Function at 0x1400042a0
Capabilities:
Access peb ldr_data
Encode data using xor
Get disk information
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r13
push r14
lea rbp, [rsp - 0x140]
sub rsp, 0x240
mov rax, qword [0x14007c040]
xor rax, rsp
mov qword [rbp + 0x130], rax
mov rsi, rcx
mov qword [rsp + 0x40], rcx
xor r10d, r10d
call fcn.140003760
movsx edi, al
mov dword [rsp + 0x50], edi
call fcn.140003750
movsx eax, al
mov r14d, eax
mov dword [rsp + 0x4c], eax
imul r14d, edi
call fcn.140003790
movsx r12d, al
xor edx, edx
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
movsx ecx, byte [reloc.OLEAUT32.dll_VariantClear]
lea r13d, [r12 + r14*8]
add r13d, r14d
add eax, r13d
div ecx
movsx ecx, byte [0x14007c0db]
sub eax, ecx
je 0x140004c9d
movsx eax, byte [0x14007c0da]
mov ecx, r10d
mov qword [rsp + 0x278], rbx
lea ebx, [r10 + 7]
mov qword [rsp + 0x280], r15
lea r15d, [r12 + r14*2]
movd xmm1, eax
movsx eax, byte [0x14007c0dc]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
mov eax, dword [0x14007d2c0]
cmp dword [0x14007d2c4], eax
cvtdq2pd xmm0, xmm0
setg cl
add r15d, r14d
xor edx, edx
mov dword [rsp + 0x48], r15d
addsd xmm0, xmm0
subsd xmm1, xmm0
xorps xmm0, xmm0
cvtsi2sd xmm0, rcx
mulsd xmm1, xmm0
movsd qword [rsp + 0x40], xmm1
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
movsx ecx, byte [reloc.OLEAUT32.dll_VariantClear]
add eax, r15d
div ecx
movsx ecx, byte [0x14007c0db]
cmp eax, ecx
je 0x1400043ee
call fcn.140003770
movsx edx, al
movsx eax, byte [0x14007d2e0]
imul edx, eax
shl edx, 3
call fcn.1400037a0
movsx ecx, al
sub edx, ecx
call fcn.140003780
movsx ecx, al
add edx, ecx
movsx ecx, byte [0x14007c0dc]
add ecx, edx
je 0x1400043ee
mov r9d, ebx
jmp 0x14000444d
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
lea ecx, [r14 + r12]
lea ecx, [rcx + r14*4]
xor edx, edx
add eax, ecx
movsx ecx, byte [reloc.OLEAUT32.dll_VariantClear]
div ecx
movsx ecx, byte [0x14007c0db]
cmp eax, ecx
je 0x140004448
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
xor edx, edx
movsx ecx, byte [reloc.OLEAUT32.dll_VariantClear]
add eax, r13d
div ecx
movsx ecx, byte [0x14007c0db]
xorps xmm0, xmm0
sub eax, ecx
cvtsi2sd xmm0, rax
mulsd xmm0, qword [rsp + 0x40]
cvttsd2si r9d, xmm0
jmp 0x14000444d
mov r9d, dword [rsp + 0x48]
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
xor edx, edx
movsx ecx, byte [reloc.OLEAUT32.dll_VariantClear]
add eax, r12d
lea eax, [rax + r14*4]
div ecx
movsx ecx, byte [0x14007c0db]
sub eax, ecx
imul eax, r9d
test eax, eax
je 0x140004c8d
xor eax, eax
mov dword [rbp - 0x60], 0x83848586
mov dword [rbp - 0x4c], eax
xorps xmm0, xmm0
mov byte [rbp - 0x48], al
movabs r9, 0x5ba3d80004d96041
movups xmmword [rbp - 0x5c], xmm0
mov qword [rsp + 0x40], r10
mov rax, qword [rsp + 0x40]
nop word [rax + rax]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x40]
add rcx, r9
movzx edx, byte [rbp + rax - 0x60]
mov rax, rcx
and rax, rdx
imul r8, rax, 0xfffffffffffffffe
mov rax, qword [rsp + 0x40]
add r8, rcx
add r8, rdx
add r8b, 0x39
mov byte [rbp + rax - 0x60], r8b
mov rax, qword [rsp + 0x40]
inc rax
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
cmp rax, 0x19
jb 0x1400044b0
mov eax, dword [rbp - 0x60]
lea edx, [r14 + r14*2]
mov dword [rbp + 0x24], eax
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
movsx ecx, byte [reloc.OLEAUT32.dll_VariantClear]
add eax, r12d
lea eax, [rax + rdx*2]
xor edx, edx
div ecx
movsx ecx, byte [0x14007c0db]
cmp eax, ecx
je 0x140004a86
xor eax, eax
mov dword [rbp - 0x40], 0x83848586
mov qword [rbp - 0x2c], rax
xorps xmm0, xmm0
mov byte [rbp - 0x24], al
movups xmmword [rbp - 0x3c], xmm0
mov qword [rsp + 0x40], r10
mov rax, qword [rsp + 0x40]
nop word [rax + rax]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x40]
add rcx, 0x11e41
movzx edx, byte [rbp + rax - 0x40]
mov rax, rcx
and rax, rdx
imul r8, rax, 0xfffffffffffffffe
mov rax, qword [rsp + 0x40]
add r8, rcx
add r8, rdx
add r8b, 0x39
mov byte [rbp + rax - 0x40], r8b
mov rax, qword [rsp + 0x40]
inc rax
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
cmp rax, 0x1d
jb 0x140004550
xor eax, eax
mov dword [rbp - 0x20], 0xa3a2adac
mov qword [rbp - 0xc], rax
xorps xmm0, xmm0
mov byte [rbp - 4], al
movups xmmword [rbp - 0x1c], xmm0
mov qword [rsp + 0x40], r10
mov rax, qword [rsp + 0x40]
nop dword [rax]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x40]
add rcx, 0x11e46
movzx edx, byte [rbp + rax - 0x20]
mov rax, rcx
and rax, rdx
imul r8, rax, 0xfffffffffffffffe
mov rax, qword [rsp + 0x40]
add r8, rcx
add r8, rdx
add r8b, 0x16
mov byte [rbp + rax - 0x20], r8b
mov rax, qword [rsp + 0x40]
inc rax
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
cmp rax, 0x1d
jb 0x1400045c0
xor eax, eax
mov dword [rsp + 0x60], 0x734c6d2b
mov qword [rsp + 0x68], rax
movabs r9, 0xfcb2830374fd26e
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x64], 0x7776712c
mov qword [rsp + 0x40], r10
mov rax, qword [rsp + 0x40]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x40]
add rcx, r9
movzx edx, byte [rsp + rax + 0x60]
mov rax, rcx
and rax, rdx
imul r8, rax, 0xfffffffffffffffe
mov rax, qword [rsp + 0x40]
add r8, rcx
add r8, rdx
sub r8b, 2
mov byte [rsp + rax + 0x60], r8b
mov rax, qword [rsp + 0x40]
inc rax
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
cmp rax, 0x14
jb 0x140004640
mov eax, dword [rbp - 0x40]
lea r9, [rbp + 0x24]
mov r8d, dword [rbp - 0x20]
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x38], eax
xor edx, edx
mov qword [rsp + 0x30], r10
mov qword [rsp + 0x28], r10
mov qword [rsp + 0x20], r10
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
xor edx, edx
movd xmm2, eax
movsx eax, byte [0x14007c0da]
cvtdq2pd xmm2, xmm2
movd xmm1, eax
movsx eax, byte [0x14007c0dc]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm0
subsd xmm1, xmm0
mulsd xmm1, xmm2
movsd qword [rsp + 0x40], xmm1
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
movsx ecx, byte [reloc.OLEAUT32.dll_VariantClear]
add eax, r15d
div ecx
movsx ecx, byte [0x14007c0db]
cmp eax, ecx
je 0x14000473f
call fcn.140003770
movsx edx, al
movsx eax, byte [0x14007d2e0]
imul edx, eax
shl edx, 3
call fcn.1400037a0
movsx ecx, al
sub edx, ecx
call fcn.140003780
movsx ecx, al
add edx, ecx
movsx ecx, byte [0x14007c0dc]
add ecx, edx
jne 0x14000479c
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
lea ecx, [r14 + r12]
lea ecx, [rcx + r14*4]
xor edx, edx
add eax, ecx
movsx ecx, byte [reloc.OLEAUT32.dll_VariantClear]
div ecx
movsx ecx, byte [0x14007c0db]
cmp eax, ecx
je 0x140004798
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
xor edx, edx
movsx ecx, byte [reloc.OLEAUT32.dll_VariantClear]
add eax, r13d
div ecx
movsx ecx, byte [0x14007c0db]
xorps xmm0, xmm0
sub eax, ecx
cvtsi2sd xmm0, rax
mulsd xmm0, qword [rsp + 0x40]
cvttsd2si ebx, xmm0
jmp 0x14000479c
mov ebx, dword [rsp + 0x48]
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
xor edx, edx
imul ecx, r14d, 7
add ecx, r12d
add eax, ecx
movsx ecx, byte [reloc.OLEAUT32.dll_VariantClear]
div ecx
movsx ecx, byte [0x14007c0db]
sub eax, ecx
imul eax, ebx
test eax, eax
je 0x140004a83
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r15, qword [rax]
mov rdi, r15
nop dword [rax]
nop word [rax + rax]
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140004868
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140004868
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
mov edx, 0xca38a76d
lea rax, [r11 + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140004863
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x140004840
cmp edx, 0x4da40864
je 0x140004a23
test r8d, r8d
jne 0x140004820
mov rax, qword [rdi]
mov rdi, rax
cmp rax, r15
je 0x14000487e
cmp qword [rax + 0x30], 0
jne 0x1400047f0
xor r8d, r8d
xor eax, eax
mov dword [rbp - 0x80], 0x235c454d
mov qword [rbp - 0x6b], rax
xorps xmm0, xmm0
mov byte [rbp - 0x63], al
movabs r10, 0x5a2dd873f7f2b96d
movups xmmword [rbp - 0x7b], xmm0
mov byte [rbp - 0x7c], 0x8a
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x40]
add rcx, r10
movzx edx, byte [rbp + rax - 0x80]
mov rax, rcx
and rax, rdx
imul r9, rax, 0xfffffffffffffffe
mov rax, qword [rsp + 0x40]
add r9, rcx
add r9, rdx
add r9b, 5
mov byte [rbp + rax - 0x80], r9b
mov rax, qword [rsp + 0x40]
inc rax
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
cmp rax, 0x1e
jb 0x1400048b0
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x30]
call fcn.14005dea0
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
xorps xmm2, xmm2
movsx ecx, byte [reloc.OLEAUT32.dll_VariantClear]
add eax, r12d
mov r9d, dword [rsp + 0x4c]
mov edx, r9d
mov edi, dword [rsp + 0x50]
mov r15d, dword [rsp + 0x48]
imul edx, edi
lea eax, [rax + rdx*4]
xor edx, edx
div ecx
movsx ecx, byte [0x14007c0db]
xor edx, edx
sub eax, ecx
cvtsi2sd xmm2, rax
movsx eax, byte [0x14007c0da]
movd xmm1, eax
movsx eax, byte [0x14007c0dc]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm0
subsd xmm1, xmm0
mulsd xmm1, xmm2
movsd qword [rsp + 0x40], xmm1
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
movsx ecx, byte [reloc.OLEAUT32.dll_VariantClear]
add eax, r15d
div ecx
movsx ecx, byte [0x14007c0db]
cmp eax, ecx
je 0x1400049ca
call fcn.140003770
movsx edx, al
movsx eax, byte [0x14007d2e0]
imul edx, eax
shl edx, 3
call fcn.1400037a0
movsx ecx, al
sub edx, ecx
call fcn.140003780
movsx ecx, al
add edx, ecx
movsx ecx, byte [0x14007c0dc]
add ecx, edx
jne 0x140004a4e
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
lea ecx, [r14 + r12]
lea ecx, [rcx + r14*4]
xor edx, edx
add eax, ecx
movsx ecx, byte [reloc.OLEAUT32.dll_VariantClear]
div ecx
movsx ecx, byte [0x14007c0db]
cmp eax, ecx
je 0x140004a40
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
xor edx, edx
movsx ecx, byte [reloc.OLEAUT32.dll_VariantClear]
add eax, r13d
div ecx
movsx ecx, byte [0x14007c0db]
xorps xmm0, xmm0
sub eax, ecx
cvtsi2sd xmm0, rax
mulsd xmm0, qword [rsp + 0x40]
cvttsd2si eax, xmm0
jmp 0x140004a44
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov r8d, dword [rcx + rdx*4]
add r8, r9
jmp 0x140004881
mov eax, dword [rsp + 0x48]
xor r10d, r10d
cmp r10d, eax
jge 0x140004a8b
jmp 0x140004a51
xor r10d, r10d
xorps xmm0, xmm0
lea rax, [rbp + 0x30]
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r10
mov r8, 0xffffffffffffffff
mov qword [rsi + 0x18], r10
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140004a70
lea rdx, [rbp + 0x30]
jmp 0x140004c82
xor r10d, r10d
mov r9d, dword [rsp + 0x4c]
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
xor edx, edx
movsx ecx, byte [reloc.OLEAUT32.dll_VariantClear]
add eax, r12d
imul edi, r9d
xorps xmm2, xmm2
lea eax, [rax + rdi*4]
div ecx
movsx ecx, byte [0x14007c0db]
xor edx, edx
sub eax, ecx
cvtsi2sd xmm2, rax
movsx eax, byte [0x14007c0da]
movd xmm1, eax
movsx eax, byte [0x14007c0dc]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm0
subsd xmm1, xmm0
mulsd xmm1, xmm2
movsd qword [rsp + 0x40], xmm1
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
movsx ecx, byte [reloc.OLEAUT32.dll_VariantClear]
add eax, r15d
div ecx
movsx ecx, byte [0x14007c0db]
cmp eax, ecx
je 0x140004b40
call fcn.140003770
movsx edx, al
movsx eax, byte [0x14007d2e0]
imul edx, eax
shl edx, 3
call fcn.1400037a0
movsx ecx, al
sub edx, ecx
call fcn.140003780
movsx ecx, al
add edx, ecx
movsx ecx, byte [0x14007c0dc]
add ecx, edx
jne 0x140004be1
call fcn.140003760
movsx edx, al
call fcn.140003750
movsx ecx, al
imul edx, ecx
lea r9d, [rdx + rdx*4]
call fcn.140003790
movsx ecx, byte [reloc.OLEAUT32.dll_VariantCopy]
xor edx, edx
movsx eax, al
add eax, r9d
add eax, ecx
movsx ecx, byte [reloc.OLEAUT32.dll_VariantClear]
div ecx
movsx ecx, byte [0x14007c0db]
cmp eax, ecx
je 0x140004bd4
call fcn.140003760
movsx edx, al
call fcn.140003750
movsx ecx, al
imul edx, ecx
lea r9d, [rdx + rdx*8]
call fcn.140003790
movsx ecx, byte [reloc.OLEAUT32.dll_VariantCopy]
xor edx, edx
movsx eax, al
xorps xmm0, xmm0
add eax, r9d
add eax, ecx
movsx ecx, byte [reloc.OLEAUT32.dll_VariantClear]
div ecx
movsx ecx, byte [0x14007c0db]
sub eax, ecx
cvtsi2sd xmm0, rax
mulsd xmm0, qword [rsp + 0x40]
cvttsd2si eax, xmm0
jmp 0x140004bd8
mov eax, dword [rsp + 0x48]
cmp r10d, eax
jge 0x140004c8d
xor eax, eax
mov byte [rbp], gethostname
mov qword [rbp + 0x11], rax
xorps xmm0, xmm0
mov word [rbp + 0x19], ax
mov byte [rbp + 0x1b], al
movups xmmword [rbp + 1], xmm0
mov qword [rsp + 0x40], r10
mov rax, qword [rsp + 0x40]
cmp rax, 0x1c
jae 0x140004c5b
movabs r9, 0x4713e687e287
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x40]
add rcx, r9
movzx edx, byte [rbp + rax]
mov rax, rcx
and rax, rdx
imul r8, rax, 0xfffffffffffffffe
mov rax, qword [rsp + 0x40]
add r8, rcx
add r8, rdx
add r8b, 0x4f
mov byte [rbp + rax], r8b
mov rax, qword [rsp + 0x40]
inc rax
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
cmp rax, 0x1c
jb 0x140004c13
xorps xmm0, xmm0
lea rax, [rbp]
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r10
mov r8, 0xffffffffffffffff
mov qword [rsi + 0x18], r10
inc r8
cmp byte [rax + r8], 0
jne 0x140004c74
lea rdx, [rbp]
mov rcx, rsi
call fcn.140002480
mov rax, rsi
mov rbx, qword [rsp + 0x278]
mov r15, qword [rsp + 0x280]
mov rcx, qword [rbp + 0x130]
xor rcx, rsp
call fcn.14006f780
mov rsi, qword [rsp + 0x288]
add rsp, 0x240
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret