Function at 0x140018620
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x150]
sub rsp, 0x250
mov rax, qword [0x140090040]
xor rax, rsp
mov qword [rbp + 0x140], rax
mov qword [rsp + 0x48], rdx
mov r13, rcx
mov qword [rbp - 0x68], rcx
mov dword [rsp + 0x44], 1
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
xor r12d, r12d
mov qword [rcx], r12
mov qword [rcx + 8], r12
mov qword [rcx + 0x10], r12
mov dword [rsp + 0x44], 1
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov r15, qword [rcx + 0x10]
mov r14, r15
nop dword [rax]
nop dword [rax + rax]
mov r11, qword [r14 + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov esi, dword [rax + r11 + 0x88]
add rsi, r11
cmp rsi, r11
je 0x140018729
mov r10d, dword [rsi + 0x18]
test r10d, r10d
je 0x140018729
mov edi, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r10d
lea rax, [rdi + r10*4]
mov r8d, dword [rax + r11]
add r8, r11
mov r9d, 0x811c9dc5
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x140018724
nop
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
movzx edx, byte [r8]
lea r8, [r8 + 1]
test dl, dl
jne 0x1400186f0
cmp r9d, 0x856fdf55
je 0x140018948
test r10d, r10d
jne 0x1400186d0
mov rax, qword [r14]
mov r14, rax
cmp rax, r15
je 0x14001873f
cmp qword [rax + 0x30], 0
jne 0x1400186a0
mov rbx, r12
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rdx + 0x10]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, 2
jb 0x140018eb1
mov r9, rdx
cmp qword [rdx + 0x18], 0xf
jbe 0x14001876f
mov r9, qword [rdx]
mov qword [rsp + 0x30], 2
lea rax, [0x140081a1c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x58]
call fcn.140005b10
mov esi, 9
mov dword [rsp + 0x44], esi
lea rcx, [rsp + 0x58]
cmp qword [rsp + 0x70], 0xf
cmova rcx, qword [rsp + 0x58]
lea rdx, [rbp]
call rbx
mov rbx, rax
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x1400187f8
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400187f3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018eb7
call fcn.1400491b0
movdqa xmm0, xmmword [0x140084880]
movdqu xmmword [rsp + 0x68], xmm0
mov byte [rsp + 0x58], 0
cmp rbx, 0xffffffffffffffff
je 0x140018e7e
mov ebx, dword [0x140090090]
test byte [rbp], 0x10
jne 0x140018cad
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], r12
lea rax, [rbp + 0x2c]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140018840
lea rdx, [rbp + 0x2c]
lea rcx, [rbp - 0x60]
call fcn.1400055d0
nop
mov rax, qword [rbp - 0x50]
lea rcx, [rax - 3]
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], r12
cmp rax, rcx
jb 0x140018eab
sub rax, rcx
mov r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 0xf
cmova rdx, qword [rbp - 0x60]
add rdx, rcx
lea rcx, [rbp - 0x40]
call fcn.1400055d0
or esi, 2
mov dword [rsp + 0x44], esi
mov eax, dword [str.XZQ7]
mov dword [rsp + 0x40], eax
cmp byte [0x140083ae3], 0
je 0x1400189a0
cmp ebx, 2
jl 0x140018964
movdqa xmm3, xmmword [0x140084890]
movdqa xmm2, xmm3
punpckldq xmm2, xmm3
pmuldq xmm2, xmmword [0x140084990]
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmmword [0x140084990]
shufps xmm2, xmm0, 0xdd
psrad xmm2, 4
movdqa xmm0, xmm2
psrld xmm0, 0x1f
paddd xmm0, xmm2
pmulld xmm0, xmmword [0x1400848b0]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140084950]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x140084970]
movd xmm0, eax
xorps xmm2, xmm0
movd dword [rsp + 0x40], xmm2
jmp 0x1400189a0
mov ecx, dword [rsi + 0x1c]
add rcx, r11
mov eax, dword [rsi + 0x24]
add rax, r11
movzx eax, word [rax + r10*2]
mov ebx, dword [rcx + rax*4]
add rbx, r11
jmp 0x140018742
lea r9, [rsp + 0x40]
mov r8d, r12d
nop dword [rax]
mov eax, 0x4d4873ed
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x35
movzx eax, r8b
sub al, cl
add al, 0x34
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 4
jl 0x140018970
lea rcx, [rsp + 0x40]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x1400189b0
lea rcx, [rbp - 0x40]
mov r14, qword [rbp - 0x28]
cmp r14, 0xf
seta r15b
mov rbx, qword [rbp - 0x40]
cmova rcx, rbx
mov rdi, qword [rbp - 0x30]
cmp rdi, rax
jne 0x1400189ef
mov r8, rdi
lea rdx, [rsp + 0x40]
call fcn.14006f670
test eax, eax
je 0x140018b12
mov eax, dword [0x140083b24]
mov dword [rsp + 0x40], eax
cmp byte [0x140083b27], 0
je 0x140018ad0
cmp dword [0x140090090], 2
jl 0x140018a8d
movdqa xmm3, xmmword [0x140084890]
movdqa xmm2, xmm3
punpckldq xmm2, xmm3
pmuldq xmm2, xmmword [0x140084990]
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmmword [0x140084990]
shufps xmm2, xmm0, 0xdd
psrad xmm2, 4
movdqa xmm0, xmm2
psrld xmm0, 0x1f
paddd xmm0, xmm2
pmulld xmm0, xmmword [0x1400848b0]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140084950]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x140084970]
movd xmm0, eax
xorps xmm2, xmm0
movd dword [rsp + 0x40], xmm2
jmp 0x140018ad0
lea r9, [rsp + 0x40]
mov r8d, r12d
nop word [rax + rax]
mov eax, 0x4d4873ed
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x35
movzx eax, r8b
sub al, cl
add al, 0x34
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 4
jl 0x140018aa0
lea rcx, [rsp + 0x40]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140018ae0
lea rcx, [rbp - 0x40]
test r15b, r15b
cmovne rcx, rbx
cmp rdi, rax
jne 0x140018c3b
mov r8, rdi
lea rdx, [rsp + 0x40]
call fcn.14006f670
test eax, eax
jne 0x140018c3b
movzx eax, word [0x1400838fc]
mov word [rsp + 0x40], ax
cmp byte [0x1400838fd], 0
je 0x140018b31
mov byte [rsp + 0x40], 0x5c
xor byte [rsp + 0x41], 0x35
lea r8, [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x78]
call fcn.1400051b0
nop
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 0xf
cmova rdx, qword [rbp - 0x60]
mov r8, qword [rbp - 0x50]
mov rcx, rax
call fcn.140004e50
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x10], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
or esi, 4
mov dword [rsp + 0x44], esi
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x140018bc1
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140018bbc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018ebd
call fcn.1400491b0
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], 0xf
mov byte [rsp + 0x78], 0
mov rax, qword [r13 + 8]
cmp rax, qword [r13 + 0x10]
je 0x140018bef
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.140004900
add qword [r13 + 8], 0x20
jmp 0x140018bff
lea r8, [rbp - 0x20]
mov rdx, rax
mov rcx, r13
call fcn.1400064c0
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x140018c3b
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140018c35
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018ec3
call fcn.1400491b0
nop
test r15b, r15b
je 0x140018c72
lea rdx, [r14 + 1]
cmp rdx, 0x1000
mov rax, rbx
jb 0x140018c69
mov rbx, qword [rbx - 8]
sub rax, rbx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018ec9
mov rcx, rbx
call fcn.1400491b0
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x140018cad
inc rdx
mov rcx, qword [rbp - 0x60]
cmp rdx, 0x1000
mov rax, rcx
jb 0x140018ca8
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018ecf
call fcn.1400491b0
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov r15, qword [rcx + 0x10]
mov r14, r15
nop dword [rax]
nop word [rax + rax]
mov r11, qword [r14 + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov esi, dword [rax + r11 + 0x88]
add rsi, r11
cmp rsi, r11
je 0x140018d53
mov r10d, dword [rsi + 0x18]
test r10d, r10d
je 0x140018d53
mov edi, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r10d
lea rax, [rdi + r10*4]
mov r8d, dword [rax + r11]
add r8, r11
mov r9d, 0x811c9dc5
movzx eax, byte [r8]
inc r8
test al, al
je 0x140018d4e
nop
movsx ecx, al
sub al, 0x41
mov edx, ecx
or edx, 0x20
cmp al, 0x19
cmova edx, ecx
xor edx, r9d
imul r9d, edx, 0x1000193
movzx eax, byte [r8]
lea r8, [r8 + 1]
test al, al
jne 0x140018d20
cmp r9d, 0xd8afde98
je 0x140018d85
test r10d, r10d
jne 0x140018d00
mov rax, qword [r14]
mov r14, rax
cmp rax, r15
je 0x140018d69
cmp qword [rax + 0x30], 0
jne 0x140018cd0
mov r8, r12
lea rdx, [rbp]
mov rcx, qword [rsp + 0x50]
call r8
test eax, eax
je 0x140018d9f
mov esi, dword [rsp + 0x44]
jmp 0x140018815
mov ecx, dword [rsi + 0x1c]
add rcx, r11
mov eax, dword [rsi + 0x24]
add rax, r11
movzx eax, word [rax + r10*2]
mov r8d, dword [rcx + rax*4]
add r8, r11
jmp 0x140018d6c
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov r15, qword [rcx + 0x10]
mov r14, r15
nop dword [rax]
nop word [rax + rax]
mov r11, qword [r14 + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov esi, dword [rax + r11 + 0x88]
add rsi, r11
cmp rsi, r11
je 0x140018e45
mov r10d, dword [rsi + 0x18]
test r10d, r10d
je 0x140018e45
mov edi, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r10d
lea rax, [r11 + r10*4]
mov r8d, dword [rax + rdi]
add r8, r11
mov r9d, 0x811c9dc5
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x140018e40
nop
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
movzx edx, byte [r8]
lea r8, [r8 + 1]
test dl, dl
jne 0x140018e10
cmp r9d, 0x5e63e2e6
je 0x140018e5d
test r10d, r10d
jne 0x140018df0
mov rax, qword [r14]
mov r14, rax
cmp rax, r15
je 0x140018e75
cmp qword [rax + 0x30], 0
jne 0x140018dc0
jmp 0x140018e75
mov ecx, dword [rsi + 0x1c]
add rcx, r11
mov eax, dword [rsi + 0x24]
add rax, r11
movzx eax, word [rax + r10*2]
mov r12d, dword [rcx + rax*4]
add r12, r11
mov rcx, qword [rsp + 0x50]
call r12
nop
mov rax, r13
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.140049190
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x250
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400092b0
nop
call fcn.140002430
int3
call fcn.1400500ac
nop
call fcn.1400500ac
nop
call fcn.1400500ac
nop
call fcn.1400500ac
nop
call fcn.1400500ac
int3