Function at 0x1400117e0
Capabilities:
Terminate process
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x2c8
mov r13, qword [rcx + 8]
mov r12, qword [rcx]
mov r14, rcx
mov rcx, r13
call dbg.stack_if_datalink
mov rcx, qword [r12 + 0xd20]
mov edx, 0x4000
mov dword [rsp + 0x98], eax
mov rax, qword [r14 + 0x10]
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x88], rax
call sym.rstfilter_create
mov ecx, 8
mov qword [rsp + 0x100], rax
call dbg.MALLOC
mov ecx, 8
mov qword [rax], 0
mov qword [r14 + 0x13d8], rax
mov qword [rsp + 0xf8], rax
call dbg.MALLOC
mov r8d, dword [r14 + 0x18]
mov ecx, 1
lea rdx, str.___starting_receive_thread__u_n
mov qword [rax], 0
mov qword [r14 + 0x13e0], rax
mov qword [rsp + 0x108], rax
call dbg.LOG
call dbg.pixie_cpu_get_count
cmp eax, 1
ja 0x1400124b0
cmp byte [r12 + 0x1158], 0
jne 0x1400124e5
mov qword [rsp + 0xd8], 0
mov edx, dword [r14 + 0x18]
mov rcx, r12
call dbg.output_create
mov qword [rsp + 0xb0], rax
call sym.dedup_create
mov qword [rsp + 0xe0], rax
movzx eax, byte [r12 + 0xce4]
test al, 4
jne 0x140012508
test al, 0x10
je 0x140011990
mov eax, dword [0x14007e150]
xor ebp, ebp
test eax, eax
jne 0x140012f75
nop word cs:[rax + rax]
nop dword [rax]
mov ecx, 0x2710
call sym.pixie_usleep
mov eax, dword [0x14007e150]
test eax, eax
je 0x140011910
mov dword [r14 + 0x398], 1
test rbp, rbp
je 0x14001193c
mov rcx, rbp
call dbg.tcpcon_destroy_table
mov rcx, qword [rsp + 0xe0]
call dbg.dedup_destroy
mov rcx, qword [rsp + 0xb0]
call dbg.output_destroy
mov rax, qword [rsp + 0xd8]
test rax, rax
je 0x14001196b
mov rcx, rax
call dbg.pcapfile_close
mov dword [r14 + 0x398], 1
add rsp, 0x2c8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor ebp, ebp
lea rdx, str.___THREAD:_recv:_starting_main_loop_n
mov ecx, 2
call dbg.LOG
mov eax, dword [0x14007e150]
test eax, eax
jne 0x140011cd6
lea rsi, [rsp + 0x230]
lea rax, [rsp + 0x1a4]
mov qword [rsp + 0x310], r14
mov qword [rsp + 0x80], rsi
lea rsi, [rsp + 0x1f0]
lea r15, [rsp + 0x1a8]
mov r14, rax
mov qword [rsp + 0xe8], rsi
lea rdi, [rsp + 0x19c]
mov rax, r15
lea rbx, [rsp + 0x1a0]
mov qword [rsp + 0xf0], r12
mov r15, r13
mov r12, rbx
mov r13, rdi
mov rdi, rax
nop word cs:[rax + rax]
nop
mov qword [rsp + 0x20], rdi
mov r9, r14
mov r8, r12
mov rdx, r13
mov rcx, r15
call dbg.rawsock_recv_packet
test eax, eax
jne 0x140011c98
test rbp, rbp
je 0x140011a5a
mov r8d, dword [rsp + 0x1a4]
mov edx, dword [rsp + 0x1a0]
mov rcx, rbp
call dbg.tcpcon_timeouts
mov edx, dword [rsp + 0x19c]
cmp edx, 0x5ea
ja case.0x140011c93.9
mov r9, qword [rsp + 0x80]
mov r8d, dword [rsp + 0x98]
mov rcx, qword [rsp + 0x1a8]
call dbg.preprocess_frame
test eax, eax
je case.0x140011c93.9
mov rax, qword [rsp + 0x288]
mov edx, dword [rsp + 0x2a0]
mov rcx, qword [rsp + 0x298]
mov r8, qword [rsp + 0x280]
mov qword [rsp + 0xb8], rax
mov eax, dword [rsp + 0x288]
lea r10d, [rdx + 4]
mov qword [rsp + 0x1c0], rcx
movzx ebx, byte [rsp + 0x298]
movdqu xmm0, xmmword [rsp + 0x288]
mov dword [rsp + 0xc8], eax
mov eax, dword [rsp + 0x270]
movdqa xmm2, xmmword [rsp + 0x270]
mov qword [rsp + 0x1e0], r8
movzx r9d, byte [rsp + 0x280]
movaps xmmword [rsp + 0x1b0], xmm0
mov dword [rsp + 0xd4], eax
mov eax, dword [rsp + 0x2ac]
movaps xmmword [rsp + 0x1d0], xmm2
mov dword [rsp + 0x70], eax
mov eax, dword [rsp + 0x2a8]
mov dword [rsp + 0x7c], eax
mov rax, qword [rsp + 0x1a8]
movzx esi, byte [rax + r10]
lea r10d, [rdx + 5]
mov byte [rsp + 0xc4], sil
movzx esi, byte [rax + r10]
lea r10d, [rdx + 6]
mov byte [rsp + 0xd1], sil
movzx esi, byte [rax + r10]
lea r10d, [rdx + 7]
mov byte [rsp + 0xd2], sil
movzx esi, byte [rax + r10]
lea r10d, [rdx + 8]
mov byte [rsp + 0xd3], sil
movzx esi, byte [rax + r10]
lea r10d, [rdx + 9]
movzx r11d, byte [rax + r10]
lea r10d, [rdx + 0xa]
add edx, 0xb
mov byte [rsp + 0xa0], r11b
movzx r11d, byte [rax + r10]
movzx eax, byte [rax + rdx]
mov byte [rsp + 0xc2], r11b
mov byte [rsp + 0xc3], al
test bl, bl
je 0x140013055
test r9b, r9b
je 0x14001306f
mov qword [rsp + 0x180], r8
lea r8, [rsp + 0x150]
cmp dword [rsp + 0x250], 0x84
mov qword [rsp + 0x160], rcx
mov qword [rsp + 0xa8], r8
movaps xmmword [rsp + 0x170], xmm2
movaps xmmword [rsp + 0x150], xmm0
je 0x140012470
mov rcx, qword [rsp + 0x90]
lea rax, [rsp + 0x170]
mov r9d, dword [rsp + 0x70]
mov edx, dword [rsp + 0x7c]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x20], rcx
mov rcx, rax
call dbg.syn_cookie
mov dword [rsp + 0x9c], eax
mov rax, qword [rsp + 0x1c0]
mov rdx, qword [rsp + 0x68]
movdqa xmm3, xmmword [rsp + 0x1b0]
mov qword [rsp + 0x180], rax
mov rax, qword [rsp + 0x88]
movaps xmmword [rsp + 0x170], xmm3
mov rcx, qword [rax + 0x18]
call sym.is_my_ip
test eax, eax
je 0x140012220
mov eax, dword [rsp + 0x2b8]
sub eax, 4
cmp eax, 0x11
ja case.0x140011c93.9
lea rbx, [0x14005d934]
movsxd rax, dword [rbx + rax*4]
add rax, rbx
jmp rax
test rbp, rbp
je case.0x140011c93.9
xor ecx, ecx
call sub.api_ms_win_crt_time_l1_1_0.dll__time64
xor r8d, r8d
mov rcx, rbp
mov edx, eax
call dbg.tcpcon_timeouts
nop word cs:[rax + rax]
nop dword [rax]
mov eax, dword [0x14007e150]
test eax, eax
je 0x140011a20
mov r14, qword [rsp + 0x310]
mov r8d, dword [r14 + 0x18]
lea rdx, str.___exiting_receive_thread__u_____________________n
mov ecx, 1
call dbg.LOG
jmp 0x14001192f
mov rax, qword [rsp + 0xf0]
xor esi, esi
lea rbx, [rax + 0x128]
mov eax, dword [rax + 0xba0]
test eax, eax
je case.0x140011c93.9
mov qword [rsp + 0x68], rbp
mov rbp, rbx
mov ebx, dword [rsp + 0x70]
mov qword [rsp + 0x70], rdi
mov edi, esi
mov rsi, qword [rsp + 0xf0]
jmp 0x140011d46
add edi, 1
add rbp, 0x170
cmp edi, dword [rsi + 0xba0]
jae 0x140012c0f
mov edx, ebx
mov rcx, rbp
call sym.is_my_port
test eax, eax
je 0x140011d30
mov rax, qword [rsp + 0x310]
mov rbp, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov rax, qword [rax]
test byte [rax + 0x1054], 1
jne 0x140012e37
mov rax, qword [rsp + 0x90]
mov edx, dword [rsp + 0x1a0]
mov r9d, dword [rsp + 0x19c]
mov r8, qword [rsp + 0x1a8]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0xb0]
mov qword [rsp + 0x20], rax
call dbg.handle_udp
mov eax, dword [0x14007e150]
test eax, eax
je 0x140011a20
jmp 0x140011cce
mov rax, qword [rsp + 0x90]
mov edx, dword [rsp + 0x1a0]
mov r9d, dword [rsp + 0x19c]
mov r8, qword [rsp + 0x1a8]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0xb0]
mov qword [rsp + 0x20], rax
call dbg.handle_oproto
mov rax, qword [rsp + 0x88]
mov edx, dword [rsp + 0x70]
mov rcx, qword [rax + 0x18]
call sym.is_my_port
test eax, eax
je case.0x140011c93.9
mov rax, qword [rsp + 0x310]
mov rax, qword [rax]
test byte [rax + 0x1054], 1
jne 0x140012b98
mov rcx, qword [rsp + 0xd8]
test rcx, rcx
je 0x140011e7e
mov eax, dword [rsp + 0x1a4]
mov r8d, dword [rsp + 0x19c]
mov rdx, qword [rsp + 0x1a8]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x1a0]
mov r9d, r8d
mov dword [rsp + 0x20], eax
call dbg.pcapfile_writeframe
movzx eax, byte [rsp + 0xa0]
shl esi, 0x18
mov rdx, qword [rsp + 0x1a8]
mov r8d, 0x40
shl eax, 0x10
or esi, eax
movzx eax, byte [rsp + 0xc3]
or esi, eax
movzx eax, byte [rsp + 0xc2]
shl eax, 8
or esi, eax
mov eax, dword [rsp + 0x2a0]
add eax, 0xd
movzx ecx, byte [rdx + rax]
mov rdx, qword [rsp + 0xe8]
call dbg.reason_string
mov r8d, dword [rsp + 0x7c]
mov ecx, 5
mov rdx, qword [rsp + 0x1e0]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x2a0]
lea r9, str.___TCP_ackno0x_08x_flags0x_02x__s__n
mov qword [rsp + 0x180], rdx
movdqa xmm4, xmmword [rsp + 0x1d0]
mov rdx, qword [rsp + 0x1a8]
add eax, 0xd
movaps xmmword [rsp + 0x170], xmm4
movzx eax, byte [rdx + rax]
mov rdx, qword [rsp + 0x68]
mov dword [rsp + 0x20], esi
mov dword [rsp + 0x28], eax
call dbg.LOGip
test rbp, rbp
je 0x140012a00
mov eax, dword [rsp + 0xc4]
movzx edx, byte [rsp + 0xd1]
mov rcx, rbp
movdqa xmm5, xmmword [rsp + 0x1b0]
mov r9d, dword [rsp + 0x70]
shl edx, 0x10
shl eax, 0x18
mov r8, qword [rsp + 0xa8]
or eax, edx
movzx edx, byte [rsp + 0xd3]
movaps xmmword [rsp + 0x170], xmm5
movdqa xmm5, xmmword [rsp + 0x1d0]
or eax, edx
movzx edx, byte [rsp + 0xd2]
movaps xmmword [rsp + 0x150], xmm5
shl edx, 8
or eax, edx
mov rdx, qword [rsp + 0x68]
mov ebx, eax
mov rax, qword [rsp + 0x1c0]
mov qword [rsp + 0x180], rax
mov rax, qword [rsp + 0x1e0]
mov qword [rsp + 0x160], rax
mov eax, dword [rsp + 0x7c]
mov dword [rsp + 0x20], eax
call dbg.tcpcon_lookup_tcb
mov edx, dword [rsp + 0x2a0]
mov r10, rax
mov rax, qword [rsp + 0x1a8]
add edx, 0xd
movzx ecx, byte [rax + rdx]
mov edx, ecx
not edx
and edx, 0x12
je 0x140012ac3
test r10, r10
je 0x140012873
and ecx, 0x10
jne 0x140012f1d
mov edx, dword [rsp + 0x2b4]
test edx, edx
jne 0x140012ebd
mov edx, dword [rsp + 0x2a0]
add edx, 0xd
movzx eax, byte [rax + rdx]
mov edx, eax
and edx, 5
cmp dl, 1
je 0x140012fe6
test al, 4
jne 0x140012e88
not eax
test al, 0x12
jne case.0x140011c93.9
mov r10d, 1
nop word cs:[rax + rax]
mov eax, dword [rsp + 0x9c]
lea ebx, [rsi - 1]
cmp ebx, eax
jne 0x140012a44
mov rax, qword [rsp + 0x1e0]
mov r9, qword [rsp + 0xa8]
mov dword [rsp + 0x9c], r10d
movdqa xmm5, xmmword [rsp + 0x1d0]
mov r8d, dword [rsp + 0x7c]
mov qword [rsp + 0x180], rax
mov rax, qword [rsp + 0x1c0]
movdqa xmm4, xmmword [rsp + 0x1b0]
mov rdx, qword [rsp + 0x68]
movaps xmmword [rsp + 0x170], xmm5
mov qword [rsp + 0x160], rax
mov eax, dword [rsp + 0x70]
mov rcx, qword [rsp + 0xe0]
movaps xmmword [rsp + 0x150], xmm4
mov dword [rsp + 0x20], eax
call sym.dedup_is_duplicate
test eax, eax
jne case.0x140011c93.9
mov eax, dword [rsp + 0x2a0]
mov r10d, dword [rsp + 0x9c]
lea edx, [rax + 0xd]
add rdx, qword [rsp + 0x1a8]
movzx eax, byte [rdx]
mov ecx, eax
not ecx
and ecx, 0x12
jne 0x140012110
mov rax, qword [rsp + 0xf8]
add qword [rax], 1
movzx eax, byte [rdx]
mov rdx, qword [rsp + 0x1e0]
mov dword [rsp + 0x30], eax
mov r8d, r10d
mov eax, dword [rsp + 0x7c]
mov dword [rsp + 0x20], 6
mov qword [rsp + 0x180], rdx
mov rdx, qword [rsp + 0x230]
mov dword [rsp + 0x28], eax
mov r9, qword [rsp + 0x68]
mov qword [rsp + 0x40], rdx
mov edx, dword [rsp + 0x258]
movdqa xmm5, xmmword [rsp + 0x1d0]
mov rcx, qword [rsp + 0xb0]
mov dword [rsp + 0x38], edx
mov rdx, qword [0x14007e148]
movaps xmmword [rsp + 0x170], xmm5
call dbg.output_report_status
test rbp, rbp
jne case.0x140011c93.9
mov rax, qword [rsp + 0xf0]
test byte [rax + 0xce4], 0x20
jne case.0x140011c93.9
mov rax, qword [rsp + 0x1e0]
mov r9, qword [rsp + 0xa8]
movdqa xmm4, xmmword [rsp + 0x1d0]
mov r8, qword [rsp + 0x68]
mov qword [rsp + 0x180], rax
mov rax, qword [rsp + 0x1c0]
movdqa xmm5, xmmword [rsp + 0x1b0]
movaps xmmword [rsp + 0x170], xmm4
mov qword [rsp + 0x160], rax
mov rax, qword [rsp + 0x310]
movaps xmmword [rsp + 0x150], xmm5
mov rdx, qword [rax + 0x10]
lea rcx, [rax + 0x40]
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x7c]
mov dword [rsp + 0x20], eax
call dbg.tcp_send_RST
jmp case.0x140011c93.9
cmp bl, 6
jne case.0x140011c93.9
mov rax, qword [rsp + 0xb8]
shr rax, 0x30
cmp rax, 0xff02
jne case.0x140011c93.9
cmp dword [rsp + 0x2b8], 0x15
jne case.0x140011c93.9
cmp dword [rsp + 0x2a8], 0x87
jne case.0x140011c93.9
mov r9d, dword [rsp + 0x19c]
mov r8, qword [rsp + 0x1a8]
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
call dbg.stack_ndpv6_incoming_request
jmp case.0x140011c93.9
mov rax, qword [rsp + 0x90]
mov edx, dword [rsp + 0x1a0]
mov r9d, dword [rsp + 0x19c]
mov r8, qword [rsp + 0x1a8]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0xb0]
mov qword [rsp + 0x20], rax
call dbg.handle_icmp
mov eax, dword [0x14007e150]
test eax, eax
je 0x140011a20
jmp 0x140011cce
mov rax, qword [rsp + 0x90]
mov edx, dword [rsp + 0x1a0]
mov r9d, dword [rsp + 0x19c]
mov r8, qword [rsp + 0x1a8]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0xb0]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x9c]
mov dword [rsp + 0x20], eax
call dbg.handle_sctp
jmp case.0x140011c93.5
mov rax, qword [rsp + 0x1e0]
xor r8d, r8d
mov rdx, qword [rsp + 0x1a8]
lea r9, str.___ARP___u___n
movdqa xmm4, xmmword [rsp + 0x1d0]
mov ecx, 2
mov qword [rsp + 0x180], rax
movsxd rax, dword [rsp + 0x2bc]
movaps xmmword [rsp + 0x170], xmm4
movzx eax, byte [rdx + rax]
mov rdx, qword [rsp + 0x68]
mov dword [rsp + 0x20], eax
call dbg.LOGip
mov eax, dword [rsp + 0x2a8]
cmp eax, 1
je 0x140012b35
cmp eax, 2
jne case.0x140011c93.9
mov rax, qword [rsp + 0xf0]
test byte [rax + 4], 0x10
je case.0x140011c93.9
mov edx, dword [rsp + 0xd4]
lea rcx, [rax + 0xba8]
call dbg.rangelist_is_contains
test eax, eax
je case.0x140011c93.9
mov rax, qword [rsp + 0x1e0]
mov rdx, qword [rsp + 0x68]
xor r8d, r8d
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0xe0]
mov qword [rsp + 0x180], rax
movdqa xmm4, xmmword [rsp + 0x1d0]
movdqa xmm5, xmmword [rsp + 0x1b0]
mov rax, qword [rsp + 0x1c0]
movaps xmmword [rsp + 0x170], xmm4
mov qword [rsp + 0x160], rax
movaps xmmword [rsp + 0x150], xmm5
call sym.dedup_is_duplicate
test eax, eax
jne case.0x140011c93.9
mov rax, qword [rsp + 0x80]
mov edx, dword [rsp + 0x1a0]
mov r9d, dword [rsp + 0x19c]
mov r8, qword [rsp + 0x1a8]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0xb0]
call dbg.arp_recv_response
jmp case.0x140011c93.9
mov rcx, qword [rsp + 0x90]
mov edx, dword [rsp + 0x7c]
lea rax, [rsp + 0x170]
mov r9d, dword [rsp + 0x70]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x20], rcx
or edx, 0x20000
mov rcx, rax
call dbg.syn_cookie
mov dword [rsp + 0x9c], eax
jmp 0x140011c37
call dbg.pixie_cpu_get_count
mov edx, dword [r14 + 0x18]
lea edx, [rdx + rdx + 1]
cmp edx, eax
jb 0x14001189d
mov ecx, 1
sub ecx, eax
nop dword [rax]
add edx, ecx
cmp edx, eax
jae 0x1400124d0
cmp byte [r12 + 0x1158], 0
je 0x1400118ac
lea rcx, [r12 + 0x1158]
mov edx, 1
call dbg.pcapfile_openwrite
mov qword [rsp + 0xd8], rax
jmp 0x1400118b8
mov eax, dword [r12 + 0xba0]
pxor xmm1, xmm1
mov rdx, qword [r14 + 0x10]
lea r8, [r14 + 0x40]
movsd xmm0, qword [r12 + 0xcd8]
divsd xmm0, qword [0x14005e0e0]
cvtsi2sd xmm1, rax
divsd xmm0, xmm1
movsd xmm1, qword [0x14005e0e8]
comisd xmm0, xmm1
jae 0x140012ab0
cvttsd2si rcx, xmm0
mov rax, qword [r12 + 0xd20]
lea r9, [dbg.output_report_banner]
mov qword [rsp + 0x30], rax
mov eax, dword [r12 + 0x1258]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x20], rax
call dbg.tcpcon_create_table
mov rdx, qword [r12 + 0x1658]
mov rcx, rax
mov rbp, rax
call dbg.scripting_init_tcp
mov rcx, rbp
movzx r9d, byte [r12 + 0xce5]
movzx r8d, byte [r12 + 0xce6]
movzx edx, byte [r12 + 0xce4]
mov eax, r9d
shr r8b, 5
and r9d, 1
shr al, 2
shr dl, 7
and r8d, 1
and eax, 1
movzx edx, dl
mov dword [rsp + 0x28], eax
movzx eax, byte [r12 + 0xce5]
shr al, 1
and eax, 1
mov dword [rsp + 0x20], eax
call dbg.tcpcon_set_banner_flags
movzx eax, byte [r12 + 0xce6]
test al, 4
jne 0x140012d42
test al, 8
jne 0x140012d18
test al, 2
jne 0x140012cf7
movzx eax, byte [r12 + 0xce5]
test al, 0x40
jne 0x140012ccd
test al, al
js 0x140012d6c
test byte [r12 + 0xce6], 1
jne 0x140012cac
mov r9, qword [r12 + 0x12e8]
test r9, r9
je 0x140012654
mov r8, qword [r12 + 0x12f0]
lea rdx, [0x14005d7a5]
mov rcx, rbp
call dbg.tcpcon_set_parameter
mov r9, qword [r12 + 0x12d8]
test r9, r9
je 0x140012678
mov r8, qword [r12 + 0x12e0]
lea rdx, [0x14005d7b2]
mov rcx, rbp
call dbg.tcpcon_set_parameter
mov r9, qword [r12 + 0x12c8]
test r9, r9
je 0x14001269c
mov r8, qword [r12 + 0x12d0]
lea rdx, [0x14005d7c2]
mov rcx, rbp
call dbg.tcpcon_set_parameter
mov r9, qword [r12 + 0x1298]
test r9, r9
je 0x1400126c0
mov r8, qword [r12 + 0x12a0]
lea rdx, [0x14005d7cc]
mov rcx, rbp
call dbg.tcpcon_set_parameter
mov r9, qword [r12 + 0x12a8]
test r9, r9
je 0x1400126e4
mov r8, qword [r12 + 0x12b0]
lea rdx, [0x14005d7d8]
mov rcx, rbp
call dbg.tcpcon_set_parameter
mov r9, qword [r12 + 0x12b8]
test r9, r9
je 0x140012708
mov r8, qword [r12 + 0x12c0]
lea rdx, [0x14005d7e1]
mov rcx, rbp
call dbg.tcpcon_set_parameter
mov r9d, dword [r12 + 0x1610]
test r9d, r9d
jne 0x140012c6e
mov r9d, dword [r12 + 0x1614]
test r9d, r9d
jne 0x140012c30
xor esi, esi
lea rbx, [r12 + 0x12f8]
cmp qword [r12 + 0x1478], 0
je 0x14001276d
nop
mov r9, qword [rbx + 8]
mov r8, qword [rbx + 0x10]
mov rcx, rbp
add rsi, 1
mov rdx, qword [rbx]
mov dword [rsp + 0x20], 0
add rbx, 0x18
call dbg.tcpcon_set_http_header
cmp rsi, qword [r12 + 0x1478]
jb 0x140012740
xor edi, edi
lea rsi, [r12 + 0x1480]
cmp qword [r12 + 0x1580], 0
lea rbx, str.Cookie
je 0x1400127bc
nop dword [rax]
mov r9, qword [rsi]
mov r8, qword [rsi + 8]
mov rdx, rbx
mov rcx, rbp
mov dword [rsp + 0x20], 1
add rdi, 1
add rsi, 0x10
call dbg.tcpcon_set_http_header
cmp rdi, qword [r12 + 0x1580]
jb 0x140012790
xor ebx, ebx
lea rsi, [r12 + 0x12f8]
cmp qword [r12 + 0x1608], 0
je 0x14001280b
nop word cs:[rax + rax]
nop dword [rax]
mov rdx, qword [rsi]
xor r9d, r9d
xor r8d, r8d
mov rcx, rbp
mov dword [rsp + 0x20], 2
add rbx, 1
add rsi, 0x18
call dbg.tcpcon_set_http_header
cmp rbx, qword [r12 + 0x1608]
jb 0x1400127e0
mov rsi, qword [r12 + 0x1288]
lea rbx, [rsp + 0x230]
test rsi, rsi
je 0x14001285d
mov r9d, dword [rsi + 8]
lea r8, str.hello_string__u_
mov edx, 0x40
mov rcx, rbx
call sym.snprintf
mov rdi, qword [rsi]
mov rcx, rdi
call sym.strlen
mov r9, rdi
mov rdx, rbx
mov rcx, rbp
mov r8, rax
call dbg.tcpcon_set_parameter
mov rsi, qword [rsi + 0x10]
test rsi, rsi
jne 0x140012820
movzx eax, byte [r12 + 0xce4]
test al, 0x10
jne 0x14001191a
jmp 0x140011992
mov edx, ecx
and edx, 4
and ecx, 1
je 0x140012a24
mov rax, qword [rsp + 0x1e0]
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x110]
movdqa xmm4, xmmword [rsp + 0x1d0]
mov qword [rsp + 0x180], rax
movaps xmmword [rsp + 0x170], xmm4
call dbg.ipaddress_fmt
mov r8, qword [rsp + 0xe8]
mov ecx, 4
movdqu xmm5, xmmword [rsp + 0x110]
movdqu xmm4, xmmword [rsp + 0x120]
lea rdx, str._s:_received_FIN_but_no_TCB_n
movaps xmmword [rsp + 0x1f0], xmm5
movdqu xmm5, xmmword [rsp + 0x130]
movaps xmmword [rsp + 0x200], xmm4
movaps xmmword [rsp + 0x210], xmm5
call dbg.LOG
mov eax, dword [rsp + 0x2a0]
add eax, 0xd
add rax, qword [rsp + 0x1a8]
test byte [rax], 4
jne 0x140012a12
mov rax, qword [rsp + 0x1c0]
mov r9, qword [rsp + 0xa8]
movdqa xmm4, xmmword [rsp + 0x1b0]
mov r8d, dword [rsp + 0x70]
mov qword [rsp + 0x180], rax
mov rax, qword [rsp + 0x1e0]
movdqa xmm5, xmmword [rsp + 0x1d0]
mov rdx, qword [rsp + 0x68]
movaps xmmword [rsp + 0x170], xmm4
mov qword [rsp + 0x160], rax
mov eax, dword [rsp + 0x7c]
mov rcx, qword [rsp + 0x100]
movaps xmmword [rsp + 0x150], xmm5
mov dword [rsp + 0x20], eax
call dbg.rstfilter_is_filter
test eax, eax
jne 0x140012a00
mov rax, qword [rsp + 0x1c0]
mov dword [rsp + 0x30], esi
mov rcx, rbp
mov r9d, dword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x180], rax
mov rax, qword [rsp + 0x1e0]
movdqa xmm4, xmmword [rsp + 0x1b0]
mov r8, qword [rsp + 0xa8]
mov qword [rsp + 0x160], rax
mov eax, dword [rsp + 0x7c]
movdqa xmm5, xmmword [rsp + 0x1d0]
movaps xmmword [rsp + 0x170], xmm4
mov dword [rsp + 0x20], eax
movaps xmmword [rsp + 0x150], xmm5
call dbg.tcpcon_send_RST
nop word cs:[rax + rax]
nop
mov eax, dword [rsp + 0x2a0]
add eax, 0xd
add rax, qword [rsp + 0x1a8]
movzx eax, byte [rax]
mov edx, eax
not eax
and edx, 4
test al, 0x12
je 0x140012bfc
test dl, dl
je case.0x140011c93.9
mov eax, dword [rsp + 0x9c]
lea ebx, [rsi - 1]
mov r10d, 2
cmp ebx, eax
je 0x140012062
mov rsi, qword [rsp + 0xe8]
mov rax, qword [rsp + 0x1e0]
movdqa xmm5, xmmword [rsp + 0x1d0]
mov rdx, qword [rsp + 0x68]
mov rcx, rsi
mov qword [rsp + 0x180], rax
movaps xmmword [rsp + 0x170], xmm5
call dbg.ipaddress_fmt
mov r9d, ebx
mov r8, rsi
mov ecx, 2
mov eax, dword [rsp + 0x9c]
lea rdx, str._s___bad_cookie:_ackno0x_08x_expected0x_08x_n
mov dword [rsp + 0x20], eax
call dbg.LOG
mov eax, dword [0x14007e150]
test eax, eax
je 0x140011a20
jmp 0x140011cce
subsd xmm0, xmm1
cvttsd2si rcx, xmm0
btc rcx, 0x3f
jmp 0x14001254e
mov eax, dword [rsp + 0x9c]
lea r9d, [rsi - 1]
cmp r9d, eax
jne 0x140012f85
add ebx, 1
test r10, r10
je 0x140012d8d
mov eax, dword [rsp + 0x1a4]
mov dword [rsp + 0x40], esi
xor r9d, r9d
mov r8d, 1
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x1a0]
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], eax
mov rdx, r10
mov rcx, rbp
call dbg.stack_incoming_tcp
mov eax, dword [rsp + 0x2a0]
add eax, 0xd
add rax, qword [rsp + 0x1a8]
jmp 0x140012a12
mov rax, qword [rsp + 0x310]
mov r9, qword [rsp + 0x1a8]
lea r8, [rsp + 0x140]
mov edx, dword [rsp + 0xc8]
mov rcx, qword [rsp + 0x88]
mov eax, dword [rax + 0x380]
mov dword [rsp + 0x140], eax
mov rax, qword [rsp + 0x310]
movzx eax, word [rax + 0x384]
mov word [rsp + 0x144], ax
mov eax, dword [rsp + 0x19c]
mov dword [rsp + 0x20], eax
call dbg.stack_arp_incoming_request
jmp case.0x140011c93.9
mov rax, qword [rsp + 0x310]
mov r8, qword [rsp + 0x1a8]
mov ecx, 1
mov ebx, dword [rsp + 0x19c]
movsd xmm1, qword [rax + 0x3a0]
mov qword [rsp + 0xc8], r8
movsd qword [rsp + 0xb8], xmm1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov dword [rsp + 0x20], 0
mov r8, qword [rsp + 0xc8]
mov r9, rbx
movsd xmm1, qword [rsp + 0xb8]
mov rcx, rax
call dbg.packet_trace
jmp 0x140011e43
test dl, dl
jne 0x140012a2c
mov r10d, 1
jmp 0x140012050
mov eax, dword [0x14007e150]
mov rbp, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
test eax, eax
je 0x140011a20
jmp 0x140011cce
lea rbx, [rsp + 0x230]
lea r8, [0x14005d7ee]
mov edx, 0x40
mov rcx, rbx
call sym.snprintf
mov rcx, rbx
call sym.strlen
mov r9, rbx
lea rdx, [0x14005d7f9]
mov rcx, rbp
mov r8, rax
call dbg.tcpcon_set_parameter
jmp 0x14001272a
lea rbx, [rsp + 0x230]
lea r8, [0x14005d7ee]
mov edx, 0x40
mov rcx, rbx
call sym.snprintf
mov rcx, rbx
call sym.strlen
mov r9, rbx
lea rdx, [0x14005d7f1]
mov rcx, rbp
mov r8, rax
call dbg.tcpcon_set_parameter
jmp 0x140012719
lea r9, [0x14005d786]
mov r8d, 1
lea rdx, [0x14005d79f]
mov rcx, rbp
call dbg.tcpcon_set_parameter
jmp 0x140012630
lea r9, [0x14005d786]
mov r8d, 1
lea rdx, [0x14005d788]
mov rcx, rbp
call dbg.tcpcon_set_parameter
movzx eax, byte [r12 + 0xce5]
jmp 0x140012619
lea r9, [0x14005d782]
mov r8d, 1
lea rdx, [0x14005d777]
mov rcx, rbp
call dbg.tcpcon_set_parameter
jmp 0x140012608
lea r9, [0x14005d77d]
mov r8d, 1
lea rdx, [0x14005d777]
mov rcx, rbp
call dbg.tcpcon_set_parameter
movzx eax, byte [r12 + 0xce6]
jmp 0x140012600
lea r9, [0x14005d771]
mov r8d, 1
lea rdx, [0x14005d777]
mov rcx, rbp
call dbg.tcpcon_set_parameter
movzx eax, byte [r12 + 0xce6]
jmp 0x1400125f8
lea r9, [0x14005d786]
mov r8d, 1
lea rdx, [0x14005d793]
mov rcx, rbp
call dbg.tcpcon_set_parameter
jmp 0x140012621
mov rax, qword [rsp + 0x1c0]
mov r9d, dword [rsp + 0x70]
mov dword [rsp + 0x30], ebx
mov rcx, rbp
mov qword [rsp + 0x40], 0
mov rdx, qword [rsp + 0x68]
mov qword [rsp + 0x180], rax
mov rax, qword [rsp + 0x1e0]
mov dword [rsp + 0x28], esi
mov r8, qword [rsp + 0xa8]
mov qword [rsp + 0x160], rax
mov eax, dword [rsp + 0x1a4]
movdqa xmm4, xmmword [rsp + 0x1b0]
movdqa xmm5, xmmword [rsp + 0x1d0]
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x1a0]
movaps xmmword [rsp + 0x170], xmm4
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x258]
movaps xmmword [rsp + 0x150], xmm5
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x7c]
mov dword [rsp + 0x20], eax
call dbg.tcpcon_create_tcb
mov r10, rax
mov rax, qword [rsp + 0x108]
add qword [rax], 1
jmp 0x140012ae3
mov rax, qword [rsp + 0x310]
mov rsi, qword [rsp + 0x1a8]
mov ecx, 1
mov ebx, dword [rsp + 0x19c]
movsd xmm1, qword [rax + 0x3a0]
movsd qword [rsp + 0x68], xmm1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov dword [rsp + 0x20], 0
mov r9, rbx
mov r8, rsi
movsd xmm1, qword [rsp + 0x68]
mov rcx, rax
call dbg.packet_trace
jmp 0x140011d76
mov eax, dword [rsp + 0x1a4]
mov dword [rsp + 0x40], esi
xor r9d, r9d
mov r8d, 2
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x1a0]
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], eax
jmp 0x140012b13
mov r8d, dword [rsp + 0x1a4]
mov ecx, dword [rsp + 0x2b0]
mov qword [rsp + 0x20], rdx
mov rdx, r10
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x30], r8d
mov r8d, dword [rsp + 0x1a0]
lea r9, [rax + rcx]
mov rcx, rbp
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x28], r8d
mov r8d, 5
mov qword [rsp + 0xa0], r10
call dbg.stack_incoming_tcp
mov rax, qword [rsp + 0x1a8]
mov r10, qword [rsp + 0xa0]
jmp 0x140012011
mov eax, dword [rsp + 0x1a4]
mov rdx, r10
xor r9d, r9d
mov rcx, rbp
mov dword [rsp + 0x40], esi
mov r8d, 4
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x1a0]
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], 0
mov qword [rsp + 0xa0], r10
call dbg.stack_incoming_tcp
mov rax, qword [rsp + 0x1a8]
mov r10, qword [rsp + 0xa0]
jmp 0x140012002
mov dword [r14 + 0x398], 1
jmp 0x14001193c
mov rbx, qword [rsp + 0xe8]
mov rdx, qword [rsp + 0x68]
mov dword [rsp + 0x70], r9d
mov rax, qword [rsp + 0x1e0]
movdqa xmm4, xmmword [rsp + 0x1d0]
mov rcx, rbx
mov qword [rsp + 0x180], rax
movaps xmmword [rsp + 0x170], xmm4
call dbg.ipaddress_fmt
mov r9d, dword [rsp + 0x70]
mov r8, rbx
xor ecx, ecx
mov eax, dword [rsp + 0x9c]
lea rdx, str._s___bad_cookie:_ackno0x_08x_expected0x_08x_n
mov dword [rsp + 0x20], eax
call dbg.LOG
jmp case.0x140011c93.9
mov eax, dword [rsp + 0x2b4]
mov rdx, r10
xor r9d, r9d
mov rcx, rbp
mov dword [rsp + 0x40], esi
mov r8d, 3
add eax, ebx
mov qword [rsp + 0xa0], r10
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x1a4]
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x1a0]
mov dword [rsp + 0x28], eax
call dbg.stack_incoming_tcp
mov eax, dword [rsp + 0x2a0]
mov rdx, qword [rsp + 0x1a8]
mov r10, qword [rsp + 0xa0]
add eax, 0xd
movzx eax, byte [rdx + rax]
jmp 0x14001202d
mov r8d, 0x331
lea rdx, str.src_main.c
lea rcx, str.ip_me.version___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__assert]
mov r8d, 0x332
lea rdx, str.src_main.c
lea rcx, str.ip_them.version___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__assert]
nop
nop word [rax + rax]