Function at 0x14000a7c0
Capabilities:
Access peb ldr_data
Create thread
Encode data using xor
Execute command
Hash data using fnv
Resolve function by parsing pe exports
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
mov rax, qword [0x140090080]
xor rax, rsp
mov qword [rbp + 0x47], rax
lea rcx, [0x1400911e0]
call fcn.14001c980
lea rcx, [0x1400911e0]
call fcn.140017970
lea rcx, [0x1400911e0]
call fcn.140018740
test al, al
je 0x14000a836
lea rdx, [0x1400825d9]
lea rcx, [rbp - 0x19]
call fcn.14000bf40
mov rdx, rax
lea rcx, [0x1400911e0]
call fcn.140016cc0
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.DbgUiRemoteBreakin
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor esi, esi
mov qword [rsp + 0x20], rsi
mov r9d, 6
lea r8, [0x140005d40]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call fcn.140007670
call fcn.1400069c0
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, [0x14000a7b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.140005ae0
lea rdx, [0x140003b30]
lea rcx, [rbp - 0x19]
call fcn.14000cf00
nop
mov rcx, rax
call fcn.140002f90
nop
lea rcx, [rbp - 0x19]
call fcn.140002f70
lea rcx, [rbp - 0x19]
call fcn.14000cf90
nop
mov rcx, rax
call fcn.140002f90
nop
lea rcx, [rbp - 0x19]
call fcn.140002f70
lea rdx, [0x140003890]
lea rcx, [rbp - 0x19]
call fcn.14000cf00
nop
mov rcx, rax
call fcn.140002f90
nop
lea rcx, [rbp - 0x19]
call fcn.140002f70
lea rdx, [0x140004050]
lea rcx, [rbp - 0x19]
call fcn.14000cf00
nop
mov rcx, rax
call fcn.140002f90
nop
lea rcx, [rbp - 0x19]
call fcn.140002f70
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
test rax, rax
je 0x14000a97b
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0x1cc
mov edx, 0x64
mov r9d, 0x280
mov r8d, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_MoveWindow]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdx, [rbp - 0x29]
call fcn.14000ae00
mov r14, rax
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax]
mov r10, qword [rcx + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov edi, dword [rdx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14000aa26
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14000aa26
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rax, [rbx + r9*4]
mov eax, dword [rax + r10]
add rax, r10
mov r8d, 0x6290e357
movzx edx, byte [rax]
inc rax
test dl, dl
je 0x14000aa21
nop
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rax]
lea rax, [rax + 1]
test dl, dl
jne 0x14000aa00
cmp r8d, 0xf3fadbd6
je 0x14000aa2b
test r9d, r9d
jne 0x14000a9e0
mov rcx, qword [rcx]
jmp 0x14000a9b0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov r11d, dword [rcx + rax*4]
add r11, r10
mov edi, dword [reloc.WS2_32.dll_accept]
cmp byte [r14 + 3], 0
je 0x14000aafb
mov r8d, esi
cmp edi, 2
jl 0x14000aacf
movdqa xmm3, xmmword [0x140083cd0]
movdqa xmm2, xmm3
punpckldq xmm2, xmm3
pmuldq xmm2, xmmword [0x140083d80]
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmmword [0x140083d80]
shufps xmm2, xmm0, 0xdd
psrad xmm2, 4
movdqa xmm0, xmm2
psrld xmm0, 0x1f
paddd xmm0, xmm2
pmulld xmm0, xmmword [str.1111]
psubd xmm3, xmm0
andps xmm3, xmmword [0x140083d40]
packuswb xmm3, xmm3
packuswb xmm3, xmm3
paddb xmm3, xmmword [0x140083d70]
movd xmm0, dword [r14]
xorps xmm3, xmm0
movd dword [r14], xmm3
jmp 0x14000aafb
mov r9, r14
mov eax, 0x5397829d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
movzx eax, r8b
sub al, cl
add al, 0x34
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 4
jl 0x14000aad2
mov rcx, r14
call r11
call fcn.14000a390
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rbp - 0x29]
call fcn.14000ae10
movzx edx, byte [rax + 4]
test dl, dl
je 0x14000ab33
xor byte [rax], 0x34
xor byte [rax + 1], 0x35
xor byte [rax + 2], 0x36
xor byte [rax + 3], 0x37
xor dl, 0x38
mov byte [rax + 4], dl
mov rdx, rax
call fcn.14000ca30
lea rdx, str.Connecting
lea rcx, [rbp + 7]
call fcn.14000bf40
nop
mov ebx, esi
lea rcx, [rbp + 7]
call fcn.14000bea0
test rax, rax
je 0x14000aba6
mov rdx, rsi
mov dword [rbp - 0x29], 0xaa
lea rcx, [rbp + 7]
call fcn.14000bec0
movzx edx, byte [rax]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000cc00
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x19]
call fcn.14000c940
mov rcx, rax
call fcn.14000c950
inc ebx
movsxd rdx, ebx
lea rcx, [rbp + 7]
call fcn.14000bea0
cmp rdx, rax
jb 0x14000ab66
call fcn.14000a460
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rbp - 0x21]
call fcn.14000ae30
movzx edx, byte [rax]
test dl, dl
je 0x14000abc7
xor dl, 0x34
mov byte [rax], dl
mov rdx, rax
call fcn.14000ca30
call fcn.14000a390
mov r10, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rbp - 0x29]
call fcn.14000ae40
mov r9, rax
cmp byte [rax + 3], 0
je 0x14000ac95
mov ecx, esi
cmp edi, 2
jl 0x14000ac69
movdqa xmm3, xmmword [0x140083cd0]
movdqa xmm2, xmm3
punpckldq xmm2, xmm3
pmuldq xmm2, xmmword [0x140083d80]
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmmword [0x140083d80]
shufps xmm2, xmm0, 0xdd
psrad xmm2, 4
movdqa xmm0, xmm2
psrld xmm0, 0x1f
paddd xmm0, xmm2
pmulld xmm0, xmmword [str.1111]
psubd xmm3, xmm0
andps xmm3, xmmword [0x140083d40]
packuswb xmm3, xmm3
packuswb xmm3, xmm3
paddb xmm3, xmmword [0x140083d70]
movd xmm0, dword [rax]
xorps xmm3, xmm0
movd dword [rax], xmm3
jmp 0x14000ac95
mov r8, r9
nop dword [rax]
mov eax, 0x5397829d
mul ecx
shr edx, 4
movsx eax, dl
imul edx, eax, 0x31
movzx eax, cl
sub al, dl
add al, 0x34
xor byte [r8], al
inc ecx
lea r8, [r8 + 1]
cmp ecx, 4
jl 0x14000ac70
mov rdx, r9
mov rcx, r10
call fcn.14000ca30
call fcn.14000a390
mov r10, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rbp - 0x29]
call fcn.14000ae50
mov r9, rax
cmp byte [rax + 3], 0
je 0x14000ad65
mov ecx, esi
cmp edi, 2
jl 0x14000ad3a
movdqa xmm3, xmmword [0x140083cd0]
movdqa xmm2, xmm3
punpckldq xmm2, xmm3
pmuldq xmm2, xmmword [0x140083d80]
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmmword [0x140083d80]
shufps xmm2, xmm0, 0xdd
psrad xmm2, 4
movdqa xmm0, xmm2
psrld xmm0, 0x1f
paddd xmm0, xmm2
pmulld xmm0, xmmword [str.1111]
psubd xmm3, xmm0
andps xmm3, xmmword [0x140083d40]
packuswb xmm3, xmm3
packuswb xmm3, xmm3
paddb xmm3, xmmword [0x140083d70]
movd xmm0, dword [rax]
xorps xmm3, xmm0
movd dword [rax], xmm3
jmp 0x14000ad65
mov r8, r9
nop dword [rax]
mov eax, 0x5397829d
mul ecx
shr edx, 4
movsx eax, dl
imul edx, eax, 0x31
movzx eax, cl
sub al, dl
add al, 0x34
xor byte [r8], al
inc ecx
lea r8, [r8 + 1]
cmp ecx, 4
jl 0x14000ad40
mov rdx, r9
mov rcx, r10
call fcn.14000ca30
call fcn.14000a2c0
lea rdx, str._Completed
lea rcx, [rbp + 0x27]
call fcn.14000bf40
nop
lea rcx, [rbp + 0x27]
call fcn.14000bea0
test rax, rax
je 0x14000ade0
mov rdx, rsi
mov dword [rbp - 0x29], 0xaa
nop
lea rcx, [rbp + 0x27]
call fcn.14000bec0
movzx edx, byte [rax]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000cc00
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x19]
call fcn.14000c940
mov rcx, rax
call fcn.14000c950
inc esi
movsxd rdx, esi
lea rcx, [rbp + 0x27]
call fcn.14000bea0
cmp rdx, rax
jb 0x14000ada0
lea rcx, [0x1400826c8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.14000a530
mov ecx, 0xa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3