Function at 0x140041f37
Capabilities:
Connect socket
Enumerate pe sections

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x238
lea rbp, [rsp + 0x80]
and rsp, 0xffffffffffffff80
mov r15, r8
mov rsi, rdx
mov r13, rcx
movzx eax, byte [rdx + 0x70]
test eax, eax
je 0x140041fc0
cmp eax, 3
jne 0x1400426ca
lea rbx, [rsi + 0x68]
movzx eax, byte [rsi + 0x68]
lea r12, [rsi + 0x30]
test eax, eax
je 0x140042136
cmp eax, 3
jne 0x1400426ca
mov rax, qword [rsi + 0x60]
mov rdx, qword [rax + 8]
lea rdi, [rsp + 0x150]
mov rcx, rdi
mov r8, r15
call fcn.140086c2a
mov al, byte [rdi + 9]
cmp al, 3
jne 0x14004231d
push 1
pop rax
mov byte [rbx], 3
mov cl, 3
jmp 0x1400426af
mov rcx, qword [rsi + 0x20]
mov qword [rsi + 0x28], rcx
mov eax, dword [rsi + 2]
movzx r9d, word [rsi + 6]
shl r9, 0x20
or r9, rax
test byte [rsi], 1
je 0x140042064
mov edx, dword [rsi + 0x14]
mov r8d, dword [rsi + 0x18]
movzx eax, word [rsi + 0x1c]
shr r9, 0x10
mov dword [rsp + 0x158], r9d
mov r9, qword [rsi + 8]
mov qword [rsp + 0x15c], r9
mov r9d, dword [rsi + 0x10]
mov dword [rsp + 0x164], r9d
xorps xmm0, xmm0
movups xmmword [rsp + 0x16c], xmm0
movups xmmword [rsp + 0x17c], xmm0
movups xmmword [rsp + 0x18c], xmm0
movups xmmword [rsp + 0x19c], xmm0
and dword [rsp + 0x1cc], 0
movups xmmword [rsp + 0x1ac], xmm0
movups xmmword [rsp + 0x1bc], xmm0
rol ax, 8
mov dword [rsp + 0x168], r8d
push 0x1c
pop r8
mov r10w, 0x17
mov r9d, edx
jmp 0x1400420bc
mov rax, r9
shr rax, 0x20
rol ax, 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x1b8], xmm0
movups xmmword [rsp + 0x1a8], xmm0
movups xmmword [rsp + 0x198], xmm0
movups xmmword [rsp + 0x188], xmm0
movups xmmword [rsp + 0x178], xmm0
and qword [rsp + 0x1c8], 0
movups xmmword [rsp + 0x168], xmm0
movups xmmword [rsp + 0x158], xmm0
push 0x10
pop r8
mov r10w, 2
lea rdx, [rsp + 0x150]
mov word [rdx], r10w
mov word [rdx + 2], ax
mov dword [rdx + 4], r9d
mov dword [rdx + 0x80], r8d
call qword [sym.imp.ws2_32.dll_connect]
test eax, eax
je 0x14004210e
call fcn.140035d05
mov r14, rax
mov qword [rsp + 0x80], rax
mov rcx, rax
call fcn.140018dc8
cmp al, 0xd
jne 0x14004230d
lea rcx, [rsp + 0x80]
call fcn.14003b61a
mov qword [rsp + 0x70], r15
mov r12, qword [rsi + 0x28]
mov qword [rsi + 0x30], r12
and qword [rsi + 0x38], 0
lea rax, [rsi + 0x30]
mov qword [rsp + 0x48], rax
lea rbx, [rsi + 0x68]
mov byte [rsi + 0x68], 0
xor r14d, r14d
jmp 0x140042148
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x48], r12
mov r12, qword [rsi + 0x30]
mov r14, qword [rsi + 0x38]
call fcn.1400865e2
mov qword [rsp + 0x200], r12
mov qword [rsp + 0x208], r14
mov qword [rsp + 0x138], rax
cmp qword [rax + 0xe0], 0
je 0x1400426ca
mov r15, rax
lea rdi, [rax + 0x100]
mov rcx, rdi
call fcn.14002832d
cmp byte [r15 + 0x130], 0
je 0x1400421b6
lea rdx, str.A_Tokio_1.x_context_was_found__but_it_is_being_shutdown.task__was_cancelled
push 0x38
pop r8
mov cl, 0x28
call fcn.14007bcbf
mov r14, rax
mov rcx, rdi
call fcn.140016bfb
mov r12, qword [rsp + 0x48]
jmp 0x14004266f
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x60], rbx
lea rdi, [rsp + 0x150]
and qword [rdi + 0x17], 0
xorps xmm0, xmm0
movups xmmword [rdi + 7], xmm0
movaps xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x89], xmm0
mov rax, qword [rdi + 0x1f]
mov qword [rsp + 0xb8], rax
movups xmm0, xmmword [rdi + 0x10]
movups xmmword [rsp + 0xa9], xmm0
movups xmm0, xmmword [rdi]
movups xmmword [rsp + 0x99], xmm0
mov rax, qword [rsp + 0xb0]
mov qword [rdi + 0xa0], rax
mov rax, qword [rsp + 0xb8]
mov qword [rdi + 0xa8], rax
movaps xmm0, xmmword [rsp + 0xa0]
movaps xmmword [rdi + 0x90], xmm0
movaps xmm0, xmmword [rsp + 0x90]
movaps xmmword [rdi + 0x80], xmm0
add byte [rdi], cl
sub byte [rsp + 0x80], al
movaps xmmword [rdi + 0x70], xmm0
mov ecx, 0x100
mov edx, 0x80
call fcn.140083bed
mov rbx, rax
push 1
pop rax
mov qword [rbx], rax
mov qword [rbx + 8], rax
lea rcx, [rbx + 0x10]
mov r8d, 0xb0
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
fld dword [rax + rax]
and qword [rbx + 0xc0], 0
add byte [rax], al
add byte [rax], al
lock inc qword [rbx]
jle 0x1400426ca
lea rcx, [rbx + 0x80]
mov rax, qword [r15 + 0x120]
cmp rcx, rax
je 0x1400426ca
mov qword [rbx + 0x88], rax
and qword [rbx + 0x80], 0
test rax, rax
mov rdi, qword [rsp + 0x78]
mov edi, dword [rsp + 0x78]
je 0x1400422c2
mov qword [rax], rcx
mov qword [r15 + 0x120], rcx
cmp qword [r15 + 0x128], 0
jne 0x1400422da
mov qword [r15 + 0x128], rcx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x140], rbx
mov rcx, rdi
call fcn.140016bfb
test r14, r14
je 0x14004232e
movabs r14, 0xc00000003
mov rbx, qword [rsp + 0x60]
mov r12, qword [rsp + 0x48]
jmp 0x14004263e
mov rcx, qword [rsi + 0x28]
call fcn.14003ab75
xor edi, edi
jmp 0x140042696
cmp al, 2
jne 0x14004237f
mov r14, qword [rsp + 0x150]
jmp 0x140042575
mov rdi, qword [r15 + 0xe0]
lea rcx, [rdi + 0x20]
mov qword [rsp + 0x50], rcx
call fcn.14002832d
lea rdx, [rdi + 0x28]
mov rax, qword [rdi + 0x38]
test rax, rax
mov qword [rsp + 0x58], rdi
je 0x140042367
mov rcx, qword [rdi + 0x30]
mov rax, qword [rcx + rax*8 - 8]
mov rax, qword [rax]
cmp rax, 0x20
jbe 0x1400423e1
mov rcx, qword [rdi + 0x18]
call fcn.1400363fa
dec dword [rax - 0x7b]
invalid
je 0x1400423e1
mov r14, rax
xor edi, edi
jmp 0x140042404
mov rcx, qword [rsi + 0x50]
cmp rcx, 0xffffffffffffffff
je 0x1400426ca
add byte [rax], al
lea r9, [rsp + 0x80]
and dword [r9], 0
mov dword [rsp + 0x150], 4
mov qword [rsp + 0x20], rdi
and al, 0x20
mov edx, 0xffff
mov r8d, 0x1007
call qword [sym.imp.ws2_32.dll_getsockopt]
cmp eax, 0xffffffff
je 0x14004256d
movsxd r14, dword [rsp + 0x80]
test r14, r14
je 0x1400425f4
shl r14, 0x20
or r14, 2
jmp 0x140042575
mov rax, qword [rdi + 0x38]
test rax, rax
je 0x1400426ca
invalid
mov rcx, qword [rdi + 0x30]
mov r14, qword [rcx + rax*8 - 8]
lock inc qword [r14]
mov dil, 1
jle 0x1400426ca
add byte [rax], al
mov rcx, qword [rsp + 0x50]
call fcn.140016bfb
test dil, dil
je 0x14004262f
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x148], r14
lea rdi, [rsp + 0x80]
mov rcx, rdi
mov ecx, edi
mov rdx, r12
mov r8d, 0x48000022
call fcn.14003658c
cmp dword [rdi], 1
jne 0x140042488
invalid
xor edi, edi
cmp rdi, 0xc
je 0x14004260d
lea rax, [0x1400ea788]
mov r8d, dword [rdi + rax]
lea rcx, [rsp + 0x150]
mov rdx, r12
call fcn.14003658c
mov r13, qword [rsp + 0x158]
cmp r13, r12
sete al
or al, byte [rsp + 0x150]
cmp al, 1
jne 0x140042490
add rdi, 4
jmp 0x140042444
mov r13, qword [rsp + 0x88]
push 0x78
pop rcx
call fcn.14000abc7
mov rdi, rax
push 1
pop rax
mov qword [rdi], rax
mov qword [rdi + 8], rax
mov byte [rdi + 0x10], 0
and dword [rdi + 0x18], 0
lea rax, [rdi + 0x10]
mov qword [rdi + 0x20], r14
xorps xmm0, xmm0
movups xmmword [rdi + 0x28], xmm0
movups xmmword [rdi + 0x38], xmm0
movups xmmword [rdi + 0x48], xmm0
mov qword [rdi + 0x58], r13
movups xmmword [rdi + 0x60], xmm0
and word [rdi + 0x70], 0
mov r14, rax
mov rcx, rax
call fcn.14002832d
inc edi
push 0x19d
mov rax, qword [rsp + 0x68]
mov qword [rdi + 0x60], rax
mov rcx, r14
call fcn.140016bfb
mov rax, qword [rsp + 0x58]
and al, 0x58
lock inc qword [rax]
jle 0x1400426ca
lock inc qword [rdi]
mov r13, qword [rsp + 0x50]
jle 0x1400426ca
mov rax, qword [rsp + 0x58]
lea r14, [rax + 0x10]
mov qword [rsp + 0x150], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x160], rax
add dh, al
test byte [rax + rbp*2], ah
add dword [rax], eax
add byte [rbx], al
mov qword [rsp + 0x158], rdi
mov rcx, r14
mov rdx, rdi
call fcn.140036378
mov rcx, r14
call fcn.1400363af
test rax, rax
je 0x140042583
mov r14, rax
lea rcx, [rsp + 0x150]
call fcn.1400365fb
jmp 0x14004262f
call fcn.14008185d
mov r14, rax
lea rcx, [rsi + 0x40]
call fcn.14003a912
jmp 0x140042689
lea rax, [rsp + 0x160]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x220], xmm0
push 0x20
pop rcx
call fcn.14000abc7
mov r14, rax
mov rax, qword [rsp + 0x58]
mov qword [r14], rax
mov qword [r14 + 8], rdi
movaps xmm0, xmmword [rsp + 0x220]
movups xmmword [r14 + 0x10], xmm0
xor ecx, ecx
call fcn.140036630
xor ecx, ecx
call fcn.1400846cc
lea rax, [rsi + 0x40]
mov qword [rsi + 0x40], r15
mov qword [rsi + 0x48], rbx
mov qword [rsi + 0x50], r12
mov qword [rsi + 0x58], r14
mov qword [rsi + 0x60], rax
mov rbx, qword [rsp + 0x60]
mov r12, qword [rsp + 0x48]
mov r15, qword [rsp + 0x70]
jmp 0x140041f91
lea rax, [rsi + 0x50]
mov rdi, qword [rsi + 0x40]
mov r14, qword [rsi + 0x48]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x210], xmm0
jmp 0x14004268b
mov r14d, dword [rsp + 0x84]
shl r14, 0x20
or r14, 2
lea rcx, [rsp + 0x148]
call fcn.1400356c8
mov r13, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
mov r12, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x78]
add r15, 0x108
mov rcx, rdi
call fcn.14002832d
mov rcx, r15
mov rdx, qword [rsp + 0x68]
push 0x443bde8
add byte [rax - 0x77], cl
stc
call fcn.140016bfb
lea rcx, [rsp + 0x140]
call fcn.140084116
lea rcx, [rsp + 0x138]
call fcn.14002c71f
movabs dword [0x248c8d48fffea0], eax
add al, byte [rax]
add al, ch
xlatb
invalid
add al, 0
xor edi, edi
mov byte [rbx], 1
mov rcx, r12
call fcn.140041f1c
mov qword [r13 + 8], rdi
mov qword [r13 + 0x10], r14
movaps xmm0, xmmword [rsp + 0x210]
movups xmmword [r13 + 0x18], xmm0
mov cl, 1
xor eax, eax
mov qword [r13], rax
mov byte [rsi + 0x70], cl
lea rsp, [rbp + 0x1b8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
ud2