Function at 0x14003e380
Capabilities:
Contain obfuscated stackstrings
Create thread
Delete file
Execute command
Get disk information
Hide graphical window
Terminate process
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xb50]
sub rsp, 0xc50
mov rax, qword [0x1400b7060]
xor rax, rsp
mov qword [rbp + 0xb40], rax
call fcn.14003de30
mov dword [rbp - 0x28], 0x4c6b1d02
mov dword [rbp - 0x24], 0x63783325
mov word [rbp - 0x20], 0x100
lea rcx, [rbp - 0x28]
call fcn.140043be0
lea rcx, [rbp - 0x28]
call fcn.140035310
lea rdx, [0x140284868]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140049960
call fcn.14003dab0
mov dword [rbp - 0x18], 0x5e6e1d02
mov dword [rbp - 0x14], 0x63783233
mov word [rbp - 0x10], 0x100
lea rcx, [rbp - 0x18]
call fcn.140043be0
lea rdx, [rbp - 0x18]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140048570
xor r13d, r13d
mov esi, r13d
mov edi, r13d
lea r14, [0x1402859e0]
call qword [sym.imp.api_ms_win_crt_conio_l1_1_0.dll__getch]
mov ebx, eax
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x14003e458
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x14003e458
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x14003e488
mov byte [rdi + r14], bl
inc esi
inc rdi
mov word [rsp + 0x44], reloc.WLDAP32.dll_Ordinal_22
mov byte [rsp + 0x46], 1
lea rcx, [rsp + 0x44]
call fcn.140043bd0
lea rdx, [rsp + 0x44]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140048570
cmp bl, 8
jne 0x14003e4ad
cmp rdi, 1
jl 0x14003e438
lea rdx, [0x1400a8228]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140048570
dec esi
dec rdi
jmp 0x14003e438
cmp bl, 0xd
jne 0x14003e438
movsxd rax, esi
cmp rax, 0x20
jae 0x14003fe10
mov byte [rax + r14], r13b
mov word [rsp + 0x48], gethostname
mov byte [rsp + 0x4a], 1
lea rcx, [rsp + 0x48]
call fcn.140043bd0
lea rcx, [rsp + 0x48]
call fcn.140035310
test esi, esi
jg 0x14003e59c
mov ecx, listen
call fcn.14003ddc0
movdqa xmm0, xmmword [0x1400a8d40]
movdqu xmmword [rbp + 0x58], xmm0
mov dword [rbp + 0x68], 0x383d3e2d
mov dword [rbp + 0x6c], 0x7336233f
mov dword [rbp + 0x70], 0x3b3a201a
mov word [rbp + 0x74], 0x100
lea rcx, [rbp + 0x58]
call fcn.140043ee0
lea rdx, [rbp + 0x58]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140048570
mov rcx, rax
lea rdx, [0x140048740]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp - 0x30], 0x4c4b5c4c
mov word [rbp - 0x2c], Ordinal_41
mov byte [rbp - 0x2a], 1
lea rcx, [rbp - 0x30]
call fcn.140043ba0
lea rcx, [rbp - 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor eax, eax
mov rcx, qword [rbp + 0xb40]
xor rcx, rsp
call fcn.140094850
lea r11, [rsp + 0xc50]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14003dab0
mov dword [rbp + 0x9f0], r13d
mov dword [rbp - 0x40], 0x1011077f
mov word [rbp - 0x3c], 0x100
lea rcx, [rbp - 0x40]
call fcn.140043cd0
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0x9f0]
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x14003e6fb
mov dword [rbp - 0x38], 0x10110778
mov word [rbp - 0x34], 0x100
lea rcx, [rbp - 0x38]
call fcn.140043cd0
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0x9f0]
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x14003e6fb
mov dword [rbp - 0x48], 0x10110779
mov word [rbp - 0x44], 0x100
lea rcx, [rbp - 0x48]
call fcn.140043cd0
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0x9f0]
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x14003e6fb
movdqa xmm0, xmmword [str.yOLP2ar_uuvwri]
movdqa xmmword [rbp + 0x690], xmm0
movdqa xmm1, xmmword [0x1400a99c0]
movdqa xmmword [rbp + 0x6a0], xmm1
movdqa xmm0, xmmword [0x1400a8d30]
movdqa xmmword [rbp + 0x6b0], xmm0
movdqa xmm1, xmmword [0x1400a8c70]
movdqa xmmword [rbp + 0x6c0], xmm1
mov byte [rbp + 0x6d0], 1
lea rcx, [0x140284908]
call fcn.140045730
mov rbx, rax
lea rcx, [rbp + 0x690]
call fcn.14003fe20
mov rdx, rax
mov r9d, 0x40010
mov r8, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rcx, [0x1402848d0]
call fcn.140045730
mov rdx, rax
lea rcx, [rbp + 0x830]
call fcn.14003db30
lea rcx, [0x140284888]
cmp rcx, rax
je 0x14003e72d
xor r8d, r8d
mov rdx, rax
call fcn.140046090
lea rcx, [rbp + 0x830]
call fcn.140045740
mov edx, dword [rbp + 0x9f0]
lea rcx, [rbp + 0x668]
call fcn.140047b60
nop
lea rcx, [rbp + 0x668]
call fcn.140045730
mov rdx, rax
lea rcx, [rbp + 0x850]
call fcn.14003db30
lea rbx, [0x140284948]
cmp rbx, rax
je 0x14003e781
xor r8d, r8d
mov rdx, rax
mov rcx, rbx
call fcn.140046090
lea rcx, [rbp + 0x850]
call fcn.140045740
nop
lea rcx, [rbp + 0x668]
call fcn.140045740
mov dword [rbp + 0x40], 0x3b5c3b13
mov dword [rbp + 0x44], 0x3b5d3b4e
mov dword [rbp + 0x48], 0x3b393b38
mov dword [rbp + 0x4c], 0x3b333b6c
mov dword [rbp + 0x50], 0x3b353b2c
mov word [rbp + 0x54], r13w
mov byte [rbp + 0x56], 1
lea rcx, [rbp + 0x40]
call fcn.140043ca0
lea r8, [rbp + 0x40]
lea rdx, [0x140284928]
lea rcx, [rbp + 0x870]
call fcn.1400483e0
nop
mov rdx, rax
mov rcx, qword [0x140285a50]
call fcn.140037470
nop
lea rcx, [rbp + 0x870]
call fcn.1400454b0
mov dword [rsp + 0x5c], 0x1000049
lea rcx, [rsp + 0x5c]
call fcn.140043d60
lea rdx, [rsp + 0x5c]
lea rcx, [rbp + 0x9f8]
call fcn.1400457d0
nop
lea rcx, [0x140284868]
call fcn.140045730
mov rdi, 0xffffffffffffffff
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14003e840
mov rdx, rax
lea rcx, [rbp + 0x9f8]
call fcn.140046010
mov dword [rsp + 0x4c], 0x34d1a
mov byte [rsp + 0x50], 1
lea rcx, [rsp + 0x4c]
call fcn.140043c70
lea rax, [rsp + 0x4c]
mov r8, rdi
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14003e880
lea rdx, [rsp + 0x4c]
lea rcx, [rbp + 0x9f8]
call fcn.140046010
mov r8, rdi
nop
inc r8
cmp byte [r14 + r8], 0
jne 0x14003e8a0
mov rdx, r14
lea rcx, [rbp + 0x9f8]
call fcn.140046010
mov dword [rsp + 0x54], 0x3551a
mov byte [rsp + 0x58], 1
lea rcx, [rsp + 0x54]
call fcn.140043c70
lea rax, [rsp + 0x54]
mov r8, rdi
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14003e8e0
lea rdx, [rsp + 0x54]
lea rcx, [rbp + 0x9f8]
call fcn.140046010
mov rcx, rbx
call fcn.140045730
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x14003e906
mov rdx, rax
lea rcx, [rbp + 0x9f8]
call fcn.140046010
mov rbx, qword [rbp + 0xa08]
lea rcx, [rbp + 0x9f8]
call fcn.140045730
mov r8d, ebx
mov rdx, rax
mov rcx, qword [0x140285a50]
call fcn.1400373e0
mov rdx, qword [rbp + 0xa08]
lea rcx, [rbp + 0x5e8]
call fcn.140047c00
nop
mov dword [rbp + 0x78], 0x3b523b7f
mov dword [rbp + 0x7c], 0x3b4b3b50
mov dword [rbp + 0x80], 0x3b2f3b25
mov dword [rbp + 0x84], 0x3b6e3b36
mov dword [rbp + 0x88], 0x3b203b08
mov dword [rbp + 0x8c], 0x3b203b28
mov dword [rbp + 0x90], 0x3b213b3c
mov dword [rbp + 0x94], 0x3b6b3b70
mov word [rbp + 0x98], r13w
mov byte [rbp + 0x9a], 1
lea rcx, [rbp + 0x78]
call fcn.140043c40
lea r8, [rbp + 0x5e8]
lea rdx, [rbp + 0x78]
lea rcx, [rbp + 0x890]
call fcn.140048780
mov rbx, rax
mov dword [rbp + 0xc0], 0x3b373b31
mov dword [rbp + 0xc4], 0x3b503b7d
mov dword [rbp + 0xc8], 0x3b353b2e
mov dword [rbp + 0xcc], 0x3b2d3b27
mov dword [rbp + 0xd0], 0x3b683b30
mov dword [rbp + 0xd4], 0x3b3e3b12
mov dword [rbp + 0xd8], 0x3b2c3b38
mov dword [rbp + 0xdc], 0x3b6b3b70
mov dword [rbp + 0xe0], 0x3b3d3b2d
mov dword [rbp + 0xe4], 0x3b233b3e
mov dword [rbp + 0xe8], 0x3b323b39
mov dword [rbp + 0xec], 0x3b273b33
mov dword [rbp + 0xf0], 0x3b3a3b3d
mov dword [rbp + 0xf4], 0x3b783b38
mov dword [rbp + 0xf8], 0x3b743b20
mov dword [rbp + 0xfc], 0x3b2c3b2d
mov dword [rbp + 0x100], 0x3b703b2b
mov dword [rbp + 0x104], 0x3b303b38
mov dword [rbp + 0x108], 0x3b0c3b12
mov dword [rbp + 0x10c], 0x3b163b4f
mov dword [rbp + 0x110], 0x3b093b16
mov dword [rbp + 0x114], 0x3b093b03
mov dword [rbp + 0x118], 0x3b063b0b
mov dword [rbp + 0x11c], 0x3b0e3b0e
mov dword [rbp + 0x120], 0x3b603b08
mov dword [rbp + 0x124], 0x3b64
mov byte [rbp + 0x128], 1
lea rcx, [rbp + 0xc0]
call fcn.140043c10
lea rax, [rbp + 0xc0]
mov r8, rdi
inc r8
cmp word [rax + r8*2], 0
jne 0x14003eaf5
lea rdx, [rbp + 0xc0]
mov rcx, rbx
call fcn.140046510
mov rdx, rax
lea rcx, [rbp + 0x5c8]
call fcn.1400455c0
nop
mov rcx, qword [0x140285a50]
add rcx, 0x120
lea rdx, [rbp + 0x5c8]
call fcn.140045480
nop
lea rcx, [rbp + 0x5c8]
call fcn.1400454b0
nop
lea rcx, [rbp + 0x890]
call fcn.1400454b0
nop
lea rcx, [rbp + 0x5e8]
call fcn.1400454b0
mov dword [rbp + 0x30], 0x3b723b6c
mov dword [rbp + 0x34], 0x3b6b3b6d
mov word [rbp + 0x38], r13w
mov byte [rbp + 0x3a], 1
lea rcx, [rbp + 0x30]
call fcn.140044540
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x608]
call fcn.1400455f0
nop
xor r8d, r8d
lea rdx, [rbp + 0x608]
mov rcx, qword [0x140285a50]
call fcn.140035fa0
movzx ebx, al
lea rcx, [rbp + 0x608]
call fcn.1400454b0
test bl, bl
je 0x14003fdb6
mov rdx, qword [0x140285a50]
add rdx, 0x50
lea rcx, [rbp + 0x648]
call fcn.140045630
lea rdx, [rbp + 0x648]
lea rcx, [rbp + 0xa80]
call fcn.140037760
nop
mov rax, qword [0x140285a50]
mov r9d, dword [rax + 0xb8]
mov r8, qword [rax + 0xb0]
lea rdx, [rbp + 0xa80]
lea rcx, [rbp + 0xa18]
call fcn.140037bf0
nop
mov dword [rsp + 0x78], 0xd0b0d
mov byte [rsp + 0x7c], 1
lea rcx, [rsp + 0x78]
call fcn.140043c70
lea rdx, [rsp + 0x78]
lea rcx, [rbp + 0xa18]
call fcn.1400498e0
test al, al
je 0x14003ecf1
movdqa xmm0, xmmword [0x1400a9250]
movdqa xmmword [rbp + 0x270], xmm0
movdqa xmm1, xmmword [0x1400a8cf0]
movdqa xmmword [rbp + 0x280], xmm1
movdqa xmm0, xmmword [0x1400a96d0]
movdqa xmmword [rbp + 0x290], xmm0
movdqa xmm1, xmmword [0x1400a9370]
movdqa xmmword [rbp + 0x2a0], xmm1
movdqa xmm0, xmmword [0x1400a9950]
movdqa xmmword [rbp + 0x2b0], xmm0
mov dword [rbp + 0x2c0], 0xfcfbadf8
mov dword [rbp + 0x2c4], 0xf2fce3f5
mov dword [rbp + 0x2c8], 0xb7b8f0f9
mov word [rbp + 0x2cc], 0x100
lea rcx, [0x140284908]
call fcn.140045730
mov rbx, rax
lea rcx, [rbp + 0x270]
call fcn.14003fe50
mov rdx, rax
mov r9d, reloc.WS2_32.dll_recv
mov r8, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov dword [rbp - 0x80], 0xd0a0d
mov byte [rbp - 0x7c], 1
lea rcx, [rbp - 0x80]
call fcn.140043c70
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0xa18]
call fcn.1400498e0
test al, al
je 0x14003edc0
movdqa xmm0, xmmword [0x1400a9250]
movdqa xmmword [rbp + 0x380], xmm0
movdqa xmm1, xmmword [0x1400a8cf0]
movdqa xmmword [rbp + 0x390], xmm1
movdqa xmm0, xmmword [0x1400a93e0]
movdqa xmmword [rbp + 0x3a0], xmm0
movdqa xmm1, xmmword [0x1400a9290]
movdqa xmmword [rbp + 0x3b0], xmm1
movdqa xmm0, xmmword [str.93D_]
movdqa xmmword [rbp + 0x3c0], xmm0
mov dword [rbp + 0x3d0], 0xe0f9feff
mov dword [rbp + 0x3d4], 0xbcf5e2
mov byte [rbp + 0x3d8], 1
lea rcx, [0x140284908]
call fcn.140045730
mov rbx, rax
lea rcx, [rbp + 0x380]
call fcn.14003fe80
mov rdx, rax
mov r9d, reloc.WS2_32.dll_recv
mov r8, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov dword [rbp - 0x78], 0xa040d
mov byte [rbp - 0x74], 1
lea rcx, [rbp - 0x78]
call fcn.140043c70
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0xa18]
call fcn.1400498e0
test al, al
je 0x14003eeec
movdqa xmm0, xmmword [0x1400a9250]
movdqa xmmword [rbp + 0x490], xmm0
movdqa xmm1, xmmword [0x1400a8cf0]
movdqa xmmword [rbp + 0x4a0], xmm1
movdqa xmm0, xmmword [0x1400a9680]
movdqa xmmword [rbp + 0x4b0], xmm0
movdqa xmm1, xmmword [0x1400a9670]
movdqa xmmword [rbp + 0x4c0], xmm1
movdqa xmm0, xmmword [0x1400a8e30]
movdqa xmmword [rbp + 0x4d0], xmm0
movdqa xmm1, xmmword [str.YeE6yCrTs_]
movdqa xmmword [rbp + 0x4e0], xmm1
movdqa xmm0, xmmword [0x1400a9390]
movdqa xmmword [rbp + 0x4f0], xmm0
movdqa xmm1, xmmword [0x1400a9750]
movdqa xmmword [rbp + 0x500], xmm1
movdqa xmm0, xmmword [0x1400a9970]
movdqa xmmword [rbp + 0x510], xmm0
movdqa xmm1, xmmword [0x1400a9640]
movdqa xmmword [rbp + 0x520], xmm1
mov dword [rbp + 0x530], 0xaab9e2f3
mov dword [rbp + 0x534], 0xde8d9390
mov dword [rbp + 0x538], 0x908e8096
mov dword [rbp + 0x53c], 0x1008d81
lea rcx, [0x140284908]
call fcn.140045730
mov rbx, rax
lea rcx, [rbp + 0x490]
call fcn.14003feb0
mov rdx, rax
mov r9d, reloc.WS2_32.dll_recv
mov r8, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov dword [rbp - 0x70], 0x70e0d
mov byte [rbp - 0x6c], 1
lea rcx, [rbp - 0x70]
call fcn.140043c70
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0xa18]
call fcn.1400498e0
test al, al
je 0x14003f018
movdqa xmm0, xmmword [0x1400a9250]
movdqa xmmword [rbp + 0x3e0], xmm0
movdqa xmm1, xmmword [0x1400a8cf0]
movdqa xmmword [rbp + 0x3f0], xmm1
movdqa xmm0, xmmword [0x1400a9680]
movdqa xmmword [rbp + 0x400], xmm0
movdqa xmm1, xmmword [0x1400a9670]
movdqa xmmword [rbp + 0x410], xmm1
movdqa xmm0, xmmword [0x1400a8e30]
movdqa xmmword [rbp + 0x420], xmm0
movdqa xmm1, xmmword [str.YeE6yCrTs_]
movdqa xmmword [rbp + 0x430], xmm1
movdqa xmm0, xmmword [0x1400a9390]
movdqa xmmword [rbp + 0x440], xmm0
movdqa xmm1, xmmword [0x1400a9750]
movdqa xmmword [rbp + 0x450], xmm1
movdqa xmm0, xmmword [0x1400a9970]
movdqa xmmword [rbp + 0x460], xmm0
movdqa xmm1, xmmword [0x1400a9640]
movdqa xmmword [rbp + 0x470], xmm1
mov dword [rbp + 0x480], 0xaab9e2f3
mov dword [rbp + 0x484], 0xde8d9390
mov dword [rbp + 0x488], 0x908e8096
mov dword [rbp + 0x48c], 0x1008d81
lea rcx, [0x140284908]
call fcn.140045730
mov rbx, rax
lea rcx, [rbp + 0x3e0]
call fcn.14003feb0
mov rdx, rax
mov r9d, reloc.WS2_32.dll_recv
mov r8, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov dword [rbp - 0x68], 0x60f0d
mov byte [rbp - 0x64], 1
lea rcx, [rbp - 0x68]
call fcn.140043c70
lea rdx, [rbp - 0x68]
lea rcx, [rbp + 0xa18]
call fcn.1400498e0
test al, al
je 0x14003f106
movdqa xmm0, xmmword [0x1400a9250]
movdqa xmmword [rbp + 0x540], xmm0
movdqa xmm1, xmmword [0x1400a8cf0]
movdqa xmmword [rbp + 0x550], xmm1
movdqa xmm0, xmmword [0x1400a96d0]
movdqa xmmword [rbp + 0x560], xmm0
movdqa xmm1, xmmword [0x1400a9660]
movdqa xmmword [rbp + 0x570], xmm1
movdqa xmm0, xmmword [0x1400a9400]
movdqa xmmword [rbp + 0x580], xmm0
movdqa xmm1, xmmword [0x1400a96b0]
movdqa xmmword [rbp + 0x590], xmm1
movdqa xmm0, xmmword [0x1400a9760]
movdqa xmmword [rbp + 0x5a0], xmm0
mov dword [rbp + 0x5b0], 0xcbdcc2db
mov word [rbp + 0x5b4], 0x9e
mov byte [rbp + 0x5b6], 1
lea rcx, [0x140284908]
call fcn.140045730
mov rbx, rax
lea rcx, [rbp + 0x540]
call fcn.14003fee0
mov rdx, rax
mov r9d, reloc.WS2_32.dll_recv
mov r8, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov dword [rbp - 0x60], 0x8040d
mov byte [rbp - 0x5c], 1
lea rcx, [rbp - 0x60]
call fcn.140043c70
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0xa18]
call fcn.1400498e0
test al, al
je 0x14003f1d1
movdqa xmm0, xmmword [0x1400a9250]
movdqa xmmword [rbp + 0x7c0], xmm0
movdqa xmm1, xmmword [0x1400a8cf0]
movdqa xmmword [rbp + 0x7d0], xmm1
movdqa xmm0, xmmword [0x1400a9630]
movdqa xmmword [rbp + 0x7e0], xmm0
movdqa xmm1, xmmword [0x1400a9360]
movdqa xmmword [rbp + 0x7f0], xmm1
movdqa xmm0, xmmword [0x1400a9800]
movdqa xmmword [rbp + 0x800], xmm0
movdqa xmm1, xmmword [0x1400a8ca0]
movdqa xmmword [rbp + 0x810], xmm1
mov byte [rbp + 0x820], 1
lea rcx, [0x140284908]
call fcn.140045730
mov rbx, rax
lea rcx, [rbp + 0x7c0]
call fcn.14003ff10
mov rdx, rax
mov r9d, reloc.WS2_32.dll_recv
mov r8, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov dword [rbp - 0x58], 0x70f0d
mov byte [rbp - 0x54], 1
lea rcx, [rbp - 0x58]
call fcn.140043c70
lea rdx, [rbp - 0x58]
lea rcx, [rbp + 0xa18]
call fcn.1400498e0
test al, al
je 0x14003fc3f
call fcn.14003dab0
mov byte [rsp + 0x40], 0
lea rcx, [rsp + 0x40]
call fcn.14003ff40
mov esi, eax
call fcn.140037de0
test al, al
je 0x14003fc0d
mov ecx, esi
call fcn.140038430
test al, al
jne 0x14003f841
mov edx, reloc.WS2_32.dll_ntohs
lea ecx, [rdx - 0xa]
call fcn.14003b370
mov edx, eax
lea rcx, [rbp + 0xae0]
call fcn.14003b4a0
nop
mov edx, reloc.WS2_32.dll_ntohs
lea ecx, [rdx - 0xa]
call fcn.14003b370
mov edx, eax
lea rcx, [rbp + 0xac0]
call fcn.14003b4a0
nop
movdqa xmm0, xmmword [0x1400a8dd0]
movdqu xmmword [rbp + 0x150], xmm0
mov dword [rbp + 0x160], 0x137c7e21
mov word [rbp + 0x164], 0x100
lea rcx, [rbp + 0x150]
call fcn.140043eb0
lea r8, [rbp + 0xae0]
lea rdx, [rbp + 0x150]
lea rcx, [rbp + 0x8d0]
call fcn.140048040
mov rbx, rax
mov dword [rsp + 0x60], 0x5a465812
mov word [rsp + 0x64], 0x100
lea rcx, [rsp + 0x60]
call fcn.140043cd0
lea rax, [rsp + 0x60]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x14003f2d4
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.140046010
mov rdx, rax
lea rcx, [rbp + 0xa60]
call fcn.1400457a0
nop
lea rcx, [rbp + 0x8d0]
call fcn.140045740
movdqa xmm0, xmmword [0x1400a8dd0]
movdqu xmmword [rbp + 0x168], xmm0
mov dword [rbp + 0x178], 0x137c7e21
mov word [rbp + 0x17c], 0x100
lea rcx, [rbp + 0x168]
call fcn.140043eb0
lea r8, [rbp + 0xac0]
lea rdx, [rbp + 0x168]
lea rcx, [rbp + 0x8f0]
call fcn.140048040
mov rbx, rax
mov dword [rsp + 0x68], 0x4c474e12
mov word [rsp + 0x6c], 0x100
lea rcx, [rsp + 0x68]
call fcn.140043cd0
lea rax, [rsp + 0x68]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x14003f374
lea rdx, [rsp + 0x68]
mov rcx, rbx
call fcn.140046010
mov rdx, rax
lea rcx, [rbp + 0xa40]
call fcn.1400457a0
nop
lea rcx, [rbp + 0x8f0]
call fcn.140045740
movdqa xmm0, xmmword [0x1400a8dd0]
movdqu xmmword [rbp + 0x180], xmm0
mov dword [rbp + 0x190], 0x137c7e21
mov word [rbp + 0x194], 0x100
lea rcx, [rbp + 0x180]
call fcn.140043eb0
lea r8, [rbp + 0xae0]
lea rdx, [rbp + 0x180]
lea rcx, [rbp + 0x910]
call fcn.140048040
mov rbx, rax
movdqa xmm0, xmmword [0x1400a8d20]
movdqu xmmword [rbp + 0xa0], xmm0
mov dword [rbp + 0xb0], 0x3b3d341f
mov dword [rbp + 0xb4], 0x61613c35
mov word [rbp + 0xb8], 8
mov byte [rbp + 0xba], 1
lea rcx, [rbp + 0xa0]
call fcn.140043b40
lea rax, [rbp + 0xa0]
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14003f440
lea rdx, [rbp + 0xa0]
mov rcx, rbx
call fcn.140046010
mov rdx, rax
lea rcx, [rbp + 0x628]
call fcn.1400457a0
nop
lea r8, [rbp + 0xac0]
lea rdx, [rbp + 0x628]
lea rcx, [rbp + 0x9d0]
call fcn.1400488d0
mov rbx, rax
mov dword [rsp + 0x70], 0x4c474e12
mov word [rsp + 0x74], 0x100
lea rcx, [rsp + 0x70]
call fcn.140043cd0
lea rax, [rsp + 0x70]
inc rdi
cmp byte [rax + rdi], 0
jne 0x14003f4a4
mov r8, rdi
lea rdx, [rsp + 0x70]
mov rcx, rbx
call fcn.140046010
mov rdx, rax
lea rcx, [rbp + 0xb00]
call fcn.1400457a0
nop
lea rcx, [rbp + 0x9d0]
call fcn.140045740
nop
lea rcx, [rbp + 0x628]
call fcn.140045740
nop
lea rcx, [rbp + 0x910]
call fcn.140045740
lea rcx, [rbp + 0xa60]
call fcn.14003ccf0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, [rbp + 0xa40]
call fcn.14003ccf0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp + 0xa60]
call fcn.14003ccf0
mov rcx, rax
mov r8d, 0xa5c00
lea rdx, [0x1401a14f0]
call fcn.14003cd60
mov edx, 0x13460
mov ecx, 0x4a00
call fcn.14003b370
mov edi, eax
lea rcx, [rbp + 0xa40]
call fcn.140045730
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 3]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0xa38]
mov r8d, edi
lea rdx, [0x1400b70c0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp + 0xb00]
call fcn.14003ccf0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp + 0xa60]
call fcn.14003ccf0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, [rbp + 0xa40]
call fcn.14003ccf0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, esi
call fcn.140038430
test al, al
jne 0x14003f7d6
mov edx, listen
lea rcx, [rbp + 0xb20]
call fcn.14003b4a0
nop
movdqa xmm0, xmmword [0x1400a8dd0]
movdqu xmmword [rbp + 0x198], xmm0
mov dword [rbp + 0x1a8], 0x137c7e21
mov word [rbp + 0x1ac], 0x100
lea rcx, [rbp + 0x198]
call fcn.14003cdf0
mov rdx, rax
lea r8, [rbp + 0xb20]
lea rcx, [rbp + 0x930]
call fcn.140048040
mov rbx, rax
mov dword [rbp - 8], 0x5a465812
mov word [rbp - 4], 0x100
lea rcx, [rbp - 8]
call fcn.14003e2f0
mov r8, rax
mov rdx, rbx
lea rcx, [rbp + 0xaa0]
call fcn.1400481a0
nop
lea rcx, [rbp + 0x930]
call fcn.140045740
lea rcx, [rbp + 0xaa0]
call fcn.14003ccf0
mov rcx, rax
mov r8d, 0x3d600
lea rdx, [0x1402470f0]
call fcn.14003cd60
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp + 0xaa0]
call fcn.14003ccf0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp + 0xaa0]
call fcn.14003ccf0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov edx, 7
lea rcx, [rbp + 0x950]
call fcn.14003b4a0
nop
movdqa xmm0, xmmword [0x1400a8df0]
movdqa xmmword [rbp + 0x6e0], xmm0
movdqa xmm1, xmmword [0x1400a93a0]
movdqa xmmword [rbp + 0x6f0], xmm1
movdqa xmm0, xmmword [0x1400a93f0]
movdqa xmmword [rbp + 0x700], xmm0
movdqa xmm1, xmmword [0x1400a9650]
movdqa xmmword [rbp + 0x710], xmm1
movdqa xmm0, xmmword [0x1400a9220]
movdqa xmmword [rbp + 0x720], xmm0
movdqa xmm1, xmmword [str.d_M]
movdqa xmmword [rbp + 0x730], xmm1
mov word [rbp + 0x740], 0x100
mov rcx, rax
call fcn.140045730
mov rbx, rax
lea rcx, [rbp + 0x6e0]
call fcn.14003ffd0
mov rdx, rax
mov r9d, 0x40010
mov r8, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
nop
lea rcx, [rbp + 0x950]
call fcn.140045740
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
lea rcx, [rbp + 0xa60]
call fcn.14003ccf0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, [rbp + 0xa40]
call fcn.14003ccf0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
nop
lea rcx, [rbp + 0xb00]
call fcn.140045740
nop
lea rcx, [rbp + 0xa40]
call fcn.140045740
nop
lea rcx, [rbp + 0xa60]
call fcn.140045740
nop
lea rcx, [rbp + 0xac0]
call fcn.140045740
nop
lea rcx, [rbp + 0xae0]
call fcn.140045740
mov dword [rbp - 0x50], 0x4d515f
mov byte [rbp - 0x4c], 1
lea rcx, [rbp - 0x50]
call fcn.140043c70
lea rcx, [rbp - 0x50]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 6
lea rcx, [rbp + 0x970]
call fcn.14003b4a0
nop
mov rcx, rax
call fcn.140045730
mov rbx, rax
movdqa xmm0, xmmword [0x1400a99e0]
movdqu xmmword [rbp + 0x1b0], xmm0
movdqa xmm1, xmmword [0x1400a92b0]
movdqu xmmword [rbp + 0x1c0], xmm1
mov dword [rbp + 0x1d0], 0x137e3315
mov dword [rbp + 0x1d4], 0x1a00030f
mov word [rbp + 0x1d8], 0x100
lea rcx, [rbp + 0x1b0]
call fcn.140043b10
mov r9d, 0x40030
mov r8, rbx
lea rdx, [rbp + 0x1b0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
nop
lea rcx, [rbp + 0x970]
call fcn.140045740
mov dword [rbp], 0x5157526c
mov dword [rbp + 4], 0x2f006134
mov dword [rbp + 8], 0x2d2b25
mov byte [rbp + 0xc], 1
lea rcx, [rbp]
call fcn.140043f10
lea rdx, [rbp]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x14003f9c3
lea edx, [rax + 7]
lea rcx, [rbp + 0x990]
call fcn.14003b4a0
nop
movdqa xmm0, xmmword [0x1400a92d0]
movdqu xmmword [rbp + 0x1e0], xmm0
movdqa xmm1, xmmword [0x1400a9380]
movdqu xmmword [rbp + 0x1f0], xmm1
movdqa xmm0, xmmword [0x1400a8d80]
movdqu xmmword [rbp + 0x200], xmm0
mov dword [rbp + 0x210], 0x1274d27
mov dword [rbp + 0x214], 0x111d3d50
mov dword [rbp + 0x218], 0x1000c16
mov rcx, rax
call fcn.140045730
mov rbx, rax
lea rcx, [rbp + 0x1e0]
call fcn.140040000
mov rdx, rax
mov r9d, 0x40010
mov r8, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
nop
lea rcx, [rbp + 0x990]
call fcn.140045740
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov dword [rbp + 0x10], 0x5157526c
mov dword [rbp + 0x14], 0x2f006134
mov dword [rbp + 0x18], 0x2d2b25
mov byte [rbp + 0x1c], 1
lea rcx, [rbp + 0x10]
call fcn.140043f10
lea rdx, [rbp + 0x10]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x140285a30], rax
lea rdx, [0x1402859d0]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [rbp + 0x20], 0x5157526c
mov dword [rbp + 0x24], 0x222e0334
mov dword [rbp + 0x28], 0x22682e2a
mov dword [rbp + 0x2c], 0x1002c30
lea rcx, [rbp + 0x20]
call fcn.140043ae0
lea rcx, [rbp + 0x20]
call fcn.14003ae00
mov dword [0x14028580c], eax
mov dword [0x140285a28], eax
call fcn.1400384a0
mov qword [0x140285850], rax
mov qword [0x140285818], rax
mov edx, 0x3e8
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Beep]
cmp qword [0x140285818], 0
jne 0x14003fb32
mov edx, 7
lea rcx, [rbp + 0x9b0]
call fcn.14003b4a0
nop
movdqa xmm0, xmmword [0x1400a8df0]
movdqa xmmword [rbp + 0x750], xmm0
movdqa xmm1, xmmword [0x1400a93a0]
movdqa xmmword [rbp + 0x760], xmm1
movdqa xmm0, xmmword [0x1400a93f0]
movdqa xmmword [rbp + 0x770], xmm0
movdqa xmm1, xmmword [0x1400a9650]
movdqa xmmword [rbp + 0x780], xmm1
movdqa xmm0, xmmword [0x1400a9220]
movdqa xmmword [rbp + 0x790], xmm0
movdqa xmm1, xmmword [str.d_M]
movdqa xmmword [rbp + 0x7a0], xmm1
mov word [rbp + 0x7b0], 0x100
mov rcx, rax
call fcn.140045730
mov rbx, rax
lea rcx, [rbp + 0x750]
call fcn.14003ffd0
mov rdx, rax
mov r9d, 0x40010
mov r8, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
nop
lea rcx, [rbp + 0x9b0]
call fcn.140045740
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
call fcn.14003aed0
lea rdx, [0x140043610]
lea rcx, [rbp + 0x340]
call fcn.140049d10
nop
lea rcx, [rbp + 0x340]
call fcn.140037d20
nop
cmp dword [rbp + 0x348], 0
jne 0x14003fc38
lea rdx, [0x140043510]
lea rcx, [rbp + 0x350]
call fcn.140049d10
nop
lea rcx, [rbp + 0x350]
call fcn.140037d20
nop
cmp dword [rbp + 0x358], 0
jne 0x14003fc38
lea rdx, [0x14003cbd0]
lea rcx, [rbp + 0x360]
call fcn.140049d10
nop
lea rcx, [rbp + 0x360]
call fcn.140037d20
nop
cmp dword [rbp + 0x368], 0
jne 0x14003fc38
lea rdx, [0x14003cc90]
lea rcx, [rbp + 0x370]
call fcn.140049d10
nop
lea rcx, [rbp + 0x370]
call fcn.140037d20
nop
cmp dword [rbp + 0x378], 0
jne 0x14003fc38
call fcn.14003b670
call fcn.14003b9b0
call fcn.14003c710
call fcn.14003cb80
nop
lea rcx, [rbp + 0xa18]
call fcn.140045740
nop
lea rcx, [rbp + 0xa80]
call fcn.1400454b0
nop
lea rcx, [rbp + 0x9f8]
call fcn.140045740
jmp 0x14003e56a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, [0x14003da90]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, listen
call fcn.14003ddc0
movdqa xmm0, xmmword [0x1400a8db0]
movdqa xmmword [rbp + 0x220], xmm0
movdqa xmm1, xmmword [0x1400a92a0]
movdqa xmmword [rbp + 0x230], xmm1
movdqa xmm0, xmmword [str._t6:_]
movdqa xmmword [rbp + 0x240], xmm0
movdqa xmm1, xmmword [0x1400a8d00]
movdqa xmmword [rbp + 0x250], xmm1
mov dword [rbp + 0x260], 0x170a120e
mov dword [rbp + 0x264], 0xf7e7efae
mov word [rbp + 0x268], reloc.WLDAP32.dll_Ordinal_217
mov byte [rbp + 0x26a], 1
lea rcx, [rbp + 0x220]
call fcn.14003e320
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140048570
mov rcx, rax
lea rdx, [0x140048740]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
movdqa xmm0, xmmword [str.yOLP2ar_veg]
movdqa xmmword [rbp + 0x2d0], xmm0
movdqa xmm1, xmmword [0x1400a9320]
movdqa xmmword [rbp + 0x2e0], xmm1
movdqa xmm0, xmmword [0x1400a9710]
movdqa xmmword [rbp + 0x2f0], xmm0
movdqa xmm1, xmmword [0x1400a96c0]
movdqa xmmword [rbp + 0x300], xmm1
movdqa xmm0, xmmword [0x1400a9210]
movdqa xmmword [rbp + 0x310], xmm0
movdqa xmm1, xmmword [str.__m6_EX]
movdqa xmmword [rbp + 0x320], xmm1
mov dword [rbp + 0x330], 0xb0f9fab2
mov dword [rbp + 0x334], 0xf1c5c0c8
mov dword [rbp + 0x338], 0xe3c3e1c6
mov dword [rbp + 0x33c], 0x100e3ff
lea rcx, [0x140284908]
call fcn.140045730
mov rbx, rax
lea rcx, [rbp + 0x2d0]
call fcn.14003e350
mov rdx, rax
mov r9d, reloc.WS2_32.dll_recv
mov r8, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
movdqa xmm0, xmmword [0x1400a8e20]
movdqu xmmword [rbp + 0x130], xmm0
mov dword [rbp + 0x140], 0x2a3b3c29
mov dword [rbp + 0x144], 0x7c2523
mov byte [rbp + 0x148], 1
lea rcx, [rbp + 0x130]
call fcn.14003e2c0
mov rdx, rax
lea rcx, [rbp + 0x8b0]
call fcn.1400457d0
lea rdx, [0x1400b3cf8]
lea rcx, [rbp + 0x8b0]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
call fcn.140094f78
int3