Function at 0x14007aed0
Capabilities:
Access peb ldr_data
Encode data using xor
Get process filename
Hash data using fnv
Read file on windows
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
mov rax, qword [0x14033c140]
xor rax, rsp
mov qword [rbp + 0xc0], rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov r14d, dword [rcx + rbx + 0x88]
add r14, rbx
cmp r14, rbx
je 0x14007a579
mov r11d, dword [r14 + 0x18]
test r11d, r11d
je 0x14007a579
mov esi, dword [r14 + 0x20]
nop word [rax + rax]
dec r11d
lea rcx, [rsi + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0xaf2dc939
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x14007a574
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x14007a540
cmp r10d, 0xda904dce
je 0x14007a581
test r11d, r11d
jne 0x14007a520
mov rax, qword [rax]
jmp 0x14007a4f0
mov ecx, dword [r14 + 0x1c]
add rcx, rbx
mov eax, dword [r14 + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov r10d, dword [rcx + rax*4]
add r10, rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x14033fae8]
call r10
mov rcx, qword gs:[0x60]
cmp eax, 0xffffffff
mov rax, qword [rcx + 0x18]
mov rax, qword [rax + 0x10]
jne 0x14007a690
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov r14d, dword [rcx + rbx + 0x88]
add r14, rbx
cmp r14, rbx
je 0x14007a659
mov r11d, dword [r14 + 0x18]
test r11d, r11d
je 0x14007a659
mov esi, dword [r14 + 0x20]
nop word [rax + rax]
dec r11d
lea rcx, [rsi + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0x3c150f4a
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x14007a654
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x14007a620
cmp r10d, 0x5fe4c30c
je 0x14007a661
test r11d, r11d
jne 0x14007a600
mov rax, qword [rax]
jmp 0x14007a5d0
mov ecx, dword [r14 + 0x24]
add rcx, rbx
movzx edx, word [rcx + r11*2]
mov ecx, dword [r14 + 0x1c]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
add rax, rbx
call rax
mov dword [0x14033faf0], eax
xor al, al
jmp 0x14007ae9f
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov r14d, dword [rcx + rbx + 0x88]
add r14, rbx
cmp r14, rbx
je 0x14007a719
mov r11d, dword [r14 + 0x18]
test r11d, r11d
je 0x14007a719
mov esi, dword [r14 + 0x20]
nop word [rax + rax]
dec r11d
lea rcx, [rsi + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0xa9b926a5
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x14007a714
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x14007a6e0
cmp r10d, 0xdb135ed8
je 0x14007a721
test r11d, r11d
jne 0x14007a6c0
mov rax, qword [rax]
jmp 0x14007a690
mov ecx, dword [r14 + 0x1c]
add rcx, rbx
mov eax, dword [r14 + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov r8d, dword [rcx + rax*4]
add r8, rbx
xor edx, edx
mov rcx, qword [0x14033fae8]
call r8
mov r15d, eax
cmp eax, 0xffffffff
jne 0x14007a805
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov r14d, dword [rcx + rbx + 0x88]
add r14, rbx
cmp r14, rbx
je 0x14007a7fd
mov r11d, dword [r14 + 0x18]
test r11d, r11d
je 0x14007a7fd
mov esi, dword [r14 + 0x20]
nop word [rax + rax]
dec r11d
lea rcx, [rsi + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0x68ef999a
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x14007a7f8
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x14007a7c0
cmp r10d, 0x31795adc
je 0x14007a661
test r11d, r11d
jne 0x14007a7a0
mov rax, qword [rax]
jmp 0x14007a770
lea edx, [rax + 1]
xor r8d, r8d
lea rcx, [rsp + 0x78]
call fcn.140088f50
nop
xor r12d, r12d
mov dword [rsp + 0x50], r12d
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
movups xmmword [rbp - 0x58], xmm0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov r14d, dword [rcx + rbx + 0x88]
add r14, rbx
cmp r14, rbx
je 0x14007a8c9
mov r11d, dword [r14 + 0x18]
test r11d, r11d
je 0x14007a8c9
mov esi, dword [r14 + 0x20]
nop word [rax + rax]
dec r11d
lea rcx, [rsi + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0x41a99382
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x14007a8c4
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x14007a890
cmp r10d, 0x95dc0c76
je 0x14007a8d1
test r11d, r11d
jne 0x14007a870
mov rax, qword [rax]
jmp 0x14007a840
mov ecx, dword [r14 + 0x1c]
add rcx, rbx
mov eax, dword [r14 + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov r10d, dword [rcx + rax*4]
add r10, rbx
lea rax, [rbp - 0x68]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xffffffff
mov r9d, 0xffffffff
xor r8d, r8d
mov edx, 2
mov rcx, qword [0x14033fae8]
call r10
lea rdx, [rsp + 0x78]
cmp qword [rbp - 0x70], 0xf
cmova rdx, qword [rsp + 0x78]
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x50]
mov r8d, r15d
mov rcx, qword [0x14033fae8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, qword gs:[0x60]
test eax, eax
mov rax, qword [rcx + 0x18]
mov rax, qword [rax + 0x10]
jne 0x14007ab00
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov r14d, dword [rcx + rbx + 0x88]
add r14, rbx
cmp r14, rbx
je 0x14007a9e9
mov r11d, dword [r14 + 0x18]
test r11d, r11d
je 0x14007a9e9
mov esi, dword [r14 + 0x20]
nop word [rax + rax]
dec r11d
lea rcx, [rsi + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0x6e871e94
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x14007a9e4
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x14007a9b0
cmp r10d, 0x1eb90c06
je 0x14007a9f1
test r11d, r11d
jne 0x14007a990
mov rax, qword [rax]
jmp 0x14007a960
mov ecx, dword [r14 + 0x1c]
add rcx, rbx
mov eax, dword [r14 + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov ecx, dword [rcx + rax*4]
add rcx, rbx
call rcx
mov dword [0x14033faf0], eax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov r14d, dword [rcx + rbx + 0x88]
add r14, rbx
cmp r14, rbx
je 0x14007aab8
mov r11d, dword [r14 + 0x18]
test r11d, r11d
je 0x14007aab8
mov esi, dword [r14 + 0x20]
nop word [rax + rax]
dec r11d
lea rcx, [rsi + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0x7af51068
movzx ecx, byte [r9]
inc r9
test cl, cl
je 0x14007aab3
nop
movsx edx, cl
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
movzx ecx, byte [r9]
lea r9, [r9 + 1]
test cl, cl
jne 0x14007aa80
cmp r10d, 0xf4994e17
je 0x14007aac0
test r11d, r11d
jne 0x14007aa60
mov rax, qword [rax]
jmp 0x14007aa30
mov ecx, dword [r14 + 0x1c]
add rcx, rbx
mov eax, dword [r14 + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov r10d, dword [rcx + rax*4]
add r10, rbx
lea rax, [rbp - 0x68]
mov qword [rsp + 0x20], rax
xor edx, edx
mov r9d, 0xffffffff
mov r8d, r9d
mov rcx, qword [0x14033fae8]
call r10
xor bl, bl
jmp 0x14007ae92
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov r14d, dword [rcx + rbx + 0x88]
add r14, rbx
cmp r14, rbx
je 0x14007ab89
mov r11d, dword [r14 + 0x18]
test r11d, r11d
je 0x14007ab89
mov esi, dword [r14 + 0x20]
nop word [rax + rax]
dec r11d
lea rcx, [rsi + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0x52757e3f
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x14007ab84
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x14007ab50
cmp r10d, 0x382e1554
je 0x14007ab91
test r11d, r11d
jne 0x14007ab30
mov rax, qword [rax]
jmp 0x14007ab00
mov ecx, dword [r14 + 0x1c]
add rcx, rbx
mov eax, dword [r14 + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov r10d, dword [rcx + rax*4]
add r10, rbx
lea rax, [rbp - 0x68]
mov qword [rsp + 0x20], rax
xor edx, edx
mov r9d, 0xffffffff
mov r8d, r9d
mov rcx, qword [0x14033fae8]
call r10
xor r8d, r8d
xor edx, edx
call fcn.140078670
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x58]
call fcn.140078870
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x40], xmm0
movups xmmword [rbp + 0x50], xmm0
movups xmmword [rbp + 0x60], xmm0
movups xmmword [rbp + 0x70], xmm0
movups xmmword [rbp + 0x80], xmm0
movups xmmword [rbp + 0x90], xmm0
movups xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0xb0], rax
mov ebx, dword [rsp + 0x68]
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 7
cmova rdx, qword [rsp + 0x58]
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], r12
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rdx + r8*2], ax
jne 0x14007ac40
lea rcx, [rsp + 0x30]
call fcn.14008b1e0
nop
lea rcx, [rbp + 0x40]
call fcn.140078b20
nop
lea rax, vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rbp + 0x40], rax
mov ecx, ebx
not ecx
and ecx, 1
shl ecx, 2
mov edx, ecx
or edx, 2
test bl, 2
cmovne edx, ecx
mov ecx, edx
or ecx, 8
test bl, 8
cmove ecx, edx
mov r9d, ecx
or r9d, 0x10
test bl, 4
cmove r9d, ecx
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 7
cmova rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x40]
lea rcx, [rbp + 0x40]
call fcn.140078c00
nop
lea rcx, [rsp + 0x30]
call fcn.14008bcd0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], rax
mov r9d, 1
lea rdx, [rbp + 0x40]
lea rcx, [rbp - 0x40]
call fcn.140079f50
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], r12
xor r8d, r8d
lea rdx, [0x14031ce4c]
lea rcx, [rsp + 0x30]
call fcn.14008b1e0
nop
lea rbx, [rsp + 0x58]
cmp qword [rsp + 0x70], 7
cmova rbx, qword [rsp + 0x58]
lea rcx, [rsp + 0x58]
cmova rcx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x68]
lea rdi, [rcx + rax*2]
cmp rbx, rdi
je 0x14007ade5
movzx edx, word [rbx]
cmp dx, 0xa
jne 0x14007adc8
cmp qword [rsp + 0x40], 0
je 0x14007add8
lea rax, [rsp + 0x30]
cmp qword [rsp + 0x48], 7
cmova rax, qword [rsp + 0x30]
cmp word [rax], 0
je 0x14007add8
mov rax, qword [0x14033fad8]
cmp rax, qword [0x14033fae0]
je 0x14007ad9f
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.14008b7a0
add qword [0x14033fad8], 0x20
jmp 0x14007adac
lea r8, [rsp + 0x30]
mov rdx, rax
call fcn.14007a220
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x30]
cmp qword [rsp + 0x48], 7
cmova rax, qword [rsp + 0x30]
mov word [rax], r12w
jmp 0x14007add8
cmp dx, 0xd
je 0x14007add8
lea rcx, [rsp + 0x30]
call fcn.1400894f0
add rbx, 2
cmp rbx, rdi
jne 0x14007ad50
cmp qword [rsp + 0x40], 0
je 0x14007ae38
lea rax, [rsp + 0x30]
cmp qword [rsp + 0x48], 7
cmova rax, qword [rsp + 0x30]
cmp word [rax], 0
je 0x14007ae38
mov rax, qword [0x14033fad8]
cmp rax, qword [0x14033fae0]
je 0x14007ae2b
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.14008b7a0
add qword [0x14033fad8], 0x20
jmp 0x14007ae38
lea r8, [rsp + 0x30]
mov rdx, rax
call fcn.14007a220
mov bl, 1
lea rcx, [rsp + 0x30]
call fcn.14008bcd0
nop
mov rax, qword [rbp - 0x40]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_istream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rbp + rcx - 0x40], rax
mov rax, qword [rbp - 0x40]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x18]
mov dword [rbp + rcx - 0x44], edx
lea rax, vtable.std::ios_base.0
mov qword [rbp - 0x28], rax
lea rcx, [rbp - 0x28]
call fcn.140266e24
nop
lea rcx, [rbp + 0x40]
call fcn.1400796e0
nop
lea rcx, [rsp + 0x58]
call fcn.14008bcd0
nop
lea rcx, [rsp + 0x78]
call fcn.14008b2f0
movzx eax, bl
mov rcx, qword [rbp + 0xc0]
xor rcx, rsp
call fcn.1402bd6f0
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
push rbx
sub rsp, 0x40
cmp qword [rdx + 0x18], 7
mov rbx, rdx
mov rcx, rdx
jbe 0x14007aee6
mov rcx, qword [rdx]
mov qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0x10000000
mov r8d, 3
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x14033fae8], rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x14007af97
lea rcx, [0x14033fad0]
call fcn.140077ce0
mov rcx, qword [0x14033fae8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rbx + 0x18], 7
jbe 0x14007af46
mov rbx, qword [rbx]
mov qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0xc0000000
mov r8d, 3
mov dword [rsp + 0x20], 4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x14033fae8], rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x14007af97
lea rcx, [0x14033fad0]
add rsp, 0x40
pop rbx
jmp 0x14007a4a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x14033faf0], eax
xor al, al
add rsp, 0x40
pop rbx
ret