Function at 0x1400b5000
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x330]
sub rsp, 0x430
movaps xmmword [rsp + 0x420], xmm6
mov rax, qword [0x140379f00]
xor rax, rsp
mov qword [rbp + 0x310], rax
mov rsi, r8
mov qword [rbp - 0x20], r8
mov r13, rdx
mov r12, rcx
mov qword [rbp + 0xf8], rdx
mov qword [rbp + 0x100], r8
xor r14d, r14d
mov dword [rsp + 0x68], r14d
call fcn.1400aa040
lea rcx, [rbp + 0x178]
call fcn.1400bfb60
nop
mov dword [rbp - 0x78], 0x3f272068
mov dword [rbp - 0x74], 0x313d2137
mov word [rbp - 0x70], WSASetLastError
mov byte [rbp - 0x6e], 1
mov dword [rbp + 0xe8], 0x3c312168
mov dword [rbp + 0xec], 0x1006e37
mov dword [rsp + 0x70], 0x22353c68
mov dword [rsp + 0x74], 0x3b3b3a21
mov dword [rsp + 0x78], 0x65333f
mov byte [rsp + 0x7c], 1
mov dword [rbp - 0x58], 0x38272768
mov dword [rbp - 0x54], 0x1006e36
mov dword [rsp + 0x68], 0x22313f68
mov dword [rsp + 0x6c], 0x1006e21
mov dword [rbp - 0x50], 0x34233a68
mov dword [rbp - 0x4c], 0x38353d20
mov dword [rbp - 0x48], 0x1006a33
mov dword [rbp + 0x108], 0x3420363a
mov dword [rbp + 0x10c], 0x323b3f6f
mov dword [rbp + 0x110], 0x100393f
lea r8, [rbp - 0x50]
lea rdx, [rbp + 0x108]
lea rcx, [rbp + 0x118]
call fcn.1400a01a0
nop
mov rdx, r13
cmp qword [r13 + 0x18], 0xf
jbe 0x1400b512d
mov rdx, qword [r13]
mov r8, qword [r13 + 0x10]
mov rcx, rax
call fcn.140005640
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x158], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x168], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rsp + 0x68]
lea rdx, [rbp + 0x158]
lea rcx, [rbp + 8]
call fcn.14009fd80
nop
mov rdx, rsi
cmp qword [rsi + 0x18], 0xf
jbe 0x1400b5180
mov rdx, qword [rsi]
mov r8, qword [rsi + 0x10]
mov rcx, rax
call fcn.140005640
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x18], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 8], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rbp - 0x58]
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0xc8]
call fcn.14009fd80
nop
lea rdx, [rbp + 0x178]
cmp qword [rbp + 0x190], 0xf
cmova rdx, qword [rbp + 0x178]
mov r8, qword [rbp + 0x188]
mov rcx, rax
call fcn.140005640
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xa8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xb8], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rsp + 0x70]
lea rdx, [rbp + 0xa8]
lea rcx, [rbp + 0x88]
call fcn.1400a0470
nop
lea rdx, [r12 + 0x240]
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x1400b5238
mov rdx, qword [rdx]
mov rcx, rax
call fcn.140005640
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x78], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rbp + 0xe8]
lea rdx, [rbp + 0x68]
lea rcx, [rbp + 0x48]
call fcn.14009fd80
nop
mov rdx, r12
cmp qword [r12 + 0x18], 0xf
jbe 0x1400b5282
mov rdx, qword [r12]
mov r8, qword [r12 + 0x10]
mov rcx, rax
call fcn.140005640
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x28], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x38], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rbp - 0x78]
lea rdx, [rbp + 0x28]
lea rcx, [rbp - 0x40]
call fcn.14009ffc0
nop
lea rdx, [r12 + 0x20]
cmp qword [r12 + 0x38], 0xf
jbe 0x1400b52d1
mov rdx, qword [r12 + 0x20]
mov r8, qword [r12 + 0x30]
mov rcx, rax
call fcn.140005640
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1d8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1e8], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x1400b5340
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b533b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400b533b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140142874
movdqa xmm6, xmmword [0x14014b4a0]
movdqu xmmword [rbp - 0x30], xmm6
mov byte [rbp - 0x40], 0
mov rdx, qword [rbp + 0x40]
cmp rdx, 0xf
jbe 0x1400b5390
inc rdx
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b538a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400b538a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140142874
nop
mov rdx, qword [rbp + 0x60]
cmp rdx, 0xf
jbe 0x1400b53ce
inc rdx
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b53c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400b53c9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140142874
movdqu xmmword [rbp + 0x58], xmm6
mov byte [rbp + 0x48], 0
mov rdx, qword [rbp + 0x80]
cmp rdx, 0xf
jbe 0x1400b5419
inc rdx
mov rcx, qword [rbp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b5413
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400b5413
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140142874
nop
mov rdx, qword [rbp + 0xa0]
cmp rdx, 0xf
jbe 0x1400b545d
inc rdx
mov rcx, qword [rbp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b5458
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400b5458
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140142874
movdqu xmmword [rbp + 0x98], xmm6
mov byte [rbp + 0x88], 0
mov rdx, qword [rbp + 0xc0]
cmp rdx, 0xf
jbe 0x1400b54b1
inc rdx
mov rcx, qword [rbp + 0xa8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b54ab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400b54ab
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140142874
nop
mov rdx, qword [rbp + 0xe0]
cmp rdx, 0xf
jbe 0x1400b54f5
inc rdx
mov rcx, qword [rbp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b54f0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400b54f0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140142874
movdqu xmmword [rbp + 0xd8], xmm6
mov byte [rbp + 0xc8], 0
mov rdx, qword [rbp]
cmp rdx, 0xf
jbe 0x1400b5543
inc rdx
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b553d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400b553d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140142874
nop
mov rdx, qword [rbp + 0x20]
cmp rdx, 0xf
jbe 0x1400b5581
inc rdx
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b557c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400b557c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140142874
movdqu xmmword [rbp + 0x18], xmm6
mov byte [rbp + 8], 0
mov rdx, qword [rbp + 0x170]
cmp rdx, 0xf
jbe 0x1400b55cf
inc rdx
mov rcx, qword [rbp + 0x158]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b55c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400b55c9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140142874
nop
mov rdx, qword [rbp + 0x130]
cmp rdx, 0xf
jbe 0x1400b5613
inc rdx
mov rcx, qword [rbp + 0x118]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b560e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400b560e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140142874
movdqu xmmword [rbp + 0x128], xmm6
mov byte [rbp + 0x118], 0
lea rax, [rbp + 0x158]
mov qword [rbp - 0x68], rax
lea rdx, [r12 + 0x60]
lea rcx, [rbp + 0x158]
call fcn.14000b140
mov rbx, rax
lea rdx, [rbp + 0x1d8]
lea rcx, [rbp - 0x18]
call fcn.14000b140
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x198]
call fcn.1400b7a30
nop
lea rax, [rbp - 0x40]
mov qword [rsp + 0x58], rax
lea rdx, [rbp + 0x198]
cmp qword [rbp + 0x1b0], 0xf
cmova rdx, qword [rbp + 0x198]
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], r14
mov r14, 0xffffffffffffffff
mov r8, r14
nop
inc r8
cmp byte [rdx + r8], 0
jne 0x1400b56a0
lea rcx, [rbp - 0x40]
call fcn.140006390
nop
lea rax, [rbp + 0x118]
mov qword [rbp - 0x68], rax
lea rdx, [0x140379040]
lea rcx, [rbp + 0x118]
call fcn.14000b140
mov rbx, rax
lea rdx, [0x140379020]
lea rcx, [rbp + 8]
call fcn.14000b140
nop
lea r8, [rbp - 0x40]
mov rdx, rbx
mov rcx, rax
call fcn.1400a7eb0
xor eax, 0xa5a5
mov edx, eax
shr eax, 8
movzx r8d, al
movzx eax, dl
movabs rcx, 0xcbf29ce484222325
xor rax, rcx
movabs r15, 0x100000001b3
imul rax, r15
xor r8, rax
imul r8, r15
mov eax, edx
shr eax, 0x10
movzx ecx, al
xor r8, rcx
imul r8, r15
shr rdx, 0x18
xor r8, rdx
imul r8, r15
cmp r8w, 0xdf7f
jne 0x1400b644f
mov qword [rbp + 0x150], 0
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x118]
lea rdx, [rbp + 0x198]
lea rcx, [rbp + 0x108]
call fcn.1400a40c0
nop
lea rdx, [r12 + 0x20]
lea rcx, [rsp + 0x70]
call fcn.14009f710
nop
mov dword [rsp + 0x5c], 0x646972
mov dword [rsp + 0x58], 0x656e776f
mov byte [rsp + 0x60], 0
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x5f]
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x40]
call fcn.140006de0
nop
movzx ecx, byte [rbp + 0x108]
test cl, cl
jne 0x1400b57e1
mov byte [rbp + 0x108], 1
call fcn.1400a2540
mov qword [rbp + 0x110], rax
movzx ecx, byte [rbp + 0x108]
jmp 0x1400b57e8
mov rax, qword [rbp + 0x110]
cmp cl, 1
jne 0x1400b57fb
lea rdx, [rbp - 0x40]
mov rcx, rax
call fcn.1400a7890
jmp 0x1400b5800
mov rax, qword [rsp + 0x58]
lea rdx, [rsp + 0x70]
mov rcx, rax
call fcn.1400a74c0
movzx ebx, al
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x1400b584e
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b5849
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400b5849
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140142874
movdqu xmmword [rbp - 0x30], xmm6
mov byte [rbp - 0x40], 0
movzx edx, byte [rsp + 0x70]
lea rcx, [rsp + 0x78]
call fcn.1400ad7f0
test bl, bl
jne 0x1400b5919
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400b58f6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400b58f6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x57430118
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400b58f1
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400b58d0
cmp r8d, 0x7950eb68
je 0x1400b58fb
test r9d, r9d
jne 0x1400b58b0
mov rax, qword [rax]
jmp 0x1400b5880
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov ecx, 8
call rdx
mov dword [rbp - 0x64], 0x656761
mov dword [rbp - 0x68], 0x7373656d
mov byte [rbp - 0x60], 0
lea r9, [rsp + 0x50]
lea r8, [rbp - 0x61]
lea rdx, [rbp - 0x68]
lea rcx, [rbp - 0x40]
call fcn.140006de0
nop
movzx ecx, byte [rbp + 0x108]
test cl, cl
jne 0x1400b5969
mov byte [rbp + 0x108], 1
call fcn.1400a2540
mov qword [rbp + 0x110], rax
movzx ecx, byte [rbp + 0x108]
jmp 0x1400b5970
mov rax, qword [rbp + 0x110]
cmp cl, 1
jne 0x1400b5983
lea rdx, [rbp - 0x40]
mov rcx, rax
call fcn.1400a7890
jmp 0x1400b5988
mov rax, qword [rsp + 0x58]
xorps xmm0, xmm0
movups xmmword [rbp + 0x1b8], xmm0
movdqu xmmword [rbp + 0x1c8], xmm6
mov byte [rbp + 0x1b8], 0
mov dword [rsp + 0x68], 0x2ffc
cmp byte [rax], 3
jne 0x1400b59c0
mov rdx, qword [rax + 8]
lea rax, [rbp + 0x1b8]
cmp rax, rdx
je 0x1400b59dd
jmp 0x1400b59c2
xor edx, edx
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x1400b59d0
mov rdx, qword [rdx]
lea rcx, [rbp + 0x1b8]
call fcn.14000b350
nop
mov r8, qword [rbp - 0x28]
cmp r8, 0xf
jbe 0x1400b59f4
mov rdx, qword [rbp - 0x40]
lea rcx, [rbp - 0x40]
call fcn.140005e00
movdqu xmmword [rbp - 0x30], xmm6
mov byte [rbp - 0x40], 0
mov word [rsp + 0x6b], 0x65
mov word [rsp + 0x68], 0x6f63
mov byte [rsp + 0x6a], 0x64
mov byte [rsp + 0x6d], 0
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x6c]
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x118]
call fcn.140006de0
nop
movzx ecx, byte [rbp + 0x108]
test cl, cl
jne 0x1400b5a58
mov byte [rbp + 0x108], 1
call fcn.1400a2540
mov qword [rbp + 0x110], rax
movzx ecx, byte [rbp + 0x108]
jmp 0x1400b5a5f
mov rax, qword [rbp + 0x110]
cmp cl, 1
jne 0x1400b5a75
lea rdx, [rbp + 0x118]
mov rcx, rax
call fcn.1400a7890
jmp 0x1400b5a7a
mov rax, qword [rsp + 0x58]
mov rcx, rax
call fcn.14009fcb0
mov edx, eax
shr eax, 8
movzx edi, al
movzx eax, dl
movabs rcx, 0xcbf29ce484222325
xor rax, rcx
imul rax, r15
xor rdi, rax
imul rdi, r15
mov eax, edx
shr eax, 0x10
movzx ecx, al
xor rdi, rcx
imul rdi, r15
shr rdx, 0x18
xor rdi, rdx
imul rdi, r15
mov r8, qword [rbp + 0x130]
cmp r8, 0xf
jbe 0x1400b5adf
mov rdx, qword [rbp + 0x118]
lea rcx, [rbp + 0x118]
call fcn.140005e00
mov dword [rsp + 0x5c], 0x737365
mov dword [rsp + 0x58], 0x63637573
mov byte [rsp + 0x60], 0
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x5f]
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x158]
call fcn.140006de0
nop
mov ebx, 0x3dffd
mov dword [rsp + 0x68], ebx
movzx ecx, byte [rbp + 0x108]
test cl, cl
jne 0x1400b5b40
mov byte [rbp + 0x108], 1
call fcn.1400a2540
mov qword [rbp + 0x110], rax
movzx ecx, byte [rbp + 0x108]
jmp 0x1400b5b47
mov rax, qword [rbp + 0x110]
cmp cl, 1
jne 0x1400b5b60
lea rdx, [rbp + 0x158]
mov rcx, rax
call fcn.1400a7890
mov rcx, rax
jmp 0x1400b5b65
mov rcx, qword [rsp + 0x58]
lea rax, [rcx + 8]
cmp byte [rcx], 4
mov r15d, 0
cmovne rax, r15
cmp byte [rax], r15b
je 0x1400b5c33
mov dword [rbp + 0xec], 0x737365
mov dword [rbp + 0xe8], 0x63637573
mov byte [rbp + 0xf0], r15b
lea r9, [rsp + 0x50]
lea r8, [rbp + 0xef]
lea rdx, [rbp + 0xe8]
lea rcx, [rbp + 0x118]
call fcn.140006de0
nop
mov ebx, 0x33dfff
mov dword [rsp + 0x68], ebx
movzx ecx, byte [rbp + 0x108]
test cl, cl
jne 0x1400b5bea
mov byte [rbp + 0x108], 1
call fcn.1400a2540
mov qword [rbp + 0x110], rax
movzx ecx, byte [rbp + 0x108]
jmp 0x1400b5bf1
mov rax, qword [rbp + 0x110]
cmp cl, 1
jne 0x1400b5c0a
lea rdx, [rbp + 0x118]
mov rcx, rax
call fcn.1400a7890
mov rcx, rax
jmp 0x1400b5c0f
mov rcx, qword [rsp + 0x58]
lea rax, [rcx + 8]
cmp byte [rcx], 4
cmovne rax, r15
cmp byte [rax], 0
je 0x1400b5c2e
movabs rax, 0xcbe5c873d26645f1
cmp rdi, rax
je 0x1400b5c33
xor dil, dil
jmp 0x1400b5c36
mov dil, 1
test bl, 2
je 0x1400b5c4b
and ebx, 0xfffffffd
lea rcx, [rbp + 0x118]
call fcn.1400053c0
nop
test bl, 1
je 0x1400b5c5c
lea rcx, [rbp + 0x158]
call fcn.1400053c0
test dil, dil
je 0x1400b6379
lea rdx, [rbp + 0x108]
lea rcx, [rsp + 0x70]
call fcn.1400a66b0
mov rdx, rax
mov rcx, r12
call fcn.1400b4160
mov dword [rsp + 0x5c], 0x737365
mov dword [rsp + 0x58], 0x63637573
mov byte [rsp + 0x60], 0
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x5f]
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x118]
call fcn.140006de0
nop
movzx ecx, byte [rbp + 0x108]
test cl, cl
jne 0x1400b5cd9
mov byte [rbp + 0x108], 1
call fcn.1400a2540
mov qword [rbp + 0x110], rax
movzx ecx, byte [rbp + 0x108]
jmp 0x1400b5ce0
mov rax, qword [rbp + 0x110]
cmp cl, 1
jne 0x1400b5cf9
lea rdx, [rbp + 0x118]
mov rcx, rax
call fcn.1400a7890
mov rcx, rax
jmp 0x1400b5cfe
mov rcx, qword [rsp + 0x58]
lea rax, [rcx + 8]
cmp byte [rcx], 4
cmovne rax, r15
movzx ebx, byte [rax]
lea rcx, [rbp + 0x118]
call fcn.1400053c0
test bl, bl
je 0x1400b5dc2
mov word [rsp + 0x6b], reloc.WS2_32.dll_WSAGetLastError
mov word [rsp + 0x68], 0x6e69
mov byte [rsp + 0x6a], 0x66
mov byte [rsp + 0x6d], 0
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x6c]
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x118]
call fcn.140006de0
nop
movzx ecx, byte [rbp + 0x108]
test cl, cl
jne 0x1400b5d7b
mov byte [rbp + 0x108], 1
call fcn.1400a2540
mov qword [rbp + 0x110], rax
movzx ecx, byte [rbp + 0x108]
jmp 0x1400b5d82
mov rax, qword [rbp + 0x110]
cmp cl, 1
jne 0x1400b5d98
lea rdx, [rbp + 0x118]
mov rcx, rax
call fcn.1400a7890
jmp 0x1400b5d9d
mov rax, qword [rsp + 0x58]
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.1400a66b0
mov rdx, rax
mov rcx, r12
call fcn.1400b4530
nop
lea rcx, [rbp + 0x118]
call fcn.1400053c0
mov dword [rsp + 0x70], 0x25392107
mov dword [rsp + 0x74], 0x3c38323b
mov dword [rsp + 0x78], 0x3c322c
mov byte [rsp + 0x7c], 1
lea rcx, [rsp + 0x70]
call fcn.1400a9140
mov rdx, rax
lea rcx, [r12 + 0x218]
call fcn.14009f980
test al, al
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
je 0x1400b62e0
lea r15, [section..data]
mov rsi, r15
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
cmova rsi, qword [section..data]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400b5ea6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400b5ea6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x8734cf44
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400b5ea1
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400b5e80
cmp r8d, 0x3ffce446
je 0x1400b5eab
test r9d, r9d
jne 0x1400b5e60
mov rax, qword [rax]
jmp 0x1400b5e30
mov edx, dword [rdi + 0x1c]
add rdx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rdx + rax*4]
add rdx, r10
mov rcx, rsi
call rdx
movdqa xmm0, xmmword [0x14014b4b0]
movdqu xmmword [rsp + 0x70], xmm0
mov byte [rbp - 0x80], 1
lea rcx, [rsp + 0x70]
call fcn.1400a90f0
mov r9, rax
inc r14
cmp byte [rax + r14], 0
jne 0x1400b5ee6
mov rcx, qword [0x140379010]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, r14
jb 0x1400b66c1
mov rax, r15
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
cmova rax, qword [section..data]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
mov r8, r15
movzx edx, byte [rsp + 0x50]
lea rcx, [rbp + 0x158]
call fcn.14003d800
nop
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x200]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 2
lea rdx, [rbp + 0x158]
lea rcx, [rbp + 0x200]
call fcn.14003c290
nop
cmp qword [rbp + 0x288], 0
je 0x1400b5fbc
mov rdx, r15
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
cmova rdx, qword [section..data]
mov r8, qword [0x140379010]
lea rcx, [rbp + 0x200]
call fcn.14003d920
lea rcx, [rbp + 0x200]
call fcn.14003c250
mov dword [rbp - 0x78], 0x2536201d
mov dword [rbp - 0x74], 0x30263225
mov word [rbp - 0x70], 0xa
mov byte [rbp - 0x6e], 1
lea rcx, [rbp - 0x78]
call fcn.1400a90b0
mov rdx, rax
mov r8, r15
lea rcx, [rbp + 0x118]
call fcn.14003d190
nop
lea rdx, [rbp + 0x118]
cmp qword [rbp + 0x130], 0xf
cmova rdx, qword [rbp + 0x118]
xor ecx, ecx
mov qword [rsp + 0x40], rcx
lea rax, [rbp + 0xe8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], ecx
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1400b61eb
mov r14, qword [0x140379010]
inc r14
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
jbe 0x1400b6061
mov r15, qword [section..data]
mov rsi, r15
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov edi, dword [rcx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x1400b60f6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400b60f6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r11 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r11
mov r8d, 0x7844d366
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400b60f1
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400b60d0
cmp r8d, 0xf0b1dd1b
je 0x1400b60fb
test r9d, r9d
jne 0x1400b60b0
mov rax, qword [rax]
jmp 0x1400b6080
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r15
mov r9d, 1
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rbp + 0xe8]
call r10
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400b61c6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400b61c6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0xcfaf5f8c
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400b61c1
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400b61a0
cmp r8d, 0xcfa64441
je 0x1400b61cb
test r9d, r9d
jne 0x1400b6180
mov rax, qword [rax]
jmp 0x1400b6150
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov rcx, qword [rbp + 0xe8]
call rdx
lea rsi, [r12 + 0x20]
cmp qword [rsi + 0x18], 0xf
jbe 0x1400b61fa
mov rsi, qword [rsi]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400b6286
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400b6286
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0xed5ed7d7
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400b6281
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400b6260
cmp r8d, 0x972f3f7d
je 0x1400b628b
test r9d, r9d
jne 0x1400b6240
mov rax, qword [rax]
jmp 0x1400b6210
mov edx, dword [rdi + 0x1c]
add rdx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rdx + rax*4]
add rdx, r10
mov rcx, rsi
call rdx
nop
lea rcx, [rbp + 0x118]
call fcn.1400053c0
nop
lea rcx, [rbp + 0x200]
call fcn.140033990
nop
lea rcx, [rbp + 0x158]
call fcn.1400053c0
mov rsi, qword [rbp - 0x20]
jmp 0x1400b642a
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400b6356
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400b6356
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0xa5a565f7
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400b6351
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400b6330
cmp r8d, 0xbe078837
je 0x1400b635b
test r9d, r9d
jne 0x1400b6310
mov rax, qword [rax]
jmp 0x1400b62e0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
mov ecx, listen
jmp 0x1400b6424
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400b6406
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400b6406
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x6f59edca
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400b6401
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400b63e0
cmp r8d, 0xf201ea42
je 0x1400b640b
test r9d, r9d
jne 0x1400b63c0
mov rax, qword [rax]
jmp 0x1400b6390
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
mov ecx, 9
add rdx, r10
call rdx
nop
lea rcx, [rbp + 0x1b8]
call fcn.1400053c0
nop
movzx edx, byte [rbp + 0x108]
lea rcx, [rbp + 0x110]
call fcn.1400ad7f0
jmp 0x1400b64fa
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400b64d6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400b64d6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov ecx, dword [rcx + rbx]
add rcx, r10
mov r8d, 0x97f623b1
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1400b64d1
nop dword [rax]
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x1400b64b0
cmp r8d, 0xccaaff51
je 0x1400b64db
test r9d, r9d
jne 0x1400b6490
mov rax, qword [rax]
jmp 0x1400b6460
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov ecx, 7
call rdx
nop
mov rdx, qword [rbp + 0x1b0]
cmp rdx, 0xf
jbe 0x1400b653e
inc rdx
mov rcx, qword [rbp + 0x198]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b6539
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400b6539
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140142874
movdqu xmmword [rbp + 0x1a8], xmm6
mov byte [rbp + 0x198], 0
mov rdx, qword [rbp + 0x1f0]
cmp rdx, 0xf
jbe 0x1400b6592
inc rdx
mov rcx, qword [rbp + 0x1d8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b658c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400b658c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140142874
nop
mov rdx, qword [rbp + 0x190]
cmp rdx, 0xf
jbe 0x1400b65d6
inc rdx
mov rcx, qword [rbp + 0x178]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b65d1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400b65d1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140142874
xor ebx, ebx
mov qword [rbp + 0x188], rbx
mov qword [rbp + 0x190], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x178], bl
mov rdx, qword [r13 + 0x18]
cmp rdx, 0xf
jbe 0x1400b662b
mov rcx, qword [r13]
inc rdx
cmp rdx, 0x1000
jb 0x1400b6626
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400b66b3
mov rcx, r8
call fcn.140142874
mov qword [r13 + 0x10], rbx
mov qword [r13 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r13], 0
mov rdx, qword [rsi + 0x18]
cmp rdx, 0xf
jbe 0x1400b6672
inc rdx
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x1400b666d
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400b66ba
mov rcx, r8
call fcn.140142874
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], 0
mov rcx, qword [rbp + 0x310]
xor rcx, rsp
call fcn.1401425d0
mov rbx, qword [rsp + 0x488]
movaps xmm6, xmmword [rsp + 0x420]
add rsp, 0x430
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.1400028a0
int3