Function at 0x14007ae50
Capabilities:
Access peb ldr_data
Encode data using xor
Get process filename
Hash data using fnv
Read file on windows
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
mov rax, qword [0x140345140]
xor rax, rsp
mov qword [rbp + 0xc0], rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov r14d, dword [rcx + rbx + 0x88]
add r14, rbx
cmp r14, rbx
je 0x14007a4f9
mov r11d, dword [r14 + 0x18]
test r11d, r11d
je 0x14007a4f9
mov esi, dword [r14 + 0x20]
nop word [rax + rax]
dec r11d
lea rcx, [rsi + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0x38769b60
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x14007a4f4
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x14007a4c0
cmp r10d, 0xb324c7cf
je 0x14007a501
test r11d, r11d
jne 0x14007a4a0
mov rax, qword [rax]
jmp 0x14007a470
mov ecx, dword [r14 + 0x1c]
add rcx, rbx
mov eax, dword [r14 + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov r10d, dword [rcx + rax*4]
add r10, rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x140348ae8]
call r10
mov rcx, qword gs:[0x60]
cmp eax, 0xffffffff
mov rax, qword [rcx + 0x18]
mov rax, qword [rax + 0x10]
jne 0x14007a610
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov r14d, dword [rcx + rbx + 0x88]
add r14, rbx
cmp r14, rbx
je 0x14007a5d9
mov r11d, dword [r14 + 0x18]
test r11d, r11d
je 0x14007a5d9
mov esi, dword [r14 + 0x20]
nop word [rax + rax]
dec r11d
lea rcx, [rsi + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0xb98f6b59
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x14007a5d4
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x14007a5a0
cmp r10d, 0x7c0d2d33
je 0x14007a5e1
test r11d, r11d
jne 0x14007a580
mov rax, qword [rax]
jmp 0x14007a550
mov ecx, dword [r14 + 0x24]
add rcx, rbx
movzx edx, word [rcx + r11*2]
mov ecx, dword [r14 + 0x1c]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
add rax, rbx
call rax
mov dword [0x140348af0], eax
xor al, al
jmp 0x14007ae1f
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov r14d, dword [rcx + rbx + 0x88]
add r14, rbx
cmp r14, rbx
je 0x14007a699
mov r11d, dword [r14 + 0x18]
test r11d, r11d
je 0x14007a699
mov esi, dword [r14 + 0x20]
nop word [rax + rax]
dec r11d
lea rcx, [rsi + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0x73c03650
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x14007a694
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x14007a660
cmp r10d, 0x8eab6343
je 0x14007a6a1
test r11d, r11d
jne 0x14007a640
mov rax, qword [rax]
jmp 0x14007a610
mov ecx, dword [r14 + 0x1c]
add rcx, rbx
mov eax, dword [r14 + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov r8d, dword [rcx + rax*4]
add r8, rbx
xor edx, edx
mov rcx, qword [0x140348ae8]
call r8
mov r15d, eax
cmp eax, 0xffffffff
jne 0x14007a785
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov r14d, dword [rcx + rbx + 0x88]
add r14, rbx
cmp r14, rbx
je 0x14007a77d
mov r11d, dword [r14 + 0x18]
test r11d, r11d
je 0x14007a77d
mov esi, dword [r14 + 0x20]
nop word [rax + rax]
dec r11d
lea rcx, [rsi + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0xf4c7bd28
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x14007a778
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x14007a740
cmp r10d, 0x7fd0e642
je 0x14007a5e1
test r11d, r11d
jne 0x14007a720
mov rax, qword [rax]
jmp 0x14007a6f0
lea edx, [rax + 1]
xor r8d, r8d
lea rcx, [rsp + 0x78]
call fcn.140088de0
nop
xor r12d, r12d
mov dword [rsp + 0x50], r12d
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
movups xmmword [rbp - 0x58], xmm0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov r14d, dword [rcx + rbx + 0x88]
add r14, rbx
cmp r14, rbx
je 0x14007a849
mov r11d, dword [r14 + 0x18]
test r11d, r11d
je 0x14007a849
mov esi, dword [r14 + 0x20]
nop word [rax + rax]
dec r11d
lea rcx, [rsi + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0xe12d21d7
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x14007a844
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x14007a810
cmp r10d, 0x8ea5dc43
je 0x14007a851
test r11d, r11d
jne 0x14007a7f0
mov rax, qword [rax]
jmp 0x14007a7c0
mov ecx, dword [r14 + 0x1c]
add rcx, rbx
mov eax, dword [r14 + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov r10d, dword [rcx + rax*4]
add r10, rbx
lea rax, [rbp - 0x68]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xffffffff
mov r9d, 0xffffffff
xor r8d, r8d
mov edx, 2
mov rcx, qword [0x140348ae8]
call r10
lea rdx, [rsp + 0x78]
cmp qword [rbp - 0x70], 0xf
cmova rdx, qword [rsp + 0x78]
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x50]
mov r8d, r15d
mov rcx, qword [0x140348ae8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, qword gs:[0x60]
test eax, eax
mov rax, qword [rcx + 0x18]
mov rax, qword [rax + 0x10]
jne 0x14007aa80
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov r14d, dword [rcx + rbx + 0x88]
add r14, rbx
cmp r14, rbx
je 0x14007a969
mov r11d, dword [r14 + 0x18]
test r11d, r11d
je 0x14007a969
mov esi, dword [r14 + 0x20]
nop word [rax + rax]
dec r11d
lea rcx, [rsi + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0x1a61fc17
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x14007a964
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x14007a930
cmp r10d, 0x19103681
je 0x14007a971
test r11d, r11d
jne 0x14007a910
mov rax, qword [rax]
jmp 0x14007a8e0
mov ecx, dword [r14 + 0x1c]
add rcx, rbx
mov eax, dword [r14 + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov ecx, dword [rcx + rax*4]
add rcx, rbx
call rcx
mov dword [0x140348af0], eax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov r14d, dword [rcx + rbx + 0x88]
add r14, rbx
cmp r14, rbx
je 0x14007aa38
mov r11d, dword [r14 + 0x18]
test r11d, r11d
je 0x14007aa38
mov esi, dword [r14 + 0x20]
nop word [rax + rax]
dec r11d
lea rcx, [rsi + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0xa791f311
movzx ecx, byte [r9]
inc r9
test cl, cl
je 0x14007aa33
nop
movsx edx, cl
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
movzx ecx, byte [r9]
lea r9, [r9 + 1]
test cl, cl
jne 0x14007aa00
cmp r10d, 0xffd330a
je 0x14007aa40
test r11d, r11d
jne 0x14007a9e0
mov rax, qword [rax]
jmp 0x14007a9b0
mov ecx, dword [r14 + 0x1c]
add rcx, rbx
mov eax, dword [r14 + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov r10d, dword [rcx + rax*4]
add r10, rbx
lea rax, [rbp - 0x68]
mov qword [rsp + 0x20], rax
xor edx, edx
mov r9d, 0xffffffff
mov r8d, r9d
mov rcx, qword [0x140348ae8]
call r10
xor bl, bl
jmp 0x14007ae12
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov r14d, dword [rcx + rbx + 0x88]
add r14, rbx
cmp r14, rbx
je 0x14007ab09
mov r11d, dword [r14 + 0x18]
test r11d, r11d
je 0x14007ab09
mov esi, dword [r14 + 0x20]
nop word [rax + rax]
dec r11d
lea rcx, [rsi + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0x658fa14
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x14007ab04
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x14007aad0
cmp r10d, 0xfc0b96b3
je 0x14007ab11
test r11d, r11d
jne 0x14007aab0
mov rax, qword [rax]
jmp 0x14007aa80
mov ecx, dword [r14 + 0x1c]
add rcx, rbx
mov eax, dword [r14 + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov r10d, dword [rcx + rax*4]
add r10, rbx
lea rax, [rbp - 0x68]
mov qword [rsp + 0x20], rax
xor edx, edx
mov r9d, 0xffffffff
mov r8d, r9d
mov rcx, qword [0x140348ae8]
call r10
xor r8d, r8d
xor edx, edx
call fcn.1400785f0
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x58]
call fcn.1400787f0
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x40], xmm0
movups xmmword [rbp + 0x50], xmm0
movups xmmword [rbp + 0x60], xmm0
movups xmmword [rbp + 0x70], xmm0
movups xmmword [rbp + 0x80], xmm0
movups xmmword [rbp + 0x90], xmm0
movups xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0xb0], rax
mov ebx, dword [rsp + 0x68]
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 7
cmova rdx, qword [rsp + 0x58]
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], r12
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rdx + r8*2], ax
jne 0x14007abc0
lea rcx, [rsp + 0x30]
call fcn.14008b070
nop
lea rcx, [rbp + 0x40]
call fcn.140078aa0
nop
lea rax, vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rbp + 0x40], rax
mov ecx, ebx
not ecx
and ecx, 1
shl ecx, 2
mov edx, ecx
or edx, 2
test bl, 2
cmovne edx, ecx
mov ecx, edx
or ecx, 8
test bl, 8
cmove ecx, edx
mov r9d, ecx
or r9d, 0x10
test bl, 4
cmove r9d, ecx
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 7
cmova rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x40]
lea rcx, [rbp + 0x40]
call fcn.140078b80
nop
lea rcx, [rsp + 0x30]
call fcn.14008bb60
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], rax
mov r9d, 1
lea rdx, [rbp + 0x40]
lea rcx, [rbp - 0x40]
call fcn.140079ed0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], r12
xor r8d, r8d
lea rdx, [0x140325e6c]
lea rcx, [rsp + 0x30]
call fcn.14008b070
nop
lea rbx, [rsp + 0x58]
cmp qword [rsp + 0x70], 7
cmova rbx, qword [rsp + 0x58]
lea rcx, [rsp + 0x58]
cmova rcx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x68]
lea rdi, [rcx + rax*2]
cmp rbx, rdi
je 0x14007ad65
movzx edx, word [rbx]
cmp dx, 0xa
jne 0x14007ad48
cmp qword [rsp + 0x40], 0
je 0x14007ad58
lea rax, [rsp + 0x30]
cmp qword [rsp + 0x48], 7
cmova rax, qword [rsp + 0x30]
cmp word [rax], 0
je 0x14007ad58
mov rax, qword [0x140348ad8]
cmp rax, qword [0x140348ae0]
je 0x14007ad1f
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.14008b630
add qword [0x140348ad8], 0x20
jmp 0x14007ad2c
lea r8, [rsp + 0x30]
mov rdx, rax
call fcn.14007a1a0
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x30]
cmp qword [rsp + 0x48], 7
cmova rax, qword [rsp + 0x30]
mov word [rax], r12w
jmp 0x14007ad58
cmp dx, 0xd
je 0x14007ad58
lea rcx, [rsp + 0x30]
call fcn.140089380
add rbx, 2
cmp rbx, rdi
jne 0x14007acd0
cmp qword [rsp + 0x40], 0
je 0x14007adb8
lea rax, [rsp + 0x30]
cmp qword [rsp + 0x48], 7
cmova rax, qword [rsp + 0x30]
cmp word [rax], 0
je 0x14007adb8
mov rax, qword [0x140348ad8]
cmp rax, qword [0x140348ae0]
je 0x14007adab
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.14008b630
add qword [0x140348ad8], 0x20
jmp 0x14007adb8
lea r8, [rsp + 0x30]
mov rdx, rax
call fcn.14007a1a0
mov bl, 1
lea rcx, [rsp + 0x30]
call fcn.14008bb60
nop
mov rax, qword [rbp - 0x40]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_istream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rbp + rcx - 0x40], rax
mov rax, qword [rbp - 0x40]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x18]
mov dword [rbp + rcx - 0x44], edx
lea rax, vtable.std::ios_base.0
mov qword [rbp - 0x28], rax
lea rcx, [rbp - 0x28]
call fcn.1402700d4
nop
lea rcx, [rbp + 0x40]
call fcn.140079660
nop
lea rcx, [rsp + 0x58]
call fcn.14008bb60
nop
lea rcx, [rsp + 0x78]
call fcn.14008b180
movzx eax, bl
mov rcx, qword [rbp + 0xc0]
xor rcx, rsp
call fcn.1402c69a0
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
push rbx
sub rsp, 0x40
cmp qword [rdx + 0x18], 7
mov rbx, rdx
mov rcx, rdx
jbe 0x14007ae66
mov rcx, qword [rdx]
mov qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0x10000000
mov r8d, 3
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x140348ae8], rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x14007af17
lea rcx, [0x140348ad0]
call fcn.140077c70
mov rcx, qword [0x140348ae8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rbx + 0x18], 7
jbe 0x14007aec6
mov rbx, qword [rbx]
mov qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0xc0000000
mov r8d, 3
mov dword [rsp + 0x20], 4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x140348ae8], rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x14007af17
lea rcx, [0x140348ad0]
add rsp, 0x40
pop rbx
jmp 0x14007a420
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x140348af0], eax
xor al, al
add rsp, 0x40
pop rbx
ret