Function at 0x1401a3470
Capabilities:
Enumerate pe sections
Get local ipv4 addresses
Get socket information

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2a8
mov qword [rsp + 0x70], r9
mov rdi, r8
mov qword [rsp + 0x80], rdx
mov qword [rsp + 0x78], rcx
mov rax, qword [0x1402121d0]
cmp rax, 2
jne 0x1401a3d9a
movzx eax, byte [0x1402121d9]
test al, al
je 0x1401a3dae
mov qword [rsp + 0x68], rdi
lea rdx, [0x141ab2848]
lea rcx, [rsp + 0xa0]
mov r8d, 0xb
call fcn.1401578f0
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x48], rax
test rax, rax
je 0x1401a3fe2
mov rdi, qword [rsp + 0xa8]
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x90], rax
cmp rdi, rax
je 0x1401a3fda
xor edx, edx
jmp 0x1401a3562
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, rbx
call sub.KERNEL32.dll_HeapFree
dec r15
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, r15
call sub.KERNEL32.dll_HeapFree
mov rdx, r14
nop word [rax + rax]
add rdi, 0x20
cmp rdi, qword [rsp + 0x90]
je 0x1401a3fda
movzx ebx, word [rdi]
cmp bx, 2
je 0x1401a3fda
mov r15, rdx
mov r12d, dword [rdi + 2]
movzx ebp, word [rdi + 6]
mov esi, dword [rdi + 8]
mov rax, qword [rdi + 0xc]
mov qword [rsp + 0x98], rax
mov eax, dword [rdi + 0x14]
mov dword [rsp + 0x38], eax
mov r13d, dword [rdi + 0x18]
movzx r14d, word [rdi + 0x1c]
mov rax, qword [0x141af8100]
cmp rax, 3
jne 0x1401a35bd
mov ecx, ebx
call fcn.140157f70
test rax, rax
je 0x1401a35d0
test r15, r15
jne 0x1401a36c8
jmp 0x1401a3550
call fcn.140156380
mov ecx, ebx
call fcn.140157f70
test rax, rax
jne 0x1401a35b2
nop
shl rbp, 0x20
or rbp, r12
test bx, bx
mov r9d, dword [rsp + 0x44]
je 0x1401a3611
movabs rax, 0xffffffff0000
and rbp, rax
shr rbp, 0x10
mov r8d, 0x1c
mov cx, 0x17
mov rbx, qword [rsp + 0x98]
mov r9d, r13d
mov rax, rbp
mov r10d, dword [rsp + 0x38]
jmp 0x1401a3631
mov r14, rbp
shr r14, 0x20
mov r8d, 0x10
mov cx, 2
xor eax, eax
xor esi, esi
mov r10d, ebp
mov rbx, qword [rsp + 0x88]
rol r14w, 8
mov word [rsp + 0xa0], cx
mov word [rsp + 0xa2], r14w
mov dword [rsp + 0xa4], r10d
shl rsi, 0x20
or rsi, rax
mov qword [rsp + 0xa8], rsi
mov qword [rsp + 0xb0], rbx
mov dword [rsp + 0x44], r9d
mov dword [rsp + 0xb8], r9d
mov rcx, rdx
mov rsi, rdx
lea rdx, [rsp + 0xa0]
call sub.ws2_32.dll_bind
cmp eax, 0xffffffff
je 0x1401a369d
mov rcx, rsi
mov edx, pe_nt_image_headers64
call sub.ws2_32.dll_listen
cmp eax, 0xffffffff
jne 0x1401a371c
mov qword [rsp + 0x88], rbx
call sub.ws2_32.dll_WSAGetLastError
mov ebx, eax
shl rbx, 0x20
or rbx, 2
mov rcx, rsi
call sub.ws2_32.dll_closesocket
mov rdx, rbx
test r15, r15
je 0x1401a3550
mov eax, r15d
and eax, 3
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x1401a3550
test rax, rax
je 0x1401a3550
mov r14, rdx
mov rbx, qword [r15 - 1]
mov rsi, qword [r15 + 7]
mov rax, qword [rsi]
test rax, rax
je 0x1401a36fd
mov rcx, rbx
call rax
cmp qword [rsi + 8], 0
je 0x1401a3530
cmp qword [rsi + 0x10], 0x11
jb 0x1401a351f
mov rbx, qword [rbx - 8]
jmp 0x1401a351f
mov rdi, rsi
cmp qword [rsp + 0x50], 0
je 0x1401a373a
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, qword [rsp + 0x48]
call sub.KERNEL32.dll_HeapFree
test r15, r15
je 0x1401a37a0
mov eax, r15d
and eax, 3
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x1401a37a0
test rax, rax
je 0x1401a37a0
mov rbx, qword [r15 - 1]
mov rsi, qword [r15 + 7]
mov rax, qword [rsi]
test rax, rax
je 0x1401a3769
mov rcx, rbx
call rax
dec r15
cmp qword [rsi + 8], 0
je 0x1401a378f
cmp qword [rsi + 0x10], 0x11
jb 0x1401a377e
mov rbx, qword [rbx - 8]
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, rbx
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, r15
call sub.KERNEL32.dll_HeapFree
xorps xmm0, xmm0
movaps xmmword [rsp + 0x110], xmm0
movaps xmmword [rsp + 0x100], xmm0
movaps xmmword [rsp + 0xf0], xmm0
movaps xmmword [rsp + 0xe0], xmm0
movaps xmmword [rsp + 0xd0], xmm0
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xa0], xmm0
mov dword [rsp + 0x1a8], pe_nt_image_headers64
lea rdx, [rsp + 0xa0]
lea r8, [rsp + 0x1a8]
mov rcx, rdi
call sub.ws2_32.dll_getsockname
cmp eax, 0xffffffff
je 0x1401a3ff9
mov eax, dword [rsp + 0x1a8]
movzx ecx, word [rsp + 0xa0]
cmp ecx, 0x17
je 0x1401a3836
cmp ecx, 2
jne 0x1401a3fe2
cmp eax, 0xf
ja 0x1401a383f
jmp 0x1401a3fe2
cmp eax, 0x1b
jbe 0x1401a3fe2
movzx eax, word [rsp + 0xa2]
rol ax, 8
mov word [rsp + 0x2e], ax
movzx eax, byte [0x141af8129]
mov edx, 0x18
xor ecx, ecx
call fcn.140146820
test rax, rax
je 0x1401a3fe2
mov r15, rax
mov qword [rax], 1
mov qword [rax + 8], 1
mov byte [rax + 0x10], 0
lock inc qword [rax]
jle 0x1401a3fe2
mov r13, qword [0x141af8120]
test r13, r13
je 0x1401a38a0
dec r13
jmp 0x1401a3932
lea rdx, [0x141ab355d]
lea rcx, [rsp + 0xa0]
mov r8d, 0xe
call fcn.140149e80
mov rsi, qword [rsp + 0xa0]
movabs rax, 0x8000000000000001
dec rax
cmp rsi, rax
jne 0x1401a38dc
mov r13d, 0x200000
jmp 0x1401a3927
mov rbp, qword [rsp + 0xa8]
mov r8, qword [rsp + 0xb0]
lea rcx, [rsp + 0x1a8]
mov rdx, rbp
call fcn.1400412c0
cmp qword [rsp + 0x1a8], 0
je 0x1401a3f0c
mov r13d, 0x200000
test rsi, rsi
je 0x1401a3927
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, rbp
call sub.KERNEL32.dll_HeapFree
lea rax, [r13 + 1]
mov qword [0x141af8120], rax
movzx eax, byte [0x141af8129]
mov edx, 0x38
xor ecx, ecx
call fcn.140146820
test rax, rax
je 0x1401a3fe2
mov rbp, rax
mov qword [rax], 1
mov qword [rax + 8], 1
mov qword [rax + 0x10], 2
mov rax, qword [0x141af8080]
nop
mov rcx, rax
inc rcx
je 0x1401a3fe2
lock cmpxchg qword [0x141af8080], rcx
jne 0x1401a3970
mov qword [rbp + 0x28], rcx
mov byte [rbp + 0x30], 0
lock inc qword [rbp]
jle 0x1401a3fe2
movzx eax, byte [0x141af8129]
mov edx, 0x30
xor ecx, ecx
call fcn.140146820
test rax, rax
je 0x1401a3fe2
mov rbx, rax
mov qword [rax], 1
mov qword [rax + 8], 1
xorps xmm0, xmm0
movups xmmword [rax + 0x10], xmm0
mov qword [rsp + 0xa0], rax
lock inc qword [rax]
jle 0x1401a3fe2
movzx eax, byte [0x141af8088]
test al, al
je 0x1401a3a3c
mov byte [0x141af8088], 1
call fcn.140146480
test rax, rax
je 0x1401a3fe2
mov r14, qword [rax]
mov qword [rax], 0
test r14, r14
je 0x1401a3a3c
lock inc qword [r14]
jle 0x1401a3fe2
mov byte [0x141af8088], 1
call fcn.140146480
test rax, rax
je 0x1401a4031
mov rcx, qword [rax]
mov qword [rax], r14
test rcx, rcx
jne 0x1401a3a72
jmp 0x1401a3a7d
movzx eax, byte [0x141af8088]
test al, al
je 0x1401a3d7d
mov byte [0x141af8088], 1
call fcn.140146480
test rax, rax
je 0x1401a3fe2
mov rcx, qword [rax]
mov qword [rax], 0
xor r14d, r14d
test rcx, rcx
je 0x1401a3a7d
lock dec qword [rcx]
jne 0x1401a3a7d
call fcn.140068bf0
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x1401a3a99
lock inc qword [rcx + 0x18]
jle 0x1401a4024
movzx eax, byte [0x141af8129]
mov edx, 0x30
xor ecx, ecx
call fcn.140146820
test rax, rax
je 0x1401a3fe2
mov qword [rax], rbp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r15
lea rcx, [0x14019fab0]
mov qword [rax + 0x28], rcx
lea r8, [0x141ab3538]
mov rcx, r13
mov rdx, rax
call fcn.14014b320
test rax, rax
jne 0x1401a4000
mov qword [rsp + 0xa0], rbp
mov qword [rsp + 0xa8], rsi
mov qword [rsp + 0xb0], rdx
mov rcx, rdx
call sub.KERNEL32.dll_CloseHandle
lock dec qword [rbp]
jne 0x1401a3b22
mov rcx, qword [rsp + 0xa0]
call fcn.1401667a0
mov qword [rsp + 0x38], r15
mov rax, qword [rsp + 0xa8]
lock dec qword [rax]
jne 0x1401a3b42
lea rcx, [rsp + 0xa8]
call fcn.14019aae0
lea rsi, [rsp + 0x2e]
lea rdi, [0x140040b60]
lea rbp, [0x141ab2838]
lea r12, [rsp + 0x58]
lea r15, [rsp + 0x1a8]
lea r13, [rsp + 0xa0]
jmp 0x1401a3b9a
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, r14
call sub.KERNEL32.dll_HeapFree
dec rbx
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, rbx
call sub.KERNEL32.dll_HeapFree
lea rsi, [rsp + 0x2e]
lea r14, [rsp + 0x30]
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0xa0], rbp
mov qword [rsp + 0xa8], 1
mov qword [rsp + 0xc0], 0
add byte [rax], al
add byte [rax], al
add byte [rcx + rcx*4 - 0x5c], cl
and al, 0xb0
add byte [rax], al
add byte [rax - 0x39], cl
test byte [rax + rdi*4], ah
add byte [rax], al
add byte [rcx], al
add byte [rax], al
add byte [rcx + rcx*4 - 7], cl
mov rdx, r13
call fcn.140034eb0
mov rcx, r15
call fcn.1401ac1b0
cmp rax, 1
jne 0x1401a3cc9
mov qword [rsp + 0x30], rdx
mov rcx, rdx
call fcn.140149740
cmp al, 2
jne 0x1401a3c20
xor ecx, ecx
mov edx, 0x5f5e100
cmc
add eax, 0xfa7d89e8
invalid
jmp case.0x14019f7bc.263
mov qword [rsp + 0x58], r14
lea rax, [fcn.140157450]
mov qword [rsp + 0x60], rax
lea rax, [0x141ab2878]
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], 2
test al, 0
add byte [rax], al
add al, byte [rax]
add byte [rax], al
mov qword [rsp + 0xc0], 0
mov qword [rsp + 0xb0], r12
mov qword [rsp + 0xb8], 1
mov rcx, r13
call fcn.14014c060
mov rbx, qword [rsp + 0x30]
mov eax, ebx
and eax, 3
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x1401a3b9f
test rax, rax
je 0x1401a3b9f
mov r14, qword [rbx - 1]
mov rsi, qword [rbx + 7]
mov rax, qword [rsi]
test rax, rax
je 0x1401a3caa
mov rcx, r14
call rax
cmp qword [rsi + 8], 0
je 0x1401a3b81
cmp qword [rsi + 0x10], 0x11
jb 0x1401a3b70
mov r14, qword [r14 - 8]
jmp 0x1401a3b70
mov rcx, rdx
call sub.ws2_32.dll_closesocket
movzx esi, word [rsp + 0x2e]
and al, 0x2e
lea rcx, [rsp + 0xa0]
call fcn.1401a80f0
movzx eax, byte [0x141af8129]
mov edx, 0x20
xor ecx, ecx
call fcn.140146820
cli
dec dword [rax - 0x7b]
invalid
je 0x1401a3fe2
mov rbx, rax
mov qword [rax], 1
add byte [rax - 0x39], cl
or byte [rcx], al
or byte [rcx], al
add byte [rax], al
add byte [rax - 0x75], cl
and al, 0x38
mov qword [rbx + 0x10], rax
mov word [rbx + 0x18], si
mov rax, qword [rsp + 0x178]
lock dec qword [rax]
mov rdi, qword [rsp + 0x68]
jne 0x1401a3d46
mov rcx, qword [rsp + 0x178]
mov rdx, qword [rsp + 0x180]
and al, 0x80
add dword [rax], eax
add al, ch
sbb ch, byte [rcx - 1]
invalid
mov qword [rsp + 0x178], rbx
lea rax, [0x141ab3080]
nop
invalid
mov qword [rsp + 0x180], rax
lea rbx, [rsp + 0x1a8]
lea rdx, [rsp + 0xa0]
mov r8d, 0x100
mov rcx, rbx
call sub.msvcrt.dll_memcpy
jmp 0x1401a3dbe
xor r14d, r14d
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsi + 0x10]
test rcx, rcx
jne 0x1401a3a8e
jmp 0x1401a3a99
call fcn.14019b180
movzx eax, byte [0x1402121d9]
test al, al
jne 0x1401a34b8
invalid
invalid
lea rbx, [rsp + 0xa0]
mov rcx, rbx
call fcn.1401a80f0
mov rcx, rbx
call fcn.1401a6de0
mov rbx, rax
mov r15, rdx
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rdx
lock inc qword [rax]
inc qword [rax]
jle 0x1401a3fe2
lock inc qword [r15]
jle 0x1401a3fe2
mov r14d, 1
test rdi, rdi
je 0x1401a3e22
js 0x1401a3fe2
movzx eax, byte [0x141af8129]
xor ecx, ecx
mov rdx, rdi
call fcn.140146820
mov r12, rax
mov rsi, rdi
test rax, rax
jne 0x1401a3e2a
jmp 0x1401a3fe2
xor esi, esi
mov r12d, 1
mov r13, qword [rsp + 0x310]
mov rcx, r12
mov rdx, qword [rsp + 0x80]
xchg esp, eax
and al, 0x80
add byte [rax], al
invalid
mov rbp, rdi
mov r8, rdi
call sub.msvcrt.dll_memcpy
test r13, r13
je 0x1401a3e74
js 0x1401a3fe2
movzx eax, byte [0x141af8129]
xor ecx, ecx
mov rdx, r13
call fcn.140146820
mov esp, 0x49fffa29
mov esi, eax
mov rdi, r13
test rax, rax
jne 0x1401a3e76
jmp 0x1401a3fe2
xor edi, edi
mov rcx, r14
mov rdx, qword [rsp + 0x70]
mov r8, r13
call sub.msvcrt.dll_memcpy
mov rax, qword [rsp + 0x78]
mov qword [rax + 0x58], rbx
mov qword [rax + 0x60], r15
mov dword [rax + 0x60], edi
mov qword [rax], rsi
mov qword [rax + 8], r12
mov dword [rax + 8], esp
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
mov qword [rax + 0x28], r13
mov qword [rax + 0x30], 0
add byte [rax - 0x39], cl
cmp byte [rax], cl
add byte [rax], al
add byte [rax - 0x39], cl
add byte [rax], al
add byte [rax], al
mov dword [rax + 0x50], 0x3b9aca00
lock dec qword [rbx]
jne 0x1401a3edc
lea rcx, [rsp + 0xa0]
call fcn.14019a710
mov rax, qword [rsp + 0xa8]
lock dec qword [rax]
jne 0x1401a3ef7
lea rcx, [rsp + 0xa8]
call fcn.14019ad20
nop
add rsp, 0x2a8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r8, qword [rsp + 0x1b8]
test r8, r8
je 0x1401a390b
mov rcx, qword [rsp + 0x1b0]
cmp r8, 1
jne 0x1401a3f48
movzx eax, byte [rcx]
cmp eax, 0x2b
je 0x1401a390b
mov r8d, 1
cmp eax, 0x2d
je 0x1401a390b
test ch, al
stc
invalid
invalid
jmp 0x1401a3fa7
cmp byte [rcx], 0x2b
jne 0x1401a3fa1
inc rcx
lea rax, [r8 - 1]
cmp r8, 0x12
mov r8, rax
jb 0x1401a3fa7
xor r9d, r9d
mov r10d, 0xa
xor r13d, r13d
mov rax, r13
mul r10
jo 0x1401a390b
mov r13, rax
movzx eax, byte [rcx + r9]
add eax, 0xffffffd0
cmp eax, 9
ja 0x1401a390b
mov eax, eax
add r13, rax
jb 0x1401a390b
inc r9
cmp r8, r9
jne 0x1401a3f69
jmp 0x1401a3911
cmp r8, 0x11
jae 0x1401a3f5d
xor eax, eax
xor r13d, r13d
movzx edx, byte [rcx + rax]
add edx, 0xffffffd0
cmp edx, 9
ja 0x1401a390b
lea r9, [r13*4]
add r9, r13
mov edx, edx
lea r13, [rdx + r9*2]
inc rax
cmp r8, rax
jne 0x1401a3fac
jmp 0x1401a3911
cmp qword [rsp + 0x50], 0
jne 0x1401a3fe4
ud2
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, qword [rsp + 0x48]
call sub.KERNEL32.dll_HeapFree
ud2
call sub.ws2_32.dll_WSAGetLastError
ud2
lock dec qword [rsi]
jne 0x1401a4013
lea rcx, [rsp + 0xa0]
call fcn.14019aae0
lock dec qword [rbp]
jne 0x1401a3fe2
mov rcx, rbp
call fcn.1401667a0
ud2
add rcx, 0x10
xor edx, edx
call case.0x140154ee5.334
ud2
lock dec qword [r14]
jne 0x1401a3fe2
mov rcx, r14
call fcn.140068bf0
ud2