Function at 0x140009200
Capabilities:
Access peb ldr_data
Create thread
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xe0
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
movaps xmmword [rax - 0x48], xmm8
mov rax, qword [0x14008c080]
xor rax, rsp
mov qword [rbp + 0xf], rax
xor edi, edi
lea rcx, [0x14013e3b0]
call fcn.1400199c0
lea rcx, [0x14013e3b0]
call fcn.1400156b0
lea ecx, [rdi + 1]
call qword [sym.imp.USER32.dll_BlockInput]
lea rcx, [0x14013e3b0]
call fcn.140016480
test al, al
je 0x1400092a3
xorps xmm0, xmm0
movups xmmword [rbp - 0x69], xmm0
mov qword [rbp - 0x59], rdi
mov qword [rbp - 0x51], rdi
xor r8d, r8d
lea rdx, [0x1400804a9]
lea rcx, [rbp - 0x69]
call fcn.14000baf0
lea rdx, [rbp - 0x69]
lea rcx, [0x14013e3b0]
call fcn.140014a00
call fcn.140001e70
call fcn.140002960
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 8
call fcn.14006e5d4
lea rcx, [fcn.140003010]
mov qword [rax], rcx
mov qword [rbp - 0x49], rax
lea rcx, [rbp - 0x19]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x14000c580]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x21], rax
test rax, rax
je 0x140009afa
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.DbgUiRemoteBreakin
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x20], rdi
mov r9d, 6
lea r8, [0x1400048a0]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call fcn.140003010
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
xor r9d, r9d
lea r8, [0x1400040a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 8
call fcn.14006e5d4
lea rcx, [0x140002530]
mov qword [rax], rcx
mov qword [rbp - 0x49], rax
lea rcx, [rbp - 0x61]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x14000c580]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x69], rax
test rax, rax
je 0x140009aeb
cmp dword [rbp - 0x61], 0
je 0x140009adf
movaps xmm0, xmmword [rbp - 0x69]
movdqa xmmword [rbp - 0x49], xmm0
lea rcx, [rbp - 0x49]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140009adf
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x69], xmm0
lea ecx, [rax + 8]
call fcn.14006e5d4
lea rcx, [0x140001f90]
mov qword [rax], rcx
mov qword [rbp - 0x49], rax
lea rcx, [rbp - 0x61]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x14000c580]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x69], rax
test rax, rax
je 0x140009ad0
cmp dword [rbp - 0x61], 0
je 0x140009ac4
movaps xmm0, xmmword [rbp - 0x69]
movdqa xmmword [rbp - 0x49], xmm0
lea rcx, [rbp - 0x49]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140009ac4
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x69], xmm0
lea ecx, [rax + 8]
call fcn.14006e5d4
lea rcx, [0x1400022a0]
mov qword [rax], rcx
mov qword [rbp - 0x49], rax
lea rcx, [rbp - 0x61]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x14000c580]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x69], rax
test rax, rax
je 0x140009ab5
cmp dword [rbp - 0x61], 0
je 0x140009aa9
movaps xmm0, xmmword [rbp - 0x69]
movdqa xmmword [rbp - 0x49], xmm0
lea rcx, [rbp - 0x49]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140009aa9
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x69], xmm0
lea ecx, [rax + 8]
call fcn.14006e5d4
lea rcx, [0x140002060]
mov qword [rax], rcx
mov qword [rbp - 0x49], rax
lea rcx, [rbp - 0x61]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x14000c580]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x69], rax
test rax, rax
je 0x140009a9a
cmp dword [rbp - 0x61], 0
je 0x140009a8e
movaps xmm0, xmmword [rbp - 0x69]
movdqa xmmword [rbp - 0x49], xmm0
lea rcx, [rbp - 0x49]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140009a8e
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x69], xmm0
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov r12d, 5
mov edx, r12d
call qword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [str._UI_]
mov dword [rbp - 0x49], eax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov esi, dword [rcx + r10 + 0x88]
add rsi, r10
cmp rsi, r10
je 0x1400095e6
mov r9d, dword [rsi + 0x18]
test r9d, r9d
je 0x1400095e6
mov ebx, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
mov r8d, 0x811c9dc5
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1400095e1
nop
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x1400095c0
cmp r8d, 0x491e0a9c
je 0x1400095eb
test r9d, r9d
jne 0x1400095a0
mov rax, qword [rax]
jmp 0x140009570
mov ecx, dword [rsi + 0x1c]
add rcx, r10
mov eax, dword [rsi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov r11d, dword [rcx + rax*4]
add r11, r10
mov r15d, Ordinal_33
mov r14d, dword [reloc.WS2_32.dll_accept]
cmp r14d, 2
jl 0x1400096a4
movdqa xmm3, xmmword [0x140081360]
movdqa xmm2, xmm3
punpckldq xmm2, xmm3
pmuldq xmm2, xmmword [0x140081430]
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmmword [0x140081430]
shufps xmm2, xmm0, 0xdd
paddd xmm2, xmm3
movd xmm0, r12d
psrad xmm2, xmm0
movd xmm0, r15d
movdqa xmm1, xmm2
psrld xmm1, xmm0
paddd xmm1, xmm2
pmulld xmm1, xmmword [str.3333]
psubd xmm3, xmm1
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140081380]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.8888888888888888___HhlzwvwaGcu9AMK1_fsz2__tdcXehiGqryvf_so___HhlzwvwaA8rCzNakSvza8rKaojx_Kawxv:pnrNffoi]
movd xmm0, dword [rbp - 0x49]
xorps xmm2, xmm0
movd dword [rbp - 0x49], xmm2
jmp 0x1400096e3
lea r9, [rbp - 0x49]
mov r8d, edi
nop dword [rax + rax]
mov eax, 0xa0a0a0a1
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x33
movzx eax, r8b
sub al, cl
add al, 0x38
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 4
jl 0x1400096b0
lea rcx, [rbp - 0x49]
call r11
xorps xmm0, xmm0
movups xmmword [rbp - 0x11], xmm0
mov qword [rbp - 1], rdi
mov qword [rbp + 7], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x11], 0
lea rdx, str._______________________________________________________________________________________________________________________________n_n______________________________________________________________________n__________________________________________________________________n___________________________________________________________________n_______________________________________________________________n___________________________________________________________n___________________________________________________________n______________________________________________________________n____________________________________________________________________________________________________________________________________________________________________________________________________________________n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000b140
mov rcx, rax
call fcn.14000b4e0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov esi, dword [rcx + r10 + 0x88]
add rsi, r10
cmp rsi, r10
je 0x1400097a6
mov r9d, dword [rsi + 0x18]
test r9d, r9d
je 0x1400097a6
mov ebx, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400097a1
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140009780
cmp r8d, 0xbc0e3315
je 0x1400097ab
test r9d, r9d
jne 0x140009760
mov rax, qword [rax]
jmp 0x140009730
mov ecx, dword [rsi + 0x1c]
add rcx, r10
mov eax, dword [rsi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov r8d, dword [rcx + rax*4]
add r8, r10
mov edx, 2
mov rcx, qword [0x14013e360]
call r8
movups xmm0, xmmword [0x140081328]
movups xmmword [rbp - 0x49], xmm0
movsd xmm0, qword [0x140081338]
movsd qword [rbp - 0x39], xmm0
mov eax, dword [0x140081340]
mov dword [rbp - 0x31], eax
movzx eax, word [0x140081344]
mov word [rbp - 0x2d], ax
cmp byte [0x140081345], 0
je 0x140009991
cmp r14d, 2
jl 0x140009958
movdqa xmm5, xmmword [0x140081360]
movdqa xmm4, xmmword [0x140081430]
movd xmm6, r12d
movdqa xmm7, xmmword [str.3333]
movd xmm8, r15d
movdqa xmm0, xmmword [str.8888888888888888___HhlzwvwaGcu9AMK1_fsz2__tdcXehiGqryvf_so___HhlzwvwaA8rCzNakSvza8rKaojx_Kawxv:pnrNffoi]
movdqa xmmword [rbp - 0x69], xmm0
lea rcx, [rbp - 0x49]
mov edx, dword [rbp - 0x69]
nop dword [rax + rax]
movd xmm2, edi
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140081380]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
lea eax, [rdi + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140081380]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx + 4]
xorps xmm2, xmm0
movd dword [rcx + 4], xmm2
add edi, 8
mov eax, edi
lea rcx, [rcx + 8]
cmp edi, 0x18
jl 0x140009850
cmp eax, 0x1e
jge 0x140009991
movsxd rax, edi
lea r8, [rbp - 0x49]
add r8, rax
mov eax, 0xa0a0a0a1
imul edi
add edx, edi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x33
movzx eax, dil
sub al, dl
add al, 0x38
xor byte [r8], al
inc edi
lea r8, [r8 + 1]
cmp edi, 0x1e
jl 0x140009962
lea rdx, [rbp - 0x49]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000b140
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x29]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
lea rcx, [rbp - 0x29]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64]
mov ebx, dword [rax + 8]
mov edi, dword [rax + 4]
mov esi, dword [rax]
lea rdx, str._n_n____Your_Local_Time:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000b140
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x140080a6c]
call fcn.14000b140
mov edx, edi
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x140080a6c]
call fcn.14000b140
mov edx, esi
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
lea rdx, [0x14000b310]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.USER32.dll_BlockInput]
call fcn.140004d70
nop
cmp dword [rbp - 0x19], 0
je 0x140009a50
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
xor eax, eax
mov rcx, qword [rbp + 0xf]
xor rcx, rsp
call fcn.14006e4d0
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x61], edi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x61], edi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x61], edi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x61], edi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x19], edi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3