Function at 0x140030840
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using murmur2
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push rbp
push r12
push r13
sub rsp, 0xa0
xor r13d, r13d
mov r12, rdx
mov qword [rcx + 0xa8], r13
mov rbp, rcx
mov qword [rcx + 0xb8], r13
mov byte [rcx + 0xb0], r13b
mov qword [rcx + 0x9c], r13
mov dword [rcx + 0x98], r13d
mov dword [rcx + 0xc8], r13d
test rdx, rdx
jne 0x140030897
mov eax, 0x10000
add rsp, 0xa0
pop r13
pop r12
pop rbp
ret
mov qword [rsp + 0xd0], rbx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x98], rsi
mov qword [rsp + 0x90], rdi
call fcn.140035130
mov rdi, rax
movsx ebx, byte [rax]
mov ecx, ebx
call fcn.140014160
add ebx, eax
cmp ebx, 0xfffffff0
jg 0x1400308d7
mov edx, 0x84
call fcn.140052d80
cmp ebx, 0xffffffb7
jg 0x1400308e6
mov edx, 0x9d
call fcn.140052d80
imul eax, ebx, 0x5bd1e995
lea r8, [rdi + 4]
mov edx, r13d
mov r9, r8
mov r10d, 8
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul r11d, ecx, 0x5bd1e995
nop word [rax + rax]
mov eax, r11d
lea r9, [r9 + 4]
xor eax, edx
add edx, 0x5bd1e995
imul ecx, eax, 0x286a90b9
xor ecx, 0xaa2a7357
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov dword [r9 - 4], eax
sub r10, 1
jne 0x140030910
mov r9d, dword [0x14018719c]
mov rdx, qword [rdi + 0x28]
call fcn.1400525a0
mov rsi, rax
test rax, rax
jne 0x140030970
mov rsi, r13
jmp 0x1400309b5
movzx eax, byte [rdi]
xor byte [rsi], al
movzx eax, byte [rdi]
xor byte [rsi + 1], al
movzx eax, byte [rdi]
xor byte [rsi + 2], al
movzx eax, byte [rdi]
xor byte [rsi + 3], al
movzx eax, byte [rdi]
xor byte [rsi + 4], al
movzx eax, byte [rdi]
xor byte [rsi + 5], al
movzx eax, byte [rdi]
xor byte [rsi + 6], al
movzx eax, byte [rdi]
xor byte [rsi + 7], al
movzx eax, byte [rdi]
xor byte [rsi + 8], al
movzx eax, byte [rdi]
xor byte [rsi + 9], al
movzx eax, byte [rdi]
xor byte [rsi + 0xa], al
mov byte [rsi + 0xb], r13b
mov rax, qword gs:[0x60]
mov qword [rsp + 0x88], r14
mov qword [rsp + 0x80], r15
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rdi, qword [rax]
cmp qword [rdi + 0x60], r13
je 0x140030aa9
mov eax, 0x5a4d
nop dword [rax + rax]
mov r11, qword [rdi + 0x30]
mov rdi, qword [rdi]
test r11, r11
je 0x140030a9f
cmp word [r11], ax
jne 0x140030aa9
movsxd rax, dword [r11 + 0x3c]
cmp dword [rax + r11], 0x4550
jne 0x140030aa9
mov ecx, dword [rax + r11 + 0x88]
test ecx, ecx
je 0x140030aa9
mov r14d, dword [r11 + rcx + 0x1c]
lea rax, [r11 + rcx]
mov r9d, dword [rax + 0x20]
add r14, r11
mov r15d, dword [rax + 0x24]
add r9, r11
mov ebx, dword [rax + 0x18]
add r15, r11
mov r10d, r13d
test ebx, ebx
je 0x140030a9a
mov eax, dword [r9]
xor dl, dl
add rax, r11
cmp byte [rax], dl
je 0x140030a8e
mov r8, rsi
sub r8, rax
movzx ecx, byte [rax + r8]
test cl, cl
je 0x140030a8a
cmp byte [rax], cl
jne 0x140030a8e
inc rax
mov dl, 1
cmp byte [rax], r13b
jne 0x140030a62
movsxd rax, r10d
movzx ecx, word [r15 + rax*2]
mov eax, dword [r14 + rcx*4]
add rax, r11
jmp 0x140030aac
test dl, dl
jne 0x140030a79
inc r10d
add r9, 4
cmp r10d, ebx
jb 0x140030a50
mov eax, 0x5a4d
cmp qword [rdi + 0x60], r13
jne 0x1400309f0
mov rax, r13
xor r9d, r9d
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], r13d
mov edx, 0x80000000
mov rcx, r12
mov qword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call rax
mov r15, qword [rsp + 0x80]
mov rbx, rax
mov r14, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x98]
cmp rax, 0xffffffffffffffff
jne 0x140030af8
mov eax, 0x200
jmp 0x140030b21
xor r8d, r8d
mov rdx, rbx
mov rcx, rbp
call fcn.140030b40
mov edi, eax
test eax, eax
je 0x140030b18
mov rdx, rbx
call fcn.140052f50
mov eax, edi
jmp 0x140030b21
mov byte [rbp + 0xb0], 1
xor eax, eax
mov rbx, qword [rsp + 0xd0]
mov rdi, qword [rsp + 0x90]
add rsp, 0xa0
pop r13
pop r12
pop rbp
ret