Function at 0x140054360
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, rcx
mov ebx, 1
mov edx, ebx
xor ecx, ecx
xor ebp, ebp
call qword [case.0x14003b950.0]
mov rdi, rax
test rax, rax
je 0x1400543dd
nop word [rax + rax]
mov r8d, ebx
mov rdx, rdi
mov rcx, r14
mov rbp, rdi
mov esi, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ebx, eax
test eax, eax
je 0x140054408
cmp ebx, esi
je 0x140054408
cmp ebx, 0x8000
ja 0x140054408
cmp ebx, esi
jb 0x140054403
mov edx, ebx
mov rcx, rdi
call qword [case.0x14003b950.0]
mov rdi, rax
test rax, rax
jne 0x1400543a0
mov rcx, rbp
call qword [fcn.14009aecc]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rax, rdi
jmp 0x1400543e8
mov rcx, rdi
jmp 0x1400543e0

Function at 0x140056070
Capabilities:
Convert ip address from string

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x1400f9b40]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, r8
mov rsi, rdx
mov r13, rcx
cmp r8, 4
jb 0x1400561fe
inc rsi
lea rdx, str.0123456789abcdefABCDEF:.
mov rcx, rsi
sub rdi, 2
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strspn]
cmp rdi, rax
je 0x140056176
cmp byte [rsi + rax], 0x25
lea r14, [rsi + rax]
mov rdi, rax
jne 0x1400561fe
xor ebp, ebp
lea rdx, [0x1400c3e04]
lea rcx, [r14 + 1]
lea rbx, [r14 + 1]
lea r8d, [rbp + 2]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
jne 0x140056104
movzx eax, byte [r14 + 3]
lea rcx, [r14 + 3]
test al, al
je 0x140056104
cmp al, 0x5d
cmovne rbx, rcx
movzx eax, byte [rbx]
test al, al
je 0x1400561fe
mov rcx, rbp
cmp al, 0x5d
je 0x14005612f
cmp rcx, 0xf
jge 0x14005612f
inc rbx
mov byte [rsp + rcx + 0x20], al
inc ebp
inc rcx
movzx eax, byte [rbx]
test al, al
jne 0x140056112
test ebp, ebp
je 0x1400561fe
cmp byte [rbx], 0x5d
jne 0x1400561fe
movsxd rax, ebp
cmp rax, 0x10
jae 0x14005621f
lea rcx, [rsp + 0x20]
mov byte [rsp + rax + 0x20], 0
call qword [case.0x14003b950.1]
mov qword [r13 + 0x28], rax
test rax, rax
jne 0x140056170
mov eax, 7
jmp 0x140056203
mov word [r14], 0x5d
lea r8, [rsp + 0x20]
mov byte [rdi + rsi], 0
mov rdx, rsi
mov ecx, reloc.WS2_32.dll_socket
call qword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
jne 0x1400561fe
lea r9d, [rax + 0x2d]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x20]
lea ecx, [rax + 0x16]
call sub.WS2_32.dll_inet_ntop
test rax, rax
je 0x1400561f6
lea rax, [rsp + 0x30]
mov rdx, 0xffffffffffffffff
nop dword [rax]
inc rdx
cmp byte [rax + rdx], 0
jne 0x1400561c0
cmp rdx, rdi
jae 0x1400561f6
lea rax, [rsp + 0x30]
mov r8, rsi
sub r8, rax
lea rcx, [rsp + 0x30]
nop
movzx eax, byte [rcx]
mov byte [r8 + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x1400561e0
mov rdi, rdx
mov byte [rdx + rsi + 1], al
mov byte [rdi + rsi], 0x5d
xor eax, eax
jmp 0x140056203
mov eax, socket
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14009a250
add rsp, 0x70
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.14009a8a8
int3