Function at 0x14000dda0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x100
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x140094a00]
xor rax, rsp
mov qword [rbp + 0x1f], rax
xor ebx, ebx
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x19], xmm1
mov r8d, Ordinal_27
lea rdx, str.https:__t.me_nightsector1
lea rcx, [rbp - 0x29]
call fcn.1400039f0
nop
mov r8, qword [rbp - 0x19]
mov rcx, qword [rbp - 0x11]
mov rax, rcx
sub rax, r8
lea r13, [0x14006150a]
mov r15d, 6
lea r14, str.start
cmp rax, r15
jb 0x14000de94
lea rax, [r8 + 6]
mov qword [rbp - 0x19], rax
lea rdi, [rbp - 0x29]
cmp rcx, 0xf
cmova rdi, qword [rbp - 0x29]
cmp r13, rdi
jbe 0x14000de58
lea rax, [rdi + r8]
cmp r14, rax
ja 0x14000de58
cmp rdi, r14
ja 0x14000de50
mov esi, ebx
jmp 0x14000de5b
mov rsi, rdi
sub rsi, r14
jmp 0x14000de5b
mov rsi, r15
inc r8
lea rcx, [rdi + 6]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memmove
mov r8, rsi
mov rdx, r14
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov r8, r15
sub r8, rsi
lea rdx, [r14 + 6]
add rdx, rsi
lea rcx, [rdi + rsi]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 0x29]
jmp 0x14000deb2
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
xor r9d, r9d
movzx r8d, byte [rbp - 0x79]
mov rdx, r15
lea rcx, [rbp - 0x29]
call fcn.14000cd70
xorps xmm0, xmm0
movups xmmword [rbp - 0x71], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x61], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x71], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x61], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r12, [rbp - 0x71]
cmp qword [rbp - 0x59], 0xf
cmova r12, qword [rbp - 0x71]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov esi, dword [rcx + r10 + 0x88]
add rsi, r10
cmp rsi, r10
je 0x14000df76
mov r9d, dword [rsi + 0x18]
test r9d, r9d
je 0x14000df76
mov edi, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rdi]
add rdx, r10
mov r8d, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14000df71
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14000df50
cmp r8d, 0x491e0a9c
je 0x14000df7b
test r9d, r9d
jne 0x14000df30
mov rax, qword [rax]
jmp 0x14000df00
mov edx, dword [rsi + 0x1c]
add rdx, r10
mov eax, dword [rsi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rdx + rax*4]
add rdx, r10
mov rcx, r12
call rdx
nop
mov rdx, qword [rbp - 0x59]
cmp rdx, 0xf
jbe 0x14000dfd6
inc rdx
mov rcx, qword [rbp - 0x71]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000dfd1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000dfd1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005215c
movdqa xmm0, xmmword [0x140061560]
movdqu xmmword [rbp - 0x61], xmm0
mov byte [rbp - 0x71], 0
mov rdx, qword [rbp - 0x11]
cmp rdx, 0xf
jbe 0x14000e025
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e020
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000e020
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005215c
xorps xmm0, xmm0
movups xmmword [rbp - 9], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 7], xmm1
mov r8d, reloc.WLDAP32.dll_Ordinal_30
lea rdx, str.https:__discord.gg_nightsector
lea rcx, [rbp - 9]
call fcn.1400039f0
nop
mov r8, qword [rbp + 7]
mov rcx, qword [rbp + 0xf]
mov rax, rcx
sub rax, r8
cmp rax, 6
jb 0x14000e0d0
lea rax, [r8 + 6]
mov qword [rbp + 7], rax
lea rdi, [rbp - 9]
cmp rcx, 0xf
cmova rdi, qword [rbp - 9]
cmp r13, rdi
jbe 0x14000e094
lea rax, [rdi + r8]
cmp r14, rax
ja 0x14000e094
cmp rdi, r14
ja 0x14000e08c
mov rsi, rbx
jmp 0x14000e097
mov rsi, rdi
sub rsi, r14
jmp 0x14000e097
mov rsi, r15
inc r8
lea rcx, [rdi + 6]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memmove
mov r8, rsi
mov rdx, r14
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
sub r15, rsi
lea rdx, [rsi + 6]
add rdx, r14
lea rcx, [rdi + rsi]
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 9]
jmp 0x14000e0ee
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
xor r9d, r9d
movzx r8d, byte [rbp - 0x79]
mov rdx, r15
lea rcx, [rbp - 9]
call fcn.14000cd70
xorps xmm0, xmm0
movups xmmword [rbp - 0x49], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x39], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x49], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x39], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r14, [rbp - 0x49]
cmp qword [rbp - 0x31], 0xf
cmova r14, qword [rbp - 0x49]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov esi, dword [rcx + r10 + 0x88]
add rsi, r10
cmp rsi, r10
je 0x14000e1b6
mov r9d, dword [rsi + 0x18]
test r9d, r9d
je 0x14000e1b6
mov edi, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rdi]
add rdx, r10
mov r8d, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14000e1b1
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14000e190
cmp r8d, 0x491e0a9c
je 0x14000e1bb
test r9d, r9d
jne 0x14000e170
mov rax, qword [rax]
jmp 0x14000e140
mov edx, dword [rsi + 0x1c]
add rdx, r10
mov eax, dword [rsi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rdx + rax*4]
add rdx, r10
mov rcx, r14
call rdx
nop
mov rdx, qword [rbp - 0x31]
cmp rdx, 0xf
jbe 0x14000e216
inc rdx
mov rcx, qword [rbp - 0x49]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e211
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000e211
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005215c
movdqa xmm0, xmmword [0x140061560]
movdqu xmmword [rbp - 0x39], xmm0
mov byte [rbp - 0x49], 0
mov rdx, qword [rbp + 0xf]
cmp rdx, 0xf
jbe 0x14000e265
inc rdx
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e260
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000e260
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005215c
lea rdx, str.close_rust__if_it_is_closed__press_enter
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400090b0
lea rdx, [0x1400097b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r8d, 0x6800
lea rdx, [0x140077ee0]
lea rcx, [0x1400955d8]
call fcn.14000cc20
call fcn.140007190
mov qword [0x140095260], rax
mov dword [rbp + 0x17], ebx
lea rcx, [rbp + 0x17]
mov qword [rsp + 0x48], rcx
lea rcx, [0x14000dd70]
mov qword [rsp + 0x40], rcx
mov byte [rsp + 0x38], 0
mov dword [rsp + 0x30], ebx
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [0x1400955d8]
mov rcx, rax
call fcn.140009bd0
test rax, rax
jne 0x14000e330
lea rdx, str.____Failed_to_map
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400090b0
mov rcx, rax
lea rdx, str.shxultragoodselfdriver
call fcn.1400090b0
lea rdx, [0x1400097b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [0x140095260]
call fcn.140007cf0
mov rcx, qword [0x140095260]
call fcn.140007cf0
test al, al
jne 0x14000e372
lea rdx, str.Warning_failed_to_fully_unload_vulnerable_driver
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400090b0
mov rcx, rax
lea rdx, [0x140061418]
call fcn.1400090b0
lea rdx, [0x1400097b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
movups xmm0, xmmword [str.BFRFA]
movups xmmword [rbp - 0x71], xmm0
movsd xmm0, qword [0x1400614d8]
movsd qword [rbp - 0x61], xmm0
mov eax, dword [0x1400614e0]
mov dword [rbp - 0x59], eax
movzx eax, word [0x1400614e4]
mov word [rbp - 0x55], ax
movzx eax, byte [reloc.WLDAP32.dll_Ordinal_79]
mov byte [rbp - 0x53], al
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov esi, dword [rcx + r10 + 0x88]
add rsi, r10
cmp rsi, r10
je 0x14000e446
mov r9d, dword [rsi + 0x18]
test r9d, r9d
je 0x14000e446
mov edi, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov ecx, dword [rcx + rdi]
add rcx, r10
mov r8d, 0x811c9dc5
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14000e441
nop dword [rax]
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x14000e420
cmp r8d, 0x491e0a9c
je 0x14000e44b
test r9d, r9d
jne 0x14000e400
mov rax, qword [rax]
jmp 0x14000e3d0
mov ecx, dword [rsi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rsi + 0x1c]
add rcx, r10
mov r9d, dword [rcx + rdx*4]
add r9, r10
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x14000e59a
movdqa xmm4, xmmword [0x140061570]
movdqa xmm3, xmmword [0x1400615d0]
movdqa xmm5, xmmword [0x1400615a0]
movdqa xmm0, xmmword [0x1400615c0]
movdqa xmmword [rbp - 0x49], xmm0
lea rcx, [rbp - 0x6d]
movdqa xmm6, xmmword [0x1400615b0]
mov edx, dword [rbp - 0x49]
nop dword [rax]
nop dword [rax + rax]
movd xmm2, ebx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [rbx + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add ebx, 8
lea rcx, [rcx + 8]
cmp ebx, 0x18
jl 0x14000e4b0
cmp ebx, 0x1f
jge 0x14000e5de
movsxd rax, ebx
lea r8, [rbp - 0x71]
add r8, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x8fb823ef
imul ebx
add edx, ebx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x39
movzx eax, bl
sub al, cl
add al, 0x31
xor byte [r8], al
inc ebx
lea r8, [r8 + 1]
cmp ebx, 0x1f
jl 0x14000e5b0
lea rcx, [rbp - 0x71]
call r9
xor eax, eax
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.140052100
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret