Function at 0x180070694
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x1800b7160]
xor rax, rsp
mov qword [rbp + 0x80], rax
test byte [0x1800b78f1], 4
lea r15, [rdx + 0xa]
mov rsi, r9
mov qword [rbp - 0x70], r9
mov r13, r8
mov qword [rsp + 0x60], rdx
mov rbx, rdx
jne 0x1800706ea
xor eax, eax
jmp 0x180071cce
movzx ecx, word [rdx + 8]
call qword [sym.imp.WS2_32.dll_ntohs]
nop dword [rax + rax]
movzx ecx, word [rbx]
movzx r14d, ax
mov word [rsp + 0x70], r14w
call qword [sym.imp.WS2_32.dll_ntohs]
nop dword [rax + rax]
lea r12, [r15 + r14]
mov word [rsp + 0x74], ax
movzx edi, ax
mov qword [rbp - 0x80], r12
mov cl, byte [0x1800b78f1]
test cl, 4
je 0x18007074e
mov qword [rsp + 0x30], r12
mov r9, r13
mov qword [rsp + 0x28], r15
mov r8, rbx
mov qword [rsp + 0x20], rsi
call fcn.18008ff6c
mov cl, byte [0x1800b78f1]
xor r14d, r14d
test cl, 4
je 0x1800707c9
movzx ecx, di
call fcn.18007b7ec
mov ecx, dword [rbx + 4]
lea rsi, str.UNKNOWN
movzx edi, word [rsp + 0x70]
test rax, rax
cmovne rsi, rax
call qword [sym.imp.WS2_32.dll_ntohl]
nop dword [rax + rax]
mov r9, qword [rsp + 0x60]
mov ebx, eax
movzx ecx, word [r9 + 2]
call qword [sym.imp.WS2_32.dll_ntohs]
nop dword [rax + rax]
movzx r9d, word [rsp + 0x74]
mov r8, rsi
movzx ecx, ax
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ecx
call fcn.18008ffd8
mov cl, byte [0x1800b78f1]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rbp - 0x70]
movzx edi, word [rsp + 0x74]
mov edx, 0x29
cmp word [rsp + 0x70], r14w
jne 0x1800707f8
cmp di, dx
je 0x1800707f8
test cl, 4
je 0x180071cc6
lea ecx, [rdx - 4]
lea rdx, [0x18009f390]
call fcn.180087008
jmp 0x180071cc6
movzx eax, word [rsp + 0x70]
movzx ecx, di
mov dword [rsp + 0x78], eax
call fcn.18007b2c4
mov edx, dword [rsp + 0x78]
cmp edx, eax
jae 0x180070825
test byte [0x1800b78f1], 4
je 0x180071cc6
mov ecx, 0x26
jmp 0x1800707e7
cmp rsi, r12
jae 0x18007085d
test byte [0x1800b78f1], 4
je 0x180071cc6
mov ecx, 0x27
mov qword [rsp + 0x28], r12
mov r9, r13
mov qword [rsp + 0x20], rsi
mov r8, rbx
lea rdx, [0x18009f390]
call fcn.18008e984
jmp 0x180071cc6
movzx r8d, di
mov eax, 0xf9
cmp r8d, eax
ja 0x1800718bd
je 0x1800716a4
cmp r8d, 0x15
ja 0x180070bd1
je 0x180070b9a
mov ebx, 1
cmp r8d, 0xd
ja 0x180070a98
je 0x180070ad2
cmp r8d, ebx
je 0x180070a72
jbe 0x1800718dd
cmp r8d, 5
jbe 0x1800708df
cmp r8d, 6
je 0x18007098e
jbe 0x1800718dd
cmp r8d, 9
jbe 0x1800708df
cmp r8d, 0xa
je 0x18007095b
cmp r8d, 0xb
je 0x1800708f4
cmp r8d, 0xc
jne 0x1800718dd
mov rdx, r15
xor ecx, ecx
mov r9, r12
mov r8, r13
call fcn.1800705d0
jmp 0x180071cc6
test byte [0x1800b78f1], 4
je 0x180070916
movzx r9d, byte [r15 + 4]
lea rdx, [0x18009f390]
mov ecx, 0x30
mov r8, r15
call fcn.18008d0e8
movzx edi, word [rsp + 0x70]
add rdi, 0xfffffffffffffffb
je 0x180071cc6
mov rax, r14
test byte [0x1800b78f1], 4
je 0x18007094b
movzx r9d, byte [rax + r15 + 5]
lea rdx, [0x18009f390]
mov ecx, 0x31
mov r8d, r14d
call fcn.180087020
add r14d, ebx
mov eax, r14d
cmp rax, rdi
jb 0x180070928
jmp 0x180071cc6
test byte [0x1800b78f1], 4
je 0x180071cc6
mov qword [rsp + 0x60], r15
test r15, r15
jne 0x18007097a
mov word [rsp + 0x68], r14w
jmp 0x180070984
movzx eax, word [rsp + 0x70]
mov word [rsp + 0x68], ax
mov ecx, 0x32
jmp 0x180071caa
mov r9, r12
lea rcx, str.PrimaryServer:
mov r8, r13
mov rdx, r15
call fcn.1800705d0
movsxd rcx, eax
mov r9, r12
add r15, rcx
mov r8, r13
mov rdx, r15
lea rcx, str.Administrator:
call fcn.1800705d0
movsxd rcx, eax
add r15, rcx
lea rax, [r15 + 0x14]
cmp rax, r12
jbe 0x1800709e4
test byte [0x1800b78f1], 4
je 0x180071cc6
mov ecx, 0x2b
jmp 0x1800707e7
test byte [0x1800b78f1], 4
je 0x180071cc6
mov ecx, dword [r15 + 0x10]
call qword [sym.imp.WS2_32.dll_ntohl]
nop dword [rax + rax]
mov ecx, dword [r15 + 0xc]
mov r14d, eax
call qword [sym.imp.WS2_32.dll_ntohl]
nop dword [rax + rax]
mov ecx, dword [r15 + 8]
mov esi, eax
call qword [sym.imp.WS2_32.dll_ntohl]
nop dword [rax + rax]
mov ecx, dword [r15 + 4]
mov edi, eax
call qword [sym.imp.WS2_32.dll_ntohl]
nop dword [rax + rax]
mov ecx, dword [r15]
mov ebx, eax
call qword [sym.imp.WS2_32.dll_ntohl]
nop dword [rax + rax]
mov dword [rsp + 0x30], r14d
lea rdx, [0x18009f390]
mov r8d, eax
mov dword [rsp + 0x28], esi
mov ecx, 0x2c
mov dword [rsp + 0x20], edi
mov r9d, ebx
call fcn.18008bf24
jmp 0x180071cc6
test byte [0x1800b78f1], 4
je 0x180071cc6
mov ecx, 0x28
lea rdx, [0x18009f390]
mov r8, r15
call fcn.18008cefc
jmp 0x180071cc6
cmp r8d, 0xe
je 0x180070b78
cmp r8d, 0xf
je 0x180070b9a
cmp r8d, 0x10
je 0x180070ad2
cmp r8d, 0x11
je 0x180070b78
cmp r8d, 0x12
je 0x180070b9a
lea eax, [r8 - 0x13]
cmp eax, ebx
ja 0x1800718dd
cmp r15, r12
ja 0x180070b61
lea rdi, [0x18009f094]
movzx eax, byte [r15]
add r15, rbx
lea rsi, [r15 + rax]
cmp rsi, r12
ja 0x180070b3e
test byte [0x1800b78f1], 4
je 0x180070b39
mov qword [rsp + 0x60], r15
test r15, r15
je 0x180070b10
test al, al
je 0x180070b10
mov word [rsp + 0x68], ax
jmp 0x180070b1a
mov word [rsp + 0x68], bx
mov qword [rsp + 0x60], rdi
movaps xmm0, xmmword [rsp + 0x60]
lea r8, [rbp - 0x80]
mov ecx, 0x2e
movdqa xmmword [rbp - 0x80], xmm0
lea rdx, [0x18009f390]
call fcn.18008f600
mov r15, rsi
jmp 0x180070ae2
test byte [0x1800b78f1], 4
je 0x180070b58
mov ecx, 0x2d
lea rdx, [0x18009f390]
call fcn.180087008
cmp r15, r12
je 0x180071cc6
test byte [0x1800b78f1], 4
je 0x180071cc6
mov ecx, 0x2f
jmp 0x1800707e7
mov r9, r12
mov r8, r13
mov rdx, r15
xor ecx, ecx
call fcn.1800705d0
movsxd rdx, eax
lea rcx, [0x18009f094]
add rdx, r15
jmp 0x1800708e4
test byte [0x1800b78f1], 4
je 0x180070bc8
movzx ecx, word [r15]
call qword [sym.imp.WS2_32.dll_ntohs]
nop dword [rax + rax]
movzx r8d, ax
mov ecx, 0x2a
lea rdx, [0x18009f390]
call fcn.1800876bc
lea rdx, [r15 + 2]
jmp 0x1800708e2
cmp r8d, 0x2b
ja 0x180070f22
je 0x180070ded
mov ecx, r8d
sub ecx, 0x18
je 0x1800714f2
sub ecx, 1
je 0x1800712df
sub ecx, 3
je 0x180070dc7
sub ecx, 2
je 0x180070d16
sub ecx, 3
je 0x180070ca9
sub ecx, 6
je 0x1800708df
cmp ecx, 2
jne 0x1800718dd
movzx ecx, byte [rbx + 5]
or r15d, 0xffffffff
movzx r12d, byte [rbx + 4]
test r13, r13
je 0x180070c47
movzx r15d, byte [r13 + 3]
mov eax, r12d
and r15d, 0xf
shl eax, 4
add r15d, eax
test byte [0x1800b78f1], 4
je 0x180071cc6
test byte [rbx + 6], 0x80
lea rdi, [0x18009f094]
mov r9, qword [rsp + 0x60]
lea rsi, [0x1800a3b10]
movzx ebx, word [rbx + 6]
cmove rsi, rdi
mov edi, ecx
movzx ecx, word [r9 + 2]
call qword [sym.imp.WS2_32.dll_ntohs]
nop dword [rax + rax]
mov qword [rsp + 0x38], rsi
mov r9d, r12d
mov dword [rsp + 0x30], ebx
movzx r8d, ax
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], r15d
call fcn.18008f944
jmp 0x180071cc6
test byte [0x1800b78f1], 4
je 0x180070d06
movzx ecx, word [r15 + 4]
call qword [sym.imp.WS2_32.dll_ntohs]
nop dword [rax + rax]
movzx ecx, word [r15 + 2]
movzx edi, ax
call qword [sym.imp.WS2_32.dll_ntohs]
nop dword [rax + rax]
movzx ecx, word [r15]
movzx ebx, ax
call qword [sym.imp.WS2_32.dll_ntohs]
nop dword [rax + rax]
mov ecx, 0x33
mov dword [rsp + 0x20], edi
movzx r8d, ax
lea rdx, [0x18009f390]
mov r9d, ebx
call fcn.180087cfc
lea rdx, [r15 + 6]
lea rcx, str.Target_host
jmp 0x1800708e4
mov r9, r12
lea rcx, str.NXT_next_name_
mov r8, r13
mov rdx, r15
call fcn.1800705d0
movsxd rcx, eax
add r15, rcx
sub r12d, r15d
mov qword [rbp - 0x80], r12
test byte [0x1800b78f1], 4
je 0x180070d52
mov ecx, 0x51
lea rdx, [0x18009f390]
call fcn.180087008
mov edi, r14d
test r12d, r12d
jle 0x180071cc6
mov ebx, 1
test edi, edi
movsxd r13, edi
mov esi, r14d
sete sil
movsx eax, byte [r15 + r13]
bt eax, esi
jae 0x180070db0
movzx ecx, di
shl cx, 3
add cx, si
call fcn.18007b7ec
test rax, rax
lea r8, str.UNKNOWN
cmovne r8, rax
test byte [0x1800b78f1], 4
je 0x180070db0
mov ecx, 0x52
lea rdx, [0x18009f390]
call fcn.180087e84
add esi, ebx
cmp esi, 8
jl 0x180070d6f
mov r12, qword [rbp - 0x80]
add edi, ebx
cmp edi, r12d
jl 0x180070d63
jmp 0x180071cc6
test byte [0x1800b78f1], 4
je 0x180071cc6
mov ecx, 0x29
lea rdx, [0x18009f390]
mov r8, r15
call fcn.18008f644
jmp 0x180071cc6
movzx ecx, word [r15]
call qword [sym.imp.WS2_32.dll_ntohs]
nop dword [rax + rax]
add r15, 2
mov ebx, 1
movzx esi, ax
movzx edi, byte [r15]
add r15, rbx
movzx r11d, byte [r15]
add r15, rbx
mov cl, byte [0x1800b78f1]
test cl, 4
je 0x180070ec2
cmp qword [str.SHA_1], r14
lea rcx, [0x180000000]
mov edx, r14d
je 0x180070e63
mov r8, r14
mov rax, r14
cmp r11d, dword [rax + rcx + 0x95270]
je 0x180070ee0
add r8, rbx
add edx, ebx
mov rax, r8
shl rax, 4
cmp qword [rax + rcx + 0x95278], r14
jne 0x180070e3f
mov r10, r14
cmp qword [str.RSAMD5], r14
mov edx, r14d
je 0x180070e97
mov r8, r14
mov rax, r14
cmp edi, dword [rax + rcx + 0x95150]
je 0x180070ef3
add r8, rbx
add edx, ebx
mov rax, r8
shl rax, 4
cmp qword [rax + rcx + 0x95158], r14
jne 0x180070e78
mov r9, r14
mov dword [rsp + 0x30], r11d
lea rdx, [0x18009f390]
mov qword [rsp + 0x28], r10
mov r8d, esi
mov ecx, 0x60
mov dword [rsp + 0x20], edi
call fcn.18008fcbc
mov cl, byte [0x1800b78f1]
sub r12d, r15d
test cl, 4
je 0x180071cc6
mov qword [rsp + 0x60], r15
test r15, r15
jne 0x180070f03
mov word [rsp + 0x68], r14w
jmp 0x180070f18
movsxd rax, edx
add rax, rax
mov r10, qword [rcx + rax*8 + 0x95278]
jmp 0x180070e66
movsxd rax, edx
add rax, rax
mov r9, qword [rcx + rax*8 + 0x95158]
jmp 0x180070e9a
mov eax, 0xffff
mov word [rsp + 0x68], ax
cmp r12d, eax
ja 0x180070f18
mov word [rsp + 0x68], r12w
mov ecx, 0x61
jmp 0x180071caa
mov ecx, r8d
sub ecx, 0x2e
je 0x1800714f2
mov ebx, 1
sub ecx, ebx
je 0x180071264
sub ecx, ebx
je 0x1800712df
sub ecx, ebx
je 0x1800712ac
sub ecx, ebx
je 0x18007105b
cmp ecx, ebx
jne 0x1800718dd
movzx edi, byte [r15]
add r15, rbx
movzx esi, byte [r15]
add r15, rbx
movzx ecx, word [r15]
call qword [sym.imp.WS2_32.dll_ntohs]
nop dword [rax + rax]
movzx r10d, ax
add r15, 2
mov cl, byte [0x1800b78f1]
test cl, 4
je 0x180070fea
cmp qword [str.SHA_1], r14
mov edx, r14d
je 0x180070fc4
mov r8, r14
lea rcx, [0x180000000]
mov rax, r14
cmp edi, dword [rax + rcx + 0x952b0]
je 0x180071008
add r8, rbx
add edx, ebx
mov rax, r8
shl rax, 4
cmp qword [rax + rcx + 0x952b8], r14
jne 0x180070fa5
mov r8, r14
mov dword [rsp + 0x28], r10d
lea rdx, [0x18009f390]
mov r9d, edi
mov dword [rsp + 0x20], esi
mov ecx, 0x53
call fcn.180090240
mov cl, byte [0x1800b78f1]
movzx eax, byte [r15]
add r15, rbx
test al, al
jne 0x180071018
test cl, 4
je 0x180071cc6
mov ecx, 0x54
jmp 0x1800707e7
movsxd rax, edx
add rax, rax
mov r8, qword [rcx + rax*8 + 0x952b8]
jmp 0x180070fc7
mov edi, eax
test al, al
je 0x180071cc6
cmp r15, r12
ja 0x180071cc6
test cl, 4
je 0x18007104b
movzx r8d, byte [r15]
lea rdx, [0x18009f390]
mov ecx, 0x55
call fcn.1800876bc
mov cl, byte [0x1800b78f1]
add r15, rbx
add r14d, ebx
cmp r14d, edi
jb 0x180071022
jmp 0x180071cc6
movzx esi, byte [r15]
add r15, rbx
mov dil, byte [r15]
add r15, rbx
mov byte [rsp + 0x50], dil
movzx ecx, word [r15]
call qword [sym.imp.WS2_32.dll_ntohs]
nop dword [rax + rax]
movzx r11d, ax
mov cl, byte [0x1800b78f1]
test cl, 4
je 0x1800710fe
test bl, dil
lea r10, str.Opt_Out
lea rdi, [0x18009f094]
mov r8d, r14d
cmove r10, rdi
cmp qword [str.SHA_1], r14
je 0x1800710da
mov rdx, r14
lea rcx, [0x180000000]
mov rax, r14
cmp esi, dword [rax + rcx + 0x952b0]
je 0x18007111a
add rdx, rbx
add r8d, ebx
mov rax, rdx
shl rax, 4
cmp qword [rax + rcx + 0x952b8], r14
jne 0x1800710ba
mov r8, r14
movzx ecx, byte [rsp + 0x50]
mov r9d, esi
mov dword [rsp + 0x30], r11d
mov qword [rsp + 0x28], r10
mov dword [rsp + 0x20], ecx
call fcn.1800902d4
mov cl, byte [0x1800b78f1]
lea rdi, [r15 + 3]
cmp rdi, r12
jbe 0x18007112a
test cl, 4
je 0x180071cc6
mov ecx, 0x57
jmp 0x1800707e7
movsxd rax, r8d
add rax, rax
mov r8, qword [rcx + rax*8 + 0x952b8]
jmp 0x1800710dd
cmp byte [r15 + 2], r14b
jne 0x18007114e
test cl, 4
je 0x18007118a
mov ecx, 0x58
lea rdx, [0x18009f390]
call fcn.180087008
mov cl, byte [0x1800b78f1]
jmp 0x18007118a
movzx r15d, byte [r15 + 2]
mov esi, r14d
test r15d, r15d
je 0x18007118a
cmp rdi, r12
ja 0x18007118a
test cl, 4
je 0x180071180
movzx r8d, byte [rdi]
lea rdx, [0x18009f390]
mov ecx, 0x59
call fcn.1800876bc
mov cl, byte [0x1800b78f1]
add rdi, rbx
add esi, ebx
cmp esi, r15d
jb 0x18007115b
lea rsi, [rdi + 1]
cmp rsi, r12
jbe 0x1800711a6
test cl, 4
je 0x180071cc6
mov ecx, 0x5a
jmp 0x1800707e7
movzx edi, byte [rdi]
lea r15, [rsi + rdi]
cmp r15, r12
jbe 0x1800711c5
test cl, 4
je 0x180071cc6
mov ecx, 0x5b
jmp 0x1800707e7
mov edx, edi
mov dword [rsp + 0x78], 0x64
lea r9, [rsp + 0x78]
mov rcx, rsi
lea r8, [rbp - 0x60]
call fcn.18007abfc
test eax, eax
je 0x180071220
cmp dword [rsp + 0x78], 0x64
jae 0x180071220
mov eax, dword [rsp + 0x78]
cmp rax, 0x64
jae 0x18007121a
mov byte [rbp + rax - 0x60], r14b
test byte [0x1800b78f1], 4
je 0x18007125f
mov ecx, 0x5c
lea r8, [rbp - 0x60]
lea rdx, [0x18009f390]
call fcn.180087e84
jmp 0x18007125f
call fcn.18002d798
int3
test byte [0x1800b78f1], 4
je 0x18007125f
mov qword [rsp + 0x60], rsi
mov word [rsp + 0x68], r14w
test rsi, rsi
je 0x18007123e
mov word [rsp + 0x68], di
movaps xmm0, xmmword [rsp + 0x60]
lea r8, [rsp + 0x60]
mov ecx, 0x5d
movdqa xmmword [rsp + 0x60], xmm0
lea rdx, [0x18009f390]
call fcn.18008f600
movzx edi, word [rsp + 0x74]
mov eax, 0x2f
cmp di, ax
jne 0x180071289
mov r9, r12
lea rcx, str.Next_domain_name_
mov r8, r13
mov rdx, r15
call fcn.1800705d0
movsxd rcx, eax
add r15, rcx
test byte [0x1800b78f1], 4
je 0x1800714e4
mov ecx, 0x5e
lea rdx, [0x18009f390]
call fcn.180087008
jmp 0x1800714e4
test byte [0x1800b78f1], 4
je 0x180071cc6
mov qword [rsp + 0x60], r15
test r15, r15
jne 0x1800712cb
mov word [rsp + 0x68], r14w
jmp 0x1800712d5
movzx eax, word [rsp + 0x70]
mov word [rsp + 0x68], ax
mov ecx, 0x4e
jmp 0x180071caa
movzx ecx, word [r15]
lea r13d, [rdx - 4]
call qword [sym.imp.WS2_32.dll_ntohs]
nop dword [rax + rax]
add r15, 2
mov ebx, 1
movzx edi, ax
movzx r10d, byte [r15]
add r15, rbx
movzx r9d, byte [r15]
add r15, rbx
mov cl, byte [0x1800b78f1]
test cl, 4
je 0x180071cc6
cmp qword [str.RSAMD5], r14
lea rcx, [0x180000000]
mov edx, r14d
je 0x180071359
mov r8, r14
mov rax, r14
cmp r9d, dword [rax + rcx + 0x95150]
je 0x1800713ee
add r8, rbx
add edx, ebx
mov rax, r8
shl rax, 4
cmp qword [rax + rcx + 0x95158], r14
jne 0x180071335
mov qword [rsp + 0x60], r14
cmp qword [str.NONE], r14
mov edx, r14d
je 0x180071394
mov r8, r14
mov rax, r14
cmp r10d, dword [rax + rcx + 0x950f0]
je 0x180071406
add r8, rbx
add edx, ebx
mov rax, r8
shl rax, 4
cmp qword [rax + rcx + 0x950f8], r14
jne 0x180071370
mov r12, r14
mov esi, edi
lea rcx, [rbp - 0x60]
mov r8d, esi
mov ebx, r9d
mov edi, r10d
call fcn.18007af18
mov dword [rsp + 0x38], ebx
mov r9, rax
mov rax, qword [rsp + 0x60]
mov r8d, esi
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], r12
call fcn.18008ee8c
mov cl, byte [0x1800b78f1]
test cl, 4
je 0x180071cc6
mov qword [rsp + 0x60], r15
test r15, r15
jne 0x180071416
mov word [rsp + 0x68], r14w
jmp 0x18007142b
movsxd rax, edx
add rax, rax
mov rax, qword [rcx + rax*8 + 0x95158]
mov qword [rsp + 0x60], rax
jmp 0x18007135e
movsxd rax, edx
add rax, rax
mov r12, qword [rcx + rax*8 + 0x950f8]
jmp 0x180071397
mov eax, 0xffff
mov word [rsp + 0x68], ax
cmp r13d, eax
ja 0x18007142b
mov word [rsp + 0x68], r13w
mov ecx, 0x4d
jmp 0x180071caa
lea rax, [r15 + 3]
cmp rax, r12
ja 0x180071cc6
mov al, byte [r15]
add r15, rbx
mov byte [rsp + 0x50], al
movzx ecx, byte [r15]
add r15, rbx
lea rax, [r15 + rcx]
cmp rax, r12
ja 0x180071cc6
mov dword [rsp + 0x74], ecx
mov esi, r14d
test cl, cl
je 0x1800714e4
movzx r12d, byte [rsp + 0x50]
movzx eax, byte [r15]
mov edi, r14d
mov edx, eax
mov dword [rsp + 0x78], eax
add r15, rbx
mov eax, 0x80
mov ecx, edi
sar eax, cl
test edx, eax
je 0x1800714d1
movzx ecx, r12w
shl cx, 5
add cx, si
shl cx, 3
add cx, di
call fcn.18007b7ec
test rax, rax
lea r8, str.UNKNOWN
cmovne r8, rax
test byte [0x1800b78f1], 4
je 0x1800714cd
mov ecx, 0x5f
lea rdx, [0x18009f390]
call fcn.180087e84
mov edx, dword [rsp + 0x78]
add edi, ebx
cmp edi, 7
jle 0x180071481
add esi, ebx
cmp esi, dword [rsp + 0x74]
jl 0x180071471
mov r12, qword [rbp - 0x80]
cmp r15, r12
jbe 0x180071435
jmp 0x180071cc6
movzx ecx, word [r15]
call qword [sym.imp.WS2_32.dll_ntohs]
nop dword [rax + rax]
add r15, 2
mov ebx, 1
mov word [rsp + 0x78], ax
movzx edi, byte [r15]
add r15, rbx
mov byte [rsp + 0x74], dil
mov al, byte [r15]
add r15, rbx
mov byte [rsp + 0x50], al
mov ecx, dword [r15]
call qword [sym.imp.WS2_32.dll_ntohl]
nop dword [rax + rax]
mov ecx, dword [r15 + 4]
mov dword [rsp + 0x60], eax
call qword [sym.imp.WS2_32.dll_ntohl]
nop dword [rax + rax]
mov ecx, dword [r15 + 8]
mov dword [rbp - 0x80], eax
call qword [sym.imp.WS2_32.dll_ntohl]
nop dword [rax + rax]
movzx ecx, word [r15 + 0xc]
mov dword [rbp - 0x70], eax
call qword [sym.imp.WS2_32.dll_ntohs]
nop dword [rax + rax]
movzx r11d, ax
add r15, 0xe
test byte [0x1800b78f1], 4
je 0x180071635
cmp qword [str.RSAMD5], r14
mov r8d, r14d
je 0x1800715c2
mov r9, r14
lea rcx, [0x180000000]
mov rdx, r14
cmp edi, dword [rdx + rcx + 0x95150]
je 0x180071672
add r9, rbx
add r8d, ebx
mov rdx, r9
shl rdx, 4
cmp qword [rdx + rcx + 0x95158], r14
jne 0x18007159e
mov rsi, r14
movzx ecx, word [rsp + 0x78]
call fcn.18007b7ec
test rax, rax
lea rcx, str.UNKNOWN
lea rdx, [rbp - 0x60]
mov edi, r11d
cmovne rcx, rax
mov qword [rsp + 0x78], rcx
mov ecx, dword [rbp - 0x70]
call fcn.18007b6f8
mov ecx, dword [rbp - 0x80]
lea rdx, [rbp + 0x10]
mov rbx, rax
call fcn.18007b6f8
movzx ecx, byte [rsp + 0x50]
mov r9, rsi
movzx edx, byte [rsp + 0x74]
mov r8, qword [rsp + 0x78]
mov dword [rsp + 0x48], edi
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], edx
call fcn.180090cb0
mov r9, r12
lea rcx, str.Signers_name_
mov r8, r13
mov rdx, r15
call fcn.1800705d0
movsxd rcx, eax
add r15, rcx
sub r12d, r15d
test byte [0x1800b78f1], 4
je 0x180071cc6
mov qword [rsp + 0x60], r15
test r15, r15
jne 0x180071685
mov word [rsp + 0x68], r14w
jmp 0x18007169a
movsxd rax, r8d
add rax, rax
mov rsi, qword [rcx + rax*8 + 0x95158]
jmp 0x1800715c5
mov eax, 0xffff
mov word [rsp + 0x68], ax
cmp r12d, eax
ja 0x18007169a
mov word [rsp + 0x68], r12w
mov ecx, 0x50
jmp 0x180071caa
mov r9, r12
lea rcx, str.Algorithm:
mov r8, r13
mov rdx, r15
call fcn.1800705d0
mov ebx, eax
test ax, ax
jne 0x1800716dc
mov dl, byte [0x1800b78f1]
test dl, 4
je 0x1800716e2
mov ecx, 0x35
lea rdx, [0x18009f390]
call fcn.180087008
mov dl, byte [0x1800b78f1]
movzx eax, bx
add r15, rax
lea rax, [r15 + 0xe]
cmp rax, r12
jbe 0x180071704
test dl, 4
je 0x180071cc6
mov ecx, 0x36
jmp 0x1800707e7
movzx eax, byte [r15 + 1]
mov r13d, pe_nt_image_headers64
movzx r8d, byte [r15]
movzx r9d, byte [r15 + 4]
movzx ebx, byte [r15 + 0xc]
movzx edi, byte [r15 + 8]
movzx esi, byte [r15 + 9]
movzx r11d, byte [r15 + 0xa]
shl r8d, 8
or r8d, eax
shl r9d, 8
movzx eax, byte [r15 + 2]
shl r8d, 8
or r8d, eax
movzx eax, byte [r15 + 3]
shl r8d, 8
or r8d, eax
movzx eax, byte [r15 + 5]
or r9d, eax
movzx eax, byte [r15 + 6]
shl r9d, 8
or r9d, eax
movzx eax, byte [r15 + 7]
shl r9d, 8
or r9d, eax
mov al, byte [r15 + 0xb]
mov byte [rsp + 0x74], al
movzx eax, r13w
imul ebx, eax
movzx eax, byte [r15 + 0xd]
add bx, ax
add r15, 0xe
test dl, 4
je 0x1800717cb
movzx eax, byte [rsp + 0x74]
mov edx, edi
shl edx, 8
mov ecx, 0x37
add edx, esi
shl r11d, 8
movzx r10d, bx
add r11d, eax
mov dword [rsp + 0x30], r10d
mov dword [rsp + 0x28], r11d
mov dword [rsp + 0x20], edx
lea rdx, [0x18009f390]
call fcn.18008bf24
mov dl, byte [0x1800b78f1]
movzx esi, bx
add rsi, r15
cmp rsi, r12
jbe 0x1800717e9
test dl, 4
je 0x180071cc6
mov ecx, 0x38
jmp 0x1800707e7
test dl, 4
je 0x18007182a
mov qword [rsp + 0x60], r15
mov word [rsp + 0x68], r14w
test r15, r15
je 0x180071803
mov word [rsp + 0x68], bx
movaps xmm0, xmmword [rsp + 0x60]
lea r8, [rsp + 0x60]
mov ecx, 0x39
movdqa xmmword [rsp + 0x60], xmm0
lea rdx, [0x18009f390]
call fcn.18008f600
mov dl, byte [0x1800b78f1]
lea rdi, [rsi + 2]
cmp rdi, r12
jbe 0x180071846
test dl, 4
je 0x180071cc6
mov ecx, 0x3a
jmp 0x1800707e7
movzx ebx, byte [rsi]
movzx eax, byte [rsi + 1]
movzx ecx, r13w
imul ebx, ecx
add bx, ax
test dl, 4
je 0x180071877
movzx r8d, bx
lea rdx, [0x18009f390]
mov ecx, 0x3b
call fcn.1800876bc
mov dl, byte [0x1800b78f1]
movzx eax, bx
add rax, rdi
cmp rax, r12
jbe 0x180071895
test dl, 4
je 0x180071cc6
mov ecx, 0x3c
jmp 0x1800707e7
test dl, 4
je 0x180071cc6
mov qword [rsp + 0x60], rdi
mov word [rsp + 0x68], r14w
test rdi, rdi
je 0x1800718b3
mov word [rsp + 0x68], bx
mov ecx, 0x3d
jmp 0x180071caa
mov ecx, r8d
sub ecx, 0xfa
je 0x180071ac2
sub ecx, 0xfe07
je 0x1800719a5
cmp ecx, 1
je 0x180071932
mov al, byte [0x1800b78f1]
test al, 4
je 0x180071cc6
mov r9, qword [rsp + 0x60]
lea rdx, [0x18009f390]
mov ecx, 0x62
call fcn.1800883c8
mov al, byte [0x1800b78f1]
mov edx, dword [rsp + 0x78]
test al, 4
je 0x180071cc6
mov qword [rsp + 0x60], r15
mov word [rsp + 0x68], r14w
test r15, r15
je 0x180071928
mov word [rsp + 0x68], dx
mov ecx, 0x63
jmp 0x180071caa
mov ecx, dword [r15]
call qword [sym.imp.WS2_32.dll_ntohl]
nop dword [rax + rax]
mov ecx, dword [r15 + 4]
mov ebx, eax
call qword [sym.imp.WS2_32.dll_ntohl]
nop dword [rax + rax]
mov ecx, dword [r15 + 8]
mov edi, eax
call qword [sym.imp.WS2_32.dll_ntohl]
nop dword [rax + rax]
mov r9d, ebx
lea rcx, [rbp - 0x60]
mov esi, eax
call fcn.180081dbc
test byte [0x1800b78f1], 4
je 0x180071995
mov ecx, 0x4b
mov dword [rsp + 0x28], esi
mov r9d, ebx
mov dword [rsp + 0x20], edi
lea r8, [rbp - 0x60]
call fcn.18009007c
lea rdx, [r15 + 0xc]
lea rcx, str.Result_domain__
jmp 0x1800708e4
mov ecx, dword [r15]
call qword [sym.imp.WS2_32.dll_ntohl]
nop dword [rax + rax]
mov ecx, dword [r15 + 4]
mov dword [rsp + 0x78], eax
call qword [sym.imp.WS2_32.dll_ntohl]
nop dword [rax + rax]
mov ecx, dword [r15 + 8]
mov dword [rbp - 0x80], eax
call qword [sym.imp.WS2_32.dll_ntohl]
nop dword [rax + rax]
mov ecx, dword [r15 + 0xc]
mov dword [rsp + 0x60], eax
call qword [sym.imp.WS2_32.dll_ntohl]
nop dword [rax + rax]
mov r9d, dword [rsp + 0x78]
lea rcx, [rbp - 0x60]
add r15, 0x10
mov edi, eax
call fcn.180081dbc
mov dl, byte [0x1800b78f1]
test dl, 4
je 0x180071a36
mov eax, dword [rsp + 0x60]
lea r8, [rbp - 0x60]
mov r9d, dword [rsp + 0x78]
mov ecx, 0x47
mov dword [rsp + 0x28], eax
mov eax, dword [rbp - 0x80]
mov dword [rsp + 0x20], eax
call fcn.18009007c
mov dl, byte [0x1800b78f1]
mov eax, edi
shl eax, 2
add rax, r15
cmp rax, r12
jbe 0x180071a6f
test dl, 4
je 0x180071cc6
mov qword [rsp + 0x38], rax
mov r9, rsi
mov dword [rsp + 0x30], edi
mov r8, r13
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rbx
call fcn.18008fee8
jmp 0x180071cc6
test dl, 4
je 0x180071a8e
mov ecx, 0x49
lea rdx, [0x18009f390]
mov r8d, edi
call fcn.1800876bc
mov dl, byte [0x1800b78f1]
test edi, edi
je 0x180071cc6
mov ebx, 1
test dl, 4
je 0x180071ab1
mov r9, r15
mov r8d, r14d
call fcn.18008fa0c
mov dl, byte [0x1800b78f1]
add r15, 4
add r14d, ebx
cmp r14d, edi
jb 0x180071a9b
jmp 0x180071cc6
mov r9, r12
lea rcx, str.Algorithm:
mov r8, r13
mov rdx, r15
call fcn.1800705d0
mov ebx, eax
test ax, ax
jne 0x180071afa
mov dl, byte [0x1800b78f1]
test dl, 4
je 0x180071b00
mov ecx, 0x3e
lea rdx, [0x18009f390]
call fcn.180087008
mov dl, byte [0x1800b78f1]
movzx eax, bx
add r15, rax
lea rax, [r15 + 0xa]
cmp rax, r12
jbe 0x180071b22
test dl, 4
je 0x180071cc6
mov ecx, 0x3f
jmp 0x1800707e7
movzx eax, byte [r15 + 1]
mov r13d, pe_nt_image_headers64
movzx r8d, byte [r15]
movzx edi, byte [r15 + 8]
movzx r9d, byte [r15 + 6]
movzx r10d, byte [r15 + 7]
shl r8, 8
or r8, rax
movzx eax, byte [r15 + 2]
shl r8, 8
or r8, rax
movzx eax, byte [r15 + 3]
shl r8, 8
or r8, rax
movzx eax, byte [r15 + 4]
shl r8, 8
or r8, rax
movzx eax, byte [r15 + 5]
shl r8, 8
or r8, rax
movzx eax, r13w
imul edi, eax
movzx eax, byte [r15 + 9]
add di, ax
add r15, 0xa
movzx ecx, di
test dl, 4
je 0x180071ba8
shl r9d, 8
add r9d, r10d
mov dword [rsp + 0x20], ecx
call fcn.18008f194
mov dl, byte [0x1800b78f1]
movzx ebx, di
add rbx, r15
cmp rbx, r12
jbe 0x180071bc6
test dl, 4
je 0x180071cc6
mov ecx, 0x41
jmp 0x1800707e7
test dl, 4
je 0x180071c07
mov qword [rsp + 0x60], r15
mov word [rsp + 0x68], r14w
test r15, r15
je 0x180071be0
mov word [rsp + 0x68], di
movaps xmm0, xmmword [rsp + 0x60]
lea r8, [rsp + 0x60]
mov ecx, 0x42
movdqa xmmword [rsp + 0x60], xmm0
lea rdx, [0x18009f390]
call fcn.18008f600
mov dl, byte [0x1800b78f1]
lea rax, [rbx + 6]
cmp rax, r12
jbe 0x180071c23
test dl, 4
je 0x180071cc6
mov ecx, 0x43
jmp 0x1800707e7
movzx edi, byte [rbx + 4]
movzx eax, byte [rbx + 5]
movzx r8d, byte [rbx]
movzx r10d, byte [rbx + 1]
movzx r9d, byte [rbx + 2]
movzx r11d, byte [rbx + 3]
movzx ecx, r13w
imul edi, ecx
add di, ax
add rbx, 6
movzx ecx, di
test dl, 4
je 0x180071c71
shl r9d, 8
shl r8d, 8
add r9d, r11d
add r8d, r10d
mov dword [rsp + 0x20], ecx
call fcn.18008ee38
mov dl, byte [0x1800b78f1]
movzx eax, di
add rax, rbx
cmp rax, r12
jbe 0x180071c8b
test dl, 4
je 0x180071cc6
mov ecx, 0x45
jmp 0x1800707e7
test dl, 4
je 0x180071cc6
mov qword [rsp + 0x60], rbx
mov word [rsp + 0x68], r14w
test rbx, rbx
je 0x180071ca5
mov word [rsp + 0x68], di
mov ecx, 0x46
movaps xmm0, xmmword [rsp + 0x60]
lea r8, [rsp + 0x60]
lea rdx, [0x18009f390]
movdqa xmmword [rsp + 0x60], xmm0
call fcn.18008f600
movzx eax, word [rsp + 0x70]
add eax, 0xa
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.18002d5c0
mov rbx, qword [rsp + 0x1d0]
add rsp, 0x190
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret