Function at 0x140007be0
Capabilities:
Access peb ldr_data
Encode data using xor
Get token membership
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x128]
sub rsp, 0x200
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
mov rax, qword [0x1400d0780]
xor rax, rsp
mov qword [rbp + 0xb8], rax
xor ecx, ecx
mov qword [rbp + 0xa0], rcx
mov dword [rbp + 0xa8], ecx
mov word [rbp + 0xac], 0x500
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], ecx
mov dword [rsp + 0x40], ecx
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], ecx
mov r9d, 0x220
mov r8d, 0x20
mov dl, 2
lea rcx, [rbp + 0xa8]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x140008e68
lea r8, [rbp + 0xb0]
mov rdx, qword [rbp + 0xa0]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x140008e44
cmp dword [rbp + 0xb0], 0
jne 0x140007daa
movdqa xmm0, xmmword [0x1400c2da0]
mov dword [rbp - 0x50], 0xd9860fac
mov dword [rbp - 0x4c], 0xed2910fa
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
mov ecx, 0x6ec
mov eax, dword [rcx + rdi]
mov ebx, 0x720
add rbx, rdi
test al, 1
jne 0x140007d3a
or eax, 1
mov dword [rcx + rdi], eax
mov byte [rbx + 0x19], 1
lea rax, [rbx + 0x18]
lea rcx, [rbp - 0x48]
cmp rbx, rcx
ja 0x140007d1c
lea rcx, [rbp - 0x60]
cmp rax, rcx
jb 0x140007d1c
movups xmmword [rbx], xmm0
movsd xmm0, qword [rbp - 0x50]
movsd qword [rbx + 0x10], xmm0
mov byte [rbx + 0x18], 0xdf
jmp 0x140007d2d
movups xmmword [rbx], xmm0
movsd xmm0, qword [rbp - 0x50]
movsd qword [rbx + 0x10], xmm0
mov byte [rbx + 0x18], 0xdf
lea rcx, [0x1400a1e00]
call fcn.14006f1a0
nop
cmp byte [rbx + 0x19], 0
je 0x140007d5b
mov edx, 0x19
movabs r8, 0xc3477997bde72fdf
mov rcx, rbx
call fcn.1400033f0
mov byte [rbx + 0x19], 0
mov ecx, 0x7b0
mov eax, dword [rcx + rdi]
mov edx, 0x410
test al, 1
jne 0x140007d89
or eax, 1
mov dword [rcx + rdi], eax
add rdi, rdx
mov word [rdi], 0x1df
lea rcx, [0x1400a1e30]
call fcn.14006f1a0
nop
jmp 0x140007d8c
add rdi, rdx
cmp byte [rdi + 1], 0
je 0x140007d99
xor byte [rdi], 0xdf
mov byte [rdi + 1], 0
xor r9d, r9d
mov r8, rbx
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
movdqa xmm0, xmmword [0x1400c2d40]
mov dword [rbp - 0x70], 0x82015779
mov dword [rbp - 0x6c], 0x60f66cdb
mov word [rbp - 0x68], 0x4f7b
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
mov ecx, 0x70c
mov eax, dword [rcx + rdi]
mov ebx, 0x320
test al, 1
jne 0x140007e48
or eax, 1
mov dword [rcx + rdi], eax
lea rcx, [rdi + rbx]
mov byte [rcx + 0x1b], 1
lea rax, [rcx + 0x1a]
lea rdx, [rbp - 0x66]
cmp rcx, rdx
ja 0x140007e22
lea rdx, [rbp - 0x80]
cmp rax, rdx
jb 0x140007e22
movups xmmword [rcx], xmm0
movsd xmm0, qword [rbp - 0x70]
movsd qword [rcx + 0x10], xmm0
movzx eax, word [rbp - 0x68]
mov word [rcx + 0x18], ax
mov byte [rcx + 0x1a], WSASetLastError
jmp 0x140007e3b
movups xmmword [rcx], xmm0
movsd xmm0, qword [rbp - 0x70]
movsd qword [rcx + 0x10], xmm0
movzx eax, word [rbp - 0x68]
mov word [rcx + 0x18], ax
mov byte [rcx + 0x1a], WSASetLastError
lea rcx, [0x1400a1dd0]
call fcn.14006f1a0
nop
add rdi, rbx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140007ed4
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140007ed4
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r11 + r9*4]
mov r8d, dword [rdx + r10]
add r8, r10
mov edx, 0xb04a9ee5
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x140007ecf
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x140007eb0
cmp edx, 0x2ae77dbc
je 0x140007ed9
test r9d, r9d
jne 0x140007e90
mov rax, qword [rax]
jmp 0x140007e60
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov ebx, dword [rdx + rcx*4]
add rbx, r10
cmp byte [rdi + 0x1b], 0
je 0x140007f11
mov edx, 0x1b
movabs r8, 0x5d8509b5eb6d7749
mov rcx, rdi
call fcn.1400033f0
mov byte [rdi + 0x1b], 0
mov rcx, rdi
call rbx
lea rdx, [0x1400d3880]
cmp qword [0x1400d3898], 0xf
cmova rdx, qword [0x1400d3880]
mov r8, qword [0x1400d3890]
lea rcx, [0x1400d1e30]
call fcn.14000ca80
mov rsi, rax
mov rcx, qword gs:[0x58]
mov rbx, qword [rcx]
mov eax, 0x434
mov ecx, dword [rax + rbx]
mov edi, 0x1d8
test cl, 1
jne 0x140007f82
or ecx, 1
mov dword [rax + rbx], ecx
mov dword [rbx + rdi + 2], 0x121dba9
mov word [rbx + rdi], 0x3b77
lea rcx, [0x1400a1db0]
call fcn.14006f1a0
nop
lea rdx, [rbx + rdi]
cmp byte [rdx + 5], 0
je 0x140007fa3
xor byte [rdx], 0x7d
xor byte [rdx + 1], 0x31
xor byte [rdx + 2], 0xa3
xor byte [rdx + 3], 0xd1
xor byte [rdx + 4], 0x21
mov byte [rdx + 5], 0
mov rcx, rsi
call fcn.14000bcc0
movdqa xmm0, xmmword [0x1400c2ab0]
mov dword [rbp - 0x30], 0x8715f633
mov ecx, 0x3d4
mov eax, dword [rcx + rbx]
mov edi, 0x148
test al, 1
jne 0x140008010
or eax, 1
mov dword [rcx + rbx], eax
lea rcx, [rbx + rdi]
mov byte [rcx + 0x14], 1
lea rax, [rcx + 0x13]
lea rdx, [rbp - 0x2d]
cmp rcx, rdx
ja 0x140007ffa
lea rdx, [rbp - 0x40]
cmp rax, rdx
jb 0x140007ffa
movups xmmword [rcx], xmm0
mov eax, dword [rbp - 0x30]
mov dword [rcx + 0x10], eax
jmp 0x140008003
movups xmmword [rcx], xmm0
mov eax, dword [rbp - 0x30]
mov dword [rcx + 0x10], eax
lea rcx, [0x1400a1d90]
call fcn.14006f1a0
nop
mov rax, qword gs:[0x58]
mov rsi, qword [rax]
lea rbx, [rsi + rdi]
cmp byte [rbx + 0x14], 0
je 0x140008041
mov edx, reloc.WS2_32.dll_sendto
movabs r8, 0x57e3df4d871fab4b
mov rcx, rbx
call fcn.1400033f0
mov byte [rbx + 0x14], 0
mov rdx, rbx
lea rcx, [0x1400d1e30]
call fcn.14000bcc0
mov rcx, rax
call fcn.14000bf70
movdqa xmm0, xmmword [0x1400c2bd0]
mov word [rbp + 0x18], 0x22d3
mov ecx, 0x420
mov eax, dword [rcx + rsi]
mov ebx, 0x188
test al, 1
jne 0x1400080c8
or eax, 1
mov dword [rcx + rsi], eax
lea rcx, [rsi + rbx]
mov byte [rcx + 0x13], 1
lea rax, [rcx + 0x12]
lea rdx, [rbp + 0x1a]
cmp rcx, rdx
ja 0x1400080ac
lea rdx, [rbp + 8]
cmp rax, rdx
jb 0x1400080ac
movups xmmword [rcx], xmm0
movzx eax, word [rbp + 0x18]
mov word [rcx + 0x10], ax
mov byte [rcx + 0x12], 0x1b
jmp 0x1400080bb
movups xmmword [rcx], xmm0
movzx eax, word [rbp + 0x18]
mov word [rcx + 0x10], ax
mov byte [rcx + 0x12], 0x1b
lea rcx, [0x1400a1d60]
call fcn.14006f1a0
nop
add rbx, rsi
cmp byte [rbx + 0x13], 0
je 0x1400080ec
mov edx, reloc.WS2_32.dll_send
movabs r8, 0x65039371591b7ff3
mov rcx, rbx
call fcn.1400033f0
mov byte [rbx + 0x13], 0
mov rdx, rbx
lea rcx, [0x1400d1e30]
call fcn.14000bcc0
mov rcx, rax
call fcn.14000bf70
mov r14d, 1
mov esi, r14d
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov qword [rsp + 0x70], rcx
mov eax, 0x31c
add rax, rcx
mov qword [rbp + 0x50], rax
mov eax, 0x370
add rax, rcx
mov qword [rbp + 0x58], rax
mov eax, 0x4f8
add rax, rcx
mov qword [rbp + 0x60], rax
mov r12d, 0x168
add r12, rcx
mov r15d, 0x250
add r15, rcx
mov eax, 0x2f4
add rax, rcx
mov qword [rbp + 0x68], rax
mov eax, 0x208
add rax, rcx
mov qword [rbp + 0x70], rax
mov eax, 0x1d4
add rax, rcx
mov qword [rbp + 0x78], rax
mov eax, 0x440
add rax, rcx
mov qword [rsp + 0x78], rax
mov r13d, 0x1e8
add r13, rcx
movdqa xmm9, xmmword [0x1400c2d70]
movdqa xmm7, xmmword [0x1400c2b10]
movdqa xmm8, xmmword [0x1400c2e80]
movdqa xmm6, xmmword [0x1400c2e90]
nop
xor dil, dil
mov byte [rsp + 0x60], dil
nop dword [rax + rax]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140008254
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140008254
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r11 + r9*4]
mov r8d, dword [rdx + r10]
add r8, r10
mov edx, 0x475f821d
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x14000824f
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x140008230
cmp edx, 0x5f2fe53d
je 0x140008259
test r9d, r9d
jne 0x140008210
mov rax, qword [rax]
jmp 0x1400081e0
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
mov ecx, 0x28
call rax
test ax, ax
jne 0x14000833c
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140008314
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140008314
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r11 + r9*4]
mov r8d, dword [rdx + r10]
add r8, r10
mov edx, 0x445f7d64
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x14000830f
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x1400082f0
cmp edx, 0x182f93d4
je 0x140008319
test r9d, r9d
jne 0x1400082d0
mov rax, qword [rax]
jmp 0x1400082a0
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
mov ecx, 0x53
call rax
test ax, ax
je 0x140008350
mov dil, 1
jmp 0x1400081c0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400083e4
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400083e4
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r11 + r9*4]
mov r8d, dword [rdx + r10]
add r8, r10
mov edx, 0x355ae899
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x1400083df
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x1400083c0
cmp edx, 0xb2de1779
je 0x1400083e9
test r9d, r9d
jne 0x1400083a0
mov rax, qword [rax]
jmp 0x140008370
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
mov ecx, 0x26
call rax
test ax, ax
jne 0x1400084cc
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400084a4
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400084a4
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r11 + r9*4]
mov r8d, dword [rdx + r10]
add r8, r10
mov edx, 0x3e5af6c4
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x14000849f
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x140008480
cmp edx, 0x96e10db4
je 0x1400084a9
test r9d, r9d
jne 0x140008460
mov rax, qword [rax]
jmp 0x140008430
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
mov ecx, 0x57
call rax
test ax, ax
je 0x1400084d4
mov dil, 1
jmp 0x140008350
test dil, dil
je 0x1400084ef
inc r14d
and r14d, 0x80000001
jge 0x1400084ef
dec r14d
or r14d, 0xfffffffe
inc r14d
xor dil, dil
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140008584
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140008584
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r11 + r9*4]
mov r8d, dword [rdx + r10]
add r8, r10
mov edx, 0xa7e33156
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x14000857f
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x140008560
cmp edx, 0x3139adfe
je 0x140008589
test r9d, r9d
jne 0x140008540
mov rax, qword [rax]
jmp 0x140008510
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
mov ecx, 0x44
call rax
test ax, ax
jne 0x1400087ee
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140008644
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140008644
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r11 + r9*4]
mov r8d, dword [rdx + r10]
add r8, r10
mov edx, 0xc0ba647a
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x14000863f
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x140008620
cmp edx, 0xb2448352
je 0x140008649
test r9d, r9d
jne 0x140008600
mov rax, qword [rax]
jmp 0x1400085d0
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
mov ecx, 0x41
call rax
test ax, ax
jne 0x1400087ee
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140008704
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140008704
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r11 + r9*4]
mov r8d, dword [rdx + r10]
add r8, r10
mov edx, 0xc1ba660d
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x1400086ff
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x1400086e0
cmp edx, 0x66f8194d
je 0x140008709
test r9d, r9d
jne 0x1400086c0
mov rax, qword [rax]
jmp 0x140008690
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
mov ecx, 0x27
call rax
test ax, ax
jne 0x1400087ee
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400087c6
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400087c6
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r11 + r9*4]
mov ecx, dword [rdx + r10]
add rcx, r10
mov r8d, 0xbeba6154
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1400087c1
nop
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x1400087a0
cmp r8d, 0x2533b2a4
je 0x1400087cb
test r9d, r9d
jne 0x140008780
mov rax, qword [rax]
jmp 0x140008750
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
mov ecx, 0x25
call rax
test ax, ax
je 0x140008809
mov dil, 1
mov qword [rsp + 0x68], gethostname
lea rcx, [rsp + 0x68]
call fcn.14000c120
jmp 0x1400084f2
test dil, dil
je 0x14000886f
mov qword [rsp + 0x68], gethostname
lea rcx, [rsp + 0x68]
call fcn.14000c120
cmp r14d, 1
jne 0x14000882e
call fcn.140006e50
jmp 0x14000886a
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
xor eax, eax
mov qword [rbp + 0x90], rax
mov qword [rbp + 0x98], rax
xor r8d, r8d
lea rdx, [0x1400c1aa2]
lea rcx, [rbp + 0x80]
call fcn.14000c3b0
lea rcx, [rbp + 0x80]
call fcn.140003e80
mov byte [rsp + 0x60], 1
cmp r14d, 1
jne 0x140008b35
cmp esi, r14d
je 0x140008e0b
mov rcx, qword [rbp + 0x50]
mov eax, dword [rcx]
test r14b, al
jne 0x1400088b2
or eax, r14d
mov dword [rcx], eax
mov rax, qword [rbp + 0x58]
mov word [rax + 3], 0x18b
mov word [rax], 0x75d2
mov byte [rax + 2], 0xe2
lea rcx, [0x1400a1d40]
call fcn.14006f1a0
nop
mov eax, 0x370
mov rdi, qword [rsp + 0x70]
add rdi, rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov ebx, dword [rcx + r11 + 0x88]
add rbx, r11
cmp rbx, r11
je 0x140008944
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140008944
mov r10d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r10 + r9*4]
mov r8d, dword [rdx + r11]
add r8, r11
mov edx, 0x9d1aa7d2
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x14000893f
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x140008920
cmp edx, 0xec0433fb
je 0x140008949
test r9d, r9d
jne 0x140008900
mov rax, qword [rax]
jmp 0x1400088d0
mov r8d, dword [rbx + 0x1c]
add r8, r11
mov edx, dword [rbx + 0x24]
add rdx, r11
movzx edx, word [rdx + r9*2]
mov r10d, dword [r8 + rdx*4]
add r10, r11
mov rcx, rdi
call fcn.140009750
mov rcx, rax
call r10
lea rdx, [0x1400d3880]
cmp qword [0x1400d3898], 0xf
cmova rdx, qword [0x1400d3880]
mov r8, qword [0x1400d3890]
lea rcx, [0x1400d1e30]
call fcn.14000ca80
mov rbx, rax
mov rax, qword [rbp + 0x60]
mov ecx, dword [rax]
test cl, 1
jne 0x1400089d6
or ecx, 1
mov dword [rax], ecx
mov rdi, qword [rsp + 0x70]
mov esi, 0x4bc
mov dword [rsi + rdi + 2], 0x1018167
mov word [rsi + rdi], 0xdf2d
lea rcx, [0x1400a1d20]
call fcn.14006f1a0
nop
mov eax, esi
jmp 0x1400089e0
mov eax, 0x4bc
mov rdi, qword [rsp + 0x70]
lea rdx, [rdi + rax]
cmp byte [rdx + 5], 0
je 0x140008a01
xor byte [rdx], 0x27
xor byte [rdx + 1], 0xd5
xor byte [rdx + 2], 0x6d
xor byte [rdx + 3], 0x8b
xor byte [rdx + 4], 1
mov byte [rdx + 5], 0
mov rcx, rbx
call fcn.14000bcc0
mov dword [rbp - 0x18], 0x5d315a3d
mov ebx, 0x75c
mov eax, dword [rbx + rdi]
test al, 1
jne 0x140008a68
or eax, 1
mov dword [rbx + rdi], eax
mov byte [r12 + 0x14], 1
lea rax, [rbp - 0x15]
cmp r12, rax
ja 0x140008a4e
lea rcx, [rbp - 0x28]
lea rax, [r12 + 0x13]
cmp rax, rcx
jb 0x140008a4e
movups xmmword [r12], xmm6
mov eax, dword [rbp - 0x18]
mov dword [r12 + 0x10], eax
jmp 0x140008a5b
movups xmmword [r12], xmm6
mov eax, dword [rbp - 0x18]
mov dword [r12 + 0x10], eax
lea rcx, [0x1400a1d00]
call fcn.14006f1a0
nop
cmp byte [r12 + 0x14], 0
je 0x140008a8d
mov edx, reloc.WS2_32.dll_sendto
movabs r8, 0xb373b3395d3b0745
mov rcx, r12
call fcn.1400033f0
mov byte [r12 + 0x14], 0
mov rdx, r12
lea rcx, [0x1400d1e30]
call fcn.14000bcc0
mov rcx, rax
call fcn.14000bf70
mov word [rbp + 0x30], 0xaa73
mov ebx, 0x1fc
mov eax, dword [rbx + rdi]
test al, 1
jne 0x140008b0a
or eax, 1
mov dword [rbx + rdi], eax
mov byte [r15 + 0x13], 1
lea rax, [rbp + 0x32]
cmp r15, rax
ja 0x140008aeb
lea rcx, [rbp + 0x20]
lea rax, [r15 + 0x12]
cmp rax, rcx
jb 0x140008aeb
movups xmmword [r15], xmm8
movzx eax, word [rbp + 0x30]
mov word [r15 + 0x10], ax
mov byte [r15 + 0x12], 0x27
jmp 0x140008afd
movups xmmword [r15], xmm8
movzx eax, word [rbp + 0x30]
mov word [r15 + 0x10], ax
mov byte [r15 + 0x12], 0x27
lea rcx, [0x1400a1cd0]
call fcn.14006f1a0
nop
cmp byte [r15 + 0x13], 0
je 0x140008b2d
mov edx, reloc.WS2_32.dll_send
movabs r8, 0xbba969eff327f753
mov rcx, r15
call fcn.1400033f0
mov byte [r15 + 0x13], 0
mov rdx, r15
jmp 0x140008df7
cmp r14d, esi
je 0x140008e0b
mov rcx, qword [rbp + 0x68]
mov eax, dword [rcx]
test al, 1
jne 0x140008b6d
or eax, 1
mov dword [rcx], eax
mov rax, qword [rbp + 0x70]
mov word [rax + 3], 0x171
mov word [rax], 0xc5bc
mov byte [rax + 2], 0xf4
lea rcx, [0x1400a1cb0]
call fcn.14006f1a0
nop
mov eax, 0x208
mov rdi, qword [rsp + 0x70]
add rdi, rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov ebx, dword [rcx + r11 + 0x88]
add rbx, r11
cmp rbx, r11
je 0x140008c04
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140008c04
mov r10d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r11 + r9*4]
mov r8d, dword [rdx + r10]
add r8, r11
mov edx, 0xdbf9a65f
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x140008bff
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x140008be0
cmp edx, 0x53df51be
je 0x140008c09
test r9d, r9d
jne 0x140008bc0
mov rax, qword [rax]
jmp 0x140008b90
mov r8d, dword [rbx + 0x1c]
add r8, r11
mov edx, dword [rbx + 0x24]
add rdx, r11
movzx edx, word [rdx + r9*2]
mov r10d, dword [r8 + rdx*4]
add r10, r11
mov rcx, rdi
call fcn.140009690
mov rcx, rax
call r10
lea rdx, [0x1400d3880]
cmp qword [0x1400d3898], 0xf
cmova rdx, qword [0x1400d3880]
mov r8, qword [0x1400d3890]
lea rcx, [0x1400d1e30]
call fcn.14000ca80
mov rbx, rax
mov rax, qword [rbp + 0x78]
mov ecx, dword [rax]
test cl, 1
jne 0x140008c96
or ecx, 1
mov dword [rax], ecx
mov rdi, qword [rsp + 0x70]
mov esi, 0x23c
mov dword [rsi + rdi + 2], 0x1f1f121
mov word [rsi + rdi], 0x23f9
lea rcx, [0x1400a1c90]
call fcn.14006f1a0
nop
mov eax, esi
jmp 0x140008ca0
mov eax, 0x23c
mov rdi, qword [rsp + 0x70]
lea rdx, [rdi + rax]
cmp byte [rdx + 5], 0
je 0x140008cc1
xor byte [rdx], 0xf3
xor byte [rdx + 1], 0x29
xor byte [rdx + 2], 0x2b
xor byte [rdx + 3], 0xfb
xor byte [rdx + 4], 0xf1
mov byte [rdx + 5], 0
mov rcx, rbx
call fcn.14000bcc0
mov dword [rbp], 0xe73b78f9
mov ecx, 0x38c
mov eax, dword [rcx + rdi]
test al, 1
jne 0x140008d2c
or eax, 1
mov dword [rcx + rdi], eax
mov rbx, qword [rsp + 0x78]
mov byte [rbx + 0x14], 1
lea rax, [rbp + 3]
cmp rbx, rax
ja 0x140008d14
lea rdx, [rbp - 0x10]
mov eax, 0x440
add rax, 0x13
add rax, rdi
cmp rax, rdx
jb 0x140008d14
movups xmmword [rbx], xmm7
mov eax, dword [rbp]
mov dword [rbx + 0x10], eax
jmp 0x140008d1d
movups xmmword [rbx], xmm7
mov eax, dword [rbp]
mov dword [rbx + 0x10], eax
lea rcx, [0x1400a1c70]
call fcn.14006f1a0
nop
jmp 0x140008d31
mov rbx, qword [rsp + 0x78]
cmp byte [rbx + 0x14], 0
je 0x140008d52
mov edx, reloc.WS2_32.dll_sendto
movabs r8, 0x4529a72fe73125d9
mov rcx, rbx
call fcn.1400033f0
mov byte [rbx + 0x14], 0
mov rdx, rbx
lea rcx, [0x1400d1e30]
call fcn.14000bcc0
mov rcx, rax
call fcn.14000bf70
mov word [rbp + 0x48], 0xd20b
mov ebx, 0x3bc
mov eax, dword [rbx + rdi]
test al, 1
jne 0x140008dd1
or eax, 1
mov dword [rbx + rdi], eax
mov byte [r13 + 0x13], 1
lea rax, [rbp + 0x4a]
cmp r13, rax
ja 0x140008db1
lea rcx, [rbp + 0x38]
lea rax, [r13 + 0x12]
cmp rax, rcx
jb 0x140008db1
movups xmmword [r13], xmm9
movzx eax, word [rbp + 0x48]
mov word [r13 + 0x10], ax
mov byte [r13 + 0x12], 0xf3
jmp 0x140008dc4
movups xmmword [r13], xmm9
movzx eax, word [rbp + 0x48]
mov word [r13 + 0x10], ax
mov byte [r13 + 0x12], 0xf3
lea rcx, [0x1400a1c40]
call fcn.14006f1a0
nop
cmp byte [r13 + 0x13], 0
je 0x140008df4
mov edx, reloc.WS2_32.dll_send
movabs r8, 0xd11d632705f38f73
mov rcx, r13
call fcn.1400033f0
mov byte [r13 + 0x13], 0
mov rdx, r13
lea rcx, [0x1400d1e30]
call fcn.14000bcc0
mov rcx, rax
call fcn.14000bf70
mov esi, r14d
mov qword [rsp + 0x68], gethostname
lea rcx, [rsp + 0x68]
call fcn.14000c120
cmp byte [rsp + 0x60], 0
je 0x1400081b0
mov qword [rsp + 0x68], 0xc8
lea rcx, [rsp + 0x68]
call fcn.14000c120
jmp 0x1400081b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rax, [0x1400c1b98]
mov qword [rsp + 0x78], rax
lea rdx, reloc.WS2_32.dll_accept
lea rcx, [rsp + 0x78]
call fcn.1400711d8
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rax, [0x1400c1b78]
mov qword [rsp + 0x78], rax
lea rdx, reloc.WS2_32.dll_accept
lea rcx, [rsp + 0x78]
call fcn.1400711d8
int3