Function at 0x1400121c0
Capabilities:
Encode data using xor
Terminate process

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x338]
sub rsp, 0x438
mov rsi, rdx
mov r13, rcx
xor r15d, r15d
lea ecx, [r15 + 8]
call fcn.140061dfc
mov qword [rbp + 0x390], rax
test rax, rax
je 0x140012210
mov rcx, rax
call fcn.140013d90
mov rdi, rax
jmp 0x140012213
mov rdi, r15
mov r8d, 0x104
lea rdx, [rbp + 0x120]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xorps xmm0, xmm0
movups xmmword [rbp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x48], xmm1
lea rax, [rbp + 0x120]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140012250
lea rdx, [rbp + 0x120]
lea rcx, [rbp + 0x38]
call fcn.140005800
cmp qword [rbp + 0x48], 0
je 0x140012285
xor edx, edx
mov r8d, pe_nt_image_headers64
lea rcx, [rbp + 0x230]
call sub.VCRUNTIME140.dll_memset
mov rdx, qword [rbp + 0x50]
cmp rdx, 0xf
jbe 0x1400122c3
inc rdx
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400122be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400122be
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140061e40
xorps xmm0, xmm0
movups xmmword [rbp + 0x18], xmm0
mov qword [rbp + 0x28], r15
mov qword [rbp + 0x30], r15
lea rax, [rbp + 0x120]
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400122e0
mov r8, rbx
lea rdx, [rbp + 0x120]
lea rcx, [rbp + 0x18]
call fcn.140005800
lea r8, [rbp + 0x18]
lea rdx, [rbp + 0x100]
mov rcx, rdi
call fcn.140013e60
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x50], 0
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x78]
call fcn.140014160
nop
mov dword [rsp + 0x30], 0x8a9d829f
mov dword [rsp + 0x34], 0xc3c0c088
mov word [rsp + 0x38], Ordinal_200
mov byte [rsp + 0x3a], 1
mov rcx, r15
nop dword [rax]
lea eax, [rcx - 0x14]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 9
jb 0x140012360
mov byte [rsp + 0x3a], 0
lea r9, [rbp + 0x390]
lea r8, [rsp + 0x39]
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x38]
call fcn.140011d50
nop
lea rdx, [rbp + 0x78]
lea rcx, [rbp + 0x18]
call fcn.140006520
mov rdx, rax
lea rcx, [rbp + 0x98]
call fcn.14000e850
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xb8], xmm0
movdqa xmm1, xmmword [0x140065850]
movdqu xmmword [rbp + 0xc8], xmm1
mov byte [rbp + 0xb8], 0
mov ecx, 3
call fcn.140014780
call fcn.140014500
mov qword [rbp + 0x398], rax
test rax, rax
je 0x14001305a
movdqa xmm0, xmmword [0x14018aeb0]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0x968e9cd3
mov dword [rsp + 0x44], 0x736a712e
mov word [rsp + 0x48], pe_nt_image_headers64
mov rcx, r15
nop word [rax + rax]
lea eax, [rcx - 0x14]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0x18
jb 0x140012420
mov byte [rsp + 0x49], 0
lea r9, [rbp + 0x390]
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x18]
call fcn.140011d50
nop
mov r15, qword [r13 + 0x10]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r15
cmp rax, 5
jb 0x140013272
mov r12, r13
cmp qword [r13 + 0x18], 0xf
jbe 0x14001247c
mov r12, qword [r13]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
lea r14, [r15 + 5]
mov ebx, reloc.WS2_32.dll_ntohs
lea rdi, [rsp + 0x70]
cmp r14, rbx
jbe 0x14001251c
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x1400124d7
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140061dfc
test rax, rax
je 0x1400124ff
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140012517
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140012506
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140013278
jmp 0x1400124bc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140012515
call fcn.140061dfc
mov rdi, rax
jmp 0x140012517
xor edi, edi
mov qword [rsp + 0x70], rdi
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], rbx
mov eax, dword [str.user]
mov dword [rdi], eax
movzx eax, byte [0x14018ae6c]
mov byte [rdi + 4], al
lea rcx, [rdi + 5]
mov r8, r15
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0
mov rcx, qword [rbp - 0x80]
mov rdx, qword [rbp - 0x78]
mov rax, rdx
sub rax, rcx
cmp rax, 6
jb 0x140012598
lea rax, [rcx + 6]
mov qword [rbp - 0x80], rax
lea rbx, [rsp + 0x70]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x70]
add rbx, rcx
mov r8d, 6
lea rdx, str.pass
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 6], 0
lea rax, [rsp + 0x70]
jmp 0x1400125bf
mov qword [rsp + 0x20], 6
lea r9, str.pass
movzx r8d, byte [rbp + 0x390]
mov edx, 6
lea rcx, [rsp + 0x70]
call fcn.140005c90
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
xor r15d, r15d
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], r15b
mov rdx, rsi
cmp qword [rsi + 0x18], 0xf
jbe 0x140012600
mov rdx, qword [rsi]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x50]
call fcn.140008400
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x18], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x28], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x18], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rcx, qword [rbp - 0x18]
mov rdx, qword [rbp - 0x10]
mov rax, rdx
sub rax, rcx
cmp rax, 6
jb 0x140012686
lea rax, [rcx + 6]
mov qword [rbp - 0x18], rax
lea rbx, [rbp - 0x28]
cmp rdx, 0xf
cmova rbx, qword [rbp - 0x28]
add rbx, rcx
mov r8d, 6
lea rdx, str.hwid
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 6], 0
lea rax, [rbp - 0x28]
jmp 0x1400126ac
mov qword [rsp + 0x20], 6
lea r9, str.hwid
movzx r8d, byte [rbp + 0x390]
mov edx, 6
lea rcx, [rbp - 0x28]
call fcn.140005c90
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x60], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rdx, [rbp + 0x98]
cmp qword [rbp + 0xb0], 0xf
cmova rdx, qword [rbp + 0x98]
mov r8, qword [rbp + 0xa8]
lea rcx, [rbp - 0x70]
call fcn.140008400
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x38], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x38], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rcx, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x30]
mov rax, rdx
sub rax, rcx
cmp rax, 5
jb 0x140012778
lea rax, [rcx + 5]
mov qword [rbp - 0x38], rax
lea rbx, [rbp - 0x48]
cmp rdx, 0xf
cmova rbx, qword [rbp - 0x48]
add rbx, rcx
mov r8d, 5
lea rdx, str.key
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 5], 0
lea rax, [rbp - 0x48]
jmp 0x14001279e
mov qword [rsp + 0x20], 5
lea r9, str.key
movzx r8d, byte [rbp + 0x390]
mov edx, 5
lea rcx, [rbp - 0x48]
call fcn.140005c90
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 8], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 8], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rdx, [rbp + 0x38]
cmp qword [rbp + 0x50], 0xf
cmova rdx, qword [rbp + 0x38]
mov r8, qword [rbp + 0x48]
lea rcx, [rbp - 8]
call fcn.140008400
xorps xmm0, xmm0
movups xmmword [rbp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x68], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x68], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rbp + 0x10]
cmp rdx, 0xf
jbe 0x140012851
inc rdx
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001284c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001284c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140061e40
movdqa xmm0, xmmword [0x140065850]
movdqu xmmword [rbp + 8], xmm0
mov byte [rbp - 8], 0
mov rdx, qword [rbp - 0x30]
cmp rdx, 0xf
jbe 0x1400128a0
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001289b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001289b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140061e40
movdqa xmm0, xmmword [0x140065850]
movdqu xmmword [rbp - 0x38], xmm0
mov byte [rbp - 0x48], 0
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x1400128ef
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400128ea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400128ea
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140061e40
movdqa xmm0, xmmword [0x140065850]
movdqu xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x70], 0
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x14001293e
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140012939
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140012939
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140061e40
movdqa xmm0, xmmword [0x140065850]
movdqu xmmword [rbp - 0x18], xmm0
mov byte [rbp - 0x28], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14001298f
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001298a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001298a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140061e40
movdqa xmm0, xmmword [0x140065850]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x1400129e1
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400129dc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400129dc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140061e40
movdqa xmm0, xmmword [0x140065850]
movdqu xmmword [rbp - 0x80], xmm0
mov byte [rsp + 0x70], 0
lea r8, [rbp + 0x18]
cmp qword [rbp + 0x30], 0xf
cmova r8, qword [rbp + 0x18]
mov edx, 0x2712
mov r14, qword [rbp + 0x398]
mov rcx, r14
call fcn.140018100
mov edx, Ordinal_50
lea r8d, [rdx - 0x2e]
mov rcx, r14
call fcn.140018100
lea r8, [rbp + 0x58]
cmp qword [rbp + 0x70], 0xf
cmova r8, qword [rbp + 0x58]
mov edx, 0x271f
mov rcx, r14
call fcn.140018100
lea r8, [0x140012190]
mov edx, 0x4e2b
mov rcx, r14
call fcn.140018100
lea r8, [rbp + 0xb8]
mov edx, 0x2711
mov rcx, r14
call fcn.140018100
mov edx, 0x40
lea r8d, [rdx - 0x3f]
mov rcx, r14
call fcn.140018100
mov edx, 0x51
lea r8d, [rdx - 0x4f]
mov rcx, r14
call fcn.140018100
mov edx, 0x34
lea r8d, [rdx - 0x33]
mov rcx, r14
call fcn.140018100
mov rcx, r14
call fcn.1400145c0
mov edi, eax
test eax, eax
je 0x140012ae7
lea rdx, str.curl_easy_perform___failed:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140005470
mov rbx, rax
mov ecx, edi
call fcn.140015250
mov rdx, rax
mov rcx, rbx
call fcn.140005470
lea rdx, [0x14000e2f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140012ee5
xor edx, edx
lea rcx, [rbp + 0xd8]
call fcn.140006c60
nop
lea rcx, [rbp + 0x230]
call fcn.1400069e0
nop
mov r9b, 1
lea r8, [rbp + 0xd8]
lea rdx, [rbp + 0xb8]
lea rcx, [rbp + 0x230]
call fcn.14000a550
test al, al
je 0x140012ecc
mov dword [rsp + 0x30], 0x9b8f999f
mov dword [rsp + 0x34], 0x1008285
mov rcx, r15
nop dword [rax + rax]
lea eax, [rcx - 0x14]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 6
jb 0x140012b40
mov byte [rsp + 0x37], 0
lea r9, [rbp + 0x390]
lea r8, [rsp + 0x36]
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x70]
call fcn.140011d50
nop
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0xd8]
call fcn.140007290
lea rdx, [rsp + 0x70]
mov rcx, rax
call fcn.140008490
nop
lea rcx, [rbp - 0x70]
call fcn.140001ca0
mov dword [rbp + 0x398], 0x8c989f
mov byte [rbp + 0x39c], 1
mov rcx, r15
nop dword [rax + rax]
lea eax, [rcx - 0x14]
xor byte [rbp + rcx + 0x398], al
inc rcx
cmp rcx, 3
jb 0x140012bb0
mov byte [rbp + 0x39c], 0
lea r9, [rbp + 0x390]
lea r8, [rbp + 0x39b]
lea rdx, [rbp + 0x398]
lea rcx, [rbp - 8]
call fcn.140011d50
nop
lea rdx, [rbp - 8]
lea rcx, [rbp + 0xd8]
call fcn.140007290
lea rdx, [rbp - 0x48]
mov rcx, rax
call fcn.140008490
nop
lea rcx, [rbp - 8]
call fcn.140001ca0
mov dword [rsp + 0x30], 0x8b879a84
mov word [rsp + 0x34], pe_nt_image_headers64
mov rcx, r15
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x14]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 4
jb 0x140012c30
mov byte [rsp + 0x35], 0
lea r9, [rbp + 0x390]
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x70]
call fcn.140011d50
nop
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0xd8]
call fcn.140007290
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.140008490
nop
lea rcx, [rbp - 0x70]
call fcn.140001ca0
mov dword [rbp + 0x398], 0x81808c8e
mov dword [rbp + 0x39c], 0x1009595
mov rcx, r15
nop
lea eax, [rcx - 0x14]
xor byte [rbp + rcx + 0x398], al
inc rcx
cmp rcx, 6
jb 0x140012ca0
mov byte [rbp + 0x39f], 0
lea r9, [rbp + 0x390]
lea r8, [rbp + 0x39e]
lea rdx, [rbp + 0x398]
lea rcx, [rbp - 8]
call fcn.140011d50
nop
lea rdx, [rbp - 8]
lea rcx, [rbp + 0xd8]
call fcn.140007290
lea rdx, [rbp - 0x28]
mov rcx, rax
call fcn.140008490
nop
lea rcx, [rbp - 8]
call fcn.140001ca0
lea rdx, [rbp + 0x78]
cmp qword [rbp + 0x90], 0xf
cmova rdx, qword [rbp + 0x78]
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
cmp rbx, qword [rbp + 0x88]
jne 0x140012fa7
mov r8, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140012fa7
movdqa xmm0, xmmword [0x14018aec0]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0x979d899d
mov word [rsp + 0x44], reloc.WLDAP32.dll_Ordinal_33
mov byte [rsp + 0x46], 1
lea rdx, [rsp + 0x30]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011ed0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov word [rbp + 0x390], Ordinal_50
mov byte [rbp + 0x392], 0
lea rdx, [rbp + 0x390]
lea rcx, [rbp - 0x28]
call fcn.140011f90
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test al, al
je 0x140012f6f
movdqa xmm0, xmmword [0x14018aed0]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0x9b9b9392
mov word [rsp + 0x44], reloc.WLDAP32.dll_Ordinal_33
mov byte [rsp + 0x46], 1
lea rdx, [rsp + 0x30]
call fcn.140011ed0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp + 0x390], 0x8a9b9f98
mov word [rbp + 0x394], pe_nt_image_headers64
mov rcx, r15
nop dword [rax]
lea eax, [rcx - 0x14]
xor byte [rbp + rcx + 0x390], al
inc rcx
cmp rcx, 4
jb 0x140012e00
mov byte [rbp + 0x395], 0
lea rdx, [rbp + 0x390]
lea rcx, [rbp - 0x48]
call fcn.140011f90
movdqa xmm0, xmmword [0x14018aea0]
test al, al
je 0x140012f33
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0x968a8d95
mov dword [rsp + 0x44], 0x62226f6f
mov dword [rsp + 0x48], 0x716f7167
mov dword [rsp + 0x4c], 0x100286d
mov rdx, r15
nop dword [rax]
nop word [rax + rax]
lea eax, [rdx - 0x14]
xor byte [rsp + rdx + 0x30], al
inc rdx
cmp rdx, 0x1e
jb 0x140012e70
mov byte [rsp + 0x4f], 0
lea rdx, [rsp + 0x30]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005470
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, [rbp - 0x28]
call fcn.140001ca0
nop
lea rcx, [rsp + 0x50]
call fcn.140001ca0
nop
lea rcx, [rbp - 0x48]
call fcn.140001ca0
nop
lea rcx, [rsp + 0x70]
call fcn.140001ca0
nop
lea rcx, [rbp + 0x230]
call fcn.140011fe0
nop
lea rcx, [rbp + 0xd8]
call fcn.140007110
mov rcx, r14
call fcn.1400144e0
nop
mov rdx, qword [rbp + 0x70]
cmp rdx, 0xf
jbe 0x140013032
inc rdx
mov rcx, qword [rbp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001302d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001302d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
movdqu xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [0x14018ae90]
movdqu xmmword [rbp - 0x60], xmm1
mov word [rbp - 0x50], pe_nt_image_headers64
lea rdx, [rbp - 0x70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011f50
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
movdqa xmm0, xmmword [0x14018aef0]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x40], 0xdd
mov byte [rsp + 0x42], 1
lea rdx, [rsp + 0x30]
call fcn.140011e90
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov word [rsp + 0x48], pe_nt_image_headers64
lea rdx, [rsp + 0x30]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test rbx, rbx
jne 0x140012ff6
movdqa xmm0, xmmword [0x14018aee0]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0x9e9191dc
mov dword [rsp + 0x44], 0x22706464
call fcn.140011f10
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
movdqa xmm0, xmmword [0x14018aec0]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0x9e938e95
mov dword [rsp + 0x44], 0x226a6274
call fcn.140011f10
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
call fcn.140061e40
movdqa xmm0, xmmword [0x140065850]
movdqu xmmword [rbp + 0x68], xmm0
mov byte [rbp + 0x58], 0
mov r8, qword [rbp + 0x30]
cmp r8, 0xf
jbe 0x14001305a
mov rdx, qword [rbp + 0x18]
lea rcx, [rbp + 0x18]
call fcn.1400079c0
call fcn.140014740
nop
mov rdx, qword [rbp + 0xd0]
cmp rdx, 0xf
jbe 0x1400130a4
inc rdx
mov rcx, qword [rbp + 0xb8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001309f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001309f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140061e40
movdqa xmm0, xmmword [0x140065850]
movdqu xmmword [rbp + 0xc8], xmm0
mov byte [rbp + 0xb8], 0
mov rdx, qword [rbp + 0xb0]
cmp rdx, 0xf
jbe 0x1400130ff
inc rdx
mov rcx, qword [rbp + 0x98]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400130fa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400130fa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140061e40
mov qword [rbp + 0xa8], r15
mov qword [rbp + 0xb0], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x98], 0
mov rdx, qword [rbp + 0x50]
cmp rdx, 0xf
jbe 0x140013157
inc rdx
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140013151
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140013151
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140061e40
nop
mov rdx, qword [rbp + 0x90]
cmp rdx, 0xf
jbe 0x140013198
inc rdx
mov rcx, qword [rbp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140013193
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140013193
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140061e40
mov qword [rbp + 0x88], r15
mov qword [rbp + 0x90], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x78], 0
mov rdx, qword [rbp + 0x118]
cmp rdx, 0xf
jbe 0x1400131f2
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400131ed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400131ed
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140061e40
movdqa xmm0, xmmword [0x140065850]
movdqu xmmword [rbp + 0x110], xmm0
mov byte [rbp + 0x100], 0
mov rcx, r13
call fcn.140001ca0
nop
mov rdx, qword [rsi + 0x18]
cmp rdx, 0xf
jbe 0x140013248
inc rdx
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x140013243
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001326b
mov rcx, r8
call fcn.140061e40
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], 0
add rsp, 0x438
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.1400036a0
nop
call fcn.140003510
int3