Function at 0x1400366f0
Capabilities:
Encode data using xor
Get graphical window text
Get hostname
Get session user name
Get system information on windows
Hash data using fnv

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x2a60
call fcn.140046640
sub rsp, rax
mov rax, qword [0x1400a13c0]
xor rax, rsp
mov qword [rsp + 0x2a58], rax
mov rax, qword [0x1400b2bc0]
cmp rax, qword [0x1400bf060]
jbe 0x14003738f
lea rcx, [rax + 0x9c4]
mov qword [0x1400bf060], rcx
cmp byte [0x14013eb44], 0
jne 0x14003732c
mov dword [0x1400be960], 0x3f
lea rcx, [0x1400be960]
mov dword [rsp + 0x38], 0x100
lea rdx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [0x1400beb60], 0x3f
lea rcx, [0x1400beb60]
mov dword [rsp + 0x34], 0x100
lea rdx, [rsp + 0x34]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
call fcn.1400373f0
cmp byte [0x14013eb6a], 1
je 0x1400367c9
mov byte [0x14013eb6a], 1
movabs rax, 0x3233697061766441
mov qword [0x14013eb5c], rax
mov dword [0x14013eb64], 0x6c6c642e
mov word [0x14013eb68], 0x4500
lea rcx, [0x14013eb5c]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rsi, rax
test rax, rax
jne 0x14003682b
cmp byte [0x14013eb79], 1
je 0x140036812
mov byte [0x14013eb79], 1
movabs rax, 0x3233697061766441
mov qword [0x14013eb6b], rax
mov dword [0x14013eb73], 0x6c6c642e
mov word [0x14013eb77], 0x7900
lea rcx, [0x14013eb6b]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x140036b51
xor eax, eax
xor ecx, ecx
xchg rbx, r8
cpuid
xchg rbx, r8
mov dword [0x1400b5f68], 0x1000193
mov dword [rsp + 0xa50], eax
mov dword [rsp + 0xa54], r8d
mov dword [rsp + 0xa58], ecx
mov dword [rsp + 0xa5c], edx
test eax, eax
jle 0x1400368c4
mov r9d, 1
lea r8, [rsp + 0xa5c]
lea eax, [r9 - 1]
xor ecx, ecx
xchg rbx, r10
cpuid
xchg rbx, r10
mov dword [r8 - 0xc], eax
mov dword [r8 - 8], r10d
mov dword [r8 - 4], ecx
mov dword [r8], edx
movsxd rax, dword [rsp + 0xa50]
cmp r9, rax
jge 0x1400368ae
lea rax, [r9 + 1]
add r8, 0x10
cmp r9, 0x200
mov r9, rax
jne 0x140036870
mov r8d, dword [rsp + 0xa54]
mov ecx, dword [rsp + 0xa58]
mov edx, dword [rsp + 0xa5c]
xorps xmm0, xmm0
movaps xmmword [rsp + 0xa40], xmm0
movaps xmmword [rsp + 0xa30], xmm0
movaps xmmword [rsp + 0xa20], xmm0
movaps xmmword [rsp + 0xa10], xmm0
movaps xmmword [rsp + 0xa00], xmm0
movaps xmmword [rsp + 0x9f0], xmm0
mov dword [rsp + 0xa30], r8d
mov dword [rsp + 0xa34], edx
mov dword [rsp + 0xa38], ecx
mov eax, 0x80000000
xor ecx, ecx
xchg rbx, r8
cpuid
xchg rbx, r8
test eax, eax
js 0x140036cfa
mov qword [rsp + 0x130], 0x20
lea rdi, [rsp + 0x9b0]
lea rdx, [rsp + 0xa30]
lea r8, [rsp + 0x130]
mov rcx, rdi
call fcn.140014690
mov qword [rsp + 0x130], 0x40
lea rbx, [rsp + 0x930]
lea rdx, [rsp + 0x9f0]
lea r8, [rsp + 0x130]
mov rcx, rbx
call fcn.140014690
lea r14, [rsp + 0x130]
mov r8d, 0x800
mov rcx, r14
xor edx, edx
call fcn.14003d750
mov qword [rsp + 0x20], rbx
lea r8, [0x140092c0e]
mov edx, 0x400
mov rcx, r14
mov r9, rdi
call fcn.1400130d0
cmp byte [0x14013eb96], 0
jne 0x1400369e1
mov byte [0x14013eb96], 1
movaps xmm0, xmmword [0x14008d840]
movaps xmmword [0x14013eb80], xmm0
mov dword [0x14013eb90], 0x57656c69
mov word [0x14013eb94], 0x4900
lea rdx, [0x14013eb80]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x14013eb58]
mov edx, dword [0x1400a264c]
mov r8, qword gs:[0x58]
mov rdx, qword [r8 + rdx*8]
cmp ecx, dword [rdx + 4]
jg 0x1400373b2
test rax, rax
je 0x140036a6b
lea rcx, [rsp + 0x3c]
call qword [0x14013eb50]
test eax, eax
je 0x140036a6b
lea rdi, [rsp + 0x8e]
lea rsi, [rsp + 0x40]
lea rcx, [rsp + 0x130]
call fcn.14005c350
mov edx, 0x800
sub rdx, rax
lea rcx, [rsp + rax*2]
add rcx, 0x130
mov qword [rsp + 0x20], rdi
lea r8, [0x140092c0e]
mov r9, rsi
call fcn.1400130d0
lea rcx, [rsp + 0x130]
call fcn.14005c350
test rax, rax
je 0x140036b51
mov ecx, dword [0x1400b5f68]
cmp rax, 8
jb 0x140036b20
mov rdx, rax
shr rdx, 3
lea r8, [rsp + 0x13e]
movzx r9d, word [r8 - 0xe]
xor r9d, ecx
imul ecx, r9d, 0x1000193
movzx r9d, word [r8 - 0xc]
xor r9d, ecx
imul ecx, r9d, 0x1000193
movzx r9d, word [r8 - 0xa]
xor r9d, ecx
imul ecx, r9d, 0x1000193
movzx r9d, word [r8 - 8]
xor r9d, ecx
imul ecx, r9d, 0x1000193
movzx r9d, word [r8 - 6]
xor r9d, ecx
imul ecx, r9d, 0x1000193
movzx r9d, word [r8 - 4]
xor r9d, ecx
imul ecx, r9d, 0x1000193
movzx r9d, word [r8 - 2]
xor r9d, ecx
imul ecx, r9d, 0x1000193
movzx r9d, word [r8]
xor r9d, ecx
imul ecx, r9d, 0x1000193
add r8, 0x10
dec rdx
jne 0x140036aa0
mov rdx, rax
and rdx, 0xfffffffffffffff8
cmp rdx, rax
je 0x140036b4b
nop dword [rax]
movzx r8d, word [rsp + rdx*2 + 0x130]
xor r8d, ecx
imul ecx, r8d, 0x1000193
inc rdx
cmp rax, rdx
jne 0x140036b30
mov dword [0x1400b5f68], ecx
call fcn.140037480
mov dword [0x1400bef60], 0x3f
cmp byte [0x14013ebc0], 1
je 0x140036b7e
mov byte [0x14013ebc0], 1
movaps xmm0, xmmword [0x14008d850]
movaps xmmword [0x14013ebb0], xmm0
lea rcx, [0x1400914f1]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x14013ebb0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14013eb98], rax
test rax, rax
je 0x14003731e
cmp byte [0x14013ebe5], 0
jne 0x140036bda
mov byte [0x14013ebe5], 1
movaps xmm0, xmmword [0x14008d860]
movaps xmmword [0x14013ebd0], xmm0
mov dword [0x14013ebe0], 0x6f666e
mov byte [0x14013ebe4], 0x80
lea rcx, [0x1400914f1]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x14013ebd0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14013eba0], rax
test rax, rax
je 0x14003731e
xorps xmm0, xmm0
movups xmmword [rsp + 0xad4], xmm0
movups xmmword [rsp + 0xac4], xmm0
movups xmmword [rsp + 0xab4], xmm0
movups xmmword [rsp + 0xaa4], xmm0
movups xmmword [rsp + 0xa94], xmm0
movups xmmword [rsp + 0xa84], xmm0
movups xmmword [rsp + 0xa74], xmm0
movups xmmword [rsp + 0xa64], xmm0
movups xmmword [rsp + 0xa54], xmm0
mov qword [rsp + 0xae4], 0
mov dword [rsp + 0xa50], 0x9c
cmp byte [0x14013ebf5], 1
je 0x140036ca4
mov byte [0x14013ebf5], 1
movabs rax, 0x65567465476c7452
mov qword [0x14013ebe6], rax
mov dword [0x14013ebee], 0x6f697372
mov word [0x14013ebf2], 0x6e
mov byte [0x14013ebf4], 0xdb
lea rcx, [0x1400914c5]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x14013ebe6]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14013eba8], rax
test rax, rax
je 0x14003731e
lea rcx, [rsp + 0xa50]
call rax
mov rax, qword [0x14013eba0]
lea rcx, [rsp + 0x130]
test rax, rax
je 0x140036dcb
call rax
jmp 0x140036dd1
mov edi, eax
mov eax, 0x80000000
xor ecx, ecx
xchg rbx, r8
cpuid
xchg rbx, r8
lea rbx, [rsp + 0xa10]
lea r14, [rsp + 0xa00]
mov dword [rsp + 0xa50], eax
mov dword [rsp + 0xa54], r8d
mov dword [rsp + 0xa58], ecx
mov dword [rsp + 0xa5c], edx
mov ebp, 0x80000001
lea r15, [rsp + 0xa50]
lea r12, [rsp + 0x9f0]
jmp 0x140036d63
mov r8d, 0x10
mov rcx, r14
mov rdx, r15
call fcn.14002d160
inc ebp
cmp ebp, edi
ja 0x140036924
mov eax, ebp
xor ecx, ecx
xchg rbx, r8
cpuid
xchg rbx, r8
mov dword [rsp + 0xa50], eax
mov dword [rsp + 0xa54], r8d
mov dword [rsp + 0xa58], ecx
mov dword [rsp + 0xa5c], edx
cmp ebp, 0x80000004
je 0x140036dc0
cmp ebp, 0x80000003
je 0x140036d50
cmp ebp, 0x80000002
jne 0x140036d61
mov r8d, 0x10
mov rcx, r12
jmp 0x140036d59
mov r8d, 0x10
mov rcx, rbx
jmp 0x140036d59
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0xa54]
cmp eax, 5
je 0x140036e63
cmp eax, 6
je 0x140036e21
cmp eax, 0xa
jne case.default.0x140036e40
cmp dword [rsp + 0xa58], 0
jne case.default.0x140036e40
cmp dword [rsp + 0xa5c], 0x55ed
jb 0x140036f4c
lea rcx, [0x1400bef60]
lea r8, [0x140094d56]
jmp 0x140037022
mov eax, dword [rsp + 0xa58]
cmp rax, 3
ja case.default.0x140036e40
lea rcx, [0x14008f9d4]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
cmp byte [rsp + 0xaea], 1
jne 0x140036fd4
lea rcx, [0x1400bef60]
lea r8, [0x140094cc0]
jmp 0x140037022
mov eax, dword [rsp + 0xa58]
cmp eax, 1
je 0x140036e9e
cmp eax, 2
jne case.default.0x140036e40
mov ecx, 0x59
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x140036f8b
lea rcx, [0x1400bef60]
lea r8, str.2003_R2
jmp 0x140037022
lea rdi, [0x1400bef60]
lea r8, [0x140094cd6]
mov esi, 0x80
mov edx, 0x80
mov rcx, rdi
call fcn.1400130d0
movzx ebx, word [rsp + 0xae8]
mov rcx, rdi
call fcn.14005c350
sub rsi, rax
lea rcx, [rdi + rax*2]
test ebx, 0x200
jne 0x140036f7c
lea r8, [0x14009320e]
jmp 0x140036f83
cmp byte [rsp + 0xaea], 1
jne 0x140036fc4
lea rcx, [0x1400bef60]
lea r8, [0x140094ce4]
jmp 0x140037022
cmp byte [rsp + 0xaea], 1
jne 0x140036f69
lea rcx, [0x1400bef60]
lea r8, str.8.1
jmp 0x140037022
cmp byte [rsp + 0xaea], 1
jne 0x140036fe4
lea rcx, [0x1400bef60]
lea r8, [0x140094cea]
jmp 0x140037022
cmp byte [rsp + 0xaea], 1
jne 0x140036f69
lea rcx, [0x1400bef60]
lea r8, [0x140094d68]
jmp 0x140037022
lea rcx, [0x1400bef60]
lea r8, [0x140094cf0]
jmp 0x140037022
lea r8, str.Home
mov rdx, rsi
jmp 0x140037027
movzx eax, word [rsp + 0xae8]
test eax, 0x2000
jne 0x140036ff4
test ax, ax
js 0x140037004
cmp byte [rsp + 0xaea], 1
jne 0x140037014
cmp word [rsp + 0x130], 9
jne 0x140037014
lea rcx, [0x1400bef60]
lea r8, str.XP_Pro_x64
jmp 0x140037022
lea rcx, [0x1400bef60]
lea r8, str.2012
jmp 0x140037022
lea rcx, [0x1400bef60]
lea r8, str.2008
jmp 0x140037022
lea rcx, [0x1400bef60]
lea r8, str.2008_R2
jmp 0x140037022
lea rcx, [0x1400bef60]
lea r8, str.SS_2003
jmp 0x140037022
lea rcx, [0x1400bef60]
lea r8, [0x140094cce]
jmp 0x140037022
lea rcx, [0x1400bef60]
lea r8, [0x140094d1a]
mov edx, 0x80
call fcn.1400130d0
mov dword [rsp + 0x3c], 0
mov rax, qword [0x14013eb98]
test rax, rax
je case.0x14003708d.5
movzx r9d, word [rsp + 0xae6]
movzx r8d, word [rsp + 0xae4]
mov ecx, dword [rsp + 0xa54]
mov edx, dword [rsp + 0xa58]
lea r10, [rsp + 0x3c]
mov qword [rsp + 0x20], r10
call rax
mov eax, dword [rsp + 0x3c]
dec eax
cmp eax, 0x2f
ja case.0x14003708d.5
lea rcx, [0x14008f9e4]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
lea rsi, [0x1400bef60]
mov rcx, rsi
call fcn.14005c350
mov edx, 0x80
sub rdx, rax
lea rcx, [rsi + rax*2]
lea r8, [0x1400945fc]
jmp 0x1400372a3
lea rsi, [0x1400bef60]
mov rcx, rsi
call fcn.14005c350
mov edx, 0x80
sub rdx, rax
lea rcx, [rsi + rax*2]
lea r8, str.Datacenter
jmp 0x1400372a3
lea rsi, [0x1400bef60]
mov rcx, rsi
call fcn.14005c350
mov edx, 0x80
sub rdx, rax
lea rcx, [rsi + rax*2]
lea r8, str.Standard
jmp 0x1400372a3
lea rsi, [0x1400bef60]
mov rcx, rsi
call fcn.14005c350
mov edx, 0x80
sub rdx, rax
lea rcx, [rsi + rax*2]
lea r8, str.Starter
jmp 0x1400372a3
lea rsi, [0x1400bef60]
mov rcx, rsi
call fcn.14005c350
mov edx, 0x80
sub rdx, rax
lea rcx, [rsi + rax*2]
lea r8, str.Business
jmp 0x1400372a3
lea rsi, [0x1400bef60]
mov rcx, rsi
call fcn.14005c350
mov edx, 0x80
sub rdx, rax
lea rcx, [rsi + rax*2]
lea r8, str.Home
jmp 0x1400372a3
lea rsi, [0x1400bef60]
mov rcx, rsi
call fcn.14005c350
mov edx, 0x80
sub rdx, rax
lea rcx, [rsi + rax*2]
lea r8, str.Enterprise
jmp 0x1400372a3
lea rsi, [0x1400bef60]
mov rcx, rsi
call fcn.14005c350
mov edx, 0x80
sub rdx, rax
lea rcx, [rsi + rax*2]
lea r8, str.Web_Server
jmp 0x1400372a3
lea rsi, [0x1400bef60]
mov rcx, rsi
call fcn.14005c350
mov edx, 0x80
sub rdx, rax
lea rcx, [rsi + rax*2]
lea r8, [0x140092a1e]
jmp 0x1400372a3
lea rsi, [0x1400bef60]
mov rcx, rsi
call fcn.14005c350
mov edx, 0x80
sub rdx, rax
lea rcx, [rsi + rax*2]
lea r8, str.Cluster
jmp 0x1400372a3
lea rsi, [0x1400bef60]
mov rcx, rsi
call fcn.14005c350
mov edx, 0x80
sub rdx, rax
lea rcx, [rsi + rax*2]
lea r8, str.HomePrem
jmp 0x1400372a3
lea rsi, [0x1400bef60]
mov rcx, rsi
call fcn.14005c350
mov edx, 0x80
sub rdx, rax
lea rcx, [rsi + rax*2]
lea r8, [0x14009320e]
jmp 0x1400372a3
lea rsi, [0x1400bef60]
mov rcx, rsi
call fcn.14005c350
mov edx, 0x80
sub rdx, rax
lea rcx, [rsi + rax*2]
lea r8, str.Small_Business_Server
jmp 0x1400372a3
lea rsi, [0x1400bef60]
mov rcx, rsi
call fcn.14005c350
mov edx, 0x80
sub rdx, rax
lea rcx, [rsi + rax*2]
lea r8, str.SBSP
call fcn.1400130d0
cmp byte [rsp + 0xa64], 0
je 0x1400372ed
lea rcx, [rsp + 0xa64]
call fcn.14002d1d0
lea rsi, [0x1400bef60]
mov rcx, rsi
call fcn.14005c350
mov edx, 0x80
sub rdx, rax
lea rcx, [rsi + rax*2]
lea r8, str.__ws
lea r9, [0x1400a5da0]
call fcn.1400130d0
mov esi, dword [rsp + 0xa5c]
lea rdi, [0x1400bef60]
mov rcx, rdi
call fcn.14005c350
mov edx, 0x80
sub rdx, rax
lea rcx, [rdi + rax*2]
lea r8, str.___i_
mov r9d, esi
call fcn.1400130d0
mov byte [0x14013eb44], 1
mov rax, qword [0x1400b2bc0]
cmp rax, qword [0x14013eb48]
jbe 0x14003737b
add rax, 0x3e8
mov qword [0x14013eb48], rax
mov dword [0x1400bed60], 0x3f
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x14003737b
lea rdx, [0x1400bed60]
mov rcx, rax
mov r8d, 0xff
call qword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jne 0x14003737b
mov dword [0x1400bed60], 0x3f
lea rcx, [rsp + 0xa50]
call qword [sym.imp.USER32.dll_GetLastInputInfo]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [rsp + 0x2a58]
xor rcx, rsp
call fcn.140046610
nop
add rsp, 0x2a60
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, [0x14013eb58]
mov rsi, rax
call fcn.140044c04
mov rax, rsi
cmp dword [0x14013eb58], 0xffffffff
jne 0x140036a16
mov qword [0x14013eb50], rax
lea rcx, [0x14013eb58]
call fcn.140044cb8
mov rax, rsi
jmp 0x140036a16