Function at 0x14006db60
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Check for peb beingdebugged flag
Encode data using xor
Execute shellcode via indirect call
Get number of processors
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
sub rsp, 0x40
mov rax, qword [0x14033c680]
xor rax, rsp
mov qword [rsp + 0x28], rax
xor ecx, ecx
call fcn.14023fd18
mov rcx, rax
call fcn.140233d58
call fcn.140068c90
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea r9, [rsp + 0x20]
nop
lea rcx, [fcn.140068c90]
nop
xor r15d, r15d
nop
mov edx, 0x100
nop
nop
nop
nop
nop
lea r8d, [r15 + 0x40]
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea edx, [r15 - 0x70]
mov r8d, 0xf7
lea rcx, [fcn.140068c90]
call fcn.140263d80
mov r8d, dword [rsp + 0x20]
lea rax, [fcn.140068c90]
mov byte [rax + 0xf7], 0x66
lea r9, [rsp + 0x24]
lea rax, [fcn.140068c90]
mov dword [rsp + 0x24], r15d
mov byte [rax + 0xf8], 0xb8
lea rcx, [fcn.140068c90]
lea rax, [fcn.140068c90]
mov edx, 0x100
mov byte [rax + 0xf9], 0xeb
lea rax, [fcn.140068c90]
mov byte [rax + 0xfa], 5
lea rax, [fcn.140068c90]
mov byte [rax + 0xfb], gethostname
lea rax, [fcn.140068c90]
mov byte [rax + 0xfc], 0xc0
lea rax, [fcn.140068c90]
mov byte [rax + 0xfd], reloc.WS2_32.dll_WSACleanup
lea rax, [fcn.140068c90]
mov byte [rax + 0xfe], 0xfa
lea rax, [fcn.140068c90]
mov byte [rax + 0xff], 0xe8
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rcx, [0x14006b780]
call fcn.140068380
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea r9, [rsp + 0x20]
nop
lea r8d, [r15 + 0x40]
nop
lea rcx, [fcn.140068380]
nop
mov edx, 0x100
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea edx, [r15 - 0x70]
mov r8d, 0xf7
lea rcx, [fcn.140068380]
call fcn.140263d80
lea rax, [fcn.140068380]
mov byte [rax + 0xf7], 0x66
lea rax, [fcn.140068380]
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x24]
mov byte [rax + 0xf8], 0xb8
lea rcx, [fcn.140068380]
lea rax, [fcn.140068380]
mov dword [rsp + 0x24], r15d
mov byte [rax + 0xf9], 0xeb
mov edx, 0x100
lea rax, [fcn.140068380]
mov byte [rax + 0xfa], 5
lea rax, [fcn.140068380]
mov byte [rax + 0xfb], gethostname
lea rax, [fcn.140068380]
mov byte [rax + 0xfc], 0xc0
lea rax, [fcn.140068380]
mov byte [rax + 0xfd], reloc.WS2_32.dll_WSACleanup
lea rax, [fcn.140068380]
mov byte [rax + 0xfe], 0xfa
lea rax, [fcn.140068380]
mov byte [rax + 0xff], 0xe8
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, qword gs:[0x60]
mov dword [0x140346450], r15d
cmp byte [rax + 2], r15b
jne 0x14006e1ae
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x60], rsi
nop word [rax + rax]
xor ecx, ecx
mov edx, 0x4d0
mov r8d, 0x1000
mov r14d, r15d
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbp, rax
test rax, rax
je 0x14006e150
mov rdi, rax
mov ecx, 0x4d0
xor eax, eax
rep stosb byte [rdi], al
mov dword [rbp + 0x30], 0x100010
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop word [rax + rax]
mov r9, qword [rcx + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x14006e044
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x14006e044
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
mov edi, 0x4525ad60
lea rax, [r9 + r8*4]
mov eax, dword [rax + r11]
add rax, r9
movzx edx, byte [rax]
inc rax
test dl, dl
je 0x14006e03f
nop dword [rax]
movsx edx, dl
lea rax, [rax + 1]
xor edx, edi
imul edi, edx, 0x1000193
movzx edx, byte [rax - 1]
test dl, dl
jne 0x14006e020
cmp edi, 0xfe0e672d
je 0x14006e049
test r8d, r8d
jne 0x14006e000
mov rcx, qword [rcx]
jmp 0x14006dfd0
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
call rax
mov rcx, qword gs:[0x60]
mov rsi, rax
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop word [rax + rax]
mov r9, qword [rcx + 0x30]
movsxd rdx, dword [r9 + 0x3c]
mov ebx, dword [rdx + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x14006e0f4
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x14006e0f4
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
mov edi, 0x5425c4fd
lea rax, [r9 + r8*4]
mov edx, dword [rax + r11]
add rdx, r9
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x14006e0ef
nop dword [rax]
movsx eax, al
lea rdx, [rdx + 1]
xor eax, edi
imul edi, eax, 0x1000193
movzx eax, byte [rdx - 1]
test al, al
jne 0x14006e0d0
cmp edi, 0x87abb276
je 0x14006e0f9
test r8d, r8d
jne 0x14006e0b0
mov rcx, qword [rcx]
jmp 0x14006e080
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
mov rdx, rbp
add rax, r9
mov rcx, rsi
call rax
test eax, eax
je 0x14006e13a
cmp qword [rbp + 0x48], r14
jne 0x14006e134
cmp qword [rbp + 0x50], r14
jne 0x14006e134
cmp qword [rbp + 0x58], r14
jne 0x14006e134
cmp qword [rbp + 0x60], r14
je 0x14006e13a
mov r14d, 1
xor edx, edx
mov r8d, 0x8000
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test r14d, r14d
jne 0x14006e195
call fcn.1400699d0
test al, al
jne 0x14006e195
call fcn.1400697b0
test al, al
jne 0x14006e195
call fcn.14006af50
test eax, eax
jne 0x14006e195
call fcn.14006b1f0
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword gs:[0x60]
mov dword [0x140346450], r15d
cmp byte [rax + 2], r15b
je 0x14006df80
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x30]
call fcn.140068aa0
int3