Function at 0x1400030c0
Capabilities:
Encode data using xor
Find process by pid
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov rdx, qword [rcx + 8]
xor eax, eax
xorps xmm0, xmm0
mov qword [rbp - 0x10], rax
mov rbx, rcx
lea rcx, [rbp - 0x30]
movups xmmword [rbp - 0x30], xmm0
lea r8d, [rax + 0x28]
movups xmmword [rbp - 0x20], xmm0
call fcn.1400059c0
test al, al
je 0x14000322b
mov ecx, dword [rbp - 0x30]
lea rdx, [rbp + 0x20]
and qword [rbp + 0x20], 0
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x14000322b
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x20]
call fcn.1400036d0
test rax, rax
je 0x14000322b
and qword [rbp + 0x28], 0
lea r9, [rbp + 0x28]
mov ecx, eax
mov edx, 0x1000
and ecx, 0xfff
sub edx, ecx
mov ecx, dword [rbp - 0x10]
cmp edx, ecx
cmovl ecx, edx
mov rdx, qword [rbx + 8]
movsxd r8, ecx
mov rcx, rax
mov rdx, qword [rdx + 0x18]
call fcn.140003ba0
test eax, eax
mov rax, qword [0x140008170]
jns 0x140003257
test rax, rax
jne 0x140003221
mov rdx, qword [0x1400081a8]
test rdx, rdx
jne 0x140003197
mov rdx, qword [0x1400080e8]
mov qword [0x1400081a8], rdx
movsxd rax, dword [rdx + 0x3c]
mov ecx, dword [rax + rdx + 0x88]
add rcx, rdx
mov r9d, dword [rcx + 0x1c]
mov r8d, dword [rcx + 0x20]
add r9, rdx
mov r10d, dword [rcx + 0x24]
add r8, rdx
mov ebx, dword [rcx + 0x18]
add r10, rdx
xor edx, edx
test ebx, ebx
je 0x140003217
movabs rsi, 0xcbf29ce484222325
movabs rdi, 0xb61941b7eb2f33e5
movabs r14, 0x100000001b3
mov ecx, dword [r8]
mov r11, rsi
add rcx, qword [0x1400081a8]
mov al, byte [rcx]
test al, al
je 0x14000320d
inc rcx
movsx rax, al
xor r11, rax
imul r11, r14
mov al, byte [rcx]
test al, al
jne 0x1400031f4
cmp r11, rdi
je 0x140003245
inc edx
add r8, 4
cmp edx, ebx
jb 0x1400031e1
int3
mov qword [0x140008170], rax
mov rcx, qword [rbp + 0x20]
call qword [0x140007080]
mov eax, 0xc0000001
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
movzx ecx, word [r10 + rdx*2]
mov eax, dword [r9 + rcx*4]
add rax, qword [0x1400081a8]
jmp 0x14000321a
test rax, rax
jne 0x140003304
mov rdx, qword [0x1400081a8]
test rdx, rdx
jne 0x14000327a
mov rdx, qword [0x1400080e8]
mov qword [0x1400081a8], rdx
movsxd rax, dword [rdx + 0x3c]
mov ecx, dword [rax + rdx + 0x88]
add rcx, rdx
mov r9d, dword [rcx + 0x1c]
mov r8d, dword [rcx + 0x20]
add r9, rdx
mov r10d, dword [rcx + 0x24]
add r8, rdx
mov ebx, dword [rcx + 0x18]
add r10, rdx
xor edx, edx
test ebx, ebx
je 0x1400032fa
movabs rsi, 0xcbf29ce484222325
movabs rdi, 0xb61941b7eb2f33e5
movabs r14, 0x100000001b3
mov ecx, dword [r8]
mov r11, rsi
add rcx, qword [0x1400081a8]
mov al, byte [rcx]
test al, al
je 0x1400032f0
inc rcx
movsx rax, al
xor r11, rax
imul r11, r14
mov al, byte [rcx]
test al, al
jne 0x1400032d7
cmp r11, rdi
je 0x140003315
inc edx
add r8, 4
cmp edx, ebx
jb 0x1400032c4
int3
mov qword [0x140008170], rax
mov rcx, qword [rbp + 0x20]
call qword [0x140007080]
xor eax, eax
jmp 0x140003230
movzx ecx, word [r10 + rdx*2]
mov eax, dword [r9 + rcx*4]
add rax, qword [0x1400081a8]
jmp 0x1400032fd