Function at 0x140003578
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2a8
mov rax, qword gs:[0x60]
mov rdx, qword [rax + 0x18]
add rdx, 0x10
mov rdx, qword [rdx]
mov rax, qword [rdx + 0x30]
movsxd r8, dword [rax + 0x3c]
mov r8d, dword [rax + r8 + 0x88]
test r8, r8
je 0x14000359c
mov r9d, dword [rax + r8 + 0x18]
test r9, r9
je 0x14000359c
mov r10d, dword [rax + r8 + 0x20]
add r10, rax
lea r11, [rax + 1]
dec r9
mov esi, r9d
mov edi, dword [r10 + rsi*4]
mov bl, byte [rax + rdi]
test bl, bl
je 0x1400035ff
add rdi, r11
mov ebp, 0xf09efc91
movsx ebx, bl
xor ebx, ebp
imul ebp, ebx, 0x1000193
mov bl, byte [rdi]
inc rdi
test bl, bl
jne 0x1400035e3
cmp ebp, 0x3a07ee52
je 0x140003606
test rsi, rsi
jne 0x1400035ca
jmp 0x14000359c
mov edx, dword [rax + r8 + 0x1c]
mov r8d, dword [rax + r8 + 0x24]
add rdx, rax
add r8, rax
movzx r8d, word [r8 + rsi*2]
mov r10d, dword [rdx + r8*4]
add r10, rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor edi, edi
mov edx, 0x80000000
mov r8d, 3
xor r9d, r9d
call r10
cmp rax, 0xffffffffffffffff
je 0x140003c4e
mov rsi, rax
mov dword [rsp + 0x3c], 0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x14000368b
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x14000368b
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov edi, dword [r9 + r11*4]
mov bl, byte [rax + rdi]
test bl, bl
je 0x1400036ed
add rdi, r10
mov ebp, 0xdb891533
movsx ebx, bl
xor ebx, ebp
imul ebp, ebx, 0x1000193
mov bl, byte [rdi]
inc rdi
test bl, bl
jne 0x1400036d1
cmp ebp, 0x3f4d7e79
je 0x1400036f4
test r11, r11
jne 0x1400036b8
jmp 0x14000368b
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov r10d, dword [rcx + rdx*4]
add r10, rax
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x40]
lea r9, [rsp + 0x3c]
mov rcx, rsi
mov r8d, 0x40
call r10
test eax, eax
je 0x140003838
cmp dword [rsp + 0x3c], 0x40
jne 0x140003838
movzx ecx, word [rsp + 0x40]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
add rax, 0x10
cmp ecx, 0x5a4d
jne 0x1400037cb
mov rax, qword [rax]
mov rcx, qword [rax + 0x30]
movsxd rdx, dword [rcx + 0x3c]
mov edx, dword [rcx + rdx + 0x88]
test rdx, rdx
je 0x14000375e
mov r8d, dword [rcx + rdx + 0x18]
test r8, r8
je 0x14000375e
mov r9d, dword [rcx + rdx + 0x20]
add r9, rcx
lea r10, [rcx + 1]
dec r8
mov r11d, r8d
mov edi, dword [r9 + r11*4]
mov bl, byte [rcx + rdi]
test bl, bl
je 0x1400037c4
add rdi, r10
mov ebp, 0x830dfc6
movsx ebx, bl
xor ebx, ebp
imul ebp, ebx, 0x1000193
mov bl, byte [rdi]
inc rdi
test bl, bl
jne 0x1400037a4
cmp ebp, 0x221da8b9
je 0x1400038b6
test r11, r11
jne 0x14000378b
jmp 0x14000375e
mov rax, qword [rax]
mov rcx, qword [rax + 0x30]
movsxd rdx, dword [rcx + 0x3c]
mov edx, dword [rcx + rdx + 0x88]
test rdx, rdx
je 0x1400037cb
mov r8d, dword [rcx + rdx + 0x18]
test r8, r8
je 0x1400037cb
mov r9d, dword [rcx + rdx + 0x20]
add r9, rcx
lea r10, [rcx + 1]
dec r8
mov r11d, r8d
mov edi, dword [r9 + r11*4]
mov bl, byte [rcx + rdi]
test bl, bl
je 0x140003831
add rdi, r10
mov ebp, 0x9ead2262
movsx ebx, bl
xor ebx, ebp
imul ebp, ebx, 0x1000193
mov bl, byte [rdi]
inc rdi
test bl, bl
jne 0x140003811
cmp ebp, 0x1a59e368
je 0x140003963
test r11, r11
jne 0x1400037f8
jmp 0x1400037cb
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x140003849
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x140003849
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov edi, dword [r9 + r11*4]
mov bl, byte [rax + rdi]
test bl, bl
je 0x1400038af
add rdi, r10
mov ebp, 0x979e0cd3
movsx ebx, bl
xor ebx, ebp
imul ebp, ebx, 0x1000193
mov bl, byte [rdi]
inc rdi
test bl, bl
jne 0x14000388f
cmp ebp, 0x7d0cf6a7
je 0x140003c2e
test r11, r11
jne 0x140003876
jmp 0x140003849
mov eax, dword [rcx + rdx + 0x1c]
mov edx, dword [rcx + rdx + 0x24]
add rax, rcx
add rdx, rcx
movzx edx, word [rdx + r11*2]
mov r10d, dword [rax + rdx*4]
add r10, rcx
mov edx, dword [rsp + 0x7c]
mov rcx, rsi
xor r8d, r8d
xor r9d, r9d
call r10
cmp eax, 0xffffffff
je 0x140003bb4
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x1400038fa
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x1400038fa
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov edi, dword [r9 + r11*4]
mov bl, byte [rax + rdi]
test bl, bl
je 0x14000395c
add rdi, r10
mov ebp, 0xa7530d00
movsx ebx, bl
xor ebx, ebp
imul ebp, ebx, 0x1000193
mov bl, byte [rdi]
inc rdi
test bl, bl
jne 0x140003940
cmp ebp, 0x588a727
je 0x140003981
test r11, r11
jne 0x140003927
jmp 0x1400038fa
mov eax, dword [rcx + rdx + 0x1c]
mov edx, dword [rcx + rdx + 0x24]
add rax, rcx
add rdx, rcx
movzx edx, word [rdx + r11*2]
mov edx, dword [rax + rdx*4]
add rdx, rcx
jmp 0x140003c47
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov r9d, dword [rcx + rdx*4]
add r9, rax
lea rcx, [rsp + 0x1b0]
mov r8d, 0xf8
xor edx, edx
call r9
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x1400039bf
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x1400039bf
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov edi, dword [r9 + r11*4]
mov bl, byte [rax + rdi]
test bl, bl
je 0x140003a21
add rdi, r10
mov ebp, 0x38562fda
movsx ebx, bl
xor ebx, ebp
imul ebp, ebx, 0x1000193
mov bl, byte [rdi]
inc rdi
test bl, bl
jne 0x140003a05
cmp ebp, 0x44eef31d
je 0x140003a28
test r11, r11
jne 0x1400039ec
jmp 0x1400039bf
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov r9d, dword [rcx + rdx*4]
add r9, rax
lea rcx, [rsp + 0xa8]
mov r8d, 0x108
xor edx, edx
call r9
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x140003a66
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x140003a66
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov edi, dword [r9 + r11*4]
mov bl, byte [rax + rdi]
test bl, bl
je 0x140003ac8
add rdi, r10
mov ebp, 0xaf50db01
movsx ebx, bl
xor ebx, ebp
imul ebp, ebx, 0x1000193
mov bl, byte [rdi]
inc rdi
test bl, bl
jne 0x140003aac
cmp ebp, 0xadb92587
je 0x140003acf
test r11, r11
jne 0x140003a93
jmp 0x140003a66
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov r10d, dword [rcx + rdx*4]
add r10, rax
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x1b0]
lea r9, [rsp + 0x3c]
mov rcx, rsi
mov r8d, 0xf8
call r10
test eax, eax
je 0x140003c64
cmp dword [rsp + 0x3c], 0xf8
jne 0x140003c64
movzx eax, word [rsp + 0x1b4]
xor edi, edi
cmp eax, 0x8664
jne 0x140003ff9
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x140003b47
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x140003b47
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov edi, dword [r9 + r11*4]
mov bl, byte [rax + rdi]
test bl, bl
je 0x140003bad
add rdi, r10
mov ebp, 0xb4aa0c4b
movsx ebx, bl
xor ebx, ebp
imul ebp, ebx, 0x1000193
mov bl, byte [rdi]
inc rdi
test bl, bl
jne 0x140003b8d
cmp ebp, 0xf139a02c
je 0x140003ce4
test r11, r11
jne 0x140003b74
jmp 0x140003b47
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x140003bc5
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x140003bc5
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov edi, dword [r9 + r11*4]
mov bl, byte [rax + rdi]
test bl, bl
je 0x140003c27
add rdi, r10
mov ebp, 0x852b945f
movsx ebx, bl
xor ebx, ebp
imul ebp, ebx, 0x1000193
mov bl, byte [rdi]
inc rdi
test bl, bl
jne 0x140003c0b
cmp ebp, 0xc5831053
je 0x140003c2e
test r11, r11
jne 0x140003bf2
jmp 0x140003bc5
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
mov rcx, rsi
call rdx
xor edi, edi
mov eax, edi
add rsp, 0x2a8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword gs:[0x60]
mov r8, qword [rax + 0x18]
add r8, 0x10
mov r8, qword [r8]
mov rax, qword [r8 + 0x30]
movsxd rcx, dword [rax + 0x3c]
mov edx, dword [rax + rcx + 0x88]
lea rcx, [rax + rdx]
test rdx, rdx
je 0x140003c75
mov r9d, dword [rcx + 0x18]
test r9, r9
je 0x140003c75
mov r10d, dword [rcx + 0x20]
add r10, rax
lea r11, [rax + 1]
dec r9
mov edx, r9d
mov edi, dword [r10 + rdx*4]
mov bl, byte [rax + rdi]
test bl, bl
je 0x140003cdd
add rdi, r11
mov ebp, 0xb25fea44
movsx ebx, bl
xor ebx, ebp
imul ebp, ebx, 0x1000193
mov bl, byte [rdi]
inc rdi
test bl, bl
jne 0x140003cbd
cmp ebp, 0x8831688e
je 0x1400040fe
test rdx, rdx
jne 0x140003ca4
jmp 0x140003c75
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov r10d, dword [rcx + rdx*4]
add r10, rax
mov edx, dword [rsp + 0x7c]
mov rcx, rsi
xor r8d, r8d
xor r9d, r9d
call r10
mov rcx, qword gs:[0x60]
mov r8, qword [rcx + 0x18]
add r8, 0x10
cmp eax, 0xffffffff
je 0x140003d8c
mov r8, qword [r8]
mov rax, qword [r8 + 0x30]
movsxd rcx, dword [rax + 0x3c]
mov ecx, dword [rax + rcx + 0x88]
test rcx, rcx
je 0x140003d24
mov edx, dword [rax + rcx + 0x18]
test rdx, rdx
je 0x140003d24
mov r9d, dword [rax + rcx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec rdx
mov r11d, edx
mov edi, dword [r9 + r11*4]
mov bl, byte [rax + rdi]
test bl, bl
je 0x140003d85
add rdi, r10
mov ebp, 0xcc6157a7
movsx ebx, bl
xor ebx, ebp
imul ebp, ebx, 0x1000193
mov bl, byte [rdi]
inc rdi
test bl, bl
jne 0x140003d69
cmp ebp, 0x4b2eef45
je 0x140003dfb
test r11, r11
jne 0x140003d50
jmp 0x140003d24
mov r8, qword [r8]
mov rax, qword [r8 + 0x30]
movsxd rcx, dword [rax + 0x3c]
mov edx, dword [rax + rcx + 0x88]
lea rcx, [rax + rdx]
test rdx, rdx
je 0x140003d8c
mov r9d, dword [rcx + 0x18]
test r9, r9
je 0x140003d8c
mov r10d, dword [rcx + 0x20]
add r10, rax
lea r11, [rax + 1]
dec r9
mov edx, r9d
mov edi, dword [r10 + rdx*4]
mov bl, byte [rax + rdi]
test bl, bl
je 0x140003df4
add rdi, r11
mov ebp, 0x99f2bc36
movsx ebx, bl
xor ebx, ebp
imul ebp, ebx, 0x1000193
mov bl, byte [rdi]
inc rdi
test bl, bl
jne 0x140003dd4
cmp ebp, 0xfa53cb4c
je 0x1400040fe
test rdx, rdx
jne 0x140003dbb
jmp 0x140003d8c
mov edx, dword [rax + rcx + 0x1c]
mov ecx, dword [rax + rcx + 0x24]
add rdx, rax
add rcx, rax
movzx ecx, word [rcx + r11*2]
mov r10d, dword [rdx + rcx*4]
add r10, rax
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0xa8]
lea r9, [rsp + 0x3c]
mov rcx, rsi
mov r8d, 0x108
call r10
test eax, eax
je 0x140004082
cmp dword [rsp + 0x3c], 0x108
jne 0x140004082
mov edi, dword [rsp + 0xfc]
cmp word [rsp + 0xae], 0
je 0x140003ff9
xor ebp, ebp
lea rbx, [rsp + 0x80]
lea r14, [rsp + 0x3c]
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x140003e83
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x140003e83
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov r15d, dword [r9 + r11*4]
mov r12b, byte [rax + r15]
test r12b, r12b
je 0x140003eee
add r15, r10
mov r13d, 0xf7dfec91
movsx r12d, r12b
xor r12d, r13d
imul r13d, r12d, 0x1000193
mov r12b, byte [r15]
inc r15
test r12b, r12b
jne 0x140003ecc
cmp r13d, 0x7ce21e6a
je 0x140003ef5
test r11, r11
jne 0x140003eb0
jmp 0x140003e83
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov r9d, dword [rcx + rdx*4]
add r9, rax
mov r8d, 0x28
mov rcx, rbx
xor edx, edx
call r9
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x140003f2e
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x140003f2e
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov r15d, dword [r9 + r11*4]
mov r12b, byte [rax + r15]
test r12b, r12b
je 0x140003f99
add r15, r10
mov r13d, 0x18c3ce68
movsx r12d, r12b
xor r12d, r13d
imul r13d, r12d, 0x1000193
mov r12b, byte [r15]
inc r15
test r12b, r12b
jne 0x140003f77
cmp r13d, 0x4ced48ca
je 0x140003fa0
test r11, r11
jne 0x140003f5b
jmp 0x140003f2e
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov r10d, dword [rcx + rdx*4]
add r10, rax
mov qword [rsp + 0x20], 0
mov rcx, rsi
mov rdx, rbx
mov r8d, 0x28
mov r9, r14
call r10
test eax, eax
je 0x140003ff9
cmp dword [rsp + 0x3c], 0x28
jne 0x140003ff9
add edi, dword [rsp + 0x90]
inc ebp
movzx eax, word [rsp + 0xae]
cmp ebp, eax
jb 0x140003e72
mov rax, qword gs:[0x60]
mov r8, qword [rax + 0x18]
add r8, 0x10
mov r8, qword [r8]
mov rax, qword [r8 + 0x30]
movsxd rcx, dword [rax + 0x3c]
mov edx, dword [rax + rcx + 0x88]
lea rcx, [rax + rdx]
test rdx, rdx
je 0x14000400a
mov r9d, dword [rcx + 0x18]
test r9, r9
je 0x14000400a
mov r10d, dword [rcx + 0x20]
add r10, rax
lea r11, [rax + 1]
dec r9
mov edx, r9d
mov ebx, dword [r10 + rdx*4]
mov bpl, byte [rax + rbx]
test bpl, bpl
je 0x14000407b
add rbx, r11
mov r14d, 0x3eb2754b
movsx ebp, bpl
xor ebp, r14d
imul r14d, ebp, 0x1000193
mov bpl, byte [rbx]
inc rbx
test bpl, bpl
jne 0x140004055
cmp r14d, 0xdce62fbf
je 0x140004100
test rdx, rdx
jne 0x140004039
jmp 0x14000400a
mov rax, qword gs:[0x60]
mov r8, qword [rax + 0x18]
add r8, 0x10
mov r8, qword [r8]
mov rax, qword [r8 + 0x30]
movsxd rcx, dword [rax + 0x3c]
mov edx, dword [rax + rcx + 0x88]
lea rcx, [rax + rdx]
test rdx, rdx
je 0x140004093
mov r9d, dword [rcx + 0x18]
test r9, r9
je 0x140004093
mov r10d, dword [rcx + 0x20]
add r10, rax
lea r11, [rax + 1]
dec r9
mov edx, r9d
mov edi, dword [r10 + rdx*4]
mov bl, byte [rax + rdi]
test bl, bl
je 0x1400040f7
add rdi, r11
mov ebp, 0x772058b3
movsx ebx, bl
xor ebx, ebp
imul ebp, ebx, 0x1000193
mov bl, byte [rdi]
inc rdi
test bl, bl
jne 0x1400040db
cmp ebp, 0x3c725987
je 0x1400040fe
test rdx, rdx
jne 0x1400040c2
jmp 0x140004093
xor edi, edi
mov r8d, dword [rcx + 0x1c]
mov ecx, dword [rcx + 0x24]
add r8, rax
add rcx, rax
movzx ecx, word [rcx + rdx*2]
mov edx, dword [r8 + rcx*4]
add rdx, rax
mov rcx, rsi
call rdx
jmp 0x140003c4e