Function at 0x1401d8990
Capabilities:
Access peb ldr_data
Check if file exists
Contain obfuscated stackstrings
Encode data using xor
Get file attributes
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
lea rbp, [rsp - 0x480]
sub rsp, 0x580
mov rsi, r9
mov ebx, r8d
mov r13, rdx
mov rdi, rcx
test r8d, r8d
je 0x1401d90a7
lea rcx, [0x140548e80]
call fcn.1403c9d90
test eax, eax
jne 0x1401d90b7
mov qword [rsp + 0x5b0], r12
lea rcx, [rdi + 0x20]
mov qword [rsp + 0x5b8], r14
mov byte [rdi + 8], 1
call qword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1401d89fa
mov rcx, rdi
call fcn.1401d9bb0
mov rcx, rdi
call fcn.1401d9d70
test al, al
je 0x1401d8a0e
mov rcx, rdi
call fcn.1401d93d0
mov rax, qword [rsi]
lea rcx, [rbp + 0x80]
xor edx, edx
mov r8d, 0xff
mov r12, qword [rax + 0x10]
call fcn.1403ccc50
lea rax, [rbp + 0x4c0]
mov ecx, ebx
mov qword [rbp + 0x70], rax
xor eax, eax
mov qword [rbp + 0x4c0], rax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
xor r14d, r14d
mov dword [rsp + 0x40], 0x6f66756e
mov ecx, r14d
mov dword [rsp + 0x44], 0x6b622b68
mov esi, eax
mov word [rsp + 0x48], 0x64
nop dword [rax]
nop dword [rax + rax]
movsxd rax, ecx
xor byte [rsp + rax + 0x40], cl
inc ecx
cmp ecx, 9
jb 0x1401d8a70
lea rcx, [rsp + 0x40]
mov byte [rsp + 0x49], r14b
call fcn.1401a76e0
lea rcx, [rbp + 0x70]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov r9d, 0x409
mov qword [rsp + 0x20], rcx
mov r8d, esi
mov ecx, 0x1900
mov rdx, rax
call qword [sym.imp.kernel32.dll_FormatMessageA]
call fcn.140141104
mov ecx, r14d
mov dword [rbp + 0x4c0], 0x80c2e
nop dword [rax]
movsxd rax, ecx
xor byte [rbp + rax + 0x4c0], cl
inc ecx
cmp ecx, 3
jb 0x1401d8ad0
mov rdx, qword [rbp + 0x70]
lea r8, [rbp + 0x4c0]
mov byte [rbp + 0x4c3], r14b
call fcn.1401a4c10
lea r8, [rbp + 0x80]
mov rdx, r12
call fcn.1401d9290
xor edx, edx
lea rcx, [rbp + 0x180]
mov r8d, 0xff
call fcn.1403ccc50
lea rdx, [rbp + 0x180]
mov rcx, r12
call fcn.1401d87d0
movdqa xmm0, xmmword [0x1404cf150]
xor eax, eax
movdqa xmm1, xmmword [0x1404cffe0]
mov ecx, r14d
movdqu xmmword [rsp + 0x65], xmm0
mov byte [rbp - 0x73], al
movdqu xmmword [rsp + 0x75], xmm1
mov dword [rbp - 0x7b], 0x5b120900
mov dword [rbp - 0x77], 0x90f7d01
nop dword [rax]
movsxd rax, ecx
xor byte [rsp + rax + 0x65], cl
inc ecx
cmp ecx, 0x28
jb 0x1401d8b60
mov rax, qword [rbp + 0x70]
lea r9, [rbp + 0x180]
mov dword [rsp + 0x38], ebx
lea rdx, [rsp + 0x65]
mov qword [rsp + 0x30], rax
mov r8, r13
lea rax, [rbp + 0x80]
mov byte [rbp - 0x73], r14b
mov qword [rsp + 0x28], rax
mov rcx, rdi
mov qword [rsp + 0x20], r12
call fcn.1401d90c0
movdqa xmm0, xmmword [0x1404cf760]
xor eax, eax
movdqu xmmword [rsp + 0x65], xmm0
mov byte [rsp + 0x7d], al
mov ecx, r14d
mov dword [rsp + 0x75], 0x47797271
mov dword [rsp + 0x79], 0x72757466
nop
movsxd rax, ecx
xor byte [rsp + rax + 0x65], cl
inc ecx
cmp ecx, 0x18
jb 0x1401d8bd0
xor eax, eax
mov byte [rsp + 0x7d], r14b
mov byte [rsp + 0x4c], al
mov ecx, r14d
mov dword [rsp + 0x40], 0x6d70646b
mov dword [rsp + 0x44], 0x35356961
mov dword [rsp + 0x48], 0x67666d26
nop dword [rax]
nop dword [rax + rax]
movsxd rax, ecx
xor byte [rsp + rax + 0x40], cl
inc ecx
cmp ecx, 0xc
jb 0x1401d8c10
lea rdx, [rsp + 0x65]
mov byte [rsp + 0x4c], r14b
lea rcx, [rsp + 0x40]
call fcn.1401a7810
mov rbx, rax
test rax, rax
jne 0x1401d8c5b
lea eax, [rbx + 1]
mov r12, qword [rsp + 0x5b0]
mov r14, qword [rsp + 0x5b8]
add rsp, 0x580
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret
lea rdx, [rbp + 0x4c0]
mov qword [rsp + 0x5c8], r15
mov rcx, rdi
mov byte [rbp + 0x4c0], r14b
call fcn.1401d90c0
movdqa xmm0, xmmword [0x1404cfb90]
mov ecx, r14d
movdqu xmmword [rsp + 0x4e], xmm0
mov word [rsp + 0x5e], 0x2a
movsxd rax, ecx
xor byte [rsp + rax + 0x4e], cl
inc ecx
cmp ecx, 0x11
jb 0x1401d8c91
lea rdx, [rsp + 0x4e]
mov byte [rsp + 0x5f], r14b
mov rcx, rdi
call fcn.1401d90c0
mov esi, 0x40
lea r8, [rbp + 0x280]
mov edx, esi
xor r9d, r9d
xor ecx, ecx
call rbx
movabs rcx, 0xefffffffeffff
lea rbx, [rbp + 0x280]
mov r15d, esi
nop word [rax + rax]
test r14b, r14b
jne 0x1401d8cf1
cmp qword [rbx], r12
jne 0x1401d8db0
mov r14b, 1
mov rsi, qword [rbx]
lea rax, [rsi - 0x10000]
cmp rax, rcx
ja 0x1401d8db0
xor edx, edx
lea rcx, [rbp + 0x80]
mov r8d, 0xff
call fcn.1403ccc50
lea r8, [rbp + 0x80]
mov rdx, rsi
call fcn.1401d9290
xor edx, edx
lea rcx, [rbp + 0x180]
mov r8d, 0xff
call fcn.1403ccc50
mov rcx, qword [rbx]
lea rdx, [rbp + 0x180]
call fcn.1401d87d0
xor ecx, ecx
mov dword [rsp + 0x40], 0x33237225
mov dword [rsp + 0x44], 0x5f4f207c
mov dword [rsp + 0x48], 0x782f2128
mov word [rsp + 0x4c], 0x25
nop dword [rax + rax]
movsxd rax, ecx
xor byte [rsp + rax + 0x40], cl
inc ecx
cmp ecx, 0xd
jb 0x1401d8d70
mov r9, qword [rbx]
lea rax, [rbp + 0x80]
lea r8, [rbp + 0x180]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x40]
mov byte [rsp + 0x4d], 0
mov rcx, rdi
call fcn.1401d90c0
movabs rcx, 0xefffffffeffff
add rbx, 8
sub r15, 1
jne 0x1401d8ce0
movdqa xmm0, xmmword [0x1404cfa50]
xor eax, eax
movdqu xmmword [rsp + 0x4e], xmm0
mov byte [rsp + 0x64], al
xor ecx, ecx
mov dword [rsp + 0x5e], 0x61777d74
mov word [rsp + 0x62], 0x1f3a
nop dword [rax]
nop word [rax + rax]
movsxd rax, ecx
xor byte [rsp + rax + 0x4e], cl
inc ecx
cmp ecx, 0x16
jb 0x1401d8df0
mov r8, r13
mov byte [rsp + 0x64], 0
lea rdx, [rsp + 0x4e]
mov rcx, rdi
call fcn.1401d90c0
mov rcx, rdi
call fcn.1401d9d70
test al, al
jne 0x1401d8e27
mov rcx, rdi
call fcn.1401d96e0
lea rcx, [0x140548e80]
call fcn.1403c9d98
mov r15, qword [rsp + 0x5c8]
xor edx, edx
mov ecx, edx
mov dword [rbp - 0x72], 0x600052
mov dword [rbp - 0x6e], 0x70006b
mov esi, 1
mov dword [rbp - 0x6a], 0x610061
mov dword [rbp - 0x66], 0x620026
mov dword [rbp - 0x62], 0x6a0070
mov dword [rbp - 0x5e], 0x7b006f
mov dword [rbp - 0x5a], 0x640078
mov dword [rbp - 0x56], 0x610061
mov dword [rbp - 0x52], 0x650030
mov dword [rbp - 0x4e], 0x72007a
mov dword [rbp - 0x4a], 0x350060
mov dword [rbp - 0x46], 0x650075
mov dword [rbp - 0x42], 0x6a0079
mov dword [rbp - 0x3e], 0x7e0072
mov dword [rbp - 0x3a], 0x3d0078
mov dword [rbp - 0x36], 0x6d006e
mov dword [rbp - 0x32], 0x46004f
mov dword [rbp - 0x2e], 0x420050
mov dword [rbp - 0x2a], 0xb0049
mov dword [rbp - 0x26], 0x610006
mov dword [rbp - 0x22], 0x470041
mov dword [rbp - 0x1e], 0xb004e
mov dword [rbp - 0x1a], 0x450058
mov dword [rbp - 0x16], 0xf004b
mov dword [rbp - 0x12], 0x580056
mov dword [rbp - 0xe], 0x56005e
mov dword [rbp - 0xa], 0x540014
mov dword [rbp - 6], 0x170042
mov dword [rbp - 2], 0x3007b
mov dword [rbp + 2], 0x680066
mov dword [rbp + 6], 0x710054
mov dword [rbp + 0xa], 0x4d005a
mov dword [rbp + 0xe], 0x330003
mov dword [rbp + 0x12], 0x300023
mov dword [rbp + 0x16], 0x17002c
mov dword [rbp + 0x1a], 0x330036
mov dword [rbp + 0x1e], 0x3d0066
mov dword [rbp + 0x22], 0x3f0032
mov dword [rbp + 0x26], 0x3e006c
mov dword [rbp + 0x2a], 0x21002b
mov dword [rbp + 0x2e], 0x710034
mov dword [rbp + 0x32], 0x3c0026
mov dword [rbp + 0x36], 0x260074
mov dword [rbp + 0x3a], 0x270023
mov dword [rbp + 0x3e], 0x360028
mov dword [rbp + 0x42], 0x2f0028
mov dword [rbp + 0x46], 0x3c007c
mov dword [rbp + 0x4a], 0x3b0030
mov dword [rbp + 0x4e], 0x50040
mov dword [rbp + 0x52], 0xf0007
mov dword [rbp + 0x56], 0x110001
mov dword [rbp + 0x5a], 0x470003
mov dword [rbp + 0x5e], 0x1001c
mov dword [rbp + 0x62], 0x6000f
mov dword [rbp + 0x66], 0x42
nop word [rax + rax]
movsxd rax, ecx
xor word [rbp + rax*2 - 0x72], cx
inc ecx
cmp ecx, 0x6d
jb 0x1401d8fd0
mov word [rbp + 0x68], dx
xor ecx, ecx
lea rdx, [rbp - 0x72]
call fcn.1401a8450
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1401d9077
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1401d9077
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x1f40597b
lea rcx, [r10 + r9*4]
mov ecx, dword [rcx + rbx]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1401d9072
nop dword [rax]
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x1401d9050
cmp r8d, 0x1d0ea8de
je 0x1401d907c
test r9d, r9d
jne 0x1401d9030
mov rax, qword [rax]
jmp 0x1401d9000
mov edx, dword [rdi + 0x24]
mov ecx, 0x64
add rdx, r10
movzx r8d, word [rdx + r9*2]
mov edx, dword [rdi + 0x1c]
add rdx, r10
mov eax, dword [rdx + r8*4]
add rax, r10
call rax
call fcn.1401a9e40
mov eax, esi
jmp 0x1401d8c3d
xor eax, eax
add rsp, 0x580
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, eax
call fcn.1403c9a0c
int3