Function at 0x18000b5a0
Capabilities:
Check os version

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x6e8]
sub rsp, 0x7e8
mov rax, qword [0x1800b7160]
xor rax, rsp
mov qword [rbp + 0x6d0], rax
mov rax, qword [rbp + 0x768]
mov r10, r9
mov r13, qword [rbp + 0x778]
mov rsi, r8
mov rbx, qword [rbp + 0x770]
mov r11d, 1
mov qword [rbp - 0x38], rax
mov r15, rcx
mov rax, qword [rbp + 0x780]
mov qword [rbp - 0x70], r9
xor r9d, r9d
mov qword [rsp + 0x78], r8
mov r8, qword [rbp + 0x760]
movzx r12d, dx
mov qword [rbp - 0x30], rax
mov word [rsp + 0x74], r12w
mov qword [rbp - 0x80], r8
mov qword [rbp + 8], r13
mov qword [rbp - 0x18], r9
mov dword [rbp - 0x78], r11d
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x60], r9
test byte [0x1800b78f1], 4
jne 0x180037638
cmp dword [r13 + 0x18], 0
lea r14, [r13 + 0x10]
mov qword [rbp], r14
mov qword [r14], r9
jne 0x18000c0e7
mov rax, qword [rsi]
bt rax, 8
jb 0x18003766f
bt rax, 0x1a
jb 0x18003767b
bt rax, 0x19
jb 0x180037688
bt rax, 0xa
jb 0x18000c0f0
bt rax, 0x12
jb 0x18000c0fc
mov qword [r13 + 8], rax
mov dword [rsp + 0x70], r9d
test rbx, rbx
jne 0x18000c1ee
mov rdi, qword [rsi]
test r8, r8
mov ebx, r9d
cmovne ebx, r11d
test byte [0x1800b85c0], 4
jne 0x180037694
mov ebx, dword [rsp + 0x70]
test ebx, ebx
jne 0x18000c21c
cmp dword [0x1800b7ec0], 0
je 0x18000c2f7
test r15, r15
je 0x180037a09
cmp word [r15], r9w
mov ebx, r9d
mov eax, dword [rsi]
cmove ebx, r11d
bt rax, 0x1e
jae 0x18000be3a
test ebx, ebx
jne 0x180037a09
test byte [0x1800b78f3], 0x40
jne 0x180037867
cmp r12d, 1
jbe 0x18000bdf8
cmp r12d, 0x1c
jne 0x18000bde7
xor edi, edi
lea rcx, [rbp + 0x20]
xor r8d, r8d
mov dword [rsp + 0x20], edi
mov rdx, r15
call fcn.18001f6f4
test eax, eax
jne 0x1800378f5
lea rbx, [r13 + 0x10]
mov r14d, 1
test byte [0x1800b78f1], 0x40
jne 0x18003795f
mov rdx, r15
lea rcx, [rbp + 0x78]
call fcn.18000ca1c
test eax, eax
jne 0x18003797c
mov rsi, qword [rsp + 0x78]
mov rax, qword [rsi]
bt rax, 0xe
jae 0x18000b782
cmp r12d, 0x1c
jne 0x18000be22
cmp dword [0x1800b79d4], 0
jne 0x180037a49
xor edx, edx
lea ecx, [rdx + 2]
call sym.DNSAPI.dll_Reg_ReadGlobalsEx
cmp dword [0x1800b7a5c], 0
mov rcx, qword [rsi]
jne 0x180037a7d
movzx eax, cl
and al, 0x18
cmp al, 0x18
je 0x18000c0c0
test cl, 0x20
jne 0x18000bba3
xor r8d, r8d
bt rcx, 0x1c
jb 0x180037a89
mov ebx, r14d
and ecx, 0x4000
mov dword [rbp - 0x54], r8d
mov edi, r8d
mov qword [rbp - 8], rcx
setne dil
mov r14d, r8d
mov dword [rbp - 0x58], edi
mov esi, r8d
cmp r12d, 0x1c
jne 0x18000c237
lea rdx, str.loopback
mov qword [r13 + 0x10], r8
cmp r15, rdx
je 0x180037ba9
mov rsi, 0xffffffffffffffff
test r15, r15
je 0x18000b846
mov rcx, rsi
nop dword [rax + rax]
inc rcx
cmp word [r15 + rcx*2], 0
jne 0x18000b820
cmp ecx, 8
je 0x18000c3f5
cmp ecx, 7
je 0x180037a91
cmp ecx, 9
je 0x18000c3e4
lea rdx, str.localhost
cmp r15, rdx
je 0x180037ba9
test r15, r15
je 0x18000b886
mov rcx, rsi
nop
inc rcx
cmp word [r15 + rcx*2], 0
jne 0x18000b860
cmp ecx, 9
je 0x18000c437
cmp ecx, 8
je 0x18000c429
cmp ecx, 0xa
je 0x18000c0cb
lea rdx, str...localmachine
mov qword [rbp + 0x60], r8
mov qword [rbp - 0x50], r8
cmp r15, rdx
je 0x180037aae
test r15, r15
je 0x18000b8d6
mov rcx, rsi
nop word [rax + rax]
inc rcx
cmp word [r15 + rcx*2], 0
jne 0x18000b8b0
cmp ecx, 0xe
je 0x18000bf1d
cmp ecx, 0xd
je 0x18000c2a2
cmp ecx, 0xf
je 0x18000c1b5
mov edx, 1
mov r12d, r8d
test r12d, r12d
mov word [rbp + 0x3c0], r8w
mov r13d, r8d
mov word [rbp + 0x1c0], r8w
cmove r13d, ebx
mov r14d, r8d
xor eax, eax
mov edi, r8d
mov ecx, 2
lock cmpxchg dword [0x1800b7f98], ecx
cmp eax, 1
jne 0x18000be64
mov ebx, pe_nt_image_headers64
lea r9, [0x1800b8030]
lea rax, [rbp + 0x3c0]
mov edx, ebx
sub r9, rax
lea rcx, [rbp + 0x3c0]
nop word [rax + rax]
lea rax, [rdx + 0x7ffffefe]
test rax, rax
je 0x18000b968
movzx eax, word [rcx + r9]
test ax, ax
je 0x18000b968
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x18000b940
jmp 0x180037ac5
test rdx, rdx
je 0x180037ac5
lea r9, [0x1800b8230]
mov word [rcx], r8w
lea rax, [rbp + 0x1c0]
mov rdx, rbx
sub r9, rax
lea rcx, [rbp + 0x1c0]
lea rax, [rdx + 0x7ffffefe]
test rax, rax
je 0x18000b9b8
movzx eax, word [rcx + r9]
test ax, ax
je 0x18000b9b8
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x18000b990
jmp 0x180037ace
test rdx, rdx
je 0x180037ace
mov word [rcx], r8w
mov edi, 1
lea rax, [rbp + 0x3c0]
cmp r15, rax
je 0x18000bf8b
test r15, r15
je 0x18000ba28
mov rdx, rsi
inc rdx
cmp word [r15 + rdx*2], 0
jne 0x18000b9e2
lea rax, [rbp + 0x3c0]
mov rcx, rsi
nop word [rax + rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x18000ba00
cmp ecx, edx
je 0x18000bf59
lea eax, [rdx + 1]
cmp ecx, eax
je 0x18000c2b5
lea eax, [rcx + 1]
cmp eax, edx
je 0x18000c1c6
lea rax, [rbp + 0x1c0]
cmp r15, rax
je 0x18000bf8b
test r15, r15
je 0x18000ba7d
mov rdx, rsi
inc rdx
cmp word [r15 + rdx*2], 0
jne 0x18000ba40
lea rax, [rbp + 0x1c0]
mov rcx, rsi
inc rcx
cmp word [rax + rcx*2], 0
jne 0x18000ba55
cmp ecx, edx
je 0x18000c089
lea eax, [rdx + 1]
cmp ecx, eax
je 0x18000c2cc
lea eax, [rcx + 1]
cmp eax, edx
je 0x18000c1da
mov rcx, rbx
lea rax, [rbp + 0x1c0]
cmp word [rax], 0
je 0x18000ba9c
add rax, 2
sub rcx, 1
jne 0x18000ba87
jmp 0x180037b72
test rcx, rcx
je 0x180037b72
sub rbx, rcx
lea rax, [rbp + 0x1c0]
xor edx, edx
lea r9, str..local
mov r10d, edx
mov r8d, 0x7ffffffe
lea rax, [rax + rbx*2]
sub r9, rax
test r8, r8
je 0x18000baec
movzx edx, word [rax + r9]
test dx, dx
je 0x18000baec
mov word [rax], dx
dec r8
add rax, 2
sub rcx, 1
jne 0x18000bac8
jmp 0x180037b5c
test rcx, rcx
je 0x180037b5c
xor edi, edi
mov word [rax], di
test r10d, r10d
js 0x18000bb48
test r15, r15
je 0x18000bb48
mov rcx, rsi
nop word [rax + rax]
inc rcx
cmp word [r15 + rcx*2], di
jne 0x18000bb10
lea rax, [rbp + 0x1c0]
inc rsi
cmp word [rax + rsi*2], di
jne 0x18000bb21
cmp esi, ecx
je 0x18000c258
lea eax, [rcx + 1]
cmp esi, eax
je 0x18000c246
lea eax, [rsi + 1]
cmp eax, ecx
je 0x18000c3c9
test r12d, r12d
jne 0x18000bf8d
movzx r12d, word [rsp + 0x74]
mov r14d, 0x232b
mov esi, dword [rbp - 0x54]
mov rcx, qword [rbp + 0x60]
test rcx, rcx
jne 0x180037b87
test r14d, r14d
je 0x18000c080
mov rax, qword [rbp - 0x50]
test rax, rax
jne 0x180037b99
mov rcx, qword [rbp]
mov r13, qword [rbp + 8]
mov qword [rcx], rax
test byte [0x1800b78f1], 4
jne 0x180037bc9
test esi, esi
jne 0x18000c19a
mov esi, 2
xor edi, edi
mov ecx, esi
xor edx, edx
mov ebx, edi
call sym.DNSAPI.dll_Reg_ReadGlobalsEx
cmp dword [0x1800b7abc], ebx
jne 0x180037bfd
xor edx, edx
mov dword [rbp - 0x44], 0x104
mov r8d, 0x104
lea rcx, [rbp + 0x5c0]
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
mov dword [rsp + 0x28], esi
lea rdx, [rbp - 0x44]
mov esi, 1
lea rcx, [rbp + 0x5c0]
xor r9d, r9d
mov dword [rsp + 0x20], esi
mov r8, r15
call fcn.180013dd0
test eax, eax
je 0x180037c07
mov dword [rbp - 0x40], edi
test byte [0x1800b78f1], 4
jne 0x180037c34
lea rax, [rbp - 0x40]
mov r9d, ebx
mov qword [rsp + 0x28], rax
lea rcx, [rbp + 0x5c0]
lea rax, [rbp - 0x10]
mov r8d, esi
xor edx, edx
mov qword [rsp + 0x20], rax
call fcn.180009000
mov r14d, eax
cmp eax, 0x7b
je 0x180037c55
mov dword [rbp - 0x68], r14d
test r14d, r14d
jne 0x18000c290
call qword [sym.imp.IPHLPAPI.DLL_GetCurrentThreadCompartmentId]
nop dword [rax + rax]
cmp eax, dword [0x1800b7d48]
mov esi, eax
jne 0x180037c60
mov edx, dword [rbp - 0x78]
cmp r12w, 0x34
ja 0x18000c111
movzx eax, r12w
lea rcx, [0x18009f510]
mov ecx, dword [rcx + rax*4]
test ecx, ecx
mov ebx, edi
sete bl
cmp dword [r13 + 0x18], edi
jne 0x18000c118
cmp qword [rbp - 0x70], rdi
jne 0x18000c118
mov r14, qword [rsp + 0x78]
mov rcx, qword [r14]
movzx eax, cl
and al, 0x18
cmp al, 0x18
je 0x18000c0dc
movabs rax, 0x10000000000000
test rax, rcx
jne 0x180037c87
mov rax, qword [rbp - 0x80]
test rax, rax
jne 0x180037c92
mov rdi, r15
test edx, edx
je 0x18000c135
test ebx, ebx
jne 0x18000c12b
mov r14d, dword [rsp + 0x70]
lea rcx, [rbp - 0x68]
mov qword [rsp + 0x60], rcx
lea r9, [r13 + 8]
mov rcx, qword [rbp - 0x38]
movzx r8d, r12w
mov qword [rsp + 0x58], r13
mov rdx, rdi
mov qword [rsp + 0x50], rcx
xor ecx, ecx
mov dword [rsp + 0x48], ecx
mov rcx, qword [rbp - 0x30]
mov qword [rsp + 0x40], rax
mov eax, dword [rbp + 0x758]
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], eax
mov eax, dword [rbp + 0x750]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r14d
call fcn.1800080f0
mov ebx, eax
test eax, eax
jne 0x180037d4a
mov r14d, dword [rbp - 0x68]
cmp r14d, 0x267b
je 0x180037dd5
cmp r14d, 0x2522
je 0x180037ecc
mov rsi, qword [rsp + 0x78]
mov rbx, qword [rbp - 0x28]
mov dword [r13 + 4], r14d
test rbx, rbx
jne 0x180037e1e
test byte [0x1800b85c0], 4
mov rbx, qword [r13 + 0x10]
mov rdi, qword [rsi]
jne 0x180037e2c
mov rbx, qword [rbp - 0x60]
mov rcx, qword [rbp - 0x18]
test rcx, rcx
jne 0x180037ef2
test rbx, rbx
jne 0x180037efd
test byte [0x1800b78f1], 4
jne 0x180037f0b
mov eax, r14d
mov rcx, qword [rbp + 0x6d0]
xor rcx, rsp
call fcn.18002d5c0
add rsp, 0x7e8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
test r12w, r12w
je 0x18000b721
xor edi, edi
jmp 0x18000b73e
mov qword [rbp - 0x20], r9
lea r8, [rbp - 0x20]
lea r9, [rbp - 0x48]
mov dl, 1
mov rcx, r15
call qword [sym.imp.ntdll.dll_RtlIpv4StringToAddressW]
nop dword [rax + rax]
test eax, eax
js 0x18000b717
jmp 0x18003788e
mov r14d, 0x57
test byte [0x1800b78f1], 4
je 0x18000bd74
jmp 0x180037a32
lea rdx, str...DnsServers
mov rcx, r15
call qword [sym.imp.api_ms_win_core_crt_l1_1_0.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x180037838
xor r9d, r9d
lea r11d, [r9 + 1]
jmp 0x18000b6f8
cmp eax, ecx
je 0x18000be6a
mov edi, edx
mov ecx, edx
call fcn.180017e98
mov rbx, rax
test rax, rax
je 0x180037ad7
mov r8, rax
lea rcx, [rbp + 0x3c0]
mov edx, pe_nt_image_headers64
call fcn.180008070
mov rcx, rbx
call sym.DNSAPI.dll_DnsApiFree
mov ecx, 1
call fcn.1800193b4
mov rbx, rax
test rax, rax
je 0x180037b0c
mov r8, rax
lea rcx, [rbp + 0x1c0]
mov edx, pe_nt_image_headers64
call fcn.180008070
mov rcx, rbx
call sym.DNSAPI.dll_DnsApiFree
test edi, edi
je 0x18000c3b6
test r14d, r14d
jne 0x180037b41
mov ebx, pe_nt_image_headers64
lea r8, [rbp + 0x3c0]
mov edx, ebx
lea rcx, [0x1800b8030]
call fcn.180008070
lea r8, [rbp + 0x1c0]
mov edx, ebx
lea rcx, [0x1800b8230]
call fcn.180008070
mov edi, 1
mov eax, edi
xchg dword [0x1800b7f98], eax
jmp 0x18000b9ca
mov dword [rsp + 0x28], ecx
mov r9d, ecx
mov qword [rsp + 0x20], rdx
mov r8, r15
mov edx, 1
lea ecx, [rdx + 0x7e]
call qword [sym.imp.api_ms_win_core_string_l1_1_0.dll_CompareStringW]
nop dword [rax + rax]
xor r8d, r8d
mov edx, 1
cmp eax, 2
jne 0x18000b8db
mov r12d, edx
jmp 0x18000b8de
mov dword [rsp + 0x28], edx
lea rax, [rbp + 0x3c0]
mov r9d, edx
mov qword [rsp + 0x20], rax
mov edx, edi
mov r8, r15
mov ecx, 0x7f
call qword [sym.imp.api_ms_win_core_string_l1_1_0.dll_CompareStringW]
nop dword [rax + rax]
cmp eax, 2
jne 0x18000ba28
xor edi, edi
cmp qword [rbp - 8], 0
mov ebx, 1
movzx r12d, word [rsp + 0x74]
mov esi, ebx
je 0x18000c2e3
mov ecx, 2
lea rdx, [rbp + 0x60]
call qword [sym.imp.IPHLPAPI.DLL_GetUnicastIpAddressTable]
nop dword [rax + rax]
mov r14d, eax
test eax, eax
jne 0x18000bb60
lea rax, [rbp - 0x50]
mov edx, ebx
mov ebx, dword [rbp - 0x58]
lea rcx, [rbp + 0x3c0]
mov qword [rsp + 0x28], rax
mov r9d, r13d
mov rax, qword [rbp + 0x60]
mov r8d, ebx
mov qword [rsp + 0x20], rax
call fcn.18002cacc
mov r14d, eax
test eax, eax
jne 0x18000bb60
mov rcx, qword [rbp + 0x60]
call qword [sym.imp.IPHLPAPI.DLL_FreeMibTable]
nop dword [rax + rax]
xor edi, edi
mov qword [rbp + 0x60], rdi
cmp r12w, 0x1c
jne 0x18000c3dd
mov ecx, 0x17
lea rdx, [rbp + 0x60]
call qword [sym.imp.IPHLPAPI.DLL_GetUnicastIpAddressTable]
nop dword [rax + rax]
mov r14d, eax
test eax, eax
jne 0x18000c3dd
lea edx, [rax + 0x1c]
mov r9d, r13d
lea rax, [rbp - 0x50]
mov r8d, ebx
mov qword [rsp + 0x28], rax
lea rcx, [rbp + 0x3c0]
mov rax, qword [rbp + 0x60]
mov qword [rsp + 0x20], rax
call fcn.18002cacc
mov r14d, eax
test eax, eax
jne 0x18000c3dd
mov rcx, qword [rbp + 0x60]
call qword [sym.imp.IPHLPAPI.DLL_FreeMibTable]
nop dword [rax + rax]
mov qword [rbp + 0x60], rdi
mov rax, qword [rbp - 0x50]
jmp 0x18000bb83
mov dword [rsp + 0x28], edx
lea rax, [rbp + 0x1c0]
mov r9d, edx
mov qword [rsp + 0x20], rax
mov edx, edi
mov r8, r15
mov ecx, 0x7f
call qword [sym.imp.api_ms_win_core_string_l1_1_0.dll_CompareStringW]
nop dword [rax + rax]
cmp eax, 2
jne 0x18000ba7d
jmp 0x18000bf8b
mov r14d, 0x57
jmp 0x18000bd74
cmp word [r15 + 0x12], 0x2e
jne 0x18000b886
jmp 0x180037aa4
mov r14d, 0x57
jmp 0x18000bd6f
mov qword [r13 + 0x20], r9
jmp 0x18000b658
or rax, 0x68
mov qword [rsi], rax
jmp 0x18000b687
movabs rcx, 0x100000000000
or rax, rcx
mov qword [rsi], rax
jmp 0x18000b692
mov ecx, edi
jmp 0x18000bc8c
mov r14, qword [rsp + 0x78]
mov ebx, 1
or qword [r14], 8
jmp 0x18000bcac
test byte [r14], 0x10
jne 0x18000bcef
mov r14d, dword [rsp + 0x70]
test byte [0x1800b78f1], 4
jne 0x180037dfd
mov rcx, qword [rbp - 0x38]
lea r9, [r13 + 8]
mov qword [rsp + 0x58], r13
movzx r8d, r12w
mov qword [rsp + 0x50], rcx
mov rdx, rdi
mov rcx, qword [rbp - 0x30]
mov qword [rsp + 0x48], rax
mov eax, dword [rbp + 0x758]
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x38], eax
mov eax, dword [rbp + 0x750]
mov dword [rsp + 0x30], eax
mov rax, qword [rbp - 0x70]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rax
call fcn.1800272c8
nop
jmp 0x18003785f
test r14d, r14d
jne 0x18000bba3
test byte [0x1800b78f1], 4
je 0x18000bd62
jmp 0x180037be6
cmp word [r15 + 0x1c], 0x2e
jne 0x18000b8d6
jmp 0x180037abb
movsxd rax, ecx
cmp word [r15 + rax*2], 0x2e
jne 0x18000ba28
jmp 0x180037b4e
movsxd rax, ecx
cmp word [r15 + rax*2], 0x2e
jne 0x18000ba7d
jmp 0x180037b55
cmp dword [rbx], 0x80000001
jne 0x18000b6a4
mov edx, 0xc
mov rcx, rbx
call fcn.18002a730
test rax, rax
je 0x18000b6a4
mov ebx, dword [rax + 0x18]
mov dword [rsp + 0x70], ebx
jmp 0x18000b6a4
test byte [0x1800b78f1], 4
jne 0x180037773
test r10, r10
je 0x18000b6ca
jmp 0x180037797
cmp r12d, 1
je 0x18000b7f8
jmp 0x18000bb8e
movsxd rax, ecx
cmp word [rbp + rax*2 + 0x1c0], 0x2e
jne 0x18000bb48
mov dword [rsp + 0x28], ecx
lea rax, [rbp + 0x1c0]
mov edx, 1
mov qword [rsp + 0x20], rax
mov r9d, ecx
mov r8, r15
lea ecx, [rdx + 0x7e]
call qword [sym.imp.api_ms_win_core_string_l1_1_0.dll_CompareStringW]
nop dword [rax + rax]
cmp eax, 2
jne 0x18000bb48
jmp 0x18000bf8d
cmp r14d, 0x2554
je 0x18000bc56
jmp 0x180037c0d
movsxd rax, ecx
cmp word [rdx + rax*2], 0x2e
jne 0x18000b8d6
jmp 0x18000bf1d
movsxd rax, edx
cmp word [rbp + rax*2 + 0x3c0], 0x2e
jne 0x18000ba28
jmp 0x18000bf59
movsxd rax, edx
cmp word [rbp + rax*2 + 0x1c0], 0x2e
jne 0x18000ba7d
jmp 0x18000c089
cmp r12w, bx
je 0x18000bfa5
mov ebx, dword [rbp - 0x58]
xor edi, edi
jmp 0x18000c00f
lea rcx, [0x1800b7d60]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop dword [rax + rax]
cmp dword [0x1800b7ec0], 0
jne 0x18000c397
xor edx, edx
lea rcx, [sym.DNSAPI.dll_DnsGlobals]
mov r8d, 0x140
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
mov ebx, 1
lea rcx, [rbp + 0xa4]
xor edx, edx
mov dword [0x1800b79cc], ebx
mov r8d, 0x118
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
lea rcx, [rbp + 0xa0]
mov dword [rbp + 0xa0], 0x11c
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetVersionExW]
nop dword [rax + rax]
test eax, eax
je 0x1800377c2
movzx eax, byte [rbp + 0x1ba]
cmp al, bl
jne 0x1800377ec
mov dword [0x1800b79d0], ebx
mov dword [0x1800b7ec0], ebx
test byte [0x1800b78f0], 4
jne 0x180037809
lea rcx, [0x1800b7d60]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
xor r9d, r9d
lea r11d, [r9 + 1]
jmp 0x18000b6d7
test r14d, r14d
jne 0x180037b79
mov ebx, pe_nt_image_headers64
jmp 0x18000b9c5
movsxd rax, esi
cmp word [r15 + rax*2], 0x2e
jne 0x18000bb48
jmp 0x180037b6b
xor edi, edi
jmp 0x18000bb60
cmp word [r15 + 0x10], 0x2e
jne 0x18000b846
mov ecx, 8
mov dword [rsp + 0x28], ecx
mov r9d, ecx
mov qword [rsp + 0x20], rdx
mov r8, r15
mov edx, 1
lea ecx, [rdx + 0x7e]
call qword [sym.imp.api_ms_win_core_string_l1_1_0.dll_CompareStringW]
nop dword [rax + rax]
cmp eax, 2
je 0x180037ba9
xor r8d, r8d
jmp 0x18000b846
movsxd rax, ecx
cmp word [rdx + rax*2], 0x2e
jne 0x18000b886
mov dword [rsp + 0x28], ecx
mov r9d, ecx
mov qword [rsp + 0x20], rdx
mov r8, r15
mov edx, 1
lea ecx, [rdx + 0x7e]
call qword [sym.imp.api_ms_win_core_string_l1_1_0.dll_CompareStringW]
nop dword [rax + rax]
cmp eax, 2
je 0x180037ba9
xor r8d, r8d
jmp 0x18000b886
mov eax, dword [r13 + 0x18]
mov r9d, r12d
mov dword [rsp + 0x38], eax
mov r8, r15
mov eax, dword [rsi]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], r10
mov dword [rsp + 0x20], eax
call fcn.18008a570
mov r8, qword [rbp - 0x80]
xor r9d, r9d
mov r10, qword [rbp - 0x70]
lea r11d, [r9 + 1]
jmp 0x18000b642
or rax, 0x68
mov qword [rsi], rax
jmp 0x18000b666
bts rax, 0x18
mov qword [rsi], rax
jmp 0x18000b671
or rax, 8
mov qword [rsi], rax
jmp 0x18000b67c
mov ecx, 0x802
call fcn.180017d38
mov rsi, rax
test rax, rax
je 0x18003775e
mov rcx, qword [rbp - 0x70]
mov r9, rax
xor r8d, r8d
call fcn.18005a190
test byte [0x1800b85c0], 4
je 0x1800376f9
mov eax, dword [rbp + 0x758]
mov r9d, r12d
mov dword [rsp + 0x48], ebx
mov r8, r15
mov ebx, dword [rsp + 0x70]
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], eax
mov eax, dword [rbp + 0x750]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
call fcn.18005ae2c
jmp 0x1800376fd
mov ebx, dword [rsp + 0x70]
mov rax, qword [0x1800b84f8]
test rax, rax
je 0x180037750
mov rcx, rsi
call qword [case.0x180030b5c.0]
jmp 0x18003773b
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov qword [0x1800b7ed8], rax
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
mov rsi, qword [rsp + 0x78]
xor r9d, r9d
mov r10, qword [rbp - 0x70]
lea r11d, [r9 + 1]
jmp 0x18000b6c2
mov rax, qword [0x1800b7ed8]
test rax, rax
jne 0x180037727
jmp 0x180037714
mov rsi, qword [rsp + 0x78]
xor r9d, r9d
mov r10, qword [rbp - 0x70]
lea r11d, [r9 + 1]
jmp 0x18000b6be
mov ecx, 0x2e
lea rdx, [0x18009f0b0]
mov r8d, ebx
call fcn.1800876bc
mov r10, qword [rbp - 0x70]
xor r9d, r9d
lea r11d, [r9 + 1]
jmp 0x18000c229
test byte [0x1800b78f1], 4
je 0x1800377b4
mov ecx, 0x2f
lea rdx, [0x18009f0b0]
call fcn.180087008
xor r9d, r9d
mov dword [r13 + 4], r9d
mov eax, 0x57
jmp 0x18000bdc3
lea rcx, [rbp + 0xa0]
mov dword [rbp + 0xa0], 0x114
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetVersionExW]
nop dword [rax + rax]
test eax, eax
je 0x18000c397
jmp 0x18000c384
cmp al, 3
je 0x1800377fe
cmp al, 2
jne 0x18000c384
mov dword [0x1800b79dc], ebx
mov dword [0x1800b79d4], ebx
jmp 0x18000c384
mov eax, dword [0x1800b79dc]
lea rdx, [0x18009f188]
mov r9d, dword [0x1800b79d4]
mov ecx, 0xa
mov r8d, dword [0x1800b79d0]
mov dword [rsp + 0x20], eax
call fcn.180087cfc
nop
jmp 0x18000c397
cmp r12d, 1
je 0x180037848
cmp r12d, 0x1c
jne 0x18000be58
cmp dword [r13 + 0x18], 0
jne 0x18000be58
movzx edx, r12w
mov rcx, r14
call fcn.18005583c
mov r14d, eax
jmp 0x18000bd62
mov ecx, 0xf
mov dword [rsp + 0x20], 0x93a80
mov r9d, r12d
lea rdx, [0x18009f3b0]
mov r8, r15
call fcn.180087144
xor r9d, r9d
jmp 0x18000b70d
mov rax, qword [rbp - 0x20]
test rax, rax
je 0x1800378a1
cmp word [rax], 0
jne 0x18000b717
mov rax, r15
mov ebx, 3
mov edx, 0x2e
mov rcx, rax
dec ebx
call qword [sym.imp.api_ms_win_core_crt_l1_1_0.dll_wcschr]
nop dword [rax + rax]
test rax, rax
je 0x18000b717
add rax, 2
cmp word [rax], 0
je 0x18000b717
test ebx, ebx
jne 0x1800378a9
mov edx, dword [rbp - 0x48]
lea rcx, [rbp + 0x20]
xor r8d, r8d
call fcn.180005ef8
mov r14d, 1
movzx ebx, r14w
jmp 0x180037900
mov ebx, 0x1c
mov r14d, 1
mov r9d, 0x93a80
mov dword [rsp + 0x28], r14d
lea r8, [rbp + 0x20]
movzx edx, bx
mov rcx, r15
call fcn.1800729a8
mov rdi, rax
test byte [0x1800b78f3], 0x40
je 0x180037944
movzx eax, bx
lea rdx, [0x18009f3b0]
mov ecx, 0x10
mov dword [rsp + 0x20], eax
mov r9, r15
mov r8, rdi
call fcn.180088618
lea rbx, [r13 + 0x10]
test rdi, rdi
je 0x18003795a
xor eax, eax
mov qword [rbx], rdi
mov r14d, eax
jmp 0x18000bd6f
jmp 0x18000b748
mov ecx, 0x1c
lea rdx, [0x18009f0b0]
mov r9d, r12d
mov r8, r15
call fcn.180087538
nop
jmp 0x18000b755
cmp r12d, 0x1c
je 0x18003798a
mov r14d, 0x232b
jmp 0x1800379cf
mov r14d, 0x2559
test rbx, rbx
je 0x1800379cf
movups xmm0, xmmword [rbp + 0x80]
mov r9d, 1
mov dword [rsp + 0x20], 1
mov r8d, 0x93a80
lea rdx, [rbp + 0x10]
mov rcx, r15
movaps xmmword [rbp + 0x10], xmm0
call fcn.18002cc38
test rax, rax
mov qword [rbx], rax
mov ecx, 0xe
cmove r14d, ecx
test byte [0x1800b78f1], 0x40
je 0x1800379f4
mov ecx, 0x1d
mov dword [rsp + 0x20], r14d
mov r9d, r12d
lea rdx, [0x18009f0b0]
mov r8, r15
call fcn.180087144
cmp r14d, 0x2559
jne 0x18000bd62
mov r14d, edi
jmp 0x18000bd6f
mov ecx, r11d
call fcn.1800193b4
mov qword [rbp - 0x18], rax
test rax, rax
jne 0x180037a24
mov eax, 0x25e5
jmp 0x18000bdc3
mov r15, rax
mov r14d, 1
jmp 0x18000b76e
mov ecx, 0x30
lea rdx, [0x18009f0b0]
call fcn.180087008
nop
jmp 0x18000bd74
bt rax, 0x1c
jae 0x18000b78f
lea rdx, [rbp + 0x68]
call fcn.1800574f0
cmp dword [rbp + 0x70], 0
je 0x18000b78f
cmp dword [rbp + 0x6c], 0
je 0x18000b78f
and qword [rsi], 0xffffffffefffffff
jmp 0x18000b78f
or rcx, 2
mov qword [rsi], rcx
jmp 0x18000b7a9
mov ebx, r8d
jmp 0x18000b7d0
movsxd rax, ecx
cmp word [rdx + rax*2], 0x2e
je 0x18000c3f5
jmp 0x18000b846
mov ecx, 9
jmp 0x18000c437
mov edx, 1
mov r12d, edx
jmp 0x18000b8de
mov ecx, 0xe
jmp 0x18000bf1d
sub rcx, 2
jmp 0x18000b971
sub rcx, 2
jmp 0x18000b9c1
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov r14d, eax
test byte [0x1800b78f1], 4
je 0x180037b03
mov ecx, 0x19
lea rdx, [0x18009f0b0]
mov r8d, eax
call fcn.1800876bc
xor eax, eax
mov edi, eax
jmp 0x18000be91
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov r14d, eax
test byte [0x1800b78f1], 4
je 0x180037b38
mov ecx, 0x1a
lea rdx, [0x18009f0b0]
mov r8d, eax
call fcn.1800876bc
xor eax, eax
mov edi, eax
jmp 0x18000bec3
xor eax, eax
xchg dword [0x1800b7f98], eax
jmp 0x18000c3b6
mov edx, ecx
jmp 0x18000bf59
mov edx, ecx
jmp 0x18000c089
sub rax, 2
mov r10d, 0x8007007a
jmp 0x18000baf5
mov ecx, esi
jmp 0x18000c258
xor edi, edi
jmp 0x18000bb48
movzx r12d, word [rsp + 0x74]
mov esi, dword [rbp - 0x54]
jmp 0x18000c3dd
call qword [sym.imp.IPHLPAPI.DLL_FreeMibTable]
nop dword [rax + rax]
nop
jmp 0x18000bb6d
mov rcx, rax
call fcn.1800157ac
mov rax, rdi
jmp 0x18000bb83
lea r9, [r13 + 0x10]
mov r8d, edi
movzx edx, r12w
mov rcx, r15
mov esi, 1
call fcn.1800559d4
mov r14d, eax
jmp 0x18000bb8e
mov ecx, 0x1b
lea rdx, [0x18009f0b0]
mov r9d, r14d
mov r8d, esi
call fcn.180087020
nop
jmp 0x18000bb9b
mov ecx, 0x31
lea rdx, [0x18009f0b0]
call fcn.180087008
nop
jmp 0x18000bd62
mov ebx, 1
jmp 0x18000bbc1
mov r14d, 0x7b
test byte [0x1800b78f1], 4
je 0x18000bd62
mov ecx, 0x32
lea rdx, [0x18009f0b0]
mov r8, r15
call fcn.180087814
nop
jmp 0x18000bd62
mov ecx, 0x13
lea r8, [rbp + 0x5c0]
xor r9d, r9d
lea rdx, [0x18009f420]
call fcn.18008aa8c
nop
jmp 0x18000bc17
mov r14d, 0x7b
jmp 0x18000bc49
test byte [0x1800b78f1], 4
je 0x180037c7d
mov ecx, 0x33
lea rdx, [0x18009f0b0]
mov r8d, esi
call fcn.1800876bc
mov edx, edi
mov dword [rbp - 0x78], edx
jmp 0x18000bc73
mov r14d, 0x57
jmp 0x18000bd6f
test r15, r15
je 0x180037d45
mov ecx, 0x200
call fcn.180017d38
mov qword [rbp - 0x28], rax
mov rdi, rax
test rax, rax
jne 0x180037cd4
test byte [0x1800b78f1], 4
je 0x180037cc9
lea ecx, [rax + 0x34]
lea rdx, [0x18009f0b0]
call fcn.180087008
mov r14d, 8
jmp 0x18000bd6f
mov dword [rsp + 0x28], 1
lea rdx, [rbp - 0x3c]
xor r9d, r9d
mov dword [rsp + 0x20], 1
mov r8, r15
mov dword [rbp - 0x3c], 0x200
mov rcx, rax
call fcn.180013dd0
test eax, eax
jne 0x180037d24
test byte [0x1800b78f1], 4
je 0x180037d19
lea ecx, [rax + 0x35]
lea rdx, [0x18009f0b0]
call fcn.180087008
mov r14d, 0x57
jmp 0x18000bd6f
test byte [0x1800b85c0], 4
je 0x180037d39
mov rcx, r15
call fcn.1800191f8
mov qword [rbp - 0x60], rax
mov rax, qword [rbp - 0x80]
mov edx, dword [rbp - 0x78]
jmp 0x18000bcdf
jmp 0x18000bcdf
call fcn.18005e444
test eax, eax
jne 0x180037dae
mov rcx, qword [rbp - 0x30]
lea rax, [rbp - 0x68]
mov qword [rsp + 0x60], rax
lea r9, [r13 + 8]
mov rax, qword [rbp - 0x38]
movzx r8d, r12w
mov qword [rsp + 0x58], r13
mov rdx, rdi
mov qword [rsp + 0x50], rax
mov rax, qword [rbp - 0x80]
mov dword [rsp + 0x48], 1
mov qword [rsp + 0x40], rax
mov eax, dword [rbp + 0x758]
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], eax
mov eax, dword [rbp + 0x750]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r14d
call fcn.1800080f0
mov ebx, eax
test ebx, ebx
je 0x18000bd51
test byte [0x1800b78f1], 4
je 0x180037df4
mov ecx, 0x36
lea rdx, [0x18009f0b0]
mov r8d, ebx
call fcn.1800876bc
jmp 0x180037df4
test byte [0x1800b78f1], 4
je 0x180037def
mov ecx, 0x37
lea rdx, [0x18009f0b0]
call fcn.180087008
mov r14d, dword [rsp + 0x70]
mov rax, qword [rbp - 0x80]
jmp 0x18000c13a
movzx r9d, r12w
lea rdx, [0x18009f0b0]
mov ecx, 0x38
mov r8, r15
call fcn.180087538
mov rax, qword [rbp - 0x80]
jmp 0x18000c147
mov rcx, rbx
call sym.DNSAPI.dll_DnsApiFree
nop
jmp 0x18000bd85
mov ecx, 0x802
call fcn.180017d38
mov rsi, rax
test rax, rax
je 0x18000bd99
mov rdx, rax
mov rcx, rbx
call fcn.180059f70
test byte [0x1800b85c0], 4
je 0x180037e78
mov qword [rsp + 0x30], rsi
lea rdx, [0x18009ee78]
mov dword [rsp + 0x28], r14d
mov r8, r15
movzx r9d, r12w
mov qword [rsp + 0x20], rdi
call fcn.18005ad20
mov rax, qword [0x1800b84f8]
test rax, rax
je 0x180037e93
mov rcx, rsi
call qword [case.0x180030b5c.0]
nop
jmp 0x18000bd99
mov rax, qword [0x1800b7ed8]
test rax, rax
jne 0x180037eb2
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov qword [0x1800b7ed8], rax
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
nop
jmp 0x18000bd99
test byte [0x1800b85c0], 4
je 0x18000bd99
mov rbx, qword [rbp - 0x60]
lea rdx, [0x1800a2490]
mov r8, rbx
call fcn.180053d44
nop
jmp 0x18000bd9d
call sym.DNSAPI.dll_DnsApiFree
nop
jmp 0x18000bdaa
mov rcx, rbx
call sym.DNSAPI.dll_DnsApiFree
nop
jmp 0x18000bdb3
mov ecx, 0x39
lea rdx, [0x18009f0b0]
mov r8d, r14d
call fcn.1800876bc
nop
jmp 0x18000bdc0