Function at 0x140024950
Capabilities:
Access peb ldr_data
Encode data using xor
Get kernel32 base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rbx
push rdi
push r13
sub rsp, 0x40
mov eax, 1
mov qword [rsp + 0x60], rbp
xchg byte [rcx + 0x20], al
mov rax, qword [0x140132318]
xor r13d, r13d
mov qword [rsp + 0x70], r12
mov rbp, rcx
mov r12, qword [rcx]
test rax, rax
jne 0x140024b38
mov rax, qword gs:[0x60]
mov ebx, r13d
mov qword [rsp + 0x68], rsi
mov r11d, 0x7097cd34
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r15
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
movups xmm0, xmmword [rax + 0x58]
movd ecx, xmm0
movups xmmword [rsp + 0x20], xmm0
sub cx, 8
test ebx, ebx
je 0x140024a12
mov rdx, qword [rsp + 0x28]
mov r9d, 0x726aed43
movzx r10d, cx
mov r8, r13
shr r10, 1
lea rcx, [rdx + r10*2]
cmp rdx, rcx
cmova r10, r13
test r10, r10
je 0x140024a09
nop word [rax + rax]
movsx ecx, byte [rdx]
lea rdx, [rdx + 2]
xor ecx, r9d
inc r8
imul r9d, ecx, 0x1000193
cmp r8, r10
jne 0x1400249f0
cmp r9d, ebx
jne 0x140024b1a
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov rdx, qword [rcx + r10 + 0x88]
mov r15, rdx
mov edi, edx
shr r15, 0x20
add rdi, r10
cmp rdi, r10
je 0x140024b1a
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140024b1a
mov r14d, dword [rdi + 0x20]
nop dword [rax + rax]
dec r9d
mov r8d, 0x726aed43
lea rcx, [r14 + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140024a89
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x140024a70
cmp r8d, r11d
je 0x140024a9b
test r9d, r9d
jne 0x140024a50
mov rax, qword [rax]
jmp 0x1400249b0
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
cmp rax, rdi
jbe 0x140024b22
lea rcx, [r15 + rdi]
cmp rax, rcx
jae 0x140024b22
movzx ecx, byte [rax]
mov ebx, 0x726aed43
mov r11d, ebx
cmp cl, 0x2e
je 0x140024ae6
movsx ecx, cl
inc rax
xor ecx, ebx
imul ebx, ecx, 0x1000193
movzx ecx, byte [rax]
cmp cl, 0x2e
jne 0x140024ad0
movzx ecx, byte [rax + 1]
inc rax
test cl, cl
je 0x140024b09
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, r11d
imul r11d, ecx, 0x1000193
movzx ecx, byte [rax]
test cl, cl
jne 0x140024af1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rax, qword [rax]
jmp 0x1400249b0
mov r15, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x68]
mov qword [0x140132318], rax
xor r9d, r9d
xor edx, edx
mov rcx, r12
lea r8, [r9 - 1]
call rax
mov rdi, qword [rbp + 0x10]
mov rbx, qword [rbp + 8]
mov r12, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x60]
cmp rbx, rdi
je 0x140024bc6
nop dword [rax]
cmp dword [rbx + 8], r13d
jne 0x140024b80
mov ecx, 1
call fcn.140075b28
cmp dword [rbx + 8], r13d
jne 0x140024b80
mov ecx, 1
call fcn.140075b28
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rbx + 8], eax
jne 0x140024b94
mov ecx, 5
call fcn.140075b28
movups xmm0, xmmword [rbx]
xor edx, edx
lea rcx, [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm0
call fcn.140075564
test eax, eax
je 0x140024bb6
mov ecx, 2
call fcn.140075b28
mov qword [rbx], r13
mov dword [rbx + 8], r13d
add rbx, 0x10
cmp rbx, rdi
jne 0x140024b60
add rsp, 0x40
pop r13
pop rdi
pop rbx
ret