Function at 0x140011b40
Capabilities:
Access peb ldr_data
Encode data using xor
Get storage device properties
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x188]
sub rsp, 0x260
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
mov rax, qword [0x1401d91a8]
xor rax, rsp
mov qword [rbp + 0x120], rax
mov r15, rdx
mov qword [rbp - 0x60], rdx
xor esi, esi
mov dword [rsp + 0x40], esi
xorps xmm0, xmm0
movups xmmword [rbp + 0xc0], xmm0
movdqa xmm1, xmmword [0x140016cf0]
movdqu xmmword [rbp + 0xd0], xmm1
mov byte [rbp + 0xc0], sil
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp - 0x50]
call fcn.140014cae
movups xmm0, xmmword [0x140016da0]
movups xmmword [rsp + 0x48], xmm0
movzx eax, word [0x140016db0]
mov word [rsp + 0x58], ax
movzx eax, byte [0x140016db2]
mov byte [rsp + 0x5a], al
mov r8d, esi
cmp dword [0x1401d91b0], 2
jl 0x140011d4b
movdqa xmm5, xmmword [0x140016d00]
movdqa xmm4, xmmword [0x140016e00]
mov eax, 5
movd xmm6, eax
movdqa xmm7, xmmword [str.9999]
mov eax, 0x1f
movd xmm8, eax
movdqa xmm0, xmmword [0x140016df0]
movdqa xmmword [rbp + 0x100], xmm0
lea rcx, [rsp + 0x4c]
mov edx, dword [rbp + 0x100]
nop dword [rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140016d30]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [r8 + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140016d30]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x10
jl 0x140011c40
cmp r8d, 0x13
jge 0x140011d93
movsxd rax, r8d
lea r9, [rsp + 0x48]
add r9, rax
nop word [rax + rax]
mov eax, 0x8fb823ef
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x39
movzx eax, r8b
sub al, cl
add al, 0x36
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x13
jl 0x140011d60
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x70], xmm1
lea rax, [rsp + 0x48]
mov r14, 0xffffffffffffffff
mov r8, r14
inc r8
cmp byte [rax + r8], 0
jne 0x140011db1
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x80]
call fcn.140001a90
nop
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 0x10
cmovae rdx, qword [rbp - 0x80]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
mov r8, r14
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140011df0
lea rcx, [rsp + 0x60]
call fcn.140001a90
nop
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rdx, qword [rsp + 0x60]
lea rax, [rbp - 0x48]
mov qword [rbp - 0x50], rax
mov r8d, 3
lea rcx, [rbp - 0x50]
call fcn.140004470
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x140011e6e
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011e69
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140011e69
call qword [0x140016288]
int3
call fcn.140013d34
movdqa xmm0, xmmword [0x140016cf0]
movdqu xmmword [rsp + 0x70], xmm0
mov byte [rsp + 0x60], 0
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x140011ebf
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011eba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140011eba
call qword [0x140016288]
int3
call fcn.140013d34
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov edi, dword [rcx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x140011f46
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140011f46
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r11]
add rdx, r11
mov r8d, 0xfc2bda9f
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140011f41
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140011f20
cmp r8d, 0x603ead6a
je 0x140011f4b
test r9d, r9d
jne 0x140011f00
mov rax, qword [rax]
jmp 0x140011ed0
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 3]
mov rcx, qword [rbp - 0x50]
call r10
mov r13, rax
xorps xmm0, xmm0
cmp rax, 0xffffffffffffffff
jne 0x14001203f
movups xmmword [r15], xmm0
mov qword [r15 + 0x10], rsi
mov qword [r15 + 0x18], 0xf
mov byte [r15], 0
lea rax, [rbp - 0x48]
mov rcx, qword [rbp - 0x50]
cmp rcx, rax
je 0x140011fbc
call qword [0x140016240]
nop
mov rdx, qword [rbp + 0xd8]
cmp rdx, 0x10
jb 0x140011ffd
inc rdx
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011ff8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140012750
call fcn.140013d34
mov rax, r15
mov rcx, qword [rbp + 0x120]
xor rcx, rsp
call fcn.140014020
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
movups xmmword [rbp + 0x100], xmm0
lea rax, [0x1400112e0]
mov qword [rbp + 0x100], rax
mov qword [rbp + 0x108], r13
mov qword [rbp + 0xe8], rsi
mov dword [rbp + 0xe0], esi
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov edi, dword [rcx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x1400120f6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400120f6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r11]
add rdx, r11
mov r8d, 0xd253fb3d
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400120f1
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400120d0
cmp r8d, 0xa1fac04c
je 0x1400120fb
test r9d, r9d
jne 0x1400120b0
mov rax, qword [rax]
jmp 0x140012080
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
mov qword [rsp + 0x38], rsi
lea rax, [rbp + 0xe0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 8
lea rax, [rbp + 0x110]
mov qword [rsp + 0x20], rax
mov r9d, 0xc
lea r8, [rbp + 0xe8]
mov edx, 0x2d1400
mov rcx, r13
call r10
test eax, eax
jne 0x14001222d
xorps xmm0, xmm0
movups xmmword [r15], xmm0
mov qword [r15 + 0x10], rsi
mov qword [r15 + 0x18], 0xf
mov byte [r15], al
mov dword [rsp + 0x40], 1
test r13, r13
je 0x140012228
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140012206
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140012206
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0xc4bc5a05
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140012201
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400121e0
cmp r8d, 0xa0983da5
je 0x14001220b
test r9d, r9d
jne 0x1400121c0
mov rax, qword [rax]
jmp 0x140012190
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov rcx, r13
call rdx
nop
jmp 0x140011fa8
mov r12d, dword [rbp + 0x114]
mov ecx, r12d
call fcn.14001465c
mov rsi, rax
test rax, rax
je 0x140012253
mov r8d, r12d
xor edx, edx
mov rcx, rax
call fcn.140014cae
jmp 0x140012255
xor esi, esi
mov qword [rbp + 0x118], rsi
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov edi, dword [rcx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x1400122e6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400122e6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r11 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r11
mov r8d, 0x4464c108
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400122e1
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400122c0
cmp r8d, 0x96a29e9f
je 0x1400122eb
test r9d, r9d
jne 0x1400122a0
mov rax, qword [rax]
jmp 0x140012270
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
xor ebx, ebx
mov qword [rsp + 0x38], rbx
lea rax, [rbp + 0xe0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rsi
lea r9d, [rbx + 0xc]
lea r8, [rbp + 0xe8]
mov edx, 0x2d1400
mov rcx, r13
call r10
test eax, eax
jne 0x14001242d
xorps xmm0, xmm0
movups xmmword [r15], xmm0
mov qword [r15 + 0x10], rbx
mov qword [r15 + 0x18], 0xf
mov byte [r15], bl
mov dword [rsp + 0x40], 1
test rsi, rsi
je 0x14001236a
mov rcx, rsi
call fcn.140013d34
nop
test r13, r13
je 0x140012428
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140012406
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140012406
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0xc4bc5a05
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140012401
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400123e0
cmp r8d, 0xa0983da5
je 0x14001240b
test r9d, r9d
jne 0x1400123c0
mov rax, qword [rax]
jmp 0x140012390
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov rcx, r13
call rdx
nop
jmp 0x140011fa8
mov eax, dword [rsi + 0x18]
test eax, eax
jne 0x14001251d
xorps xmm0, xmm0
movups xmmword [r15], xmm0
mov qword [r15 + 0x10], rbx
mov qword [r15 + 0x18], 0xf
mov byte [r15], bl
mov dword [rsp + 0x40], 1
mov rcx, rsi
call fcn.140013d34
nop
test r13, r13
je 0x140012518
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400124f6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400124f6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0xc4bc5a05
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400124f1
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400124d0
cmp r8d, 0xa0983da5
je 0x1400124fb
test r9d, r9d
jne 0x1400124b0
mov rax, qword [rax]
jmp 0x140012480
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov rcx, r13
call rdx
nop
jmp 0x140011fa8
lea rdx, [rsi + rax]
inc r14
cmp byte [rdx + r14], bl
jne 0x140012521
mov r8, r14
lea rcx, [rbp + 0xc0]
call fcn.140006b80
lea rbx, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 0x10
cmovae rbx, qword [rbp + 0xc0]
add rbx, qword [rbp + 0xd0]
lea rcx, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 0x10
cmovae rcx, qword [rbp + 0xc0]
mov r8b, 0x20
mov rdx, rbx
call fcn.1400139e0
mov r10, rax
cmp rax, rbx
je 0x1400125a6
inc rax
cmp rax, rbx
je 0x1400125a6
nop dword [rax]
movzx ecx, byte [rax]
cmp cl, 0x20
je 0x14001259e
mov byte [r10], cl
inc r10
inc rax
cmp rax, rbx
jne 0x140012590
lea r9, [rbp + 0xc0]
mov r8, qword [rbp + 0xc0]
mov rcx, qword [rbp + 0xd8]
cmp rcx, 0x10
cmovae r9, r8
mov rbx, qword [rbp + 0xd0]
add r9, rbx
lea rax, [rbp + 0xc0]
cmp rcx, 0x10
cmovae rax, r8
mov rdx, r10
sub rdx, rax
sub r9, r10
mov rax, rbx
sub rax, rdx
cmp rax, r9
cmovb r9, rax
lea rax, [rbp + 0xc0]
cmp rcx, 0x10
cmovae rax, r8
lea rcx, [rax + rdx]
sub rbx, r9
mov r8, rbx
sub r8, rdx
inc r8
lea rdx, [rcx + r9]
call fcn.140014cba
mov qword [rbp + 0xd0], rbx
xor r8d, r8d
lea rdx, [rbp + 0xc0]
mov rcx, r15
call fcn.140012cd0
mov dword [rsp + 0x40], 1
mov rcx, rsi
call fcn.140013d34
nop
test r13, r13
je 0x1400126f8
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400126d6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400126d6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
mov r8d, 0xc4bc5a05
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1400126d1
nop
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x1400126b0
cmp r8d, 0xa0983da5
je 0x1400126db
test r9d, r9d
jne 0x140012690
mov rax, qword [rax]
jmp 0x140012660
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov rcx, r13
call rdx
nop
lea rax, [rbp - 0x48]
mov rcx, qword [rbp - 0x50]
cmp rcx, rax
je 0x14001270c
call qword [0x140016240]
nop
mov rdx, qword [rbp + 0xd8]
cmp rdx, 0x10
jb 0x140011ffd
inc rdx
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011ff8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140011ff8
call qword [0x140016288]
int3