Function at 0x1400348e0
Capabilities:
Enumerate threads
Resume thread

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x920]
sub rsp, 0xa20
mov rax, qword [0x1400a3020]
xor rax, rsp
mov qword [rbp + 0x918], rax
mov r12, r8
mov r15, rdx
mov qword [rbp - 0x70], rdx
mov ebx, ecx
mov dword [rsp + 0x60], ecx
xor r14d, r14d
mov r13d, r14d
mov dword [rbp - 0x78], r14d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x900], xmm0
mov dword [rbp + 0x910], eax
xor edx, edx
lea ecx, [rax + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
mov qword [rbp + 0x140], rax
cmp rax, 0xffffffffffffffff
je 0x14003608d
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x94], xmm0
mov qword [rbp + 0xa4], r14
mov dword [rbp + 0x90], 0x1c
lea rdx, [rbp + 0x90]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x14003608d
cmp dword [rbp + 0x9c], ebx
jne 0x140036078
mov qword [rbp + 0x88], r14
mov r8d, dword [rbp + 0x98]
xor edx, edx
lea ecx, [rdx + 0x4a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
mov qword [rbp + 0x148], rax
test rax, rax
je 0x14003606a
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
movups xmmword [rbp + 0xc0], xmm0
movups xmmword [rbp + 0xd0], xmm0
mov qword [rbp + 0xb0], r14
mov qword [rbp + 0xb8], r14
mov ecx, 0x48
call fcn.140047d0c
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp + 0xb0], rax
mov qword [rbp + 0xc0], r14
mov qword [rbp + 0xd0], r14
mov qword [rbp + 0xd8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xc0], 0
mov qword [rsp + 0x20], r14
mov r9d, 8
lea r8, [rbp + 0x88]
lea edx, [r9 + 1]
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtQueryInformationThread]
test eax, eax
js 0x140035141
mov r8, qword [rbp + 0x88]
lea rdx, str.0x_016llX
lea rcx, [rbp + 0x900]
call fcn.14003c2e0
mov dword [rbp - 0x18], 6
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x80], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x68], 0
lea rax, [rbp + 0x900]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140034aa0
lea rdx, [rbp + 0x900]
lea rcx, [rsp + 0x68]
call fcn.140006ac0
nop
lea rcx, [rbp - 0x18]
call fcn.140008f70
mov dword [rbp - 0x18], 1
mov ecx, 0x20
call fcn.140047d0c
mov qword [rax], r14
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x10], rax
lea rcx, [rsp + 0x68]
cmp rax, rcx
je 0x140034b11
lea rdx, [rsp + 0x68]
cmp qword [rbp - 0x80], 0x10
cmovae rdx, qword [rsp + 0x68]
mov r8, qword [rsp + 0x78]
mov rcx, rax
call fcn.140006ac0
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x140034b4e
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140034b48
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400360cc
call fcn.1400477f0
nop
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x40], 0
mov r8d, 0x11
lea rdx, str.start_address_hex
lea rcx, [rsp + 0x40]
call fcn.140006ac0
nop
lea rax, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 0x10
cmovae rax, qword [rbp + 0xc0]
mov qword [rbp + 0xd0], r14
mov byte [rax], 0
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0xb0]
call fcn.140007ea0
mov r14, qword [rbp + 0xb0]
mov rbx, qword [rsp + 0x78]
cmp byte [rbx + 0x19], 0
jne 0x140034bd9
lea r8, [rbx + 0x20]
lea rdx, [rsp + 0x40]
call fcn.140007f60
test al, al
je 0x140034bdc
mov rbx, r14
cmp rbx, r14
je 0x140034bff
mov rbx, qword [rbx + 0x40]
test rbx, rbx
je 0x140034bff
mov rcx, rbx
call fcn.1400080e0
mov edx, 0x10
mov rcx, rbx
call fcn.1400477f0
mov ecx, 0x10
call fcn.140047d0c
mov qword [rbp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rdx, [rbp - 0x18]
mov rcx, rax
call fcn.14000b360
mov rbx, rax
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0xb0]
call fcn.14000c600
mov qword [rax], rbx
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x140034c73
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140034c6e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400360d2
call fcn.1400477f0
xor r14d, r14d
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x40], r14b
lea rcx, [rbp - 0x18]
call fcn.140008f70
mov rbx, qword [rbp + 0x88]
mov dword [rbp - 8], 6
lea rcx, [rbp - 8]
call fcn.140008f70
mov dword [rbp - 8], r14d
xorps xmm0, xmm0
test rbx, rbx
js 0x140034cbc
cvtsi2sd xmm0, rbx
jmp 0x140034cd1
mov rax, rbx
shr rax, 1
and ebx, 1
or rax, rbx
cvtsi2sd xmm0, rax
addsd xmm0, xmm0
movsd qword [rbp], xmm0
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x40], 0
mov r8d, ntohs
lea rdx, str.start_address
lea rcx, [rsp + 0x40]
call fcn.140006ac0
nop
lea rax, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 0x10
cmovae rax, qword [rbp + 0xc0]
mov qword [rbp + 0xd0], r14
mov byte [rax], 0
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0xb0]
call fcn.140007ea0
mov r14, qword [rbp + 0xb0]
mov rbx, qword [rsp + 0x78]
cmp byte [rbx + 0x19], 0
jne 0x140034d61
lea r8, [rbx + 0x20]
lea rdx, [rsp + 0x40]
call fcn.140007f60
test al, al
je 0x140034d64
mov rbx, r14
cmp rbx, r14
je 0x140034d87
mov rbx, qword [rbx + 0x40]
test rbx, rbx
je 0x140034d87
mov rcx, rbx
call fcn.1400080e0
mov edx, 0x10
mov rcx, rbx
call fcn.1400477f0
mov ecx, 0x10
call fcn.140047d0c
mov qword [rbp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rdx, [rbp - 8]
mov rcx, rax
call fcn.14000b360
mov rbx, rax
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0xb0]
call fcn.14000c600
mov qword [rax], rbx
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x140034dfb
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140034df6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400360d8
call fcn.1400477f0
xor ebx, ebx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x40], bl
lea rcx, [rbp - 8]
call fcn.140008f70
nop
mov qword [rbp + 0xe0], rbx
mov r9d, ebx
mov qword [rbp + 0xf0], rbx
mov r10d, 7
mov qword [rbp + 0xf8], r10
mov word [rbp + 0xe0], bx
or r13d, 1
mov dword [rbp - 0x78], r13d
mov rax, qword [r12]
cmp rax, qword [r12 + 8]
je 0x140034eb4
mov r8, qword [rbp + 0x88]
nop dword [rax + rax]
mov rdx, qword [rax + 0x18]
cmp r8, rdx
jb 0x140034e74
mov ecx, dword [rax + 0x20]
add rcx, rdx
cmp r8, rcx
jbe 0x140034e83
add rax, 0x438
cmp rax, qword [r12 + 8]
je 0x140034eb4
jmp 0x140034e60
lea rdx, [rax + 0x30]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rdx + r8*2], bx
jne 0x140034e90
lea rcx, [rbp + 0xe0]
call fcn.140002760
mov r10, qword [rbp + 0xf8]
mov r9, qword [rbp + 0xf0]
lea rax, [rbp + 0xe0]
cmp r10, 8
jb 0x140034ece
mov rdx, qword [rbp + 0xe0]
lea r8, [rdx + r9*2]
jmp 0x140034ed9
lea r8, [rax + r9*2]
lea rdx, [rbp + 0xe0]
mov qword [rbp + 0x108], rbx
mov qword [rbp + 0x118], rbx
mov qword [rbp + 0x120], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x108], 0
lea rcx, [rbp + 0x108]
call fcn.14001f290
nop
mov dword [rbp + 8], 6
lea rcx, [rbp + 8]
call fcn.140008f70
mov dword [rbp + 8], 1
mov ecx, 0x20
call fcn.140047d0c
mov qword [rax], rbx
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x10], rax
lea rcx, [rbp + 0x108]
cmp rax, rcx
je 0x140034f6d
lea rdx, [rbp + 0x108]
cmp qword [rbp + 0x120], 0x10
cmovae rdx, qword [rbp + 0x108]
mov r8, qword [rbp + 0x118]
mov rcx, rax
call fcn.140006ac0
nop
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x40], 0
mov r8d, 0x14
lea rdx, str.start_address_module
lea rcx, [rsp + 0x40]
call fcn.140006ac0
nop
lea rax, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 0x10
cmovae rax, qword [rbp + 0xc0]
mov qword [rbp + 0xd0], rbx
mov byte [rax], 0
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0xb0]
call fcn.140007ea0
mov r14, qword [rbp + 0xb0]
mov rbx, qword [rsp + 0x78]
cmp byte [rbx + 0x19], 0
jne 0x140034ff8
lea r8, [rbx + 0x20]
lea rdx, [rsp + 0x40]
call fcn.140007f60
test al, al
je 0x140034ffb
mov rbx, r14
cmp rbx, r14
je 0x14003501e
mov rbx, qword [rbx + 0x40]
test rbx, rbx
je 0x14003501e
mov rcx, rbx
call fcn.1400080e0
mov edx, 0x10
mov rcx, rbx
call fcn.1400477f0
mov ecx, 0x10
call fcn.140047d0c
mov qword [rbp + 0x48], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rdx, [rbp + 8]
mov rcx, rax
call fcn.14000b360
mov rbx, rax
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0xb0]
call fcn.14000c600
mov qword [rax], rbx
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x140035092
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003508d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400360de
call fcn.1400477f0
xor r14d, r14d
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x40], r14b
lea rcx, [rbp + 8]
call fcn.140008f70
nop
mov rdx, qword [rbp + 0x120]
cmp rdx, 0x10
jb 0x1400350f3
inc rdx
mov rcx, qword [rbp + 0x108]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400350ee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400360e4
call fcn.1400477f0
and r13d, 0xfffffffe
mov rdx, qword [rbp + 0xf8]
cmp rdx, 8
jb 0x14003513d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140035138
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400360ea
call fcn.1400477f0
mov ebx, dword [rsp + 0x60]
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x128], xmm1
mov qword [rbp + 0x138], r14
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp ebx, eax
je 0x140035da1
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
mov qword [rbp + 0x150], rax
test rax, rax
je 0x140035d93
mov dword [rbp + 0x100], r14d
lea rdx, [rbp + 0x100]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x140035d93
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x140035d93
mov r15, r14
nop dword [rax + rax]
xor edx, edx
cmp dword [rbp + 0x100], edx
je 0x140035600
mov r8d, 0x2c8
lea rcx, [rbp + 0x164]
call fcn.14004a2e0
mov dword [rbp + 0x160], 0x100001
lea rdx, [rbp + 0x160]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Wow64GetThreadContext]
test eax, eax
je 0x140035634
mov r8d, dword [rbp + 0x218]
lea rdx, str.0x_016llX
lea rcx, [rbp + 0x900]
call fcn.14003c2e0
mov dword [rbp - 0x68], 6
xor r14d, r14d
mov qword [rbp + 0xe0], r14
mov qword [rbp + 0xf0], r14
mov qword [rbp + reloc.WS2_32.dll_ntohs8], 0xf
mov byte [rbp + 0xe0], r14b
lea rax, [rbp + 0x900]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r14b
jne 0x140035254
lea rdx, [rbp + 0x900]
lea rcx, [rbp + 0xe0]
call fcn.140006ac0
nop
lea rcx, [rbp - 0x68]
call fcn.140008f70
mov dword [rbp - 0x68], 1
mov ecx, 0x20
call fcn.140047d0c
mov qword [rax], r14
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x60], rax
lea rcx, [rbp + 0xe0]
cmp rax, rcx
je 0x1400352d1
lea rdx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 0x10
cmovae rdx, qword [rbp + 0xe0]
mov r8, qword [rbp + 0xf0]
mov rcx, rax
call fcn.140006ac0
nop
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0x10
jb 0x140035313
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003530d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400360f0
call fcn.1400477f0
nop
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x40], 0
mov r8d, 6
lea rdx, str.ip_hex
lea rcx, [rsp + 0x40]
call fcn.140006ac0
nop
lea rax, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 0x10
cmovae rax, qword [rbp + 0xc0]
mov qword [rbp + 0xd0], r14
mov byte [rax], 0
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0xb0]
call fcn.140007ea0
mov r15, qword [rbp + 0xb0]
mov r14, qword [rsp + 0x78]
cmp byte [r14 + 0x19], 0
jne 0x14003539f
lea r8, [r14 + 0x20]
lea rdx, [rsp + 0x40]
call fcn.140007f60
test al, al
je 0x1400353a2
mov r14, r15
cmp r14, r15
je 0x1400353c5
mov r14, qword [r14 + 0x40]
test r14, r14
je 0x1400353c5
mov rcx, r14
call fcn.1400080e0
mov edx, 0x10
mov rcx, r14
call fcn.1400477f0
mov ecx, 0x10
call fcn.140047d0c
mov qword [rbp + 0x50], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rdx, [rbp - 0x68]
mov rcx, rax
call fcn.14000b360
mov r14, rax
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0xb0]
call fcn.14000c600
mov qword [rax], r14
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x140035439
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140035434
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400360f6
call fcn.1400477f0
xor r14d, r14d
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x40], r14b
lea rcx, [rbp - 0x68]
call fcn.140008f70
mov dword [rbp - 0x58], 6
lea rcx, [rbp - 0x58]
call fcn.140008f70
mov dword [rbp - 0x58], r14d
mov eax, dword [rbp + 0x218]
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
movsd qword [rbp - 0x50], xmm0
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x40], r14b
lea r8d, [r14 + 2]
lea rdx, [0x140093e18]
lea rcx, [rsp + 0x40]
call fcn.140006ac0
nop
lea rax, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 0x10
cmovae rax, qword [rbp + 0xc0]
mov qword [rbp + 0xd0], r14
mov byte [rax], r14b
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0xb0]
call fcn.140007ea0
mov r15, qword [rbp + 0xb0]
mov r14, qword [rsp + 0x78]
cmp byte [r14 + 0x19], 0
jne 0x140035509
lea r8, [r14 + 0x20]
lea rdx, [rsp + 0x40]
call fcn.140007f60
test al, al
je 0x14003550c
mov r14, r15
cmp r14, r15
je 0x14003552f
mov r14, qword [r14 + 0x40]
test r14, r14
je 0x14003552f
mov rcx, r14
call fcn.1400080e0
mov edx, 0x10
mov rcx, r14
call fcn.1400477f0
mov ecx, 0x10
call fcn.140047d0c
mov qword [rbp + 0x58], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rdx, [rbp - 0x58]
mov rcx, rax
call fcn.14000b360
mov r14, rax
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0xb0]
call fcn.14000c600
mov qword [rax], r14
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x1400355a3
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003559e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400360fc
call fcn.1400477f0
xor r14d, r14d
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x40], r14b
lea rcx, [rbp - 0x58]
call fcn.140008f70
mov r15d, dword [rbp + 0x218]
mov eax, dword [rbp + 0x214]
mov ecx, dword [rbp + 0x224]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
mov r9, rdi
mov r8, rbx
mov rdx, r12
lea rcx, [rbp + 0x128]
call fcn.140033fe0
jmp 0x14003564f
mov r8d, 0x4d0
lea rcx, [rbp + 0x430]
call fcn.14004a2e0
mov dword [rbp + 0x460], 0x100001
lea rdx, [rbp + 0x430]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x1400356be
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
inc r14d
cmp r14d, 2
jl 0x1400351c0
xor r14d, r14d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
test r15, r15
je 0x140035d8f
mov qword [rbp + 0x108], r14
mov r8, r14
mov qword [rbp + 0x118], r14
mov r9d, 7
mov qword [rbp + 0x120], r9
mov word [rbp + 0x108], r14w
or r13d, 2
mov dword [rbp - 0x78], r13d
mov rax, qword [r12]
cmp rax, qword [r12 + 8]
je 0x140035b05
mov rdx, qword [rax + 0x18]
cmp r15, rdx
jb 0x1400356b6
mov ecx, dword [rax + 0x20]
add rcx, rdx
cmp r15, rcx
jbe 0x140035ad2
add rax, 0x438
jmp 0x140035693
mov r8, qword [rbp + 0x528]
lea rdx, str.0x_016llX
lea rcx, [rbp + 0x900]
call fcn.14003c2e0
mov dword [rbp - 0x48], 6
xor r14d, r14d
mov qword [rbp + 0xe0], r14
mov qword [rbp + 0xf0], r14
mov qword [rbp + reloc.WS2_32.dll_ntohs8], 0xf
mov byte [rbp + 0xe0], r14b
lea rax, [rbp + 0x900]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r14b
jne 0x140035710
lea rdx, [rbp + 0x900]
lea rcx, [rbp + 0xe0]
call fcn.140006ac0
nop
lea rcx, [rbp - 0x48]
call fcn.140008f70
mov dword [rbp - 0x48], 1
mov ecx, 0x20
call fcn.140047d0c
mov qword [rax], r14
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x40], rax
lea rcx, [rbp + 0xe0]
cmp rax, rcx
je 0x14003578d
lea rdx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 0x10
cmovae rdx, qword [rbp + 0xe0]
mov r8, qword [rbp + 0xf0]
mov rcx, rax
call fcn.140006ac0
nop
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0x10
jb 0x1400357cf
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400357c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140036102
call fcn.1400477f0
nop
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x40], 0
mov r8d, 6
lea rdx, str.ip_hex
lea rcx, [rsp + 0x40]
call fcn.140006ac0
nop
lea rax, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 0x10
cmovae rax, qword [rbp + 0xc0]
mov qword [rbp + 0xd0], r14
mov byte [rax], 0
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0xb0]
call fcn.140007ea0
mov r15, qword [rbp + 0xb0]
mov r14, qword [rsp + 0x78]
cmp byte [r14 + 0x19], 0
jne 0x14003585b
lea r8, [r14 + 0x20]
lea rdx, [rsp + 0x40]
call fcn.140007f60
test al, al
je 0x14003585e
mov r14, r15
cmp r14, r15
je 0x140035881
mov r14, qword [r14 + 0x40]
test r14, r14
je 0x140035881
mov rcx, r14
call fcn.1400080e0
mov edx, 0x10
mov rcx, r14
call fcn.1400477f0
mov ecx, 0x10
call fcn.140047d0c
mov qword [rbp + 0x60], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rdx, [rbp - 0x48]
mov rcx, rax
call fcn.14000b360
mov r14, rax
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0xb0]
call fcn.14000c600
mov qword [rax], r14
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x1400358f5
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400358f0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140036108
call fcn.1400477f0
xor r14d, r14d
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x40], r14b
lea rcx, [rbp - 0x48]
call fcn.140008f70
mov dword [rbp - 0x38], 6
lea rcx, [rbp - 0x38]
call fcn.140008f70
mov dword [rbp - 0x38], r14d
mov rcx, qword [rbp + 0x528]
xorps xmm0, xmm0
test rcx, rcx
js 0x14003593e
cvtsi2sd xmm0, rcx
jmp 0x140035953
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2sd xmm0, rax
addsd xmm0, xmm0
movsd qword [rbp - 0x30], xmm0
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x40], 0
mov r8d, 2
lea rdx, [0x140093e18]
lea rcx, [rsp + 0x40]
call fcn.140006ac0
nop
lea rax, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 0x10
cmovae rax, qword [rbp + 0xc0]
mov qword [rbp + 0xd0], r14
mov byte [rax], 0
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0xb0]
call fcn.140007ea0
mov r15, qword [rbp + 0xb0]
mov r14, qword [rsp + 0x78]
cmp byte [r14 + 0x19], 0
jne 0x1400359e4
lea r8, [r14 + 0x20]
lea rdx, [rsp + 0x40]
call fcn.140007f60
test al, al
je 0x1400359e7
mov r14, r15
cmp r14, r15
je 0x140035a0a
mov r14, qword [r14 + 0x40]
test r14, r14
je 0x140035a0a
mov rcx, r14
call fcn.1400080e0
mov edx, 0x10
mov rcx, r14
call fcn.1400477f0
mov ecx, 0x10
call fcn.140047d0c
mov qword [rbp + 0x68], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rdx, [rbp - 0x38]
mov rcx, rax
call fcn.14000b360
mov r14, rax
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0xb0]
call fcn.14000c600
mov qword [rax], r14
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x140035a7e
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140035a79
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003610e
call fcn.1400477f0
xor r14d, r14d
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x40], r14b
lea rcx, [rbp - 0x38]
call fcn.140008f70
mov r15, qword [rbp + 0x528]
mov rax, qword [rbp + 0x4d0]
mov qword [rsp + 0x38], rax
mov rax, qword [rbp + 0x4c8]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
lea rax, [rbp + 0x430]
mov qword [rsp + 0x20], rax
jmp 0x1400355e9
lea rdx, [rax + 0x30]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140035ae0
lea rcx, [rbp + 0x108]
call fcn.140002760
mov r9, qword [rbp + 0x120]
mov r8, qword [rbp + 0x118]
lea rax, [rbp + 0x108]
cmp r9, 8
jb 0x140035b1f
mov rdx, qword [rbp + 0x108]
lea r8, [rdx + r8*2]
jmp 0x140035b2a
lea r8, [rax + r8*2]
lea rdx, [rbp + 0x108]
mov qword [rbp + 0xe0], r14
mov qword [rbp + 0xf0], r14
mov qword [rbp + reloc.WS2_32.dll_ntohs8], 0xf
mov byte [rbp + 0xe0], 0
lea rcx, [rbp + 0xe0]
call fcn.14001f290
nop
mov dword [rbp - 0x28], 6
lea rcx, [rbp - 0x28]
call fcn.140008f70
mov dword [rbp - 0x28], 1
mov ecx, 0x20
call fcn.140047d0c
mov qword [rax], r14
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x20], rax
lea rcx, [rbp + 0xe0]
cmp rax, rcx
je 0x140035bbe
lea rdx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 0x10
cmovae rdx, qword [rbp + 0xe0]
mov r8, qword [rbp + 0xf0]
mov rcx, rax
call fcn.140006ac0
nop
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x40], 0
mov r8d, 9
lea rdx, str.ip_module
lea rcx, [rsp + 0x40]
call fcn.140006ac0
nop
lea rax, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 0x10
cmovae rax, qword [rbp + 0xc0]
mov qword [rbp + 0xd0], r14
mov byte [rax], 0
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0xb0]
call fcn.140007ea0
mov r15, qword [rbp + 0xb0]
mov r14, qword [rsp + 0x78]
cmp byte [r14 + 0x19], 0
jne 0x140035c4a
lea r8, [r14 + 0x20]
lea rdx, [rsp + 0x40]
call fcn.140007f60
test al, al
je 0x140035c4d
mov r14, r15
cmp r14, r15
je 0x140035c70
mov r14, qword [r14 + 0x40]
test r14, r14
je 0x140035c70
mov rcx, r14
call fcn.1400080e0
mov edx, 0x10
mov rcx, r14
call fcn.1400477f0
mov ecx, 0x10
call fcn.140047d0c
mov qword [rbp + 0x70], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rdx, [rbp - 0x28]
mov rcx, rax
call fcn.14000b360
mov r14, rax
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0xb0]
call fcn.14000c600
mov qword [rax], r14
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x140035ce4
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140035cdf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140036114
call fcn.1400477f0
xor r14d, r14d
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x40], r14b
lea rcx, [rbp - 0x28]
call fcn.140008f70
nop
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0x10
jb 0x140035d45
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140035d40
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003611a
call fcn.1400477f0
and r13d, 0xfffffffd
mov rdx, qword [rbp + 0x120]
cmp rdx, 8
jb 0x140035d8f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x108]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140035d8a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140036120
call fcn.1400477f0
mov r15, qword [rbp - 0x70]
test rbx, rbx
je 0x140035da1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x18], 6
lea rdx, [rbp + 0x128]
lea rcx, [rbp + 0x18]
call fcn.1400080f0
nop
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x40], 0
mov r8d, 9
lea rdx, str.callstack
lea rcx, [rsp + 0x40]
call fcn.140006ac0
nop
lea rax, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 0x10
cmovae rax, qword [rbp + 0xc0]
mov qword [rbp + 0xd0], r14
mov byte [rax], 0
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0xb0]
call fcn.140007ea0
mov r14, qword [rbp + 0xb0]
mov rbx, qword [rsp + 0x78]
cmp byte [rbx + 0x19], 0
jne 0x140035e44
lea r8, [rbx + 0x20]
lea rdx, [rsp + 0x40]
call fcn.140007f60
test al, al
je 0x140035e47
mov rbx, r14
cmp rbx, r14
je 0x140035e6a
mov rbx, qword [rbx + 0x40]
test rbx, rbx
je 0x140035e6a
mov rcx, rbx
call fcn.1400080e0
mov edx, 0x10
mov rcx, rbx
call fcn.1400477f0
mov ecx, 0x10
call fcn.140047d0c
mov qword [rbp + 0x80], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rdx, [rbp + 0x18]
mov rcx, rax
call fcn.14000b360
mov rbx, rax
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0xb0]
call fcn.14000c600
mov qword [rax], rbx
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x140035ee1
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140035edc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140036126
call fcn.1400477f0
xor r14d, r14d
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x40], r14b
lea rcx, [rbp + 0x18]
call fcn.140008f70
mov dword [rbp + 0x28], 6
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x28]
call fcn.140008170
nop
lea ecx, [r14 + 0x10]
call fcn.140047d0c
mov qword [rbp + 0x78], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rdx, [rbp + 0x28]
mov rcx, rax
call fcn.14000b360
nop
mov qword [rbp - 0x78], rax
mov rdx, qword [r15 + 8]
cmp rdx, qword [r15 + 0x10]
je 0x140035f50
mov qword [rdx], rax
add qword [r15 + 8], 8
jmp 0x140035f5d
lea r8, [rbp - 0x78]
mov rcx, r15
call fcn.14000f860
nop
lea rcx, [rbp + 0x28]
call fcn.140008f70
nop
lea rcx, [rbp + 0x128]
call fcn.14000b270
mov rcx, qword [rbp + 0x128]
test rcx, rcx
je 0x140035fd1
mov rax, qword [rbp + 0x138]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140035fba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003612c
call fcn.1400477f0
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x128], xmm0
mov qword [rbp + 0x138], r14
lea rcx, [rbp + 0xb0]
call fcn.14000b010
mov rdx, qword [rbp + 0xd8]
cmp rdx, 0x10
jb 0x14003601e
inc rdx
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140036019
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400360c6
call fcn.1400477f0
mov qword [rbp + 0xd0], r14
mov qword [rbp + 0xd8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xc0], 0
mov r8, qword [rbp + 0xb0]
mov r8, qword [r8 + 8]
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0xb0]
call fcn.14000f950
mov edx, 0x48
mov rcx, qword [rbp + 0xb0]
call fcn.1400477f0
mov ebx, dword [rsp + 0x60]
test rdi, rdi
je 0x140036078
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp + 0x90]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
jmp 0x140034987
cmp rsi, 0xffffffffffffffff
je 0x14003609c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x918]
xor rcx, rsp
call fcn.1400477d0
mov rbx, qword [rsp + 0xa78]
add rsp, 0xa20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14004e14c
nop
call fcn.14004e14c
nop
call fcn.14004e14c
nop
call fcn.14004e14c
nop
call fcn.14004e14c
nop
call fcn.14004e14c
nop
call fcn.14004e14c
nop
call fcn.14004e14c
nop
call fcn.14004e14c
nop
call fcn.14004e14c
nop
call fcn.14004e14c
nop
call fcn.14004e14c
nop
call fcn.14004e14c
nop
call fcn.14004e14c
nop
call fcn.14004e14c
nop
call fcn.14004e14c
nop
call fcn.14004e14c
nop
call fcn.14004e14c
int3