Function at 0x14002fb00
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using murmur2
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
push r13
sub rsp, 0xa0
cmp qword [rcx + 8], 0
mov r13, rcx
jne 0x14002ffda
cmp qword [rcx + 0x18], 0
jne 0x14002ffda
cmp qword [rcx + 0x30], 0
jne 0x14002ffda
cmp dword [rcx + 0x28], 0
jne 0x14002ffda
cmp dword [rcx + 0x24], 0
jne 0x14002ffda
cmp byte [rcx + 0x40], 0
jne 0x14002ffda
mov qword [rax + 0x10], rbx
lea rcx, [rax - 0x78]
mov qword [rax + 0x20], rsi
mov qword [rax - 0x10], rdi
mov qword [rax - 0x18], r12
mov qword [rax - 0x28], r15
call fcn.140034a00
mov rbx, rax
movsx edi, byte [rax]
mov ecx, edi
call fcn.140014160
add edi, eax
cmp edi, 0xfffffff0
jg 0x14002fb89
mov edx, 0x84
call fcn.140052d80
cmp edi, 0xffffffb7
jg 0x14002fb98
mov edx, 0x9d
call fcn.140052d80
imul eax, edi, 0x5bd1e995
lea r8, [rbx + 4]
mov r12d, 8
mov r9, r8
mov r10d, r12d
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul r11d, ecx, 0x5bd1e995
xor edx, edx
nop
mov eax, r11d
lea r9, [r9 + 4]
xor eax, edx
add edx, 0x5bd1e995
imul ecx, eax, 0x286a90b9
xor ecx, 0xaa2a7357
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov dword [r9 - 4], eax
sub r10, 1
jne 0x14002fbc0
mov r9d, dword [0x14018719c]
mov rdx, qword [rbx + 0x28]
call fcn.1400525a0
mov rsi, rax
test rax, rax
je 0x14002fc72
movsx eax, byte [rbx]
xor r8d, r8d
movd xmm1, eax
lea rax, [rsi + 0x11]
punpcklbw xmm1, xmm1
punpcklwd xmm1, xmm1
pshufd xmm1, xmm1, 0
cmp rsi, rbx
ja 0x14002fc36
cmp rax, rbx
jae 0x14002fc47
movdqu xmm0, xmmword [rsi]
mov r8d, 0x10
xorps xmm1, xmm0
movdqu xmmword [rsi], xmm1
mov edx, 0x12
lea rcx, [rsi + r8]
sub rdx, r8
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbx]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x14002fc60
mov byte [rsi + 0x12], dl
mov rax, qword gs:[0x60]
mov qword [rsp + 0xc0], rbp
mov qword [rsp + 0x88], r14
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rdi, qword [rax]
mov eax, 0x5a4d
cmp qword [rdi + 0x60], 0
je 0x14002fd6a
nop word [rax + rax]
mov r11, qword [rdi + 0x30]
mov rdi, qword [rdi]
test r11, r11
je 0x14002fd5f
cmp word [r11], ax
jne 0x14002fd6a
movsxd rax, dword [r11 + 0x3c]
cmp dword [rax + r11], 0x4550
jne 0x14002fd6a
mov ecx, dword [rax + r11 + 0x88]
test ecx, ecx
je 0x14002fd6a
mov ebp, dword [r11 + rcx + 0x1c]
lea rax, [r11 + rcx]
mov r10d, dword [rax + 0x20]
add rbp, r11
mov r14d, dword [rax + 0x24]
add r10, r11
mov ebx, dword [rax + 0x18]
add r14, r11
xor r9d, r9d
test ebx, ebx
je 0x14002fd5a
mov ecx, dword [r10]
xor dl, dl
add rcx, r11
cmp byte [rcx], dl
je 0x14002fd4e
mov r8, rsi
sub r8, rcx
movzx eax, byte [rcx + r8]
test al, al
je 0x14002fd4a
cmp byte [rcx], al
jne 0x14002fd4e
inc rcx
mov dl, 1
cmp byte [rcx], 0
jne 0x14002fd22
movsxd rax, r9d
movzx ecx, word [r14 + rax*2]
mov eax, dword [rbp + rcx*4]
add rax, r11
jmp 0x14002fd6c
test dl, dl
jne 0x14002fd39
inc r9d
add r10, 4
cmp r9d, ebx
jb 0x14002fd10
mov eax, 0x5a4d
cmp qword [rdi + 0x60], 0
jne 0x14002fcb0
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x28], 0
xor edx, edx
mov dword [rsp + 0x20], 0x3b9aca00
lea r8d, [r9 + 4]
lea rcx, [rdx - 1]
call rax
mov qword [r13 + 0x18], rax
mov r15, rax
test rax, rax
je 0x14002ff7a
lea rcx, [rsp + 0x30]
call fcn.140034b60
mov rbx, rax
movsx edi, byte [rax]
mov ecx, edi
call fcn.140014160
add edi, eax
cmp edi, 0xfffffff0
jg 0x14002fdc4
mov edx, 0x84
call fcn.140052d80
cmp edi, 0xffffffb7
jg 0x14002fdd3
mov edx, 0x9d
call fcn.140052d80
imul eax, edi, 0x5bd1e995
lea r8, [rbx + 4]
mov r9, r8
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul r10d, ecx, 0x5bd1e995
xor edx, edx
mov eax, r10d
lea r9, [r9 + 4]
xor eax, edx
add edx, 0x5bd1e995
imul ecx, eax, 0x286a90b9
xor ecx, 0xaa2a7357
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov dword [r9 - 4], eax
sub r12, 1
jne 0x14002fdf0
mov r9d, dword [0x14018719c]
mov rdx, qword [rbx + 0x28]
call fcn.1400525a0
mov rsi, rax
test rax, rax
je 0x14002fe62
mov rcx, rsi
mov edx, 0xd
nop dword [rax]
movzx eax, byte [rbx]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x14002fe50
mov byte [rsi + 0xd], dl
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rdi, qword [rax]
cmp qword [rdi + 0x60], 0
je 0x14002ff45
mov r12d, 0x5a4d
nop word [rax + rax]
mov r11, qword [rdi + 0x30]
mov rdi, qword [rdi]
test r11, r11
je 0x14002ff3a
cmp word [r11], r12w
jne 0x14002ff45
movsxd rax, dword [r11 + 0x3c]
cmp dword [rax + r11], 0x4550
jne 0x14002ff45
mov ecx, dword [rax + r11 + 0x88]
test ecx, ecx
je 0x14002ff45
mov ebp, dword [r11 + rcx + 0x1c]
lea rax, [r11 + rcx]
mov r9d, dword [rax + 0x20]
add rbp, r11
mov r14d, dword [rax + 0x24]
add r9, r11
mov ebx, dword [rax + 0x18]
add r14, r11
xor r10d, r10d
test ebx, ebx
je 0x14002ff3a
nop dword [rax]
mov eax, dword [r9]
xor dl, dl
add rax, r11
cmp byte [rax], dl
je 0x14002ff2e
mov r8, rsi
sub r8, rax
movzx ecx, byte [rax + r8]
test cl, cl
je 0x14002ff2a
cmp byte [rax], cl
jne 0x14002ff2e
inc rax
mov dl, 1
cmp byte [rax], 0
jne 0x14002ff02
movsxd rax, r10d
movzx ecx, word [r14 + rax*2]
mov eax, dword [rbp + rcx*4]
add rax, r11
jmp 0x14002ff47
test dl, dl
jne 0x14002ff19
inc r10d
add r9, 4
cmp r10d, ebx
jb 0x14002fef0
cmp qword [rdi + 0x60], 0
jne 0x14002fe90
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x20], 0x3b9aca00
xor r8d, r8d
mov edx, 0xf001f
mov rcx, r15
call rax
mov qword [r13 + 0x30], rax
test rax, rax
jne 0x14002ffc1
mov rdx, qword [r13 + 0x18]
call fcn.140052f50
mov qword [r13 + 0x18], 0
mov eax, 0x300
mov r14, qword [rsp + 0x88]
mov rbp, qword [rsp + 0xc0]
mov rdi, qword [rsp + 0x98]
mov rsi, qword [rsp + 0xc8]
mov r12, qword [rsp + 0x90]
mov rbx, qword [rsp + 0xb8]
mov r15, qword [rsp + 0x80]
add rsp, 0xa0
pop r13
ret
mov byte [r13 + 0x2c], 1
xor eax, eax
mov dword [r13 + 0x38], 0
mov dword [r13 + 0x3c], 0x3b9aca00
jmp 0x14002ff7f
mov eax, 0x1000000
add rsp, 0xa0
pop r13
ret