Function at 0x1401544f0
Capabilities:
Create process on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x4290
call fcn.14037c5f0
sub rsp, rax
lea rdi, [rsp + 0x60]
mov ecx, 0x108c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x42a0]
mov rax, qword [0x140575740]
xor rax, rsp
mov qword [rsp + 0x4288], rax
mov qword [rsp + 0x60], 0
mov eax, dword [rsp + 0x42b8]
and eax, 0x8000
cmp eax, 0x8000
jne 0x140154566
mov dword [rsp + 0x4230], 1
jmp 0x140154571
mov dword [rsp + 0x4230], 0
mov eax, dword [rsp + 0x4230]
mov dword [rsp + 0x68], eax
cmp dword [rsp + 0x68], 0
je 0x140154595
mov eax, dword [rsp + 0x42b8]
btc eax, 0xf
mov dword [rsp + 0x42b8], eax
lea rax, [rsp + 0x80]
mov rdi, rax
xor eax, eax
mov ecx, 0x68
rep stosb byte [rdi], al
lea rax, [rsp + 0x108]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
mov qword [rsp + 0x158], 0
mov qword [rsp + 0x188], 0
mov qword [rsp + 0x1a8], 0
mov qword [rsp + 0x1b8], 0
mov dword [rsp + 0x1c0], 0
mov r8d, 0x18
xor edx, edx
lea rcx, [rsp + 0x108]
call fcn.140410c60
mov r8d, 0x68
xor edx, edx
lea rcx, [rsp + 0x80]
call fcn.140410c60
cmp dword [rsp + 0x42b8], 5
je 0x140154654
cmp dword [rsp + 0x42b8], 0
je 0x140154654
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov dword [rsp + 0x164], eax
cmp dword [rsp + 0x164], 0xffffffff
jne 0x140154654
xor eax, eax
jmp 0x1401553d9
cmp dword [rsp + 0x42b8], 0
je 0x1401547d8
cmp dword [rsp + 0x42b8], 4
je 0x1401547d8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x1b8], rax
lea r8, [rsp + 0x188]
mov edx, 2
mov rcx, qword [rsp + 0x1b8]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1401546c9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov r9d, 2
mov r8d, 0x216
lea rdx, [0x14055ffe0]
xor ecx, ecx
call fcn.14014da80
nop
xor eax, eax
jmp 0x1401553d9
lea rax, [rsp + 0x1a8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
mov r9d, 2
xor r8d, r8d
mov edx, 0x2000000
mov rcx, qword [rsp + 0x188]
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x140154739
mov rcx, qword [rsp + 0x188]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov r9d, 2
mov r8d, 0x217
lea rdx, [0x140560030]
xor ecx, ecx
call fcn.14014da80
nop
xor eax, eax
jmp 0x1401553d9
cmp dword [rsp + 0x42b8], 5
jne 0x140154751
mov eax, dword [rsp + 0x42c0]
mov dword [rsp + 0x164], eax
mov r9d, 4
lea r8, [rsp + 0x164]
mov edx, ntohs
mov rcx, qword [rsp + 0x1a8]
call qword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
jne 0x1401547bf
mov rcx, qword [rsp + 0x188]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x1a8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov r9d, 2
mov r8d, 0x219
lea rdx, [0x140560080]
xor ecx, ecx
call fcn.14014da80
nop
xor eax, eax
jmp 0x1401553d9
cmp dword [rsp + 0x42b8], 2
jne 0x1401547d8
lea rax, str.Winsta0Winlogon
mov qword [rsp + 0x90], rax
cmp qword [rsp + 0x42b0], 0
je 0x140154835
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x42b0]
cmp qword [rcx + rax], 0
je 0x140154835
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rsp + 0x42b0]
cmp qword [rcx + rax], 0
jne 0x140154835
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x42b0]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x158], rax
jmp 0x140154a44
cmp qword [rsp + 0x42b0], 0
je 0x140154a44
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x42b0]
cmp qword [rcx + rax], 0
je 0x140154a44
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rsp + 0x42b0]
cmp qword [rcx + rax], 0
je 0x140154a44
mov dword [rsp + 0x1c4], 0
mov dword [rsp + 0x1c8], 0
mov dword [rsp + 0x1cc], 0
movsxd rax, dword [rsp + 0x1c8]
mov rcx, qword [rsp + 0x42b0]
cmp qword [rcx + rax*8], 0
je 0x140154906
movsxd rax, dword [rsp + 0x1c8]
mov rcx, qword [rsp + 0x42b0]
mov rax, qword [rcx + rax*8]
mov qword [rsp + 0x4238], rax
mov eax, dword [rsp + 0x1c8]
inc eax
mov dword [rsp + 0x1c8], eax
mov edx, 0x10000
mov rcx, qword [rsp + 0x4238]
call fcn.1401539a0
mov ecx, dword [rsp + 0x1cc]
lea eax, [rcx + rax + 1]
mov dword [rsp + 0x1cc], eax
jmp 0x14015489d
mov eax, dword [rsp + 0x1cc]
mov ecx, dword [rsp + 0x1c8]
lea eax, [rax + rcx - 1]
mov dword [rsp + 0x1cc], eax
movsxd rax, dword [rsp + 0x1cc]
mov r9d, 0x22b
lea r8, [0x1405600f0]
mov edx, 1
mov rcx, rax
call fcn.1403ba980
mov qword [rsp + 0x158], rax
mov dword [rsp + 0x1c8], 0
mov dword [rsp + 0x1c4], 0
mov dword [rsp + 0x1c0], 1
movsxd rax, dword [rsp + 0x1c8]
mov rcx, qword [rsp + 0x42b0]
cmp qword [rcx + rax*8], 0
je 0x140154a44
cmp dword [rsp + 0x1c8], 0
jne 0x1401549a0
lea rax, [0x140577339]
mov qword [rsp + 0x4240], rax
jmp 0x1401549af
lea rax, [0x140560138]
mov qword [rsp + 0x4240], rax
movsxd rax, dword [rsp + 0x1c8]
mov ecx, dword [rsp + 0x1c4]
mov edx, dword [rsp + 0x1cc]
sub edx, ecx
mov ecx, edx
movsxd rcx, ecx
movsxd rdx, dword [rsp + 0x1c4]
mov rdi, qword [rsp + 0x158]
add rdi, rdx
mov rdx, rdi
mov qword [rsp + 0x4248], rdx
mov rdi, qword [rsp + 0x42b0]
mov rax, qword [rdi + rax*8]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x4240]
lea r8, str._s_s
mov rdx, rcx
mov rax, qword [rsp + 0x4248]
mov rcx, rax
call fcn.140015f80
mov ecx, dword [rsp + 0x1c4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x1c4], eax
mov eax, dword [rsp + 0x1c8]
inc eax
mov dword [rsp + 0x1c8], eax
jmp 0x14015496a
mov dword [rsp + 0x138], 0x18
mov dword [rsp + 0x148], 1
mov qword [rsp + 0x140], 0
mov r9d, 0x23d
lea r8, [0x140560150]
mov edx, 1
mov ecx, 0x80
call fcn.1403ba980
xor r9d, r9d
xor r8d, r8d
mov edx, 0x68
mov rcx, rax
call fcn.1401375b0
mov qword [rsp + 0x60], rax
cmp dword [rsp + 0x42b8], 4
je 0x140154adc
mov r9d, dword [rsp + 0x42d0]
xor r8d, r8d
mov edx, 0x1000
mov rcx, qword [rsp + 0x42a0]
call fcn.1401564f0
mov rcx, qword [rsp + 0x60]
mov qword [rcx + 0x38], rax
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x38]
mov rcx, qword [rsp + 0x60]
mov qword [rax + 0x40], rcx
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x42a0]
mov qword [rax + 0x10], rcx
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x10]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rax + 0x20]
mov qword [rcx + 0x60], rax
mov dword [rsp + 0x80], WSASetLastError
cmp dword [rsp + 0x42b8], 4
je 0x140154c2b
mov r9d, dword [rsp + 0x42d0]
xor r8d, r8d
mov edx, 0x1000
mov rcx, qword [rsp + 0x42a0]
call fcn.1401564f0
mov rcx, qword [rsp + 0x60]
mov qword [rcx + 0x28], rax
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x28]
mov rcx, qword [rsp + 0x60]
mov qword [rax + 0x40], rcx
mov r9d, dword [rsp + 0x42d0]
xor r8d, r8d
mov edx, 0x1000
mov rcx, qword [rsp + 0x42a0]
call fcn.1401564f0
mov rcx, qword [rsp + 0x60]
mov qword [rcx + 0x30], rax
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x30]
mov rcx, qword [rsp + 0x60]
mov qword [rax + 0x40], rcx
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x28]
add rax, 0x88
mov rcx, rax
call fcn.140156470
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x30]
add rax, 0x80
mov rcx, rax
call fcn.140156470
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x38]
add rax, 0x80
mov rcx, rax
call fcn.140156470
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x38]
mov rax, qword [rax + 0x88]
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x28]
mov rax, qword [rax + 0x80]
mov qword [rsp + 0xd0], rax
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x30]
mov rax, qword [rax + 0x88]
mov qword [rsp + 0xd8], rax
mov eax, dword [rsp + 0xbc]
bts eax, 8
mov dword [rsp + 0xbc], eax
cmp qword [rsp + 0x42c8], 0
je 0x140154fbe
mov dword [rsp + 0x4214], 0
mov rax, qword [rsp + 0x42c8]
mov qword [rsp + 0x4218], rax
cmp qword [rsp + 0x4218], 0
je 0x140154d66
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x4218]
cmp qword [rcx + rax], 0
je 0x140154d66
mov eax, 8
imul rax, rax, 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0xffffffff
mov rcx, qword [rsp + 0x4218]
mov r8, qword [rcx + rax]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [rsp + 0x4250], eax
mov ecx, 8
imul rcx, rcx, 1
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0xffffffff
mov rdx, qword [rsp + 0x4218]
mov r8, qword [rdx + rcx]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, dword [rsp + 0x4250]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4254], eax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0xffffffff
lea r8, [0x140560198]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
add eax, dword [rsp + 0x4214]
mov ecx, dword [rsp + 0x4254]
add eax, ecx
mov dword [rsp + 0x4214], eax
mov rax, qword [rsp + 0x4218]
add rax, 0x10
mov qword [rsp + 0x4218], rax
jmp 0x140154c55
mov eax, dword [rsp + 0x4214]
shl eax, 1
cdqe
mov ecx, 0xffffffff
cmp rax, rcx
jae 0x140154de5
mov eax, dword [rsp + 0x4214]
shl eax, 1
cdqe
mov ecx, 0xffffffff
sub rcx, rax
mov rax, rcx
test rax, rax
jbe 0x140154de5
mov eax, dword [rsp + 0x4214]
shl eax, 1
cdqe
mov ecx, 0xffffffe7
cmp rax, rcx
jae 0x140154de5
xor eax, eax
cmp eax, 1
je 0x140154de5
mov eax, dword [rsp + 0x4214]
shl eax, 1
cdqe
add rax, 0x18
mov r9d, 0x266
lea r8, [0x1405601a0]
mov edx, 1
mov rcx, rax
call fcn.1403ba980
mov qword [rsp + 0x4258], rax
jmp 0x140154df1
mov qword [rsp + 0x4258], 0
mov eax, dword [rsp + 0x4214]
shl eax, 1
cdqe
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x4258]
call fcn.1401375b0
mov qword [rsp + 0x4208], rax
mov dword [rsp + 0x4210], 0
mov rax, qword [rsp + 0x42c8]
mov qword [rsp + 0x4218], rax
cmp qword [rsp + 0x4218], 0
je 0x140154fae
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x4218]
cmp qword [rcx + rax], 0
je 0x140154fae
mov rax, qword [rsp + 0x4208]
mov eax, dword [rax - 0x18]
cdq
sub eax, edx
sar eax, 1
movsxd rcx, dword [rsp + 0x4210]
mov rdx, qword [rsp + 0x4208]
lea rcx, [rdx + rcx*2]
mov edx, 8
imul rdx, rdx, 0
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 0xffffffff
mov rax, qword [rsp + 0x4218]
mov r8, qword [rax + rdx]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, dword [rsp + 0x4210]
lea eax, [rcx + rax - 1]
mov dword [rsp + 0x4210], eax
mov rax, qword [rsp + 0x4208]
mov eax, dword [rax - 0x18]
cdq
sub eax, edx
sar eax, 1
sub eax, dword [rsp + 0x4210]
movsxd rcx, dword [rsp + 0x4210]
mov rdx, qword [rsp + 0x4208]
lea rcx, [rdx + rcx*2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 0xffffffff
lea r8, [0x1405601e8]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, dword [rsp + 0x4210]
lea eax, [rcx + rax - 1]
mov dword [rsp + 0x4210], eax
mov rax, qword [rsp + 0x4208]
mov eax, dword [rax - 0x18]
cdq
sub eax, edx
sar eax, 1
sub eax, dword [rsp + 0x4210]
movsxd rcx, dword [rsp + 0x4210]
mov rdx, qword [rsp + 0x4208]
lea rcx, [rdx + rcx*2]
mov edx, 8
imul rdx, rdx, 1
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 0xffffffff
mov rax, qword [rsp + 0x4218]
mov r8, qword [rax + rdx]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, dword [rsp + 0x4210]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4210], eax
mov rax, qword [rsp + 0x4218]
add rax, 0x10
mov qword [rsp + 0x4218], rax
jmp 0x140154e35
mov rax, qword [rsp + 0x4208]
mov qword [rsp + 0x42c8], rax
cmp dword [rsp + 0x42b8], 0
je 0x140154fd6
cmp dword [rsp + 0x42b8], 4
jne 0x1401550da
cmp dword [rsp + 0x68], 0
je 0x140154fea
mov dword [rsp + 0x4260], 0x208
jmp 0x140154ff5
mov dword [rsp + 0x4260], 0
cmp dword [rsp + 0x42b8], 4
jne 0x14015500c
mov dword [rsp + 0x4264], 0
jmp 0x140155017
mov dword [rsp + 0x4264], 1
mov eax, dword [rsp + 0x4260]
or eax, 0x8000400
mov dword [rsp + 0x4268], eax
mov r9d, 0x1000
lea r8, [rsp + 0x2200]
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x158]
call fcn.1401370a0
mov qword [rsp + 0x4270], rax
mov r9d, 0x1000
lea r8, [rsp + 0x1e0]
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x42a8]
call fcn.1401370a0
lea rcx, [rsp + 0x108]
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], 0
mov rcx, qword [rsp + 0x42c8]
mov qword [rsp + 0x30], rcx
mov ecx, dword [rsp + 0x4268]
mov dword [rsp + 0x28], ecx
mov ecx, dword [rsp + 0x4264]
mov dword [rsp + 0x20], ecx
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x4270]
mov rdx, rcx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1401551d5
cmp dword [rsp + 0x42b8], 0
je 0x140155292
cmp dword [rsp + 0x68], 0
je 0x1401550fc
mov dword [rsp + 0x4278], 0x208
jmp 0x140155107
mov dword [rsp + 0x4278], 0
mov eax, dword [rsp + 0x4278]
or eax, 0x8000400
mov dword [rsp + 0x427c], eax
mov r9d, 0x1000
lea r8, [rsp + 0x2200]
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x158]
call fcn.1401370a0
mov qword [rsp + 0x4280], rax
mov r9d, 0x1000
lea r8, [rsp + 0x1e0]
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x42a8]
call fcn.1401370a0
lea rcx, [rsp + 0x108]
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], 0
mov rcx, qword [rsp + 0x42c8]
mov qword [rsp + 0x38], rcx
mov ecx, dword [rsp + 0x427c]
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov rcx, qword [rsp + 0x4280]
mov r8, rcx
mov rdx, rax
mov rcx, qword [rsp + 0x1a8]
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x140155292
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x4220], eax
cmp dword [rsp + 0x42b8], 4
je 0x140155217
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x38]
call fcn.1401561c0
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x30]
call fcn.1401561c0
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x28]
call fcn.1401561c0
nop
cmp dword [rsp + 0x1c0], 0
je 0x140155234
mov edx, 1
mov rcx, qword [rsp + 0x158]
call fcn.1403ba8b0
nop
mov rcx, qword [rsp + 0x60]
call fcn.140137da0
cmp qword [rsp + 0x188], 0
je 0x140155258
mov rcx, qword [rsp + 0x188]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp qword [rsp + 0x1a8], 0
je 0x140155272
mov rcx, qword [rsp + 0x1a8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp qword [rsp + 0x42c8], 0
je 0x14015528b
mov rcx, qword [rsp + 0x42c8]
call fcn.140137da0
nop
xor eax, eax
jmp 0x1401553d9
cmp qword [rsp + 0x42c8], 0
je 0x1401552ab
mov rcx, qword [rsp + 0x42c8]
call fcn.140137da0
nop
cmp dword [rsp + 0x1c0], 0
je 0x1401552c8
mov edx, 1
mov rcx, qword [rsp + 0x158]
call fcn.1403ba8b0
nop
cmp dword [rsp + 0x42b8], 4
je 0x140155350
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x30]
mov rcx, qword [rax + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x30]
mov qword [rax + 0x88], 0
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x38]
mov rcx, qword [rax + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x38]
mov qword [rax + 0x88], 0
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x28]
mov rcx, qword [rax + 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x28]
mov qword [rax + 0x80], 0
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x108]
mov qword [rax + 0x50], rcx
cmp qword [rsp + 0x110], 0
je 0x14015537b
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rax, qword [rsp + 0x60]
mov ecx, dword [rsp + 0x118]
mov dword [rax + 0x18], ecx
cmp qword [rsp + 0x188], 0
je 0x1401553af
mov rcx, qword [rsp + 0x188]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x188], 0
cmp qword [rsp + 0x1a8], 0
je 0x1401553d4
mov rcx, qword [rsp + 0x1a8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x1a8], 0
mov rax, qword [rsp + 0x60]
mov rdi, rax
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_htonl
call fcn.14037c300
mov rax, rdi
mov rcx, qword [rsp + 0x4288]
xor rcx, rsp
call fcn.14037c650
add rsp, 0x4290
pop rdi
ret