Function at 0x1400fe270
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call
Parse pe header
Query environment variable
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov rax, qword [0x140236800]
xor rax, rsp
mov qword [rbp + 0x38], rax
mov qword [rbp - 0x38], rdx
mov qword [rbp - 0x40], rcx
xor r14d, r14d
mov qword [rbp - 0x48], r14
mov esi, r14d
mov qword [rbp - 0x80], r14
mov dword [rbp - 0x10], r14d
lea r9, [rbp - 0x10]
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x1400fe31f
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp - 0x10]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
lea r9, [rbp - 0x10]
mov r8d, dword [rbp - 0x10]
mov rdx, rax
mov ecx, listen
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x1400fe2d5
mov qword [rbp - 0x80], rsi
test eax, eax
js 0x1401007f3
mov eax, r14d
mov dword [rsp + 0x2c], eax
cmp dword [rsi], r14d
jbe 0x1401007f3
movzx edi, byte [rsp + 0x28]
movzx ebx, byte [rsp + 0x28]
movzx r13d, byte [rsp + 0x28]
movzx r12d, byte [rsp + 0x28]
movzx r15d, byte [rsp + 0x28]
mov qword [rsp + 0x20], r15
nop dword [rax + rax]
imul rcx, rax, 0x128
lea rax, [rcx + rsi]
mov qword [rbp - 0x50], rax
movzx eax, word [rax + 0x2e]
add rax, rcx
add rsi, rax
movzx edx, dil
lea rcx, [rbp + 0x18]
call fcn.1400029d0
nop
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rsi + r8 + 0x30], 0
jne 0x1400fe390
lea rdx, [rsi + 0x30]
lea rcx, [rbp + 0x18]
call fcn.140004440
nop
lea rcx, [rbp + 0x18]
call fcn.140001ba0
mov rdx, qword [rbp - 0x40]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x1401007d4
mov rdx, qword [rbp - 0x50]
add rdx, 0x30
lea rcx, [rbp - 8]
call fcn.1400042b0
nop
mov dword [rsp + 0x58], 0xe7e198e3
mov dword [rsp + 0x5c], 0xe8e4e8f1
mov word [rsp + 0x60], 0xddd7
mov byte [rsp + 0x62], 0xa
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x63], xmm0
mov qword [rsp + 0x73], rax
nop dword [rax]
nop dword [rax + rax]
mov r8, qword [0x14023d108]
mov r9, qword [0x14023d100]
nop
mov rsi, r14
cmp rsi, 0x23
jae 0x1400fef47
movzx r10d, byte [rsp + rsi + 0x58]
movzx r11d, r10b
cmp r8, rsi
ja 0x1400fef3e
lea rax, [r9 + 1]
cmp r8, rax
jae 0x1400fe46c
movabs rcx, 0x456fef4d4abc1058
add rcx, rsi
mov rax, rcx
and rax, r10
imul r13, rax, 0xfffffffffffffffe
add r13, rcx
add r13, r10
sub r13b, 0x68
jmp 0x1400fe48b
je 0x1400feeca
inc rax
cmp r8, rax
je 0x1400fee67
lea rax, [r9 + 3]
cmp r8, rax
je 0x1400fee01
movzx r11d, r10b
nop
cmp r9, rsi
ja 0x1400fef35
lea rax, [r9 + 0x20]
cmp r8, rax
jae 0x1400fe4c8
movabs rdx, 0xb22ea157216d5738
add rdx, rsi
movzx eax, dl
and al, r10b
mov ecx, reloc.WLDAP32.dll_Ordinal_60
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r11b
add r13b, dl
jmp 0x1400fe4f0
lea rax, [r9 + 1]
cmp r8, rax
je 0x1400fedac
lea rax, [r9 + 5]
cmp r8, rax
je 0x1400fed83
lea rax, [r9 + 3]
cmp r8, rax
je 0x1400fed5e
nop
lea rax, [r9 + r8]
cmp rax, rsi
jbe 0x1400fea6e
nop dword [rax]
lea rax, [r9 + 0x64]
cmp r8, rax
je 0x1400fea4a
lea rcx, [r9 + 9]
cmp r8, rcx
je 0x1400fea23
lea rax, [r9 + 0x200]
cmp r8, rax
je 0x1400fea02
lea rax, [r9 + 0x10]
cmp r8, rax
je 0x1400feafd
lea rax, [r9 + 0x400]
cmp r8, rax
je 0x1400fe9e3
lea rax, [r9 + 0x28]
cmp r8, rax
je 0x1400fe9c4
lea rax, [r9 + 0x61]
cmp r8, rax
je 0x1400fe9a3
lea rax, [r9 + 0x42]
cmp r8, rax
je 0x1400fe985
lea rax, [r9 + 0x41]
cmp r8, rax
je 0x1400fe95c
lea rax, [r9 + 0x80]
cmp r8, rax
je 0x1400fe500
mov r8, rcx
lea r9, [rcx + 0x2a]
lea rax, [r9 + 1]
cmp rcx, rax
jb 0x1400fef18
lea rax, [r9 + 0x10]
cmp rcx, rax
jb 0x1400feefb
lea rax, [r9 + 3]
cmp rcx, rax
jb 0x1400fe708
lea rax, [r9 + 0x28]
cmp rcx, rax
jb 0x1400fe6df
lea rax, [r9 + 5]
cmp rcx, rax
jb 0x1400fe6b7
lea rax, [r9 + 0x42]
cmp rcx, rax
jb 0x1400fe90c
lea rax, [r9 + 8]
cmp rcx, rax
jb 0x1400fe8c1
lea rax, [r9 + 0x2a]
cmp rcx, rax
jb 0x1400fe87c
lea rax, [r9 + 0xa]
cmp rcx, rax
jb 0x1400fe855
lea rax, [r9 + 2]
cmp rcx, rax
jb 0x1400fe500
lea r8, [r9 + 0x400]
lea r9, [r8 + 0x20]
lea rax, [r9 + 3]
cmp r8, rax
ja 0x1400fe828
lea rax, [r9 + 0x61]
cmp r8, rax
ja 0x1400fe809
lea rax, [r9 + 0x42]
cmp r8, rax
ja 0x1400fe7ea
lea rax, [r9 + 0x41]
cmp r8, rax
ja 0x1400fe7cf
lea rax, [r9 + 0x80]
cmp r8, rax
ja 0x1400fe7b7
lea rax, [r9 + 0x2a]
cmp r8, rax
ja 0x1400fe798
lea rax, [r9 + 0x3e8]
cmp r8, rax
ja 0x1400fe773
lea rax, [r9 + 2]
cmp r8, rax
ja 0x1400fe74f
lea rax, [r9 + 0x1000]
cmp r8, rax
ja 0x1400fe731
lea rax, [r9 + 4]
cmp r8, rax
ja 0x1400fe500
lea r8, [r9 + 5]
lea r9, [r8 + 0x7a]
jmp 0x1400fe500
movabs rdx, 0xb3c6eef7941cdfc8
add rdx, rsi
movzx eax, dl
and al, r10b
add al, al
movzx r13d, r11b
sub r13b, al
sub r13b, 0x78
add r13b, dl
jmp 0x1400fe4f0
movabs rdx, 0x28e7105cfea4bf18
add rdx, rsi
movzx eax, dl
and al, r10b
mov ecx, Ordinal_45
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r11b
add r13b, dl
jmp 0x1400fe490
movabs rdx, 0x9e0731c2692c9e68
add rdx, rsi
movzx eax, dl
and al, r10b
mov ecx, reloc.WS2_32.dll_sendto
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r11b
add r13b, dl
jmp 0x1400fe437
lea edx, [rsi - 0x40]
movzx eax, r10b
and al, dl
add al, al
movzx r13d, r10b
sub r13b, al
sub r13b, 0x40
add r13b, dl
jmp 0x1400fedd1
lea ecx, [rsi + 0x10]
movzx eax, r10b
and al, cl
add al, al
sub r10b, al
lea r13d, [rcx + r10]
sub r13b, 0x70
inc r9
dec rsi
inc rsi
jmp 0x1400fe423
lea edx, [rsi + 0x60]
movzx eax, r10b
and al, dl
mov ecx, Ordinal_50
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r10b
add r13b, dl
dec rsi
inc rsi
jmp 0x1400fe423
lea edx, [rsi - 0x50]
movzx eax, r10b
and al, dl
mov ecx, Ordinal_26
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r10b
add r13b, dl
jmp 0x1400fee26
movzx ecx, sil
and cl, r10b
add cl, cl
movzx r13d, sil
sub r13b, cl
add r13b, r10b
jmp 0x1400fee4b
lea ecx, [rsi + 0x50]
movzx eax, r10b
and al, cl
add al, al
sub r10b, al
lea r13d, [rcx + r10]
sub r13b, 0x30
jmp 0x1400fee4e
lea edx, [rsi - 0x60]
movzx eax, r10b
and al, dl
add al, al
movzx r13d, r10b
sub r13b, al
sub r13b, 0x60
movzx r11d, sil
jmp 0x1400fed2d
lea edx, [rsi - 0x10]
movzx eax, r10b
and al, dl
mov ecx, gethostname
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r10b
add r13b, dl
jmp 0x1400fee8c
lea edx, [rsi + 0x40]
movzx eax, r10b
and al, dl
mov ecx, reloc.WLDAP32.dll_Ordinal_32
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r10b
add r13b, dl
movzx eax, byte [rsp + rsi + 0x58]
add rax, r9
add rsi, rax
inc rsi
jmp 0x1400fe423
lea edx, [rsi - 0x78]
movzx eax, r10b
and al, dl
mov ecx, 0x24
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r10b
add r13b, dl
mov byte [rsp + rsi + 0x58], r13b
inc rsi
jmp 0x1400fe423
lea edx, [rsi - 0x28]
movzx eax, r10b
and al, dl
mov ecx, recv
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r10b
add r13b, dl
cmp r9, 0x20
jb 0x1400fe86f
movzx r11d, sil
lea edx, [r11 + 0x10]
movzx eax, r10b
and al, dl
mov ecx, 8
sub cl, al
add cl, cl
add cl, r10b
add cl, dl
lea r13d, [rcx + rcx]
jmp 0x1400fedd5
lea edx, [rsi + 0x28]
movzx eax, r10b
and al, dl
add al, al
movzx r13d, r10b
sub r13b, al
sub r13b, 0x18
add r13b, dl
cmp r8, 0x2a
jae 0x1400fece9
lea rax, [r9 + 0x200]
cmp r8, rax
jbe 0x1400fec33
lea edx, [rsi + 0x30]
movzx eax, r10b
and al, dl
add al, al
movzx r13d, r10b
sub r13b, al
sub r13b, 0x50
jmp 0x1400fe893
lea edx, [rsi + 0x78]
movzx eax, r10b
and al, dl
add al, al
movzx r13d, r10b
sub r13b, al
sub r13b, 0x48
add r13b, dl
lea rax, [r9 + r8]
cmp rax, 0x41
je 0x1400fed0f
lea rax, [r9 + 0x64]
cmp r8, rax
jbe 0x1400feb7f
lea edx, [rsi - 8]
movzx eax, r10b
and al, dl
mov ecx, Ordinal_30
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r10b
jmp 0x1400fe8d7
lea ecx, [rsi + 0x50]
movzx eax, r10b
and al, cl
add al, al
sub r10b, al
lea r13d, [rcx + r10]
sub r13b, 0x30
movzx eax, byte [rsp + rsi + 0x58]
add rax, r9
add rsi, rax
inc rsi
jmp 0x1400fe423
lea edx, [rsi - 0x60]
movzx eax, r10b
and al, dl
add al, al
movzx r13d, r10b
sub r13b, al
sub r13b, 0x60
add r13b, dl
jmp 0x1400fee8c
movzx r11d, sil
lea edx, [r11 - 0x10]
movzx eax, r10b
and al, dl
mov ecx, gethostname
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r10b
jmp 0x1400fed2d
lea edx, [rsi + 0x40]
movzx eax, r10b
and al, dl
mov ecx, reloc.WLDAP32.dll_Ordinal_32
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r10b
add r13b, dl
jmp 0x1400fee4e
lea edx, [rsi - 0x70]
movzx eax, r10b
and al, dl
mov ecx, 8
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r10b
add r13b, dl
jmp 0x1400fee4b
lea ecx, [rsi + 0x30]
movzx eax, r10b
and al, cl
add al, al
sub r10b, al
lea r13d, [rcx + r10]
sub r13b, 0x50
dec rsi
inc rsi
jmp 0x1400fe423
lea ecx, [rsi + 0x80]
movzx eax, r10b
and al, cl
add al, al
sub r10b, al
lea r13d, [rcx + r10]
add r13b, 0x80
inc r9
dec rsi
inc rsi
jmp 0x1400fe423
movzx r11d, sil
lea edx, [r11 - 0x30]
movzx eax, r10b
and al, dl
mov ecx, Ordinal_41
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r10b
add r13b, dl
jmp 0x1400fedd5
lea rax, [r9 + 0x61]
cmp r8, rax
jae 0x1400fea9c
movabs rcx, 0x456fef4d4abc1058
add rcx, rsi
movzx eax, cl
and al, r10b
add al, al
sub r11b, al
lea r13d, [rcx + r11]
sub r13b, 0x68
jmp 0x1400fe925
lea rax, [r9 + 1]
cmp r8, rax
jne 0x1400feace
lea ecx, [rsi + 0x70]
movzx eax, r10b
and al, cl
add al, al
sub r10b, al
lea r13d, [rcx + r10]
sub r13b, 0x10
movzx eax, byte [rsp + rsi + 0x58]
add rax, r9
add rsi, rax
inc rsi
jmp 0x1400fe423
inc rax
cmp r8, rax
jne 0x1400feaf4
lea ecx, [rsi + 0x80]
movzx eax, r10b
and al, cl
add al, al
sub r10b, al
lea r13d, [rcx + r10]
add r13b, 0x80
jmp 0x1400fee4e
lea rax, [r9 + 5]
cmp r8, rax
jne 0x1400feb20
movzx r11d, sil
lea edx, [r11 - 0x20]
movzx eax, r10b
and al, dl
add al, al
movzx r13d, r10b
sub r13b, al
sub r13b, 0x20
add r13b, dl
jmp 0x1400fee2a
lea rax, [r9 + 4]
cmp r8, rax
jne 0x1400feb4e
lea edx, [rsi - 0x70]
movzx eax, r10b
and al, dl
mov ecx, 8
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r10b
add r13b, dl
dec rsi
inc rsi
jmp 0x1400fe423
lea rax, [r9 + 6]
cmp r8, rax
jne 0x1400fe925
movzx r11d, sil
lea edx, [r11 - 0x10]
movzx eax, r10b
and al, dl
mov ecx, gethostname
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r10b
add r13b, dl
jmp 0x1400fedd5
lea rax, [r9 + 1]
cmp r8, rax
jne 0x1400febac
movzx r11d, sil
lea edx, [r11 - 0x58]
movzx eax, r10b
and al, dl
mov ecx, 0x34
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r10b
add r13b, dl
jmp 0x1400fedd5
inc rax
cmp r8, rax
jne 0x1400febd5
lea ecx, [rsi + 8]
movzx eax, r10b
and al, cl
add al, al
sub r10b, al
lea r13d, [rcx + r10]
sub r13b, 0x38
dec rsi
inc rsi
jmp 0x1400fe423
lea rax, [r9 + 4]
cmp r8, rax
jne 0x1400febfd
lea edx, [rsi + 0x68]
movzx eax, r10b
and al, dl
mov ecx, reloc.WS2_32.dll_sendto
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r10b
add r13b, dl
jmp 0x1400fee4b
lea rax, [r9 + 3]
cmp r8, rax
jne 0x1400fe8da
lea ecx, [rsi + 0x28]
movzx eax, r10b
and al, cl
add al, al
sub r10b, al
lea r13d, [rcx + r10]
sub r13b, 0x18
movzx eax, byte [rsp + rsi + 0x58]
add rax, r9
add rsi, rax
inc rsi
jmp 0x1400fe423
lea rax, [r9 + 1]
cmp r8, rax
jne 0x1400fec65
lea ecx, [rsi - 0x20]
movzx eax, r10b
and al, cl
add al, al
sub r10b, al
lea r13d, [rcx + r10]
sub r13b, 0x20
movzx eax, byte [rsp + rsi + 0x58]
add rax, r9
add rsi, rax
inc rsi
jmp 0x1400fe423
inc rax
cmp r8, rax
jne 0x1400fec8c
lea edx, [rsi - 0x70]
movzx eax, r10b
and al, dl
mov ecx, 8
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r10b
add r13b, dl
jmp 0x1400fee8c
lea rax, [r9 + 3]
cmp r8, rax
jne 0x1400fecb8
movzx r11d, sil
lea edx, [r11 + 0x50]
movzx eax, r10b
and al, dl
add al, al
movzx r13d, r10b
sub r13b, al
sub r13b, 0x30
add r13b, dl
jmp 0x1400fee2a
lea rax, [r9 + 2]
cmp r8, rax
jne 0x1400fe896
movzx r11d, sil
lea edx, [r11 + 0x60]
movzx eax, r10b
and al, dl
mov ecx, Ordinal_50
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r10b
add r13b, dl
jmp 0x1400fedd5
movzx r11d, sil
lea edx, [r11 - 0x40]
movzx eax, r10b
and al, dl
add al, al
movzx r13d, r10b
sub r13b, al
sub r13b, 0x40
add r13b, dl
add r13b, r10b
jmp 0x1400fee2a
movzx r11d, sil
lea edx, [r11 + 0x70]
movzx eax, r10b
and al, dl
add al, al
movzx r13d, r10b
sub r13b, al
sub r13b, r10b
sub r13b, 0x10
add r13b, dl
sub r11b, 0x38
movzx eax, r10b
and al, r11b
add al, al
movzx ecx, r10b
sub cl, al
sub cl, 0x78
add cl, r11b
movzx eax, cl
mov byte [rsp + rsi + 0x58], al
inc r9
add rax, r9
sub rsi, rax
jmp 0x1400fee8c
movabs rcx, 0xf36dd8f6a23e1b58
add rcx, rsi
movzx eax, cl
and al, r10b
add al, al
sub r11b, al
lea r13d, [rcx + r11]
sub r13b, 0x68
jmp 0x1400fee4e
movabs rdx, 0x688dfa5c0cc5faa8
add rdx, rsi
movzx eax, dl
and al, r10b
mov ecx, 0x34
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r11b
add r13b, dl
jmp 0x1400fee4b
movabs rcx, 0x3d0e7ff1b6e577e8
add rcx, rsi
and r10b, cl
add r10b, r10b
movzx r13d, r11b
sub r13b, r10b
sub r13b, 0x58
add r13b, cl
movzx r10d, r11b
movzx r11d, sil
add r11b, 0x68
movzx eax, r11b
and al, r10b
mov ecx, reloc.WS2_32.dll_sendto
sub cl, al
add cl, cl
add cl, r11b
add cl, r10b
mov byte [rsp + rsi + 0x58], cl
inc r9
dec rsi
inc rsi
jmp 0x1400fe423
movabs rcx, 0x86af26eccb8cd478
add rcx, rsi
and r10b, cl
add r10b, r10b
movzx r13d, r11b
sub r13b, r10b
sub r13b, 0x48
add r13b, cl
movzx r10d, r11b
movzx r11d, sil
add r11b, 0x18
movzx eax, r11b
and al, r10b
mov ecx, Ordinal_45
sub cl, al
add cl, cl
add cl, r11b
add cl, r10b
add cl, r13b
mov byte [rsp + rsi + 0x58], cl
add r8, r9
movzx eax, r13b
mov rcx, 0xffffffffffffffff
sub rcx, rax
add rsi, rcx
inc rsi
jmp 0x1400fe423
movabs rcx, 0x5b2fac8275ac51b8
add rcx, rsi
and r10b, cl
add r10b, r10b
movzx r13d, r11b
sub r13b, r10b
sub r13b, 8
add r13b, cl
movzx r10d, r11b
lea edx, [rsi + 0x20]
movzx eax, dl
and al, r10b
mov ecx, reloc.WS2_32.dll_recv
sub cl, al
add cl, cl
add cl, dl
add cl, r10b
mov byte [rsp + rsi + 0x58], cl
inc r8
mov rax, 0xffffffffffffffff
sub rax, r8
add rsi, rax
movzx eax, byte [rsp + rsi + 0x58]
add rax, r9
add rsi, rax
inc rsi
jmp 0x1400fe423
movabs rax, 0xd04fcde7e0343108
add rax, rsi
and r10b, al
add r10b, r10b
sub r11b, r10b
lea r13d, [rax + r11]
sub r13b, 0x38
movzx eax, byte [rsp + rsi + 0x58]
add rax, r9
add rsi, rax
inc rsi
jmp 0x1400fe423
sub sil, 0x48
movzx eax, r10b
and al, sil
add al, al
sub r10b, al
lea r13d, [rsi + r10]
sub r13b, 8
jmp 0x1400fe420
add sil, 8
movzx eax, r10b
and al, sil
add al, al
sub r10b, al
lea r13d, [rsi + r10]
sub r13b, 0x38
jmp 0x1400fe410
lea rcx, [rbp + 0x15afa78]
jmp 0x1400fef4c
lea rcx, [rbp + 0x1570ad0]
jmp 0x1400fef4c
lea rcx, [rsp + 0x58]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rsi, rax
movzx edx, bl
lea rcx, [rbp - 0x30]
call fcn.1400029d0
nop
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rsi + r8], 0
jne 0x1400fef70
mov rdx, rsi
lea rcx, [rbp - 0x30]
call fcn.140004440
nop
mov word [rbp - 0x78], 0x15ba
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x76], xmm0
movups xmmword [rbp - 0x66], xmm0
mov byte [rbp - 0x56], al
nop dword [rax]
mov r8, qword [0x14023d108]
mov r9, qword [0x14023d100]
nop
mov rsi, r14
cmp rsi, 0x23
jae 0x1400ffb83
movzx r11d, byte [rbp + rsi - 0x78]
mov edx, r11d
cmp r8, rsi
ja 0x1400ffb7a
lea rax, [r9 + 1]
cmp r8, rax
jae 0x1400feffb
movabs rcx, 0x3b05dfb23e75232d
add rcx, rsi
mov rax, rcx
and rax, rdx
imul r12, rax, 0xfffffffffffffffe
add r12, rcx
add r12, rdx
sub r12b, 0x3b
jmp 0x1400ff034
je 0x1400ffb08
inc rax
cmp r8, rax
je 0x1400ffa82
lea rax, [r9 + 3]
cmp r8, rax
je 0x1400ffa4e
lea rax, [r9 + 4]
cmp r8, rax
je 0x1400ffa2e
lea rax, [r9 + 8]
cmp r8, rax
je 0x1400ff9ea
movzx r10d, sil
nop dword [rax + rax]
cmp r9, rsi
ja 0x1400ffb71
lea rax, [r9 + 0x200]
cmp r8, rax
jae 0x1400ff06d
lea ecx, [r10 - 0x4f]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
add r12b, 0x29
jmp 0x1400ff0b0
lea rax, [r9 + 1]
cmp r8, rax
je 0x1400ff9d2
inc rax
cmp r8, rax
je 0x1400ff9af
lea rax, [r9 + 3]
cmp r8, rax
je 0x1400ff972
lea rax, [r9 + 6]
cmp r8, rax
je 0x1400ff957
lea rax, [r9 + 8]
cmp r8, rax
je 0x1400ff92c
nop dword [rax]
lea rax, [r9 + r8]
cmp rax, rsi
jbe 0x1400ff635
nop dword [rax]
lea rax, [r9 + 0x200]
cmp r8, rax
je 0x1400ff61a
lea rax, [r9 + 0x64]
cmp r8, rax
je 0x1400ff5f0
lea rax, [r9 + 0x7a]
cmp r8, rax
je 0x1400ff5cd
lea rax, [r9 + 0x1000]
cmp r8, rax
je 0x1400ff5ad
lea rax, [r9 + 0x3e8]
cmp r8, rax
je 0x1400ff58d
lea rax, [r9 + 0x2a]
cmp r8, rax
je 0x1400ff56c
lea rax, [r9 + 0x41]
cmp r8, rax
je 0x1400ff54d
lea rax, [r9 + 5]
cmp r8, rax
je 0x1400ff52c
lea rax, [r9 + 3]
cmp r8, rax
je 0x1400ff501
lea rax, [r9 + 0x10]
cmp r8, rax
je 0x1400ff0c0
lea r8, [r9 + 0xa]
lea r9, [r8 + 9]
lea rax, [r9 + 8]
cmp r8, rax
jb 0x1400ffb54
lea rax, [r9 + 0x42]
cmp r8, rax
jb 0x1400ffb37
lea rax, [r9 + 0x28]
cmp r8, rax
jb 0x1400ff2aa
lea rax, [r9 + 0x400]
cmp r8, rax
jb 0x1400ff28f
lea rax, [r9 + 0x200]
cmp r8, rax
jb 0x1400ff274
lea rax, [r9 + 0x5a]
cmp r8, rax
jb 0x1400ff4b0
lea rax, [r9 + 0x7a]
cmp r8, rax
jb 0x1400ff465
lea rax, [r9 + 4]
cmp r8, rax
jb 0x1400ff424
lea rax, [r9 + 2]
cmp r8, rax
jb 0x1400ff3ff
lea rax, [r9 + 0xa]
cmp r8, rax
jb 0x1400ff0c0
lea r8, [r9 + 9]
lea r9, [r8 + 8]
lea rax, [r9 + 6]
cmp r8, rax
ja 0x1400ff3d4
lea rax, [r9 + 0x40]
cmp r8, rax
ja 0x1400ff3b4
lea rax, [r9 + 0x20]
cmp r8, rax
ja 0x1400ff394
lea rax, [r9 + 0x3e8]
cmp r8, rax
ja 0x1400ff377
lea rax, [r9 + 0x80]
cmp r8, rax
ja 0x1400ff353
lea rax, [r9 + 0x41]
cmp r8, rax
ja 0x1400ff334
lea rax, [r9 + 0x61]
cmp r8, rax
ja 0x1400ff30d
lea rax, [r9 + 3]
cmp r8, rax
ja 0x1400ff2e7
lea rax, [r9 + 1]
cmp r8, rax
ja 0x1400ff2c7
lea rax, [r9 + 0x5a]
cmp r8, rax
ja 0x1400ff0c0
lea r8, [r9 + 8]
lea r9, [r8 + 6]
jmp 0x1400ff0c0
lea ecx, [r10 + 0x6f]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 9
jmp 0x1400ff0b0
lea ecx, [r10 + 0x15]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
add r12b, 0x6d
jmp 0x1400ff040
sub r10b, 0x45
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea r12d, [r11 + r10]
sub r12b, 0x1d
jmp 0x1400fefc6
lea edx, [r10 - 0x78]
movzx eax, r11b
and al, dl
mov ecx, 0x24
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r11b
add r12b, dl
jmp 0x1400ffa04
add r10b, 0x2e
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r12d, [r10 + r11]
sub r12b, 0x42
inc r9
dec rsi
inc rsi
jmp 0x1400fefb3
sub r10b, 0x2c
movzx eax, r11b
and al, r10b
mov ecx, reloc.WLDAP32.dll_Ordinal_26
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r11b
add r12b, r10b
dec rsi
inc rsi
jmp 0x1400fefb3
lea edx, [r10 + 0x7a]
movzx eax, r11b
and al, dl
add al, al
movzx r12d, r11b
sub r12b, al
sub r12b, 0x56
add r12b, dl
jmp 0x1400ff988
add r10b, 0x20
movzx eax, r11b
and al, r10b
mov ecx, reloc.WS2_32.dll_recv
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r11b
add r12b, r10b
add r8, r9
jmp 0x1400ffa69
sub r10b, 0x3a
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r12d, [r10 + r11]
sub r12b, 0x6a
jmp 0x1400ffa69
lea edx, [r10 + 0x6c]
movzx eax, r11b
and al, dl
mov ecx, 6
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r11b
add r12b, dl
jmp 0x1400ffaa1
add r10b, 0x12
movzx eax, r11b
and al, r10b
add al, al
movzx r12d, r11b
sub r12b, al
sub r12b, 0x7e
add r12b, r10b
jmp 0x1400ffaca
sub r10b, 0x48
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r12d, [r10 + r11]
sub r12b, 8
movzx eax, byte [rbp + rsi - 0x78]
add rax, r9
add rsi, rax
inc rsi
jmp 0x1400fefb3
sub r10b, 0x29
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r12d, [r10 + r11]
add r12b, 0x1f
mov byte [rbp + rsi - 0x78], r12b
inc rsi
jmp 0x1400fefb3
lea edx, [r10 + 0x7d]
movzx eax, r11b
and al, dl
add al, al
movzx r12d, r11b
sub r12b, al
sub r12b, 0x6b
add r12b, dl
cmp r9, 8
jb 0x1400ff417
lea edx, [r10 - 0x12]
movzx eax, r11b
and al, dl
add al, al
movzx ecx, r11b
sub cl, al
add cl, dl
lea r12d, [rcx*2 - 4]
jmp 0x1400ffa04
lea edx, [r10 + 0x23]
movzx eax, r11b
and al, dl
add al, al
movzx r12d, r11b
sub r12b, al
add r12b, 0xb
add r12b, dl
cmp r8, 9
jae 0x1400ff8ee
lea rax, [r9 + 8]
cmp r8, rax
jbe 0x1400ff812
lea edx, [r10 + 0x6a]
movzx eax, r11b
and al, dl
mov ecx, reloc.WS2_32.dll_listen
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r11b
jmp 0x1400ff43b
lea edx, [r10 - 0x37]
movzx eax, r11b
and al, dl
add al, al
movzx r12d, r11b
sub r12b, al
sub r12b, 0x7f
add r12b, dl
lea rax, [r9 + r8]
cmp rax, 0xa
je 0x1400ff90a
lea rax, [r9 + 9]
cmp r8, rax
jbe 0x1400ff743
lea edx, [r10 - 0x47]
movzx eax, r11b
and al, dl
add al, al
movzx r12d, r11b
sub r12b, al
sub r12b, 0xf
jmp 0x1400ff47c
add r10b, 0x26
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r12d, [r10 + r11]
sub r12b, 0xa
movzx eax, byte [rbp + rsi - 0x78]
add rax, r9
add rsi, rax
inc rsi
jmp 0x1400fefb3
sub r10b, 0x34
movzx eax, r11b
and al, r10b
mov ecx, gethostname
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r11b
add r12b, r10b
jmp 0x1400ffaca
lea edx, [r10 + 0x72]
movzx eax, r11b
and al, dl
add al, al
movzx r12d, r11b
sub r12b, al
sub r12b, 0x1e
add r12b, dl
jmp 0x1400ffaa1
add r10b, 0x18
movzx eax, r11b
and al, r10b
mov ecx, Ordinal_45
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r11b
add r12b, r10b
jmp 0x1400ffa69
sub r10b, 0x42
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r12d, [r10 + r11]
sub r12b, 0x32
add r8, r9
jmp 0x1400ffa69
lea edx, [r10 + 0x64]
movzx eax, r11b
and al, dl
mov ecx, Ordinal_35
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r11b
add r12b, dl
jmp 0x1400ff988
add r10b, 0xa
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r12d, [r10 + r11]
sub r12b, 0x46
dec rsi
inc rsi
jmp 0x1400fefb3
sub r10b, 0x50
movzx eax, r10b
and al, r11b
mov ecx, Ordinal_26
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r10b
add r12b, r11b
inc r9
dec rsi
inc rsi
jmp 0x1400fefb3
lea ecx, [r10 + 0x56]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0x5a
jmp 0x1400ffa04
lea rax, [r9 + 0x200]
cmp r8, rax
jae 0x1400ff65c
lea ecx, [r10 + 0x2d]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0x3b
jmp 0x1400ff4ca
lea rax, [r9 + 1]
cmp r8, rax
jne 0x1400ff694
add r10b, 0x62
movzx eax, r10b
and al, r11b
mov ecx, reloc.WLDAP32.dll_Ordinal_41
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r10b
add r12b, r11b
movzx eax, byte [rbp + rsi - 0x78]
add rax, r9
add rsi, rax
inc rsi
jmp 0x1400fefb3
inc rax
cmp r8, rax
jne 0x1400ff6bc
lea edx, [r10 + 0x16]
movzx eax, dl
and al, r11b
mov ecx, 0x33
sub cl, al
lea r12d, [rcx + rcx]
add r12b, dl
add r12b, r11b
jmp 0x1400ffaa1
lea rax, [r9 + 7]
cmp r8, rax
jne 0x1400ff6e8
add r10b, 0x7e
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea r12d, [r11 + r10]
sub r12b, 0x72
dec rsi
inc rsi
jmp 0x1400fefb3
lea rax, [r9 + 5]
cmp r8, rax
jne 0x1400ff71b
sub r10b, 0x28
movzx eax, r10b
and al, r11b
mov ecx, recv
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r10b
add r12b, r11b
inc r9
dec rsi
inc rsi
jmp 0x1400fefb3
lea rax, [r9 + 6]
cmp r8, rax
jne 0x1400ff4ca
lea ecx, [r10 + 0x32]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0x5e
jmp 0x1400ffa04
lea rax, [r9 + 1]
cmp r8, rax
jne 0x1400ff76b
lea edx, [r10 + 0x13]
movzx eax, r11b
and al, dl
add al, al
movzx r12d, r11b
sub r12b, al
add r12b, 0x7b
add r12b, dl
jmp 0x1400ffa04
inc rax
cmp r8, rax
jne 0x1400ff796
sub r10b, 0x39
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r12d, [r10 + r11]
sub r12b, 0x71
dec rsi
inc rsi
jmp 0x1400fefb3
lea rax, [r9 + 3]
cmp r8, rax
jne 0x1400ff7bf
add r10b, 0x7b
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r12d, [r10 + r11]
sub r12b, 0x5d
add r8, r9
jmp 0x1400ffa69
lea rax, [r9 + 6]
cmp r8, rax
jne 0x1400ff7e5
sub r10b, 0x2b
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r12d, [r10 + r11]
add r12b, 0x2d
jmp 0x1400ffa69
lea rax, [r9 + 4]
cmp r8, rax
jne 0x1400ff47f
sub r10b, 0x77
movzx eax, r11b
and al, r10b
add al, al
movzx r12d, r11b
sub r12b, al
add r12b, 0x41
add r12b, r10b
jmp 0x1400ffaca
lea rax, [r9 + 1]
cmp r8, rax
jne 0x1400ff846
sub r10b, 0x3c
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r12d, [r10 + r11]
sub r12b, 0x5c
movzx eax, byte [rbp + rsi - 0x78]
add rax, r9
add rsi, rax
inc rsi
jmp 0x1400fefb3
inc rax
cmp r8, rax
jne 0x1400ff86d
lea edx, [r10 + 0x78]
movzx eax, r11b
and al, dl
add al, al
movzx r12d, r11b
sub r12b, al
sub r12b, 0x48
add r12b, dl
jmp 0x1400ffaa1
lea rax, [r9 + 3]
cmp r8, rax
jne 0x1400ff896
lea edx, [r10 - 0x7a]
movzx eax, r11b
and al, dl
mov ecx, Ordinal_45
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r11b
add r12b, dl
jmp 0x1400ff988
lea rax, [r9 + 2]
cmp r8, rax
jne 0x1400ff8c2
sub r10b, 0x20
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r12d, [r10 + r11]
sub r12b, 0x20
dec rsi
inc rsi
jmp 0x1400fefb3
lea rax, [r9 + 7]
cmp r8, rax
jne 0x1400ff43e
lea edx, [r10 - 0x6c]
movzx eax, r11b
and al, dl
add al, al
movzx r12d, r11b
sub r12b, al
sub r12b, 0xc
add r12b, dl
jmp 0x1400ffa04
lea edx, [r10 + 0x48]
movzx eax, r11b
and al, dl
movzx ecx, r11b
sub cl, al
add cl, 4
lea r12d, [rcx + rcx]
add r12b, dl
jmp 0x1400ff988
lea edx, [r10 - 0x5e]
movzx eax, r11b
and al, dl
add al, al
movzx r12d, r11b
sub r12b, al
sub r12b, r11b
sub r12b, 0x6e
add r12b, dl
jmp 0x1400ffaa1
sub r10b, 0x25
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea r12d, [r11 + r10]
add r12b, 3
movzx eax, byte [rbp + rsi - 0x78]
add rax, r9
add rsi, rax
inc rsi
jmp 0x1400fefb3
lea ecx, [r10 + 0x27]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0x11
jmp 0x1400ffaa1
lea ecx, [r10 + 0x19]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
add r12b, 0x51
add r10b, 0x75
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
sub r11b, 0x33
add r11b, r10b
add r11b, r12b
mov byte [rbp + rsi - 0x78], r11b
add r8, r9
jmp 0x1400ffa69
sub r10b, 0x41
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea r12d, [r11 + r10]
sub r12b, 0x39
dec rsi
inc rsi
jmp 0x1400fefb3
lea ecx, [r10 + 0xb]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0x4d
jmp 0x1400ffa04
movzx r10d, sil
lea ecx, [r10 + 0x57]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0x61
add r10b, 0x1b
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
add r11b, 0x43
add r11b, r10b
mov byte [rbp + rsi - 0x78], r11b
inc r9
dec rsi
inc rsi
jmp 0x1400fefb3
lea ecx, [rsi - 0x5d]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0x75
dec rsi
inc rsi
jmp 0x1400fefb3
movabs rax, 0x1334dd44321e3c95
add rax, rsi
and dl, al
add dl, dl
sub al, dl
lea r12d, [r11 + rax]
sub r12b, 0x13
movzx eax, r12b
mov rcx, 0xffffffffffffffff
sub rcx, rax
add rsi, rcx
inc rsi
jmp 0x1400fefb3
movabs rax, 0x9d291ddfb533f63b
add rax, rsi
and dl, al
add dl, dl
sub al, dl
lea r12d, [r11 + rax]
add r12b, 0x63
movzx r10d, sil
sub r10b, 0x31
movzx eax, r11b
and al, r10b
add al, al
movzx ecx, r11b
sub cl, al
add cl, 0x57
add cl, r10b
movzx eax, cl
mov byte [rbp + rsi - 0x78], al
inc r9
add rax, r9
sub rsi, rax
lea edx, [rsi - 4]
movzx eax, r11b
and al, dl
mov ecx, recv
sub cl, al
add cl, cl
add cl, r11b
add cl, dl
mov byte [rbp + rsi - 0x78], cl
inc r8
mov rax, 0xffffffffffffffff
sub rax, r8
add rsi, rax
movzx eax, byte [rbp + rsi - 0x78]
add rax, r9
add rsi, rax
inc rsi
jmp 0x1400fefb3
movabs rax, 0xb1119f16bb5f6987
add rax, rsi
and dl, al
add dl, dl
sub r11b, dl
lea r12d, [rax + r11]
add r12b, 0x4f
movzx eax, byte [rbp + rsi - 0x78]
add rax, r9
add rsi, rax
inc rsi
jmp 0x1400fefb3
add r10b, 0x61
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r12d, [r10 + r11]
add r12b, 0x59
jmp 0x1400fefb0
add r10b, 7
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r12d, [r10 + r11]
sub r12b, 0x31
jmp 0x1400fefa0
lea rdx, [rbp + 0x173a1c4]
jmp 0x1400ffb87
lea rdx, [rbp + 0x168c4f1]
jmp 0x1400ffb87
lea rdx, [rbp - 0x78]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rdx + r8], 0
jne 0x1400ffb90
lea rcx, [rbp - 0x30]
call fcn.1400030f0
mov r14, rax
mov dword [rsp + 0x30], 0x6e738caa
mov dword [rsp + 0x34], 0x8d639a6e
mov dword [rsp + 0x38], 0x9f64606f
mov byte [rsp + 0x3c], 0xf2
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x3d], xmm0
mov dword [rsp + 0x4d], eax
mov word [rsp + 0x51], ax
nop word [rax + rax]
mov r9, qword [0x14023d108]
mov r10, qword [0x14023d100]
nop
xor esi, esi
cmp rsi, 0x23
jae 0x1401006e3
movzx r11d, byte [rsp + rsi + 0x30]
mov r8d, r11d
cmp r9, rsi
ja 0x1401006da
lea rax, [r10 + 1]
cmp r9, rax
jae 0x1400ffc3f
movabs rcx, 0x8559cf63f024d5df
add rcx, rsi
mov rax, rcx
and rax, r8
imul r15, rax, 0xfffffffffffffffe
add r15, rcx
add r15, r8
sub r15b, 0x19
mov qword [rsp + 0x20], r15
jmp 0x1400ffc6c
je 0x14010065d
lea rax, [r10 + 3]
cmp r9, rax
je 0x1401005d0
lea rax, [r10 + 5]
cmp r9, rax
je 0x140100577
lea rax, [r10 + 9]
cmp r9, rax
je 0x14010052f
movzx eax, sil
cmp r10, rsi
ja 0x1401006d1
lea rcx, [r10 + 0x80]
cmp r9, rcx
jae 0x1400ffca1
lea edx, [rax + 0x4b]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r15d, [r11 + rdx]
sub r15b, 0xd
mov qword [rsp + 0x20], r15
jmp 0x1400ffcf0
lea rcx, [r10 + 1]
cmp r9, rcx
je 0x140100518
inc rcx
cmp r9, rcx
je 0x1401004f1
lea rcx, [r10 + 3]
cmp r9, rcx
je 0x1401004d8
lea rcx, [r10 + 5]
cmp r9, rcx
je 0x1401004ba
lea rcx, [r10 + 4]
cmp r9, rcx
je 0x1401004a0
lea rcx, [r10 + 9]
cmp r9, rcx
je 0x140100487
nop
lea rcx, [r10 + r9]
cmp rcx, rsi
jbe 0x1401001fe
nop dword [rax]
lea rcx, [r10 + 0x10]
cmp r9, rcx
je 0x1401001df
lea rcx, [r10 + 0xa]
cmp r9, rcx
je 0x1401001b0
lea rcx, [r10 + 9]
cmp r9, rcx
je 0x140100189
lea rcx, [r10 + 8]
cmp r9, rcx
je 0x14010016f
lea rcx, [r10 + 6]
cmp r9, rcx
je 0x140100163
lea rdx, [r10 + 5]
cmp r9, rdx
je 0x140100140
lea rcx, [r10 + 0x40]
cmp r9, rcx
je 0x140100121
lea rcx, [r10 + 0x28]
cmp r9, rcx
je 0x140100108
lea rcx, [r10 + 0x20]
cmp r9, rcx
je 0x1401000ef
mov r9, rdx
lea r10, [rdx + 0xa]
lea rcx, [r10 + 4]
cmp rdx, rcx
jb 0x1401006b2
lea rcx, [r10 + 3]
cmp rdx, rcx
jb 0x140100693
lea rcx, [r10 + 2]
cmp rdx, rcx
jb 0x1400ffec2
lea rcx, [r10 + 1]
cmp rdx, rcx
jb 0x1400ffea3
lea rcx, [r10 + 0x2a]
cmp rdx, rcx
jb 0x1400ffe84
lea rdx, [r10 + 0x5a]
cmp r9, rdx
jb 0x1401000a0
lea rcx, [r10 + 0x41]
cmp r9, rcx
jb 0x140100055
lea rcx, [r10 + 6]
cmp r9, rcx
jb 0x140100012
lea rcx, [r10 + 5]
cmp r9, rcx
jb 0x1400fffec
mov r9, rdx
lea r10, [rdx + 3]
lea rcx, [r10 + 0x41]
cmp rdx, rcx
ja 0x1400fffce
lea rcx, [r10 + 0x7a]
cmp rdx, rcx
ja 0x1400fffb5
lea rcx, [r10 + 0x61]
cmp rdx, rcx
ja 0x1400fff9b
lea rcx, [r10 + 0x1000]
cmp rdx, rcx
ja 0x1400fff7d
lea rcx, [r10 + 0x400]
cmp rdx, rcx
ja 0x1400fff71
lea rdx, [r10 + 0x3e8]
cmp r9, rdx
ja 0x1400fff52
lea rcx, [r10 + 0x200]
cmp r9, rcx
ja 0x1400fff2a
lea rcx, [r10 + 0x80]
cmp r9, rcx
ja 0x1400ffeff
lea rcx, [r10 + 0x64]
cmp r9, rcx
ja 0x1400ffee0
mov r9, rdx
lea r10, [rdx + 0x7a]
jmp 0x1400ffd00
lea edx, [rax + 0x15]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r15d, [r11 + rdx]
add r15b, 0x6d
mov qword [rsp + 0x20], r15
jmp 0x1400ffcf0
lea edx, [rax + 0x57]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r15d, [r11 + rdx]
sub r15b, 0x61
mov qword [rsp + 0x20], r15
jmp 0x1400ffc70
sub al, 0x67
movzx ecx, al
and cl, r11b
add cl, cl
sub al, cl
lea r15d, [r11 + rax]
sub r15b, 0x2f
mov qword [rsp + 0x20], r15
jmp 0x1400ffc05
lea r8d, [rax + 0x58]
movzx ecx, r11b
and cl, r8b
add cl, cl
movzx edx, r11b
sub dl, cl
sub r8b, 0x68
add r8b, dl
jmp 0x140100548
sub al, 0x66
movzx ecx, r11b
and cl, al
add cl, cl
sub r11b, cl
lea r8d, [rax + r11]
sub r8b, 0x36
inc r10
mov qword [rsp + 0x20], r8
dec rsi
mov r15, r8
inc rsi
jmp 0x1400ffbf2
sub al, 0x24
movzx ecx, r11b
and cl, al
add cl, cl
sub r11b, cl
lea r8d, [rax + r11]
sub r8b, 4
mov qword [rsp + 0x20], r8
dec rsi
mov r15, r8
inc rsi
jmp 0x1400ffbf2
lea r8d, [rax + 0x1e]
movzx ecx, r8b
and cl, r11b
mov edx, reloc.WS2_32.dll_socket
sub dl, cl
add dl, dl
add r8b, dl
add r8b, r11b
jmp 0x140100590
add al, 0x60
mov edx, Ordinal_50
jmp 0x140100252
sub al, 0x5e
movzx ecx, al
and cl, r11b
add cl, cl
sub al, cl
lea r15d, [r11 + rax]
sub r15b, 0x6e
mov qword [rsp + 0x20], r15
jmp 0x1401005b7
lea edx, [rax - 0x1c]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
sub r8b, 0x3c
jmp 0x1401005f6
add al, 0x26
movzx ecx, al
and cl, r11b
add cl, cl
sub al, cl
lea r8d, [r11 + rax]
sub r8b, 0xa
jmp 0x140100617
add al, 0x68
movzx ecx, al
and cl, r11b
mov edx, reloc.WS2_32.dll_sendto
sub dl, cl
lea r15d, [rdx + rdx]
add r15b, al
add r15b, r11b
jmp 0x14010067b
add al, 0xd
movzx ecx, al
and cl, r11b
add cl, cl
sub al, cl
lea r15d, [r11 + rax]
sub r15b, 0x5b
mov qword [rsp + 0x20], r15
mov byte [rsp + rsi + 0x30], r15b
inc rsi
jmp 0x1400ffbf2
lea edx, [rax + 0x4f]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r15d, [r11 + rdx]
sub r15b, 0x29
mov qword [rsp + 0x20], r15
cmp r10, 0x42
jb 0x140100005
lea edx, [rax - 0x26]
movzx ecx, dl
and cl, r11b
mov r8d, 5
sub r8b, cl
add r8b, r8b
add r8b, dl
add r8b, r11b
add r8b, r8b
jmp 0x140100548
lea edx, [rax - 0x6f]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r15d, [r11 + rdx]
add r15b, 9
mov qword [rsp + 0x20], r15
cmp r9, 0x1000
jae 0x140100454
lea rcx, [r10 + 0x5a]
cmp r9, rcx
jbe 0x1401003c2
lea edx, [rax + 0x6e]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r15d, [r11 + rdx]
sub r15b, 2
jmp 0x140100027
lea edx, [rax - 0x2d]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r15d, [r11 + rdx]
add r15b, 0x3b
mov qword [rsp + 0x20], r15
lea rcx, [r10 + r9]
cmp rcx, 1
je 0x140100471
lea rcx, [r10 + 5]
cmp r9, rcx
jbe 0x140100317
lea edx, [rax + 0x23]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r15d, [r11 + rdx]
add r15b, 0xb
jmp 0x14010006a
sub al, 0x3e
movzx ecx, al
and cl, r11b
add cl, cl
sub al, cl
lea r15d, [r11 + rax]
sub r15b, 0x4e
jmp 0x14010067b
add al, 4
movzx ecx, al
and cl, r11b
add cl, cl
sub al, cl
lea r8d, [r11 + rax]
sub r8b, 0x1c
jmp 0x140100617
lea r8d, [rax + 0x46]
movzx ecx, r8b
and cl, r11b
mov edx, listen
sub dl, cl
add dl, dl
add r8b, dl
add r8b, r11b
jmp 0x1401005f6
sub al, 0x78
movzx ecx, al
and cl, r11b
mov edx, 0x24
sub dl, cl
lea r15d, [rdx + rdx]
add r15b, al
add r15b, r11b
mov qword [rsp + 0x20], r15
jmp 0x1401005b7
sub al, 0x36
mov edx, 0x3d
jmp 0x140100252
lea edx, [rax + 0xc]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
sub r8b, 0x54
jmp 0x140100590
add al, 0x4e
movzx ecx, al
and cl, r11b
add cl, cl
sub al, cl
lea r8d, [r11 + rax]
sub r8b, 0x22
mov qword [rsp + 0x20], r8
dec rsi
mov r15, r8
inc rsi
jmp 0x1400ffbf2
sub al, 0x70
movzx ecx, al
and cl, r11b
mov edx, 8
sub dl, cl
lea r8d, [rdx + rdx]
add r8b, al
add r8b, r11b
inc r10
mov qword [rsp + 0x20], r8
dec rsi
mov r15, r8
inc rsi
jmp 0x1400ffbf2
lea r8d, [rax - 0x2e]
movzx ecx, r8b
and cl, r11b
mov edx, reloc.WLDAP32.dll_Ordinal_33
sub dl, cl
add dl, dl
add r8b, dl
add r8b, r11b
jmp 0x140100548
lea rdx, [r10 + 6]
cmp r9, rdx
jae 0x140100221
lea edx, [rax - 0x21]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r15d, [r11 + rdx]
sub r15b, 0x19
jmp 0x1401000b5
lea rcx, [r10 + 1]
cmp r9, rcx
jne 0x140100243
sub al, 0x6a
movzx ecx, al
and cl, r11b
add cl, cl
sub al, cl
lea r15d, [r11 + rax]
sub r15b, 0x1a
jmp 0x14010067b
inc rcx
cmp r9, rcx
jne 0x140100269
sub al, 0x72
mov edx, reloc.WS2_32.dll_ntohs
movzx ecx, al
and cl, r11b
sub dl, cl
lea r8d, [rdx + rdx]
add r8b, al
add r8b, r11b
jmp 0x1401005ac
cmp r9, rdx
jne 0x140100288
lea edx, [rax + 0x4c]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
sub r8b, 0x14
jmp 0x140100590
lea rcx, [r10 + 5]
cmp r9, rcx
jne 0x1401002b8
add al, 0xa
movzx ecx, al
and cl, r11b
add cl, cl
sub al, cl
lea r8d, [r11 + rax]
sub r8b, 0x46
mov qword [rsp + 0x20], r8
dec rsi
mov r15, r8
inc rsi
jmp 0x1400ffbf2
lea rcx, [r10 + 4]
cmp r9, rcx
jne 0x1401002eb
sub al, 0x38
movzx ecx, al
and cl, r11b
add cl, cl
sub al, cl
lea r8d, [r11 + rax]
sub r8b, 0x78
inc r10
mov qword [rsp + 0x20], r8
dec rsi
mov r15, r8
inc rsi
jmp 0x1400ffbf2
lea rcx, [r10 + 3]
cmp r9, rcx
jne 0x1401000ba
lea r8d, [rax - 0x7a]
movzx ecx, r8b
and cl, r11b
mov edx, Ordinal_45
sub dl, cl
add dl, dl
add r8b, dl
add r8b, r11b
jmp 0x140100548
lea rcx, [r10 + 1]
cmp r9, rcx
jne 0x14010033a
lea edx, [rax - 0x1f]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
sub r8b, 0x27
jmp 0x140100548
inc rcx
cmp r9, rcx
jne 0x14010036c
sub al, 0x61
movzx ecx, al
and cl, r11b
add cl, cl
sub al, cl
lea r8d, [r11 + rax]
sub r8b, 0x59
inc r10
mov qword [rsp + 0x20], r8
dec rsi
mov r15, r8
inc rsi
jmp 0x1400ffbf2
lea rcx, [r10 + 3]
cmp r9, rcx
jne 0x14010039c
add al, 0x5d
movzx ecx, al
and cl, r11b
add cl, cl
sub al, cl
lea r8d, [r11 + rax]
add r8b, 0x75
mov qword [rsp + 0x20], r8
dec rsi
mov r15, r8
inc rsi
jmp 0x1400ffbf2
lea rcx, [r10 + 8]
cmp r9, rcx
jne 0x14010006f
sub al, 0x2f
movzx ecx, al
and cl, r11b
add cl, cl
sub al, cl
lea r15d, [r11 + rax]
add r15b, 0x49
jmp 0x14010067b
lea rcx, [r10 + 1]
cmp r9, rcx
jne 0x1401003e4
add al, 0x2c
movzx ecx, al
and cl, r11b
add cl, cl
sub al, cl
lea r15d, [r11 + rax]
sub r15b, 0x34
jmp 0x14010067b
inc rcx
cmp r9, rcx
jne 0x14010040b
lea r8d, [rax - 0x58]
movzx ecx, r8b
and cl, r11b
mov edx, 0x34
sub dl, cl
add dl, dl
add r8b, dl
add r8b, r11b
jmp 0x1401005f6
lea rcx, [r10 + 5]
cmp r9, rcx
jne 0x140100420
add al, 0x24
mov edx, 2
jmp 0x140100252
lea rcx, [r10 + 2]
cmp r9, rcx
jne 0x14010002c
sub al, 0x60
movzx ecx, al
and cl, r11b
add cl, cl
sub al, cl
lea r8d, [r11 + rax]
sub r8b, 0x60
mov qword [rsp + 0x20], r8
dec rsi
mov r15, r8
inc rsi
jmp 0x1400ffbf2
lea edx, [rax - 0x68]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
sub r8b, 0x28
add r8b, r11b
jmp 0x140100590
lea edx, [rax + 0x56]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [rdx - 0x5a]
jmp 0x1401005f6
sub al, 7
movzx ecx, al
and cl, r11b
add cl, cl
sub al, cl
lea r15d, [r11 + rax]
add r15b, 0x31
jmp 0x14010067b
lea edx, [rax + 0x7d]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
sub r8b, 0x6b
jmp 0x1401005f6
sub al, 0x41
movzx ecx, al
and cl, r11b
add cl, cl
sub al, cl
lea r15d, [r11 + rax]
sub r15b, 0x39
mov qword [rsp + 0x20], r15
jmp 0x1401005b7
inc al
movzx ecx, al
and cl, r11b
add cl, cl
sub al, cl
lea r8d, [r11 + rax]
sub r8b, 7
jmp 0x1401005ac
sub al, 0x7b
movzx ecx, al
and cl, r11b
add cl, cl
sub al, cl
lea r8d, [r11 + rax]
add r8b, 0x5d
mov qword [rsp + 0x20], r8
dec rsi
mov r15, r8
inc rsi
jmp 0x1400ffbf2
lea edx, [rax + 9]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
sub r8b, 0x3f
jmp 0x140100548
movzx eax, sil
lea edx, [rax - 0x73]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
add r8b, 0x25
sub al, 0x47
movzx ecx, r11b
and cl, al
add cl, cl
sub r11b, cl
sub r11b, 0xf
add r11b, al
mov byte [rsp + rsi + 0x30], r11b
inc r10
mov qword [rsp + 0x20], r8
dec rsi
mov r15, r8
inc rsi
jmp 0x1400ffbf2
movzx eax, sil
lea edx, [rax + 0x53]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
sub r8b, 0x45
add al, 0x77
movzx ecx, r11b
and cl, al
add cl, cl
sub r11b, cl
sub r11b, 0x41
add r11b, r8b
add r11b, al
mov byte [rsp + rsi + 0x30], r11b
mov qword [rsp + 0x20], r8
add r9, r10
mov r15, r8
movzx eax, r15b
mov rcx, 0xffffffffffffffff
sub rcx, rax
add rsi, rcx
inc rsi
jmp 0x1400ffbf2
movabs rcx, 0xa574abbb9101d919
add rcx, rsi
and r8b, cl
add r8b, r8b
movzx eax, r11b
sub al, r8b
lea r8d, [rcx + rax]
add r8b, 0x51
movzx eax, sil
add al, 0x35
movzx ecx, al
and cl, r11b
add cl, cl
sub al, cl
sub al, 0x73
add al, r11b
movzx ecx, al
mov byte [rsp + rsi + 0x30], cl
inc r10
add rcx, r10
sub rsi, rcx
mov qword [rsp + 0x20], r8
lea edx, [rsi + 0x14]
movzx eax, dl
and al, r11b
mov ecx, Ordinal_60
sub cl, al
add cl, cl
add cl, dl
add cl, r11b
mov byte [rsp + rsi + 0x30], cl
inc r9
mov rax, 0xffffffffffffffff
sub rax, r9
add rsi, rax
mov r15, r8
movzx eax, byte [rsp + rsi + 0x30]
add rax, r10
add rsi, rax
inc rsi
jmp 0x1400ffbf2
movabs rax, 0x900d6e2bd06e819d
add rax, rsi
and r8b, al
add r8b, r8b
sub r11b, r8b
lea r15d, [rax + r11]
sub r15b, 0x4b
mov qword [rsp + 0x20], r15
movzx eax, byte [rsp + rsi + 0x30]
add rax, r10
add rsi, rax
inc rsi
jmp 0x1400ffbf2
sub al, 0x25
movzx ecx, r11b
and cl, al
add cl, cl
sub r11b, cl
lea r15d, [rax + r11]
add r15b, 3
mov qword [rsp + 0x20], r15
jmp 0x1400ffbf0
add al, 0x1d
movzx ecx, r11b
and cl, al
add cl, cl
sub r11b, cl
lea r15d, [rax + r11]
add r15b, 0x35
mov qword [rsp + 0x20], r15
jmp 0x1400ffbe0
lea rdx, [rbp + 0x17fb104]
jmp 0x1401006e8
lea rdx, [rbp + 0x6486e3]
jmp 0x1401006e8
lea rdx, [rsp + 0x30]
xor r8d, r8d
lea rcx, [rbp - 8]
call fcn.140005690
mov r9, r14
mov r8d, recv
mov rdx, rax
lea rcx, [rbp - 8]
call fcn.140058170
nop
lea rcx, [rbp - 0x30]
call fcn.140002800
lea rcx, [rbp - 8]
cmp qword [rbp + 0x10], 0xf
cmova rcx, qword [rbp - 8]
xor edx, edx
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov r11, rax
mov eax, 0x5a4d
cmp word [r11], ax
jne 0x14010085e
movsxd rcx, dword [r11 + 0x3c]
cmp dword [rcx + r11], 0x4550
jne 0x14010085e
mov edx, dword [rcx + r11 + 0x88]
test edx, edx
je 0x14010085e
mov esi, dword [rdx + r11 + 0x1c]
lea r14, [r11 + rsi]
mov r9d, dword [rdx + r11 + 0x20]
add r9, r11
mov r15d, dword [rdx + r11 + 0x24]
add r15, r11
xor r10d, r10d
test esi, esi
je 0x1401007c3
nop dword [rax]
nop word [rax + rax]
mov r8d, dword [r9]
add r8, r11
mov rax, qword [rbp - 0x38]
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1401007b3
inc rax
test ecx, ecx
jne 0x1401007a0
test edx, edx
je 0x140100833
inc r10d
add r9, 4
cmp r10d, esi
jb 0x140100790
lea rcx, [rbp - 8]
call fcn.140002800
mov r15, qword [rsp + 0x20]
xor r14d, r14d
lea rcx, [rbp + 0x18]
call fcn.140002800
mov eax, dword [rsp + 0x2c]
inc eax
mov dword [rsp + 0x2c], eax
mov rsi, qword [rbp - 0x80]
cmp eax, dword [rsi]
jb 0x1400fe360
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rcx, qword [rbp + 0x38]
xor rcx, rsp
call fcn.140198db0
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
movsxd rax, r10d
movzx ecx, word [r15 + rax*2]
mov eax, dword [r14 + rcx*4]
mov rcx, qword [rbp - 0x50]
add rax, qword [rcx + 0x18]
mov qword [rbp - 0x48], rax
xor edx, edx
mov r8d, 0x8000
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
lea rcx, [rbp - 8]
call fcn.140002800
nop
lea rcx, [rbp + 0x18]
call fcn.140002800
mov rax, qword [rbp - 0x48]
jmp 0x140100806
mov rcx, qword [rdx]
mov rax, r8
xor r8d, r8d
mov rdx, qword [rax]
jmp 0x1400fe270