Function at 0xb20f90
Capabilities:
Contain obfuscated stackstrings
Hash data using sha1
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x150
mov qword [rsp + 0xc0], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
movzx r15d, r9b
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r9b, r9b
jne 0xb20fda
call fcn.00b20640
test al, al
je 0xb21492
call fcn.00b19060
mov rbp, rax
xor edi, edi
cmp qword [rax + 0x10], rdi
jne 0xb2100d
lea ecx, [rdi + 0x10]
call fcn.00b2b91c
mov qword [rsp + 0x20], rax
test rax, rax
je 0xb21006
mov rcx, rax
call fcn.00b1d590
jmp 0xb21009
mov rax, rdi
mov qword [rbp + 0x10], rax
mov r12d, 0x40
mov r8, r12
lea rdx, [rsp + 0x40]
mov rcx, qword [rbp + 0x10]
call fcn.00b1df80
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x20]
lea r8, [rsp + 0xd0]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.00b1bcf0
mov r11, qword [rsp + 0x20]
mov byte [rsp + r11 + 0xd0], 0
mov dword [rsp + 0x94], edi
mov dword [rsp + 0x90], edi
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x98], 0x67452301
mov dword [rsp + 0x9c], 0xefcdab89
mov dword [rsp + 0xa0], 0x98badcfe
mov dword [rsp + 0xa4], 0x10325476
mov dword [rsp + 0xa8], 0xc3d2e1f0
mov byte [rsp + 0x40], 0
mov rax, qword [rsi + 0x10]
sub rax, 4
or ebp, 0xffffffff
cmp rax, 0x10
jb 0xb210d9
lea r9d, [r12 - 0x3c]
lea r8, [rsp + 0x198]
lea edx, [r12 - 0x30]
mov rcx, rsi
call fcn.00b1b910
test al, al
je 0xb210d9
mov r13d, dword [rsp + 0x198]
jmp 0xb210dc
mov r13d, ebp
mov rax, qword [rsi + 0x10]
sub rax, 4
cmp rax, 0xc
jb 0xb2110f
mov r9d, 4
lea r8, [rsp + 0x198]
lea edx, [r9 + 8]
mov rcx, rsi
call fcn.00b1b910
test al, al
je 0xb2110f
mov ebp, dword [rsp + 0x198]
mov r9d, r13d
mov r8d, ebp
mov rdx, rsi
lea rcx, [rsp + 0x40]
call fcn.00b1c020
mov qword [rsp + 0x20], r12
cmp byte [rsp + 0x40], 0
jne 0xb211bf
mov rax, qword [rsp + 0x48]
mov byte [rsp + rax + 0x50], pe_nt_image_headers64
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
cmp rax, 0x38
jbe 0xb21175
cmp rax, r12
jae 0xb21166
lea rcx, [rsp + rax + 0x50]
sub r12, rax
mov r8, r12
xor edx, edx
call fcn.00b304f0
lea rcx, [rsp + 0x40]
call fcn.00b1c150
mov rax, qword [rsp + 0x48]
cmp rax, 0x38
jae 0xb21190
lea rcx, [rsp + rax + 0x50]
mov r8d, 0x38
sub r8, rax
xor edx, edx
call fcn.00b304f0
mov eax, dword [rsp + 0x90]
bswap eax
mov dword [rsp + 0x88], eax
mov eax, dword [rsp + 0x94]
bswap eax
mov dword [rsp + 0x8c], eax
lea rcx, [rsp + 0x40]
call fcn.00b1c150
mov byte [rsp + 0x40], 1
mov rcx, rdi
nop word [rax + rax]
mov eax, dword [rsp + rcx*4 + 0x98]
bswap eax
mov dword [rsp + rcx*4 + 0xac], eax
inc rcx
cmp rcx, 5
jb 0xb211d0
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x110]
mov edx, 0x14
lea rcx, [rsp + 0xac]
call fcn.00b1bcf0
mov r11, qword [rsp + 0x20]
mov byte [rsp + r11 + 0x110], 0
test r15b, r15b
je 0xb212e3
mov byte [rsp + 0x28], 0x74
mov byte [rsp + 0x29], 0x79
mov byte [rsp + 0x2a], 0x70
mov byte [rsp + 0x2b], 0x65
mov byte [rsp + 0x2c], 0x3d
mov byte [rsp + 0x2d], 0x61
mov byte [rsp + 0x2e], 0x63
mov byte [rsp + 0x2f], 0x74
mov byte [rsp + 0x30], 0x69
mov byte [rsp + 0x31], 0x76
mov byte [rsp + 0x32], 0x61
mov byte [rsp + 0x33], 0x74
mov byte [rsp + 0x34], 0x69
mov byte [rsp + 0x35], 0x6f
mov byte [rsp + 0x36], 0x6e
mov byte [rsp + 0x37], 0x26
mov byte [rsp + 0x38], 0x63
mov byte [rsp + 0x39], 0x6f
mov byte [rsp + 0x3a], 0x64
mov byte [rsp + 0x3b], 0x65
mov byte [rsp + 0x3c], 0x3d
mov byte [rsp + 0x3d], 0
lea rdx, [rsp + 0x28]
mov rcx, rdi
cmp byte [rbx + 8], cl
je 0xb212b0
nop word [rax + rax]
inc rcx
cmp byte [rcx + rbx + 8], 0
jne 0xb212a0
nop word [rax + rax]
cmp rcx, 0x800
jae 0xb212cb
movzx eax, byte [rdx]
mov byte [rcx + rbx + 8], al
inc rcx
inc rdx
cmp byte [rdx], 0
jne 0xb212b0
mov byte [rcx + rbx + 8], 0
mov r8b, 1
mov rdx, r14
mov rcx, rbx
call fcn.00b20da0
jmp 0xb2139e
mov byte [rsp + 0x28], 0x61
mov byte [rsp + 0x29], 0x63
mov byte [rsp + 0x2a], 0x74
mov byte [rsp + 0x2b], 0x69
mov byte [rsp + 0x2c], 0x76
mov byte [rsp + 0x2d], 0x61
mov byte [rsp + 0x2e], 0x74
mov byte [rsp + 0x2f], 0x69
mov byte [rsp + 0x30], 0x6f
mov byte [rsp + 0x31], 0x6e
mov byte [rsp + 0x32], 0x2e
mov byte [rsp + 0x33], 0x70
mov byte [rsp + 0x34], 0x68
mov byte [rsp + 0x35], 0x70
mov byte [rsp + 0x36], 0x3f
mov byte [rsp + 0x37], 0x63
mov byte [rsp + 0x38], 0x6f
mov byte [rsp + 0x39], 0x64
mov byte [rsp + 0x3a], 0x65
mov byte [rsp + 0x3b], 0x3d
mov byte [rsp + 0x3c], 0
lea rdx, [rsp + 0x28]
mov rcx, rdi
cmp byte [rbx + 8], cl
je 0xb21370
nop dword [rax]
inc rcx
cmp byte [rcx + rbx + 8], 0
jne 0xb21360
nop word [rax + rax]
cmp rcx, 0x800
jae 0xb2138b
movzx eax, byte [rdx]
mov byte [rcx + rbx + 8], al
inc rcx
inc rdx
cmp byte [rdx], 0
jne 0xb21370
mov byte [rcx + rbx + 8], 0
mov r8b, 1
mov rdx, r14
mov rcx, rbx
call fcn.00b20da0
mov byte [rsp + 0x20], 0x26
mov byte [rsp + 0x21], 0x68
mov byte [rsp + 0x22], 0x77
mov byte [rsp + 0x23], 0x69
mov byte [rsp + 0x24], 0x64
mov byte [rsp + 0x25], 0x3d
mov byte [rsp + 0x26], 0
lea rdx, [rsp + 0x20]
mov rcx, rdi
cmp byte [rbx + 8], cl
je 0xb213e0
nop
inc rcx
cmp byte [rcx + rbx + 8], 0
jne 0xb213d0
nop word [rax + rax]
cmp rcx, 0x800
jae 0xb213fb
movzx eax, byte [rdx]
mov byte [rcx + rbx + 8], al
inc rcx
inc rdx
cmp byte [rdx], 0
jne 0xb213e0
mov byte [rcx + rbx + 8], 0
mov r8b, 1
lea rdx, [rsp + 0xd0]
mov rcx, rbx
call fcn.00b20da0
mov byte [rsp + 0x20], 0x26
mov byte [rsp + 0x21], 0x68
mov byte [rsp + 0x22], 0x61
mov byte [rsp + 0x23], 0x73
mov byte [rsp + 0x24], 0x68
mov byte [rsp + 0x25], 0x3d
mov byte [rsp + 0x26], 0
lea rcx, [rsp + 0x20]
cmp byte [rbx + 8], 0
je 0xb21450
inc rdi
cmp byte [rdi + rbx + 8], 0
jne 0xb21441
nop dword [rax + rax]
cmp rdi, 0x800
jae 0xb2146b
movzx eax, byte [rcx]
mov byte [rdi + rbx + 8], al
inc rdi
inc rcx
cmp byte [rcx], 0
jne 0xb21450
mov byte [rdi + rbx + 8], 0
mov r8b, 1
lea rdx, [rsp + 0x110]
mov rcx, rbx
call fcn.00b20da0
test r15b, r15b
je 0xb21490
mov rcx, rbx
call fcn.00b20ed0
mov al, 1
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret