Function at 0x14002b2c0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xb0]
sub rsp, 0x1b0
mov rdi, rdx
mov r13d, 1
mov edx, r13d
mov r15, r9
mov rsi, r8
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x14002b722
mov ecx, dword [rbx]
test cl, 8
je 0x14002b31a
lea eax, [r13 + 0xc]
jmp 0x14002b73b
mov r14d, dword [rbp + 0x100]
xor r12d, r12d
and ecx, 0xffffff0f
mov qword [rbx + 0xa0], r12
mov eax, r14d
mov qword [rbx + 0x78], r12
and eax, 0xffffffcf
mov qword [rbx + 0x20], r12
mov dword [rbx + 0x80], r12d
mov dword [rbx], ecx
mov dword [rsp + 0x48], r14d
sub eax, r13d
je 0x14002b4d5
sub eax, r13d
je 0x14002b3ba
cmp eax, 6
je 0x14002b39d
test rsi, rsi
je 0x14002b722
test r15, r15
je 0x14002b722
mov r13d, dword [rsp + 0x48]
or ecx, 0xa0
mov dword [rbx], ecx
mov qword [rbx + 0x88], rsi
mov qword [rbx + 0x90], r15
mov qword [rbx + 0x70], r15
mov qword [rbx + 0x98], r12
jmp 0x14002b481
mov r13d, dword [rsp + 0x48]
mov qword [rbx + 0x88], r12
mov qword [rbx + 0x70], r12
mov dword [rsp + 0x4c], 0x41c00010
jmp 0x14002b544
test rsi, rsi
je 0x14002b722
xor r9d, r9d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov edx, 0x80000000
mov rcx, rsi
lea r8d, [r9 + 3]
mov dword [rsp + 0x20], r8d
test r14b, 0x10
je 0x14002b3ef
call qword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x14002b3f5
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rbx + 0x88], rax
cmp rax, 0xffffffffffffffff
je 0x14002b505
mov rcx, qword [rbx + 0x88]
lea r8, [rsp + 0x68]
mov r9d, r13d
mov qword [rsp + 0x68], r12
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14002b45c
mov rax, qword [rsp + 0x68]
lea rdx, [rsp + 0x70]
or dword [rbx], 0x20
mov rcx, rbx
mov qword [rbx + 0x20], rax
call fcn.140027330
test eax, eax
je 0x14002b468
mov rcx, qword [rbx + 0x88]
mov r13d, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r13d
jmp 0x14002b73b
mov qword [rbx + 0x20], r12
mov qword [rbx + 0x70], 0xffffffffffffffff
or dword [rbx], 0x40
mov r13d, r12d
test rdi, rdi
cmovne rsi, rdi
mov rdi, rsi
test byte [rbx], 0x20
jne 0x14002b5f1
mov dword [rsp + 0x4c], 0x81800000
mov rcx, rdi
test r14b, 0x10
je 0x14002b50d
call qword [sym.imp.KERNEL32.dll_lstrlenW]
dec eax
cdqe
lea rcx, [rdi + rax*2]
movzx eax, word [rdi + rax*2]
cmp ax, 0x2e
je 0x14002b544
nop
cmp rcx, rdi
jbe 0x14002b53c
cmp ax, 0x2f
je 0x14002b53c
cmp ax, 0x5c
je 0x14002b53c
movzx eax, word [rcx - 2]
sub rcx, 2
cmp ax, 0x2e
jne 0x14002b4b0
jmp 0x14002b544
lea rax, [rsi - 1]
mov qword [rbx + 0x88], rsi
cmp rax, 0xfffffffffffffffd
ja 0x14002b722
lea r8, [rsp + 0x70]
mov rdx, r15
mov rcx, rbx
call fcn.14002ae80
mov r13d, eax
test eax, eax
je 0x14002b478
mov eax, r13d
jmp 0x14002b73b
call qword [sym.imp.KERNEL32.dll_lstrlenA]
dec eax
movsxd rcx, eax
add rcx, rdi
movzx eax, byte [rcx]
cmp al, 0x2e
je 0x14002b544
cmp rcx, rdi
jbe 0x14002b53c
cmp al, 0x2f
je 0x14002b53c
cmp al, 0x5c
je 0x14002b53c
movzx eax, byte [rcx - 1]
dec rcx
cmp al, 0x2e
jne 0x14002b522
jmp 0x14002b544
mov dword [rsp + 0x4c], 0x81c00000
test r14b, 0x20
jne 0x14002b5e0
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea r8, [rsp + 0x44]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_FileTimeToDosDateTime]
movzx r14d, word [rsp + 0x40]
movabs rcx, 0xfe624e212ac18000
add rcx, qword [rsp + 0x68]
movabs rax, 0xd6bf94d5e57a42bd
imul rcx
shl r14d, 0x10
lea rsi, [rcx + rdx]
sar rsi, 0x17
mov rax, rsi
shr rax, 0x3f
add rsi, rax
mov eax, esi
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x74], eax
mov dword [rsp + 0x64], eax
mov dword [rsp + 0x78], eax
movzx eax, word [rsp + 0x44]
or r14d, eax
mov dword [rsp + 0x44], r14d
mov r14d, dword [rsp + 0x48]
jmp 0x14002b614
mov r14d, dword [rsp + 0x7c]
mov dword [rsp + 0x44], r14d
mov r14d, dword [rsp + 0x48]
jmp 0x14002b600
mov eax, dword [rbp - 0x80]
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x7c]
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x78]
mov esi, dword [rsp + 0x70]
mov dword [rsp + 0x64], eax
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x60], eax
mov qword [rsp + 0x38], r12
mov r9d, 0xffffffff
mov qword [rsp + 0x30], r12
mov r8, rdi
mov dword [rsp + 0x28], r12d
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add eax, 8
xor ecx, ecx
movsxd rdx, eax
add rdx, 0x169
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r15, rax
test rax, rax
jne 0x14002b663
lea edi, [rax + 2]
jmp 0x14002b727
xor edx, edx
mov r8d, 0x160
mov rcx, r15
call fcn.1400d8190
mov eax, r14d
and eax, 0x20
mov dword [rsp + 0x68], eax
je 0x14002b6b0
mov eax, 8
mov dil, 8
mov word [r15 + 2], ax
mov rax, qword [rbx + 0x70]
mov qword [r15 + 0x10], rax
mov qword [r15 + 0x18], rax
mov rax, qword [rbx + 0x18]
mov qword [r15 + 0x38], rax
or dword [rbx], 0x80000000
mov byte [rsp + 0x40], dil
jmp 0x14002bd5f
mov eax, r14d
lea r14, [r15 + 0x50]
and eax, 0x10
mov dword [rbp - 0x78], eax
je 0x14002b6fc
mov qword [rsp + 0x38], r12
mov r9d, 0xffffffff
mov qword [rsp + 0x30], r12
mov r8, rdi
mov dword [rsp + 0x28], 0x104
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [r15 + 0x20], eax
test eax, eax
je 0x14002b719
dec eax
mov dword [r15 + 0x20], eax
jmp 0x14002b715
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [r15 + 0x20], eax
test eax, eax
jne 0x14002b75c
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov edi, 9
test byte [rbx], 0x40
je 0x14002b739
mov rcx, qword [rbx + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
movzx ecx, byte [r14]
mov rax, r14
test cl, cl
je 0x14002b77a
cmp cl, 0x5c
jne 0x14002b76f
mov byte [rax], 0x2f
movzx ecx, byte [rax + 1]
inc rax
test cl, cl
jne 0x14002b767
mov edx, dword [rsp + 0x60]
lea rcx, [r15 + 0x160]
mov qword [r15 + 0x48], rcx
mov eax, 8
mov word [r15], ax
xor dil, dil
mov eax, dword [rsp + 0x44]
mov r8d, 9
mov dword [r15 + 4], eax
mov r13d, r12d
mov eax, dword [rsp + 0x4c]
mov dword [r15 + 0x34], eax
lea rax, [rbp - 0x70]
mov qword [r15 + 0x40], rax
movzx eax, byte [rsp + 0x74]
mov byte [rbp - 0x6b], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0x6a], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0x69], al
movzx eax, byte [rsp + 0x70]
mov byte [rbp - 0x67], al
mov eax, esi
shr eax, 8
mov byte [rbp - 0x66], al
mov eax, esi
shr eax, 0x10
mov byte [rbp - 0x65], al
movzx eax, byte [rsp + 0x78]
mov byte [rbp - 0x63], al
mov dword [rbp - 0x70], 0xd5455
mov byte [rbp - 0x6c], 7
movsd xmm0, qword [rbp - 0x70]
shr edx, 0x18
mov byte [rbp - 0x68], dl
mov edx, dword [rsp + 0x64]
mov eax, edx
shr eax, 8
mov byte [rbp - 0x62], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0x61], al
mov dword [r15 + 0x24], reloc.OLEAUT32.dll_SafeArrayGetElemsize
mov dword [r15 + 0x28], r8d
shr esi, 0x18
mov byte [rbp - 0x64], sil
shr edx, 0x18
mov byte [rbp - 0x60], dl
movsd qword [rcx], xmm0
movzx eax, byte [rbp - 0x68]
mov byte [rcx + 8], al
mov rax, qword [r15 + 0x48]
mov byte [rsp + 0x40], dil
mov byte [rax + 2], 5
mov rax, qword [r15 + 0x48]
mov byte [rax + 4], 1
cmp dword [rbp - 0x78], r12d
je 0x14002b8e3
mov r8d, dword [r15 + 0x20]
mov rdx, r14
xor ecx, ecx
mov word [rbp - 0x5f], 0x7075
mov byte [rbp - 0x5b], 1
lea eax, [r8 + 0x1b]
mov dword [r15 + 0x24], eax
lea eax, [r8 + 0x13]
mov dword [r15 + 0x28], eax
lea eax, [r8 + 0xa]
mov byte [rbp - 0x5d], al
lea eax, [r8 + 0xa]
shr eax, 8
mov byte [rbp - 0x5c], al
call fcn.14002a950
mov byte [rbp - 0x5a], al
mov ecx, eax
shr ecx, 8
mov rdx, r14
mov byte [rbp - 0x59], cl
mov ecx, eax
shr ecx, 0x10
mov byte [rbp - 0x58], cl
mov rcx, qword [r15 + 0x48]
shr eax, 0x18
mov byte [rbp - 0x57], al
mov rax, qword [r15 + 0x40]
movsd xmm0, qword [rax + 0x11]
movsd qword [rcx + 9], xmm0
movzx eax, byte [rax + 0x19]
mov byte [rcx + 0x11], al
mov r8d, dword [r15 + 0x20]
mov rcx, qword [r15 + 0x48]
inc r8d
add rcx, 0x12
call fcn.1400d8380
mov r8d, 9
cmp dword [rbx], r12d
jge 0x14002b8f9
mov dil, 8
mov dword [r15 + 0x24], r12d
mov byte [rsp + 0x40], dil
jmp 0x14002b993
test byte [rsp + 0x48], 8
je 0x14002b91f
mov edx, dword [r15 + 0x20]
lea eax, [rdx - 1]
cmp byte [rax + r15 + 0x50], 0x2f
je 0x14002b993
mov byte [rdx + r15 + 0x50], gethostbyname
inc dword [r15 + 0x20]
jmp 0x14002b993
cmp qword [rbx + 0x10], r12
je 0x14002b92f
mov r13d, reloc.WSOCK32.dll_ioctlsocket
mov word [r15], r8w
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd rdi, eax
add rdi, r14
cmp rdi, r14
jbe 0x14002b953
cmp byte [rdi], 0x2e
je 0x14002b950
dec rdi
cmp rdi, r14
ja 0x14002b943
cmp rdi, r14
jne 0x14002b95a
cmp byte [rdi], 0x2e
jne 0x14002b986
lea rsi, [0x140105030]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x14002b990
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
cdqe
add rsi, rax
cmp byte [rsi], r12b
jne 0x14002b961
mov dil, 8
mov byte [rsp + 0x40], dil
jmp 0x14002b993
xor dil, dil
movzx eax, word [r15]
mov word [r15 + 0x30], ax
movzx eax, dil
mov word [r15 + 2], ax
test dil, dil
jne 0x14002b9be
mov rcx, qword [rbx + 0x70]
cmp rcx, 0xffffffffffffffff
je 0x14002b9be
mov eax, r13d
add rax, rcx
mov qword [r15 + 0x10], rax
mov rax, qword [rbx + 0x70]
mov rdx, rbx
mov qword [r15 + 0x18], rax
mov rcx, r15
mov rax, qword [rbx + 0x18]
add rax, qword [rbx + 0x20]
mov qword [r15 + 0x38], rax
mov dword [rbx + 0x28], r12d
call fcn.14002a070
mov eax, dword [rbx + 0x28]
test eax, eax
jne 0x14002beaf
mov edx, dword [rbx]
mov ecx, dword [r15 + 0x20]
test edx, edx
jns 0x14002ba02
add ecx, 0xb
mov qword [rbx + 0x18], rcx
jmp 0x14002bd61
mov eax, dword [r15 + 0x24]
add eax, 0x32
add eax, ecx
add qword [rbx + 0x18], rax
test r13d, r13d
je 0x14002bd61
mov dword [rbx + 0x48], 0x12345678
lea r14, [0x140106a40]
mov dword [rbx + 0x4c], 0x23456789
mov dword [rbx + 0x50], 0x34567890
mov r8, qword [rbx + 0x10]
test r8, r8
je 0x14002ba8d
nop dword [rax]
movzx eax, byte [r8]
test al, al
je 0x14002ba8d
mov edx, dword [rbx + 0x48]
xor rax, rdx
movzx ecx, al
shr edx, 8
mov eax, dword [r14 + rcx*4]
mov ecx, dword [rbx + 0x50]
xor eax, edx
mov dword [rbx + 0x48], eax
movzx eax, al
add eax, dword [rbx + 0x4c]
imul edx, eax, 0x8088405
movzx eax, cl
shr ecx, 8
inc edx
mov dword [rbx + 0x4c], edx
shr rdx, 0x18
xor rdx, rax
mov eax, dword [r14 + rdx*4]
xor eax, ecx
mov dword [rbx + 0x50], eax
add r8, 1
jne 0x14002ba40
mov rdi, r12
call fcn.1400e4c48
sar eax, 7
mov byte [rsp + rdi + 0x50], al
inc rdi
cmp rdi, 0xc
jl 0x14002ba90
movzx eax, byte [r15 + 5]
mov byte [rsp + 0x5b], al
nop
movsx rsi, byte [rsp + r12 + 0x50]
mov edx, dword [rbx + 0x48]
mov rax, rsi
mov r8d, dword [rbx + 0x50]
xor rax, rdx
movzx ecx, al
mov r11d, r8d
shr edx, 8
and r11d, 0xfffd
or r11d, 2
mov r10d, dword [r14 + rcx*4]
xor r10d, edx
mov edx, r10d
movzx eax, r10b
add eax, dword [rbx + 0x4c]
imul ecx, eax, 0x8088405
movzx eax, r8b
shr r8d, 8
inc ecx
mov edi, ecx
shr rcx, 0x18
xor rcx, rax
mov eax, r11d
xor eax, 1
imul eax, r11d
mov r9d, dword [r14 + rcx*4]
xor r9d, r8d
mov r11d, r9d
shr eax, 8
and r11d, 0xfffd
xor al, sil
or r11d, 2
movsx rsi, byte [rsp + r12 + 0x51]
mov byte [rsp + r12 + 0x50], al
mov rax, rsi
xor rax, rdx
shr edx, 8
movzx ecx, al
mov r10d, dword [r14 + rcx*4]
xor r10d, edx
mov edx, r9d
shr edx, 8
movzx eax, r10b
add eax, edi
imul edi, eax, 0x8088405
movzx eax, r9b
inc edi
mov ecx, edi
shr rcx, 0x18
xor rcx, rax
mov eax, r11d
xor eax, 1
imul eax, r11d
movsx r11, byte [rsp + r12 + 0x52]
mov r8d, dword [r14 + rcx*4]
xor r8d, edx
mov edx, r10d
mov r9d, r8d
shr eax, 8
and r9d, 0xfffd
xor al, sil
or r9d, 2
mov byte [rsp + r12 + 0x51], al
mov rax, r11
xor rax, rdx
shr edx, 8
movzx ecx, al
mov r10d, dword [r14 + rcx*4]
xor r10d, edx
mov edx, r8d
movzx eax, r10b
add eax, edi
shr edx, 8
imul esi, eax, 0x8088405
movzx eax, r8b
inc esi
mov ecx, esi
shr rcx, 0x18
xor rcx, rax
mov r14d, dword [r14 + rcx*4]
xor r14d, edx
movsx r8, byte [rsp + r12 + 0x54]
mov eax, r9d
xor eax, 1
mov edx, r10d
imul eax, r9d
mov ecx, edx
shr edx, 8
mov r9d, r14d
and r9d, 0xfffd
or r9d, 2
shr eax, 8
xor al, r11b
movsx r11, byte [rsp + r12 + 0x53]
mov byte [rsp + r12 + 0x52], al
xor rcx, r11
movzx eax, cl
lea rcx, [0x140106a40]
mov ecx, dword [rcx + rax*4]
xor ecx, edx
movzx eax, cl
mov edi, ecx
add eax, esi
imul ecx, eax, 0x8088405
movzx eax, r14b
shr r14d, 8
inc ecx
mov r10d, ecx
shr rcx, 0x18
xor rcx, rax
lea rax, [0x140106a40]
mov esi, dword [rax + rcx*4]
mov eax, r9d
xor eax, 1
xor esi, r14d
imul eax, r9d
lea r14, [0x140106a40]
movsx r9, byte [rsp + r12 + 0x55]
mov edx, esi
and edx, 0xfffd
or edx, 2
shr eax, 8
xor al, r11b
mov byte [rsp + r12 + 0x53], al
mov rax, r8
xor rax, rdi
shr edi, 8
movzx ecx, al
mov eax, dword [r14 + rcx*4]
xor eax, edi
mov r11d, eax
movzx eax, al
add eax, r10d
imul r10d, eax, 0x8088405
movzx eax, sil
shr esi, 8
inc r10d
mov ecx, r10d
shr rcx, 0x18
xor rcx, rax
mov eax, edx
xor eax, 1
imul eax, edx
mov edi, dword [r14 + rcx*4]
mov ecx, r11d
xor rcx, r9
shr r11d, 8
xor edi, esi
shr eax, 8
mov edx, edi
xor al, r8b
mov dword [rbx + 0x50], edi
mov byte [rsp + r12 + 0x54], al
and edx, 0xfffd
movzx eax, cl
or edx, 2
mov ecx, dword [r14 + rax*4]
xor ecx, r11d
movzx eax, cl
add eax, r10d
mov dword [rbx + 0x48], ecx
imul ecx, eax, 0x8088405
inc ecx
mov dword [rbx + 0x4c], ecx
movzx eax, byte [rbx + 0x4f]
movzx ecx, dil
xor rcx, rax
shr edi, 8
mov eax, dword [r14 + rcx*4]
xor eax, edi
mov dword [rbx + 0x50], eax
mov eax, edx
xor eax, 1
imul eax, edx
shr eax, 8
xor al, r9b
mov byte [rsp + r12 + 0x55], al
add r12, 6
cmp r12, 0xc
jl 0x14002bab0
mov r8d, reloc.WSOCK32.dll_ioctlsocket
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.14002ac30
mov eax, dword [rbx + 0x28]
test eax, eax
jne 0x14002beaf
add qword [rbx + 0x18], 0xc
or dword [rbx], 0x10
movzx edi, byte [rsp + 0x40]
mov edx, dword [rbx]
mov rax, qword [rbx + 0x88]
test rax, rax
je 0x14002be58
mov rcx, rbx
cmp dil, 8
jne 0x14002bd87
mov rdx, r15
call fcn.14002b020
jmp 0x14002be1a
test dl, dl
jns 0x14002bdc6
mov esi, dword [rbx + 0x90]
mov rdx, rax
mov r8d, esi
call fcn.14002ac30
mov rdx, qword [rbx + 0x88]
mov r8d, esi
mov ecx, dword [rbx + 0x80]
mov edi, esi
add qword [rbx + 0x78], rsi
call fcn.14002a950
add qword [rbx + 0x98], rsi
mov dword [rbx + 0x80], eax
jmp 0x14002be0c
lea rdi, [rbx + 0xb0]
mov r8d, 0x4000
mov rdx, rdi
call fcn.14002af20
mov esi, eax
test eax, eax
je 0x14002be0c
cmp dword [rbx + 0x28], 0
jne 0x14002be0c
mov r8d, esi
mov rdx, rdi
mov rcx, rbx
call fcn.14002ac30
mov r8d, 0x4000
mov rdx, rdi
mov rcx, rbx
call fcn.14002af20
mov esi, eax
test eax, eax
jne 0x14002bde1
movzx edi, byte [rsp + 0x40]
mov eax, esi
add qword [rbx + 0xa0], rax
mov eax, dword [rbx + 0x28]
test eax, eax
jne 0x14002beaf
mov edx, dword [rbx]
and edx, 0xffffffef
mov dword [rbx], edx
test dl, 0x40
je 0x14002be40
mov rcx, qword [rbx + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [rbx]
mov rax, qword [rbx + 0x78]
and edx, 0xffffffbf
mov qword [rbx + 0x70], rax
mov rax, qword [rbx + 0xa0]
add qword [rbx + 0x18], rax
mov dword [rbx], edx
test edx, edx
jns 0x14002bebf
or edx, 8
cmp dword [rsp + 0x68], 0
mov dword [rbx], edx
jne 0x14002c076
mov edx, dword [rbx + 0x80]
mov rcx, rbx
call fcn.14002aa90
movzx edx, word [rbx + 0x82]
mov rcx, rbx
call fcn.14002aa90
mov edx, dword [rbx + 0x78]
mov rcx, rbx
call fcn.14002aa90
mov rdx, qword [rbx + 0x78]
mov rcx, rbx
shr rdx, 0x10
call fcn.14002aa90
mov eax, dword [rbx + 0x28]
test eax, eax
je 0x14002c076
mov edi, eax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x14002b727
mov rdx, qword [rbx + 0xa0]
mov eax, dword [rbx + 0x80]
mov r8, qword [r15 + 0x10]
mov dword [r15 + 8], eax
mov ecx, r13d
add rdx, rcx
add rcx, qword [rbx + 0xa0]
mov qword [r15 + 0x10], rcx
mov rax, qword [rbx + 0x70]
mov qword [r15 + 0x18], rax
test byte [rbx], 4
je 0x14002bf6a
test r13d, r13d
jne 0x14002bf6a
movzx eax, dil
mov word [r15 + 2], ax
movzx eax, word [r15]
test al, 1
jne 0x14002bf14
mov ecx, 0xfff7
and ax, cx
mov word [r15], ax
mov rdx, qword [r15 + 0x38]
mov rcx, rbx
mov word [r15 + 0x30], ax
sub rdx, qword [rbx + 0x20]
call fcn.14002adf0
test eax, eax
je 0x14002bf57
mov rdx, rbx
mov rcx, r15
call fcn.14002a070
mov eax, dword [rbx + 0x28]
test eax, eax
jne 0x14002beaf
mov rdx, qword [rbx + 0x18]
mov rcx, rbx
call fcn.14002adf0
test eax, eax
jne 0x14002c036
mov rcx, r15
mov edi, reloc.WSOCK32.dll_recv
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x14002b727
movzx eax, dil
cmp word [r15 + 2], ax
jne 0x14002c07d
test dil, dil
jne 0x14002bf87
cmp r8, rdx
jne 0x14002c07d
mov edx, 0x8074b50
mov rcx, rbx
call fcn.14002aa90
mov edx, 0x807
mov rcx, rbx
call fcn.14002aa90
mov edx, dword [r15 + 8]
mov rcx, rbx
call fcn.14002aa90
movzx edx, word [r15 + 0xa]
mov rcx, rbx
call fcn.14002aa90
mov rax, qword [r15 + 0x10]
mov edi, 0xffffffff
mov rcx, rbx
cmp rax, rdi
jb 0x14002bfd6
mov edx, edi
call fcn.14002aa90
mov eax, edi
jmp 0x14002bfe5
mov edx, eax
call fcn.14002aa90
mov rax, qword [r15 + 0x10]
shr rax, 0x10
mov edx, eax
mov rcx, rbx
call fcn.14002aa90
mov rax, qword [r15 + 0x18]
mov rcx, rbx
cmp rax, rdi
jb 0x14002c004
mov edx, edi
call fcn.14002aa90
jmp 0x14002c013
mov edx, eax
call fcn.14002aa90
mov rdi, qword [r15 + 0x18]
shr rdi, 0x10
mov edx, edi
mov rcx, rbx
call fcn.14002aa90
mov eax, dword [rbx + 0x28]
test eax, eax
jne 0x14002beaf
add qword [rbx + 0x18], 0x10
movzx eax, word [r15 + 0x30]
mov word [r15], ax
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14002c04a
mov qword [rbx + 0x68], r15
xor eax, eax
jmp 0x14002b73b
mov rax, qword [rcx + 0x158]
test rax, rax
je 0x14002c06f
nop word [rax + rax]
mov rcx, rax
mov rax, qword [rax + 0x158]
test rax, rax
jne 0x14002c060
mov qword [rcx + 0x158], r15
xor eax, eax
jmp 0x14002b73b
mov rcx, r15
mov edi, reloc.OLEAUT32.dll_SafeArrayGetElemsize
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x14002b727