Function at 0x1400a9a10
Capabilities:
Access peb ldr_data
Encode data using xor
Get storage device properties
Hash data using fnv
Hash data with md5
Resolve function by fnv-1a hash
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x1f0
lea rbp, [rsp + 0x60]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x1404280e0]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov r13, rdx
mov qword [rbp], rdx
xor ecx, ecx
movabs rsi, 0xe6a6f249192436f4
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
movabs r15, 0xf55a8d3caf3d3b2d
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movdqa xmm0, xmmword [rbp + 0x80]
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp + 0x80], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], rcx
mov qword [rbp + 0x48], rcx
lea rax, [rbp + 0x80]
mov r14, 0xffffffffffffffff
mov r8, r14
inc r8
cmp byte [rax + r8], cl
jne 0x1400a9ad0
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x30]
call fcn.1400a23c0
nop
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov edi, dword [rcx + r9 + 0x88]
add rdi, r9
cmp rdi, r9
je 0x1400a9b73
mov r8d, dword [rdi + 0x18]
test r8d, r8d
je 0x1400a9b73
mov r11d, dword [rdi + 0x20]
nop word [rax + rax]
dec r8d
lea rcx, [r11 + r8*4]
mov edx, dword [rcx + r9]
add rdx, r9
mov ebx, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400a9b6e
nop dword [rax]
movsx ecx, cl
xor ecx, ebx
imul ebx, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400a9b50
cmp ebx, 0xbdcac9ce
je 0x1400a9b78
test r8d, r8d
jne 0x1400a9b30
mov rax, qword [rax]
jmp 0x1400a9b00
mov ecx, dword [rdi + 0x1c]
add rcx, r9
mov eax, dword [rdi + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov ebx, dword [rcx + rax*4]
add rbx, r9
movabs rax, 0x95df9a19450a6aa8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
movabs rax, 0x8333ff78c35c5844
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
movabs rax, 0xe85eb1f328003883
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd0], rax
movabs rcx, 0xdb7e31667aea1abf
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0xd8], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x160], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x168], rax
movabs rax, 0xe85eb1f3280008e6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x170], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x178], rax
vmovdqu ymm0, ymmword [rbp + 0xc0]
vpxor ymm1, ymm0, ymmword [rbp + 0x160]
vmovdqa ymmword [rbp + 0xc0], ymm1
xor esi, esi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor edx, edx
lea r8d, [rsi + 3]
lea rcx, [rbp + 0xc0]
vzeroupper
call rbx
mov r12, rax
cmp rax, 0xffffffffffffffff
jne 0x1400a9c99
movups xmm0, xmmword [rbp + 0x30]
movups xmmword [r13], xmm0
movups xmm1, xmmword [rbp + 0x40]
movups xmmword [r13 + 0x10], xmm1
jmp 0x1400aa5b0
mov qword [rbp + 0x74], rsi
mov dword [rbp + 0x70], esi
mov qword [rbp + 0x10], rsi
mov dword [rbp + 8], esi
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov edi, dword [rcx + r9 + 0x88]
add rdi, r9
cmp rdi, r9
je 0x1400a9d33
mov r8d, dword [rdi + 0x18]
test r8d, r8d
je 0x1400a9d33
mov r11d, dword [rdi + 0x20]
nop word [rax + rax]
dec r8d
lea rcx, [r11 + r8*4]
mov edx, dword [rcx + r9]
add rdx, r9
mov ebx, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400a9d2e
nop dword [rax]
movsx ecx, cl
xor ecx, ebx
imul ebx, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400a9d10
cmp ebx, 0xb04cce94
je 0x1400a9d38
test r8d, r8d
jne 0x1400a9cf0
mov rax, qword [rax]
jmp 0x1400a9cc0
mov ecx, dword [rdi + 0x1c]
add rcx, r9
mov eax, dword [rdi + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov eax, dword [rcx + rax*4]
add rax, r9
mov qword [rsp + 0x38], rsi
lea rcx, [rbp + 8]
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 8
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x20], rcx
mov r9d, reloc.WS2_32.dll_inet_ntoa
lea r8, [rbp + 0x70]
mov edx, 0x2d1400
mov rcx, r12
call rax
mov esi, dword [rbp + 0x14]
mov ecx, esi
call fcn.1402ff054
mov r15, rax
mov r8d, esi
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax]
mov r9, qword [rcx + 0x30]
movsxd rdx, dword [r9 + 0x3c]
mov edi, dword [rdx + r9 + 0x88]
add rdi, r9
cmp rdi, r9
je 0x1400a9e23
mov r8d, dword [rdi + 0x18]
test r8d, r8d
je 0x1400a9e23
mov r11d, dword [rdi + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r11 + r8*4]
mov edx, dword [rax + r9]
add rdx, r9
mov ebx, 0x811c9dc5
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x1400a9e1e
nop dword [rax]
movsx eax, al
xor eax, ebx
imul ebx, eax, 0x1000193
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
test al, al
jne 0x1400a9e00
cmp ebx, 0xb04cce94
je 0x1400a9e28
test r8d, r8d
jne 0x1400a9de0
mov rcx, qword [rcx]
jmp 0x1400a9db0
mov ecx, dword [rdi + 0x1c]
add rcx, r9
mov eax, dword [rdi + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov eax, dword [rcx + rax*4]
add rax, r9
xor edi, edi
mov qword [rsp + 0x38], rdi
lea rcx, [rbp + 8]
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
lea r9d, [rdi + 0xc]
lea r8, [rbp + 0x70]
mov edx, 0x2d1400
mov rcx, r12
call rax
mov eax, dword [r15 + 0x18]
test eax, eax
je 0x1400a9f14
lea rdx, [r15 + rax]
xorps xmm0, xmm0
movups xmmword [rbp + 0x160], xmm0
mov qword [rbp + 0x170], rdi
mov qword [rbp + 0x178], rdi
mov r8, r14
inc r8
cmp byte [rdx + r8], dil
jne 0x1400a9e95
lea rcx, [rbp + 0x160]
call fcn.1400a23c0
nop
lea rdx, [rbp + 0x160]
cmp qword [rbp + 0x178], 0x10
cmovae rdx, qword [rbp + 0x160]
mov r8, qword [rbp + 0x170]
lea rcx, [rbp + 0x30]
call fcn.1400a0920
nop
mov rdx, qword [rbp + 0x178]
cmp rdx, 0x10
jb 0x1400a9f14
inc rdx
mov rcx, qword [rbp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a9f0f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400aa02d
call fcn.1402fecf0
mov eax, dword [r15 + 0x14]
test eax, eax
je 0x1400a9f8b
lea rdx, [r15 + rax]
xorps xmm0, xmm0
movups xmmword [rbp + 0x160], xmm0
mov qword [rbp + 0x170], rdi
mov qword [rbp + 0x178], rdi
mov r8, r14
nop dword [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x1400a9f40
lea rcx, [rbp + 0x160]
call fcn.1400a23c0
nop
lea rdx, [rbp + 0x160]
cmp qword [rbp + 0x178], 0x10
cmovae rdx, qword [rbp + 0x160]
mov r8, qword [rbp + 0x170]
lea rcx, [rbp + 0x30]
call fcn.1400a0920
nop
lea rcx, [rbp + 0x160]
call fcn.1400a1430
mov eax, dword [r15 + 0x10]
test eax, eax
je 0x1400aa039
lea rdx, [r15 + rax]
xorps xmm0, xmm0
movups xmmword [rbp + 0x160], xmm0
mov qword [rbp + 0x170], rdi
mov qword [rbp + 0x178], rdi
inc r14
cmp byte [rdx + r14], 0
jne 0x1400a9fb3
mov r8, r14
lea rcx, [rbp + 0x160]
call fcn.1400a23c0
nop
lea rdx, [rbp + 0x160]
cmp qword [rbp + 0x178], 0x10
cmovae rdx, qword [rbp + 0x160]
mov r8, qword [rbp + 0x170]
lea rcx, [rbp + 0x30]
call fcn.1400a0920
nop
mov rdx, qword [rbp + 0x178]
cmp rdx, 0x10
jb 0x1400aa039
inc rdx
mov rcx, qword [rbp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400aa034
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400aa034
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1402fecf0
xor eax, eax
xor ecx, ecx
cpuid
mov dword [rbp + 0x50], eax
mov dword [rbp + 0x54], ebx
mov dword [rbp + 0x58], ecx
mov dword [rbp + 0x5c], edx
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
mov qword [rbp + 0xa0], rdi
mov ebx, reloc.WS2_32.dll_ntohs
mov qword [rbp + 0xa8], rbx
mov byte [rbp + 0x90], 0
movups xmmword [rbp + 0x160], xmm0
mov qword [rbp + 0x170], rdi
mov qword [rbp + 0x178], rdi
lea r8d, [rbx - 0xb]
lea rdx, [rbp + 0x54]
lea rcx, [rbp + 0x160]
call fcn.1400a23c0
nop
lea rdx, [rbp + 0x160]
cmp qword [rbp + 0x178], 0x10
cmovae rdx, qword [rbp + 0x160]
mov r8, qword [rbp + 0x170]
lea rcx, [rbp + 0x90]
call fcn.1400a0920
nop
mov rdx, qword [rbp + 0x178]
cmp rdx, 0x10
jb 0x1400aa105
inc rdx
mov rcx, qword [rbp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400aa100
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400aa2fb
call fcn.1402fecf0
xorps xmm0, xmm0
movups xmmword [rbp + 0x160], xmm0
mov qword [rbp + 0x170], rdi
mov qword [rbp + 0x178], rdi
mov r8d, 4
lea rdx, [rbp + 0x5c]
lea rcx, [rbp + 0x160]
call fcn.1400a23c0
nop
lea rdx, [rbp + 0x160]
cmp qword [rbp + 0x178], 0x10
cmovae rdx, qword [rbp + 0x160]
mov r8, qword [rbp + 0x170]
lea rcx, [rbp + 0x90]
call fcn.1400a0920
nop
mov rdx, qword [rbp + 0x178]
cmp rdx, 0x10
jb 0x1400aa1a0
inc rdx
mov rcx, qword [rbp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400aa19b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400aa2fb
call fcn.1402fecf0
xorps xmm0, xmm0
movups xmmword [rbp + 0x160], xmm0
mov qword [rbp + 0x170], rdi
mov qword [rbp + 0x178], rdi
mov r8d, 4
lea rdx, [rbp + 0x58]
lea rcx, [rbp + 0x160]
call fcn.1400a23c0
nop
lea rdx, [rbp + 0x160]
cmp qword [rbp + 0x178], 0x10
cmovae rdx, qword [rbp + 0x160]
mov r8, qword [rbp + 0x170]
lea rcx, [rbp + 0x90]
call fcn.1400a0920
nop
mov rdx, qword [rbp + 0x178]
cmp rdx, 0x10
jb 0x1400aa23b
inc rdx
mov rcx, qword [rbp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400aa236
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400aa2fb
call fcn.1402fecf0
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], rdi
mov qword [rbp + 0x68], rdi
mov rsi, qword [rbp + 0xa0]
lea r14, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0x10
cmovae r14, qword [rbp + 0x90]
movabs rax, 0x7fffffffffffffff
cmp rsi, rax
ja 0x1400aa5e3
mov qword [rbp + 0x68], rbx
cmp rsi, 0x10
jae 0x1400aa29b
mov qword [rbp + 0x60], rsi
movups xmm0, xmmword [r14]
movups xmmword [rbp + 0x50], xmm0
movq rdi, xmm0
jmp 0x1400aa32b
mov rbx, rsi
or rbx, 0xf
cmp rbx, rax
jbe 0x1400aa2d3
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1402fecf8
test rax, rax
je 0x1400aa2fb
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400aa30f
mov eax, reloc.WS2_32.dll_shutdown
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400aa302
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400aa5e9
jmp 0x1400aa2b8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x1400aa30f
call fcn.1402fecf8
mov rdi, rax
mov qword [rbp + 0x50], rdi
mov qword [rbp + 0x60], rsi
mov qword [rbp + 0x68], rbx
lea r8, [rsi + 1]
mov rdx, r14
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
nop
lea rdx, [rbp + 0x50]
cmp rbx, 0x10
cmovae rdx, rdi
mov r8, rsi
lea rcx, [rbp + 0x30]
call fcn.1400a0920
nop
lea rcx, [rbp + 0x50]
call fcn.1400a1430
lea rax, [rbp + 0x30]
mov r10, qword [rbp + 0x30]
mov r11, qword [rbp + 0x48]
mov rdi, qword [rbp + 0x40]
cmp r11, 0x10
jb 0x1400aa370
lea rax, [r10 + rdi]
lea rcx, [r10 + rdi]
mov rbx, r10
jmp 0x1400aa37e
add rax, rdi
lea rcx, [rbp + 0x30]
add rcx, rdi
lea rbx, [rbp + 0x30]
mov r9, rax
cmp rbx, rcx
je 0x1400aa3da
nop word [rax + rax]
movsx edx, byte [rbx]
add edx, 0xffffffdf
cmp edx, 0x5d
ja 0x1400aa3a3
inc rbx
cmp rbx, rcx
jne 0x1400aa390
cmp rbx, rcx
je 0x1400aa3da
lea r8, [rbx + 1]
cmp r8, rcx
je 0x1400aa3da
movsx r10d, byte [r8]
mov edx, r10d
add edx, 0xffffffdf
cmp edx, 0x5d
ja 0x1400aa3c6
mov byte [rbx], r10b
inc rbx
inc r8
cmp r8, rcx
jne 0x1400aa3b1
mov r11, qword [rbp + 0x48]
mov rdi, qword [rbp + 0x40]
mov r10, qword [rbp + 0x30]
lea rcx, [rbp + 0x30]
mov rdx, rbx
cmp r11, 0x10
jb 0x1400aa3ec
sub rdx, r10
jmp 0x1400aa3f6
sub rdx, rcx
mov r9, rax
lea r10, [rbp + 0x30]
mov rax, rdi
sub r9, rbx
sub rax, rdx
cmp rax, r9
cmovb r9, rax
lea rcx, [r10 + rdx]
sub rdi, r9
mov r8, rdi
sub r8, rdx
inc r8
lea rdx, [rcx + r9]
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp + 0x40], rdi
mov rcx, r15
call fcn.1402fecf0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov edi, dword [rcx + r9 + 0x88]
add rdi, r9
cmp rdi, r9
je 0x1400aa4b3
mov r8d, dword [rdi + 0x18]
test r8d, r8d
je 0x1400aa4b3
mov r11d, dword [rdi + 0x20]
nop word [rax + rax]
dec r8d
lea rcx, [r9 + r8*4]
mov ecx, dword [rcx + r11]
add rcx, r9
mov ebx, 0x811c9dc5
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1400aa4ae
nop dword [rax]
movsx edx, dl
xor edx, ebx
imul ebx, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x1400aa490
cmp ebx, 0xfaba0065
je 0x1400aa4b8
test r8d, r8d
jne 0x1400aa470
mov rax, qword [rax]
jmp 0x1400aa440
mov ecx, dword [rdi + 0x1c]
add rcx, r9
mov eax, dword [rdi + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov edx, dword [rcx + rax*4]
add rdx, r9
mov rcx, r12
call rdx
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0xc0]
call fcn.1400a09f0
mov rbx, rax
mov qword [rbp], rax
mov byte [rbp + 0xe0], 0
xor ecx, ecx
mov qword [rbp + 0x124], rcx
mov dword [rbp + 0x12c], 0x67452301
mov dword [rbp + 0x130], 0xefcdab89
mov dword [rbp + 0x134], 0x98badcfe
mov dword [rbp + 0x138], 0x10325476
mov rdx, rax
cmp qword [rax + 0x18], 0x10
jb 0x1400aa530
mov rdx, qword [rax]
mov r8d, dword [rax + 0x10]
lea rcx, [rbp + 0xe0]
call fcn.1400ac2c0
lea rcx, [rbp + 0xe0]
call fcn.1400ac390
mov rdx, r13
lea rcx, [rbp + 0xe0]
call fcn.1400ac600
nop
mov rcx, rbx
call fcn.1400a1430
nop
lea rcx, [rbp + 0x90]
call fcn.1400a1430
nop
mov rdx, qword [rbp + 0x48]
cmp rdx, 0x10
jb 0x1400aa5b0
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400aa5ab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400aa5ab
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1402fecf0
mov rax, r13
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.1402fecd0
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14009a190
nop
call fcn.14009a0f0
int3