Function at 0x140051a50
Capabilities:
Access peb ldr_data
Encode data using xor
Enumerate processes
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x118]
sub rsp, 0x1f0
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x140159680]
xor rax, rsp
mov qword [rbp + 0xd0], rax
call fcn.14004b650
call fcn.140042600
mov rcx, qword [0x14015a3a0]
call fcn.140042050
mov byte [rsp + 0x40], 0x35
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140051b36
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140051b36
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140051b31
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140051b10
cmp r8d, 0x9a9264ad
je 0x140051b3b
test r9d, r9d
jne 0x140051af0
mov rax, qword [rax]
jmp 0x140051ac0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov byte [rsp + 0x40], 0
lea rcx, [rsp + 0x40]
call rdx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x14015a438], eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x14015a43c], eax
mov eax, dword [0x1400ad9b0]
mov dword [rbp - 0x70], eax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140051c16
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140051c16
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov ecx, dword [rcx + rbx]
add rcx, r10
mov r8d, 0x811c9dc5
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140051c11
nop dword [rax]
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x140051bf0
cmp r8d, 0x491e0a9c
je 0x140051c1b
test r9d, r9d
jne 0x140051bd0
mov rax, qword [rax]
jmp 0x140051ba0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov r11d, dword [rcx + rax*4]
add r11, r10
xor r13d, r13d
mov r8d, r13d
movdqa xmm6, xmmword [0x1400adb30]
mov r14d, dword [0x1401596d8]
cmp r14d, 2
jl 0x140051cc1
movdqa xmm3, xmmword [0x14005c1b0]
movdqa xmm2, xmm3
punpckldq xmm2, xmm3
pmuldq xmm2, xmmword [0x1400adbe0]
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmmword [0x1400adbe0]
shufps xmm2, xmm0, 0xdd
paddd xmm2, xmm3
psrad xmm2, 5
movdqa xmm0, xmm2
psrld xmm0, 0x1f
paddd xmm0, xmm2
pmulld xmm0, xmmword [str.9999]
psubd xmm3, xmm0
andps xmm3, xmm6
packuswb xmm3, xmm3
packuswb xmm3, xmm3
paddb xmm3, xmmword [0x1400adb40]
movd xmm0, dword [rbp - 0x70]
xorps xmm3, xmm0
movd dword [rbp - 0x70], xmm3
jmp 0x140051d02
lea r9, [rbp - 0x70]
nop word [rax + rax]
mov eax, 0x1f7047dd
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
movzx eax, r8b
sub al, cl
add al, 0x35
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 4
jl 0x140051cd0
lea rcx, [rbp - 0x70]
call r11
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
mov r8d, 3
lea rcx, str..porndriverio
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x14015a008], rax
cmp qword [0x140159ff0], r13
jne 0x140051e18
lea r12, [rbp + 0x118]
movabs r14, 0xff00ff00ff00ff00
nop dword [rax + rax]
mov al, 0x57
mov cl, 0x7d
mov dl, 0x61
mov r8b, 0x60
mov r9b, 0x7b
mov r10b, 0x7f
mov r11b, 0x63
movzx ebx, cl
mov dil, 0x39
mov sil, 0x3a
xor r15d, r15d
xor al, 0x11
mov byte [rbp - 0x70], al
xor cl, 0x12
mov byte [rbp - 0x6f], cl
xor dl, 0x13
mov byte [rbp - 0x6e], dl
xor r8b, 0x14
mov byte [rbp - 0x6d], r8b
xor r9b, 0x15
mov byte [rbp - 0x6c], r9b
xor r10b, 0x16
mov byte [rbp - 0x6b], r10b
xor r11b, 0x17
mov byte [rbp - 0x6a], r11b
xor bl, 0x18
mov byte [rbp - 0x69], bl
xor dil, 0x19
mov byte [rbp - 0x68], dil
xor sil, 0x1a
mov byte [rbp - 0x67], sil
mov byte [rbp - 0x66], r15b
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x80], r12
mov rbx, qword [r12]
mov rax, rbx
xor rax, r14
mov qword [rsp + 0x70], rax
mov qword [r12], r13
mov rax, qword [0x14015a068]
lea rdx, [rbp - 0x70]
xor ecx, ecx
call rax
nop
mov qword [r12], rbx
mov qword [0x140159ff0], rax
test rax, rax
je 0x140051d60
mov r14d, dword [0x1401596d8]
movups xmm0, xmmword [str.sYELWSOYRV__6n]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [str.__qd]
movups xmmword [rsp + 0x58], xmm1
movzx eax, word [0x1400ad9d8]
mov word [rsp + 0x68], ax
mov r8d, r13d
cmp r14d, 2
jl 0x140051f6f
movdqa xmm4, xmmword [0x14005c1b0]
movdqa xmm3, xmmword [0x1400adbe0]
movdqa xmm5, xmmword [str.9999]
movdqa xmm0, xmmword [0x1400adb40]
movdqa xmmword [rsp + 0x70], xmm0
lea rcx, [rsp + 0x4c]
mov edx, dword [rsp + 0x70]
nop dword [rax + rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x20
jl 0x140051e80
cmp r8d, 0x22
jge 0x140051fb3
movsxd rax, r8d
lea r9, [rsp + 0x48]
add r9, rax
nop word [rax + rax]
mov eax, 0x8fb823ef
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x39
movzx eax, r8b
sub al, cl
add al, 0x35
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x22
jl 0x140051f80
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
mov dword [rbp - 0x60], 0x130
lea rdx, [rbp - 0x60]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x140052007
nop dword [rax]
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x34]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov rcx, rbx
test eax, eax
je 0x1400520c9
lea rdx, [rbp - 0x60]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x140051fe0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r13d
mov dword [0x14015a010], eax
mov qword [rbp - 0x70], r13
mov dword [rsp + 0x70], 0x85b3b69
mov dword [rsp + 0x74], eax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
mov r9d, 0x10
lea r8, [rsp + 0x70]
mov edx, 0x225918
mov rcx, qword [0x14015a008]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rax, qword [rbp - 0x70]
mov qword [0x14015a000], rax
mov rcx, qword [0x14015a3a8]
call fcn.140040e10
mov rcx, qword [0x14015a3a8]
call fcn.140041660
mov rcx, qword [0x14015a3a8]
call fcn.140050a10
xor eax, eax
mov rcx, qword [rbp + 0xd0]
xor rcx, rsp
call fcn.1400521e0
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp - 0x58]
jmp 0x140052013