Function at 0x14000e090
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x330
movaps xmmword [r11 - 0x38], xmm6
movaps xmmword [r11 - 0x48], xmm7
movaps xmmword [r11 - 0x58], xmm8
mov rax, qword [0x140101940]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x118], rcx
xor r12d, r12d
mov dword [rsp + 0x70], r12d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x260], xmm0
movups xmmword [rsp + 0x270], xmm0
movups xmmword [rsp + 0x280], xmm0
movups xmmword [rsp + 0x290], xmm0
movups xmmword [rsp + 0x2a0], xmm0
movups xmmword [rsp + 0x2b0], xmm0
mov qword [r11 - 0x98], rax
mov dword [rsp + 0x260], WSASetLastError
mov dword [rsp + 0x29c], 1
mov word [r11 - 0xb8], r12w
movups xmmword [rsp + 0x1e8], xmm0
mov qword [r11 - 0x160], rax
movups xmmword [rsp + 0x200], xmm0
movdqa xmm8, xmmword [0x1400f0460]
movdqu xmmword [r11 - 0x148], xmm8
mov byte [rsp + 0x200], al
mov rsi, qword [rdx + 0x10]
mov rcx, rdx
mov r14, qword [rdx + 0x18]
cmp r14, 0xf
jbe 0x14000e17b
mov rcx, qword [rdx]
cmp rsi, 3
jne 0x14000e194
mov r8, rsi
lea rdx, [0x1400ee24c]
call fcn.1400c76a0
test eax, eax
je 0x14000e1c1
mov rcx, rdi
cmp r14, 0xf
jbe 0x14000e1a0
mov rcx, qword [rdi]
cmp rsi, 3
jne 0x14000e2e2
mov r8, rsi
lea rdx, [0x1400ee250]
call fcn.1400c76a0
test eax, eax
jne 0x14000e2e2
mov rcx, qword [rbx + 0x10]
movabs rsi, 0x7fffffffffffffff
mov rax, rsi
sub rax, rcx
cmp rax, 1
jb 0x14000f083
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x14000e1ec
mov rax, qword [rbx]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 1
lea r9, [0x1400ee254]
lea rcx, [rsp + 0x120]
call fcn.140025360
nop
mov r8d, 1
lea rdx, [0x1400ee254]
lea rcx, [rsp + 0x120]
call fcn.140014c60
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x218]
cmp rdx, 0xf
jbe 0x14000e287
inc rdx
mov rcx, qword [rsp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e282
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f089
call fcn.1400987d0
movups xmmword [rsp + 0x200], xmm6
movups xmmword [rsp + 0x210], xmm7
mov rdx, qword [rsp + 0x138]
cmp rdx, 0xf
jbe 0x14000ecc9
inc rdx
mov rcx, qword [rsp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ecc4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f08f
jmp 0x14000ecc4
mov rcx, rdi
cmp r14, 0xf
jbe 0x14000e2ee
mov rcx, qword [rdi]
cmp rsi, 3
jne 0x14000e430
mov r8, rsi
lea rdx, [0x1400ee258]
call fcn.1400c76a0
test eax, eax
jne 0x14000e430
mov rcx, qword [rbx + 0x10]
movabs rsi, 0x7fffffffffffffff
mov rax, rsi
sub rax, rcx
cmp rax, 0x2a
jb 0x14000f095
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x14000e33a
mov rax, qword [rbx]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x2a
lea r9, str.powershell__ExecutionPolicy_Bypass__File__
lea rcx, [rsp + 0xf8]
call fcn.140025360
nop
mov r8d, 1
lea rdx, [0x1400ee254]
lea rcx, [rsp + 0xf8]
call fcn.140014c60
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x218]
cmp rdx, 0xf
jbe 0x14000e3d5
inc rdx
mov rcx, qword [rsp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e3d0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f09b
call fcn.1400987d0
movups xmmword [rsp + 0x200], xmm6
movups xmmword [rsp + 0x210], xmm7
mov rdx, qword [rsp + 0x110]
cmp rdx, 0xf
jbe 0x14000ecc9
inc rdx
mov rcx, qword [rsp + 0xf8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ecc4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f0a1
jmp 0x14000ecc4
mov rcx, rdi
cmp r14, 0xf
jbe 0x14000e43c
mov rcx, qword [rdi]
cmp rsi, 3
jne 0x14000e572
mov r8, rsi
lea rdx, [0x1400ee28c]
call fcn.1400c76a0
test eax, eax
jne 0x14000e572
mov rcx, qword [rbx + 0x10]
movabs rsi, 0x7fffffffffffffff
mov rax, rsi
sub rax, rcx
cmp rax, 9
jb 0x14000f0a7
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x14000e488
mov rax, qword [rbx]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 9
lea r9, str.cscript__
lea rcx, [rsp + 0x50]
call fcn.140025360
nop
mov r8d, 1
lea rdx, [0x1400ee254]
lea rcx, [rsp + 0x50]
call fcn.140014c60
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x218]
cmp rdx, 0xf
jbe 0x14000e51d
inc rdx
mov rcx, qword [rsp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e518
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f0ad
call fcn.1400987d0
movups xmmword [rsp + 0x200], xmm6
movups xmmword [rsp + 0x210], xmm7
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14000ecc9
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ecc4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f0b3
jmp 0x14000ecc4
mov r14, rsi
mov rcx, rdi
mov r15, qword [rdi + 0x18]
cmp r15, 0xf
jbe 0x14000e585
mov rcx, qword [rdi]
cmp r14, 4
jne 0x14000ec39
mov r8, r14
lea rdx, str.json
call fcn.1400c76a0
test eax, eax
jne 0x14000ec39
mov rdx, rbx
lea rcx, [rsp + 0x240]
call fcn.14001cea0
nop
lea rcx, [rsp + 0x240]
cmp qword [rsp + 0x258], 7
cmova rcx, qword [rsp + 0x240]
mov rax, qword [rsp + 0x250]
lea rdx, [rcx + rax*2]
mov rdi, rdx
call fcn.1400026d0
cmp rax, rdx
je 0x14000e62e
nop word [rax + rax]
movzx ecx, word [rax]
cmp cx, 0x5c
je 0x14000e5ff
cmp cx, 0x2f
jne 0x14000e608
add rax, 2
cmp rax, rdx
jne 0x14000e5f0
cmp rax, rdx
je 0x14000e62e
nop dword [rax]
lea rcx, [rdi - 2]
movzx r8d, word [rcx]
cmp r8w, 0x5c
je 0x14000e62e
cmp r8w, 0x2f
je 0x14000e62e
mov rdi, rcx
cmp rax, rcx
jne 0x14000e610
mov qword [rsp + 0x2d0], rdi
sub rdx, rdi
sar rdx, 1
mov qword [rsp + 0x2d8], rdx
lea rdx, [rsp + 0x2d0]
lea rcx, [rsp + 0x160]
call fcn.140027670
nop
lea rdx, [rsp + 0x1c0]
lea rcx, [rsp + 0x160]
call fcn.140002ad0
mov rdi, rax
lea rcx, [rsp + 0x1a0]
call fcn.1400090b0
nop
mov r9, rdi
mov r8, rax
lea rcx, [rsp + 0x140]
call fcn.140025170
nop
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x220]
call fcn.14001cea0
nop
mov rdx, qword [rsp + 0x158]
cmp rdx, 0xf
jbe 0x14000e6ed
inc rdx
mov rcx, qword [rsp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e6e8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f0b9
call fcn.1400987d0
movdqu xmmword [rsp + 0x150], xmm8
mov byte [rsp + 0x140], 0
mov rdx, qword [rsp + 0x1b8]
cmp rdx, 0xf
jbe 0x14000e742
inc rdx
mov rcx, qword [rsp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e73d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f0bf
call fcn.1400987d0
movdqu xmmword [rsp + 0x1b0], xmm8
mov byte [rsp + 0x1a0], 0
mov rdx, qword [rsp + 0x1d8]
cmp rdx, 0xf
jbe 0x14000e797
inc rdx
mov rcx, qword [rsp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e792
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f0c5
call fcn.1400987d0
movdqu xmmword [rsp + 0x1d0], xmm8
mov byte [rsp + 0x1c0], 0
mov rdx, qword [rsp + 0x178]
cmp rdx, 7
jbe 0x14000e7f1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e7ec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f0cb
call fcn.1400987d0
movdqa xmm0, xmmword [0x1400f0450]
movdqu xmmword [rsp + 0x170], xmm0
mov word [rsp + 0x160], r12w
lea rdx, [rsp + 0x220]
cmp qword [rsp + 0x238], 7
cmova rdx, qword [rsp + 0x220]
lea rcx, [rsp + 0x240]
cmp qword [rsp + 0x258], 7
cmova rcx, qword [rsp + 0x240]
call fcn.140097450
test eax, eax
jne 0x14000f0d1
lea r14, [rsp + 0x220]
cmp qword [rsp + 0x238], 7
cmova r14, qword [rsp + 0x220]
mov rsi, qword [rsp + 0x230]
call fcn.140096a94
mov r15d, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x2d0], xmm0
movdqu xmmword [rsp + 0x2e0], xmm8
mov byte [rsp + 0x2d0], 0
mov dword [rsp + 0x70], 0x1a000
test rsi, rsi
je 0x14000e924
cmp rsi, 0x7fffffff
ja 0x14000f0f0
mov dword [rsp + 0x20], r12d
xor r9d, r9d
mov r8d, esi
mov rdx, r14
mov ecx, r15d
call fcn.140096b04
mov rdi, rax
shr rax, 0x20
test eax, eax
jne 0x14000f0f5
movsxd rdx, edi
xor r8d, r8d
lea rcx, [rsp + 0x2d0]
call fcn.14001a0e0
lea r9, [rsp + 0x2d0]
cmp qword [rsp + 0x2e8], 0xf
cmova r9, qword [rsp + 0x2d0]
mov dword [rsp + 0x20], edi
mov r8d, esi
mov rdx, r14
mov ecx, r15d
call fcn.140096b04
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x14000f100
mov rax, qword [rbx + 0x10]
movabs rsi, 0x7fffffffffffffff
sub rsi, rax
cmp rsi, 0xc
jb 0x14000f10a
cmp qword [rbx + 0x18], 0xf
jbe 0x14000e949
mov rbx, qword [rbx]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], send
lea r9, str.Moved_JSON:
lea rcx, [rsp + 0x98]
call fcn.140025360
nop
mov r8d, 4
lea rdx, str._to
lea rcx, [rsp + 0x98]
call fcn.140014c60
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0xd8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0xe8], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r9, [rsp + 0x2d0]
lea r8, [rsp + 0xd8]
lea rcx, [rsp + 0x180]
call fcn.140025170
nop
lea rcx, [rsp + 0x180]
call fcn.140008290
nop
mov rdx, qword [rsp + 0x198]
cmp rdx, 0xf
jbe 0x14000ea20
inc rdx
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ea1b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f110
call fcn.1400987d0
movdqu xmmword [rsp + 0x190], xmm8
mov byte [rsp + 0x180], 0
mov rdx, qword [rsp + 0xf0]
cmp rdx, 0xf
jbe 0x14000ea76
inc rdx
mov rcx, qword [rsp + 0xd8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ea70
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f116
call fcn.1400987d0
nop
mov rdx, qword [rsp + 0xb0]
cmp rdx, 0xf
jbe 0x14000eab9
inc rdx
mov rcx, qword [rsp + 0x98]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000eab4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f11c
call fcn.1400987d0
movdqu xmmword [rsp + 0xa8], xmm8
mov byte [rsp + 0x98], 0
mov rdx, qword [rsp + 0x2e8]
cmp rdx, 0xf
jbe 0x14000eb0e
inc rdx
mov rcx, qword [rsp + 0x2d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000eb09
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f122
call fcn.1400987d0
mov r8d, 0x1a
lea rdx, str.__Execute_File_json_Copied
lea rcx, [0x1401025e8]
call fcn.140014c60
call fcn.140009210
nop
mov rdx, qword [rsp + 0x238]
cmp rdx, 7
jbe 0x14000eb75
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x220]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000eb70
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f128
call fcn.1400987d0
movdqa xmm0, xmmword [0x1400f0450]
movdqu xmmword [rsp + 0x230], xmm0
mov word [rsp + 0x220], r12w
mov rdx, qword [rsp + 0x258]
cmp rdx, 7
jbe 0x14000ebdf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x240]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ebd2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f12e
call fcn.1400987d0
movdqa xmm0, xmmword [0x1400f0450]
movdqu xmmword [rsp + 0x250], xmm0
mov word [rsp + 0x240], r12w
mov rdx, qword [rsp + 0x218]
cmp rdx, 0xf
jbe 0x14000ec34
inc rdx
mov rcx, qword [rsp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ec2f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f134
call fcn.1400987d0
jmp 0x14000f04c
movabs rsi, 0x7fffffffffffffff
mov rax, rsi
sub rax, r14
cmp rax, 0x21
jb 0x14000f13a
cmp r15, 0xf
jbe 0x14000ec5c
mov rdi, qword [rdi]
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 0x21
lea r9, str.Unknown_file_type_for_execution:
lea rcx, [rsp + 0x50]
call fcn.140025360
nop
lea rcx, [rsp + 0x50]
call fcn.140008290
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14000ecc9
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ecc4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f13f
call fcn.1400987d0
lea rdx, [rsp + 0x200]
cmp qword [rsp + 0x218], 0xf
cmova rdx, qword [rsp + 0x200]
lea rax, [rsp + 0x1e8]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x260]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x14000ede9
mov rax, qword [rbx + 0x10]
sub rsi, rax
cmp rsi, 0xa
jb 0x14000f145
cmp qword [rbx + 0x18], 0xf
jbe 0x14000ed42
mov rbx, qword [rbx]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], 0xa
lea r9, str.Executed:
lea rcx, [rsp + 0x50]
call fcn.140025360
nop
lea rcx, [rsp + 0x50]
call fcn.140008290
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14000edaf
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000edaa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f14a
call fcn.1400987d0
mov rcx, qword [rsp + 0x1e8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x1f0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, reloc.WS2_32.dll_socket
lea rdx, str.__Execute_File_executed
lea rcx, [0x1401025e8]
call fcn.140014c60
jmp 0x14000f008
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea r9, [rsp + 0x2e5]
nop word [rax + rax]
dec r9
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx ecx, dl
shl cl, 2
lea eax, [rcx + rdx]
add al, al
sub r8b, al
add r8b, 0x30
mov byte [r9], r8b
mov r8d, edx
test edx, edx
jne 0x14000ee00
lea r8, [rsp + 0x2e5]
mov rdx, r9
lea rcx, [rsp + 0xb8]
call fcn.140027540
nop
mov r8, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0xd0]
mov rax, rcx
sub rax, r8
lea rsi, str.Error_executing_file:
cmp rax, 0x16
jb 0x14000eefc
lea rax, [r8 + 0x16]
mov qword [rsp + 0xc8], rax
lea rdi, [rsp + 0xb8]
cmp rcx, 0xf
cmova rdi, qword [rsp + 0xb8]
lea rax, [0x1400ee346]
cmp rax, rdi
jbe 0x14000eeb7
lea rax, [rdi + r8]
cmp rsi, rax
ja 0x14000eeb7
mov ebx, socket
cmp rdi, rsi
ja 0x14000eeaf
mov r14, r12
jmp 0x14000eebf
mov r14, rdi
sub r14, rsi
jmp 0x14000eebf
mov ebx, socket
mov r14d, ebx
inc r8
lea rcx, [rdi + 0x16]
mov rdx, rdi
call fcn.1400c6c60
mov r8, r14
mov rdx, rsi
mov rcx, rdi
call fcn.1400c6c60
sub rbx, r14
lea rdx, [rsi + 0x16]
add rdx, r14
lea rcx, [rdi + r14]
mov r8, rbx
call fcn.1400c6c60
lea rax, [rsp + 0xb8]
jmp 0x14000ef1a
mov ebx, socket
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rsi
mov edx, ebx
lea rcx, [rsp + 0xb8]
call fcn.14002d800
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x88], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x88], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rsp + 0x78]
call fcn.140008290
nop
mov rdx, qword [rsp + 0x90]
cmp rdx, 0xf
jbe 0x14000ef9c
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ef97
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f150
call fcn.1400987d0
movdqu xmmword [rsp + 0x88], xmm8
mov byte [rsp + 0x78], 0
mov rdx, qword [rsp + 0xd0]
cmp rdx, 0xf
jbe 0x14000efee
inc rdx
mov rcx, qword [rsp + 0xb8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000efe9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f156
call fcn.1400987d0
mov r8d, reloc.WS2_32.dll_sendto
lea rdx, str.__Execute_File_Error
lea rcx, [0x1401025e8]
call fcn.140014c60
nop
mov rdx, qword [rsp + 0x218]
cmp rdx, 0xf
jbe 0x14000f04c
inc rdx
mov rcx, qword [rsp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f046
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f15c
call fcn.1400987d0
nop
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.1400987b0
lea r11, [rsp + 0x330]
mov rbx, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
call fcn.140001570
nop
call fcn.1400a82a0
nop
call fcn.1400a82a0
int3
call fcn.140001570
nop
call fcn.1400a82a0
nop
call fcn.1400a82a0
int3
call fcn.140001570
nop
call fcn.1400a82a0
nop
call fcn.1400a82a0
nop
call fcn.1400a82a0
nop
call fcn.1400a82a0
nop
call fcn.1400a82a0
nop
call fcn.1400a82a0
int3
lea r9, [rsp + 0x220]
lea r8, [rsp + 0x240]
mov edx, eax
lea rcx, str.rename
call fcn.140003a00
nop
call fcn.1400019b0
shr rdi, 0x20
mov ecx, edi
call fcn.140001d20
shr rcx, 0x20
call fcn.140001d20
nop
call fcn.140001570
nop
call fcn.1400a82a0
nop
call fcn.1400a82a0
nop
call fcn.1400a82a0
nop
call fcn.1400a82a0
nop
call fcn.1400a82a0
nop
call fcn.1400a82a0
nop
call fcn.1400a82a0
nop
call fcn.140001570
call fcn.1400a82a0
int3
call fcn.140001570
call fcn.1400a82a0
nop
call fcn.1400a82a0
nop
call fcn.1400a82a0
nop
call fcn.1400a82a0
int3