Function at 0x140100420
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call
Parse pe header
Query environment variable
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov rax, qword [0x1401dc800]
xor rax, rsp
mov qword [rbp + 0x30], rax
mov qword [rbp - 0x40], rdx
mov qword [rbp - 0x48], rcx
xor r14d, r14d
mov esi, r14d
mov qword [rbp - 0x80], r14
mov dword [rbp - 0x18], r14d
lea r9, [rbp - 0x18]
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x1401004cb
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp - 0x18]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
lea r9, [rbp - 0x18]
mov r8d, dword [rbp - 0x18]
mov rdx, rax
mov ecx, listen
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x140100481
mov qword [rbp - 0x80], rsi
test eax, eax
js 0x140102ad3
mov eax, r14d
mov dword [rsp + 0x2c], eax
cmp dword [rsi], r14d
jbe 0x140102ad3
movzx edi, byte [rsp + 0x28]
movzx ebx, byte [rsp + 0x28]
movzx r12d, byte [rsp + 0x28]
movzx r15d, byte [rsp + 0x28]
mov qword [rsp + 0x20], r15
movzx r13d, byte [rsp + 0x28]
nop dword [rax]
nop dword [rax + rax]
imul rcx, rax, 0x128
lea rax, [rcx + rsi]
mov qword [rbp - 0x50], rax
movzx eax, word [rax + 0x2e]
add rax, rcx
add rsi, rax
movzx edx, dil
lea rcx, [rbp + 0x10]
call fcn.1400029f0
nop
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rsi + r8 + 0x30], 0
jne 0x140100540
lea rdx, [rsi + 0x30]
lea rcx, [rbp + 0x10]
call fcn.140004460
nop
lea rcx, [rbp + 0x10]
call fcn.140001bc0
mov rdx, qword [rbp - 0x48]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x140102ab4
mov rdx, qword [rbp - 0x50]
add rdx, 0x30
lea rcx, [rbp - 0x10]
call fcn.1400042d0
nop
mov dword [rsp + 0x58], 0x7769706b
mov dword [rsp + 0x5c], 0x60646069
mov word [rsp + 0x60], 0x7d67
mov byte [rsp + 0x62], Ordinal_211
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x63], xmm0
mov qword [rsp + 0x73], rax
nop dword [rax]
nop dword [rax + rax]
mov r8, qword [0x1402304a8]
mov r9, qword [0x1402304a0]
nop
mov rsi, r14
cmp rsi, 0x23
jae 0x1401011f8
movzx r11d, byte [rsp + rsi + 0x58]
movzx r10d, r11b
cmp r8, rsi
ja 0x1401011ef
lea rax, [r9 + 1]
cmp r8, rax
jae 0x14010061c
movabs rcx, 0xff450b9f068fa3e4
add rcx, rsi
mov rax, rcx
and rax, r11
imul r12, rax, 0xfffffffffffffffe
add r12, rcx
add r12, r11
sub r12b, 0x3c
jmp 0x140100662
je 0x140101171
inc rax
cmp r8, rax
je 0x1401010ec
lea rax, [r9 + 3]
cmp r8, rax
je 0x1401010ac
lea rax, [r9 + 4]
cmp r8, rax
je 0x14010105e
lea rax, [r9 + 5]
cmp r8, rax
je 0x14010102c
lea rax, [r9 + 8]
cmp r8, rax
je 0x140100fdd
movzx r10d, r11b
cmp r9, rsi
ja 0x1401011e6
lea rax, [r9 + 2]
cmp r8, rax
jae 0x14010069e
movabs rcx, 0xf0a9f40b89c871b4
add rcx, rsi
movzx eax, cl
and al, r11b
mov edx, 0xa
sub dl, al
lea r12d, [rdx + rdx]
add r12b, cl
add r12b, r10b
jmp 0x1401006f0
lea rax, [r9 + 1]
cmp r8, rax
je 0x140100fbc
inc rax
cmp r8, rax
je 0x140100f92
lea rax, [r9 + 4]
cmp r8, rax
je 0x140100f6e
lea rax, [r9 + 5]
cmp r8, rax
je 0x140100f45
lea rax, [r9 + 3]
cmp r8, rax
je 0x140100f21
lea rax, [r9 + 7]
cmp r8, rax
je 0x140100eef
nop dword [rax + rax]
lea rax, [r9 + r8]
cmp rax, rsi
jbe 0x140100c39
nop dword [rax]
lea rax, [r9 + 0x400]
cmp r8, rax
je 0x140100c1a
lea rax, [r9 + 0x2a]
cmp r8, rax
je 0x140100bf7
lea rax, [r9 + 6]
cmp r8, rax
je 0x140100bd2
lea rax, [r9 + 0x28]
cmp r8, rax
je 0x140100cef
lea rax, [r9 + 0x3e8]
cmp r8, rax
je 0x140100bb3
lea rax, [r9 + 0x5a]
cmp r8, rax
je 0x140100b99
lea rax, [r9 + 5]
cmp r8, rax
je 0x140100b7a
lea rax, [r9 + 0x20]
cmp r8, rax
je 0x140100b60
lea rax, [r9 + 0x200]
cmp r8, rax
je 0x140100b33
lea rax, [r9 + 0x41]
cmp r8, rax
je 0x140100700
lea r8, [r9 + 1]
lea r9, [r8 + 4]
lea rax, [r9 + 8]
cmp r8, rax
jb 0x1401011c5
lea rax, [r9 + 0x40]
cmp r8, rax
jb 0x1401011a8
lea rax, [r9 + 0x400]
cmp r8, rax
jb 0x14010090b
lea rax, [r9 + 0x2a]
cmp r8, rax
jb 0x1401008e7
lea rax, [r9 + 6]
cmp r8, rax
jb 0x1401008be
lea rax, [r9 + 0x28]
cmp r8, rax
jb 0x140100ae2
lea rax, [r9 + 0x3e8]
cmp r8, rax
jb 0x140100abe
lea rax, [r9 + 0x5a]
cmp r8, rax
jb 0x140100a74
lea rax, [r9 + 5]
cmp r8, rax
jb 0x140100a52
lea rax, [r9 + 0x20]
cmp r8, rax
jb 0x140100700
lea r8, [r9 + 0x42]
lea r9, [r8 + 0x200]
lea rax, [r9 + 0x1000]
cmp r8, rax
ja 0x140100a25
lea rax, [r9 + 1]
cmp r8, rax
ja 0x140100a0b
lea rax, [r9 + 8]
cmp r8, rax
ja 0x1401009ec
lea rax, [r9 + 0x40]
cmp r8, rax
ja 0x1401009d2
lea rax, [r9 + 0x400]
cmp r8, rax
ja 0x1401009b5
lea rax, [r9 + 0x2a]
cmp r8, rax
ja 0x140100996
lea rax, [r9 + 6]
cmp r8, rax
ja 0x140100976
lea rax, [r9 + 0x28]
cmp r8, rax
ja 0x14010094e
lea rax, [r9 + 0x3e8]
cmp r8, rax
ja 0x140100934
lea rax, [r9 + 0x5a]
cmp r8, rax
ja 0x140100700
lea r8, [r9 + 2]
lea r9, [r8 + 5]
jmp 0x140100700
movabs rcx, 0x9a7d4f588ffdfccc
add rcx, rsi
movzx eax, cl
and al, r11b
mov edx, gethostname
sub dl, al
lea r12d, [rdx + rdx]
add r12b, cl
add r12b, r10b
jmp 0x1401006f0
movabs rcx, 0x9bf3381a82deb504
add rcx, rsi
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r10 + rcx]
sub r12b, 0x1c
jmp 0x140100666
movabs rcx, 0x9d6920dc75bf6d3c
add rcx, rsi
movzx eax, cl
and al, r11b
mov edx, reloc.WLDAP32.dll_Ordinal_46
sub dl, al
lea r12d, [rdx + rdx]
add r12b, cl
add r12b, r10b
jmp 0x1401005e7
lea ecx, [rsi - 0x60]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0x60
jmp 0x140101004
lea edx, [rsi - 0x28]
movzx eax, dl
and al, r11b
mov ecx, recv
sub cl, al
lea r12d, [rcx + rcx]
add r12b, dl
add r12b, r11b
inc r9
dec rsi
inc rsi
jmp 0x1401005d3
lea ecx, [rsi + 0x10]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0x70
dec rsi
inc rsi
jmp 0x1401005d3
lea edx, [rsi + 0x48]
movzx eax, dl
and al, r11b
mov ecx, 4
sub cl, al
lea r12d, [rcx + rcx]
add r12b, dl
add r12b, r11b
jmp 0x140101085
lea ecx, [rsi + 0x80]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
add r12b, 0x80
jmp 0x1401010d0
lea ecx, [rsi - 0x48]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 8
jmp 0x1401010d3
lea edx, [rsi - 0x10]
movzx eax, dl
and al, r11b
mov ecx, gethostname
sub cl, al
lea r12d, [rcx + rcx]
add r12b, dl
add r12b, r11b
jmp 0x140101114
lea ecx, [rsi + 0x28]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0x18
jmp 0x140101137
lea edx, [rsi + 0x60]
movzx eax, dl
and al, r11b
mov ecx, Ordinal_50
sub cl, al
lea r12d, [rcx + rcx]
add r12b, dl
add r12b, r11b
movzx eax, byte [rsp + rsi + 0x58]
add rax, r9
add rsi, rax
inc rsi
jmp 0x1401005d3
lea ecx, [rsi - 0x14]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0x74
mov byte [rsp + rsi + 0x58], r12b
inc rsi
jmp 0x1401005d3
lea edx, [rsi + 0x24]
movzx eax, dl
and al, r11b
mov ecx, 2
sub cl, al
lea r12d, [rcx + rcx]
add r12b, dl
add r12b, r11b
movzx r10d, sil
cmp r9, 0x1000
jb 0x140100a67
sub r10b, 0x28
movzx eax, r10b
and al, r11b
mov ecx, recv
sub cl, al
add cl, cl
add cl, r10b
add cl, r11b
lea r12d, [rcx + rcx]
jmp 0x140101004
movzx r10d, sil
lea edx, [r10 + 0x5c]
movzx eax, dl
and al, r11b
mov ecx, 0x3e
sub cl, al
lea r12d, [rcx + rcx]
add r12b, dl
add r12b, r11b
jmp 0x140100dde
lea ecx, [rsi - 0x6c]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0xc
lea rax, [r9 + r8]
cmp rax, 0x400
je 0x140100ed6
lea rax, [r9 + 0x7a]
cmp r8, rax
jbe 0x140100d3a
movzx r10d, sil
lea ecx, [r10 + 0x54]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0x4c
jmp 0x140100dde
lea edx, [rsi + 0x38]
movzx eax, dl
and al, r11b
mov ecx, reloc.WLDAP32.dll_Ordinal_60
sub cl, al
lea r12d, [rcx + rcx]
add r12b, dl
add r12b, r11b
movzx eax, byte [rsp + rsi + 0x58]
add rax, r9
add rsi, rax
inc rsi
jmp 0x1401005d3
lea ecx, [rsi + 0x70]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0x10
jmp 0x140101137
lea edx, [rsi - 0x58]
movzx eax, dl
and al, r11b
mov ecx, 0x34
sub cl, al
lea r12d, [rcx + rcx]
add r12b, dl
add r12b, r11b
jmp 0x140101114
lea ecx, [rsi - 0x20]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0x20
jmp 0x1401010d3
lea edx, [rsi + 0x18]
movzx eax, dl
and al, r11b
mov ecx, Ordinal_45
sub cl, al
lea r12d, [rcx + rcx]
add r12b, dl
add r12b, r11b
jmp 0x1401010d0
lea edx, [rsi - 0x78]
movzx eax, dl
and al, r11b
mov ecx, 0x24
sub cl, al
lea r12d, [rcx + rcx]
add r12b, dl
add r12b, r11b
dec rsi
inc rsi
jmp 0x1401005d3
lea ecx, [rsi - 0x40]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0x40
inc r9
dec rsi
inc rsi
jmp 0x1401005d3
lea edx, [rsi - 8]
movzx eax, dl
and al, r11b
mov ecx, Ordinal_30
sub cl, al
lea r12d, [rcx + rcx]
add r12b, dl
add r12b, r11b
jmp 0x140101004
lea rax, [r9 + 0x28]
cmp r8, rax
jae 0x140100c66
movabs rcx, 0xff450b9f068fa3e4
add rcx, rsi
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r10 + rcx]
sub r12b, 0x3c
jmp 0x140100af7
lea rax, [r9 + 1]
cmp r8, rax
jne 0x140100c9c
lea edx, [rsi + 0x68]
movzx eax, dl
and al, r11b
mov ecx, reloc.WS2_32.dll_sendto
sub cl, al
lea r12d, [rcx + rcx]
add r12b, dl
add r12b, r11b
movzx eax, byte [rsp + rsi + 0x58]
add rax, r9
add rsi, rax
inc rsi
jmp 0x1401005d3
inc rax
cmp r8, rax
jne 0x140100cbe
lea ecx, [rsi + 0x30]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0x50
jmp 0x140101137
lea rax, [r9 + 3]
cmp r8, rax
jne 0x140100ce6
lea edx, [rsi - 8]
movzx eax, dl
and al, r11b
mov ecx, Ordinal_30
sub cl, al
lea r12d, [rcx + rcx]
add r12b, dl
add r12b, r11b
jmp 0x140101114
lea rax, [r9 + 5]
cmp r8, rax
jne 0x140100d0e
movzx r10d, sil
lea ecx, [r10 + 0x50]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0x30
jmp 0x140101089
lea rax, [r9 + 2]
cmp r8, rax
jne 0x140100af7
lea edx, [rsi - 0x58]
movzx eax, dl
and al, r11b
mov ecx, 0x34
sub cl, al
lea r12d, [rcx + rcx]
add r12b, dl
add r12b, r11b
jmp 0x140101004
lea rax, [r9 + 1]
cmp r8, rax
jne 0x140100d62
lea edx, [rsi + 0x1c]
movzx eax, dl
and al, r11b
mov ecx, reloc.WLDAP32.dll_Ordinal_30
sub cl, al
lea r12d, [rcx + rcx]
add r12b, dl
add r12b, r11b
jmp 0x140101004
inc rax
cmp r8, rax
jne 0x140100d8f
lea edx, [rsi - 0x54]
movzx eax, dl
and al, r11b
mov ecx, Ordinal_41
sub cl, al
lea r12d, [rcx + rcx]
add r12b, dl
add r12b, r11b
dec rsi
inc rsi
jmp 0x1401005d3
lea rax, [r9 + 3]
cmp r8, rax
jne 0x140100db7
lea edx, [rsi + 0x3c]
movzx eax, dl
and al, r11b
mov ecx, reloc.WLDAP32.dll_Ordinal_46
sub cl, al
lea r12d, [rcx + rcx]
add r12b, dl
add r12b, r11b
jmp 0x1401010d0
lea rax, [r9 + 4]
cmp r8, rax
jne 0x140100dda
lea ecx, [rsi + 4]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0x1c
jmp 0x1401010d3
movzx r10d, sil
cmp r8, 8
jae 0x140100eb8
lea rax, [r9 + 0x10]
cmp r8, rax
jbe 0x140100e0c
lea ecx, [r10 + 8]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0x38
jmp 0x140100a92
lea rcx, [r9 + 1]
cmp r8, rcx
jne 0x140100e44
sub r10b, 0x30
movzx eax, r10b
and al, r11b
mov ecx, Ordinal_41
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r10b
add r12b, r11b
movzx eax, byte [rsp + rsi + 0x58]
add rax, r9
add rsi, rax
inc rsi
jmp 0x1401005d3
lea rax, [r9 + 3]
cmp r8, rax
jne 0x140100e6a
add r10b, 0x28
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea r12d, [r11 + r10]
sub r12b, 0x18
jmp 0x1401010d3
lea rax, [rcx + 1]
cmp r8, rax
jne 0x140100e8e
lea ecx, [r10 - 0x48]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 8
jmp 0x140101089
lea rax, [r9 + 4]
cmp r8, rax
jne 0x140100a92
add r10b, 0x10
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea r12d, [r11 + r10]
sub r12b, 0x70
jmp 0x140101004
lea ecx, [r10 - 0x60]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0x60
add r12b, r11b
jmp 0x140101089
lea edx, [rsi + 0x68]
movzx eax, dl
and al, r11b
mov ecx, reloc.WS2_32.dll_sendto
sub cl, al
lea r12d, [rcx + rcx]
jmp 0x140101111
movabs rcx, 0xe384c539ffe1f7bc
add rcx, rsi
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r10 + rcx]
sub r12b, 0x24
movzx eax, byte [rsp + rsi + 0x58]
add rax, r9
add rsi, rax
inc rsi
jmp 0x1401005d3
movabs rcx, 0xe67096bde5a3682c
add rcx, rsi
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r10 + rcx]
sub r12b, 0x34
jmp 0x140101114
movabs rcx, 0xe7e67f7fd8842064
add rcx, rsi
movzx eax, cl
and al, r11b
mov edx, Ordinal_35
sub dl, al
lea r12d, [rdx + rdx]
add r12b, cl
add r12b, r10b
jmp 0x1401010d3
movabs rcx, 0xe95c6841cb64d89c
add rcx, rsi
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r10 + rcx]
sub r12b, 0x44
jmp 0x1401010d0
movabs rcx, 0xec4839c5b126490c
add rcx, rsi
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r10 + rcx]
sub r12b, 0x54
dec rsi
inc rsi
jmp 0x1401005d3
movabs rcx, 0xef340b4996e7b97c
add rcx, rsi
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r10 + rcx]
sub r12b, 0x64
jmp 0x140101004
movabs rdx, 0xf21fdccd7ca929ec
add rdx, rsi
movzx eax, dl
and al, r11b
add al, al
movzx r12d, r10b
sub r12b, al
sub r12b, 0x74
add r12b, dl
movzx r11d, r10b
lea ecx, [rsi - 0x44]
movzx eax, r11b
and al, cl
add al, al
sub r11b, al
sub r11b, 0x24
add r11b, cl
mov byte [rsp + rsi + 0x58], r11b
inc r9
dec rsi
inc rsi
jmp 0x1401005d3
movabs rdx, 0xf395c58f6f89e224
add rdx, rsi
movzx eax, dl
and al, r11b
mov ecx, 2
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r10b
add r12b, dl
inc r9
dec rsi
inc rsi
jmp 0x1401005d3
movabs rdx, 0xf6819713554b5294
add rdx, rsi
movzx eax, dl
and al, r11b
add al, al
movzx r12d, r10b
sub r12b, al
sub r12b, 0xc
add r12b, dl
movzx r11d, r10b
movzx r10d, sil
sub r10b, 0x7c
movzx eax, r11b
and al, r10b
mov ecx, reloc.WLDAP32.dll_Ordinal_50
sub cl, al
add cl, cl
add cl, r11b
add cl, r12b
add cl, r10b
mov byte [rsp + rsi + 0x58], cl
jmp 0x1401010d0
movabs rdx, 0xf7f77fd5482c0acc
add rdx, rsi
movzx eax, dl
and al, r11b
mov ecx, gethostname
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r10b
add r12b, dl
add r8, r9
movzx eax, r12b
mov rcx, 0xffffffffffffffff
sub rcx, rax
add rsi, rcx
inc rsi
jmp 0x1401005d3
movabs rdx, 0xfae351592ded7b3c
add rdx, rsi
movzx eax, dl
and al, r11b
mov ecx, reloc.WLDAP32.dll_Ordinal_46
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r10b
movzx r11d, r10b
add r12b, dl
lea ecx, [rsi + 0x4c]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
sub cl, 0x14
add cl, r11b
movzx eax, cl
mov byte [rsp + rsi + 0x58], al
inc r9
add rax, r9
sub rsi, rax
lea ecx, [rsi + 0x30]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
sub cl, 0x50
add cl, r11b
mov byte [rsp + rsi + 0x58], cl
inc r8
mov rax, 0xffffffffffffffff
sub rax, r8
add rsi, rax
movzx eax, byte [rsp + rsi + 0x58]
add rax, r9
add rsi, rax
inc rsi
jmp 0x1401005d3
movabs rdx, 0xfdcf22dd13aeebac
add rdx, rsi
movzx eax, dl
and al, r11b
mov ecx, Ordinal_41
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r10b
add r12b, dl
movzx eax, byte [rsp + rsi + 0x58]
add rax, r9
add rsi, rax
inc rsi
jmp 0x1401005d3
add sil, 0x74
movzx eax, r11b
and al, sil
add al, al
sub r11b, al
lea r12d, [rsi + r11]
sub r12b, 0x2c
jmp 0x1401005d0
sub sil, 0x54
movzx eax, sil
and al, r11b
mov ecx, Ordinal_41
sub cl, al
lea r12d, [rcx + rcx]
add r12b, sil
add r12b, r11b
jmp 0x1401005c0
lea rcx, [rbp + 0x1421c88]
jmp 0x1401011fd
lea rcx, [rbp + 0x51c06c]
jmp 0x1401011fd
lea rcx, [rsp + 0x58]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rsi, rax
movzx edx, bl
lea rcx, [rbp - 0x38]
call fcn.1400029f0
nop
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rsi + r8], 0
jne 0x140101220
mov rdx, rsi
lea rcx, [rbp - 0x38]
call fcn.140004460
nop
mov word [rbp - 0x78], 0xcd68
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x76], xmm0
movups xmmword [rbp - 0x66], xmm0
mov byte [rbp - 0x56], al
nop dword [rax]
mov rax, qword [0x1402304a8]
mov r10, qword [0x1402304a0]
nop
cmp r14, 0x23
jae 0x140101dc0
movzx r11d, byte [rbp + r14 - 0x78]
mov esi, r11d
cmp rax, r14
ja 0x140101db7
lea rcx, [r10 + 1]
cmp rax, rcx
jae 0x1401012ad
movabs rdx, 0x1e81019185b46ee2
add rdx, r14
mov rcx, rdx
and rcx, rsi
imul r15, rcx, 0xfffffffffffffffe
add r15, rdx
add r15, rsi
sub r15b, 0x2e
mov qword [rsp + 0x20], r15
jmp 0x1401012f3
je 0x140101d21
inc rcx
cmp rax, rcx
je 0x140101c8e
lea rcx, [r10 + 4]
cmp rax, rcx
je 0x140101c4e
lea rcx, [r10 + 3]
cmp rax, rcx
je 0x140101c27
lea rcx, [r10 + 5]
cmp rax, rcx
je 0x140101bde
lea rcx, [r10 + 6]
cmp rax, rcx
je 0x140101b8f
movzx r9d, r14b
cmp r10, r14
ja 0x140101dae
lea rcx, [r10 + 0x5a]
cmp rax, rcx
jae 0x140101317
lea r8d, [r9 - 0x76]
mov edx, Ordinal_30
jmp 0x1401014f9
lea rcx, [r10 + 1]
cmp rax, rcx
je 0x140101b77
lea rcx, [r10 + 3]
cmp rax, rcx
je 0x140101b48
lea rcx, [r10 + 2]
cmp rax, rcx
je 0x140101b27
nop
lea rcx, [r10 + rax]
cmp rcx, r14
jbe 0x140101866
nop dword [rax]
lea rcx, [r10 + 5]
cmp rax, rcx
je 0x140101847
lea rcx, [r10 + 2]
cmp rax, rcx
je 0x140101819
lea rcx, [r10 + 0x64]
cmp rax, rcx
je 0x1401017ee
lea rcx, [r10 + 3]
cmp rax, rcx
je 0x1401017cf
lea rcx, [r10 + 0x80]
cmp rax, rcx
je 0x1401017a7
lea rcx, [r10 + 0x40]
cmp rax, rcx
je 0x140101786
lea rcx, [r10 + 1]
cmp rax, rcx
je 0x140101767
lea rcx, [r10 + 0x42]
cmp rax, rcx
je 0x14010174a
lea rcx, [r10 + 0x5a]
cmp rax, rcx
je 0x140101350
lea rax, [r10 + 0x3e8]
lea r10, [rax + 0x28]
lea rcx, [r10 + 6]
cmp rax, rcx
jb 0x140101d85
lea rcx, [r10 + 0x400]
cmp rax, rcx
jb 0x140101d5c
lea rcx, [r10 + 8]
cmp rax, rcx
jb 0x14010153c
lea rcx, [r10 + 4]
cmp rax, rcx
jb 0x140101516
lea rcx, [r10 + 0x200]
cmp rax, rcx
jb 0x1401014f0
lea rcx, [r10 + 5]
cmp rax, rcx
jb 0x1401016bb
lea rcx, [r10 + 0x3e8]
cmp rax, rcx
jb 0x1401016b0
lea rcx, [r10 + 0x64]
cmp rax, rcx
jb 0x14010166b
lea rcx, [r10 + 3]
cmp rax, rcx
jb 0x140101641
lea rcx, [r10 + 0x80]
cmp rax, rcx
jb 0x140101350
lea rax, [r10 + 0x10]
lea r10, [rax + 4]
lea rcx, [r10 + 0x41]
cmp rax, rcx
ja 0x140101624
lea rcx, [r10 + 0x1000]
cmp rax, rcx
ja 0x140101616
lea rcx, [r10 + 9]
cmp rax, rcx
ja 0x1401015fb
lea rcx, [r10 + 0x61]
cmp rax, rcx
ja 0x1401015de
lea rcx, [r10 + 0xa]
cmp rax, rcx
ja 0x1401015b2
lea rcx, [r10 + 6]
cmp rax, rcx
ja 0x140101597
lea rcx, [r10 + 0x400]
cmp rax, rcx
ja 0x14010156c
lea rcx, [r10 + 8]
cmp rax, rcx
ja 0x14010155e
lea rcx, [r10 + 0x200]
cmp rax, rcx
ja 0x140101350
lea rax, [r10 + 0x20]
lea r10, [rax + 5]
jmp 0x140101350
lea r8d, [r9 - 0x4a]
mov edx, 3
movzx ecx, r8b
and cl, r11b
sub dl, cl
lea r15d, [rdx + rdx]
add r15b, r8b
add r15b, r11b
mov qword [rsp + 0x20], r15
jmp 0x140101340
lea r8d, [r9 - 0xe]
movzx ecx, r8b
and cl, r11b
mov edx, Ordinal_50
sub dl, cl
lea r15d, [rdx + rdx]
add r15b, r8b
add r15b, r11b
mov qword [rsp + 0x20], r15
jmp 0x1401012f7
add r9b, 0x2e
movzx ecx, r9b
and cl, r11b
add cl, cl
sub r9b, cl
lea r15d, [r11 + r9]
sub r15b, 0x42
mov qword [rsp + 0x20], r15
jmp 0x140101273
sub r9b, 0x74
mov edx, reloc.WLDAP32.dll_Ordinal_22
jmp 0x140101975
sub r9b, 0x38
movzx ecx, r9b
and cl, r11b
add cl, cl
sub r9b, cl
lea r8d, [r11 + r9]
sub r8b, 0x78
mov qword [rsp + 0x20], r8
dec r14
mov r15, r8
inc r14
jmp 0x140101260
lea edx, [r9 + 4]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
sub r8b, 0x1c
jmp 0x140101bf8
add r9b, 0x40
movzx ecx, r9b
and cl, r11b
mov edx, reloc.WLDAP32.dll_Ordinal_32
sub dl, cl
lea r8d, [rdx + rdx]
add r8b, r9b
add r8b, r11b
mov qword [rsp + 0x20], r8
add rax, r10
mov r15, r8
jmp 0x140101c75
add r9b, 0x7c
movzx ecx, r9b
and cl, r11b
add cl, cl
sub r9b, cl
lea r15d, [r11 + r9]
sub r15b, 0x64
jmp 0x140101c70
lea edx, [r9 - 0x48]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
sub r8b, 8
jmp 0x140101cb3
sub r9b, 0xc
mov edx, Ordinal_45
jmp 0x140101b30
add r9b, 0x30
movzx ecx, r9b
and cl, r11b
add cl, cl
sub r9b, cl
lea r15d, [r11 + r9]
sub r15b, 0x50
jmp 0x140101d43
sub r9b, 0x3a
movzx ecx, r9b
and cl, r11b
add cl, cl
sub r9b, cl
lea r15d, [r11 + r9]
sub r15b, 0x6a
mov qword [rsp + 0x20], r15
mov byte [rbp + r14 - 0x78], r15b
inc r14
jmp 0x140101260
lea edx, [r9 + 2]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r15d, [r11 + rdx]
sub r15b, 0xe
mov qword [rsp + 0x20], r15
cmp r10, 3
jb 0x14010165e
lea edx, [r9 + 0xc]
movzx ecx, dl
and cl, r11b
mov r8d, reloc.WLDAP32.dll_Ordinal_22
sub r8b, cl
add r8b, r8b
add r8b, dl
add r8b, r11b
add r8b, r8b
jmp 0x140101ba9
lea r8d, [r9 + 0x3e]
mov edx, Ordinal_41
jmp 0x1401016fa
lea edx, [r9 + 0x7a]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r15d, [r11 + rdx]
sub r15b, 0x56
mov qword [rsp + 0x20], r15
lea rcx, [r10 + rax]
cmp rcx, 0x10
je 0x140101b10
lea rdx, [r10 + 4]
cmp rax, rdx
jbe 0x140101940
lea r8d, [r9 - 0x26]
mov edx, 5
movzx ecx, r8b
and cl, r11b
sub dl, cl
lea r15d, [rdx + rdx]
add r15b, r8b
add r15b, r11b
mov qword [rsp + 0x20], r15
cmp rax, 2
jae 0x140101af2
lea rcx, [r10 + 0x61]
cmp rax, rcx
jbe 0x140101a1d
lea r8d, [r9 + 0x64]
movzx ecx, r8b
and cl, r11b
mov edx, Ordinal_35
sub dl, cl
lea r15d, [rdx + rdx]
add r15b, r8b
add r15b, r11b
jmp 0x140101681
add r9b, 0x78
movzx ecx, r9b
and cl, r11b
add cl, cl
sub r9b, cl
lea r8d, [r11 + r9]
sub r8b, 0x48
jmp 0x140101cdc
lea r8d, [r9 - 0x4c]
movzx ecx, r8b
and cl, r11b
mov edx, 0xa
sub dl, cl
add dl, dl
add r8b, dl
add r8b, r11b
jmp 0x140101cb3
sub r9b, 0x10
movzx ecx, r9b
and cl, r11b
mov edx, gethostname
sub dl, cl
lea r15d, [rdx + rdx]
add r15b, r9b
add r15b, r11b
jmp 0x140101c70
add r9b, 0x2c
movzx ecx, r9b
and cl, r11b
add cl, cl
sub r9b, cl
lea r8d, [r11 + r9]
sub r8b, 0x34
mov qword [rsp + 0x20], r8
add rax, r10
mov r15, r8
jmp 0x140101c75
lea r8d, [r9 + 0x68]
movzx ecx, r8b
and cl, r11b
mov edx, reloc.WS2_32.dll_sendto
sub dl, cl
add dl, dl
add r8b, dl
add r8b, r11b
jmp 0x140101bf8
sub r9b, 0x5c
movzx ecx, r9b
and cl, r11b
add cl, cl
sub r9b, cl
lea r8d, [r11 + r9]
sub r8b, 0x7c
mov qword [rsp + 0x20], r8
dec r14
mov r15, r8
inc r14
jmp 0x140101260
sub r9b, 0x20
movzx ecx, r9b
and cl, r11b
add cl, cl
sub r9b, cl
lea r8d, [r11 + r9]
sub r8b, 0x20
inc r10
mov qword [rsp + 0x20], r8
dec r14
mov r15, r8
inc r14
jmp 0x140101260
lea r8d, [r9 + 0x1c]
movzx ecx, r8b
and cl, r11b
mov edx, reloc.WLDAP32.dll_Ordinal_30
sub dl, cl
add dl, dl
add r8b, dl
add r8b, r11b
jmp 0x140101ba9
lea rcx, [r10 + 0x7a]
cmp rax, rcx
jae 0x14010188a
lea edx, [r9 - 0x1e]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r15d, [r11 + rdx]
sub r15b, 0x2e
jmp 0x1401016d1
lea rcx, [r10 + 1]
cmp rax, rcx
jne 0x1401018b4
add r9b, 0x14
movzx ecx, r9b
and cl, r11b
mov edx, Ordinal_60
sub dl, cl
lea r15d, [rdx + rdx]
add r15b, r9b
add r15b, r11b
jmp 0x140101d43
inc rcx
cmp rax, rcx
jne 0x1401018d7
lea edx, [r9 - 0x64]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
sub r8b, 0x44
jmp 0x140101cb3
lea rcx, [r10 + 3]
cmp rax, rcx
jne 0x140101901
add r9b, 0x60
movzx ecx, r9b
and cl, r11b
mov edx, Ordinal_50
sub dl, cl
lea r15d, [rdx + rdx]
add r15b, r9b
add r15b, r11b
jmp 0x140101c70
lea rcx, [r10 + 6]
cmp rax, rcx
jne 0x140101918
sub r9b, 0x54
mov edx, Ordinal_41
jmp 0x140101b51
lea rcx, [r10 + 2]
cmp rax, rcx
jne 0x1401016d6
lea edx, [r9 + 0x34]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
sub r8b, 0x6c
jmp 0x140101ba9
lea rcx, [r10 + 1]
cmp rax, rcx
jne 0x140101964
lea edx, [r9 - 0x62]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
sub r8b, 0x52
jmp 0x140101ba9
inc rcx
cmp rax, rcx
jne 0x14010199e
add r9b, 0x62
mov edx, reloc.WLDAP32.dll_Ordinal_41
movzx ecx, r9b
and cl, r11b
sub dl, cl
lea r8d, [rdx + rdx]
add r8b, r9b
add r8b, r11b
inc r10
mov qword [rsp + 0x20], r8
dec r14
mov r15, r8
inc r14
jmp 0x140101260
cmp rax, rdx
jne 0x1401019cf
sub r9b, 0x52
movzx ecx, r9b
and cl, r11b
mov edx, Ordinal_35
sub dl, cl
lea r8d, [rdx + rdx]
add r8b, r9b
add r8b, r11b
mov qword [rsp + 0x20], r8
add rax, r10
mov r15, r8
jmp 0x140101c75
lea rcx, [r10 + 3]
cmp rax, rcx
jne 0x1401019f5
add r9b, 0x72
movzx ecx, r9b
and cl, r11b
add cl, cl
sub r9b, cl
lea r15d, [r11 + r9]
sub r15b, 0x1e
jmp 0x140101c70
lea rcx, [r10 + 5]
cmp rax, rcx
jne 0x140101712
lea edx, [r9 + 0x36]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
sub r8b, 0x7a
jmp 0x140101cb3
lea rcx, [r10 + 1]
cmp rax, rcx
jne 0x140101a43
add r9b, 0x28
movzx ecx, r9b
and cl, r11b
add cl, cl
sub r9b, cl
lea r15d, [r11 + r9]
sub r15b, 0x18
jmp 0x140101d43
inc rcx
cmp rax, rcx
jne 0x140101a6a
lea r8d, [r9 - 0x50]
movzx ecx, r8b
and cl, r11b
mov edx, Ordinal_26
sub dl, cl
add dl, dl
add r8b, dl
add r8b, r11b
jmp 0x140101cb3
lea rcx, [r10 + 3]
cmp rax, rcx
jne 0x140101a92
lea r8d, [r9 - 4]
movzx ecx, r8b
and cl, r11b
mov edx, recv
sub dl, cl
add dl, dl
add r8b, dl
add r8b, r11b
jmp 0x140101bf8
lea rcx, [r10 + 6]
cmp rax, rcx
jne 0x140101ac6
sub r9b, 0x40
movzx ecx, r9b
and cl, r11b
add cl, cl
sub r9b, cl
lea r8d, [r11 + r9]
sub r8b, 0x40
mov qword [rsp + 0x20], r8
dec r14
mov r15, r8
inc r14
jmp 0x140101260
lea rcx, [r10 + 7]
cmp rax, rcx
jne 0x140101686
lea r8d, [r9 + 0x48]
movzx ecx, r8b
and cl, r11b
mov edx, 4
sub dl, cl
add dl, dl
add r8b, dl
add r8b, r11b
jmp 0x140101ba9
lea r8d, [r9 - 0x30]
movzx ecx, r8b
and cl, r11b
movzx edx, r11b
sub dl, cl
add dl, 0x28
add dl, dl
add r8b, dl
jmp 0x140101bf8
lea edx, [r9 - 0x6c]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [rdx - 0xc]
jmp 0x140101cb3
sub r9b, 0x56
mov edx, reloc.WLDAP32.dll_Ordinal_45
movzx ecx, r9b
and cl, r11b
sub dl, cl
lea r8d, [rdx + rdx]
add r8b, r9b
add r8b, r11b
jmp 0x140101cdc
sub r9b, 0x2a
mov edx, reloc.WS2_32.dll_send
movzx ecx, r9b
and cl, r11b
sub dl, cl
lea r8d, [rdx + rdx]
add r8b, r9b
add r8b, r11b
mov qword [rsp + 0x20], r8
dec r14
mov r15, r8
inc r14
jmp 0x140101260
lea edx, [r9 + 0x4e]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
sub r8b, 0x22
jmp 0x140101ba9
movzx r9d, r14b
lea edx, [r9 - 0x3a]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
sub r8b, 0x6a
sub r9b, 0x12
movzx ecx, r9b
and cl, r11b
mov edx, 0x3f
sub dl, cl
add dl, dl
add dl, r9b
add dl, r11b
mov byte [rbp + r14 - 0x78], dl
inc r10
mov qword [rsp + 0x20], r8
dec r14
mov r15, r8
inc r14
jmp 0x140101260
movzx r9d, r14b
lea edx, [r9 + 0x7a]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
sub r8b, 0x56
sub r9b, 0x4e
movzx ecx, r9b
and cl, r11b
mov edx, reloc.WS2_32.dll_recvfrom
sub dl, cl
add dl, dl
add dl, r9b
add dl, r11b
add dl, r8b
mov byte [rbp + r14 - 0x78], dl
mov qword [rsp + 0x20], r8
add rax, r10
mov r15, r8
jmp 0x140101c75
lea r8d, [r14 - 0x4a]
movzx ecx, r8b
and cl, r11b
mov edx, 3
sub dl, cl
add dl, dl
add r8b, dl
add r8b, r11b
mov qword [rsp + 0x20], r8
add rax, r10
mov r15, r8
jmp 0x140101c75
movabs rdx, 0x12890e1db357e5f2
add rdx, r14
and sil, dl
mov ecx, Ordinal_50
sub cl, sil
lea r15d, [rcx + rcx]
add r15b, r11b
add r15b, dl
mov qword [rsp + 0x20], r15
movzx ecx, r15b
mov rdx, 0xffffffffffffffff
sub rdx, rcx
add r14, rdx
inc r14
jmp 0x140101260
movabs rdx, 0xd5870afaa7ef082e
add rdx, r14
and sil, dl
add sil, sil
movzx r8d, r11b
sub r8b, sil
sub r8b, 0x42
add r8b, dl
movzx r9d, r14b
add r9b, 0x76
movzx ecx, r9b
and cl, r11b
add cl, cl
sub r9b, cl
sub r9b, 0x3a
add r9b, r11b
movzx ecx, r9b
mov byte [rbp + r14 - 0x78], cl
inc r10
add rcx, r10
sub r14, rcx
mov qword [rsp + 0x20], r8
lea edx, [r14 + 0x58]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
sub dl, 0x68
add dl, r11b
mov byte [rbp + r14 - 0x78], dl
inc rax
mov rcx, 0xffffffffffffffff
sub rcx, rax
add r14, rcx
mov r15, r8
movzx ecx, byte [rbp + r14 - 0x78]
add rcx, r10
add r14, rcx
inc r14
jmp 0x140101260
movabs rdx, 0x5b8304b4911d4ca6
add rdx, r14
and sil, dl
mov ecx, Ordinal_60
sub cl, sil
lea r15d, [rcx + rcx]
add r15b, r11b
add r15b, dl
mov qword [rsp + 0x20], r15
movzx ecx, byte [rbp + r14 - 0x78]
add rcx, r10
add r14, rcx
inc r14
jmp 0x140101260
add r9b, 0x6a
movzx ecx, r9b
and cl, r11b
mov edx, reloc.WS2_32.dll_listen
sub dl, cl
lea r15d, [rdx + rdx]
add r15b, r9b
add r15b, r11b
mov qword [rsp + 0x20], r15
xor r14d, r14d
jmp 0x140101260
sub r9b, 0x5a
movzx eax, r9b
and al, r11b
mov ecx, Ordinal_60
sub cl, al
lea r15d, [rcx + rcx]
add r15b, r9b
add r15b, r11b
mov qword [rsp + 0x20], r15
xor r14d, r14d
jmp 0x140101250
lea rdx, [rbp + 0x17a7f60]
jmp 0x140101dc4
lea rdx, [rbp + 0x12eee42]
jmp 0x140101dc4
lea rdx, [rbp - 0x78]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140101dd0
lea rcx, [rbp - 0x38]
call fcn.140003110
mov r15, rax
mov dword [rsp + 0x30], 0x646b3a30
mov dword [rsp + 0x34], 0x415b5464
mov dword [rsp + 0x38], 0x476e6667
mov byte [rsp + 0x3c], 0xf8
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x3d], xmm0
mov dword [rsp + 0x4d], eax
mov word [rsp + 0x51], ax
nop word [rax + rax]
mov r8, qword [0x1402304a8]
mov r9, qword [0x1402304a0]
nop
xor esi, esi
mov r14d, esi
cmp r14, 0x23
jae 0x1401029c3
movzx r11d, byte [rsp + r14 + 0x30]
mov esi, r11d
nop dword [rax + rax]
cmp r8, r14
ja 0x1401029ba
lea rax, [r9 + 1]
cmp r8, rax
jae 0x140101e85
movabs rcx, 0xd5871ab68893b13e
add rcx, r14
mov rax, rcx
and rax, rsi
imul r13, rax, 0xfffffffffffffffe
add r13, rcx
add r13, rsi
add r13b, 0x4e
jmp 0x140101ecb
je 0x140102945
inc rax
cmp r8, rax
je 0x1401028b9
lea rax, [r9 + 3]
cmp r8, rax
je 0x140102882
lea rax, [r9 + 4]
cmp r8, rax
je 0x140102862
lea rax, [r9 + 7]
cmp r8, rax
je 0x140102839
lea rax, [r9 + 8]
cmp r8, rax
je 0x1401027ee
movzx r10d, r14b
nop
cmp r9, r14
ja 0x1401029b1
lea rax, [r9 + 5]
cmp r8, rax
jae 0x140101eff
lea edx, [r10 + 0x16]
movzx eax, dl
and al, r11b
mov ecx, 0x33
sub cl, al
lea r13d, [rcx + rcx]
add r13b, dl
add r13b, r11b
jmp 0x140101f30
lea rax, [r9 + 1]
cmp r8, rax
je 0x1401027d4
lea rax, [r9 + 4]
cmp r8, rax
je 0x1401027b0
lea rax, [r9 + 3]
cmp r8, rax
je 0x14010278f
nop word [rax + rax]
lea rax, [r9 + r8]
cmp rax, r14
jbe 0x1401024a9
nop dword [rax]
lea rax, [r9 + 0x41]
cmp r8, rax
je 0x14010248d
lea rax, [r9 + 2]
cmp r8, rax
je 0x140102463
lea rax, [r9 + 6]
cmp r8, rax
je 0x140102440
lea rax, [r9 + 1]
cmp r8, rax
je 0x140102426
lea rax, [r9 + 5]
cmp r8, rax
je 0x140102406
lea rcx, [r9 + 0xa]
cmp r8, rcx
je 0x1401023e9
lea rax, [r9 + 4]
cmp r8, rax
je 0x1401023c9
lea rax, [r9 + 9]
cmp r8, rax
je 0x1401023a9
lea rax, [r9 + 0x28]
cmp r8, rax
je 0x140102379
lea rax, [r9 + 8]
cmp r8, rax
je 0x140101f40
mov r8, rcx
lea r9, [rcx + 0x20]
lea rax, [r9 + 0x40]
cmp rcx, rax
jb 0x140102994
lea rax, [r9 + 0x200]
cmp rcx, rax
jb 0x140102977
lea rax, [r9 + 0x28]
cmp rcx, rax
jb 0x140102126
lea rax, [r9 + 0x80]
cmp rcx, rax
jb 0x14010210b
lea rax, [r9 + 0x1000]
cmp rcx, rax
jb 0x1401020eb
lea rax, [r9 + 0x64]
cmp rcx, rax
jb 0x140102328
lea rax, [r9 + 0x400]
cmp rcx, rax
jb 0x1401022de
lea rax, [r9 + 0x41]
cmp rcx, rax
jb 0x14010229c
lea rax, [r9 + 0x3e8]
cmp rcx, rax
jb 0x140102277
lea rax, [r9 + 0x7a]
cmp rcx, rax
jb 0x140101f40
lea r8, [r9 + 0x5a]
lea r9, [r8 + 1]
lea rax, [r9 + 0x400]
cmp r8, rax
ja 0x140102247
lea rax, [r9 + 0x41]
cmp r8, rax
ja 0x140102227
lea rax, [r9 + 2]
cmp r8, rax
ja 0x140102208
lea rax, [r9 + 0x7a]
cmp r8, rax
ja 0x1401021e7
lea rax, [r9 + 1]
cmp r8, rax
ja 0x1401021c7
lea rcx, [r9 + 5]
cmp r8, rcx
ja 0x1401021ad
lea rax, [r9 + 0x2a]
cmp r8, rax
ja 0x14010218a
lea rax, [r9 + 4]
cmp r8, rax
ja 0x140102164
lea rax, [r9 + 9]
cmp r8, rax
ja 0x140102147
lea rax, [r9 + 3]
cmp r8, rax
ja 0x140101f40
mov r8, rcx
lea r9, [rcx + 8]
jmp 0x140101f40
lea edx, [r10 - 0x56]
movzx eax, dl
and al, r11b
mov ecx, reloc.WLDAP32.dll_Ordinal_45
sub cl, al
lea r13d, [rcx + rcx]
add r13b, dl
add r13b, r11b
jmp 0x140101f30
lea ecx, [r10 + 0x2e]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r13d, [r11 + rcx]
sub r13b, 0x42
jmp 0x140101ed0
sub r10b, 0x4e
movzx eax, r10b
and al, r11b
mov ecx, reloc.WS2_32.dll_recvfrom
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r10b
add r13b, r11b
jmp 0x140101e50
lea edx, [r10 - 0x50]
movzx eax, r11b
and al, dl
mov ecx, Ordinal_26
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r11b
jmp 0x140102809
add r10b, 0x34
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r13d, [r10 + r11]
sub r13b, 0x6c
inc r9
dec r14
inc r14
jmp 0x140101e35
sub r10b, 0x48
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r13d, [r10 + r11]
sub r13b, 8
dec r14
inc r14
jmp 0x140101e35
lea edx, [r10 + 0x3c]
movzx eax, r11b
and al, dl
mov ecx, reloc.WLDAP32.dll_Ordinal_46
sub cl, al
lea r13d, [rcx + rcx]
jmp 0x140102745
sub r10b, 0x40
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r13d, [r10 + r11]
sub r13b, 0x40
add r8, r9
jmp 0x1401028a0
add r10b, 0x44
movzx eax, r11b
and al, r10b
mov ecx, reloc.WS2_32.dll_select
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r11b
add r13b, r10b
jmp 0x1401028a0
lea edx, [r10 - 0x38]
movzx eax, r11b
and al, dl
add al, al
movzx r13d, r11b
sub r13b, al
sub r13b, 0x78
add r13b, dl
jmp 0x1401028df
add r10b, 0x4c
movzx eax, r11b
and al, r10b
add al, al
movzx r13d, r11b
sub r13b, al
sub r13b, 0x14
add r13b, r10b
jmp 0x140102908
sub r10b, 0x30
movzx eax, r11b
and al, r10b
mov ecx, Ordinal_41
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r11b
add r13b, r10b
movzx eax, byte [rsp + r14 + 0x30]
add rax, r9
add r14, rax
inc r14
jmp 0x140101e35
sub r10b, 0x66
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r13d, [r10 + r11]
sub r13b, 0x36
mov byte [rsp + r14 + 0x30], r13b
inc r14
jmp 0x140101e35
lea edx, [r10 + 0x1e]
movzx eax, r11b
and al, dl
mov ecx, reloc.WS2_32.dll_socket
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r11b
add r13b, dl
cmp r9, 0x2a
jb 0x14010228f
lea edx, [r10 - 0x4c]
movzx eax, r11b
and al, dl
mov ecx, 0xa
sub cl, al
add cl, cl
add cl, r11b
add cl, dl
lea r13d, [rcx + rcx]
jmp 0x14010280c
lea edx, [r10 - 0x5e]
movzx eax, r11b
and al, dl
add al, al
movzx r13d, r11b
sub r13b, al
sub r13b, 0x6e
add r13b, dl
cmp r8, 0x10
jae 0x14010272e
lea rax, [r9 + 0x28]
cmp r8, rax
jbe 0x140102656
lea edx, [r10 - 0x24]
movzx eax, r11b
and al, dl
add al, al
movzx r13d, r11b
sub r13b, al
sub r13b, 4
jmp 0x1401022b4
lea edx, [r10 + 0x26]
movzx eax, r11b
and al, dl
add al, al
movzx r13d, r11b
sub r13b, al
sub r13b, 0xa
add r13b, dl
lea rax, [r9 + r8]
cmp rax, 4
je 0x140102772
lea rax, [r9 + 6]
cmp r8, rax
jbe 0x1401025ad
lea edx, [r10 - 0x3a]
movzx eax, r11b
and al, dl
add al, al
movzx r13d, r11b
sub r13b, al
sub r13b, 0x6a
jmp 0x1401022f5
sub r10b, 0x7c
movzx eax, r11b
and al, r10b
mov ecx, reloc.WLDAP32.dll_Ordinal_50
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r11b
add r13b, r10b
movzx eax, byte [rsp + r14 + 0x30]
add rax, r9
add r14, rax
inc r14
jmp 0x140101e35
add r10b, 8
movzx eax, r11b
and al, r10b
add al, al
movzx r13d, r11b
sub r13b, al
sub r13b, 0x38
add r13b, r10b
jmp 0x140102908
lea edx, [r10 - 0x74]
movzx eax, r11b
and al, dl
mov ecx, reloc.WLDAP32.dll_Ordinal_22
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r11b
add r13b, dl
jmp 0x1401028df
add r10b, 0x10
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r13d, [r10 + r11]
sub r13b, 0x70
jmp 0x1401028a0
sub r10b, 0x6c
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r13d, [r10 + r11]
sub r13b, 0xc
add r8, r9
jmp 0x1401028a0
lea edx, [r10 + 0x18]
movzx eax, r11b
and al, dl
mov ecx, Ordinal_45
sub cl, al
lea r13d, [rcx + rcx]
jmp 0x140102745
sub r10b, 0x64
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r13d, [r10 + r11]
sub r13b, 0x44
dec r14
inc r14
jmp 0x140101e35
add r10b, 0x20
movzx eax, r11b
and al, r10b
mov ecx, reloc.WS2_32.dll_recv
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r11b
add r13b, r10b
inc r9
dec r14
inc r14
jmp 0x140101e35
lea edx, [r10 - 0x5c]
movzx eax, r11b
and al, dl
add al, al
movzx r13d, r11b
sub r13b, al
sub r13b, 0x7c
jmp 0x140102809
lea rax, [r9 + 0x3e8]
cmp r8, rax
jae 0x1401024d2
lea edx, [r10 + 0x3e]
movzx eax, r11b
and al, dl
mov ecx, Ordinal_41
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r11b
jmp 0x14010233f
lea rax, [r9 + 1]
cmp r8, rax
jne 0x140102507
add r10b, 0x2c
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r13d, [r10 + r11]
sub r13b, 0x34
movzx eax, byte [rsp + r14 + 0x30]
add rax, r9
add r14, rax
inc r14
jmp 0x140101e35
inc rax
cmp r8, rax
jne 0x14010252f
lea edx, [r10 + 0x24]
movzx eax, r11b
and al, dl
mov ecx, 2
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r11b
add r13b, dl
jmp 0x1401028df
lea rax, [r9 + 3]
cmp r8, rax
jne 0x140102554
lea edx, [r10 - 0x68]
movzx eax, r11b
and al, dl
add al, al
movzx r13d, r11b
sub r13b, al
sub r13b, 0x28
jmp 0x140102748
lea rax, [r9 + 2]
cmp r8, rax
jne 0x140102584
add r10b, 0x14
movzx eax, r11b
and al, r10b
mov ecx, Ordinal_60
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r11b
add r13b, r10b
dec r14
inc r14
jmp 0x140101e35
lea rax, [r9 + 7]
cmp r8, rax
jne 0x140102342
lea edx, [r10 + 0xc]
movzx eax, r11b
and al, dl
add al, al
movzx r13d, r11b
sub r13b, al
sub r13b, 0x54
jmp 0x140102809
lea rax, [r9 + 1]
cmp r8, rax
jne 0x1401025d3
lea edx, [r10 + 0x42]
movzx eax, r11b
and al, dl
mov ecx, Ordinal_26
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r11b
jmp 0x140102809
inc rax
cmp r8, rax
jne 0x140102601
sub r10b, 0x42
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r13d, [r10 + r11]
sub r13b, 0x32
inc r9
dec r14
inc r14
jmp 0x140101e35
lea rax, [r9 + 5]
cmp r8, rax
jne 0x14010262a
add r10b, 0x32
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r13d, [r10 + r11]
sub r13b, 0x5e
add r8, r9
jmp 0x1401028a0
lea rax, [r9 + 2]
cmp r8, rax
jne 0x1401022f8
lea edx, [r10 + 0x2a]
movzx eax, r11b
and al, dl
add al, al
movzx r13d, r11b
sub r13b, al
sub r13b, 0x26
add r13b, dl
jmp 0x1401028df
lea rax, [r9 + 1]
cmp r8, rax
jne 0x14010268b
add r10b, 0x58
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r13d, [r10 + r11]
sub r13b, 0x68
movzx eax, byte [rsp + r14 + 0x30]
add rax, r9
add r14, rax
inc r14
jmp 0x140101e35
inc rax
cmp r8, rax
jne 0x1401026b2
lea edx, [r10 + 0x50]
movzx eax, r11b
and al, dl
add al, al
movzx r13d, r11b
sub r13b, al
sub r13b, 0x30
add r13b, dl
jmp 0x1401028df
lea rax, [r9 + 5]
cmp r8, rax
jne 0x1401026d4
lea edx, [r10 - 0x3c]
movzx eax, r11b
and al, dl
add al, al
movzx r13d, r11b
sub r13b, al
sub r13b, 0x5c
jmp 0x140102748
lea rax, [r9 + 4]
cmp r8, rax
jne 0x140102704
add r10b, 0x40
movzx eax, r11b
and al, r10b
mov ecx, reloc.WLDAP32.dll_Ordinal_32
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r11b
add r13b, r10b
dec r14
inc r14
jmp 0x140101e35
lea rax, [r9 + 8]
cmp r8, rax
jne 0x1401022b7
lea edx, [r10 + 0x38]
movzx eax, r11b
and al, dl
mov ecx, reloc.WLDAP32.dll_Ordinal_60
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r11b
jmp 0x140102809
lea edx, [r10 + 0x30]
movzx eax, r11b
and al, dl
add al, al
movzx r13d, r11b
sub r13b, al
sub r13b, 0x50
add r13b, r11b
add r13b, dl
add r10b, 0x6e
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
sub r11b, 2
add r11b, r10b
add r11b, r13b
mov byte [rsp + r14 + 0x30], r11b
add r8, r9
jmp 0x1401028a0
lea edx, [r10 - 0x54]
movzx eax, r11b
and al, dl
mov ecx, Ordinal_41
sub cl, al
lea r13d, [rcx + rcx]
add r13b, dl
jmp 0x1401028df
sub r10b, 2
movzx eax, r11b
and al, r10b
mov ecx, 7
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r11b
add r13b, r10b
jmp 0x1401028a0
sub r10b, 0x7e
movzx eax, r11b
and al, r10b
mov ecx, reloc.WS2_32.dll_gethostname
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r11b
add r13b, r10b
add r8, r9
jmp 0x1401028a0
lea edx, [r10 - 0x6e]
movzx eax, r11b
and al, dl
mov ecx, 1
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r11b
jmp 0x140102809
movzx r10d, r14b
lea edx, [r10 - 0x66]
movzx eax, r11b
and al, dl
add al, al
movzx r13d, r11b
sub r13b, al
sub r13b, 0x36
add r13b, dl
sub r10b, 0xe
movzx eax, r11b
and al, r10b
mov ecx, Ordinal_50
sub cl, al
add cl, cl
add cl, r11b
add cl, r10b
mov byte [rsp + r14 + 0x30], cl
inc r9
dec r14
inc r14
jmp 0x140101e35
lea edx, [r14 + 0x1e]
movzx eax, r11b
and al, dl
mov ecx, reloc.WS2_32.dll_socket
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r11b
add r13b, dl
inc r9
dec r14
inc r14
jmp 0x140101e35
lea edx, [r14 - 0x56]
movzx eax, dl
and al, r11b
mov ecx, reloc.WLDAP32.dll_Ordinal_45
sub cl, al
lea r13d, [rcx + rcx]
add r13b, dl
add r13b, r11b
add r8, r9
jmp 0x1401028a0
movabs rax, 0x81bff06acd313b2e
add rax, r14
and sil, al
add sil, sil
sub r11b, sil
lea r13d, [rax + r11]
sub r13b, 0x42
movzx eax, r13b
mov rcx, 0xffffffffffffffff
sub rcx, rax
add r14, rcx
inc r14
jmp 0x140101e35
movabs rcx, 0xd6b1bafdbc09d8b2
add rcx, r14
and sil, cl
mov eax, reloc.WS2_32.dll_recvfrom
sub al, sil
lea r13d, [rax + rax]
add r13b, r11b
add r13b, cl
movzx r10d, r14b
sub r10b, 0x16
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
sub r10b, 0x66
add r10b, r11b
movzx eax, r10b
mov byte [rsp + r14 + 0x30], al
inc r9
add rax, r9
sub r14, rax
lea ecx, [r14 + 0x28]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
sub cl, 0x18
add cl, r11b
mov byte [rsp + r14 + 0x30], cl
inc r8
mov rax, 0xffffffffffffffff
sub rax, r8
add r14, rax
movzx eax, byte [rsp + r14 + 0x30]
add rax, r9
add r14, rax
inc r14
jmp 0x140101e35
movabs rax, 0x8095502399bb13ba
add rax, r14
and sil, al
add sil, sil
sub r11b, sil
lea r13d, [rax + r11]
sub r13b, 0x16
movzx eax, byte [rsp + r14 + 0x30]
add rax, r9
add r14, rax
inc r14
jmp 0x140101e35
add r10b, 0x36
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r13d, [r10 + r11]
sub r13b, 0x7a
jmp 0x140101e30
sub r10b, 0x46
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r13d, [r10 + r11]
sub r13b, 0x16
jmp 0x140101e20
lea rdx, [rbp + 0x17b14d8]
jmp 0x1401029c8
lea rdx, [rbp + 0xcec616]
jmp 0x1401029c8
lea rdx, [rsp + 0x30]
xor r8d, r8d
lea rcx, [rbp - 0x10]
call fcn.1400056b0
mov r9, r15
mov r8d, recv
mov rdx, rax
lea rcx, [rbp - 0x10]
call fcn.140058ee0
nop
lea rcx, [rbp - 0x38]
call fcn.140002820
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 0xf
cmova rcx, qword [rbp - 0x10]
xor edx, edx
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov r11, rax
mov eax, 0x5a4d
cmp word [r11], ax
jne 0x140102b3b
movsxd rcx, dword [r11 + 0x3c]
cmp dword [rcx + r11], 0x4550
jne 0x140102b3b
mov edx, dword [rcx + r11 + 0x88]
test edx, edx
je 0x140102b3b
mov esi, dword [rdx + r11 + 0x1c]
lea r14, [r11 + rsi]
mov r9d, dword [rdx + r11 + 0x20]
add r9, r11
mov r15d, dword [rdx + r11 + 0x24]
add r15, r11
xor r10d, r10d
test esi, esi
je 0x140102aa3
nop dword [rax]
nop word [rax + rax]
mov r8d, dword [r9]
add r8, r11
mov rax, qword [rbp - 0x40]
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140102a93
inc rax
test ecx, ecx
jne 0x140102a80
test edx, edx
je 0x140102b13
inc r10d
add r9, 4
cmp r10d, esi
jb 0x140102a70
lea rcx, [rbp - 0x10]
call fcn.140002820
mov r15, qword [rsp + 0x20]
xor r14d, r14d
lea rcx, [rbp + 0x10]
call fcn.140002820
mov eax, dword [rsp + 0x2c]
inc eax
mov dword [rsp + 0x2c], eax
mov rsi, qword [rbp - 0x80]
cmp eax, dword [rsi]
jb 0x140100510
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.14019b1d0
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
movsxd rax, r10d
movzx ecx, word [r15 + rax*2]
mov esi, dword [r14 + rcx*4]
mov rax, qword [rbp - 0x50]
add rsi, qword [rax + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x140102b3d
xor esi, esi
lea rcx, [rbp - 0x10]
call fcn.140002820
nop
lea rcx, [rbp + 0x10]
call fcn.140002820
mov rax, rsi
jmp 0x140102ae6
mov rcx, qword [rdx]
mov rax, r8
xor r8d, r8d
mov rdx, qword [rax]
jmp 0x140100420