Function at 0x140050510
Capabilities:
Allocate or change rwx memory
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf]
sub rsp, 0xd0
mov rdi, r9
mov r12, rcx
xor r14d, r14d
mov rcx, qword [rbp + 0x6f]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__msize]
mov qword [rbp - 0x41], rax
test eax, eax
jg 0x14005055d
xor al, al
jmp 0x140050a4a
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
mov r13, r14
mov qword [rbp + 0x57], r14
mov qword [rbp - 0x71], r14
movdqu xmmword [rbp - 9], xmm0
mov qword [rbp + 7], r14
mov rbx, qword [rbp + 0x7f]
mov r10, qword [rbx + 0x10]
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x14005058f
mov rdx, qword [rbx]
movabs r9, 0xcbf29ce484222325
mov rcx, r14
test r10, r10
je 0x1400505c3
movabs r8, 0x100000001b3
nop dword [rax + rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r8
inc rcx
cmp rcx, r10
jb 0x1400505b0
mov r8, rbx
lea rdx, [rbp - 0x69]
call fcn.140056510
cmp qword [rax + 8], 0
je 0x140050626
mov r8, rbx
lea rdx, [rbp - 0x69]
call fcn.140055ca0
mov r8, qword [rax]
add r8, 0x30
lea rax, [rsp + 0x40]
cmp rax, r8
je 0x140050613
mov rdx, qword [r8]
mov r8, qword [r8 + 8]
sub r8, rdx
sar r8, 3
lea rcx, [rsp + 0x40]
call fcn.140055fb0
mov r13, qword [rbp - 0x71]
mov qword [rbp + 0x57], r13
lea rax, [r12 + 8]
mov qword [rsp + 0x30], rax
mov r14, qword [rbp - 0x79]
jmp 0x140050813
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__msize]
mov rsi, rax
mov rcx, r14
add r12, 8
mov qword [rsp + 0x30], r12
movabs r15, 0x7fffffffffff
mov r14, qword [rbp - 0x79]
nop dword [rax]
mov r9d, Ordinal_50
lea r8, [rbp - 0x39]
mov rdx, rcx
mov rcx, qword [r12]
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
cmp rax, 0x30
jne 0x1400507c7
cmp dword [rbp - 0x19], 0x1000
jne 0x1400507b6
mov eax, dword [rbp - 0x15]
bt eax, 8
jb 0x1400507b6
cmp eax, 1
je 0x1400507b6
cmp eax, 0x10
je 0x1400507b6
mov rcx, qword [rbp - 0x21]
call fcn.1400b9f9c
mov rbx, rax
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x51]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp - 0x21]
mov r8, rbx
mov rdx, qword [rbp - 0x39]
mov rcx, qword [r12]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1400507ae
mov r8, rbx
mov rcx, qword [rbp - 0x51]
sub rcx, rsi
lea r9, [rbx + 1]
add r9, rcx
mov qword [rbp - 0x69], r9
lea r13, [rbx - 1]
add r13, rsi
mov r12, r13
lea r15, [rbx - 1]
add r15, qword [rbp - 0x51]
cmp rbx, r9
jae 0x14005079f
test rsi, rsi
je 0x14005072c
mov rcx, rdi
mov rdx, rbx
sub rdx, rdi
movzx eax, byte [rcx]
cmp al, 0x3f
je 0x14005071e
cmp al, byte [rdx + rcx]
jne 0x140050773
inc rcx
mov rax, rcx
sub rax, rdi
cmp rax, rsi
jb 0x140050712
mov rax, rbx
sub rax, r8
add rax, qword [rbp - 0x39]
mov qword [rbp - 0x49], rax
cmp r14, qword [rbp + 0x57]
je 0x14005074d
mov qword [r14], rax
add r14, 8
mov qword [rbp - 0x79], r14
jmp 0x140050773
lea r8, [rbp - 0x49]
mov rdx, r14
lea rcx, [rsp + 0x40]
call fcn.140056910
mov rax, qword [rbp - 0x71]
mov qword [rbp + 0x57], rax
mov r14, qword [rbp - 0x79]
mov r8, qword [rsp + 0x38]
mov r9, qword [rbp - 0x69]
inc rbx
cmp rbx, r15
jb 0x140050791
add r12, 0x1000
add r15, 0x1000
cmp r12, r13
jae 0x14005079a
mov rbx, r13
cmp rbx, r9
jb 0x140050704
mov rbx, qword [rsp + 0x38]
movabs r15, 0x7fffffffffff
mov r12, qword [rsp + 0x30]
mov rcx, rbx
call fcn.1400b9ee4
mov rcx, qword [rbp - 0x21]
add rcx, qword [rbp - 0x39]
cmp rcx, r15
jb 0x140050650
mov r8, qword [rbp + 0x7f]
lea rdx, [rbp - 0x69]
call fcn.140055ca0
mov rcx, qword [rax]
add rcx, 0x30
lea rax, [rsp + 0x40]
cmp rcx, rax
je 0x14005080b
mov r8, r14
mov r15, qword [rsp + 0x40]
sub r8, r15
sar r8, 3
mov rdx, r15
call fcn.140055fb0
mov qword [rsp + 0x30], r12
mov r13, qword [rbp + 0x57]
mov r12, qword [rbp + 0x4f]
jmp 0x140050818
mov r13, qword [rbp + 0x57]
mov r12, qword [rbp + 0x4f]
mov r15, qword [rsp + 0x40]
lea rdi, [r12 + 0x18]
mov r12, r14
sub r12, r15
sar r12, 3
mov rax, qword [rdi + 0x10]
sub rax, qword [rdi]
cmp r12, rax
jbe 0x140050851
movabs rax, 0x7fffffffffffffff
cmp r12, rax
ja 0x140050a65
mov rdx, r12
mov rcx, rdi
call fcn.140055790
mov rbx, r15
cmp r15, r14
je 0x1400508c8
mov rsi, qword [rbp + 0x4f]
mov r13, qword [rsp + 0x30]
nop dword [rax]
nop word [rax + rax]
mov qword [rsp + 0x20], 0
mov r9d, 1
lea r8, [rsi + 0x17]
mov rdx, qword [rbx]
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1400508b6
mov rdx, qword [rdi + 8]
cmp rdx, qword [rdi + 0x10]
je 0x1400508aa
movzx eax, byte [rsi + 0x17]
mov byte [rdx], al
inc qword [rdi + 8]
jmp 0x1400508b6
lea r8, [rsi + 0x17]
mov rcx, rdi
call fcn.1400565f0
add rbx, 8
cmp rbx, r14
jne 0x140050870
mov r13, qword [rbp + 0x57]
cmp r15, r14
jne 0x1400508cf
xor bl, bl
jmp 0x140050a01
xor edi, edi
test r12, r12
je 0x1400509ff
movsxd rsi, dword [rbp - 0x41]
mov rbx, r15
mov r14, qword [rsp + 0x30]
nop word [rax + rax]
mov rcx, qword [rbx]
lea r10, [rbp - 0x54]
test ecx, ecx
jns 0x140050940
neg ecx
nop dword [rax]
dec r10
mov eax, 0xcccccccd
mul ecx
shr edx, 3
movzx eax, dl
shl al, 2
lea r8d, [rax + rdx]
add r8b, r8b
sub cl, r8b
add cl, 0x30
mov byte [r10], cl
mov ecx, edx
test edx, edx
jne 0x140050900
dec r10
mov byte [r10], reloc.WLDAP32.dll_Ordinal_45
jmp 0x140050969
dec r10
mov eax, 0xcccccccd
mul ecx
shr edx, 3
movzx eax, dl
shl al, 2
lea r8d, [rax + rdx]
add r8b, r8b
sub cl, r8b
add cl, 0x30
mov byte [r10], cl
mov ecx, edx
test edx, edx
jne 0x140050940
lea r9, [rbp + 0x77]
lea r8, [rbp - 0x54]
mov rdx, r10
lea rcx, [rbp - 0x39]
call fcn.140041260
mov edx, dword [rbx]
lea rax, [rbp + 0x5f]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
mov r8, rsi
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov qword [rsp + 0x20], 0
mov r9, rsi
mov r8, qword [rbp + 0x6f]
mov rdx, qword [rbx]
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [rbp - 0x21]
cmp rdx, 0x10
jb 0x1400509ed
inc rdx
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400509e8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140050a35
call fcn.1400b9ee4
inc edi
add rbx, 8
movsxd rax, edi
cmp rax, r12
jb 0x1400508f0
mov bl, 1
test r15, r15
je 0x140050a47
sub r13, r15
and r13, 0xfffffffffffffff8
mov rax, r15
cmp r13, 0x1000
jb 0x140050a3c
add r13, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140050a3c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rdx, r13
mov rcx, r15
call fcn.1400b9ee4
movzx eax, bl
mov rbx, qword [rsp + 0x128]
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140055770
nop
int3