Function at 0x1402d8510
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
push rbp
push rbx
push rdi
push r15
lea rbp, [rsp - 0x688]
sub rsp, 0x788
mov rax, qword [0x14057c500]
xor rax, rsp
mov qword [rbp + 0x660], rax
mov qword [rsp + 0x38], r8
xor edi, edi
mov dword [rsp + 0x30], edx
lea r8, [rbp + 0x5e0]
lea rdx, [rsp + 0x50]
mov word [rbp + 0x5f8], di
mov dword [rbp + 0x5e0], 0x65004b
mov dword [rbp + 0x5e4], 0x6e0072
mov dword [rbp + 0x5e8], 0x6c0065
mov dword [rbp + 0x5ec], 0x320033
mov dword [rbp + 0x5f0], 0x64002e
mov dword [rbp + 0x5f4], 0x6c006c
call fcn.1402d7cb0
cmp qword [rax + 0x18], 8
jb 0x1402d859f
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r8, qword [rsp + 0x68]
mov rbx, rax
cmp r8, 8
jb 0x1402d85c8
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x50]
inc r8
call fcn.1402d6e70
movdqa xmm0, xmmword [0x1402bf150]
lea r8, [rbp + 0x570]
movdqa xmm1, xmmword [0x1402bf170]
lea rdx, [rsp + 0x70]
movdqu xmmword [rbp + 0x600], xmm0
mov qword [rsp + 0x68], 7
movdqa xmm0, xmmword [0x1402bf130]
movdqu xmmword [rbp + 0x5e0], xmm0
mov qword [rsp + 0x60], rdi
movdqa xmm0, xmmword [0x1402bf160]
movdqu xmmword [rbp + 0x620], xmm0
mov word [rsp + 0x50], di
mov dword [rbp + 0x570], 0x6e65704f
mov dword [rbp + 0x574], 0x636f7250
mov dword [rbp + 0x578], 0x737365
mov dword [rbp + 0x5a0], 0x74726956
mov dword [rbp + 0x5a4], 0x416c6175
mov dword [rbp + 0x5a8], 0x636f6c6c
mov word [rbp + 0x5ac], 0x7845
mov byte [rbp + 0x5ae], dil
mov word [rbp + 0x610], 0x7972
mov byte [rbp + 0x612], dil
mov dword [rbp + 0x5f0], 0x70616e53
mov dword [rbp + 0x5f4], 0x746f6873
mov byte [rbp + 0x5f8], dil
mov dword [rbp + 0x590], 0x65726854
mov dword [rbp + 0x594], 0x32336461
mov dword [rbp + 0x598], 0x73726946
mov word [rbp + 0x59c], reloc.WS2_32.dll_WSACleanup
mov dword [rbp + 0x580], 0x65726854
mov dword [rbp + 0x584], 0x32336461
mov dword [rbp + 0x588], 0x7478654e
mov byte [rbp + 0x58c], dil
mov dword [rbp + 0x560], 0x6e65704f
mov dword [rbp + 0x564], 0x65726854
mov word [rbp + 0x568], 0x6461
mov byte [rbp + 0x56a], dil
mov byte [rbp + 0x630], dil
movdqu xmmword [rbp + 0x640], xmm1
mov byte [rbp + 0x650], dil
mov dword [rbp + 0x5d0], 0x70737553
mov dword [rbp + 0x5d4], 0x54646e65
mov dword [rbp + 0x5d8], 0x61657268
mov word [rbp + 0x5dc], WSAAsyncSelect
mov dword [rbp + 0x5c0], 0x75736552
mov dword [rbp + 0x5c4], 0x6854656d
mov dword [rbp + 0x5c8], 0x64616572
mov byte [rbp + 0x5cc], dil
mov dword [rbp + 0x5b0], 0x736f6c43
mov dword [rbp + 0x5b4], 0x6e614865
mov dword [rbp + 0x5b8], 0x656c64
call fcn.1402d7d40
cmp qword [rax + 0x18], 0x10
jb 0x1402d8795
mov rax, qword [rax]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbp - 0x78]
mov r15, rax
cmp rcx, 0x10
jb 0x1402d87f7
mov rdx, qword [rsp + 0x70]
inc rcx
cmp rcx, 0x1000
jb 0x1402d87ef
test dl, 0x1f
jne 0x1402d8fd5
mov rax, qword [rdx - 8]
cmp rax, rdx
jae 0x1402d8fdb
sub rdx, rax
cmp rdx, 8
jb 0x1402d8fe1
cmp rdx, 0x27
ja 0x1402d8fe7
mov rdx, rax
mov rcx, rdx
call fcn.1404e1e20
lea r8, [rbp + 0x5a0]
mov qword [rsp + 0x780], r12
lea rdx, [rbp - 0x70]
mov qword [rbp - 0x78], select
mov qword [rbp - 0x80], rdi
mov byte [rsp + 0x70], dil
call fcn.1402d7d40
cmp qword [rax + 0x18], 0x10
jb 0x1402d882a
mov rax, qword [rax]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbp - 0x58]
mov r12, rax
cmp rcx, 0x10
jb 0x1402d888b
mov rdx, qword [rbp - 0x70]
inc rcx
cmp rcx, 0x1000
jb 0x1402d8883
test dl, 0x1f
jne 0x1402d8fed
mov rax, qword [rdx - 8]
cmp rax, rdx
jae 0x1402d8ff3
sub rdx, rax
cmp rdx, 8
jb 0x1402d8ff9
cmp rdx, 0x27
ja 0x1402d8fff
mov rdx, rax
mov rcx, rdx
call fcn.1404e1e20
lea r8, [rbp + 0x600]
mov qword [rbp - 0x58], select
lea rdx, [rbp - 0x50]
mov qword [rbp - 0x60], rdi
mov byte [rbp - 0x70], dil
call fcn.1402d7d40
cmp qword [rax + 0x18], 0x10
jb 0x1402d88b5
mov rax, qword [rax]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbp - 0x38]
mov qword [rsp + 0x40], rax
cmp rcx, 0x10
jb 0x1402d8918
mov rdx, qword [rbp - 0x50]
inc rcx
cmp rcx, 0x1000
jb 0x1402d8910
test dl, 0x1f
jne 0x1402d9005
mov rax, qword [rdx - 8]
cmp rax, rdx
jae 0x1402d900b
sub rdx, rax
cmp rdx, 8
jb 0x1402d9011
cmp rdx, 0x27
ja 0x1402d9017
mov rdx, rax
mov rcx, rdx
call fcn.1404e1e20
lea r8, [rbp + 0x5e0]
mov qword [rsp + 0x770], r14
lea rdx, [rbp + 0x600]
mov qword [rbp - 0x38], select
mov qword [rbp - 0x40], rdi
mov byte [rbp - 0x50], dil
call fcn.1402d7d40
cmp qword [rax + 0x18], 0x10
jb 0x1402d894d
mov rax, qword [rax]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbp + 0x618]
mov r14, rax
cmp rcx, 0x10
jb 0x1402d89b4
mov rdx, qword [rbp + 0x600]
inc rcx
cmp rcx, 0x1000
jb 0x1402d89ac
test dl, 0x1f
jne 0x1402d901d
mov rax, qword [rdx - 8]
cmp rax, rdx
jae 0x1402d9023
sub rdx, rax
cmp rdx, 8
jb 0x1402d9029
cmp rdx, 0x27
ja 0x1402d902f
mov rdx, rax
mov rcx, rdx
call fcn.1404e1e20
lea r8, [rbp + 0x590]
mov qword [rbp + 0x618], select
lea rdx, [rbp + 0x5e0]
mov qword [rbp + 0x610], rdi
mov byte [rbp + 0x600], dil
call fcn.1402d7d40
cmp qword [rax + 0x18], 0x10
jb 0x1402d89ea
mov rax, qword [rax]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbp + 0x5f8]
mov qword [rsp + 0x48], rax
cmp rcx, 0x10
jb 0x1402d8a53
mov rdx, qword [rbp + 0x5e0]
inc rcx
cmp rcx, 0x1000
jb 0x1402d8a4b
test dl, 0x1f
jne 0x1402d9035
mov rax, qword [rdx - 8]
cmp rax, rdx
jae 0x1402d903b
sub rdx, rax
cmp rdx, 8
jb 0x1402d9041
cmp rdx, 0x27
ja 0x1402d9047
mov rdx, rax
mov rcx, rdx
call fcn.1404e1e20
lea r8, [rbp + 0x580]
mov qword [rbp + 0x5f8], select
lea rdx, [rbp - 0x30]
mov qword [rbp + 0x5f0], rdi
mov byte [rbp + 0x5e0], dil
call fcn.1402d7d40
cmp qword [rax + 0x18], 0x10
jb 0x1402d8a86
mov rax, qword [rax]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbp - 0x18]
mov qword [rbp + 0x570], rax
cmp rcx, 0x10
jb 0x1402d8aeb
mov rdx, qword [rbp - 0x30]
inc rcx
cmp rcx, 0x1000
jb 0x1402d8ae3
test dl, 0x1f
jne 0x1402d904d
mov rax, qword [rdx - 8]
cmp rax, rdx
jae 0x1402d9053
sub rdx, rax
cmp rdx, 8
jb 0x1402d9059
cmp rdx, 0x27
ja 0x1402d905f
mov rdx, rax
mov rcx, rdx
call fcn.1404e1e20
lea r8, [rbp + 0x560]
mov qword [rbp - 0x18], select
lea rdx, [rbp - 0x10]
mov qword [rbp - 0x20], rdi
mov byte [rbp - 0x30], dil
call fcn.1402d7d40
cmp qword [rax + 0x18], 0x10
jb 0x1402d8b15
mov rax, qword [rax]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbp + 8]
mov qword [rbp + 0x5a0], rax
cmp rcx, 0x10
jb 0x1402d8b7a
mov rdx, qword [rbp - 0x10]
inc rcx
cmp rcx, 0x1000
jb 0x1402d8b72
test dl, 0x1f
jne 0x1402d9065
mov rax, qword [rdx - 8]
cmp rax, rdx
jae 0x1402d906b
sub rdx, rax
cmp rdx, 8
jb 0x1402d9071
cmp rdx, 0x27
ja 0x1402d9077
mov rdx, rax
mov rcx, rdx
call fcn.1404e1e20
lea r8, [rbp + 0x620]
mov qword [rbp + 8], select
lea rdx, [rbp + 0x10]
mov qword [rbp], rdi
mov byte [rbp - 0x10], dil
call fcn.1402d7d40
cmp qword [rax + 0x18], 0x10
jb 0x1402d8ba4
mov rax, qword [rax]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbp + 0x28]
mov qword [rbp + 0x580], rax
cmp rcx, 0x10
jb 0x1402d8c09
mov rdx, qword [rbp + 0x10]
inc rcx
cmp rcx, 0x1000
jb 0x1402d8c01
test dl, 0x1f
jne 0x1402d907d
mov rax, qword [rdx - 8]
cmp rax, rdx
jae 0x1402d9083
sub rdx, rax
cmp rdx, 8
jb 0x1402d9089
cmp rdx, 0x27
ja 0x1402d908f
mov rdx, rax
mov rcx, rdx
call fcn.1404e1e20
lea r8, [rbp + 0x640]
mov qword [rbp + 0x28], select
lea rdx, [rbp + 0x620]
mov qword [rbp + 0x20], rdi
mov byte [rbp + 0x10], dil
call fcn.1402d7d40
cmp qword [rax + 0x18], 0x10
jb 0x1402d8c36
mov rax, qword [rax]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbp + 0x638]
mov qword [rbp + 0x560], rax
cmp rcx, 0x10
jb 0x1402d8ca1
mov rdx, qword [rbp + 0x620]
inc rcx
cmp rcx, 0x1000
jb 0x1402d8c99
test dl, 0x1f
jne 0x1402d9095
mov rax, qword [rdx - 8]
cmp rax, rdx
jae 0x1402d909b
sub rdx, rax
cmp rdx, 8
jb 0x1402d90a1
cmp rdx, 0x27
ja 0x1402d90a7
mov rdx, rax
mov rcx, rdx
call fcn.1404e1e20
lea r8, [rbp + 0x5d0]
mov qword [rbp + 0x638], select
lea rdx, [rbp + 0x640]
mov qword [rbp + 0x630], rdi
mov byte [rbp + 0x620], dil
call fcn.1402d7d40
cmp qword [rax + 0x18], 0x10
jb 0x1402d8cd7
mov rax, qword [rax]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbp + 0x658]
mov qword [rbp + 0x590], rax
cmp rcx, 0x10
jb 0x1402d8d42
mov rdx, qword [rbp + 0x640]
inc rcx
cmp rcx, 0x1000
jb 0x1402d8d3a
test dl, 0x1f
jne 0x1402d90ad
mov rax, qword [rdx - 8]
cmp rax, rdx
jae 0x1402d90b3
sub rdx, rax
cmp rdx, 8
jb 0x1402d90b9
cmp rdx, 0x27
ja 0x1402d90bf
mov rdx, rax
mov rcx, rdx
call fcn.1404e1e20
lea r8, [rbp + 0x5c0]
mov qword [rsp + 0x778], r13
lea rdx, [rbp + 0x30]
mov qword [rbp + 0x658], select
mov qword [rbp + 0x650], rdi
mov byte [rbp + 0x640], dil
call fcn.1402d7d40
cmp qword [rax + 0x18], 0x10
jb 0x1402d8d7d
mov rax, qword [rax]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbp + 0x48]
mov r13, rax
cmp rcx, 0x10
jb 0x1402d8dde
mov rdx, qword [rbp + 0x30]
inc rcx
cmp rcx, 0x1000
jb 0x1402d8dd6
test dl, 0x1f
jne 0x1402d90c5
mov rax, qword [rdx - 8]
cmp rax, rdx
jae 0x1402d90cb
sub rdx, rax
cmp rdx, 8
jb 0x1402d90d1
cmp rdx, 0x27
ja 0x1402d90d7
mov rdx, rax
mov rcx, rdx
call fcn.1404e1e20
lea r8, [rbp + 0x5b0]
mov qword [rsp + 0x7b0], rsi
lea rdx, [rbp + 0x50]
mov qword [rbp + 0x48], select
mov qword [rbp + 0x40], rdi
mov byte [rbp + 0x30], dil
call fcn.1402d7d40
cmp qword [rax + 0x18], 0x10
jb 0x1402d8e10
mov rax, qword [rax]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbp + 0x68]
mov rsi, rax
cmp rcx, 0x10
jb 0x1402d8e70
mov rax, qword [rbp + 0x50]
inc rcx
cmp rcx, 0x1000
jb 0x1402d8e68
test al, 0x1f
jne 0x1402d90dd
mov rcx, qword [rax - 8]
cmp rcx, rax
jae 0x1402d90e3
sub rax, rcx
cmp rax, 8
jb 0x1402d90e9
cmp rax, 0x27
ja 0x1402d90ef
mov rax, rcx
mov rcx, rax
call fcn.1404e1e20
mov ebx, dword [rsp + 0x30]
xor edx, edx
mov r8d, ebx
mov qword [rbp + 0x68], select
mov ecx, 0x1fffff
mov qword [rbp + 0x60], rdi
mov byte [rbp + 0x50], dil
call r15
mov r15, rax
test rax, rax
je 0x1402d8f99
mov rax, qword [rsp + 0x38]
xor edx, edx
mov r9d, 0x3000
mov dword [rsp + 0x20], 0x40
mov rcx, r15
mov r8, qword [rax + 8]
sub r8, qword [rax]
call r12
mov r12, rax
mov rcx, r15
test rax, rax
je 0x1402d8f97
mov rax, qword [rsp + 0x38]
mov rdx, r12
mov qword [rsp + 0x20], rdi
mov r8, qword [rax]
mov r9, qword [rax + 8]
sub r9, r8
call qword [rsp + 0x40]
xor edx, edx
lea ecx, [rdx + 4]
call r14
lea rdx, [rbp + 0x70]
mov dword [rbp + 0x70], 0x1c
mov rcx, rax
mov r14, rax
call qword [rsp + 0x48]
test eax, eax
je 0x1402d8f8f
nop
cmp ebx, dword [rbp + 0x7c]
jne 0x1402d8f7e
mov r8d, dword [rbp + 0x78]
xor edx, edx
mov ecx, 0x1fffff
call qword [rbp + 0x5a0]
mov rbx, rax
test rax, rax
je 0x1402d8f8f
mov rcx, rax
inc edi
call qword [rbp + 0x590]
lea rdx, [rbp + 0x90]
mov dword [rbp + 0xc0], 0x10000b
mov rcx, rbx
call qword [rbp + 0x580]
lea rdx, [rbp + 0x90]
mov qword [rbp + 0x188], r12
mov rcx, rbx
call qword [rbp + 0x560]
mov rcx, rbx
call r13
mov rcx, rbx
call rsi
cmp edi, 4
jg 0x1402d8f8f
mov ebx, dword [rsp + 0x30]
lea rdx, [rbp + 0x70]
mov rcx, r14
call qword [rbp + 0x570]
test eax, eax
jne 0x1402d8f10
mov rcx, r14
call rsi
mov rcx, r15
call rsi
mov rsi, qword [rsp + 0x7b0]
mov r13, qword [rsp + 0x778]
mov r14, qword [rsp + 0x770]
mov r12, qword [rsp + 0x780]
mov rcx, qword [rbp + 0x660]
xor rcx, rsp
call fcn.1404e17d0
add rsp, 0x788
pop r15
pop rdi
pop rbx
pop rbp
ret
call fcn.1405048d4
int3
call fcn.1405048d4
int3
call fcn.1405048d4
int3
call fcn.1405048d4
int3
call fcn.1405048d4
int3
call fcn.1405048d4
int3
call fcn.1405048d4
int3
call fcn.1405048d4
int3
call fcn.1405048d4
int3
call fcn.1405048d4
int3
call fcn.1405048d4
int3
call fcn.1405048d4
int3
call fcn.1405048d4
int3
call fcn.1405048d4
int3
call fcn.1405048d4
int3
call fcn.1405048d4
int3
call fcn.1405048d4
int3
call fcn.1405048d4
int3
call fcn.1405048d4
int3
call fcn.1405048d4
int3
call fcn.1405048d4
int3
call fcn.1405048d4
int3
call fcn.1405048d4
int3
call fcn.1405048d4
int3
call fcn.1405048d4
int3
call fcn.1405048d4
int3
call fcn.1405048d4
int3
call fcn.1405048d4
int3
call fcn.1405048d4
int3
call fcn.1405048d4
int3
call fcn.1405048d4
int3
call fcn.1405048d4
int3
call fcn.1405048d4
int3
call fcn.1405048d4
int3
call fcn.1405048d4
int3
call fcn.1405048d4
int3
call fcn.1405048d4
int3
call fcn.1405048d4
int3
call fcn.1405048d4
int3
call fcn.1405048d4
int3
call fcn.1405048d4
int3
call fcn.1405048d4
int3
call fcn.1405048d4
int3
call fcn.1405048d4
int3
call fcn.1405048d4
int3
call fcn.1405048d4
int3
call fcn.1405048d4
int3
call fcn.1405048d4
int3