Function at 0x1400c30c0
Capabilities:
Access peb ldr_data
Encode data using xor
Enumerate process modules
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x20c0]
mov eax, 0x21c0
call fcn.140175b70
sub rsp, rax
mov rax, qword [0x1401f6080]
xor rax, rsp
mov qword [rbp + 0x20b0], rax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r9, [rsp + 0x38]
mov r8d, 0x2000
lea rdx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x1400c34f4
xor esi, esi
mov r13d, esi
test dword [rsp + 0x38], 0xfffffff8
jbe 0x1400c34f4
nop dword [rax + rax]
mov ecx, r13d
mov r8d, 0x104
lea rdx, [rbp + 0x1fa0]
mov rcx, qword [rbp + rcx*8 - 0x60]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x1400c34de
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rsi
lea rax, [rbp + 0x1fa0]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x1400c3193
lea rdx, [rbp + 0x1fa0]
lea rcx, [rsp + 0x40]
call fcn.1400256b0
nop
mov rcx, qword [rsp + 0x50]
cmp rcx, 4
jb 0x1400c34d4
mov eax, dword [0x1401ce710]
mov dword [rsp + 0x30], eax
movzx eax, byte [0x1401ce714]
mov byte [rsp + 0x30], reloc.WLDAP32.dll_Ordinal_46
xor byte [rsp + 0x31], 0x33
xor byte [rsp + 0x32], 0x34
xor byte [rsp + 0x33], 0x35
xor al, 0x36
mov byte [rsp + 0x34], al
lea rdx, [rcx - 4]
cmp rcx, rdx
jb 0x1400c3524
lea rax, [rsp + 0x30]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400c3202
sub rcx, rdx
mov edi, 4
cmp rcx, rdi
cmovb rdi, rcx
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rcx, qword [rsp + 0x40]
add rcx, rdx
mov r8, rdi
cmp rbx, rdi
cmovb r8, rbx
lea rdx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400c34d4
cmp rdi, rbx
jae 0x1400c3256
mov eax, 0xffffffff
jmp 0x1400c325b
mov eax, esi
seta al
test eax, eax
jne 0x1400c34d4
lea rcx, [rsp + 0x40]
call fcn.1400c2320
test al, al
jne 0x1400c34d4
lea rcx, [rsp + 0x40]
call fcn.1400c25a0
test al, al
jne 0x1400c34d4
lea rcx, [rsp + 0x40]
call fcn.1400c2880
test al, al
jne 0x1400c34d4
lea rcx, [rsp + 0x40]
call fcn.1400c2df0
test al, al
jne 0x1400c34d4
lea rcx, [rsp + 0x40]
call fcn.1400c2b60
test al, al
jne 0x1400c34d4
movsd xmm0, qword [str.gdqu]
movsd qword [rsp + 0x20], xmm0
movzx eax, word [0x1401ce540]
mov word [rsp + 0x28], ax
cmp byte [0x1401ce541], 0
je 0x1400c3312
mov byte [rsp + 0x20], 0x55
xor byte [rsp + 0x21], 0x33
xor byte [rsp + 0x22], 0x34
xor byte [rsp + 0x23], 0x35
xor byte [rsp + 0x24], 0x36
xor byte [rsp + 0x25], 0x37
xor byte [rsp + 0x26], 0x38
xor byte [rsp + 0x27], 0x39
xor byte [rsp + 0x28], 0x3a
xor byte [rsp + 0x29], 0x3b
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rsi
lea rax, [rsp + 0x20]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x1400c3330
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.1400256b0
lea r15, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova r15, qword [rsp + 0x60]
lea rdi, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x50]
test rsi, rsi
jne 0x1400c338a
mov rbx, 0xffffffffffffffff
cmp r14, rbx
cmovb rbx, r14
jmp 0x1400c33d4
cmp rsi, r14
ja 0x1400c33ed
mov rax, r14
sub rax, rsi
mov rbx, 0xffffffffffffffff
cmp rax, rbx
cmovb rbx, rax
add rbx, rdi
movzx r12d, byte [r15]
nop word [rax + rax]
cmp byte [rbx], r12b
jne 0x1400c33c7
mov r8, rsi
mov rdx, r15
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400c33d1
cmp rbx, rdi
je 0x1400c33ed
dec rbx
jmp 0x1400c33b0
sub rbx, rdi
cmp rbx, 0xffffffffffffffff
je 0x1400c33ed
lea rax, [rsi + rbx]
cmp rax, r14
jne 0x1400c33ed
lea rcx, [rsp + 0x60]
jmp 0x1400c34ce
lea rcx, [rsp + 0x60]
call fcn.1400252b0
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x80]
call fcn.1400c1c20
nop
cmp qword [rbp - 0x70], 0
jne 0x1400c34ca
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400c34a6
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400c34a6
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
mov r8d, 0x811c9dc5
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1400c34a1
nop
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x1400c3480
cmp r8d, 0xcded1a85
je 0x1400c34ab
test r9d, r9d
jne 0x1400c3460
mov rax, qword [rax]
jmp 0x1400c3430
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rbx + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov ecx, 1
call rdx
nop
lea rcx, [rbp - 0x80]
call fcn.1400252b0
nop
lea rcx, [rsp + 0x40]
call fcn.1400252b0
inc r13d
mov eax, dword [rsp + 0x38]
shr eax, 3
cmp r13d, eax
jae 0x1400c34f4
xor esi, esi
jmp 0x1400c3150
mov rcx, qword [rbp + 0x20b0]
xor rcx, rsp
call fcn.140175100
lea r11, [rsp + 0x21c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400253e0
nop
int3