Function at 0x140052740
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
xorps xmm0, xmm0
xor ebx, ebx
movups xmmword [rbp + 0x27], xmm0
mov dword [rbp + 0x67], ebx
mov eax, 0x81ee
movups xmmword [rbp + 0x37], xmm0
mov r9d, ebx
lea edi, [rbx + 0xf]
movups xmmword [rbp + 0x47], xmm0
mov word [rbp - 9], ax
movabs r10, 0x7c8a7225b143818f
mov eax, 0x81ec
mov r11d, 0x7e71
mov word [rbp - 7], ax
mov eax, 0x81f4
mov word [rbp - 5], ax
mov eax, 0x81f6
mov word [rbp - 3], ax
mov eax, 0x81fc
mov word [rbp - 1], ax
mov eax, 0x81be
mov word [rbp + 1], ax
mov eax, 0x81f0
mov word [rbp + 3], ax
mov eax, 0x81f1
mov word [rbp + 5], ax
mov eax, 0x81fe
mov word [rbp + 7], ax
mov eax, 0x819a
mov word [rbp + 9], ax
movzx eax, word [rbp - 9]
nop
movzx r8d, word [rbp + r9*2 - 9]
mov rcx, r9
and ecx, edi
movzx eax, r9w
cmp rcx, rdi
mov rdx, r10
cmovae rcx, rdi
sub ax, r11w
shl cl, 2
shr rdx, cl
and dx, di
xor dx, ax
xor dx, r8w
mov word [rbp + r9*2 - 9], dx
inc r9
cmp r9, 0xa
jb 0x1400527e0
lea rcx, [rbp - 9]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r10, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140052b70
mov byte [rbp + 0xb], reloc.WLDAP32.dll_Ordinal_46
movabs r11, 0x1ce5c4424ad5346f
mov byte [rbp + 0xc], 2
mov r9, r11
mov byte [rbp + 0xd], 0x24
mov byte [rbp + 0xe], 4
mov byte [rbp + 0xf], reloc.WS2_32.dll_send
mov byte [rbp + 0x10], listen
mov byte [rbp + 0x11], 6
mov byte [rbp + 0x12], Ordinal_60
mov byte [rbp + 0x13], reloc.WLDAP32.dll_Ordinal_27
mov byte [rbp + 0x14], reloc.WLDAP32.dll_Ordinal_26
mov byte [rbp + 0x15], reloc.WS2_32.dll_select
mov byte [rbp + 0x16], 4
mov byte [rbp + 0x17], reloc.WS2_32.dll_send
mov byte [rbp + 0x18], reloc.WS2_32.dll_send
mov byte [rbp + 0x19], 5
mov byte [rbp + 0x1a], reloc.WLDAP32.dll_Ordinal_22
mov byte [rbp + 0x1b], Ordinal_32
mov byte [rbp + 0x1c], 0xe8
mov byte [rbp + 0x1d], 0xd5
mov byte [rbp + 0x1e], 0xf3
mov byte [rbp + 0x1f], 0xe9
mov byte [rbp + 0x20], 0xea
mov byte [rbp + 0x21], 0xea
mov byte [rbp + 0x22], 0xf1
mov byte [rbp + 0x23], 0xf6
mov byte [rbp + 0x24], Ordinal_143
movzx eax, byte [rbp + 0xb]
lea rax, [rbp + 0xb]
sub r9, rax
nop word [rax + rax]
mov rcx, rbx
lea rdx, [rbp + 0xb]
add rdx, rbx
and ecx, edi
cmp rcx, rdi
mov rax, r11
cmovae rcx, rdi
movzx r8d, byte [rdx]
add dl, r9b
shl cl, 2
shr rax, cl
and al, dil
xor al, dl
xor al, r8b
mov byte [rbp + rbx + 0xb], al
inc rbx
cmp rbx, 0x1a
jb 0x1400528c0
lea rdx, [rbp + 0xb]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140052b70
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rcx, [rbp + 0x67]
mov r9d, Ordinal_50
mov qword [rsp + 0x20], rcx
lea r8, [rbp + 0x27]
mov rcx, rax
xor edx, edx
call rbx
test eax, eax
js 0x140052b70
mov rax, qword [rbp + 0x2f]
test rax, rax
je 0x140052b70
cmp byte [rax + 2], 0
je 0x140052b70
mov rax, qword gs:[0x60]
mov byte [0x14018a84c], 1
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400529e7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400529e7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400529e2
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x1400529c0
cmp r8d, 0xcded1a85
je 0x1400529ec
test r9d, r9d
jne 0x1400529a0
mov rax, qword [rax]
jmp 0x140052970
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140052a97
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140052a97
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rdi]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140052a92
nop dword [rax]
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x140052a70
cmp r8d, 0xe80fd3a
je 0x140052a9c
test r9d, r9d
jne 0x140052a50
mov rax, qword [rax]
jmp 0x140052a20
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140052b47
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140052b47
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [r10 + r9*4]
mov ecx, dword [rcx + rdi]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140052b42
nop dword [rax]
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x140052b20
cmp r8d, 0xa52bcaf9
je 0x140052b4c
test r9d, r9d
jne 0x140052b00
mov rax, qword [rax]
jmp 0x140052ad0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
call rax
mov dword [0], 0xdead
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret