Function at 0x140042280
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call
Parse pe header
Query environment variable
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov rax, qword [0x140278800]
xor rax, rsp
mov qword [rbp + 0x30], rax
mov byte [rsp + 0x28], r8b
mov qword [rbp - 0x40], rdx
mov qword [rbp - 0x48], rcx
xor r14d, r14d
mov esi, r14d
mov qword [rbp - 0x80], r14
mov dword [rbp - 0x18], r14d
lea r9, [rbp - 0x18]
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14004233a
nop word [rax + rax]
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp - 0x18]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
lea r9, [rbp - 0x18]
mov r8d, dword [rbp - 0x18]
mov rdx, rax
mov ecx, listen
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x1400422f0
mov qword [rbp - 0x80], rsi
test eax, eax
js 0x140044793
mov eax, r14d
mov dword [rsp + 0x2c], eax
cmp dword [rsi], r14d
jbe 0x140044793
movzx edi, byte [rsp + 0x28]
movzx ebx, byte [rsp + 0x28]
movzx r12d, byte [rsp + 0x28]
movzx r13d, byte [rsp + 0x28]
movzx r15d, byte [rsp + 0x28]
mov qword [rsp + 0x20], r15
nop dword [rax]
nop word [rax + rax]
imul rcx, rax, 0x128
lea rax, [rcx + rsi]
mov qword [rbp - 0x50], rax
movzx eax, word [rax + 0x2e]
add rax, rcx
add rsi, rax
movzx edx, dil
lea rcx, [rbp + 0x10]
call fcn.140002dc0
nop
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rsi + r8 + 0x30], 0
jne 0x1400423b0
lea rdx, [rsi + 0x30]
lea rcx, [rbp + 0x10]
call fcn.140004830
nop
lea rcx, [rbp + 0x10]
call fcn.140001ca0
mov rdx, qword [rbp - 0x48]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x140044774
mov rdx, qword [rbp - 0x50]
add rdx, 0x30
lea rcx, [rbp - 0x10]
call fcn.1400046a0
nop
mov dword [rsp + 0x58], 0xe7e1d8e3
mov dword [rsp + 0x5c], 0xe8e4e8f1
mov word [rsp + 0x60], 0x1d17
mov byte [rsp + 0x62], 0xca
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x63], xmm0
mov qword [rsp + 0x73], rax
nop dword [rax]
nop dword [rax + rax]
mov r8, qword [0x1402cdf20]
mov r9, qword [0x1402cdf18]
nop
mov rsi, r14
cmp rsi, 0x23
jae 0x140042fbb
movzx r11d, byte [rsp + rsi + 0x58]
movzx r10d, r11b
cmp r8, rsi
ja 0x140042fb2
lea rax, [r9 + 1]
cmp r8, rax
jae 0x14004248c
movabs rcx, 0x1ed6c306079ec578
add rcx, rsi
mov rax, rcx
and rax, r11
imul r12, rax, 0xfffffffffffffffe
add r12, rcx
add r12, r11
sub r12b, 0x48
jmp 0x1400424c6
je 0x140042f34
lea rax, [r9 + 3]
cmp r8, rax
je 0x140042ea6
lea rax, [r9 + 5]
cmp r8, rax
je 0x140042e44
lea rax, [r9 + 4]
cmp r8, rax
je 0x140042e19
lea rax, [r9 + 8]
cmp r8, rax
je 0x140042dc9
movzx r10d, r11b
nop word [rax + rax]
cmp r9, rsi
ja 0x140042fa9
lea rax, [r9 + 0xa]
cmp r8, rax
jae 0x140042508
movabs rdx, 0x879dff7ea00632d8
add rdx, rsi
movzx eax, dl
and al, r11b
mov ecx, recv
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r10b
add r12b, dl
jmp 0x140042540
lea rax, [r9 + 1]
cmp r8, rax
je 0x140042da7
inc rax
cmp r8, rax
je 0x140042d78
lea rax, [r9 + 3]
cmp r8, rax
je 0x140042d53
lea rax, [r9 + 5]
cmp r8, rax
je 0x140042d2a
nop dword [rax + rax]
lea rax, [r9 + r8]
cmp rax, rsi
jbe 0x140042aa7
nop dword [rax]
lea rax, [r9 + 1]
cmp r8, rax
je 0x140042a88
lea rax, [r9 + 0x2a]
cmp r8, rax
je 0x140042a62
lea rax, [r9 + 0x5a]
cmp r8, rax
je 0x140042a42
lea rax, [r9 + 0x41]
cmp r8, rax
je 0x140042a23
lea rax, [r9 + 6]
cmp r8, rax
je 0x140042a09
lea rax, [r9 + 5]
cmp r8, rax
je 0x1400429ea
lea rax, [r9 + 4]
cmp r8, rax
je 0x1400429cb
lea rax, [r9 + 3]
cmp r8, rax
je 0x1400429ac
lea rax, [r9 + 0x20]
cmp r8, rax
je 0x140042984
lea rax, [r9 + 0x10]
cmp r8, rax
je 0x140042550
lea r8, [r9 + 0x7a]
lea r9, [r8 + 0xa]
lea rax, [r9 + 0x61]
cmp r8, rax
jb 0x140042f88
lea rax, [r9 + 0x1000]
cmp r8, rax
jb 0x140042f6b
lea rax, [r9 + 3]
cmp r8, rax
jb 0x140042746
lea rax, [r9 + 2]
cmp r8, rax
jb 0x14004271d
lea rax, [r9 + 1]
cmp r8, rax
jb 0x1400426f5
lea rax, [r9 + 0x2a]
cmp r8, rax
jb 0x140042935
lea rax, [r9 + 9]
cmp r8, rax
jb 0x1400428eb
lea rax, [r9 + 8]
cmp r8, rax
jb 0x1400428aa
lea rax, [r9 + 6]
cmp r8, rax
jb 0x140042888
lea rax, [r9 + 5]
cmp r8, rax
jb 0x140042550
lea r8, [r9 + 0x200]
lea r9, [r8 + 0x40]
lea rax, [r9 + 0x2a]
cmp r8, rax
ja 0x14004285b
lea rax, [r9 + 0x5a]
cmp r8, rax
ja 0x140042841
lea rax, [r9 + 0x41]
cmp r8, rax
ja 0x140042822
lea rax, [r9 + 0x7a]
cmp r8, rax
ja 0x140042808
lea rax, [r9 + 5]
cmp r8, rax
ja 0x1400427f0
lea rax, [r9 + 4]
cmp r8, rax
ja 0x1400427d1
lea rax, [r9 + 3]
cmp r8, rax
ja 0x1400427b1
lea rax, [r9 + 2]
cmp r8, rax
ja 0x140042789
lea rax, [r9 + 0x10]
cmp r8, rax
ja 0x14004276f
lea rax, [r9 + 0xa]
cmp r8, rax
ja 0x140042550
lea r8, [r9 + 0x61]
lea r9, [r8 + 9]
jmp 0x140042550
movabs rdx, 0xbe9be44623353828
add rdx, rsi
movzx eax, dl
and al, r11b
add al, al
movzx r12d, r10b
sub r12b, al
sub r12b, 0x18
add r12b, dl
jmp 0x140042540
movabs rdx, 0x80ee5e3a13f7ad38
add rdx, rsi
movzx eax, dl
and al, r11b
mov ecx, reloc.WLDAP32.dll_Ordinal_60
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r10b
add r12b, dl
jmp 0x1400424d0
movabs rdx, 0x4340d82e04ba2248
add rdx, rsi
movzx eax, dl
and al, r11b
mov ecx, 4
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r10b
add r12b, dl
jmp 0x140042457
lea ecx, [rsi - 0x40]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0x40
jmp 0x140042df0
lea edx, [rsi - 0x30]
movzx eax, dl
and al, r11b
mov ecx, Ordinal_41
sub cl, al
lea r12d, [rcx + rcx]
add r12b, dl
add r12b, r11b
inc r9
dec rsi
inc rsi
jmp 0x140042443
lea ecx, [rsi - 0x20]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0x20
dec rsi
inc rsi
jmp 0x140042443
lea edx, [rsi - 0x10]
movzx eax, dl
and al, r11b
mov ecx, gethostname
sub cl, al
lea r12d, [rcx + rcx]
add r12b, dl
add r12b, r11b
jmp 0x140042e6c
movzx ecx, sil
and cl, r11b
add cl, cl
movzx r12d, sil
sub r12b, cl
add r12b, r11b
jmp 0x140042e8a
lea ecx, [rsi + 0x10]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0x70
jmp 0x140042e8d
lea edx, [rsi + 0x20]
movzx eax, dl
and al, r11b
mov ecx, reloc.WS2_32.dll_recv
sub cl, al
lea r12d, [rcx + rcx]
add r12b, dl
add r12b, r11b
jmp 0x140042ece
lea ecx, [rsi + 0x30]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0x50
jmp 0x140042efa
lea edx, [rsi + 0x40]
movzx eax, dl
and al, r11b
mov ecx, reloc.WLDAP32.dll_Ordinal_32
sub cl, al
lea r12d, [rcx + rcx]
add r12b, dl
add r12b, r11b
movzx eax, byte [rsp + rsi + 0x58]
add rax, r9
add rsi, rax
inc rsi
jmp 0x140042443
lea ecx, [rsi - 0x18]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0x58
mov byte [rsp + rsi + 0x58], r12b
inc rsi
jmp 0x140042443
lea edx, [rsi - 8]
movzx eax, dl
and al, r11b
mov ecx, Ordinal_32
sub cl, al
lea r12d, [rcx + rcx]
add r12b, dl
add r12b, r11b
movzx edx, sil
cmp r9, 0x61
jb 0x14004289d
sub dl, 0x30
movzx eax, dl
and al, r11b
add al, al
sub dl, al
add dl, r11b
lea r12d, [rdx*2 - 0x60]
jmp 0x140042df0
lea ecx, [rsi + 8]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0x38
cmp r8, 0x200
jae 0x140042cec
lea rax, [r9 + 4]
cmp r8, rax
jbe 0x140042c3b
movzx edx, sil
lea ecx, [rdx + 0x70]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0x10
jmp 0x1400428c8
lea edx, [rsi + 0x18]
movzx eax, dl
and al, r11b
mov ecx, Ordinal_46
sub cl, al
lea r12d, [rcx + rcx]
add r12b, dl
add r12b, r11b
lea rax, [r9 + r8]
cmp rax, 0x7a
je 0x140042d09
lea rax, [r9 + 0xa]
cmp r8, rax
jbe 0x140042b93
lea ecx, [rsi - 0x68]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0x28
jmp 0x140042900
lea ecx, [rsi + 0x10]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0x70
movzx eax, byte [rsp + rsi + 0x58]
add rax, r9
add rsi, rax
inc rsi
jmp 0x140042443
lea edx, [rsi + 0x20]
movzx eax, dl
and al, r11b
mov ecx, reloc.WS2_32.dll_recv
sub cl, al
lea r12d, [rcx + rcx]
add r12b, dl
add r12b, r11b
jmp 0x140042efa
movzx r10d, sil
lea ecx, [r10 + 0x30]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0x50
jmp 0x140042ed2
lea edx, [rsi + 0x40]
movzx eax, dl
and al, r11b
mov ecx, reloc.WLDAP32.dll_Ordinal_32
sub cl, al
lea r12d, [rcx + rcx]
add r12b, dl
add r12b, r11b
jmp 0x140042e8d
lea ecx, [rsi + 0x50]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0x30
jmp 0x140042e8a
lea edx, [rsi + 0x60]
movzx eax, dl
and al, r11b
mov ecx, Ordinal_50
sub cl, al
lea r12d, [rcx + rcx]
add r12b, dl
add r12b, r11b
jmp 0x140042e6c
lea ecx, [rsi + 0x70]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0x10
dec rsi
inc rsi
jmp 0x140042443
lea ecx, [rsi + 0x80]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
add r12b, 0x80
inc r9
dec rsi
inc rsi
jmp 0x140042443
lea edx, [rsi - 0x70]
movzx eax, dl
and al, r11b
mov ecx, 8
sub cl, al
lea r12d, [rcx + rcx]
add r12b, dl
add r12b, r11b
jmp 0x140042df0
lea rax, [r9 + 0x200]
cmp r8, rax
jae 0x140042ad8
movabs rcx, 0x1ed6c306079ec578
add rcx, rsi
movzx eax, cl
and al, r11b
add al, al
sub r10b, al
lea r12d, [rcx + r10]
sub r12b, 0x48
jmp 0x14004294f
lea rax, [r9 + 1]
cmp r8, rax
jne 0x140042b0e
lea edx, [rsi - 0x50]
movzx eax, dl
and al, r11b
mov ecx, Ordinal_27
sub cl, al
lea r12d, [rcx + rcx]
add r12b, dl
add r12b, r11b
movzx eax, byte [rsp + rsi + 0x58]
add rax, r9
add rsi, rax
inc rsi
jmp 0x140042443
lea rax, [r9 + 3]
cmp r8, rax
jne 0x140042b3b
movzx r10d, sil
lea edx, [r10 - 0x70]
movzx eax, dl
and al, r11b
mov ecx, 8
sub cl, al
lea r12d, [rcx + rcx]
add r12b, dl
add r12b, r11b
jmp 0x140042ed2
lea rax, [r9 + 5]
cmp r8, rax
jne 0x140042b6c
lea edx, [rsi + 0x40]
movzx eax, dl
and al, r11b
mov ecx, reloc.WLDAP32.dll_Ordinal_32
sub cl, al
lea r12d, [rcx + rcx]
add r12b, dl
add r12b, r11b
inc r9
dec rsi
inc rsi
jmp 0x140042443
lea rax, [r9 + 4]
cmp r8, rax
jne 0x14004294f
lea ecx, [rsi + 0x30]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0x50
jmp 0x140042df0
lea rax, [r9 + 1]
cmp r8, rax
jne 0x140042bbb
lea edx, [rsi - 0x78]
movzx eax, dl
and al, r11b
mov ecx, 0x24
sub cl, al
lea r12d, [rcx + rcx]
add r12b, dl
add r12b, r11b
jmp 0x140042df0
lea rax, [r9 + 3]
cmp r8, rax
jne 0x140042bde
lea ecx, [rsi + 0x58]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0x68
jmp 0x140042e6c
lea rax, [r9 + 5]
cmp r8, rax
jne 0x140042c06
lea edx, [rsi + 0x48]
movzx eax, dl
and al, r11b
mov ecx, 4
sub cl, al
lea r12d, [rcx + rcx]
add r12b, dl
add r12b, r11b
jmp 0x140042e8a
lea rax, [r9 + 2]
cmp r8, rax
jne 0x140042900
lea ecx, [rsi + 8]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0x38
movzx eax, byte [rsp + rsi + 0x58]
add rax, r9
add rsi, rax
inc rsi
jmp 0x140042443
lea rax, [r9 + 1]
cmp r8, rax
jne 0x140042c71
lea edx, [rsi + 0x60]
movzx eax, dl
and al, r11b
mov ecx, Ordinal_50
sub cl, al
lea r12d, [rcx + rcx]
add r12b, dl
add r12b, r11b
movzx eax, byte [rsp + rsi + 0x58]
add rax, r9
add rsi, rax
inc rsi
jmp 0x140042443
inc rax
cmp r8, rax
jne 0x140042c9d
movzx r10d, sil
lea edx, [r10 + 0x40]
movzx eax, dl
and al, r11b
mov ecx, reloc.WLDAP32.dll_Ordinal_32
sub cl, al
lea r12d, [rcx + rcx]
add r12b, dl
add r12b, r11b
jmp 0x140042ed2
lea rax, [r9 + 3]
cmp r8, rax
jne 0x140042cc0
lea ecx, [rsi + 0x30]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0x50
jmp 0x140042e8d
lea rax, [r9 + 5]
cmp r8, rax
jne 0x1400428c4
lea edx, [rsi + 0x20]
movzx eax, dl
and al, r11b
mov ecx, reloc.WS2_32.dll_recv
sub cl, al
lea r12d, [rcx + rcx]
add r12b, dl
add r12b, r11b
jmp 0x140042e8a
lea ecx, [rsi - 0x40]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0x40
add r12b, r11b
jmp 0x140042e6c
movzx r10d, sil
lea edx, [r10 - 0x50]
movzx eax, dl
and al, r11b
mov ecx, Ordinal_27
sub cl, al
lea r12d, [rcx + rcx]
add r12b, dl
jmp 0x140042ed2
movabs rdx, 0xbc019dbaec39e988
add rdx, rsi
movzx eax, dl
and al, r11b
mov ecx, 0x24
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r10b
add r12b, dl
jmp 0x140042e8a
movabs rdx, 0x7e5417aedcfc5e98
add rdx, rsi
movzx eax, dl
and al, r11b
add al, al
movzx r12d, r10b
sub r12b, al
sub r12b, 0x28
jmp 0x140042e69
movabs rdx, 0x40a691a2cdbed3a8
add rdx, rsi
movzx eax, dl
and al, r11b
mov ecx, 0x34
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r10b
add r12b, dl
dec rsi
inc rsi
jmp 0x140042443
movabs rdx, 0xc54b858aaf43bdc8
add rdx, rsi
movzx eax, dl
and al, r11b
add al, al
movzx r12d, r10b
sub r12b, al
sub r12b, 0x78
jmp 0x140042ded
movabs rdx, 0x49f0797290c8a7e8
add rdx, rsi
movzx eax, dl
and al, r11b
add al, al
movzx r12d, r10b
sub r12b, al
sub r12b, 0x58
movzx r11d, r10b
add r12b, dl
lea edx, [rsi + 0x48]
movzx eax, dl
and al, r11b
mov ecx, 4
sub cl, al
add cl, cl
add cl, dl
add cl, r11b
mov byte [rsp + rsi + 0x58], cl
inc r9
dec rsi
inc rsi
jmp 0x140042443
movabs rcx, 0xce956d5a724d9208
add rcx, rsi
movzx eax, cl
and al, r11b
add al, al
sub r10b, al
lea r12d, [rcx + r10]
sub r12b, 0x38
dec rsi
inc rsi
jmp 0x140042443
movabs rdx, 0x90e7e74e63100718
add rdx, rsi
movzx eax, dl
and al, r11b
mov ecx, Ordinal_46
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r10b
movzx r11d, r10b
add r12b, dl
lea ecx, [rsi + 0x38]
movzx eax, cl
and al, r11b
mov edx, reloc.WLDAP32.dll_Ordinal_60
sub dl, al
add dl, dl
add dl, cl
add dl, r11b
add dl, r12b
mov byte [rsp + rsi + 0x58], dl
add r8, r9
movzx eax, r12b
mov rcx, 0xffffffffffffffff
sub rcx, rax
add rsi, rcx
inc rsi
jmp 0x140042443
movabs rdx, 0xd7df552a35576648
add rdx, rsi
movzx eax, dl
and al, r11b
mov ecx, 4
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r10b
add r12b, dl
movzx r11d, r10b
movzx r10d, sil
add r10b, 0x28
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
sub r10b, 0x18
add r10b, r11b
movzx eax, r10b
mov byte [rsp + rsi + 0x58], al
inc r9
add rax, r9
sub rsi, rax
lea ecx, [rsi - 0x60]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
sub cl, 0x60
add cl, r11b
mov byte [rsp + rsi + 0x58], cl
inc r8
mov rax, 0xffffffffffffffff
sub rax, r8
add rsi, rax
movzx eax, byte [rsp + rsi + 0x58]
add rax, r9
add rsi, rax
inc rsi
jmp 0x140042443
movabs rdx, 0x5c84491216dc5068
add rdx, rsi
movzx eax, dl
and al, r11b
mov ecx, reloc.WS2_32.dll_sendto
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r10b
add r12b, dl
movzx eax, byte [rsp + rsi + 0x58]
add rax, r9
add rsi, rax
inc rsi
jmp 0x140042443
add sil, 0x58
movzx eax, sil
and al, r11b
add al, al
sub sil, al
lea r12d, [r11 + rsi]
sub r12b, 0x68
jmp 0x140042440
add sil, 0x68
movzx eax, sil
and al, r11b
mov ecx, reloc.WS2_32.dll_sendto
sub cl, al
lea r12d, [rcx + rcx]
add r12b, sil
add r12b, r11b
jmp 0x140042430
lea rcx, [rbp + 0x16cabf8]
jmp 0x140042fc0
lea rcx, [rbp + 0x10b7170]
jmp 0x140042fc0
lea rcx, [rsp + 0x58]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rsi, rax
movzx edx, bl
lea rcx, [rbp - 0x38]
call fcn.140002dc0
nop
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rsi + r8], 0
jne 0x140042fe0
mov rdx, rsi
lea rcx, [rbp - 0x38]
call fcn.140004830
nop
mov word [rbp - 0x78], 0x319c
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x76], xmm0
movups xmmword [rbp - 0x66], xmm0
mov byte [rbp - 0x56], al
nop dword [rax]
mov rax, qword [0x1402cdf20]
mov r9, qword [0x1402cdf18]
nop
cmp r14, 0x23
jae 0x140043ae0
movzx r10d, byte [rbp + r14 - 0x78]
mov esi, r10d
cmp rax, r14
ja 0x140043ad7
lea rcx, [r9 + 1]
cmp rax, rcx
jae 0x140043068
movabs rdx, 0xece771a7cfc46188
add rdx, r14
mov rcx, rdx
and rcx, rsi
imul r13, rcx, 0xfffffffffffffffe
add r13, rdx
add r13, rsi
add r13b, 0x48
jmp 0x140043094
je 0x140043a58
inc rcx
cmp rax, rcx
je 0x1400439f3
lea rcx, [r9 + 3]
cmp rax, rcx
je 0x1400439cc
lea rcx, [r9 + 5]
cmp rax, rcx
je 0x140043982
movzx r11d, r14b
nop dword [rax + rax]
cmp r9, r14
ja 0x140043ace
lea rcx, [r9 + 0x41]
cmp rax, rcx
jae 0x1400430ca
lea edx, [r11 + 0x28]
movzx ecx, dl
and cl, r10b
add cl, cl
sub dl, cl
lea r13d, [r10 + rdx]
sub r13b, 0x18
jmp 0x140043100
lea rcx, [r9 + 1]
cmp rax, rcx
je 0x140043977
lea rcx, [r9 + 3]
cmp rax, rcx
je 0x140043954
lea rcx, [r9 + 4]
cmp rax, rcx
je 0x14004391f
lea rcx, [r9 + 8]
cmp rax, rcx
je 0x1400438f3
nop
lea rcx, [r9 + rax]
cmp rcx, r14
jbe 0x140043651
nop dword [rax]
lea rcx, [r9 + 0x3e8]
cmp rax, rcx
je 0x140043634
lea rcx, [r9 + 0x28]
cmp rax, rcx
je 0x14004360e
lea rcx, [r9 + 6]
cmp rax, rcx
je 0x1400435e7
lea rcx, [r9 + 0x2a]
cmp rax, rcx
je 0x1400436dc
lea rcx, [r9 + 0x400]
cmp rax, rcx
je 0x1400435c3
lea rcx, [r9 + 0x40]
cmp rax, rcx
je 0x1400435a6
lea rcx, [r9 + 0x41]
cmp rax, rcx
je 0x140043588
lea rcx, [r9 + 0x200]
cmp rax, rcx
je 0x140043568
lea rcx, [r9 + 0x20]
cmp rax, rcx
je 0x140043538
lea rcx, [r9 + 5]
cmp rax, rcx
je 0x140043110
lea rax, [r9 + 2]
lea r9, [rax + 0x5a]
lea rdx, [r9 + 0x61]
cmp rax, rdx
jb 0x140043aae
lea rcx, [r9 + 0x64]
cmp rax, rcx
jb 0x140043a8a
lea rcx, [r9 + 0xa]
cmp rax, rcx
jb 0x140043307
lea rcx, [r9 + 0x400]
cmp rax, rcx
jb 0x1400432e7
lea rcx, [r9 + 0x40]
cmp rax, rcx
jb 0x1400432c6
lea rcx, [r9 + 8]
cmp rax, rcx
jb 0x1400434ed
lea rcx, [r9 + 1]
cmp rax, rcx
jb 0x14004349c
lea rcx, [r9 + 0x1000]
cmp rax, rcx
jb 0x140043458
lea rcx, [r9 + 0x42]
cmp rax, rcx
jb 0x14004342f
lea rcx, [r9 + 0x5a]
cmp rax, rcx
jb 0x140043110
mov rax, rdx
lea r9, [rdx + 0x3e8]
lea rcx, [r9 + 0x64]
cmp rdx, rcx
ja 0x140043403
lea rcx, [r9 + 0xa]
cmp rdx, rcx
ja 0x1400433e2
lea rcx, [r9 + 3]
cmp rdx, rcx
ja 0x1400433c5
lea rcx, [r9 + 0x7a]
cmp rdx, rcx
ja 0x1400433b7
lea rcx, [r9 + 0x80]
cmp rdx, rcx
ja 0x14004339f
lea rcx, [r9 + 1]
cmp rdx, rcx
ja 0x140043382
lea rcx, [r9 + 0x1000]
cmp rdx, rcx
ja 0x14004335b
lea rcx, [r9 + 0x42]
cmp rdx, rcx
ja 0x140043335
lea rcx, [r9 + 9]
cmp rdx, rcx
ja 0x140043327
lea rcx, [r9 + 2]
cmp rdx, rcx
ja 0x140043110
lea rax, [r9 + 0x5a]
lea r9, [rax + 0x61]
jmp 0x140043110
lea r8d, [r11 - 0x28]
movzx ecx, r10b
and cl, r8b
mov edx, recv
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r10b
add r13b, r8b
jmp 0x140043100
lea r8d, [r11 - 0x38]
movzx ecx, r10b
and cl, r8b
add cl, cl
movzx r13d, r10b
sub r13b, cl
sub r13b, 0x78
add r13b, r8b
jmp 0x1400430a0
sub r11b, 0x48
movzx ecx, r10b
and cl, r11b
add cl, cl
movzx r13d, r10b
sub r13b, cl
sub r13b, 8
add r13b, r11b
jmp 0x140043033
lea r8d, [r11 + 0x40]
mov edx, reloc.WLDAP32.dll_Ordinal_32
jmp 0x14004398f
add r11b, 0x30
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
lea r13d, [r11 + r10]
sub r13b, 0x50
inc r9
dec r14
inc r14
jmp 0x140043020
add r11b, 0x20
movzx ecx, r10b
and cl, r11b
mov edx, reloc.WS2_32.dll_recv
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r10b
add r13b, r11b
dec r14
inc r14
jmp 0x140043020
lea r8d, [r11 + 0x10]
movzx ecx, r10b
and cl, r8b
add cl, cl
movzx r13d, r10b
sub r13b, cl
sub r13b, 0x70
jmp 0x14004387b
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
lea r13d, [r11 + r10]
add rax, r9
jmp 0x14004393b
sub r11b, 0x10
mov edx, gethostname
jmp 0x140043928
lea r8d, [r11 - 0x20]
movzx ecx, r10b
and cl, r8b
add cl, cl
movzx r13d, r10b
sub r13b, cl
sub r13b, 0x20
jmp 0x1400438c0
sub r11b, 0x30
movzx ecx, r10b
and cl, r11b
mov edx, Ordinal_41
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r10b
add r13b, r11b
jmp 0x140043a15
sub r11b, 0x40
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
lea r13d, [r11 + r10]
sub r13b, 0x40
movzx ecx, byte [rbp + r14 - 0x78]
add rcx, r9
add r14, rcx
inc r14
jmp 0x140043020
add r11b, 0x18
movzx ecx, r10b
and cl, r11b
mov edx, Ordinal_46
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r10b
add r13b, r11b
mov byte [rbp + r14 - 0x78], r13b
inc r14
jmp 0x140043020
lea r8d, [r11 + 8]
movzx ecx, r10b
and cl, r8b
add cl, cl
movzx r13d, r10b
sub r13b, cl
sub r13b, 0x38
add r13b, r8b
cmp r9, 1
jb 0x14004344b
lea r8d, [r11 + 0x30]
movzx ecx, r10b
and cl, r8b
mov edx, Ordinal_27
sub dl, cl
add dl, dl
add dl, r10b
add dl, r8b
lea r13d, [rdx + rdx]
jmp 0x1400439a2
lea r8d, [r11 - 8]
movzx ecx, r10b
and cl, r8b
mov edx, Ordinal_32
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r10b
add r13b, r8b
cmp rax, 8
jae 0x140043863
lea rcx, [r9 + 0x1000]
cmp rax, rcx
jbe 0x1400437a0
lea r8d, [r11 - 0x70]
movzx ecx, r10b
and cl, r8b
mov edx, 8
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r10b
jmp 0x140043470
lea r8d, [r11 - 0x18]
movzx ecx, r10b
and cl, r8b
add cl, cl
movzx r13d, r10b
sub r13b, cl
sub r13b, 0x58
add r13b, r8b
lea rcx, [r9 + rax]
cmp rcx, 4
je 0x1400438a5
lea rcx, [r9 + 1]
cmp rax, rcx
jbe 0x140043744
lea r8d, [r11 + 0x68]
movzx ecx, r10b
and cl, r8b
mov edx, reloc.WS2_32.dll_sendto
jmp 0x1400434ac
sub r11b, 0x10
movzx ecx, r10b
and cl, r11b
mov edx, gethostname
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r10b
add r13b, r11b
movzx ecx, byte [rbp + r14 - 0x78]
add rcx, r9
add r14, rcx
inc r14
jmp 0x140043020
sub r11b, 0x20
movzx ecx, r10b
and cl, r11b
add cl, cl
movzx r13d, r10b
sub r13b, cl
sub r13b, 0x20
add r13b, r11b
jmp 0x140043a15
lea r8d, [r11 - 0x30]
movzx ecx, r10b
and cl, r8b
mov edx, Ordinal_41
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r10b
jmp 0x1400438c0
sub r11b, 0x40
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
lea r13d, [r11 + r10]
sub r13b, 0x40
jmp 0x14004393b
sub r11b, 0x50
movzx ecx, r10b
and cl, r11b
mov edx, Ordinal_27
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r10b
add r13b, r11b
add rax, r9
jmp 0x14004393b
sub r11b, 0x70
movzx ecx, r10b
and cl, r11b
mov edx, 8
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r10b
add r13b, r11b
dec r14
inc r14
jmp 0x140043020
add r11b, 0x80
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
lea r13d, [r11 + r10]
add r13b, 0x80
inc r9
dec r14
inc r14
jmp 0x140043020
lea r8d, [r11 + 0x70]
movzx ecx, r10b
and cl, r8b
add cl, cl
movzx r13d, r10b
sub r13b, cl
sub r13b, 0x10
jmp 0x14004399f
lea rcx, [r9 + 4]
cmp rax, rcx
jae 0x140043678
lea r8d, [r11 - 0x78]
movzx ecx, r10b
and cl, r8b
mov edx, 0x24
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r10b
jmp 0x140043505
lea rcx, [r9 + 1]
cmp rax, rcx
jne 0x1400436ad
add r11b, 0x50
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
lea r13d, [r11 + r10]
sub r13b, 0x30
movzx ecx, byte [rbp + r14 - 0x78]
add rcx, r9
add r14, rcx
inc r14
jmp 0x140043020
lea rcx, [r9 + 3]
cmp rax, rcx
jne 0x1400436d3
lea r8d, [r11 + 0x70]
movzx ecx, r10b
and cl, r8b
add cl, cl
movzx r13d, r10b
sub r13b, cl
sub r13b, 0x10
jmp 0x1400438c0
lea rcx, [r9 + 5]
cmp rax, rcx
jne 0x1400436f9
lea r8d, [r11 - 0x60]
movzx ecx, r10b
and cl, r8b
add cl, cl
movzx r13d, r10b
sub r13b, cl
sub r13b, 0x60
jmp 0x14004387b
lea rcx, [r9 + 7]
cmp rax, rcx
jne 0x140043729
sub r11b, 0x50
movzx ecx, r10b
and cl, r11b
mov edx, Ordinal_27
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r10b
add r13b, r11b
dec r14
inc r14
jmp 0x140043020
lea rcx, [r9 + 8]
cmp rax, rcx
jne 0x140043508
lea r8d, [r11 - 0x30]
mov edx, Ordinal_41
jmp 0x14004398f
jne 0x140043763
lea r8d, [r11 + 0x78]
movzx ecx, r10b
and cl, r8b
add cl, cl
movzx r13d, r10b
sub r13b, cl
sub r13b, 0x48
jmp 0x14004399f
lea rcx, [r9 + 2]
cmp rax, rcx
jne 0x1400434b8
sub r11b, 8
movzx ecx, r10b
and cl, r11b
mov edx, Ordinal_32
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r10b
add r13b, r11b
movzx ecx, byte [rbp + r14 - 0x78]
add rcx, r9
add r14, rcx
inc r14
jmp 0x140043020
lea rcx, [r9 + 1]
cmp rax, rcx
jne 0x1400437d5
sub r11b, 0x60
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
lea r13d, [r11 + r10]
sub r13b, 0x60
movzx ecx, byte [rbp + r14 - 0x78]
add rcx, r9
add r14, rcx
inc r14
jmp 0x140043020
inc rcx
cmp rax, rcx
jne 0x1400437fe
sub r11b, 0x50
movzx ecx, r10b
and cl, r11b
mov edx, Ordinal_27
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r10b
add r13b, r11b
jmp 0x140043a15
lea rcx, [r9 + 3]
cmp rax, rcx
jne 0x140043824
lea r8d, [r11 - 0x40]
movzx ecx, r10b
and cl, r8b
add cl, cl
movzx r13d, r10b
sub r13b, cl
sub r13b, 0x40
jmp 0x1400438c0
lea rcx, [r9 + 5]
cmp rax, rcx
jne 0x140043848
lea r8d, [r11 - 0x10]
movzx ecx, r10b
and cl, r8b
mov edx, gethostname
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r10b
jmp 0x14004387b
lea rcx, [r9 + 9]
cmp rax, rcx
jne 0x140043473
lea r8d, [r11 + 0x20]
mov edx, reloc.WS2_32.dll_recv
jmp 0x14004398f
lea r8d, [r11 + 0x40]
movzx ecx, r10b
and cl, r8b
movzx edx, r10b
sub dl, cl
add dl, 0x20
lea r13d, [rdx + rdx]
add r13b, r8b
sub r11b, 0x38
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
sub r10b, 0x78
add r10b, r13b
add r10b, r11b
mov byte [rbp + r14 - 0x78], r10b
add rax, r9
jmp 0x14004393b
lea r8d, [r11 + 0x50]
movzx ecx, r10b
and cl, r8b
add cl, cl
movzx r13d, r10b
sub r13b, cl
sub r13b, r10b
sub r13b, 0x30
add r13b, r8b
sub r11b, 0x28
movzx ecx, r10b
and cl, r11b
mov edx, recv
sub dl, cl
add dl, dl
add dl, r10b
add dl, r11b
movzx ecx, dl
mov byte [rbp + r14 - 0x78], cl
inc r9
add rcx, r9
sub r14, rcx
jmp 0x140043a15
sub r11b, 0x48
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
lea r13d, [r11 + r10]
sub r13b, 8
movzx ecx, byte [rbp + r14 - 0x78]
add rcx, r9
add r14, rcx
inc r14
jmp 0x140043020
sub r11b, 0x78
mov edx, 0x24
movzx ecx, r10b
and cl, r11b
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r10b
add r13b, r11b
movzx ecx, r13b
mov rdx, 0xffffffffffffffff
sub rdx, rcx
add r14, rdx
inc r14
jmp 0x140043020
add r11b, 0x58
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
lea r13d, [r11 + r10]
sub r13b, 0x68
dec r14
inc r14
jmp 0x140043020
lea r8d, [r11 + 0x38]
mov edx, reloc.WLDAP32.dll_Ordinal_60
jmp 0x14004398f
movzx r11d, r14b
lea r8d, [r11 + 0x18]
mov edx, Ordinal_46
movzx ecx, r10b
and cl, r8b
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r10b
add r13b, r8b
sub r11b, 0x48
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
sub r10b, 8
add r10b, r11b
mov byte [rbp + r14 - 0x78], r10b
inc r9
dec r14
inc r14
jmp 0x140043020
lea r8d, [r14 - 8]
movzx ecx, r10b
and cl, r8b
mov edx, Ordinal_32
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r10b
add r13b, r8b
dec r14
inc r14
jmp 0x140043020
movabs rdx, 0xa08538470ed5e7a8
add rdx, r14
and sil, dl
mov ecx, 0x34
sub cl, sil
lea r13d, [rcx + rcx]
add r13b, r10b
add r13b, dl
lea r8d, [r14 + 0x60]
movzx ecx, r8b
and cl, r10b
mov edx, Ordinal_50
sub dl, cl
add dl, dl
add dl, r8b
add dl, r10b
mov byte [rbp + r14 - 0x78], dl
inc rax
mov rcx, 0xffffffffffffffff
sub rcx, rax
add r14, rcx
movzx ecx, byte [rbp + r14 - 0x78]
add rcx, r9
add r14, rcx
inc r14
jmp 0x140043020
movabs rcx, 0xc6b654f76f4d2498
add rcx, r14
and sil, cl
add sil, sil
sub r10b, sil
lea r13d, [rcx + r10]
sub r13b, 0x28
movzx ecx, byte [rbp + r14 - 0x78]
add rcx, r9
add r14, rcx
inc r14
jmp 0x140043020
sub r11b, 0x58
movzx ecx, r10b
and cl, r11b
mov edx, 0x34
sub dl, cl
lea r13d, [rdx + rdx]
add r13b, r10b
add r13b, r11b
xor r14d, r14d
jmp 0x140043020
sub r11b, 0x68
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea r13d, [r11 + r10]
sub r13b, 0x28
xor r14d, r14d
jmp 0x140043010
lea rdx, [rbp + 0x17186e8]
jmp 0x140043ae4
lea rdx, [rbp + 0x135e870]
jmp 0x140043ae4
lea rdx, [rbp - 0x78]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140043af0
lea rcx, [rbp - 0x38]
call fcn.1400034e0
mov r14, rax
mov dword [rsp + 0x30], 0xe4e3c2c8
mov dword [rsp + 0x34], 0xc9f3f4e4
mov dword [rsp + 0x38], 0xc7eef6f7
mov byte [rsp + 0x3c], 0x60
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x3d], xmm0
mov dword [rsp + 0x4d], eax
mov word [rsp + 0x51], ax
nop word [rax + rax]
mov r8, qword [0x1402cdf20]
mov r10, qword [0x1402cdf18]
nop
xor esi, esi
cmp rsi, 0x23
jae 0x14004468f
movzx r11d, byte [rsp + rsi + 0x30]
mov edx, r11d
cmp r8, rsi
ja 0x140044686
lea rcx, [r10 + 1]
cmp r8, rcx
jae 0x140043b9f
movabs rcx, 0x943361b36fc1b512
add rcx, rsi
mov rax, rcx
and rax, rdx
imul r15, rax, 0xfffffffffffffffe
add r15, rcx
add r15, rdx
sub r15b, 0x7e
mov qword [rsp + 0x20], r15
jmp 0x140043bcc
je 0x140044606
lea rax, [r10 + 3]
cmp r8, rax
je 0x140044579
lea rax, [rcx + 1]
cmp r8, rax
je 0x140044543
lea rax, [r10 + 2]
cmp r8, rax
je 0x140044506
movzx r9d, sil
cmp r10, rsi
ja 0x14004467d
lea rax, [r10 + 0x10]
cmp r8, rax
jae 0x140043bff
lea ecx, [r9 + 0x7a]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r15d, [r11 + rcx]
sub r15b, 0x56
mov qword [rsp + 0x20], r15
jmp 0x140043c40
lea rax, [r10 + 1]
cmp r8, rax
je 0x1400444bc
inc rax
cmp r8, rax
je 0x140044493
lea rax, [r10 + 3]
cmp r8, rax
je 0x140044478
lea rax, [r10 + 5]
cmp r8, rax
je 0x14004445b
lea rax, [r10 + 4]
cmp r8, rax
je 0x140044442
nop
lea rax, [r10 + r8]
cmp rax, rsi
jbe 0x14004419a
nop dword [rax]
lea rax, [r10 + 5]
cmp r8, rax
je 0x140044181
lea rax, [r10 + 0x2a]
cmp r8, rax
je 0x140044155
lea rax, [r10 + 0x1000]
cmp r8, rax
je 0x14004412c
lea rax, [r10 + 0x64]
cmp r8, rax
je 0x140044111
lea rax, [r10 + 0x10]
cmp r8, rax
je 0x1400440f4
lea rax, [r10 + 0xa]
cmp r8, rax
je 0x1400440db
lea rax, [r10 + 4]
cmp r8, rax
je 0x1400440bb
lea rax, [r10 + 0x5a]
cmp r8, rax
je 0x14004409e
lea rax, [r10 + 0x400]
cmp r8, rax
je 0x140043c50
lea r8, [r10 + 0x61]
lea r10, [r8 + 0x42]
lea rax, [r10 + 0x80]
cmp r8, rax
jb 0x14004465b
lea rax, [r10 + 0x20]
cmp r8, rax
jb 0x140044639
lea rax, [r10 + 6]
cmp r8, rax
jb 0x140043e26
lea rax, [r10 + 1]
cmp r8, rax
jb 0x140043e06
lea rax, [r10 + 0x61]
cmp r8, rax
jb 0x140043de6
lea rax, [r10 + 0x2a]
cmp r8, rax
jb 0x140044047
lea rax, [r10 + 0x1000]
cmp r8, rax
jb 0x140043ff9
lea rax, [r10 + 0x64]
cmp r8, rax
jb 0x140043fb5
lea rax, [r10 + 0x10]
cmp r8, rax
jb 0x140043f8b
lea rax, [r10 + 5]
cmp r8, rax
jb 0x140043c50
lea r8, [r10 + 8]
lea r10, [r8 + 0x2a]
lea rax, [r10 + 2]
cmp r8, rax
ja 0x140043f6a
lea rax, [r10 + 0x7a]
cmp r8, rax
ja 0x140043f45
lea rax, [r10 + 0x200]
cmp r8, rax
ja 0x140043f27
lea rax, [r10 + 0x28]
cmp r8, rax
ja 0x140043f06
lea rax, [r10 + 0x80]
cmp r8, rax
ja 0x140043ee5
lea rax, [r10 + 0x20]
cmp r8, rax
ja 0x140043ec5
lea rax, [r10 + 6]
cmp r8, rax
ja 0x140043e97
lea rax, [r10 + 1]
cmp r8, rax
ja 0x140043e66
lea rax, [r10 + 0x61]
cmp r8, rax
ja 0x140043e48
lea r8, [r10 + 0x3e8]
lea r10, [r8 + 0x20]
jmp 0x140043c50
lea ecx, [r9 - 0x3a]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r15d, [r11 + rcx]
sub r15b, 0x6a
mov qword [rsp + 0x20], r15
jmp 0x140043c40
lea ecx, [r9 - 0x5e]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r15d, [r11 + rcx]
sub r15b, 0x6e
mov qword [rsp + 0x20], r15
jmp 0x140043bd0
add r9b, 0x7e
movzx eax, r9b
and al, r11b
add al, al
sub r9b, al
lea r15d, [r11 + r9]
sub r15b, 0x72
mov qword [rsp + 0x20], r15
jmp 0x140043b65
lea edx, [r9 - 0x30]
movzx eax, r11b
and al, dl
mov ecx, Ordinal_41
sub cl, al
lea eax, [rcx + rcx]
add al, r11b
add al, dl
jmp 0x1400444d0
sub r9b, 0x54
movzx eax, r11b
and al, r9b
mov ecx, Ordinal_41
sub cl, al
lea eax, [rcx + rcx]
add al, r11b
add al, r9b
mov qword [rsp + 0x20], rax
inc r10
dec rsi
mov r15, rax
inc rsi
jmp 0x140043b52
sub r9b, 0x78
movzx eax, r11b
and al, r9b
mov ecx, 0x24
sub cl, al
lea eax, [rcx + rcx]
add al, r11b
add al, r9b
mov qword [rsp + 0x20], rax
dec rsi
mov r15, rax
inc rsi
jmp 0x140043b52
lea edx, [r9 + 0x64]
movzx eax, r11b
and al, dl
mov ecx, Ordinal_35
sub cl, al
lea r15d, [rcx + rcx]
add r15b, r11b
add r15b, dl
jmp 0x140044520
add r9b, 0x40
movzx eax, r11b
and al, r9b
mov ecx, reloc.WLDAP32.dll_Ordinal_32
sub cl, al
lea r15d, [rcx + rcx]
add r15b, r11b
add r15b, r9b
jmp 0x140044558
add r9b, 0x1c
movzx eax, r11b
and al, r9b
mov ecx, reloc.WLDAP32.dll_Ordinal_30
sub cl, al
lea r15d, [rcx + rcx]
add r15b, r11b
add r15b, r9b
jmp 0x14004455b
lea edx, [r9 - 8]
movzx eax, r11b
and al, dl
mov ecx, Ordinal_32
sub cl, al
lea eax, [rcx + rcx]
add al, r11b
add al, dl
jmp 0x140044595
sub r9b, 0x2c
movzx eax, r11b
and al, r9b
mov ecx, reloc.WLDAP32.dll_Ordinal_26
sub cl, al
lea eax, [rcx + rcx]
add al, r11b
add al, r9b
mov qword [rsp + 0x20], rax
jmp 0x1400445c4
sub r9b, 0x50
movzx eax, r11b
and al, r9b
mov ecx, Ordinal_27
sub cl, al
lea r15d, [rcx + rcx]
add r15b, r11b
add r15b, r9b
jmp 0x140044621
add r9b, 0x56
movzx eax, r9b
and al, r11b
add al, al
sub r9b, al
lea r15d, [r11 + r9]
sub r15b, 0x5a
mov qword [rsp + 0x20], r15
mov byte [rsp + rsi + 0x30], r15b
inc rsi
jmp 0x140043b52
lea ecx, [r9 + 0x32]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r15d, [r11 + rcx]
sub r15b, 0x5e
mov qword [rsp + 0x20], r15
cmp r10, 0x80
jb 0x140043fa8
lea edx, [r9 + 0x2c]
movzx eax, r11b
and al, dl
add al, al
movzx ecx, r11b
sub cl, al
add cl, dl
lea eax, [rcx*2 - 0x68]
jmp 0x1400444d0
lea ecx, [r9 + 0xe]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r15d, [r11 + rcx]
sub r15b, 0x62
mov qword [rsp + 0x20], r15
cmp r8, 5
jae 0x140044401
lea rax, [r10 + 0x41]
cmp r8, rax
jbe 0x140044332
lea edx, [r9 - 0x3c]
movzx eax, r11b
and al, dl
add al, al
movzx r15d, r11b
sub r15b, al
sub r15b, 0x5c
add r15b, dl
jmp 0x140043fcb
lea ecx, [r9 - 0x16]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r15d, [r11 + rcx]
sub r15b, 0x66
mov qword [rsp + 0x20], r15
lea rax, [r10 + r8]
cmp rax, 0x400
je 0x140044423
lea rax, [r10 + 0x28]
cmp r8, rax
jbe 0x140044238
lea edx, [r9 + 0x4a]
movzx eax, r11b
and al, dl
add al, al
movzx r15d, r11b
sub r15b, al
sub r15b, 6
add r15b, dl
jmp 0x14004400f
sub r9b, 0x24
movzx eax, r9b
and al, r11b
add al, al
sub r9b, al
lea r15d, [r11 + r9]
sub r15b, 4
jmp 0x140044621
sub r9b, 0x48
movzx eax, r9b
and al, r11b
add al, al
sub r9b, al
lea eax, [r11 + r9]
sub al, 8
mov qword [rsp + 0x20], rax
jmp 0x1400445c4
lea ecx, [r9 - 0x6c]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea eax, [r11 + rcx]
sub al, 0xc
jmp 0x140044595
add r9b, 0x4c
movzx eax, r9b
and al, r11b
add al, al
sub r9b, al
lea r15d, [r11 + r9]
sub r15b, 0x14
jmp 0x140044558
lea ecx, [r9 + 0x28]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r15d, [r11 + rcx]
sub r15b, 0x18
jmp 0x140044520
add r9b, 4
movzx eax, r9b
and al, r11b
add al, al
sub r9b, al
lea eax, [r11 + r9]
sub al, 0x1c
mov qword [rsp + 0x20], rax
dec rsi
mov r15, rax
inc rsi
jmp 0x140043b52
sub r9b, 0x20
movzx eax, r9b
and al, r11b
add al, al
sub r9b, al
lea eax, [r11 + r9]
sub al, 0x20
mov qword [rsp + 0x20], rax
inc r10
dec rsi
mov r15, rax
inc rsi
jmp 0x140043b52
lea ecx, [r9 - 0x44]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea eax, [r11 + rcx]
sub al, 0x24
jmp 0x1400444d0
lea rax, [r10 + 3]
cmp r8, rax
jae 0x1400441be
lea ecx, [r9 + 0x12]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r15d, [r11 + rcx]
sub r15b, 0x7e
jmp 0x14004405d
lea rax, [r10 + 1]
cmp r8, rax
jne 0x1400441e8
sub r9b, 0xc
movzx eax, r9b
and al, r11b
mov ecx, Ordinal_46
sub cl, al
lea r15d, [rcx + rcx]
add r15b, r9b
add r15b, r11b
jmp 0x140044621
inc rax
cmp r8, rax
jne 0x14004420b
lea edx, [r9 + 0x3c]
movzx eax, dl
and al, r11b
mov ecx, reloc.WLDAP32.dll_Ordinal_46
sub cl, al
lea eax, [rcx + rcx]
add al, dl
jmp 0x140044592
lea rax, [r10 + 6]
cmp r8, rax
jne 0x140044062
lea edx, [r9 - 0x58]
movzx eax, dl
and al, r11b
mov ecx, 0x34
sub cl, al
lea r15d, [rcx + rcx]
add r15b, dl
add r15b, r11b
jmp 0x140044520
lea rax, [r10 + 1]
cmp r8, rax
jne 0x14004425d
lea edx, [r9 + 0x6e]
movzx eax, r11b
and al, dl
add al, al
movzx ecx, r11b
sub cl, al
lea eax, [rdx + rcx]
sub al, 2
jmp 0x1400444d0
inc rax
cmp r8, rax
jne 0x140044285
lea edx, [r9 - 0x26]
movzx eax, r11b
and al, dl
mov ecx, 5
sub cl, al
lea r15d, [rcx + rcx]
add r15b, r11b
add r15b, dl
jmp 0x140044520
lea rax, [r10 + 3]
cmp r8, rax
jne 0x1400442af
sub r9b, 2
movzx eax, r11b
and al, r9b
mov ecx, 7
sub cl, al
lea r15d, [rcx + rcx]
add r15b, r11b
add r15b, r9b
jmp 0x140044558
lea rax, [r10 + 5]
cmp r8, rax
jne 0x1400442d6
lea edx, [r9 + 0x46]
movzx eax, r11b
and al, dl
mov ecx, listen
sub cl, al
lea eax, [rcx + rcx]
add al, r11b
add al, dl
jmp 0x140044595
lea rax, [r10 + 7]
cmp r8, rax
jne 0x140044304
add r9b, 0x6a
movzx eax, r11b
and al, r9b
mov ecx, reloc.WS2_32.dll_listen
sub cl, al
lea eax, [rcx + rcx]
add al, r11b
add al, r9b
mov qword [rsp + 0x20], rax
jmp 0x1400445c4
lea rax, [r10 + 8]
cmp r8, rax
jne 0x140044014
sub r9b, 0x72
movzx eax, r11b
and al, r9b
mov ecx, reloc.WS2_32.dll_ntohs
sub cl, al
lea r15d, [rcx + rcx]
add r15b, r11b
add r15b, r9b
jmp 0x140044621
lea rax, [r10 + 1]
cmp r8, rax
jne 0x140044358
sub r9b, 0x18
movzx eax, r11b
and al, r9b
add al, al
sub r11b, al
lea r15d, [r9 + r11]
sub r15b, 0x58
jmp 0x140044621
lea rax, [r10 + 3]
cmp r8, rax
jne 0x14004437d
lea edx, [r9 + 0x30]
movzx eax, r11b
and al, dl
add al, al
movzx ecx, r11b
sub cl, al
lea eax, [rdx + rcx]
sub al, 0x50
jmp 0x140044595
lea rax, [r10 + 4]
cmp r8, rax
jne 0x1400443a3
add r9b, 0x78
movzx eax, r11b
and al, r9b
add al, al
sub r11b, al
lea r15d, [r9 + r11]
sub r15b, 0x48
jmp 0x140044558
lea rax, [r10 + 2]
cmp r8, rax
jne 0x1400443d8
sub r9b, 0x1c
movzx eax, r11b
and al, r9b
add al, al
sub r11b, al
lea eax, [r9 + r11]
sub al, 0x3c
mov qword [rsp + 0x20], rax
inc r10
dec rsi
mov r15, rax
inc rsi
jmp 0x140043b52
lea rax, [r10 + 8]
cmp r8, rax
jne 0x140043fd0
lea edx, [r9 + 8]
movzx eax, r11b
and al, dl
add al, al
movzx ecx, r11b
sub cl, al
lea eax, [rdx + rcx]
sub al, 0x38
jmp 0x1400444d0
lea edx, [r9 + 0x50]
movzx eax, r11b
and al, dl
add al, al
movzx r15d, r11b
sub r15b, al
sub r15b, 0x30
add r15b, r11b
add r15b, dl
jmp 0x140044520
lea edx, [r9 + 0x74]
movzx eax, r11b
and al, dl
add al, al
movzx ecx, r11b
sub cl, al
sub cl, r11b
lea eax, [rdx + rcx]
sub al, 0x2c
jmp 0x140044595
lea ecx, [r9 + 0x76]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea eax, [r11 + rcx]
sub al, 0x3a
jmp 0x140044595
add r9b, 0x2e
movzx eax, r9b
and al, r11b
add al, al
sub r9b, al
lea r15d, [r11 + r9]
sub r15b, 0x42
jmp 0x140044558
lea ecx, [r9 + 0xa]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r15d, [r11 + rcx]
sub r15b, 0x46
jmp 0x140044520
sub r9b, 0x1a
movzx eax, r9b
and al, r11b
add al, al
sub r9b, al
lea eax, [r11 + r9]
sub al, 0x4a
mov qword [rsp + 0x20], rax
dec rsi
mov r15, rax
inc rsi
jmp 0x140043b52
lea ecx, [r9 - 0x62]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea eax, [r11 + rcx]
sub al, 0x52
mov qword [rsp + 0x20], rax
add r9b, 0x3e
movzx eax, r11b
and al, r9b
mov ecx, Ordinal_41
sub cl, al
add cl, cl
add cl, r11b
add cl, r9b
mov byte [rsp + rsi + 0x30], cl
inc r10
dec rsi
mov r15, qword [rsp + 0x20]
inc rsi
jmp 0x140043b52
movzx r9d, sil
lea ecx, [r9 - 0x16]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r15d, [r11 + rcx]
sub r15b, 0x66
add r9b, 0x62
movzx eax, r11b
and al, r9b
mov ecx, reloc.WLDAP32.dll_Ordinal_41
sub cl, al
add cl, cl
add cl, r11b
add cl, r15b
add cl, r9b
mov byte [rsp + rsi + 0x30], cl
jmp 0x140044558
lea ecx, [rsi - 0x3a]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r15d, [r11 + rcx]
sub r15b, 0x6a
add r8, r10
mov qword [rsp + 0x20], r15
movzx eax, r15b
mov rcx, 0xffffffffffffffff
sub rcx, rax
add rsi, rcx
inc rsi
jmp 0x140043b52
movabs rax, 0xd67abe80e4bf37e
add rax, rsi
and dl, al
add dl, dl
sub al, dl
sub al, 0x72
movzx r9d, sil
add al, r11b
mov qword [rsp + 0x20], rax
sub r9b, 0x7a
movzx eax, r11b
and al, r9b
mov ecx, Ordinal_46
sub cl, al
add cl, cl
add cl, r11b
add cl, r9b
movzx eax, cl
mov byte [rsp + rsi + 0x30], al
inc r10
add rax, r10
sub rsi, rax
lea ecx, [rsi - 0x68]
movzx eax, r11b
and al, cl
add al, al
sub r11b, al
sub r11b, 0x28
add r11b, cl
mov byte [rsp + rsi + 0x30], r11b
inc r8
mov rax, 0xffffffffffffffff
sub rax, r8
add rsi, rax
mov r15, qword [rsp + 0x20]
movzx eax, byte [rsp + rsi + 0x30]
add rax, r10
add rsi, rax
inc rsi
jmp 0x140043b52
movabs rax, 0xbc9a251a4f451f36
add rax, rsi
and dl, al
add dl, dl
sub al, dl
lea r15d, [r11 + rax]
sub r15b, 0x7a
mov qword [rsp + 0x20], r15
movzx eax, byte [rsp + rsi + 0x30]
add rax, r10
add rsi, rax
inc rsi
jmp 0x140043b52
add r9b, 0x5a
movzx eax, r11b
and al, r9b
add al, al
sub r11b, al
lea r15d, [r9 + r11]
sub r15b, 0x76
mov qword [rsp + 0x20], r15
jmp 0x140043b50
add r9b, 0x36
movzx eax, r11b
and al, r9b
add al, al
sub r11b, al
lea r15d, [r9 + r11]
sub r15b, 0x7a
mov qword [rsp + 0x20], r15
jmp 0x140043b40
lea rdx, [rbp + 0x165a748]
jmp 0x140044694
lea rdx, [rbp + 0x675c5a]
jmp 0x140044694
lea rdx, [rsp + 0x30]
xor r8d, r8d
lea rcx, [rbp - 0x10]
call fcn.140005aa0
mov r9, r14
mov r8d, recv
mov rdx, rax
lea rcx, [rbp - 0x10]
call fcn.14004dd10
nop
lea rcx, [rbp - 0x38]
call fcn.140002a20
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 0xf
cmova rcx, qword [rbp - 0x10]
xor edx, edx
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov r11, rax
mov eax, 0x5a4d
cmp word [r11], ax
jne 0x140044801
movsxd rcx, dword [r11 + 0x3c]
cmp dword [rcx + r11], 0x4550
jne 0x140044801
mov edx, dword [rcx + r11 + 0x88]
test edx, edx
je 0x140044801
mov esi, dword [rdx + r11 + 0x1c]
lea r14, [r11 + rsi]
mov r9d, dword [rdx + r11 + 0x20]
add r9, r11
mov r15d, dword [rdx + r11 + 0x24]
add r15, r11
xor r10d, r10d
test esi, esi
je 0x140044763
nop dword [rax]
mov r8d, dword [r9]
add r8, r11
mov rax, qword [rbp - 0x40]
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140044753
inc rax
test ecx, ecx
jne 0x140044740
test edx, edx
je 0x1400447d3
inc r10d
add r9, 4
cmp r10d, esi
jb 0x140044730
lea rcx, [rbp - 0x10]
call fcn.140002a20
mov r15, qword [rsp + 0x20]
xor r14d, r14d
lea rcx, [rbp + 0x10]
call fcn.140002a20
mov eax, dword [rsp + 0x2c]
inc eax
mov dword [rsp + 0x2c], eax
mov rsi, qword [rbp - 0x80]
cmp eax, dword [rsi]
jb 0x140042380
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.140212e90
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
movsxd rax, r10d
movzx ecx, word [r15 + rax*2]
mov ebx, dword [r14 + rcx*4]
xor edx, edx
mov r8d, 0x8000
mov rcx, qword [rbp - 0x80]
cmp byte [rsp + 0x28], dl
jne 0x1400447f9
mov rax, qword [rbp - 0x50]
add rbx, qword [rax + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x140044803
xor ebx, ebx
lea rcx, [rbp - 0x10]
call fcn.140002a20
nop
lea rcx, [rbp + 0x10]
call fcn.140002a20
mov rax, rbx
jmp 0x1400447a6