Function at 0x14004d6a0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Link many functions at runtime
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x190
lea rbp, [rsp + 0x40]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x14010f080]
xor rax, rsp
mov qword [rbp + 0x140], rax
mov esi, r8d
mov rdi, rdx
mov r12, rcx
mov ebx, 4
mov rax, qword gs:[0x58]
mov r13, qword [rax]
mov eax, dword [rbx + r13]
cmp dword [0x1401d5600], eax
jle 0x14004d724
lea rcx, [0x1401d5600]
call fcn.1400d23c8
cmp dword [0x1401d5600], 0xffffffff
jne 0x14004d724
call fcn.1400495c0
mov qword [0x1401d55f0], rax
lea rcx, [0x1401d5600]
call fcn.1400d235c
mov eax, dword [rbx + r13]
cmp dword [0x1401d5610], eax
jle 0x14004d75d
lea rcx, [0x1401d5610]
call fcn.1400d23c8
cmp dword [0x1401d5610], 0xffffffff
jne 0x14004d75d
call fcn.14004a190
mov qword [0x1401d55e0], rax
lea rcx, [0x1401d5610]
call fcn.1400d235c
cmp qword [0x1401d55f0], 0
je 0x14004e9bb
cmp qword [0x1401d55e0], 0
je 0x14004e9bb
movabs rbx, 0x2656043d44fa49f5
movabs r14, 0x3866a4e0e99d87e6
movabs r15, 0xee6e3fee44eb2d48
mov eax, 4
mov eax, dword [rax + r13]
cmp dword [0x1401d5548], eax
jle 0x14004d906
lea rcx, [0x1401d5548]
call fcn.1400d23c8
cmp dword [0x1401d5548], 0xffffffff
jne 0x14004d906
movabs rax, 0x543f714c27bb31b0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0x5b14d18f9af8d583
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0xd63c3cff922970e2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rax, 0xee6e5a9a2da7483e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
movabs rax, 0xbf4f4993f1513587
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
vmovdqu ymm0, ymmword [rbp + 0xe0]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm1
movabs rax, 0x4a38765637953d9b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x110], rax
movabs rax, 0x3866a4e08ce5e2c8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x118], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
vmovdqa xmm0, xmmword [rbp + 0x110]
vxorps xmm0, xmm0, xmmword [rbp + 0xe0]
vmovdqa xmmword [rbp + 0x110], xmm0
xor r8d, r8d
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x110]
vzeroupper
call fcn.140048aa0
mov qword [0x1401d55b0], rax
lea rcx, [0x1401d5548]
call fcn.1400d235c
mov eax, 4
mov eax, dword [rax + r13]
cmp dword [0x1401d554c], eax
jle 0x14004da75
lea rcx, [0x1401d554c]
call fcn.1400d23c8
cmp dword [0x1401d554c], 0xffffffff
jne 0x14004da75
movabs rax, 0x533d6b5208963da7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0x4c08c18d8cf1c296
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0xeb2c20e1943f50c0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rax, 0xee0249af21874f29
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
movabs rax, 0xbf4f4993f1513587
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
vmovdqu ymm0, ymmword [rbp + 0x20]
vpxor ymm1, ymm0, ymmword [rbp + 0xe0]
vmovdqa ymmword [rbp + 0x20], ymm1
movabs rax, 0x4a38765637953d9b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x110], rax
movabs rax, 0x3866a4e08ce5e2c8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x118], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
vmovdqa xmm0, xmmword [rbp + 0x110]
vxorps xmm0, xmm0, xmmword [rbp + 0xe0]
vmovdqa xmmword [rbp + 0x110], xmm0
xor r8d, r8d
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x110]
vzeroupper
call fcn.140048aa0
mov qword [0x1401d5598], rax
lea rcx, [0x1401d554c]
call fcn.1400d235c
mov eax, 4
mov eax, dword [rax + r13]
cmp dword [0x1401d5550], eax
jle 0x14004dbda
lea rcx, [0x1401d5550]
call fcn.1400d23c8
cmp dword [0x1401d5550], 0xffffffff
jne 0x14004dbda
movabs rax, 0x5537615121a831b0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0x5b14d18f9af8d583
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0xbf4f49f6853879e2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
movabs rax, 0xbf4f4993f1513587
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
vmovdqu ymm0, ymmword [rbp + 0x20]
vpxor ymm1, ymm0, ymmword [rbp + 0xe0]
vmovdqa ymmword [rbp + 0x20], ymm1
movabs rax, 0x4a38765637953d9b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x110], rax
movabs rax, 0x3866a4e08ce5e2c8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x118], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
vmovdqa xmm0, xmmword [rbp + 0x110]
vxorps xmm0, xmm0, xmmword [rbp + 0xe0]
vmovdqa xmmword [rbp + 0x110], xmm0
xor r8d, r8d
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x110]
vzeroupper
call fcn.140048aa0
mov qword [0x1401d55c0], rax
lea rcx, [0x1401d5550]
call fcn.1400d235c
mov eax, 4
mov eax, dword [rax + r13]
cmp dword [0x1401d55b8], eax
jle 0x14004dd49
lea rcx, [0x1401d55b8]
call fcn.1400d23c8
cmp dword [0x1401d55b8], 0xffffffff
jne 0x14004dd49
movabs rax, 0x5233685800963da7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0x4c08c18d8cf1c283
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0xeb2c20e1943f50c0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rax, 0xee0249af21874f29
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
movabs rax, 0xbf4f4993f1513587
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
vmovdqu ymm0, ymmword [rbp + 0xe0]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm1
movabs rax, 0x4a38765637953d9b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x110], rax
movabs rax, 0x3866a4e08ce5e2c8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x118], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
vmovdqa xmm0, xmmword [rbp + 0x110]
vxorps xmm0, xmm0, xmmword [rbp + 0xe0]
vmovdqa xmmword [rbp + 0x110], xmm0
xor r8d, r8d
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x110]
vzeroupper
call fcn.140048aa0
mov qword [0x1401d5558], rax
lea rcx, [0x1401d55b8]
call fcn.1400d235c
cmp qword [0x1401d55b0], 0
je 0x14004e9bb
cmp qword [0x1401d5598], 0
je 0x14004e9bb
cmp qword [0x1401d55c0], 0
je 0x14004e9bb
lea rdx, [rbp]
mov rcx, rdi
call fcn.14004eb00
mov rbx, qword [rax]
lea rdx, [rbp + 0x10]
mov rcx, rdi
call fcn.14004eb20
lea r9, [rbp + 8]
mov r8, rbx
mov rdx, qword [rax]
lea rcx, [rbp + 0x78]
call fcn.14004eb50
nop
mov dword [rbp + 0xb8], esi
lea rcx, [rbp + 0x78]
call fcn.14004eb40
mov rdx, rax
lea rcx, [rbp + 0xa8]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov r14, qword [0x1401d55f0]
mov r15, qword [0x1401d55b0]
mov edi, 4
mov eax, dword [rdi + r13]
cmp dword [0x1401d5574], eax
jle 0x14004dee2
lea rcx, [0x1401d5574]
call fcn.1400d23c8
cmp dword [0x1401d5574], 0xffffffff
jne 0x14004dee2
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rdi, rsi
nop dword [rax]
nop dword [rax + rax]
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x14004de97
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x14004de97
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r9 + r8*4]
mov ecx, dword [rax + r11]
add rcx, r9
mov edx, 0x603d7331
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x14004de92
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x14004de70
cmp edx, 0x37107bfb
je 0x14004e757
test r8d, r8d
jne 0x14004de50
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x14004dead
cmp qword [rax + 0x30], 0
jne 0x14004de20
xor r8d, r8d
lea rcx, [0x1400f90f0]
call r8
lea rdx, str.NtShutdownSystem
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401d5588], rax
lea rcx, [0x1401d5574]
call fcn.1400d235c
mov edi, 4
lea rcx, reloc.WS2_32.dll_bind
call fcn.140048a50
mov dword [rbp + 0x100], 0x25ff
mov word [rbp + 0x104], 0
mov qword [rbp + 0x106], r15
mov edx, 5
lea rcx, [0x1401d53f0]
call fcn.14004ea80
mov rcx, rax
mov r8d, reloc.WS2_32.dll_ntohl
lea rdx, [rbp + 0x130]
call fcn.14004adc0
mov edx, 5
lea rcx, [0x1401d53f0]
call fcn.14004ea80
mov rcx, rax
mov r8d, reloc.WS2_32.dll_ntohl
lea rdx, [rbp + 0x100]
call fcn.14004b0f0
mov rax, qword [0x1401d5588]
mov dl, 1
mov rcx, r14
call rax
movzx ebx, al
mov edx, 5
lea rcx, [0x1401d53f0]
call fcn.14004ea80
mov rcx, rax
mov r8d, reloc.WS2_32.dll_ntohl
lea rdx, [rbp + 0x130]
call fcn.14004b0f0
lea rcx, reloc.WS2_32.dll_bind
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
test bl, bl
je 0x14004e98f
mov r14, qword [0x1401d55e0]
mov r15, qword [0x1401d5598]
mov eax, dword [rdi + r13]
cmp dword [0x1401d55a8], eax
jle 0x14004e0b0
lea rcx, [0x1401d55a8]
call fcn.1400d23c8
cmp dword [0x1401d55a8], 0xffffffff
jne 0x14004e0b0
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rdi, rsi
nop
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x14004e067
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x14004e067
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r11 + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
mov edx, 0x603d7331
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x14004e062
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x14004e040
cmp edx, 0x37107bfb
je 0x14004e774
test r8d, r8d
jne 0x14004e020
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x14004e07d
cmp qword [rax + 0x30], 0
jne 0x14004dff0
xor eax, eax
lea rcx, [0x1400f90f0]
call rax
lea rdx, str.NtShutdownSystem
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401d5590], rax
lea rcx, [0x1401d55a8]
call fcn.1400d235c
mov edi, 4
lea rcx, reloc.WS2_32.dll_bind
call fcn.140048a50
mov dword [rbp + 0x120], 0x25ff
mov word [rbp + 0x124], 0
mov qword [rbp + 0x126], r15
mov edx, 5
lea rcx, [0x1401d53f0]
call fcn.14004ea80
mov rcx, rax
mov r8d, reloc.WS2_32.dll_ntohl
lea rdx, [rbp + 0x110]
call fcn.14004adc0
mov edx, 5
lea rcx, [0x1401d53f0]
call fcn.14004ea80
mov rcx, rax
mov r8d, reloc.WS2_32.dll_ntohl
lea rdx, [rbp + 0x120]
call fcn.14004b0f0
mov rax, qword [0x1401d5590]
lea rdx, [rbp + 0x98]
mov rcx, r14
call rax
mov r14, rax
mov edx, 5
lea rcx, [0x1401d53f0]
call fcn.14004ea80
mov rcx, rax
mov r8d, reloc.WS2_32.dll_ntohl
lea rdx, [rbp + 0x110]
call fcn.14004b0f0
lea rcx, reloc.WS2_32.dll_bind
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
test r14, r14
je 0x14004e7e4
mov r9d, Ordinal_60
mov r8, r14
lea rdx, [rbp + 0x40]
mov rcx, r12
call fcn.14004bef0
test al, al
jne 0x14004e1a2
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x40], xmm0
movups xmmword [rbp + 0x50], xmm0
movups xmmword [rbp + 0x60], xmm0
mov qword [rbp + 0x70], rax
mov r9d, reloc.WS2_32.dll_recv
mov r8, qword [rbp + 0x40]
lea rdx, [rbp + 0xe0]
mov rcx, r12
call fcn.14004bef0
test al, al
jne 0x14004e1c9
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
mov r9d, reloc.WS2_32.dll_recv
mov r8, qword [rbp + 0x48]
lea rdx, [rbp + 0x20]
mov rcx, r12
call fcn.14004bef0
test al, al
jne 0x14004e1eb
mov qword [rbp + 0x28], 0
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0x20], rax
mov rdx, qword [rbp + 0x48]
mov qword [rbp + 0xe8], rdx
mov r9d, reloc.WS2_32.dll_recv
lea r8, [rbp + 0x20]
mov rcx, r12
call fcn.14004c890
mov r9d, reloc.WS2_32.dll_recv
lea r8, [rbp + 0xe0]
mov rdx, qword [rbp + 0x40]
mov rcx, r12
call fcn.14004c890
mov r15, qword [0x1401d55e0]
mov r12, qword [0x1401d5558]
mov eax, dword [rdi + r13]
cmp dword [0x1401d5568], eax
jle 0x14004e340
lea rcx, [0x1401d5568]
call fcn.1400d23c8
cmp dword [0x1401d5568], 0xffffffff
jne 0x14004e340
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rdi, rsi
nop word [rax + rax]
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x14004e2f7
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x14004e2f7
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r9 + r8*4]
mov ecx, dword [rax + r11]
add rcx, r9
mov edx, 0x603d7331
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x14004e2f2
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x14004e2d0
cmp edx, 0x37107bfb
je 0x14004e790
test r8d, r8d
jne 0x14004e2b0
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x14004e30d
cmp qword [rax + 0x30], 0
jne 0x14004e280
xor edx, edx
lea rcx, [0x1400f90f0]
call rdx
lea rdx, str.NtShutdownSystem
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401d55a0], rax
lea rcx, [0x1401d5568]
call fcn.1400d235c
mov edi, 4
lea rcx, reloc.WS2_32.dll_bind
call fcn.140048a50
mov dword [rbp + 0x100], 0x25ff
mov word [rbp + 0x104], 0
mov qword [rbp + 0x106], r12
mov rcx, qword [0x1401d53f0]
mov r8d, reloc.WS2_32.dll_ntohl
lea rdx, [rbp + 0x130]
call fcn.14004adc0
mov rcx, qword [0x1401d53f0]
mov r8d, reloc.WS2_32.dll_ntohl
lea rdx, [rbp + 0x100]
call fcn.14004b0f0
mov rdx, r14
mov rcx, r15
call qword [0x1401d55a0]
mov edx, 5
lea rcx, [0x1401d53f0]
call fcn.14004ea80
mov rcx, rax
mov r8d, reloc.WS2_32.dll_ntohl
lea rdx, [rbp + 0x130]
call fcn.14004b0f0
lea rcx, reloc.WS2_32.dll_bind
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov r14, qword [0x1401d55e0]
mov r15, qword [0x1401d5598]
mov eax, dword [rdi + r13]
cmp dword [0x1401d55a8], eax
jle 0x14004e4f0
lea rcx, [0x1401d55a8]
call fcn.1400d23c8
cmp dword [0x1401d55a8], 0xffffffff
jne 0x14004e4f0
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rdi, rsi
nop word [rax + rax]
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x14004e4a7
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x14004e4a7
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r11 + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
mov edx, 0x603d7331
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x14004e4a2
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x14004e480
cmp edx, 0x37107bfb
je 0x14004e7ac
test r8d, r8d
jne 0x14004e460
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x14004e4bd
cmp qword [rax + 0x30], 0
jne 0x14004e430
xor edx, edx
lea rcx, [0x1400f90f0]
call rdx
lea rdx, str.NtShutdownSystem
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401d5590], rax
lea rcx, [0x1401d55a8]
call fcn.1400d235c
mov edi, 4
lea rcx, reloc.WS2_32.dll_bind
call fcn.140048a50
mov dword [rbp + 0x120], 0x25ff
mov word [rbp + 0x124], 0
mov qword [rbp + 0x126], r15
mov rcx, qword [0x1401d53f0]
mov r8d, reloc.WS2_32.dll_ntohl
lea rdx, [rbp + 0x110]
call fcn.14004adc0
mov edx, 5
lea rcx, [0x1401d53f0]
call fcn.14004ea80
mov rcx, rax
mov r8d, reloc.WS2_32.dll_ntohl
lea rdx, [rbp + 0x120]
call fcn.14004b0f0
mov rax, qword [0x1401d5590]
lea rdx, [rbp + 0x98]
mov rcx, r14
call rax
mov r14, rax
mov edx, 5
lea rcx, [0x1401d53f0]
call fcn.14004ea80
mov rcx, rax
mov r8d, reloc.WS2_32.dll_ntohl
lea rdx, [rbp + 0x110]
call fcn.14004b0f0
lea rcx, reloc.WS2_32.dll_bind
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov r15, qword [0x1401d55f0]
mov r12, qword [0x1401d55c0]
mov ecx, dword [rdi + r13]
cmp dword [0x1401d5570], ecx
jle 0x14004e6ab
lea rcx, [0x1401d5570]
call fcn.1400d23c8
cmp dword [0x1401d5570], 0xffffffff
jne 0x14004e6ab
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rdi, rsi
nop dword [rax]
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x14004e667
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x14004e667
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r11 + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
mov edx, 0x603d7331
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x14004e662
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x14004e640
cmp edx, 0x37107bfb
je 0x14004e7c8
test r8d, r8d
jne 0x14004e620
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x14004e67d
cmp qword [rax + 0x30], 0
jne 0x14004e5f0
xor eax, eax
lea rcx, [0x1400f90f0]
call rax
lea rdx, str.NtShutdownSystem
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401d5578], rax
lea rcx, [0x1401d5570]
call fcn.1400d235c
lea rcx, reloc.WS2_32.dll_bind
call fcn.140048a50
mov dword [rbp + 0x100], 0x25ff
mov word [rbp + 0x104], 0
mov qword [rbp + 0x106], r12
mov rcx, qword [0x1401d53f0]
mov r8d, reloc.WS2_32.dll_ntohl
lea rdx, [rbp + 0x130]
call fcn.14004adc0
mov edx, 5
lea rcx, [0x1401d53f0]
call fcn.14004ea80
mov rcx, rax
mov r8d, reloc.WS2_32.dll_ntohl
lea rdx, [rbp + 0x100]
call fcn.14004b0f0
mov rcx, r15
call qword [0x1401d5578]
mov edx, 5
lea rcx, [0x1401d53f0]
call fcn.14004ea80
mov rcx, rax
mov r8d, reloc.WS2_32.dll_ntohl
lea rdx, [rbp + 0x130]
call fcn.14004b0f0
lea rcx, reloc.WS2_32.dll_bind
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
test r14, r14
sete bl
jmp 0x14004e991
mov edx, dword [rbx + 0x1c]
add rdx, r9
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx eax, word [rcx + r8*2]
mov r8d, dword [rdx + rax*4]
add r8, r9
jmp 0x14004deb0
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x14004e07f
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rbx + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov edx, dword [rcx + rax*4]
add rdx, r9
jmp 0x14004e30f
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rbx + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov edx, dword [rcx + rax*4]
add rdx, r9
jmp 0x14004e4bf
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rbx + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov eax, dword [rcx + rax*4]
add rax, r9
jmp 0x14004e67f
mov r14, qword [0x1401d55f0]
mov r15, qword [0x1401d55c0]
mov eax, dword [rdi + r13]
cmp dword [0x1401d5570], eax
jle 0x14004e8fb
lea rcx, [0x1401d5570]
call fcn.1400d23c8
cmp dword [0x1401d5570], 0xffffffff
jne 0x14004e8fb
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rdi, rsi
nop dword [rax]
nop word [rax + rax]
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x14004e8b7
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x14004e8b7
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r11 + r8*4]
mov eax, dword [rax + r9]
add rax, r9
mov edx, 0x603d7331
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x14004e8b2
nop dword [rax]
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax]
lea rax, [rax + 1]
test cl, cl
jne 0x14004e890
cmp edx, 0x37107bfb
je 0x14004e99f
test r8d, r8d
jne 0x14004e870
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x14004e8cd
cmp qword [rax + 0x30], 0
jne 0x14004e840
xor eax, eax
lea rcx, [0x1400f90f0]
call rax
lea rdx, str.NtShutdownSystem
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401d5578], rax
lea rcx, [0x1401d5570]
call fcn.1400d235c
lea rcx, reloc.WS2_32.dll_bind
call fcn.140048a50
mov dword [rbp + 0x100], 0x25ff
mov word [rbp + 0x104], 0
mov qword [rbp + 0x106], r15
mov rcx, qword [0x1401d53f0]
mov r8d, reloc.WS2_32.dll_ntohl
lea rdx, [rbp + 0x130]
call fcn.14004adc0
mov rcx, qword [0x1401d53f0]
mov r8d, reloc.WS2_32.dll_ntohl
lea rdx, [rbp + 0x100]
call fcn.14004b0f0
mov rcx, r14
call qword [0x1401d5578]
mov edx, 5
lea rcx, [0x1401d53f0]
call fcn.14004ea80
mov rcx, rax
mov r8d, reloc.WS2_32.dll_ntohl
lea rdx, [rbp + 0x130]
call fcn.14004b0f0
lea rcx, reloc.WS2_32.dll_bind
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
xor bl, bl
lea rcx, [rbp + 0x78]
call fcn.14004ea90
movzx eax, bl
jmp 0x14004e9bd
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rbx + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov eax, dword [rcx + rax*4]
add rax, r9
jmp 0x14004e8cf
xor al, al
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.1400d2300
mov rbx, qword [rsp + 0x1e8]
add rsp, 0x190
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret