Function at 0x14004ce90
Capabilities:
Contain obfuscated stackstrings
Get system information on windows
Make suspicious ntquerysysteminformation call
Parse pe header
Query environment variable
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov rax, qword [0x1401d8800]
xor rax, rsp
mov qword [rbp + 0x38], rax
mov byte [rsp + 0x20], r8b
mov qword [rbp - 0x38], rdx
mov qword [rbp - 0x40], rcx
xor r15d, r15d
mov esi, r15d
mov qword [rbp - 0x78], r15
mov dword [rbp - 0x10], r15d
lea r9, [rbp - 0x10]
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14004cf4a
nop word [rax + rax]
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp - 0x10]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
lea r9, [rbp - 0x10]
mov r8d, dword [rbp - 0x10]
mov rdx, rax
mov ecx, listen
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x14004cf00
mov qword [rbp - 0x78], rsi
test eax, eax
js 0x14004f2f3
mov eax, r15d
mov dword [rsp + 0x30], eax
cmp dword [rsi], r15d
jbe 0x14004f2f3
movzx edi, byte [rsp + 0x20]
movzx ebx, byte [rsp + 0x20]
movzx r14d, byte [rsp + 0x20]
mov qword [rsp + 0x28], r14
movzx r13d, byte [rsp + 0x20]
movzx r12d, byte [rsp + 0x20]
nop dword [rax]
nop word [rax + rax]
imul rcx, rax, 0x128
lea rax, [rcx + rsi]
mov qword [rbp - 0x48], rax
movzx eax, word [rax + 0x2e]
add rax, rcx
add rsi, rax
movzx edx, dil
lea rcx, [rbp + 0x18]
call fcn.1400029f0
nop
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rsi + r8 + 0x30], 0
jne 0x14004cfc0
lea rdx, [rsi + 0x30]
lea rcx, [rbp + 0x18]
call fcn.140004460
nop
lea rcx, [rbp + 0x18]
call fcn.140001bc0
mov rdx, qword [rbp - 0x40]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x14004f2d4
mov rdx, qword [rbp - 0x48]
add rdx, 0x30
lea rcx, [rbp - 8]
call fcn.1400042d0
nop
mov dword [rsp + 0x60], 0xf7c9f0cb
mov dword [rsp + 0x64], 0xc0c4c0c9
mov word [rsp + 0x68], 0xfdc7
mov byte [rsp + 0x6a], 0x92
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x6b], xmm0
mov qword [rsp + 0x7b], rax
nop dword [rax]
nop dword [rax + rax]
mov r8, qword [0x14022c4b8]
mov r9, qword [0x14022c4b0]
nop
mov rsi, r15
cmp rsi, 0x23
jae 0x14004da3a
movzx r11d, byte [rsp + rsi + 0x60]
movzx r10d, r11b
cmp r8, rsi
ja 0x14004da31
lea rcx, [r9 + 1]
cmp r8, rcx
jae 0x14004d0a1
movabs rcx, 0x2ce72e0ae9d25a94
add rcx, rsi
mov rax, rcx
and rax, r11
imul r14, rax, 0xfffffffffffffffe
add r14, rcx
add r14, r11
sub r14b, 0xc
mov qword [rsp + 0x28], r14
jmp 0x14004d0db
je 0x14004d9ac
lea rax, [r9 + 3]
cmp r8, rax
je 0x14004d923
lea rax, [rcx + 1]
cmp r8, rax
je 0x14004d8e5
lea rax, [r9 + 5]
cmp r8, rax
je 0x14004d88f
lea rax, [r9 + 4]
cmp r8, rax
je 0x14004d85b
movzx r10d, r11b
nop
cmp r9, rsi
ja 0x14004da28
lea rax, [r9 + 0x3e8]
cmp r8, rax
jae 0x14004d11c
movabs rcx, 0xaef6c6e52e416e24
add rcx, rsi
movzx eax, cl
and al, r11b
mov edx, 2
sub dl, al
add dl, dl
add dl, cl
add dl, r10b
movzx r14d, dl
jmp 0x14004d170
lea rax, [r9 + 1]
cmp r8, rax
je 0x14004d803
inc rax
cmp r8, rax
je 0x14004d7d4
lea rax, [r9 + 5]
cmp r8, rax
je 0x14004d7ab
lea rax, [r9 + 4]
cmp r8, rax
je 0x14004d787
lea rax, [r9 + 3]
cmp r8, rax
je 0x14004d761
lea rax, [r9 + 7]
cmp r8, rax
je 0x14004d738
nop dword [rax]
lea rax, [r9 + r8]
cmp rax, rsi
jbe 0x14004d46b
nop dword [rax]
lea rax, [r9 + 0x64]
cmp r8, rax
je 0x14004d44d
lea rax, [r9 + 0x400]
cmp r8, rax
je 0x14004d425
lea rax, [r9 + 0x41]
cmp r8, rax
je 0x14004d400
lea rax, [r9 + 0x20]
cmp r8, rax
je 0x14004d3e2
lea rax, [r9 + 8]
cmp r8, rax
je 0x14004d3c6
lea rax, [r9 + 3]
cmp r8, rax
je 0x14004d180
lea r8, [r9 + 5]
lea r9, [r8 + 8]
lea rax, [r9 + 0xa]
cmp r8, rax
jb 0x14004da06
lea rax, [r9 + 0x7a]
cmp r8, rax
jb 0x14004d9e4
lea rax, [r9 + 1]
cmp r8, rax
jb 0x14004d2db
lea rax, [r9 + 5]
cmp r8, rax
jb 0x14004d2b2
lea rax, [r9 + 0x3e8]
cmp r8, rax
jb 0x14004d288
lea rax, [r9 + 0x42]
cmp r8, rax
jb 0x14004d3a2
lea r8, [r9 + 9]
lea r9, [r8 + 0x10]
lea rax, [r9 + 0x28]
cmp r8, rax
ja 0x14004d388
lea rax, [r9 + 0x80]
cmp r8, rax
ja 0x14004d36f
lea rax, [r9 + 4]
cmp r8, rax
ja 0x14004d356
lea rax, [r9 + 9]
cmp r8, rax
ja 0x14004d33c
lea rax, [r9 + 0x2a]
cmp r8, rax
ja 0x14004d320
lea rax, [r9 + 0x61]
cmp r8, rax
ja 0x14004d304
lea r8, [r9 + 2]
lea r9, [r8 + 4]
jmp 0x14004d180
movabs rcx, 0x6185ffecf5372e5c
add rcx, rsi
movzx eax, cl
and al, r11b
mov edx, 0x3e
sub dl, al
add dl, dl
add dl, cl
add dl, r10b
movzx r14d, dl
jmp 0x14004d170
movabs rcx, 0x7b7a3d721927934
add rcx, rsi
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r14d, [r10 + rcx]
sub r14b, 0x6c
mov qword [rsp + 0x28], r14
jmp 0x14004d0e0
movabs rcx, 0xade947c14dedc40c
add rcx, rsi
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r14d, [r10 + rcx]
sub r14b, 0x54
mov qword [rsp + 0x28], r14
jmp 0x14004d067
lea edx, [rsi + 0x20]
movzx eax, dl
and al, r11b
mov ecx, reloc.WS2_32.dll_recv
sub cl, al
add cl, cl
add dl, cl
add dl, r11b
jmp 0x14004d823
lea edx, [rsi - 0x58]
movzx eax, dl
and al, r11b
mov ecx, 0x34
sub cl, al
add cl, cl
add dl, cl
add dl, r11b
jmp 0x14004d8b4
lea ecx, [rsi + 0x58]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r14d, [r11 + rcx]
sub r14b, 0x68
jmp 0x14004d905
lea ecx, [rsi + 0x30]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea edx, [r11 + rcx]
sub dl, 0x50
jmp 0x14004d947
lea ecx, [rsi + 8]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea edx, [r11 + rcx]
sub dl, 0x38
jmp 0x14004d96a
lea ecx, [rsi - 0x20]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r14d, [r11 + rcx]
sub r14b, 0x20
jmp 0x14004d9cc
movzx r10d, sil
lea edx, [r10 - 0x2c]
movzx eax, dl
and al, r11b
mov ecx, reloc.WLDAP32.dll_Ordinal_26
sub cl, al
lea r14d, [rcx + rcx]
add r14b, dl
add r14b, r11b
jmp 0x14004d6ca
lea edx, [rsi - 0x78]
movzx eax, dl
and al, r11b
mov ecx, 0x24
sub cl, al
add cl, cl
add dl, cl
add dl, r11b
jmp 0x14004d947
movzx r10d, sil
lea ecx, [r10 + 0x10]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea edx, [r11 + rcx]
sub dl, 0x70
jmp 0x14004d8b8
lea ecx, [rsi - 0x18]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r14d, [r11 + rcx]
sub r14b, 0x58
mov qword [rsp + 0x28], r14
dec rsi
inc rsi
jmp 0x14004d053
lea ecx, [rsi - 0x40]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r14d, [r11 + rcx]
sub r14b, 0x40
mov qword [rsp + 0x28], r14
inc r9
dec rsi
inc rsi
jmp 0x14004d053
movzx r10d, sil
lea ecx, [r10 - 0x68]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea edx, [r11 + rcx]
sub dl, 0x28
jmp 0x14004d827
lea rax, [r9 + 0x400]
cmp r8, rax
jae 0x14004d50b
movabs rcx, 0x2ce72e0ae9d25a94
add rcx, rsi
movzx eax, cl
and al, r11b
add al, al
sub r10b, al
lea r14d, [rcx + r10]
sub r14b, 0xc
lea rax, [r9 + r8]
cmp rax, 0xa
je 0x14004d721
lea rax, [r9 + 0x20]
cmp r8, rax
jbe 0x14004d5af
lea edx, [rsi + 0x44]
movzx eax, dl
and al, r11b
mov ecx, reloc.WS2_32.dll_select
sub cl, al
lea r14d, [rcx + rcx]
add r14b, dl
add r14b, r11b
cmp r8, 0x28
jae 0x14004d701
lea rax, [r9 + 0x42]
cmp r8, rax
jbe 0x14004d65a
movzx r10d, sil
lea edx, [r10 + 0x68]
movzx eax, dl
and al, r11b
mov ecx, reloc.WS2_32.dll_sendto
sub cl, al
lea r14d, [rcx + rcx]
add r14b, dl
add r14b, r11b
jmp 0x14004d6ca
lea rax, [r9 + 1]
cmp r8, rax
jne 0x14004d533
lea edx, [rsi + 0x48]
movzx eax, dl
and al, r11b
mov ecx, 4
sub cl, al
lea r14d, [rcx + rcx]
add r14b, dl
add r14b, r11b
jmp 0x14004d9cc
inc rax
cmp r8, rax
jne 0x14004d554
lea ecx, [rsi - 0x68]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea edx, [r11 + rcx]
sub dl, 0x28
jmp 0x14004d947
lea rax, [r9 + 3]
cmp r8, rax
jne 0x14004d581
lea ecx, [rsi - 0x18]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea edx, [r11 + rcx]
sub dl, 0x58
mov qword [rsp + 0x28], rdx
add r8, r9
mov r14, rdx
jmp 0x14004d90a
lea rax, [r9 + 8]
cmp r8, rax
jne 0x14004d49b
movzx r10d, sil
lea edx, [r10 - 0x78]
movzx eax, dl
and al, r11b
mov ecx, 0x24
sub cl, al
add cl, cl
add dl, cl
add dl, r11b
jmp 0x14004d827
lea rax, [r9 + 1]
cmp r8, rax
jne 0x14004d5d9
movzx r10d, sil
lea edx, [r10 + 0x6c]
movzx eax, dl
and al, r11b
mov ecx, 6
sub cl, al
add cl, cl
add dl, cl
add dl, r11b
jmp 0x14004d827
inc rax
cmp r8, rax
jne 0x14004d609
lea ecx, [rsi - 0x6c]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r14d, [r11 + rcx]
sub r14b, 0xc
mov qword [rsp + 0x28], r14
inc r9
dec rsi
inc rsi
jmp 0x14004d053
lea rax, [r9 + 3]
cmp r8, rax
jne 0x14004d637
lea ecx, [rsi - 0x44]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r14d, [r11 + rcx]
sub r14b, 0x24
mov qword [rsp + 0x28], r14
dec rsi
inc rsi
jmp 0x14004d053
lea rax, [r9 + 4]
cmp r8, rax
jne 0x14004d4d0
lea ecx, [rsi + 0x34]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r14d, [r11 + rcx]
jmp 0x14004d901
lea rax, [r9 + 1]
cmp r8, rax
jne 0x14004d682
lea edx, [rsi - 0x70]
movzx eax, dl
and al, r11b
mov ecx, 8
sub cl, al
lea r14d, [rcx + rcx]
add r14b, dl
add r14b, r11b
jmp 0x14004d9cc
inc rax
cmp r8, rax
jne 0x14004d6a3
lea ecx, [rsi - 0x20]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea edx, [r11 + rcx]
sub dl, 0x20
jmp 0x14004d947
lea rax, [r9 + 3]
cmp r8, rax
jne 0x14004d6c6
lea ecx, [rsi + 8]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r14d, [r11 + rcx]
sub r14b, 0x38
jmp 0x14004d905
movzx r10d, sil
cmp r9, 6
jb 0x14004d6ef
lea ecx, [r10 - 8]
movzx eax, cl
and al, r11b
mov edx, Ordinal_30
sub dl, al
add dl, dl
add dl, cl
add dl, r11b
add dl, dl
jmp 0x14004d827
mov byte [rsp + rsi + 0x60], r14b
mov qword [rsp + 0x28], r14
inc rsi
jmp 0x14004d053
movzx r10d, sil
lea edx, [r10 + 0x20]
movzx eax, dl
and al, r11b
movzx ecx, r11b
sub cl, al
add cl, 0x10
add cl, cl
add dl, cl
jmp 0x14004d8b8
lea edx, [rsi + 0x48]
movzx eax, dl
and al, r11b
mov ecx, 4
sub cl, al
add cl, cl
jmp 0x14004d945
movabs rdx, 0xd73803a99f0bcc8c
add rdx, rsi
movzx eax, dl
and al, r11b
mov ecx, reloc.WLDAP32.dll_Ordinal_22
sub cl, al
lea r14d, [rcx + rcx]
add r14b, r10b
add r14b, dl
jmp 0x14004d9cc
movabs rdx, 0x7d69a793cb671764
add rdx, rsi
movzx eax, dl
and al, r11b
mov ecx, Ordinal_35
sub cl, al
add cl, cl
add cl, r10b
add dl, cl
jmp 0x14004d96a
movabs rdx, 0x239b4b7df7c2623c
add rdx, rsi
movzx eax, dl
and al, r11b
mov ecx, reloc.WLDAP32.dll_Ordinal_46
sub cl, al
add cl, cl
add cl, r10b
jmp 0x14004d945
movabs rdx, 0xc9ccef68241dad14
add rdx, rsi
movzx eax, dl
and al, r11b
mov ecx, Ordinal_60
sub cl, al
lea r14d, [rcx + rcx]
add r14b, r10b
add r14b, dl
jmp 0x14004d905
movabs rcx, 0x6ffe93525078f7ec
add rcx, rsi
movzx eax, cl
and al, r11b
add al, al
sub r10b, al
lea edx, [rcx + r10]
sub dl, 0x74
mov qword [rsp + 0x28], rdx
add r8, r9
mov r14, rdx
jmp 0x14004d90a
movabs rdx, 0x8c522fb01e6234c
add rdx, rsi
movzx eax, dl
and al, r11b
add al, al
movzx ecx, r10b
sub cl, al
sub dl, 0x14
add dl, cl
movzx r10d, sil
mov qword [rsp + 0x28], rdx
sub r10b, 0x74
movzx eax, r10b
and al, r11b
mov ecx, reloc.WLDAP32.dll_Ordinal_22
sub cl, al
add cl, cl
add cl, r10b
add cl, r11b
mov byte [rsp + rsi + 0x60], cl
mov r14, rdx
inc r9
dec rsi
inc rsi
jmp 0x14004d053
movabs rdx, 0xa18bb2a3b3534eac
add rdx, rsi
movzx eax, dl
and al, r11b
mov ecx, Ordinal_41
sub cl, al
lea r14d, [rcx + rcx]
add r14b, r10b
add r14b, dl
mov qword [rsp + 0x28], r14
dec rsi
inc rsi
jmp 0x14004d053
movabs rdx, 0x47bd568ddfae9984
add rdx, rsi
movzx eax, dl
and al, r11b
mov ecx, reloc.WLDAP32.dll_Ordinal_50
sub cl, al
add cl, cl
add cl, r10b
add dl, cl
movzx r11d, r10b
movzx r10d, sil
sub r10b, 0x4c
movzx eax, r10b
and al, r11b
mov ecx, 0xa
sub cl, al
add cl, cl
add cl, r10b
add cl, r11b
add cl, dl
mov byte [rsp + rsi + 0x60], cl
mov qword [rsp + 0x28], rdx
add r8, r9
mov r14, rdx
jmp 0x14004d90a
movabs rcx, 0x94209e6238652f34
add rcx, rsi
movzx eax, cl
and al, r11b
add al, al
sub r10b, al
lea r14d, [rcx + r10]
sub r14b, 0x6c
mov qword [rsp + 0x28], r14
movzx eax, r14b
mov rcx, 0xffffffffffffffff
sub rcx, rax
add rsi, rcx
inc rsi
jmp 0x14004d053
movabs rdx, 0x3a52424c64c07a0c
add rdx, rsi
movzx eax, dl
and al, r11b
add al, al
movzx ecx, r10b
sub cl, al
sub dl, 0x54
movzx r11d, r10b
add dl, cl
lea ecx, [rsi - 0x24]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
sub cl, 4
add cl, r11b
movzx eax, cl
mov byte [rsp + rsi + 0x60], al
inc r9
add rax, r9
sub rsi, rax
mov qword [rsp + 0x28], rdx
lea ecx, [rsi + 0x70]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
sub cl, 0x10
add cl, r11b
mov byte [rsp + rsi + 0x60], cl
inc r8
mov rax, 0xffffffffffffffff
sub rax, r8
add rsi, rax
mov r14, rdx
movzx eax, byte [rsp + rsi + 0x60]
add rax, r9
add rsi, rax
inc rsi
jmp 0x14004d053
movabs rcx, 0x86b58a20bd770fbc
add rcx, rsi
movzx eax, cl
and al, r11b
add al, al
sub r10b, al
lea r14d, [rcx + r10]
sub r14b, 0x24
mov qword [rsp + 0x28], r14
movzx eax, byte [rsp + rsi + 0x60]
add rax, r9
add rsi, rax
inc rsi
jmp 0x14004d053
sub sil, 0x1c
movzx eax, sil
and al, r11b
add al, al
sub sil, al
lea r14d, [r11 + rsi]
sub r14b, 0x3c
mov qword [rsp + 0x28], r14
jmp 0x14004d050
sub sil, 0x44
movzx eax, sil
and al, r11b
add al, al
sub sil, al
lea r14d, [r11 + rsi]
sub r14b, 0x24
mov qword [rsp + 0x28], r14
jmp 0x14004d040
lea rcx, [rbp + 0x154dad0]
jmp 0x14004da3f
lea rcx, [rbp + 0xa73564]
jmp 0x14004da3f
lea rcx, [rsp + 0x60]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rsi, rax
movzx edx, bl
lea rcx, [rbp - 0x30]
call fcn.1400029f0
nop
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rsi + r8], 0
jne 0x14004da60
mov rdx, rsi
lea rcx, [rbp - 0x30]
call fcn.140004460
nop
mov word [rbp - 0x70], 0x6d30
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x6e], xmm0
movups xmmword [rbp - 0x5e], xmm0
mov byte [rbp - 0x4e], al
nop dword [rax]
mov rax, qword [0x14022c4b8]
mov r9, qword [0x14022c4b0]
nop
mov rsi, r15
cmp rsi, 0x23
jae 0x14004e544
movzx r11d, byte [rbp + rsi - 0x70]
mov r10d, r11d
cmp rax, rsi
ja 0x14004e53b
lea rcx, [r9 + 1]
cmp rax, rcx
jae 0x14004daeb
movabs rdx, 0x9c434df882bd2e4e
add rdx, rsi
mov rcx, rdx
and rcx, r10
imul r13, rcx, 0xfffffffffffffffe
add r13, rdx
add r13, r10
sub r13b, 0x22
jmp 0x14004db17
je 0x14004e4c3
inc rcx
cmp rax, rcx
je 0x14004e467
lea rcx, [r9 + 4]
cmp rax, rcx
je 0x14004e440
lea rcx, [r9 + 5]
cmp rax, rcx
je 0x14004e3f4
cmp r9, rsi
ja 0x14004e532
lea rcx, [r9 + 4]
cmp rax, rcx
jae 0x14004db46
lea edx, [rsi + 0x66]
movzx ecx, dl
and cl, r11b
mov r8d, reloc.WLDAP32.dll_Ordinal_27
sub r8b, cl
add r8b, r8b
add r8b, dl
add r8b, r11b
jmp 0x14004db71
lea rcx, [r9 + 1]
cmp rax, rcx
je 0x14004e3d6
lea rcx, [r9 + 3]
cmp rax, rcx
je 0x14004e3cb
lea rcx, [r9 + 5]
cmp rax, rcx
je 0x14004e39c
movzx r8d, r13b
lea rcx, [r9 + rax]
cmp rcx, rsi
jbe 0x14004dff6
nop
lea rcx, [r9 + 0x42]
cmp rax, rcx
je 0x14004dfe4
lea rcx, [r9 + 5]
cmp rax, rcx
je 0x14004dfba
lea rcx, [r9 + 0x61]
cmp rax, rcx
je 0x14004df99
lea rcx, [r9 + 0x28]
cmp rax, rcx
je 0x14004df75
lea rcx, [r9 + 3]
cmp rax, rcx
je 0x14004df54
lea rcx, [r9 + 0x400]
cmp rax, rcx
je 0x14004df37
lea rcx, [r9 + 0x10]
cmp rax, rcx
je 0x14004df08
lea rcx, [r9 + 1]
cmp rax, rcx
je 0x14004db80
mov rax, rcx
lea r9, [rcx + 0x200]
lea rcx, [r9 + 0x200]
cmp rax, rcx
jb 0x14004e515
lea rcx, [r9 + 9]
cmp rax, rcx
jb 0x14004e4f4
lea rcx, [r9 + 0x5a]
cmp rax, rcx
jb 0x14004dcff
lea rcx, [r9 + 0x64]
cmp rax, rcx
jb 0x14004dce0
lea rcx, [r9 + 6]
cmp rax, rcx
jb 0x14004deb4
lea rcx, [r9 + 0x7a]
cmp rax, rcx
jb 0x14004de67
lea rcx, [r9 + 0x40]
cmp rax, rcx
jb 0x14004de19
lea rcx, [r9 + 4]
cmp rax, rcx
jb 0x14004db80
lea rax, [r9 + 0x1000]
lea r9, [rax + 0x1000]
lea rcx, [r9 + 0x1000]
cmp rax, rcx
ja 0x14004ddf0
lea rcx, [r9 + 0x20]
cmp rax, rcx
ja 0x14004ddd0
lea rcx, [r9 + 2]
cmp rax, rcx
ja 0x14004ddb2
lea rcx, [r9 + 0x3e8]
cmp rax, rcx
ja 0x14004dd91
lea rcx, [r9 + 0xa]
cmp rax, rcx
ja 0x14004dd73
lea rcx, [r9 + 0x2a]
cmp rax, rcx
ja 0x14004dd65
lea rcx, [r9 + 0x80]
cmp rax, rcx
ja 0x14004dd41
lea rcx, [r9 + 8]
cmp rax, rcx
ja 0x14004dd20
lea rax, [r9 + 0x41]
lea r9, [rax + 0x41]
jmp 0x14004db80
lea r8d, [rsi + 0x5a]
movzx ecx, r11b
and cl, r8b
add cl, cl
movzx edx, r11b
sub dl, cl
sub r8b, 0x76
add r8b, dl
jmp 0x14004db71
lea r8d, [rsi + 0x22]
movzx ecx, r11b
and cl, r8b
mov edx, 9
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r11b
add r13b, r8b
jmp 0x14004dab6
lea r8d, [rsi + 0x30]
movzx ecx, r11b
and cl, r8b
add cl, cl
movzx r13d, r11b
sub r13b, cl
sub r13b, 0x50
movzx r10d, sil
jmp 0x14004e411
lea edx, [rsi - 0x6c]
movzx ecx, r11b
and cl, dl
add cl, cl
sub r11b, cl
lea r13d, [rdx + r11]
sub r13b, 0xc
inc r9
dec rsi
inc rsi
jmp 0x14004daa3
lea r8d, [rsi - 8]
mov edx, Ordinal_30
jmp 0x14004e449
lea r8d, [rsi + 0x5c]
movzx ecx, r11b
and cl, r8b
mov edx, 0x3e
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r11b
jmp 0x14004e327
lea r8d, [rsi + 0x24]
movzx ecx, r11b
and cl, r8b
mov edx, 2
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r11b
add r13b, r8b
jmp 0x14004e3b2
lea r8d, [rsi - 0x78]
movzx ecx, r11b
and cl, r8b
mov edx, 0x24
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r11b
jmp 0x14004e36b
lea r8d, [rsi - 0x14]
movzx ecx, r11b
and cl, r8b
add cl, cl
movzx r13d, r11b
sub r13b, cl
sub r13b, 0x74
add r13b, r8b
jmp 0x14004e489
lea edx, [rsi + 0x50]
movzx ecx, r11b
and cl, dl
add cl, cl
sub r11b, cl
lea r13d, [rdx + r11]
sub r13b, 0x30
movzx ecx, byte [rbp + rsi - 0x70]
add rcx, r9
add rsi, rcx
inc rsi
jmp 0x14004daa3
lea r8d, [rsi + 0x2e]
movzx ecx, r11b
and cl, r8b
add cl, cl
movzx edx, r11b
sub dl, cl
sub r8b, 0x42
add r8b, dl
cmp r9, 0x80
jb 0x14004e2fe
lea r8d, [rsi + 0x14]
movzx ecx, r11b
and cl, r8b
add cl, cl
movzx edx, r11b
sub dl, cl
add dl, r8b
lea r13d, [rdx*2 - 0x18]
movzx r10d, sil
jmp 0x14004e414
lea r8d, [rsi - 0x6e]
movzx ecx, r11b
and cl, r8b
mov edx, 1
sub dl, cl
add dl, dl
add dl, r11b
add r8b, dl
cmp rax, 0x40
jae 0x14004e30f
lea rcx, [r9 + 0x40]
cmp rax, rcx
jbe 0x14004e217
lea r8d, [rsi - 4]
movzx ecx, r11b
and cl, r8b
mov edx, recv
sub dl, cl
add dl, dl
add dl, r11b
jmp 0x14004de30
lea r8d, [rsi - 0xa]
movzx ecx, r11b
and cl, r8b
mov edx, reloc.WLDAP32.dll_Ordinal_35
sub dl, cl
add dl, dl
add dl, r11b
add r8b, dl
lea rcx, [r9 + rax]
cmp rcx, 0x400
je 0x14004e350
lea rcx, [r9 + 0x10]
cmp rax, rcx
jbe 0x14004e11b
lea r8d, [rsi - 0x6a]
movzx ecx, r11b
and cl, r8b
add cl, cl
movzx edx, r11b
sub dl, cl
sub r8b, 0x1a
jmp 0x14004de7e
lea r8d, [rsi + 0x64]
movzx ecx, r11b
and cl, r8b
mov edx, Ordinal_35
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r11b
add r13b, r8b
movzx ecx, byte [rbp + rsi - 0x70]
add rcx, r9
add rsi, rcx
inc rsi
jmp 0x14004daa3
lea r8d, [rsi + 0x2c]
movzx ecx, r11b
and cl, r8b
add cl, cl
movzx r13d, r11b
sub r13b, cl
sub r13b, 0x34
jmp 0x14004e36b
lea r8d, [rsi - 0x70]
movzx ecx, r11b
and cl, r8b
mov edx, 8
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r11b
add r13b, r8b
jmp 0x14004e3b2
lea r8d, [rsi - 0xc]
movzx ecx, r11b
and cl, r8b
mov edx, Ordinal_45
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r11b
add r13b, r8b
add rax, r9
jmp 0x14004e3b2
lea edx, [rsi - 0x44]
movzx ecx, r11b
and cl, dl
add cl, cl
sub r11b, cl
lea r13d, [rdx + r11]
sub r13b, 0x24
dec rsi
inc rsi
jmp 0x14004daa3
lea r8d, [rsi + 0x20]
movzx ecx, r11b
and cl, r8b
mov edx, reloc.WS2_32.dll_recv
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r11b
add r13b, r8b
inc r9
dec rsi
inc rsi
jmp 0x14004daa3
lea r8d, [rsi - 0x7c]
mov edx, reloc.WLDAP32.dll_Ordinal_50
movzx r10d, sil
jmp 0x14004e401
lea rdx, [r9 + 8]
cmp rax, rdx
jae 0x14004e01b
lea r8d, [rsi + 0x4e]
movzx ecx, r11b
and cl, r8b
add cl, cl
movzx edx, r11b
sub dl, cl
sub r8b, 0x22
jmp 0x14004decb
lea rcx, [r9 + 1]
cmp rax, rcx
jne 0x14004e053
lea r8d, [rsi - 0x34]
movzx ecx, r11b
and cl, r8b
mov edx, gethostname
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r11b
add r13b, r8b
movzx ecx, byte [rbp + rsi - 0x70]
add rcx, r9
add rsi, rcx
inc rsi
jmp 0x14004daa3
inc rcx
cmp rax, rcx
jne 0x14004e07c
lea r8d, [rsi + 0x68]
movzx ecx, r11b
and cl, r8b
mov edx, reloc.WS2_32.dll_sendto
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r11b
add r13b, r8b
jmp 0x14004e489
lea rcx, [r9 + 3]
cmp rax, rcx
jne 0x14004e0a9
lea r8d, [rsi + 0x3c]
movzx ecx, r11b
and cl, r8b
mov edx, reloc.WLDAP32.dll_Ordinal_46
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r11b
add r13b, r8b
add rax, r9
jmp 0x14004e3b2
lea rcx, [r9 + 6]
cmp rax, rcx
jne 0x14004e0d3
lea edx, [rsi + 0x74]
movzx ecx, r11b
and cl, dl
add cl, cl
sub r11b, cl
lea r13d, [rdx + r11]
sub r13b, 0x2c
dec rsi
inc rsi
jmp 0x14004daa3
lea rcx, [r9 + 4]
cmp rax, rcx
jne 0x14004e100
lea edx, [rsi + 0x10]
movzx ecx, r11b
and cl, dl
add cl, cl
sub r11b, cl
lea r13d, [rdx + r11]
sub r13b, 0x70
inc r9
dec rsi
inc rsi
jmp 0x14004daa3
cmp rax, rdx
jne 0x14004dece
lea r8d, [rsi - 0x54]
mov edx, Ordinal_41
movzx r10d, sil
jmp 0x14004e401
lea rcx, [r9 + 1]
cmp rax, rcx
jne 0x14004e145
lea r8d, [rsi + 0x32]
movzx ecx, r11b
and cl, r8b
add cl, cl
movzx r13d, r11b
sub r13b, cl
sub r13b, 0x5e
movzx r10d, sil
jmp 0x14004e411
inc rcx
cmp rax, rcx
jne 0x14004e177
lea r8d, [rsi - 0x32]
movzx ecx, r11b
and cl, r8b
mov edx, Ordinal_50
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r11b
add r13b, r8b
inc r9
dec rsi
inc rsi
jmp 0x14004daa3
lea rcx, [r9 + 3]
cmp rax, rcx
jne 0x14004e18e
lea r8d, [rsi + 0x6a]
mov edx, reloc.WS2_32.dll_listen
jmp 0x14004e449
lea rcx, [r9 + 5]
cmp rax, rcx
jne 0x14004e1b8
lea r8d, [rsi + 0x3e]
movzx ecx, r11b
and cl, r8b
mov edx, Ordinal_41
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r11b
add r13b, r8b
jmp 0x14004e3b2
lea rcx, [r9 + 7]
cmp rax, rcx
jne 0x14004e1e1
lea r8d, [rsi + 0x76]
movzx ecx, r11b
and cl, r8b
add cl, cl
movzx r13d, r11b
sub r13b, cl
sub r13b, 0x3a
add r13b, r8b
jmp 0x14004e489
lea rcx, [r9 + 6]
cmp rax, rcx
jne 0x14004de81
lea edx, [rsi + 0x12]
movzx ecx, r11b
and cl, dl
add cl, cl
sub r11b, cl
lea r13d, [rdx + r11]
sub r13b, 0x7e
movzx ecx, byte [rbp + rsi - 0x70]
add rcx, r9
add rsi, rcx
inc rsi
jmp 0x14004daa3
lea rcx, [r9 + 1]
cmp rax, rcx
jne 0x14004e249
lea edx, [rsi - 0x68]
movzx ecx, r11b
and cl, dl
add cl, cl
sub r11b, cl
lea r13d, [rdx + r11]
sub r13b, 0x28
movzx ecx, byte [rbp + rsi - 0x70]
add rcx, r9
add rsi, rcx
inc rsi
jmp 0x14004daa3
inc rcx
cmp rax, rcx
jne 0x14004e26f
lea r8d, [rsi - 0x30]
movzx ecx, r11b
and cl, r8b
mov edx, Ordinal_41
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r11b
jmp 0x14004e36b
lea rcx, [r9 + 3]
cmp rax, rcx
jne 0x14004e296
lea edx, [rsi + 8]
movzx ecx, r11b
and cl, dl
add cl, cl
sub r11b, cl
lea r13d, [rdx + r11]
sub r13b, 0x38
add rax, r9
jmp 0x14004e3b2
lea rcx, [r9 + 5]
cmp rax, rcx
jne 0x14004e2b9
lea r8d, [rsi - 0x5c]
movzx ecx, r11b
and cl, r8b
add cl, cl
movzx r13d, r11b
sub r13b, cl
sub r13b, 0x7c
jmp 0x14004e327
lea rcx, [r9 + 4]
cmp rax, rcx
jne 0x14004e2d0
lea r8d, [rsi + 0x40]
mov edx, reloc.WLDAP32.dll_Ordinal_32
jmp 0x14004e449
lea rcx, [r9 + 7]
cmp rax, rcx
jne 0x14004de33
lea r8d, [rsi + 0x78]
movzx ecx, r11b
and cl, r8b
add cl, cl
movzx r13d, r11b
sub r13b, cl
sub r13b, 0x48
movzx r10d, sil
jmp 0x14004e411
mov byte [rbp + rsi - 0x70], r8b
movzx r13d, r8b
inc rsi
jmp 0x14004daa3
lea r8d, [rsi - 0x50]
movzx ecx, r11b
and cl, r8b
movzx edx, r11b
sub dl, cl
add dl, 0x18
lea r13d, [rdx + rdx]
add r13b, r8b
lea r8d, [rsi - 2]
movzx ecx, r11b
and cl, r8b
mov edx, 7
sub dl, cl
add dl, dl
add dl, r11b
add dl, r8b
add dl, r13b
mov byte [rbp + rsi - 0x70], dl
add rax, r9
jmp 0x14004e3b2
lea r8d, [rsi + 0x4c]
movzx ecx, r11b
and cl, r8b
add cl, cl
movzx r13d, r11b
sub r13b, cl
sub r13b, r11b
sub r13b, 0x14
add r13b, r8b
lea r8d, [rsi - 0x66]
movzx ecx, r11b
and cl, r8b
add cl, cl
movzx edx, r11b
sub dl, cl
sub dl, 0x36
add dl, r8b
movzx ecx, dl
mov byte [rbp + rsi - 0x70], cl
inc r9
add rcx, r9
sub rsi, rcx
jmp 0x14004e489
lea edx, [rsi + 0xe]
movzx ecx, r11b
and cl, dl
add cl, cl
sub r11b, cl
lea r13d, [rdx + r11]
sub r13b, 0x62
movzx ecx, r13b
mov rdx, 0xffffffffffffffff
sub rdx, rcx
add rsi, rdx
inc rsi
jmp 0x14004daa3
lea r8d, [rsi + 0x3a]
mov edx, gethostname
jmp 0x14004e449
lea r8d, [rsi + 2]
movzx ecx, r11b
and cl, r8b
add cl, cl
movzx r13d, r11b
sub r13b, cl
sub r13b, 0xe
movzx r10d, sil
jmp 0x14004e411
movzx r10d, sil
lea r8d, [r10 - 0x36]
mov edx, 0x3d
movzx ecx, r11b
and cl, r8b
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r11b
add r13b, r8b
add r10b, 0x62
movzx ecx, r11b
and cl, r10b
mov edx, reloc.WLDAP32.dll_Ordinal_41
sub dl, cl
add dl, dl
add dl, r11b
add dl, r10b
mov byte [rbp + rsi - 0x70], dl
inc r9
dec rsi
inc rsi
jmp 0x14004daa3
lea r8d, [rsi - 0x6e]
mov edx, 1
movzx ecx, r11b
and cl, r8b
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r11b
add r13b, r8b
dec rsi
inc rsi
jmp 0x14004daa3
movabs rdx, 0xd5085da8db1e786
add rdx, rsi
and r10b, dl
mov ecx, Ordinal_45
sub cl, r10b
lea r13d, [rcx + rcx]
add r13b, r11b
add r13b, dl
lea edx, [rsi - 0x18]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
sub dl, 0x58
add dl, r11b
mov byte [rbp + rsi - 0x70], dl
inc rax
mov rcx, 0xffffffffffffffff
sub rcx, rax
add rsi, rcx
movzx ecx, byte [rbp + rsi - 0x70]
add rcx, r9
add rsi, rcx
inc rsi
jmp 0x14004daa3
movabs rcx, 0xd4c9e9e988378aea
add rcx, rsi
and r10b, cl
add r10b, r10b
sub r11b, r10b
lea r13d, [rcx + r11]
sub r13b, 0x66
movzx ecx, byte [rbp + rsi - 0x70]
add rcx, r9
add rsi, rcx
inc rsi
jmp 0x14004daa3
sub sil, 0x7a
movzx ecx, r11b
and cl, sil
mov edx, Ordinal_45
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r11b
add r13b, sil
jmp 0x14004daa0
sub sil, 0x16
movzx eax, r11b
and al, sil
add al, al
sub r11b, al
lea r13d, [rsi + r11]
sub r13b, 0x66
jmp 0x14004da90
lea rdx, [rbp + 0x15b1bf8]
jmp 0x14004e548
lea rdx, [rbp + 0xd84a46]
jmp 0x14004e548
lea rdx, [rbp - 0x70]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rdx + r8], 0
jne 0x14004e550
lea rcx, [rbp - 0x30]
call fcn.140003110
mov r14, rax
mov dword [rsp + 0x38], 0x3e335852
mov dword [rsp + 0x3c], 0x41232a3e
mov dword [rsp + 0x40], 0x4f203c3f
mov byte [rsp + 0x44], 0xaa
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x45], xmm0
mov dword [rsp + 0x55], eax
mov word [rsp + 0x59], ax
nop word [rax + rax]
mov r8, qword [0x14022c4b8]
mov r9, qword [0x14022c4b0]
nop
mov rsi, r15
cmp rsi, 0x23
jae 0x14004f1ee
movzx r11d, byte [rsp + rsi + 0x38]
mov edx, r11d
cmp r8, rsi
ja 0x14004f1e5
lea rax, [r9 + 1]
cmp r8, rax
jae 0x14004e5fb
movabs rcx, 0x7ef15ca76b7eb3e9
add rcx, rsi
mov rax, rcx
and rax, rdx
imul r12, rax, 0xfffffffffffffffe
add r12, rcx
add r12, rdx
sub r12b, 0x5f
jmp 0x14004e641
je 0x14004f173
inc rax
cmp r8, rax
je 0x14004f0ea
lea rax, [r9 + 3]
cmp r8, rax
je 0x14004f0b9
lea rax, [r9 + 4]
cmp r8, rax
je 0x14004f07e
lea rax, [r9 + 5]
cmp r8, rax
je 0x14004f05b
lea rax, [r9 + 8]
cmp r8, rax
je 0x14004f017
movzx r10d, sil
cmp r9, rsi
ja 0x14004f1dc
lea rax, [r9 + 2]
cmp r8, rax
jae 0x14004e66f
lea ecx, [r10 + 0x1d]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
add r12b, 0x35
jmp 0x14004e6c0
lea rax, [r9 + 1]
cmp r8, rax
je 0x14004efff
inc rax
cmp r8, rax
je 0x14004efdc
lea rax, [r9 + 4]
cmp r8, rax
je 0x14004efbf
lea rax, [r9 + 5]
cmp r8, rax
je 0x14004efa2
lea rax, [r9 + 3]
cmp r8, rax
je 0x14004ef87
lea rax, [r9 + 7]
cmp r8, rax
je 0x14004ef5c
nop dword [rax]
lea rax, [r9 + r8]
cmp rax, rsi
jbe 0x14004ec4b
nop dword [rax]
lea rax, [r9 + 0x20]
cmp r8, rax
je 0x14004ec2b
lea rax, [r9 + 0x200]
cmp r8, rax
je 0x14004ec01
lea rax, [r9 + 0x41]
cmp r8, rax
je 0x14004ebde
lea rax, [r9 + 4]
cmp r8, rax
je 0x14004ebbf
lea rax, [r9 + 0x10]
cmp r8, rax
je 0x14004eb9e
lea rax, [r9 + 0x80]
cmp r8, rax
je 0x14004eb7d
lea rax, [r9 + 0x7a]
cmp r8, rax
je 0x14004eb5e
lea rax, [r9 + 0x400]
cmp r8, rax
je 0x14004eb3e
lea rax, [r9 + 0x2a]
cmp r8, rax
je 0x14004eb0f
lea rax, [r9 + 6]
cmp r8, rax
je 0x14004e6d0
lea r8, [r9 + 1]
lea r9, [r8 + 0x28]
lea rax, [r9 + 8]
cmp r8, rax
jb 0x14004f1bf
lea rax, [r9 + 0x40]
cmp r8, rax
jb 0x14004f1a2
lea rax, [r9 + 0x400]
cmp r8, rax
jb 0x14004e8b9
lea rax, [r9 + 0x2a]
cmp r8, rax
jb 0x14004e89e
lea rax, [r9 + 6]
cmp r8, rax
jb 0x14004e883
lea rax, [r9 + 0x28]
cmp r8, rax
jb 0x14004eabe
lea rax, [r9 + 0x3e8]
cmp r8, rax
jb 0x14004ea74
lea rax, [r9 + 0x5a]
cmp r8, rax
jb 0x14004ea33
lea rax, [r9 + 5]
cmp r8, rax
jb 0x14004ea0e
lea rax, [r9 + 0x20]
cmp r8, rax
jb 0x14004e6d0
lea r8, [r9 + 0x7a]
lea r9, [r8 + 0x200]
lea rax, [r9 + 3]
cmp r8, rax
ja 0x14004e9e3
lea rax, [r9 + 0xa]
cmp r8, rax
ja 0x14004e9c3
lea rax, [r9 + 0x64]
cmp r8, rax
ja 0x14004e9a3
lea rax, [r9 + 0x61]
cmp r8, rax
ja 0x14004e982
lea rcx, [r9 + 2]
cmp r8, rcx
ja 0x14004e965
lea rax, [r9 + 9]
cmp r8, rax
ja 0x14004e946
lea rax, [r9 + 0x42]
cmp r8, rax
ja 0x14004e91f
lea rax, [r9 + 0x1000]
cmp r8, rax
ja 0x14004e8f5
lea rax, [r9 + 1]
cmp r8, rax
ja 0x14004e8d6
lea rax, [r9 + 8]
cmp r8, rax
ja 0x14004e6d0
mov r8, rcx
lea r9, [rcx + 0x40]
jmp 0x14004e6d0
lea ecx, [r10 - 0x7d]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
add r12b, 0x6b
jmp 0x14004e6c0
lea ecx, [r10 - 0x4f]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
add r12b, 0x29
jmp 0x14004e645
sub r10b, 0x21
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea r12d, [r11 + r10]
sub r12b, 0x19
jmp 0x14004e5c6
lea edx, [r10 - 0x18]
movzx eax, r11b
and al, dl
add al, al
movzx r12d, r11b
sub r12b, al
sub r12b, 0x58
add r12b, dl
jmp 0x14004f031
add r10b, 0x16
movzx eax, r11b
and al, r10b
mov ecx, 0x33
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r11b
add r12b, r10b
inc r9
dec rsi
inc rsi
jmp 0x14004e5b3
add r10b, 0x44
movzx eax, r11b
and al, r10b
mov ecx, reloc.WS2_32.dll_select
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r11b
add r12b, r10b
dec rsi
inc rsi
jmp 0x14004e5b3
lea edx, [r10 + 0x72]
movzx eax, r11b
and al, dl
add al, al
movzx r12d, r11b
sub r12b, al
sub r12b, 0x1e
add r12b, dl
jmp 0x14004f098
sub r10b, 0x60
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r12d, [r10 + r11]
sub r12b, 0x60
jmp 0x14004f0ce
sub r10b, 0x32
movzx eax, r11b
and al, r10b
mov ecx, Ordinal_50
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r11b
add r12b, r10b
jmp 0x14004f0d1
lea edx, [r10 - 4]
movzx eax, r11b
and al, dl
mov ecx, recv
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r11b
add r12b, dl
jmp 0x14004f10d
add r10b, 0x2a
movzx eax, r11b
and al, r10b
add al, al
movzx r12d, r11b
sub r12b, al
sub r12b, 0x26
add r12b, r10b
jmp 0x14004f136
add r10b, 0x58
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r12d, [r10 + r11]
sub r12b, 0x68
movzx eax, byte [rsp + rsi + 0x38]
add rax, r9
add rsi, rax
inc rsi
jmp 0x14004e5b3
sub r10b, 0x35
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r12d, [r10 + r11]
add r12b, 0x73
mov byte [rsp + rsi + 0x38], r12b
inc rsi
jmp 0x14004e5b3
lea edx, [r10 - 7]
movzx eax, r11b
and al, dl
add al, al
movzx r12d, r11b
sub r12b, al
add r12b, 0x31
add r12b, dl
cmp r9, 0x28
jb 0x14004ea26
lea edx, [r10 - 0x2a]
movzx eax, r11b
and al, dl
mov ecx, reloc.WS2_32.dll_send
sub cl, al
add cl, cl
add cl, r11b
add cl, dl
lea r12d, [rcx + rcx]
jmp 0x14004f031
lea edx, [r10 + 0x27]
movzx eax, r11b
and al, dl
add al, al
movzx r12d, r11b
sub r12b, al
sub r12b, 0x11
add r12b, dl
cmp r8, 8
jae 0x14004ef1b
lea rax, [r9 + 2]
cmp r8, rax
jbe 0x14004ee14
lea edx, [r10 - 0x5e]
movzx eax, r11b
and al, dl
add al, al
movzx r12d, r11b
sub r12b, al
sub r12b, 0x6e
jmp 0x14004ea4a
lea edx, [r10 + 0x55]
movzx eax, r11b
and al, dl
add al, al
movzx r12d, r11b
sub r12b, al
sub r12b, 0x53
add r12b, dl
lea rax, [r9 + r8]
cmp rax, 0x20
je 0x14004ef3a
lea rax, [r9 + 0x7a]
cmp r8, rax
jbe 0x14004ed71
lea edx, [r10 - 0x7b]
movzx eax, r11b
and al, dl
add al, al
movzx r12d, r11b
sub r12b, al
add r12b, 0x5d
jmp 0x14004ea8b
sub r10b, 0x52
movzx eax, r11b
and al, r10b
mov ecx, Ordinal_35
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r11b
add r12b, r10b
movzx eax, byte [rsp + rsi + 0x38]
add rax, r9
add rsi, rax
inc rsi
jmp 0x14004e5b3
sub r10b, 0x24
movzx eax, r11b
and al, r10b
add al, al
movzx r12d, r11b
sub r12b, al
sub r12b, 4
add r12b, r10b
jmp 0x14004f136
lea edx, [r10 + 0xa]
movzx eax, r11b
and al, dl
add al, al
movzx r12d, r11b
sub r12b, al
sub r12b, 0x46
add r12b, dl
jmp 0x14004f10d
add r10b, 0x38
movzx eax, r11b
and al, r10b
mov ecx, reloc.WLDAP32.dll_Ordinal_60
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r11b
add r12b, r10b
jmp 0x14004f0d1
add r10b, 0x66
movzx eax, r11b
and al, r10b
mov ecx, reloc.WLDAP32.dll_Ordinal_27
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r11b
add r12b, r10b
jmp 0x14004f0ce
lea edx, [r10 - 0x6c]
movzx eax, r11b
and al, dl
add al, al
movzx r12d, r11b
sub r12b, al
sub r12b, 0xc
add r12b, dl
jmp 0x14004f098
sub r10b, 0x3e
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r12d, [r10 + r11]
sub r12b, 0x4e
dec rsi
inc rsi
jmp 0x14004e5b3
sub r10b, 0x10
movzx eax, r11b
and al, r10b
mov ecx, gethostname
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r11b
add r12b, r10b
inc r9
dec rsi
inc rsi
jmp 0x14004e5b3
lea edx, [r10 + 0x1e]
movzx eax, dl
and al, r11b
mov ecx, reloc.WS2_32.dll_socket
sub cl, al
lea r12d, [rcx + rcx]
add r12b, dl
add r12b, r11b
jmp 0x14004f031
lea rax, [r9 + 0x28]
cmp r8, rax
jae 0x14004ec6f
lea ecx, [r10 - 0x17]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0x5f
jmp 0x14004ead8
lea rax, [r9 + 1]
cmp r8, rax
jne 0x14004eca7
add r10b, 0x3a
movzx eax, r10b
and al, r11b
mov ecx, gethostname
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r10b
add r12b, r11b
movzx eax, byte [rsp + rsi + 0x38]
add rax, r9
add rsi, rax
inc rsi
jmp 0x14004e5b3
inc rax
cmp r8, rax
jne 0x14004ecca
lea ecx, [r10 - 0x22]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0x12
jmp 0x14004f10d
lea rax, [r9 + 3]
cmp r8, rax
jne 0x14004ecf4
sub r10b, 0x50
movzx eax, r10b
and al, r11b
mov ecx, Ordinal_26
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r10b
add r12b, r11b
jmp 0x14004f0d1
lea rax, [r9 + 5]
cmp r8, rax
jne 0x14004ed18
lea ecx, [r10 + 0x54]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0x4c
jmp 0x14004f098
lea rax, [r9 + 7]
cmp r8, rax
jne 0x14004ed44
add r10b, 0x26
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea r12d, [r11 + r10]
sub r12b, 0xa
dec rsi
inc rsi
jmp 0x14004e5b3
lea rax, [r9 + 6]
cmp r8, rax
jne 0x14004ead8
lea edx, [r10 - 0x36]
movzx eax, dl
and al, r11b
mov ecx, 0x3d
sub cl, al
lea r12d, [rcx + rcx]
add r12b, dl
add r12b, r11b
jmp 0x14004f031
lea rax, [r9 + 1]
cmp r8, rax
jne 0x14004ed99
lea edx, [r10 + 0x57]
movzx eax, r11b
and al, dl
add al, al
movzx r12d, r11b
sub r12b, al
sub r12b, 0x61
add r12b, dl
jmp 0x14004f031
inc rax
cmp r8, rax
jne 0x14004edc4
sub r10b, 5
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r12d, [r10 + r11]
add r12b, 0x23
dec rsi
inc rsi
jmp 0x14004e5b3
lea rax, [r9 + 3]
cmp r8, rax
jne 0x14004edea
sub r10b, 0x61
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r12d, [r10 + r11]
sub r12b, 0x59
jmp 0x14004f0ce
lea rax, [r9 + 4]
cmp r8, rax
jne 0x14004ea8e
add r10b, 0x71
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r12d, [r10 + r11]
sub r12b, 0x17
jmp 0x14004f0d1
lea rax, [r9 + 1]
cmp r8, rax
jne 0x14004ee48
add r10b, 0x74
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r12d, [r10 + r11]
sub r12b, 0x2c
movzx eax, byte [rsp + rsi + 0x38]
add rax, r9
add rsi, rax
inc rsi
jmp 0x14004e5b3
inc rax
cmp r8, rax
jne 0x14004ee70
lea edx, [r10 + 0x18]
movzx eax, r11b
and al, dl
mov ecx, Ordinal_45
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r11b
add r12b, dl
jmp 0x14004f10d
lea rax, [r9 + 4]
cmp r8, rax
jne 0x14004ee96
sub r10b, 0x44
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r12d, [r10 + r11]
sub r12b, 0x24
jmp 0x14004f0ce
lea rax, [r9 + 5]
cmp r8, rax
jne 0x14004eebf
lea edx, [r10 - 0x72]
movzx eax, r11b
and al, dl
mov ecx, reloc.WS2_32.dll_ntohs
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r11b
add r12b, dl
jmp 0x14004f098
lea rax, [r9 + 3]
cmp r8, rax
jne 0x14004eeef
add r10b, 0x60
movzx eax, r11b
and al, r10b
mov ecx, Ordinal_50
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r11b
add r12b, r10b
dec rsi
inc rsi
jmp 0x14004e5b3
lea rax, [r9 + 7]
cmp r8, rax
jne 0x14004ea4d
lea edx, [r10 + 4]
movzx eax, r11b
and al, dl
add al, al
movzx r12d, r11b
sub r12b, al
sub r12b, 0x1c
add r12b, dl
jmp 0x14004f031
lea edx, [r10 - 0x58]
movzx eax, r11b
and al, dl
movzx ecx, r11b
sub cl, al
add cl, 0x34
lea r12d, [rcx + rcx]
add r12b, dl
jmp 0x14004f098
lea edx, [r10 + 0x7a]
movzx eax, r11b
and al, dl
add al, al
movzx r12d, r11b
sub r12b, al
sub r12b, r11b
sub r12b, 0x56
add r12b, dl
jmp 0x14004f10d
add r10b, 0x7f
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea r12d, [r11 + r10]
sub r12b, 0x79
movzx eax, byte [rsp + rsi + 0x38]
add rax, r9
add rsi, rax
inc rsi
jmp 0x14004e5b3
lea ecx, [r10 - 0x25]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
add r12b, 3
jmp 0x14004f10d
add r10b, 9
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea r12d, [r11 + r10]
sub r12b, 0x3f
jmp 0x14004f0d1
add r10b, 0x37
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea r12d, [r11 + r10]
add r12b, 0x7f
jmp 0x14004f0ce
sub r10b, 0x6d
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea r12d, [r11 + r10]
sub r12b, 5
dec rsi
inc rsi
jmp 0x14004e5b3
lea ecx, [r10 - 0x11]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
add r12b, 0x77
jmp 0x14004f031
movzx r10d, sil
lea ecx, [r10 + 0x4b]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0xd
sub r10b, 0x41
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
sub r11b, 0x39
add r11b, r10b
mov byte [rsp + rsi + 0x38], r11b
inc r9
dec rsi
inc rsi
jmp 0x14004e5b3
lea ecx, [rsi + 0x79]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0x4f
inc r9
dec rsi
inc rsi
jmp 0x14004e5b3
movzx r10d, sil
lea ecx, [r10 - 0x2b]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
add r12b, 0x2d
sub r10b, 0x6f
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
add r11b, 9
add r11b, r10b
add r11b, r12b
mov byte [rsp + rsi + 0x38], r11b
jmp 0x14004f0ce
lea ecx, [rsi + 3]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0x15
add r8, r9
movzx eax, r12b
mov rcx, 0xffffffffffffffff
sub rcx, rax
add rsi, rcx
inc rsi
jmp 0x14004e5b3
movabs rcx, 0x78998893f076eb5f
add rcx, rsi
and dl, cl
add dl, dl
movzx r12d, r11b
sub r12b, dl
add r12b, 0x67
add r12b, cl
movzx r10d, sil
add r10b, 0x63
movzx eax, r11b
and al, r10b
add al, al
movzx ecx, r11b
sub cl, al
add cl, 0x4b
add cl, r10b
movzx eax, cl
mov byte [rsp + rsi + 0x38], al
inc r9
add rax, r9
sub rsi, rax
lea ecx, [rsi + 0x4c]
movzx eax, r11b
and al, cl
add al, al
sub r11b, al
sub r11b, 0x14
add r11b, cl
mov byte [rsp + rsi + 0x38], r11b
inc r8
mov rax, 0xffffffffffffffff
sub rax, r8
add rsi, rax
movzx eax, byte [rsp + rsi + 0x38]
add rax, r9
add rsi, rax
inc rsi
jmp 0x14004e5b3
movabs rax, 0x7cd415f6427c1bbb
add rax, rsi
and dl, al
add dl, dl
sub r11b, dl
lea r12d, [rax + r11]
sub r12b, 0x1d
movzx eax, byte [rsp + rsi + 0x38]
add rax, r9
add rsi, rax
inc rsi
jmp 0x14004e5b3
add r10b, 0xd
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r12d, [r10 + r11]
sub r12b, 0x5b
jmp 0x14004e5b0
add r10b, 0x3b
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r12d, [r10 + r11]
add r12b, 0x63
jmp 0x14004e5a0
lea rdx, [rbp + 0x160dfc4]
jmp 0x14004f1f3
lea rdx, [rbp + 0x11f93ad]
jmp 0x14004f1f3
lea rdx, [rsp + 0x38]
xor r8d, r8d
lea rcx, [rbp - 8]
call fcn.1400056b0
mov r9, r14
mov r8d, recv
mov rdx, rax
lea rcx, [rbp - 8]
call fcn.140058a60
nop
lea rcx, [rbp - 0x30]
call fcn.140002820
lea rcx, [rbp - 8]
cmp qword [rbp + 0x10], 0xf
cmova rcx, qword [rbp - 8]
xor edx, edx
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov r11, rax
mov eax, 0x5a4d
cmp word [r11], ax
jne 0x14004f360
movsxd rcx, dword [r11 + 0x3c]
cmp dword [rcx + r11], 0x4550
jne 0x14004f360
mov edx, dword [rcx + r11 + 0x88]
test edx, edx
je 0x14004f360
mov esi, dword [rdx + r11 + 0x1c]
lea r14, [r11 + rsi]
mov r9d, dword [rdx + r11 + 0x20]
add r9, r11
mov r15d, dword [rdx + r11 + 0x24]
add r15, r11
xor r10d, r10d
test esi, esi
je 0x14004f2c3
nop dword [rax]
mov r8d, dword [r9]
add r8, r11
mov rax, qword [rbp - 0x38]
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x14004f2b3
inc rax
test ecx, ecx
jne 0x14004f2a0
test edx, edx
je 0x14004f333
inc r10d
add r9, 4
cmp r10d, esi
jb 0x14004f290
lea rcx, [rbp - 8]
call fcn.140002820
mov r14, qword [rsp + 0x28]
xor r15d, r15d
lea rcx, [rbp + 0x18]
call fcn.140002820
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov rsi, qword [rbp - 0x78]
cmp eax, dword [rsi]
jb 0x14004cf90
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rcx, qword [rbp + 0x38]
xor rcx, rsp
call fcn.140196270
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
movsxd rax, r10d
movzx ecx, word [r15 + rax*2]
mov r15d, dword [r14 + rcx*4]
xor edx, edx
mov r8d, 0x8000
mov rcx, qword [rbp - 0x78]
cmp byte [rsp + 0x20], dl
jne 0x14004f359
mov rax, qword [rbp - 0x48]
add r15, qword [rax + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
lea rcx, [rbp - 8]
call fcn.140002820
nop
lea rcx, [rbp + 0x18]
call fcn.140002820
mov rax, r15
jmp 0x14004f306