Function at 0x140002de0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1d8]
sub rsp, 0x2b0
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x140009040]
xor rax, rsp
mov qword [rbp + 0x198], rax
mov r13, rcx
mov ecx, 4
mov rax, qword gs:[0x58]
mov rdx, qword [rax]
mov eax, dword [rcx + rdx]
cmp dword [0x140009794], eax
jle 0x140002e85
lea rcx, [0x140009794]
call fcn.140005b6c
cmp dword [0x140009794], 0xffffffff
jne 0x140002e85
mov dword [0x140009790], 0x1d1c5c5
mov dword [0x140009788], 0x2eb8c5ea
mov dword [0x14000978c], 0xb05bd1b
lea rcx, [0x140006b70]
call fcn.140005e48
lea rcx, [0x140009794]
call fcn.140005b00
cmp byte [0x140009793], 0
je 0x140002ee2
xor byte [0x140009788], 0xa9
xor byte [0x140009789], 0xa9
xor byte [0x14000978a], 0xd1
xor byte [0x14000978b], 0x4b
xor byte [0x14000978c], 0x75
xor byte [0x14000978d], 0xc9
xor byte [0x14000978e], 0x2b
xor byte [0x14000978f], 0x6f
xor byte [0x140009790], 0xa9
xor byte [0x140009791], 0xa9
xor byte [0x140009792], 0xd1
mov byte [0x140009793], 0
xor r12d, r12d
mov qword [rbp - 0x80], r12
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
movabs rdi, 0x3f3be160fbd3b149
mov r8, rdi
lea rdx, [rbp - 0x78]
call fcn.1400050b0
mov rax, qword [rbp - 0x78]
test rax, rax
jne 0x14000326d
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], r12
mov rax, qword gs:[0x60]
mov r12, qword [rax + 0x18]
add r12, 0x10
mov rax, qword [r12]
mov r14, qword [rax]
mov qword [rbp + 0x130], r14
mov qword [rbp + 0x138], r12
xor r10d, r10d
mov qword [rbp + 0xe0], r14
mov qword [rbp + 0xe8], r14
mov qword [rbp + 0x140], r12
mov qword [rbp + 0x148], r12
cmp r14, r12
je 0x1400031fb
mov rsi, r14
mov qword [rbp + 0xe8], r14
movabs rbx, 0x218c04230219554a
lea r15, [r10 - 1]
test rsi, rsi
jne 0x140002f94
mov qword [rbp - 0x68], rsi
mov qword [rbp - 0x60], r10
lea rax, [rbp - 0x68]
jmp 0x140002fa0
movups xmm0, xmmword [rsi + 0x58]
movups xmmword [rbp + 0x68], xmm0
lea rax, [rbp + 0x68]
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xa0], xmm0
mov rcx, qword [rax + 8]
mov qword [rbp - 0x10], rcx
mov rax, r15
inc rax
cmp word [rcx + rax*2], 0
jne 0x140002fb5
mov qword [rbp - 8], rax
movaps xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rbp + 0x80], xmm0
lea r8, [rbp + 0x80]
mov rdx, rbx
call fcn.140001660
test al, al
jne 0x1400031db
xorps xmm0, xmm0
movups xmmword [rbp + 0xc0], xmm0
mov rcx, qword [rsi + 0x30]
mov qword [rbp + 0xc0], rcx
mov eax, dword [rcx + 0x3c]
mov edx, dword [rax + rcx + 0x88]
test rcx, rcx
jne 0x14000300e
xor eax, eax
jmp 0x140003012
lea rax, [rcx + rdx]
mov qword [rbp + 0xc8], rax
xor eax, eax
movups xmmword [rbp + 0x108], xmm0
movups xmmword [rbp + 0x118], xmm0
mov qword [rbp + 0x128], rax
mov byte [rsp + 0x20], al
mov r9, rdi
lea r8, [rbp + 0xc0]
lea rdx, [rbp + 0x108]
call fcn.1400051f0
mov rax, qword [rbp + 0xc8]
mov r8d, dword [rax + 0x18]
lea r11, [rbp + 0xc0]
mov qword [rbp - 0x40], r11
mov qword [rbp - 0x38], r8
xor r10d, r10d
mov qword [rbp - 0x30], r10
mov qword [rbp - 0x28], r10
mov qword [rbp - 0x20], r10
mov r9, qword [r11 + 8]
mov eax, dword [r9 + 0x18]
cmp r8, rax
jae 0x1400030de
mov rdx, qword [r11]
test rdx, rdx
jne 0x14000308d
mov ecx, r10d
jmp 0x14000309b
mov eax, dword [r9 + 0x20]
add rax, rdx
mov ecx, dword [rax + r8*4]
add rcx, rdx
mov qword [rbp], rcx
mov rax, r15
inc rax
cmp byte [rcx + rax], r10b
jne 0x1400030a2
mov qword [rbp + 8], rax
mov ecx, dword [r9 + 0x1c]
add rcx, rdx
mov eax, dword [r9 + 0x24]
add rax, rdx
movzx eax, word [rax + r8*2]
mov r9d, dword [rcx + rax*4]
test rdx, rdx
mov rax, r10
je 0x1400030d2
lea rax, [rdx + r9]
movups xmm0, xmmword [rbp]
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rax
cmp qword [rbp + 0x110], r8
jne 0x1400030f4
cmp qword [rbp + 0x108], r11
je 0x1400031de
mov rax, qword [rbp + 0xc0]
mov ecx, dword [rax + 0x3c]
mov rdx, qword [rcx + rax + 0x88]
mov ecx, edx
add rcx, rax
shr rdx, 0x20
add rdx, rcx
xor r12d, r12d
mov r8d, r12d
test rcx, rcx
cmovne r8, rdx
lea edx, [r12 + 1]
mov r9d, 0xff
mov r14, qword [rbp + 0x128]
cmp r14, rcx
je 0x140003144
mov eax, edx
cmovb eax, r9d
test al, al
js 0x14000336b
cmp r14, r8
je 0x14000336b
cmovb edx, r9d
test dl, dl
jns 0x14000336b
mov qword [rbp + 0x10], r14
mov rbx, r15
inc rbx
cmp byte [r14 + rbx], r10b
jne 0x140003160
mov qword [rbp + 0x18], rbx
test rbx, rbx
je 0x14000327e
mov r8, rbx
mov edx, 0x2e
mov rcx, r14
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x14000327e
sub rax, r14
cmp rax, 0xffffffffffffffff
je 0x14000327e
mov rcx, rax
cmp rbx, rax
cmovb rcx, rbx
mov qword [rbp + 0xf8], r14
mov qword [rbp + 0x100], rcx
inc rax
cmp rbx, rax
jb 0x140003b31
sub rbx, rax
cmp rbx, 0xffffffffffffffff
cmovb r15, rbx
movups xmm0, xmmword [rbp + 0xf8]
lea rsi, [r14 + rax]
jmp 0x14000328b
xor r10d, r10d
mov r14, qword [r14]
mov rsi, r14
mov qword [rbp + 0xe0], r14
mov qword [rbp + 0xe8], r14
cmp r14, r12
jne 0x140002f81
xor r12d, r12d
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], r12
movaps xmm6, xmmword [rbp + 0xd0]
movaps xmmword [rbp - 0x50], xmm6
movups xmmword [rbp - 0x78], xmm6
mov qword [rbp + 0xf0], rdi
movdqa xmmword [rbp + 0x90], xmm6
lea rbx, [0x1400097c0]
mov qword [rbp + 0x60], rbx
mov rcx, rbx
call sub.KERNEL32.dll_AcquireSRWLockExclusive
nop
lea r9, [rbp + 0x90]
lea r8, [rbp + 0xf0]
lea rdx, [rbp + 0xb0]
lea rcx, [0x1400097c8]
call fcn.140005450
nop
mov rcx, rbx
call sub.KERNEL32.dll_ReleaseSRWLockExclusive
movq rax, xmm6
test rax, rax
jne 0x14000337e
mov rax, r12
jmp 0x140003388
movups xmm0, xmmword [rbp + 0x10]
mov rsi, r12
mov r15, r12
mov rcx, rbx
movups xmmword [rbp + 0x150], xmm0
mov r11d, r12d
mov r10d, 0x5a7f5a6c
mov r9d, r10d
movabs rbx, 0x100000001b3
test rcx, rcx
je 0x140003317
movq rbx, xmm0
mov r14, qword [rbp + 0x158]
movabs rdi, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
movzx r8d, byte [rbx]
lea edx, [r8 - 0x41]
lea eax, [r8 + 0x20]
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movsx rax, cl
xor rax, r9
imul rax, rdi
add r9, rax
inc r11d
lea rbx, [rbx + 1]
movsxd rax, r11d
cmp rax, r14
jb 0x1400032d0
movabs rdi, 0x3f3be160fbd3b149
movabs rbx, 0x100000001b3
mov r11d, r12d
test r15, r15
je 0x140003353
nop
movzx r8d, byte [rsi]
lea edx, [r8 - 0x41]
lea eax, [r8 + 0x20]
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movsx rax, cl
xor rax, r10
imul rax, rbx
add r10, rax
inc r11d
lea rsi, [rsi + 1]
movsxd rax, r11d
cmp rax, r15
jb 0x140003320
mov r8, r10
lea rdx, [rbp + 0xd0]
lea rcx, [rbp - 0x50]
call fcn.140001340
jmp 0x14000320c
mov qword [rbp + 0xd0], r14
mov qword [rbp + 0xd8], rsi
jmp 0x14000320c
lea rcx, [0x140009788]
call rax
nop
mov qword [rbp - 0x80], rax
mov qword [r13], rax
test rax, rax
jne 0x140003a7f
mov dword [rsp + 0x39], r12d
mov byte [rsp + 0x3d], al
mov word [rbp + 0x175], 0x72
mov dword [rbp + 0x170], 0x7206ae72
mov byte [rbp + 0x174], 0xff
mov rdx, r12
nop
movzx ecx, byte [rbp + rdx + 0x170]
movzx eax, byte [rbp + rdx + 0x171]
mov byte [rbp + rdx + 0x170], al
mov byte [rbp + rdx + 0x171], cl
add rdx, 2
cmp rdx, 6
jb 0x1400033c0
movzx eax, byte [rbp + 0x170]
not al
movzx r9d, al
and r9b, 0xd5
add r9b, r9b
shr al, 1
and al, 0x55
or r9b, al
xor r10b, r10b
mov r8d, r12d
mov edx, 7
nop
movzx eax, r9b
movzx ecx, r8b
shr al, cl
and al, 1
mov ecx, edx
shl al, cl
or r10b, al
inc r8d
dec edx
cmp edx, 0xffffffff
jg 0x140003410
mov byte [rsp + 0x38], r10b
movzx eax, byte [rbp + 0x171]
not al
movzx r9d, al
and r9b, 0xd5
add r9b, r9b
shr al, 1
and al, 0x55
or r9b, al
xor r10b, r10b
mov r8d, r12d
mov edx, 7
nop dword [rax + rax]
movzx eax, r9b
movzx ecx, r8b
shr al, cl
and al, 1
mov ecx, edx
shl al, cl
or r10b, al
inc r8d
dec edx
cmp edx, 0xffffffff
jg 0x140003460
mov byte [rsp + 0x39], r10b
movzx eax, byte [rbp + 0x172]
not al
movzx r9d, al
and r9b, 0xd5
add r9b, r9b
shr al, 1
and al, 0x55
or r9b, al
xor r10b, r10b
mov r8d, r12d
mov edx, 7
nop dword [rax + rax]
movzx eax, r9b
movzx ecx, r8b
shr al, cl
and al, 1
mov ecx, edx
shl al, cl
or r10b, al
inc r8d
dec edx
cmp edx, 0xffffffff
jg 0x1400034b0
mov byte [rsp + 0x3a], r10b
movzx eax, byte [rbp + 0x173]
not al
movzx r9d, al
and r9b, 0xd5
add r9b, r9b
shr al, 1
and al, 0x55
or r9b, al
xor r10b, r10b
mov r8d, r12d
mov edx, 7
nop dword [rax + rax]
movzx eax, r9b
movzx ecx, r8b
shr al, cl
and al, 1
mov ecx, edx
shl al, cl
or r10b, al
inc r8d
dec edx
cmp edx, 0xffffffff
jg 0x140003500
mov byte [rsp + 0x3b], r10b
movzx eax, byte [rbp + 0x174]
not al
movzx r9d, al
and r9b, 0xd5
add r9b, r9b
shr al, 1
and al, 0x55
or r9b, al
xor r10b, r10b
mov r8d, r12d
mov edx, 7
nop dword [rax + rax]
movzx eax, r9b
movzx ecx, r8b
shr al, cl
and al, 1
mov ecx, edx
shl al, cl
or r10b, al
inc r8d
dec edx
cmp edx, 0xffffffff
jg 0x140003550
mov byte [rsp + 0x3c], r10b
movzx eax, byte [rbp + 0x175]
not al
movzx r9d, al
and r9b, 0xd5
add r9b, r9b
shr al, 1
and al, 0x55
or r9b, al
xor r10b, r10b
mov r8d, r12d
mov edx, 7
nop dword [rax + rax]
movzx eax, r9b
movzx ecx, r8b
shr al, cl
and al, 1
mov ecx, edx
shl al, cl
or r10b, al
inc r8d
dec edx
cmp edx, 0xffffffff
jg 0x1400035a0
mov byte [rsp + 0x3d], r10b
mov byte [rsp + 0x3e], 0
movdqa xmm1, xmmword [0x140007410]
movdqu xmmword [rsp + 0x40], xmm1
mov dword [rsp + 0x50], 0x96a63ec6
mov dword [rsp + 0x54], 0x47e646e2
mov word [rsp + 0x58], 0xc6c6
mov byte [rsp + 0x5a], 0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x78], eax
mov word [rbp + 0x192], ax
movups xmmword [rbp + 0x178], xmm1
movsd xmm0, qword [rsp + 0x50]
movsd qword [rbp + 0x188], xmm0
movzx eax, word [rsp + 0x58]
mov word [rbp + 0x190], ax
mov rdx, r12
nop
movzx ecx, byte [rbp + rdx + 0x178]
movzx eax, byte [rbp + rdx + 0x179]
mov byte [rbp + rdx + 0x178], al
mov byte [rbp + rdx + 0x179], cl
add rdx, 2
cmp rdx, 0x1b
jb 0x140003630
mov r8, r12
nop dword [rax + rax]
movzx eax, byte [rbp + r8 + 0x178]
not al
movzx r10d, al
and r10b, 0xd5
add r10b, r10b
shr al, 1
and al, 0x55
or r10b, al
xor r11b, r11b
mov r9d, r12d
mov edx, 7
nop dword [rax + rax]
movzx eax, r10b
movzx ecx, r9b
shr al, cl
and al, 1
mov ecx, edx
shl al, cl
or r11b, al
inc r9d
dec edx
cmp edx, 0xffffffff
jg 0x140003690
mov byte [rsp + r8 + 0x60], r11b
movzx eax, byte [rbp + r8 + 0x179]
not al
movzx r11d, al
and r11b, 0xd5
add r11b, r11b
shr al, 1
and al, 0x55
or r11b, al
xor r10b, r10b
mov r9d, r12d
mov edx, 7
nop word [rax + rax]
movzx eax, r11b
movzx ecx, r9b
shr al, cl
and al, 1
mov ecx, edx
shl al, cl
or r10b, al
inc r9d
dec edx
cmp edx, 0xffffffff
jg 0x1400036e0
mov byte [rsp + r8 + 0x61], r10b
movzx eax, byte [rbp + r8 + 0x17a]
not al
movzx r11d, al
and r11b, 0xd5
add r11b, r11b
shr al, 1
and al, 0x55
or r11b, al
xor r10b, r10b
mov r9d, r12d
mov edx, 7
nop word [rax + rax]
movzx eax, r11b
movzx ecx, r9b
shr al, cl
and al, 1
mov ecx, edx
shl al, cl
or r10b, al
inc r9d
dec edx
cmp edx, 0xffffffff
jg 0x140003730
mov byte [rsp + r8 + 0x62], r10b
movzx eax, byte [rbp + r8 + 0x17b]
not al
movzx r11d, al
and r11b, 0xd5
add r11b, r11b
shr al, 1
and al, 0x55
or r11b, al
xor r10b, r10b
mov r9d, r12d
mov edx, 7
nop word [rax + rax]
movzx eax, r11b
movzx ecx, r9b
shr al, cl
and al, 1
mov ecx, edx
shl al, cl
or r10b, al
inc r9d
dec edx
cmp edx, 0xffffffff
jg 0x140003780
mov byte [rsp + r8 + 0x63], r10b
movzx eax, byte [rbp + r8 + 0x17c]
not al
movzx r11d, al
and r11b, 0xd5
add r11b, r11b
shr al, 1
and al, 0x55
or r11b, al
xor r10b, r10b
mov r9d, r12d
mov edx, 7
nop word [rax + rax]
movzx eax, r11b
movzx ecx, r9b
shr al, cl
and al, 1
mov ecx, edx
shl al, cl
or r10b, al
inc r9d
dec edx
cmp edx, 0xffffffff
jg 0x1400037d0
mov byte [rsp + r8 + 0x64], r10b
movzx eax, byte [rbp + r8 + 0x17d]
not al
movzx r11d, al
and r11b, 0xd5
add r11b, r11b
shr al, 1
and al, 0x55
or r11b, al
xor r10b, r10b
mov r9d, r12d
mov edx, 7
nop word [rax + rax]
movzx eax, r11b
movzx ecx, r9b
shr al, cl
and al, 1
mov ecx, edx
shl al, cl
or r10b, al
inc r9d
dec edx
cmp edx, 0xffffffff
jg 0x140003820
mov byte [rsp + r8 + 0x65], r10b
movzx eax, byte [rbp + r8 + 0x17e]
not al
movzx r11d, al
and r11b, 0xd5
add r11b, r11b
shr al, 1
and al, 0x55
or r11b, al
xor r10b, r10b
mov r9d, r12d
mov edx, 7
nop word [rax + rax]
movzx eax, r11b
movzx ecx, r9b
shr al, cl
and al, 1
mov ecx, edx
shl al, cl
or r10b, al
inc r9d
dec edx
cmp edx, 0xffffffff
jg 0x140003870
mov byte [rsp + r8 + 0x66], r10b
movzx eax, byte [rbp + r8 + 0x17f]
not al
movzx r11d, al
and r11b, 0xd5
add r11b, r11b
shr al, 1
and al, 0x55
or r11b, al
xor r10b, r10b
mov r9d, r12d
mov edx, 7
nop word [rax + rax]
movzx eax, r11b
movzx ecx, r9b
shr al, cl
and al, 1
mov ecx, edx
shl al, cl
or r10b, al
inc r9d
dec edx
cmp edx, 0xffffffff
jg 0x1400038c0
mov byte [rsp + r8 + 0x67], r10b
movzx eax, byte [rbp + r8 + 0x180]
not al
movzx r11d, al
and r11b, 0xd5
add r11b, r11b
shr al, 1
and al, 0x55
or r11b, al
xor r10b, r10b
mov r9d, r12d
mov edx, 7
nop word [rax + rax]
movzx eax, r11b
movzx ecx, r9b
shr al, cl
and al, 1
mov ecx, edx
shl al, cl
or r10b, al
inc r9d
dec edx
cmp edx, 0xffffffff
jg 0x140003910
mov byte [rsp + r8 + 0x68], r10b
add r8, 9
cmp r8, 0x1b
jb 0x140003660
mov byte [rsp + 0x7b], 0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400039d6
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400039d6
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov ecx, dword [rcx + rdi]
add rcx, r10
mov r8d, 0x9797edb5
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1400039d1
nop dword [rax]
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x1400039b0
cmp r8d, 0x5ae8cad4
je 0x1400039db
test r9d, r9d
jne 0x140003990
mov rax, qword [rax]
jmp 0x140003960
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov r9d, 0x10
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x60]
xor ecx, ecx
call rax
mov byte [rbp + 0x20], 0xd6
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x21], xmm0
mov qword [rbp + 0x31], rax
mov qword [rsp + 0x30], r12
mov rax, qword [rsp + 0x30]
cmp rax, 0x19
jae 0x140003a79
movabs r9, 0xd3bea0386f7cd923
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x30]
movzx edx, byte [rbp + rax + 0x20]
add rcx, r9
mov rax, rcx
and rax, rdx
imul r8, rax, 0xfffffffffffffffe
add r8, rcx
add r8, rdx
add r8b, 0xb
mov rax, qword [rsp + 0x30]
mov byte [rbp + rax + 0x20], r8b
mov rax, qword [rsp + 0x30]
inc rax
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp rax, 0x19
jb 0x140003a31
movzx eax, byte [rbp + 0x20]
jmp 0x140003afc
mov byte [rbp + 0x40], 0x69
xorps xmm0, xmm0
movups xmmword [rbp + 0x41], xmm0
mov qword [rsp + 0x30], r12
mov rax, qword [rsp + 0x30]
cmp rax, 0x11
jae 0x140003af8
movabs r9, 0xabb84685416ae211
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x30]
movzx edx, byte [rbp + rax + 0x40]
add rcx, r9
mov rax, rcx
and rax, rdx
imul r8, rax, 0xfffffffffffffffe
add r8, rcx
add r8, rdx
sub r8b, 0x77
mov rax, qword [rsp + 0x30]
mov byte [rbp + rax + 0x40], r8b
mov rax, qword [rsp + 0x30]
inc rax
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp rax, 0x11
jb 0x140003ab0
movzx eax, byte [rbp + 0x40]
mov rcx, qword [rbp + 0x198]
xor rcx, rsp
call fcn.140005ae0
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140005090
nop
int3