Function at 0x1400354f0
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x420]
sub rsp, 0x520
mov rax, qword [0x140205108]
xor rax, rsp
mov qword [rbp + 0x410], rax
xor r12d, r12d
mov edi, r8d
mov esi, r12d
mov r15d, edx
cmp qword [0x14020f688], rsi
mov rbx, rcx
je 0x140036119
mov qword [rsp + 0x78], r12
mov r8, 0xffffffffffffffff
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], reloc.WS2_32.dll_ntohs
inc r8
cmp byte [rcx + r8], sil
jne 0x140035554
mov rdx, rbx
lea rcx, [rsp + 0x78]
call fcn.1400090a0
call qword [sym.imp.WINMM.dll_timeGetTime]
mov ecx, dword [0x14020f6c8]
test ecx, ecx
cmove ecx, eax
mov rax, qword [rbp - 0x78]
mov dword [0x14020f6c8], ecx
mov ecx, dword [reloc.WS2_32.dll_accept]
test ecx, ecx
je 0x1400355b3
test rax, rax
jne 0x1400355b3
lea rdx, str.12sNewIP.length____0_no_report
lea ecx, [rax + 4]
call fcn.14002f270
mov r13, qword [rsp + 0x78]
mov r12d, 1
jmp 0x14003594c
mov r13, qword [rsp + 0x78]
mov rsi, qword [reloc.WS2_32.dll_ntohs]
mov r14, qword [0x1402015e0]
test ecx, ecx
je 0x14003592f
test edi, edi
jne 0x14003592f
cmp qword [rbp - 0x70], 0x10
lea rdx, [rsp + 0x78]
mov r8, qword [0x1402015f0]
lea rcx, [0x1402015e0]
cmovae rdx, r13
cmp rsi, 0x10
cmovae rcx, r14
cmp r8, rax
jne 0x14003560c
call fcn.14016bbc0
test eax, eax
je 0x140035938
mov r9d, edi
lea rax, [0x1402015e0]
cmp rsi, 0x10
lea rdx, str.report_new_ip:_s_force:_d__g_lastPubIP:_s
mov edi, 4
mov r8, rbx
cmovae rax, r14
mov ecx, edi
mov qword [rsp + 0x20], rax
call fcn.14002f270
lea rcx, [0x14020f6f8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movdqa xmm0, xmmword [0x1401ac6d0]
mov r8, 0xffffffffffffffff
movdqu xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x58], r12
inc r8
cmp byte [rbx + r8], r12b
jne 0x140035660
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.1400090a0
mov rcx, qword [0x14020f688]
lea rdx, [rsp + 0x58]
mov r8d, r15d
call fcn.140053340
mov esi, eax
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rbx + rcx], r12b
jne 0x140035693
test rcx, rcx
je 0x1400357d4
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
lea rax, [0x140201620]
xorps xmm0, xmm0
lea r9, [rbp + 0xa0]
cmovae rax, qword [0x140201620]
lea r8, [0x1401d4b53]
mov qword [rsp + 0x28], rax
lea rdx, [0x1401a697c]
lea rcx, str.network
mov dword [rsp + 0x20], 0x40
movups xmmword [rbp + 0xa0], xmm0
movups xmmword [rbp + 0xb0], xmm0
movups xmmword [rbp + 0xc0], xmm0
movups xmmword [rbp + 0xd0], xmm0
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x58], r12
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], reloc.WS2_32.dll_ntohs
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], r12b
jne 0x140035730
lea rdx, [rbp + 0xa0]
lea rcx, [rsp + 0x58]
call fcn.1400090a0
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rbx + r8], r12b
jne 0x140035751
mov rdx, rbx
lea rcx, [0x1402015e0]
call fcn.1400090a0
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
lea r9, [0x140201600]
mov r8, rbx
lea rdx, str.publicip
cmovae r9, qword [0x140201600]
lea rcx, str.network
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x1400357d4
mov rcx, qword [rsp + 0x58]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400357cf
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140036157
call fcn.140167ab8
cmp esi, 1
jne 0x1400360d5
xor edx, edx
lea rcx, [rbp + 0x1f0]
mov r8d, 0x104
call fcn.14016b7a0
xor edx, edx
lea rcx, [rbp + 0x300]
mov r8d, 0x104
call fcn.14016b7a0
mov rcx, qword [0x14020f688]
call fcn.14004cf30
mov rcx, qword [0x14020f688]
cmp eax, 2
mov dword [0x14020f6c4], eax
cmove esi, edi
mov dword [rsp + 0x30], esi
call fcn.14002e1a0
cmp dword [reloc.WS2_32.dll_accept], r12d
je 0x1400360d5
xor edx, edx
lea rcx, [rbp + 0xe0]
mov r8d, 0x104
call fcn.14016b7a0
mov r8d, 0x104
lea rdx, [rbp + 0xe0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rax, [rbp + 0xe0]
mov qword [rsp + 0x38], r12
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], reloc.WS2_32.dll_ntohs
inc r8
cmp byte [rax + r8], r12b
jne 0x140035884
lea rdx, [rbp + 0xe0]
lea rcx, [rsp + 0x38]
call fcn.1400090a0
mov r15, qword [rsp + 0x50]
lea rbx, [rsp + 0x38]
mov r14, qword [rsp + 0x38]
cmp r15, 0x10
mov rdi, qword [rsp + 0x48]
cmovae rbx, r14
test rdi, rdi
je 0x14003598f
xorps xmm0, xmm0
lea rcx, [rbp - 3]
xor eax, eax
xor edx, edx
mov r8d, 0xa3
mov qword [rbp - 0x10], rax
movups xmmword [rbp - 0x60], xmm0
mov dword [rbp - 8], eax
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
call fcn.14016b7a0
lea rax, [rdi - 1]
mov byte [rbp - 4], 1
mov rcx, 0xffffffffffffffff
cmp rax, rcx
cmovb rcx, rax
add rcx, rbx
movzx eax, byte [rcx]
cmp byte [rbp + rax - 0x60], r12b
jne 0x14003592a
cmp rcx, rbx
je 0x14003598f
movzx eax, byte [rcx - 1]
dec rcx
cmp byte [rbp + rax - 0x60], r12b
je 0x140035917
sub rcx, rbx
jmp 0x140035996
cmp edi, 1
je 0x14003560c
mov r8, rbx
lea rdx, str.12old_ip:_s__no_report
mov ecx, 4
call fcn.14002f270
mov rax, qword [rbp - 0x70]
cmp rax, 0x10
jb 0x140035987
lea rdx, [rax + 1]
mov rcx, r13
cmp rdx, 0x1000
jb 0x14003597f
mov r13, qword [r13 - 8]
add rdx, 0x27
sub rcx, r13
add rcx, 0xfffffffffffffff8
cmp rcx, 0x1f
ja 0x14003616f
mov rcx, r13
call fcn.140167ab8
mov eax, r12d
jmp 0x14003611b
mov rcx, 0xffffffffffffffff
inc rcx
mov qword [rbp + 0xa0], r12
mov qword [rbp + 0xb8], reloc.WS2_32.dll_ntohs
cmp rdi, rcx
jb 0x140036145
sub rdi, rcx
mov rsi, 0xffffffffffffffff
cmp rdi, rsi
movabs rax, 0x7fffffffffffffff
cmovb rsi, rdi
cmp r15, 0x10
lea rdi, [rsp + 0x38]
movabs r15, 0x8000000000000027
cmovae rdi, r14
add rdi, rcx
mov ecx, reloc.WS2_32.dll_shutdown
cmp rsi, 0xf
ja 0x140035a2f
mov r8, rsi
mov qword [rbp + 0xb0], rsi
mov rdx, rdi
lea rcx, [rbp + 0xa0]
call fcn.14016bcc0
mov byte [rbp + rsi + 0xa0], r12b
mov rbx, qword [rbp + 0xb8]
mov rsi, qword [rbp + 0xb0]
mov r14, qword [rbp + 0xa0]
jmp 0x140035ac5
cmp rsi, rax
ja 0x140036175
mov rbx, rsi
or rbx, 0xf
cmp rbx, rax
jbe 0x140035a4c
mov rbx, rax
mov rax, r15
jmp 0x140035a6d
cmp rbx, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140035a8c
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14003614b
mov rcx, rax
call fcn.140167a7c
test rax, rax
je 0x140036169
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x140035a9e
test rcx, rcx
je 0x140035a9b
call fcn.140167a7c
mov r14, rax
jmp 0x140035a9e
mov r14, r12
mov r8, rsi
mov qword [rbp + 0xb0], rsi
mov rdx, rdi
mov qword [rbp + 0xb8], rbx
mov rcx, r14
call fcn.14016bcc0
mov byte [r14 + rsi], r12b
mov qword [rbp + 0xa0], r14
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x140035b02
mov rcx, qword [rsp + 0x38]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140035afd
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140036169
call fcn.140167ab8
movups xmm0, xmmword [rbp + 0xa0]
cmp rbx, 0x10
lea rdi, [rsp + 0x38]
movups xmm1, xmmword [rbp + 0xb0]
cmovae rdi, r14
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm1
cmp rsi, 5
jb 0x140035b88
lea r15, [rdi + rsi]
mov edx, 0x50
lea r8, [r15 - 4]
mov rcx, rdi
sub r8, rdi
call fcn.14016d3f0
test rax, rax
je 0x140035b7e
nop word [rax + rax]
cmp dword [rax], 0x786f7250
jne 0x140035b62
cmp byte [rax + 4], 0x79
je 0x140035c11
inc rax
lea r8, [r15 - 4]
sub r8, rax
mov rcx, rax
mov edx, 0x50
call fcn.14016d3f0
test rax, rax
jne 0x140035b50
movabs r15, 0x8000000000000027
mov rax, 0xffffffffffffffff
lea rcx, [rax + 5]
mov qword [rbp + 0xa0], r12
mov qword [rbp + 0xb8], reloc.WS2_32.dll_ntohs
cmp rsi, rcx
jb 0x140036145
sub rsi, rcx
lea rax, [rsp + 0x38]
mov rdi, 0xffffffffffffffff
cmp rsi, rdi
cmovb rdi, rsi
cmp rbx, 0x10
cmovae rax, r14
lea r14, [rax + rcx]
cmp rdi, 0xf
ja 0x140035c23
mov r8, rdi
mov qword [rbp + 0xb0], rdi
mov rdx, r14
lea rcx, [rbp + 0xa0]
call fcn.14016bcc0
mov byte [rbp + rdi + 0xa0], r12b
mov rbx, qword [rbp + 0xb8]
mov rdi, qword [rbp + 0xb0]
mov rsi, qword [rbp + 0xa0]
jmp 0x140035cc9
sub rax, rdi
movabs r15, 0x8000000000000027
jmp 0x140035b8f
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
ja 0x140036175
mov rbx, rdi
or rbx, 0xf
cmp rbx, rax
jbe 0x140035c67
mov rbx, rax
mov rax, r15
mov rcx, rax
call fcn.140167a7c
test rax, rax
je 0x140036169
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140035ca2
cmp rbx, 0x16
mov eax, reloc.WS2_32.dll_shutdown
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140035c90
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14003614b
jmp 0x140035c48
test rcx, rcx
je 0x140035c9f
call fcn.140167a7c
mov rsi, rax
jmp 0x140035ca2
mov rsi, r12
mov r8, rdi
mov qword [rbp + 0xb0], rdi
mov rdx, r14
mov qword [rbp + 0xb8], rbx
mov rcx, rsi
call fcn.14016bcc0
mov byte [rsi + rdi], r12b
mov qword [rbp + 0xa0], rsi
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x140035d06
mov rcx, qword [rsp + 0x38]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140035d01
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140036169
call fcn.140167ab8
movups xmm0, xmmword [rbp + 0xa0]
cmp rbx, 0x10
lea r14, [rsp + 0x38]
movups xmm1, xmmword [rbp + 0xb0]
cmovae r14, rsi
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm1
cmp rdi, 1
jb 0x140035d74
mov r8, rdi
lea r15, [rdi + r14]
mov edx, 0x2e
mov rcx, r14
call fcn.14016d3f0
test rax, rax
je 0x140035d74
nop word [rax + rax]
cmp byte [rax], 0x2e
je 0x140035eae
inc rax
mov r8, r15
sub r8, rax
mov rcx, rax
mov edx, 0x2e
call fcn.14016d3f0
test rax, rax
jne 0x140035d50
mov rax, 0xffffffffffffffff
cmp rdi, rax
mov qword [rbp + 0xa0], r12
lea rdx, [rsp + 0x38]
mov qword [rbp + 0xb0], r12
cmovb rax, rdi
mov qword [rbp + 0xb8], reloc.WS2_32.dll_ntohs
cmp rbx, 0x10
lea rcx, [rbp + 0xa0]
mov r8, rax
cmovae rdx, rsi
call fcn.1400090a0
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x140035df4
mov rcx, qword [rsp + 0x38]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140035def
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140036169
call fcn.140167ab8
movups xmm0, xmmword [rbp + 0xa0]
lea rcx, [rbp + 0x1f0]
movups xmm1, xmmword [rbp + 0xb0]
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm1
call fcn.140034360
mov r14, qword [rsp + 0x48]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r14
cmp rax, 7
jb 0x14003615d
cmp qword [rsp + 0x50], 0x10
lea r15, [rsp + 0x38]
lea rsi, [r14 + 7]
mov qword [rbp + 0xa0], r12
cmovae r15, qword [rsp + 0x38]
lea rdi, [rbp + 0xa0]
mov ebx, reloc.WS2_32.dll_ntohs
mov qword [rbp + 0xb0], r12
mov qword [rbp + 0xb8], r12
cmp rsi, rbx
jbe 0x140035ef8
mov rbx, rsi
or rbx, 0xf
cmp rbx, rcx
jbe 0x140035eb6
mov rbx, rcx
movabs rax, 0x8000000000000027
mov rcx, rax
call fcn.140167a7c
test rax, rax
je 0x140036163
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140035ef1
sub rax, r14
jmp 0x140035d7b
cmp rbx, 0x16
mov eax, reloc.WS2_32.dll_shutdown
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140035edf
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140036151
jmp 0x140035e8f
test rcx, rcx
je 0x140035eee
call fcn.140167a7c
mov rdi, rax
jmp 0x140035ef1
mov rdi, r12
mov qword [rbp + 0xa0], rdi
mov eax, dword [str.CDProxy]
lea rcx, [rdi + 7]
mov qword [rbp + 0xb0], rsi
mov r8, r14
mov qword [rbp + 0xb8], rbx
mov rdx, r15
mov dword [rdi], eax
movzx eax, word [0x1401ac834]
mov word [rdi + 4], ax
movzx eax, byte [0x1401ac836]
mov byte [rdi + 6], al
call fcn.14016bcc0
mov byte [rdi + rsi], r12b
mov rdx, qword [rbp + 0xb8]
mov rcx, qword [rbp + 0xb0]
mov rax, rdx
sub rax, rcx
cmp rax, 4
jb 0x140035f83
lea rax, [rcx + 4]
cmp rdx, 0x10
mov qword [rbp + 0xb0], rax
lea rax, [rbp + 0xa0]
cmovae rax, qword [rbp + 0xa0]
mov dword [rax + rcx], 0x6578652e
mov byte [rax + rcx + 4], r12b
lea rax, [rbp + 0xa0]
jmp 0x140035fa5
mov eax, 4
lea r9, [0x1401ac824]
mov edx, eax
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rcx, [rbp + 0xa0]
call fcn.14000ad30
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x68], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], r12b
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0x10
jb 0x140036006
mov rcx, qword [rbp + 0xa0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140036001
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140036163
call fcn.140167ab8
cmp qword [rsp + 0x70], 0x10
lea r9, [rsp + 0x58]
lea r8, [rbp + 0x1f0]
cmovae r9, qword [rsp + 0x58]
lea rdx, str._s_s
lea rcx, [rbp + 0x300]
call fcn.1400031e0
lea rdx, [rbp + 0x300]
lea rcx, str.CDProxy:_s_n
call fcn.14000fa00
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x140036081
mov rcx, qword [rsp + 0x58]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003607c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140036169
call fcn.140167ab8
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x58], r12b
cmp rdx, 0x10
jb 0x1400360d1
mov rcx, qword [rsp + 0x38]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400360cc
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140036169
call fcn.140167ab8
mov esi, dword [rsp + 0x30]
lea rcx, [0x14020f6f8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rbp - 0x70]
cmp rax, 0x10
jb 0x140036119
lea rdx, [rax + 1]
mov rax, r13
cmp rdx, 0x1000
jb 0x140036111
mov r13, qword [r13 - 8]
add rdx, 0x27
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003616f
mov rcx, r13
call fcn.140167ab8
mov eax, esi
mov rcx, qword [rbp + 0x410]
xor rcx, rsp
call fcn.1401677c0
mov rbx, qword [rsp + 0x578]
add rsp, 0x520
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14000a600
int3
call fcn.1400026c0
int3
call fcn.1400026c0
int3
call fcn.14017d6e4
int3
call fcn.1400032a0
int3
call fcn.14017d6e4
int3
call fcn.14017d6e4
int3
call fcn.14017d6e4
int3
call fcn.1400032a0
int3