Function at 0x1400041a5
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov r12, r8
mov rbx, rdx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x2c], 0
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x140003d58
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x140003d58
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov r14d, dword [r9 + r11*4]
mov dil, byte [rax + r14]
test dil, dil
je 0x140003dbf
add r14, r10
mov esi, 0x41102777
movsx edi, dil
xor edi, esi
imul esi, edi, 0x1000193
mov dil, byte [r14]
inc r14
test dil, dil
jne 0x140003da0
cmp esi, 0x7ff4705e
je 0x140003dc6
test r11, r11
jne 0x140003d85
jmp 0x140003d58
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov r8d, dword [rcx + rdx*4]
add r8, rax
xor r15d, r15d
mov rcx, qword [rsp + 0x30]
xor edx, edx
call r8
cmp eax, 0xffffffff
je 0x140004191
mov ebp, eax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x140003e09
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x140003e09
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov r14d, dword [r9 + r11*4]
mov dil, byte [rax + r14]
test dil, dil
je 0x140003e70
add r14, r10
mov esi, 0x340b95d2
movsx edi, dil
xor edi, esi
imul esi, edi, 0x1000193
mov dil, byte [r14]
inc r14
test dil, dil
jne 0x140003e51
cmp esi, 0xb48c6f6a
je 0x140003e77
test r11, r11
jne 0x140003e36
jmp 0x140003e09
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov r8d, dword [rcx + rdx*4]
add r8, rax
mov edx, ebp
mov ecx, 0x40
call r8
mov qword [rbx], rax
test rax, rax
je 0x140004191
mov r14, rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], rbx
xor eax, eax
lea r15, [rsp + 0x2c]
mov edx, eax
mov rcx, qword gs:[0x60]
mov r8, qword [rcx + 0x18]
add r8, 0x10
mov r8, qword [r8]
mov rcx, qword [r8 + 0x30]
movsxd r9, dword [rcx + 0x3c]
mov r9d, dword [rcx + r9 + 0x88]
test r9, r9
je 0x140003ece
mov r10d, dword [rcx + r9 + 0x18]
test r10, r10
je 0x140003ece
mov r11d, dword [rcx + r9 + 0x20]
add r11, rcx
lea r13, [rcx + 1]
dec r10
mov r12d, r10d
mov edi, dword [r11 + r12*4]
mov sil, byte [rcx + rdi]
test sil, sil
je 0x140003f36
add rdi, r13
mov ebx, 0xd46555ea
movsx esi, sil
xor esi, ebx
imul ebx, esi, 0x1000193
mov sil, byte [rdi]
inc rdi
test sil, sil
jne 0x140003f17
cmp ebx, 0x2350fe54
je 0x140003f3d
test r12, r12
jne 0x140003efc
jmp 0x140003ece
mov r8d, ebp
sub r8d, eax
add rdx, r14
mov eax, dword [rcx + r9 + 0x1c]
mov r9d, dword [rcx + r9 + 0x24]
add rax, rcx
add r9, rcx
movzx r9d, word [r9 + r12*2]
mov r10d, dword [rax + r9*4]
add r10, rcx
mov qword [rsp + 0x20], 0
mov rcx, qword [rsp + 0x30]
mov r9, r15
call r10
test eax, eax
je 0x140003f86
mov eax, dword [rsp + 0x2c]
cmp eax, ebp
jne 0x140003ebb
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov r12, qword [rsp + 0x40]
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x140003f9c
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x140003f9c
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov edi, dword [r9 + r11*4]
mov sil, byte [rax + rdi]
test sil, sil
je 0x140004003
add rdi, r10
mov ebx, 0x5580647a
movsx esi, sil
xor esi, ebx
imul ebx, esi, 0x1000193
mov sil, byte [rdi]
inc rdi
test sil, sil
jne 0x140003fe4
cmp ebx, 0x40c09c20
je 0x14000400a
test r11, r11
jne 0x140003fc9
jmp 0x140003f9c
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
mov rcx, qword [rsp + 0x30]
call rdx
movzx eax, word [r14]
xor r15d, r15d
cmp eax, 0x5a4d
jne 0x1400040d2
mov ecx, dword [rsp + 0x2c]
mov eax, dword [r14 + 0x3c]
sub ecx, eax
jbe 0x1400040d2
mov dword [rsp + 0x2c], ecx
cmp ecx, 0x109
jb 0x1400040d2
cdqe
mov edx, ecx
add rdx, 0xfffffffffffffef8
mov r8d, dword [r14 + rax + 0x54]
cmp rdx, r8
jbe 0x1400040d2
movzx edx, word [r14 + rax + 4]
mov r8, qword [rsp + 0x38]
mov word [r8], dx
movzx edx, word [r14 + rax + 4]
cmp edx, 0x8664
jne 0x1400040d2
add ecx, 0xfffffef8
mov dword [rsp + 0x2c], ecx
cmp word [r14 + rax + 6], 0
je 0x1400040cd
lea rcx, [rax + r14]
add rcx, 0x118
xor r15d, r15d
xor edx, edx
mov r8d, dword [rcx]
add dword [r14 + rax + 0x54], r8d
add dword [rsp + 0x2c], 0xffffffd8
je 0x1400040d2
inc edx
movzx r8d, word [r14 + rax + 6]
add rcx, 0x28
cmp edx, r8d
jb 0x1400040ad
mov r15d, dword [r14 + rax + 0x54]
mov rcx, qword [r12]
test rcx, rcx
je 0x140004191
test r15d, r15d
jne 0x140004191
mov rax, qword gs:[0x60]
mov rdx, qword [rax + 0x18]
add rdx, 0x10
mov rdx, qword [rdx]
mov rax, qword [rdx + 0x30]
movsxd r8, dword [rax + 0x3c]
mov r8d, dword [rax + r8 + 0x88]
test r8, r8
je 0x1400040f9
mov r9d, dword [rax + r8 + 0x18]
test r9, r9
je 0x1400040f9
mov r10d, dword [rax + r8 + 0x20]
add r10, rax
lea r11, [rax + 1]
dec r9
mov edi, r9d
mov ebx, dword [r10 + rdi*4]
mov sil, byte [rax + rbx]
test sil, sil
je 0x140004161
add rbx, r11
mov ebp, 0xfe89739
movsx esi, sil
xor esi, ebp
imul ebp, esi, 0x1000193
mov sil, byte [rbx]
inc rbx
test sil, sil
jne 0x140004142
cmp ebp, 0x801f8602
je 0x140004168
test rdi, rdi
jne 0x140004127
jmp 0x1400040f9
mov edx, dword [rax + r8 + 0x1c]
mov r8d, dword [rax + r8 + 0x24]
add rdx, rax
add r8, rax
movzx r8d, word [r8 + rdi*2]
mov edx, dword [rdx + r8*4]
add rdx, rax
call rdx
mov qword [r12], 0
xor r15d, r15d
mov eax, r15d
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, r8
mov rdi, rdx
mov rax, qword gs:[0x60]
mov rdx, qword [rax + 0x18]
add rdx, 0x10
mov rdx, qword [rdx]
mov rax, qword [rdx + 0x30]
movsxd r8, dword [rax + 0x3c]
mov r8d, dword [rax + r8 + 0x88]
test r8, r8
je 0x1400041c8
mov r9d, dword [rax + r8 + 0x18]
test r9, r9
je 0x1400041c8
mov r10d, dword [rax + r8 + 0x20]
add r10, rax
lea r11, [rax + 1]
dec r9
mov ebx, r9d
mov r14d, dword [r10 + rbx*4]
mov bpl, byte [rax + r14]
test bpl, bpl
je 0x140004234
add r14, r11
mov r15d, 0xae5e2aa8
movsx ebp, bpl
xor ebp, r15d
imul r15d, ebp, 0x1000193
mov bpl, byte [r14]
inc r14
test bpl, bpl
jne 0x140004212
cmp r15d, 0x1a4a6fe1
je 0x14000423b
test rbx, rbx
jne 0x1400041f6
jmp 0x1400041c8
mov edx, dword [rax + r8 + 0x1c]
mov r8d, dword [rax + r8 + 0x24]
add rdx, rax
add r8, rax
movzx r8d, word [r8 + rbx*2]
mov r10d, dword [rdx + r8*4]
add r10, rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
mov r8d, 3
xor r9d, r9d
call r10
cmp rax, 0xffffffffffffffff
je 0x1400042a1
mov rcx, rax
mov rdx, rdi
mov r8, rsi
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
jmp 0x140003d24
xor eax, eax
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret