Function at 0x1400f1540
Capabilities:
Access peb ldr_data
Create thread
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2e0]
sub rsp, 0x3e0
movaps xmmword [rsp + 0x3d0], xmm6
mov rax, qword [0x1401e6f00]
xor rax, rsp
mov qword [rbp + 0x2c0], rax
mov r13, rdx
mov r12, rcx
mov qword [rbp + 0xa0], rdx
xor r15d, r15d
mov dword [rsp + 0x68], r15d
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8, [fcn.1400ea5e0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8, [0x1400ea860]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8, [0x1400eaca0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.1400eabd0
lea rcx, [rbp + 0x128]
call fcn.1400fa1a0
nop
mov dword [rbp - 0x78], 0xc2dcc58f
mov dword [rbp - 0x74], 0xd4c6dcc8
mov word [rbp - 0x70], 0x8c
mov byte [rbp - 0x6e], 1
mov dword [rbp + 0x90], 0xc1cac48f
mov dword [rbp + 0x94], 0x10093c8
mov dword [rsp + 0x70], 0xdfced98f
mov dword [rsp + 0x74], 0xdec0c7de
mov dword [rsp + 0x78], 0x8ed6d8
mov byte [rsp + 0x7c], 1
mov dword [rbp - 0x58], 0xc5dcc28f
mov dword [rbp - 0x54], 0x10093c9
mov dword [rsp + 0x68], 0xd5cec18f
mov word [rsp + 0x6c], 0x90
mov byte [rsp + 0x6e], 1
mov dword [rbp + 0xa8], 0xc9dbd3dd
mov dword [rbp + 0xac], 0xd3c6c290
mov dword [rbp + 0xb0], 0xd1c0dcd4
mov word [rbp + 0xb4], 0x100
lea r8, [rsp + 0x68]
lea rdx, [rbp + 0xa8]
lea rcx, [rbp + 0xc8]
call fcn.1400e8ce0
nop
mov rdx, r13
cmp qword [r13 + 0x18], 0xf
jbe 0x1400f16b2
mov rdx, qword [r13]
mov r8, qword [r13 + 0x10]
mov rcx, rax
call fcn.1400056e0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x108], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x118], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rbp - 0x58]
lea rdx, [rbp + 0x108]
lea rcx, [rbp - 0x10]
call fcn.1400e87b0
nop
lea rdx, [rbp + 0x128]
cmp qword [rbp + 0x140], 0xf
cmova rdx, qword [rbp + 0x128]
mov r8, qword [rbp + 0x138]
mov rcx, rax
call fcn.1400056e0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x20], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rsp + 0x70]
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x70]
call fcn.1400e8bd0
nop
lea rdx, [r12 + 0x240]
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x1400f1764
mov rdx, qword [rdx]
mov rcx, rax
call fcn.1400056e0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x60], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rbp + 0x90]
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x30]
call fcn.1400e87b0
nop
mov rdx, r12
cmp qword [r12 + 0x18], 0xf
jbe 0x1400f17ae
mov rdx, qword [r12]
mov r8, qword [r12 + 0x10]
mov rcx, rax
call fcn.1400056e0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x20], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rbp - 0x78]
lea rdx, [rbp + 0x10]
lea rcx, [rbp - 0x50]
call fcn.1400e89f0
nop
lea rdx, [r12 + 0x20]
cmp qword [r12 + 0x38], 0xf
jbe 0x1400f17fd
mov rdx, qword [r12 + 0x20]
mov r8, qword [r12 + 0x30]
mov rcx, rax
call fcn.1400056e0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x188], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x198], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x1400f186c
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400f1867
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400f1867
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140179794
movdqa xmm6, xmmword [0x1401c8e40]
movdqu xmmword [rbp - 0x40], xmm6
mov byte [rbp - 0x50], 0
mov rdx, qword [rbp + 0x28]
cmp rdx, 0xf
jbe 0x1400f18bc
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400f18b6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400f18b6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140179794
nop
mov rdx, qword [rbp + 0x48]
cmp rdx, 0xf
jbe 0x1400f18fa
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400f18f5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400f18f5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140179794
movdqu xmmword [rbp + 0x40], xmm6
mov byte [rbp + 0x30], 0
mov rdx, qword [rbp + 0x68]
cmp rdx, 0xf
jbe 0x1400f1942
inc rdx
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400f193c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400f193c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140179794
nop
mov rdx, qword [rbp + 0x88]
cmp rdx, 0xf
jbe 0x1400f1983
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400f197e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400f197e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140179794
movdqu xmmword [rbp + 0x80], xmm6
mov byte [rbp + 0x70], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x1400f19ce
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400f19c8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400f19c8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140179794
nop
mov rdx, qword [rbp + 8]
cmp rdx, 0xf
jbe 0x1400f1a0c
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400f1a07
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400f1a07
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140179794
movdqu xmmword [rbp], xmm6
mov byte [rbp - 0x10], 0
mov rdx, qword [rbp + 0x120]
cmp rdx, 0xf
jbe 0x1400f1a5a
inc rdx
mov rcx, qword [rbp + 0x108]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400f1a54
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400f1a54
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140179794
nop
mov rdx, qword [rbp + 0xe0]
cmp rdx, 0xf
jbe 0x1400f1a9e
inc rdx
mov rcx, qword [rbp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400f1a99
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400f1a99
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140179794
movdqu xmmword [rbp + 0xd8], xmm6
mov byte [rbp + 0xc8], 0
lea rax, [rbp + 0x108]
mov qword [rbp - 0x68], rax
lea rdx, [r12 + 0x60]
lea rcx, [rbp + 0x108]
call fcn.140005100
mov rbx, rax
lea rdx, [rbp + 0x188]
lea rcx, [rbp - 0x30]
call fcn.140005100
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x148]
call fcn.1400f41d0
nop
lea rax, [rbp + 0xa8]
mov qword [rsp + 0x58], rax
lea rdx, [rbp + 0x148]
cmp qword [rbp + 0x160], 0xf
cmova rdx, qword [rbp + 0x148]
xorps xmm0, xmm0
movups xmmword [rbp + 0xa8], xmm0
mov qword [rbp + 0xb8], r15
mov qword [rbp + 0xc0], r15
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x1400f1b32
lea rcx, [rbp + 0xa8]
call fcn.140006600
nop
lea rax, [rbp + 0xc8]
mov qword [rbp - 0x68], rax
lea rdx, [0x1401e6040]
lea rcx, [rbp + 0xc8]
call fcn.140005100
mov rbx, rax
lea rdx, [0x1401e6020]
lea rcx, [rbp - 0x10]
call fcn.140005100
nop
lea r8, [rbp + 0xa8]
mov rdx, rbx
mov rcx, rax
call fcn.1400e9d70
xor eax, 0xa5a5
mov edx, eax
shr eax, 8
movzx r8d, al
movzx eax, dl
movabs r14, 0xcbf29ce484222325
xor rax, r14
movabs rsi, 0x100000001b3
imul rax, rsi
xor r8, rax
imul r8, rsi
mov eax, edx
shr eax, 0x10
movzx ecx, al
xor r8, rcx
imul r8, rsi
shr rdx, 0x18
xor r8, rdx
imul r8, rsi
cmp r8w, 0xdf7f
jne 0x1400f28d3
mov qword [rbp + 0x100], r15
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0xc8]
lea rdx, [rbp + 0x148]
lea rcx, [rbp + 0xa8]
call fcn.140023cec
nop
lea rdx, [r12 + 0x20]
lea rcx, [rsp + 0x70]
call fcn.14002bbcc
nop
mov dword [rsp + 0x5c], 0x646972
mov dword [rsp + 0x58], 0x656e776f
mov byte [rsp + 0x60], 0
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x5f]
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x50]
call fcn.140007118
nop
movzx ecx, byte [rbp + 0xa8]
test cl, cl
jne 0x1400f1c75
mov byte [rbp + 0xa8], 1
call fcn.140024954
mov qword [rbp + 0xb0], rax
movzx ecx, byte [rbp + 0xa8]
jmp 0x1400f1c7c
mov rax, qword [rbp + 0xb0]
cmp cl, 1
jne 0x1400f1c8f
lea rdx, [rbp - 0x50]
mov rcx, rax
call fcn.14002b278
jmp 0x1400f1c94
mov rax, qword [rsp + 0x58]
lea rdx, [rsp + 0x70]
mov rcx, rax
call fcn.1400e9400
movzx ebx, al
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x1400f1ce2
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400f1cdd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400f1cdd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140179794
movdqu xmmword [rbp - 0x40], xmm6
mov byte [rbp - 0x50], 0
movzx edx, byte [rsp + 0x70]
lea rcx, [rsp + 0x78]
call fcn.140022b7c
test bl, bl
jne 0x1400f1db9
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400f1d96
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400f1d96
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x5d980519
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400f1d91
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400f1d70
cmp r8d, 0x59c85df9
je 0x1400f1d9b
test r9d, r9d
jne 0x1400f1d50
mov rax, qword [rax]
jmp 0x1400f1d20
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov ecx, 8
call rdx
mov dword [rbp - 0x64], 0x656761
mov dword [rbp - 0x68], 0x7373656d
mov byte [rbp - 0x60], 0
lea r9, [rsp + 0x50]
lea r8, [rbp - 0x61]
lea rdx, [rbp - 0x68]
lea rcx, [rbp - 0x50]
call fcn.140007118
nop
movzx ecx, byte [rbp + 0xa8]
test cl, cl
jne 0x1400f1e09
mov byte [rbp + 0xa8], 1
call fcn.140024954
mov qword [rbp + 0xb0], rax
movzx ecx, byte [rbp + 0xa8]
jmp 0x1400f1e10
mov rax, qword [rbp + 0xb0]
cmp cl, 1
jne 0x1400f1e23
lea rdx, [rbp - 0x50]
mov rcx, rax
call fcn.14002b278
jmp 0x1400f1e28
mov rax, qword [rsp + 0x58]
xorps xmm0, xmm0
movups xmmword [rbp + 0x168], xmm0
movdqu xmmword [rbp + 0x178], xmm6
mov byte [rbp + 0x168], 0
mov dword [rsp + 0x68], 0x17fc
cmp byte [rax], 3
jne 0x1400f1e60
mov rdx, qword [rax + 8]
lea rax, [rbp + 0x168]
cmp rax, rdx
je 0x1400f1e7e
jmp 0x1400f1e63
mov rdx, r15
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x1400f1e71
mov rdx, qword [rdx]
lea rcx, [rbp + 0x168]
call fcn.140008164
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x1400f1ebc
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400f1eb7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400f1eb7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140179794
movdqu xmmword [rbp - 0x40], xmm6
mov byte [rbp - 0x50], 0
mov word [rsp + 0x6b], 0x65
mov word [rsp + 0x68], 0x6f63
mov byte [rsp + 0x6a], 0x64
mov byte [rsp + 0x6d], 0
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x6c]
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0xc8]
call fcn.140007118
nop
movzx ecx, byte [rbp + 0xa8]
test cl, cl
jne 0x1400f1f20
mov byte [rbp + 0xa8], 1
call fcn.140024954
mov qword [rbp + 0xb0], rax
movzx ecx, byte [rbp + 0xa8]
jmp 0x1400f1f27
mov rax, qword [rbp + 0xb0]
cmp cl, 1
jne 0x1400f1f3d
lea rdx, [rbp + 0xc8]
mov rcx, rax
call fcn.14002b278
jmp 0x1400f1f42
mov rax, qword [rsp + 0x58]
mov rcx, rax
call fcn.140027a74
mov edx, eax
shr eax, 8
movzx edi, al
movzx eax, dl
xor rax, r14
imul rax, rsi
xor rdi, rax
imul rdi, rsi
mov eax, edx
shr eax, 0x10
movzx ecx, al
xor rdi, rcx
imul rdi, rsi
shr rdx, 0x18
xor rdi, rdx
imul rdi, rsi
mov r8, qword [rbp + 0xe0]
cmp r8, 0xf
jbe 0x1400f1f9d
mov rdx, qword [rbp + 0xc8]
lea rcx, [rbp + 0xc8]
call fcn.140005914
mov dword [rsp + 0x5c], 0x737365
mov dword [rsp + 0x58], 0x63637573
mov byte [rsp + 0x60], 0
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x5f]
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x108]
call fcn.140007118
nop
mov ebx, 0x1effd
mov dword [rsp + 0x68], ebx
movzx ecx, byte [rbp + 0xa8]
test cl, cl
jne 0x1400f1ffe
mov byte [rbp + 0xa8], 1
call fcn.140024954
mov qword [rbp + 0xb0], rax
movzx ecx, byte [rbp + 0xa8]
jmp 0x1400f2005
mov rax, qword [rbp + 0xb0]
cmp cl, 1
jne 0x1400f201e
lea rdx, [rbp + 0x108]
mov rcx, rax
call fcn.14002b278
mov rcx, rax
jmp 0x1400f2023
mov rcx, qword [rsp + 0x58]
lea rax, [rcx + 8]
cmp byte [rcx], 4
cmovne rax, r15
cmp byte [rax], 0
je 0x1400f20eb
mov dword [rbp + 0x94], 0x737365
mov dword [rbp + 0x90], 0x63637573
mov byte [rbp + 0x98], 0
lea r9, [rsp + 0x50]
lea r8, [rbp + 0x97]
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0xc8]
call fcn.140007118
nop
mov ebx, 0x19efff
mov dword [rsp + 0x68], ebx
movzx ecx, byte [rbp + 0xa8]
test cl, cl
jne 0x1400f20a2
mov byte [rbp + 0xa8], 1
call fcn.140024954
mov qword [rbp + 0xb0], rax
movzx ecx, byte [rbp + 0xa8]
jmp 0x1400f20a9
mov rax, qword [rbp + 0xb0]
cmp cl, 1
jne 0x1400f20c2
lea rdx, [rbp + 0xc8]
mov rcx, rax
call fcn.14002b278
mov rcx, rax
jmp 0x1400f20c7
mov rcx, qword [rsp + 0x58]
lea rax, [rcx + 8]
cmp byte [rcx], 4
cmovne rax, r15
cmp byte [rax], 0
je 0x1400f20e6
movabs rax, 0xcbe5c873d26645f1
cmp rdi, rax
je 0x1400f20eb
xor dil, dil
jmp 0x1400f20ee
mov dil, 1
test bl, 2
je 0x1400f2103
and ebx, 0xfffffffd
lea rcx, [rbp + 0xc8]
call fcn.140004f48
nop
test bl, 1
je 0x1400f2114
lea rcx, [rbp + 0x108]
call fcn.140004f48
test dil, dil
je 0x1400f27e9
lea rdx, [rbp + 0xa8]
lea rcx, [rsp + 0x70]
call fcn.1400236fc
mov rdx, rax
mov rcx, r12
call fcn.1400f2f20
mov dword [rsp + 0x5c], 0x737365
mov dword [rsp + 0x58], 0x63637573
mov byte [rsp + 0x60], 0
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x5f]
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0xc8]
call fcn.140007118
nop
movzx ecx, byte [rbp + 0xa8]
test cl, cl
jne 0x1400f2191
mov byte [rbp + 0xa8], 1
call fcn.140024954
mov qword [rbp + 0xb0], rax
movzx ecx, byte [rbp + 0xa8]
jmp 0x1400f2198
mov rax, qword [rbp + 0xb0]
cmp cl, 1
jne 0x1400f21b1
lea rdx, [rbp + 0xc8]
mov rcx, rax
call fcn.14002b278
mov rcx, rax
jmp 0x1400f21b6
mov rcx, qword [rsp + 0x58]
lea rax, [rcx + 8]
cmp byte [rcx], 4
cmovne rax, r15
movzx ebx, byte [rax]
lea rcx, [rbp + 0xc8]
call fcn.140004f48
test bl, bl
je 0x1400f227a
mov word [rsp + 0x6b], reloc.WS2_32.dll_WSAGetLastError
mov word [rsp + 0x68], 0x6e69
mov byte [rsp + 0x6a], 0x66
mov byte [rsp + 0x6d], 0
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x6c]
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0xc8]
call fcn.140007118
nop
movzx ecx, byte [rbp + 0xa8]
test cl, cl
jne 0x1400f2233
mov byte [rbp + 0xa8], 1
call fcn.140024954
mov qword [rbp + 0xb0], rax
movzx ecx, byte [rbp + 0xa8]
jmp 0x1400f223a
mov rax, qword [rbp + 0xb0]
cmp cl, 1
jne 0x1400f2250
lea rdx, [rbp + 0xc8]
mov rcx, rax
call fcn.14002b278
jmp 0x1400f2255
mov rax, qword [rsp + 0x58]
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.1400236fc
mov rdx, rax
mov rcx, r12
call fcn.1400f32f0
nop
lea rcx, [rbp + 0xc8]
call fcn.140004f48
mov dword [rsp + 0x70], 0xd8c2c4e0
mov dword [rsp + 0x74], 0xd9c3cfc4
mov dword [rsp + 0x78], 0xd7d7cb
mov byte [rsp + 0x7c], 1
lea rcx, [rsp + 0x70]
call fcn.1400ea5a0
mov rdx, rax
lea rcx, [r12 + 0x218]
call fcn.1400e8660
test al, al
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
je 0x1400f2750
lea r15, [section..data]
mov rsi, r15
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
cmova rsi, qword [section..data]
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400f2366
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400f2366
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0xb619e942
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400f2361
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400f2340
cmp r8d, 0xb52155e4
je 0x1400f236b
test r9d, r9d
jne 0x1400f2320
mov rax, qword [rax]
jmp 0x1400f22f0
mov edx, dword [rdi + 0x1c]
add rdx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rdx + rax*4]
add rdx, r10
mov rcx, rsi
call rdx
movdqa xmm0, xmmword [0x14019e710]
movdqu xmmword [rsp + 0x70], xmm0
mov byte [rbp - 0x80], 1
lea rcx, [rsp + 0x70]
call fcn.1400ea550
mov rdx, rax
mov r8, r15
lea rcx, [rbp + 0x108]
call fcn.1400239e8
nop
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x1b0]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 2
lea rdx, [rbp + 0x108]
lea rcx, [rbp + 0x1b0]
call fcn.1400041a4
nop
cmp qword [rbp + 0x238], 0
je 0x1400f242e
mov rdx, r15
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
cmova rdx, qword [section..data]
mov r8, qword [0x1401e6010]
lea rcx, [rbp + 0x1b0]
call fcn.1400071d0
lea rcx, [rbp + 0x1b0]
call fcn.140004170
mov dword [rbp - 0x78], 0xd8cdc5fa
mov dword [rbp - 0x74], 0xd5ddcfda
mov word [rbp - 0x70], 0xed
mov byte [rbp - 0x6e], 1
lea rcx, [rbp - 0x78]
call fcn.1400ea510
mov rdx, rax
mov r8, r15
lea rcx, [rbp + 0xc8]
call fcn.1400239e8
nop
lea rdx, [rbp + 0xc8]
cmp qword [rbp + 0xe0], 0xf
cmova rdx, qword [rbp + 0xc8]
xor ecx, ecx
mov qword [rsp + 0x40], rcx
lea rax, [rbp + 0x90]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], ecx
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1400f265b
mov r14, qword [0x1401e6010]
inc r14
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
jbe 0x1400f24d3
mov r15, qword [section..data]
mov rsi, r15
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov edi, dword [rcx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x1400f2566
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400f2566
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r11 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r11
mov r8d, 0x35ffffbf
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400f2561
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400f2540
cmp r8d, 0xd77d2bde
je 0x1400f256b
test r9d, r9d
jne 0x1400f2520
mov rax, qword [rax]
jmp 0x1400f24f0
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r15
mov r9d, 1
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rbp + 0x90]
call r10
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400f2636
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400f2636
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x1d8d7dd9
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400f2631
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400f2610
cmp r8d, 0x931d35b6
je 0x1400f263b
test r9d, r9d
jne 0x1400f25f0
mov rax, qword [rax]
jmp 0x1400f25c0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov rcx, qword [rbp + 0x90]
call rdx
lea rsi, [r12 + 0x20]
cmp qword [rsi + 0x18], 0xf
jbe 0x1400f266a
mov rsi, qword [rsi]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400f26f6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400f26f6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x95ba6259
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400f26f1
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400f26d0
cmp r8d, 0xda55e78f
je 0x1400f26fb
test r9d, r9d
jne 0x1400f26b0
mov rax, qword [rax]
jmp 0x1400f2680
mov edx, dword [rdi + 0x1c]
add rdx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rdx + rax*4]
add rdx, r10
mov rcx, rsi
call rdx
nop
lea rcx, [rbp + 0xc8]
call fcn.140004f48
nop
lea rcx, [rbp + 0x1b0]
call fcn.14000354c
nop
lea rcx, [rbp + 0x108]
call fcn.140004f48
xor r15d, r15d
jmp 0x1400f289a
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400f27c6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400f27c6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x3c73bf8
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400f27c1
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400f27a0
cmp r8d, 0xf030e648
je 0x1400f27cb
test r9d, r9d
jne 0x1400f2780
mov rax, qword [rax]
jmp 0x1400f2750
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
mov ecx, recv
jmp 0x1400f2894
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400f2876
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400f2876
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0xc02af4af
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400f2871
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400f2850
cmp r8d, 0x94d5092f
je 0x1400f287b
test r9d, r9d
jne 0x1400f2830
mov rax, qword [rax]
jmp 0x1400f2800
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
mov ecx, 9
add rdx, r10
call rdx
nop
mov r8, qword [rbp + 0x180]
cmp r8, 0xf
jbe 0x1400f28bb
mov rdx, qword [rbp + 0x168]
lea rcx, [rbp + 0x168]
call fcn.140005914
nop
movzx edx, byte [rbp + 0xa8]
lea rcx, [rbp + 0xb0]
call fcn.140022b7c
jmp 0x1400f298a
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400f2966
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400f2966
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
mov r8d, 0x5cadbeb6
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1400f2961
nop
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x1400f2940
cmp r8d, 0x90ce8b1e
je 0x1400f296b
test r9d, r9d
jne 0x1400f2920
mov rax, qword [rax]
jmp 0x1400f28f0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov ecx, 7
call rdx
nop
mov rdx, qword [rbp + 0x160]
cmp rdx, 0xf
jbe 0x1400f29ce
inc rdx
mov rcx, qword [rbp + 0x148]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400f29c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400f29c9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140179794
movdqu xmmword [rbp + 0x158], xmm6
mov byte [rbp + 0x148], 0
mov rdx, qword [rbp + 0x1a0]
cmp rdx, 0xf
jbe 0x1400f2a22
inc rdx
mov rcx, qword [rbp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400f2a1c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400f2a1c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140179794
nop
mov rdx, qword [rbp + 0x140]
cmp rdx, 0xf
jbe 0x1400f2a66
inc rdx
mov rcx, qword [rbp + 0x128]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400f2a61
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400f2a61
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140179794
mov qword [rbp + 0x138], r15
mov qword [rbp + 0x140], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x128], 0
mov rdx, qword [r13 + 0x18]
cmp rdx, 0xf
jbe 0x1400f2ab6
inc rdx
mov rcx, qword [r13]
cmp rdx, 0x1000
jb 0x1400f2ab1
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400f2af9
mov rcx, r8
call fcn.140179794
mov qword [r13 + 0x10], r15
mov qword [r13 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r13], 0
mov rcx, qword [rbp + 0x2c0]
xor rcx, rsp
call fcn.1401794f0
mov rbx, qword [rsp + 0x430]
movaps xmm6, xmmword [rsp + 0x3d0]
add rsp, 0x3e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3