Function at 0x14004c7c0
Capabilities:
Contain obfuscated stackstrings
Get system information on windows
Make suspicious ntquerysysteminformation call
Parse pe header
Query environment variable
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov rax, qword [0x140236800]
xor rax, rsp
mov qword [rbp + 0x38], rax
mov byte [rsp + 0x30], r8b
mov qword [rbp - 0x40], rdx
mov qword [rbp - 0x48], rcx
xor r15d, r15d
mov esi, r15d
mov qword [rbp - 0x78], r15
mov dword [rbp - 0x10], r15d
lea r9, [rbp - 0x10]
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14004c87a
nop word [rax + rax]
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp - 0x10]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
lea r9, [rbp - 0x10]
mov r8d, dword [rbp - 0x10]
mov rdx, rax
mov ecx, listen
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x14004c830
mov qword [rbp - 0x78], rsi
test eax, eax
js 0x14004ed33
mov eax, r15d
mov dword [rsp + 0x34], eax
cmp dword [rsi], r15d
jbe 0x14004ed33
movzx edi, byte [rsp + 0x30]
movzx ebx, byte [rsp + 0x30]
movzx r14d, byte [rsp + 0x30]
mov qword [rsp + 0x20], r14
movzx r13d, byte [rsp + 0x30]
movzx ecx, byte [rsp + 0x30]
mov qword [rsp + 0x28], rcx
nop word [rax + rax]
imul rcx, rax, 0x128
lea r12, [rcx + rsi]
mov qword [rbp - 0x38], r12
movzx eax, word [r12 + 0x2e]
add rax, rcx
add rsi, rax
movzx edx, dil
lea rcx, [rbp + 0x18]
call fcn.1400029d0
nop
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rsi + r8 + 0x30], 0
jne 0x14004c8f0
lea rdx, [rsi + 0x30]
lea rcx, [rbp + 0x18]
call fcn.140004440
nop
lea rcx, [rbp + 0x18]
call fcn.140001ba0
mov rdx, qword [rbp - 0x48]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x14004ed14
lea rdx, [r12 + 0x30]
lea rcx, [rbp - 8]
call fcn.1400042b0
nop
mov dword [rsp + 0x60], 0x2729202b
mov dword [rsp + 0x64], 0x30343049
mov word [rsp + 0x68], 0x3d37
mov byte [rsp + 0x6a], 0x82
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x6b], xmm0
mov qword [rsp + 0x7b], rax
mov r8, qword [0x14023d108]
mov r9, qword [0x14023d100]
nop
mov rsi, r15
cmp rsi, 0x23
jae 0x14004d540
movzx r11d, byte [rsp + rsi + 0x60]
movzx r10d, r11b
cmp r8, rsi
ja 0x14004d537
lea rcx, [r9 + 1]
cmp r8, rcx
jae 0x14004c9c2
movabs r12, 0xe9e4d766bff4736c
lea rcx, [rsi + r12]
mov rax, rcx
and rax, r11
imul r14, rax, 0xfffffffffffffffe
add r14, rcx
add r14, r11
add r14b, 0xc
mov qword [rsp + 0x20], r14
jmp 0x14004c9f9
je 0x14004d4a5
lea rax, [r9 + 3]
cmp r8, rax
je 0x14004d411
lea rax, [r9 + 4]
cmp r8, rax
je 0x14004d3a8
lea rax, [rcx + 1]
cmp r8, rax
je 0x14004d359
movabs r12, 0xe9e4d766bff4736c
movzx r10d, r11b
nop dword [rax]
cmp r9, rsi
ja 0x14004d52e
lea rax, [r9 + 9]
cmp r8, rax
jae 0x14004ca3c
movabs rdx, 0x2fc5ab6dbf0d77dc
add rdx, rsi
movzx eax, dl
and al, r11b
add al, al
movzx r14d, r10b
sub r14b, al
sub r14b, 4
add r14b, dl
mov qword [rsp + 0x20], r14
jmp 0x14004ca80
lea rax, [r9 + 1]
cmp r8, rax
je 0x14004d336
inc rax
cmp r8, rax
je 0x14004d302
lea rax, [r9 + 5]
cmp r8, rax
je 0x14004d2d8
lea rax, [r9 + 4]
cmp r8, rax
je 0x14004d2b3
lea rax, [r9 + 3]
cmp r8, rax
je 0x14004d289
nop dword [rax]
lea rax, [r9 + r8]
cmp rax, rsi
jbe 0x14004cfb0
nop dword [rax]
lea rax, [r9 + 1]
cmp r8, rax
je 0x14004cf94
lea rax, [r9 + 0x61]
cmp r8, rax
je 0x14004cf67
lea rax, [r9 + 0x80]
cmp r8, rax
je 0x14004cf3d
lea rax, [r9 + 0x20]
cmp r8, rax
je 0x14004cf21
lea rax, [r9 + 0x7a]
cmp r8, rax
je 0x14004cf08
lea rax, [r9 + 0x200]
cmp r8, rax
je 0x14004cee9
lea rax, [r9 + 0x28]
cmp r8, rax
je 0x14004ced0
lea rax, [r9 + 8]
cmp r8, rax
je 0x14004ceb2
lea rax, [r9 + 2]
cmp r8, rax
je 0x14004ce98
lea r8, [r9 + 0x41]
lea r9, [r8 + 9]
lea rax, [r9 + 0x3e8]
cmp r8, rax
jb 0x14004d508
lea rax, [r9 + 0x40]
cmp r8, rax
jb 0x14004d4e2
lea rax, [r9 + 9]
cmp r8, rax
jb 0x14004cc84
lea rax, [r9 + 3]
cmp r8, rax
jb 0x14004cc56
lea rax, [r9 + 0x41]
cmp r8, rax
jb 0x14004cc29
lea rax, [r9 + 0xa]
cmp r8, rax
jb 0x14004ce4c
lea rax, [r9 + 4]
cmp r8, rax
jb 0x14004ce04
lea rcx, [r9 + 0x5a]
cmp r8, rcx
jb 0x14004cdc8
lea rax, [r9 + 0x400]
cmp r8, rax
jb 0x14004cda1
lea rax, [r9 + 0x42]
cmp r8, rax
jb 0x14004ca90
mov r8, rcx
lea r9, [rcx + 0xa]
lea rax, [r9 + 0x10]
cmp rcx, rax
ja 0x14004cd82
lea rax, [r9 + 5]
cmp rcx, rax
ja 0x14004cd61
lea rax, [r9 + 0x2a]
cmp rcx, rax
ja 0x14004cd45
lea rax, [r9 + 0x1000]
cmp rcx, rax
ja 0x14004cd38
lea rax, [r9 + 0x64]
cmp rcx, rax
ja 0x14004cd1c
lea rax, [r9 + 0x61]
cmp rcx, rax
ja 0x14004ccf5
lea rcx, [r9 + 0x80]
cmp r8, rcx
ja 0x14004cccb
lea rax, [r9 + 0x20]
cmp r8, rax
ja 0x14004ccb2
lea rax, [r9 + 6]
cmp r8, rax
ja 0x14004ca90
mov r8, rcx
lea r9, [rcx + 1]
jmp 0x14004ca90
movabs rdx, 0xff40f4ca39baaba4
add rdx, rsi
movzx eax, dl
and al, r11b
add al, al
movzx r14d, r10b
sub r14b, al
sub r14b, 0x7c
add r14b, dl
mov qword [rsp + 0x20], r14
jmp 0x14004ca80
movabs rdx, 0x2b7745fcb9d1c4cc
add rdx, rsi
movzx eax, dl
and al, r11b
mov ecx, gethostname
sub cl, al
lea r14d, [rcx + rcx]
add r14b, r10b
add r14b, dl
mov qword [rsp + 0x20], r14
jmp 0x14004ca00
movabs rdx, 0x57ad972f39e8ddf4
add rdx, rsi
movzx eax, dl
and al, r11b
mov ecx, Ordinal_45
sub cl, al
lea r14d, [rcx + rcx]
add r14b, r10b
add r14b, dl
mov qword [rsp + 0x20], r14
jmp 0x14004c987
lea ecx, [rsi - 0x20]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea edx, [r11 + rcx]
sub dl, 0x20
jmp 0x14004d37b
lea ecx, [rsi + 8]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea edx, [r11 + rcx]
sub dl, 0x38
inc r9
mov qword [rsp + 0x20], rdx
dec rsi
mov r14, rdx
inc rsi
jmp 0x14004c973
lea ecx, [rsi + 0x30]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea edx, [r11 + rcx]
sub dl, 0x50
mov qword [rsp + 0x20], rdx
dec rsi
mov r14, rdx
inc rsi
jmp 0x14004c973
lea ecx, [rsi + 0x80]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea edx, [r11 + rcx]
add dl, 0x80
jmp 0x14004d3ed
lea edx, [rsi - 0x58]
mov ecx, 0x34
jmp 0x14004d137
lea edx, [rsi - 0x30]
movzx eax, dl
and al, r11b
mov ecx, Ordinal_41
sub cl, al
add cl, cl
add dl, cl
add dl, r11b
jmp 0x14004d436
lea edx, [rsi - 8]
movzx eax, dl
and al, r11b
mov ecx, Ordinal_30
sub cl, al
add cl, cl
add dl, cl
add dl, r11b
mov qword [rsp + 0x20], rdx
jmp 0x14004d462
lea edx, [rsi + 0x20]
movzx eax, dl
and al, r11b
mov ecx, reloc.WS2_32.dll_recv
sub cl, al
lea r14d, [rcx + rcx]
add r14b, dl
add r14b, r11b
jmp 0x14004d4ca
lea ecx, [rsi + 4]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r14d, [r11 + rcx]
sub r14b, 0x1c
mov qword [rsp + 0x20], r14
mov byte [rsp + rsi + 0x60], r14b
inc rsi
jmp 0x14004c973
lea ecx, [rsi + 0x2c]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r14d, [r11 + rcx]
sub r14b, 0x34
mov qword [rsp + 0x20], r14
cmp r9, 5
jb 0x14004cdbb
lea ecx, [rsi + 8]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
add cl, r11b
lea edx, [rcx*2 - 0x70]
jmp 0x14004d37b
lea ecx, [rsi + 0x54]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r14d, [r11 + rcx]
sub r14b, 0x4c
mov qword [rsp + 0x20], r14
cmp r8, 0x40
jae 0x14004d251
lea rax, [r9 + 0x41]
cmp r8, rax
jbe 0x14004d17e
lea ecx, [rsi - 0x68]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r14d, [r11 + rcx]
sub r14b, 0x28
jmp 0x14004cddd
lea ecx, [rsi + 0x7c]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r14d, [r11 + rcx]
sub r14b, 0x64
mov qword [rsp + 0x20], r14
lea rax, [r9 + r8]
cmp rax, 0x28
je 0x14004d274
lea rax, [r9 + 0x7a]
cmp r8, rax
jbe 0x14004d0ac
lea ecx, [rsi - 0x44]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r14d, [r11 + rcx]
sub r14b, 0x24
jmp 0x14004ce19
lea ecx, [rsi + 0x28]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r14d, [r11 + rcx]
sub r14b, 0x18
jmp 0x14004d4ca
lea ecx, [rsi + 0x50]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea edx, [r11 + rcx]
sub dl, 0x30
mov qword [rsp + 0x20], rdx
jmp 0x14004d462
lea ecx, [rsi + 0x78]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea edx, [r11 + rcx]
sub dl, 0x48
jmp 0x14004d436
lea ecx, [rsi - 0x60]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r14d, [r11 + rcx]
sub r14b, 0x60
mov qword [rsp + 0x20], r14
jmp 0x14004d3f8
lea ecx, [rsi - 0x38]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea edx, [r11 + rcx]
sub dl, 0x78
jmp 0x14004d3ed
lea edx, [rsi - 0x10]
movzx eax, dl
and al, r11b
mov ecx, gethostname
sub cl, al
add cl, cl
add dl, cl
add dl, r11b
jmp 0x14004d3ca
lea edx, [rsi + 0x18]
movzx eax, dl
and al, r11b
mov ecx, Ordinal_45
sub cl, al
add cl, cl
add dl, cl
add dl, r11b
mov qword [rsp + 0x20], rdx
dec rsi
mov r14, rdx
inc rsi
jmp 0x14004c973
lea edx, [rsi + 0x40]
movzx eax, dl
and al, r11b
mov ecx, reloc.WLDAP32.dll_Ordinal_32
sub cl, al
add cl, cl
add dl, cl
add dl, r11b
inc r9
mov qword [rsp + 0x20], rdx
dec rsi
mov r14, rdx
inc rsi
jmp 0x14004c973
lea edx, [rsi + 0x68]
movzx eax, dl
and al, r11b
mov ecx, reloc.WS2_32.dll_sendto
sub cl, al
add cl, cl
add dl, cl
add dl, r11b
jmp 0x14004d37b
lea rax, [r9 + 0x64]
cmp r8, rax
jae 0x14004cfd9
lea rdx, [rsi + r12]
movzx eax, dl
and al, r11b
mov ecx, 6
sub cl, al
lea r14d, [rcx + rcx]
add r14b, r10b
add r14b, dl
jmp 0x14004ce61
lea rax, [r9 + 1]
cmp r8, rax
jne 0x14004cffc
lea ecx, [rsi - 0x48]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r14d, [r11 + rcx]
sub r14b, 8
jmp 0x14004d4ca
inc rax
cmp r8, rax
jne 0x14004d020
lea edx, [rsi + 0x68]
movzx eax, dl
and al, r11b
mov ecx, reloc.WS2_32.dll_sendto
sub cl, al
add cl, cl
add dl, cl
add dl, r11b
jmp 0x14004d436
lea rax, [r9 + 3]
cmp r8, rax
jne 0x14004d045
lea edx, [rsi + 0x18]
movzx eax, dl
and al, r11b
mov ecx, Ordinal_45
sub cl, al
add cl, cl
add dl, cl
add dl, r11b
jmp 0x14004d3ed
lea rax, [r9 + 5]
cmp r8, rax
jne 0x14004d075
lea ecx, [rsi - 0x38]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea edx, [r11 + rcx]
sub dl, 0x78
mov qword [rsp + 0x20], rdx
dec rsi
mov r14, rdx
inc rsi
jmp 0x14004c973
lea rax, [r9 + 7]
cmp r8, rax
jne 0x14004ce66
lea ecx, [rsi - 0x60]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea edx, [r11 + rcx]
sub dl, 0x60
inc r9
mov qword [rsp + 0x20], rdx
dec rsi
mov r14, rdx
inc rsi
jmp 0x14004c973
lea rax, [r9 + 1]
cmp r8, rax
jne 0x14004d0ce
lea ecx, [rsi - 0x6c]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea edx, [r11 + rcx]
sub dl, 0xc
jmp 0x14004d37b
lea rax, [r9 + 3]
cmp r8, rax
jne 0x14004d101
lea edx, [rsi + 0x44]
movzx eax, dl
and al, r11b
mov ecx, reloc.WS2_32.dll_select
sub cl, al
add cl, cl
add dl, cl
add dl, r11b
mov qword [rsp + 0x20], rdx
dec rsi
mov r14, rdx
inc rsi
jmp 0x14004c973
lea rax, [r9 + 5]
cmp r8, rax
jne 0x14004d126
lea edx, [rsi - 0xc]
movzx eax, dl
and al, r11b
mov ecx, Ordinal_45
sub cl, al
add cl, cl
add dl, cl
add dl, r11b
jmp 0x14004d3ed
lea rax, [r9 + 4]
cmp r8, rax
jne 0x14004d153
lea edx, [rsi - 0x34]
mov ecx, gethostname
movzx eax, dl
and al, r11b
sub cl, al
lea r14d, [rcx + rcx]
add r14b, dl
add r14b, r11b
mov qword [rsp + 0x20], r14
jmp 0x14004d3f8
lea rax, [r9 + 2]
cmp r8, rax
jne 0x14004ce1e
lea ecx, [rsi + 0x7c]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea edx, [r11 + rcx]
sub dl, 0x64
mov qword [rsp + 0x20], rdx
jmp 0x14004d462
lea rax, [r9 + 1]
cmp r8, rax
jne 0x14004d1a1
lea ecx, [rsi + 0x70]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r14d, [r11 + rcx]
sub r14b, 0x10
jmp 0x14004d4ca
inc rax
cmp r8, rax
jne 0x14004d1c5
lea edx, [rsi - 0x30]
movzx eax, dl
and al, r11b
mov ecx, Ordinal_41
sub cl, al
add cl, cl
add dl, cl
add dl, r11b
jmp 0x14004d3ed
lea rax, [r9 + 2]
cmp r8, rax
jne 0x14004d1f8
lea ecx, [rsi + 0x80]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea edx, [r11 + rcx]
add dl, 0x80
mov qword [rsp + 0x20], rdx
dec rsi
mov r14, rdx
inc rsi
jmp 0x14004c973
lea rax, [r9 + 5]
cmp r8, rax
jne 0x14004d22b
lea ecx, [rsi + 0x58]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea edx, [r11 + rcx]
sub dl, 0x68
inc r9
mov qword [rsp + 0x20], rdx
dec rsi
mov r14, rdx
inc rsi
jmp 0x14004c973
lea rax, [r9 + 8]
cmp r8, rax
jne 0x14004cde2
lea ecx, [rsi + 0x30]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea edx, [r11 + rcx]
sub dl, 0x50
jmp 0x14004d37b
movzx r10d, sil
lea edx, [r10 - 0x20]
movzx eax, dl
and al, r11b
add al, al
movzx ecx, r11b
sub cl, al
sub dl, 0x20
add dl, cl
add dl, r11b
jmp 0x14004d3ce
lea ecx, [rsi - 0x48]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea edx, [rcx - 8]
jmp 0x14004d436
movabs rdx, 0xce1321d9be54ae9c
add rdx, rsi
movzx eax, dl
and al, r11b
add al, al
movzx ecx, r10b
sub cl, al
sub dl, 0x44
add dl, cl
mov qword [rsp + 0x20], rdx
jmp 0x14004d462
movabs rdx, 0xfa49730c3e6bc7c4
add rdx, rsi
movzx eax, dl
and al, r11b
add al, al
movzx ecx, r10b
sub cl, al
sub dl, 0x5c
add dl, cl
jmp 0x14004d436
movabs rcx, 0x267fc43ebe82e0ec
add rcx, rsi
movzx eax, cl
and al, r11b
add al, al
sub r10b, al
lea r14d, [rcx + r10]
sub r14b, 0x74
mov qword [rsp + 0x20], r14
jmp 0x14004d3f8
movabs rdx, 0xab22b7d63ec82c64
add rdx, rsi
movzx eax, dl
and al, r11b
mov ecx, Ordinal_35
sub cl, al
add cl, cl
add cl, r10b
add dl, cl
mov qword [rsp + 0x20], rdx
dec rsi
mov r14, rdx
inc rsi
jmp 0x14004c973
movabs rdx, 0x38f5a3b3ef65eb4
add rdx, rsi
movzx eax, dl
and al, r11b
mov ecx, 0xa
sub cl, al
add cl, cl
add cl, r10b
add dl, cl
jmp 0x14004d37b
movabs rcx, 0x5bfbfca03f249104
add rcx, rsi
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea edx, [r10 + rcx]
sub dl, 0x1c
movzx r11d, r10b
lea ecx, [rsi + 0x74]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
sub cl, 0x2c
add cl, r11b
mov byte [rsp + rsi + 0x60], cl
inc r9
mov qword [rsp + 0x20], rdx
dec rsi
mov r14, rdx
inc rsi
jmp 0x14004c973
movabs rcx, 0xe09ef037bf69dc7c
add rcx, rsi
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea edx, [r10 + rcx]
sub dl, 0x64
movzx r11d, r10b
movzx r10d, sil
add r10b, 0x4c
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
sub r10b, 0x14
add r10b, r11b
add r10b, dl
mov byte [rsp + rsi + 0x60], r10b
mov qword [rsp + 0x20], rdx
add r8, r9
mov r14, rdx
movzx eax, r14b
mov rcx, 0xffffffffffffffff
sub rcx, rax
add rsi, rcx
inc rsi
jmp 0x14004c973
movabs rcx, 0x6541e3cf3faf27f4
add rcx, rsi
movzx eax, cl
and al, r11b
mov edx, Ordinal_45
sub dl, al
add dl, dl
add dl, cl
add dl, r10b
movzx r11d, r10b
mov qword [rsp + 0x20], rdx
lea edx, [rsi + 0x24]
movzx eax, dl
and al, r11b
mov ecx, 2
sub cl, al
add cl, cl
add cl, dl
add cl, r11b
movzx eax, cl
mov byte [rsp + rsi + 0x60], al
inc r9
add rax, r9
sub rsi, rax
lea edx, [rsi - 0x70]
movzx eax, dl
and al, r11b
mov ecx, 8
sub cl, al
add cl, cl
add cl, dl
add cl, r11b
mov byte [rsp + rsi + 0x60], cl
inc r8
mov rax, 0xffffffffffffffff
sub rax, r8
add rsi, rax
mov r14, qword [rsp + 0x20]
movzx eax, byte [rsp + rsi + 0x60]
add rax, r9
add rsi, rax
inc rsi
jmp 0x14004c973
movabs rcx, 0xbdae86343fdd5a44
add rcx, rsi
movzx eax, cl
and al, r11b
mov edx, reloc.WS2_32.dll_select
sub dl, al
add dl, dl
add dl, cl
add dl, r10b
movzx r14d, dl
mov qword [rsp + 0x20], r14
movzx eax, byte [rsp + rsi + 0x60]
add rax, r9
add rsi, rax
inc rsi
jmp 0x14004c973
add sil, 0x1c
movzx eax, sil
and al, r11b
mov ecx, reloc.WLDAP32.dll_Ordinal_30
sub cl, al
lea r14d, [rcx + rcx]
add r14b, sil
add r14b, r11b
mov qword [rsp + 0x20], r14
jmp 0x14004c970
add sil, 0x44
movzx eax, sil
and al, r11b
mov ecx, reloc.WS2_32.dll_select
sub cl, al
lea r14d, [rcx + rcx]
add r14b, sil
add r14b, r11b
mov qword [rsp + 0x20], r14
jmp 0x14004c961
lea rcx, [rbp + 0x17d8bf0]
jmp 0x14004d545
lea rcx, [rbp + 0xb1ff5c]
jmp 0x14004d545
lea rcx, [rsp + 0x60]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rsi, rax
movzx edx, bl
lea rcx, [rbp - 0x30]
call fcn.1400029d0
nop
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rsi + r8], 0
jne 0x14004d562
mov rdx, rsi
lea rcx, [rbp - 0x30]
call fcn.140004440
nop
mov word [rbp - 0x70], 0x611c
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x6e], xmm0
movups xmmword [rbp - 0x5e], xmm0
mov byte [rbp - 0x4e], al
nop
mov rax, qword [0x14023d108]
mov r10, qword [0x14023d100]
nop
mov r14, r15
cmp r14, 0x23
jae 0x14004e0d4
movzx r11d, byte [rbp + r14 - 0x70]
mov esi, r11d
cmp rax, r14
ja 0x14004e0cb
lea rdx, [r10 + 1]
cmp rax, rdx
jae 0x14004d5eb
movabs rdx, 0x1b523888fa3d09f0
add rdx, r14
mov rcx, rdx
and rcx, rsi
imul r13, rcx, 0xfffffffffffffffe
add r13, rdx
add r13, rsi
add r13b, 0x70
jmp 0x14004d618
je 0x14004e04a
lea rcx, [r10 + 3]
cmp rax, rcx
je 0x14004dfb7
lea rcx, [rdx + 1]
cmp rax, rcx
je 0x14004df85
lea rcx, [r10 + 4]
cmp rax, rcx
je 0x14004df64
movzx r9d, r14b
nop dword [rax]
cmp r10, r14
ja 0x14004e0c2
lea rcx, [r10 + 0x42]
cmp rax, rcx
jae 0x14004d650
lea r8d, [r9 - 0x50]
movzx ecx, r8b
and cl, r11b
mov edx, Ordinal_26
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r8b
add r13b, r11b
jmp 0x14004d690
lea rcx, [r10 + 1]
cmp rax, rcx
je 0x14004df1b
inc rcx
cmp rax, rcx
je 0x14004def5
lea rcx, [r10 + 5]
cmp rax, rcx
je 0x14004ded8
lea rcx, [r10 + 4]
cmp rax, rcx
je 0x14004deb7
lea rcx, [r10 + 2]
cmp rax, rcx
je 0x14004de87
lea rcx, [r10 + rax]
cmp rcx, r14
jbe 0x14004dbd9
nop dword [rax]
lea rcx, [r10 + 0x400]
cmp rax, rcx
je 0x14004dbcb
lea rcx, [r10 + 1]
cmp rax, rcx
je 0x14004dbad
lea rcx, [r10 + 0x200]
cmp rax, rcx
je 0x14004db8a
lea rcx, [r10 + 0x5a]
cmp rax, rcx
je 0x14004dc8d
lea rcx, [r10 + 6]
cmp rax, rcx
je 0x14004db6d
lea rcx, [r10 + 0x40]
cmp rax, rcx
je 0x14004db50
lea rcx, [r10 + 0x1000]
cmp rax, rcx
je 0x14004db2f
lea rcx, [r10 + 0x20]
cmp rax, rcx
je 0x14004db0e
lea rcx, [r10 + 0x3e8]
cmp rax, rcx
je 0x14004dade
lea rcx, [r10 + 0x2a]
cmp rax, rcx
je 0x14004d6a0
lea rax, [r10 + 0x80]
lea r10, [rax + 8]
lea rcx, [r10 + 0x41]
cmp rax, rcx
jb 0x14004e0a1
lea rcx, [r10 + 0x42]
cmp rax, rcx
jb 0x14004e080
lea rcx, [r10 + 0x61]
cmp rax, rcx
jb 0x14004d896
lea rcx, [r10 + 3]
cmp rax, rcx
jb 0x14004d87b
lea rcx, [r10 + 0x10]
cmp rax, rcx
jb 0x14004d860
lea rcx, [r10 + 0x200]
cmp rax, rcx
jb 0x14004da95
lea rcx, [r10 + 9]
cmp rax, rcx
jb 0x14004da4d
lea rcx, [r10 + 0x64]
cmp rax, rcx
jb 0x14004da06
lea rcx, [r10 + 0x7a]
cmp rax, rcx
jb 0x14004d9dd
lea rcx, [r10 + 4]
cmp rax, rcx
jb 0x14004d6a0
lea rax, [r10 + 0x1000]
lea r10, [rax + 0x1000]
lea rcx, [r10 + 0x20]
cmp rax, rcx
ja 0x14004d9b1
lea rcx, [r10 + 0x3e8]
cmp rax, rcx
ja 0x14004d990
lea rcx, [r10 + 0x2a]
cmp rax, rcx
ja 0x14004d96f
lea rcx, [r10 + 8]
cmp rax, rcx
ja 0x14004d94e
lea rcx, [r10 + 0x42]
cmp rax, rcx
ja 0x14004d939
lea rcx, [r10 + 5]
cmp rax, rcx
ja 0x14004d91e
lea rcx, [r10 + 0x28]
cmp rax, rcx
ja 0x14004d8fb
lea rcx, [r10 + 0x400]
cmp rax, rcx
ja 0x14004d8d5
lea rcx, [r10 + 1]
cmp rax, rcx
ja 0x14004d8b7
lea rcx, [r10 + 0x200]
cmp rax, rcx
ja 0x14004d6a0
lea rax, [r10 + 9]
lea r10, [rax + 0x5a]
jmp 0x14004d6a0
lea edx, [r9 + 0x50]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r13d, [r11 + rdx]
sub r13b, 0x30
jmp 0x14004d690
lea edx, [r9 + 0x70]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r13d, [r11 + rdx]
sub r13b, 0x10
jmp 0x14004d620
sub r9b, 0x70
movzx ecx, r9b
and cl, r11b
mov edx, 8
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r9b
add r13b, r11b
jmp 0x14004d5b6
lea edx, [r9 + 0x80]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r13d, [r11 + rdx]
add r13b, 0x80
jmp 0x14004df37
sub r9b, 0x60
movzx ecx, r9b
and cl, r11b
add cl, cl
sub r9b, cl
lea r13d, [r11 + r9]
sub r13b, 0x60
inc r10
dec r14
inc r14
jmp 0x14004d5a3
sub r9b, 0x40
movzx ecx, r9b
and cl, r11b
add cl, cl
sub r9b, cl
lea r13d, [r11 + r9]
sub r13b, 0x40
dec r14
inc r14
jmp 0x14004d5a3
lea edx, [r9 - 0x20]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r13d, [r11 + rdx]
sub r13b, 0x20
jmp 0x14004de45
movzx ecx, r9b
and cl, r11b
add cl, cl
sub r9b, cl
lea r13d, [r11 + r9]
jmp 0x14004df9b
add r9b, 0x20
movzx ecx, r9b
and cl, r11b
mov edx, reloc.WS2_32.dll_recv
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r9b
add r13b, r11b
jmp 0x14004df9e
lea r8d, [r9 + 0x40]
movzx ecx, r8b
and cl, r11b
mov edx, reloc.WLDAP32.dll_Ordinal_32
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r8b
add r13b, r11b
jmp 0x14004dfdd
add r9b, 0x60
movzx ecx, r9b
and cl, r11b
mov edx, Ordinal_50
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r9b
add r13b, r11b
jmp 0x14004e007
add r9b, 0x80
movzx ecx, r9b
and cl, r11b
add cl, cl
sub r9b, cl
lea r13d, [r11 + r9]
add r13b, 0x80
movzx ecx, byte [rbp + r14 - 0x70]
add rcx, r10
add r14, rcx
inc r14
jmp 0x14004d5a3
sub r9b, 0x30
movzx ecx, r9b
and cl, r11b
mov edx, Ordinal_41
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r9b
add r13b, r11b
mov byte [rbp + r14 - 0x70], r13b
inc r14
jmp 0x14004d5a3
lea r8d, [r9 - 0x10]
movzx ecx, r8b
and cl, r11b
mov edx, gethostname
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r8b
add r13b, r11b
cmp r10, 8
jb 0x14004d9f9
lea edx, [r9 - 0x60]
movzx ecx, dl
and cl, r11b
mov r8d, reloc.WS2_32.dll_recv
sub r8b, cl
add r8b, r8b
add r8b, dl
add r8b, r11b
lea r13d, [r8 + r8]
jmp 0x14004df37
lea edx, [r9 + 0x10]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r13d, [r11 + rdx]
sub r13b, 0x70
cmp rax, 3
jae 0x14004de24
lea rcx, [r10 + 0x400]
cmp rax, rcx
jbe 0x14004dd73
lea edx, [r9 - 0x20]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r13d, [r11 + rdx]
sub r13b, 0x20
jmp 0x14004da22
lea edx, [r9 + 0x30]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r13d, [r11 + rdx]
sub r13b, 0x50
lea rcx, [r10 + rax]
cmp rcx, 0x5a
je 0x14004de69
lea rcx, [r10 + 0x64]
cmp rax, rcx
jbe 0x14004dcc3
lea edx, [r9 + 0x30]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r13d, [r11 + rdx]
sub r13b, 0x50
jmp 0x14004da63
add r9b, 0x20
movzx ecx, r9b
and cl, r11b
mov edx, reloc.WS2_32.dll_recv
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r9b
add r13b, r11b
movzx ecx, byte [rbp + r14 - 0x70]
add rcx, r10
add r14, rcx
inc r14
jmp 0x14004d5a3
add r9b, 0x40
movzx ecx, r9b
and cl, r11b
mov edx, reloc.WLDAP32.dll_Ordinal_32
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r9b
add r13b, r11b
jmp 0x14004e007
lea r8d, [r9 + 0x60]
movzx ecx, r8b
and cl, r11b
mov edx, Ordinal_50
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r8b
add r13b, r11b
jmp 0x14004dfdd
add r9b, 0x80
movzx ecx, r9b
and cl, r11b
add cl, cl
sub r9b, cl
lea r13d, [r11 + r9]
add r13b, 0x80
jmp 0x14004df9e
sub r9b, 0x60
movzx ecx, r9b
and cl, r11b
add cl, cl
sub r9b, cl
lea r13d, [r11 + r9]
sub r13b, 0x60
jmp 0x14004df9b
sub r9b, 0x20
movzx ecx, r9b
and cl, r11b
add cl, cl
sub r9b, cl
lea r13d, [r11 + r9]
sub r13b, 0x20
dec r14
inc r14
jmp 0x14004d5a3
movzx ecx, r9b
and cl, r11b
add cl, cl
sub r9b, cl
lea r13d, [r11 + r9]
inc r10
dec r14
inc r14
jmp 0x14004d5a3
lea r8d, [r9 + 0x20]
mov edx, reloc.WS2_32.dll_recv
jmp 0x14004df24
lea rcx, [r10 + 2]
cmp rax, rcx
jae 0x14004dc03
lea r8d, [r9 - 0x10]
movzx ecx, r8b
and cl, r11b
mov edx, gethostname
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r8b
add r13b, r11b
jmp 0x14004daab
lea rdx, [r10 + 1]
cmp rax, rdx
jne 0x14004dc3c
add r9b, 0x60
movzx ecx, r9b
and cl, r11b
mov edx, Ordinal_50
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r9b
add r13b, r11b
movzx ecx, byte [rbp + r14 - 0x70]
add rcx, r10
add r14, rcx
inc r14
jmp 0x14004d5a3
lea rcx, [r10 + 3]
cmp rax, rcx
jne 0x14004dc66
lea r8d, [r9 + 0x20]
movzx ecx, r8b
and cl, r11b
mov edx, reloc.WS2_32.dll_recv
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r8b
add r13b, r11b
jmp 0x14004dfdd
lea rcx, [rdx + 1]
cmp rax, rcx
jne 0x14004dc84
movzx ecx, r9b
and cl, r11b
add cl, cl
sub r9b, cl
lea r13d, [r11 + r9]
jmp 0x14004df9e
lea rcx, [r10 + 5]
cmp rax, rcx
jne 0x14004dca8
lea edx, [r9 - 0x40]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r13d, [r11 + rdx]
sub r13b, 0x40
jmp 0x14004de45
lea rcx, [r10 + 9]
cmp rax, rcx
jne 0x14004daab
lea r8d, [r9 + 0x60]
mov edx, Ordinal_50
jmp 0x14004df24
lea rcx, [r10 + 1]
cmp rax, rcx
jne 0x14004dce7
lea edx, [r9 + 0x10]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r13d, [r11 + rdx]
sub r13b, 0x70
jmp 0x14004df37
inc rcx
cmp rax, rcx
jne 0x14004dd16
sub r9b, 0x30
movzx ecx, r9b
and cl, r11b
mov edx, Ordinal_41
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r9b
add r13b, r11b
dec r14
inc r14
jmp 0x14004d5a3
lea rcx, [r10 + 3]
cmp rax, rcx
jne 0x14004dd3a
lea r8d, [r9 - 0x50]
movzx ecx, r8b
and cl, r11b
mov edx, Ordinal_26
sub dl, cl
lea r13d, [rdx + rdx]
jmp 0x14004de3f
lea rcx, [r10 + 8]
cmp rax, rcx
jne 0x14004da63
add r9b, 0x10
movzx ecx, r9b
and cl, r11b
add cl, cl
sub r9b, cl
lea r13d, [r11 + r9]
sub r13b, 0x70
movzx ecx, byte [rbp + r14 - 0x70]
add rcx, r10
add r14, rcx
inc r14
jmp 0x14004d5a3
lea rcx, [r10 + 1]
cmp rax, rcx
jne 0x14004dda8
sub r9b, 0x40
movzx ecx, r9b
and cl, r11b
add cl, cl
sub r9b, cl
lea r13d, [r11 + r9]
sub r13b, 0x40
movzx ecx, byte [rbp + r14 - 0x70]
add rcx, r10
add r14, rcx
inc r14
jmp 0x14004d5a3
lea rcx, [r10 + 3]
cmp rax, rcx
jne 0x14004ddd2
add r9b, 0x60
movzx ecx, r9b
and cl, r11b
mov edx, Ordinal_50
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r9b
add r13b, r11b
jmp 0x14004df9e
lea rcx, [r10 + 5]
cmp rax, rcx
jne 0x14004ddfc
add r9b, 0x40
movzx ecx, r9b
and cl, r11b
mov edx, reloc.WLDAP32.dll_Ordinal_32
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r9b
add r13b, r11b
jmp 0x14004df9b
lea rcx, [r10 + 7]
cmp rax, rcx
jne 0x14004da22
lea edx, [r9 - 0x40]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r13d, [r11 + rdx]
sub r13b, 0x40
jmp 0x14004df37
lea r8d, [r9 + 0x80]
movzx ecx, r8b
and cl, r11b
add cl, cl
movzx r13d, r11b
sub r13b, cl
add r13b, 0x80
add r13b, r8b
add r13b, r11b
add r9b, 0x70
movzx ecx, r11b
and cl, r9b
add cl, cl
sub r11b, cl
sub r11b, 0x10
add r11b, r13b
add r11b, r9b
mov byte [rbp + r14 - 0x70], r11b
jmp 0x14004df9b
lea r8d, [r9 + 0x60]
movzx ecx, r8b
and cl, r11b
mov edx, Ordinal_50
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r8b
jmp 0x14004dfdd
sub r9b, 0x70
movzx ecx, r9b
and cl, r11b
mov edx, 8
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r9b
add r13b, r11b
movzx ecx, byte [rbp + r14 - 0x70]
add rcx, r10
add r14, rcx
inc r14
jmp 0x14004d5a3
lea r8d, [r9 - 0x30]
movzx ecx, r8b
and cl, r11b
mov edx, Ordinal_41
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r8b
add r13b, r11b
jmp 0x14004dfdd
add r9b, 0x10
movzx ecx, r9b
and cl, r11b
add cl, cl
sub r9b, cl
lea r13d, [r11 + r9]
sub r13b, 0x70
jmp 0x14004df9b
add r9b, 0x70
movzx ecx, r9b
and cl, r11b
add cl, cl
sub r9b, cl
lea r13d, [r11 + r9]
sub r13b, 0x10
inc r10
dec r14
inc r14
jmp 0x14004d5a3
lea r8d, [r9 - 0x70]
mov edx, 8
movzx ecx, r8b
and cl, r11b
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r8b
add r13b, r11b
sub r9b, 0x70
movzx ecx, r11b
and cl, r9b
mov edx, 8
sub dl, cl
add dl, dl
add dl, r11b
add dl, r9b
mov byte [rbp + r14 - 0x70], dl
inc r10
dec r14
inc r14
jmp 0x14004d5a3
lea edx, [r14 + 0x10]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r13d, [r11 + rdx]
sub r13b, 0x70
dec r14
inc r14
jmp 0x14004d5a3
lea edx, [r14 + 0x50]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r13d, [r11 + rdx]
sub r13b, 0x30
add rax, r10
movzx ecx, r13b
mov rdx, 0xffffffffffffffff
sub rdx, rcx
add r14, rdx
inc r14
jmp 0x14004d5a3
movabs rdx, 0xbf3f8bbed7ab4590
add rdx, r14
and sil, dl
mov ecx, 8
sub cl, sil
lea r13d, [rcx + rcx]
add r13b, r11b
add r13b, dl
movzx r9d, r14b
add r9b, 0x50
movzx ecx, r11b
and cl, r9b
add cl, cl
movzx edx, r11b
sub dl, cl
sub dl, 0x30
add dl, r9b
movzx ecx, dl
mov byte [rbp + r14 - 0x70], cl
inc r10
add rcx, r10
sub r14, rcx
lea r8d, [r14 + 0x40]
movzx ecx, r8b
and cl, r11b
mov edx, reloc.WLDAP32.dll_Ordinal_32
sub dl, cl
add dl, dl
add dl, r8b
add dl, r11b
mov byte [rbp + r14 - 0x70], dl
inc rax
mov rcx, 0xffffffffffffffff
sub rcx, rax
add r14, rcx
movzx ecx, byte [rbp + r14 - 0x70]
add rcx, r10
add r14, rcx
inc r14
jmp 0x14004d5a3
movabs rdx, 0x51f6a99aeeb71dd0
add rdx, r14
and sil, dl
mov ecx, Ordinal_41
sub cl, sil
lea r13d, [rcx + rcx]
add r13b, r11b
add r13b, dl
movzx ecx, byte [rbp + r14 - 0x70]
add rcx, r10
add r14, rcx
inc r14
jmp 0x14004d5a3
sub r9b, 0x50
movzx ecx, r9b
and cl, r11b
mov edx, Ordinal_26
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r9b
add r13b, r11b
jmp 0x14004d5a0
sub r9b, 0x30
movzx eax, r9b
and al, r11b
mov ecx, Ordinal_41
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r9b
add r13b, r11b
jmp 0x14004d590
lea rdx, [rbp + 0x142acd0]
jmp 0x14004e0d8
lea rdx, [rbp + 0x17fb6c0]
jmp 0x14004e0d8
lea rdx, [rbp - 0x70]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rdx + r8], 0
jne 0x14004e0e0
lea rcx, [rbp - 0x30]
call fcn.1400030f0
mov r12, rax
mov dword [rsp + 0x38], 0xa8a3cabc
mov dword [rsp + 0x3c], 0x35534858
mov dword [rsp + 0x40], 0x475e5657
mov byte [rsp + 0x44], 0xec
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x45], xmm0
mov dword [rsp + 0x55], eax
mov word [rsp + 0x59], ax
nop word [rax + rax]
mov r8, qword [0x14023d108]
mov r9, qword [0x14023d100]
nop
mov r14, r15
cmp r14, 0x23
jae 0x14004ec29
movzx r11d, byte [rsp + r14 + 0x38]
mov esi, r11d
movzx r10d, r14b
nop word [rax + rax]
movzx r15d, r10b
cmp r8, r14
ja 0x14004ec20
lea rax, [r9 + 1]
cmp r8, rax
jae 0x14004e19d
movabs rcx, 0x9bb7cf9819db287c
add rcx, r14
mov rax, rcx
and rax, rsi
imul rdx, rax, 0xfffffffffffffffe
add rdx, rcx
add rdx, rsi
sub dl, 0x64
mov qword [rsp + 0x28], rdx
jmp 0x14004e1b0
je 0x14004eb96
lea rax, [r9 + 3]
cmp r8, rax
je 0x14004eb6c
movzx r10d, r14b
cmp r9, r14
ja 0x14004ec17
lea rax, [r9 + 0xa]
cmp r8, rax
jae 0x14004e1e1
lea ecx, [r10 + 0x2c]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
sub cl, 0x34
add cl, r11b
mov qword [rsp + 0x28], rcx
jmp 0x14004e220
lea rax, [r9 + 1]
cmp r8, rax
je 0x14004eb23
lea rax, [r9 + 3]
cmp r8, rax
je 0x14004eaf9
lea rax, [r9 + 5]
cmp r8, rax
je 0x14004eabf
lea rax, [r9 + 7]
cmp r8, rax
je 0x14004ea38
nop word [rax + rax]
lea rax, [r9 + r8]
cmp rax, r14
jbe 0x14004e75e
nop dword [rax]
lea rax, [r9 + 0x1000]
cmp r8, rax
je 0x14004e750
lea rax, [r9 + 4]
cmp r8, rax
je 0x14004e723
lea rax, [r9 + 0x40]
cmp r8, rax
je 0x14004e6f9
lea rax, [r9 + 0x7a]
cmp r8, rax
je 0x14004e7fd
lea rax, [r9 + 0x64]
cmp r8, rax
je 0x14004e6dd
lea rax, [r9 + 0x5a]
cmp r8, rax
je 0x14004e6b8
lea rax, [r9 + 9]
cmp r8, rax
je 0x14004e69b
lea rax, [r9 + 0x200]
cmp r8, rax
je 0x14004e678
lea rax, [r9 + 0x10]
cmp r8, rax
je 0x14004e65c
lea rax, [r9 + 0x400]
cmp r8, rax
je 0x14004e230
mov r8, rax
lea r9, [rax + 3]
lea rax, [r9 + 0x28]
cmp r8, rax
jb 0x14004ebf3
lea rax, [r9 + 0x61]
cmp r8, rax
jb 0x14004ebcc
lea rax, [r9 + 5]
cmp r8, rax
jb 0x14004e428
lea rax, [r9 + 0x42]
cmp r8, rax
jb 0x14004e406
lea rax, [r9 + 0x41]
cmp r8, rax
jb 0x14004e3e8
lea rax, [r9 + 0x80]
cmp r8, rax
jb 0x14004e63b
lea rax, [r9 + 0x2a]
cmp r8, rax
jb 0x14004e5e5
lea rax, [r9 + 0xa]
cmp r8, rax
jb 0x14004e59e
lea rax, [r9 + 0x3e8]
cmp r8, rax
jb 0x14004e575
lea rax, [r9 + 0x20]
cmp r8, rax
jb 0x14004e230
mov r8, rax
lea r9, [rax + 0x1000]
lea rax, [r9 + 0x1000]
cmp r8, rax
ja 0x14004e559
lea rax, [r9 + 0x40]
cmp r8, rax
ja 0x14004e536
lea rax, [r9 + 0x7a]
cmp r8, rax
ja 0x14004e519
lea rax, [r9 + 6]
cmp r8, rax
ja 0x14004e4f4
lea rax, [r9 + 0x64]
cmp r8, rax
ja 0x14004e4d8
lea rax, [r9 + 0x5a]
cmp r8, rax
ja 0x14004e4bd
lea rax, [r9 + 0x200]
cmp r8, rax
ja 0x14004e496
lea rax, [r9 + 1]
cmp r8, rax
ja 0x14004e469
lea rax, [r9 + 0x10]
cmp r8, rax
ja 0x14004e44a
lea rax, [r9 + 0x400]
cmp r8, rax
ja 0x14004e230
lea r8, [r9 + 3]
lea r9, [r8 + 0x28]
jmp 0x14004e230
lea ecx, [r10 + 0x54]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
sub cl, 0x4c
add cl, r11b
mov qword [rsp + 0x28], rcx
jmp 0x14004e220
lea edx, [r10 + 0x5c]
movzx eax, dl
and al, r11b
mov ecx, 0x3e
sub cl, al
add cl, cl
add cl, dl
add cl, r11b
mov qword [rsp + 0x28], rcx
jmp 0x14004e1b4
lea edx, [r10 + 0x64]
movzx eax, dl
and al, r11b
mov ecx, Ordinal_35
sub cl, al
add cl, cl
add cl, dl
add cl, r11b
mov qword [rsp + 0x28], rcx
jmp 0x14004e160
add r10b, 0x60
movzx eax, r11b
and al, r10b
mov ecx, Ordinal_50
sub cl, al
add cl, cl
add cl, r11b
add cl, r10b
jmp 0x14004eb3d
add r10b, 0x68
movzx eax, r11b
and al, r10b
mov ecx, reloc.WS2_32.dll_sendto
sub cl, al
add cl, cl
add cl, r11b
add cl, r10b
inc r9
mov qword [rsp + 0x28], rcx
dec r14
inc r14
jmp 0x14004e143
add r10b, 0x70
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea ecx, [r10 + r11]
sub cl, 0x10
mov qword [rsp + 0x28], rcx
dec r14
inc r14
jmp 0x14004e143
add r10b, 0x78
movzx eax, r11b
and al, r10b
add al, al
movzx ecx, r11b
sub cl, al
sub cl, 0x48
jmp 0x14004e9fe
add r10b, 0x80
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea ecx, [r10 + r11]
add cl, 0x80
jmp 0x14004ead6
sub r10b, 0x78
movzx eax, r11b
and al, r10b
mov ecx, 0x24
sub cl, al
lea edx, [rcx + rcx]
add dl, r11b
add dl, r10b
mov qword [rsp + 0x28], rdx
jmp 0x14004eae1
lea edx, [r10 - 0x70]
movzx eax, r11b
and al, dl
mov ecx, 8
sub cl, al
add cl, cl
add cl, r11b
add cl, dl
jmp 0x14004ea50
sub r10b, 0x68
movzx eax, r11b
and al, r10b
add al, al
movzx ecx, r11b
sub cl, al
sub cl, 0x28
add cl, r10b
mov qword [rsp + 0x28], rcx
jmp 0x14004ea80
sub r10b, 0x60
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea ecx, [r10 + r11]
sub cl, 0x60
jmp 0x14004ebb3
add r10b, 0x34
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea edx, [r11 + r10]
sub dl, 0x6c
mov qword [rsp + 0x28], rdx
mov byte [rsp + r14 + 0x38], dl
inc r14
jmp 0x14004e143
lea edx, [r10 + 0x3c]
movzx eax, dl
and al, r11b
mov ecx, reloc.WLDAP32.dll_Ordinal_46
sub cl, al
add cl, cl
add cl, dl
add cl, r11b
movzx edx, cl
mov qword [rsp + 0x28], rdx
cmp r9, 0x2a
jb 0x14004e591
add r10b, 0x68
movzx eax, r11b
and al, r10b
mov ecx, reloc.WS2_32.dll_sendto
sub cl, al
add cl, cl
add cl, r11b
add cl, r10b
add cl, cl
jmp 0x14004eb3d
lea edx, [r10 + 0x44]
movzx eax, dl
and al, r11b
mov ecx, reloc.WS2_32.dll_select
sub cl, al
add cl, cl
add cl, dl
add cl, r11b
movzx edx, cl
mov qword [rsp + 0x28], rdx
cmp r8, 9
jae 0x14004e9e8
lea rax, [r9 + 0x200]
cmp r8, rax
jbe 0x14004e91e
lea edx, [r10 - 0x48]
movzx eax, r11b
and al, dl
add al, al
movzx ecx, r11b
sub cl, al
sub dl, 8
add cl, dl
jmp 0x14004e5b6
lea ecx, [r10 + 0x4c]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
sub cl, 0x14
add cl, r11b
movzx edx, cl
mov qword [rsp + 0x28], rdx
jmp 0x14004e845
add r10b, 8
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea ecx, [r10 + r11]
sub cl, 0x38
jmp 0x14004ebb3
add r10b, 0x10
movzx eax, r11b
and al, r10b
add al, al
movzx ecx, r11b
sub cl, al
sub cl, 0x70
add cl, r10b
mov qword [rsp + 0x28], rcx
jmp 0x14004ea80
lea edx, [r10 + 0x18]
movzx eax, r11b
and al, dl
mov ecx, Ordinal_45
sub cl, al
add cl, cl
add cl, r11b
add cl, dl
jmp 0x14004ea50
add r10b, 0x20
movzx eax, r11b
and al, r10b
mov ecx, reloc.WS2_32.dll_recv
sub cl, al
lea edx, [rcx + rcx]
add dl, r11b
add dl, r10b
mov qword [rsp + 0x28], rdx
jmp 0x14004eae1
add r10b, 0x28
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea ecx, [r10 + r11]
sub cl, 0x18
jmp 0x14004ead6
add r10b, 0x38
movzx eax, r10b
and al, r11b
mov ecx, reloc.WLDAP32.dll_Ordinal_60
sub cl, al
add cl, cl
add cl, r10b
add cl, r11b
mov qword [rsp + 0x28], rcx
dec r14
inc r14
jmp 0x14004e143
add r10b, 0x40
movzx eax, r10b
and al, r11b
mov ecx, reloc.WLDAP32.dll_Ordinal_32
sub cl, al
add cl, cl
add cl, r10b
add cl, r11b
inc r9
mov qword [rsp + 0x28], rcx
dec r14
inc r14
jmp 0x14004e143
add r10b, 0x48
mov ecx, 4
jmp 0x14004eb2c
lea rax, [r9 + 0x200]
cmp r8, rax
jae 0x14004e78b
lea ecx, [r10 + 0x7c]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
sub cl, 0x64
add cl, r11b
movzx edx, cl
mov qword [rsp + 0x28], rdx
jmp 0x14004e845
lea rax, [r9 + 1]
cmp r8, rax
jne 0x14004e7b0
add r10b, 0x58
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea ecx, [r11 + r10]
sub cl, 0x68
jmp 0x14004ebb3
inc rax
cmp r8, rax
jne 0x14004e7c6
lea edx, [r10 + 0x48]
mov ecx, 4
jmp 0x14004ea41
lea rax, [r9 + 4]
cmp r8, rax
jne 0x14004e7f4
add r10b, 0x40
movzx eax, r10b
and al, r11b
mov ecx, reloc.WLDAP32.dll_Ordinal_32
sub cl, al
lea edx, [rcx + rcx]
add dl, r10b
add dl, r11b
mov qword [rsp + 0x28], rdx
jmp 0x14004eae1
lea rax, [r9 + 6]
cmp r8, rax
jne 0x14004e818
add r10b, 0x30
movzx eax, r11b
and al, r10b
add al, al
movzx ecx, r11b
sub cl, al
sub cl, 0x50
jmp 0x14004e9fe
lea rax, [r9 + 9]
cmp r8, rax
jne 0x14004e840
add r10b, 0x18
movzx eax, r11b
and al, r10b
mov ecx, Ordinal_45
sub cl, al
add cl, cl
add cl, r11b
add cl, r10b
jmp 0x14004eb3d
mov rdx, qword [rsp + 0x28]
lea rax, [r9 + r8]
cmp rax, 0x80
je 0x14004ea25
lea rax, [r9 + 0x2a]
cmp r8, rax
jbe 0x14004e87b
lea edx, [r10 - 0x74]
movzx eax, r11b
and al, dl
mov ecx, reloc.WLDAP32.dll_Ordinal_22
sub cl, al
add cl, cl
add cl, r11b
add cl, dl
jmp 0x14004e5fd
lea rax, [r9 + 1]
cmp r8, rax
jne 0x14004e8a3
sub r10b, 0x7c
movzx eax, r11b
and al, r10b
mov ecx, reloc.WLDAP32.dll_Ordinal_50
sub cl, al
add cl, cl
add cl, r11b
add cl, r10b
jmp 0x14004eb3d
lea rax, [r9 + 3]
cmp r8, rax
jne 0x14004e8d3
add r10b, 0x74
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea ecx, [r10 + r11]
sub cl, 0x2c
mov qword [rsp + 0x28], rcx
dec r14
inc r14
jmp 0x14004e143
lea rax, [r9 + 5]
cmp r8, rax
jne 0x14004e8fb
add r10b, 0x64
movzx eax, r10b
and al, r11b
mov ecx, Ordinal_35
sub cl, al
add cl, cl
add cl, r10b
add cl, r11b
jmp 0x14004ead6
lea rax, [r9 + 7]
cmp r8, rax
jne 0x14004e605
lea ecx, [r10 + 0x54]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
sub cl, 0x4c
jmp 0x14004ea4d
lea rax, [r9 + 1]
cmp r8, rax
jne 0x14004e946
sub r10b, 0x50
movzx eax, r11b
and al, r10b
mov ecx, Ordinal_26
sub cl, al
add cl, cl
add cl, r11b
add cl, r10b
jmp 0x14004ebb3
inc rax
cmp r8, rax
jne 0x14004e96a
lea edx, [r10 - 0x60]
movzx eax, r11b
and al, dl
add al, al
movzx ecx, r11b
sub cl, al
sub cl, 0x60
add cl, dl
jmp 0x14004ea50
lea rax, [r9 + 3]
cmp r8, rax
jne 0x14004e992
sub r10b, 0x70
movzx eax, r11b
and al, r10b
mov ecx, 8
sub cl, al
add cl, cl
add cl, r11b
add cl, r10b
jmp 0x14004ead6
lea rax, [r9 + 6]
cmp r8, rax
jne 0x14004e9b4
sub r10b, 0x78
movzx eax, r11b
and al, r10b
mov ecx, 0x24
sub cl, al
add cl, cl
add cl, r11b
jmp 0x14004e9fe
lea rax, [r9 + 4]
cmp r8, rax
jne 0x14004e5be
add r10b, 0x80
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea ecx, [r10 + r11]
add cl, 0x80
mov qword [rsp + 0x28], rcx
dec r14
inc r14
jmp 0x14004e143
add r10b, 0x60
movzx eax, r11b
and al, r10b
movzx ecx, r11b
sub cl, al
add cl, 0x30
add cl, cl
add cl, r10b
sub r15b, 0x24
movzx eax, r11b
and al, r15b
add al, al
sub r11b, al
sub r11b, 4
add r11b, r15b
add r11b, cl
mov byte [rsp + r14 + 0x38], r11b
jmp 0x14004ead6
lea ecx, [r10 + 0x58]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
sub cl, 0x68
jmp 0x14004ea50
lea edx, [r10 - 0xc]
mov ecx, Ordinal_45
movzx eax, dl
and al, r11b
sub cl, al
add cl, cl
add cl, dl
add cl, r11b
mov qword [rsp + 0x28], rcx
sub r10b, 0x2c
movzx eax, r11b
and al, r10b
mov ecx, reloc.WLDAP32.dll_Ordinal_26
sub cl, al
add cl, cl
add cl, r11b
add cl, r10b
movzx eax, cl
mov byte [rsp + r14 + 0x38], al
inc r9
add rax, r9
sub r14, rax
lea ecx, [r14 + 0x50]
movzx eax, r11b
and al, cl
add al, al
sub r11b, al
sub r11b, 0x30
add r11b, cl
mov byte [rsp + r14 + 0x38], r11b
inc r8
mov rax, 0xffffffffffffffff
sub rax, r8
add r14, rax
movzx eax, byte [rsp + r14 + 0x38]
add rax, r9
add r14, rax
inc r14
jmp 0x14004e143
add r10b, 4
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea ecx, [r11 + r10]
sub cl, 0x1c
mov qword [rsp + 0x28], rcx
add r8, r9
mov rdx, rcx
movzx eax, dl
mov rcx, 0xffffffffffffffff
sub rcx, rax
add r14, rcx
inc r14
jmp 0x14004e143
add r10b, 0x14
movzx eax, r10b
and al, r11b
mov ecx, Ordinal_60
sub cl, al
add cl, cl
add cl, r10b
add cl, r11b
mov qword [rsp + 0x28], rcx
dec r14
inc r14
jmp 0x14004e143
add r10b, 0x24
mov ecx, 2
movzx eax, r10b
and al, r11b
sub cl, al
add cl, cl
add cl, r10b
add cl, r11b
sub r15b, 0x1c
movzx eax, r15b
and al, r11b
add al, al
sub r15b, al
sub r15b, 0x3c
add r15b, r11b
mov byte [rsp + r14 + 0x38], r15b
inc r9
mov qword [rsp + 0x28], rcx
dec r14
inc r14
jmp 0x14004e143
add r15b, 0x44
movzx eax, r15b
and al, r11b
mov ecx, reloc.WS2_32.dll_select
sub cl, al
add cl, cl
add cl, r15b
add cl, r11b
mov qword [rsp + 0x28], rcx
dec r14
inc r14
jmp 0x14004e143
movabs rax, 0xd3276ec84d917974
add rax, r14
and sil, al
add sil, sil
sub al, sil
lea ecx, [r11 + rax]
sub cl, 0x2c
mov qword [rsp + 0x28], rcx
movzx eax, byte [rsp + r14 + 0x38]
add rax, r9
add r14, rax
inc r14
jmp 0x14004e143
add r10b, 0x6c
movzx eax, r11b
and al, r10b
mov ecx, 6
sub cl, al
add cl, cl
add cl, r11b
add cl, r10b
mov qword [rsp + 0x28], rcx
xor r15d, r15d
jmp 0x14004e140
add r10b, 0x74
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea ecx, [r10 + r11]
sub cl, 0x2c
mov qword [rsp + 0x28], rcx
xor r15d, r15d
jmp 0x14004e130
lea rdx, [rbp + 0x17f3288]
jmp 0x14004ec2e
lea rdx, [rbp + 0x9a5b04]
jmp 0x14004ec2e
lea rdx, [rsp + 0x38]
xor r8d, r8d
lea rcx, [rbp - 8]
call fcn.140005690
mov r9, r12
mov r8d, recv
mov rdx, rax
lea rcx, [rbp - 8]
call fcn.140058170
nop
lea rcx, [rbp - 0x30]
call fcn.140002800
lea rcx, [rbp - 8]
cmp qword [rbp + 0x10], 0xf
cmova rcx, qword [rbp - 8]
xor edx, edx
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov r11, rax
mov eax, 0x5a4d
cmp word [r11], ax
jne 0x14004eda1
movsxd rcx, dword [r11 + 0x3c]
cmp dword [rcx + r11], 0x4550
jne 0x14004eda1
mov edx, dword [rcx + r11 + 0x88]
test edx, edx
je 0x14004eda1
mov esi, dword [rdx + r11 + 0x1c]
lea r14, [r11 + rsi]
mov r9d, dword [rdx + r11 + 0x20]
add r9, r11
mov r15d, dword [rdx + r11 + 0x24]
add r15, r11
xor r10d, r10d
test esi, esi
je 0x14004ed03
nop word [rax + rax]
mov r8d, dword [r9]
add r8, r11
mov rax, qword [rbp - 0x40]
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x14004ecf3
inc rax
test ecx, ecx
jne 0x14004ece0
test edx, edx
je 0x14004ed73
inc r10d
add r9, 4
cmp r10d, esi
jb 0x14004ecd0
lea rcx, [rbp - 8]
call fcn.140002800
mov r14, qword [rsp + 0x20]
xor r15d, r15d
lea rcx, [rbp + 0x18]
call fcn.140002800
mov eax, dword [rsp + 0x34]
inc eax
mov dword [rsp + 0x34], eax
mov rsi, qword [rbp - 0x78]
cmp eax, dword [rsi]
jb 0x14004c8c0
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rcx, qword [rbp + 0x38]
xor rcx, rsp
call fcn.140198db0
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
movsxd rax, r10d
movzx ecx, word [r15 + rax*2]
mov r15d, dword [r14 + rcx*4]
xor edx, edx
mov r8d, 0x8000
mov rcx, qword [rbp - 0x78]
cmp byte [rsp + 0x30], dl
jne 0x14004ed99
mov rax, qword [rbp - 0x38]
add r15, qword [rax + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x14004eda4
xor r15d, r15d
lea rcx, [rbp - 8]
call fcn.140002800
nop
lea rcx, [rbp + 0x18]
call fcn.140002800
mov rax, r15
jmp 0x14004ed46