Function at 0x140223b80
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x60
movdqa xmm0, xmmword [0x1403271b0]
lea rsi, [rbp - 0x35]
xor edi, edi
mov dword [rbp - 0x2f], 0xa40486
movdqu xmmword [rbp - 0x40], xmm0
neg rsi
mov word [rbp - 0x2b], 0x305
mov byte [rbp - 0x29], 0x7c
lea r8, [rbp - 0x34]
mov byte [rbp - 0x30], 0
nop
movzx eax, dil
lea ebx, [rdi + rdi*2]
movzx ecx, byte [rbp + rbx - 0x40]
add al, al
mov byte [r8], cl
lea r11d, [rax + rdi]
movzx r10d, r11b
lea eax, [rbx + 1]
add r10b, byte [rbp - 0x2d]
xor r10b, cl
mov byte [r8], r10b
xor dl, dl
movzx r9d, byte [rbp + rax - 0x40]
nop
movzx eax, r9b
movzx ecx, dl
sar al, cl
test al, 1
jne 0x140223c06
inc dl
cmp dl, 4
jne 0x140223bf0
jmp 0x140223c14
movzx eax, byte [rbp - 0x2a]
movsx ecx, r10b
btc ecx, eax
mov byte [r8], cl
lea eax, [rbx + 2]
mov cl, 5
movzx edx, byte [rbp + rax - 0x40]
mov r9d, eax
movzx eax, dl
sar al, cl
test al, 1
jne 0x140223c33
inc cl
cmp cl, 8
jne 0x140223c21
jmp 0x140223c41
movsx ecx, byte [r8]
movzx eax, byte [rbp - 0x2b]
btc ecx, eax
mov byte [r8], cl
movzx edx, byte [rbp + r9 - 0x40]
xor cl, cl
nop dword [rax]
movzx eax, dl
sar al, cl
test al, 1
jne 0x140223c62
inc cl
cmp cl, 5
jne 0x140223c50
jmp 0x140223c70
movsx ecx, byte [r8]
movzx eax, byte [rbp - 0x2c]
btc ecx, eax
mov byte [r8], cl
movzx eax, r11b
lea r10d, [r11 + 3]
add al, byte [rbp - 0x2e]
xor byte [r8], al
lea eax, [rbx + 3]
movzx eax, byte [rbp + rax - 0x40]
mov byte [r8 + 1], al
add r10b, byte [rbp - 0x2d]
xor r10b, al
lea eax, [rbx + 4]
mov byte [r8 + 1], r10b
xor dl, dl
movzx r9d, byte [rbp + rax - 0x40]
movzx eax, r9b
movzx ecx, dl
sar al, cl
test al, 1
jne 0x140223cba
inc dl
cmp dl, 4
jne 0x140223ca0
lea rdx, [rsi + r8]
jmp 0x140223ccd
movzx eax, byte [rbp - 0x2a]
lea rdx, [rsi + r8]
movsx ecx, r10b
btc ecx, eax
mov byte [rbp + rdx - 0x34], cl
lea eax, [rbx + 5]
mov cl, 5
movzx r9d, byte [rbp + rax - 0x40]
mov r10d, eax
nop dword [rax + rax]
movzx eax, r9b
sar al, cl
test al, 1
jne 0x140223cf3
inc cl
cmp cl, 8
jne 0x140223ce0
jmp 0x140223d03
movsx ecx, byte [rbp + rdx - 0x34]
movzx eax, byte [rbp - 0x2b]
btc ecx, eax
mov byte [rbp + rdx - 0x34], cl
movzx r9d, byte [rbp + r10 - 0x40]
xor cl, cl
nop dword [rax + rax]
movzx eax, r9b
sar al, cl
test al, 1
jne 0x140223d23
inc cl
cmp cl, 5
jne 0x140223d10
jmp 0x140223d33
movsx ecx, byte [rbp + rdx - 0x34]
movzx eax, byte [rbp - 0x2c]
btc ecx, eax
mov byte [rbp + rdx - 0x34], cl
add r11b, 3
add edi, 2
add r11b, byte [rbp - 0x2e]
add r8, 2
xor byte [rbp + rdx - 0x34], r11b
cmp edi, 4
jne 0x140223bc0
xorps xmm0, xmm0
lea rax, [rbp - 0x34]
xorps xmm1, xmm1
mov r8, 0xffffffffffffffff
movups xmmword [rbp - 0x28], xmm0
movdqu xmmword [rbp - 0x18], xmm1
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140223d70
lea rdx, [rbp - 0x34]
lea rcx, [rbp - 0x28]
call fcn.14008b1f0
cmp qword [rbp - 0x10], 0xf
lea rbx, [rbp - 0x28]
mov dil, 0x84
cmova rbx, qword [rbp - 0x28]
xor cl, cl
nop word [rax + rax]
mov eax, 1
sar al, cl
test al, 1
jne 0x140223db4
inc cl
cmp cl, 4
jne 0x140223da0
jmp 0x140223db7
mov dil, 0x8c
mov cl, 5
nop dword [rax]
mov eax, reloc.WS2_32.dll_recv
sar al, cl
test al, 1
jne 0x140223dd4
inc cl
cmp cl, 8
jne 0x140223dc0
jmp 0x140223ddc
movsx edi, dil
btc edi, 5
xor cl, cl
nop
mov eax, reloc.WS2_32.dll_recv
sar al, cl
test al, 1
jne 0x140223df4
inc cl
cmp cl, 5
jne 0x140223de0
jmp 0x140223dfc
movsx edi, dil
btc edi, 0
movzx ebx, byte [rbx + 1]
lea rcx, [rbp - 0x28]
xor dil, 0xa4
call fcn.14008b180
cmp dil, bl
jne 0x140224740
mov rax, qword gs:[0x60]
mov qword [rsp + 0x88], r14
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x140223eba
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x140223eba
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
mov r10d, 0x1d2990e
lea rcx, [r14 + r11*4]
mov r8d, dword [rcx + rbx]
add r8, rbx
movzx r9d, byte [r8]
inc r8
test r9b, r9b
je 0x140223eb5
movsx ecx, r9b
lea r8, [r8 + 1]
sub r9b, 0x41
mov edx, ecx
or edx, 0x20
cmp r9b, 0x19
movzx r9d, byte [r8 - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r9b, r9b
jne 0x140223e80
cmp r10d, 0x1d1b6408
je 0x140223ec2
test r11d, r11d
jne 0x140223e60
mov rax, qword [rax]
jmp 0x140223e30
mov ecx, dword [rsi + 0x24]
add rcx, rbx
movzx edx, word [rcx + r11*2]
mov ecx, dword [rsi + 0x1c]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
add rax, rbx
call rax
mov r10d, eax
mov dl, 0xd6
xor cl, cl
mov dword [rbp - 0x40], 0xff1001aa
mov word [rbp - 0x3c], 0x1001
mov dword [rbp - 0x37], 0x7ca47c
mov word [rbp - 0x33], 0x305
mov byte [rbp - 0x31], 0xa4
mov byte [rbp - 0x38], 0
mov eax, 1
sar al, cl
test al, 1
jne 0x140223f18
inc cl
cmp cl, 4
jne 0x140223f04
jmp 0x140223f1a
mov dl, 0xde
mov cl, 5
nop dword [rax]
mov eax, reloc.WS2_32.dll_recv
sar al, cl
test al, 1
jne 0x140223f34
inc cl
cmp cl, 8
jne 0x140223f20
jmp 0x140223f3b
movsx edx, dl
btc edx, 5
xor cl, cl
nop dword [rax]
mov eax, reloc.WS2_32.dll_recv
sar al, cl
test al, 1
jne 0x140223f54
inc cl
cmp cl, 5
jne 0x140223f40
jmp 0x140223f5b
movsx edx, dl
btc edx, 0
xor dl, 0xa4
mov byte [rbp - 0x3a], dl
xor cl, cl
mov dl, 0x80
mov eax, 1
sar al, cl
test al, 1
jne 0x140223f79
inc cl
cmp cl, 4
jne 0x140223f65
jmp 0x140223f7b
mov dl, 0x88
mov cl, 5
nop dword [rax]
mov eax, reloc.WS2_32.dll_recv
sar al, cl
test al, 1
jne 0x140223f94
inc cl
cmp cl, 8
jne 0x140223f80
jmp 0x140223f9b
movsx edx, dl
btc edx, 5
xor cl, cl
nop dword [rax]
mov eax, reloc.WS2_32.dll_recv
sar al, cl
test al, 1
jne 0x140223fb4
inc cl
cmp cl, 5
jne 0x140223fa0
jmp 0x140223fbb
movsx edx, dl
btc edx, 0
xor dl, 0xa7
mov ecx, r10d
mov byte [rbp - 0x39], dl
mov eax, 0xaaaaaaab
mul r10d
shr edx, 1
lea eax, [rdx + rdx*2]
sub ecx, eax
mov r8d, ecx
cmp byte [rbp + rcx - 0x3a], 0x5d
je 0x140224738
xor r11b, r11b
mov word [rbp - 0x40], 0x124
mov byte [rbp - 0x3c], r11b
xor cl, cl
mov byte [rbp - 0x3e], 0x40
mov r9b, 5
mov dword [rbp - 0x3b], 0xa48604
mov dl, 0x80
mov word [rbp - 0x37], 0x305
mov byte [rbp - 0x35], 0x7c
nop word [rax + rax]
mov eax, 1
sar al, cl
test al, 1
jne 0x140224024
inc cl
cmp cl, 4
jne 0x140224010
jmp 0x14022402d
mov edx, 0xffffff80
btc edx, 3
movzx ecx, r9b
mov al, 0x40
sar al, cl
test al, 1
jne 0x140224042
inc cl
cmp cl, 8
jne 0x140224031
jmp 0x14022404c
movsx edx, dl
movzx eax, r9b
btc edx, eax
xor cl, cl
nop
mov al, 0x40
sar al, cl
test al, 1
jne 0x140224061
inc cl
cmp cl, r9b
jne 0x140224050
jmp 0x14022406b
movsx edx, dl
movzx eax, r11b
btc edx, eax
mov rax, r10
xor dl, 0x86
and eax, 1
mov byte [rbp - 0x3d], dl
mov r9, r10
cmp byte [rbp + rax - 0x3d], 0x20
je 0x140224738
mov dword [rbp - 0x40], 0xb98001fa
mov dl, 0x86
mov word [rbp - 0x3c], 0x9000
xor cl, cl
mov dword [rbp - 0x37], 0x7ca47c
mov word [rbp - 0x33], 0x305
mov byte [rbp - 0x31], 0xa4
mov byte [rbp - 0x38], r11b
nop dword [rax + rax]
mov eax, 1
sar al, cl
test al, 1
jne 0x1402240c4
inc cl
cmp cl, 4
jne 0x1402240b0
jmp 0x1402240c6
mov dl, Ordinal_143
mov cl, 5
nop dword [rax + rax]
mov eax, 0xffffff80
sar al, cl
test al, 1
jne 0x1402240e4
inc cl
cmp cl, 8
jne 0x1402240d0
jmp 0x1402240eb
movsx edx, dl
btc edx, 5
xor cl, cl
nop dword [rax]
mov eax, 0xffffff80
sar al, cl
test al, 1
jne 0x140224104
inc cl
cmp cl, 5
jne 0x1402240f0
jmp 0x14022410b
movsx edx, dl
btc edx, 0
xor dl, 0xa4
mov cl, 5
mov byte [rbp - 0x3a], dl
mov dl, 0xc6
mov eax, 0xffffff90
sar al, cl
test al, 1
jne 0x140224129
inc cl
cmp cl, 8
jne 0x140224115
jmp 0x140224130
movsx edx, dl
btc edx, 5
xor cl, cl
mov eax, 0xffffff90
sar al, cl
test al, 1
jne 0x140224146
inc cl
cmp cl, 5
jne 0x140224132
jmp 0x14022414d
movsx edx, dl
btc edx, 0
xor dl, 0xa7
mov byte [rbp - 0x39], dl
cmp byte [rbp + r8 - 0x3a], 0xa
je 0x140224738
mov dword [rbp - 0x40], 0x1b400040
mov dl, 0xc6
mov dword [rbp - 0x3c], 0x15a5001
mov cl, 5
mov byte [rbp - 0x38], 0x50
mov dword [rbp - 0x33], 0x868604
mov word [rbp - 0x2f], 0x305
mov byte [rbp - 0x2d], 4
mov byte [rbp - 0x34], r11b
nop word [rax + rax]
mov eax, 0x40
sar al, cl
test al, 1
jne 0x1402241a4
inc cl
cmp cl, 8
jne 0x140224190
jmp 0x1402241ab
movsx edx, dl
btc edx, 5
xor cl, cl
nop dword [rax]
mov eax, 0x40
sar al, cl
test al, 1
jne 0x1402241c4
inc cl
cmp cl, 5
jne 0x1402241b0
jmp 0x1402241cb
movsx edx, dl
btc edx, 0
xor dl, 0x86
mov byte [rbp - 0x37], dl
xor cl, cl
mov dl, 0x92
mov eax, 1
sar al, cl
test al, 1
jne 0x1402241e9
inc cl
cmp cl, 4
jne 0x1402241d5
jmp 0x1402241eb
mov dl, 0x9a
mov cl, 5
nop dword [rax]
mov eax, 0x50
sar al, cl
test al, 1
jne 0x140224204
inc cl
cmp cl, 8
jne 0x1402241f0
jmp 0x14022420b
movsx edx, dl
btc edx, 5
xor cl, cl
nop dword [rax]
mov eax, 0x50
sar al, cl
test al, 1
jne 0x140224224
inc cl
cmp cl, 5
jne 0x140224210
jmp 0x14022422b
movsx edx, dl
btc edx, 0
xor dl, 0x89
mov byte [rbp - 0x36], dl
xor cl, cl
mov dl, 0xd6
mov eax, 1
sar al, cl
test al, 1
jne 0x140224249
inc cl
cmp cl, 4
jne 0x140224235
jmp 0x14022424b
mov dl, 0xde
mov cl, 5
nop dword [rax]
mov eax, 0x50
sar al, cl
test al, 1
jne 0x140224264
inc cl
cmp cl, 8
jne 0x140224250
jmp 0x14022426b
movsx edx, dl
btc edx, 5
xor cl, cl
nop dword [rax]
mov eax, 0x50
sar al, cl
test al, 1
jne 0x140224284
inc cl
cmp cl, 5
jne 0x140224270
jmp 0x14022428b
movsx edx, dl
btc edx, 0
xor dl, 0x8c
and r9d, 3
mov byte [rbp - 0x35], dl
cmp byte [rbp + r9 - 0x37], 0x2e
je 0x140224738
cmp r10d, 0xc4b67e8b
ja 0x140224738
inc r10d
xor r10d, 0xc4b67e8b
cmp r10d, 0x15c9c09
jne 0x140224738
mov dl, 6
xor cl, cl
nop dword [rax]
mov eax, 4
sar al, cl
test al, 1
jne 0x1402242e4
inc cl
cmp cl, 4
jne 0x1402242d0
jmp 0x1402242e6
mov dl, ntohs
mov cl, 5
nop dword [rax + rax]
mov eax, 0xffffff90
sar al, cl
test al, 1
jne 0x140224304
inc cl
cmp cl, 8
jne 0x1402242f0
jmp 0x14022430b
movsx edx, dl
btc edx, 5
xor cl, cl
nop dword [rax]
mov eax, 0xffffff90
sar al, cl
test al, 1
jne 0x140224324
inc cl
cmp cl, 5
jne 0x140224310
jmp 0x14022432b
movsx edx, dl
btc edx, 0
xor dl, 4
cmp dl, 3
jne 0x140224410
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x1402243da
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x1402243da
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
mov r10d, 0x146ffc67
lea rcx, [rbx + r11*4]
mov r9d, dword [rcx + r14]
add r9, rbx
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x1402243d5
movsx ecx, r8b
lea r9, [r9 + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [r9 - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x1402243a0
cmp r10d, 0x213bed7
je 0x1402243e2
test r11d, r11d
jne 0x140224380
mov rax, qword [rax]
jmp 0x140224350
mov ecx, dword [rsi + 0x24]
add rcx, rbx
movzx edx, word [rcx + r11*2]
mov ecx, dword [rsi + 0x1c]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
mov edx, 0xc8c9f43
add rax, rbx
mov ecx, 0x54fc3d74
call rax
jmp 0x140224738
mov dl, 0x90
mov cl, 5
mov eax, 0xffffff80
sar al, cl
test al, 1
jne 0x140224428
inc cl
cmp cl, 8
jne 0x140224414
jmp 0x14022442f
movsx edx, dl
btc edx, 5
xor cl, cl
mov eax, 0xffffff80
sar al, cl
test al, 1
jne 0x140224445
inc cl
cmp cl, 5
jne 0x140224431
jmp 0x14022444c
movsx edx, dl
btc edx, 0
xor dl, 0x82
cmp dl, 4
jne 0x140224738
movss xmm0, dword [0x140345cd4]
mov edx, 0x81e17a9e
movss xmm2, dword [0x140345cd0]
movaps xmm1, xmm0
divss xmm1, xmm2
mov cl, reloc.WLDAP32.dll_Ordinal_26
mov eax, edx
shr eax, cl
mulss xmm1, xmm0
addss xmm1, xmm0
movss dword [0x140345cd4], xmm1
test al, 1
je 0x14022449a
xor cl, cl
mov eax, edx
inc cl
shr eax, cl
test al, 1
jne 0x1402244cb
xor ecx, ecx
mov eax, edx
shr eax, cl
test al, 1
jne 0x1402244cb
add cl, 2
mov eax, edx
shr eax, cl
test al, 1
jne 0x1402244cb
mov cl, 9
mov eax, edx
shr eax, cl
test al, 1
jne 0x1402244cb
mov cl, 0xb
shr edx, cl
test dl, 1
jne 0x1402244cb
comiss xmm2, xmm1
jbe 0x140224738
mov rax, qword gs:[0x60]
mov qword [rsp + 0x90], r15
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x14022457a
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x14022457a
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
mov r10d, 0x3f11bdf6
lea rcx, [rbx + r11*4]
mov r9d, dword [rcx + r14]
add r9, rbx
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x140224575
movsx ecx, r8b
lea r9, [r9 + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [r9 - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x140224540
cmp r10d, 0x484b6328
je 0x140224582
test r11d, r11d
jne 0x140224520
mov rax, qword [rax]
jmp 0x1402244f0
mov ecx, dword [rsi + 0x24]
add rcx, rbx
movzx edx, word [rcx + r11*2]
mov ecx, dword [rsi + 0x1c]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
add rax, rbx
call rax
mov r15, rax
test rax, rax
je 0x140224730
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax + rax]
mov rbx, qword [rcx + 0x30]
movsxd rdx, dword [rbx + 0x3c]
mov esi, dword [rdx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x14022464a
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x14022464a
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
mov r10d, 0xb8c428c0
lea rax, [r14 + r11*4]
mov r9d, dword [rax + rbx]
add r9, rbx
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x140224645
movsx eax, r8b
lea r9, [r9 + 1]
sub r8b, 0x41
mov edx, eax
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [r9 - 1]
cmova edx, eax
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x140224610
cmp r10d, 0xcc9ab10a
je 0x140224652
test r11d, r11d
jne 0x1402245f0
mov rcx, qword [rcx]
jmp 0x1402245c0
mov ecx, dword [rsi + 0x24]
add rcx, rbx
movzx edx, word [rcx + r11*2]
mov ecx, dword [rsi + 0x1c]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
mov rcx, r15
add rax, rbx
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x14022470a
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x14022470a
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
mov r10d, 0x1fa70343
lea rcx, [r14 + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x140224705
movsx ecx, r8b
lea r9, [r9 + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [r9 - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x1402246d0
cmp r10d, 0xb8510ec1
je 0x140224712
test r11d, r11d
jne 0x1402246b0
mov rax, qword [rax]
jmp 0x140224680
mov ecx, dword [rsi + 0x24]
add rcx, rbx
movzx edx, word [rcx + r11*2]
mov ecx, dword [rsi + 0x1c]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
mov ecx, 0xe8b6a9b9
add rax, rbx
call rax
mov r15, qword [rsp + 0x90]
mov r14, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret