Function at 0x140056570
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Create thread
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x4b0]
sub rsp, 0x5b0
mov rax, qword [0x140239780]
xor rax, rsp
mov qword [rbp + 0x4a0], rax
mov rsi, rcx
xor r13d, r13d
mov dword [rsp + 0x40], r13d
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, [0x140059510]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp qword [rsi + 0x30], 0xa
jne 0x1400576f3
cmp qword [rsi + 0x50], 0x40
jne 0x1400576f3
xorps xmm0, xmm0
movups xmmword [rbp + 0x348], xmm0
xorps xmm1, xmm1
movups xmmword [rbp + 0x308], xmm1
mov ebx, r13d
mov qword [rbp + 0x318], rbx
mov edi, reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x320], rdi
mov byte [rbp + 0x308], bl
lea rcx, [rbp + 0x348]
call qword [sym.imp.RPCRT4.dll_UuidCreate]
mov qword [rbp + 0x260], r13
lea rdx, [rbp + 0x260]
lea rcx, [rbp + 0x348]
call qword [sym.imp.RPCRT4.dll_UuidToStringA]
test eax, eax
jne 0x140056682
mov rdx, qword [rbp + 0x260]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x140056651
lea rcx, [rbp + 0x308]
call fcn.140051da0
lea rcx, [rbp + 0x260]
call qword [sym.imp.RPCRT4.dll_RpcStringFreeA]
mov rdi, qword [rbp + 0x320]
mov rbx, qword [rbp + 0x318]
xorps xmm0, xmm0
movups xmmword [rbp + 0x2e8], xmm0
mov qword [rbp + 0x2f8], r13
mov qword [rbp + 0x300], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x2e8], 0
movups xmmword [rbp], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x10], xmm1
mov r8d, reloc.WS2_32.dll_recv
cmp rbx, r8
cmovb r8, rbx
lea rdx, [rbp + 0x308]
cmp rdi, 0x10
cmovae rdx, qword [rbp + 0x308]
lea rcx, [rbp]
call fcn.1400417f0
lea rdx, [rbp]
lea rcx, [rbp + 0x2e8]
call fcn.14004f170
lea rcx, [rbp]
call fcn.140042840
mov word [rsp + 0x40], 0x2d
mov byte [rsp + 0x42], 0
lea r9, [rbp + 0x268]
lea r8, [rsp + 0x41]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.14003d420
nop
lea r8, [rbp + 0x2e8]
cmp qword [rbp + 0x300], 0x10
cmovae r8, qword [rbp + 0x2e8]
mov r9, qword [rbp + 0x2f8]
xor edx, edx
lea rcx, [rsp + 0x48]
call fcn.140057a40
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x80], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r8, qword [rsp + 0x60]
cmp r8, 0x10
jb 0x140056791
inc r8
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x48]
call fcn.140042800
movdqa xmm0, xmmword [0x14021b0d0]
movdqu xmmword [rsp + 0x58], xmm0
mov byte [rsp + 0x48], 0
lea r15, [rsi + 0x40]
mov r8, r15
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x290]
call fcn.140046df0
lea rcx, [rsi + 0x258]
mov rdx, rax
call fcn.14004f170
lea rcx, [rbp + 0x290]
call fcn.140042840
nop
lea rcx, [rsp + 0x70]
call fcn.140042840
lea rcx, [rbp + 0x328]
call fcn.1400523e0
nop
call fcn.1400cacf0
mov rbx, rax
mov dword [rsp + 0x48], 0x78627b35
mov dword [rsp + 0x4c], 0x7e706a72
mov word [rsp + 0x50], 0x26
mov byte [rsp + 0x52], 1
mov rdx, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x140056820
mov rdx, qword [rsi]
xor r8d, r8d
mov rcx, rbx
call fcn.1400c9770
mov rdi, rax
mov dword [rbp - 0x60], 0x7b747a35
mov dword [rbp - 0x5c], 0x1002572
mov dword [rbp + 0x270], 0x757b7135
mov dword [rbp + 0x274], 0x27607d7c
mov word [rbp + 0x278], 0x100
mov dword [rbp - 0x58], 0x65747c35
mov dword [rbp - 0x54], 0x100257f
mov dword [rsp + 0x40], 0x64706235
mov word [rsp + 0x44], 0x2a
mov byte [rsp + 0x46], 1
mov dword [rsp + 0x70], 0x73656d67
mov dword [rsp + 0x74], 0x7377712a
mov word [rsp + 0x78], reloc.WS2_32.dll_WSAGetLastError
mov byte [rsp + 0x7a], 1
mov rcx, r13
nop word [rax + rax]
lea eax, [rcx + 0x13]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 5
jb 0x1400568a0
mov byte [rsp + 0x46], 0
lea r9, [rbp + 0x268]
lea r8, [rsp + 0x45]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x290]
call fcn.14003d420
nop
cmp byte [rsp + 0x7a], 0
je 0x1400568f5
mov rcx, r13
nop dword [rax]
lea eax, [rcx + 0x13]
xor byte [rsp + rcx + 0x70], al
inc rcx
cmp rcx, 9
jb 0x1400568e0
mov byte [rsp + 0x7a], 0
lea r9, [rbp + 0x268]
lea r8, [rsp + 0x79]
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x20]
call fcn.14003d420
nop
lea r9, [rbp + 0x290]
lea r8, [rbp + 0x20]
movzx edx, byte [rbp + 0x268]
lea rcx, [rbp]
call fcn.14004e460
nop
lea rcx, [rbp + 0x20]
call fcn.140042840
nop
lea rcx, [rbp + 0x290]
call fcn.140042840
nop
lea r8, [rsi + 0x60]
lea rdx, [rbp]
lea rcx, [rbp - 0x50]
call fcn.140046df0
nop
lea r8, [rbp - 0x58]
mov rdx, rax
lea rcx, [rbp + 0x100]
call fcn.140047030
nop
lea rdx, [rbp + 0x328]
cmp qword [rbp + 0x340], 0x10
cmovae rdx, qword [rbp + 0x328]
mov r8, qword [rbp + 0x338]
mov rcx, rax
call fcn.140040930
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x70], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rbp + 0x270]
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x80]
call fcn.140047110
nop
lea rdx, [rbp + 0x2e8]
cmp qword [rbp + 0x300], 0x10
cmovae rdx, qword [rbp + 0x2e8]
mov r8, qword [rbp + 0x2f8]
mov rcx, rax
call fcn.140040930
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xa0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xb0], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r14d, 0x3ff0000
lea r8, [rbp - 0x60]
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0xc0]
call fcn.140047030
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rbp + 0xe0]
call fcn.140046e60
nop
lea r8, [rsp + 0x48]
mov rdx, rax
lea rcx, [rbp + 0x40]
call fcn.1400471f0
nop
lea r8, [rsi + 0x20]
mov rdx, rax
lea rcx, [rbp + 0x378]
call fcn.140046df0
nop
lea rcx, [rbp + 0x40]
call fcn.140042840
nop
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0x10
jb 0x140056ab1
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140056aac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005775a
call fcn.14013d010
movdqa xmm0, xmmword [0x14021b0d0]
movdqu xmmword [rbp + 0xf0], xmm0
mov byte [rbp + 0xe0], 0
mov rdx, qword [rbp + 0xd8]
cmp rdx, 0x10
jb 0x140056b09
inc rdx
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140056b04
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140057760
call fcn.14013d010
movdqa xmm0, xmmword [0x14021b0d0]
movdqu xmmword [rbp + 0xd0], xmm0
mov byte [rbp + 0xc0], 0
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0x10
jb 0x140056b62
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140056b5c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140057766
call fcn.14013d010
nop
mov rdx, qword [rbp + 0x98]
cmp rdx, 0x10
jb 0x140056ba3
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140056b9e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005776c
call fcn.14013d010
movdqa xmm0, xmmword [0x14021b0d0]
movdqu xmmword [rbp + 0x90], xmm0
mov byte [rbp + 0x80], 0
mov rdx, qword [rbp + 0x78]
cmp rdx, 0x10
jb 0x140056bf6
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140056bf0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140057772
call fcn.14013d010
nop
mov rdx, qword [rbp + 0x118]
cmp rdx, 0x10
jb 0x140056c37
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140056c32
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140057778
call fcn.14013d010
movdqa xmm0, xmmword [0x14021b0d0]
movdqu xmmword [rbp + 0x110], xmm0
mov byte [rbp + 0x100], 0
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140056c89
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140056c84
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005777e
call fcn.14013d010
movdqa xmm0, xmmword [0x14021b0d0]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x10
jb 0x140056cd5
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140056cd0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140057784
call fcn.14013d010
movdqa xmm0, xmmword [0x14021b0d0]
movdqu xmmword [rbp + 0x10], xmm0
mov byte [rbp], 0
mov rcx, rbx
call fcn.1400cacc0
lea rax, [rbp + 0x290]
mov qword [rbp - 0x70], rax
lea rdx, [rsi + 0x80]
lea rcx, [rbp + 0x290]
call fcn.1400426e0
mov rbx, rax
lea rdx, [rbp + 0x378]
lea rcx, [rbp + 0x20]
call fcn.1400426e0
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x2c8]
call fcn.14005a900
nop
movdqa xmm0, xmmword [str.XqlWblqERrk]
movdqu xmmword [rsp + 0x48], xmm0
mov byte [rsp + 0x58], 1
cmp qword [rbp + 0x2d8], 0x10
jne 0x140056dde
mov rcx, r13
nop word [rax + rax]
lea eax, [rcx + 0x13]
xor byte [rsp + rcx + 0x48], al
inc rcx
cmp rcx, 0xf
jb 0x140056d60
mov byte [rsp + 0x58], 0
lea r9, [rbp + 0x268]
lea r8, [rsp + 0x57]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x70]
call fcn.14003d420
mov r14d, 0x3ffc000
lea rdx, [rsp + 0x70]
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rbp - 0x78]
cmp rdi, 0x10
cmovae rdx, rbx
lea rcx, [rbp + 0x2c8]
cmp qword [rbp + 0x2e0], 0x10
cmovae rcx, qword [rbp + 0x2c8]
mov r8, qword [rbp + 0x2d8]
cmp r8, qword [rbp - 0x80]
jne 0x140056de7
call fcn.14017e860
test eax, eax
jne 0x140056de7
mov r12b, 1
jmp 0x140056dea
mov rdi, qword [rbp - 0x78]
mov rbx, qword [rsp + 0x70]
xor r12b, r12b
bt r14d, 0xe
jae 0x140056e2d
btr r14d, 0xe
cmp rdi, 0x10
jb 0x140056e2d
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140056e25
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005778a
mov rcx, rbx
call fcn.14013d010
test r12b, r12b
jne 0x140057790
mov qword [rbp - 0x18], r13
mov byte [rsp + 0x20], r12b
mov r9b, 1
lea r8, [rbp - 0x50]
lea rdx, [rbp + 0x2c8]
lea rcx, [rbp + 0x280]
call fcn.14004bcd0
nop
mov dword [rsp + 0x30], 0x6566717e
mov dword [rsp + 0x34], 0x7c7f76
mov byte [rsp + 0x38], 1
lea rdx, [rbp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.14004fba0
mov rdx, rax
lea rcx, [rbp + 0x280]
call fcn.14004f910
lea rdx, [rbp + 0x358]
mov rcx, rax
call fcn.140046cc0
nop
xor edx, edx
mov r8d, 0xf8
lea rcx, [rbp + 0x3a0]
call fcn.14017f000
mov edx, 1
lea rcx, [rbp + 0x3a0]
call fcn.14004e610
nop
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x2b0], xmm1
mov qword [rbp + 0x2c0], r13
mov ecx, 0x20
call fcn.14013d614
mov qword [rbp + 0x2b0], rax
lea rcx, [rax + 0x20]
mov qword [rbp + 0x2c0], rcx
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
mov qword [rbp + 0x2b8], rcx
mov qword [rbp - 0x60], r13
lea rcx, [rbp - 0x60]
call fcn.14004eab0
nop
mov rax, qword [rbp + 0x2b8]
mov rcx, qword [rbp + 0x2b0]
sub rax, rcx
lea r8, [rbp + 0x2c8]
cmp qword [rbp + 0x2e0], 0x10
cmovae r8, qword [rbp + 0x2c8]
cmp qword [r15 + 0x18], 0x10
jb 0x140056f41
mov r15, qword [r15]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov r9, qword [rbp + 0x2d8]
mov rdx, qword [rsi + 0x50]
mov rcx, r15
call fcn.14005e0c0
mov r15, qword [rbp + 0x2b8]
mov rdi, qword [rbp + 0x2b0]
cmp rdi, r15
je 0x140056ffc
nop word [rax + rax]
movzx ebx, byte [rdi]
mov rax, qword [rbp + 0x3b0]
movsxd rcx, dword [rax + 4]
mov eax, dword [rbp + rcx + 0x3c8]
and eax, 0xfffff9ff
bts eax, 0xb
mov dword [rbp + rcx + 0x3c8], eax
mov rax, qword [rbp + 0x3b0]
movsxd rcx, dword [rax + 4]
mov byte [rbp + rcx + 0x408], 0x30
mov edx, 2
lea rcx, [rsp + 0x48]
call fcn.14013cbcc
mov r8, qword [rax]
mov rcx, qword [rbp + 0x3b0]
movsxd rdx, dword [rcx + 4]
lea rcx, [rbp + 0x3b0]
add rcx, rdx
mov rdx, qword [rax + 8]
call r8
mov edx, ebx
lea rcx, [rbp + 0x3b0]
call fcn.14004f200
inc rdi
cmp rdi, r15
jne 0x140056f80
lea r15, [section..data]
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae r15, qword [section..data]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x14021b0d0]
movdqu xmmword [rbp - 0x80], xmm1
mov byte [rsp + 0x70], 0
or r14d, 2
mov dword [rsp + 0x40], r14d
xor eax, eax
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rax
mov rcx, qword [rbp + 0x428]
mov eax, ecx
and al, 0x22
cmp al, 2
je 0x14005707e
mov rax, qword [rbp + 0x3f8]
mov r8, qword [rax]
test r8, r8
je 0x14005707e
mov rax, qword [rbp + 0x3d8]
mov rdx, qword [rax]
cmp r8, qword [rbp + 0x420]
cmovb r8, qword [rbp + 0x420]
sub r8, rdx
jmp 0x1400570b8
test cl, 4
jne 0x1400570ae
mov rax, qword [rbp + 0x3f0]
mov rcx, qword [rax]
test rcx, rcx
je 0x1400570ae
mov rax, qword [rbp + 0x3d0]
mov rdx, qword [rax]
mov rax, qword [rbp + 0x408]
movsxd r8, dword [rax]
add r8, rcx
sub r8, rdx
jmp 0x1400570b8
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x1400570c8
lea rcx, [rsp + 0x70]
call fcn.140051da0
nop
lea rcx, [rsp + 0x70]
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rbp - 0x78]
cmp rdi, 0x10
cmovae rcx, rbx
mov r8d, 8
mov rdx, r15
call fcn.140052840
movzx r14d, al
cmp rdi, 0x10
jb 0x140057127
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14005711f
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400577f4
mov rcx, rbx
call fcn.14013d010
test r14b, r14b
jne 0x14005714b
lea r8, [rbp + 0x358]
lea rdx, str.Signature_checksum_failed._Request_was_tampered_with_or_session_ended_most_likely.__echo:__echo_Message:
lea rcx, [rbp + 0x40]
call fcn.140046ed0
mov rcx, rax
call fcn.140055240
lea rdx, [rbp + 0x280]
lea rcx, [rsp + 0x48]
call fcn.14004dfc0
mov rdx, rax
mov rcx, rsi
call fcn.140057e50
mov dword [rsp + 0x30], 0x75766160
mov dword [rsp + 0x34], 0x6a6b72
mov byte [rsp + 0x38], 1
mov rcx, r13
nop
lea eax, [rcx + 0x13]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 7
jb 0x140057180
mov byte [rsp + 0x38], 0
lea r9, [rbp + 0x268]
lea r8, [rsp + 0x37]
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x290]
call fcn.14003d420
lea rdx, [rbp + 0x290]
lea rcx, [rbp + 0x280]
call fcn.14004f910
mov rcx, rax
call fcn.140046d80
test al, al
je 0x1400575c2
mov dword [rsp + 0x48], 0x4562717d
mov dword [rsp + 0x4c], 0x736a6b72
mov dword [rsp + 0x50], 0x1007274
mov rcx, r13
lea eax, [rcx + 0x13]
xor byte [rsp + rcx + 0x48], al
inc rcx
cmp rcx, 0xa
jb 0x1400571f0
mov byte [rsp + 0x53], 0
lea r9, [rbp + 0x268]
lea r8, [rsp + 0x52]
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x20]
call fcn.14003d420
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x280]
call fcn.14004f910
mov rcx, rax
call fcn.140046d80
test al, al
je 0x140057246
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0x70], 0x65667160
mov dword [rsp + 0x74], 0x7377777e
mov word [rsp + 0x78], 0x7f
mov byte [rsp + 0x7a], 1
mov rcx, r13
nop word [rax + rax]
lea eax, [rcx + 0x13]
xor byte [rsp + rcx + 0x70], al
inc rcx
cmp rcx, 9
jb 0x140057270
mov byte [rsp + 0x7a], 0
lea r9, [rbp + 0x268]
lea r8, [rsp + 0x79]
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x290]
call fcn.14003d420
lea rdx, [rbp + 0x290]
lea rcx, [rbp + 0x280]
call fcn.14004f910
mov rdx, rax
lea rcx, [rsi + 0x238]
call fcn.140046b60
mov byte [0x14023be88], 1
mov dword [rsp + 0x30], 0x7f656472
mov dword [rsp + 0x34], 0x767e79
mov byte [rsp + 0x38], 1
mov rcx, r13
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x13]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 7
jb 0x1400572f0
mov byte [rsp + 0x38], 0
lea r9, [rbp + 0x268]
lea r8, [rsp + 0x37]
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x290]
call fcn.14003d420
lea rdx, [rbp + 0x290]
lea rcx, [rbp + 0x280]
call fcn.14004f910
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.14004dfc0
mov rdx, rax
mov rcx, rsi
call fcn.140057cc0
nop
mov rcx, qword [rbp + 0x2b0]
test rcx, rcx
je 0x1400573a0
mov rdx, qword [rbp + 0x2c0]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140057389
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400577fa
call fcn.14013d010
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x2b0], xmm0
mov qword [rbp + 0x2c0], r13
lea rcx, [rbp + 0x3a0]
call fcn.14004fd90
nop
mov rdx, qword [rbp + 0x370]
cmp rdx, 0x10
jb 0x1400573ee
inc rdx
mov rcx, qword [rbp + 0x358]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400573e9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140057a20
call fcn.14013d010
movdqa xmm0, xmmword [0x14021b0d0]
movdqu xmmword [rbp + 0x368], xmm0
mov byte [rbp + 0x358], 0
movzx edx, byte [rbp + 0x280]
lea rcx, [rbp + 0x288]
call fcn.140052a20
nop
mov rdx, qword [rbp + 0x2e0]
cmp rdx, 0x10
jb 0x14005745a
inc rdx
mov rcx, qword [rbp + 0x2c8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140057455
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140057a26
call fcn.14013d010
mov qword [rbp + 0x2d8], r13
mov qword [rbp + 0x2e0], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x2c8], 0
mov rdx, qword [rbp + 0x390]
cmp rdx, 0x10
jb 0x1400574b5
inc rdx
mov rcx, qword [rbp + 0x378]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400574af
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140057a2c
call fcn.14013d010
nop
mov rdx, qword [rbp + 0x340]
cmp rdx, 0x10
jb 0x1400574f6
inc rdx
mov rcx, qword [rbp + 0x328]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400574f1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140057a32
call fcn.14013d010
mov qword [rbp + 0x338], r13
mov qword [rbp + 0x340], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x328], 0
mov rdx, qword [rbp + 0x300]
cmp rdx, 0x10
jb 0x140057551
inc rdx
mov rcx, qword [rbp + 0x2e8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005754b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140057a38
call fcn.14013d010
nop
mov rdx, qword [rbp + 0x320]
cmp rdx, 0x10
jb 0x140057592
inc rdx
mov rcx, qword [rbp + 0x308]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005758d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400576ed
call fcn.14013d010
mov rcx, qword [rbp + 0x4a0]
xor rcx, rsp
call fcn.14013cff0
lea r11, [rsp + 0x5b0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov dword [rsp + 0x48], 0x77637a7a
mov dword [rsp + 0x4c], 0x6c7d717b
mov dword [rsp + 0x50], 0x1006e7e
mov byte [rsp + 0x70], 0
xor eax, eax
mov qword [rsp + 0x78], rax
xor edx, edx
lea rcx, [rsp + 0x78]
call fcn.140052a20
mov byte [rsp + 0x70], 3
xorps xmm0, xmm0
movups xmmword [rbp + 0x270], xmm0
mov ecx, 0x20
call fcn.14013d614
mov rbx, rax
lea rax, [rbp + 0x268]
mov qword [rbp + 0x270], rax
mov qword [rbp + 0x278], rbx
cmp byte [rsp + 0x53], 0
je 0x140057645
mov rdx, r13
nop dword [rax]
lea ecx, [rdx + 0x13]
xor byte [rsp + rdx + 0x48], cl
inc rdx
cmp rdx, 0xa
jb 0x140057630
mov byte [rsp + 0x53], 0
lea r9, [rsp + 0x68]
lea r8, [rsp + 0x52]
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.14003d420
nop
mov qword [rsp + 0x78], rbx
mov dword [rbp - 0x70], 0x6566717e
mov dword [rbp - 0x6c], 0x7c7f76
mov byte [rbp - 0x68], 1
mov rcx, r13
nop word [rax + rax]
lea eax, [rcx + 0x13]
xor byte [rbp + rcx - 0x70], al
inc rcx
cmp rcx, 7
jb 0x140057680
mov byte [rbp - 0x68], 0
lea r9, [rsp + 0x68]
lea r8, [rbp - 0x69]
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x290]
call fcn.14003d420
lea rdx, [rbp + 0x290]
lea rcx, [rbp + 0x280]
call fcn.14004f910
mov rcx, rax
lea rdx, [rsp + 0x70]
call fcn.14004f540
movzx ebx, al
movzx edx, byte [rsp + 0x70]
lea rcx, [rsp + 0x78]
call fcn.140052a20
nop
test bl, bl
jne 0x140057800
jmp 0x14005734e
call fcn.14014edc4
int3
movdqa xmm0, xmmword [str.Rdezxnrss_QOU]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [str.pAQSW_bjEYHM_H]
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmm0, xmmword [0x140185330]
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmm1, xmmword [0x140185340]
movdqa xmmword [rbp - 0x20], xmm1
mov dword [rbp - 0x10], 0x357b3a3a
mov dword [rbp - 0xc], 0x1002827
lea rcx, [rbp - 0x50]
call fcn.140052100
mov rdx, rax
mov r9d, reloc.WS2_32.dll_recv
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call fcn.14014fae0
nop
call fcn.14014edc4
nop
call fcn.14014edc4
nop
call fcn.14014edc4
nop
call fcn.14014edc4
nop
call fcn.14014edc4
nop
call fcn.14014edc4
nop
call fcn.14014edc4
nop
call fcn.14014edc4
nop
call fcn.14014edc4
int3
movdqa xmm0, xmmword [str.Rdezxnrss_qOU]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [0x1401853b0]
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmm0, xmmword [0x140185300]
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmm1, xmmword [0x140185350]
movdqa xmmword [rbp - 0x20], xmm1
mov dword [rbp - 0x10], 0x7b3021
mov byte [rbp - 0xc], 1
lea rcx, [rbp - 0x50]
call fcn.1400520d0
mov rdx, rax
mov r9d, reloc.WS2_32.dll_recv
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call fcn.14014fae0
nop
call fcn.14014edc4
nop
call fcn.14014edc4
nop
mov dword [rbp + 0x270], 0x78627b77
mov dword [rbp + 0x274], 0x7e78777b
mov word [rbp + 0x278], 0x100
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x270]
call fcn.14004fbe0
mov rdx, rax
lea rcx, [rbp + 0x280]
call fcn.14004f910
lea rdx, [rbp + 0x290]
mov rcx, rax
call fcn.140046cc0
lea rdx, [0x140219e0c]
lea rcx, [rbp + 0x290]
call fcn.140042560
test al, al
je 0x1400579d2
movdqa xmm0, xmmword [0x140185370]
movdqa xmmword [rbp + 0x120], xmm0
movdqa xmm1, xmmword [0x140185390]
movdqa xmmword [rbp + 0x130], xmm1
movdqa xmm0, xmmword [0x1401853d0]
movdqa xmmword [rbp + 0x140], xmm0
movdqa xmm1, xmmword [0x140185310]
movdqa xmmword [rbp + 0x150], xmm1
movdqa xmm0, xmmword [str._1u28_76493_t]
movdqa xmmword [rbp + 0x160], xmm0
movdqa xmm1, xmmword [str.C_v_vF]
movdqa xmmword [rbp + 0x170], xmm1
movdqa xmm0, xmmword [0x140185430]
movdqa xmmword [rbp + 0x180], xmm0
movdqa xmm1, xmmword [0x140185480]
movdqa xmmword [rbp + 0x190], xmm1
movdqa xmm0, xmmword [0x140185460]
movdqa xmmword [rbp + 0x1a0], xmm0
movdqa xmm1, xmmword [0x140185470]
movdqa xmmword [rbp + 0x1b0], xmm1
movdqa xmm0, xmmword [0x140185440]
movdqa xmmword [rbp + 0x1c0], xmm0
movdqa xmm1, xmmword [0x140185450]
movdqa xmmword [rbp + 0x1d0], xmm1
movdqa xmm0, xmmword [0x140185420]
movdqa xmmword [rbp + 0x1e0], xmm0
movdqa xmm1, xmmword [0x140185410]
movdqa xmmword [rbp + 0x1f0], xmm1
movdqa xmm0, xmmword [0x1401853e0]
movdqa xmmword [rbp + 0x200], xmm0
movdqa xmm1, xmmword [0x1401853f0]
movdqa xmmword [rbp + 0x210], xmm1
movdqa xmm0, xmmword [0x140185360]
movdqa xmmword [rbp + 0x220], xmm0
movdqa xmm1, xmmword [0x140185380]
movdqa xmmword [rbp + 0x230], xmm1
movdqa xmm0, xmmword [0x140185320]
movdqa xmmword [rbp + 0x240], xmm0
mov dword [rbp + 0x250], 0x3f293020
mov word [rbp + 0x254], WSAGetLastError
mov byte [rbp + 0x256], 1
lea rcx, [rbp + 0x120]
call fcn.1400520a0
mov rdx, rax
mov r9d, reloc.WS2_32.dll_recv
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x140057a18
lea rcx, [rbp + 0x290]
call fcn.140041610
mov rbx, rax
mov dword [rsp + 0x40], 0x7870647c
mov word [rsp + 0x44], 0x100
lea rcx, [rsp + 0x40]
call fcn.140052070
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor ecx, ecx
call fcn.14014fae0
nop
call fcn.14014edc4
nop
call fcn.14014edc4
nop
call fcn.14014edc4
nop
call fcn.14014edc4
nop
call fcn.14014edc4
int3