Function at 0x1400608e0
Capabilities:
Allocate or change rwx memory
Create thread
Encode data using xor
Enumerate gui resources
Enumerate processes
Execute shellcode via indirect call
Execute shellcode via windows callback function
Spawn thread to rwx shellcode
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x100]
sub rsp, 0x200
mov rax, qword [0x1400cd080]
xor rax, rsp
mov qword [rbp + 0xf0], rax
xor ebx, ebx
call fcn.140048ce0
xor edx, edx
mov cl, 0x5b
call fcn.140048c80
movzx edi, al
mov byte [rsp + 0x5c], al
mov byte [rbp - 0x80], al
lea edx, [rbx + 1]
mov cl, reloc.WLDAP32.dll_Ordinal_32
call fcn.140048c80
movzx esi, al
mov byte [rsp + 0x5d], al
mov byte [rbp - 0x7f], al
lea edx, [rbx + 2]
mov cl, reloc.WLDAP32.dll_Ordinal_33
call fcn.140048c80
mov byte [rbp - 0x7e], al
lea edx, [rbx + 3]
call fcn.140048c80
mov byte [rbp - 0x7d], al
lea edx, [rbx + 4]
mov cl, reloc.WLDAP32.dll_Ordinal_32
call fcn.140048c80
mov byte [rbp - 0x7c], al
lea edx, [rbx + 5]
mov cl, 0x5d
call fcn.140048c80
mov byte [rbp - 0x7b], al
lea edx, [rbx + 6]
mov cl, reloc.WLDAP32.dll_Ordinal_32
call fcn.140048c80
mov byte [rbp - 0x7a], al
lea edx, [rbx + 7]
mov cl, reloc.WLDAP32.dll_Ordinal_79
call fcn.140048c80
mov byte [rbp - 0x79], al
lea edx, [rbx + 8]
mov cl, reloc.WS2_32.dll_WSASetLastError
call fcn.140048c80
mov byte [rbp - 0x78], al
lea edx, [rbx + 9]
mov cl, 0x65
call fcn.140048c80
mov byte [rbp - 0x77], al
lea edx, [rbx + 0xa]
mov cl, WSAGetLastError
call fcn.140048c80
mov byte [rbp - 0x76], al
lea edx, [rbx + 0xb]
mov cl, reloc.WLDAP32.dll_Ordinal_32
call fcn.140048c80
mov byte [rbp - 0x75], al
lea edx, [rbx + 0xc]
mov cl, 0x47
call fcn.140048c80
mov byte [rbp - 0x74], al
lea edx, [rbx + 0xd]
mov cl, 0x61
call fcn.140048c80
mov byte [rbp - 0x73], al
lea edx, [rbx + 0xe]
mov cl, 0x6d
call fcn.140048c80
mov byte [rbp - 0x72], al
lea edx, [rbx + 0xf]
mov cl, 0x65
call fcn.140048c80
mov byte [rbp - 0x71], al
lea edx, [rbx + 0x10]
mov cl, reloc.WLDAP32.dll_Ordinal_32
call fcn.140048c80
mov byte [rbp - 0x70], al
lea edx, [rbx + 0x11]
mov cl, 0x41
call fcn.140048c80
mov byte [rbp - 0x6f], al
lea edx, [rbx + 0x12]
mov cl, WSAGetLastError
call fcn.140048c80
mov byte [rbp - 0x6e], al
lea edx, [rbx + 0x13]
mov cl, 0x64
call fcn.140048c80
mov byte [rbp - 0x6d], al
lea edx, [rbx + 0x14]
mov cl, reloc.WLDAP32.dll_Ordinal_32
call fcn.140048c80
mov byte [rbp - 0x6c], al
lea edx, [rbx + 0x15]
mov cl, 0x4d
call fcn.140048c80
mov byte [rbp - 0x6b], al
lea edx, [rbx + 0x16]
mov cl, 0x65
call fcn.140048c80
mov byte [rbp - 0x6a], al
lea edx, [rbx + 0x17]
mov cl, 0x64
call fcn.140048c80
mov byte [rbp - 0x69], al
lea edx, [rbx + 0x18]
mov cl, 0x61
call fcn.140048c80
mov byte [rbp - 0x68], al
lea edx, [rbx + 0x19]
mov cl, 0x6c
call fcn.140048c80
mov byte [rbp - 0x67], al
lea edx, [rbx + 0x1a]
mov cl, 0xa
call fcn.140048c80
mov byte [rbp - 0x66], al
xor eax, eax
mov byte [rbp - 0x65], al
mov ecx, ebx
mov edx, ebx
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x51]
xor byte [rbp + rdx - 0x80], al
inc ecx
movsxd rdx, ecx
cmp rdx, 0x1b
jb 0x140060aa0
mov byte [rbp - 0x65], bl
lea rcx, [rbp - 0x80]
call fcn.140002400
cmp qword [0x1400f3968], rbx
jne 0x140061219
xor edx, edx
mov cl, 0x46
call fcn.140048c80
movzx esi, al
mov edx, 1
mov cl, reloc.WS2_32.dll_WSAGetLastError
call fcn.140048c80
movzx r14d, al
mov edx, 2
mov cl, WSAStartup
call fcn.140048c80
movzx r15d, al
mov edx, 3
mov cl, reloc.WS2_32.dll_WSACleanup
call fcn.140048c80
movzx r12d, al
mov edx, 4
mov cl, WSAGetLastError
call fcn.140048c80
movzx r13d, al
mov edx, 5
mov cl, 0x69
call fcn.140048c80
mov byte [rsp + 0x40], al
mov edx, 6
mov cl, reloc.WS2_32.dll_WSACleanup
call fcn.140048c80
mov byte [rsp + 0x41], al
mov edx, 7
mov cl, 0x65
call fcn.140048c80
mov byte [rsp + 0x42], al
mov edx, 8
mov cl, 0x43
call fcn.140048c80
mov byte [rsp + 0x43], al
mov edx, 9
mov cl, 0x6c
call fcn.140048c80
mov byte [rsp + 0x44], al
mov edx, 0xa
mov cl, 0x69
call fcn.140048c80
mov byte [rsp + 0x45], al
mov edx, ntohl
mov cl, 0x65
call fcn.140048c80
mov byte [rsp + 0x46], al
mov edx, recv
mov cl, WSAGetLastError
call fcn.140048c80
mov byte [rsp + 0x47], al
mov edx, reloc.WS2_32.dll_listen
mov cl, reloc.WS2_32.dll_WSACleanup
call fcn.140048c80
mov byte [rsp + 0x48], al
mov edx, reloc.WS2_32.dll_ntohl
mov cl, reloc.WLDAP32.dll_Ordinal_45
call fcn.140048c80
mov byte [rsp + 0x49], al
mov edx, reloc.WS2_32.dll_ntohs
mov cl, 0x57
call fcn.140048c80
mov byte [rsp + 0x4a], al
mov edx, reloc.WS2_32.dll_recv
mov cl, 0x69
call fcn.140048c80
mov byte [rsp + 0x4b], al
mov edx, reloc.WS2_32.dll_recvfrom
mov cl, WSAGetLastError
call fcn.140048c80
mov byte [rsp + 0x4c], al
mov edx, reloc.WS2_32.dll_select
mov cl, 0x36
call fcn.140048c80
mov byte [rsp + 0x4d], al
mov edx, reloc.WS2_32.dll_send
mov cl, 0x34
call fcn.140048c80
mov byte [rsp + 0x4e], al
mov edx, reloc.WS2_32.dll_sendto
mov cl, reloc.WLDAP32.dll_Ordinal_45
call fcn.140048c80
mov byte [rsp + 0x4f], al
mov edx, reloc.WS2_32.dll_setsockopt
mov cl, 0x53
call fcn.140048c80
mov byte [rsp + 0x50], al
mov edx, reloc.WLDAP32.dll_Ordinal_22
mov cl, 0x68
call fcn.140048c80
mov byte [rsp + 0x51], al
mov edx, reloc.WS2_32.dll_socket
mov cl, 0x69
call fcn.140048c80
mov byte [rsp + 0x52], al
mov edx, Ordinal_26
mov cl, reloc.WS2_32.dll_WSASetLastError
call fcn.140048c80
mov byte [rsp + 0x53], al
mov edx, Ordinal_26
call fcn.140048c80
mov byte [rsp + 0x54], al
mov edx, reloc.WLDAP32.dll_Ordinal_26
mov cl, 0x69
call fcn.140048c80
mov byte [rsp + 0x55], al
mov edx, reloc.WLDAP32.dll_Ordinal_27
mov cl, WSAGetLastError
call fcn.140048c80
mov byte [rsp + 0x56], al
mov edx, Ordinal_32
mov cl, 0x67
call fcn.140048c80
mov byte [rsp + 0x57], al
mov edx, Ordinal_32
mov cl, reloc.WLDAP32.dll_Ordinal_46
call fcn.140048c80
mov byte [rsp + 0x58], al
mov edx, reloc.WLDAP32.dll_Ordinal_30
mov cl, 0x65
call fcn.140048c80
mov byte [rsp + 0x59], al
mov edx, Ordinal_32
mov cl, 0x78
call fcn.140048c80
mov byte [rsp + 0x5a], al
mov edx, reloc.WLDAP32.dll_Ordinal_32
mov cl, 0x65
call fcn.140048c80
mov byte [rsp + 0x5b], al
lea rcx, [rbp + 0x128]
movabs r9, 0xff0f0ff0f0ff00f
lea r8, [0x1400637c0]
lea rdx, [0x140000000]
nop dword [rax]
nop dword [rax + rax]
mov dword [rbp - 0x50], 1
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x78], r9
mov qword [rbp - 0x70], rcx
mov rdi, qword [rcx]
xor rdi, r9
mov qword [rbp - 0x80], rdi
mov qword [rcx], rbx
mov ecx, ebx
mov rax, qword [0x1400f4a10]
test rax, rax
je 0x140060d5a
cmp rax, r8
je 0x140060d47
inc ecx
mov rax, qword [rdx + rcx*8 + 0xf4a10]
test rax, rax
jne 0x140060d31
jmp 0x140060d5a
mov eax, ecx
mov r8, qword [rdx + rax*8 + 0xf4390]
test r8, r8
jne 0x140060e4d
mov edx, 0x1f4
xor ecx, ecx
lea r9d, [rcx + 0x40]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, rax
test rax, rax
jne 0x140060d81
mov r8, rbx
jmp 0x140060e1e
lea rax, [0x1400637c0]
mov rcx, r8
mov edx, 3
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x140060d90
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
mov eax, dword [rax + 0x70]
mov dword [rcx + 0x70], eax
mov rax, qword [0x1400f4d38]
lea rcx, [0x140000000]
lea rdx, [0x1400637c0]
mov qword [rcx + rax*8 + 0xf4a10], rdx
mov qword [rcx + rax*8 + 0xf4390], r8
inc rax
mov qword [0x1400f4d38], rax
lea rdx, [rbp - 0x50]
mov rcx, qword [sym.imp.KERNEL32.dll_Sleep]
call r8
nop
movabs rax, 0xff0f0ff0f0ff00f
xor rdi, rax
lea rcx, [rbp + 0x128]
mov qword [rcx], rdi
mov byte [rbp - 0x80], sil
mov byte [rbp - 0x7f], r14b
mov byte [rbp - 0x7e], r15b
mov byte [rbp - 0x7d], r12b
mov byte [rbp - 0x7c], r13b
movzx eax, byte [rsp + 0x40]
mov byte [rbp - 0x7b], al
movzx eax, byte [rsp + 0x41]
mov byte [rbp - 0x7a], al
movzx eax, byte [rsp + 0x42]
mov byte [rbp - 0x79], al
movzx eax, byte [rsp + 0x43]
mov byte [rbp - 0x78], al
movzx eax, byte [rsp + 0x44]
mov byte [rbp - 0x77], al
movzx eax, byte [rsp + 0x45]
mov byte [rbp - 0x76], al
movzx eax, byte [rsp + 0x46]
mov byte [rbp - 0x75], al
movzx eax, byte [rsp + 0x47]
mov byte [rbp - 0x74], al
movzx eax, byte [rsp + 0x48]
mov byte [rbp - 0x73], al
movzx eax, byte [rsp + 0x49]
mov byte [rbp - 0x72], al
movzx eax, byte [rsp + 0x4a]
mov byte [rbp - 0x71], al
movzx eax, byte [rsp + 0x4b]
mov byte [rbp - 0x70], al
movzx eax, byte [rsp + 0x4c]
mov byte [rbp - 0x6f], al
movzx eax, byte [rsp + 0x4d]
mov byte [rbp - 0x6e], al
movzx eax, byte [rsp + 0x4e]
mov byte [rbp - 0x6d], al
movzx eax, byte [rsp + 0x4f]
mov byte [rbp - 0x6c], al
movzx eax, byte [rsp + 0x50]
mov byte [rbp - 0x6b], al
movzx eax, byte [rsp + 0x51]
mov byte [rbp - 0x6a], al
movzx eax, byte [rsp + 0x52]
mov byte [rbp - 0x69], al
movzx eax, byte [rsp + 0x53]
mov byte [rbp - 0x68], al
movzx eax, byte [rsp + 0x54]
mov byte [rbp - 0x67], al
movzx eax, byte [rsp + 0x55]
mov byte [rbp - 0x66], al
movzx eax, byte [rsp + 0x56]
mov byte [rbp - 0x65], al
movzx eax, byte [rsp + 0x57]
mov byte [rbp - 0x64], al
movzx eax, byte [rsp + 0x58]
mov byte [rbp - 0x63], al
movzx eax, byte [rsp + 0x59]
mov byte [rbp - 0x62], al
movzx eax, byte [rsp + 0x5a]
mov byte [rbp - 0x61], al
movzx eax, byte [rsp + 0x5b]
mov byte [rbp - 0x60], al
xor eax, eax
mov byte [rbp - 0x5f], al
mov ecx, ebx
mov rdx, rbx
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x51]
xor byte [rbp + rdx - 0x80], al
inc ecx
movsxd rdx, ecx
cmp rdx, 0x21
jb 0x140060f80
mov byte [rbp - 0x5f], 0
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
mov dword [rbp - 0x40], 0x130
lea rdx, [rbp - 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140060fe7
nop dword [rax]
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x14]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov rcx, rdi
test eax, eax
je 0x1400610b6
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140060fc0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov dword [0x1400f38e8], eax
lea rcx, [rbp + 0x128]
mov rdi, qword [rcx]
mov qword [rcx], rbx
mov qword [rsp + 0x60], rbx
mov dword [rsp + 0x68], eax
lea rdx, [rsp + 0x60]
lea rcx, [0x14004c600]
call qword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
jne 0x140061039
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xffffffff
jne 0x140061039
mov rax, qword [rsp + 0x60]
test rax, rax
jne 0x14006103c
mov rax, rbx
lea rcx, [rbp + 0x128]
mov qword [rcx], rdi
mov qword [0x1400f3968], rax
mov dword [rbp - 0x50], 1
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
movabs rcx, 0xff0f0ff0f0ff00f
mov qword [rbp - 0x78], rcx
lea rax, [rbp + 0x128]
mov qword [rbp - 0x70], rax
mov rdi, qword [rax]
xor rdi, rcx
mov qword [rbp - 0x80], rdi
mov qword [rax], rbx
mov ecx, ebx
mov rax, qword [0x1400f4a10]
test rax, rax
je 0x1400610d7
lea r8, [0x140000000]
lea rdx, [0x1400637c0]
nop dword [rax]
cmp rax, rdx
je 0x1400610c4
inc ecx
mov rax, qword [r8 + rcx*8 + 0xf4a10]
test rax, rax
jne 0x1400610a0
jmp 0x1400610d7
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp - 0x38]
jmp 0x140060ff2
mov eax, ecx
mov r8, qword [r8 + rax*8 + 0xf4390]
test r8, r8
jne 0x1400611cd
mov edx, 0x1f4
xor ecx, ecx
lea r9d, [rcx + 0x40]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, rax
test rax, rax
jne 0x1400610fe
mov r8, rbx
jmp 0x14006119e
lea rcx, [0x1400637c0]
mov edx, 3
nop word [rax + rax]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rax - 0x10], xmm1
lea rcx, [rcx + 0x80]
sub rdx, 1
jne 0x140061110
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
mov ecx, dword [rcx + 0x70]
mov dword [rax + 0x70], ecx
mov rax, qword [0x1400f4d38]
lea rcx, [0x140000000]
lea rdx, [0x1400637c0]
mov qword [rcx + rax*8 + 0xf4a10], rdx
mov qword [rcx + rax*8 + 0xf4390], r8
inc rax
mov qword [0x1400f4d38], rax
lea rdx, [rbp - 0x50]
mov rcx, qword [sym.imp.KERNEL32.dll_Sleep]
call r8
nop
movabs r9, 0xff0f0ff0f0ff00f
xor rdi, r9
lea rcx, [rbp + 0x128]
mov qword [rcx], rdi
cmp qword [0x1400f3968], 0
lea rdx, [0x140000000]
lea r8, [0x1400637c0]
je 0x140060d00
movzx edi, byte [rsp + 0x5c]
movzx esi, byte [rsp + 0x5d]
call fcn.14004be20
call fcn.14004c730
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r9 + 3]
lea rcx, str..Womic
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1400f38e0], rax
test rax, rax
je 0x140061266
cmp rax, 0xffffffffffffffff
lea rcx, str.Sucess_Load_tHE_driver_n
jne 0x14006126d
lea rcx, str.ERRO_Load_tHE_driver_n
call fcn.140002400
mov qword [rbp - 0x50], rbx
mov dword [rsp + 0x60], 0x85b3e12
mov eax, dword [0x1400f38e8]
mov dword [rsp + 0x64], eax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
mov r9d, reloc.WS2_32.dll_recv
lea r8, [rsp + 0x60]
mov edx, 0x2201c8
mov rcx, qword [0x1400f38e0]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rax, qword [rbp - 0x50]
mov qword [0x1400f39f8], rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140063820
mov rdx, qword [0x1400f39f8]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
lea rdx, [0x1400639d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
cmp qword [0x1400f39f8], 0
jne 0x1400614a8
mov byte [rsp + 0x60], dil
mov byte [rsp + 0x61], sil
mov edx, 2
mov cl, 0x58
call fcn.140048c80
mov byte [rsp + 0x62], al
mov edx, 3
mov cl, reloc.WLDAP32.dll_Ordinal_32
call fcn.140048c80
mov byte [rsp + 0x63], al
mov edx, 4
mov cl, 0x5d
call fcn.140048c80
mov byte [rsp + 0x64], al
mov edx, 5
mov cl, reloc.WLDAP32.dll_Ordinal_32
call fcn.140048c80
mov byte [rsp + 0x65], al
mov edx, 6
mov cl, 0x45
call fcn.140048c80
mov byte [rsp + 0x66], al
mov edx, 7
mov cl, 0x52
call fcn.140048c80
mov byte [rsp + 0x67], al
mov edx, 8
call fcn.140048c80
mov byte [rsp + 0x68], al
mov edx, 9
mov cl, reloc.WLDAP32.dll_Ordinal_79
call fcn.140048c80
mov byte [rsp + 0x69], al
mov edx, 0xa
mov cl, reloc.WLDAP32.dll_Ordinal_32
call fcn.140048c80
mov byte [rsp + 0x6a], al
mov edx, ntohl
mov cl, 0x4c
call fcn.140048c80
mov byte [rsp + 0x6b], al
mov edx, recv
mov cl, reloc.WLDAP32.dll_Ordinal_79
call fcn.140048c80
mov byte [rsp + 0x6c], al
mov edx, reloc.WS2_32.dll_listen
mov cl, 0x41
call fcn.140048c80
mov byte [rsp + 0x6d], al
mov edx, reloc.WS2_32.dll_ntohl
mov cl, 0x44
call fcn.140048c80
mov byte [rsp + 0x6e], al
mov edx, reloc.WS2_32.dll_ntohs
mov cl, reloc.WLDAP32.dll_Ordinal_32
call fcn.140048c80
mov byte [rsp + 0x6f], al
mov edx, reloc.WS2_32.dll_recv
mov cl, 0x44
call fcn.140048c80
mov byte [rsp + 0x70], al
mov edx, reloc.WS2_32.dll_recvfrom
mov cl, 0x52
call fcn.140048c80
mov byte [rsp + 0x71], al
mov edx, reloc.WS2_32.dll_select
mov cl, 0x49
call fcn.140048c80
mov byte [rsp + 0x72], al
mov edx, reloc.WS2_32.dll_send
mov cl, 0x56
call fcn.140048c80
mov byte [rsp + 0x73], al
mov edx, reloc.WS2_32.dll_sendto
mov cl, 0x45
call fcn.140048c80
mov byte [rsp + 0x74], al
mov edx, reloc.WS2_32.dll_setsockopt
mov cl, 0x52
call fcn.140048c80
mov byte [rsp + 0x75], al
mov edx, reloc.WLDAP32.dll_Ordinal_22
mov cl, 0xa
call fcn.140048c80
mov byte [rsp + 0x76], al
xor eax, eax
mov byte [rsp + 0x77], al
mov rdx, rbx
nop word [rax + rax]
lea eax, [rbx + 0x51]
xor byte [rsp + rdx + 0x60], al
inc ebx
movsxd rdx, ebx
cmp rdx, 0x17
jb 0x140061470
mov byte [rsp + 0x77], 0
lea rcx, [rsp + 0x60]
call fcn.140002400
mov ecx, 0x2328
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.1400530c0
mov ecx, 8
call fcn.1400a7004
lea rcx, [0x14004e0e0]
mov qword [rax], rcx
mov qword [rbp - 0x50], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x1400645c0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1400615e3
cmp dword [rsp + 0x68], 0
je 0x1400615d7
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rbp - 0x50], xmm0
lea rcx, [rbp - 0x50]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x1400615d7
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
lea ecx, [rax + 8]
call fcn.1400a7004
lea rcx, [0x14004e4e0]
mov qword [rax], rcx
mov qword [rbp - 0x50], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x1400645c0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1400615c7
cmp dword [rsp + 0x68], 0
je 0x1400615bb
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rbp - 0x50], xmm0
lea rcx, [rbp - 0x50]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x1400615bb
call fcn.14005f350
mov rcx, qword [rbp + 0xf0]
xor rcx, rsp
call fcn.1400a69c0
lea r11, [rsp + 0x200]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x68], ebx
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x68], ebx
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3