Function at 0x14001c090
Capabilities:
Access peb ldr_data
Encode data using xor
Get kernel32 base address
Get number of processors
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0xa0
mov rax, qword [0x1401310c0]
xor rax, rsp
mov qword [rbp + 0x2f], rax
xor r14d, r14d
mov dword [rbp - 1], 0x30
mov qword [rbp - 9], r14
xorps xmm0, xmm0
mov dword [rbp - 0x11], r14d
mov qword [rbp + 7], r14
mov dword [rbp + 0x17], r14d
mov qword [rbp + 0xf], r14
movdqu xmmword [rbp + 0x1f], xmm0
mov rax, qword gs:[0x60]
mov qword [rbp - 0x31], r14
mov qword [rbp - 0x29], r14
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax]
mov rax, qword [0x140134b28]
mov r10, qword [rcx + 0x30]
test rax, rax
jne 0x14001c197
movsxd rax, dword [r10 + 0x3c]
mov r11d, r14d
mov edi, dword [rax + r10 + 0x88]
mov esi, dword [rdi + r10 + 0x20]
nop dword [rax + rax]
mov ebx, r11d
mov r9d, 0x12f4926c
lea rax, [r10 + rbx*4]
mov r8d, dword [rax + rsi]
add r8, r10
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x14001c171
nop
movsx eax, dl
lea r8, [r8 + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [r8 - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test dl, dl
jne 0x14001c140
cmp r9d, 0x96b4dca
je 0x14001c176
inc r11d
jmp 0x14001c120
mov ecx, dword [rdi + r10 + 0x24]
add rcx, r10
movzx edx, word [rcx + rbx*2]
mov ecx, dword [rdi + r10 + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov qword [0x140134b28], rax
xor r9d, r9d
lea r8, [rbp - 1]
mov edx, 0x1f000f
lea rcx, [rbp - 9]
call rax
test eax, eax
js 0x14001cbee
mov rax, qword gs:[0x60]
mov qword [rsp + 0xe0], r15
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax]
mov rax, qword [0x140134b08]
mov r10, qword [rcx + 0x30]
test rax, rax
jne 0x14001c277
movsxd rax, dword [r10 + 0x3c]
mov r11d, r14d
mov edi, dword [rax + r10 + 0x88]
mov esi, dword [rdi + r10 + 0x20]
nop word [rax + rax]
mov ebx, r11d
mov r9d, 0xc17b5ea9
lea rax, [rsi + rbx*4]
mov r8d, dword [rax + r10]
add r8, r10
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x14001c251
nop
movsx eax, dl
lea r8, [r8 + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [r8 - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test dl, dl
jne 0x14001c220
cmp r9d, 0xbd14f4ee
je 0x14001c256
inc r11d
jmp 0x14001c200
mov ecx, dword [rdi + r10 + 0x24]
add rcx, r10
movzx edx, word [rcx + rbx*2]
mov ecx, dword [rdi + r10 + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov qword [0x140134b08], rax
mov r9d, 4
lea rcx, [rbp - 0x11]
mov qword [rsp + 0x20], rcx
lea r8, [rbp - 0x11]
mov rcx, qword [rbp - 9]
lea edx, [r9 - 2]
call rax
mov edx, dword [rbp - 0x11]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
test r15, r15
jne 0x14001c375
mov r10, qword [rax + 0x30]
mov rax, qword [0x140134a10]
test rax, rax
jne 0x14001c368
movsxd rax, dword [r10 + 0x3c]
mov ebx, dword [rax + r10 + 0x88]
mov edi, dword [rbx + r10 + 0x20]
nop
mov r11d, r14d
mov r9d, 0xda4f79ed
lea rax, [rdi + r11*4]
mov r8d, dword [rax + r10]
add r8, r10
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x14001c341
nop
movsx eax, dl
lea r8, [r8 + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [r8 - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test dl, dl
jne 0x14001c310
cmp r9d, 0xcf125d6d
je 0x14001c346
inc r14d
jmp 0x14001c2f0
mov ecx, dword [rbx + r10 + 0x24]
add rcx, r10
movzx edx, word [rcx + r11*2]
mov ecx, dword [rbx + r10 + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov qword [0x140134a10], rax
mov rcx, qword [rbp - 9]
call rax
xor al, al
jmp 0x14001c7f0
mov r11, qword [rax + 0x30]
mov rax, qword [0x140134b20]
test rax, rax
jne 0x14001c419
movsxd rax, dword [r11 + 0x3c]
mov r10d, r14d
mov edi, dword [rax + r11 + 0x88]
mov esi, dword [rdi + r11 + 0x20]
nop dword [rax]
mov ebx, r10d
mov r9d, 0x86d64304
lea rax, [rsi + rbx*4]
mov r8d, dword [rax + r11]
add r8, r11
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x14001c3f1
nop
movsx eax, dl
lea r8, [r8 + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [r8 - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test dl, dl
jne 0x14001c3c0
cmp r9d, 0xb8b453b9
je 0x14001c3f6
inc r10d
jmp 0x14001c3a0
mov ecx, dword [rdi + r11 + 0x24]
add rcx, r11
movzx r8d, word [rcx + rbx*2]
mov ecx, dword [rdi + r11 + 0x1c]
add rcx, r11
mov eax, dword [rcx + r8*4]
add rax, r11
mov qword [0x140134b20], rax
mov r9d, dword [rbp - 0x11]
lea rcx, [rbp - 0x11]
mov qword [rsp + 0x20], rcx
mov r8, r15
mov rcx, qword [rbp - 9]
mov edx, 2
call rax
mov r11d, dword [r15 + 0x14]
mov ebx, 0xb8
cmp r11d, 1
je 0x14001c605
mov r9, qword [r15 + 8]
test r9, r9
je 0x14001c605
lea r10, [0x140103d60]
sub r10, r9
nop
movzx ecx, word [r9 + r10]
lea eax, [rcx - 0x41]
cmp eax, 0x19
ja 0x14001c473
lea r8d, [rcx + 0x20]
jmp 0x14001c491
lea eax, [rcx - 0xc0]
cmp eax, 0x1f
ja 0x14001c484
lea r8d, [rcx + 0x20]
jmp 0x14001c491
cmp ecx, 0xa8
mov r8d, ecx
cmove r8d, ebx
movzx edx, word [r9]
lea eax, [rdx - 0x41]
cmp eax, 0x19
ja 0x14001c4a2
lea eax, [rdx + 0x20]
jmp 0x14001c4bd
lea eax, [rdx - 0xc0]
cmp eax, 0x1f
ja 0x14001c4b2
lea eax, [rdx + 0x20]
jmp 0x14001c4bd
cmp edx, 0xa8
mov eax, edx
cmove eax, ebx
cmp r8d, eax
jne 0x14001c4d7
test cx, cx
je 0x14001c4d2
test dx, dx
je 0x14001c4d7
add r9, 2
jmp 0x14001c460
test dx, dx
je 0x14001c52b
lea eax, [rcx - 0x41]
cmp eax, 0x19
ja 0x14001c4e4
add ecx, 0x20
jmp 0x14001c4fd
lea eax, [rcx - 0xc0]
cmp eax, 0x1f
ja 0x14001c4f4
add ecx, 0x20
jmp 0x14001c4fd
cmp ecx, 0xa8
cmove ecx, ebx
lea eax, [rdx - 0x41]
cmp eax, 0x19
ja 0x14001c50a
add edx, 0x20
jmp 0x14001c523
lea eax, [rdx - 0xc0]
cmp eax, 0x1f
ja 0x14001c51a
add edx, 0x20
jmp 0x14001c523
cmp edx, 0xa8
cmove edx, ebx
cmp ecx, edx
jne 0x14001c605
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax]
mov rax, qword [0x140134af8]
mov r10, qword [rcx + 0x30]
test rax, rax
jne 0x14001c5f8
movsxd rax, dword [r10 + 0x3c]
mov ebx, dword [rax + r10 + 0x88]
mov edi, dword [rbx + r10 + 0x20]
nop word [rax + rax]
mov r11d, r14d
mov r9d, 0xcfc6eb8e
lea rax, [r10 + r11*4]
mov r8d, dword [rax + rdi]
add r8, r10
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x14001c5d1
nop
movsx eax, dl
lea r8, [r8 + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [r8 - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test dl, dl
jne 0x14001c5a0
cmp r9d, 0x3e8a3800
je 0x14001c5d6
inc r14d
jmp 0x14001c580
mov ecx, dword [rbx + r10 + 0x24]
add rcx, r10
movzx edx, word [rcx + r11*2]
mov ecx, dword [rbx + r10 + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov qword [0x140134af8], rax
mov rcx, qword [rbp - 9]
call rax
mov al, 1
jmp 0x14001c7f0
mov qword [rsp + 0xd0], r12
xor edx, edx
mov r12d, dword [r15 + 0x10]
mov r8d, 0x8000
mov qword [rsp + 0xd8], r13
mov rcx, r15
mov qword [rbp - 0x21], r12
mov r13, r11
mov qword [rbp - 0x19], r11
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax]
mov rax, qword [0x140134aa0]
mov r11, qword [rcx + 0x30]
test rax, rax
jne 0x14001c6ec
movsxd rax, dword [r11 + 0x3c]
mov r10d, r14d
mov edi, dword [rax + r11 + 0x88]
mov esi, dword [rdi + r11 + 0x20]
mov ebx, r10d
mov r9d, 0xfcd8fbd3
lea rax, [rsi + rbx*4]
mov edx, dword [rax + r11]
add rdx, r11
movzx r8d, byte [rdx]
inc rdx
test r8b, r8b
je 0x14001c6c6
movsx eax, r8b
lea rdx, [rdx + 1]
sub r8b, 0x41
mov ecx, eax
or ecx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rdx - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test r8b, r8b
jne 0x14001c691
cmp r9d, 0xa95f901c
je 0x14001c6cb
inc r10d
jmp 0x14001c671
mov ecx, dword [rdi + r11 + 0x24]
add rcx, r11
movzx edx, word [rcx + rbx*2]
mov ecx, dword [rdi + r11 + 0x1c]
add rcx, r11
mov eax, dword [rcx + rdx*4]
add rax, r11
mov qword [0x140134aa0], rax
mov r9d, 4
lea rcx, [rbp - 0x11]
mov qword [rsp + 0x20], rcx
lea r8, [rbp - 0x11]
xor ecx, ecx
lea edx, [r9 - 1]
call rax
mov edx, dword [rbp - 0x11]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
test r15, r15
jne 0x14001c812
mov r10, qword [rax + 0x30]
mov rax, qword [0x140134a70]
test rax, rax
jne 0x14001c7d8
movsxd rax, dword [r10 + 0x3c]
mov ebx, dword [rax + r10 + 0x88]
mov edi, dword [rbx + r10 + 0x20]
mov r11d, r14d
mov r9d, 0x3618636f
lea rax, [rdi + r11*4]
mov r8d, dword [rax + r10]
add r8, r10
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x14001c7b1
movsx eax, dl
lea r8, [r8 + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [r8 - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test dl, dl
jne 0x14001c780
cmp r9d, 0xb3c7283
je 0x14001c7b6
inc r14d
jmp 0x14001c761
mov ecx, dword [rbx + r10 + 0x24]
add rcx, r10
movzx edx, word [rcx + r11*2]
mov ecx, dword [rbx + r10 + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov qword [0x140134a70], rax
mov rcx, qword [rbp - 9]
call rax
xor al, al
mov r13, qword [rsp + 0xd8]
mov r12, qword [rsp + 0xd0]
mov r15, qword [rsp + 0xe0]
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.1400ab310
add rsp, 0xa0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov r11, qword [rax + 0x30]
mov rax, qword [0x140134ad8]
test rax, rax
jne 0x14001c8bd
movsxd rax, dword [r11 + 0x3c]
mov r10d, r14d
mov edi, dword [rax + r11 + 0x88]
mov esi, dword [rdi + r11 + 0x20]
nop word [rax + rax]
mov ebx, r10d
mov r9d, 0x62694c2d
lea rax, [rsi + rbx*4]
mov edx, dword [rax + r11]
add rdx, r11
movzx r8d, byte [rdx]
inc rdx
test r8b, r8b
je 0x14001c895
movsx eax, r8b
lea rdx, [rdx + 1]
sub r8b, 0x41
mov ecx, eax
or ecx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rdx - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test r8b, r8b
jne 0x14001c860
cmp r9d, 0x3ca53af2
je 0x14001c89a
inc r10d
jmp 0x14001c840
mov ecx, dword [rdi + r11 + 0x24]
add rcx, r11
movzx r8d, word [rcx + rbx*2]
mov ecx, dword [rdi + r11 + 0x1c]
add rcx, r11
mov eax, dword [rcx + r8*4]
add rax, r11
mov qword [0x140134ad8], rax
mov r9d, dword [rbp - 0x11]
mov r8, r15
mov edx, 3
mov qword [rsp + 0x20], r14
mov rcx, 0xffffffffffffffff
call rax
test eax, eax
jns 0x14001c9b4
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax]
mov rax, qword [0x140134ab8]
mov r10, qword [rcx + 0x30]
test rax, rax
jne 0x14001c998
movsxd rax, dword [r10 + 0x3c]
mov ebx, dword [rax + r10 + 0x88]
mov edi, dword [rbx + r10 + 0x20]
nop dword [rax + rax]
mov r11d, r14d
mov r9d, 0xa4cc44d6
lea rax, [rdi + r11*4]
mov r8d, dword [rax + r10]
add r8, r10
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x14001c971
nop
movsx eax, dl
lea r8, [r8 + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [r8 - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test dl, dl
jne 0x14001c940
cmp r9d, 0x9cfdade8
je 0x14001c976
inc r14d
jmp 0x14001c920
mov ecx, dword [rbx + r10 + 0x24]
add rcx, r10
movzx edx, word [rcx + r11*2]
mov ecx, dword [rbx + r10 + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov qword [0x140134ab8], rax
mov rcx, qword [rbp - 9]
call rax
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x14001c7de
mov eax, dword [r15]
lea r11, [r15 + 8]
test eax, eax
je 0x14001cb06
mov edi, eax
mov r12, r14
mov r13, r14
nop dword [rax + rax]
mov rbx, qword [r11 + 8]
mov r9, rbx
test rbx, rbx
je 0x14001cad2
lea r10, str.DebugObject
sub r10, rbx
nop word [rax + rax]
movzx ecx, word [r10 + r9]
mov esi, 0xb8
lea eax, [rcx - 0x41]
cmp eax, 0x19
ja 0x14001ca08
lea r8d, [rcx + 0x20]
jmp 0x14001ca26
lea eax, [rcx - 0xc0]
cmp eax, 0x1f
ja 0x14001ca19
lea r8d, [rcx + 0x20]
jmp 0x14001ca26
cmp ecx, 0xa8
mov r8d, ecx
cmove r8d, esi
movzx edx, word [r9]
lea eax, [rdx - 0x41]
cmp eax, 0x19
ja 0x14001ca37
lea eax, [rdx + 0x20]
jmp 0x14001ca52
lea eax, [rdx - 0xc0]
cmp eax, 0x1f
ja 0x14001ca47
lea eax, [rdx + 0x20]
jmp 0x14001ca52
cmp edx, 0xa8
mov eax, edx
cmove eax, esi
cmp r8d, eax
jne 0x14001ca6c
test cx, cx
je 0x14001ca67
test dx, dx
je 0x14001ca6c
add r9, 2
jmp 0x14001c9f0
test dx, dx
je 0x14001cabc
lea eax, [rcx - 0x41]
cmp eax, 0x19
ja 0x14001ca79
add ecx, 0x20
jmp 0x14001ca92
lea eax, [rcx - 0xc0]
cmp eax, 0x1f
ja 0x14001ca89
add ecx, 0x20
jmp 0x14001ca92
cmp ecx, 0xa8
cmove ecx, esi
lea eax, [rdx - 0x41]
cmp eax, 0x19
ja 0x14001ca9f
add edx, 0x20
jmp 0x14001cab8
lea eax, [rdx - 0xc0]
cmp eax, 0x1f
ja 0x14001caaf
add edx, 0x20
jmp 0x14001cab8
cmp edx, 0xa8
cmove edx, esi
cmp ecx, edx
jne 0x14001cad2
mov eax, dword [r11 + 0x14]
test eax, eax
je 0x14001cac7
add r12, rax
mov eax, dword [r11 + 0x10]
test eax, eax
je 0x14001cad2
add r13, rax
movzx ecx, word [r11 + 2]
add rcx, rbx
mov rax, rcx
and rax, 0xfffffffffffffff8
cmp rax, rcx
lea r11, [rax + 8]
cmove r11, rax
sub rdi, 1
jne 0x14001c9d0
mov qword [rbp - 0x29], r13
mov r13, qword [rbp - 0x19]
mov qword [rbp - 0x31], r12
mov r12, qword [rbp - 0x21]
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax]
mov rax, qword [0x140134ae0]
mov r10, qword [rcx + 0x30]
test rax, rax
jne 0x14001cbc8
movsxd rax, dword [r10 + 0x3c]
mov ebx, dword [rax + r10 + 0x88]
mov edi, dword [rbx + r10 + 0x20]
mov r11d, r14d
mov r9d, 0x45647c80
lea rax, [rdi + r11*4]
mov r8d, dword [rax + r10]
add r8, r10
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x14001cba1
nop
movsx eax, dl
lea r8, [r8 + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [r8 - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test dl, dl
jne 0x14001cb70
cmp r9d, 0x5664ea86
je 0x14001cba6
inc r14d
jmp 0x14001cb50
mov ecx, dword [rbx + r10 + 0x24]
add rcx, r10
movzx edx, word [rcx + r11*2]
mov ecx, dword [rbx + r10 + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov qword [0x140134ae0], rax
mov rcx, qword [rbp - 9]
call rax
mov rax, qword [rbp - 0x31]
cmp rax, 1
jb 0x14001cbe7
cmp rax, r13
jb 0x14001cbe7
cmp qword [rbp - 0x29], r12
jae 0x14001c7de
mov al, 1
jmp 0x14001c7e0
xor al, al
jmp 0x14001c7f8