Function at 0x1403960e0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x330]
sub rsp, 0x430
mov r15, rdx
xor r12d, r12d
mov dword [rsp + 0x30], r12d
lea rax, vtable.ATL::CSid.0
mov qword [rbp + 0x220], rax
mov byte [rbp + 0x26c], r12b
mov dword [rbp + 0x270], 7
call fcn.140359a70
mov rcx, rax
test rax, rax
je 0x140397326
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x278], rax
call fcn.140359a70
mov rcx, rax
test rax, rax
je 0x140397331
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x280], rax
call fcn.140359a70
mov rcx, rax
test rax, rax
je 0x14039733c
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x288], rax
call fcn.140359a70
mov rcx, rax
test rax, rax
je 0x140397347
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x290], rax
lea rax, vtable.ATL::CAccessToken.0
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r12
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp + 0x370]
mov edx, 0x20008
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
movabs rcx, 0xaaaf1044c46d906
movabs rdx, 0xf9b2c4036dbd008d
movabs rbx, 0xf6324b730ee9812f
movabs rdi, 0xdec0f87aa29b7310
movabs rsi, 0xd7c6b66c1dcd75fe
movabs r13, 0x2ade92653828b645
lea r14, [r12 - 1]
test eax, eax
je 0x14039627b
lea rcx, [rsp + 0x38]
mov rax, qword [rsp + 0x38]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rax, qword [rbp + 0x370]
mov qword [rsp + 0x40], rax
lea rdx, [rbp + 0x220]
lea rcx, [rsp + 0x38]
call fcn.14039ae50
test al, al
jne 0x1403969a8
movabs rcx, 0xaaaf1044c46d906
movabs rdx, 0xf9b2c4036dbd008d
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbp], 0
mov qword [rbp + 0x380], rcx
mov rax, qword [rbp + 0x380]
mov qword [rbp - 0x40], rax
mov qword [rbp + 0x380], rdx
mov rax, qword [rbp + 0x380]
mov qword [rbp - 0x38], rax
mov qword [rbp + 0x380], rbx
mov rax, qword [rbp + 0x380]
mov qword [rbp - 0x30], rax
mov qword [rbp + 0x380], rdi
mov rax, qword [rbp + 0x380]
mov qword [rbp - 0x28], rax
mov qword [rbp + 0x380], r13
mov rax, qword [rbp + 0x380]
mov qword [rbp + 0x120], rax
mov qword [rbp + 0x380], rsi
mov rax, qword [rbp + 0x380]
mov qword [rbp + 0x128], rax
mov qword [rbp + 0x380], rbx
mov rax, qword [rbp + 0x380]
mov qword [rbp + 0x130], rax
mov qword [rbp + 0x380], rdi
mov rax, qword [rbp + 0x380]
mov qword [rbp + 0x138], rax
movdqa xmm0, xmmword [rbp - 0x40]
pxor xmm0, xmmword [rbp + 0x120]
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [rbp - 0x30]
pxor xmm1, xmmword [rbp + 0x130]
movdqa xmmword [rbp - 0x30], xmm1
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r12
lea rax, [rbp - 0x40]
mov r8, r14
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140396370
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x58]
call fcn.14035aa00
nop
mov rcx, qword [0x14049bfa8]
movabs rax, 0x59acf7166d748c06
mov qword [rbp + 0x380], rax
mov rax, qword [rbp + 0x380]
mov qword [rbp + 0x20], rax
movabs rax, 0xb282ea1e78be20a2
mov qword [rbp + 0x380], rax
mov rax, qword [rbp + 0x380]
mov qword [rbp + 0x28], rax
movabs rax, 0x83531703619dea5c
mov qword [rbp + 0x380], rax
mov rax, qword [rbp + 0x380]
mov qword [rbp + 0x30], rax
movabs rax, 0x82b3880ac3bb1b64
mov qword [rbp + 0x380], rax
mov rax, qword [rbp + 0x380]
mov qword [rbp + 0x38], rax
movabs rax, 0x3d76346948f226a8
mov qword [rbp + 0x380], rax
mov rax, qword [rbp + 0x380]
mov qword [rbp + 0x40], rax
movabs rax, 0x9ee5275c77b2d636
mov qword [rbp + 0x380], rax
mov rax, qword [rbp + 0x380]
mov qword [rbp + 0x48], rax
movabs rax, 0x4b0081e48b5c6e07
mov qword [rbp + 0x380], rax
mov rax, qword [rbp + 0x380]
mov qword [rbp + 0x50], rax
movabs rax, 0x12f7997743e7a2c1
mov qword [rbp + 0x380], rax
mov rax, qword [rbp + 0x380]
mov qword [rbp + 0x58], rax
movabs rax, 0x78a9df348a72ddfe
mov qword [rbp + 0x380], rax
mov rax, qword [rbp + 0x380]
mov qword [rbp + 0x60], rax
movabs rax, 0x5e0b42a7ebe82dcf
mov qword [rbp + 0x380], rax
mov rax, qword [rbp + 0x380]
mov qword [rbp + 0x68], rax
mov qword [rbp + 0x380], r13
mov rax, qword [rbp + 0x380]
mov qword [rbp + 0x180], rax
mov qword [rbp + 0x380], rsi
mov rax, qword [rbp + 0x380]
mov qword [rbp + 0x188], rax
mov qword [rbp + 0x380], rbx
mov rax, qword [rbp + 0x380]
mov qword [rbp + 0x190], rax
mov qword [rbp + 0x380], rdi
mov rax, qword [rbp + 0x380]
mov qword [rbp + 0x198], rax
movabs rax, 0x55561949208653c9
mov qword [rbp + 0x380], rax
mov rax, qword [rbp + 0x380]
mov qword [rbp + 0x1a0], rax
movabs rax, 0xff8a4b0004c2a242
mov qword [rbp + 0x380], rax
mov rax, qword [rbp + 0x380]
mov qword [rbp + 0x1a8], rax
movabs rax, 0x1763f397d72e0b63
mov qword [rbp + 0x380], rax
mov rax, qword [rbp + 0x380]
mov qword [rbp + 0x1b0], rax
movabs rax, 0x779eed1e2f8ed6b4
mov qword [rbp + 0x380], rax
mov rax, qword [rbp + 0x380]
mov qword [rbp + 0x1b8], rax
movabs rax, 0xcc0b35dfe07818d
mov qword [rbp + 0x380], rax
mov rax, qword [rbp + 0x380]
mov qword [rbp + 0x1c0], rax
movabs rax, 0x5e7b32c4c59b48a6
mov qword [rbp + 0x380], rax
mov rax, qword [rbp + 0x380]
mov qword [rbp + 0x1c8], rax
movdqa xmm0, xmmword [rbp + 0x180]
pxor xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp + 0x20], xmm0
movdqa xmm1, xmmword [rbp + 0x30]
pxor xmm1, xmmword [rbp + 0x190]
movdqa xmmword [rbp + 0x30], xmm1
movdqa xmm0, xmmword [rbp + 0x40]
pxor xmm0, xmmword [rbp + 0x1a0]
movdqa xmmword [rbp + 0x40], xmm0
movdqa xmm1, xmmword [rbp + 0x50]
pxor xmm1, xmmword [rbp + 0x1b0]
movdqa xmmword [rbp + 0x50], xmm1
movdqa xmm0, xmmword [rbp + 0x60]
pxor xmm0, xmmword [rbp + 0x1c0]
movdqa xmmword [rbp + 0x60], xmm0
mov r9d, 0xb1
lea r8, [rbp + 0x20]
lea rdx, [rbp + 0xc0]
call fcn.140398980
nop
lea rdx, [rbp + 0xc0]
mov rcx, qword [0x14049bfc0]
call fcn.14035b6c0
nop
mov rdx, qword [rbp + 0xd8]
cmp rdx, 0x10
jb 0x14039667c
inc rdx
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140396677
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140397352
call fcn.140419458
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xc0], 0
movabs rax, 0x4ffefc005c4cc316
mov qword [rbp + 0x380], rax
mov rax, qword [rbp + 0x380]
mov qword [rbp - 0x60], rax
movabs rax, 0xd7c6b6426fa2078c
mov qword [rbp + 0x380], rax
mov rax, qword [rbp + 0x380]
mov qword [rbp - 0x58], rax
mov qword [rbp + 0x380], r13
mov rax, qword [rbp + 0x380]
mov qword [rbp + 0x100], rax
mov qword [rbp + 0x380], rsi
mov rax, qword [rbp + 0x380]
mov qword [rbp + 0x108], rax
movdqa xmm0, xmmword [rbp - 0x60]
pxor xmm0, xmmword [rbp + 0x100]
movdqa xmmword [rbp - 0x60], xmm0
lea rsi, [rsp + 0x58]
cmp qword [rsp + 0x70], 0x10
cmovae rsi, qword [rsp + 0x58]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov edi, dword [rcx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x1403967a6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1403967a6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r11 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r11
mov r8d, 0xad26294d
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1403967a1
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140396780
cmp r8d, 0x398804ab
je 0x1403967ab
test r9d, r9d
jne 0x140396760
mov rax, qword [rax]
jmp 0x140396730
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
mov dword [rsp + 0x28], 0xbb8
mov word [rsp + 0x20], r12w
mov r9d, reloc.WS2_32.dll_recv
lea r8, [rbp - 0x60]
mov rdx, rsi
xor ecx, ecx
call r10
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140396876
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140396876
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x9e2611b0
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140396871
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140396850
cmp r8d, 0x7041d92
je 0x14039687b
test r9d, r9d
jne 0x140396830
mov rax, qword [rax]
jmp 0x140396800
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov r8d, dword [rcx + rax*4]
add r8, r10
mov edx, dword [0x7ffe0014]
mov rcx, r14
call r8
mov ecx, 0xa
call fcn.140419954
lea rcx, [rax + 1]
call fcn.140419458
mov ecx, 4
call fcn.1404196c8
mov rbx, rax
mov edx, 4
mov rcx, rax
call fcn.140419458
mov dword [rbx], 0xa
mov ecx, 4
call fcn.1404196c8
mov rbx, rax
mov edx, 4
mov rcx, rax
call fcn.140419458
mov edx, 4
mov rcx, rbx
call fcn.140419458
mov ecx, dword [0x7ffe0014]
int 0x29
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x140396940
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14039693b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140397358
call fcn.140419458
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x58], 0
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x10
jb 0x14039698e
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140396989
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14039735e
call fcn.140419458
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbp], 0
movabs rsi, 0xd7c6b66c1dcd75fe
lea rcx, [rbp + 0x220]
call fcn.14038f830
mov rbx, rax
lea rax, [rbp + 0x2a8]
mov qword [rbp + 0x2a0], rax
test rbx, rbx
jne 0x1403969d6
mov rax, r12
mov qword [rbp + 0x2a0], rax
jmp 0x140396a50
mov rax, r14
nop dword [rax]
lea rax, [rax + 1]
cmp byte [rbx + rax], 0
jne 0x1403969e0
lea ecx, [rax + 1]
test ecx, ecx
js 0x140397364
movsxd rdi, ecx
cmp ecx, 0x80
jle 0x140396a1f
mov edx, 1
mov rcx, rdi
call fcn.14042a0b4
mov qword [rbp + 0x2a0], rax
test rax, rax
je 0x14039731b
jmp 0x140396a2d
lea rax, [rbp + 0x2a8]
mov qword [rbp + 0x2a0], rax
test rdi, rdi
je 0x140396a50
test rax, rax
je 0x14039736f
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.14041bc20
mov rax, qword [rbp + 0x2a0]
xorps xmm0, xmm0
movups xmmword [r15], xmm0
mov qword [r15 + 0x10], r12
mov qword [r15 + 0x18], r12
mov r8, r14
inc r8
cmp byte [rax + r8], 0
jne 0x140396a62
mov rdx, rax
mov rcx, r15
call fcn.14035aa00
mov dword [rsp + 0x30], 1
lea rax, [rbp + 0x2a8]
mov rcx, qword [rbp + 0x2a0]
cmp rcx, rax
je 0x140396a97
call fcn.14042890c
cmp qword [r15 + 0x10], 0
jne 0x140397212
xorps xmm0, xmm0
movups xmmword [rbp + 0x160], xmm0
mov qword [rbp + 0x170], r12
mov qword [rbp + 0x178], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x160], 0
movabs rax, 0xaaaf1044c46d906
mov qword [rbp + 0x380], rax
mov rax, qword [rbp + 0x380]
mov qword [rbp - 0x20], rax
movabs rax, 0xf9b2c4036dbd008d
mov qword [rbp + 0x380], rax
mov rax, qword [rbp + 0x380]
mov qword [rbp - 0x18], rax
movabs rbx, 0xf6324b730ee9812f
mov qword [rbp + 0x380], rbx
mov rax, qword [rbp + 0x380]
mov qword [rbp - 0x10], rax
movabs rdi, 0xdec0f87aa29b7310
mov qword [rbp + 0x380], rdi
mov rax, qword [rbp + 0x380]
mov qword [rbp - 8], rax
mov qword [rbp + 0x380], r13
mov rax, qword [rbp + 0x380]
mov qword [rbp + 0x140], rax
mov qword [rbp + 0x380], rsi
mov rax, qword [rbp + 0x380]
mov qword [rbp + 0x148], rax
mov qword [rbp + 0x380], rbx
mov rax, qword [rbp + 0x380]
mov qword [rbp + 0x150], rax
mov qword [rbp + 0x380], rdi
mov rax, qword [rbp + 0x380]
mov qword [rbp + 0x158], rax
movdqa xmm0, xmmword [rbp - 0x20]
pxor xmm0, xmmword [rbp + 0x140]
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [rbp - 0x10]
pxor xmm1, xmmword [rbp + 0x150]
movdqa xmmword [rbp - 0x10], xmm1
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], r12
lea rax, [rbp - 0x20]
mov r8, r14
inc r8
cmp byte [rax + r8], 0
jne 0x140396bc4
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x78]
call fcn.14035aa00
nop
mov rcx, qword [0x14049bfa8]
movabs rax, 0x59acf7166d748c06
mov qword [rbp + 0x380], rax
mov rax, qword [rbp + 0x380]
mov qword [rbp + 0x70], rax
movabs rax, 0xb282ea1e78be20a2
mov qword [rbp + 0x380], rax
mov rax, qword [rbp + 0x380]
mov qword [rbp + 0x78], rax
movabs rax, 0x83531703619dea5c
mov qword [rbp + 0x380], rax
mov rax, qword [rbp + 0x380]
mov qword [rbp + 0x80], rax
movabs rax, 0x82b3880ac3bb1b64
mov qword [rbp + 0x380], rax
mov rax, qword [rbp + 0x380]
mov qword [rbp + 0x88], rax
movabs rax, 0x3d76346948f226a8
mov qword [rbp + 0x380], rax
mov rax, qword [rbp + 0x380]
mov qword [rbp + 0x90], rax
movabs rax, 0x9ee5275c77b2d636
mov qword [rbp + 0x380], rax
mov rax, qword [rbp + 0x380]
mov qword [rbp + 0x98], rax
movabs rax, 0x4b0081e48b5c6e07
mov qword [rbp + 0x380], rax
mov rax, qword [rbp + 0x380]
mov qword [rbp + 0xa0], rax
movabs rax, 0x12f7997743e7a2c1
mov qword [rbp + 0x380], rax
mov rax, qword [rbp + 0x380]
mov qword [rbp + 0xa8], rax
movabs rax, 0x78a9df348a72ddfe
mov qword [rbp + 0x380], rax
mov rax, qword [rbp + 0x380]
mov qword [rbp + 0xb0], rax
movabs rax, 0x5e0b42a7ebe82dcf
mov qword [rbp + 0x380], rax
mov rax, qword [rbp + 0x380]
mov qword [rbp + 0xb8], rax
mov qword [rbp + 0x380], r13
mov rax, qword [rbp + 0x380]
mov qword [rbp + 0x1d0], rax
mov qword [rbp + 0x380], rsi
mov rax, qword [rbp + 0x380]
mov qword [rbp + 0x1d8], rax
mov qword [rbp + 0x380], rbx
mov rax, qword [rbp + 0x380]
mov qword [rbp + 0x1e0], rax
mov qword [rbp + 0x380], rdi
mov rax, qword [rbp + 0x380]
mov qword [rbp + 0x1e8], rax
movabs rax, 0x55561949208653c9
mov qword [rbp + 0x380], rax
mov rax, qword [rbp + 0x380]
mov qword [rbp + 0x1f0], rax
movabs rax, 0xff8a4b0004c2a242
mov qword [rbp + 0x380], rax
mov rax, qword [rbp + 0x380]
mov qword [rbp + 0x1f8], rax
movabs rax, 0x1763f397d72e0b63
mov qword [rbp + 0x380], rax
mov rax, qword [rbp + 0x380]
mov qword [rbp + 0x200], rax
movabs rax, 0x779eed1e2f8ed6b4
mov qword [rbp + 0x380], rax
mov rax, qword [rbp + 0x380]
mov qword [rbp + 0x208], rax
movabs rax, 0xcc0b35dfe07818d
mov qword [rbp + 0x380], rax
mov rax, qword [rbp + 0x380]
mov qword [rbp + 0x210], rax
movabs rax, 0x5e7b32c4c59b48a6
mov qword [rbp + 0x380], rax
mov rax, qword [rbp + 0x380]
mov qword [rbp + 0x218], rax
movdqa xmm0, xmmword [rbp + 0x70]
pxor xmm0, xmmword [rbp + 0x1d0]
movdqa xmmword [rbp + 0x70], xmm0
movdqa xmm1, xmmword [rbp + 0x80]
pxor xmm1, xmmword [rbp + 0x1e0]
movdqa xmmword [rbp + 0x80], xmm1
movdqa xmm0, xmmword [rbp + 0x90]
pxor xmm0, xmmword [rbp + 0x1f0]
movdqa xmmword [rbp + 0x90], xmm0
movdqa xmm1, xmmword [rbp + 0xa0]
pxor xmm1, xmmword [rbp + 0x200]
movdqa xmmword [rbp + 0xa0], xmm1
movdqa xmm0, xmmword [rbp + 0xb0]
pxor xmm0, xmmword [rbp + 0x210]
movdqa xmmword [rbp + 0xb0], xmm0
mov r9d, 0xb7
lea r8, [rbp + 0x70]
lea rdx, [rbp + 0xe0]
call fcn.140398980
nop
lea rdx, [rbp + 0xe0]
mov rcx, qword [0x14049bfc0]
call fcn.14035b6c0
nop
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0x10
jb 0x140396f00
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140396efb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14039738a
call fcn.140419458
mov qword [rbp + 0xf0], r12
mov qword [rbp + reloc.WS2_32.dll_ntohs8], 0xf
mov byte [rbp + 0xe0], 0
movabs rax, 0x4ffefc005c4cc316
mov qword [rbp + 0x380], rax
mov rax, qword [rbp + 0x380]
mov qword [rbp - 0x50], rax
movabs rax, 0xd7c6b6426fa2078c
mov qword [rbp + 0x380], rax
mov rax, qword [rbp + 0x380]
mov qword [rbp - 0x48], rax
mov qword [rbp + 0x380], r13
mov rax, qword [rbp + 0x380]
mov qword [rbp + 0x110], rax
mov qword [rbp + 0x380], rsi
mov rax, qword [rbp + 0x380]
mov qword [rbp + 0x118], rax
movdqa xmm0, xmmword [rbp - 0x50]
pxor xmm0, xmmword [rbp + 0x110]
movdqa xmmword [rbp - 0x50], xmm0
lea rsi, [rsp + 0x78]
cmp qword [rbp - 0x70], 0x10
cmovae rsi, qword [rsp + 0x78]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov edi, dword [rcx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x140397026
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140397026
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r11 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r11
mov r8d, 0x5e329a8c
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140397021
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140397000
cmp r8d, 0xf8672d82
je 0x14039702b
test r9d, r9d
jne 0x140396fe0
mov rax, qword [rax]
jmp 0x140396fb0
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
mov dword [rsp + 0x28], 0xbb8
mov word [rsp + 0x20], r12w
mov r9d, reloc.WS2_32.dll_recv
lea r8, [rbp - 0x50]
mov rdx, rsi
xor ecx, ecx
call r10
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1403970f6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1403970f6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov ecx, dword [rcx + rbx]
add rcx, r10
mov r8d, 0x613060ae
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1403970f1
nop dword [rax]
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x1403970d0
cmp r8d, 0xebb03128
je 0x1403970fb
test r9d, r9d
jne 0x1403970b0
mov rax, qword [rax]
jmp 0x140397080
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov r8d, dword [rcx + rax*4]
add r8, r10
mov edx, dword [0x7ffe0014]
mov rcx, r14
call r8
mov ecx, 0xa
call fcn.140419954
lea rcx, [rax + 1]
call fcn.140419458
mov ecx, 4
call fcn.1404196c8
mov rbx, rax
mov edx, 4
mov rcx, rax
call fcn.140419458
mov dword [rbx], 0xa
mov ecx, 4
call fcn.1404196c8
mov rbx, rax
mov edx, 4
mov rcx, rax
call fcn.140419458
mov edx, 4
mov rcx, rbx
call fcn.140419458
mov ecx, dword [0x7ffe0014]
int 0x29
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
jb 0x1403971bf
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1403971ba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140397390
call fcn.140419458
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x78], 0
mov rdx, qword [rbp + 0x178]
cmp rdx, 0x10
jb 0x140397212
inc rdx
mov rcx, qword [rbp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14039720c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140397315
call fcn.140419458
nop
lea rax, vtable.ATL::CAccessToken.0
mov qword [rsp + 0x38], rax
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
test rdx, rdx
je 0x140397242
test rcx, rcx
je 0x14039723d
call qword [sym.imp.USERENV.dll_UnloadUserProfile]
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x48], r12
test rcx, rcx
je 0x140397252
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x40], r12
mov edx, 8
mov rcx, qword [rsp + 0x50]
call fcn.140419458
mov qword [rsp + 0x50], r12
lea rax, vtable.ATL::CSid.0
mov qword [rbp + 0x220], rax
mov rdx, qword [rbp + 0x290]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140397295
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rdx, qword [rbp + 0x288]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1403972b6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rdx, qword [rbp + 0x280]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1403972d7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rdx, qword [rbp + 0x278]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x1403972f7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rax, r15
mov rbx, qword [rsp + 0x488]
add rsp, 0x430
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140428d2c
int3
mov ecx, 0x8007000e
call fcn.140359960
nop
mov ecx, 0x80004005
call fcn.140359960
nop
mov ecx, 0x80004005
call fcn.140359960
nop
mov ecx, 0x80004005
call fcn.140359960
nop
mov ecx, 0x80004005
call fcn.140359960
nop
call fcn.140428d2c
nop
call fcn.140428d2c
nop
call fcn.140428d2c
int3
mov ecx, 0x80070057
call fcn.140359960
int3
call fcn.140428e78
mov dword [rax], socket
call fcn.140428d0c
mov ecx, 0x80070057
call fcn.140359960
nop
call fcn.140428d2c
nop
call fcn.140428d2c
int3