Function at 0x14000cba0
Capabilities:
Access peb ldr_data
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
mov rdi, rcx
test rdx, rdx
je 0x140005c0e
mov ecx, 4
mov rax, qword gs:[0x58]
mov r8, qword [rax]
mov eax, dword [rcx + r8]
cmp dword [0x1401e4ad0], eax
jle 0x140005bef
lea rcx, [0x1401e4ad0]
call fcn.1400cf7f0
cmp dword [0x1401e4ad0], 0xffffffff
jne 0x140005bef
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov r8d, reloc.WS2_32.dll_setsockopt
lea rdx, str.ExReleaseResourceLite
lea rcx, [rsp + 0x20]
call fcn.14000dc50
nop
lea r8, [rsp + 0x20]
mov rcx, rdi
call fcn.1400054c0
mov qword [0x1401e4a78], rax
lea rcx, [rsp + 0x20]
call fcn.14000b050
nop
lea rcx, [0x1401e4ad0]
call fcn.1400cf784
cmp qword [0x1401e4a78], 0
je 0x140005c0e
mov r9, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
jmp 0x14000cba0
xor al, al
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xb0
mov rax, qword [0x14012b240]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov qword [rbp - 0x31], r9
mov qword [rbp - 0x49], rcx
cmp qword [0x1401e4a78], 0
je 0x14000cfa3
xor r12d, r12d
mov r15d, 0x21c89ba6
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov rdi, qword [rax + 0x30]
test rdi, rdi
je 0x14000cde7
cmp word [rax + 0x48], 0
je 0x14000cde7
movups xmm0, xmmword [rax + 0x58]
movd ecx, xmm0
sub cx, 8
test r12d, r12d
je 0x14000cc83
psrldq xmm0, 8
movq r9, xmm0
movzx ecx, cx
shr rcx, 1
lea r11, [r9 + rcx*2]
mov r10d, 0x1fa2eb56
cmp r9, r11
je 0x14000cc7a
nop dword [rax + rax]
movsx ecx, byte [r9]
mov edx, ecx
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
add r9, 2
cmp r9, r11
jne 0x14000cc50
cmp r10d, r12d
jne 0x14000cde7
movsxd rcx, dword [rdi + 0x3c]
mov rdx, qword [rcx + rdi + 0x88]
mov r13, rdx
shr r13, 0x20
mov esi, edx
add rsi, rdi
cmp rsi, rdi
je 0x14000cde7
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x14000cde7
mov r8d, dword [rsi + 0x1c]
add r8, rdi
mov qword [rbp - 0x41], r8
mov ecx, dword [rsi + 0x24]
add rcx, rdi
mov qword [rbp - 0x39], rcx
mov r9d, dword [rsi + 0x20]
nop word [rax + rax]
dec r11d
movzx ecx, word [rcx + r11*2]
mov ebx, dword [r8 + rcx*4]
add rbx, rdi
lea rcx, [r9 + r11*4]
mov r9d, dword [rcx + rdi]
add r9, rdi
cmp rbx, rsi
jbe 0x14000ccfd
lea rcx, [rsi + r13]
cmp rbx, rcx
jae 0x14000ccfd
mov r14b, 1
jmp 0x14000cd00
xor r14b, r14b
mov r10d, 0x1fa2eb56
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x14000cd3d
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x14000cd12
cmp r10d, r15d
je 0x14000cd5f
test r11d, r11d
mov r8, qword [rbp - 0x41]
mov rcx, qword [rbp - 0x39]
mov r9d, dword [rsi + 0x20]
jne 0x14000ccd0
mov rax, qword [rax]
jmp 0x14000cc00
test r14b, r14b
je 0x14000cdef
mov r12d, 0x1fa2eb56
mov r15d, r12d
movzx edx, byte [rbx]
cmp dl, 0x2e
je 0x14000cda6
nop dword [rax]
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, r12d
imul r12d, ecx, 0x1000193
inc rbx
movzx edx, byte [rbx]
cmp dl, 0x2e
jne 0x14000cd80
inc rbx
movzx edx, byte [rbx]
test dl, dl
je 0x14000cdd6
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, r15d
imul r15d, ecx, 0x1000193
lea rbx, [rbx + 1]
movzx edx, byte [rbx]
test dl, dl
jne 0x14000cdb0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rax, qword [rax]
jmp 0x14000cc00
test rbx, rbx
je 0x14000cfa3
mov word [rbp - 9], 0xb848
mov word [rbp + 1], 0xe0ff
mov rax, qword [0x1401e4a78]
mov qword [rbp - 7], rax
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1401e4a98], eax
jle 0x14000cf27
lea rcx, [0x1401e4a98]
call fcn.1400cf7f0
cmp dword [0x1401e4a98], 0xffffffff
jne 0x14000cf27
mov dword [rbp - 0x69], 0x274b315e
mov dword [rbp - 0x65], 0x242a4824
mov word [rbp - 0x61], 0x9521
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x5f], xmm0
mov dword [rbp - 0x4f], eax
mov byte [rbp - 0x4b], al
movabs r11, 0x25b1c5722fc0df6a
mov r9, r11
lea rax, [rbp - 0x69]
sub r9, rax
xor r10d, r10d
nop dword [rax]
nop word [rax + rax]
lea r8, [rbp - 0x69]
add r8, r10
movzx edx, byte [r8]
lea rax, [r8 + r9]
and rax, rdx
imul rcx, rax, 0xfffffffffffffffe
add rcx, rdx
add rcx, r11
add rcx, r10
add cl, 0x1a
mov byte [r8], cl
inc r10
cmp r10, 0x1f
jb 0x14000ce90
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x19], xmm1
lea rax, [rbp - 0x69]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14000cee0
lea rdx, [rbp - 0x69]
lea rcx, [rbp - 0x29]
call fcn.14000dc50
nop
lea r8, [rbp - 0x29]
mov rdi, qword [rbp - 0x49]
mov rcx, rdi
call fcn.1400054c0
mov qword [0x1401e4ac0], rax
lea rcx, [rbp - 0x29]
call fcn.14000b050
nop
lea rcx, [0x1401e4a98]
call fcn.1400cf784
jmp 0x14000cf2b
mov rdi, qword [rbp - 0x49]
mov r8, qword [0x1401e4ac0]
test r8, r8
je 0x14000cfa3
mov r9d, recvfrom
lea rdx, [rbp + 7]
mov rcx, rdi
call fcn.140004970
test al, al
je 0x14000cfa3
movzx eax, byte [rbp - 9]
cmp byte [rbp + 7], al
jne 0x14000cf71
movzx eax, byte [rbp - 8]
cmp byte [rbp + 8], al
jne 0x14000cf71
movzx eax, byte [rbp + 1]
cmp byte [rbp + 0x11], al
jne 0x14000cf71
movzx eax, byte [rbp + 2]
cmp byte [rbp + 0x12], al
je 0x14000cfa3
lea r8, [rbp - 9]
mov rdx, qword [0x1401e4ac0]
mov rcx, rdi
call fcn.140004a20
test al, al
je 0x14000cfa3
mov rcx, qword [rbp - 0x31]
call rbx
lea r8, [rbp + 7]
mov rdx, qword [0x1401e4ac0]
mov rcx, rdi
call fcn.140004a20
jmp 0x14000cfa5
xor al, al
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.1400cf720
mov rbx, qword [rsp + 0xf8]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret