Function at 0x140045610
Capabilities:
Access peb ldr_data
Encode data using xor
Get system information on windows
Hash data using fnv
Make suspicious ntquerysysteminformation call
Parse pe header
Query environment variable
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x14010f080]
xor rax, rsp
mov qword [rbp + 0x20], rax
mov qword [rbp - 0x80], rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor r12d, r12d
mov r14d, r12d
mov qword [rsp + 0x38], r12
mov dword [rbp - 0x58], r12d
lea r9, [rbp - 0x58]
xor r8d, r8d
xor edx, edx
mov ecx, ntohl
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x140045831
nop dword [rax]
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rdi, rsi
nop word [rax + rax]
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140045717
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140045717
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r11 + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
mov edx, 0xb0de48c0
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140045712
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x1400456f0
cmp edx, 0xfe284311
je 0x1400458e5
test r8d, r8d
jne 0x1400456d0
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x14004572c
cmp qword [rax + 0x30], r12
jne 0x1400456a0
mov r10, r12
xor edx, edx
mov r8d, 0x8000
mov rcx, r14
call r10
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rdi, rsi
nop dword [rax]
nop dword [rax + rax]
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x1400457d7
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x1400457d7
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r11 + r8*4]
mov eax, dword [rax + r9]
add rax, r9
mov edx, 0x35e158b6
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x1400457d2
nop dword [rax]
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax]
lea rax, [rax + 1]
test cl, cl
jne 0x1400457b0
cmp edx, 0x86eecc46
je 0x140045902
test r8d, r8d
jne 0x140045790
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x1400457ec
cmp qword [rax + 0x30], r12
jne 0x140045760
mov r10, r12
mov edx, dword [rbp - 0x58]
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
call r10
mov r14, rax
lea r9, [rbp - 0x58]
mov r8d, dword [rbp - 0x58]
mov rdx, rax
mov ecx, ntohl
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x140045680
mov qword [rsp + 0x38], r14
mov rdi, qword [rsp + 0x40]
test eax, eax
jns 0x14004591f
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rdi, rsi
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x1400458c7
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x1400458c7
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r9 + r8*4]
mov ecx, dword [rax + r11]
add rcx, r9
mov edx, 0x21711bb3
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1400458c2
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x1400458a0
cmp edx, 0xcefb8cc4
je 0x1400460cf
test r8d, r8d
jne 0x140045880
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x1400460e7
cmp qword [rax + 0x30], r12
jne 0x140045850
jmp 0x1400460e7
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rbx + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov r10d, dword [rcx + rax*4]
add r10, r9
jmp 0x14004572f
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rbx + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov r10d, dword [rcx + rax*4]
add r10, r9
jmp 0x1400457ef
mov r13d, r12d
cmp dword [r14], r12d
jbe 0x140045e58
movabs rsi, 0x4c89569ee669f706
nop word [rax + rax]
mov r15d, r13d
imul rcx, r15, 0x128
lea rbx, [rcx + r14]
movzx eax, word [rbx + 0x2e]
add rax, rcx
lea rdx, [r14 + 0x30]
add rdx, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x18], r12
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x140045972
lea rcx, [rbp - 0x30]
call fcn.140044fa0
nop
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0xf
cmova rcx, qword [rbp - 0x30]
mov rdx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x140045e11
lea rdx, [rbx + 0x30]
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], r12
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rdx + r8], 0
jne 0x1400459c0
lea rcx, [rbp - 0x50]
call fcn.140044fa0
nop
movabs rax, 0x4536aff6e7a6a5fa
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x70], rax
movabs rax, 0x4c89569ee669a349
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x78], rax
movabs rbx, 0xa64e2b3b3f5fca9
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x10], rax
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
mov qword [rbp - 8], rax
movdqa xmm0, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rsp + 0x70], xmm0
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x60], r12
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140045a60
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.140044fa0
nop
movabs rax, 0xa64e2b3b3f5fcf5
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x30]
mov qword [rbp], rax
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
mov qword [rbp + 8], rax
movdqa xmm0, xmmword [rsp + 0x50]
xorps xmm0, xmmword [rbp]
movdqa xmmword [rsp + 0x50], xmm0
lea rax, [rsp + 0x50]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140045ae0
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x78]
call fcn.140044ed0
mov r12, rax
movabs rax, 0x580987c7c08caff5
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x60], rax
movabs rax, 0x4c89569eba1d9869
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x10], rax
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x18], rax
movdqa xmm0, xmmword [rsp + 0x60]
xorps xmm0, xmmword [rbp + 0x10]
movdqa xmmword [rsp + 0x60], xmm0
lea rax, [rsp + 0x60]
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rax + rdi], 0
jne 0x140045b65
lea rsi, [rbp - 0x50]
cmp qword [rbp - 0x38], 0xf
cmova rsi, qword [rbp - 0x50]
mov rax, qword [rbp - 0x40]
cmp rdi, rax
ja 0x140045bfd
sub rax, rdi
test rdi, rdi
jne 0x140045b91
xor ebx, ebx
jmp 0x140045c04
lea r14, [rsi + rax]
movq rax, xmm0
movsx r15d, al
lea r8, [r14 + 1]
sub r8, rsi
mov edx, r15d
mov rcx, rsi
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x140045bf5
nop dword [rax + rax]
mov r8, rdi
lea rdx, [rsp + 0x60]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140045f06
inc rbx
lea r8, [r14 + 1]
sub r8, rbx
mov edx, r15d
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
jne 0x140045bc0
mov r15d, r13d
mov r14, qword [rsp + 0x38]
mov rbx, 0xffffffffffffffff
mov rax, qword [r12 + 0x10]
cmp qword [r12 + 0x18], 0xf
jbe 0x140045c15
mov r12, qword [r12]
mov qword [rsp + 0x20], rax
mov r9, r12
mov r8d, 7
mov rdx, rbx
lea rcx, [rbp - 0x50]
call fcn.1400475f0
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 0xf
jbe 0x140045c6b
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140045c66
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140045f36
call fcn.1400d2750
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rdi, rsi
nop dword [rax]
nop word [rax + rax]
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140045d07
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140045d07
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r11 + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
mov edx, 0x3d223578
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140045d02
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x140045ce0
cmp edx, 0xeb46d119
je 0x140045f16
test r8d, r8d
jne 0x140045cc0
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x140045d1d
cmp qword [rax + 0x30], 0
jne 0x140045c90
xor r12d, r12d
mov r10d, r12d
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0xf
cmova rcx, qword [rbp - 0x50]
xor edx, edx
mov r8d, 1
call r10
mov r11, rax
mov eax, 0x5a4d
cmp word [r11], ax
jne 0x140046034
movsxd rcx, dword [r11 + 0x3c]
cmp dword [rcx + r11], 0x4550
jne 0x140046034
mov edx, dword [rcx + r11 + 0x88]
test edx, edx
je 0x140046034
mov ebx, dword [rdx + r11 + 0x1c]
lea rdi, [r11 + rbx]
mov r9d, dword [rdx + r11 + 0x20]
add r9, r11
mov esi, dword [rdx + r11 + 0x24]
add rsi, r11
mov r10d, r12d
test ebx, ebx
je 0x140045dc7
mov r8d, dword [r9]
add r8, r11
mov rax, qword [rbp - 0x80]
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140045db3
inc rax
test ecx, ecx
jne 0x140045da0
test edx, edx
je 0x140045f3d
inc r10d
add r9, 4
cmp r10d, ebx
jb 0x140045d90
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x140045e02
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140045dfd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140046069
call fcn.1400d2750
movabs rsi, 0x4c89569ee669f706
mov rdi, qword [rsp + 0x40]
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140045e4c
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140045e47
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400460c8
call fcn.1400d2750
inc r13d
cmp r13d, dword [r14]
jb 0x140045940
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rdi, rsi
nop
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140045ee7
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140045ee7
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r11 + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
mov edx, 0xbfa0c9b5
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140045ee2
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x140045ec0
cmp edx, 0xfb0807a2
je 0x1400460cf
test r8d, r8d
jne 0x140045ea0
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x1400460e7
cmp qword [rax + 0x30], 0
jne 0x140045e70
jmp 0x1400460e7
sub rbx, rsi
mov r15d, r13d
mov r14, qword [rsp + 0x38]
jmp 0x140045c04
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rbx + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov r10d, dword [rcx + rax*4]
add r10, r9
xor r12d, r12d
jmp 0x140045d23
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
movsxd rax, r10d
movzx ecx, word [rsi + rax*2]
mov r14d, dword [rdi + rcx*4]
imul rax, r15, 0x128
mov r15, qword [rsp + 0x38]
add r14, qword [rax + r15 + 0x18]
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rdi, rsi
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140045fe3
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140045fe3
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r9 + r8*4]
mov ecx, dword [rax + r11]
add rcx, r9
mov edx, 0xfcc7a303
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140045fde
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x140045fc0
cmp edx, 0x3959e6d4
je 0x14004600c
test r8d, r8d
jne 0x140045fa0
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x140045ff9
cmp qword [rax + 0x30], 0
jne 0x140045f70
mov r10, r12
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call r10
jmp 0x140046037
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rbx + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov r10d, dword [rcx + rax*4]
add r10, r9
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call r10
jmp 0x140046037
mov r14, r12
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x140046075
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140046070
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140046070
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d2750
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x50], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x1400460c3
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400460be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400460be
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d2750
mov rax, r14
jmp 0x1400460f7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov r12d, dword [rcx + rdx*4]
add r12, r9
mov r8d, 0x8000
xor edx, edx
mov rcx, r14
call r12
xor eax, eax
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1400d2300
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret