Function at 0x140068a00
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x2e0]
sub rsp, 0x3e0
mov rax, qword [0x140340610]
xor rax, rsp
mov qword [rbp + 0x2d8], rax
xor r12d, r12d
lea rcx, [rbp - 0x50]
call fcn.140067800
nop
mov rdx, rax
lea rcx, [rbp - 0x70]
call fcn.140066fb0
mov rbx, rax
lea rsi, [0x14034a590]
cmp rsi, rax
je 0x140068add
mov rdx, qword [0x14034a5a8]
cmp rdx, 0x10
jb 0x140068aa2
mov rcx, qword [0x14034a590]
inc rdx
cmp rdx, 0x1000
jb 0x140068a9d
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400699eb
mov rcx, r8
call fcn.1402267a0
movdqa xmm0, xmmword [0x140315a90]
movdqa xmmword [0x14034a5a0], xmm0
mov byte [0x14034a590], 0
movups xmm0, xmmword [rbx]
movaps xmmword [0x14034a590], xmm0
movups xmm1, xmmword [rbx + 0x10]
movaps xmmword [0x14034a5a0], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x140068b18
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140068b13
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400699eb
call fcn.1402267a0
movdqa xmm0, xmmword [0x140315a90]
movdqu xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x70], 0
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140068b64
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140068b5f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400699f1
call fcn.1402267a0
cmp qword [0x14034a450], 0xa
jne 0x1400699cf
cmp qword [0x14034a470], 0x40
jne 0x1400699cf
mov dword [rsp + 0x68], 0x21292f63
mov dword [rsp + 0x6c], 0x3a22153d
mov word [rsp + reloc.WS2_32.dll_WSASetLastError], 0x70
mov byte [rsp + 0x72], 1
mov rcx, r12
nop
lea eax, [rcx + 0x45]
xor byte [rsp + rcx + 0x68], al
inc rcx
cmp rcx, 9
jb 0x140068ba0
mov byte [rsp + 0x72], 0
lea rdx, [0x14034a440]
lea rcx, [rbp - 0x50]
call fcn.1400673e0
mov r15, rax
mov dword [rsp + 0x58], 0x26302963
mov dword [rsp + 0x5c], 0x2822382c
mov word [rsp + 0x60], reloc.WS2_32.dll_WSASetLastError
mov byte [rsp + 0x62], 1
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx + 0x45]
xor byte [rsp + rcx + 0x58], al
inc rcx
cmp rcx, 9
jb 0x140068bf0
mov byte [rsp + 0x62], 0
lea rdx, [0x14034a420]
lea rcx, [rbp + 0x170]
call fcn.1400673e0
mov r14, rax
mov dword [rsp + 0x40], 0x25262863
mov dword [rsp + 0x44], 0x100772c
mov rcx, r12
nop
lea eax, [rcx + 0x45]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 6
jb 0x140068c30
mov byte [rsp + 0x47], 0
lea rax, [rbp + 0x228]
mov qword [rsp + 0x38], rax
lea rdx, [0x14034a3d8]
lea rcx, [rbp + 0x228]
call fcn.14005fe40
mov rdi, rax
lea rax, [rbp + 0x248]
mov qword [rsp + 0x30], rax
lea rdx, [0x14034a460]
lea rcx, [rbp + 0x248]
call fcn.14005fe40
mov rbx, rax
mov rdx, rsi
lea rcx, [rbp + 0x1e8]
call fcn.14005fe40
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x150]
call fcn.140067980
mov rsi, rax
mov dword [rsp + 0x48], 0x2b292363
mov dword [rsp + 0x4c], 0x71322f22
mov word [rsp + 0x50], 0x100
mov rcx, r12
nop dword [rax + rax]
lea eax, [rcx + 0x45]
xor byte [rsp + rcx + 0x48], al
inc rcx
cmp rcx, 8
jb 0x140068cd0
mov byte [rsp + 0x51], 0
lea rax, [rbp + 0x1b0]
mov qword [rbp - 0x78], rax
lea rdx, [0x14034a3d8]
lea rcx, [rbp + 0x1b0]
call fcn.14005fe40
mov rdi, rax
lea rax, [rbp + 0x190]
mov qword [rsp + 0x38], rax
lea rdx, [0x14034a460]
lea rcx, [rbp + 0x190]
call fcn.14005fe40
mov rbx, rax
lea rdx, [0x14034a480]
lea rcx, [rbp + 0x298]
call fcn.14005fe40
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x130]
call fcn.140067980
mov rdi, rax
mov dword [rsp + 0x38], 0x3a223063
mov word [rsp + 0x3c], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0x3e], 1
mov rcx, r12
nop dword [rax + rax]
lea eax, [rcx + 0x45]
xor byte [rsp + rcx + 0x38], al
inc rcx
cmp rcx, 5
jb 0x140068d70
mov byte [rsp + 0x3e], 0
mov dword [rsp + 0x30], 0x3c2e282c
mov word [rsp + 0x34], 0x100
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx + 0x45]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 4
jb 0x140068da0
mov byte [rsp + 0x35], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x20], xmm1
lea rax, [rsp + 0x30]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x140068dd3
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x10]
call fcn.140061b70
nop
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x110]
call fcn.1400673e0
mov r10, rax
mov dword [rsp + 0x30], 0x2d373f31
mov word [rsp + 0x34], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0x36], 1
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx + 0x45]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 5
jb 0x140068e20
mov byte [rsp + 0x36], 0
lea rax, [rsp + 0x30]
mov r9, rbx
nop dword [rax]
inc r9
cmp byte [rax + r9], 0
jne 0x140068e40
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, r10
call fcn.14007be50
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rax, [rsp + 0x38]
mov r8, rbx
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140068e90
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x10]
call fcn.1400607d0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xf0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x100], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, rdi
lea r8, [rbp + 0xf0]
lea rcx, [rbp - 0x70]
call fcn.14007bf50
nop
lea rax, [rsp + 0x48]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140068ef0
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x70]
call fcn.1400607d0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xd0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xe0], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, rsi
lea r8, [rbp + 0xd0]
lea rcx, [rbp + 0x70]
call fcn.14007bf50
nop
lea rax, [rsp + 0x40]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140068f50
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x70]
call fcn.1400607d0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xb0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xc0], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, r14
lea r8, [rbp + 0xb0]
lea rcx, [rbp + 0x50]
call fcn.14007bf50
nop
lea rax, [rsp + 0x58]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140068fb0
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x50]
call fcn.1400607d0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x90], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xa0], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, r15
lea r8, [rbp + 0x90]
lea rcx, [rbp + 0x30]
call fcn.14007bf50
nop
lea rax, [rsp + 0x68]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140069005
mov r8, rbx
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x30]
call fcn.1400607d0
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x20], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rdx, [0x14034a3d8]
cmp qword [0x14034a3f0], 0x10
cmovae rdx, qword [0x14034a3d8]
mov r8, qword [0x14034a3e8]
lea rcx, [rbp - 0x30]
call fcn.1400607d0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x2b8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x2c8], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400690d2
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400690cd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400699f7
call fcn.1402267a0
movdqa xmm0, xmmword [0x140315a90]
movdqu xmmword [rbp - 0x20], xmm0
mov byte [rbp - 0x30], 0
mov rdx, qword [rbp + 0x48]
cmp rdx, 0x10
jb 0x14006911e
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140069119
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400699fd
call fcn.1402267a0
movdqa xmm0, xmmword [0x140315a90]
movdqu xmmword [rbp + 0x40], xmm0
mov byte [rbp + 0x30], 0
mov rdx, qword [rbp + 0xa8]
cmp rdx, 0x10
jb 0x140069171
inc rdx
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006916b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140069a03
call fcn.1402267a0
nop
mov rdx, qword [rbp + 0x68]
cmp rdx, 0x10
jb 0x1400691ac
inc rdx
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400691a7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140069a09
call fcn.1402267a0
movdqa xmm0, xmmword [0x140315a90]
movdqu xmmword [rbp + 0x60], xmm0
mov byte [rbp + 0x50], 0
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0x10
jb 0x1400691ff
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400691f9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140069a0f
call fcn.1402267a0
nop
mov rdx, qword [rbp + 0x88]
cmp rdx, 0x10
jb 0x14006923d
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140069238
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140069a15
call fcn.1402267a0
movdqa xmm0, xmmword [0x140315a90]
movdqu xmmword [rbp + 0x80], xmm0
mov byte [rbp + 0x70], 0
mov rdx, qword [rbp + 0xe8]
cmp rdx, 0x10
jb 0x140069293
inc rdx
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006928d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140069a1b
call fcn.1402267a0
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x1400692ce
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400692c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140069a21
call fcn.1402267a0
movdqa xmm0, xmmword [0x140315a90]
movdqu xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x70], 0
mov rdx, qword [rbp + 0x108]
cmp rdx, 0x10
jb 0x140069321
inc rdx
mov rcx, qword [rbp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006931b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140069a27
call fcn.1402267a0
nop
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x14006935c
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140069357
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140069a2d
call fcn.1402267a0
movdqa xmm0, xmmword [0x140315a90]
movdqu xmmword [rbp], xmm0
mov byte [rbp - 0x10], 0
mov rdx, qword [rbp + 0x128]
cmp rdx, 0x10
jb 0x1400693ae
inc rdx
mov rcx, qword [rbp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400693a9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140069a33
call fcn.1402267a0
movdqa xmm0, xmmword [0x140315a90]
movdqu xmmword [rbp + 0x120], xmm0
mov byte [rbp + 0x110], 0
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x140069400
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400693fb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140069a39
call fcn.1402267a0
movdqa xmm0, xmmword [0x140315a90]
movdqu xmmword [rbp + 0x20], xmm0
mov byte [rbp + 0x10], 0
mov rdx, qword [rbp + 0x148]
cmp rdx, 0x10
jb 0x140069452
inc rdx
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006944d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140069a3f
call fcn.1402267a0
movdqa xmm0, xmmword [0x140315a90]
movdqu xmmword [rbp + 0x140], xmm0
mov byte [rbp + 0x130], 0
mov rdx, qword [rbp + 0x168]
cmp rdx, 0x10
jb 0x1400694aa
inc rdx
mov rcx, qword [rbp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400694a5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140069a45
call fcn.1402267a0
movdqa xmm0, xmmword [0x140315a90]
movdqu xmmword [rbp + 0x160], xmm0
mov byte [rbp + 0x150], 0
mov rdx, qword [rbp + 0x188]
cmp rdx, 0x10
jb 0x140069502
inc rdx
mov rcx, qword [rbp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400694fd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140069a4b
call fcn.1402267a0
movdqa xmm0, xmmword [0x140315a90]
movdqu xmmword [rbp + 0x180], xmm0
mov byte [rbp + 0x170], 0
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140069554
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006954f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140069a51
call fcn.1402267a0
movdqa xmm0, xmmword [0x140315a90]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x80], r12
lea r14, [rbp + 0x2b8]
mov rsi, qword [rbp + 0x2b8]
mov r15, qword [rbp + 0x2d0]
cmp r15, 0x10
cmovae r14, rsi
movabs rbx, 0x7fffffffffffffff
mov rdi, qword [rbp + 0x2c8]
cmp rdi, rbx
ja 0x140069a57
mov qword [rbp - 0x80], reloc.WS2_32.dll_ntohs
cmp rdi, 0x10
jae 0x1400695ce
mov qword [rsp + 0x78], rdi
movups xmm0, xmmword [r14]
movups xmmword [rsp + 0x68], xmm0
jmp 0x140069661
mov rax, rdi
or rax, 0xf
cmp rax, rbx
jbe 0x14006960a
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140226a40
mov rcx, rax
test rax, rax
je 0x140069a5d
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140069644
mov rbx, rax
mov ecx, reloc.WS2_32.dll_shutdown
cmp rax, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140069635
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140069978
jmp 0x1400695e8
test rcx, rcx
je 0x140069641
call fcn.140226a40
jmp 0x140069644
mov rax, r12
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x80], rbx
lea r8, [rdi + 1]
mov rdx, r14
mov rcx, rax
call fcn.140228be0
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x278]
call fcn.14006cd80
nop
lea rax, [rbp + 0x298]
mov qword [rbp - 0x78], rax
lea rdx, [0x14034a3d8]
lea rcx, [rbp + 0x298]
call fcn.14005fe40
mov rdi, rax
lea rax, [rbp + 0x190]
mov qword [rsp + 0x40], rax
lea rdx, [0x14034a460]
lea rcx, [rbp + 0x190]
call fcn.14005fe40
mov rbx, rax
lea rdx, [rbp + 0x278]
lea rcx, [rbp + 0x1b0]
call fcn.14005fe40
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp - 0x50]
call fcn.140067d30
mov rbx, rax
lea rax, [rbp + 0x278]
cmp rax, rbx
je 0x140069767
mov rdx, qword [rbp + 0x290]
cmp rdx, 0x10
jb 0x14006972c
inc rdx
mov rcx, qword [rbp + 0x278]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140069727
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140069a63
call fcn.1402267a0
movdqa xmm0, xmmword [0x140315a90]
movdqu xmmword [rbp + 0x288], xmm0
mov byte [rbp + 0x278], 0
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x278], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x288], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x1400697a2
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006979d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140069a63
call fcn.1402267a0
mov qword [rbp + 0x220], r12
lea r8, [rbp + 0x1e8]
lea rdx, [rbp + 0x278]
lea rcx, [rbp + 0x268]
call fcn.140079150
nop
lea rdx, str.success
lea rcx, [rbp + 0x268]
call fcn.140079270
cmp byte [rax], 4
jne 0x140069a69
lea rcx, [rbp + 0x268]
cmp byte [rax + 8], 0
je 0x1400698e0
lea rdx, str.sessionid
call fcn.140079270
mov rdx, rax
lea rcx, [0x14034a570]
call fcn.1400793b0
nop
movzx edx, byte [rbp + 0x268]
lea rcx, [rbp + 0x270]
call fcn.140077a20
nop
mov rdx, qword [rbp + 0x290]
cmp rdx, 0x10
jb 0x140069862
inc rdx
mov rcx, qword [rbp + 0x278]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006985d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140069ac0
call fcn.1402267a0
movdqa xmm0, xmmword [0x140315a90]
movdqu xmmword [rbp + 0x288], xmm0
mov byte [rbp + 0x278], 0
cmp r15, 0x10
jb 0x1400698b0
lea rdx, [r15 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400698a8
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140069ac6
mov rcx, rsi
call fcn.1402267a0
mov rcx, qword [rbp + 0x2d8]
xor rcx, rsp
call fcn.140226780
lea r11, [rsp + 0x3e0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
lea rdx, str.message
call fcn.140079270
mov rdi, rax
mov byte [rsp + 0x68], 3
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.140226a40
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], r12
mov r8d, 0xa
lea rdx, str.invalidver
mov rcx, rax
call fcn.140061b70
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov rcx, rdi
call fcn.14007b9d0
movzx ebx, al
movzx edx, byte [rsp + 0x68]
lea rcx, [rsp + 0x70]
call fcn.140077a20
nop
lea rcx, [rbp + 0x268]
test bl, bl
jne 0x14006997e
lea rdx, str._Ghost__message
call fcn.140079270
lea rdx, [rbp + 0x298]
mov rcx, rax
call fcn.140079480
mov rcx, rax
call fcn.14006cd10
nop
call fcn.14005b450
nop
lea rdx, str.download
call fcn.140079270
lea rdx, [rbp + 0x298]
mov rcx, rax
call fcn.140079480
lea rcx, [rbp + 0x298]
call fcn.14005fd90
mov r8, rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor ecx, ecx
call fcn.140238028
nop
lea rdx, str._Ghost__Application_Not_Setup_Correctly.Please_Watch_Video_Linked_in_Main.cpp
lea rcx, [rbp + 0x298]
call fcn.14005fe00
mov rcx, rax
call fcn.14006cd10
nop
call fcn.140237b6c
nop
call fcn.140237b6c
nop
call fcn.140237b6c
nop
call fcn.140237b6c
nop
call fcn.140237b6c
nop
call fcn.140237b6c
nop
call fcn.140237b6c
nop
call fcn.140237b6c
nop
call fcn.140237b6c
nop
call fcn.140237b6c
nop
call fcn.140237b6c
nop
call fcn.140237b6c
nop
call fcn.140237b6c
nop
call fcn.140237b6c
nop
call fcn.140237b6c
nop
call fcn.140237b6c
nop
call fcn.140237b6c
nop
call fcn.140237b6c
int3
call fcn.14005b4f0
int3
call fcn.140237b6c
nop
call fcn.140237b6c
nop
mov rcx, rax
call fcn.140077f10
mov rdx, rax
lea rcx, [rbp + 0x298]
call fcn.14005fe00
nop
mov r8, rax
lea rdx, str.type_must_be_boolean__but_is
lea rcx, [rbp + 0x190]
call fcn.140078a70
nop
mov r8, rax
mov edx, 0x12e
lea rcx, [rbp + 0x1b0]
call fcn.1400660a0
lea rdx, [0x140338e38]
lea rcx, [rbp + 0x1b0]
call fcn.140228b0c
nop
call fcn.140237b6c
nop
call fcn.140237b6c
int3