Function at 0x140382910
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x278]
sub rsp, 0x378
xor r14d, r14d
mov dword [rsp + 0x50], r14d
lea edx, [r14 + 0x10]
mov rcx, qword [0x14049bfa8]
call fcn.140393e50
mov rsi, rax
mov qword [rsp + 0x60], rax
movabs rax, 0xadabf8e08f285c5a
movabs rdx, 0xee859de8bc3d5d3a
movabs rbx, 0x6f366752f465de03
movabs rdi, 0xeae467dafc22d51f
movabs r8, 0x37561c353675b660
movabs r9, 0x76b69d3c17c6ed5c
movabs r10, 0x5144da9ff5e4c88c
movabs r11, 0x82f6452a6173fdde
movabs r15, 0xb4d2ccfe8694583d
movabs r12, 0x12763d824d18abd7
movabs r13, 0xded99d93da746619
test rsi, rsi
jne 0x14038301b
mov rcx, qword [0x14049bfa8]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x10], rax
mov qword [rsp + 0x40], rdx
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x18], rax
mov qword [rsp + 0x40], r8
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x20], rax
mov qword [rsp + 0x40], r9
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x28], rax
mov qword [rsp + 0x40], r10
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x30], rax
mov qword [rsp + 0x40], r11
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x40], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x48], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x50], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x58], rax
mov qword [rsp + 0x40], r13
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x160], rax
movabs rax, 0x8bc1c19ad94e0866
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x168], rax
movabs rax, 0x423740455901dd13
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x170], rax
movabs rax, 0x2ac5ed4c76e68528
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x178], rax
movabs rax, 0x3964f7bf9d90bded
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x180], rax
movabs rax, 0xe3992976120389aa
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x188], rax
movabs rax, 0x33551521a817bb67
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x190], rax
movabs rax, 0x93900ea88941b06c
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x198], rax
movabs rax, 0xc0bbbe8be5f12b61
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x1a0], rax
movabs rax, 0x12763df23d7b85ae
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x1a8], rax
movdqa xmm0, xmmword [rbp + 0x10]
pxor xmm0, xmmword [rbp + 0x160]
movdqa xmmword [rbp + 0x10], xmm0
movdqa xmm1, xmmword [rbp + 0x170]
pxor xmm1, xmmword [rbp + 0x20]
movdqa xmmword [rbp + 0x20], xmm1
movdqa xmm0, xmmword [rbp + 0x180]
pxor xmm0, xmmword [rbp + 0x30]
movdqa xmmword [rbp + 0x30], xmm0
movdqa xmm1, xmmword [rbp + 0x40]
pxor xmm1, xmmword [rbp + 0x190]
movdqa xmmword [rbp + 0x40], xmm1
movdqa xmm0, xmmword [rbp + 0x50]
pxor xmm0, xmmword [rbp + 0x1a0]
movdqa xmmword [rbp + 0x50], xmm0
mov r9d, 0xf2
lea r8, [rbp + 0x10]
lea rdx, [rbp - 0x38]
call fcn.140398980
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
mov qword [rbp + 0x110], r14
mov qword [rbp + 0x118], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x100], sil
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], r14
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x58], sil
mov dword [rsp + 0x50], 1
lea r8, [rbp - 0x38]
cmp qword [rbp - 0x20], 0x10
cmovae r8, qword [rbp - 0x38]
mov r9, qword [rbp - 0x28]
xor edx, edx
lea rcx, [rbp - 0x58]
call fcn.14035ab50
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xc0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xd0], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], sil
mov dword [rsp + 0x50], 0x1001
lea rdx, [rbp + 0xc0]
call fcn.14035b6c0
nop
mov rdx, qword [rbp + 0xd8]
cmp rdx, 0x10
jb 0x140382cab
inc rdx
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140382ca6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140383d48
call fcn.140419458
mov qword [rbp + 0xd0], r14
mov qword [rbp + 0xd8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xc0], 0
mov dword [rsp + 0x50], 0x1000
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x140382d07
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140382d02
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140383d4e
call fcn.140419458
mov qword [rbp - 0x48], r14
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x58], 0
mov byte [rbp + 0x2c0], 0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov edi, dword [rcx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x140382da6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140382da6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r11]
add rdx, r11
mov r8d, 0x8c77e866
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140382da1
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140382d80
cmp r8d, 0x326eebfa
je 0x140382dab
test r9d, r9d
jne 0x140382d60
mov rax, qword [rax]
jmp 0x140382d30
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
lea r9, [rbp + 0x2c0]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x14]
call r10
mov dword [rbp - 0x80], 1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov edi, dword [rcx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x140382e66
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140382e66
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r11]
add rdx, r11
mov r8d, 0x8d77e9f9
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140382e61
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140382e40
cmp r8d, 0x8b41d43e
je 0x140382e6b
test r9d, r9d
jne 0x140382e20
mov rax, qword [rax]
jmp 0x140382df0
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
mov r9d, 4
lea r8, [rbp - 0x80]
lea edx, [r9 + 0x19]
mov rcx, 0xffffffffffffffff
call r10
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140382f26
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140382f26
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x1a7b0687
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140382f21
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140382f00
cmp r8d, 0x485a8421
je 0x140382f2b
test r9d, r9d
jne 0x140382ee0
mov rax, qword [rax]
jmp 0x140382eb0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov r8d, dword [rcx + rax*4]
add r8, r10
mov edx, dword [0x7ffe0014]
mov rcx, 0xffffffffffffffff
call r8
mov ecx, 0xa
call fcn.140419954
lea rcx, [rax + 1]
call fcn.140419458
mov ecx, 4
call fcn.1404196c8
mov rbx, rax
mov edx, 4
mov rcx, rax
call fcn.140419458
mov dword [rbx], 0xa
mov ecx, 4
call fcn.1404196c8
mov rbx, rax
mov edx, 4
mov rcx, rax
call fcn.140419458
mov edx, 4
mov rcx, rbx
call fcn.140419458
mov ecx, dword [0x7ffe0014]
int 0x29
mov qword [rbp + 0x110], r14
mov qword [rbp + 0x118], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x100], 0
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x14038300b
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140383006
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140383d54
call fcn.140419458
mov qword [rbp - 0x28], r14
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x38], 0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r14
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1403830b6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1403830b6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x5bbe7347
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1403830b1
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140383090
cmp r8d, 0x8f63e86e
je 0x1403830bb
test r9d, r9d
jne 0x140383070
mov rax, qword [rax]
jmp 0x140383040
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov ecx, dword [rcx + rax*4]
add rcx, r10
call rcx
mov dword [rsp + 0x58], eax
mov r12d, r14d
mov rbx, qword [rsp + 0x70]
mov r13, qword [rsp + 0x68]
cmp dword [rsi], r14d
jbe 0x1403832d6
lea r15, [rsi + 0xe]
mov rcx, qword [rsp + 0x60]
nop word [rax + rax]
mov esi, dword [r15 - 6]
movzx r8d, word [r15]
mov qword [rbp + 0xb8], r8
cmp eax, esi
je 0x1403832c6
mov rax, r13
cmp r13, rbx
je 0x14038312d
nop
cmp dword [rax], esi
je 0x14038312d
add rax, 0x20
cmp rax, rbx
jne 0x140383120
cmp rax, rbx
jne 0x140383299
mov qword [rbp + 0xb0], r8
mov edx, 1
call fcn.14038c9e0
mov rdi, rax
mov qword [rbp + 0x140], rax
lea r14, [rax + 8]
mov qword [rbp + 0x150], r14
mov rax, qword [rbp + 0xb0]
mov qword [rdi], rax
mov qword [rbp + 0x148], r14
mov dword [rbp - 0x78], esi
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], 0
mov edx, 1
call fcn.14038c9e0
mov r8, rax
mov qword [rbp - 0x70], rax
lea rdx, [rax + 8]
mov qword [rbp - 0x60], rdx
mov rcx, qword [rdi]
mov qword [rax], rcx
mov qword [rbp - 0x68], rdx
cmp rbx, qword [rsp + 0x78]
je 0x1403831d5
mov dword [rbx], esi
xor esi, esi
mov eax, esi
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x68], rsi
mov ecx, esi
mov qword [rbp - 0x70], rcx
mov qword [rbx + 8], r8
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], rdx
add rbx, 0x20
mov qword [rsp + 0x70], rbx
jmp 0x1403831fa
lea r8, [rbp - 0x78]
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14038ca50
mov rbx, qword [rsp + 0x70]
mov r13, qword [rsp + 0x68]
mov rax, qword [rbp - 0x60]
mov rcx, qword [rbp - 0x70]
xor esi, esi
test rcx, rcx
je 0x140383244
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140383233
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140383d5a
call fcn.140419458
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], rsi
test rdi, rdi
je 0x1403832bd
sub r14, rdi
sar r14, 3
lea rdx, [r14*8]
cmp rdx, 0x1000
jb 0x14038327d
add rdx, 0x27
mov rcx, qword [rdi - 8]
sub rdi, rcx
lea rax, [rdi - 8]
cmp rax, 0x1f
ja 0x140383d60
mov rdi, rcx
mov rcx, rdi
call fcn.140419458
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x140], xmm0
mov qword [rbp + 0x150], rsi
jmp 0x1403832bd
lea rcx, [rax + 8]
mov rdx, qword [rcx + 8]
cmp rdx, qword [rcx + 0x10]
je 0x1403832b1
mov qword [rdx], r8
add qword [rcx + 8], 8
jmp 0x1403832bd
lea r8, [rbp + 0xb8]
call fcn.14038ced0
mov rcx, qword [rsp + 0x60]
mov eax, dword [rsp + 0x58]
inc r12d
add r15, 0x18
cmp r12d, dword [rcx]
jb 0x140383100
cmp r13, rbx
je 0x140383c12
mov r12d, dword [rsp + 0x58]
nop dword [rax]
nop dword [rax + rax]
mov esi, dword [r13]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140383386
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140383386
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x7bb2bacf
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140383381
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140383360
cmp r8d, 0x253cb2c8
je 0x14038338b
test r9d, r9d
jne 0x140383340
mov rax, qword [rax]
jmp 0x140383310
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov r9d, dword [rcx + rax*4]
add r9, r10
mov r8d, esi
xor edx, edx
mov ecx, 0x1fffff
call r9
mov r14, rax
test rax, rax
je 0x140383be6
mov rsi, qword [r13 + 8]
mov r15, qword [r13 + 0x10]
cmp rsi, r15
je 0x140383bdd
xor edi, edi
nop
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
lea r9, [rsp + 0x58]
mov r8, 0xffffffffffffffff
mov rdx, qword [rsi]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x140383bd0
xorps xmm0, xmm0
movups xmmword [rbp + 0x240], xmm0
movups xmmword [rbp + 0x250], xmm0
movups xmmword [rbp + 0x260], xmm0
mov qword [rsp + 0x20], rdi
mov r9d, 0x30
lea r8, [rbp + 0x240]
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x140383bc5
cmp r12, qword [rbp + 0x260]
jne 0x140383bc5
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
lea r9, [rsp + 0x40]
mov r8, 0xffffffffffffffff
mov rdx, qword [rsi]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x140383bba
mov rcx, qword [0x14049bfa8]
movabs rax, 0xadabf8e08f285c5a
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rbp + 0x60], rax
movabs rax, 0xee859de8bc3d5d3a
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rbp + 0x68], rax
movabs rax, 0x37561c353675b660
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rbp + 0x70], rax
movabs rax, 0x76b69d3c17c6ed5c
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rbp + 0x78], rax
movabs rax, 0x5144da9ff5e4c88c
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rbp + 0x80], rax
movabs rax, 0x82f6452a6173fdde
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rbp + 0x88], rax
movabs rax, 0x6f366752f465de03
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rbp + 0x90], rax
movabs rax, 0xeae467dafc22d51f
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rbp + 0x98], rax
movabs rax, 0xb4d2ccfe8694583d
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rbp + 0xa0], rax
movabs rax, 0x12763d824d18abd7
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rbp + 0xa8], rax
movabs rax, 0xded99d93da746619
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rbp + 0x1b0], rax
movabs rax, 0x8bc1c19ad94e0866
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rbp + 0x1b8], rax
movabs rax, 0x423740455901dd13
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rbp + 0x1c0], rax
movabs rax, 0x2ac5ed4c76e68528
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rbp + 0x1c8], rax
movabs rax, 0x3964f7bf9d90bded
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rbp + 0x1d0], rax
movabs rax, 0xe3992976120389aa
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rbp + 0x1d8], rax
movabs rax, 0x33551521a817bb67
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rbp + 0x1e0], rax
movabs rax, 0x93900ea88941b06c
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rbp + 0x1e8], rax
movabs rax, 0xc0bbbe8be5f12b61
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rbp + 0x1f0], rax
movabs rax, 0x12763df23d7b85ae
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rbp + 0x1f8], rax
movdqa xmm0, xmmword [rbp + 0x60]
pxor xmm0, xmmword [rbp + 0x1b0]
movdqa xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [rbp + 0x70]
pxor xmm1, xmmword [rbp + 0x1c0]
movdqa xmmword [rbp + 0x70], xmm1
movdqa xmm0, xmmword [rbp + 0x80]
pxor xmm0, xmmword [rbp + 0x1d0]
movdqa xmmword [rbp + 0x80], xmm0
movdqa xmm1, xmmword [rbp + 0x90]
pxor xmm1, xmmword [rbp + 0x1e0]
movdqa xmmword [rbp + 0x90], xmm1
movdqa xmm0, xmmword [rbp + 0xa0]
pxor xmm0, xmmword [rbp + 0x1f0]
movdqa xmmword [rbp + 0xa0], xmm0
mov r9d, 0x132
lea r8, [rbp + 0x60]
lea rdx, [rbp + 0x120]
call fcn.140398980
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x200], xmm0
mov qword [rbp + 0x210], rdi
mov qword [rbp + 0x218], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x200], 0
movups xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], rdi
mov qword [rbp], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x18], 0
mov ebx, dword [rsp + 0x50]
or ebx, 4
mov dword [rsp + 0x50], ebx
lea r8, [rbp + 0x120]
cmp qword [rbp + 0x138], 0x10
cmovae r8, qword [rbp + 0x120]
mov r9, qword [rbp + 0x130]
xor edx, edx
lea rcx, [rbp - 0x18]
call fcn.14035ab50
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xe0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xf0], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
or ebx, 0x10
mov dword [rsp + 0x50], ebx
lea rdx, [rbp + 0xe0]
call fcn.14035b6c0
nop
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0x10
jb 0x140383804
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1403837ff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140383d66
call fcn.140419458
mov qword [rbp + 0xf0], rdi
mov qword [rbp + reloc.WS2_32.dll_ntohs8], 0xf
mov byte [rbp + 0xe0], 0
test bl, 8
je 0x14038387c
and ebx, 0xfffffff7
mov dword [rsp + 0x50], ebx
mov rdx, qword [rbp + 0x238]
cmp rdx, 0x10
jb 0x14038386a
inc rdx
mov rcx, qword [rbp + 0x220]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140383865
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140383d6c
call fcn.140419458
mov qword [rbp + 0x238], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x220], 0
test bl, 4
je 0x1403838d3
and ebx, 0xfffffffb
mov dword [rsp + 0x50], ebx
mov rdx, qword [rbp]
cmp rdx, 0x10
jb 0x1403838c3
inc rdx
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1403838be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140383d72
call fcn.140419458
mov qword [rbp - 8], rdi
mov qword [rbp], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x18], 0
mov byte [rbp + 0x2d8], 0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov edi, dword [rcx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x140383966
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140383966
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r11 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r11
mov r8d, 0x793bc07
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140383961
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140383940
cmp r8d, 0xc5db1ab
je 0x14038396b
test r9d, r9d
jne 0x140383920
mov rax, qword [rax]
jmp 0x1403838f0
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
lea r9, [rbp + 0x2d8]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x14]
call r10
mov dword [rbp - 0x7c], 1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov edi, dword [rcx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x140383a26
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140383a26
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r11 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r11
mov r8d, 0x493b74e
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140383a21
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140383a00
cmp r8d, 0x3912a14f
je 0x140383a2b
test r9d, r9d
jne 0x1403839e0
mov rax, qword [rax]
jmp 0x1403839b0
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
mov r9d, 4
lea r8, [rbp - 0x7c]
lea edx, [r9 + 0x19]
mov rcx, 0xffffffffffffffff
call r10
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140383ae6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140383ae6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov ecx, dword [rcx + rbx]
add rcx, r10
mov r8d, 0x593b8e1
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140383ae1
nop dword [rax]
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x140383ac0
cmp r8d, 0x31636f03
je 0x140383aeb
test r9d, r9d
jne 0x140383aa0
mov rax, qword [rax]
jmp 0x140383a70
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov r8d, dword [rcx + rax*4]
add r8, r10
mov edx, dword [0x7ffe0014]
mov rcx, 0xffffffffffffffff
call r8
mov ecx, 0xa
call fcn.140419954
lea rcx, [rax + 1]
call fcn.140419458
mov ecx, 4
call fcn.1404196c8
mov rbx, rax
mov edx, 4
mov rcx, rax
call fcn.140419458
mov dword [rbx], 0xa
mov ecx, 4
call fcn.1404196c8
mov rbx, rax
mov edx, 4
mov rcx, rax
call fcn.140419458
mov edx, 4
mov rcx, rbx
call fcn.140419458
mov ecx, dword [0x7ffe0014]
int 0x29
mov rdx, qword [rbp + 0x138]
cmp rdx, 0x10
jb 0x140383bb8
inc rdx
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140383bb3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140383d78
call fcn.140419458
xor edi, edi
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsi, 8
cmp rsi, r15
jne 0x1403833d0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add r13, 0x20
mov rbx, qword [rsp + 0x70]
cmp r13, rbx
jne 0x1403832f0
mov r13, qword [rsp + 0x68]
cmp r13, rbx
je 0x140383c12
mov rdx, rbx
mov rcx, r13
call fcn.14038c790
mov qword [rsp + 0x70], r13
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140383ca6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140383ca6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x84c89b96
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140383ca1
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140383c80
cmp r8d, 0xcf1347ab
je 0x140383cab
test r9d, r9d
jne 0x140383c60
mov rax, qword [rax]
jmp 0x140383c30
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov r9d, dword [rcx + rax*4]
add r9, r10
xor edx, edx
mov r8d, 0x8000
mov rcx, qword [rsp + 0x60]
call r9
mov rax, qword [rbp + 0x2d0]
mov ecx, dword [rbp + 0x2c8]
mov dword [rax], ecx
mov rbx, qword [rsp + 0x68]
test rbx, rbx
je 0x140383d2e
mov rdx, qword [rsp + 0x70]
mov rcx, rbx
call fcn.14038c790
mov rdx, qword [rsp + 0x78]
sub rdx, rbx
and rdx, 0xffffffffffffffe0
mov rax, rbx
cmp rdx, 0x1000
jb 0x140383d26
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140383d42
mov rcx, rbx
call fcn.140419458
add rsp, 0x378
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140428d2c
nop
call fcn.140428d2c
nop
call fcn.140428d2c
nop
call fcn.140428d2c
nop
call fcn.140428d2c
nop
call fcn.140428d2c
nop
call fcn.140428d2c
nop
call fcn.140428d2c
nop
call fcn.140428d2c
nop
call fcn.140428d2c
int3