Function at 0x140051200
Capabilities:
Allocate or change rwx memory
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf]
sub rsp, 0xd0
mov rdi, r9
mov r12, rcx
xor r14d, r14d
mov rcx, qword [rbp + 0x6f]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__msize]
mov qword [rbp - 0x41], rax
test eax, eax
jg 0x14005124d
xor al, al
jmp 0x14005173a
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
mov r13, r14
mov qword [rbp + 0x57], r14
mov qword [rbp - 0x71], r14
movdqu xmmword [rbp - 9], xmm0
mov qword [rbp + 7], r14
mov rbx, qword [rbp + 0x7f]
mov r10, qword [rbx + 0x10]
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x14005127f
mov rdx, qword [rbx]
movabs r9, 0xcbf29ce484222325
mov rcx, r14
test r10, r10
je 0x1400512b3
movabs r8, 0x100000001b3
nop dword [rax + rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r8
inc rcx
cmp rcx, r10
jb 0x1400512a0
mov r8, rbx
lea rdx, [rbp - 0x69]
call fcn.140059fd0
cmp qword [rax + 8], 0
je 0x140051316
mov r8, rbx
lea rdx, [rbp - 0x69]
call fcn.1400595d0
mov r8, qword [rax]
add r8, 0x30
lea rax, [rsp + 0x40]
cmp rax, r8
je 0x140051303
mov rdx, qword [r8]
mov r8, qword [r8 + 8]
sub r8, rdx
sar r8, 3
lea rcx, [rsp + 0x40]
call fcn.1400598e0
mov r13, qword [rbp - 0x71]
mov qword [rbp + 0x57], r13
lea rax, [r12 + 8]
mov qword [rsp + 0x30], rax
mov r14, qword [rbp - 0x79]
jmp 0x140051503
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__msize]
mov rsi, rax
mov rcx, r14
add r12, 8
mov qword [rsp + 0x30], r12
movabs r15, 0x7fffffffffff
mov r14, qword [rbp - 0x79]
nop dword [rax]
mov r9d, Ordinal_50
lea r8, [rbp - 0x39]
mov rdx, rcx
mov rcx, qword [r12]
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
cmp rax, 0x30
jne 0x1400514b7
cmp dword [rbp - 0x19], 0x1000
jne 0x1400514a6
mov eax, dword [rbp - 0x15]
bt eax, 8
jb 0x1400514a6
cmp eax, 1
je 0x1400514a6
cmp eax, 0x10
je 0x1400514a6
mov rcx, qword [rbp - 0x21]
call fcn.1400bdaac
mov rbx, rax
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x51]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp - 0x21]
mov r8, rbx
mov rdx, qword [rbp - 0x39]
mov rcx, qword [r12]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x14005149e
mov r8, rbx
mov rcx, qword [rbp - 0x51]
sub rcx, rsi
lea r9, [rbx + 1]
add r9, rcx
mov qword [rbp - 0x69], r9
lea r13, [rbx - 1]
add r13, rsi
mov r12, r13
lea r15, [rbx - 1]
add r15, qword [rbp - 0x51]
cmp rbx, r9
jae 0x14005148f
test rsi, rsi
je 0x14005141c
mov rcx, rdi
mov rdx, rbx
sub rdx, rdi
movzx eax, byte [rcx]
cmp al, 0x3f
je 0x14005140e
cmp al, byte [rdx + rcx]
jne 0x140051463
inc rcx
mov rax, rcx
sub rax, rdi
cmp rax, rsi
jb 0x140051402
mov rax, rbx
sub rax, r8
add rax, qword [rbp - 0x39]
mov qword [rbp - 0x49], rax
cmp r14, qword [rbp + 0x57]
je 0x14005143d
mov qword [r14], rax
add r14, 8
mov qword [rbp - 0x79], r14
jmp 0x140051463
lea r8, [rbp - 0x49]
mov rdx, r14
lea rcx, [rsp + 0x40]
call fcn.14005a3d0
mov rax, qword [rbp - 0x71]
mov qword [rbp + 0x57], rax
mov r14, qword [rbp - 0x79]
mov r8, qword [rsp + 0x38]
mov r9, qword [rbp - 0x69]
inc rbx
cmp rbx, r15
jb 0x140051481
add r12, 0x1000
add r15, 0x1000
cmp r12, r13
jae 0x14005148a
mov rbx, r13
cmp rbx, r9
jb 0x1400513f4
mov rbx, qword [rsp + 0x38]
movabs r15, 0x7fffffffffff
mov r12, qword [rsp + 0x30]
mov rcx, rbx
call fcn.1400bd9f4
mov rcx, qword [rbp - 0x21]
add rcx, qword [rbp - 0x39]
cmp rcx, r15
jb 0x140051340
mov r8, qword [rbp + 0x7f]
lea rdx, [rbp - 0x69]
call fcn.1400595d0
mov rcx, qword [rax]
add rcx, 0x30
lea rax, [rsp + 0x40]
cmp rcx, rax
je 0x1400514fb
mov r8, r14
mov r15, qword [rsp + 0x40]
sub r8, r15
sar r8, 3
mov rdx, r15
call fcn.1400598e0
mov qword [rsp + 0x30], r12
mov r13, qword [rbp + 0x57]
mov r12, qword [rbp + 0x4f]
jmp 0x140051508
mov r13, qword [rbp + 0x57]
mov r12, qword [rbp + 0x4f]
mov r15, qword [rsp + 0x40]
lea rdi, [r12 + 0x18]
mov r12, r14
sub r12, r15
sar r12, 3
mov rax, qword [rdi + 0x10]
sub rax, qword [rdi]
cmp r12, rax
jbe 0x140051541
movabs rax, 0x7fffffffffffffff
cmp r12, rax
ja 0x140051755
mov rdx, r12
mov rcx, rdi
call fcn.140058fd0
mov rbx, r15
cmp r15, r14
je 0x1400515b8
mov rsi, qword [rbp + 0x4f]
mov r13, qword [rsp + 0x30]
nop dword [rax]
nop word [rax + rax]
mov qword [rsp + 0x20], 0
mov r9d, 1
lea r8, [rsi + 0x17]
mov rdx, qword [rbx]
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1400515a6
mov rdx, qword [rdi + 8]
cmp rdx, qword [rdi + 0x10]
je 0x14005159a
movzx eax, byte [rsi + 0x17]
mov byte [rdx], al
inc qword [rdi + 8]
jmp 0x1400515a6
lea r8, [rsi + 0x17]
mov rcx, rdi
call fcn.14005a0b0
add rbx, 8
cmp rbx, r14
jne 0x140051560
mov r13, qword [rbp + 0x57]
cmp r15, r14
jne 0x1400515bf
xor bl, bl
jmp 0x1400516f1
xor edi, edi
test r12, r12
je 0x1400516ef
movsxd rsi, dword [rbp - 0x41]
mov rbx, r15
mov r14, qword [rsp + 0x30]
nop word [rax + rax]
mov rcx, qword [rbx]
lea r10, [rbp - 0x54]
test ecx, ecx
jns 0x140051630
neg ecx
nop dword [rax]
dec r10
mov eax, 0xcccccccd
mul ecx
shr edx, 3
movzx eax, dl
shl al, 2
lea r8d, [rax + rdx]
add r8b, r8b
sub cl, r8b
add cl, 0x30
mov byte [r10], cl
mov ecx, edx
test edx, edx
jne 0x1400515f0
dec r10
mov byte [r10], reloc.WLDAP32.dll_Ordinal_45
jmp 0x140051659
dec r10
mov eax, 0xcccccccd
mul ecx
shr edx, 3
movzx eax, dl
shl al, 2
lea r8d, [rax + rdx]
add r8b, r8b
sub cl, r8b
add cl, 0x30
mov byte [r10], cl
mov ecx, edx
test edx, edx
jne 0x140051630
lea r9, [rbp + 0x77]
lea r8, [rbp - 0x54]
mov rdx, r10
lea rcx, [rbp - 0x39]
call fcn.1400427a0
mov edx, dword [rbx]
lea rax, [rbp + 0x5f]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
mov r8, rsi
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov qword [rsp + 0x20], 0
mov r9, rsi
mov r8, qword [rbp + 0x6f]
mov rdx, qword [rbx]
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [rbp - 0x21]
cmp rdx, 0x10
jb 0x1400516dd
inc rdx
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400516d8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140051725
call fcn.1400bd9f4
inc edi
add rbx, 8
movsxd rax, edi
cmp rax, r12
jb 0x1400515e0
mov bl, 1
test r15, r15
je 0x140051737
sub r13, r15
and r13, 0xfffffffffffffff8
mov rax, r15
cmp r13, 0x1000
jb 0x14005172c
add r13, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005172c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rdx, r13
mov rcx, r15
call fcn.1400bd9f4
movzx eax, bl
mov rbx, qword [rsp + 0x128]
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140058fb0
nop
int3