Function at 0x140001192
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rsi, rcx
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov qword [rcx], rbx
mov ecx, 5
call fcn.140003352
mov rdi, rax
movsxd rax, dword [rax + 0x3c]
mov eax, dword [rdi + rax + 0x88]
mov ecx, dword [rdi + rax + 0x20]
add rcx, rdi
lea r8, [rdi + 1]
mov edx, ebx
mov r9d, dword [rcx + rdx*4]
mov r10b, byte [rdi + r9]
test r10b, r10b
je 0x14000120a
add r9, r8
mov r11d, 0x34b40fe6
movsx r10d, r10b
xor r10d, r11d
imul r11d, r10d, 0x1000193
mov r10b, byte [r9]
inc r9
test r10b, r10b
jne 0x1400011e8
cmp r11d, 0xbec91f58
je 0x14000120e
inc ebx
jmp 0x1400011d0
mov ecx, dword [rdi + rax + 0x1c]
mov eax, dword [rdi + rax + 0x24]
add rcx, rdi
add rax, rdi
movzx eax, word [rax + rdx*2]
mov ecx, dword [rcx + rax*4]
mov rax, qword gs:[0x60]
mov rdx, qword [rax + 0x18]
add rdx, 0x10
mov rdx, qword [rdx]
mov rax, qword [rdx + 0x30]
movsxd r8, dword [rax + 0x3c]
mov r8d, dword [rax + r8 + 0x88]
test r8, r8
je 0x140001234
mov r9d, dword [rax + r8 + 0x18]
test r9, r9
je 0x140001234
mov r10d, dword [rax + r8 + 0x20]
add r10, rax
lea rbx, [rax + 1]
dec r9
mov r11d, r9d
mov r14d, dword [r10 + r11*4]
mov bpl, byte [rax + r14]
test bpl, bpl
je 0x1400012a0
add r14, rbx
mov r15d, 0x35b41179
movsx ebp, bpl
xor ebp, r15d
imul r15d, ebp, 0x1000193
mov bpl, byte [r14]
inc r14
test bpl, bpl
jne 0x14000127e
cmp r15d, 0x2ef7fef9
je 0x1400012a7
test r11, r11
jne 0x140001262
jmp 0x140001234
add rdi, rcx
mov ecx, dword [rax + r8 + 0x1c]
mov edx, dword [rax + r8 + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov ecx, dword [rcx + rdx*4]
add rcx, rax
call rcx
lea r8, [rsp + 0x30]
mov rcx, rax
mov edx, 8
call rdi
test eax, eax
je 0x140001cb4
mov dword [rsp + 0x3c], 0
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x1400012f7
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x1400012f7
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov edi, dword [r9 + r11*4]
mov bl, byte [rax + rdi]
test bl, bl
je 0x140001359
add rdi, r10
mov ebp, 0xc8bbb4a7
movsx ebx, bl
xor ebx, ebp
imul ebp, ebx, 0x1000193
mov bl, byte [rdi]
inc rdi
test bl, bl
jne 0x14000133d
cmp ebp, 0xafe5b5a8
je 0x140001360
test r11, r11
jne 0x140001324
jmp 0x1400012f7
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov r10d, dword [rcx + rdx*4]
add r10, rax
mov rcx, qword [rsp + 0x30]
lea rbx, [rsp + 0x3c]
mov qword [rsp + 0x20], rbx
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call r10
test eax, eax
jne 0x140001446
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x1400013b0
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x1400013b0
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov edi, dword [r9 + r11*4]
mov bpl, byte [rax + rdi]
test bpl, bpl
je 0x14000141b
add rdi, r10
mov r14d, 0xc7bbb314
movsx ebp, bpl
xor ebp, r14d
imul r14d, ebp, 0x1000193
mov bpl, byte [rdi]
inc rdi
test bpl, bpl
jne 0x1400013f9
cmp r14d, 0x25aab8a6
je 0x140001422
test r11, r11
jne 0x1400013dd
jmp 0x1400013b0
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov ecx, dword [rcx + rdx*4]
add rcx, rax
call rcx
cmp eax, 0x7a
jne 0x1400019a7
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x140001457
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x140001457
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov edi, dword [r9 + r11*4]
mov bpl, byte [rax + rdi]
test bpl, bpl
je 0x1400014c2
add rdi, r10
mov r14d, 0xc9cac0c4
movsx ebp, bpl
xor ebp, r14d
imul r14d, ebp, 0x1000193
mov bpl, byte [rdi]
inc rdi
test bpl, bpl
jne 0x1400014a0
cmp r14d, 0x1d626c44
je 0x1400014c9
test r11, r11
jne 0x140001484
jmp 0x140001457
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov r8d, dword [rcx + rdx*4]
add r8, rax
mov edx, dword [rsp + 0x3c]
mov ecx, 0x40
call r8
mov rdi, rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
add rax, 0x10
test rdi, rdi
je 0x14000157a
mov rax, qword [rax]
mov rcx, qword [rax + 0x30]
movsxd rdx, dword [rcx + 0x3c]
mov edx, dword [rcx + rdx + 0x88]
test rdx, rdx
je 0x140001508
mov r8d, dword [rcx + rdx + 0x18]
test r8, r8
je 0x140001508
mov r9d, dword [rcx + rdx + 0x20]
add r9, rcx
lea r10, [rcx + 1]
dec r8
mov r11d, r8d
mov r14d, dword [r9 + r11*4]
mov bpl, byte [rcx + r14]
test bpl, bpl
je 0x140001573
add r14, r10
mov r15d, 0x3450be52
movsx ebp, bpl
xor ebp, r15d
imul r15d, ebp, 0x1000193
mov bpl, byte [r14]
inc r14
test bpl, bpl
jne 0x140001551
cmp r15d, 0x4ae053af
je 0x1400015e7
test r11, r11
jne 0x140001535
jmp 0x140001508
mov rax, qword [rax]
mov rcx, qword [rax + 0x30]
movsxd rdx, dword [rcx + 0x3c]
mov edx, dword [rcx + rdx + 0x88]
test rdx, rdx
je 0x14000157a
mov r8d, dword [rcx + rdx + 0x18]
test r8, r8
je 0x14000157a
mov r9d, dword [rcx + rdx + 0x20]
add r9, rcx
lea r10, [rcx + 1]
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
mov bl, byte [rcx + rsi]
test bl, bl
je 0x1400015e0
add rsi, r10
mov edi, 0xad46ef71
movsx ebx, bl
xor ebx, edi
imul edi, ebx, 0x1000193
mov bl, byte [rsi]
inc rsi
test bl, bl
jne 0x1400015c0
cmp edi, 0xa3942851
je 0x1400018d3
test r11, r11
jne 0x1400015a7
jmp 0x14000157a
mov eax, dword [rcx + rdx + 0x1c]
mov edx, dword [rcx + rdx + 0x24]
add rax, rcx
add rdx, rcx
movzx edx, word [rdx + r11*2]
mov r10d, dword [rax + rdx*4]
add r10, rcx
mov r9d, dword [rsp + 0x3c]
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rbx
mov edx, 1
mov r8, rdi
call r10
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
add rcx, 0x10
test eax, eax
je 0x1400016a2
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x140001630
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x140001630
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov ebx, dword [r9 + r11*4]
mov bpl, byte [rax + rbx]
test bpl, bpl
je 0x14000169b
add rbx, r10
mov r14d, 0x47dd5f15
movsx ebp, bpl
xor ebp, r14d
imul r14d, ebp, 0x1000193
mov bpl, byte [rbx]
inc rbx
test bpl, bpl
jne 0x140001679
cmp r14d, 0xe0f86a31
je 0x14000170f
test r11, r11
jne 0x14000165d
jmp 0x140001630
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x1400016a2
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x1400016a2
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
mov bl, byte [rax + rsi]
test bl, bl
je 0x140001708
add rsi, r10
mov ebp, 0x469788f0
movsx ebx, bl
xor ebx, ebp
imul ebp, ebx, 0x1000193
mov bl, byte [rsi]
inc rsi
test bl, bl
jne 0x1400016e8
cmp ebp, 0x37f31dd1
je 0x140001a25
test r11, r11
jne 0x1400016cf
jmp 0x1400016a2
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
mov rcx, qword [rdi]
call rdx
mov ebx, eax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x140001740
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x140001740
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov r14d, dword [r9 + r11*4]
mov bpl, byte [rax + r14]
test bpl, bpl
je 0x1400017ab
add r14, r10
mov r15d, 0x3caca1c1
movsx ebp, bpl
xor ebp, r15d
imul r15d, ebp, 0x1000193
mov bpl, byte [r14]
inc r14
test bpl, bpl
jne 0x140001789
cmp r15d, 0xaae6219
je 0x1400017b2
test r11, r11
jne 0x14000176d
jmp 0x140001740
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov r8d, dword [rcx + rdx*4]
add r8, rax
mov edx, ebx
mov ecx, 0x40
call r8
mov qword [rsi], rax
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
add rcx, 0x10
test rax, rax
je 0x140001866
mov rcx, qword [rcx]
mov rdx, qword [rcx + 0x30]
movsxd r8, dword [rdx + 0x3c]
mov r8d, dword [rdx + r8 + 0x88]
test r8, r8
je 0x1400017ef
mov r9d, dword [rdx + r8 + 0x18]
test r9, r9
je 0x1400017ef
mov r10d, dword [rdx + r8 + 0x20]
add r10, rdx
lea r11, [rdx + 1]
dec r9
mov r14d, r9d
mov r15d, dword [r10 + r14*4]
mov bpl, byte [rdx + r15]
test bpl, bpl
je 0x14000185f
add r15, r11
mov r12d, 0x1252b211
movsx ebp, bpl
xor ebp, r12d
imul r12d, ebp, 0x1000193
mov bpl, byte [r15]
inc r15
test bpl, bpl
jne 0x140001839
cmp r12d, 0xa45b0a84
je 0x1400018f1
test r14, r14
jne 0x14000181d
jmp 0x1400017ef
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x140001866
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x140001866
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
mov bl, byte [rax + rsi]
test bl, bl
je 0x1400018cc
add rsi, r10
mov ebp, 0x5d4bccdf
movsx ebx, bl
xor ebx, ebp
imul ebp, ebx, 0x1000193
mov bl, byte [rsi]
inc rsi
test bl, bl
jne 0x1400018ac
cmp ebp, 0x99eee9bc
je 0x140001ac1
test r11, r11
jne 0x140001893
jmp 0x140001866
mov eax, dword [rcx + rdx + 0x1c]
mov edx, dword [rcx + rdx + 0x24]
add rax, rcx
add rdx, rcx
movzx edx, word [rdx + r11*2]
mov edx, dword [rax + rdx*4]
add rdx, rcx
jmp 0x140001cad
mov ecx, dword [rdx + r8 + 0x1c]
mov r8d, dword [rdx + r8 + 0x24]
add rcx, rdx
add r8, rdx
movzx r8d, word [r8 + r14*2]
mov r9d, dword [rcx + r8*4]
add r9, rdx
mov r8, qword [rdi]
mov ecx, ebx
mov rdx, rax
call r9
test eax, eax
jne 0x140001b82
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x140001931
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x140001931
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov ebx, dword [r9 + r11*4]
mov bpl, byte [rax + rbx]
test bpl, bpl
je 0x1400019a0
add rbx, r10
mov r14d, 0x6b6f9048
movsx ebp, bpl
xor ebp, r14d
imul r14d, ebp, 0x1000193
mov bpl, byte [rbx]
inc rbx
test bpl, bpl
jne 0x14000197a
cmp r14d, 0xa3010de9
je 0x140001b5d
test r11, r11
jne 0x14000195e
jmp 0x140001931
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x1400019b8
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x1400019b8
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
mov bl, byte [rax + rsi]
test bl, bl
je 0x140001a1e
add rsi, r10
mov edi, 0x4ac0fe7b
movsx ebx, bl
xor ebx, edi
imul edi, ebx, 0x1000193
mov bl, byte [rsi]
inc rsi
test bl, bl
jne 0x1400019fe
cmp edi, 0x1792eb2f
je 0x140001c94
test r11, r11
jne 0x1400019e5
jmp 0x1400019b8
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
mov rcx, rdi
call rdx
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x140001a54
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x140001a54
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
mov bl, byte [rax + rsi]
test bl, bl
je 0x140001aba
add rsi, r10
mov edi, 0xf2176104
movsx ebx, bl
xor ebx, edi
imul edi, ebx, 0x1000193
mov bl, byte [rsi]
inc rsi
test bl, bl
jne 0x140001a9a
cmp edi, 0xee15304e
je 0x140001c94
test r11, r11
jne 0x140001a81
jmp 0x140001a54
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
mov rcx, rdi
call rdx
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x140001af0
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x140001af0
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
mov bl, byte [rax + rsi]
test bl, bl
je 0x140001b56
add rsi, r10
mov edi, 0xc8de97f3
movsx ebx, bl
xor ebx, edi
imul edi, ebx, 0x1000193
mov bl, byte [rsi]
inc rsi
test bl, bl
jne 0x140001b36
cmp edi, 0x960104c7
je 0x140001c94
test r11, r11
jne 0x140001b1d
jmp 0x140001af0
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
mov rcx, qword [rsi]
call rdx
mov qword [rsi], 0
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x140001b93
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x140001b93
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
mov bl, byte [rax + rsi]
test bl, bl
je 0x140001bf5
add rsi, r10
mov ebp, 0x3267fb25
movsx ebx, bl
xor ebx, ebp
imul ebp, ebx, 0x1000193
mov bl, byte [rsi]
inc rsi
test bl, bl
jne 0x140001bd9
cmp ebp, 0xba679d6
je 0x140001bfc
test r11, r11
jne 0x140001bc0
jmp 0x140001b93
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
mov rcx, rdi
call rdx
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x140001c2b
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x140001c2b
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
mov bl, byte [rax + rsi]
test bl, bl
je 0x140001c8d
add rsi, r10
mov edi, 0x9737ee21
movsx ebx, bl
xor ebx, edi
imul edi, ebx, 0x1000193
mov bl, byte [rsi]
inc rsi
test bl, bl
jne 0x140001c71
cmp edi, 0x61946041
je 0x140001c94
test r11, r11
jne 0x140001c58
jmp 0x140001c2b
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
mov rcx, qword [rsp + 0x30]
call rdx
nop
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret