Function at 0x140036c00
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x310]
sub rsp, 0x410
movaps xmmword [rsp + 0x400], xmm6
mov rax, qword [0x1400fff00]
xor rax, rsp
mov qword [rbp + 0x2f0], rax
mov rsi, r8
mov qword [rbp - 0x18], r8
mov r13, rdx
mov r12, rcx
mov qword [rbp + 0xf8], rdx
mov qword [rbp + 0x100], r8
xor r14d, r14d
call fcn.14002ac40
lea rcx, [rbp + 0x158]
call fcn.140043e00
nop
mov dword [rsp + 0x78], 0xa0baa3ed
mov dword [rsp + 0x7c], 0xb6b8a2aa
mov word [rbp - 0x80], 0xee
mov byte [rbp - 0x7e], 1
mov dword [rbp + 0xf0], 0xa3aca2ed
mov dword [rbp + 0xf4], 0x100edaa
mov dword [rbp - 0x78], 0xbda8bfed
mov dword [rbp - 0x74], 0xbcbeb9bc
mov dword [rbp - 0x70], 0xe8b0ba
mov byte [rbp - 0x6c], 1
mov dword [rbp - 0x58], 0xa7baa4ed
mov dword [rbp - 0x54], 0x100edab
mov dword [rsp + 0x60], 0xbdacbced
mov dword [rsp + 0x64], 0x100edbc
mov dword [rbp - 0x50], 0xabbeb9ed
mov dword [rbp - 0x4c], 0xbfb0bebd
mov dword [rbp - 0x48], 0x100e9b6
mov dword [rbp + 0x108], 0xabbdb5bf
mov dword [rbp + 0x10c], 0xb5bebcf2
mov dword [rbp + 0x110], 0x100baba
lea r8, [rbp - 0x50]
lea rdx, [rbp + 0x108]
lea rcx, [rbp + 0x118]
call fcn.14001e160
nop
mov rdx, r13
cmp qword [r13 + 0x18], 0xf
jbe 0x140036d26
mov rdx, qword [r13]
mov r8, qword [r13 + 0x10]
mov rcx, rax
call fcn.14000e300
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x178], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x188], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rsp + 0x60]
lea rdx, [rbp + 0x178]
lea rcx, [rbp - 0x38]
call fcn.14001db00
nop
mov rdx, rsi
cmp qword [rsi + 0x18], 0xf
jbe 0x140036d79
mov rdx, qword [rsi]
mov r8, qword [rsi + 0x10]
mov rcx, rax
call fcn.14000e300
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rbp - 0x58]
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0xb0]
call fcn.14001db00
nop
lea rdx, [rbp + 0x158]
cmp qword [rbp + 0x170], 0xf
cmova rdx, qword [rbp + 0x158]
mov r8, qword [rbp + 0x168]
mov rcx, rax
call fcn.14000e300
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x90], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xa0], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rbp - 0x78]
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x70]
call fcn.14001e430
nop
lea rdx, [r12 + 0x240]
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x140036e2d
mov rdx, qword [rdx]
mov rcx, rax
call fcn.14000e300
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x60], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rbp + 0xf0]
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x30]
call fcn.14001db00
nop
mov rdx, r12
cmp qword [r12 + 0x18], 0xf
jbe 0x140036e77
mov rdx, qword [r12]
mov r8, qword [r12 + 0x10]
mov rcx, rax
call fcn.14000e300
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x20], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rsp + 0x78]
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x138]
call fcn.14001df80
nop
lea rdx, [r12 + 0x20]
cmp qword [r12 + 0x38], 0xf
jbe 0x140036eca
mov rdx, qword [r12 + 0x20]
mov r8, qword [r12 + 0x30]
mov rcx, rax
call fcn.14000e300
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1b8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1c8], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rbp + 0x150]
cmp rdx, 0xf
jbe 0x140036f3f
inc rdx
mov rcx, qword [rbp + 0x138]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140036f3a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140036f3a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6ba4
movdqa xmm6, xmmword [0x1400ec3c0]
movdqu xmmword [rbp + 0x148], xmm6
mov byte [rbp + 0x138], 0
mov rdx, qword [rbp + 0x28]
cmp rdx, 0xf
jbe 0x140036f95
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140036f8f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140036f8f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6ba4
nop
mov rdx, qword [rbp + 0x48]
cmp rdx, 0xf
jbe 0x140036fd3
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140036fce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140036fce
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6ba4
movdqu xmmword [rbp + 0x40], xmm6
mov byte [rbp + 0x30], 0
mov rdx, qword [rbp + 0x68]
cmp rdx, 0xf
jbe 0x14003701b
inc rdx
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140037015
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140037015
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6ba4
nop
mov rdx, qword [rbp + 0x88]
cmp rdx, 0xf
jbe 0x14003705c
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140037057
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140037057
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6ba4
movdqu xmmword [rbp + 0x80], xmm6
mov byte [rbp + 0x70], 0
mov rdx, qword [rbp + 0xa8]
cmp rdx, 0xf
jbe 0x1400370ad
inc rdx
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400370a7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400370a7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6ba4
nop
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0xf
jbe 0x1400370f1
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400370ec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400370ec
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6ba4
movdqu xmmword [rbp + 0xc0], xmm6
mov byte [rbp + 0xb0], 0
mov rdx, qword [rbp + 8]
cmp rdx, 0xf
jbe 0x14003713f
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140037139
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140037139
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6ba4
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0xf
jbe 0x14003717d
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140037178
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140037178
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6ba4
movdqu xmmword [rbp - 0x28], xmm6
mov byte [rbp - 0x38], 0
mov rdx, qword [rbp + 0x190]
cmp rdx, 0xf
jbe 0x1400371cb
inc rdx
mov rcx, qword [rbp + 0x178]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400371c5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400371c5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6ba4
nop
mov rdx, qword [rbp + 0x130]
cmp rdx, 0xf
jbe 0x14003720f
inc rdx
mov rcx, qword [rbp + 0x118]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003720a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003720a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6ba4
movdqu xmmword [rbp + 0x128], xmm6
mov byte [rbp + 0x118], 0
lea rax, [rbp + 0x178]
mov qword [rsp + 0x68], rax
lea rdx, [r12 + 0x60]
lea rcx, [rbp + 0x178]
call fcn.14000c8d0
mov rbx, rax
lea rdx, [rbp + 0x1b8]
lea rcx, [rbp - 0x10]
call fcn.14000c8d0
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x198]
call fcn.14003a8e0
nop
lea rax, [rbp - 0x78]
mov qword [rsp + 0x50], rax
lea rdx, [rbp + 0x198]
cmp qword [rbp + 0x1b0], 0xf
cmova rdx, qword [rbp + 0x198]
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x60], r14
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x1400372a0
lea rcx, [rbp - 0x78]
call fcn.14000fed0
nop
lea rax, [rbp + 0x118]
mov qword [rsp + 0x68], rax
lea rdx, [0x1400ff040]
lea rcx, [rbp + 0x118]
call fcn.14000c8d0
mov rbx, rax
lea rdx, [0x1400ff020]
lea rcx, [rbp - 0x38]
call fcn.14000c8d0
nop
lea r8, [rbp - 0x78]
mov rdx, rbx
mov rcx, rax
call fcn.1400288e0
xor eax, 0xa5a5
mov edx, eax
shr eax, 8
movzx r8d, al
movzx eax, dl
movabs r15, 0xcbf29ce484222325
xor rax, r15
movabs r14, 0x100000001b3
imul rax, r14
xor r8, rax
imul r8, r14
mov eax, edx
shr eax, 0x10
movzx ecx, al
xor r8, rcx
imul r8, r14
shr rdx, 0x18
xor r8, rdx
imul r8, r14
cmp r8w, 0xdf7f
jne 0x140037d32
mov qword [rbp + 0xe8], 0
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0xb0]
lea rdx, [rbp + 0x198]
lea rcx, [rbp + 0x108]
call fcn.140023fb0
nop
lea rdx, [r12 + 0x20]
lea rcx, [rbp - 0x78]
call fcn.14001d140
nop
mov dword [rsp + 0x6c], 0x646972
mov dword [rsp + 0x68], 0x656e776f
mov byte [rsp + 0x70], 0
lea r9, [rbp - 0x40]
lea r8, [rsp + 0x6f]
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x118]
call fcn.140014390
lea rdx, [rbp + 0x118]
lea rcx, [rbp + 0x108]
call fcn.140027ce0
mov r9, rax
movzx r8d, byte [rax]
movzx edx, byte [rbp - 0x78]
cmp r8b, 7
jne 0x1400373f8
movsd xmm0, qword [rax + 8]
ucomisd xmm0, xmm0
setp cl
cmp cl, 1
jne 0x1400373f8
lea ecx, [rdx - 5]
cmp cl, 2
jbe 0x140037438
cmp dl, 7
jne 0x140037415
movsd xmm0, qword [rbp - 0x70]
ucomisd xmm0, xmm0
setp al
cmp al, 1
jne 0x140037415
lea eax, [r8 - 5]
cmp al, 2
jbe 0x140037438
cmp r8b, 9
je 0x140037438
cmp dl, 9
je 0x140037438
lea rdx, [rbp - 0x78]
mov rcx, r9
call fcn.140027890
movzx ebx, al
xor bl, 1
movzx edx, byte [rbp - 0x78]
jmp 0x14003743a
xor bl, bl
lea rcx, [rbp - 0x70]
call fcn.14002e0d0
nop
test bl, bl
je 0x1400374f9
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400374d6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400374d6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0xc98b05a5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400374d1
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400374b0
cmp r8d, 0x28adb665
je 0x1400374db
test r9d, r9d
jne 0x140037490
mov rax, qword [rax]
jmp 0x140037460
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov ecx, 8
call rdx
mov dword [rsp + 0x68], 0xbdbea9a6
mov dword [rsp + 0x6c], 0xb4b7ae
mov byte [rsp + 0x70], 1
lea rdx, [rbp - 0x38]
lea rcx, [rsp + 0x68]
call fcn.140028110
mov rdx, rax
lea rcx, [rbp + 0x108]
call fcn.140027ce0
lea rdx, [rbp + 0x138]
mov rcx, rax
call fcn.14001d850
nop
mov dword [rsp + 0x60], 0xaba9a3a8
mov word [rsp + 0x64], 0x100
lea rdx, [rbp + 0x118]
lea rcx, [rsp + 0x60]
call fcn.1400280d0
mov rdx, rax
lea rcx, [rbp + 0x108]
call fcn.140027ce0
mov rcx, rax
call fcn.14001d730
mov edx, eax
shr eax, 8
movzx ebx, al
movzx eax, dl
xor rax, r15
imul rax, r14
xor rbx, rax
imul rbx, r14
mov eax, edx
shr eax, 0x10
movzx ecx, al
xor rbx, rcx
imul rbx, r14
shr rdx, 0x18
xor rbx, rdx
imul rbx, r14
mov dword [rsp + 0x50], 0xadaeb9b8
mov dword [rsp + 0x54], 0xa2a3aa
mov byte [rsp + 0x58], 1
lea rdx, [rbp + 0x118]
lea rcx, [rsp + 0x50]
call fcn.140028110
mov rdx, rax
lea rcx, [rbp + 0x108]
call fcn.140027ce0
mov rcx, rax
call fcn.14001d9a0
test al, al
je 0x1400376e9
mov dword [rsp + 0x50], 0xadaeb9b8
mov dword [rsp + 0x54], 0xa2a3aa
mov byte [rsp + 0x58], 1
lea rdx, [rbp + 0x118]
lea rcx, [rsp + 0x50]
call fcn.140028110
mov rdx, rax
lea rcx, [rbp + 0x108]
call fcn.140027ce0
mov rcx, rax
call fcn.14001d9a0
test al, al
je 0x14003763e
movabs rax, 0xcbe5c873d26645f1
cmp rbx, rax
je 0x1400376e9
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400376c6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400376c6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0xad3d7045
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400376c1
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400376a0
cmp r8d, 0xfde89505
je 0x1400376cb
test r9d, r9d
jne 0x140037680
mov rax, qword [rax]
jmp 0x140037650
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
mov ecx, 9
jmp 0x140037ce4
lea rdx, [rbp + 0x108]
lea rcx, [rbp - 0x78]
call fcn.1400264e0
mov rdx, rax
mov rcx, r12
call fcn.140035f00
mov dword [rsp + 0x50], 0xadaeb9b8
mov dword [rsp + 0x54], 0xa2a3aa
mov byte [rsp + 0x58], 1
lea rdx, [rbp + 0x118]
lea rcx, [rsp + 0x50]
call fcn.140028110
mov rdx, rax
lea rcx, [rbp + 0x108]
call fcn.140027ce0
mov rcx, rax
call fcn.14001d9a0
test al, al
je 0x14003778b
mov dword [rsp + 0x60], 0xa1aba2a2
mov word [rsp + 0x64], 0x100
lea rdx, [rbp + 0x118]
lea rcx, [rsp + 0x60]
call fcn.1400280d0
mov rdx, rax
lea rcx, [rbp + 0x108]
call fcn.140027ce0
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.1400264e0
mov rdx, rax
mov rcx, r12
call fcn.1400361b0
mov dword [rbp - 0x78], 0xbaa4a282
mov dword [rbp - 0x74], 0xbbbdb1a6
mov dword [rbp - 0x70], 0xb1b1a9
mov byte [rbp - 0x6c], 1
lea rcx, [rbp - 0x78]
call fcn.140029b90
mov rdx, rax
lea rcx, [r12 + 0x218]
call fcn.14001d550
test al, al
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
je 0x140037c50
lea r15, [section..data]
mov rsi, r15
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
cmova rsi, qword [section..data]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140037866
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140037866
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x9ac2e441
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140037861
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140037840
cmp r8d, 0xd0d295c7
je 0x14003786b
test r9d, r9d
jne 0x140037820
mov rax, qword [rax]
jmp 0x1400377f0
mov edx, dword [rdi + 0x1c]
add rdx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rdx + rax*4]
add rdx, r10
mov rcx, rsi
call rdx
movdqa xmm0, xmmword [0x1400ccdb0]
movdqu xmmword [rbp - 0x78], xmm0
mov byte [rbp - 0x68], 1
lea rcx, [rbp - 0x78]
call fcn.140029b40
mov rdx, rax
mov r8, r15
lea rcx, [rbp + 0x178]
call fcn.14000f550
nop
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x1e0]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 2
lea rdx, [rbp + 0x178]
lea rcx, [rbp + 0x1e0]
call fcn.14000b250
nop
cmp qword [rbp + 0x268], 0
je 0x14003792c
mov rdx, r15
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
cmova rdx, qword [section..data]
mov r8, qword [0x1400ff010]
lea rcx, [rbp + 0x1e0]
call fcn.1400146b0
lea rcx, [rbp + 0x1e0]
call fcn.14000b210
mov dword [rsp + 0x78], 0xbaaba398
mov dword [rsp + 0x7c], 0xb7a3b1b8
mov word [rbp - 0x80], 0x8f
mov byte [rbp - 0x7e], 1
lea rcx, [rsp + 0x78]
call fcn.140029b00
mov rdx, rax
mov r8, r15
lea rcx, [rbp + 0x118]
call fcn.14000f550
nop
lea rdx, [rbp + 0x118]
cmp qword [rbp + 0x130], 0xf
cmova rdx, qword [rbp + 0x118]
xor ecx, ecx
mov qword [rsp + 0x40], rcx
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], ecx
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x140037b5b
mov r14, qword [0x1400ff010]
inc r14
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
jbe 0x1400379d4
mov r15, qword [section..data]
mov rsi, r15
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov edi, dword [rcx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x140037a66
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140037a66
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r11 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r11
mov r8d, 0x32ff0ccd
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140037a61
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140037a40
cmp r8d, 0xd40d4684
je 0x140037a6b
test r9d, r9d
jne 0x140037a20
mov rax, qword [rax]
jmp 0x1400379f0
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r15
mov r9d, 1
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rbp + 0xf0]
call r10
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140037b36
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140037b36
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0xd18e4c6b
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140037b31
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140037b10
cmp r8d, 0x260682d4
je 0x140037b3b
test r9d, r9d
jne 0x140037af0
mov rax, qword [rax]
jmp 0x140037ac0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov rcx, qword [rbp + 0xf0]
call rdx
lea rsi, [r12 + 0x20]
cmp qword [rsi + 0x18], 0xf
jbe 0x140037b6a
mov rsi, qword [rsi]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140037bf6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140037bf6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x10b62564
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140037bf1
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140037bd0
cmp r8d, 0x65c52266
je 0x140037bfb
test r9d, r9d
jne 0x140037bb0
mov rax, qword [rax]
jmp 0x140037b80
mov edx, dword [rdi + 0x1c]
add rdx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rdx + rax*4]
add rdx, r10
mov rcx, rsi
call rdx
nop
lea rcx, [rbp + 0x118]
call fcn.14000c720
nop
lea rcx, [rbp + 0x1e0]
call fcn.140005670
nop
lea rcx, [rbp + 0x178]
call fcn.14000c720
mov rsi, qword [rbp - 0x18]
jmp 0x140037cea
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140037cc6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140037cc6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x586f9744
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140037cc1
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140037ca0
cmp r8d, 0x8f4faf54
je 0x140037ccb
test r9d, r9d
jne 0x140037c80
mov rax, qword [rax]
jmp 0x140037c50
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
mov ecx, ntohs
add rdx, r10
call rdx
nop
mov r8, qword [rbp + 0x150]
cmp r8, 0xf
jbe 0x140037d0a
mov rdx, qword [rbp + 0x138]
lea rcx, [rbp + 0x138]
call fcn.14000ea70
movdqu xmmword [rbp + 0x148], xmm6
mov byte [rbp + 0x138], 0
movzx edx, byte [rbp + 0x108]
lea rcx, [rbp + 0x110]
call fcn.14002e0d0
nop
jmp 0x140037dea
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140037dc6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140037dc6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x7b63943a
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140037dc1
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140037da0
cmp r8d, 0xef6630b2
je 0x140037dcb
test r9d, r9d
jne 0x140037d80
mov rax, qword [rax]
jmp 0x140037d50
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov ecx, 7
call rdx
nop
mov rdx, qword [rbp + 0x1b0]
cmp rdx, 0xf
jbe 0x140037e2e
inc rdx
mov rcx, qword [rbp + 0x198]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140037e29
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140037e29
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6ba4
movdqu xmmword [rbp + 0x1a8], xmm6
mov byte [rbp + 0x198], 0
mov rdx, qword [rbp + 0x1d0]
cmp rdx, 0xf
jbe 0x140037e82
inc rdx
mov rcx, qword [rbp + 0x1b8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140037e7c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140037e7c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6ba4
nop
mov rdx, qword [rbp + 0x170]
cmp rdx, 0xf
jbe 0x140037ec6
inc rdx
mov rcx, qword [rbp + 0x158]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140037ec1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140037ec1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6ba4
xor ebx, ebx
mov qword [rbp + 0x168], rbx
mov qword [rbp + 0x170], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x158], bl
mov rdx, qword [r13 + 0x18]
cmp rdx, 0xf
jbe 0x140037f1b
mov rcx, qword [r13]
inc rdx
cmp rdx, 0x1000
jb 0x140037f16
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140037fa3
mov rcx, r8
call fcn.1400c6ba4
mov qword [r13 + 0x10], rbx
mov qword [r13 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r13], 0
mov rdx, qword [rsi + 0x18]
cmp rdx, 0xf
jbe 0x140037f62
inc rdx
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x140037f5d
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140037faa
mov rcx, r8
call fcn.1400c6ba4
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], 0
mov rcx, qword [rbp + 0x2f0]
xor rcx, rsp
call fcn.1400c6900
mov rbx, qword [rsp + 0x468]
movaps xmm6, xmmword [rsp + 0x400]
add rsp, 0x410
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3