Function at 0x1800af6c0
Capabilities:
Allocate or change rwx memory
Check for software breakpoints
Execute shellcode via indirect call
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x128
mov r13, r8
mov r12, rdx
mov rbp, rcx
mov rax, qword [0x1801df668]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov esi, 1
xor eax, eax
lock cmpxchg dword [0x1801eae20], esi
je 0x1800af72a
xor edi, edi
mov rbx, qword [sym.imp.KERNEL32.dll_Sleep]
nop dword [rax + rax]
xor ecx, ecx
cmp rdi, 0x20
setae cl
call rbx
inc rdi
xor eax, eax
lock cmpxchg dword [0x1801eae20], esi
jne 0x1800af710
cmp qword [0x1801eae28], 0
je 0x1800af7e1
lea rdx, [rsp + 0xd8]
mov r8d, Ordinal_50
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
cmp dword [rsp + 0xf8], 0x1000
mov esi, 7
jne 0x1800b0f86
mov eax, 0xf0
and eax, dword [rsp + 0xfc]
je 0x1800b0f86
lea rdx, [rsp + 0xd8]
mov r8d, Ordinal_50
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
cmp dword [rsp + 0xf8], 0x1000
jne 0x1800b0f86
mov eax, 0xf0
and eax, dword [rsp + 0xfc]
je 0x1800b0f86
mov eax, dword [0x1801eae40]
test rax, rax
je 0x1800af803
mov rcx, qword [0x1801eae30]
imul rdx, rax, 0x38
xor eax, eax
nop dword [rax]
cmp qword [rcx + rax], rbp
je 0x1800af7eb
add rax, 0x38
cmp rdx, rax
jne 0x1800af7d0
jmp 0x1800af803
mov esi, 2
jmp 0x1800b0f86
mov esi, 3
movabs rcx, 0x37ffffffc8
cmp rax, rcx
jne 0x1800b0f86
lea rcx, [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xb0]
mov rsi, rbp
add rbp, 0xffffffffc0000000
cmp rbp, rax
cmovbe rbp, rax
mov rbx, qword [rsp + 0xb8]
cmp rsi, 0x40000001
cmovb rbp, rax
lea rax, [rsi + 0x40000000]
cmp rax, rbx
cmovb rbx, rax
add rbx, 0xfffffffffffff001
mov rax, qword [0x1801eae18]
mov qword [rsp + 0x38], rsi
test rax, rax
mov qword [rsp + 0x50], r12
jne 0x1800af87c
jmp 0x1800b0a55
mov rax, qword [rax]
test rax, rax
je 0x1800b0a50
cmp rbp, rax
ja 0x1800af870
cmp rbx, rax
jbe 0x1800af870
cmp qword [rax + 8], 0
je 0x1800af870
mov qword [rsp + 0x40], r13
mov rdx, qword [rsp + 0x38]
mov rbp, qword [rax + 8]
mov rcx, qword [rbp]
mov qword [rax + 8], rcx
inc dword [rax + 0x10]
mov qword [rsp + 0xd8], rdx
mov qword [rsp + 0xe0], r12
mov rax, rbp
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0xe8], rbp
movups xmm0, xmmword [0x1801aa211]
movaps xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0x86], 0
mov qword [rsp + 0x80], 0x25ff
movups xmm0, xmmword [0x1801aa228]
movaps xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0xf8], 0
xor eax, eax
mov qword [rsp + 0x48], rax
xor eax, eax
mov qword [rsp + 0x28], rax
xor eax, eax
mov qword [rsp + 0x58], rax
xor r10d, r10d
nop dword [rax]
mov rax, qword [rsp + 0xd8]
movzx ecx, r10b
lea r13, [rax + rcx]
lea rdi, [rax + rcx]
inc rdi
movzx r8d, byte [rax + rcx]
movzx ecx, r8b
mov r11b, 1
cmp ecx, 0xef
jg 0x1800afd81
add ecx, 0xffffffda
cmp ecx, 0x41
ja case.default.0x1800af96f
lea rdx, [0x1800b12b4]
movsxd rax, dword [rdx + rcx*4]
add rax, rdx
mov rcx, rdi
mov r9, r13
notrack jmp rax
mov al, 0x40
lea rbp, [r13 + 2]
movzx r8d, byte [r13 + 1]
movzx ecx, r8b
cmp ecx, 0xef
jg 0x1800afdae
add ecx, 0xffffffda
cmp ecx, 0x41
ja case.default.0x1800afc64
mov dl, reloc.WS2_32.dll_recv
lea rbx, [0x1800b13bc]
movsxd rsi, dword [rbx + rcx*4]
add rsi, rbx
mov rcx, rbp
mov r9, rdi
mov r11d, eax
notrack jmp rsi
mov dl, 0x40
or al, dl
lea rdi, [r13 + 3]
movzx r8d, byte [r13 + 2]
movzx ecx, r8b
cmp ecx, 0xef
jg 0x1800afdd9
add ecx, 0xffffffda
cmp ecx, 0x41
ja case.default.0x1800afca9
mov dl, reloc.WS2_32.dll_recv
lea rbx, [0x1800b14c4]
movsxd rsi, dword [rbx + rcx*4]
add rsi, rbx
mov rcx, rdi
mov r9, rbp
mov r11d, eax
notrack jmp rsi
mov dl, 0x40
or al, dl
lea rbp, [r13 + 4]
movzx r8d, byte [r13 + 3]
movzx ecx, r8b
cmp ecx, 0xef
jg 0x1800afe04
add ecx, 0xffffffda
cmp ecx, 0x41
ja case.default.0x1800afc64
mov dl, reloc.WS2_32.dll_recv
lea rbx, [0x1800b15cc]
movsxd rsi, dword [rbx + rcx*4]
add rsi, rbx
mov rcx, rbp
mov r9, rdi
mov r11d, eax
notrack jmp rsi
mov dl, 0x40
or al, dl
lea rdi, [r13 + 5]
movzx r8d, byte [r13 + 4]
movzx ecx, r8b
cmp ecx, 0xef
jg 0x1800afe2f
add ecx, 0xffffffda
cmp ecx, 0x41
ja case.default.0x1800afca9
mov dl, reloc.WS2_32.dll_recv
lea rbx, [0x1800b16d4]
movsxd rsi, dword [rbx + rcx*4]
add rsi, rbx
mov rcx, rdi
mov r9, rbp
mov r11d, eax
notrack jmp rsi
mov dl, 0x40
or al, dl
lea rbp, [r13 + 6]
movzx r8d, byte [r13 + 5]
movzx ecx, r8b
cmp ecx, 0xef
jg 0x1800afe5a
add ecx, 0xffffffda
cmp ecx, 0x41
ja case.default.0x1800afc64
mov dl, reloc.WS2_32.dll_recv
lea rbx, [0x1800b17dc]
movsxd rsi, dword [rbx + rcx*4]
add rsi, rbx
mov rcx, rbp
mov r9, rdi
mov r11d, eax
notrack jmp rsi
mov dl, 0x40
or al, dl
lea rdi, [r13 + 7]
movzx r8d, byte [r13 + 6]
movzx ecx, r8b
cmp ecx, 0xef
jg 0x1800afe85
add ecx, 0xffffffda
cmp ecx, 0x41
ja case.default.0x1800afca9
mov dl, reloc.WS2_32.dll_recv
lea rbx, [0x1800b18e4]
movsxd rsi, dword [rbx + rcx*4]
add rsi, rbx
mov rcx, rdi
mov r9, rbp
mov r11d, eax
notrack jmp rsi
mov dl, 0x40
or al, dl
lea rbp, [r13 + 8]
movzx r8d, byte [r13 + 7]
movzx ecx, r8b
cmp ecx, 0xef
jg 0x1800afeb0
add ecx, 0xffffffda
cmp ecx, 0x41
ja case.default.0x1800afc64
mov dl, reloc.WS2_32.dll_recv
lea rbx, [0x1800b19ec]
movsxd rsi, dword [rbx + rcx*4]
add rsi, rbx
mov rcx, rbp
mov r9, rdi
mov r11d, eax
notrack jmp rsi
mov dl, 0x40
or al, dl
lea rdi, [r13 + 9]
movzx r8d, byte [r13 + 8]
movzx ecx, r8b
cmp ecx, 0xef
jg 0x1800afedb
add ecx, 0xffffffda
cmp ecx, 0x41
ja case.default.0x1800afca9
mov dl, reloc.WS2_32.dll_recv
lea rbx, [0x1800b1af4]
movsxd rsi, dword [rbx + rcx*4]
add rsi, rbx
mov rcx, rdi
mov r9, rbp
mov r11d, eax
notrack jmp rsi
mov dl, 0x40
or al, dl
lea rbp, [r13 + 0xa]
movzx r8d, byte [r13 + 9]
movzx ecx, r8b
cmp ecx, 0xef
jg 0x1800aff06
add ecx, 0xffffffda
cmp ecx, 0x41
ja case.default.0x1800afc64
mov dl, reloc.WS2_32.dll_recv
lea rbx, [0x1800b1bfc]
movsxd rsi, dword [rbx + rcx*4]
add rsi, rbx
mov rcx, rbp
mov r9, rdi
mov r11d, eax
notrack jmp rsi
mov dl, 0x40
or al, dl
lea rdi, [r13 + 0xb]
movzx r8d, byte [r13 + 0xa]
movzx ecx, r8b
cmp ecx, 0xef
jg 0x1800aff2d
add ecx, 0xffffffda
cmp ecx, 0x41
ja case.default.0x1800afca9
mov dl, reloc.WS2_32.dll_recv
lea rbx, [0x1800b1d04]
movsxd rsi, dword [rbx + rcx*4]
add rsi, rbx
mov rcx, rdi
mov r9, rbp
mov r11d, eax
notrack jmp rsi
mov dl, 0x40
or al, dl
lea rbp, [r13 + 0xc]
movzx r8d, byte [r13 + 0xb]
movzx ecx, r8b
cmp ecx, 0xef
jg 0x1800aff54
add ecx, 0xffffffda
cmp ecx, 0x41
ja case.default.0x1800afc64
mov dl, reloc.WS2_32.dll_recv
lea rbx, [0x1800b1e0c]
movsxd rsi, dword [rbx + rcx*4]
add rsi, rbx
mov rcx, rbp
mov r9, rdi
mov r11d, eax
notrack jmp rsi
mov dl, 0x40
or al, dl
lea rdi, [r13 + 0xd]
movzx r8d, byte [r13 + 0xc]
movzx ecx, r8b
cmp ecx, 0xef
jg 0x1800aff83
add ecx, 0xffffffda
cmp ecx, 0x41
ja case.default.0x1800afca9
mov dl, reloc.WS2_32.dll_recv
lea rbx, [0x1800b1f14]
movsxd rsi, dword [rbx + rcx*4]
add rsi, rbx
mov rcx, rdi
mov r9, rbp
mov r11d, eax
notrack jmp rsi
mov dl, 0x40
or al, dl
lea rsi, [r13 + 0xe]
movzx r8d, byte [r13 + 0xd]
movzx ecx, r8b
cmp ecx, 0xef
jg 0x1800b002f
add ecx, 0xffffffda
cmp ecx, 0x41
ja case.default.0x1800afcee
mov dl, reloc.WS2_32.dll_recv
lea rbx, [0x1800b201c]
movsxd rbp, dword [rbx + rcx*4]
add rbp, rbx
mov rcx, rsi
mov r9, rdi
mov r11d, eax
notrack jmp rbp
mov dl, 0x40
or al, dl
lea rbp, [r13 + 0xf]
movzx r8d, byte [r13 + 0xe]
movzx ecx, r8b
cmp ecx, 0xef
jg 0x1800b0247
add ecx, 0xffffffda
cmp ecx, 0x41
ja case.default.0x1800afd33
mov dl, reloc.WS2_32.dll_recv
lea rbx, [0x1800b2124]
movsxd rdi, dword [rbx + rcx*4]
add rdi, rbx
mov rcx, rbp
mov r9, rsi
mov r11d, eax
notrack jmp rdi
mov dl, 0x40
or al, dl
lea rcx, [r13 + 0x10]
movzx r8d, byte [r13 + 0xf]
movzx ebx, r8b
cmp ebx, 0xef
jg 0x1800b0272
add ebx, 0xffffffda
cmp ebx, 0x41
ja case.default.0x1800afd75
mov dl, reloc.WS2_32.dll_recv
lea rsi, [0x1800b222c]
movsxd rdi, dword [rsi + rbx*4]
add rdi, rsi
mov r9, rbp
mov r11d, eax
notrack jmp rdi
mov dl, 0x40
or al, dl
jmp case.default.0x1800afd75
cmp ecx, 0xf0
je 0x1800b02ab
mov al, 4
cmp ecx, 0xf3
je 0x1800af974
cmp ecx, 0xf2
jne case.default.0x1800af96f
mov al, 2
jmp 0x1800af974
cmp ecx, 0xf0
je 0x1800b02b9
cmp ecx, 0xf2
je 0x1800b02c0
cmp ecx, 0xf3
jne case.default.0x1800afc64
mov dl, 4
jmp case.0x1800af9b2.103
cmp ecx, 0xf0
je 0x1800b02ce
cmp ecx, 0xf2
je 0x1800b02d5
cmp ecx, 0xf3
jne case.default.0x1800afca9
mov dl, 4
jmp case.0x1800af9f7.103
cmp ecx, 0xf0
je 0x1800b02e3
cmp ecx, 0xf2
je 0x1800b02ea
cmp ecx, 0xf3
jne case.default.0x1800afc64
mov dl, 4
jmp case.0x1800afa3c.103
cmp ecx, 0xf0
je 0x1800b057c
cmp ecx, 0xf2
je 0x1800b0583
cmp ecx, 0xf3
jne case.default.0x1800afca9
mov dl, 4
jmp case.0x1800afa81.103
cmp ecx, 0xf0
je 0x1800b0591
cmp ecx, 0xf2
je 0x1800b0598
cmp ecx, 0xf3
jne case.default.0x1800afc64
mov dl, 4
jmp case.0x1800afac6.103
cmp ecx, 0xf0
je 0x1800b05a6
cmp ecx, 0xf2
je 0x1800b05ad
cmp ecx, 0xf3
jne case.default.0x1800afca9
mov dl, 4
jmp case.0x1800afb0b.103
cmp ecx, 0xf0
je 0x1800b05bb
cmp ecx, 0xf2
je 0x1800b05c2
cmp ecx, 0xf3
jne case.default.0x1800afc64
mov dl, 4
jmp case.0x1800afb50.103
cmp ecx, 0xf0
je 0x1800b07f9
cmp ecx, 0xf2
je 0x1800b0800
cmp ecx, 0xf3
jne case.default.0x1800afca9
mov dl, 4
jmp case.0x1800afb95.103
cmp ecx, 0xf0
je 0x1800b080e
cmp ecx, 0xf2
je 0x1800b0815
cmp ecx, 0xf3
jne case.default.0x1800afc64
mov dl, 4
jmp case.0x1800afbda.103
cmp ecx, 0xf0
je 0x1800b0823
cmp ecx, 0xf2
je 0x1800b082a
cmp ecx, 0xf3
jne case.default.0x1800afca9
mov dl, 4
jmp case.0x1800afc1f.103
cmp ecx, 0xf0
je 0x1800b0838
cmp ecx, 0xf2
je 0x1800b083f
cmp ecx, 0xf3
jne case.default.0x1800afc64
mov dl, 4
jmp case.0x1800afc64.103
mov rcx, rbp
mov r9, rdi
jmp 0x1800affb0
cmp ecx, 0xf0
je 0x1800b086d
cmp ecx, 0xf2
je 0x1800b0874
cmp ecx, 0xf3
jne case.default.0x1800afca9
mov dl, 4
jmp case.0x1800afca9.103
mov rcx, rdi
mov r9, rbp
mov r11d, eax
mov eax, r8d
and al, 0xf0
xor edi, edi
cmp al, 0x40
jne 0x1800afff7
mov eax, r8d
shr al, 3
movzx r8d, byte [rcx]
mov ecx, r8d
and cl, 0xf8
cmp cl, 0xb8
sete bl
and bl, al
add r9, 2
mov eax, r8d
and al, 0xf0
mov edi, 0x40000000
cmp al, 0x40
jne 0x1800afffc
xor eax, eax
mov dword [rsp + 0x20], 0
jmp 0x1800b00b1
mov r9, rcx
xor ebx, ebx
cmp r8b, 0xf
jne 0x1800b0018
movzx ecx, byte [r9]
inc r9
lea rax, [0x1801aa04a]
mov dword [rsp + 0x20], ecx
mov ebp, ecx
jmp 0x1800b0070
mov eax, r8d
and al, 0xfc
cmp al, 0xa0
jne 0x1800b005e
inc bl
test r11b, 0x10
jne 0x1800b005a
and r11b, 0x77
jmp 0x1800b005e
cmp ecx, 0xf0
je 0x1800b0996
cmp ecx, 0xf2
je 0x1800b099d
cmp ecx, 0xf3
jne case.default.0x1800afcee
mov dl, 4
jmp case.0x1800afcee.103
or r11b, 8
mov dword [rsp + 0x20], 0
lea rax, [0x1801aa000]
mov ebp, r8d
movzx ecx, bpl
mov rdx, rcx
shr rdx, 2
movzx edx, byte [rax + rdx]
and ecx, 3
add rcx, rdx
movzx r14d, byte [rax + rcx]
cmp r14, 0xff
je 0x1800b00ab
xor esi, esi
test r14b, r14b
jns 0x1800b00cc
and r14d, 0x7f
movzx r14d, word [rax + r14]
mov esi, r14d
shr esi, 8
jmp 0x1800b00cc
mov eax, r8d
mov r8d, ebp
mov ebp, r8d
or edi, 0x3000
mov ecx, r8d
and cl, 0xfd
cmp cl, 0x24
sete r14b
xor esi, esi
mov r8d, eax
cmp byte [rsp + 0x20], 0
je 0x1800b0109
movzx eax, bpl
mov rcx, rax
shr rcx, 2
lea rdx, [0x1801aa000]
movzx ecx, byte [rcx + rdx + 0x13c]
and eax, 3
add rax, rcx
mov ecx, edi
or ecx, 0x3000
lea rdx, str.____AI____LB________ODS___DWC________________dfnk__jF__DF___D__
test byte [rdx + rax], r11b
cmovne edi, ecx
mov qword [rsp + 0x68], r10
test r14b, 1
mov dword [rsp + 0x64], ebx
mov r15d, edi
jne 0x1800b0141
or r15d, 0x9000
test r11b, 0x20
cmove r15d, edi
mov dword [rsp + 0x24], 0
xor r12d, r12d
xor eax, eax
xor r10d, r10d
xor ebp, ebp
jmp 0x1800b04c5
or r15d, 1
movzx eax, byte [r9]
mov dword [rsp + 0x24], eax
mov r12d, eax
shr r12d, 3
and r12d, 7
test esi, esi
je 0x1800b016f
mov ecx, r12d
shl esi, cl
or edi, 0x3001
test sil, 0x80
cmovne r15d, edi
mov eax, dword [rsp + 0x24]
mov r10d, eax
shr r10b, 6
mov ebx, eax
and bl, 7
cmp byte [rsp + 0x20], 0
jne 0x1800b01d9
cmp bpl, 0xd9
jb 0x1800b01d9
cmp bpl, 0xdf
ja 0x1800b01d9
lea eax, [rbp + 0x27]
cmp r10b, 3
movzx eax, al
lea rdx, [0x1801aa000]
lea rcx, [rax + rdx + 0xfd]
lea rax, [rdx + rax*8]
lea rax, [r12 + rax + 0x104]
cmovne rax, rcx
movzx esi, bl
movzx ecx, r12b
cmove ecx, esi
movzx eax, byte [rax]
shl al, cl
mov ecx, r15d
or ecx, 0x3000
test al, al
cmovs r15d, ecx
test r11b, 0x20
je 0x1800b0305
cmp r10b, 3
je 0x1800b02fe
mov edx, ebp
and dl, 0xfe
cmp byte [rsp + 0x20], 0
lea rsi, [0x1801aa1c6]
mov rax, rsi
lea rcx, [0x1801aa1ae]
cmove rax, rcx
lea rcx, [0x1801aa1d8]
cmove rcx, rsi
movzx edi, bpl
movzx esi, dl
cmovne esi, edi
nop word cs:[rax + rax]
cmp byte [rax], sil
je 0x1800b02f1
add rax, 2
cmp rax, rcx
jne 0x1800b0230
jmp 0x1800b02fe
cmp ecx, 0xf0
je 0x1800b09ab
cmp ecx, 0xf2
je 0x1800b09b2
cmp ecx, 0xf3
jne case.default.0x1800afd33
mov dl, 4
jmp case.0x1800afd33.103
cmp ebx, 0xf0
je 0x1800b09c0
cmp ebx, 0xf2
je 0x1800b09c7
cmp ebx, 0xf3
jne case.default.0x1800afd75
mov dl, 4
jmp case.0x1800afd75.103
mov al, 8
jmp 0x1800af974
mov al, reloc.WS2_32.dll_recv
jmp 0x1800af974
mov al, reloc.WLDAP32.dll_Ordinal_32
jmp 0x1800af974
mov dl, 8
jmp case.0x1800af9b2.103
mov dl, reloc.WLDAP32.dll_Ordinal_32
jmp case.0x1800af9b2.103
mov dl, 2
jmp case.0x1800af9b2.103
mov dl, 8
jmp case.0x1800af9f7.103
mov dl, reloc.WLDAP32.dll_Ordinal_32
jmp case.0x1800af9f7.103
mov dl, 2
jmp case.0x1800af9f7.103
mov dl, 8
jmp case.0x1800afa3c.103
mov dl, reloc.WLDAP32.dll_Ordinal_32
jmp case.0x1800afa3c.103
mov dl, 2
jmp case.0x1800afa3c.103
movzx eax, byte [rax + 1]
mov ecx, r12d
shl eax, cl
test al, 0x80
je 0x1800b0305
or r15d, 0x9000
cmp byte [rsp + 0x20], 0
je 0x1800b0345
movzx eax, bpl
lea ecx, [rax - 0x20]
cmp ecx, 3
ja case.default.0x1800b0326
lea rdx, [0x1800b2334]
movsxd rax, dword [rdx + rcx*4]
add rax, rdx
notrack jmp rax
mov r10b, 3
cmp r12b, 4
ja 0x1800b03c0
cmp r12b, 1
jne 0x1800b03c7
jmp 0x1800b03c0
cmp bpl, 0x8e
je 0x1800b03b4
movzx eax, bpl
cmp eax, 0x8c
je 0x1800b03ba
lea rsi, [0x1801aa1e7]
lea rcx, [0x1801aa1d8]
cmp r10b, 3
je 0x1800b03a0
jmp 0x1800b03c7
mov eax, dword [rsp + 0x24]
and al, 0x30
mov r10b, 3
cmp al, 0x20
je 0x1800b03c0
jmp 0x1800b03c7
mov rcx, rdi
mov r9, r13
jmp case.0x1800afd75.39
lea rsi, [0x1801aa211]
lea rcx, [0x1801aa1e7]
cmp r10b, 3
jne 0x1800b087b
nop
cmp byte [rcx], bpl
je 0x1800b0846
add rcx, 3
cmp rcx, rsi
jne 0x1800b03a0
jmp 0x1800b03c7
cmp r12b, 1
je 0x1800b03c0
cmp r12b, 5
jbe 0x1800b03c7
or r15d, 0x11000
movzx eax, byte [r9 + 1]
cmp r12b, 1
ja 0x1800b03ee
cmp bpl, 0xf7
je 0x1800b03ea
movzx ecx, bpl
cmp ecx, 0xf6
jne 0x1800b03ee
or r14b, 2
jmp 0x1800b03ee
or r14b, 0x10
cmp r10b, 2
je 0x1800b0412
movzx ecx, r10b
cmp ecx, 1
je 0x1800b0420
test ecx, ecx
jne 0x1800b0424
test r11b, 0x10
jne 0x1800b0428
cmp bl, 5
sete cl
shl cl, 2
jmp 0x1800b0430
test r11b, 0x10
sete cl
add cl, cl
add cl, 2
jmp 0x1800b0430
mov cl, 1
jmp 0x1800b0430
xor ecx, ecx
jmp 0x1800b0430
cmp bl, 6
sete cl
add cl, cl
mov esi, 2
cmp r10b, 3
je 0x1800b045e
cmp bl, 4
jne 0x1800b045e
or r15d, 2
and al, 7
mov esi, 3
cmp al, 5
jne 0x1800b045e
and r10b, 1
jne 0x1800b045e
add r9, 2
mov rsi, r9
jmp 0x1800b0488
add rsi, r9
dec rsi
cmp cl, 4
je 0x1800b0488
movzx eax, cl
xor ebp, ebp
cmp eax, 2
je 0x1800b04a4
cmp eax, 1
jne 0x1800b04b9
or r15d, 0x40
movzx eax, byte [rsi]
mov cl, 1
xor r10d, r10d
xor ebp, ebp
jmp 0x1800b04be
or r15d, 0x100
mov eax, dword [rsi]
mov r10d, eax
shr r10d, 8
mov ebp, eax
and ebp, 0xffff0000
mov cl, 4
jmp 0x1800b04be
or r15d, 0x80
movzx eax, word [rsi]
mov r10d, eax
shr r10d, 8
mov cl, 2
jmp 0x1800b04be
xor eax, eax
xor r10d, r10d
movzx r9d, cl
add r9, rsi
test r14b, 0x10
mov dword [rsp + 0x60], eax
jne 0x1800b04f8
xor edi, edi
xor ebx, ebx
xor ecx, ecx
test r14b, 4
jne 0x1800b05cb
test r14b, 2
jne 0x1800b05e6
test r14b, 0x40
jne 0x1800b060d
jmp 0x1800b05f7
test r14b, 0x40
jne 0x1800b052a
cmp byte [rsp + 0x64], 0
je 0x1800b054f
or r15d, 0x20
mov rdi, qword [r9]
mov rbx, rdi
shr rbx, 8
mov rcx, rdi
shr rcx, 0x10
add r9, 8
test r14b, 4
jne 0x1800b05cb
jmp 0x1800b04df
test r11b, 8
je 0x1800b060d
or r15d, 0x208
movzx edi, word [r9]
mov ebx, edi
shr ebx, 8
add r9, 2
xor ecx, ecx
jmp 0x1800b0625
test r11b, 8
jne 0x1800b05c9
or r15d, 0x10
mov edi, dword [r9]
mov ebx, edi
shr ebx, 8
mov ecx, edi
shr ecx, 0x10
add r9, 4
test r14b, 4
jne 0x1800b05cb
jmp 0x1800b04df
mov dl, 8
jmp case.0x1800afa81.103
mov dl, reloc.WLDAP32.dll_Ordinal_32
jmp case.0x1800afa81.103
mov dl, 2
jmp case.0x1800afa81.103
mov dl, 8
jmp case.0x1800afac6.103
mov dl, reloc.WLDAP32.dll_Ordinal_32
jmp case.0x1800afac6.103
mov dl, 2
jmp case.0x1800afac6.103
mov dl, 8
jmp case.0x1800afb0b.103
mov dl, reloc.WLDAP32.dll_Ordinal_32
jmp case.0x1800afb0b.103
mov dl, 2
jmp case.0x1800afb0b.103
mov dl, 8
jmp case.0x1800afb50.103
mov dl, reloc.WLDAP32.dll_Ordinal_32
jmp case.0x1800afb50.103
mov dl, 2
jmp case.0x1800afb50.103
xor ecx, ecx
or r15d, 8
movzx edi, word [r9]
mov ebx, edi
shr ebx, 8
add r9, 2
test r14b, 2
je 0x1800b04e9
or r15d, 4
movzx edi, byte [r9]
inc r9
test r14b, 0x40
jne 0x1800b060d
test r14b, 0x20
je 0x1800b0625
or r15d, 0x204
movzx edi, byte [r9]
inc r9
jmp 0x1800b0625
or r15d, 0x210
mov edi, dword [r9]
mov ebx, edi
shr ebx, 8
mov ecx, edi
shr ecx, 0x10
add r9, 4
sub r9, r13
mov eax, r15d
or eax, 0x5000
test r9b, 0xf0
cmove eax, r15d
mov edx, reloc.WS2_32.dll_ntohs
cmovne r9d, edx
test eax, 0x1000
mov r15, qword [rsp + 0x68]
jne 0x1800b1233
movzx r14d, byte [rsp + 0x58]
mov r11d, r14d
cmp r15b, 5
jb 0x1800b068d
mov qword [rsp + 0x86], r13
mov al, 1
mov cl, reloc.WS2_32.dll_ntohl
lea rsi, [rsp + 0x80]
cmp r13, qword [rsp + 0x28]
jae 0x1800b0920
cmp cl, r9b
je 0x1800b0920
jmp 0x1800b1233
mov edx, dword [rsp + 0x24]
and dl, 0xc7
cmp dl, 5
jne 0x1800b06fb
movzx ebx, r9b
lea rdx, [rsp + 0x110]
mov rdi, rdx
mov rcx, rbx
mov rsi, r13
rep movsb byte [rdi], byte [rsi]
shr eax, 2
and eax, 0xf
lea rcx, [rsp + 0x10c]
add rbx, rcx
sub rbx, rax
shl r10d, 8
movzx eax, byte [rsp + 0x60]
or eax, r10d
movzx eax, ax
or ebp, eax
mov rax, qword [rsp + 0x30]
add eax, r11d
sub r13d, eax
add r13d, ebp
mov dword [rbx], r13d
not r8b
xor r12b, 4
or r12b, r8b
sete al
mov rsi, rdx
jmp 0x1800b091d
cmp r8b, 0xe8
jne 0x1800b0738
movzx eax, r9b
add rax, r13
movzx edx, bl
shl edx, 8
movzx ebx, dil
or ebx, edx
shl ecx, 0x10
or ecx, ebx
movsxd rcx, ecx
add rcx, rax
mov qword [rsp + 0x98], rcx
mov cl, reloc.WS2_32.dll_recv
xor eax, eax
lea rsi, [rsp + 0x90]
jmp 0x1800b0674
movzx esi, r8b
mov edx, esi
and edx, 0xfffffffd
cmp edx, 0xe9
jne 0x1800b07a7
movzx edx, r9b
add rdx, r13
movzx eax, bl
shl eax, 8
movzx ebx, dil
or ebx, eax
shl ecx, 0x10
or ecx, ebx
cmp r8b, 0xeb
movsx rbx, dil
movsxd rax, ecx
cmove rax, rbx
add rax, rdx
mov rcx, qword [rsp + 0xd8]
cmp rax, rcx
jb 0x1800b08ac
add rcx, 5
cmp rax, rcx
jae 0x1800b08ac
mov rcx, qword [rsp + 0x28]
cmp rcx, rax
cmovbe rcx, rax
mov qword [rsp + 0x28], rcx
jmp 0x1800b0918
mov edx, esi
and edx, 0xfffffff0
cmp edx, 0x70
sete dl
mov eax, esi
and eax, 0xfffffffc
cmp eax, 0xe0
sete r10b
or r10b, dl
jne 0x1800b08c1
mov eax, dword [rsp + 0x20]
and al, 0xf0
cmp al, 0x80
je 0x1800b08c1
and esi, 0xfffffffe
cmp esi, 0xc2
sete cl
cmp r13, qword [rsp + 0x28]
setae al
and al, cl
jmp 0x1800b091a
mov dl, 8
jmp case.0x1800afb95.103
mov dl, reloc.WLDAP32.dll_Ordinal_32
jmp case.0x1800afb95.103
mov dl, 2
jmp case.0x1800afb95.103
mov dl, 8
jmp case.0x1800afbda.103
mov dl, reloc.WLDAP32.dll_Ordinal_32
jmp case.0x1800afbda.103
mov dl, 2
jmp case.0x1800afbda.103
mov dl, 8
jmp case.0x1800afc1f.103
mov dl, reloc.WLDAP32.dll_Ordinal_32
jmp case.0x1800afc1f.103
mov dl, 2
jmp case.0x1800afc1f.103
mov dl, 8
jmp case.0x1800afc64.103
mov dl, reloc.WLDAP32.dll_Ordinal_32
jmp case.0x1800afc64.103
mov dl, 2
jmp case.0x1800afc64.103
test byte [rcx + 1], r11b
je 0x1800b03c7
movzx eax, byte [rcx + 2]
mov ecx, r12d
shl eax, cl
test al, 0x80
jne 0x1800b03c7
jmp 0x1800b03c0
mov dl, 8
jmp case.0x1800afca9.103
mov dl, reloc.WLDAP32.dll_Ordinal_32
jmp case.0x1800afca9.103
mov dl, 2
jmp case.0x1800afca9.103
cmp eax, 0xd5
jle 0x1800b0a1d
cmp eax, 0xd6
je 0x1800b0a41
cmp eax, 0xf7
je 0x1800b0a32
cmp eax, 0xd7
je 0x1800b0a32
jmp 0x1800b03c7
mov qword [rsp + 0x86], rax
cmp r13, qword [rsp + 0x28]
setae al
jmp 0x1800b066a
movzx eax, r9b
add rax, r13
movsx rdx, dil
movzx ebx, bl
shl ebx, 8
movzx edi, dl
or edi, ebx
shl ecx, 0x10
or ecx, edi
movsxd rcx, ecx
test r10b, r10b
cmovne rcx, rdx
add rcx, rax
mov rdx, qword [rsp + 0xd8]
cmp rcx, rdx
jb 0x1800b09e4
add rdx, 5
cmp rcx, rdx
jae 0x1800b09e4
mov rax, qword [rsp + 0x28]
cmp rax, rcx
cmovbe rax, rcx
mov qword [rsp + 0x28], rax
xor eax, eax
mov rsi, r13
mov ecx, r9d
movzx ecx, cl
add r14d, ecx
cmp r14d, 0x32
ja 0x1800b1233
cmp qword [rsp + 0x48], 8
je 0x1800b1233
mov rdx, qword [rsp + 0x48]
mov byte [rsp + rdx + 0x100], r15b
mov rbx, qword [rsp + 0x58]
mov byte [rsp + rdx + 0x108], bl
inc rdx
mov qword [rsp + 0x48], rdx
mov dword [rsp + 0xfc], edx
mov rdx, qword [rsp + 0x30]
lea rdi, [rdx + r11]
rep movsb byte [rdi], byte [rsi]
add r9b, r15b
mov ecx, r14d
mov qword [rsp + 0x58], rcx
mov r10d, r9d
test al, al
mov rdi, qword [rsp + 0x50]
je 0x1800af920
jmp 0x1800b0fb4
mov dl, 8
jmp case.0x1800afcee.103
mov dl, reloc.WLDAP32.dll_Ordinal_32
jmp case.0x1800afcee.103
mov dl, 2
jmp case.0x1800afcee.103
mov dl, 8
jmp case.0x1800afd33.103
mov dl, reloc.WLDAP32.dll_Ordinal_32
jmp case.0x1800afd33.103
mov dl, 2
jmp case.0x1800afd33.103
mov dl, 8
jmp case.0x1800afd75.103
mov dl, reloc.WLDAP32.dll_Ordinal_32
jmp case.0x1800afd75.103
mov dl, 2
jmp case.0x1800afd75.103
mov rcx, rsi
mov r9, rdi
jmp 0x1800affb0
mov rcx, rbp
mov r9, rsi
jmp 0x1800affb0
mov eax, r8d
and al, 0xfc
cmp al, 0xe0
je 0x1800b1233
cmp r8b, 0xf
movzx eax, byte [rsp + 0x20]
cmove esi, eax
and sil, 0xf
xor sil, 0x71
mov byte [rsp + 0x70], sil
mov qword [rsp + 0x78], rcx
mov cl, reloc.WS2_32.dll_recv
xor eax, eax
lea rsi, [rsp + 0x70]
jmp 0x1800b0674
cmp eax, 0x50
je 0x1800b0a32
cmp eax, 0xc5
je 0x1800b03c0
jmp 0x1800b03c7
test r11b, 9
jne 0x1800b03c0
jmp 0x1800b03c7
test r11b, 6
jne 0x1800b03c0
jmp 0x1800b03c7
mov rsi, qword [rsp + 0x38]
cmp rbp, rsi
ja 0x1800b0b07
mov edi, dword [rsp + 0xd0]
mov rax, rsi
shr rax, 0x20
je 0x1800b0a78
mov rax, rsi
xor edx, edx
div rdi
jmp 0x1800b0a7e
mov eax, esi
xor edx, edx
div edi
add rdx, rdi
sub rsi, rdx
cmp rsi, rbp
jb 0x1800b0b07
lea r14, [rsp + 0xd8]
mov r15, qword [sym.imp.KERNEL32.dll_VirtualQuery]
nop dword [rax]
mov r8d, Ordinal_50
mov rcx, rsi
mov rdx, r14
call r15
test rax, rax
je 0x1800b0b07
cmp dword [rsp + 0xf8], 0x10000
je 0x1800b0ad5
mov rsi, qword [rsp + 0xe0]
sub rsi, rdi
jb 0x1800b0b07
cmp rsi, rbp
jae 0x1800b0aa0
jmp 0x1800b0b07
test rsi, rsi
je 0x1800b0b07
mov edx, 0x1000
mov rcx, rsi
mov r8d, 0x3000
mov r9d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x1800b0a55
mov qword [rsp + 0x40], r13
jmp 0x1800b0bf0
lea r15, [rsp + 0xd8]
mov r12, qword [sym.imp.KERNEL32.dll_VirtualQuery]
mov r14, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, qword [rsp + 0x38]
cmp rbx, rdi
jb 0x1800b0f81
mov esi, dword [rsp + 0xd0]
mov rax, rdi
shr rax, 0x20
je 0x1800b0b45
mov rax, rdi
xor edx, edx
div rsi
jmp 0x1800b0b4b
mov eax, edi
xor edx, edx
div esi
add rdi, rsi
sub rdi, rdx
cmp rdi, rbx
ja 0x1800b0f81
lea ebp, [rsi - 1]
jmp 0x1800b0b74
mov rax, rdi
xor edx, edx
div rsi
sub rdi, rdx
cmp rdi, rbx
ja 0x1800b0f81
mov r8d, Ordinal_50
mov rcx, rdi
mov rdx, r15
call r12
test rax, rax
je 0x1800b0f81
cmp dword [rsp + 0xf8], 0x10000
je 0x1800b0bbd
mov rdi, qword [rsp + 0xd8]
add rdi, rbp
add rdi, qword [rsp + 0xf0]
mov rax, rdi
shr rax, 0x20
jne 0x1800b0b60
mov eax, edi
xor edx, edx
div esi
jmp 0x1800b0b68
test rdi, rdi
je 0x1800b0f81
mov edx, 0x1000
mov rcx, rdi
mov r8d, 0x3000
mov r9d, 0x40
call r14
test rax, rax
je 0x1800b0b22
mov qword [rsp + 0x40], r13
mov r12, qword [rsp + 0x50]
lea rcx, [rax + 0x40]
mov dword [rax + 0x10], 0
mov qword [rax + 0x40], 0
lea rdx, [rax + 0x80]
mov qword [rax + 0x80], rcx
lea rcx, [rax + 0xc0]
mov qword [rax + 0xc0], rdx
lea rdx, [rax + 0x100]
mov qword [rax + 0x100], rcx
lea rcx, [rax + 0x140]
mov qword [rax + 0x140], rdx
lea rdx, [rax + 0x180]
mov qword [rax + 0x180], rcx
lea rcx, [rax + 0x1c0]
mov qword [rax + 0x1c0], rdx
lea rdx, [rax + 0x200]
mov qword [rax + 0x200], rcx
lea rcx, [rax + 0x240]
mov qword [rax + 0x240], rdx
lea rdx, [rax + 0x280]
mov qword [rax + 0x280], rcx
lea rcx, [rax + 0x2c0]
mov qword [rax + 0x2c0], rdx
lea rdx, [rax + 0x300]
mov qword [rax + 0x300], rcx
lea rcx, [rax + 0x340]
mov qword [rax + 0x340], rdx
lea rdx, [rax + 0x380]
mov qword [rax + 0x380], rcx
lea rcx, [rax + 0x3c0]
mov qword [rax + 0x3c0], rdx
lea rdx, [rax + 0x400]
mov qword [rax + 0x400], rcx
lea rcx, [rax + 0x440]
mov qword [rax + 0x440], rdx
lea rdx, [rax + 0x480]
mov qword [rax + 0x480], rcx
lea rcx, [rax + 0x4c0]
mov qword [rax + 0x4c0], rdx
lea rdx, [rax + 0x500]
mov qword [rax + 0x500], rcx
lea rcx, [rax + 0x540]
mov qword [rax + 0x540], rdx
lea rdx, [rax + 0x580]
mov qword [rax + 0x580], rcx
lea rcx, [rax + 0x5c0]
mov qword [rax + 0x5c0], rdx
lea rdx, [rax + 0x600]
mov qword [rax + 0x600], rcx
lea rcx, [rax + 0x640]
mov qword [rax + 0x640], rdx
lea rdx, [rax + 0x680]
mov qword [rax + 0x680], rcx
lea rcx, [rax + 0x6c0]
mov qword [rax + 0x6c0], rdx
lea rdx, [rax + 0x700]
mov qword [rax + 0x700], rcx
lea rcx, [rax + 0x740]
mov qword [rax + 0x740], rdx
lea rdx, [rax + 0x780]
mov qword [rax + 0x780], rcx
lea rcx, [rax + 0x7c0]
mov qword [rax + 0x7c0], rdx
lea rdx, [rax + 0x800]
mov qword [rax + 0x800], rcx
lea rcx, [rax + 0x840]
mov qword [rax + 0x840], rdx
lea rdx, [rax + 0x880]
mov qword [rax + 0x880], rcx
lea rcx, [rax + 0x8c0]
mov qword [rax + 0x8c0], rdx
lea rdx, [rax + 0x900]
mov qword [rax + 0x900], rcx
lea rcx, [rax + 0x940]
mov qword [rax + 0x940], rdx
lea rdx, [rax + 0x980]
mov qword [rax + 0x980], rcx
lea rcx, [rax + 0x9c0]
mov qword [rax + 0x9c0], rdx
lea rdx, [rax + 0xa00]
mov qword [rax + 0xa00], rcx
lea rcx, [rax + 0xa40]
mov qword [rax + 0xa40], rdx
lea rdx, [rax + 0xa80]
mov qword [rax + 0xa80], rcx
lea rcx, [rax + 0xac0]
mov qword [rax + 0xac0], rdx
lea rdx, [rax + 0xb00]
mov qword [rax + 0xb00], rcx
lea rcx, [rax + 0xb40]
mov qword [rax + 0xb40], rdx
lea rdx, [rax + 0xb80]
mov qword [rax + 0xb80], rcx
lea rcx, [rax + 0xbc0]
mov qword [rax + 0xbc0], rdx
lea rdx, [rax + 0xc00]
mov qword [rax + 0xc00], rcx
lea rcx, [rax + 0xc40]
mov qword [rax + 0xc40], rdx
lea rdx, [rax + 0xc80]
mov qword [rax + 0xc80], rcx
lea rcx, [rax + 0xcc0]
mov qword [rax + 0xcc0], rdx
lea rdx, [rax + 0xd00]
mov qword [rax + 0xd00], rcx
lea rcx, [rax + 0xd40]
mov qword [rax + 0xd40], rdx
lea rdx, [rax + 0xd80]
mov qword [rax + 0xd80], rcx
lea rcx, [rax + 0xdc0]
mov qword [rax + 0xdc0], rdx
lea rdx, [rax + 0xe00]
mov qword [rax + 0xe00], rcx
lea rcx, [rax + 0xe40]
mov qword [rax + 0xe40], rdx
lea rdx, [rax + 0xe80]
mov qword [rax + 0xe80], rcx
lea rcx, [rax + 0xec0]
mov qword [rax + 0xec0], rdx
lea rdx, [rax + 0xf00]
mov qword [rax + 0xf00], rcx
lea rcx, [rax + 0xf40]
mov qword [rax + 0xf40], rdx
lea rdx, [rax + 0xf80]
mov qword [rax + 0xf80], rcx
lea rcx, [rax + 0xfc0]
mov qword [rax + 0xfc0], rdx
mov qword [rax + 8], rcx
mov rcx, qword [0x1801eae18]
mov qword [rax], rcx
mov qword [0x1801eae18], rax
jmp 0x1800af892
mov esi, 9
xor eax, eax
xchg dword [0x1801eae20], eax
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.1800da5d0
mov eax, esi
add rsp, 0x128
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r13b, 1
cmp r9b, 4
ja 0x1800b1018
movzx edx, r9b
mov r12, qword [rsp + 0xd8]
lea rax, [r12 + rdx]
movzx ecx, byte [r12 + rdx]
test ecx, ecx
mov r15, qword [rsp + 0x40]
je 0x1800b0fef
cmp ecx, 0xcc
je 0x1800b0fef
cmp ecx, 0x90
jne 0x1800b116e
mov ebx, 5
sub ebx, edx
cmp ebx, 2
jb 0x1800b1013
mov ebx, ebx
mov esi, 1
cmp byte [rax + rsi], cl
jne 0x1800b116e
inc rsi
cmp rbx, rsi
jne 0x1800b1002
xor r12d, r12d
jmp 0x1800b1020
xor r12d, r12d
mov r15, qword [rsp + 0x40]
mov qword [rsp + 0x86], rdi
movzx eax, r14b
mov rdx, qword [rsp + 0x30]
lea rbx, [rdx + rax]
mov qword [rsp + 0xf0], rbx
mov qword [rdx + rax + 6], rdi
mov rcx, qword [rsp + 0x80]
mov qword [rdx + rax], rcx
mov rax, qword [0x1801eae30]
test rax, rax
je 0x1800b109d
mov ecx, dword [0x1801eae38]
cmp dword [0x1801eae40], ecx
mov rsi, qword [rsp + 0x38]
jb 0x1800b10d1
add ecx, ecx
imul r9, rcx, 0x38
mov rcx, qword [0x1801eae28]
xor edx, edx
mov r8, rax
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
test rax, rax
je 0x1800b12aa
shl dword [0x1801eae38], 1
mov qword [0x1801eae30], rax
jmp 0x1800b10d1
mov dword [0x1801eae38], 0x20
mov rcx, qword [0x1801eae28]
mov r8d, 0x700
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [0x1801eae30], rax
test rax, rax
mov rsi, qword [rsp + 0x38]
je 0x1800b12aa
mov ecx, dword [0x1801eae40]
lea edx, [rcx + 1]
mov dword [0x1801eae40], edx
imul rcx, rcx, 0x38
mov rdx, qword [rsp + 0xd8]
mov qword [rax + rcx], rdx
mov qword [rax + rcx + 8], rbx
mov rdx, qword [rsp + 0x30]
mov qword [rax + rcx + 0x10], rdx
movzx edx, byte [rax + rcx + 0x20]
and dl, 0xf8
or dl, r12b
mov byte [rax + rcx + 0x20], dl
mov edx, dword [rax + rcx + 0x24]
mov rbp, qword [rsp + 0x48]
and ebp, 0xf
and edx, 0xfffffff0
or edx, ebp
mov dword [rax + rcx + 0x24], edx
mov rdx, qword [rsp + 0x100]
mov qword [rax + rcx + 0x28], rdx
mov rdx, qword [rsp + 0x108]
mov qword [rax + rcx + 0x30], rdx
add rax, rcx
add rax, 0x18
test r13b, r13b
je 0x1800b1154
movzx ecx, byte [rsi + 4]
mov byte [rax + 4], cl
mov ecx, dword [rsi]
jmp 0x1800b115d
mov ecx, dword [rsi - 5]
mov edx, dword [rsi - 2]
mov dword [rax + 3], edx
mov dword [rax], ecx
mov rax, qword [rsp + 0x30]
mov qword [r15], rax
xor esi, esi
jmp 0x1800b0f86
cmp r9b, 1
ja 0x1800b11b0
test ecx, ecx
je 0x1800b118c
cmp ecx, 0xcc
je 0x1800b118c
cmp ecx, 0x90
jne 0x1800b1233
mov ebx, 2
sub ebx, edx
cmp ebx, 2
jb 0x1800b11b0
mov edx, ebx
mov ebx, 1
cmp byte [rax + rbx], cl
jne 0x1800b1233
inc rbx
cmp rdx, rbx
jne 0x1800b119f
lea rsi, [r12 - 5]
lea rdx, [rsp + 0xa8]
mov r8d, Ordinal_50
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
cmp dword [rsp + 0xc8], 0x1000
jne 0x1800b1233
mov eax, 0xf0
and eax, dword [rsp + 0xcc]
je 0x1800b1233
movzx eax, byte [rsi]
test eax, eax
je 0x1800b11fc
cmp eax, 0xcc
je 0x1800b11fc
cmp eax, 0x90
jne 0x1800b1233
cmp byte [r12 - 4], al
jne 0x1800b1233
cmp byte [r12 - 3], al
jne 0x1800b1233
cmp byte [r12 - 2], al
jne 0x1800b1233
cmp byte [r12 - 1], al
jne 0x1800b1233
mov dword [rsp + 0xf8], 1
mov r12b, 1
xor r13d, r13d
mov rdi, qword [rsp + 0x50]
jmp 0x1800b1020
mov esi, 8
mov rdx, qword [rsp + 0x30]
and rdx, 0xfffffffffffff000
lea rbp, [0x1801eae18]
xor ecx, ecx
nop dword [rax]
mov rax, rcx
mov rcx, qword [rbp]
test rcx, rcx
je 0x1800b0f86
mov rbp, rcx
cmp rdx, rcx
jne 0x1800b1250
mov rdx, qword [rcx + 8]
mov rbp, qword [rsp + 0x30]
mov qword [rbp], rdx
mov qword [rcx + 8], rbp
dec dword [rcx + 0x10]
jne 0x1800b0f86
test rax, rax
mov rdx, qword [rcx]
lea rbp, [0x1801eae18]
cmovne rbp, rax
mov qword [rbp], rdx
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x1800b0f86
mov esi, 9
jmp 0x1800b1238