Function at 0x140036c20
Capabilities:
Access peb ldr_data
Encode data using xor
Get kernel32 base address
Get process filename
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x140090040]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r13, rdx
mov r12, rcx
mov qword [rsp + 0x48], rcx
xor r15d, r15d
cmp qword [rdx + 0x10], r15
jne 0x140036c74
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], r15
mov qword [rcx + 0x18], 0xf
mov byte [rcx], r15b
jmp 0x140036e8e
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rbp, qword [rcx + 0x10]
mov rdi, rbp
nop dword [rax + rax]
mov r11, qword [rdi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov esi, dword [rax + r11 + 0x88]
add rsi, r11
cmp rsi, r11
je 0x140036d17
mov r10d, dword [rsi + 0x18]
test r10d, r10d
je 0x140036d17
mov r14d, dword [rsi + 0x20]
nop word [rax + rax]
dec r10d
lea rax, [r14 + r10*4]
mov r8d, dword [rax + r11]
add r8, r11
mov r9d, 0x811c9dc5
movzx eax, byte [r8]
inc r8
test al, al
je 0x140036d12
nop
movsx ecx, al
sub al, 0x41
mov edx, ecx
or edx, 0x20
cmp al, 0x19
cmova edx, ecx
xor edx, r9d
imul r9d, edx, 0x1000193
movzx eax, byte [r8]
lea r8, [r8 + 1]
test al, al
jne 0x140036ce0
cmp r9d, 0xa83e21de
je 0x140036eb9
test r10d, r10d
jne 0x140036cc0
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rbp
je 0x140036d2c
cmp qword [rax + 0x30], r15
jne 0x140036c90
mov r10, r15
mov r8, r13
cmp qword [r13 + 0x18], 7
jbe 0x140036d3d
mov r8, qword [r13]
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
mov r9d, dword [r13 + 0x10]
xor edx, edx
mov ecx, 0xfde9
call r10
movsxd r15, eax
mov rdx, r15
xor r8d, r8d
lea rcx, [rsp + 0x50]
call fcn.140007ba0
nop
mov rcx, qword gs:[0x60]
mov rdx, qword [rcx + 0x18]
mov rbp, qword [rdx + 0x10]
mov rsi, rbp
nop word [rax + rax]
mov r11, qword [rsi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov edi, dword [rax + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x140036e1d
mov r10d, dword [rdi + 0x18]
test r10d, r10d
je 0x140036e1d
mov r14d, dword [rdi + 0x20]
nop word [rax + rax]
dec r10d
lea rax, [r14 + r10*4]
mov edx, dword [rax + r11]
add rdx, r11
mov r9d, 0x811c9dc5
movzx r8d, byte [rdx]
inc rdx
test r8b, r8b
je 0x140036e18
movsx eax, r8b
sub r8b, 0x41
mov ecx, eax
or ecx, 0x20
cmp r8b, 0x19
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
movzx r8d, byte [rdx]
lea rdx, [rdx + 1]
test r8b, r8b
jne 0x140036de0
cmp r9d, 0xa83e21de
je 0x140036ed6
test r10d, r10d
jne 0x140036dc0
mov rax, qword [rsi]
mov rsi, rax
cmp rax, rbp
je 0x140036e33
cmp qword [rax + 0x30], 0
jne 0x140036d90
xor ebx, ebx
mov r10d, ebx
lea rax, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rax, qword [rsp + 0x50]
mov r9d, dword [r13 + 0x10]
cmp qword [r13 + 0x18], 7
jbe 0x140036e58
mov r13, qword [r13]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
mov r8, r13
xor edx, edx
mov ecx, 0xfde9
call r10
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [r12], xmm0
movups xmm1, xmmword [rsp + 0x60]
movups xmmword [r12 + 0x10], xmm1
mov rax, r12
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140049190
mov rbx, qword [rsp + 0xd0]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, dword [rsi + 0x1c]
add rcx, r11
mov eax, dword [rsi + 0x24]
add rax, r11
movzx eax, word [rax + r10*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
jmp 0x140036d2f
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + r10*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
xor ebx, ebx
jmp 0x140036e38