Function at 0x1400febe0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call
Parse pe header
Query environment variable
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov rax, qword [0x1401da800]
xor rax, rsp
mov qword [rbp + 0x30], rax
mov qword [rbp - 0x48], rdx
mov qword [rbp - 0x50], rcx
xor r14d, r14d
mov esi, r14d
mov qword [rbp - 0x80], r14
mov dword [rbp - 0x18], r14d
lea r9, [rbp - 0x18]
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x1400fec8b
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp - 0x18]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
lea r9, [rbp - 0x18]
mov r8d, dword [rbp - 0x18]
mov rdx, rax
mov ecx, listen
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x1400fec41
mov qword [rbp - 0x80], rsi
test eax, eax
js 0x14010126e
mov eax, r14d
mov dword [rsp + 0x2c], eax
cmp dword [rsi], r14d
jbe 0x14010126e
movzx edi, byte [rsp + 0x28]
movzx ebx, byte [rsp + 0x28]
movzx r13d, byte [rsp + 0x28]
movzx r12d, byte [rsp + 0x28]
movzx ecx, byte [rsp + 0x28]
mov qword [rsp + 0x20], rcx
nop dword [rax]
nop word [rax + rax]
imul rcx, rax, 0x128
lea r15, [rcx + rsi]
mov qword [rbp - 0x40], r15
movzx eax, word [r15 + 0x2e]
add rax, rcx
add rsi, rax
movzx edx, dil
lea rcx, [rbp + 0x10]
call fcn.1400029f0
nop
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rsi + r8 + 0x30], 0
jne 0x1400fed00
lea rdx, [rsi + 0x30]
lea rcx, [rbp + 0x10]
call fcn.140004460
nop
lea rcx, [rbp + 0x10]
call fcn.140001bc0
mov rdx, qword [rbp - 0x50]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x14010124f
lea rdx, [r15 + 0x30]
lea rcx, [rbp - 0x10]
call fcn.1400042d0
nop
mov dword [rsp + 0x58], 0x4745b4bb
mov dword [rsp + 0x5c], 0x44403c35
mov word [rsp + 0x60], 0x4147
mov byte [rsp + 0x62], 0xfa
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x63], xmm0
mov qword [rsp + 0x73], rax
mov r8, qword [0x14022e4a8]
mov r9, qword [0x14022e4a0]
nop
mov rsi, r14
cmp rsi, 0x23
jae 0x1400ff949
movzx r11d, byte [rsp + rsi + 0x58]
movzx r10d, r11b
cmp r8, rsi
ja 0x1400ff940
lea rax, [r9 + 1]
cmp r8, rax
jae 0x1400fedcd
movabs r15, 0xd955740697c026fe
lea rcx, [rsi + r15]
mov rax, rcx
and rax, r11
imul r13, rax, 0xfffffffffffffffe
add r13, rcx
add r13, r11
add r13b, 0xe
jmp 0x1400fee03
je 0x1400ff8be
inc rax
cmp r8, rax
je 0x1400ff830
lea rax, [r9 + 3]
cmp r8, rax
je 0x1400ff7f3
lea rax, [r9 + 5]
cmp r8, rax
je 0x1400ff7ce
movabs r15, 0xd955740697c026fe
movzx r10d, r11b
cmp r9, rsi
ja 0x1400ff937
lea rax, [r9 + 0x2a]
cmp r8, rax
jae 0x1400fee3f
movabs rdx, 0xd402848a72c332d6
add rdx, rsi
movzx eax, dl
and al, r11b
mov ecx, reloc.WS2_32.dll_send
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r10b
add r13b, dl
jmp 0x1400fee73
lea rcx, [r9 + 1]
cmp r8, rcx
je 0x1400ff77c
lea rax, [r9 + 3]
cmp r8, rax
je 0x1400ff74d
lea rax, [rcx + 1]
cmp r8, rax
je 0x1400ff6ff
lea rax, [r9 + 5]
cmp r8, rax
je 0x1400ff6da
lea rax, [r9 + r8]
cmp rax, rsi
jbe 0x1400ff402
lea rcx, [r9 + 0x1000]
cmp r8, rcx
je 0x1400ff3de
lea rax, [r9 + 0x20]
cmp r8, rax
je 0x1400ff3b6
lea rax, [r9 + 0x3e8]
cmp r8, rax
je 0x1400ff391
lea rax, [r9 + 0xa]
cmp r8, rax
je 0x1400ff36d
lea rax, [r9 + 0x2a]
cmp r8, rax
je 0x1400ff34b
lea rax, [r9 + 0x80]
cmp r8, rax
je 0x1400ff331
lea rax, [r9 + 0x41]
cmp r8, rax
je 0x1400ff312
lea rax, [r9 + 0x42]
cmp r8, rax
je 0x1400ff2f8
lea rax, [r9 + 5]
cmp r8, rax
je 0x1400ff2d0
lea rax, [r9 + 0x28]
cmp r8, rax
je 0x1400fee80
mov r8, rcx
lea r9, [rcx + 3]
lea rcx, [r9 + 0x20]
cmp r8, rcx
jb 0x1400ff916
lea rax, [r9 + 2]
cmp r8, rax
jb 0x1400ff8f5
lea rax, [r9 + 0xa]
cmp r8, rax
jb 0x1400ff086
lea rax, [r9 + 0x2a]
cmp r8, rax
jb 0x1400ff05d
lea rax, [r9 + 0x80]
cmp r8, rax
jb 0x1400ff035
lea rax, [r9 + 0x41]
cmp r8, rax
jb 0x1400ff27c
lea rax, [r9 + 0x42]
cmp r8, rax
jb 0x1400ff234
lea rax, [r9 + 5]
cmp r8, rax
jb 0x1400ff1f4
lea rax, [r9 + 0x28]
cmp r8, rax
jb 0x1400ff1cd
lea rax, [r9 + 3]
cmp r8, rax
jb 0x1400fee80
mov r8, rcx
lea r9, [rcx + 0x400]
lea rcx, [r9 + 2]
cmp r8, rcx
ja 0x1400ff1a0
lea rax, [r9 + 0xa]
cmp r8, rax
ja 0x1400ff181
lea rax, [r9 + 0x2a]
cmp r8, rax
ja 0x1400ff167
lea rax, [r9 + 0x80]
cmp r8, rax
ja 0x1400ff14d
lea rax, [r9 + 0x41]
cmp r8, rax
ja 0x1400ff130
lea rax, [r9 + 0x42]
cmp r8, rax
ja 0x1400ff116
lea rax, [r9 + 5]
cmp r8, rax
ja 0x1400ff0f6
lea rax, [r9 + 0x61]
cmp r8, rax
ja 0x1400ff0ce
lea rax, [r9 + 3]
cmp r8, rax
ja 0x1400ff0af
lea rax, [r9 + 0x400]
cmp r8, rax
ja 0x1400fee80
mov r8, rcx
lea r9, [rcx + 0x10]
jmp 0x1400fee80
movabs rdx, 0x165ff9465552bea
add rdx, rsi
movzx eax, dl
and al, r11b
add al, al
movzx r13d, r10b
sub r13b, al
sub r13b, 0x66
add r13b, dl
jmp 0x1400fee73
movabs rdx, 0x4ebb178735d4ddee
add rdx, rsi
movzx eax, dl
and al, r11b
mov ecx, 0x3f
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r10b
add r13b, dl
jmp 0x1400fee07
movabs rdx, 0x9c102f7a06548ff2
add rdx, rsi
movzx eax, dl
and al, r11b
mov ecx, Ordinal_50
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r10b
add r13b, dl
jmp 0x1400fed97
lea edx, [rsi - 0x50]
movzx eax, dl
and al, r11b
mov ecx, Ordinal_26
sub cl, al
lea r13d, [rcx + rcx]
add r13b, dl
add r13b, r11b
jmp 0x1400ff7a0
lea edx, [rsi - 0x4c]
movzx eax, dl
and al, r11b
mov ecx, 0xa
sub cl, al
lea r13d, [rcx + rcx]
add r13b, dl
add r13b, r11b
inc r9
dec rsi
inc rsi
jmp 0x1400fed83
lea ecx, [rsi - 0x48]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r13d, [r11 + rcx]
sub r13b, 8
dec rsi
inc rsi
jmp 0x1400fed83
lea ecx, [rsi - 0x44]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r13d, [r11 + rcx]
sub r13b, 0x24
jmp 0x1400ff722
lea ecx, [rsi - 0x40]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r13d, [r11 + rcx]
sub r13b, 0x40
add r8, r9
jmp 0x1400ff817
lea ecx, [rsi - 0x3c]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r13d, [r11 + rcx]
sub r13b, 0x5c
jmp 0x1400ff817
lea ecx, [rsi - 0x38]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r13d, [r11 + rcx]
sub r13b, 0x78
jmp 0x1400ff858
lea edx, [rsi - 0x34]
movzx eax, dl
and al, r11b
mov ecx, gethostname
sub cl, al
lea r13d, [rcx + rcx]
add r13b, dl
add r13b, r11b
jmp 0x1400ff884
lea edx, [rsi - 0x30]
movzx eax, dl
and al, r11b
mov ecx, Ordinal_41
sub cl, al
lea r13d, [rcx + rcx]
add r13b, dl
add r13b, r11b
movzx eax, byte [rsp + rsi + 0x58]
add rax, r9
add rsi, rax
inc rsi
jmp 0x1400fed83
lea edx, [rsi - 0x26]
movzx eax, dl
and al, r11b
mov ecx, 5
sub cl, al
lea r13d, [rcx + rcx]
add r13b, dl
add r13b, r11b
mov byte [rsp + rsi + 0x58], r13b
inc rsi
jmp 0x1400fed83
lea ecx, [rsi - 0x22]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r13d, [r11 + rcx]
sub r13b, 0x12
cmp r9, 0x64
jb 0x1400ff1e7
movzx r10d, sil
lea ecx, [r10 + 0x34]
movzx eax, cl
and al, r11b
mov edx, 0xa
sub dl, al
add dl, dl
add dl, cl
add dl, r11b
lea r13d, [rdx + rdx]
jmp 0x1400ff7a4
lea ecx, [rsi - 0x1e]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r13d, [r11 + rcx]
sub r13b, 0x2e
cmp r8, 0x5a
jae 0x1400ff69c
lea rax, [r9 + 8]
cmp r8, rax
jbe 0x1400ff5ba
lea edx, [rsi + 0x5c]
movzx eax, dl
and al, r11b
mov ecx, 0x3e
sub cl, al
lea r13d, [rcx + rcx]
add r13b, dl
add r13b, r11b
jmp 0x1400ff209
lea ecx, [rsi - 0x1a]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r13d, [r11 + rcx]
sub r13b, 0x4a
lea rax, [r9 + r8]
cmp rax, 0x200
je 0x1400ff6bf
lea rax, [r9 + 0x80]
cmp r8, rax
jbe 0x1400ff4d8
lea edx, [rsi - 0x7a]
movzx eax, dl
and al, r11b
mov ecx, Ordinal_45
sub cl, al
lea r13d, [rcx + rcx]
add r13b, dl
add r13b, r11b
jmp 0x1400ff249
lea ecx, [rsi + 4]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r13d, [r11 + rcx]
sub r13b, 0x1c
movzx eax, byte [rsp + rsi + 0x58]
add rax, r9
add rsi, rax
inc rsi
jmp 0x1400fed83
lea ecx, [rsi + 8]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r13d, [r11 + rcx]
sub r13b, 0x38
jmp 0x1400ff884
movzx r10d, sil
lea ecx, [r10 + 0xc]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r13d, [r11 + rcx]
sub r13b, 0x54
jmp 0x1400ff85c
lea ecx, [rsi + 0x10]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r13d, [r11 + rcx]
sub r13b, 0x70
jmp 0x1400ff817
lea edx, [rsi + 0x14]
movzx eax, dl
and al, r11b
mov ecx, Ordinal_60
sub cl, al
lea r13d, [rcx + rcx]
add r13b, dl
add r13b, r11b
add r8, r9
jmp 0x1400ff817
movzx r10d, sil
lea edx, [r10 + 0x18]
movzx eax, dl
and al, r11b
mov ecx, Ordinal_45
sub cl, al
lea r13d, [rcx + rcx]
add r13b, dl
add r13b, r11b
jmp 0x1400ff726
lea edx, [rsi + 0x1c]
movzx eax, dl
and al, r11b
mov ecx, reloc.WLDAP32.dll_Ordinal_30
sub cl, al
lea r13d, [rcx + rcx]
add r13b, dl
add r13b, r11b
dec rsi
inc rsi
jmp 0x1400fed83
lea edx, [rsi + 0x20]
movzx eax, dl
and al, r11b
mov ecx, reloc.WS2_32.dll_recv
sub cl, al
lea r13d, [rcx + rcx]
add r13b, dl
add r13b, r11b
inc r9
dec rsi
inc rsi
jmp 0x1400fed83
movzx r10d, sil
lea edx, [r10 + 0x24]
movzx eax, dl
and al, r11b
mov ecx, 2
sub cl, al
lea r13d, [rcx + rcx]
add r13b, dl
add r13b, r11b
jmp 0x1400ff7a4
lea rax, [r9 + 9]
cmp r8, rax
jae 0x1400ff42b
lea rdx, [rsi + r15]
movzx eax, dl
and al, r11b
mov ecx, 7
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r10b
add r13b, dl
jmp 0x1400ff291
lea rcx, [r9 + 1]
cmp r8, rcx
jne 0x1400ff461
lea edx, [rsi - 0x54]
movzx eax, dl
and al, r11b
mov ecx, Ordinal_41
sub cl, al
lea r13d, [rcx + rcx]
add r13b, dl
add r13b, r11b
movzx eax, byte [rsp + rsi + 0x58]
add rax, r9
add rsi, rax
inc rsi
jmp 0x1400fed83
lea rax, [r9 + 3]
cmp r8, rax
jne 0x1400ff489
movzx r10d, sil
lea ecx, [r10 - 0x5c]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r13d, [r11 + rcx]
sub r13b, 0x7c
jmp 0x1400ff85c
lea rax, [rcx + 1]
cmp r8, rax
jne 0x1400ff4ac
lea ecx, [rsi - 0x60]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r13d, [r11 + rcx]
sub r13b, 0x60
jmp 0x1400ff817
lea rax, [r9 + 5]
cmp r8, rax
jne 0x1400ff291
movzx r10d, sil
lea ecx, [r10 - 0x68]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r13d, [r11 + rcx]
sub r13b, 0x28
jmp 0x1400ff726
lea rax, [r9 + 1]
cmp r8, rax
jne 0x1400ff505
movzx r10d, sil
lea edx, [r10 - 0x7e]
movzx eax, dl
and al, r11b
mov ecx, reloc.WS2_32.dll_gethostname
sub cl, al
lea r13d, [rcx + rcx]
add r13b, dl
add r13b, r11b
jmp 0x1400ff7a4
inc rax
cmp r8, rax
jne 0x1400ff530
lea ecx, [rsi + 0x7e]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r13d, [r11 + rcx]
sub r13b, 0x72
inc r9
dec rsi
inc rsi
jmp 0x1400fed83
lea rax, [r9 + 4]
cmp r8, rax
jne 0x1400ff553
lea ecx, [rsi + 0x6e]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r13d, [r11 + rcx]
sub r13b, 2
jmp 0x1400ff817
lea rax, [r9 + 3]
cmp r8, rax
jne 0x1400ff580
movzx r10d, sil
lea edx, [r10 + 0x6a]
movzx eax, dl
and al, r11b
mov ecx, reloc.WS2_32.dll_listen
sub cl, al
lea r13d, [rcx + rcx]
add r13b, dl
add r13b, r11b
jmp 0x1400ff85c
lea rax, [r9 + 9]
cmp r8, rax
jne 0x1400ff249
lea edx, [rsi + 0x62]
movzx eax, dl
and al, r11b
mov ecx, reloc.WLDAP32.dll_Ordinal_41
sub cl, al
lea r13d, [rcx + rcx]
add r13b, dl
add r13b, r11b
movzx eax, byte [rsp + rsi + 0x58]
add rax, r9
add rsi, rax
inc rsi
jmp 0x1400fed83
lea rax, [r9 + 1]
cmp r8, rax
jne 0x1400ff5eb
lea ecx, [rsi + 0x58]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r13d, [r11 + rcx]
sub r13b, 0x68
movzx eax, byte [rsp + rsi + 0x58]
add rax, r9
add rsi, rax
inc rsi
jmp 0x1400fed83
inc rax
cmp r8, rax
jne 0x1400ff612
movzx r10d, sil
lea ecx, [r10 + 0x50]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r13d, [r11 + rcx]
sub r13b, 0x30
jmp 0x1400ff85c
lea rax, [r9 + 4]
cmp r8, rax
jne 0x1400ff63d
lea edx, [rsi + 0x48]
movzx eax, dl
and al, r11b
mov ecx, 4
sub cl, al
lea r13d, [rcx + rcx]
add r13b, dl
add r13b, r11b
add r8, r9
jmp 0x1400ff817
lea rax, [r9 + 5]
cmp r8, rax
jne 0x1400ff66a
movzx r10d, sil
lea edx, [r10 + 0x44]
movzx eax, dl
and al, r11b
mov ecx, reloc.WS2_32.dll_select
sub cl, al
lea r13d, [rcx + rcx]
add r13b, dl
add r13b, r11b
jmp 0x1400ff726
lea rax, [r9 + 2]
cmp r8, rax
jne 0x1400ff209
lea edx, [rsi + 0x40]
movzx eax, dl
and al, r11b
mov ecx, reloc.WLDAP32.dll_Ordinal_32
sub cl, al
lea r13d, [rcx + rcx]
add r13b, dl
add r13b, r11b
dec rsi
inc rsi
jmp 0x1400fed83
movzx r10d, sil
lea edx, [r10 + 0x30]
movzx eax, dl
and al, r11b
add al, al
movzx r13d, r11b
sub r13b, al
sub r13b, 0x50
add r13b, dl
add r13b, r11b
jmp 0x1400ff726
movzx r10d, sil
lea ecx, [r10 + 0x2c]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea r13d, [rcx - 0x34]
jmp 0x1400ff85c
movabs rcx, 0x403f4d98fc506be
add rcx, rsi
movzx eax, cl
and al, r11b
add al, al
sub r10b, al
lea r13d, [rcx + r10]
sub r13b, 0x32
jmp 0x1400ff817
movabs rdx, 0x9eae24bf30c46ac6
add rdx, rsi
movzx eax, dl
and al, r11b
add al, al
movzx r13d, r10b
sub r13b, al
sub r13b, 0x6a
add r13b, dl
movzx r10d, sil
add r10b, 0x2e
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
sub r10b, 0x42
add r10b, r11b
add r10b, r13b
mov byte [rsp + rsi + 0x58], r10b
add r8, r9
jmp 0x1400ff817
movabs rdx, 0xec033cb201441cca
add rdx, rsi
movzx eax, dl
and al, r11b
mov ecx, 0x3d
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r10b
add r13b, dl
dec rsi
inc rsi
jmp 0x1400fed83
movabs rdx, 0x86ad6c97a24380d2
add rdx, rsi
movzx eax, dl
and al, r11b
mov ecx, reloc.WLDAP32.dll_Ordinal_33
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r10b
add r13b, dl
movzx r10d, sil
add r10b, 0x32
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
sub r10b, 0x5e
add r10b, r11b
mov byte [rsp + rsi + 0x58], r10b
inc r9
dec rsi
inc rsi
jmp 0x1400fed83
movabs rcx, 0x56abfc488541acea
add rcx, rsi
movzx eax, cl
and al, r11b
add al, al
sub r10b, al
lea r13d, [rcx + r10]
sub r13b, 0x66
add r8, r9
jmp 0x1400ff817
movabs rdx, 0xa401143b55c15eee
add rdx, rsi
movzx eax, dl
and al, r11b
mov ecx, 0x3f
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r10b
add r13b, dl
movzx eax, r13b
mov rcx, 0xffffffffffffffff
sub rcx, rax
add rsi, rcx
inc rsi
jmp 0x1400fed83
movabs rdx, 0xf1562c2e264110f2
add rdx, rsi
movzx eax, dl
and al, r11b
mov ecx, Ordinal_50
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r10b
add r13b, dl
movzx r11d, r10b
movzx r10d, sil
add r10b, 0x2a
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
sub r10b, 0x26
add r10b, r11b
movzx eax, r10b
mov byte [rsp + rsi + 0x58], al
inc r9
add rax, r9
sub rsi, rax
lea ecx, [rsi + 0x28]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
sub cl, 0x18
add cl, r11b
mov byte [rsp + rsi + 0x58], cl
inc r8
mov rax, 0xffffffffffffffff
sub rax, r8
add rsi, rax
movzx eax, byte [rsp + rsi + 0x58]
add rax, r9
add rsi, rax
inc rsi
jmp 0x1400fed83
movabs rdx, 0x8c005c13c74074fa
add rdx, rsi
movzx eax, dl
and al, r11b
mov ecx, reloc.WS2_32.dll_setsockopt
sub cl, al
lea r13d, [rcx + rcx]
add r13b, r10b
add r13b, dl
movzx eax, byte [rsp + rsi + 0x58]
add rax, r9
add rsi, rax
inc rsi
jmp 0x1400fed83
sub sil, 0xa
movzx eax, sil
and al, r11b
mov ecx, reloc.WLDAP32.dll_Ordinal_35
sub cl, al
lea r13d, [rcx + rcx]
add r13b, sil
add r13b, r11b
jmp 0x1400fed80
sub sil, 6
movzx eax, sil
and al, r11b
mov ecx, reloc.WS2_32.dll_setsockopt
sub cl, al
lea r13d, [rcx + rcx]
add r13b, sil
add r13b, r11b
jmp 0x1400fed70
lea rcx, [rbp + 0x15a3200]
jmp 0x1400ff94e
lea rcx, [rbp + 0x5a58fe]
jmp 0x1400ff94e
lea rcx, [rsp + 0x58]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rsi, rax
movzx edx, bl
lea rcx, [rbp - 0x38]
call fcn.1400029f0
nop
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rsi + r8], 0
jne 0x1400ff970
mov rdx, rsi
lea rcx, [rbp - 0x38]
call fcn.140004460
nop
mov word [rbp - 0x78], 0xd68
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x76], xmm0
movups xmmword [rbp - 0x66], xmm0
mov byte [rbp - 0x56], al
nop dword [rax]
mov rax, qword [0x14022e4a8]
mov r9, qword [0x14022e4a0]
nop
cmp r14, 0x23
jae 0x140100650
movzx r11d, byte [rbp + r14 - 0x78]
mov esi, r11d
cmp rax, r14
ja 0x140100647
lea rcx, [r9 + 1]
cmp rax, rcx
jae 0x1400ff9f8
movabs rdx, 0xca563c59c84a2302
add rdx, r14
mov rcx, rdx
and rcx, rsi
imul r12, rcx, 0xfffffffffffffffe
add r12, rdx
add r12, rsi
sub r12b, 0xe
jmp 0x1400ffa3e
je 0x1401005cc
inc rcx
cmp rax, rcx
je 0x140100539
lea rcx, [r9 + 3]
cmp rax, rcx
je 0x140100502
lea rcx, [r9 + 5]
cmp rax, rcx
je 0x1401004e1
lea rcx, [r9 + 6]
cmp rax, rcx
je 0x14010049a
lea rcx, [r9 + 2]
cmp rax, rcx
je 0x14010044e
movzx r10d, r14b
cmp r9, r14
ja 0x14010063e
lea rcx, [r9 + 0x61]
cmp rax, rcx
jae 0x1400ffa6c
lea edx, [r10 + 0x2a]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r12d, [r11 + rdx]
sub r12b, 0x26
jmp 0x1400ffab0
lea rcx, [r9 + 1]
cmp rax, rcx
je 0x140100434
lea rcx, [r9 + 4]
cmp rax, rcx
je 0x140100429
lea rcx, [r9 + 3]
cmp rax, rcx
je 0x140100408
lea rcx, [r9 + 2]
cmp rax, rcx
je 0x1401003e8
lea rcx, [r9 + 6]
cmp rax, rcx
je 0x1401003bc
nop dword [rax]
lea rcx, [r9 + rax]
cmp rcx, r14
jbe 0x140100010
nop dword [rax]
lea rcx, [r9 + 0x28]
cmp rax, rcx
je 0x1400ffff3
lea rcx, [r9 + 8]
cmp rax, rcx
je 0x1400fffcd
lea rcx, [r9 + 0x20]
cmp rax, rcx
je 0x1400fffaa
lea rcx, [r9 + 6]
cmp rax, rcx
je 0x1400fff8d
lea rcx, [r9 + 0x10]
cmp rax, rcx
je 0x1400fff6d
lea rdx, [r9 + 0x42]
cmp rax, rdx
je 0x1400fff4c
lea rcx, [r9 + 0xa]
cmp rax, rcx
je 0x1400fff2b
lea rcx, [r9 + 0x40]
cmp rax, rcx
je 0x1400fff0a
lea rcx, [r9 + 9]
cmp rax, rcx
je 0x1400ffeda
mov rax, rdx
lea r9, [rdx + 8]
lea rcx, [r9 + 0xa]
cmp rdx, rcx
jb 0x14010061e
lea rcx, [r9 + 0x40]
cmp rdx, rcx
jb 0x1401005fe
lea rcx, [r9 + 9]
cmp rdx, rcx
jb 0x1400ffc85
lea rcx, [r9 + 0x28]
cmp rdx, rcx
jb 0x1400ffc65
lea rcx, [r9 + 0x80]
cmp rdx, rcx
jb 0x1400ffc44
lea rdx, [r9 + 0x20]
cmp rax, rdx
jb 0x1400ffe86
lea rcx, [r9 + 0x64]
cmp rax, rcx
jb 0x1400ffe39
lea rcx, [r9 + 0x10]
cmp rax, rcx
jb 0x1400ffdf4
lea rcx, [r9 + 0x42]
cmp rax, rcx
jb 0x1400ffdcf
mov rax, rdx
lea r9, [rdx + 0x40]
lea rcx, [r9 + 0x64]
cmp rdx, rcx
ja 0x1400ffda3
lea rcx, [r9 + 0x10]
cmp rdx, rcx
ja 0x1400ffd83
lea rcx, [r9 + 0x42]
cmp rdx, rcx
ja 0x1400ffd62
lea rcx, [r9 + 0x3e8]
cmp rdx, rcx
ja 0x1400ffd41
lea rcx, [r9 + 0x40]
cmp rdx, rcx
ja 0x1400ffd1d
lea rdx, [r9 + 0x200]
cmp rax, rdx
ja 0x1400ffd0f
lea rcx, [r9 + 0x28]
cmp rax, rcx
ja 0x1400ffce8
lea rcx, [r9 + 0x80]
cmp rax, rcx
ja 0x1400ffcc2
lea rcx, [r9 + 0x20]
cmp rax, rcx
ja 0x1400ffca5
mov rax, rdx
lea r9, [rdx + 0x400]
jmp 0x1400ffac0
lea r8d, [r10 + 0x16]
movzx ecx, r11b
and cl, r8b
mov edx, 0x33
sub dl, cl
lea r12d, [rdx + rdx]
add r12b, r11b
add r12b, r8b
jmp 0x1400ffab0
lea r8d, [r10 + 0x12]
movzx ecx, r11b
and cl, r8b
add cl, cl
movzx r12d, r11b
sub r12b, cl
sub r12b, 0x7e
add r12b, r8b
jmp 0x1400ffa42
add r10b, 0xe
movzx ecx, r11b
and cl, r10b
add cl, cl
movzx r12d, r11b
sub r12b, cl
sub r12b, 0x62
add r12b, r10b
jmp 0x1400ff9c3
lea r8d, [r10 + 0x50]
movzx ecx, r11b
and cl, r8b
add cl, cl
movzx r12d, r11b
sub r12b, cl
sub r12b, 0x30
jmp 0x14010046a
add r10b, 0x4c
movzx ecx, r11b
and cl, r10b
add cl, cl
sub r11b, cl
lea r12d, [r10 + r11]
sub r12b, 0x14
inc r9
dec r14
inc r14
jmp 0x1400ff9b0
add r10b, 0x48
movzx ecx, r11b
and cl, r10b
mov edx, 4
sub dl, cl
lea r12d, [rdx + rdx]
add r12b, r11b
add r12b, r10b
dec r14
inc r14
jmp 0x1400ff9b0
lea r8d, [r10 + 0x44]
mov edx, reloc.WS2_32.dll_select
jmp 0x1401004a7
add r10b, 0x40
movzx ecx, r11b
and cl, r10b
mov edx, reloc.WLDAP32.dll_Ordinal_32
sub dl, cl
lea r12d, [rdx + rdx]
add r12b, r11b
add r12b, r10b
add rax, r9
jmp 0x140100520
add r10b, 0x3c
movzx ecx, r11b
and cl, r10b
mov edx, reloc.WLDAP32.dll_Ordinal_46
sub dl, cl
lea r12d, [rdx + rdx]
add r12b, r11b
add r12b, r10b
jmp 0x140100520
lea r8d, [r10 + 0x38]
movzx ecx, r11b
and cl, r8b
mov edx, reloc.WLDAP32.dll_Ordinal_60
sub dl, cl
lea r12d, [rdx + rdx]
add r12b, r11b
add r12b, r8b
jmp 0x14010055e
add r10b, 0x34
movzx ecx, r11b
and cl, r10b
add cl, cl
movzx r12d, r11b
sub r12b, cl
sub r12b, 0x6c
add r12b, r10b
jmp 0x140100589
add r10b, 0x30
movzx ecx, r11b
and cl, r10b
add cl, cl
sub r11b, cl
lea r12d, [r10 + r11]
sub r12b, 0x50
movzx ecx, byte [rbp + r14 - 0x78]
add rcx, r9
add r14, rcx
inc r14
jmp 0x1400ff9b0
add r10b, 0x26
movzx ecx, r11b
and cl, r10b
add cl, cl
sub r11b, cl
lea r12d, [r10 + r11]
sub r12b, 0xa
mov byte [rbp + r14 - 0x78], r12b
inc r14
jmp 0x1400ff9b0
lea r8d, [r10 + 0x22]
movzx ecx, r11b
and cl, r8b
mov edx, 9
sub dl, cl
lea r12d, [rdx + rdx]
add r12b, r11b
add r12b, r8b
cmp r9, 5
jb 0x1400ffde7
lea r8d, [r10 - 0x34]
movzx ecx, r11b
and cl, r8b
add cl, cl
movzx edx, r11b
sub dl, cl
add dl, r8b
lea r12d, [rdx*2 - 0x28]
jmp 0x14010046d
lea r8d, [r10 + 0x1e]
movzx ecx, r11b
and cl, r8b
mov edx, reloc.WS2_32.dll_socket
sub dl, cl
lea r12d, [rdx + rdx]
add r12b, r11b
add r12b, r8b
cmp rax, 9
jae 0x140100381
lea rcx, [r9 + 0x10]
cmp rax, rcx
jbe 0x14010024b
lea r8d, [r10 - 0x5c]
movzx ecx, r11b
and cl, r8b
add cl, cl
movzx r12d, r11b
sub r12b, cl
sub r12b, 0x7c
jmp 0x1400ffe0d
lea r8d, [r10 + 0x1a]
movzx ecx, r11b
and cl, r8b
mov edx, Ordinal_41
sub dl, cl
lea r12d, [rdx + rdx]
add r12b, r11b
add r12b, r8b
lea rcx, [r9 + rax]
cmp rcx, 2
je 0x14010039e
lea rcx, [r9 + 4]
cmp rax, rcx
jbe 0x140100161
lea r8d, [r10 + 0x7a]
movzx ecx, r11b
and cl, r8b
add cl, cl
movzx r12d, r11b
sub r12b, cl
sub r12b, 0x56
jmp 0x1400ffe52
sub r10b, 4
movzx ecx, r11b
and cl, r10b
mov edx, recv
sub dl, cl
lea r12d, [rdx + rdx]
add r12b, r11b
add r12b, r10b
movzx ecx, byte [rbp + r14 - 0x78]
add rcx, r9
add r14, rcx
inc r14
jmp 0x1400ff9b0
sub r10b, 8
movzx ecx, r11b
and cl, r10b
mov edx, Ordinal_30
sub dl, cl
lea r12d, [rdx + rdx]
add r12b, r11b
add r12b, r10b
jmp 0x140100589
lea r8d, [r10 - 0xc]
movzx ecx, r11b
and cl, r8b
mov edx, Ordinal_45
sub dl, cl
lea r12d, [rdx + rdx]
add r12b, r11b
add r12b, r8b
jmp 0x14010055e
sub r10b, 0x10
movzx ecx, r11b
and cl, r10b
mov edx, gethostname
sub dl, cl
lea r12d, [rdx + rdx]
add r12b, r11b
add r12b, r10b
jmp 0x140100520
sub r10b, 0x14
movzx ecx, r11b
and cl, r10b
add cl, cl
sub r11b, cl
lea r12d, [r10 + r11]
sub r12b, 0x74
add rax, r9
jmp 0x140100520
lea r8d, [r10 - 0x18]
movzx ecx, r11b
and cl, r8b
add cl, cl
movzx r12d, r11b
sub r12b, cl
sub r12b, 0x58
jmp 0x1401004b7
sub r10b, 0x1c
movzx ecx, r11b
and cl, r10b
add cl, cl
sub r11b, cl
lea r12d, [r10 + r11]
sub r12b, 0x3c
dec r14
inc r14
jmp 0x1400ff9b0
sub r10b, 0x20
movzx ecx, r11b
and cl, r10b
add cl, cl
sub r11b, cl
lea r12d, [r10 + r11]
sub r12b, 0x20
inc r9
dec r14
inc r14
jmp 0x1400ff9b0
lea r8d, [r10 - 0x24]
movzx ecx, r11b
and cl, r8b
add cl, cl
movzx r12d, r11b
sub r12b, cl
sub r12b, 4
jmp 0x14010046a
lea rcx, [r9 + 0x2a]
cmp rax, rcx
jae 0x140100036
lea r8d, [r10 + 2]
movzx ecx, r11b
and cl, r8b
add cl, cl
movzx r12d, r11b
sub r12b, cl
sub r12b, 0xe
jmp 0x1400ffe9f
lea rcx, [r9 + 1]
cmp rax, rcx
jne 0x14010006b
add r10b, 0x54
movzx ecx, r11b
and cl, r10b
add cl, cl
sub r11b, cl
lea r12d, [r10 + r11]
sub r12b, 0x4c
movzx ecx, byte [rbp + r14 - 0x78]
add rcx, r9
add r14, rcx
inc r14
jmp 0x1400ff9b0
inc rcx
cmp rax, rcx
jne 0x140100094
lea r8d, [r10 + 0x5c]
movzx ecx, r11b
and cl, r8b
mov edx, 0x3e
sub dl, cl
lea r12d, [rdx + rdx]
add r12b, r11b
add r12b, r8b
jmp 0x14010055e
lea rcx, [r9 + 3]
cmp rax, rcx
jne 0x1401000c1
add r10b, 0x64
movzx ecx, r11b
and cl, r10b
mov edx, Ordinal_35
sub dl, cl
lea r12d, [rdx + rdx]
add r12b, r11b
add r12b, r10b
add rax, r9
jmp 0x140100520
lea rcx, [r9 + 5]
cmp rax, rcx
jne 0x1401000d8
lea r8d, [r10 + 0x68]
mov edx, reloc.WS2_32.dll_sendto
jmp 0x1401004a7
lea rcx, [r9 + 7]
cmp rax, rcx
jne 0x140100108
add r10b, 0x6c
movzx ecx, r11b
and cl, r10b
mov edx, 6
sub dl, cl
lea r12d, [rdx + rdx]
add r12b, r11b
add r12b, r10b
dec r14
inc r14
jmp 0x1400ff9b0
lea rcx, [r9 + 4]
cmp rax, rcx
jne 0x140100137
add r10b, 0x70
movzx ecx, r11b
and cl, r10b
add cl, cl
sub r11b, cl
lea r12d, [r10 + r11]
sub r12b, 0x10
inc r9
dec r14
inc r14
jmp 0x1400ff9b0
lea rcx, [r9 + 9]
cmp rax, rcx
jne 0x1400ffea2
lea r8d, [r10 + 0x74]
movzx ecx, r11b
and cl, r8b
add cl, cl
movzx r12d, r11b
sub r12b, cl
sub r12b, 0x2c
jmp 0x14010046a
lea rcx, [r9 + 1]
cmp rax, rcx
jne 0x140100187
lea r8d, [r10 + 0x7e]
movzx ecx, r11b
and cl, r8b
add cl, cl
movzx r12d, r11b
sub r12b, cl
sub r12b, 0x72
jmp 0x14010046a
inc rcx
cmp rax, rcx
jne 0x1401001b9
sub r10b, 0x7e
movzx ecx, r11b
and cl, r10b
mov edx, reloc.WS2_32.dll_gethostname
sub dl, cl
lea r12d, [rdx + rdx]
add r12b, r11b
add r12b, r10b
inc r9
dec r14
inc r14
jmp 0x1400ff9b0
lea rcx, [r9 + 3]
cmp rax, rcx
jne 0x1401001e9
sub r10b, 0x7a
movzx ecx, r11b
and cl, r10b
mov edx, Ordinal_45
sub dl, cl
lea r12d, [rdx + rdx]
add r12b, r11b
add r12b, r10b
dec r14
inc r14
jmp 0x1400ff9b0
lea rcx, [r9 + 6]
cmp rax, rcx
jne 0x140100212
lea r8d, [r10 - 0x6a]
movzx ecx, r11b
and cl, r8b
add cl, cl
movzx r12d, r11b
sub r12b, cl
sub r12b, 0x1a
add r12b, r8b
jmp 0x14010055e
lea rcx, [r9 + 5]
cmp rax, rcx
jne 0x1400ffe55
sub r10b, 0x62
movzx ecx, r11b
and cl, r10b
add cl, cl
sub r11b, cl
lea r12d, [r10 + r11]
sub r12b, 0x52
movzx ecx, byte [rbp + r14 - 0x78]
add rcx, r9
add r14, rcx
inc r14
jmp 0x1400ff9b0
lea rcx, [r9 + 1]
cmp rax, rcx
jne 0x140100284
sub r10b, 0x58
movzx ecx, r11b
and cl, r10b
mov edx, 0x34
sub dl, cl
lea r12d, [rdx + rdx]
add r12b, r11b
add r12b, r10b
movzx ecx, byte [rbp + r14 - 0x78]
add rcx, r9
add r14, rcx
inc r14
jmp 0x1400ff9b0
inc rcx
cmp rax, rcx
jne 0x1401002ad
lea r8d, [r10 - 0x50]
movzx ecx, r11b
and cl, r8b
mov edx, Ordinal_26
sub dl, cl
lea r12d, [rdx + rdx]
add r12b, r11b
add r12b, r8b
jmp 0x14010055e
lea rcx, [r9 + 4]
cmp rax, rcx
jne 0x1401002d6
sub r10b, 0x48
movzx ecx, r11b
and cl, r10b
add cl, cl
sub r11b, cl
lea r12d, [r10 + r11]
sub r12b, 8
add rax, r9
jmp 0x140100520
lea rcx, [r9 + 3]
cmp rax, rcx
jne 0x1401002fc
lea r8d, [r10 - 0x44]
movzx ecx, r11b
and cl, r8b
add cl, cl
movzx r12d, r11b
sub r12b, cl
sub r12b, 0x24
jmp 0x1401004b7
lea rcx, [r9 + 5]
cmp rax, rcx
jne 0x140100328
sub r10b, 0x40
movzx ecx, r11b
and cl, r10b
add cl, cl
sub r11b, cl
lea r12d, [r10 + r11]
sub r12b, 0x40
dec r14
inc r14
jmp 0x1400ff9b0
lea rcx, [r9 + 7]
cmp rax, rcx
jne 0x140100357
sub r10b, 0x3c
movzx ecx, r11b
and cl, r10b
add cl, cl
sub r11b, cl
lea r12d, [r10 + r11]
sub r12b, 0x5c
inc r9
dec r14
inc r14
jmp 0x1400ff9b0
lea rcx, [r9 + 8]
cmp rax, rcx
jne 0x1400ffe10
lea r8d, [r10 - 0x38]
movzx ecx, r11b
and cl, r8b
add cl, cl
movzx r12d, r11b
sub r12b, cl
sub r12b, 0x78
jmp 0x14010046a
lea r8d, [r10 - 0x30]
movzx ecx, r11b
and cl, r8b
movzx edx, r11b
sub dl, cl
add dl, 0x28
lea r12d, [rdx + rdx]
jmp 0x1401004b7
lea r8d, [r10 - 0x2c]
movzx ecx, r11b
and cl, r8b
mov edx, reloc.WLDAP32.dll_Ordinal_26
sub dl, cl
lea r12d, [rdx + rdx]
add r12b, r8b
jmp 0x14010055e
add r10b, 0x4e
movzx ecx, r11b
and cl, r10b
add cl, cl
sub r11b, cl
lea r12d, [r10 + r11]
sub r12b, 0x22
movzx ecx, byte [rbp + r14 - 0x78]
add rcx, r9
add r14, rcx
inc r14
jmp 0x1400ff9b0
add r10b, 0x4a
movzx ecx, r11b
and cl, r10b
add cl, cl
movzx r12d, r11b
sub r12b, cl
sub r12b, 6
add r12b, r10b
jmp 0x140100589
add r10b, 0x42
movzx ecx, r11b
and cl, r10b
mov edx, Ordinal_26
sub dl, cl
lea r12d, [rdx + rdx]
add r12b, r11b
add r12b, r10b
jmp 0x140100520
lea r8d, [r10 + 0x3a]
mov edx, gethostname
jmp 0x1401004a7
lea r8d, [r10 + 0x2e]
movzx ecx, r11b
and cl, r8b
add cl, cl
movzx r12d, r11b
sub r12b, cl
sub r12b, 0x42
jmp 0x14010046a
movzx r10d, r14b
lea r8d, [r10 + 0x26]
movzx ecx, r11b
and cl, r8b
add cl, cl
movzx r12d, r11b
sub r12b, cl
sub r12b, 0xa
add r12b, r8b
sub r10b, 0x32
movzx ecx, r11b
and cl, r10b
mov edx, Ordinal_50
sub dl, cl
add dl, dl
add dl, r11b
add dl, r10b
mov byte [rbp + r14 - 0x78], dl
inc r9
dec r14
inc r14
jmp 0x1400ff9b0
movzx r10d, r14b
lea r8d, [r10 + 0x1a]
mov edx, Ordinal_41
movzx ecx, r11b
and cl, r8b
sub dl, cl
lea r12d, [rdx + rdx]
add r12b, r11b
add r12b, r8b
sub r10b, 0x2e
movzx ecx, r11b
and cl, r10b
mov edx, reloc.WLDAP32.dll_Ordinal_33
sub dl, cl
add dl, dl
add dl, r11b
add dl, r10b
add dl, r12b
mov byte [rbp + r14 - 0x78], dl
add rax, r9
jmp 0x140100520
lea r8d, [r14 + 0x16]
movzx ecx, r11b
and cl, r8b
mov edx, 0x33
sub dl, cl
lea r12d, [rdx + rdx]
add r12b, r11b
add r12b, r8b
add rax, r9
jmp 0x140100520
movabs rcx, 0x1d081f280a9b3b12
add rcx, r14
and sil, cl
add sil, sil
sub r11b, sil
lea r12d, [rcx + r11]
sub r12b, 0x7e
movzx ecx, r12b
mov rdx, 0xffffffffffffffff
sub rdx, rcx
add r14, rdx
inc r14
jmp 0x1400ff9b0
movabs rdx, 0x885ba6747a06f50e
add rdx, r14
and sil, dl
add sil, sil
movzx r12d, r11b
sub r12b, sil
sub r12b, 0x62
add r12b, dl
movzx r10d, r14b
sub r10b, 0x2a
movzx ecx, r10b
and cl, r11b
mov edx, reloc.WS2_32.dll_send
sub dl, cl
add dl, dl
add dl, r10b
add dl, r11b
movzx ecx, dl
mov byte [rbp + r14 - 0x78], cl
inc r9
add rcx, r9
sub r14, rcx
lea r8d, [r14 - 0x28]
movzx ecx, r8b
and cl, r11b
mov edx, recv
sub dl, cl
add dl, dl
add dl, r8b
add dl, r11b
mov byte [rbp + r14 - 0x78], dl
inc rax
mov rcx, 0xffffffffffffffff
sub rcx, rax
add r14, rcx
movzx ecx, byte [rbp + r14 - 0x78]
add rcx, r9
add r14, rcx
inc r14
jmp 0x1400ff9b0
movabs rcx, 0x5f02b50d58de6906
add rcx, r14
and sil, cl
add sil, sil
sub r11b, sil
lea r12d, [rcx + r11]
sub r12b, 0x2a
movzx ecx, byte [rbp + r14 - 0x78]
add rcx, r9
add r14, rcx
inc r14
jmp 0x1400ff9b0
add r10b, 0xa
movzx ecx, r11b
and cl, r10b
add cl, cl
sub r11b, cl
lea r12d, [r10 + r11]
sub r12b, 0x46
xor r14d, r14d
jmp 0x1400ff9b0
add r10b, 6
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea r12d, [r10 + r11]
sub r12b, 0x2a
xor r14d, r14d
jmp 0x1400ff9a0
lea rdx, [rbp + 0x14f84e0]
jmp 0x140100654
lea rdx, [rbp + 0x59a7e2]
jmp 0x140100654
lea rdx, [rbp - 0x78]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140100660
lea rcx, [rbp - 0x38]
call fcn.140003110
mov r15, rax
mov dword [rsp + 0x30], 0xaea38c8a
mov dword [rsp + 0x34], 0x8d939aae
mov dword [rsp + 0x38], 0x9fb4b0af
mov byte [rsp + 0x3c], Ordinal_35
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x3d], xmm0
mov dword [rsp + 0x4d], eax
mov word [rsp + 0x51], ax
nop word [rax + rax]
mov r8, qword [0x14022e4a8]
mov r9, qword [0x14022e4a0]
nop
xor esi, esi
mov r14d, esi
cmp r14, 0x23
jae 0x14010116a
movzx r11d, byte [rsp + r14 + 0x30]
mov edx, r11d
movzx r10d, r14b
nop dword [rax]
movzx esi, r10b
cmp r8, r14
ja 0x140101161
lea rax, [r9 + 1]
cmp r8, rax
jae 0x14010071c
movabs rcx, 0xf66b577f4b33a707
add rcx, r14
mov rax, rcx
and rax, rdx
imul rax, rax, 0xfffffffffffffffe
add rax, rcx
add rax, rdx
sub al, 0x31
mov qword [rsp + 0x20], rax
jmp 0x140100749
je 0x1401010e2
lea rax, [r9 + 3]
cmp r8, rax
je 0x1401010a8
lea rax, [r9 + 2]
cmp r8, rax
je 0x140101081
lea rax, [r9 + 7]
cmp r8, rax
je 0x14010103f
movzx r10d, r14b
nop dword [rax]
cmp r9, r14
ja 0x140101158
lea rax, [r9 + 0x28]
cmp r8, rax
jae 0x14010077d
lea ecx, [r10 - 0x6d]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
sub cl, 5
add cl, r11b
mov qword [rsp + 0x20], rcx
jmp 0x1401007c0
lea rcx, [r9 + 1]
cmp r8, rcx
je 0x140101026
lea rax, [r9 + 3]
cmp r8, rax
je 0x140100fff
lea rax, [rcx + 1]
cmp r8, rax
je 0x140100fc4
lea rax, [r9 + 5]
cmp r8, rax
je 0x140100fa8
lea rax, [r9 + 6]
cmp r8, rax
je 0x140100f24
nop
lea rax, [r9 + r8]
cmp rax, r14
jbe 0x140100c39
nop dword [rax]
lea rax, [r9 + 0x10]
cmp r8, rax
je 0x140100c1d
lea rax, [r9 + 0x7a]
cmp r8, rax
je 0x140100bf3
lea rax, [r9 + 0xa]
cmp r8, rax
je 0x140100bc9
lea rax, [r9 + 0x61]
cmp r8, rax
je 0x140100bad
lea rax, [r9 + 9]
cmp r8, rax
je 0x140100b8e
lea rax, [r9 + 0x1000]
cmp r8, rax
je 0x140100b69
lea rax, [r9 + 8]
cmp r8, rax
je 0x140100b4d
lea rax, [r9 + 0x400]
cmp r8, rax
je 0x140100b29
lea rax, [r9 + 6]
cmp r8, rax
je 0x140100b0d
lea rax, [r9 + 0x3e8]
cmp r8, rax
je 0x1401007d0
lea r8, [r9 + 0x5a]
lea r9, [r8 + 5]
lea rax, [r9 + 0x20]
cmp r8, rax
jb 0x140101137
lea rax, [r9 + 0x41]
cmp r8, rax
jb 0x140101116
lea rax, [r9 + 1]
cmp r8, rax
jb 0x140100979
lea rax, [r9 + 0x40]
cmp r8, rax
jb 0x14010095b
lea rax, [r9 + 0x2a]
cmp r8, rax
jb 0x14010093d
lea rax, [r9 + 0x28]
cmp r8, rax
jb 0x140100aee
lea rax, [r9 + 0x5a]
cmp r8, rax
jb 0x140100a78
lea rax, [r9 + 0x10]
cmp r8, rax
jb 0x1401007d0
lea r8, [r9 + 0x80]
lea r9, [r8 + 0x7a]
lea rax, [r9 + 3]
cmp r8, rax
ja 0x140100a5c
lea rax, [r9 + 0x64]
cmp r8, rax
ja 0x140100a39
lea rax, [r9 + 2]
cmp r8, rax
ja 0x140100a1c
lea rax, [r9 + 0x42]
cmp r8, rax
ja 0x1401009fb
lea rax, [r9 + 1]
cmp r8, rax
ja 0x1401009dc
lea rax, [r9 + 4]
cmp r8, rax
ja 0x1401009be
lea rax, [r9 + 0x80]
cmp r8, rax
ja 0x140100997
lea r8, [r9 + 9]
lea r9, [r8 + 0x42]
jmp 0x1401007d0
lea ecx, [r10 - 0x33]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
add cl, 0x65
add cl, r11b
mov qword [rsp + 0x20], rcx
jmp 0x1401007c0
lea ecx, [r10 - 0x41]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
sub cl, 0x39
add cl, r11b
mov qword [rsp + 0x20], rcx
jmp 0x140100750
lea ecx, [r10 - 0x4f]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
add cl, 0x29
add cl, r11b
mov qword [rsp + 0x20], rcx
jmp 0x1401006e0
add r10b, 0x7c
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea ecx, [r10 + r11]
sub cl, 0x64
mov qword [rsp + 0x20], rcx
dec r14
inc r14
jmp 0x1401006c5
add r10b, 0x6e
movzx eax, r11b
and al, r10b
add al, al
movzx ecx, r11b
sub cl, al
sub cl, 2
add cl, r10b
jmp 0x140100fdb
add r10b, 0x60
movzx eax, r11b
and al, r10b
mov ecx, Ordinal_50
sub cl, al
add cl, cl
add cl, r11b
add cl, r10b
jmp 0x1401010bf
add r10b, 0x52
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea edx, [r10 + r11]
sub dl, 0x3e
mov qword [rsp + 0x20], rdx
jmp 0x1401010ca
lea edx, [r10 + 0x44]
movzx eax, r11b
and al, dl
mov ecx, reloc.WS2_32.dll_select
sub cl, al
add cl, cl
add cl, r11b
add cl, dl
jmp 0x140100f38
add r10b, 0x36
movzx eax, r11b
and al, r10b
add al, al
movzx ecx, r11b
sub cl, al
sub cl, 0x7a
add cl, r10b
mov qword [rsp + 0x20], rcx
jmp 0x140100f67
add r10b, 0x28
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea ecx, [r10 + r11]
sub cl, 0x18
jmp 0x1401010fd
lea edx, [r10 - 0x17]
movzx eax, r11b
and al, dl
add al, al
movzx ecx, r11b
sub cl, al
sub dl, 0x5f
add cl, dl
movzx edx, cl
cmp r8, 4
jae 0x140100eea
lea rax, [r9 + 1]
cmp r8, rax
jbe 0x140100e3f
lea edx, [r10 + 0x3e]
movzx eax, r11b
and al, dl
mov ecx, Ordinal_41
sub cl, al
add cl, cl
add cl, r11b
add cl, dl
movzx edx, cl
cmp r9, 0x61
jb 0x140100ed8
sub r10b, 0x36
movzx eax, r11b
and al, r10b
add al, al
movzx ecx, r11b
sub cl, al
add cl, r10b
add cl, cl
sub cl, 0xc
jmp 0x140101052
lea edx, [r10 - 0x25]
movzx eax, r11b
and al, dl
add al, al
movzx ecx, r11b
sub cl, al
add dl, 3
add cl, dl
movzx edx, cl
jmp 0x140100d16
add r10b, 0x72
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea ecx, [r10 + r11]
sub cl, 0x1e
jmp 0x1401010fd
add r10b, 0x64
movzx eax, r11b
and al, r10b
mov ecx, Ordinal_35
sub cl, al
add cl, cl
add cl, r11b
add cl, r10b
mov qword [rsp + 0x20], rcx
jmp 0x140100f67
lea edx, [r10 + 0x56]
movzx eax, r11b
and al, dl
add al, al
movzx ecx, r11b
sub cl, al
sub cl, 0x5a
add cl, dl
jmp 0x140100f38
add r10b, 0x48
movzx eax, r11b
and al, r10b
mov ecx, 4
sub cl, al
lea edx, [rcx + rcx]
add dl, r11b
add dl, r10b
mov qword [rsp + 0x20], rdx
jmp 0x1401010ca
add r10b, 0x3a
movzx eax, r10b
and al, r11b
mov ecx, gethostname
sub cl, al
add cl, cl
add cl, r10b
add cl, r11b
jmp 0x1401010bf
add r10b, 0x2c
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea ecx, [r11 + r10]
sub cl, 0x34
jmp 0x140100fdb
add r10b, 0x1e
movzx eax, r10b
and al, r11b
mov ecx, reloc.WS2_32.dll_socket
sub cl, al
add cl, cl
add cl, r10b
add cl, r11b
mov qword [rsp + 0x20], rcx
dec r14
inc r14
jmp 0x1401006c5
add r10b, 0x10
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea ecx, [r11 + r10]
sub cl, 0x70
inc r9
mov qword [rsp + 0x20], rcx
dec r14
inc r14
jmp 0x1401006c5
add r10b, 2
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea ecx, [r11 + r10]
sub cl, 0xe
jmp 0x140101052
lea rax, [r9 + 0x41]
cmp r8, rax
jae 0x140100c5e
lea ecx, [r10 + 7]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
sub cl, 0x31
add cl, r11b
movzx edx, cl
jmp 0x140100d16
lea rax, [r9 + 1]
cmp r8, rax
jne 0x140100c83
add r10b, 0x26
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea ecx, [r11 + r10]
sub cl, 0xa
jmp 0x1401010fd
lea rax, [r9 + 3]
cmp r8, rax
jne 0x140100cab
add r10b, 0x5e
movzx eax, r10b
and al, r11b
mov ecx, gethostname
sub cl, al
add cl, cl
add cl, r10b
add cl, r11b
jmp 0x1401010bf
lea rax, [r9 + 2]
cmp r8, rax
jne 0x140100cdb
add r10b, 0x7a
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea ecx, [r11 + r10]
sub cl, 0x56
mov qword [rsp + 0x20], rcx
dec r14
inc r14
jmp 0x1401006c5
lea rax, [r9 + 5]
cmp r8, rax
jne 0x140100d11
sub r10b, 0x78
movzx eax, r10b
and al, r11b
mov ecx, 0x24
sub cl, al
add cl, cl
add cl, r10b
add cl, r11b
inc r9
mov qword [rsp + 0x20], rcx
dec r14
inc r14
jmp 0x1401006c5
mov rdx, qword [rsp + 0x20]
lea rax, [r9 + r8]
cmp rax, 3
je 0x140100f08
lea rax, [r9 + 0xa]
cmp r8, rax
jbe 0x140100d47
lea edx, [r10 - 0x55]
movzx eax, r11b
and al, dl
add al, al
movzx ecx, r11b
sub cl, al
add dl, 0x53
jmp 0x140100a8d
lea rax, [r9 + 1]
cmp r8, rax
jne 0x140100d6e
sub r10b, 0x47
movzx eax, r11b
and al, r10b
add al, al
movzx ecx, r11b
sub cl, al
sub cl, 0xf
add cl, r10b
jmp 0x140101052
inc rax
cmp r8, rax
jne 0x140100da0
sub r10b, 0x39
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea ecx, [r10 + r11]
sub cl, 0x71
inc r9
mov qword [rsp + 0x20], rcx
dec r14
inc r14
jmp 0x1401006c5
lea rax, [r9 + 5]
cmp r8, rax
jne 0x140100dc5
sub r10b, 0xf
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea ecx, [r10 + r11]
add cl, 0x69
jmp 0x1401010bf
lea rax, [r9 + 7]
cmp r8, rax
jne 0x140100dea
lea edx, [r10 + 0xd]
movzx eax, r11b
and al, dl
add al, al
movzx ecx, r11b
sub cl, al
sub cl, 0x5b
add cl, dl
jmp 0x140100f38
lea rax, [r9 + 6]
cmp r8, rax
jne 0x140100e16
add r10b, 0x1b
movzx eax, r11b
and al, r10b
add al, al
movzx ecx, r11b
sub cl, al
add cl, 0x43
add cl, r10b
mov qword [rsp + 0x20], rcx
jmp 0x140100f67
lea rax, [r9 + 9]
cmp r8, rax
jne 0x140100a92
add r10b, 0x29
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea ecx, [r10 + r11]
sub cl, 0x1f
jmp 0x1401010fd
jne 0x140100e5d
add r10b, 0x4c
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea ecx, [r10 + r11]
sub cl, 0x14
jmp 0x1401010fd
inc rax
cmp r8, rax
jne 0x140100e82
lea edx, [r10 + 0x68]
movzx eax, r11b
and al, dl
mov ecx, reloc.WS2_32.dll_sendto
sub cl, al
add cl, cl
add cl, r11b
add cl, dl
jmp 0x140100f38
lea rax, [r9 + 3]
cmp r8, rax
jne 0x140100eac
add r10b, 0x76
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea edx, [r10 + r11]
sub dl, 0x3a
mov qword [rsp + 0x20], rdx
jmp 0x1401010ca
lea rax, [r9 + 6]
cmp r8, rax
jne 0x140100ac4
sub r10b, 0x6e
movzx eax, r11b
and al, r10b
mov ecx, 1
sub cl, al
add cl, cl
add cl, r11b
add cl, r10b
jmp 0x140100fdb
mov byte [rsp + r14 + 0x30], dl
mov qword [rsp + 0x20], rdx
inc r14
jmp 0x1401006c5
sub r10b, 0x28
movzx eax, r11b
and al, r10b
movzx ecx, r11b
sub cl, al
add cl, 0xc
add cl, cl
add cl, r10b
jmp 0x140100fdb
lea edx, [r10 - 0x1a]
movzx eax, r11b
and al, dl
add al, al
movzx ecx, r11b
sub cl, al
sub cl, r11b
sub cl, 0x4a
add cl, dl
jmp 0x140100f38
lea ecx, [r10 - 0xb]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
add cl, 0x4d
add cl, r11b
mov qword [rsp + 0x20], rcx
sub r10b, 0x13
movzx eax, r11b
and al, r10b
add al, al
movzx ecx, r11b
sub cl, al
sub cl, 0x7b
add cl, r10b
movzx eax, cl
mov byte [rsp + r14 + 0x30], al
inc r9
add rax, r9
sub r14, rax
lea edx, [r14 - 0xc]
movzx eax, r11b
and al, dl
mov ecx, Ordinal_45
sub cl, al
add cl, cl
add cl, r11b
add cl, dl
mov byte [rsp + r14 + 0x30], cl
inc r8
mov rax, 0xffffffffffffffff
sub rax, r8
add r14, rax
movzx eax, byte [rsp + r14 + 0x30]
add rax, r9
add r14, rax
inc r14
jmp 0x1401006c5
sub r10b, 0x27
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea ecx, [r11 + r10]
add cl, 0x11
jmp 0x1401010bf
sub r10b, 0x35
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea ecx, [r11 + r10]
add cl, 0x73
sub sil, 0x21
movzx eax, r11b
and al, sil
add al, al
sub r11b, al
sub r11b, 0x19
add r11b, sil
add r11b, cl
mov byte [rsp + r14 + 0x30], r11b
jmp 0x1401010bf
sub r10b, 0x43
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea ecx, [r11 + r10]
sub cl, 0x2b
mov qword [rsp + 0x20], rcx
dec r14
inc r14
jmp 0x1401006c5
sub r10b, 0x5f
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea ecx, [r11 + r10]
sub cl, 0x67
jmp 0x140101052
lea ecx, [rsi - 0x7b]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
add cl, 0x5d
add cl, r11b
sub sil, 0x2f
movzx eax, r11b
and al, sil
add al, al
sub r11b, al
add r11b, 0x49
add r11b, sil
mov byte [rsp + r14 + 0x30], r11b
inc r9
mov qword [rsp + 0x20], rcx
dec r14
inc r14
jmp 0x1401006c5
add sil, 0x69
movzx eax, sil
and al, r11b
add al, al
sub sil, al
lea ecx, [r11 + rsi]
add cl, 0x21
mov qword [rsp + 0x20], rcx
dec r14
inc r14
jmp 0x1401006c5
add sil, 0x4d
movzx eax, sil
and al, r11b
add al, al
sub sil, al
lea ecx, [r11 + rsi]
sub cl, 0x1b
mov qword [rsp + 0x20], rcx
add r8, r9
mov rdx, rcx
movzx eax, dl
mov rcx, 0xffffffffffffffff
sub rcx, rax
add r14, rcx
inc r14
jmp 0x1401006c5
movabs rax, 0xe342067de19af515
add rax, r14
and dl, al
add dl, dl
sub r11b, dl
lea ecx, [rax + r11]
add cl, 0x6d
mov qword [rsp + 0x20], rcx
movzx eax, byte [rsp + r14 + 0x30]
add rax, r9
add r14, rax
inc r14
jmp 0x1401006c5
sub r10b, 0x5d
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea ecx, [r10 + r11]
sub cl, 0x75
mov qword [rsp + 0x20], rcx
jmp 0x1401006c0
sub r10b, 0x6b
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
lea ecx, [r10 + r11]
sub cl, 0x13
mov qword [rsp + 0x20], rcx
jmp 0x1401006b0
lea rdx, [rbp + 0x17437e4]
jmp 0x14010116f
lea rdx, [rbp + 0x167deeb]
jmp 0x14010116f
lea rdx, [rsp + 0x30]
xor r8d, r8d
lea rcx, [rbp - 0x10]
call fcn.1400056b0
mov r9, r15
mov r8d, recv
mov rdx, rax
lea rcx, [rbp - 0x10]
call fcn.140058b50
nop
lea rcx, [rbp - 0x38]
call fcn.140002820
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 0xf
cmova rcx, qword [rbp - 0x10]
xor edx, edx
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov r11, rax
mov eax, 0x5a4d
cmp word [r11], ax
jne 0x1401012d6
movsxd rcx, dword [r11 + 0x3c]
cmp dword [rcx + r11], 0x4550
jne 0x1401012d6
mov edx, dword [rcx + r11 + 0x88]
test edx, edx
je 0x1401012d6
mov esi, dword [rdx + r11 + 0x1c]
lea r14, [r11 + rsi]
mov r9d, dword [rdx + r11 + 0x20]
add r9, r11
mov r15d, dword [rdx + r11 + 0x24]
add r15, r11
xor r10d, r10d
test esi, esi
je 0x140101243
nop dword [rax + rax]
mov r8d, dword [r9]
add r8, r11
mov rax, qword [rbp - 0x48]
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140101233
inc rax
test ecx, ecx
jne 0x140101220
test edx, edx
je 0x1401012ae
inc r10d
add r9, 4
cmp r10d, esi
jb 0x140101210
lea rcx, [rbp - 0x10]
call fcn.140002820
xor r14d, r14d
lea rcx, [rbp + 0x10]
call fcn.140002820
mov eax, dword [rsp + 0x2c]
inc eax
mov dword [rsp + 0x2c], eax
mov rsi, qword [rbp - 0x80]
cmp eax, dword [rsi]
jb 0x1400fecd0
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.140198890
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
movsxd rax, r10d
movzx ecx, word [r15 + rax*2]
mov esi, dword [r14 + rcx*4]
mov rax, qword [rbp - 0x40]
add rsi, qword [rax + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x1401012d8
xor esi, esi
lea rcx, [rbp - 0x10]
call fcn.140002820
nop
lea rcx, [rbp + 0x10]
call fcn.140002820
mov rax, rsi
jmp 0x140101281
mov rcx, qword [rdx]
mov rax, r8
xor r8d, r8d
mov rdx, qword [rax]
jmp 0x1400febe0