Function at 0x1400251d0
Capabilities:
Authenticate hmac
Check mutex and terminate process on windows
Check mutex on windows
Contain obfuscated stackstrings
Encode data using xor
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0xbe0
mov rax, qword [0x140158418]
xor rax, rsp
mov qword [rsp + 0xbd8], rax
xor r15d, r15d
mov cl, 0x48
mov dword [rsp + 0x188], 0x21260148
mov dword [rsp + 0x18c], 0x2429213c
mov dword [rsp + 0x190], 0x26213221
mov word [rsp + 0x194], Ordinal_50
mov eax, r15d
nop word [rax + rax]
xor byte [rsp + rax + 0x189], cl
inc rax
cmp rax, 0xc
jae 0x14002525a
movzx ecx, byte [rsp + 0x188]
jmp 0x140025240
mov byte [rsp + 0x195], r15b
xorps xmm0, xmm0
movups xmmword [rsp + 0x520], xmm0
mov qword [rsp + 0x530], r15
mov qword [rsp + 0x538], r15
lea rax, [rsp + 0x189]
mov r12, 0xffffffffffffffff
mov r8, r12
nop
inc r8
cmp byte [rax + r8], r15b
jne 0x140025290
lea rdx, [rsp + 0x189]
lea rcx, [rsp + 0x520]
call fcn.140004160
xor edx, edx
lea rcx, [rsp + 0x520]
call fcn.14002adc0
mov dl, 1
lea rcx, [rsp + 0x5e0]
call fcn.14001e3b0
nop
xor edx, edx
lea r8d, [rdx + 0x10]
mov rcx, rax
call fcn.140035190
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
nop
mov rdx, qword [rsp + 0x5f8]
cmp rdx, 0x10
jb 0x140025327
inc rdx
mov rcx, qword [rsp + 0x5e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140025322
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400253a6
call fcn.1400e9774
movdqa xmm0, xmmword [0x14012dbf0]
movdqu xmmword [rsp + 0x5f0], xmm0
mov byte [rsp + 0x5e0], 0
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edx, eax
lea rcx, [rsp + 0x600]
call fcn.140035dc0
cmp qword [rax + 0x18], 0x10
jb 0x14002535f
mov rax, qword [rax]
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rdx, qword [rsp + 0x618]
cmp rdx, 0x10
jb 0x1400253b2
inc rdx
mov rcx, qword [rsp + 0x600]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400253ad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400253ad
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e9774
movdqa xmm0, xmmword [0x14012dbf0]
movdqu xmmword [rsp + 0x610], xmm0
mov byte [rsp + 0x600], 0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140025550
movdqa xmm1, xmmword [0x14012e6f0]
movdqu xmmword [rsp + 0x158], xmm1
mov cl, 0x7c
mov dl, 0x78
mov r8b, 0x7d
mov r10b, 0x60
mov r11b, reloc.WS2_32.dll_gethostname
mov bl, 0x6b
mov dil, 0x6c
mov sil, 0x77
movzx r14d, sil
mov r15b, reloc.WS2_32.dll_WSASetLastError
movzx r12d, sil
mov r13b, 0x7e
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd r9d, xmm1
xor al, r9b
mov byte [rsp + 0x159], al
xor byte [rsp + 0x15a], r9b
xor byte [rsp + 0x15b], r9b
xor byte [rsp + 0x15c], r9b
xor byte [rsp + 0x15d], r9b
xor byte [rsp + 0x15e], r9b
xor byte [rsp + 0x15f], r9b
xor byte [rsp + 0x160], r9b
xor byte [rsp + 0x161], r9b
xor byte [rsp + 0x162], r9b
xor byte [rsp + 0x163], r9b
xor byte [rsp + 0x164], r9b
xor byte [rsp + 0x165], r9b
xor byte [rsp + 0x166], r9b
xor byte [rsp + 0x167], r9b
xor cl, r9b
mov byte [rsp + 0x168], cl
xor dl, r9b
mov byte [rsp + 0x169], dl
xor r8b, r9b
mov byte [rsp + 0x16a], r8b
xor r10b, r9b
mov byte [rsp + 0x16b], r10b
xor r11b, r9b
mov byte [rsp + 0x16c], r11b
xor bl, r9b
mov byte [rsp + 0x16d], bl
xor dil, r9b
mov byte [rsp + 0x16e], dil
xor sil, r9b
mov byte [rsp + 0x16f], sil
xor r14b, r9b
mov byte [rsp + 0x170], r14b
xor r15b, r9b
mov byte [rsp + 0x171], r15b
xor r12b, r9b
mov byte [rsp + 0x172], r12b
xor r13b, r9b
mov byte [rsp + 0x173], r13b
mov byte [rsp + 0x174], 0
lea rdx, [rsp + 0x159]
lea rcx, [rsp + 0x770]
call fcn.14000d120
mov edx, 2
mov rcx, rax
call fcn.14002adc0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
movdqa xmm0, xmmword [0x14012e1e0]
movdqu xmmword [rsp + 0x2e0], xmm0
mov dword [rsp + 0x2f0], 0x3436303a
mov dword [rsp + 0x2f4], 0x373f3871
mov word [rsp + 0x2f8], 0x3e
mov rcx, r15
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rsp + 0x2e0]
xor byte [rsp + rcx + 0x2e1], al
inc rcx
cmp rcx, 0x18
jb 0x140025590
mov byte [rsp + 0x2f9], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x540], xmm0
mov qword [rsp + 0x550], r15
mov qword [rsp + 0x558], r15
lea rax, [rsp + 0x2e1]
mov r8, r12
inc r8
cmp byte [rax + r8], 0
jne 0x1400255d6
lea rdx, [rsp + 0x2e1]
lea rcx, [rsp + 0x540]
call fcn.140004160
xor edx, edx
lea rcx, [rsp + 0x540]
call fcn.14002adc0
movdqa xmm0, xmmword [0x14012e040]
movdqa xmmword [rsp + 0x4b0], xmm0
movdqa xmm1, xmmword [0x14012def0]
movdqa xmmword [rsp + 0x4c0], xmm1
movdqa xmm0, xmmword [0x14012e000]
movdqa xmmword [rsp + 0x4d0], xmm0
movdqa xmm1, xmmword [0x14012e0c0]
movdqa xmmword [rsp + 0x4e0], xmm1
movdqa xmm0, xmmword [0x14012df00]
movdqa xmmword [rsp + 0x4f0], xmm0
movdqa xmm1, xmmword [str._aS6_v]
movdqa xmmword [rsp + 0x500], xmm1
mov dword [rsp + 0x510], 0x1625530a
mov dword [rsp + 0x514], 0x1c1a0001
mov word [rsp + 0x518], 0x511d
xor eax, eax
mov byte [rsp + 0x51a], al
mov rcx, r15
nop word [rax + rax]
movzx eax, byte [rsp + 0x4b0]
xor byte [rsp + rcx + 0x4b1], al
inc rcx
cmp rcx, 0x69
jb 0x1400256a0
mov byte [rsp + 0x51a], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x490], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x4a0], xmm1
lea rax, [rsp + 0x4b1]
mov r8, r12
inc r8
cmp byte [rax + r8], 0
jne 0x1400256e2
lea rdx, [rsp + 0x4b1]
lea rcx, [rsp + 0x490]
call fcn.140004160
nop
lea rdx, [rsp + 0x490]
lea rcx, [rsp + 0xb10]
call fcn.140015df0
nop
mov rdx, qword [rsp + 0x4a8]
cmp rdx, 0x10
jb 0x14002575e
inc rdx
mov rcx, qword [rsp + 0x490]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140025759
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140025759
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e9774
movdqa xmm0, xmmword [0x14012dbf0]
movdqu xmmword [rsp + 0x4a0], xmm0
mov byte [rsp + 0x490], 0
movdqa xmm0, xmmword [0x14012e840]
movdqa xmmword [rsp + 0x640], xmm0
movdqa xmm1, xmmword [0x14012e750]
movdqa xmmword [rsp + 0x650], xmm1
movdqa xmm0, xmmword [0x14012e7f0]
movdqa xmmword [rsp + 0x660], xmm0
movdqa xmm1, xmmword [0x14012e310]
movdqa xmmword [rsp + 0x670], xmm1
movdqa xmm0, xmmword [0x14012e770]
movdqa xmmword [rsp + 0x680], xmm0
movdqa xmm1, xmmword [0x14012e670]
movdqa xmmword [rsp + 0x690], xmm1
movdqa xmm0, xmmword [str.k2S_qzfwqfg_w0]
movdqa xmmword [rsp + 0x6a0], xmm0
mov rcx, r15
movzx eax, byte [rsp + 0x640]
xor byte [rsp + rcx + 0x641], al
movzx eax, byte [rsp + 0x640]
xor byte [rsp + rcx + 0x642], al
add rcx, 2
cmp rcx, 0x6e
jb 0x1400257f1
mov byte [rsp + 0x6af], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x450], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x460], xmm1
lea rax, [rsp + 0x641]
mov r8, r12
inc r8
cmp byte [rax + r8], 0
jne 0x140025843
lea rdx, [rsp + 0x641]
lea rcx, [rsp + 0x450]
call fcn.140004160
nop
lea rdx, [rsp + 0x450]
lea rcx, [rsp + 0xae0]
call fcn.140015df0
nop
mov rdx, qword [rsp + 0x468]
cmp rdx, 0x10
jb 0x1400258bf
inc rdx
mov rcx, qword [rsp + 0x450]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400258ba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400258ba
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e9774
movdqa xmm0, xmmword [0x14012dbf0]
movdqu xmmword [rsp + 0x460], xmm0
mov byte [rsp + 0x450], 0
mov byte [rsp + 0x150], Ordinal_60
mov al, 0x63
mov cl, reloc.WS2_32.dll_listen
mov dl, reloc.WS2_32.dll_ntohs
xor r8d, r8d
xor al, 0x3b
mov byte [rsp + 0x151], al
xor cl, 0x3b
mov byte [rsp + 0x152], cl
xor dl, 0x3b
mov byte [rsp + 0x153], dl
mov byte [rsp + 0x154], r8b
lea rcx, [rsp + 0x151]
mov rax, r12
nop dword [rax]
inc rax
cmp byte [rcx + rax], r8b
jne 0x140025920
lea rcx, [rsp + 0xae0]
cmp qword [rsp + 0xaf8], 0x10
cmovae rcx, qword [rsp + 0xae0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x151]
mov rdx, qword [rsp + 0xaf0]
call fcn.140006660
cmp rax, 0xffffffffffffffff
jne 0x140025dcf
mov byte [rsp + 0x198], reloc.WS2_32.dll_WSASetLastError
mov al, Ordinal_41
mov cl, 0x48
mov dl, 0x46
xor r8d, r8d
xor al, 0x70
mov byte [rsp + 0x199], al
xor cl, 0x70
mov byte [rsp + 0x19a], cl
xor dl, 0x70
mov byte [rsp + 0x19b], dl
mov byte [rsp + 0x19c], r8b
lea rdx, [rsp + 0x199]
lea rcx, [rsp + 0xae0]
call fcn.14001c130
cmp rax, 0xffffffffffffffff
je 0x140025b63
movdqa xmm1, xmmword [0x14012e440]
movdqu xmmword [rsp + 0xf0], xmm1
movdqa xmm2, xmmword [0x14012e550]
movdqu xmmword [rsp + 0x100], xmm2
mov dl, Ordinal_26
mov r8b, reloc.WS2_32.dll_socket
mov r9b, 1
mov r10b, 9
mov r11b, 0x58
mov bl, 0x44
mov dil, 0x55
mov sil, 8
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0xf1], al
xor byte [rsp + 0xf2], cl
xor byte [rsp + 0xf3], cl
xor byte [rsp + 0xf4], cl
xor byte [rsp + 0xf5], cl
xor byte [rsp + 0xf6], cl
xor byte [rsp + 0xf7], cl
xor byte [rsp + 0xf8], cl
xor byte [rsp + 0xf9], cl
xor byte [rsp + 0xfa], cl
xor byte [rsp + 0xfb], cl
xor byte [rsp + 0xfc], cl
xor byte [rsp + 0xfd], cl
xor byte [rsp + 0xfe], cl
xor byte [rsp + 0xff], cl
movd eax, xmm2
xor al, cl
mov byte [rsp + 0x100], al
xor byte [rsp + 0x101], cl
xor byte [rsp + 0x102], cl
xor byte [rsp + 0x103], cl
xor byte [rsp + 0x104], cl
xor byte [rsp + 0x105], cl
xor byte [rsp + 0x106], cl
xor byte [rsp + 0x107], cl
xor byte [rsp + 0x108], cl
xor byte [rsp + 0x109], cl
xor byte [rsp + 0x10a], cl
xor byte [rsp + 0x10b], cl
xor byte [rsp + 0x10c], cl
xor byte [rsp + 0x10d], cl
xor byte [rsp + 0x10e], cl
xor byte [rsp + 0x10f], cl
xor dl, cl
mov byte [rsp + 0x110], dl
xor r8b, cl
mov byte [rsp + 0x111], r8b
xor r9b, cl
mov byte [rsp + 0x112], r9b
xor r10b, cl
mov byte [rsp + 0x113], r10b
xor r11b, cl
mov byte [rsp + 0x114], r11b
xor bl, cl
mov byte [rsp + 0x115], bl
xor dil, cl
mov byte [rsp + 0x116], dil
xor sil, cl
mov byte [rsp + 0x117], sil
mov byte [rsp + 0x118], 0
lea rdx, [0x140007e50]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [rsp + 0xf1]
jmp 0x140025d9c
movdqa xmm1, xmmword [0x14012df40]
movdqu xmmword [rsp + 0xb0], xmm1
movdqa xmm2, xmmword [0x14012dff0]
movdqu xmmword [rsp + 0xc0], xmm2
movdqa xmm3, xmmword [str._tS_4]
movdqu xmmword [rsp + 0xd0], xmm3
mov dl, reloc.WS2_32.dll_send
mov r8b, recv
mov r9b, 9
mov r10b, Ordinal_30
mov r11b, reloc.WS2_32.dll_recvfrom
movzx ebx, r11b
mov dil, Ordinal_26
mov sil, Ordinal_27
mov r14b, 0x42
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0xb1], al
xor byte [rsp + 0xb2], cl
xor byte [rsp + 0xb3], cl
xor byte [rsp + 0xb4], cl
xor byte [rsp + 0xb5], cl
xor byte [rsp + 0xb6], cl
xor byte [rsp + 0xb7], cl
xor byte [rsp + 0xb8], cl
xor byte [rsp + 0xb9], cl
xor byte [rsp + 0xba], cl
xor byte [rsp + 0xbb], cl
xor byte [rsp + 0xbc], cl
xor byte [rsp + 0xbd], cl
xor byte [rsp + 0xbe], cl
xor byte [rsp + 0xbf], cl
movd eax, xmm2
xor al, cl
mov byte [rsp + 0xc0], al
xor byte [rsp + 0xc1], cl
xor byte [rsp + 0xc2], cl
xor byte [rsp + 0xc3], cl
xor byte [rsp + 0xc4], cl
xor byte [rsp + 0xc5], cl
xor byte [rsp + 0xc6], cl
xor byte [rsp + 0xc7], cl
xor byte [rsp + 0xc8], cl
xor byte [rsp + 0xc9], cl
xor byte [rsp + 0xca], cl
xor byte [rsp + 0xcb], cl
xor byte [rsp + 0xcc], cl
xor byte [rsp + 0xcd], cl
xor byte [rsp + 0xce], cl
xor byte [rsp + 0xcf], cl
movd eax, xmm3
xor al, cl
mov byte [rsp + 0xd0], al
xor byte [rsp + 0xd1], cl
xor byte [rsp + 0xd2], cl
xor byte [rsp + 0xd3], cl
xor byte [rsp + 0xd4], cl
xor byte [rsp + 0xd5], cl
xor byte [rsp + 0xd6], cl
xor byte [rsp + 0xd7], cl
xor byte [rsp + 0xd8], cl
xor byte [rsp + 0xd9], cl
xor byte [rsp + 0xda], cl
xor byte [rsp + 0xdb], cl
xor byte [rsp + 0xdc], cl
xor byte [rsp + 0xdd], cl
xor byte [rsp + 0xde], cl
xor byte [rsp + 0xdf], cl
xor dl, cl
mov byte [rsp + 0xe0], dl
xor r8b, cl
mov byte [rsp + 0xe1], r8b
xor r9b, cl
mov byte [rsp + 0xe2], r9b
xor r10b, cl
mov byte [rsp + 0xe3], r10b
xor r11b, cl
mov byte [rsp + 0xe4], r11b
xor bl, cl
mov byte [rsp + 0xe5], bl
xor dil, cl
mov byte [rsp + 0xe6], dil
xor sil, cl
mov byte [rsp + 0xe7], sil
xor r14b, cl
mov byte [rsp + 0xe8], r14b
mov byte [rsp + 0xe9], 0
lea rdx, [0x140007e50]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [rsp + 0xb1]
mov rcx, rax
call fcn.140003a10
mov dword [rsp + 0x30], 4
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x6d8]
call fcn.140003880
mov rcx, rax
call fcn.14000c420
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov byte [rsp + 0x178], Ordinal_41
mov al, 4
mov cl, 0x5c
mov dl, reloc.WS2_32.dll_select
mov r8b, reloc.WS2_32.dll_recv
xor r9d, r9d
xor al, 0x24
mov byte [rsp + 0x179], al
xor cl, 0x24
mov byte [rsp + 0x17a], cl
xor dl, 0x24
mov byte [rsp + 0x17b], dl
xor r8b, 0x24
mov byte [rsp + 0x17c], r8b
mov byte [rsp + 0x17d], r9b
lea rax, [rsp + 0x179]
mov r8, r12
nop
inc r8
cmp byte [rax + r8], r9b
jne 0x140025e20
lea rdx, [rsp + 0x179]
lea rcx, [rsp + 0xae0]
call fcn.140012110
movdqa xmm0, xmmword [0x14012e2b0]
movdqu xmmword [rsp + 0x350], xmm0
mov dword [rsp + 0x360], 0x5d5a46
mov rcx, r15
nop dword [rax]
movzx eax, byte [rsp + 0x350]
xor byte [rsp + rcx + 0x351], al
inc rcx
cmp rcx, 0x12
jb 0x140025e60
mov byte [rsp + 0x363], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x560], xmm0
mov qword [rsp + 0x570], r15
mov qword [rsp + 0x578], r15
lea rax, [rsp + 0x351]
mov r8, r12
inc r8
cmp byte [rax + r8], 0
jne 0x140025ea6
lea rdx, [rsp + 0x351]
lea rcx, [rsp + 0x560]
call fcn.140004160
xor edx, edx
lea rcx, [rsp + 0x560]
call fcn.14002adc0
mov byte [rsp + 0x180], reloc.WS2_32.dll_WSAStartup
mov al, 0x5c
xor cl, cl
mov dl, reloc.WS2_32.dll_socket
mov r8b, Ordinal_26
xor r9d, r9d
xor al, 0x73
mov byte [rsp + 0x181], al
xor cl, 0x73
mov byte [rsp + 0x182], cl
xor dl, 0x73
mov byte [rsp + 0x183], dl
xor r8b, 0x73
mov byte [rsp + 0x184], r8b
mov byte [rsp + 0x185], r9b
xorps xmm0, xmm0
movups xmmword [rsp + 0x470], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x480], xmm1
lea rax, [rsp + 0x181]
mov r8, r12
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], r9b
jne 0x140025f40
lea rdx, [rsp + 0x181]
lea rcx, [rsp + 0x470]
call fcn.140004160
nop
movdqa xmm0, xmmword [str.oYXA_XAYA__]
movdqu xmmword [rsp + 0x3f0], xmm0
movdqa xmm1, xmmword [0x14012dd40]
movdqu xmmword [rsp + 0x400], xmm1
mov rcx, r15
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rsp + 0x3f0]
xor byte [rsp + rcx + 0x3f1], al
movzx eax, byte [rsp + 0x3f0]
xor byte [rsp + rcx + 0x3f2], al
add rcx, 2
cmp rcx, 0x1e
jb 0x140025f90
mov byte [rsp + 0x40f], 0
lea r8, [rsp + 0x470]
lea rdx, [rsp + 0x3f1]
lea rcx, [rsp + 0x830]
call fcn.140003f20
mov rdx, rax
lea rcx, [rsp + 0xb70]
call fcn.14001cbe0
nop
mov rdx, qword [rsp + 0x488]
cmp rdx, 0x10
jb 0x140026034
inc rdx
mov rcx, qword [rsp + 0x470]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002602f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002602f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e9774
movdqa xmm0, xmmword [0x14012dbf0]
movdqu xmmword [rsp + 0x480], xmm0
mov byte [rsp + 0x470], 0
cmp byte [0x1401590c4], 0
je 0x1400260cf
movdqa xmm0, xmmword [0x14012e5d0]
movdqu xmmword [rsp + 0x338], xmm0
mov dword [rsp + 0x348], 0x5f58105d
mov word [rsp + 0x34c], 0x4443
xor eax, eax
mov byte [rsp + 0x34e], al
mov rcx, r15
nop dword [rax + rax]
movzx eax, byte [rsp + 0x338]
xor byte [rsp + rcx + 0x339], al
inc rcx
cmp rcx, 0x15
jb 0x140026090
mov byte [rsp + 0x34e], 0
lea rdx, [rsp + 0x339]
lea rcx, [rsp + 0x790]
call fcn.14000d120
xor edx, edx
mov rcx, rax
call fcn.14002adc0
xor edx, edx
lea rcx, [rsp + 0x7d0]
call fcn.14001e3b0
nop
mov byte [rsp + 0x1d0], Ordinal_79
mov cl, 0x65
mov dl, reloc.WLDAP32.dll_Ordinal_41
mov r8b, Ordinal_45
mov r9b, reloc.WLDAP32.dll_Ordinal_45
mov r10b, 0x75
mov r11b, Ordinal_35
mov bl, 0x3d
mov dil, reloc.WLDAP32.dll_Ordinal_35
mov sil, reloc.WLDAP32.dll_Ordinal_46
mov r14b, 0x77
xor r13d, r13d
xor cl, 0x4a
mov byte [rsp + 0x1d1], cl
xor dl, 0x4a
mov byte [rsp + 0x1d2], dl
xor r8b, 0x4a
mov byte [rsp + 0x1d3], r8b
xor r9b, 0x4a
mov byte [rsp + 0x1d4], r9b
xor r10b, 0x4a
mov byte [rsp + 0x1d5], r10b
xor r11b, 0x4a
mov byte [rsp + 0x1d6], r11b
xor bl, 0x4a
mov byte [rsp + 0x1d7], bl
xor dil, 0x4a
mov byte [rsp + 0x1d8], dil
xor sil, 0x4a
mov byte [rsp + 0x1d9], sil
xor r14b, 0x4a
mov byte [rsp + 0x1da], r14b
mov byte [rsp + 0x1db], r13b
lea rcx, [rsp + 0x1d1]
mov r9, r12
nop word [rax + rax]
inc r9
cmp byte [rcx + r9], r13b
jne 0x140026190
lea r8, [rsp + 0x1d1]
xor edx, edx
mov rcx, rax
call fcn.14002aad0
xorps xmm0, xmm0
movups xmmword [rsp + 0x580], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x590], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x580], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x590], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], r13b
movdqa xmm0, xmmword [str.oYXA_XAYA__]
movdqu xmmword [rsp + 0x410], xmm0
movdqa xmm1, xmmword [0x14012dd40]
movdqu xmmword [rsp + 0x420], xmm1
mov rcx, r15
nop dword [rax]
movzx eax, byte [rsp + 0x410]
xor byte [rsp + rcx + 0x411], al
movzx eax, byte [rsp + 0x410]
xor byte [rsp + rcx + 0x412], al
add rcx, 2
cmp rcx, 0x1e
jb 0x140026210
mov byte [rsp + 0x42f], 0
lea r8, [rsp + 0x580]
lea rdx, [rsp + 0x411]
lea rcx, [rsp + 0x7b0]
call fcn.140003f20
mov rdx, rax
lea rcx, [rsp + 0xb50]
call fcn.14001cbe0
nop
lea rcx, [rsp + 0x580]
call fcn.14000e0b0
nop
lea rcx, [rsp + 0x7d0]
call fcn.14000e0b0
xor edx, edx
lea rcx, [rsp + 0x620]
call fcn.14001e3b0
nop
mov byte [rsp + 0x270], 6
mov cl, reloc.WLDAP32.dll_Ordinal_41
mov dl, 0x65
mov r8b, 0x6a
mov r9b, reloc.WS2_32.dll_WSAGetLastError
mov r10b, reloc.WS2_32.dll_gethostname
mov r11b, 0x62
mov bl, 0x67
mov dil, WSAStartup
movzx esi, bl
mov r14b, Ordinal_60
xor r13d, r13d
xor cl, 6
mov byte [rsp + 0x271], cl
xor dl, 6
mov byte [rsp + 0x272], dl
xor r8b, 6
mov byte [rsp + 0x273], r8b
xor r9b, 6
mov byte [rsp + 0x274], r9b
xor r10b, 6
mov byte [rsp + 0x275], r10b
xor r11b, 6
mov byte [rsp + 0x276], r11b
xor bl, 6
mov byte [rsp + 0x277], bl
xor dil, 6
mov byte [rsp + 0x278], dil
xor sil, 6
mov byte [rsp + 0x279], sil
xor r14b, 6
mov byte [rsp + 0x27a], r14b
mov byte [rsp + 0x27b], r13b
mov r8, rax
lea rdx, [rsp + 0x271]
lea rcx, [rsp + 0x9d0]
call fcn.140003f20
nop
mov byte [rsp + 0x1a0], 0xa
mov cl, 0x2f
mov dl, gethostname
mov r8b, Ordinal_60
xor r9d, r9d
xor cl, 0xa
mov byte [rsp + 0x1a1], cl
xor dl, 0xa
mov byte [rsp + 0x1a2], dl
xor r8b, 0xa
mov byte [rsp + 0x1a3], r8b
mov byte [rsp + 0x1a4], r9b
lea r8, [rsp + 0x1a1]
mov rdx, rax
lea rcx, [rsp + 0x810]
call fcn.140003eb0
nop
lea rdx, [0x140158118]
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae rdx, qword [0x140158118]
mov r8, qword [0x140158128]
mov rcx, rax
call fcn.140012080
xorps xmm0, xmm0
movups xmmword [rsp + 0x5a0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x5b0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x5a0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x5b0], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], r13b
movdqa xmm0, xmmword [str.sED_ABD_E__BC__]
movdqu xmmword [rsp + 0x430], xmm0
movdqa xmm1, xmmword [0x14012dd00]
movdqu xmmword [rsp + 0x440], xmm1
mov rcx, r15
nop dword [rax]
movzx eax, byte [rsp + 0x430]
xor byte [rsp + rcx + 0x431], al
movzx eax, byte [rsp + 0x430]
xor byte [rsp + rcx + 0x432], al
add rcx, 2
cmp rcx, 0x1e
jb 0x140026430
mov byte [rsp + 0x44f], 0
lea r8, [rsp + 0x5a0]
lea rdx, [rsp + 0x431]
lea rcx, [rsp + 0x7f0]
call fcn.140003f20
mov rdx, rax
lea rcx, [rsp + 0xb30]
call fcn.14001cbe0
nop
lea rcx, [rsp + 0x5a0]
call fcn.14000e0b0
nop
lea rcx, [rsp + 0x810]
call fcn.14000e0b0
nop
lea rcx, [rsp + 0x9d0]
call fcn.14000e0b0
nop
mov rdx, qword [rsp + 0x638]
cmp rdx, 0x10
jb 0x1400264fe
inc rdx
mov rcx, qword [rsp + 0x620]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400264f9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400264f9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e9774
movdqa xmm0, xmmword [0x14012dbf0]
movdqu xmmword [rsp + 0x630], xmm0
mov byte [rsp + 0x620], 0
movdqa xmm0, xmmword [0x14012e500]
movdqu xmmword [rsp + 0x300], xmm0
mov dword [rsp + 0x310], 0x585a4b51
mov dword [rsp + 0x314], 0x464b564d
xor eax, eax
mov byte [rsp + 0x318], al
mov rcx, r15
nop word [rax + rax]
movzx eax, byte [rsp + 0x300]
xor byte [rsp + rcx + 0x301], al
inc rcx
cmp rcx, 0x17
jb 0x140026550
mov byte [rsp + 0x318], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x5c0], xmm0
mov qword [rsp + 0x5d0], r15
mov qword [rsp + 0x5d8], r15
lea rax, [rsp + 0x301]
mov r8, r12
inc r8
cmp byte [rax + r8], 0
jne 0x140026596
lea rdx, [rsp + 0x301]
lea rcx, [rsp + 0x5c0]
call fcn.140004160
xor edx, edx
lea rcx, [rsp + 0x5c0]
call fcn.14002adc0
cmp qword [rsp + 0xb40], 0
je 0x1400278c3
cmp qword [rsp + 0xb80], 0
je 0x1400278c3
movdqa xmm0, xmmword [0x14012e190]
movdqu xmmword [rsp + 0x370], xmm0
mov word [rsp + 0x380], 0x2e3b
xor eax, eax
mov byte [rsp + 0x382], al
mov rcx, r15
nop dword [rax]
movzx eax, byte [rsp + 0x370]
xor byte [rsp + rcx + 0x371], al
inc rcx
cmp rcx, 0x11
jb 0x140026610
mov byte [rsp + 0x382], 0
lea rdx, [rsp + 0x371]
lea rcx, [rsp + 0x850]
call fcn.14000d120
xor edx, edx
mov rcx, rax
call fcn.14002adc0
mov qword [rsp + 0xa48], r15
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rsp + 0xa10]
lea rdx, [rsp + 0xb70]
lea rcx, [rsp + 0xb00]
call fcn.14000a270
nop
mov qword [rsp + 0xa88], r15
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rsp + 0xa50]
lea rdx, [rsp + 0xb30]
lea rcx, [rsp + 0xad0]
call fcn.14000a270
nop
mov byte [rsp + 0x230], 0x3d
mov al, reloc.WS2_32.dll_WSAStartup
mov cl, 0x52
mov dl, 0x49
mov r8b, Ordinal_30
mov r9b, 0x5b
movzx r10d, cl
mov r11b, 0x48
mov bl, 0x53
mov dil, 0x59
xor esi, esi
xor al, 0x3d
mov byte [rsp + 0x231], al
xor cl, 0x3d
mov byte [rsp + 0x232], cl
xor dl, 0x3d
mov byte [rsp + 0x233], dl
xor r8b, 0x3d
mov byte [rsp + 0x234], r8b
xor r9b, 0x3d
mov byte [rsp + 0x235], r9b
xor r10b, 0x3d
mov byte [rsp + 0x236], r10b
xor r11b, 0x3d
mov byte [rsp + 0x237], r11b
xor bl, 0x3d
mov byte [rsp + 0x238], bl
xor dil, 0x3d
mov byte [rsp + 0x239], dil
mov byte [rsp + 0x23a], sil
lea rdx, [rsp + 0x231]
lea rcx, [rsp + 0xb50]
call fcn.140003c70
test al, al
je 0x140026aa9
movdqa xmm1, xmmword [0x14012e2a0]
movdqu xmmword [rsp + 0x138], xmm1
mov dl, 0x2a
mov r8b, 0x6b
mov r9b, reloc.WLDAP32.dll_Ordinal_45
mov r10b, 0x24
mov r11b, 0x3e
mov bl, 0x25
mov dil, 0x2f
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x139], al
xor byte [rsp + 0x13a], cl
xor byte [rsp + 0x13b], cl
xor byte [rsp + 0x13c], cl
xor byte [rsp + 0x13d], cl
xor byte [rsp + 0x13e], cl
xor byte [rsp + 0x13f], cl
xor byte [rsp + 0x140], cl
xor byte [rsp + 0x141], cl
xor byte [rsp + 0x142], cl
xor byte [rsp + 0x143], cl
xor byte [rsp + 0x144], cl
xor byte [rsp + 0x145], cl
xor byte [rsp + 0x146], cl
xor byte [rsp + 0x147], cl
xor dl, cl
mov byte [rsp + 0x148], dl
xor r8b, cl
mov byte [rsp + 0x149], r8b
xor r9b, cl
mov byte [rsp + 0x14a], r9b
xor r10b, cl
mov byte [rsp + 0x14b], r10b
xor r11b, cl
mov byte [rsp + 0x14c], r11b
xor bl, cl
mov byte [rsp + 0x14d], bl
xor dil, cl
mov byte [rsp + 0x14e], dil
mov byte [rsp + 0x14f], sil
lea rdx, [rsp + 0x139]
lea rcx, [rsp + 0x870]
call fcn.14000d120
xor edx, edx
mov rcx, rax
call fcn.14002adc0
movdqa xmm1, xmmword [0x14012dec0]
movdqu xmmword [rsp + 0x68], xmm1
movdqa xmm2, xmmword [0x14012dc50]
movdqu xmmword [rsp + 0x78], xmm2
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x69], al
xor byte [rsp + 0x6a], cl
xor byte [rsp + 0x6b], cl
xor byte [rsp + 0x6c], cl
xor byte [rsp + 0x6d], cl
xor byte [rsp + 0x6e], cl
xor byte [rsp + 0x6f], cl
xor byte [rsp + 0x70], cl
xor byte [rsp + 0x71], cl
xor byte [rsp + 0x72], cl
xor byte [rsp + 0x73], cl
xor byte [rsp + 0x74], cl
xor byte [rsp + 0x75], cl
xor byte [rsp + 0x76], cl
xor byte [rsp + 0x77], cl
movd eax, xmm2
xor al, cl
mov byte [rsp + 0x78], al
xor byte [rsp + 0x79], cl
xor byte [rsp + 0x7a], cl
xor byte [rsp + 0x7b], cl
xor byte [rsp + 0x7c], cl
xor byte [rsp + 0x7d], cl
xor byte [rsp + 0x7e], cl
xor byte [rsp + 0x7f], cl
xor byte [rsp + 0x80], cl
xor byte [rsp + 0x81], cl
xor byte [rsp + 0x82], cl
xor byte [rsp + 0x83], cl
xor byte [rsp + 0x84], cl
xor byte [rsp + 0x85], cl
xor byte [rsp + 0x86], cl
mov byte [rsp + 0x87], sil
lea rdx, [rsp + 0x69]
lea rcx, [rsp + 0x890]
call fcn.14000d120
xor edx, edx
mov rcx, rax
call fcn.14002adc0
nop
movdqa xmm1, xmmword [0x14012e530]
movdqu xmmword [rsp + 0x120], xmm1
mov dl, 0xa
mov r8b, 0x49
mov r9b, 0x45
mov r10b, 0x44
mov r11b, 0x4c
mov bl, 0x43
mov dil, Ordinal_79
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x121], al
xor byte [rsp + 0x122], cl
xor byte [rsp + 0x123], cl
xor byte [rsp + 0x124], cl
xor byte [rsp + 0x125], cl
xor byte [rsp + 0x126], cl
xor byte [rsp + 0x127], cl
xor byte [rsp + 0x128], cl
xor byte [rsp + 0x129], cl
xor byte [rsp + 0x12a], cl
xor byte [rsp + 0x12b], cl
xor byte [rsp + 0x12c], cl
xor byte [rsp + reloc.WLDAP32.dll_Ordinal_301], cl
xor byte [rsp + 0x12e], cl
xor byte [rsp + 0x12f], cl
xor dl, cl
mov byte [rsp + 0x130], dl
xor r8b, cl
mov byte [rsp + 0x131], r8b
xor r9b, cl
mov byte [rsp + 0x132], r9b
xor r10b, cl
mov byte [rsp + 0x133], r10b
xor r11b, cl
mov byte [rsp + 0x134], r11b
xor bl, cl
mov byte [rsp + 0x135], bl
xor dil, cl
mov byte [rsp + 0x136], dil
mov byte [rsp + 0x137], sil
lea rdx, [rsp + 0x121]
lea rcx, [rsp + 0x8b0]
call fcn.14000d120
xor edx, edx
mov rcx, rax
call fcn.14002adc0
mov qword [rsp + 0xac8], r15
mov byte [rsp + 0x20], sil
mov r9b, 1
lea r8, [rsp + 0xa90]
lea rdx, [rsp + 0xb50]
lea rcx, [rsp + 0x6e0]
call fcn.14000a270
mov rdx, rax
lea rcx, [0x1401591b0]
call fcn.14000e940
call fcn.1400162c0
nop
jmp 0x140026b0f
movdqa xmm0, xmmword [0x14012e730]
movdqu xmmword [rsp + 0x388], xmm0
xor eax, eax
mov byte [rsp + 0x398], al
mov rcx, r15
nop word [rax + rax]
movzx eax, byte [rsp + 0x388]
xor byte [rsp + rcx + 0x389], al
inc rcx
cmp rcx, 0xf
jb 0x140026ad0
mov byte [rsp + 0x398], sil
lea rdx, [rsp + 0x389]
lea rcx, [rsp + 0x910]
call fcn.14000d120
xor edx, edx
mov rcx, rax
call fcn.14002adc0
movdqa xmm0, xmmword [0x14012dc80]
movdqu xmmword [rsp + 0x3d0], xmm0
mov rcx, r15
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rsp + 0x3d0]
xor byte [rsp + rcx + 0x3d1], al
inc rcx
cmp rcx, 0xe
jb 0x140026b30
mov byte [rsp + 0x3df], 0
lea rdx, [rsp + 0x3d1]
lea rcx, [rsp + 0xad0]
call fcn.140003d90
mov rcx, rax
call fcn.1400081a0
mov dword [rsp + 0x30], eax
movdqa xmm0, xmmword [0x14012dc70]
movdqu xmmword [rsp + 0x3e0], xmm0
mov rcx, r15
nop word [rax + rax]
movzx eax, byte [rsp + 0x3e0]
xor byte [rsp + rcx + 0x3e1], al
inc rcx
cmp rcx, 0xe
jb 0x140026b90
mov byte [rsp + 0x3ef], 0
lea rdx, [rsp + 0x3e1]
lea rcx, [rsp + 0xad0]
call fcn.140003d90
mov rcx, rax
lea rdx, [rsp + 0xbb0]
call fcn.140003de0
nop
mov cl, reloc.WS2_32.dll_WSAStartup
mov dword [rsp + 0x1c0], 0x7061c73
mov dword [rsp + 0x1c4], 0x16071217
mov dword [rsp + 0x1c8], 0x1e2c17
mov word [rsp + 0x1cc], reloc.WS2_32.dll_sendto
mov rax, r15
nop word [rax + rax]
xor byte [rsp + rax + 0x1c1], cl
inc rax
cmp rax, 0xc
jae 0x140026c2a
movzx ecx, byte [rsp + 0x1c0]
jmp 0x140026c10
mov byte [rsp + 0x1cd], 0
lea rdx, [rsp + 0x1c1]
lea rcx, [rsp + 0xad0]
call fcn.140003d90
mov rcx, rax
lea rdx, [rsp + 0xb90]
call fcn.140003de0
nop
mov byte [rsp + 0x1e0], 0x52
mov al, 0x3f
mov cl, 0x3d
mov dl, 0x26
mov r8b, 0x36
mov r9b, reloc.WS2_32.dll_listen
movzx r10d, al
mov r11b, reloc.WLDAP32.dll_Ordinal_33
mov bl, 0x35
xor edi, edi
xor al, 0x52
mov byte [rsp + 0x1e1], al
xor cl, 0x52
mov byte [rsp + 0x1e2], cl
xor dl, 0x52
mov byte [rsp + 0x1e3], dl
xor r8b, 0x52
mov byte [rsp + 0x1e4], r8b
xor r9b, 0x52
mov byte [rsp + 0x1e5], r9b
xor r10b, 0x52
mov byte [rsp + 0x1e6], r10b
xor r11b, 0x52
mov byte [rsp + 0x1e7], r11b
xor bl, 0x52
mov byte [rsp + 0x1e8], bl
mov byte [rsp + 0x1e9], dil
lea rdx, [rsp + 0x1e1]
lea rcx, [rsp + 0xad0]
call fcn.140003d90
mov rcx, rax
lea rdx, [rsp + 0x930]
call fcn.140003de0
mov rdx, rax
lea rcx, [0x140158198]
call fcn.14000e980
lea rcx, [rsp + 0x930]
call fcn.14000e0b0
mov byte [rsp + 0x260], 0x50
mov al, 0x3d
mov cl, 0x3f
mov dl, 0x24
mov r8b, 0x34
mov r9b, reloc.WS2_32.dll_ntohs
movzx r10d, r8b
mov r11b, 0x35
mov bl, reloc.WLDAP32.dll_Ordinal_60
mov dil, Ordinal_50
mov sil, reloc.WLDAP32.dll_Ordinal_41
xor r14d, r14d
xor al, 0x50
mov byte [rsp + 0x261], al
xor cl, 0x50
mov byte [rsp + 0x262], cl
xor dl, 0x50
mov byte [rsp + 0x263], dl
xor r8b, 0x50
mov byte [rsp + 0x264], r8b
xor r9b, 0x50
mov byte [rsp + 0x265], r9b
xor r10b, 0x50
mov byte [rsp + 0x266], r10b
xor r11b, 0x50
mov byte [rsp + 0x267], r11b
xor bl, 0x50
mov byte [rsp + 0x268], bl
xor dil, 0x50
mov byte [rsp + 0x269], dil
xor sil, 0x50
mov byte [rsp + 0x26a], sil
mov byte [rsp + 0x26b], r14b
lea rdx, [rsp + 0x261]
lea rcx, [rsp + 0xad0]
call fcn.140003d90
mov rcx, rax
call fcn.1400081a0
mov dword [0x140158d14], eax
movdqa xmm0, xmmword [0x14012e580]
movdqu xmmword [rsp + 0x3a0], xmm0
xor eax, eax
mov byte [rsp + 0x3b0], al
mov rcx, r15
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rsp + 0x3a0]
xor byte [rsp + rcx + 0x3a1], al
inc rcx
cmp rcx, 0xf
jb 0x140026e00
mov byte [rsp + 0x3b0], r14b
lea rdx, [rsp + 0x3a1]
lea rcx, [rsp + 0xad0]
call fcn.140003d90
mov rcx, rax
lea rdx, [rsp + 0x950]
call fcn.140003de0
mov rdx, rax
lea rcx, [0x1401581d8]
call fcn.14000e980
lea rcx, [rsp + 0x950]
call fcn.14000e0b0
mov byte [rsp + 0x250], reloc.WS2_32.dll_WSAStartup
mov al, 6
mov cl, 3
mov dl, reloc.WS2_32.dll_socket
mov r8b, reloc.WS2_32.dll_select
mov r9b, 7
mov r10b, reloc.WLDAP32.dll_Ordinal_22
mov r11b, Ordinal_45
mov bl, reloc.WLDAP32.dll_Ordinal_30
xor dil, dil
mov sil, reloc.WS2_32.dll_sendto
xor al, 0x73
mov byte [rsp + 0x251], al
xor cl, 0x73
mov byte [rsp + 0x252], cl
xor dl, 0x73
mov byte [rsp + 0x253], dl
xor r8b, 0x73
mov byte [rsp + 0x254], r8b
xor r9b, 0x73
mov byte [rsp + 0x255], r9b
xor r10b, 0x73
mov byte [rsp + 0x256], r10b
xor r11b, 0x73
mov byte [rsp + 0x257], r11b
xor bl, 0x73
mov byte [rsp + 0x258], bl
xor dil, 0x73
mov byte [rsp + 0x259], dil
xor sil, 0x73
mov byte [rsp + 0x25a], sil
mov byte [rsp + 0x25b], r14b
lea rdx, [rsp + 0x251]
lea rcx, [rsp + 0xad0]
call fcn.140003d90
mov rcx, rax
lea rdx, [rsp + 0x970]
call fcn.140003de0
mov rdx, rax
lea rcx, [0x1401581b8]
call fcn.14000e980
lea rcx, [rsp + 0x970]
call fcn.14000e0b0
mov byte [rsp + 0x220], 0x5f
mov al, 0x3a
mov cl, 0x27
mov dl, 0x2f
mov r8b, 0x36
mov r9b, reloc.WLDAP32.dll_Ordinal_45
movzx r10d, al
xor r11b, r11b
mov bl, 0x26
movzx edi, bl
xor esi, esi
xor al, 0x5f
mov byte [rsp + 0x221], al
xor cl, 0x5f
mov byte [rsp + 0x222], cl
xor dl, 0x5f
mov byte [rsp + 0x223], dl
xor r8b, 0x5f
mov byte [rsp + 0x224], r8b
xor r9b, 0x5f
mov byte [rsp + 0x225], r9b
xor r10b, 0x5f
mov byte [rsp + 0x226], r10b
xor r11b, 0x5f
mov byte [rsp + 0x227], r11b
xor bl, 0x5f
mov byte [rsp + 0x228], bl
xor dil, 0x5f
mov byte [rsp + 0x229], dil
mov byte [rsp + 0x22a], sil
lea rdx, [rsp + 0x221]
lea rcx, [rsp + 0xad0]
call fcn.140003d90
mov rcx, rax
call fcn.1400081a0
mov dword [0x140158d10], eax
mov byte [rsp + 0x210], Ordinal_45
mov al, 0x49
mov cl, 0x54
mov dl, 0x5c
mov r8b, 0x45
mov r9b, 0x5e
movzx r10d, al
mov r11b, reloc.WS2_32.dll_WSAStartup
mov bl, 0x41
movzx edi, bl
xor al, 0x2c
mov byte [rsp + 0x211], al
xor cl, 0x2c
mov byte [rsp + 0x212], cl
xor dl, 0x2c
mov byte [rsp + 0x213], dl
xor r8b, 0x2c
mov byte [rsp + 0x214], r8b
xor r9b, 0x2c
mov byte [rsp + 0x215], r9b
xor r10b, 0x2c
mov byte [rsp + 0x216], r10b
xor r11b, 0x2c
mov byte [rsp + 0x217], r11b
xor bl, 0x2c
mov byte [rsp + 0x218], bl
xor dil, 0x2c
mov byte [rsp + 0x219], dil
mov byte [rsp + 0x21a], sil
lea rdx, [rsp + 0x211]
lea rcx, [rsp + 0xad0]
call fcn.140003d90
mov rcx, rax
call fcn.1400081a0
mov dword [0x140158d08], eax
mov byte [rsp + 0x200], reloc.WLDAP32.dll_Ordinal_46
mov al, 0x4b
mov cl, 0x56
mov dl, 0x5e
mov r8b, 0x47
mov r9b, 0x5c
movzx r10d, al
mov r11b, WSAStartup
mov bl, 0x4a
movzx edi, bl
xor al, 0x2e
mov byte [rsp + 0x201], al
xor cl, 0x2e
mov byte [rsp + 0x202], cl
xor dl, 0x2e
mov byte [rsp + 0x203], dl
xor r8b, 0x2e
mov byte [rsp + 0x204], r8b
xor r9b, 0x2e
mov byte [rsp + 0x205], r9b
xor r10b, 0x2e
mov byte [rsp + 0x206], r10b
xor r11b, 0x2e
mov byte [rsp + 0x207], r11b
xor bl, 0x2e
mov byte [rsp + 0x208], bl
xor dil, 0x2e
mov byte [rsp + 0x209], dil
mov byte [rsp + 0x20a], sil
lea rdx, [rsp + 0x201]
lea rcx, [rsp + 0xad0]
call fcn.140003d90
mov rcx, rax
call fcn.1400081a0
mov dword [0x140158d0c], eax
mov cl, 0x76
mov dword [rsp + 0x1a8], 0x60e1376
mov dword [rsp + 0x1ac], 0x2913041f
mov dword [rsp + 0x1b0], 0x1a171911
xor eax, eax
mov byte [rsp + 0x1b4], al
mov rax, r15
nop word [rax + rax]
xor byte [rsp + rax + 0x1a9], cl
inc rax
cmp rax, 0xb
jae 0x14002719a
movzx ecx, byte [rsp + 0x1a8]
jmp 0x140027180
mov byte [rsp + 0x1b4], sil
lea rdx, [rsp + 0x1a9]
lea rcx, [rsp + 0xad0]
call fcn.140003d90
mov rcx, rax
lea rdx, [rsp + 0x990]
call fcn.140003de0
mov rdx, rax
lea rcx, [0x140158178]
call fcn.14000e980
lea rcx, [rsp + 0x990]
call fcn.14000e0b0
mov byte [rsp + 0x240], 0x66
mov al, 3
mov cl, reloc.WLDAP32.dll_Ordinal_30
mov dl, reloc.WLDAP32.dll_Ordinal_22
mov r8b, reloc.WS2_32.dll_ntohs
mov r9b, reloc.WS2_32.dll_sendto
movzx r10d, al
mov r11b, reloc.WS2_32.dll_gethostname
mov bl, 0xb
mov dil, reloc.WS2_32.dll_setsockopt
mov sil, 1
xor al, 0x66
mov byte [rsp + 0x241], al
xor cl, 0x66
mov byte [rsp + 0x242], cl
xor dl, 0x66
mov byte [rsp + 0x243], dl
xor r8b, 0x66
mov byte [rsp + 0x244], r8b
xor r9b, 0x66
mov byte [rsp + 0x245], r9b
xor r10b, 0x66
mov byte [rsp + 0x246], r10b
xor r11b, 0x66
mov byte [rsp + 0x247], r11b
xor bl, 0x66
mov byte [rsp + 0x248], bl
xor dil, 0x66
mov byte [rsp + 0x249], dil
xor sil, 0x66
mov byte [rsp + 0x24a], sil
mov byte [rsp + 0x24b], r14b
lea rdx, [rsp + 0x241]
lea rcx, [rsp + 0xad0]
call fcn.140003d90
mov rcx, rax
lea rdx, [rsp + 0x9b0]
call fcn.140003de0
mov rdx, rax
lea rcx, [0x140158158]
call fcn.14000e980
lea rcx, [rsp + 0x9b0]
call fcn.14000e0b0
movdqa xmm0, xmmword [0x14012e4e0]
movdqu xmmword [rsp + 0x320], xmm0
mov dword [rsp + 0x330], 0x4d484348
mov dword [rsp + 0x334], 0x585548
mov rcx, r15
nop dword [rax + rax]
movzx eax, byte [rsp + 0x320]
xor byte [rsp + rcx + 0x321], al
inc rcx
cmp rcx, 0x16
jb 0x1400272f0
mov byte [rsp + 0x337], r14b
lea rdx, [rsp + 0x321]
lea rcx, [rsp + 0x750]
call fcn.14000d120
xor edx, edx
mov rcx, rax
call fcn.14002adc0
mov byte [rsp + 0x1f0], 0x50
mov al, 0x61
mov cl, 0x36
mov dl, reloc.WLDAP32.dll_Ordinal_50
movzx r8d, al
mov r9b, Ordinal_50
movzx r10d, r9b
mov r11b, 0x64
mov bl, 0x33
xor edi, edi
xor al, 0x50
mov byte [rsp + 0x1f1], al
xor cl, 0x50
mov byte [rsp + 0x1f2], cl
xor dl, 0x50
mov byte [rsp + 0x1f3], dl
xor r8b, 0x50
mov byte [rsp + 0x1f4], r8b
xor r9b, 0x50
mov byte [rsp + 0x1f5], r9b
xor r10b, 0x50
mov byte [rsp + 0x1f6], r10b
xor r11b, 0x50
mov byte [rsp + 0x1f7], r11b
xor bl, 0x50
mov byte [rsp + 0x1f8], bl
mov byte [rsp + 0x1f9], dil
lea rdx, [rsp + 0x1f1]
lea rcx, [rsp + 0xbb0]
call fcn.140003c70
test al, al
je 0x14002740e
lea rdx, [0x140007e50]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [rsp + 0xb90]
call fcn.1400039f0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x6b0]
call fcn.140003880
mov rcx, rax
call fcn.14000c420
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
movdqa xmm0, xmmword [0x14012de80]
movdqu xmmword [rsp + 0x280], xmm0
mov dword [rsp + 0x290], 0x36450d06
mov dword [rsp + 0x294], 0x11452e21
mov dword [rsp + 0x298], 0x1610450a
mov word [rsp + 0x29c], di
mov rcx, r15
nop dword [rax + rax]
movzx eax, byte [rsp + 0x280]
xor byte [rsp + rcx + 0x281], al
movzx eax, byte [rsp + 0x280]
xor byte [rsp + rcx + 0x282], al
add rcx, 2
cmp rcx, 0x1c
jb 0x140027450
mov byte [rsp + 0x29d], dil
lea rdx, [rsp + 0x281]
lea rcx, [rsp + 0x730]
call fcn.14000d120
xor edx, edx
mov rcx, rax
call fcn.14002adc0
lea r8, [rsp + 0xb10]
lea rdx, [rsp + 0xb00]
lea rcx, [rsp + 0x9f0]
call fcn.140033870
mov rdx, rax
lea rsi, [0x140158138]
mov rcx, rsi
call fcn.14000e980
lea rcx, [rsp + 0x9f0]
call fcn.14000e0b0
lea rax, [rsp + 0x6f0]
mov qword [rsp + 0x368], rax
mov rdx, rsi
lea rcx, [rsp + 0x6f0]
call fcn.14000d040
mov rbx, rax
lea rdx, [rsp + 0xb00]
lea rcx, [rsp + 0x6c8]
call fcn.14000c910
nop
mov rdx, rbx
mov rcx, rax
call fcn.14001b030
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
jb 0x140027538
mov rcx, qword [0x140158138]
mov rdx, rcx
mov rbx, rcx
jmp 0x140027541
mov rbx, rsi
mov rcx, rsi
mov rdx, rsi
mov rdi, qword [0x140158148]
add rdi, rcx
cmp rdx, rdi
je 0x140027563
movsx ecx, byte [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
mov byte [rbx], al
inc rbx
cmp rbx, rdi
jne 0x140027550
lea rdx, [rsp + 0xae0]
cmp qword [rsp + 0xaf8], 0x10
cmovae rdx, qword [rsp + 0xae0]
mov r8, qword [rsp + 0xaf0]
mov rcx, rsi
call fcn.140012080
mov byte [rsp + 0x1b8], Ordinal_41
mov al, reloc.WS2_32.dll_setsockopt
mov cl, 0xa
mov dl, reloc.WLDAP32.dll_Ordinal_22
mov r8b, reloc.WS2_32.dll_sendto
movzx r9d, cl
xor r10d, r10d
xor al, 0x24
mov byte [rsp + 0x1b9], al
xor cl, 0x24
mov byte [rsp + 0x1ba], cl
xor dl, 0x24
mov byte [rsp + 0x1bb], dl
xor r8b, 0x24
mov byte [rsp + 0x1bc], r8b
xor r9b, 0x24
mov byte [rsp + 0x1bd], r9b
mov byte [rsp + 0x1be], r10b
lea rax, [rsp + 0x1b9]
nop word [rax + rax]
inc r12
cmp byte [rax + r12], r10b
jne 0x1400275f0
lea rcx, [rsp + 0xb10]
cmp qword [rsp + 0xb28], 0x10
cmovae rcx, qword [rsp + 0xb10]
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x1b9]
xor r8d, r8d
mov rdx, qword [rsp + 0xb20]
call fcn.140006660
cmp rax, 0xffffffffffffffff
jne 0x14002779c
movdqa xmm1, xmmword [0x14012e070]
movdqu xmmword [rsp + 0x38], xmm1
movdqa xmm2, xmmword [0x14012e120]
movdqu xmmword [rsp + 0x48], xmm2
movdqa xmm3, xmmword [str.5_1___em__1l]
movdqu xmmword [rsp + 0x58], xmm3
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x39], al
xor byte [rsp + 0x3a], cl
xor byte [rsp + 0x3b], cl
xor byte [rsp + 0x3c], cl
xor byte [rsp + 0x3d], cl
xor byte [rsp + 0x3e], cl
xor byte [rsp + 0x3f], cl
xor byte [rsp + 0x40], cl
xor byte [rsp + 0x41], cl
xor byte [rsp + 0x42], cl
xor byte [rsp + 0x43], cl
xor byte [rsp + 0x44], cl
xor byte [rsp + 0x45], cl
xor byte [rsp + 0x46], cl
xor byte [rsp + 0x47], cl
movd eax, xmm2
xor al, cl
mov byte [rsp + 0x48], al
xor byte [rsp + 0x49], cl
xor byte [rsp + 0x4a], cl
xor byte [rsp + 0x4b], cl
xor byte [rsp + 0x4c], cl
xor byte [rsp + 0x4d], cl
xor byte [rsp + 0x4e], cl
xor byte [rsp + 0x4f], cl
xor byte [rsp + 0x50], cl
xor byte [rsp + 0x51], cl
xor byte [rsp + 0x52], cl
xor byte [rsp + 0x53], cl
xor byte [rsp + 0x54], cl
xor byte [rsp + 0x55], cl
xor byte [rsp + 0x56], cl
xor byte [rsp + 0x57], cl
movd eax, xmm3
xor al, cl
mov byte [rsp + 0x58], al
xor byte [rsp + 0x59], cl
xor byte [rsp + 0x5a], cl
xor byte [rsp + 0x5b], cl
xor byte [rsp + 0x5c], cl
xor byte [rsp + 0x5d], cl
xor byte [rsp + 0x5e], cl
xor byte [rsp + 0x5f], cl
xor byte [rsp + 0x60], cl
xor byte [rsp + 0x61], cl
xor byte [rsp + 0x62], cl
xor byte [rsp + 0x63], cl
xor byte [rsp + 0x64], cl
xor byte [rsp + 0x65], cl
xor byte [rsp + 0x66], cl
mov byte [rsp + 0x67], 0
lea rdx, [0x140007e50]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [rsp + 0x39]
call fcn.140003a10
mov rcx, rax
lea rdx, [rsp + 0xb10]
call fcn.1400039f0
mov dword [rsp + 0x30], 5
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x6b8]
call fcn.140003880
mov rcx, rax
call fcn.14000c420
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
movdqa xmm0, xmmword [0x14012e400]
movdqu xmmword [rsp + 0x3b8], xmm0
xor eax, eax
mov byte [rsp + 0x3c8], al
nop word [rax + rax]
movzx eax, byte [rsp + 0x3b8]
xor byte [rsp + r15 + 0x3b9], al
inc r15
cmp r15, 0xf
jb 0x1400277c0
mov byte [rsp + 0x3c8], 0
mov r8, rsi
lea rdx, [rsp + 0x3b9]
lea rcx, [rsp + 0x710]
call fcn.140003f90
xor edx, edx
mov rcx, rax
call fcn.14002adc0
nop
lea rcx, [rsp + 0xb90]
call fcn.14000e0b0
nop
lea rcx, [rsp + 0xbb0]
call fcn.14000e0b0
nop
movzx edx, byte [rsp + 0xad0]
lea rcx, [rsp + 0xad8]
call fcn.1400131b0
nop
movzx edx, byte [rsp + 0xb00]
lea rcx, [rsp + 0xb08]
call fcn.1400131b0
nop
lea rcx, [rsp + 0xb30]
call fcn.14000e0b0
nop
lea rcx, [rsp + 0xb50]
call fcn.14000e0b0
nop
lea rcx, [rsp + 0xb70]
call fcn.14000e0b0
nop
lea rcx, [rsp + 0xae0]
call fcn.14000e0b0
nop
lea rcx, [rsp + 0xb10]
call fcn.14000e0b0
mov rcx, qword [rsp + 0xbd8]
xor rcx, rsp
call fcn.1400ea080
lea r11, [rsp + 0xbe0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
movdqa xmm1, xmmword [0x14012e160]
movdqu xmmword [rsp + 0x88], xmm1
movdqa xmm2, xmmword [0x14012e150]
movdqu xmmword [rsp + 0x98], xmm2
mov dl, 0x58
mov r8b, reloc.WLDAP32.dll_Ordinal_79
mov r9b, 0x40
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x89], al
xor byte [rsp + 0x8a], cl
xor byte [rsp + 0x8b], cl
xor byte [rsp + 0x8c], cl
xor byte [rsp + 0x8d], cl
xor byte [rsp + 0x8e], cl
xor byte [rsp + 0x8f], cl
xor byte [rsp + 0x90], cl
xor byte [rsp + 0x91], cl
xor byte [rsp + 0x92], cl
xor byte [rsp + 0x93], cl
xor byte [rsp + 0x94], cl
xor byte [rsp + 0x95], cl
xor byte [rsp + 0x96], cl
xor byte [rsp + 0x97], cl
movd eax, xmm2
xor al, cl
mov byte [rsp + 0x98], al
xor byte [rsp + 0x99], cl
xor byte [rsp + 0x9a], cl
xor byte [rsp + 0x9b], cl
xor byte [rsp + 0x9c], cl
xor byte [rsp + 0x9d], cl
xor byte [rsp + 0x9e], cl
xor byte [rsp + 0x9f], cl
xor byte [rsp + 0xa0], cl
xor byte [rsp + 0xa1], cl
xor byte [rsp + 0xa2], cl
xor byte [rsp + 0xa3], cl
xor byte [rsp + 0xa4], cl
xor byte [rsp + 0xa5], cl
xor byte [rsp + 0xa6], cl
xor byte [rsp + 0xa7], cl
xor dl, cl
mov byte [rsp + 0xa8], dl
xor r8b, cl
mov byte [rsp + 0xa9], r8b
xor r9b, cl
mov byte [rsp + 0xaa], r9b
mov byte [rsp + 0xab], 0
lea rdx, [0x140007e50]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [rsp + 0x89]
call fcn.140003a10
mov dword [rsp + 0x30], 2
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x6c0]
call fcn.140003880
mov rcx, rax
call fcn.14000c420
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]