Function at 0x1401229e0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using murmur2
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
cmp qword [rcx + 8], 0
mov qword [rbp + 0x27], rcx
jne 0x14012315a
cmp qword [rcx + 0x18], 0
jne 0x14012315a
cmp qword [rcx + 0x30], 0
jne 0x14012315a
cmp dword [rcx + 0x28], 0
jne 0x14012315a
cmp dword [rcx + 0x24], 0
jne 0x14012315a
cmp byte [rcx + 0x40], 0
jne 0x14012315a
mov qword [rax + 0x10], rbx
mov cl, 0x51
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax - 0x10], r12
mov qword [rax - 0x18], r13
movzx eax, byte [0x14016db50]
xor al, cl
movsx ebx, cl
mov byte [rbp + 7], al
movzx eax, byte [0x14016db51]
xor al, cl
mov byte [rbp - 0x29], cl
mov byte [rbp + 8], al
movzx eax, byte [0x14016db52]
xor al, cl
mov byte [rbp + 9], al
movzx eax, byte [0x14016db53]
xor al, cl
mov byte [rbp + 0xa], al
movzx eax, byte [0x14016db54]
xor al, cl
mov byte [rbp + 0xb], al
movzx eax, byte [0x14016db55]
xor al, cl
mov byte [rbp + 0xc], al
movzx eax, byte [0x14016db56]
xor al, cl
mov byte [rbp + 0xd], al
movzx eax, byte [0x14016db57]
xor al, cl
mov byte [rbp + 0xe], al
movzx eax, byte [0x14016db58]
xor al, cl
mov byte [rbp + 0xf], al
movzx eax, byte [0x14016db59]
xor al, cl
mov byte [rbp + 0x10], al
movzx eax, byte [0x14016db5a]
xor al, cl
mov byte [rbp + 0x11], al
movzx eax, byte [0x14016db5b]
xor al, cl
mov byte [rbp + 0x12], al
movzx eax, byte [0x14016db5c]
xor al, cl
mov byte [rbp + 0x13], al
movzx eax, byte [0x14016db5d]
xor al, cl
mov byte [rbp + 0x14], al
movzx eax, byte [0x14016db5e]
xor al, cl
mov byte [rbp + 0x15], al
movzx eax, byte [0x14016db5f]
xor al, cl
mov byte [rbp + 0x16], al
movzx eax, byte [0x14016db60]
xor al, cl
mov byte [rbp + 0x17], al
movzx eax, byte [0x14016db61]
xor al, cl
mov ecx, ebx
mov byte [rbp + 0x18], al
xor eax, eax
mov byte [rbp + 0x19], al
call fcn.140013f00
add ebx, eax
cmp ebx, 0xfffffff0
jg 0x140122b43
mov edx, 0x84
call fcn.140128630
cmp ebx, 0xffffffb7
jg 0x140122b52
mov edx, 0x9d
call fcn.140128630
imul eax, ebx, 0x5bd1e995
lea r8, [rbp - 0x25]
mov r13d, 8
mov r9d, r13d
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul r10d, ecx, 0x5bd1e995
xor edx, edx
nop word [rax + rax]
mov eax, edx
lea r8, [r8 + 4]
xor eax, r10d
add edx, 0x5bd1e995
imul ecx, eax, 0x286a90b9
xor ecx, 0xaa2a7357
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov dword [r8 - 4], eax
sub r9, 1
jne 0x140122b80
mov r9d, 0x12
lea r8, [rbp - 0x25]
lea rdx, [rbp + 7]
call fcn.14011c9b0
movsx ebx, byte [rbp - 0x29]
mov ecx, ebx
mov qword [rbp - 1], rax
call fcn.140013f00
add ebx, eax
cmp ebx, 0xfffffff0
jg 0x140122bec
mov edx, 0x84
call fcn.140128630
cmp ebx, 0xffffffb7
jg 0x140122bfb
mov edx, 0x9d
call fcn.140128630
imul eax, ebx, 0x5bd1e995
lea r8, [rbp - 0x25]
mov r9, r13
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul r10d, ecx, 0x5bd1e995
xor edx, edx
nop dword [rax + rax]
mov eax, edx
lea r8, [r8 + 4]
xor eax, r10d
add edx, 0x5bd1e995
imul ecx, eax, 0x286a90b9
xor ecx, 0xaa2a7357
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov dword [r8 - 4], eax
sub r9, 1
jne 0x140122c20
mov r9d, dword [0x140196874]
lea r8, [rbp - 0x25]
mov rdx, qword [rbp - 1]
call fcn.14011cb00
mov rsi, rax
test rax, rax
je 0x140122caf
movdqu xmm0, xmmword [rax]
movsx edx, byte [rbp - 0x29]
mov ecx, 2
movd xmm1, edx
punpcklbw xmm1, xmm1
punpcklwd xmm1, xmm1
pshufd xmm1, xmm1, 0
pxor xmm1, xmm0
movdqu xmmword [rax], xmm1
add rax, 0x10
nop
xor byte [rax], dl
lea rax, [rax + 1]
sub rcx, 1
jne 0x140122ca0
mov byte [rsi + 0x12], cl
mov rax, qword gs:[0x60]
mov qword [rsp + 0x98], r14
mov qword [rsp + 0x90], r15
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rdi, qword [rax]
mov eax, 0x5a4d
cmp qword [rdi + 0x60], 0
je 0x140122daa
nop dword [rax]
nop word [rax + rax]
mov r11, qword [rdi + 0x30]
mov rdi, qword [rdi]
test r11, r11
je 0x140122d9f
cmp word [r11], ax
jne 0x140122daa
movsxd rax, dword [r11 + 0x3c]
cmp dword [rax + r11], 0x4550
jne 0x140122daa
mov ecx, dword [rax + r11 + 0x88]
test ecx, ecx
je 0x140122daa
mov r14d, dword [r11 + rcx + 0x1c]
lea rax, [r11 + rcx]
mov r9d, dword [rax + 0x20]
add r14, r11
mov r15d, dword [rax + 0x24]
add r9, r11
mov ebx, dword [rax + 0x18]
add r15, r11
xor r10d, r10d
test ebx, ebx
je 0x140122d9a
mov ecx, dword [r9]
xor dl, dl
add rcx, r11
cmp byte [rcx], dl
je 0x140122d8e
mov r8, rsi
sub r8, rcx
movzx eax, byte [r8 + rcx]
test al, al
je 0x140122d8a
cmp byte [rcx], al
jne 0x140122d8e
inc rcx
mov dl, 1
cmp byte [rcx], 0
jne 0x140122d62
movsxd rax, r10d
movzx ecx, word [r15 + rax*2]
mov eax, dword [r14 + rcx*4]
add rax, r11
jmp 0x140122dac
test dl, dl
jne 0x140122d79
inc r10d
add r9, 4
cmp r10d, ebx
jb 0x140122d50
mov eax, 0x5a4d
cmp qword [rdi + 0x60], 0
jne 0x140122cf0
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x28], 0
xor edx, edx
mov dword [rsp + 0x20], 0x3b9aca00
lea r8d, [r9 + 4]
lea rcx, [rdx - 1]
call rax
mov r12, rax
mov rax, qword [rbp + 0x27]
mov qword [rax + 0x18], r12
test r12, r12
je 0x1401230fe
movzx eax, byte [0x14016de38]
mov cl, 0x67
xor al, cl
movsx ebx, cl
mov byte [rbp + 7], al
movzx eax, byte [0x14016de39]
xor al, cl
mov byte [rbp - 0x29], cl
mov byte [rbp + 8], al
movzx eax, byte [0x14016de3a]
xor al, cl
mov byte [rbp + 9], al
movzx eax, byte [0x14016de3b]
xor al, cl
mov byte [rbp + 0xa], al
movzx eax, byte [0x14016de3c]
xor al, cl
mov byte [rbp + 0xb], al
movzx eax, byte [0x14016de3d]
xor al, cl
mov byte [rbp + 0xc], al
movzx eax, byte [0x14016de3e]
xor al, cl
mov byte [rbp + 0xd], al
movzx eax, byte [0x14016de3f]
xor al, cl
mov byte [rbp + 0xe], al
movzx eax, byte [0x14016de40]
xor al, cl
mov byte [rbp + 0xf], al
movzx eax, byte [0x14016de41]
xor al, cl
mov byte [rbp + 0x10], al
movzx eax, byte [0x14016de42]
xor al, cl
mov byte [rbp + 0x11], al
movzx eax, byte [0x14016de43]
xor al, cl
mov byte [rbp + 0x12], al
movzx eax, byte [0x14016de44]
xor al, cl
mov ecx, ebx
mov byte [rbp + 0x13], al
xor eax, eax
mov byte [rbp + 0x14], al
call fcn.140013f00
add ebx, eax
cmp ebx, 0xfffffff0
jg 0x140122ea1
mov edx, 0x84
call fcn.140128630
cmp ebx, 0xffffffb7
jg 0x140122eb0
mov edx, 0x9d
call fcn.140128630
imul eax, ebx, 0x5bd1e995
lea r8, [rbp - 0x25]
mov r9, r13
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul r10d, ecx, 0x5bd1e995
xor edx, edx
nop dword [rax]
mov eax, edx
lea r8, [r8 + 4]
xor eax, r10d
add edx, 0x5bd1e995
imul ecx, eax, 0x286a90b9
xor ecx, 0xaa2a7357
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov dword [r8 - 4], eax
sub r9, 1
jne 0x140122ed0
mov ebx, 0xd
lea r8, [rbp - 0x25]
mov r9d, ebx
lea rdx, [rbp + 7]
call fcn.14011c9b0
movsx edi, byte [rbp - 0x29]
mov ecx, edi
mov qword [rbp - 1], rax
call fcn.140013f00
add edi, eax
cmp edi, 0xfffffff0
jg 0x140122f3c
lea edx, [rbx + 0x77]
call fcn.140128630
cmp edi, 0xffffffb7
jg 0x140122f4b
mov edx, 0x9d
call fcn.140128630
imul eax, edi, 0x5bd1e995
lea r8, [rbp - 0x25]
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul r9d, ecx, 0x5bd1e995
xor edx, edx
nop word [rax + rax]
mov eax, edx
lea r8, [r8 + 4]
xor eax, r9d
add edx, 0x5bd1e995
imul ecx, eax, 0x286a90b9
xor ecx, 0xaa2a7357
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov dword [r8 - 4], eax
sub r13, 1
jne 0x140122f70
mov r9d, dword [0x140196874]
lea r8, [rbp - 0x25]
mov rdx, qword [rbp - 1]
call fcn.14011cb00
mov rsi, rax
test rax, rax
je 0x140122fdf
movzx ecx, byte [rbp - 0x29]
nop dword [rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rbx, 1
jne 0x140122fd0
mov byte [rsi + 0xd], bl
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rdi, qword [rax]
cmp qword [rdi + 0x60], 0
je 0x1401230c5
mov r13d, 0x5a4d
nop dword [rax]
nop dword [rax + rax]
mov r11, qword [rdi + 0x30]
mov rdi, qword [rdi]
test r11, r11
je 0x1401230ba
cmp word [r11], r13w
jne 0x1401230c5
movsxd rax, dword [r11 + 0x3c]
cmp dword [rax + r11], 0x4550
jne 0x1401230c5
mov ecx, dword [rax + r11 + 0x88]
test ecx, ecx
je 0x1401230c5
mov r14d, dword [r11 + rcx + 0x1c]
lea rax, [r11 + rcx]
mov r9d, dword [rax + 0x20]
add r14, r11
mov r15d, dword [rax + 0x24]
add r9, r11
mov ebx, dword [rax + 0x18]
add r15, r11
xor r10d, r10d
test ebx, ebx
je 0x1401230ba
mov eax, dword [r9]
xor dl, dl
add rax, r11
cmp byte [rax], dl
je 0x1401230ae
mov r8, rsi
sub r8, rax
movzx ecx, byte [rax + r8]
test cl, cl
je 0x1401230aa
cmp byte [rax], cl
jne 0x1401230ae
inc rax
mov dl, 1
cmp byte [rax], 0
jne 0x140123082
movsxd rax, r10d
movzx ecx, word [r15 + rax*2]
mov eax, dword [r14 + rcx*4]
add rax, r11
jmp 0x1401230c7
test dl, dl
jne 0x140123099
inc r10d
add r9, 4
cmp r10d, ebx
jb 0x140123070
cmp qword [rdi + 0x60], 0
jne 0x140123010
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x20], 0x3b9aca00
xor r8d, r8d
mov edx, 0xf001f
mov rcx, r12
call rax
mov rbx, qword [rbp + 0x27]
mov qword [rbx + 0x30], rax
test rax, rax
jne 0x140123144
mov rdx, qword [rbx + 0x18]
call fcn.140128850
mov qword [rbx + 0x18], 0
mov eax, 0x300
mov r14, qword [rsp + 0x98]
mov r15, qword [rsp + 0x90]
mov r12, qword [rsp + 0xa8]
mov rdi, qword [rsp + 0xd8]
mov rsi, qword [rsp + 0xd0]
mov rbx, qword [rsp + 0xc8]
mov r13, qword [rsp + 0xa0]
add rsp, 0xb0
pop rbp
ret
mov byte [rbx + 0x2c], 1
xor eax, eax
mov dword [rbx + 0x38], 0
mov dword [rbx + 0x3c], 0x3b9aca00
jmp 0x140123103
mov eax, 0x1000000
add rsp, 0xb0
pop rbp
ret