Function at 0x1400d9500
Capabilities:
Access peb ldr_data
Get ntdll base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
movaps xmmword [rbp - 0x10], xmm6
mov eax, dword [0x1406cdd48]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x1406cdd4c], 0xa
setl dl
or dl, al
nop word [rax + rax]
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.1401f8850
sub rsp, rax
mov rbx, rsp
test dl, dl
je 0x1400d9540
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.1401f8850
sub rsp, rax
mov rsi, rsp
mov eax, dword [0x1406d3df0]
mov edi, dword [0x1406d3df4]
lea r9d, [rax - 1]
imul r9d, eax
cmp edi, 0xa
jl 0x1400d9592
mov eax, r9d
and eax, 1
je 0x1400d9592
nop word cs:[rax + rax]
nop
jmp 0x1400d9590
mov eax, dword [0x1406d3d98]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete dl
cmp dword [0x1406d3d9c], 0xa
setl al
or al, dl
cmp al, 1
jne 0x1400d95c1
mov rdx, qword gs:[0x60]
test al, al
jne 0x1400d95cc
mov rdx, qword gs:[0x60]
jmp 0x1400d95b4
mov rax, qword [rdx + 0x18]
mov r8, qword [rax + 0x10]
cmp dword [0x1406d3da0], 0xa
jl 0x1400d95f2
mov eax, dword [0x1406d3da4]
lea edx, [rax - 1]
imul edx, eax
and edx, 1
je 0x1400d95f2
nop
jmp 0x1400d95f0
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x60], rcx
mov eax, dword [0x1406d3da8]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete dl
cmp dword [0x1406d3dac], 0xa
setl r12b
cmp edi, 0xa
setge cl
mov eax, dword [0x1406d3db0]
lea edi, [rax - 1]
imul edi, eax
test dil, 1
sete al
cmp dword [0x1406d3db4], 0xa
setl byte [rbp - 0x11]
cmp dword [0x1406d3db8], 0xa
jl 0x1400d9662
mov edi, dword [0x1406d3dbc]
lea esi, [rdi - 1]
imul esi, edi
and esi, 1
je 0x1400d9662
nop word cs:[rax + rax]
nop
jmp 0x1400d9660
or r12b, dl
and r9b, cl
or byte [rbp - 0x11], al
mov rdx, qword [r8 + 0x30]
xor eax, eax
mov qword [rbp - 0x38], rax
mov rax, r8
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x40], r8
mov dword [rbp - 0x28], r9d
movsxd rcx, dword [rdx + 0x3c]
mov esi, dword [rcx + rdx + 0x88]
test rsi, rsi
je 0x1400d985b
mov qword [rbp - 0x48], rax
mov ecx, dword [rdx + rsi + 0x18]
mov r10, rcx
mov rax, rdx
jmp 0x1400d96ca
mov ebx, 0x811c9dc5
mov rcx, r10
cmp ebx, 0xb8e4e945
mov rdx, rax
mov rsi, r13
je 0x1400d9895
sub r10, 1
jb 0x1400d9846
mov r8d, ecx
add r8d, 0xffffffff
mov r13, rsi
mov ecx, dword [rdx + rsi + 0x20]
add rcx, rdx
mov r15d, dword [rcx + r8*4]
mov cl, byte [rdx + r15]
test cl, cl
je 0x1400d96b0
add r15, rdx
mov ebx, 0x811c9dc5
jmp 0x1400d9802
mov ecx, ebx
and ecx, 0x7ab683ed
or ecx, 0x1410812
mov esi, ebx
and esi, 0x85497c12
xor esi, ecx
mov ecx, esi
xor ecx, 0x50af90c3
xor esi, 0xfebef7ed
and esi, ecx
mov r11d, ebx
and r11d, 0xae11672e
mov r9d, edx
and r9d, 0xae11672e
mov ecx, esi
not ecx
mov r14d, r11d
not r14d
and ecx, r14d
and r14d, 0x6400fcd7
xor ebx, 0x24006406
and ebx, r11d
or ebx, r14d
xor ebx, esi
xor ebx, 0x6400fcd7
xor r11d, esi
or r11d, ecx
not r11d
or r11d, ebx
mov ecx, edx
xor ecx, 0xac106400
and ecx, r9d
mov esi, edx
and esi, 0x12c8050
mov ebx, edx
and ebx, 0x50c21881
lea edi, [rbx + 0x9148106]
xor edi, esi
xor ebx, 0xfdd6fc81
mov esi, edx
and esi, 0xac106400
or esi, 0x52831b03
xor esi, ecx
mov ecx, esi
xor ecx, 0x53af9b53
xor edi, 0xa390278
and edi, ecx
or esi, 0x400080
and esi, ebx
or esi, edi
mov ecx, edx
and ecx, 0x51ee98d1
or ecx, 0x2e016708
xor ecx, r9d
xor ecx, 0x7fefffd9
xor edx, 0xae11672e
or edx, ecx
mov ecx, edx
xor ecx, esi
not ecx
not edx
and edx, esi
or edx, ecx
xor edx, r11d
imul ebx, edx, 0x1000193
mov cl, byte [r15]
test cl, cl
je 0x1400d96b5
add r15, 1
movsx edx, cl
add cl, 0xbf
cmp cl, 0x19
ja 0x1400d9700
nop word cs:[rax + rax]
nop
test r12b, r12b
je 0x1400d9820
mov ecx, edx
and ecx, 0xebcba6fa
and edx, 0x14345925
or edx, 0xab402048
xor edx, ecx
xor edx, 0xab402068
jmp 0x1400d9700
mov r9d, dword [rbp - 0x28]
test r9b, r9b
mov rbx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x40]
mov rax, qword [rbp - 0x48]
jne 0x1400d98a0
cmp byte [rbp - 0x11], 0
je 0x1400d9890
nop word cs:[rax + rax]
nop dword [rax + rax]
mov rax, qword [rax]
cmp byte [rbp - 0x11], 0
je 0x1400d9890
cmp rax, r8
je 0x1400d98c2
mov rdx, qword [rax + 0x30]
test rdx, rdx
jne 0x1400d9684
jmp 0x1400d98c2
mov rax, qword [rax]
jmp 0x1400d9870
cmp byte [rbp - 0x28], 0
mov rbx, qword [rbp - 0x30]
je 0x1400d98a2
nop
jmp 0x1400d98a0
mov ecx, dword [rdx + rsi + 0x1c]
mov rdi, rdx
mov edx, dword [rdx + rsi + 0x24]
add rcx, rdi
add rdx, rdi
movzx edx, word [rdx + r8*2]
mov eax, dword [rcx + rdx*4]
add rax, rdi
mov qword [rbp - 0x38], rax
mov rcx, qword [0x140263807]
mov qword [rbx + 0xf], rcx
movups xmm0, xmmword [0x1402637f8]
movups xmmword [rbx], xmm0
mov ecx, dword [0x1406cdd60]
lea edx, [rcx - 1]
imul edx, ecx
test dl, 1
sete dl
cmp dword [0x1406cdd64], 0xa
setl cl
or cl, dl
nop word cs:[rax + rax]
nop
test cl, cl
je 0x1400d9900
mov ecx, dword [0x1406d3e00]
lea edx, [rcx - 1]
imul edx, ecx
test dl, 1
sete cl
cmp dword [0x1406d3e04], 0xa
setl r8b
or r8b, cl
mov cl, 0x77
mov r9d, 0x1fffffc6
xor r11d, r11d
mov rax, qword [rbp - 0x30]
nop word cs:[rax + rax]
nop dword [rax]
movzx edi, cl
mov ecx, edi
and ecx, 0x20
mov r10d, ecx
xor r10d, 0x9490120
lea esi, [r11 + 0x39]
mov edx, esi
and edx, 0xed495529
mov ebx, r9d
and ebx, 0x12b6aad6
or ebx, edx
mov edx, ebx
xor edx, 9
xor ebx, 0xd6
or ebx, edx
mov edx, r9d
and edx, 0x12ed50a3
and esi, 0xe410a65c
or esi, edx
mov edx, r9d
and edx, 0x20
xor esi, 0x7c
or esi, edx
and esi, ebx
mov edx, edi
or edx, 0xf634f6df
or ecx, 0x4214f65f
and ecx, edx
lea edx, [rdi + 0x9490100]
and edx, r10d
or edx, ecx
mov ecx, edi
or ecx, 0x20
not edx
and edx, ecx
and edi, 0x5f
or edi, edx
xor edi, esi
not dil
test r8b, r8b
jne 0x1400d99f0
jmp 0x1400d99f9
cmp r11, 0x16
je 0x1400d99ff
movzx ecx, byte [rax + r11 + 1]
add r9d, 0xffffffff
add r11, 1
jmp 0x1400d9940
mov byte [rax + r11], dil
test r8b, r8b
jne 0x1400d99d0
mov byte [rax + r11], dil
jmp 0x1400d99f0
mov ecx, dword [0x1406cdd68]
lea edx, [rcx - 1]
imul edx, ecx
test dl, 1
sete cl
cmp dword [0x1406cdd6c], 0xa
setl al
or al, cl
mov byte [rbp - 0x12], al
mov eax, dword [0x1406d3e10]
mov qword [rbp - 0x50], rax
mov eax, dword [0x1406d3e14]
mov dword [rbp - 0x18], eax
jne 0x1400d9c75
mov rax, qword [rbp - 0x50]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
mov dword [rbp - 0x1c], ecx
cmp dword [rbp - 0x1c], 0
sete dl
cmp dword [rbp - 0x18], 0xa
setl cl
or cl, dl
nop dword [rax]
test cl, cl
je 0x1400d9a60
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov r14, qword [rcx + 0x10]
mov r11, qword [r14 + 0x30]
mov qword [rbp - 0x28], r14
movsxd rcx, dword [r11 + 0x3c]
mov r10d, dword [rcx + r11 + 0x88]
test r10, r10
je 0x1400d9c30
mov ecx, dword [r11 + r10 + 0x18]
mov r8, rcx
jmp 0x1400d9ab4
mov edx, 0x811c9dc5
mov rcx, r8
cmp edx, 0xab288e66
je 0x1400d9c75
sub r8, 1
jb 0x1400d9c30
add ecx, 0xffffffff
mov edx, dword [r11 + r10 + 0x20]
add rdx, r11
mov r15d, dword [rdx + rcx*4]
mov cl, byte [r11 + r15]
test cl, cl
je 0x1400d9aa0
add r15, r11
mov edx, 0x811c9dc5
jmp 0x1400d9be5
mov ecx, edx
and ecx, 0x7ab683ed
or ecx, 0x1410812
mov esi, edx
and esi, 0x85497c12
xor esi, ecx
mov ecx, esi
xor ecx, 0x50af90c3
xor esi, 0xfebef7ed
and esi, ecx
mov edi, edx
and edi, 0xae11672e
mov r13d, ebx
and r13d, 0xae11672e
mov eax, esi
not eax
mov ecx, edi
not ecx
and eax, ecx
and ecx, 0x6400fcd7
xor edx, 0x24006406
and edx, edi
or edx, ecx
xor edx, esi
xor edx, 0x6400fcd7
xor edi, esi
or edi, eax
not edi
or edi, edx
mov eax, ebx
xor eax, 0xac106400
and eax, r13d
mov ecx, ebx
and ecx, 0x12c8050
mov esi, ebx
and esi, 0x50c21881
lea r9d, [rsi + 0x9148106]
xor r9d, ecx
xor esi, 0xfdd6fc81
mov edx, ebx
and edx, 0xac106400
or edx, 0x52831b03
xor edx, eax
mov eax, edx
xor eax, 0x53af9b53
xor r9d, 0xa390278
and r9d, eax
or edx, 0x400080
and edx, esi
or edx, r9d
mov eax, ebx
and eax, 0x51ee98d1
or eax, 0x2e016708
xor eax, r13d
xor eax, 0x7fefffd9
xor ebx, 0xae11672e
or ebx, eax
mov eax, ebx
xor eax, edx
not eax
not ebx
and ebx, edx
or ebx, eax
xor ebx, edi
imul edx, ebx, 0x1000193
mov cl, byte [r15]
test cl, cl
je 0x1400d9aa5
add r15, 1
movsx ebx, cl
add cl, 0xbf
cmp cl, 0x19
ja 0x1400d9af0
nop dword [rax + rax]
test r12b, r12b
je 0x1400d9c00
mov ecx, ebx
and ecx, 0xebcba6fa
and ebx, 0x14345925
or ebx, 0xab402048
xor ebx, ecx
xor ebx, 0xab402068
jmp 0x1400d9af0
cmp byte [rbp - 0x11], 0
je 0x1400d9c60
nop word cs:[rax + rax]
mov r14, qword [r14]
cmp byte [rbp - 0x11], 0
je 0x1400d9c60
cmp r14, qword [rbp - 0x28]
je 0x1400d9c65
mov r11, qword [r14 + 0x30]
test r11, r11
jne 0x1400d9a7d
jmp 0x1400d9c65
mov r14, qword [r14]
jmp 0x1400d9c40
cmp dword [rbp - 0x1c], 0
je 0x1400d9c75
cmp dword [rbp - 0x18], 0xa
jge 0x1400d9ef0
mov rax, qword [rbp - 0x50]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
mov dword [rbp - 0x1c], ecx
sete dl
cmp dword [rbp - 0x18], 0xa
setl cl
or cl, dl
nop word cs:[rax + rax]
nop dword [rax + rax]
test cl, cl
je 0x1400d9ca0
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
mov rax, qword [rcx + 0x30]
mov qword [rbp - 0x40], rcx
mov qword [rbp - 0x48], rcx
movsxd rbx, dword [rax + 0x3c]
mov edx, dword [rbx + rax + 0x88]
mov rcx, rdx
mov qword [rbp - 0x28], rdx
test rdx, rdx
je 0x1400d9ea0
mov rcx, qword [rbp - 0x28]
mov ebx, dword [rax + rcx + 0x18]
mov r15, rbx
jmp 0x1400d9d06
mov r10d, 0x811c9dc5
mov rbx, r15
cmp r10d, 0xab288e66
je 0x1400d9ef2
sub r15, 1
jb 0x1400d9ea0
mov r14d, ebx
add r14d, 0xffffffff
mov rcx, qword [rbp - 0x28]
mov ebx, dword [rax + rcx + 0x20]
add rbx, rax
mov edi, dword [rbx + r14*4]
mov bl, byte [rax + rdi]
test bl, bl
je 0x1400d9cf0
add rdi, rax
mov r10d, 0x811c9dc5
jmp 0x1400d9e52
mov edx, r10d
and edx, 0x7ab683ed
or edx, 0x1410812
mov ebx, r10d
and ebx, 0x85497c12
xor ebx, edx
mov edx, ebx
xor edx, 0x50af90c3
xor ebx, 0xfebef7ed
and ebx, edx
mov r13d, r10d
and r13d, 0xae11672e
mov r8d, r9d
and r8d, 0xae11672e
mov edx, ebx
not edx
mov r11d, r13d
not r11d
and edx, r11d
and r11d, 0x6400fcd7
xor r10d, 0x24006406
and r10d, r13d
or r10d, r11d
xor r10d, ebx
xor r10d, 0x6400fcd7
xor r13d, ebx
or r13d, edx
not r13d
or r13d, r10d
mov edx, r9d
xor edx, 0xac106400
and edx, r8d
mov ebx, r9d
and ebx, 0x12c8050
mov esi, r9d
and esi, 0x50c21881
lea ecx, [rsi + 0x9148106]
xor ecx, ebx
xor esi, 0xfdd6fc81
mov ebx, r9d
and ebx, 0xac106400
or ebx, 0x52831b03
xor ebx, edx
mov edx, ebx
xor edx, 0x53af9b53
xor ecx, 0xa390278
and ecx, edx
or ebx, 0x400080
and ebx, esi
or ebx, ecx
mov ecx, r9d
and ecx, 0x51ee98d1
or ecx, 0x2e016708
xor ecx, r8d
xor ecx, 0x7fefffd9
xor r9d, 0xae11672e
or r9d, ecx
mov ecx, r9d
xor ecx, ebx
not ecx
not r9d
and r9d, ebx
or r9d, ecx
xor r9d, r13d
imul r10d, r9d, 0x1000193
mov bl, byte [rdi]
test bl, bl
je 0x1400d9cf6
add rdi, 1
movsx r9d, bl
add bl, 0xbf
cmp bl, 0x19
ja 0x1400d9d40
nop word cs:[rax + rax]
test r12b, r12b
je 0x1400d9e70
mov ebx, r9d
and ebx, 0xebcba6fa
and r9d, 0x14345925
or r9d, 0xab402048
xor r9d, ebx
xor r9d, 0xab402068
jmp 0x1400d9d40
cmp byte [rbp - 0x11], 0
mov rcx, qword [rbp - 0x48]
je 0x1400d9ee0
nop word [rax + rax]
mov rcx, qword [rcx]
cmp byte [rbp - 0x11], 0
je 0x1400d9ee0
cmp rcx, qword [rbp - 0x40]
je 0x1400da1c4
mov rax, qword [rcx + 0x30]
test rax, rax
jne 0x1400d9cbd
jmp 0x1400da1c4
mov rcx, qword [rcx]
jmp 0x1400d9eb0
jmp 0x1400d9ef0
mov rdx, qword [rbp - 0x28]
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r14*2]
mov r15d, dword [rcx + rdx*4]
add r15, rax
cmp byte [rbp - 0x12], 0
je 0x1400d9a49
mov r14d, dword [0x140263820]
movups xmm6, xmmword [str.WN_PQ]
mov r12, qword [rbp - 0x58]
jmp 0x1400d9f48
sub rsp, 0x20
mov rcx, r12
call r15
mov rcx, rax
mov rdx, qword [rbp - 0x30]
call qword [rbp - 0x38]
add rsp, 0x20
mov eax, dword [0x1406ce3f0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete cl
cmp dword [0x1406ce3f4], 0xa
setl al
setge dl
xor dl, cl
xor dl, 1
and al, cl
or al, dl
test al, al
je 0x1400d9f70
mov dword [r12 + 0x10], r14d
movups xmmword [r12], xmm6
mov cx, 0x57
mov r9d, 1
mov r8d, 0xffc6
nop
movzx ebx, cx
mov ecx, ebx
and ecx, 0xe4b9
or ecx, 0x1102
mov eax, ebx
and eax, 0x1b46
xor eax, ecx
xor eax, 0xffffeefd
lea esi, [r9 + 0x38]
and eax, esi
mov ecx, r8d
and ecx, 0xcbb1
and esi, 0x344e
or esi, ecx
xor esi, ebx
xor esi, 0xcbb1
and esi, ebx
mov ebx, eax
not ebx
mov edi, esi
not edi
mov ecx, eax
and ecx, 0x800053
and edi, ebx
and ebx, 0x4c2a2c08
add ecx, ebx
add ecx, 0x2454220
mov edx, eax
and edx, 0xb355d3a4
xor edx, ecx
mov ecx, edx
xor ecx, 0x2454273
mov ebx, esi
and ebx, 0x2c5b
or ebx, 0x20509120
xor eax, esi
and esi, 0xd3a4
xor esi, ebx
mov ebx, esi
xor ebx, 0x6cfabd7b
xor edx, 0x4c2abd8c
and edx, ebx
xor esi, 0x93054284
and esi, ecx
or esi, edx
or edi, eax
mov eax, edi
xor eax, esi
not eax
not edi
and edi, esi
or edi, eax
mov word [r12 + r9*2 - 2], di
cmp r9, 0xa
je 0x1400da060
movzx ecx, word [r12 + r9*2]
add r9, 1
add r8d, 0xffffffff
jmp 0x1400d9f90
sub rsp, 0x20
mov rcx, r12
call r15
mov rcx, rax
mov rdx, qword [rbp - 0x30]
call qword [rbp - 0x38]
add rsp, 0x20
mov rsi, rax
cmp dword [0x1406cdd4c], 0xa
jl 0x1400da1e2
mov eax, dword [0x1406cdd48]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x1400da1e2
mov eax, dword [0x1406ce3f0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete cl
cmp dword [0x1406ce3f4], 0xa
setl al
setge dl
xor dl, cl
xor dl, 1
and al, cl
or al, dl
nop word cs:[rax + rax]
nop
test al, al
je 0x1400da0d0
mov dword [r12 + 0x10], r14d
movups xmmword [r12], xmm6
mov cx, 0x57
mov r9d, 1
mov r8d, 0xffc6
nop
movzx ebx, cx
mov ecx, ebx
and ecx, 0xe4b9
or ecx, 0x1102
mov eax, ebx
and eax, 0x1b46
xor eax, ecx
xor eax, 0xffffeefd
lea esi, [r9 + 0x38]
and eax, esi
mov ecx, r8d
and ecx, 0xcbb1
and esi, 0x344e
or esi, ecx
xor esi, ebx
xor esi, 0xcbb1
and esi, ebx
mov ebx, eax
not ebx
mov edi, esi
not edi
mov ecx, eax
and ecx, 0x800053
and edi, ebx
and ebx, 0x4c2a2c08
add ecx, ebx
add ecx, 0x2454220
mov edx, eax
and edx, 0xb355d3a4
xor edx, ecx
mov ecx, edx
xor ecx, 0x2454273
mov ebx, esi
and ebx, 0x2c5b
or ebx, 0x20509120
xor eax, esi
and esi, 0xd3a4
xor esi, ebx
mov ebx, esi
xor ebx, 0x6cfabd7b
xor edx, 0x4c2abd8c
and edx, ebx
xor esi, 0x93054284
and esi, ecx
or esi, edx
or edi, eax
mov eax, edi
xor eax, esi
not eax
not edi
and edi, esi
or edi, eax
mov word [r12 + r9*2 - 2], di
cmp r9, 0xa
je 0x1400d9f30
movzx ecx, word [r12 + r9*2]
add r9, 1
add r8d, 0xffffffff
jmp 0x1400da0f0
xor r15d, r15d
cmp dword [rbp - 0x1c], 0
je 0x1400d9f10
cmp dword [rbp - 0x18], 0xa
jl 0x1400d9f10
nop dword [rax + rax]
jmp 0x1400da1e0
test rsi, rsi
mov rdi, qword [rbp - 0x60]
je 0x1400da252
sub rsp, 0x20
nop
mov rcx, rdi
mov edx, reloc.WS2_32.dll_recvfrom
xor r8d, r8d
xor r9d, r9d
call rsi
add rsp, 0x20
mov ecx, dword [0x1406cdd48]
lea ebx, [rcx - 1]
imul ebx, ecx
and ebx, 1
sete cl
cmp dword [0x1406cdd4c], 0xa
setl dl
jl 0x1400da23c
test ebx, ebx
je 0x1400da23c
sub rsp, 0x20
mov rcx, rdi
mov edx, reloc.WS2_32.dll_recvfrom
xor r8d, r8d
xor r9d, r9d
call rsi
jmp 0x1400da1f0
test eax, eax
sete al
je 0x1400da254
test dl, dl
jne 0x1400da254
test cl, cl
jne 0x1400da254
nop dword [rax + rax]
jmp 0x1400da250
xor eax, eax
movaps xmm6, xmmword [rbp - 0x10]
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret