Function at 0x140029bd0
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rax, qword [0x1400fff00]
xor rax, rsp
mov qword [rbp + 0x90], rax
movzx ebx, dl
mov r14, rcx
xor r13d, r13d
call fcn.14002ac40
mov dword [rbp - 0x20], 0xa0baa3ed
mov dword [rbp - 0x1c], 0xb6b8a2aa
mov word [rbp - 0x18], 0xee
mov byte [rbp - 0x16], 1
mov dword [rsp + 0x40], 0xa3aca2ed
mov dword [rsp + 0x44], 0x100edaa
mov dword [rsp + 0x48], 0xbda8bfed
mov dword [rsp + 0x4c], 0xbcbeb9bc
mov dword [rsp + 0x50], 0xe8b0ba
mov byte [rsp + 0x54], 1
mov dword [rsp + 0x30], 0xabbdb5bf
mov dword [rsp + 0x34], 0xb7b9b3f2
mov dword [rsp + 0x38], 0x100bfb0
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x30]
call fcn.14001e2c0
nop
lea rdx, [r14 + 0x240]
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x140029c9c
mov rdx, qword [rdx]
mov rcx, rax
call fcn.14000e300
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x58]
call fcn.14001db00
nop
mov rdx, r14
cmp qword [r14 + 0x18], 0xf
jbe 0x140029ce5
mov rdx, qword [r14]
mov r8, qword [r14 + 0x10]
mov rcx, rax
call fcn.14000e300
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x58], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rbp - 0x20]
lea rdx, [rbp - 0x68]
lea rcx, [rbp - 0x10]
call fcn.14001df80
nop
lea rdx, [r14 + 0x20]
cmp qword [r14 + 0x38], 0xf
jbe 0x140029d30
mov rdx, qword [r14 + 0x20]
mov r8, qword [r14 + 0x30]
mov rcx, rax
call fcn.14000e300
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x80], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rbp + 8]
cmp rdx, 0xf
jbe 0x140029d9b
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029d96
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140029d96
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6ba4
movdqa xmm0, xmmword [0x1400ec3c0]
movdqu xmmword [rbp], xmm0
mov byte [rbp - 0x10], 0
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
jbe 0x140029df2
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029de5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140029de5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6ba4
movdqa xmm0, xmmword [0x1400ec3c0]
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x140029e3a
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029e2d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140029e2d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6ba4
movdqa xmm0, xmmword [0x1400ec3c0]
movdqu xmmword [rsp + 0x68], xmm0
mov byte [rsp + 0x58], 0
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x140029e8c
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029e7f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140029e7f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6ba4
movdqa xmm0, xmmword [0x1400ec3c0]
mov rdx, qword [rbp + 0x48]
cmp rdx, 0xf
jbe 0x140029ed2
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029ec5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140029ec5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6ba4
movdqa xmm0, xmmword [0x1400ec3c0]
movdqu xmmword [rbp + 0x40], xmm0
mov byte [rbp + 0x30], 0
lea rdx, [r14 + 0x60]
lea rcx, [rbp + 0x10]
call fcn.14000c8d0
nop
test bl, bl
je 0x140029f55
mov rcx, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x28]
mov rax, rdx
sub rax, rcx
cmp rax, 0xd
jb 0x140029f34
lea rax, [rcx + 0xd]
mov qword [rbp + 0x20], rax
lea rbx, [rbp + 0x10]
cmp rdx, 0xf
cmova rbx, qword [rbp + 0x10]
add rbx, rcx
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str._check_paid1
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0xd], 0
jmp 0x140029f55
mov qword [rsp + 0x20], reloc.WS2_32.dll_listen
lea r9, str._check_paid1
xor r8d, r8d
mov edx, reloc.WS2_32.dll_listen
lea rcx, [rbp + 0x10]
call fcn.140010900
lea rax, [rsp + 0x78]
mov qword [rsp + 0x40], rax
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x78]
call fcn.14000c8d0
mov rbx, rax
lea rdx, [rbp + 0x70]
lea rcx, [rsp + 0x58]
call fcn.14000c8d0
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x50]
call fcn.14003a8e0
nop
lea rax, [rbp - 0x10]
mov qword [rsp + 0x30], rax
lea rdx, [rbp + 0x50]
cmp qword [rbp + 0x68], 0xf
cmova rdx, qword [rbp + 0x50]
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp], r13
mov qword [rbp + 8], r13
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140029fc0
lea rcx, [rbp - 0x10]
call fcn.14000fed0
nop
lea rax, [rbp + 0x30]
mov qword [rsp + 0x40], rax
lea rdx, [0x1400ff040]
lea rcx, [rbp + 0x30]
call fcn.14000c8d0
mov rbx, rax
lea rdx, [0x1400ff020]
lea rcx, [rbp - 0x68]
call fcn.14000c8d0
nop
lea r8, [rbp - 0x10]
mov rdx, rbx
mov rcx, rax
call fcn.1400288e0
xor eax, 0xa5a5
mov edx, eax
shr eax, 8
movzx r8d, al
movzx eax, dl
movabs r12, 0xcbf29ce484222325
xor rax, r12
movabs r15, 0x100000001b3
imul rax, r15
xor r8, rax
imul r8, r15
mov eax, edx
shr eax, 0x10
movzx ecx, al
xor r8, rcx
imul r8, r15
shr rdx, 0x18
xor r8, rdx
imul r8, r15
cmp r8w, 0xdf7f
jne 0x14002a487
mov qword [rbp - 0x30], r13
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp - 0x68]
lea rdx, [rbp + 0x50]
lea rcx, [rbp - 0x10]
call fcn.140023fb0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov byte [rsp + 0x48], 0
xor eax, eax
mov qword [rsp + 0x50], rax
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.14002e0d0
mov sil, 3
mov byte [rsp + 0x48], sil
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov ecx, 0x20
call fcn.1400c6920
mov rbx, rax
lea rax, [rbp - 0x28]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rbx
lea rdx, [r14 + 0x20]
mov rcx, rbx
call fcn.14000c8d0
nop
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x34], 0x646972
mov dword [rsp + 0x30], 0x656e776f
mov byte [rsp + 0x38], 0
lea r9, [rbp - 0x28]
lea r8, [rsp + 0x37]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x78]
call fcn.140014390
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x10]
call fcn.140027ce0
cmp byte [rax], 9
jne 0x14002a125
xor bl, bl
jmp 0x14002a13d
lea rdx, [rsp + 0x48]
mov rcx, rax
call fcn.140027890
movzx ebx, al
xor bl, 1
movzx esi, byte [rsp + 0x48]
movzx edx, sil
lea rcx, [rsp + 0x50]
call fcn.14002e0d0
nop
test bl, bl
je 0x14002a209
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14002a1e6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14002a1e6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0xe595b0b9
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14002a1e1
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14002a1c0
cmp r8d, 0xc9018d99
je 0x14002a1eb
test r9d, r9d
jne 0x14002a1a0
mov rax, qword [rax]
jmp 0x14002a170
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov ecx, 8
call rdx
mov dword [rsp + 0x34], 0x656761
mov dword [rsp + 0x30], 0x7373656d
mov byte [rsp + 0x38], 0
lea r9, [rbp - 0x28]
lea r8, [rsp + 0x37]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x78]
call fcn.140014390
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x10]
call fcn.140027ce0
lea rdx, [rbp + 0x30]
mov rcx, rax
call fcn.14001d850
nop
mov word [rsp + 0x43], 0x65
mov word [rsp + 0x40], 0x6f63
mov byte [rsp + 0x42], 0x64
mov byte [rsp + 0x45], 0
lea r9, [rbp - 0x28]
lea r8, [rsp + 0x44]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x58]
call fcn.140014390
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x10]
call fcn.140027ce0
mov rcx, rax
call fcn.14001d730
mov edx, eax
shr eax, 8
movzx ebx, al
movzx eax, dl
xor rax, r12
imul rax, r15
xor rbx, rax
imul rbx, r15
mov eax, edx
shr eax, 0x10
movzx ecx, al
xor rbx, rcx
imul rbx, r15
shr rdx, 0x18
xor rbx, rdx
imul rbx, r15
mov dword [rbp - 0x1c], 0x737365
mov dword [rbp - 0x20], 0x63637573
mov byte [rbp - 0x18], 0
lea r9, [rbp - 0x28]
lea r8, [rbp - 0x19]
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x58]
call fcn.140014390
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x10]
call fcn.140027ce0
mov rcx, rax
call fcn.14001d9a0
test al, al
je 0x14002a40b
mov dword [rbp - 0x20], 0xadaeb9b8
mov dword [rbp - 0x1c], 0xa2a3aa
mov byte [rbp - 0x18], 1
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x20]
call fcn.140028110
mov rdx, rax
lea rcx, [rbp - 0x10]
call fcn.140027ce0
mov rcx, rax
call fcn.14001d9a0
test al, al
je 0x14002a35b
movabs rax, 0xcbe5c873d26645f1
cmp rbx, rax
je 0x14002a40b
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14002a3e6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14002a3e6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x66086ebe
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14002a3e1
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14002a3c0
cmp r8d, 0x167f1e46
je 0x14002a3eb
test r9d, r9d
jne 0x14002a3a0
mov rax, qword [rax]
jmp 0x14002a370
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov ecx, 9
call rdx
jmp 0x14002a425
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x48]
call fcn.1400264e0
mov rdx, rax
mov rcx, r14
call fcn.140035f00
nop
mov rdx, qword [rbp + 0x48]
cmp rdx, 0xf
jbe 0x14002a463
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002a45e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002a45e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6ba4
movdqa xmm0, xmmword [0x1400ec3c0]
movdqu xmmword [rbp + 0x40], xmm0
mov byte [rbp + 0x30], 0
movzx edx, byte [rbp - 0x10]
lea rcx, [rbp - 8]
call fcn.14002e0d0
nop
jmp 0x14002a53a
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14002a516
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14002a516
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x8c404603
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14002a511
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14002a4f0
cmp r8d, 0x3c0d3a33
je 0x14002a51b
test r9d, r9d
jne 0x14002a4d0
mov rax, qword [rax]
jmp 0x14002a4a0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov ecx, 7
call rdx
nop
mov rdx, qword [rbp + 0x68]
cmp rdx, 0xf
jbe 0x14002a578
inc rdx
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002a573
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002a573
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6ba4
movdqa xmm0, xmmword [0x1400ec3c0]
movdqu xmmword [rbp + 0x60], xmm0
mov byte [rbp + 0x50], 0
mov rdx, qword [rbp + 0x28]
cmp rdx, 0xf
jbe 0x14002a5c7
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002a5c2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002a5c2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6ba4
mov qword [rbp + 0x20], r13
mov qword [rbp + 0x28], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x10], 0
mov rdx, qword [rbp + 0x88]
cmp rdx, 0xf
jbe 0x14002a618
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002a613
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002a613
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6ba4
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.1400c6900
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret