Function at 0x14009b8c0
Capabilities:
Access peb ldr_data
Encode data using xor
Get storage device properties
Hash data using fnv
Resolve function by fnv-1a hash
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x1402acd18]
xor rax, rsp
mov qword [rbp], rax
mov r12, rcx
mov qword [rbp - 0x70], rcx
mov dword [rsp + 0x60], 1
movabs rsi, 0x462fcfbcd8c2e9bc
mov qword [rsp + 0x40], rsi
movabs r15, 0x57bd4dbc9656e9bc
mov qword [rsp + 0x48], r15
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], r15
movdqa xmm0, xmmword [rsp + 0x40]
xorps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rsp + 0x40], xmm0
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
xor eax, eax
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], rax
lea rax, [rsp + 0x40]
mov r14, 0xffffffffffffffff
mov r8, r14
inc r8
cmp byte [rax + r8], 0
jne 0x14009b956
lea rdx, [rsp + 0x40]
call fcn.140042620
nop
mov dword [rsp + 0x60], 1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov edi, dword [rcx + r9 + 0x88]
add rdi, r9
cmp rdi, r9
je 0x14009ba03
mov r8d, dword [rdi + 0x18]
test r8d, r8d
je 0x14009ba03
mov r11d, dword [rdi + 0x20]
nop word [rax + rax]
dec r8d
lea rcx, [r9 + r8*4]
mov edx, dword [rcx + r11]
add rdx, r9
mov ebx, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14009b9fe
nop dword [rax]
movsx ecx, cl
xor ecx, ebx
imul ebx, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14009b9e0
cmp ebx, 0xbdcac9ce
je 0x14009ba08
test r8d, r8d
jne 0x14009b9c0
mov rax, qword [rax]
jmp 0x14009b990
mov ecx, dword [rdi + 0x1c]
add rcx, r9
mov eax, dword [rdi + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov eax, dword [rcx + rax*4]
add rax, r9
movabs rcx, 0x3556a7ec84ecb5e0
mov qword [rsp + 0x70], rcx
movabs rcx, 0x21d43ff8fa378ad5
mov qword [rsp + 0x78], rcx
movabs rcx, 0xf47eebbc02aad9d9
mov qword [rbp - 0x80], rcx
movabs rdx, 0x584c99bcd25ee9bc
mov qword [rbp - 0x78], rdx
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], r15
movabs rcx, 0xf47eebbc02aae9bc
mov qword [rbp - 0x10], rcx
mov qword [rbp - 8], rdx
movdqa xmm0, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [rbp - 0x80]
xorps xmm1, xmmword [rbp - 0x10]
movdqa xmmword [rbp - 0x80], xmm1
xor esi, esi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor edx, edx
lea r8d, [rsi + 3]
lea rcx, [rsp + 0x70]
call rax
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x14009c2ac
mov qword [rbp - 0x2c], rsi
mov dword [rbp - 0x30], esi
mov qword [rbp - 0x40], rsi
mov dword [rbp - 0x68], esi
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
mov r9, qword [rcx + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov edi, dword [rax + r9 + 0x88]
add rdi, r9
cmp rdi, r9
je 0x14009bb53
mov r8d, dword [rdi + 0x18]
test r8d, r8d
je 0x14009bb53
mov r11d, dword [rdi + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r9 + r8*4]
mov edx, dword [rax + r11]
add rdx, r9
mov ebx, 0x811c9dc5
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x14009bb4e
nop dword [rax]
movsx eax, al
xor eax, ebx
imul ebx, eax, 0x1000193
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
test al, al
jne 0x14009bb30
cmp ebx, 0xb04cce94
je 0x14009bb58
test r8d, r8d
jne 0x14009bb10
mov rcx, qword [rcx]
jmp 0x14009bae0
mov ecx, dword [rdi + 0x1c]
add rcx, r9
mov eax, dword [rdi + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov eax, dword [rcx + rax*4]
add rax, r9
mov qword [rsp + 0x38], rsi
lea rcx, [rbp - 0x68]
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 8
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x20], rcx
mov r9d, 0xc
lea r8, [rbp - 0x30]
mov edx, 0x2d1400
mov rcx, r13
call rax
mov esi, dword [rbp - 0x3c]
mov ecx, esi
call fcn.1400a07ac
mov r15, rax
mov r8d, esi
xor edx, edx
mov rcx, rax
call fcn.1400bc2f0
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax]
mov r9, qword [rcx + 0x30]
movsxd rdx, dword [r9 + 0x3c]
mov edi, dword [rdx + r9 + 0x88]
add rdi, r9
cmp rdi, r9
je 0x14009bc43
mov r8d, dword [rdi + 0x18]
test r8d, r8d
je 0x14009bc43
mov r11d, dword [rdi + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r9 + r8*4]
mov edx, dword [rax + r11]
add rdx, r9
mov ebx, 0x811c9dc5
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x14009bc3e
nop dword [rax]
movsx eax, al
xor eax, ebx
imul ebx, eax, 0x1000193
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
test al, al
jne 0x14009bc20
cmp ebx, 0xb04cce94
je 0x14009bc48
test r8d, r8d
jne 0x14009bc00
mov rcx, qword [rcx]
jmp 0x14009bbd0
mov ecx, dword [rdi + 0x1c]
add rcx, r9
mov eax, dword [rdi + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov eax, dword [rcx + rax*4]
add rax, r9
mov qword [rsp + 0x38], 0
lea rcx, [rbp - 0x68]
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0xc
lea r8, [rbp - 0x30]
mov edx, 0x2d1400
mov rcx, r13
call rax
mov eax, dword [r15 + 0x18]
test eax, eax
je 0x14009bd23
lea rdx, [r15 + rax]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8, r14
inc r8
cmp byte [rdx + r8], 0
jne 0x14009bcb2
lea rcx, [rsp + 0x40]
call fcn.140042620
nop
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x50]
mov rcx, r12
call fcn.140012060
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14009bd23
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009bd1e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009c2dc
call fcn.1400a031c
mov eax, dword [r15 + 0x14]
test eax, eax
je 0x14009bdc1
lea rdx, [r15 + rax]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8, r14
nop word [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x14009bd50
lea rcx, [rsp + 0x40]
call fcn.140042620
nop
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x50]
mov rcx, r12
call fcn.140012060
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14009bdc1
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009bdbc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009c2dc
call fcn.1400a031c
mov eax, dword [r15 + 0x10]
test eax, eax
je 0x14009be56
lea rdx, [r15 + rax]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
inc r14
cmp byte [rdx + r14], 0
jne 0x14009bde2
mov r8, r14
lea rcx, [rsp + 0x40]
call fcn.140042620
nop
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x50]
mov rcx, r12
call fcn.140012060
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14009be56
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009be51
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009c2dc
call fcn.1400a031c
xor eax, eax
xor ecx, ecx
cpuid
mov esi, ecx
mov dword [rsp + 0x40], eax
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov edi, 0xf
mov qword [rbp - 0x48], rdi
mov byte [rbp - 0x60], 0
movups xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [reloc.XINPUT1_4.dll_Ordinal_4]
movdqu xmmword [rbp - 0x10], xmm1
mov byte [rbp - 0x1c], 0
lea r14d, [rdi - 0xb]
mov dword [rbp - 0x60], ebx
mov byte [rbp - 0x5c], 0
movups xmmword [rsp + 0x40], xmm0
movdqu xmmword [rsp + 0x50], xmm1
mov dword [rsp + 0x40], edx
mov byte [rsp + 0x44], 0
lea rax, [r14 + 4]
mov qword [rbp - 0x50], rax
lea rax, [rbp - 0x60]
mov dword [rax + r14], edx
mov byte [rax + r14 + 4], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14009befd
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009bef8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009c2e8
call fcn.1400a031c
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [reloc.XINPUT1_4.dll_Ordinal_4]
movdqu xmmword [rsp + 0x50], xmm1
mov dword [rsp + 0x40], esi
mov byte [rsp + 0x44], 0
mov rcx, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 4
jb 0x14009bf4f
lea rax, [rcx + 4]
mov qword [rbp - 0x50], rax
lea rax, [rbp - 0x60]
cmp rdx, 0x10
cmovae rax, qword [rbp - 0x60]
mov dword [rax + rcx], esi
mov byte [rax + rcx + 4], 0
jmp 0x14009bf69
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x40]
xor r8d, r8d
mov rdx, r14
lea rcx, [rbp - 0x60]
call fcn.140012a30
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14009bfa6
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009bfa1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009c2e8
call fcn.1400a031c
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov rbx, qword [rbp - 0x50]
lea r14, [rbp - 0x60]
cmp qword [rbp - 0x48], 0x10
cmovae r14, qword [rbp - 0x60]
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
ja 0x14009c2e2
cmp rbx, 0x10
jae 0x14009bfff
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rdi
movups xmm0, xmmword [r14]
movups xmmword [rsp + 0x40], xmm0
movq rsi, xmm0
jmp 0x14009c04c
mov rdi, rbx
or rdi, 0xf
cmp rdi, rax
jbe 0x14009c010
mov rdi, rax
jmp 0x14009c01c
mov eax, 0x16
cmp rdi, rax
cmovb rdi, rax
lea rdx, [rdi + 1]
lea rcx, [rsp + 0x40]
call fcn.140009e60
mov rsi, rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rdi
lea r8, [rbx + 1]
mov rdx, r14
mov rcx, rax
call fcn.1400bd5b0
nop
lea rdx, [rsp + 0x40]
cmp rdi, 0x10
cmovae rdx, rsi
mov r8, rbx
mov rcx, r12
call fcn.140012060
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14009c0a2
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009c09d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009c2e8
call fcn.1400a031c
cmp qword [r12 + 0x18], 0x10
jb 0x14009c0c0
mov r9, qword [r12]
mov r8, r9
mov rbx, r9
add r8, qword [r12 + 0x10]
add r9, qword [r12 + 0x10]
jmp 0x14009c0d0
mov rax, qword [r12 + 0x10]
mov rbx, r12
lea r8, [r12 + rax]
lea r9, [rax + r12]
cmp rbx, r8
je 0x14009c10b
movzx eax, byte [rbx]
sub al, 0x21
cmp al, 0x5d
ja 0x14009c0e6
inc rbx
cmp rbx, r8
jne 0x14009c0d5
cmp rbx, r8
je 0x14009c10b
lea rcx, [rbx + 1]
cmp rcx, r8
je 0x14009c10b
movzx edx, byte [rcx]
lea eax, [rdx - 0x21]
cmp al, 0x5d
ja 0x14009c103
mov byte [rbx], dl
inc rbx
inc rcx
cmp rcx, r8
jne 0x14009c0f4
sub r9, rbx
mov rdi, qword [r12 + 0x10]
mov rax, rdi
cmp qword [r12 + 0x18], 0x10
jb 0x14009c132
sub rbx, qword [r12]
sub rax, rbx
cmp rax, r9
cmovb r9, rax
mov rax, qword [r12]
jmp 0x14009c142
sub rbx, r12
sub rax, rbx
cmp rax, r9
cmovb r9, rax
mov rax, r12
lea rcx, [rax + rbx]
sub rdi, r9
mov r8, rdi
sub r8, rbx
inc r8
lea rdx, [rcx + r9]
call fcn.1400bd5b0
mov qword [r12 + 0x10], rdi
mov rcx, r15
call fcn.1400a031c
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov edi, dword [rcx + r9 + 0x88]
add rdi, r9
cmp rdi, r9
je 0x14009c1f3
mov r8d, dword [rdi + 0x18]
test r8d, r8d
je 0x14009c1f3
mov r11d, dword [rdi + 0x20]
nop word [rax + rax]
dec r8d
lea rcx, [r9 + r8*4]
mov ecx, dword [rcx + r11]
add rcx, r9
mov ebx, 0x811c9dc5
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14009c1ee
nop dword [rax]
movsx edx, dl
xor edx, ebx
imul ebx, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x14009c1d0
cmp ebx, 0xfaba0065
je 0x14009c1f8
test r8d, r8d
jne 0x14009c1b0
mov rax, qword [rax]
jmp 0x14009c180
mov ecx, dword [rdi + 0x1c]
add rcx, r9
mov eax, dword [rdi + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov edx, dword [rcx + rax*4]
add rdx, r9
mov rcx, r13
call rdx
mov rdx, r12
lea rcx, [rsp + 0x70]
call fcn.140009b10
mov rdx, rax
lea rcx, [rbp - 0x20]
call fcn.14009b810
mov rdx, rax
mov rcx, r12
call fcn.14000b210
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x14009c274
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009c26e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009c2ee
call fcn.1400a031c
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x14009c2ac
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009c2a6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009c2dc
call fcn.1400a031c
nop
mov rax, r12
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.1400a02c0
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400d0a24
nop
call fcn.140001860
int3
call fcn.1400d0a24
int3
call fcn.1400d0a24
int3