Function at 0x1400f28d0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x1f0
mov qword [rsp + 0xc0], 0xfffffffffffffffe
mov rax, qword [0x1402de400]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
mov r12d, r8d
mov r9, rdx
mov r13, rcx
mov rsi, qword [rsp + 0x250]
test rsi, rsi
je case.0x1400f2973.3
mov ebx, dword [rsi + 0x10]
cmp ebx, 1
jb case.0x1400f2973.3
mov rsi, qword [rsi + 8]
xor ebp, ebp
mov edi, ebp
mov rdx, rbx
cmp rbx, 1
jb 0x1400f2941
movzx eax, byte [rsi]
mov edi, 1
jmp 0x1400f2945
mov al, byte [rsp + 0x40]
movzx eax, al
add eax, 0xfffffffe
cmp eax, 0xfd
ja case.0x1400f2973.3
cdqe
lea r8, [0x140000000]
movzx eax, byte [r8 + rax + 0xf3370]
mov ecx, dword [r8 + rax*4 + 0xf333c]
add rcx, r8
jmp rcx
mov r8d, edi
add r8, rsi
lea ecx, [rdi + 1]
cmp ecx, ebx
ja case.0x1400f2973.3
nop word [rax + rax]
mov eax, edi
inc edi
inc ecx
cmp byte [rax + rsi], bpl
je 0x1400f29a5
cmp ecx, ebx
jbe 0x1400f2990
jmp case.0x1400f2973.3
lea rcx, [r13 + 0x158]
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov edx, r12d
call fcn.1400f9840
jmp case.0x1400f2973.3
cmp dword [0x1402e2b58], ebp
jne case.0x1400f2973.3
movzx r11d, byte [r13 + 0x25a]
movzx ebx, byte [r13 + 0x25b]
lea rax, [rdi + 1]
cmp rax, rdx
ja 0x1400f2a09
movzx eax, byte [rdi + rsi]
inc edi
test al, al
je 0x1400f2a09
cmp al, 1
jne case.0x1400f2973.3
lea rcx, [r13 - 0x58]
call fcn.1400eb3a0
jmp case.0x1400f2973.3
lea rax, [rdi + 1]
cmp rax, rdx
ja 0x1400f2a18
mov r11b, byte [rdi + rsi]
inc edi
lea rax, [rdi + 1]
cmp rax, rdx
ja 0x1400f2a26
mov bl, byte [rdi + rsi]
inc edi
lea rax, [rdi + 2]
cmp rax, rdx
ja 0x1400f2a41
movzx r9d, word [rdi + rsi]
mov word [0x1402de2d4], r9w
add edi, 2
jmp 0x1400f2a49
mov r9w, word [0x1402de2d4]
lea rax, [rdi + 1]
cmp rax, rdx
ja 0x1400f2a62
movzx r8d, byte [rdi + rsi]
mov byte [reloc.WS2_32.dll_accept], r8b
inc edi
jmp 0x1400f2a69
mov r8b, byte [reloc.WS2_32.dll_accept]
mov ecx, edi
lea rax, [rdi + 1]
cmp rax, rdx
ja 0x1400f2a82
movzx ecx, byte [rdi + rsi]
mov byte [reloc.WS2_32.dll_htonl], cl
inc edi
jmp 0x1400f2a88
mov cl, byte [reloc.WS2_32.dll_htonl]
lea rax, [rdi + 4]
cmp rax, rdx
ja 0x1400f2a9e
mov r10d, dword [rdi + rsi]
mov dword [0x1402de2d8], r10d
jmp 0x1400f2aa5
mov r10d, dword [0x1402de2d8]
movzx eax, cl
movzx edi, r8b
movzx r9d, r9w
movzx r8d, bl
movzx edx, r11b
lea rcx, [r13 - 0x58]
mov dword [rsp + 0x30], r10d
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], edi
call fcn.1400eded0
jmp case.0x1400f2973.3
cmp dword [0x1402e2b58], ebp
jne case.0x1400f2973.3
mov ebp, edi
add rbp, rsi
lea ecx, [rdi + 1]
cmp ecx, ebx
ja case.0x1400f2973.3
nop
mov eax, edi
inc edi
inc ecx
cmp byte [rax + rsi], 0
je 0x1400f2b05
cmp ecx, ebx
jbe 0x1400f2af0
jmp case.0x1400f2973.3
lea r8, str.gotohttp.ck
mov edx, 0x104
lea rcx, [rsp + 0xd0]
call fcn.140004450
lea rdx, [0x14029d034]
lea rcx, [rsp + 0xd0]
call fcn.1401e696c
mov rbx, rax
test rax, rax
je case.0x1400f2973.3
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbp
repne scasb al, byte [rdi]
not rcx
lea rdx, [rcx - 1]
mov r9, rbx
lea r8d, [rax + 1]
mov rcx, rbp
call fcn.1401e6b44
mov rcx, rbx
call fcn.1401e67bc
jmp case.0x1400f2973.3
cmp dword [0x1402e2b58], ebp
jne case.0x1400f2973.3
lea rcx, [r13 - 0x58]
mov r8d, r12d
mov rdx, r9
call fcn.1400f1230
jmp case.0x1400f2973.3
mov rdx, rbp
mov r12d, edi
add r12, rsi
lea ecx, [rdi + 1]
cmp ecx, ebx
ja 0x1400f2bd5
nop dword [rax]
mov eax, edi
inc edi
inc ecx
cmp byte [rax + rsi], dl
je 0x1400f2bb1
cmp ecx, ebx
jbe 0x1400f2ba0
jmp 0x1400f2bd5
mov edx, edi
add rdx, rsi
lea ecx, [rdi + 1]
cmp ecx, ebx
ja 0x1400f2bd0
nop dword [rax]
mov eax, edi
inc edi
inc ecx
cmp byte [rax + rsi], bpl
je 0x1400f2bd8
cmp ecx, ebx
jbe 0x1400f2bc0
mov rdx, rbp
jmp 0x1400f2bd8
mov r12, rbp
mov rcx, rdx
call fcn.140001cb0
mov r8d, eax
lea rcx, [r13 - 0x58]
mov rdx, r12
call fcn.1400eb2e0
jmp case.0x1400f2973.3
lea rcx, [r13 + 0x158]
mov edx, r12d
call fcn.1400f7600
jmp case.0x1400f2973.3
mov r12d, edi
add r12, rsi
lea ecx, [rdi + 1]
cmp ecx, ebx
ja case.0x1400f2973.3
nop dword [rax]
mov eax, edi
inc edi
inc ecx
cmp byte [rax + rsi], bpl
je 0x1400f2c35
cmp ecx, ebx
jbe 0x1400f2c20
jmp case.0x1400f2973.3
lea rcx, [rsp + 0x48]
call fcn.140004b60
nop
mov rdx, r12
lea rcx, [rsp + 0x48]
call fcn.140006430
xor r8d, r8d
lea rdx, [0x14023b8ac]
lea rcx, [rsp + 0x48]
call fcn.140004db0
mov rbx, rax
test rax, rax
je 0x1400f2cbc
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp rcx, 0x11
jb 0x1400f2cbc
movzx ecx, byte [rbx]
call fcn.1400017f0
mov edi, eax
shl dil, 4
movzx ecx, byte [rbx + 1]
call fcn.1400017f0
add al, dil
mov byte [rsp + rbp + 0xc8], al
inc rbp
add rbx, 3
cmp rbp, 6
jl 0x1400f2c80
lea rcx, [rsp + 0xc8]
call fcn.1400085a0
nop
lea rcx, [rsp + 0x48]
call fcn.140004cd0
jmp case.0x1400f2973.3
lea rcx, [rsp + 0x70]
call fcn.1400e34e0
nop
mov edx, edi
add rdx, rsi
lea ecx, [rdi + 1]
cmp ecx, ebx
ja 0x1400f2d00
mov eax, edi
inc edi
inc ecx
cmp byte [rax + rsi], 0
je 0x1400f2cf4
cmp ecx, ebx
jbe 0x1400f2ce2
jmp 0x1400f2d00
lea rcx, [rsp + 0x70]
call fcn.1400dfec0
jmp 0x1400f2d0c
xor edx, edx
lea rcx, [rsp + 0x70]
call fcn.1400dfec0
lea rcx, [r13 - 0x58]
xor r8d, r8d
mov edx, 0x8b
call fcn.1400ed020
mov rax, qword [r13 + 0x100]
test rax, rax
je 0x1400f2d34
cmp qword [rax], 0
je 0x1400f2d34
mov rdx, qword [rax]
jmp 0x1400f2d37
mov rdx, rbp
mov rcx, qword [r13 + 8]
mov rax, qword [rcx]
call qword [rax + 0x18]
nop
cmp dword [rsp + 0xb4], 0
je 0x1400f2e32
mov dword [rsp + 0xb4], ebp
xor r8d, r8d
lea rdx, str.general
lea rcx, [rsp + 0x70]
call fcn.140002b70
mov rdi, rax
test rax, rax
je 0x1400f2ddf
lea rdx, [0x14023a110]
mov rcx, rax
call fcn.140001ef0
test eax, eax
js 0x1400f2ddf
movsxd rcx, eax
add rcx, rcx
mov rax, qword [rdi + 8]
mov rcx, qword [rax + rcx*8 + 8]
test rcx, rcx
je 0x1400f2ddf
movzx eax, byte [rcx]
cmp al, 0x23
jne 0x1400f2db1
inc rcx
xor edx, edx
lea r8d, [rdx + 0x10]
call fcn.1401e4998
jmp 0x1400f2de1
cmp al, 0x30
jne 0x1400f2dd2
movzx eax, byte [rcx + 1]
cmp al, 0x78
je 0x1400f2dc1
cmp al, 0x58
jne 0x1400f2dd2
add rcx, 2
xor edx, edx
lea r8d, [rdx + 0x10]
call fcn.1401e4998
jmp 0x1400f2de1
xor edx, edx
lea r8d, [rdx + 0xa]
call fcn.1401e4998
jmp 0x1400f2de1
mov eax, ebp
and al, 9
cmp al, 1
jne 0x1400f2e10
mov rax, qword [0x1402e2b88]
test rax, rax
je 0x1400f2dfb
mov rdx, qword [rax]
test rdx, rdx
jne 0x1400f2dfe
mov rdx, rbp
mov r8d, 1
lea rcx, [rsp + 0x70]
call fcn.1400027e0
jmp 0x1400f2e32
mov rax, qword [0x1402e2b88]
test rax, rax
je 0x1400f2e24
mov rdx, qword [rax]
test rdx, rdx
jne 0x1400f2e27
mov rdx, rbp
lea rcx, [rsp + 0x70]
call fcn.140002760
nop
lea rcx, [rsp + 0x70]
call fcn.140002680
jmp case.0x1400f2973.3
cmp r12d, dword [r13 + 0x32c]
jne case.0x1400f2973.3
cmp ebx, 5
jbe case.0x1400f2973.3
mov edx, edi
add rdx, rsi
lea ecx, [rdi + 1]
cmp ecx, ebx
ja case.0x1400f2973.3
nop word [rax + rax]
mov eax, edi
inc edi
inc ecx
cmp byte [rax + rsi], bpl
je 0x1400f2e85
cmp ecx, ebx
jbe 0x1400f2e70
jmp case.0x1400f2973.3
lea rcx, [rsp + 0x48]
call fcn.140004c50
nop
xor r8d, r8d
lea rdx, str.server
lea rcx, [rsp + 0x48]
call fcn.140004db0
mov rbx, rax
test rax, rax
je 0x1400f2f03
mov ecx, gethostbyaddr
call fcn.1401e37b4
mov rdi, rax
mov qword [rsp + 0xc8], rax
test rax, rax
je 0x1400f2ef2
mov qword [rax + 8], rbp
mov dword [rax + 0x10], ebp
mov qword [rax + 0x18], rax
lea rax, vtable.._AVTChangeServer__DM___on_send_data_indication_CMainDlg__MEAAXPEBDIIPEBVTBuffer__H_Z_.0
mov qword [rdi], rax
lea rax, [r13 - 0x58]
mov qword [rdi + 0x20], rax
lea rcx, [rdi + 0x28]
mov rdx, rbx
call fcn.1400041f0
nop
jmp 0x1400f2ef5
mov rdi, rbp
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.140001050
nop
lea rcx, [rsp + 0x48]
call fcn.140004cd0
jmp case.0x1400f2973.3
mov r14d, edi
add r14, rsi
lea ecx, [rdi + 1]
cmp ecx, ebx
ja 0x1400f2fac
mov eax, edi
inc edi
inc ecx
cmp byte [rax + rsi], bpl
je 0x1400f2f35
cmp ecx, ebx
jbe 0x1400f2f23
jmp 0x1400f2fac
cmp byte [r14], bpl
je 0x1400f2fac
lea rcx, [rsp + 0x48]
call fcn.140004b60
nop
mov rdx, r14
lea rcx, [rsp + 0x48]
call fcn.140006430
xor r8d, r8d
lea rdx, [0x14023b8a0]
lea rcx, [rsp + 0x48]
call fcn.140004db0
mov rdi, rax
lea rcx, [r13 - 0x58]
test rcx, rcx
je 0x1400f2f76
lea rbp, [r13 + 0x60]
mov r8d, r12d
mov rdx, rbp
mov rcx, rax
call fcn.1400ff510
test eax, eax
jne 0x1400f2f9d
test rdi, rdi
je 0x1400f2f9d
lea r8d, [rax + 1]
mov rdx, rdi
mov ecx, r12d
call fcn.1400ff100
nop
lea rcx, [rsp + 0x48]
call fcn.140004cd0
jmp case.0x1400f2973.3
mov ecx, r12d
call fcn.1400ff380
jmp case.0x1400f2973.3
cmp r12d, dword [r13 + 0x32c]
jne 0x1400f32d5
cmp ebx, 5
jbe 0x1400f32d5
mov edx, edi
add rdx, rsi
lea ecx, [rdi + 1]
cmp ecx, ebx
ja 0x1400f32d5
nop
mov eax, edi
inc edi
inc ecx
cmp byte [rax + rsi], bpl
je 0x1400f2ff5
cmp ecx, ebx
jbe 0x1400f2fe0
jmp 0x1400f32d5
lea rcx, [rsp + 0x48]
call fcn.140004c50
nop
xor r8d, r8d
lea rdx, [0x14023b014]
lea rcx, [rsp + 0x48]
call fcn.140004e10
cmp eax, 1
jne 0x1400f305d
cmp dword [0x1402e2b58], 0
je 0x1400f3031
lea rcx, [rsp + 0x48]
call fcn.140004cd0
jmp case.0x1400f2973.3
mov dword [0x1402e2b58], 1
mov r8d, 1
lea rdx, str.cursor
lea rcx, [rsp + 0x48]
call fcn.140004e10
mov dword [0x1402e2da0], eax
jmp 0x1400f32bd
cmp dword [0x1402e2b58], 0
je 0x1400f32c9
lea rcx, [rsp + 0x70]
call fcn.1400e34e0
nop
xor r9d, r9d
lea r8, [0x14023b014]
lea rdx, str.general
lea rcx, [rsp + 0x70]
call fcn.140008a00
test eax, eax
je 0x1400f31a2
cmp dword [rsp + 0xb4], 0
je 0x1400f3188
mov dword [rsp + 0xb4], ebp
xor r8d, r8d
lea rdx, str.general
lea rcx, [rsp + 0x70]
call fcn.140002b70
mov rdi, rax
test rax, rax
je 0x1400f3135
lea rdx, [0x14023a110]
mov rcx, rax
call fcn.140001ef0
test eax, eax
js 0x1400f3135
movsxd rcx, eax
add rcx, rcx
mov rax, qword [rdi + 8]
mov rcx, qword [rax + rcx*8 + 8]
test rcx, rcx
je 0x1400f3135
movzx eax, byte [rcx]
cmp al, 0x23
jne 0x1400f3107
inc rcx
xor edx, edx
lea r8d, [rdx + 0x10]
call fcn.1401e4998
jmp 0x1400f3137
cmp al, 0x30
jne 0x1400f3128
movzx eax, byte [rcx + 1]
cmp al, 0x78
je 0x1400f3117
cmp al, 0x58
jne 0x1400f3128
add rcx, 2
xor edx, edx
lea r8d, [rdx + 0x10]
call fcn.1401e4998
jmp 0x1400f3137
xor edx, edx
lea r8d, [rdx + 0xa]
call fcn.1401e4998
jmp 0x1400f3137
mov eax, ebp
and al, 9
cmp al, 1
jne 0x1400f3166
mov rax, qword [0x1402e2b88]
test rax, rax
je 0x1400f3151
mov rdx, qword [rax]
test rdx, rdx
jne 0x1400f3154
mov rdx, rbp
mov r8d, 1
lea rcx, [rsp + 0x70]
call fcn.1400027e0
jmp 0x1400f3188
mov rax, qword [0x1402e2b88]
test rax, rax
je 0x1400f317a
mov rdx, qword [rax]
test rdx, rdx
jne 0x1400f317d
mov rdx, rbp
lea rcx, [rsp + 0x70]
call fcn.140002760
nop
lea rcx, [rsp + 0x70]
call fcn.140002680
nop
lea rcx, [rsp + 0x48]
call fcn.140004cd0
jmp case.0x1400f2973.3
mov dword [0x1402e2b58], ebp
xor r8d, r8d
lea rdx, str.cursor
lea rcx, [rsp + 0x48]
call fcn.140004e10
mov dword [0x1402e2da0], eax
cmp dword [rsp + 0xb4], 0
je 0x1400f32b2
mov dword [rsp + 0xb4], ebp
xor r8d, r8d
lea rdx, str.general
lea rcx, [rsp + 0x70]
call fcn.140002b70
mov rdi, rax
test rax, rax
je 0x1400f325f
lea rdx, [0x14023a110]
mov rcx, rax
call fcn.140001ef0
test eax, eax
js 0x1400f325f
movsxd rcx, eax
add rcx, rcx
mov rax, qword [rdi + 8]
mov rcx, qword [rax + rcx*8 + 8]
test rcx, rcx
je 0x1400f325f
movzx eax, byte [rcx]
cmp al, 0x23
jne 0x1400f3231
inc rcx
xor edx, edx
lea r8d, [rdx + 0x10]
call fcn.1401e4998
jmp 0x1400f3261
cmp al, 0x30
jne 0x1400f3252
movzx eax, byte [rcx + 1]
cmp al, 0x78
je 0x1400f3241
cmp al, 0x58
jne 0x1400f3252
add rcx, 2
xor edx, edx
lea r8d, [rdx + 0x10]
call fcn.1401e4998
jmp 0x1400f3261
xor edx, edx
lea r8d, [rdx + 0xa]
call fcn.1401e4998
jmp 0x1400f3261
mov eax, ebp
and al, 9
cmp al, 1
jne 0x1400f3290
mov rax, qword [0x1402e2b88]
test rax, rax
je 0x1400f327b
mov rdx, qword [rax]
test rdx, rdx
jne 0x1400f327e
mov rdx, rbp
mov r8d, 1
lea rcx, [rsp + 0x70]
call fcn.1400027e0
jmp 0x1400f32b2
mov rax, qword [0x1402e2b88]
test rax, rax
je 0x1400f32a4
mov rdx, qword [rax]
test rdx, rdx
jne 0x1400f32a7
mov rdx, rbp
lea rcx, [rsp + 0x70]
call fcn.140002760
nop
lea rcx, [rsp + 0x70]
call fcn.140002680
nop
lea rcx, [rsp + 0x48]
call fcn.140004cd0
jmp 0x1400f32d5
lea rcx, [rsp + 0x48]
call fcn.140004cd0
jmp case.0x1400f2973.3
mov rdx, qword [r13 + 0x100]
test rdx, rdx
je 0x1400f32e9
mov rdx, qword [rdx]
test rdx, rdx
jne 0x1400f32ec
mov rdx, rbp
mov rcx, qword [r13 + 8]
mov rax, qword [rcx]
call qword [rax + 0x18]
jmp case.0x1400f2973.3
cmp dword [reloc.WS2_32.dll_accept], ebp
je case.0x1400f2973.3
xor r9d, r9d
mov edx, VarUI4FromDisp
mov r8d, 0xe140
mov rcx, qword [r13 - 0x50]
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.1401e42a0
add rsp, 0x1f0
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret