Function at 0x14004cbc0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call
Parse pe header
Query environment variable
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov rax, qword [0x1401da800]
xor rax, rsp
mov qword [rbp + 0x38], rax
mov byte [rsp + 0x20], r8b
mov qword [rbp - 0x38], rdx
mov qword [rbp - 0x40], rcx
xor r15d, r15d
mov esi, r15d
mov qword [rbp - 0x78], r15
mov dword [rbp - 0x10], r15d
lea r9, [rbp - 0x10]
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14004cc7a
nop word [rax + rax]
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp - 0x10]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
lea r9, [rbp - 0x10]
mov r8d, dword [rbp - 0x10]
mov rdx, rax
mov ecx, listen
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x14004cc30
mov qword [rbp - 0x78], rsi
test eax, eax
js 0x14004eec3
mov eax, r15d
mov dword [rsp + 0x30], eax
cmp dword [rsi], r15d
jbe 0x14004eec3
movzx edi, byte [rsp + 0x20]
movzx ebx, byte [rsp + 0x20]
movzx r13d, byte [rsp + 0x20]
movzx r14d, byte [rsp + 0x20]
mov qword [rsp + 0x28], r14
movzx r12d, byte [rsp + 0x20]
nop dword [rax]
nop word [rax + rax]
imul rcx, rax, 0x128
lea rax, [rcx + rsi]
mov qword [rbp - 0x48], rax
movzx eax, word [rax + 0x2e]
add rax, rcx
add rsi, rax
movzx edx, dil
lea rcx, [rbp + 0x18]
call fcn.1400029f0
nop
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rsi + r8 + 0x30], 0
jne 0x14004ccf0
lea rdx, [rsi + 0x30]
lea rcx, [rbp + 0x18]
call fcn.140004460
nop
lea rcx, [rbp + 0x18]
call fcn.140001bc0
mov rdx, qword [rbp - 0x40]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x14004eea4
mov rdx, qword [rbp - 0x48]
add rdx, 0x30
lea rcx, [rbp - 8]
call fcn.1400042d0
nop
mov dword [rsp + 0x60], 0x97959493
mov dword [rsp + 0x64], 0xa4a89ce5
mov word [rsp + 0x68], 0xa9a7
mov byte [rsp + 0x6a], reloc.WS2_32.dll_select
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x6b], xmm0
mov qword [rsp + 0x7b], rax
nop dword [rax]
nop dword [rax + rax]
mov rax, qword [0x14022e4a8]
mov r9, qword [0x14022e4a0]
nop
mov rsi, r15
cmp rsi, 0x23
jae 0x14004d88e
movzx r11d, byte [rsp + rsi + 0x60]
movzx r10d, r11b
cmp rax, rsi
ja 0x14004d885
lea rcx, [r9 + 1]
cmp rax, rcx
jae 0x14004cdcc
movabs rdx, 0x72e7f58cbbdfb45a
add rdx, rsi
mov rcx, rdx
and rcx, r11
imul r13, rcx, 0xfffffffffffffffe
add r13, rdx
add r13, r11
sub r13b, 0x76
jmp 0x14004cdf8
je 0x14004d810
inc rcx
cmp rax, rcx
je 0x14004d789
lea rcx, [r9 + 3]
cmp rax, rcx
je 0x14004d758
lea rcx, [r9 + 5]
cmp rax, rcx
je 0x14004d724
movzx r10d, r11b
nop dword [rax]
cmp r9, rsi
ja 0x14004d87c
lea rcx, [r9 + 0x41]
cmp rax, rcx
jae 0x14004ce39
movabs r8, 0x6d07248b6959cb62
add r8, rsi
movzx ecx, r8b
and cl, r11b
mov edx, reloc.WLDAP32.dll_Ordinal_41
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r10b
add r13b, r8b
jmp 0x14004ce70
lea rcx, [r9 + 1]
cmp rax, rcx
je 0x14004d6d1
inc rcx
cmp rax, rcx
je 0x14004d69e
lea rcx, [r9 + 3]
cmp rax, rcx
je 0x14004d665
lea rcx, [r9 + 7]
cmp rax, rcx
je 0x14004d63c
nop dword [rax]
lea rcx, [r9 + rax]
cmp rcx, rsi
jbe 0x14004d35b
nop dword [rax]
lea rcx, [r9 + 0x3e8]
cmp rax, rcx
je 0x14004d33a
lea rcx, [r9 + 8]
cmp rax, rcx
je 0x14004d310
lea rcx, [r9 + 0x61]
cmp rax, rcx
je 0x14004d2e9
lea rcx, [r9 + 0x10]
cmp rax, rcx
je 0x14004d2ca
lea rcx, [r9 + 0x5a]
cmp rax, rcx
je 0x14004d2ad
lea rcx, [r9 + 0x40]
cmp rax, rcx
je 0x14004d293
lea rcx, [r9 + 2]
cmp rax, rcx
je 0x14004d279
lea rcx, [r9 + 0x80]
cmp rax, rcx
je 0x14004d25f
lea rcx, [r9 + 5]
cmp rax, rcx
je 0x14004d237
lea rcx, [r9 + 0x400]
cmp rax, rcx
je 0x14004ce80
lea rax, [r9 + 0xa]
lea r9, [rax + 0x5a]
lea rcx, [r9 + 0x41]
cmp rax, rcx
jb 0x14004d85f
lea rcx, [r9 + 0x28]
cmp rax, rcx
jb 0x14004d842
lea rcx, [r9 + 1]
cmp rax, rcx
jb 0x14004d039
lea rcx, [r9 + 0x64]
cmp rax, rcx
jb 0x14004d010
lea rcx, [r9 + 0x1000]
cmp rax, rcx
jb 0x14004cfe7
lea rcx, [r9 + 0xa]
cmp rax, rcx
jb 0x14004d187
lea rax, [r9 + 5]
lea r9, [rax + 4]
lea rcx, [r9 + 0x400]
cmp rax, rcx
ja 0x14004d15f
lea rcx, [r9 + 9]
cmp rax, rcx
ja 0x14004d13e
lea rcx, [r9 + 0x7a]
cmp rax, rcx
ja 0x14004d11d
lea rcx, [r9 + 0x20]
cmp rax, rcx
ja 0x14004d0fc
lea rcx, [r9 + 0x2a]
cmp rax, rcx
ja 0x14004d0d8
lea rcx, [r9 + 0x42]
cmp rax, rcx
ja 0x14004d0b3
lea rcx, [r9 + 3]
cmp rax, rcx
ja 0x14004d08c
lea rcx, [r9 + 0x200]
cmp rax, rcx
ja 0x14004d062
lea rax, [r9 + 0x10]
lea r9, [rax + 0x2a]
jmp 0x14004ce80
movabs r8, 0x63f2536a0276ecde
add r8, rsi
movzx ecx, r8b
and cl, r11b
add cl, cl
movzx r13d, r10b
sub r13b, cl
sub r13b, 0x12
add r13b, r8b
jmp 0x14004ce70
movabs r8, 0x7e2268508ab7842a
add r8, rsi
movzx ecx, r8b
and cl, r11b
add cl, cl
movzx r13d, r10b
sub r13b, cl
sub r13b, 0x26
add r13b, r8b
jmp 0x14004ce00
movabs r8, 0x98527d3712f81b76
add r8, rsi
movzx ecx, r8b
and cl, r11b
add cl, cl
movzx r13d, r10b
sub r13b, cl
sub r13b, 0x3a
add r13b, r8b
jmp 0x14004cd97
lea r8d, [rsi + 0x5c]
movzx ecx, r11b
and cl, r8b
mov edx, 0x3e
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r11b
add r13b, r8b
inc r9
dec rsi
inc rsi
jmp 0x14004cd83
lea r8d, [rsi - 0x58]
movzx ecx, r8b
and cl, r11b
mov edx, 0x34
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r8b
add r13b, r11b
dec rsi
inc rsi
jmp 0x14004cd83
lea r8d, [rsi - 0xc]
movzx ecx, r8b
and cl, r11b
mov edx, Ordinal_45
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r8b
add r13b, r11b
movzx r10d, sil
jmp 0x14004d5fa
lea r8d, [rsi + 0x40]
movzx ecx, r8b
and cl, r11b
mov edx, reloc.WLDAP32.dll_Ordinal_32
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r8b
add r13b, r11b
add rax, r9
jmp 0x14004d685
lea r8d, [rsi - 0x74]
movzx ecx, r8b
and cl, r11b
mov edx, reloc.WLDAP32.dll_Ordinal_22
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r8b
add r13b, r11b
jmp 0x14004d685
lea r8d, [rsi - 0x28]
movzx ecx, r8b
and cl, r11b
mov edx, recv
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r8b
add r13b, r11b
jmp 0x14004d7ac
lea r8d, [rsi + 0x24]
movzx ecx, r8b
and cl, r11b
mov edx, 2
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r8b
add r13b, r11b
jmp 0x14004d7cf
lea edx, [rsi + 0x70]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r13d, [r11 + rdx]
sub r13b, 0x10
movzx ecx, byte [rsp + rsi + 0x60]
add rcx, r9
add rsi, rcx
inc rsi
jmp 0x14004cd83
lea r8d, [rsi - 0x6e]
movzx ecx, r8b
and cl, r11b
mov edx, 1
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r8b
add r13b, r11b
lea rcx, [r9 + rax]
cmp rcx, 0x1000
je 0x14004d61e
lea rcx, [r9 + 0x10]
cmp rax, rcx
jbe 0x14004d43e
lea edx, [rsi + 0x72]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r13d, [r11 + rdx]
sub r13b, 0x1e
cmp rax, 0x80
jae 0x14004d5db
lea rcx, [r9 + 0x64]
cmp rax, rcx
jbe 0x14004d4f5
lea r8d, [rsi - 0x2c]
movzx ecx, r8b
and cl, r11b
mov edx, reloc.WLDAP32.dll_Ordinal_26
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r8b
add r13b, r11b
cmp r9, 0x61
jb 0x14004d5ce
movzx r10d, sil
lea edx, [r10 - 0x24]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
add dl, r11b
lea r13d, [rdx*2 - 8]
jmp 0x14004d6fa
lea edx, [rsi + 0x4c]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r13d, [r11 + rdx]
sub r13b, 0x14
movzx ecx, byte [rsp + rsi + 0x60]
add rcx, r9
add rsi, rcx
inc rsi
jmp 0x14004cd83
lea edx, [rsi - 0x68]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r13d, [r11 + rdx]
sub r13b, 0x28
jmp 0x14004d7cf
lea edx, [rsi - 0x1c]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r13d, [r11 + rdx]
sub r13b, 0x3c
jmp 0x14004d7ac
lea edx, [rsi + 0x30]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r13d, [r11 + rdx]
sub r13b, 0x50
jmp 0x14004d685
lea edx, [rsi + 0x7c]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r13d, [r11 + rdx]
sub r13b, 0x64
add rax, r9
jmp 0x14004d685
movzx r10d, sil
lea edx, [r10 - 0x38]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r13d, [r11 + rdx]
sub r13b, 0x78
jmp 0x14004d5fa
lea r8d, [rsi + 0x14]
movzx ecx, r8b
and cl, r11b
mov edx, Ordinal_60
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r8b
add r13b, r11b
dec rsi
inc rsi
jmp 0x14004cd83
lea r8d, [rsi + 0x60]
movzx ecx, r8b
and cl, r11b
mov edx, Ordinal_50
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r8b
add r13b, r11b
inc r9
dec rsi
inc rsi
jmp 0x14004cd83
lea r8d, [rsi - 0x54]
movzx ecx, r8b
and cl, r11b
mov edx, Ordinal_41
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r8b
add r13b, r11b
jmp 0x14004d6f6
lea rdx, [r9 + 4]
cmp rax, rdx
jae 0x14004d389
movabs rdx, 0x72e7f58cbbdfb45a
add rdx, rsi
movzx ecx, dl
and cl, r11b
add cl, cl
sub r10b, cl
lea r13d, [rdx + r10]
sub r13b, 0x76
jmp 0x14004d1a3
lea rcx, [r9 + 1]
cmp rax, rcx
jne 0x14004d3ba
lea edx, [rsi - 0x3c]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r13d, [r11 + rdx]
sub r13b, 0x5c
movzx ecx, byte [rsp + rsi + 0x60]
add rcx, r9
add rsi, rcx
inc rsi
jmp 0x14004cd83
lea rcx, [r9 + 3]
cmp rax, rcx
jne 0x14004d3e0
lea edx, [rsi - 0x6c]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r13d, [r11 + rdx]
sub r13b, 0xc
add rax, r9
jmp 0x14004d685
cmp rax, rdx
jne 0x14004d40c
lea r8d, [rsi - 4]
movzx ecx, r8b
and cl, r11b
mov edx, recv
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r8b
add r13b, r11b
dec rsi
inc rsi
jmp 0x14004cd83
lea rcx, [r9 + 7]
cmp rax, rcx
jne 0x14004d1a3
movzx r10d, sil
lea r8d, [r10 + 0x64]
movzx ecx, r8b
and cl, r11b
mov edx, Ordinal_35
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r8b
add r13b, r11b
jmp 0x14004d6fa
lea rcx, [r9 + 1]
cmp rax, rcx
jne 0x14004d466
movzx r10d, sil
lea edx, [r10 + 0x26]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r13d, [r11 + rdx]
sub r13b, 0xa
jmp 0x14004d6fa
lea rcx, [r9 + 3]
cmp rax, rcx
jne 0x14004d496
lea r8d, [rsi - 0x72]
movzx ecx, r8b
and cl, r11b
mov edx, reloc.WS2_32.dll_ntohs
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r8b
add r13b, r11b
dec rsi
inc rsi
jmp 0x14004cd83
lea rcx, [r9 + 5]
cmp rax, rcx
jne 0x14004d4c0
lea r8d, [rsi - 0x56]
movzx ecx, r8b
and cl, r11b
mov edx, reloc.WLDAP32.dll_Ordinal_45
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r8b
add r13b, r11b
jmp 0x14004d685
lea rcx, [r9 + 6]
cmp rax, rcx
jne 0x14004d1d6
lea edx, [rsi - 0x3a]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r13d, [r11 + rdx]
sub r13b, 0x6a
movzx ecx, byte [rsp + rsi + 0x60]
add rcx, r9
add rsi, rcx
inc rsi
jmp 0x14004cd83
lea rdx, [r9 + 1]
cmp rax, rdx
jne 0x14004d52d
lea r8d, [rsi - 0x78]
movzx ecx, r8b
and cl, r11b
mov edx, 0x24
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r8b
add r13b, r11b
movzx ecx, byte [rsp + rsi + 0x60]
add rcx, r9
add rsi, rcx
inc rsi
jmp 0x14004cd83
lea rcx, [r9 + 3]
cmp rax, rcx
jne 0x14004d557
lea r8d, [rsi - 0x10]
movzx ecx, r8b
and cl, r11b
mov edx, gethostname
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r8b
add r13b, r11b
jmp 0x14004d7ac
lea rcx, [rdx + 1]
cmp rax, rcx
jne 0x14004d57d
lea edx, [rsi + 0x58]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r13d, [r11 + rdx]
sub r13b, 0x68
add rax, r9
jmp 0x14004d685
lea rcx, [r9 + 5]
cmp rax, rcx
jne 0x14004d5a2
movzx r10d, sil
lea edx, [r10 + 0xc]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r13d, [r11 + rdx]
sub r13b, 0x54
jmp 0x14004d5fa
lea rcx, [r9 + 9]
cmp rax, rcx
jne 0x14004d20b
movzx r10d, sil
lea edx, [r10 + 0x28]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r13d, [r11 + rdx]
sub r13b, 0x18
jmp 0x14004d6fa
mov byte [rsp + rsi + 0x60], r13b
inc rsi
jmp 0x14004cd83
movzx r10d, sil
lea r8d, [r10 - 0x70]
movzx ecx, r8b
and cl, r11b
movzx edx, r11b
sub dl, cl
add dl, 8
lea r13d, [rdx + rdx]
add r13b, r8b
sub r10b, 0x16
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
sub r10b, 0x66
add r10b, r11b
add r10b, r13b
mov byte [rsp + rsi + 0x60], r10b
add rax, r9
jmp 0x14004d685
lea r8d, [rsi + 0x44]
movzx ecx, r8b
and cl, r11b
mov edx, reloc.WS2_32.dll_select
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r8b
jmp 0x14004d7ac
movabs r8, 0xb5b6923daf95a84e
add r8, rsi
movzx ecx, r8b
and cl, r11b
add cl, cl
movzx r13d, r10b
sub r13b, cl
sub r13b, 0x22
add r13b, r8b
jmp 0x14004d7ac
movabs rdx, 0xcfe6a72437d63f9a
add rdx, rsi
movzx ecx, dl
and cl, r11b
add cl, cl
sub r10b, cl
lea r13d, [rdx + r10]
sub r13b, 0x36
movzx ecx, r13b
mov rdx, 0xffffffffffffffff
sub rdx, rcx
add rsi, rdx
inc rsi
jmp 0x14004cd83
movabs r8, 0x38a6fabe58d89cca
add r8, rsi
movzx ecx, r8b
and cl, r11b
mov edx, 0x3d
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r10b
add r13b, r8b
inc r9
dec rsi
inc rsi
jmp 0x14004cd83
movabs r8, 0x52d70fa4e1193416
add r8, rsi
movzx ecx, r8b
and cl, r11b
mov edx, 0x33
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r10b
add r13b, r8b
movzx r10d, sil
add r10b, 0x36
movzx ecx, r11b
and cl, r10b
add cl, cl
sub r11b, cl
sub r11b, 0x7a
add r11b, r10b
mov byte [rsp + rsi + 0x60], r11b
inc r9
dec rsi
inc rsi
jmp 0x14004cd83
movabs rdx, 0xa1674e5879daf9fa
add rdx, rsi
movzx ecx, dl
and cl, r11b
mov r8d, reloc.WS2_32.dll_setsockopt
sub r8b, cl
lea r13d, [r8 + r8]
add r13b, dl
add r13b, r10b
inc r9
dec rsi
inc rsi
jmp 0x14004cd83
movabs rdx, 0xbb97633f021b9146
add rdx, rsi
movzx ecx, dl
and cl, r11b
mov r8d, recv
sub r8b, cl
lea r13d, [r8 + r8]
add r13b, dl
add r13b, r10b
dec rsi
inc rsi
jmp 0x14004cd83
movabs rdx, 0x2457b6d9231dee76
add rdx, rsi
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r13d, [r10 + rdx]
sub r13b, 0x3a
movzx r11d, r10b
lea edx, [rsi - 0x62]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
sub dl, 0x52
add dl, r11b
movzx ecx, dl
mov byte [rsp + rsi + 0x60], cl
inc r9
add rcx, r9
sub rsi, rcx
lea r8d, [rsi - 8]
movzx ecx, r8b
and cl, r11b
mov edx, Ordinal_30
sub dl, cl
add dl, dl
add dl, r8b
add dl, r11b
mov byte [rsp + rsi + 0x60], dl
inc rax
mov rcx, 0xffffffffffffffff
sub rcx, rax
add rsi, rcx
movzx ecx, byte [rsp + rsi + 0x60]
add rcx, r9
add rsi, rcx
inc rsi
jmp 0x14004cd83
movabs rdx, 0x58b7e0a6339f1d0e
add rdx, rsi
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r13d, [r10 + rdx]
sub r13b, 0x62
movzx ecx, byte [rsp + rsi + 0x60]
add rcx, r9
add rsi, rcx
inc rsi
jmp 0x14004cd83
sub sil, 0x3e
movzx ecx, r11b
and cl, sil
add cl, cl
sub r11b, cl
lea r13d, [rsi + r11]
sub r13b, 0x4e
jmp 0x14004cd80
add sil, 0xe
movzx eax, r11b
and al, sil
add al, al
sub r11b, al
lea r13d, [rsi + r11]
sub r13b, 0x62
jmp 0x14004cd70
lea rcx, [rbp + 0x14d2bd8]
jmp 0x14004d893
lea rcx, [rbp + 0x6ce032]
jmp 0x14004d893
lea rcx, [rsp + 0x60]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rsi, rax
movzx edx, bl
lea rcx, [rbp - 0x30]
call fcn.1400029f0
nop
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rsi + r8], 0
jne 0x14004d8b0
mov rdx, rsi
lea rcx, [rbp - 0x30]
call fcn.140004460
nop
mov word [rbp - 0x70], 0x319c
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x6e], xmm0
movups xmmword [rbp - 0x5e], xmm0
mov byte [rbp - 0x4e], al
nop dword [rax]
mov r8, qword [0x14022e4a8]
mov r9, qword [0x14022e4a0]
nop
mov r10, r15
cmp r10, 0x23
jae 0x14004e199
movzx r11d, byte [rbp + r10 - 0x70]
mov esi, r11d
cmp r8, r10
ja 0x14004e190
lea rax, [r9 + 1]
cmp r8, rax
jae 0x14004d93b
movabs rcx, 0xb62f907c2f1efb58
add rcx, r10
mov rax, rcx
and rax, rsi
imul r14, rax, 0xfffffffffffffffe
add r14, rcx
add r14, rsi
sub r14b, 0x68
jmp 0x14004d974
je 0x14004e126
inc rax
cmp r8, rax
je 0x14004e0d6
lea rax, [r9 + 5]
cmp r8, rax
je 0x14004e09c
lea rax, [r9 + 3]
cmp r8, rax
je 0x14004e073
lea rax, [r9 + 4]
cmp r8, rax
je 0x14004e043
cmp r9, r10
ja 0x14004e182
lea rax, [r9 + 0x28]
cmp r8, rax
jae 0x14004d9a8
lea edx, [r10 + 0x38]
movzx eax, dl
and al, r11b
mov ecx, reloc.WLDAP32.dll_Ordinal_60
sub cl, al
lea r14d, [rcx + rcx]
add r14b, dl
add r14b, r11b
mov qword [rsp + 0x28], r14
jmp 0x14004d9f0
lea rax, [r9 + 1]
cmp r8, rax
je 0x14004dff7
inc rax
cmp r8, rax
je 0x14004dfcb
lea rax, [r9 + 6]
cmp r8, rax
je 0x14004dfab
lea rax, [r9 + 4]
cmp r8, rax
je 0x14004df68
mov qword [rsp + 0x28], r14
lea rax, [r9 + 3]
cmp r8, rax
je 0x14004df51
nop dword [rax]
lea rax, [r9 + r8]
cmp rax, r10
jbe 0x14004dca7
nop dword [rax]
lea rax, [r9 + 0x80]
cmp r8, rax
je 0x14004dc88
lea rax, [r9 + 0x2a]
cmp r8, rax
je 0x14004dc5f
lea rax, [r9 + 0xa]
cmp r8, rax
je 0x14004dc40
lea rax, [r9 + 0x3e8]
cmp r8, rax
je 0x14004dc21
lea rax, [r9 + 2]
cmp r8, rax
je 0x14004da00
lea r8, [r9 + 0x400]
lea r9, [r8 + 2]
lea rax, [r9 + 0x400]
cmp r8, rax
jb 0x14004e160
lea rax, [r9 + 3]
cmp r8, rax
jb 0x14004db03
lea rax, [r9 + 0x28]
cmp r8, rax
jb 0x14004dae3
lea rax, [r9 + 0x61]
cmp r8, rax
jb 0x14004dba7
lea rax, [r9 + 5]
cmp r8, rax
jb 0x14004da00
lea r8, [r9 + 0x7a]
lea r9, [r8 + 5]
lea rax, [r9 + 0x7a]
cmp r8, rax
ja 0x14004db88
lea rax, [r9 + 6]
cmp r8, rax
ja 0x14004db6d
lea rax, [r9 + 0x64]
cmp r8, rax
ja 0x14004db55
lea rax, [r9 + 0x5a]
cmp r8, rax
ja 0x14004db28
lea rax, [r9 + 9]
cmp r8, rax
ja 0x14004da00
lea r8, [r9 + 0x80]
lea r9, [r8 + 9]
jmp 0x14004da00
lea ecx, [r10 - 0x38]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r14d, [r11 + rcx]
sub r14b, 0x78
mov qword [rsp + 0x28], r14
jmp 0x14004d9f0
lea edx, [r10 + 0x68]
movzx eax, dl
and al, r11b
mov ecx, reloc.WS2_32.dll_sendto
sub cl, al
lea r14d, [rcx + rcx]
add r14b, dl
add r14b, r11b
mov qword [rsp + 0x28], r14
jmp 0x14004d906
lea edx, [r10 + 0x60]
movzx eax, dl
and al, r11b
mov ecx, Ordinal_50
sub cl, al
lea esi, [rcx + rcx]
add sil, dl
add sil, r11b
dec r10
mov qword [rsp + 0x28], rsi
mov r14, rsi
inc r10
jmp 0x14004d8f3
movzx ecx, r10b
and cl, r11b
add cl, cl
movzx esi, r10b
sub sil, cl
add sil, r11b
jmp 0x14004e0b2
lea ecx, [r10 - 0x60]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea esi, [r11 + rcx]
sub sil, 0x60
jmp 0x14004df7e
lea edx, [r10 + 0x40]
movzx eax, dl
and al, r11b
mov ecx, reloc.WLDAP32.dll_Ordinal_32
sub cl, al
lea esi, [rcx + rcx]
add sil, dl
add sil, r11b
jmp 0x14004e144
lea ecx, [r10 + 0x28]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r14d, [r11 + rcx]
sub r14b, 0x18
mov qword [rsp + 0x28], r14
cmp r8, 0x1000
jae 0x14004df00
lea rax, [r9 + 0x28]
cmp r8, rax
jbe 0x14004de4d
lea ecx, [r10 + 0x30]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r14d, [r11 + rcx]
sub r14b, 0x50
mov qword [rsp + 0x28], r14
cmp r9, 0x41
jb 0x14004def3
lea ecx, [r10 + 0x10]
movzx eax, cl
and al, r11b
mov edx, 8
sub dl, al
add dl, dl
add dl, cl
add dl, r11b
lea esi, [rdx + rdx]
jmp 0x14004e00d
lea edx, [r10 - 0x10]
movzx eax, dl
and al, r11b
mov ecx, gethostname
sub cl, al
lea esi, [rcx + rcx]
add sil, dl
add sil, r11b
jmp 0x14004df7e
lea edx, [r10 - 0x70]
movzx eax, dl
and al, r11b
mov ecx, 8
sub cl, al
lea esi, [rcx + rcx]
add sil, dl
add sil, r11b
jmp 0x14004e0b2
lea ecx, [r10 + 0x30]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea esi, [r11 + rcx]
sub sil, 0x50
dec r10
mov qword [rsp + 0x28], rsi
mov r14, rsi
inc r10
jmp 0x14004d8f3
lea edx, [r10 - 0x30]
movzx eax, dl
and al, r11b
mov ecx, Ordinal_41
sub cl, al
lea esi, [rcx + rcx]
add sil, dl
add sil, r11b
jmp 0x14004e00d
lea rax, [r9 + 0x41]
cmp r8, rax
jae 0x14004dd08
lea ecx, [r10 + 0x58]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r14d, [r11 + rcx]
sub r14b, 0x68
mov qword [rsp + 0x28], r14
lea rax, [r9 + r8]
cmp rax, 0x200
je 0x14004df3e
lea rax, [r9 + 0xa]
cmp r8, rax
jbe 0x14004dda8
lea edx, [r10 - 8]
movzx eax, dl
and al, r11b
mov ecx, Ordinal_30
sub cl, al
lea r14d, [rcx + rcx]
add r14b, dl
add r14b, r11b
jmp 0x14004dbbd
lea rax, [r9 + 1]
cmp r8, rax
jne 0x14004dd2c
lea ecx, [r10 + 0x70]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea esi, [r11 + rcx]
sub sil, 0x10
jmp 0x14004e144
lea rax, [r9 + 3]
cmp r8, rax
jne 0x14004dd58
lea ecx, [r10 + 0x80]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r14d, [r11 + rcx]
add r14b, 0x80
mov qword [rsp + 0x28], r14
jmp 0x14004e0bd
lea rax, [r9 + 4]
cmp r8, rax
jne 0x14004dd7c
lea ecx, [r10 - 0x20]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea esi, [r11 + rcx]
sub sil, 0x20
jmp 0x14004df19
lea rax, [r9 + 9]
cmp r8, rax
jne 0x14004dccb
lea edx, [r10 - 0x10]
movzx eax, dl
and al, r11b
mov ecx, gethostname
sub cl, al
lea esi, [rcx + rcx]
add sil, dl
add sil, r11b
jmp 0x14004e00d
lea rax, [r9 + 1]
cmp r8, rax
jne 0x14004ddd0
lea edx, [r10 - 0x58]
movzx eax, dl
and al, r11b
mov ecx, 0x34
sub cl, al
lea esi, [rcx + rcx]
add sil, dl
add sil, r11b
jmp 0x14004e00d
inc rax
cmp r8, rax
jne 0x14004de01
lea ecx, [r10 + 8]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea esi, [r11 + rcx]
sub sil, 0x38
dec r10
mov qword [rsp + 0x28], rsi
mov r14, rsi
inc r10
jmp 0x14004d8f3
lea rax, [r9 + 3]
cmp r8, rax
jne 0x14004de25
lea ecx, [r10 - 0x48]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea esi, [r11 + rcx]
sub sil, 8
jmp 0x14004df19
lea rax, [r9 + 5]
cmp r8, rax
jne 0x14004dbc2
lea ecx, [r10 - 0x38]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea esi, [r11 + rcx]
sub sil, 0x78
jmp 0x14004df7e
lea rax, [r9 + 1]
cmp r8, rax
jne 0x14004de71
lea ecx, [r10 - 0x20]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea esi, [r11 + rcx]
sub sil, 0x20
jmp 0x14004e144
inc rax
cmp r8, rax
jne 0x14004de98
lea edx, [r10 - 0x70]
movzx eax, dl
and al, r11b
mov ecx, 8
sub cl, al
lea esi, [rcx + rcx]
add sil, dl
add sil, r11b
jmp 0x14004e0f7
lea rax, [r9 + 4]
cmp r8, rax
jne 0x14004dec7
movzx ecx, r10b
and cl, r11b
add cl, cl
movzx esi, r10b
sub sil, cl
add sil, r11b
dec r10
mov qword [rsp + 0x28], rsi
mov r14, rsi
inc r10
jmp 0x14004d8f3
lea rax, [r9 + 3]
cmp r8, rax
jne 0x14004dbf7
lea edx, [r10 + 0x60]
movzx eax, dl
and al, r11b
mov ecx, Ordinal_50
sub cl, al
lea esi, [rcx + rcx]
add sil, dl
add sil, r11b
jmp 0x14004e00d
mov byte [rbp + r10 - 0x70], r14b
inc r10
jmp 0x14004d8f3
lea edx, [r10 - 0x40]
movzx eax, dl
and al, r11b
add al, al
sub sil, al
sub sil, 0x40
add sil, dl
add sil, r11b
lea edx, [r10 + 0x18]
movzx eax, r11b
and al, dl
mov ecx, Ordinal_45
sub cl, al
add cl, cl
add cl, r11b
add cl, sil
add cl, dl
mov byte [rbp + r10 - 0x70], cl
jmp 0x14004e0b2
lea ecx, [r10 + 0x70]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea esi, [rcx - 0x10]
jmp 0x14004df7e
lea ecx, [r10 - 0x48]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea esi, [r11 + rcx]
jmp 0x14004e0f3
lea ecx, [r10 + 8]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea esi, [r11 + rcx]
sub sil, 0x38
lea edx, [r10 - 0x38]
movzx eax, r11b
and al, dl
add al, al
movzx ecx, r11b
sub cl, al
sub cl, 0x78
add cl, dl
movzx eax, cl
mov byte [rbp + r10 - 0x70], al
inc r9
add rax, r9
sub r10, rax
jmp 0x14004e0f7
lea ecx, [r10 + 0x58]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r14d, [r11 + rcx]
sub r14b, 0x68
mov qword [rsp + 0x28], r14
jmp 0x14004e0bd
lea ecx, [r10 - 0x68]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea esi, [r11 + rcx]
sub sil, 0x28
inc r9
dec r10
mov qword [rsp + 0x28], rsi
mov r14, rsi
inc r10
jmp 0x14004d8f3
lea ecx, [r10 - 0x18]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea esi, [r11 + rcx]
sub sil, 0x58
movzx edx, r10b
add dl, 0x68
movzx eax, r11b
and al, dl
mov ecx, reloc.WS2_32.dll_sendto
sub cl, al
add cl, cl
add cl, r11b
add cl, dl
mov byte [rbp + r10 - 0x70], cl
inc r9
dec r10
mov qword [rsp + 0x28], rsi
mov r14, rsi
inc r10
jmp 0x14004d8f3
lea edx, [r10 - 0x28]
movzx eax, dl
and al, r11b
mov ecx, recv
sub cl, al
lea esi, [rcx + rcx]
add sil, dl
add sil, r11b
inc r9
dec r10
mov qword [rsp + 0x28], rsi
mov r14, rsi
inc r10
jmp 0x14004d8f3
lea ecx, [r10 + 0x28]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea esi, [r11 + rcx]
sub sil, 0x18
dec r10
mov qword [rsp + 0x28], rsi
mov r14, rsi
inc r10
jmp 0x14004d8f3
lea ecx, [r10 - 0x38]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea esi, [r11 + rcx]
sub sil, 0x78
mov qword [rsp + 0x28], rsi
add r8, r9
mov r14, rsi
movzx eax, r14b
mov rcx, 0xffffffffffffffff
sub rcx, rax
add r10, rcx
inc r10
jmp 0x14004d8f3
movabs rcx, 0x8eedd26ceb9ae8b8
add rcx, r10
and sil, cl
add sil, sil
movzx eax, r11b
sub al, sil
lea esi, [rcx + rax]
sub sil, 8
lea edx, [r10 + 0x20]
movzx eax, dl
and al, r11b
mov ecx, reloc.WS2_32.dll_recv
sub cl, al
add cl, cl
add cl, dl
add cl, r11b
mov byte [rbp + r10 - 0x70], cl
inc r8
mov rax, 0xffffffffffffffff
sub rax, r8
add r10, rax
jmp 0x14004e144
movabs rax, 0x228eb1748d5cf208
add rax, r10
and sil, al
add sil, sil
sub r11b, sil
lea esi, [rax + r11]
sub sil, 0x38
movzx eax, byte [rbp + r10 - 0x70]
add rax, r9
add r10, rax
mov qword [rsp + 0x28], rsi
mov r14, rsi
inc r10
jmp 0x14004d8f3
add r10b, 8
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea r14d, [r11 + r10]
sub r14b, 0x38
mov qword [rsp + 0x28], r14
jmp 0x14004d8e0
lea rdx, [rbp + 0x150deb0]
mov qword [rsp + 0x28], r14
jmp 0x14004e19d
lea rdx, [rbp + 0x16fda08]
jmp 0x14004e19d
lea rdx, [rbp - 0x70]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x14004e1a4
lea rcx, [rbp - 0x30]
call fcn.140003110
mov r14, rax
mov dword [rsp + 0x38], 0x142b7a00
mov dword [rsp + 0x3c], 0x711b0414
mov dword [rsp + 0x40], 0x170e1617
mov byte [rsp + 0x44], 0xb8
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x45], xmm0
mov dword [rsp + 0x55], eax
mov word [rsp + 0x59], ax
nop word [rax + rax]
mov r8, qword [0x14022e4a8]
mov r9, qword [0x14022e4a0]
nop
mov rsi, r15
cmp rsi, 0x23
jae 0x14004edb9
movzx r11d, byte [rsp + rsi + 0x38]
mov edx, r11d
cmp r8, rsi
ja 0x14004edb0
lea rax, [r9 + 1]
cmp r8, rax
jae 0x14004e24b
movabs rcx, 0xb119768de4898f46
add rcx, rsi
mov rax, rcx
and rax, rdx
imul r12, rax, 0xfffffffffffffffe
add r12, rcx
add r12, rdx
add r12b, 0x16
jmp 0x14004e284
je 0x14004ed32
inc rax
cmp r8, rax
je 0x14004ecd4
lea rax, [r9 + 3]
cmp r8, rax
je 0x14004ec85
lea rax, [r9 + 2]
cmp r8, rax
je 0x14004ec54
lea rax, [r9 + 8]
cmp r8, rax
je 0x14004ec10
movzx r10d, sil
nop dword [rax + rax]
cmp r9, rsi
ja 0x14004eda7
lea rax, [r9 + 0x41]
cmp r8, rax
jae 0x14004e2ba
lea ecx, [r10 - 0x42]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0x32
jmp 0x14004e300
lea rax, [r9 + 1]
cmp r8, rax
je 0x14004ebf8
inc rax
cmp r8, rax
je 0x14004ebd1
lea rax, [r9 + 3]
cmp r8, rax
je 0x14004eb90
lea rax, [r9 + 5]
cmp r8, rax
je 0x14004eb73
lea rax, [r9 + 4]
cmp r8, rax
je 0x14004eb53
nop word [rax + rax]
lea rax, [r9 + r8]
cmp rax, rsi
jbe 0x14004e889
nop dword [rax]
lea rax, [r9 + 8]
cmp r8, rax
je 0x14004e869
lea rax, [r9 + 0xa]
cmp r8, rax
je 0x14004e843
lea rcx, [r9 + 0x1000]
cmp r8, rcx
je 0x14004e820
lea rax, [r9 + 0x7a]
cmp r8, rax
je 0x14004e801
lea rax, [r9 + 0x5a]
cmp r8, rax
je 0x14004e7e0
lea rax, [r9 + 0x10]
cmp r8, rax
je 0x14004e7bf
lea rax, [r9 + 0x28]
cmp r8, rax
je 0x14004e79f
lea rax, [r9 + 0x41]
cmp r8, rax
je 0x14004e77f
lea rax, [r9 + 0x2a]
cmp r8, rax
je 0x14004e754
lea rax, [r9 + 2]
cmp r8, rax
je 0x14004e310
mov r8, rcx
lea r9, [rcx + 0x40]
lea rax, [r9 + 0x7a]
cmp rcx, rax
jb 0x14004ed86
lea rax, [r9 + 9]
cmp rcx, rax
jb 0x14004ed65
lea rax, [r9 + 0x10]
cmp rcx, rax
jb 0x14004e4ec
lea rax, [r9 + 0x61]
cmp rcx, rax
jb 0x14004e4d1
lea rax, [r9 + 0x41]
cmp rcx, rax
jb 0x14004e4b6
lea rax, [r9 + 0x2a]
cmp rcx, rax
jb 0x14004e6fc
lea rax, [r9 + 0x20]
cmp rcx, rax
jb 0x14004e6aa
lea rax, [r9 + 0x40]
cmp rcx, rax
jb 0x14004e668
lea rax, [r9 + 0x5a]
cmp rcx, rax
jb 0x14004e643
lea rax, [r9 + 1]
cmp rcx, rax
jb 0x14004e310
lea r8, [r9 + 0x400]
lea r9, [r8 + 3]
lea rax, [r9 + 0x61]
cmp r8, rax
ja 0x14004e614
lea rax, [r9 + 0x41]
cmp r8, rax
ja 0x14004e5f3
lea rcx, [r9 + 0xa]
cmp r8, rcx
ja 0x14004e5d3
lea rax, [r9 + 0x20]
cmp r8, rax
ja 0x14004e5b6
lea rax, [r9 + 0x40]
cmp r8, rax
ja 0x14004e599
lea rax, [r9 + 0x5a]
cmp r8, rax
ja 0x14004e57a
lea rax, [r9 + 1]
cmp r8, rax
ja 0x14004e553
lea rax, [r9 + 0x28]
cmp r8, rax
ja 0x14004e529
lea rax, [r9 + 0x42]
cmp r8, rax
ja 0x14004e509
lea rax, [r9 + 0x80]
cmp r8, rax
ja 0x14004e310
mov r8, rcx
lea r9, [rcx + 2]
jmp 0x14004e310
lea ecx, [r10 + 2]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0xe
jmp 0x14004e300
lea ecx, [r10 + 0x76]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0x3a
jmp 0x14004e290
sub r10b, 0x16
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea r12d, [r11 + r10]
sub r12b, 0x66
jmp 0x14004e216
lea edx, [r10 - 0x10]
movzx eax, r11b
and al, dl
mov ecx, gethostname
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r11b
add r12b, dl
jmp 0x14004ec2a
add r10b, 0x64
movzx eax, r11b
and al, r10b
mov ecx, Ordinal_35
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r11b
add r12b, r10b
inc r9
dec rsi
inc rsi
jmp 0x14004e203
sub r10b, 0x28
movzx eax, r11b
and al, r10b
mov ecx, recv
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r11b
add r12b, r10b
dec rsi
inc rsi
jmp 0x14004e203
lea edx, [r10 + 0x4c]
movzx eax, r11b
and al, dl
add al, al
movzx r12d, r11b
sub r12b, al
sub r12b, 0x14
add r12b, dl
jmp 0x14004ebab
sub r10b, 0x40
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r12d, [r10 + r11]
sub r12b, 0x40
jmp 0x14004ec69
add r10b, 0x34
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r12d, [r10 + r11]
sub r12b, 0x6c
jmp 0x14004ec6c
lea edx, [r10 - 0x58]
movzx eax, r11b
and al, dl
mov ecx, 0x34
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r11b
add r12b, dl
jmp 0x14004eca8
add r10b, 0x1c
movzx eax, r11b
and al, r10b
mov ecx, reloc.WLDAP32.dll_Ordinal_30
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r11b
add r12b, r10b
jmp 0x14004ecf4
sub r10b, 0x70
movzx eax, r11b
and al, r10b
mov ecx, 8
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r11b
add r12b, r10b
movzx eax, byte [rsp + rsi + 0x38]
add rax, r9
add rsi, rax
inc rsi
jmp 0x14004e203
add r10b, 0x32
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea r12d, [r11 + r10]
sub r12b, 0x5e
mov byte [rsp + rsi + 0x38], r12b
inc rsi
jmp 0x14004e203
lea edx, [r10 - 0x5a]
movzx eax, dl
and al, r11b
mov ecx, Ordinal_60
sub cl, al
lea r12d, [rcx + rcx]
add r12b, dl
add r12b, r11b
cmp r9, 6
jb 0x14004e65b
lea edx, [r10 - 0x1c]
movzx eax, r11b
and al, dl
add al, al
movzx ecx, r11b
sub cl, al
add cl, dl
lea r12d, [rcx*2 - 0x78]
jmp 0x14004ec2a
lea edx, [r10 + 0x1a]
movzx eax, dl
and al, r11b
mov ecx, Ordinal_41
sub cl, al
lea r12d, [rcx + rcx]
add r12b, dl
add r12b, r11b
cmp r8, 0x80
jae 0x14004eb17
lea rax, [r9 + 0xa]
cmp r8, rax
jbe 0x14004ea38
lea edx, [r10 + 0x6c]
movzx eax, r11b
and al, dl
mov ecx, 6
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r11b
add r12b, dl
jmp 0x14004e683
lea edx, [r10 - 0x72]
movzx eax, dl
and al, r11b
mov ecx, reloc.WS2_32.dll_ntohs
sub cl, al
lea r12d, [rcx + rcx]
add r12b, dl
add r12b, r11b
lea rax, [r9 + r8]
cmp rax, 0x200
je 0x14004eb36
lea rax, [r9 + 0x10]
cmp r8, rax
jbe 0x14004e92d
lea edx, [r10 - 0x52]
movzx eax, r11b
and al, dl
mov ecx, Ordinal_35
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r11b
add r12b, dl
jmp 0x14004e6c5
add r10b, 0x74
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r12d, [r10 + r11]
sub r12b, 0x2c
movzx eax, byte [rsp + rsi + 0x38]
add rax, r9
add rsi, rax
inc rsi
jmp 0x14004e203
sub r10b, 0x18
movzx eax, r11b
and al, r10b
add al, al
movzx r12d, r11b
sub r12b, al
sub r12b, 0x58
add r12b, r10b
jmp 0x14004ecf4
lea edx, [r10 + 0x5c]
movzx eax, r11b
and al, dl
mov ecx, 0x3e
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r11b
add r12b, dl
jmp 0x14004eca8
sub r10b, 0x30
movzx eax, r11b
and al, r10b
mov ecx, Ordinal_41
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r11b
add r12b, r10b
jmp 0x14004ec6c
add r10b, 0x44
movzx eax, r11b
and al, r10b
mov ecx, reloc.WS2_32.dll_select
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r11b
add r12b, r10b
jmp 0x14004ec69
lea edx, [r10 - 0x48]
movzx eax, r11b
and al, dl
add al, al
movzx r12d, r11b
sub r12b, al
sub r12b, 8
add r12b, dl
jmp 0x14004ebab
add r10b, 0x2c
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r12d, [r10 + r11]
sub r12b, 0x34
dec rsi
inc rsi
jmp 0x14004e203
sub r10b, 0x60
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r12d, [r10 + r11]
sub r12b, 0x60
inc r9
dec rsi
inc rsi
jmp 0x14004e203
lea edx, [r10 + 0x14]
movzx eax, r11b
and al, dl
mov ecx, Ordinal_60
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r11b
add r12b, dl
jmp 0x14004ec2a
lea rax, [r9 + 4]
cmp r8, rax
jae 0x14004e8a6
lea edx, [r10 + 0x46]
movzx eax, dl
and al, r11b
mov ecx, listen
jmp 0x14004e70b
lea rax, [r9 + 1]
cmp r8, rax
jne 0x14004e8da
add r10b, 0x7c
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea r12d, [r11 + r10]
sub r12b, 0x64
movzx eax, byte [rsp + rsi + 0x38]
add rax, r9
add rsi, rax
inc rsi
jmp 0x14004e203
inc rax
cmp r8, rax
jne 0x14004e8fd
lea ecx, [r10 - 0x6c]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0xc
jmp 0x14004eca8
lea rax, [r9 + 3]
cmp r8, rax
jne 0x14004e717
sub r10b, 0x3c
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r12d, [r10 + r11]
sub r12b, 0x5c
dec rsi
inc rsi
jmp 0x14004e203
lea rax, [r9 + 1]
cmp r8, rax
jne 0x14004e956
lea edx, [r10 + 0x3a]
movzx eax, r11b
and al, dl
mov ecx, gethostname
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r11b
add r12b, dl
jmp 0x14004ec2a
inc rax
cmp r8, rax
jne 0x14004e984
sub r10b, 0x3a
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r12d, [r10 + r11]
sub r12b, 0x6a
inc r9
dec rsi
inc rsi
jmp 0x14004e203
lea rax, [r9 + 5]
cmp r8, rax
jne 0x14004e9ae
add r10b, 0x6a
movzx eax, r11b
and al, r10b
mov ecx, reloc.WS2_32.dll_listen
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r11b
add r12b, r10b
jmp 0x14004ec69
lea rax, [r9 + 2]
cmp r8, rax
jne 0x14004e9d7
lea edx, [r10 - 0x7e]
movzx eax, r11b
and al, dl
mov ecx, reloc.WS2_32.dll_gethostname
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r11b
add r12b, dl
jmp 0x14004eca8
lea rax, [r9 + 4]
cmp r8, rax
jne 0x14004ea00
add r10b, 0xe
movzx eax, r11b
and al, r10b
add al, al
movzx r12d, r11b
sub r12b, al
sub r12b, 0x62
add r12b, r10b
jmp 0x14004ecf4
lea rax, [r9 + 6]
cmp r8, rax
jne 0x14004e6c5
sub r10b, 0x66
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r12d, [r10 + r11]
sub r12b, 0x36
movzx eax, byte [rsp + rsi + 0x38]
add rax, r9
add rsi, rax
inc rsi
jmp 0x14004e203
lea rax, [r9 + 1]
cmp r8, rax
jne 0x14004ea70
sub r10b, 8
movzx eax, r11b
and al, r10b
mov ecx, Ordinal_30
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r11b
add r12b, r10b
movzx eax, byte [rsp + rsi + 0x38]
add rax, r9
add rsi, rax
inc rsi
jmp 0x14004e203
inc rax
cmp r8, rax
jne 0x14004ea95
sub r10b, 0x64
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r12d, [r10 + r11]
sub r12b, 0x44
jmp 0x14004ec6c
lea rax, [r9 + 4]
cmp r8, rax
jne 0x14004eabb
add r10b, 0x28
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r12d, [r10 + r11]
sub r12b, 0x18
jmp 0x14004ec69
lea rax, [r9 + 3]
cmp r8, rax
jne 0x14004eaeb
add r10b, 0x40
movzx eax, r11b
and al, r10b
mov ecx, reloc.WLDAP32.dll_Ordinal_32
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r11b
add r12b, r10b
dec rsi
inc rsi
jmp 0x14004e203
lea rax, [r9 + 5]
cmp r8, rax
jne 0x14004e683
lea edx, [r10 + 0x58]
movzx eax, r11b
and al, dl
add al, al
movzx r12d, r11b
sub r12b, al
sub r12b, 0x68
add r12b, dl
jmp 0x14004ec2a
lea edx, [r10 + 0x70]
movzx eax, r11b
and al, dl
add al, al
movzx r12d, r11b
sub r12b, al
sub r12b, 0x10
add r12b, r11b
add r12b, dl
jmp 0x14004ebab
lea edx, [r10 - 4]
movzx eax, r11b
and al, dl
mov ecx, recv
sub cl, al
lea r12d, [rcx + rcx]
add r12b, dl
jmp 0x14004eca8
lea edx, [r10 - 0x6e]
movzx eax, dl
and al, r11b
mov ecx, 1
sub cl, al
lea r12d, [rcx + rcx]
add r12b, dl
add r12b, r11b
jmp 0x14004eca8
add r10b, 6
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea r12d, [r11 + r10]
sub r12b, 0x2a
jmp 0x14004ec6c
lea edx, [r10 - 0x12]
movzx eax, dl
and al, r11b
mov ecx, 0x3f
sub cl, al
lea r12d, [rcx + rcx]
add r12b, dl
add r12b, r11b
sub r10b, 0x4a
movzx eax, r10b
and al, r11b
mov ecx, 3
sub cl, al
add cl, cl
add cl, r10b
add cl, r11b
add cl, r12b
mov byte [rsp + rsi + 0x38], cl
jmp 0x14004ec69
add r10b, 0x62
movzx eax, r10b
and al, r11b
mov ecx, reloc.WLDAP32.dll_Ordinal_41
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r10b
add r12b, r11b
dec rsi
inc rsi
jmp 0x14004e203
lea ecx, [r10 + 0x4a]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 6
jmp 0x14004ec2a
movzx r10d, sil
lea ecx, [r10 + 0x32]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0x5e
add r10b, 0x2a
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
sub r10b, 0x26
add r10b, r11b
mov byte [rsp + rsi + 0x38], r10b
inc r9
dec rsi
inc rsi
jmp 0x14004e203
lea ecx, [rsi + 2]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0xe
add r8, r9
movzx eax, r12b
mov rcx, 0xffffffffffffffff
sub rcx, rax
add rsi, rcx
inc rsi
jmp 0x14004e203
movabs rcx, 0xd7b23de13fc2eaea
add rcx, rsi
and dl, cl
add dl, dl
movzx r12d, r11b
sub r12b, dl
sub r12b, 0x66
add r12b, cl
movzx r10d, sil
add r10b, 0x42
movzx eax, r11b
and al, r10b
mov ecx, Ordinal_26
sub cl, al
add cl, cl
add cl, r11b
add cl, r10b
movzx eax, cl
mov byte [rsp + rsi + 0x38], al
inc r9
add rax, r9
sub rsi, rax
jmp 0x14004ecf4
movabs rcx, 0x757f50c576afcc5e
add rcx, rsi
and dl, cl
mov eax, gethostname
sub al, dl
lea r12d, [rax + rax]
add r12b, r11b
add r12b, cl
lea edx, [rsi - 0x78]
movzx eax, r11b
and al, dl
mov ecx, 0x24
sub cl, al
add cl, cl
add cl, r11b
add cl, dl
mov byte [rsp + rsi + 0x38], cl
inc r8
mov rax, 0xffffffffffffffff
sub rax, r8
add rsi, rax
movzx eax, byte [rsp + rsi + 0x38]
add rax, r9
add rsi, rax
inc rsi
jmp 0x14004e203
movabs rcx, 0x134c63a9ad9cadd2
add rcx, rsi
and dl, cl
mov eax, reloc.WLDAP32.dll_Ordinal_33
sub al, dl
lea r12d, [rax + rax]
add r12b, r11b
add r12b, cl
movzx eax, byte [rsp + rsi + 0x38]
add rax, r9
add rsi, rax
inc rsi
jmp 0x14004e203
add r10b, 0x5e
movzx eax, r11b
and al, r10b
mov ecx, gethostname
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r11b
add r12b, r10b
jmp 0x14004e200
sub r10b, 0x2e
movzx eax, r11b
and al, r10b
mov ecx, reloc.WLDAP32.dll_Ordinal_33
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r11b
add r12b, r10b
jmp 0x14004e1f0
lea rdx, [rbp + 0x16c4240]
jmp 0x14004edbe
lea rdx, [rbp + 0x135d186]
jmp 0x14004edbe
lea rdx, [rsp + 0x38]
xor r8d, r8d
lea rcx, [rbp - 8]
call fcn.1400056b0
mov r9, r14
mov r8d, recv
mov rdx, rax
lea rcx, [rbp - 8]
call fcn.140058b50
nop
lea rcx, [rbp - 0x30]
call fcn.140002820
lea rcx, [rbp - 8]
cmp qword [rbp + 0x10], 0xf
cmova rcx, qword [rbp - 8]
xor edx, edx
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov r11, rax
mov eax, 0x5a4d
cmp word [r11], ax
jne 0x14004ef30
movsxd rcx, dword [r11 + 0x3c]
cmp dword [rcx + r11], 0x4550
jne 0x14004ef30
mov edx, dword [rcx + r11 + 0x88]
test edx, edx
je 0x14004ef30
mov esi, dword [rdx + r11 + 0x1c]
lea r14, [r11 + rsi]
mov r9d, dword [rdx + r11 + 0x20]
add r9, r11
mov r15d, dword [rdx + r11 + 0x24]
add r15, r11
xor r10d, r10d
test esi, esi
je 0x14004ee93
nop word [rax + rax]
mov r8d, dword [r9]
add r8, r11
mov rax, qword [rbp - 0x38]
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x14004ee83
inc rax
test ecx, ecx
jne 0x14004ee70
test edx, edx
je 0x14004ef03
inc r10d
add r9, 4
cmp r10d, esi
jb 0x14004ee60
lea rcx, [rbp - 8]
call fcn.140002820
mov r14, qword [rsp + 0x28]
xor r15d, r15d
lea rcx, [rbp + 0x18]
call fcn.140002820
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov rsi, qword [rbp - 0x78]
cmp eax, dword [rsi]
jb 0x14004ccc0
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rcx, qword [rbp + 0x38]
xor rcx, rsp
call fcn.140198890
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
movsxd rax, r10d
movzx ecx, word [r15 + rax*2]
mov r15d, dword [r14 + rcx*4]
xor edx, edx
mov r8d, 0x8000
mov rcx, qword [rbp - 0x78]
cmp byte [rsp + 0x20], dl
jne 0x14004ef29
mov rax, qword [rbp - 0x48]
add r15, qword [rax + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
lea rcx, [rbp - 8]
call fcn.140002820
nop
lea rcx, [rbp + 0x18]
call fcn.140002820
mov rax, r15
jmp 0x14004eed6