Function at 0x140001590
Capabilities:
Access peb ldr_data
Encode data using xor
Enumerate process modules
Execute command
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3d0]
sub rsp, 0x4d0
mov rax, qword [0x140005010]
xor rax, rsp
mov qword [rbp + 0x3c0], rax
xor r13d, r13d
mov r14d, r13d
mov dword [rsp + 0x30], r13d
mov rcx, qword [0x1400056f0]
call fcn.140001170
test al, al
jne 0x140001630
lea rcx, str.Failed_to_attach_to_ReadyOrNot_Win64__process.__n
call fcn.140001370
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea eax, [r13 - 1]
mov rcx, qword [rbp + 0x3c0]
xor rcx, rsp
call fcn.140001e00
lea r11, [rsp + 0x4d0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea rcx, str.Succeed_to_attach_to_ReadyOrNot_Win64__process.__n
call fcn.140001370
mov rdi, r13
mov qword [rsp + 0x38], r13
mov rax, qword [0x1400056f0]
mov edx, dword [rax + 0x18]
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400016c9
xor edx, edx
mov r8d, 0x234
lea rcx, [rbp - 0x4c]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp - 0x50], 0x238
lea rdx, [rbp - 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x1400016c0
nop dword [rax + rax]
lea rdx, [rbp - 0x20]
lea rcx, str.ReadyOrNot_Win64_Shipping.exe
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400016b7
lea rdx, [rbp - 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x140001690
jmp 0x1400016c0
mov rdi, qword [rbp - 0x38]
mov qword [rsp + 0x38], rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rdi + 0x67efad0]
mov qword [rsp + 0x78], rax
nop word [rax + rax]
mov qword [rbp - 0x80], r13
mov r9d, 8
lea r8, [rbp - 0x80]
mov rdx, rax
mov rcx, qword [0x1400056f0]
call fcn.140001030
test al, al
jne 0x14000170b
mov rsi, r13
mov ebx, 0x148
jmp 0x14000171b
mov rsi, qword [rbp - 0x80]
lea rbx, [rsi + 0x148]
test rbx, rbx
je 0x140001793
mov qword [rbp - 0x70], r13
mov r9d, 8
lea r8, [rbp - 0x70]
mov rdx, rbx
mov rcx, qword [0x1400056f0]
call fcn.140001030
mov r12, qword [rbp - 0x70]
test al, al
cmove r12, r13
mov qword [rsp + 0x68], r12
mov dword [rbp - 0x74], r13d
lea rdx, [rbx + 8]
mov r9d, 4
lea r8, [rbp - 0x74]
mov rcx, qword [0x1400056f0]
call fcn.140001030
mov r15d, dword [rbp - 0x74]
test al, al
cmove r15d, r13d
mov dword [rbp - 0x70], r15d
mov dword [rbp - 0x80], r13d
lea rdx, [rbx + 0xc]
mov r9d, 4
lea r8, [rbp - 0x80]
mov rcx, qword [0x1400056f0]
call fcn.140001030
jmp 0x14000179c
mov r15d, dword [rbp - 0x70]
mov r12, qword [rsp + 0x68]
mov ebx, r13d
test r15d, r15d
je 0x140001c64
mov edi, r13d
nop dword [rax + rax]
cmp r15d, ebx
jb 0x1400017e0
movsxd rdx, edi
add rdx, r12
mov qword [rbp - 0x80], r13
mov r9d, 8
lea r8, [rbp - 0x80]
mov rcx, qword [0x1400056f0]
call fcn.140001030
test al, al
je 0x1400017e0
cmp qword [rbp - 0x80], 0
ja 0x1400017f0
inc ebx
add edi, 8
cmp ebx, r15d
jae 0x140001c64
jmp 0x1400017b0
lea rdx, [rsi + 0x120]
xor r15d, r15d
mov qword [rbp - 0x80], r15
lea r9d, [r15 + 8]
lea r8, [rbp - 0x80]
mov rcx, qword [0x1400056f0]
call fcn.140001030
test al, al
je 0x140001c61
mov rbx, qword [rbp - 0x80]
test rbx, rbx
je 0x140001c61
add rbx, 0x238
je 0x1400018a1
mov qword [rbp - 0x80], r15
lea r9d, [r15 + 8]
lea r8, [rbp - 0x80]
mov rdx, rbx
mov rcx, qword [0x1400056f0]
call fcn.140001030
mov rsi, qword [rbp - 0x80]
test al, al
cmove rsi, r15
mov qword [rsp + 0x40], rsi
mov dword [rbp - 0x74], r15d
lea rdx, [rbx + 8]
lea r9d, [r15 + 4]
lea r8, [rbp - 0x74]
mov rcx, qword [0x1400056f0]
call fcn.140001030
mov ecx, dword [rbp - 0x74]
test al, al
cmove ecx, r15d
mov dword [rsp + 0x34], ecx
mov dword [rbp - 0x80], r15d
lea rdx, [rbx + 0xc]
lea r9d, [r15 + 4]
lea r8, [rbp - 0x80]
mov rcx, qword [0x1400056f0]
call fcn.140001030
jmp 0x1400018a6
mov rsi, qword [rsp + 0x40]
mov r13d, r15d
cmp dword [rsp + 0x34], r15d
jbe 0x140001c64
mov ebx, r15d
mov dword [rbp - 0x74], ebx
mov edi, dword [rsp + 0x34]
nop
cmp edi, r13d
jb 0x140001c4a
movsxd rdx, ebx
add rdx, rsi
mov qword [rbp - 0x80], r15
mov r9d, 8
lea r8, [rbp - 0x80]
mov rcx, qword [0x1400056f0]
call fcn.140001030
test al, al
je 0x140001c4a
mov rax, qword [rbp - 0x80]
test rax, rax
je 0x140001c4a
lea rdx, [rax + 0x280]
mov qword [rbp - 0x68], r15
mov r9d, 8
lea r8, [rbp - 0x68]
mov rcx, qword [0x1400056f0]
call fcn.140001030
mov rcx, qword [rbp - 0x68]
test al, al
cmove rcx, r15
mov qword [rsp + 0x70], rcx
lea rdx, [rcx + 0x18]
mov dword [rbp - 0x80], r15d
mov r9d, 4
lea r8, [rbp - 0x80]
mov rcx, qword [0x1400056f0]
call fcn.140001030
mov ecx, dword [rbp - 0x80]
test al, al
cmove ecx, r15d
mov eax, ecx
sar eax, 0x10
movzx ebx, cx
mov qword [rbp - 0x60], r15
lea ecx, [rax*8 + 0x10]
mov rdx, qword [rsp + 0x38]
add rdx, 0x666ed80
add rdx, rcx
mov r9d, 8
lea r8, [rbp - 0x60]
mov rcx, qword [0x1400056f0]
call fcn.140001030
mov rcx, qword [rbp - 0x60]
test al, al
cmove rcx, r15
lea rdi, [rcx + rbx*2]
mov word [rbp - 0x78], r15w
mov r9d, 2
lea r8, [rbp - 0x78]
mov rdx, rdi
mov rcx, qword [0x1400056f0]
call fcn.140001030
movzx ecx, word [rbp - 0x78]
test al, al
cmove cx, r15w
movsx eax, cx
sar eax, 6
test eax, eax
jle 0x140001a30
movsxd rbx, eax
lea rdx, [rdi + 2]
mov r9, rbx
lea r8, [rbp - 0x50]
mov rcx, qword [0x1400056f0]
call fcn.140001030
cmp rbx, 0x404
jae 0x140001c80
mov byte [rbp + rbx - 0x50], 0
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], 0xf
lea rax, [rbp - 0x50]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140001a20
lea rdx, [rbp - 0x50]
jmp 0x140001a4d
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], 0xf
xor r8d, r8d
lea rdx, [0x1400033b8]
lea rcx, [rsp + 0x48]
call fcn.140001c90
or r14d, 1
mov dword [rsp + 0x30], r14d
lea rdi, [rsp + 0x48]
mov r15, qword [rsp + 0x60]
cmp r15, 0x10
setae r12b
mov rsi, qword [rsp + 0x48]
cmovae rdi, rsi
mov rax, qword [rsp + 0x58]
cmp rax, 0xc
jb 0x140001adc
lea r14, [rax + rdi]
lea r8, [r14 - 0xb]
sub r8, rdi
mov rcx, rdi
mov edx, 0x42
call sub.VCRUNTIME140.dll_memchr
test rax, rax
mov rbx, rax
je 0x140001ad7
movabs rax, 0x79616c5065736142
cmp qword [rbx], rax
jne 0x140001abe
cmp dword [rbx + 8], 0x435f7265
je 0x140001acd
inc rbx
lea r8, [r14 - 0xb]
sub r8, rbx
mov rcx, rbx
jmp 0x140001a94
sub rbx, rdi
mov r14d, dword [rsp + 0x30]
jmp 0x140001ae3
mov r14d, dword [rsp + 0x30]
mov rbx, 0xffffffffffffffff
test r12b, r12b
je 0x140001b19
lea rdx, [r15 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140001b11
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001c79
mov rcx, rsi
call fcn.1400020ac
cmp rbx, 0xffffffffffffffff
je 0x140001c40
mov byte [rbp - 0x78], 1
mov r12, qword [rsp + 0x70]
mov rax, qword [0x1400056e8]
test rax, rax
jne 0x140001c06
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov r14d, dword [rcx + rbx + 0x88]
add r14, rbx
cmp r14, rbx
je 0x140001bd8
mov r11d, dword [r14 + 0x18]
test r11d, r11d
je 0x140001bd8
mov esi, dword [r14 + 0x20]
nop word [rax + rax]
dec r11d
lea rcx, [rbx + r11*4]
mov r9d, dword [rcx + rsi]
add r9, rbx
mov r10d, 0xcbd0ea0a
movzx ecx, byte [r9]
inc r9
test cl, cl
je 0x140001bd3
nop
movsx edx, cl
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
movzx ecx, byte [r9]
lea r9, [r9 + 1]
test cl, cl
jne 0x140001ba0
cmp r10d, 0x6343ac75
je 0x140001be0
test r11d, r11d
jne 0x140001b80
mov rax, qword [rax]
jmp 0x140001b50
mov ecx, dword [r14 + 0x24]
add rcx, rbx
movzx r9d, word [rcx + r11*2]
mov ecx, dword [r14 + 0x1c]
add rcx, rbx
mov eax, dword [rcx + r9*4]
add rax, rbx
mov qword [0x1400056e8], rax
mov r14d, dword [rsp + 0x30]
mov qword [rsp + 0x20], 0
mov r9d, 1
lea r8, [rbp - 0x78]
lea rdx, [r12 + 0xe5d]
mov rcx, qword [0x1400056f0]
mov rcx, qword [rcx + 0x10]
call rax
mov r8, r12
mov edx, r13d
lea rcx, str.__d__PlayerPawnAddress_____llx__n
call fcn.140001370
xor r15d, r15d
mov edi, dword [rsp + 0x34]
mov ebx, dword [rbp - 0x74]
inc r13d
add ebx, 8
mov dword [rbp - 0x74], ebx
cmp r13d, edi
mov rsi, qword [rsp + 0x40]
jb 0x1400018c0
xor r13d, r13d
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [rsp + 0x78]
jmp 0x1400016e0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400021bc
int3