Function at 0x1400a2b00
Capabilities:
Access peb ldr_data
Delete file
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x198
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x110], 0xfffffffffffffffe
lea rax, [rcx + 1]
cmp rax, 2
jae 0x1400a2b8e
lea rsi, [rbp - 0x58]
mov rcx, rsi
call fcn.14009e480
mov rcx, rsi
call fcn.1400cce60
mov r14d, eax
lea rcx, [rbp - 0x58]
call fcn.1400bd230
mov eax, dword [0x1406cdc40]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete cl
cmp dword [0x1406cdc44], 0xa
setl al
or al, cl
mov ecx, dword [0x1406ce18c]
mov edx, dword [0x1406ce188]
jne 0x1400a33c9
lea edi, [rcx - 1]
imul edi, ecx
and edi, 1
jmp 0x1400a3423
mov qword [rbp + 0xd0], rcx
mov eax, dword [0x1406ce3b0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete al
cmp dword [0x1406ce3b4], 0xa
setl cl
or cl, al
mov byte [rbp + 0x10b], cl
mov eax, dword [0x1406ce2d0]
mov qword [rbp + 0xd8], rax
mov eax, dword [0x1406ce2d4]
mov dword [rbp + 0x100], eax
jne 0x1400a2be9
mov rax, qword [rbp + 0xd8]
lea edx, [rax - 1]
imul edx, eax
and edx, 1
jmp 0x1400a2fd1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov r11, qword [rax + 0x10]
mov rax, qword [rbp + 0xd8]
lea r14d, [rax - 1]
imul r14d, eax
and r14d, 1
cmp dword [rbp + 0x100], 0xa
jl 0x1400a2c1f
test r14d, r14d
jne 0x1400a2f70
mov eax, dword [0x1406ce164]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete r10b
cmp dword [0x1406ce160], 0xa
setl cl
mov eax, dword [0x1406ce2e0]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete r8b
cmp dword [0x1406ce2e4], 0xa
setl byte [rbp + 0x10e]
mov edx, dword [0x1406ce2ec]
lea edi, [rdx - 1]
imul edi, edx
test dil, 1
sete r15b
cmp dword [0x1406ce2e8], 0xa
setl al
mov edi, dword [0x1406ce2f0]
lea esi, [rdi - 1]
imul esi, edi
test sil, 1
sete r9b
cmp dword [0x1406ce2f4], 0xa
setl bl
cmp dword [0x1406ce6e4], 0xa
jl 0x1400a2cb7
mov edi, dword [0x1406ce6e0]
lea esi, [rdi - 1]
imul esi, edi
and esi, 1
jne 0x1400a2f80
mov dword [rbp + 0x104], r14d
mov edx, ecx
or dl, r10b
mov byte [rbp + 0x10f], dl
or byte [rbp + 0x10e], r8b
or al, r15b
mov byte [rbp + 0x10d], al
mov edx, ecx
and dl, r10b
xor dl, 1
xor cl, r10b
mov eax, ecx
xor al, dl
not cl
or cl, dl
and cl, al
mov byte [rbp + 0x10c], cl
or bl, r9b
mov r10, qword [r11 + 0x30]
mov rax, r11
mov qword [rbp + 0xf0], r11
mov byte [rbp + 0xf8], bl
mov qword [rbp + 0xe8], rax
movsxd rcx, dword [r10 + 0x3c]
mov r9d, dword [rcx + r10 + 0x88]
test r9, r9
je 0x1400a2ef0
cmp byte [rbp + 0x10f], 0
je 0x1400a2f40
mov ecx, dword [r10 + r9 + 0x18]
lea rax, [r10 + 1]
mov qword [rbp + 0xe0], rax
mov r15, rcx
jmp 0x1400a2d66
mov r8d, 0x811c9dc5
mov rcx, r15
cmp r8d, 0x8285aca5
je 0x1400a2f82
sub r15, 1
jb 0x1400a2ef0
cmp byte [rbp + 0x10e], 0
je 0x1400a2f30
mov eax, 0xffffffff
add rcx, rax
mov edx, dword [r10 + r9 + 0x20]
add rdx, r10
mov r11d, ecx
mov r12d, dword [rdx + r11*4]
mov dl, byte [r10 + r12]
test dl, dl
je 0x1400a2d50
add r12, qword [rbp + 0xe0]
mov r8d, 0x811c9dc5
jmp 0x1400a2e67
mov r13d, edx
or r13d, 0x1c6c88fb
mov r14d, edx
not r14d
or r14d, 0xe3937704
mov eax, r13d
and eax, 0x4a121404
mov ecx, edx
and ecx, 0x48801a
mov esi, r14d
and esi, 0x1c121044
add ecx, esi
add ecx, 0x80006801
mov esi, edx
and esi, 0x2408a1
mov edi, edx
and edi, 0xa1816300
or edi, eax
xor edi, esi
xor edi, ecx
mov eax, edx
and eax, 0x2103304
and r13d, 0xe9c7cc99
or r13d, eax
mov eax, edx
and eax, 0x14280062
and r14d, 0xe9c7cc99
add eax, r14d
add eax, 0x2103304
xor eax, r13d
xor edx, 0x1c6c88fb
or edx, eax
mov eax, edi
xor eax, 0x887ef0be
xor edi, edx
xor edi, 0x887ef0be
or eax, edx
not eax
or eax, edi
xor r8d, eax
xor r8d, 0xe3937704
imul r8d, r8d, 0x1000193
movzx edx, byte [r12]
add r12, 1
test dl, dl
je 0x1400a2d56
movsx edx, dl
lea edi, [rdx - 0x41]
cmp dil, 0x19
ja 0x1400a2db0
mov edi, edx
not edi
mov ebx, edx
and ebx, 0x89c1ac7c
mov ecx, edx
or ecx, 0x89c1ac7c
mov esi, edx
xor esi, 0x1008070
and esi, ebx
not ebx
mov eax, ecx
and eax, 0x253ac2f1
and edi, 0x52041102
or edi, eax
xor ecx, ebx
and ebx, 0x253ac2f1
or esi, ebx
xor esi, edi
mov eax, edx
xor eax, 0x89c1ac7c
or eax, ecx
mov ecx, eax
xor ecx, esi
not ecx
not eax
and eax, esi
or eax, ecx
and edx, 0x20
mov ecx, eax
not ecx
and ecx, edx
mov esi, eax
and esi, 0x2e4f563d
xor esi, edx
and eax, 0xd1b0a9c2
or eax, esi
xor eax, ecx
xor eax, 0x763e53a3
mov edx, eax
jmp 0x1400a2db0
cmp byte [rbp + 0x10f], 0
je 0x1400a2f50
mov bl, byte [rbp + 0xf8]
test bl, bl
je 0x1400a2f60
mov rax, qword [rbp + 0xe8]
mov rax, qword [rax]
mov r11, qword [rbp + 0xf0]
cmp rax, r11
je 0x1400a2f26
mov r10, qword [rax + 0x30]
test r10, r10
jne 0x1400a2d0b
xor eax, eax
jmp 0x1400a2fb7
jmp 0x1400a2f30
jmp 0x1400a2f40
jmp 0x1400a2f50
jmp 0x1400a2f60
jmp 0x1400a2f70
jmp 0x1400a2f80
cmp byte [rbp + 0x10d], 0
je 0x1400a3380
cmp byte [rbp + 0x10c], 0
jne 0x1400a3390
mov eax, dword [r10 + r9 + 0x1c]
mov ecx, dword [r10 + r9 + 0x24]
add rax, r10
add rcx, r10
movzx ecx, word [rcx + r11*2]
mov eax, dword [rax + rcx*4]
add rax, r10
cmp byte [rbp + 0x10b], 0
mov rcx, qword [rbp + 0xd0]
mov edx, dword [rbp + 0x104]
jne 0x1400a33c2
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov qword [rbp + 0xf8], rax
cmp dword [rbp + 0x100], 0xa
jl 0x1400a2ffa
test edx, edx
jne 0x1400a3360
mov eax, dword [0x1406ce164]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete r9b
cmp dword [0x1406ce160], 0xa
setl cl
mov eax, dword [0x1406ce2e0]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete r8b
cmp dword [0x1406ce2e4], 0xa
setl byte [rbp + 0x10e]
mov eax, dword [0x1406ce2ec]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete r10b
cmp dword [0x1406ce2e8], 0xa
setl dl
mov eax, dword [0x1406ce2f0]
lea ebx, [rax - 1]
imul ebx, eax
test bl, 1
sete r11b
cmp dword [0x1406ce2f4], 0xa
setl bl
cmp dword [0x1406ce6e4], 0xa
jl 0x1400a3090
mov eax, dword [0x1406ce6e0]
lea edi, [rax - 1]
imul edi, eax
and edi, 1
jne 0x1400a3370
mov eax, ecx
or al, r9b
mov byte [rbp + 0x10f], al
or byte [rbp + 0x10e], r8b
or dl, r10b
mov byte [rbp + 0x104], dl
mov eax, ecx
and al, r9b
xor al, 1
xor cl, r9b
mov edx, ecx
xor dl, al
not cl
or cl, al
and cl, dl
mov byte [rbp + 0x10d], cl
or bl, r11b
mov rax, qword [rbp + 0xf8]
mov r12, qword [rax + 0x30]
mov byte [rbp + 0xf0], bl
mov qword [rbp + 0xe8], rax
movsxd rax, dword [r12 + 0x3c]
mov r10d, dword [rax + r12 + 0x88]
test r10, r10
je 0x1400a32e0
cmp byte [rbp + 0x10f], 0
je 0x1400a3330
mov ecx, dword [r12 + r10 + 0x18]
lea rax, [r12 + 1]
mov qword [rbp + 0xe0], rax
mov r13, rcx
jmp 0x1400a3134
mov ebx, 0x811c9dc5
mov rcx, r13
cmp ebx, 0x8285aca5
je 0x1400a3392
sub r13, 1
jb 0x1400a32e0
cmp byte [rbp + 0x10e], 0
je 0x1400a3320
mov eax, 0xffffffff
add rcx, rax
mov eax, dword [r12 + r10 + 0x20]
add rax, r12
mov ecx, ecx
mov r9d, dword [rax + rcx*4]
mov al, byte [r12 + r9]
test al, al
je 0x1400a3120
add r9, qword [rbp + 0xe0]
mov ebx, 0x811c9dc5
jmp 0x1400a3243
mov r14d, r8d
or r14d, 0x1c6c88fb
mov r11d, r8d
not r11d
or r11d, 0xe3937704
mov eax, r14d
and eax, 0x4a121404
mov ecx, r8d
and ecx, 0x48801a
mov edx, r11d
and edx, 0x1c121044
add ecx, edx
add ecx, 0x80006801
mov edx, r8d
and edx, 0x2408a1
mov r15d, r8d
and r15d, 0xa1816300
or r15d, eax
xor r15d, edx
xor r15d, ecx
mov eax, r8d
and eax, 0x2103304
and r14d, 0xe9c7cc99
or r14d, eax
mov eax, r8d
and eax, 0x14280062
and r11d, 0xe9c7cc99
add eax, r11d
add eax, 0x2103304
xor eax, r14d
xor r8d, 0x1c6c88fb
or r8d, eax
mov eax, r15d
xor eax, 0x887ef0be
xor r15d, r8d
xor r15d, 0x887ef0be
or eax, r8d
not eax
or eax, r15d
xor ebx, eax
xor ebx, 0xe3937704
imul ebx, ebx, 0x1000193
movzx eax, byte [r9]
add r9, 1
test al, al
je 0x1400a3125
movsx r8d, al
lea eax, [r8 - 0x41]
cmp al, 0x19
ja 0x1400a3180
mov eax, r8d
not eax
mov esi, r8d
and esi, 0x89c1ac7c
mov ecx, r8d
or ecx, 0x89c1ac7c
mov edi, r8d
xor edi, 0x1008070
and edi, esi
not esi
mov edx, ecx
and edx, 0x253ac2f1
and eax, 0x52041102
or eax, edx
xor ecx, esi
and esi, 0x253ac2f1
or edi, esi
xor edi, eax
mov eax, r8d
xor eax, 0x89c1ac7c
or eax, ecx
mov ecx, eax
xor ecx, edi
not ecx
not eax
and eax, edi
or eax, ecx
and r8d, 0x20
mov ecx, eax
not ecx
and ecx, r8d
mov edx, eax
and edx, 0x2e4f563d
xor edx, r8d
and eax, 0xd1b0a9c2
or eax, edx
xor eax, ecx
xor eax, 0x763e53a3
mov r8d, eax
jmp 0x1400a3180
cmp byte [rbp + 0x10f], 0
je 0x1400a3340
mov bl, byte [rbp + 0xf0]
test bl, bl
je 0x1400a3350
mov rax, qword [rbp + 0xe8]
mov rax, qword [rax]
cmp rax, qword [rbp + 0xf8]
je 0x1400a2be9
mov r12, qword [rax + 0x30]
test r12, r12
jne 0x1400a30d9
jmp 0x1400a2be9
jmp 0x1400a3320
jmp 0x1400a3330
jmp 0x1400a3340
jmp 0x1400a3350
jmp 0x1400a3360
jmp 0x1400a3370
jmp 0x1400a3380
jmp 0x1400a3390
cmp byte [rbp + 0x104], 0
je 0x1400a33c0
cmp byte [rbp + 0x10d], 0
je 0x1400a2be9
nop dword [rax + rax]
jmp 0x1400a33b0
jmp 0x1400a33c0
call rax
jmp 0x1400a2b30
lea edi, [rcx - 1]
imul edi, ecx
and edi, 1
cmp edx, 0xa
jl 0x1400a33df
test edi, edi
jne 0x1400a3480
cmp dword [0x1406ce63c], 0xa
jl 0x1400a33fd
mov esi, dword [0x1406ce638]
lea ebx, [rsi - 1]
imul ebx, esi
and ebx, 1
jne 0x1400a34b0
cmp dword [0x1406ce644], 0xa
jl 0x1400a341b
mov ebx, dword [0x1406ce640]
lea esi, [rbx - 1]
imul esi, ebx
and esi, 1
jne 0x1400a34c0
test al, al
jne 0x1400a34c2
cmp edx, 0xa
jl 0x1400a342c
test edi, edi
jne 0x1400a3490
cmp dword [0x1406ce63c], 0xa
jl 0x1400a3446
mov ebx, dword [0x1406ce638]
lea edi, [rbx - 1]
imul edi, ebx
and edi, 1
jne 0x1400a34a0
cmp dword [0x1406ce644], 0xa
jl 0x1400a33c9
mov ebx, dword [0x1406ce640]
lea edi, [rbx - 1]
imul edi, ebx
and edi, 1
je 0x1400a33c9
nop dword [rax + rax]
jmp 0x1400a3470
jmp 0x1400a3480
jmp 0x1400a3490
jmp 0x1400a34a0
jmp 0x1400a34b0
jmp 0x1400a34c0
test r14b, r14b
je 0x1400a35f3
lea rsi, [rbp + 0xb0]
mov rcx, rsi
call fcn.14009ec60
cmp qword [rbp + 0xc8], 8
jb 0x1400a34eb
mov rsi, qword [rbp + 0xb0]
mov dword [rsp + 0x20], 1
lea rcx, [rbp - 0x58]
mov rdx, rsi
mov r8d, Ordinal_35
mov r9d, 0x40
call fcn.1400a9250
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdqe
imul rcx, rax, 0x7249ae75
mov rdx, rcx
shr rdx, 0x3f
sar rcx, 0x34
add ecx, edx
imul ecx, ecx, 0x23d6df
neg ecx
lea edi, [rax + rcx]
add edi, 0x1649d
movsxd r14, edi
mov rcx, r14
call fcn.1401f859c
mov rsi, rax
test edi, edi
je 0x1400a358a
cmp r14, 2
mov ebx, 1
cmovae rbx, r14
xor edi, edi
mov r15, qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
call r15
cdqe
imul rcx, rax, 0xffffffff80808081
shr rcx, 0x20
add ecx, eax
mov edx, ecx
shr edx, 0x1f
shr ecx, 7
add ecx, edx
add ecx, eax
mov byte [rsi + rdi], cl
add rdi, 1
cmp rbx, rdi
jne 0x1400a3560
lea rcx, [rbp - 0x58]
mov rdx, rsi
mov r8, r14
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::fail_void_const___ptr64]
lea rcx, [rbp - 0x50]
call fcn.1400b9490
test rax, rax
jne 0x1400a35d8
mov rax, qword [rbp - 0x58]
movsxd rax, dword [rax + 4]
lea rcx, [rax + rbp]
add rcx, 0xffffffffffffffa8
mov edx, dword [rbp + rax - 0x48]
or edx, 2
xor r8d, r8d
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::clear_int__bool____ptr64]
mov rcx, rsi
call fcn.1401f8568
cmp qword [rbp + 0xc8], 8
jb 0x1400a360d
mov rcx, qword [rbp + 0xb0]
jmp 0x1400a3614
xor r14d, r14d
mov eax, r14d
add rsp, 0x198
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, [rbp + 0xb0]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wremove]
test eax, eax
sete r14b
cmp dword [0x1406cdd1c], 0xa
jl 0x1400a3642
mov eax, dword [0x1406cdd18]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x1400a3642
nop word [rax + rax]
jmp 0x1400a3640
lea rdi, [rbp + 0x50]
mov rcx, rdi
call fcn.1400b9180
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::ios_base::destructor_void____ptr64]
lea rcx, [rbp + 0xb0]
call fcn.1400bd230
mov eax, dword [0x1406cdc40]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete cl
cmp dword [0x1406cdc44], 0xa
setl al
or al, cl
mov ecx, dword [0x1406ce18c]
mov edx, dword [0x1406ce188]
jne 0x1400a369a
lea ebx, [rcx - 1]
imul ebx, ecx
and ebx, 1
jmp 0x1400a36f4
lea ebx, [rcx - 1]
imul ebx, ecx
and ebx, 1
cmp edx, 0xa
jl 0x1400a36b0
test ebx, ebx
jne 0x1400a3750
cmp dword [0x1406ce63c], 0xa
jl 0x1400a36ce
mov edi, dword [0x1406ce638]
lea esi, [rdi - 1]
imul esi, edi
and esi, 1
jne 0x1400a3780
cmp dword [0x1406ce644], 0xa
jl 0x1400a36ec
mov edi, dword [0x1406ce640]
lea esi, [rdi - 1]
imul esi, edi
and esi, 1
jne 0x1400a3790
test al, al
jne 0x1400a35f6
cmp edx, 0xa
jl 0x1400a36fd
test ebx, ebx
jne 0x1400a3760
cmp dword [0x1406ce63c], 0xa
jl 0x1400a3717
mov ebx, dword [0x1406ce638]
lea edi, [rbx - 1]
imul edi, ebx
and edi, 1
jne 0x1400a3770
cmp dword [0x1406ce644], 0xa
jl 0x1400a369a
mov ebx, dword [0x1406ce640]
lea edi, [rbx - 1]
imul edi, ebx
and edi, 1
je 0x1400a369a
nop dword [rax]
jmp 0x1400a3740
jmp 0x1400a3750
jmp 0x1400a3760
jmp 0x1400a3770
jmp 0x1400a3780
jmp 0x1400a3790