Function at 0x140043d6c
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
mov eax, 0x2870
call fcn.140062f00
sub rsp, rax
mov rax, qword [0x1400b2040]
xor rax, rsp
mov qword [rsp + 0x2860], rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x140043e17
mov r9d, dword [r10 + 0x18]
test r9d, r9d
je 0x140043e17
mov edi, dword [r10 + 0x20]
dec r9d
mov r11d, 0x811c9dc5
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r8]
add rdx, r8
mov cl, byte [rdx]
inc rdx
test cl, cl
je 0x140043e12
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
inc rdx
test cl, cl
jne 0x140043df3
cmp r11d, 0xbc25fccb
je 0x140043e1c
test r9d, r9d
jne 0x140043dd6
mov rax, qword [rax]
jmp 0x140043db1
mov ecx, dword [r10 + 0x24]
mov ebx, 0x2000
add rcx, r8
movzx edx, word [rcx + r9*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
mov edx, ebx
add rax, r8
lea rcx, [rsp + 0x30]
lea r8, [rsp + 0x20]
call rax
test eax, eax
je 0x140044010
cmp dword [rsp + 0x20], ebx
jae 0x140044010
mov eax, dword [0x1400ab3c8]
mov esi, dword [rsp + 0x20]
movups xmm0, xmmword [str.kprocesshacker.sys]
shr rsi, 3
mov dword [rsp + 0x2050], eax
movzx eax, word [0x1400ab3cc]
mov word [rsp + 0x2054], ax
movups xmm1, xmmword [0x1400ab3b8]
movups xmmword [rsp + 0x2030], xmm0
movups xmmword [rsp + 0x2040], xmm1
test rsi, rsi
je 0x140044010
xor ebx, ebx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x140043f1e
mov r9d, dword [r10 + 0x18]
test r9d, r9d
je 0x140043f1e
mov edi, dword [r10 + 0x20]
dec r9d
mov r11d, 0x811c9dc5
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r8]
add rdx, r8
mov cl, byte [rdx]
inc rdx
test cl, cl
je 0x140043f19
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
inc rdx
test cl, cl
jne 0x140043efa
cmp r11d, 0x46edcbd0
je 0x140043f23
test r9d, r9d
jne 0x140043edd
mov rax, qword [rax]
jmp 0x140043eb8
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx edx, word [rcx + r9*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
lea rdx, [rsp + 0x2060]
mov rcx, qword [rsp + rbx*8 + 0x30]
add rax, r8
mov r8d, 0x400
call rax
test eax, eax
je 0x140044004
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x140043fd0
mov r9d, dword [r10 + 0x18]
test r9d, r9d
je 0x140043fd0
mov r14d, dword [r10 + 0x20]
dec r9d
mov r11d, 0x811c9dc5
lea rcx, [r14 + r9*4]
mov edx, dword [rcx + r8]
add rdx, r8
mov cl, byte [rdx]
inc rdx
test cl, cl
je 0x140043fcb
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
inc rdx
test cl, cl
jne 0x140043fac
cmp r11d, 0x28976ce8
je 0x140043fd5
test r9d, r9d
jne 0x140043f8f
mov rax, qword [rax]
jmp 0x140043f6a
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx edx, word [rcx + r9*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
lea rdx, [rsp + 0x2030]
add rax, r8
lea rcx, [rsp + 0x2060]
call rax
test eax, eax
je 0x140044040
inc rbx
cmp rbx, rsi
jl 0x140043ea7
xor eax, eax
mov rcx, qword [rsp + 0x2860]
xor rcx, rsp
call fcn.140061e40
lea r11, [rsp + 0x2870]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
mov eax, 0x3002
jmp 0x140044012