Function at 0x7ff70b510dc0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xd0
movaps xmmword [rax - 0x38], xmm6
call fcn.7ff70b50fd50
xor ebx, ebx
mov dl, 1
mov ecx, ebx
call fcn.7ff70b50b5e0
inc ebx
cmp ebx, 0x23
jl 0x7ff70b510df2
lea rcx, [rbp + 7]
call fcn.7ff70b53bb60
xorps xmm0, xmm0
movaps xmmword [rbp - 0x59], xmm0
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x19]
call fcn.7ff70b4fd090
movups xmm6, xmmword [rax]
mov qword [rbp - 0x49], 0
xor r14d, r14d
mov edi, 0xb2c300e2
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
movups xmm0, xmmword [rax + 0x58]
movups xmmword [rbp - 0x59], xmm0
movd ecx, xmm0
sub cx, 8
test r14d, r14d
je 0x7ff70b510eb3
mov r9, qword [rbp - 0x51]
movzx ecx, cx
shr rcx, 1
lea r11, [r9 + rcx*2]
mov r10d, 0x811c9dc5
cmp r9, r11
je 0x7ff70b510eaa
nop
movsx ecx, byte [r9]
mov edx, ecx
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
add r9, 2
cmp r9, r11
jne 0x7ff70b510e80
cmp r10d, r14d
jne 0x7ff70b51100a
mov rbx, qword [rax + 0x30]
test rbx, rbx
je 0x7ff70b511012
movsxd rcx, dword [rbx + 0x3c]
mov rdx, qword [rcx + rbx + 0x88]
mov r13, rdx
shr r13, 0x20
mov esi, edx
add rsi, rbx
cmp rsi, rbx
je 0x7ff70b51100a
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x7ff70b51100a
mov r12d, dword [rsi + 0x20]
dec r11d
lea rcx, [rbx + r11*4]
mov r9d, dword [rcx + r12]
add r9, rbx
mov r10d, 0x811c9dc5
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x7ff70b510f3d
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x7ff70b510f12
cmp r10d, edi
je 0x7ff70b510f4f
test r11d, r11d
jne 0x7ff70b510ef2
mov rax, qword [rax]
jmp 0x7ff70b510e50
mov ecx, dword [rsi + 0x1c]
add rcx, rbx
mov eax, dword [rsi + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov edx, dword [rcx + rax*4]
add rdx, rbx
cmp rdx, rsi
jbe 0x7ff70b511014
lea rax, [rsi + r13]
cmp rdx, rax
jae 0x7ff70b511014
mov edi, 0x811c9dc5
mov r14d, edi
movzx r8d, byte [rdx]
cmp r8b, 0x2e
je 0x7ff70b510fbb
nop
movsx eax, r8b
sub r8b, 0x41
mov ecx, eax
or ecx, 0x20
cmp r8b, 0x19
cmova ecx, eax
xor ecx, r14d
imul r14d, ecx, 0x1000193
inc rdx
movzx r8d, byte [rdx]
cmp r8b, 0x2e
jne 0x7ff70b510f90
inc rdx
movzx r8d, byte [rdx]
test r8b, r8b
je 0x7ff70b510ff9
nop word [rax + rax]
movsx eax, r8b
sub r8b, 0x41
mov ecx, eax
or ecx, 0x20
cmp r8b, 0x19
cmova ecx, eax
xor ecx, edi
imul edi, ecx, 0x1000193
lea rdx, [rdx + 1]
movzx r8d, byte [rdx]
test r8b, r8b
jne 0x7ff70b510fd0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rax, qword [rax]
jmp 0x7ff70b510e50
xor edx, edx
mov rcx, rdx
call fcn.7ff70b5266f0
xor r14d, r14d
mov esi, 0x8b519c0d
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
movups xmm0, xmmword [rax + 0x58]
movups xmmword [rbp - 0x59], xmm0
movd ecx, xmm0
sub cx, 8
test r14d, r14d
je 0x7ff70b5110a3
mov r9, qword [rbp - 0x51]
movzx ecx, cx
shr rcx, 1
lea r11, [r9 + rcx*2]
mov r10d, 0x811c9dc5
cmp r9, r11
je 0x7ff70b51109a
nop
movsx ecx, byte [r9]
mov edx, ecx
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
add r9, 2
cmp r9, r11
jne 0x7ff70b511070
cmp r10d, r14d
jne 0x7ff70b5111fa
mov rbx, qword [rax + 0x30]
test rbx, rbx
je 0x7ff70b511202
movsxd rcx, dword [rbx + 0x3c]
mov rdx, qword [rcx + rbx + 0x88]
mov r13, rdx
shr r13, 0x20
mov edi, edx
add rdi, rbx
cmp rdi, rbx
je 0x7ff70b5111fa
mov r11d, dword [rdi + 0x18]
test r11d, r11d
je 0x7ff70b5111fa
mov r12d, dword [rdi + 0x20]
dec r11d
lea rcx, [r12 + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0x811c9dc5
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x7ff70b51112d
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x7ff70b511102
cmp r10d, esi
je 0x7ff70b51113f
test r11d, r11d
jne 0x7ff70b5110e2
mov rax, qword [rax]
jmp 0x7ff70b511040
mov ecx, dword [rdi + 0x1c]
add rcx, rbx
mov eax, dword [rdi + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov edx, dword [rcx + rax*4]
add rdx, rbx
cmp rdx, rdi
jbe 0x7ff70b511204
lea rax, [rdi + r13]
cmp rdx, rax
jae 0x7ff70b511204
mov esi, 0x811c9dc5
mov r14d, esi
movzx r8d, byte [rdx]
cmp r8b, 0x2e
je 0x7ff70b5111ab
nop
movsx eax, r8b
sub r8b, 0x41
mov ecx, eax
or ecx, 0x20
cmp r8b, 0x19
cmova ecx, eax
xor ecx, r14d
imul r14d, ecx, 0x1000193
inc rdx
movzx r8d, byte [rdx]
cmp r8b, 0x2e
jne 0x7ff70b511180
inc rdx
movzx r8d, byte [rdx]
test r8b, r8b
je 0x7ff70b5111e9
nop word [rax + rax]
movsx eax, r8b
sub r8b, 0x41
mov ecx, eax
or ecx, 0x20
cmp r8b, 0x19
cmova ecx, eax
xor ecx, esi
imul esi, ecx, 0x1000193
lea rdx, [rdx + 1]
movzx r8d, byte [rdx]
test r8b, r8b
jne 0x7ff70b5111c0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rax, qword [rax]
jmp 0x7ff70b511040
xor edx, edx
lea rcx, [0x7ff70b5104d0]
call rdx
lea rax, [rbp - 0x49]
mov qword [rbp - 0x29], rax
lea rax, [rbp + 0x67]
mov qword [rbp - 0x21], rax
mov ecx, 0x10
call fcn.7ff70b4dd450
test rax, rax
je 0x7ff70b511233
movups xmm0, xmmword [rbp - 0x29]
movups xmmword [rax], xmm0
lea rcx, [rbp - 0x31]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x7ff70b531130]
xor edx, edx
xor ecx, ecx
call fcn.7ff70b55607c
mov qword [rbp - 0x39], rax
test rax, rax
je 0x7ff70b5118b7
cmp dword [rbp - 0x31], 0
je 0x7ff70b5118c9
call sub.kernel32.dll_GetCurrentThreadId
cmp dword [rbp - 0x31], eax
je 0x7ff70b5118d4
movaps xmm0, xmmword [rbp - 0x39]
movdqa xmmword [rbp - 0x59], xmm0
xor edx, edx
lea rcx, [rbp - 0x59]
call fcn.7ff70b54b510
test eax, eax
jne 0x7ff70b5118df
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x39], xmm0
movdqa xmmword [rbp - 0x59], xmm6
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 9]
call fcn.7ff70b4fd090
movups xmm2, xmmword [rax]
movsd xmm1, qword [0x7ff70b595968]
mov r9d, 0x89eabb08
mov dword [rbp - 0x69], r9d
comisd xmm1, xmm2
jbe 0x7ff70b5114b7
xor r15d, r15d
mov edi, r9d
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
movups xmm0, xmmword [rax + 0x58]
movups xmmword [rbp - 0x59], xmm0
movd ecx, xmm0
sub cx, 8
test r15d, r15d
je 0x7ff70b511353
mov r9, qword [rbp - 0x51]
movzx ecx, cx
shr rcx, 1
lea r11, [r9 + rcx*2]
mov r10d, 0x811c9dc5
cmp r9, r11
je 0x7ff70b51134a
nop
movsx ecx, byte [r9]
mov edx, ecx
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
add r9, 2
cmp r9, r11
jne 0x7ff70b511320
cmp r10d, r15d
jne 0x7ff70b511498
mov rbx, qword [rax + 0x30]
test rbx, rbx
je 0x7ff70b5114a0
movsxd rcx, dword [rbx + 0x3c]
mov rdx, qword [rcx + rbx + 0x88]
mov r13, rdx
shr r13, 0x20
mov esi, edx
add rsi, rbx
cmp rsi, rbx
je 0x7ff70b511498
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x7ff70b511498
mov r12d, dword [rsi + 0x20]
dec r11d
lea rcx, [r12 + r11*4]
mov r8d, dword [rcx + rbx]
add r8, rbx
mov r10d, 0x811c9dc5
movzx r9d, byte [r8]
inc r8
test r9b, r9b
je 0x7ff70b5113dd
movsx ecx, r9b
sub r9b, 0x41
mov edx, ecx
or edx, 0x20
cmp r9b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r9d, byte [r8]
lea r8, [r8 + 1]
test r9b, r9b
jne 0x7ff70b5113b2
cmp r10d, edi
je 0x7ff70b5113ef
test r11d, r11d
jne 0x7ff70b511392
mov rax, qword [rax]
jmp 0x7ff70b5112f0
mov ecx, dword [rsi + 0x24]
add rcx, rbx
movzx edx, word [rcx + r11*2]
mov ecx, dword [rsi + 0x1c]
add rcx, rbx
mov r8d, dword [rcx + rdx*4]
add r8, rbx
cmp r8, rsi
jbe 0x7ff70b5114a3
lea rax, [rsi + r13]
cmp r8, rax
jae 0x7ff70b5114a3
mov edi, 0x811c9dc5
mov r15d, edi
movzx edx, byte [r8]
cmp dl, 0x2e
je 0x7ff70b511457
nop
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, r15d
imul r15d, ecx, 0x1000193
inc r8
movzx edx, byte [r8]
cmp dl, 0x2e
jne 0x7ff70b511430
inc r8
movzx edx, byte [r8]
test dl, dl
je 0x7ff70b511487
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, edi
imul edi, ecx, 0x1000193
lea r8, [r8 + 1]
movzx edx, byte [r8]
test dl, dl
jne 0x7ff70b511462
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rax, qword [rax]
jmp 0x7ff70b5112f0
xor r8d, r8d
subsd xmm1, xmm2
mulsd xmm1, qword [0x7ff70b595978]
cvttsd2si rcx, xmm1
call r8
xor esi, esi
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
movups xmm0, xmmword [rax + 0x58]
movups xmmword [rbp - 0x59], xmm0
movd ecx, xmm0
sub cx, 8
test esi, esi
je 0x7ff70b511533
mov r9, qword [rbp - 0x51]
movzx ecx, cx
shr rcx, 1
lea r11, [r9 + rcx*2]
mov r10d, 0x811c9dc5
cmp r9, r11
je 0x7ff70b51152a
nop dword [rax]
movsx ecx, byte [r9]
mov edx, ecx
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
add r9, 2
cmp r9, r11
jne 0x7ff70b511500
cmp r10d, esi
jne 0x7ff70b51167e
mov rbx, qword [rax + 0x30]
test rbx, rbx
je 0x7ff70b511686
movsxd rcx, dword [rbx + 0x3c]
mov rdx, qword [rcx + rbx + 0x88]
mov r12, rdx
shr r12, 0x20
mov edi, edx
add rdi, rbx
cmp rdi, rbx
je 0x7ff70b51167e
mov r11d, dword [rdi + 0x18]
test r11d, r11d
je 0x7ff70b51167e
mov r15d, dword [rdi + 0x20]
dec r11d
lea rcx, [r15 + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0x811c9dc5
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x7ff70b5115bd
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x7ff70b511592
cmp r10d, dword [rbp - 0x69]
je 0x7ff70b5115d0
test r11d, r11d
jne 0x7ff70b511572
mov rax, qword [rax]
jmp 0x7ff70b5114d0
mov ecx, dword [rdi + 0x24]
add rcx, rbx
movzx edx, word [rcx + r11*2]
mov ecx, dword [rdi + 0x1c]
add rcx, rbx
mov r8d, dword [rcx + rdx*4]
add r8, rbx
cmp r8, rdi
jbe 0x7ff70b511689
lea rax, [r12 + rdi]
cmp r8, rax
jae 0x7ff70b511689
mov esi, 0x811c9dc5
mov r9d, esi
mov dword [rbp - 0x69], esi
movzx edx, byte [r8]
cmp dl, 0x2e
je 0x7ff70b511637
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, esi
imul esi, ecx, 0x1000193
inc r8
movzx edx, byte [r8]
cmp dl, 0x2e
jne 0x7ff70b511612
inc r8
movzx edx, byte [r8]
test dl, dl
je 0x7ff70b51166d
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
lea r8, [r8 + 1]
movzx edx, byte [r8]
test dl, dl
jne 0x7ff70b511642
mov dword [rbp - 0x69], r9d
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rax, qword [rax]
jmp 0x7ff70b5114d0
xor r8d, r8d
mov ecx, 0xbb8
call r8
mov rax, qword [rbp - 0x49]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x7ff70b51187a
xor r14d, r14d
mov esi, 0x8285aca5
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
movups xmm0, xmmword [rax + 0x58]
movups xmmword [rbp - 0x59], xmm0
movd ecx, xmm0
sub cx, 8
test r14d, r14d
je 0x7ff70b511723
mov r9, qword [rbp - 0x51]
movzx ecx, cx
shr rcx, 1
lea r11, [r9 + rcx*2]
mov r10d, 0x811c9dc5
cmp r9, r11
je 0x7ff70b51171a
nop
movsx ecx, byte [r9]
mov edx, ecx
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
add r9, 2
cmp r9, r11
jne 0x7ff70b5116f0
cmp r10d, r14d
jne 0x7ff70b511868
mov rbx, qword [rax + 0x30]
test rbx, rbx
je 0x7ff70b511870
movsxd rcx, dword [rbx + 0x3c]
mov rdx, qword [rcx + rbx + 0x88]
mov r13, rdx
shr r13, 0x20
mov edi, edx
add rdi, rbx
cmp rdi, rbx
je 0x7ff70b511868
mov r11d, dword [rdi + 0x18]
test r11d, r11d
je 0x7ff70b511868
mov r12d, dword [rdi + 0x20]
dec r11d
lea rcx, [r12 + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0x811c9dc5
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x7ff70b5117ad
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x7ff70b511782
cmp r10d, esi
je 0x7ff70b5117bf
test r11d, r11d
jne 0x7ff70b511762
mov rax, qword [rax]
jmp 0x7ff70b5116c0
mov ecx, dword [rdi + 0x24]
add rcx, rbx
movzx edx, word [rcx + r11*2]
mov ecx, dword [rdi + 0x1c]
add rcx, rbx
mov r8d, dword [rcx + rdx*4]
add r8, rbx
cmp r8, rdi
jbe 0x7ff70b511873
lea rax, [rdi + r13]
cmp r8, rax
jae 0x7ff70b511873
mov esi, 0x811c9dc5
mov r14d, esi
movzx edx, byte [r8]
cmp dl, 0x2e
je 0x7ff70b511827
nop
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, r14d
imul r14d, ecx, 0x1000193
inc r8
movzx edx, byte [r8]
cmp dl, 0x2e
jne 0x7ff70b511800
inc r8
movzx edx, byte [r8]
test dl, dl
je 0x7ff70b511857
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, esi
imul esi, ecx, 0x1000193
lea r8, [r8 + 1]
movzx edx, byte [r8]
test dl, dl
jne 0x7ff70b511832
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rax, qword [rax]
jmp 0x7ff70b5116c0
xor r8d, r8d
mov rcx, qword [rbp - 0x49]
call r8
cmp dword [rbp - 0x31], 0
jne 0x7ff70b5118b1
lea rcx, [rbp + 7]
call fcn.7ff70b53c2c0
xor eax, eax
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.7ff70b55975c
int3
mov dword [rbp - 0x31], 0
mov ecx, 6
call fcn.7ff70b54aa54
int3
mov ecx, 1
call fcn.7ff70b54aa54
int3
mov ecx, 5
call fcn.7ff70b54aa54
int3
mov ecx, 2
call fcn.7ff70b54aa54
int3