Function at 0x140001070
Capabilities:
Access peb ldr_data
Encode data using xor
Get process filename

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x480
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x470], rax
xor ecx, ecx
lea r8, [0x140005041]
xor r9d, r9d
lea r11, str.test
xor edx, edx
lea r8, [r8 + 0xa]
cmp ecx, 4
cmovne edx, ecx
xor ecx, ecx
movsxd rax, edx
movzx eax, byte [rax + r11]
xor byte [r8 - 0xb], al
lea eax, [rdx + 1]
cmp edx, 3
cmovne ecx, eax
xor edx, edx
movsxd rax, ecx
movzx eax, byte [rax + r11]
xor byte [r8 - 0xa], al
lea eax, [rcx + 1]
cmp ecx, 3
cmovne edx, eax
xor ecx, ecx
movsxd rax, edx
movzx eax, byte [rax + r11]
xor byte [r8 - 9], al
lea eax, [rdx + 1]
cmp edx, 3
cmovne ecx, eax
xor edx, edx
movsxd rax, ecx
movzx eax, byte [rax + r11]
xor byte [r8 - 8], al
lea eax, [rcx + 1]
cmp ecx, 3
cmovne edx, eax
xor ecx, ecx
movsxd rax, edx
movzx eax, byte [rax + r11]
xor byte [r8 - 7], al
lea eax, [rdx + 1]
cmp edx, 3
cmovne ecx, eax
xor edx, edx
movsxd rax, ecx
movzx eax, byte [rax + r11]
xor byte [r8 - 6], al
lea eax, [rcx + 1]
cmp ecx, 3
cmovne edx, eax
xor ecx, ecx
movsxd rax, edx
movzx eax, byte [rax + r11]
xor byte [r8 - 5], al
lea eax, [rdx + 1]
cmp edx, 3
cmovne ecx, eax
xor edx, edx
movsxd rax, ecx
movzx eax, byte [rax + r11]
xor byte [r8 - 4], al
lea eax, [rcx + 1]
cmp ecx, 3
cmovne edx, eax
xor ecx, ecx
movsxd rax, edx
movzx eax, byte [rax + r11]
xor byte [r8 - 3], al
lea eax, [rdx + 1]
cmp edx, 3
cmovne ecx, eax
add r9d, 0xa
movsxd rax, ecx
movzx eax, byte [rax + r11]
xor byte [r8 - 2], al
inc ecx
cmp r9d, 0xa
jb 0x1400010a2
xor ecx, ecx
lea r9, [0x140005051]
xor r10d, r10d
nop word [rax + rax]
xor edx, edx
lea r9, [r9 + 0xb]
cmp ecx, 4
cmovne edx, ecx
xor ecx, ecx
movsxd rax, edx
movzx eax, byte [rax + r11]
xor byte [r9 - 0xc], al
lea eax, [rdx + 1]
cmp edx, 3
cmovne ecx, eax
xor edx, edx
movsxd rax, ecx
movzx eax, byte [rax + r11]
xor byte [r9 - 0xb], al
lea eax, [rcx + 1]
cmp ecx, 3
cmovne edx, eax
xor ecx, ecx
movsxd rax, edx
movzx eax, byte [rax + r11]
xor byte [r9 - 0xa], al
lea eax, [rdx + 1]
cmp edx, 3
cmovne ecx, eax
xor edx, edx
movsxd rax, ecx
movzx eax, byte [rax + r11]
xor byte [r9 - 9], al
lea eax, [rcx + 1]
cmp ecx, 3
cmovne edx, eax
xor ecx, ecx
movsxd rax, edx
movzx eax, byte [rax + r11]
xor byte [r9 - 8], al
lea eax, [rdx + 1]
cmp edx, 3
cmovne ecx, eax
xor edx, edx
movsxd rax, ecx
movzx eax, byte [rax + r11]
xor byte [r9 - 7], al
lea eax, [rcx + 1]
cmp ecx, 3
cmovne edx, eax
xor ecx, ecx
movsxd rax, edx
movzx eax, byte [rax + r11]
xor byte [r9 - 6], al
lea eax, [rdx + 1]
cmp edx, 3
cmovne ecx, eax
xor edx, edx
movsxd rax, ecx
movzx eax, byte [rax + r11]
xor byte [r9 - 5], al
lea eax, [rcx + 1]
cmp ecx, 3
cmovne edx, eax
xor r8d, r8d
movsxd rax, edx
movzx eax, byte [rax + r11]
xor byte [r9 - 4], al
lea eax, [rdx + 1]
cmp edx, 3
cmovne r8d, eax
xor ecx, ecx
movsxd rax, r8d
movzx eax, byte [rax + r11]
xor byte [r9 - 3], al
lea eax, [r8 + 1]
cmp r8d, 3
cmovne ecx, eax
add r10d, 0xb
movsxd rax, ecx
movzx eax, byte [rax + r11]
xor byte [r9 - 2], al
inc ecx
cmp r10d, 0xb
jb 0x1400011b0
lea rdx, [0x140005040]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x1400012d0
inc r8
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_mbstowcs]
xor r9d, r9d
lea r8, [0x1400032b0]
lea rdx, [0x1400032b0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rax, qword gs:[0x60]
lea rcx, [rsp + 0x260]
xor edx, edx
mov r8d, 0x208
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
cmp rbx, rdi
je 0x1400013ea
nop word [rax + rax]
xor edx, edx
lea rcx, [rsp + 0x260]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
mov r8, qword [rbx + 0x40]
lea rcx, [rsp + 0x260]
mov edx, 0x104
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x20]
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcslwr_s]
mov edx, 0x104
lea rcx, [rsp + 0x260]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcslwr_s]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x260]
call qword [sym.imp.SHLWAPI.dll_StrStrW]
test rax, rax
jne 0x140001421
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x140001350
lea rdx, [rsp + 0x20]
lea rcx, str.no_to__s_n
call fcn.140001010
mov eax, 0xfffffffe
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.140001470
mov rbx, qword [rsp + 0x490]
add rsp, 0x480
pop rdi
ret
mov rbx, qword [rbx + 0x20]
test rbx, rbx
je 0x1400013fb
lea rcx, [0x1400032bc]
call fcn.140001010
lea rdx, [0x140005050]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r9d, r9d
lea r8, str.dfddfddf
lea rdx, str.neat_1234
xor ecx, ecx
call rax
xor eax, eax
jmp 0x140001400