Function at 0x140002920
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov rax, qword [0x140008008]
xor rax, rsp
mov qword [rbp + 0x10], rax
call fcn.140001230
lea rcx, [rbp - 0x20]
call qword [0x1400086e8]
cmp dword [rbp], 4
jb 0x14000332d
mov dword [rbp - 0x80], 0x40
lea rcx, [rbp - 0x80]
call qword [0x140008700]
mov rax, qword [rbp - 0x78]
and rax, 0xfffffffffff00000
movabs rcx, 0x100000000
cmp rax, rcx
jb 0x14000332d
mov rax, qword [0x1400086f8]
xor r14d, r14d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor edx, edx
lea r8d, [r14 + 3]
lea rcx, str..PhysicalDrive0
call rax
mov qword [rsp + 0x38], r14
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0x18
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x70000
mov rcx, rax
call qword [0x140008710]
mov eax, dword [rsp + 0x6c]
mov ecx, dword [rsp + 0x68]
imul rax, rcx
mov ecx, dword [rsp + 0x64]
imul rax, rcx
imul rax, qword [rsp + 0x58]
cqo
and edx, 0x3fffffff
add rax, rdx
sar rax, 0x1e
cmp rax, 0x64
jb 0x14000332d
call fcn.140003f20
test al, al
je 0x14000332d
call fcn.140004150
test al, al
je 0x14000332d
lea rcx, str.RobloxPlayerBeta.exe
call fcn.140002460
mov esi, eax
test eax, eax
jne 0x140002bd1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140002ae6
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140002ae6
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x38eb833b
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140002ae1
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140002ac0
cmp r8d, 0xefd95fe4
je 0x140002aeb
test r9d, r9d
jne 0x140002aa0
mov rax, qword [rax]
jmp 0x140002a70
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rbx + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
lea rcx, str.waiting_for_roblox..._n_n
call rdx
nop dword [rax + rax]
lea rcx, str.RobloxPlayerBeta.exe
call fcn.140002460
mov esi, eax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140002ba6
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140002ba6
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov ecx, dword [rcx + rdi]
add rcx, r10
mov r8d, 0xddbd4e2b
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140002ba1
nop dword [rax]
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x140002b80
cmp r8d, 0x606089ae
je 0x140002bab
test r9d, r9d
jne 0x140002b60
mov rax, qword [rax]
jmp 0x140002b30
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rbx + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov ecx, 0xa
call rdx
test esi, esi
je 0x140002b10
mov qword [rsp + 0x40], r14
mov eax, esi
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], r14
mov dword [rbp - 0x20], 0x30
mov qword [rbp - 0x18], r14
mov dword [rbp - 8], r14d
mov qword [rbp - 0x10], r14
xorps xmm0, xmm0
movdqu xmmword [rbp], xmm0
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], 0x26
lea r9, [rsp + 0x48]
lea r8, [rbp - 0x20]
mov edx, 0x1fffff
lea rcx, [rsp + 0x40]
call fcn.1400044b0
test eax, eax
js 0x140003272
cmp qword [rsp + 0x40], 0xffffffffffffffff
je 0x140003272
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r14w
mov r8d, 0x73
lea rcx, [rbp - 0x40]
call fcn.140003620
nop
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x58], xmm1
mov qword [rsp + 0x68], r14
mov rbx, qword [rsp + 0x40]
mov qword [rsp + 0x70], r14
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0x30
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], 0x23
lea r9, [rbp - 0x80]
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.1400044b0
test eax, eax
js 0x140002d3e
nop dword [rax]
cmp dword [rbp - 0x60], 0x1000
jne 0x140002cff
mov eax, dword [rbp - 0x5c]
add eax, 0xfffffffe
test eax, 0xfffffffd
jne 0x140002cff
mov rdx, qword [rsp + 0x60]
cmp rdx, qword [rsp + 0x68]
je 0x140002cf1
movups xmm0, xmmword [rbp - 0x80]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp - 0x70]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rbp - 0x60]
movups xmmword [rdx + 0x20], xmm0
add qword [rsp + 0x60], 0x30
jmp 0x140002cff
lea r8, [rbp - 0x80]
lea rcx, [rsp + 0x58]
call fcn.140003810
mov rdx, qword [rbp - 0x68]
add rdx, qword [rbp - 0x80]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0x30
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], 0x23
lea r9, [rbp - 0x80]
xor r8d, r8d
mov rcx, rbx
call fcn.1400044b0
test eax, eax
jns 0x140002cb0
mov rdi, qword [rsp + 0x60]
mov rcx, rdi
mov rbx, qword [rsp + 0x58]
sub rcx, rbx
movabs rsi, 0x2aaaaaaaaaaaaaab
mov rax, rsi
imul rcx
sar rdx, 3
mov rax, rdx
shr rax, 0x3f
add rdx, rax
jne 0x140002f8d
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140002e06
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140002e06
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rdi]
add rdx, r10
mov r8d, 0x46b9d82b
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140002e01
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140002de0
cmp r8d, 0xc5b81174
je 0x140002e0b
test r9d, r9d
jne 0x140002dc0
mov rax, qword [rax]
jmp 0x140002d90
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rbx + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
lea rcx, str.no_valid_mem_regions_n
call rdx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140002eb6
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140002eb6
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rdi]
add rdx, r10
mov r8d, 0xbcd942c7
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140002eb1
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140002e90
cmp r8d, 0xa0dbba9b
je 0x140002ebb
test r9d, r9d
jne 0x140002e70
mov rax, qword [rax]
jmp 0x140002e40
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov edx, dword [rdx + rcx*4]
add rdx, r10
mov rcx, qword [rsp + 0x40]
call rdx
nop
mov r8, qword [rsp + 0x58]
test r8, r8
je 0x140002f43
mov rcx, qword [rsp + 0x68]
sub rcx, r8
mov rax, rsi
imul rcx
sar rdx, 3
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*2]
shl rdx, 4
mov rax, r8
cmp rdx, 0x1000
jb 0x140002f2d
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003209
mov rcx, r8
call fcn.140004544
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r14
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x140002f83
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002f7e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003261
call fcn.140004544
mov eax, 1
jmp 0x14000333b
cmp rbx, rdi
je 0x14000310f
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
mov r9, qword [rbx + 0x18]
mov r8, qword [rbx]
mov rdx, qword [rsp + 0x40]
lea rcx, [rbp - 0x80]
call fcn.1400022a0
nop
cmp qword [rbp - 0x70], 0
jne 0x140003002
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x140002ffc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002ff7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003103
call fcn.140004544
add rbx, 0x30
jmp 0x140002f8d
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140003096
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140003096
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rdi]
add rdx, r10
mov r8d, 0xb5266442
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140003091
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140003070
cmp r8d, 0x31855ff0
je 0x14000309b
test r9d, r9d
jne 0x140003050
mov rax, qword [rax]
jmp 0x140003020
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rbx + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov r8d, dword [rcx + rax*4]
add r8, r10
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rdx, qword [rbp - 0x80]
lea rcx, str.token:__s_n
call r8
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x14000310f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000310a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000310a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004544
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140003196
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140003196
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0xb3cda6b7
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140003191
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140003170
cmp r8d, 0x8b0baa8b
je 0x14000319b
test r9d, r9d
jne 0x140003150
mov rax, qword [rax]
jmp 0x140003120
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rbx + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov rcx, qword [rsp + 0x40]
call rdx
nop
mov r8, qword [rsp + 0x58]
test r8, r8
je 0x140003226
mov rcx, qword [rsp + 0x68]
sub rcx, r8
mov rax, rsi
imul rcx
sar rdx, 3
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*2]
shl rdx, 4
mov rax, r8
cmp rdx, 0x1000
jb 0x140003210
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003210
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r8
call fcn.140004544
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r14
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x140003339
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003268
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003268
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004544
jmp 0x140003339
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140003306
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140003306
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0xec95aaa4
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140003301
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400032e0
cmp r8d, 0xb103888f
je 0x14000330b
test r9d, r9d
jne 0x1400032c0
mov rax, qword [rax]
jmp 0x140003290
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
lea rcx, str.failed_to_open_handle_n
call rax
jmp 0x140003339
lea rcx, str.Hello__world__n
call fcn.140001010
xor eax, eax
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.1400044e0
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret