Function at 0x140002d00
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1d8]
sub rsp, 0x2b0
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x140009040]
xor rax, rsp
mov qword [rbp + 0x198], rax
mov r13, rcx
mov ecx, 4
mov rax, qword gs:[0x58]
mov rdx, qword [rax]
mov eax, dword [rcx + rdx]
cmp dword [0x140009794], eax
jle 0x140002da5
lea rcx, [0x140009794]
call fcn.140005a8c
cmp dword [0x140009794], 0xffffffff
jne 0x140002da5
mov dword [0x140009790], 0x1d1c5c5
mov dword [0x140009788], 0x2eb8c5ea
mov dword [0x14000978c], 0xb05bd1b
lea rcx, [0x140006a80]
call fcn.140005d68
lea rcx, [0x140009794]
call fcn.140005a20
cmp byte [0x140009793], 0
je 0x140002e02
xor byte [0x140009788], 0xa9
xor byte [0x140009789], 0xa9
xor byte [0x14000978a], 0xd1
xor byte [0x14000978b], 0x4b
xor byte [0x14000978c], 0x75
xor byte [0x14000978d], 0xc9
xor byte [0x14000978e], 0x2b
xor byte [0x14000978f], 0x6f
xor byte [0x140009790], 0xa9
xor byte [0x140009791], 0xa9
xor byte [0x140009792], 0xd1
mov byte [0x140009793], 0
xor r12d, r12d
mov qword [rbp - 0x80], r12
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
movabs rdi, 0x3f3be160fbd3b149
mov r8, rdi
lea rdx, [rbp - 0x78]
call fcn.140004fd0
mov rax, qword [rbp - 0x78]
test rax, rax
jne 0x14000318d
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], r12
mov rax, qword gs:[0x60]
mov r12, qword [rax + 0x18]
add r12, 0x10
mov rax, qword [r12]
mov r14, qword [rax]
mov qword [rbp + 0x130], r14
mov qword [rbp + 0x138], r12
xor r10d, r10d
mov qword [rbp + 0xe0], r14
mov qword [rbp + 0xe8], r14
mov qword [rbp + 0x140], r12
mov qword [rbp + 0x148], r12
cmp r14, r12
je 0x14000311b
mov rsi, r14
mov qword [rbp + 0xe8], r14
movabs rbx, 0x218c04230219554a
lea r15, [r10 - 1]
test rsi, rsi
jne 0x140002eb4
mov qword [rbp - 0x68], rsi
mov qword [rbp - 0x60], r10
lea rax, [rbp - 0x68]
jmp 0x140002ec0
movups xmm0, xmmword [rsi + 0x58]
movups xmmword [rbp + 0x68], xmm0
lea rax, [rbp + 0x68]
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xa0], xmm0
mov rcx, qword [rax + 8]
mov qword [rbp - 0x10], rcx
mov rax, r15
inc rax
cmp word [rcx + rax*2], 0
jne 0x140002ed5
mov qword [rbp - 8], rax
movaps xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rbp + 0x80], xmm0
lea r8, [rbp + 0x80]
mov rdx, rbx
call fcn.140001660
test al, al
jne 0x1400030fb
xorps xmm0, xmm0
movups xmmword [rbp + 0xc0], xmm0
mov rcx, qword [rsi + 0x30]
mov qword [rbp + 0xc0], rcx
mov eax, dword [rcx + 0x3c]
mov edx, dword [rax + rcx + 0x88]
test rcx, rcx
jne 0x140002f2e
xor eax, eax
jmp 0x140002f32
lea rax, [rcx + rdx]
mov qword [rbp + 0xc8], rax
xor eax, eax
movups xmmword [rbp + 0x108], xmm0
movups xmmword [rbp + 0x118], xmm0
mov qword [rbp + 0x128], rax
mov byte [rsp + 0x20], al
mov r9, rdi
lea r8, [rbp + 0xc0]
lea rdx, [rbp + 0x108]
call fcn.140005110
mov rax, qword [rbp + 0xc8]
mov r8d, dword [rax + 0x18]
lea r11, [rbp + 0xc0]
mov qword [rbp - 0x40], r11
mov qword [rbp - 0x38], r8
xor r10d, r10d
mov qword [rbp - 0x30], r10
mov qword [rbp - 0x28], r10
mov qword [rbp - 0x20], r10
mov r9, qword [r11 + 8]
mov eax, dword [r9 + 0x18]
cmp r8, rax
jae 0x140002ffe
mov rdx, qword [r11]
test rdx, rdx
jne 0x140002fad
mov ecx, r10d
jmp 0x140002fbb
mov eax, dword [r9 + 0x20]
add rax, rdx
mov ecx, dword [rax + r8*4]
add rcx, rdx
mov qword [rbp], rcx
mov rax, r15
inc rax
cmp byte [rcx + rax], r10b
jne 0x140002fc2
mov qword [rbp + 8], rax
mov ecx, dword [r9 + 0x1c]
add rcx, rdx
mov eax, dword [r9 + 0x24]
add rax, rdx
movzx eax, word [rax + r8*2]
mov r9d, dword [rcx + rax*4]
test rdx, rdx
mov rax, r10
je 0x140002ff2
lea rax, [rdx + r9]
movups xmm0, xmmword [rbp]
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rax
cmp qword [rbp + 0x110], r8
jne 0x140003014
cmp qword [rbp + 0x108], r11
je 0x1400030fe
mov rax, qword [rbp + 0xc0]
mov ecx, dword [rax + 0x3c]
mov rdx, qword [rcx + rax + 0x88]
mov ecx, edx
add rcx, rax
shr rdx, 0x20
add rdx, rcx
xor r12d, r12d
mov r8d, r12d
test rcx, rcx
cmovne r8, rdx
lea edx, [r12 + 1]
mov r9d, 0xff
mov r14, qword [rbp + 0x128]
cmp r14, rcx
je 0x140003064
mov eax, edx
cmovb eax, r9d
test al, al
js 0x14000328b
cmp r14, r8
je 0x14000328b
cmovb edx, r9d
test dl, dl
jns 0x14000328b
mov qword [rbp + 0x10], r14
mov rbx, r15
inc rbx
cmp byte [r14 + rbx], r10b
jne 0x140003080
mov qword [rbp + 0x18], rbx
test rbx, rbx
je 0x14000319e
mov r8, rbx
mov edx, 0x2e
mov rcx, r14
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x14000319e
sub rax, r14
cmp rax, 0xffffffffffffffff
je 0x14000319e
mov rcx, rax
cmp rbx, rax
cmovb rcx, rbx
mov qword [rbp + 0xf8], r14
mov qword [rbp + 0x100], rcx
inc rax
cmp rbx, rax
jb 0x140003a51
sub rbx, rax
cmp rbx, 0xffffffffffffffff
cmovb r15, rbx
movups xmm0, xmmword [rbp + 0xf8]
lea rsi, [r14 + rax]
jmp 0x1400031ab
xor r10d, r10d
mov r14, qword [r14]
mov rsi, r14
mov qword [rbp + 0xe0], r14
mov qword [rbp + 0xe8], r14
cmp r14, r12
jne 0x140002ea1
xor r12d, r12d
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], r12
movaps xmm6, xmmword [rbp + 0xd0]
movaps xmmword [rbp - 0x50], xmm6
movups xmmword [rbp - 0x78], xmm6
mov qword [rbp + 0xf0], rdi
movdqa xmmword [rbp + 0x90], xmm6
lea rbx, [0x1400097c0]
mov qword [rbp + 0x60], rbx
mov rcx, rbx
call sub.KERNEL32.dll_AcquireSRWLockExclusive
nop
lea r9, [rbp + 0x90]
lea r8, [rbp + 0xf0]
lea rdx, [rbp + 0xb0]
lea rcx, [0x1400097c8]
call fcn.140005370
nop
mov rcx, rbx
call sub.KERNEL32.dll_ReleaseSRWLockExclusive
movq rax, xmm6
test rax, rax
jne 0x14000329e
mov rax, r12
jmp 0x1400032a8
movups xmm0, xmmword [rbp + 0x10]
mov rsi, r12
mov r15, r12
mov rcx, rbx
movups xmmword [rbp + 0x150], xmm0
mov r11d, r12d
mov r10d, 0x5a7f5a6c
mov r9d, r10d
movabs rbx, 0x100000001b3
test rcx, rcx
je 0x140003237
movq rbx, xmm0
mov r14, qword [rbp + 0x158]
movabs rdi, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
movzx r8d, byte [rbx]
lea edx, [r8 - 0x41]
lea eax, [r8 + 0x20]
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movsx rax, cl
xor rax, r9
imul rax, rdi
add r9, rax
inc r11d
lea rbx, [rbx + 1]
movsxd rax, r11d
cmp rax, r14
jb 0x1400031f0
movabs rdi, 0x3f3be160fbd3b149
movabs rbx, 0x100000001b3
mov r11d, r12d
test r15, r15
je 0x140003273
nop
movzx r8d, byte [rsi]
lea edx, [r8 - 0x41]
lea eax, [r8 + 0x20]
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movsx rax, cl
xor rax, r10
imul rax, rbx
add r10, rax
inc r11d
lea rsi, [rsi + 1]
movsxd rax, r11d
cmp rax, r15
jb 0x140003240
mov r8, r10
lea rdx, [rbp + 0xd0]
lea rcx, [rbp - 0x50]
call fcn.140001340
jmp 0x14000312c
mov qword [rbp + 0xd0], r14
mov qword [rbp + 0xd8], rsi
jmp 0x14000312c
lea rcx, [0x140009788]
call rax
nop
mov qword [rbp - 0x80], rax
mov qword [r13], rax
test rax, rax
jne 0x14000399e
mov dword [rsp + 0x39], r12d
mov byte [rsp + 0x3d], al
mov word [rbp + 0x175], 0x72
mov dword [rbp + 0x170], 0x7206ae72
mov byte [rbp + 0x174], 0xff
mov rdx, r12
nop
movzx ecx, byte [rbp + rdx + 0x170]
movzx eax, byte [rbp + rdx + 0x171]
mov byte [rbp + rdx + 0x170], al
mov byte [rbp + rdx + 0x171], cl
add rdx, 2
cmp rdx, 6
jb 0x1400032e0
movzx eax, byte [rbp + 0x170]
not al
movzx r9d, al
and r9b, 0xd5
add r9b, r9b
shr al, 1
and al, 0x55
or r9b, al
xor r10b, r10b
mov r8d, r12d
mov edx, 7
nop
movzx eax, r9b
movzx ecx, r8b
shr al, cl
and al, 1
mov ecx, edx
shl al, cl
or r10b, al
inc r8d
dec edx
cmp edx, 0xffffffff
jg 0x140003330
mov byte [rsp + 0x38], r10b
movzx eax, byte [rbp + 0x171]
not al
movzx r9d, al
and r9b, 0xd5
add r9b, r9b
shr al, 1
and al, 0x55
or r9b, al
xor r10b, r10b
mov r8d, r12d
mov edx, 7
nop dword [rax + rax]
movzx eax, r9b
movzx ecx, r8b
shr al, cl
and al, 1
mov ecx, edx
shl al, cl
or r10b, al
inc r8d
dec edx
cmp edx, 0xffffffff
jg 0x140003380
mov byte [rsp + 0x39], r10b
movzx eax, byte [rbp + 0x172]
not al
movzx r9d, al
and r9b, 0xd5
add r9b, r9b
shr al, 1
and al, 0x55
or r9b, al
xor r10b, r10b
mov r8d, r12d
mov edx, 7
nop dword [rax + rax]
movzx eax, r9b
movzx ecx, r8b
shr al, cl
and al, 1
mov ecx, edx
shl al, cl
or r10b, al
inc r8d
dec edx
cmp edx, 0xffffffff
jg 0x1400033d0
mov byte [rsp + 0x3a], r10b
movzx eax, byte [rbp + 0x173]
not al
movzx r9d, al
and r9b, 0xd5
add r9b, r9b
shr al, 1
and al, 0x55
or r9b, al
xor r10b, r10b
mov r8d, r12d
mov edx, 7
nop dword [rax + rax]
movzx eax, r9b
movzx ecx, r8b
shr al, cl
and al, 1
mov ecx, edx
shl al, cl
or r10b, al
inc r8d
dec edx
cmp edx, 0xffffffff
jg 0x140003420
mov byte [rsp + 0x3b], r10b
movzx eax, byte [rbp + 0x174]
not al
movzx r9d, al
and r9b, 0xd5
add r9b, r9b
shr al, 1
and al, 0x55
or r9b, al
xor r10b, r10b
mov r8d, r12d
mov edx, 7
nop dword [rax + rax]
movzx eax, r9b
movzx ecx, r8b
shr al, cl
and al, 1
mov ecx, edx
shl al, cl
or r10b, al
inc r8d
dec edx
cmp edx, 0xffffffff
jg 0x140003470
mov byte [rsp + 0x3c], r10b
movzx eax, byte [rbp + 0x175]
not al
movzx r9d, al
and r9b, 0xd5
add r9b, r9b
shr al, 1
and al, 0x55
or r9b, al
xor r10b, r10b
mov r8d, r12d
mov edx, 7
nop dword [rax + rax]
movzx eax, r9b
movzx ecx, r8b
shr al, cl
and al, 1
mov ecx, edx
shl al, cl
or r10b, al
inc r8d
dec edx
cmp edx, 0xffffffff
jg 0x1400034c0
mov byte [rsp + 0x3d], r10b
mov byte [rsp + 0x3e], 0
movdqa xmm1, xmmword [0x140007410]
movdqu xmmword [rsp + 0x40], xmm1
mov dword [rsp + 0x50], 0x96a63ec6
mov dword [rsp + 0x54], 0x47e646e2
mov word [rsp + 0x58], 0xc6c6
mov byte [rsp + 0x5a], 0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x78], eax
mov word [rbp + 0x192], ax
movups xmmword [rbp + 0x178], xmm1
movsd xmm0, qword [rsp + 0x50]
movsd qword [rbp + 0x188], xmm0
movzx eax, word [rsp + 0x58]
mov word [rbp + 0x190], ax
mov rdx, r12
nop
movzx ecx, byte [rbp + rdx + 0x178]
movzx eax, byte [rbp + rdx + 0x179]
mov byte [rbp + rdx + 0x178], al
mov byte [rbp + rdx + 0x179], cl
add rdx, 2
cmp rdx, 0x1b
jb 0x140003550
mov r8, r12
nop dword [rax + rax]
movzx eax, byte [rbp + r8 + 0x178]
not al
movzx r10d, al
and r10b, 0xd5
add r10b, r10b
shr al, 1
and al, 0x55
or r10b, al
xor r11b, r11b
mov r9d, r12d
mov edx, 7
nop dword [rax + rax]
movzx eax, r10b
movzx ecx, r9b
shr al, cl
and al, 1
mov ecx, edx
shl al, cl
or r11b, al
inc r9d
dec edx
cmp edx, 0xffffffff
jg 0x1400035b0
mov byte [rsp + r8 + 0x60], r11b
movzx eax, byte [rbp + r8 + 0x179]
not al
movzx r11d, al
and r11b, 0xd5
add r11b, r11b
shr al, 1
and al, 0x55
or r11b, al
xor r10b, r10b
mov r9d, r12d
mov edx, 7
nop word [rax + rax]
movzx eax, r11b
movzx ecx, r9b
shr al, cl
and al, 1
mov ecx, edx
shl al, cl
or r10b, al
inc r9d
dec edx
cmp edx, 0xffffffff
jg 0x140003600
mov byte [rsp + r8 + 0x61], r10b
movzx eax, byte [rbp + r8 + 0x17a]
not al
movzx r11d, al
and r11b, 0xd5
add r11b, r11b
shr al, 1
and al, 0x55
or r11b, al
xor r10b, r10b
mov r9d, r12d
mov edx, 7
nop word [rax + rax]
movzx eax, r11b
movzx ecx, r9b
shr al, cl
and al, 1
mov ecx, edx
shl al, cl
or r10b, al
inc r9d
dec edx
cmp edx, 0xffffffff
jg 0x140003650
mov byte [rsp + r8 + 0x62], r10b
movzx eax, byte [rbp + r8 + 0x17b]
not al
movzx r11d, al
and r11b, 0xd5
add r11b, r11b
shr al, 1
and al, 0x55
or r11b, al
xor r10b, r10b
mov r9d, r12d
mov edx, 7
nop word [rax + rax]
movzx eax, r11b
movzx ecx, r9b
shr al, cl
and al, 1
mov ecx, edx
shl al, cl
or r10b, al
inc r9d
dec edx
cmp edx, 0xffffffff
jg 0x1400036a0
mov byte [rsp + r8 + 0x63], r10b
movzx eax, byte [rbp + r8 + 0x17c]
not al
movzx r11d, al
and r11b, 0xd5
add r11b, r11b
shr al, 1
and al, 0x55
or r11b, al
xor r10b, r10b
mov r9d, r12d
mov edx, 7
nop word [rax + rax]
movzx eax, r11b
movzx ecx, r9b
shr al, cl
and al, 1
mov ecx, edx
shl al, cl
or r10b, al
inc r9d
dec edx
cmp edx, 0xffffffff
jg 0x1400036f0
mov byte [rsp + r8 + 0x64], r10b
movzx eax, byte [rbp + r8 + 0x17d]
not al
movzx r11d, al
and r11b, 0xd5
add r11b, r11b
shr al, 1
and al, 0x55
or r11b, al
xor r10b, r10b
mov r9d, r12d
mov edx, 7
nop word [rax + rax]
movzx eax, r11b
movzx ecx, r9b
shr al, cl
and al, 1
mov ecx, edx
shl al, cl
or r10b, al
inc r9d
dec edx
cmp edx, 0xffffffff
jg 0x140003740
mov byte [rsp + r8 + 0x65], r10b
movzx eax, byte [rbp + r8 + 0x17e]
not al
movzx r11d, al
and r11b, 0xd5
add r11b, r11b
shr al, 1
and al, 0x55
or r11b, al
xor r10b, r10b
mov r9d, r12d
mov edx, 7
nop word [rax + rax]
movzx eax, r11b
movzx ecx, r9b
shr al, cl
and al, 1
mov ecx, edx
shl al, cl
or r10b, al
inc r9d
dec edx
cmp edx, 0xffffffff
jg 0x140003790
mov byte [rsp + r8 + 0x66], r10b
movzx eax, byte [rbp + r8 + 0x17f]
not al
movzx r11d, al
and r11b, 0xd5
add r11b, r11b
shr al, 1
and al, 0x55
or r11b, al
xor r10b, r10b
mov r9d, r12d
mov edx, 7
nop word [rax + rax]
movzx eax, r11b
movzx ecx, r9b
shr al, cl
and al, 1
mov ecx, edx
shl al, cl
or r10b, al
inc r9d
dec edx
cmp edx, 0xffffffff
jg 0x1400037e0
mov byte [rsp + r8 + 0x67], r10b
movzx eax, byte [rbp + r8 + 0x180]
not al
movzx r11d, al
and r11b, 0xd5
add r11b, r11b
shr al, 1
and al, 0x55
or r11b, al
xor r10b, r10b
mov r9d, r12d
mov edx, 7
nop word [rax + rax]
movzx eax, r11b
movzx ecx, r9b
shr al, cl
and al, 1
mov ecx, edx
shl al, cl
or r10b, al
inc r9d
dec edx
cmp edx, 0xffffffff
jg 0x140003830
mov byte [rsp + r8 + 0x68], r10b
add r8, 9
cmp r8, 0x1b
jb 0x140003580
mov byte [rsp + 0x7b], 0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400038f6
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400038f6
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov ecx, dword [rcx + rdi]
add rcx, r10
mov r8d, 0xba2de5c5
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1400038f1
nop dword [rax]
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x1400038d0
cmp r8d, 0x6fc91e4
je 0x1400038fb
test r9d, r9d
jne 0x1400038b0
mov rax, qword [rax]
jmp 0x140003880
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov r9d, 0x10
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x60]
xor ecx, ecx
call rax
mov byte [rbp + 0x20], 0xa6
xorps xmm0, xmm0
movups xmmword [rbp + 0x21], xmm0
mov qword [rsp + 0x30], r12
mov rax, qword [rsp + 0x30]
cmp rax, 0x11
jae 0x140003998
movabs r9, 0xc8303644846c9f65
nop dword [rax + rax]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x30]
movzx edx, byte [rbp + rax + 0x20]
add rcx, r9
mov rax, rcx
and rax, rdx
imul r8, rax, 0xfffffffffffffffe
add r8, rcx
add r8, rdx
add r8b, 0x3d
mov rax, qword [rsp + 0x30]
mov byte [rbp + rax + 0x20], r8b
mov rax, qword [rsp + 0x30]
inc rax
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp rax, 0x11
jb 0x140003950
movzx eax, byte [rbp + 0x20]
jmp 0x140003a1c
mov byte [rbp + 0x40], 0x4d
xorps xmm0, xmm0
movups xmmword [rbp + 0x41], xmm0
mov qword [rsp + 0x30], r12
mov rax, qword [rsp + 0x30]
cmp rax, 0x11
jae 0x140003a18
movabs r9, 0xb0ddab2268d6d6ca
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x30]
movzx edx, byte [rbp + rax + 0x40]
add rcx, r9
mov rax, rcx
and rax, rdx
imul r8, rax, 0xfffffffffffffffe
add r8, rcx
add r8, rdx
add r8b, 0x7a
mov rax, qword [rsp + 0x30]
mov byte [rbp + rax + 0x40], r8b
mov rax, qword [rsp + 0x30]
inc rax
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp rax, 0x11
jb 0x1400039d0
movzx eax, byte [rbp + 0x40]
mov rcx, qword [rbp + 0x198]
xor rcx, rsp
call fcn.140005a00
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140004fb0
nop
int3