Function at 0x398127330
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbp
mov rbp, rsp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
and rsp, 0xfffffffffffffff0
sub rsp, 0xc10
mov rax, qword [rcx + 0x1a8]
mov qword [rbp + 0x10], rcx
mov dword [rsp + 0x94], pe_nt_image_headers64
cmp qword [rax + 0x118], 0
je 0x39812736f
call fcn.398122050
lea rax, [rsp + 0x94]
lea r14, [rsp + 0x630]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0xa0]
mov r15, r14
mov qword [rsp + 0x60], rax
nop dword [rax]
mov rax, qword [rsp + 0x58]
xor r9d, r9d
mov r8d, 0x5dc
mov rdx, r15
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax]
call qword [sym.imp.WS2_32.dll_recvfrom]
mov ebx, eax
mov rax, qword [rbp + 0x10]
test ebx, ebx
js 0x398127c50
mov rcx, qword [rsp + 0x60]
lea rdx, [rax + 8]
xor r8d, r8d
call fcn.398124770
mov dword [rsp + 0x70], eax
test eax, eax
jne 0x398127c66
mov dword [rsp + 0x9c], 0
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x90], 0
mov rax, qword [rax + 0x1a8]
cmp qword [rax + 0x118], 0
mov qword [rsp + 0x80], rax
je 0x398127427
call fcn.398122050
cmp ebx, 1
jle 0x398127398
movzx ecx, word [rsp + 0x630]
call qword [sym.imp.WS2_32.dll_ntohs]
mov esi, eax
cmp ebx, 3
jle 0x398127398
movzx ecx, word [rsp + 0x632]
call qword [sym.imp.WS2_32.dll_ntohs]
mov word [rsp + 0x6c], ax
cmp ebx, 5
jle 0x398127398
movzx ecx, word [rsp + 0x634]
call qword [sym.imp.WS2_32.dll_ntohs]
mov r14d, eax
cmp ebx, 7
jle 0x398127398
movzx ecx, word [rsp + 0x636]
call qword [sym.imp.WS2_32.dll_ntohs]
mov word [rsp + 0x68], ax
cmp ebx, 9
jle 0x398127398
movzx ecx, word [rsp + 0x638]
call qword [sym.imp.WS2_32.dll_ntohs]
mov word [rsp + 0x52], ax
cmp ebx, 0xb
jle 0x398127398
movzx ecx, word [rsp + 0x63a]
mov dword [rsp + 0x98], 0xc
call qword [sym.imp.WS2_32.dll_ntohs]
mov rcx, qword [rsp + 0x80]
movzx eax, si
cdq
idiv dword [rcx + 0x18]
mov rax, qword [rcx]
cmp qword [rcx + 0x118], 0
movsxd rdx, edx
mov rdi, qword [rax + rdx*8]
je 0x3981274f8
call fcn.398122050
test rdi, rdi
je 0x398127398
mov r12, rdi
jmp 0x39812751e
mov r12, qword [r12 + 0x30]
cmp rdi, r12
je 0x398127398
cmp si, word [r12 + 0xb8]
jne 0x398127510
lea rdi, [rsp + 0x420]
xor eax, eax
mov ecx, 0x41
cmp word [rsp + 0x6c], 0
mov qword [rsp + 0x48], rdi
rep stosq qword [rdi], rax
mov dword [rdi], 0
jns 0x398127398
mov eax, dword [rsp + 0x6c]
and eax, 0x20f
je 0x398127566
cmp eax, 3
jne 0x398127680
movzx eax, byte [r12 + 8]
mov dword [rsp + 0x420], eax
movzx eax, r14w
mov dword [rsp + 0x78], eax
test eax, eax
je 0x398127680
lea rdi, [rsp + 0x98]
mov eax, 0xc
xor esi, esi
mov qword [rsp + 0x88], rdi
lea r14, [rsp + 0x220]
lea rdi, [rsp + 0x320]
lea r13, [rsp + 0x9c]
jmp 0x3981275ef
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x3981275c9
mov dword [rsp + 0x70], 1
mov eax, dword [rsp + 0x98]
add eax, 4
mov dword [rsp + 0x98], eax
cmp ebx, eax
jl 0x398127680
add esi, 1
cmp esi, dword [rsp + 0x78]
je 0x3981276a0
mov dword [rsp + 0x20], 0x100
mov r9, r14
mov edx, ebx
mov rcx, r15
mov r8, qword [rsp + 0x88]
mov byte [rsp + 0x220], 0
mov byte [rsp + 0x320], 0
mov dword [rsp + 0x9c], eax
call fcn.398126c90
test eax, eax
js 0x398127680
mov edx, dword [r12 + 0xc]
mov dword [rsp + 0x20], 0x100
mov r9, rdi
mov r8, r13
mov rcx, qword [r12]
call fcn.398126c90
test eax, eax
js 0x398127680
mov rax, qword [rsp + 0x80]
mov rdx, rdi
mov rcx, r14
mov r8d, dword [rax + 0x4c]
test r8d, r8d
je 0x3981275b8
call fcn.398122600
test eax, eax
je 0x3981275c1
jmp 0x3981275c9
mov r12, qword [rsp + 0x70]
nop dword [rax]
movzx edx, word [rsp + 0x6c]
xor r9d, r9d
xor r8d, r8d
mov rcx, r12
call fcn.3981283b0
jmp 0x398127398
mov eax, dword [rsp + 0x70]
test eax, eax
je 0x398127680
movzx eax, word [rsp + 0x68]
mov dword [rsp + 0x40], eax
test eax, eax
je 0x398127d17
lea rax, [rsp + 0x120]
mov dword [rsp + 0x54], 0xffffffff
mov dword [rsp + 0x80], 0
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r14
mov dword [rsp + 0x20], 0x100
mov r9, qword [rsp + 0x78]
mov edx, ebx
mov rcx, r15
mov r8, qword [rsp + 0x88]
mov byte [rsp + 0x220], 0
call fcn.398126c90
test eax, eax
js 0x398127678
mov r14d, dword [rsp + 0x98]
lea eax, [r14 + 1]
cmp ebx, eax
jle 0x398127678
movsxd rax, r14d
lea edi, [r14 + 2]
movzx ecx, word [rsp + rax + 0x630]
call qword [sym.imp.WS2_32.dll_ntohs]
mov esi, eax
lea eax, [r14 + 3]
cmp ebx, eax
jle 0x398127678
movsxd rdi, edi
lea r12d, [r14 + 4]
movzx ecx, word [rsp + rdi + 0x630]
call qword [sym.imp.WS2_32.dll_ntohs]
mov edi, eax
lea eax, [r14 + 7]
cmp ebx, eax
jle 0x398127678
movsxd r12, r12d
lea r13d, [r14 + 8]
mov ecx, dword [rsp + r12 + 0x630]
call qword [sym.imp.WS2_32.dll_ntohl]
mov dword [rsp + 0x68], eax
lea eax, [r14 + 9]
cmp ebx, eax
jle 0x398127678
movsxd r13, r13d
lea r12d, [r14 + 0xa]
movzx ecx, word [rsp + r13 + 0x630]
mov dword [rsp + 0x98], r12d
call qword [sym.imp.WS2_32.dll_ntohs]
cmp di, 1
sete cl
cmp si, 1
jne 0x398127ae0
test cl, cl
je 0x398127ae0
mov rsi, qword [rsp + 0x70]
cmp byte [rsi + 8], 1
jne 0x398127afd
test al, 3
jne 0x398127d0f
mov ecx, dword [rsp + 0x428]
shr ax, 2
mov esi, 0x20
mov edi, dword [rsp + 0x54]
movzx eax, ax
sub esi, ecx
cmp esi, eax
cmova esi, eax
mov eax, dword [rsp + 0x68]
cmp edi, eax
lea r8d, [rsi*4]
cmovbe eax, edi
lea edi, [r12 + r8]
mov dword [rsp + 0x54], eax
cmp ebx, edi
jl 0x398127678
mov rax, qword [rsp + 0x48]
movsxd rdx, r12d
movsxd r8, r8d
add rdx, r15
lea rcx, [rax + rcx*4 + 0xc]
call sub.msvcrt.dll_memcpy
mov eax, dword [rsp + 0x428]
or byte [rsp + 0x424], 1
mov dword [rsp + 0x98], edi
add eax, esi
mov dword [rsp + 0x428], eax
cmp eax, 0x20
je 0x398127873
add dword [rsp + 0x80], 1
mov eax, dword [rsp + 0x80]
cmp eax, dword [rsp + 0x40]
jne 0x3981276e3
mov r12, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
test byte [rsp + 0x424], 1
jne 0x398127b68
movzx eax, word [rsp + 0x52]
mov dword [rsp + 0x68], eax
test eax, eax
je 0x398127b68
mov dword [rsp + 0x80], 0
mov qword [rsp + 0x40], r12
jmp 0x3981279f4
cmp word [rsp + 0x78], 1
jne 0x398127aca
mov dword [rsp + 0x20], 0x100
mov r9, r14
mov edx, ebx
mov rcx, r15
mov r8, qword [rsp + 0x88]
mov byte [rsp + 0x220], 0
call fcn.398126c90
test eax, eax
js 0x398127cd9
mov dword [rsp + 0x20], 0x100
mov edx, ebx
mov rcx, r15
mov byte [rsp + 0x220], 0
call fcn.398126c90
test eax, eax
js 0x398127cd9
mov r13d, dword [rsp + 0x98]
lea eax, [r13 + 3]
cmp ebx, eax
jle 0x398127cd9
movsxd rax, r13d
lea r12d, [r13 + 4]
mov ecx, dword [rsp + rax + 0x630]
call qword [sym.imp.WS2_32.dll_ntohl]
lea eax, [r13 + 7]
cmp ebx, eax
jle 0x398127cd9
movsxd r12, r12d
lea esi, [r13 + 8]
mov ecx, dword [rsp + r12 + 0x630]
call qword [sym.imp.WS2_32.dll_ntohl]
lea eax, [r13 + 0xb]
cmp ebx, eax
jle 0x398127cd9
movsxd rsi, esi
lea r12d, [r13 + 0xc]
mov ecx, dword [rsp + rsi + 0x630]
call qword [sym.imp.WS2_32.dll_ntohl]
lea eax, [r13 + 0xf]
cmp ebx, eax
jle 0x398127cd9
movsxd r12, r12d
lea esi, [r13 + 0x10]
mov ecx, dword [rsp + r12 + 0x630]
call qword [sym.imp.WS2_32.dll_ntohl]
lea eax, [r13 + 0x13]
cmp ebx, eax
jle 0x398127cd9
movsxd rsi, esi
add r13d, 0x14
mov ecx, dword [rsp + rsi + 0x630]
mov dword [rsp + 0x98], r13d
call qword [sym.imp.WS2_32.dll_ntohl]
mov edi, dword [rsp + 0x54]
mov esi, dword [rsp + 0x70]
cmp esi, edi
cmovbe edi, esi
cmp eax, edi
cmovbe edi, eax
mov dword [rsp + 0x54], edi
add dword [rsp + 0x80], 1
mov eax, dword [rsp + 0x80]
cmp dword [rsp + 0x68], eax
jbe 0x398127d05
mov dword [rsp + 0x20], 0x100
mov r9, r14
mov edx, ebx
mov rcx, r15
mov r8, qword [rsp + 0x88]
mov byte [rsp + 0x220], 0
call fcn.398126c90
test eax, eax
js 0x398127cd9
mov r13d, dword [rsp + 0x98]
lea eax, [r13 + 1]
cmp ebx, eax
jle 0x398127cd9
movsxd rax, r13d
lea r12d, [r13 + 2]
movzx ecx, word [rsp + rax + 0x630]
call qword [sym.imp.WS2_32.dll_ntohs]
mov esi, eax
lea eax, [r13 + 3]
cmp ebx, eax
jle 0x398127cd9
movsxd r12, r12d
lea edi, [r13 + 4]
movzx ecx, word [rsp + r12 + 0x630]
call qword [sym.imp.WS2_32.dll_ntohs]
mov word [rsp + 0x78], ax
lea eax, [r13 + 7]
cmp ebx, eax
jle 0x398127cd9
movsxd rdi, edi
lea r12d, [r13 + 8]
mov ecx, dword [rsp + rdi + 0x630]
call qword [sym.imp.WS2_32.dll_ntohl]
mov dword [rsp + 0x70], eax
lea eax, [r13 + 9]
cmp ebx, eax
jle 0x398127cd9
movsxd r12, r12d
lea edi, [r13 + 0xa]
movzx ecx, word [rsp + r12 + 0x630]
mov dword [rsp + 0x98], edi
call qword [sym.imp.WS2_32.dll_ntohs]
cmp si, 6
je 0x3981278b8
movzx eax, ax
add eax, edi
mov dword [rsp + 0x98], eax
jmp 0x3981279db
cmp si, 0xc
jne 0x398127b90
test cl, cl
je 0x398127b90
mov rsi, qword [rsp + 0x70]
cmp byte [rsi + 8], 0xc
je 0x398127b0f
movzx eax, ax
add eax, r12d
mov dword [rsp + 0x98], eax
jmp 0x39812785a
mov dword [rsp + 0x20], 0xff
mov edx, ebx
mov rcx, r15
mov r12, rsi
mov r8, qword [rsp + 0x88]
lea r9, [rsp + 0x428]
mov r14, qword [rsp + 0x78]
call fcn.398126c90
test eax, eax
js 0x398127680
mov esi, dword [rsp + 0x54]
mov eax, dword [rsp + 0x68]
cmp esi, eax
cmovbe eax, esi
or byte [rsp + 0x424], 1
mov dword [rsp + 0x54], eax
test byte [rsp + 0x424], 1
je 0x39812788b
cmp dword [rsp + 0x54], 0xffffffff
je 0x398127cf8
movzx edx, word [rsp + 0x6c]
mov r9, qword [rsp + 0x48]
mov rcx, r12
mov r8d, dword [rsp + 0x54]
call fcn.3981283b0
jmp 0x398127398
cmp si, 5
je 0x398127c77
cmp si, 0x1c
jne 0x398127afd
test cl, cl
je 0x398127afd
mov rsi, qword [rsp + 0x70]
cmp byte [rsi + 8], 0x1c
jne 0x398127afd
test al, 0xf
jne 0x398127d0f
mov r9d, dword [rsp + 0x428]
shr ax, 4
mov esi, 0x20
mov edi, dword [rsp + 0x54]
movzx ecx, ax
mov eax, dword [rsp + 0x68]
sub esi, r9d
cmp esi, ecx
cmova esi, ecx
cmp edi, eax
cmovbe eax, edi
mov r8d, esi
shl r8d, 4
mov dword [rsp + 0x54], eax
lea edi, [r12 + r8]
cmp ebx, edi
jl 0x398127678
mov rdx, qword [rsp + 0x48]
mov eax, r9d
movsxd r8, r8d
shl rax, 4
lea rcx, [rdx + rax + 0xc]
movsxd rdx, r12d
add rdx, r15
call sub.msvcrt.dll_memcpy
add esi, dword [rsp + 0x428]
or byte [rsp + 0x424], 1
mov dword [rsp + 0x428], esi
mov dword [rsp + 0x98], edi
cmp esi, 0x20
jne 0x39812785a
jmp 0x398127873
mov rcx, qword [rax]
call fcn.398124ce0
cmp eax, 0x2733
je 0x398127c66
cmp eax, 0x2714
jne 0x398127ce3
lea rsp, [rbp - 0x38]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rsi, qword [rsp + 0x70]
mov rcx, qword [rsi + 0xc0]
test rcx, rcx
je 0x398127afd
cmp qword [rcx], 0
jne 0x398127afd
mov dword [rsp + 0x20], 0xff
mov r9, qword [rsp + 0x38]
mov edx, ebx
mov rcx, r15
mov r8, qword [rsp + 0x88]
call fcn.398126c90
test eax, eax
js 0x398127678
mov rax, qword [rsp + 0x70]
mov rcx, r9
mov rsi, qword [rax + 0xc0]
call fcn.39811f170
mov qword [rsi], rax
jmp 0x39812785a
mov r12, qword [rsp + 0x40]
jmp 0x398127680
mov ecx, eax
call fcn.398124a30
mov rcx, qword [rbp + 0x10]
call fcn.398126e50
jmp 0x398127c66
mov dword [rsp + 0x54], 0
jmp 0x398127b73
mov r12, qword [rsp + 0x40]
jmp 0x398127b68
mov r12, rsi
jmp 0x398127680
test byte [rsp + 0x424], 1
jne 0x398127cf8
movzx eax, word [rsp + 0x52]
mov dword [rsp + 0x68], eax
test eax, eax
je 0x398127cf8
mov dword [rsp + 0x54], 0xffffffff
jmp 0x39812789c