Function at 0x140055020
Capabilities:
Access peb ldr_data
Encode data using xor
Get system information on windows
Hash data using fnv
Make suspicious ntquerysysteminformation call
Resolve function by parsing pe exports

Disassembly:
push rbp
push rbx
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xc0
mov rax, qword [0x1400af040]
xor rax, rsp
mov qword [rbp + 0x2f], rax
xor edx, edx
lea r9, [rbp - 0x19]
mov r15, rcx
xor r12d, r12d
xor r8d, r8d
mov dword [rbp - 0x19], r12d
mov r14d, r12d
lea ecx, [rdx + 0x40]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x140055206
nop dword [rax]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140055105
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140055105
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r11 + r9*4]
mov r8d, dword [rdx + r10]
mov edx, 0xf30bd72b
add r8, r10
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x140055100
nop
movsx ecx, cl
lea r8, [r8 + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8 - 1]
test cl, cl
jne 0x1400550e0
cmp edx, 0x3f139cac
je 0x14005510a
test r9d, r9d
jne 0x1400550c0
mov rax, qword [rax]
jmp 0x140055090
mov ecx, dword [rbx + 0x24]
mov r8d, 0x8000
mov edx, dword [rbx + 0x1c]
add rcx, r10
add rdx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
xor edx, edx
add rax, r10
mov rcx, r14
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400551b5
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400551b5
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r11 + r9*4]
mov r8d, dword [rdx + r10]
mov edx, 0xfdfcddf2
add r8, r10
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x1400551b0
nop
movsx ecx, cl
lea r8, [r8 + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8 - 1]
test cl, cl
jne 0x140055190
cmp edx, 0xe4cd24ea
je 0x1400551ba
test r9d, r9d
jne 0x140055170
mov rax, qword [rax]
jmp 0x140055140
mov ecx, dword [rbx + 0x24]
mov r8d, 0x3000
mov edx, dword [rbx + 0x1c]
add rcx, r10
add rdx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
xor ecx, ecx
mov edx, dword [rbp - 0x19]
add rax, r10
lea r9d, [rcx + 4]
call rax
mov r8d, dword [rbp - 0x19]
lea r9, [rbp - 0x19]
mov rdx, rax
mov ecx, 0x40
mov r14, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x140055070
mov qword [rsp + 0xf8], rsi
mov qword [rsp + 0x100], rdi
test eax, eax
js 0x14005559f
test r14, r14
je 0x140055661
mov rsi, r12
mov edi, r12d
cmp qword [r14], r12
jbe 0x140055348
mov rax, r12
nop dword [rax]
lea rax, [rax + rax*4]
movups xmm0, xmmword [r14 + rax*8 + 0x10]
movups xmmword [rbp - 0x49], xmm0
movups xmm0, xmmword [r14 + rax*8 + 0x20]
movups xmmword [rbp - 0x39], xmm0
movsd xmm0, qword [r14 + rax*8 + 0x30]
mov rax, qword gs:[0x60]
movsd qword [rbp + 0x27], xmm0
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400552f7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400552f7
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
mov r8d, 0x57f95b16
lea rdx, [r11 + r9*4]
mov ecx, dword [rdx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1400552f2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x1400552d0
cmp r8d, 0x3edd0a35
je 0x1400552fc
test r9d, r9d
jne 0x1400552b0
mov rax, qword [rax]
jmp 0x140055280
mov ecx, dword [rbx + 0x24]
mov edx, dword [rbx + 0x1c]
add rcx, r10
add rdx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
call rax
movups xmm1, xmmword [rbp - 0x49]
mov ecx, eax
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, rcx
jne 0x140055334
cmp qword [rbp - 0x39], r15
je 0x140055343
inc edi
mov eax, edi
cmp rax, qword [r14]
jb 0x140055240
jmp 0x140055348
movq rsi, xmm1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400553d5
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400553d5
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r11 + r9*4]
mov r8d, dword [rdx + r10]
mov edx, 0x179e73d4
add r8, r10
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x1400553d0
nop
movsx ecx, cl
lea r8, [r8 + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8 - 1]
test cl, cl
jne 0x1400553b0
cmp edx, 0xa86d5ab5
je 0x1400553da
test r9d, r9d
jne 0x140055390
mov rax, qword [rax]
jmp 0x140055360
mov ecx, dword [rbx + 0x24]
mov r8d, 0x8000
mov edx, dword [rbx + 0x1c]
add rcx, r10
add rdx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
xor edx, edx
add rax, r10
mov rcx, r14
call rax
test rsi, rsi
je 0x140055661
lea r8, [rsi + 8]
mov qword [rbp - 9], r12
mov r9d, 8
lea rdx, [rbp - 9]
mov rcx, r15
call fcn.140053d40
test al, al
je 0x140055661
mov r8, qword [rbp - 9]
test r8, r8
je 0x140055661
add r8, 8
mov qword [rbp - 1], r12
mov r9d, 8
lea rdx, [rbp - 1]
mov rcx, r15
call fcn.140053d40
test al, al
je 0x140055661
mov r8, qword [rbp - 1]
test r8, r8
je 0x140055661
add r8, 0x28
mov qword [rbp - 0x11], r12
mov r9d, 8
lea rdx, [rbp - 0x11]
mov rcx, r15
call fcn.140053d40
test al, al
je 0x140055661
mov r8, qword [rbp - 0x11]
test r8, r8
je 0x140055661
xorps xmm0, xmm0
lea rdx, [rbp - 0x29]
add r8, 0x58
mov r9d, select
mov rcx, r15
movups xmmword [rbp - 0x29], xmm0
call fcn.140053d40
test al, al
je 0x140055661
movzx eax, word [rbp - 0x29]
test ax, ax
je 0x140055661
mov ecx, eax
mov eax, 2
shr rcx, 1
inc rcx
mul rcx
mov rbx, rax
mov rax, 0xffffffffffffffff
cmovo rbx, rax
mov rcx, rbx
call fcn.14007ffc4
mov r8, rbx
xor edx, edx
mov rcx, rax
mov rdi, rax
call sub.VCRUNTIME140.dll_memset
movzx r9d, word [rbp - 0x29]
mov rdx, rdi
mov r8, qword [rbp - 0x21]
mov rcx, r15
call fcn.140053d40
test al, al
je 0x14005558d
mov rax, qword [rbp - 0x11]
mov word [rbp - 0x29], r12w
add rax, 0x58
je 0x14005558d
mov qword [rsp + 0x38], r12
lea rcx, [rbp - 0x29]
mov qword [rbp + 0x1f], rax
lea r8, [rbp + 7]
lea rax, [rbp - 0x15]
mov qword [rbp + 0x17], rcx
mov qword [rsp + 0x30], rax
mov r9d, 0x28
mov dword [rsp + 0x28], r12d
mov edx, 0x80862007
mov rcx, r15
mov qword [rsp + 0x20], r12
mov qword [rbp + 0xf], r12
mov qword [rbp + 7], 0x33
mov qword [rbp + 0x27], select
mov dword [rbp - 0x15], r12d
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x14005558d
mov rcx, rdi
mov bl, 1
call fcn.14007fc40
movzx eax, bl
jmp 0x140055663
xor bl, bl
mov rcx, rdi
call fcn.14007fc40
movzx eax, bl
jmp 0x140055663
test r14, r14
je 0x140055661
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov r11d, dword [rcx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x140055635
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x140055635
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [rbx + r9*4]
mov r8d, dword [rdx + r10]
mov edx, 0x75392cf2
add r8, r10
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x140055630
nop
movsx ecx, cl
lea r8, [r8 + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8 - 1]
test cl, cl
jne 0x140055610
cmp edx, 0x6de977b7
je 0x14005563a
test r9d, r9d
jne 0x1400555f0
mov rax, qword [rax]
jmp 0x1400555c0
mov ecx, dword [r11 + 0x24]
xor edx, edx
add rcx, r10
movzx r8d, word [rcx + r9*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r10
mov eax, dword [rcx + r8*4]
mov r8d, 0x8000
add rax, r10
mov rcx, r14
call rax
xor al, al
mov rdi, qword [rsp + 0x100]
mov rsi, qword [rsp + 0xf8]
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.14007f7f0
add rsp, 0xc0
pop r15
pop r14
pop r12
pop rbx
pop rbp
ret