Function at 0x1400f4c80
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x1401a4028]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r12, rdx
mov r13, rcx
mov qword [rsp + 0x50], rdx
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x1400f4cbc
mov rdx, qword [rdx]
xor ecx, ecx
lea rax, [r9 - 1]
lea r8, [r9 - 4]
cmp rax, r8
jbe 0x1400f4ce1
nop dword [rax + rax]
cmp byte [rax + rdx], 0x3d
jne 0x1400f4ce1
inc rcx
dec rax
cmp rax, r8
ja 0x1400f4cd0
shr r9, 2
lea r15, [r9 + r9*2]
sub r15, rcx
mov rax, qword [0x1401ae248]
test rax, rax
jne 0x1400f4db6
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov r11, rsi
nop dword [rax]
nop word [rax + rax]
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x1400f4d97
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x1400f4d97
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
lea rax, [rdi + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
mov edx, 0x6e0ce128
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1400f4d92
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x1400f4d70
cmp edx, 0xa3b9134
je 0x1400f5348
test r8d, r8d
jne 0x1400f4d50
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x1400f4dad
cmp qword [rax + 0x30], 0
jne 0x1400f4d20
xor eax, eax
mov qword [0x1401ae248], rax
lea rcx, [r15 + 1]
call rax
mov r14, rax
mov r9, qword [0x1401ae280]
test r9, r9
jne 0x1400f4e87
mov rcx, qword gs:[0x60]
mov rdx, qword [rcx + 0x18]
mov rcx, qword [rdx + 0x10]
mov rsi, qword [rcx]
mov r11, rsi
nop word [rax + rax]
mov r10, qword [r11 + 0x30]
movsxd rax, dword [r10 + 0x3c]
mov ebx, dword [rax + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400f4e67
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x1400f4e67
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
lea rax, [rdi + r8*4]
mov ecx, dword [rax + r10]
add rcx, r10
mov edx, 0x7283c0c0
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1400f4e62
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x1400f4e40
cmp edx, 0xf979bfe7
je 0x1400f5364
test r8d, r8d
jne 0x1400f4e20
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x1400f4e7d
cmp qword [rax + 0x30], 0
jne 0x1400f4df0
xor r9d, r9d
mov qword [0x1401ae280], r9
lea r8, [r15 + 1]
xor edx, edx
mov rcx, r14
call r9
mov rax, qword [0x1401ae270]
test rax, rax
jne 0x1400f4f56
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov r11, rsi
nop word [rax + rax]
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x1400f4f37
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x1400f4f37
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
lea rax, [rdi + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
mov edx, 0xab58645a
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1400f4f32
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x1400f4f10
cmp edx, 0x22a3e5c6
je 0x1400f5381
test r8d, r8d
jne 0x1400f4ef0
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x1400f4f4d
cmp qword [rax + 0x30], 0
jne 0x1400f4ec0
xor eax, eax
mov qword [0x1401ae270], rax
lea rcx, [r15 + 1]
call rax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], r15d
mov r9, qword [0x1401ae2d8]
test r9, r9
jne 0x1400f502c
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov r11, rsi
nop dword [rax]
mov r10, qword [r11 + 0x30]
movsxd rax, dword [r10 + 0x3c]
mov ebx, dword [rax + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400f5007
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x1400f5007
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
lea rax, [rdi + r8*4]
mov ecx, dword [rax + r10]
add rcx, r10
mov edx, 0x6b5eb137
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1400f5002
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x1400f4fe0
cmp edx, 0xab4ef97c
je 0x1400f539d
test r8d, r8d
jne 0x1400f4fc0
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x1400f501d
cmp qword [rax + 0x30], 0
jne 0x1400f4f90
xor r9d, r9d
mov qword [0x1401ae2d8], r9
mov rax, qword [rsp + 0x28]
lea r8, [r15 + 1]
xor edx, edx
mov rcx, rax
call r9
mov rax, qword [r13 + 8]
mov rcx, r12
cmp qword [r12 + 0x18], 0x10
jb 0x1400f504b
mov rcx, qword [r12]
mov r8, r14
mov edx, dword [r12 + 0x10]
call rax
test rax, rax
je 0x1400f5171
mov rax, qword [0x1401ae238]
test rax, rax
jne 0x1400f5126
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov r11, rsi
nop word [rax + rax]
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x1400f5107
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x1400f5107
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
lea rax, [rdi + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
mov edx, 0xc056547f
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1400f5102
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x1400f50e0
cmp edx, 0x11de856a
je 0x1400f53ba
test r8d, r8d
jne 0x1400f50c0
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x1400f511d
cmp qword [rax + 0x30], 0
jne 0x1400f5090
xor eax, eax
mov qword [0x1401ae238], rax
mov r8, r15
mov rdx, r14
mov rcx, qword [rsp + 0x28]
call rax
call qword [r13 + 0x20]
mov rbx, rax
test rax, rax
je 0x1400f5168
mov r9, qword [r13 + 0x18]
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rax
call r9
test eax, eax
jne 0x1400f5168
mov r9, qword [r13 + 0x10]
xor r8d, r8d
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x20]
call r9
mov rax, qword [r13 + 0x28]
mov rcx, rbx
call rax
mov rdx, qword [0x1401ae290]
test rdx, rdx
jne 0x1400f5236
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov r11, rsi
nop dword [rax + rax]
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x1400f5217
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x1400f5217
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
lea rax, [r9 + r8*4]
mov eax, dword [rax + rdi]
add rax, r9
mov edx, 0x3756267a
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x1400f5212
nop dword [rax]
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax]
lea rax, [rax + 1]
test cl, cl
jne 0x1400f51f0
cmp edx, 0xd5317ae6
je 0x1400f53d6
test r8d, r8d
jne 0x1400f51d0
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x1400f522d
cmp qword [rax + 0x30], 0
jne 0x1400f51a0
xor edx, edx
mov qword [0x1401ae290], rdx
mov ecx, dword [rsp + 0x48]
inc ecx
call rdx
mov rbp, rax
mov ecx, dword [rsp + 0x48]
mov byte [rcx + rax], 0
mov r10, qword [0x1401ae288]
test r10, r10
jne 0x1400f5307
mov rcx, qword gs:[0x60]
mov rdx, qword [rcx + 0x18]
mov rcx, qword [rdx + 0x10]
mov rsi, qword [rcx]
mov r11, rsi
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x1400f52e7
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x1400f52e7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
lea rax, [r9 + r8*4]
mov ecx, dword [rax + rdi]
add rcx, r9
mov edx, 0x99e5c875
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1400f52e2
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x1400f52c0
cmp edx, 0x66aa8d94
je 0x1400f53f2
test r8d, r8d
jne 0x1400f52a0
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x1400f52fd
cmp qword [rax + 0x30], 0
jne 0x1400f5270
xor r10d, r10d
mov qword [0x1401ae288], r10
mov r8d, dword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rcx, rbp
call r10
nop
mov rcx, r12
call fcn.1400d96a0
mov rax, rbp
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140106970
mov rbx, qword [rsp + 0xb0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rbx + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov eax, dword [rcx + rax*4]
add rax, r9
jmp 0x1400f4daf
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rbx + 0x24]
add rax, r10
movzx eax, word [rax + r8*2]
mov r9d, dword [rcx + rax*4]
add r9, r10
jmp 0x1400f4e80
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rbx + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov eax, dword [rcx + rax*4]
add rax, r9
jmp 0x1400f4f4f
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rbx + 0x24]
add rax, r10
movzx eax, word [rax + r8*2]
mov r9d, dword [rcx + rax*4]
add r9, r10
jmp 0x1400f5020
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rbx + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov eax, dword [rcx + rax*4]
add rax, r9
jmp 0x1400f511f
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rbx + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov edx, dword [rcx + rax*4]
add rdx, r9
jmp 0x1400f522f
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rbx + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov r10d, dword [rcx + rax*4]
add r10, r9
jmp 0x1400f5300