Function at 0x1400d47c0
Capabilities:
Encode data using xor
Enumerate process modules
Hash data using fnv

Disassembly:
mov eax, 0x11a8
call fcn.140136990
sub rsp, rax
mov rax, qword [0x140193080]
xor rax, rsp
mov qword [rsp + 0x1170], rax
cmp qword [0x1401e6930], 0
jne 0x1400d47f8
cmp qword [0x1401e6970], 0
jne 0x1400d47f8
call fcn.1400d2500
mov qword [rsp + 0x11b0], rbx
lea r8, [rsp + 0x30]
mov qword [rsp + 0x11b8], rbp
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x11c0], rsi
mov edx, 0x1000
mov qword [rsp + 0x11a0], rdi
mov qword [rsp + 0x1198], r12
mov qword [rsp + 0x1190], r13
mov qword [rsp + 0x1188], r14
mov qword [rsp + 0x1180], r15
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x1400d4a4e
mov edi, dword [rsp + 0x30]
xor r13d, r13d
shr edi, 2
mov dword [rsp + 0x20], edi
test edi, edi
je 0x1400d4a4e
lea rbx, [rsp + 0x60]
movabs rbp, 0x100000001b3
mov qword [rsp + 0x28], rbx
movabs r15, 0xcbf29ce484222325
nop dword [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r12, rax
test rax, rax
je 0x1400d4a39
mov r9d, 0x104
lea r8, [rsp + 0x1060]
xor edx, edx
mov rcx, rax
call sub.PSAPI.DLL_GetModuleBaseNameA
test eax, eax
je 0x1400d4a30
xorps xmm0, xmm0
mov qword [rsp + 0x48], 0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x1060]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x1400d48f5
lea rdx, [rsp + 0x1060]
lea rcx, [rsp + 0x38]
call fcn.1400413c0
mov r14, qword [rsp + 0x50]
lea r8, [rsp + 0x38]
mov rsi, qword [rsp + 0x38]
cmp r14, 0xf
mov rdi, qword [rsp + 0x48]
mov rcx, r15
cmova r8, rsi
xor edx, edx
test rdi, rdi
je 0x1400d4954
nop word [rax + rax]
movzx eax, byte [rdx + r8]
inc rdx
xor rcx, rax
imul rcx, rbp
cmp rdx, rdi
jb 0x1400d4940
and rcx, qword [0x1401e6950]
mov rax, qword [0x1401e6938]
add rcx, rcx
mov r15, qword [0x1401e6928]
mov rbx, qword [rax + rcx*8 + 8]
cmp rbx, r15
je 0x1400d49d1
mov rbp, qword [rax + rcx*8]
nop word [rax + rax]
cmp qword [rbx + 0x28], 0xf
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
jbe 0x1400d4992
mov rdx, qword [rdx]
cmp r14, 0xf
lea rcx, [rsp + 0x38]
cmova rcx, rsi
cmp rdi, rax
jne 0x1400d49b0
mov r8, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400d49bb
cmp rbx, rbp
je 0x1400d49c7
mov rbx, qword [rbx + 8]
jmp 0x1400d4980
movabs rbp, 0x100000001b3
jmp 0x1400d49d3
movabs rbp, 0x100000001b3
xor ebx, ebx
test rbx, rbx
mov rax, r15
cmovne rax, rbx
cmp rax, r15
jne 0x1400d4aa8
cmp r14, 0xf
jbe 0x1400d4a1d
lea rdx, [r14 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400d4a15
mov rsi, qword [rsi - 8]
add rdx, 0x27
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400d4adc
mov rcx, rsi
call fcn.140136310
mov edi, dword [rsp + 0x20]
movabs r15, 0xcbf29ce484222325
mov rbx, qword [rsp + 0x28]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
inc r13d
mov qword [rsp + 0x28], rbx
cmp r13d, edi
jb 0x1400d4890
xor al, al
mov r15, qword [rsp + 0x1180]
mov r14, qword [rsp + 0x1188]
mov r13, qword [rsp + 0x1190]
mov r12, qword [rsp + 0x1198]
mov rdi, qword [rsp + 0x11a0]
mov rsi, qword [rsp + 0x11c0]
mov rbp, qword [rsp + 0x11b8]
mov rbx, qword [rsp + 0x11b0]
mov rcx, qword [rsp + 0x1170]
xor rcx, rsp
call fcn.140136960
add rsp, 0x11a8
ret
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp r14, 0xf
jbe 0x1400d4aeb
lea rdx, [r14 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400d4ae3
mov rsi, qword [rsi - 8]
add rdx, 0x27
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400d4ae3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.140136310
mov al, 1
jmp 0x1400d4a50