Function at 0x1400f70f0
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Query service status
Start service
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x450]
sub rsp, 0x550
mov rax, qword [0x1403f80a0]
xor rax, rsp
mov qword [rbp + 0x448], rax
mov r12, rdx
xor r14d, r14d
mov eax, r14d
mov dword [rsp + 0x38], eax
mov dword [rbp + 0x1d0], eax
lea ecx, [r14 + 1]
test rdx, rdx
je 0x1400fa156
mov dword [rdx + 0xc], r14d
cmp dword [0x14040e6c8], ecx
jne 0x1400f7163
lea r15, [rdx + 8]
mov dword [r15], r14d
mov rax, r15
jmp 0x1400f72bf
mov ebx, r14d
mov r8d, ecx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
je 0x1400f72a2
mov r8d, reloc.WS2_32.dll_sendto
lea rdx, [0x1403bc1c0]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x1400f7292
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x2d8], xmm0
mov qword [rbp + 0x2e8], rax
mov dword [rbp + 0x2f0], eax
lea rdx, [rbp + 0x2d8]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x1400f7263
mov eax, dword [rbp + 0x2dc]
dec eax
test eax, 0xfffffffd
jne 0x1400f71f8
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x1400f71f8
lea ebx, [rax - 0x51]
jmp 0x1400f7268
lea rdx, [rbp + 0x2d8]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x1400f7251
nop dword [rax]
mov eax, dword [rbp + 0x2dc]
cmp eax, 2
jne 0x1400f7257
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x2d8], xmm0
mov qword [rbp + 0x2e8], rax
mov dword [rbp + 0x2f0], eax
lea ecx, [rax + 0x64]
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rbp + 0x2d8]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x1400f7210
mov eax, dword [rbp + 0x2dc]
cmp eax, 4
je 0x1400f7268
mov ebx, 0xffffffaf
jmp 0x1400f7268
mov ebx, 0xffffffae
mov ecx, dword [rbp + 0x2e4]
mov eax, dword [rbp + 0x2e8]
test eax, eax
cmovne ecx, eax
mov dword [r12 + 0xc], ecx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1400f72a7
mov ebx, 0xffffffad
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1400f72a7
mov ebx, 0xffffffac
lea r15, [r12 + 8]
mov rax, r15
mov dword [r15], ebx
mov ecx, 1
test ebx, ebx
js 0x1400fa156
lea r13, str.Global294E088E_E3EF_42A9_AE0C_1EF642412F95
mov edi, 0xffffffa0
lea ebx, [rdi - 1]
mov rsi, qword [0x14040e6f0]
test rsi, rsi
je 0x1400f739e
mov dword [rax], ecx
mov rcx, qword [0x14040e700]
xor r15d, r15d
mov r14d, r15d
test rsi, rsi
jne 0x1400f7a82
xor edx, edx
mov r8d, 0x17d8
lea rcx, [0x14040cef0]
call fcn.140133080
mov r8, r13
xor edx, edx
mov ecx, 0xf001f
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov qword [0x14040e6f8], rax
test rax, rax
jne 0x1400f7364
nop word [rax + rax]
cmp dword [0x14040e6c8], 1
je 0x1400f77a1
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8, r13
xor edx, edx
mov ecx, 0xf001f
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov qword [0x14040e6f8], rax
test rax, rax
je 0x1400f7330
mov esi, 1
mov qword [rsp + 0x20], 0x100000
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf001f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [0x14040e6f0], rax
test rax, rax
jne 0x1400f7824
lea edi, [rax - 0x5f]
jmp 0x1400f7a61
xor edx, edx
mov r8d, 0x17d8
lea rcx, [0x14040cef0]
call fcn.140133080
mov r8, r13
xor edx, edx
mov ecx, 0xf001f
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov qword [0x14040e6f8], rax
test rax, rax
jne 0x1400f7400
nop
cmp dword [0x14040e6c8], 1
je 0x1400f743d
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8, r13
xor edx, edx
mov ecx, 0xf001f
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov qword [0x14040e6f8], rax
test rax, rax
je 0x1400f73d0
mov qword [rsp + 0x20], 0x100000
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf001f
mov rcx, qword [0x14040e6f8]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rsi, rax
mov qword [0x14040e6f0], rax
test rax, rax
jne 0x1400f74ca
lea r14d, [rax - 0x5f]
jmp 0x1400f7704
mov esi, 1
mov edx, esi
lea rcx, [rbp + 0x358]
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
xor r9d, r9d
xor r8d, r8d
mov edx, esi
lea rcx, [rbp + 0x358]
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov qword [rbp + 0xc0], Ordinal_32
mov qword [rbp + 0xd0], r14
lea rax, [rbp + 0x358]
mov qword [rbp + 0xc8], rax
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], 0x100000
xor r9d, r9d
lea r8d, [rsi + 3]
lea rdx, [rbp + 0xc0]
lea rcx, [rsi - 2]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [0x14040e6f8], rax
test rax, rax
jne 0x1400f7400
mov r14d, edi
mov rsi, qword [0x14040e6f0]
jmp 0x1400f7704
mov qword [0x14040e6e8], rax
mov rcx, qword [0x14040e700]
test rcx, rcx
jne 0x1400f757c
mov esi, 1
nop word [rax + rax]
mov edx, esi
lea rcx, [rbp + 0x380]
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
xor r9d, r9d
xor r8d, r8d
mov edx, esi
lea rcx, [rbp + 0x380]
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov qword [rbp + 0xd8], Ordinal_32
mov qword [rbp + 0xe8], r14
lea rax, [rbp + 0x380]
mov qword [rbp + 0xe0], rax
lea r8, str.Global587203BC_5798_47BA_8BDA_C63D7DE25FCD
xor edx, edx
lea rcx, [rbp + 0xd8]
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rcx, rax
mov qword [0x14040e700], rax
test rax, rax
jne 0x1400f757c
cmp dword [0x14040e6c8], esi
je 0x1400f759a
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x14040e700]
test rcx, rcx
je 0x1400f74f0
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1400f75a5
mov r14d, ebx
mov rsi, qword [0x14040e6f0]
jmp 0x1400f7704
mov r14d, 0xffffff9d
jmp 0x1400f771d
mov rbx, qword [0x14040e6e8]
cmp dword [rbx], 0xdeadbeef
je 0x1400f75ca
xor edx, edx
mov r8d, 0x3798
mov rcx, rbx
call fcn.140133080
mov dword [rbx], 0xdeadbeef
inc dword [rbx + 4]
mov rsi, qword [0x14040e6f0]
test rsi, rsi
jne 0x1400f75e2
lea r14d, [rsi - 0x5e]
jmp 0x1400f76ff
mov eax, r14d
lea rcx, [rbx + 8]
nop dword [rax]
cmp dword [rcx], r14d
je 0x1400f760d
inc eax
add rcx, 0x38
cmp eax, 0xfe
jb 0x1400f75f0
mov r14d, 0xffffffa3
jmp 0x1400f76ff
mov r14d, eax
imul rsi, r14, 0x38
mov dword [rsi + rbx + 8], 0xffffffff
mov eax, dword [0x14040e6c8]
mov dword [rsi + rbx + 0xc], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [0x14040e6e8]
mov dword [rsi + rcx + 0x18], eax
call fcn.14012f870
mov rbx, rax
call fcn.14012f854
cmp rbx, 0x989680
jne 0x1400f7653
imul rax, rax, 0x64
jmp 0x1400f766e
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
mov rcx, qword [0x14040e6e8]
mov qword [rsi + rcx + 0x20], rax
call fcn.14012f870
mov rbx, rax
call fcn.14012f854
cmp rbx, 0x989680
jne 0x1400f7696
imul rax, rax, 0x64
jmp 0x1400f76b1
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
mov rcx, qword [0x14040e6e8]
mov qword [rsi + rcx + 0x28], rax
xor ebx, ebx
mov qword [rsi + rcx + 0x38], rbx
mov qword [rsi + rcx + 0x30], rbx
mov dword [rsi + rcx + 0x10], 1
mov word [rsi + rcx + 0x14], bx
lea rcx, [r14 + 1]
shl rcx, 0xc
mov rsi, qword [0x14040e6f0]
add rcx, rsi
mov qword [0x14040e6d0], rcx
xor edx, edx
mov r8d, 0x1000
call fcn.140133080
mov r14d, ebx
mov ebx, 0xffffff9f
mov rcx, qword [0x14040e700]
test rcx, rcx
je 0x1400f7724
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [0x14040e700]
mov rsi, qword [0x14040e6f0]
mov dword [r15], r14d
test r14d, r14d
jns 0x1400f72e7
mov rdi, qword [0x14040e768]
mov rbx, qword [0x14040e760]
cmp rbx, rdi
je 0x1400f7758
mov ecx, r14d
call qword [rbx]
add rbx, 8
cmp rbx, rdi
jne 0x1400f7743
mov rsi, qword [0x14040e6f0]
test rsi, rsi
je 0x1400f7766
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rax, qword [0x14040e6f8]
test rax, rax
je 0x1400f777b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
mov qword [0x14040e6f0], rcx
mov qword [0x14040e6f8], rcx
mov qword [0x14040e6e8], rcx
mov qword [0x14040e6d0], rcx
lea eax, [rcx + 1]
jmp 0x1400fa158
mov esi, 1
mov edx, esi
lea rcx, [rbp + 0x3a8]
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
xor r9d, r9d
xor r8d, r8d
mov edx, esi
lea rcx, [rbp + 0x3a8]
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov qword [rbp + 0xf0], Ordinal_32
mov qword [rbp + 0x100], r15
lea rax, [rbp + 0x3a8]
mov qword [rbp + 0xf8], rax
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], 0x100000
xor r9d, r9d
lea r8d, [rsi + 3]
lea rdx, [rbp + 0xf0]
lea rcx, [rsi - 2]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [0x14040e6f8], rax
test rax, rax
jne 0x1400f7369
jmp 0x1400f7a61
mov rax, qword [0x14040e6f0]
mov qword [0x14040e6e8], rax
mov rcx, qword [0x14040e700]
test rcx, rcx
jne 0x1400f78dd
nop dword [rax]
nop word [rax + rax]
mov edx, esi
lea rcx, [rbp + 0x3d0]
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
xor r9d, r9d
xor r8d, r8d
mov edx, esi
lea rcx, [rbp + 0x3d0]
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov qword [rbp + 0x108], Ordinal_32
mov qword [rbp + 0x118], r15
lea rax, [rbp + 0x3d0]
mov qword [rbp + 0x110], rax
lea r8, str.Global587203BC_5798_47BA_8BDA_C63D7DE25FCD
xor edx, edx
lea rcx, [rbp + 0x108]
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rcx, rax
mov qword [0x14040e700], rax
test rax, rax
jne 0x1400f78dd
cmp dword [0x14040e6c8], 1
je 0x1400f78f3
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x14040e700]
test rcx, rcx
je 0x1400f7850
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1400f78fd
mov edi, ebx
jmp 0x1400f7a61
mov edi, 0xffffff9d
jmp 0x1400f7b4e
mov rbx, qword [0x14040e6e8]
cmp dword [rbx], 0xdeadbeef
je 0x1400f7922
xor edx, edx
mov r8d, 0x3798
mov rcx, rbx
call fcn.140133080
mov dword [rbx], 0xdeadbeef
mov rax, qword [0x14040e6e8]
inc dword [rax + 4]
cmp qword [0x14040e6f0], r14
jne 0x1400f793f
mov edi, 0xffffffa2
jmp 0x1400f7a61
mov ecx, r15d
mov rax, qword [0x14040e6e8]
add rax, 8
nop dword [rax]
cmp dword [rax], r14d
je 0x1400f796d
inc ecx
add rax, 0x38
cmp ecx, 0xfe
jb 0x1400f7950
mov edi, 0xffffffa3
jmp 0x1400f7a61
mov esi, ecx
imul rbx, rsi, 0x38
mov rcx, qword [0x14040e6e8]
mov dword [rcx + rbx + 8], 0xffffffff
mov eax, dword [0x14040e6c8]
mov dword [rcx + rbx + 0xc], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [0x14040e6e8]
mov dword [rbx + rcx + 0x18], eax
call fcn.14012f870
mov rdi, rax
call fcn.14012f854
cmp rdi, 0x989680
jne 0x1400f79b9
imul rax, rax, 0x64
jmp 0x1400f79d4
cqo
idiv rdi
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rdi
add rax, rcx
mov rcx, qword [0x14040e6e8]
mov qword [rbx + rcx + 0x20], rax
call fcn.14012f870
mov rdi, rax
call fcn.14012f854
cmp rdi, 0x989680
jne 0x1400f79fc
imul rax, rax, 0x64
jmp 0x1400f7a17
cqo
idiv rdi
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rdi
add rax, rcx
mov rcx, qword [0x14040e6e8]
mov qword [rbx + rcx + 0x28], rax
mov qword [rbx + rcx + 0x38], r15
mov qword [rbx + rcx + 0x30], r15
mov dword [rbx + rcx + 0x10], 1
mov word [rbx + rcx + 0x14], r15w
lea rcx, [rsi + 1]
shl rcx, 0xc
add rcx, qword [0x14040e6f0]
mov qword [0x14040e6d0], rcx
xor edx, edx
mov r8d, 0x1000
call fcn.140133080
mov edi, r15d
mov rcx, qword [0x14040e700]
test rcx, rcx
je 0x1400f7a7a
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [0x14040e700]
test edi, edi
js 0x1400f7b4e
test rcx, rcx
jne 0x1400f7b20
mov ebx, 1
mov edx, ebx
lea rcx, [rbp + 0x3f8]
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
lea rcx, [rbp + 0x3f8]
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov qword [rbp + 0x120], Ordinal_32
mov qword [rbp + 0x130], r15
lea rax, [rbp + 0x3f8]
mov qword [rbp + 0x128], rax
lea r8, str.Global587203BC_5798_47BA_8BDA_C63D7DE25FCD
xor edx, edx
lea rcx, [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rcx, rax
mov qword [0x14040e700], rax
test rax, rax
jne 0x1400f7b20
cmp dword [0x14040e6c8], ebx
je 0x1400f7bdb
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x14040e700]
test rcx, rcx
je 0x1400f7a90
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, r15d
test eax, eax
mov eax, 0xffffff9f
cmovne edi, eax
mov rcx, qword [0x14040e700]
test edi, edi
js 0x1400f7b4e
mov rax, qword [0x14040e6e8]
mov r14d, dword [rax + 4]
test rcx, rcx
je 0x1400f7b59
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
test edi, edi
jns 0x1400f7b80
mov rsi, qword [0x14040e768]
mov rbx, qword [0x14040e760]
cmp rbx, rsi
je 0x1400f7b80
mov rax, qword [rbx]
mov ecx, edi
call rax
add rbx, 8
cmp rbx, rsi
jne 0x1400f7b70
mov rdi, qword [0x14040e750]
mov rbx, qword [0x14040e748]
cmp rbx, rdi
je 0x1400f7ba4
mov rax, qword [rbx]
mov ecx, r14d
call rax
add rbx, 8
cmp rbx, rdi
jne 0x1400f7b93
mov rcx, qword [0x14040e6f0]
test rcx, rcx
je 0x1400f7be5
mov rax, qword [0x14040e6d0]
test rax, rax
je 0x1400f7be5
sub rax, rcx
shr rax, 0xc
dec eax
imul rcx, rax, 0x38
mov r13, qword [0x14040e6e8]
add r13, 8
add r13, rcx
xor esi, esi
jmp 0x1400f7bea
mov edi, 0xffffff9d
jmp 0x1400f7b3f
xor esi, esi
mov r13d, esi
mov qword [rsp + 0x70], r13
mov rcx, qword [r12]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [0x14040e6f0], r15
je 0x1400fa152
lea r14, [0x14040cf08]
lea rdi, [0x14040e850]
mov r12d, reloc.WLDAP32.dll_Ordinal_26
mov rax, qword [rbp + 0x2d0]
mov qword [rbp - 0x70], rax
movzx eax, byte [rbp + 0x150]
mov byte [rbp + 0x150], al
nop dword [rax]
mov rax, qword [0x14040e700]
test rax, rax
jne 0x1400f7cf1
mov ebx, 1
nop word [rax + rax]
mov edx, ebx
lea rcx, [rbp + 0x420]
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
lea rcx, [rbp + 0x420]
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov qword [rbp + 0x138], Ordinal_32
mov qword [rbp + 0x148], 0
lea rax, [rbp + 0x420]
mov qword [rbp + 0x140], rax
lea r8, str.Global587203BC_5798_47BA_8BDA_C63D7DE25FCD
xor edx, edx
lea rcx, [rbp + 0x138]
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [0x14040e700], rax
test rax, rax
jne 0x1400f7cf1
cmp dword [0x14040e6c8], ebx
je 0x1400f8312
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [0x14040e700]
test rax, rax
je 0x1400f7c60
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1400f82fe
test r13, r13
je 0x1400fa059
cmp dword [r13], eax
je 0x1400fa059
mov rax, qword [0x14040e6d0]
mov rcx, qword [0x14040e6f0]
sub rax, rcx
shr rax, 0xc
dec eax
inc rax
shl rax, 0xc
add rcx, rax
mov r10, rcx
mov r11, rcx
cmp dword [rcx], 0
je 0x1400f7dc1
nop word [rax + rax]
mov eax, dword [r11 + 4]
add r11, rax
cmp dword [r11], 0
jne 0x1400f7d50
cmp rcx, r11
je 0x1400f7dc1
mov rbx, qword [0x14040e6e8]
nop dword [rax]
mov r9d, esi
mov r8, r14
lea rdx, [rbx + 8]
nop word [rax + rax]
cmp dword [rdx], 0
je 0x1400f7d8e
mov rax, qword [r8]
cmp qword [r10 + 0x12], rax
ja 0x1400f7daf
inc r9d
add rdx, 0x38
add r8, 0x18
cmp r9d, 0xfe
jb 0x1400f7d80
mov eax, dword [r10 + 4]
add r10, rax
cmp dword [r10], 0
jne 0x1400f7d70
cmp r10, r11
jne 0x1400f7dc1
xor edx, edx
mov r8d, 0x1000
call fcn.140133080
mov qword [rbp + 0x2d0], rdi
mov rcx, rdi
call fcn.14012da90
test eax, eax
jne 0x1400fa188
cmp qword [0x14040e840], 0
je 0x1400f8197
call fcn.14012f870
mov rbx, rax
call fcn.14012f854
cmp rbx, 0x989680
jne 0x1400f7e02
imul rbx, rax, 0x64
jmp 0x1400f7e1e
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
lea rbx, [rax + rcx]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x1a8], xmm0
movups xmmword [rbp + 0x1b8], xmm0
mov qword [rbp + 0x1c8], rax
mov rcx, qword [0x14040e830]
dec rcx
and rcx, qword [0x14040e838]
mov rax, qword [0x14040e828]
mov r14, qword [rax + rcx*8]
mov edi, dword [r14 + 0x14]
mov rax, qword [r14 + 8]
mov r15d, dword [rax]
lea rax, vtable.Vanguard::Message.0
mov qword [rbp + 0x1a8], rax
mov qword [rbp + 0x1b0], rsi
mov qword [rbp + 0x1b8], 0
mov qword [rbp + 0x1c0], rsi
mov qword [rbp + 0x1c8], rsi
mov ecx, Ordinal_50
call fcn.140130550
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp + 0x1c0], rax
mov rsi, qword [rbp + 0x1b0]
test rsi, rsi
jne 0x1400f7f11
cmp edi, 0x1a
cmovb edi, r12d
mov ecx, edi
call fcn.140130e50
mov qword [rbp + 0x1b0], rax
mov dword [rbp + 0x1bc], edi
mov dword [rbp + 0x1b8], r12d
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rax], xmm0
mov qword [rax + 0x10], rcx
mov word [rax + 0x18], cx
mov rax, qword [rbp + 0x1b0]
mov word [rax + 8], cx
mov rcx, qword [rbp + 0x1b0]
mov eax, dword [rbp + 0x1b8]
mov dword [rcx + 4], eax
mov rsi, qword [rbp + 0x1b0]
jmp 0x1400f7f53
cmp dword [rbp + 0x1bc], edi
jae 0x1400f7f53
mov rcx, rdi
call fcn.140130e50
mov rsi, rax
mov r8d, dword [rbp + 0x1b8]
mov rdx, qword [rbp + 0x1b0]
mov rcx, rax
call fcn.1401329d0
mov rcx, qword [rbp + 0x1b0]
call fcn.140130510
mov qword [rbp + 0x1b0], rsi
mov dword [rbp + 0x1bc], edi
mov dword [rsi], r15d
lea r15, vtable.Vanguard::Message.0
mov qword [rbp + 0x1a8], r15
lea rdx, [r14 + 0x18]
lea rcx, [rbp + 0x1c0]
call fcn.1400fcfe0
mov ecx, dword [r14 + 0x10]
mov dword [rbp + 0x1b8], ecx
mov rax, qword [rbp + 0x1b0]
mov dword [rax + 4], ecx
mov rcx, qword [rbp + 0x1b0]
movzx eax, word [rbp + 0x1c8]
mov word [rcx + 8], ax
mov r8d, dword [rbp + 0x1b8]
mov rdx, qword [r14 + 8]
mov rcx, qword [rbp + 0x1b0]
call fcn.1401329d0
nop
mov r14, qword [0x14040e6d0]
mov rax, r14
mov rdi, qword [0x14040e6f0]
sub rax, rdi
shr rax, 0xc
dec eax
mov esi, eax
lea r8, [rax + 1]
shl r8, 0xc
add r8, rdi
mov rdx, r8
mov r11d, dword [r8]
test r11d, r11d
je 0x1400f7fef
mov eax, dword [rdx + 4]
add rdx, rax
cmp dword [rdx], 0
jne 0x1400f7fe4
lea r10, [rsi + 2]
shl r10, 0xc
mov rcx, r10
sub rcx, rdx
add rcx, rdi
mov eax, dword [rbp + 0x1b8]
cmp rcx, rax
jb 0x1400f824f
mov r9, r8
test r11d, r11d
je 0x1400f802d
nop word [rax + rax]
mov eax, dword [r9 + 4]
add r9, rax
cmp dword [r9], 0
jne 0x1400f8020
mov rax, qword [rbp + 0x1b0]
mov qword [rax + 0xa], rbx
mov rcx, qword [0x14040cef0]
lea rax, [rcx + 1]
mov qword [0x14040cef0], rax
mov rax, qword [rbp + 0x1b0]
mov qword [rax + 0x12], rcx
cmp dword [r8], 0
je 0x1400f806d
nop dword [rax + rax]
mov eax, dword [r8 + 4]
add r8, rax
cmp dword [r8], 0
jne 0x1400f8060
sub r10, r8
add r10, rdi
mov eax, dword [rbp + 0x1b8]
cmp r10d, eax
jb 0x1400f81ec
mov r8d, eax
mov rdx, qword [rbp + 0x1b0]
mov rcx, r9
call fcn.1401329d0
mov rdx, qword [0x14040e6e8]
test rdi, rdi
je 0x1400f80b2
test r14, r14
je 0x1400f80b2
imul rax, rsi, 0x38
lea rcx, [rdx + 0x30]
add rcx, rax
jmp 0x1400f80bb
imul rax, rsi, 0x38
mov ecx, Ordinal_41
mov qword [rcx], rbx
test rdi, rdi
je 0x1400f80d1
test r14, r14
je 0x1400f80d1
lea rcx, [rdx + 0x28]
add rcx, rax
jmp 0x1400f80d6
mov ecx, reloc.WLDAP32.dll_Ordinal_32
mov qword [rcx], rbx
mov rcx, qword [0x14040e830]
dec rcx
and rcx, qword [0x14040e838]
mov rax, qword [0x14040e828]
mov rcx, qword [rax + rcx*8]
mov rax, qword [rcx]
xor edx, edx
call qword [rax + htons]
sub qword [0x14040e840], 1
jne 0x1400f8112
xor esi, esi
mov qword [0x14040e838], rsi
jmp 0x1400f811b
inc qword [0x14040e838]
xor esi, esi
mov qword [rbp + 0x1a8], r15
mov rcx, qword [rbp + 0x1b0]
test rcx, rcx
je 0x1400f8133
call fcn.140130510
mov rcx, qword [rbp + 0x1c0]
mov rbx, qword [rcx + 8]
cmp byte [rbx + 0x19], 0
jne 0x1400f8178
mov r8, qword [rbx + 0x10]
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0x1c0]
call fcn.1400fdbb0
mov rcx, rbx
mov rbx, qword [rbx]
mov edx, Ordinal_50
call fcn.140130510
cmp byte [rbx + 0x19], 0
je 0x1400f8144
mov rcx, qword [rbp + 0x1c0]
mov edx, Ordinal_50
call fcn.140130510
cmp qword [0x14040e840], 0
jne 0x1400f7de6
lea rdi, [0x14040e850]
mov rcx, rdi
call fcn.14012daa0
mov r10, qword [r13 + 0x20]
mov qword [rbp + 0x2d0], r10
mov r8, qword [0x14040e6e8]
mov rcx, qword [0x14040e6d0]
mov rdx, qword [0x14040e6f0]
test rdx, rdx
je 0x1400f8342
test rcx, rcx
je 0x1400f8342
mov rax, rcx
sub rax, rdx
shr rax, 0xc
dec eax
inc rax
imul r9, rax, 0x38
add r9, r8
jmp 0x1400f8348
mov qword [rbp + 0x1a8], r15
mov rcx, qword [rbp + 0x1b0]
test rcx, rcx
je 0x1400f8204
call fcn.140130510
mov rcx, qword [rbp + 0x1c0]
mov rbx, qword [rcx + 8]
cmp byte [rbx + 0x19], 0
jne 0x1400f82b4
nop dword [rax]
mov r8, qword [rbx + 0x10]
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0x1c0]
call fcn.1400fdbb0
mov rcx, rbx
mov rbx, qword [rbx]
mov edx, Ordinal_50
call fcn.140130510
cmp byte [rbx + 0x19], 0
je 0x1400f8220
jmp 0x1400f82ad
mov qword [rbp + 0x1a8], r15
mov rcx, qword [rbp + 0x1b0]
test rcx, rcx
je 0x1400f8267
call fcn.140130510
mov rcx, qword [rbp + 0x1c0]
mov rbx, qword [rcx + 8]
cmp byte [rbx + 0x19], 0
jne 0x1400f82b4
nop dword [rax + rax]
mov r8, qword [rbx + 0x10]
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0x1c0]
call fcn.1400fdbb0
mov rcx, rbx
mov rbx, qword [rbx]
mov edx, Ordinal_50
call fcn.140130510
cmp byte [rbx + 0x19], 0
je 0x1400f8280
mov rcx, qword [rbp + 0x1c0]
mov edx, Ordinal_50
call fcn.140130510
nop
lea rcx, [0x14040e850]
call fcn.14012daa0
mov rdi, qword [0x14040e768]
mov rbx, qword [0x14040e760]
cmp rbx, rdi
je 0x1400f82f0
nop
mov ecx, 0xffffffaa
call qword [rbx]
add rbx, 8
cmp rbx, rdi
jne 0x1400f82e0
lea r14, [0x14040cf08]
lea rdi, [0x14040e850]
mov rcx, qword [0x14040e700]
test rcx, rcx
je 0x1400f8310
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor esi, esi
cmp byte [0x14040e6d8], 0
jne 0x1400fa112
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [0x14040e6f0], 0
je 0x1400fa152
mov r13, qword [rsp + 0x70]
jmp 0x1400f7c40
mov r9d, Ordinal_50
mov rdi, qword [r9]
mov qword [rsp + 0x40], rdi
mov r13d, esi
mov r14, rsi
mov qword [rbp - 0x78], rsi
nop word [rax + rax]
mov rax, rcx
sub rax, rdx
shr rax, 0xc
dec eax
cmp eax, r13d
je 0x1400f9da0
imul r15, r14, 0x38
mov qword [rbp + 0x38], r15
cmp dword [r15 + r8 + 8], 0
je 0x1400f9da0
cmp qword [r15 + r8 + 0x30], r10
jb 0x1400f9da0
mov ebx, r13d
lea r12, [rbx + 1]
shl r12, 0xc
add r12, rdx
mov qword [rsp + 0x48], r12
xorps xmm0, xmm0
movups xmmword [rbp + 0x158], xmm0
movups xmmword [rbp + 0x168], xmm0
lea rax, vtable.Vanguard::Message.0
mov qword [rbp + 0x158], rax
mov qword [rbp + 0x160], rsi
mov qword [rbp + 0x168], 0
mov qword [rbp + 0x170], rsi
mov qword [rbp + 0x178], rsi
mov ecx, Ordinal_50
call fcn.140130550
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x160]
test rax, rax
jne 0x1400f8466
lea ecx, [rax + 0x1a]
call fcn.140130e50
mov qword [rbp + 0x160], rax
mov ecx, reloc.WLDAP32.dll_Ordinal_26
mov dword [rbp + 0x16c], ecx
mov dword [rbp + 0x168], ecx
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rax], xmm0
mov qword [rax + 0x10], rcx
mov word [rax + 0x18], cx
mov rax, qword [rbp + 0x160]
mov word [rax + 8], si
mov rcx, qword [rbp + 0x160]
mov eax, dword [rbp + 0x168]
mov dword [rcx + 4], eax
mov rax, qword [rbp + 0x160]
mov dword [rax], esi
lea rax, vtable.Vanguard::Message.0
mov qword [rbp + 0x158], rax
mov rcx, qword [0x14040e6e8]
lea rax, [r14 + r14*2]
lea r8, [rax*8]
lea r9, [0x14040cef0]
movups xmm1, xmmword [r8 + r9 + 8]
movups xmmword [rbp - 0x58], xmm1
movsd xmm2, qword [r8 + r9 + 0x18]
mov rdx, qword [rcx + r15 + 0x20]
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, rdx
jne 0x1400f84c4
movd eax, xmm1
cmp eax, dword [rcx + r15 + 0x18]
je 0x1400f84dd
mov qword [rbp - 0x48], rsi
mov qword [rbp - 0x50], rdx
mov eax, dword [rcx + r15 + 0x18]
mov dword [rbp - 0x58], eax
movsd xmm2, qword [rbp - 0x48]
movups xmm1, xmmword [rbp - 0x58]
movups xmmword [r8 + r9 + 8], xmm1
movsd qword [r8 + r9 + 0x18], xmm2
lea rax, [r9 + 0x18]
add rax, r8
mov qword [rbp - 0x80], rax
mov rax, qword [rax]
mov qword [rsp + 0x58], rax
mov rax, r14
shl rax, 0xc
mov qword [rbp - 0x68], rax
lea r8, [rbx + 2]
shl r8, 0xc
mov qword [rsp + 0x78], r8
nop word [rax + rax]
mov rdx, qword [0x14040e6f0]
add rax, 0x1000
add rax, rdx
cmp dword [rax], 0
je 0x1400f8540
mov ecx, dword [rax + 4]
add rax, rcx
cmp dword [rax], 0
jne 0x1400f8535
mov rsi, r8
sub rsi, rax
add rsi, rdx
cmp esi, 0x1a
jb 0x1400f9d03
xorps xmm0, xmm0
movups xmmword [rbp + 0x1d0], xmm0
xor r14d, r14d
mov qword [rbp + 0x1d0], r14
mov qword [rbp + 0x1d8], r14
lea ecx, [r14 + 0x30]
call fcn.140130550
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp + 0x1d0], rax
mov eax, reloc.WLDAP32.dll_Ordinal_26
mov ebx, eax
mov edi, eax
xor ecx, ecx
cmp cx, word [r12 + 8]
jae 0x1400f85fc
mov esi, esi
lea rax, [rbx + 6]
cmp rax, rsi
jae 0x1400f9ca8
movzx eax, word [r12 + rbx]
mov word [rbp + 0x280], ax
lea r8, [rbp + 0x280]
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x1d0]
call fcn.1400fda40
mov rcx, qword [rax]
mov qword [rcx + 0x28], rbx
mov eax, dword [r12 + rbx + 2]
add rbx, 6
add rbx, rax
mov edi, ebx
inc r14w
cmp r14w, word [r12 + 8]
jb 0x1400f85a3
mov eax, reloc.WLDAP32.dll_Ordinal_26
mov rbx, qword [rbp + 0x160]
test rbx, rbx
jne 0x1400f8666
mov ebx, edi
cmp edi, 0x1a
cmovb ebx, eax
mov ecx, ebx
call fcn.140130e50
mov qword [rbp + 0x160], rax
mov dword [rbp + 0x16c], ebx
mov dword [rbp + 0x168], reloc.WLDAP32.dll_Ordinal_26
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rax], xmm0
mov qword [rax + 0x10], rcx
mov word [rax + 0x18], cx
mov rax, qword [rbp + 0x160]
xor r14d, r14d
mov word [rax + 8], r14w
mov rcx, qword [rbp + 0x160]
mov eax, dword [rbp + 0x168]
mov dword [rcx + 4], eax
mov rbx, qword [rbp + 0x160]
jmp 0x1400f86aa
cmp dword [rbp + 0x16c], edi
jae 0x1400f86a7
mov ecx, edi
call fcn.140130e50
mov rbx, rax
mov r8d, dword [rbp + 0x168]
mov rdx, qword [rbp + 0x160]
mov rcx, rax
call fcn.1401329d0
mov rcx, qword [rbp + 0x160]
call fcn.140130510
mov qword [rbp + 0x160], rbx
mov dword [rbp + 0x16c], edi
xor r14d, r14d
mov r8d, edi
mov rdx, r12
mov rcx, rbx
call fcn.1401329d0
lea rdx, [rbp + 0x1d0]
lea rcx, [rbp + 0x170]
call fcn.1400fcfe0
mov dword [rbp + 0x168], edi
mov rcx, qword [rbp + 0x1d0]
mov rbx, qword [rcx + 8]
cmp byte [rbx + 0x19], 0
jne 0x1400f8716
mov r8, qword [rbx + 0x10]
lea rdx, [rbp + 0x1d0]
lea rcx, [rbp + 0x1d0]
call fcn.1400fdbb0
mov rcx, rbx
mov rbx, qword [rbx]
mov edx, Ordinal_50
call fcn.140130510
cmp byte [rbx + 0x19], 0
je 0x1400f86e2
mov rcx, qword [rbp + 0x1d0]
mov edx, Ordinal_50
call fcn.140130510
mov rcx, qword [rbp + 0x160]
cmp dword [rcx], 0
je 0x1400f9cfe
mov rax, qword [rcx + 0x12]
mov rcx, qword [rbp - 0x80]
cmp rax, qword [rcx]
jb 0x1400f9c83
cmp rax, qword [rsp + 0x58]
jb 0x1400f8750
inc rax
mov qword [rsp + 0x58], rax
mov rax, qword [rbp + 0x160]
mov rdi, qword [rsp + 0x40]
cmp qword [rax + 0xa], rdi
cmova rdi, qword [rax + 0xa]
mov qword [rsp + 0x40], rdi
mov edx, 0x200
mov rax, qword [0x14040e6e8]
mov ecx, dword [r15 + rax + 0x18]
call fcn.1400f59e0
test al, al
je 0x1400fa085
mov rax, qword [rbp + 0x160]
mov esi, dword [rax]
lea eax, [rsi - 1]
cmp eax, 6
ja case.default.0x1400f87ae
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0xfa190]
add rcx, rdx
jmp rcx
xorps xmm0, xmm0
movups xmmword [rbp + 0x1e0], xmm0
movups xmmword [rbp + 0x1f0], xmm0
mov ebx, dword [rbp + 0x16c]
lea rax, vtable.Vanguard::Message.0
mov qword [rbp + 0x1e0], rax
mov qword [rbp + 0x1e8], r14
mov qword [rbp + 0x1f0], 0
mov qword [rbp + 0x1f8], r14
mov qword [rbp + 0x200], r14
mov ecx, Ordinal_50
call fcn.140130550
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp + 0x1f8], rax
mov rdi, qword [rbp + 0x1e8]
test rdi, rdi
jne 0x1400f887d
cmp ebx, 0x1a
mov edi, reloc.WLDAP32.dll_Ordinal_26
cmovb ebx, edi
mov ecx, ebx
call fcn.140130e50
mov qword [rbp + 0x1e8], rax
mov dword [rbp + 0x1f4], ebx
mov dword [rbp + 0x1f0], edi
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rax], xmm0
mov qword [rax + 0x10], rcx
mov word [rax + 0x18], cx
mov rax, qword [rbp + 0x1e8]
mov word [rax + 8], r14w
mov rcx, qword [rbp + 0x1e8]
mov eax, dword [rbp + 0x1f0]
mov dword [rcx + 4], eax
mov rdi, qword [rbp + 0x1e8]
jmp 0x1400f88bf
cmp dword [rbp + 0x1f4], ebx
jae 0x1400f88bf
mov rcx, rbx
call fcn.140130e50
mov rdi, rax
mov r8d, dword [rbp + 0x1f0]
mov rdx, qword [rbp + 0x1e8]
mov rcx, rax
call fcn.1401329d0
mov rcx, qword [rbp + 0x1e8]
call fcn.140130510
mov qword [rbp + 0x1e8], rdi
mov dword [rbp + 0x1f4], ebx
mov dword [rdi], esi
lea rax, vtable.Vanguard::Message.0
mov qword [rbp + 0x1e0], rax
lea rdx, [rbp + 0x170]
lea rcx, [rbp + 0x1f8]
call fcn.1400fcfe0
mov ecx, dword [rbp + 0x168]
mov dword [rbp + 0x1f0], ecx
mov rax, qword [rbp + 0x1e8]
mov dword [rax + 4], ecx
mov rcx, qword [rbp + 0x1e8]
movzx eax, word [rbp + 0x200]
mov word [rcx + 8], ax
mov r8d, dword [rbp + 0x1f0]
mov rdx, qword [rbp + 0x160]
mov rcx, qword [rbp + 0x1e8]
call fcn.1401329d0
nop
lea rax, vtable.Vanguard::GenericMessage.0
mov qword [rbp + 0x1e0], rax
mov rax, qword [rbp + 0x1e8]
cmp dword [rax], 1
jne 0x1400f898e
mov word [rsp + 0x32], r14w
lea rdx, [rsp + 0x32]
lea rcx, [rbp + 0x1f8]
call fcn.1400fdb50
lea r8, [rbp + 0x1f8]
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.1400fd1c0
lea r8, [rbp + 0x1f8]
mov rdx, qword [rbp + 0x1f8]
lea rcx, [rbp - 0x60]
call fcn.1400fd1c0
mov rax, qword [rbp - 0x60]
cmp qword [rbp - 0x40], rax
je 0x1400f898e
mov al, 1
jmp 0x1400f8990
xor al, al
test al, al
je 0x1400f8ac0
lea rcx, [rbp + 0x2b0]
call fcn.1400d3c10
mov eax, dword [rsp + 0x38]
or eax, 1
mov dword [rsp + 0x38], eax
mov dword [rbp + 0x1d0], eax
mov word [rsp + 0x32], r14w
lea rdx, [rsp + 0x32]
lea rcx, [rbp + 0x1f8]
call fcn.1400fdb50
lea r8, [rbp + 0x1f8]
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.1400fd1c0
lea r8, [rbp + 0x1f8]
mov rdx, qword [rbp + 0x1f8]
lea rcx, [rbp - 0x38]
call fcn.1400fd1c0
mov rax, qword [rbp - 0x38]
cmp qword [rbp - 0x30], rax
je 0x1400f8a59
mov word [rsp + 0x60], r14w
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x1f8]
call fcn.1400fddb0
mov rcx, qword [rax]
mov rax, qword [rbp + 0x1e8]
mov ebx, dword [rax + rcx + 2]
mov word [rsp + 0x62], r14w
lea rdx, [rsp + 0x62]
lea rcx, [rbp + 0x1f8]
call fcn.1400fddb0
mov rdx, qword [rbp + 0x1e8]
add rdx, 6
add rdx, qword [rax]
mov r8d, ebx
lea rcx, [rbp + 0x2b0]
call fcn.1400d7b90
mov rax, qword [0x14040e6e8]
mov esi, dword [r15 + rax + 0x18]
mov rax, qword [rbp + 0x160]
mov r14, qword [rax + 0xa]
mov rdi, qword [0x14040e7b0]
mov rbx, qword [0x14040e7a8]
cmp rbx, rdi
je 0x1400f8aae
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rbx]
lea r9, [rbp + 0x2b0]
mov r8d, esi
mov edx, r13d
mov rcx, r14
call rax
add rbx, 8
cmp rbx, rdi
jne 0x1400f8a90
and dword [rsp + 0x38], 0xfffffffe
lea rcx, [rbp + 0x2b0]
call fcn.1400d7d30
nop
lea rcx, [rbp + 0x1e0]
call fcn.1400f6990
jmp 0x1400f9c83
xorps xmm0, xmm0
movups xmmword [rbp + 0x208], xmm0
movups xmmword [rbp + 0x218], xmm0
mov ebx, dword [rbp + 0x16c]
lea rax, vtable.Vanguard::Message.0
mov qword [rbp + 0x208], rax
mov qword [rbp + 0x210], r14
mov qword [rbp + 0x218], 0
mov qword [rbp + 0x220], r14
mov qword [rbp + 0x228], r14
mov ecx, Ordinal_50
call fcn.140130550
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp + 0x220], rax
mov rdi, qword [rbp + 0x210]
test rdi, rdi
jne 0x1400f8b9e
cmp ebx, 0x1a
mov edi, reloc.WLDAP32.dll_Ordinal_26
cmovb ebx, edi
mov ecx, ebx
call fcn.140130e50
mov qword [rbp + 0x210], rax
mov dword [rbp + 0x21c], ebx
mov dword [rbp + 0x218], edi
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rax], xmm0
mov qword [rax + 0x10], rcx
mov word [rax + 0x18], cx
mov rax, qword [rbp + 0x210]
mov word [rax + 8], r14w
mov rcx, qword [rbp + 0x210]
mov eax, dword [rbp + 0x218]
mov dword [rcx + 4], eax
mov rdi, qword [rbp + 0x210]
jmp 0x1400f8be0
cmp dword [rbp + 0x21c], ebx
jae 0x1400f8be0
mov rcx, rbx
call fcn.140130e50
mov rdi, rax
mov r8d, dword [rbp + 0x218]
mov rdx, qword [rbp + 0x210]
mov rcx, rax
call fcn.1401329d0
mov rcx, qword [rbp + 0x210]
call fcn.140130510
mov qword [rbp + 0x210], rdi
mov dword [rbp + 0x21c], ebx
mov dword [rdi], esi
lea rax, vtable.Vanguard::Message.0
mov qword [rbp + 0x208], rax
lea rdx, [rbp + 0x170]
lea rcx, [rbp + 0x220]
call fcn.1400fcfe0
mov ecx, dword [rbp + 0x168]
mov dword [rbp + 0x218], ecx
mov rax, qword [rbp + 0x210]
mov dword [rax + 4], ecx
mov rcx, qword [rbp + 0x210]
movzx eax, word [rbp + 0x228]
mov word [rcx + 8], ax
mov r8d, dword [rbp + 0x218]
mov rdx, qword [rbp + 0x160]
mov rcx, qword [rbp + 0x210]
call fcn.1401329d0
nop
lea rax, vtable.Vanguard::ConnectMessage.0
mov qword [rbp + 0x208], rax
mov rax, qword [rbp + 0x210]
cmp dword [rax], 2
jne 0x1400f8caf
mov word [rsp + 0x32], r14w
lea rdx, [rsp + 0x32]
lea rcx, [rbp + 0x220]
call fcn.1400fdb50
lea r8, [rbp + 0x220]
mov rdx, rax
lea rcx, [rbp - 0x20]
call fcn.1400fd1c0
lea r8, [rbp + 0x220]
mov rdx, qword [rbp + 0x220]
lea rcx, [rbp - 0x28]
call fcn.1400fd1c0
mov rax, qword [rbp - 0x28]
cmp qword [rbp - 0x20], rax
je 0x1400f8caf
mov al, 1
jmp 0x1400f8cb1
xor al, al
test al, al
je 0x1400f8dfc
lea rcx, [rbp + 0x2b0]
call fcn.1400d3c10
mov eax, dword [rsp + 0x38]
or eax, 2
mov dword [rsp + 0x38], eax
mov dword [rbp + 0x1d0], eax
mov word [rsp + 0x32], r14w
lea rdx, [rsp + 0x32]
lea rcx, [rbp + 0x220]
call fcn.1400fdb50
lea r8, [rbp + 0x220]
mov rdx, rax
lea rcx, [rbp - 0x10]
call fcn.1400fd1c0
lea r8, [rbp + 0x220]
mov rdx, qword [rbp + 0x220]
lea rcx, [rbp - 0x18]
call fcn.1400fd1c0
mov rax, qword [rbp - 0x18]
cmp qword [rbp - 0x10], rax
je 0x1400f8d7a
mov word [rsp + 0x34], r14w
lea rdx, [rsp + 0x34]
lea rcx, [rbp + 0x220]
call fcn.1400fddb0
mov rcx, qword [rax]
mov rax, qword [rbp + 0x210]
mov ebx, dword [rax + rcx + 2]
mov word [rsp + 0x30], r14w
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x220]
call fcn.1400fddb0
mov rdx, qword [rbp + 0x210]
add rdx, 6
add rdx, qword [rax]
mov r8d, ebx
lea rcx, [rbp + 0x2b0]
call fcn.1400d7b90
lea rcx, [rbp + 0x2b0]
call fcn.1400d7710
mov rdx, rax
lea rcx, [rbp + 0x338]
call fcn.1400d7cf0
nop
mov rax, qword [0x14040e6e8]
mov esi, dword [r15 + rax + 0x18]
mov rax, qword [rbp + 0x160]
mov r14, qword [rax + 0xa]
mov rdi, qword [0x14040e780]
mov rbx, qword [0x14040e778]
cmp rbx, rdi
je 0x1400f8dde
mov rax, qword [rbx]
lea r9, [rbp + 0x338]
mov r8d, esi
mov edx, r13d
mov rcx, r14
call rax
add rbx, 8
cmp rbx, rdi
jne 0x1400f8dc0
lea rcx, [rbp + 0x338]
call fcn.1400d7d30
and dword [rsp + 0x38], 0xfffffffd
lea rcx, [rbp + 0x2b0]
call fcn.1400d7d30
nop
lea rcx, [rbp + 0x208]
call fcn.1400f6990
jmp 0x1400f9c83
mov rax, qword [0x14040e6e8]
mov r14d, dword [r15 + rax + 0x18]
mov rax, qword [rbp + 0x160]
mov r15, qword [rax + 0xa]
xor eax, eax
mov esi, eax
cmp dword [0x14040e6c8], 1
je 0x1400f8efd
mov ebx, eax
xor edx, edx
xor ecx, ecx
lea r8d, [rax + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r12, rax
test rax, rax
je 0x1400f8ef3
mov r8d, reloc.WS2_32.dll_sendto
lea rdx, [0x1403bc1c0]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x1400f8ee1
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x2f8], xmm0
mov qword [rbp + 0x308], rax
mov dword [rbp + 0x310], eax
lea rdx, [rbp + 0x2f8]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x1400f8ed1
cmp dword [rbp + 0x2fc], 1
jne 0x1400f8ec1
mov esi, dword [rbp + 0x304]
mov eax, dword [rbp + 0x308]
test eax, eax
cmovne esi, eax
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1400f8ee6
mov ebx, 0xffffffb0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1400f8ee6
mov ebx, 0xffffffae
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1400f8ee6
mov ebx, 0xffffffad
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test ebx, ebx
jns 0x1400f8ef8
mov esi, 0xffffffff
mov r12, qword [rsp + 0x48]
mov rdi, qword [0x14040e798]
mov rbx, qword [0x14040e790]
cmp rbx, rdi
je 0x1400f9c83
nop dword [rax]
nop dword [rax + rax]
mov r9d, esi
mov r8d, r14d
mov edx, r13d
mov rcx, r15
call qword [rbx]
add rbx, 8
cmp rbx, rdi
jne 0x1400f8f20
jmp 0x1400f9c83
xorps xmm0, xmm0
movups xmmword [rbp + 0x258], xmm0
movups xmmword [rbp + 0x268], xmm0
mov ebx, dword [rbp + 0x16c]
lea rax, vtable.Vanguard::Message.0
mov qword [rbp + 0x258], rax
mov qword [rbp + 0x260], r14
mov qword [rbp + 0x268], 0
mov qword [rbp + 0x270], r14
mov qword [rbp + 0x278], r14
mov ecx, Ordinal_50
call fcn.140130550
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp + 0x270], rax
mov rdi, qword [rbp + 0x260]
test rdi, rdi
jne 0x1400f9009
cmp ebx, 0x1a
mov edi, reloc.WLDAP32.dll_Ordinal_26
cmovb ebx, edi
mov ecx, ebx
call fcn.140130e50
mov qword [rbp + 0x260], rax
mov dword [rbp + 0x26c], ebx
mov dword [rbp + 0x268], edi
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rax], xmm0
mov qword [rax + 0x10], rcx
mov word [rax + 0x18], cx
mov rax, qword [rbp + 0x260]
mov word [rax + 8], r14w
mov rcx, qword [rbp + 0x260]
mov eax, dword [rbp + 0x268]
mov dword [rcx + 4], eax
mov rdi, qword [rbp + 0x260]
jmp 0x1400f904b
cmp dword [rbp + 0x26c], ebx
jae 0x1400f904b
mov rcx, rbx
call fcn.140130e50
mov rdi, rax
mov r8d, dword [rbp + 0x268]
mov rdx, qword [rbp + 0x260]
mov rcx, rax
call fcn.1401329d0
mov rcx, qword [rbp + 0x260]
call fcn.140130510
mov qword [rbp + 0x260], rdi
mov dword [rbp + 0x26c], ebx
mov dword [rdi], esi
lea rax, vtable.Vanguard::Message.0
mov qword [rbp + 0x258], rax
lea rdx, [rbp + 0x170]
lea rcx, [rbp + 0x270]
call fcn.1400fcfe0
mov ecx, dword [rbp + 0x168]
mov dword [rbp + 0x268], ecx
mov rax, qword [rbp + 0x260]
mov dword [rax + 4], ecx
mov rcx, qword [rbp + 0x260]
movzx eax, word [rbp + 0x278]
mov word [rcx + 8], ax
mov r8d, dword [rbp + 0x268]
mov rdx, qword [rbp + 0x160]
mov rcx, qword [rbp + 0x260]
call fcn.1401329d0
nop
lea rax, vtable.Vanguard::AresLoginMessage.0
mov qword [rbp + 0x258], rax
mov rax, qword [rbp + 0x260]
cmp dword [rax], 4
jne 0x1400f916d
mov word [rsp + 0x30], r14w
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x270]
call fcn.1400fdb50
lea r8, [rbp + 0x270]
mov rdx, rax
lea rcx, [rbp]
call fcn.1400fd1c0
lea r8, [rbp + 0x270]
mov rdx, qword [rbp + 0x270]
lea rcx, [rbp - 8]
call fcn.1400fd1c0
mov rax, qword [rbp - 8]
cmp qword [rbp], rax
je 0x1400f916d
mov eax, 1
mov word [rsp + 0x34], ax
lea rdx, [rsp + 0x34]
lea rcx, [rbp + 0x270]
call fcn.1400fdb50
lea r8, [rbp + 0x270]
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.1400fd1c0
lea r8, [rbp + 0x270]
mov rdx, qword [rbp + 0x270]
lea rcx, [rbp + 8]
call fcn.1400fd1c0
mov rax, qword [rbp + 8]
cmp qword [rbp + 0x10], rax
je 0x1400f916d
mov al, 1
jmp 0x1400f916f
xor al, al
test al, al
je 0x1400f9214
lea rdx, [rbp + 0x2b0]
lea rcx, [rbp + 0x258]
call fcn.1400f6c40
nop
lea rdx, [rbp + 0x338]
lea rcx, [rbp + 0x258]
call fcn.1400f6d40
nop
mov rax, qword [0x14040e6e8]
mov esi, dword [r15 + rax + 0x18]
mov rax, qword [rbp + 0x160]
mov r14, qword [rax + 0xa]
mov rdi, qword [0x14040e7c8]
mov rbx, qword [0x14040e7c0]
cmp rbx, rdi
je 0x1400f91fa
nop dword [rax]
mov rax, qword [rbx]
lea rcx, [rbp + 0x338]
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x2b0]
mov r8d, esi
mov edx, r13d
mov rcx, r14
call rax
add rbx, 8
cmp rbx, rdi
jne 0x1400f91d0
lea rcx, [rbp + 0x338]
call fcn.1400d7d30
nop
lea rcx, [rbp + 0x2b0]
call fcn.1400d7d30
nop
lea rcx, [rbp + 0x258]
call fcn.1400f6990
jmp 0x1400f9c83
xorps xmm0, xmm0
movups xmmword [rbp + 0x230], xmm0
movups xmmword [rbp + 0x240], xmm0
mov ebx, dword [rbp + 0x16c]
lea rax, vtable.Vanguard::Message.0
mov qword [rbp + 0x230], rax
mov qword [rbp + 0x238], r14
mov qword [rbp + 0x240], 0
mov qword [rbp + 0x248], r14
mov qword [rbp + 0x250], r14
mov ecx, Ordinal_50
call fcn.140130550
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp + 0x248], rax
mov rdi, qword [rbp + 0x238]
test rdi, rdi
jne 0x1400f92f2
cmp ebx, 0x1a
mov edi, reloc.WLDAP32.dll_Ordinal_26
cmovb ebx, edi
mov ecx, ebx
call fcn.140130e50
mov qword [rbp + 0x238], rax
mov dword [rbp + 0x244], ebx
mov dword [rbp + 0x240], edi
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rax], xmm0
mov qword [rax + 0x10], rcx
mov word [rax + 0x18], cx
mov rax, qword [rbp + 0x238]
mov word [rax + 8], r14w
mov rcx, qword [rbp + 0x238]
mov eax, dword [rbp + 0x240]
mov dword [rcx + 4], eax
mov rdi, qword [rbp + 0x238]
jmp 0x1400f9334
cmp dword [rbp + 0x244], ebx
jae 0x1400f9334
mov rcx, rbx
call fcn.140130e50
mov rdi, rax
mov r8d, dword [rbp + 0x240]
mov rdx, qword [rbp + 0x238]
mov rcx, rax
call fcn.1401329d0
mov rcx, qword [rbp + 0x238]
call fcn.140130510
mov qword [rbp + 0x238], rdi
mov dword [rbp + 0x244], ebx
mov dword [rdi], esi
lea rax, vtable.Vanguard::Message.0
mov qword [rbp + 0x230], rax
lea rdx, [rbp + 0x170]
lea rcx, [rbp + 0x248]
call fcn.1400fcfe0
mov ecx, dword [rbp + 0x168]
mov dword [rbp + 0x240], ecx
mov rax, qword [rbp + 0x238]
mov dword [rax + 4], ecx
mov rcx, qword [rbp + 0x238]
movzx eax, word [rbp + 0x250]
mov word [rcx + 8], ax
mov r8d, dword [rbp + 0x240]
mov rdx, qword [rbp + 0x160]
mov rcx, qword [rbp + 0x238]
call fcn.1401329d0
nop
lea rax, vtable.Vanguard::AresMatchStartMessage.0
mov qword [rbp + 0x230], rax
mov rax, qword [rbp + 0x238]
cmp dword [rax], 5
jne 0x1400f9403
mov word [rsp + 0x30], r14w
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x248]
call fcn.1400fdb50
lea r8, [rbp + 0x248]
mov rdx, rax
lea rcx, [rbp + 0x20]
call fcn.1400fd1c0
lea r8, [rbp + 0x248]
mov rdx, qword [rbp + 0x248]
lea rcx, [rbp + 0x18]
call fcn.1400fd1c0
mov rax, qword [rbp + 0x18]
cmp qword [rbp + 0x20], rax
je 0x1400f9403
mov al, 1
jmp 0x1400f9405
xor al, al
test al, al
je 0x1400f9530
lea rcx, [rbp + 0x2b0]
call fcn.1400d3c10
mov eax, dword [rsp + 0x38]
or eax, 0x10
mov dword [rsp + 0x38], eax
mov dword [rbp + 0x1d0], eax
mov word [rsp + 0x30], r14w
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x248]
call fcn.1400fdb50
lea r8, [rbp + 0x248]
mov rdx, rax
lea rcx, [rbp + 0x30]
call fcn.1400fd1c0
lea r8, [rbp + 0x248]
mov rdx, qword [rbp + 0x248]
lea rcx, [rbp + 0x28]
call fcn.1400fd1c0
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x30], rax
je 0x1400f94ce
mov word [rsp + 0x64], r14w
lea rdx, [rsp + 0x64]
lea rcx, [rbp + 0x248]
call fcn.1400fddb0
mov rcx, qword [rax]
mov rax, qword [rbp + 0x238]
mov ebx, dword [rax + rcx + 2]
mov word [rsp + 0x66], r14w
lea rdx, [rsp + 0x66]
lea rcx, [rbp + 0x248]
call fcn.1400fddb0
mov rdx, qword [rbp + 0x238]
add rdx, 6
add rdx, qword [rax]
mov r8d, ebx
lea rcx, [rbp + 0x2b0]
call fcn.1400d7b90
mov rax, qword [0x14040e6e8]
mov esi, dword [r15 + rax + 0x18]
mov rax, qword [rbp + 0x160]
mov r14, qword [rax + 0xa]
mov rdi, qword [0x14040e7e0]
mov rbx, qword [0x14040e7d8]
cmp rbx, rdi
je 0x1400f951e
nop dword [rax + rax]
mov rax, qword [rbx]
lea r9, [rbp + 0x2b0]
mov r8d, esi
mov edx, r13d
mov rcx, r14
call rax
add rbx, 8
cmp rbx, rdi
jne 0x1400f9500
and dword [rsp + 0x38], 0xffffffef
lea rcx, [rbp + 0x2b0]
call fcn.1400d7d30
nop
lea rcx, [rbp + 0x230]
call fcn.1400f6990
jmp 0x1400f9c83
mov edx, Ordinal_41
lea rcx, [rbp + 0x288]
call fcn.1400fa1b0
mov ebx, dword [rbp + 0x16c]
mov rax, qword [rbp + 0x160]
mov esi, dword [rax]
lea rax, vtable.Vanguard::Message.0
mov qword [rbp + 0x288], rax
mov qword [rbp + 0x290], r14
mov qword [rbp + 0x298], 0
mov qword [rbp + 0x2a0], r14
mov qword [rbp + 0x2a8], r14
mov ecx, Ordinal_50
call fcn.140130550
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp + 0x2a0], rax
mov rdi, qword [rbp + 0x290]
test rdi, rdi
jne 0x1400f9617
cmp ebx, 0x1a
mov edi, reloc.WLDAP32.dll_Ordinal_26
cmovb ebx, edi
mov ecx, ebx
call fcn.140130e50
mov qword [rbp + 0x290], rax
mov dword [rbp + 0x29c], ebx
mov dword [rbp + 0x298], edi
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rax], xmm0
mov qword [rax + 0x10], rcx
mov word [rax + 0x18], cx
mov rax, qword [rbp + 0x290]
mov word [rax + 8], r14w
mov rcx, qword [rbp + 0x290]
mov eax, dword [rbp + 0x298]
mov dword [rcx + 4], eax
mov rdi, qword [rbp + 0x290]
jmp 0x1400f9659
cmp dword [rbp + 0x29c], ebx
jae 0x1400f9659
mov rcx, rbx
call fcn.140130e50
mov rdi, rax
mov r8d, dword [rbp + 0x298]
mov rdx, qword [rbp + 0x290]
mov rcx, rax
call fcn.1401329d0
mov rcx, qword [rbp + 0x290]
call fcn.140130510
mov qword [rbp + 0x290], rdi
mov dword [rbp + 0x29c], ebx
mov dword [rdi], esi
lea rax, vtable.Vanguard::Message.0
mov qword [rbp + 0x288], rax
lea rdx, [rbp + 0x170]
lea rcx, [rbp + 0x2a0]
call fcn.1400fcfe0
mov ecx, dword [rbp + 0x168]
mov dword [rbp + 0x298], ecx
mov rax, qword [rbp + 0x290]
mov dword [rax + 4], ecx
mov rcx, qword [rbp + 0x290]
movzx eax, word [rbp + 0x2a8]
mov word [rcx + 8], ax
mov r8d, dword [rbp + 0x298]
mov rdx, qword [rbp + 0x160]
mov rcx, qword [rbp + 0x290]
call fcn.1401329d0
nop
lea rax, vtable.Vanguard::ClientAuthenticationResultMessage.0
mov qword [rbp + 0x288], rax
mov rax, qword [rbp + 0x290]
cmp dword [rax], 7
jne 0x1400f978c
mov word [rsp + 0x30], r14w
lea r8, [rsp + 0x30]
lea rdx, [rbp + 0x58]
lea rcx, [rbp + 0x2a0]
call fcn.1400fde10
mov rbx, rax
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x2a0]
call fcn.1400fde60
mov rdx, rax
mov rcx, rbx
call fcn.1400e06d0
test al, al
je 0x1400f978c
lea rcx, [rbp + 0x288]
call fcn.1400f6f90
movzx esi, al
mov rcx, qword [0x14040e6e8]
mov r14d, dword [r15 + rcx + 0x18]
mov rcx, qword [rbp + 0x160]
mov r15, qword [rcx + 0xa]
lea rcx, [0x14040e808]
call fcn.1400fceb0
mov rbx, rax
lea rcx, [0x14040e808]
call fcn.1400fcea0
mov rdi, rax
cmp rbx, rax
je 0x1400f978c
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rbx]
movzx r9d, sil
mov r8d, r14d
mov edx, r13d
mov rcx, r15
call r10
add rbx, 8
cmp rbx, rdi
jne 0x1400f9770
lea rcx, [rbp + 0x288]
call fcn.1400f6990
jmp 0x1400f9c83
mov edx, Ordinal_41
lea rcx, [rbp + 0x180]
call fcn.1400fa1b0
mov ebx, dword [rbp + 0x16c]
mov rax, qword [rbp + 0x160]
mov esi, dword [rax]
lea rax, vtable.Vanguard::Message.0
mov qword [rbp + 0x180], rax
mov qword [rbp + 0x188], r14
mov qword [rbp + 0x190], 0
mov qword [rbp + 0x198], r14
mov qword [rbp + 0x1a0], r14
mov ecx, Ordinal_50
call fcn.140130550
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp + 0x198], rax
mov rdi, qword [rbp + 0x188]
test rdi, rdi
jne 0x1400f9873
cmp ebx, 0x1a
mov edi, reloc.WLDAP32.dll_Ordinal_26
cmovb ebx, edi
mov ecx, ebx
call fcn.140130e50
mov qword [rbp + 0x188], rax
mov dword [rbp + 0x194], ebx
mov dword [rbp + 0x190], edi
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rax], xmm0
mov qword [rax + 0x10], rcx
mov word [rax + 0x18], cx
mov rax, qword [rbp + 0x188]
mov word [rax + 8], r14w
mov rcx, qword [rbp + 0x188]
mov eax, dword [rbp + 0x190]
mov dword [rcx + 4], eax
mov rdi, qword [rbp + 0x188]
jmp 0x1400f98b5
cmp dword [rbp + 0x194], ebx
jae 0x1400f98b5
mov rcx, rbx
call fcn.140130e50
mov rdi, rax
mov r8d, dword [rbp + 0x190]
mov rdx, qword [rbp + 0x188]
mov rcx, rax
call fcn.1401329d0
mov rcx, qword [rbp + 0x188]
call fcn.140130510
mov qword [rbp + 0x188], rdi
mov dword [rbp + 0x194], ebx
mov dword [rdi], esi
lea rax, vtable.Vanguard::Message.0
mov qword [rbp + 0x180], rax
lea rdx, [rbp + 0x170]
lea rcx, [rbp + 0x198]
call fcn.1400fcfe0
mov ecx, dword [rbp + 0x168]
mov dword [rbp + 0x190], ecx
mov rax, qword [rbp + 0x188]
mov dword [rax + 4], ecx
mov rcx, qword [rbp + 0x188]
movzx eax, word [rbp + 0x1a0]
mov word [rcx + 8], ax
mov r8d, dword [rbp + 0x190]
mov rdx, qword [rbp + 0x160]
mov rcx, qword [rbp + 0x188]
call fcn.1401329d0
nop
lea rax, vtable.Vanguard::ModuleExecutionReport.0
mov qword [rbp + 0x180], rax
mov rax, qword [rbp + 0x188]
cmp dword [rax], 6
jne 0x1400f9a09
mov word [rsp + 0x30], r14w
lea r8, [rsp + 0x30]
lea rdx, [rbp + 0x68]
lea rcx, [rbp + 0x198]
call fcn.1400fde10
mov rbx, rax
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x198]
call fcn.1400fde60
mov rdx, rax
mov rcx, rbx
call fcn.1400e06d0
mov edi, 1
test al, al
je 0x1400f9a0e
mov word [rsp + 0x34], di
lea r8, [rsp + 0x34]
lea rdx, [rbp + 0x78]
lea rcx, [rbp + 0x198]
call fcn.1400fde10
mov rbx, rax
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x198]
call fcn.1400fde60
mov rdx, rax
mov rcx, rbx
call fcn.1400e06d0
lea esi, [rdi + 1]
test al, al
je 0x1400f9a13
mov word [rsp + 0x32], si
lea r8, [rsp + 0x32]
lea rdx, [rbp + 0x88]
lea rcx, [rbp + 0x198]
call fcn.1400fde10
mov rbx, rax
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x198]
call fcn.1400fde60
mov rdx, rax
mov rcx, rbx
call fcn.1400e06d0
test al, al
je 0x1400f9a13
movzx eax, dil
jmp 0x1400f9a15
mov edi, 1
mov esi, 2
xor al, al
test al, al
je 0x1400f9c77
mov word [rsp + 0x30], si
lea r8, [rsp + 0x30]
lea rdx, [rbp + 0x98]
lea rcx, [rbp + 0x198]
call fcn.1400fde10
mov rbx, rax
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x198]
call fcn.1400fde60
mov rdx, rax
mov rcx, rbx
call fcn.1400fd140
test al, al
jne 0x1400f9aaf
mov word [rsp + 0x34], si
lea rdx, [rsp + 0x34]
lea rcx, [rbp + 0x198]
call fcn.1400fddb0
mov rcx, qword [rax]
mov rax, qword [rbp + 0x188]
cmp dword [rax + rcx + 2], 8
jne 0x1400f9aaf
mov word [rsp + 0x32], si
lea rdx, [rsp + 0x32]
lea rcx, [rbp + 0x198]
call fcn.1400fddb0
mov rcx, qword [rax]
mov rax, qword [rbp + 0x188]
mov rax, qword [rcx + rax + 6]
mov qword [rbp - 0x70], rax
mov word [rsp + 0x30], di
lea r8, [rsp + 0x30]
lea rdx, [rbp + 0xa8]
lea rcx, [rbp + 0x198]
call fcn.1400fde10
mov rbx, rax
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x198]
call fcn.1400fde60
mov rdx, rax
mov rcx, rbx
call fcn.1400fd140
test al, al
jne 0x1400f9b40
mov word [rsp + 0x34], di
lea rdx, [rsp + 0x34]
lea rcx, [rbp + 0x198]
call fcn.1400fddb0
mov rcx, qword [rax]
mov rax, qword [rbp + 0x188]
cmp dword [rax + rcx + 2], 1
jne 0x1400f9b40
mov word [rsp + 0x32], di
lea rdx, [rsp + 0x32]
lea rcx, [rbp + 0x198]
call fcn.1400fddb0
mov rcx, qword [rax]
mov rax, qword [rbp + 0x188]
movzx eax, byte [rcx + rax + 6]
mov byte [rbp + 0x150], al
lea rcx, [rbp + 0x2b0]
call fcn.1400d3c10
mov eax, dword [rsp + 0x38]
or eax, 0x20
mov dword [rsp + 0x38], eax
mov dword [rbp + 0x1d0], eax
mov word [rsp + 0x30], r14w
lea r8, [rsp + 0x30]
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0x198]
call fcn.1400fde10
mov rbx, rax
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x198]
call fcn.1400fde60
mov rdx, rax
mov rcx, rbx
call fcn.1400fd140
test al, al
jne 0x1400f9bf3
mov word [rsp + 0x68], r14w
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x198]
call fcn.1400fddb0
mov rcx, qword [rax]
mov rax, qword [rbp + 0x188]
mov ebx, dword [rax + rcx + 2]
mov word [rsp + 0x50], r14w
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x198]
call fcn.1400fddb0
mov rdx, qword [rbp + 0x188]
add rdx, 6
add rdx, qword [rax]
mov r8d, ebx
lea rcx, [rbp + 0x2b0]
call fcn.1400d7b90
mov rax, qword [0x14040e6e8]
mov esi, dword [r15 + rax + 0x18]
mov rax, qword [rbp + 0x160]
mov r14, qword [rax + 0xa]
lea rcx, [0x14040e7f0]
call fcn.1400fced0
mov rbx, rax
lea rcx, [0x14040e7f0]
call fcn.1400fcec0
mov rdi, rax
cmp rbx, rax
je 0x1400f9c65
mov r12, qword [rbp - 0x70]
mov r10, qword [rbx]
mov qword [rsp + 0x28], r12
movzx eax, byte [rbp + 0x150]
mov byte [rsp + 0x20], al
lea r9, [rbp + 0x2b0]
mov r8d, esi
mov edx, r13d
mov rcx, r14
call r10
add rbx, 8
cmp rbx, rdi
jne 0x1400f9c31
mov r12, qword [rsp + 0x48]
and dword [rsp + 0x38], 0xffffffdf
lea rcx, [rbp + 0x2b0]
call fcn.1400d7d90
nop
lea rcx, [rbp + 0x180]
call fcn.1400f6990
mov rdi, qword [rsp + 0x40]
mov eax, dword [rbp + 0x168]
add r12, rax
mov qword [rsp + 0x48], r12
mov r15, qword [rbp + 0x38]
mov rax, qword [rbp - 0x68]
mov r8, qword [rsp + 0x78]
jmp 0x1400f8520
mov rcx, qword [rbp + 0x1d0]
mov rbx, qword [rcx + 8]
cmp byte [rbx + 0x19], 0
jne 0x1400f9cf4
nop dword [rax]
mov r8, qword [rbx + 0x10]
lea rdx, [rbp + 0x1d0]
lea rcx, [rbp + 0x1d0]
call fcn.1400fdbb0
mov rcx, rbx
mov rbx, qword [rbx]
mov edx, Ordinal_50
call fcn.140130510
cmp byte [rbx + 0x19], 0
je 0x1400f9cc0
mov rcx, qword [rbp + 0x1d0]
mov edx, Ordinal_50
call fcn.140130510
mov rdi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
mov rcx, qword [rbp - 0x80]
mov qword [rcx], rax
lea rax, vtable.Vanguard::Message.0
mov qword [rbp + 0x158], rax
mov rcx, qword [rbp + 0x160]
test rcx, rcx
je 0x1400f9d2e
call fcn.140130510
mov rcx, qword [rbp + 0x170]
mov rbx, qword [rcx + 8]
cmp byte [rbx + 0x19], 0
jne 0x1400f9d74
nop
mov r8, qword [rbx + 0x10]
lea rdx, [rbp + 0x170]
lea rcx, [rbp + 0x170]
call fcn.1400fdbb0
mov rcx, rbx
mov rbx, qword [rbx]
mov edx, Ordinal_50
call fcn.140130510
cmp byte [rbx + 0x19], 0
je 0x1400f9d40
mov rcx, qword [rbp + 0x170]
mov edx, Ordinal_50
call fcn.140130510
mov rdx, qword [0x14040e6f0]
mov r8, qword [0x14040e6e8]
mov rcx, qword [0x14040e6d0]
mov r14, qword [rbp - 0x78]
mov r10, qword [rbp + 0x2d0]
xor esi, esi
inc r13d
inc r14
mov qword [rbp - 0x78], r14
cmp r13d, 0xfe
jb 0x1400f8360
test rdx, rdx
je 0x1400f9dd7
test rcx, rcx
je 0x1400f9dd7
sub rcx, rdx
shr rcx, 0xc
lea eax, [rcx - 1]
inc rax
imul rcx, rax, 0x38
add rcx, r8
jmp 0x1400f9ddc
mov ecx, Ordinal_50
mov qword [rcx], rdi
call fcn.14012f870
mov rbx, rax
call fcn.14012f854
cmp rbx, 0x989680
jne 0x1400f9dfb
imul rax, rax, 0x64
jmp 0x1400f9e19
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
imul rcx, rcx, 0x3b9aca00
add rax, rcx
mov rcx, qword [rsp + 0x70]
mov qword [rcx + 0x20], rax
mov r15d, esi
mov r12, rsi
mov qword [rsp + 0x58], rsi
mov rbx, qword [0x14040e6e8]
nop dword [rax]
nop dword [rax + rax]
lea rdi, [r12 + rbx]
cmp dword [rdi + 8], 0xffffffff
jne 0x1400fa035
call fcn.14012f870
mov rbx, rax
call fcn.14012f854
cmp rbx, 0x989680
jne 0x1400f9e6a
imul rax, rax, 0x64
jmp 0x1400f9e88
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
imul rcx, rcx, 0x3b9aca00
add rax, rcx
sub rax, qword [rdi + 0x28]
movabs rcx, 0x12a05f200
cmp rax, rcx
jbe 0x1400fa02e
mov rax, qword [0x14040e6e8]
mov r13d, dword [r12 + rax + 0x18]
call fcn.14012f870
mov rbx, rax
call fcn.14012f854
cmp rbx, 0x989680
jne 0x1400f9ec7
imul rbx, rax, 0x64
jmp 0x1400f9ee8
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
mov rbx, rax
imul rax, rcx, 0x3b9aca00
add rbx, rax
cmp dword [0x14040e6c8], 1
je 0x1400f9fbd
xor ecx, ecx
mov edi, ecx
xor edx, edx
lea r8d, [rcx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r12, rax
test rax, rax
je 0x1400f9fb3
mov r8d, reloc.WS2_32.dll_sendto
lea rdx, [0x1403bc1c0]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov r14, rax
test rax, rax
je 0x1400f9fa1
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x318], xmm0
mov qword [rbp + 0x328], rax
mov dword [rbp + 0x330], eax
lea rdx, [rbp + 0x318]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x1400f9f91
cmp dword [rbp + 0x31c], 1
jne 0x1400f9f81
mov esi, dword [rbp + 0x324]
mov eax, dword [rbp + 0x328]
test eax, eax
cmovne esi, eax
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1400f9fa6
mov edi, 0xffffffb0
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1400f9fa6
mov edi, 0xffffffae
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1400f9fa6
mov edi, 0xffffffad
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
jns 0x1400f9fb8
mov esi, 0xffffffff
mov r12, qword [rsp + 0x58]
mov r14, qword [0x14040e798]
mov rdi, qword [0x14040e790]
cmp rdi, r14
je 0x1400f9fe7
mov r9d, esi
mov r8d, r13d
mov edx, r15d
mov rcx, rbx
call qword [rdi]
add rdi, 8
cmp rdi, r14
jne 0x1400f9fd0
mov ecx, r15d
imul rax, rcx, 0x38
mov rbx, qword [0x14040e6e8]
xorps xmm0, xmm0
xor edx, edx
movups xmmword [rax + rbx + 8], xmm0
movups xmmword [rax + rbx + 0x18], xmm0
movups xmmword [rax + rbx + 0x28], xmm0
mov qword [rax + rbx + 0x38], rdx
inc rcx
shl rcx, 0xc
add rcx, qword [0x14040e6f0]
mov r8d, 0x1000
call fcn.140133080
dec dword [rbx + 4]
xor esi, esi
jmp 0x1400fa035
mov rbx, qword [0x14040e6e8]
inc r15d
add r12, 0x38
mov qword [rsp + 0x58], r12
cmp r15d, 0xfe
jb 0x1400f9e40
mov r12d, reloc.WLDAP32.dll_Ordinal_26
jmp 0x1400f82f0
mov rdi, qword [0x14040e768]
mov rbx, qword [0x14040e760]
cmp rbx, rdi
je 0x1400f82f7
mov ecx, 0xffffffa4
call qword [rbx]
add rbx, 8
cmp rbx, rdi
jne 0x1400fa070
jmp 0x1400f82f7
lea rcx, [0x1403fe908]
call fcn.1400cfc30
test al, al
je 0x1400fa0ee
lea rcx, [0x1403fe908]
call fcn.1400cfc40
mov rdi, rax
mov ecx, r13d
imul rdx, rcx, 0x38
mov rcx, qword [0x14040e6e8]
mov ebx, dword [rdx + rcx + 0x18]
mov dword [rbp + 0x1d0], 0x1000008c
lea rdx, [rbp + 0x1d0]
lea rcx, [0x14040c730]
call fcn.1400cfbe0
mov rcx, rax
call fcn.1400d9100
mov r9d, ebx
mov r8, rax
mov edx, 6
mov rcx, rdi
call fcn.1400d88a0
mov dword [0x14040c150], 0x1000008c
xor r8d, r8d
mov ebx, 1
mov edx, ebx
mov ecx, ebx
call fcn.1400d9fb0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, qword [0x14040e6f0]
test rcx, rcx
je 0x1400fa124
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, qword [0x14040e6f8]
test rcx, rcx
je 0x1400fa136
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x14040e6f0], rsi
mov qword [0x14040e6f8], rsi
mov qword [0x14040e6e8], rsi
mov qword [0x14040e6d0], rsi
xor eax, eax
jmp 0x1400fa158
mov eax, ecx
mov rcx, qword [rbp + 0x448]
xor rcx, rsp
call fcn.1401304f0
lea r11, [rsp + 0x550]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, eax
call fcn.14012de70
int3