Function at 0x140131000
Capabilities:
Access peb ldr_data
Execute anti-debugging instructions
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
movabs byte [0x1bcc9d615c3df7b6], al
rcr bh, 0xe4
fisttp word [r10 + 0x1b799218]
movsb byte [rdi], byte [rsi]
call 0x15a1d61f0
add eax, ebp
xchg edx, edx
jo 0x140130874
mov al, 6
sub eax, 0xf92a10e5
movsb byte [rdi], byte [rsi]
movsd dword [rdi], dword [rsi]
invalid
or byte [rsi + 0x7a3b4bff], ch
mov cs, ebx
xchg edx, eax
invalid
xor eax, 0x488bad85
invalid
adc dword [rbp - 0x2a], eax
push rsp
xor al, ah
push rdx
pop rbp
jo 0x140130a2b
add dword [rsi - 0x7f], ebp
outsb dx, byte [rsi]
retf 0xb994
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
mov qword [rsp + 0x20], r9
xchg r14, r8
mov qword [rsp + 0x18], r14
je 0x14013102c
jne 0x14013102c
ja 0x140131b7e
rcl esi, 0x3a
jmp 0x140130a62
jmp 0x14013106a
call rcx
mov ebp, 0x97bd9d75
jle 0x140131bae
jmp 0x140131faa
mov r11, qword [r10 + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov ebx, dword [rax + r11 + 0x88]
mov r10d, dword [rbx + r11 + 0x20]
nop dword [rax + rax]
jmp 0x140131139
xchg r14, r8
xchg r15, rdx
mov qword [rsp + 0x10], r15
xchg r15, rdx
xchg r8, rcx
mov qword [rsp + 8], r8
xchg r8, rcx
jmp 0x140131182
lea rbp, [rsp - 0x2b8]
sub rsp, 0x3b8
mov rax, qword gs:[0x60]
xor r13d, r13d
mov r8d, r13d
jmp 0x140131191
nop
sub rsp, 8
mov qword [rsp], rbx
push rdi
nop
jmp 0x1401310bb
sub rsp, 8
mov qword [rsp], r13
push r14
nop
sub rsp, 8
mov qword [rsp], r15
jne 0x1401310ed
je 0x1401310ed
lea r13d, [rbp + 0xa336]
rcr r13d, 0x85
lea r10d, [rcx - 0x73c]
lea r9d, [rcx + 0xcdf]
movabs r14, 0x52658a1b159199eb
test r8, rdi
syscall
mov edx, 0xb4fe41e0
jmp rcx
jmp 0x140131088
je 0x1401311ce
inc r8d
jmp 0x140131139
add rcx, r11
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140131115
nop dword [rax]
movsx eax, al
jmp 0x1401311ab
mov r9d, r8d
mov edx, 0xaf710d4c
lea rax, [r10 + r9*4]
mov ecx, dword [rax + r11]
je 0x140131158
jne 0x140131158
jne 0x140131a7f
syscall
ret
jmp 0x14013111d
nop
mov qword [rsp - 8], rbp
sub rsp, 8
jmp 0x1401310ab
mov r10, qword [rax + 0x18]
xchg rsi, rax
mov rsi, qword [r10 + 0x10]
xchg rsi, rax
xchg r12, r10
mov r12, qword [rax]
xchg r12, r10
jmp 0x14013104b
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x140131131
cmp edx, 0xeb8fbdbf
jmp 0x14013110f
mov rax, qword gs:[0x60]
mov r8d, r13d
mov ecx, dword [rbx + r11 + 0x24]
add rcx, r11
jmp 0x1401312e0
inc rcx
test al, al
je 0x1401312fc
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
jmp 0x140131304
xchg r14, rax
mov r14, qword [rcx + 0x10]
xchg r14, rax
xchg rbx, rcx
mov rbx, qword [rax]
xchg rcx, rbx
mov r9, qword [rcx + 0x30]
jmp 0x14013129c
nop dword [rax + rax]
mov r10d, r8d
mov edx, 0x4078ad54
lea rax, [r9 + r10*4]
mov ecx, dword [rax + r11]
add rcx, r9
sbb byte [rcx + 3], cl
leave
movzx eax, byte [rcx]
je 0x140131286
jne 0x140131286
test ebp, 0xfa8ba4e
lea r11d, [rbx + 0x7598]
sub r13d, 0x9e1abb94
cmp r14, rbx
jmp rax
jmp 0x1401311e7
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
mov r11d, dword [rbx + r9 + 0x20]
je 0x1401312ca
jne 0x1401312ca
mov ecx, 0xea59b3b1
pushf
cpuid
test ecx, 0xbb32933
lea r9d, [rbp + 0x1f18]
int3
jmp 0x14013121d
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + r11 + 0x1c]
add rcx, r11
mov edi, dword [rcx + rdx*4]
mov rcx, qword [rax + 0x18]
add rdi, r11
jmp 0x140131203
inc r8d
jmp 0x140131222
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x1401311f5
cmp edx, 0xb6ef69d8
je 0x140131327
jmp 0x1401312fc
mov rax, qword gs:[0x60]
mov r8d, r13d
mov ecx, dword [rbx + r9 + 0x24]
add rcx, r9
movzx edx, word [rcx + r10*2]
jmp 0x140131353
je 0x1401314a3
inc r8d
jmp 0x140131466
mov ecx, dword [rbx + r9 + 0x1c]
add rcx, r9
mov r15d, dword [rcx + rdx*4]
xchg rcx, rdi
mov rdi, qword [rax + 0x18]
xchg rcx, rdi
add r15, r9
jmp 0x140131371
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax]
xchg r9, r10
je 0x1401313b0
jne 0x1401313b0
rcr esi, 0x49
div r8
mov ebx, 0x5f9ec349
call rcx
and r9d, 0x9f09c33d
jae 0x140131d54
lea r8d, [rcx + 0x644d]
cmp r8, rcx
jne 0x140131e0d
call rcx
test r8, rdi
movabs r9, 0x255b9600000095e9
ret
jmp 0x14013144a
mov edx, 0x397663b8
lea rax, [r11 + r10*4]
mov ecx, dword [rax + r9]
je 0x140131403
jne 0x140131403
rol r13d, 0x25
call rax
mov r15d, 0xc71405fc
call rcx
call rax
rcl r12d, 0xbd
popf
cmp rbp, rbp
lea r12d, [rbp + 0x663e]
cmp r10, rbp
call rcx
push r15
dec r11
movabs rsi, 0x25f81c00000085e9
rcr esi, 0xff
inc rsi
lea ebp, [rcx - 0xd83a]
rcl r12d, 0x5c
rcl esi, 0x62
jmp rax
jmp 0x14013148d
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
jmp 0x14013146e
mov r10, qword [rcx + 0x30]
xchg r10, r9
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
mov r11d, dword [rbx + r9 + 0x20]
nop dword [rax]
mov r10d, r8d
jmp 0x1401313c6
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x14013143e
cmp edx, 0x221100a3
jmp 0x140131345
add rcx, r9
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x14013134b
jmp 0x14013143b
mov ecx, dword [rbx + r9 + 0x24]
xor r8d, r8d
add rcx, r9
jmp 0x140131643
xchg r13, r12
lea r9, [rbp + 0xd0]
mov qword [rbp + 0xd0], 0x1f400000
mov rcx, 0xffffffffffffffff
call rdi
cmp qword [rsp + 0x48], r13
je 0x140134621
jmp 0x140131624
mov ecx, dword [rbx + r9 + 0x1c]
add rcx, r9
mov r14d, dword [rcx + rdx*4]
lea rdx, [rsp + 0x48]
add r14, r9
xchg r13, r12
mov qword [rsp + 0x48], r12
jne 0x140131539
je 0x140131539
bswap r10
jg 0x140132255
cmp rbp, rbp
jle 0x140131231
rol r15d, 0xa9
js 0x140131f3f
lea r8d, [rdx - 0x495b]
call rcx
test r13, rdi
popf
rol r11d, 0xba
rcr r12d, 0x8e
jmp rax
jmp 0x1401314b3
inc rcx
test al, al
je 0x1401316f0
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
je 0x1401315b2
jne 0x1401315b2
cpuid
rol edi, 0x78
xor r15d, 0xba301cd0
test r13d, 0x62cec4ba
call rax
or edx, 0xba8366
test ebx, 0x137dbb38
mul r12
cmp r13d, 0x10381a44
jmp rcx
jmp 0x1401316cd
mov rcx, qword [rax]
mov r9, qword [rcx + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
mov r11d, dword [rbx + r9 + 0x20]
nop word [rax + rax]
jne 0x140131611
je 0x140131611
and r11d, 0x5c9ec418
ret
jmp 0x14013166b
mov rax, qword gs:[0x60]
mov r8d, r13d
xchg r11, rcx
mov r11, qword [rax + 0x18]
xchg r11, rcx
mov rax, qword [rcx + 0x10]
jmp 0x1401315cc
mov dword [rsp + 0x28], 4
xchg r12, rsi
mov qword [rsp + 0x3b0], r12
xchg rsi, r12
mov dword [rsp + 0x20], 0x3000
movzx edx, word [rcx + r10*2]
jmp 0x1401314e1
mov r10d, r8d
mov edx, 0x96fe8b66
lea rax, [r11 + r10*4]
mov ecx, dword [rax + r9]
add rcx, r9
movzx eax, byte [rcx]
je 0x1401316b8
jne 0x1401316b8
add r10d, 0x350d6463
pop r8
neg r14
lea r15d, [rdi + 0xc6c8]
jmp rcx
jmp 0x14013155c
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x14013156a
jmp 0x1401316e4
cmp edx, 0x2db7b98b
je 0x1401316f8
inc r8d
jmp 0x14013166b
mov rax, qword gs:[0x60]
mov r8d, r13d
mov ecx, dword [rbx + r9 + 0x24]
add rcx, r9
movzx edx, word [rcx + r10*2]
mov ecx, dword [rbx + r9 + 0x1c]
add rcx, r9
je 0x14013171f
jne 0x14013171f
movabs r11, 0x57a365000000c5e9
rcr ebp, 0x8e
call rax
jae 0x140130a7c
jmp 0x1401317e9
rcr r14d, 0x4c
call rcx
neg r11
jmp 0x1401324a9
test al, al
je 0x140131789
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
jmp 0x140131771
add byte [rax], al
add byte [rdx - 0x75], al
or al, 8
mov ecx, dword [rax + r9]
add rcx, r9
movzx eax, byte [rcx]
inc rcx
jmp 0x140131740
movzx eax, byte [rcx - 1]
test al, al
jne 0x14013174b
cmp edx, 0xe55c37ce
je 0x140131873
inc r8d
jmp 0x140131796
nop dword [rax + rax]
mov r10d, r8d
mov edx, 0xa7ed5d08
lea rax, [r11 + r10*4]
jne 0x1401317d3
je 0x1401317d3
popfq
call rax
rcr edx, 0x55
jge 0x140130e86
bswap r11
rcr esi, 0x49
jmp rcx
jmp 0x14013175f
mov esi, dword [rcx + rdx*4]
mov rcx, qword [rax + 0x18]
add rsi, r9
mov rax, qword [rcx + 0x10]
mov eax, dword [rcx + 0x10]
xchg rcx, r9
mov r9, qword [rax]
jmp 0x140131818
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
mov r11d, dword [rbx + r9 + 0x20]
jmp 0x140131791
xchg rcx, r9
xchg r11, r9
mov r11, qword [rcx + 0x30]
xchg r9, r11
jne 0x14013184f
je 0x14013184f
mov r8d, 0x4a15a116
bswap rdi
neg rdx
jl 0x140130845
test r8d, 0x909b1b50
popf
call rax
jmp rcx
jmp 0x140131802
mov ecx, dword [rbx + r9 + 0x24]
xorps xmm0, xmm0
add rcx, r9
mov qword [rsp + 0x20], r13
movzx edx, word [rcx + r10*2]
jne 0x1401318d2
je 0x1401318d2
add r15d, 0x58a5f4f6
lea ebx, [rdi - 0x8134]
mov r14d, 0xd55ba78a
cmp esi, 0x17f7f655
call rax
cmp r12d, 0x828245ef
lea r8d, [rcx - 0xa0ee]
call rax
sub esi, 0x3f18e2c0
xor r10d, 0x910edec2
call rax
test r11, rbp
popfq
xor edi, 0xf2aeecae
movabs rsi, 0x7782bf00000217e9
add r12d, 0x491ed767
dec r13
ret
jmp 0x140131aee
xchg r12, r9
lea r8, [rbp + 0xd0]
xchg r13, rsi
jmp 0x140131bf7
mov rcx, qword [rbp + 0xd0]
add rcx, r10
cmp r10, rcx
jae 0x140131a86
movabs r11, 0x47ae147ae147ae15
nop word [rax + rax]
rdtsc
jmp 0x140131b08
movdqu xmmword [rdx + 0x108], xmm0
xchg rbp, rdx
xchg rcx, r13
mov qword [rsp + 0x30], rcx
xchg r13, rcx
jmp 0x1401319d4
shl rdx, 1
or rax, rdx
mov r8, rax
jmp 0x140131c75
call rsi
test eax, eax
jne 0x140134621
mov rax, qword [rsp + 0x30]
jne 0x1401319e9
je 0x1401319e9
movabs rdx, 0x4626cc00000185e9
ror edx, 0xe9
jno 0x140131034
jmp 0x140131b73
lea ebx, [rbx + 0x8d2b]
pushfq
call 0x140131d6d
xchg rsi, rcx
mov rsi, qword [rsp + 0x30]
xchg rsi, rcx
call rdi
jmp 0x140131b1d
jb 0x140131a21
mov rbx, r9
mov rcx, qword [rsp + 0x48]
sub r10, 0x75005b42
jmp 0x140131a6f
xchg r8, rax
and r9d, 0xfff
add r9, r10
mov byte [r9], 0xc3
test rbx, rbx
je 0x140131a1e
rdtsc
jmp 0x140131baa
add rcx, rdx
shr rcx, 4
shr rcx, 1
shr rcx, 1
imul rcx, rcx, 0x64
sub r8, rcx
cmp r8, 0x4b
jmp 0x140131a18
add r10, 0x75006b42
add rcx, qword [rbp + 0xd0]
cmp r10, rcx
jb 0x14013193e
ror dword [rdi], 1
invalid
lea rax, [rbp + 0x20]
mov dword [rbp + 0x20], r13d
mov r9d, 0x20
je 0x140131acd
jne 0x140131acd
jmp 0x140130cfd
jmp 0x140131cd1
mov ecx, dword [rbx + r9 + 0x1c]
add rcx, r9
mov edi, dword [rcx + rdx*4]
lea rdx, [rbp + 0xe8]
add rdi, r9
jmp 0x140131b53
shl rdx, 0x19
shl rdx, 7
or rax, rdx
xchg r8, rax
mov r9, r8
jmp 0x140131a32
test eax, eax
jne 0x140134621
mov r9d, 0x8000
xchg r12, r9
mov qword [rsp + 0x3a8], r9
jmp 0x1401318e5
mov qword [rbp + 0xe8], 0x30
mov r9d, 0x64
xchg rcx, r13
mov qword [rbp + 0x100], rcx
jmp 0x140131c12
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x140134621
add byte [rax], al
xchg r11, r10
mov r11, qword [rsp + 0x48]
xchg r11, r10
mov rbx, r13
jmp 0x140131917
shl rdx, 0xd
shl rdx, 0xd
shl rdx, 5
je 0x140131bda
jne 0x140131bda
inc r8
pushfq
lea ebx, [rbp - 0xbb5]
test r14d, 0x50b21992
neg r8
lea esi, [rbp + 0xb3d4]
rol r13d, 0x67
movabs r15, 0x562d9ffffffde7e9
jno 0x140131fcc
jmp 0x1401319c6
test edi, 0x4cfbb5c6
lea r14d, [rbp - 0xc2b7]
jmp 0x140131c39
mov qword [rbp + 0xd0], rsi
xchg rsi, r13
lea rdx, [rsp + 0x48]
mov rcx, 0xffffffffffffffff
jmp 0x140131cb8
xchg r13, rcx
mov r8d, r9d
mov qword [rbp + 0xf0], r13
lea rcx, [rsp + 0x30]
mov qword [rbp + 0xf8], r13
xchg rdx, rbp
jmp 0x1401319ab
lea edx, [rdx + 1]
mov r13, r8
xchg r13, rcx
sub rcx, rdx
shr rcx, 1
jmp 0x140131a52
mov rax, r11
mul r8
xchg r13, rcx
jne 0x140131ca2
je 0x140131ca2
lea edi, [rdi + 0xebb9]
pushfq
ror ebp, 0xbf
jp 0x140132a93
lea r14d, [rbx - 0x8a0d]
test r15, rcx
rcr r14d, 0x1a
movabs rcx, 0x6434d4bd5d08a7eb
lea ebx, [rbx + 0x9253]
mul rbp
jmp 0x14013175c
jmp 0x140131c4b
call r15
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
jmp 0x140131d5b
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0xd0]
mov rcx, 0xffffffffffffffff
lea rdx, [rsp + 0x48]
jne 0x140131d2d
je 0x140131d2d
jns 0x140131bf7
pop r14
jnp 0x140132b29
jne 0x140131fb8
mov ecx, 0x669b9c78
jmp rcx
jmp 0x140131d47
call r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rbx
jmp 0x140131a06
nop dword [rax]
test dword [0x14f6a5f69], edx
cmp dword [rsi - 0xc], 0xc141ffff
invalid
invalid
div dh
div dh
mov dword [rsp + 0x6c], 0x81596f78
mov dword [rsp + 0x60], 0xf6f6f6f6
jmp 0x14013239c
fmul qword [rdi]
xor ecx, 0xfffffffa
invalid
mov dword [rsp + 0x70], 0x71787378
mov word [rsp + 0x64], 0xf6f6
mov dword [rsp + 0x74], 0x7f7d38
mov byte [rsp + 0x66], 0xf6
jmp 0x140132494
nop word [rax + rax]
loopne 0x140132a95
add byte [rax], al
add al, 0
add byte [rax + 0x35fe940], ch
add byte [rax], al
mov eax, 0xffffffff
jmp 0x140133f8d