Function at 0x14012d450
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Create thread
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2e0]
sub rsp, 0x3e0
movaps xmmword [rsp + 0x3d0], xmm6
mov rax, qword [0x140714d80]
xor rax, rsp
mov qword [rbp + 0x2c0], rax
mov r13, rdx
mov r12, rcx
mov qword [rbp + 0xa0], rdx
xor r15d, r15d
mov dword [rsp + 0x68], r15d
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8, [fcn.1401213f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8, [0x140121670]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8, [0x140121ab0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.1401219e0
lea rcx, [rbp + 0x128]
call fcn.14013af70
nop
mov dword [rbp - 0x78], 0x7a647d37
mov dword [rbp - 0x74], 0x7c7e6470
mov word [rbp - 0x70], 0x24
mov byte [rbp - 0x6e], 1
mov dword [rbp + 0x90], 0x79727c37
mov dword [rbp + 0x94], 0x1002b70
mov dword [rsp + 0x70], 0x67766137
mov dword [rsp + 0x74], 0x76787f66
mov dword [rsp + 0x78], 0x267e70
mov byte [rsp + 0x7c], 1
mov dword [rbp - 0x58], 0x7d647a37
mov dword [rbp - 0x54], 0x1002b71
mov dword [rsp + 0x68], 0x6d767937
mov word [rsp + 0x6c], 0x28
mov byte [rsp + 0x6e], 1
mov dword [rbp + 0xa8], 0x71636b65
mov dword [rbp + 0xac], 0x7b7e7a28
mov dword [rbp + 0xb0], 0x7968747c
mov word [rbp + 0xb4], 0x100
lea r8, [rsp + 0x68]
lea rdx, [rbp + 0xa8]
lea rcx, [rbp + 0xc8]
call fcn.140117ee0
nop
mov rdx, r13
cmp qword [r13 + 0x18], 0xf
jbe 0x14012d5c2
mov rdx, qword [r13]
mov r8, qword [r13 + 0x10]
mov rcx, rax
call fcn.14006ec50
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x108], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x118], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rbp - 0x58]
lea rdx, [rbp + 0x108]
lea rcx, [rbp - 0x10]
call fcn.1401172d0
nop
lea rdx, [rbp + 0x128]
cmp qword [rbp + 0x140], 0xf
cmova rdx, qword [rbp + 0x128]
mov r8, qword [rbp + 0x138]
mov rcx, rax
call fcn.14006ec50
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x20], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rsp + 0x70]
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x70]
call fcn.140117dd0
nop
lea rdx, [r12 + 0x240]
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x14012d674
mov rdx, qword [rdx]
mov rcx, rax
call fcn.14006ec50
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x60], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rbp + 0x90]
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x30]
call fcn.1401172d0
nop
mov rdx, r12
cmp qword [r12 + 0x18], 0xf
jbe 0x14012d6be
mov rdx, qword [r12]
mov r8, qword [r12 + 0x10]
mov rcx, rax
call fcn.14006ec50
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x20], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rbp - 0x78]
lea rdx, [rbp + 0x10]
lea rcx, [rbp - 0x50]
call fcn.1401177b0
nop
lea rdx, [r12 + 0x20]
cmp qword [r12 + 0x38], 0xf
jbe 0x14012d70d
mov rdx, qword [r12 + 0x20]
mov r8, qword [r12 + 0x30]
mov rcx, rax
call fcn.14006ec50
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x188], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x198], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x14012d77c
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14012d777
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14012d777
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140224898
movdqa xmm6, xmmword [0x14037a260]
movdqu xmmword [rbp - 0x40], xmm6
mov byte [rbp - 0x50], 0
mov rdx, qword [rbp + 0x28]
cmp rdx, 0xf
jbe 0x14012d7cc
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14012d7c6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14012d7c6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140224898
nop
mov rdx, qword [rbp + 0x48]
cmp rdx, 0xf
jbe 0x14012d80a
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14012d805
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14012d805
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140224898
movdqu xmmword [rbp + 0x40], xmm6
mov byte [rbp + 0x30], 0
mov rdx, qword [rbp + 0x68]
cmp rdx, 0xf
jbe 0x14012d852
inc rdx
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14012d84c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14012d84c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140224898
nop
mov rdx, qword [rbp + 0x88]
cmp rdx, 0xf
jbe 0x14012d893
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14012d88e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14012d88e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140224898
movdqu xmmword [rbp + 0x80], xmm6
mov byte [rbp + 0x70], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x14012d8de
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14012d8d8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14012d8d8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140224898
nop
mov rdx, qword [rbp + 8]
cmp rdx, 0xf
jbe 0x14012d91c
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14012d917
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14012d917
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140224898
movdqu xmmword [rbp], xmm6
mov byte [rbp - 0x10], 0
mov rdx, qword [rbp + 0x120]
cmp rdx, 0xf
jbe 0x14012d96a
inc rdx
mov rcx, qword [rbp + 0x108]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14012d964
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14012d964
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140224898
nop
mov rdx, qword [rbp + 0xe0]
cmp rdx, 0xf
jbe 0x14012d9ae
inc rdx
mov rcx, qword [rbp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14012d9a9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14012d9a9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140224898
movdqu xmmword [rbp + 0xd8], xmm6
mov byte [rbp + 0xc8], 0
lea rax, [rbp + 0x108]
mov qword [rbp - 0x68], rax
lea rdx, [r12 + 0x60]
lea rcx, [rbp + 0x108]
call fcn.1400df200
mov rbx, rax
lea rdx, [rbp + 0x188]
lea rcx, [rbp - 0x30]
call fcn.1400df200
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x148]
call fcn.140132de0
nop
lea rax, [rbp + 0xa8]
mov qword [rsp + 0x58], rax
lea rdx, [rbp + 0x148]
cmp qword [rbp + 0x160], 0xf
cmova rdx, qword [rbp + 0x148]
xorps xmm0, xmm0
movups xmmword [rbp + 0xa8], xmm0
mov qword [rbp + 0xb8], r15
mov qword [rbp + 0xc0], r15
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x14012da42
lea rcx, [rbp + 0xa8]
call fcn.14006d8c0
nop
lea rax, [rbp + 0xc8]
mov qword [rbp - 0x68], rax
lea rdx, [0x140713ea8]
lea rcx, [rbp + 0xc8]
call fcn.1400df200
mov rbx, rax
lea rdx, [0x140713e88]
lea rcx, [rbp - 0x10]
call fcn.1400df200
nop
lea r8, [rbp + 0xa8]
mov rdx, rbx
mov rcx, rax
call fcn.14011f4e0
xor eax, 0xa5a5
mov edx, eax
shr eax, 8
movzx r8d, al
movzx eax, dl
movabs r14, 0xcbf29ce484222325
xor rax, r14
movabs rsi, 0x100000001b3
imul rax, rsi
xor r8, rax
imul r8, rsi
mov eax, edx
shr eax, 0x10
movzx ecx, al
xor r8, rcx
imul r8, rsi
shr rdx, 0x18
xor r8, rdx
imul r8, rsi
cmp r8w, 0xdf7f
jne 0x14012e7e3
mov qword [rbp + 0x100], r15
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0xc8]
lea rdx, [rbp + 0x148]
lea rcx, [rbp + 0xa8]
call fcn.14011b810
nop
lea rdx, [r12 + 0x20]
lea rcx, [rsp + 0x70]
call fcn.140116b60
nop
mov dword [rsp + 0x5c], 0x646972
mov dword [rsp + 0x58], 0x656e776f
mov byte [rsp + 0x60], 0
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x5f]
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x50]
call fcn.14006d490
nop
movzx ecx, byte [rbp + 0xa8]
test cl, cl
jne 0x14012db85
mov byte [rbp + 0xa8], 1
call fcn.140119e60
mov qword [rbp + 0xb0], rax
movzx ecx, byte [rbp + 0xa8]
jmp 0x14012db8c
mov rax, qword [rbp + 0xb0]
cmp cl, 1
jne 0x14012db9f
lea rdx, [rbp - 0x50]
mov rcx, rax
call fcn.14011efd0
jmp 0x14012dba4
mov rax, qword [rsp + 0x58]
lea rdx, [rsp + 0x70]
mov rcx, rax
call fcn.14011ec00
movzx ebx, al
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x14012dbf2
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14012dbed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14012dbed
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140224898
movdqu xmmword [rbp - 0x40], xmm6
mov byte [rbp - 0x50], 0
movzx edx, byte [rsp + 0x70]
lea rcx, [rsp + 0x78]
call fcn.140126380
test bl, bl
jne 0x14012dcc9
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14012dca6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14012dca6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0xfc77d5a9
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14012dca1
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14012dc80
cmp r8d, 0x84e14989
je 0x14012dcab
test r9d, r9d
jne 0x14012dc60
mov rax, qword [rax]
jmp 0x14012dc30
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov ecx, 8
call rdx
mov dword [rbp - 0x64], 0x656761
mov dword [rbp - 0x68], 0x7373656d
mov byte [rbp - 0x60], 0
lea r9, [rsp + 0x50]
lea r8, [rbp - 0x61]
lea rdx, [rbp - 0x68]
lea rcx, [rbp - 0x50]
call fcn.14006d490
nop
movzx ecx, byte [rbp + 0xa8]
test cl, cl
jne 0x14012dd19
mov byte [rbp + 0xa8], 1
call fcn.140119e60
mov qword [rbp + 0xb0], rax
movzx ecx, byte [rbp + 0xa8]
jmp 0x14012dd20
mov rax, qword [rbp + 0xb0]
cmp cl, 1
jne 0x14012dd33
lea rdx, [rbp - 0x50]
mov rcx, rax
call fcn.14011efd0
jmp 0x14012dd38
mov rax, qword [rsp + 0x58]
xorps xmm0, xmm0
movups xmmword [rbp + 0x168], xmm0
movdqu xmmword [rbp + 0x178], xmm6
mov byte [rbp + 0x168], 0
mov dword [rsp + 0x68], 0x17fc
cmp byte [rax], 3
jne 0x14012dd70
mov rdx, qword [rax + 8]
lea rax, [rbp + 0x168]
cmp rax, rdx
je 0x14012dd8e
jmp 0x14012dd73
mov rdx, r15
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x14012dd81
mov rdx, qword [rdx]
lea rcx, [rbp + 0x168]
call fcn.14006ece0
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x14012ddcc
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14012ddc7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14012ddc7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140224898
movdqu xmmword [rbp - 0x40], xmm6
mov byte [rbp - 0x50], 0
mov word [rsp + 0x6b], 0x65
mov word [rsp + 0x68], 0x6f63
mov byte [rsp + 0x6a], 0x64
mov byte [rsp + 0x6d], 0
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x6c]
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0xc8]
call fcn.14006d490
nop
movzx ecx, byte [rbp + 0xa8]
test cl, cl
jne 0x14012de30
mov byte [rbp + 0xa8], 1
call fcn.140119e60
mov qword [rbp + 0xb0], rax
movzx ecx, byte [rbp + 0xa8]
jmp 0x14012de37
mov rax, qword [rbp + 0xb0]
cmp cl, 1
jne 0x14012de4d
lea rdx, [rbp + 0xc8]
mov rcx, rax
call fcn.14011efd0
jmp 0x14012de52
mov rax, qword [rsp + 0x58]
mov rcx, rax
call fcn.140117200
mov edx, eax
shr eax, 8
movzx edi, al
movzx eax, dl
xor rax, r14
imul rax, rsi
xor rdi, rax
imul rdi, rsi
mov eax, edx
shr eax, 0x10
movzx ecx, al
xor rdi, rcx
imul rdi, rsi
shr rdx, 0x18
xor rdi, rdx
imul rdi, rsi
mov r8, qword [rbp + 0xe0]
cmp r8, 0xf
jbe 0x14012dead
mov rdx, qword [rbp + 0xc8]
lea rcx, [rbp + 0xc8]
call fcn.1400ea290
mov dword [rsp + 0x5c], 0x737365
mov dword [rsp + 0x58], 0x63637573
mov byte [rsp + 0x60], 0
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x5f]
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x108]
call fcn.14006d490
nop
mov ebx, 0x1effd
mov dword [rsp + 0x68], ebx
movzx ecx, byte [rbp + 0xa8]
test cl, cl
jne 0x14012df0e
mov byte [rbp + 0xa8], 1
call fcn.140119e60
mov qword [rbp + 0xb0], rax
movzx ecx, byte [rbp + 0xa8]
jmp 0x14012df15
mov rax, qword [rbp + 0xb0]
cmp cl, 1
jne 0x14012df2e
lea rdx, [rbp + 0x108]
mov rcx, rax
call fcn.14011efd0
mov rcx, rax
jmp 0x14012df33
mov rcx, qword [rsp + 0x58]
lea rax, [rcx + 8]
cmp byte [rcx], 4
cmovne rax, r15
cmp byte [rax], 0
je 0x14012dffb
mov dword [rbp + 0x94], 0x737365
mov dword [rbp + 0x90], 0x63637573
mov byte [rbp + 0x98], 0
lea r9, [rsp + 0x50]
lea r8, [rbp + 0x97]
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0xc8]
call fcn.14006d490
nop
mov ebx, 0x19efff
mov dword [rsp + 0x68], ebx
movzx ecx, byte [rbp + 0xa8]
test cl, cl
jne 0x14012dfb2
mov byte [rbp + 0xa8], 1
call fcn.140119e60
mov qword [rbp + 0xb0], rax
movzx ecx, byte [rbp + 0xa8]
jmp 0x14012dfb9
mov rax, qword [rbp + 0xb0]
cmp cl, 1
jne 0x14012dfd2
lea rdx, [rbp + 0xc8]
mov rcx, rax
call fcn.14011efd0
mov rcx, rax
jmp 0x14012dfd7
mov rcx, qword [rsp + 0x58]
lea rax, [rcx + 8]
cmp byte [rcx], 4
cmovne rax, r15
cmp byte [rax], 0
je 0x14012dff6
movabs rax, 0xcbe5c873d26645f1
cmp rdi, rax
je 0x14012dffb
xor dil, dil
jmp 0x14012dffe
mov dil, 1
test bl, 2
je 0x14012e013
and ebx, 0xfffffffd
lea rcx, [rbp + 0xc8]
call fcn.14006ead0
nop
test bl, 1
je 0x14012e024
lea rcx, [rbp + 0x108]
call fcn.14006ead0
test dil, dil
je 0x14012e6f9
lea rdx, [rbp + 0xa8]
lea rcx, [rsp + 0x70]
call fcn.14011de50
mov rdx, rax
mov rcx, r12
call fcn.14012ee30
mov dword [rsp + 0x5c], 0x737365
mov dword [rsp + 0x58], 0x63637573
mov byte [rsp + 0x60], 0
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x5f]
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0xc8]
call fcn.14006d490
nop
movzx ecx, byte [rbp + 0xa8]
test cl, cl
jne 0x14012e0a1
mov byte [rbp + 0xa8], 1
call fcn.140119e60
mov qword [rbp + 0xb0], rax
movzx ecx, byte [rbp + 0xa8]
jmp 0x14012e0a8
mov rax, qword [rbp + 0xb0]
cmp cl, 1
jne 0x14012e0c1
lea rdx, [rbp + 0xc8]
mov rcx, rax
call fcn.14011efd0
mov rcx, rax
jmp 0x14012e0c6
mov rcx, qword [rsp + 0x58]
lea rax, [rcx + 8]
cmp byte [rcx], 4
cmovne rax, r15
movzx ebx, byte [rax]
lea rcx, [rbp + 0xc8]
call fcn.14006ead0
test bl, bl
je 0x14012e18a
mov word [rsp + 0x6b], reloc.WS2_32.dll_WSAGetLastError
mov word [rsp + 0x68], 0x6e69
mov byte [rsp + 0x6a], 0x66
mov byte [rsp + 0x6d], 0
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x6c]
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0xc8]
call fcn.14006d490
nop
movzx ecx, byte [rbp + 0xa8]
test cl, cl
jne 0x14012e143
mov byte [rbp + 0xa8], 1
call fcn.140119e60
mov qword [rbp + 0xb0], rax
movzx ecx, byte [rbp + 0xa8]
jmp 0x14012e14a
mov rax, qword [rbp + 0xb0]
cmp cl, 1
jne 0x14012e160
lea rdx, [rbp + 0xc8]
mov rcx, rax
call fcn.14011efd0
jmp 0x14012e165
mov rax, qword [rsp + 0x58]
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.14011de50
mov rdx, rax
mov rcx, r12
call fcn.14012f200
nop
lea rcx, [rbp + 0xc8]
call fcn.14006ead0
mov dword [rsp + 0x70], 0x607a7c58
mov dword [rsp + 0x74], 0x717b777c
mov dword [rsp + 0x78], 0x7f7f63
mov byte [rsp + 0x7c], 1
lea rcx, [rsp + 0x70]
call fcn.140120770
mov rdx, rax
lea rcx, [r12 + 0x218]
call fcn.140116ed0
test al, al
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
je 0x14012e660
lea r15, [0x140713e68]
mov rsi, r15
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
cmova rsi, qword [0x140713e68]
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14012e276
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14012e276
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0xeccb2812
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14012e271
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14012e250
cmp r8d, 0x129eecd4
je 0x14012e27b
test r9d, r9d
jne 0x14012e230
mov rax, qword [rax]
jmp 0x14012e200
mov edx, dword [rdi + 0x1c]
add rdx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rdx + rax*4]
add rdx, r10
mov rcx, rsi
call rdx
movdqa xmm0, xmmword [str.R_ODgypjxw_i]
movdqu xmmword [rsp + 0x70], xmm0
mov byte [rbp - 0x80], 1
lea rcx, [rsp + 0x70]
call fcn.140120720
mov rdx, rax
mov r8, r15
lea rcx, [rbp + 0x108]
call fcn.14006d5d0
nop
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x1b0]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 2
lea rdx, [rbp + 0x108]
lea rcx, [rbp + 0x1b0]
call fcn.14011e0c0
nop
cmp qword [rbp + 0x238], 0
je 0x14012e33e
mov rdx, r15
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
cmova rdx, qword [0x140713e68]
mov r8, qword [0x140713e78]
lea rcx, [rbp + 0x1b0]
call fcn.1400d5680
lea rcx, [rbp + 0x1b0]
call fcn.1401231c0
mov dword [rbp - 0x78], 0x60757d42
mov dword [rbp - 0x74], 0x7d657762
mov word [rbp - 0x70], 0x45
mov byte [rbp - 0x6e], 1
lea rcx, [rbp - 0x78]
call fcn.1401206e0
mov rdx, rax
mov r8, r15
lea rcx, [rbp + 0xc8]
call fcn.14006d5d0
nop
lea rdx, [rbp + 0xc8]
cmp qword [rbp + 0xe0], 0xf
cmova rdx, qword [rbp + 0xc8]
xor ecx, ecx
mov qword [rsp + 0x40], rcx
lea rax, [rbp + 0x90]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], ecx
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14012e56b
mov r14, qword [0x140713e78]
inc r14
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
jbe 0x14012e3e3
mov r15, qword [0x140713e68]
mov rsi, r15
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov edi, dword [rcx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x14012e476
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14012e476
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r11 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r11
mov r8d, 0x6cb13e8f
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14012e471
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14012e450
cmp r8d, 0x59df9a6e
je 0x14012e47b
test r9d, r9d
jne 0x14012e430
mov rax, qword [rax]
jmp 0x14012e400
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r15
mov r9d, 1
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rbp + 0x90]
call r10
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14012e546
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14012e546
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x557bf129
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14012e541
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14012e520
cmp r8d, 0xf20fe286
je 0x14012e54b
test r9d, r9d
jne 0x14012e500
mov rax, qword [rax]
jmp 0x14012e4d0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov rcx, qword [rbp + 0x90]
call rdx
lea rsi, [r12 + 0x20]
cmp qword [rsi + 0x18], 0xf
jbe 0x14012e57a
mov rsi, qword [rsi]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14012e606
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14012e606
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0xcc6ba129
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14012e601
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14012e5e0
cmp r8d, 0xf3af49ff
je 0x14012e60b
test r9d, r9d
jne 0x14012e5c0
mov rax, qword [rax]
jmp 0x14012e590
mov edx, dword [rdi + 0x1c]
add rdx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rdx + rax*4]
add rdx, r10
mov rcx, rsi
call rdx
nop
lea rcx, [rbp + 0xc8]
call fcn.14006ead0
nop
lea rcx, [rbp + 0x1b0]
call fcn.1400e45c0
nop
lea rcx, [rbp + 0x108]
call fcn.14006ead0
xor r15d, r15d
jmp 0x14012e7aa
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14012e6d6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14012e6d6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x3a787ac8
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14012e6d1
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14012e6b0
cmp r8d, 0xcedbc918
je 0x14012e6db
test r9d, r9d
jne 0x14012e690
mov rax, qword [rax]
jmp 0x14012e660
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
mov ecx, listen
jmp 0x14012e7a4
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14012e786
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14012e786
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0xf81967ff
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14012e781
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14012e760
cmp r8d, 0x73bf447f
je 0x14012e78b
test r9d, r9d
jne 0x14012e740
mov rax, qword [rax]
jmp 0x14012e710
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
mov ecx, 9
add rdx, r10
call rdx
nop
mov r8, qword [rbp + 0x180]
cmp r8, 0xf
jbe 0x14012e7cb
mov rdx, qword [rbp + 0x168]
lea rcx, [rbp + 0x168]
call fcn.1400ea290
nop
movzx edx, byte [rbp + 0xa8]
lea rcx, [rbp + 0xb0]
call fcn.140126380
jmp 0x14012e89a
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14012e876
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14012e876
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov ecx, dword [rcx + rbx]
add rcx, r10
mov r8d, 0x935efd86
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14012e871
nop dword [rax]
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x14012e850
cmp r8d, 0x6f796dee
je 0x14012e87b
test r9d, r9d
jne 0x14012e830
mov rax, qword [rax]
jmp 0x14012e800
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov ecx, 7
call rdx
nop
mov rdx, qword [rbp + 0x160]
cmp rdx, 0xf
jbe 0x14012e8de
inc rdx
mov rcx, qword [rbp + 0x148]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14012e8d9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14012e8d9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140224898
movdqu xmmword [rbp + 0x158], xmm6
mov byte [rbp + 0x148], 0
mov rdx, qword [rbp + 0x1a0]
cmp rdx, 0xf
jbe 0x14012e932
inc rdx
mov rcx, qword [rbp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14012e92c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14012e92c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140224898
nop
mov rdx, qword [rbp + 0x140]
cmp rdx, 0xf
jbe 0x14012e976
inc rdx
mov rcx, qword [rbp + 0x128]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14012e971
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14012e971
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140224898
mov qword [rbp + 0x138], r15
mov qword [rbp + 0x140], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x128], 0
mov rdx, qword [r13 + 0x18]
cmp rdx, 0xf
jbe 0x14012e9c6
inc rdx
mov rcx, qword [r13]
cmp rdx, 0x1000
jb 0x14012e9c1
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14012ea09
mov rcx, r8
call fcn.140224898
mov qword [r13 + 0x10], r15
mov qword [r13 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r13], 0
mov rcx, qword [rbp + 0x2c0]
xor rcx, rsp
call fcn.140225440
mov rbx, qword [rsp + 0x430]
movaps xmm6, xmmword [rsp + 0x3d0]
add rsp, 0x3e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3