Function at 0x140135320
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call
Parse pe header
Query environment variable
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov rax, qword [0x140278800]
xor rax, rsp
mov qword [rbp + 0x30], rax
mov qword [rbp - 0x40], rdx
mov qword [rbp - 0x48], rcx
xor r15d, r15d
mov esi, r15d
mov qword [rbp - 0x80], r15
mov dword [rbp - 0x18], r15d
lea r9, [rbp - 0x18]
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14010ff9b
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp - 0x18]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
lea r9, [rbp - 0x18]
mov r8d, dword [rbp - 0x18]
mov rdx, rax
mov ecx, listen
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x14010ff51
mov qword [rbp - 0x80], rsi
test eax, eax
js 0x1401123b3
mov eax, r15d
mov dword [rsp + 0x2c], eax
cmp dword [rsi], r15d
jbe 0x1401123b3
movzx edi, byte [rsp + 0x28]
movzx ebx, byte [rsp + 0x28]
movzx r14d, byte [rsp + 0x28]
mov qword [rsp + 0x20], r14
movzx r12d, byte [rsp + 0x28]
movzx r13d, byte [rsp + 0x28]
nop dword [rax]
nop dword [rax + rax]
imul rcx, rax, 0x128
lea rax, [rcx + rsi]
mov qword [rbp - 0x50], rax
movzx eax, word [rax + 0x2e]
add rax, rcx
add rsi, rax
movzx edx, dil
lea rcx, [rbp + 0x10]
call fcn.140002dc0
nop
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rsi + r8 + 0x30], 0
jne 0x140110010
lea rdx, [rsi + 0x30]
lea rcx, [rbp + 0x10]
call fcn.140004830
nop
lea rcx, [rbp + 0x10]
call fcn.140001ca0
mov rdx, qword [rbp - 0x48]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x140112394
mov rdx, qword [rbp - 0x50]
add rdx, 0x30
lea rcx, [rbp - 0x10]
call fcn.1400046a0
nop
mov dword [rsp + 0x58], 0xa7a5b4bb
mov dword [rsp + 0x5c], 0xa4a0bcb5
mov word [rsp + 0x60], 0xa1a7
mov byte [rsp + 0x62], 0x7a
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x63], xmm0
mov qword [rsp + 0x73], rax
nop dword [rax]
nop dword [rax + rax]
mov r8, qword [0x1402cdf20]
mov r9, qword [0x1402cdf18]
nop
mov rsi, r15
cmp rsi, 0x23
jae 0x140110a75
movzx r11d, byte [rsp + rsi + 0x58]
movzx r10d, r11b
cmp r8, rsi
ja 0x140110a6c
lea rax, [r9 + 1]
cmp r8, rax
jae 0x1401100f1
movabs rcx, 0x695ae131a2e8828e
add rcx, rsi
mov rax, rcx
and rax, r11
imul r14, rax, 0xfffffffffffffffe
add r14, rcx
add r14, r11
add r14b, 0x1e
mov qword [rsp + 0x20], r14
jmp 0x14011011d
je 0x1401109df
inc rax
cmp r8, rax
je 0x14011096c
lea rax, [r9 + 3]
cmp r8, rax
je 0x140110900
lea rax, [r9 + 7]
cmp r8, rax
je 0x1401108d0
movzx r10d, r11b
cmp r9, rsi
ja 0x140110a63
lea rax, [r9 + 0x41]
cmp r8, rax
jae 0x140110159
movabs rdx, 0xa47479125d12b5a6
add rdx, rsi
movzx eax, dl
and al, r11b
mov ecx, Ordinal_60
sub cl, al
lea r14d, [rcx + rcx]
add r14b, r10b
add r14b, dl
jmp 0x140110190
lea rax, [r9 + 1]
cmp r8, rax
je 0x140110878
lea rax, [r9 + 6]
cmp r8, rax
je 0x14011084e
lea rax, [r9 + 4]
cmp r8, rax
je 0x140110828
lea rax, [r9 + 7]
cmp r8, rax
je 0x140110803
nop dword [rax]
lea rax, [r9 + r8]
cmp rax, rsi
jbe 0x1401104fc
nop dword [rax]
lea rax, [r9 + 8]
cmp r8, rax
je 0x1401104e2
lea rax, [r9 + 0x61]
cmp r8, rax
je 0x1401104b5
lea rax, [r9 + 0x10]
cmp r8, rax
je 0x14011048b
lea rax, [r9 + 0x5a]
cmp r8, rax
je 0x14011046d
lea rax, [r9 + 0x40]
cmp r8, rax
je 0x140110454
lea rax, [r9 + 0x3e8]
cmp r8, rax
je 0x140110430
lea r8, [r9 + 0x42]
lea r9, [r8 + 0x40]
lea rax, [r9 + 3]
cmp r8, rax
jb 0x140110a3d
lea rax, [r9 + 0x200]
cmp r8, rax
jb 0x140110a1b
lea rax, [r9 + 6]
cmp r8, rax
jb 0x140110303
lea rax, [r9 + 0x20]
cmp r8, rax
jb 0x1401102d5
lea rax, [r9 + 0x2a]
cmp r8, rax
jb 0x1401102ac
lea rax, [r9 + 0x42]
cmp r8, rax
jb 0x1401103d9
lea r8, [r9 + 0x10]
lea r9, [r8 + 0x2a]
lea rax, [r9 + 0x5a]
cmp r8, rax
ja 0x1401103bf
lea rax, [r9 + 4]
cmp r8, rax
ja 0x1401103a0
lea rax, [r9 + 0x3e8]
cmp r8, rax
ja 0x140110381
lea rax, [r9 + 8]
cmp r8, rax
ja 0x140110362
lea rax, [r9 + 0x61]
cmp r8, rax
ja 0x140110349
lea rax, [r9 + 0x10]
cmp r8, rax
ja 0x140110330
lea r8, [r9 + 0x7a]
lea r9, [r8 + 0x61]
jmp 0x1401101a0
movabs rdx, 0x345845f3743ee31a
add rdx, rsi
movzx eax, dl
and al, r11b
mov ecx, Ordinal_41
sub cl, al
lea r14d, [rcx + rcx]
add r14b, r10b
add r14b, dl
jmp 0x140110190
movabs rdx, 0x61a283902e6dddfe
add rdx, rsi
movzx eax, dl
and al, r11b
mov ecx, 7
sub cl, al
lea r14d, [rcx + rcx]
add r14b, r10b
add r14b, dl
mov qword [rsp + 0x20], r14
jmp 0x140110121
movabs rdx, 0x8eecc12ce89cd8e2
add rdx, rsi
movzx eax, dl
and al, r11b
add al, al
movzx r14d, r10b
sub r14b, al
sub r14b, 0x2e
add r14b, dl
mov qword [rsp + 0x20], r14
jmp 0x1401100b7
lea ecx, [rsi - 0x24]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea edx, [r11 + rcx]
sub dl, 4
jmp 0x140110924
lea ecx, [rsi - 0x40]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea edx, [r11 + rcx]
sub dl, 0x40
jmp 0x140110948
lea ecx, [rsi - 0x5c]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r14d, [r11 + rcx]
sub r14b, 0x7c
mov qword [rsp + 0x20], r14
jmp 0x140110953
lea edx, [rsi - 0x78]
movzx eax, dl
and al, r11b
mov ecx, 0x24
sub cl, al
lea r14d, [rcx + rcx]
add r14b, dl
add r14b, r11b
jmp 0x140110993
lea edx, [rsi + 0x6c]
movzx eax, dl
and al, r11b
mov ecx, 6
sub cl, al
lea r14d, [rcx + rcx]
add r14b, dl
add r14b, r11b
jmp 0x1401109b6
lea ecx, [rsi + 0x50]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r14d, [r11 + rcx]
sub r14b, 0x30
jmp 0x140110a03
lea ecx, [rsi + 0x36]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r14d, [r11 + rcx]
sub r14b, 0x7a
lea rax, [r9 + r8]
cmp rax, 2
je 0x1401107ea
lea rax, [r9 + 0x200]
cmp r8, rax
jbe 0x1401105c9
movzx r10d, sil
lea edx, [r10 - 0x2a]
movzx eax, dl
and al, r11b
mov ecx, reloc.WS2_32.dll_send
sub cl, al
lea r14d, [rcx + rcx]
add r14b, dl
add r14b, r11b
jmp 0x140110699
lea edx, [rsi - 0x70]
movzx eax, dl
and al, r11b
mov ecx, 8
sub cl, al
lea r14d, [rcx + rcx]
add r14b, dl
add r14b, r11b
mov qword [rsp + 0x20], r14
jmp 0x140110953
lea ecx, [rsi + 0x74]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea edx, [r11 + rcx]
sub dl, 0x2c
jmp 0x140110948
movzx r10d, sil
lea ecx, [r10 + 0x58]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea edx, [r11 + rcx]
sub dl, 0x68
jmp 0x140110928
lea edx, [rsi + 0x3c]
movzx eax, dl
and al, r11b
mov ecx, reloc.WLDAP32.dll_Ordinal_46
sub cl, al
lea r14d, [rcx + rcx]
add r14b, dl
add r14b, r11b
dec rsi
mov qword [rsp + 0x20], r14
inc rsi
jmp 0x1401100a3
lea edx, [rsi + 0x20]
movzx eax, dl
and al, r11b
mov ecx, reloc.WS2_32.dll_recv
sub cl, al
lea r14d, [rcx + rcx]
add r14b, dl
add r14b, r11b
inc r9
dec rsi
mov qword [rsp + 0x20], r14
inc rsi
jmp 0x1401100a3
lea ecx, [rsi + 4]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r14d, [r11 + rcx]
sub r14b, 0x1c
jmp 0x14011089b
lea rax, [r9 + 0x1000]
cmp r8, rax
jae 0x140110531
movabs rdx, 0x695ae131a2e8828e
add rdx, rsi
movzx eax, dl
and al, r11b
mov ecx, reloc.WS2_32.dll_ntohs
sub cl, al
lea r14d, [rcx + rcx]
add r14b, r10b
add r14b, dl
jmp 0x1401103ee
lea rax, [r9 + 1]
cmp r8, rax
jne 0x140110554
lea ecx, [rsi + 0x4c]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r14d, [r11 + rcx]
sub r14b, 0x14
jmp 0x140110a03
inc rax
cmp r8, rax
jne 0x14011057b
lea edx, [rsi - 0x7c]
movzx eax, dl
and al, r11b
mov ecx, reloc.WLDAP32.dll_Ordinal_50
sub cl, al
lea r14d, [rcx + rcx]
add r14b, dl
add r14b, r11b
jmp 0x140110993
lea rax, [r9 + 3]
cmp r8, rax
jne 0x1401105a3
lea ecx, [rsi - 0x60]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r14d, [r11 + rcx]
sub r14b, 0x60
mov qword [rsp + 0x20], r14
jmp 0x140110953
lea rax, [r9 + 4]
cmp r8, rax
jne 0x1401103ee
lea ecx, [rsi - 0x44]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea edx, [r11 + rcx]
sub dl, 0x24
jmp 0x140110948
lea rax, [r9 + 1]
cmp r8, rax
jne 0x1401105f6
movzx r10d, sil
lea edx, [r10 - 0xe]
movzx eax, dl
and al, r11b
mov ecx, Ordinal_50
sub cl, al
lea r14d, [rcx + rcx]
add r14b, dl
add r14b, r11b
jmp 0x14011089f
inc rax
cmp r8, rax
jne 0x140110623
lea ecx, [rsi + 0x2a]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r14d, [r11 + rcx]
sub r14b, 0x26
dec rsi
mov qword [rsp + 0x20], r14
inc rsi
jmp 0x1401100a3
lea rax, [r9 + 3]
cmp r8, rax
jne 0x14011064d
movzx r10d, sil
lea edx, [r10 + 0x46]
movzx eax, dl
and al, r11b
mov ecx, listen
sub cl, al
add cl, cl
add dl, cl
add dl, r11b
jmp 0x140110928
lea rax, [r9 + 4]
cmp r8, rax
jne 0x140110672
lea edx, [rsi + 0x62]
movzx eax, dl
and al, r11b
mov ecx, reloc.WLDAP32.dll_Ordinal_41
sub cl, al
add cl, cl
add dl, cl
add dl, r11b
jmp 0x140110948
lea rax, [r9 + 7]
cmp r8, rax
jne 0x140110695
lea ecx, [rsi - 0x66]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r14d, [r11 + rcx]
sub r14b, 0x36
jmp 0x140110993
movzx r10d, sil
cmp r8, 0x42
jae 0x1401107ce
lea rax, [r9 + 0x40]
cmp r8, rax
jbe 0x1401106ea
lea ecx, [r10 + 0x7c]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r14d, [r11 + rcx]
sub r14b, 0x64
cmp r9, 0x10
jb 0x1401107bc
lea ecx, [r10 - 0x6c]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
add cl, r11b
lea r14d, [rcx*2 - 0x18]
jmp 0x14011089f
lea rax, [r9 + 1]
cmp r8, rax
jne 0x140110710
sub r10b, 0x68
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea r14d, [r11 + r10]
sub r14b, 0x28
jmp 0x140110a03
inc rax
cmp r8, rax
jne 0x140110739
sub r10b, 0x30
movzx eax, r10b
and al, r11b
mov ecx, Ordinal_41
sub cl, al
lea r14d, [rcx + rcx]
add r14b, r10b
add r14b, r11b
jmp 0x140110993
lea rax, [r9 + 5]
cmp r8, rax
jne 0x14011075f
lea edx, [r10 + 0x24]
movzx eax, dl
and al, r11b
mov ecx, 2
sub cl, al
add cl, cl
add dl, cl
add dl, r11b
jmp 0x140110928
lea rax, [r9 + 3]
cmp r8, rax
jne 0x140110794
add r10b, 0x40
movzx eax, r10b
and al, r11b
mov ecx, reloc.WLDAP32.dll_Ordinal_32
sub cl, al
lea r14d, [rcx + rcx]
add r14b, r10b
add r14b, r11b
dec rsi
mov qword [rsp + 0x20], r14
inc rsi
jmp 0x1401100a3
lea rax, [r9 + 8]
cmp r8, rax
jne 0x1401106c2
lea ecx, [r10 + 0x78]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r14d, [r11 + rcx]
sub r14b, 0x48
jmp 0x14011089f
mov byte [rsp + rsi + 0x58], r14b
mov qword [rsp + 0x20], r14
inc rsi
jmp 0x1401100a3
lea edx, [r10 - 0x50]
movzx eax, dl
and al, r11b
movzx ecx, r11b
sub cl, al
add cl, 0x18
add cl, cl
add dl, cl
jmp 0x140110928
lea edx, [rsi - 0x34]
movzx eax, dl
and al, r11b
mov ecx, gethostname
sub cl, al
lea r14d, [rcx + rcx]
jmp 0x140110990
movabs rcx, 0xcd84e8fd16be3a2
add rcx, rsi
movzx eax, cl
and al, r11b
add al, al
sub r10b, al
lea r14d, [rcx + r10]
sub r14b, 0x6e
jmp 0x140110a03
movabs rdx, 0x676cc9c945c9d96a
add rdx, rsi
movzx eax, dl
and al, r11b
mov ecx, reloc.WS2_32.dll_listen
sub cl, al
lea r14d, [rcx + rcx]
add r14b, r10b
jmp 0x140110990
movabs rcx, 0x94b70765fff8d44e
add rcx, rsi
movzx eax, cl
and al, r11b
add al, al
sub r10b, al
lea r14d, [rcx + r10]
sub r14b, 0x22
mov qword [rsp + 0x20], r14
jmp 0x140110953
movabs rdx, 0x772a3b75a2e3bac2
add rdx, rsi
movzx eax, dl
and al, r11b
add al, al
movzx r14d, r10b
sub r14b, al
sub r14b, 0x4e
add r14b, dl
movzx r10d, sil
add r10b, 0x22
movzx eax, r10b
and al, r11b
mov ecx, 9
sub cl, al
add cl, cl
add cl, r10b
add cl, r11b
mov byte [rsp + rsi + 0x58], cl
inc r9
dec rsi
mov qword [rsp + 0x20], r14
inc rsi
jmp 0x1401100a3
movabs rcx, 0x2c5331e88b9fa652
add rcx, rsi
movzx eax, cl
and al, r11b
add al, al
sub r10b, al
lea r14d, [rcx + r10]
sub r14b, 0x3e
dec rsi
mov qword [rsp + 0x20], r14
inc rsi
jmp 0x1401100a3
movabs rdx, 0x599d6f8545cea136
add rdx, rsi
movzx eax, dl
and al, r11b
add al, al
movzx ecx, r10b
sub cl, al
sub dl, 0x7a
add dl, cl
movzx r11d, r10b
movzx r10d, sil
add r10b, 0x3e
movzx eax, r10b
and al, r11b
mov ecx, Ordinal_41
sub cl, al
add cl, cl
add cl, r10b
add cl, r11b
add cl, dl
mov byte [rsp + rsi + 0x58], cl
mov qword [rsp + 0x20], rdx
add r8, r9
mov r14, rdx
movzx eax, r14b
mov rcx, 0xffffffffffffffff
sub rcx, rax
add rsi, rcx
inc rsi
jmp 0x1401100a3
movabs rdx, 0xe17c285b745b91e2
add rdx, rsi
movzx eax, dl
and al, r11b
add al, al
movzx r14d, r10b
sub r14b, al
sub r14b, 0x2e
movzx r11d, r10b
add r14b, dl
lea ecx, [rsi + 0x5a]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
sub cl, 0x76
add cl, r11b
movzx eax, cl
mov byte [rsp + rsi + 0x58], al
inc r9
add rax, r9
sub rsi, rax
lea ecx, [rsi - 0x18]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
sub cl, 0x58
add cl, r11b
mov byte [rsp + rsi + 0x58], cl
inc r8
mov rax, 0xffffffffffffffff
sub rax, r8
add rsi, rax
jmp 0x140110a03
movabs rdx, 0x3c10a394e8b987aa
add rdx, rsi
movzx eax, dl
and al, r11b
mov ecx, reloc.WLDAP32.dll_Ordinal_45
sub cl, al
lea r14d, [rcx + rcx]
add r14b, r10b
add r14b, dl
movzx eax, byte [rsp + rsi + 0x58]
add rax, r9
add rsi, rax
mov qword [rsp + 0x20], r14
inc rsi
jmp 0x1401100a3
sub sil, 0x3a
movzx eax, sil
and al, r11b
add al, al
sub sil, al
lea r14d, [r11 + rsi]
sub r14b, 0x6a
mov qword [rsp + 0x20], r14
jmp 0x1401100a0
sub sil, 0x56
movzx eax, sil
and al, r11b
mov ecx, reloc.WLDAP32.dll_Ordinal_45
sub cl, al
lea r14d, [rcx + rcx]
add r14b, sil
add r14b, r11b
mov qword [rsp + 0x20], r14
jmp 0x140110090
lea rcx, [rbp + 0x177b6c0]
jmp 0x140110a7a
lea rcx, [rbp + 0xa0394e]
jmp 0x140110a7a
lea rcx, [rsp + 0x58]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rsi, rax
movzx edx, bl
lea rcx, [rbp - 0x38]
call fcn.140002dc0
nop
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rsi + r8], 0
jne 0x140110aa0
mov rdx, rsi
lea rcx, [rbp - 0x38]
call fcn.140004830
nop
mov word [rbp - 0x78], 0x5fa
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x76], xmm0
movups xmmword [rbp - 0x66], xmm0
mov byte [rbp - 0x56], al
nop dword [rax]
mov rax, qword [0x1402cdf20]
mov r9, qword [0x1402cdf18]
nop
mov r14, r15
cmp r14, 0x23
jae 0x1401116ee
movzx r10d, byte [rbp + r14 - 0x78]
mov esi, r10d
cmp rax, r14
ja 0x1401116e5
lea rcx, [r9 + 1]
cmp rax, rcx
jae 0x140110b2b
movabs rdx, 0xfd99a1eec3ba18d5
add rdx, r14
mov rcx, rdx
and rcx, rsi
imul r12, rcx, 0xfffffffffffffffe
add r12, rdx
add r12, rsi
add r12b, 0x2d
jmp 0x140110b64
je 0x140111671
inc rcx
cmp rax, rcx
je 0x1401115e6
lea rcx, [r9 + 4]
cmp rax, rcx
je 0x1401115af
lea rcx, [r9 + 6]
cmp rax, rcx
je 0x14011158d
lea rcx, [r9 + 3]
cmp rax, rcx
je 0x140111568
movzx r11d, r14b
nop dword [rax + rax]
cmp r9, r14
ja 0x1401116dc
lea rcx, [r9 + 8]
cmp rax, rcx
jae 0x140110b9a
lea edx, [r11 + 0x79]
movzx ecx, dl
and cl, r10b
add cl, cl
sub dl, cl
lea r12d, [r10 + rdx]
sub r12b, 0x4f
jmp 0x140110bd0
lea rcx, [r9 + 1]
cmp rax, rcx
je 0x140111523
inc rcx
cmp rax, rcx
je 0x140111500
lea rcx, [r9 + 3]
cmp rax, rcx
je 0x1401114e0
lea rcx, [r9 + 5]
cmp rax, rcx
je 0x1401114c0
nop dword [rax]
lea rcx, [r9 + rax]
cmp rcx, r14
jbe 0x140111175
nop dword [rax]
lea rcx, [r9 + 0x20]
cmp rax, rcx
je 0x140111157
lea rcx, [r9 + 0x1000]
cmp rax, rcx
je 0x140111131
lea rcx, [r9 + 4]
cmp rax, rcx
je 0x14011110a
lea rcx, [r9 + 0x40]
cmp rax, rcx
je 0x1401110ec
lea rcx, [r9 + 0x7a]
cmp rax, rcx
je 0x1401110cc
lea rcx, [r9 + 6]
cmp rax, rcx
je 0x1401110ab
lea rcx, [r9 + 0x64]
cmp rax, rcx
je 0x14011108a
lea rcx, [r9 + 0x5a]
cmp rax, rcx
je 0x14011106a
lea rcx, [r9 + 9]
cmp rax, rcx
je 0x14011103a
lea rcx, [r9 + 0x200]
cmp rax, rcx
je 0x140110be0
lea rax, [r9 + 0xa]
lea r9, [rax + 1]
lea rcx, [r9 + 0x3e8]
cmp rax, rcx
jb 0x1401116c0
lea rcx, [r9 + 2]
cmp rax, rcx
jb 0x1401116a3
lea rcx, [r9 + 0x20]
cmp rax, rcx
jb 0x140110dd4
lea rcx, [r9 + 0x1000]
cmp rax, rcx
jb 0x140110db4
lea rcx, [r9 + 4]
cmp rax, rcx
jb 0x140110d94
lea rcx, [r9 + 0x40]
cmp rax, rcx
jb 0x140110fe4
lea rcx, [r9 + 0x7a]
cmp rax, rcx
jb 0x140110f94
lea rcx, [r9 + 6]
cmp rax, rcx
jb 0x140110f50
lea rcx, [r9 + 0x64]
cmp rax, rcx
jb 0x140110f2b
lea rcx, [r9 + 0x5a]
cmp rax, rcx
jb 0x140110be0
lea rax, [r9 + 0x80]
lea r9, [rax + 9]
lea rcx, [r9 + 0x2a]
cmp rax, rcx
ja 0x140110eff
lea rcx, [r9 + 0xa]
cmp rax, rcx
ja 0x140110ede
lea rcx, [r9 + 0x3e8]
cmp rax, rcx
ja 0x140110ebd
lea rcx, [r9 + 2]
cmp rax, rcx
ja 0x140110ea0
lea rcx, [r9 + 0x20]
cmp rax, rcx
ja 0x140110e7c
lea rcx, [r9 + 0x1000]
cmp rax, rcx
ja 0x140110e5e
lea rcx, [r9 + 4]
cmp rax, rcx
ja 0x140110e3b
lea rcx, [r9 + 0x40]
cmp rax, rcx
ja 0x140110e11
lea rcx, [r9 + 0x7a]
cmp rax, rcx
ja 0x140110df4
lea rcx, [r9 + 6]
cmp rax, rcx
ja 0x140110be0
lea rax, [r9 + 0x41]
lea r9, [rax + 0x64]
jmp 0x140110be0
lea r8d, [r11 - 0x59]
movzx ecx, r10b
and cl, r8b
add cl, cl
movzx r12d, r10b
sub r12b, cl
add r12b, 0x6f
add r12b, r8b
jmp 0x140110bd0
lea r8d, [r11 - 3]
movzx ecx, r10b
and cl, r8b
add cl, cl
movzx r12d, r10b
sub r12b, cl
add r12b, 0x15
add r12b, r8b
jmp 0x140110b70
add r11b, 0x53
movzx ecx, r10b
and cl, r11b
add cl, cl
movzx r12d, r10b
sub r12b, cl
sub r12b, 0x45
add r12b, r11b
jmp 0x140110af6
lea r8d, [r11 - 0x38]
movzx ecx, r10b
and cl, r8b
add cl, cl
movzx r12d, r10b
sub r12b, cl
sub r12b, 0x78
jmp 0x14011153b
add r11b, 0x1e
movzx ecx, r10b
and cl, r11b
mov edx, reloc.WS2_32.dll_socket
sub dl, cl
lea r12d, [rdx + rdx]
add r12b, r10b
add r12b, r11b
inc r9
dec r14
inc r14
jmp 0x140110ae3
add r11b, 0x74
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
lea r12d, [r11 + r10]
sub r12b, 0x2c
dec r14
inc r14
jmp 0x140110ae3
lea r8d, [r11 - 0x36]
movzx ecx, r10b
and cl, r8b
mov edx, 0x3d
sub dl, cl
lea r12d, [rdx + rdx]
add r12b, r10b
jmp 0x140111473
add r11b, 0x20
movzx ecx, r10b
and cl, r11b
mov edx, reloc.WS2_32.dll_recv
sub dl, cl
lea r12d, [rdx + rdx]
add r12b, r10b
add r12b, r11b
add rax, r9
jmp 0x1401115cd
add r11b, 0x76
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
lea r12d, [r11 + r10]
sub r12b, 0x3a
jmp 0x1401115cd
lea r8d, [r11 - 0x34]
movzx ecx, r10b
and cl, r8b
mov edx, gethostname
sub dl, cl
lea r12d, [rdx + rdx]
add r12b, r10b
add r12b, r8b
jmp 0x14011160b
add r11b, 0x22
movzx ecx, r10b
and cl, r11b
mov edx, 9
sub dl, cl
lea r12d, [rdx + rdx]
add r12b, r10b
add r12b, r11b
jmp 0x140111634
add r11b, 0x78
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
lea r12d, [r11 + r10]
sub r12b, 0x48
movzx ecx, byte [rbp + r14 - 0x78]
add rcx, r9
add r14, rcx
inc r14
jmp 0x140110ae3
add r11b, 0x4f
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
lea r12d, [r11 + r10]
sub r12b, 0x29
mov byte [rbp + r14 - 0x78], r12b
inc r14
jmp 0x140110ae3
lea r8d, [r11 - 0x5b]
movzx ecx, r10b
and cl, r8b
add cl, cl
movzx r12d, r10b
sub r12b, cl
add r12b, 0x7d
add r12b, r8b
cmp r9, 0xa
jb 0x140110f43
lea r8d, [r11 - 0x22]
movzx ecx, r10b
and cl, r8b
add cl, cl
movzx edx, r10b
sub dl, cl
add dl, r8b
lea r12d, [rdx*2 - 0x24]
jmp 0x14011153e
lea r8d, [r11 - 5]
movzx ecx, r10b
and cl, r8b
add cl, cl
movzx r12d, r10b
sub r12b, cl
add r12b, 0x23
add r12b, r8b
cmp rax, 2
jae 0x14011145b
lea rcx, [r9 + 0x400]
cmp rax, rcx
jbe 0x140111384
lea r8d, [r11 + 0x3a]
movzx ecx, r10b
and cl, r8b
mov edx, gethostname
sub dl, cl
lea r12d, [rdx + rdx]
add r12b, r10b
jmp 0x140110f68
lea r8d, [r11 + 0x51]
movzx ecx, r10b
and cl, r8b
add cl, cl
movzx r12d, r10b
sub r12b, cl
sub r12b, 0x37
add r12b, r8b
lea rcx, [r9 + rax]
cmp rcx, 0x1000
je 0x14011149d
lea rcx, [r9 + 0x28]
cmp rax, rcx
jbe 0x1401112a8
lea r8d, [r11 - 0x3f]
movzx ecx, r10b
and cl, r8b
add cl, cl
movzx r12d, r10b
sub r12b, cl
sub r12b, 0x47
jmp 0x140110fac
sub r11b, 0x2a
movzx ecx, r10b
and cl, r11b
mov edx, reloc.WS2_32.dll_send
sub dl, cl
lea r12d, [rdx + rdx]
add r12b, r10b
add r12b, r11b
movzx ecx, byte [rbp + r14 - 0x78]
add rcx, r9
add r14, rcx
inc r14
jmp 0x140110ae3
add r11b, 0x2c
movzx ecx, r10b
and cl, r11b
add cl, cl
movzx r12d, r10b
sub r12b, cl
sub r12b, 0x34
add r12b, r11b
jmp 0x140111634
lea r8d, [r11 - 0x7e]
movzx ecx, r10b
and cl, r8b
mov edx, reloc.WS2_32.dll_gethostname
sub dl, cl
lea r12d, [rdx + rdx]
add r12b, r10b
add r12b, r8b
jmp 0x14011160b
sub r11b, 0x28
movzx ecx, r10b
and cl, r11b
mov edx, recv
sub dl, cl
lea r12d, [rdx + rdx]
add r12b, r10b
add r12b, r11b
jmp 0x1401115cd
add r11b, 0x2e
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
lea r12d, [r11 + r10]
sub r12b, 0x42
add rax, r9
jmp 0x1401115cd
lea r8d, [r11 - 0x7c]
movzx ecx, r10b
and cl, r8b
mov edx, reloc.WLDAP32.dll_Ordinal_50
sub dl, cl
lea r12d, [rdx + rdx]
add r12b, r10b
jmp 0x140111473
sub r11b, 0x26
movzx ecx, r10b
and cl, r11b
mov edx, 5
sub dl, cl
lea r12d, [rdx + rdx]
add r12b, r10b
add r12b, r11b
dec r14
inc r14
jmp 0x140110ae3
add r11b, 0x30
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
lea r12d, [r11 + r10]
sub r12b, 0x50
inc r9
dec r14
inc r14
jmp 0x140110ae3
lea r8d, [r11 - 0x7a]
movzx ecx, r10b
and cl, r8b
mov edx, Ordinal_46
sub dl, cl
lea r12d, [rdx + rdx]
add r12b, r10b
jmp 0x14011153b
lea rcx, [r9 + 0x7a]
cmp rax, rcx
jae 0x14011119b
lea r8d, [r11 - 0x2b]
movzx ecx, r10b
and cl, r8b
add cl, cl
movzx r12d, r10b
sub r12b, cl
add r12b, 0x2d
jmp 0x140110ffc
lea rcx, [r9 + 1]
cmp rax, rcx
jne 0x1401111d4
sub r11b, 0xe
movzx ecx, r10b
and cl, r11b
mov edx, Ordinal_50
sub dl, cl
lea r12d, [rdx + rdx]
add r12b, r10b
add r12b, r11b
movzx ecx, byte [rbp + r14 - 0x78]
add rcx, r9
add r14, rcx
inc r14
jmp 0x140110ae3
inc rcx
cmp rax, rcx
jne 0x1401111fc
sub r11b, 0x64
movzx ecx, r10b
and cl, r11b
add cl, cl
movzx r12d, r10b
sub r12b, cl
sub r12b, 0x44
add r12b, r11b
jmp 0x140111634
lea rcx, [r9 + 3]
cmp rax, rcx
jne 0x140111226
lea r8d, [r11 + 0x46]
movzx ecx, r10b
and cl, r8b
mov edx, listen
sub dl, cl
lea r12d, [rdx + rdx]
add r12b, r10b
add r12b, r8b
jmp 0x14011160b
lea rcx, [r9 + 5]
cmp rax, rcx
jne 0x14011124d
lea r8d, [r11 + 0x44]
movzx ecx, r10b
and cl, r8b
mov edx, reloc.WS2_32.dll_select
sub dl, cl
lea r12d, [rdx + rdx]
add r12b, r10b
jmp 0x140111473
lea rcx, [r9 + 7]
cmp rax, rcx
jne 0x14011127d
sub r11b, 0x12
movzx ecx, r10b
and cl, r11b
mov edx, 0x3f
sub dl, cl
lea r12d, [rdx + rdx]
add r12b, r10b
add r12b, r11b
dec r14
inc r14
jmp 0x140110ae3
lea rcx, [r9 + 6]
cmp rax, rcx
jne 0x140110fff
lea r8d, [r11 + 0x42]
movzx ecx, r10b
and cl, r8b
mov edx, Ordinal_27
sub dl, cl
lea r12d, [rdx + rdx]
add r12b, r10b
jmp 0x14011153b
lea rcx, [r9 + 1]
cmp rax, rcx
jne 0x1401112ce
lea r8d, [r11 + 0x6b]
movzx ecx, r10b
and cl, r8b
add cl, cl
movzx r12d, r10b
sub r12b, cl
add r12b, 0x13
jmp 0x14011153b
inc rcx
cmp rax, rcx
jne 0x1401112fc
add r11b, 0x15
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
lea r12d, [r11 + r10]
add r12b, 0x6d
inc r9
dec r14
inc r14
jmp 0x140110ae3
lea rcx, [r9 + 4]
cmp rax, rcx
jne 0x140111325
add r11b, 0x13
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
lea r12d, [r11 + r10]
add r12b, 0x7b
add rax, r9
jmp 0x1401115cd
lea rcx, [r9 + 3]
cmp rax, rcx
jne 0x14011134b
sub r11b, 0x43
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
lea r12d, [r11 + r10]
sub r12b, 0x2b
jmp 0x1401115cd
lea rcx, [r9 + 2]
cmp rax, rcx
jne 0x140110faf
sub r11b, 0x45
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
lea r12d, [r11 + r10]
sub r12b, 0x1d
movzx ecx, byte [rbp + r14 - 0x78]
add rcx, r9
add r14, rcx
inc r14
jmp 0x140110ae3
lea rcx, [r9 + 1]
cmp rax, rcx
jne 0x1401113b9
sub r11b, 0x1c
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
lea r12d, [r11 + r10]
sub r12b, 0x3c
movzx ecx, byte [rbp + r14 - 0x78]
add rcx, r9
add r14, rcx
inc r14
jmp 0x140110ae3
inc rcx
cmp rax, rcx
jne 0x1401113e2
lea r8d, [r11 + 0x38]
movzx ecx, r10b
and cl, r8b
mov edx, reloc.WLDAP32.dll_Ordinal_60
sub dl, cl
lea r12d, [rdx + rdx]
add r12b, r10b
add r12b, r8b
jmp 0x14011160b
lea rcx, [r9 + 6]
cmp rax, rcx
jne 0x140111405
lea r8d, [r11 + 0x36]
movzx ecx, r10b
and cl, r8b
add cl, cl
movzx r12d, r10b
sub r12b, cl
sub r12b, 0x7a
jmp 0x140111473
lea rcx, [r9 + 2]
cmp rax, rcx
jne 0x140111431
sub r11b, 0x20
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
lea r12d, [r11 + r10]
sub r12b, 0x20
dec r14
inc r14
jmp 0x140110ae3
lea rcx, [r9 + 7]
cmp rax, rcx
jne 0x140110f6b
lea r8d, [r11 + 0x34]
movzx ecx, r10b
and cl, r8b
add cl, cl
movzx r12d, r10b
sub r12b, cl
sub r12b, 0x6c
jmp 0x14011153b
lea r8d, [r11 - 0x78]
movzx ecx, r10b
and cl, r8b
movzx edx, r10b
sub dl, cl
add dl, 0x24
lea r12d, [rdx + rdx]
add r12b, r8b
add r11b, 0x5d
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
add r10b, 0x75
add r10b, r11b
add r10b, r12b
mov byte [rbp + r14 - 0x78], r10b
add rax, r9
jmp 0x1401115cd
lea r8d, [r11 + 0x32]
movzx ecx, r10b
and cl, r8b
add cl, cl
movzx r12d, r10b
sub r12b, cl
sub r12b, r10b
sub r12b, 0x5e
add r12b, r8b
jmp 0x14011160b
sub r11b, 0x37
movzx ecx, r10b
and cl, r11b
add cl, cl
movzx r12d, r10b
sub r12b, cl
sub r12b, 0x7f
add r12b, r11b
jmp 0x140111634
sub r11b, 0x35
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
lea r12d, [r11 + r10]
add r12b, 0x73
add rax, r9
jmp 0x1401115cd
add r11b, 0x77
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
lea r12d, [r11 + r10]
sub r12b, 0x41
dec r14
inc r14
jmp 0x140110ae3
lea r8d, [r11 + 0x23]
movzx ecx, r10b
and cl, r8b
add cl, cl
movzx r12d, r10b
sub r12b, cl
add r12b, 0xb
add r12b, r8b
sub r11b, 0x4d
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
add r10b, 0x1b
add r10b, r11b
mov byte [rbp + r14 - 0x78], r10b
inc r9
dec r14
inc r14
jmp 0x140110ae3
lea edx, [r14 + 0x25]
movzx ecx, r10b
and cl, dl
add cl, cl
sub r10b, cl
lea r12d, [rdx + r10]
sub r12b, 3
inc r9
dec r14
inc r14
jmp 0x140110ae3
lea edx, [r14 + 0x7b]
movzx ecx, r10b
and cl, dl
add cl, cl
sub r10b, cl
lea r12d, [rdx + r10]
sub r12b, 0x5d
dec r14
inc r14
jmp 0x140110ae3
movabs rcx, 0xea66b164e18adf7d
add rcx, r14
and sil, cl
add sil, sil
sub r10b, sil
lea r12d, [rcx + r10]
sub r12b, 0x6b
movzx ecx, r12b
mov rdx, 0xffffffffffffffff
sub rdx, rcx
add r14, rdx
inc r14
jmp 0x140110ae3
movabs rdx, 0xef336d875a16add3
add rdx, r14
and sil, dl
add sil, sil
movzx r12d, r10b
sub r12b, sil
add r12b, 0x3b
add r12b, dl
movzx r11d, r14b
add r11b, 7
movzx ecx, r11b
and cl, r10b
add cl, cl
sub r11b, cl
sub r11b, 0x31
add r11b, r10b
movzx ecx, r11b
mov byte [rbp + r14 - 0x78], cl
inc r9
add rcx, r9
sub r14, rcx
lea edx, [r14 - 0x24]
movzx ecx, dl
and cl, r10b
add cl, cl
sub dl, cl
sub dl, 4
add dl, r10b
mov byte [rbp + r14 - 0x78], dl
inc rax
mov rcx, 0xffffffffffffffff
sub rcx, rax
add r14, rcx
movzx ecx, byte [rbp + r14 - 0x78]
add rcx, r9
add r14, rcx
inc r14
jmp 0x140110ae3
movabs rcx, 0xf8cce5cc4b2e4a7f
add rcx, r14
and sil, cl
add sil, sil
sub r10b, sil
lea r12d, [rcx + r10]
sub r12b, 0x79
movzx ecx, byte [rbp + r14 - 0x78]
add rcx, r9
add r14, rcx
inc r14
jmp 0x140110ae3
sub r11b, 0x57
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
lea r12d, [r11 + r10]
add r12b, 0x61
jmp 0x140110ae0
dec r11b
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea r12d, [r11 + r10]
add r12b, 7
jmp 0x140110ad0
lea rdx, [rbp + 0x148aea4]
jmp 0x1401116f2
lea rdx, [rbp + 0x142c779]
jmp 0x1401116f2
lea rdx, [rbp - 0x78]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140111700
lea rcx, [rbp - 0x38]
call fcn.1400034e0
mov r15, rax
mov dword [rsp + 0x30], 0x8136a7c
mov dword [rsp + 0x34], 0x65030818
mov dword [rsp + 0x38], 0x771e0607
mov byte [rsp + 0x3c], Ordinal_143
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x3d], xmm0
mov dword [rsp + 0x4d], eax
mov word [rsp + 0x51], ax
nop word [rax + rax]
mov r8, qword [0x1402cdf20]
mov r9, qword [0x1402cdf18]
nop
xor esi, esi
mov r14d, esi
cmp r14, 0x23
jae 0x1401122a4
movzx r11d, byte [rsp + r14 + 0x30]
mov esi, r11d
nop dword [rax + rax]
cmp r8, r14
ja 0x14011229b
lea rax, [r9 + 1]
cmp r8, rax
jae 0x1401117b5
movabs rcx, 0xbe1777c4bb098a44
add rcx, r14
mov rax, rcx
and rax, rsi
imul r13, rax, 0xfffffffffffffffe
add r13, rcx
add r13, rsi
add r13b, 0x24
jmp 0x1401117ee
je 0x14011221e
inc rax
cmp r8, rax
je 0x14011218d
lea rax, [r9 + 2]
cmp r8, rax
je 0x14011215b
lea rax, [r9 + 6]
cmp r8, rax
je 0x140112120
lea rax, [r9 + 3]
cmp r8, rax
je 0x1401120fa
movzx r10d, r14b
cmp r9, r14
ja 0x140112292
lea rax, [r9 + 2]
cmp r8, rax
jae 0x14011181c
lea ecx, [r10 - 0x6c]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r13d, [r11 + rcx]
sub r13b, 0xc
jmp 0x140111850
lea rcx, [r9 + 1]
cmp r8, rcx
je 0x1401120b2
lea rax, [r9 + 3]
cmp r8, rax
je 0x14011208f
lea rax, [r9 + 4]
cmp r8, rax
je 0x140112072
lea rax, [rcx + 1]
cmp r8, rax
je 0x140112057
lea rax, [r9 + r8]
cmp rax, r14
jbe 0x140111dbb
nop dword [rax]
lea rax, [r9 + 0x61]
cmp r8, rax
je 0x140111dad
lea rax, [r9 + 0x42]
cmp r8, rax
je 0x140111d87
lea rax, [r9 + 0x41]
cmp r8, rax
je 0x140111d60
lea rax, [r9 + 0x80]
cmp r8, rax
je 0x140111e78
lea rax, [r9 + 0x2a]
cmp r8, rax
je 0x140111d43
lea rax, [r9 + 0x3e8]
cmp r8, rax
je 0x140111d26
lea rax, [r9 + 2]
cmp r8, rax
je 0x140111d06
lea rax, [r9 + 0x1000]
cmp r8, rax
je 0x140111ce5
lea rax, [r9 + 4]
cmp r8, rax
je 0x140111cb9
lea rax, [r9 + 0x7a]
cmp r8, rax
je 0x140111860
lea r8, [r9 + 6]
lea r9, [r8 + 6]
lea rax, [r9 + 0x64]
cmp r8, rax
jb 0x140112271
lea rax, [r9 + 9]
cmp r8, rax
jb 0x140112254
lea rax, [r9 + 0x200]
cmp r8, rax
jb 0x140111a55
lea rax, [r9 + 1]
cmp r8, rax
jb 0x140111a35
lea rax, [r9 + 0x400]
cmp r8, rax
jb 0x140111a1a
lea rax, [r9 + 3]
cmp r8, rax
jb 0x140111c69
lea rax, [r9 + 0x61]
cmp r8, rax
jb 0x140111c18
lea rax, [r9 + 5]
cmp r8, rax
jb 0x140111bd3
lea rax, [r9 + 0x41]
cmp r8, rax
jb 0x140111bae
lea rax, [r9 + 8]
cmp r8, rax
jb 0x140111860
lea r8, [r9 + 0x80]
lea r9, [r8 + 0x2a]
lea rax, [r9 + 0xa]
cmp r8, rax
ja 0x140111b7e
lea rax, [r9 + 0x3e8]
cmp r8, rax
ja 0x140111b5e
lea rax, [r9 + 0x20]
cmp r8, rax
ja 0x140111b3f
lea rax, [r9 + 0x1000]
cmp r8, rax
ja 0x140111b1e
lea rax, [r9 + 0x40]
cmp r8, rax
ja 0x140111b01
lea rax, [r9 + 0x7a]
cmp r8, rax
ja 0x140111ae2
lea rax, [r9 + 0x64]
cmp r8, rax
ja 0x140111abb
lea rax, [r9 + 0x5a]
cmp r8, rax
ja 0x140111a91
lea rax, [r9 + 0x200]
cmp r8, rax
ja 0x140111a72
lea rax, [r9 + 1]
cmp r8, rax
ja 0x140111860
lea r8, [r9 + 0x10]
lea r9, [r8 + 0x10]
jmp 0x140111860
lea ecx, [r10 - 0x14]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r13d, [r11 + rcx]
sub r13b, 0x74
jmp 0x140111850
lea edx, [r10 + 0x64]
movzx eax, dl
and al, r11b
mov ecx, Ordinal_35
sub cl, al
lea r13d, [rcx + rcx]
add r13b, dl
add r13b, r11b
jmp 0x1401117f2
sub r10b, 0x24
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea r13d, [r11 + r10]
sub r13b, 4
jmp 0x140111780
lea edx, [r10 - 0x60]
movzx eax, r11b
and al, dl
add al, al
movzx r13d, r11b
sub r13b, al
sub r13b, 0x60
add r13b, dl
jmp 0x1401120cd
add r10b, 0x18
movzx eax, r11b
and al, r10b
mov ecx, Ordinal_46
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r11b
add r13b, r10b
inc r9
dec r14
inc r14
jmp 0x140111765
sub r10b, 0x70
movzx eax, r11b
and al, r10b
mov ecx, 8
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r11b
add r13b, r10b
dec r14
inc r14
jmp 0x140111765
lea edx, [r10 + 8]
movzx eax, r11b
and al, dl
add al, al
movzx r13d, r11b
sub r13b, al
sub r13b, 0x38
add r13b, dl
jmp 0x14011213a
add r10b, 0x80
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r13d, [r10 + r11]
add r13b, 0x80
jmp 0x140112171
sub r10b, 8
movzx eax, r11b
and al, r10b
mov ecx, Ordinal_32
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r11b
add r13b, r10b
jmp 0x140112174
lea edx, [r10 + 0x70]
movzx eax, r11b
and al, dl
add al, al
movzx r13d, r11b
sub r13b, al
sub r13b, 0x10
add r13b, dl
jmp 0x1401121b2
sub r10b, 0x18
movzx eax, r11b
and al, r10b
add al, al
movzx r13d, r11b
sub r13b, al
sub r13b, 0x58
add r13b, r10b
jmp 0x1401121dd
add r10b, 0x60
movzx eax, r11b
and al, r10b
mov ecx, Ordinal_50
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r11b
add r13b, r10b
movzx eax, byte [rsp + r14 + 0x30]
add rax, r9
add r14, rax
inc r14
jmp 0x140111765
add r10b, 0xc
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea r13d, [r11 + r10]
sub r13b, 0x54
mov byte [rsp + r14 + 0x30], r13b
inc r14
jmp 0x140111765
lea edx, [r10 - 0x7c]
movzx eax, dl
and al, r11b
mov ecx, reloc.WLDAP32.dll_Ordinal_50
sub cl, al
lea r13d, [rcx + rcx]
add r13b, dl
add r13b, r11b
cmp r9, 0x200
jb 0x140111bc6
lea edx, [r10 + 0x18]
movzx eax, r11b
and al, dl
add al, al
movzx ecx, r11b
sub cl, al
add cl, dl
lea r13d, [rcx*2 - 0x50]
jmp 0x1401120cd
lea edx, [r10 - 4]
movzx eax, dl
and al, r11b
mov ecx, recv
sub cl, al
lea r13d, [rcx + rcx]
add r13b, dl
add r13b, r11b
cmp r8, 8
jae 0x14011201e
lea rax, [r9 + 0x80]
cmp r8, rax
jbe 0x140111f6a
lea edx, [r10 - 0x38]
movzx eax, r11b
and al, dl
add al, al
movzx r13d, r11b
sub r13b, al
sub r13b, 0x78
add r13b, dl
jmp 0x140111bee
lea ecx, [r10 + 0x74]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r13d, [r11 + rcx]
sub r13b, 0x2c
lea rax, [r9 + r8]
cmp rax, 0x40
je 0x140112040
lea rax, [r9 + 0x7a]
cmp r8, rax
jbe 0x140111e98
lea edx, [r10 + 0x34]
movzx eax, r11b
and al, dl
add al, al
movzx r13d, r11b
sub r13b, al
sub r13b, 0x6c
add r13b, dl
jmp 0x140111c33
add r10b, 0x78
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r13d, [r10 + r11]
sub r13b, 0x48
movzx eax, byte [rsp + r14 + 0x30]
add rax, r9
add r14, rax
inc r14
jmp 0x140111765
sub r10b, 0x10
movzx eax, r11b
and al, r10b
mov ecx, gethostname
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r11b
add r13b, r10b
jmp 0x1401121dd
lea edx, [r10 + 0x68]
movzx eax, r11b
and al, dl
mov ecx, reloc.WS2_32.dll_sendto
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r11b
add r13b, dl
jmp 0x1401121b2
sub r10b, 0x20
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r13d, [r10 + r11]
sub r13b, 0x20
jmp 0x140112174
add r10b, 0x58
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r13d, [r10 + r11]
sub r13b, 0x68
jmp 0x140112171
add r10b, 0x48
movzx eax, r10b
and al, r11b
mov ecx, 4
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r10b
add r13b, r11b
dec r14
inc r14
jmp 0x140111765
sub r10b, 0x40
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea r13d, [r11 + r10]
sub r13b, 0x40
inc r9
dec r14
inc r14
jmp 0x140111765
lea edx, [r10 + 0x38]
mov ecx, reloc.WLDAP32.dll_Ordinal_60
jmp 0x1401120bb
lea rax, [r9 + 0x28]
cmp r8, rax
jae 0x140111de4
lea edx, [r10 + 0x44]
movzx eax, dl
and al, r11b
mov ecx, reloc.WS2_32.dll_select
sub cl, al
lea r13d, [rcx + rcx]
add r13b, dl
add r13b, r11b
jmp 0x140111c7f
lea rax, [r9 + 1]
cmp r8, rax
jne 0x140111e19
add r10b, 0x28
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea r13d, [r11 + r10]
sub r13b, 0x18
movzx eax, byte [rsp + r14 + 0x30]
add rax, r9
add r14, rax
inc r14
jmp 0x140111765
inc rax
cmp r8, rax
jne 0x140111e42
sub r10b, 0x50
movzx eax, r10b
and al, r11b
mov ecx, Ordinal_27
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r10b
add r13b, r11b
jmp 0x1401121dd
lea rax, [r9 + 3]
cmp r8, rax
jne 0x140111e6b
lea edx, [r10 + 0x38]
movzx eax, dl
and al, r11b
mov ecx, reloc.WLDAP32.dll_Ordinal_60
sub cl, al
lea r13d, [rcx + rcx]
add r13b, dl
add r13b, r11b
jmp 0x1401121b2
lea rax, [r9 + 5]
cmp r8, rax
jne 0x140111c7f
lea edx, [r10 - 0x30]
movzx eax, r11b
and al, dl
mov ecx, Ordinal_41
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r11b
add r13b, dl
jmp 0x14011213a
lea rcx, [r9 + 1]
cmp r8, rcx
jne 0x140111ec0
lea edx, [r10 - 0x44]
movzx eax, r11b
and al, dl
add al, al
movzx r13d, r11b
sub r13b, al
sub r13b, 0x24
add r13b, dl
jmp 0x1401120cd
lea rax, [r9 + 3]
cmp r8, rax
jne 0x140111ef0
sub r10b, 0x34
movzx eax, r11b
and al, r10b
mov ecx, gethostname
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r11b
add r13b, r10b
dec r14
inc r14
jmp 0x140111765
lea rax, [rcx + 1]
cmp r8, rax
jne 0x140111f18
lea edx, [r10 + 0x54]
movzx eax, r11b
and al, dl
add al, al
movzx r13d, r11b
sub r13b, al
sub r13b, 0x4c
add r13b, dl
jmp 0x14011213a
lea rax, [r9 + 4]
cmp r8, rax
jne 0x140111f42
add r10b, 0x64
movzx eax, r10b
and al, r11b
mov ecx, Ordinal_35
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r10b
add r13b, r11b
jmp 0x140112174
lea rax, [r9 + 6]
cmp r8, rax
jne 0x140111c33
lea ecx, [r10 - 0x14]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r13d, [r11 + rcx]
sub r13b, 0x74
jmp 0x1401121b2
lea rax, [r9 + 1]
cmp r8, rax
jne 0x140111f9f
add r10b, 0x50
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r13d, [r10 + r11]
sub r13b, 0x30
movzx eax, byte [rsp + r14 + 0x30]
add rax, r9
add r14, rax
inc r14
jmp 0x140111765
lea rax, [r9 + 3]
cmp r8, rax
jne 0x140111fc8
lea edx, [r10 + 0x60]
movzx eax, r11b
and al, dl
mov ecx, Ordinal_50
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r11b
add r13b, dl
jmp 0x1401121b2
lea rax, [r9 + 5]
cmp r8, rax
jne 0x140111fee
add r10b, 0x70
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r13d, [r10 + r11]
sub r13b, 0x10
jmp 0x140112171
lea rax, [r9 + 7]
cmp r8, rax
jne 0x140111bee
add r10b, 0x80
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r13d, [r10 + r11]
add r13b, 0x80
dec r14
inc r14
jmp 0x140111765
lea edx, [r10 - 0x60]
movzx eax, r11b
and al, dl
add al, al
movzx r13d, r11b
sub r13b, al
sub r13b, 0x60
add r13b, r11b
add r13b, dl
jmp 0x14011213a
lea ecx, [r10 + 0x28]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r13d, [rcx - 0x18]
jmp 0x1401121b2
lea ecx, [r10 + 0x4c]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r13d, [r11 + rcx]
sub r13b, 0x14
jmp 0x1401121b2
sub r10b, 0x3c
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea r13d, [r11 + r10]
sub r13b, 0x5c
jmp 0x140112174
add r10b, 0x2c
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea r13d, [r11 + r10]
sub r13b, 0x34
dec r14
inc r14
jmp 0x140111765
lea edx, [r10 + 0x1c]
mov ecx, reloc.WLDAP32.dll_Ordinal_30
movzx eax, dl
and al, r11b
sub cl, al
lea r13d, [rcx + rcx]
add r13b, dl
add r13b, r11b
add r10b, 0x5c
movzx eax, r10b
and al, r11b
mov ecx, 0x3e
sub cl, al
add cl, cl
add cl, r10b
add cl, r11b
mov byte [rsp + r14 + 0x30], cl
inc r9
dec r14
inc r14
jmp 0x140111765
lea edx, [r14 - 4]
movzx eax, dl
and al, r11b
mov ecx, recv
sub cl, al
lea r13d, [rcx + rcx]
add r13b, dl
add r13b, r11b
dec r14
inc r14
jmp 0x140111765
movzx r10d, r14b
lea ecx, [r10 + 0x74]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r13d, [r11 + rcx]
sub r13b, 0x2c
sub r10b, 0x1c
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
sub r11b, 0x3c
add r11b, r10b
add r11b, r13b
mov byte [rsp + r14 + 0x30], r11b
jmp 0x140112171
lea ecx, [r14 - 0x14]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r13d, [r11 + rcx]
sub r13b, 0x74
add r8, r9
movzx eax, r13b
mov rcx, 0xffffffffffffffff
sub rcx, rax
add r14, rcx
inc r14
jmp 0x140111765
movabs rcx, 0x32a446611d42c7dc
add rcx, r14
and sil, cl
add sil, sil
movzx r13d, r11b
sub r13b, sil
sub r13b, 4
add r13b, cl
movzx r10d, r14b
add r10b, 0x6c
movzx eax, r11b
and al, r10b
mov ecx, 6
sub cl, al
add cl, cl
add cl, r11b
add cl, r10b
movzx eax, cl
mov byte [rsp + r14 + 0x30], al
inc r9
add rax, r9
sub r14, rax
lea edx, [r14 - 0x50]
movzx eax, dl
and al, r11b
mov ecx, Ordinal_27
sub cl, al
add cl, cl
add cl, dl
add cl, r11b
mov byte [rsp + r14 + 0x30], cl
inc r8
mov rax, 0xffffffffffffffff
sub rax, r8
add r14, rax
movzx eax, byte [rsp + r14 + 0x30]
add rax, r9
add r14, rax
inc r14
jmp 0x140111765
movabs rcx, 0x3a46674e311c9ecc
add rcx, r14
and sil, cl
mov eax, gethostname
sub al, sil
lea r13d, [rax + rax]
add r13b, r11b
add r13b, cl
movzx eax, byte [rsp + r14 + 0x30]
add rax, r9
add r14, rax
inc r14
jmp 0x140111765
add r10b, 0x54
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r13d, [r10 + r11]
sub r13b, 0x4c
jmp 0x140111760
sub r10b, 0x34
movzx eax, r11b
and al, r10b
mov ecx, gethostname
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r11b
add r13b, r10b
jmp 0x140111750
lea rdx, [rbp + 0x168e4e0]
jmp 0x1401122a9
lea rdx, [rbp + 0x1326f24]
jmp 0x1401122a9
lea rdx, [rsp + 0x30]
xor r8d, r8d
lea rcx, [rbp - 0x10]
call fcn.140005aa0
mov r9, r15
mov r8d, recv
mov rdx, rax
lea rcx, [rbp - 0x10]
call fcn.14004dd10
nop
lea rcx, [rbp - 0x38]
call fcn.140002a20
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 0xf
cmova rcx, qword [rbp - 0x10]
xor edx, edx
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov r11, rax
mov eax, 0x5a4d
cmp word [r11], ax
jne 0x14011241b
movsxd rcx, dword [r11 + 0x3c]
cmp dword [rcx + r11], 0x4550
jne 0x14011241b
mov edx, dword [rcx + r11 + 0x88]
test edx, edx
je 0x14011241b
mov esi, dword [rdx + r11 + 0x1c]
lea r14, [r11 + rsi]
mov r9d, dword [rdx + r11 + 0x20]
add r9, r11
mov r15d, dword [rdx + r11 + 0x24]
add r15, r11
xor r10d, r10d
test esi, esi
je 0x140112383
nop dword [rax]
nop word [rax + rax]
mov r8d, dword [r9]
add r8, r11
mov rax, qword [rbp - 0x40]
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140112373
inc rax
test ecx, ecx
jne 0x140112360
test edx, edx
je 0x1401123f3
inc r10d
add r9, 4
cmp r10d, esi
jb 0x140112350
lea rcx, [rbp - 0x10]
call fcn.140002a20
mov r14, qword [rsp + 0x20]
xor r15d, r15d
lea rcx, [rbp + 0x10]
call fcn.140002a20
mov eax, dword [rsp + 0x2c]
inc eax
mov dword [rsp + 0x2c], eax
mov rsi, qword [rbp - 0x80]
cmp eax, dword [rsi]
jb 0x14010ffe0
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.140212e90
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
movsxd rax, r10d
movzx ecx, word [r15 + rax*2]
mov esi, dword [r14 + rcx*4]
mov rax, qword [rbp - 0x50]
add rsi, qword [rax + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x14011241d
xor esi, esi
lea rcx, [rbp - 0x10]
call fcn.140002a20
nop
lea rcx, [rbp + 0x10]
call fcn.140002a20
mov rax, rsi
jmp 0x1401123c6
mov rcx, qword [rdx]
mov rax, r8
xor r8d, r8d
mov rdx, qword [rax]
jmp 0x14010fef0