Function at 0x140132f1a
Capabilities:
Contain obfuscated stackstrings
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
inc rcx
test dl, dl
je 0x140132831
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
jmp 0x14013285a
and byte [rbp + rcx*4 - 0x55], al
jrcxz 0x1401327aa
add byte [rax], al
xor r8d, 0x83813c99
ror r8d, 0x1e
jmp rax
dec r9d
mov r8d, 0x6db7b5d9
lea rdx, [r10 + r9*4]
mov ecx, dword [rdx + r11]
add rcx, r10
movzx edx, byte [rcx]
je 0x1401327f1
jne 0x1401327f1
jne 0x1401327f1
mov r11d, 0x8daa7fa2
int3
jmp 0x14013243d
test r9d, r9d
jne 0x140132792
mov rax, qword [rax]
jmp 0x140132ace
add rbx, r10
cmp rbx, r10
je 0x14013283a
mov r9d, dword [rbx + 0x18]
test r9d, r9d
jmp 0x140132ab4
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x14013244a
cmp r8d, 0xe5d75b2c
je 0x140132b3e
jmp 0x140132831
je 0x14013283a
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
jmp 0x140132792
xchg r10, r9
mov r9, qword [rax + 0x30]
xchg r9, r10
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
jmp 0x140132842
mov eax, dword [rbx + 0x24]
mov ecx, dword [rbx + 0x1c]
add rax, r10
add rcx, r10
movzx edx, word [rax + r9*2]
mov rax, qword gs:[0x60]
mov edi, dword [rcx + rdx*4]
je 0x140132b97
jne 0x140132b97
jbe 0x140132d39
lea r14d, [rdx + 0x4b5]
cpuid
call rcx
cmp ebp, 0xb93fd5c1
jmp rcx
jmp 0x140132bfe
test cl, cl
je 0x140132ca0
nop
jmp fcn.140132bea
add rbx, r10
cmp rbx, r10
je 0x140132cae
mov r9d, dword [rbx + 0x18]
test r9d, r9d
jmp 0x140132bc9
je 0x140132cae
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r10 + r9*4]
jmp 0x140132cb6
mov rax, qword [rax + 0x18]
add rdi, r10
mov qword [rsp + 0x30], rdi
je 0x140132c52
jne 0x140132c52
test rdx, rdx
sub ebx, 0x412773d4
lea ecx, [rbp + 0xd788]
jo 0x140133675
mov r13d, 0x5674a343
xor r8d, 0xb4b455bb
rcl r14d, 0xd0
ret
jmp 0x140132c67
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
jmp 0x140132bb1
test r9d, r9d
jmp fcn.140132ca8
mov rax, qword [rax]
jmp 0x140132c72
mov r8d, dword [rdx + r11]
mov edx, 0x7cba0c0d
add r8, r10
movzx ecx, byte [r8]
inc r8
jmp 0x140132ba2
lea edx, [rcx - 0x588d]
rcl edi, 0x36
lea r8d, [rcx - 0xe1c4]
cmp ecx, 0x8a0accdd
cmp r14, rdi
or edi, 0x4f788642
movabs rsi, 0x668b6400000089e9
sub edx, 0x956d9478
cmp r11, rbp
test r13, rdx
popf
rcr ecx, 0xd6
rcr r10d, 0xba
cmp r11, rbp
ret
je 0x140132f37
jne 0x140132f37
int3
jmp 0x140132fdc
mov edx, edi
add rdx, rax
lea rax, [0x140000000]
jmp 0x140133085
mov rdx, rcx
nop
add rax, 2
add rax, rdx
je 0x140132f83
jne 0x140132f83
jmp rax
jmp 0x140132fba
mov r9, qword [rbx]
xchg r9, rcx
test rcx, rcx
je 0x140133164
jmp 0x140132f6a
mov rbx, rsi
xchg rcx, rbx
cmovns rdx, rax
call r15
mov r8, rax
test rax, rax
jmp 0x1401330f3
movzx edx, dx
test rcx, rcx
xchg rbx, rcx
jmp 0x140132fa2
nop
mov ecx, dword [r14 + 0xc]
xor r8d, r8d
add rcx, rax
xor edx, edx
call rdi
jmp 0x140133079
mov r12d, dword [rcx + r8*4]
add r12, r9
nop word [rax + rax]
mov byte [rsp + rax + 0x63], r13b
inc rax
cmp rax, 0xa
jb 0x140132fed
jmp 0x14013308e
jne 0x14013300e
mov ecx, dword [r14 + 0x10]
mov ebx, ecx
lea rax, [0x140000000]
add rbx, rax
mov edi, r13d
xchg rcx, r9
je 0x140133056
jne 0x140133056
pushf
cmp rcx, rcx
pop r12
lea r9d, [rdi + 0xa3c4]
jmp rcx
jmp 0x140132f8e
test rax, rax
je 0x140133703
mov ecx, dword [r14]
test ecx, ecx
jmp 0x140133004
xchg r9, rax
mov rsi, r9
xchg r9, rax
jmp 0x140133066
mov qword [rdx + rax], r8
jmp 0x140133215
cmp dword [r14 + 0xc], r13d
je 0x140133ae3
lea rax, [0x140000000]
jne 0x1401330cd
je 0x1401330cd
pause
neg rbx
call rcx
push rbp
rol r9d, 0xce
test edx, 0xceb2a11a
cpuid
js 0x140132758
lea edi, [rbp - 0x74d3]
ret
jmp 0x140132fc8
je 0x140133224
mov eax, dword [r14 + 0x10]
test eax, eax
je 0x14013310a
jmp 0x140132f59
xchg rsi, rax
mov rsi, qword [rbx]
xchg rsi, rax
je 0x14013313e
jne 0x14013313e
xor r12d, 0xc750a4d1
and edx, 0x3bae7e38
lea r10d, [rcx - 0x1b78]
cmp r12d, 0x7d14b2ce
adc al, 0x7d
jmp rax
jmp 0x140133173
mov rdx, rcx
test rcx, rcx
jne 0x140132f6e
neg r14
add r14, 0xffffffffffffffec
neg r14
jmp 0x1401331c3
lea rcx, [0x140000000]
mov qword [rcx + rax], r8
lea rax, [0x140000000]
je 0x1401331a3
jne 0x1401331a3
jmp rax
jmp 0x140133215
cmp dword [r14 + 0xc], r13d
je 0x140133ae3
mov rdi, qword [rsp + 0x30]
jmp 0x140132fc9
add rbx, 8
nop
add edi, 0x6f7b9a45
sub edi, 0x6f7b9a3d
jne 0x140133200
je 0x140133200
div r12
dec rbp
rcr r12d, 0x95
push r11
lea esi, [rbp + 0xe791]
movabs rdi, 0x54a7e9ffffff53e9
rcr r12d, 0x94
pushfq
pop r10
rol edi, 0xae
ret 0x28
jmp 0x140133158
xchg rcx, r13
mov r13, qword [rbx + 8]
xchg rcx, r13
jmp 0x1401331d7
mov dword [rsp + 0x30], 0xf6f6f6f6
xchg r13, rdi
mov rdx, rdi
jmp 0x14013364a
nop dword [rax + rax]
movzx eax, byte [rsp + rdx + 0x36]
movzx ecx, byte [rsp + rdx + 0x30]
add cl, al
mov byte [rsp + rdx + 0x36], cl
jmp 0x1401334b3
mov byte [rsp + rdx + 0x30], r13b
inc rdx
cmp rdx, 5
jb 0x140133494
jmp fcn.140133283
stc
invalid
sub edx, 0xb8bcac32
div r12
call rcx
jg 0x1401335bd
ret 0x38
xchg rdi, r13
mov dword [rsp + 0x36], 0x797c7c4f
mov byte [rsp + 0x34], 0xf6
mov word [rsp + 0x3a], 0x7c
jmp 0x14013348c
invalid
mov dword [rsp + 0x48], 0xf6f6f6f6
mov rdx, r13
mov dword [rsp + 0x4e], 0x797c7c4f
mov byte [rsp + 0x4c], 0xf6
mov word [rsp + 0x52], 0x7c
nop dword [rax]
nop dword [rax + rax]
jmp 0x140133919
mov dword [rbp + 0x44], 0xf6f6f6f6
mov dword [rbp + 0x98], 0x6f7c7f7d
mov dword [rbp + 0x48], 0xf6f6f6f6
jne 0x14013376e
je 0x14013376e
test r12, rdi
test rbp, rcx
jl 0x140133a97
lea r13d, [rbp + 0xcc79]
call rcx
pause
neg rdi
mul r14
movabs r14, 0x489f5b7975552feb
or r15d, 0xe4e6027a
ret
jmp 0x14013379f
movzx eax, byte [rbp + rdx + 0x78]
movzx ecx, byte [rbp + rdx + 0x24]
add cl, al
mov byte [rbp + rdx + 0x78], cl
mov byte [rbp + rdx + 0x24], r13b
inc rdx
cmp rdx, 0x53
jmp 0x140133878
mov dword [rbp + 0x9c], 0x6f727e2a
mov dword [rbp + 0x4c], 0xf6f6f6f6
mov dword [rbp + 0xa0], 0x7d73602a
mov dword [rbp + 0x50], 0xf6f6f6f6
jne 0x1401337d4
je 0x1401337d4
and esi, 0x712b8fae
lea r15d, [rcx + 0xeef5]
movabs rcx, 0x1b4a19000001d4e9
int3
jmp 0x1401339ad
mov word [rbp + 0x74], 0xf6f6
mov dword [rbp + 0xc8], 0x386e6f
mov byte [rbp + 0x76], 0xf6
nop dword [rax]
nop word [rax + rax]
jne 0x14013383b
je 0x14013383b
pop r15
sub r12d, 0x420f85ef
cmp r12d, 0x60da9d7d
ror ecx, 0xb8
inc r11
call rcx
jmp rax
jmp 0x14013377e
mov dword [rbp + 0x60], 0xf6f6f6f6
mov dword [rbp + 0xb4], 0x6b7e7f6c
mov dword [rbp + 0x64], 0xf6f6f6f6
jmp 0x1401339ef
jb 0x14013377e
mov r9d, 0x10
lea r8, [rsp + 0x4e]
lea rdx, [rbp + 0x78]
je 0x1401338a2
jne 0x1401338a2
popfq
lea ebx, [rbp + 0x25b1]
and r14d, 0x19435fea
popfq
movabs rdx, 0x5e64c100000083e9
cmp r12d, 0x4ab0f5c1
call rcx
jg 0x140133a1d
jmp 0x14013392a
or edx, 0x33e93c52
mov r14d, 0xb7ab441f
call fcn.140133e8c
cmp rax, 0x53
jb 0x1401338f3
nop
mov byte [rsp + r13 + 0x4e], 0
inc r13
cmp r13, 5
jmp 0x140133900
nop word [rax + rax]
mov byte [rbp + rax + 0x78], r13b
inc rax
jmp 0x1401338ca
jb 0x1401338d6
jmp fcn.1401335aa
xchg r13, rdx
mov r13, rdx
xchg r13, rdx
jmp 0x14013395f
movzx eax, byte [rsp + rdx + 0x4e]
movzx ecx, byte [rsp + rdx + 0x48]
add cl, al
jmp 0x14013393d
xor ecx, ecx
call r12
xchg r12, r13
mov rax, r12
xchg r13, r12
jmp 0x1401338e8
mov byte [rsp + rdx + 0x4e], cl
mov byte [rsp + rdx + 0x48], r13b
inc rdx
cmp rdx, 5
jb 0x140133919
mov dword [rbp + 0x24], 0xf6f6f6f6
jmp 0x14013390b
mov dword [rbp + 0x78], 0x76736b50
mov dword [rbp + 0x28], 0xf6f6f6f6
mov dword [rbp + 0x7c], 0x7e2a6e6f
mov dword [rbp + 0x2c], 0xf6f6f6f6
jne 0x140133992
je 0x140133992
cmp r14, rdx
jmp 0x140134183
jmp 0x140133a7a
mov dword [rbp + 0xa4], 0x2a766b7f
mov dword [rbp + 0x54], 0xf6f6f6f6
mov dword [rbp + 0xa8], 0x2a35354d
mov dword [rbp + 0x58], 0xf6f6f6f6
mov dword [rbp + 0xac], 0x736e6f5c
mov dword [rbp + 0x5c], 0xf6f6f6f6
div dh
mov dword [rbp + 0xb0], 0x737c7e7d
add byte [rax], al
add byte [rbp + 0x7e], bh
jl 0x140133a5d
jmp 0x14013385b
mov dword [rbp + 0xb8], 0x7d6f766c
mov dword [rbp + 0x68], 0xf6f6f6f6
mov dword [rbp + 0xbc], 0x6f7c6b2a
mov dword [rbp + 0x6c], 0xf6f6f6f6
mov dword [rbp + 0xc0], 0x7d78732a
mov dword [rbp + 0x70], 0xf6f6f6f6
mov dword [rbp + 0xc4], 0x76766b7e
je 0x140133a5a
add byte [rax], al
sub dh, byte [rbx + 0x78]
jge 0x1401339e3
jo 0x140133a15
jo 0x140133a15
div dh
test bh, 0x85
invalid
jne 0x140133a5a
test rdx, rcx
rcr r12d, 0x5e
je 0x1401335cd
jmp rax
jmp 0x1401337ec
invalid
mov dword [rbp + 0x80], 0x78732a79
mov dword [rbp + 0x30], 0xf6f6f6f6
mov dword [rbp + 0x84], 0x6b737e73
mov dword [rbp + 0x34], 0xf6f6f6f6
mov dword [rbp + 0x88], 0x6f847376
jmp 0x140133aab
xor al, 0xf6
div dh
test bh, 0x85
mov byte [rax], al
add byte [rax], al
jbe 0x140133b17
test byte [rdi - 0x17], ch
add byte [rax], al
add byte [rax], al
mov dword [rbp + 0x38], 0xf6f6f6f6
mov dword [rbp + 0x8c], 0x55572a44
mov dword [rbp + 0x3c], 0xf6f6f6f6
mov dword [rbp + 0x90], 0x57143b4c
mov dword [rbp + 0x40], 0xf6f6f6f6
mov dword [rbp + 0x94], 0x2a6f756b
jmp 0x140133733
xchg r9, r13
mov r13, qword [rbp + 0x308]
xchg r9, r13
lea rcx, [0x140133f10]
xchg r8, r13
jmp 0x140133aff
mov r13, qword [rbp + 0x300]
xchg r13, r8
lea rax, [0x140133ee0]
mov rax, qword [rax]
je 0x140133b3a
jne 0x140133b3a
or r12d, 0x33f99e9e
lea r13d, [rbx + 0xfb1a]
jmp rcx
jmp 0x140133b51
xor rax, qword [rcx]
mov rcx, qword [rbp + 0x2f0]
mov rdx, qword [rbp + 0x2f8]
call rax
jmp fcn.1401334ca