Function at 0x1400a0830
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x330]
sub rsp, 0x430
movaps xmmword [rsp + 0x420], xmm6
mov rax, qword [0x140365f00]
xor rax, rsp
mov qword [rbp + 0x310], rax
mov rsi, r8
mov qword [rbp - 0x20], r8
mov r13, rdx
mov r12, rcx
mov qword [rbp + 0xf8], rdx
mov qword [rbp + 0x100], r8
xor r14d, r14d
mov dword [rsp + 0x68], r14d
call fcn.140093e90
lea rcx, [rbp + 0x178]
call fcn.1400ada60
nop
mov dword [rbp - 0x78], 0x3f272068
mov dword [rbp - 0x74], 0x313d2137
mov word [rbp - 0x70], WSAGetLastError
mov byte [rbp - 0x6e], 1
mov dword [rbp + 0xe8], 0x3c312168
mov dword [rbp + 0xec], 0x1006e37
mov dword [rsp + 0x70], 0x22353c68
mov dword [rsp + 0x74], 0x3b3b3a21
mov dword [rsp + 0x78], 0x65333f
mov byte [rsp + 0x7c], 1
mov dword [rbp - 0x58], 0x38272768
mov dword [rbp - 0x54], 0x1006e36
mov dword [rsp + 0x68], 0x22313f68
mov dword [rsp + 0x6c], 0x1006e21
mov dword [rbp - 0x50], 0x34233a68
mov dword [rbp - 0x4c], 0x38353d20
mov dword [rbp - 0x48], 0x1006a33
mov dword [rbp + 0x108], 0x3420363a
mov dword [rbp + 0x10c], 0x323b3f6f
mov dword [rbp + 0x110], 0x100393f
lea r8, [rbp - 0x50]
lea rdx, [rbp + 0x108]
lea rcx, [rbp + 0x118]
call fcn.140089570
nop
mov rdx, r13
cmp qword [r13 + 0x18], 0xf
jbe 0x1400a095d
mov rdx, qword [r13]
mov r8, qword [r13 + 0x10]
mov rcx, rax
call fcn.140003620
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x158], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x168], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rsp + 0x68]
lea rdx, [rbp + 0x158]
lea rcx, [rbp + 8]
call fcn.140089060
nop
mov rdx, rsi
cmp qword [rsi + 0x18], 0xf
jbe 0x1400a09b0
mov rdx, qword [rsi]
mov r8, qword [rsi + 0x10]
mov rcx, rax
call fcn.140003620
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x18], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 8], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rbp - 0x58]
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0xc8]
call fcn.140089060
nop
lea rdx, [rbp + 0x178]
cmp qword [rbp + 0x190], 0xf
cmova rdx, qword [rbp + 0x178]
mov r8, qword [rbp + 0x188]
mov rcx, rax
call fcn.140003620
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xa8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xb8], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rsp + 0x70]
lea rdx, [rbp + 0xa8]
lea rcx, [rbp + 0x88]
call fcn.140089840
nop
lea rdx, [r12 + 0x240]
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x1400a0a68
mov rdx, qword [rdx]
mov rcx, rax
call fcn.140003620
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x78], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rbp + 0xe8]
lea rdx, [rbp + 0x68]
lea rcx, [rbp + 0x48]
call fcn.140089060
nop
mov rdx, r12
cmp qword [r12 + 0x18], 0xf
jbe 0x1400a0ab2
mov rdx, qword [r12]
mov r8, qword [r12 + 0x10]
mov rcx, rax
call fcn.140003620
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x28], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x38], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rbp - 0x78]
lea rdx, [rbp + 0x28]
lea rcx, [rbp - 0x40]
call fcn.140089390
nop
lea rdx, [r12 + 0x20]
cmp qword [r12 + 0x38], 0xf
jbe 0x1400a0b01
mov rdx, qword [r12 + 0x20]
mov r8, qword [r12 + 0x30]
mov rcx, rax
call fcn.140003620
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1d8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1e8], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x1400a0b70
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a0b6b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400a0b6b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140130784
movdqa xmm6, xmmword [0x14034bf10]
movdqu xmmword [rbp - 0x30], xmm6
mov byte [rbp - 0x40], 0
mov rdx, qword [rbp + 0x40]
cmp rdx, 0xf
jbe 0x1400a0bc0
inc rdx
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a0bba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400a0bba
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140130784
nop
mov rdx, qword [rbp + 0x60]
cmp rdx, 0xf
jbe 0x1400a0bfe
inc rdx
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a0bf9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400a0bf9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140130784
movdqu xmmword [rbp + 0x58], xmm6
mov byte [rbp + 0x48], 0
mov rdx, qword [rbp + 0x80]
cmp rdx, 0xf
jbe 0x1400a0c49
inc rdx
mov rcx, qword [rbp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a0c43
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400a0c43
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140130784
nop
mov rdx, qword [rbp + 0xa0]
cmp rdx, 0xf
jbe 0x1400a0c8d
inc rdx
mov rcx, qword [rbp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a0c88
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400a0c88
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140130784
movdqu xmmword [rbp + 0x98], xmm6
mov byte [rbp + 0x88], 0
mov rdx, qword [rbp + 0xc0]
cmp rdx, 0xf
jbe 0x1400a0ce1
inc rdx
mov rcx, qword [rbp + 0xa8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a0cdb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400a0cdb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140130784
nop
mov rdx, qword [rbp + 0xe0]
cmp rdx, 0xf
jbe 0x1400a0d25
inc rdx
mov rcx, qword [rbp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a0d20
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400a0d20
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140130784
movdqu xmmword [rbp + 0xd8], xmm6
mov byte [rbp + 0xc8], 0
mov rdx, qword [rbp]
cmp rdx, 0xf
jbe 0x1400a0d73
inc rdx
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a0d6d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400a0d6d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140130784
nop
mov rdx, qword [rbp + 0x20]
cmp rdx, 0xf
jbe 0x1400a0db1
inc rdx
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a0dac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400a0dac
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140130784
movdqu xmmword [rbp + 0x18], xmm6
mov byte [rbp + 8], 0
mov rdx, qword [rbp + 0x170]
cmp rdx, 0xf
jbe 0x1400a0dff
inc rdx
mov rcx, qword [rbp + 0x158]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a0df9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400a0df9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140130784
nop
mov rdx, qword [rbp + 0x130]
cmp rdx, 0xf
jbe 0x1400a0e43
inc rdx
mov rcx, qword [rbp + 0x118]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a0e3e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400a0e3e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140130784
movdqu xmmword [rbp + 0x128], xmm6
mov byte [rbp + 0x118], 0
lea rax, [rbp + 0x158]
mov qword [rbp - 0x68], rax
lea rdx, [r12 + 0x60]
lea rcx, [rbp + 0x158]
call fcn.14000cc10
mov rbx, rax
lea rdx, [rbp + 0x1d8]
lea rcx, [rbp - 0x18]
call fcn.14000cc10
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x198]
call fcn.1400a49f0
nop
lea rax, [rbp - 0x40]
mov qword [rsp + 0x58], rax
lea rdx, [rbp + 0x198]
cmp qword [rbp + 0x1b0], 0xf
cmova rdx, qword [rbp + 0x198]
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], r14
mov r14, 0xffffffffffffffff
mov r8, r14
nop
inc r8
cmp byte [rdx + r8], 0
jne 0x1400a0ed0
lea rcx, [rbp - 0x40]
call fcn.1400042a0
nop
lea rax, [rbp + 0x118]
mov qword [rbp - 0x68], rax
lea rdx, [0x140365040]
lea rcx, [rbp + 0x118]
call fcn.14000cc10
mov rbx, rax
lea rdx, [0x140365020]
lea rcx, [rbp + 8]
call fcn.14000cc10
nop
lea r8, [rbp - 0x40]
mov rdx, rbx
mov rcx, rax
call fcn.140091920
xor eax, 0xa5a5
mov edx, eax
shr eax, 8
movzx r8d, al
movzx eax, dl
movabs rcx, 0xcbf29ce484222325
xor rax, rcx
movabs r15, 0x100000001b3
imul rax, r15
xor r8, rax
imul r8, r15
mov eax, edx
shr eax, 0x10
movzx ecx, al
xor r8, rcx
imul r8, r15
shr rdx, 0x18
xor r8, rdx
imul r8, r15
cmp r8w, 0xdf7f
jne 0x1400a1c7f
mov qword [rbp + 0x150], 0
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x118]
lea rdx, [rbp + 0x198]
lea rcx, [rbp + 0x108]
call fcn.14008d950
nop
lea rdx, [r12 + 0x20]
lea rcx, [rsp + 0x70]
call fcn.140088820
nop
mov dword [rsp + 0x5c], 0x646972
mov dword [rsp + 0x58], 0x656e776f
mov byte [rsp + 0x60], 0
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x5f]
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x40]
call fcn.140004e40
nop
movzx ecx, byte [rbp + 0x108]
test cl, cl
jne 0x1400a1011
mov byte [rbp + 0x108], 1
call fcn.14008bdd0
mov qword [rbp + 0x110], rax
movzx ecx, byte [rbp + 0x108]
jmp 0x1400a1018
mov rax, qword [rbp + 0x110]
cmp cl, 1
jne 0x1400a102b
lea rdx, [rbp - 0x40]
mov rcx, rax
call fcn.140091170
jmp 0x1400a1030
mov rax, qword [rsp + 0x58]
lea rdx, [rsp + 0x70]
mov rcx, rax
call fcn.140090da0
movzx ebx, al
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x1400a107e
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a1079
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400a1079
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140130784
movdqu xmmword [rbp - 0x30], xmm6
mov byte [rbp - 0x40], 0
movzx edx, byte [rsp + 0x70]
lea rcx, [rsp + 0x78]
call fcn.140097a60
test bl, bl
jne 0x1400a1149
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400a1126
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400a1126
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x57430118
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400a1121
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400a1100
cmp r8d, 0x7950eb68
je 0x1400a112b
test r9d, r9d
jne 0x1400a10e0
mov rax, qword [rax]
jmp 0x1400a10b0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov ecx, 8
call rdx
mov dword [rbp - 0x64], 0x656761
mov dword [rbp - 0x68], 0x7373656d
mov byte [rbp - 0x60], 0
lea r9, [rsp + 0x50]
lea r8, [rbp - 0x61]
lea rdx, [rbp - 0x68]
lea rcx, [rbp - 0x40]
call fcn.140004e40
nop
movzx ecx, byte [rbp + 0x108]
test cl, cl
jne 0x1400a1199
mov byte [rbp + 0x108], 1
call fcn.14008bdd0
mov qword [rbp + 0x110], rax
movzx ecx, byte [rbp + 0x108]
jmp 0x1400a11a0
mov rax, qword [rbp + 0x110]
cmp cl, 1
jne 0x1400a11b3
lea rdx, [rbp - 0x40]
mov rcx, rax
call fcn.140091170
jmp 0x1400a11b8
mov rax, qword [rsp + 0x58]
xorps xmm0, xmm0
movups xmmword [rbp + 0x1b8], xmm0
movdqu xmmword [rbp + 0x1c8], xmm6
mov byte [rbp + 0x1b8], 0
mov dword [rsp + 0x68], 0x2ffc
cmp byte [rax], 3
jne 0x1400a11f0
mov rdx, qword [rax + 8]
lea rax, [rbp + 0x1b8]
cmp rax, rdx
je 0x1400a120d
jmp 0x1400a11f2
xor edx, edx
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x1400a1200
mov rdx, qword [rdx]
lea rcx, [rbp + 0x1b8]
call fcn.14000dae0
nop
mov r8, qword [rbp - 0x28]
cmp r8, 0xf
jbe 0x1400a1224
mov rdx, qword [rbp - 0x40]
lea rcx, [rbp - 0x40]
call fcn.140003e40
movdqu xmmword [rbp - 0x30], xmm6
mov byte [rbp - 0x40], 0
mov word [rsp + 0x6b], 0x65
mov word [rsp + 0x68], 0x6f63
mov byte [rsp + 0x6a], 0x64
mov byte [rsp + 0x6d], 0
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x6c]
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x118]
call fcn.140004e40
nop
movzx ecx, byte [rbp + 0x108]
test cl, cl
jne 0x1400a1288
mov byte [rbp + 0x108], 1
call fcn.14008bdd0
mov qword [rbp + 0x110], rax
movzx ecx, byte [rbp + 0x108]
jmp 0x1400a128f
mov rax, qword [rbp + 0x110]
cmp cl, 1
jne 0x1400a12a5
lea rdx, [rbp + 0x118]
mov rcx, rax
call fcn.140091170
jmp 0x1400a12aa
mov rax, qword [rsp + 0x58]
mov rcx, rax
call fcn.140088dc0
mov edx, eax
shr eax, 8
movzx edi, al
movzx eax, dl
movabs rcx, 0xcbf29ce484222325
xor rax, rcx
imul rax, r15
xor rdi, rax
imul rdi, r15
mov eax, edx
shr eax, 0x10
movzx ecx, al
xor rdi, rcx
imul rdi, r15
shr rdx, 0x18
xor rdi, rdx
imul rdi, r15
mov r8, qword [rbp + 0x130]
cmp r8, 0xf
jbe 0x1400a130f
mov rdx, qword [rbp + 0x118]
lea rcx, [rbp + 0x118]
call fcn.140003e40
mov dword [rsp + 0x5c], 0x737365
mov dword [rsp + 0x58], 0x63637573
mov byte [rsp + 0x60], 0
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x5f]
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x158]
call fcn.140004e40
nop
mov ebx, 0x3dffd
mov dword [rsp + 0x68], ebx
movzx ecx, byte [rbp + 0x108]
test cl, cl
jne 0x1400a1370
mov byte [rbp + 0x108], 1
call fcn.14008bdd0
mov qword [rbp + 0x110], rax
movzx ecx, byte [rbp + 0x108]
jmp 0x1400a1377
mov rax, qword [rbp + 0x110]
cmp cl, 1
jne 0x1400a1390
lea rdx, [rbp + 0x158]
mov rcx, rax
call fcn.140091170
mov rcx, rax
jmp 0x1400a1395
mov rcx, qword [rsp + 0x58]
lea rax, [rcx + 8]
cmp byte [rcx], 4
mov r15d, 0
cmovne rax, r15
cmp byte [rax], r15b
je 0x1400a1463
mov dword [rbp + 0xec], 0x737365
mov dword [rbp + 0xe8], 0x63637573
mov byte [rbp + 0xf0], r15b
lea r9, [rsp + 0x50]
lea r8, [rbp + 0xef]
lea rdx, [rbp + 0xe8]
lea rcx, [rbp + 0x118]
call fcn.140004e40
nop
mov ebx, 0x33dfff
mov dword [rsp + 0x68], ebx
movzx ecx, byte [rbp + 0x108]
test cl, cl
jne 0x1400a141a
mov byte [rbp + 0x108], 1
call fcn.14008bdd0
mov qword [rbp + 0x110], rax
movzx ecx, byte [rbp + 0x108]
jmp 0x1400a1421
mov rax, qword [rbp + 0x110]
cmp cl, 1
jne 0x1400a143a
lea rdx, [rbp + 0x118]
mov rcx, rax
call fcn.140091170
mov rcx, rax
jmp 0x1400a143f
mov rcx, qword [rsp + 0x58]
lea rax, [rcx + 8]
cmp byte [rcx], 4
cmovne rax, r15
cmp byte [rax], 0
je 0x1400a145e
movabs rax, 0xcbe5c873d26645f1
cmp rdi, rax
je 0x1400a1463
xor dil, dil
jmp 0x1400a1466
mov dil, 1
test bl, 2
je 0x1400a147b
and ebx, 0xfffffffd
lea rcx, [rbp + 0x118]
call fcn.140003410
nop
test bl, 1
je 0x1400a148c
lea rcx, [rbp + 0x158]
call fcn.140003410
test dil, dil
je 0x1400a1ba9
lea rdx, [rbp + 0x108]
lea rcx, [rsp + 0x70]
call fcn.14008ff40
mov rdx, rax
mov rcx, r12
call fcn.14009f990
mov dword [rsp + 0x5c], 0x737365
mov dword [rsp + 0x58], 0x63637573
mov byte [rsp + 0x60], 0
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x5f]
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x118]
call fcn.140004e40
nop
movzx ecx, byte [rbp + 0x108]
test cl, cl
jne 0x1400a1509
mov byte [rbp + 0x108], 1
call fcn.14008bdd0
mov qword [rbp + 0x110], rax
movzx ecx, byte [rbp + 0x108]
jmp 0x1400a1510
mov rax, qword [rbp + 0x110]
cmp cl, 1
jne 0x1400a1529
lea rdx, [rbp + 0x118]
mov rcx, rax
call fcn.140091170
mov rcx, rax
jmp 0x1400a152e
mov rcx, qword [rsp + 0x58]
lea rax, [rcx + 8]
cmp byte [rcx], 4
cmovne rax, r15
movzx ebx, byte [rax]
lea rcx, [rbp + 0x118]
call fcn.140003410
test bl, bl
je 0x1400a15f2
mov word [rsp + 0x6b], reloc.WS2_32.dll_WSAGetLastError
mov word [rsp + 0x68], 0x6e69
mov byte [rsp + 0x6a], 0x66
mov byte [rsp + 0x6d], 0
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x6c]
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x118]
call fcn.140004e40
nop
movzx ecx, byte [rbp + 0x108]
test cl, cl
jne 0x1400a15ab
mov byte [rbp + 0x108], 1
call fcn.14008bdd0
mov qword [rbp + 0x110], rax
movzx ecx, byte [rbp + 0x108]
jmp 0x1400a15b2
mov rax, qword [rbp + 0x110]
cmp cl, 1
jne 0x1400a15c8
lea rdx, [rbp + 0x118]
mov rcx, rax
call fcn.140091170
jmp 0x1400a15cd
mov rax, qword [rsp + 0x58]
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.14008ff40
mov rdx, rax
mov rcx, r12
call fcn.14009fd60
nop
lea rcx, [rbp + 0x118]
call fcn.140003410
mov dword [rsp + 0x70], 0x25392107
mov dword [rsp + 0x74], 0x3c38323b
mov dword [rsp + 0x78], 0x3c322c
mov byte [rsp + 0x7c], 1
lea rcx, [rsp + 0x70]
call fcn.140092c20
mov rdx, rax
lea rcx, [r12 + 0x218]
call fcn.140088a90
test al, al
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
je 0x1400a1b10
lea r15, [section..data]
mov rsi, r15
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
cmova rsi, qword [section..data]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400a16d6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400a16d6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x8734cf44
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400a16d1
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400a16b0
cmp r8d, 0x3ffce446
je 0x1400a16db
test r9d, r9d
jne 0x1400a1690
mov rax, qword [rax]
jmp 0x1400a1660
mov edx, dword [rdi + 0x1c]
add rdx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rdx + rax*4]
add rdx, r10
mov rcx, rsi
call rdx
movdqa xmm0, xmmword [0x140138e70]
movdqu xmmword [rsp + 0x70], xmm0
mov byte [rbp - 0x80], 1
lea rcx, [rsp + 0x70]
call fcn.140092bd0
mov r9, rax
inc r14
cmp byte [rax + r14], 0
jne 0x1400a1716
mov rcx, qword [0x140365010]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, r14
jb 0x1400a1ef1
mov rax, r15
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
cmova rax, qword [section..data]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
mov r8, r15
movzx edx, byte [rsp + 0x50]
lea rcx, [rbp + 0x158]
call fcn.140084f40
nop
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x200]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 2
lea rdx, [rbp + 0x158]
lea rcx, [rbp + 0x200]
call fcn.140033be0
nop
cmp qword [rbp + 0x288], 0
je 0x1400a17ec
mov rdx, r15
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
cmova rdx, qword [section..data]
mov r8, qword [0x140365010]
lea rcx, [rbp + 0x200]
call fcn.140036bc0
lea rcx, [rbp + 0x200]
call fcn.140033ba0
mov dword [rbp - 0x78], 0x2536201d
mov dword [rbp - 0x74], 0x30263225
mov word [rbp - 0x70], 0xa
mov byte [rbp - 0x6e], 1
lea rcx, [rbp - 0x78]
call fcn.140092b90
mov rdx, rax
mov r8, r15
lea rcx, [rbp + 0x118]
call fcn.140088f00
nop
lea rdx, [rbp + 0x118]
cmp qword [rbp + 0x130], 0xf
cmova rdx, qword [rbp + 0x118]
xor ecx, ecx
mov qword [rsp + 0x40], rcx
lea rax, [rbp + 0xe8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], ecx
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1400a1a1b
mov r14, qword [0x140365010]
inc r14
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
jbe 0x1400a1891
mov r15, qword [section..data]
mov rsi, r15
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov edi, dword [rcx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x1400a1926
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400a1926
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r11 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r11
mov r8d, 0x7844d366
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400a1921
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400a1900
cmp r8d, 0xf0b1dd1b
je 0x1400a192b
test r9d, r9d
jne 0x1400a18e0
mov rax, qword [rax]
jmp 0x1400a18b0
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r15
mov r9d, 1
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rbp + 0xe8]
call r10
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400a19f6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400a19f6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0xcfaf5f8c
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400a19f1
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400a19d0
cmp r8d, 0xcfa64441
je 0x1400a19fb
test r9d, r9d
jne 0x1400a19b0
mov rax, qword [rax]
jmp 0x1400a1980
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov rcx, qword [rbp + 0xe8]
call rdx
lea rsi, [r12 + 0x20]
cmp qword [rsi + 0x18], 0xf
jbe 0x1400a1a2a
mov rsi, qword [rsi]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400a1ab6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400a1ab6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0xed5ed7d7
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400a1ab1
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400a1a90
cmp r8d, 0x972f3f7d
je 0x1400a1abb
test r9d, r9d
jne 0x1400a1a70
mov rax, qword [rax]
jmp 0x1400a1a40
mov edx, dword [rdi + 0x1c]
add rdx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rdx + rax*4]
add rdx, r10
mov rcx, rsi
call rdx
nop
lea rcx, [rbp + 0x118]
call fcn.140003410
nop
lea rcx, [rbp + 0x200]
call fcn.14002f860
nop
lea rcx, [rbp + 0x158]
call fcn.140003410
mov rsi, qword [rbp - 0x20]
jmp 0x1400a1c5a
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400a1b86
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400a1b86
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0xa5a565f7
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400a1b81
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400a1b60
cmp r8d, 0xbe078837
je 0x1400a1b8b
test r9d, r9d
jne 0x1400a1b40
mov rax, qword [rax]
jmp 0x1400a1b10
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
mov ecx, ntohs
jmp 0x1400a1c54
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400a1c36
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400a1c36
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x6f59edca
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400a1c31
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400a1c10
cmp r8d, 0xf201ea42
je 0x1400a1c3b
test r9d, r9d
jne 0x1400a1bf0
mov rax, qword [rax]
jmp 0x1400a1bc0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
mov ecx, 9
add rdx, r10
call rdx
nop
lea rcx, [rbp + 0x1b8]
call fcn.140003410
nop
movzx edx, byte [rbp + 0x108]
lea rcx, [rbp + 0x110]
call fcn.140097a60
jmp 0x1400a1d2a
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400a1d06
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400a1d06
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov ecx, dword [rcx + rbx]
add rcx, r10
mov r8d, 0x97f623b1
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1400a1d01
nop dword [rax]
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x1400a1ce0
cmp r8d, 0xccaaff51
je 0x1400a1d0b
test r9d, r9d
jne 0x1400a1cc0
mov rax, qword [rax]
jmp 0x1400a1c90
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov ecx, 7
call rdx
nop
mov rdx, qword [rbp + 0x1b0]
cmp rdx, 0xf
jbe 0x1400a1d6e
inc rdx
mov rcx, qword [rbp + 0x198]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a1d69
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400a1d69
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140130784
movdqu xmmword [rbp + 0x1a8], xmm6
mov byte [rbp + 0x198], 0
mov rdx, qword [rbp + 0x1f0]
cmp rdx, 0xf
jbe 0x1400a1dc2
inc rdx
mov rcx, qword [rbp + 0x1d8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a1dbc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400a1dbc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140130784
nop
mov rdx, qword [rbp + 0x190]
cmp rdx, 0xf
jbe 0x1400a1e06
inc rdx
mov rcx, qword [rbp + 0x178]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a1e01
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400a1e01
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140130784
xor ebx, ebx
mov qword [rbp + 0x188], rbx
mov qword [rbp + 0x190], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x178], bl
mov rdx, qword [r13 + 0x18]
cmp rdx, 0xf
jbe 0x1400a1e5b
mov rcx, qword [r13]
inc rdx
cmp rdx, 0x1000
jb 0x1400a1e56
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400a1ee3
mov rcx, r8
call fcn.140130784
mov qword [r13 + 0x10], rbx
mov qword [r13 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r13], 0
mov rdx, qword [rsi + 0x18]
cmp rdx, 0xf
jbe 0x1400a1ea2
inc rdx
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x1400a1e9d
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400a1eea
mov rcx, r8
call fcn.140130784
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], 0
mov rcx, qword [rbp + 0x310]
xor rcx, rsp
call fcn.1401304e0
mov rbx, qword [rsp + 0x488]
movaps xmm6, xmmword [rsp + 0x420]
add rsp, 0x430
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140001ca0
int3