Function at 0x140145b90
Capabilities:
Access peb ldr_data
Create thread
Encode data using xor
Get ntdll base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xf8]
sub rsp, 0x1d0
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x1402f9040]
xor rax, rsp
mov qword [rbp + 0xb0], rax
xor r12d, r12d
call fcn.1401465b0
call fcn.1401474e0
mov rbx, rax
call fcn.1401474e0
mov rdx, qword [rax + 0x38]
add rdx, 0x225bff8
mov rcx, rbx
call fcn.140149d20
movss dword [0x1403021a4], xmm0
movss xmm6, dword [0x1402c7ca4]
movabs rsi, 0xff2a35c4564644cd
movabs rdx, 0xa27870941e1d64c7
movabs r8, 0x3c755938586c70
movabs r9, 0xed2e9ad61804f709
movabs r13, 0xd68cb7a34b9b562a
movabs r14, 0x68a126c054fc7dbb
movabs r15, 0x23eb7d45b0769714
comiss xmm6, xmm0
jbe 0x140145d70
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x60], rax
movabs rax, 0x6e55012d51393b50
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x68], rax
movabs rax, 0x855abaa47762d76e
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x70], rax
movabs rax, 0xa2acd2ce2afc764f
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x78], rax
movabs rax, 0x46cf4fa7319e5dd4
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x80], rax
movabs rax, 0x23eb7d45b076973a
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x78], rax
mov qword [rsp + 0x30], rdx
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x50], rax
mov qword [rsp + 0x30], r8
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x58], rax
mov qword [rsp + 0x30], r9
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x60], rax
mov qword [rsp + 0x30], r13
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x68], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x70], rax
mov qword [rsp + 0x30], r15
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x78], rax
movdqa xmm0, xmmword [rsp + 0x60]
xorps xmm0, xmmword [rbp + 0x50]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [rsp + 0x70]
xorps xmm1, xmmword [rbp + 0x60]
movdqa xmmword [rsp + 0x70], xmm1
movdqa xmm0, xmmword [rbp - 0x80]
xorps xmm0, xmmword [rbp + 0x70]
movdqa xmmword [rbp - 0x80], xmm0
lea rdx, [rsp + 0x60]
call fcn.14003ea10
nop
cmp qword [0x140302798], 0
jne 0x140145dda
mov ecx, reloc.WS2_32.dll_recv
call fcn.14022f7fc
mov rdi, rax
mov qword [rsp + 0x30], rax
mov qword [rax], r12
mov dword [rax + 8], r12d
mov word [rax + 0xc], 0
mov rbx, qword [0x140302858]
call fcn.1401474e0
lea rdx, [rbx + 0x80]
mov rcx, rax
call fcn.140149b30
mov rbx, rax
call fcn.1401474e0
lea rdx, [rbx + 0x30]
mov rcx, rax
call fcn.140149bb0
cmp eax, 0x1ff
setne al
mov byte [rdi + 0xd], al
mov qword [0x140302798], rdi
call fcn.1401474e0
mov rbx, rax
call fcn.1401474e0
mov rdx, qword [rax + 0x38]
add rdx, 0x225bff8
mov rcx, rbx
call fcn.140149d20
movss dword [0x1403021a4], xmm0
comiss xmm6, xmm0
ja 0x140145d70
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x70], rax
movabs rax, 0x744f553c55392b50
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x68], rax
movabs rax, 0xe70ebbb27d708568
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x60], rax
movabs rax, 0xf6d1e5e61bd30d0a
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x58], rax
movabs rax, 0xdcc4fb431911cfc
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x50], rax
movabs rax, 0x23eb7d45b076b72e
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x48], rax
movabs rbx, 0xa27870941e1d64c7
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x80], rax
movabs rdi, 0x3c755938586c70
mov qword [rsp + 0x30], rdi
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x88], rax
movabs rsi, 0xed2e9ad61804f709
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x90], rax
mov qword [rsp + 0x30], r13
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x98], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0xa0], rax
mov qword [rsp + 0x30], r15
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0xa8], rax
movdqa xmm0, xmmword [rbp - 0x70]
xorps xmm0, xmmword [rbp + 0x80]
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [rbp - 0x60]
xorps xmm1, xmmword [rbp + 0x90]
movdqa xmmword [rbp - 0x60], xmm1
movdqa xmm0, xmmword [rbp - 0x50]
xorps xmm0, xmmword [rbp + 0xa0]
movdqa xmmword [rbp - 0x50], xmm0
lea rdx, [rbp - 0x70]
call fcn.14003ea10
movss xmm1, dword [0x1403021a4]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___float____ptr64]
mov rcx, rax
call fcn.1401358d0
cmp qword [0x140302840], 0
jne 0x14014636f
movabs r14, 0xa21f70f51e78648b
movabs r15, 0x53751a383d6c05
movabs r13, 0xed409ab71869f764
movabs r12, 0xd68cb7a34be8564e
nop word [rax + rax]
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x30], r15
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], r13
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x30], r12
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x30], rax
mov qword [rsp + 0x30], rdi
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x40], rax
movabs rax, 0xd68cb7a34b9b562a
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x48], rax
movdqa xmm0, xmmword [rsp + 0x40]
xorps xmm0, xmmword [rbp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [rsp + 0x50]
xorps xmm1, xmmword [rbp + 0x40]
movdqa xmmword [rsp + 0x50], xmm1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov rcx, qword [rcx + r10 + 0x88]
mov qword [rsp + 0x30], rcx
mov ebx, ecx
add rbx, r10
cmp rbx, r10
je 0x1401460d4
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1401460d4
mov r11d, dword [rbx + 0x20]
nop dword [rax]
dec r9d
lea rdx, [r11 + r9*4]
mov r8d, dword [rdx + r10]
add r8, r10
mov edx, 0x3e1a2044
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x1401460cf
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x1401460b0
cmp edx, 0xda98ff39
je 0x1401460d9
test r9d, r9d
jne 0x140146090
mov rax, qword [rax]
jmp 0x140146060
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
lea r8, [rsp + 0x40]
xor edx, edx
lea ecx, [rdx + 4]
call rax
mov rsi, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x14014633f
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop
mov r10, qword [rcx + 0x30]
movsxd rax, dword [r10 + 0x3c]
mov rax, qword [rax + r10 + 0x88]
mov qword [rsp + 0x30], rax
mov ebx, eax
add rbx, r10
cmp rbx, r10
je 0x140146194
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140146194
mov r11d, dword [rbx + 0x20]
nop dword [rax]
dec r9d
lea rdx, [r11 + r9*4]
mov r8d, dword [rdx + r10]
add r8, r10
mov edx, 0xa7103833
movzx eax, byte [r8]
inc r8
test al, al
je 0x14014618f
nop
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [r8]
lea r8, [r8 + 1]
test al, al
jne 0x140146170
cmp edx, 0xf839fec9
je 0x140146199
test r9d, r9d
jne 0x140146150
mov rcx, qword [rcx]
jmp 0x140146120
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
mov qword [rsp + 0x20], 8
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
mov rcx, rsi
call rax
mov rdi, rax
test rax, rax
je 0x140146285
mov rcx, qword [rax]
mov qword [0x140302840], rcx
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop
mov r10, qword [rcx + 0x30]
movsxd rax, dword [r10 + 0x3c]
mov rax, qword [rax + r10 + 0x88]
mov qword [rsp + 0x30], rax
mov ebx, eax
add rbx, r10
cmp rbx, r10
je 0x140146264
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140146264
mov r11d, dword [rbx + 0x20]
nop dword [rax]
dec r9d
lea rdx, [r11 + r9*4]
mov r8d, dword [rdx + r10]
add r8, r10
mov edx, 0x94af08e0
movzx eax, byte [r8]
inc r8
test al, al
je 0x14014625f
nop
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [r8]
lea r8, [r8 + 1]
test al, al
jne 0x140146240
cmp edx, 0xc5e8abc9
je 0x140146269
test r9d, r9d
jne 0x140146220
mov rcx, qword [rcx]
jmp 0x1401461f0
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
mov rcx, rdi
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov rcx, qword [rcx + r10 + 0x88]
mov qword [rsp + 0x30], rcx
mov ebx, ecx
add rbx, r10
cmp rbx, r10
je 0x140146314
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140146314
mov r11d, dword [rbx + 0x20]
nop dword [rax]
dec r9d
lea rdx, [r11 + r9*4]
mov r8d, dword [rdx + r10]
add r8, r10
mov edx, 0x2da9e98d
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x14014630f
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x1401462f0
cmp edx, 0x1fd3524d
je 0x140146319
test r9d, r9d
jne 0x1401462d0
mov rax, qword [rax]
jmp 0x1401462a0
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
mov rcx, rsi
call rax
movabs rdi, 0x3c755938586c70
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [0x140302840], 0
movabs rbx, 0xa27870941e1d64c7
movabs rsi, 0xed2e9ad61804f709
je 0x140145fb0
xor r12d, r12d
call fcn.140146c00
call fcn.140146640
mov rcx, rax
call fcn.1401be6c0
call fcn.140146640
mov rcx, rax
call fcn.1401bef20
call fcn.140146640
mov rcx, rax
call fcn.1401bf350
mov rax, qword [0x1403027b0]
test rax, rax
jne 0x1401463e3
mov ecx, 0x88
call fcn.14022f7fc
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x60], xmm0
movups xmmword [rax + 0x70], xmm0
mov qword [rax + 0x80], rcx
mov qword [0x1403027b0], rax
mov rcx, rax
call fcn.1401642a0
call fcn.1401a5570
call fcn.1400d02d0
mov ecx, 8
call fcn.14022f7fc
lea rcx, [0x1401c1e70]
mov qword [rax], rcx
mov qword [rbp - 0x38], rax
lea rcx, [rbp - 8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x140147340]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x10], rax
test rax, rax
je 0x14014659b
mov ecx, 8
call fcn.14022f7fc
lea rcx, [0x1401c1500]
mov qword [rax], rcx
mov qword [rbp - 0x38], rax
lea rcx, [rbp - 0x18]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x140147340]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x20], rax
test rax, rax
je 0x14014658b
mov ecx, 8
call fcn.14022f7fc
lea rcx, [0x1401c2240]
mov qword [rax], rcx
mov qword [rbp - 0x38], rax
lea rcx, [rbp - 0x28]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x140147340]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x30], rax
test rax, rax
je 0x14014657b
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
movabs rdi, 0x7ffffffffffe795e
movabs rbx, 0x7fffffffffffffff
nop dword [rax]
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp]
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x140146542
nop
lea rcx, [rbp]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp]
call qword [sym.imp.USER32.dll_DispatchMessageW]
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp]
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x140146510
lea rcx, [rbp - 0x40]
call fcn.14006f5f0
mov rax, qword [rbp - 0x40]
cmp rax, rdi
jg 0x140146569
add rax, 0x186a0
mov qword [rbp - 0x38], rax
lea rcx, [rbp - 0x38]
call fcn.14006f3a0
jmp 0x1401464f0
mov qword [rbp - 0x38], rbx
lea rcx, [rbp - 0x38]
call fcn.14006f3a0
jmp 0x1401464f0
mov dword [rbp - 0x28], r12d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x18], r12d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 8], r12d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3