Function at 0x140124080
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using murmur2
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
push rbp
push r12
push r14
lea rbp, [r11 - 0x38]
sub rsp, 0x120
mov rax, qword [0x140188020]
xor rax, rsp
mov qword [rbp - 8], rax
xor r14d, r14d
mov qword [rbp - 0x78], rdx
mov rax, rdx
mov qword [rbp - 0x80], rcx
dec rax
mov qword [rcx + 0xa8], r14
mov qword [rcx + 0xb8], r14
mov r12d, r8d
mov byte [rcx + 0xb0], r14b
mov qword [rcx + 0x9c], r14
mov dword [rcx + 0x98], r14d
mov dword [rcx + 0xc8], r14d
cmp rax, 0xfffffffffffffffd
ja 0x140124ade
movzx eax, byte [0x14016de80]
mov qword [r11 + 0x18], rbx
mov qword [r11 - 0x20], rsi
mov qword [r11 - 0x28], rdi
mov qword [r11 - 0x30], r13
mov r13, qword [rcx + 8]
mov cl, 0x6a
xor al, cl
movsx ebx, cl
mov byte [rsp + 0x70], al
movzx eax, byte [0x14016de81]
xor al, cl
mov byte [rsp + 0x40], cl
mov byte [rsp + 0x71], al
movzx eax, byte [0x14016de82]
xor al, cl
mov byte [rsp + 0x72], al
movzx eax, byte [0x14016de83]
xor al, cl
mov byte [rsp + 0x73], al
movzx eax, byte [0x14016de84]
xor al, cl
mov byte [rsp + 0x74], al
movzx eax, byte [0x14016de85]
xor al, cl
mov byte [rsp + 0x75], al
movzx eax, byte [0x14016de86]
xor al, cl
mov byte [rsp + 0x76], al
movzx eax, byte [0x14016de87]
xor al, cl
mov byte [rsp + 0x77], al
movzx eax, byte [0x14016de88]
xor al, cl
mov byte [rsp + 0x78], al
movzx eax, byte [0x14016de89]
xor al, cl
mov byte [rsp + 0x79], al
movzx eax, byte [0x14016de8a]
xor al, cl
mov byte [rsp + 0x7a], al
movzx eax, byte [0x14016de8b]
xor al, cl
mov byte [rsp + 0x7b], al
movzx eax, byte [0x14016de8c]
xor al, cl
mov byte [rsp + 0x7c], al
movzx eax, byte [0x14016de8d]
xor al, cl
mov ecx, ebx
mov byte [rsp + 0x7d], al
xor eax, eax
mov byte [rsp + 0x7e], al
call fcn.140013f00
add ebx, eax
cmp ebx, 0xfffffff0
jg 0x1401241da
mov edx, 0x84
call fcn.140128630
cmp ebx, 0xffffffb7
jg 0x1401241e9
mov edx, 0x9d
call fcn.140128630
imul eax, ebx, 0x5bd1e995
lea r8, [rsp + 0x44]
mov esi, 8
mov edx, r14d
mov r9d, esi
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul r10d, ecx, 0x5bd1e995
nop dword [rax]
mov eax, r10d
lea r8, [r8 + 4]
xor eax, edx
add edx, 0x5bd1e995
imul ecx, eax, 0x286a90b9
xor ecx, 0xaa2a7357
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov dword [r8 - 4], eax
sub r9, 1
jne 0x140124210
mov ebx, 0xe
lea r8, [rsp + 0x44]
mov r9d, ebx
lea rdx, [rsp + 0x70]
call fcn.14011c9b0
movsx edi, byte [rsp + 0x40]
mov ecx, edi
mov qword [rsp + 0x68], rax
call fcn.140013f00
add edi, eax
cmp edi, 0xfffffff0
jg 0x140124280
lea edx, [rbx + 0x76]
call fcn.140128630
cmp edi, 0xffffffb7
jg 0x14012428f
mov edx, 0x9d
call fcn.140128630
imul eax, edi, 0x5bd1e995
lea r8, [rsp + 0x44]
mov edx, r14d
mov r9, rsi
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul r10d, ecx, 0x5bd1e995
nop
mov eax, r10d
lea r8, [r8 + 4]
xor eax, edx
add edx, 0x5bd1e995
imul ecx, eax, 0x286a90b9
xor ecx, 0xaa2a7357
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov dword [r8 - 4], eax
sub r9, 1
jne 0x1401242b0
mov r9d, dword [0x140196874]
lea r8, [rsp + 0x44]
mov rdx, qword [rsp + 0x68]
call fcn.14011cb00
mov rsi, rax
test rax, rax
jne 0x14012430c
mov rsi, r14
jmp 0x140124321
movzx ecx, byte [rsp + 0x40]
xor byte [rax], cl
lea rax, [rax + 1]
sub rbx, 1
jne 0x140124311
mov byte [rsi + 0xe], r14b
mov rax, qword gs:[0x60]
mov qword [rsp + 0x100], r15
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rdi, qword [rax]
mov eax, 0x5a4d
cmp qword [rdi + 0x60], r14
je 0x140124410
nop dword [rax]
mov r11, qword [rdi + 0x30]
mov rdi, qword [rdi]
test r11, r11
je 0x140124402
cmp word [r11], ax
jne 0x14012440d
movsxd rax, dword [r11 + 0x3c]
cmp dword [rax + r11], 0x4550
jne 0x14012440d
mov ecx, dword [rax + r11 + 0x88]
test ecx, ecx
je 0x14012440d
mov r14d, dword [r11 + rcx + 0x1c]
lea rax, [r11 + rcx]
mov r10d, dword [rax + 0x20]
add r14, r11
mov r15d, dword [rax + 0x24]
add r10, r11
mov ebx, dword [rax + 0x18]
add r15, r11
xor r9d, r9d
test ebx, ebx
je 0x1401243fd
mov ecx, dword [r10]
xor dl, dl
add rcx, r11
cmp byte [rcx], dl
je 0x1401243f1
mov r8, rsi
sub r8, rcx
movzx eax, byte [rcx + r8]
test al, al
je 0x1401243ed
cmp byte [rcx], al
jne 0x1401243f1
inc rcx
mov dl, 1
cmp byte [rcx], 0
jne 0x1401243c2
movsxd rax, r9d
movzx ecx, word [r15 + rax*2]
mov eax, dword [r14 + rcx*4]
add rax, r11
xor r14d, r14d
jmp 0x140124413
test dl, dl
jne 0x1401243d9
inc r9d
add r10, 4
cmp r9d, ebx
jb 0x1401243b0
mov eax, 0x5a4d
cmp qword [rdi + 0x60], 0
jne 0x140124350
xor r14d, r14d
mov rax, r14
mov rsi, qword [rbp - 0x80]
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov rcx, r13
call rax
cmp eax, 0xffffffff
je 0x1401245ba
mov r13, qword [rbp - 0x78]
lea rax, [rsi + 0x90]
mov rcx, r13
mov qword [rsp + 0x20], rax
lea r9, [rsi + 0x78]
lea r8, [rsi + 0x98]
lea rdx, [rsi + 0x70]
call fcn.140121360
test eax, eax
jne 0x140124579
lea rdx, [0x14016de80]
lea rcx, [rsp + 0x40]
call fcn.140102510
mov rcx, rax
call fcn.14001d920
mov rcx, qword gs:[0x60]
mov rsi, rax
mov rdx, qword [rcx + 0x18]
mov rcx, qword [rdx + 0x10]
mov rdi, qword [rcx]
cmp qword [rdi + 0x60], 0
je 0x140124555
mov r12d, 0x5a4d
mov r11, qword [rdi + 0x30]
mov rdi, qword [rdi]
test r11, r11
je 0x14012454a
cmp word [r11], r12w
jne 0x140124555
movsxd rax, dword [r11 + 0x3c]
cmp dword [rax + r11], 0x4550
jne 0x140124555
mov ecx, dword [rax + r11 + 0x88]
test ecx, ecx
je 0x140124555
mov r14d, dword [r11 + rcx + 0x1c]
lea rax, [r11 + rcx]
mov r9d, dword [rax + 0x20]
add r14, r11
mov r15d, dword [rax + 0x24]
add r9, r11
mov ebx, dword [rax + 0x18]
add r15, r11
xor r10d, r10d
test ebx, ebx
je 0x14012454a
mov ecx, dword [r9]
xor dl, dl
add rcx, r11
cmp byte [rcx], dl
je 0x14012453e
mov r8, rsi
sub r8, rcx
movzx eax, byte [r8 + rcx]
test al, al
je 0x14012453a
cmp byte [rcx], al
jne 0x14012453e
inc rcx
mov dl, 1
cmp byte [rcx], 0
jne 0x140124512
movsxd rax, r10d
movzx ecx, word [r15 + rax*2]
mov eax, dword [r14 + rcx*4]
add rax, r11
jmp 0x140124557
test dl, dl
jne 0x140124529
inc r10d
add r9, 4
cmp r10d, ebx
jb 0x140124500
cmp qword [rdi + 0x60], 0
jne 0x1401244a0
xor eax, eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r13
call rax
mov r8, qword [rbp - 0x80]
mov byte [r8 + 0x94], 1
mov qword [r8 + 0xa8], r13
xor eax, eax
mov r15, qword [rsp + 0x100]
mov rdi, qword [rsp + 0x110]
mov rsi, qword [rsp + 0x118]
mov rbx, qword [rsp + 0x150]
mov r13, qword [rsp + 0x108]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14012b8f0
add rsp, 0x120
pop r14
pop r12
pop rbp
ret
mov dword [rsi + 0x70], 0x80000000
mov dword [rsi + 0x98], 0xffffffff
test r12d, r12d
je 0x1401245d7
mov dword [rsi + 0x98], r12d
mov cl, 0x66
mov byte [rsi + 0x94], 0
movsx ebx, cl
xor eax, eax
mov byte [rsp + 0x40], cl
mov ecx, ebx
mov dword [rsp + 0x70], 0x2a120321
mov dword [rsp + 0x74], 0xa070509
mov dword [rsp + 0x78], 0x30b0f32
mov byte [rsp + 0x7c], al
call fcn.140013f00
add ebx, eax
cmp ebx, 0xfffffff0
jg 0x14012461d
mov edx, 0x84
call fcn.140128630
cmp ebx, 0xffffffb7
jg 0x14012462c
mov edx, 0x9d
call fcn.140128630
imul eax, ebx, 0x5bd1e995
lea r8, [rsp + 0x44]
mov r12d, 8
mov edx, r14d
mov r9d, r12d
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul r10d, ecx, 0x5bd1e995
mov eax, edx
lea r8, [r8 + 4]
xor eax, r10d
add edx, 0x5bd1e995
imul ecx, eax, 0x286a90b9
xor ecx, 0xaa2a7357
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov dword [r8 - 4], eax
sub r9, 1
jne 0x140124651
mov ebx, 0xc
lea r8, [rsp + 0x44]
mov r9d, ebx
lea rdx, [rsp + 0x70]
call fcn.14011c9b0
movsx edi, byte [rsp + 0x40]
mov ecx, edi
mov qword [rsp + 0x68], rax
call fcn.140013f00
add edi, eax
cmp edi, 0xfffffff0
jg 0x1401246c1
lea edx, [rbx + 0x78]
call fcn.140128630
cmp edi, 0xffffffb7
jg 0x1401246d0
mov edx, 0x9d
call fcn.140128630
imul eax, edi, 0x5bd1e995
lea r8, [rsp + 0x44]
mov edx, r14d
mov r9, r12
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul r10d, ecx, 0x5bd1e995
nop
mov eax, edx
lea r8, [r8 + 4]
xor eax, r10d
add edx, 0x5bd1e995
imul ecx, eax, 0x286a90b9
xor ecx, 0xaa2a7357
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov dword [r8 - 4], eax
sub r9, 1
jne 0x1401246f0
mov r9d, dword [0x140196874]
lea r8, [rsp + 0x44]
mov rdx, qword [rsp + 0x68]
call fcn.14011cb00
mov rsi, rax
test rax, rax
jne 0x14012474c
mov rsi, r14
jmp 0x140124760
movzx ecx, byte [rsp + 0x40]
xor byte [rax], cl
lea rax, [rax + 1]
sub rbx, 1
jne 0x140124751
mov byte [rsi + 0xc], bl
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rdi, qword [rax]
cmp qword [rdi + 0x60], 0
je 0x14012484b
nop
mov r11, qword [rdi + 0x30]
mov rdi, qword [rdi]
test r11, r11
je 0x14012483d
mov r15d, 0x5a4d
cmp word [r11], r15w
jne 0x140124906
movsxd rax, dword [r11 + 0x3c]
cmp dword [rax + r11], 0x4550
jne 0x140124906
mov ecx, dword [rax + r11 + 0x88]
test ecx, ecx
je 0x140124906
mov r14d, dword [r11 + rcx + 0x1c]
lea rax, [r11 + rcx]
mov r9d, dword [rax + 0x20]
add r14, r11
mov r15d, dword [rax + 0x24]
add r9, r11
mov ebx, dword [rax + 0x18]
add r15, r11
xor r10d, r10d
test ebx, ebx
je 0x14012483d
nop word [rax + rax]
mov ecx, dword [r9]
xor dl, dl
add rcx, r11
cmp byte [rcx], dl
je 0x140124831
mov r8, rsi
sub r8, rcx
movzx eax, byte [r8 + rcx]
test al, al
je 0x14012482d
cmp byte [rcx], al
jne 0x140124831
inc rcx
mov dl, 1
cmp byte [rcx], 0
jne 0x140124802
movsxd rax, r10d
movzx ecx, word [r15 + rax*2]
mov eax, dword [r14 + rcx*4]
add rax, r11
xor r14d, r14d
jmp 0x14012484e
test dl, dl
jne 0x140124819
inc r10d
add r9, 4
cmp r10d, ebx
jb 0x1401247f0
cmp qword [rdi + 0x60], 0
jne 0x140124780
xor r14d, r14d
mov rax, r14
mov r15d, 0x5a4d
lea rcx, [rbp - 0x18]
call rax
lea rcx, [rbp - 0x70]
call fcn.140127900
mov rbx, rax
movsx edi, byte [rax]
mov ecx, edi
call fcn.140013f00
add edi, eax
cmp edi, 0xfffffff0
jg 0x140124881
mov edx, 0x84
call fcn.140128630
cmp edi, 0xffffffb7
jg 0x140124890
mov edx, 0x9d
call fcn.140128630
imul eax, edi, 0x5bd1e995
lea r8, [rbx + 4]
mov edx, r14d
mov r9, r8
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul r10d, ecx, 0x5bd1e995
nop
mov eax, edx
lea r9, [r9 + 4]
xor eax, r10d
add edx, 0x5bd1e995
imul ecx, eax, 0x286a90b9
xor ecx, 0xaa2a7357
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov dword [r9 - 4], eax
sub r12, 1
jne 0x1401248b0
mov r9d, dword [0x140196874]
mov rdx, qword [rbx + 0x28]
call fcn.14011cb00
mov rsi, rax
test rax, rax
jne 0x140124911
mov rsi, r14
jmp 0x140124972
xor r14d, r14d
mov eax, r14d
jmp 0x140124854
movsx eax, byte [rbx]
mov r8, r14
movd xmm1, eax
lea rax, [rsi + 0x13]
punpcklbw xmm1, xmm1
punpcklwd xmm1, xmm1
pshufd xmm1, xmm1, 0
cmp rsi, rbx
ja 0x140124936
cmp rax, rbx
jae 0x140124948
movdqu xmm0, xmmword [rsi]
mov r8d, 0x10
pxor xmm1, xmm0
movdqu xmmword [rsi], xmm1
mov edx, 0x14
lea rcx, [r8 + rsi]
sub rdx, r8
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rbx]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x140124960
mov byte [rsi + 0x14], dl
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rdi, qword [rax]
cmp qword [rdi + 0x60], 0
je 0x140124a5f
nop dword [rax]
nop word [rax + rax]
mov r11, qword [rdi + 0x30]
mov rdi, qword [rdi]
test r11, r11
je 0x140124a4a
cmp word [r11], r15w
jne 0x140124a5c
movsxd rax, dword [r11 + 0x3c]
cmp dword [rax + r11], 0x4550
jne 0x140124a5c
mov ecx, dword [rax + r11 + 0x88]
test ecx, ecx
je 0x140124a5c
mov r14d, dword [r11 + rcx + 0x1c]
lea rax, [r11 + rcx]
mov r9d, dword [rax + 0x20]
add r14, r11
mov r15d, dword [rax + 0x24]
add r9, r11
mov ebx, dword [rax + 0x18]
add r15, r11
xor r10d, r10d
test ebx, ebx
je 0x140124a4a
mov eax, dword [r9]
xor dl, dl
add rax, r11
cmp byte [rax], dl
je 0x140124a3e
mov r8, rsi
sub r8, rax
movzx ecx, byte [r8 + rax]
test cl, cl
je 0x140124a3a
cmp byte [rax], cl
jne 0x140124a3e
inc rax
mov dl, 1
cmp byte [rax], 0
jne 0x140124a12
movsxd rax, r10d
movzx ecx, word [r15 + rax*2]
mov r14d, dword [r14 + rcx*4]
add r14, r11
jmp 0x140124a5f
test dl, dl
jne 0x140124a29
inc r10d
add r9, 4
cmp r10d, ebx
jb 0x140124a00
cmp qword [rdi + 0x60], 0
je 0x140124a5c
mov r15d, 0x5a4d
jmp 0x1401249a0
xor r14d, r14d
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x18]
call r14
mov rcx, qword [rbp - 0x20]
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x30]
call fcn.140121060
mov r8, qword [rbp - 0x80]
movabs rcx, 0xfe624e212ac18000
add rcx, qword [rbp - 0x20]
movabs rax, 0xd6bf94d5e57a42bd
mov r13, qword [rbp - 0x78]
imul rcx
add rdx, rcx
movzx ecx, word [rsp + 0x30]
sar rdx, 0x17
mov rax, rdx
shl ecx, 0x10
shr rax, 0x3f
add rdx, rax
movzx eax, word [rsp + 0x34]
or ecx, eax
mov qword [r8 + 0x78], rdx
mov dword [r8 + 0x90], ecx
mov qword [r8 + 0x80], rdx
mov qword [r8 + 0x88], rdx
jmp 0x140124570
mov eax, 0x10000
jmp 0x1401245a1