Function at 0x14000cfbc
Capabilities:
Access peb ldr_data
Encode data using xor
Get process filename
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r15
sub rsp, 0x70
mov dword [rcx], 0x50
lea rax, [0x14000d618]
mov qword [rcx + 8], rax
mov rdi, rcx
mov dword [rcx + 4], 3
mov rax, qword [rdx]
mov qword [rcx + 0x18], rax
lea rax, str.Mitchboard
mov qword [rcx + 0x40], rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x14000d072
mov r9d, dword [r10 + 0x18]
test r9d, r9d
je 0x14000d072
mov esi, dword [r10 + 0x20]
dec r9d
mov r11d, 0xa7b917e4
lea rcx, [rsi + r9*4]
mov edx, dword [rcx + r8]
add rdx, r8
mov cl, byte [rdx]
inc rdx
test cl, cl
je 0x14000d06d
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x37d89a
mov cl, byte [rdx]
inc rdx
test cl, cl
jne 0x14000d04e
cmp r11d, 0x59a505d2
je 0x14000d077
test r9d, r9d
jne 0x14000d031
mov rax, qword [rax]
jmp 0x14000d00c
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx edx, word [rcx + r9*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
mov rcx, rdi
add rax, r8
call rax
lea rcx, [rsp + 0x90]
call fcn.1400013f4
mov rax, qword [rsp + 0x90]
movabs rcx, 0x7fffffff27fe25fe
cmp rax, rcx
jg 0x14000d0c3
mov ebx, 0xd801da00
add rbx, rax
jmp 0x14000d0cd
movabs rbx, 0x7fffffffffffffff
movabs rsi, 0x4e94914f0000
movabs rbp, 0x431bde82d7b634db
mov r15d, 0xff
lea rcx, [rsp + 0x90]
call fcn.1400013f4
mov rax, qword [rsp + 0x90]
cmp rbx, rax
je 0x14000d164
mov ecx, 1
cmovl ecx, r15d
test cl, cl
jle 0x14000d164
mov rcx, rbx
sub rcx, rax
cmp rcx, rsi
jne 0x14000d12f
mov rax, rbp
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
jmp 0x14000d15b
jl 0x14000d138
mov edx, 0x5265c00
jmp 0x14000d15b
mov rax, rbp
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x14000d15b
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x14000d0e7
mov rcx, rdi
call fcn.14000d634
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x14000d1e3
mov r9d, dword [r10 + 0x18]
test r9d, r9d
je 0x14000d1e3
mov ebx, dword [r10 + 0x20]
dec r9d
mov r11d, 0xc298af7e
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r8]
add rdx, r8
mov cl, byte [rdx]
inc rdx
test cl, cl
je 0x14000d1de
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x37d89a
mov cl, byte [rdx]
inc rdx
test cl, cl
jne 0x14000d1bf
cmp r11d, 0xea232f52
je 0x14000d1e8
test r9d, r9d
jne 0x14000d1a2
mov rax, qword [rax]
jmp 0x14000d17d
and qword [rsp + 0x58], 0
mov ecx, dword [r10 + 0x24]
mov rax, qword [rdi + 0x18]
add rcx, r8
mov qword [rsp + 0x50], rax
mov eax, 0x12c
and qword [rsp + 0x48], 0
and qword [rsp + 0x40], 0
movzx edx, word [rcx + r9*2]
mov r9d, 0x80000000
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov dword [rsp + 0x38], 0xc8
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov r10d, dword [rcx + rdx*4]
xor ecx, ecx
mov rdx, qword [rdi + 0x40]
add r10, r8
lea r8, str.Dizzardly_ellwand
call r10
mov qword [rdi + 0x70], rax
mov rbp, rax
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
mov r9, qword [rcx + 0x30]
movsxd rdx, dword [r9 + 0x3c]
mov r10d, dword [rdx + r9 + 0x88]
add r10, r9
cmp r10, r9
je 0x14000d2ca
mov r8d, dword [r10 + 0x18]
test r8d, r8d
je 0x14000d2ca
mov esi, dword [r10 + 0x20]
dec r8d
mov r11d, 0x2bd5ebc0
lea rax, [rsi + r8*4]
mov edx, dword [rax + r9]
add rdx, r9
mov al, byte [rdx]
inc rdx
test al, al
je 0x14000d2c5
movsx eax, al
xor eax, r11d
imul r11d, eax, 0x37d89a
mov al, byte [rdx]
inc rdx
test al, al
jne 0x14000d2a6
cmp r11d, 0x562a65ca
je 0x14000d2cf
test r8d, r8d
jne 0x14000d289
mov rcx, qword [rcx]
jmp 0x14000d264
mov ecx, dword [r10 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov r8b, r15b
mov ecx, dword [r10 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
xor edx, edx
add rax, r9
mov rcx, rbp
mov r9d, 2
call rax
mov ecx, dword [0x1400b8f98]
mov edx, dword [0x1400b8f9c]
mov eax, dword [0x1400b8fa0]
sub eax, ecx
mov dword [rsp + 0x60], ecx
mov rcx, qword [rdi + 0x70]
mov dword [rsp + 0x68], eax
mov eax, dword [0x1400b8fa4]
sub eax, edx
mov dword [rsp + 0x64], edx
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x6c], eax
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop rdi
pop rsi
ret