Function at 0x1401d4c10
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xa0
mov eax, dword [0x140454e50]
xor r12d, r12d
xor r15d, r15d
mov dword [rbp + 0x77], r12d
xor esi, esi
mov r14, rdx
mov rdi, rcx
cmp eax, 0xffffffff
jne 0x1401d4d35
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
je 0x1401d4ced
lea rdx, str.NtOpenFile
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtClose
mov rcx, rbx
mov qword [0x14045bb38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtSetEaFile
mov rcx, rbx
mov qword [0x14045bb20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtQueryEaFile
mov rcx, rbx
mov qword [0x14045bb30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtQueryInformationFile
mov rcx, rbx
mov qword [0x14045bb40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlInitUnicodeString
mov rcx, rbx
mov qword [0x14045bb48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14045bb28], rax
jmp 0x1401d4cf4
mov rax, qword [0x14045bb28]
cmp qword [0x14045bb38], rsi
je 0x1401d4d2d
cmp qword [0x14045bb20], rsi
je 0x1401d4d2d
cmp qword [0x14045bb30], rsi
je 0x1401d4d2d
cmp qword [0x14045bb40], rsi
je 0x1401d4d2d
cmp qword [0x14045bb48], rsi
je 0x1401d4d2d
test rax, rax
je 0x1401d4d2d
mov eax, 1
jmp 0x1401d4d2f
xor eax, eax
mov dword [0x140454e50], eax
test eax, eax
je 0x1401d5010
mov rbx, 0xffffffffffffffff
mov qword [rsp + 0xe0], r13
mov rcx, rbx
nop
inc rcx
cmp byte [rdi + rcx], sil
jne 0x1401d4d50
add rcx, 5
mov edx, 1
call fcn.140032b90
mov r13, rax
nop word [rax + rax]
cmp byte [r14 + rbx + 1], sil
lea rbx, [rbx + 1]
jne 0x1401d4d70
lea rcx, [rbx + 5]
mov edx, 1
call fcn.140032b90
mov rbx, rax
test r13, r13
je 0x1401d4fb0
test rax, rax
je 0x1401d4f9f
mov eax, dword [0x1403c93b0]
lea rcx, [r13 - 1]
mov dword [r13], eax
movzx eax, byte [0x1403c93b4]
mov byte [r13 + 4], al
nop word [rax + rax]
cmp byte [rcx + 1], sil
lea rcx, [rcx + 1]
jne 0x1401d4dc0
xor edx, edx
nop dword [rax]
movzx eax, byte [rdi + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x1401d4dd0
mov eax, dword [0x1403c93b0]
lea rcx, [rbx - 1]
mov dword [rbx], eax
movzx eax, byte [0x1403c93b4]
mov byte [rbx + 4], al
cmp byte [rcx + 1], sil
lea rcx, [rcx + 1]
jne 0x1401d4df5
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r14 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x1401d4e10
xor edx, edx
mov rcx, r13
call fcn.140321ad0
xor edx, edx
mov rcx, rbx
mov r12, rax
call fcn.140321ad0
mov r15, rax
test r12, r12
je 0x1401d4f9f
test rax, rax
je 0x1401d4f9f
mov rdx, r12
lea rcx, [rbp - 0x19]
call qword [0x14045bb28]
xor edi, edi
mov dword [rsp + 0x28], 0x40
lea rax, [rbp - 0x19]
mov dword [rbp - 9], 0x30
xorps xmm0, xmm0
mov qword [rbp - 1], rdi
lea r9, [rbp - 0x29]
mov dword [rbp + 0xf], edi
lea edx, [rdi + 8]
mov qword [rbp + 7], rax
lea r8, [rbp - 9]
mov dword [rsp + 0x20], edi
lea rcx, [rbp + 0x7f]
movdqu xmmword [rbp + 0x17], xmm0
call qword [0x14045bb38]
test eax, eax
jne 0x1401d4f9f
mov rcx, qword [rbp + 0x7f]
lea r9d, [rdi + 4]
lea r8, [rbp + 0x77]
mov dword [rsp + 0x20], 7
lea rdx, [rbp - 0x29]
call qword [0x14045bb48]
mov eax, dword [rbp + 0x77]
test eax, eax
je 0x1401d4f1f
mov ecx, eax
lea edx, [rdi + 1]
call fcn.140032b90
mov rsi, rax
test rax, rax
je 0x1401d4f1f
mov r9d, dword [rbp + 0x77]
lea rdx, [rbp - 0x29]
mov rcx, qword [rbp + 0x7f]
mov r8, rax
mov byte [rsp + 0x40], 1
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rdi
mov byte [rsp + 0x20], dil
call qword [0x14045bb40]
test eax, eax
je 0x1401d4f1f
cmp dword [0x14045b3f8], edi
jne 0x1401d4f1a
mov rcx, rsi
call fcn.140005660
mov rsi, rdi
jmp 0x1401d4f95
mov rcx, qword [rbp + 0x7f]
call qword [0x14045bb20]
test rsi, rsi
je 0x1401d4f9f
mov rdx, r15
lea rcx, [rbp - 0x19]
call qword [0x14045bb28]
lea rax, [rbp - 0x19]
mov dword [rsp + 0x28], 0x40
xorps xmm0, xmm0
mov qword [rbp + 7], rax
lea r9, [rbp - 0x29]
mov dword [rbp - 9], 0x30
lea r8, [rbp - 9]
mov qword [rbp - 1], rdi
mov edx, reloc.WSOCK32.dll_recv
mov dword [rbp + 0xf], edi
lea rcx, [rbp + 0x7f]
mov dword [rsp + 0x20], edi
movdqu xmmword [rbp + 0x17], xmm0
call qword [0x14045bb38]
test eax, eax
jne 0x1401d4f9f
mov r9d, dword [rbp + 0x77]
lea rdx, [rbp - 0x29]
mov rcx, qword [rbp + 0x7f]
mov r8, rsi
call qword [0x14045bb30]
mov rcx, qword [rbp + 0x7f]
call qword [0x14045bb20]
cmp dword [0x14045b3f8], 0
jne 0x1401d4fb0
mov rcx, r13
call fcn.140005660
mov r13, qword [rsp + 0xe0]
test rbx, rbx
je 0x1401d4fce
cmp dword [0x14045b3f8], 0
jne 0x1401d4fce
mov rcx, rbx
call fcn.140005660
test r12, r12
je 0x1401d4fe4
cmp dword [0x14045b3f8], 0
jne 0x1401d4fe4
mov rcx, r12
call fcn.140005660
test r15, r15
je 0x1401d4ffa
cmp dword [0x14045b3f8], 0
jne 0x1401d4ffa
mov rcx, r15
call fcn.140005660
test rsi, rsi
je 0x1401d5010
cmp dword [0x14045b3f8], 0
jne 0x1401d5010
mov rcx, rsi
call fcn.140005660
add rsp, 0xa0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret