Function at 0x140032770
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Create process on windows
Create thread
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xb08]
sub rsp, 0xbe0
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x1400fff00]
xor rax, rsp
mov qword [rbp + 0xac0], rax
mov r13, rcx
xor r14d, r14d
mov dword [rbp + 0x80], r14d
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8, [0x14003afe0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [rbp + 0x8b0]
call fcn.1400314a0
nop
lea rdx, [rbp + 0x8b0]
cmp qword [rbp + 0x8c8], 0xf
cmova rdx, qword [rbp + 0x8b0]
mov r8, qword [rbp + 0x8c0]
lea rcx, [section..data]
call fcn.14001c9a0
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8, [0x140038020]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp qword [r13 + 0x30], 0xa
je 0x1400329f6
movdqa xmm0, xmmword [0x1400cd0f0]
movdqa xmmword [rbp + 0x90], xmm0
movdqa xmm1, xmmword [0x1400cd050]
movdqa xmmword [rbp + 0xa0], xmm1
movdqa xmm0, xmmword [0x1400ccfa0]
movdqa xmmword [rbp + 0xb0], xmm0
movdqa xmm1, xmmword [0x1400cce50]
movdqa xmmword [rbp + 0xc0], xmm1
mov dword [rbp + 0xd0], 0x6d236262
mov dword [rbp + 0xd4], 0x100607f
mov ecx, r14d
nop dword [rax]
lea eax, [rcx - 0x35]
xor byte [rbp + rcx + 0x90], al
lea eax, [rcx - 0x34]
xor byte [rbp + rcx + 0x91], al
lea eax, [rcx - 0x33]
xor byte [rbp + rcx + 0x92], al
lea eax, [rcx - 0x32]
xor byte [rbp + rcx + 0x93], al
lea eax, [rcx - 0x31]
xor byte [rbp + rcx + 0x94], al
lea eax, [rcx - 0x30]
xor byte [rbp + rcx + 0x95], al
lea eax, [rcx - 0x2f]
xor byte [rbp + rcx + 0x96], al
lea eax, [rcx - 0x2e]
xor byte [rbp + rcx + 0x97], al
lea eax, [rcx - 0x2d]
xor byte [rbp + rcx + 0x98], al
lea eax, [rcx - 0x2c]
xor byte [rbp + rcx + 0x99], al
lea eax, [rcx - 0x2b]
xor byte [rbp + rcx + 0x9a], al
lea eax, [rcx - 0x2a]
xor byte [rbp + rcx + 0x9b], al
lea eax, [rcx - 0x29]
xor byte [rbp + rcx + 0x9c], al
lea eax, [rcx - 0x28]
xor byte [rbp + rcx + 0x9d], al
add rcx, 0xe
cmp rcx, 0x46
jb 0x140032890
mov byte [rbp + 0xd7], 0
mov r9d, reloc.WS2_32.dll_recv
xor r8d, r8d
lea rdx, [rbp + 0x90]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400329d6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400329d6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x4f96a5f0
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400329d1
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400329b0
cmp r8d, 0xc4d6d580
je 0x1400329db
test r9d, r9d
jne 0x140032990
mov rax, qword [rax]
jmp 0x140032960
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
xor ecx, ecx
call rdx
lea rcx, [rbp + 0x860]
call fcn.14002b3e0
nop
call fcn.14003fdb0
mov r12, rax
mov dword [rbp + 0x40], 0xa0baa3ed
mov dword [rbp + 0x44], 0xb6b8a2aa
mov word [rbp + 0x48], 0xee
mov byte [rbp + 0x4a], 1
mov rdx, r13
cmp qword [r13 + 0x18], 0xf
jbe 0x140032a31
mov rdx, qword [r13]
xor r8d, r8d
mov rcx, r12
call fcn.14003e7b0
mov rbx, rax
mov dword [rbp - 0x80], 0xa3aca2ed
mov dword [rbp - 0x7c], 0x100edaa
mov dword [rsp + 0x78], 0xbdaca4ed
mov dword [rsp + 0x7c], 0x100eda7
mov dword [rsp + 0x70], 0xbca8baed
mov word [rsp + 0x74], 0xf2
mov byte [rsp + 0x76], 1
mov dword [rbp + 0x20], 0xabbdb5bf
mov dword [rbp + 0x24], 0xbbbfb9f2
mov word [rbp + 0x28], 0xa7
mov byte [rbp + 0x2a], 1
lea r8, [rsp + 0x70]
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x2b8]
call fcn.14001dce0
nop
lea rdx, [r13 + 0x40]
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x140032ab1
mov rdx, qword [rdx]
mov rcx, rax
call fcn.14000e300
xorps xmm0, xmm0
movups xmmword [rbp + 0x150], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x160], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x150], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x160], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rsp + 0x78]
lea rdx, [rbp + 0x150]
lea rcx, [rbp + 0x298]
call fcn.14001db00
nop
lea rdx, [rbp + 0x860]
cmp qword [rbp + 0x878], 0xf
cmova rdx, qword [rbp + 0x860]
mov r8, qword [rbp + 0x870]
mov rcx, rax
call fcn.14000e300
xorps xmm0, xmm0
movups xmmword [rbp + 0x130], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x140], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x130], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x140], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x130]
lea rcx, [rbp + 0x310]
call fcn.14001db00
nop
mov r15, 0xffffffffffffffff
mov r8, r15
nop dword [rax]
inc r8
cmp byte [rbx + r8], 0
jne 0x140032b90
mov rdx, rbx
mov rcx, rax
call fcn.14000e300
xorps xmm0, xmm0
movups xmmword [rbp + 0x110], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x120], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x110], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x120], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rbp + 0x40]
lea rdx, [rbp + 0x110]
lea rcx, [rbp + 0x330]
call fcn.14001df80
nop
lea rdx, [r13 + 0x20]
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x140032c08
mov rdx, qword [rdx]
mov rcx, rax
call fcn.14000e300
xorps xmm0, xmm0
movups xmmword [rbp + 0x7f0], xmm0
mov qword [rbp + 0x800], r14
mov qword [rbp + 0x808], r14
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x7f0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x800], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rbp + 0x348]
cmp rdx, 0xf
jbe 0x140032c90
inc rdx
mov rcx, qword [rbp + 0x330]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032c8b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140032c8b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6ba4
movdqa xmm6, xmmword [0x1400ec3c0]
movdqu xmmword [rbp + 0x340], xmm6
mov byte [rbp + 0x330], 0
mov rdx, qword [rbp + 0x128]
cmp rdx, 0xf
jbe 0x140032ceb
inc rdx
mov rcx, qword [rbp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032ce6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140032ce6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6ba4
movdqu xmmword [rbp + 0x120], xmm6
mov byte [rbp + 0x110], 0
mov rdx, qword [rbp + 0x328]
cmp rdx, 0xf
jbe 0x140032d3e
inc rdx
mov rcx, qword [rbp + 0x310]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032d39
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140032d39
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6ba4
movdqu xmmword [rbp + 0x320], xmm6
mov byte [rbp + 0x310], 0
mov rdx, qword [rbp + 0x148]
cmp rdx, 0xf
jbe 0x140032d91
inc rdx
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032d8c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140032d8c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6ba4
movdqu xmmword [rbp + 0x140], xmm6
mov byte [rbp + 0x130], 0
mov rdx, qword [rbp + 0x2b0]
cmp rdx, 0xf
jbe 0x140032de4
inc rdx
mov rcx, qword [rbp + 0x298]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032ddf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140032ddf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6ba4
movdqu xmmword [rbp + 0x2a8], xmm6
mov byte [rbp + 0x298], 0
mov rdx, qword [rbp + 0x168]
cmp rdx, 0xf
jbe 0x140032e37
inc rdx
mov rcx, qword [rbp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032e32
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140032e32
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6ba4
movdqu xmmword [rbp + 0x160], xmm6
mov byte [rbp + 0x150], 0
mov rdx, qword [rbp + 0x2d0]
cmp rdx, 0xf
jbe 0x140032e87
inc rdx
mov rcx, qword [rbp + 0x2b8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032e82
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400345c2
call fcn.1400c6ba4
movdqu xmmword [rbp + 0x2c8], xmm6
mov byte [rbp + 0x2b8], 0
lea rbx, [r13 + 0x80]
mov rax, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x140032eab
mov rbx, qword [rbx]
cmp rax, 5
jb 0x140033026
lea rdi, [rax + rbx]
lea r8, [rdi - 4]
sub r8, rbx
mov edx, 0x68
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x140033026
cmp dword [rax], 0x70747468
jne 0x140032ee4
cmp byte [rax + 4], 0x73
je 0x140032f05
inc rax
lea r8, [rdi - 4]
sub r8, rax
mov edx, 0x68
mov rcx, rax
call sub.VCRUNTIME140.dll_memchr
test rax, rax
jne 0x140032ed6
jmp 0x140033026
sub rax, rbx
cmp rax, 0xffffffffffffffff
je 0x140033026
movdqa xmm0, xmmword [0x1400cd040]
movdqa xmmword [rbp + 0x3b0], xmm0
movdqa xmm1, xmmword [0x1400ccfb0]
movdqa xmmword [rbp + 0x3c0], xmm1
movdqa xmm0, xmmword [0x1400ccf30]
movdqa xmmword [rbp + 0x3d0], xmm0
movdqa xmm1, xmmword [0x1400ccda0]
movdqa xmmword [rbp + 0x3e0], xmm1
mov byte [rbp + 0x3f0], 1
lea rcx, [rbp + 0x3b0]
call fcn.14002deb0
mov r9d, reloc.WS2_32.dll_recv
xor r8d, r8d
lea rdx, [rbp + 0x3b0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140033006
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140033006
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x4c5e1042
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140033001
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140032fe0
cmp r8d, 0x3c6ad19a
je 0x14003300b
test r9d, r9d
jne 0x140032fc0
mov rax, qword [rax]
jmp 0x140032f90
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
xor ecx, ecx
call rdx
lea rcx, [r13 + 0x80]
mov r8, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 0xf
jbe 0x14003303b
mov rcx, qword [rcx]
test r8, r8
jne 0x14003305e
lea rdx, [0x1400ea089]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14003305e
cmp qword [r13 + 0x90], 0
je 0x140033932
lea rdx, [r13 + 0x80]
xor r8d, r8d
lea rcx, [rbp + 0x250]
call fcn.14000ef30
nop
lea rcx, [rbp + 0x250]
cmp qword [rbp + 0x268], 7
cmova rcx, qword [rbp + 0x250]
mov r9d, 0xffffffff
mov r8d, 3
lea rdx, [rbp + 0xa00]
call fcn.1400c64cc
mov r8d, eax
test eax, eax
jne 0x1400330e8
mov edx, dword [rbp + 0xa10]
mov ecx, edx
shr ecx, 0xa
test cl, 1
je 0x1400330dd
mov eax, dword [rbp + 0xa14]
cmp eax, 0xa000000c
jne 0x1400330cf
mov edx, 4
jmp 0x14003310e
cmp eax, 0xa0000003
jne 0x1400330dd
mov edx, 0xa
jmp 0x14003310e
shr edx, 4
and edx, 1
or edx, 2
jmp 0x14003310e
mov dword [rbp + 0x28c], 0xffff
sub eax, 2
je 0x140033109
sub eax, 1
je 0x140033109
sub eax, 0x32
je 0x140033109
cmp eax, 0x46
mov edx, r14d
jne 0x14003310e
mov edx, 1
mov dword [rbp + 0x1e0], r8d
lea rax, [0x1400ff060]
mov qword [rbp + 0x1e8], rax
movaps xmm0, xmmword [rbp + 0x1e0]
movdqa xmmword [rbp + 0x70], xmm0
test edx, edx
je 0x140033249
cmp edx, 1
sete bl
lea rcx, [rbp + 0x250]
call fcn.140002f70
test bl, bl
je 0x140033274
movdqa xmm0, xmmword [0x1400cd140]
movdqu xmmword [rbp + 0x2d8], xmm0
movdqa xmm1, xmmword [0x1400ccf90]
movdqu xmmword [rbp + 0x2e8], xmm1
movdqa xmm0, xmmword [0x1400ccf20]
movdqu xmmword [rbp + 0x2f8], xmm0
mov word [rbp + 0x308], 0xd5
mov byte [rbp + 0x30a], 1
lea rcx, [rbp + 0x2d8]
call fcn.14002dbf0
mov r9d, reloc.WS2_32.dll_recv
xor r8d, r8d
lea rdx, [rbp + 0x2d8]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140033244
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140033244
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r11 + r9*4]
mov r8d, dword [rdx + r10]
add r8, r10
mov edx, 0xbfe41bfb
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x14003323f
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x140033220
cmp edx, 0x58782fcb
je 0x140033259
test r9d, r9d
jne 0x140033200
mov rax, qword [rax]
jmp 0x1400331d0
mov bl, 1
test r8d, r8d
jne 0x14003476c
jmp 0x14003313d
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
xor ecx, ecx
call rax
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp + 0x8f0]
call sub.VCRUNTIME140.dll_memset
lea rbx, [r13 + 0x80]
cmp qword [rbx + 0x18], 0xf
jbe 0x140033299
mov rbx, qword [rbx]
lea rax, [0x1400ec148]
mov qword [rbp + 0x8f0], rax
lea rcx, [rbp + 0x9a0]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rbp + 0x80], 0x2f
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x900]
lea rcx, [rbp + 0x8f0]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rbp + 0x8f0]
movsxd rcx, dword [rax + 4]
lea rdi, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x8f0], rdi
mov rax, qword [rbp + 0x8f0]
movsxd rcx, dword [rax + 4]
lea r8d, [rcx - 0xb0]
mov dword [rbp + rcx + 0x8ec], r8d
lea rcx, [rbp + 0x900]
call fcn.14000e970
nop
mov r9d, 0x40
mov r8d, 1
mov rdx, rbx
lea rcx, [rbp + 0x900]
call fcn.14000e830
test rax, rax
jne 0x14003335f
mov rax, qword [rbp + 0x8f0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x8f0]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
mov rax, qword [rbp + 0x8f0]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x8f0], rdi
mov rax, qword [rbp + 0x8f0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x8ec], edx
xorps xmm0, xmm0
movups xmmword [rbp + 0x810], xmm0
mov qword [rbp + 0x820], r14
mov qword [rbp + 0x828], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x810], 0
movups xmmword [rbp + 0x890], xmm0
movdqu xmmword [rbp + 0x8a0], xmm6
mov byte [rbp + 0x890], 0
mov rax, qword [rbp + 0x8f0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x8f0]
add rcx, rax
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
movzx r8d, al
lea rdx, [rbp + 0x810]
lea rcx, [rbp + 0x8f0]
call fcn.140022240
movdqa xmm0, xmmword [0x1400cd110]
movdqu xmmword [rbp + 0x370], xmm0
movdqa xmm1, xmmword [0x1400cd060]
movdqu xmmword [rbp + 0x380], xmm1
movdqa xmm0, xmmword [0x1400cd080]
movdqu xmmword [rbp + 0x390], xmm0
mov word [rbp + 0x3a0], 0x100
lea r8, [r13 + 0x80]
mov rcx, qword [r8 + 0x10]
movabs r14, 0x7fffffffffffffff
mov rax, r14
sub rax, rcx
cmp rax, 0x14
jb 0x140034784
mov rax, r8
cmp qword [r8 + 0x18], 0xf
jbe 0x140033462
mov rax, qword [r8]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], reloc.WS2_32.dll_sendto
lea r9, str.certutil__hashfile__
movzx edx, byte [rbp + 0x7d8]
lea rcx, [rbp + 0x540]
call fcn.140011ac0
nop
lea r8, [rbp + 0x370]
lea rdx, [rbp + 0x540]
lea rcx, [rbp + 0x678]
call fcn.14001e080
nop
cmp qword [rax + 0x18], 0xf
jbe 0x1400334b5
mov rax, qword [rax]
xorps xmm0, xmm0
movups xmmword [rbp + 0x230], xmm0
movdqu xmmword [rbp + 0x240], xmm6
mov byte [rbp + 0x230], 0
mov dword [rbp + 0x80], 0xef
movups xmmword [rbp + 0x850], xmm0
lea rdx, [0x1400cc610]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__popen]
mov rcx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__pclose]
mov qword [rbp + 0x850], rcx
mov qword [rbp + 0x858], rax
test rax, rax
je 0x14003471a
mov r8, rax
mov edx, 0x80
lea rcx, [rbp + 0xa40]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgets]
test rax, rax
je 0x14003357b
nop word [rax + rax]
lea rax, [rbp + 0xa40]
mov r8, r15
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140033540
lea rdx, [rbp + 0xa40]
lea rcx, [rbp + 0x230]
call fcn.14001c9a0
mov r8, qword [rbp + 0x858]
mov edx, 0x80
lea rcx, [rbp + 0xa40]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgets]
test rax, rax
jne 0x140033530
mov rcx, qword [rbp + 0x858]
test rcx, rcx
je 0x14003358e
call qword [rbp + 0x850]
nop
lea rdx, [rbp + 0x230]
lea rcx, [rbp + 0x890]
call fcn.140027800
nop
lea rcx, [rbp + 0x230]
call fcn.14000c720
nop
lea rcx, [rbp + 0x678]
call fcn.14000c720
nop
lea rcx, [rbp + 0x540]
call fcn.14000c720
mov dword [rsp + 0x54], 0x3d6e65
mov dword [rsp + 0x50], 0x6b6f7426
mov byte [rsp + 0x58], 0
lea rax, [rsp + 0x50]
mov rcx, r15
inc rcx
cmp byte [rax + rcx], 0
jne 0x1400335e5
mov rax, r14
mov rdx, qword [rbp + 0x820]
sub rax, rdx
cmp rax, rcx
jb 0x140034784
lea rax, [rbp + 0x810]
cmp qword [rbp + 0x828], 0xf
cmova rax, qword [rbp + 0x810]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x50]
lea r8, [rbp + 0x810]
movzx edx, byte [rbp + 0x7d8]
lea rcx, [rbp + 0x210]
call fcn.140011ac0
nop
mov rdi, qword [rbp + 0x220]
lea r9, [rbp + 0x210]
cmp qword [rbp + 0x228], 0xf
cmova r9, qword [rbp + 0x210]
mov rsi, qword [rbp + 0x800]
mov rcx, qword [rbp + 0x808]
mov rax, rcx
sub rax, rsi
cmp rdi, rax
ja 0x1400336b8
lea rax, [rsi + rdi]
mov qword [rbp + 0x800], rax
lea rbx, [rbp + 0x7f0]
cmp rcx, 0xf
cmova rbx, qword [rbp + 0x7f0]
lea rcx, [rbx + rsi]
mov r8, rdi
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
lea rax, [rdi + rbx]
mov byte [rax + rsi], 0
jmp 0x1400336d0
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rdx, rdi
lea rcx, [rbp + 0x7f0]
call fcn.140010900
nop
lea rcx, [rbp + 0x210]
call fcn.14000c720
lea r8, [r13 + 0x80]
mov dword [rsp + 0x44], 0x3d6873
mov dword [rsp + 0x40], 0x61687426
mov byte [rsp + 0x48], 0
lea rcx, [rsp + 0x40]
mov rax, r15
inc rax
cmp byte [rcx + rax], 0
jne 0x140033700
mov rdx, qword [r8 + 0x10]
sub r14, rdx
cmp r14, rax
jb 0x140034784
mov rcx, r8
cmp qword [r8 + 0x18], 0xf
jbe 0x140033726
mov rcx, qword [r8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
movzx edx, byte [rbp + 0x7d8]
lea rcx, [rbp + 0xf0]
call fcn.140011ac0
nop
mov rdi, qword [rbp + 0x100]
lea r9, [rbp + 0xf0]
cmp qword [rbp + 0x108], 0xf
cmova r9, qword [rbp + 0xf0]
mov rsi, qword [rbp + 0x800]
mov rcx, qword [rbp + 0x808]
mov rax, rcx
sub rax, rsi
cmp rdi, rax
ja 0x1400337bc
lea rax, [rdi + rsi]
mov qword [rbp + 0x800], rax
lea rbx, [rbp + 0x7f0]
cmp rcx, 0xf
cmova rbx, qword [rbp + 0x7f0]
lea rcx, [rbx + rsi]
mov r8, rdi
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
lea rax, [rbx + rdi]
mov byte [rax + rsi], 0
jmp 0x1400337d4
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rdx, rdi
lea rcx, [rbp + 0x7f0]
call fcn.140010900
nop
mov rdx, qword [rbp + 0x108]
cmp rdx, 0xf
jbe 0x140033818
inc rdx
mov rcx, qword [rbp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140033813
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140033813
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6ba4
movdqu xmmword [rbp + 0x100], xmm6
mov byte [rbp + 0xf0], 0
mov rdx, qword [rbp + 0x8a8]
cmp rdx, 0xf
jbe 0x14003386b
inc rdx
mov rcx, qword [rbp + 0x890]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140033866
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140033866
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6ba4
movdqu xmmword [rbp + 0x8a0], xmm6
mov byte [rbp + 0x890], 0
mov rdx, qword [rbp + 0x828]
cmp rdx, 0xf
jbe 0x1400338be
inc rdx
mov rcx, qword [rbp + 0x810]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400338b9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400338b9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6ba4
xor r14d, r14d
mov qword [rbp + 0x820], r14
mov qword [rbp + 0x828], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x810], r14b
mov rax, qword [rbp + 0x8f0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x8f0], rax
mov rax, qword [rbp + 0x8f0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x8ec], edx
lea rcx, [rbp + 0x900]
call fcn.14000bf90
lea rcx, [rbp + 0x908]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x9a0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
mov rcx, r12
call fcn.14003fd80
lea rax, [rbp + 0x698]
mov qword [rbp + 0x80], rax
lea rdx, [r13 + 0x60]
lea rcx, [rbp + 0x698]
call fcn.14000c8d0
mov rbx, rax
lea rdx, [rbp + 0x7f0]
lea rcx, [rbp + 0x6b8]
call fcn.14000c8d0
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x830]
call fcn.14003a8e0
nop
mov dword [rbp - 0x6c], 0x64696c
mov dword [rbp - 0x78], 0x4179654b
mov dword [rbp - 0x74], 0x5f687475
mov dword [rbp - 0x70], 0x61766e49
mov byte [rbp - 0x68], 0
lea rcx, [rbp - 0x78]
mov rax, r15
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x1400339b0
lea rcx, [rbp + 0x830]
mov rbx, qword [rbp + 0x830]
mov rdi, qword [rbp + 0x848]
cmp rdi, 0xf
cmova rcx, rbx
mov r8, qword [rbp + 0x840]
cmp r8, rax
jne 0x140033b42
lea rdx, [rbp - 0x78]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140033b42
movdqa xmm0, xmmword [0x1400cd100]
movdqa xmmword [rbp + 0x190], xmm0
movdqa xmm1, xmmword [0x1400ccf00]
movdqa xmmword [rbp + 0x1a0], xmm1
movdqa xmm0, xmmword [0x1400ccfc0]
movdqa xmmword [rbp + 0x1b0], xmm0
movdqa xmm1, xmmword [0x1400cce60]
movdqa xmmword [rbp + 0x1c0], xmm1
mov dword [rbp + 0x1d0], 0x236879
mov byte [rbp + 0x1d4], 1
mov rcx, r14
nop dword [rax + rax]
lea eax, [rcx - 0x35]
xor byte [rbp + rcx + 0x190], al
inc rcx
cmp rcx, 0x43
jb 0x140033a50
mov byte [rbp + 0x1d4], 0
mov r9d, reloc.WS2_32.dll_recv
xor r8d, r8d
lea rdx, [rbp + 0x190]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140033b14
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140033b14
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r10 + r9*4]
mov r8d, dword [rdx + r11]
add r8, r10
mov edx, 0x859a829e
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x140033b0f
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x140033af0
cmp edx, 0x11f09326
je 0x140033b19
test r9d, r9d
jne 0x140033ad0
mov rax, qword [rax]
jmp 0x140033aa0
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
xor ecx, ecx
call rax
mov rdi, qword [rbp + 0x848]
mov rbx, qword [rbp + 0x830]
lea rax, [rbp + 0x1f0]
mov qword [rbp + 0x170], rax
lea rdx, [rbp + 0x830]
cmp rdi, 0xf
cmova rdx, rbx
xorps xmm0, xmm0
movups xmmword [rbp + 0x1f0], xmm0
mov qword [rbp + 0x200], r14
mov qword [rbp + 0x208], r14
nop word [rax + rax]
inc r15
cmp byte [rdx + r15], 0
jne 0x140033b80
mov r8, r15
lea rcx, [rbp + 0x1f0]
call fcn.14000fed0
nop
lea rax, [rbp + 0x6d8]
mov qword [rbp + 0x80], rax
lea rdx, [0x1400ff040]
lea rcx, [rbp + 0x6d8]
call fcn.14000c8d0
mov rbx, rax
lea rdx, [0x1400ff020]
lea rcx, [rbp + 0x6f8]
call fcn.14000c8d0
nop
lea r8, [rbp + 0x1f0]
mov rdx, rbx
mov rcx, rax
call fcn.1400288e0
xor eax, 0xa5a5
mov edx, eax
shr eax, 8
movzx r8d, al
movzx eax, dl
movabs rsi, 0xcbf29ce484222325
xor rax, rsi
movabs rdi, 0x100000001b3
imul rax, rdi
xor r8, rax
imul r8, rdi
mov eax, edx
shr eax, 0x10
movzx ecx, al
xor r8, rcx
imul r8, rdi
shr rdx, 0x18
xor r8, rdx
imul r8, rdi
cmp r8w, 0xdf7f
jne 0x1400344d8
mov qword [rbp + 0x7d0], r14
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x798]
lea rdx, [rbp + 0x830]
lea rcx, [rbp + 0x7e0]
call fcn.140023fb0
nop
lea rdx, [r13 + 0x20]
lea rcx, [rbp + 0x178]
call fcn.14001d140
nop
mov dword [rbp - 0x40], 0xaba3bba4
mov dword [rbp - 0x3c], 0xb5b9bd
mov byte [rbp - 0x38], 1
lea rdx, [rbp + 0x638]
lea rcx, [rbp - 0x40]
call fcn.140028110
mov rdx, rax
lea rcx, [rbp + 0x7e0]
call fcn.140027ce0
mov rcx, rax
lea rdx, [rbp + 0x178]
call fcn.140027c70
movzx ebx, al
movzx edx, byte [rbp + 0x178]
lea rcx, [rbp + 0x180]
call fcn.14002e0d0
nop
test bl, bl
je 0x140033d87
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140033d64
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140033d64
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r10 + r9*4]
mov r8d, dword [rdx + r11]
add r8, r10
mov edx, 0x754860fb
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x140033d5f
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x140033d40
cmp edx, 0xed1bc4cb
je 0x140033d69
test r9d, r9d
jne 0x140033d20
mov rax, qword [rax]
jmp 0x140033cf0
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
mov ecx, 8
call rax
mov dword [rbp - 0x30], 0xbdbea9a6
mov dword [rbp - 0x2c], 0xb4b7ae
mov byte [rbp - 0x28], 1
lea rdx, [rbp + 0x578]
lea rcx, [rbp - 0x30]
call fcn.140028110
mov rdx, rax
lea rcx, [rbp + 0x7e0]
call fcn.140027ce0
lea rdx, [rbp + 0xa20]
mov rcx, rax
call fcn.14001d850
nop
lea rdx, [rbp + 0x7e0]
lea rcx, [rbp + 0x360]
call fcn.1400264e0
mov rdx, rax
mov rcx, r13
call fcn.140035f00
mov dword [rsp + 0x60], 0xaba9a3a8
mov word [rsp + 0x64], 0x100
lea rdx, [rbp + 0x738]
lea rcx, [rsp + 0x60]
call fcn.1400280d0
mov rdx, rax
lea rcx, [rbp + 0x7e0]
call fcn.140027ce0
mov rcx, rax
call fcn.14001d730
mov edx, eax
shr eax, 8
movzx ebx, al
movzx eax, dl
xor rax, rsi
imul rax, rdi
xor rbx, rax
imul rbx, rdi
mov eax, edx
shr eax, 0x10
movzx ecx, al
xor rbx, rcx
imul rbx, rdi
shr rdx, 0x18
xor rbx, rdx
imul rbx, rdi
mov dword [rbp - 0x20], 0xadaeb9b8
mov dword [rbp - 0x1c], 0xa2a3aa
mov byte [rbp - 0x18], 1
lea rdx, [rbp + 0x758]
lea rcx, [rbp - 0x20]
call fcn.140028110
mov rdx, rax
lea rcx, [rbp + 0x7e0]
call fcn.140027ce0
mov rcx, rax
call fcn.14001d9a0
test al, al
je 0x140033f9c
mov dword [rbp - 0x10], 0xadaeb9b8
mov dword [rbp - 0xc], 0xa2a3aa
mov byte [rbp - 8], 1
lea rdx, [rbp + 0x778]
lea rcx, [rbp - 0x10]
call fcn.140028110
mov rdx, rax
lea rcx, [rbp + 0x7e0]
call fcn.140027ce0
mov rcx, rax
call fcn.14001d9a0
test al, al
je 0x140033ee1
movabs rax, 0xcbe5c873d26645f1
cmp rbx, rax
je 0x140033f9c
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140033f74
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140033f74
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r10 + r9*4]
mov r8d, dword [rdx + r11]
add r8, r10
mov edx, 0x4d0c7ad9
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x140033f6f
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x140033f50
cmp edx, 0x1bc743b9
je 0x140033f79
test r9d, r9d
jne 0x140033f30
mov rax, qword [rax]
jmp 0x140033f00
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
mov ecx, 9
call rax
jmp 0x1400344b2
mov dword [rbp], 0xadaeb9b8
mov dword [rbp + 4], 0xa2a3aa
mov byte [rbp + 8], 1
lea rdx, [rbp + 0x598]
lea rcx, [rbp]
call fcn.140028110
mov rdx, rax
lea rcx, [rbp + 0x7e0]
call fcn.140027ce0
mov rcx, rax
call fcn.14001d9a0
test al, al
je 0x1400340c5
mov dword [rbp + 0x50], 0x9dbaa9a5
mov dword [rbp + 0x54], 0xbba2a3aa
mov dword [rbp + 0x58], 0x100babc
lea rdx, [rbp + 0x5b8]
lea rcx, [rbp + 0x50]
call fcn.140028230
mov rdx, rax
lea rcx, [rbp + 0x7e0]
call fcn.140027ce0
mov rcx, rax
call fcn.14001d9a0
test al, al
je 0x140034028
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp + 0x30], 0xbdbea9b8
mov dword [rbp + 0x34], 0xbbbfbfa6
mov word [rbp + 0x38], 0xb7
mov byte [rbp + 0x3a], 1
lea rdx, [rbp + 0x5d8]
lea rcx, [rbp + 0x30]
call fcn.1400281b0
mov rdx, rax
lea rcx, [rbp + 0x7e0]
call fcn.140027ce0
mov rdx, rax
lea rcx, [r13 + 0x240]
call fcn.14001d4c0
mov byte [0x140100d10], 1
mov dword [rbp - 0x60], 0xa7bdbcaa
mov dword [rbp - 0x5c], 0xbeb6a1
mov byte [rbp - 0x58], 1
lea rdx, [rbp + 0x5f8]
lea rcx, [rbp - 0x60]
call fcn.140028110
mov rdx, rax
lea rcx, [rbp + 0x7e0]
call fcn.140027ce0
mov rdx, rax
lea rcx, [rbp + 0x350]
call fcn.1400264e0
mov rdx, rax
mov rcx, r13
call fcn.140035d40
jmp 0x1400344b2
mov dword [rbp + 0x60], 0xafbba2a2
mov dword [rbp + 0x64], 0xa4b5b9a3
mov dword [rbp + 0x68], 0x100a6b6
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
mov byte [rbp + 0xe0], 0
xor eax, eax
mov qword [rbp + 0xe8], rax
xor edx, edx
lea rcx, [rbp + 0xe8]
call fcn.14002e0d0
mov byte [rbp + 0xe0], 3
xorps xmm0, xmm0
movups xmmword [rbp + 0x880], xmm0
mov ecx, 0x20
call fcn.1400c6920
lea rcx, [rbp + 0x7d8]
mov qword [rbp + 0x880], rcx
mov qword [rbp + 0x888], rax
mov rdx, rax
lea rcx, [rbp + 0x60]
call fcn.140028230
mov rax, qword [rbp + 0x888]
mov qword [rbp + 0x888], r14
mov qword [rbp + 0xe8], rax
mov dword [rbp - 0x50], 0xbdbea9a6
mov dword [rbp - 0x4c], 0xb4b7ae
mov byte [rbp - 0x48], 1
lea rdx, [rbp + 0x618]
lea rcx, [rbp - 0x50]
call fcn.140028110
mov rdx, rax
lea rcx, [rbp + 0x7e0]
call fcn.140027ce0
mov rcx, rax
lea rdx, [rbp + 0xe0]
call fcn.140027890
movzx ebx, al
movzx edx, byte [rbp + 0xe0]
lea rcx, [rbp + 0xe8]
call fcn.14002e0d0
nop
test bl, bl
je 0x1400344b2
mov dword [rbp + 0x10], 0xa0baa3af
mov dword [rbp + 0x14], 0xb6b0bfa3
mov word [rbp + 0x18], 0x100
lea rdx, [rbp + 0x718]
lea rcx, [rbp + 0x10]
call fcn.140028160
mov rdx, rax
lea rcx, [rbp + 0x7e0]
call fcn.140027ce0
lea rdx, [rbp + 0x8d0]
mov rcx, rax
call fcn.14001d850
nop
lea rcx, [rbp + 0x8d0]
mov rbx, qword [rbp + 0x8d0]
mov rdi, qword [rbp + 0x8e8]
cmp rdi, 0xf
cmova rcx, rbx
mov r8, qword [rbp + 0x8e0]
test r8, r8
jne 0x1400343ba
lea rdx, [0x1400ea089]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400343ba
movdqa xmm0, xmmword [0x1400cd020]
movdqa xmmword [rbp + 0x400], xmm0
movdqa xmm1, xmmword [0x1400ccee0]
movdqa xmmword [rbp + 0x410], xmm1
movdqa xmm0, xmmword [0x1400cd0b0]
movdqa xmmword [rbp + 0x420], xmm0
movdqa xmm1, xmmword [0x1400cced0]
movdqa xmmword [rbp + 0x430], xmm1
movdqa xmm0, xmmword [0x1400cce90]
movdqa xmmword [rbp + 0x440], xmm0
movdqa xmm1, xmmword [0x1400cce40]
movdqa xmmword [rbp + 0x450], xmm1
movdqa xmm0, xmmword [str._vNAOA_]
movdqa xmmword [rbp + 0x460], xmm0
movdqa xmm1, xmmword [0x1400cce10]
movdqa xmmword [rbp + 0x470], xmm1
movdqa xmm0, xmmword [0x1400cce20]
movdqa xmmword [rbp + 0x480], xmm0
movdqa xmm1, xmmword [0x1400ccde0]
movdqa xmmword [rbp + 0x490], xmm1
movdqa xmm0, xmmword [0x1400ccdd0]
movdqa xmmword [rbp + 0x4a0], xmm0
movdqa xmm1, xmmword [0x1400cd0c0]
movdqa xmmword [rbp + 0x4b0], xmm1
movdqa xmm0, xmmword [0x1400cd0e0]
movdqa xmmword [rbp + 0x4c0], xmm0
movdqa xmm1, xmmword [0x1400cd090]
movdqa xmmword [rbp + 0x4d0], xmm1
movdqa xmm0, xmmword [0x1400cd070]
movdqa xmmword [rbp + 0x4e0], xmm0
movdqa xmm1, xmmword [0x1400ccff0]
movdqa xmmword [rbp + 0x4f0], xmm1
movdqa xmm0, xmmword [0x1400cd010]
movdqa xmmword [rbp + 0x500], xmm0
movdqa xmm1, xmmword [0x1400ccf60]
movdqa xmmword [rbp + 0x510], xmm1
movdqa xmm0, xmmword [0x1400ccfe0]
movdqa xmmword [rbp + 0x520], xmm0
mov dword [rbp + 0x530], 0x87918898
mov word [rbp + 0x534], 0xd1
mov byte [rbp + 0x536], 1
mov rcx, r14
lea eax, [rcx - 0x35]
xor byte [rbp + rcx + 0x400], al
inc rcx
cmp rcx, 0x135
jb 0x140034383
mov byte [rbp + 0x536], 0
mov r9d, reloc.WS2_32.dll_recv
xor r8d, r8d
lea rdx, [rbp + 0x400]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x1400343fe
lea r8, [rbp + 0x8d0]
cmp rdi, 0xf
cmova r8, rbx
mov word [rsp + 0x6b], WSACleanup
mov word [rsp + 0x68], 0x706f
mov byte [rsp + 0x6a], 0x65
mov byte [rsp + 0x6d], 0
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea rdx, [rsp + 0x68]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140034484
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140034484
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r10 + r9*4]
mov r8d, dword [rdx + r11]
add r8, r10
mov edx, 0xda02cb74
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x14003447f
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x140034460
cmp edx, 0x87030684
je 0x140034489
test r9d, r9d
jne 0x140034440
mov rax, qword [rax]
jmp 0x140034410
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
xor ecx, ecx
call rax
nop
lea rcx, [rbp + 0x8d0]
call fcn.14000c720
nop
lea rcx, [rbp + 0xa20]
call fcn.14000c720
nop
movzx edx, byte [rbp + 0x7e0]
lea rcx, [rbp + 0x7e8]
call fcn.14002e0d0
nop
jmp 0x14003458a
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140034566
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140034566
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r10 + r9*4]
mov ecx, dword [rdx + r11]
add rcx, r10
mov r8d, 0xcc163d22
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140034561
nop
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x140034540
cmp r8d, 0x468c827a
je 0x14003456b
test r9d, r9d
jne 0x140034520
mov rax, qword [rax]
jmp 0x1400344f0
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
mov ecx, 7
call rax
nop
mov rdx, qword [rbp + 0x848]
cmp rdx, 0xf
jbe 0x1400345ce
inc rdx
mov rcx, qword [rbp + 0x830]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400345c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400345c9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6ba4
mov qword [rbp + 0x840], r14
mov qword [rbp + 0x848], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x830], 0
mov rdx, qword [rbp + 0x808]
cmp rdx, 0xf
jbe 0x14003462b
inc rdx
mov rcx, qword [rbp + 0x7f0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140034626
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140034626
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6ba4
mov qword [rbp + 0x800], r14
mov qword [rbp + 0x808], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x7f0], 0
mov rdx, qword [rbp + 0x878]
cmp rdx, 0xf
jbe 0x140034688
inc rdx
mov rcx, qword [rbp + 0x860]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140034683
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140034683
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6ba4
mov qword [rbp + 0x870], r14
mov qword [rbp + 0x878], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x860], 0
mov rdx, qword [rbp + 0x8c8]
cmp rdx, 0xf
jbe 0x1400346e5
inc rdx
mov rcx, qword [rbp + 0x8b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400346e0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400346e0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6ba4
mov rcx, qword [rbp + 0xac0]
xor rcx, rsp
call fcn.1400c6900
lea r11, [rsp + 0xbe0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
movdqa xmm0, xmmword [0x1400ccdc0]
movdqu xmmword [rbp + 0x270], xmm0
mov byte [rbp + 0x280], 1
lea rdx, [rbp + 0x658]
lea rcx, [rbp + 0x270]
call fcn.140028210
nop
lea rdx, [rbp + 0x658]
lea rcx, [rbp + 0x560]
call fcn.140001bb0
lea rdx, [0x1400faae0]
lea rcx, [rbp + 0x560]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
lea r8, [rbp + 0x250]
lea rdx, [rbp + 0x70]
lea rcx, str.exists
call fcn.140003900
nop
call fcn.140001b90
int3