Function at 0x140003510
Capabilities:
Encode data using xor
Find process by pid
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov rdx, qword [rcx + 8]
xor eax, eax
xorps xmm0, xmm0
mov qword [rbp - 0x10], rax
mov rbx, rcx
lea rcx, [rbp - 0x30]
movups xmmword [rbp - 0x30], xmm0
lea r8d, [rax + 0x28]
movups xmmword [rbp - 0x20], xmm0
call fcn.140005db0
test al, al
je 0x14000367b
mov ecx, dword [rbp - 0x30]
lea rdx, [rbp + 0x20]
and qword [rbp + 0x20], 0
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x14000367b
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x20]
call fcn.140003b60
test rax, rax
je 0x14000367b
and qword [rbp + 0x28], 0
lea r9, [rbp + 0x28]
mov ecx, eax
mov edx, 0x1000
and ecx, 0xfff
sub edx, ecx
mov ecx, dword [rbp - 0x10]
cmp edx, ecx
cmovl ecx, edx
mov rdx, qword [rbx + 8]
movsxd r8, ecx
mov rcx, rax
mov rdx, qword [rdx + 0x18]
call fcn.140003fa0
test eax, eax
mov rax, qword [0x140008188]
jns 0x1400036a7
test rax, rax
jne 0x140003671
mov rdx, qword [0x1400081c0]
test rdx, rdx
jne 0x1400035e7
mov rdx, qword [0x1400080f8]
mov qword [0x1400081c0], rdx
movsxd rax, dword [rdx + 0x3c]
mov ecx, dword [rax + rdx + 0x88]
add rcx, rdx
mov r9d, dword [rcx + 0x1c]
mov r8d, dword [rcx + 0x20]
add r9, rdx
mov r10d, dword [rcx + 0x24]
add r8, rdx
mov ebx, dword [rcx + 0x18]
add r10, rdx
xor edx, edx
test ebx, ebx
je 0x140003667
movabs rsi, 0xcbf29ce484222325
movabs rdi, 0xb61941b7eb2f33e5
movabs r14, 0x100000001b3
mov ecx, dword [r8]
mov r11, rsi
add rcx, qword [0x1400081c0]
mov al, byte [rcx]
test al, al
je 0x14000365d
inc rcx
movsx rax, al
xor r11, rax
imul r11, r14
mov al, byte [rcx]
test al, al
jne 0x140003644
cmp r11, rdi
je 0x140003695
inc edx
add r8, 4
cmp edx, ebx
jb 0x140003631
int3
mov qword [0x140008188], rax
mov rcx, qword [rbp + 0x20]
call qword [0x140007080]
mov eax, 0xc0000001
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
movzx ecx, word [r10 + rdx*2]
mov eax, dword [r9 + rcx*4]
add rax, qword [0x1400081c0]
jmp 0x14000366a
test rax, rax
jne 0x140003754
mov rdx, qword [0x1400081c0]
test rdx, rdx
jne 0x1400036ca
mov rdx, qword [0x1400080f8]
mov qword [0x1400081c0], rdx
movsxd rax, dword [rdx + 0x3c]
mov ecx, dword [rax + rdx + 0x88]
add rcx, rdx
mov r9d, dword [rcx + 0x1c]
mov r8d, dword [rcx + 0x20]
add r9, rdx
mov r10d, dword [rcx + 0x24]
add r8, rdx
mov ebx, dword [rcx + 0x18]
add r10, rdx
xor edx, edx
test ebx, ebx
je 0x14000374a
movabs rsi, 0xcbf29ce484222325
movabs rdi, 0xb61941b7eb2f33e5
movabs r14, 0x100000001b3
mov ecx, dword [r8]
mov r11, rsi
add rcx, qword [0x1400081c0]
mov al, byte [rcx]
test al, al
je 0x140003740
inc rcx
movsx rax, al
xor r11, rax
imul r11, r14
mov al, byte [rcx]
test al, al
jne 0x140003727
cmp r11, rdi
je 0x140003765
inc edx
add r8, 4
cmp edx, ebx
jb 0x140003714
int3
mov qword [0x140008188], rax
mov rcx, qword [rbp + 0x20]
call qword [0x140007080]
xor eax, eax
jmp 0x140003680
movzx ecx, word [r10 + rdx*2]
mov eax, dword [r9 + rcx*4]
add rax, qword [0x1400081c0]
jmp 0x14000374d