Function at 0x140021900
Capabilities:
Contain obfuscated stackstrings
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
lea rbp, [rsp - 0x190]
sub rsp, 0x290
mov rax, qword [0x140320c20]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov r13, rcx
mov dword [rsp + 0x20], 0x13000aa
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x24], 0x460029
mov dword [rsp + 0x28], 0x9200ce
mov dword [rsp + 0x2c], 0xdb008d
mov dword [rsp + 0x30], 0xc70114
mov dword [rsp + 0x34], 0xd00032
mov dword [rsp + 0x38], 0xe6
call fcn.140014970
xor ebx, ebx
mov dword [rsp + 0x50], 0x630061
lea rcx, [rsp + 0x50]
mov word [rsp + 0x68], bx
mov rsi, rax
mov dword [rsp + 0x54], 0x2d0065
mov dword [rsp + 0x58], 0x610073
mov dword [rsp + 0x5c], 0x650066
mov dword [rsp + 0x60], 0x64002e
mov dword [rsp + 0x64], 0x6c006c
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r9, rax
test rax, rax
jne 0x140021a34
test rsi, rsi
lea rdi, [rsp + 0x50]
mov r8d, 0x20a
lea rcx, [rsp + 0x70]
cmovne rdi, rsi
xor edx, edx
call fcn.140218bd0
mov r8d, 0x104
lea rdx, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x140021a29
lea edx, [rbx + 0x5c]
lea rcx, [rsp + 0x70]
call fcn.14021a260
test rax, rax
je 0x140021a29
mov r8, rdi
mov word [rax + 2], bx
mov edx, 0x104
lea rcx, [rsp + 0x70]
call fcn.140224a34
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r9, rax
test rax, rax
jne 0x140021a34
mov qword [r13], rbx
xor al, al
jmp 0x140021bb8
lea rax, [rsp + 0x40]
mov qword [rsp + 0x2c8], r12
test rax, 0xffffffffffff0000
mov qword [rsp + 0x2d0], r14
movsxd rax, dword [r9 + 0x3c]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x2d8], r15
mov ecx, 0x5a4d
mov dword [rsp + 0x40], 0x456c6c44
mov dword [rsp + 0x44], 0x7972746e
mov word [rsp + 0x48], 0x3033
mov byte [rsp + 0x4a], bl
jne 0x140021ad0
cmp word [r9], cx
jne 0x140021b51
cmp dword [rax + r9], 0x4550
jne 0x140021b51
mov r8d, dword [rax + r9 + 0x88]
movzx edx, dx
mov ecx, dword [r8 + r9 + 0x14]
mov r10d, dword [r8 + r9 + 0x10]
add ecx, r10d
cmp edx, ecx
jae 0x140021b51
mov ecx, dword [r8 + r9 + 0x1c]
sub edx, r10d
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x140021b54
cmp word [r9], cx
jne 0x140021b51
cmp dword [rax + r9], 0x4550
jne 0x140021b51
mov r11d, dword [rax + r9 + 0x88]
mov r10d, ebx
add r11, r9
mov r12d, dword [r11 + 0x1c]
mov r14d, dword [r11 + 0x20]
add r12, r9
mov esi, dword [r11 + 0x24]
add r14, r9
mov r15d, dword [r11 + 0x18]
add rsi, r9
test r15d, r15d
je 0x140021b51
nop dword [rax]
mov edi, r10d
lea r8, [rsp + 0x40]
mov eax, dword [r14 + rdi*4]
add rax, r9
sub r8, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140021b35
inc rax
test ecx, ecx
jne 0x140021b22
test edx, edx
jne 0x140021b49
mov ecx, dword [r11 + 0x10]
add ecx, dword [r11 + 0x14]
movzx edx, word [rsi + rdi*2]
cmp edx, ecx
jb 0x140021b7a
inc r10d
cmp r10d, r15d
jb 0x140021b10
mov rax, rbx
mov r15, qword [rsp + 0x2d8]
mov r14, qword [rsp + 0x2d0]
mov r12, qword [rsp + 0x2c8]
test rax, rax
je 0x140021b86
xor ecx, ecx
call rax
mov rdi, rax
jmp 0x140021b89
movzx eax, dx
mov eax, dword [r12 + rax*4]
add rax, r9
jmp 0x140021b54
mov rdi, rbx
mov qword [r13], rdi
test rdi, rdi
jne 0x140021b96
xor al, al
jmp 0x140021bb8
mov rax, qword [rdi]
xor edx, edx
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_htonl]
test rax, rax
je 0x140021bae
mov rcx, rdi
call rax
mov rbx, rax
test rbx, rbx
mov qword [r13 + 8], rbx
setne al
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.140215090
add rsp, 0x290
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret