Function at 0x140001ca0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
movaps xmmword [rax - 0x18], xmm6
mov rax, qword [0x140007040]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rax, qword gs:[0x58]
movdqa xmm6, xmmword [0x1400052a0]
mov edx, 4
mov dword [rbp + 0x27], 0xbb01d528
mov rcx, qword [rax]
mov word [rbp + 0x2b], 0xbfc9
mov eax, dword [rdx + rcx]
cmp dword [0x140007748], eax
jle 0x140001d4f
lea rcx, [0x140007748]
call fcn.1400031fc
cmp dword [0x140007748], 0xffffffff
jne 0x140001d4f
mov eax, dword [rbp + 0x27]
lea rcx, [0x140004070]
mov dword [0x140007708], eax
movzx eax, word [rbp + 0x2b]
mov word [0x14000770c], ax
mov word [0x14000770e], 0x163
movups xmmword [0x1400076f8], xmm6
call fcn.14000349c
lea rcx, [0x140007748]
call fcn.140003190
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140001dd7
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140001dd7
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xce334546
lea rcx, [rbx + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140001dd2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x140001db0
cmp r8d, 0xc308bc28
je 0x140001ddc
test r9d, r9d
jne 0x140001d90
mov rax, qword [rax]
jmp 0x140001d60
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
cmp byte [0x14000770f], 0
je 0x140001ea8
xor byte [0x1400076f8], 0x5d
xor byte [0x1400076f9], 0xa5
xor byte [0x1400076fa], 0x2f
xor byte [0x1400076fb], 0xdf
xor byte [0x1400076fc], 0xa5
xor byte [0x1400076fd], 0xd3
xor byte [0x1400076fe], 0x63
xor byte [0x1400076ff], 0xdb
xor byte [0x140007700], 0x5d
xor byte [0x140007701], 0xa5
xor byte [0x140007702], 0x2f
xor byte [0x140007703], 0xdf
xor byte [0x140007704], 0xa5
xor byte [0x140007705], 0xd3
xor byte [0x140007706], 0x63
xor byte [0x140007707], 0xdb
xor byte [0x140007708], 0x5d
xor byte [0x140007709], 0xa5
xor byte [0x14000770a], 0x2f
xor byte [0x14000770b], 0xdf
xor byte [0x14000770c], 0xa5
xor byte [0x14000770d], 0xd3
xor byte [0x14000770e], 0x63
mov byte [0x14000770f], 0
lea rcx, [0x1400076f8]
call rax
mov rsi, rax
test rax, rax
jne 0x1400026da
mov dword [rbp - 0x38], eax
xor edx, edx
mov byte [rbp - 0x34], al
mov word [rbp + 0x14], 0x72
mov dword [rbp + 0xf], 0x7206ae72
mov byte [rbp + 0x13], 0xff
nop word [rax + rax]
movzx eax, byte [rbp + rdx + 0x10]
movzx ecx, byte [rbp + rdx + 0xf]
mov byte [rbp + rdx + 0xf], al
mov byte [rbp + rdx + 0x10], cl
add rdx, 2
cmp rdx, 6
jb 0x140001ee0
movzx eax, byte [rbp + 0xf]
xor r10b, r10b
not al
movzx r9d, al
shr al, 1
and r9b, 0xd5
and al, 0x55
add r9b, r9b
or r9b, al
xor r8d, r8d
lea edx, [r8 + 7]
nop
movzx ecx, r8b
movzx eax, r9b
shr al, cl
inc r8d
and al, 1
mov ecx, edx
shl al, cl
dec edx
or r10b, al
cmp edx, 0xffffffff
jg 0x140001f20
movzx eax, byte [rbp + 0x10]
not al
mov byte [rbp - 0x39], r10b
movzx r9d, al
xor r10b, r10b
and r9b, 0xd5
shr al, 1
add r9b, r9b
and al, 0x55
or r9b, al
xor r8d, r8d
lea edx, [r8 + 7]
nop dword [rax]
nop word [rax + rax]
movzx ecx, r8b
movzx eax, r9b
shr al, cl
inc r8d
and al, 1
mov ecx, edx
shl al, cl
dec edx
or r10b, al
cmp edx, 0xffffffff
jg 0x140001f70
movzx eax, byte [rbp + 0x11]
not al
mov byte [rbp - 0x38], r10b
movzx r9d, al
xor r10b, r10b
and r9b, 0xd5
shr al, 1
add r9b, r9b
and al, 0x55
or r9b, al
xor r8d, r8d
lea edx, [r8 + 7]
nop dword [rax]
nop word [rax + rax]
movzx ecx, r8b
movzx eax, r9b
shr al, cl
inc r8d
and al, 1
mov ecx, edx
shl al, cl
dec edx
or r10b, al
cmp edx, 0xffffffff
jg 0x140001fc0
movzx eax, byte [rbp + 0x12]
not al
mov byte [rbp - 0x37], r10b
movzx r9d, al
xor r10b, r10b
and r9b, 0xd5
shr al, 1
add r9b, r9b
and al, 0x55
or r9b, al
xor r8d, r8d
lea edx, [r8 + 7]
nop dword [rax]
nop word [rax + rax]
movzx ecx, r8b
movzx eax, r9b
shr al, cl
inc r8d
and al, 1
mov ecx, edx
shl al, cl
dec edx
or r10b, al
cmp edx, 0xffffffff
jg 0x140002010
movzx eax, byte [rbp + 0x13]
not al
mov byte [rbp - 0x36], r10b
movzx r9d, al
xor r10b, r10b
and r9b, 0xd5
shr al, 1
add r9b, r9b
and al, 0x55
or r9b, al
xor r8d, r8d
lea edx, [r8 + 7]
nop dword [rax]
nop word [rax + rax]
movzx ecx, r8b
movzx eax, r9b
shr al, cl
inc r8d
and al, 1
mov ecx, edx
shl al, cl
dec edx
or r10b, al
cmp edx, 0xffffffff
jg 0x140002060
movzx eax, byte [rbp + 0x14]
not al
mov byte [rbp - 0x35], r10b
movzx r9d, al
xor r10b, r10b
and r9b, 0xd5
shr al, 1
add r9b, r9b
and al, 0x55
or r9b, al
xor r8d, r8d
lea edx, [r8 + 7]
nop dword [rax]
nop word [rax + rax]
movzx ecx, r8b
movzx eax, r9b
shr al, cl
inc r8d
and al, 1
mov ecx, edx
shl al, cl
dec edx
or r10b, al
cmp edx, 0xffffffff
jg 0x1400020b0
movdqa xmm1, xmmword [0x1400052c0]
xor eax, eax
xorps xmm0, xmm0
mov qword [rbp - 0x21], rax
movups xmmword [rbp - 0x31], xmm0
mov word [rbp - 0x19], ax
xor edx, edx
mov byte [rbp - 0x17], al
mov byte [rbp + 0x31], al
mov dword [rbp - 1], 0x963e46e2
mov dword [rbp + 3], 0xb6e2d6a6
movsd xmm0, qword [rbp - 1]
mov word [rbp + 7], 0x47ff
movzx eax, word [rbp + 7]
movsd qword [rbp + 0x27], xmm0
mov word [rbp + 0x2f], ax
mov byte [rbp - 0x34], r10b
mov byte [rbp - 0x33], 0
movups xmmword [rbp + 0x17], xmm1
movzx eax, byte [rbp + rdx + 0x18]
movzx ecx, byte [rbp + rdx + 0x17]
mov byte [rbp + rdx + 0x17], al
mov byte [rbp + rdx + 0x18], cl
add rdx, 2
cmp rdx, 0x1a
jb 0x140002120
xor r11d, r11d
nop
movzx eax, byte [rbp + r11 + 0x17]
xor r10b, r10b
not al
movzx r9d, al
shr al, 1
and r9b, 0xd5
and al, 0x55
add r9b, r9b
or r9b, al
xor r8d, r8d
lea edx, [r8 + 7]
nop dword [rax]
nop dword [rax + rax]
movzx ecx, r8b
movzx eax, r9b
shr al, cl
inc r8d
and al, 1
mov ecx, edx
shl al, cl
dec edx
or r10b, al
cmp edx, 0xffffffff
jg 0x140002170
movzx eax, byte [rbp + r11 + 0x18]
xor r9b, r9b
mov byte [rbp + r11 - 0x31], r10b
not al
movzx r10d, al
shr al, 1
and r10b, 0xd5
and al, 0x55
add r10b, r10b
or r10b, al
xor r8d, r8d
lea edx, [r8 + 7]
nop word [rax + rax]
movzx ecx, r8b
movzx eax, r10b
shr al, cl
inc r8d
and al, 1
mov ecx, edx
shl al, cl
dec edx
or r9b, al
cmp edx, 0xffffffff
jg 0x1400021c0
movzx eax, byte [rbp + r11 + 0x19]
not al
mov byte [rbp + r11 - 0x30], r9b
movzx r10d, al
xor r9b, r9b
and r10b, 0xd5
shr al, 1
add r10b, r10b
and al, 0x55
or r10b, al
xor r8d, r8d
lea edx, [r8 + 7]
nop word [rax + rax]
movzx ecx, r8b
movzx eax, r10b
shr al, cl
inc r8d
and al, 1
mov ecx, edx
shl al, cl
dec edx
or r9b, al
cmp edx, 0xffffffff
jg 0x140002210
movzx eax, byte [rbp + r11 + 0x1a]
not al
mov byte [rbp + r11 - 0x2f], r9b
movzx r10d, al
xor r9b, r9b
and r10b, 0xd5
shr al, 1
add r10b, r10b
and al, 0x55
or r10b, al
xor r8d, r8d
lea edx, [r8 + 7]
nop word [rax + rax]
movzx ecx, r8b
movzx eax, r10b
shr al, cl
inc r8d
and al, 1
mov ecx, edx
shl al, cl
dec edx
or r9b, al
cmp edx, 0xffffffff
jg 0x140002260
movzx eax, byte [rbp + r11 + 0x1b]
not al
mov byte [rbp + r11 - 0x2e], r9b
movzx r10d, al
xor r9b, r9b
and r10b, 0xd5
shr al, 1
add r10b, r10b
and al, 0x55
or r10b, al
xor r8d, r8d
lea edx, [r8 + 7]
nop word [rax + rax]
movzx ecx, r8b
movzx eax, r10b
shr al, cl
inc r8d
and al, 1
mov ecx, edx
shl al, cl
dec edx
or r9b, al
cmp edx, 0xffffffff
jg 0x1400022b0
movzx eax, byte [rbp + r11 + 0x1c]
not al
mov byte [rbp + r11 - 0x2d], r9b
movzx r10d, al
xor r9b, r9b
and r10b, 0xd5
shr al, 1
add r10b, r10b
and al, 0x55
or r10b, al
xor r8d, r8d
lea edx, [r8 + 7]
nop word [rax + rax]
movzx ecx, r8b
movzx eax, r10b
shr al, cl
inc r8d
and al, 1
mov ecx, edx
shl al, cl
dec edx
or r9b, al
cmp edx, 0xffffffff
jg 0x140002300
movzx eax, byte [rbp + r11 + 0x1d]
not al
mov byte [rbp + r11 - 0x2c], r9b
movzx r10d, al
xor r9b, r9b
and r10b, 0xd5
shr al, 1
add r10b, r10b
and al, 0x55
or r10b, al
xor r8d, r8d
lea edx, [r8 + 7]
nop word [rax + rax]
movzx ecx, r8b
movzx eax, r10b
shr al, cl
inc r8d
and al, 1
mov ecx, edx
shl al, cl
dec edx
or r9b, al
cmp edx, 0xffffffff
jg 0x140002350
movzx eax, byte [rbp + r11 + 0x1e]
not al
mov byte [rbp + r11 - 0x2b], r9b
movzx r10d, al
xor r9b, r9b
and r10b, 0xd5
shr al, 1
add r10b, r10b
and al, 0x55
or r10b, al
xor r8d, r8d
lea edx, [r8 + 7]
nop word [rax + rax]
movzx ecx, r8b
movzx eax, r10b
shr al, cl
inc r8d
and al, 1
mov ecx, edx
shl al, cl
dec edx
or r9b, al
cmp edx, 0xffffffff
jg 0x1400023a0
movzx eax, byte [rbp + r11 + 0x1f]
not al
mov byte [rbp + r11 - 0x2a], r9b
movzx r10d, al
xor r9b, r9b
and r10b, 0xd5
shr al, 1
add r10b, r10b
and al, 0x55
or r10b, al
xor r8d, r8d
lea edx, [r8 + 7]
nop word [rax + rax]
movzx ecx, r8b
movzx eax, r10b
shr al, cl
inc r8d
and al, 1
mov ecx, edx
shl al, cl
dec edx
or r9b, al
cmp edx, 0xffffffff
jg 0x1400023f0
movzx eax, byte [rbp + r11 + 0x20]
not al
mov byte [rbp + r11 - 0x29], r9b
movzx r10d, al
xor r9b, r9b
and r10b, 0xd5
shr al, 1
add r10b, r10b
and al, 0x55
or r10b, al
xor r8d, r8d
lea edx, [r8 + 7]
nop word [rax + rax]
movzx ecx, r8b
movzx eax, r10b
shr al, cl
inc r8d
and al, 1
mov ecx, edx
shl al, cl
dec edx
or r9b, al
cmp edx, 0xffffffff
jg 0x140002440
movzx eax, byte [rbp + r11 + 0x21]
xor r10b, r10b
mov byte [rbp + r11 - 0x28], r9b
not al
movzx r9d, al
shr al, 1
and r9b, 0xd5
and al, 0x55
add r9b, r9b
or r9b, al
xor r8d, r8d
lea edx, [r8 + 7]
nop word [rax + rax]
movzx ecx, r8b
movzx eax, r9b
shr al, cl
inc r8d
and al, 1
mov ecx, edx
shl al, cl
dec edx
or r10b, al
cmp edx, 0xffffffff
jg 0x140002490
movzx eax, byte [rbp + r11 + 0x22]
not al
mov byte [rbp + r11 - 0x27], r10b
movzx r9d, al
xor r10b, r10b
and r9b, 0xd5
shr al, 1
add r9b, r9b
and al, 0x55
or r9b, al
xor r8d, r8d
lea edx, [r8 + 7]
nop word [rax + rax]
movzx ecx, r8b
movzx eax, r9b
shr al, cl
inc r8d
and al, 1
mov ecx, edx
shl al, cl
dec edx
or r10b, al
cmp edx, 0xffffffff
jg 0x1400024e0
movzx eax, byte [rbp + r11 + 0x23]
xor r9b, r9b
mov byte [rbp + r11 - 0x26], r10b
not al
movzx r10d, al
shr al, 1
and r10b, 0xd5
and al, 0x55
add r10b, r10b
or r10b, al
xor r8d, r8d
lea edx, [r8 + 7]
nop word [rax + rax]
movzx ecx, r8b
movzx eax, r10b
shr al, cl
inc r8d
and al, 1
mov ecx, edx
shl al, cl
dec edx
or r9b, al
cmp edx, 0xffffffff
jg 0x140002530
mov byte [rbp + r11 - 0x25], r9b
add r11, 0xd
cmp r11, 0x1a
jb 0x140002140
mov byte [rbp - 0x17], 0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400025f7
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400025f7
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x2d0854aa
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400025f2
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x1400025d0
cmp r8d, 0xd6030ded
je 0x1400025fc
test r9d, r9d
jne 0x1400025b0
mov rax, qword [rax]
jmp 0x140002580
mov ecx, dword [rdi + 0x24]
lea r8, [rbp - 0x39]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov r9d, 0x10
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rdx, [rbp - 0x31]
add rax, r10
xor ecx, ecx
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400026b7
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400026b7
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x9c02f339
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400026b2
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x140002690
cmp r8d, 0x55ff860a
je 0x1400026bc
test r9d, r9d
jne 0x140002670
mov rax, qword [rax]
jmp 0x140002640
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
mov rax, rsi
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140003170
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop rbp
ret