Function at 0x1400378f0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0xa8]
sub rsp, 0x1a0
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movaps xmmword [rax - 0x38], xmm8
movaps xmmword [rax - 0x48], xmm9
movaps xmmword [rax - 0x58], xmm10
movaps xmmword [rax - 0x68], xmm11
movaps xmmword [rax - 0x78], xmm12
movaps xmmword [rax - 0x88], xmm13
mov rax, qword [0x14009d700]
xor rax, rsp
mov qword [rbp + 0x10], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
xor esi, esi
cmp dword [0x14009e0d8], 0x12
je 0x14002a34f
mov edi, dword [0x14009d6c8]
movdqa xmm10, xmmword [0x14008a450]
movdqa xmm8, xmmword [0x14008a480]
movdqa xmm13, xmmword [0x14008a400]
movdqa xmm9, xmmword [0x14008a3f0]
movdqa xmm12, xmmword [0x14008a470]
movdqa xmm11, xmmword [0x14008a420]
movdqa xmm7, xmmword [0x14008a4d0]
movss xmm6, dword [0x14008a304]
nop word [rax + rax]
mov rax, qword [0x14009e010]
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [0x14009e100]
lea rcx, [0x14009e0d0]
call rax
test eax, eax
je 0x140029dd3
lea rcx, [0x14009e0d0]
call qword [0x14009e018]
lea rcx, [0x14009e0d0]
call qword [0x14009e020]
mov rax, qword [0x14009e008]
mov ecx, 0x71
call rax
test al, 1
je 0x140029df3
cmp byte [0x14009df26], 0
sete byte [0x14009df26]
mov rax, qword [0x14009e008]
mov ecx, 0x77
call rax
test al, 1
jne 0x14002a444
call fcn.140044600
mov rbx, rax
mov rdx, qword [0x14009e028]
lea rcx, [rbp - 0x70]
call rdx
test eax, eax
je 0x140029e42
movd xmm1, dword [rbp - 0x6c]
cvtdq2ps xmm1, xmm1
movd xmm0, dword [rbp - 0x70]
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0xf0], xmm0
movss dword [rbx + 0xf4], xmm1
mov rax, qword [0x14009e030]
mov ecx, 1
call rax
shr eax, 0xf
and al, 1
mov byte [rbx + 0xf8], al
mov rax, qword [0x14009e030]
mov ecx, 2
call rax
shr eax, 0xf
and al, 1
mov byte [rbx + 0xf9], al
call fcn.140068ea0
call fcn.140069dd0
call fcn.14004c8b0
movups xmmword [rbp - 0x80], xmm8
lea rcx, [rbp - 0x80]
call fcn.140040df0
mov ebx, eax
mov dword [rsp + 0x40], 0x41200000
mov dword [rsp + 0x44], 0x41200000
movups xmm0, xmmword [str.ZZASEQLW]
movups xmmword [rsp + 0x50], xmm0
movzx ecx, word [0x140089df0]
mov word [rsp + 0x60], cx
movzx ecx, byte [0x140089df2]
mov byte [rsp + 0x62], cl
mov r8d, esi
cmp edi, 2
jl 0x140029fdd
movdqa xmmword [rsp + 0x70], xmm12
lea rcx, [rsp + 0x54]
mov edx, dword [rsp + 0x70]
nop dword [rax]
nop word [rax + rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm9
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm7
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm11
psubd xmm2, xmm0
andps xmm2, xmm10
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm9
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm7
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm11
psubd xmm2, xmm0
andps xmm2, xmm10
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x10
jl 0x140029ef0
cmp r8d, 0x13
jge 0x14002a020
movsxd rax, r8d
lea r9, [rsp + 0x50]
add r9, rax
nop dword [rax + rax]
mov eax, 0x4ec4ec4f
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x34
movzx eax, r8b
sub al, cl
add al, 0x33
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x13
jl 0x140029ff0
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x50], rsi
lea rax, [rsp + 0x50]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14002a040
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x68]
call fcn.140001730
nop
mov byte [rsp + 0x20], 0
mov r9d, ebx
movaps xmm2, xmm6
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x68]
call fcn.140037cf0
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
jbe 0x14002a0ae
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002a0a9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a436
call fcn.140082fa4
cmp byte [0x14009e0ba], 0
je 0x14002a2cd
mov dword [rsp + 0x48], 0x41200000
mov dword [rsp + 0x4c], 0x41c80000
call fcn.140044600
movss xmm3, dword [rax + 0xcc]
cvtps2pd xmm3, xmm3
movsd xmm0, qword [str.hree_r]
movsd qword [rsp + 0x30], xmm0
mov eax, dword [str._a7_]
mov dword [rsp + 0x38], eax
cmp byte [0x140089e03], 0
je 0x14002a220
mov r8d, esi
cmp edi, 2
jl 0x14002a1e5
movdqa xmm1, xmm9
punpckldq xmm1, xmm9
pmuldq xmm1, xmm7
movdqa xmm0, xmm9
punpckhdq xmm0, xmm9
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm11
movdqa xmm1, xmm9
psubd xmm1, xmm0
andps xmm1, xmm10
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd eax, xmm12
movd xmm0, eax
paddb xmm1, xmm0
movd xmm0, dword [str.hree_r]
xorps xmm1, xmm0
movd dword [rsp + 0x30], xmm1
movdqa xmm1, xmm13
punpckldq xmm1, xmm13
pmuldq xmm1, xmm7
movdqa xmm0, xmm13
punpckhdq xmm0, xmm13
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm11
movdqa xmm2, xmm13
psubd xmm2, xmm0
andps xmm2, xmm10
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, eax
paddb xmm2, xmm0
movd xmm1, dword [rsp + 0x34]
xorps xmm2, xmm1
movd dword [rsp + 0x34], xmm2
mov r8d, 8
movsxd rax, r8d
lea r9, [rsp + 0x30]
add r9, rax
mov eax, 0x4ec4ec4f
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x34
movzx eax, r8b
sub al, cl
add al, 0x33
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0xc
jl 0x14002a1f0
movaps xmm2, xmm3
movq r8, xmm3
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x30]
call fcn.140003f20
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x50], rsi
lea rax, [rbp - 0x30]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x14002a250
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x68]
call fcn.140001730
nop
movups xmmword [rsp + 0x70], xmm8
lea rcx, [rsp + 0x70]
call fcn.140040df0
mov byte [rsp + 0x20], 0
mov r9d, eax
movaps xmm2, xmm6
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x68]
call fcn.140037cf0
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
jbe 0x14002a2cd
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002a2c8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a43d
call fcn.140082fa4
cmp byte [0x14009df26], 0
je 0x14002a2db
call fcn.140013950
call fcn.140008b30
call fcn.14004e850
mov rcx, qword [0x14009e120]
mov rax, qword [rcx]
xor r9d, r9d
lea r8, [0x14009e128]
mov edx, 1
call qword [rax + pe_nt_image_headers64]
mov rcx, qword [0x14009e120]
mov rax, qword [rcx]
lea r8, [rbp - 0x48]
mov rdx, qword [0x14009e128]
call qword [rax + 0x190]
call fcn.140044250
mov rcx, rax
call fcn.140068ee0
mov rcx, qword [0x14009e118]
mov rax, qword [rcx]
xor r8d, r8d
mov edx, dword [0x14009d0b0]
call qword [rax + 0x40]
cmp dword [0x14009e0d8], 0x12
jne 0x140029d90
lea rcx, str.Rainmeter.exe
call fcn.140037c00
call fcn.140069b50
call fcn.14006a0e0
xor ecx, ecx
call fcn.140041d30
mov rcx, qword [0x14009e128]
test rcx, rcx
je 0x14002a385
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x14009e128], rsi
mov rcx, qword [0x14009e120]
test rcx, rcx
je 0x14002a39e
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x14009e120], rsi
mov rcx, qword [0x14009e110]
test rcx, rcx
je 0x14002a3b7
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x14009e110], rsi
mov rcx, qword [0x14009e118]
test rcx, rcx
je 0x14002a3d0
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x14009e118], rsi
mov rcx, qword [0x14009e100]
test rcx, rcx
je 0x14002a3e9
call qword [sym.imp.USER32.dll_DestroyWindow]
mov qword [0x14009e100], rsi
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.140083480
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm12, xmmword [r11 - 0x70]
movaps xmm13, xmmword [r11 - 0x80]
mov rsp, r11
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rcx, str.Rainmeter.exe
call fcn.140037c00
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x1400379a9
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x1400379a9
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
mov r10d, 0xee3dc988
lea rcx, [r14 + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
movzx ecx, byte [r9]
inc r9
test cl, cl
je 0x1400379a4
nop
movsx edx, cl
lea r9, [r9 + 1]
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
movzx ecx, byte [r9 - 1]
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
test cl, cl
jne 0x140037970
cmp r10d, 0xb79a9fa1
je 0x1400379b1
test r11d, r11d
jne 0x140037950
mov rax, qword [rax]
jmp 0x140037920
mov rax, qword gs:[0x60]
mov ecx, dword [rsi + 0x24]
add rcx, rbx
mov rax, qword [rax + 0x18]
movzx edx, word [rcx + r11*2]
mov ecx, dword [rsi + 0x1c]
mov rax, qword [rax + 0x10]
add rcx, rbx
mov ebp, dword [rcx + rdx*4]
add rbp, rbx
nop dword [rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x140037a6a
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x140037a6a
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
mov r10d, 0x13ba8da
lea rcx, [r14 + r11*4]
mov r8d, dword [rcx + rbx]
add r8, rbx
movzx r9d, byte [r8]
inc r8
test r9b, r9b
je 0x140037a65
movsx ecx, r9b
lea r8, [r8 + 1]
sub r9b, 0x41
mov edx, ecx
or edx, 0x20
cmp r9b, 0x19
movzx r9d, byte [r8 - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r9b, r9b
jne 0x140037a30
cmp r10d, 0xa81f59af
je 0x140037a72
test r11d, r11d
jne 0x140037a10
mov rax, qword [rax]
jmp 0x1400379e0
mov ecx, dword [rsi + 0x24]
add rcx, rbx
movzx edx, word [rcx + r11*2]
mov ecx, dword [rsi + 0x1c]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
add rax, rbx
call rax
xor edx, edx
mov rcx, rax
call rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp 0x140029cd0