Function at 0x14001ac50
Capabilities:
Inspect section memory permissions

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x1f8
lea rbp, [rsp + 0x80]
movdqa xmmword [rbp + 0x160], xmm14
movdqa xmmword [rbp + 0x150], xmm13
movdqa xmmword [rbp + 0x140], xmm12
movdqa xmmword [rbp + 0x130], xmm11
movdqa xmmword [rbp + 0x120], xmm10
movdqa xmmword [rbp + 0x110], xmm9
movdqa xmmword [rbp + 0x100], xmm8
movdqa xmmword [rbp + 0xf0], xmm7
movdqa xmmword [rbp + 0xe0], xmm6
mov qword [rbp + 0xd8], 0xfffffffffffffffe
mov r12, r8
mov rbx, rdx
mov qword [rbp + 0x58], rcx
mov rsi, qword [rdx + 0x18]
mov rdi, qword [rdx + 0x20]
test rsi, rsi
je 0x14001ace2
mov rax, qword [rdi + 0x30]
jmp 0x14001ace5
mov eax, dword [rdi + 0x34]
mov qword [rbp + 0xa8], rax
mov eax, dword [rdi + 0x50]
mov qword [rbp - 0x48], rax
mov r14, qword [0x140b65268]
test r14, r14
je 0x14001ad31
call sub.KERNEL32.dll_GetCurrentProcess
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x3000
lea rdx, [rbp + 0xa8]
lea r9, [rbp - 0x48]
mov rcx, rax
xor r8d, r8d
call r14
test eax, eax
jne 0x14001ad80
jmp 0x14001addd
lea rdx, str.ntdll.dllNtAllocateVirtualMemoryNtProtectVirtualMemorymemexec_srcpeparserheader.rs
lea rcx, [rbp + 0xb0]
mov r8d, 9
call fcn.14001a7a0
cmp dword [rbp + 0xb0], 0
jne 0x14001ad80
mov rdx, qword [rbp + 0xb8]
lea r8, [0x1409ff7b9]
lea rcx, [rbp + 0x88]
mov r9d, 0x17
call fcn.14001a880
cmp dword [rbp + 0x88], 0
je 0x14001bc40
mov qword [rbp + 0xa8], 0
mov r14, qword [0x140b65268]
test r14, r14
je 0x14001ae5b
call sub.KERNEL32.dll_GetCurrentProcess
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x3000
lea rdx, [rbp + 0xa8]
lea r9, [rbp - 0x48]
mov rcx, rax
xor r8d, r8d
call r14
test eax, eax
je 0x14001addd
movd xmm1, eax
movdqa xmm0, xmmword [reloc.WS2_32.dll_closesocket]
punpckldq xmm0, xmm1
jmp 0x14001bc63
mov r13, qword [rbx + 0x28]
mov rcx, qword [rbx + 0x30]
mov rax, rcx
mov qword [rbp - 8], rcx
test rcx, rcx
je 0x14001ae37
mov rbx, qword [rbx + 0x48]
mov rax, qword [rbp - 8]
lea rax, [rax*8]
lea r14, [rax + rax*4]
xor r15d, r15d
nop dword [rax + rax]
mov edx, dword [r13 + r15 + 0x14]
add rdx, rbx
mov ecx, dword [r13 + r15 + 0xc]
mov r8d, dword [r13 + r15 + 0x10]
add rcx, qword [rbp + 0xa8]
call sub.VCRUNTIME140.dll_memcpy
add r15, 0x28
cmp r14, r15
jne 0x14001ae10
mov rbx, qword [rbp + 0xa8]
test rsi, rsi
je 0x14001ae8e
lea rdx, [rdi + 0xb0]
mov rcx, qword [rdi + 0x30]
mov rax, rbx
sub rax, rcx
jne 0x14001aea4
jmp 0x14001af74
lea rdx, str.ntdll.dllNtAllocateVirtualMemoryNtProtectVirtualMemorymemexec_srcpeparserheader.rs
lea rcx, [rbp + 0xb0]
mov r8d, 9
call fcn.14001a7a0
cmp dword [rbp + 0xb0], 0
je 0x14001bc03
movq xmm0, qword [rbp + 0xb4]
jmp 0x14001bc63
lea rdx, [rdi + 0xa0]
mov ecx, dword [rdi + 0x34]
mov rax, rbx
sub rax, rcx
je 0x14001af74
mov ecx, dword [rdx]
test rcx, rcx
je 0x14001af74
cmp dword [rdx + 4], 0
je 0x14001af74
add rcx, rbx
mov edx, 1
mov r8d, dword [rcx + 4]
test r8, r8
jne 0x14001aee3
jmp 0x14001af64
xor r8d, r8d
add rcx, r8
mov r8d, dword [rcx + 4]
test r8, r8
je 0x14001af64
cmp r8d, 0xa
jb 0x14001af54
lea r9, [r8 - 8]
shr r9, 0x3f
add r8, r9
add r8, 0xfffffffffffffff8
sar r8, 1
cmp r8, 2
cmovl r8, rdx
xor r9d, r9d
jmp 0x14001af18
inc r9
cmp r8, r9
je 0x14001af50
movzx r10d, word [rcx + r9*2 + 8]
mov r11d, r10d
and r11d, 0xf000
cmp r11d, 0xa000
jne 0x14001af10
mov r11d, dword [rcx]
and r10d, 0xfff
add r11, rbx
add qword [r10 + r11], rax
jmp 0x14001af10
mov r8d, dword [rcx + 4]
add rcx, r8
mov r8d, dword [rcx + 4]
test r8, r8
jne 0x14001aee3
cmp dword [rcx], 0
jne 0x14001aed0
mov rbx, qword [rbp + 0xa8]
shl esi, 4
lea rax, [rdi + rsi]
add rax, 0x78
mov qword [rbp + 0x10], rax
cmp dword [rdi + rsi + 0x84], 0
mov qword [rbp + 0x40], r13
je 0x14001ba5f
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 8]
test rax, rax
je 0x14001ba5f
add rax, rbx
lea r14, [rbx + 2]
lea rcx, [r12 + 0x20]
mov qword [rbp - 0x18], rcx
lea r15, [rbp + 0xb0]
pcmpeqd xmm6, xmm6
movdqa xmm7, xmmword [0x1409ff730]
movdqa xmm8, xmmword [0x1409ff740]
movdqa xmm9, xmmword [0x1409ff750]
movdqa xmm10, xmmword [0x1409ff700]
movdqa xmm11, xmmword [0x1409ff710]
movdqa xmm12, xmmword [0x1409ff720]
mov rcx, rax
mov qword [rbp + 0x80], r12
mov qword [rbp + 0x30], rbx
mov qword [rbp - 0x30], r14
mov esi, dword [rcx + 0xc]
test rsi, rsi
mov rax, rcx
jne 0x14001b030
cmp dword [rax + 0x10], 0
jne 0x14001b030
cmp dword [rax], 0
jne 0x14001b030
cmp dword [rax + 4], 0
jne 0x14001b030
cmp dword [rax + 8], 0
je 0x14001ba5f
nop dword [rax]
mov qword [rbp - 0x10], rax
add rsi, rbx
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
lea r8, [rax + 1]
mov rcx, r15
mov rdx, rsi
call fcn.1401fc510
cmp qword [rbp + 0xb0], 0
jne 0x14001bc36
mov rdx, qword [rbp + 0xb8]
mov r8, qword [rbp + 0xc0]
mov rcx, r15
mov qword [rbp - 0x28], rdx
mov qword [rbp + 0x28], r8
call fcn.14001a7a0
cmp dword [rbp + 0xb0], 0
jne 0x14001bcbf
mov rcx, qword [rbp - 0x10]
mov eax, dword [rcx]
mov ecx, dword [rcx + 0x10]
lea rdx, [rbx + rcx]
lea r8, [rbx + rax]
test rax, rax
cmove rax, rcx
cmove r8, rdx
mov rax, qword [rbx + rax]
test rax, rax
je 0x14001ba34
mov r9, rax
mov qword [rbp - 0x38], r8
mov qword [rbp - 0x40], rdx
mov rax, qword [rbp + 0xb8]
mov qword [rbp + 0x50], rax
mov rcx, qword [rbp + 0x28]
mov rdx, rcx
movabs rax, 0x7fffffffffffffe0
and rdx, rax
mov qword [rbp - 0x20], rdx
movabs rax, 0x7ffffffffffffff8
and rcx, rax
mov qword [rbp], rcx
mov rsi, rdi
mov rdi, r9
jmp 0x14001b172
lea rax, [r12 + r12*2]
shl rax, 4
mov rcx, qword [rbp + 0x78]
mov rdi, qword [rcx + rax - 8]
mov r12, qword [rbp + 0x80]
mov r13, qword [rbp + 0x40]
mov rbx, qword [rbp + 0x30]
lea r15, [rbp + 0xb0]
mov rsi, qword [rbp + 0x48]
mov rdx, qword [rbp + 0xb0]
test rdx, rdx
mov r14, qword [rbp - 0x30]
je 0x14001b144
mov rcx, qword [rbp + 0xb8]
mov r8d, 1
call fcn.14001a130
mov rax, rsi
mov rcx, qword [rbp - 0x40]
mov qword [rcx], rdi
add rcx, 8
mov qword [rbp - 0x40], rcx
mov rcx, qword [rbp - 0x38]
mov rdi, qword [rcx + 8]
add rcx, 8
mov qword [rbp - 0x38], rcx
mov rsi, rax
test rdi, rdi
je 0x14001ba40
test rdi, rdi
js 0x14001b240
cmp byte [r14 + rdi], 0
je 0x14001ba39
add rdi, r14
mov rcx, rdi
test r12, r12
je 0x14001b2c0
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
lea r8, [rax + 1]
lea rcx, [rbp + 0x88]
mov rdx, rdi
call fcn.1401fc510
cmp qword [rbp + 0x88], 0
jne 0x14001bc36
mov rbx, qword [rbp + 0x90]
mov r14, qword [rbp + 0x98]
mov r15, qword [rbp + 0x28]
test r15, r15
mov qword [rbp + 0x48], rsi
mov qword [rbp + 0x38], rdi
je 0x14001b336
js 0x14001bd68
movzx eax, byte [0x140b65265]
mov edx, 1
mov rcx, r15
call fcn.14001a120
test rax, rax
mov r13, qword [rbp - 0x20]
je 0x14001bd6d
mov rdi, rax
mov rsi, rax
mov rcx, rdi
mov rdx, qword [rbp - 0x28]
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
mov rax, rdi
cmp r15, 8
jb 0x14001b4e3
cmp r15, 0x20
jae 0x14001b34a
xor ecx, ecx
jmp 0x14001b3c3
test r12, r12
je 0x14001b319
mov rbx, qword [rbp + 0x28]
test rbx, rbx
mov qword [rbp + 0x48], rsi
je 0x14001b340
js 0x14001bd68
mov r13, rdi
movzx eax, byte [0x140b65265]
mov edx, 1
mov rcx, rbx
call fcn.14001a120
test rax, rax
mov r14, qword [rbp - 0x20]
mov r15, qword [rbp]
je 0x14001bd7a
mov rdi, rax
mov rsi, rax
mov rcx, rdi
mov rdx, qword [rbp - 0x28]
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rax, rdi
cmp rbx, 8
jb 0x14001b78d
cmp rbx, 0x20
jae 0x14001b40f
xor ecx, ecx
jmp 0x14001b492
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
lea r8, [rax + 1]
mov rcx, r15
mov rdx, rdi
call fcn.1401fc510
cmp qword [rbp + 0xb0], 0
jne 0x14001bc36
mov r8, qword [rbp + 0xb8]
mov r9, qword [rbp + 0xc0]
lea rcx, [rbp + 0x88]
mov rdx, qword [rbp + 0x50]
call fcn.14001a880
cmp dword [rbp + 0x88], 0
jne 0x14001bcb1
mov rdi, qword [rbp + 0x90]
jmp 0x14001b144
movzx edx, di
mov rcx, qword [rbp + 0x50]
call sub.KERNEL32.dll_GetProcAddress
mov rdi, rax
test rax, rax
jne 0x14001b147
jmp 0x14001bcf6
mov esi, 1
jmp 0x14001b50f
mov esi, 1
jmp 0x14001b7b2
xor eax, eax
nop dword [rax]
movdqu xmm0, xmmword [rsi + rax]
movdqu xmm1, xmmword [rsi + rax + 0x10]
movdqa xmm2, xmm0
paddb xmm2, xmm10
movdqa xmm3, xmm1
paddb xmm3, xmm10
movdqa xmm4, xmm2
pminub xmm4, xmm11
pcmpeqb xmm4, xmm2
pand xmm4, xmm12
movdqa xmm2, xmm3
pminub xmm2, xmm11
pcmpeqb xmm2, xmm3
pand xmm2, xmm12
por xmm4, xmm0
por xmm2, xmm1
movdqu xmmword [rsi + rax], xmm4
movdqu xmmword [rsi + rax + 0x10], xmm2
add rax, 0x20
cmp r13, rax
jne 0x14001b350
cmp r15, r13
je 0x14001b50f
mov rcx, r13
test r15b, 0x18
je 0x14001b4df
mov rdx, qword [rbp]
lea rax, [rdi + rdx]
nop dword [rax + rax]
movq xmm0, qword [rsi + rcx]
movdqa xmm1, xmm0
paddb xmm1, xmm7
movdqa xmm2, xmm1
pmaxub xmm2, xmm8
pcmpeqb xmm2, xmm1
pandn xmm2, xmm9
por xmm2, xmm0
movq qword [rsi + rcx], xmm2
add rcx, 8
cmp rdx, rcx
jne 0x14001b3d0
cmp r15, rdx
jne 0x14001b4e3
jmp 0x14001b50f
xor eax, eax
nop word cs:[rax + rax]
movdqu xmm0, xmmword [rsi + rax]
movdqu xmm1, xmmword [rsi + rax + 0x10]
movdqa xmm2, xmm0
paddb xmm2, xmm10
movdqa xmm3, xmm1
paddb xmm3, xmm10
movdqa xmm4, xmm2
pminub xmm4, xmm11
pcmpeqb xmm4, xmm2
pand xmm4, xmm12
movdqa xmm2, xmm3
pminub xmm2, xmm11
pcmpeqb xmm2, xmm3
pand xmm2, xmm12
por xmm4, xmm0
por xmm2, xmm1
movdqu xmmword [rsi + rax], xmm4
movdqu xmmword [rsi + rax + 0x10], xmm2
add rax, 0x20
cmp r14, rax
jne 0x14001b420
cmp rbx, r14
je 0x14001b7af
mov rcx, r14
test bl, 0x18
je 0x14001b789
lea rax, [rdi + r15]
nop word cs:[rax + rax]
movq xmm0, qword [rsi + rcx]
movdqa xmm1, xmm0
paddb xmm1, xmm7
movdqa xmm2, xmm1
pmaxub xmm2, xmm8
pcmpeqb xmm2, xmm1
pandn xmm2, xmm9
por xmm2, xmm0
movq qword [rsi + rcx], xmm2
add rcx, 8
cmp r15, rcx
jne 0x14001b4a0
cmp rbx, r15
jne 0x14001b78d
jmp 0x14001b7af
lea rax, [rdi + r13]
add rdi, r15
nop word cs:[rax + rax]
movzx ecx, byte [rax]
lea edx, [rcx - 0x41]
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, cl
mov byte [rax], dl
lea rcx, [rax + 1]
mov rax, rcx
cmp rcx, rdi
jne 0x14001b4f0
mov qword [rbp + 0xb0], r15
mov qword [rbp + 0xb8], rsi
mov qword [rbp + 0xc0], r15
mov qword [rbp + 0xc8], rbx
mov qword [rbp + 0xd0], r14
cmp qword [r12 + 0x18], 0
je 0x14001b700
mov rcx, qword [rbp - 0x18]
lea rdx, [rbp + 0xb0]
call fcn.140016930
mov r14, rax
mov rax, qword [rbp + 0x80]
mov rcx, qword [rax]
mov r15, qword [rax + 8]
mov rax, r14
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm13, xmm0, 0
mov qword [rbp + 0x78], rcx
lea r13, [rcx - 0x30]
mov rax, qword [rbp + 0xb8]
mov qword [rbp + 0x60], rax
mov rbx, qword [rbp + 0xc0]
mov rax, qword [rbp + 0xc8]
mov qword [rbp + 0x70], rax
mov rax, qword [rbp + 0xd0]
mov qword [rbp + 0xa0], rax
xor eax, eax
nop
mov qword [rbp + 0x68], rax
and r14, r15
mov rax, qword [rbp + 0x78]
movdqu xmm14, xmmword [rax + r14]
movdqa xmm0, xmm14
pcmpeqb xmm0, xmm13
pmovmskb edi, xmm0
test edi, edi
je 0x14001b6d0
cmp qword [rbp + 0x70], 0
jne 0x14001b5fe
jmp 0x14001b67a
lea eax, [rdi - 1]
and ax, di
mov edi, eax
je 0x14001b6d0
tzcnt r12d, edi
add r12, r14
and r12, r15
neg r12
lea rsi, [r12 + r12*2]
shl rsi, 4
cmp rbx, qword [r13 + rsi + 0x10]
jne 0x14001b5f0
add rsi, r13
mov rdx, qword [rsi + 8]
mov rcx, qword [rbp + 0x60]
mov r8, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001b5f0
mov rdx, qword [rsi + 0x18]
test rdx, rdx
je 0x14001b5f0
mov rax, qword [rbp + 0xa0]
cmp rax, qword [rsi + 0x20]
jne 0x14001b5f0
mov rcx, qword [rbp + 0x70]
mov r8, qword [rbp + 0xa0]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001b5f0
jmp 0x14001b0f7
lea eax, [rdi - 1]
and ax, di
mov edi, eax
je 0x14001b6d0
tzcnt r12d, edi
add r12, r14
and r12, r15
neg r12
lea rsi, [r12 + r12*2]
shl rsi, 4
cmp rbx, qword [r13 + rsi + 0x10]
jne 0x14001b670
add rsi, r13
mov rdx, qword [rsi + 8]
mov rcx, qword [rbp + 0x60]
mov r8, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001b670
cmp qword [rsi + 0x18], 0
jne 0x14001b670
mov rax, qword [rbp + 0xa0]
cmp rax, qword [rsi + 0x20]
jne 0x14001b670
jmp 0x14001b0f7
pcmpeqb xmm14, xmm6
pmovmskb eax, xmm14
test eax, eax
jne 0x14001b700
mov rax, qword [rbp + 0x68]
add r14, rax
add r14, 0x10
add rax, 0x10
jmp 0x14001b5b0
mov rsi, qword [rbp + 0x38]
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
lea r8, [rax + 1]
lea rcx, [rbp + 0x88]
mov rdx, rsi
call fcn.1401fc510
mov r12, qword [rbp + 0x80]
mov r13, qword [rbp + 0x40]
mov rbx, qword [rbp + 0x30]
lea r15, [rbp + 0xb0]
mov rsi, qword [rbp + 0x48]
cmp qword [rbp + 0x88], 0
jne 0x14001bc84
mov r8, qword [rbp + 0x90]
mov r9, qword [rbp + 0x98]
lea rcx, [rbp + 0x18]
mov rdx, qword [rbp + 0x50]
call fcn.14001a880
cmp dword [rbp + 0x18], 0
jne 0x14001bc8b
mov rdi, qword [rbp + 0x20]
mov rdx, qword [rbp + 0xb0]
test rdx, rdx
mov r14, qword [rbp - 0x30]
jne 0x14001b132
jmp 0x14001b144
lea rax, [rdi + r14]
add rdi, rbx
movzx ecx, byte [rax]
lea edx, [rcx - 0x41]
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, cl
mov byte [rax], dl
lea rcx, [rax + 1]
mov rax, rcx
cmp rcx, rdi
jne 0x14001b790
mov rdi, r13
movzx eax, di
mov qword [rbp + 0xb0], rbx
mov qword [rbp + 0xb8], rsi
mov qword [rbp + 0xc0], rbx
mov qword [rbp + 0xc8], 0
mov qword [rbp + 0x38], rax
mov qword [rbp + 0xd0], rax
cmp qword [r12 + 0x18], 0
je 0x14001b9a2
mov rcx, qword [rbp - 0x18]
lea rdx, [rbp + 0xb0]
call fcn.140016930
mov r14, rax
mov rax, qword [rbp + 0x80]
mov rcx, qword [rax]
mov r15, qword [rax + 8]
mov rax, r14
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm13, xmm0, 0
mov qword [rbp + 0x78], rcx
lea r13, [rcx - 0x30]
mov rax, qword [rbp + 0xb8]
mov qword [rbp + 0x60], rax
mov rbx, qword [rbp + 0xc0]
mov rax, qword [rbp + 0xc8]
mov qword [rbp + 0x70], rax
mov rax, qword [rbp + 0xd0]
mov qword [rbp + 0xa0], rax
xor eax, eax
nop dword [rax]
mov qword [rbp + 0x68], rax
and r14, r15
mov rax, qword [rbp + 0x78]
movdqu xmm14, xmmword [rax + r14]
movdqa xmm0, xmm14
pcmpeqb xmm0, xmm13
pmovmskb edi, xmm0
test edi, edi
je 0x14001b980
cmp qword [rbp + 0x70], 0
jne 0x14001b8ae
jmp 0x14001b92a
lea eax, [rdi - 1]
and ax, di
mov edi, eax
je 0x14001b980
tzcnt r12d, edi
add r12, r14
and r12, r15
neg r12
lea rsi, [r12 + r12*2]
shl rsi, 4
cmp rbx, qword [r13 + rsi + 0x10]
jne 0x14001b8a0
add rsi, r13
mov rdx, qword [rsi + 8]
mov rcx, qword [rbp + 0x60]
mov r8, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001b8a0
mov rdx, qword [rsi + 0x18]
test rdx, rdx
je 0x14001b8a0
mov rax, qword [rbp + 0xa0]
cmp rax, qword [rsi + 0x20]
jne 0x14001b8a0
mov rcx, qword [rbp + 0x70]
mov r8, qword [rbp + 0xa0]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001b8a0
jmp 0x14001ba03
lea eax, [rdi - 1]
and ax, di
mov edi, eax
je 0x14001b980
tzcnt r12d, edi
add r12, r14
and r12, r15
neg r12
lea rsi, [r12 + r12*2]
shl rsi, 4
cmp rbx, qword [r13 + rsi + 0x10]
jne 0x14001b920
add rsi, r13
mov rdx, qword [rsi + 8]
mov rcx, qword [rbp + 0x60]
mov r8, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001b920
cmp qword [rsi + 0x18], 0
jne 0x14001b920
mov rax, qword [rbp + 0xa0]
cmp rax, qword [rsi + 0x20]
jne 0x14001b920
jmp 0x14001ba03
pcmpeqb xmm14, xmm6
pmovmskb eax, xmm14
test eax, eax
jne 0x14001b9a2
mov rax, qword [rbp + 0x68]
add r14, rax
add r14, 0x10
add rax, 0x10
jmp 0x14001b860
mov rcx, qword [rbp + 0x50]
mov rdx, qword [rbp + 0x38]
call sub.KERNEL32.dll_GetProcAddress
mov rsi, rax
mov rdi, rax
test rax, rax
mov r12, qword [rbp + 0x80]
lea r15, [rbp + 0xb0]
je 0x14001bccd
mov rdx, qword [rbp + 0xb0]
test rdx, rdx
je 0x14001b9ea
mov rcx, qword [rbp + 0xb8]
mov r8d, 1
call fcn.14001a130
mov qword [rbp + 8], rsi
mov rax, qword [rbp + 0x48]
mov r13, qword [rbp + 0x40]
mov rbx, qword [rbp + 0x30]
mov r14, qword [rbp - 0x30]
jmp 0x14001b147
lea rax, [r12 + r12*2]
shl rax, 4
mov rcx, qword [rbp + 0x78]
mov rdi, qword [rcx + rax - 8]
mov rsi, qword [rbp + 8]
mov r12, qword [rbp + 0x80]
lea r15, [rbp + 0xb0]
mov rdx, qword [rbp + 0xb0]
test rdx, rdx
jne 0x14001b9d8
jmp 0x14001b9ea
mov rax, rdi
jmp 0x14001ba40
mov rax, rsi
nop dword [rax]
mov rcx, qword [rbp - 0x10]
add rcx, 0x14
mov rdi, rax
mov esi, dword [rcx + 0xc]
test rsi, rsi
mov rax, rcx
jne 0x14001b030
jmp 0x14001b012
mov rax, qword [rbp - 8]
test rax, rax
je 0x14001bba6
shl rax, 3
lea rbx, [rax + rax*4]
xor esi, esi
lea rdi, [rbp + 0xb0]
lea r15, [rbp + 0x18]
lea r12, [rbp - 0x50]
jmp 0x14001ba9d
add rsi, 0x28
cmp rbx, rsi
je 0x14001bba6
mov eax, dword [r13 + rsi + 0x10]
mov qword [rbp - 0x50], rax
test rax, rax
je 0x14001ba90
mov eax, dword [r13 + rsi + 0xc]
add rax, qword [rbp + 0xa8]
mov qword [rbp + 0x18], rax
mov eax, dword [r13 + rsi + 0x24]
test eax, 0x20000000
jne 0x14001baf0
mov r13d, 1
test eax, 0x40000000
je 0x14001bb09
shr eax, 0x1f
lea r13d, [rax*2 + 2]
jmp 0x14001bb09
mov r13d, reloc.WS2_32.dll_recv
test eax, 0x40000000
je 0x14001bb09
shr eax, 0x1a
and eax, 0xffffffe0
add eax, 0x20
mov r13d, eax
mov r14, qword [0x140b65270]
test r14, r14
jne 0x14001bb72
mov r8d, 9
mov rcx, rdi
lea rdx, str.ntdll.dllNtAllocateVirtualMemoryNtProtectVirtualMemorymemexec_srcpeparserheader.rs
call fcn.14001a7a0
cmp dword [rbp + 0xb0], 0
jne 0x14001ae81
mov rdx, qword [rbp + 0xb8]
mov r9d, 0x16
lea rcx, [rbp + 0x88]
lea r8, [0x1409ff7d0]
call fcn.14001a880
cmp dword [rbp + 0x88], 0
jne 0x14001bc2c
mov r14, qword [rbp + 0x90]
mov qword [0x140b65270], r14
mov dword [rbp + 0xb0], 0
call sub.KERNEL32.dll_GetCurrentProcess
mov qword [rsp + 0x20], rdi
mov rcx, rax
mov rdx, r15
mov r8, r12
mov r9d, r13d
call r14
test eax, eax
jne 0x14001bc53
mov r13, qword [rbp + 0x40]
jmp 0x14001ba90
mov rsi, qword [rbp + 0xa8]
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x4c], 0
je 0x14001bbf0
mov eax, dword [rax + 0x48]
test rax, rax
je 0x14001bbf0
mov rdi, qword [rsi + rax + 0x18]
mov rax, qword [rdi]
test rax, rax
je 0x14001bbf0
add rdi, 8
mov rcx, rsi
mov edx, 2
xor r8d, r8d
call rax
mov rax, qword [rdi]
add rdi, 8
test rax, rax
jne 0x14001bbd0
mov rsi, qword [rbp + 0xa8]
mov rax, qword [rbp + 0x58]
mov qword [rax + 8], rsi
mov dword [rax], 0
jmp 0x14001bd0e
mov rdx, qword [rbp + 0xb8]
lea r8, [0x1409ff7b9]
lea rcx, [rbp + 0x88]
mov r9d, 0x17
call fcn.14001a880
cmp dword [rbp + 0x88], 0
je 0x14001bc71
movq xmm0, qword [rbp + 0x8c]
jmp 0x14001bc63
mov esi, 5
jmp 0x14001bcfe
mov r14, qword [rbp + 0x90]
mov qword [0x140b65268], r14
jmp 0x14001acff
movd xmm1, eax
movdqa xmm0, xmmword [reloc.WS2_32.dll_connect]
punpckldq xmm0, xmm1
mov rax, qword [rbp + 0x58]
movq qword [rax + 4], xmm0
jmp 0x14001bd08
mov r14, qword [rbp + 0x90]
mov qword [0x140b65268], r14
jmp 0x14001ad9b
mov esi, 5
jmp 0x14001bc91
mov esi, dword [rbp + 0x1c]
mov edi, dword [rbp + 0x20]
mov rdx, qword [rbp + 0xb0]
test rdx, rdx
je 0x14001bcfe
mov rcx, qword [rbp + 0xb8]
mov r8d, 1
call fcn.14001a130
jmp 0x14001bcfe
mov esi, dword [rbp + 0x8c]
mov edi, dword [rbp + 0x90]
jmp 0x14001bcfe
mov esi, dword [rbp + 0xb4]
mov edi, dword [rbp + 0xb8]
jmp 0x14001bcfe
mov rdx, qword [rbp + 0xb0]
test rdx, rdx
je 0x14001bceb
mov rcx, qword [rbp + 0xb8]
mov r8d, 1
call fcn.14001a130
mov esi, 2
mov rdi, qword [rbp + 8]
jmp 0x14001bcfe
mov rdi, rsi
mov esi, 2
mov rax, qword [rbp + 0x58]
mov dword [rax + 4], esi
mov dword [rax + 8], edi
mov dword [rax], 1
movaps xmm6, xmmword [rbp + 0xe0]
movaps xmm7, xmmword [rbp + 0xf0]
movaps xmm8, xmmword [rbp + 0x100]
movaps xmm9, xmmword [rbp + 0x110]
movaps xmm10, xmmword [rbp + 0x120]
movaps xmm11, xmmword [rbp + 0x130]
movaps xmm12, xmmword [rbp + 0x140]
movaps xmm13, xmmword [rbp + 0x150]
movaps xmm14, xmmword [rbp + 0x160]
add rsp, 0x1f8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.1401f9dd0
mov ecx, 1
mov rdx, r15
call fcn.14021cf70
mov ecx, 1
mov rdx, rbx
call fcn.14021cf70
int3