Function at 0x14000a310
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Encode data using xor
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x510
mov rax, qword [0x14008c118]
xor rax, rsp
mov qword [rsp + 0x500], rax
mov r15, rcx
mov qword [rsp + 0x78], rcx
xor edi, edi
mov byte [rsp + 0x31], dil
xor r13b, r13b
mov byte [0x14008c910], r13b
xor r8d, r8d
lea rdx, [0x14006f36b]
lea rcx, [0x14008c918]
call fcn.140004040
mov ecx, 0x1024
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
xor edx, edx
mov r8d, 0x1024
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0xd0], rdi
mov qword [rsp + 0xe0], 6
mov qword [rsp + 0xe8], reloc.WS2_32.dll_ntohs
mov ecx, dword [str.remove]
mov dword [rsp + 0xd0], ecx
movzx ecx, word [0x14006f38c]
mov word [rsp + 0xd4], cx
mov byte [rsp + 0xd6], r13b
lea rax, [rsp + 0x110]
mov qword [rsp + 0x1d0], rax
mov dword [rsp + 0x88], 0x1007774
mov ecx, edi
nop word [rax + rax]
lea eax, [rcx + 0x49]
xor byte [rsp + rcx + 0x88], al
inc rcx
cmp rcx, 2
jb 0x14000a400
mov byte [rsp + 0x8b], 0
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x8a]
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x110]
call fcn.140007890
nop
mov rdx, qword [0x14008ca60]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], rdi
mov r12, 0xffffffffffffffff
mov r8, r12
nop
inc r8
cmp byte [rdx + r8], 0
jne 0x14000a460
lea rcx, [rsp + 0x58]
call fcn.140002ad0
nop
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x110]
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x130]
mov rcx, r15
call fcn.14000ef40
mov rcx, rax
cmp qword [rax + 0x18], 0x10
jb 0x14000a4ac
mov rcx, qword [rax]
mov rdx, rbx
sub rdx, rcx
movzx eax, byte [rcx]
mov byte [rcx + rdx], al
lea rcx, [rcx + 1]
test al, al
jne 0x14000a4b2
mov rdx, qword [rsp + 0x148]
cmp rdx, 0x10
jb 0x14000a506
inc rdx
mov rcx, qword [rsp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a501
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000a501
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006ab5c
mov rcx, qword [0x14008ca60]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], rdi
mov r8, r12
inc r8
cmp byte [rbx + r8], 0
jne 0x14000a525
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.140002ad0
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x50]
call fcn.140018430
mov rcx, rax
cmp qword [rax + 0x18], 0x10
jb 0x14000a560
mov rcx, qword [rax]
mov rdx, rbx
sub rdx, rcx
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rcx + rdx], al
lea rcx, [rcx + 1]
test al, al
jne 0x14000a570
mov rdx, qword [rsp + 0x128]
cmp rdx, 0x10
jb 0x14000a5c4
inc rdx
mov rcx, qword [rsp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a5bf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000a5bf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006ab5c
lea rdx, str.NB64
mov rcx, rbx
call sub.VCRUNTIME140.dll_strstr
test rax, rax
je 0x14000aa6b
mov ecx, dword [0x14008ca98]
sub ecx, 1
je 0x14000a9fb
sub ecx, 1
je 0x14000a99a
sub ecx, 1
je 0x14000a8a6
cmp ecx, 1
je 0x14000a67b
mov dword [rsp + 0x90], 0x2200241c
mov dword [rsp + 0x94], 0x70213922
mov dword [rsp + 0x98], 0x3b212014
mov word [rsp + 0x9c], Ordinal_41
mov byte [rsp + 0x9e], 1
nop word [rax + rax]
lea eax, [rdi + 0x49]
xor byte [rsp + rdi + 0x90], al
inc rdi
cmp rdi, 0xd
jb 0x14000a640
mov byte [rsp + 0x9e], 0
lea rcx, [rsp + 0x90]
call fcn.140014050
mov byte [0x14008c911], 1
mov byte [0x14008caa1], 1
jmp 0x14000c974
mov dword [rsp + 0x90], 0x2f2e220a
mov dword [rsp + 0x94], 0x703d2b26
mov dword [rsp + 0x98], 0x383a3337
mov dword [rsp + 0x9c], 0x1003230
mov rcx, rdi
nop word [rax + rax]
lea eax, [rcx + 0x49]
xor byte [rsp + rcx + 0x90], al
inc rcx
cmp rcx, 0xe
jb 0x14000a6b0
mov byte [rsp + 0x9f], 0
lea rcx, [rsp + 0x90]
call fcn.140014050
cmp dword [0x14008ca98], 4
jne 0x14000a893
mov edx, dword [0x14008ca80]
mov ecx, edx
test edx, edx
je 0x14000a806
sub ecx, 1
je 0x14000a806
sub ecx, 1
je 0x14000a806
mov byte [0x14008c911], 1
mov byte [0x14008caa1], 1
mov dword [rsp + 0x90], 0x28272b0e
mov dword [rsp + 0x94], 0x353d3c22
mov word [rsp + 0x98], 0x100
cmp ecx, 1
je 0x14000a7a3
nop word [rax + rax]
lea eax, [rdi + 0x49]
xor byte [rsp + rdi + 0x90], al
inc rdi
cmp rdi, 8
jb 0x14000a740
mov byte [rsp + 0x99], 0
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x98]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x110]
call fcn.140007890
lea rdx, [rsp + 0x110]
lea rcx, [0x14008c918]
call fcn.140008cf0
lea rcx, [rsp + 0x110]
call fcn.140001ce0
jmp 0x14000c974
lea eax, [rdi + 0x49]
xor byte [rsp + rdi + 0x90], al
inc rdi
cmp rdi, 8
jb 0x14000a7a3
mov byte [rsp + 0x99], 0
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x98]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x110]
call fcn.140007890
lea rdx, [rsp + 0x110]
lea rcx, [0x14008c918]
call fcn.140008cf0
lea rcx, [rsp + 0x110]
call fcn.140001ce0
jmp 0x14000c974
inc edx
mov dword [0x14008ca80], edx
mov byte [0x14008c910], 1
mov dword [rsp + 0x88], 0x2939250a
mov word [rsp + 0x8c], 0x100
nop word [rax + rax]
lea eax, [rdi + 0x49]
xor byte [rsp + rdi + 0x88], al
inc rdi
cmp rdi, 4
jb 0x14000a830
mov byte [rsp + 0x8d], 0
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x8c]
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x110]
call fcn.140007890
lea rdx, [rsp + 0x110]
lea rcx, [0x14008c918]
call fcn.140008cf0
lea rcx, [rsp + 0x110]
call fcn.140001ce0
jmp 0x14000c974
mov byte [0x14008c911], 1
mov byte [0x14008caa1], 1
jmp 0x14000c974
mov byte [0x14008c910], 0
mov dword [rsp + 0x90], 0x252c2505
mov dword [rsp + 0x94], 0x31296e23
mov dword [rsp + 0x98], 0x30363e38
mov word [rsp + 0x9c], 0x100
nop dword [rax + rax]
lea eax, [rdi + 0x49]
xor byte [rsp + rdi + 0x90], al
inc rdi
cmp rdi, 0xc
jb 0x14000a8e0
mov byte [rsp + 0x9d], 0
mov qword [rsp + 0xe0], send
mov qword [rsp + 0xe8], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [rsp + 0x90]
movsd qword [rsp + 0xd0], xmm0
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0xd8], eax
mov byte [rsp + 0xdc], 0
lea rdx, [rsp + 0xd0]
lea rcx, [0x14008c960]
call fcn.140008cf0
mov rdx, qword [rsp + 0xe8]
cmp rdx, 0x10
jb 0x14000a995
inc rdx
mov rcx, qword [rsp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a990
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000a990
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006ab5c
jmp 0x14000c974
movdqa xmm0, xmmword [0x14006f4b0]
movdqu xmmword [rsp + 0x90], xmm0
mov word [rsp + 0xa0], 0x3d
mov byte [rsp + 0xa2], 1
nop dword [rax]
lea eax, [rdi + 0x49]
xor byte [rsp + rdi + 0x90], al
inc rdi
cmp rdi, 0x11
jb 0x14000a9c0
mov byte [rsp + 0xa2], 0
lea rcx, [rsp + 0x90]
call fcn.140014050
mov byte [0x14008c911], 1
mov byte [0x14008caa1], 1
jmp 0x14000c974
movdqa xmm0, xmmword [0x14006f4c0]
movdqu xmmword [rsp + 0x90], xmm0
mov dword [rsp + 0xa0], 0x39373338
mov word [rsp + 0xa4], reloc.WS2_32.dll_gethostname
mov byte [rsp + 0xa6], 1
nop dword [rax]
lea eax, [rdi + 0x49]
xor byte [rsp + rdi + 0x90], al
inc rdi
cmp rdi, 0x15
jb 0x14000aa30
mov byte [rsp + 0xa6], 0
lea rcx, [rsp + 0x90]
call fcn.140014050
mov byte [0x14008c911], 1
mov byte [0x14008caa1], 1
jmp 0x14000c974
mov dword [0x14008ca80], edi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x68], 1
mov qword [rsp + 0x70], reloc.WS2_32.dll_ntohs
mov word [rsp + 0x58], Ordinal_60
mov qword [rsp + 0x110], rdi
mov qword [rsp + 0x120], rdi
mov qword [rsp + 0x128], rdi
mov r8, r12
nop word [rax + rax]
inc r8
cmp byte [rbx + r8], 0
jne 0x14000aac0
mov rdx, rbx
lea rcx, [rsp + 0x110]
call fcn.140002ad0
nop
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x38]
call fcn.140010810
nop
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [rsp + 0x38]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rsi, rax
cmp qword [rbx + 0x18], 0x10
jb 0x14000ab14
mov rbx, qword [rbx]
mov dword [rax], edi
mov r8d, 0xa
lea rdx, [rsp + 0x88]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtol]
mov ecx, eax
cmp rbx, qword [rsp + 0x88]
je 0x14000ca46
cmp dword [rsi], 0x22
je 0x14000ca52
cmp ecx, 0x22b
jg 0x14000ac08
je case.0x14000ac48.730
sub ecx, 0x67
je 0x14000ab78
sub ecx, 0xa
je 0x14000ab78
sub ecx, 0x32
je 0x14000ab78
sub ecx, 0xf0
je 0x14000ab78
cmp ecx, 1
jne case.0x14000ac48.637
mov rcx, qword [rsp + 0x38]
add rcx, 0x20
cmp qword [rcx + 0x18], 0x10
jb 0x14000ab8b
mov rcx, qword [rcx]
call fcn.140014050
mov byte [0x14008c911], 1
mov byte [0x14008caa1], 1
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14000ca41
lea r8, [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
call fcn.140007a10
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ca3c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000ca3c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov byte [0x14008c910], 1
jmp 0x14000adfe
cmp ecx, 0x387
jg 0x14000ad78
je case.0x14000ac48.701
add ecx, 0xfffffd84
cmp ecx, 0x91
ja case.0x14000ac48.637
movsxd rax, ecx
lea rdx, [0x140000000]
movzx eax, byte [rdx + rax + 0xca7c]
mov ecx, dword [rdx + rax*4 + 0xca64]
add rcx, rdx
jmp rcx
mov r13b, 1
inc dword [0x14008ca68]
jmp 0x14000adfe
mov dword [rsp + 0x88], 0x382e2467
mov word [rsp + 0x8c], 0x100
lea rcx, [rsp + 0x88]
call fcn.14000d710
mov rdx, rax
lea rcx, [0x14008cb08]
call fcn.1400079c0
test al, al
je 0x14000ac9b
mov byte [0x14008c911], 1
mov byte [0x14008caa1], 1
cmp dword [0x14008ca88], 0x369f
je 0x14000acb5
mov byte [0x14008c911], 1
mov byte [0x14008caa1], 1
cmp dword [0x14008ca90], 0x2c5aa
je 0x14000accf
mov byte [0x14008c911], 1
mov byte [0x14008caa1], 1
lea rdx, [0x14008cb28]
lea rcx, [rsp + 0x130]
call fcn.140002d90
lea rdx, [0x14008cb48]
lea rcx, [rsp + 0x130]
call fcn.140007980
movzx ebx, al
lea rcx, [rsp + 0x130]
call fcn.140001ce0
test bl, bl
je 0x14000ad19
mov byte [0x14008c911], 1
mov byte [0x14008caa1], 1
mov byte [rsp + 0x31], 1
jmp 0x14000adfe
mov byte [0x14008c910], 1
mov byte [0x14008caa0], 1
mov rdx, qword [rsp + 0x38]
add rdx, 0x20
lea rcx, [rsp + 0x150]
call fcn.140002d90
mov rdx, rax
lea rcx, [rsp + 0x130]
call fcn.140014fc0
mov rdx, rax
lea rcx, [0x14008cac8]
call fcn.140008cf0
lea rcx, [rsp + 0x130]
call fcn.140001ce0
jmp 0x14000adfe
cmp ecx, 0xbbd
jg 0x14000c9a1
je 0x14000adb0
sub ecx, 0x3e9
je 0x14000b027
sub ecx, 0xa
je 0x14000b027
sub ecx, 0x29
je case.0x14000ac48.701
cmp ecx, 0x7a0
jne case.0x14000ac48.637
mov byte [0x14008c910], 0
mov rdx, qword [rsp + 0x38]
add rdx, 0x20
cmp qword [rdx + 0x18], 0x10
jb 0x14000adca
mov rdx, qword [rdx]
mov r8, r12
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x14000add0
lea rcx, [0x14008c960]
call fcn.140004040
mov rcx, qword [rsp + 0x38]
add rcx, 0x20
cmp qword [rcx + 0x18], 0x10
jb 0x14000adf9
mov rcx, qword [rcx]
call fcn.140014050
cmp byte [0x14008c911], 0
jne 0x14000ab9e
cmp byte [0x14008caa1], 0
jne 0x14000ab9e
test r13b, r13b
je 0x14000c196
cmp dword [0x14008ca68], 1
jne 0x14000b1de
mov ecx, 8
call fcn.14006ab20
mov qword [rsp + 0x90], rax
test rax, rax
je 0x14000b04b
mov rcx, rax
call fcn.140013c70
mov rbx, rax
jmp 0x14000b04e
mov qword [rsp + 0xb0], rdi
mov qword [rsp + 0xc0], rdi
mov qword [rsp + 0xc8], rdi
mov rsi, qword [0x14008cb38]
lea r15, [0x14008cb28]
cmp qword [0x14008cb40], 0x10
cmovae r15, qword [0x14008cb28]
movabs rbx, 0x7fffffffffffffff
cmp rsi, rbx
ja 0x14000ca5e
cmp rsi, 0x10
jae 0x14000aed3
mov qword [rsp + 0xc0], rsi
mov ebx, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0xc8], rbx
movups xmm0, xmmword [r15]
movups xmmword [rsp + 0xb0], xmm0
mov r14, qword [rsp + 0xb0]
jmp 0x14000af35
mov qword [rsp + 0xc8], reloc.WS2_32.dll_ntohs
mov rax, rsi
or rax, 0xf
cmp rax, rbx
ja 0x14000aefa
mov rbx, rax
mov ecx, reloc.WLDAP32.dll_Ordinal_22
cmp rax, rcx
cmovb rbx, rcx
lea rdx, [rbx + 1]
lea rcx, [rsp + 0xb0]
call fcn.140001d40
mov r14, rax
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xc0], rsi
mov qword [rsp + 0xc8], rbx
lea r8, [rsi + 1]
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rdx, [0x14008cb48]
cmp qword [0x14008cb60], 0x10
cmovae rdx, qword [0x14008cb48]
lea rcx, [rsp + 0xb0]
cmp rbx, 0x10
cmovae rcx, r14
cmp rsi, qword [0x14008cb58]
jne 0x14000af76
mov r8, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14000af76
xor sil, sil
jmp 0x14000af79
mov sil, 1
cmp rbx, 0x10
jb 0x14000afb0
lea rdx, [rbx + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x14000afa8
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b8c0
mov rcx, r14
call fcn.14006ab5c
test sil, sil
je 0x14000b00a
mov byte [0x14008c910], 0
mov rdx, qword [rsp + 0x38]
add rdx, 0x20
cmp qword [rdx + 0x18], 0x10
jb 0x14000afcf
mov rdx, qword [rdx]
mov r8, r12
inc r8
cmp byte [rdx + r8], 0
jne 0x14000afd2
lea rcx, [0x14008c960]
call fcn.140004040
mov rcx, qword [rsp + 0x38]
add rcx, 0x20
cmp qword [rcx + 0x18], 0x10
jb 0x14000affb
mov rcx, qword [rcx]
call fcn.140014050
mov r15, qword [rsp + 0x78]
jmp 0x14000adfe
mov rcx, qword [rsp + 0x38]
add rcx, 0x20
cmp qword [rcx + 0x18], 0x10
jb 0x14000b01d
mov rcx, qword [rcx]
call fcn.140014050
jmp 0x14000ab90
mov byte [0x14008c910], 0
mov rcx, qword [rsp + 0x38]
add rcx, 0x20
cmp qword [rcx + 0x18], 0x10
jb 0x14000b041
mov rcx, qword [rcx]
call fcn.140014050
jmp 0x14000ab90
mov rbx, rdi
lea rax, [rsp + 0x150]
mov qword [rsp + 0x90], rax
mov word [rsp + 0x88], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0x8a], 1
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x88]
call fcn.140008e30
mov rsi, rax
mov rdx, qword [rsp + 0x38]
add rdx, 0x20
lea rcx, [rsp + 0x130]
call fcn.140002d90
mov rdx, rax
lea rcx, [rsp + 0xd0]
call fcn.140014fc0
nop
mov r8, rsi
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.140010810
nop
lea rcx, [0x14008c9f8]
mov rdx, qword [rsp + 0xb0]
cmp rcx, rdx
je 0x14000b0f2
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x14000b0e5
mov rdx, qword [rdx]
call fcn.140004040
mov rdx, qword [rsp + 0xb0]
lea rax, [rdx + 0x20]
lea rcx, [0x14008c9d8]
cmp rcx, rax
je 0x14000b120
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0x10
jb 0x14000b110
mov rax, qword [rax]
mov rdx, rax
call fcn.140004040
mov rdx, qword [rsp + 0xb0]
add rdx, 0x20
lea rcx, [rsp + 0x210]
call fcn.140002d90
mov r8, rax
lea rdx, [rsp + 0x230]
mov rcx, rbx
call fcn.140013d60
mov rdx, rax
lea rcx, [0x14008c9b8]
call fcn.140008cf0
lea rcx, [rsp + 0x230]
call fcn.140001ce0
mov dword [0x14008ca8c], 0xf1
mov byte [0x14008c910], 1
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
je 0x14000c196
lea r8, [rsp + 0xb0]
mov rdx, qword [rsp + 0xb8]
call fcn.140007a10
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0xb0]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b8ca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b8ca
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp dword [0x14008ca68], 2
jne 0x14000bc39
mov rdx, qword [rsp + 0x38]
add rdx, 0x20
lea rcx, [rsp + 0x150]
call fcn.140002d90
mov rdx, rax
lea rcx, [rsp + 0xd0]
call fcn.140014fc0
nop
cmp qword [rax + 0x18], 0x10
jb 0x14000b21c
mov rax, qword [rax]
mov qword [rsp + 0x130], rdi
mov qword [rsp + 0x140], rdi
mov qword [rsp + 0x148], rdi
mov r8, r12
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14000b240
mov rdx, rax
lea rcx, [rsp + 0x130]
call fcn.140002ad0
nop
lea rcx, [rsp + 0xd0]
call fcn.140001ce0
mov rdx, qword [rsp + 0x38]
add rdx, 0x40
lea rcx, [rsp + 0x210]
call fcn.140002d90
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.140014fc0
nop
cmp qword [rax + 0x18], 0x10
jb 0x14000b299
mov rax, qword [rax]
mov qword [rsp + 0x230], rdi
mov qword [rsp + 0x240], rdi
mov qword [rsp + 0x248], rdi
mov r8, r12
inc r8
cmp byte [rax + r8], 0
jne 0x14000b2b4
mov rdx, rax
lea rcx, [rsp + 0x230]
call fcn.140002ad0
nop
lea rcx, [rsp + 0xb0]
call fcn.140001ce0
mov rdx, qword [rsp + 0x38]
add rdx, 0x60
lea rcx, [rsp + 0x150]
call fcn.140002d90
mov rdx, rax
lea rcx, [rsp + 0x1d0]
call fcn.140014fc0
nop
cmp qword [rax + 0x18], 0x10
jb 0x14000b30d
mov rax, qword [rax]
mov qword [rsp + 0xd0], rdi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xe0], xmm0
mov r8, r12
inc r8
cmp byte [rax + r8], 0
jne 0x14000b324
mov rdx, rax
lea rcx, [rsp + 0xd0]
call fcn.140002ad0
nop
lea rcx, [rsp + 0x1d0]
call fcn.140001ce0
mov rdx, qword [rsp + 0x38]
sub rdx, 0xffffffffffffff80
lea rcx, [rsp + 0xb0]
call fcn.140002d90
mov rdx, rax
lea rcx, [rsp + 0x1f0]
call fcn.140014fc0
nop
cmp qword [rax + 0x18], 0x10
jb 0x14000b37d
mov rax, qword [rax]
mov qword [rsp + 0x210], rdi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x220], xmm0
mov r8, r12
inc r8
cmp byte [rax + r8], 0
jne 0x14000b394
mov rdx, rax
lea rcx, [rsp + 0x210]
call fcn.140002ad0
nop
lea rcx, [rsp + 0x1f0]
call fcn.140001ce0
mov rdx, qword [rsp + 0x38]
add rdx, 0xa0
lea rcx, [rsp + 0x1b0]
call fcn.140002d90
mov rdx, rax
lea rcx, [rsp + 0xf0]
call fcn.140014fc0
nop
cmp qword [rax + 0x18], 0x10
jb 0x14000b3f0
mov rax, qword [rax]
mov qword [rsp + 0xb0], rdi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xc0], xmm0
mov r8, r12
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14000b410
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.140002ad0
nop
lea rcx, [rsp + 0xf0]
call fcn.140001ce0
lea rdx, [r15 + 0x80]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x14000b44d
mov rdx, qword [rdx]
lea rcx, [rsp + 0x130]
mov rbx, qword [rsp + 0x130]
mov r14, qword [rsp + 0x148]
cmp r14, 0x10
cmovae rcx, rbx
mov r8, qword [rsp + 0x140]
cmp r8, rax
jne 0x14000b483
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14000b4ce
lea r8, [0x14008caa8]
cmp qword [0x14008cac0], 0x10
cmovae r8, qword [0x14008caa8]
mov word [rsp + 0x20], di
mov r9d, 0x44
lea rdx, str.Do_you_want_to_update_app__
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxExA]
sub eax, 6
je 0x14000b8d4
cmp eax, 1
je 0x14000b4ce
mov ecx, Ordinal_46
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, [rsp + 0x230]
mov rsi, qword [rsp + 0x230]
mov r15, qword [rsp + 0x248]
cmp r15, 0x10
cmovae rcx, rsi
mov r8, qword [rsp + 0x240]
cmp r8, 1
jne 0x14000b72a
lea rdx, [0x14006f330]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14000b72a
movdqa xmm0, xmmword [0x14006f4f0]
movdqu xmmword [rsp + 0x170], xmm0
movdqa xmm1, xmmword [str.___2_r]
movdqu xmmword [rsp + 0x180], xmm1
movdqa xmm0, xmmword [0x14006f440]
movdqu xmmword [rsp + 0x190], xmm0
mov dword [rsp + 0x1a0], 0xa1e1e59
mov dword [rsp + 0x1a4], 0xf0101218
mov dword [rsp + 0x1a8], 0xa2f0e4
mov byte [rsp + 0x1ac], 1
lea eax, [rdi + 0x49]
xor byte [rsp + rdi + 0x170], al
inc rdi
cmp rdi, 0x3b
jb 0x14000b570
mov byte [rsp + 0x1ac], 0
lea rcx, [rsp + 0x170]
call fcn.140014050
mov byte [0x14008c911], 1
mov byte [0x14008caa1], 1
mov rdx, qword [rsp + 0xc8]
cmp rdx, 0x10
jb 0x14000b5ea
inc rdx
mov rcx, qword [rsp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b5e4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b7bb
call fcn.14006ab5c
nop
mov rdx, qword [rsp + 0x228]
cmp rdx, 0x10
jb 0x14000b62e
inc rdx
mov rcx, qword [rsp + 0x210]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b628
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b802
call fcn.14006ab5c
nop
mov rdx, qword [rsp + 0xe8]
cmp rdx, 0x10
jb 0x14000b672
inc rdx
mov rcx, qword [rsp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b66c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b849
call fcn.14006ab5c
nop
cmp r15, 0x10
jb 0x14000b6aa
lea rdx, [r15 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14000b6a1
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b881
mov rcx, rsi
call fcn.14006ab5c
nop
cmp r14, 0x10
jb 0x14000b6e2
lea rdx, [r14 + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14000b6d9
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b8c0
mov rcx, rbx
call fcn.14006ab5c
nop
mov rbx, qword [rsp + 0x38]
test rbx, rbx
je 0x14000b725
mov rdi, qword [rsp + 0x40]
cmp rbx, rdi
je 0x14000b70c
mov rcx, rbx
call fcn.140001ce0
add rbx, 0x20
cmp rbx, rdi
jne 0x14000b6f6
mov rbx, qword [rsp + 0x38]
mov r8, qword [rsp + 0x48]
sub r8, rbx
sar r8, 5
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.14000e720
jmp 0x14000c974
mov dword [rsp + 0x88], 0x293e383d
mov word [rsp + 0x8c], 0x100
lea rdx, [rsp + 0x1f0]
lea rcx, [rsp + 0x88]
call fcn.140008eb0
mov rdx, rax
lea rcx, [0x14008cb08]
call fcn.140008cf0
lea rcx, [rsp + 0x1f0]
call fcn.140001ce0
mov dword [0x14008ca88], 0xd0035f3
mov byte [0x14008c910], 1
mov rdx, qword [rsp + 0xc8]
cmp rdx, 0x10
jb 0x14000b7c8
inc rdx
mov rcx, qword [rsp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b7c2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b7c2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006ab5c
nop
mov rdx, qword [rsp + 0x228]
cmp rdx, 0x10
jb 0x14000b80f
inc rdx
mov rcx, qword [rsp + 0x210]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b809
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b809
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006ab5c
nop
mov rdx, qword [rsp + 0xe8]
cmp rdx, 0x10
jb 0x14000b856
inc rdx
mov rcx, qword [rsp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b850
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b850
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006ab5c
nop
cmp r15, 0x10
jb 0x14000b891
lea rdx, [r15 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14000b888
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b888
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.14006ab5c
nop
cmp r14, 0x10
jb 0x14000c196
lea rdx, [r14 + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14000b8c7
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b8c7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.14006ab5c
jmp 0x14000c196
mov r8d, 0x104
lea rdx, [rsp + 0x2f0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rax, [rsp + 0x110]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x110], rdi
mov qword [rsp + 0x120], rdi
mov qword [rsp + 0x128], rdi
mov r8d, 1
lea rdx, [0x14006f37c]
lea rcx, [rsp + 0x110]
call fcn.140002ad0
nop
lea rax, [rsp + 0x58]
mov qword [rsp + 0x1d0], rax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], rdi
mov r8d, 1
lea rdx, [0x14006f3bc]
lea rcx, [rsp + 0x58]
call fcn.140002ad0
nop
lea rdx, [rsp + 0x2f0]
lea rcx, [rsp + 0x1f0]
call fcn.140008f70
nop
lea rdx, [rsp + 0x110]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x58]
mov r8, rax
lea rdx, [rsp + 0x170]
mov rcx, r15
call fcn.14000ef40
mov rsi, rax
lea rdx, [rsp + 0xb0]
cmp qword [rsp + 0xc8], 0x10
cmovae rdx, qword [rsp + 0xb0]
lea rcx, [rsp + 0x150]
call fcn.1400080c0
nop
mov rdx, rsi
lea rcx, [rsp + 0x150]
call fcn.140004820
nop
lea rcx, [rsp + 0x150]
call fcn.140001ce0
nop
lea rcx, [rsp + 0x170]
call fcn.140001ce0
lea rdx, [rsp + 0x2f0]
lea rcx, [rsp + 0x170]
call fcn.140008f70
cmp qword [rax + 0x18], 0x10
jb 0x14000ba12
mov rax, qword [rax]
movabs rcx, 0xc2f77e44ac652beb
mov qword [rsp + 0x1d0], rcx
movabs rdx, 0x37262ac55fc85544
mov qword [rsp + 0x1d8], rdx
movabs rcx, 0xc2f77e44c2005b84
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x98], rdx
movdqa xmm0, xmmword [rsp + 0x90]
pxor xmm0, xmmword [rsp + 0x1d0]
movdqa xmmword [rsp + 0x90], xmm0
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rdi
xor r9d, r9d
mov r8, rax
lea rdx, [rsp + 0x90]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rcx, [rsp + 0x170]
call fcn.140001ce0
mov byte [0x14008c911], 1
mov byte [0x14008caa1], 1
mov rdx, qword [rsp + 0xc8]
cmp rdx, 0x10
jb 0x14000baf0
inc rdx
mov rcx, qword [rsp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000baea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000baea
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006ab5c
nop
mov rdx, qword [rsp + 0x228]
cmp rdx, 0x10
jb 0x14000bb37
inc rdx
mov rcx, qword [rsp + 0x210]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bb31
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000bb31
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006ab5c
nop
mov rdx, qword [rsp + 0xe8]
cmp rdx, 0x10
jb 0x14000bb7e
inc rdx
mov rcx, qword [rsp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bb78
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000bb78
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006ab5c
nop
mov rdx, qword [rsp + 0x248]
cmp rdx, 0x10
jb 0x14000bbc5
inc rdx
mov rcx, qword [rsp + 0x230]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bbbf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000bbbf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006ab5c
nop
cmp r14, 0x10
jb 0x14000bc00
lea rdx, [r14 + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14000bbf7
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000bbf7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.14006ab5c
nop
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14000bc34
lea r8, [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
call fcn.140007a10
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x38]
sub r8, rdx
sar r8, 5
lea rcx, [rsp + 0x38]
call fcn.14000e720
jmp 0x14000c974
cmp dword [0x14008ca68], 3
jne 0x14000c146
mov dword [rsp + 0x88], 0x293e383d
mov word [rsp + 0x8c], 0x100
lea rcx, [rsp + 0x88]
call fcn.14000d710
mov rdx, rax
lea rcx, [0x14008cb08]
call fcn.1400079c0
test al, al
je 0x14000bc89
mov byte [0x14008c911], 1
mov byte [0x14008caa1], 1
cmp dword [0x14008ca88], 0xd0035f3
je 0x14000bca3
mov byte [0x14008c911], 1
mov byte [0x14008caa1], 1
mov rdx, qword [rsp + 0x38]
add rdx, 0x20
lea rcx, [rsp + 0x170]
call fcn.140002d90
mov rdx, rax
lea rcx, [rsp + 0xf0]
call fcn.140014fc0
nop
xor edx, edx
lea r8d, [rdx + 0xa]
mov rcx, rax
call fcn.140010b50
mov dword [0x14008c7f0], eax
lea rcx, [rsp + 0xf0]
call fcn.140001ce0
mov rdx, qword [rsp + 0x38]
add rdx, 0x40
lea rcx, [rsp + 0x170]
call fcn.140002d90
mov rdx, rax
lea rcx, [rsp + 0xf0]
call fcn.140014fc0
nop
cmp qword [rax + 0x18], 0x10
jb 0x14000bd1c
mov rax, qword [rax]
mov r8, r12
nop
inc r8
cmp byte [rax + r8], 0
jne 0x14000bd20
mov rdx, rax
lea rcx, [0x14008c838]
call fcn.140004040
nop
lea rcx, [rsp + 0xf0]
call fcn.140001ce0
mov rdx, qword [rsp + 0x38]
add rdx, 0x60
lea rcx, [rsp + 0x170]
call fcn.140002d90
mov rdx, rax
lea rcx, [rsp + 0x1b0]
call fcn.140014fc0
nop
xor edx, edx
lea r8d, [rdx + 0xa]
mov rcx, rax
call fcn.140010b50
mov edx, eax
lea rcx, [rsp + 0xf0]
call fcn.140010cb0
mov rdx, rax
lea rcx, [0x14008c878]
call fcn.140008cf0
lea rcx, [rsp + 0xf0]
call fcn.140001ce0
nop
lea rcx, [rsp + 0x1b0]
call fcn.140001ce0
mov rdx, qword [rsp + 0x38]
sub rdx, 0xffffffffffffff80
lea rcx, [rsp + 0x170]
call fcn.140002d90
mov rdx, rax
lea rcx, [rsp + 0xf0]
call fcn.140014fc0
nop
cmp qword [rax + 0x18], 0x10
jb 0x14000bde6
mov rax, qword [rax]
mov r8, r12
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14000bdf0
mov rdx, rax
lea rcx, [0x14008c858]
call fcn.140004040
nop
lea rcx, [rsp + 0xf0]
call fcn.140001ce0
mov rdx, qword [rsp + 0x38]
add rdx, 0xa0
lea rcx, [rsp + 0x170]
call fcn.140002d90
mov rdx, rax
lea rcx, [rsp + 0xf0]
call fcn.140014fc0
nop
cmp qword [rax + 0x18], 0x10
jb 0x14000be4b
mov rax, qword [rax]
mov r8, r12
nop
inc r8
cmp byte [rax + r8], 0
jne 0x14000be50
mov rdx, rax
lea rcx, [0x14008c818]
call fcn.140004040
nop
lea rcx, [rsp + 0xf0]
call fcn.140001ce0
mov rdx, qword [rsp + 0x38]
add rdx, 0xc0
lea rcx, [rsp + 0x170]
call fcn.140002d90
mov rdx, rax
lea rcx, [rsp + 0xf0]
call fcn.140014fc0
nop
cmp qword [rax + 0x18], 0x10
jb 0x14000beab
mov rax, qword [rax]
mov r8, r12
nop
inc r8
cmp byte [rax + r8], 0
jne 0x14000beb0
mov rdx, rax
lea rcx, [0x14008c9d8]
call fcn.140004040
nop
lea rcx, [rsp + 0xf0]
call fcn.140001ce0
mov rdx, qword [rsp + 0x38]
add rdx, 0xe0
lea rcx, [rsp + 0x170]
call fcn.140002d90
mov rdx, rax
lea rcx, [rsp + 0xf0]
call fcn.140014fc0
nop
xor edx, edx
lea r8d, [rdx + 0xa]
mov rcx, rax
call fcn.140010b50
mov dword [0x14008c90c], eax
lea rcx, [rsp + 0xf0]
call fcn.140001ce0
mov dword [rsp + 0x88], 0x382e2467
mov word [rsp + 0x8c], 0x100
mov rcx, rdi
nop word [rax + rax]
lea eax, [rcx + 0x49]
xor byte [rsp + rcx + 0x88], al
inc rcx
cmp rcx, 4
jb 0x14000bf40
mov byte [rsp + 0x8d], 0
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x8c]
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x150]
call fcn.140007890
lea rdx, [rsp + 0x150]
lea rcx, [0x14008cb08]
call fcn.140008cf0
lea rcx, [rsp + 0x150]
call fcn.140001ce0
mov dword [0x14008ca88], 0x369f
mov dword [0x14008ca90], 0x2c5aa
movdqa xmm0, xmmword [0x14006f4a0]
movdqu xmmword [rsp + 0x250], xmm0
movdqa xmm1, xmmword [str.0_tlr]
movdqu xmmword [rsp + 0x260], xmm1
movdqa xmm0, xmmword [0x14006f460]
movdqu xmmword [rsp + 0x270], xmm0
movdqa xmm1, xmmword [0x14006f510]
movdqu xmmword [rsp + 0x280], xmm1
movdqa xmm0, xmmword [0x14006f520]
movdqu xmmword [rsp + 0x290], xmm0
movdqa xmm1, xmmword [0x14006f530]
movdqu xmmword [rsp + 0x2a0], xmm1
movdqa xmm0, xmmword [0x14006f500]
movdqu xmmword [rsp + 0x2b0], xmm0
mov dword [rsp + 0x2c0], 0xddcfdbfd
mov word [rsp + 0x2c4], 0x100
lea rdx, [rsp + 0x170]
lea rcx, [rsp + 0x250]
call fcn.140008f30
mov rdx, rax
lea rcx, [0x14008cb28]
call fcn.140008cf0
lea rcx, [rsp + 0x170]
call fcn.140001ce0
mov byte [0x14008c910], 1
mov dword [rsp + 0x88], 0x1007f00
lea rdx, [rsp + 0x170]
lea rcx, [rsp + 0x88]
call fcn.140008e70
mov rdx, rax
lea rcx, [0x14008c918]
call fcn.140008cf0
lea rcx, [rsp + 0x170]
call fcn.140001ce0
movdqa xmm0, xmmword [0x14006f470]
movdqu xmmword [rsp + 0x90], xmm0
mov dword [rsp + 0xa0], 0x302e3c2a
mov dword [rsp + 0xa4], 0x1002731
mov rcx, rdi
nop dword [rax]
lea eax, [rcx + 0x49]
xor byte [rsp + rcx + 0x90], al
inc rcx
cmp rcx, 0x16
jb 0x14000c0e0
mov byte [rsp + 0xa7], 0
lea r9, [rsp + 0x30]
lea r8, [rsp + 0xa6]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x150]
call fcn.140007890
lea rdx, [rsp + 0x150]
lea rcx, [0x14008c960]
call fcn.140008cf0
lea rcx, [rsp + 0x150]
call fcn.140001ce0
inc dword [0x14008ca68]
jmp 0x14000c196
cmp dword [0x14008ca68], 4
je 0x14000c196
mov byte [0x14008c911], 1
mov byte [0x14008caa1], 1
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14000c191
lea r8, [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
call fcn.140007a10
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x38]
sub r8, rdx
sar r8, 5
lea rcx, [rsp + 0x38]
call fcn.14000e720
jmp 0x14000c974
cmp byte [rsp + 0x31], 0
je 0x14000c8cc
mov rdx, qword [rsp + 0x38]
add rdx, 0x20
lea rcx, [rsp + 0x170]
call fcn.140002d90
mov rdx, rax
lea rcx, [rsp + 0xd0]
call fcn.140014fc0
nop
cmp qword [rax + 0x18], 0x10
jb 0x14000c1d2
mov rax, qword [rax]
mov qword [rsp + 0x130], rdi
mov qword [rsp + 0x140], rdi
mov qword [rsp + 0x148], rdi
mov r8, r12
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14000c1f0
mov rdx, rax
lea rcx, [rsp + 0x130]
call fcn.140002ad0
nop
mov rdx, qword [rsp + 0xe8]
cmp rdx, 0x10
jb 0x14000c251
inc rdx
mov rcx, qword [rsp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c24c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c24c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006ab5c
movdqa xmm0, xmmword [0x14006eca0]
movdqu xmmword [rsp + 0xe0], xmm0
mov byte [rsp + 0xd0], 0
lea rcx, [rsp + 0x130]
mov rbx, qword [rsp + 0x130]
mov r14, qword [rsp + 0x148]
cmp r14, 0x10
cmovae rcx, rbx
mov r8, qword [rsp + 0x140]
cmp r8, 8
jne 0x14000c81b
lea rdx, str.Req_IDNF
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14000c81b
xor r8d, r8d
lea rdx, [0x14006f36b]
lea rcx, [0x14008c8e8]
call fcn.140004040
mov rdx, qword [rsp + 0x38]
add rdx, 0x40
lea rcx, [rsp + 0xf0]
call fcn.140002d90
mov rdx, rax
lea rcx, [rsp + 0x1b0]
call fcn.140014fc0
nop
xor edx, edx
lea r8d, [rdx + 0xa]
mov rcx, rax
call fcn.140010b50
mov dword [0x14008c7f0], eax
lea rcx, [rsp + 0x1b0]
call fcn.140001ce0
mov rdx, qword [rsp + 0x38]
add rdx, 0x60
lea rcx, [rsp + 0x1f0]
call fcn.140002d90
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.140014fc0
nop
cmp qword [rax + 0x18], 0x10
jb 0x14000c33f
mov rax, qword [rax]
mov r8, r12
inc r8
cmp byte [rax + r8], 0
jne 0x14000c342
mov rdx, rax
lea rcx, [0x14008c838]
call fcn.140004040
nop
lea rcx, [rsp + 0x150]
call fcn.140001ce0
mov rdx, qword [rsp + 0x38]
sub rdx, 0xffffffffffffff80
lea rcx, [rsp + 0xf0]
call fcn.140002d90
mov rdx, rax
lea rcx, [rsp + 0x110]
call fcn.140014fc0
nop
xor edx, edx
lea r8d, [rdx + 0xa]
mov rcx, rax
call fcn.140010b50
mov edx, eax
lea rcx, [rsp + 0x1b0]
call fcn.140010cb0
mov rdx, rax
lea rcx, [0x14008c878]
call fcn.140008cf0
lea rcx, [rsp + 0x1b0]
call fcn.140001ce0
nop
lea rcx, [rsp + 0x110]
call fcn.140001ce0
mov rdx, qword [rsp + 0x38]
add rdx, 0xa0
lea rcx, [rsp + 0x1f0]
call fcn.140002d90
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.140014fc0
nop
cmp qword [rax + 0x18], 0x10
jb 0x14000c40b
mov rax, qword [rax]
mov r8, r12
nop
inc r8
cmp byte [rax + r8], 0
jne 0x14000c410
mov rdx, rax
lea rcx, [0x14008c858]
call fcn.140004040
nop
lea rcx, [rsp + 0x150]
call fcn.140001ce0
mov rdx, qword [rsp + 0x38]
add rdx, 0xc0
lea rcx, [rsp + 0xf0]
call fcn.140002d90
mov rdx, rax
lea rcx, [rsp + 0x1b0]
call fcn.140014fc0
nop
cmp qword [rax + 0x18], 0x10
jb 0x14000c46b
mov rax, qword [rax]
mov r8, r12
nop
inc r8
cmp byte [rax + r8], 0
jne 0x14000c470
mov rdx, rax
lea rcx, [0x14008c818]
call fcn.140004040
nop
lea rcx, [rsp + 0x1b0]
call fcn.140001ce0
mov rdx, qword [rsp + 0x38]
cmp qword [rdx + 0xf0], 0
je 0x14000c542
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x90], rax
mov word [rsp + 0x88], gethostname
mov byte [rsp + 0x8a], 1
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x88]
call fcn.140008e30
mov rsi, rax
mov rdx, qword [rsp + 0x38]
add rdx, 0xe0
lea rcx, [rsp + 0x1b0]
call fcn.140002d90
mov rdx, rax
lea rcx, [rsp + 0x1f0]
call fcn.140014fc0
nop
mov r8, rsi
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.140010810
mov rdx, rax
lea rcx, [0x14008c898]
call fcn.140008d80
lea rcx, [rsp + 0xb0]
call fcn.14000cb10
mov rdx, qword [rsp + 0x38]
cmp qword [rdx + 0x110], 0
je 0x14000c5f4
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x90], rax
mov word [rsp + 0x88], gethostname
mov byte [rsp + 0x8a], 1
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x88]
call fcn.140008e30
mov rsi, rax
mov rdx, qword [rsp + 0x38]
add rdx, 0x100
lea rcx, [rsp + 0x1b0]
call fcn.140002d90
mov rdx, rax
lea rcx, [rsp + 0x1f0]
call fcn.140014fc0
nop
mov r8, rsi
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.140010810
mov rdx, rax
lea rcx, [0x14008c8b0]
call fcn.140008d80
lea rcx, [rsp + 0xb0]
call fcn.14000cb10
mov dword [0x14008c908], 0xf018b3
mov rdx, qword [rsp + 0x38]
jmp 0x14000c5fa
mov dword [0x14008c908], edi
add rdx, 0x160
lea rcx, [rsp + 0xf0]
call fcn.140002d90
mov rdx, rax
lea rcx, [rsp + 0x1b0]
call fcn.140014fc0
nop
xor edx, edx
lea r8d, [rdx + 0xa]
mov rcx, rax
call fcn.140010b50
mov dword [0x14008c90c], eax
lea rcx, [rsp + 0x1b0]
call fcn.140001ce0
mov rax, qword [rsp + 0x38]
lea rdx, [rax + 0x180]
cmp qword [rdx + 0x10], 0
je 0x14000c6af
lea rcx, [rsp + 0xf0]
call fcn.140002d90
mov rdx, rax
lea rcx, [rsp + 0x1b0]
call fcn.140014fc0
nop
cmp qword [rax + 0x18], 0x10
jb 0x14000c680
mov rax, qword [rax]
nop dword [rax + rax]
inc r12
cmp byte [rax + r12], 0
jne 0x14000c680
mov r8, r12
mov rdx, rax
lea rcx, [0x14008c8e8]
call fcn.140004040
nop
lea rcx, [rsp + 0x1b0]
call fcn.140001ce0
mov rax, qword [rsp + 0x38]
cmp qword [rax + 0x1b0], 0
je 0x14000c759
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x90], rax
mov word [rsp + 0x88], gethostname
mov byte [rsp + 0x8a], 1
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x88]
call fcn.140008e30
mov rsi, rax
mov rdx, qword [rsp + 0x38]
add rdx, 0x1a0
lea rcx, [rsp + 0x1b0]
call fcn.140002d90
mov rdx, rax
lea rcx, [rsp + 0x1f0]
call fcn.140014fc0
nop
mov r8, rsi
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.140010810
mov rdx, rax
lea rcx, [0x14008c8c8]
call fcn.140008d80
lea rcx, [rsp + 0xb0]
call fcn.14000cb10
mov byte [0x14008c8e0], 1
jmp 0x14000c760
mov byte [0x14008c8e0], 0
mov byte [0x14008c910], 1
mov dword [rsp + 0x88], 0x2939250a
mov word [rsp + 0x8c], 0x100
mov rcx, rdi
nop
lea eax, [rcx + 0x49]
xor byte [rsp + rcx + 0x88], al
inc rcx
cmp rcx, 4
jb 0x14000c780
mov byte [rsp + 0x8d], 0
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x8c]
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x150]
call fcn.140007890
lea rdx, [rsp + 0x150]
lea rcx, [0x14008c918]
call fcn.140008cf0
lea rcx, [rsp + 0x150]
call fcn.140001ce0
nop
cmp r14, 0x10
jb 0x14000c8cc
lea rdx, [r14 + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14000c80e
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c854
mov rcx, rbx
call fcn.14006ab5c
jmp 0x14000c8cc
mov byte [0x14008c911], 1
mov byte [0x14008caa1], 1
cmp r14, 0x10
jb 0x14000c864
lea rdx, [r14 + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14000c85b
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c85b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.14006ab5c
nop
mov rbx, qword [rsp + 0x38]
test rbx, rbx
je 0x14000c8c7
mov rdi, qword [rsp + 0x40]
cmp rbx, rdi
je 0x14000c88e
mov rcx, rbx
call fcn.140001ce0
add rbx, 0x20
cmp rbx, rdi
jne 0x14000c878
mov rbx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x48]
sub rdx, rbx
and rdx, 0xffffffffffffffe0
mov rax, rbx
cmp rdx, 0x1000
jb 0x14000c8bf
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c964
mov rcx, rbx
call fcn.14006ab5c
jmp 0x14000c974
mov rbx, qword [rsp + 0x38]
test rbx, rbx
je 0x14000c974
mov rsi, qword [rsp + 0x40]
cmp rbx, rsi
je 0x14000c937
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x14000c91a
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x14000c915
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000c964
mov rcx, r8
call fcn.14006ab5c
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
add rbx, 0x20
cmp rbx, rsi
jne 0x14000c8e4
mov rbx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x48]
sub rdx, rbx
and rdx, 0xffffffffffffffe0
mov rax, rbx
cmp rdx, 0x1000
jb 0x14000c96b
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c96b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.14006ab5c
nop
mov rcx, qword [rsp + 0x500]
xor rcx, rsp
call fcn.14006abf0
lea r11, [rsp + 0x510]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
cmp ecx, 0xd1f
je 0x14000ab78
cmp ecx, 0x19b4
je 0x14000ca2e
cmp ecx, 0x2719
je 0x14000c9e1
mov byte [0x14008c910], 0
mov rcx, qword [rsp + 0x38]
add rcx, 0x20
cmp qword [rcx + 0x18], 0x10
jb 0x14000c9d7
mov rcx, qword [rcx]
call fcn.140014050
jmp 0x14000ab90
mov byte [0x14008c910], 0
mov dword [rsp + 0x90], 0x293f2400
mov dword [rsp + 0x94], 0x3c2e203f
mov dword [rsp + 0x98], 0x26211771
mov dword [rsp + 0x9c], 0x100243a
lea rcx, [rsp + 0x90]
call fcn.14000d740
mov rcx, rax
call fcn.140014050
jmp 0x14000ab90
mov word [0x14008c910], 0x100
jmp 0x14000ab97
call fcn.14006ab5c
jmp 0x14000c974
lea rcx, str.invalid_stoi_argument
call sub.MSVCP140.dll_void___cdecl_std::_Xinvalid_argument_char_const____ptr64_
lea rcx, str.stoi_argument_out_of_range
call sub.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const____ptr64_
call fcn.140001ac0
int3