Function at 0x140085c90
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x420
mov rax, qword [0x1401db200]
xor rax, rsp
mov qword [rsp + 0x410], rax
xor eax, eax
mov dword [rsp + 0x30], eax
mov byte [rsp + 0x1c0], 0x7e
mov al, 0x3f
mov cl, reloc.WLDAP32.dll_Ordinal_46
movzx edx, cl
mov r8b, Ordinal_60
movzx r9d, al
mov r10b, 0x2a
movzx r11d, al
xor ebx, ebx
xor al, 0x7e
mov byte [rsp + 0x1c1], al
xor cl, 0x7e
mov byte [rsp + 0x1c2], cl
xor dl, 0x7e
mov byte [rsp + 0x1c3], dl
xor r8b, 0x7e
mov byte [rsp + 0x1c4], r8b
xor r9b, 0x7e
mov byte [rsp + 0x1c5], r9b
xor r10b, 0x7e
mov byte [rsp + 0x1c6], r10b
xor r11b, 0x7e
mov byte [rsp + 0x1c7], r11b
mov byte [rsp + 0x1c8], bl
lea rcx, [rsp + 0x1c1]
call fcn.140141b00
mov qword [rsp + 0x210], rax
movdqa xmm1, xmmword [0x1401b6840]
movdqu xmmword [rsp + 0x1f0], xmm1
mov cl, 0x48
mov dl, 0x5b
mov r8b, 0x4c
mov r10b, reloc.WLDAP32.dll_Ordinal_27
mov r11b, 0x76
mov bl, 0x45
mov dil, 0x46
mov sil, Ordinal_79
mov r14b, 7
movzx r15d, bl
movzx r12d, dil
movzx r13d, sil
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd r9d, xmm1
xor al, r9b
mov byte [rsp + 0x1f1], al
xor byte [rsp + 0x1f2], r9b
xor byte [rsp + 0x1f3], r9b
xor byte [rsp + 0x1f4], r9b
xor byte [rsp + 0x1f5], r9b
xor byte [rsp + 0x1f6], r9b
xor byte [rsp + 0x1f7], r9b
xor byte [rsp + 0x1f8], r9b
xor byte [rsp + 0x1f9], r9b
xor byte [rsp + 0x1fa], r9b
xor byte [rsp + 0x1fb], r9b
xor byte [rsp + 0x1fc], r9b
xor byte [rsp + 0x1fd], r9b
xor byte [rsp + 0x1fe], r9b
xor byte [rsp + 0x1ff], r9b
xor cl, r9b
mov byte [rsp + 0x200], cl
xor dl, r9b
mov byte [rsp + 0x201], dl
xor r8b, r9b
mov byte [rsp + 0x202], r8b
xor r10b, r9b
mov byte [rsp + 0x203], r10b
xor r11b, r9b
mov byte [rsp + 0x204], r11b
xor bl, r9b
mov byte [rsp + 0x205], bl
xor dil, r9b
mov byte [rsp + 0x206], dil
xor sil, r9b
mov byte [rsp + 0x207], sil
xor r14b, r9b
mov byte [rsp + 0x208], r14b
xor r15b, r9b
mov byte [rsp + 0x209], r15b
xor r12b, r9b
mov byte [rsp + 0x20a], r12b
xor r13b, r9b
mov byte [rsp + 0x20b], r13b
mov byte [rsp + 0x20c], 0
mov r8, qword [rsp + 0x210]
lea rdx, [rsp + 0x1f1]
lea rcx, [rsp + 0x3a0]
call fcn.140056240
nop
lea rax, [rsp + 0x3a0]
mov rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140085ed0
xor r8d, r8d
mov rdx, rbx
lea rcx, [rsp + 0x1f0]
call fcn.140088190
mov dword [rsp + 0x30], 4
mov rcx, qword [rsp + 0x200]
test rcx, rcx
je 0x140085f4c
lea rax, [rsp + 0x1f0]
cmp qword [rsp + 0x208], 7
cmova rax, qword [rsp + 0x1f0]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov r9d, ebx
lea r8, [rsp + 0x3a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor r8d, r8d
movsxd rdx, eax
lea rcx, [rsp + 0x1f0]
call fcn.140015350
lea rdx, [rsp + 0x1f0]
cmp qword [rsp + 0x208], 7
cmova rdx, qword [rsp + 0x1f0]
call fcn.1400898d0
xor edi, edi
mov r15d, edi
mov dword [rsp + 0x30], edi
lea rcx, [rsp + 0x1f0]
call fcn.1400100e0
xor ecx, ecx
call fcn.1401416e0
mov rcx, rax
call fcn.140139a58
nop
mov rax, qword [0x140200800]
test rax, rax
je 0x14008627b
cmp dword [rax + 8], 4
jl 0x14008627b
lea r13, vtable.plog::Record.0
mov qword [rsp + 0x220], r13
mov dword [rsp + 0x238], 4
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x23c], eax
mov qword [rsp + 0x240], rdi
mov qword [rsp + Ordinal_458], 0x24
lea rcx, [rsp + 0x250]
call fcn.140087ea0
lea r12, str.WinMain
mov qword [rsp + 0x338], r12
lea rax, [0x140186f40]
mov qword [rsp + 0x340], rax
mov dword [rsp + 0x348], edi
xorps xmm0, xmm0
movups xmmword [rsp + 0x350], xmm0
mov qword [rsp + 0x360], rdi
mov qword [rsp + 0x368], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x350], dil
movups xmmword [rsp + 0x370], xmm0
mov qword [rsp + 0x380], rdi
mov qword [rsp + 0x388], 7
mov word [rsp + 0x370], di
lea rcx, [rsp + 0x228]
call fcn.14013da7c
nop
movdqa xmm1, xmmword [0x1401b6570]
movdqu xmmword [rsp + 0x1c0], xmm1
movdqa xmm2, xmmword [0x1401b6820]
movdqu xmmword [rsp + 0x1d0], xmm2
mov dl, 2
mov r8b, reloc.WLDAP32.dll_Ordinal_30
mov r9b, reloc.WS2_32.dll_send
mov r10b, 0x56
mov r11b, 4
mov bl, Ordinal_32
mov dil, reloc.WS2_32.dll_select
movzx esi, r9b
mov r14b, 0x58
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x1c1], al
xor byte [rsp + 0x1c2], cl
xor byte [rsp + 0x1c3], cl
xor byte [rsp + 0x1c4], cl
xor byte [rsp + 0x1c5], cl
xor byte [rsp + 0x1c6], cl
xor byte [rsp + 0x1c7], cl
xor byte [rsp + 0x1c8], cl
xor byte [rsp + 0x1c9], cl
xor byte [rsp + 0x1ca], cl
xor byte [rsp + 0x1cb], cl
xor byte [rsp + 0x1cc], cl
xor byte [rsp + 0x1cd], cl
xor byte [rsp + 0x1ce], cl
xor byte [rsp + 0x1cf], cl
movd eax, xmm2
xor al, cl
mov byte [rsp + 0x1d0], al
xor byte [rsp + 0x1d1], cl
xor byte [rsp + 0x1d2], cl
xor byte [rsp + 0x1d3], cl
xor byte [rsp + 0x1d4], cl
xor byte [rsp + 0x1d5], cl
xor byte [rsp + 0x1d6], cl
xor byte [rsp + 0x1d7], cl
xor byte [rsp + 0x1d8], cl
xor byte [rsp + 0x1d9], cl
xor byte [rsp + 0x1da], cl
xor byte [rsp + 0x1db], cl
xor byte [rsp + 0x1dc], cl
xor byte [rsp + 0x1dd], cl
xor byte [rsp + 0x1de], cl
xor byte [rsp + 0x1df], cl
xor dl, cl
mov byte [rsp + 0x1e0], dl
xor r8b, cl
mov byte [rsp + 0x1e1], r8b
xor r9b, cl
mov byte [rsp + 0x1e2], r9b
xor r10b, cl
mov byte [rsp + 0x1e3], r10b
xor r11b, cl
mov byte [rsp + 0x1e4], r11b
xor bl, cl
mov byte [rsp + 0x1e5], bl
xor dil, cl
mov byte [rsp + 0x1e6], dil
xor sil, cl
mov byte [rsp + 0x1e7], sil
xor r14b, cl
mov byte [rsp + 0x1e8], r14b
mov byte [rsp + 0x1e9], 0
lea rdx, [rsp + 0x1c1]
lea rcx, [rsp + 0x250]
call fcn.140083e50
lea rsi, [rsp + 0x220]
mov rdi, qword [0x140200800]
mov rbx, qword [rdi + 0x10]
nop
cmp rbx, qword [rdi + 0x18]
je 0x140086248
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.WS2_32.dll_htonl]
add rbx, 8
jmp 0x140086230
mov qword [rsp + 0x220], r13
lea rcx, [rsp + 0x370]
call fcn.1400100e0
lea rcx, [rsp + 0x350]
call fcn.1400019c0
lea rcx, [rsp + 0x250]
call fcn.1400841d0
xor edi, edi
jmp 0x140086289
lea r13, vtable.plog::Record.0
lea r12, str.WinMain
lea r14, [0x140186f40]
mov ecx, gethostname
call fcn.140128990
mov rbx, rax
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
movups xmmword [rbx + 0x20], xmm0
mov qword [rbx], rdi
mov qword [rbx + 8], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
mov qword [rbx + 0x20], rdi
mov qword [rbx + 0x28], rdi
mov qword [rbx + 0x30], rax
mov qword [rsp + 0x390], rbx
or r15d, 1
mov dword [rsp + 0x30], r15d
movups xmmword [rsp + 0x1c0], xmm0
mov qword [rsp + 0x1d0], rdi
mov qword [rsp + 0x1d8], rdi
lea r8d, [rax + 6]
lea rdx, [0x14018dd34]
lea rcx, [rsp + 0x1c0]
call fcn.1400112f0
lea rdx, [rsp + 0x1c0]
mov rcx, rbx
call fcn.1400b3630
mov ecx, 0xa0
call fcn.140128990
mov rdi, rax
mov qword [rsp + 0x38], rax
xor edx, edx
mov r8d, 0xa0
mov rcx, rax
call fcn.1401600b0
mov rdx, qword [rbx + 8]
mov rcx, rdi
call fcn.1400b4130
mov rdi, rax
mov qword [rsp + 0x38], rax
mov ecx, Ordinal_41
call fcn.140128990
mov qword [rsp + 0x210], rax
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
mov qword [rax + 0x20], rcx
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.1400a3e60
mov rsi, rax
mov qword [rsp + 0x398], rax
or r15d, 2
mov dword [rsp + 0x30], r15d
mov rax, qword [0x140200800]
test rax, rax
je 0x140086594
cmp dword [rax + 8], 4
jl 0x140086594
mov qword [rsp + 0x220], r13
mov dword [rsp + 0x238], 4
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x23c], eax
xor eax, eax
mov qword [rsp + 0x240], rax
mov qword [rsp + 0x248], Ordinal_60
lea rcx, [rsp + 0x250]
call fcn.140087ea0
mov qword [rsp + 0x338], r12
mov qword [rsp + 0x340], r14
xor r12d, r12d
mov dword [rsp + 0x348], r12d
xorps xmm0, xmm0
movups xmmword [rsp + 0x350], xmm0
mov qword [rsp + 0x360], r12
mov qword [rsp + 0x368], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x350], r12b
movups xmmword [rsp + 0x370], xmm0
mov qword [rsp + 0x380], r12
mov qword [rsp + 0x388], 7
mov word [rsp + 0x370], r12w
lea rcx, [rsp + 0x228]
call fcn.14013da7c
nop
movdqa xmm1, xmmword [0x1401b6660]
movdqu xmmword [rsp + 0x1c0], xmm1
mov dl, reloc.WLDAP32.dll_Ordinal_41
mov r8b, 0x36
mov r9b, 0x68
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x1c1], al
xor byte [rsp + 0x1c2], cl
xor byte [rsp + 0x1c3], cl
xor byte [rsp + 0x1c4], cl
xor byte [rsp + 0x1c5], cl
xor byte [rsp + 0x1c6], cl
xor byte [rsp + 0x1c7], cl
xor byte [rsp + 0x1c8], cl
xor byte [rsp + 0x1c9], cl
xor byte [rsp + 0x1ca], cl
xor byte [rsp + 0x1cb], cl
xor byte [rsp + 0x1cc], cl
xor byte [rsp + 0x1cd], cl
xor byte [rsp + 0x1ce], cl
xor byte [rsp + 0x1cf], cl
xor dl, cl
mov byte [rsp + 0x1d0], dl
xor r8b, cl
mov byte [rsp + 0x1d1], r8b
xor r9b, cl
mov byte [rsp + 0x1d2], r9b
mov byte [rsp + 0x1d3], r12b
lea rdx, [rsp + 0x1c1]
lea rcx, [rsp + 0x250]
call fcn.140083e50
mov r14, qword [0x140200800]
mov rdi, qword [r14 + 0x10]
lea rdx, [rsp + 0x220]
cmp rdi, qword [r14 + 0x18]
je 0x140086563
mov rcx, qword [rdi]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
add rdi, 8
jmp 0x140086546
mov qword [rsp + 0x220], r13
lea rcx, [rsp + 0x370]
call fcn.1400100e0
lea rcx, [rsp + 0x350]
call fcn.1400019c0
lea rcx, [rsp + 0x250]
call fcn.1400841d0
jmp 0x140086597
xor r12d, r12d
lea rdx, [rsp + 0x210]
mov rcx, rbx
call fcn.1400b3c10
mov edx, 0xffffffec
mov r8d, 0xa8
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
mov edx, 0xffffffec
mov r8d, 0x800a8
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
mov rcx, rbx
call fcn.1400b3d50
mov ecx, 8
call fcn.140128990
lea rcx, [0x1400848a0]
mov qword [rax], rcx
mov qword [rsp + 0x1c0], rax
or r15d, 8
mov dword [rsp + 0x30], r15d
lea rcx, [rsp + 0x1f8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x140096720]
xor edx, edx
xor ecx, ecx
call fcn.140139944
mov qword [rsp + 0x1f0], rax
test rax, rax
je 0x140086a6e
cmp dword [rsp + 0x1f8], 0
je 0x140086a81
movaps xmm0, xmmword [rsp + 0x1f0]
movdqa xmmword [rsp + 0x1c0], xmm0
lea rcx, [rsp + 0x1c0]
call fcn.140127970
test eax, eax
jne 0x140086a8b
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x1f0], xmm0
mov r15d, dword [rsp + 0x214]
mov r12d, dword [rsp + 0x210]
cmp byte [rsi + 1], 0
je 0x1400866d1
mov rdx, rbx
mov rcx, rsi
call fcn.1400a64b0
lea rdx, [rsp + 0x210]
mov rcx, rbx
call fcn.1400b3c10
mov r14d, dword [rsp + 0x214]
mov rdi, qword [rsp + 0x210]
cmp r14d, r15d
jne 0x1400866bd
cmp edi, r12d
je 0x140086682
mov rcx, rbx
call fcn.1400b3d50
test al, al
je 0x1400866d1
mov r15d, r14d
mov r12d, edi
jmp 0x140086682
mov rdi, qword [rsp + 0x38]
test rdi, rdi
je 0x140086703
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rdi + 0x48]
call fcn.1400b4490
lea rcx, [rdi + 8]
call fcn.1400b4490
mov edx, 0xa0
mov rcx, rdi
call fcn.1401289cc
mov rax, qword [0x140200800]
test rax, rax
je 0x1400869b1
cmp dword [rax + 8], 4
jl 0x1400869b1
mov qword [rsp + 0x220], r13
mov dword [rsp + 0x238], 4
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x23c], eax
xor r15d, r15d
mov qword [rsp + 0x240], r15
mov qword [rsp + 0x248], 0x5c
lea rcx, [rsp + 0x250]
call fcn.140087ea0
lea rax, str.WinMain
mov qword [rsp + 0x338], rax
lea rax, [0x140186f40]
mov qword [rsp + 0x340], rax
mov dword [rsp + 0x348], r15d
xorps xmm0, xmm0
movups xmmword [rsp + 0x350], xmm0
mov qword [rsp + 0x360], r15
mov qword [rsp + 0x368], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x350], r15b
movups xmmword [rsp + 0x370], xmm0
mov qword [rsp + 0x380], r15
mov qword [rsp + 0x388], 7
mov word [rsp + 0x370], r15w
lea rcx, [rsp + 0x228]
call fcn.14013da7c
nop
movdqa xmm1, xmmword [0x1401b65d0]
movdqu xmmword [rsp + 0x1c0], xmm1
movdqa xmm2, xmmword [0x1401b65e0]
movdqu xmmword [rsp + 0x1d0], xmm2
mov dl, 7
mov r8b, reloc.WLDAP32.dll_Ordinal_26
mov r9b, Ordinal_30
mov r10b, reloc.WS2_32.dll_sendto
mov r11b, 0x5d
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x1c1], al
xor byte [rsp + 0x1c2], cl
xor byte [rsp + 0x1c3], cl
xor byte [rsp + 0x1c4], cl
xor byte [rsp + 0x1c5], cl
xor byte [rsp + 0x1c6], cl
xor byte [rsp + 0x1c7], cl
xor byte [rsp + 0x1c8], cl
xor byte [rsp + 0x1c9], cl
xor byte [rsp + 0x1ca], cl
xor byte [rsp + 0x1cb], cl
xor byte [rsp + 0x1cc], cl
xor byte [rsp + 0x1cd], cl
xor byte [rsp + 0x1ce], cl
xor byte [rsp + 0x1cf], cl
movd eax, xmm2
xor al, cl
mov byte [rsp + 0x1d0], al
xor byte [rsp + 0x1d1], cl
xor byte [rsp + 0x1d2], cl
xor byte [rsp + 0x1d3], cl
xor byte [rsp + 0x1d4], cl
xor byte [rsp + 0x1d5], cl
xor byte [rsp + 0x1d6], cl
xor byte [rsp + 0x1d7], cl
xor byte [rsp + 0x1d8], cl
xor byte [rsp + 0x1d9], cl
xor byte [rsp + 0x1da], cl
xor byte [rsp + 0x1db], cl
xor byte [rsp + 0x1dc], cl
xor byte [rsp + 0x1dd], cl
xor byte [rsp + 0x1de], cl
xor byte [rsp + 0x1df], cl
xor dl, cl
mov byte [rsp + 0x1e0], dl
xor r8b, cl
mov byte [rsp + 0x1e1], r8b
xor r9b, cl
mov byte [rsp + 0x1e2], r9b
xor r10b, cl
mov byte [rsp + 0x1e3], r10b
xor r11b, cl
mov byte [rsp + 0x1e4], r11b
mov byte [rsp + 0x1e5], r15b
lea rdx, [rsp + 0x1c1]
lea rcx, [rsp + 0x250]
call fcn.140083e50
lea r12, [rsp + 0x220]
mov r14, qword [0x140200800]
mov rdi, qword [r14 + 0x10]
cmp rdi, qword [r14 + 0x18]
je 0x140086980
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, r12
call qword [rax + reloc.WS2_32.dll_htonl]
add rdi, 8
jmp 0x140086968
mov qword [rsp + 0x220], r13
lea rcx, [rsp + 0x370]
call fcn.1400100e0
lea rcx, [rsp + 0x350]
call fcn.1400019c0
lea rcx, [rsp + 0x250]
call fcn.1400841d0
jmp 0x1400869b4
xor r15d, r15d
cmp dword [rsp + 0x1f8], 0
jne 0x140086a96
test rsi, rsi
je 0x140086a27
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x140086a19
mov rax, qword [rsi + 0x20]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
cmp rdx, 0x1000
jb 0x140086a08
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140086a9c
mov rcx, r8
call fcn.1401289cc
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], r15
mov qword [rsi + 0x20], r15
mov edx, Ordinal_41
mov rcx, rsi
call fcn.1401289cc
nop
test rbx, rbx
je 0x140086a3a
mov edx, gethostname
mov rcx, rbx
call fcn.1401289cc
nop
xor eax, eax
mov rcx, qword [rsp + 0x410]
xor rcx, rsp
call fcn.140128970
lea r11, [rsp + 0x420]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
mov dword [rsp + 0x1f8], r12d
mov ecx, 6
call fcn.14012787c
nop
mov ecx, 1
call fcn.14012787c
mov ecx, 1
call fcn.14012787c
nop
call fcn.140139a70
nop
call fcn.14012fd60
int3