Function at 0x14002d8b0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
mov rdi, rdx
mov r14d, 1
mov edx, r14d
mov r13, r9
mov rsi, r8
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x14002dd49
mov ecx, dword [rbx]
test cl, 8
je 0x14002d90a
lea eax, [r14 + 0xc]
jmp 0x14002dd62
mov r12d, dword [rbp + 0x110]
xor r15d, r15d
and ecx, 0xffffff0f
mov qword [rbx + 0xa0], r15
mov eax, r12d
mov qword [rbx + 0x78], r15
and eax, 0xffffffcf
mov qword [rbx + 0x20], r15
mov dword [rbx + 0x80], r15d
mov dword [rbx], ecx
mov dword [rsp + 0x4c], r12d
sub eax, r14d
je 0x14002da69
sub eax, r14d
je 0x14002d9b0
cmp eax, 6
je 0x14002d990
test rsi, rsi
je 0x14002dd49
test r13, r13
je 0x14002dd49
mov qword [rbx + 0x88], rsi
or ecx, 0xa0
mov esi, dword [rsp + 0x4c]
mov dword [rbx], ecx
mov dword [rsp + 0x44], esi
mov qword [rbx + 0x90], r13
mov qword [rbx + 0x70], r13
mov qword [rbx + 0x98], r15
jmp 0x14002dae9
mov esi, dword [rsp + 0x4c]
mov dword [rsp + 0x44], esi
mov qword [rbx + 0x88], r15
mov qword [rbx + 0x70], r15
mov dword [rsp + 0x58], 0x41c00010
jmp 0x14002db6a
test rsi, rsi
je 0x14002dd49
xor r9d, r9d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov edx, 0x80000000
mov rcx, rsi
lea r8d, [r9 + 3]
mov dword [rsp + 0x20], r8d
test r12b, 0x10
je 0x14002d9e5
call qword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x14002d9eb
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rbx + 0x88], rax
cmp rax, 0xffffffffffffffff
je 0x14002dabb
mov r9d, r14d
mov qword [rsp + 0x50], r15
lea r8, [rsp + 0x50]
mov rdx, r15
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14002da4e
mov rax, qword [rsp + 0x50]
lea rdx, [rsp + 0x78]
or dword [rbx], 0x20
mov rcx, rbx
mov qword [rbx + 0x20], rax
call fcn.140029a30
test eax, eax
je 0x14002da5a
mov rcx, qword [rbx + 0x88]
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r14d
jmp 0x14002dd62
mov qword [rbx + 0x20], r15
mov qword [rbx + 0x70], 0xffffffffffffffff
or dword [rbx], 0x40
test rdi, rdi
cmovne rsi, rdi
mov rdi, rsi
jmp 0x14002dad9
lea rax, [rsi - 1]
mov qword [rbx + 0x88], rsi
cmp rax, 0xfffffffffffffffd
ja 0x14002dd49
mov r9d, r14d
mov qword [rsp + 0x50], r15
lea r8, [rsp + 0x50]
mov rdx, r15
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14002dac3
mov rax, qword [rsp + 0x50]
lea rdx, [rsp + 0x78]
or dword [rbx], 0x20
mov rcx, rbx
mov qword [rbx + 0x20], rax
call fcn.140029a30
test eax, eax
je 0x14002dad9
mov r14d, eax
mov eax, r14d
jmp 0x14002dd62
test r13, r13
mov qword [rbx + 0x20], r15
mov rax, 0xffffffffffffffff
cmovne rax, r13
mov qword [rbx + 0x70], rax
mov ecx, dword [rbx]
mov dword [rsp + 0x44], r15d
test cl, 0x20
jne 0x14002dc14
mov dword [rsp + 0x58], 0x81800000
mov rcx, rdi
test r12b, 0x10
je 0x14002db33
call qword [sym.imp.KERNEL32.dll_lstrlenW]
dec eax
cdqe
lea rcx, [rdi + rax*2]
movzx eax, word [rdi + rax*2]
cmp ax, 0x2e
je 0x14002db6a
cmp rcx, rdi
jbe 0x14002db62
cmp ax, 0x2f
je 0x14002db62
cmp ax, 0x5c
je 0x14002db62
movzx eax, word [rcx - 2]
sub rcx, 2
cmp ax, 0x2e
jne 0x14002db12
jmp 0x14002db6a
call qword [sym.imp.KERNEL32.dll_lstrlenA]
dec eax
movsxd rcx, eax
add rcx, rdi
movzx eax, byte [rcx]
cmp al, 0x2e
je 0x14002db6a
cmp rcx, rdi
jbe 0x14002db62
cmp al, 0x2f
je 0x14002db62
cmp al, 0x5c
je 0x14002db62
movzx eax, byte [rcx - 1]
dec rcx
cmp al, 0x2e
jne 0x14002db48
jmp 0x14002db6a
mov dword [rsp + 0x58], 0x81c00000
test r12b, 0x20
jne 0x14002dc04
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_FileTimeToDosDateTime]
movzx r12d, word [rsp + 0x40]
movabs rcx, 0xfe624e212ac18000
add rcx, qword [rsp + 0x50]
movabs rax, 0xd6bf94d5e57a42bd
imul rcx
shl r12d, 0x10
lea rsi, [rcx + rdx]
sar rsi, 0x17
mov rax, rsi
shr rax, 0x3f
add rsi, rax
mov eax, esi
mov dword [rsp + 0x78], esi
mov dword [rsp + 0x70], eax
mov r13d, esi
mov dword [rbp - 0x80], eax
movzx eax, word [rsp + 0x48]
or r12d, eax
mov dword [rsp + 0x7c], esi
mov dword [rsp + 0x48], r12d
mov r12d, dword [rsp + 0x4c]
jmp 0x14002dc32
mov r12d, dword [rbp - 0x7c]
mov dword [rsp + 0x48], r12d
mov r12d, dword [rsp + 0x4c]
jmp 0x14002dc22
mov eax, dword [rbp - 0x78]
mov dword [rsp + 0x58], eax
mov eax, dword [rbp - 0x7c]
mov dword [rsp + 0x48], eax
mov eax, dword [rbp - 0x80]
mov esi, dword [rsp + 0x78]
mov r13d, dword [rsp + 0x7c]
mov dword [rsp + 0x70], eax
mov qword [rsp + 0x38], r15
mov r9d, 0xffffffff
mov qword [rsp + 0x30], r15
mov r8, rdi
mov dword [rsp + 0x28], r15d
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add eax, 8
xor ecx, ecx
movsxd rdx, eax
add rdx, 0x169
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r14, rax
test rax, rax
jne 0x14002dc81
lea edi, [rax + 2]
jmp 0x14002dd4e
xor edx, edx
mov r8d, 0x160
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
mov eax, r12d
and eax, 0x20
mov dword [rsp + 0x50], eax
je 0x14002dcd7
mov r13d, dword [rsp + 0x44]
lea r12, [r14 + 2]
mov eax, 8
mov dil, 8
mov word [r12], ax
mov rax, qword [rbx + 0x70]
mov qword [r14 + 0x10], rax
mov qword [r14 + 0x18], rax
mov rax, qword [rbx + 0x18]
mov qword [r14 + 0x38], rax
or dword [rbx], 0x80000000
mov byte [rsp + 0x40], dil
jmp 0x14002e38f
mov eax, r12d
lea r12, [r14 + 0x50]
and eax, 0x10
mov dword [rbp - 0x70], eax
je 0x14002dd23
mov qword [rsp + 0x38], r15
mov r9d, 0xffffffff
mov qword [rsp + 0x30], r15
mov r8, rdi
mov dword [rsp + 0x28], 0x104
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [r14 + 0x20], eax
test eax, eax
je 0x14002dd40
dec eax
mov dword [r14 + 0x20], eax
jmp 0x14002dd3c
mov rdx, rdi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [r14 + 0x20], eax
test eax, eax
jne 0x14002dd83
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov edi, 9
test byte [rbx], 0x40
je 0x14002dd60
mov rcx, qword [rbx + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
movzx ecx, byte [r12]
mov rax, r12
test cl, cl
je 0x14002dda3
nop
cmp cl, 0x5c
jne 0x14002dd98
mov byte [rax], 0x2f
movzx ecx, byte [rax + 1]
inc rax
test cl, cl
jne 0x14002dd90
mov eax, dword [rsp + 0x48]
lea rcx, [r14 + 0x160]
mov edx, dword [rsp + 0x70]
mov r8d, 8
mov dword [r14 + 4], eax
mov r9d, 9
mov eax, dword [rsp + 0x58]
mov edi, r15d
mov dword [r14 + 0x34], eax
lea rax, [rbp - 0x60]
mov qword [r14 + 0x40], rax
movzx eax, byte [rsp + 0x7c]
mov byte [rbp - 0x5b], al
mov eax, r13d
shr eax, 8
mov byte [rbp - 0x5a], al
mov eax, r13d
shr eax, 0x10
mov byte [rbp - 0x59], al
movzx eax, byte [rsp + 0x78]
mov byte [rbp - 0x57], al
mov eax, esi
shr eax, 8
mov byte [rbp - 0x56], al
mov eax, esi
shr eax, 0x10
mov byte [rbp - 0x55], al
movzx eax, byte [rbp - 0x80]
mov byte [rbp - 0x53], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0x52], al
mov eax, edx
mov dword [rbp - 0x60], 0xd5455
mov byte [rbp - 0x5c], 7
movsd xmm0, qword [rbp - 0x60]
mov qword [r14 + 0x48], rcx
shr eax, 0x10
mov byte [rbp - 0x51], al
mov word [r14], r8w
mov dword [r14 + 0x24], reloc.OLEAUT32.dll_SafeArrayGetElemsize
mov dword [r14 + 0x28], r9d
shr r13d, 0x18
mov byte [rbp - 0x58], r13b
shr esi, 0x18
mov byte [rbp - 0x54], sil
shr edx, 0x18
mov byte [rbp - 0x50], dl
movsd qword [rcx], xmm0
movzx eax, byte [rbp - 0x58]
mov byte [rcx + 8], al
mov byte [rcx + 2], 5
mov rax, qword [r14 + 0x48]
mov dword [rsp + 0x44], r15d
mov byte [rsp + 0x40], dil
mov byte [rax + 4], 1
cmp dword [rbp - 0x70], r15d
je 0x14002df0e
mov r8d, dword [r14 + 0x20]
mov rdx, r12
xor ecx, ecx
mov word [rbp - 0x4f], 0x7075
mov byte [rbp - 0x4b], 1
lea eax, [r8 + 0x1b]
mov dword [r14 + 0x24], eax
lea eax, [r8 + 0x13]
mov dword [r14 + 0x28], eax
lea eax, [r8 + 0xa]
mov byte [rbp - 0x4d], al
lea eax, [r8 + 0xa]
shr eax, 8
mov byte [rbp - 0x4c], al
call fcn.14002d020
mov byte [rbp - 0x4a], al
mov ecx, eax
shr ecx, 8
mov rdx, r12
mov byte [rbp - 0x49], cl
mov ecx, eax
shr ecx, 0x10
mov byte [rbp - 0x48], cl
mov rcx, qword [r14 + 0x48]
shr eax, 0x18
mov byte [rbp - 0x47], al
mov rax, qword [r14 + 0x40]
movsd xmm0, qword [rax + 0x11]
movsd qword [rcx + 9], xmm0
movzx eax, byte [rax + 0x19]
mov byte [rcx + 0x11], al
mov r8d, dword [r14 + 0x20]
mov rcx, qword [r14 + 0x48]
inc r8d
add rcx, 0x12
call sub.VCRUNTIME140.dll_memcpy
mov r8d, 8
lea r9d, [r8 + 1]
cmp dword [rbx], edi
jge 0x14002df35
movzx eax, word [r14]
lea r12, [r14 + 2]
mov dil, 8
mov word [r14 + 0x30], ax
mov byte [rsp + 0x40], dil
mov word [r12], r8w
mov dword [r14 + 0x24], r15d
jmp 0x14002e016
test byte [rsp + 0x4c], 8
je 0x14002df5e
mov edx, dword [r14 + 0x20]
lea eax, [rdx - 1]
cmp byte [rax + r14 + 0x50], 0x2f
je 0x14002df55
mov byte [rdx + r14 + 0x50], gethostbyname
inc dword [r14 + 0x20]
movzx edx, r15w
jmp 0x14002dfed
cmp qword [rbx + 0x10], rdi
je 0x14002df70
mov dword [rsp + 0x44], reloc.WSOCK32.dll_ioctlsocket
mov word [r14], r9w
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd rdi, eax
add rdi, r12
cmp rdi, r12
jbe 0x14002df91
cmp byte [rdi], 0x2e
je 0x14002df98
dec rdi
cmp rdi, r12
ja 0x14002df84
jne 0x14002df98
cmp byte [rdi], 0x2e
jne 0x14002dfc5
lea rsi, [0x1400f12b0]
nop
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x14002dfe6
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
cdqe
add rsi, rax
cmp byte [rsi], r15b
jne 0x14002dfa0
movzx eax, word [r14]
lea r12, [r14 + 2]
mov word [r14 + 0x30], ax
mov dil, 8
mov eax, 8
mov byte [rsp + 0x40], dil
mov word [r12], ax
jmp 0x14002e016
mov edi, dword [rsp + 0x44]
mov edx, r15d
movzx ecx, word [r14]
lea r12, [r14 + 2]
mov word [r14 + 0x30], cx
mov rax, r12
mov word [rax], dx
mov rcx, qword [rbx + 0x70]
cmp rcx, 0xffffffffffffffff
je 0x14002e013
mov eax, edi
add rax, rcx
mov qword [r14 + 0x10], rax
xor dil, dil
mov rax, qword [rbx + 0x70]
mov rdx, rbx
mov qword [r14 + 0x18], rax
mov rcx, r14
mov rax, qword [rbx + 0x18]
add rax, qword [rbx + 0x20]
mov qword [r14 + 0x38], rax
mov dword [rbx + 0x28], r15d
call fcn.14002c740
mov eax, dword [rbx + 0x28]
test eax, eax
jne 0x14002e4e4
mov edx, dword [rbx]
mov ecx, dword [r14 + 0x20]
mov r13d, dword [rsp + 0x44]
test edx, edx
jns 0x14002e05f
add ecx, 0xb
mov qword [rbx + 0x18], rcx
jmp 0x14002e391
mov eax, dword [r14 + 0x24]
add eax, 0x32
add eax, ecx
add qword [rbx + 0x18], rax
test r13d, r13d
je 0x14002e391
mov r8, qword [rbx + 0x10]
lea rsi, [0x1400f2cc0]
mov dword [rbx + 0x48], 0x12345678
mov dword [rbx + 0x4c], 0x23456789
mov dword [rbx + 0x50], 0x34567890
test r8, r8
je 0x14002e0e7
nop word [rax + rax]
movzx eax, byte [r8]
test al, al
je 0x14002e0e7
mov edx, dword [rbx + 0x48]
xor rax, rdx
shr edx, 8
movzx ecx, al
xor edx, dword [rsi + rcx*4]
mov ecx, dword [rbx + 0x50]
movzx eax, dl
add eax, dword [rbx + 0x4c]
mov dword [rbx + 0x48], edx
imul edx, eax, 0x8088405
movzx eax, cl
shr ecx, 8
inc edx
mov dword [rbx + 0x4c], edx
shr rdx, 0x18
xor rdx, rax
xor ecx, dword [rsi + rdx*4]
mov dword [rbx + 0x50], ecx
add r8, 1
jne 0x14002e0a0
mov rdi, r15
nop word [rax + rax]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
sar eax, 7
mov byte [rsp + rdi + 0x60], al
inc rdi
cmp rdi, 0xc
jl 0x14002e0f0
movzx eax, byte [r14 + 5]
mov byte [rsp + 0x6b], al
nop
movsx r9, byte [rsp + r15 + 0x60]
mov r10d, dword [rbx + 0x48]
mov rax, r9
xor rax, r10
mov edi, dword [rbx + 0x50]
movzx ecx, al
mov edx, edi
and edx, 0xfffd
shr r10d, 8
or edx, 2
xor r10d, dword [rsi + rcx*4]
mov r11d, r10d
movzx eax, r10b
add eax, dword [rbx + 0x4c]
imul ecx, eax, 0x8088405
movzx eax, dil
shr edi, 8
inc ecx
mov r8d, ecx
shr rcx, 0x18
xor rcx, rax
mov eax, edx
xor eax, 1
imul eax, edx
xor edi, dword [rsi + rcx*4]
mov edx, edi
and edx, 0xfffd
shr eax, 8
or edx, 2
xor al, r9b
movsx r9, byte [rsp + r15 + 0x61]
mov byte [rsp + r15 + 0x60], al
mov rax, r9
xor rax, r11
shr r11d, 8
movzx ecx, al
xor r11d, dword [rsi + rcx*4]
movzx eax, r11b
add eax, r8d
movsx r8, byte [rsp + r15 + 0x62]
imul r10d, eax, 0x8088405
movzx eax, dil
shr edi, 8
inc r10d
mov ecx, r10d
shr rcx, 0x18
xor rcx, rax
mov eax, edx
xor eax, 1
imul eax, edx
xor edi, dword [rsi + rcx*4]
mov edx, edi
and edx, 0xfffd
shr eax, 8
or edx, 2
xor al, r9b
mov byte [rsp + r15 + 0x61], al
mov rax, r8
xor rax, r11
shr r11d, 8
movzx ecx, al
xor r11d, dword [rsi + rcx*4]
movzx eax, r11b
add eax, r10d
movzx ecx, dil
imul r9d, eax, 0x8088405
mov r10d, edi
shr r10d, 8
inc r9d
mov eax, r9d
shr rax, 0x18
xor rcx, rax
mov eax, edx
xor eax, 1
imul eax, edx
xor r10d, dword [rsi + rcx*4]
mov edx, r10d
shr eax, 8
xor al, r8b
movsx r8, byte [rsp + r15 + 0x63]
mov byte [rsp + r15 + 0x62], al
and edx, 0xfffd
mov edi, r10d
or edx, 2
shr edi, 8
mov ecx, r11d
shr r11d, 8
xor rcx, r8
movzx eax, cl
movzx ecx, r10b
xor r11d, dword [rsi + rax*4]
movzx eax, r11b
add eax, r9d
imul r9d, eax, 0x8088405
inc r9d
mov eax, r9d
shr rax, 0x18
xor rcx, rax
mov eax, edx
xor eax, 1
imul eax, edx
xor edi, dword [rsi + rcx*4]
mov esi, r11d
mov edx, edi
lea r11, [0x1400f2cc0]
and edx, 0xfffd
mov ecx, esi
shr eax, 8
or edx, 2
xor al, r8b
shr esi, 8
movsx r8, byte [rsp + r15 + 0x64]
mov byte [rsp + r15 + 0x63], al
xor rcx, r8
movzx eax, cl
movzx ecx, dil
shr edi, 8
xor esi, dword [r11 + rax*4]
movzx eax, sil
add eax, r9d
imul r10d, eax, 0x8088405
inc r10d
mov eax, r10d
shr rax, 0x18
xor rcx, rax
mov eax, edx
xor eax, 1
imul eax, edx
mov edx, esi
lea rsi, [0x1400f2cc0]
xor edi, dword [r11 + rcx*4]
mov ecx, edx
movsx r11, byte [rsp + r15 + 0x65]
mov r9d, edi
shr edx, 8
xor rcx, r11
shr eax, 8
and r9d, 0xfffd
xor al, r8b
or r9d, 2
mov byte [rsp + r15 + 0x64], al
movzx eax, cl
movzx ecx, dil
xor edx, dword [rsi + rax*4]
movzx eax, dl
add eax, r10d
mov dword [rbx + 0x48], edx
imul eax, eax, 0x8088405
mov edx, edi
shr edx, 8
inc eax
mov dword [rbx + 0x4c], eax
shr rax, 0x18
xor rcx, rax
mov eax, r9d
xor eax, 1
imul eax, r9d
xor edx, dword [rsi + rcx*4]
mov dword [rbx + 0x50], edx
shr eax, 8
xor al, r11b
mov byte [rsp + r15 + 0x65], al
add r15, 6
cmp r15, 0xc
jl 0x14002e110
mov r8d, reloc.WSOCK32.dll_ioctlsocket
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.14002d2d0
mov eax, dword [rbx + 0x28]
test eax, eax
jne 0x14002e4e4
add qword [rbx + 0x18], 0xc
or dword [rbx], 0x10
movzx edi, byte [rsp + 0x40]
mov edx, dword [rbx]
mov rax, qword [rbx + 0x88]
test rax, rax
je 0x14002e48d
mov rcx, rbx
cmp dil, 8
jne 0x14002e3b7
mov rdx, r14
call fcn.14002d620
jmp 0x14002e451
test dl, dl
jns 0x14002e3f4
mov esi, dword [rbx + 0x90]
mov rdx, rax
mov r8d, esi
call fcn.14002d2d0
mov rdx, qword [rbx + 0x88]
mov r8d, esi
mov ecx, dword [rbx + 0x80]
add qword [rbx + 0x78], rsi
call fcn.14002d020
add qword [rbx + 0x98], rsi
mov dword [rbx + 0x80], eax
jmp 0x14002e443
mov r8d, 0x4000
lea rdx, [rbx + 0xb0]
call fcn.14002d520
mov esi, eax
test eax, eax
je 0x14002e443
nop dword [rax]
cmp dword [rbx + 0x28], 0
jne 0x14002e443
mov r8d, esi
lea rdx, [rbx + 0xb0]
mov rcx, rbx
call fcn.14002d2d0
mov r8d, 0x4000
lea rdx, [rbx + 0xb0]
mov rcx, rbx
call fcn.14002d520
mov esi, eax
test eax, eax
jne 0x14002e410
movzx edi, byte [rsp + 0x40]
mov eax, esi
add qword [rbx + 0xa0], rax
mov eax, dword [rbx + 0x28]
test eax, eax
jne 0x14002e4e4
and dword [rbx], 0xffffffef
mov edx, dword [rbx]
test dl, 0x40
je 0x14002e475
mov rcx, qword [rbx + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [rbx]
mov rax, qword [rbx + 0x78]
and edx, 0xffffffbf
mov qword [rbx + 0x70], rax
mov rax, qword [rbx + 0xa0]
add qword [rbx + 0x18], rax
mov dword [rbx], edx
test edx, edx
jns 0x14002e4f4
or edx, 8
cmp dword [rsp + 0x50], 0
mov dword [rbx], edx
jne 0x14002e6a6
mov edx, dword [rbx + 0x80]
mov rcx, rbx
call fcn.14002d140
movzx edx, word [rbx + 0x82]
mov rcx, rbx
call fcn.14002d140
mov edx, dword [rbx + 0x78]
mov rcx, rbx
call fcn.14002d140
mov rdx, qword [rbx + 0x78]
mov rcx, rbx
shr rdx, 0x10
call fcn.14002d140
mov eax, dword [rbx + 0x28]
test eax, eax
je 0x14002e6a6
mov edi, eax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x14002dd4e
mov rdx, qword [rbx + 0xa0]
mov eax, dword [rbx + 0x80]
mov r8, qword [r14 + 0x10]
mov dword [r14 + 8], eax
mov ecx, r13d
add rdx, rcx
add rcx, qword [rbx + 0xa0]
mov qword [r14 + 0x10], rcx
mov rax, qword [rbx + 0x70]
mov qword [r14 + 0x18], rax
test byte [rbx], 4
je 0x14002e59f
test r13d, r13d
jne 0x14002e59f
movzx eax, dil
mov word [r12], ax
movzx eax, word [r14]
test al, 1
jne 0x14002e549
mov ecx, 0xfff7
and ax, cx
mov word [r14], ax
mov rdx, qword [r14 + 0x38]
mov rcx, rbx
mov word [r14 + 0x30], ax
sub rdx, qword [rbx + 0x20]
call fcn.14002d490
test eax, eax
je 0x14002e58c
mov rdx, rbx
mov rcx, r14
call fcn.14002c740
mov eax, dword [rbx + 0x28]
test eax, eax
jne 0x14002e4e4
mov rdx, qword [rbx + 0x18]
mov rcx, rbx
call fcn.14002d490
test eax, eax
jne 0x14002e66b
mov rcx, r14
mov edi, reloc.WSOCK32.dll_recv
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x14002dd4e
movzx eax, dil
cmp word [r12], ax
jne 0x14002e6ad
test dil, dil
jne 0x14002e5bc
cmp r8, rdx
jne 0x14002e6ad
mov edx, 0x8074b50
mov rcx, rbx
call fcn.14002d140
mov edx, 0x807
mov rcx, rbx
call fcn.14002d140
mov edx, dword [r14 + 8]
mov rcx, rbx
call fcn.14002d140
movzx edx, word [r14 + 0xa]
mov rcx, rbx
call fcn.14002d140
mov rax, qword [r14 + 0x10]
mov edi, 0xffffffff
mov rcx, rbx
cmp rax, rdi
jb 0x14002e60b
mov edx, edi
call fcn.14002d140
mov eax, edi
jmp 0x14002e61a
mov edx, eax
call fcn.14002d140
mov rax, qword [r14 + 0x10]
shr rax, 0x10
mov edx, eax
mov rcx, rbx
call fcn.14002d140
mov rax, qword [r14 + 0x18]
mov rcx, rbx
cmp rax, rdi
jb 0x14002e639
mov edx, edi
call fcn.14002d140
jmp 0x14002e648
mov edx, eax
call fcn.14002d140
mov rdi, qword [r14 + 0x18]
shr rdi, 0x10
mov edx, edi
mov rcx, rbx
call fcn.14002d140
mov eax, dword [rbx + 0x28]
test eax, eax
jne 0x14002e4e4
add qword [rbx + 0x18], 0x10
movzx eax, word [r14 + 0x30]
mov word [r14], ax
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14002e67f
mov qword [rbx + 0x68], r14
xor eax, eax
jmp 0x14002dd62
mov rax, qword [rcx + 0x158]
test rax, rax
je 0x14002e69f
nop dword [rax + rax]
mov rcx, rax
mov rax, qword [rax + 0x158]
test rax, rax
jne 0x14002e690
mov qword [rcx + 0x158], r14
xor eax, eax
jmp 0x14002dd62
mov rcx, r14
mov edi, reloc.OLEAUT32.dll_SafeArrayGetElemsize
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x14002dd4e