Function at 0x1400397e0
Capabilities:
Get remote cert context via schannel
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x1d8
movaps xmmword [rsp + 0x1c0], xmm7
movaps xmmword [rsp + 0x1b0], xmm6
mov rdi, rdx
mov qword [rsp + 0x70], rcx
lea rax, [rdx + 0xe4]
mov qword [rsp + 0x160], rax
lea rax, [rdx + 8]
mov qword [rsp + 0xd8], rax
lea rax, [rdx + 0xc8]
mov qword [rsp + 0x198], rax
xorps xmm6, xmm6
movaps xmm7, xmmword [0x1400988c0]
mov qword [rsp + 0xe0], rsi
jmp 0x14003985a
cmp bpl, 4
jne 0x14003a767
movzx eax, byte [rdi + 0xe0]
test rax, rax
jne 0x14003a72f
mov r14b, byte [rdi + 0xe1]
mov bl, byte [rdi + 0xe2]
mov r13b, byte [rdi + 0xe3]
mov r15b, byte [rdi + 0xe4]
mov r8, qword [rdi + 0xb0]
mov rbp, qword [rdi + 0xb8]
cmp r8, rbp
jne 0x1400398a0
test r14b, r14b
jne 0x14003990e
jmp 0x14003991e
mov r12d, r13d
mov r13d, ebx
mov rsi, qword [rdi + 0x50]
xor ebx, ebx
nop dword [rax]
sub r8, rbp
jb 0x14003a929
mov rdx, qword [rdi + 0xa0]
add rdx, rbp
cmp r8, 0x7fffffff
mov eax, 0x7fffffff
cmovae r8d, eax
mov rcx, rsi
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_send]
cmp eax, 0xffffffff
je 0x14003a6e9
cdqe
add rbx, rax
add rbp, rax
mov qword [rdi + 0xb8], rbp
mov r8, qword [rdi + 0xb0]
cmp r8, rbp
jne 0x1400398b0
test rbx, rbx
mov ebx, r13d
mov r13d, r12d
je 0x140039898
cmp byte [rdi + 0xe0], 0
jne 0x14003991e
mov byte [rdi + 0xe1], 0
or r15b, r13b
jne 0x140039930
cmp byte [rdi + 0xfa], 0
je 0x140039e2a
mov rsi, qword [rsp + 0xe0]
test bl, bl
je 0x14003a64b
mov qword [rsp + 0xe0], rsi
cmp qword [rdi + 0x58], 0
je 0x14003997c
lea rcx, [rsp + 0xf0]
mov rdx, rdi
call fcn.14003ac00
cmp dword [rsp + 0xf0], 1
je 0x14003a789
cmp qword [rsp + 0xf8], 0
je 0x14003a79f
mov rsi, qword [rdi + 0x98]
mov rax, qword [0x140443578]
test rax, rax
jne 0x1400399a4
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x14003a92d
mov qword [0x140443578], rax
mov r8d, 0x20
mov rcx, rax
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x14003a92d
cmp rsi, qword [rdi + 0x90]
ja 0x14003a929
mov r13, rax
mov rax, qword [rdi + 0x80]
test rax, rax
mov ecx, esi
cmove rcx, rax
movabs rdx, 0x200000000
or rcx, rdx
mov qword [r13 + 8], rax
mov qword [r13], rcx
movups xmmword [r13 + 0x10], xmm6
mov qword [rsp + 0xb8], r13
movups xmmword [rsp + 0xc0], xmm7
mov rax, qword [rdi + 0xc8]
test rax, rax
cmovne rax, qword [rsp + 0x198]
je 0x140039a90
mov rdx, qword [rax]
mov r8, qword [rax + 0x10]
lea rcx, [rsp + 0x78]
call fcn.140082ca7
mov r14, qword [rsp + 0x80]
test r14, r14
je 0x140039a9c
mov esi, dword [rsp + 0x78]
movabs rax, 0x1200000000
or rsi, rax
mov rbp, qword [rsp + 0x88]
lea rcx, [rsp + 0xb8]
call fcn.14003add0
mov r13, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0xc8]
mov rax, rbx
shl rax, 4
mov qword [r13 + rax + 8], rbp
mov qword [r13 + rax], rsi
add rbx, 1
mov qword [rsp + 0xc8], rbx
jmp 0x140039aa4
mov qword [rsp + 0x80], 0
mov ebx, 2
xor r14d, r14d
mov rax, rbx
shl rax, 0x20
mov qword [rsp + 0x1a8], r13
mov qword [rsp + 0x1a0], rax
movabs rax, 0x200000000
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], 0
movups xmmword [rsp + 0x108], xmm6
movabs rax, 0x1100000000
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x118], 0
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x98], rax
movabs rax, 0x300000000
mov qword [rsp + 0x90], rax
mov dword [rsp + 0xd4], 0
cmp byte [rdi + 0xfa], 0
je 0x140039c50
cmp byte [rdi + 0xfb], 0
mov edx, 0
mov rcx, qword [rsp + 0xd8]
cmove rdx, rcx
mov rax, qword [rdi]
movups xmm0, xmmword [rax + 0x10]
movaps xmmword [rsp + 0xa0], xmm0
lea rax, [rsp + 0xd4]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x20], 0
lea rcx, [rsp + 0xa0]
lea r8, [rsp + 0x1a0]
mov r9d, 0x1011c
call sub.secur32.dll_AcceptSecurityContext
mov esi, eax
mov rcx, qword [rsp + 0x108]
test rcx, rcx
je 0x140039bbf
call sub.secur32.dll_FreeContextBuffer
mov rcx, qword [rsp + 0x118]
test rcx, rcx
je 0x140039bd1
call sub.secur32.dll_FreeContextBuffer
cmp esi, 0x80090318
je 0x140039cff
test esi, esi
je 0x140039d22
cmp esi, 0x90312
jne 0x140039d62
mov byte [rdi + 0xfb], 0
cmp rbx, 1
jbe 0x14003a929
cmp dword [r13 + 0x14], 5
mov rbp, qword [rdi + 0x98]
jne 0x140039e72
mov eax, dword [r13 + 0x10]
mov rdx, rbp
sub rdx, rax
cmp rbp, rdx
jb 0x14003a929
mov r15d, dword [rsp + 0xf0]
mov rsi, qword [rsp + 0xf8]
sub rbp, rdx
jne 0x140039e8e
jmp 0x140039f74
cmp byte [rdi + 0xf8], 0
mov rax, qword [rdi + 0x28]
mov r8d, 0
cmovne r8, rax
test rax, rax
cmove r8, rax
mov rax, qword [rdi]
movups xmm0, xmmword [rax + 0x10]
movaps xmmword [rsp + 0xa0], xmm0
lea rax, [rsp + 0xd4]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x1a0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea rcx, [rsp + 0xa0]
mov rdx, qword [rsp + 0xd8]
mov r9d, 0x9819c
call sub.secur32.dll_InitializeSecurityContextW
mov esi, eax
mov rcx, qword [rsp + 0x108]
test rcx, rcx
jne 0x140039bba
jmp 0x140039bbf
cmp rbx, 1
jbe 0x14003a929
mov eax, 1
cmp dword [r13 + 0x14], 4
jne 0x140039d19
mov eax, dword [r13 + 0x10]
mov qword [rdi + 0x58], rax
jmp 0x14003a0d0
cmp rbx, 1
jbe 0x14003a929
cmp dword [r13 + 0x14], 5
mov rbx, qword [rdi + 0x98]
mov rdx, rbx
jne 0x140039db2
mov eax, dword [r13 + 0x10]
mov rdx, rbx
sub rdx, rax
mov rbp, qword [rsp + 0xf8]
test rbp, rbp
jne 0x140039dbf
sub rbx, rdx
jae 0x140039de0
jmp 0x14003a929
mov esi, esi
shl rsi, 0x18
xor ebx, ebx
xor ebp, ebp
test r14, r14
je 0x14003a090
mov r8, qword [rsp + 0x88]
cmp r14, 0x11
jb 0x140039d87
mov r8, qword [r8 - 8]
mov rcx, qword [0x140443578]
xor edx, edx
call sub.kernel32.dll_HeapFree
movabs rax, 0xfffffffffffffff
test qword [rsp + 0xc0], rax
jne 0x14003a0a8
jmp 0x140039850
mov rbp, qword [rsp + 0xf8]
test rbp, rbp
je 0x140039d54
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x190], rax
mov qword [rsp + 0x188], rbp
sub rbx, rdx
jb 0x14003a929
je 0x140039fdc
mov rsi, qword [rdi + 0x90]
sub rsi, rdx
jb 0x14003a929
mov qword [rdi + 0x90], 0
test rdx, rdx
je 0x140039fd0
test rsi, rsi
je 0x140039fdc
mov rcx, qword [rdi + 0x80]
add rdx, rcx
mov r8, rsi
call fcn.1400931b0
jmp 0x140039fd5
mov qword [rsp + 0xf0], 0
mov rcx, qword [rsp + 0xd8]
mov edx, 0x53
lea r8, [rsp + 0xf0]
call sub.secur32.dll_QueryContextAttributesW
mov rbp, rax
shl rbp, 0x20
test eax, eax
jne 0x140039e63
mov rbp, qword [rsp + 0xf0]
je 0x140039ed2
test bl, bl
jne 0x140039948
jmp 0x14003a8e2
mov r15d, dword [rsp + 0xf0]
mov rsi, qword [rsp + 0xf8]
mov rdx, rbp
sub rbp, rdx
je 0x140039f74
mov rbx, qword [rdi + 0x90]
sub rbx, rdx
jb 0x14003a929
mov qword [rdi + 0x90], 0
test rdx, rdx
je 0x140039f68
test rbx, rbx
je 0x140039f74
mov rcx, qword [rdi + 0x80]
add rdx, rcx
mov r8, rbx
call fcn.1400931b0
jmp 0x140039f6d
mov rcx, qword [rbp + 0x20]
test rcx, rcx
je 0x14003a138
call sub.crypt32.dll_CertDuplicateStore
mov rsi, rax
cmp dword [rdi + 0x18], 1
jne 0x14003a12c
xor r15d, r15d
nop word cs:[rax + rax]
nop
mov rcx, qword [rdi + 0x20]
mov rdx, r15
call sub.crypt32.dll_CertEnumCertificatesInStore
test rax, rax
je 0x14003a12c
mov r14, rax
mov rcx, rax
call sub.crypt32.dll_CertDuplicateCertificateContext
mov r15, rax
mov qword [rsp + 0xf0], 0
mov rcx, rsi
mov rdx, r14
mov r8d, 3
lea r9, [rsp + 0xf0]
call sub.crypt32.dll_CertAddCertificateContextToStore
cmp eax, 1
jne 0x14003a89e
mov rcx, qword [rsp + 0xf0]
call sub.crypt32.dll_CertFreeCertificateContext
mov rcx, r14
call sub.crypt32.dll_CertFreeCertificateContext
jmp 0x140039f00
test rbx, rbx
je 0x140039f74
mov qword [rdi + 0x90], rbx
xor eax, eax
test rbp, rbp
sete al
mov qword [rdi + 0x98], rbp
mov qword [rdi + 0x58], rax
mov ebx, r15d
mov rax, qword [rdi + 0xa8]
mov rbp, qword [rdi + 0xb0]
sub rax, rbp
cmp rax, rbx
jb 0x14003a144
mov rcx, qword [rdi + 0xa0]
add rcx, rbp
mov rdx, rsi
mov r8, rbx
call fcn.1400931b0
add rbp, rbx
mov qword [rdi + 0xb0], rbp
mov rcx, rsi
call sub.secur32.dll_FreeContextBuffer
jmp 0x14003a0d0
test rsi, rsi
je 0x140039fdc
mov qword [rdi + 0x90], rsi
xor eax, eax
test rbx, rbx
sete al
mov qword [rdi + 0x98], rbx
mov qword [rdi + 0x58], rax
test rbp, rbp
je 0x14003a04b
mov esi, dword [rsp + 0x190]
mov rax, qword [rdi + 0xa8]
mov rbx, qword [rdi + 0xb0]
sub rax, rbx
cmp rax, rsi
jb 0x14003a579
mov rcx, qword [rdi + 0xa0]
add rcx, rbx
mov rbp, qword [rsp + 0x188]
mov rdx, rbp
mov r8, rsi
call fcn.1400931b0
add rbx, rsi
mov qword [rdi + 0xb0], rbx
mov rcx, rbp
call sub.secur32.dll_FreeContextBuffer
mov rbx, qword [rdi + 0x98]
test rbx, rbx
je 0x14003a0be
lea rcx, [rsp + 0xa0]
mov rdx, rdi
call fcn.14003a960
cmp byte [rsp + 0xa0], 1
jne 0x14003a0be
mov rbp, qword [rsp + 0xa8]
mov rsi, qword [rsp + 0xb0]
mov rbx, rsi
shr rbx, 8
shld rsi, rbp, 0x38
test r14, r14
jne 0x140039d75
nop
movabs rax, 0xfffffffffffffff
test qword [rsp + 0xc0], rax
je 0x140039850
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, r13
call sub.kernel32.dll_HeapFree
jmp 0x140039850
cmp byte [rdi + 0xe0], 0
jne 0x14003a0d0
mov byte [rdi + 0xe2], 0
nop
test r14, r14
je 0x14003a0f5
mov r8, qword [rsp + 0x88]
cmp r14, 0x11
jb 0x14003a0e7
mov r8, qword [r8 - 8]
mov rcx, qword [0x140443578]
xor edx, edx
call sub.kernel32.dll_HeapFree
movabs rax, 0xfffffffffffffff
test qword [rsp + 0xc0], rax
je 0x14003a11a
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, r13
call sub.kernel32.dll_HeapFree
mov bpl, 4
cmp bpl, 4
je 0x14003985a
jmp 0x14003a767
mov rcx, rsi
xor edx, edx
call sub.crypt32.dll_CertCloseStore
jmp 0x14003a164
cmp dword [rdi + 0x18], 1
jne 0x14003a162
mov rsi, qword [rdi + 0x20]
jmp 0x14003a164
lea rcx, [rdi + 0xa0]
mov rdx, rbp
mov r8, rbx
call fcn.1400945d0
mov rbp, qword [rdi + 0xb0]
jmp 0x140039fa4
xor esi, esi
mov byte [rsp + 0x6f], bl
movaps xmmword [rsp + 0xf0], xmm6
movaps xmmword [rsp + 0x140], xmm6
movaps xmmword [rsp + 0x130], xmm6
movaps xmmword [rsp + 0x120], xmm6
movaps xmmword [rsp + 0x110], xmm6
movaps xmmword [rsp + 0x100], xmm6
mov dword [rsp + 0xf0], 0x60
mov dword [rsp + 0xf8], 1
lea rax, [0x140443498]
mov qword [rsp + 0x90], rax
mov rax, qword [0x1404434b0]
cmp rax, 3
jne 0x14003a597
mov rax, qword [rsp + 0x90]
mov r14, qword [rax]
lea rax, [0x1404434b8]
mov qword [rsp + 0x90], rax
mov rax, qword [0x1404434d0]
cmp rax, 3
jne 0x14003a5d3
mov rax, qword [rsp + 0x90]
mov rbx, qword [rax]
lea rax, [0x1404434d8]
mov qword [rsp + 0x90], rax
mov rax, qword [0x1404434f0]
cmp rax, 3
jne 0x14003a60f
mov rax, qword [rsp + 0x90]
mov rax, qword [rax]
mov qword [rsp + 0xa0], r14
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0xb0], rax
mov dword [rsp + 0x100], 3
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x108], rax
mov qword [rsp + 0x78], 0
lea rax, [rsp + 0x78]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xc0000001
xor ecx, ecx
mov rdx, rbp
xor r8d, r8d
mov r9, rsi
call sub.crypt32.dll_CertGetCertificateChain
cmp eax, 1
jne 0x14003a8ef
mov qword [rsp + 0x158], rbp
mov rdx, qword [rsp + 0x78]
mov esi, 0xf00
cmp dword [rdi + 0x18], 1
mov r12, rdx
jne 0x14003a413
cmp dword [rdx + 0xc], 0
je 0x14003a413
mov rax, qword [rdx + 0x10]
mov r14, qword [rax]
mov rcx, rdx
call sub.crypt32.dll_CertDuplicateCertificateChain
mov rcx, r12
mov rbx, rax
cmp dword [r12 + 0xc], 2
jb 0x14003a32e
mov ebp, 1
nop word [rax + rax]
mov rax, qword [rcx + 0x10]
mov r14, qword [rax + rbp*8]
call sub.crypt32.dll_CertDuplicateCertificateChain
mov rsi, rax
mov rcx, rbx
call fcn.140092440
mov rcx, r12
mov eax, dword [r12 + 0xc]
add rbp, 1
mov rbx, rsi
cmp rbp, rax
jb 0x14003a300
jmp 0x14003a331
mov rsi, rbx
call sub.crypt32.dll_CertDuplicateCertificateChain
mov qword [rsp + 0x168], rax
mov rcx, rsi
call fcn.140092440
xor ecx, ecx
jmp 0x14003a35a
mov rcx, rbp
call sub.crypt32.dll_CertFreeCertificateContext
mov rcx, qword [rsp + 0x180]
mov eax, dword [r14 + 0xc]
mov esi, 0xf00
cmp rcx, rax
jae 0x14003a403
mov rax, qword [r14 + 0x10]
test rax, rax
je 0x14003a403
mov rax, qword [rax + rcx*8]
add rcx, 1
mov qword [rsp + 0x180], rcx
mov rcx, qword [rax + 8]
call sub.crypt32.dll_CertDuplicateCertificateContext
mov rbp, rax
xor ebx, ebx
jmp 0x14003a3a8
mov rcx, rsi
call sub.crypt32.dll_CertFreeCertificateContext
mov rcx, qword [rdi + 0x20]
mov rdx, rbx
call sub.crypt32.dll_CertEnumCertificatesInStore
test rax, rax
je 0x14003a34a
mov rsi, rax
mov rcx, rax
call sub.crypt32.dll_CertDuplicateCertificateContext
mov rbx, rax
mov r8d, dword [rsi + 0x10]
cmp r8d, dword [rbp + 0x10]
jne 0x14003a3a0
mov rcx, qword [rsi + 8]
mov rdx, qword [rbp + 8]
call fcn.140093840
mov r15d, eax
mov rcx, rsi
call sub.crypt32.dll_CertFreeCertificateContext
test r15d, r15d
jne 0x14003a3a8
mov rcx, rbx
call sub.crypt32.dll_CertFreeCertificateContext
mov rcx, rbp
call sub.crypt32.dll_CertFreeCertificateContext
mov esi, 0xf10
mov rcx, qword [rsp + 0x168]
call fcn.140092440
mov rdx, r12
lea rax, [rsp + 0x80]
movups xmmword [rax], xmm6
movabs rax, 0x200000018
mov qword [rsp + 0x78], rax
mov rax, qword [rdi + 0x28]
test rax, rax
je 0x14003a447
cmp byte [rdi + 0xf9], 0
jne 0x14003a447
mov qword [rsp + 0x88], rax
mov qword [rsp + 0xb8], 0x10
mov dword [rsp + 0xbc], esi
lea rax, [rsp + 0x78]
mov qword [rsp + 0xc0], rax
movaps xmmword [rsp + 0xa0], xmm6
mov qword [rsp + 0xb0], 0
mov dword [rsp + 0xa0], 0x18
mov ecx, 4
lea r8, [rsp + 0xb8]
lea r9, [rsp + 0xa0]
call sub.crypt32.dll_CertVerifyCertificateChainPolicy
test eax, eax
je 0x14003a901
mov eax, dword [rsp + 0xa4]
mov rsi, rax
shl rsi, 0x18
test eax, eax
cmove rsi, qword [rsp + 0xe0]
mov rbx, qword [rdi + 0x40]
test rbx, rbx
je 0x14003a51a
mov rbp, qword [rdi + 0x48]
mov rcx, qword [rbp + 0x10]
add rcx, 0xf
and rcx, 0xfffffffffffffff0
add rcx, rbx
mov rdx, qword [rsp + 0xa8]
mov qword [rsp + 0xf0], r12
mov dword [rsp + 0xf8], eax
mov qword [rsp + 0xfc], rdx
lea rdx, [rsp + 0xf0]
call qword [rbp + 0x28]
mov r14, rax
mov r15, rdx
xor eax, eax
cmp r14b, 4
je 0x14003a53b
jmp 0x14003a913
xor ecx, ecx
test eax, eax
sete cl
mov rax, rsi
shl rax, 8
lea r14, [rax + rcx*4]
mov al, 1
xor r15d, r15d
cmp r14b, 4
jne 0x14003a913
test rbx, rbx
mov rbx, qword [rsp + 0x158]
jne 0x14003a550
mov rcx, r12
call fcn.140092440
mov rcx, rbx
call sub.crypt32.dll_CertFreeCertificateContext
cmp byte [rdi + 0xe0], 0
mov bl, byte [rsp + 0x6f]
jne 0x140039938
mov rax, qword [rsp + 0x160]
mov byte [rax], 1
jmp 0x140039938
lea rcx, [rdi + 0xa0]
mov rdx, rbx
mov r8, rsi
call fcn.1400945d0
mov rbx, qword [rdi + 0xb0]
jmp 0x14003a015
lea rax, [rsp + 0x90]
mov qword [rsp + 0xb8], rax
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x78], rax
lea rcx, [0x1404434b0]
xor edx, edx
lea r8, [rsp + 0x78]
lea r9, [0x14043d320]
call fcn.140096ca7
jmp 0x14003a1ce
lea rax, [rsp + 0x90]
mov qword [rsp + 0xb8], rax
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x78], rax
lea rcx, [0x1404434d0]
xor edx, edx
lea r8, [rsp + 0x78]
lea r9, [0x14043d348]
call fcn.140096ca7
jmp 0x14003a1f9
lea rax, [rsp + 0x90]
mov qword [rsp + 0xb8], rax
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x78], rax
lea rcx, [0x1404434f0]
xor edx, edx
lea r8, [rsp + 0x78]
lea r9, [0x14043d370]
call fcn.140096ca7
jmp 0x14003a224
mov al, 2
test r13b, r13b
jne 0x14003a6b3
movaps xmmword [rsp + 0xf0], xmm6
mov dword [rsp + 0x100], 0
mov rcx, qword [rsp + 0xd8]
mov edx, 4
lea r8, [rsp + 0xf0]
call sub.secur32.dll_QueryContextAttributesW
test eax, eax
jne 0x14003a6ef
mov eax, dword [rsp + 0xf0]
mov dword [rsp + 0xec], eax
mov rax, qword [rsp + 0xfc]
mov qword [rsp + 0x170], rax
mov rax, qword [rsp + 0xf4]
mov qword [rsp + 0x178], rax
mov al, 1
mov byte [rdi + 0xe0], al
mov eax, dword [rsp + 0xec]
mov dword [rdi + 0xe4], eax
mov rax, qword [rsp + 0x178]
mov qword [rdi + 0xe8], rax
mov rax, qword [rsp + 0x170]
mov qword [rdi + 0xf0], rax
jmp 0x14003983f
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
mov rdi, qword [rsp + 0x70]
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], 0
mov eax, 1
mov dword [rdi], eax
movaps xmm6, xmmword [rsp + 0x1b0]
movaps xmm7, xmmword [rsp + 0x1c0]
add rsp, 0x1d8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
cmp eax, 1
jne 0x14003a757
mov rcx, qword [rsp + 0x160]
mov eax, dword [rcx + 0x10]
mov rdi, qword [rsp + 0x70]
mov dword [rdi + 0x18], eax
movups xmm0, xmmword [rcx]
movups xmmword [rdi + 8], xmm0
mov dword [rdi + 4], 1
jmp 0x14003a763
mov rdi, qword [rsp + 0x70]
mov dword [rdi + 4], 0
xor eax, eax
jmp 0x14003a709
movzx eax, bpl
shld rbx, rsi, 8
shl rsi, 8
or rsi, rax
mov rdi, qword [rsp + 0x70]
mov qword [rdi + 0x10], rbx
mov qword [rdi + 8], rsi
jmp 0x14003a704
movups xmm0, xmmword [rsp + 0xf8]
mov rdi, qword [rsp + 0x70]
movups xmmword [rdi + 8], xmm0
jmp 0x14003a704
mov rcx, qword [0x140443578]
test rcx, rcx
jne 0x14003a7c3
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x14003a94f
mov rcx, rax
mov qword [0x140443578], rax
mov r8d, 0x1f
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x14003a94f
mov rsi, rax
movups xmm0, xmmword [0x1403ea922]
movups xmmword [rax + 0xf], xmm0
movups xmm0, xmmword [0x1403ea913]
movups xmmword [rax], xmm0
mov rcx, qword [0x140443578]
test rcx, rcx
jne 0x14003a815
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x14003a93e
mov rcx, rax
mov qword [0x140443578], rax
mov r8d, 0x18
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x14003a93e
mov rdi, rax
mov qword [rax], rsi
movaps xmm0, xmmword [0x140098a10]
movups xmmword [rax + 8], xmm0
mov rcx, qword [0x140443578]
test rcx, rcx
jne 0x14003a860
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x14003a93e
mov rcx, rax
mov qword [0x140443578], rax
mov r8d, 0x18
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x14003a93e
mov qword [rax], rdi
lea rcx, [0x1403eab08]
mov qword [rax + 8], rcx
mov byte [rax + 0x10], 0x25
mov rdi, qword [rsp + 0x70]
mov qword [rdi + 0x10], rax
mov qword [rdi + 8], 3
jmp 0x14003a704
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
mov rcx, r14
mov r14, rax
call sub.crypt32.dll_CertFreeCertificateContext
mov rcx, r15
xor r15d, r15d
call sub.crypt32.dll_CertFreeCertificateContext
mov rcx, rsi
xor edx, edx
call sub.crypt32.dll_CertCloseStore
mov rdi, qword [rsp + 0x70]
mov rcx, rbp
call sub.crypt32.dll_CertFreeCertificateContext
mov qword [rdi + 8], r14
mov qword [rdi + 0x10], r15
jmp 0x14003a704
xor r15d, r15d
mov r14, rbp
mov rdi, qword [rsp + 0x70]
jmp 0x14003a8d5
call qword [sym.imp.kernel32.dll_GetLastError]
mov r14d, eax
shl r14, 0x20
xor r15d, r15d
jmp 0x14003a8c8
call qword [sym.imp.kernel32.dll_GetLastError]
mov r14d, eax
shl r14, 0x20
mov al, 1
xor r15d, r15d
test al, al
mov rbp, qword [rsp + 0x158]
je 0x14003a8c8
mov rcx, r12
call fcn.140092440
jmp 0x14003a8c8
ud2
mov ecx, 0x20
mov edx, 8
call fcn.1400949bf
ud2
mov ecx, 0x18
mov edx, 8
call fcn.1400949bf
ud2
mov ecx, 0x1f
mov edx, 1
call fcn.1400949bf
ud2