Function at 0x14002d980
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
mov rdi, rdx
mov r14d, 1
mov edx, r14d
mov r13, r9
mov rsi, r8
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x14002de19
mov ecx, dword [rbx]
test cl, 8
je 0x14002d9da
lea eax, [r14 + 0xc]
jmp 0x14002de32
mov r12d, dword [rbp + 0x110]
xor r15d, r15d
and ecx, 0xffffff0f
mov qword [rbx + 0xa0], r15
mov eax, r12d
mov qword [rbx + 0x78], r15
and eax, 0xffffffcf
mov qword [rbx + 0x20], r15
mov dword [rbx + 0x80], r15d
mov dword [rbx], ecx
mov dword [rsp + 0x4c], r12d
sub eax, r14d
je 0x14002db39
sub eax, r14d
je 0x14002da80
cmp eax, 6
je 0x14002da60
test rsi, rsi
je 0x14002de19
test r13, r13
je 0x14002de19
mov qword [rbx + 0x88], rsi
or ecx, 0xa0
mov esi, dword [rsp + 0x4c]
mov dword [rbx], ecx
mov dword [rsp + 0x44], esi
mov qword [rbx + 0x90], r13
mov qword [rbx + 0x70], r13
mov qword [rbx + 0x98], r15
jmp 0x14002dbb9
mov esi, dword [rsp + 0x4c]
mov dword [rsp + 0x44], esi
mov qword [rbx + 0x88], r15
mov qword [rbx + 0x70], r15
mov dword [rsp + 0x58], 0x41c00010
jmp 0x14002dc3a
test rsi, rsi
je 0x14002de19
xor r9d, r9d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov edx, 0x80000000
mov rcx, rsi
lea r8d, [r9 + 3]
mov dword [rsp + 0x20], r8d
test r12b, 0x10
je 0x14002dab5
call qword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x14002dabb
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rbx + 0x88], rax
cmp rax, 0xffffffffffffffff
je 0x14002db8b
mov r9d, r14d
mov qword [rsp + 0x50], r15
lea r8, [rsp + 0x50]
mov rdx, r15
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14002db1e
mov rax, qword [rsp + 0x50]
lea rdx, [rsp + 0x78]
or dword [rbx], 0x20
mov rcx, rbx
mov qword [rbx + 0x20], rax
call fcn.140029ae0
test eax, eax
je 0x14002db2a
mov rcx, qword [rbx + 0x88]
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r14d
jmp 0x14002de32
mov qword [rbx + 0x20], r15
mov qword [rbx + 0x70], 0xffffffffffffffff
or dword [rbx], 0x40
test rdi, rdi
cmovne rsi, rdi
mov rdi, rsi
jmp 0x14002dba9
lea rax, [rsi - 1]
mov qword [rbx + 0x88], rsi
cmp rax, 0xfffffffffffffffd
ja 0x14002de19
mov r9d, r14d
mov qword [rsp + 0x50], r15
lea r8, [rsp + 0x50]
mov rdx, r15
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14002db93
mov rax, qword [rsp + 0x50]
lea rdx, [rsp + 0x78]
or dword [rbx], 0x20
mov rcx, rbx
mov qword [rbx + 0x20], rax
call fcn.140029ae0
test eax, eax
je 0x14002dba9
mov r14d, eax
mov eax, r14d
jmp 0x14002de32
test r13, r13
mov qword [rbx + 0x20], r15
mov rax, 0xffffffffffffffff
cmovne rax, r13
mov qword [rbx + 0x70], rax
mov ecx, dword [rbx]
mov dword [rsp + 0x44], r15d
test cl, 0x20
jne 0x14002dce4
mov dword [rsp + 0x58], 0x81800000
mov rcx, rdi
test r12b, 0x10
je 0x14002dc03
call qword [sym.imp.KERNEL32.dll_lstrlenW]
dec eax
cdqe
lea rcx, [rdi + rax*2]
movzx eax, word [rdi + rax*2]
cmp ax, 0x2e
je 0x14002dc3a
cmp rcx, rdi
jbe 0x14002dc32
cmp ax, 0x2f
je 0x14002dc32
cmp ax, 0x5c
je 0x14002dc32
movzx eax, word [rcx - 2]
sub rcx, 2
cmp ax, 0x2e
jne 0x14002dbe2
jmp 0x14002dc3a
call qword [sym.imp.KERNEL32.dll_lstrlenA]
dec eax
movsxd rcx, eax
add rcx, rdi
movzx eax, byte [rcx]
cmp al, 0x2e
je 0x14002dc3a
cmp rcx, rdi
jbe 0x14002dc32
cmp al, 0x2f
je 0x14002dc32
cmp al, 0x5c
je 0x14002dc32
movzx eax, byte [rcx - 1]
dec rcx
cmp al, 0x2e
jne 0x14002dc18
jmp 0x14002dc3a
mov dword [rsp + 0x58], 0x81c00000
test r12b, 0x20
jne 0x14002dcd4
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_FileTimeToDosDateTime]
movzx r12d, word [rsp + 0x40]
movabs rcx, 0xfe624e212ac18000
add rcx, qword [rsp + 0x50]
movabs rax, 0xd6bf94d5e57a42bd
imul rcx
shl r12d, 0x10
lea rsi, [rcx + rdx]
sar rsi, 0x17
mov rax, rsi
shr rax, 0x3f
add rsi, rax
mov eax, esi
mov dword [rsp + 0x78], esi
mov dword [rsp + 0x70], eax
mov r13d, esi
mov dword [rbp - 0x80], eax
movzx eax, word [rsp + 0x48]
or r12d, eax
mov dword [rsp + 0x7c], esi
mov dword [rsp + 0x48], r12d
mov r12d, dword [rsp + 0x4c]
jmp 0x14002dd02
mov r12d, dword [rbp - 0x7c]
mov dword [rsp + 0x48], r12d
mov r12d, dword [rsp + 0x4c]
jmp 0x14002dcf2
mov eax, dword [rbp - 0x78]
mov dword [rsp + 0x58], eax
mov eax, dword [rbp - 0x7c]
mov dword [rsp + 0x48], eax
mov eax, dword [rbp - 0x80]
mov esi, dword [rsp + 0x78]
mov r13d, dword [rsp + 0x7c]
mov dword [rsp + 0x70], eax
mov qword [rsp + 0x38], r15
mov r9d, 0xffffffff
mov qword [rsp + 0x30], r15
mov r8, rdi
mov dword [rsp + 0x28], r15d
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add eax, 8
xor ecx, ecx
movsxd rdx, eax
add rdx, 0x169
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r14, rax
test rax, rax
jne 0x14002dd51
lea edi, [rax + 2]
jmp 0x14002de1e
xor edx, edx
mov r8d, 0x160
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
mov eax, r12d
and eax, 0x20
mov dword [rsp + 0x50], eax
je 0x14002dda7
mov r13d, dword [rsp + 0x44]
lea r12, [r14 + 2]
mov eax, 8
mov dil, 8
mov word [r12], ax
mov rax, qword [rbx + 0x70]
mov qword [r14 + 0x10], rax
mov qword [r14 + 0x18], rax
mov rax, qword [rbx + 0x18]
mov qword [r14 + 0x38], rax
or dword [rbx], 0x80000000
mov byte [rsp + 0x40], dil
jmp 0x14002e45f
mov eax, r12d
lea r12, [r14 + 0x50]
and eax, 0x10
mov dword [rbp - 0x70], eax
je 0x14002ddf3
mov qword [rsp + 0x38], r15
mov r9d, 0xffffffff
mov qword [rsp + 0x30], r15
mov r8, rdi
mov dword [rsp + 0x28], 0x104
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [r14 + 0x20], eax
test eax, eax
je 0x14002de10
dec eax
mov dword [r14 + 0x20], eax
jmp 0x14002de0c
mov rdx, rdi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [r14 + 0x20], eax
test eax, eax
jne 0x14002de53
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov edi, 9
test byte [rbx], 0x40
je 0x14002de30
mov rcx, qword [rbx + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
movzx ecx, byte [r12]
mov rax, r12
test cl, cl
je 0x14002de73
nop
cmp cl, 0x5c
jne 0x14002de68
mov byte [rax], 0x2f
movzx ecx, byte [rax + 1]
inc rax
test cl, cl
jne 0x14002de60
mov eax, dword [rsp + 0x48]
lea rcx, [r14 + 0x160]
mov edx, dword [rsp + 0x70]
mov r8d, 8
mov dword [r14 + 4], eax
mov r9d, 9
mov eax, dword [rsp + 0x58]
mov edi, r15d
mov dword [r14 + 0x34], eax
lea rax, [rbp - 0x60]
mov qword [r14 + 0x40], rax
movzx eax, byte [rsp + 0x7c]
mov byte [rbp - 0x5b], al
mov eax, r13d
shr eax, 8
mov byte [rbp - 0x5a], al
mov eax, r13d
shr eax, 0x10
mov byte [rbp - 0x59], al
movzx eax, byte [rsp + 0x78]
mov byte [rbp - 0x57], al
mov eax, esi
shr eax, 8
mov byte [rbp - 0x56], al
mov eax, esi
shr eax, 0x10
mov byte [rbp - 0x55], al
movzx eax, byte [rbp - 0x80]
mov byte [rbp - 0x53], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0x52], al
mov eax, edx
mov dword [rbp - 0x60], 0xd5455
mov byte [rbp - 0x5c], 7
movsd xmm0, qword [rbp - 0x60]
mov qword [r14 + 0x48], rcx
shr eax, 0x10
mov byte [rbp - 0x51], al
mov word [r14], r8w
mov dword [r14 + 0x24], reloc.OLEAUT32.dll_SafeArrayGetElemsize
mov dword [r14 + 0x28], r9d
shr r13d, 0x18
mov byte [rbp - 0x58], r13b
shr esi, 0x18
mov byte [rbp - 0x54], sil
shr edx, 0x18
mov byte [rbp - 0x50], dl
movsd qword [rcx], xmm0
movzx eax, byte [rbp - 0x58]
mov byte [rcx + 8], al
mov byte [rcx + 2], 5
mov rax, qword [r14 + 0x48]
mov dword [rsp + 0x44], r15d
mov byte [rsp + 0x40], dil
mov byte [rax + 4], 1
cmp dword [rbp - 0x70], r15d
je 0x14002dfde
mov r8d, dword [r14 + 0x20]
mov rdx, r12
xor ecx, ecx
mov word [rbp - 0x4f], 0x7075
mov byte [rbp - 0x4b], 1
lea eax, [r8 + 0x1b]
mov dword [r14 + 0x24], eax
lea eax, [r8 + 0x13]
mov dword [r14 + 0x28], eax
lea eax, [r8 + 0xa]
mov byte [rbp - 0x4d], al
lea eax, [r8 + 0xa]
shr eax, 8
mov byte [rbp - 0x4c], al
call fcn.14002d0f0
mov byte [rbp - 0x4a], al
mov ecx, eax
shr ecx, 8
mov rdx, r12
mov byte [rbp - 0x49], cl
mov ecx, eax
shr ecx, 0x10
mov byte [rbp - 0x48], cl
mov rcx, qword [r14 + 0x48]
shr eax, 0x18
mov byte [rbp - 0x47], al
mov rax, qword [r14 + 0x40]
movsd xmm0, qword [rax + 0x11]
movsd qword [rcx + 9], xmm0
movzx eax, byte [rax + 0x19]
mov byte [rcx + 0x11], al
mov r8d, dword [r14 + 0x20]
mov rcx, qword [r14 + 0x48]
inc r8d
add rcx, 0x12
call sub.VCRUNTIME140.dll_memcpy
mov r8d, 8
lea r9d, [r8 + 1]
cmp dword [rbx], edi
jge 0x14002e005
movzx eax, word [r14]
lea r12, [r14 + 2]
mov dil, 8
mov word [r14 + 0x30], ax
mov byte [rsp + 0x40], dil
mov word [r12], r8w
mov dword [r14 + 0x24], r15d
jmp 0x14002e0e6
test byte [rsp + 0x4c], 8
je 0x14002e02e
mov edx, dword [r14 + 0x20]
lea eax, [rdx - 1]
cmp byte [rax + r14 + 0x50], 0x2f
je 0x14002e025
mov byte [rdx + r14 + 0x50], gethostbyname
inc dword [r14 + 0x20]
movzx edx, r15w
jmp 0x14002e0bd
cmp qword [rbx + 0x10], rdi
je 0x14002e040
mov dword [rsp + 0x44], reloc.WSOCK32.dll_ioctlsocket
mov word [r14], r9w
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd rdi, eax
add rdi, r12
cmp rdi, r12
jbe 0x14002e061
cmp byte [rdi], 0x2e
je 0x14002e068
dec rdi
cmp rdi, r12
ja 0x14002e054
jne 0x14002e068
cmp byte [rdi], 0x2e
jne 0x14002e095
lea rsi, [0x1400f12c0]
nop
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x14002e0b6
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
cdqe
add rsi, rax
cmp byte [rsi], r15b
jne 0x14002e070
movzx eax, word [r14]
lea r12, [r14 + 2]
mov word [r14 + 0x30], ax
mov dil, 8
mov eax, 8
mov byte [rsp + 0x40], dil
mov word [r12], ax
jmp 0x14002e0e6
mov edi, dword [rsp + 0x44]
mov edx, r15d
movzx ecx, word [r14]
lea r12, [r14 + 2]
mov word [r14 + 0x30], cx
mov rax, r12
mov word [rax], dx
mov rcx, qword [rbx + 0x70]
cmp rcx, 0xffffffffffffffff
je 0x14002e0e3
mov eax, edi
add rax, rcx
mov qword [r14 + 0x10], rax
xor dil, dil
mov rax, qword [rbx + 0x70]
mov rdx, rbx
mov qword [r14 + 0x18], rax
mov rcx, r14
mov rax, qword [rbx + 0x18]
add rax, qword [rbx + 0x20]
mov qword [r14 + 0x38], rax
mov dword [rbx + 0x28], r15d
call fcn.14002c810
mov eax, dword [rbx + 0x28]
test eax, eax
jne 0x14002e5b4
mov edx, dword [rbx]
mov ecx, dword [r14 + 0x20]
mov r13d, dword [rsp + 0x44]
test edx, edx
jns 0x14002e12f
add ecx, 0xb
mov qword [rbx + 0x18], rcx
jmp 0x14002e461
mov eax, dword [r14 + 0x24]
add eax, 0x32
add eax, ecx
add qword [rbx + 0x18], rax
test r13d, r13d
je 0x14002e461
mov r8, qword [rbx + 0x10]
lea rsi, [0x1400f2cd0]
mov dword [rbx + 0x48], 0x12345678
mov dword [rbx + 0x4c], 0x23456789
mov dword [rbx + 0x50], 0x34567890
test r8, r8
je 0x14002e1b7
nop word [rax + rax]
movzx eax, byte [r8]
test al, al
je 0x14002e1b7
mov edx, dword [rbx + 0x48]
xor rax, rdx
shr edx, 8
movzx ecx, al
xor edx, dword [rsi + rcx*4]
mov ecx, dword [rbx + 0x50]
movzx eax, dl
add eax, dword [rbx + 0x4c]
mov dword [rbx + 0x48], edx
imul edx, eax, 0x8088405
movzx eax, cl
shr ecx, 8
inc edx
mov dword [rbx + 0x4c], edx
shr rdx, 0x18
xor rdx, rax
xor ecx, dword [rsi + rdx*4]
mov dword [rbx + 0x50], ecx
add r8, 1
jne 0x14002e170
mov rdi, r15
nop word [rax + rax]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
sar eax, 7
mov byte [rsp + rdi + 0x60], al
inc rdi
cmp rdi, 0xc
jl 0x14002e1c0
movzx eax, byte [r14 + 5]
mov byte [rsp + 0x6b], al
nop
movsx r9, byte [rsp + r15 + 0x60]
mov r10d, dword [rbx + 0x48]
mov rax, r9
xor rax, r10
mov edi, dword [rbx + 0x50]
movzx ecx, al
mov edx, edi
and edx, 0xfffd
shr r10d, 8
or edx, 2
xor r10d, dword [rsi + rcx*4]
mov r11d, r10d
movzx eax, r10b
add eax, dword [rbx + 0x4c]
imul ecx, eax, 0x8088405
movzx eax, dil
shr edi, 8
inc ecx
mov r8d, ecx
shr rcx, 0x18
xor rcx, rax
mov eax, edx
xor eax, 1
imul eax, edx
xor edi, dword [rsi + rcx*4]
mov edx, edi
and edx, 0xfffd
shr eax, 8
or edx, 2
xor al, r9b
movsx r9, byte [rsp + r15 + 0x61]
mov byte [rsp + r15 + 0x60], al
mov rax, r9
xor rax, r11
shr r11d, 8
movzx ecx, al
xor r11d, dword [rsi + rcx*4]
movzx eax, r11b
add eax, r8d
movsx r8, byte [rsp + r15 + 0x62]
imul r10d, eax, 0x8088405
movzx eax, dil
shr edi, 8
inc r10d
mov ecx, r10d
shr rcx, 0x18
xor rcx, rax
mov eax, edx
xor eax, 1
imul eax, edx
xor edi, dword [rsi + rcx*4]
mov edx, edi
and edx, 0xfffd
shr eax, 8
or edx, 2
xor al, r9b
mov byte [rsp + r15 + 0x61], al
mov rax, r8
xor rax, r11
shr r11d, 8
movzx ecx, al
xor r11d, dword [rsi + rcx*4]
movzx eax, r11b
add eax, r10d
movzx ecx, dil
imul r9d, eax, 0x8088405
mov r10d, edi
shr r10d, 8
inc r9d
mov eax, r9d
shr rax, 0x18
xor rcx, rax
mov eax, edx
xor eax, 1
imul eax, edx
xor r10d, dword [rsi + rcx*4]
mov edx, r10d
shr eax, 8
xor al, r8b
movsx r8, byte [rsp + r15 + 0x63]
mov byte [rsp + r15 + 0x62], al
and edx, 0xfffd
mov edi, r10d
or edx, 2
shr edi, 8
mov ecx, r11d
shr r11d, 8
xor rcx, r8
movzx eax, cl
movzx ecx, r10b
xor r11d, dword [rsi + rax*4]
movzx eax, r11b
add eax, r9d
imul r9d, eax, 0x8088405
inc r9d
mov eax, r9d
shr rax, 0x18
xor rcx, rax
mov eax, edx
xor eax, 1
imul eax, edx
xor edi, dword [rsi + rcx*4]
mov esi, r11d
mov edx, edi
lea r11, [0x1400f2cd0]
and edx, 0xfffd
mov ecx, esi
shr eax, 8
or edx, 2
xor al, r8b
shr esi, 8
movsx r8, byte [rsp + r15 + 0x64]
mov byte [rsp + r15 + 0x63], al
xor rcx, r8
movzx eax, cl
movzx ecx, dil
shr edi, 8
xor esi, dword [r11 + rax*4]
movzx eax, sil
add eax, r9d
imul r10d, eax, 0x8088405
inc r10d
mov eax, r10d
shr rax, 0x18
xor rcx, rax
mov eax, edx
xor eax, 1
imul eax, edx
mov edx, esi
lea rsi, [0x1400f2cd0]
xor edi, dword [r11 + rcx*4]
mov ecx, edx
movsx r11, byte [rsp + r15 + 0x65]
mov r9d, edi
shr edx, 8
xor rcx, r11
shr eax, 8
and r9d, 0xfffd
xor al, r8b
or r9d, 2
mov byte [rsp + r15 + 0x64], al
movzx eax, cl
movzx ecx, dil
xor edx, dword [rsi + rax*4]
movzx eax, dl
add eax, r10d
mov dword [rbx + 0x48], edx
imul eax, eax, 0x8088405
mov edx, edi
shr edx, 8
inc eax
mov dword [rbx + 0x4c], eax
shr rax, 0x18
xor rcx, rax
mov eax, r9d
xor eax, 1
imul eax, r9d
xor edx, dword [rsi + rcx*4]
mov dword [rbx + 0x50], edx
shr eax, 8
xor al, r11b
mov byte [rsp + r15 + 0x65], al
add r15, 6
cmp r15, 0xc
jl 0x14002e1e0
mov r8d, reloc.WSOCK32.dll_ioctlsocket
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.14002d3a0
mov eax, dword [rbx + 0x28]
test eax, eax
jne 0x14002e5b4
add qword [rbx + 0x18], 0xc
or dword [rbx], 0x10
movzx edi, byte [rsp + 0x40]
mov edx, dword [rbx]
mov rax, qword [rbx + 0x88]
test rax, rax
je 0x14002e55d
mov rcx, rbx
cmp dil, 8
jne 0x14002e487
mov rdx, r14
call fcn.14002d6f0
jmp 0x14002e521
test dl, dl
jns 0x14002e4c4
mov esi, dword [rbx + 0x90]
mov rdx, rax
mov r8d, esi
call fcn.14002d3a0
mov rdx, qword [rbx + 0x88]
mov r8d, esi
mov ecx, dword [rbx + 0x80]
add qword [rbx + 0x78], rsi
call fcn.14002d0f0
add qword [rbx + 0x98], rsi
mov dword [rbx + 0x80], eax
jmp 0x14002e513
mov r8d, 0x4000
lea rdx, [rbx + 0xb0]
call fcn.14002d5f0
mov esi, eax
test eax, eax
je 0x14002e513
nop dword [rax]
cmp dword [rbx + 0x28], 0
jne 0x14002e513
mov r8d, esi
lea rdx, [rbx + 0xb0]
mov rcx, rbx
call fcn.14002d3a0
mov r8d, 0x4000
lea rdx, [rbx + 0xb0]
mov rcx, rbx
call fcn.14002d5f0
mov esi, eax
test eax, eax
jne 0x14002e4e0
movzx edi, byte [rsp + 0x40]
mov eax, esi
add qword [rbx + 0xa0], rax
mov eax, dword [rbx + 0x28]
test eax, eax
jne 0x14002e5b4
and dword [rbx], 0xffffffef
mov edx, dword [rbx]
test dl, 0x40
je 0x14002e545
mov rcx, qword [rbx + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [rbx]
mov rax, qword [rbx + 0x78]
and edx, 0xffffffbf
mov qword [rbx + 0x70], rax
mov rax, qword [rbx + 0xa0]
add qword [rbx + 0x18], rax
mov dword [rbx], edx
test edx, edx
jns 0x14002e5c4
or edx, 8
cmp dword [rsp + 0x50], 0
mov dword [rbx], edx
jne 0x14002e776
mov edx, dword [rbx + 0x80]
mov rcx, rbx
call fcn.14002d210
movzx edx, word [rbx + 0x82]
mov rcx, rbx
call fcn.14002d210
mov edx, dword [rbx + 0x78]
mov rcx, rbx
call fcn.14002d210
mov rdx, qword [rbx + 0x78]
mov rcx, rbx
shr rdx, 0x10
call fcn.14002d210
mov eax, dword [rbx + 0x28]
test eax, eax
je 0x14002e776
mov edi, eax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x14002de1e
mov rdx, qword [rbx + 0xa0]
mov eax, dword [rbx + 0x80]
mov r8, qword [r14 + 0x10]
mov dword [r14 + 8], eax
mov ecx, r13d
add rdx, rcx
add rcx, qword [rbx + 0xa0]
mov qword [r14 + 0x10], rcx
mov rax, qword [rbx + 0x70]
mov qword [r14 + 0x18], rax
test byte [rbx], 4
je 0x14002e66f
test r13d, r13d
jne 0x14002e66f
movzx eax, dil
mov word [r12], ax
movzx eax, word [r14]
test al, 1
jne 0x14002e619
mov ecx, 0xfff7
and ax, cx
mov word [r14], ax
mov rdx, qword [r14 + 0x38]
mov rcx, rbx
mov word [r14 + 0x30], ax
sub rdx, qword [rbx + 0x20]
call fcn.14002d560
test eax, eax
je 0x14002e65c
mov rdx, rbx
mov rcx, r14
call fcn.14002c810
mov eax, dword [rbx + 0x28]
test eax, eax
jne 0x14002e5b4
mov rdx, qword [rbx + 0x18]
mov rcx, rbx
call fcn.14002d560
test eax, eax
jne 0x14002e73b
mov rcx, r14
mov edi, reloc.WSOCK32.dll_recv
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x14002de1e
movzx eax, dil
cmp word [r12], ax
jne 0x14002e77d
test dil, dil
jne 0x14002e68c
cmp r8, rdx
jne 0x14002e77d
mov edx, 0x8074b50
mov rcx, rbx
call fcn.14002d210
mov edx, 0x807
mov rcx, rbx
call fcn.14002d210
mov edx, dword [r14 + 8]
mov rcx, rbx
call fcn.14002d210
movzx edx, word [r14 + 0xa]
mov rcx, rbx
call fcn.14002d210
mov rax, qword [r14 + 0x10]
mov edi, 0xffffffff
mov rcx, rbx
cmp rax, rdi
jb 0x14002e6db
mov edx, edi
call fcn.14002d210
mov eax, edi
jmp 0x14002e6ea
mov edx, eax
call fcn.14002d210
mov rax, qword [r14 + 0x10]
shr rax, 0x10
mov edx, eax
mov rcx, rbx
call fcn.14002d210
mov rax, qword [r14 + 0x18]
mov rcx, rbx
cmp rax, rdi
jb 0x14002e709
mov edx, edi
call fcn.14002d210
jmp 0x14002e718
mov edx, eax
call fcn.14002d210
mov rdi, qword [r14 + 0x18]
shr rdi, 0x10
mov edx, edi
mov rcx, rbx
call fcn.14002d210
mov eax, dword [rbx + 0x28]
test eax, eax
jne 0x14002e5b4
add qword [rbx + 0x18], 0x10
movzx eax, word [r14 + 0x30]
mov word [r14], ax
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14002e74f
mov qword [rbx + 0x68], r14
xor eax, eax
jmp 0x14002de32
mov rax, qword [rcx + 0x158]
test rax, rax
je 0x14002e76f
nop dword [rax + rax]
mov rcx, rax
mov rax, qword [rax + 0x158]
test rax, rax
jne 0x14002e760
mov qword [rcx + 0x158], r14
xor eax, eax
jmp 0x14002de32
mov rcx, r14
mov edi, reloc.OLEAUT32.dll_SafeArrayGetElemsize
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x14002de1e