Function at 0x1401339d0
Capabilities:
Contain obfuscated stackstrings
Execute syscall
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
jg 0x140133042
add byte [rax], al
jae 0x14013339c
cli
push rbx
scasd eax, dword [rdi]
scasd eax, dword [rdi]
xor eax, 0xb9410000
mov dl, 0xab
jrcxz 0x140133383
test r11, rbx
popf
mul r9
jmp rcx
sar bh, 1
loopne 0x140133564
mov esi, 0xfffd90e9
invalid
and al, 0x44
mul byte [rsi - 0x39]
and al, 0x4a
jl 0x14013356f
mov al, 0
add byte [rax], al
div dh
div dh
add ah, cl
jmp 0x14013373b
mov qword [rsp + 0x20], r9
xchg rdx, r8
mov qword [rsp + 0x18], rdx
jne 0x1401339f6
je 0x1401339f6
test ebx, 0x6472d726
syscall
call rcx
dec rsi
jb 0x140133d25
movabs r14, 0x63e7280408462beb
add r11d, 0xd209f552
add ecx, 0x99499a1b
test rbp, rdi
div rsi
push r13
lea ecx, [rcx - 0x1157]
rol esi, 0x91
syscall
jmp 0x14013332f
jmp 0x140133a23
xchg rdx, r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x28
jmp 0x140133a3d
jmp 0x140133aa3
lea rax, [0x140133d30]
xchg r15, rax
mov qword [rsp + 0x18], r15
xchg r15, rax
mov dword [rsp + 8], 0
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x10], rax
jne 0x140133a6c
je 0x140133a6c
or r14d, 0x290b7b22
movabs rdi, 0x1ed4fefa238dcaeb
cmp r9d, 0x90df3940
jg 0x140133994
jmp 0x140133a38
cmp ebx, 0x4a1b0e02
jno 0x140133034
jmp 0x140132bfb
mov rax, qword [rsp + 0x10]
inc rax
xchg r13, rax
mov qword [rsp + 0x10], r13
xchg r13, rax
mov eax, dword [rsp + 0x38]
je 0x140133ade
jne 0x140133ade
jmp 0x140133d17
jmp 0x140133afd
xchg rcx, r15
mov r15, qword [rsp + 0x30]
xchg r15, rcx
add rcx, rax
xchg r11, rcx
mov rax, r11
je 0x140133b2c
jne 0x140133b2c
lea r14d, [rdi + 0xf3bf]
test rcx, rcx
ror edx, 0xb0
je 0x1401346a3
cpuid
movabs r13, 0x452cf6165d9812eb
ror r11d, 0xac
ror r11d, 0x2b
dec r8
ret
jmp 0x140133b40
xchg r11, rcx
cmp qword [rsp + 0x10], rax
jae 0x140133d27
mov byte [rsp], 0
mov dword [rsp + 4], 0
jmp 0x140133b69
mov eax, dword [rsp + 4]
inc eax
mov dword [rsp + 4], eax
mov eax, dword [rsp + 0x50]
jmp 0x140133c0c
mov ecx, dword [rsp + 4]
xchg rdx, rsi
mov rsi, qword [rsp + 0x48]
jne 0x140133bae
je 0x140133bae
jmp rax
jmp 0x140133bcb
xchg rsi, rdx
mov ecx, dword [rdx + rcx*4]
xchg rdx, rsi
jmp 0x140133bd9
mov rsi, qword [rsp + 0x40]
xchg rsi, rdx
add rcx, qword [rdx + rax*8]
mov rax, rcx
cmp qword [rsp + 0x10], rax
jae 0x140133c4b
je 0x140133bfe
jne 0x140133bfe
pop rcx
ror r15d, 0xfe
movabs r14, 0x72e64bbc68a71feb
jmp 0x140133c1f
cmp dword [rsp + 4], eax
jae 0x140133c50
mov eax, dword [rsp + 4]
jmp 0x140133c28
mov byte [rsp], 1
jmp 0x140133c50
xchg r15, rcx
mov r15, qword [rsp + 0x40]
xchg rcx, r15
mov rax, qword [rcx + rax*8]
cmp qword [rsp + 0x10], rax
jb 0x140133c4b
mov eax, dword [rsp + 4]
jmp 0x140133b72
jmp 0x140133b5f
movzx eax, byte [rsp]
test eax, eax
je 0x140133c7c
jne 0x140133c6c
je 0x140133c6c
lea ecx, [rbx - 0x2a3b]
rcl r15d, 0x14
movabs rbp, 0x69066f7d737a09eb
ret 0x20
jmp 0x140133c77
jmp 0x140133a92
xor edx, edx
mov eax, dword [rsp + 8]
mov ecx, 0x20
div ecx
jmp 0x140133ca2
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x10]
mov byte [rcx], al
mov eax, dword [rsp + 8]
jmp 0x140133ce6
mov eax, edx
mov eax, eax
mov rcx, qword [rsp + 0x18]
je 0x140133cd5
jne 0x140133cd5
pause
push r8
rcr ebp, 0x3b
cmp r8, rdx
jmp 0x140133cf1
inc eax
mov dword [rsp + 8], eax
jmp 0x140133a92
movzx eax, byte [rcx + rax]
mov rcx, qword [rsp + 0x10]
movzx ecx, byte [rcx]
jne 0x140133d03
je 0x140133d03
movabs rcx, 0x7d03ca1e58ee89eb
ror ebx, 0xc8
xor r13d, 0x6c60cc2e
lea esi, [rdi - 0x694a]
lea r12d, [rbx + 0xcb32]
jmp 0x140133518
jmp 0x140133c8e
mov dh, 0x96
invalid
invalid
add rsp, 0x28
ret
cli
cmp dword [0x199937b4d], edi
xor al, 0x30
or dl, byte [rdx + 0x6d9c168]
jle 0x1401346ce
mov bh, 0xc6
shr byte [ebp - 0x1e], 1
test byte [rdx - 0x94f5cd8], ch
shl byte [0x191f42a5d], 1
invalid
push rdi
or ch, cl
scasb al, byte [rdi]
mov dh, 0xe7
not r12
invalid