Function at 0x140156d88
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by fnv-1a hash
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], r12
push r13
push r14
push r15
sub rsp, 0xc0
mov rax, qword [0x14017b0c0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov r10, qword [0x14017c780]
test r10, r10
jne 0x140156f29
xor edi, edi
mov r14d, 0x3285501
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r12, qword [rax]
mov rdx, r12
mov ecx, 8
movups xmm0, xmmword [rdx + 0x58]
movd eax, xmm0
sub ax, cx
test edi, edi
je 0x140156e34
psrldq xmm0, 8
movq rcx, xmm0
movzx eax, ax
shr rax, 1
lea r9, [rcx + rax*2]
mov r8d, 0x811c9dc5
jmp 0x140156e26
movsx eax, byte [rcx]
xor eax, r8d
imul r8d, eax, 0x1000193
add rcx, 2
cmp rcx, r9
jne 0x140156e15
cmp r8d, edi
jne 0x140156f09
mov r8, qword [rdx + 0x30]
movsxd rax, dword [r8 + 0x3c]
mov rax, qword [rax + r8 + 0x88]
mov r9d, eax
add r9, r8
shr rax, 0x20
cmp r9, r8
je 0x140156f09
mov r11d, dword [r9 + 0x18]
test r11d, r11d
je 0x140156f09
mov r13d, dword [r9 + 0x20]
dec r11d
lea rcx, [r11*4]
add rcx, r13
mov r10d, dword [rcx + r8]
add r10, r8
mov esi, 0x811c9dc5
jmp 0x140156e8f
movsx ecx, cl
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [r10]
inc r10
test cl, cl
jne 0x140156e84
cmp esi, r14d
je 0x140156ea5
test r11d, r11d
jne 0x140156e68
jmp 0x140156f09
mov edx, dword [r9 + 0x1c]
add rdx, r8
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx ecx, word [rcx + r11*2]
mov r10d, dword [rdx + rcx*4]
add r10, r8
cmp r10, r9
jbe 0x140156f22
lea rcx, [r9 + rax]
cmp r10, rcx
jae 0x140156f22
mov edi, 0x811c9dc5
mov r14d, edi
jmp 0x140156ee5
movsx eax, al
xor eax, edi
imul edi, eax, 0x1000193
inc r10
mov al, byte [r10]
cmp al, 0x2e
jne 0x140156ed7
jmp 0x140156efb
movsx eax, al
xor eax, r14d
imul r14d, eax, 0x1000193
inc r10
mov al, byte [r10]
test al, al
jne 0x140156eee
mov rdx, qword [r12]
mov rax, qword [rdx]
mov rdx, rax
cmp rax, r12
je 0x140156f1f
cmp qword [rax + 0x30], 0
jne 0x140156de5
xor r10d, r10d
mov qword [0x14017c780], r10
mov esi, 8
mov edx, 0x2000
xor ecx, ecx
lea r9d, [rsi + 0x38]
mov r8d, 0x3000
call r10
mov rcx, rax
mov qword [rsp + 0x50], rax
add rax, 0xffa
mov qword [rsp + 0x38], rax
lea rdx, [rcx + 0x1000]
mov ecx, dword [0x14017b090]
mov dword [rax], ecx
movzx ecx, word [0x14017b094]
mov word [rax + 4], cx
mov qword [rsp + 0x98], rdx
mov r9, qword [0x14017c6a0]
test r9, r9
jne 0x1401570eb
xor edi, edi
mov eax, 0xaae02ba9
mov dword [rsp + 0x20], eax
mov r15d, eax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r13, qword [rax]
mov rdx, r13
movups xmm0, xmmword [rdx + 0x58]
movd eax, xmm0
sub ax, si
test edi, edi
je 0x140156ff6
psrldq xmm0, 8
movq rcx, xmm0
movzx eax, ax
shr rax, 1
lea r9, [rcx + rax*2]
mov r8d, 0x811c9dc5
jmp 0x140156fe8
movsx eax, byte [rcx]
xor eax, r8d
imul r8d, eax, 0x1000193
add rcx, 2
cmp rcx, r9
jne 0x140156fd7
cmp r8d, edi
jne 0x1401570c9
mov r10, qword [rdx + 0x30]
movsxd rax, dword [r10 + 0x3c]
mov rax, qword [rax + r10 + 0x88]
mov r8d, eax
add r8, r10
shr rax, 0x20
cmp r8, r10
je 0x1401570c9
mov r11d, dword [r8 + 0x18]
test r11d, r11d
je 0x1401570c9
mov r12d, dword [r8 + 0x20]
dec r11d
lea rcx, [r12 + r11*4]
mov r9d, dword [rcx + r10]
add r9, r10
mov esi, 0x811c9dc5
jmp 0x14015704a
movsx ecx, cl
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [r9]
inc r9
test cl, cl
jne 0x14015703f
cmp esi, r15d
je 0x140157060
test r11d, r11d
jne 0x14015702a
jmp 0x1401570c4
mov edx, dword [r8 + 0x1c]
add rdx, r10
mov ecx, dword [r8 + 0x24]
add rcx, r10
movzx ecx, word [rcx + r11*2]
mov r9d, dword [rdx + rcx*4]
add r9, r10
cmp r9, r8
jbe 0x1401570e2
lea rcx, [r8 + rax]
cmp r9, rcx
jae 0x1401570e2
mov edi, 0x811c9dc5
mov r15d, edi
jmp 0x1401570a0
movsx eax, al
xor eax, edi
imul edi, eax, 0x1000193
inc r9
mov al, byte [r9]
cmp al, 0x2e
jne 0x140157092
jmp 0x1401570b6
movsx eax, al
xor eax, r15d
imul r15d, eax, 0x1000193
inc r9
mov al, byte [r9]
test al, al
jne 0x1401570a9
mov rdx, qword [r13]
mov esi, 8
mov rax, qword [rdx]
mov rdx, rax
cmp rax, r13
je 0x1401570df
cmp qword [rax + 0x30], 0
jne 0x140156fac
xor r9d, r9d
mov qword [0x14017c6a0], r9
jmp 0x1401570f3
mov dword [rsp + 0x20], 0xaae02ba9
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x98]
or rcx, 0xffffffffffffffff
call r9
nop
mov rax, qword [0x14017c778]
test rax, rax
jne 0x140157310
xor r9d, r9d
mov dword [rsp + 0x2c], r9d
mov esi, 0x820621f3
mov dword [rsp + 0x28], esi
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rcx, qword [rax + 0x10]
mov r8, qword [rcx]
mov qword [rsp + 0x58], r8
mov r13, r8
mov qword [rsp + 0x60], r8
mov rax, r8
movups xmm0, xmmword [rax + 0x58]
movups xmmword [rsp + 0x68], xmm0
movd eax, xmm0
sub ax, 8
mov word [rsp + 0x68], ax
mov r12d, 0x811c9dc5
test r9d, r9d
je 0x1401571a5
mov rcx, qword [rsp + 0x70]
movzx eax, ax
shr rax, 1
lea r10, [rcx + rax*2]
mov edx, r12d
mov qword [rsp + 0x40], rcx
cmp rcx, r10
je 0x14015719c
movsx eax, byte [rcx]
xor eax, edx
imul edx, eax, 0x1000193
add rcx, 2
jmp 0x140157181
cmp edx, r9d
jne 0x1401572e8
mov r14, qword [r8 + 0x30]
mov qword [rsp + 0x80], r14
movsxd rax, dword [r14 + 0x3c]
mov rax, qword [rax + r14 + 0x88]
mov qword [rsp + 0x78], rax
mov edi, eax
add rdi, r14
mov qword [rsp + 0x88], rdi
shr rax, 0x20
mov dword [rsp + 0x90], eax
cmp rdi, r14
je 0x1401572e8
mov r11d, dword [rdi + 0x18]
mov dword [rsp + 0x24], r11d
mov ecx, r11d
dec r11d
mov dword [rsp + 0x24], r11d
test ecx, ecx
je 0x1401572e8
mov edx, dword [rdi + 0x20]
add rdx, r14
mov r10d, dword [rdx + r11*4]
add r10, r14
mov qword [rsp + 0x48], r10
mov edx, r12d
movsx ecx, byte [r10]
inc r10
mov qword [rsp + 0x48], r10
test cl, cl
jne 0x1401572db
cmp edx, esi
jne 0x1401572d6
mov edx, dword [rdi + 0x1c]
add rdx, r14
mov ecx, dword [rdi + 0x24]
add rcx, r14
movzx ecx, word [rcx + r11*2]
mov r8d, dword [rdx + rcx*4]
add r8, r14
cmp r8, rdi
jbe 0x140157306
lea rcx, [rdi + rax]
cmp r8, rcx
jae 0x140157306
mov r9d, r12d
mov dword [rsp + 0xa8], r12d
mov esi, r12d
mov dword [rsp + 0xac], r12d
mov ecx, r12d
mov qword [rsp + 0x30], r8
cmp byte [r8], 0x2e
je 0x14015729f
movsx eax, byte [r8]
xor eax, ecx
imul r9d, eax, 0x1000193
mov dword [rsp + 0xa8], r9d
inc r8
mov ecx, r9d
jmp 0x140157277
inc r8
mov qword [rsp + 0x30], r8
cmp byte [r8], 0
je 0x1401572c2
movsx eax, byte [r8]
xor eax, esi
imul esi, eax, 0x1000193
mov dword [rsp + 0xac], esi
jmp 0x14015729f
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x2c], r9d
mov r8, qword [r13]
mov qword [rsp + 0x58], r8
jmp 0x1401572e8
jmp 0x1401571ec
xor ecx, edx
imul edx, ecx, 0x1000193
jmp 0x140157214
mov r8, qword [r8]
mov rax, r8
mov qword [rsp + 0x58], r8
cmp r8, r13
je 0x140157303
cmp qword [r8 + 0x30], 0
jne 0x14015714e
xor r8d, r8d
mov qword [0x14017c778], r8
mov rax, r8
lea r9, [rsp + 0xa8]
mov edx, 8
lea r8d, [rdx + 0x18]
mov rdi, qword [rsp + 0x38]
mov rcx, rdi
call rax
call rdi
mov r13d, 0x811c9dc5
mov r10d, 8
jmp 0x140157352
mov r9, qword [0x14017c6a0]
test r9, r9
jne 0x1401574c6
xor edi, edi
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r12, qword [rax]
mov rdx, r12
movups xmm0, xmmword [rdx + 0x58]
movd eax, xmm0
sub ax, r10w
test edi, edi
je 0x1401573c3
psrldq xmm0, 8
movq rcx, xmm0
movzx eax, ax
shr rax, 1
lea r9, [rcx + rax*2]
mov r8d, r13d
jmp 0x1401573b5
movsx eax, byte [rcx]
xor eax, r8d
imul r8d, eax, 0x1000193
add rcx, 2
cmp rcx, r9
jne 0x1401573a4
cmp r8d, edi
jne 0x1401574a6
mov r11, qword [rdx + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov rax, qword [rax + r11 + 0x88]
mov r10d, eax
add r10, r11
shr rax, 0x20
cmp r10, r11
je 0x1401574a0
mov r9d, dword [r10 + 0x18]
test r9d, r9d
je 0x1401574a0
mov r15d, dword [r10 + 0x20]
dec r9d
lea rcx, [r15 + r9*4]
mov r8d, dword [rcx + r11]
add r8, r11
mov esi, r13d
jmp 0x140157415
movsx ecx, cl
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [r8]
inc r8
test cl, cl
jne 0x14015740a
cmp esi, dword [rsp + 0x20]
je 0x14015742c
test r9d, r9d
jne 0x1401573f7
jmp 0x1401574a0
mov edx, dword [r10 + 0x24]
add rdx, r11
movzx r8d, word [rdx + r9*2]
mov edx, dword [r10 + 0x1c]
add rdx, r11
mov r9d, dword [rdx + r8*4]
add r9, r11
cmp r9, r10
jbe 0x1401574bf
lea rcx, [rax + r10]
cmp r9, rcx
jae 0x1401574bf
mov edi, r13d
mov r8d, r13d
mov dword [rsp + 0x20], r13d
jmp 0x14015746f
movsx eax, al
xor eax, edi
imul edi, eax, 0x1000193
inc r9
mov al, byte [r9]
cmp al, 0x2e
jne 0x140157461
inc r9
mov al, byte [r9]
test al, al
je 0x14015749c
movsx eax, al
xor eax, r8d
imul r8d, eax, 0x1000193
inc r9
mov al, byte [r9]
test al, al
jne 0x140157480
mov dword [rsp + 0x20], r8d
mov rdx, qword [r12]
mov r10d, 8
mov rax, qword [rdx]
mov rdx, rax
cmp rax, r12
je 0x1401574bc
cmp qword [rax + 0x30], 0
jne 0x14015737b
xor r9d, r9d
mov qword [0x14017c6a0], r9
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x98]
or rcx, 0xffffffffffffffff
call r9
mov rcx, qword [rsp + 0x38]
mov eax, dword [rcx]
cmp eax, dword [0x14017b090]
jne 0x1401574f7
movzx eax, word [rcx + 4]
cmp ax, word [0x14017b094]
je 0x1401574fe
mov cl, 1
call fcn.1401360f8
test byte [rsp + 0xa0], 1
je 0x14015750f
mov cl, 1
call fcn.1401360f8
mov r9, qword [0x14017c770]
test r9, r9
jne 0x14015767e
xor edi, edi
mov r14d, 0x3a9acc72
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r12, qword [rax]
mov rdx, r12
movups xmm0, xmmword [rdx + 0x58]
movd eax, xmm0
sub ax, 8
test edi, edi
je 0x140157586
psrldq xmm0, 8
movq rcx, xmm0
movzx eax, ax
shr rax, 1
lea r9, [rcx + rax*2]
mov r8d, r13d
jmp 0x140157578
movsx eax, byte [rcx]
xor eax, r8d
imul r8d, eax, 0x1000193
add rcx, 2
cmp rcx, r9
jne 0x140157567
cmp r8d, edi
jne 0x14015765e
mov r10, qword [rdx + 0x30]
movsxd rax, dword [r10 + 0x3c]
mov rax, qword [rax + r10 + 0x88]
mov r11d, eax
add r11, r10
shr rax, 0x20
cmp r11, r10
je 0x14015765e
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x14015765e
mov r13d, dword [r11 + 0x20]
dec r9d
lea rcx, [r10 + r9*4]
mov r8d, dword [rcx + r13]
add r8, r10
mov esi, 0x811c9dc5
jmp 0x1401575da
movsx ecx, cl
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [r8]
inc r8
test cl, cl
jne 0x1401575cf
cmp esi, r14d
je 0x1401575f6
test r9d, r9d
jne 0x1401575ba
mov r13d, 0x811c9dc5
jmp 0x14015765e
mov edx, dword [r11 + 0x24]
add rdx, r10
movzx r8d, word [rdx + r9*2]
mov edx, dword [r11 + 0x1c]
add rdx, r10
mov r9d, dword [rdx + r8*4]
add r9, r10
cmp r9, r11
jbe 0x140157677
lea rcx, [rax + r11]
cmp r9, rcx
jae 0x140157677
mov r13d, 0x811c9dc5
mov edi, r13d
mov r14d, r13d
jmp 0x14015763a
movsx eax, al
xor eax, edi
imul edi, eax, 0x1000193
inc r9
mov al, byte [r9]
cmp al, 0x2e
jne 0x14015762c
jmp 0x140157650
movsx eax, al
xor eax, r14d
imul r14d, eax, 0x1000193
inc r9
mov al, byte [r9]
test al, al
jne 0x140157643
mov rdx, qword [r12]
mov rax, qword [rdx]
mov rdx, rax
cmp rax, r12
je 0x140157674
cmp qword [rax + 0x30], 0
jne 0x14015753e
xor r9d, r9d
mov qword [0x14017c770], r9
xor edx, edx
mov r8d, 0x8000
mov rcx, qword [rsp + 0x50]
call r9
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140158250
lea r11, [rsp + 0xc0]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov r12, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop r13
ret