Function at 0x140002ee4
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0xb0
mov rsi, r8
mov r11, rdx
mov r8, qword [0x140141748]
test r8, r8
jne 0x140002f80
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r9, qword [rax + 0x60]
mov r10d, 0x1327e3a3
movzx ecx, word [rax + 0x58]
shr rcx, 1
lea rbx, [r9 + rcx*2]
cmp r9, rbx
je 0x140002f70
movsx ecx, byte [r9]
mov edx, ecx
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
add r9, 2
xor r8d, r10d
imul r10d, r8d, 0x1000193
cmp r9, rbx
jne 0x140002f3d
cmp r10d, 0x2f4a94a1
je 0x140002f75
mov rax, qword [rax]
jmp 0x140002f23
mov r8, qword [rax + 0x30]
mov qword [0x140141748], r8
movsxd rax, dword [r8 + 0x3c]
xor edx, edx
mov r9d, dword [rax + r8 + 0x88]
lea r14d, [rdx + 1]
mov edi, dword [r9 + r8 + 0x20]
lea rax, [rdi + rdx*4]
mov r10d, 0x1227e210
mov ecx, dword [rax + r8]
add rcx, r8
mov al, byte [rcx]
add rcx, r14
test al, al
je 0x140002fd0
movsx eax, al
xor eax, r10d
imul r10d, eax, 0x1000193
mov al, byte [rcx]
add rcx, r14
test al, al
jne 0x140002fb1
cmp r10d, 0x2aa6e08f
je 0x140002fd5
add edx, r14d
jmp 0x140002f97
mov ecx, dword [r9 + r8 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r9 + r8 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
cmp qword [r11 + 0x18], 8
jb 0x140002ff9
mov r11, qword [r11]
and qword [rsp + 0x30], 0
mov edi, 0x80
mov dword [rsp + 0x28], edi
xor r9d, r9d
mov r8d, r14d
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
mov rcx, r11
call rax
mov r8, qword [0x1401417c0]
mov rbp, rax
test r8, r8
jne 0x14000309b
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
mov r9, qword [rcx + 0x60]
mov r10d, 0x5e785388
movzx edx, word [rcx + 0x58]
shr rdx, 1
lea r11, [r9 + rdx*2]
cmp r9, r11
je 0x14000308b
movsx eax, byte [r9]
mov edx, eax
sub al, 0x41
mov r8d, edx
or r8d, 0x20
cmp al, 0x19
cmova r8d, edx
add r9, 2
xor r8d, r10d
imul r10d, r8d, 0x1000193
cmp r9, r11
jne 0x14000305a
cmp r10d, 0x8b5e5e32
je 0x140003090
mov rcx, qword [rcx]
jmp 0x140003040
mov r8, qword [rcx + 0x30]
mov qword [0x1401417c0], r8
movsxd rax, dword [r8 + 0x3c]
xor edx, edx
mov r9d, dword [rax + r8 + 0x88]
mov ebx, dword [r9 + r8 + 0x20]
lea rax, [rbx + rdx*4]
mov r10d, 0x5f78551b
mov ecx, dword [rax + r8]
add rcx, r8
mov al, byte [rcx]
add rcx, r14
test al, al
je 0x1400030e7
movsx eax, al
xor eax, r10d
imul r10d, eax, 0x1000193
mov al, byte [rcx]
add rcx, r14
test al, al
jne 0x1400030c8
cmp r10d, 0x5d905c96
je 0x1400030ec
add edx, r14d
jmp 0x1400030ae
mov ecx, dword [r9 + r8 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r9 + r8 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
cmp qword [rsi + 0x18], 8
jb 0x140003110
mov rsi, qword [rsi]
and qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], edi
mov r8d, r14d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, rsi
call rax
mov rsi, rax
cmp rbp, 0xffffffffffffffff
je 0x14000362f
cmp rax, 0xffffffffffffffff
je 0x140003545
mov r8, qword [0x1401417b8]
xor dil, dil
test r8, r8
jne 0x1400031c6
mov rcx, qword gs:[0x60]
mov rax, qword [rcx + 0x18]
mov rax, qword [rax + 0x10]
mov r9, qword [rax + 0x60]
mov r10d, 0x7b29089b
movzx ecx, word [rax + 0x58]
shr rcx, 1
lea r11, [r9 + rcx*2]
cmp r9, r11
je 0x1400031b6
movsx ecx, byte [r9]
mov edx, ecx
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
add r9, 2
xor r8d, r10d
imul r10d, r8d, 0x1000193
cmp r9, r11
jne 0x140003183
cmp r10d, 0xdfe96f79
je 0x1400031bb
mov rax, qword [rax]
jmp 0x140003169
mov r8, qword [rax + 0x30]
mov qword [0x1401417b8], r8
movsxd rax, dword [r8 + 0x3c]
xor edx, edx
mov r9d, dword [rax + r8 + 0x88]
mov ebx, dword [r9 + r8 + 0x20]
lea rax, [rbx + rdx*4]
mov r10d, 0x7a290708
mov ecx, dword [rax + r8]
add rcx, r8
mov al, byte [rcx]
add rcx, r14
test al, al
je 0x140003212
movsx eax, al
xor eax, r10d
imul r10d, eax, 0x1000193
mov al, byte [rcx]
add rcx, r14
test al, al
jne 0x1400031f3
cmp r10d, 0xae872f8f
je 0x140003217
add edx, r14d
jmp 0x1400031d9
mov ecx, dword [r9 + r8 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r9 + r8 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
lea rdx, [rsp + 0x78]
add rax, r8
mov rcx, rbp
call rax
test eax, eax
je 0x140003363
mov r8, qword [0x1401417d0]
test r8, r8
jne 0x1400032bd
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r9, qword [rax + 0x60]
mov r10d, 0x63c7d169
movzx ecx, word [rax + 0x58]
shr rcx, 1
lea r11, [r9 + rcx*2]
cmp r9, r11
je 0x1400032ad
movsx ecx, byte [r9]
mov edx, ecx
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
add r9, 2
xor r8d, r10d
imul r10d, r8d, 0x1000193
cmp r9, r11
jne 0x14000327a
cmp r10d, 0x444430f7
je 0x1400032b2
mov rax, qword [rax]
jmp 0x140003260
mov r8, qword [rax + 0x30]
mov qword [0x1401417d0], r8
movsxd rax, dword [r8 + 0x3c]
xor edx, edx
mov r9d, dword [rax + r8 + 0x88]
mov ebx, dword [r9 + r8 + 0x20]
lea rax, [rbx + rdx*4]
mov r10d, 0x62c7cfd6
mov ecx, dword [rax + r8]
add rcx, r8
mov al, byte [rcx]
add rcx, r14
test al, al
je 0x140003309
movsx eax, al
xor eax, r10d
imul r10d, eax, 0x1000193
mov al, byte [rcx]
add rcx, r14
test al, al
jne 0x1400032ea
cmp r10d, 0xd9ff618d
je 0x14000330e
add edx, r14d
jmp 0x1400032d0
mov ecx, dword [r9 + r8 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r9 + r8 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
lea rdx, [rsp + 0x40]
add rax, r8
mov rcx, rsi
call rax
test eax, eax
je 0x140003363
mov eax, dword [rsp + 0x5c]
cmp dword [rsp + 0x94], eax
jne 0x140003363
mov eax, dword [rsp + 0x6c]
cmp dword [rsp + 0xa4], eax
jne 0x140003363
mov eax, dword [rsp + 0x70]
cmp dword [rsp + 0xa8], eax
movzx edi, dil
cmove edi, r14d
mov r8, qword [0x140141788]
test r8, r8
jne 0x1400033dd
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r9, qword [rax + 0x60]
mov r10d, 0x90286267
movzx ecx, word [rax + 0x58]
shr rcx, 1
lea r11, [r9 + rcx*2]
cmp r9, r11
je 0x1400033cd
movsx ecx, byte [r9]
mov edx, ecx
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
add r9, 2
xor r8d, r10d
imul r10d, r8d, 0x1000193
cmp r9, r11
jne 0x14000339a
cmp r10d, 0x26afede5
je 0x1400033d2
mov rax, qword [rax]
jmp 0x140003380
mov r8, qword [rax + 0x30]
mov qword [0x140141788], r8
movsxd rax, dword [r8 + 0x3c]
xor edx, edx
mov r9d, dword [rax + r8 + 0x88]
mov ebx, dword [r9 + r8 + 0x20]
lea rax, [rbx + rdx*4]
mov r10d, 0x8f2860d4
mov ecx, dword [rax + r8]
add rcx, r8
mov al, byte [rcx]
add rcx, r14
test al, al
je 0x140003429
movsx eax, al
xor eax, r10d
imul r10d, eax, 0x1000193
mov al, byte [rcx]
add rcx, r14
test al, al
jne 0x14000340a
cmp r10d, 0x9e9eea5e
je 0x14000342e
add edx, r14d
jmp 0x1400033f0
mov ecx, dword [r9 + r8 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r9 + r8 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
mov rcx, rbp
add rax, r8
call rax
mov r10, qword [0x1401417a0]
test r10, r10
jne 0x1400034c7
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r9, qword [rax + 0x60]
mov r10d, 0x8477a7e8
movzx ecx, word [rax + 0x58]
shr rcx, 1
lea r11, [r9 + rcx*2]
cmp r9, r11
je 0x1400034b7
movsx ecx, byte [r9]
mov edx, ecx
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
add r9, 2
xor r8d, r10d
imul r10d, r8d, 0x1000193
cmp r9, r11
jne 0x140003484
cmp r10d, 0x4f152692
je 0x1400034bc
mov rax, qword [rax]
jmp 0x14000346a
mov r10, qword [rax + 0x30]
mov qword [0x1401417a0], r10
movsxd rax, dword [r10 + 0x3c]
xor edx, edx
mov r9d, dword [rax + r10 + 0x88]
mov ebx, dword [r9 + r10 + 0x20]
lea rax, [rbx + rdx*4]
mov r11d, edx
mov ecx, dword [rax + r10]
mov r8d, 0x8577a97b
add rcx, r10
mov al, byte [rcx]
add rcx, r14
test al, al
je 0x140003516
movsx eax, al
xor eax, r8d
imul r8d, eax, 0x1000193
mov al, byte [rcx]
add rcx, r14
test al, al
jne 0x1400034f7
cmp r8d, 0xd692242f
je 0x14000351b
add edx, r14d
jmp 0x1400034da
mov edx, dword [r9 + r10 + 0x24]
mov rcx, rsi
add rdx, r10
movzx r8d, word [rdx + r11*2]
mov edx, dword [r9 + r10 + 0x1c]
add rdx, r10
mov r9d, dword [rdx + r8*4]
add r9, r10
call r9
mov al, dil
jmp 0x140003725
mov r8, qword [0x140141760]
test r8, r8
jne 0x1400035bf
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r9, qword [rax + 0x60]
mov r10d, 0xc828a457
movzx ecx, word [rax + 0x58]
shr rcx, 1
lea r11, [r9 + rcx*2]
cmp r9, r11
je 0x1400035af
movsx ecx, byte [r9]
mov edx, ecx
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
add r9, 2
xor r8d, r10d
imul r10d, r8d, 0x1000193
cmp r9, r11
jne 0x14000357c
cmp r10d, 0xdea58535
je 0x1400035b4
mov rax, qword [rax]
jmp 0x140003562
mov r8, qword [rax + 0x30]
mov qword [0x140141760], r8
movsxd rax, dword [r8 + 0x3c]
xor edx, edx
mov r9d, dword [rax + r8 + 0x88]
mov ebx, dword [r9 + r8 + 0x20]
lea rax, [rbx + rdx*4]
mov r10d, 0xc728a2c4
mov ecx, dword [rax + r8]
add rcx, r8
mov al, byte [rcx]
add rcx, r14
test al, al
je 0x14000360b
movsx eax, al
xor eax, r10d
imul r10d, eax, 0x1000193
mov al, byte [rcx]
add rcx, r14
test al, al
jne 0x1400035ec
cmp r10d, 0x37f5260e
je 0x140003610
add edx, r14d
jmp 0x1400035d2
mov ecx, dword [r9 + r8 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r9 + r8 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
mov rcx, rbp
jmp 0x14000371e
cmp rsi, 0xffffffffffffffff
je 0x140003723
mov r8, qword [0x140141768]
test r8, r8
jne 0x1400036b3
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r9, qword [rax + 0x60]
mov r10d, 0xa4946fa7
movzx ecx, word [rax + 0x58]
shr rcx, 1
lea r11, [r9 + rcx*2]
cmp r9, r11
je 0x1400036a3
movsx ecx, byte [r9]
mov edx, ecx
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
add r9, 2
xor r8d, r10d
imul r10d, r8d, 0x1000193
cmp r9, r11
jne 0x140003670
cmp r10d, 0x2b9f4a5
je 0x1400036a8
mov rax, qword [rax]
jmp 0x140003656
mov r8, qword [rax + 0x30]
mov qword [0x140141768], r8
movsxd rax, dword [r8 + 0x3c]
xor edx, edx
mov r9d, dword [rax + r8 + 0x88]
mov ebx, dword [r9 + r8 + 0x20]
lea rax, [rbx + rdx*4]
mov r10d, 0xa3946e14
mov ecx, dword [rax + r8]
add rcx, r8
mov al, byte [rcx]
add rcx, r14
test al, al
je 0x1400036ff
movsx eax, al
xor eax, r10d
imul r10d, eax, 0x1000193
mov al, byte [rcx]
add rcx, r14
test al, al
jne 0x1400036e0
cmp r10d, 0x78ca409e
je 0x140003704
add edx, r14d
jmp 0x1400036c6
mov ecx, dword [r9 + r8 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r9 + r8 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
mov rcx, rsi
add rax, r8
call rax
xor al, al
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret