Function at 0x140090d20
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by fnv-1a hash
Resolve function by parsing pe exports
Send data
Send data on socket

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x20]
sub rsp, 0x120
xor ebx, ebx
mov edi, r9d
mov rsi, r8
mov r14, rdx
test r9d, r9d
jle 0x140091591
nop word [rax + rax]
mov r8d, edi
lea edx, [rsi + rbx]
sub r8d, ebx
xor r9d, r9d
mov rcx, r14
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jle 0x140090d80
add ebx, eax
cmp ebx, edi
jl 0x140090d50
mov eax, ebx
add rsp, 0x120
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2745
jne 0x140090fbb
movabs rdx, 0xc1ff7e5b1dd80b78
movabs rax, 0xb2e57b4a19c21d7a
mov qword [rsp + 0x30], rdx
movabs rcx, 0xb29612397cac783d
mov qword [rsp + 0x20], rax
movabs rdx, 0x9688d10b39af008e
mov qword [rsp + 0x38], rdx
movabs rax, 0xf8e6be6819cb65e6
mov qword [rsp + 0x28], rax
movabs rdx, 0xe57dcb1846407762
mov qword [rsp + 0x40], rdx
movabs r8, 0xd8463da47e89f2b2
mov qword [rbp - 0x58], rax
movabs rdx, 0x735108e4956ad2c9
mov qword [rsp + 0x48], rdx
movabs rdx, 0x116fe514c24788a4
movdqa xmm1, xmmword [rsp + 0x40]
mov qword [rsp + 0x50], rdx
movabs rdx, 0xcc37e4fa4c15c2cf
mov qword [rbp - 0x48], rax
movabs rax, 0x925da5772f341407
mov qword [rsp + 0x58], rdx
movabs rdx, 0xeb7d96758f8022f9
mov qword [rbp - 0x40], rax
movabs rax, 0x7236786f44aa1a8
mov qword [rsp + 0x60], rdx
movabs rdx, 0x9d336ed572133699
mov qword [rbp - 0x38], rax
movabs rax, 0x791bc56da067ecc1
xorps xmm1, xmmword [rbp - 0x40]
mov qword [rsp + 0x68], rdx
movabs rdx, 0x1851df14928f99c6
mov qword [rbp - 0x30], rax
movabs rax, 0xad40909c2366e2aa
mov qword [rsp + 0x70], rdx
movabs rdx, 0x2056547545bc4ee0
mov qword [rbp - 0x28], rax
movabs rax, 0x8404b61be6a0478b
mov qword [rsp + 0x78], rdx
movabs rdx, 0xb96215e6f8df5523
mov qword [rbp - 0x20], rax
movabs rax, 0xbd471dba1a3344ec
mov qword [rbp - 0x80], rdx
movabs rdx, 0x38cf666270ee8bb1
mov qword [rbp - 0x18], rax
movabs rax, 0x6a34ab61e2e2f6a5
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmm1, xmmword [rsp + 0x60]
xorps xmm1, xmmword [rbp - 0x20]
mov qword [rbp - 0x78], rdx
movabs rdx, 0xcfb364f50159853b
mov qword [rbp - 0x10], rax
movabs rax, 0xde03359f8aab750f
mov qword [rbp], rax
movabs rax, 0x5dbb070e5080e2d0
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmm1, xmmword [rbp - 0x80]
mov qword [rbp + 8], rax
movabs rax, 0xcfb364f50153ab49
xorps xmm1, xmmword [rbp]
mov qword [rbp - 0x60], rcx
movdqa xmm0, xmmword [rbp - 0x60]
xorps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmm0, xmmword [rsp + 0x30]
mov qword [rbp - 0x50], rcx
xorps xmm0, xmmword [rbp - 0x50]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm0, xmmword [rsp + 0x50]
xorps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm0, xmmword [rsp + 0x70]
mov qword [rbp - 0x70], rdx
movabs rdx, 0x4525351029ec6ece
mov qword [rbp - 8], rdx
xorps xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x68], r8
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], r8
movdqa xmmword [rbp - 0x80], xmm1
movdqa xmm0, xmmword [rbp - 0x70]
lea rdx, [rsp + 0x30]
xorps xmm0, xmmword [rbp + 0x10]
movdqa xmmword [rbp - 0x70], xmm0
jmp 0x1400914af
cmp eax, 0x274d
jne 0x1400911f0
movabs rdx, 0xd7f87c561f8c1773
movabs rax, 0xb2e57b4a19c21d7a
mov qword [rsp + 0x30], rdx
movabs rcx, 0xb29612397cac783d
mov qword [rsp + 0x20], rax
movabs rdx, 0x97859e0676a21185
mov qword [rsp + 0x38], rdx
movabs rax, 0xf8e6be6819cb65e6
mov qword [rsp + 0x28], rax
movabs rdx, 0xff7dc0150f507872
movdqa xmm0, xmmword [rsp + 0x20]
movabs r8, 0xd8463da47e89f2b2
mov qword [rsp + 0x40], rdx
movabs rdx, 0x664002e4d42fc5c9
mov qword [rsp + 0x48], rdx
movabs rdx, 0x597ead1980029fb4
movdqa xmm1, xmmword [rsp + 0x40]
mov qword [rsp + 0x50], rdx
movabs rdx, 0xc060e4f9441483de
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x48], rax
movabs rax, 0x925da5772f341407
mov qword [rsp + 0x58], rdx
movabs rdx, 0xe524d3758fc824ea
mov qword [rbp - 0x40], rax
movabs rax, 0x7236786f44aa1a8
mov qword [rsp + 0x60], rdx
movabs rdx, 0x9d3e71df6c5a308f
mov qword [rbp - 0x38], rax
movabs rax, 0x791bc56da067ecc1
xorps xmm1, xmmword [rbp - 0x40]
mov qword [rsp + 0x68], rdx
movabs rdx, 0x4a50ce12978493d7
mov qword [rbp - 0x30], rax
movabs rax, 0xad40909c2366e2aa
mov qword [rsp + 0x70], rdx
movabs rdx, 0x3644594009c21aa7
mov qword [rbp - 0x28], rax
movabs rax, 0x8404b61be6a0478b
mov qword [rsp + 0x78], rdx
movabs rdx, 0xbf234cedfe8b596a
mov qword [rbp - 0x20], rax
movabs rax, 0xbd471dba1a3344ec
mov qword [rbp - 0x80], rdx
movabs rdx, 0x29da6b2e3ee983b7
mov qword [rbp - 0x18], rax
movabs rax, 0x6a34ab61e2e2f6a5
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmm1, xmmword [rsp + 0x60]
xorps xmm1, xmmword [rbp - 0x20]
mov qword [rbp - 0x78], rdx
movabs rdx, 0xcfb364f50b7dd92c
mov qword [rbp - 0x10], rax
movabs rax, 0xde03359f8aab750f
mov qword [rbp], rax
movabs rax, 0x5dbb070e5080e2d0
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmm1, xmmword [rbp - 0x80]
mov qword [rbp + 8], rax
movabs rax, 0xcfb364f50153ab49
xorps xmm1, xmmword [rbp]
mov qword [rbp - 0x60], rcx
xorps xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmm0, xmmword [rsp + 0x30]
mov qword [rbp - 0x50], rcx
xorps xmm0, xmmword [rbp - 0x50]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm0, xmmword [rsp + 0x50]
xorps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm0, xmmword [rsp + 0x70]
mov qword [rbp - 0x70], rdx
movabs rdx, 0x4525351029ec6ece
mov qword [rbp - 8], rdx
xorps xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x68], r8
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], r8
movdqa xmmword [rbp - 0x80], xmm1
movdqa xmm0, xmmword [rbp - 0x70]
lea rdx, [rsp + 0x30]
xorps xmm0, xmmword [rbp + 0x10]
movdqa xmmword [rbp - 0x70], xmm0
jmp 0x1400914af
cmp eax, 0x2746
jne 0x140091399
movabs rdx, 0xdbe2715c12c2177e
movabs rax, 0xb2e57b4a19c21d7a
mov qword [rsp + 0x30], rdx
movabs rcx, 0xb29612397cac783d
mov qword [rsp + 0x20], rax
movabs rdx, 0x9bc6cd096eeb0b89
mov qword [rsp + 0x38], rdx
movabs rax, 0xf8e6be6819cb65e6
mov qword [rsp + 0x28], rax
movabs rdx, 0xeb3f85134a477b6b
movdqa xmm0, xmmword [rsp + 0x20]
mov qword [rsp + 0x40], rdx
movabs rdx, 0x6a4615a69122d588
mov qword [rsp + 0x48], rdx
movabs rdx, 0xd68aa05800298ae
movdqa xmm1, xmmword [rsp + 0x40]
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x48], rax
movabs rax, 0x925da5772f341407
mov qword [rsp + 0x50], rdx
movabs rdx, 0xc833f1f94f36c284
mov qword [rbp - 0x40], rax
movabs rax, 0x7236786f44aa1a8
mov qword [rsp + 0x58], rdx
movabs rdx, 0xe365966294d467a7
mov qword [rbp - 0x38], rax
movabs rax, 0x791bc56da067ecc1
xorps xmm1, xmmword [rbp - 0x40]
mov qword [rsp + 0x60], rdx
movabs rdx, 0xd8337cd63a5d2d8d
mov qword [rbp - 0x30], rax
movabs rax, 0xad40909c2366e2aa
mov qword [rsp + 0x68], rdx
movabs rdx, 0x6a34ab61e2e8d8d7
mov qword [rbp - 0x28], rax
movabs rax, 0x8404b61be6a0478b
mov qword [rsp + 0x70], rdx
movabs rdx, 0x4525351029ec6ece
mov qword [rbp - 0x20], rax
movabs rax, 0xbd471dba1a3344ec
mov qword [rsp + 0x78], rdx
mov qword [rbp - 0x18], rax
movabs rax, 0x6a34ab61e2e2f6a5
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmm1, xmmword [rsp + 0x60]
xorps xmm1, xmmword [rbp - 0x20]
mov qword [rbp - 8], rdx
lea rdx, [rsp + 0x30]
mov qword [rbp - 0x60], rcx
xorps xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmm0, xmmword [rsp + 0x30]
mov qword [rbp - 0x50], rcx
xorps xmm0, xmmword [rbp - 0x50]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm0, xmmword [rsp + 0x50]
xorps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm0, xmmword [rsp + 0x70]
mov qword [rbp - 0x10], rax
xorps xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmmword [rsp + 0x60], xmm1
jmp 0x1400914af
cmp eax, 0x274c
jne 0x1400914c2
movabs rdx, 0xdbe2715c12c2177e
movabs rax, 0xb2e57b4a19c21d7a
mov qword [rbp - 0x50], rdx
movabs rcx, 0xb29612397cac783d
mov qword [rsp + 0x20], rax
movabs rdx, 0x9c83d3016deb0b89
mov qword [rbp - 0x48], rdx
movabs rax, 0xf8e6be6819cb65e6
mov qword [rsp + 0x28], rax
movabs rdx, 0xfe0d85595b417b27
movdqa xmm0, xmmword [rsp + 0x20]
mov qword [rbp - 0x40], rdx
movabs rdx, 0x755747aa9139c0cd
mov qword [rbp - 0x58], rax
mov qword [rsp + 0x38], rax
movabs rax, 0x925da5772f341407
mov qword [rbp - 0x38], rdx
movabs rdx, 0x5975ac0cc706ccb8
movdqa xmm1, xmmword [rbp - 0x40]
mov qword [rsp + 0x40], rax
movabs rax, 0x7236786f44aa1a8
mov qword [rbp - 0x30], rdx
movabs rdx, 0xad4abeee461283c6
mov qword [rsp + 0x48], rax
movabs rax, 0x791bc56da067ecc1
xorps xmm1, xmmword [rsp + 0x40]
mov qword [rbp - 0x28], rdx
lea rdx, [rbp - 0x50]
mov qword [rsp + 0x50], rax
movabs rax, 0xad40909c2366e2aa
mov qword [rbp - 0x60], rcx
xorps xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmm0, xmmword [rbp - 0x50]
mov qword [rsp + 0x30], rcx
xorps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm0, xmmword [rbp - 0x30]
mov qword [rsp + 0x58], rax
xorps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmmword [rbp - 0x40], xmm1
mov r9d, reloc.WS2_32.dll_recv
lea r8, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov esi, dword [rcx + r10 + 0x88]
add rsi, r10
cmp rsi, r10
je 0x140091557
mov r9d, dword [rsi + 0x18]
test r9d, r9d
je 0x140091557
mov edi, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140091552
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x140091530
cmp r8d, 0x2fa62ca8
je 0x14009155c
test r9d, r9d
jne 0x140091510
mov rax, qword [rax]
jmp 0x1400914e0
mov edx, dword [rsi + 0x24]
mov ecx, 0xfa0
add rdx, r10
movzx r8d, word [rdx + r9*2]
mov edx, dword [rsi + 0x1c]
add rdx, r10
mov eax, dword [rdx + r8*4]
add rax, r10
call rax
mov rcx, r14
call qword [sym.imp.WS2_32.dll_closesocket]
mov rcx, qword [0x1401ff598]
mov rax, qword [rcx]
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
mov eax, ebx
add rsp, 0x120
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret