Function at 0x14002f8e0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rsi, rdx
mov r12d, 1
mov edx, r12d
mov r13, r9
mov rdi, r8
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x14002fd4f
mov ecx, dword [rbx]
test cl, 8
je 0x14002f93b
mov eax, ntohs
jmp 0x14002fd68
mov r14d, dword [rbp + 0xf0]
xor r15d, r15d
and ecx, 0xffffff0f
mov qword [rbx + 0xa0], r15
mov eax, r14d
mov qword [rbx + 0x78], r15
and eax, 0xffffffcf
mov qword [rbx + 0x20], r15
mov dword [rbx + 0x80], r15d
mov dword [rbx], ecx
sub eax, r12d
je 0x14002fa96
sub eax, r12d
je 0x14002f9d6
cmp eax, 6
je 0x14002f9b9
test rdi, rdi
je 0x14002fd4f
test r13, r13
je 0x14002fd4f
or ecx, 0xa0
mov qword [rbx + 0x90], r13
mov qword [rbx + 0x70], r13
mov r13d, dword [rsp + 0x48]
mov dword [rbx], ecx
mov qword [rbx + 0x88], rdi
mov qword [rbx + 0x98], r15
jmp 0x14002fb12
mov r13d, dword [rsp + 0x48]
mov qword [rbx + 0x88], r15
mov qword [rbx + 0x70], r15
mov dword [rsp + 0x5c], 0x41c00010
jmp 0x14002fb98
test rdi, rdi
je 0x14002fd4f
mov qword [rsp + 0x30], r15
mov eax, r14d
mov dword [rsp + 0x28], r15d
mov r8d, 3
mov dword [rsp + 0x20], r8d
mov edx, 0x80000000
mov rcx, rdi
and eax, 0x10
je 0x14002fa0f
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x14002fa18
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rbx + 0x88], rax
cmp rax, 0xffffffffffffffff
je 0x14002fae8
mov r9d, r12d
mov qword [rsp + 0x48], r15
lea r8, [rsp + 0x48]
mov rdx, r15
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14002fa7b
mov rax, qword [rsp + 0x48]
lea rdx, [rsp + 0x68]
or dword [rbx], 0x20
mov rcx, rbx
mov qword [rbx + 0x20], rax
call fcn.14002b750
test eax, eax
je 0x14002fa87
mov rcx, qword [rbx + 0x88]
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r12d
jmp 0x14002fd68
mov qword [rbx + 0x20], r15
mov qword [rbx + 0x70], 0xffffffffffffffff
or dword [rbx], 0x40
test rsi, rsi
cmovne rdi, rsi
mov rsi, rdi
jmp 0x14002fb06
lea rax, [rdi - 1]
mov qword [rbx + 0x88], rdi
cmp rax, 0xfffffffffffffffd
ja 0x14002fd4f
mov r9d, r12d
mov qword [rsp + 0x48], r15
lea r8, [rsp + 0x48]
mov rdx, r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14002faf0
mov rax, qword [rsp + 0x48]
lea rdx, [rsp + 0x68]
or dword [rbx], 0x20
mov rcx, rbx
mov qword [rbx + 0x20], rax
call fcn.14002b750
test eax, eax
je 0x14002fb06
mov r12d, eax
mov eax, r12d
jmp 0x14002fd68
test r13, r13
mov qword [rbx + 0x20], r15
mov rax, 0xffffffffffffffff
cmovne rax, r13
mov qword [rbx + 0x70], rax
mov r13d, r15d
test byte [rbx], 0x20
jne 0x14002fc25
mov eax, r14d
mov dword [rsp + 0x5c], 0x81800000
mov rcx, rsi
and eax, 0x10
je 0x14002fb61
call qword [sym.imp.KERNEL32.dll_lstrlenW]
dec eax
cdqe
lea rcx, [rsi + rax*2]
movzx eax, word [rsi + rax*2]
cmp ax, 0x2e
je 0x14002fb98
nop dword [rax]
cmp rcx, rsi
jbe 0x14002fb90
cmp ax, 0x2f
je 0x14002fb90
cmp ax, 0x5c
je 0x14002fb90
movzx eax, word [rcx - 2]
sub rcx, 2
cmp ax, 0x2e
jne 0x14002fb40
jmp 0x14002fb98
call qword [sym.imp.KERNEL32.dll_lstrlenA]
dec eax
movsxd rcx, eax
add rcx, rsi
movzx eax, byte [rcx]
cmp al, 0x2e
je 0x14002fb98
cmp rcx, rsi
jbe 0x14002fb90
cmp al, 0x2f
je 0x14002fb90
cmp al, 0x5c
je 0x14002fb90
movzx eax, byte [rcx - 1]
dec rcx
cmp al, 0x2e
jne 0x14002fb76
jmp 0x14002fb98
mov dword [rsp + 0x5c], 0x81c00000
test r14b, 0x20
jne 0x14002fc1b
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_FileTimeToDosDateTime]
movzx edi, word [rsp + 0x40]
movabs rcx, 0xfe624e212ac18000
add rcx, qword [rsp + 0x48]
movabs rax, 0xd6bf94d5e57a42bd
imul rcx
shl edi, 0x10
lea r12, [rcx + rdx]
sar r12, 0x17
mov rax, r12
shr rax, 0x3f
add r12, rax
movzx eax, word [rsp + 0x58]
or edi, eax
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x58], edi
mov dword [rsp + 0x64], r12d
jmp 0x14002fc4a
mov edi, dword [rsp + 0x74]
mov dword [rsp + 0x58], edi
jmp 0x14002fc35
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x6c]
mov ecx, dword [rsp + 0x70]
mov r12d, dword [rsp + 0x68]
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x64], ecx
mov qword [rsp + 0x38], r15
mov r9d, 0xffffffff
mov qword [rsp + 0x30], r15
mov r8, rsi
mov dword [rsp + 0x28], r15d
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rdx, eax
xor ecx, ecx
add rdx, 0x171
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r14, rax
test rax, rax
jne 0x14002fc98
mov edi, 2
jmp 0x14002fd54
xor edx, edx
mov r8d, 0x160
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
mov eax, dword [rbp + 0xf0]
test al, 0x20
je 0x14002fce3
mov word [r14 + 2], 8
lea rdi, [rbx + 0x70]
mov rax, qword [rdi]
mov sil, 8
mov qword [r14 + 0x10], rax
mov qword [r14 + 0x18], rax
mov rax, qword [rbx + 0x18]
mov qword [r14 + 0x38], rax
or dword [rbx], 0x80000000
mov byte [rsp + 0x40], sil
jmp 0x140030380
and eax, 0x10
lea rdi, [r14 + 0x50]
mov dword [rsp + 0x48], eax
je 0x14002fd29
mov qword [rsp + 0x38], r15
mov r9d, 0xffffffff
mov qword [rsp + 0x30], r15
mov r8, rsi
mov dword [rsp + 0x28], 0x104
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [r14 + 0x20], eax
test eax, eax
je 0x14002fd46
dec eax
jmp 0x14002fd3e
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [r14 + 0x20], eax
test eax, eax
jne 0x14002fd89
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov edi, 9
test byte [rbx], 0x40
je 0x14002fd66
mov rcx, qword [rbx + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
movzx eax, byte [rdi]
test al, al
je 0x14002fdb3
cmp al, 0x5c
jne 0x14002fd97
mov byte [rdi], 0x2f
movzx eax, byte [rdi + 1]
inc rdi
test al, al
jne 0x14002fd90
mov edi, dword [rbp + 0xf0]
mov eax, edi
and eax, 0x10
mov dword [rsp + 0x48], eax
jmp 0x14002fdb9
mov edi, dword [rbp + 0xf0]
mov edx, dword [rsp + 0x60]
lea rcx, [r14 + 0x160]
mov eax, dword [rsp + 0x58]
mov r8d, 8
mov dword [r14 + 4], eax
mov esi, 9
mov eax, dword [rsp + 0x5c]
mov r13d, r15d
mov dword [r14 + 0x34], eax
lea rax, [rbp - 0x80]
mov qword [r14 + 0x40], rax
mov eax, edx
shr eax, 8
mov byte [rbp - 0x7a], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0x79], al
mov eax, r12d
shr eax, 8
mov byte [rbp - 0x76], al
mov eax, r12d
mov byte [rbp - 0x7b], dl
shr eax, 0x10
mov byte [rbp - 0x75], al
mov byte [rbp - 0x77], r12b
mov dword [rbp - 0x80], 0xd5455
mov byte [rbp - 0x7c], 7
movsd xmm0, qword [rbp - 0x80]
mov qword [r14 + 0x48], rcx
shr edx, 0x18
mov byte [rbp - 0x78], dl
mov edx, dword [rsp + 0x64]
mov eax, edx
shr eax, 8
mov byte [rbp - 0x72], al
mov eax, edx
mov byte [rbp - 0x73], dl
shr eax, 0x10
mov byte [rbp - 0x71], al
mov word [r14], r8w
mov dword [r14 + 0x24], reloc.OLEAUT32.dll_SafeArrayGetElemsize
mov dword [r14 + 0x28], esi
shr r12d, 0x18
mov byte [rbp - 0x74], r12b
shr edx, 0x18
mov byte [rbp - 0x70], dl
movsd qword [rcx], xmm0
movzx eax, byte [rbp - 0x78]
mov byte [rcx + 8], al
mov byte [rcx + 2], 5
mov rax, qword [r14 + 0x48]
mov byte [rsp + 0x40], r13b
mov byte [rax + 4], 1
cmp dword [rsp + 0x48], r15d
je 0x14002ff13
mov r8d, dword [r14 + 0x20]
lea rdx, [r14 + 0x50]
xor ecx, ecx
mov word [rbp - 0x6f], 0x7075
mov byte [rbp - 0x6b], 1
lea eax, [r8 + 0x1b]
mov dword [r14 + 0x24], eax
lea eax, [r8 + 0x13]
mov dword [r14 + 0x28], eax
lea eax, [r8 + 0xa]
mov byte [rbp - 0x6d], al
lea eax, [r8 + 0xa]
shr eax, 8
mov byte [rbp - 0x6c], al
call fcn.14002f060
mov byte [rbp - 0x6a], al
lea rdx, [r14 + 0x50]
mov ecx, eax
shr ecx, 8
mov byte [rbp - 0x69], cl
mov ecx, eax
shr ecx, 0x10
mov byte [rbp - 0x68], cl
mov rcx, qword [r14 + 0x48]
shr eax, 0x18
mov byte [rbp - 0x67], al
mov rax, qword [r14 + 0x40]
movsd xmm0, qword [rax + 0x11]
movsd qword [rcx + 9], xmm0
movzx eax, byte [rax + 0x19]
mov byte [rcx + 0x11], al
mov r8d, dword [r14 + 0x20]
mov rcx, qword [r14 + 0x48]
inc r8d
add rcx, 0x12
call sub.VCRUNTIME140.dll_memcpy
mov r8d, 8
cmp dword [rbx], r13d
jge 0x14002ff37
movzx eax, word [r14]
mov sil, 8
mov byte [rsp + 0x40], sil
mov word [r14 + 0x30], ax
mov dword [r14 + 0x24], r15d
mov word [r14 + 2], r8w
jmp 0x14003000b
test dil, 8
je 0x14002ff5f
mov edx, dword [r14 + 0x20]
lea eax, [rdx - 1]
cmp byte [rax + r14 + 0x50], 0x2f
je 0x14002ff56
mov byte [rdx + r14 + 0x50], gethostbyname
inc dword [r14 + 0x20]
movzx ecx, r15w
jmp 0x14002ffe6
cmp qword [rbx + 0x10], r13
je 0x14002ff6f
mov r13d, reloc.WSOCK32.dll_ioctlsocket
mov word [r14], si
lea rsi, [r14 + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd rdi, eax
add rdi, rsi
cmp rdi, rsi
jbe 0x14002ff94
cmp byte [rdi], 0x2e
je 0x14002ff9b
dec rdi
cmp rdi, rsi
ja 0x14002ff87
jne 0x14002ff9b
cmp byte [rdi], 0x2e
jne 0x14002ffc9
lea rsi, [0x1400fb2c0]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x14002ffe3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
inc rsi
movsxd rcx, eax
add rsi, rcx
cmp byte [rsi], r15b
jne 0x14002ffa2
movzx eax, word [r14]
mov sil, 8
mov byte [rsp + 0x40], sil
mov word [r14 + 0x30], ax
mov word [r14 + 2], 8
jmp 0x14003000b
mov ecx, r15d
movzx eax, word [r14]
mov word [r14 + 0x30], ax
mov word [r14 + 2], cx
mov rcx, qword [rbx + 0x70]
cmp rcx, 0xffffffffffffffff
je 0x140030008
mov eax, r13d
add rax, rcx
mov qword [r14 + 0x10], rax
xor sil, sil
mov rax, qword [rbx + 0x70]
lea rdi, [rbx + 0x70]
mov qword [r14 + 0x18], rax
mov rdx, rbx
mov rax, qword [rbx + 0x20]
mov rcx, r14
add rax, qword [rbx + 0x18]
mov qword [r14 + 0x38], rax
mov dword [rbx + 0x28], r15d
call fcn.14002e730
mov eax, dword [rbx + 0x28]
test eax, eax
jne 0x1400304d5
mov edx, dword [rbx]
mov ecx, dword [r14 + 0x20]
test edx, edx
jns 0x140030053
add ecx, 0xb
mov qword [rbx + 0x18], rcx
jmp 0x140030382
mov eax, dword [r14 + 0x24]
add eax, 0x32
add eax, ecx
add qword [rbx + 0x18], rax
test r13d, r13d
je 0x140030382
mov r8, qword [rbx + 0x10]
lea r12, [0x1400fccc0]
mov dword [rbx + 0x48], 0x12345678
mov dword [rbx + 0x4c], 0x23456789
mov dword [rbx + 0x50], 0x34567890
test r8, r8
je 0x1400300d9
nop
movzx eax, byte [r8]
test al, al
je 0x1400300d9
mov edx, dword [rbx + 0x48]
xor rax, rdx
shr edx, 8
movzx ecx, al
xor edx, dword [r12 + rcx*4]
mov ecx, dword [rbx + 0x50]
movzx eax, dl
add eax, dword [rbx + 0x4c]
mov dword [rbx + 0x48], edx
imul edx, eax, 0x8088405
movzx eax, cl
shr ecx, 8
inc edx
mov dword [rbx + 0x4c], edx
shr rdx, 0x18
xor rdx, rax
xor ecx, dword [r12 + rdx*4]
mov dword [rbx + 0x50], ecx
add r8, 1
jne 0x140030090
mov rdi, r15
nop dword [rax]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
sar eax, 7
mov byte [rsp + rdi + 0x48], al
inc rdi
cmp rdi, 0xc
jl 0x1400300e0
movzx eax, byte [r14 + 5]
mov byte [rsp + 0x53], al
nop
movsx r10, byte [rsp + r15 + 0x48]
mov r11d, dword [rbx + 0x50]
mov edx, dword [rbx + 0x48]
mov r8d, r11d
mov ecx, edx
and r8d, 0xfffd
xor rcx, r10
shr edx, 8
movzx eax, cl
or r8d, 2
xor edx, dword [r12 + rax*4]
movzx eax, dl
mov edi, edx
add eax, dword [rbx + 0x4c]
imul ecx, eax, 0x8088405
movzx eax, r11b
shr r11d, 8
inc ecx
mov r9d, ecx
shr rcx, 0x18
xor rcx, rax
mov eax, r8d
xor eax, 1
imul eax, r8d
movsx r8, byte [rsp + r15 + 0x49]
xor r11d, dword [r12 + rcx*4]
mov ecx, edi
xor rcx, r8
shr edi, 8
mov edx, r11d
shr eax, 8
and edx, 0xfffd
xor al, r10b
or edx, 2
mov byte [rsp + r15 + 0x48], al
movzx eax, cl
movzx ecx, r11b
mov r10d, r11d
shr r10d, 8
xor edi, dword [r12 + rax*4]
movzx eax, dil
mov r11d, edi
add eax, r9d
imul r9d, eax, 0x8088405
inc r9d
mov eax, r9d
shr rax, 0x18
xor rcx, rax
mov eax, edx
xor eax, 1
imul eax, edx
xor r10d, dword [r12 + rcx*4]
mov ecx, r11d
mov edx, r10d
shr r11d, 8
and edx, 0xfffd
shr eax, 8
or edx, 2
xor al, r8b
movsx r8, byte [rsp + r15 + 0x4a]
mov byte [rsp + r15 + 0x49], al
xor rcx, r8
movzx eax, cl
movzx ecx, r10b
shr r10d, 8
xor r11d, dword [r12 + rax*4]
movzx eax, r11b
add eax, r9d
imul r9d, eax, 0x8088405
inc r9d
mov eax, r9d
shr rax, 0x18
xor rcx, rax
mov eax, edx
xor eax, 1
imul eax, edx
xor r10d, dword [r12 + rcx*4]
shr eax, 8
xor al, r8b
movsx r8, byte [rsp + r15 + 0x4b]
mov byte [rsp + r15 + 0x4a], al
mov edx, r10d
mov esi, r10d
and edx, 0xfffd
shr esi, 8
or edx, 2
mov ecx, r11d
xor rcx, r8
shr r11d, 8
movzx eax, cl
xor r11d, dword [r12 + rax*4]
movzx eax, r11b
mov edi, r11d
movsx r11, byte [rsp + r15 + 0x4d]
add eax, r9d
imul r9d, eax, 0x8088405
movzx eax, r10b
inc r9d
mov ecx, r9d
shr rcx, 0x18
xor rcx, rax
mov eax, edx
xor eax, 1
imul eax, edx
xor esi, dword [r12 + rcx*4]
mov ecx, edi
mov edx, esi
shr edi, 8
and edx, 0xfffd
shr eax, 8
or edx, 2
xor al, r8b
movsx r8, byte [rsp + r15 + 0x4c]
mov byte [rsp + r15 + 0x4b], al
xor rcx, r8
movzx eax, cl
movzx ecx, sil
shr esi, 8
xor edi, dword [r12 + rax*4]
movzx eax, dil
add eax, r9d
imul r10d, eax, 0x8088405
inc r10d
mov eax, r10d
shr rax, 0x18
xor rcx, rax
mov eax, edx
xor eax, 1
imul eax, edx
mov edx, edi
xor esi, dword [r12 + rcx*4]
mov ecx, edx
shr edx, 8
xor rcx, r11
mov r9d, esi
shr eax, 8
and r9d, 0xfffd
xor al, r8b
or r9d, 2
mov byte [rsp + r15 + 0x4c], al
movzx eax, cl
movzx ecx, sil
xor edx, dword [r12 + rax*4]
movzx eax, dl
add eax, r10d
mov dword [rbx + 0x48], edx
imul eax, eax, 0x8088405
mov edx, esi
shr edx, 8
inc eax
mov dword [rbx + 0x4c], eax
shr rax, 0x18
xor rcx, rax
mov eax, r9d
xor eax, 1
imul eax, r9d
xor edx, dword [r12 + rcx*4]
mov dword [rbx + 0x50], edx
shr eax, 8
xor al, r11b
mov byte [rsp + r15 + 0x4d], al
add r15, 6
cmp r15, 0xc
jl 0x140030100
mov r8d, reloc.WSOCK32.dll_ioctlsocket
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.14002f310
mov eax, dword [rbx + 0x28]
test eax, eax
jne 0x1400304d5
add qword [rbx + 0x18], 0xc
lea rdi, [rbx + 0x70]
or dword [rbx], 0x10
movzx esi, byte [rsp + 0x40]
mov edx, dword [rbx]
mov rax, qword [rbx + 0x88]
test rax, rax
je 0x14003047c
mov rcx, rbx
cmp sil, 8
jne 0x1400303a8
mov rdx, r14
call fcn.14002f660
jmp 0x140030441
test dl, dl
jns 0x1400303e5
mov esi, dword [rbx + 0x90]
mov rdx, rax
mov r8d, esi
call fcn.14002f310
mov rdx, qword [rbx + 0x88]
mov r8d, esi
mov ecx, dword [rbx + 0x80]
add qword [rbx + 0x78], rsi
call fcn.14002f060
add qword [rbx + 0x98], rsi
mov dword [rbx + 0x80], eax
jmp 0x140030433
mov r8d, 0x4000
lea rdx, [rbx + 0xb0]
call fcn.14002f560
mov esi, eax
test eax, eax
je 0x140030433
nop dword [rax]
cmp dword [rbx + 0x28], 0
jne 0x140030433
mov r8d, esi
lea rdx, [rbx + 0xb0]
mov rcx, rbx
call fcn.14002f310
mov r8d, 0x4000
lea rdx, [rbx + 0xb0]
mov rcx, rbx
call fcn.14002f560
mov esi, eax
test eax, eax
jne 0x140030400
mov eax, esi
add qword [rbx + 0xa0], rax
movzx esi, byte [rsp + 0x40]
mov eax, dword [rbx + 0x28]
test eax, eax
jne 0x1400304d5
and dword [rbx], 0xffffffef
test byte [rbx], 0x40
je 0x140030461
mov rcx, qword [rbx + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbx + 0x78]
lea rdi, [rbx + 0x70]
and dword [rbx], 0xffffffbf
mov edx, dword [rbx]
mov qword [rdi], rax
mov rax, qword [rbx + 0xa0]
add qword [rbx + 0x18], rax
test edx, edx
jns 0x1400304e5
or edx, 8
test byte [rbp + 0xf0], 0x20
mov dword [rbx], edx
jne 0x140030696
mov edx, dword [rbx + 0x80]
mov rcx, rbx
call fcn.14002f180
movzx edx, word [rbx + 0x82]
mov rcx, rbx
call fcn.14002f180
mov edx, dword [rbx + 0x78]
mov rcx, rbx
call fcn.14002f180
mov rdx, qword [rbx + 0x78]
mov rcx, rbx
shr rdx, 0x10
call fcn.14002f180
mov eax, dword [rbx + 0x28]
test eax, eax
je 0x140030696
mov edi, eax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x14002fd54
mov rdx, qword [rbx + 0xa0]
mov eax, dword [rbx + 0x80]
mov r8, qword [r14 + 0x10]
mov dword [r14 + 8], eax
mov ecx, r13d
add rdx, rcx
add rcx, qword [rbx + 0xa0]
mov qword [r14 + 0x10], rcx
mov rax, qword [rdi]
mov qword [r14 + 0x18], rax
test byte [rbx], 4
je 0x14003058f
test r13d, r13d
jne 0x14003058f
movzx eax, sil
mov word [r14 + 2], ax
movzx eax, word [r14]
test al, 1
jne 0x140030539
mov ecx, 0xfff7
and ax, cx
mov word [r14], ax
mov rdx, qword [r14 + 0x38]
mov rcx, rbx
mov word [r14 + 0x30], ax
sub rdx, qword [rbx + 0x20]
call fcn.14002f4d0
test eax, eax
je 0x14003057c
mov rdx, rbx
mov rcx, r14
call fcn.14002e730
mov eax, dword [rbx + 0x28]
test eax, eax
jne 0x1400304d5
mov rdx, qword [rbx + 0x18]
mov rcx, rbx
call fcn.14002f4d0
test eax, eax
jne 0x140030655
mov rcx, r14
mov edi, reloc.WSOCK32.dll_recv
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x14002fd54
movzx eax, sil
cmp word [r14 + 2], ax
jne 0x14003069d
test sil, sil
jne 0x1400305ac
cmp r8, rdx
jne 0x14003069d
mov edx, 0x8074b50
mov rcx, rbx
call fcn.14002f180
mov edx, 0x807
mov rcx, rbx
call fcn.14002f180
mov edx, dword [r14 + 8]
mov rcx, rbx
call fcn.14002f180
movzx edx, word [r14 + 0xa]
mov rcx, rbx
call fcn.14002f180
mov rdx, qword [r14 + 0x10]
mov edi, 0xffffffff
mov rcx, rbx
cmp rdx, rdi
jb 0x1400305fb
mov edx, edi
call fcn.14002f180
mov edx, edi
jmp 0x140030608
call fcn.14002f180
mov rdx, qword [r14 + 0x10]
shr rdx, 0x10
mov rcx, rbx
call fcn.14002f180
mov rdx, qword [r14 + 0x18]
mov rcx, rbx
cmp rdx, rdi
jb 0x140030625
mov edx, edi
call fcn.14002f180
jmp 0x140030632
call fcn.14002f180
mov rdi, qword [r14 + 0x18]
shr rdi, 0x10
mov edx, edi
mov rcx, rbx
call fcn.14002f180
mov eax, dword [rbx + 0x28]
test eax, eax
jne 0x1400304d5
add qword [rbx + 0x18], 0x10
movzx eax, word [r14 + 0x30]
mov word [r14], ax
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140030669
mov qword [rbx + 0x68], r14
xor eax, eax
jmp 0x14002fd68
mov rax, qword [rcx + 0x158]
test rax, rax
je 0x14003068f
nop word [rax + rax]
mov rcx, rax
mov rax, qword [rax + 0x158]
test rax, rax
jne 0x140030680
mov qword [rcx + 0x158], r14
xor eax, eax
jmp 0x14002fd68
mov rcx, r14
mov edi, reloc.OLEAUT32.dll_SafeArrayGetElemsize
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x14002fd54