Function at 0x140055010
Capabilities:
Access peb ldr_data
Encode data using xor
Get system information on windows
Hash data using fnv
Make suspicious ntquerysysteminformation call
Resolve function by parsing pe exports

Disassembly:
push rbp
push rbx
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xc0
mov rax, qword [0x1400af040]
xor rax, rsp
mov qword [rbp + 0x2f], rax
xor edx, edx
lea r9, [rbp - 0x19]
mov r15, rcx
xor r12d, r12d
xor r8d, r8d
mov dword [rbp - 0x19], r12d
mov r14d, r12d
lea ecx, [rdx + 0x40]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x1400551f6
nop dword [rax]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400550f5
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400550f5
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r11 + r9*4]
mov r8d, dword [rdx + r10]
mov edx, 0xf30bd72b
add r8, r10
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x1400550f0
nop
movsx ecx, cl
lea r8, [r8 + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8 - 1]
test cl, cl
jne 0x1400550d0
cmp edx, 0x3f139cac
je 0x1400550fa
test r9d, r9d
jne 0x1400550b0
mov rax, qword [rax]
jmp 0x140055080
mov ecx, dword [rbx + 0x24]
mov r8d, 0x8000
mov edx, dword [rbx + 0x1c]
add rcx, r10
add rdx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
xor edx, edx
add rax, r10
mov rcx, r14
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400551a5
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400551a5
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r11 + r9*4]
mov r8d, dword [rdx + r10]
mov edx, 0xfdfcddf2
add r8, r10
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x1400551a0
nop
movsx ecx, cl
lea r8, [r8 + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8 - 1]
test cl, cl
jne 0x140055180
cmp edx, 0xe4cd24ea
je 0x1400551aa
test r9d, r9d
jne 0x140055160
mov rax, qword [rax]
jmp 0x140055130
mov ecx, dword [rbx + 0x24]
mov r8d, 0x3000
mov edx, dword [rbx + 0x1c]
add rcx, r10
add rdx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
xor ecx, ecx
mov edx, dword [rbp - 0x19]
add rax, r10
lea r9d, [rcx + 4]
call rax
mov r8d, dword [rbp - 0x19]
lea r9, [rbp - 0x19]
mov rdx, rax
mov ecx, 0x40
mov r14, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x140055060
mov qword [rsp + 0xf8], rsi
mov qword [rsp + 0x100], rdi
test eax, eax
js 0x14005558f
test r14, r14
je 0x140055651
mov rsi, r12
mov edi, r12d
cmp qword [r14], r12
jbe 0x140055338
mov rax, r12
nop dword [rax]
lea rax, [rax + rax*4]
movups xmm0, xmmword [r14 + rax*8 + 0x10]
movups xmmword [rbp - 0x49], xmm0
movups xmm0, xmmword [r14 + rax*8 + 0x20]
movups xmmword [rbp - 0x39], xmm0
movsd xmm0, qword [r14 + rax*8 + 0x30]
mov rax, qword gs:[0x60]
movsd qword [rbp + 0x27], xmm0
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400552e7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400552e7
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
mov r8d, 0x57f95b16
lea rdx, [r11 + r9*4]
mov ecx, dword [rdx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1400552e2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x1400552c0
cmp r8d, 0x3edd0a35
je 0x1400552ec
test r9d, r9d
jne 0x1400552a0
mov rax, qword [rax]
jmp 0x140055270
mov ecx, dword [rbx + 0x24]
mov edx, dword [rbx + 0x1c]
add rcx, r10
add rdx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
call rax
movups xmm1, xmmword [rbp - 0x49]
mov ecx, eax
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, rcx
jne 0x140055324
cmp qword [rbp - 0x39], r15
je 0x140055333
inc edi
mov eax, edi
cmp rax, qword [r14]
jb 0x140055230
jmp 0x140055338
movq rsi, xmm1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400553c5
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400553c5
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r11 + r9*4]
mov r8d, dword [rdx + r10]
mov edx, 0x179e73d4
add r8, r10
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x1400553c0
nop
movsx ecx, cl
lea r8, [r8 + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8 - 1]
test cl, cl
jne 0x1400553a0
cmp edx, 0xa86d5ab5
je 0x1400553ca
test r9d, r9d
jne 0x140055380
mov rax, qword [rax]
jmp 0x140055350
mov ecx, dword [rbx + 0x24]
mov r8d, 0x8000
mov edx, dword [rbx + 0x1c]
add rcx, r10
add rdx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
xor edx, edx
add rax, r10
mov rcx, r14
call rax
test rsi, rsi
je 0x140055651
lea r8, [rsi + 8]
mov qword [rbp - 9], r12
mov r9d, 8
lea rdx, [rbp - 9]
mov rcx, r15
call fcn.140053d30
test al, al
je 0x140055651
mov r8, qword [rbp - 9]
test r8, r8
je 0x140055651
add r8, 8
mov qword [rbp - 1], r12
mov r9d, 8
lea rdx, [rbp - 1]
mov rcx, r15
call fcn.140053d30
test al, al
je 0x140055651
mov r8, qword [rbp - 1]
test r8, r8
je 0x140055651
add r8, 0x28
mov qword [rbp - 0x11], r12
mov r9d, 8
lea rdx, [rbp - 0x11]
mov rcx, r15
call fcn.140053d30
test al, al
je 0x140055651
mov r8, qword [rbp - 0x11]
test r8, r8
je 0x140055651
xorps xmm0, xmm0
lea rdx, [rbp - 0x29]
add r8, 0x58
mov r9d, select
mov rcx, r15
movups xmmword [rbp - 0x29], xmm0
call fcn.140053d30
test al, al
je 0x140055651
movzx eax, word [rbp - 0x29]
test ax, ax
je 0x140055651
mov ecx, eax
mov eax, 2
shr rcx, 1
inc rcx
mul rcx
mov rbx, rax
mov rax, 0xffffffffffffffff
cmovo rbx, rax
mov rcx, rbx
call fcn.140080614
mov r8, rbx
xor edx, edx
mov rcx, rax
mov rdi, rax
call sub.VCRUNTIME140.dll_memset
movzx r9d, word [rbp - 0x29]
mov rdx, rdi
mov r8, qword [rbp - 0x21]
mov rcx, r15
call fcn.140053d30
test al, al
je 0x14005557d
mov rax, qword [rbp - 0x11]
mov word [rbp - 0x29], r12w
add rax, 0x58
je 0x14005557d
mov qword [rsp + 0x38], r12
lea rcx, [rbp - 0x29]
mov qword [rbp + 0x1f], rax
lea r8, [rbp + 7]
lea rax, [rbp - 0x15]
mov qword [rbp + 0x17], rcx
mov qword [rsp + 0x30], rax
mov r9d, 0x28
mov dword [rsp + 0x28], r12d
mov edx, 0x80862007
mov rcx, r15
mov qword [rsp + 0x20], r12
mov qword [rbp + 0xf], r12
mov qword [rbp + 7], 0x33
mov qword [rbp + 0x27], select
mov dword [rbp - 0x15], r12d
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x14005557d
mov rcx, rdi
mov bl, 1
call fcn.140080290
movzx eax, bl
jmp 0x140055653
xor bl, bl
mov rcx, rdi
call fcn.140080290
movzx eax, bl
jmp 0x140055653
test r14, r14
je 0x140055651
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov r11d, dword [rcx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x140055625
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x140055625
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [rbx + r9*4]
mov r8d, dword [rdx + r10]
mov edx, 0x75392cf2
add r8, r10
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x140055620
nop
movsx ecx, cl
lea r8, [r8 + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8 - 1]
test cl, cl
jne 0x140055600
cmp edx, 0x6de977b7
je 0x14005562a
test r9d, r9d
jne 0x1400555e0
mov rax, qword [rax]
jmp 0x1400555b0
mov ecx, dword [r11 + 0x24]
xor edx, edx
add rcx, r10
movzx r8d, word [rcx + r9*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r10
mov eax, dword [rcx + r8*4]
mov r8d, 0x8000
add rax, r10
mov rcx, r14
call rax
xor al, al
mov rdi, qword [rsp + 0x100]
mov rsi, qword [rsp + 0xf8]
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.14007fe40
add rsp, 0xc0
pop r15
pop r14
pop r12
pop rbx
pop rbp
ret