Function at 0x18000ca54
Capabilities:
Create thread
Initialize winsock library

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x398
xor edx, edx
mov rsi, rcx
mov rcx, r9
mov ebx, edx
mov dword [rsp + 0x40], edx
mov dword [rsp + 0x94], edx
mov qword [rax - 0x2c8], rdx
mov dword [rax - 0x328], edx
mov rbp, rdx
mov qword [rsp + 0x100], r8
call fcn.180019414
mov qword [rsp + 0x130], rax
mov edi, dword [rsp + 0x3c0]
xor edx, edx
mov r9d, 1
mov r8, qword [rsp + 0x100]
mov dword [rsp + 0x44], edx
lea rcx, [r8 + 4]
mov r8d, dword [r8]
mov eax, edx
add edx, r9d
mov dword [rsp + rax*4 + 0x78], r8d
add r8, rcx
mov qword [rsp + rax*8 + 0xb0], rcx
mov dword [rsp + 0x44], edx
cmp edx, 6
jb 0x18000cac3
xor edx, edx
mov qword [rsp + 0x100], r8
cmp dword [rsp + 0x78], r9d
jbe 0x18000d563
mov rax, qword [rsp + 0xb0]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x50], rax
call fcn.18000b8d8
mov rcx, qword [rsp + 0x50]
lea r8, [rsp + 0xe8]
lea rdx, [rsp + 0xe4]
call fcn.18000bfc4
xor edx, edx
cmp rax, rdx
je 0x18000cb57
cmp dword [rsp + 0xe8], edx
jne 0x18000cb57
mov ecx, dword [rsp + 0xe4]
cmp ecx, edx
je 0x18000cb9a
cmp dword [rsp + 0x3e0], edx
je 0x18000cb95
cmp ecx, 8
je 0x18000cb9a
mov rax, qword [rsp + 0xb0]
mov r9d, 1
cmp qword [rsp + 0x50], rax
je 0x18000cab7
mov r8, qword [rsp + 0x50]
xor edx, edx
mov rcx, qword [0x180037ae8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x18000caaf
mov edi, dword [rsp + 0x3c0]
jmp 0x18000cab7
cmp ecx, 7
jne 0x18000cb57
mov rdx, qword [rsp + 0x130]
mov rcx, rax
call fcn.1800183ac
xor edx, edx
cmp eax, edx
je 0x18000cb57
mov rax, qword [rsp + 0xb0]
cmp qword [rsp + 0x50], rax
je 0x18000cbd3
mov r8, qword [rsp + 0x50]
mov rcx, qword [0x180037ae8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor edx, edx
mov eax, dword [rsp + 0x7c]
mov r9d, 1
cmp dword [rsp + 0x8c], r9d
jbe 0x18000cbfa
cmp dword [rsp + 0x80], r9d
ja 0x18000cbfa
cmp eax, r9d
jbe 0x18000d46b
cmp eax, r9d
jbe 0x18000cab7
cmp rbp, rdx
jne 0x18000cca0
mov rax, qword [rsi]
lea rdx, [rsp + 0x150]
mov r8d, r9d
mov rcx, rsi
call qword [rax + 0x60]
mov edi, dword [rsp + 0x160]
xor edx, edx
mov dword [rsp + 0x3c0], edi
lea r9d, [rdx + 1]
cmp edi, edx
je 0x18000cab7
mov rcx, qword [0x180037ae8]
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor edx, edx
mov rbp, rax
lea r9d, [rdx + 1]
cmp rax, rdx
je 0x18000cab7
mov rax, qword [rsi]
mov dword [rsp + 0x120], edx
mov dword [rsp + 0x124], edx
mov rdx, qword [rsp + 0x120]
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
call qword [rax + 0x28]
mov r11, qword [rsi]
xor r9d, r9d
mov r8d, edi
mov rdx, rbp
mov rcx, rsi
call qword [r11 + 0x18]
mov eax, dword [rsp + 0x7c]
xor edx, edx
lea r9d, [rdx + 1]
cmp edi, edx
je 0x18000cab7
mov rcx, qword [rsp + 0xb8]
lea edx, [rax - 1]
call fcn.180028dfc
mov edi, eax
xor edi, dword [0x180037cb0]
cmp edi, 0x35cf7503
je 0x18000d27a
mov edx, 0
lea r9d, [rdx + 1]
cmp edi, 0x369d482b
je 0x18000cb89
cmp edi, 0x65423cfb
je 0x18000d3c4
cmp edi, 0x9ac86a3e
je 0x18000d222
cmp edi, 0xc8220e73
je 0x18000d00c
cmp edi, 0xdf9190f1
je 0x18000cf0c
cmp edi, 0xf432bdb4
je 0x18000cb89
cmp dword [rsp + 0x80], r9d
jbe 0x18000cb89
mov rax, qword [rsp + 0xc0]
xor ecx, ecx
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x60], rcx
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x48], rax
call fcn.18000b8d8
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, qword [rsp + 0xc0]
mov edx, 1
lea r8, [rsp + 0x70]
xor r9d, r9d
add edx, eax
call fcn.18000c64c
cmp edi, 0x4beb8fe5
jne 0x18000ce26
cmp dword [rsp + 0x7c], 3
jne 0x18000ce26
xor eax, eax
cmp dword [rsp + 0x3e8], eax
je 0x18000cebc
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, dword [rsp + 0x3c0]
mov rcx, qword [0x180037ae8]
mov dword [rsp + 0x60], eax
add eax, edi
xor edx, edx
mov r8d, eax
mov dword [rsp + 0x50], eax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor ecx, ecx
mov qword [rsp + 0x68], rax
cmp rax, rcx
je 0x18000cebc
mov ebx, dword [rsp + 0x60]
mov rdx, qword [rsp + 0x70]
mov rcx, rax
mov r8, rbx
call sub.ntdll.dll_memcpy
mov r8, rdi
mov rdi, qword [rsp + 0x68]
lea rcx, [rbx + rdi]
mov rdx, rbp
call sub.ntdll.dll_memcpy
mov r11d, dword [rsp + 0x50]
mov ebx, dword [rsp + 0x40]
mov dword [rsp + 0x98], r11d
xor ecx, ecx
jmp 0x18000ce80
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, dword [rsp + 0x3c0]
cmp eax, edi
ja 0x18000ce6e
mov r9, qword [rsp + 0x70]
mov r8, qword [rsp + 0x48]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov edx, edi
mov rcx, rbp
mov qword [rsp + 0x20], rax
call fcn.18000c2f0
mov rdi, qword [rsp + 0x60]
jmp 0x18000ce78
mov rdi, qword [rsp + 0x68]
mov eax, 0x57
xor ecx, ecx
cmp eax, ecx
cmovne rdi, rcx
cmp rdi, rcx
je 0x18000cebc
mov rcx, qword [0x180037ae8]
mov r8, rbp
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbp, rdi
mov edi, dword [rsp + 0x98]
or ebx, 8
mov dword [rsp + 0x94], 1
mov dword [rsp + 0x3c0], edi
mov dword [rsp + 0x40], ebx
jmp 0x18000cec3
mov edi, dword [rsp + 0x3c0]
mov rax, qword [rsp + 0xc0]
cmp qword [rsp + 0x70], rax
je 0x18000cee6
mov r8, qword [rsp + 0x70]
mov rcx, qword [0x180037ae8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [rsp + 0xb8]
mov edx, 0
lea r9d, [rdx + 1]
cmp qword [rsp + 0x48], rax
je 0x18000cab7
mov r8, qword [rsp + 0x48]
jmp 0x18000cb77
mov edi, dword [rsp + 0x3c0]
mov eax, r9d
cmp dword [rsp + 0x8c], eax
jbe 0x18000cf3f
mov r8, qword [rsp + 0xd8]
mov edx, edi
mov rcx, rbp
call fcn.1800185d4
xor edx, edx
cmp rax, rdx
je 0x18000cab1
lea eax, [rdx + 1]
mov word [rsp + 0x58], ax
mov eax, 0xbb8
mov dword [rsp + 0x50], eax
mov word [rsp + 0x5a], ax
cmp dword [rsp + 0x80], edx
je 0x18000cfbd
cmp dword [rsp + 0x84], edx
je 0x18000cfbd
mov rcx, qword [rsp + 0xc0]
lea r8, [rsp + 0x44]
xor edx, edx
call qword [sym.imp.SHLWAPI.dll_StrToIntExA]
xor edx, edx
cmp eax, edx
je 0x18000cf91
mov eax, dword [rsp + 0x44]
lea ecx, [rdx + 1]
cmp eax, edx
cmovne cx, ax
mov word [rsp + 0x58], cx
mov rcx, qword [rsp + 0xc8]
lea r8, [rsp + 0x44]
call qword [sym.imp.SHLWAPI.dll_StrToIntExA]
xor edx, edx
cmp eax, edx
je 0x18000cfbd
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x50]
cmp eax, edx
cmovne cx, ax
mov word [rsp + 0x5a], cx
mov eax, dword [0x180037bf8]
cmp eax, edx
jne 0x18000d000
mov r9d, dword [rsp + 0x58]
lea rax, [rsp + 0x138]
lea r8, [0x18000c058]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edx
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor edx, edx
cmp rax, rdx
je 0x18000d000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
or ebx, 4
mov dword [rsp + 0x40], ebx
jmp 0x18000cab1
mov rcx, qword [rsp + 0x3c8]
cmp rcx, rdx
je 0x18000d1b9
mov rax, qword [rcx]
lea rdx, [rsp + 0x1a0]
mov r8d, r9d
call qword [rax + 0x60]
mov eax, dword [rsp + 0x1b0]
mov edi, dword [rsp + 0x3c0]
mov rcx, qword [0x180037ae8]
lea r8d, [rdi + rax]
xor edx, edx
mov dword [rsp + 0x60], eax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor edx, edx
mov qword [rsp + 0x48], rax
cmp rax, rdx
je 0x18000cab1
mov r11, qword [rsp + 0x3c8]
mov dword [rsp + 0xf8], edx
mov dword [rsp + 0xfc], edx
mov rax, qword [r11]
mov rdx, qword [rsp + 0xf8]
xor r9d, r9d
xor r8d, r8d
mov rcx, r11
call qword [rax + 0x28]
mov rax, qword [rsp + 0x3c8]
mov r8d, dword [rsp + 0x60]
mov r11, qword [rax]
mov rdx, qword [rsp + 0x48]
xor r9d, r9d
mov rcx, rax
call qword [r11 + 0x18]
mov r11, qword [rsp + 0x3c8]
xor ecx, ecx
xor eax, eax
mov dword [rsp + 0x128], ecx
mov dword [rsp + 0x12c], ecx
mov rdx, qword [rsp + 0x128]
mov dword [rsp + 0x114], eax
mov rax, qword [r11]
mov dword [rsp + 0x110], ecx
xor r9d, r9d
xor r8d, r8d
mov rcx, r11
call qword [rax + 0x28]
mov rax, qword [rsp + 0x3c8]
mov rdx, qword [rsp + 0x110]
mov r11, qword [rax]
mov rcx, rax
call qword [r11 + 0x30]
mov ecx, dword [rsp + 0x60]
mov r8, rdi
add rcx, qword [rsp + 0x48]
mov rdx, rbp
call sub.ntdll.dll_memcpy
mov r8d, dword [rsp + 0x60]
mov r9, qword [rsp + 0xc8]
mov rdx, qword [rsp + 0x48]
xor eax, eax
lea ecx, [rax + 1]
cmp dword [rsp + 0x80], ecx
lea rcx, [rsp + 0xe0]
cmova rax, qword [rsp + 0xc0]
mov qword [rsp + 0x30], rcx
mov rcx, qword [rsp + 0x3d8]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xd0]
add r8d, edi
mov qword [rsp + 0x20], rax
call fcn.18000c8cc
xor ecx, ecx
cmp eax, ecx
je 0x18000d17f
or ebx, 2
mov dword [rsp + 0x40], ebx
mov r8d, dword [rsp + 0xe0]
cmp r8d, ecx
je 0x18000d1af
mov r11, qword [rsp + 0x3c8]
mov edx, dword [rsp + 0x60]
xor r9d, r9d
mov r10, qword [r11]
add edx, edi
mov rcx, r11
sub rdx, r8
add rdx, qword [rsp + 0x48]
call qword [r10 + 0x20]
mov r8, qword [rsp + 0x48]
jmp 0x18000cb75
mov edi, dword [rsp + 0x3c0]
mov ecx, r9d
mov r9, qword [rsp + 0xc8]
cmp dword [rsp + 0x80], ecx
mov rcx, qword [rsp + 0x3d8]
mov qword [rsp + 0x30], rdx
mov rax, rdx
mov r8d, edi
mov rdx, rbp
cmova rax, qword [rsp + 0xc0]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x20], rax
call fcn.18000c8cc
xor edx, edx
lea r9d, [rdx + 1]
cmp eax, edx
je 0x18000cab7
or ebx, 2
mov dword [rsp + 0x40], ebx
jmp 0x18000cab7
mov eax, r9d
cmp dword [rsp + 0x80], eax
jb 0x18000d27a
cmp dword [rsp + 0x8c], eax
jbe 0x18000d255
mov r8, qword [rsp + 0xd8]
mov edx, dword [rsp + 0x3c0]
mov rcx, rbp
call fcn.1800185d4
xor ecx, ecx
cmp rax, rcx
je 0x18000d27a
mov r8d, dword [rsp + 0x80]
mov rdx, qword [rsp + 0xc0]
xor r9d, r9d
mov ecx, 0x126
call fcn.18000f3c8
bts ebx, 7
mov dword [rsp + 0x40], ebx
mov rdi, qword [rsp + 0xd8]
mov rcx, rdi
mov qword [rsp + 0x68], rdi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, 1
lea r8, [rsp + 0x68]
xor r9d, r9d
mov rcx, rdi
add edx, eax
call fcn.18000c64c
mov edi, dword [rsp + 0x3c0]
xor edx, edx
cmp eax, edx
je 0x18000cab1
lea r8, [rsp + 0xa8]
mov edx, 1
xor ecx, ecx
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
xor edx, edx
lea r9d, [rdx + 1]
cmp eax, edx
jne 0x18000cab7
mov rcx, qword [rsp + 0x68]
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0xf0]
xor r9d, r9d
call fcn.180004a80
xor edi, edi
cmp eax, edi
jne 0x18000d3b1
mov rcx, qword [rsp + 0xa8]
mov r8d, dword [rsp + 0x90]
mov rdx, qword [rsp + 0xf0]
mov rax, qword [rcx]
xor r9d, r9d
call qword [rax + 0x20]
mov rcx, qword [rsp + 0xa8]
mov dword [rsp + 0xa0], edi
mov rax, qword [rcx]
mov dword [rsp + 0xa4], edi
mov rdx, qword [rsp + 0xa0]
xor r9d, r9d
xor r8d, r8d
call qword [rax + 0x28]
mov r8, qword [rsp + 0xf0]
mov rcx, qword [0x180037ae8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [rsp + 0x3e8]
mov r9, qword [rsp + 0xd8]
mov r8, qword [rsp + 0x3d0]
mov rcx, qword [rsp + 0xa8]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], eax
xor edx, edx
mov dword [rsp + 0x20], edi
call fcn.18000ca54
mov r8, qword [rsp + 0x68]
mov rcx, qword [0x180037ae8]
or ebx, eax
xor edx, edx
mov dword [rsp + 0x40], ebx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0xa8]
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x18000caa8
mov edi, dword [rsp + 0x3c0]
cmp dword [rsp + 0x80], r9d
jb 0x18000cab7
cmp dword [rsp + 0x8c], r9d
jbe 0x18000d404
mov r8, qword [rsp + 0xd8]
mov edx, edi
mov rcx, rbp
call fcn.1800185d4
xor edx, edx
lea r9d, [rdx + 1]
cmp rax, rdx
je 0x18000cab7
lea rdx, [rsp + 0x1f0]
mov ecx, 0x201
call qword [sym.imp.WS2_32.dll_WSAStartup]
xor edx, edx
cmp eax, edx
jne 0x18000d436
mov rcx, qword [rsp + 0xc0]
lea rdx, [rsp + 0x140]
call fcn.180017a84
xor edx, edx
jmp 0x18000d438
mov eax, edx
mov r9d, 1
cmp eax, edx
je 0x18000cab7
xor r9d, r9d
lea rdx, [rsp + 0x140]
mov ecx, 0x127
lea r8d, [r9 + 0x10]
call fcn.18000f3c8
or ebx, 0x40
mov dword [rsp + 0x40], ebx
jmp 0x18000caaf
mov rdi, qword [rsp + 0x3f0]
cmp rdi, rdx
je 0x18000d563
cmp qword [rdi + 0x18], rdx
jne 0x18000d494
mov rcx, rdi
call fcn.18001a8c0
xor edx, edx
cmp eax, edx
jne 0x18000d563
mov rcx, rdi
call fcn.18001a744
xor edx, edx
cmp eax, edx
jne 0x18000d563
xor eax, eax
mov dword [rsp + 0x108], edx
mov dword [rsp + 0xa0], edx
mov dword [rsp + 0x10c], eax
mov rax, qword [rsi]
mov dword [rsp + 0xa4], edx
mov rdx, qword [rsp + 0xa0]
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
call qword [rax + 0x28]
mov r11, qword [rsi]
mov rdx, qword [rsp + 0x108]
mov rcx, rsi
call qword [r11 + 0x30]
lea rdx, [rdi + 0x58]
lea rcx, [rdi + 0x10]
call fcn.18000b8d8
mov r11, qword [rsi]
mov r8d, dword [rdi + 0x58]
mov rdx, qword [rdi + 0x10]
xor r9d, r9d
mov rcx, rsi
call qword [r11 + 0x20]
xor ebx, ebx
cmp rbp, rbx
je 0x18000d52b
mov rcx, qword [0x180037ae8]
mov r8, rbp
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbp, rbx
mov eax, dword [rsp + 0x3e8]
mov r8, qword [rsp + 0x3d0]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], eax
mov r9, rdi
xor edx, edx
add r9, 0x60
mov rcx, rsi
mov dword [rsp + 0x20], ebx
call fcn.18000ca54
mov ebx, dword [rsp + 0x40]
or eax, 1
or ebx, eax
xor edx, edx
cmp rbp, rdx
je 0x18000d5e6
mov ecx, dword [rsp + 0x94]
cmp ecx, edx
je 0x18000d5d2
xor eax, eax
mov dword [rsp + 0x118], edx
mov dword [rsp + 0x3d0], edx
mov dword [rsp + 0x11c], eax
mov rax, qword [rsi]
mov dword [rsp + 0x3d4], edx
mov rdx, qword [rsp + 0x3d0]
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
call qword [rax + 0x28]
mov r11, qword [rsi]
mov rdx, qword [rsp + 0x118]
mov rcx, rsi
call qword [r11 + 0x30]
mov r11, qword [rsi]
mov r8d, dword [rsp + 0x3c0]
xor r9d, r9d
mov rdx, rbp
mov rcx, rsi
call qword [r11 + 0x20]
mov rcx, qword [0x180037ae8]
mov r8, rbp
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor edx, edx
mov r10, qword [rsi]
mov dword [rsp + 0x3d0], edx
mov dword [rsp + 0x3d4], edx
mov rdx, qword [rsp + 0x3d0]
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
call qword [r10 + 0x28]
mov eax, ebx
add rsp, 0x398
pop rdi
pop rsi
pop rbp
pop rbx
ret