Function at 0x140016190
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Encode data using xor
Hash data using murmur2
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov qword [rbp + 0x67], rcx
xor eax, eax
mov cl, 0x65
mov dword [rbp - 0x29], 0x3a571632
movsx ebx, cl
mov byte [rbp - 0x59], cl
mov ecx, ebx
mov dword [rbp - 0x25], 0x14b5756
mov word [rbp - 0x21], 0x909
mov byte [rbp - 0x1f], al
call fcn.140013f00
add ebx, eax
cmp ebx, 0xfffffff0
jg 0x1400161eb
mov edx, 0x84
call fcn.140128630
cmp ebx, 0xffffffb7
jg 0x1400161fa
mov edx, 0x9d
call fcn.140128630
imul eax, ebx, 0x5bd1e995
lea r8, [rbp - 0x55]
mov r13d, 8
mov r9d, r13d
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul r10d, ecx, 0x5bd1e995
xor r15d, r15d
mov edx, r15d
mov eax, edx
lea r8, [r8 + 4]
xor eax, r10d
add edx, 0x5bd1e995
imul ecx, eax, 0x286a90b9
xor ecx, 0xaa2a7357
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov dword [r8 - 4], eax
sub r9, 1
jne 0x140016221
mov r9d, 0xa
lea r8, [rbp - 0x55]
lea rdx, [rbp - 0x29]
call fcn.14011c9b0
movsx ebx, byte [rbp - 0x59]
mov ecx, ebx
mov qword [rbp - 0x31], rax
call fcn.140013f00
add ebx, eax
cmp ebx, 0xfffffff0
jg 0x14001628d
mov edx, 0x84
call fcn.140128630
cmp ebx, 0xffffffb7
jg 0x14001629c
mov edx, 0x9d
call fcn.140128630
imul eax, ebx, 0x5bd1e995
lea r8, [rbp - 0x55]
mov edx, r15d
mov r9, r13
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul r10d, ecx, 0x5bd1e995
nop word [rax + rax]
mov eax, edx
lea r8, [r8 + 4]
xor eax, r10d
add edx, 0x5bd1e995
imul ecx, eax, 0x286a90b9
xor ecx, 0xaa2a7357
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov dword [r8 - 4], eax
sub r9, 1
jne 0x1400162c0
mov r9d, dword [0x140196874]
lea r8, [rbp - 0x55]
mov rdx, qword [rbp - 0x31]
call fcn.14011cb00
mov rsi, rax
test rax, rax
jne 0x14001631a
mov rsi, r15
jmp 0x14001633f
movzx eax, byte [rbp - 0x59]
xor byte [rsi], al
xor byte [rsi + 1], al
xor byte [rsi + 2], al
xor byte [rsi + 3], al
xor byte [rsi + 4], al
xor byte [rsi + 5], al
xor byte [rsi + 6], al
xor byte [rsi + 7], al
xor byte [rsi + 8], al
xor byte [rsi + 9], al
mov byte [rsi + 0xa], r15b
movdqa xmm0, xmmword [0x140174b50]
mov cl, 0x33
movsx ebx, cl
xor eax, eax
mov byte [rbp - 0x19], cl
mov ecx, ebx
movdqu xmmword [rbp + 0x17], xmm0
mov byte [rbp + 0x27], al
call fcn.140013f00
add ebx, eax
cmp ebx, 0xfffffff0
jg 0x140016371
mov edx, 0x84
call fcn.140128630
cmp ebx, 0xffffffb7
jg 0x140016380
mov edx, 0x9d
call fcn.140128630
imul eax, ebx, 0x5bd1e995
lea r8, [rbp - 0x15]
mov edx, r15d
mov r9, r13
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul r10d, ecx, 0x5bd1e995
nop
mov eax, edx
lea r8, [r8 + 4]
xor eax, r10d
add edx, 0x5bd1e995
imul ecx, eax, 0x286a90b9
xor ecx, 0xaa2a7357
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov dword [r8 - 4], eax
sub r9, 1
jne 0x1400163a0
mov r9d, 0x10
lea r8, [rbp - 0x15]
lea rdx, [rbp + 0x17]
call fcn.14011c9b0
movsx ebx, byte [rbp - 0x19]
mov ecx, ebx
mov qword [rbp + 0xf], rax
call fcn.140013f00
add ebx, eax
cmp ebx, 0xfffffff0
jg 0x14001640c
mov edx, 0x84
call fcn.140128630
cmp ebx, 0xffffffb7
jg 0x14001641b
mov edx, 0x9d
call fcn.140128630
imul eax, ebx, 0x5bd1e995
lea r8, [rbp - 0x15]
mov edx, r15d
mov r9, r13
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul r10d, ecx, 0x5bd1e995
nop dword [rax]
mov eax, r10d
lea r8, [r8 + 4]
xor eax, edx
add edx, 0x5bd1e995
imul ecx, eax, 0x286a90b9
xor ecx, 0xaa2a7357
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov dword [r8 - 4], eax
sub r9, 1
jne 0x140016440
mov r9d, dword [0x140196874]
lea r8, [rbp - 0x15]
mov rdx, qword [rbp + 0xf]
call fcn.14011cb00
mov r14, rax
test rax, rax
jne 0x14001649a
mov r14, r15
jmp 0x1400164c1
movdqu xmm0, xmmword [r14]
movsx eax, byte [rbp - 0x19]
movd xmm1, eax
punpcklbw xmm1, xmm1
punpcklwd xmm1, xmm1
pshufd xmm1, xmm1, 0
pxor xmm1, xmm0
movdqu xmmword [r14], xmm1
mov byte [r14 + 0x10], r15b
mov rax, qword gs:[0x60]
mov qword [rsp + 0xe8], r12
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rdi, qword [rax]
mov eax, 0x5a4d
cmp qword [rdi + 0x60], r15
je 0x1400165b0
nop dword [rax]
mov r11, qword [rdi + 0x30]
mov rdi, qword [rdi]
test r11, r11
je 0x1400165a2
cmp word [r11], ax
jne 0x1400165ad
movsxd rax, dword [r11 + 0x3c]
cmp dword [rax + r11], 0x4550
jne 0x1400165ad
mov ecx, dword [rax + r11 + 0x88]
test ecx, ecx
je 0x1400165ad
mov r15d, dword [r11 + rcx + 0x1c]
lea rax, [r11 + rcx]
mov r10d, dword [rax + 0x20]
add r15, r11
mov r12d, dword [rax + 0x24]
add r10, r11
mov ebx, dword [rax + 0x18]
add r12, r11
xor r9d, r9d
test ebx, ebx
je 0x14001659d
mov ecx, dword [r10]
xor dl, dl
add rcx, r11
cmp byte [rcx], dl
je 0x140016591
mov r8, r14
sub r8, rcx
movzx eax, byte [r8 + rcx]
test al, al
je 0x14001658d
cmp byte [rcx], al
jne 0x140016591
inc rcx
mov dl, 1
cmp byte [rcx], 0
jne 0x140016562
movsxd rax, r9d
movzx ecx, word [r12 + rax*2]
mov eax, dword [r15 + rcx*4]
add rax, r11
xor r15d, r15d
jmp 0x1400165b3
test dl, dl
jne 0x140016579
inc r9d
add r10, 4
cmp r9d, ebx
jb 0x140016550
mov eax, 0x5a4d
cmp qword [rdi + 0x60], 0
jne 0x1400164f0
xor r15d, r15d
mov rax, r15
mov rcx, rsi
call rax
test rax, rax
jne 0x14001684e
mov cl, 0x1a
mov dword [rbp - 0x29], 0x4528694d
movsx ebx, cl
mov byte [rbp - 0x59], cl
mov ecx, ebx
mov dword [rbp - 0x25], 0x7e342829
mov word [rbp - 0x21], 0x7676
mov byte [rbp - 0x1f], al
call fcn.140013f00
add ebx, eax
cmp ebx, 0xfffffff0
jg 0x1400165f8
mov edx, 0x84
call fcn.140128630
cmp ebx, 0xffffffb7
jg 0x140016607
mov edx, 0x9d
call fcn.140128630
imul eax, ebx, 0x5bd1e995
lea r8, [rbp - 0x55]
mov edx, r15d
mov r10, r13
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul r11d, ecx, 0x5bd1e995
nop word [rax + rax]
mov eax, edx
lea r8, [r8 + 4]
xor eax, r11d
add edx, 0x5bd1e995
imul ecx, eax, 0x286a90b9
xor ecx, 0xaa2a7357
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov dword [r8 - 4], eax
sub r10, 1
jne 0x140016630
lea r9d, [r10 + 0xa]
lea r8, [rbp - 0x55]
lea rdx, [rbp - 0x29]
call fcn.14011c9b0
movsx ebx, byte [rbp - 0x59]
mov ecx, ebx
mov qword [rbp - 0x31], rax
call fcn.140013f00
add ebx, eax
cmp ebx, 0xfffffff0
jg 0x14001669a
mov edx, 0x84
call fcn.140128630
cmp ebx, 0xffffffb7
jg 0x1400166a9
mov edx, 0x9d
call fcn.140128630
imul eax, ebx, 0x5bd1e995
lea r8, [rbp - 0x55]
mov edx, r15d
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul r9d, ecx, 0x5bd1e995
nop dword [rax]
nop dword [rax + rax]
mov eax, edx
lea r8, [r8 + 4]
xor eax, r9d
add edx, 0x5bd1e995
imul ecx, eax, 0x286a90b9
xor ecx, 0xaa2a7357
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov dword [r8 - 4], eax
sub r13, 1
jne 0x1400166d0
mov r9d, dword [0x140196874]
lea r8, [rbp - 0x55]
mov rdx, qword [rbp - 0x31]
call fcn.14011cb00
mov rsi, rax
test rax, rax
jne 0x14001672a
mov rsi, r15
jmp 0x14001674f
movzx eax, byte [rbp - 0x59]
xor byte [rsi], al
xor byte [rsi + 1], al
xor byte [rsi + 2], al
xor byte [rsi + 3], al
xor byte [rsi + 4], al
xor byte [rsi + 5], al
xor byte [rsi + 6], al
xor byte [rsi + 7], al
xor byte [rsi + 8], al
xor byte [rsi + 9], al
mov byte [rsi + 0xa], 0
lea rdx, [0x1401600b0]
lea rcx, [rbp - 0x19]
call fcn.140020ea0
mov rcx, rax
call fcn.14001ca00
mov rcx, qword gs:[0x60]
mov r14, rax
mov rdx, qword [rcx + 0x18]
mov rcx, qword [rdx + 0x10]
mov rdi, qword [rcx]
cmp qword [rdi + 0x60], 0
je 0x140016848
mov r13d, 0x5a4d
nop
mov r11, qword [rdi + 0x30]
mov rdi, qword [rdi]
test r11, r11
je 0x14001683a
cmp word [r11], r13w
jne 0x140016845
movsxd rax, dword [r11 + 0x3c]
cmp dword [rax + r11], 0x4550
jne 0x140016845
mov ecx, dword [rax + r11 + 0x88]
test ecx, ecx
je 0x140016845
mov r15d, dword [r11 + rcx + 0x1c]
lea rax, [r11 + rcx]
mov r9d, dword [rax + 0x20]
add r15, r11
mov r12d, dword [rax + 0x24]
add r9, r11
mov ebx, dword [rax + 0x18]
add r12, r11
xor r10d, r10d
test ebx, ebx
je 0x14001683a
mov eax, dword [r9]
xor dl, dl
add rax, r11
cmp byte [rax], dl
je 0x14001682e
mov r8, r14
sub r8, rax
movzx ecx, byte [r8 + rax]
test cl, cl
je 0x14001682a
cmp byte [rax], cl
jne 0x14001682e
inc rax
mov dl, 1
cmp byte [rax], 0
jne 0x140016802
movsxd rax, r10d
movzx ecx, word [r12 + rax*2]
mov r15d, dword [r15 + rcx*4]
add r15, r11
jmp 0x140016848
test dl, dl
jne 0x140016819
inc r10d
add r9, 4
cmp r10d, ebx
jb 0x1400167f0
cmp qword [rdi + 0x60], 0
jne 0x140016790
xor r15d, r15d
mov rcx, rsi
call r15
mov rax, qword [rbp + 0x67]
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov r12, qword [rsp + 0xe8]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret