Function at 0x140011560
Capabilities:
Access peb ldr_data
Check for software breakpoints
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x180
lea rbp, [rsp + 0x50]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x14002b040]
xor rax, rsp
mov qword [rbp + 0x120], rax
call fcn.14000fd30
call fcn.14000ce40
call fcn.140007b10
movabs rsi, 0x22d4c437636b1eec
movabs rbx, 0x6c202038277432eb
movabs r15, 0x3ef99c5d4ee9c59
movabs r12, 0x5d00541507071fcb
movabs r14, 0x568121ceac43e0ad
movabs r13, 0x6d98f6a1a09bf42a
test al, al
je 0x140011725
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
vmovdqu ymm0, ymmword [rbp + 0xa0]
vpxor ymm1, ymm0, ymmword [rbp + 0x40]
vmovdqa ymmword [rbp + 0x40], ymm1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
vzeroupper
nop
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400116f7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400116f7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x2890261e
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rdi]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400116f2
nop dword [rax]
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x1400116d0
cmp r8d, 0xee700241
je 0x1400116fc
test r9d, r9d
jne 0x1400116b0
mov rax, qword [rax]
jmp 0x140011680
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor edx, edx
add rax, r10
lea rcx, [rbp + 0x40]
call rax
movabs rbx, 0x6c202038277432eb
call fcn.140004dd0
test al, al
je 0x14001186b
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x70], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0xd0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0xd8], rax
vmovdqu ymm0, ymmword [rbp + 0xc0]
vpxor ymm1, ymm0, ymmword [rbp + 0x60]
vmovdqa ymmword [rbp + 0x60], ymm1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
vzeroupper
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140011847
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140011847
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x549e3ef6
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140011842
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x140011820
cmp r8d, 0x716c6099
je 0x14001184c
test r9d, r9d
jne 0x140011800
mov rax, qword [rax]
jmp 0x1400117d0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor edx, edx
add rax, r10
lea rcx, [rbp + 0x60]
call rax
call fcn.1400112a0
test al, al
je 0x1400119bb
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
movabs rax, 0x6c202038277432eb
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0xf0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
vmovdqu ymm0, ymmword [rbp + 0xe0]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
vzeroupper
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140011997
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140011997
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x35ebfd11
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140011992
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x140011970
cmp r8d, 0x81e43a04
je 0x14001199c
test r9d, r9d
jne 0x140011950
mov rax, qword [rax]
jmp 0x140011920
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor edx, edx
add rax, r10
lea rcx, [rbp + 0x20]
call rax
call fcn.1400103f0
call fcn.140004590
call fcn.1400069d0
call fcn.140008100
call fcn.14000ae00
call fcn.14000fab0
call fcn.1400074b0
call fcn.140007620
call fcn.140007dc0
mov rbx, qword [rsp + 0x1a8]
cmp byte [rbx], 0xcc
jne 0x140011a31
mov edx, 1
lea r9, [rbp + 0x84]
mov rcx, rbx
lea r8d, [rdx + 0x3f]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x140011a31
mov r8d, dword [rbp + 0x84]
lea r9, [rbp + 0x84]
mov edx, 1
mov byte [rbx], 0x90
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call fcn.1400073c0
movzx ecx, byte [0x1402aeae8]
movabs rax, 0xcbf29ce484222325
xor rcx, rax
movabs rdx, 0x100000001b3
movzx eax, byte [0x1402aeae9]
imul rcx, rdx
xor rcx, rax
imul rcx, rdx
mov qword [0x1402af668], rcx
rdtsc
shl rdx, 0x20
or rax, rdx
mov rdx, qword [0x1402af880]
mov rcx, rax
test rdx, rdx
jne 0x140011a8e
mov qword [0x1402af880], rax
jmp 0x140011ab2
sub rax, rdx
movabs rdx, 0x8000000000
and rax, 0xffffffff80000000
cmp rax, rdx
jbe 0x140011ab2
mov qword [0x1402af880], rcx
call fcn.1400044b0
call fcn.1400076d0
test al, al
je 0x140011bfb
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
movabs rax, 0x6c202038277432eb
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x108], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x110], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x118], rax
vmovdqu ymm0, ymmword [rbp + 0x100]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
vzeroupper
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140011bd7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140011bd7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xfe10282d
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140011bd2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x140011bb0
cmp r8d, 0xf64dc0f8
je 0x140011bdc
test r9d, r9d
jne 0x140011b90
mov rax, qword [rax]
jmp 0x140011b60
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor edx, edx
add rax, r10
lea rcx, [rbp + 0x20]
call rax
mov rbx, qword [rsp + 0x1a8]
mov byte [rbp + 0x80], 0x90
cmp byte [rbx], 0xcc
jne 0x140011c70
mov edx, 1
lea r9, [rbp + 0x88]
mov rcx, rbx
lea r8d, [rdx + 0x3f]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x140011c70
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 1
mov qword [rsp + 0x20], 0
mov rcx, rax
lea r8, [rbp + 0x80]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r8d, dword [rbp + 0x88]
lea r9, [rbp + 0x88]
mov edx, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0x120]
xor rcx, rsp
call fcn.140017750
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret