Function at 0x180009c70
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x1800ae1f0]
xor rax, rsp
mov qword [rbp + 0x168], rax
mov r14, rdx
mov rbx, rcx
mov r8d, dword [rcx + 0x14]
lea r9, [rbp + 0x145]
nop dword [rax]
dec r9
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r9], r8b
mov r8d, edx
test edx, edx
jne 0x180009cb0
xor r15d, r15d
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], r15b
lea rax, [rbp + 0x145]
cmp r9, rax
je 0x180009d19
lea r8, [rbp + 0x145]
sub r8, r9
mov rdx, r9
lea rcx, [rsp + 0x50]
call fcn.180004080
nop
mov r8d, dword [rbx + 0x10]
lea r9, [rbp + 0x15d]
nop dword [rax]
nop dword [rax + rax]
dec r9
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r9], r8b
mov r8d, edx
test edx, edx
jne 0x180009d30
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], dl
lea rax, [rbp + 0x15d]
cmp r9, rax
je 0x180009d95
lea r8, [rbp + 0x15d]
sub r8, r9
mov rdx, r9
lea rcx, [rsp + 0x30]
call fcn.180004080
nop
mov r8d, 1
lea rdx, [0x1800994d8]
lea rcx, [rsp + 0x30]
call fcn.1800041e0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x30], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea r9, [rsp + 0x50]
lea r8, [rbp - 0x40]
lea rcx, [rbp - 0x18]
call fcn.18000b4a0
nop
lea rdx, [rbp - 0x18]
lea rcx, [rsp + 0x70]
call fcn.1800337e0
nop
lea rdx, str.detectionRuleId
mov rcx, r14
call fcn.180034340
mov rcx, rax
lea rdx, [rsp + 0x70]
call fcn.180033e50
nop
lea rcx, [rsp + 0x70]
call fcn.180033d80
nop
mov rdx, qword [rbp]
cmp rdx, 0x10
jb 0x180009e4f
inc rdx
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009e4a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b1d8
call fcn.18004e190
mov qword [rbp - 8], r15
mov qword [rbp], 0xf
mov byte [rbp - 0x18], 0
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x180009e9b
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009e95
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b1de
call fcn.18004e190
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x180009ed8
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009ed3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b1e4
call fcn.18004e190
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x180009f28
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009f23
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b1ea
call fcn.18004e190
mov edx, dword [rbx + 0x18]
lea rcx, [rbp - 0x40]
call fcn.180033840
nop
lea rdx, str.silent
mov rcx, r14
call fcn.180034340
mov rcx, rax
lea rdx, [rbp - 0x40]
call fcn.180033e50
nop
lea rcx, [rbp - 0x40]
call fcn.180033d80
lea rdx, [rbx + 0x48]
lea rcx, [rbp - 0x40]
call fcn.1800337e0
nop
lea rdx, str.detectionMessage
mov rcx, r14
call fcn.180034340
mov rcx, rax
lea rdx, [rbp - 0x40]
call fcn.180033e50
nop
lea rcx, [rbp - 0x40]
call fcn.180033d80
mov ecx, dword [rbx + 0x88]
mov qword [rbp + 0x148], r15
mov qword [rbp + 0x158], r15
mov qword [rbp + 0x160], 0xf
mov byte [rbp + 0x148], 0
test ecx, ecx
je 0x180009fdb
cmp ecx, 1
lea rcx, [rbp + 0x148]
je 0x180009fcc
lea rdx, str.UNKNOWN
jmp 0x180009fe9
mov r8d, 8
lea rdx, str.OUTBOUND
jmp 0x180009fef
lea rdx, str.INBOUND
lea rcx, [rbp + 0x148]
mov r8d, 7
call fcn.180004080
nop
lea rdx, [rbp + 0x148]
lea rcx, [rbp - 0x40]
call fcn.1800337e0
nop
lea rdx, str.flowDirection
mov rcx, r14
call fcn.180034340
mov rcx, rax
lea rdx, [rbp - 0x40]
call fcn.180033e50
nop
lea rcx, [rbp - 0x40]
call fcn.180033d80
nop
mov rdx, qword [rbp + 0x160]
cmp rdx, 0x10
jb 0x18000a06d
inc rdx
mov rcx, qword [rbp + 0x148]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000a068
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b1f0
call fcn.18004e190
mov ecx, dword [rbx + 0x8c]
mov qword [rbp + 0x148], r15
mov qword [rbp + 0x158], r15
mov qword [rbp + 0x160], 0xf
mov byte [rbp + 0x148], 0
test ecx, ecx
je 0x18000a0bb
cmp ecx, 1
lea rcx, [rbp + 0x148]
je 0x18000a0ac
lea rdx, str.UNKNOWN
jmp 0x18000a0c9
mov r8d, 8
lea rdx, str.OUTBOUND
jmp 0x18000a0cf
lea rdx, str.INBOUND
lea rcx, [rbp + 0x148]
mov r8d, 7
call fcn.180004080
nop
lea rdx, [rbp + 0x148]
lea rcx, [rbp - 0x40]
call fcn.1800337e0
nop
lea rdx, str.packetDirection
mov rcx, r14
call fcn.180034340
mov rcx, rax
lea rdx, [rbp - 0x40]
call fcn.180033e50
nop
lea rcx, [rbp - 0x40]
call fcn.180033d80
nop
mov rdx, qword [rbp + 0x160]
cmp rdx, 0x10
jb 0x18000a14d
inc rdx
mov rcx, qword [rbp + 0x148]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000a148
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b1f6
call fcn.18004e190
mov edx, dword [rbx + 0x1c]
test edx, edx
je 0x18000a183
lea rcx, [rbp - 0x40]
call fcn.180033840
nop
lea rdx, str.aaconly
mov rcx, r14
call fcn.180034340
mov rcx, rax
lea rdx, [rbp - 0x40]
call fcn.180033e50
nop
lea rcx, [rbp - 0x40]
call fcn.180033d80
cmp qword [rbx + 0x30], 0
je 0x18000a1e8
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rax
lea rdx, [rbx + 0x20]
lea rcx, [rbp - 0x40]
call fcn.180009110
nop
lea rcx, [rbp - 0x40]
call fcn.180036640
test al, al
je 0x18000a1df
lea rcx, [rbp - 0x40]
call fcn.180036ed0
test eax, eax
je 0x18000a1df
lea rdx, str.ttpnames
mov rcx, r14
call fcn.180034340
mov rcx, rax
lea rdx, [rbp - 0x40]
call fcn.180033e70
nop
lea rcx, [rbp - 0x40]
call fcn.180033d80
mov edx, dword [rbx + 0x40]
test edx, edx
je 0x18000a21e
lea rcx, [rbp - 0x40]
call fcn.180033840
nop
lea rdx, str.notelem
mov rcx, r14
call fcn.180034340
mov rcx, rax
lea rdx, [rbp - 0x40]
call fcn.180033e50
nop
lea rcx, [rbp - 0x40]
call fcn.180033d80
mov qword [rbp + 0x10], 0x11c
mov qword [rbp + 0x18], r15
mov dword [rbp + 0x20], r15d
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x24]
call fcn.180050e40
mov dword [rbp + 0x124], r15d
mov dword [rbp + 0x128], 0x10000
mov r8b, 1
mov edx, 0x80
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8, rax
mov edx, 0x80
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x18000a27f
cmp dword [rbx + 0x44], 1
mov edx, r15d
jne 0x18000a284
mov edx, 1
lea rcx, [rbp - 0x40]
call fcn.180033840
nop
lea rdx, str.nocleanup
mov rcx, r14
call fcn.180034340
mov rcx, rax
lea rdx, [rbp - 0x40]
call fcn.180033e50
nop
lea rcx, [rbp - 0x40]
call fcn.180033d80
cmp qword [rbx + 0x78], 0
je 0x18000a2ed
lea rdx, [rbx + 0x68]
lea rcx, [rbp - 0x40]
call fcn.1800337e0
nop
lea rdx, str.detectionCve
mov rcx, r14
call fcn.180034340
mov rcx, rax
lea rdx, [rbp - 0x40]
call fcn.180033e50
nop
lea rcx, [rbp - 0x40]
call fcn.180033d80
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x18], xmm0
movups xmmword [rbp - 8], xmm0
mov qword [rbp + 8], rax
mov r9, qword [rbx + 0xa8]
mov r8, qword [rbx + 0xa0]
lea rcx, [rbp - 0x18]
call fcn.180008eb0
xor eax, eax
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rax
mov ecx, 0x88
call fcn.18004e1a0
mov qword [rbp + 0x130], rax
test rax, rax
je 0x18000a342
mov qword [rax + 0x80], r15
jmp 0x18000a345
mov rax, r15
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], r15
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x28], r15
mov word [rbp - 0x20], 0x2000
mov dword [rbp - 0x1c], r15d
mov edx, dword [rbp - 4]
lea rcx, [rbp - 0x40]
call fcn.180019630
mov rcx, qword [rbp - 0x40]
mov rdx, qword [rcx + 0x80]
mov rdi, qword [rbp - 0x30]
add rdi, rdx
cmp qword [rbp - 0x38], 0
je 0x18000a393
lea rcx, [rbp - 0x40]
call fcn.180019570
mov rdx, qword [rbp - 0x38]
jmp 0x18000a39b
mov byte [rdx + rcx], 0
mov rdx, qword [rbp - 0x40]
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], 0
mov r8, rdi
lea rcx, [rsp + 0x50]
call fcn.180004080
nop
mov rcx, qword [rbp - 0x40]
call fcn.18004e848
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x18000a3dc
call fcn.18004e848
mov qword [rbp - 0x38], r15
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x70]
call fcn.1800337e0
nop
lea rdx, str.detectionProtocol
mov rcx, r14
call fcn.180034340
mov rcx, rax
lea rdx, [rsp + 0x70]
call fcn.180033e50
nop
lea rcx, [rsp + 0x70]
call fcn.180033d80
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x18000a451
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000a44c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b1fc
call fcn.18004e190
mov rcx, qword [rbx + 0xd8]
mov edx, dword [rcx + 0x10]
mov dword [rbp + 0x130], edx
cmp dword [rbx + 0x8c], 0
jne 0x18000a8a1
cmp edx, 0x800
je 0x18000a490
cmp edx, 0x86dd
je 0x18000a487
mov qword [rbp + 0x138], r15
jmp 0x18000a4a1
mov eax, dword [rcx + 0x1c]
add rax, 8
jmp 0x18000a497
mov eax, dword [rcx + 0x1c]
add rax, 0xc
add rax, qword [rcx]
mov qword [rbp + 0x138], rax
lea rdx, [rbp + 0x130]
lea rcx, [rbp - 0x40]
call fcn.1800193d0
nop
mov rdx, rax
lea rcx, [rbp - 0x18]
call fcn.1800337e0
nop
lea rdx, str.detectionRemoteAddress
mov rcx, r14
call fcn.180034340
mov rcx, rax
lea rdx, [rbp - 0x18]
call fcn.180033e50
nop
lea rcx, [rbp - 0x18]
call fcn.180033d80
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x18000a520
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000a51b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b202
call fcn.18004e190
mov rcx, qword [rbx + 0xd8]
mov eax, dword [rcx + 0x14]
cmp eax, 6
je 0x18000a539
cmp eax, 0x11
je 0x18000a539
mov edx, r15d
jmp 0x18000a54b
mov eax, dword [rcx + 0x20]
add rax, qword [rcx]
movzx edx, byte [rax]
movzx eax, byte [rax + 1]
shl edx, 8
add edx, eax
lea rcx, [rbp - 0x40]
call fcn.180033840
nop
lea rdx, str.detectionRemotePort
mov rcx, r14
call fcn.180034340
mov rcx, rax
lea rdx, [rbp - 0x40]
call fcn.180033e50
nop
lea rcx, [rbp - 0x40]
call fcn.180033d80
mov rcx, qword [rbx + 0xd8]
mov eax, dword [rcx + 0x18]
test eax, eax
je 0x18000a5ef
cmp eax, 0x10
je 0x18000a597
xor eax, eax
mov dword [rbp + 0x130], eax
jmp 0x18000a5ff
mov rdx, qword [rcx]
movzx eax, byte [rdx + 1]
and eax, 3
sub eax, 1
je 0x18000a5da
sub eax, 1
je 0x18000a5c5
cmp eax, 1
jne 0x18000a5da
mov ecx, 0x18
mov eax, dword [rcx + rdx]
mov dword [rbp + 0x130], eax
movzx eax, word [rcx + rdx + 4]
jmp 0x18000a5ff
mov ecx, 0x10
mov eax, dword [rcx + rdx]
mov dword [rbp + 0x130], eax
movzx eax, word [rcx + rdx + 4]
jmp 0x18000a5ff
mov ecx, 0xa
mov eax, dword [rcx + rdx]
mov dword [rbp + 0x130], eax
movzx eax, word [rcx + rdx + 4]
jmp 0x18000a5ff
mov rcx, qword [rcx]
mov eax, dword [rcx + 6]
mov dword [rbp + 0x130], eax
movzx eax, word [rcx + 0xa]
mov word [rbp + 0x134], ax
lea rdx, [rbp + 0x130]
lea rcx, [rbp - 0x40]
call fcn.180019220
nop
mov rdx, rax
lea rcx, [rbp - 0x18]
call fcn.1800337e0
nop
lea rdx, str.detectionRemoteMAC
mov rcx, r14
call fcn.180034340
mov rcx, rax
lea rdx, [rbp - 0x18]
call fcn.180033e50
nop
lea rcx, [rbp - 0x18]
call fcn.180033d80
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x18000a685
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000a680
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b208
call fcn.18004e190
mov rdx, qword [rbx + 0xd8]
mov ecx, dword [rdx + 0x10]
mov dword [rbp + 0x130], ecx
cmp ecx, 0x800
je 0x18000a6b7
cmp ecx, 0x86dd
je 0x18000a6ae
mov qword [rbp + 0x138], r15
jmp 0x18000a6c8
mov eax, dword [rdx + 0x1c]
add rax, 0x18
jmp 0x18000a6be
mov eax, dword [rdx + 0x1c]
add rax, 0x10
add rax, qword [rdx]
mov qword [rbp + 0x138], rax
lea rdx, [rbp + 0x130]
lea rcx, [rbp - 0x40]
call fcn.1800193d0
nop
mov rdx, rax
lea rcx, [rbp - 0x18]
call fcn.1800337e0
nop
lea rdx, str.detectionLocalAddress
mov rcx, r14
call fcn.180034340
mov rcx, rax
lea rdx, [rbp - 0x18]
call fcn.180033e50
nop
lea rcx, [rbp - 0x18]
call fcn.180033d80
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x18000a747
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000a742
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b20e
call fcn.18004e190
mov rax, qword [rbx + 0xd8]
mov ecx, dword [rax + 0x14]
cmp ecx, 6
je 0x18000a760
cmp ecx, 0x11
je 0x18000a760
mov edx, r15d
jmp 0x18000a775
mov ecx, dword [rax + 0x20]
mov rax, qword [rax]
movzx edx, byte [rcx + rax + 2]
movzx eax, byte [rcx + rax + 3]
shl edx, 8
add edx, eax
lea rcx, [rbp - 0x40]
call fcn.180033840
nop
lea rdx, str.detectionLocalPort
mov rcx, r14
call fcn.180034340
mov rcx, rax
lea rdx, [rbp - 0x40]
call fcn.180033e50
nop
lea rcx, [rbp - 0x40]
call fcn.180033d80
mov rcx, qword [rbx + 0xd8]
mov eax, dword [rcx + 0x18]
test eax, eax
je 0x18000a804
cmp eax, 0x10
je 0x18000a7c1
xor eax, eax
mov dword [rbp + 0x130], eax
jmp 0x18000a813
mov rdx, qword [rcx]
movzx eax, byte [rdx + 1]
and eax, 3
sub eax, 1
je 0x18000a7ef
sub eax, 1
je 0x18000a7da
cmp eax, 1
je 0x18000a7ef
mov ecx, 4
mov eax, dword [rcx + rdx]
mov dword [rbp + 0x130], eax
movzx eax, word [rcx + rdx + 4]
jmp 0x18000a813
mov ecx, 0x10
mov eax, dword [rcx + rdx]
mov dword [rbp + 0x130], eax
movzx eax, word [rcx + rdx + 4]
jmp 0x18000a813
mov rcx, qword [rcx]
mov eax, dword [rcx]
mov dword [rbp + 0x130], eax
movzx eax, word [rcx + 4]
mov word [rbp + 0x134], ax
lea rdx, [rbp + 0x130]
lea rcx, [rbp - 0x40]
call fcn.180019220
nop
mov rdx, rax
lea rcx, [rbp - 0x18]
call fcn.1800337e0
nop
lea rdx, str.detectionLocalMAC
mov rcx, r14
call fcn.180034340
mov rcx, rax
lea rdx, [rbp - 0x18]
call fcn.180033e50
nop
lea rcx, [rbp - 0x18]
call fcn.180033d80
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x18000acde
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000acd9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b1d2
jmp 0x18000acd9
cmp edx, 0x800
je 0x18000a8c3
cmp edx, 0x86dd
je 0x18000a8ba
mov qword [rbp + 0x138], r15
jmp 0x18000a8d4
mov eax, dword [rcx + 0x1c]
add rax, 0x18
jmp 0x18000a8ca
mov eax, dword [rcx + 0x1c]
add rax, 0x10
add rax, qword [rcx]
mov qword [rbp + 0x138], rax
lea rdx, [rbp + 0x130]
lea rcx, [rbp - 0x40]
call fcn.1800193d0
nop
mov rdx, rax
lea rcx, [rbp - 0x18]
call fcn.1800337e0
nop
lea rdx, str.detectionRemoteAddress
mov rcx, r14
call fcn.180034340
mov rcx, rax
lea rdx, [rbp - 0x18]
call fcn.180033e50
nop
lea rcx, [rbp - 0x18]
call fcn.180033d80
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x18000a953
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000a94e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b214
call fcn.18004e190
mov rax, qword [rbx + 0xd8]
mov ecx, dword [rax + 0x14]
cmp ecx, 6
je 0x18000a96c
cmp ecx, 0x11
je 0x18000a96c
mov edx, r15d
jmp 0x18000a981
mov ecx, dword [rax + 0x20]
mov rax, qword [rax]
movzx edx, byte [rcx + rax + 2]
movzx eax, byte [rcx + rax + 3]
shl edx, 8
add edx, eax
lea rcx, [rbp - 0x40]
call fcn.180033840
nop
lea rdx, str.detectionRemotePort
mov rcx, r14
call fcn.180034340
mov rcx, rax
lea rdx, [rbp - 0x40]
call fcn.180033e50
nop
lea rcx, [rbp - 0x40]
call fcn.180033d80
mov rcx, qword [rbx + 0xd8]
mov eax, dword [rcx + 0x18]
test eax, eax
je 0x18000aa10
cmp eax, 0x10
je 0x18000a9cd
xor eax, eax
mov dword [rbp + 0x130], eax
jmp 0x18000aa1f
mov rdx, qword [rcx]
movzx eax, byte [rdx + 1]
and eax, 3
sub eax, 1
je 0x18000a9fb
sub eax, 1
je 0x18000a9e6
cmp eax, 1
je 0x18000a9fb
mov ecx, 4
mov eax, dword [rcx + rdx]
mov dword [rbp + 0x130], eax
movzx eax, word [rcx + rdx + 4]
jmp 0x18000aa1f
mov ecx, 0x10
mov eax, dword [rcx + rdx]
mov dword [rbp + 0x130], eax
movzx eax, word [rcx + rdx + 4]
jmp 0x18000aa1f
mov rcx, qword [rcx]
mov eax, dword [rcx]
mov dword [rbp + 0x130], eax
movzx eax, word [rcx + 4]
mov word [rbp + 0x134], ax
lea rdx, [rbp + 0x130]
lea rcx, [rbp - 0x40]
call fcn.180019220
nop
mov rdx, rax
lea rcx, [rbp - 0x18]
call fcn.1800337e0
nop
lea rdx, str.detectionRemoteMAC
mov rcx, r14
call fcn.180034340
mov rcx, rax
lea rdx, [rbp - 0x18]
call fcn.180033e50
nop
lea rcx, [rbp - 0x18]
call fcn.180033d80
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x18000aaa5
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000aaa0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b21a
call fcn.18004e190
mov rdx, qword [rbx + 0xd8]
mov ecx, dword [rdx + 0x10]
mov dword [rbp + 0x130], ecx
cmp ecx, 0x800
je 0x18000aad7
cmp ecx, 0x86dd
je 0x18000aace
mov qword [rbp + 0x138], r15
jmp 0x18000aae8
mov eax, dword [rdx + 0x1c]
add rax, 8
jmp 0x18000aade
mov eax, dword [rdx + 0x1c]
add rax, 0xc
add rax, qword [rdx]
mov qword [rbp + 0x138], rax
lea rdx, [rbp + 0x130]
lea rcx, [rbp - 0x40]
call fcn.1800193d0
nop
mov rdx, rax
lea rcx, [rbp - 0x18]
call fcn.1800337e0
nop
lea rdx, str.detectionLocalAddress
mov rcx, r14
call fcn.180034340
mov rcx, rax
lea rdx, [rbp - 0x18]
call fcn.180033e50
nop
lea rcx, [rbp - 0x18]
call fcn.180033d80
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x18000ab67
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000ab62
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b220
call fcn.18004e190
mov rcx, qword [rbx + 0xd8]
mov eax, dword [rcx + 0x14]
cmp eax, 6
je 0x18000ab92
cmp eax, 0x11
je 0x18000ab80
mov edx, r15d
jmp 0x18000aba4
mov eax, dword [rcx + 0x20]
add rax, qword [rcx]
movzx edx, byte [rax]
shl edx, 8
movzx eax, byte [rax + 1]
jmp 0x18000aba2
mov eax, dword [rcx + 0x20]
add rax, qword [rcx]
movzx edx, byte [rax + 1]
movzx eax, byte [rax]
shl eax, 8
add edx, eax
lea rcx, [rbp - 0x40]
call fcn.180033840
nop
lea rdx, str.detectionLocalPort
mov rcx, r14
call fcn.180034340
mov rcx, rax
lea rdx, [rbp - 0x40]
call fcn.180033e50
nop
lea rcx, [rbp - 0x40]
call fcn.180033d80
mov rcx, qword [rbx + 0xd8]
mov eax, dword [rcx + 0x18]
test eax, eax
je 0x18000ac48
cmp eax, 0x10
je 0x18000abf0
xor eax, eax
mov dword [rbp + 0x130], eax
jmp 0x18000ac58
mov rdx, qword [rcx]
movzx eax, byte [rdx + 1]
and eax, 3
sub eax, 1
je 0x18000ac33
sub eax, 1
je 0x18000ac1e
cmp eax, 1
jne 0x18000ac33
mov ecx, 0x18
mov eax, dword [rcx + rdx]
mov dword [rbp + 0x130], eax
movzx eax, word [rcx + rdx + 4]
jmp 0x18000ac58
mov ecx, 0x10
mov eax, dword [rcx + rdx]
mov dword [rbp + 0x130], eax
movzx eax, word [rcx + rdx + 4]
jmp 0x18000ac58
mov ecx, 0xa
mov eax, dword [rcx + rdx]
mov dword [rbp + 0x130], eax
movzx eax, word [rcx + rdx + 4]
jmp 0x18000ac58
mov rcx, qword [rcx]
mov eax, dword [rcx + 6]
mov dword [rbp + 0x130], eax
movzx eax, word [rcx + 0xa]
mov word [rbp + 0x134], ax
lea rdx, [rbp + 0x130]
lea rcx, [rbp - 0x40]
call fcn.180019220
nop
mov rdx, rax
lea rcx, [rbp - 0x18]
call fcn.1800337e0
nop
lea rdx, str.detectionLocalMAC
mov rcx, r14
call fcn.180034340
mov rcx, rax
lea rdx, [rbp - 0x18]
call fcn.180033e50
nop
lea rcx, [rbp - 0x18]
call fcn.180033d80
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x18000acde
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000acd9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b226
call fcn.18004e190
cmp qword [rbx + 0xc0], 0
je 0x18000b1a6
mov r8, qword [rbx + 0xc8]
test r8, r8
je 0x18000b1a6
lea r9, [rbp + 0x145]
movabs rdi, 0xcccccccccccccccd
jns 0x18000ad60
neg r8
nop dword [rax]
nop word [rax + rax]
dec r9
mov rax, rdi
mul r8
shr rdx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r9], r8b
mov r8, rdx
test rdx, rdx
jne 0x18000ad20
dec r9
mov byte [r9], 0x2d
jmp 0x18000ad8a
dec r9
mov rax, rdi
mul r8
shr rdx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r9], r8b
mov r8, rdx
test rdx, rdx
jne 0x18000ad60
mov qword [rbp - 0x18], r15
mov qword [rbp - 8], r15
mov qword [rbp], 0xf
mov byte [rbp - 0x18], 0
lea rax, [rbp + 0x145]
cmp r9, rax
je 0x18000adc1
lea r8, [rbp + 0x145]
sub r8, r9
mov rdx, r9
lea rcx, [rbp - 0x18]
call fcn.180004080
nop
mov r8, qword [rbx + 0xc0]
lea r9, [rbp + 0x15d]
nop
dec r9
mov rax, rdi
mul r8
shr rdx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r9], r8b
mov r8, rdx
test rdx, rdx
jne 0x18000add0
mov qword [rsp + 0x30], r15
mov rcx, r15
mov qword [rsp + 0x40], rcx
mov edx, 0xf
mov qword [rsp + 0x48], rdx
mov byte [rsp + 0x30], cl
lea rax, [rbp + 0x15d]
cmp r9, rax
je 0x18000ae42
lea r8, [rbp + 0x15d]
sub r8, r9
mov rdx, r9
lea rcx, [rsp + 0x30]
call fcn.180004080
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
mov rax, rdx
sub rax, rcx
lea rsi, [0x180099618]
cmp rax, 1
jb 0x18000aed3
lea r8, [rcx + 1]
mov qword [rsp + 0x40], r8
lea rbx, [rsp + 0x30]
cmp rdx, 0x10
cmovae rbx, qword [rsp + 0x30]
lea rax, [0x180099619]
cmp rax, rbx
jbe 0x18000ae94
lea rax, [rbx + rcx]
cmp rsi, rax
ja 0x18000ae94
cmp rbx, rsi
ja 0x18000ae8c
mov rdi, r15
jmp 0x18000ae99
mov rdi, rbx
sub rdi, rsi
jmp 0x18000ae99
mov edi, 1
lea rcx, [rbx + 1]
mov rdx, rbx
call fcn.180050790
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call fcn.180050790
lea rcx, [rbx + rdi]
mov r8d, 1
sub r8, rdi
lea rdx, [rsi + 1]
add rdx, rdi
call fcn.180050790
lea rax, [rsp + 0x30]
jmp 0x18000aef0
mov qword [rsp + 0x28], 1
mov qword [rsp + 0x20], rsi
mov edx, 1
lea rcx, [rsp + 0x30]
call fcn.18000b690
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 1
lea rdx, [0x1800994d8]
lea rcx, [rsp + 0x50]
call fcn.1800041e0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x148], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x158], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea r9, [rbp - 0x18]
lea r8, [rbp + 0x148]
lea rcx, [rbp - 0x40]
call fcn.18000b4a0
nop
mov r8d, 1
lea rdx, [0x180099614]
lea rcx, [rbp - 0x40]
call fcn.1800041e0
mov qword [rsp + 0x70], r15
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x80], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x68]
call fcn.1800337e0
nop
lea rdx, str.spid
mov rcx, r14
call fcn.180034340
lea rdx, str._spid
mov rcx, rax
call fcn.180034340
mov rcx, rax
lea rdx, [rbp - 0x68]
call fcn.180033e50
nop
lea rcx, [rbp - 0x68]
call fcn.180033d80
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x18000b031
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000b02c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b22c
call fcn.18004e190
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], 0xf
mov byte [rsp + 0x70], 0
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x18000b07d
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000b078
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b232
call fcn.18004e190
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x28], 0xf
mov byte [rbp - 0x40], 0
mov rdx, qword [rbp + 0x160]
cmp rdx, 0x10
jb 0x18000b0cf
inc rdx
mov rcx, qword [rbp + 0x148]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000b0c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b238
call fcn.18004e190
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x18000b10c
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000b107
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b23e
call fcn.18004e190
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x18000b15c
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000b157
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b244
call fcn.18004e190
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
mov rdx, qword [rbp]
cmp rdx, 0x10
jb 0x18000b1a6
inc rdx
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000b1a1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b1cc
call fcn.18004e190
mov rcx, qword [rbp + 0x168]
xor rcx, rsp
call fcn.18004e170
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x270
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.180055c10
int3
call fcn.180055c10
nop
call fcn.180055c10
nop
call fcn.180055c10
nop
call fcn.180055c10
nop
call fcn.180055c10
int3
call fcn.180055c10
int3
call fcn.180055c10
int3
call fcn.180055c10
int3
call fcn.180055c10
int3
call fcn.180055c10
int3
call fcn.180055c10
int3
call fcn.180055c10
int3
call fcn.180055c10
int3
call fcn.180055c10
int3
call fcn.180055c10
nop
call fcn.180055c10
nop
call fcn.180055c10
nop
call fcn.180055c10
nop
call fcn.180055c10
nop
call fcn.180055c10
int3