Function at 0x1400aab10
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x310]
sub rsp, 0x410
mov rax, qword [0x1403a05a0]
xor rax, rsp
mov qword [rbp + 0x300], rax
mov r13, rcx
mov qword [rsp + 0x48], rcx
lea rcx, [rbp + 0xc8]
call fcn.1400a9a20
nop
mov rdx, rax
lea rcx, [rbp + 0x68]
call fcn.1400a9430
mov rbx, rax
lea rsi, [r13 + 0x108]
xor edi, edi
cmp rsi, rax
je 0x1400aabe0
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x1400aabb4
mov rcx, qword [rsi]
inc rdx
cmp rdx, 0x1000
jb 0x1400aabaf
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400abc65
mov rcx, r8
call fcn.1402711ec
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], dil
movups xmm0, xmmword [rbx]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsi + 0x10], xmm1
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], dil
mov rdx, qword [rbp + 0x80]
cmp rdx, 0x10
jb 0x1400aac1e
inc rdx
mov rcx, qword [rbp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400aac19
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400abc65
call fcn.1402711ec
mov qword [rbp + 0x78], rdi
mov qword [rbp + 0x80], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x68], dil
mov rdx, qword [rbp + 0xe0]
cmp rdx, 0x10
jb 0x1400aac72
inc rdx
mov rcx, qword [rbp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400aac6d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400abc6b
call fcn.1402711ec
cmp qword [r13 + 0x30], 0xa
jne 0x1400abbe2
cmp qword [r13 + 0x50], 0x40
jne 0x1400abbe2
mov dword [rbp + 8], 0x3f3b3d75
mov dword [rbp + 0xc], 0x2c300723
mov word [rbp + 0x10], 0x66
mov byte [rbp + 0x12], 1
mov rcx, rdi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x53]
xor byte [rbp + rcx + 8], al
inc rcx
cmp rcx, 9
jb 0x1400aacb0
mov byte [rbp + 0x12], 0
lea rdx, [r13 + 0x20]
lea rcx, [rbp + 0x240]
call fcn.1400a97d0
mov r15, rax
mov dword [rbp - 8], 0x38223b75
mov dword [rbp - 4], 0x3e302a32
mov word [rbp], 0x66
mov byte [rbp + 2], 1
mov rcx, rdi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x53]
xor byte [rbp + rcx - 8], al
inc rcx
cmp rcx, 9
jb 0x1400aad00
mov byte [rbp + 2], 0
mov rdx, r13
lea rcx, [rbp + 0x220]
call fcn.1400a97d0
mov r14, rax
mov dword [rbp - 0x20], 0x3b343a75
mov dword [rbp - 0x1c], 0x1006532
mov rcx, rdi
nop word [rax + rax]
lea eax, [rcx + 0x53]
xor byte [rbp + rcx - 0x20], al
inc rcx
cmp rcx, 6
jb 0x1400aad40
mov byte [rbp - 0x19], 0
lea rax, [rbp - 0x50]
mov qword [rbp - 0x28], rax
lea rdx, [0x140521ed8]
lea rcx, [rbp - 0x50]
call fcn.1400a20a0
mov rdi, rax
lea rax, [rbp - 0x70]
mov qword [rbp - 0x30], rax
lea rdx, [r13 + 0x40]
lea rcx, [rbp - 0x70]
call fcn.1400a20a0
mov rbx, rax
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.1400a20a0
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x200]
call fcn.1400a9b70
mov rsi, rax
mov dword [rbp - 0x18], 0x353b3175
mov dword [rbp - 0x14], 0x67203d3c
mov word [rbp - 0x10], 0x100
xor eax, eax
mov ecx, eax
nop word [rax + rax]
lea eax, [rcx + 0x53]
xor byte [rbp + rcx - 0x18], al
inc rcx
cmp rcx, 8
jb 0x1400aadd0
mov byte [rbp - 0xf], 0
lea rax, [rbp + 0x110]
mov qword [rsp + 0x30], rax
lea rdx, [0x140521ed8]
lea rcx, [rbp + 0x110]
call fcn.1400a20a0
mov rdi, rax
lea rax, [rbp + 0x2e0]
mov qword [rbp - 0x28], rax
lea rdx, [r13 + 0x40]
lea rcx, [rbp + 0x2e0]
call fcn.1400a20a0
mov rbx, rax
lea rdx, [r13 + 0x60]
lea rcx, [rbp + 0xe8]
call fcn.1400a20a0
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x1e0]
call fcn.1400a9b70
mov rdi, rax
mov dword [rbp - 0x28], 0x24302275
mov word [rbp - 0x24], WSAGetLastError
mov byte [rbp - 0x22], 1
xor r12d, r12d
mov ecx, r12d
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx + 0x53]
xor byte [rbp + rcx - 0x28], al
inc rcx
cmp rcx, 5
jb 0x1400aae70
mov byte [rbp - 0x22], r12b
mov dword [rbp - 0x30], 0x223c3a3a
mov word [rbp - 0x2c], 0x100
mov rcx, r12
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx + 0x53]
xor byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 4
jb 0x1400aaea0
mov byte [rbp - 0x2b], r12b
mov qword [rbp + 0x28], r12
mov qword [rbp + 0x38], r12
mov qword [rbp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x28], r12b
lea rax, [rbp - 0x30]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], r12b
jne 0x1400aaed6
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x28]
call fcn.1400a22c0
nop
lea rdx, [rbp + 0x28]
lea rcx, [rbp + 0x1c0]
call fcn.1400a97d0
mov r10, rax
mov dword [rbp - 0x30], 0x33252d27
mov word [rbp - 0x2c], WSAGetLastError
mov byte [rbp - 0x2a], 1
mov rcx, r12
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx + 0x53]
xor byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 5
jb 0x1400aaf20
mov byte [rbp - 0x2a], 0
lea rax, [rbp - 0x30]
mov r9, rbx
nop dword [rax + rax]
inc r9
cmp byte [rax + r9], 0
jne 0x1400aaf40
lea r8, [rbp - 0x30]
xor edx, edx
mov rcx, r10
call fcn.1400bf2c0
mov qword [rbp + 0xa8], r12
mov qword [rbp + 0xb8], r12
mov qword [rbp + 0xc0], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xa8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xb8], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rax, [rbp - 0x28]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400aafa0
lea rdx, [rbp - 0x28]
lea rcx, [rbp + 0xa8]
call fcn.1400a2420
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xc8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xd8], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, rdi
lea r8, [rbp + 0xc8]
lea rcx, [rbp + 0x68]
call fcn.1400bf3d0
nop
lea rax, [rbp - 0x18]
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400ab000
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0x68]
call fcn.1400a2420
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x2c0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x2d0], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, rsi
lea r8, [rbp + 0x2c0]
lea rcx, [rbp + 0x160]
call fcn.1400bf3d0
nop
lea rax, [rbp - 0x20]
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400ab060
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x160]
call fcn.1400a2420
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x2a0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x2b0], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, r14
lea r8, [rbp + 0x2a0]
lea rcx, [rbp + 0x180]
call fcn.1400bf3d0
nop
lea rax, [rbp - 8]
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400ab0c0
lea rdx, [rbp - 8]
lea rcx, [rbp + 0x180]
call fcn.1400a2420
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x280], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x290], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, r15
lea r8, [rbp + 0x280]
lea rcx, [rbp + 0x1a0]
call fcn.1400bf3d0
nop
lea rax, [rbp + 8]
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400ab120
mov r8, rbx
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x1a0]
call fcn.1400a2420
mov qword [rbp + 0x88], r12
mov qword [rbp + 0x98], r12
mov qword [rbp + 0xa0], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x88], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x98], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rdx, [0x140521ed8]
cmp qword [0x140521ef0], 0x10
cmovae rdx, qword [0x140521ed8]
mov r8, qword [0x140521ee8]
lea rcx, [rbp + 0x88]
call fcn.1400a2420
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x260], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x270], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rbp + 0xa0]
cmp rdx, 0x10
jb 0x1400ab204
inc rdx
mov rcx, qword [rbp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ab1ff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400abc71
call fcn.1402711ec
mov qword [rbp + 0x98], r12
mov qword [rbp + 0xa0], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x88], 0
mov rdx, qword [rbp + 0x1b8]
cmp rdx, 0x10
jb 0x1400ab25e
inc rdx
mov rcx, qword [rbp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ab259
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400abc77
call fcn.1402711ec
mov qword [rbp + 0x1b0], r12
mov qword [rbp + 0x1b8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x1a0], 0
mov rdx, qword [rbp + 0x298]
cmp rdx, 0x10
jb 0x1400ab2b9
inc rdx
mov rcx, qword [rbp + 0x280]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ab2b3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400abc7d
call fcn.1402711ec
nop
mov rdx, qword [rbp + 0x198]
cmp rdx, 0x10
jb 0x1400ab2fa
inc rdx
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ab2f5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400abc83
call fcn.1402711ec
mov qword [rbp + 0x190], r12
mov qword [rbp + 0x198], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x180], 0
mov rdx, qword [rbp + 0x2b8]
cmp rdx, 0x10
jb 0x1400ab355
inc rdx
mov rcx, qword [rbp + 0x2a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ab34f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400abc89
call fcn.1402711ec
nop
mov rdx, qword [rbp + 0x178]
cmp rdx, 0x10
jb 0x1400ab396
inc rdx
mov rcx, qword [rbp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ab391
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400abc8f
call fcn.1402711ec
mov qword [rbp + 0x170], r12
mov qword [rbp + 0x178], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x160], 0
mov rdx, qword [rbp + 0x2d8]
cmp rdx, 0x10
jb 0x1400ab3f1
inc rdx
mov rcx, qword [rbp + 0x2c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ab3eb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400abc95
call fcn.1402711ec
nop
mov rdx, qword [rbp + 0x80]
cmp rdx, 0x10
jb 0x1400ab42f
inc rdx
mov rcx, qword [rbp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ab42a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400abc9b
call fcn.1402711ec
mov qword [rbp + 0x78], r12
mov qword [rbp + 0x80], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x68], 0
mov rdx, qword [rbp + 0xe0]
cmp rdx, 0x10
jb 0x1400ab484
inc rdx
mov rcx, qword [rbp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ab47e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400abca1
call fcn.1402711ec
nop
mov rdx, qword [rbp + 0xc0]
cmp rdx, 0x10
jb 0x1400ab4c5
inc rdx
mov rcx, qword [rbp + 0xa8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ab4c0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400abca7
call fcn.1402711ec
mov qword [rbp + 0xb8], r12
mov qword [rbp + 0xc0], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xa8], 0
mov rdx, qword [rbp + 0x1d8]
cmp rdx, 0x10
jb 0x1400ab51f
inc rdx
mov rcx, qword [rbp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ab51a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400abcad
call fcn.1402711ec
mov qword [rbp + 0x1d0], r12
mov qword [rbp + 0x1d8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x1c0], 0
mov rdx, qword [rbp + 0x40]
cmp rdx, 0x10
jb 0x1400ab573
inc rdx
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ab56e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400abcb3
call fcn.1402711ec
mov qword [rbp + 0x38], r12
mov qword [rbp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x28], 0
mov rdx, qword [rbp + 0x1f8]
cmp rdx, 0x10
jb 0x1400ab5c4
inc rdx
mov rcx, qword [rbp + 0x1e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ab5bf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400abcb9
call fcn.1402711ec
mov qword [rbp + 0x1f0], r12
mov qword [rbp + 0x1f8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x1e0], 0
mov rdx, qword [rbp + 0x218]
cmp rdx, 0x10
jb 0x1400ab61e
inc rdx
mov rcx, qword [rbp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ab619
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400abcbf
call fcn.1402711ec
mov qword [rbp + 0x210], r12
mov qword [rbp + 0x218], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x200], 0
mov rdx, qword [rbp + 0x238]
cmp rdx, 0x10
jb 0x1400ab678
inc rdx
mov rcx, qword [rbp + 0x220]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ab673
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400abcc5
call fcn.1402711ec
mov qword [rbp + 0x230], r12
mov qword [rbp + 0x238], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x220], 0
mov rdx, qword [rbp + 0x258]
cmp rdx, 0x10
jb 0x1400ab6d2
inc rdx
mov rcx, qword [rbp + 0x240]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ab6cd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400abccb
call fcn.1402711ec
mov qword [rbp + 0x250], r12
mov qword [rbp + 0x258], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x240], 0
mov qword [rbp + 8], r12
mov qword [rbp + 0x18], r12
mov qword [rbp + 0x20], r12
lea rsi, [rbp + 0x260]
mov rdi, qword [rbp + 0x260]
mov r15, qword [rbp + 0x278]
cmp r15, 0x10
cmovae rsi, rdi
movabs rax, 0x7fffffffffffffff
mov r14, qword [rbp + 0x270]
cmp r14, 0x10
jae 0x1400ab739
movups xmm0, xmmword [rsi]
movups xmmword [rbp + 8], xmm0
mov ebx, reloc.WS2_32.dll_ntohs
jmp 0x1400ab7a5
mov rbx, r14
or rbx, 0xf
cmp rbx, rax
cmova rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400ab783
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400abcd1
mov rcx, rax
call fcn.1402714fc
mov rcx, rax
test rax, rax
je 0x1400abcd7
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400ab792
test rcx, rcx
je 0x1400ab78f
call fcn.1402714fc
jmp 0x1400ab792
mov rax, r12
mov qword [rbp + 8], rax
lea r8, [r14 + 1]
mov rdx, rsi
mov rcx, rax
call fcn.1402756e0
mov qword [rbp + 0x18], r14
mov qword [rbp + 0x20], rbx
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x48]
call fcn.1400ad4b0
nop
lea rax, [rbp + 0xe8]
mov qword [rsp + 0x30], rax
lea rdx, [0x140521ed8]
lea rcx, [rbp + 0xe8]
call fcn.1400a20a0
mov r12, rax
lea rax, [rbp + 0x2e0]
mov qword [rbp - 0x20], rax
lea rdx, [r13 + 0x40]
lea rcx, [rbp + 0x2e0]
call fcn.1400a20a0
mov r13, rax
xor eax, eax
mov qword [rbp + 0x28], rax
mov qword [rbp + 0x38], rax
mov qword [rbp + 0x40], rax
mov rsi, qword [rbp + 0x58]
lea r14, [rbp + 0x48]
cmp qword [rbp + 0x60], 0x10
cmovae r14, qword [rbp + 0x48]
cmp rsi, 0x10
jae 0x1400ab82e
movups xmm0, xmmword [r14]
movups xmmword [rbp + 0x28], xmm0
lea ebx, [rax + 0xf]
jmp 0x1400ab89f
mov rbx, rsi
or rbx, 0xf
movabs rcx, 0x7fffffffffffffff
cmp rbx, rcx
cmova rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400ab882
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400abcdd
mov rcx, rax
call fcn.1402714fc
mov rcx, rax
test rax, rax
je 0x1400abce3
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400ab88c
test rcx, rcx
je 0x1400ab88c
call fcn.1402714fc
mov qword [rbp + 0x28], rax
lea r8, [rsi + 1]
mov rdx, r14
mov rcx, rax
call fcn.1402756e0
mov qword [rbp + 0x38], rsi
mov qword [rbp + 0x40], rbx
mov r9, r12
mov r8, r13
lea rdx, [rbp + 0x28]
lea rcx, [rbp + 0xc8]
call fcn.1400a9f10
mov rbx, rax
lea rax, [rbp + 0x48]
cmp rax, rbx
je 0x1400ab936
mov rdx, qword [rbp + 0x60]
cmp rdx, 0x10
jb 0x1400ab904
inc rdx
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ab8ff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400abce3
call fcn.1402711ec
xor esi, esi
mov qword [rbp + 0x58], rsi
mov qword [rbp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x48], sil
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x48], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x58], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
jmp 0x1400ab938
xor esi, esi
mov rdx, qword [rbp + 0xe0]
cmp rdx, 0x10
jb 0x1400ab979
inc rdx
mov rcx, qword [rbp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ab974
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400abce3
call fcn.1402711ec
mov qword [rbp - 0x78], rsi
lea r8, [rsp + 0x50]
lea rdx, [rbp + 0x48]
lea rcx, [rsp + 0x38]
call fcn.1400bd010
nop
lea rdx, str.success
lea rcx, [rsp + 0x38]
call fcn.1400bd170
cmp byte [rax], 4
jne 0x1400abce9
lea rcx, [rsp + 0x38]
cmp byte [rax + 8], 0
je 0x1400abaa7
lea rdx, str.sessionid
call fcn.1400bd170
mov rcx, qword [rsp + 0x48]
add rcx, 0xe8
mov rdx, rax
call fcn.1400c2580
nop
lea rcx, [rsp + 0x38]
call fcn.1400bba50
movzx edx, byte [rsp + 0x38]
lea rcx, [rsp + 0x40]
call fcn.1400bb490
nop
mov rdx, qword [rbp + 0x60]
cmp rdx, 0x10
jb 0x1400aba30
inc rdx
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400aba2b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400abd40
call fcn.1402711ec
mov qword [rbp + 0x58], rsi
mov qword [rbp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x48], 0
cmp r15, 0x10
jb 0x1400aba77
lea rdx, [r15 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400aba6f
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400abd46
mov rcx, rdi
call fcn.1402711ec
mov rcx, qword [rbp + 0x300]
xor rcx, rsp
call fcn.140270e60
lea r11, [rsp + 0x410]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea rdx, str.message
call fcn.1400bd170
mov rdi, rax
mov byte [rbp + 8], 3
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1402714fc
mov rbx, rax
mov qword [rax], rsi
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov r8d, 0xa
lea rdx, str.invalidver
mov rcx, rax
call fcn.1400a22c0
mov qword [rbp + 0x10], rbx
lea rcx, [rbp + 8]
call fcn.1400bba50
lea rcx, [rbp + 8]
call fcn.1400bba50
lea rdx, [rbp + 8]
mov rcx, rdi
call fcn.1400bee90
movzx ebx, al
lea rcx, [rbp + 8]
call fcn.1400bba50
mov dl, 3
lea rcx, [rbp + 0x10]
call fcn.1400bb490
nop
test bl, bl
jne 0x1400abb8c
lea rdx, [0x14036a4fc]
lea rcx, [0x140520200]
call fcn.1400bcda0
lea rdx, str.message
lea rcx, [rsp + 0x38]
call fcn.1400bd170
mov rdx, rax
lea rcx, [rbp + 0xe8]
call fcn.1400bd470
nop
mov rdx, rax
lea rcx, [0x140520200]
call fcn.1400bd4a0
nop
lea rcx, [rbp + 0xe8]
call fcn.1400a1fe0
mov ecx, 0x1194
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call fcn.140291278
int3
lea rdx, str.download
lea rcx, [rsp + 0x38]
call fcn.1400bd170
lea rdx, [rbp + 0xe8]
mov rcx, rax
call fcn.1400bd390
lea rcx, [rbp + 0xe8]
call fcn.1400ba250
mov r8, rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor ecx, ecx
call fcn.140291278
nop
movdqa xmm0, xmmword [0x14036e4f0]
movdqa xmmword [rbp + 0x110], xmm0
movdqa xmm1, xmmword [0x14036e490]
movdqa xmmword [rbp + 0x120], xmm1
movdqa xmm0, xmmword [0x14036e960]
movdqa xmmword [rbp + 0x130], xmm0
movdqa xmm1, xmmword [0x14036e9a0]
movdqa xmmword [rbp + 0x140], xmm1
mov dword [rbp + 0x150], 0xfff4d9b3
mov dword [rbp + 0x154], 0xeafab6f9
mov word [rbp + 0x158], 0xeb
mov byte [rbp + 0x15a], 1
lea rdx, [rbp + 0x110]
call fcn.1400abd50
mov ecx, 0x1194
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call fcn.140291278
nop
call fcn.140290dbc
nop
call fcn.140290dbc
nop
call fcn.140290dbc
nop
call fcn.140290dbc
nop
call fcn.140290dbc
nop
call fcn.140290dbc
nop
call fcn.140290dbc
nop
call fcn.140290dbc
nop
call fcn.140290dbc
nop
call fcn.140290dbc
nop
call fcn.140290dbc
nop
call fcn.140290dbc
nop
call fcn.140290dbc
nop
call fcn.140290dbc
nop
call fcn.140290dbc
nop
call fcn.140290dbc
nop
call fcn.140290dbc
nop
call fcn.140290dbc
int3
call fcn.1400955c0
int3
call fcn.140290dbc
nop
call fcn.1400955c0
int3
call fcn.140290dbc
nop
mov rcx, rax
call fcn.1400bb9c0
mov rdx, rax
lea rcx, [rbp + 0xe8]
call fcn.1400a2040
nop
mov r8, rax
lea rdx, str.type_must_be_boolean__but_is
lea rcx, [rbp + 0x2e0]
call fcn.1400bc8e0
nop
mov r8, rax
mov edx, 0x12e
lea rcx, [rbp + 0x110]
call fcn.1400a7840
lea rdx, [0x140398218]
lea rcx, [rbp + 0x110]
call fcn.140275604
nop
call fcn.140290dbc
nop
call fcn.140290dbc
int3