Function at 0x1400164d0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using murmur2
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0xf0
mov qword [rsp + 0x120], rcx
lea rcx, [rsp + 0x70]
call fcn.140021100
mov rdi, rax
movsx ebx, byte [rax]
mov ecx, ebx
call fcn.140014160
add ebx, eax
cmp ebx, 0xfffffff0
jg 0x140016514
mov edx, 0x84
call fcn.140052d80
cmp ebx, 0xffffffb7
jg 0x140016523
mov edx, 0x9d
call fcn.140052d80
imul eax, ebx, 0x5bd1e995
lea r8, [rdi + 4]
mov r12d, 8
mov r9, r8
mov r10d, r12d
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul r11d, ecx, 0x5bd1e995
xor r13d, r13d
mov edx, r13d
nop dword [rax]
mov eax, edx
lea r9, [r9 + 4]
xor eax, r11d
add edx, 0x5bd1e995
imul ecx, eax, 0x286a90b9
xor ecx, 0xaa2a7357
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov dword [r9 - 4], eax
sub r10, 1
jne 0x140016550
mov r9d, dword [0x14018719c]
mov rdx, qword [rdi + 0x28]
call fcn.1400525a0
mov r15, rax
test rax, rax
jne 0x1400165b0
mov r15, r13
jmp 0x1400165f9
movzx eax, byte [rdi]
xor byte [r15], al
movzx eax, byte [rdi]
xor byte [r15 + 1], al
movzx eax, byte [rdi]
xor byte [r15 + 2], al
movzx eax, byte [rdi]
xor byte [r15 + 3], al
movzx eax, byte [rdi]
xor byte [r15 + 4], al
movzx eax, byte [rdi]
xor byte [r15 + 5], al
movzx eax, byte [rdi]
xor byte [r15 + 6], al
movzx eax, byte [rdi]
xor byte [r15 + 7], al
movzx eax, byte [rdi]
xor byte [r15 + 8], al
movzx eax, byte [rdi]
xor byte [r15 + 9], al
mov byte [r15 + 0xa], r13b
movdqa xmm0, xmmword [0x14016e150]
mov cl, 1
movsx ebx, cl
xor eax, eax
mov byte [rsp + 0x20], cl
mov ecx, ebx
movdqu xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x60], al
call fcn.140014160
add ebx, eax
cmp ebx, 0xfffffff0
jg 0x14001662e
mov edx, 0x84
call fcn.140052d80
cmp ebx, 0xffffffb7
jg 0x14001663d
mov edx, 0x9d
call fcn.140052d80
imul eax, ebx, 0x5bd1e995
lea r8, [rsp + 0x24]
mov edx, r13d
mov r9, r12
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul r10d, ecx, 0x5bd1e995
nop dword [rax]
mov eax, edx
lea r8, [r8 + 4]
xor eax, r10d
add edx, 0x5bd1e995
imul ecx, eax, 0x286a90b9
xor ecx, 0xaa2a7357
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov dword [r8 - 4], eax
sub r9, 1
jne 0x140016660
lea edx, [r9 + 0x18]
mov qword [0x140187190], r13
call fcn.140052d80
mov qword [0x140187190], rax
mov rbx, rax
test rax, rax
jne 0x1400166bd
mov rbx, r13
jmp 0x140016703
movups xmm0, xmmword [rsp + 0x50]
lea rcx, [rbx + 8]
mov dword [0x14018719c], 0x18
lea r9, [rsp + 0x24]
mov dword [0x140187198], 0x10
mov r8b, 1
mov dword [rax], 0x18
mov eax, dword [0x140187198]
mov dword [rbx + 4], eax
movups xmmword [rbx + 8], xmm0
mov edx, dword [0x14018719c]
add edx, 0xfffffff8
call fcn.140052470
mov qword [rsp + 0x48], rbx
movsx ebx, byte [rsp + 0x20]
mov ecx, ebx
call fcn.140014160
add ebx, eax
cmp ebx, 0xfffffff0
jg 0x140016725
mov edx, 0x84
call fcn.140052d80
cmp ebx, 0xffffffb7
jg 0x140016734
mov edx, 0x9d
call fcn.140052d80
imul eax, ebx, 0x5bd1e995
lea r8, [rsp + 0x24]
mov edx, r13d
mov r9, r12
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul r10d, ecx, 0x5bd1e995
nop dword [rax]
nop word [rax + rax]
mov eax, edx
lea r8, [r8 + 4]
xor eax, r10d
add edx, 0x5bd1e995
imul ecx, eax, 0x286a90b9
xor ecx, 0xaa2a7357
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov dword [r8 - 4], eax
sub r9, 1
jne 0x140016760
mov r9d, dword [0x14018719c]
lea r8, [rsp + 0x24]
mov rdx, qword [rsp + 0x48]
call fcn.1400525a0
mov rsi, rax
test rax, rax
jne 0x1400167bc
mov rsi, r13
jmp 0x1400167e1
movdqu xmm0, xmmword [rsi]
movsx eax, byte [rsp + 0x20]
movd xmm1, eax
punpcklbw xmm1, xmm1
punpcklwd xmm1, xmm1
pshufd xmm1, xmm1, 0
xorps xmm1, xmm0
movdqu xmmword [rsi], xmm1
mov byte [rsi + 0x10], r13b
mov rax, qword gs:[0x60]
mov qword [rsp + 0x128], rbp
mov qword [rsp + 0x130], r14
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rdi, qword [rax]
mov eax, 0x5a4d
cmp qword [rdi + 0x60], r13
je 0x1400168d9
nop dword [rax]
nop dword [rax + rax]
mov r11, qword [rdi + 0x30]
mov rdi, qword [rdi]
test r11, r11
je 0x1400168cf
cmp word [r11], ax
jne 0x1400168d9
movsxd rax, dword [r11 + 0x3c]
cmp dword [rax + r11], 0x4550
jne 0x1400168d9
mov ecx, dword [rax + r11 + 0x88]
test ecx, ecx
je 0x1400168d9
mov ebp, dword [r11 + rcx + 0x1c]
lea rax, [r11 + rcx]
mov r9d, dword [rax + 0x20]
add rbp, r11
mov r14d, dword [rax + 0x24]
add r9, r11
mov ebx, dword [rax + 0x18]
add r14, r11
mov r10d, r13d
test ebx, ebx
je 0x1400168ca
mov ecx, dword [r9]
xor dl, dl
add rcx, r11
cmp byte [rcx], dl
je 0x1400168be
mov r8, rsi
sub r8, rcx
movzx eax, byte [rcx + r8]
test al, al
je 0x1400168ba
cmp byte [rcx], al
jne 0x1400168be
inc rcx
mov dl, 1
cmp byte [rcx], r13b
jne 0x140016892
movsxd rax, r10d
movzx ecx, word [r14 + rax*2]
mov eax, dword [rbp + rcx*4]
add rax, r11
jmp 0x1400168dc
test dl, dl
jne 0x1400168a9
inc r10d
add r9, 4
cmp r10d, ebx
jb 0x140016880
mov eax, 0x5a4d
cmp qword [rdi + 0x60], r13
jne 0x140016820
mov rax, r13
mov rcx, r15
call rax
test rax, rax
jne 0x140016b91
lea rcx, [rsp + 0xb0]
call fcn.1400213b0
mov rdi, rax
movsx ebx, byte [rax]
mov ecx, ebx
call fcn.140014160
add ebx, eax
cmp ebx, 0xfffffff0
jg 0x140016915
mov edx, 0x84
call fcn.140052d80
cmp ebx, 0xffffffb7
jg 0x140016924
mov edx, 0x9d
call fcn.140052d80
imul eax, ebx, 0x5bd1e995
lea r8, [rdi + 4]
mov edx, r13d
mov r9, r8
mov r10, r12
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul r11d, ecx, 0x5bd1e995
nop word [rax + rax]
mov eax, edx
lea r9, [r9 + 4]
xor eax, r11d
add edx, 0x5bd1e995
imul ecx, eax, 0x286a90b9
xor ecx, 0xaa2a7357
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov dword [r9 - 4], eax
sub r10, 1
jne 0x140016950
mov r9d, dword [0x14018719c]
mov rdx, qword [rdi + 0x28]
call fcn.1400525a0
mov r15, rax
test rax, rax
jne 0x1400169b0
mov r15, r13
jmp 0x1400169f9
movzx eax, byte [rdi]
xor byte [r15], al
movzx eax, byte [rdi]
xor byte [r15 + 1], al
movzx eax, byte [rdi]
xor byte [r15 + 2], al
movzx eax, byte [rdi]
xor byte [r15 + 3], al
movzx eax, byte [rdi]
xor byte [r15 + 4], al
movzx eax, byte [rdi]
xor byte [r15 + 5], al
movzx eax, byte [rdi]
xor byte [r15 + 6], al
movzx eax, byte [rdi]
xor byte [r15 + 7], al
movzx eax, byte [rdi]
xor byte [r15 + 8], al
movzx eax, byte [rdi]
xor byte [r15 + 9], al
mov byte [r15 + 0xa], r13b
lea rcx, [rsp + 0x20]
call fcn.140021260
mov rbx, rax
movsx edi, byte [rax]
mov ecx, edi
call fcn.140014160
add edi, eax
cmp edi, 0xfffffff0
jg 0x140016a21
mov edx, 0x84
call fcn.140052d80
cmp edi, 0xffffffb7
jg 0x140016a30
mov edx, 0x9d
call fcn.140052d80
imul eax, edi, 0x5bd1e995
lea r8, [rbx + 4]
mov edx, r13d
mov r9, r8
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul r10d, ecx, 0x5bd1e995
nop
mov eax, edx
lea r9, [r9 + 4]
xor eax, r10d
add edx, 0x5bd1e995
imul ecx, eax, 0x286a90b9
xor ecx, 0xaa2a7357
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov dword [r9 - 4], eax
sub r12, 1
jne 0x140016a50
mov r9d, dword [0x14018719c]
mov rdx, qword [rbx + 0x28]
call fcn.1400525a0
mov rsi, rax
test rax, rax
jne 0x140016aa6
mov rsi, r13
jmp 0x140016ac3
mov rcx, rsi
mov edx, 0xc
nop
movzx eax, byte [rbx]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x140016ab0
mov byte [rsi + 0xc], r13b
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rdi, qword [rax]
cmp qword [rdi + 0x60], r13
je 0x140016b8b
mov r12d, 0x5a4d
nop word [rax + rax]
mov r11, qword [rdi + 0x30]
mov rdi, qword [rdi]
test r11, r11
je 0x140016bd6
cmp word [r11], r12w
jne 0x140016b8b
movsxd rax, dword [r11 + 0x3c]
cmp dword [rax + r11], 0x4550
jne 0x140016b8b
mov ecx, dword [rax + r11 + 0x88]
test ecx, ecx
je 0x140016b8b
mov ebp, dword [r11 + rcx + 0x1c]
lea rax, [r11 + rcx]
mov r9d, dword [rax + 0x20]
add rbp, r11
mov r14d, dword [rax + 0x24]
add r9, r11
mov ebx, dword [rax + 0x18]
add r14, r11
mov r10d, r13d
test ebx, ebx
je 0x140016bd6
nop dword [rax]
mov eax, dword [r9]
xor r8b, r8b
add rax, r11
cmp byte [rax], r8b
je 0x140016bc6
mov rdx, rsi
sub rdx, rax
movzx ecx, byte [rax + rdx]
test cl, cl
je 0x140016bc1
cmp byte [rax], cl
jne 0x140016bc6
inc rax
mov r8b, 1
cmp byte [rax], r13b
jne 0x140016b64
movsxd rax, r10d
movzx ecx, word [r14 + rax*2]
mov r13d, dword [rbp + rcx*4]
add r13, r11
mov rcx, r15
call r13
mov rax, qword [rsp + 0x120]
mov r14, qword [rsp + 0x130]
mov rbp, qword [rsp + 0x128]
mov rbx, qword [rsp + 0x138]
add rsp, 0xf0
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret
test r8b, r8b
jne 0x140016b7b
inc r10d
add r9, 4
cmp r10d, ebx
jb 0x140016b50
cmp qword [rdi + 0x60], r13
jne 0x140016af0
jmp 0x140016b8b