Function at 0x1400fe510
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call
Parse pe header
Query environment variable
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov rax, qword [0x14021a800]
xor rax, rsp
mov qword [rbp + 0x30], rax
mov qword [rbp - 0x40], rdx
mov qword [rbp - 0x48], rcx
xor r14d, r14d
mov esi, r14d
mov qword [rbp - 0x80], r14
mov dword [rbp - 0x18], r14d
lea r9, [rbp - 0x18]
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x1400fe5bb
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp - 0x18]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
lea r9, [rbp - 0x18]
mov r8d, dword [rbp - 0x18]
mov rdx, rax
mov ecx, listen
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x1400fe571
mov qword [rbp - 0x80], rsi
test eax, eax
js 0x140100b13
mov eax, r14d
mov dword [rsp + 0x2c], eax
cmp dword [rsi], r14d
jbe 0x140100b13
movzx edi, byte [rsp + 0x28]
movzx ebx, byte [rsp + 0x28]
movzx r15d, byte [rsp + 0x28]
mov qword [rsp + 0x20], r15
movzx r13d, byte [rsp + 0x28]
movzx r12d, byte [rsp + 0x28]
nop dword [rax]
nop dword [rax + rax]
imul rcx, rax, 0x128
lea rax, [rcx + rsi]
mov qword [rbp - 0x50], rax
movzx eax, word [rax + 0x2e]
add rax, rcx
add rsi, rax
movzx edx, dil
lea rcx, [rbp + 0x10]
call fcn.140002620
nop
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rsi + r8 + 0x30], 0
jne 0x1400fe630
lea rdx, [rsi + 0x30]
lea rcx, [rbp + 0x10]
call fcn.140004030
nop
lea rcx, [rbp + 0x10]
call fcn.1400018f0
mov rdx, qword [rbp - 0x48]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x140100af4
mov rdx, qword [rbp - 0x50]
add rdx, 0x30
lea rcx, [rbp - 0x10]
call fcn.140003ea0
nop
mov dword [rsp + 0x58], 0x87858483
mov dword [rsp + 0x5c], 0x94889c95
mov word [rsp + 0x60], 0x8997
mov byte [rsp + 0x62], 0x62
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x63], xmm0
mov qword [rsp + 0x73], rax
nop dword [rax]
nop dword [rax + rax]
mov rax, qword [0x140220a80]
mov r9, qword [0x140220a78]
nop
cmp r14, 0x23
jae 0x1400ff321
movzx r10d, byte [rsp + r14 + 0x58]
movzx r11d, r10b
cmp rax, r14
ja 0x1400ff318
lea rcx, [r9 + 1]
cmp rax, rcx
jae 0x1400fe70e
movabs rdx, 0x4a045e8bdfa78eb2
add rdx, r14
mov rcx, rdx
and rcx, r10
imul r15, rcx, 0xfffffffffffffffe
add r15, rdx
add r15, r10
add r15b, 0x22
mov qword [rsp + 0x20], r15
jmp 0x1400fe747
je 0x1400ff281
inc rcx
cmp rax, rcx
je 0x1400ff1e3
lea rcx, [r9 + 5]
cmp rax, rcx
je 0x1400ff19c
lea rcx, [r9 + 3]
cmp rax, rcx
je 0x1400ff16b
lea rcx, [r9 + 8]
cmp rax, rcx
je 0x1400ff114
movzx r11d, r10b
nop dword [rax + rax]
mov r8, rax
cmp r9, r14
ja 0x1400ff30f
lea rcx, [r9 + 0x80]
cmp rax, rcx
jae 0x1400fe78d
movabs rdx, 0x125bc17958beb49a
add rdx, r14
movzx eax, dl
and al, r10b
add al, al
movzx r15d, r10b
sub r15b, al
sub r15b, 0x36
add r15b, dl
jmp 0x1400fe7db
lea rdx, [r9 + 1]
cmp rax, rdx
je 0x1400ff0f2
lea rcx, [r9 + 3]
cmp rax, rcx
je 0x1400ff0a8
lea rcx, [r9 + 4]
cmp rax, rcx
je 0x1400ff083
lea rcx, [r9 + 5]
cmp rax, rcx
je 0x1400ff054
lea rcx, [r9 + 7]
cmp rax, rcx
je 0x1400ff030
lea rcx, [rdx + 1]
cmp rax, rcx
je 0x1400ff00b
nop dword [rax + rax]
lea rax, [r9 + r8]
cmp rax, r14
jbe 0x1400fecce
mov rax, r8
lea rcx, [r9 + 4]
cmp rax, rcx
je 0x1400fecb3
lea rcx, [r9 + 0x10]
cmp rax, rcx
je 0x1400fec88
lea rcx, [r9 + 8]
cmp rax, rcx
je 0x1400fec5b
lea rcx, [r9 + 0x40]
cmp rax, rcx
je 0x1400fec3b
lea rcx, [r9 + 0x80]
cmp rax, rcx
je 0x1400fec1a
lea rcx, [r9 + 0x400]
cmp rax, rcx
je 0x1400febf6
lea rcx, [r9 + 0x2a]
cmp rax, rcx
je 0x1400febda
lea rcx, [r9 + 0x7a]
cmp rax, rcx
je 0x1400fe7f0
lea rax, [r9 + 0x200]
lea r9, [rax + 3]
lea rcx, [r9 + 0x42]
cmp rax, rcx
jb 0x1400ff2e6
lea rcx, [r9 + 0x1000]
cmp rax, rcx
jb 0x1400ff2c1
lea rcx, [r9 + 0x200]
cmp rax, rcx
jb 0x1400fe981
lea rcx, [r9 + 0x41]
cmp rax, rcx
jb 0x1400fe952
lea rcx, [r9 + 1]
cmp rax, rcx
jb 0x1400feb83
lea rcx, [r9 + 8]
cmp rax, rcx
jb 0x1400feb2f
lea rcx, [r9 + 4]
cmp rax, rcx
jb 0x1400feae5
lea rcx, [r9 + 0x10]
cmp rax, rcx
jb 0x1400feabc
lea rax, [r9 + 2]
lea r9, [rax + 0x40]
lea rcx, [r9 + 0x5a]
cmp rax, rcx
ja 0x1400feaa0
lea rcx, [r9 + 5]
cmp rax, rcx
ja 0x1400fea7c
lea rcx, [r9 + 2]
cmp rax, rcx
ja 0x1400fea61
lea rcx, [r9 + 9]
cmp rax, rcx
ja 0x1400fea40
lea rcx, [r9 + 0x20]
cmp rax, rcx
ja 0x1400fea25
lea rcx, [r9 + 0x200]
cmp rax, rcx
ja 0x1400fe9fd
lea rcx, [r9 + 0x42]
cmp rax, rcx
ja 0x1400fe9cd
lea rcx, [r9 + 0x1000]
cmp rax, rcx
ja 0x1400fe9b1
lea rax, [r9 + 0x28]
lea r9, [rax + 0x41]
jmp 0x1400fe7f0
movabs r8, 0x9c5698dab0ab5d42
add r8, r14
movzx ecx, r8b
and cl, r10b
mov edx, Ordinal_27
sub dl, cl
lea r15d, [rdx + rdx]
add r15b, r10b
add r15b, r8b
mov qword [rsp + 0x20], r15
jmp 0x1400fe750
movabs r8, 0x84ddbc2f15c3fde
add r8, r14
movzx ecx, r8b
and cl, r10b
add cl, cl
movzx edx, r10b
sub dl, cl
sub dl, 0x12
add dl, r8b
movzx r15d, dl
mov qword [rsp + 0x20], r15
jmp 0x1400fe6d4
lea r8d, [r14 - 0x30]
movzx ecx, r10b
and cl, r8b
mov edx, Ordinal_41
sub dl, cl
add dl, dl
add dl, r10b
jmp 0x1400ff137
lea r8d, [r14 + 0x6c]
movzx ecx, r10b
and cl, r8b
mov edx, 6
sub dl, cl
add dl, dl
add dl, r10b
add dl, r8b
mov qword [rsp + 0x20], rdx
inc r9
dec r14
mov r15, rdx
inc r14
jmp 0x1400fe6c0
lea edx, [r14 + 8]
movzx ecx, r10b
and cl, dl
add cl, cl
sub r10b, cl
sub dl, 0x38
add dl, r10b
mov qword [rsp + 0x20], rdx
dec r14
mov r15, rdx
inc r14
jmp 0x1400fe6c0
lea r8d, [r14 - 0x5c]
movzx ecx, r10b
and cl, r8b
add cl, cl
movzx edx, r10b
sub dl, cl
sub dl, 0x7c
jmp 0x1400ff0c7
lea edx, [r14 - 0x24]
movzx ecx, r10b
and cl, dl
add cl, cl
sub r10b, cl
lea r15d, [rdx + r10]
sub r15b, 4
mov qword [rsp + 0x20], r15
jmp 0x1400ff1ca
lea r8d, [r14 + 0x78]
movzx ecx, r10b
and cl, r8b
add cl, cl
movzx edx, r10b
sub dl, cl
sub dl, 0x48
jmp 0x1400ff206
lea r8d, [r14 + 0x14]
movzx ecx, r10b
and cl, r8b
mov edx, Ordinal_60
sub dl, cl
add dl, dl
add dl, r10b
add dl, r8b
mov qword [rsp + 0x20], rdx
jmp 0x1400ff239
lea r8d, [r14 - 0x50]
movzx ecx, r10b
and cl, r8b
mov edx, Ordinal_27
sub dl, cl
add dl, dl
add dl, r10b
jmp 0x1400ff2a1
lea edx, [r14 + 0x36]
movzx ecx, r10b
and cl, dl
add cl, cl
sub r10b, cl
lea r15d, [rdx + r10]
sub r15b, 0x7a
mov qword [rsp + 0x20], r15
mov byte [rsp + r14 + 0x58], r15b
inc r14
jmp 0x1400fe6c0
lea r8d, [r14 - 0x2e]
movzx ecx, r10b
and cl, r8b
mov edx, reloc.WLDAP32.dll_Ordinal_33
sub dl, cl
add dl, dl
add dl, r10b
add dl, r8b
movzx r15d, dl
mov qword [rsp + 0x20], r15
cmp r9, 0x41
jb 0x1400fead8
lea r8d, [r14 - 0x14]
movzx ecx, r10b
and cl, r8b
mov edx, 6
sub dl, cl
add dl, dl
add dl, r10b
add dl, r8b
add dl, dl
jmp 0x1400ff13a
lea r8d, [r14 + 0x6e]
movzx ecx, r10b
and cl, r8b
add cl, cl
movzx edx, r10b
sub dl, cl
sub dl, 2
add dl, r8b
movzx r15d, dl
mov qword [rsp + 0x20], r15
cmp rax, 0x40
jae 0x1400fefcd
lea rcx, [r9 + 0x5a]
cmp rax, rcx
jbe 0x1400fef08
lea r8d, [r14 + 4]
movzx ecx, r10b
and cl, r8b
add cl, cl
movzx edx, r10b
sub dl, cl
sub dl, 0x1c
jmp 0x1400feafc
lea r8d, [r14 + 0xa]
movzx ecx, r10b
and cl, r8b
add cl, cl
movzx r15d, r10b
sub r15b, cl
sub r15b, 0x46
add r15b, r8b
mov qword [rsp + 0x20], r15
lea rcx, [r9 + rax]
cmp rcx, 3
je 0x1400feff2
lea rcx, [r9 + 0x42]
cmp rax, rcx
jbe 0x1400fee16
lea r8d, [r14 + 0x6a]
movzx ecx, r10b
and cl, r8b
mov edx, reloc.WS2_32.dll_listen
sub dl, cl
add dl, dl
add dl, r10b
jmp 0x1400feb45
lea edx, [r14 - 0x64]
movzx ecx, r10b
and cl, dl
add cl, cl
sub r10b, cl
lea r15d, [rdx + r10]
sub r15b, 0x44
jmp 0x1400ff2a8
lea r8d, [r14 + 0x38]
movzx ecx, r10b
and cl, r8b
mov edx, reloc.WLDAP32.dll_Ordinal_60
sub dl, cl
add dl, dl
add dl, r10b
add dl, r8b
mov qword [rsp + 0x20], rdx
jmp 0x1400ff239
lea edx, [r14 + 0x70]
movzx ecx, r10b
and cl, dl
add cl, cl
sub r10b, cl
lea r15d, [rdx + r10]
sub r15b, 0x10
mov qword [rsp + 0x20], r15
jmp 0x1400ff1ca
movzx r11d, r14b
lea r8d, [r11 - 0x58]
movzx ecx, r10b
and cl, r8b
mov edx, 0x34
sub dl, cl
add dl, dl
add dl, r10b
jmp 0x1400ff0cb
lea r8d, [r14 + 0x44]
movzx ecx, r10b
and cl, r8b
mov edx, reloc.WS2_32.dll_select
sub dl, cl
add dl, dl
add dl, r10b
add dl, r8b
mov qword [rsp + 0x20], rdx
dec r14
mov r15, rdx
inc r14
jmp 0x1400fe6c0
lea edx, [r14 - 0x20]
movzx ecx, r10b
and cl, dl
add cl, cl
sub r10b, cl
sub dl, 0x20
add dl, r10b
mov qword [rsp + 0x20], rdx
inc r9
dec r14
mov r15, rdx
inc r14
jmp 0x1400fe6c0
lea r8d, [r14 + 0x7c]
movzx ecx, r10b
and cl, r8b
add cl, cl
movzx edx, r10b
sub dl, cl
sub dl, 0x64
jmp 0x1400ff137
lea rax, [r9 + 0x64]
cmp r8, rax
jae 0x1400fed08
movabs rdx, 0x4a045e8bdfa78eb2
add rdx, r14
movzx eax, dl
and al, r10b
mov ecx, reloc.WS2_32.dll_recvfrom
sub cl, al
lea r15d, [rcx + rcx]
add r15b, r10b
add r15b, dl
mov qword [rsp + 0x20], r15
mov rax, r8
jmp 0x1400feba3
lea rax, [r9 + 1]
cmp r8, rax
jne 0x1400fed30
lea ecx, [r14 + 0x34]
movzx eax, r10b
and al, cl
add al, al
sub r10b, al
lea r15d, [rcx + r10]
sub r15b, 0x6c
mov rax, r8
jmp 0x1400ff2a8
inc rax
cmp r8, rax
jne 0x1400fed58
lea edx, [r14 - 4]
movzx eax, r10b
and al, dl
mov ecx, select
sub cl, al
add cl, cl
add cl, r10b
add dl, cl
mov rax, r8
jmp 0x1400ff209
lea rax, [r9 + 4]
cmp r8, rax
jne 0x1400fed7f
lea ecx, [r14 - 0x3c]
movzx eax, r10b
and al, cl
add al, al
sub r10b, al
lea edx, [rcx + r10]
sub dl, 0x5c
mov rax, r8
jmp 0x1400ff1bf
lea rax, [r9 + 5]
cmp r8, rax
jne 0x1400fedab
movzx r11d, r14b
lea edx, [r11 + 0x28]
movzx eax, r10b
and al, dl
add al, al
movzx ecx, r10b
sub cl, al
sub dl, 0x18
add dl, cl
mov rax, r8
jmp 0x1400ff0ce
lea rax, [r9 + 3]
cmp r8, rax
jne 0x1400fede2
lea edx, [r14 - 0x74]
movzx eax, r10b
and al, dl
mov ecx, reloc.WLDAP32.dll_Ordinal_22
sub cl, al
add cl, cl
add cl, r10b
add dl, cl
mov rax, r8
mov qword [rsp + 0x20], rdx
dec r14
mov r15, rdx
inc r14
jmp 0x1400fe6c0
mov rax, r8
mov qword [rsp + 0x20], r15
lea rcx, [r9 + 6]
cmp r8, rcx
jne 0x1400feba3
lea edx, [r14 + 0x54]
movzx eax, r10b
and al, dl
add al, al
movzx ecx, r10b
sub cl, al
sub dl, 0x4c
add dl, cl
mov rax, r8
jmp 0x1400ff13a
lea rdx, [r9 + 1]
cmp rax, rdx
jne 0x1400fee3b
lea r8d, [r14 - 0x32]
movzx ecx, r10b
and cl, r8b
mov edx, Ordinal_50
sub dl, cl
add dl, dl
add dl, r10b
jmp 0x1400ff137
lea rcx, [r9 + 3]
cmp rax, rcx
jne 0x1400fee6c
lea edx, [r14 - 0x6a]
movzx ecx, r10b
and cl, dl
add cl, cl
sub r10b, cl
sub dl, 0x1a
add dl, r10b
mov qword [rsp + 0x20], rdx
dec r14
mov r15, rdx
inc r14
jmp 0x1400fe6c0
lea rcx, [rdx + 1]
cmp rax, rcx
jne 0x1400fee91
lea r8d, [r14 + 0x5e]
movzx ecx, r10b
and cl, r8b
mov edx, gethostname
sub dl, cl
add dl, dl
add dl, r10b
jmp 0x1400ff1bc
lea rcx, [r9 + 6]
cmp rax, rcx
jne 0x1400feebb
lea edx, [r14 - 0x3e]
movzx ecx, r10b
and cl, dl
add cl, cl
sub r10b, cl
lea r15d, [rdx + r10]
sub r15b, 0x4e
mov qword [rsp + 0x20], r15
jmp 0x1400ff1ca
lea rcx, [r9 + 5]
cmp rax, rcx
jne 0x1400feedf
lea r8d, [r14 + 0x26]
movzx ecx, r10b
and cl, r8b
add cl, cl
movzx edx, r10b
sub dl, cl
sub dl, 0xa
jmp 0x1400ff206
lea rcx, [r9 + 9]
cmp rax, rcx
jne 0x1400feb51
lea r8d, [r14 - 0x12]
movzx ecx, r10b
and cl, r8b
mov edx, 0x3f
sub dl, cl
add dl, dl
add dl, r10b
jmp 0x1400ff2a1
lea rcx, [r9 + 1]
cmp rax, rcx
jne 0x1400fef2d
lea r8d, [r14 + 0x68]
movzx ecx, r10b
and cl, r8b
mov edx, reloc.WS2_32.dll_sendto
sub dl, cl
add dl, dl
add dl, r10b
jmp 0x1400ff2a1
inc rcx
cmp rax, rcx
jne 0x1400fef56
lea edx, [r14 - 0x6c]
movzx ecx, r10b
and cl, dl
add cl, cl
sub r10b, cl
lea r15d, [rdx + r10]
sub r15b, 0xc
mov qword [rsp + 0x20], r15
jmp 0x1400ff1ca
lea rcx, [r9 + 3]
cmp rax, rcx
jne 0x1400fef7b
lea r8d, [r14 - 8]
movzx ecx, r10b
and cl, r8b
mov edx, Ordinal_30
sub dl, cl
add dl, dl
add dl, r10b
jmp 0x1400ff1bc
lea rcx, [r9 + 4]
cmp rax, rcx
jne 0x1400fefa4
movzx r11d, r14b
lea r8d, [r11 + 0x5c]
movzx ecx, r10b
and cl, r8b
mov edx, 0x3e
sub dl, cl
add dl, dl
add dl, r10b
jmp 0x1400ff0cb
lea rcx, [r9 + 9]
cmp rax, rcx
jne 0x1400feb08
lea r8d, [r14 - 0x78]
movzx ecx, r10b
and cl, r8b
mov edx, 0x24
sub dl, cl
add dl, dl
add dl, r10b
jmp 0x1400ff137
movzx r11d, r14b
lea r8d, [r11 + 0x50]
movzx ecx, r10b
and cl, r8b
add cl, cl
movzx edx, r10b
sub dl, cl
sub dl, 0x30
add dl, r8b
add dl, r10b
jmp 0x1400ff0ce
lea r8d, [r14 - 0x4c]
movzx ecx, r10b
and cl, r8b
mov edx, 0xa
sub dl, cl
add dl, dl
jmp 0x1400ff206
movabs r8, 0x46aa674f1286bd1e
add r8, r14
movzx ecx, r8b
and cl, r10b
mov edx, reloc.WS2_32.dll_socket
sub dl, cl
add dl, dl
add dl, r10b
jmp 0x1400ff2a1
movabs r8, 0x1e98ed1f93e88256
add r8, r14
movzx ecx, r8b
and cl, r10b
add cl, cl
movzx edx, r10b
sub dl, cl
sub dl, 0x5a
jmp 0x1400ff206
movabs r8, 0x8a903007d49964f2
add r8, r14
movzx ecx, r8b
and cl, r10b
mov edx, Ordinal_50
sub dl, cl
lea r15d, [rdx + rdx]
add r15b, r10b
add r15b, r8b
mov qword [rsp + 0x20], r15
jmp 0x1400ff1ca
movabs r8, 0xf68772f0154a478e
add r8, r14
movzx ecx, r8b
and cl, r10b
mov edx, reloc.WS2_32.dll_ntohs
sub dl, cl
add dl, dl
add dl, r10b
jmp 0x1400ff1bc
movabs r8, 0x627eb5d855fb2a2a
add r8, r14
movzx ecx, r8b
and cl, r10b
add cl, cl
movzx edx, r10b
sub dl, cl
sub dl, 0x26
movzx r11d, r14b
add dl, r8b
add r11b, 2
movzx ecx, r11b
and cl, r10b
add cl, cl
sub r11b, cl
sub r11b, 0xe
add r11b, r10b
add r11b, dl
mov byte [rsp + r14 + 0x58], r11b
jmp 0x1400ff1bf
movabs r8, 0xa6647e91180dd1fe
add r8, r14
movzx ecx, r8b
and cl, r10b
mov edx, 7
sub dl, cl
add dl, dl
add dl, r10b
jmp 0x1400ff137
movabs r8, 0x7e530461996f9736
add r8, r14
movzx ecx, r8b
and cl, r10b
add cl, cl
movzx edx, r11b
sub dl, cl
sub dl, 0x7a
movzx r10d, r11b
add dl, r8b
mov qword [rsp + 0x20], rdx
lea edx, [r14 - 0x62]
movzx ecx, dl
and cl, r10b
add cl, cl
sub dl, cl
sub dl, 0x52
add dl, r10b
mov byte [rsp + r14 + 0x58], dl
inc r9
dec r14
mov r15, qword [rsp + 0x20]
inc r14
jmp 0x1400fe6c0
movabs rdx, 0x56418a321ad15c6e
add rdx, r14
movzx ecx, dl
and cl, r10b
add cl, cl
sub r11b, cl
sub dl, 2
add dl, r11b
mov qword [rsp + 0x20], rdx
dec r14
mov r15, rdx
inc r14
jmp 0x1400fe6c0
movabs r8, 0x2e3010029c3321a6
add r8, r14
movzx ecx, r8b
and cl, r10b
mov edx, Ordinal_60
sub dl, cl
add dl, dl
add dl, r11b
add dl, r8b
mov qword [rsp + 0x20], rdx
add rax, r9
mov r15, rdx
movzx ecx, r15b
mov rdx, 0xffffffffffffffff
sub rdx, rcx
add r14, rdx
inc r14
jmp 0x1400fe6c0
movabs r8, 0x61e95d31d94e6de
add r8, r14
movzx ecx, r8b
and cl, r10b
add cl, cl
movzx edx, r11b
sub dl, cl
sub dl, 0x12
movzx r10d, r11b
add dl, r8b
mov qword [rsp + 0x20], rdx
lea r8d, [r14 + 0x66]
movzx ecx, r8b
and cl, r10b
mov edx, reloc.WLDAP32.dll_Ordinal_27
sub dl, cl
add dl, dl
add dl, r8b
add dl, r10b
movzx ecx, dl
mov byte [rsp + r14 + 0x58], cl
inc r9
add rcx, r9
sub r14, rcx
lea r8d, [r14 + 0x18]
movzx ecx, r8b
and cl, r10b
mov edx, Ordinal_46
sub dl, cl
add dl, dl
add dl, r8b
add dl, r10b
mov byte [rsp + r14 + 0x58], dl
inc rax
mov rcx, 0xffffffffffffffff
sub rcx, rax
add r14, rcx
mov r15, qword [rsp + 0x20]
movzx ecx, byte [rsp + r14 + 0x58]
add rcx, r9
add r14, rcx
inc r14
jmp 0x1400fe6c0
movabs r8, 0xde0d1ba39ef6ac16
add r8, r14
movzx ecx, r8b
and cl, r10b
mov edx, 0x33
sub dl, cl
add dl, dl
add dl, r11b
add dl, r8b
movzx r15d, dl
mov qword [rsp + 0x20], r15
movzx ecx, byte [rsp + r14 + 0x58]
add rcx, r9
add r14, rcx
inc r14
jmp 0x1400fe6c0
add r14b, 0x7a
movzx ecx, r10b
and cl, r14b
add cl, cl
sub r10b, cl
lea r15d, [r14 + r10]
sub r15b, 0x56
mov qword [rsp + 0x20], r15
xor r14d, r14d
jmp 0x1400fe6c0
add r14b, 0x16
movzx eax, r10b
and al, r14b
mov ecx, 0x33
sub cl, al
lea r15d, [rcx + rcx]
add r15b, r10b
add r15b, r14b
mov qword [rsp + 0x20], r15
xor r14d, r14d
jmp 0x1400fe6b0
lea rcx, [rbp + 0x153def0]
jmp 0x1400ff326
lea rcx, [rbp + 0x7b6da2]
jmp 0x1400ff326
lea rcx, [rsp + 0x58]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rsi, rax
movzx edx, bl
lea rcx, [rbp - 0x38]
call fcn.140002620
nop
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rsi + r8], 0
jne 0x1400ff343
mov rdx, rsi
lea rcx, [rbp - 0x38]
call fcn.140004030
nop
mov word [rbp - 0x78], 0x953a
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x76], xmm0
movups xmmword [rbp - 0x66], xmm0
mov byte [rbp - 0x56], al
xor r15d, r15d
nop dword [rax]
nop word [rax + rax]
mov r8, qword [0x140220a80]
mov r9, qword [0x140220a78]
nop
mov r14, r15
cmp r14, 0x23
jae 0x1400ffe0b
movzx r10d, byte [rbp + r14 - 0x78]
mov edx, r10d
movzx r11d, r14b
nop word [rax + rax]
movzx esi, r11b
cmp r8, r14
ja 0x1400ffe02
lea rax, [r9 + 1]
cmp r8, rax
jae 0x1400ff3e9
movabs rcx, 0x42f6b1ddf1cd0aed
add rcx, r14
mov rax, rcx
and rax, rdx
imul r13, rax, 0xfffffffffffffffe
add r13, rcx
add r13, rdx
sub r13b, 0x7b
jmp 0x1400ff408
je 0x1400ffd8f
inc rax
cmp r8, rax
je 0x1400ffd6c
lea rax, [r9 + 3]
cmp r8, rax
je 0x1400ffd2d
movzx r11d, r14b
nop dword [rax]
cmp r9, r14
ja 0x1400ffdf9
lea rax, [r9 + 6]
cmp r8, rax
jae 0x1400ff43a
lea ecx, [r11 + 0x71]
movzx eax, cl
and al, r10b
add al, al
sub cl, al
lea r13d, [r10 + rcx]
sub r13b, 0x17
jmp 0x1400ff470
lea rax, [r9 + 1]
cmp r8, rax
je 0x1400ffd13
inc rax
cmp r8, rax
je 0x1400ffcbe
lea rax, [r9 + 5]
cmp r8, rax
je 0x1400ffca4
lea rax, [r9 + 8]
cmp r8, rax
je 0x1400ffc78
nop dword [rax]
lea rax, [r9 + r8]
cmp rax, r14
jbe 0x1400ffa0b
nop dword [rax]
lea rax, [r9 + 5]
cmp r8, rax
je 0x1400ff9ea
lea rax, [r9 + 0x1000]
cmp r8, rax
je 0x1400ff9c0
lea rax, [r9 + 1]
cmp r8, rax
je 0x1400ff999
lea rax, [r9 + 0x80]
cmp r8, rax
je 0x1400ff97c
lea rax, [r9 + 0x7a]
cmp r8, rax
je 0x1400ff95b
lea rax, [r9 + 0x28]
cmp r8, rax
je 0x1400ff93a
lea rax, [r9 + 0x3e8]
cmp r8, rax
je 0x1400ff91d
lea rax, [r9 + 9]
cmp r8, rax
je 0x1400ff8fc
lea rax, [r9 + 0x42]
cmp r8, rax
je 0x1400ff8cc
lea rax, [r9 + 4]
cmp r8, rax
je 0x1400ff480
lea r8, [r9 + 8]
lea r9, [r8 + 0x10]
lea rax, [r9 + 0x7a]
cmp r8, rax
jb 0x1400ffddc
lea rax, [r9 + 3]
cmp r8, rax
jb 0x1400ffdbf
lea rax, [r9 + 0x3e8]
cmp r8, rax
jb 0x1400ff670
lea rax, [r9 + 0x5a]
cmp r8, rax
jb 0x1400ff655
lea rax, [r9 + 0x42]
cmp r8, rax
jb 0x1400ff63a
lea rax, [r9 + 0x1000]
cmp r8, rax
jb 0x1400ff878
lea rax, [r9 + 0x10]
cmp r8, rax
jb 0x1400ff82e
lea rax, [r9 + 0x80]
cmp r8, rax
jb 0x1400ff7eb
lea rax, [r9 + 6]
cmp r8, rax
jb 0x1400ff7c6
lea rax, [r9 + 0x28]
cmp r8, rax
jb 0x1400ff480
lea r8, [r9 + 0x64]
lea r9, [r8 + 2]
lea rax, [r9 + 5]
cmp r8, rax
ja 0x1400ff79a
lea rax, [r9 + 0x1000]
cmp r8, rax
ja 0x1400ff779
lea rax, [r9 + 1]
cmp r8, rax
ja 0x1400ff75c
lea rax, [r9 + 0x80]
cmp r8, rax
ja 0x1400ff73b
lea rax, [r9 + 0x7a]
cmp r8, rax
ja 0x1400ff71a
lea rax, [r9 + 0x28]
cmp r8, rax
ja 0x1400ff6fd
lea rax, [r9 + 0x3e8]
cmp r8, rax
ja 0x1400ff6d6
lea rax, [r9 + 9]
cmp r8, rax
ja 0x1400ff6ac
lea rax, [r9 + 0x42]
cmp r8, rax
ja 0x1400ff68b
lea rax, [r9 + 4]
cmp r8, rax
ja 0x1400ff480
lea r8, [r9 + 8]
lea r9, [r8 + 0x10]
jmp 0x1400ff480
lea ecx, [r11 - 0x51]
movzx eax, cl
and al, r10b
add al, al
sub cl, al
lea r13d, [r10 + rcx]
add r13b, 0x37
jmp 0x1400ff470
lea ecx, [r11 - 0x2b]
movzx eax, cl
and al, r10b
add al, al
sub cl, al
lea r13d, [r10 + rcx]
add r13b, 0x2d
jmp 0x1400ff410
lea ecx, [r11 - 5]
movzx eax, cl
and al, r10b
add al, al
sub cl, al
lea r13d, [r10 + rcx]
add r13b, 0x23
jmp 0x1400ff3b0
sub r11b, 0x78
movzx eax, r10b
and al, r11b
mov ecx, 0x24
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r10b
add r13b, r11b
jmp 0x1400ffd42
sub r11b, 0x52
movzx eax, r10b
and al, r11b
mov ecx, Ordinal_33
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r10b
add r13b, r11b
inc r9
dec r14
inc r14
jmp 0x1400ff393
sub r11b, 0x2c
movzx eax, r10b
and al, r11b
mov ecx, reloc.WLDAP32.dll_Ordinal_26
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r10b
add r13b, r11b
dec r14
inc r14
jmp 0x1400ff393
lea edx, [r11 - 6]
movzx eax, r10b
and al, dl
mov ecx, reloc.WS2_32.dll_setsockopt
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r10b
jmp 0x1400ffcd5
add r11b, 0x20
movzx eax, r10b
and al, r11b
mov ecx, reloc.WS2_32.dll_recv
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r10b
add r13b, r11b
jmp 0x1400ffcf7
add r11b, 0x46
movzx eax, r10b
and al, r11b
mov ecx, listen
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r10b
add r13b, r11b
jmp 0x1400ffcfa
lea edx, [r11 + 0x6c]
movzx eax, r10b
and al, dl
mov ecx, 6
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r10b
jmp 0x1400ffc0a
sub r11b, 0x6e
movzx eax, r10b
and al, r11b
mov ecx, 1
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r10b
add r13b, r11b
jmp 0x1400ffc37
sub r11b, 0x48
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea r13d, [r11 + r10]
sub r13b, 8
movzx eax, byte [rbp + r14 - 0x78]
add rax, r9
add r14, rax
inc r14
jmp 0x1400ff393
add r11b, 0x17
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea r13d, [r11 + r10]
add r13b, 0x5f
mov byte [rbp + r14 - 0x78], r13b
inc r14
jmp 0x1400ff393
lea edx, [r11 + 0x3d]
movzx eax, r10b
and al, dl
add al, al
movzx r13d, r10b
sub r13b, al
add r13b, 0x55
add r13b, dl
cmp r9, 0x40
jb 0x1400ff7de
add r11b, 0x6e
movzx eax, r10b
and al, r11b
add al, al
movzx ecx, r10b
sub cl, al
add cl, r11b
lea r13d, [rcx*2 - 4]
jmp 0x1400ffd42
lea edx, [r11 + 0x63]
movzx eax, r10b
and al, dl
add al, al
movzx r13d, r10b
sub r13b, al
add r13b, 0x4b
add r13b, dl
cmp r8, 0x61
jae 0x1400ffbd9
lea rax, [r9 + 9]
cmp r8, rax
jbe 0x1400ffb58
lea edx, [r11 - 0x16]
movzx eax, r10b
and al, dl
add al, al
movzx r13d, r10b
sub r13b, al
sub r13b, 0x66
jmp 0x1400ff802
lea edx, [r11 - 0x77]
movzx eax, r10b
and al, dl
add al, al
movzx r13d, r10b
sub r13b, al
add r13b, 0x41
add r13b, dl
lea rax, [r9 + r8]
cmp rax, 0x40
je 0x1400ffbf5
lea rax, [r9 + 0x80]
cmp r8, rax
jbe 0x1400ffab4
lea edx, [r11 + 0x79]
movzx eax, r10b
and al, dl
add al, al
movzx r13d, r10b
sub r13b, al
sub r13b, 0x4f
jmp 0x1400ff845
sub r11b, 0x5a
movzx eax, r10b
and al, r11b
mov ecx, Ordinal_60
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r10b
add r13b, r11b
movzx eax, byte [rbp + r14 - 0x78]
add rax, r9
add r14, rax
inc r14
jmp 0x1400ff393
sub r11b, 0x34
movzx eax, r10b
and al, r11b
mov ecx, gethostname
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r10b
add r13b, r11b
jmp 0x1400ffc37
lea edx, [r11 - 0xe]
movzx eax, r10b
and al, dl
mov ecx, Ordinal_50
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r10b
jmp 0x1400ffc0a
add r11b, 0x18
movzx eax, r10b
and al, r11b
mov ecx, Ordinal_46
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r10b
add r13b, r11b
jmp 0x1400ffcfa
add r11b, 0x3e
movzx eax, r10b
and al, r11b
mov ecx, Ordinal_41
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r10b
add r13b, r11b
jmp 0x1400ffcf7
lea edx, [r11 + 0x64]
movzx eax, r10b
and al, dl
mov ecx, Ordinal_35
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r10b
jmp 0x1400ffcd5
sub r11b, 0x76
movzx eax, r10b
and al, r11b
mov ecx, Ordinal_33
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r10b
add r13b, r11b
dec r14
inc r14
jmp 0x1400ff393
sub r11b, 0x50
movzx eax, r10b
and al, r11b
mov ecx, Ordinal_27
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r10b
add r13b, r11b
inc r9
dec r14
inc r14
jmp 0x1400ff393
sub r11b, 0x2a
movzx eax, r10b
and al, r11b
mov ecx, reloc.WS2_32.dll_send
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r10b
add r13b, r11b
jmp 0x1400ffd42
lea rax, [r9 + 0x20]
cmp r8, rax
jae 0x1400ffa30
lea edx, [r11 - 0x13]
movzx eax, r10b
and al, dl
add al, al
movzx r13d, r10b
sub r13b, al
sub r13b, 0x7b
jmp 0x1400ff88f
lea rax, [r9 + 1]
cmp r8, rax
jne 0x1400ffa65
sub r11b, 0x1e
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea r13d, [r11 + r10]
sub r13b, 0x2e
movzx eax, byte [rbp + r14 - 0x78]
add rax, r9
add r14, rax
inc r14
jmp 0x1400ff393
lea rax, [r9 + 2]
cmp r8, rax
jne 0x1400ffa8a
lea edx, [r11 - 0x6a]
movzx eax, r10b
and al, dl
add al, al
movzx r13d, r10b
sub r13b, al
sub r13b, 0x1a
jmp 0x1400ffc0a
lea rax, [r9 + 3]
cmp r8, rax
jne 0x1400ff892
add r11b, 0x70
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea r13d, [r11 + r10]
sub r13b, 0x10
jmp 0x1400ffcfa
lea rcx, [r9 + 1]
cmp r8, rcx
jne 0x1400ffadd
add r11b, 0x53
movzx eax, r10b
and al, r11b
add al, al
movzx r13d, r10b
sub r13b, al
sub r13b, 0x45
add r13b, r11b
jmp 0x1400ffd42
lea rax, [r9 + 3]
cmp r8, rax
jne 0x1400ffb09
add r11b, 7
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea r13d, [r11 + r10]
sub r13b, 0x31
dec r14
inc r14
jmp 0x1400ff393
lea rax, [rcx + 1]
cmp r8, rax
jne 0x1400ffb2e
lea edx, [r11 - 0x1f]
movzx eax, r10b
and al, dl
add al, al
movzx r13d, r10b
sub r13b, al
sub r13b, 0x27
jmp 0x1400ffcd5
lea rax, [r9 + 5]
cmp r8, rax
jne 0x1400ff848
sub r11b, 0x6b
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea r13d, [r11 + r10]
sub r13b, 0x13
jmp 0x1400ffcfa
lea rax, [r9 + 1]
cmp r8, rax
jne 0x1400ffb8d
sub r11b, 0x3c
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea r13d, [r11 + r10]
sub r13b, 0x5c
movzx eax, byte [rbp + r14 - 0x78]
add rax, r9
add r14, rax
inc r14
jmp 0x1400ff393
lea rax, [r9 + 2]
cmp r8, rax
jne 0x1400ffbaf
lea edx, [r11 + 0x78]
movzx eax, r10b
and al, dl
add al, al
movzx r13d, r10b
sub r13b, al
sub r13b, 0x48
jmp 0x1400ffc0a
lea rax, [r9 + 3]
cmp r8, rax
jne 0x1400ff805
add r11b, 0x52
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea r13d, [r11 + r10]
sub r13b, 0x3e
jmp 0x1400ffcfa
lea edx, [r11 + 0x48]
movzx eax, r10b
and al, dl
movzx ecx, r10b
sub cl, al
add cl, 4
lea r13d, [rcx + rcx]
jmp 0x1400ffcd5
lea edx, [r11 + 0x22]
movzx eax, r10b
and al, dl
mov ecx, 9
sub cl, al
lea r13d, [rcx + rcx]
add r13b, dl
add r11b, 0xf
movzx eax, r10b
and al, r11b
add al, al
movzx ecx, r10b
sub cl, al
sub cl, 0x69
add cl, r11b
movzx eax, cl
mov byte [rbp + r14 - 0x78], al
inc r9
add rax, r9
sub r14, rax
lea edx, [r14 - 4]
movzx eax, r10b
and al, dl
mov ecx, select
sub cl, al
add cl, cl
add cl, r10b
add cl, dl
mov byte [rbp + r14 - 0x78], cl
inc r8
mov rax, 0xffffffffffffffff
sub rax, r8
add r14, rax
movzx eax, byte [rbp + r14 - 0x78]
add rax, r9
add r14, rax
inc r14
jmp 0x1400ff393
add r11b, 0x1b
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea r13d, [r11 + r10]
add r13b, 0x43
movzx eax, byte [rbp + r14 - 0x78]
add rax, r9
add r14, rax
inc r14
jmp 0x1400ff393
sub r11b, 0x4d
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea r13d, [r11 + r10]
add r13b, 0x1b
jmp 0x1400ffcf7
lea edx, [r11 - 0x27]
movzx eax, r10b
and al, dl
add al, al
movzx r13d, r10b
sub r13b, al
add r13b, 0x11
add r13b, dl
add r11b, 0x35
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
sub r10b, 0x73
add r10b, r11b
add r10b, r13b
mov byte [rbp + r14 - 0x78], r10b
add r8, r9
movzx eax, r13b
mov rcx, 0xffffffffffffffff
sub rcx, rax
add r14, rcx
inc r14
jmp 0x1400ff393
add r11b, 0x4b
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r13d, [r10 + r11]
sub r13b, 0xd
jmp 0x1400ffd42
lea ecx, [rsi - 0x69]
movzx eax, cl
and al, r10b
add al, al
sub cl, al
lea r13d, [r10 + rcx]
sub r13b, 0x21
add sil, 0x5b
movzx eax, r10b
and al, sil
add al, al
sub r10b, al
sub r10b, 0x7d
add r10b, sil
mov byte [rbp + r14 - 0x78], r10b
inc r9
dec r14
inc r14
jmp 0x1400ff393
sub sil, 0x1d
movzx eax, sil
and al, r10b
add al, al
sub sil, al
lea r13d, [r10 + rsi]
sub r13b, 0x35
dec r14
inc r14
jmp 0x1400ff393
movabs rax, 0xc8e41599d56720c7
add rax, r14
and dl, al
add dl, dl
sub r10b, dl
lea r13d, [rax + r10]
sub r13b, 0x71
movzx eax, byte [rbp + r14 - 0x78]
add rax, r9
add r14, rax
inc r14
jmp 0x1400ff393
add r11b, 0x21
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea r13d, [r11 + r10]
add r13b, 0x19
jmp 0x1400ff390
add r11b, 0x47
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea r13d, [r11 + r10]
add r13b, 0xf
jmp 0x1400ff380
lea rdx, [rbp + 0x14356c4]
jmp 0x1400ffe0f
lea rdx, [rbp + 0x9061b1]
jmp 0x1400ffe0f
lea rdx, [rbp - 0x78]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], r15b
jne 0x1400ffe16
lea rcx, [rbp - 0x38]
call fcn.140002d30
mov r14, rax
mov dword [rsp + 0x30], 0xfee3d8c2
mov dword [rsp + 0x34], 0xd1f3cafe
mov dword [rsp + 0x38], 0xcff0fcff
mov byte [rsp + 0x3c], 0x6a
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x3d], xmm0
mov dword [rsp + 0x4d], eax
mov word [rsp + 0x51], ax
nop dword [rax + rax]
mov r8, qword [0x140220a80]
mov r9, qword [0x140220a78]
nop
mov rsi, r15
cmp rsi, 0x23
jae 0x140100a12
movzx r11d, byte [rsp + rsi + 0x30]
mov edx, r11d
cmp r8, rsi
ja 0x140100a09
lea rax, [r9 + 1]
cmp r8, rax
jae 0x1400ffebb
movabs rcx, 0xe48e915520977c91
add rcx, rsi
mov rax, rcx
and rax, rdx
imul r12, rax, 0xfffffffffffffffe
add r12, rcx
add r12, rdx
add r12b, 9
jmp 0x1400fff01
je 0x140100998
inc rax
cmp r8, rax
je 0x140100964
lea rax, [r9 + 5]
cmp r8, rax
je 0x140100926
lea rax, [r9 + 6]
cmp r8, rax
je 0x140100906
lea rax, [r9 + 3]
cmp r8, rax
je 0x1401008e3
lea rax, [r9 + 7]
cmp r8, rax
je 0x14010089f
movzx r10d, sil
cmp r9, rsi
ja 0x140100a00
lea rax, [r9 + 0x400]
cmp r8, rax
jae 0x1400fff32
lea ecx, [r10 - 0x1b]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0x43
jmp 0x1400fff70
lea rax, [r9 + 1]
cmp r8, rax
je 0x140100887
lea rax, [r9 + 2]
cmp r8, rax
je 0x140100864
lea rax, [r9 + 3]
cmp r8, rax
je 0x140100847
lea rax, [r9 + 4]
cmp r8, rax
je 0x1401007cb
nop word [rax + rax]
lea rax, [r9 + r8]
cmp rax, rsi
jbe 0x1401004e8
nop dword [rax]
lea rax, [r9 + 0x200]
cmp r8, rax
je 0x1401004cd
lea rax, [r9 + 0x42]
cmp r8, rax
je 0x1401004a7
lea rax, [r9 + 2]
cmp r8, rax
je 0x140100480
lea rax, [r9 + 0x5a]
cmp r8, rax
je 0x140100460
lea rax, [r9 + 0x61]
cmp r8, rax
je 0x14010043c
lea rax, [r9 + 0x3e8]
cmp r8, rax
je 0x14010041b
lea rax, [r9 + 0x64]
cmp r8, rax
je 0x1401003fb
lea rax, [r9 + 3]
cmp r8, rax
je 0x1401003da
lea rax, [r9 + 0x2a]
cmp r8, rax
je 0x1401003ab
lea rax, [r9 + 0x7a]
cmp r8, rax
je 0x1400fff80
lea r8, [r9 + 9]
lea r9, [r8 + 0x400]
lea rax, [r9 + 5]
cmp r8, rax
jb 0x1401009e3
lea rax, [r9 + 0x3e8]
cmp r8, rax
jb 0x1401009c6
lea rax, [r9 + 0x64]
cmp r8, rax
jb 0x140100166
lea rax, [r9 + 0x28]
cmp r8, rax
jb 0x14010014b
lea rax, [r9 + 0xa]
cmp r8, rax
jb 0x140100130
lea rax, [r9 + 0x7a]
cmp r8, rax
jb 0x140100362
lea rax, [r9 + 0x400]
cmp r8, rax
jb 0x14010031d
lea rax, [r9 + 0x80]
cmp r8, rax
jb 0x1401002dc
lea rax, [r9 + 0x40]
cmp r8, rax
jb 0x1401002b7
lea rax, [r9 + 0x10]
cmp r8, rax
jb 0x1400fff80
lea r8, [r9 + 0x61]
lea r9, [r8 + 0x41]
lea rax, [r9 + 0xa]
cmp r8, rax
ja 0x140100288
lea rax, [r9 + 6]
cmp r8, rax
ja 0x140100267
lea rax, [r9 + 3]
cmp r8, rax
ja 0x140100247
lea rcx, [r9 + 0x2a]
cmp r8, rcx
ja 0x14010022a
lea rax, [r9 + 0x40]
cmp r8, rax
ja 0x14010020a
lea rax, [r9 + 0x10]
cmp r8, rax
ja 0x1401001eb
lea rax, [r9 + 8]
cmp r8, rax
ja 0x1401001c8
lea rax, [r9 + 4]
cmp r8, rax
ja 0x1401001a2
lea rax, [r9 + 1]
cmp r8, rax
ja 0x140100183
lea rax, [r9 + 0x42]
cmp r8, rax
ja 0x1400fff80
mov r8, rcx
lea r9, [rcx + 0x20]
jmp 0x1400fff80
lea ecx, [r10 - 0x45]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0x1d
jmp 0x1400fff70
lea ecx, [r10 - 0x67]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0x2f
jmp 0x1400fff05
add r10b, 0x77
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea r12d, [r11 + r10]
sub r12b, 0x41
jmp 0x1400ffe86
lea edx, [r10 + 0x28]
movzx eax, r11b
and al, dl
add al, al
movzx r12d, r11b
sub r12b, al
sub r12b, 0x18
add r12b, dl
jmp 0x1401008b9
add r10b, 6
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r12d, [r10 + r11]
sub r12b, 0x2a
inc r9
dec rsi
inc rsi
jmp 0x1400ffe73
sub r10b, 0x1c
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r12d, [r10 + r11]
sub r12b, 0x3c
dec rsi
inc rsi
jmp 0x1400ffe73
lea edx, [r10 - 0x3e]
movzx eax, r11b
and al, dl
add al, al
movzx r12d, r11b
sub r12b, al
sub r12b, 0x4e
add r12b, dl
jmp 0x140100940
sub r10b, 0x60
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r12d, [r10 + r11]
sub r12b, 0x60
add r8, r9
jmp 0x14010097f
add r10b, 0x7e
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r12d, [r10 + r11]
sub r12b, 0x72
jmp 0x14010097f
lea edx, [r10 + 0x5c]
movzx eax, r11b
and al, dl
mov ecx, 0x3e
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r11b
add r12b, dl
jmp 0x1401007e1
add r10b, 0x3a
movzx eax, r11b
and al, r10b
mov ecx, gethostname
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r11b
add r12b, r10b
jmp 0x14010080a
add r10b, 0x18
movzx eax, r11b
and al, r10b
mov ecx, Ordinal_46
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r11b
add r12b, r10b
movzx eax, byte [rsp + rsi + 0x30]
add rax, r9
add rsi, rax
inc rsi
jmp 0x1400ffe73
add r10b, 0x43
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r12d, [r10 + r11]
add r12b, 0x2b
mov byte [rsp + rsi + 0x30], r12b
inc rsi
jmp 0x1400ffe73
lea edx, [r10 + 0x21]
movzx eax, r11b
and al, dl
add al, al
movzx r12d, r11b
sub r12b, al
add r12b, 0x19
add r12b, dl
cmp r9, 0x40
jb 0x1401002cf
lea edx, [r10 - 0x3a]
movzx eax, r11b
and al, dl
mov ecx, listen
sub cl, al
add cl, cl
add cl, r11b
add cl, dl
lea r12d, [rcx + rcx]
jmp 0x1401008b9
lea ecx, [r10 - 1]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
add r12b, 7
cmp r8, 0x2a
jae 0x140100795
lea rax, [r9 + 0x20]
cmp r8, rax
jbe 0x1401006b3
lea ecx, [r10 + 0x72]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0x1e
jmp 0x1401002f6
lea ecx, [r10 - 0x23]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0xb
lea rax, [r9 + r8]
cmp rax, 0x28
je 0x1401007b7
lea rax, [r9 + 0x41]
cmp r8, rax
jbe 0x1401005e1
lea ecx, [r10 - 0x73]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
add r12b, 0x25
jmp 0x140100333
add r10b, 0x5e
movzx eax, r10b
and al, r11b
mov ecx, gethostname
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r10b
add r12b, r11b
movzx eax, byte [rsp + rsi + 0x30]
add rax, r9
add rsi, rax
inc rsi
jmp 0x1400ffe73
add r10b, 0x3c
movzx eax, r10b
and al, r11b
mov ecx, reloc.WLDAP32.dll_Ordinal_46
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r10b
add r12b, r11b
jmp 0x14010080a
lea edx, [r10 + 0x1a]
movzx eax, dl
and al, r11b
mov ecx, Ordinal_41
sub cl, al
lea r12d, [rcx + rcx]
add r12b, dl
add r12b, r11b
jmp 0x1401007e1
sub r10b, 8
movzx eax, r10b
and al, r11b
mov ecx, Ordinal_30
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r10b
add r12b, r11b
jmp 0x14010097f
sub r10b, 0x2a
movzx eax, r10b
and al, r11b
mov ecx, reloc.WS2_32.dll_send
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r10b
add r12b, r11b
add r8, r9
jmp 0x14010097f
lea edx, [r10 - 0x4c]
movzx eax, dl
and al, r11b
mov ecx, 0xa
sub cl, al
lea r12d, [rcx + rcx]
add r12b, dl
add r12b, r11b
jmp 0x140100940
sub r10b, 0x6e
movzx eax, r10b
and al, r11b
mov ecx, 1
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r10b
add r12b, r11b
dec rsi
inc rsi
jmp 0x1400ffe73
add r10b, 0x70
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea r12d, [r11 + r10]
sub r12b, 0x10
inc r9
dec rsi
inc rsi
jmp 0x1400ffe73
lea ecx, [r10 + 0x4e]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0x22
jmp 0x1401008b9
lea rax, [r9 + 0x61]
cmp r8, rax
jae 0x14010050c
lea ecx, [r10 - 0x6f]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
add r12b, 9
jmp 0x140100378
lea rax, [r9 + 1]
cmp r8, rax
jne 0x140100544
sub r10b, 0x36
movzx eax, r10b
and al, r11b
mov ecx, 0x3d
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r10b
add r12b, r11b
movzx eax, byte [rsp + rsi + 0x30]
add rax, r9
add rsi, rax
inc rsi
jmp 0x1400ffe73
inc rax
cmp r8, rax
jne 0x140100567
lea ecx, [r10 + 0xe]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0x62
jmp 0x1401007e1
lea rax, [r9 + 3]
cmp r8, rax
jne 0x14010058d
add r10b, 0x30
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea r12d, [r11 + r10]
sub r12b, 0x50
jmp 0x14010097f
lea rax, [r9 + 4]
cmp r8, rax
jne 0x1401005b1
lea ecx, [r10 + 0x74]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0x2c
jmp 0x140100940
lea rax, [r9 + 6]
cmp r8, rax
jne 0x140100378
sub r10b, 0x6a
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea r12d, [r11 + r10]
sub r12b, 0x1a
dec rsi
inc rsi
jmp 0x1400ffe73
lea rax, [r9 + 1]
cmp r8, rax
jne 0x140100605
lea ecx, [r10 - 0x51]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
add r12b, 0x37
jmp 0x1401008b9
lea rax, [r9 + 3]
cmp r8, rax
jne 0x140100631
sub r10b, 0xd
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea r12d, [r11 + r10]
add r12b, 0x5b
dec rsi
inc rsi
jmp 0x1400ffe73
lea rax, [r9 + 2]
cmp r8, rax
jne 0x140100657
add r10b, 0x59
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea r12d, [r11 + r10]
sub r12b, 0x6f
jmp 0x14010097f
lea rax, [r9 + 7]
cmp r8, rax
jne 0x14010067b
lea ecx, [r10 + 0x7b]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0x5d
jmp 0x1401007e1
lea rax, [r9 + 4]
cmp r8, rax
jne 0x140100333
sub r10b, 0x41
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea r12d, [r11 + r10]
sub r12b, 0x39
movzx eax, byte [rsp + rsi + 0x30]
add rax, r9
add rsi, rax
inc rsi
jmp 0x1400ffe73
lea rax, [r9 + 1]
cmp r8, rax
jne 0x1401006e7
sub r10b, 0x6c
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea r12d, [r11 + r10]
sub r12b, 0xc
movzx eax, byte [rsp + rsi + 0x30]
add rax, r9
add rsi, rax
inc rsi
jmp 0x1400ffe73
inc rax
cmp r8, rax
jne 0x140100710
sub r10b, 0x4a
movzx eax, r10b
and al, r11b
mov ecx, 3
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r10b
add r12b, r11b
jmp 0x14010080a
lea rax, [r9 + 5]
cmp r8, rax
jne 0x140100739
lea edx, [r10 + 0x3e]
movzx eax, dl
and al, r11b
mov ecx, Ordinal_41
sub cl, al
lea r12d, [rcx + rcx]
add r12b, dl
add r12b, r11b
jmp 0x140100940
lea rax, [r9 + 4]
cmp r8, rax
jne 0x140100769
add r10b, 0x60
movzx eax, r10b
and al, r11b
mov ecx, Ordinal_50
sub cl, al
lea r12d, [rcx + rcx]
add r12b, r10b
add r12b, r11b
dec rsi
inc rsi
jmp 0x1400ffe73
lea rax, [r9 + 3]
cmp r8, rax
jne 0x1401002f6
lea edx, [r10 - 0x5c]
movzx eax, r11b
and al, dl
add al, al
movzx r12d, r11b
sub r12b, al
sub r12b, 0x7c
add r12b, dl
jmp 0x1401008b9
lea edx, [r10 - 0x18]
movzx eax, r11b
and al, dl
add al, al
movzx r12d, r11b
sub r12b, al
sub r12b, 0x58
add r12b, r11b
add r12b, dl
jmp 0x140100940
lea ecx, [r10 + 0xa]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [rcx - 0x46]
jmp 0x1401007e1
lea ecx, [r10 - 0x2d]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
add r12b, 0x3b
sub r10b, 0x65
movzx eax, r11b
and al, r10b
add al, al
movzx ecx, r11b
sub cl, al
sub cl, 0x3d
add cl, r10b
movzx eax, cl
mov byte [rsp + rsi + 0x30], al
inc r9
add rax, r9
sub rsi, rax
lea ecx, [rsi + 0x2c]
movzx eax, r11b
and al, cl
add al, al
sub r11b, al
sub r11b, 0x34
add r11b, cl
mov byte [rsp + rsi + 0x30], r11b
inc r8
mov rax, 0xffffffffffffffff
sub rax, r8
add rsi, rax
movzx eax, byte [rsp + rsi + 0x30]
add rax, r9
add rsi, rax
inc rsi
jmp 0x1400ffe73
sub r10b, 0x4f
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea r12d, [r11 + r10]
add r12b, 0x29
jmp 0x14010097f
add r10b, 0x4b
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea r12d, [r11 + r10]
sub r12b, 0xd
dec rsi
inc rsi
jmp 0x1400ffe73
lea ecx, [r10 + 7]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0x31
jmp 0x1401008b9
movzx r10d, sil
lea ecx, [r10 - 0x3d]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0x55
add r10b, 0x57
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
sub r11b, 0x61
add r11b, r10b
mov byte [rsp + rsi + 0x30], r11b
inc r9
dec rsi
inc rsi
jmp 0x1400ffe73
lea ecx, [rsi - 0x5f]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0x67
inc r9
dec rsi
inc rsi
jmp 0x1400ffe73
lea ecx, [rsi + 0x7f]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
sub r12b, 0x79
dec rsi
inc rsi
jmp 0x1400ffe73
movzx r10d, sil
lea ecx, [r10 + 0x5d]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r12d, [r11 + rcx]
add r12b, 0x75
add r10b, 0x79
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
sub r11b, 0x4f
add r11b, r12b
add r11b, r10b
mov byte [rsp + rsi + 0x30], r11b
add r8, r9
jmp 0x14010097f
movabs rax, 0x9031bfe25536119
add rax, rsi
and dl, al
add dl, dl
sub al, dl
lea r12d, [r11 + rax]
add r12b, 0x51
movzx eax, r12b
mov rcx, 0xffffffffffffffff
sub rcx, rax
add rsi, rcx
inc rsi
jmp 0x1400ffe73
movabs rax, 0xadabb3ff61c675b3
add rax, rsi
and dl, al
add dl, dl
sub al, dl
lea r12d, [r11 + rax]
add r12b, 0x1b
movzx eax, byte [rsp + rsi + 0x30]
add rax, r9
add rsi, rax
inc rsi
jmp 0x1400ffe73
add r10b, 0x55
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r12d, [r10 + r11]
sub r12b, 0x53
jmp 0x1400ffe70
add r10b, 0x33
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r12d, [r10 + r11]
sub r12b, 0x65
jmp 0x1400ffe60
lea rdx, [rbp + 0x147b09c]
jmp 0x140100a17
lea rdx, [rbp + 0xdf2d2d]
jmp 0x140100a17
lea rdx, [rsp + 0x30]
xor r8d, r8d
lea rcx, [rbp - 0x10]
call fcn.1400050a0
mov r9, r14
mov r8d, listen
mov rdx, rax
lea rcx, [rbp - 0x10]
call fcn.140057f00
nop
lea rcx, [rbp - 0x38]
call fcn.140002490
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 0xf
cmova rcx, qword [rbp - 0x10]
xor edx, edx
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov r11, rax
mov eax, 0x5a4d
cmp word [r11], ax
jne 0x140100b7a
movsxd rcx, dword [r11 + 0x3c]
cmp dword [rcx + r11], 0x4550
jne 0x140100b7a
mov edx, dword [rcx + r11 + 0x88]
test edx, edx
je 0x140100b7a
mov esi, dword [rdx + r11 + 0x1c]
lea r14, [r11 + rsi]
mov r9d, dword [rdx + r11 + 0x20]
add r9, r11
mov r15d, dword [rdx + r11 + 0x24]
add r15, r11
xor r10d, r10d
test esi, esi
je 0x140100ae3
mov r8d, dword [r9]
add r8, r11
mov rax, qword [rbp - 0x40]
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140100ad3
inc rax
test ecx, ecx
jne 0x140100ac0
test edx, edx
je 0x140100b53
inc r10d
add r9, 4
cmp r10d, esi
jb 0x140100ab0
lea rcx, [rbp - 0x10]
call fcn.140002490
mov r15, qword [rsp + 0x20]
xor r14d, r14d
lea rcx, [rbp + 0x10]
call fcn.140002490
mov eax, dword [rsp + 0x2c]
inc eax
mov dword [rsp + 0x2c], eax
mov rsi, qword [rbp - 0x80]
cmp eax, dword [rsi]
jb 0x1400fe600
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.1401830b0
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
movsxd rax, r10d
movzx ecx, word [r15 + rax*2]
mov r15d, dword [r14 + rcx*4]
mov rax, qword [rbp - 0x50]
add r15, qword [rax + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
lea rcx, [rbp - 0x10]
call fcn.140002490
nop
lea rcx, [rbp + 0x10]
call fcn.140002490
mov rax, r15
jmp 0x140100b26
mov rcx, qword [rdx]
mov rax, r8
xor r8d, r8d
mov rdx, qword [rax]
jmp 0x1400fe510