Function at 0x140046000
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov rax, qword [0x140099040]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
xor esi, esi
mov edi, esi
sub ecx, 1
je 0x140046047
cmp ecx, 1
jne 0x140046096
lea rdi, [0x1400990c0]
jmp 0x140046096
lea rcx, [rbp + 0x180]
call fcn.140045860
nop
mov rcx, qword [rbp + 0x190]
call fcn.140076480
mov rdi, rax
lea rdx, [rbp + 0x180]
cmp qword [rbp + 0x198], 0xf
cmova rdx, qword [rbp + 0x180]
mov r8, qword [rbp + 0x190]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
nop
lea rcx, [rbp + 0x180]
call fcn.14005b190
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov r11d, dword [rcx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x140046124
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x140046124
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [rbx + r9*4]
mov r8d, dword [rdx + r10]
add r8, r10
mov edx, 0x38b9ce13
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x14004611f
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x140046100
cmp edx, 0x3346cdaf
je 0x140046129
test r9d, r9d
jne 0x1400460e0
mov rax, qword [rax]
jmp 0x1400460b0
mov edx, dword [r11 + 0x1c]
add rdx, r10
mov ecx, dword [r11 + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
lea rcx, [0x140045840]
call rax
call fcn.14006c620
mov qword [0x140963968], rax
cmp rax, 0xffffffffffffffff
jne 0x140046451
mov r10, qword [0x140963ae0]
mov word [rbp + 0x140], 0xd9d6
mov byte [rbp + 0x142], 0x38
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x143], xmm0
mov qword [rbp + 0x153], rax
mov qword [rsp + 0x50], rsi
mov rax, qword [rsp + 0x50]
movabs r9, 0xd9858cff6d15a857
nop
mov r8, qword [rsp + 0x50]
mov rax, qword [rsp + 0x50]
movzx edx, byte [rbp + rax + 0x140]
add r8, r9
mov eax, edx
and rax, r8
imul rcx, rax, 0xfffffffffffffffe
add rcx, rdx
add rcx, r8
sub cl, 0x61
mov rax, qword [rsp + 0x50]
mov byte [rbp + rax + 0x140], cl
mov rax, qword [rsp + 0x50]
inc rax
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
cmp rax, 0x1b
jb 0x1400461a0
mov dword [rbp + 0x70], 0x7baf79b4
mov dword [rbp + 0x74], 0x7f9c7db0
mov dword [rbp + 0x78], 0x77a87590
mov dword [rbp + 0x7c], 0x738771ba
mov dword [rbp + 0x80], 0x4fb84dbc
mov dword [rbp + 0x84], 0x4b854daa
mov dword [rbp + 0x88], 0x47b545be
mov dword [rbp + 0x8c], 0x43814182
mov dword [rbp + 0x90], 0x5f925d8f
mov dword [rbp + 0x94], 0x5fbc5992
mov dword [rbp + 0x98], 0x579055aa
mov dword [rbp + 0x9c], 0x539f51a2
mov dword [rbp + 0xa0], 0x2fdf2da4
mov dword [rbp + 0xa4], 0x2bdc29ea
mov dword [rbp + 0xa8], 0x23c521ce
mov dword [rbp + 0xac], 0x27c425d1
mov dword [rbp + 0xb0], 0x3b2239c5
mov dword [rbp + 0xb4], 0x3fe23dfd
mov dword [rbp + 0xb8], 0x33fa31e7
mov dword [rbp + 0xbc], 0x37f235d2
mov dword [rbp + 0xc0], 0xbb30995
mov dword [rbp + 0xc4], 0xfab0db6
mov dword [rbp + 0xc8], 0x3e001aa
mov dword [rbp + 0xcc], 0x7b505de
mov dword [rbp + 0xd0], 0x1bbc19a5
mov dword [rbp + 0xd4], 0x1fd81dfa
mov dword [rbp + 0xd8], 0x13ab11ac
mov dword [rbp + 0xdc], 0x17b315a4
mov dword [rbp + 0xe0], 0xeb08e9a4
mov dword [rbp + 0xe4], 0xef1fed0f
mov dword [rbp + 0xe8], 0xe3e0e10d
xor eax, eax
mov qword [rbp + 0xec], rax
mov dword [rbp + 0xf4], eax
mov qword [rsp + 0x50], rsi
mov rax, qword [rsp + 0x50]
movabs r9, 0x8a013bfdcb08498f
nop dword [rax + rax]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x50]
movzx edx, byte [rbp + rax + 0x70]
add rcx, r9
mov rax, rcx
and rax, rdx
imul r8, rax, 0xfffffffffffffffe
add r8, rcx
add r8, rdx
add r8b, 0x17
mov rax, qword [rsp + 0x50]
mov byte [rbp + rax + 0x70], r8b
mov rax, qword [rsp + 0x50]
inc rax
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
cmp rax, 0x88
jb 0x140046340
xor r9d, r9d
lea r8, [rbp + 0x140]
lea rdx, [rbp + 0x70]
xor ecx, ecx
call r10
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov r11d, dword [rcx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x140046424
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x140046424
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [rbx + r9*4]
mov r8d, dword [rdx + r10]
add r8, r10
mov edx, 0x14d96cc7
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x14004641f
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x140046400
cmp edx, 0xc8a27ad2
je 0x140046429
test r9d, r9d
jne 0x1400463e0
mov rax, qword [rax]
jmp 0x1400463b0
mov edx, dword [r11 + 0x1c]
add rdx, r10
mov ecx, dword [r11 + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xbadc0de
call rax
mov dword [rsp + 0x58], esi
mov dword [rbp + 0x100], 0x6461595e
mov dword [rbp + 0x104], 0x1b64671f
mov dword [rbp + 0x108], 0x1e621026
mov byte [rbp + 0x10c], pe_nt_image_headers64
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x10d], xmm0
mov word [rbp + 0x11d], ax
mov byte [rbp + 0x11f], al
mov qword [rsp + 0x50], rsi
mov rax, qword [rsp + 0x50]
movabs r9, 0xa339145d0ef43f1e
nop word [rax + rax]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x50]
movzx edx, byte [rbp + rax + 0x100]
add rcx, r9
mov rax, rcx
and rax, rdx
imul r8, rax, 0xfffffffffffffffe
add r8, rcx
add r8, rdx
add r8b, 0x2e
mov rax, qword [rsp + 0x50]
mov byte [rbp + rax + 0x100], r8b
mov rax, qword [rsp + 0x50]
inc rax
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
cmp rax, 0x20
jb 0x1400464b0
xorps xmm0, xmm0
movups xmmword [rbp + 0x120], xmm0
mov qword [rbp + 0x130], rsi
mov qword [rbp + 0x138], rsi
lea rax, [rbp + 0x100]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140046524
lea rdx, [rbp + 0x100]
lea rcx, [rbp + 0x120]
call fcn.14005fa20
nop
lea rcx, [rbp + 0x120]
call fcn.140074c30
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x48], rcx
mov r8, rax
mov rdx, rdi
mov rcx, qword [0x140963968]
call fcn.1400725c0
mov rbx, rax
mov rdx, qword [rbp + 0x138]
cmp rdx, 0xf
jbe 0x1400465b1
inc rdx
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400465ac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400465ac
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400763dc
mov qword [rbp + 0x130], rsi
mov qword [rbp + 0x138], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x120], 0
test rbx, rbx
jne 0x140046871
mov rcx, qword [0x140963968]
call fcn.14006cc20
mov r10, qword [0x140963ae0]
mov word [rbp + 0x1a0], 0xf9f8
mov byte [rbp + 0x1a2], 0xda
xorps xmm0, xmm0
movups xmmword [rbp + 0x1a3], xmm0
mov qword [rsp + 0x50], rsi
mov rax, qword [rsp + 0x50]
movabs r9, 0x39010fa7e4e90f5c
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x50]
movzx edx, byte [rbp + rax + 0x1a0]
add rcx, r9
mov rax, rcx
and rax, rdx
imul r8, rax, 0xfffffffffffffffe
add r8, rcx
add r8, rdx
add r8b, 0x7c
mov rax, qword [rsp + 0x50]
mov byte [rbp + rax + 0x1a0], r8b
mov rax, qword [rsp + 0x50]
inc rax
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
cmp rax, 0x13
jb 0x140046614
mov dword [rsp + 0x60], 0xa3cfa1d4
mov dword [rsp + 0x64], 0xdffcdde8
mov dword [rsp + 0x68], 0xe7a0e5f8
mov dword [rsp + 0x6c], 0xeb87e992
mov dword [rsp + 0x70], 0xef80ed9c
mov dword [rsp + 0x74], 0xf385cdf2
mov dword [rsp + 0x78], 0xf785f59e
mov dword [rsp + 0x7c], 0xfbb9f98a
mov dword [rbp - 0x80], 0xff8afd8f
mov dword [rbp - 0x7c], 0xffdcc18a
mov dword [rbp - 0x78], 0xc7b8c5b2
mov dword [rbp - 0x74], 0xcbbfc9aa
mov dword [rbp - 0x70], 0xcfbfcda4
mov dword [rbp - 0x6c], 0xd3bcd1b2
mov dword [rbp - 0x68], 0xebb5e9ce
mov dword [rbp - 0x64], 0xe7c4e5b8
mov dword [rbp - 0x60], 0xe3dae1c5
mov dword [rbp - 0x5c], 0x1f6a1d9d
mov dword [rbp - 0x58], 0x1b521967
mov dword [rbp - 0x54], 0x176a153a
mov dword [rbp - 0x50], 0x138b1175
mov dword [rbp - 0x4c], 0xf930d86
mov dword [rbp - 0x48], 0xb280992
mov dword [rbp - 0x44], 0x795057e
mov dword [rbp - 0x40], 0x39c0165
mov dword [rbp - 0x3c], 0x3f403d22
mov dword [rbp - 0x38], 0x3ba339ac
mov dword [rbp - 0x34], 0x37ab35b4
mov dword [rbp - 0x30], 0x331031a4
mov dword [rbp - 0x2c], 0x2f7e2d6f
mov qword [rbp - 0x28], 0x2b28290d
mov qword [rsp + 0x50], rsi
mov rax, qword [rsp + 0x50]
movabs r9, 0xce0f87904426cebb
nop dword [rax + rax]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x50]
movzx edx, byte [rsp + rax + 0x60]
add rcx, r9
mov rax, rcx
and rax, rdx
imul r8, rax, 0xfffffffffffffffe
add r8, rcx
add r8, rdx
sub r8b, 0x1d
mov rax, qword [rsp + 0x50]
mov byte [rsp + rax + 0x60], r8b
mov rax, qword [rsp + 0x50]
inc rax
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
cmp rax, 0x80
jb 0x140046760
xor r9d, r9d
lea r8, [rbp + 0x1a0]
lea rdx, [rsp + 0x60]
xor ecx, ecx
call r10
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov r11d, dword [rcx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x140046844
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x140046844
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [rbx + r9*4]
mov r8d, dword [rdx + r10]
add r8, r10
mov edx, 0xee198b8f
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x14004683f
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x140046820
cmp edx, 0x401c166a
je 0x140046849
test r9d, r9d
jne 0x140046800
mov rax, qword [rax]
jmp 0x1400467d0
mov eax, dword [r11 + 0x24]
add rax, r10
movzx edx, word [rax + r9*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xbadc0de
call rax
mov rcx, qword [0x140963968]
call fcn.14006cc20
test al, al
jne 0x140046b24
mov r10, qword [0x140963ae0]
mov word [rbp + 0x160], 0xedec
mov byte [rbp + 0x162], 0xf2
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x163], xmm0
mov qword [rbp + 0x173], rax
mov qword [rsp + 0x50], rsi
mov rax, qword [rsp + 0x50]
movabs r9, 0x4d3f3177c372673e
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x50]
movzx edx, byte [rbp + rax + 0x160]
add rcx, r9
mov rax, rcx
and rax, rdx
imul r8, rax, 0xfffffffffffffffe
add r8, rcx
add r8, rdx
add r8b, 0x4e
mov rax, qword [rsp + 0x50]
mov byte [rbp + rax + 0x160], r8b
mov rax, qword [rsp + 0x50]
inc rax
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
cmp rax, 0x1b
jb 0x1400468c3
mov dword [rbp - 0x20], 0x339f3598
mov dword [rbp - 0x1c], 0xfd031f4
mov dword [rbp - 0x18], 0x17d411ec
mov dword [rbp - 0x14], 0x1bc715c2
mov dword [rbp - 0x10], 0x1ff419c0
mov dword [rbp - 0xc], 0x3c901e2
mov dword [rbp - 8], 0x7d101ee
mov dword [rbp - 4], 0xbc505da
mov dword [rbp], 0xfd209df
mov dword [rbp + 4], 0xeff00dda
mov dword [rbp + 8], 0xf72cf122
mov dword [rbp + 0xc], 0xfb2ff51a
mov dword [rbp + 0x10], 0xff2ff928
mov dword [rbp + 0x14], 0xe310fd22
mov dword [rbp + 0x18], 0xfb01fd1e
mov dword [rbp + 0x1c], 0xf718f937
mov dword [rbp + 0x20], 0xf3e2f509
mov dword [rbp + 0x24], 0xcf22f129
mov dword [rbp + 0x28], 0xcb0acd17
mov dword [rbp + 0x2c], 0xc712c92a
mov dword [rbp + 0x30], 0xc373c579
mov dword [rbp + 0x34], 0xdf7bc176
mov dword [rbp + 0x38], 0xdb3cdd62
mov dword [rbp + 0x3c], 0xd769d90e
mov dword [rbp + 0x40], 0xd368d569
mov dword [rbp + 0x44], 0xaf0cd132
mov dword [rbp + 0x48], 0xab1bad20
mov dword [rbp + 0x4c], 0xa713a920
mov dword [rbp + 0x50], 0xa344a528
mov dword [rbp + 0x54], 0xbf6da15f
mov dword [rbp + 0x58], 0xbbbcbd41
xor eax, eax
mov qword [rbp + 0x5c], rax
mov word [rbp + 0x64], ax
mov byte [rbp + 0x66], al
mov qword [rsp + 0x50], rsi
mov rax, qword [rsp + 0x50]
movabs r9, 0x8f3a1b5484112ed9
nop dword [rax + rax]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x50]
movzx edx, byte [rbp + rax - 0x20]
add rcx, r9
mov rax, rcx
and rax, rdx
imul r8, rax, 0xfffffffffffffffe
add r8, rcx
add r8, rdx
add r8b, 0x11
mov rax, qword [rsp + 0x50]
mov byte [rbp + rax - 0x20], r8b
mov rax, qword [rsp + 0x50]
inc rax
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
cmp rax, 0x87
jb 0x140046a10
xor r9d, r9d
lea r8, [rbp + 0x160]
lea rdx, [rbp - 0x20]
xor ecx, ecx
call r10
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov r11d, dword [rcx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x140046af6
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x140046af6
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r10 + r9*4]
mov ecx, dword [rdx + rbx]
add rcx, r10
mov r8d, 0xcc870259
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140046af1
nop dword [rax]
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x140046ad0
cmp r8d, 0x39b9d860
je 0x140046afb
test r9d, r9d
jne 0x140046ab0
mov rax, qword [rax]
jmp 0x140046a80
mov eax, dword [r11 + 0x24]
add rax, r10
movzx r8d, word [rax + r9*2]
mov edx, dword [r11 + 0x1c]
add rdx, r10
mov eax, dword [rdx + r8*4]
add rax, r10
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xbadc0de
call rax
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.140075d20
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret