Function at 0x14001e660
Capabilities:
Access pe header
Encode data using xor
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r15
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1400d8b80]
xor rax, rsp
mov qword [rbp - 8], rax
mov rsi, rcx
lea rcx, [0x140079260]
call fcn.14001ef20
xor ebx, ebx
mov dword [rbp - 0x10], eax
test rsi, rsi
jne 0x14001e7a2
xor edx, edx
mov cl, 0x5b
call fcn.140019f90
lea edx, [rbx + 1]
mov byte [rbp - 0x40], al
mov cl, 0x2b
call fcn.140019f90
lea edx, [rbx + 2]
mov byte [rbp - 0x3f], al
mov cl, 0x5d
call fcn.140019f90
lea edx, [rbx + 3]
mov byte [rbp - 0x3e], al
mov cl, reloc.WLDAP32.dll_Ordinal_32
call fcn.140019f90
lea edx, [rbx + 4]
mov byte [rbp - 0x3d], al
mov cl, 0x49
call fcn.140019f90
lea edx, [rbx + 5]
mov byte [rbp - 0x3c], al
mov cl, WSAGetLastError
call fcn.140019f90
lea edx, [rbx + 6]
mov byte [rbp - 0x3b], al
mov cl, 0x76
call fcn.140019f90
lea edx, [rbx + 7]
mov byte [rbp - 0x3a], al
mov cl, 0x61
call fcn.140019f90
lea edx, [rbx + 8]
mov byte [rbp - 0x39], al
mov cl, 0x69
call fcn.140019f90
lea edx, [rbx + 9]
mov byte [rbp - 0x38], al
mov cl, 0x6c
call fcn.140019f90
lea edx, [rbx + 0xa]
mov byte [rbp - 0x37], al
mov cl, 0x64
call fcn.140019f90
lea edx, [rbx + 0xb]
mov byte [rbp - 0x36], al
mov cl, reloc.WLDAP32.dll_Ordinal_32
call fcn.140019f90
lea edx, [rbx + 0xc]
mov byte [rbp - 0x35], al
mov cl, 0x44
call fcn.140019f90
lea edx, [rbx + 0xd]
mov byte [rbp - 0x34], al
mov cl, 0x4c
call fcn.140019f90
lea edx, [rbx + 0xe]
mov byte [rbp - 0x33], al
mov cl, 0x4c
call fcn.140019f90
lea edx, [rbx + 0xf]
mov byte [rbp - 0x32], al
mov cl, 0xa
call fcn.140019f90
mov byte [rbp - 0x31], al
mov edx, ebx
xor eax, eax
mov byte [rbp - 0x30], al
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rbp - 0x40]
add rcx, rax
lea eax, [rdx + 0x13]
inc edx
xor byte [rcx], al
cmp edx, 0x10
jb 0x14001e780
lea rcx, [rbp - 0x40]
mov byte [rbp - 0x30], bl
call fcn.140026440
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov rdi, rax
test rax, rax
jne 0x14001e8a2
xor edx, edx
mov cl, 0x5b
call fcn.140019f90
lea edx, [rdi + 1]
mov byte [rbp - 0x40], al
mov cl, 0x2b
call fcn.140019f90
lea edx, [rdi + 2]
mov byte [rbp - 0x3f], al
mov cl, 0x5d
call fcn.140019f90
lea edx, [rdi + 3]
mov byte [rbp - 0x3e], al
mov cl, reloc.WLDAP32.dll_Ordinal_32
call fcn.140019f90
lea edx, [rdi + 4]
mov byte [rbp - 0x3d], al
mov cl, 0x49
call fcn.140019f90
lea edx, [rdi + 5]
mov byte [rbp - 0x3c], al
mov cl, WSAGetLastError
call fcn.140019f90
lea edx, [rdi + 6]
mov byte [rbp - 0x3b], al
mov cl, 0x76
call fcn.140019f90
lea edx, [rdi + 7]
mov byte [rbp - 0x3a], al
mov cl, 0x61
call fcn.140019f90
lea edx, [rdi + 8]
mov byte [rbp - 0x39], al
mov cl, 0x69
call fcn.140019f90
lea edx, [rdi + 9]
mov byte [rbp - 0x38], al
mov cl, 0x6c
call fcn.140019f90
lea edx, [rdi + 0xa]
mov byte [rbp - 0x37], al
mov cl, 0x64
call fcn.140019f90
lea edx, [rdi + 0xb]
mov byte [rbp - 0x36], al
mov cl, reloc.WLDAP32.dll_Ordinal_32
call fcn.140019f90
lea edx, [rdi + 0xc]
mov byte [rbp - 0x35], al
mov cl, 0x50
call fcn.140019f90
lea edx, [rdi + 0xd]
mov byte [rbp - 0x34], al
mov cl, 0x45
call fcn.140019f90
lea edx, [rdi + 0xe]
mov byte [rbp - 0x33], al
mov cl, 0xa
call fcn.140019f90
mov byte [rbp - 0x32], al
mov edx, ebx
xor eax, eax
mov byte [rbp - 0x31], al
movsxd rax, edx
lea rcx, [rbp - 0x40]
add rcx, rax
lea eax, [rdx + 0x13]
inc edx
xor byte [rcx], al
cmp edx, 0xf
jb 0x14001e880
lea rcx, [rbp - 0x40]
mov byte [rbp - 0x31], bl
call fcn.140026440
mov ecx, dword [rbp - 0x10]
call fcn.1400207a0
lea rdx, [rbp - 0x10]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r15d, eax
cmp dword [rbp - 0x10], ebx
je 0x14001ebbf
test eax, eax
je 0x14001ebbf
mov qword [rsp + 0x88], r14
call fcn.14001e280
mov edx, dword [rbp - 0x10]
mov rcx, rax
call fcn.140018e80
call fcn.14001e280
mov edx, dword [rdi + 0x50]
mov r8d, 0x40
mov rcx, rax
call fcn.140019090
mov r8, rdi
mov rdx, rsi
mov rcx, rax
mov r14, rax
call fcn.140021c90
test eax, eax
jne 0x14001e91e
call fcn.14001e280
mov rdx, r14
mov rcx, rax
call fcn.140019130
mov r8, rdi
mov rdx, rsi
mov ecx, r15d
call fcn.140021f50
test eax, eax
jne 0x14001e940
call fcn.14001e280
mov rdx, r14
mov rcx, rax
call fcn.140019130
mov r8, rdi
mov rdx, rsi
mov rcx, r14
call fcn.140022320
xor r9d, r9d
mov r8, rdi
mov rdx, r14
mov ecx, r15d
call fcn.14001fe70
mov rdx, rdi
mov rcx, r14
call fcn.140020670
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor edx, edx
mov cl, 0x5b
call fcn.140019f90
mov edx, 1
mov byte [rbp - 0x40], al
mov cl, 0x2b
call fcn.140019f90
mov edx, 2
mov byte [rbp - 0x3f], al
mov cl, 0x5d
call fcn.140019f90
mov edx, 3
mov byte [rbp - 0x3e], al
mov cl, reloc.WLDAP32.dll_Ordinal_32
call fcn.140019f90
mov edx, 4
mov byte [rbp - 0x3d], al
mov cl, 0x53
call fcn.140019f90
mov edx, 5
mov byte [rbp - 0x3c], al
mov cl, 0x75
call fcn.140019f90
mov edx, 6
mov byte [rbp - 0x3b], al
mov cl, 0x63
call fcn.140019f90
mov edx, 7
mov byte [rbp - 0x3a], al
mov cl, 0x63
call fcn.140019f90
mov edx, 8
mov byte [rbp - 0x39], al
mov cl, 0x65
call fcn.140019f90
mov edx, 9
mov byte [rbp - 0x38], al
mov cl, reloc.WS2_32.dll_WSAStartup
call fcn.140019f90
mov edx, 0xa
mov byte [rbp - 0x37], al
mov cl, reloc.WS2_32.dll_WSAStartup
call fcn.140019f90
mov edx, ntohs
mov byte [rbp - 0x36], al
mov cl, 0x66
call fcn.140019f90
mov edx, ntohs
mov byte [rbp - 0x35], al
mov cl, 0x75
call fcn.140019f90
mov edx, reloc.WS2_32.dll_listen
mov byte [rbp - 0x34], al
mov cl, 0x6c
call fcn.140019f90
mov edx, reloc.WS2_32.dll_ntohl
mov byte [rbp - 0x33], al
mov cl, 0x6c
call fcn.140019f90
mov edx, reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x32], al
mov cl, 0x79
call fcn.140019f90
mov byte [rbp - 0x31], al
mov edx, reloc.WS2_32.dll_recv
mov cl, reloc.WLDAP32.dll_Ordinal_32
call fcn.140019f90
mov edx, reloc.WS2_32.dll_recvfrom
mov byte [rbp - 0x30], al
mov cl, 0x49
call fcn.140019f90
mov edx, reloc.WS2_32.dll_select
mov byte [rbp - 0x2f], al
mov cl, WSAGetLastError
call fcn.140019f90
mov edx, reloc.WS2_32.dll_send
mov byte [rbp - 0x2e], al
mov cl, 0x6a
call fcn.140019f90
mov edx, reloc.WS2_32.dll_sendto
mov byte [rbp - 0x2d], al
mov cl, 0x65
call fcn.140019f90
mov edx, reloc.WS2_32.dll_setsockopt
mov byte [rbp - 0x2c], al
mov cl, 0x63
call fcn.140019f90
mov edx, reloc.WLDAP32.dll_Ordinal_22
mov byte [rbp - 0x2b], al
mov cl, reloc.WS2_32.dll_WSACleanup
call fcn.140019f90
mov edx, reloc.WS2_32.dll_socket
mov byte [rbp - 0x2a], al
mov cl, 0x65
call fcn.140019f90
mov edx, Ordinal_27
mov byte [rbp - 0x29], al
mov cl, 0x64
call fcn.140019f90
mov edx, Ordinal_27
mov byte [rbp - 0x28], al
mov cl, reloc.WLDAP32.dll_Ordinal_32
call fcn.140019f90
mov edx, reloc.WLDAP32.dll_Ordinal_26
mov byte [rbp - 0x27], al
mov cl, 0x45
call fcn.140019f90
mov edx, reloc.WLDAP32.dll_Ordinal_27
mov byte [rbp - 0x26], al
mov cl, WSAGetLastError
call fcn.140019f90
mov edx, Ordinal_32
mov byte [rbp - 0x25], al
mov cl, 0x6a
call fcn.140019f90
mov edx, Ordinal_32
mov byte [rbp - 0x24], al
mov cl, reloc.WS2_32.dll_WSAGetLastError
call fcn.140019f90
mov edx, reloc.WLDAP32.dll_Ordinal_30
mov byte [rbp - 0x23], al
mov cl, 0x79
call fcn.140019f90
mov edx, Ordinal_35
mov byte [rbp - 0x22], al
mov cl, reloc.WLDAP32.dll_Ordinal_33
call fcn.140019f90
mov edx, reloc.WLDAP32.dll_Ordinal_32
mov byte [rbp - 0x21], al
mov cl, reloc.WLDAP32.dll_Ordinal_33
call fcn.140019f90
mov r14, qword [rsp + 0x88]
mov byte [rbp - 0x20], al
xor eax, eax
mov byte [rbp - 0x1f], al
nop dword [rax]
nop dword [rax + rax]
movsxd rax, ebx
lea rdx, [rbp - 0x40]
add rdx, rax
lea eax, [rbx + 0x13]
inc ebx
xor byte [rdx], al
cmp ebx, 0x21
jb 0x14001eb80
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rbp - 0x40]
mov byte [rbp - 0x1f], 0
call fcn.1400195d0
lea rdx, [0x14001c200]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x14001ee93
xor edx, edx
mov cl, 0x5b
call fcn.140019f90
mov edx, 1
mov byte [rbp - 0x40], al
mov cl, 0x2b
call fcn.140019f90
mov edx, 2
mov byte [rbp - 0x3f], al
mov cl, 0x5d
call fcn.140019f90
mov edx, 3
mov byte [rbp - 0x3e], al
mov cl, reloc.WLDAP32.dll_Ordinal_32
call fcn.140019f90
mov edx, 4
mov byte [rbp - 0x3d], al
mov cl, reloc.WLDAP32.dll_Ordinal_79
call fcn.140019f90
mov edx, 5
mov byte [rbp - 0x3c], al
mov cl, reloc.WS2_32.dll_WSASetLastError
call fcn.140019f90
mov edx, 6
mov byte [rbp - 0x3b], al
mov cl, 0x65
call fcn.140019f90
mov edx, 7
mov byte [rbp - 0x3a], al
mov cl, WSAGetLastError
call fcn.140019f90
mov edx, 8
mov byte [rbp - 0x39], al
mov cl, reloc.WLDAP32.dll_Ordinal_32
call fcn.140019f90
mov edx, 9
mov byte [rbp - 0x38], al
mov cl, reloc.WS2_32.dll_WSACleanup
call fcn.140019f90
mov edx, 0xa
mov byte [rbp - 0x37], al
mov cl, 0x68
call fcn.140019f90
mov edx, ntohs
mov byte [rbp - 0x36], al
mov cl, 0x65
call fcn.140019f90
mov edx, ntohs
mov byte [rbp - 0x35], al
mov cl, reloc.WLDAP32.dll_Ordinal_32
call fcn.140019f90
mov edx, reloc.WS2_32.dll_listen
mov byte [rbp - 0x34], al
mov cl, 0x67
call fcn.140019f90
mov edx, reloc.WS2_32.dll_ntohl
mov byte [rbp - 0x33], al
mov cl, 0x61
call fcn.140019f90
mov edx, reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x32], al
mov cl, 0x6d
call fcn.140019f90
mov edx, reloc.WS2_32.dll_recv
mov byte [rbp - 0x31], al
mov cl, 0x65
call fcn.140019f90
mov edx, reloc.WS2_32.dll_recvfrom
mov byte [rbp - 0x30], al
mov cl, reloc.WLDAP32.dll_Ordinal_32
call fcn.140019f90
mov edx, reloc.WS2_32.dll_select
mov byte [rbp - 0x2f], al
mov cl, 0x66
call fcn.140019f90
mov edx, reloc.WS2_32.dll_send
mov byte [rbp - 0x2e], al
mov cl, 0x69
call fcn.140019f90
mov byte [rbp - 0x2d], al
mov edx, reloc.WS2_32.dll_sendto
mov cl, WSAStartup
call fcn.140019f90
mov edx, reloc.WS2_32.dll_setsockopt
mov byte [rbp - 0x2c], al
mov cl, reloc.WS2_32.dll_WSAStartup
call fcn.140019f90
mov edx, reloc.WLDAP32.dll_Ordinal_22
mov byte [rbp - 0x2b], al
mov cl, reloc.WS2_32.dll_WSACleanup
call fcn.140019f90
mov edx, reloc.WS2_32.dll_socket
mov byte [rbp - 0x2a], al
mov cl, reloc.WLDAP32.dll_Ordinal_32
call fcn.140019f90
mov edx, Ordinal_27
mov byte [rbp - 0x29], al
mov cl, 0x79
call fcn.140019f90
mov edx, Ordinal_27
mov byte [rbp - 0x28], al
mov cl, 0x61
call fcn.140019f90
mov edx, reloc.WLDAP32.dll_Ordinal_26
mov byte [rbp - 0x27], al
mov cl, reloc.WLDAP32.dll_Ordinal_32
call fcn.140019f90
mov edx, reloc.WLDAP32.dll_Ordinal_27
mov byte [rbp - 0x26], al
mov cl, WSAStartup
call fcn.140019f90
mov edx, Ordinal_32
mov byte [rbp - 0x25], al
mov cl, 0x65
call fcn.140019f90
mov edx, Ordinal_32
mov byte [rbp - 0x24], al
mov cl, reloc.WS2_32.dll_WSACleanup
call fcn.140019f90
mov edx, reloc.WLDAP32.dll_Ordinal_30
mov byte [rbp - 0x23], al
mov cl, 0x61
call fcn.140019f90
mov edx, Ordinal_35
mov byte [rbp - 0x22], al
mov cl, WSAStartup
call fcn.140019f90
mov edx, reloc.WLDAP32.dll_Ordinal_32
mov byte [rbp - 0x21], al
mov cl, 0x64
call fcn.140019f90
mov edx, reloc.WLDAP32.dll_Ordinal_33
mov byte [rbp - 0x20], al
mov cl, 0x65
call fcn.140019f90
mov edx, Ordinal_35
mov byte [rbp - 0x1f], al
mov cl, 0x64
call fcn.140019f90
mov edx, reloc.WLDAP32.dll_Ordinal_35
mov byte [rbp - 0x1e], al
mov cl, reloc.WLDAP32.dll_Ordinal_32
call fcn.140019f90
mov edx, 0x24
mov byte [rbp - 0x1d], al
mov cl, reloc.WS2_32.dll_WSAStartup
call fcn.140019f90
mov edx, Ordinal_41
mov byte [rbp - 0x1c], al
mov cl, reloc.WS2_32.dll_WSASetLastError
call fcn.140019f90
mov edx, Ordinal_41
mov byte [rbp - 0x1b], al
mov cl, 0x65
call fcn.140019f90
mov edx, Ordinal_41
mov byte [rbp - 0x1a], al
mov cl, 0x63
call fcn.140019f90
mov byte [rbp - 0x19], al
mov edx, Ordinal_41
mov cl, 0x69
call fcn.140019f90
mov edx, reloc.WLDAP32.dll_Ordinal_41
mov byte [rbp - 0x18], al
mov cl, 0x6d
call fcn.140019f90
mov edx, Ordinal_46
mov byte [rbp - 0x17], al
mov cl, 0x69
call fcn.140019f90
mov edx, Ordinal_46
mov byte [rbp - 0x16], al
mov cl, WSAGetLastError
call fcn.140019f90
mov edx, Ordinal_46
mov byte [rbp - 0x15], al
mov cl, 0xa
call fcn.140019f90
mov byte [rbp - 0x14], al
xor eax, eax
mov byte [rbp - 0x13], al
nop dword [rax]
nop dword [rax + rax]
movsxd rax, ebx
lea rcx, [rbp - 0x40]
add rcx, rax
lea eax, [rbx + 0x13]
inc ebx
xor byte [rcx], al
cmp ebx, 0x2d
jb 0x14001ee70
lea rcx, [rbp - 0x40]
mov byte [rbp - 0x13], 0
call fcn.140026440
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14001eec0
call fcn.14001eec0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3