Function at 0x14001a220
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0xf0
mov dword [rbp + 0x67], 0x3f
lea rax, str.VMWARE
mov qword [rbp - 0x29], rax
lea rax, str.VBOX
mov qword [rbp - 0x21], rax
lea rax, str.VIRTUAL
mov qword [rbp - 0x19], rax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rdi, rsi
mov r9, qword [rdi + 0x30]
xor r14d, r14d
movsxd rax, dword [r9 + 0x3c]
mov r11d, dword [rax + r9 + 0x88]
add r11, r9
cmp r11, r9
je 0x14001a2e8
mov r8d, dword [r11 + 0x18]
test r8d, r8d
je 0x14001a2e8
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r8d
mov edx, 0xc8aca303
lea rax, [rbx + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x14001a2e3
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x14001a2c0
cmp edx, 0x2661dbda
je 0x14001a606
test r8d, r8d
jne 0x14001a2a0
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x14001a2fd
cmp qword [rax + 0x30], r14
jne 0x14001a272
mov r10, r14
movabs rax, 0xce20fd5bec0320e8
lea rdx, [rsp + 0x30]
mov qword [rbp + 0x77], rax
movabs rcx, 0x4a979477c0189a90
mov rax, qword [rbp + 0x77]
mov r9d, 0x20019
mov qword [rsp + 0x30], rax
xor r8d, r8d
movabs rax, 0x7400ac2c73e1e273
mov qword [rbp + 0x77], rax
mov rax, qword [rbp + 0x77]
mov qword [rsp + 0x38], rax
movabs rax, 0xe2e785c360eafd1
mov qword [rbp + 0x77], rax
mov rax, qword [rbp + 0x77]
mov qword [rbp - 0x79], rax
movabs rax, 0xe207c1e2746b790
mov qword [rbp + 0x77], rax
mov rax, qword [rbp + 0x77]
mov qword [rbp - 0x71], rax
movabs rax, 0xa1494f0c12b4095c
mov qword [rbp + 0x77], rax
mov rax, qword [rbp + 0x77]
mov qword [rbp - 0x69], rax
mov qword [rbp + 0x77], rcx
mov rax, qword [rbp + 0x77]
mov qword [rbp - 0x61], rax
movabs rax, 0x8d7cb01eb85079bb
mov qword [rbp + 0x77], rax
mov rax, qword [rbp + 0x77]
mov qword [rbp - 0x59], rax
movabs rax, 0x1153c04301958c1c
mov qword [rbp + 0x77], rax
mov rax, qword [rbp + 0x77]
mov qword [rbp - 0x51], rax
movabs rax, 0x7c4b2b00073e9fa5
mov qword [rbp + 0x77], rax
mov rax, qword [rbp + 0x77]
mov qword [rbp - 0x49], rax
movabs rax, 0x6764206d4225dee6
mov qword [rbp + 0x77], rax
mov rax, qword [rbp + 0x77]
mov qword [rbp - 0x41], rax
movabs rax, 0xa1243a6257e8622f
mov qword [rbp + 0x77], rax
mov rax, qword [rbp + 0x77]
mov qword [rbp - 0x39], rax
mov qword [rbp + 0x77], rcx
mov rcx, 0xffffffff80000002
mov rax, qword [rbp + 0x77]
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rbp - 0x59]
movdqa xmm1, xmmword [rbp - 0x79]
xorps xmm1, xmmword [rbp - 0x49]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm0, xmmword [rbp - 0x69]
mov qword [rbp - 0x31], rax
lea rax, [rbp + 0x6f]
xorps xmm0, xmmword [rbp - 0x39]
movdqa xmmword [rbp - 0x69], xmm0
movdqa xmmword [rbp - 0x79], xmm1
mov qword [rsp + 0x20], rax
call r10
test eax, eax
jne 0x14001a752
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rdi, rsi
nop dword [rax]
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov r11d, dword [rax + r9 + 0x88]
add r11, r9
cmp r11, r9
je 0x14001a4e8
mov r8d, dword [r11 + 0x18]
test r8d, r8d
je 0x14001a4e8
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r8d
mov edx, 0xbe40b520
lea rax, [rbx + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x14001a4e3
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x14001a4c0
cmp edx, 0x864c2ad1
je 0x14001a625
test r8d, r8d
jne 0x14001a4a0
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x14001a4fd
cmp qword [rax + 0x30], r14
jne 0x14001a470
mov rax, r14
lea rcx, [rbp + 0x67]
xor r9d, r9d
mov qword [rsp + 0x28], rcx
lea rdx, [0x140020594]
lea rcx, [rbp - 9]
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp + 0x6f]
call rax
test eax, eax
jne 0x14001a551
mov ebx, r14d
lea rdi, [rbp - 0x29]
mov rdx, qword [rdi]
lea rcx, [rbp - 9]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
jne 0x14001a643
inc ebx
add rdi, 8
cmp ebx, 3
jb 0x14001a530
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rdi, rsi
nop dword [rax + rax]
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov r11d, dword [rax + r9 + 0x88]
add r11, r9
cmp r11, r9
je 0x14001a5e8
mov r8d, dword [r11 + 0x18]
test r8d, r8d
je 0x14001a5e8
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r8d
mov edx, 0xc16e1e0a
lea rax, [rbx + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x14001a5e3
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x14001a5c0
cmp edx, 0xdedc6cf3
je 0x14001a731
test r8d, r8d
jne 0x14001a5a0
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x14001a74b
cmp qword [rax + 0x30], r14
jne 0x14001a570
jmp 0x14001a74b
mov ecx, dword [r11 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r9
mov r10d, dword [rcx + rdx*4]
add r10, r9
jmp 0x14001a300
mov ecx, dword [r11 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x14001a500
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rdi, rsi
nop word [rax + rax]
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov r11d, dword [rax + r9 + 0x88]
add r11, r9
cmp r11, r9
je 0x14001a6d4
mov r8d, dword [r11 + 0x18]
test r8d, r8d
je 0x14001a6d4
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r8d
mov edx, 0x3e571f6d
lea rax, [rbx + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x14001a6cf
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x14001a6b0
cmp edx, 0xb40ec382
je 0x14001a700
test r8d, r8d
jne 0x14001a690
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x14001a71a
cmp qword [rax + 0x30], r14
jne 0x14001a660
mov rcx, qword [rbp + 0x6f]
call r14
mov al, 1
add rsp, 0xf0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, dword [r11 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r9
mov r14d, dword [rcx + rdx*4]
add r14, r9
mov rcx, qword [rbp + 0x6f]
call r14
mov al, 1
add rsp, 0xf0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, dword [r11 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r9
mov r14d, dword [rcx + rdx*4]
add r14, r9
mov rcx, qword [rbp + 0x6f]
call r14
xor al, al
add rsp, 0xf0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret