Function at 0x140042d70
Capabilities:
Access peb ldr_data
Create thread
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x100
movaps xmmword [rax - 0x28], xmm6
mov rax, qword [0x1400cb060]
xor rax, rsp
mov qword [rbp + 0x27], rax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.ExitProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.DbgUiRemoteBreakin
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.DbgBreakPoint
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp - 0x29]
mov edx, 6
lea r8d, [rdx + 0x3a]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [rbx], 0x68
mov qword [rbx + 1], rsi
mov byte [rbx + 5], 0xc3
lea r9, [rbp - 0x29]
mov r8d, dword [rbp - 0x29]
mov edx, 6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea r9, [rbp - 0x29]
mov edx, 6
lea r8d, [rdx + 0x3a]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [rdi], 0x68
mov qword [rdi + 1], rsi
mov byte [rdi + 5], 0xc3
lea r9, [rbp - 0x29]
mov r8d, dword [rbp - 0x29]
mov edx, 6
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
xor r12d, r12d
mov qword [rbp + 7], r12
lea ecx, [r12 + 0x18]
call fcn.1400a527c
mov qword [rbp - 0x29], rax
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rax], xmm0
mov qword [rax + 0x10], rcx
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rbp - 0x79], r12
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.140041140
mov rbx, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0xf], xmm0
mov qword [rbp + 0x1f], rax
lea rdx, [rbp + 0xf]
mov rcx, rbx
call fcn.140040fd0
nop
mov rdi, qword [rbx + 8]
mov rbx, qword [rbx]
cmp rbx, rdi
je 0x140042f06
mov rcx, qword [rbx]
call fcn.1400a4ab0
add rbx, 0x18
cmp rbx, rdi
jne 0x140042ef5
lea rcx, [rsp + 0x30]
call fcn.14003fd70
mov r15, rax
cmp qword [rax + 0x18], 0x10
jb 0x140042f1d
mov r15, qword [rax]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov r14d, dword [rcx + rbx + 0x88]
add r14, rbx
cmp r14, rbx
je 0x140042fb9
mov r11d, dword [r14 + 0x18]
test r11d, r11d
je 0x140042fb9
mov esi, dword [r14 + 0x20]
nop word [rax + rax]
dec r11d
lea rcx, [rsi + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0xdd2263ea
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x140042fb4
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x140042f80
cmp r10d, 0xb5d7ec06
je 0x140042fc1
test r11d, r11d
jne 0x140042f60
mov rax, qword [rax]
jmp 0x140042f30
mov edx, dword [r14 + 0x1c]
add rdx, rbx
mov eax, dword [r14 + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov edx, dword [rdx + rax*4]
add rdx, rbx
mov rcx, r15
call rdx
nop
mov rdx, qword [rbp - 0x71]
cmp rdx, 0x10
jb 0x14004301f
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004301a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004301a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a4ab0
mov ecx, 1
call fcn.1400a527c
mov qword [rbp - 0x19], rax
lea rcx, [rbp - 0x21]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x140044430]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x29], rax
test rax, rax
je 0x140043204
cmp dword [rbp - 0x21], 0
jne 0x14004306e
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
movaps xmm0, xmmword [rbp - 0x29]
movdqa xmmword [rbp - 0x19], xmm0
lea rcx, [rbp - 0x19]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
je 0x14004308e
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
nop
lea rax, vtable.std::_Func_impl_no_alloc_void____cdecl___void___void___.0
mov qword [rbp - 0x69], rax
lea rax, [0x140042940]
mov qword [rbp - 0x61], rax
lea rax, [rbp - 0x69]
mov qword [rbp - 0x31], rax
lea rdx, [rbp - 0x69]
lea rcx, [0x1400cc300]
call fcn.140045aa0
movabs rsi, 0x311cdad160000
movabs r12, 0x7ffffffffffc2f6f
movabs r15, 0x7fffffffffffffff
movabs r14, 0x112e0be826d694b3
movsd xmm6, qword [0x1400bbcc8]
nop dword [rax]
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
imul rdi, rcx, 0x3b9aca00
add rdi, rax
cmp rdi, r12
jge 0x14004312b
add rdi, 0x3d090
jmp 0x14004312e
mov rdi, r15
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
imul rcx, rcx, 0x3b9aca00
add rax, rcx
cmp rax, rdi
jge 0x1400430f0
mov rbx, rdi
sub rbx, rax
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
imul rdx, rax, 0x64
xorps xmm0, xmm0
cvtsi2sd xmm0, rbx
comisd xmm0, xmm6
seta r8b
test r8b, r8b
lea rcx, [rdx + rsi]
jne 0x14004318d
lea rcx, [rbx + rdx]
lea rax, [rbx + rdx]
add rdx, rsi
test r8b, r8b
cmove rdx, rax
mov rax, r14
imul rdx
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [rbp - 9], rdx
imul rax, rdx, 0x3b9aca00
sub ecx, eax
mov dword [rbp - 1], ecx
lea rcx, [rbp - 9]
call qword [sym.imp.MSVCP140.dll__Thrd_sleep]
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
imul rcx, rcx, 0x3b9aca00
add rax, rcx
cmp rax, rdi
jl 0x140043160
jmp 0x1400430f0
mov dword [rbp - 0x21], r12d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3