Function at 0x1401303b0
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x330]
sub rsp, 0x430
movaps xmmword [rsp + 0x420], xmm6
mov rax, qword [0x140714d80]
xor rax, rsp
mov qword [rbp + 0x310], rax
mov rsi, r8
mov qword [rbp - 0x20], r8
mov r13, rdx
mov r12, rcx
mov qword [rbp + 0xf8], rdx
mov qword [rbp + 0x100], r8
xor r14d, r14d
mov dword [rsp + 0x68], r14d
call fcn.1401219e0
lea rcx, [rbp + 0x178]
call fcn.14013af70
nop
mov dword [rbp - 0x78], 0x7a647d37
mov dword [rbp - 0x74], 0x7c7e6470
mov word [rbp - 0x70], 0x24
mov byte [rbp - 0x6e], 1
mov dword [rbp + 0xe8], 0x79727c37
mov dword [rbp + 0xec], 0x1002b70
mov dword [rsp + 0x70], 0x67766137
mov dword [rsp + 0x74], 0x76787f66
mov dword [rsp + 0x78], 0x267e70
mov byte [rsp + 0x7c], 1
mov dword [rbp - 0x58], 0x7d647a37
mov dword [rbp - 0x54], 0x1002b71
mov dword [rsp + 0x68], 0x67726237
mov dword [rsp + 0x6c], 0x1002b66
mov dword [rbp - 0x50], 0x71606737
mov dword [rbp - 0x4c], 0x75767867
mov dword [rbp - 0x48], 0x100277c
mov dword [rbp + 0x108], 0x71636b65
mov dword [rbp + 0x10c], 0x7f787a28
mov dword [rbp + 0x110], 0x1007470
lea r8, [rbp - 0x50]
lea rdx, [rbp + 0x108]
lea rcx, [rbp + 0x118]
call fcn.140117b00
nop
mov rdx, r13
cmp qword [r13 + 0x18], 0xf
jbe 0x1401304dd
mov rdx, qword [r13]
mov r8, qword [r13 + 0x10]
mov rcx, rax
call fcn.14006ec50
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x158], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x168], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rsp + 0x68]
lea rdx, [rbp + 0x158]
lea rcx, [rbp + 8]
call fcn.1401172d0
nop
mov rdx, rsi
cmp qword [rsi + 0x18], 0xf
jbe 0x140130530
mov rdx, qword [rsi]
mov r8, qword [rsi + 0x10]
mov rcx, rax
call fcn.14006ec50
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x18], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 8], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rbp - 0x58]
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0xc8]
call fcn.1401172d0
nop
lea rdx, [rbp + 0x178]
cmp qword [rbp + 0x190], 0xf
cmova rdx, qword [rbp + 0x178]
mov r8, qword [rbp + 0x188]
mov rcx, rax
call fcn.14006ec50
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xa8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xb8], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rsp + 0x70]
lea rdx, [rbp + 0xa8]
lea rcx, [rbp + 0x88]
call fcn.140117dd0
nop
lea rdx, [r12 + 0x240]
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x1401305e8
mov rdx, qword [rdx]
mov rcx, rax
call fcn.14006ec50
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x78], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rbp + 0xe8]
lea rdx, [rbp + 0x68]
lea rcx, [rbp + 0x48]
call fcn.1401172d0
nop
mov rdx, r12
cmp qword [r12 + 0x18], 0xf
jbe 0x140130632
mov rdx, qword [r12]
mov r8, qword [r12 + 0x10]
mov rcx, rax
call fcn.14006ec50
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x28], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x38], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rbp - 0x78]
lea rdx, [rbp + 0x28]
lea rcx, [rbp - 0x40]
call fcn.1401177b0
nop
lea rdx, [r12 + 0x20]
cmp qword [r12 + 0x38], 0xf
jbe 0x140130681
mov rdx, qword [r12 + 0x20]
mov r8, qword [r12 + 0x30]
mov rcx, rax
call fcn.14006ec50
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1d8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1e8], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x1401306f0
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401306eb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401306eb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140224898
movdqa xmm6, xmmword [0x14037a260]
movdqu xmmword [rbp - 0x30], xmm6
mov byte [rbp - 0x40], 0
mov rdx, qword [rbp + 0x40]
cmp rdx, 0xf
jbe 0x140130740
inc rdx
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14013073a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14013073a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140224898
nop
mov rdx, qword [rbp + 0x60]
cmp rdx, 0xf
jbe 0x14013077e
inc rdx
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140130779
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140130779
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140224898
movdqu xmmword [rbp + 0x58], xmm6
mov byte [rbp + 0x48], 0
mov rdx, qword [rbp + 0x80]
cmp rdx, 0xf
jbe 0x1401307c9
inc rdx
mov rcx, qword [rbp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401307c3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401307c3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140224898
nop
mov rdx, qword [rbp + 0xa0]
cmp rdx, 0xf
jbe 0x14013080d
inc rdx
mov rcx, qword [rbp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140130808
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140130808
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140224898
movdqu xmmword [rbp + 0x98], xmm6
mov byte [rbp + 0x88], 0
mov rdx, qword [rbp + 0xc0]
cmp rdx, 0xf
jbe 0x140130861
inc rdx
mov rcx, qword [rbp + 0xa8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14013085b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14013085b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140224898
nop
mov rdx, qword [rbp + 0xe0]
cmp rdx, 0xf
jbe 0x1401308a5
inc rdx
mov rcx, qword [rbp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401308a0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401308a0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140224898
movdqu xmmword [rbp + 0xd8], xmm6
mov byte [rbp + 0xc8], 0
mov rdx, qword [rbp]
cmp rdx, 0xf
jbe 0x1401308f3
inc rdx
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401308ed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401308ed
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140224898
nop
mov rdx, qword [rbp + 0x20]
cmp rdx, 0xf
jbe 0x140130931
inc rdx
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14013092c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14013092c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140224898
movdqu xmmword [rbp + 0x18], xmm6
mov byte [rbp + 8], 0
mov rdx, qword [rbp + 0x170]
cmp rdx, 0xf
jbe 0x14013097f
inc rdx
mov rcx, qword [rbp + 0x158]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140130979
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140130979
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140224898
nop
mov rdx, qword [rbp + 0x130]
cmp rdx, 0xf
jbe 0x1401309c3
inc rdx
mov rcx, qword [rbp + 0x118]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401309be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401309be
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140224898
movdqu xmmword [rbp + 0x128], xmm6
mov byte [rbp + 0x118], 0
lea rax, [rbp + 0x158]
mov qword [rbp - 0x68], rax
lea rdx, [r12 + 0x60]
lea rcx, [rbp + 0x158]
call fcn.1400df200
mov rbx, rax
lea rdx, [rbp + 0x1d8]
lea rcx, [rbp - 0x18]
call fcn.1400df200
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x198]
call fcn.140132de0
nop
lea rax, [rbp - 0x40]
mov qword [rsp + 0x58], rax
lea rdx, [rbp + 0x198]
cmp qword [rbp + 0x1b0], 0xf
cmova rdx, qword [rbp + 0x198]
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], r14
mov r14, 0xffffffffffffffff
mov r8, r14
nop
inc r8
cmp byte [rdx + r8], 0
jne 0x140130a50
lea rcx, [rbp - 0x40]
call fcn.14006d8c0
nop
lea rax, [rbp + 0x118]
mov qword [rbp - 0x68], rax
lea rdx, [0x140713ea8]
lea rcx, [rbp + 0x118]
call fcn.1400df200
mov rbx, rax
lea rdx, [0x140713e88]
lea rcx, [rbp + 8]
call fcn.1400df200
nop
lea r8, [rbp - 0x40]
mov rdx, rbx
mov rcx, rax
call fcn.14011f4e0
xor eax, 0xa5a5
mov edx, eax
shr eax, 8
movzx r8d, al
movzx eax, dl
movabs rcx, 0xcbf29ce484222325
xor rax, rcx
movabs r15, 0x100000001b3
imul rax, r15
xor r8, rax
imul r8, r15
mov eax, edx
shr eax, 0x10
movzx ecx, al
xor r8, rcx
imul r8, r15
shr rdx, 0x18
xor r8, rdx
imul r8, r15
cmp r8w, 0xdf7f
jne 0x1401317ff
mov qword [rbp + 0x150], 0
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x118]
lea rdx, [rbp + 0x198]
lea rcx, [rbp + 0x108]
call fcn.14011b810
nop
lea rdx, [r12 + 0x20]
lea rcx, [rsp + 0x70]
call fcn.140116b60
nop
mov dword [rsp + 0x5c], 0x646972
mov dword [rsp + 0x58], 0x656e776f
mov byte [rsp + 0x60], 0
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x5f]
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x40]
call fcn.14006d490
nop
movzx ecx, byte [rbp + 0x108]
test cl, cl
jne 0x140130b91
mov byte [rbp + 0x108], 1
call fcn.140119e60
mov qword [rbp + 0x110], rax
movzx ecx, byte [rbp + 0x108]
jmp 0x140130b98
mov rax, qword [rbp + 0x110]
cmp cl, 1
jne 0x140130bab
lea rdx, [rbp - 0x40]
mov rcx, rax
call fcn.14011efd0
jmp 0x140130bb0
mov rax, qword [rsp + 0x58]
lea rdx, [rsp + 0x70]
mov rcx, rax
call fcn.14011ec00
movzx ebx, al
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x140130bfe
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140130bf9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140130bf9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140224898
movdqu xmmword [rbp - 0x30], xmm6
mov byte [rbp - 0x40], 0
movzx edx, byte [rsp + 0x70]
lea rcx, [rsp + 0x78]
call fcn.140126380
test bl, bl
jne 0x140130cc9
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140130ca6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140130ca6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0xa65b68aa
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140130ca1
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140130c80
cmp r8d, 0x9a323622
je 0x140130cab
test r9d, r9d
jne 0x140130c60
mov rax, qword [rax]
jmp 0x140130c30
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov ecx, 8
call rdx
mov dword [rbp - 0x64], 0x656761
mov dword [rbp - 0x68], 0x7373656d
mov byte [rbp - 0x60], 0
lea r9, [rsp + 0x50]
lea r8, [rbp - 0x61]
lea rdx, [rbp - 0x68]
lea rcx, [rbp - 0x40]
call fcn.14006d490
nop
movzx ecx, byte [rbp + 0x108]
test cl, cl
jne 0x140130d19
mov byte [rbp + 0x108], 1
call fcn.140119e60
mov qword [rbp + 0x110], rax
movzx ecx, byte [rbp + 0x108]
jmp 0x140130d20
mov rax, qword [rbp + 0x110]
cmp cl, 1
jne 0x140130d33
lea rdx, [rbp - 0x40]
mov rcx, rax
call fcn.14011efd0
jmp 0x140130d38
mov rax, qword [rsp + 0x58]
xorps xmm0, xmm0
movups xmmword [rbp + 0x1b8], xmm0
movdqu xmmword [rbp + 0x1c8], xmm6
mov byte [rbp + 0x1b8], 0
mov dword [rsp + 0x68], 0x2ffc
cmp byte [rax], 3
jne 0x140130d70
mov rdx, qword [rax + 8]
lea rax, [rbp + 0x1b8]
cmp rax, rdx
je 0x140130d8d
jmp 0x140130d72
xor edx, edx
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x140130d80
mov rdx, qword [rdx]
lea rcx, [rbp + 0x1b8]
call fcn.14006ece0
nop
mov r8, qword [rbp - 0x28]
cmp r8, 0xf
jbe 0x140130da4
mov rdx, qword [rbp - 0x40]
lea rcx, [rbp - 0x40]
call fcn.1400ea290
movdqu xmmword [rbp - 0x30], xmm6
mov byte [rbp - 0x40], 0
mov word [rsp + 0x6b], 0x65
mov word [rsp + 0x68], 0x6f63
mov byte [rsp + 0x6a], 0x64
mov byte [rsp + 0x6d], 0
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x6c]
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x118]
call fcn.14006d490
nop
movzx ecx, byte [rbp + 0x108]
test cl, cl
jne 0x140130e08
mov byte [rbp + 0x108], 1
call fcn.140119e60
mov qword [rbp + 0x110], rax
movzx ecx, byte [rbp + 0x108]
jmp 0x140130e0f
mov rax, qword [rbp + 0x110]
cmp cl, 1
jne 0x140130e25
lea rdx, [rbp + 0x118]
mov rcx, rax
call fcn.14011efd0
jmp 0x140130e2a
mov rax, qword [rsp + 0x58]
mov rcx, rax
call fcn.140117200
mov edx, eax
shr eax, 8
movzx edi, al
movzx eax, dl
movabs rcx, 0xcbf29ce484222325
xor rax, rcx
imul rax, r15
xor rdi, rax
imul rdi, r15
mov eax, edx
shr eax, 0x10
movzx ecx, al
xor rdi, rcx
imul rdi, r15
shr rdx, 0x18
xor rdi, rdx
imul rdi, r15
mov r8, qword [rbp + 0x130]
cmp r8, 0xf
jbe 0x140130e8f
mov rdx, qword [rbp + 0x118]
lea rcx, [rbp + 0x118]
call fcn.1400ea290
mov dword [rsp + 0x5c], 0x737365
mov dword [rsp + 0x58], 0x63637573
mov byte [rsp + 0x60], 0
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x5f]
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x158]
call fcn.14006d490
nop
mov ebx, 0x3dffd
mov dword [rsp + 0x68], ebx
movzx ecx, byte [rbp + 0x108]
test cl, cl
jne 0x140130ef0
mov byte [rbp + 0x108], 1
call fcn.140119e60
mov qword [rbp + 0x110], rax
movzx ecx, byte [rbp + 0x108]
jmp 0x140130ef7
mov rax, qword [rbp + 0x110]
cmp cl, 1
jne 0x140130f10
lea rdx, [rbp + 0x158]
mov rcx, rax
call fcn.14011efd0
mov rcx, rax
jmp 0x140130f15
mov rcx, qword [rsp + 0x58]
lea rax, [rcx + 8]
cmp byte [rcx], 4
mov r15d, 0
cmovne rax, r15
cmp byte [rax], r15b
je 0x140130fe3
mov dword [rbp + 0xec], 0x737365
mov dword [rbp + 0xe8], 0x63637573
mov byte [rbp + 0xf0], r15b
lea r9, [rsp + 0x50]
lea r8, [rbp + 0xef]
lea rdx, [rbp + 0xe8]
lea rcx, [rbp + 0x118]
call fcn.14006d490
nop
mov ebx, 0x33dfff
mov dword [rsp + 0x68], ebx
movzx ecx, byte [rbp + 0x108]
test cl, cl
jne 0x140130f9a
mov byte [rbp + 0x108], 1
call fcn.140119e60
mov qword [rbp + 0x110], rax
movzx ecx, byte [rbp + 0x108]
jmp 0x140130fa1
mov rax, qword [rbp + 0x110]
cmp cl, 1
jne 0x140130fba
lea rdx, [rbp + 0x118]
mov rcx, rax
call fcn.14011efd0
mov rcx, rax
jmp 0x140130fbf
mov rcx, qword [rsp + 0x58]
lea rax, [rcx + 8]
cmp byte [rcx], 4
cmovne rax, r15
cmp byte [rax], 0
je 0x140130fde
movabs rax, 0xcbe5c873d26645f1
cmp rdi, rax
je 0x140130fe3
xor dil, dil
jmp 0x140130fe6
mov dil, 1
test bl, 2
je 0x140130ffb
and ebx, 0xfffffffd
lea rcx, [rbp + 0x118]
call fcn.14006ead0
nop
test bl, 1
je 0x14013100c
lea rcx, [rbp + 0x158]
call fcn.14006ead0
test dil, dil
je 0x140131729
lea rdx, [rbp + 0x108]
lea rcx, [rsp + 0x70]
call fcn.14011de50
mov rdx, rax
mov rcx, r12
call fcn.14012ee30
mov dword [rsp + 0x5c], 0x737365
mov dword [rsp + 0x58], 0x63637573
mov byte [rsp + 0x60], 0
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x5f]
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x118]
call fcn.14006d490
nop
movzx ecx, byte [rbp + 0x108]
test cl, cl
jne 0x140131089
mov byte [rbp + 0x108], 1
call fcn.140119e60
mov qword [rbp + 0x110], rax
movzx ecx, byte [rbp + 0x108]
jmp 0x140131090
mov rax, qword [rbp + 0x110]
cmp cl, 1
jne 0x1401310a9
lea rdx, [rbp + 0x118]
mov rcx, rax
call fcn.14011efd0
mov rcx, rax
jmp 0x1401310ae
mov rcx, qword [rsp + 0x58]
lea rax, [rcx + 8]
cmp byte [rcx], 4
cmovne rax, r15
movzx ebx, byte [rax]
lea rcx, [rbp + 0x118]
call fcn.14006ead0
test bl, bl
je 0x140131172
mov word [rsp + 0x6b], reloc.WS2_32.dll_WSAGetLastError
mov word [rsp + 0x68], 0x6e69
mov byte [rsp + 0x6a], 0x66
mov byte [rsp + 0x6d], 0
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x6c]
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x118]
call fcn.14006d490
nop
movzx ecx, byte [rbp + 0x108]
test cl, cl
jne 0x14013112b
mov byte [rbp + 0x108], 1
call fcn.140119e60
mov qword [rbp + 0x110], rax
movzx ecx, byte [rbp + 0x108]
jmp 0x140131132
mov rax, qword [rbp + 0x110]
cmp cl, 1
jne 0x140131148
lea rdx, [rbp + 0x118]
mov rcx, rax
call fcn.14011efd0
jmp 0x14013114d
mov rax, qword [rsp + 0x58]
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.14011de50
mov rdx, rax
mov rcx, r12
call fcn.14012f200
nop
lea rcx, [rbp + 0x118]
call fcn.14006ead0
mov dword [rsp + 0x70], 0x607a7c58
mov dword [rsp + 0x74], 0x717b777c
mov dword [rsp + 0x78], 0x7f7f63
mov byte [rsp + 0x7c], 1
lea rcx, [rsp + 0x70]
call fcn.140120770
mov rdx, rax
lea rcx, [r12 + 0x218]
call fcn.140116ed0
test al, al
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
je 0x140131690
lea r15, [0x140713e68]
mov rsi, r15
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
cmova rsi, qword [0x140713e68]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140131256
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140131256
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x8197d432
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140131251
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140131230
cmp r8d, 0xf81b1a74
je 0x14013125b
test r9d, r9d
jne 0x140131210
mov rax, qword [rax]
jmp 0x1401311e0
mov edx, dword [rdi + 0x1c]
add rdx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rdx + rax*4]
add rdx, r10
mov rcx, rsi
call rdx
movdqa xmm0, xmmword [str.R_ODgypjxw_i]
movdqu xmmword [rsp + 0x70], xmm0
mov byte [rbp - 0x80], 1
lea rcx, [rsp + 0x70]
call fcn.140120720
mov r9, rax
inc r14
cmp byte [rax + r14], 0
jne 0x140131296
mov rcx, qword [0x140713e78]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, r14
jb 0x140131a71
mov rax, r15
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
cmova rax, qword [0x140713e68]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
mov r8, r15
movzx edx, byte [rsp + 0x50]
lea rcx, [rbp + 0x158]
call fcn.1400df560
nop
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x200]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 2
lea rdx, [rbp + 0x158]
lea rcx, [rbp + 0x200]
call fcn.14011e0c0
nop
cmp qword [rbp + 0x288], 0
je 0x14013136c
mov rdx, r15
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
cmova rdx, qword [0x140713e68]
mov r8, qword [0x140713e78]
lea rcx, [rbp + 0x200]
call fcn.1400d5680
lea rcx, [rbp + 0x200]
call fcn.1401231c0
mov dword [rbp - 0x78], 0x60757d42
mov dword [rbp - 0x74], 0x7d657762
mov word [rbp - 0x70], 0x45
mov byte [rbp - 0x6e], 1
lea rcx, [rbp - 0x78]
call fcn.1401206e0
mov rdx, rax
mov r8, r15
lea rcx, [rbp + 0x118]
call fcn.14006d5d0
nop
lea rdx, [rbp + 0x118]
cmp qword [rbp + 0x130], 0xf
cmova rdx, qword [rbp + 0x118]
xor ecx, ecx
mov qword [rsp + 0x40], rcx
lea rax, [rbp + 0xe8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], ecx
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14013159b
mov r14, qword [0x140713e78]
inc r14
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
jbe 0x140131411
mov r15, qword [0x140713e68]
mov rsi, r15
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov edi, dword [rcx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x1401314a6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1401314a6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r11 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r11
mov r8d, 0x65850f00
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1401314a1
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140131480
cmp r8d, 0x253c0ffd
je 0x1401314ab
test r9d, r9d
jne 0x140131460
mov rax, qword [rax]
jmp 0x140131430
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r15
mov r9d, 1
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rbp + 0xe8]
call r10
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140131576
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140131576
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0xf88acd12
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140131571
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140131550
cmp r8d, 0xa8a7722b
je 0x14013157b
test r9d, r9d
jne 0x140131530
mov rax, qword [rax]
jmp 0x140131500
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov rcx, qword [rbp + 0xe8]
call rdx
lea rsi, [r12 + 0x20]
cmp qword [rsi + 0x18], 0xf
jbe 0x1401315aa
mov rsi, qword [rsi]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140131636
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140131636
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x86e073c9
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140131631
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140131610
cmp r8d, 0xd9548c1f
je 0x14013163b
test r9d, r9d
jne 0x1401315f0
mov rax, qword [rax]
jmp 0x1401315c0
mov edx, dword [rdi + 0x1c]
add rdx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rdx + rax*4]
add rdx, r10
mov rcx, rsi
call rdx
nop
lea rcx, [rbp + 0x118]
call fcn.14006ead0
nop
lea rcx, [rbp + 0x200]
call fcn.1400e45c0
nop
lea rcx, [rbp + 0x158]
call fcn.14006ead0
mov rsi, qword [rbp - 0x20]
jmp 0x1401317da
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140131706
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140131706
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0xbed81989
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140131701
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1401316e0
cmp r8d, 0x4dd3ee69
je 0x14013170b
test r9d, r9d
jne 0x1401316c0
mov rax, qword [rax]
jmp 0x140131690
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
mov ecx, listen
jmp 0x1401317d4
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1401317b6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1401317b6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x1c8bf758
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1401317b1
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140131790
cmp r8d, 0xb6bf24a8
je 0x1401317bb
test r9d, r9d
jne 0x140131770
mov rax, qword [rax]
jmp 0x140131740
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
mov ecx, 9
add rdx, r10
call rdx
nop
lea rcx, [rbp + 0x1b8]
call fcn.14006ead0
nop
movzx edx, byte [rbp + 0x108]
lea rcx, [rbp + 0x110]
call fcn.140126380
jmp 0x1401318aa
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140131886
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140131886
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov ecx, dword [rcx + rbx]
add rcx, r10
mov r8d, 0xbecbd253
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140131881
nop dword [rax]
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x140131860
cmp r8d, 0xb48d1e83
je 0x14013188b
test r9d, r9d
jne 0x140131840
mov rax, qword [rax]
jmp 0x140131810
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov ecx, 7
call rdx
nop
mov rdx, qword [rbp + 0x1b0]
cmp rdx, 0xf
jbe 0x1401318ee
inc rdx
mov rcx, qword [rbp + 0x198]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401318e9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401318e9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140224898
movdqu xmmword [rbp + 0x1a8], xmm6
mov byte [rbp + 0x198], 0
mov rdx, qword [rbp + 0x1f0]
cmp rdx, 0xf
jbe 0x140131942
inc rdx
mov rcx, qword [rbp + 0x1d8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14013193c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14013193c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140224898
nop
mov rdx, qword [rbp + 0x190]
cmp rdx, 0xf
jbe 0x140131986
inc rdx
mov rcx, qword [rbp + 0x178]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140131981
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140131981
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140224898
xor ebx, ebx
mov qword [rbp + 0x188], rbx
mov qword [rbp + 0x190], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x178], bl
mov rdx, qword [r13 + 0x18]
cmp rdx, 0xf
jbe 0x1401319db
mov rcx, qword [r13]
inc rdx
cmp rdx, 0x1000
jb 0x1401319d6
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140131a63
mov rcx, r8
call fcn.140224898
mov qword [r13 + 0x10], rbx
mov qword [r13 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r13], 0
mov rdx, qword [rsi + 0x18]
cmp rdx, 0xf
jbe 0x140131a22
inc rdx
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x140131a1d
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140131a6a
mov rcx, r8
call fcn.140224898
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], 0
mov rcx, qword [rbp + 0x310]
xor rcx, rsp
call fcn.140225440
mov rbx, qword [rsp + 0x488]
movaps xmm6, xmmword [rsp + 0x420]
add rsp, 0x430
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.14006ec10
int3