Function at 0x7ff70b542ed0
Capabilities:
Access peb ldr_data
Encode data using xor
Execute anti-debugging instructions
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xe0
mov r13, rcx
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x7ff70b543154
mov rdx, qword [0x7ff70b692418]
test rdx, rdx
jne 0x7ff70b54313d
xor esi, esi
mov edi, 0x8285aca5
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
movups xmm0, xmmword [rax + 0x58]
movups xmmword [rsp + 0x38], xmm0
movd ecx, xmm0
sub cx, 8
test esi, esi
je 0x7ff70b542f93
mov r9, qword [rbp - 0x79]
movzx ecx, cx
shr rcx, 1
lea r11, [r9 + rcx*2]
mov r10d, 0x811c9dc5
cmp r9, r11
je 0x7ff70b542f8a
nop
movsx ecx, byte [r9]
mov edx, ecx
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
add r9, 2
cmp r9, r11
jne 0x7ff70b542f60
cmp r10d, esi
jne 0x7ff70b5430e6
mov rbx, qword [rax + 0x30]
test rbx, rbx
je 0x7ff70b5430ee
movsxd rcx, dword [rbx + 0x3c]
mov rdx, qword [rcx + rbx + 0x88]
mov r13, rdx
shr r13, 0x20
mov r15d, edx
add r15, rbx
cmp r15, rbx
je 0x7ff70b5430e6
mov r11d, dword [r15 + 0x18]
test r11d, r11d
je 0x7ff70b5430e6
mov r12d, dword [r15 + 0x20]
nop dword [rax]
nop word [rax + rax]
dec r11d
lea rcx, [r12 + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0x811c9dc5
movzx ecx, byte [r9]
inc r9
test cl, cl
je 0x7ff70b54302a
nop
movsx edx, cl
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
movzx ecx, byte [r9]
lea r9, [r9 + 1]
test cl, cl
jne 0x7ff70b543000
cmp r10d, edi
je 0x7ff70b54303c
test r11d, r11d
jne 0x7ff70b542fe0
mov rax, qword [rax]
jmp 0x7ff70b542f30
mov ecx, dword [r15 + 0x1c]
add rcx, rbx
mov eax, dword [r15 + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov r8d, dword [rcx + rax*4]
add r8, rbx
cmp r8, r15
jbe 0x7ff70b5430f1
lea rax, [r15 + r13]
cmp r8, rax
jae 0x7ff70b5430f1
mov esi, 0x811c9dc5
mov edi, esi
movzx edx, byte [r8]
cmp dl, 0x2e
je 0x7ff70b5430a5
nop dword [rax]
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, esi
imul esi, ecx, 0x1000193
inc r8
movzx edx, byte [r8]
cmp dl, 0x2e
jne 0x7ff70b543080
inc r8
movzx edx, byte [r8]
test dl, dl
je 0x7ff70b5430d5
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, edi
imul edi, ecx, 0x1000193
lea r8, [r8 + 1]
movzx edx, byte [r8]
test dl, dl
jne 0x7ff70b5430b0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rax, qword [rax]
jmp 0x7ff70b542f30
xor r8d, r8d
mov qword [0x7ff70b692418], r8
nop dword [rax + rax]
rdtsc
shl rdx, 0x20
or rax, rdx
lea rcx, [rax + rax*4]
mov qword [0x7ff70b692420], rcx
cmp rcx, r8
je 0x7ff70b543100
mov rdx, rcx
xor rdx, r8
mov qword [0x7ff70b692418], rdx
mov eax, ecx
xor eax, 0x8285aca5
mov dword [0x7ff70b692410], eax
mov r13, qword [rbp + 0x67]
mov rax, qword [r13 + 0x18]
jmp 0x7ff70b543144
mov rcx, qword [0x7ff70b692420]
xor rdx, rcx
mov rcx, rax
call rdx
mov qword [r13 + 0x18], 0
lea rcx, [rsp + 0x20]
call fcn.7ff70b546560
nop
mov r12, qword [rsp + 0x20]
mov r15, qword [rsp + 0x28]
cmp r12, r15
je 0x7ff70b54358a
lea rdi, [r12 + 0x28]
nop word [rax + rax]
mov rsi, rdi
mov rcx, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 8
jb 0x7ff70b54319a
mov rax, qword [rdi]
lea r14, [rax + rcx*2]
mov rsi, rax
jmp 0x7ff70b5431a3
lea r14, [rdi + rcx*2]
mov rbx, rdi
jb 0x7ff70b5431a6
mov rbx, qword [rdi]
cmp rbx, r14
je 0x7ff70b5431c9
sub rsi, rbx
nop
movzx ecx, word [rbx]
call fcn.7ff70b559af0
mov word [rsi + rbx], ax
add rbx, 2
cmp rbx, r14
jne 0x7ff70b5431b0
mov rcx, qword [rdi + 0x10]
movabs rax, 0x59c474f53fbee785
mov qword [rbp - 0x39], rax
movabs rax, 0x6aef071cbdca6406
mov qword [rbp - 0x31], rax
movabs rax, 0x9822406bbc19ce9f
mov qword [rbp - 0x29], rax
movabs rax, 0x2e445422d04bcb78
mov qword [rbp - 0x21], rax
movabs rax, 0xac5b470991c5eec9
mov qword [rbp - 0x19], rax
movabs rax, 0x6c00d3a0f6d0587a
mov qword [rbp - 0x11], rax
movabs rax, 0x59b374a93f84e7e6
mov qword [rbp - 0x71], rax
movabs rax, 0x6a800778bda4646f
mov qword [rbp - 0x69], rax
movabs rax, 0x98474037bc6acee8
mov qword [rbp - 0x61], rax
movabs rax, 0x2e2b544ed03bcb00
mov qword [rbp - 0x59], rax
movabs rax, 0xac75477b91a0eebb
mov qword [rbp - 0x51], rax
movabs rax, 0x6c00d3c5f6a8581f
mov qword [rbp - 0x49], rax
movups xmm1, xmmword [rbp - 0x71]
movups xmm2, xmmword [rbp - 0x61]
movups xmm3, xmmword [rbp - 0x51]
movdqa xmm0, xmmword [rbp - 0x39]
pxor xmm0, xmm1
movdqa xmmword [rbp - 9], xmm0
pxor xmm2, xmmword [rbp - 0x29]
movdqa xmmword [rbp + 7], xmm2
movdqa xmm0, xmmword [rbp - 0x19]
pxor xmm0, xmm3
movdqa xmmword [rbp + 0x17], xmm0
lea rdx, [rbp - 9]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rdx + rax*2], 0
jne 0x7ff70b5432b0
mov r9, rdi
cmp qword [rdi + 0x18], 8
jb 0x7ff70b5432c7
mov r9, qword [rdi]
cmp rcx, rax
jne 0x7ff70b54330d
lea rax, [rbp - 9]
test rcx, rcx
je 0x7ff70b543323
movzx edx, word [r9]
movzx r8d, word [rbp - 9]
cmp dx, r8w
jb 0x7ff70b54330d
lea r10, [rbp - 9]
sub r9, r10
cmp dx, r8w
ja 0x7ff70b54330d
cmp rcx, 1
je 0x7ff70b543323
dec rcx
add rax, 2
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jae 0x7ff70b5432ef
add r12, 0x48
add rdi, 0x48
cmp r12, r15
je 0x7ff70b543585
jmp 0x7ff70b543180
mov r9, qword [0x7ff70b6923c8]
test r9, r9
jne 0x7ff70b543569
xor esi, esi
mov edi, 0x6e477856
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
movups xmm0, xmmword [rax + 0x58]
movups xmmword [rsp + 0x38], xmm0
movd ecx, xmm0
sub cx, 8
test esi, esi
je 0x7ff70b5433b3
mov r9, qword [rbp - 0x79]
movzx ecx, cx
shr rcx, 1
lea r11, [r9 + rcx*2]
mov r10d, 0x811c9dc5
cmp r9, r11
je 0x7ff70b5433aa
nop
movsx ecx, byte [r9]
mov edx, ecx
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
add r9, 2
cmp r9, r11
jne 0x7ff70b543380
cmp r10d, esi
jne 0x7ff70b543516
mov rbx, qword [rax + 0x30]
test rbx, rbx
je 0x7ff70b54351e
movsxd rcx, dword [rbx + 0x3c]
mov rdx, qword [rcx + rbx + 0x88]
mov rcx, rdx
shr rcx, 0x20
mov qword [rbp + 0x6f], rcx
mov r15d, edx
add r15, rbx
cmp r15, rbx
je 0x7ff70b543516
mov r11d, dword [r15 + 0x18]
test r11d, r11d
je 0x7ff70b543516
mov r13d, dword [r15 + 0x20]
nop word [rax + rax]
dec r11d
lea rcx, [r11*4]
add rcx, r13
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0x811c9dc5
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x7ff70b54345b
nop word [rax + rax]
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x7ff70b543430
cmp r10d, edi
je 0x7ff70b54346d
test r11d, r11d
jne 0x7ff70b543400
mov rax, qword [rax]
jmp 0x7ff70b543350
mov ecx, dword [r15 + 0x1c]
add rcx, rbx
mov eax, dword [r15 + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov r8d, dword [rcx + rax*4]
add r8, rbx
cmp r8, r15
jbe 0x7ff70b543521
mov rax, qword [rbp + 0x6f]
add rax, r15
cmp r8, rax
jae 0x7ff70b543521
mov esi, 0x811c9dc5
mov edi, esi
movzx edx, byte [r8]
cmp dl, 0x2e
je 0x7ff70b5434d5
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, esi
imul esi, ecx, 0x1000193
inc r8
movzx edx, byte [r8]
cmp dl, 0x2e
jne 0x7ff70b5434b0
inc r8
movzx edx, byte [r8]
test dl, dl
je 0x7ff70b543505
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, edi
imul edi, ecx, 0x1000193
lea r8, [r8 + 1]
movzx edx, byte [r8]
test dl, dl
jne 0x7ff70b5434e0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rax, qword [rax]
jmp 0x7ff70b543350
xor r8d, r8d
mov qword [0x7ff70b6923c8], r8
nop dword [rax + rax]
rdtsc
shl rdx, 0x20
or rax, rdx
lea rcx, [rax + rax*4]
mov qword [0x7ff70b6923d0], rcx
cmp rcx, r8
je 0x7ff70b543530
mov r9, rcx
xor r9, r8
mov qword [0x7ff70b6923c8], r9
mov eax, ecx
xor eax, 0x6e477856
mov dword [0x7ff70b6923c0], eax
mov r13, qword [rbp + 0x67]
jmp 0x7ff70b543570
mov rcx, qword [0x7ff70b6923d0]
xor r9, rcx
mov r8d, dword [r12]
xor edx, edx
mov ecx, 0x1fffff
call r9
mov qword [r13 + 0x18], rax
mov r12, qword [rsp + 0x20]
test r12, r12
je 0x7ff70b543607
mov rbx, qword [rsp + 0x28]
cmp r12, rbx
je 0x7ff70b5435b6
nop dword [rax]
mov rcx, r12
call fcn.7ff70b5464a0
add r12, 0x48
cmp r12, rbx
jne 0x7ff70b5435a0
mov r12, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
sub rcx, r12
movabs rax, 0xe38e38e38e38e39
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rax, [rdx + rdx*8]
shl rax, 3
mov rcx, r12
cmp rax, 0x1000
jb 0x7ff70b5435fe
mov r12, qword [r12 - 8]
sub rcx, r12
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x7ff70b54362a
mov rcx, r12
call fcn.7ff70b4dd700
nop
cmp qword [r13 + 0x18], 0
setne al
mov rbx, qword [rsp + 0x130]
add rsp, 0xe0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.7ff70b5526b4
int3