Function at 0x140061ca0
Capabilities:
Create process on windows
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x300]
sub rsp, 0x400
mov rax, qword [0x14032a5b0]
xor rax, rsp
mov qword [rbp + 0x2f0], rax
lea rcx, [rbp + 0x10]
call fcn.140060cf0
nop
mov rdx, rax
lea rcx, [rbp - 0x50]
call fcn.140060490
mov rdx, rax
lea rcx, [0x140334558]
call fcn.14006bc00
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140061d38
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061d33
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062d4e
call fcn.14021ad70
xor r12d, r12d
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x50], r12b
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x140061d86
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061d81
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062d54
call fcn.14021ad70
cmp qword [0x140334480], 0xa
jne 0x140062ce6
cmp qword [0x1403344a0], 0x40
jne 0x140062ce6
mov dword [rsp + 0x68], 0x43474101
mov dword [rsp + 0x6c], 0x5844735f
mov word [rsp + 0x70], reloc.WS2_32.dll_select
mov byte [rsp + 0x72], 1
mov rcx, r12
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x27]
xor byte [rsp + rcx + 0x68], al
inc rcx
cmp rcx, 9
jb 0x140061dd0
mov byte [rsp + 0x72], 0
lea rdx, [0x140334470]
lea rcx, [rbp + 0x160]
call fcn.1400608c0
mov r15, rax
mov dword [rsp + 0x58], 0x445e4701
mov dword [rsp + 0x5c], 0x4a445e4e
mov word [rsp + 0x60], reloc.WS2_32.dll_select
mov byte [rsp + 0x62], 1
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx + 0x27]
xor byte [rsp + rcx + 0x58], al
inc rcx
cmp rcx, 9
jb 0x140061e20
mov byte [rsp + 0x62], 0
lea rdx, [0x140334450]
lea rcx, [rbp + 0x140]
call fcn.1400608c0
mov r14, rax
mov dword [rsp + 0x40], 0x47484601
mov dword [rsp + 0x44], 0x100114e
mov rcx, r12
nop
lea eax, [rcx + 0x27]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 6
jb 0x140061e60
mov byte [rsp + 0x47], 0
lea rax, [rbp + 0x240]
mov qword [rsp + 0x38], rax
lea rdx, [0x140334430]
lea rcx, [rbp + 0x240]
call fcn.14006bcd0
mov rdi, rax
lea rax, [rbp + 0x260]
mov qword [rsp + 0x30], rax
lea rdx, [0x140334490]
lea rcx, [rbp + 0x260]
call fcn.14006bcd0
mov rbx, rax
lea rdx, [0x140334558]
lea rcx, [rbp + 0x200]
call fcn.14006bcd0
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x120]
call fcn.140060e40
mov rsi, rax
mov dword [rsp + 0x48], 0x49474d01
mov dword [rsp + 0x4c], 0x13544940
mov word [rsp + 0x50], 0x100
mov rcx, r12
nop
lea eax, [rcx + 0x27]
xor byte [rsp + rcx + 0x48], al
inc rcx
cmp rcx, 8
jb 0x140061f00
mov byte [rsp + 0x51], 0
lea rax, [rbp + 0x30]
mov qword [rbp - 0x78], rax
lea rdx, [0x140334430]
lea rcx, [rbp + 0x30]
call fcn.14006bcd0
mov rdi, rax
lea rax, [rbp + 0x1e0]
mov qword [rsp + 0x38], rax
lea rdx, [0x140334490]
lea rcx, [rbp + 0x1e0]
call fcn.14006bcd0
mov rbx, rax
lea rdx, [0x1403344b0]
lea rcx, [rbp + 0x2b0]
call fcn.14006bcd0
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x100]
call fcn.140060e40
mov rdi, rax
mov dword [rsp + 0x38], 0x584c5e01
mov word [rsp + 0x3c], reloc.WS2_32.dll_shutdown
mov byte [rsp + 0x3e], 1
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx + 0x27]
xor byte [rsp + rcx + 0x38], al
inc rcx
cmp rcx, 5
jb 0x140061fa0
mov byte [rsp + 0x3e], 0
mov dword [rsp + 0x30], 0x5e40464e
mov word [rsp + 0x34], 0x100
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx + 0x27]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 4
jb 0x140061fd0
mov byte [rsp + 0x35], 0
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x58], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x70], 0
lea rax, [rsp + 0x30]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140062010
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x70]
call fcn.14006d370
nop
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0xe0]
call fcn.1400608c0
mov r10, rax
mov dword [rsp + 0x30], 0x4f595153
mov word [rsp + 0x34], reloc.WS2_32.dll_shutdown
mov byte [rsp + 0x36], 1
mov rcx, r12
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x27]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 5
jb 0x140062060
mov byte [rsp + 0x36], 0
lea rax, [rsp + 0x30]
mov r9, rbx
nop dword [rax]
inc r9
cmp byte [rax + r9], 0
jne 0x140062080
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, r10
call fcn.140071210
mov qword [rbp - 0x10], r12
mov qword [rbp], r12
mov qword [rbp + 8], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rax, [rsp + 0x38]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400620d0
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x10]
call fcn.14006bb10
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x20], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, rdi
lea r8, [rbp + 0x10]
lea rcx, [rbp - 0x50]
call fcn.140071320
nop
lea rax, [rsp + 0x48]
mov r8, rbx
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140062120
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x50]
call fcn.14006bb10
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1c0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1d0], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, rsi
lea r8, [rbp + 0x1c0]
lea rcx, [rbp + 0xc0]
call fcn.140071320
nop
lea rax, [rsp + 0x40]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140062180
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0xc0]
call fcn.14006bb10
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1a0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1b0], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, r14
lea r8, [rbp + 0x1a0]
lea rcx, [rbp + 0xa0]
call fcn.140071320
nop
lea rax, [rsp + 0x58]
mov r8, rbx
nop
inc r8
cmp byte [rax + r8], 0
jne 0x1400621e0
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0xa0]
call fcn.14006bb10
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x180], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x190], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, r15
lea r8, [rbp + 0x180]
lea rcx, [rbp + 0x80]
call fcn.140071320
nop
lea rax, [rsp + 0x68]
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140062240
mov r8, rbx
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x80]
call fcn.14006bb10
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x18], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x20], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rdx, [0x140334430]
cmp qword [0x140334448], 0x10
cmovae rdx, qword [0x140334430]
mov r8, qword [0x140334440]
lea rcx, [rbp - 0x30]
call fcn.14006bb10
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x2d0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x2e0], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x14006230d
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062308
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062d5a
call fcn.14021ad70
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x30], 0
mov rdx, qword [rbp + 0x98]
cmp rdx, 0x10
jb 0x14006235e
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062359
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062d60
call fcn.14021ad70
mov qword [rbp + 0x90], r12
mov qword [rbp + 0x98], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x80], 0
mov rdx, qword [rbp + 0x198]
cmp rdx, 0x10
jb 0x1400623b9
inc rdx
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400623b3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062d66
call fcn.14021ad70
nop
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0x10
jb 0x1400623fa
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400623f5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062d6c
call fcn.14021ad70
mov qword [rbp + 0xb0], r12
mov qword [rbp + 0xb8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xa0], 0
mov rdx, qword [rbp + 0x1b8]
cmp rdx, 0x10
jb 0x140062455
inc rdx
mov rcx, qword [rbp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006244f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062d72
call fcn.14021ad70
nop
mov rdx, qword [rbp + 0xd8]
cmp rdx, 0x10
jb 0x140062496
inc rdx
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062491
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062d78
call fcn.14021ad70
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xc0], 0
mov rdx, qword [rbp + 0x1d8]
cmp rdx, 0x10
jb 0x1400624f1
inc rdx
mov rcx, qword [rbp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400624eb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062d7e
call fcn.14021ad70
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x14006252c
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062527
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062d84
call fcn.14021ad70
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x50], 0
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x140062578
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062572
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062d8a
call fcn.14021ad70
nop
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x1400625b3
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400625ae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062d90
call fcn.14021ad70
mov qword [rbp], r12
mov qword [rbp + 8], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x10], 0
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0x10
jb 0x140062604
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400625ff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062d96
call fcn.14021ad70
mov qword [rbp + 0xf0], r12
mov qword [rbp + reloc.WS2_32.dll_ntohs8], 0xf
mov byte [rbp + 0xe0], 0
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x140062658
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062653
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062d9c
call fcn.14021ad70
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x58], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x70], 0
mov rdx, qword [rbp + 0x118]
cmp rdx, 0x10
jb 0x1400626a9
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400626a4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062da2
call fcn.14021ad70
mov qword [rbp + 0x110], r12
mov qword [rbp + 0x118], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x100], 0
mov rdx, qword [rbp + 0x138]
cmp rdx, 0x10
jb 0x140062703
inc rdx
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400626fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062da8
call fcn.14021ad70
mov qword [rbp + 0x130], r12
mov qword [rbp + 0x138], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x120], 0
mov rdx, qword [rbp + 0x158]
cmp rdx, 0x10
jb 0x14006275d
inc rdx
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062758
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062dae
call fcn.14021ad70
mov qword [rbp + 0x150], r12
mov qword [rbp + 0x158], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x140], 0
mov rdx, qword [rbp + 0x178]
cmp rdx, 0x10
jb 0x1400627b7
inc rdx
mov rcx, qword [rbp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400627b2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062db4
call fcn.14021ad70
mov qword [rbp + 0x170], r12
mov qword [rbp + 0x178], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x160], 0
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x80], r12
lea rsi, [rbp + 0x2d0]
mov rdi, qword [rbp + 0x2d0]
mov r15, qword [rbp + 0x2e8]
cmp r15, 0x10
cmovae rsi, rdi
movabs rax, 0x7fffffffffffffff
mov r14, qword [rbp + 0x2e0]
cmp r14, 0x10
jae 0x140062821
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x68], xmm0
mov ebx, reloc.WS2_32.dll_ntohs
jmp 0x14006288e
mov rbx, r14
or rbx, 0xf
cmp rbx, rax
cmova rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14006286b
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140062dba
mov rcx, rax
call fcn.14021aff0
mov rcx, rax
test rax, rax
je 0x140062dc0
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14006287a
test rcx, rcx
je 0x140062877
call fcn.14021aff0
jmp 0x14006287a
mov rax, r12
mov qword [rsp + 0x68], rax
lea r8, [r14 + 1]
mov rdx, rsi
mov rcx, rax
call fcn.14021d160
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x80], rbx
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x280]
call fcn.1400695c0
nop
lea rax, [rbp + 0x2b0]
mov qword [rbp - 0x78], rax
lea rdx, [0x140334430]
lea rcx, [rbp + 0x2b0]
call fcn.14006bcd0
mov r12, rax
lea rax, [rbp + 0x1e0]
mov qword [rsp + 0x40], rax
lea rdx, [0x140334490]
lea rcx, [rbp + 0x1e0]
call fcn.14006bcd0
mov r13, rax
xor eax, eax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov rsi, qword [rbp + 0x290]
lea r14, [rbp + 0x280]
cmp qword [rbp + 0x298], 0x10
cmovae r14, qword [rbp + 0x280]
cmp rsi, 0x10
jae 0x14006292b
movups xmm0, xmmword [r14]
movups xmmword [rbp - 0x70], xmm0
lea ebx, [rax + 0xf]
jmp 0x14006299c
mov rbx, rsi
or rbx, 0xf
movabs rcx, 0x7fffffffffffffff
cmp rbx, rcx
cmova rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14006297f
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140062dc6
mov rcx, rax
call fcn.14021aff0
mov rcx, rax
test rax, rax
je 0x140062dcc
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140062989
test rcx, rcx
je 0x140062989
call fcn.14021aff0
mov qword [rbp - 0x70], rax
lea r8, [rsi + 1]
mov rdx, r14
mov rcx, rax
call fcn.14021d160
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x58], rbx
mov r9, r12
mov r8, r13
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x10]
call fcn.140061140
mov rbx, rax
lea rax, [rbp + 0x280]
cmp rax, rbx
je 0x140062a4c
mov rdx, qword [rbp + 0x298]
cmp rdx, 0x10
jb 0x140062a0b
inc rdx
mov rcx, qword [rbp + 0x280]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062a06
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062dcc
call fcn.14021ad70
xor esi, esi
mov qword [rbp + 0x290], rsi
mov qword [rbp + 0x298], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x280], sil
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x280], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x290], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
jmp 0x140062a4e
xor esi, esi
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x140062a89
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062a84
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062dcc
call fcn.14021ad70
mov qword [rbp + 0x238], rsi
lea r8, [rbp + 0x200]
lea rdx, [rbp + 0x280]
lea rcx, [rbp + 0x2a0]
call fcn.14006e670
nop
lea rdx, str.success
lea rcx, [rbp + 0x2a0]
call fcn.14006e7b0
cmp byte [rax], 4
jne 0x140062dd2
lea rcx, [rbp + 0x2a0]
cmp byte [rax + 8], 0
je 0x140062bc9
lea rdx, str.sessionid
call fcn.14006e7b0
mov rdx, rax
lea rcx, [0x140334538]
call fcn.140077ac0
nop
movzx edx, byte [rbp + 0x2a0]
lea rcx, [rbp + 0x2a8]
call fcn.14006cc70
nop
mov rdx, qword [rbp + 0x298]
cmp rdx, 0x10
jb 0x140062b49
inc rdx
mov rcx, qword [rbp + 0x280]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062b44
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062e23
call fcn.14021ad70
mov qword [rbp + 0x290], rsi
mov qword [rbp + 0x298], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x280], 0
cmp r15, 0x10
jb 0x140062b99
lea rdx, [r15 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140062b91
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062e29
mov rcx, rdi
call fcn.14021ad70
mov rcx, qword [rbp + 0x2f0]
xor rcx, rsp
call fcn.14021ad50
lea r11, [rsp + 0x400]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea rdx, str.message
call fcn.14006e7b0
mov rdi, rax
mov byte [rsp + 0x68], 3
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.14021aff0
mov rbx, rax
mov qword [rax], rsi
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov r8d, 0xa
lea rdx, str.invalidver
mov rcx, rax
call fcn.14006d370
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov rcx, rdi
call fcn.140070e40
movzx ebx, al
movzx edx, byte [rsp + 0x68]
lea rcx, [rsp + 0x70]
call fcn.14006cc70
nop
test bl, bl
jne 0x140062c8e
lea rdx, [0x1402ff174]
call fcn.14006e380
lea rdx, str.message
lea rcx, [rbp + 0x2a0]
call fcn.14006e7b0
mov rdx, rax
lea rcx, [rbp + 0x2b0]
call fcn.14006e9a0
nop
mov rdx, rax
call fcn.14006e9d0
nop
lea rcx, [rbp + 0x2b0]
call fcn.14006bba0
mov ecx, 0x1194
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call fcn.14022a04c
int3
lea rdx, str.download
lea rcx, [rbp + 0x2a0]
call fcn.14006e7b0
lea rdx, [rbp + 0x2b0]
mov rcx, rax
call fcn.14006e8e0
lea rcx, [rbp + 0x2b0]
call fcn.14006bb00
mov r8, rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor ecx, ecx
call fcn.14022a04c
nop
movdqa xmm0, xmmword [0x140300f50]
movdqa xmmword [rbp + 0x30], xmm0
movdqa xmm1, xmmword [0x140300ed0]
movdqa xmmword [rbp + 0x40], xmm1
movdqa xmm0, xmmword [0x140300ef0]
movdqa xmmword [rbp + 0x50], xmm0
movdqa xmm1, xmmword [0x140300e90]
movdqa xmmword [rbp + 0x60], xmm1
mov dword [rbp + 0x70], 0x3082547
mov dword [rbp + 0x74], 0x1e0e4205
mov word [rbp + 0x78], Ordinal_35
mov byte [rbp + 0x7a], 1
lea rdx, [rbp + 0x30]
call fcn.140062e30
mov ecx, 0x1194
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call fcn.14022a04c
nop
call fcn.14022f310
nop
call fcn.14022f310
nop
call fcn.14022f310
nop
call fcn.14022f310
nop
call fcn.14022f310
nop
call fcn.14022f310
nop
call fcn.14022f310
nop
call fcn.14022f310
nop
call fcn.14022f310
nop
call fcn.14022f310
nop
call fcn.14022f310
nop
call fcn.14022f310
nop
call fcn.14022f310
nop
call fcn.14022f310
nop
call fcn.14022f310
nop
call fcn.14022f310
nop
call fcn.14022f310
nop
call fcn.14022f310
int3
call fcn.14005b510
int3
call fcn.14022f310
nop
call fcn.14005b510
int3
call fcn.14022f310
nop
mov rcx, rax
call fcn.14006d170
mov rdx, rax
lea rcx, [rbp + 0x2b0]
call fcn.14006bc90
nop
mov r8, rax
lea rdx, str.type_must_be_boolean__but_is
lea rcx, [rbp + 0x1e0]
call fcn.14006df70
nop
mov r8, rax
mov edx, 0x12e
lea rcx, [rbp + 0x30]
call fcn.14005f660
lea rdx, [0x140323158]
lea rcx, [rbp + 0x30]
call fcn.14021d088
nop
call fcn.14022f310
nop
call fcn.14022f310
int3