Function at 0x14013e114
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xc38]
sub rsp, 0xcf8
movaps xmmword [rax - 0x58], xmm6
call fcn.140141298
mov dword [rax + 0x38], 0x12c
call fcn.140141298
mov ecx, 0x3f000000
xor r14d, r14d
mov ebx, 0x7e8
xor edx, edx
mov r8d, ebx
mov dword [rax + 0x3c], 0x154
mov rax, qword [0x140548838]
mov dword [rax + 0x3910], ecx
mov dword [rax + 0x3914], ecx
lea rcx, [rbp + 0x3f0]
mov dword [rax + 0x3900], r14d
mov dword [rax + 0x3978], r14d
call fcn.1403ccc50
xor edx, edx
lea rcx, [rbp - 0x60]
mov r8d, 0x44e
call fcn.1403ccc50
movdqa xmm0, xmmword [0x1404d0580]
lea r15d, [r14 + 1]
movdqa xmm1, xmmword [0x1404cf2b0]
mov ecx, r14d
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x70], 0x44
movdqu xmmword [rsp + 0x60], xmm1
movsxd rax, ecx
xor byte [rsp + rax + 0x50], cl
add ecx, r15d
cmp ecx, 0x21
jb 0x14013e1c7
mov byte [rsp + 0x71], r14b
mov rcx, r14
mov al, byte [rsp + rcx + 0x50]
mov byte [rbp + rcx - 0x60], al
add rcx, r15
test al, al
jne 0x14013e1de
mov edi, 2
mov dword [rsp + 0x20], ebx
mov r8d, edi
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x3f0]
lea r9d, [rdi + 3]
call fcn.14013f10c
call fcn.14014142c
mov rcx, rax
call fcn.14013f97c
mov r8d, 0x13e
lea rcx, [rbp + 0x3f0]
lea rdx, [rax + 0x8bc]
call fcn.14014cadc
or r12d, 0xffffffff
cmp byte [0x140548821], r14b
jne 0x14013e7d7
call fcn.140141298
mov rbx, qword [rax + 0x18]
call fcn.14014142c
mov rcx, rax
call fcn.14013f97c
mov qword [rax + 0x908], rbx
call fcn.14014142c
mov rcx, rax
call fcn.14013fb04
mov byte [rax + 0xa35], r14b
call fcn.14013b3b0
xorps xmm0, xmm0
mov qword [rbp + 0xc40], r14
xor eax, eax
mov dword [rsp + 0x50], 0x28
lea rcx, [rbp + 0xc40]
mov dword [rsp + 0x74], eax
movups xmmword [rsp + 0x54], xmm0
movups xmmword [rsp + 0x64], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.user32.dll_GetCursorPos]
mov rcx, qword [rbp + 0xc40]
mov edx, edi
call qword [sym.imp.user32.dll_MonitorFromPoint]
mov rcx, rax
lea rdx, [rsp + 0x50]
call qword [sym.imp.user32.dll_GetMonitorInfoW]
test eax, eax
je 0x14013e302
call fcn.140141298
mov ecx, dword [rsp + 0x5c]
sub ecx, dword [rax + 0x38]
add ecx, dword [rsp + 0x54]
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
mov ebx, eax
call fcn.140141298
mov dword [rax + 0x30], ebx
call fcn.140141298
mov ecx, dword [rsp + 0x60]
sub ecx, dword [rax + 0x3c]
add ecx, dword [rsp + 0x58]
jmp 0x14013e346
xor edx, edx
lea r8, [rsp + 0x40]
xor r9d, r9d
lea ecx, [rdx + 0x30]
call qword [sym.imp.user32.dll_SystemParametersInfoW]
call fcn.140141298
mov ecx, dword [rsp + 0x40]
sub ecx, dword [rax + 0x38]
add ecx, dword [rsp + 0x48]
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
mov ebx, eax
call fcn.140141298
mov dword [rax + 0x30], ebx
call fcn.140141298
mov ecx, dword [rsp + 0x4c]
sub ecx, dword [rax + 0x3c]
add ecx, dword [rsp + 0x44]
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
mov ebx, eax
call fcn.140141298
mov dword [rax + 0x34], ebx
call fcn.140141298
mov rsi, rax
call fcn.140141298
mov r14, rax
call fcn.140141298
mov r15, rax
call fcn.140141298
mov r13, rax
call fcn.140141298
mov r12, rax
call fcn.140141298
mov rcx, qword gs:[0x60]
mov qword [rbp - 0x78], rax
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
mov r9, qword [rcx + 0x30]
movsxd rdx, dword [r9 + 0x3c]
mov r10d, dword [rdx + r9 + 0x88]
add r10, r9
cmp r10, r9
je 0x14013e3ff
mov r8d, dword [r10 + 0x18]
test r8d, r8d
je 0x14013e3ff
mov edi, dword [r10 + 0x20]
dec r8d
mov r11d, 0x7ff665ca
lea rax, [rdi + r8*4]
mov edx, dword [rax + r9]
add rdx, r9
mov al, byte [rdx]
inc rdx
test al, al
je 0x14013e3fa
movsx eax, al
xor eax, r11d
imul r11d, eax, 0x1000193
mov al, byte [rdx]
inc rdx
test al, al
jne 0x14013e3db
cmp r11d, 0xe766e86c
je 0x14013e404
test r8d, r8d
jne 0x14013e3be
mov rcx, qword [rcx]
jmp 0x14013e399
mov ecx, dword [r10 + 0x24]
add rcx, r9
mov dword [rsp + 0x30], 4
movzx edx, word [rcx + r8*2]
mov ecx, dword [r10 + 0x1c]
mov r8d, dword [r13 + 0x30]
add rcx, r9
mov eax, dword [rcx + rdx*4]
mov ecx, dword [rsi + 0x3c]
add rax, r9
mov r9d, dword [r15 + 0x34]
mov rdx, qword [r12 + 0x28]
mov dword [rsp + 0x28], ecx
mov ecx, dword [r14 + 0x38]
mov dword [rsp + 0x20], ecx
mov rcx, qword [rbp - 0x78]
mov rcx, qword [rcx + 0x28]
call qword [case.0x140173169.0]
call fcn.140141298
mov rsi, rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov r10d, dword [rcx + r9 + 0x88]
add r10, r9
cmp r10, r9
je 0x14013e4d9
mov r8d, dword [r10 + 0x18]
xor r14d, r14d
test r8d, r8d
je 0x14013e4d9
mov edi, dword [r10 + 0x20]
lea r15d, [r14 + 1]
or r12d, 0xffffffff
add r8d, r12d
mov r11d, 0x8a759d99
lea rcx, [rdi + r8*4]
mov edx, dword [rcx + r9]
add rdx, r9
mov cl, byte [rdx]
add rdx, r15
test cl, cl
je 0x14013e4d4
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
add rdx, r15
test cl, cl
jne 0x14013e4b5
cmp r11d, 0x5a639f8f
je 0x14013e4de
test r8d, r8d
jne 0x14013e498
mov rax, qword [rax]
jmp 0x14013e468
mov edx, dword [r10 + 0x24]
mov rcx, qword [rsi + 0x28]
add rdx, r9
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
movzx r8d, word [rdx + r8*2]
mov edx, dword [r10 + 0x1c]
add rdx, r9
mov eax, dword [rdx + r8*4]
xor r8d, r8d
add rax, r9
or rdx, 0xffffffffffffffff
xor r9d, r9d
call qword [case.0x140173169.0]
call fcn.140141298
mov rsi, rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov r10d, dword [rcx + r9 + 0x88]
add r10, r9
cmp r10, r9
je 0x14013e59d
mov r8d, dword [r10 + 0x18]
test r8d, r8d
je 0x14013e59d
mov edi, dword [r10 + 0x20]
add r8d, r12d
mov r11d, 0x9177e735
lea rcx, [rdi + r8*4]
mov edx, dword [rcx + r9]
add rdx, r9
mov cl, byte [rdx]
add rdx, r15
test cl, cl
je 0x14013e598
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
add rdx, r15
test cl, cl
jne 0x14013e579
cmp r11d, 0xac74acdb
je 0x14013e5a2
test r8d, r8d
jne 0x14013e55c
mov rax, qword [rax]
jmp 0x14013e537
mov edx, dword [r10 + 0x24]
mov rcx, qword [rsi + 0x28]
add rdx, r9
mov dword [rsp + 0x30], 0x43
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
movzx r8d, word [rdx + r8*2]
mov edx, dword [r10 + 0x1c]
add rdx, r9
mov eax, dword [rdx + r8*4]
xor r8d, r8d
add rax, r9
xor r9d, r9d
lea rdx, [r9 - 2]
call qword [case.0x140173169.0]
call fcn.140141298
mov rsi, rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov r10d, dword [rcx + r9 + 0x88]
add r10, r9
cmp r10, r9
je 0x14013e660
mov r8d, dword [r10 + 0x18]
test r8d, r8d
je 0x14013e660
mov edi, dword [r10 + 0x20]
add r8d, r12d
mov r11d, 0xe8553da0
lea rcx, [r9 + r8*4]
mov edx, dword [rcx + rdi]
add rdx, r9
mov cl, byte [rdx]
add rdx, r15
test cl, cl
je 0x14013e65b
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
add rdx, r15
test cl, cl
jne 0x14013e63c
cmp r11d, 0xcd657a01
je 0x14013e665
test r8d, r8d
jne 0x14013e620
mov rax, qword [rax]
jmp 0x14013e5fb
mov edx, dword [r10 + 0x24]
mov rcx, qword [rsi + 0x28]
add rdx, r9
movzx r8d, word [rdx + r8*2]
mov edx, dword [r10 + 0x1c]
add rdx, r9
mov eax, dword [rdx + r8*4]
add rax, r9
call qword [case.0x140173169.0]
call fcn.140141298
mov rdi, rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov r10d, dword [rcx + r9 + 0x88]
add r10, r9
cmp r10, r9
je 0x14013e707
mov r8d, dword [r10 + 0x18]
test r8d, r8d
je 0x14013e707
mov esi, dword [r10 + 0x20]
add r8d, r12d
mov r11d, 0x71f1324a
lea rcx, [r9 + r8*4]
mov edx, dword [rcx + rsi]
add rdx, r9
mov cl, byte [rdx]
add rdx, r15
test cl, cl
je 0x14013e702
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
add rdx, r15
test cl, cl
jne 0x14013e6e3
cmp r11d, 0x85055e
je 0x14013e70c
test r8d, r8d
jne 0x14013e6c7
mov rax, qword [rax]
jmp 0x14013e6a2
mov edx, dword [r10 + 0x24]
mov rcx, qword [rdi + 0x28]
add rdx, r9
movzx r8d, word [rdx + r8*2]
mov edx, dword [r10 + 0x1c]
add rdx, r9
mov eax, dword [rdx + r8*4]
add rax, r9
call qword [case.0x140173169.0]
call fcn.140141298
mov rdi, rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov r10d, dword [rcx + r9 + 0x88]
add r10, r9
cmp r10, r9
je 0x14013e7ae
mov r8d, dword [r10 + 0x18]
test r8d, r8d
je 0x14013e7ae
mov esi, dword [r10 + 0x20]
add r8d, r12d
mov r11d, 0xc383d470
lea rcx, [r9 + r8*4]
mov edx, dword [rcx + rsi]
add rdx, r9
mov cl, byte [rdx]
add rdx, r15
test cl, cl
je 0x14013e7a9
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
add rdx, r15
test cl, cl
jne 0x14013e78a
cmp r11d, 0xf41d2826
je 0x14013e7b3
test r8d, r8d
jne 0x14013e76e
mov rax, qword [rax]
jmp 0x14013e749
mov edx, dword [r10 + 0x24]
mov rcx, qword [rdi + 0x28]
add rdx, r9
movzx r8d, word [rdx + r8*2]
mov edx, dword [r10 + 0x1c]
add rdx, r9
mov eax, dword [rdx + r8*4]
add rax, r9
call qword [case.0x140173169.0]
call fcn.14014142c
mov rcx, rax
call fcn.14013fb04
cmp byte [rax + 0xa35], r14b
jne 0x14013e91c
mov rcx, qword [0x140548838]
lea rdx, [rbp + 0xc48]
and dword [rbp + 0xc48], 0
xor r8d, r8d
and dword [rbp + 0xc4c], 0
mov rcx, qword [rcx + 0x4008]
call fcn.14014f3ec
call fcn.140141298
movd xmm6, dword [rax + 0x3c]
cvtdq2ps xmm6, xmm6
call fcn.140141298
mov rcx, qword [0x140548838]
lea rdx, [rbp + 0xc50]
xor r8d, r8d
movss dword [rbp + 0xc54], xmm6
movd xmm0, dword [rax + 0x38]
mov rcx, qword [rcx + 0x4008]
cvtdq2ps xmm0, xmm0
movss dword [rbp + 0xc50], xmm0
call fcn.14014f534
call fcn.140140f70
mov byte [rax + 1], r15b
call fcn.140140f70
movdqa xmm1, xmmword [0x1404cf620]
xorps xmm0, xmm0
and dword [rsp + 0x78], 0
and dword [rsp + 0x7c], 0
movups xmmword [rsp + 0x40], xmm0
mov byte [rax + 2], r14b
movss xmm0, dword [0x1404ceb80]
movups xmmword [rbp - 0x78], xmm1
mov dword [rbp + 0xc58], 0x3f800000
movss xmm1, dword [0x1404ceb5c]
movss dword [rbp - 0x80], xmm0
movss dword [rbp - 0x7c], xmm1
mov dword [rbp + 0xc5c], 0x3f800000
call fcn.14014142c
mov rcx, rax
call fcn.14013f97c
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rcx
lea r9, [rbp + 0xc58]
lea rcx, [rbp - 0x78]
mov qword [rsp + 0x20], rcx
lea r8, [rsp + 0x78]
mov rcx, qword [rax + 0x910]
lea rdx, [rbp - 0x80]
call fcn.14016c020
lea rcx, [rbp + 0xc40]
mov byte [rbp + 0xc40], r14b
call fcn.14016a8e4
call fcn.14013c774
call fcn.14013d538
jmp 0x14013e92e
call fcn.14014142c
mov rcx, rax
call fcn.14013fb04
call fcn.140184768
cmp byte [0x140548821], r14b
jne 0x14013ebe4
call fcn.140141298
mov rbx, rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov r10d, dword [rcx + r9 + 0x88]
add r10, r9
cmp r10, r9
je 0x14013e9b9
mov r8d, dword [r10 + 0x18]
test r8d, r8d
je 0x14013e9b9
mov esi, dword [r10 + 0x20]
add r8d, r12d
mov r11d, 0x422cbaec
lea rcx, [r9 + r8*4]
mov edx, dword [rcx + rsi]
add rdx, r9
mov cl, byte [rdx]
add rdx, r15
test cl, cl
je 0x14013e9b4
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
add rdx, r15
test cl, cl
jne 0x14013e995
cmp r11d, 0x9f742f5d
je 0x14013e9be
test r8d, r8d
jne 0x14013e979
mov rax, qword [rax]
jmp 0x14013e954
mov edx, dword [r10 + 0x24]
mov rcx, qword [rbx + 0x28]
add rdx, r9
movzx r8d, word [rdx + r8*2]
mov edx, dword [r10 + 0x1c]
add rdx, r9
mov eax, dword [rdx + r8*4]
mov edx, 0xa
add rax, r9
call qword [case.0x140173169.0]
call fcn.140141298
mov rdi, rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov r10d, dword [rcx + r9 + 0x88]
add r10, r9
cmp r10, r9
je 0x14013ea65
mov r8d, dword [r10 + 0x18]
test r8d, r8d
je 0x14013ea65
mov esi, dword [r10 + 0x20]
add r8d, r12d
mov r11d, 0x5e903894
lea rcx, [r9 + r8*4]
mov edx, dword [rcx + rsi]
add rdx, r9
mov cl, byte [rdx]
add rdx, r15
test cl, cl
je 0x14013ea60
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
add rdx, r15
test cl, cl
jne 0x14013ea41
cmp r11d, 0xbde4be4d
je 0x14013ea6a
test r8d, r8d
jne 0x14013ea25
mov rax, qword [rax]
jmp 0x14013ea00
mov edx, dword [r10 + 0x24]
mov rcx, qword [rdi + 0x28]
add rdx, r9
movzx r8d, word [rdx + r8*2]
mov edx, dword [r10 + 0x1c]
add rdx, r9
mov eax, dword [rdx + r8*4]
add rax, r9
call qword [case.0x140173169.0]
call fcn.140141298
mov rdi, rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov r10d, dword [rcx + r9 + 0x88]
add r10, r9
cmp r10, r9
je 0x14013eb0c
mov r8d, dword [r10 + 0x18]
test r8d, r8d
je 0x14013eb0c
mov esi, dword [r10 + 0x20]
add r8d, r12d
mov r11d, 0x61c0e950
lea rcx, [r9 + r8*4]
mov edx, dword [rcx + rsi]
add rdx, r9
mov cl, byte [rdx]
add rdx, r15
test cl, cl
je 0x14013eb07
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
add rdx, r15
test cl, cl
jne 0x14013eae8
cmp r11d, 0x36283178
je 0x14013eb11
test r8d, r8d
jne 0x14013eacc
mov rax, qword [rax]
jmp 0x14013eaa7
mov edx, dword [r10 + 0x24]
mov rcx, qword [rdi + 0x28]
add rdx, r9
movzx r8d, word [rdx + r8*2]
mov edx, dword [r10 + 0x1c]
add rdx, r9
mov eax, dword [rdx + r8*4]
add rax, r9
call qword [case.0x140173169.0]
call fcn.140141298
mov rdi, rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov r10d, dword [rcx + r9 + 0x88]
add r10, r9
cmp r10, r9
je 0x14013ebb4
mov r8d, dword [r10 + 0x18]
test r8d, r8d
je 0x14013ebb4
mov esi, dword [r10 + 0x20]
add r8d, r12d
mov r11d, 0x76245a60
lea rcx, [rsi + r8*4]
mov edx, dword [rcx + r9]
add rdx, r9
mov cl, byte [rdx]
add rdx, r15
test cl, cl
je 0x14013ebaf
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
add rdx, r15
test cl, cl
jne 0x14013eb90
cmp r11d, 0xb6eff2c1
je 0x14013ebb9
test r8d, r8d
jne 0x14013eb73
mov rax, qword [rax]
jmp 0x14013eb4e
mov edx, dword [r10 + 0x24]
mov rcx, qword [rdi + 0x28]
add rdx, r9
movzx r8d, word [rdx + r8*2]
mov edx, dword [r10 + 0x1c]
add rdx, r9
mov eax, dword [rdx + r8*4]
add rax, r9
call qword [case.0x140173169.0]
mov byte [0x140548821], r15b
call fcn.1401393d8
call fcn.14014ebc0
movaps xmm6, xmmword [rsp + 0xce0]
add rsp, 0xcf8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret