Function at 0x1400618f0
Capabilities:
Create process on windows
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x348]
sub rsp, 0x420
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [0x14037d600]
xor rax, rsp
mov qword [rbp + 0x2f0], rax
mov r13, rcx
xor edi, edi
lea rcx, [rbp - 0x50]
call fcn.1400607a0
nop
mov rdx, rax
lea rcx, [rbp - 0x70]
call fcn.1400600d0
mov rbx, rax
lea rsi, [r13 + 0x108]
cmp rsi, rax
je 0x1400619bf
mov rdx, qword [rsi + 0x18]
cmp rdx, 0xf
jbe 0x140061993
mov rcx, qword [rsi]
inc rdx
cmp rdx, 0x1000
jb 0x14006198e
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140062978
mov rcx, r8
call fcn.1402620a8
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], 0
movups xmm0, xmmword [rbx]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsi + 0x10], xmm1
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x1400619fa
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400619f5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062978
call fcn.1402620a8
movdqa xmm0, xmmword [0x14034e300]
movdqu xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x70], 0
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x140061a46
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061a41
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006297e
call fcn.1402620a8
cmp qword [r13 + 0x30], 0xa
jne 0x140062910
cmp qword [r13 + 0x50], 0x40
jne 0x140062910
mov dword [rsp + 0x68], 0x7b7f7929
mov dword [rsp + 0x6c], 0x607c4b67
mov word [rsp + 0x70], Ordinal_45
mov byte [rsp + 0x72], 1
mov rcx, rdi
nop dword [rax + rax]
lea eax, [rcx + 0xf]
xor byte [rsp + rcx + 0x68], al
inc rcx
cmp rcx, 9
jb 0x140061a80
mov byte [rsp + 0x72], 0
lea rdx, [r13 + 0x20]
lea rcx, [rbp - 0x50]
call fcn.140060500
mov r15, rax
mov dword [rsp + 0x58], 0x7c667f29
mov dword [rsp + 0x5c], 0x727c6676
mov word [rsp + 0x60], Ordinal_45
mov byte [rsp + 0x62], 1
mov rcx, rdi
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx + 0xf]
xor byte [rsp + rcx + 0x58], al
inc rcx
cmp rcx, 9
jb 0x140061ad0
mov byte [rsp + 0x62], 0
mov rdx, r13
lea rcx, [rbp + 0x1c0]
call fcn.140060500
mov r14, rax
mov dword [rsp + 0x40], 0x7f707e29
mov dword [rsp + 0x44], 0x1002976
mov rcx, rdi
nop word [rax + rax]
lea eax, [rcx + 0xf]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 6
jb 0x140061b10
mov byte [rsp + 0x47], 0
lea rax, [rbp + 0x240]
mov qword [rsp + 0x38], rax
lea rdx, [0x140387688]
lea rcx, [rbp + 0x240]
call fcn.140073f10
mov rdi, rax
lea rax, [rbp + 0x260]
mov qword [rsp + 0x30], rax
lea rdx, [r13 + 0x40]
lea rcx, [rbp + 0x260]
call fcn.140073f10
mov rbx, rax
mov rdx, rsi
lea rcx, [rbp + 0x200]
call fcn.140073f10
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x1a0]
call fcn.140060920
mov rsi, rax
mov dword [rsp + 0x48], 0x717f7529
mov dword [rsp + 0x4c], 0x2b6c7178
mov word [rsp + 0x50], 0x100
xor ecx, ecx
nop word [rax + rax]
lea eax, [rcx + 0xf]
xor byte [rsp + rcx + 0x48], al
inc rcx
cmp rcx, 8
jb 0x140061bb0
mov byte [rsp + 0x51], 0
lea rax, [rbp - 0x30]
mov qword [rbp - 0x78], rax
lea rdx, [0x140387688]
lea rcx, [rbp - 0x30]
call fcn.140073f10
mov rdi, rax
lea rax, [rbp + 0x1e0]
mov qword [rsp + 0x38], rax
lea rdx, [r13 + 0x40]
lea rcx, [rbp + 0x1e0]
call fcn.140073f10
mov rbx, rax
lea rdx, [r13 + 0x60]
lea rcx, [rbp + 0x2b0]
call fcn.140073f10
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x180]
call fcn.140060920
mov rdi, rax
mov dword [rsp + 0x38], 0x60746629
mov word [rsp + 0x3c], reloc.WLDAP32.dll_Ordinal_46
mov byte [rsp + 0x3e], 1
xor ecx, ecx
nop
lea eax, [rcx + 0xf]
xor byte [rsp + rcx + 0x38], al
inc rcx
cmp rcx, 5
jb 0x140061c40
mov byte [rsp + 0x3e], 0
mov dword [rsp + 0x30], 0x66787e66
mov word [rsp + 0x34], 0x100
xor ecx, ecx
nop word [rax + rax]
lea eax, [rcx + 0xf]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 4
jb 0x140061c70
mov byte [rsp + 0x35], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x70], xmm1
lea rax, [rsp + 0x30]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x140061ca3
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x60]
call fcn.140077320
nop
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x160]
call fcn.140060500
mov r10, rax
mov dword [rsp + 0x30], 0x7761697b
mov word [rsp + 0x34], reloc.WLDAP32.dll_Ordinal_46
mov byte [rsp + 0x36], 1
xor ecx, ecx
nop word [rax + rax]
lea eax, [rcx + 0xf]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 5
jb 0x140061cf0
mov byte [rsp + 0x36], 0
lea rax, [rsp + 0x30]
mov r9, rbx
nop dword [rax]
inc r9
cmp byte [rax + r9], 0
jne 0x140061d10
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, r10
call fcn.140078690
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x50], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x50], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rax, [rsp + 0x38]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x140061d62
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x40]
call fcn.140073de0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x140], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x150], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, rdi
lea r8, [rbp + 0x140]
lea rcx, [rbp - 0x70]
call fcn.140078790
nop
lea rax, [rsp + 0x48]
mov r8, rbx
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140061dc0
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x70]
call fcn.140073de0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x120], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x130], xmm1
xor edi, edi
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], dil
mov r9, rsi
lea r8, [rbp + 0x120]
lea rcx, [rbp + 0xc0]
call fcn.140078790
nop
lea rax, [rsp + 0x40]
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140061e20
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0xc0]
call fcn.140073de0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x100], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x110], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, r14
lea r8, [rbp + 0x100]
lea rcx, [rbp + 0xa0]
call fcn.140078790
nop
lea rax, [rsp + 0x58]
mov r8, rbx
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140061e80
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0xa0]
call fcn.140073de0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xe0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xf0], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, r15
lea r8, [rbp + 0xe0]
lea rcx, [rbp + 0x80]
call fcn.140078790
nop
lea rax, [rsp + 0x68]
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140061ee0
mov r8, rbx
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x80]
call fcn.140073de0
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x30], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x30], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rdx, [0x140387688]
cmp qword [0x1403876a0], 0xf
cmova rdx, qword [0x140387688]
mov r8, qword [0x140387698]
lea rcx, [rbp + 0x20]
call fcn.140073de0
movups xmm7, xmmword [rax]
movups xmmword [rbp + 0x2d0], xmm7
movups xmm6, xmmword [rax + 0x10]
movups xmmword [rbp + 0x2e0], xmm6
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x140061fb0
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061fab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062984
call fcn.1402620a8
movdqa xmm0, xmmword [0x14034e300]
movdqu xmmword [rbp + 0x30], xmm0
mov byte [rbp + 0x20], 0
mov rdx, qword [rbp + 0x98]
cmp rdx, 0xf
jbe 0x140062002
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061ffd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006298a
call fcn.1402620a8
movdqa xmm0, xmmword [0x14034e300]
movdqu xmmword [rbp + 0x90], xmm0
mov byte [rbp + 0x80], 0
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0xf
jbe 0x14006205b
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062055
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062990
call fcn.1402620a8
nop
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0xf
jbe 0x14006209c
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062097
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062996
call fcn.1402620a8
movdqa xmm0, xmmword [0x14034e300]
movdqu xmmword [rbp + 0xb0], xmm0
mov byte [rbp + 0xa0], 0
mov rdx, qword [rbp + 0x118]
cmp rdx, 0xf
jbe 0x1400620f5
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400620ef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006299c
call fcn.1402620a8
nop
mov rdx, qword [rbp + 0xd8]
cmp rdx, 0xf
jbe 0x140062136
inc rdx
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062131
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400629a2
call fcn.1402620a8
movdqa xmm0, xmmword [0x14034e300]
movdqu xmmword [rbp + 0xd0], xmm0
mov byte [rbp + 0xc0], 0
mov rdx, qword [rbp + 0x138]
cmp rdx, 0xf
jbe 0x14006218f
inc rdx
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062189
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400629a8
call fcn.1402620a8
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x1400621ca
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400621c5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400629ae
call fcn.1402620a8
movdqa xmm0, xmmword [0x14034e300]
movdqu xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x70], 0
mov rdx, qword [rbp + 0x158]
cmp rdx, 0xf
jbe 0x14006221d
inc rdx
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062217
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400629b4
call fcn.1402620a8
nop
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x140062258
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062253
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400629ba
call fcn.1402620a8
movdqa xmm0, xmmword [0x14034e300]
movdqu xmmword [rbp + 0x50], xmm0
mov byte [rbp + 0x40], 0
mov rdx, qword [rbp + 0x178]
cmp rdx, 0xf
jbe 0x1400622aa
inc rdx
mov rcx, qword [rbp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400622a5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400629c0
call fcn.1402620a8
movdqa xmm0, xmmword [0x14034e300]
movdqu xmmword [rbp + 0x170], xmm0
mov byte [rbp + 0x160], 0
mov rdx, qword [rbp + 0x78]
cmp rdx, 0xf
jbe 0x1400622fc
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400622f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400629c6
call fcn.1402620a8
movdqa xmm0, xmmword [0x14034e300]
movdqu xmmword [rbp + 0x70], xmm0
mov byte [rbp + 0x60], 0
mov rdx, qword [rbp + 0x198]
cmp rdx, 0xf
jbe 0x14006234e
inc rdx
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062349
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400629cc
call fcn.1402620a8
movdqa xmm0, xmmword [0x14034e300]
movdqu xmmword [rbp + 0x190], xmm0
mov byte [rbp + 0x180], 0
mov rdx, qword [rbp + 0x1b8]
cmp rdx, 0xf
jbe 0x1400623a6
inc rdx
mov rcx, qword [rbp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400623a1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400629d2
call fcn.1402620a8
movdqa xmm0, xmmword [0x14034e300]
movdqu xmmword [rbp + 0x1b0], xmm0
mov byte [rbp + 0x1a0], 0
mov rdx, qword [rbp + 0x1d8]
cmp rdx, 0xf
jbe 0x1400623fe
inc rdx
mov rcx, qword [rbp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400623f9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400629d8
call fcn.1402620a8
movdqa xmm0, xmmword [0x14034e300]
movdqu xmmword [rbp + 0x1d0], xmm0
mov byte [rbp + 0x1c0], 0
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x140062450
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006244b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400629de
call fcn.1402620a8
movdqa xmm0, xmmword [0x14034e300]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x80], rdi
lea r14, [rbp + 0x2d0]
movq rsi, xmm7
movdqa xmm0, xmm6
psrldq xmm0, 8
movq r15, xmm0
cmp r15, 0xf
cmova r14, rsi
movabs rbx, 0x7fffffffffffffff
movq rdi, xmm6
cmp rdi, rbx
ja 0x1400629e4
mov qword [rbp - 0x80], reloc.WS2_32.dll_ntohs
cmp rdi, 0xf
ja 0x1400624cd
mov qword [rsp + 0x78], rdi
movups xmm0, xmmword [r14]
movups xmmword [rsp + 0x68], xmm0
jmp 0x14006255f
mov rax, rdi
or rax, 0xf
cmp rax, rbx
jbe 0x140062509
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140261bb0
mov rcx, rax
test rax, rax
je 0x1400629ea
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140062542
mov rbx, rax
mov ecx, reloc.WS2_32.dll_shutdown
cmp rax, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140062534
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400628b2
jmp 0x1400624e7
test rcx, rcx
je 0x140062540
call fcn.140261bb0
jmp 0x140062542
xor eax, eax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x80], rbx
lea r8, [rdi + 1]
mov rdx, r14
mov rcx, rax
call fcn.1402a2bc0
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x290]
call fcn.140063e50
nop
lea rax, [rbp + 0x2b0]
mov qword [rbp - 0x78], rax
lea rdx, [0x140387688]
lea rcx, [rbp + 0x2b0]
call fcn.140073f10
mov rdi, rax
lea rax, [rbp + 0x1e0]
mov qword [rsp + 0x40], rax
lea rdx, [r13 + 0x40]
lea rcx, [rbp + 0x1e0]
call fcn.140073f10
mov rbx, rax
lea rdx, [rbp + 0x290]
lea rcx, [rbp - 0x30]
call fcn.140073f10
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp - 0x50]
call fcn.140060cd0
mov rbx, rax
lea rax, [rbp + 0x290]
cmp rax, rbx
je 0x140062668
mov rdx, qword [rbp + 0x2a8]
cmp rdx, 0xf
jbe 0x140062628
inc rdx
mov rcx, qword [rbp + 0x290]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062623
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400629f0
call fcn.1402620a8
movdqa xmm0, xmmword [0x14034e300]
movdqu xmmword [rbp + 0x2a0], xmm0
mov byte [rbp + 0x290], 0
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x290], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x2a0], xmm1
xor r14d, r14d
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r14b
jmp 0x14006266b
xor r14d, r14d
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x1400626a6
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400626a1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400629f0
call fcn.1402620a8
mov qword [rbp + 0x238], r14
lea r8, [rbp + 0x200]
lea rdx, [rbp + 0x290]
lea rcx, [rbp + 0x280]
call fcn.140076940
nop
lea rdx, str.success
lea rcx, [rbp + 0x280]
call fcn.140076a60
cmp byte [rax], 4
jne 0x1400629f6
lea rcx, [rbp + 0x280]
cmp byte [rax + 8], 0
je 0x1400627ee
lea rdx, str.sessionid
call fcn.140076a60
mov rdx, rax
lea rcx, [r13 + 0xe8]
call fcn.140076c90
nop
movzx edx, byte [rbp + 0x280]
lea rcx, [rbp + 0x288]
call fcn.140075260
nop
mov rdx, qword [rbp + 0x2a8]
cmp rdx, 0xf
jbe 0x140062766
inc rdx
mov rcx, qword [rbp + 0x290]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062761
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062a47
call fcn.1402620a8
movdqa xmm0, xmmword [0x14034e300]
movdqu xmmword [rbp + 0x2a0], xmm0
mov byte [rbp + 0x290], 0
cmp r15, 0xf
jbe 0x1400627b4
lea rdx, [r15 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400627ac
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062a4d
mov rcx, rsi
call fcn.1402620a8
mov rcx, qword [rbp + 0x2f0]
xor rcx, rsp
call fcn.140261800
lea r11, [rsp + 0x420]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea rdx, str.message
call fcn.140076a60
mov rdi, rax
mov byte [rsp + 0x68], 3
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.140261bb0
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], r14
mov r8d, 0xa
lea rdx, str.invalidver
mov rcx, rax
call fcn.140077320
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov rcx, rdi
call fcn.1400782c0
movzx ebx, al
movzx edx, byte [rsp + 0x68]
lea rcx, [rsp + 0x70]
call fcn.140075260
nop
test bl, bl
jne 0x1400628b8
lea rdx, [0x14034611c]
call fcn.140076660
lea rdx, str.message
lea rcx, [rbp + 0x280]
call fcn.140076a60
mov rdx, rax
lea rcx, [rbp + 0x2b0]
call fcn.140076e40
nop
mov rdx, rax
call fcn.140076ee0
nop
lea rcx, [rbp + 0x2b0]
call fcn.140073e70
mov ecx, 0x1194
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call fcn.140271564
nop
call fcn.14005b650
nop
lea rdx, str.download
lea rcx, [rbp + 0x280]
call fcn.140076a60
lea rdx, [rbp + 0x2b0]
mov rcx, rax
call fcn.140076d60
lea rcx, [rbp + 0x2b0]
call fcn.140073dd0
mov r8, rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor ecx, ecx
call fcn.140271564
nop
movdqa xmm0, xmmword [0x14034e460]
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmm1, xmmword [0x14034e490]
movdqa xmmword [rbp - 0x20], xmm1
movdqa xmm0, xmmword [0x14034e480]
movdqa xmmword [rbp - 0x10], xmm0
movdqa xmm1, xmmword [0x14034e3e0]
movdqa xmmword [rbp], xmm1
mov dword [rbp + 0x10], 0x3b301d6f
mov dword [rbp + 0x14], 0x26367a3d
mov word [rbp + 0x18], Ordinal_41
mov byte [rbp + 0x1a], 1
lea rdx, [rbp - 0x30]
call fcn.140062a60
mov ecx, 0x1194
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call fcn.140271564
nop
call fcn.1402770c0
nop
call fcn.1402770c0
nop
call fcn.1402770c0
nop
call fcn.1402770c0
nop
call fcn.1402770c0
nop
call fcn.1402770c0
nop
call fcn.1402770c0
nop
call fcn.1402770c0
nop
call fcn.1402770c0
nop
call fcn.1402770c0
nop
call fcn.1402770c0
nop
call fcn.1402770c0
nop
call fcn.1402770c0
nop
call fcn.1402770c0
nop
call fcn.1402770c0
nop
call fcn.1402770c0
nop
call fcn.1402770c0
nop
call fcn.1402770c0
int3
call fcn.14005b6f0
int3
call fcn.1402770c0
nop
call fcn.1402770c0
nop
mov rcx, rax
call fcn.140075760
mov rdx, rax
lea rcx, [rbp + 0x2b0]
call fcn.140073ed0
nop
mov r8, rax
lea rdx, str.type_must_be_boolean__but_is
lea rcx, [rbp + 0x1e0]
call fcn.140076240
nop
mov r8, rax
mov edx, 0x12e
lea rcx, [rbp - 0x30]
call fcn.14005f1a0
lea rdx, [0x140376038]
lea rcx, [rbp - 0x30]
call fcn.140263dd0
nop
call fcn.1402770c0
nop
call fcn.1402770c0
int3