Function at 0x18000269c
Capabilities:
List tcp connections and listeners
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x4c8]
sub rsp, 0x5a0
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x180017070]
xor rax, rsp
mov qword [rbp + 0x490], rax
mov r12, rcx
xor r15b, r15b
xor edx, edx
lea r13d, [rdx + 2]
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
mov qword [rsp + 0x68], rax
cmp rax, 0xffffffffffffffff
jne 0x180002706
xor eax, eax
jmp 0x180002ff7
and dword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
mov r14d, 8
mov dword [rsp + 0x20], r14d
mov r9d, r13d
xor r8d, r8d
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.IPHLPAPI.DLL_GetExtendedTcpTable]
mov ebx, dword [rsp + 0x30]
mov ecx, ebx
call fcn.1800051a0
mov rsi, rax
test rax, rax
je 0x180002750
mov r8d, ebx
xor edx, edx
mov rcx, rax
call fcn.180008f40
jmp 0x180002752
xor esi, esi
cmp dword [rsp + 0x30], 0
je 0x180002b90
and dword [rsp + 0x28], 0
mov dword [rsp + 0x20], r14d
mov r9d, r13d
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.IPHLPAPI.DLL_GetExtendedTcpTable]
test eax, eax
jne 0x180002b90
xor r13d, r13d
cmp dword [rsi], r13d
jbe 0x180002b90
lea r14, [rsi + 0x1c]
mov ecx, dword [r14 - 0x10]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.180003918
nop
mov ecx, dword [r14 - 8]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.180003918
nop
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x58]
call fcn.18000346c
test al, al
je 0x180002820
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800027f7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180002b60
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x180002b60
lea rdx, str.0.0.0.0
mov rcx, qword [rsp + 0x38]
call fcn.1800063b0
test eax, eax
jne 0x180002858
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180002856
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
jmp 0x1800027f7
lea rdx, str.127.0.0.1
mov rcx, qword [rsp + 0x38]
call fcn.1800063b0
test eax, eax
jne 0x180002893
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18000288e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
jmp 0x1800027f7
mov rax, qword [rsp + 0x38]
cmp dword [rax - 0x10], 0
jne 0x1800028bf
lea rdx, [rax - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800028ba
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
jmp 0x1800027f7
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x80]
call fcn.180008f40
lea rax, [r13 + r13*4]
shl rax, 5
lea rax, [rax + rsi + 0x28]
mov qword [rsp + 0x20], rax
mov r9d, dword [r14]
lea r8, [rbp - 0x80]
mov rdx, rdi
mov rcx, r12
call fcn.180003028
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x280]
call fcn.180008f40
mov ebx, dword [r14]
mov r8d, ebx
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
je 0x180002936
mov r9, rax
mov r8d, ebx
lea rdx, [rbp + 0x280]
mov rcx, r12
call fcn.180003274
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x50]
call fcn.1800039b8
nop
xor ebx, ebx
mov rdx, qword [r12 + 0x68]
mov rax, qword [r12 + 0x70]
sub rax, rdx
sar rax, 3
test rax, rax
je 0x180002a16
mov rax, qword [rsp + 0x50]
mov rdx, qword [rdx + rbx*8]
test rdx, rdx
je 0x180002993
cmp dword [rax - 0x10], 0
jl 0x180002993
mov rcx, rax
call fcn.180005e58
mov r11, rax
test rax, rax
mov rax, qword [rsp + 0x50]
je 0x180002993
sub r11d, eax
cmp r11d, 0xffffffff
jne 0x1800029ae
inc rbx
mov rdx, qword [r12 + 0x68]
mov rcx, qword [r12 + 0x70]
sub rcx, rdx
sar rcx, 3
cmp rbx, rcx
jae 0x180002a16
jmp 0x180002966
xor edi, edi
mov rcx, qword [r12 + 0x88]
mov rax, qword [r12 + 0x90]
sub rax, rcx
sar rax, 3
test rax, rax
je 0x180002ae4
xor eax, eax
mov rdx, qword [rsp + 0x38]
test rdx, rdx
setne al
test eax, eax
je 0x180002b74
mov rcx, qword [rcx + rdi*8]
call fcn.1800063b0
test eax, eax
je 0x180002a16
inc rdi
mov rcx, qword [r12 + 0x88]
mov rax, qword [r12 + 0x90]
sub rax, rcx
sar rax, 3
cmp rdi, rax
jb 0x1800029d0
jmp 0x180002ae4
lea rdx, [rbp + 0x280]
lea rcx, [rsp + 0x50]
call fcn.180003a38
xor ebx, ebx
mov rcx, qword [r12 + 0x68]
mov rax, qword [r12 + 0x70]
sub rax, rcx
sar rax, 3
test rax, rax
je 0x180002af9
mov rdx, qword [rcx + rbx*8]
test rdx, rdx
je 0x180002a6a
mov rcx, qword [rsp + 0x50]
cmp dword [rcx - 0x10], 0
jl 0x180002a6a
call fcn.180005e58
test rax, rax
je 0x180002a6a
sub eax, dword [rsp + 0x50]
cmp eax, 0xffffffff
jne 0x180002a85
inc rbx
mov rcx, qword [r12 + 0x68]
mov rax, qword [r12 + 0x70]
sub rax, rcx
sar rax, 3
cmp rbx, rax
jae 0x180002af9
jmp 0x180002a43
xor edi, edi
mov rcx, qword [r12 + 0x88]
mov rax, qword [r12 + 0x90]
sub rax, rcx
sar rax, 3
test rax, rax
je 0x180002ae4
xor eax, eax
mov rdx, qword [rsp + 0x38]
test rdx, rdx
setne al
test eax, eax
je 0x180002b7f
mov rcx, qword [rcx + rdi*8]
call fcn.1800063b0
test eax, eax
je 0x180002af9
inc rdi
mov rcx, qword [r12 + 0x88]
mov rax, qword [r12 + 0x90]
sub rax, rcx
sar rax, 3
cmp rdi, rax
jb 0x180002aa3
lea rdx, [rsp + 0x38]
lea rcx, [r12 + 0x88]
call fcn.180003e38
mov r15b, 1
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180002b1a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180002b3b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180002b5b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdi, qword [rsp + 0x68]
inc r13d
add r14, 0xa0
cmp r13d, dword [rsi]
jae 0x180002b8a
jmp 0x180002793
mov ecx, 0x80004005
call fcn.180001c84
int3
mov ecx, 0x80004005
call fcn.180001c84
nop
mov r14d, 8
and dword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
mov dword [rsp + 0x20], r14d
mov r13d, 0x17
mov r9d, r13d
xor r8d, r8d
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.IPHLPAPI.DLL_GetExtendedTcpTable]
test rsi, rsi
je 0x180002bc5
mov rcx, rsi
call fcn.180006104
mov edi, dword [rsp + 0x30]
mov ecx, edi
call fcn.1800051a0
mov rbx, rax
test rax, rax
je 0x180002be7
mov r8d, edi
xor edx, edx
mov rcx, rax
call fcn.180008f40
jmp 0x180002be9
xor ebx, ebx
cmp dword [rsp + 0x30], 0
je 0x180002fdb
and dword [rsp + 0x28], 0
mov dword [rsp + 0x20], r14d
mov r9d, r13d
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.IPHLPAPI.DLL_GetExtendedTcpTable]
test eax, eax
jne 0x180002fdb
xor r13d, r13d
cmp dword [rbx], r13d
jbe 0x180002fdb
lea r14, [rbx + 0x3c]
lea rdi, [r13 + r13*2]
shl rdi, 6
lea rcx, [rdi + rbx + 8]
test rcx, rcx
je 0x180002c50
lea rdx, [rbp + 0x180]
call fcn.18000386c
mov esi, 0x100
jmp 0x180002c66
mov esi, 0x100
mov r8d, esi
xor edx, edx
lea rcx, [rbp + 0x180]
call fcn.180008f40
lea rcx, [rdi + rbx + 0x20]
test rcx, rcx
je 0x180002c7e
lea rdx, [rbp + 0x80]
call fcn.18000386c
jmp 0x180002c8f
mov r8, rsi
xor edx, edx
lea rcx, [rbp + 0x80]
call fcn.180008f40
lea rdx, [rbp + 0x180]
lea rcx, [rsp + 0x60]
call fcn.1800039b8
nop
lea rdx, [rbp + 0x80]
lea rcx, [rsp + 0x40]
call fcn.1800039b8
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.18000366c
test al, al
je 0x180002cef
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or rdi, 0xffffffffffffffff
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x180002cea
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
jmp 0x180002f92
mov rax, qword [rsp + 0x40]
cmp dword [rax - 0x10], 0
jne 0x180002d1e
lea rdx, [rax - 0x18]
or rdi, 0xffffffffffffffff
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x180002d19
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
jmp 0x180002f92
mov r8, rsi
xor edx, edx
lea rcx, [rbp - 0x80]
call fcn.180008f40
lea r11, [rdi + rbx + 0x48]
mov qword [rsp + 0x20], r11
mov r9d, dword [r14]
lea r8, [rbp - 0x80]
mov rdx, qword [rsp + 0x68]
mov rcx, r12
call fcn.180003028
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x280]
call fcn.180008f40
mov edi, dword [r14]
mov r8d, edi
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
je 0x180002d8b
mov r9, rax
mov r8d, edi
lea rdx, [rbp + 0x280]
mov rcx, r12
call fcn.180003274
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x48]
call fcn.1800039b8
nop
xor edi, edi
mov rdx, qword [r12 + 0x68]
mov rax, qword [r12 + 0x70]
sub rax, rdx
sar rax, 3
test rax, rax
je 0x180002e6b
mov rax, qword [rsp + 0x48]
mov rdx, qword [rdx + rdi*8]
test rdx, rdx
je 0x180002de8
cmp dword [rax - 0x10], 0
jl 0x180002de8
mov rcx, rax
call fcn.180005e58
mov r11, rax
test rax, rax
mov rax, qword [rsp + 0x48]
je 0x180002de8
sub r11d, eax
cmp r11d, 0xffffffff
jne 0x180002e03
inc rdi
mov rdx, qword [r12 + 0x68]
mov rcx, qword [r12 + 0x70]
sub rcx, rdx
sar rcx, 3
cmp rdi, rcx
jae 0x180002e6b
jmp 0x180002dbb
xor esi, esi
mov rcx, qword [r12 + 0x88]
mov rax, qword [r12 + 0x90]
sub rax, rcx
sar rax, 3
test rax, rax
je 0x180002f39
xor eax, eax
mov rdx, qword [rsp + 0x40]
test rdx, rdx
setne al
test eax, eax
je 0x180002fc5
mov rcx, qword [rcx + rsi*8]
call fcn.1800063b0
test eax, eax
je 0x180002e6b
inc rsi
mov rcx, qword [r12 + 0x88]
mov rax, qword [r12 + 0x90]
sub rax, rcx
sar rax, 3
cmp rsi, rax
jb 0x180002e25
jmp 0x180002f39
lea rdx, [rbp + 0x280]
lea rcx, [rsp + 0x48]
call fcn.180003a38
xor edi, edi
mov rcx, qword [r12 + 0x68]
mov rax, qword [r12 + 0x70]
sub rax, rcx
sar rax, 3
test rax, rax
je 0x180002f4e
mov rdx, qword [rcx + rdi*8]
test rdx, rdx
je 0x180002ebf
mov rcx, qword [rsp + 0x48]
cmp dword [rcx - 0x10], 0
jl 0x180002ebf
call fcn.180005e58
test rax, rax
je 0x180002ebf
sub eax, dword [rsp + 0x48]
cmp eax, 0xffffffff
jne 0x180002eda
inc rdi
mov rcx, qword [r12 + 0x68]
mov rax, qword [r12 + 0x70]
sub rax, rcx
sar rax, 3
cmp rdi, rax
jae 0x180002f4e
jmp 0x180002e98
xor esi, esi
mov rcx, qword [r12 + 0x88]
mov rax, qword [r12 + 0x90]
sub rax, rcx
sar rax, 3
test rax, rax
je 0x180002f39
xor eax, eax
mov rdx, qword [rsp + 0x40]
test rdx, rdx
setne al
test eax, eax
je 0x180002fd0
mov rcx, qword [rcx + rsi*8]
call fcn.1800063b0
test eax, eax
je 0x180002f4e
inc rsi
mov rcx, qword [r12 + 0x88]
mov rax, qword [r12 + 0x90]
sub rax, rcx
sar rax, 3
cmp rsi, rax
jb 0x180002ef8
lea rdx, [rsp + 0x40]
lea rcx, [r12 + 0x88]
call fcn.180003e38
mov r15b, 1
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
or rdi, 0xffffffffffffffff
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x180002f72
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x180002f92
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x180002fb1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
inc r13d
add r14, 0xc0
cmp r13d, dword [rbx]
jae 0x180002fdb
jmp 0x180002c2a
mov ecx, 0x80004005
call fcn.180001c84
int3
mov ecx, 0x80004005
call fcn.180001c84
nop
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x180002ff3
mov rcx, rbx
call fcn.180006104
movzx eax, r15b
mov rcx, qword [rbp + 0x490]
xor rcx, rsp
call fcn.1800051c0
lea r11, [rsp + 0x5a0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret