Function at 0x1400c7a20
Capabilities:
Access peb ldr_data
Encode data using xor
Get process filename
Hash data using fnv
Hook routines via microsoft detours
Resolve function by parsing pe exports

Disassembly:
xor ecx, ecx
jmp 0x1400c7a20
push rbx
push rbp
push rsi
push rdi
push r13
sub rsp, 0x520
mov rax, qword [0x140137c00]
xor rax, rsp
mov qword [rsp + 0x510], rax
mov r13, rcx
test rcx, rcx
je 0x1400c7a52
mov rax, qword [0x140139a28]
mov qword [rcx], rax
mov rax, qword gs:[0x60]
mov rdx, qword [rax + 0x18]
mov rax, qword [rdx + 0x10]
mov rsi, qword [rax]
mov r11, rsi
nop dword [rax]
mov r9, qword [r11 + 0x30]
xor ebp, ebp
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x1400c7ae4
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x1400c7ae4
mov edi, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1400c7adf
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x1400c7ac0
cmp edx, 0xebcdfe95
je 0x1400c7b10
test r8d, r8d
jne 0x1400c7aa0
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x1400c7af9
cmp qword [rax + 0x30], rbp
jne 0x1400c7a70
mov rax, rbp
call rax
cmp dword [0x140139a1c], eax
je 0x1400c7b29
mov eax, 0x10dd
jmp 0x1400c83ce
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x1400c7afc
cmp dword [0x140139a20], ebp
je 0x1400c7b3b
call fcn.1400c7570
jmp 0x1400c83c8
mov rbx, qword [0x140139a38]
mov qword [rsp + 0x558], r12
mov r12d, ebp
mov qword [rsp + 0x560], r14
mov qword [rsp + 0x568], r15
test rbx, rbx
je 0x1400c7c02
mov rdx, qword [rbx + 0x20]
cmp dword [rbx + 8], ebp
je 0x1400c7b87
movzx r8d, byte [rdx + 0x3e]
add rdx, 0x20
mov rcx, qword [rbx + 0x18]
call fcn.1400f7ce0
mov rax, qword [rbx + 0x18]
jmp 0x1400c7bef
lea rcx, [rdx + 0x58]
mov word [rcx], 0x25ff
lea rax, [rcx + 6]
sub edx, eax
add edx, 0x50
mov dword [rcx + 2], edx
mov rcx, qword [rbx + 0x18]
mov rdx, qword [rbx + 0x20]
add rdx, 0x58
lea rax, [rcx + 5]
mov byte [rcx], 0xe9
sub edx, eax
mov dword [rcx + 1], edx
add rcx, 5
cmp dword [0x140139a00], ebp
je 0x1400c7bcc
mov rax, qword [rbx + 0x18]
cmp byte [rax], 0xe9
jne 0x1400c7bcc
mov byte [rax], 0xe8
mov rax, qword [rbx + 0x20]
mov r8, qword [rax + 0x48]
sub r8, rcx
cmp rcx, qword [rax + 0x48]
cmova r8, rbp
test r8, r8
je 0x1400c7beb
mov dl, 0xcc
call fcn.1400f8380
mov rax, qword [rbx + 0x20]
mov rcx, qword [rbx + 0x10]
mov qword [rcx], rax
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1400c7b66
mov r15, qword [0x140139a30]
test r15, r15
je 0x1400c7e7b
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x4d0
call fcn.1400f8380
mov dword [rsp + 0x70], 0x100001
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rbx, rsi
nop dword [rax]
nop word [rax + rax]
mov r9, qword [rbx + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov r11d, dword [rax + r9 + 0x88]
add r11, r9
cmp r11, r9
je 0x1400c7cc8
mov r8d, dword [r11 + 0x18]
test r8d, r8d
je 0x1400c7cc8
mov edi, dword [r11 + 0x20]
nop word [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1400c7cc3
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x1400c7ca0
cmp edx, 0x85cca27e
je 0x1400c7d77
test r8d, r8d
jne 0x1400c7c80
mov rax, qword [rbx]
mov rbx, rax
cmp rax, rsi
je 0x1400c7cdd
cmp qword [rax + 0x30], rbp
jne 0x1400c7c50
mov rax, rbp
mov rcx, qword [r15 + 8]
lea rdx, [rsp + 0x40]
call rax
test eax, eax
je 0x1400c7e6f
mov r14, qword [0x140139a38]
test r14, r14
je 0x1400c7e6f
mov rcx, qword [rsp + 0x138]
nop dword [rax + rax]
cmp dword [r14 + 8], ebp
je 0x1400c8046
mov r10, qword [r14 + 0x20]
cmp rcx, r10
jb 0x1400c7e63
lea rax, [r10 + 8]
cmp rcx, rax
jae 0x1400c7e63
movzx r11d, byte [rsp + 0x138]
lea rdx, [r10 + 0x40]
mov r8d, ebp
nop dword [rax]
nop dword [rax + rax]
movzx r9d, byte [rdx]
movzx ecx, r11b
movzx eax, r9b
sub cl, r10b
shr al, 3
cmp al, cl
je 0x1400c7d95
inc r8d
inc rdx
cmp r8d, 8
jb 0x1400c7d50
xor r9b, r9b
jmp 0x1400c7d99
mov ecx, dword [r11 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x1400c7ce0
and r9b, 7
movzx eax, r9b
add rax, qword [r14 + 0x18]
mov qword [rsp + 0x138], rax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rbx, rsi
mov r9, qword [rbx + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov r11d, dword [rax + r9 + 0x88]
add r11, r9
cmp r11, r9
je 0x1400c7e38
mov r8d, dword [r11 + 0x18]
test r8d, r8d
je 0x1400c7e38
mov edi, dword [r11 + 0x20]
nop word [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [r9 + r8*4]
mov ecx, dword [rax + rdi]
add rcx, r9
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1400c7e33
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x1400c7e10
cmp edx, 0x6ed04712
je 0x1400c8162
test r8d, r8d
jne 0x1400c7df0
mov rax, qword [rbx]
mov rbx, rax
cmp rax, rsi
je 0x1400c7e4d
cmp qword [rax + 0x30], rbp
jne 0x1400c7dc0
mov rax, rbp
mov rcx, qword [r15 + 8]
lea rdx, [rsp + 0x40]
call rax
mov rcx, qword [rsp + 0x138]
mov r14, qword [r14]
test r14, r14
jne 0x1400c7d10
mov r15, qword [r15]
test r15, r15
jne 0x1400c7c12
mov rsi, qword [0x140139a38]
mov r15, qword [rsp + 0x568]
test rsi, rsi
je 0x1400c7ff5
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rsi + 0x20]
mov rcx, qword [0x1401399a8]
mov r9d, dword [rsi + 0x28]
mov rdx, qword [rsi + 0x18]
movzx r8d, byte [rax + 0x3e]
lea rax, [rsp + 0x30]
mov r10, qword [rcx]
mov qword [rsp + 0x20], rax
call qword [r10 + 0x50]
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov rbx, rbp
mov r10, qword [rbx + 0x30]
movsxd rax, dword [r10 + 0x3c]
mov r11d, dword [rax + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x1400c7f58
mov r8d, dword [r11 + 0x18]
test r8d, r8d
je 0x1400c7f58
mov edi, dword [r11 + 0x20]
nop word [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov ecx, dword [rax + r10]
add rcx, r10
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1400c7f53
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x1400c7f30
cmp edx, 0x490286b
je 0x1400c8180
test r8d, r8d
jne 0x1400c7f10
mov rax, qword [rbx]
mov rbx, rax
cmp rax, rbp
je 0x1400c7f6e
cmp qword [rax + 0x30], 0
jne 0x1400c7ee0
xor ebp, ebp
mov r9d, ebp
mov rax, qword [rsi + 0x20]
mov rcx, 0xffffffffffffffff
mov rdx, qword [rsi + 0x18]
movzx r8d, byte [rax + 0x3e]
call r9
cmp dword [rsi + 8], 0
je 0x1400c7fd9
mov r8, qword [rsi + 0x20]
test r8, r8
je 0x1400c7fd9
xorps xmm0, xmm0
mov rdx, r8
movups xmmword [r8], xmm0
and rdx, 0xffffffffffff0000
mov r12d, 1
movups xmmword [r8 + 0x10], xmm0
movups xmmword [r8 + 0x20], xmm0
movups xmmword [r8 + 0x30], xmm0
movups xmmword [r8 + 0x40], xmm0
movups xmmword [r8 + 0x50], xmm0
mov rax, qword [rdx + 0x10]
mov qword [r8 + 0x48], rax
mov qword [rdx + 0x10], r8
mov qword [rsi + 0x20], rbp
mov rbx, qword [rsi]
mov edx, 0x30
mov rcx, rsi
call fcn.1400d0120
mov rsi, rbx
test rbx, rbx
jne 0x1400c7ea0
test r12d, r12d
mov qword [0x140139a38], rbp
mov r12, qword [rsp + 0x558]
je 0x1400c82b2
cmp dword [0x140139a18], 0
jne 0x1400c82b2
mov rsi, qword [0x140139a08]
lea r14, [0x140139a08]
test rsi, rsi
je 0x1400c82b2
cmp dword [rsi], 0x52727464
je 0x1400c81a1
lea r14, [rsi + 8]
jmp 0x1400c82a6
mov r10, qword [r14 + 0x18]
cmp rcx, r10
jb 0x1400c7e63
mov rbx, qword [r14 + 0x20]
movzx eax, byte [rbx + 0x3e]
add rax, r10
cmp rcx, rax
jae 0x1400c7e63
movzx r11d, byte [rsp + 0x138]
lea rdx, [rbx + 0x40]
mov r8d, ebp
nop word [rax + rax]
movzx r9d, byte [rdx]
movzx ecx, r11b
movzx eax, r9b
sub cl, r10b
and al, 7
cmp al, cl
je 0x1400c80a5
inc r8d
inc rdx
cmp r8d, 8
jb 0x1400c8080
mov eax, ebp
jmp 0x1400c80ab
mov eax, r9d
shr eax, 3
add rax, rbx
mov qword [rsp + 0x138], rax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rbx, rsi
nop dword [rax]
mov r9, qword [rbx + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov r11d, dword [rax + r9 + 0x88]
add r11, r9
cmp r11, r9
je 0x1400c8144
mov r8d, dword [r11 + 0x18]
test r8d, r8d
je 0x1400c8144
mov edi, dword [r11 + 0x20]
nop word [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [r9 + r8*4]
mov eax, dword [rax + rdi]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x1400c813f
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x1400c8120
cmp edx, 0x6ed04712
je 0x1400c8162
test r8d, r8d
jne 0x1400c8100
mov rax, qword [rbx]
mov rbx, rax
cmp rax, rsi
je 0x1400c7e4d
cmp qword [rax + 0x30], rbp
jne 0x1400c80d0
jmp 0x1400c7e4d
mov ecx, dword [r11 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x1400c7e50
mov ecx, dword [r11 + 0x24]
add rcx, r10
movzx edx, word [rcx + r8*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r10
mov r9d, dword [rcx + rdx*4]
add r9, r10
xor ebp, ebp
jmp 0x1400c7f73
lea r8, [rsi + 0x10000]
mov edx, ebp
lea rcx, [rsi + 0xa8]
mov rax, qword [rcx]
test rax, rax
je 0x1400c81cb
cmp rax, rsi
jb 0x1400c803d
cmp rax, r8
jae 0x1400c803d
inc edx
add rcx, 0x60
cmp edx, 0x2a9
jb 0x1400c81b1
mov rax, qword [rsi + 8]
mov qword [r14], rax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov rbx, rbp
nop word [rax + rax]
mov r9, qword [rbx + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov r11d, dword [rax + r9 + 0x88]
add r11, r9
cmp r11, r9
je 0x1400c8278
mov r8d, dword [r11 + 0x18]
test r8d, r8d
je 0x1400c8278
mov edi, dword [r11 + 0x20]
nop word [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1400c8273
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x1400c8250
cmp edx, 0x3a9acc72
je 0x1400c83ec
test r8d, r8d
jne 0x1400c8230
mov rax, qword [rbx]
mov rbx, rax
cmp rax, rbp
je 0x1400c828e
cmp qword [rax + 0x30], 0
jne 0x1400c8200
xor ebp, ebp
mov eax, ebp
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call rax
mov qword [0x140139a10], rbp
mov rsi, qword [r14]
test rsi, rsi
jne 0x1400c8031
call fcn.1400c6b60
mov r14, qword [0x140139a30]
test r14, r14
je 0x1400c83a3
nop word [rax + rax]
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rbx, rsi
nop word [rax + rax]
mov r9, qword [rbx + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov r11d, dword [rax + r9 + 0x88]
add r11, r9
cmp r11, r9
je 0x1400c8368
mov r8d, dword [r11 + 0x18]
test r8d, r8d
je 0x1400c8368
mov edi, dword [r11 + 0x20]
nop word [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1400c8363
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x1400c8340
cmp edx, 0xbb21e02e
je 0x1400c840c
test r8d, r8d
jne 0x1400c8320
mov rax, qword [rbx]
mov rbx, rax
cmp rax, rsi
je 0x1400c837e
cmp qword [rax + 0x30], 0
jne 0x1400c82f0
mov rax, rbp
mov rcx, qword [r14 + 8]
call rax
mov rbx, qword [r14]
mov edx, 0x10
mov rcx, r14
call fcn.1400d0120
mov r14, rbx
test rbx, rbx
jne 0x1400c82d0
mov r14, qword [rsp + 0x560]
mov qword [0x140139a30], rbp
mov dword [0x140139a1c], ebp
test r13, r13
je 0x1400c83c8
mov rax, qword [0x140139a28]
mov qword [r13], rax
mov eax, dword [0x140139a20]
mov rcx, qword [rsp + 0x510]
xor rcx, rsp
call fcn.1400d0100
add rsp, 0x520
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, dword [r11 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
xor ebp, ebp
jmp 0x1400c8292
mov ecx, dword [r11 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x1400c8381