Function at 0x140035c40
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x190
mov rax, qword [0x140090040]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov r15, rcx
mov qword [rsp + 0x20], rcx
mov rax, qword gs:[0x60]
mov rdx, qword [rax + 0x18]
mov rbp, qword [rdx + 0x10]
mov rdi, rbp
nop dword [rax]
mov r11, qword [rdi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov esi, dword [rax + r11 + 0x88]
add rsi, r11
xor r13d, r13d
cmp rsi, r11
je 0x140035d19
mov r10d, dword [rsi + 0x18]
test r10d, r10d
je 0x140035d19
mov r14d, dword [rsi + 0x20]
nop dword [rax + rax]
dec r10d
lea rax, [r14 + r10*4]
mov r8d, dword [rax + r11]
add r8, r11
mov r9d, 0x811c9dc5
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x140035d14
nop
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
movzx edx, byte [r8]
lea r8, [r8 + 1]
test dl, dl
jne 0x140035ce0
cmp r9d, 0x7f8fe695
je 0x140035f64
test r10d, r10d
jne 0x140035cc0
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rbp
je 0x140035d2e
cmp qword [rax + 0x30], r13
jne 0x140035c90
mov r8, r13
xor edx, edx
lea ecx, [rdx + 2]
call r8
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x140035ee7
mov dword [rsp + 0x50], 0x130
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rbp, qword [rcx + 0x10]
mov rdi, rbp
nop dword [rax]
nop word [rax + rax]
mov r11, qword [rdi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov esi, dword [rax + r11 + 0x88]
add rsi, r11
cmp rsi, r11
je 0x140035df9
mov r10d, dword [rsi + 0x18]
test r10d, r10d
je 0x140035df9
mov r14d, dword [rsi + 0x20]
nop word [rax + rax]
dec r10d
lea rax, [r14 + r10*4]
mov r8d, dword [rax + r11]
add r8, r11
mov r9d, 0x811c9dc5
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x140035df4
nop
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
movzx edx, byte [r8]
lea r8, [r8 + 1]
test dl, dl
jne 0x140035dc0
cmp r9d, 0x4767c60f
je 0x140035f81
test r10d, r10d
jne 0x140035da0
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rbp
je 0x140035e0e
cmp qword [rax + 0x30], r13
jne 0x140035d70
mov r8, r13
lea rdx, [rsp + 0x50]
mov rcx, r12
call r8
test eax, eax
jne 0x140035fa0
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rbp, qword [rcx + 0x10]
mov rdi, rbp
nop dword [rax + rax]
mov r11, qword [rdi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov esi, dword [rax + r11 + 0x88]
add rsi, r11
cmp rsi, r11
je 0x140035ec9
mov r10d, dword [rsi + 0x18]
test r10d, r10d
je 0x140035ec9
mov r14d, dword [rsi + 0x20]
nop word [rax + rax]
dec r10d
lea rax, [r14 + r10*4]
mov r8d, dword [rax + r11]
add r8, r11
mov r9d, 0x811c9dc5
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x140035ec4
nop
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
movzx edx, byte [r8]
lea r8, [r8 + 1]
test dl, dl
jne 0x140035e90
cmp r9d, 0x8285aca5
je 0x14003635e
test r10d, r10d
jne 0x140035e70
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rbp
je 0x140035ede
cmp qword [rax + 0x30], r13
jne 0x140035e40
mov rdx, r13
mov rcx, r12
call rdx
nop
mov rdx, qword [r15 + 0x18]
cmp rdx, 0xf
jbe 0x140035f21
inc rdx
mov rcx, qword [r15]
cmp rdx, 0x1000
jb 0x140035f1c
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140036380
mov rcx, r8
call fcn.1400491b0
xor eax, eax
mov byte [r15], 0
mov qword [r15 + 0x18], 0xf
mov qword [r15 + 0x10], r13
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.140049190
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ecx, dword [rsi + 0x1c]
add rcx, r11
mov eax, dword [rsi + 0x24]
add rax, r11
movzx eax, word [rax + r10*2]
mov r8d, dword [rcx + rax*4]
add r8, r11
jmp 0x140035d31
mov ecx, dword [rsi + 0x1c]
add rcx, r11
mov eax, dword [rsi + 0x24]
add rax, r11
movzx eax, word [rax + r10*2]
mov r8d, dword [rcx + rax*4]
add r8, r11
jmp 0x140035e11
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x40], r13
lea rax, [rsp + 0x7c]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140035fc0
lea rdx, [rsp + 0x7c]
lea rcx, [rsp + 0x28]
call fcn.1400055d0
nop
mov rdx, r15
cmp qword [r15 + 0x18], 0xf
jbe 0x140035fe7
mov rdx, qword [r15]
lea rcx, [rsp + 0x28]
mov rdi, qword [rsp + 0x40]
cmp rdi, 0xf
seta sil
mov rbx, qword [rsp + 0x28]
cmova rcx, rbx
mov r8, qword [rsp + 0x38]
cmp r8, qword [r15 + 0x10]
jne 0x14003601a
call fcn.14006f670
test eax, eax
je 0x140036205
test sil, sil
je 0x140036050
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140036048
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003637a
mov rcx, rbx
call fcn.1400491b0
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rbp, qword [rcx + 0x10]
mov rdi, rbp
nop dword [rax]
nop dword [rax + rax]
mov r11, qword [rdi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov esi, dword [rax + r11 + 0x88]
add rsi, r11
cmp rsi, r11
je 0x1400360fd
mov r10d, dword [rsi + 0x18]
test r10d, r10d
je 0x1400360fd
mov r14d, dword [rsi + 0x20]
nop word [rax + rax]
dec r10d
lea rax, [r14 + r10*4]
mov eax, dword [rax + r11]
add rax, r11
mov r9d, 0x811c9dc5
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x1400360f8
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r9d
imul r9d, edx, 0x1000193
movzx r8d, byte [rax]
lea rax, [rax + 1]
test r8b, r8b
jne 0x1400360c0
cmp r9d, 0xdab098f2
je 0x1400361e8
test r10d, r10d
jne 0x1400360a0
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rbp
je 0x140036113
cmp qword [rax + 0x30], 0
jne 0x140036070
mov r8, r13
lea rdx, [rsp + 0x50]
mov rcx, r12
call r8
test eax, eax
jne 0x140035fa0
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov r14, qword [rcx + 0x10]
mov rdi, r14
nop dword [rax]
mov r11, qword [rdi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov esi, dword [rax + r11 + 0x88]
add rsi, r11
cmp rsi, r11
je 0x1400361c9
mov r10d, dword [rsi + 0x18]
test r10d, r10d
je 0x1400361c9
mov ebp, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r10d
lea rax, [r11 + r10*4]
mov r8d, dword [rax + rbp]
add r8, r11
mov r9d, 0x811c9dc5
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x1400361c4
nop
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
movzx edx, byte [r8]
lea r8, [r8 + 1]
test dl, dl
jne 0x140036190
cmp r9d, 0x8285aca5
je 0x14003635e
test r10d, r10d
jne 0x140036170
mov rax, qword [rdi]
mov rdi, rax
cmp rax, r14
je 0x140035ede
cmp qword [rax + 0x30], 0
jne 0x140036140
jmp 0x140035ede
mov ecx, dword [rsi + 0x1c]
add rcx, r11
mov eax, dword [rsi + 0x24]
add rax, r11
movzx eax, word [rax + r10*2]
mov r8d, dword [rcx + rax*4]
add r8, r11
jmp 0x140036116
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rbp, qword [rcx + 0x10]
mov rdi, rbp
nop dword [rax]
mov r11, qword [rdi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov esi, dword [rax + r11 + 0x88]
add rsi, r11
cmp rsi, r11
je 0x1400362a9
mov r10d, dword [rsi + 0x18]
test r10d, r10d
je 0x1400362a9
mov r14d, dword [rsi + 0x20]
nop word [rax + rax]
dec r10d
lea rax, [r14 + r10*4]
mov r8d, dword [rax + r11]
add r8, r11
mov r9d, 0x811c9dc5
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x1400362a4
nop
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
movzx edx, byte [r8]
lea r8, [r8 + 1]
test dl, dl
jne 0x140036270
cmp r9d, 0x8285aca5
je 0x140036342
test r10d, r10d
jne 0x140036250
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rbp
je 0x1400362bf
cmp qword [rax + 0x30], 0
jne 0x140036220
mov rdx, r13
mov rcx, r12
call rdx
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x140036302
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400362fc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003637a
call fcn.1400491b0
nop
mov rdx, qword [r15 + 0x18]
cmp rdx, 0xf
jbe 0x140036338
inc rdx
mov rcx, qword [r15]
cmp rdx, 0x1000
jb 0x140036333
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140036380
mov rcx, r8
call fcn.1400491b0
mov eax, 1
jmp 0x140035f23
mov ecx, dword [rsi + 0x1c]
add rcx, r11
mov eax, dword [rsi + 0x24]
add rax, r11
movzx eax, word [rax + r10*2]
mov edx, dword [rcx + rax*4]
add rdx, r11
jmp 0x1400362c2
mov ecx, dword [rsi + 0x1c]
add rcx, r11
mov eax, dword [rsi + 0x24]
add rax, r11
movzx eax, word [rax + r10*2]
mov edx, dword [rcx + rax*4]
add rdx, r11
jmp 0x140035ee1
call fcn.1400500ac
nop
call fcn.1400500ac
int3