Function at 0x140057e30
Capabilities:
Allocate or change rwx memory
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf]
sub rsp, 0xd0
mov rsi, r9
mov r13, rcx
xor r14d, r14d
mov rcx, qword [rbp + 0x6f]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__msize]
mov qword [rbp - 0x19], rax
test eax, eax
jg 0x140057e7d
xor al, al
jmp 0x1400583d6
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov rax, r14
mov qword [rbp - 0x79], rax
mov qword [rsp + 0x40], rax
movdqu xmmword [rbp - 0x11], xmm0
mov qword [rbp - 1], r14
mov rbx, qword [rbp + 0x7f]
mov r10, qword [rbx + 0x10]
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140057eb0
mov rdx, qword [rbx]
movabs r9, 0xcbf29ce484222325
mov rcx, r14
test r10, r10
je 0x140057ee3
movabs r8, 0x100000001b3
nop dword [rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r8
inc rcx
cmp rcx, r10
jb 0x140057ed0
mov r8, rbx
lea rdx, [rbp - 0x71]
call fcn.14005fa80
cmp qword [rax + 8], 0
je 0x140057f80
mov r8, rbx
lea rdx, [rbp - 0x71]
call fcn.14005ec30
mov rcx, qword [rax]
add rcx, 0x30
lea rax, [rsp + 0x30]
cmp rax, rcx
je 0x140057f69
mov rbx, qword [rcx + 8]
mov rdi, qword [rcx]
sub rbx, rdi
mov rdx, rbx
sar rdx, 3
test rdx, rdx
je 0x140057f40
lea rcx, [rsp + 0x30]
call fcn.14005fc40
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x79], rax
mov r8, rbx
mov rdx, rdi
mov r14, qword [rsp + 0x30]
mov rcx, r14
call sub.VCRUNTIME140.dll_memmove
lea r15, [r14 + rbx]
mov qword [rsp + 0x38], r15
lea rax, [r13 + 8]
mov qword [rbp + 0x5f], rax
jmp 0x14005818f
mov r15, qword [rsp + 0x38]
mov r14, qword [rsp + 0x30]
lea rax, [r13 + 8]
mov qword [rbp + 0x5f], rax
jmp 0x14005818f
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__msize]
mov rdi, rax
mov rcx, r14
lea r12, [r13 + 8]
mov qword [rbp + 0x5f], r12
movabs r14, 0x7fffffffffff
mov r15, qword [rsp + 0x38]
nop word [rax + rax]
mov r9d, Ordinal_50
lea r8, [rbp - 0x59]
mov rdx, rcx
mov rcx, qword [r12]
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
cmp rax, 0x30
jne 0x140058126
cmp dword [rbp - 0x39], 0x1000
jne 0x140058115
mov eax, dword [rbp - 0x35]
bt eax, 8
jb 0x140058115
cmp eax, 1
je 0x140058115
cmp eax, 0x10
je 0x140058115
mov rcx, qword [rbp - 0x41]
call fcn.14012ac90
mov rbx, rax
mov qword [rbp + 0x57], rax
lea rax, [rbp - 0x29]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp - 0x41]
mov r8, rbx
mov rdx, qword [rbp - 0x59]
mov rcx, qword [r12]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x14005810d
mov r8, rbx
mov rcx, qword [rbp - 0x29]
sub rcx, rdi
lea r9, [rbx + 1]
add r9, rcx
mov qword [rbp - 0x71], r9
lea r13, [rbx - 1]
add r13, rdi
mov r12, r13
lea r14, [rbx - 1]
add r14, qword [rbp - 0x29]
cmp rbx, r9
jae 0x1400580ff
test rdi, rdi
je 0x14005808b
mov rcx, rsi
mov rdx, rbx
sub rdx, rsi
movzx eax, byte [rcx]
cmp al, 0x3f
je 0x14005807d
cmp al, byte [rdx + rcx]
jne 0x1400580d4
inc rcx
mov rax, rcx
sub rax, rsi
cmp rax, rdi
jb 0x140058071
mov rax, rbx
sub rax, r8
add rax, qword [rbp - 0x59]
mov qword [rbp - 0x21], rax
cmp r15, qword [rbp - 0x79]
je 0x1400580ad
mov qword [r15], rax
add r15, 8
mov qword [rsp + 0x38], r15
jmp 0x1400580d4
lea r8, [rbp - 0x21]
mov rdx, r15
lea rcx, [rsp + 0x30]
call fcn.14005f260
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x79], rax
mov r15, qword [rsp + 0x38]
mov r8, qword [rbp + 0x57]
mov r9, qword [rbp - 0x71]
inc rbx
cmp rbx, r14
jb 0x1400580f2
add r12, 0x1000
add r14, 0x1000
cmp r12, r13
jae 0x1400580fb
mov rbx, r13
cmp rbx, r9
jb 0x140058063
mov rbx, qword [rbp + 0x57]
movabs r14, 0x7fffffffffff
mov r12, qword [rbp + 0x5f]
mov rcx, rbx
call fcn.14012abd8
mov rcx, qword [rbp - 0x41]
add rcx, qword [rbp - 0x59]
cmp rcx, r14
jb 0x140057fb0
mov r8, qword [rbp + 0x7f]
lea rdx, [rbp - 0x71]
call fcn.14005ec30
mov rdi, qword [rax]
add rdi, 0x30
lea rax, [rsp + 0x30]
mov r14, qword [rsp + 0x30]
cmp rdi, rax
je 0x14005818b
mov rsi, r15
sub rsi, r14
mov rdx, rsi
sar rdx, 3
mov rax, qword [rdi + 0x10]
sub rax, qword [rdi]
sar rax, 3
cmp rdx, rax
jbe 0x14005816e
mov rcx, rdi
call fcn.14005fc40
mov rbx, qword [rdi]
mov r8, rsi
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
lea rax, [rsi + rbx]
mov qword [rdi + 8], rax
mov qword [rbp + 0x5f], r12
mov r13, qword [rbp + 0x4f]
lea rdi, [r13 + 0x20]
mov r12, r15
sub r12, r14
sar r12, 3
mov rax, qword [rdi + 0x10]
sub rax, qword [rdi]
cmp r12, rax
jbe 0x1400581c7
movabs rax, 0x7fffffffffffffff
cmp r12, rax
ja 0x1400583f1
mov rdx, r12
mov rcx, rdi
call fcn.14005e390
mov rbx, r14
cmp r14, r15
je 0x140058231
lea rsi, [r13 + 0x18]
mov r13, qword [rbp + 0x5f]
nop word [rax + rax]
mov qword [rsp + 0x20], 0
mov r9d, 1
mov r8, rsi
mov rdx, qword [rbx]
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x140058223
mov rdx, qword [rdi + 8]
cmp rdx, qword [rdi + 0x10]
je 0x140058218
movzx eax, byte [rsi]
mov byte [rdx], al
inc qword [rdi + 8]
jmp 0x140058223
mov r8, rsi
mov rcx, rdi
call fcn.14005f0e0
add rbx, 8
cmp rbx, r15
jne 0x1400581e0
cmp r14, r15
jne 0x140058238
xor bl, bl
jmp 0x140058389
xor r15d, r15d
test r12, r12
je 0x140058387
movsxd r13, dword [rbp - 0x19]
mov rsi, r14
nop dword [rax + rax]
mov rcx, qword [rsi]
lea r9, [rbp - 0x5c]
test ecx, ecx
jns 0x1400582a0
neg ecx
nop dword [rax]
dec r9
mov eax, 0xcccccccd
mul ecx
shr edx, 3
movzx eax, dl
shl al, 2
lea r8d, [rax + rdx]
add r8b, r8b
sub cl, r8b
add cl, 0x30
mov byte [r9], cl
mov ecx, edx
test edx, edx
jne 0x140058260
dec r9
mov byte [r9], reloc.WLDAP32.dll_Ordinal_45
jmp 0x1400582c9
dec r9
mov eax, 0xcccccccd
mul ecx
shr edx, 3
movzx eax, dl
shl al, 2
lea r8d, [rax + rdx]
add r8b, r8b
sub cl, r8b
add cl, 0x30
mov byte [r9], cl
mov ecx, edx
test edx, edx
jne 0x1400582a0
xor ebx, ebx
mov qword [rbp - 0x59], rbx
mov qword [rbp - 0x49], rbx
mov edi, reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x41], rdi
lea rax, [rbp - 0x5c]
cmp r9, rax
je 0x140058300
lea r8, [rbp - 0x5c]
sub r8, r9
mov rdx, r9
lea rcx, [rbp - 0x59]
call fcn.140044e60
mov rdi, qword [rbp - 0x41]
mov rbx, qword [rbp - 0x59]
mov edx, dword [rsi]
lea rax, [rbp + 0x77]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
mov r8, r13
mov rax, qword [rbp + 0x5f]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov qword [rsp + 0x20], 0
mov r9, r13
mov r8, qword [rbp + 0x6f]
mov rdx, qword [rsi]
mov rax, qword [rbp + 0x5f]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp rdi, 0x10
jb 0x140058374
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14005836c
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400583c1
mov rcx, rbx
call fcn.14012abd8
inc r15d
add rsi, 8
movsxd rax, r15d
cmp rax, r12
jb 0x140058250
mov bl, 1
test r14, r14
je 0x1400583d3
mov rcx, qword [rbp - 0x79]
sub rcx, r14
and rcx, 0xfffffffffffffff8
mov rax, r14
cmp rcx, 0x1000
jb 0x1400583c8
add rcx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400583c8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rdx, rcx
mov rcx, r14
call fcn.14012abd8
movzx eax, bl
mov rbx, qword [rsp + 0x128]
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14004a950
nop
int3