Function at 0x5fd889e0
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x5fd89258
push 0x5fdc0910
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x10dc
call fcn.5fd85ced
mov eax, dword [0x5fde94a8]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 8]
mov dword [ebp - 0x10c8], esi
mov dword [ebp - 0x10d0], esi
xor eax, eax
mov dword [ebp - 0x10bc], eax
mov dword [ebp - 0x10cc], eax
mov edi, dword [esi + 0x70]
mov eax, dword [esi + 0x74]
mov dword [ebp - 0x10ec], eax
mov eax, edi
and eax, 0x4000
or eax, 0
je 0x5fd88a86
mov eax, edi
and eax, 0x200
or eax, 0
jne 0x5fdaa818
movzx eax, word [esi + 0x6c]
cmp eax, 1
je 0x5fdaa80e
cmp eax, 0x1c
jne 0x5fdaa818
cmp eax, 1
je 0x5fdaa80e
lea ebx, [esi + 0x2c]
mov dword [esi + 0x30], ebx
mov dword [ebx], ebx
push 0x5fde9420
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_EnterCriticalSection]
mov eax, dword [0x5fde914c]
mov dword [ebx], 0x5fde9148
mov dword [esi + 0x30], eax
mov dword [eax], ebx
mov dword [0x5fde914c], ebx
mov dword [esi + 0x1c8], 1
inc dword [0x5fde910c]
push 0x5fde9420
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_LeaveCriticalSection]
cmp dword [esi + 0x40], 0
je 0x5fdaa829
mov esi, dword [esi + 0x64]
xor eax, eax
mov dword [ebp - 0x10c0], eax
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5fd88ae4
sub ecx, edx
sar ecx, 1
je 0x5fd88b01
cmp word [esi + ecx*2 - 2], 0x2e
je 0x5fd9d91e
push 0x2e
push esi
call dword [sym.imp.api_ms_win_core_crt_l1_1_0.dll_wcschr]
add esp, 8
test eax, eax
je 0x5fd90dc8
cmp word [eax + 2], 0
je 0x5fd90dc8
or dword [ebp - 0x10c0], 0x100
push 0x2e
push esi
call dword [sym.imp.api_ms_win_core_crt_l1_1_0.dll_wcschr]
add esp, 8
mov esi, eax
test esi, esi
je 0x5fd88b73
add esi, 2
cmp word [esi], 0
je 0x5fd88b73
push 0x5fd89238
push esi
call dword [sym.imp.api_ms_win_core_crt_l1_1_0.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x5fdaa859
push 0x5fd89244
push esi
call dword [sym.imp.api_ms_win_core_crt_l1_1_0.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x5fdaa859
mov eax, dword [ebp - 0x10c0]
and edi, 0x1000
or edi, 0
jne 0x5fd98721
mov esi, dword [ebp - 0x10c8]
mov dword [esi + 0xc4], eax
mov eax, dword [esi + 0x254]
test eax, eax
je 0x5fd88ba8
cmp dword [eax + 0x30], 0
je 0x5fda73c5
mov edi, 1
mov ecx, edi
lock xadd dword [esi], ecx
inc ecx
cmp ecx, edi
je 0x5fdad192
inc byte [esi + 0x10]
mov eax, dword [0x5fde9010]
cmp eax, 0x5fde9010
je 0x5fd88bd8
test dword [eax + 0x1c], 0x400
jne 0x5fdaa869
cmp dword [esi + 0xec], 0
je 0x5fd9dfc8
cmp eax, 0x5fde9010
je 0x5fd88bf9
test dword [eax + 0x1c], 0x400
jne 0x5fdaa895
mov esi, dword [0x5fde9038]
push 0x58
test esi, esi
je 0x5fdaa8c7
cmp esi, fcn.5fd85ca0
jne 0x5fdaa8b0
call fcn.5fd85ca0
mov esi, eax
mov dword [ebp - 0x10bc], esi
test esi, esi
je 0x5fdad19c
push 0x58
push 0
push esi
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
add esp, 0xc
mov dword [ebp - 0x10d8], esi
test esi, esi
je 0x5fdaa8e2
mov dword [ebp - 4], 0
lea eax, [esi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_InitializeCriticalSection]
mov dword [ebp - 4], 0xfffffffe
mov eax, edi
lock xadd dword [esi], eax
mov eax, dword [0x5fde9010]
cmp eax, 0x5fde9010
je 0x5fd88c7c
test dword [eax + 0x1c], 0x400
jne 0x5fdaa8f4
mov esi, dword [0x5fde9038]
push 0x200
test esi, esi
je 0x5fdaa91f
cmp esi, fcn.5fd85ca0
jne 0x5fdaa910
call fcn.5fd85ca0
mov esi, eax
test esi, esi
je 0x5fd9dbdc
push 0x200
push 0
push esi
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
add esp, 0xc
mov eax, dword [ebp - 0x10bc]
mov dword [eax + 4], esi
test esi, esi
je 0x5fdaa92e
mov dword [ebp - 0x10d4], 0x200
push 1
push 1
push 0
mov eax, dword [ebp - 0x10c8]
push dword [eax + 0x64]
lea edx, [ebp - 0x10d4]
mov ecx, esi
call fcn.5fd85b0e
test eax, eax
je 0x5fdaa999
mov eax, dword [ebp - 0x10c8]
lock xadd dword [eax], edi
inc edi
cmp edi, 1
je 0x5fdad1a9
mov ebx, eax
inc byte [ebx + 0x10]
mov eax, dword [0x5fde9010]
cmp eax, 0x5fde9010
je 0x5fd88d2b
test dword [eax + 0x1c], 0x400
jne 0x5fdaa9b0
lea eax, [ebx + 0x34]
mov dword [ebx + 0x38], eax
mov dword [eax], eax
mov ecx, dword [ebp - 0x10bc]
mov dword [ebx + 0xfc], ecx
mov eax, dword [ebx + 0x254]
mov dword [ecx + 0x48], eax
mov ax, word [ebx + 0x6c]
mov word [ecx + 0x30], ax
mov eax, dword [ebx + 0x70]
mov dword [ecx + 0x28], eax
mov eax, dword [ebx + 0x74]
mov dword [ecx + 0x2c], eax
mov eax, dword [ebx + 0xc4]
mov dword [ecx + 0x34], eax
mov dword [ecx + 0x4c], ebx
mov dword [ecx + 0x50], ebx
xor esi, esi
cmp dword [ebx + 0xec], esi
je 0x5fd88d8d
cmp dword [0x5fde92b8], esi
jne 0x5fd88d8d
test dword [ebx + 0xc4], 0x100
je 0x5fd90e07
mov edi, dword [ebx + 0x254]
test esi, esi
jne 0x5fdb2274
mov dword [ebp - 0x10c0], edi
mov eax, dword [ebx + 0x100]
mov dword [ebp - 0x10e4], eax
mov eax, dword [ebx + 0xec]
mov dword [ebp - 0x10dc], eax
mov eax, dword [ebx + 0x64]
mov dword [ebp - 0x10ec], eax
mov dword [ebp - 0x8b0], esi
push 0x7fe
push esi
lea eax, [ebp - 0x8ac]
push eax
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
add esp, 0xc
mov dword [ebp - 0x10b8], esi
push 0x7fe
push esi
lea eax, [ebp - 0x10b4]
push eax
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
add esp, 0xc
mov dword [ebp - 0x10d4], esi
cmp dword [0x5fde907c], esi
je 0x5fd8918d
test edi, edi
je 0x5fd89168
mov esi, dword [edi + 0x30]
mov dword [ebp - 0x10d8], esi
test esi, esi
je 0x5fd89168
mov eax, dword [edi + 0xac]
mov dword [ebp - 0x10d4], eax
mov eax, dword [edi + 0x5c]
mov dword [ebp - 0x10e0], eax
xor ecx, ecx
mov word [ebp - 0x8b0], cx
test eax, eax
je 0x5fd88fbc
mov dword [ebp - 0x10d0], ecx
cmp dword [eax + 4], ecx
jbe 0x5fd88fbc
lea edi, [eax + 0x20]
mov dword [ebp - 0x10c4], edi
movzx eax, word [edi]
cmp eax, 2
je 0x5fd8937f
cmp eax, 0x17
lea eax, [ebp - 0xa8]
jne 0x5fdb2381
push eax
lea eax, [edi + 8]
push eax
call dword [sym.imp.ntdll.dll_RtlIpv6AddressToStringW]
mov ecx, 0x401
lea eax, [ebp - 0x8b0]
xor ebx, ebx
cmp word [eax], bx
je 0x5fd88e9f
add eax, 2
dec ecx
jne 0x5fd88e94
test ecx, ecx
je 0x5fdb2397
mov edx, 0x401
sub edx, ecx
test ebx, ebx
js 0x5fd88fb6
mov esi, 0x401
sub esi, edx
lea eax, [ebp - 0x8b0]
lea eax, [eax + edx*2]
mov ebx, 0
je 0x5fd88efc
add edx, 0x7ffffbfd
add edx, esi
lea edi, [ebp - 0xa8]
sub edi, eax
lea ecx, [ecx]
test edx, edx
je 0x5fd88ef6
movzx ecx, word [eax + edi]
test cx, cx
je 0x5fd88ef6
mov word [eax], cx
add eax, 2
dec edx
dec esi
jne 0x5fd88edf
mov edi, dword [ebp - 0x10c4]
test esi, esi
je 0x5fdb23a3
xor ecx, ecx
mov word [eax], cx
test ebx, ebx
js 0x5fd88fb6
mov ecx, 0x401
lea eax, [ebp - 0x8b0]
xor ebx, ebx
nop
cmp word [eax], bx
je 0x5fd88f2a
add eax, 2
dec ecx
jne 0x5fd88f1f
test ecx, ecx
je 0x5fdb23b0
mov eax, 0x401
sub eax, ecx
test ebx, ebx
js 0x5fd88fb6
mov esi, 0x401
sub esi, eax
lea ecx, [ebp - 0x8b0]
lea ecx, [ecx + eax*2]
mov ebx, 0
je 0x5fd88f80
lea edx, [eax + 0x7ffffbfd]
add edx, esi
mov edi, 0x5fd85d18
sub edi, ecx
test edx, edx
je 0x5fd88f7a
movzx eax, word [ecx + edi]
test ax, ax
je 0x5fd88f7a
mov word [ecx], ax
add ecx, 2
dec edx
dec esi
jne 0x5fd88f63
mov edi, dword [ebp - 0x10c4]
test esi, esi
je 0x5fdb23bc
xor eax, eax
mov word [ecx], ax
test ebx, ebx
js 0x5fd88fb6
mov ecx, dword [ebp - 0x10d0]
inc ecx
mov dword [ebp - 0x10d0], ecx
add edi, 0x40
mov dword [ebp - 0x10c4], edi
mov eax, dword [ebp - 0x10e0]
cmp ecx, dword [eax + 4]
jb 0x5fd88e61
mov edi, dword [ebp - 0x10c0]
mov edi, dword [edi + 0x60]
mov dword [ebp - 0x10d0], edi
xor eax, eax
mov word [ebp - 0x10b8], ax
test edi, edi
je 0x5fd89162
mov dword [ebp - 0x10c4], eax
cmp dword [edi + 4], eax
jbe 0x5fd89162
lea ecx, [edi + 0x20]
mov dword [ebp - 0x10c0], ecx
nop
movzx eax, word [ecx]
cmp eax, 2
jne 0x5fdb23c9
mov ecx, dword [ecx + 4]
mov eax, ecx
shr eax, 0x18
push eax
mov eax, ecx
shr eax, 0x10
movzx eax, al
push eax
mov eax, ecx
shr eax, 8
movzx eax, al
push eax
movzx eax, cl
push eax
push 0x5fd86b28
push 0x10
lea eax, [ebp - 0xa8]
push eax
call fcn.5fd86b45
add esp, 0x1c
mov ecx, 0x401
lea eax, [ebp - 0x10b8]
xor ebx, ebx
mov edi, edi
cmp word [eax], bx
je 0x5fd8904a
add eax, 2
dec ecx
jne 0x5fd8903f
test ecx, ecx
je 0x5fdb23fa
mov edx, 0x401
sub edx, ecx
test ebx, ebx
js 0x5fd89162
mov esi, 0x401
sub esi, edx
lea eax, [ebp - 0x10b8]
lea eax, [eax + edx*2]
mov ebx, 0
je 0x5fd890a8
add edx, 0x7ffffbfd
add edx, esi
lea edi, [ebp - 0xa8]
sub edi, eax
lea esp, [esp]
test edx, edx
je 0x5fd890a2
movzx ecx, word [eax + edi]
test cx, cx
je 0x5fd890a2
mov word [eax], cx
add eax, 2
dec edx
dec esi
jne 0x5fd8908b
mov edi, dword [ebp - 0x10d0]
test esi, esi
je 0x5fdb2406
xor ecx, ecx
mov word [eax], cx
test ebx, ebx
js 0x5fd89162
mov ecx, 0x401
lea eax, [ebp - 0x10b8]
xor ebx, ebx
nop
cmp word [eax], bx
je 0x5fd890d6
add eax, 2
dec ecx
jne 0x5fd890cb
test ecx, ecx
je 0x5fdb2413
mov eax, 0x401
sub eax, ecx
test ebx, ebx
js 0x5fd89162
mov esi, 0x401
sub esi, eax
lea ecx, [ebp - 0x10b8]
lea ecx, [ecx + eax*2]
mov ebx, 0
je 0x5fd8912c
lea edx, [eax + 0x7ffffbfd]
add edx, esi
mov edi, 0x5fd85d18
sub edi, ecx
test edx, edx
je 0x5fd89126
movzx eax, word [ecx + edi]
test ax, ax
je 0x5fd89126
mov word [ecx], ax
add ecx, 2
dec edx
dec esi
jne 0x5fd8910f
mov edi, dword [ebp - 0x10d0]
test esi, esi
je 0x5fdb241f
xor eax, eax
mov word [ecx], ax
test ebx, ebx
js 0x5fd89162
mov edx, dword [ebp - 0x10c4]
inc edx
mov dword [ebp - 0x10c4], edx
mov ecx, dword [ebp - 0x10c0]
add ecx, 0x40
mov dword [ebp - 0x10c0], ecx
cmp edx, dword [edi + 4]
jb 0x5fd88fef
mov esi, dword [ebp - 0x10d8]
push 0x5fd89350
push dword [0x5fde946c]
push dword [0x5fde9468]
call dword [sym.imp.ntdll.dll_EtwEventEnabled]
test al, al
jne 0x5fdb242c
mov ebx, dword [ebp - 0x10c8]
push 0
push ebx
push 0
call fcn.5fd89280
cmp dword [ebx + 0xec], 0
je 0x5fd9dfcf
mov dword [ebp - 0x10c4], 1
test dword [ebx + 0x1bc], 0x100
je 0x5fd8d88b
mov eax, dword [ebx + 0x104]
test eax, eax
jne 0x5fd9dbcc
mov eax, dword [ebp - 0x10c4]
xor edi, edi
mov esi, dword [ebp - 0x10bc]
test eax, eax
je 0x5fd9dfd6
cmp dword [ebx + 0xec], 0
je 0x5fd9dfd6
add esi, 0xc
push esi
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_EnterCriticalSection]
mov eax, dword [ebp - 0x10bc]
or dword [eax + 8], 2
push esi
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_LeaveCriticalSection]
mov ecx, ebx
call fcn.5fd84f21
mov edi, 0x2522
mov eax, edi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.5fd83560
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [edi + 4]
mov eax, ecx
shr eax, 0x18
push eax
mov eax, ecx
shr eax, 0x10
movzx eax, al
push eax
mov eax, ecx
shr eax, 8
movzx eax, al
push eax
movzx eax, cl
push eax
push 0x5fd86b28
push 0x10
lea eax, [ebp - 0xa8]
push eax
call fcn.5fd86b45
add esp, 0x1c
jmp 0x5fd88e87
mov esi, dword [ebp - 0x10bc]
lea ebx, [esi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_EnterCriticalSection]
test byte [esi + 8], 1
je 0x5fd8d8ae
mov eax, dword [esi + 0x48]
mov edi, dword [eax]
cmp edi, eax
jne 0x5fdb2460
xor edi, edi
or dword [esi + 8], 2
push ebx
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_LeaveCriticalSection]
mov ebx, dword [ebp - 0x10c8]
mov eax, dword [ebp - 0x10c4]
jmp 0x5fd891da
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5fd90dcd
sub ecx, edx
sar ecx, 1
cmp ecx, 0x3f
jg 0x5fdaa83f
mov eax, dword [ebp - 0x10c0]
or eax, 0x10
jmp 0x5fd88b79
mov eax, dword [ebx + 0xfc]
mov ecx, dword [eax + 0x28]
mov edx, dword [eax + 0x2c]
and ecx, 0x400
or ecx, esi
jne 0x5fd88d8d
and edx, 0x4000
xor eax, eax
or eax, edx
jne 0x5fd88d8d
mov eax, dword [ebx + 0x254]
cmp dword [eax + 0x38], esi
jne 0x5fd88d8d
cmp dword [eax + 0x30], esi
je 0x5fdc1dae
test dword [eax + 0x78], 0x20000000
jne 0x5fd88d8d
jmp 0x5fdc1dae
or eax, 1
jmp 0x5fd88b88
mov dword [ebp - 0x10c0], 1
jmp 0x5fd88b01
cmp eax, 0x251d
jne 0x5fd8d88b
jmp 0x5fd891cc
xor esi, esi
jmp 0x5fd88cba
mov ebx, esi
jmp 0x5fd88d6b
xor eax, eax
jmp 0x5fd891d2
push 0xc
push 0x2a9a
push 0x5fd9dff8
push ebx
call sym.DNSAPI.dll_DeRefQueryBlobEx
test edi, edi
je 0x5fd89211
jmp 0x5fd89216
cmp dword [eax], eax
jne 0x5fd88ba8
mov dword [esi + 0xec], 0
jmp 0x5fd88ba8
mov eax, 0x25e5
jmp 0x5fd89218
mov dword [esi + 0x104], 0x57
xor eax, eax
jmp 0x5fd89218
lea eax, [esi + 0x44]
push eax
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_InitializeCriticalSection]
mov dword [esi + 0x40], 1
jmp 0x5fd88ad4
dec ecx
cmp ecx, 0x3f
jne 0x5fd88b20
cmp word [esi + 0x7e], 0x2e
jne 0x5fd88b20
jmp 0x5fd90de5
mov eax, dword [ebp - 0x10c0]
or eax, 0x1000
jmp 0x5fd88b79
push ecx
push esi
push 0x2951
push 0x5fd9dff8
push dword [0x5fdbd340]
push dword [eax + 0x14]
push dword [eax + 0x10]
mov ecx, 0x10
call fcn.5fdcb2d4
mov eax, dword [0x5fde9010]
jmp 0x5fd88bd8
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
mov edx, 0x5fdbd57c
mov ecx, 0xd0
call fcn.5fdc7d09
jmp 0x5fd88bf9
mov ecx, esi
call dword [0x5fdec34c]
call esi
mov esi, eax
mov dword [ebp - 0x10bc], eax
jmp 0x5fd88c22
push 0x40
call dword [sym.imp.api_ms_win_core_heap_obsolete_l1_1_0.dll_LocalAlloc]
mov esi, eax
mov dword [ebp - 0x10bc], esi
mov dword [ebp - 0x10d8], eax
jmp 0x5fd88c3d
mov edi, 0xe
mov ebx, dword [ebp - 0x10c8]
xor eax, eax
jmp 0x5fd891da
push dword [esi]
push dword [eax + 0x14]
push dword [eax + 0x10]
mov edx, 0x5fdbd57c
mov ecx, 0xe
call fcn.5fdc7d09
jmp 0x5fd88c7c
mov ecx, esi
call dword [0x5fdec34c]
call esi
jmp 0x5fd88ca0
push 0x40
call dword [sym.imp.api_ms_win_core_heap_obsolete_l1_1_0.dll_LocalAlloc]
mov esi, eax
jmp 0x5fd88cba
mov eax, dword [0x5fde9010]
cmp eax, 0x5fde9010
je 0x5fdaa958
test dword [eax + 0x1c], 0x400
je 0x5fdaa958
push dword [eax + 0x14]
push dword [eax + 0x10]
mov edx, 0x5fdbd57c
mov ecx, 0xd1
call fcn.5fdc44b5
mov edi, 8
jmp 0x5fdaa979
push dword [eax + 0x14]
push dword [eax + 0x10]
mov edx, 0x5fdbd57c
mov ecx, 0xd2
call fcn.5fdc44b5
mov edi, 0x57
mov ecx, dword [ebp - 0x10bc]
call fcn.5fd8ebb4
xor esi, esi
mov dword [ebp - 0x10bc], esi
mov ebx, dword [ebp - 0x10c8]
xor eax, eax
jmp 0x5fd891da
mov eax, dword [0x5fde9010]
cmp eax, 0x5fde9010
je 0x5fdaa974
test dword [eax + 0x1c], 0x400
jne 0x5fdaa95f
jmp 0x5fdaa974
push edi
push ebx
push 0x298c
push 0x5fd9dff8
push dword [0x5fdbd340]
push dword [eax + 0x14]
push dword [eax + 0x10]
mov ecx, 0x10
call fcn.5fdcb2d4
jmp 0x5fd88d2b
mov dword [esi + 0x30], ebx
mov dword [ebx], ebx
jmp 0x5fd88bbc
xor esi, esi
mov dword [ebp - 0x10bc], esi
jmp 0x5fdaa8e2
mov dword [eax + 0x30], ebx
mov dword [ebx], ebx
jmp 0x5fd88d0d
mov eax, dword [0x5fde9010]
cmp eax, 0x5fde9010
je 0x5fd88d8d
test dword [eax + 0x1c], 0x400
je 0x5fd88d8d
push dword [ebx + 0x100]
push ebx
push dword [eax + 0x14]
push dword [eax + 0x10]
mov edx, 0x5fdbd57c
mov ecx, 0xcb
call fcn.5fdc81e7
jmp 0x5fd88d8d
or dword [ebx + 0x70], 0x400
mov eax, dword [ebx + 0x74]
mov dword [ebx + 0x74], eax
mov dword [ebx + 0xf4], 1
mov dword [ebp - 0x10cc], 1
xor edx, edx
mov ecx, ebx
call fcn.5fd922a5
mov esi, eax
test esi, esi
jne 0x5fdb22da
mov eax, dword [0x5fde9010]
cmp eax, 0x5fde9010
je 0x5fdb22ce
test dword [eax + 0x1c], 0x400
je 0x5fdb22ce
push dword [eax + 0x14]
push dword [eax + 0x10]
mov edx, 0x5fdbd57c
mov ecx, 0xd3
call fcn.5fdc44b5
mov edi, 0xe
xor eax, eax
jmp 0x5fd891d4
push dword [ebx + 0x254]
push dword [ebx + 0x100]
mov edx, dword [ebx + 0xec]
mov ecx, dword [ebx + 0x64]
call fcn.5fdcea4d
push 0
push ebx
push 0
call fcn.5fd89280
mov dword [esi + 0xf4], 1
or dword [esi + 0x70], 0x800
mov eax, dword [esi + 0x74]
and dword [esi + 0x70], 0xfffdffff
mov dword [esi + 0x74], eax
mov dword [esi + 0x254], edi
mov dword [esi + 0x100], 1
mov ecx, dword [esi + 0xfc]
mov eax, dword [ecx + 0x28]
or dword [esi + 0x70], eax
mov eax, dword [ecx + 0x2c]
or dword [esi + 0x74], eax
mov eax, dword [ebx + 0x268]
mov dword [esi + 0x268], eax
mov eax, dword [ebx + 0x26c]
mov dword [esi + 0x26c], eax
mov eax, dword [ebp - 0x10bc]
mov dword [eax + 0x50], esi
push dword [esi + 0x254]
push dword [esi + 0x100]
mov edx, dword [esi + 0xec]
mov ecx, dword [esi + 0x64]
call fcn.5fdcea4d
push 0
push esi
jmp 0x5fd89190
push edi
push 0x5fdbd218
push 0x41
push eax
call fcn.5fd8a9b4
add esp, 0x10
jmp 0x5fd88e87
mov ebx, 0x80070057
xor edx, edx
jmp 0x5fd88eae
sub eax, 2
mov ebx, 0x8007007a
jmp 0x5fd88f04
mov ebx, 0x80070057
xor eax, eax
jmp 0x5fd88f39
sub ecx, 2
mov ebx, 0x8007007a
jmp 0x5fd88f88
cmp eax, 0x17
lea eax, [ebp - 0xa8]
jne 0x5fdb23e4
push eax
lea eax, [ecx + 8]
push eax
call dword [sym.imp.ntdll.dll_RtlIpv6AddressToStringW]
jmp 0x5fd89030
push ecx
push 0x5fdbd218
push 0x41
push eax
call fcn.5fd8a9b4
add esp, 0x10
jmp 0x5fd89030
mov ebx, 0x80070057
xor edx, edx
jmp 0x5fd89059
sub eax, 2
mov ebx, 0x8007007a
jmp 0x5fd890b0
mov ebx, 0x80070057
xor eax, eax
jmp 0x5fd890e5
sub ecx, 2
mov ebx, 0x8007007a
jmp 0x5fd89134
lea eax, [ebp - 0x10b8]
push eax
lea eax, [ebp - 0x8b0]
push eax
push dword [ebp - 0x10d4]
push esi
push dword [ebp - 0x10e4]
push dword [ebp - 0x10dc]
sub esp, 8
mov edx, dword [ebp - 0x10ec]
call fcn.5fdcf9d3
jmp 0x5fd89187
mov dword [ebp - 0x10c4], 0
inc dword [ebp - 0x10cc]
xor edx, edx
mov ecx, dword [ebp - 0x10c8]
call fcn.5fd922a5
mov esi, eax
test esi, esi
je 0x5fdb267b
mov dword [esi + 0x254], edi
mov eax, dword [ebp - 0x10cc]
mov dword [esi + 0x100], eax
mov ecx, esi
call fcn.5fdca246
test eax, eax
je 0x5fdb253b
or dword [esi + 0x70], 0x400
mov eax, dword [esi + 0x74]
mov dword [esi + 0x74], eax
mov dword [esi + 0xf4], 1
push dword [esi + 0x254]
push dword [esi + 0x100]
mov edx, dword [esi + 0xec]
mov ecx, dword [esi + 0x64]
call fcn.5fdcea4d
mov edx, esi
call fcn.5fdd40c7
mov dword [ebp - 0x10c0], eax
test eax, eax
jne 0x5fdb25d5
inc dword [ebp - 0x10cc]
xor edx, edx
mov ecx, dword [ebp - 0x10c8]
call fcn.5fd922a5
mov esi, eax
test esi, esi
je 0x5fdb2591
or dword [esi + 0x70], 0x800
mov eax, dword [esi + 0x74]
and dword [esi + 0x70], 0xfffdffff
mov dword [esi + 0x74], eax
mov dword [esi + 0x254], edi
mov eax, dword [ebp - 0x10cc]
mov dword [esi + 0x100], eax
mov dword [esi + 0xf4], 1
mov eax, dword [ebp - 0x10bc]
cmp edi, dword [eax + 0x48]
jne 0x5fdb254a
or dword [eax + 8], 2
push dword [esi + 0x254]
push dword [esi + 0x100]
mov edx, dword [esi + 0xec]
mov ecx, dword [esi + 0x64]
call fcn.5fdcea4d
mov edx, esi
call fcn.5fdd40c7
mov dword [ebp - 0x10c0], eax
test eax, eax
jne 0x5fdb265e
mov edi, dword [edi]
mov esi, dword [ebp - 0x10bc]
cmp edi, dword [esi + 0x48]
jne 0x5fdb246a
mov edi, eax
jmp 0x5fd8d8b0
mov eax, dword [0x5fde9010]
cmp eax, 0x5fde9010
je 0x5fdb25bb
test dword [eax + 0x1c], 0x400
je 0x5fdb25bb
push dword [eax + 0x14]
push dword [eax + 0x10]
mov edx, 0x5fdbd57c
mov ecx, 0xd6
call fcn.5fdc44b5
mov edi, 0xe
mov dword [ebp - 0x10c4], 1
mov esi, dword [ebp - 0x10bc]
jmp 0x5fd8d8b0
mov eax, dword [0x5fde9010]
cmp eax, 0x5fde9010
je 0x5fdb260e
mov edi, dword [ebp - 0x10c0]
test dword [eax + 0x1c], 0x400
je 0x5fdb2632
push dword [ebp - 0x10cc]
push edi
push dword [eax + 0x14]
push dword [eax + 0x10]
mov edx, 0x5fdbd57c
mov ecx, 0xd5
call fcn.5fdc81e7
jmp 0x5fdb2632
mov edi, dword [ebp - 0x10c0]
jmp 0x5fdb2632
push dword [ebp - 0x10cc]
push edi
push dword [eax + 0x14]
push dword [eax + 0x10]
mov edx, 0x5fdbd57c
mov ecx, 0xd7
call fcn.5fdc81e7
mov dword [esi + 0x104], edi
or dword [esi + 0x1bc], 0x100
mov ecx, esi
call fcn.5fd84f21
mov dword [ebp - 0x10c4], 1
mov esi, dword [ebp - 0x10bc]
jmp 0x5fd8d8b0
mov eax, dword [0x5fde9010]
cmp eax, 0x5fde9010
je 0x5fdb260e
mov edi, dword [ebp - 0x10c0]
test dword [eax + 0x1c], 0x400
jne 0x5fdb2616
jmp 0x5fdb2632
mov eax, dword [0x5fde9010]
cmp eax, 0x5fde9010
je 0x5fdb25bb
test dword [eax + 0x1c], 0x400
je 0x5fdb25bb
push dword [eax + 0x14]
push dword [eax + 0x10]
mov edx, 0x5fdbd57c
mov ecx, 0xd4
call fcn.5fdc44b5
mov edi, 0xe
mov dword [ebp - 0x10c4], 1
mov esi, dword [ebp - 0x10bc]
jmp 0x5fd8d8b0
xor edi, edi
mov edx, 0x5fde9390
mov eax, dword [edx]
mov ecx, eax
or ecx, edi
lock cmpxchg dword [edx], ecx
jne 0x5fdc1db7
and eax, 3
cmp al, 3
je 0x5fd88d8d
mov eax, dword [ebx + 0x254]
cmp dword [eax + 0x30], esi
je 0x5fdb2236
test dword [eax + 0x78], 0x40000000
je 0x5fdb2236
lea esi, [edi + 1]
jmp 0x5fdb2236