Function at 0x14000d200
Capabilities:
Access peb ldr_data
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
mov rdi, rcx
test rdx, rdx
je 0x140005ede
mov ecx, 4
mov rax, qword gs:[0x58]
mov r8, qword [rax]
mov eax, dword [rcx + r8]
cmp dword [0x1401e0940], eax
jle 0x140005ebf
lea rcx, [0x1401e0940]
call fcn.1400cdba0
cmp dword [0x1401e0940], 0xffffffff
jne 0x140005ebf
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov r8d, reloc.WS2_32.dll_setsockopt
lea rdx, str.ExReleaseResourceLite
lea rcx, [rsp + 0x20]
call fcn.14000e820
nop
lea r8, [rsp + 0x20]
mov rcx, rdi
call fcn.140005790
mov qword [0x1401e08e8], rax
lea rcx, [rsp + 0x20]
call fcn.14000b3e0
nop
lea rcx, [0x1401e0940]
call fcn.1400cdb34
cmp qword [0x1401e08e8], 0
je 0x140005ede
mov r9, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
jmp 0x14000d200
xor al, al
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xb0
mov rax, qword [0x140127240]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov qword [rbp - 0x31], r9
mov qword [rbp - 0x49], rcx
cmp qword [0x1401e08e8], 0
je 0x14000d7d6
xor r15d, r15d
mov r14d, 0xf7d723d7
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r11, qword [rax + 0x30]
test r11, r11
je 0x14000d438
cmp word [rax + 0x48], 0
je 0x14000d438
movups xmm0, xmmword [rax + 0x58]
movd ecx, xmm0
sub cx, 8
test r15d, r15d
je 0x14000d2e3
psrldq xmm0, 8
movq r9, xmm0
movzx ecx, cx
shr rcx, 1
lea rbx, [r9 + rcx*2]
mov r10d, 0x91faaf65
cmp r9, rbx
je 0x14000d2da
nop dword [rax + rax]
movsx ecx, byte [r9]
mov edx, ecx
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
add r9, 2
cmp r9, rbx
jne 0x14000d2b0
cmp r10d, r15d
jne 0x14000d438
movsxd rcx, dword [r11 + 0x3c]
mov rdx, qword [rcx + r11 + 0x88]
mov r13, rdx
shr r13, 0x20
mov esi, edx
add rsi, r11
cmp rsi, r11
je 0x14000d438
mov edi, dword [rsi + 0x18]
test edi, edi
je 0x14000d438
mov r8d, dword [rsi + 0x1c]
add r8, r11
mov qword [rbp - 0x41], r8
mov ecx, dword [rsi + 0x24]
add rcx, r11
mov qword [rbp - 0x39], rcx
mov r9d, dword [rsi + 0x20]
nop dword [rax + rax]
dec edi
movzx ecx, word [rcx + rdi*2]
mov ebx, dword [r8 + rcx*4]
add rbx, r11
lea rcx, [r9 + rdi*4]
mov r9d, dword [rcx + r11]
add r9, r11
cmp rbx, rsi
jbe 0x14000d35b
lea rcx, [rsi + r13]
cmp rbx, rcx
jae 0x14000d35b
mov r12b, 1
jmp 0x14000d35e
xor r12b, r12b
mov r10d, 0x91faaf65
movzx ecx, byte [r9]
inc r9
test cl, cl
je 0x14000d39e
nop
movsx edx, cl
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
movzx ecx, byte [r9]
lea r9, [r9 + 1]
test cl, cl
jne 0x14000d370
mov r8, qword [rbp - 0x41]
cmp r10d, r14d
je 0x14000d3b7
test edi, edi
mov rcx, qword [rbp - 0x39]
mov r9d, dword [rsi + 0x20]
jne 0x14000d330
mov rax, qword [rax]
jmp 0x14000d260
test r12b, r12b
je 0x14000d440
mov r15d, 0x91faaf65
mov r14d, r15d
movzx edx, byte [rbx]
cmp dl, 0x2e
je 0x14000d3f7
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, r15d
imul r15d, ecx, 0x1000193
inc rbx
movzx edx, byte [rbx]
cmp dl, 0x2e
jne 0x14000d3d1
inc rbx
movzx edx, byte [rbx]
test dl, dl
je 0x14000d427
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, r14d
imul r14d, ecx, 0x1000193
lea rbx, [rbx + 1]
movzx edx, byte [rbx]
test dl, dl
jne 0x14000d401
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rax, qword [rax]
jmp 0x14000d260
test rbx, rbx
je 0x14000d7d6
mov word [rbp - 9], 0xb848
mov word [rbp + 1], 0xe0ff
mov rax, qword [0x1401e08e8]
mov qword [rbp - 7], rax
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1401e0908], eax
jle 0x14000d75a
lea rcx, [0x1401e0908]
call fcn.1400cdba0
cmp dword [0x1401e0908], 0xffffffff
jne 0x14000d75a
mov al, 0xd4
mov dl, 0xf9
mov r8b, 0xab
mov r9b, 0xcf
mov r10b, 0xce
mov r11b, 0xae
mov dil, 0xfc
mov sil, 0xfe
mov r14b, 0xfd
mov r15b, WSAGetLastError
xorps xmm0, xmm0
xor r12d, r12d
movups xmmword [rbp - 0x5f], xmm0
mov word [rbp - 0x4f], r12w
movzx ecx, al
movzx eax, cl
and al, 0x91
add al, al
sub cl, al
sub cl, 0x66
mov byte [rbp - 0x69], cl
movzx ecx, dl
movzx eax, cl
and al, 0x92
add al, al
sub cl, al
sub cl, 0x65
mov byte [rbp - 0x68], cl
movzx ecx, r8b
movzx eax, cl
and al, 0x93
add al, al
sub cl, al
sub cl, 0x64
mov byte [rbp - 0x67], cl
movzx ecx, r9b
movzx eax, cl
and al, 0x94
add al, al
sub cl, al
sub cl, 0x63
mov byte [rbp - 0x66], cl
movzx ecx, r10b
movzx eax, cl
and al, 0x95
add al, al
sub cl, al
sub cl, 0x62
mov byte [rbp - 0x65], cl
movzx ecx, r11b
movzx eax, cl
and al, 0x96
add al, al
sub cl, al
sub cl, 0x61
mov byte [rbp - 0x64], cl
movzx ecx, dil
movzx eax, cl
and al, 0x97
add al, al
sub cl, al
sub cl, 0x60
mov byte [rbp - 0x63], cl
movzx ecx, sil
movzx eax, cl
and al, 0x98
add al, al
sub cl, al
sub cl, 0x5f
mov byte [rbp - 0x62], cl
movzx ecx, r14b
movzx eax, cl
and al, 0x99
add al, al
sub cl, al
sub cl, 0x5e
mov byte [rbp - 0x61], cl
movzx ecx, r15b
movzx eax, cl
and al, 0x9a
add al, al
sub cl, al
sub cl, 0x5d
mov byte [rbp - 0x60], cl
movd eax, xmm0
movzx ecx, al
movzx eax, cl
and al, 0x9b
add al, al
sub cl, al
sub cl, 0x5c
mov byte [rbp - 0x5f], cl
movzx ecx, byte [rbp - 0x5e]
movzx eax, cl
and al, 0x9c
add al, al
sub cl, al
sub cl, 0x5b
mov byte [rbp - 0x5e], cl
movzx ecx, byte [rbp - 0x5d]
movzx eax, cl
and al, 0x9d
add al, al
sub cl, al
sub cl, 0x5a
mov byte [rbp - 0x5d], cl
movzx ecx, byte [rbp - 0x5c]
movzx eax, cl
and al, 0x9e
add al, al
sub cl, al
sub cl, 0x59
mov byte [rbp - 0x5c], cl
movzx ecx, byte [rbp - 0x5b]
movzx eax, cl
and al, 0x9f
add al, al
sub cl, al
sub cl, 0x58
mov byte [rbp - 0x5b], cl
movzx ecx, byte [rbp - 0x5a]
movzx eax, cl
and al, 0xa0
add al, al
sub cl, al
sub cl, 0x57
mov byte [rbp - 0x5a], cl
movzx ecx, byte [rbp - 0x59]
movzx eax, cl
and al, 0xa1
add al, al
sub cl, al
sub cl, 0x56
mov byte [rbp - 0x59], cl
movzx ecx, byte [rbp - 0x58]
movzx eax, cl
and al, 0xa2
add al, al
sub cl, al
sub cl, 0x55
mov byte [rbp - 0x58], cl
movzx ecx, byte [rbp - 0x57]
movzx eax, cl
and al, 0xa3
add al, al
sub cl, al
sub cl, 0x54
mov byte [rbp - 0x57], cl
movzx ecx, byte [rbp - 0x56]
movzx eax, cl
and al, 0xa4
add al, al
sub cl, al
sub cl, 0x53
mov byte [rbp - 0x56], cl
movzx ecx, byte [rbp - 0x55]
movzx eax, cl
and al, 0xa5
add al, al
sub cl, al
sub cl, 0x52
mov byte [rbp - 0x55], cl
movzx ecx, byte [rbp - 0x54]
movzx eax, cl
and al, 0xa6
add al, al
sub cl, al
sub cl, 0x51
mov byte [rbp - 0x54], cl
movzx ecx, byte [rbp - 0x53]
movzx eax, cl
and al, 0xa7
add al, al
sub cl, al
sub cl, 0x50
mov byte [rbp - 0x53], cl
movzx ecx, byte [rbp - 0x52]
movzx eax, cl
and al, 0xa8
add al, al
sub cl, al
sub cl, 0x4f
mov byte [rbp - 0x52], cl
movzx ecx, byte [rbp - 0x51]
movzx eax, cl
and al, 0xa9
add al, al
sub cl, al
sub cl, 0x4e
mov byte [rbp - 0x51], cl
movzx ecx, byte [rbp - 0x50]
movzx eax, cl
and al, 0xaa
add al, al
sub cl, al
sub cl, 0x4d
mov byte [rbp - 0x50], cl
movzx ecx, r12b
movzx eax, cl
and al, r8b
add al, al
sub cl, al
sub cl, 0x4c
mov byte [rbp - 0x4f], cl
movzx ecx, byte [rbp - 0x4e]
movzx eax, cl
and al, 0xac
add al, al
sub cl, al
sub cl, 0x4b
mov byte [rbp - 0x4e], cl
movzx ecx, r12b
mov eax, ecx
movabs rdx, 0xe347aa7058d1faad
and rax, rdx
imul rax, rax, 0xfffffffffffffffe
add rax, rdx
add rcx, rax
add cl, 9
mov byte [rbp - 0x4d], cl
movups xmmword [rbp - 0x29], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x19], xmm1
lea rax, [rbp - 0x69]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r12b
jne 0x14000d714
lea rdx, [rbp - 0x69]
lea rcx, [rbp - 0x29]
call fcn.14000e820
nop
lea r8, [rbp - 0x29]
mov rdi, qword [rbp - 0x49]
mov rcx, rdi
call fcn.140005790
mov qword [0x1401e0930], rax
lea rcx, [rbp - 0x29]
call fcn.14000b3e0
nop
lea rcx, [0x1401e0908]
call fcn.1400cdb34
jmp 0x14000d75e
mov rdi, qword [rbp - 0x49]
mov r8, qword [0x1401e0930]
test r8, r8
je 0x14000d7d6
mov r9d, recvfrom
lea rdx, [rbp + 7]
mov rcx, rdi
call fcn.140004bb0
test al, al
je 0x14000d7d6
movzx eax, byte [rbp - 9]
cmp byte [rbp + 7], al
jne 0x14000d7a4
movzx eax, byte [rbp - 8]
cmp byte [rbp + 8], al
jne 0x14000d7a4
movzx eax, byte [rbp + 1]
cmp byte [rbp + 0x11], al
jne 0x14000d7a4
movzx eax, byte [rbp + 2]
cmp byte [rbp + 0x12], al
je 0x14000d7d6
lea r8, [rbp - 9]
mov rdx, qword [0x1401e0930]
mov rcx, rdi
call fcn.140004c60
test al, al
je 0x14000d7d6
mov rcx, qword [rbp - 0x31]
call rbx
lea r8, [rbp + 7]
mov rdx, qword [0x1401e0930]
mov rcx, rdi
call fcn.140004c60
jmp 0x14000d7d8
xor al, al
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.1400cdad0
mov rbx, qword [rsp + 0xf8]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret