Function at 0x140030c70
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x60
mov ecx, dword [0x140275248]
test ecx, ecx
je 0x140030ccd
mov eax, dword [0x14027d9a8]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x14027d9ac], 0xa
setl r8b
or r8b, al
mov r10d, dword [0x14027e328]
mov r9d, dword [0x14027e32c]
jne 0x14003122b
lea r11d, [r10 - 1]
imul r11d, r10d
and r11d, 1
jmp 0x140031217
cmp dword [0x14027e294], 0xa
jl 0x140030cf2
mov eax, dword [0x14027e290]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x140030cf2
nop word [rax + rax]
jmp 0x140030cf0
mov rax, qword gs:[0x60]
mov r8, qword [rax + 0x18]
add r8, 0x10
mov r8, qword [r8]
mov r10, qword [r8 + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov r9d, dword [rcx + r10 + 0x88]
test r9, r9
je 0x140030d03
mov ebp, dword [r10 + r9 + 0x18]
mov rbx, rbp
nop word cs:[rax + rax]
nop dword [rax]
sub rbx, 1
jb 0x140030d03
mov ecx, ebp
add ecx, 0xffffffff
mov edx, dword [r10 + r9 + 0x20]
add rdx, r10
mov edi, dword [rdx + rcx*4]
add rdi, r10
mov esi, 0xce1375cd
nop
mov eax, esi
movsx ebp, byte [rdi]
add rdi, 1
mov edx, esi
xor edx, ebp
imul esi, edx, 0x1000193
test ebp, ebp
jne 0x140030d50
mov rbp, rbx
cmp eax, 0xe1b8c20b
jne 0x140030d30
mov eax, dword [r10 + r9 + 0x1c]
mov edx, dword [r10 + r9 + 0x24]
add rax, r10
add rdx, r10
movzx ecx, word [rdx + rcx*2]
mov eax, dword [rax + rcx*4]
add rax, r10
mov ecx, 0x77
call rax
mov r14b, 1
test ax, ax
js 0x14003100b
cmp dword [0x14027e30c], 0xa
jl 0x140030dc2
mov eax, dword [0x14027e308]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x140030dc2
nop dword [rax + rax]
jmp 0x140030dc0
mov rax, qword gs:[0x60]
mov r8, qword [rax + 0x18]
add r8, 0x10
mov r8, qword [r8]
mov r10, qword [r8 + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov r9d, dword [rcx + r10 + 0x88]
test r9, r9
je 0x140030dd3
mov ebx, dword [r10 + r9 + 0x18]
mov rbp, rbx
nop word cs:[rax + rax]
nop dword [rax]
sub rbp, 1
jb 0x140030dd3
mov ecx, ebx
add ecx, 0xffffffff
mov edx, dword [r10 + r9 + 0x20]
add rdx, r10
mov edi, dword [rdx + rcx*4]
add rdi, r10
mov esi, 0xcd13743a
nop
mov eax, esi
movsx ebx, byte [rdi]
add rdi, 1
mov edx, esi
xor edx, ebx
imul esi, edx, 0x1000193
test ebx, ebx
jne 0x140030e20
mov rbx, rbp
cmp eax, 0xa744e5ae
jne 0x140030e00
mov eax, dword [r10 + r9 + 0x1c]
mov edx, dword [r10 + r9 + 0x24]
add rax, r10
add rdx, r10
movzx ecx, word [rdx + rcx*2]
mov edx, dword [rax + rcx*4]
add rdx, r10
mov ecx, reloc.WLDAP32.dll_Ordinal_45
call rdx
test ax, ax
js 0x14003100b
mov rax, qword gs:[0x60]
mov r8, qword [rax + 0x18]
add r8, 0x10
mov eax, dword [0x14027e310]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete al
cmp dword [0x14027e314], 0xa
setl dl
or dl, al
mov r9d, 0xffffffff
mov r8, qword [r8]
mov rcx, qword [r8 + 0x30]
movsxd rax, dword [rcx + 0x3c]
mov r10d, dword [rax + rcx + 0x88]
test r10, r10
je 0x140030ea0
mov edi, dword [rcx + r10 + 0x18]
mov rax, rdi
sub rax, 1
jb 0x140030ea0
add rdi, r9
nop dword [rax]
test dl, dl
je 0x140030ed0
mov r11d, edi
mov ebx, dword [rcx + r10 + 0x20]
add rbx, rcx
mov edi, dword [rbx + r11*4]
add rdi, rcx
mov ebx, 0xcc1372a7
nop dword [rax + rax]
mov esi, ebx
movsx ebp, byte [rdi]
add rdi, 1
xor ebx, ebp
imul ebx, ebx, 0x1000193
test ebp, ebp
jne 0x140030ef0
mov rdi, rax
cmp esi, 0xed75d2bd
jne 0x140030ec0
mov eax, dword [rcx + r10 + 0x1c]
mov edx, dword [rcx + r10 + 0x24]
add rax, rcx
add rdx, rcx
movzx edx, word [rdx + r11*2]
mov edx, dword [rax + rdx*4]
add rdx, rcx
mov ecx, Ordinal_41
call rdx
test ax, ax
js 0x14003100b
cmp dword [0x14027e31c], 0xa
jl 0x140030f62
mov eax, dword [0x14027e318]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x140030f62
nop word cs:[rax + rax]
nop
jmp 0x140030f60
mov rax, qword gs:[0x60]
mov r8, qword [rax + 0x18]
add r8, 0x10
mov r8, qword [r8]
mov r10, qword [r8 + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov r9d, dword [rcx + r10 + 0x88]
test r9, r9
je 0x140030f73
mov ebp, dword [r10 + r9 + 0x18]
mov rbx, rbp
nop word cs:[rax + rax]
nop dword [rax]
sub rbx, 1
jb 0x140030f73
mov ecx, ebp
add ecx, 0xffffffff
mov edx, dword [r10 + r9 + 0x20]
add rdx, r10
mov edi, dword [rdx + rcx*4]
add rdi, r10
mov esi, 0xcb137114
nop
mov eax, esi
movsx ebp, byte [rdi]
add rdi, 1
mov edx, esi
xor edx, ebp
imul esi, edx, 0x1000193
test ebp, ebp
jne 0x140030fc0
mov rbp, rbx
cmp eax, 0x7f22b160
jne 0x140030fa0
mov eax, dword [r10 + r9 + 0x1c]
mov edx, dword [r10 + r9 + 0x24]
add rax, r10
add rdx, r10
movzx ecx, word [rdx + rcx*2]
mov edx, dword [rax + rcx*4]
add rdx, r10
mov ecx, dword [0x140275248]
call rdx
movzx r14d, ax
shr r14d, 0xf
mov eax, dword [0x14027ec28]
mov ecx, dword [0x14028e5f0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140031179
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r9b, byte [0x14027d178]
mov ecx, r9d
and cl, 1
sete r8b
mov rdx, qword [0x14027d168]
cmp rax, rdx
sete bl
cmp rax, qword [0x14027d170]
sete sil
or sil, bl
cmp sil, 1
je 0x14003108a
test cl, cl
je 0x14003108a
xor ecx, ecx
call fcn.1400a85a0
mov byte [0x14027d178], 0
mov rdx, qword [0x14027ec20]
mov cl, 1
call fcn.1400a8290
jmp 0x140031106
mov al, byte [0x14027ec18]
not al
and al, r14b
cmp al, 1
jne 0x140031106
test sil, sil
je 0x1400310ff
mov byte [0x14027d178], r8b
test r9b, 1
je 0x1400310dd
xor ecx, ecx
call fcn.1400a85a0
mov rcx, qword [0x14027d170]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov rdx, qword [0x14027d170]
mov cl, 1
call fcn.1400a8290
mov rdx, qword [0x14027ec20]
mov cl, 1
call fcn.1400a8290
jmp 0x1400310ff
mov cl, 1
call fcn.1400a85a0
mov rdx, qword [0x14027ec20]
xor ecx, ecx
call fcn.1400a8290
mov rcx, qword [0x14027d168]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov byte [0x14027ec18], 1
mov al, byte [0x14027d178]
test al, al
je 0x140031116
xor sil, 1
je 0x140031155
test al, al
mov rdx, qword [0x14027d170]
mov rax, qword [0x14027d168]
mov rcx, rax
cmove rcx, rdx
cmove rdx, rax
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.USER32.dll_SetWindowPos]
test r14b, r14b
jne 0x14003116a
cmp byte [0x14027ec18], 1
jne 0x14003116a
mov byte [0x14027ec18], 0
add rsp, 0x60
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, [0x14027ec28]
call fcn.1400c4998
cmp dword [0x14027ec28], 0xffffffff
jne 0x140031030
movups xmm0, xmmword [str.fRTUeoNGh._B]
movaps xmmword [rsp + 0x40], xmm0
movups xmm0, xmmword [0x1401ca2f6]
movups xmmword [rsp + 0x4c], xmm0
mov word [rsp + 0x40], 0x53
xor byte [rsp + 0x42], 0x36
xor byte [rsp + 0x44], 0x37
xor byte [rsp + 0x46], 0x38
xor byte [rsp + 0x48], 0x39
xor byte [rsp + 0x4a], 0x3a
xor byte [rsp + 0x4c], 0x3b
xor byte [rsp + 0x4e], 0x3c
xor byte [rsp + 0x50], 0x3d
xor byte [rsp + 0x52], 0x3e
xor byte [rsp + 0x54], 0x3f
xor byte [rsp + 0x56], 0x40
xor byte [rsp + 0x58], 0x41
xor byte [rsp + 0x5a], 0x42
lea rcx, [rsp + 0x40]
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
mov qword [0x14027ec20], rax
lea rcx, [0x14027ec28]
call fcn.1400c4a30
jmp 0x140031030
mov rax, qword gs:[0x60]
cmp r9d, 0xa
jl 0x14003122b
test r11d, r11d
jne 0x14003124c
lea r11d, [r10 - 1]
imul r11d, r10d
and r11d, 1
sete dl
cmp r9d, 0xa
setl al
or al, dl
cmp al, 1
je 0x140031274
jmp 0x140031354
mov rax, qword gs:[0x60]
nop word cs:[rax + rax]
nop
mov rax, qword gs:[0x60]
mov rax, qword gs:[0x60]
jmp 0x140031260
mov rdx, qword gs:[0x60]
test al, al
je 0x140031354
mov r14, qword [rdx + 0x18]
add r14, 0x10
mov r14, qword [r14]
mov r12, qword [r14 + 0x30]
movsxd rax, dword [r12 + 0x3c]
mov r15d, dword [rax + r12 + 0x88]
test r15, r15
je 0x14003128d
mov eax, dword [r12 + r15 + 0x18]
mov rdx, rax
nop
sub rdx, 1
jb 0x14003128d
mov ebp, eax
add ebp, 0xffffffff
mov eax, dword [r12 + r15 + 0x20]
add rax, r12
mov eax, dword [rax + rbp*4]
add rax, r12
mov esi, 0x38165b42
nop
mov edi, esi
movsx ebx, byte [rax]
add rax, 1
xor esi, ebx
imul esi, esi, 0x1000193
test ebx, ebx
jne 0x1400312d0
mov rax, rdx
cmp edi, 0x8aa41126
jne 0x1400312b0
test r8b, r8b
je 0x140031217
mov eax, dword [r12 + r15 + 0x1c]
mov edx, dword [r12 + r15 + 0x24]
add rax, r12
add rdx, r12
movzx edx, word [rdx + rbp*2]
mov esi, dword [rax + rdx*4]
add rsi, r12
nop word cs:[rax + rax]
nop dword [rax]
call rsi
cmp dword [0x14027d9ac], 0xa
jl 0x140031003
mov ecx, dword [0x14027d9a8]
lea edx, [rcx - 1]
imul edx, ecx
and edx, 1
je 0x140031003
mov ecx, dword [0x140275248]
call rsi
mov ecx, dword [0x140275248]
jmp 0x140031320
mov rdx, qword gs:[0x60]
jmp 0x140031274