 0x14009f630
Capabilities:
Access peb ldr_data
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
movups xmm0, xmmword [0x1402624d2]
movaps xmmword [rsp + 0x40], xmm0
mov eax, dword [0x1406cdc70]
lea ecx, [rax - 1]
imul ecx, eax
cmp dword [0x1406cdc74], 0xa
setl dl
test cl, 1
sete al
or al, dl
mov ecx, dword [0x1406ce2cc]
mov edx, dword [0x1406ce2c8]
jne 0x14009f686
lea ebp, [rcx - 1]
imul ebp, ecx
and ebp, 1
jmp 0x14009f6c4
lea ebp, [rcx - 1]
imul ebp, ecx
and ebp, 1
xor byte [rsp + 0x40], 0x39
cmp edx, 0xa
jl 0x14009f69d
test ebp, ebp
jne 0x14009f700
xor byte [rsp + 0x42], 0x3a
xor byte [rsp + 0x44], 0x3b
xor byte [rsp + 0x46], 0x3c
xor byte [rsp + 0x48], 0x3d
xor byte [rsp + 0x4a], 0x3e
xor byte [rsp + 0x4c], 0x3f
xor byte [rsp + 0x4e], 0x40
test al, al
jne 0x14009f712
xor byte [rsp + 0x40], 0x39
cmp edx, 0xa
jl 0x14009f6d2
test ebp, ebp
jne 0x14009f710
xor byte [rsp + 0x42], 0x3a
xor byte [rsp + 0x44], 0x3b
xor byte [rsp + 0x46], 0x3c
xor byte [rsp + 0x48], 0x3d
xor byte [rsp + 0x4a], 0x3e
xor byte [rsp + 0x4c], 0x3f
xor byte [rsp + 0x4e], 0x40
jmp 0x14009f686
jmp 0x14009f700
jmp 0x14009f710
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea rcx, [rsp + 0x40]
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
add rax, 1
cmp rax, 2
jae 0x14009f766
cmp rax, 2
setae al
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov qword [rsp + 0x78], rax
mov eax, dword [0x1406ce3b0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete al
cmp dword [0x1406ce3b4], 0xa
setl cl
or cl, al
mov byte [rsp + 0x3b], cl
mov eax, dword [0x1406ce2d0]
mov qword [rsp + 0x80], rax
mov eax, dword [0x1406ce2d4]
mov dword [rsp + 0x54], eax
mov qword [rsp + 0x60], r14
jne 0x14009f7c2
mov rax, qword [rsp + 0x80]
lea edx, [rax - 1]
imul edx, eax
and edx, 1
jmp 0x14009fb77
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov r10, qword [rax + 0x10]
mov rax, qword [rsp + 0x80]
lea esi, [rax - 1]
imul esi, eax
and esi, 1
cmp dword [rsp + 0x54], 0xa
jl 0x14009f7f3
test esi, esi
jne 0x14009fb20
mov eax, dword [0x1406ce164]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete r11b
cmp dword [0x1406ce160], 0xa
setl cl
mov eax, dword [0x1406ce2e0]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete r8b
cmp dword [0x1406ce2e4], 0xa
setl r12b
mov edx, dword [0x1406ce2ec]
lea ebp, [rdx - 1]
imul ebp, edx
test bpl, 1
sete r14b
cmp dword [0x1406ce2e8], 0xa
setl al
mov ebp, dword [0x1406ce2f0]
lea edi, [rbp - 1]
imul edi, ebp
test dil, 1
sete r9b
cmp dword [0x1406ce2f4], 0xa
setl bl
cmp dword [0x1406ce6e4], 0xa
jl 0x14009f888
mov ebp, dword [0x1406ce6e0]
lea edi, [rbp - 1]
imul edi, ebp
and edi, 1
jne 0x14009fb30
mov dword [rsp + 0x3c], esi
mov edx, ecx
or dl, r11b
mov byte [rsp + 0x38], dl
or r12b, r8b
or al, r14b
mov byte [rsp + 0x39], al
mov edx, ecx
and dl, r11b
xor dl, 1
xor cl, r11b
mov eax, ecx
xor al, dl
not cl
or cl, dl
and cl, al
mov byte [rsp + 0x3a], cl
or bl, r9b
mov rsi, qword [r10 + 0x30]
mov rax, r10
mov qword [rsp + 0x68], r10
mov byte [rsp + 0x58], bl
mov qword [rsp + 0x70], rax
movsxd rcx, dword [rsi + 0x3c]
mov r9d, dword [rcx + rsi + 0x88]
test r9, r9
je 0x14009fa9a
cmp byte [rsp + 0x38], 0
je 0x14009faf0
mov edx, dword [rsi + r9 + 0x18]
lea r10, [rsi + 1]
mov r14, rdx
jmp 0x14009f916
mov r8d, 0x811c9dc5
mov rdx, r14
cmp r8d, 0x8285aca5
je 0x14009fb32
sub r14, 1
jb 0x14009fa9a
test r12b, r12b
je 0x14009fae0
mov eax, 0xffffffff
add rdx, rax
mov ecx, dword [rsi + r9 + 0x20]
add rcx, rsi
mov r15d, edx
mov r11d, dword [rcx + r15*4]
mov dl, byte [rsi + r11]
test dl, dl
je 0x14009f900
add r11, r10
mov r8d, 0x811c9dc5
jmp 0x14009fa10
mov edx, ebp
or edx, 0x1c6c88fb
mov r13d, ebp
not r13d
or r13d, 0xe3937704
mov eax, edx
and eax, 0x4a121404
mov ecx, ebp
and ecx, 0x48801a
mov edi, r13d
and edi, 0x1c121044
add ecx, edi
add ecx, 0x80006801
mov edi, ebp
and edi, 0x2408a1
mov ebx, ebp
and ebx, 0xa1816300
or ebx, eax
xor ebx, edi
xor ebx, ecx
mov eax, ebp
and eax, 0x2103304
and edx, 0xe9c7cc99
or edx, eax
mov eax, ebp
and eax, 0x14280062
and r13d, 0xe9c7cc99
add eax, r13d
add eax, 0x2103304
xor eax, edx
xor ebp, 0x1c6c88fb
or ebp, eax
mov eax, ebx
xor eax, 0x887ef0be
xor ebx, ebp
xor ebx, 0x887ef0be
or eax, ebp
not eax
or eax, ebx
xor r8d, eax
xor r8d, 0xe3937704
imul r8d, r8d, 0x1000193
movzx edx, byte [r11]
add r11, 1
test dl, dl
je 0x14009f906
movsx ebp, dl
lea ecx, [rbp - 0x41]
cmp cl, 0x19
ja 0x14009f960
mov ecx, ebp
not ecx
mov edx, ebp
and edx, 0x89c1ac7c
mov eax, ebp
or eax, 0x89c1ac7c
mov edi, ebp
xor edi, 0x1008070
and edi, edx
not edx
mov ebx, eax
and ebx, 0x253ac2f1
and ecx, 0x52041102
or ecx, ebx
xor eax, edx
and edx, 0x253ac2f1
or edi, edx
xor edi, ecx
mov ecx, ebp
xor ecx, 0x89c1ac7c
or ecx, eax
mov eax, ecx
xor eax, edi
not eax
not ecx
and ecx, edi
or ecx, eax
and ebp, 0x20
mov eax, ecx
not eax
and eax, ebp
mov edx, ecx
and edx, 0x2e4f563d
xor edx, ebp
and ecx, 0xd1b0a9c2
or ecx, edx
xor ecx, eax
xor ecx, 0x763e53a3
mov ebp, ecx
jmp 0x14009f960
cmp byte [rsp + 0x38], 0
je 0x14009fb00
mov bl, byte [rsp + 0x58]
test bl, bl
je 0x14009fb10
mov rax, qword [rsp + 0x70]
mov rax, qword [rax]
mov r10, qword [rsp + 0x68]
cmp rax, r10
je 0x14009fac8
mov rsi, qword [rax + 0x30]
test rsi, rsi
jne 0x14009f8cb
mov r14, qword [rsp + 0x60]
mov edx, dword [rsp + 0x3c]
xor edi, edi
jmp 0x14009fb6c
jmp 0x14009fae0
jmp 0x14009faf0
jmp 0x14009fb00
jmp 0x14009fb10
jmp 0x14009fb20
jmp 0x14009fb30
cmp byte [rsp + 0x39], 0
mov edx, dword [rsp + 0x3c]
je 0x14009fef0
cmp byte [rsp + 0x3a], 0
jne 0x14009ff00
mov eax, dword [rsi + r9 + 0x1c]
mov ecx, dword [rsi + r9 + 0x24]
add rax, rsi
add rcx, rsi
movzx ecx, word [rcx + r15*2]
mov edi, dword [rax + rcx*4]
add rdi, rsi
mov r14, qword [rsp + 0x60]
cmp byte [rsp + 0x3b], 0
jne 0x14009ff32
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x58], rax
cmp dword [rsp + 0x54], 0xa
jl 0x14009fb9c
test edx, edx
jne 0x14009fed0
mov eax, dword [0x1406ce164]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete r10b
cmp dword [0x1406ce160], 0xa
setl al
mov ecx, dword [0x1406ce2e0]
lea edx, [rcx - 1]
imul edx, ecx
test dl, 1
sete r8b
cmp dword [0x1406ce2e4], 0xa
setl r9b
mov ecx, dword [0x1406ce2ec]
lea ebp, [rcx - 1]
imul ebp, ecx
test bpl, 1
sete sil
cmp dword [0x1406ce2e8], 0xa
setl dl
mov ebp, dword [0x1406ce2f0]
lea ebx, [rbp - 1]
imul ebx, ebp
test bl, 1
sete r11b
cmp dword [0x1406ce2f4], 0xa
setl bl
cmp dword [0x1406ce6e4], 0xa
jl 0x14009fc30
mov ebp, dword [0x1406ce6e0]
lea edi, [rbp - 1]
imul edi, ebp
and edi, 1
jne 0x14009fee0
mov ecx, eax
or cl, r10b
mov byte [rsp + 0x38], cl
or r9b, r8b
or dl, sil
mov byte [rsp + 0x3c], dl
mov ecx, eax
and cl, r10b
xor cl, 1
xor al, r10b
mov edx, eax
xor dl, cl
not al
or al, cl
and al, dl
mov byte [rsp + 0x39], al
or bl, r11b
mov rax, qword [rsp + 0x58]
mov r15, qword [rax + 0x30]
mov byte [rsp + 0x68], bl
mov qword [rsp + 0x70], rax
movsxd rax, dword [r15 + 0x3c]
mov r10d, dword [rax + r15 + 0x88]
test r10, r10
je 0x14009fe4f
cmp byte [rsp + 0x38], 0
je 0x14009fea0
mov eax, dword [r15 + r10 + 0x18]
lea r13, [r15 + 1]
mov r12, rax
jmp 0x14009fcb4
mov esi, 0x811c9dc5
mov rax, r12
cmp esi, 0x8285aca5
je 0x14009ff02
sub r12, 1
jb 0x14009fe4f
test r9b, r9b
je 0x14009fe90
mov ecx, 0xffffffff
add rax, rcx
mov ecx, dword [r15 + r10 + 0x20]
add rcx, r15
mov eax, eax
mov ecx, dword [rcx + rax*4]
mov al, byte [r15 + rcx]
test al, al
je 0x14009fca0
add rcx, r13
mov esi, 0x811c9dc5
jmp 0x14009fdbe
mov r11d, r8d
or r11d, 0x1c6c88fb
mov eax, r8d
not eax
or eax, 0xe3937704
mov edx, r11d
and edx, 0x4a121404
mov edi, r8d
and edi, 0x48801a
mov ebx, eax
and ebx, 0x1c121044
add edi, ebx
add edi, 0x80006801
mov ebx, r8d
and ebx, 0x2408a1
mov r14d, r8d
and r14d, 0xa1816300
or r14d, edx
xor r14d, ebx
xor r14d, edi
mov edx, r8d
and edx, 0x2103304
and r11d, 0xe9c7cc99
or r11d, edx
mov edx, r8d
and edx, 0x14280062
and eax, 0xe9c7cc99
add eax, edx
add eax, 0x2103304
xor eax, r11d
xor r8d, 0x1c6c88fb
or r8d, eax
mov eax, r14d
xor eax, 0x887ef0be
xor r14d, r8d
xor r14d, 0x887ef0be
or eax, r8d
not eax
or eax, r14d
xor esi, eax
xor esi, 0xe3937704
imul esi, esi, 0x1000193
movzx eax, byte [rcx]
add rcx, 1
test al, al
je 0x14009fca5
movsx r8d, al
lea eax, [r8 - 0x41]
cmp al, 0x19
ja 0x14009fd00
mov eax, r8d
not eax
mov edx, r8d
and edx, 0x89c1ac7c
mov ebp, r8d
or ebp, 0x89c1ac7c
mov edi, r8d
xor edi, 0x1008070
and edi, edx
not edx
mov ebx, ebp
and ebx, 0x253ac2f1
and eax, 0x52041102
or eax, ebx
xor ebp, edx
and edx, 0x253ac2f1
or edi, edx
xor edi, eax
mov eax, r8d
xor eax, 0x89c1ac7c
or eax, ebp
mov edx, eax
xor edx, edi
not edx
not eax
and eax, edi
or eax, edx
and r8d, 0x20
mov edx, eax
not edx
and edx, r8d
mov ebp, eax
and ebp, 0x2e4f563d
xor ebp, r8d
and eax, 0xd1b0a9c2
or eax, ebp
xor eax, edx
xor eax, 0x763e53a3
mov r8d, eax
jmp 0x14009fd00
cmp byte [rsp + 0x38], 0
je 0x14009feb0
mov bl, byte [rsp + 0x68]
test bl, bl
je 0x14009fec0
mov rax, qword [rsp + 0x70]
mov rax, qword [rax]
cmp rax, qword [rsp + 0x58]
je 0x14009f7c2
mov r15, qword [rax + 0x30]
test r15, r15
jne 0x14009fc6c
jmp 0x14009f7c2
jmp 0x14009fe90
jmp 0x14009fea0
jmp 0x14009feb0
jmp 0x14009fec0
jmp 0x14009fed0
jmp 0x14009fee0
jmp 0x14009fef0
jmp 0x14009ff00
cmp byte [rsp + 0x3c], 0
je 0x14009ff30
cmp byte [rsp + 0x39], 0
je 0x14009f7c2
nop word cs:[rax + rax]
nop
jmp 0x14009ff20
jmp 0x14009ff30
cmp dword [0x1406cdc64], 0xa
jl 0x14009ff4c
mov eax, dword [0x1406cdc60]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
jne 0x14009ff7d
mov rcx, r14
call rdi
mov rax, qword [rsp + 0x78]
cmp dword [0x1406cdc64], 0xa
jl 0x14009f74b
mov eax, dword [0x1406cdc60]
lea ecx, [rax - 1]
imul ecx, eax
mov rax, qword [rsp + 0x78]
and ecx, 1
je 0x14009f74b
mov rcx, r14
call rdi
jmp 0x14009ff4c