Function at 0x140048aa0
Capabilities:
Access peb ldr_data
Encode data using xor
Get system information on windows
Hash data using fnv
Make suspicious ntquerysysteminformation call
Parse pe header
Query environment variable
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x14010f080]
xor rax, rsp
mov qword [rbp + 0x20], rax
mov qword [rbp - 0x80], rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor r12d, r12d
mov r14d, r12d
mov qword [rsp + 0x38], r12
mov dword [rbp - 0x58], r12d
lea r9, [rbp - 0x58]
xor r8d, r8d
xor edx, edx
mov ecx, ntohl
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x140048cc1
nop dword [rax]
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rdi, rsi
nop word [rax + rax]
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140048ba7
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140048ba7
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r11 + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
mov edx, 0xd76bb4fa
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140048ba2
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x140048b80
cmp edx, 0xc77561ef
je 0x140048d75
test r8d, r8d
jne 0x140048b60
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x140048bbc
cmp qword [rax + 0x30], r12
jne 0x140048b30
mov r10, r12
xor edx, edx
mov r8d, 0x8000
mov rcx, r14
call r10
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rdi, rsi
nop dword [rax]
nop dword [rax + rax]
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140048c67
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140048c67
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r11 + r8*4]
mov eax, dword [rax + r9]
add rax, r9
mov edx, 0xd46deed8
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x140048c62
nop dword [rax]
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax]
lea rax, [rax + 1]
test cl, cl
jne 0x140048c40
cmp edx, 0xecc5cff8
je 0x140048d92
test r8d, r8d
jne 0x140048c20
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x140048c7c
cmp qword [rax + 0x30], r12
jne 0x140048bf0
mov r10, r12
mov edx, dword [rbp - 0x58]
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
call r10
mov r14, rax
lea r9, [rbp - 0x58]
mov r8d, dword [rbp - 0x58]
mov rdx, rax
mov ecx, ntohl
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x140048b10
mov qword [rsp + 0x38], r14
mov rdi, qword [rsp + 0x40]
test eax, eax
jns 0x140048daf
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rdi, rsi
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140048d57
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140048d57
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r9 + r8*4]
mov ecx, dword [rax + r11]
add rcx, r9
mov edx, 0xc3b8939d
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140048d52
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x140048d30
cmp edx, 0x139ed6fa
je 0x14004955f
test r8d, r8d
jne 0x140048d10
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x140049577
cmp qword [rax + 0x30], r12
jne 0x140048ce0
jmp 0x140049577
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rbx + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov r10d, dword [rcx + rax*4]
add r10, r9
jmp 0x140048bbf
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rbx + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov r10d, dword [rcx + rax*4]
add r10, r9
jmp 0x140048c7f
mov r13d, r12d
cmp dword [r14], r12d
jbe 0x1400492e8
movabs rsi, 0x3866a4e0e99d87e6
nop word [rax + rax]
mov r15d, r13d
imul rcx, r15, 0x128
lea rbx, [rcx + r14]
movzx eax, word [rbx + 0x2e]
add rax, rcx
lea rdx, [r14 + 0x30]
add rdx, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x18], r12
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x140048e02
lea rcx, [rbp - 0x30]
call fcn.140044fa0
nop
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0xf
cmova rcx, qword [rbp - 0x30]
mov rdx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x1400492a1
lea rdx, [rbx + 0x30]
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], r12
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rdx + r8], 0
jne 0x140048e50
lea rcx, [rbp - 0x50]
call fcn.140044fa0
nop
movabs rax, 0x6904497810a910a6
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x70], rax
movabs rax, 0x3866a4e0e99dd3a9
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x78], rax
movabs rbx, 0x2656043d44fa49f5
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x10], rax
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
mov qword [rbp - 8], rax
movdqa xmm0, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rsp + 0x70], xmm0
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x60], r12
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140048ef0
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.140044fa0
nop
movabs rax, 0x2656043d44fa49a9
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x30]
mov qword [rbp], rax
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
mov qword [rbp + 8], rax
movdqa xmm0, xmmword [rsp + 0x50]
xorps xmm0, xmmword [rbp]
movdqa xmmword [rsp + 0x50], xmm0
lea rax, [rsp + 0x50]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140048f70
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x78]
call fcn.140044ed0
mov r12, rax
movabs rax, 0x743b614937831aa9
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x60], rax
movabs rax, 0x3866a4e0b5e9e889
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x10], rax
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x18], rax
movdqa xmm0, xmmword [rsp + 0x60]
xorps xmm0, xmmword [rbp + 0x10]
movdqa xmmword [rsp + 0x60], xmm0
lea rax, [rsp + 0x60]
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rax + rdi], 0
jne 0x140048ff5
lea rsi, [rbp - 0x50]
cmp qword [rbp - 0x38], 0xf
cmova rsi, qword [rbp - 0x50]
mov rax, qword [rbp - 0x40]
cmp rdi, rax
ja 0x14004908d
sub rax, rdi
test rdi, rdi
jne 0x140049021
xor ebx, ebx
jmp 0x140049094
lea r14, [rsi + rax]
movq rax, xmm0
movsx r15d, al
lea r8, [r14 + 1]
sub r8, rsi
mov edx, r15d
mov rcx, rsi
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x140049085
nop dword [rax + rax]
mov r8, rdi
lea rdx, [rsp + 0x60]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140049396
inc rbx
lea r8, [r14 + 1]
sub r8, rbx
mov edx, r15d
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
jne 0x140049050
mov r15d, r13d
mov r14, qword [rsp + 0x38]
mov rbx, 0xffffffffffffffff
mov rax, qword [r12 + 0x10]
cmp qword [r12 + 0x18], 0xf
jbe 0x1400490a5
mov r12, qword [r12]
mov qword [rsp + 0x20], rax
mov r9, r12
mov r8d, 7
mov rdx, rbx
lea rcx, [rbp - 0x50]
call fcn.1400475f0
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 0xf
jbe 0x1400490fb
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400490f6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400493c6
call fcn.1400d2750
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rdi, rsi
nop dword [rax]
nop word [rax + rax]
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140049197
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140049197
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r11 + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
mov edx, 0x6729af5e
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140049192
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x140049170
cmp edx, 0x1a328cf7
je 0x1400493a6
test r8d, r8d
jne 0x140049150
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x1400491ad
cmp qword [rax + 0x30], 0
jne 0x140049120
xor r12d, r12d
mov r10d, r12d
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0xf
cmova rcx, qword [rbp - 0x50]
xor edx, edx
mov r8d, 1
call r10
mov r11, rax
mov eax, 0x5a4d
cmp word [r11], ax
jne 0x1400494c4
movsxd rcx, dword [r11 + 0x3c]
cmp dword [rcx + r11], 0x4550
jne 0x1400494c4
mov edx, dword [rcx + r11 + 0x88]
test edx, edx
je 0x1400494c4
mov ebx, dword [rdx + r11 + 0x1c]
lea rdi, [r11 + rbx]
mov r9d, dword [rdx + r11 + 0x20]
add r9, r11
mov esi, dword [rdx + r11 + 0x24]
add rsi, r11
mov r10d, r12d
test ebx, ebx
je 0x140049257
mov r8d, dword [r9]
add r8, r11
mov rax, qword [rbp - 0x80]
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140049243
inc rax
test ecx, ecx
jne 0x140049230
test edx, edx
je 0x1400493cd
inc r10d
add r9, 4
cmp r10d, ebx
jb 0x140049220
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x140049292
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004928d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400494f9
call fcn.1400d2750
movabs rsi, 0x3866a4e0e99d87e6
mov rdi, qword [rsp + 0x40]
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x1400492dc
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400492d7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140049558
call fcn.1400d2750
inc r13d
cmp r13d, dword [r14]
jb 0x140048dd0
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rdi, rsi
nop
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140049377
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140049377
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r11 + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
mov edx, 0xa83d3217
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140049372
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x140049350
cmp edx, 0xd56a0f08
je 0x14004955f
test r8d, r8d
jne 0x140049330
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x140049577
cmp qword [rax + 0x30], 0
jne 0x140049300
jmp 0x140049577
sub rbx, rsi
mov r15d, r13d
mov r14, qword [rsp + 0x38]
jmp 0x140049094
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rbx + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov r10d, dword [rcx + rax*4]
add r10, r9
xor r12d, r12d
jmp 0x1400491b3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
movsxd rax, r10d
movzx ecx, word [rsi + rax*2]
mov r14d, dword [rdi + rcx*4]
imul rax, r15, 0x128
mov r15, qword [rsp + 0x38]
add r14, qword [rax + r15 + 0x18]
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rdi, rsi
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140049473
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140049473
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r9 + r8*4]
mov ecx, dword [rax + r11]
add rcx, r9
mov edx, 0x12997ac1
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x14004946e
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x140049450
cmp edx, 0xa8fb164e
je 0x14004949c
test r8d, r8d
jne 0x140049430
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x140049489
cmp qword [rax + 0x30], 0
jne 0x140049400
mov r10, r12
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call r10
jmp 0x1400494c7
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rbx + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov r10d, dword [rcx + rax*4]
add r10, r9
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call r10
jmp 0x1400494c7
mov r14, r12
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x140049505
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049500
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140049500
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d2750
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x50], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140049553
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004954e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004954e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d2750
mov rax, r14
jmp 0x140049587
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov r12d, dword [rcx + rdx*4]
add r12, r9
mov r8d, 0x8000
xor edx, edx
mov rcx, r14
call r12
xor eax, eax
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1400d2300
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret