Function at 0x1400b4ab0
Capabilities:
Check mutex on windows
Create process on windows
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x320
movaps xmmword [rsp + 0x310], xmm6
mov rsi, rcx
xorps xmm6, xmm6
movaps xmmword [rsp + 0xd0], xmm6
movaps xmmword [rsp + 0xc0], xmm6
movaps xmmword [rsp + 0xb0], xmm6
movaps xmmword [rsp + 0xa0], xmm6
movaps xmmword [rsp + 0x90], xmm6
movaps xmmword [rsp + 0x80], xmm6
mov qword [rsp + 0xe0], 0
cmp dword [0x1406dfd8c], 0xa
jl 0x1400b4b1e
mov eax, dword [0x1406dfd88]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
jne 0x1400b4b70
movaps xmmword [rsp + 0x60], xmm6
mov qword [rsp + 0x70], 0
mov dword [rsp + 0x80], WSASetLastError
mov dword [rsp + 0x5c], 0
lea r8, str.Security
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x1406dfd8c], 0xa
jl 0x1400b4bb0
mov ecx, dword [0x1406dfd88]
lea edx, [rcx - 1]
imul edx, ecx
and edx, 1
je 0x1400b4bb0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov dword [rsp + 0x80], WSASetLastError
mov dword [rsp + 0x5c], 0
lea r8, str.Security
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400b4b1e
test eax, eax
je 0x1400b4bf2
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_DebugActiveProcess]
cmp dword [0x1406dfd8c], 0xa
jl 0x1400b4c65
mov ecx, dword [0x1406dfd88]
lea edx, [rcx - 1]
imul edx, ecx
and edx, 1
je 0x1400b4c65
nop word [rax + rax]
jmp 0x1400b4bf0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
lea rdx, [rsp + 0xf0]
xor ecx, ecx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [0x14026338f]
mov dword [rsp + 0x53], eax
mov eax, dword [0x14026338c]
mov dword [rsp + 0x50], eax
mov eax, dword [0x1406dfd90]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete al
cmp dword [0x1406dfd94], 0xa
setl r8b
or r8b, al
mov dil, 0x36
mov r9b, reloc.WS2_32.dll_setsockopt
mov r10b, 0x46
mov r11b, 0x41
mov cl, reloc.WS2_32.dll_send
mov dl, reloc.WS2_32.dll_recvfrom
mov al, 0x51
cmp r8b, 1
je 0x1400b4db3
jmp 0x1400b4e1e
test eax, eax
je 0x1400b4c7c
movaps xmm6, xmmword [rsp + 0x310]
add rsp, 0x320
pop rbx
pop rdi
pop rsi
ret
cmp dword [0x1406f0b20], 0xa
jl 0x1400b4ca2
mov eax, dword [0x1406f0b24]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x1400b4ca2
nop word cs:[rax + rax]
jmp 0x1400b4ca0
mov rax, qword gs:[0x60]
mov ecx, dword [0x1406f0b28]
lea edx, [rcx - 1]
imul edx, ecx
test dl, 1
sete cl
cmp dword [0x1406f0b2c], 0xa
setl r8b
cmp dword [0x1406f0b30], 0xa
jl 0x1400b4cf2
mov edx, dword [0x1406f0b34]
lea ebx, [rdx - 1]
imul ebx, edx
and ebx, 1
je 0x1400b4cf2
nop word cs:[rax + rax]
nop dword [rax]
jmp 0x1400b4cf0
or r8b, cl
mov r9, qword [rax + 0x18]
add r9, 0x10
jmp 0x1400b4d09
test r8b, r8b
je 0x1400b4d90
mov r9, qword [r9]
mov rdi, qword [r9 + 0x30]
movsxd rax, dword [rdi + 0x3c]
mov r11d, dword [rax + rdi + 0x88]
test r11, r11
je 0x1400b4d00
mov ecx, dword [rdi + r11 + 0x18]
lea r10, [rdi + 1]
mov rax, rcx
jmp 0x1400b4d40
mov ebx, 0x811c9dc5
mov rcx, rax
cmp ebx, 0xcded1a85
je 0x1400b4d92
sub rax, 1
jb 0x1400b4d00
mov esi, ecx
add esi, 0xffffffff
mov ecx, dword [rdi + r11 + 0x20]
add rcx, rdi
mov edx, dword [rcx + rsi*4]
mov cl, byte [rdi + rdx]
test cl, cl
je 0x1400b4d30
add rdx, r10
mov ebx, 0x811c9dc5
nop word cs:[rax + rax]
nop
movsx ecx, cl
xor ecx, ebx
imul ebx, ecx, 0x1000193
movzx ecx, byte [rdx]
add rdx, 1
test cl, cl
jne 0x1400b4d70
jmp 0x1400b4d35
jmp 0x1400b4d90
mov eax, dword [rdi + r11 + 0x1c]
mov ecx, dword [rdi + r11 + 0x24]
add rax, rdi
add rcx, rdi
movzx ecx, word [rcx + rsi*2]
mov eax, dword [rax + rcx*4]
add rax, rdi
mov ecx, 0x22b
call rax
mov ebx, edi
nop word cs:[rax + rax]
nop
test bl, bl
je 0x1400b4e10
xor r9b, 0x30
mov byte [rsp + 0x50], r9b
xor r10b, 0x31
mov byte [rsp + 0x51], r10b
xor r11b, 0x32
mov byte [rsp + 0x52], r11b
xor cl, 0x33
mov byte [rsp + 0x53], cl
xor dl, 0x34
mov byte [rsp + 0x54], dl
xor al, 0x35
mov byte [rsp + 0x55], al
xor bl, 0x36
mov byte [rsp + 0x56], bl
mov edi, ebx
test r8b, r8b
je 0x1400b4e17
jmp 0x1400b4e5b
xor edi, edi
test r8b, r8b
jne 0x1400b4e5b
xor ebx, ebx
test dil, dil
je 0x1400b4dc0
xor r9b, 0x30
mov byte [rsp + 0x50], r9b
xor r10b, 0x31
mov byte [rsp + 0x51], r10b
xor r11b, 0x32
mov byte [rsp + 0x52], r11b
xor cl, 0x33
mov byte [rsp + 0x53], cl
xor dl, 0x34
mov byte [rsp + 0x54], dl
xor al, 0x35
mov byte [rsp + 0x55], al
xor dil, 0x36
mov byte [rsp + 0x56], dil
jmp 0x1400b4db3
mov dword [rsp + 0x20], esi
lea rsi, [rsp + 0x200]
lea r8, [rsp + 0x50]
lea r9, [rsp + 0xf0]
mov edx, 0x109
mov rcx, rsi
call fcn.14008b030
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor ecx, ecx
mov rdx, rsi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, qword [rsp + 0x60]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x60]
lea rdx, [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov esi, dword [rsp + 0x5c]
mov rcx, qword [rsp + 0x60]
mov rdi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rdi
mov rcx, qword [rsp + 0x68]
call rdi
cmp esi, 0x22b
jne 0x1400b4fb2
mov eax, dword [0x1406f0b24]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete cl
cmp dword [0x1406f0b20], 0xa
setl al
or al, cl
cmp dword [0x1406dfd8c], 0xa
jl 0x1400b4fe2
mov ecx, dword [0x1406dfd88]
lea edx, [rcx - 1]
imul edx, ecx
and edx, 1
je 0x1400b4fe2
test al, al
je 0x1400b4fb0
mov rax, qword gs:[0x60]
mov ecx, dword [0x1406f0b28]
lea edx, [rcx - 1]
imul edx, ecx
test dl, 1
sete cl
cmp dword [0x1406f0b2c], 0xa
setl r8b
cmp dword [0x1406f0b30], 0xa
jl 0x1400b5042
mov edx, dword [0x1406f0b34]
lea ebx, [rdx - 1]
imul ebx, edx
and ebx, 1
je 0x1400b5042
nop word cs:[rax + rax]
nop dword [rax]
jmp 0x1400b4fa0
jmp 0x1400b4fb0
cmp dword [0x1406dfd8c], 0xa
jl 0x1400b4c69
mov eax, dword [0x1406dfd88]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x1400b4c69
nop word cs:[rax + rax]
nop
jmp 0x1400b4fe0
test al, al
je 0x1400b5040
mov rax, qword gs:[0x60]
mov ecx, dword [0x1406f0b28]
lea edx, [rcx - 1]
imul edx, ecx
test dl, 1
sete cl
cmp dword [0x1406f0b2c], 0xa
setl r8b
cmp dword [0x1406f0b30], 0xa
jl 0x1400b50e2
mov edx, dword [0x1406f0b34]
lea ebx, [rdx - 1]
imul ebx, edx
and ebx, 1
je 0x1400b50e2
nop
jmp 0x1400b5030
jmp 0x1400b5040
or r8b, cl
mov r9, qword [rax + 0x18]
add r9, 0x10
jmp 0x1400b5059
test r8b, r8b
je 0x1400b50e0
mov r9, qword [r9]
mov rdi, qword [r9 + 0x30]
movsxd rax, dword [rdi + 0x3c]
mov r11d, dword [rax + rdi + 0x88]
test r11, r11
je 0x1400b5050
mov ecx, dword [rdi + r11 + 0x18]
lea r10, [rdi + 1]
mov rax, rcx
jmp 0x1400b5094
mov ebx, 0x811c9dc5
mov rcx, rax
cmp ebx, 0xcded1a85
je 0x1400b5182
sub rax, 1
jb 0x1400b5050
mov esi, ecx
add esi, 0xffffffff
mov ecx, dword [rdi + r11 + 0x20]
add rcx, rdi
mov edx, dword [rcx + rsi*4]
mov cl, byte [rdi + rdx]
test cl, cl
je 0x1400b5080
add rdx, r10
mov ebx, 0x811c9dc5
nop dword [rax]
movsx ecx, cl
xor ecx, ebx
imul ebx, ecx, 0x1000193
movzx ecx, byte [rdx]
add rdx, 1
test cl, cl
jne 0x1400b50c0
jmp 0x1400b5085
jmp 0x1400b50e0
or r8b, cl
mov r9, qword [rax + 0x18]
add r9, 0x10
jmp 0x1400b50f9
test r8b, r8b
je 0x1400b5180
mov r9, qword [r9]
mov rdi, qword [r9 + 0x30]
movsxd rax, dword [rdi + 0x3c]
mov r11d, dword [rax + rdi + 0x88]
test r11, r11
je 0x1400b50f0
mov ecx, dword [rdi + r11 + 0x18]
lea r10, [rdi + 1]
mov rax, rcx
jmp 0x1400b5130
mov ebx, 0x811c9dc5
mov rcx, rax
cmp ebx, 0xcded1a85
je 0x1400b5182
sub rax, 1
jb 0x1400b50f0
mov esi, ecx
add esi, 0xffffffff
mov ecx, dword [rdi + r11 + 0x20]
add rcx, rdi
mov edx, dword [rcx + rsi*4]
mov cl, byte [rdi + rdx]
test cl, cl
je 0x1400b5120
add rdx, r10
mov ebx, 0x811c9dc5
nop word cs:[rax + rax]
nop
movsx ecx, cl
xor ecx, ebx
imul ebx, ecx, 0x1000193
movzx ecx, byte [rdx]
add rdx, 1
test cl, cl
jne 0x1400b5160
jmp 0x1400b5125
jmp 0x1400b5180
mov eax, dword [rdi + r11 + 0x1c]
mov ecx, dword [rdi + r11 + 0x24]
add rax, rdi
add rcx, rdi
movzx ecx, word [rcx + rsi*2]
mov eax, dword [rax + rcx*4]
add rax, rdi
xor ecx, ecx
call rax
int3