Function at 0x18000e9e0
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x3b0
mov rax, qword [0x1800b7160]
xor rax, rsp
mov qword [rsp + 0x3a0], rax
mov r12, qword [rcx + 0xb8]
xor eax, eax
movzx r13d, dx
mov edi, r9d
mov dword [rsp + 0x40], r9d
mov ebx, r8d
mov word [rsp + 0x48], r13w
mov rsi, rcx
lea r15d, [rax + 0xe]
mov qword [rsp + 0x98], r12
mov ebp, eax
mov dword [rsp + 0x4c], eax
mov r14d, eax
mov dword [rsp + 0x44], eax
test byte [0x1800b78f1], 0x40
jne 0x180039f56
lock inc dword [0x1800b7f94]
test byte [0x1800b78f1], 0x40
jne 0x180039f70
lea rcx, [rsi + 0x68]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop dword [rax + rax]
test edi, edi
jne 0x18000f8a7
test byte [rsi + 0x280], 4
mov dword [rsi + 0x324], ebx
jne 0x18000ea9e
mov rcx, rsi
call fcn.18000ff70
mov r15d, eax
test eax, eax
jne 0x180039f8e
mov ecx, 0x202
lea rdx, [rsp + 0x200]
call qword [sym.imp.WS2_32.dll_WSAStartup]
nop dword [rax + rax]
mov dword [rsp + 0x50], eax
mov r15d, eax
test eax, eax
jne 0x180039fa4
mov rcx, qword [rsi + 0xb8]
mov r14d, 1
mov rax, rcx
mov qword [rsp + 0x90], r14
and eax, 0x2400
cmp rax, 0x2000
jne 0x18000ebbd
mov eax, dword [0x1800b7a34]
test eax, eax
je 0x18000ebbd
mov rbx, qword [rsi + 0x348]
test rbx, rbx
je 0x18000f9fe
cmp r13d, r14d
je 0x18000f889
cmp r13d, 0x1c
jne 0x18000eb30
test dword [rbx + 0x38], 0x8000200
mov edx, ebp
setne dl
test edx, edx
je 0x18000f9fe
test al, 0x10
jne 0x18000ebbd
movabs rax, 0x1000000000000
test rax, rcx
jne 0x18000ebbd
xor edi, edi
test byte [0x1800b78f3], 0x40
jne 0x180039fba
xor edx, edx
cmp dword [rbx + 0x44], edx
jbe 0x18000eba4
lea rcx, [rdx + rdx*8]
shl rcx, 4
lea rax, [rbx + 0x68]
add rax, rcx
je 0x180039fe4
cmp r13d, r14d
je 0x18000f894
cmp r13d, 0x1c
jne 0x180039ff0
test dword [rax + 0x44], 0x200
je 0x180039fd7
test dword [rax + 0x4c], 0x1000
jne 0x18000eb9d
inc edi
inc edx
cmp edx, dword [rbx + 0x44]
jb 0x18000eb5d
test byte [0x1800b78f3], 0x40
jne 0x180039ff8
test edi, edi
mov edi, dword [rsp + 0x40]
je 0x18000f9fe
mov rax, qword [rsi + 0x380]
test rax, rax
je 0x18000ec0d
test byte [rsi + 0x120], 0x80
jne 0x18000ec0d
mov ecx, dword [rsi + 0x12c]
movzx edx, r13w
mov r9d, dword [rsi + 0x174]
mov r8, qword [rsi + 0xb8]
mov dword [rsp + 0x28], ecx
mov ecx, dword [rsi + 0x190]
mov dword [rsp + 0x20], ecx
mov rcx, qword [rsi + 0xa8]
call qword [case.0x180030b5c.0]
test eax, eax
jne 0x18003a030
mov r8, qword [rsi + 0xa8]
mov eax, r12d
bts eax, 0x1c
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x28], eax
movzx r9d, r13w
xor edx, edx
mov qword [rsp + 0x20], rbp
xor ecx, ecx
call sym.DNSAPI.dll_Dns_BuildPacket
mov rbp, rax
test rax, rax
je 0x18003a05f
mov rax, r12
shr rax, 0xa
and al, r14b
mov byte [rbp + 0x24d], al
bt r12, 0x18
jb 0x18003a06f
xor al, al
mov byte [rbp + 0x24e], al
lock inc dword [rbp + 0x28]
test byte [0x1800b78f3], 2
jne 0x18003a078
lock inc dword [0x1800b7c50]
xor edx, edx
lea rcx, [rsp + 0xc0]
mov r8d, 0x138
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
cmp dword [0x1800b7984], 0
je 0x18000f8e2
cmp dword [0x1800b7980], 0
mov rdi, 0xffffffffffffffff
jne 0x18003a093
mov rax, qword [0x1800b8500]
test rax, rax
jne 0x18003a182
mov rax, qword [0x1800b7ed8]
test rax, rax
je 0x18003a1b4
mov edx, 8
mov r8d, 0x1d0
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov r13, rax
mov qword [rsp + 0x60], rax
test r13, r13
je 0x18003a1cc
lock inc dword [r13]
test byte [0x1800b78f3], 2
jne 0x18003a1e0
mov ebx, dword [rsp + 0x40]
lea rax, [r13 + 0x38]
mov qword [rax + 8], rax
mov qword [rax], rax
test ebx, ebx
jne 0x18000f8c3
mov qword [rsi + 0x308], r13
mov eax, dword [rsi + 0x128]
mov dword [rbp + 0x238], eax
mov rax, qword [rsi + 0x168]
mov qword [rbp + 0xb0], rax
cmp dword [rsi + 0x170], 0
jne 0x18003a1fe
xor eax, eax
mov dword [rbp + 0xc0], eax
mov eax, dword [rsi + 0x12c]
mov dword [rbp + 0xac], eax
mov qword [r13 + 0x30], rbp
xor ebp, ebp
mov rax, qword [rsi + 0x350]
mov qword [r13 + 0x28], rax
mov eax, r12d
and eax, 0x200
mov qword [rsp + 0x78], rbp
mov dword [r13 + 0x60], eax
lea rax, [fcn.180016f40]
mov qword [r13 + 0x160], rax
mov qword [r13 + 0x58], r12
mov dword [r13 + 0x64], r14d
mov qword [r13 + 0x158], rsi
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount64]
nop dword [rax + rax]
mov qword [r13 + 0x168], rax
mov edx, r14d
lock xadd dword [rsi], edx
inc edx
cmp edx, r14d
je 0x18003a206
inc byte [rsi + 8]
test byte [0x1800b78f3], 2
jne 0x18003a216
cmp dword [rsi + 0x174], ebp
je 0x18000f933
mov eax, r14d
mov dword [r13 + 0x148], eax
prefetchw byte [rsi + 0x280]
mov eax, dword [rsi + 0x280]
mov ecx, eax
bts ecx, 0xf
lock cmpxchg dword [rsi + 0x280], ecx
jne 0x18000edff
bt eax, 0xc
jb 0x18000f951
mov r15, qword [rsi + 0x348]
mov qword [rsp + 0x88], r15
test byte [0x1800b78f3], 0x40
jne 0x18003a260
test r15, r15
je 0x18003a941
mov r14d, dword [r15 + 0x44]
xor r12d, r12d
test byte [0x1800b78f1], 4
jne 0x18003a27a
test byte [0x1800b78f3], 2
jne 0x18003a2a4
cmp r14d, 0x3e8
ja 0x18003a379
mov rax, qword [0x1800b8500]
lea ebx, [r14 + r14*8]
shl ebx, 4
add ebx, 0x68
test rax, rax
jne 0x18003a2bb
mov rax, qword [0x1800b7ed8]
test rax, rax
je 0x18003a2e2
mov r8d, ebx
mov edx, 8
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov rdi, rax
test rdi, rdi
je 0x18003a379
mov dword [rdi + 0x48], r14d
mov qword [rdi + 8], rdi
mov qword [rdi], rdi
movups xmm0, xmmword [r15]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [r15 + 0x10]
movups xmmword [rdi + 0x10], xmm1
movups xmm0, xmmword [r15 + 0x20]
movups xmmword [rdi + 0x20], xmm0
movups xmm1, xmmword [r15 + 0x30]
movups xmmword [rdi + 0x30], xmm1
movups xmm0, xmmword [r15 + 0x40]
movups xmmword [rdi + 0x40], xmm0
movups xmm1, xmmword [r15 + 0x50]
movups xmmword [rdi + 0x50], xmm1
movsd xmm0, qword [r15 + 0x60]
movsd qword [rdi + 0x60], xmm0
mov dword [rdi + 0x48], r14d
mov dword [rdi + 0x44], ebp
mov qword [rdi + 8], rdi
mov qword [rdi], rdi
mov rbp, qword [r15 + 0x10]
test byte [0x1800b78f3], 4
jne 0x18003a2fa
test rbp, rbp
jne 0x18003a314
lea ecx, [rbp + 0x57]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
xor ebx, ebx
mov qword [rdi + 0x10], rbx
cmp qword [r15 + 0x10], r12
jne 0x18003a368
mov rbx, qword [r15 + 0x18]
test byte [0x1800b78f3], 4
jne 0x18003a384
test rbx, rbx
je 0x18003a39e
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
cmp word [rbx + rax*2 + 2], r12w
lea rax, [rax + 1]
jne 0x18000ef70
lea r14d, [rax*2 + 2]
mov rax, qword [0x1800b8500]
test rax, rax
jne 0x18003a3b6
mov rax, qword [0x1800b7ed8]
test rax, rax
je 0x18003a3de
mov r8, r14
mov edx, 8
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov rbp, rax
test rbp, rbp
je 0x18003a3f6
mov r8, r14
mov rdx, rbx
mov rcx, rbp
call sub.api_ms_win_core_crt_l1_1_0.dll_memcpy
mov qword [rdi + 0x18], rbp
cmp qword [r15 + 0x18], r12
je 0x18000efe8
test rbp, rbp
je 0x18003a371
mov r15, qword [r15 + 0x20]
xor ebx, ebx
test byte [0x1800b78f1], 4
jne 0x18003a40e
test r15, r15
je 0x18000f07d
mov r14d, dword [r15]
test byte [0x1800b78f3], 2
jne 0x18003a428
cmp r14d, 0x32
ja 0x18000f060
mov rax, qword [0x1800b8500]
lea ebp, [r14 + 1]
shl ebp, 4
test rax, rax
jne 0x18003a442
mov rax, qword [0x1800b7ed8]
test rax, rax
je 0x18003a469
mov r8d, ebp
mov edx, 8
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov rbx, rax
test rbx, rbx
je 0x18000f060
mov dword [rbx + 4], r14d
test byte [0x1800b78f3], 2
jne 0x18003a481
test rbx, rbx
je 0x18000f07d
xor ebp, ebp
cmp dword [r15], ebp
ja 0x18003a49b
test byte [0x1800b78f1], 4
jne 0x18003a4e1
mov r15, qword [rsp + 0x88]
mov qword [rdi + 0x20], rbx
cmp qword [r15 + 0x20], r12
je 0x18000f0a5
test rbx, rbx
je 0x18003a371
mov qword [rsp + 0xb8], rdi
test byte [0x1800b78f1], 4
jne 0x18003a4fb
test r12d, r12d
jne 0x18003a90a
xor edx, edx
xor eax, eax
mov dword [rsp + 0x54], edx
mov dword [rsp + 0x58], eax
cmp dword [r15 + 0x44], eax
jbe 0x18000f6df
mov r13, qword [rsp + 0xb8]
lea rdi, [rax + rax*8]
shl rdi, 4
lea rcx, [rdx + rdx*8]
add rdi, 0x68
shl rcx, 4
add rdi, r15
add r13, 0x68
add r13, rcx
mov qword [rsp + 0x70], r13
test byte [0x1800b78f3], 0x40
jne 0x18003a515
test rdi, rdi
je 0x18003a8ff
test r13, r13
je 0x18003a8ff
movups xmm0, xmmword [rdi]
movups xmmword [r13], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [r13 + 0x10], xmm1
movups xmm0, xmmword [rdi + 0x20]
movups xmmword [r13 + 0x20], xmm0
movups xmm1, xmmword [rdi + 0x30]
movups xmmword [r13 + 0x30], xmm1
movups xmm0, xmmword [rdi + 0x40]
movups xmmword [r13 + 0x40], xmm0
movups xmm1, xmmword [rdi + 0x50]
movups xmmword [r13 + 0x50], xmm1
movups xmm0, xmmword [rdi + 0x60]
movups xmmword [r13 + 0x60], xmm0
movups xmm1, xmmword [rdi + 0x70]
movups xmmword [r13 + 0x70], xmm1
movups xmm0, xmmword [rdi + 0x80]
movups xmmword [r13 + 0x80], xmm0
mov qword [r13], 0
mov qword [r13 + 0x78], 0
mov qword [r13 + 8], 0
mov qword [r13 + 0x20], 0
mov qword [r13 + 0x28], 0
mov qword [r13 + 0x10], 0
mov qword [r13 + 0x18], 0
mov qword [r13 + 0x80], 0
mov qword [r13 + 0x88], 0
mov rax, qword [rdi + 0x28]
mov rbp, qword [rdi + 0x18]
mov r12, qword [rdi + 0x10]
mov r15, qword [rdi + 8]
mov r14, qword [rdi + 0x78]
mov rbx, qword [rdi]
mov qword [rsp + 0xb0], rax
mov rax, qword [rdi + 0x20]
mov qword [rsp + 0xa8], rax
mov eax, dword [rdi + 0x44]
mov dword [rsp + 0x68], eax
mov qword [rsp + 0x80], rbp
test byte [0x1800b78f3], 0x40
jne 0x18003a52f
test rbx, rbx
je 0x18000f2a0
test byte [0x1800b78f3], 4
jne 0x18003a546
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
cmp word [rbx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x18000f230
lea ebp, [rax*2 + 2]
mov rax, qword [0x1800b8500]
test rax, rax
jne 0x18003a560
mov rax, qword [0x1800b7ed8]
test rax, rax
je 0x18003a587
mov r8, rbp
mov edx, 8
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov rdi, rax
test rdi, rdi
je 0x18003a651
mov r8, rbp
mov rdx, rbx
mov rcx, rdi
call sub.api_ms_win_core_crt_l1_1_0.dll_memcpy
mov rbp, qword [rsp + 0x80]
mov qword [r13], rdi
test r14, r14
je 0x18000f329
test byte [0x1800b78f3], 4
jne 0x18003a59f
mov rax, 0xffffffffffffffff
nop dword [rax]
cmp word [r14 + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x18000f2c0
lea edi, [rax*2 + 2]
mov rax, qword [0x1800b8500]
test rax, rax
jne 0x18003a5b9
mov rax, qword [0x1800b7ed8]
test rax, rax
je 0x18003a5e0
mov r8, rdi
mov edx, 8
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov rbx, rax
test rbx, rbx
je 0x18003a651
mov r8, rdi
mov rdx, r14
mov rcx, rbx
call sub.api_ms_win_core_crt_l1_1_0.dll_memcpy
mov qword [r13 + 0x78], rbx
test r15, r15
je 0x18000f3ab
test byte [0x1800b78f3], 4
jne 0x18003a5f8
mov rax, 0xffffffffffffffff
cmp word [r15 + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x18000f342
lea edi, [rax*2 + 2]
mov rax, qword [0x1800b8500]
test rax, rax
jne 0x18003a612
mov rax, qword [0x1800b7ed8]
test rax, rax
je 0x18003a639
mov r8, rdi
mov edx, 8
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov rbx, rax
test rbx, rbx
je 0x18003a651
mov r8, rdi
mov rdx, r15
mov rcx, rbx
call sub.api_ms_win_core_crt_l1_1_0.dll_memcpy
mov qword [r13 + 8], rbx
test r12, r12
je 0x18000f52e
test byte [0x1800b78f1], 4
jne 0x18003a667
mov edi, dword [r12]
xor r13d, r13d
test byte [0x1800b78f3], 2
jne 0x18003a681
cmp edi, 0x32
ja 0x18000f423
mov rax, qword [0x1800b8500]
lea ebx, [rdi + 1]
shl ebx, 4
test rax, rax
jne 0x18003a69b
mov rax, qword [0x1800b7ed8]
test rax, rax
je 0x18003a6c2
mov r8d, ebx
mov edx, 8
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov r13, rax
test r13, r13
je 0x18000f423
mov dword [r13 + 4], edi
test byte [0x1800b78f3], 2
jne 0x18003a6da
test r13, r13
je 0x18000f504
xor r15d, r15d
cmp dword [r12], r15d
jbe 0x18000f504
nop word [rax + rax]
mov r14d, r15d
add r14, r14
mov rbx, qword [r12 + r14*8 + 0x10]
test rbx, rbx
je 0x18000f4f7
test byte [0x1800b78f3], 4
jne 0x18003a6f4
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
cmp word [rbx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x18000f480
lea ebp, [rax*2 + 2]
mov rax, qword [0x1800b8500]
test rax, rax
jne 0x18003a70e
mov rax, qword [0x1800b7ed8]
test rax, rax
je 0x18003a735
mov r8, rbp
mov edx, 8
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov rdi, rax
test rdi, rdi
je 0x18003a74d
mov r8, rbp
mov rdx, rbx
mov rcx, rdi
call sub.api_ms_win_core_crt_l1_1_0.dll_memcpy
mov qword [r13 + r14*8 + 0x10], rdi
mov eax, dword [r12 + r14*8 + 0x18]
mov dword [r13 + r14*8 + 0x18], eax
inc dword [r13]
inc r15d
cmp r15d, dword [r12]
jb 0x18000f450
test byte [0x1800b78f1], 4
jne 0x18003a76e
test r13, r13
je 0x18003a8ea
mov rcx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x80]
mov qword [rcx + 0x10], r13
mov r13, rcx
test rbp, rbp
jne 0x18003a788
mov r14, qword [rsp + 0xa8]
test r14, r14
je 0x18000f928
mov ebp, dword [r14 + 4]
test byte [0x1800b78f0], 1
jne 0x18003a7a2
mov rax, rbp
mov r15d, 0xffffffff
shl rax, 6
cmp rax, r15
ja 0x18003a847
lea edi, [rax + 0x20]
cmp edi, eax
jb 0x18003a830
mov rax, qword [0x1800b8500]
test rax, rax
jne 0x18003a7bc
mov rax, qword [0x1800b7ed8]
test rax, rax
je 0x18003a7e3
mov r8d, edi
mov edx, 8
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov rbx, rax
test rbx, rbx
je 0x18003a7fb
mov dword [rbx], ebp
test byte [0x1800b78f0], 1
jne 0x18003a812
mov r8d, dword [r14 + 4]
mov rdx, r14
shl r8d, 6
mov rcx, rbx
add r8d, 0x20
call sub.api_ms_win_core_crt_l1_1_0.dll_memcpy
mov dword [rbx], ebp
mov qword [r13 + 0x20], rbx
mov r14, qword [rsp + 0xb0]
test r14, r14
je 0x18000f695
mov edi, dword [r14 + 4]
test byte [0x1800b78f0], 1
jne 0x18003a859
mov rax, rdi
shl rax, 6
cmp rax, r15
ja 0x18003a8d0
lea ebp, [rax + 0x20]
cmp ebp, eax
jb 0x18003a830
mov rax, qword [0x1800b8500]
test rax, rax
jne 0x18003a873
mov rax, qword [0x1800b7ed8]
test rax, rax
je 0x18003a89a
mov r8d, ebp
mov edx, 8
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov rbx, rax
test rbx, rbx
je 0x18003a7fb
mov dword [rbx], edi
test byte [0x1800b78f0], 1
jne 0x18003a8b2
mov r8d, dword [r14 + 4]
mov rdx, r14
shl r8d, 6
mov rcx, rbx
add r8d, 0x20
call sub.api_ms_win_core_crt_l1_1_0.dll_memcpy
mov dword [rbx], edi
mov qword [r13 + 0x28], rbx
mov eax, dword [rsp + 0x68]
xor r12d, r12d
mov dword [r13 + 0x44], eax
test r12d, r12d
jne 0x18003a905
mov rax, qword [rsp + 0xb8]
mov edx, dword [rsp + 0x54]
mov r15, qword [rsp + 0x88]
inc edx
mov dword [rsp + 0x54], edx
mov dword [rax + 0x44], edx
mov eax, dword [rsp + 0x58]
inc eax
mov dword [rsp + 0x58], eax
cmp eax, dword [r15 + 0x44]
jb 0x18000f0d9
mov r13, qword [rsp + 0x60]
mov rax, qword [rsp + 0xb8]
mov rdi, 0xffffffffffffffff
mov r14, qword [rsp + 0x90]
mov r12, qword [rsp + 0x98]
mov ebx, dword [rsp + 0x40]
mov qword [r13 + 0x20], rax
test rax, rax
je 0x18003a948
test ebx, ebx
jne 0x18000f8cf
mov dword [rsi + 0x31c], r14d
test byte [0x1800b85c0], 4
jne 0x18003a9b4
movzx ebx, word [rsp + 0x48]
test byte [rsi + 0x120], 2
jne 0x18003a9e2
movabs rax, 0x2000000000402
test rax, r12
jne 0x18000f91e
mov rax, qword [rsi + 0x348]
test rax, rax
je 0x18000f91e
cmp dword [rax + 0x44], 0
je 0x18000f91e
cmp dword [0x1800b7a50], 0
jne 0x18000f91e
mov r9d, dword [rsi + 0x12c]
lea rcx, [rsp + 0xa0]
mov r8d, dword [rax + 0x98]
movzx edx, bx
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsi + 0xa8]
mov qword [rsp + 0xa0], r13
mov qword [rsp + 0x20], rsi
call fcn.180010080
mov r15d, eax
test eax, eax
jne 0x18003a9ec
mov rbx, qword [rsp + 0xa0]
lea rax, [0x180016ca0]
mov qword [r13 + 0x160], rax
cmp rbx, r13
jne 0x18000f8ec
mov ebp, dword [rsp + 0x4c]
lock xadd dword [rsi], r14d
inc r14d
cmp r14d, 1
je 0x18003aa88
inc byte [rsi + 0x16]
test byte [0x1800b78f3], 2
jne 0x18003aa98
test ebp, ebp
jne 0x18000f81a
mov rcx, r13
call fcn.180010480
mov r15d, eax
test byte [0x1800b78f1], 4
jne 0x18003aac5
lea rcx, [rsi + 0x68]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
cmp dword [rsi], 0
je 0x18000f84d
inc byte [rsi + 0x2c]
lock xadd dword [rsi], edi
dec edi
test byte [0x1800b78f3], 2
jne 0x18003aaeb
test edi, edi
je 0x18003ab17
test byte [0x1800b78f1], 0x40
jne 0x18003acad
mov eax, r15d
mov rcx, qword [rsp + 0x3a0]
xor rcx, rsp
call fcn.18002d5c0
mov rbx, qword [rsp + 0x400]
add rsp, 0x3b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov edx, dword [rbx + 0x38]
and edx, 0x20
jmp 0x18000eb28
mov ecx, dword [rax + 0x44]
and ecx, 0x20
test ecx, ecx
jne 0x18000eb92
jmp 0x180039fe4
cmp dword [rsi + 0x31c], ebp
je 0x18000f8bb
cmp ebx, dword [rsi + 0x324]
je 0x18000ea7c
mov r12d, ebp
jmp 0x18000f9b0
mov qword [rsi + 0x310], r13
jmp 0x18000ed2d
mov dword [rsi + 0x318], r14d
mov dword [rsi + 0x320], r14d
jmp 0x18000f71e
call fcn.18002c9e0
jmp 0x18000ec9e
mov rcx, rbx
mov ebp, r14d
call fcn.180006060
cmp dword [rsp + 0x40], 0
je 0x18000f915
mov qword [rsi + 0x310], rbx
mov rcx, r13
call fcn.180005974
xor r13d, r13d
jmp 0x18000f7dc
mov qword [rsi + 0x308], rbx
jmp 0x18000f905
mov r15d, dword [rsp + 0x50]
jmp 0x18000f7d8
mov r15d, 0xffffffff
jmp 0x18000f5e9
cmp qword [rsi + 0x370], rbp
je 0x18000ede8
cmp dword [rsi + 0x12c], ebp
jne 0x18000ede8
jmp 0x18003a242
lock and dword [rsi + 0x280], 0xffff7fff
mov edx, ebx
mov rcx, rsi
mov edi, ebx
call fcn.180024e74
mov rcx, r13
call fcn.180005974
mov r9d, 4
lea rdx, str.Query_Wire
mov r8d, 0xdb7
mov rcx, rsi
call sym.DNSAPI.dll_DeRefQueryBlobEx
test byte [0x1800b78f1], 4
jne 0x18003a249
mov r15d, 0x4c7
lea rcx, [0x18009dd70]
mov edx, r15d
call fcn.180024fd0
mov r12d, ebp
lea rcx, [rsi + 0x68]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
test rbp, rbp
jne 0x18003aa59
test r14d, r14d
je 0x18000f9da
call qword [sym.imp.WS2_32.dll_WSACleanup]
nop dword [rax + rax]
test edi, edi
jne 0x18000f9f0
mov rcx, rsi
mov dword [rsi + 0x194], r15d
call fcn.18000cf40
mov r15d, eax
test r12d, r12d
je 0x18000f84d
jmp 0x18003aa67
test byte [0x1800b78f1], 0x40
jne 0x18003a019
mov r15d, 0x25e5
mov r12d, ebp
mov dword [rsi + 0x194], r15d
jmp 0x18000f9b0
mov ecx, 0x4f
lea rdx, [0x18009f098]
mov r8, rsi
call fcn.1800879b4
nop
jmp 0x18000ea50
mov r8d, dword [0x1800b7f94]
lea rdx, [0x18009f098]
mov ecx, 0x50
call fcn.1800876bc
nop
jmp 0x18000ea64
mov edx, eax
lea rcx, str.idnQueryWireFormat
call fcn.180024fd0
mov r12d, ebp
jmp 0x18000f9b0
mov edx, eax
lea rcx, str.WSAStartup
call fcn.180024fd0
mov r12d, ebp
jmp 0x18000f9b0
mov r9d, r13d
lea rdx, [0x18009ef80]
mov ecx, 0x64
mov r8, rbx
call fcn.1800874d4
nop
jmp 0x18000eb56
test dword [rbx + 0x38], 0x8000000
jne 0x18000eb92
or dword [rax + 0x4c], 0x1000
jmp 0x18000eb9d
mov ecx, r14d
jmp 0x18000f89a
mov r9d, r13d
mov dword [rsp + 0x20], edi
mov ecx, 0x65
lea rdx, [0x18009ef80]
mov r8, rbx
call fcn.18008851c
nop
jmp 0x18000ebb1
mov ecx, 0x51
lea rdx, [0x18009f098]
call fcn.180087008
nop
jmp 0x18000fa0b
test byte [0x1800b78f1], 0x40
je 0x18003a04a
mov ecx, 0x52
lea rdx, [0x18009f098]
call fcn.180087008
mov r15d, 0x5b4
mov r12d, ebp
mov dword [rsi + 0x194], r15d
jmp 0x18000f9b0
mov r12d, dword [rsp + 0x44]
mov r15d, 0xe
jmp 0x18000f9b0
movzx eax, r14b
jmp 0x18000ec5e
mov r8d, dword [rbp + 0x28]
lea rdx, [0x18009f098]
mov ecx, 0xa
call fcn.1800876bc
nop
jmp 0x18000ec75
movups xmm0, xmmword [0x1800a1650]
movsx r8d, byte [rbp + 0x278]
mov edx, r14d
movzx eax, word [rbp + 0x26c]
mov byte [rsp + 0xc4], r14b
mov dword [rsp + 0xec], 0x20000
mov word [rsp + 0xf0], ax
mov word [rsp + 0xf2], r13w
movups xmmword [rsp + 0xd8], xmm0
test r8d, r8d
je 0x18003a136
mov rcx, r14
mov r10d, pe_nt_image_headers64
xor r9d, r9d
test r8d, r8d
jle 0x18003a10f
cmp rcx, r10
jge 0x18003a10f
movzx eax, byte [rcx + rbp + 0x278]
inc r9d
mov byte [rsp + rcx + 0xf3], al
inc edx
inc rcx
cmp r9d, r8d
jl 0x18003a0ee
movsx r8d, byte [rcx + rbp + 0x278]
cmp rcx, r10
jge 0x18003a12a
inc edx
mov byte [rsp + rcx + 0xf3], 0x2e
inc rcx
test r8d, r8d
jne 0x18003a0e6
cmp edx, r10d
cmovg edx, r10d
movsxd rax, edx
lea rcx, [rsp + 0xf4]
mov byte [rsp + rax + 0xf3], 0
mov rax, rdi
inc rax
cmp byte [rcx + rax], 0
jne 0x18003a14c
mov rcx, qword [0x1800b7970]
lea rdx, [rsp + 0xc0]
add ax, 0x39
mov word [rsp + 0xc0], ax
call qword [sym.imp.ntdll.dll_EtwLogTraceEvent]
nop dword [rax + rax]
nop
jmp 0x18000ecb2
mov ecx, 0x1d0
call qword [case.0x180030b5c.0]
mov qword [rsp + 0x60], rax
mov r13, rax
test rax, rax
je 0x18000ecf4
xor edx, edx
mov r8d, 0x1d0
mov rcx, rax
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
nop
jmp 0x18000ecf4
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov qword [0x1800b7ed8], rax
jmp 0x18000ecd2
mov edi, dword [rsp + 0x40]
mov r15d, 0xe
mov r12d, dword [rsp + 0x44]
jmp 0x18000f9b0
mov r9d, dword [r13]
lea rdx, [0x18009f098]
mov ecx, 0xc
mov r8, r13
call fcn.1800874d4
nop
jmp 0x18000ed0f
mov eax, r14d
jmp 0x18000ed56
lea rax, [rsi + 0x30]
mov qword [rax + 8], rax
mov qword [rax], rax
jmp 0x18000edcc
mov dword [rsp + 0x30], edx
lea r9, str.Query_Wire
mov ecx, 0x10
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 0xd97
lea r8d, [rcx - 0xc]
call fcn.180089608
nop
jmp 0x18000eddc
xor eax, eax
jmp 0x18000edeb
mov ecx, 0x53
lea rdx, [0x18009f098]
call fcn.180087008
nop
jmp 0x18000f998
mov ecx, 0x53
lea rdx, [0x18009ef80]
mov r8, r15
call fcn.1800879b4
nop
jmp 0x18000ee35
lea rax, [rsp + 0xb8]
mov ecx, 0x51
mov r9d, r14d
mov qword [rsp + 0x20], rax
mov r8, r15
lea rdx, [0x18009ef80]
call fcn.180088904
nop
jmp 0x18000ee52
mov ecx, 0x4c
lea rdx, [0x18009ef80]
call fcn.180087008
nop
jmp 0x18000ee5f
mov ecx, ebx
call qword [case.0x180030b5c.0]
mov rdi, rax
test rax, rax
je 0x18000eeb0
mov r8d, ebx
xor edx, edx
mov rcx, rax
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
nop
jmp 0x18000eeb0
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov qword [0x1800b7ed8], rax
jmp 0x18000ee96
mov ecx, 0x10
lea rdx, [0x18009f3a0]
mov r8, rbp
call fcn.180087814
nop
jmp 0x18000ef22
mov rax, 0xffffffffffffffff
cmp word [rbp + rax*2 + 2], r12w
lea rax, [rax + 1]
jne 0x18003a31b
lea r14d, [rax*2 + 2]
mov ecx, r14d
call fcn.180017d38
mov rbx, rax
test rax, rax
jne 0x18003a354
lea ecx, [rax + 0xe]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
nop
jmp 0x18000ef3c
mov r8d, r14d
mov rdx, rbp
mov rcx, rax
call sub.api_ms_win_core_crt_l1_1_0.dll_memcpy
nop
jmp 0x18000ef3c
test rbx, rbx
jne 0x18000ef4a
mov rcx, rdi
call sym.DNSAPI.dll_NetInfo_Free
mov r12d, 0xe
jmp 0x18000f0ad
mov ecx, 0x10
lea rdx, [0x18009f3a0]
mov r8, rbx
call fcn.180087814
nop
jmp 0x18000ef5b
mov ecx, 0x57
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
xor ebp, ebp
jmp 0x18000efd5
mov ecx, r14d
call qword [case.0x180030b5c.0]
mov rbp, rax
test rax, rax
je 0x18000efbe
mov r8, r14
xor edx, edx
mov rcx, rax
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
nop
jmp 0x18000efbe
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov qword [0x1800b7ed8], rax
jmp 0x18000efa4
mov ecx, 0xe
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
xor ebp, ebp
jmp 0x18000efd5
mov ecx, 0xe
lea rdx, [0x18009ef80]
mov r8, r15
call fcn.1800879b4
nop
jmp 0x18000effb
mov ecx, 0xa
lea rdx, [0x18009ef80]
mov r8d, r14d
call fcn.1800876bc
nop
jmp 0x18000f010
mov ecx, ebp
call qword [case.0x180030b5c.0]
mov rbx, rax
test rax, rax
je 0x18000f057
mov r8d, ebp
xor edx, edx
mov rcx, rax
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
nop
jmp 0x18000f057
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov qword [0x1800b7ed8], rax
jmp 0x18000f03d
mov ecx, 0xb
lea rdx, [0x18009ef80]
mov r8, rbx
call fcn.1800879b4
nop
jmp 0x18000f06d
mov r14d, ebp
add r14, r14
mov rcx, qword [r15 + r14*8 + 0x10]
test rcx, rcx
je 0x18003a4c6
call fcn.1800191f8
test rax, rax
je 0x18003a4d2
mov qword [rbx + r14*8 + 0x10], rax
mov eax, dword [r15 + r14*8 + 0x18]
mov dword [rbx + r14*8 + 0x18], eax
inc dword [rbx]
inc ebp
cmp ebp, dword [r15]
jb 0x18003a49b
jmp 0x18000f07d
mov rcx, rbx
call fcn.180018d10
xor ebx, ebx
jmp 0x18000f07d
mov ecx, 0xf
lea rdx, [0x18009ef80]
mov r8, rbx
call fcn.1800879b4
nop
jmp 0x18000f08a
mov ecx, 0x52
lea rdx, [0x18009ef80]
mov r8d, r12d
call fcn.1800876bc
nop
jmp 0x18000f0ba
mov ecx, 0x42
lea rdx, [0x18009ef80]
mov r8, rdi
call fcn.1800879b4
nop
jmp 0x18000f111
mov ecx, 0x41
lea rdx, [0x18009ef80]
call fcn.180087008
nop
jmp 0x18000f20e
mov ecx, 0x10
lea rdx, [0x18009f3a0]
mov r8, rbx
call fcn.180087814
nop
jmp 0x18000f224
mov ecx, ebp
call qword [case.0x180030b5c.0]
mov rdi, rax
test rax, rax
je 0x18000f27d
mov r8, rbp
xor edx, edx
mov rcx, rax
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
nop
jmp 0x18000f27d
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov qword [0x1800b7ed8], rax
jmp 0x18000f263
mov ecx, 0x10
lea rdx, [0x18009f3a0]
mov r8, r14
call fcn.180087814
nop
jmp 0x18000f2b6
mov ecx, edi
call qword [case.0x180030b5c.0]
mov rbx, rax
test rax, rax
je 0x18000f30e
mov r8, rdi
xor edx, edx
mov rcx, rax
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
nop
jmp 0x18000f30e
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov qword [0x1800b7ed8], rax
jmp 0x18000f2f4
mov ecx, 0x10
lea rdx, [0x18009f3a0]
mov r8, r15
call fcn.180087814
nop
jmp 0x18000f33b
mov ecx, edi
call qword [case.0x180030b5c.0]
mov rbx, rax
test rax, rax
je 0x18000f390
mov r8, rdi
xor edx, edx
mov rcx, rax
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
nop
jmp 0x18000f390
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov qword [0x1800b7ed8], rax
jmp 0x18000f376
mov ecx, 0xe
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
jmp 0x18003a8ea
mov ecx, 0xe
lea rdx, [0x18009ef80]
mov r8, r12
call fcn.1800879b4
nop
jmp 0x18000f3c1
mov ecx, 0xa
lea rdx, [0x18009ef80]
mov r8d, edi
call fcn.1800876bc
nop
jmp 0x18000f3d5
mov ecx, ebx
call qword [case.0x180030b5c.0]
mov r13, rax
test rax, rax
je 0x18000f41a
mov r8d, ebx
xor edx, edx
mov rcx, rax
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
nop
jmp 0x18000f41a
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov qword [0x1800b7ed8], rax
jmp 0x18000f400
mov ecx, 0xb
lea rdx, [0x18009ef80]
mov r8, r13
call fcn.1800879b4
nop
jmp 0x18000f430
mov ecx, 0x10
lea rdx, [0x18009f3a0]
mov r8, rbx
call fcn.180087814
nop
jmp 0x18000f471
mov ecx, ebp
call qword [case.0x180030b5c.0]
mov rdi, rax
test rax, rax
je 0x18000f4cd
mov r8, rbp
xor edx, edx
mov rcx, rax
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
nop
jmp 0x18000f4cd
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov qword [0x1800b7ed8], rax
jmp 0x18000f4b3
mov ecx, 0xe
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
mov rcx, r13
call fcn.180018d10
xor r13d, r13d
jmp 0x18000f504
mov ecx, 0xf
lea rdx, [0x18009ef80]
mov r8, r13
call fcn.1800879b4
nop
jmp 0x18000f511
mov rcx, rbp
call fcn.18001e320
test rax, rax
je 0x18003a8ea
mov qword [r13 + 0x18], rax
jmp 0x18000f537
mov ecx, 0x12
lea rdx, [0x18009f310]
mov r8d, ebp
call fcn.1800876bc
nop
jmp 0x18000f559
mov ecx, edi
call qword [case.0x180030b5c.0]
mov rbx, rax
test rax, rax
je 0x18000f5b4
mov r8d, edi
xor edx, edx
mov rcx, rax
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
nop
jmp 0x18000f5b4
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov qword [0x1800b7ed8], rax
jmp 0x18000f59a
test byte [0x1800b78f1], 4
je 0x18003a8ea
mov ecx, 0x15
jmp 0x18003a8de
mov ecx, 0x16
lea rdx, [0x18009f310]
mov r9, rbx
mov r8d, ebp
call fcn.1800883c8
mov ebp, dword [rbx]
jmp 0x18000f5cc
test byte [0x1800b78f1], 4
je 0x18003a8ea
mov ecx, 0x14
jmp 0x18003a8de
test byte [0x1800b78f1], 4
jne 0x18003a8d9
jmp 0x18003a8ea
mov ecx, 0x12
lea rdx, [0x18009f310]
mov r8d, edi
call fcn.1800876bc
nop
jmp 0x18000f60b
mov ecx, ebp
call qword [case.0x180030b5c.0]
mov rbx, rax
test rax, rax
je 0x18000f660
mov r8d, ebp
xor edx, edx
mov rcx, rax
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
nop
jmp 0x18000f660
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov qword [0x1800b7ed8], rax
jmp 0x18000f646
mov ecx, 0x16
lea rdx, [0x18009f310]
mov r9, rbx
mov r8d, edi
call fcn.1800883c8
mov edi, dword [rbx]
jmp 0x18000f678
test byte [0x1800b78f1], 4
je 0x18003a8ea
mov ecx, 0x13
lea rdx, [0x18009f310]
call fcn.180087008
mov rcx, qword [rsp + 0x70]
call fcn.180005670
mov r12d, 0xe
jmp 0x18000f6a0
mov r12d, 0x57
mov r13, qword [rsp + 0x60]
mov rcx, qword [rsp + 0xb8]
call sym.DNSAPI.dll_NetInfo_Free
mov ecx, r12d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
mov r14, qword [rsp + 0x90]
mov rdi, 0xffffffffffffffff
mov r12, qword [rsp + 0x98]
mov ebx, dword [rsp + 0x40]
xor eax, eax
jmp 0x18000f702
mov edi, dword [rsp + 0x40]
mov rcx, rsi
mov edx, edi
call fcn.180024e74
mov rcx, r13
call fcn.180005974
mov r9d, 4
lea rdx, str.Query_Wire
mov r8d, 0xdc3
mov rcx, rsi
call sym.DNSAPI.dll_DeRefQueryBlobEx
test byte [0x1800b78f1], 4
je 0x18003a993
mov ecx, 0x54
lea rdx, [0x18009f098]
call fcn.180087008
mov edx, 0xe
lea rcx, [0x18009dd70]
mov r15d, edx
call fcn.180024fd0
mov rbp, qword [rsp + 0x78]
mov r12d, ebp
jmp 0x18000f9b0
mov eax, dword [rsi + 0x190]
movzx ebx, word [rsp + 0x48]
mov r8, qword [rsi + 0xa8]
mov r9d, ebx
mov dword [rsp + 0x28], eax
mov eax, dword [rsi + 0x12c]
mov dword [rsp + 0x20], eax
call fcn.180053dcc
nop
jmp 0x18000f730
or dword [r13 + 0x6c], 8
jmp 0x18000f73d
test byte [0x1800b78f1], 1
je 0x18003aa09
mov ecx, 0x55
lea rdx, [0x18009f098]
mov r8d, eax
call fcn.1800876bc
mov edi, dword [rsp + 0x40]
mov rcx, rsi
mov edx, edi
call fcn.180024e74
mov rcx, r13
call fcn.180005974
mov rbp, qword [rsp + 0x78]
mov r15d, 0xe
mov r12d, r14d
test edi, edi
je 0x18003aa4a
mov dword [rsi + 0x318], 0
mov dword [rsi + 0x320], 0
jmp 0x18000f9b0
mov dword [rsi + 0x31c], 0
jmp 0x18000f9b0
mov rcx, rbp
call fcn.180003ccc
nop
jmp 0x18000f9c9
mov r9d, 4
lea rdx, str.Query_Wire
mov r8d, 0xe51
mov rcx, rsi
call sym.DNSAPI.dll_DeRefQueryBlobEx
nop
jmp 0x18000f84d
lea rax, [rsi + 0x30]
mov qword [rax + 8], rax
mov qword [rax], rax
jmp 0x18000f7ee
mov ecx, 0x10
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x28], rsi
lea r9, str.Query_Wire
mov dword [rsp + 0x20], 0xe23
lea r8d, [rcx + 2]
call fcn.180089608
nop
jmp 0x18000f7fe
mov dword [rsp + 0x28], eax
lea rdx, [0x18009f098]
mov ecx, 0x56
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov r8, r13
call fcn.180088cd0
nop
jmp 0x18000f81a
mov ecx, 0x11
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rsi
lea r9, str.Query_Wire
mov dword [rsp + 0x20], 0xe32
lea r8d, [rcx + 1]
call fcn.180089608
nop
jmp 0x18000f845
mov rcx, qword [rsi + 0xc80]
test rcx, rcx
je 0x18003ab33
call sym.DNSAPI.dll_DnsApiFree
xor edi, edi
mov qword [rsi + 0xc80], rdi
jmp 0x18003ab35
xor edi, edi
mov rcx, qword [rsi + 0xc70]
test rcx, rcx
je 0x18003ab54
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov qword [rsi + 0xc70], rdi
mov rcx, qword [rsi + 0x430]
test rcx, rcx
je 0x18003ab73
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov qword [rsi + 0x430], rdi
cmp dword [rsi + 0x28c], 0
je 0x18003abd3
lea rcx, [0x1800b7d60]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop dword [rax + rax]
mov r8, qword [rsi + 0x30]
lea rax, [rsi + 0x30]
cmp qword [r8 + 8], rax
jne 0x18003aca6
mov rdx, qword [rax + 8]
cmp qword [rdx], rax
jne 0x18003aca6
mov eax, 0xffffffff
mov qword [rdx], r8
add dword [0x1800b7c4c], eax
lea rcx, [0x1800b7d60]
mov qword [r8 + 8], rdx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov rcx, qword [rsi + 0x2a8]
test rcx, rcx
je 0x18003abe4
call fcn.1800157ac
mov rcx, qword [rsi + 0x2b0]
test rcx, rcx
je 0x18003abf5
call fcn.1800157ac
mov rcx, qword [rsi + 0x2d0]
test rcx, rcx
je 0x18003ac06
call fcn.1800157ac
mov rcx, qword [rsi + 0x2d8]
test rcx, rcx
je 0x18003ac17
call fcn.1800157ac
cmp dword [rsi + 0x174], 0
je 0x18003ac52
cmp dword [rsi + 0x190], 0
je 0x18003ac52
mov rcx, qword [rsi + 0x338]
test rcx, rcx
je 0x18003ac3a
call fcn.1800157ac
mov rcx, qword [rsi + 0x3b0]
test rcx, rcx
je 0x18003ac52
call sym.DNSAPI.dll_Dns_FreeMsgBuf
mov qword [rsi + 0x3b0], rdi
mov rcx, qword [rsi + 0x188]
test rcx, rcx
je 0x18003ac63
call fcn.180007f78
cmp dword [rsi + 0x60], 0
je 0x18003ac79
lea rcx, [rsi + 0x68]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_DeleteCriticalSection]
nop dword [rax + rax]
mov rcx, qword [rsi + 0xe8]
test rcx, rcx
je 0x18003ac98
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
nop dword [rax + rax]
mov qword [rsi + 0xe8], rdi
mov rcx, rsi
call sym.DNSAPI.dll_DnsApiFree
nop
jmp 0x18000f84d
mov ecx, 3
int 0x29
mov ecx, 0x57
lea rdx, [0x18009f098]
mov r8d, r15d
call fcn.1800876bc
nop
jmp 0x18000f85a