Function at 0x1400f4140
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x1401a4028]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r15, rcx
mov rdi, qword [0x1401ae2a8]
test rdi, rdi
jne 0x1400f4226
mov rax, qword gs:[0x60]
mov rdx, qword [rax + 0x18]
mov rax, qword [rdx + 0x10]
mov rsi, qword [rax]
mov rdi, rsi
nop
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov r11d, dword [rax + r9 + 0x88]
add r11, r9
cmp r11, r9
je 0x1400f4207
mov r8d, dword [r11 + 0x18]
test r8d, r8d
je 0x1400f4207
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [rbx + r8*4]
mov eax, dword [rax + r9]
add rax, r9
mov edx, 0xd62d8ce7
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x1400f4202
nop dword [rax]
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax]
lea rax, [rax + 1]
test cl, cl
jne 0x1400f41e0
cmp edx, 0x7c4d1763
je 0x1400f43ac
test r8d, r8d
jne 0x1400f41c0
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x1400f421d
cmp qword [rax + 0x30], 0
jne 0x1400f4190
xor edi, edi
mov qword [0x1401ae2a8], rdi
mov rax, qword gs:[0x58]
mov r14, qword [rax]
mov ecx, 0x7b8
mov eax, dword [rcx + r14]
mov ebx, 0x620
add rbx, r14
test al, 1
jne 0x1400f426e
or eax, 1
mov dword [rcx + r14], eax
mov dword [rbx + 6], 0x105f50c
mov dword [rbx], 0xf6ae664b
mov word [rbx + 4], 0xaf86
lea rcx, [0x14015ef30]
call fcn.140106ffc
nop
cmp byte [rbx + 9], 0
je 0x1400f429b
xor byte [rbx], 5
xor byte [rbx + 1], 0x35
xor byte [rbx + 2], 0xfd
xor byte [rbx + 3], 0xa9
xor byte [rbx + 4], 0xcf
xor byte [rbx + 5], 0xc1
xor byte [rbx + 6], 0x65
xor byte [rbx + 7], 0x81
xor byte [rbx + 8], 5
mov byte [rbx + 9], 0
mov rdx, rbx
mov rcx, qword [r15 + 0x38]
call rdi
mov qword [r15], rax
mov rdi, qword [0x1401ae2f0]
test rdi, rdi
jne 0x1400f4366
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rdi, rsi
nop
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov r11d, dword [rax + r9 + 0x88]
add r11, r9
cmp r11, r9
je 0x1400f4347
mov r8d, dword [r11 + 0x18]
test r8d, r8d
je 0x1400f4347
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [rbx + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
mov edx, 0xc1bb114d
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1400f4342
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x1400f4320
cmp edx, 0xb071f4dd
je 0x1400f43ca
test r8d, r8d
jne 0x1400f4300
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x1400f435d
cmp qword [rax + 0x30], 0
jne 0x1400f42d0
xor edi, edi
mov qword [0x1401ae2f0], rdi
movdqa xmm0, xmmword [0x140184d90]
mov ecx, 0x618
mov eax, dword [rcx + r14]
mov edx, 0x688
test al, 1
jne 0x1400f43fa
or eax, 1
mov dword [rcx + r14], eax
lea rbx, [r14 + rdx]
mov byte [rbx + 0x10], 1
lea rax, [rbx + 0xf]
lea rcx, [rsp + 0x5f]
cmp rbx, rcx
ja 0x1400f43e8
lea rcx, [rsp + 0x50]
cmp rax, rcx
jb 0x1400f43e8
movups xmmword [rbx], xmm0
jmp 0x1400f43eb
mov ecx, dword [r11 + 0x1c]
add rcx, r9
mov eax, dword [r11 + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov edi, dword [rcx + rax*4]
add rdi, r9
jmp 0x1400f421f
mov ecx, dword [r11 + 0x1c]
add rcx, r9
mov eax, dword [r11 + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov edi, dword [rcx + rax*4]
add rdi, r9
jmp 0x1400f435f
movups xmmword [rbx], xmm0
lea rcx, [0x14015ef00]
call fcn.140106ffc
nop
jmp 0x1400f43fe
lea rbx, [r14 + rdx]
cmp byte [rbx + 0x10], 0
je 0x1400f4447
xor byte [rbx], 0xb5
xor byte [rbx + 1], 0x17
xor byte [rbx + 2], 0xfb
xor byte [rbx + 3], 0xbf
xor byte [rbx + 4], 0xd1
xor byte [rbx + 5], 0xfb
xor byte [rbx + 6], 0xdf
xor byte [rbx + 7], 0x6b
xor byte [rbx + 8], 0xb5
xor byte [rbx + 9], 0x17
xor byte [rbx + 0xa], 0xfb
xor byte [rbx + 0xb], 0xbf
xor byte [rbx + 0xc], 0xd1
xor byte [rbx + 0xd], 0xfb
xor byte [rbx + 0xe], 0xdf
xor byte [rbx + 0xf], 0x6b
mov byte [rbx + 0x10], 0
mov rdx, rbx
mov rcx, qword [r15 + 0x38]
call rdi
mov qword [r15 + 8], rax
mov rdi, qword [0x1401ae2a0]
test rdi, rdi
jne 0x1400f4512
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rdi, rsi
nop dword [rax + rax]
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov r11d, dword [rax + r9 + 0x88]
add r11, r9
cmp r11, r9
je 0x1400f44f3
mov r8d, dword [r11 + 0x18]
test r8d, r8d
je 0x1400f44f3
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [rbx + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
mov edx, 0x66f512bf
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1400f44ee
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x1400f44d0
cmp edx, 0x8dff09cb
je 0x1400f4558
test r8d, r8d
jne 0x1400f44b0
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x1400f4509
cmp qword [rax + 0x30], 0
jne 0x1400f4480
xor edi, edi
mov qword [0x1401ae2a0], rdi
movdqa xmm0, xmmword [0x140184ec0]
mov ecx, 0x504
mov eax, dword [rcx + r14]
mov edx, 0x770
test al, 1
jne 0x1400f4585
or eax, 1
mov dword [rcx + r14], eax
lea rbx, [rdx + r14]
mov byte [rbx + 0x10], 1
lea rax, [rbx + 0xf]
lea rcx, [rsp + 0x6f]
cmp rbx, rcx
ja 0x1400f4573
lea rcx, [rsp + 0x60]
cmp rax, rcx
jb 0x1400f4573
movups xmmword [rbx], xmm0
jmp 0x1400f4576
mov ecx, dword [r11 + 0x1c]
add rcx, r9
mov eax, dword [r11 + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov edi, dword [rcx + rax*4]
add rdi, r9
jmp 0x1400f450b
movups xmmword [rbx], xmm0
lea rcx, [0x14015eed0]
call fcn.140106ffc
nop
jmp 0x1400f4589
lea rbx, [r14 + rdx]
cmp byte [rbx + 0x10], 0
je 0x1400f45d2
xor byte [rbx], 0xf3
xor byte [rbx + 1], 0xdb
xor byte [rbx + 2], 0xe1
xor byte [rbx + 3], 0x13
xor byte [rbx + 4], 0x47
xor byte [rbx + 5], 0xd5
xor byte [rbx + 6], 0x85
xor byte [rbx + 7], 0xd3
xor byte [rbx + 8], 0xf3
xor byte [rbx + 9], 0xdb
xor byte [rbx + 0xa], 0xe1
xor byte [rbx + 0xb], 0x13
xor byte [rbx + 0xc], 0x47
xor byte [rbx + 0xd], 0xd5
xor byte [rbx + 0xe], 0x85
xor byte [rbx + 0xf], 0xd3
mov byte [rbx + 0x10], 0
mov rdx, rbx
mov rcx, qword [r15 + 0x38]
call rdi
mov qword [r15 + 0x10], rax
mov rdi, qword [0x1401ae2c8]
test rdi, rdi
jne 0x1400f46a2
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rdi, rsi
nop word [rax + rax]
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov r11d, dword [rax + r9 + 0x88]
add r11, r9
cmp r11, r9
je 0x1400f4683
mov r8d, dword [r11 + 0x18]
test r8d, r8d
je 0x1400f4683
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [rbx + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
mov edx, 0x56962529
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1400f467e
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x1400f4660
cmp edx, 0x2b273831
je 0x1400f46f8
test r8d, r8d
jne 0x1400f4640
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x1400f4699
cmp qword [rax + 0x30], 0
jne 0x1400f4610
xor edi, edi
mov qword [0x1401ae2c8], rdi
movdqa xmm0, xmmword [0x140184e20]
mov word [rsp + 0x48], 0x6fba
mov ecx, 0x78c
mov eax, dword [rcx + r14]
mov edx, 0x4d0
test al, 1
jne 0x1400f472e
or eax, 1
mov dword [rcx + r14], eax
lea rbx, [rdx + r14]
mov byte [rbx + 0x12], 1
lea rax, [rbx + 0x11]
lea rcx, [rsp + 0x49]
cmp rbx, rcx
ja 0x1400f4713
lea rcx, [rsp + 0x38]
cmp rax, rcx
jb 0x1400f4713
movups xmmword [rbx], xmm0
movzx eax, word [rsp + 0x48]
mov word [rbx + 0x10], ax
jmp 0x1400f471f
mov ecx, dword [r11 + 0x1c]
add rcx, r9
mov eax, dword [r11 + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov edi, dword [rcx + rax*4]
add rdi, r9
jmp 0x1400f469b
movups xmmword [rbx], xmm0
movzx eax, word [rsp + 0x48]
mov word [rbx + 0x10], ax
lea rcx, [0x14015eeb0]
call fcn.140106ffc
nop
jmp 0x1400f4732
lea rbx, [rdx + r14]
cmp byte [rbx + 0x12], 0
je 0x1400f4783
xor byte [rbx], 0xdf
xor byte [rbx + 1], 0x6f
xor byte [rbx + 2], 0x29
xor byte [rbx + 3], 0x85
xor byte [rbx + 4], 0x79
xor byte [rbx + 5], 0x41
xor byte [rbx + 6], 0xe1
xor byte [rbx + 7], 0xeb
xor byte [rbx + 8], 0xdf
xor byte [rbx + 9], 0x6f
xor byte [rbx + 0xa], 0x29
xor byte [rbx + 0xb], 0x85
xor byte [rbx + 0xc], 0x79
xor byte [rbx + 0xd], 0x41
xor byte [rbx + 0xe], 0xe1
xor byte [rbx + 0xf], 0xeb
xor byte [rbx + 0x10], 0xdf
xor byte [rbx + 0x11], 0x6f
mov byte [rbx + 0x12], 0
mov rdx, rbx
mov rcx, qword [r15 + 0x38]
call rdi
mov qword [r15 + 0x18], rax
mov rdi, qword [0x1401ae200]
test rdi, rdi
jne 0x1400f4856
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rdi, rsi
nop word [rax + rax]
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov r11d, dword [rax + r9 + 0x88]
add r11, r9
cmp r11, r9
je 0x1400f4837
mov r8d, dword [r11 + 0x18]
test r8d, r8d
je 0x1400f4837
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r9 + r8*4]
mov ecx, dword [rax + rbx]
add rcx, r9
mov edx, 0xd0a9e0bc
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1400f4832
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x1400f4810
cmp edx, 0x99002dd0
je 0x1400f48b7
test r8d, r8d
jne 0x1400f47f0
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x1400f484d
cmp qword [rax + 0x30], 0
jne 0x1400f47c0
xor edi, edi
mov qword [0x1401ae200], rdi
movdqa xmm0, xmmword [0x140184ca0]
mov dword [rsp + 0x30], 0x405c6266
mov dword [rsp + 0x34], 0x6f296ee9
mov ecx, 0x784
mov eax, dword [rcx + r14]
mov edx, 0x6d0
test al, 1
jne 0x1400f48f2
or eax, 1
mov dword [rcx + r14], eax
lea rbx, [rdx + r14]
mov byte [rbx + 0x18], 1
lea rax, [rbx + 0x17]
lea rcx, [rsp + 0x37]
cmp rbx, rcx
ja 0x1400f48d5
lea rcx, [rsp + 0x20]
cmp rax, rcx
jb 0x1400f48d5
movups xmmword [rbx], xmm0
movsd xmm0, qword [rsp + 0x30]
movsd qword [rbx + 0x10], xmm0
jmp 0x1400f48e3
mov ecx, dword [r11 + 0x1c]
add rcx, r9
mov eax, dword [r11 + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov edi, dword [rcx + rax*4]
add rdi, r9
jmp 0x1400f484f
movups xmmword [rbx], xmm0
movsd xmm0, qword [rsp + 0x30]
movsd qword [rbx + 0x10], xmm0
lea rcx, [0x14015ee90]
call fcn.140106ffc
nop
jmp 0x1400f48f6
lea rbx, [rdx + r14]
cmp byte [rbx + 0x18], 0
je 0x1400f495f
xor byte [rbx], 0x2d
xor byte [rbx + 1], 7
xor byte [rbx + 2], 0x25
xor byte [rbx + 3], 0x13
xor byte [rbx + 4], 0x85
xor byte [rbx + 5], 1
xor byte [rbx + 6], 0x5d
xor byte [rbx + 7], 0x6f
xor byte [rbx + 8], 0x2d
xor byte [rbx + 9], 7
xor byte [rbx + 0xa], 0x25
xor byte [rbx + 0xb], 0x13
xor byte [rbx + 0xc], 0x85
xor byte [rbx + 0xd], 1
xor byte [rbx + 0xe], 0x5d
xor byte [rbx + 0xf], 0x6f
xor byte [rbx + 0x10], 0x2d
xor byte [rbx + 0x11], 7
xor byte [rbx + 0x12], 0x25
xor byte [rbx + 0x13], 0x13
xor byte [rbx + 0x14], 0x85
xor byte [rbx + 0x15], 1
xor byte [rbx + 0x16], 0x5d
xor byte [rbx + 0x17], 0x6f
mov byte [rbx + 0x18], 0
mov rdx, rbx
mov rcx, qword [r15 + 0x38]
call rdi
mov qword [r15 + 0x20], rax
mov rdi, qword [0x1401ae230]
test rdi, rdi
jne 0x1400f4a32
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rdi, rsi
nop dword [rax]
nop word [rax + rax]
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov r11d, dword [rax + r9 + 0x88]
add r11, r9
cmp r11, r9
je 0x1400f4a13
mov r8d, dword [r11 + 0x18]
test r8d, r8d
je 0x1400f4a13
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r9 + r8*4]
mov ecx, dword [rax + rbx]
add rcx, r9
mov edx, 0xefdf3aba
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1400f4a0e
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x1400f49f0
cmp edx, 0x1fb59bd2
je 0x1400f4a7c
test r8d, r8d
jne 0x1400f49d0
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x1400f4a29
cmp qword [rax + 0x30], 0
jne 0x1400f49a0
xor edi, edi
mov qword [0x1401ae230], rdi
mov ecx, 0x7d4
mov eax, dword [rcx + r14]
mov edx, 0x6f0
test al, 1
jne 0x1400f4a97
or eax, 1
mov dword [rcx + r14], eax
lea rbx, [r14 + rdx]
mov word [rbx + 0xd], 0x189
mov dword [rbx], 0xe4007e3b
mov dword [rbx + 4], 0x3e9bcf02
mov dword [rbx + 8], 0xba5d660e
mov byte [rbx + 0xc], 0x29
lea rcx, [0x14015ee70]
call fcn.140106ffc
nop
jmp 0x1400f4a9b
mov ecx, dword [r11 + 0x1c]
add rcx, r9
mov eax, dword [r11 + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov edi, dword [rcx + rax*4]
add rdi, r9
jmp 0x1400f4a2b
lea rbx, [r14 + rdx]
cmp byte [rbx + 0xe], 0
je 0x1400f4adc
xor byte [rbx], 0x6b
xor byte [rbx + 1], 0x35
xor byte [rbx + 2], 0x31
xor byte [rbx + 3], 0xd5
xor byte [rbx + 4], 0x5d
xor byte [rbx + 5], 0x89
xor byte [rbx + 6], 0xe9
xor byte [rbx + 7], 0x5b
xor byte [rbx + 8], 0x6b
xor byte [rbx + 9], 0x35
xor byte [rbx + 0xa], 0x31
xor byte [rbx + 0xb], 0xd5
xor byte [rbx + 0xc], 0x5d
xor byte [rbx + 0xd], 0x89
mov byte [rbx + 0xe], 0
mov rdx, rbx
mov rcx, qword [r15 + 0x38]
call rdi
mov qword [r15 + 0x28], rax
mov rdi, qword [0x1401ae220]
test rdi, rdi
jne 0x1400f4ba2
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rdi, rsi
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov r11d, dword [rax + r9 + 0x88]
add r11, r9
cmp r11, r9
je 0x1400f4b83
mov r8d, dword [r11 + 0x18]
test r8d, r8d
je 0x1400f4b83
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r9 + r8*4]
mov ecx, dword [rax + rbx]
add rcx, r9
mov edx, 0xabe304e8
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1400f4b7e
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x1400f4b60
cmp edx, 0xf7290144
je 0x1400f4be8
test r8d, r8d
jne 0x1400f4b40
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x1400f4b99
cmp qword [rax + 0x30], 0
jne 0x1400f4b10
xor edi, edi
mov qword [0x1401ae220], rdi
mov ecx, 0x6cc
mov eax, dword [rcx + r14]
mov edx, 0x4e8
test al, 1
jne 0x1400f4c03
or eax, 1
mov dword [rcx + r14], eax
lea rbx, [rdx + r14]
mov dword [rbx + 0xa], 0x117db22
mov dword [rbx], 0xea06aad5
mov dword [rbx + 4], 0x9346f44
mov word [rbx + 8], 0x96ff
lea rcx, [0x14015ee50]
call fcn.140106ffc
nop
jmp 0x1400f4c07
mov ecx, dword [r11 + 0x1c]
add rcx, r9
mov eax, dword [r11 + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov edi, dword [rcx + rax*4]
add rdi, r9
jmp 0x1400f4b9b
lea rbx, [rdx + r14]
cmp byte [rbx + 0xd], 0
je 0x1400f4c44
xor byte [rbx], 0x9b
xor byte [rbx + 1], 0xf9
xor byte [rbx + 2], 0x55
xor byte [rbx + 3], 0xb5
xor byte [rbx + 4], 0x17
xor byte [rbx + 5], 7
xor byte [rbx + 6], 0x41
xor byte [rbx + 7], 0x7d
xor byte [rbx + 8], 0x9b
xor byte [rbx + 9], 0xf9
xor byte [rbx + 0xa], 0x55
xor byte [rbx + 0xb], 0xb5
xor byte [rbx + 0xc], 0x17
mov byte [rbx + 0xd], 0
mov rdx, rbx
mov rcx, qword [r15 + 0x38]
call rdi
mov qword [r15 + 0x30], rax
xor eax, eax
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140106970
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret