Function at 0x140074da0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Encode data using xor
Hash data using fnv
Read file on windows
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0xf0]
sub rsp, 0x1f0
mov rax, qword [0x140398130]
xor rax, rsp
mov qword [rbp + 0xe0], rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov r14d, dword [rcx + rbx + 0x88]
add r14, rbx
cmp r14, rbx
je 0x140074389
mov r11d, dword [r14 + 0x18]
test r11d, r11d
je 0x140074389
mov esi, dword [r14 + 0x20]
nop word [rax + rax]
dec r11d
lea rcx, [rsi + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0xe55a085a
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x140074384
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x140074350
cmp r10d, 0x305affc5
je 0x140074391
test r11d, r11d
jne 0x140074330
mov rax, qword [rax]
jmp 0x140074300
mov ecx, dword [r14 + 0x1c]
add rcx, rbx
mov eax, dword [r14 + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov r10d, dword [rcx + rax*4]
add r10, rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x14039d290]
call r10
mov rcx, qword gs:[0x60]
cmp eax, 0xffffffff
mov rax, qword [rcx + 0x18]
mov rax, qword [rax + 0x10]
jne 0x1400744a0
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x140074469
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x140074469
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
lea rcx, [r14 + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0x5654aa0f
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x140074464
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x140074430
cmp r10d, 0x1ffc66b9
je 0x140074471
test r11d, r11d
jne 0x140074410
mov rax, qword [rax]
jmp 0x1400743e0
mov ecx, dword [rsi + 0x24]
add rcx, rbx
movzx edx, word [rcx + r11*2]
mov ecx, dword [rsi + 0x1c]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
add rax, rbx
call rax
mov dword [0x14039d298], eax
xor al, al
jmp 0x140074d5f
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov r14d, dword [rcx + rbx + 0x88]
add r14, rbx
cmp r14, rbx
je 0x140074529
mov r11d, dword [r14 + 0x18]
test r11d, r11d
je 0x140074529
mov esi, dword [r14 + 0x20]
nop word [rax + rax]
dec r11d
lea rcx, [rsi + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0x48fa9b8e
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x140074524
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x1400744f0
cmp r10d, 0x82bdc8d5
je 0x140074531
test r11d, r11d
jne 0x1400744d0
mov rax, qword [rax]
jmp 0x1400744a0
mov ecx, dword [r14 + 0x1c]
add rcx, rbx
mov eax, dword [r14 + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov r8d, dword [rcx + rax*4]
add r8, rbx
xor edx, edx
mov rcx, qword [0x14039d290]
call r8
mov r15d, eax
cmp eax, 0xffffffff
jne 0x140074615
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x14007460d
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x14007460d
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
lea rcx, [r14 + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0xd1f7a1a2
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x140074608
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x1400745d0
cmp r10d, 0x442dd6a4
je 0x140074471
test r11d, r11d
jne 0x1400745b0
mov rax, qword [rax]
jmp 0x140074580
lea edx, [rax + 1]
xor r8d, r8d
lea rcx, [rbp + 0x20]
call fcn.1400869e0
nop
xor r12d, r12d
mov dword [rsp + 0x70], r12d
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
movups xmmword [rbp + 0x50], xmm0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov r14d, dword [rcx + rbx + 0x88]
add r14, rbx
cmp r14, rbx
je 0x1400746d9
mov r11d, dword [r14 + 0x18]
test r11d, r11d
je 0x1400746d9
mov esi, dword [r14 + 0x20]
nop word [rax + rax]
dec r11d
lea rcx, [rsi + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0x530cc109
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x1400746d4
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x1400746a0
cmp r10d, 0xefd17705
je 0x1400746e1
test r11d, r11d
jne 0x140074680
mov rax, qword [rax]
jmp 0x140074650
mov ecx, dword [r14 + 0x1c]
add rcx, rbx
mov eax, dword [r14 + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov r10d, dword [rcx + rax*4]
add r10, rbx
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xffffffff
mov r9d, 0xffffffff
xor r8d, r8d
lea edx, [r8 + 2]
mov rcx, qword [0x14039d290]
call r10
lea rdx, [rbp + 0x20]
cmp qword [rbp + 0x38], 0x10
cmovae rdx, qword [rbp + 0x20]
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x70]
mov r8d, r15d
mov rcx, qword [0x14039d290]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, qword gs:[0x60]
test eax, eax
mov rax, qword [rcx + 0x18]
mov rax, qword [rax + 0x10]
jne 0x140074910
nop dword [rax]
nop dword [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov r14d, dword [rcx + rbx + 0x88]
add r14, rbx
cmp r14, rbx
je 0x1400747f9
mov r11d, dword [r14 + 0x18]
test r11d, r11d
je 0x1400747f9
mov esi, dword [r14 + 0x20]
nop word [rax + rax]
dec r11d
lea rcx, [rsi + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0xda0e0359
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x1400747f4
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x1400747c0
cmp r10d, 0x36c84533
je 0x140074801
test r11d, r11d
jne 0x1400747a0
mov rax, qword [rax]
jmp 0x140074770
mov ecx, dword [r14 + 0x1c]
add rcx, rbx
mov eax, dword [r14 + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov ecx, dword [rcx + rax*4]
add rcx, rbx
call rcx
mov dword [0x14039d298], eax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov r14d, dword [rcx + rbx + 0x88]
add r14, rbx
cmp r14, rbx
je 0x1400748c8
mov r11d, dword [r14 + 0x18]
test r11d, r11d
je 0x1400748c8
mov esi, dword [r14 + 0x20]
nop word [rax + rax]
dec r11d
lea rcx, [rsi + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0x847b5ae7
movzx ecx, byte [r9]
inc r9
test cl, cl
je 0x1400748c3
nop
movsx edx, cl
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
movzx ecx, byte [r9]
lea r9, [r9 + 1]
test cl, cl
jne 0x140074890
cmp r10d, 0x70a240ac
je 0x1400748d0
test r11d, r11d
jne 0x140074870
mov rax, qword [rax]
jmp 0x140074840
mov ecx, dword [r14 + 0x1c]
add rcx, rbx
mov eax, dword [r14 + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov r10d, dword [rcx + rax*4]
add r10, rbx
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
xor edx, edx
mov r9d, 0xffffffff
mov r8d, r9d
mov rcx, qword [0x14039d290]
call r10
xor bl, bl
jmp 0x140074d53
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov r14d, dword [rcx + rbx + 0x88]
add r14, rbx
cmp r14, rbx
je 0x140074999
mov r11d, dword [r14 + 0x18]
test r11d, r11d
je 0x140074999
mov esi, dword [r14 + 0x20]
nop word [rax + rax]
dec r11d
lea rcx, [rsi + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0x7fb17f5a
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x140074994
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x140074960
cmp r10d, 0xf6020865
je 0x1400749a1
test r11d, r11d
jne 0x140074940
mov rax, qword [rax]
jmp 0x140074910
mov ecx, dword [r14 + 0x1c]
add rcx, rbx
mov eax, dword [r14 + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov r10d, dword [rcx + rax*4]
add r10, rbx
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
xor edx, edx
mov r9d, 0xffffffff
mov r8d, r9d
mov rcx, qword [0x14039d290]
call r10
xor r8d, r8d
xor edx, edx
call fcn.1400726a0
lea rdx, [rbp + 0x20]
lea rcx, [rsp + 0x78]
call fcn.1400728b0
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], rax
mov ebx, dword [rbp - 0x78]
lea rdx, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rdx, qword [rsp + 0x78]
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], r12
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], ax
jne 0x140074a40
lea rcx, [rsp + 0x30]
call fcn.1400855f0
nop
lea rcx, [rbp - 0x60]
call fcn.140072b70
nop
lea rax, vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rbp - 0x60], rax
mov ecx, ebx
not ecx
and ecx, 1
shl ecx, 2
mov edx, ecx
or edx, 2
test bl, 2
cmovne edx, ecx
mov ecx, edx
or ecx, 8
test bl, 8
cmove ecx, edx
mov edi, ecx
or edi, 0x10
test bl, 4
cmove edi, ecx
lea r14, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae r14, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
cmp rsi, 0x7fffffff
ja 0x140074d8f
test rsi, rsi
je 0x140074b64
mov eax, edi
and eax, 6
cmp al, 6
je 0x140074b64
mov rdx, rsi
lea rcx, [rbp + 0x14]
call fcn.140085b50
mov rbx, rax
add rsi, rsi
mov r8, rsi
mov rdx, r14
mov rcx, rax
call fcn.140315cb0
lea rdx, [rsi + rbx]
mov qword [rbp + 8], rdx
mov r8d, edi
and r8d, 4
jne 0x140074b1a
mov rcx, qword [rbp - 0x48]
mov qword [rcx], rbx
mov rax, qword [rbp - 0x28]
mov qword [rax], rbx
sar rsi, 1
mov rax, qword [rbp - 0x10]
mov dword [rax], esi
mov rdx, qword [rbp + 8]
test dil, 2
jne 0x140074b5f
test dil, 0x18
mov rcx, rbx
cmovne rcx, rdx
mov rax, qword [rbp - 0x40]
mov qword [rax], rbx
mov rax, qword [rbp - 0x20]
mov qword [rax], rcx
sub rdx, rcx
sar rdx, 1
mov rax, qword [rbp - 8]
mov dword [rax], edx
test r8d, r8d
je 0x140074b5f
mov rax, qword [rbp - 0x48]
mov qword [rax], rbx
mov rax, qword [rbp - 0x28]
mov qword [rax], rbx
mov rax, qword [rbp - 0x10]
mov dword [rax], r12d
or edi, 1
jmp 0x140074b68
mov qword [rbp + 8], r12
mov dword [rbp + 0x10], edi
lea rcx, [rsp + 0x30]
call fcn.140085e10
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x60], xmm0
movups xmmword [rbp + 0x70], xmm0
movups xmmword [rbp + 0x80], xmm0
movups xmmword [rbp + 0x90], xmm0
movups xmmword [rbp + 0xa0], xmm0
movups xmmword [rbp + 0xb0], xmm0
movups xmmword [rbp + 0xc0], xmm0
mov qword [rbp + 0xd0], rax
lea r9d, [rax + 1]
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x60]
call fcn.140073de0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r12
xor r8d, r8d
lea rdx, [0x140374568]
lea rcx, [rsp + 0x50]
call fcn.1400855f0
nop
lea rbx, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rbx, qword [rsp + 0x78]
lea rcx, [rsp + 0x78]
cmovae rcx, qword [rsp + 0x78]
mov rax, qword [rbp - 0x78]
lea rdi, [rcx + rax*2]
cmp rbx, rdi
je 0x140074ca6
movzx edx, word [rbx]
cmp dx, 0xa
jne 0x140074c89
cmp qword [rsp + 0x60], 0
je 0x140074c99
lea rax, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rax, qword [rsp + 0x50]
cmp word [rax], 0
je 0x140074c99
mov rax, qword [0x14039d280]
cmp rax, qword [0x14039d288]
je 0x140074c60
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.140085a30
add qword [0x14039d280], 0x20
jmp 0x140074c6d
lea r8, [rsp + 0x50]
mov rdx, rax
call fcn.140074090
lea rax, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rax, qword [rsp + 0x50]
mov qword [rsp + 0x60], r12
mov word [rax], r12w
jmp 0x140074c99
cmp dx, 0xd
je 0x140074c99
lea rcx, [rsp + 0x50]
call fcn.140085390
add rbx, 2
cmp rbx, rdi
jne 0x140074c11
cmp qword [rsp + 0x60], 0
je 0x140074cf9
lea rax, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rax, qword [rsp + 0x50]
cmp word [rax], 0
je 0x140074cf9
mov rax, qword [0x14039d280]
cmp rax, qword [0x14039d288]
je 0x140074cec
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.140085a30
add qword [0x14039d280], 0x20
jmp 0x140074cf9
lea r8, [rsp + 0x50]
mov rdx, rax
call fcn.140074090
mov bl, 1
lea rcx, [rsp + 0x50]
call fcn.140085e10
nop
mov rax, qword [rbp + 0x60]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_istream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rbp + rcx + 0x60], rax
mov rax, qword [rbp + 0x60]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x18]
mov dword [rbp + rcx + 0x5c], edx
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x78], rax
lea rcx, [rbp + 0x78]
call fcn.1402bd96c
nop
lea rcx, [rbp - 0x60]
call fcn.140073570
nop
lea rcx, [rsp + 0x78]
call fcn.140085e10
nop
lea rcx, [rbp + 0x20]
call fcn.140087070
movzx eax, bl
mov rcx, qword [rbp + 0xe0]
xor rcx, rsp
call fcn.1403139c0
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.1402bd0e4
nop
int3
push rbx
sub rsp, 0x40
cmp qword [rdx + 0x18], 8
mov rbx, rdx
mov rcx, rdx
jb 0x140074db6
mov rcx, qword [rdx]
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov edx, 0x10000000
mov dword [rsp + 0x20], 4
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x14039d290], rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x140074e63
lea rcx, [0x14039d278]
call fcn.140071db0
mov rcx, qword [0x14039d290]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rbx + 0x18], 8
jb 0x140074e14
mov rbx, qword [rbx]
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov edx, 0xc0000000
mov rcx, rbx
mov dword [rsp + 0x20], 4
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x14039d290], rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x140074e63
lea rcx, [0x14039d278]
add rsp, 0x40
pop rbx
jmp 0x1400742b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x14039d298], eax
xor al, al
add rsp, 0x40
pop rbx
ret