Function at 0x14009dfb0
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Create thread
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2e0]
sub rsp, 0x3e0
movaps xmmword [rsp + 0x3d0], xmm6
mov rax, qword [0x140365f00]
xor rax, rsp
mov qword [rbp + 0x2c0], rax
mov r13, rdx
mov r12, rcx
mov qword [rbp + 0xa0], rdx
xor r15d, r15d
mov dword [rsp + 0x68], r15d
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8, [fcn.1400938a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8, [0x140093b20]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8, [0x140093f60]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.140093e90
lea rcx, [rbp + 0x128]
call fcn.1400ada60
nop
mov dword [rbp - 0x78], 0x3f272068
mov dword [rbp - 0x74], 0x313d2137
mov word [rbp - 0x70], WSAGetLastError
mov byte [rbp - 0x6e], 1
mov dword [rbp + 0x90], 0x3c312168
mov dword [rbp + 0x94], 0x1006e37
mov dword [rsp + 0x70], 0x22353c68
mov dword [rsp + 0x74], 0x3b3b3a21
mov dword [rsp + 0x78], 0x65333f
mov byte [rsp + 0x7c], 1
mov dword [rbp - 0x58], 0x38272768
mov dword [rbp - 0x54], 0x1006e36
mov dword [rsp + 0x68], 0x28352468
mov word [rsp + 0x6c], reloc.WS2_32.dll_WSAGetLastError
mov byte [rsp + 0x6e], 1
mov dword [rbp + 0xa8], 0x3420363a
mov dword [rbp + 0xac], 0x363d3f6f
mov dword [rbp + 0xb0], 0x3c2b3933
mov word [rbp + 0xb4], 0x100
lea r8, [rsp + 0x68]
lea rdx, [rbp + 0xa8]
lea rcx, [rbp + 0xc8]
call fcn.140089950
nop
mov rdx, r13
cmp qword [r13 + 0x18], 0xf
jbe 0x14009e122
mov rdx, qword [r13]
mov r8, qword [r13 + 0x10]
mov rcx, rax
call fcn.140003620
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x108], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x118], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rbp - 0x58]
lea rdx, [rbp + 0x108]
lea rcx, [rbp - 0x10]
call fcn.140089060
nop
lea rdx, [rbp + 0x128]
cmp qword [rbp + 0x140], 0xf
cmova rdx, qword [rbp + 0x128]
mov r8, qword [rbp + 0x138]
mov rcx, rax
call fcn.140003620
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x20], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rsp + 0x70]
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x70]
call fcn.140089840
nop
lea rdx, [r12 + 0x240]
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x14009e1d4
mov rdx, qword [rdx]
mov rcx, rax
call fcn.140003620
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x60], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rbp + 0x90]
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x30]
call fcn.140089060
nop
mov rdx, r12
cmp qword [r12 + 0x18], 0xf
jbe 0x14009e21e
mov rdx, qword [r12]
mov r8, qword [r12 + 0x10]
mov rcx, rax
call fcn.140003620
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x20], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rbp - 0x78]
lea rdx, [rbp + 0x10]
lea rcx, [rbp - 0x50]
call fcn.140089390
nop
lea rdx, [r12 + 0x20]
cmp qword [r12 + 0x38], 0xf
jbe 0x14009e26d
mov rdx, qword [r12 + 0x20]
mov r8, qword [r12 + 0x30]
mov rcx, rax
call fcn.140003620
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x188], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x198], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x14009e2dc
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009e2d7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14009e2d7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140130784
movdqa xmm6, xmmword [0x14034bf10]
movdqu xmmword [rbp - 0x40], xmm6
mov byte [rbp - 0x50], 0
mov rdx, qword [rbp + 0x28]
cmp rdx, 0xf
jbe 0x14009e32c
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009e326
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14009e326
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140130784
nop
mov rdx, qword [rbp + 0x48]
cmp rdx, 0xf
jbe 0x14009e36a
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009e365
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14009e365
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140130784
movdqu xmmword [rbp + 0x40], xmm6
mov byte [rbp + 0x30], 0
mov rdx, qword [rbp + 0x68]
cmp rdx, 0xf
jbe 0x14009e3b2
inc rdx
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009e3ac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14009e3ac
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140130784
nop
mov rdx, qword [rbp + 0x88]
cmp rdx, 0xf
jbe 0x14009e3f3
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009e3ee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14009e3ee
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140130784
movdqu xmmword [rbp + 0x80], xmm6
mov byte [rbp + 0x70], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x14009e43e
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009e438
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14009e438
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140130784
nop
mov rdx, qword [rbp + 8]
cmp rdx, 0xf
jbe 0x14009e47c
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009e477
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14009e477
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140130784
movdqu xmmword [rbp], xmm6
mov byte [rbp - 0x10], 0
mov rdx, qword [rbp + 0x120]
cmp rdx, 0xf
jbe 0x14009e4ca
inc rdx
mov rcx, qword [rbp + 0x108]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009e4c4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14009e4c4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140130784
nop
mov rdx, qword [rbp + 0xe0]
cmp rdx, 0xf
jbe 0x14009e50e
inc rdx
mov rcx, qword [rbp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009e509
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14009e509
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140130784
movdqu xmmword [rbp + 0xd8], xmm6
mov byte [rbp + 0xc8], 0
lea rax, [rbp + 0x108]
mov qword [rbp - 0x68], rax
lea rdx, [r12 + 0x60]
lea rcx, [rbp + 0x108]
call fcn.14000cc10
mov rbx, rax
lea rdx, [rbp + 0x188]
lea rcx, [rbp - 0x30]
call fcn.14000cc10
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x148]
call fcn.1400a49f0
nop
lea rax, [rbp + 0xa8]
mov qword [rsp + 0x58], rax
lea rdx, [rbp + 0x148]
cmp qword [rbp + 0x160], 0xf
cmova rdx, qword [rbp + 0x148]
xorps xmm0, xmm0
movups xmmword [rbp + 0xa8], xmm0
mov qword [rbp + 0xb8], r15
mov qword [rbp + 0xc0], r15
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x14009e5a2
lea rcx, [rbp + 0xa8]
call fcn.1400042a0
nop
lea rax, [rbp + 0xc8]
mov qword [rbp - 0x68], rax
lea rdx, [0x140365040]
lea rcx, [rbp + 0xc8]
call fcn.14000cc10
mov rbx, rax
lea rdx, [0x140365020]
lea rcx, [rbp - 0x10]
call fcn.14000cc10
nop
lea r8, [rbp + 0xa8]
mov rdx, rbx
mov rcx, rax
call fcn.140091920
xor eax, 0xa5a5
mov edx, eax
shr eax, 8
movzx r8d, al
movzx eax, dl
movabs r14, 0xcbf29ce484222325
xor rax, r14
movabs rsi, 0x100000001b3
imul rax, rsi
xor r8, rax
imul r8, rsi
mov eax, edx
shr eax, 0x10
movzx ecx, al
xor r8, rcx
imul r8, rsi
shr rdx, 0x18
xor r8, rdx
imul r8, rsi
cmp r8w, 0xdf7f
jne 0x14009f343
mov qword [rbp + 0x100], r15
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0xc8]
lea rdx, [rbp + 0x148]
lea rcx, [rbp + 0xa8]
call fcn.14008d950
nop
lea rdx, [r12 + 0x20]
lea rcx, [rsp + 0x70]
call fcn.140088820
nop
mov dword [rsp + 0x5c], 0x646972
mov dword [rsp + 0x58], 0x656e776f
mov byte [rsp + 0x60], 0
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x5f]
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x50]
call fcn.140004e40
nop
movzx ecx, byte [rbp + 0xa8]
test cl, cl
jne 0x14009e6e5
mov byte [rbp + 0xa8], 1
call fcn.14008bdd0
mov qword [rbp + 0xb0], rax
movzx ecx, byte [rbp + 0xa8]
jmp 0x14009e6ec
mov rax, qword [rbp + 0xb0]
cmp cl, 1
jne 0x14009e6ff
lea rdx, [rbp - 0x50]
mov rcx, rax
call fcn.140091170
jmp 0x14009e704
mov rax, qword [rsp + 0x58]
lea rdx, [rsp + 0x70]
mov rcx, rax
call fcn.140090da0
movzx ebx, al
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x14009e752
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009e74d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14009e74d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140130784
movdqu xmmword [rbp - 0x40], xmm6
mov byte [rbp - 0x50], 0
movzx edx, byte [rsp + 0x70]
lea rcx, [rsp + 0x78]
call fcn.140097a60
test bl, bl
jne 0x14009e829
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14009e806
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14009e806
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0xbf828103
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14009e801
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14009e7e0
cmp r8d, 0x13f82533
je 0x14009e80b
test r9d, r9d
jne 0x14009e7c0
mov rax, qword [rax]
jmp 0x14009e790
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov ecx, 8
call rdx
mov dword [rbp - 0x64], 0x656761
mov dword [rbp - 0x68], 0x7373656d
mov byte [rbp - 0x60], 0
lea r9, [rsp + 0x50]
lea r8, [rbp - 0x61]
lea rdx, [rbp - 0x68]
lea rcx, [rbp - 0x50]
call fcn.140004e40
nop
movzx ecx, byte [rbp + 0xa8]
test cl, cl
jne 0x14009e879
mov byte [rbp + 0xa8], 1
call fcn.14008bdd0
mov qword [rbp + 0xb0], rax
movzx ecx, byte [rbp + 0xa8]
jmp 0x14009e880
mov rax, qword [rbp + 0xb0]
cmp cl, 1
jne 0x14009e893
lea rdx, [rbp - 0x50]
mov rcx, rax
call fcn.140091170
jmp 0x14009e898
mov rax, qword [rsp + 0x58]
xorps xmm0, xmm0
movups xmmword [rbp + 0x168], xmm0
movdqu xmmword [rbp + 0x178], xmm6
mov byte [rbp + 0x168], 0
mov dword [rsp + 0x68], 0x17fc
cmp byte [rax], 3
jne 0x14009e8d0
mov rdx, qword [rax + 8]
lea rax, [rbp + 0x168]
cmp rax, rdx
je 0x14009e8ee
jmp 0x14009e8d3
mov rdx, r15
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x14009e8e1
mov rdx, qword [rdx]
lea rcx, [rbp + 0x168]
call fcn.14000dae0
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x14009e92c
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009e927
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14009e927
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140130784
movdqu xmmword [rbp - 0x40], xmm6
mov byte [rbp - 0x50], 0
mov word [rsp + 0x6b], 0x65
mov word [rsp + 0x68], 0x6f63
mov byte [rsp + 0x6a], 0x64
mov byte [rsp + 0x6d], 0
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x6c]
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0xc8]
call fcn.140004e40
nop
movzx ecx, byte [rbp + 0xa8]
test cl, cl
jne 0x14009e990
mov byte [rbp + 0xa8], 1
call fcn.14008bdd0
mov qword [rbp + 0xb0], rax
movzx ecx, byte [rbp + 0xa8]
jmp 0x14009e997
mov rax, qword [rbp + 0xb0]
cmp cl, 1
jne 0x14009e9ad
lea rdx, [rbp + 0xc8]
mov rcx, rax
call fcn.140091170
jmp 0x14009e9b2
mov rax, qword [rsp + 0x58]
mov rcx, rax
call fcn.140088dc0
mov edx, eax
shr eax, 8
movzx edi, al
movzx eax, dl
xor rax, r14
imul rax, rsi
xor rdi, rax
imul rdi, rsi
mov eax, edx
shr eax, 0x10
movzx ecx, al
xor rdi, rcx
imul rdi, rsi
shr rdx, 0x18
xor rdi, rdx
imul rdi, rsi
mov r8, qword [rbp + 0xe0]
cmp r8, 0xf
jbe 0x14009ea0d
mov rdx, qword [rbp + 0xc8]
lea rcx, [rbp + 0xc8]
call fcn.140003e40
mov dword [rsp + 0x5c], 0x737365
mov dword [rsp + 0x58], 0x63637573
mov byte [rsp + 0x60], 0
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x5f]
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x108]
call fcn.140004e40
nop
mov ebx, 0x1effd
mov dword [rsp + 0x68], ebx
movzx ecx, byte [rbp + 0xa8]
test cl, cl
jne 0x14009ea6e
mov byte [rbp + 0xa8], 1
call fcn.14008bdd0
mov qword [rbp + 0xb0], rax
movzx ecx, byte [rbp + 0xa8]
jmp 0x14009ea75
mov rax, qword [rbp + 0xb0]
cmp cl, 1
jne 0x14009ea8e
lea rdx, [rbp + 0x108]
mov rcx, rax
call fcn.140091170
mov rcx, rax
jmp 0x14009ea93
mov rcx, qword [rsp + 0x58]
lea rax, [rcx + 8]
cmp byte [rcx], 4
cmovne rax, r15
cmp byte [rax], 0
je 0x14009eb5b
mov dword [rbp + 0x94], 0x737365
mov dword [rbp + 0x90], 0x63637573
mov byte [rbp + 0x98], 0
lea r9, [rsp + 0x50]
lea r8, [rbp + 0x97]
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0xc8]
call fcn.140004e40
nop
mov ebx, 0x19efff
mov dword [rsp + 0x68], ebx
movzx ecx, byte [rbp + 0xa8]
test cl, cl
jne 0x14009eb12
mov byte [rbp + 0xa8], 1
call fcn.14008bdd0
mov qword [rbp + 0xb0], rax
movzx ecx, byte [rbp + 0xa8]
jmp 0x14009eb19
mov rax, qword [rbp + 0xb0]
cmp cl, 1
jne 0x14009eb32
lea rdx, [rbp + 0xc8]
mov rcx, rax
call fcn.140091170
mov rcx, rax
jmp 0x14009eb37
mov rcx, qword [rsp + 0x58]
lea rax, [rcx + 8]
cmp byte [rcx], 4
cmovne rax, r15
cmp byte [rax], 0
je 0x14009eb56
movabs rax, 0xcbe5c873d26645f1
cmp rdi, rax
je 0x14009eb5b
xor dil, dil
jmp 0x14009eb5e
mov dil, 1
test bl, 2
je 0x14009eb73
and ebx, 0xfffffffd
lea rcx, [rbp + 0xc8]
call fcn.140003410
nop
test bl, 1
je 0x14009eb84
lea rcx, [rbp + 0x108]
call fcn.140003410
test dil, dil
je 0x14009f259
lea rdx, [rbp + 0xa8]
lea rcx, [rsp + 0x70]
call fcn.14008ff40
mov rdx, rax
mov rcx, r12
call fcn.14009f990
mov dword [rsp + 0x5c], 0x737365
mov dword [rsp + 0x58], 0x63637573
mov byte [rsp + 0x60], 0
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x5f]
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0xc8]
call fcn.140004e40
nop
movzx ecx, byte [rbp + 0xa8]
test cl, cl
jne 0x14009ec01
mov byte [rbp + 0xa8], 1
call fcn.14008bdd0
mov qword [rbp + 0xb0], rax
movzx ecx, byte [rbp + 0xa8]
jmp 0x14009ec08
mov rax, qword [rbp + 0xb0]
cmp cl, 1
jne 0x14009ec21
lea rdx, [rbp + 0xc8]
mov rcx, rax
call fcn.140091170
mov rcx, rax
jmp 0x14009ec26
mov rcx, qword [rsp + 0x58]
lea rax, [rcx + 8]
cmp byte [rcx], 4
cmovne rax, r15
movzx ebx, byte [rax]
lea rcx, [rbp + 0xc8]
call fcn.140003410
test bl, bl
je 0x14009ecea
mov word [rsp + 0x6b], reloc.WS2_32.dll_WSAGetLastError
mov word [rsp + 0x68], 0x6e69
mov byte [rsp + 0x6a], 0x66
mov byte [rsp + 0x6d], 0
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x6c]
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0xc8]
call fcn.140004e40
nop
movzx ecx, byte [rbp + 0xa8]
test cl, cl
jne 0x14009eca3
mov byte [rbp + 0xa8], 1
call fcn.14008bdd0
mov qword [rbp + 0xb0], rax
movzx ecx, byte [rbp + 0xa8]
jmp 0x14009ecaa
mov rax, qword [rbp + 0xb0]
cmp cl, 1
jne 0x14009ecc0
lea rdx, [rbp + 0xc8]
mov rcx, rax
call fcn.140091170
jmp 0x14009ecc5
mov rax, qword [rsp + 0x58]
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.14008ff40
mov rdx, rax
mov rcx, r12
call fcn.14009fd60
nop
lea rcx, [rbp + 0xc8]
call fcn.140003410
mov dword [rsp + 0x70], 0x25392107
mov dword [rsp + 0x74], 0x3c38323b
mov dword [rsp + 0x78], 0x3c322c
mov byte [rsp + 0x7c], 1
lea rcx, [rsp + 0x70]
call fcn.140092c20
mov rdx, rax
lea rcx, [r12 + 0x218]
call fcn.140088a90
test al, al
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
je 0x14009f1c0
lea r15, [section..data]
mov rsi, r15
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
cmova rsi, qword [section..data]
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14009edd6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14009edd6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x5b9ebec8
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14009edd1
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14009edb0
cmp r8d, 0x2dab9182
je 0x14009eddb
test r9d, r9d
jne 0x14009ed90
mov rax, qword [rax]
jmp 0x14009ed60
mov edx, dword [rdi + 0x1c]
add rdx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rdx + rax*4]
add rdx, r10
mov rcx, rsi
call rdx
movdqa xmm0, xmmword [0x140138e70]
movdqu xmmword [rsp + 0x70], xmm0
mov byte [rbp - 0x80], 1
lea rcx, [rsp + 0x70]
call fcn.140092bd0
mov rdx, rax
mov r8, r15
lea rcx, [rbp + 0x108]
call fcn.140088f00
nop
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x1b0]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 2
lea rdx, [rbp + 0x108]
lea rcx, [rbp + 0x1b0]
call fcn.140033be0
nop
cmp qword [rbp + 0x238], 0
je 0x14009ee9e
mov rdx, r15
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
cmova rdx, qword [section..data]
mov r8, qword [0x140365010]
lea rcx, [rbp + 0x1b0]
call fcn.140036bc0
lea rcx, [rbp + 0x1b0]
call fcn.140033ba0
mov dword [rbp - 0x78], 0x2536201d
mov dword [rbp - 0x74], 0x30263225
mov word [rbp - 0x70], 0xa
mov byte [rbp - 0x6e], 1
lea rcx, [rbp - 0x78]
call fcn.140092b90
mov rdx, rax
mov r8, r15
lea rcx, [rbp + 0xc8]
call fcn.140088f00
nop
lea rdx, [rbp + 0xc8]
cmp qword [rbp + 0xe0], 0xf
cmova rdx, qword [rbp + 0xc8]
xor ecx, ecx
mov qword [rsp + 0x40], rcx
lea rax, [rbp + 0x90]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], ecx
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14009f0cb
mov r14, qword [0x140365010]
inc r14
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
jbe 0x14009ef43
mov r15, qword [section..data]
mov rsi, r15
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov edi, dword [rcx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x14009efd6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14009efd6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r11 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r11
mov r8d, 0xe7dc4765
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14009efd1
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14009efb0
cmp r8d, 0x3a1d8c3c
je 0x14009efdb
test r9d, r9d
jne 0x14009ef90
mov rax, qword [rax]
jmp 0x14009ef60
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r15
mov r9d, 1
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rbp + 0x90]
call r10
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14009f0a6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14009f0a6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0xcb69bf33
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14009f0a1
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14009f080
cmp r8d, 0x88a1ffec
je 0x14009f0ab
test r9d, r9d
jne 0x14009f060
mov rax, qword [rax]
jmp 0x14009f030
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov rcx, qword [rbp + 0x90]
call rdx
lea rsi, [r12 + 0x20]
cmp qword [rsi + 0x18], 0xf
jbe 0x14009f0da
mov rsi, qword [rsi]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14009f166
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14009f166
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0xc3be7ca3
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14009f161
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14009f140
cmp r8d, 0xce9b4371
je 0x14009f16b
test r9d, r9d
jne 0x14009f120
mov rax, qword [rax]
jmp 0x14009f0f0
mov edx, dword [rdi + 0x1c]
add rdx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rdx + rax*4]
add rdx, r10
mov rcx, rsi
call rdx
nop
lea rcx, [rbp + 0xc8]
call fcn.140003410
nop
lea rcx, [rbp + 0x1b0]
call fcn.14002f860
nop
lea rcx, [rbp + 0x108]
call fcn.140003410
xor r15d, r15d
jmp 0x14009f30a
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14009f236
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14009f236
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x719228c2
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14009f231
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14009f210
cmp r8d, 0xbce7f21a
je 0x14009f23b
test r9d, r9d
jne 0x14009f1f0
mov rax, qword [rax]
jmp 0x14009f1c0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
mov ecx, ntohs
jmp 0x14009f304
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14009f2e6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14009f2e6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x361917a1
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14009f2e1
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14009f2c0
cmp r8d, 0xac97a41
je 0x14009f2eb
test r9d, r9d
jne 0x14009f2a0
mov rax, qword [rax]
jmp 0x14009f270
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
mov ecx, 9
add rdx, r10
call rdx
nop
mov r8, qword [rbp + 0x180]
cmp r8, 0xf
jbe 0x14009f32b
mov rdx, qword [rbp + 0x168]
lea rcx, [rbp + 0x168]
call fcn.140003e40
nop
movzx edx, byte [rbp + 0xa8]
lea rcx, [rbp + 0xb0]
call fcn.140097a60
jmp 0x14009f3fa
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14009f3d6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14009f3d6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
mov r8d, 0x66780e14
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14009f3d1
nop
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x14009f3b0
cmp r8d, 0xd30fb724
je 0x14009f3db
test r9d, r9d
jne 0x14009f390
mov rax, qword [rax]
jmp 0x14009f360
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov ecx, 7
call rdx
nop
mov rdx, qword [rbp + 0x160]
cmp rdx, 0xf
jbe 0x14009f43e
inc rdx
mov rcx, qword [rbp + 0x148]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009f439
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14009f439
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140130784
movdqu xmmword [rbp + 0x158], xmm6
mov byte [rbp + 0x148], 0
mov rdx, qword [rbp + 0x1a0]
cmp rdx, 0xf
jbe 0x14009f492
inc rdx
mov rcx, qword [rbp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009f48c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14009f48c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140130784
nop
mov rdx, qword [rbp + 0x140]
cmp rdx, 0xf
jbe 0x14009f4d6
inc rdx
mov rcx, qword [rbp + 0x128]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009f4d1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14009f4d1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140130784
mov qword [rbp + 0x138], r15
mov qword [rbp + 0x140], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x128], 0
mov rdx, qword [r13 + 0x18]
cmp rdx, 0xf
jbe 0x14009f526
inc rdx
mov rcx, qword [r13]
cmp rdx, 0x1000
jb 0x14009f521
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14009f569
mov rcx, r8
call fcn.140130784
mov qword [r13 + 0x10], r15
mov qword [r13 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r13], 0
mov rcx, qword [rbp + 0x2c0]
xor rcx, rsp
call fcn.1401304e0
mov rbx, qword [rsp + 0x430]
movaps xmm6, xmmword [rsp + 0x3d0]
add rsp, 0x3e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3