Function at 0x140016690
Capabilities:
Access peb ldr_data
Authenticate hmac
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x1400d0040]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov rsi, rcx
mov qword [rbp - 0x10], rcx
xor r15d, r15d
mov dword [rbp + 0x30], 0x68
xorps xmm0, xmm0
movups xmmword [rbp + 0x38], xmm0
movups xmmword [rbp + 0x48], xmm0
movups xmmword [rbp + 0x58], xmm0
movups xmmword [rbp + 0x68], xmm0
movups xmmword [rbp + 0x78], xmm0
movups xmmword [rbp + 0x88], xmm0
xor edx, edx
mov cl, 0x27
call fcn.140008960
mov byte [rsp + 0x50], al
lea edx, [r15 + 1]
mov cl, 0x29
call fcn.140008960
mov byte [rsp + 0x51], al
lea edx, [r15 + 2]
mov cl, 0x22
call fcn.140008960
mov byte [rsp + 0x52], al
xor eax, eax
mov byte [rsp + 0x53], al
mov r8d, r15d
nop word [rax + rax]
movsxd rax, r8d
lea rcx, [rsp + 0x50]
add rcx, rax
lea eax, [r8 - 0x79]
xor byte [rcx], al
inc r8d
cmp r8d, 3
jb 0x140016730
mov byte [rsp + 0x53], 0
xor edx, edx
mov cl, 0x50
call fcn.140008960
mov byte [rsp + 0x60], al
mov edx, 1
mov cl, 0x6f
call fcn.140008960
mov byte [rsp + 0x61], al
mov edx, 2
mov cl, 0x77
call fcn.140008960
mov byte [rsp + 0x62], al
mov edx, 3
mov cl, 0x65
call fcn.140008960
mov byte [rsp + 0x63], al
mov edx, 4
mov cl, 0x72
call fcn.140008960
mov byte [rsp + 0x64], al
mov edx, 5
mov cl, 0x53
call fcn.140008960
mov byte [rsp + 0x65], al
mov edx, 6
mov cl, 0x68
call fcn.140008960
mov byte [rsp + 0x66], al
mov edx, 7
mov cl, 0x65
call fcn.140008960
mov byte [rsp + 0x67], al
mov edx, 8
mov cl, 0x6c
call fcn.140008960
mov byte [rsp + 0x68], al
mov edx, 9
call fcn.140008960
mov byte [rsp + 0x69], al
mov edx, 0xa
mov cl, 0x20
call fcn.140008960
mov byte [rsp + 0x6a], al
mov edx, 0xb
mov cl, 0x2d
call fcn.140008960
mov byte [rsp + 0x6b], al
mov edx, 0xc
mov cl, 0x43
call fcn.140008960
mov byte [rsp + 0x6c], al
mov edx, 0xd
mov cl, 0x6f
call fcn.140008960
mov byte [rsp + 0x6d], al
mov edx, 0xe
mov cl, 0x6d
call fcn.140008960
mov byte [rsp + 0x6e], al
mov edx, 0xf
call fcn.140008960
mov byte [rsp + 0x6f], al
mov edx, 0x10
mov cl, 0x61
call fcn.140008960
mov byte [rsp + 0x70], al
mov edx, 0x11
mov cl, 0x6e
call fcn.140008960
mov byte [rsp + 0x71], al
mov edx, 0x12
mov cl, 0x64
call fcn.140008960
mov byte [rsp + 0x72], al
mov edx, 0x13
mov cl, 0x20
call fcn.140008960
mov byte [rsp + 0x73], al
mov edx, 0x14
mov cl, 0x22
call fcn.140008960
mov byte [rsp + 0x74], al
mov edx, 0x15
mov cl, 0x41
call fcn.140008960
mov byte [rsp + 0x75], al
mov edx, 0x16
mov cl, 0x64
call fcn.140008960
mov byte [rsp + 0x76], al
mov edx, 0x17
call fcn.140008960
mov byte [rsp + 0x77], al
mov edx, 0x18
mov cl, 0x2d
call fcn.140008960
mov byte [rsp + 0x78], al
mov edx, 0x19
mov cl, 0x54
call fcn.140008960
mov byte [rsp + 0x79], al
mov edx, 0x1a
mov cl, 0x79
call fcn.140008960
mov byte [rsp + 0x7a], al
mov edx, 0x1b
mov cl, 0x70
call fcn.140008960
mov byte [rsp + 0x7b], al
mov edx, 0x1c
mov cl, 0x65
call fcn.140008960
mov byte [rsp + 0x7c], al
mov edx, 0x1d
mov cl, 0x20
call fcn.140008960
mov byte [rsp + 0x7d], al
mov edx, 0x1e
mov cl, 0x2d
call fcn.140008960
mov byte [rsp + 0x7e], al
mov edx, 0x1f
mov cl, 0x41
call fcn.140008960
mov byte [rsp + 0x7f], al
mov edx, 0x20
mov cl, 0x73
call fcn.140008960
mov byte [rbp - 0x80], al
mov edx, 0x21
call fcn.140008960
mov byte [rbp - 0x7f], al
mov edx, 0x22
mov cl, 0x65
call fcn.140008960
mov byte [rbp - 0x7e], al
mov edx, 0x23
mov cl, 0x6d
call fcn.140008960
mov byte [rbp - 0x7d], al
mov edx, 0x24
mov cl, 0x62
call fcn.140008960
mov byte [rbp - 0x7c], al
mov edx, 0x25
mov cl, 0x6c
call fcn.140008960
mov byte [rbp - 0x7b], al
mov edx, 0x26
mov cl, 0x79
call fcn.140008960
mov byte [rbp - 0x7a], al
mov edx, 0x27
mov cl, 0x4e
call fcn.140008960
mov byte [rbp - 0x79], al
mov edx, 0x28
mov cl, 0x61
call fcn.140008960
mov byte [rbp - 0x78], al
mov edx, 0x29
mov cl, 0x6d
call fcn.140008960
mov byte [rbp - 0x77], al
mov edx, 0x2a
mov cl, 0x65
call fcn.140008960
mov byte [rbp - 0x76], al
mov edx, 0x2b
mov cl, 0x20
call fcn.140008960
mov byte [rbp - 0x75], al
mov edx, 0x2c
mov cl, 0x50
call fcn.140008960
mov byte [rbp - 0x74], al
mov edx, 0x2d
mov cl, 0x72
call fcn.140008960
mov byte [rbp - 0x73], al
mov edx, 0x2e
mov cl, 0x65
call fcn.140008960
mov byte [rbp - 0x72], al
mov edx, 0x2f
mov cl, 0x73
call fcn.140008960
mov byte [rbp - 0x71], al
mov edx, 0x30
mov cl, 0x65
call fcn.140008960
mov byte [rbp - 0x70], al
mov edx, 0x31
mov cl, 0x6e
call fcn.140008960
mov byte [rbp - 0x6f], al
mov edx, 0x32
mov cl, 0x74
call fcn.140008960
mov byte [rbp - 0x6e], al
mov edx, 0x33
mov cl, 0x61
call fcn.140008960
mov byte [rbp - 0x6d], al
mov edx, 0x34
mov cl, 0x74
call fcn.140008960
mov byte [rbp - 0x6c], al
mov edx, 0x35
mov cl, 0x69
call fcn.140008960
mov byte [rbp - 0x6b], al
mov edx, 0x36
mov cl, 0x6f
call fcn.140008960
mov byte [rbp - 0x6a], al
mov edx, 0x37
mov cl, 0x6e
call fcn.140008960
mov byte [rbp - 0x69], al
mov edx, 0x38
mov cl, 0x46
call fcn.140008960
mov byte [rbp - 0x68], al
mov edx, 0x39
mov cl, 0x72
call fcn.140008960
mov byte [rbp - 0x67], al
mov edx, 0x3a
mov cl, 0x61
call fcn.140008960
mov byte [rbp - 0x66], al
mov edx, 0x3b
mov cl, 0x6d
call fcn.140008960
mov byte [rbp - 0x65], al
mov edx, 0x3c
mov cl, 0x65
call fcn.140008960
mov byte [rbp - 0x64], al
mov edx, 0x3d
mov cl, 0x77
call fcn.140008960
mov byte [rbp - 0x63], al
mov edx, 0x3e
mov cl, 0x6f
call fcn.140008960
mov byte [rbp - 0x62], al
mov edx, 0x3f
mov cl, 0x72
call fcn.140008960
mov byte [rbp - 0x61], al
mov edx, 0x40
mov cl, 0x6b
call fcn.140008960
mov byte [rbp - 0x60], al
mov edx, 0x41
mov cl, 0x3b
call fcn.140008960
mov byte [rbp - 0x5f], al
mov edx, 0x42
mov cl, 0x5b
call fcn.140008960
mov byte [rbp - 0x5e], al
mov edx, 0x43
mov cl, 0x53
call fcn.140008960
mov byte [rbp - 0x5d], al
mov edx, 0x44
mov cl, 0x79
call fcn.140008960
mov byte [rbp - 0x5c], al
mov edx, 0x45
mov cl, 0x73
call fcn.140008960
mov byte [rbp - 0x5b], al
mov edx, 0x46
mov cl, 0x74
call fcn.140008960
mov byte [rbp - 0x5a], al
mov edx, 0x47
mov cl, 0x65
call fcn.140008960
mov byte [rbp - 0x59], al
mov edx, 0x48
mov cl, 0x6d
call fcn.140008960
mov byte [rbp - 0x58], al
mov edx, 0x49
mov cl, 0x2e
call fcn.140008960
mov byte [rbp - 0x57], al
mov edx, 0x4a
mov cl, 0x57
call fcn.140008960
mov byte [rbp - 0x56], al
mov edx, 0x4b
mov cl, 0x69
call fcn.140008960
mov byte [rbp - 0x55], al
mov edx, 0x4c
mov cl, 0x6e
call fcn.140008960
mov byte [rbp - 0x54], al
mov edx, 0x4d
mov cl, 0x64
call fcn.140008960
mov byte [rbp - 0x53], al
mov edx, 0x4e
mov cl, 0x6f
call fcn.140008960
mov byte [rbp - 0x52], al
mov edx, 0x4f
mov cl, 0x77
call fcn.140008960
mov byte [rbp - 0x51], al
mov edx, 0x50
mov cl, 0x73
call fcn.140008960
mov byte [rbp - 0x50], al
mov edx, 0x51
mov cl, 0x2e
call fcn.140008960
mov byte [rbp - 0x4f], al
mov edx, 0x52
mov cl, 0x4d
call fcn.140008960
mov byte [rbp - 0x4e], al
mov edx, 0x53
mov cl, 0x65
call fcn.140008960
mov byte [rbp - 0x4d], al
mov edx, 0x54
mov cl, 0x73
call fcn.140008960
mov byte [rbp - 0x4c], al
mov edx, 0x55
call fcn.140008960
mov byte [rbp - 0x4b], al
mov edx, 0x56
mov cl, 0x61
call fcn.140008960
mov byte [rbp - 0x4a], al
mov edx, 0x57
mov cl, 0x67
call fcn.140008960
mov byte [rbp - 0x49], al
mov edx, 0x58
mov cl, 0x65
call fcn.140008960
mov byte [rbp - 0x48], al
mov edx, 0x59
mov cl, 0x42
call fcn.140008960
mov byte [rbp - 0x47], al
mov edx, 0x5a
mov cl, 0x6f
call fcn.140008960
mov byte [rbp - 0x46], al
mov edx, 0x5b
mov cl, 0x78
call fcn.140008960
mov byte [rbp - 0x45], al
mov edx, 0x5c
mov cl, 0x5d
call fcn.140008960
mov byte [rbp - 0x44], al
mov edx, 0x5d
mov cl, 0x3a
call fcn.140008960
mov byte [rbp - 0x43], al
mov edx, 0x5e
call fcn.140008960
mov byte [rbp - 0x42], al
mov edx, 0x5f
mov cl, 0x53
call fcn.140008960
mov byte [rbp - 0x41], al
mov edx, 0x60
mov cl, 0x68
call fcn.140008960
mov byte [rbp - 0x40], al
mov edx, 0x61
mov cl, 0x6f
call fcn.140008960
mov byte [rbp - 0x3f], al
mov edx, 0x62
mov cl, 0x77
call fcn.140008960
mov byte [rbp - 0x3e], al
mov edx, 0x63
mov cl, 0x28
call fcn.140008960
mov byte [rbp - 0x3d], al
mov edx, 0x64
mov cl, 0x27
call fcn.140008960
mov byte [rbp - 0x3c], al
xor eax, eax
mov byte [rbp - 0x3b], al
mov edx, r15d
nop dword [rax]
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x60]
add rcx, rax
lea eax, [rdx - 0x79]
xor byte [rcx], al
inc edx
cmp edx, 0x65
jb 0x140016d60
mov byte [rbp - 0x3b], 0
lea rax, [rsp + 0x60]
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rax + rcx], 0
jne 0x140016d87
mov rdx, qword [rsi + 0x10]
movabs rax, 0x7fffffffffffffff
sub rax, rdx
cmp rax, rcx
jb 0x1400172a2
mov rax, rsi
cmp qword [rsi + 0x18], 0xf
jbe 0x140016db7
mov rax, qword [rsi]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x60]
lea rcx, [rbp - 0x30]
call fcn.14000fd50
nop
lea rax, [rsp + 0x50]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140016de1
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x30]
call fcn.14000e550
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x20], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x20], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140016e64
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016e5f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140016e5f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006ae3c
movdqa xmm0, xmmword [0x1400c3190]
movdqu xmmword [rbp - 0x20], xmm0
mov byte [rbp - 0x30], 0
lea r8, [rbp + 0x10]
cmp qword [rbp + 0x28], 0xf
cmova r8, qword [rbp + 0x10]
mov edx, 0x104
mov r9, 0xffffffffffffffff
lea rcx, [rbp + 0xa0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r14, qword [rax]
mov rdi, r14
nop dword [rax]
nop word [rax + rax]
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140016f37
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140016f37
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r9 + r8*4]
mov ecx, dword [rax + r11]
add rcx, r9
mov edx, 0x58ee3626
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140016f32
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x140016f10
cmp edx, 0xb3b29c4a
je 0x140017184
test r8d, r8d
jne 0x140016ef0
mov rax, qword [rdi]
mov rdi, rax
cmp rax, r14
je 0x140016f4d
cmp qword [rax + 0x30], 0
jne 0x140016ec0
mov r10, r15
lea rax, [rbp - 8]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0xa0]
xor ecx, ecx
call r10
test eax, eax
je 0x1400171d9
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r14, qword [rax]
mov rdi, r14
nop word [rax + rax]
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140017027
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140017027
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r9 + r8*4]
mov ecx, dword [rax + r11]
add rcx, r9
mov edx, 0x55ebf2d6
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140017022
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x140017000
cmp edx, 0x4e090d6c
je 0x1400171a1
test r8d, r8d
jne 0x140016fe0
mov rax, qword [rdi]
mov rdi, rax
cmp rax, r14
je 0x14001703d
cmp qword [rax + 0x30], 0
jne 0x140016fb0
mov rdx, r15
mov rcx, qword [rbp - 8]
call rdx
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r14, qword [rax]
mov rdi, r14
nop dword [rax]
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x1400170d7
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x1400170d7
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r9 + r8*4]
mov eax, dword [rax + r11]
add rax, r9
mov edx, 0x5efd4a22
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x1400170d2
nop dword [rax]
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax]
lea rax, [rax + 1]
test cl, cl
jne 0x1400170b0
cmp edx, 0x3a051f28
je 0x1400171bd
test r8d, r8d
jne 0x140017090
mov rax, qword [rdi]
mov rdi, rax
cmp rax, r14
je 0x1400170ed
cmp qword [rax + 0x30], 0
jne 0x140017060
mov rdx, r15
mov rcx, qword [rbp]
call rdx
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 0xf
jbe 0x140017132
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001712d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001720b
call fcn.14006ae3c
movdqa xmm0, xmmword [0x1400c3190]
movdqu xmmword [rbp + 0x20], xmm0
mov byte [rbp + 0x10], 0
mov rdx, qword [rsi + 0x18]
cmp rdx, 0xf
jbe 0x14001717d
inc rdx
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x140017178
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001729b
mov rcx, r8
call fcn.14006ae3c
mov al, 1
jmp 0x140017260
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rbx + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov r10d, dword [rcx + rax*4]
add r10, r9
jmp 0x140016f50
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rbx + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov edx, dword [rcx + rax*4]
add rdx, r9
jmp 0x140017040
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rbx + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov edx, dword [rcx + rax*4]
add rdx, r9
jmp 0x1400170f0
mov rdx, qword [rbp + 0x28]
cmp rdx, 0xf
jbe 0x140017217
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017212
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140017212
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006ae3c
movdqa xmm0, xmmword [0x1400c3190]
movdqu xmmword [rbp + 0x20], xmm0
mov byte [rbp + 0x10], 0
mov rdx, qword [rsi + 0x18]
cmp rdx, 0xf
jbe 0x14001725e
inc rdx
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x140017259
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001729b
mov rcx, r8
call fcn.14006ae3c
xor al, al
mov byte [rsi], 0
mov qword [rsi + 0x18], 0xf
mov qword [rsi + 0x10], r15
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.14006a9b0
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140002120
nop
int3