Function at 0x140068ec0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rax, qword [0x140115080]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rbp - 0x21], rcx
xor r15d, r15d
lea rcx, [0x140117ff0]
call fcn.1400902e0
lea rax, [rbp + 0xf]
mov qword [rbp - 0x21], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0xf], xmm0
mov qword [rbp + 0x1f], r15
mov qword [rbp + 0x27], r15
lea rdx, [0x140117c38]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rdx + r8], r15b
jne 0x140068f27
lea rcx, [rbp + 0xf]
call fcn.140012c50
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x11], xmm0
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
lea rdx, [0x140117c58]
inc rbx
cmp byte [rdx + rbx], 0
jne 0x140068f50
mov r8, rbx
lea rcx, [rbp - 0x11]
call fcn.140012c50
nop
lea r8, [rbp + 0xf]
lea rdx, [rbp - 0x11]
lea rcx, [0x140117ff0]
call fcn.140092220
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x11]
cmp byte [0x140118200], 0
jne 0x1400690e7
lea rdx, [0x140118208]
call fcn.14005e890
nop
lea rcx, [rbp - 0x11]
call fcn.140035fb0
mov r9, rax
xor edx, edx
lea rcx, [rbp - 0x11]
call fcn.140012ac0
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
mov r8, rax
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov rdx, rbx
lea rcx, [rbp + 0xf]
call fcn.14007ec80
nop
lea rcx, [rbp + 0xf]
call fcn.14005e700
mov r10, rax
xor edx, edx
lea rcx, [rbp - 0x11]
call fcn.140012ac0
mov r8, rax
lea rcx, [rbp - 0x11]
call fcn.140035fb0
mov r9, rax
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r10
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov edi, dword [rcx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x1400690a6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400690a6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r11 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r11
mov r8d, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400690a1
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140069080
cmp r8d, 0x31a98fee
je 0x1400690ab
test r9d, r9d
jne 0x140069060
mov rax, qword [rax]
jmp 0x140069030
mov ecx, dword [rdi + 0x24]
add rcx, r11
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov r10d, dword [rcx + rdx*4]
add r10, r11
lea rcx, [rbp + 0xf]
call fcn.14005e700
xor r9d, r9d
lea r8, str.Error
mov rdx, rax
xor ecx, ecx
call r10
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x11], xmm0
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov r8d, 6
lea rdx, str.EncKey
call fcn.140012c50
lea r8, [rbp - 0x11]
lea rdx, [rbp + 0xf]
lea rcx, [0x140117ff0]
call fcn.140096a60
mov rbx, rax
lea r14, [0x140117de0]
cmp r14, rax
je 0x1400691a5
mov rdx, qword [0x140117df8]
cmp rdx, 0x10
jb 0x140069168
inc rdx
mov rcx, qword [0x140117de0]
cmp rdx, 0x1000
jb 0x140069163
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400691d7
mov rcx, r8
call fcn.1400e44b0
mov qword [0x140117df0], r15
mov qword [0x140117df8], 0xf
mov byte [0x140117de0], 0
movups xmm0, xmmword [rbx]
movups xmmword [0x140117de0], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [0x140117df0], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rbp + 0x27]
cmp rdx, 0x10
jb 0x1400691e3
inc rdx
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400691de
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400691de
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e44b0
mov ecx, reloc.WLDAP32.dll_Ordinal_200
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [0x140117df8], 0x10
cmovae r14, qword [0x140117de0]
lea rcx, [0x140118288]
cmp qword [0x1401182a0], 0x10
cmovae rcx, qword [0x140118288]
mov r8, qword [0x140118298]
cmp r8, qword [0x140117df0]
jne 0x1400692b2
mov rdx, r14
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400692b2
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], al
call qword [fcn.1400820e0]
mov rbx, rax
test rax, rax
je 0x1400692aa
cmp qword [rsi + 0x18], 0x10
jb 0x140069261
mov rsi, qword [rsi]
mov r8, rsi
mov edx, 0x2712
mov rcx, rbx
call qword [fcn.1400849c0]
lea r8, [0x140068e90]
mov edx, 0x4e2b
mov rcx, rbx
call qword [fcn.1400849c0]
mov r8, rdi
mov edx, 0x2711
mov rcx, rbx
call qword [fcn.1400849c0]
mov rcx, rbx
call qword [fcn.1400821a0]
mov rcx, rbx
call qword [fcn.1400820c0]
mov rax, rdi
jmp 0x140069377
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140069346
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140069346
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov ecx, dword [rcx + rbx]
add rcx, r10
mov r8d, 0x811c9dc5
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140069341
nop dword [rax]
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x140069320
cmp r8d, 0x31a98fee
je 0x14006934b
test r9d, r9d
jne 0x140069300
mov rax, qword [rax]
jmp 0x1400692d0
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
xor r9d, r9d
lea r8, str.Error
lea rdx, str.Error_Connecting_To_Auth
xor ecx, ecx
call rax
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.1400e4490
mov rbx, qword [rsp + 0xd0]
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret