Function at 0x14002b430
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xb0]
sub rsp, 0x1b0
mov rdi, rdx
mov r13d, 1
mov edx, r13d
mov r15, r9
mov rsi, r8
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x14002b892
mov ecx, dword [rbx]
test cl, 8
je 0x14002b48a
lea eax, [r13 + 0xc]
jmp 0x14002b8ab
mov r14d, dword [rbp + 0x100]
xor r12d, r12d
and ecx, 0xffffff0f
mov qword [rbx + 0xa0], r12
mov eax, r14d
mov qword [rbx + 0x78], r12
and eax, 0xffffffcf
mov qword [rbx + 0x20], r12
mov dword [rbx + 0x80], r12d
mov dword [rbx], ecx
mov dword [rsp + 0x48], r14d
sub eax, r13d
je 0x14002b645
sub eax, r13d
je 0x14002b52a
cmp eax, 6
je 0x14002b50d
test rsi, rsi
je 0x14002b892
test r15, r15
je 0x14002b892
mov r13d, dword [rsp + 0x48]
or ecx, 0xa0
mov dword [rbx], ecx
mov qword [rbx + 0x88], rsi
mov qword [rbx + 0x90], r15
mov qword [rbx + 0x70], r15
mov qword [rbx + 0x98], r12
jmp 0x14002b5f1
mov r13d, dword [rsp + 0x48]
mov qword [rbx + 0x88], r12
mov qword [rbx + 0x70], r12
mov dword [rsp + 0x4c], 0x41c00010
jmp 0x14002b6b4
test rsi, rsi
je 0x14002b892
xor r9d, r9d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov edx, 0x80000000
mov rcx, rsi
lea r8d, [r9 + 3]
mov dword [rsp + 0x20], r8d
test r14b, 0x10
je 0x14002b55f
call qword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x14002b565
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rbx + 0x88], rax
cmp rax, 0xffffffffffffffff
je 0x14002b675
mov rcx, qword [rbx + 0x88]
lea r8, [rsp + 0x68]
mov r9d, r13d
mov qword [rsp + 0x68], r12
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14002b5cc
mov rax, qword [rsp + 0x68]
lea rdx, [rsp + 0x70]
or dword [rbx], 0x20
mov rcx, rbx
mov qword [rbx + 0x20], rax
call fcn.1400274a0
test eax, eax
je 0x14002b5d8
mov rcx, qword [rbx + 0x88]
mov r13d, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r13d
jmp 0x14002b8ab
mov qword [rbx + 0x20], r12
mov qword [rbx + 0x70], 0xffffffffffffffff
or dword [rbx], 0x40
mov r13d, r12d
test rdi, rdi
cmovne rsi, rdi
mov rdi, rsi
test byte [rbx], 0x20
jne 0x14002b761
mov dword [rsp + 0x4c], 0x81800000
mov rcx, rdi
test r14b, 0x10
je 0x14002b67d
call qword [sym.imp.KERNEL32.dll_lstrlenW]
dec eax
cdqe
lea rcx, [rdi + rax*2]
movzx eax, word [rdi + rax*2]
cmp ax, 0x2e
je 0x14002b6b4
nop
cmp rcx, rdi
jbe 0x14002b6ac
cmp ax, 0x2f
je 0x14002b6ac
cmp ax, 0x5c
je 0x14002b6ac
movzx eax, word [rcx - 2]
sub rcx, 2
cmp ax, 0x2e
jne 0x14002b620
jmp 0x14002b6b4
lea rax, [rsi - 1]
mov qword [rbx + 0x88], rsi
cmp rax, 0xfffffffffffffffd
ja 0x14002b892
lea r8, [rsp + 0x70]
mov rdx, r15
mov rcx, rbx
call fcn.14002aff0
mov r13d, eax
test eax, eax
je 0x14002b5e8
mov eax, r13d
jmp 0x14002b8ab
call qword [sym.imp.KERNEL32.dll_lstrlenA]
dec eax
movsxd rcx, eax
add rcx, rdi
movzx eax, byte [rcx]
cmp al, 0x2e
je 0x14002b6b4
cmp rcx, rdi
jbe 0x14002b6ac
cmp al, 0x2f
je 0x14002b6ac
cmp al, 0x5c
je 0x14002b6ac
movzx eax, byte [rcx - 1]
dec rcx
cmp al, 0x2e
jne 0x14002b692
jmp 0x14002b6b4
mov dword [rsp + 0x4c], 0x81c00000
test r14b, 0x20
jne 0x14002b750
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea r8, [rsp + 0x44]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_FileTimeToDosDateTime]
movzx r14d, word [rsp + 0x40]
movabs rcx, 0xfe624e212ac18000
add rcx, qword [rsp + 0x68]
movabs rax, 0xd6bf94d5e57a42bd
imul rcx
shl r14d, 0x10
lea rsi, [rcx + rdx]
sar rsi, 0x17
mov rax, rsi
shr rax, 0x3f
add rsi, rax
mov eax, esi
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x74], eax
mov dword [rsp + 0x64], eax
mov dword [rsp + 0x78], eax
movzx eax, word [rsp + 0x44]
or r14d, eax
mov dword [rsp + 0x44], r14d
mov r14d, dword [rsp + 0x48]
jmp 0x14002b784
mov r14d, dword [rsp + 0x7c]
mov dword [rsp + 0x44], r14d
mov r14d, dword [rsp + 0x48]
jmp 0x14002b770
mov eax, dword [rbp - 0x80]
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x7c]
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x78]
mov esi, dword [rsp + 0x70]
mov dword [rsp + 0x64], eax
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x60], eax
mov qword [rsp + 0x38], r12
mov r9d, 0xffffffff
mov qword [rsp + 0x30], r12
mov r8, rdi
mov dword [rsp + 0x28], r12d
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add eax, 8
xor ecx, ecx
movsxd rdx, eax
add rdx, 0x169
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r15, rax
test rax, rax
jne 0x14002b7d3
lea edi, [rax + 2]
jmp 0x14002b897
xor edx, edx
mov r8d, 0x160
mov rcx, r15
call sub.VCRUNTIME140.dll_memset
mov eax, r14d
and eax, 0x20
mov dword [rsp + 0x68], eax
je 0x14002b820
mov eax, 8
mov dil, 8
mov word [r15 + 2], ax
mov rax, qword [rbx + 0x70]
mov qword [r15 + 0x10], rax
mov qword [r15 + 0x18], rax
mov rax, qword [rbx + 0x18]
mov qword [r15 + 0x38], rax
or dword [rbx], 0x80000000
mov byte [rsp + 0x40], dil
jmp 0x14002becf
mov eax, r14d
lea r14, [r15 + 0x50]
and eax, 0x10
mov dword [rbp - 0x78], eax
je 0x14002b86c
mov qword [rsp + 0x38], r12
mov r9d, 0xffffffff
mov qword [rsp + 0x30], r12
mov r8, rdi
mov dword [rsp + 0x28], 0x104
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [r15 + 0x20], eax
test eax, eax
je 0x14002b889
dec eax
mov dword [r15 + 0x20], eax
jmp 0x14002b885
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [r15 + 0x20], eax
test eax, eax
jne 0x14002b8cc
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov edi, 9
test byte [rbx], 0x40
je 0x14002b8a9
mov rcx, qword [rbx + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
movzx ecx, byte [r14]
mov rax, r14
test cl, cl
je 0x14002b8ea
cmp cl, 0x5c
jne 0x14002b8df
mov byte [rax], 0x2f
movzx ecx, byte [rax + 1]
inc rax
test cl, cl
jne 0x14002b8d7
mov edx, dword [rsp + 0x60]
lea rcx, [r15 + 0x160]
mov qword [r15 + 0x48], rcx
mov eax, 8
mov word [r15], ax
xor dil, dil
mov eax, dword [rsp + 0x44]
mov r8d, 9
mov dword [r15 + 4], eax
mov r13d, r12d
mov eax, dword [rsp + 0x4c]
mov dword [r15 + 0x34], eax
lea rax, [rbp - 0x70]
mov qword [r15 + 0x40], rax
movzx eax, byte [rsp + 0x74]
mov byte [rbp - 0x6b], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0x6a], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0x69], al
movzx eax, byte [rsp + 0x70]
mov byte [rbp - 0x67], al
mov eax, esi
shr eax, 8
mov byte [rbp - 0x66], al
mov eax, esi
shr eax, 0x10
mov byte [rbp - 0x65], al
movzx eax, byte [rsp + 0x78]
mov byte [rbp - 0x63], al
mov dword [rbp - 0x70], 0xd5455
mov byte [rbp - 0x6c], 7
movsd xmm0, qword [rbp - 0x70]
shr edx, 0x18
mov byte [rbp - 0x68], dl
mov edx, dword [rsp + 0x64]
mov eax, edx
shr eax, 8
mov byte [rbp - 0x62], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0x61], al
mov dword [r15 + 0x24], reloc.OLEAUT32.dll_SafeArrayGetElemsize
mov dword [r15 + 0x28], r8d
shr esi, 0x18
mov byte [rbp - 0x64], sil
shr edx, 0x18
mov byte [rbp - 0x60], dl
movsd qword [rcx], xmm0
movzx eax, byte [rbp - 0x68]
mov byte [rcx + 8], al
mov rax, qword [r15 + 0x48]
mov byte [rsp + 0x40], dil
mov byte [rax + 2], 5
mov rax, qword [r15 + 0x48]
mov byte [rax + 4], 1
cmp dword [rbp - 0x78], r12d
je 0x14002ba53
mov r8d, dword [r15 + 0x20]
mov rdx, r14
xor ecx, ecx
mov word [rbp - 0x5f], 0x7075
mov byte [rbp - 0x5b], 1
lea eax, [r8 + 0x1b]
mov dword [r15 + 0x24], eax
lea eax, [r8 + 0x13]
mov dword [r15 + 0x28], eax
lea eax, [r8 + 0xa]
mov byte [rbp - 0x5d], al
lea eax, [r8 + 0xa]
shr eax, 8
mov byte [rbp - 0x5c], al
call fcn.14002aac0
mov byte [rbp - 0x5a], al
mov ecx, eax
shr ecx, 8
mov rdx, r14
mov byte [rbp - 0x59], cl
mov ecx, eax
shr ecx, 0x10
mov byte [rbp - 0x58], cl
mov rcx, qword [r15 + 0x48]
shr eax, 0x18
mov byte [rbp - 0x57], al
mov rax, qword [r15 + 0x40]
movsd xmm0, qword [rax + 0x11]
movsd qword [rcx + 9], xmm0
movzx eax, byte [rax + 0x19]
mov byte [rcx + 0x11], al
mov r8d, dword [r15 + 0x20]
mov rcx, qword [r15 + 0x48]
inc r8d
add rcx, 0x12
call sub.VCRUNTIME140.dll_memcpy
mov r8d, 9
cmp dword [rbx], r12d
jge 0x14002ba69
mov dil, 8
mov dword [r15 + 0x24], r12d
mov byte [rsp + 0x40], dil
jmp 0x14002bb03
test byte [rsp + 0x48], 8
je 0x14002ba8f
mov edx, dword [r15 + 0x20]
lea eax, [rdx - 1]
cmp byte [rax + r15 + 0x50], 0x2f
je 0x14002bb03
mov byte [rdx + r15 + 0x50], gethostbyaddr
inc dword [r15 + 0x20]
jmp 0x14002bb03
cmp qword [rbx + 0x10], r12
je 0x14002ba9f
mov r13d, reloc.WSOCK32.dll_ioctlsocket
mov word [r15], r8w
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd rdi, eax
add rdi, r14
cmp rdi, r14
jbe 0x14002bac3
cmp byte [rdi], 0x2e
je 0x14002bac0
dec rdi
cmp rdi, r14
ja 0x14002bab3
cmp rdi, r14
jne 0x14002baca
cmp byte [rdi], 0x2e
jne 0x14002baf6
lea rsi, [0x1400dc280]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x14002bb00
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
cdqe
add rsi, rax
cmp byte [rsi], r12b
jne 0x14002bad1
mov dil, 8
mov byte [rsp + 0x40], dil
jmp 0x14002bb03
xor dil, dil
movzx eax, word [r15]
mov word [r15 + 0x30], ax
movzx eax, dil
mov word [r15 + 2], ax
test dil, dil
jne 0x14002bb2e
mov rcx, qword [rbx + 0x70]
cmp rcx, 0xffffffffffffffff
je 0x14002bb2e
mov eax, r13d
add rax, rcx
mov qword [r15 + 0x10], rax
mov rax, qword [rbx + 0x70]
mov rdx, rbx
mov qword [r15 + 0x18], rax
mov rcx, r15
mov rax, qword [rbx + 0x18]
add rax, qword [rbx + 0x20]
mov qword [r15 + 0x38], rax
mov dword [rbx + 0x28], r12d
call fcn.14002a1e0
mov eax, dword [rbx + 0x28]
test eax, eax
jne 0x14002c01f
mov edx, dword [rbx]
mov ecx, dword [r15 + 0x20]
test edx, edx
jns 0x14002bb72
add ecx, 0xb
mov qword [rbx + 0x18], rcx
jmp 0x14002bed1
mov eax, dword [r15 + 0x24]
add eax, 0x32
add eax, ecx
add qword [rbx + 0x18], rax
test r13d, r13d
je 0x14002bed1
mov dword [rbx + 0x48], 0x12345678
lea r14, [0x1400ddc90]
mov dword [rbx + 0x4c], 0x23456789
mov dword [rbx + 0x50], 0x34567890
mov r8, qword [rbx + 0x10]
test r8, r8
je 0x14002bbfd
nop dword [rax]
movzx eax, byte [r8]
test al, al
je 0x14002bbfd
mov edx, dword [rbx + 0x48]
xor rax, rdx
movzx ecx, al
shr edx, 8
mov eax, dword [r14 + rcx*4]
mov ecx, dword [rbx + 0x50]
xor eax, edx
mov dword [rbx + 0x48], eax
movzx eax, al
add eax, dword [rbx + 0x4c]
imul edx, eax, 0x8088405
movzx eax, cl
shr ecx, 8
inc edx
mov dword [rbx + 0x4c], edx
shr rdx, 0x18
xor rdx, rax
mov eax, dword [r14 + rdx*4]
xor eax, ecx
mov dword [rbx + 0x50], eax
add r8, 1
jne 0x14002bbb0
mov rdi, r12
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
sar eax, 7
mov byte [rsp + rdi + 0x50], al
inc rdi
cmp rdi, 0xc
jl 0x14002bc00
movzx eax, byte [r15 + 5]
mov byte [rsp + 0x5b], al
nop
movsx rsi, byte [rsp + r12 + 0x50]
mov edx, dword [rbx + 0x48]
mov rax, rsi
mov r8d, dword [rbx + 0x50]
xor rax, rdx
movzx ecx, al
mov r11d, r8d
shr edx, 8
and r11d, 0xfffd
or r11d, 2
mov r10d, dword [r14 + rcx*4]
xor r10d, edx
mov edx, r10d
movzx eax, r10b
add eax, dword [rbx + 0x4c]
imul ecx, eax, 0x8088405
movzx eax, r8b
shr r8d, 8
inc ecx
mov edi, ecx
shr rcx, 0x18
xor rcx, rax
mov eax, r11d
xor eax, 1
imul eax, r11d
mov r9d, dword [r14 + rcx*4]
xor r9d, r8d
mov r11d, r9d
shr eax, 8
and r11d, 0xfffd
xor al, sil
or r11d, 2
movsx rsi, byte [rsp + r12 + 0x51]
mov byte [rsp + r12 + 0x50], al
mov rax, rsi
xor rax, rdx
shr edx, 8
movzx ecx, al
mov r10d, dword [r14 + rcx*4]
xor r10d, edx
mov edx, r9d
shr edx, 8
movzx eax, r10b
add eax, edi
imul edi, eax, 0x8088405
movzx eax, r9b
inc edi
mov ecx, edi
shr rcx, 0x18
xor rcx, rax
mov eax, r11d
xor eax, 1
imul eax, r11d
movsx r11, byte [rsp + r12 + 0x52]
mov r8d, dword [r14 + rcx*4]
xor r8d, edx
mov edx, r10d
mov r9d, r8d
shr eax, 8
and r9d, 0xfffd
xor al, sil
or r9d, 2
mov byte [rsp + r12 + 0x51], al
mov rax, r11
xor rax, rdx
shr edx, 8
movzx ecx, al
mov r10d, dword [r14 + rcx*4]
xor r10d, edx
mov edx, r8d
movzx eax, r10b
add eax, edi
shr edx, 8
imul esi, eax, 0x8088405
movzx eax, r8b
inc esi
mov ecx, esi
shr rcx, 0x18
xor rcx, rax
mov r14d, dword [r14 + rcx*4]
xor r14d, edx
movsx r8, byte [rsp + r12 + 0x54]
mov eax, r9d
xor eax, 1
mov edx, r10d
imul eax, r9d
mov ecx, edx
shr edx, 8
mov r9d, r14d
and r9d, 0xfffd
or r9d, 2
shr eax, 8
xor al, r11b
movsx r11, byte [rsp + r12 + 0x53]
mov byte [rsp + r12 + 0x52], al
xor rcx, r11
movzx eax, cl
lea rcx, [0x1400ddc90]
mov ecx, dword [rcx + rax*4]
xor ecx, edx
movzx eax, cl
mov edi, ecx
add eax, esi
imul ecx, eax, 0x8088405
movzx eax, r14b
shr r14d, 8
inc ecx
mov r10d, ecx
shr rcx, 0x18
xor rcx, rax
lea rax, [0x1400ddc90]
mov esi, dword [rax + rcx*4]
mov eax, r9d
xor eax, 1
xor esi, r14d
imul eax, r9d
lea r14, [0x1400ddc90]
movsx r9, byte [rsp + r12 + 0x55]
mov edx, esi
and edx, 0xfffd
or edx, 2
shr eax, 8
xor al, r11b
mov byte [rsp + r12 + 0x53], al
mov rax, r8
xor rax, rdi
shr edi, 8
movzx ecx, al
mov eax, dword [r14 + rcx*4]
xor eax, edi
mov r11d, eax
movzx eax, al
add eax, r10d
imul r10d, eax, 0x8088405
movzx eax, sil
shr esi, 8
inc r10d
mov ecx, r10d
shr rcx, 0x18
xor rcx, rax
mov eax, edx
xor eax, 1
imul eax, edx
mov edi, dword [r14 + rcx*4]
mov ecx, r11d
xor rcx, r9
shr r11d, 8
xor edi, esi
shr eax, 8
mov edx, edi
xor al, r8b
mov dword [rbx + 0x50], edi
mov byte [rsp + r12 + 0x54], al
and edx, 0xfffd
movzx eax, cl
or edx, 2
mov ecx, dword [r14 + rax*4]
xor ecx, r11d
movzx eax, cl
add eax, r10d
mov dword [rbx + 0x48], ecx
imul ecx, eax, 0x8088405
inc ecx
mov dword [rbx + 0x4c], ecx
movzx eax, byte [rbx + 0x4f]
movzx ecx, dil
xor rcx, rax
shr edi, 8
mov eax, dword [r14 + rcx*4]
xor eax, edi
mov dword [rbx + 0x50], eax
mov eax, edx
xor eax, 1
imul eax, edx
shr eax, 8
xor al, r9b
mov byte [rsp + r12 + 0x55], al
add r12, 6
cmp r12, 0xc
jl 0x14002bc20
mov r8d, reloc.WSOCK32.dll_ioctlsocket
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.14002ada0
mov eax, dword [rbx + 0x28]
test eax, eax
jne 0x14002c01f
add qword [rbx + 0x18], 0xc
or dword [rbx], 0x10
movzx edi, byte [rsp + 0x40]
mov edx, dword [rbx]
mov rax, qword [rbx + 0x88]
test rax, rax
je 0x14002bfc8
mov rcx, rbx
cmp dil, 8
jne 0x14002bef7
mov rdx, r15
call fcn.14002b190
jmp 0x14002bf8a
test dl, dl
jns 0x14002bf36
mov esi, dword [rbx + 0x90]
mov rdx, rax
mov r8d, esi
call fcn.14002ada0
mov rdx, qword [rbx + 0x88]
mov r8d, esi
mov ecx, dword [rbx + 0x80]
mov edi, esi
add qword [rbx + 0x78], rsi
call fcn.14002aac0
add qword [rbx + 0x98], rsi
mov dword [rbx + 0x80], eax
jmp 0x14002bf7c
lea rdi, [rbx + 0xb0]
mov r8d, 0x4000
mov rdx, rdi
call fcn.14002b090
mov esi, eax
test eax, eax
je 0x14002bf7c
cmp dword [rbx + 0x28], 0
jne 0x14002bf7c
mov r8d, esi
mov rdx, rdi
mov rcx, rbx
call fcn.14002ada0
mov r8d, 0x4000
mov rdx, rdi
mov rcx, rbx
call fcn.14002b090
mov esi, eax
test eax, eax
jne 0x14002bf51
movzx edi, byte [rsp + 0x40]
mov eax, esi
add qword [rbx + 0xa0], rax
mov eax, dword [rbx + 0x28]
test eax, eax
jne 0x14002c01f
mov edx, dword [rbx]
and edx, 0xffffffef
mov dword [rbx], edx
test dl, 0x40
je 0x14002bfb0
mov rcx, qword [rbx + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [rbx]
mov rax, qword [rbx + 0x78]
and edx, 0xffffffbf
mov qword [rbx + 0x70], rax
mov rax, qword [rbx + 0xa0]
add qword [rbx + 0x18], rax
mov dword [rbx], edx
test edx, edx
jns 0x14002c02f
or edx, 8
cmp dword [rsp + 0x68], 0
mov dword [rbx], edx
jne 0x14002c1e6
mov edx, dword [rbx + 0x80]
mov rcx, rbx
call fcn.14002ac00
movzx edx, word [rbx + 0x82]
mov rcx, rbx
call fcn.14002ac00
mov edx, dword [rbx + 0x78]
mov rcx, rbx
call fcn.14002ac00
mov rdx, qword [rbx + 0x78]
mov rcx, rbx
shr rdx, 0x10
call fcn.14002ac00
mov eax, dword [rbx + 0x28]
test eax, eax
je 0x14002c1e6
mov edi, eax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x14002b897
mov rdx, qword [rbx + 0xa0]
mov eax, dword [rbx + 0x80]
mov r8, qword [r15 + 0x10]
mov dword [r15 + 8], eax
mov ecx, r13d
add rdx, rcx
add rcx, qword [rbx + 0xa0]
mov qword [r15 + 0x10], rcx
mov rax, qword [rbx + 0x70]
mov qword [r15 + 0x18], rax
test byte [rbx], 4
je 0x14002c0da
test r13d, r13d
jne 0x14002c0da
movzx eax, dil
mov word [r15 + 2], ax
movzx eax, word [r15]
test al, 1
jne 0x14002c084
mov ecx, 0xfff7
and ax, cx
mov word [r15], ax
mov rdx, qword [r15 + 0x38]
mov rcx, rbx
mov word [r15 + 0x30], ax
sub rdx, qword [rbx + 0x20]
call fcn.14002af60
test eax, eax
je 0x14002c0c7
mov rdx, rbx
mov rcx, r15
call fcn.14002a1e0
mov eax, dword [rbx + 0x28]
test eax, eax
jne 0x14002c01f
mov rdx, qword [rbx + 0x18]
mov rcx, rbx
call fcn.14002af60
test eax, eax
jne 0x14002c1a6
mov rcx, r15
mov edi, reloc.WSOCK32.dll_recv
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x14002b897
movzx eax, dil
cmp word [r15 + 2], ax
jne 0x14002c1ed
test dil, dil
jne 0x14002c0f7
cmp r8, rdx
jne 0x14002c1ed
mov edx, 0x8074b50
mov rcx, rbx
call fcn.14002ac00
mov edx, 0x807
mov rcx, rbx
call fcn.14002ac00
mov edx, dword [r15 + 8]
mov rcx, rbx
call fcn.14002ac00
movzx edx, word [r15 + 0xa]
mov rcx, rbx
call fcn.14002ac00
mov rax, qword [r15 + 0x10]
mov edi, 0xffffffff
mov rcx, rbx
cmp rax, rdi
jb 0x14002c146
mov edx, edi
call fcn.14002ac00
mov eax, edi
jmp 0x14002c155
mov edx, eax
call fcn.14002ac00
mov rax, qword [r15 + 0x10]
shr rax, 0x10
mov edx, eax
mov rcx, rbx
call fcn.14002ac00
mov rax, qword [r15 + 0x18]
mov rcx, rbx
cmp rax, rdi
jb 0x14002c174
mov edx, edi
call fcn.14002ac00
jmp 0x14002c183
mov edx, eax
call fcn.14002ac00
mov rdi, qword [r15 + 0x18]
shr rdi, 0x10
mov edx, edi
mov rcx, rbx
call fcn.14002ac00
mov eax, dword [rbx + 0x28]
test eax, eax
jne 0x14002c01f
add qword [rbx + 0x18], 0x10
movzx eax, word [r15 + 0x30]
mov word [r15], ax
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14002c1ba
mov qword [rbx + 0x68], r15
xor eax, eax
jmp 0x14002b8ab
mov rax, qword [rcx + 0x158]
test rax, rax
je 0x14002c1df
nop word [rax + rax]
mov rcx, rax
mov rax, qword [rax + 0x158]
test rax, rax
jne 0x14002c1d0
mov qword [rcx + 0x158], r15
xor eax, eax
jmp 0x14002b8ab
mov rcx, r15
mov edi, reloc.OLEAUT32.dll_SafeArrayGetElemsize
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x14002b897