Function at 0x7ff77f2eb220
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x7ff77f37b080]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov r13, rcx
mov ecx, r8d
mov r12d, r8d
mov r15, rdx
test r8d, r8d
je 0x7ff77f2eb3ee
sub ecx, 1
je 0x7ff77f2eb32e
cmp ecx, 1
jne 0x7ff77f2eb4d7
call qword [sym.imp.kernel32.dll_GetCurrentProcess]
mov rcx, qword gs:[0x60]
mov r14, rax
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov rbx, qword [rcx + 0x30]
movsxd rdx, dword [rbx + 0x3c]
mov esi, dword [rdx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x7ff77f2eb31a
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x7ff77f2eb31a
mov ebp, dword [rsi + 0x20]
dec r11d
mov r10d, 0x521a802c
lea rax, [rbx + r11*4]
mov r9d, dword [rax + rbp]
add r9, rbx
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x7ff77f2eb315
nop dword [rax]
nop word [rax + rax]
movsx eax, r8b
lea r9, [r9 + 1]
sub r8b, 0x41
mov edx, eax
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [r9 - 1]
cmova edx, eax
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x7ff77f2eb2e0
cmp r10d, 0x21ecf3a6
je 0x7ff77f2eb322
test r11d, r11d
jne 0x7ff77f2eb2b3
mov rcx, qword [rcx]
jmp 0x7ff77f2eb290
lea r8, [0x7ff77f37bf68]
jmp 0x7ff77f2eb4a9
call qword [sym.imp.kernel32.dll_GetCurrentProcess]
mov rcx, qword gs:[0x60]
mov r14, rax
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax + rax]
mov rbx, qword [rcx + 0x30]
movsxd rdx, dword [rbx + 0x3c]
mov esi, dword [rdx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x7ff77f2eb3da
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x7ff77f2eb3da
mov ebp, dword [rsi + 0x20]
dec r11d
mov r10d, 0xe68039a6
lea rax, [rbx + r11*4]
mov r9d, dword [rax + rbp]
add r9, rbx
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x7ff77f2eb3d5
nop dword [rax]
nop word [rax + rax]
movsx eax, r8b
lea r9, [r9 + 1]
sub r8b, 0x41
mov edx, eax
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [r9 - 1]
cmova edx, eax
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x7ff77f2eb3a0
cmp r10d, 0xce5abac
je 0x7ff77f2eb3e2
test r11d, r11d
jne 0x7ff77f2eb373
mov rcx, qword [rcx]
jmp 0x7ff77f2eb350
lea r8, [0x7ff77f37bf98]
jmp 0x7ff77f2eb4a9
call qword [sym.imp.kernel32.dll_GetCurrentProcess]
mov rcx, qword gs:[0x60]
mov r14, rax
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax + rax]
mov rbx, qword [rcx + 0x30]
movsxd rdx, dword [rbx + 0x3c]
mov esi, dword [rdx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x7ff77f2eb49a
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x7ff77f2eb49a
mov ebp, dword [rsi + 0x20]
dec r11d
mov r10d, 0x7bb23e03
lea rax, [rbx + r11*4]
mov r9d, dword [rax + rbp]
add r9, rbx
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x7ff77f2eb495
nop dword [rax]
nop word [rax + rax]
movsx eax, r8b
lea r9, [r9 + 1]
sub r8b, 0x41
mov edx, eax
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [r9 - 1]
cmova edx, eax
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x7ff77f2eb460
cmp r10d, 0x777ff207
je 0x7ff77f2eb4a2
test r11d, r11d
jne 0x7ff77f2eb433
mov rcx, qword [rcx]
jmp 0x7ff77f2eb410
lea r8, [0x7ff77f37bf30]
mov ecx, dword [rsi + 0x24]
mov r9d, 5
add rcx, rbx
mov qword [rsp + 0x20], 0
movzx edx, word [rcx + r11*2]
mov ecx, dword [rsi + 0x1c]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
mov rdx, r13
add rax, rbx
mov rcx, r14
call rax
mov rcx, r13
call fcn.7ff77f2eacc0
mov rdx, r15
mov rcx, rax
mov rbp, rax
call fcn.7ff77f2eb020
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop
mov rbx, qword [rcx + 0x30]
movsxd rdx, dword [rbx + 0x3c]
mov esi, dword [rdx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x7ff77f2eb58a
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x7ff77f2eb58a
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
mov r10d, 0x891347da
lea rax, [r14 + r11*4]
mov r9d, dword [rax + rbx]
add r9, rbx
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x7ff77f2eb585
movsx eax, r8b
lea r9, [r9 + 1]
sub r8b, 0x41
mov edx, eax
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [r9 - 1]
cmova edx, eax
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x7ff77f2eb550
cmp r10d, 0xe11f3070
je 0x7ff77f2eb592
test r11d, r11d
jne 0x7ff77f2eb530
mov rcx, qword [rcx]
jmp 0x7ff77f2eb500
mov ecx, dword [rsi + 0x24]
lea r9, [rsp + 0x30]
add rcx, rbx
mov r8d, 0x20
movzx edx, word [rcx + r11*2]
mov ecx, dword [rsi + 0x1c]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
mov edx, 0x1000
add rax, rbx
mov rcx, rbp
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x7ff77f2eb65a
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x7ff77f2eb65a
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
mov r10d, 0x76b4571e
lea rcx, [r14 + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x7ff77f2eb655
movsx ecx, r8b
lea r9, [r9 + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [r9 - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x7ff77f2eb620
cmp r10d, 0xffb4c134
je 0x7ff77f2eb662
test r11d, r11d
jne 0x7ff77f2eb600
mov rax, qword [rax]
jmp 0x7ff77f2eb5d0
mov ecx, dword [rsi + 0x24]
lea r9, [rsp + 0x34]
add rcx, rbx
movzx edx, word [rcx + r11*2]
mov ecx, dword [rsi + 0x1c]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
mov edx, 5
add rax, rbx
mov rcx, r13
lea r8d, [rdx + 0x3b]
call rax
mov dword [rsp + 0x48], 0xe9
sub rbp, r13
mov byte [rsp + 0x4c], 0
sub rbp, 5
mov qword [rsp + 0x40], rbp
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x7ff77f2eb74a
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x7ff77f2eb74a
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
mov r10d, 0xacdb677
lea rcx, [r14 + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x7ff77f2eb745
movsx ecx, r8b
lea r9, [r9 + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [r9 - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x7ff77f2eb710
cmp r10d, 0xf2723c92
je 0x7ff77f2eb752
test r11d, r11d
jne 0x7ff77f2eb6f0
mov rax, qword [rax]
jmp 0x7ff77f2eb6c0
mov ecx, dword [rsi + 0x24]
mov r8d, 4
add rcx, rbx
movzx edx, word [rcx + r11*2]
mov ecx, dword [rsi + 0x1c]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
lea rdx, [rsp + 0x40]
add rax, rbx
lea rcx, [rsp + 0x49]
call rax
test r12d, r12d
je 0x7ff77f2eb932
sub r12d, 1
je 0x7ff77f2eb862
cmp r12d, 1
jne 0x7ff77f2eba0d
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x7ff77f2eb83a
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x7ff77f2eb83a
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
mov r10d, 0x7f16fdf7
lea rcx, [r14 + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x7ff77f2eb835
movsx ecx, r8b
lea r9, [r9 + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [r9 - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x7ff77f2eb800
cmp r10d, 0x7f354812
je 0x7ff77f2eb842
test r11d, r11d
jne 0x7ff77f2eb7e0
mov rax, qword [rax]
jmp 0x7ff77f2eb7b0
mov ecx, dword [rsi + 0x24]
add rcx, rbx
movzx edx, word [rcx + r11*2]
mov ecx, dword [rsi + 0x1c]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
lea rcx, [0x7ff77f37bf90]
jmp 0x7ff77f2eb9fd
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x7ff77f2eb90a
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x7ff77f2eb90a
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
mov r10d, 0x9e956353
lea rcx, [r14 + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x7ff77f2eb905
movsx ecx, r8b
lea r9, [r9 + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [r9 - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x7ff77f2eb8d0
cmp r10d, 0xb48dd376
je 0x7ff77f2eb912
test r11d, r11d
jne 0x7ff77f2eb8b0
mov rax, qword [rax]
jmp 0x7ff77f2eb880
mov ecx, dword [rsi + 0x24]
add rcx, rbx
movzx edx, word [rcx + r11*2]
mov ecx, dword [rsi + 0x1c]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
lea rcx, [0x7ff77f37bf28]
jmp 0x7ff77f2eb9fd
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x7ff77f2eb9da
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x7ff77f2eb9da
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
mov r10d, 0xdcdea981
lea rcx, [r14 + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x7ff77f2eb9d5
movsx ecx, r8b
lea r9, [r9 + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [r9 - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x7ff77f2eb9a0
cmp r10d, 0xa934e558
je 0x7ff77f2eb9e2
test r11d, r11d
jne 0x7ff77f2eb980
mov rax, qword [rax]
jmp 0x7ff77f2eb950
mov ecx, dword [rsi + 0x24]
add rcx, rbx
movzx edx, word [rcx + r11*2]
mov ecx, dword [rsi + 0x1c]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
lea rcx, [0x7ff77f37bf70]
mov r8d, 5
lea rdx, [rsp + 0x48]
add rax, rbx
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x7ff77f2ebaaa
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x7ff77f2ebaaa
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
mov r10d, 0x44cb7f7e
lea rcx, [r14 + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x7ff77f2ebaa5
movsx ecx, r8b
lea r9, [r9 + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [r9 - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x7ff77f2eba70
cmp r10d, 0x85041213
je 0x7ff77f2ebab2
test r11d, r11d
jne 0x7ff77f2eba50
mov rax, qword [rax]
jmp 0x7ff77f2eba20
mov ecx, dword [rsi + 0x24]
mov r8d, 5
add rcx, rbx
movzx edx, word [rcx + r11*2]
mov ecx, dword [rsi + 0x1c]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
lea rdx, [rsp + 0x48]
add rax, rbx
mov rcx, r13
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x7ff77f2ebb6b
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x7ff77f2ebb6b
mov ebp, dword [rsi + 0x20]
dec r11d
mov r10d, 0x2a6804fc
lea rcx, [rbx + r11*4]
mov r9d, dword [rcx + rbp]
add r9, rbx
movzx ecx, byte [r9]
inc r9
test cl, cl
je 0x7ff77f2ebb66
movsx edx, cl
lea r9, [r9 + 1]
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
movzx ecx, byte [r9 - 1]
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
test cl, cl
jne 0x7ff77f2ebb32
cmp r10d, 0x623b997e
je 0x7ff77f2ebb70
test r11d, r11d
jne 0x7ff77f2ebb13
mov rax, qword [rax]
jmp 0x7ff77f2ebaf0
mov r9d, dword [rsi + 0x24]
mov edx, 5
add r9, rbx
mov rcx, r13
lea r8d, [rdx + 0x1b]
movzx r10d, word [r9 + r11*2]
mov r9d, dword [rsi + 0x1c]
add r9, rbx
mov eax, dword [r9 + r10*4]
lea r9, [rsp + 0x38]
add rax, rbx
call rax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.7ff77f355090
mov rbx, qword [rsp + 0xb0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret