Function at 0x14003d2b0
Capabilities:
Access peb ldr_data
Encode data using xor
Execute command
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.14003c2b0
test eax, eax
je 0x14003d507
movabs rax, 0x665378897d42e51f
movabs rcx, 0xf373dbce0ecf1aa6
mov qword [rbp - 0x39], rcx
movabs r8, 0xc68753c3f95bc125
mov qword [rbp - 0x31], rax
movabs rdx, 0x848c23cc5752e3d0
mov qword [rbp - 0x29], rdx
movabs rdx, 0x37b2a80f7488f621
mov qword [rbp - 0x21], rdx
movabs rdx, 0x39e6a7a2400a08ca
movdqa xmm1, xmmword [rbp - 0x29]
mov qword [rbp - 0x19], rdx
movabs rdx, 0xcc76641de4157ee3
mov qword [rbp - 0x11], rdx
movabs rdx, 0x55c1cf80514e8154
mov qword [rbp - 9], rdx
movabs rdx, 0x801afba67ebd75eb
mov qword [rbp + 0x17], rdx
movabs rdx, 0x123d1dfb0f37863f
mov qword [rbp + 0x1f], rdx
movabs rdx, 0xaae254a333729abc
movdqa xmm0, xmmword [rbp + 0x17]
xorps xmm0, xmmword [rbp - 0x39]
mov qword [rbp + 0x27], rdx
movabs rdx, 0x58d4887b1de9a101
mov qword [rbp + 0x2f], rdx
movabs rdx, 0x5c8887c7287e28b8
xorps xmm1, xmmword [rbp + 0x27]
mov qword [rbp + 0x37], rdx
movabs rdx, 0xb817006db1350a9b
mov qword [rbp + 0x3f], rdx
movabs rdx, 0x55c1cf8a7f60af31
movdqa xmmword [rbp + 0x17], xmm0
movdqa xmm0, xmmword [rbp - 0x19]
xorps xmm0, xmmword [rbp + 0x37]
mov qword [rbp + 0x47], rdx
lea rdx, [rbp - 0x49]
mov qword [rbp + 0x4f], r8
mov qword [rbp - 1], r8
lea r8, [rbp + 0x17]
movdqa xmmword [rbp + 0x27], xmm1
movdqa xmm1, xmmword [rbp - 9]
xorps xmm1, xmmword [rbp + 0x47]
movdqa xmmword [rbp + 0x37], xmm0
movdqa xmmword [rbp + 0x47], xmm1
mov qword [rbp + 7], rcx
movabs rcx, 0xf373dbce0ecf1a87
mov qword [rbp - 0x49], rcx
mov ecx, 0xc
mov qword [rbp - 0x41], rax
mov qword [rbp + 0xf], rax
movdqa xmm0, xmmword [rbp + 7]
xorps xmm0, xmmword [rbp - 0x49]
movdqa xmmword [rbp - 0x49], xmm0
call fcn.14003b940
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov r14d, dword [rcx + rbx + 0x88]
add r14, rbx
cmp r14, rbx
je 0x14003d4da
mov r11d, dword [r14 + 0x18]
test r11d, r11d
je 0x14003d4da
mov esi, dword [r14 + 0x20]
nop word [rax + rax]
dec r11d
mov r10d, 0x811c9dc5
lea rcx, [rbx + r11*4]
mov r9d, dword [rcx + rsi]
add r9, rbx
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x14003d4d5
movsx ecx, r8b
lea r9, [r9 + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [r9 - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x14003d4a0
cmp r10d, 0x89eabb08
je 0x14003d4e2
test r11d, r11d
jne 0x14003d480
mov rax, qword [rax]
jmp 0x14003d450
mov ecx, dword [r14 + 0x24]
add rcx, rbx
movzx edx, word [rcx + r11*2]
mov ecx, dword [r14 + 0x1c]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
mov ecx, 0x5dc
add rax, rbx
call rax
jmp 0x14003da3e
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.14003c7e0
test eax, eax
jne 0x14003da3e
call fcn.14003cfc0
test eax, eax
je 0x14003d6e6
movabs rax, 0x665378897d42e51f
lea r8, [rbp - 0x39]
movabs rcx, 0xf373dbce0ecf1aa6
mov qword [rbp - 0x41], rax
mov qword [rbp + 0x17], rcx
movabs rdx, 0x848c23cc5752e3d0
mov qword [rbp + 0x1f], rax
mov qword [rbp + 0x27], rdx
movabs rdx, 0x37b2a80f7488f621
mov qword [rbp + 0x2f], rdx
movabs rdx, 0x39e6a7a2400a08ca
movdqa xmm1, xmmword [rbp + 0x27]
mov qword [rbp + 0x37], rdx
movabs rdx, 0xcc76641de4157ee3
mov qword [rbp + 0x3f], rdx
movabs rdx, 0xb15ebebc7bac7ff5
mov qword [rbp - 0x39], rdx
movabs rdx, 0x12730be05d368a70
mov qword [rbp - 0x31], rdx
movabs rdx, 0xcac303a8323c91a5
movdqa xmm0, xmmword [rbp - 0x39]
xorps xmm0, xmmword [rbp + 0x17]
mov qword [rbp - 0x29], rdx
movabs rdx, 0x43ddc66115cbd60f
mov qword [rbp - 0x21], rdx
movabs rdx, 0x4c88ced62e656bea
xorps xmm1, xmmword [rbp - 0x29]
mov qword [rbp - 0x19], rdx
movabs rdx, 0xcc76641de41f5086
movdqa xmmword [rbp - 0x39], xmm0
movdqa xmm0, xmmword [rbp + 0x37]
mov qword [rbp - 0x11], rdx
lea rdx, [rbp - 0x49]
xorps xmm0, xmmword [rbp - 0x19]
movdqa xmmword [rbp - 0x19], xmm0
movdqa xmmword [rbp - 0x29], xmm1
mov qword [rbp + 7], rcx
movabs rcx, 0xf373dbce0ecf1a87
mov qword [rbp - 0x49], rcx
mov ecx, 0xc
movdqa xmm0, xmmword [rbp - 0x49]
mov qword [rbp + 0xf], rax
xorps xmm0, xmmword [rbp + 7]
movdqa xmmword [rbp - 0x49], xmm0
call fcn.14003b940
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov r14d, dword [rcx + rbx + 0x88]
add r14, rbx
cmp r14, rbx
je 0x14003d6de
mov r11d, dword [r14 + 0x18]
test r11d, r11d
je 0x14003d6de
mov esi, dword [r14 + 0x20]
nop word [rax + rax]
dec r11d
mov r10d, 0x811c9dc5
lea rcx, [rbx + r11*4]
mov r9d, dword [rcx + rsi]
add r9, rbx
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x14003d6d9
movsx ecx, r8b
lea r9, [r9 + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [r9 - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x14003d6a0
cmp r10d, 0x89eabb08
je 0x14003d4e2
test r11d, r11d
jne 0x14003d680
mov rax, qword [rax]
jmp 0x14003d650
call fcn.14003c5a0
test eax, eax
je 0x14003d8a6
movabs rax, 0x665378897d42e51f
lea r8, [rbp - 0x39]
movabs rcx, 0xf373dbce0ecf1aa6
mov qword [rbp - 0x41], rax
mov qword [rbp + 0x17], rcx
movabs rdx, 0x848c23cc5752e3d0
mov qword [rbp + 0x1f], rax
mov qword [rbp + 0x27], rdx
movabs rdx, 0x37b2a80f7488f621
mov qword [rbp + 0x2f], rdx
movabs rdx, 0x39e6a7a2400a08ca
movdqa xmm1, xmmword [rbp + 0x27]
mov qword [rbp + 0x37], rdx
movabs rdx, 0xcc76641de4157ee3
mov qword [rbp + 0x3f], rdx
movabs rdx, 0xd30abaa27caa6ce9
mov qword [rbp - 0x39], rdx
movabs rdx, 0x23730fe6192c8c48
mov qword [rbp - 0x31], rdx
movabs rdx, 0xebcf03e2253d91a2
movdqa xmm0, xmmword [rbp - 0x39]
xorps xmm0, xmmword [rbp + 0x17]
mov qword [rbp - 0x29], rdx
movabs rdx, 0x42e1887b17e9824f
mov qword [rbp - 0x21], rdx
movabs rdx, 0x17c889d6326578ba
xorps xmm1, xmmword [rbp - 0x29]
mov qword [rbp - 0x19], rdx
movabs rdx, 0xcc76641de4157ee9
movdqa xmmword [rbp - 0x39], xmm0
movdqa xmm0, xmmword [rbp + 0x37]
mov qword [rbp - 0x11], rdx
lea rdx, [rbp - 0x49]
xorps xmm0, xmmword [rbp - 0x19]
movdqa xmmword [rbp - 0x19], xmm0
movdqa xmmword [rbp - 0x29], xmm1
mov qword [rbp + 7], rcx
movabs rcx, 0xf373dbce0ecf1a87
mov qword [rbp - 0x49], rcx
mov ecx, 0xc
movdqa xmm0, xmmword [rbp - 0x49]
mov qword [rbp + 0xf], rax
xorps xmm0, xmmword [rbp + 7]
movdqa xmmword [rbp - 0x49], xmm0
call fcn.14003b940
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov r14d, dword [rcx + rbx + 0x88]
add r14, rbx
cmp r14, rbx
je 0x14003d89e
mov r11d, dword [r14 + 0x18]
test r11d, r11d
je 0x14003d89e
mov esi, dword [r14 + 0x20]
nop word [rax + rax]
dec r11d
mov r10d, 0x811c9dc5
lea rcx, [rsi + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x14003d899
movsx ecx, r8b
lea r9, [r9 + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [r9 - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x14003d860
cmp r10d, 0x89eabb08
je 0x14003d4e2
test r11d, r11d
jne 0x14003d840
mov rax, qword [rax]
jmp 0x14003d810
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov r14d, dword [rcx + rbx + 0x88]
add r14, rbx
cmp r14, rbx
je 0x14003d94a
mov r11d, dword [r14 + 0x18]
test r11d, r11d
je 0x14003d94a
mov esi, dword [r14 + 0x20]
nop word [rax + rax]
dec r11d
mov r10d, 0x811c9dc5
lea rcx, [rsi + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x14003d945
movsx ecx, r8b
lea r9, [r9 + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [r9 - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x14003d910
cmp r10d, 0x491e0a9c
je 0x14003d952
test r11d, r11d
jne 0x14003d8f0
mov rax, qword [rax]
jmp 0x14003d8c0
mov ecx, dword [r14 + 0x24]
add rcx, rbx
movzx edx, word [rcx + r11*2]
mov ecx, dword [r14 + 0x1c]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
lea rcx, [0x140048948]
add rax, rbx
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov r14d, dword [rcx + rbx + 0x88]
add r14, rbx
cmp r14, rbx
je 0x14003da19
mov r11d, dword [r14 + 0x18]
test r11d, r11d
je 0x14003da19
mov esi, dword [r14 + 0x20]
nop word [rax + rax]
dec r11d
mov r10d, 0x811c9dc5
lea rcx, [rsi + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
movzx ecx, byte [r9]
inc r9
test cl, cl
je 0x14003da14
nop
movsx edx, cl
lea r9, [r9 + 1]
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
movzx ecx, byte [r9 - 1]
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
test cl, cl
jne 0x14003d9e0
cmp r10d, 0x2e672dee
je 0x14003da21
test r11d, r11d
jne 0x14003d9c0
mov rax, qword [rax]
jmp 0x14003d990
mov ecx, dword [r14 + 0x24]
add rcx, rbx
movzx edx, word [rcx + r11*2]
mov ecx, dword [r14 + 0x1c]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, rbx
call rax
lea r11, [rsp + 0xc0]
xor eax, eax
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret