Function at 0x140030b40
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using murmur2
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
push r12
push r13
push r14
sub rsp, 0xe0
mov rax, qword [0x140181020]
xor rax, rsp
mov qword [rsp + 0xb8], rax
xor r14d, r14d
mov qword [rsp + 0x40], rdx
mov rax, rdx
mov qword [rsp + 0x38], rcx
dec rax
mov qword [rcx + 0xa8], r14
mov qword [rcx + 0xb8], r14
lea r12, [rcx + 0x98]
mov byte [rcx + 0xb0], r14b
mov r13d, r8d
mov qword [rcx + 0x9c], r14
mov dword [r12], r14d
mov dword [rcx + 0xc8], r14d
cmp rax, 0xfffffffffffffffd
ja 0x140031471
mov rax, qword [rcx + 8]
lea rcx, [rsp + 0x50]
mov qword [r11 + 0x18], rbx
mov qword [r11 - 0x20], rbp
mov qword [r11 - 0x28], rsi
mov qword [r11 - 0x30], rdi
mov qword [r11 - 0x38], r15
mov qword [rsp + 0xa0], rax
call fcn.140035290
mov rdi, rax
movsx ebx, byte [rax]
mov ecx, ebx
call fcn.140014160
add ebx, eax
cmp ebx, 0xfffffff0
jg 0x140030bf8
mov edx, 0x84
call fcn.140052d80
cmp ebx, 0xffffffb7
jg 0x140030c07
mov edx, 0x9d
call fcn.140052d80
imul eax, ebx, 0x5bd1e995
lea r8, [rdi + 4]
mov edx, r14d
mov r9, r8
mov r10d, 8
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul r11d, ecx, 0x5bd1e995
nop dword [rax + rax]
mov eax, edx
lea r9, [r9 + 4]
xor eax, r11d
add edx, 0x5bd1e995
imul ecx, eax, 0x286a90b9
xor ecx, 0xaa2a7357
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov dword [r9 - 4], eax
sub r10, 1
jne 0x140030c30
mov r9d, dword [0x14018719c]
mov rdx, qword [rdi + 0x28]
call fcn.1400525a0
mov rsi, rax
mov ebp, 0xe
test rax, rax
jne 0x140030c8b
mov rsi, r14
jmp 0x140030ca4
mov rcx, rsi
mov rdx, rbp
movzx eax, byte [rdi]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x140030c91
mov byte [rsi + 0xe], r14b
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rdi, qword [rax]
mov eax, 0x5a4d
cmp qword [rdi + 0x60], r14
je 0x140030d90
nop word [rax + rax]
mov r11, qword [rdi + 0x30]
mov rdi, qword [rdi]
test r11, r11
je 0x140030d82
cmp word [r11], ax
jne 0x140030d8d
movsxd rax, dword [r11 + 0x3c]
cmp dword [rax + r11], 0x4550
jne 0x140030d8d
mov ecx, dword [rax + r11 + 0x88]
test ecx, ecx
je 0x140030d8d
mov r14d, dword [r11 + rcx + 0x1c]
lea rax, [r11 + rcx]
mov r9d, dword [rax + 0x20]
add r14, r11
mov r15d, dword [rax + 0x24]
add r9, r11
mov ebx, dword [rax + 0x18]
add r15, r11
xor r10d, r10d
test ebx, ebx
je 0x140030d7d
mov ecx, dword [r9]
xor dl, dl
add rcx, r11
cmp byte [rcx], dl
je 0x140030d71
mov r8, rsi
sub r8, rcx
movzx eax, byte [r8 + rcx]
test al, al
je 0x140030d6d
cmp byte [rcx], al
jne 0x140030d71
inc rcx
mov dl, 1
cmp byte [rcx], 0
jne 0x140030d42
movsxd rax, r10d
movzx ecx, word [r15 + rax*2]
mov eax, dword [r14 + rcx*4]
add rax, r11
xor r14d, r14d
jmp 0x140030d93
test dl, dl
jne 0x140030d59
inc r10d
add r9, 4
cmp r10d, ebx
jb 0x140030d30
mov eax, 0x5a4d
cmp qword [rdi + 0x60], 0
jne 0x140030cd0
xor r14d, r14d
mov rax, r14
mov rcx, qword [rsp + 0xa0]
mov r9d, 1
mov r15, qword [rsp + 0x38]
xor r8d, r8d
xor edx, edx
call rax
cmp eax, 0xffffffff
je 0x140030ffe
mov r13, qword [rsp + 0x40]
lea rax, [r15 + 0x90]
mov rcx, r13
mov qword [rsp + 0x20], rax
lea r9, [r15 + 0x78]
mov r8, r12
lea rdx, [r15 + 0x70]
call fcn.14002e9e0
test eax, eax
jne 0x140030fb8
lea rcx, [rsp + 0x50]
call fcn.140035400
mov rbx, rax
movsx edi, byte [rax]
mov ecx, edi
call fcn.140014160
add edi, eax
cmp edi, 0xfffffff0
jg 0x140030e0a
mov edx, 0x84
call fcn.140052d80
cmp edi, 0xffffffb7
jg 0x140030e19
mov edx, 0x9d
call fcn.140052d80
imul eax, edi, 0x5bd1e995
lea r9, [rbx + 4]
mov edx, r14d
mov r8d, 8
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul r10d, ecx, 0x5bd1e995
nop word [rax + rax]
mov eax, r10d
lea r9, [r9 + 4]
xor eax, edx
add edx, 0x5bd1e995
imul ecx, eax, 0x286a90b9
xor ecx, 0xaa2a7357
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov dword [r9 - 4], eax
sub r8, 1
jne 0x140030e40
mov r9d, dword [0x14018719c]
lea r8, [rbx + 4]
mov rdx, qword [rbx + 0x28]
call fcn.1400525a0
mov rsi, rax
test rax, rax
jne 0x140030e9a
mov rsi, r14
jmp 0x140030eb3
mov rcx, rsi
nop dword [rax]
movzx eax, byte [rbx]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub rbp, 1
jne 0x140030ea0
mov byte [rsi + 0xe], bpl
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rdi, qword [rax]
cmp qword [rdi + 0x60], 0
je 0x140030f99
mov r12d, 0x5a4d
nop dword [rax + rax]
mov r11, qword [rdi + 0x30]
mov rdi, qword [rdi]
test r11, r11
je 0x140030f8b
cmp word [r11], r12w
jne 0x140030f96
movsxd rax, dword [r11 + 0x3c]
cmp dword [rax + r11], 0x4550
jne 0x140030f96
mov ecx, dword [rax + r11 + 0x88]
test ecx, ecx
je 0x140030f96
mov ebp, dword [r11 + rcx + 0x1c]
lea rax, [r11 + rcx]
mov r9d, dword [rax + 0x20]
add rbp, r11
mov r14d, dword [rax + 0x24]
add r9, r11
mov ebx, dword [rax + 0x18]
add r14, r11
xor r10d, r10d
test ebx, ebx
je 0x140030f8b
nop dword [rax]
mov ecx, dword [r9]
xor dl, dl
add rcx, r11
cmp byte [rcx], dl
je 0x140030f7f
mov r8, rsi
sub r8, rcx
movzx eax, byte [r8 + rcx]
test al, al
je 0x140030f7b
cmp byte [rcx], al
jne 0x140030f7f
inc rcx
mov dl, 1
cmp byte [rcx], 0
jne 0x140030f52
movsxd rax, r10d
movzx ecx, word [r14 + rax*2]
mov r14d, dword [rbp + rcx*4]
add r14, r11
jmp 0x140030f99
test dl, dl
jne 0x140030f69
inc r10d
add r9, 4
cmp r10d, ebx
jb 0x140030f40
cmp qword [rdi + 0x60], 0
jne 0x140030ee0
xor r14d, r14d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r13
call r14
mov byte [r15 + 0x94], 1
mov qword [r15 + 0xa8], r13
xor eax, eax
mov rdi, qword [rsp + 0xc8]
mov rsi, qword [rsp + 0xd0]
mov rbp, qword [rsp + 0xd8]
mov rbx, qword [rsp + 0x110]
mov r15, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.14012f610
add rsp, 0xe0
pop r14
pop r13
pop r12
ret
mov dword [r15 + 0x70], 0x80000000
mov dword [r12], 0xffffffff
test r13d, r13d
je 0x140031017
mov dword [r12], r13d
lea rcx, [rsp + 0x50]
mov byte [r15 + 0x94], 0
call fcn.140035570
mov rdi, rax
movsx ebx, byte [rax]
mov ecx, ebx
call fcn.140014160
add ebx, eax
cmp ebx, 0xfffffff0
jg 0x140031047
mov edx, 0x84
call fcn.140052d80
cmp ebx, 0xffffffb7
jg 0x140031056
mov edx, 0x9d
call fcn.140052d80
imul eax, ebx, 0x5bd1e995
lea r8, [rdi + 4]
mov r15d, 8
mov edx, r14d
mov r9, r8
mov r10d, r15d
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul r11d, ecx, 0x5bd1e995
nop dword [rax]
mov eax, edx
lea r9, [r9 + 4]
xor eax, r11d
add edx, 0x5bd1e995
imul ecx, eax, 0x286a90b9
xor ecx, 0xaa2a7357
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov dword [r9 - 4], eax
sub r10, 1
jne 0x140031080
mov r9d, dword [0x14018719c]
mov rdx, qword [rdi + 0x28]
call fcn.1400525a0
mov rsi, rax
test rax, rax
jne 0x1400310d6
mov rsi, r14
jmp 0x1400310f2
mov rcx, rsi
mov edx, 0xc
nop
movzx eax, byte [rdi]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x1400310e0
mov byte [rsi + 0xc], dl
mov rax, qword gs:[0x60]
mov r12d, 0x5a4d
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rdi, qword [rax]
cmp qword [rdi + 0x60], 0
je 0x1400311db
nop word [rax + rax]
mov r11, qword [rdi + 0x30]
mov rdi, qword [rdi]
test r11, r11
je 0x1400311cd
cmp word [r11], r12w
jne 0x1400311d8
movsxd rax, dword [r11 + 0x3c]
cmp dword [rax + r11], 0x4550
jne 0x1400311d8
mov ecx, dword [rax + r11 + 0x88]
test ecx, ecx
je 0x1400311d8
mov ebp, dword [r11 + rcx + 0x1c]
lea rax, [r11 + rcx]
mov r9d, dword [rax + 0x20]
add rbp, r11
mov r14d, dword [rax + 0x24]
add r9, r11
mov ebx, dword [rax + 0x18]
add r14, r11
xor r10d, r10d
test ebx, ebx
je 0x1400311cd
mov ecx, dword [r9]
xor dl, dl
add rcx, r11
cmp byte [rcx], dl
je 0x1400311c1
mov r8, rsi
sub r8, rcx
movzx eax, byte [rcx + r8]
test al, al
je 0x1400311bd
cmp byte [rcx], al
jne 0x1400311c1
inc rcx
mov dl, 1
cmp byte [rcx], 0
jne 0x140031192
movsxd rax, r10d
movzx ecx, word [r14 + rax*2]
mov eax, dword [rbp + rcx*4]
add rax, r11
xor r14d, r14d
jmp 0x1400311de
test dl, dl
jne 0x1400311a9
inc r10d
add r9, 4
cmp r10d, ebx
jb 0x140031180
cmp qword [rdi + 0x60], 0
jne 0x140031120
xor r14d, r14d
mov rax, r14
lea rcx, [rsp + 0xa8]
call rax
lea rcx, [rsp + 0x50]
call fcn.1400356c0
mov rbx, rax
movsx edi, byte [rax]
mov ecx, edi
call fcn.140014160
add edi, eax
cmp edi, 0xfffffff0
jg 0x140031210
mov edx, 0x84
call fcn.140052d80
cmp edi, 0xffffffb7
jg 0x14003121f
mov edx, 0x9d
call fcn.140052d80
imul eax, edi, 0x5bd1e995
lea r8, [rbx + 4]
mov edx, r14d
mov r9, r8
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul r10d, ecx, 0x5bd1e995
nop dword [rax]
mov eax, edx
lea r9, [r9 + 4]
xor eax, r10d
add edx, 0x5bd1e995
imul ecx, eax, 0x286a90b9
xor ecx, 0xaa2a7357
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov dword [r9 - 4], eax
sub r15, 1
jne 0x140031240
mov r9d, dword [0x14018719c]
mov rdx, qword [rbx + 0x28]
call fcn.1400525a0
mov rsi, rax
test rax, rax
jne 0x140031296
mov rsi, r14
jmp 0x1400312f2
movsx eax, byte [rbx]
mov r8, r14
movd xmm1, eax
lea rax, [rsi + 0x13]
punpcklbw xmm1, xmm1
punpcklwd xmm1, xmm1
pshufd xmm1, xmm1, 0
cmp rsi, rbx
ja 0x1400312bb
cmp rax, rbx
jae 0x1400312cc
movdqu xmm0, xmmword [rsi]
mov r8d, 0x10
xorps xmm1, xmm0
movdqu xmmword [rsi], xmm1
mov edx, 0x14
lea rcx, [rsi + r8]
sub rdx, r8
nop dword [rax + rax]
movzx eax, byte [rbx]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x1400312e0
mov byte [rsi + 0x14], dl
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rdi, qword [rax]
cmp qword [rdi + 0x60], 0
je 0x1400313d9
nop dword [rax]
nop word [rax + rax]
mov r11, qword [rdi + 0x30]
mov rdi, qword [rdi]
test r11, r11
je 0x1400313cb
cmp word [r11], r12w
jne 0x1400313d6
movsxd rax, dword [r11 + 0x3c]
cmp dword [rax + r11], 0x4550
jne 0x1400313d6
mov ecx, dword [rax + r11 + 0x88]
test ecx, ecx
je 0x1400313d6
mov ebp, dword [r11 + rcx + 0x1c]
lea rax, [r11 + rcx]
mov r9d, dword [rax + 0x20]
add rbp, r11
mov r14d, dword [rax + 0x24]
add r9, r11
mov ebx, dword [rax + 0x18]
add r14, r11
xor r10d, r10d
test ebx, ebx
je 0x1400313cb
mov eax, dword [r9]
xor dl, dl
add rax, r11
cmp byte [rax], dl
je 0x1400313bf
mov r8, rsi
sub r8, rax
movzx ecx, byte [rax + r8]
test cl, cl
je 0x1400313bb
cmp byte [rax], cl
jne 0x1400313bf
inc rax
mov dl, 1
cmp byte [rax], 0
jne 0x140031392
movsxd rax, r10d
movzx ecx, word [r14 + rax*2]
mov r14d, dword [rbp + rcx*4]
add r14, r11
jmp 0x1400313d9
test dl, dl
jne 0x1400313a9
inc r10d
add r9, 4
cmp r10d, ebx
jb 0x140031380
cmp qword [rdi + 0x60], 0
jne 0x140031320
xor r14d, r14d
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0xa8]
call r14
mov rcx, qword [rsp + 0xa0]
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x30]
call fcn.14002e6e0
mov r8, qword [rsp + 0x38]
movabs rcx, 0xfe624e212ac18000
add rcx, qword [rsp + 0xa0]
movabs rax, 0xd6bf94d5e57a42bd
mov r13, qword [rsp + 0x40]
imul rcx
mov qword [r8 + 0xa8], r13
add rdx, rcx
movzx ecx, word [rsp + 0x30]
sar rdx, 0x17
mov rax, rdx
shl ecx, 0x10
shr rax, 0x3f
add rdx, rax
movzx eax, word [rsp + 0x34]
or ecx, eax
mov qword [r8 + 0x78], rdx
mov dword [r8 + 0x90], ecx
mov qword [r8 + 0x80], rdx
mov qword [r8 + 0x88], rdx
jmp 0x140030fb6
mov eax, 0x10000
jmp 0x140030fe0