Function at 0x140010c00
Capabilities:
Access peb ldr_data
Encode data using xor
Get kernel32 base address
Get process filename
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 8], rcx
push r14
sub rsp, 0x120
movabs rcx, 0x818e9899e0b682a7
movabs rdx, 0xc17dda2e6f030b5a
mov qword [rsp + 0x90], rdx
movabs rax, 0xcf4db420579da135
mov qword [rsp + 0x30], rax
movabs r11, 0xae1d945232ebce76
mov qword [rsp + 0x98], rcx
movabs rax, 0x41faa68d8be44704
mov qword [rsp + 0x38], rax
movabs r10, 0x399be0ada6c42263
mov qword [rsp + 0x58], rcx
movabs rax, 0x3c165c81c0f8a498
mov qword [rsp + 0x40], rax
movabs r9, 0x6c362ee4b697e7b8
mov qword [rsp + 0x70], r11
movabs rax, 0xd87fb342fe6b0c7c
mov qword [rsp + 0x48], rax
movabs r8, 0xac16d707de0e6b1d
vmovups ymm0, ymmword [rsp + 0x30]
vmovups ymmword [rsp + 0xf0], ymm0
mov qword [rsp + 0x78], r10
movabs rax, 0xc17dda2e6f037935
vpxor xmm0, xmm0, xmmword [rsp + 0x70]
mov qword [rsp + 0x50], rax
movabs rax, 0xa9b90c0c24a995c
mov qword [rsp + 0x60], rax
movabs rax, 0x23acb6539d0c6b21
mov qword [rsp + 0x68], rax
movabs rax, 0x9e2da4620893a837
mov qword [rsp + 0x70], rax
movabs rax, 0x7fdfd99a90826454
mov qword [rsp + 0x78], rax
movabs rax, 0x5c0c4cde86a7d788
vmovdqu xmmword [rsp + 0xf0], xmm0
vmovdqu xmm0, xmmword [rsp + 0x90]
mov qword [rsp + 0x80], r9
mov qword [rsp + 0x88], r8
vmovdqu xmm1, xmmword [rsp + 0x80]
vpxor xmm2, xmm1, xmmword [rsp + 0x100]
vpxor xmm1, xmm0, xmmword [rsp + 0x50]
mov qword [rsp + 0x80], rax
movabs rax, 0x9c26e737ee3e5b2d
mov qword [rsp + 0x88], rax
movabs rax, 0xfb4eea1e5f323b6a
mov qword [rsp + 0x90], rax
movabs rax, 0xb1bea8a9d086b297
mov qword [rsp + 0x98], rax
movabs rax, 0x3caba0f0f27aa96c
vmovdqu xmmword [rsp + 0x110], xmm1
vmovups ymm1, ymmword [rsp + 0x70]
vmovups ymmword [rsp + 0xb0], ymm1
mov qword [rsp + 0xa0], rax
movabs rax, 0x239c8663ad3c5b1b
vmovdqu xmmword [rsp + 0x100], xmm2
mov qword [rsp + 0xa8], rax
vmovups ymm3, ymmword [rsp + 0x90]
mov rax, qword [0x14025cee8]
vmovups ymmword [rsp + 0xd0], ymm3
mov qword [rsp + 0x50], rdx
lea rdx, [rsp + 0xf0]
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0xb0]
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x48], r8
vmovdqu xmm2, xmmword [rsp + 0x40]
vpxor xmm0, xmm2, xmmword [rsp + 0xc0]
vmovdqu xmm2, xmmword [rsp + 0x60]
vmovdqu xmmword [rsp + 0xc0], xmm0
vpxor xmm0, xmm2, xmmword [rsp + 0xe0]
mov qword [rsp + 0x30], r11
mov qword [rsp + 0x38], r10
vpxor xmm1, xmm1, xmmword [rsp + 0x30]
vmovdqu xmmword [rsp + 0xb0], xmm1
vpxor xmm1, xmm3, xmmword [rsp + 0x50]
vmovdqu xmmword [rsp + 0xe0], xmm0
vmovdqu xmmword [rsp + 0xd0], xmm1
vzeroupper
call rax
mov rsi, rax
mov qword [rsp + 0x130], 0
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
lea rax, [rsp + 0x130]
xor edx, edx
lea r9, [0x140168060]
mov qword [rsp + 0x20], rax
mov r8d, 1
lea rcx, [0x140168070]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov rcx, qword gs:[0x60]
mov r14d, eax
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax]
mov r10, qword [rcx + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov edi, dword [rdx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140010f47
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140010f47
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rax, [r10 + r9*4]
mov eax, dword [rax + rbx]
add rax, r10
movzx edx, byte [rax]
inc rax
test dl, dl
je 0x140010f42
nop dword [rax]
movsx edx, dl
lea rax, [rax + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rax - 1]
test dl, dl
jne 0x140010f20
cmp r8d, 0xf50944d9
je 0x140010f4c
test r9d, r9d
jne 0x140010f00
mov rcx, qword [rcx]
jmp 0x140010ed0
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rdx, [0x14025ca60]
add rax, r10
mov rcx, rsi
call rax
mov ecx, dword [0x14025ca60]
xor r8d, r8d
mov rdx, rsi
call fcn.140010300
test r14d, r14d
jne 0x140010fa4
mov rcx, qword [rsp + 0x130]
mov rdx, rsi
mov rax, qword [rcx]
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
mov rcx, qword [rsp + 0x130]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret