Function at 0x180020de0
Capabilities:
Delete file
Encode data using xor
Get common file path
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x588]
sub rsp, 0x688
mov qword [rbp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x180067008]
xor rax, rsp
mov qword [rbp + 0x570], rax
mov rsi, r9
mov qword [rbp - 0x30], r9
mov rdi, r8
mov rbx, rdx
mov qword [rbp - 0x28], rcx
xor r14d, r14d
cmp qword [r9 + 0x10], r14
jne 0x18002108d
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x150]
call fcn.180037440
lea rdx, [rbp + 0x150]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rcx, [rbp + 0x150]
call qword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x360]
call fcn.180037440
lea rcx, [rbp + 0x108]
call fcn.180033670
nop
cmp qword [rax + 0x18], 0x10
jb 0x180020e91
mov rax, qword [rax]
mov qword [rbp + 0x78], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x70], r14
mov byte [rbp + 0x60], 0
cmp byte [rax], 0
jne 0x180020eab
mov r8, r14
jmp 0x180020eba
or r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x180020eb0
mov rdx, rax
lea rcx, [rbp + 0x60]
call fcn.1800020b0
nop
lea rdx, [rbp + 0x60]
lea rcx, [rbp - 0x80]
call fcn.180033260
cmp qword [rax + 0x18], 8
jb 0x180020ede
mov rax, qword [rax]
mov r8, rax
lea rdx, [0x180059218]
lea rcx, [rbp + 0x360]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rax, qword [rbp - 0x68]
cmp rax, 8
jb 0x180020f64
inc rax
mov rcx, qword [rbp - 0x80]
movabs rdx, 0x7fffffffffffffff
cmp rax, rdx
jbe 0x180020f1b
call fcn.18003835c
int3
add rax, rax
cmp rax, 0x1000
jb 0x180020f5f
test byte [rbp - 0x80], 0x1f
je 0x180020f32
call fcn.18003835c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x180020f41
call fcn.18003835c
int3
sub rcx, rax
cmp rcx, 8
jae 0x180020f50
call fcn.18003835c
int3
cmp rcx, 0x27
jbe 0x180020f5c
call fcn.18003835c
int3
mov rcx, rax
call fcn.180033ed0
mov qword [rbp - 0x68], 7
mov qword [rbp - 0x70], r14
mov word [rbp - 0x80], r14w
mov rax, qword [rbp + 0x78]
cmp rax, 0x10
jb 0x180020fcb
inc rax
mov rcx, qword [rbp + 0x60]
cmp rax, 0x1000
jb 0x180020fc6
test cl, 0x1f
je 0x180020f99
call fcn.18003835c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x180020fa8
call fcn.18003835c
int3
sub rcx, rax
cmp rcx, 8
jae 0x180020fb7
call fcn.18003835c
int3
cmp rcx, 0x27
jbe 0x180020fc3
call fcn.18003835c
int3
mov rcx, rax
call fcn.180033ed0
mov qword [rbp + 0x78], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x70], r14
mov byte [rbp + 0x60], 0
mov rax, qword [rbp + 0x120]
cmp rax, 0x10
jb 0x180021037
inc rax
mov rcx, qword [rbp + 0x108]
cmp rax, 0x1000
jb 0x180021032
test cl, 0x1f
je 0x180021005
call fcn.18003835c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x180021014
call fcn.18003835c
int3
sub rcx, rax
cmp rcx, 8
jae 0x180021023
call fcn.18003835c
int3
cmp rcx, 0x27
jbe 0x18002102f
call fcn.18003835c
int3
mov rcx, rax
call fcn.180033ed0
lea r9, [rbp + 0x360]
lea r8, [rbp + 0x150]
lea rdx, str._s_s
lea rcx, [rbp + 0x150]
call qword [sym.imp.USER32.dll_wsprintfW]
cmp word [rbp + 0x150], 0
jne 0x180021068
mov r8, r14
jmp 0x18002107e
lea rax, [rbp + 0x150]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x180021073
lea rdx, [rbp + 0x150]
mov rcx, rsi
call fcn.180005ff0
cmp qword [rbx + 0x10], 0
je 0x18002236e
cmp qword [rdi + 0x10], 0
je 0x18002236e
mov qword [rbp + 0xc0], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0xb8], r14
mov byte [rbp + 0xa8], 0
movups xmm0, xmmword [str.RV_]
movups xmmword [rbp + 0x108], xmm0
movups xmm1, xmmword [0x180059250]
movups xmmword [rbp + 0x118], xmm1
movups xmm0, xmmword [0x180059260]
movups xmmword [rbp + 0x128], xmm0
movzx eax, byte [0x180059270]
mov byte [rbp + 0x138], al
mov ecx, gethostbyaddr
nop dword [rax + rax]
movzx eax, byte [rbp + rcx + 0x107]
xor byte [rbp + rcx + 0x108], al
dec rcx
test rcx, rcx
jg 0x180021100
xor byte [rbp + 0x108], 0x4e
jne 0x180021125
mov r8, r14
jmp 0x18002113a
lea rax, [rbp + 0x108]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x180021130
lea rdx, [rbp + 0x108]
lea rcx, [rbp + 0xa8]
call fcn.180006140
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rbx
lea rcx, [rbp + 0xa8]
call fcn.180006290
mov r8d, 1
lea rdx, [0x180058bb8]
lea rcx, [rbp + 0xa8]
call fcn.180006140
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rdi
lea rcx, [rbp + 0xa8]
call fcn.180006290
movsd xmm0, qword [0x180059278]
movsd qword [rbp + 0xe8], xmm0
movzx eax, word [0x180059280]
mov word [rbp + 0xf0], ax
movzx eax, byte [rbp + 0xef]
xor byte [rbp + 0xf0], al
movzx ecx, byte [rbp + 0xee]
xor al, cl
mov byte [rbp + 0xef], al
movzx eax, byte [rbp + 0xed]
xor cl, al
mov byte [rbp + 0xee], cl
movzx ecx, byte [rbp + 0xec]
xor al, cl
mov byte [rbp + 0xed], al
movzx eax, byte [rbp + 0xeb]
xor cl, al
mov byte [rbp + 0xec], cl
movzx ecx, byte [rbp + 0xea]
xor al, cl
mov byte [rbp + 0xeb], al
movzx edx, byte [rbp + 0xe9]
xor cl, dl
mov byte [rbp + 0xea], cl
movzx eax, byte [rbp + 0xe8]
xor dl, al
mov byte [rbp + 0xe9], dl
xor al, 0xa6
mov byte [rbp + 0xe8], al
jne 0x180021235
mov r8, r14
jmp 0x18002124a
lea rax, [rbp + 0xe8]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x180021240
lea rdx, [rbp + 0xe8]
lea rcx, [rbp + 0xa8]
call fcn.180006140
mov qword [rbp + 0x50], r14
mov qword [rbp + 0x58], r14
call fcn.18000f420
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x40], r14
mov qword [rbp + 0x48], r14
call fcn.18000f420
mov qword [rbp + 0x40], rax
lea rdx, [rbp + 0x50]
call fcn.1800207a0
mov dword [rsp + 0x78], r14d
mov qword [rbp - 0x38], r14
or r12, 0xffffffffffffffff
mov qword [rbp + 0xa0], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x98], r14
mov byte [rbp + 0x88], 0
mov qword [rbp + 0xe0], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0xd8], r14
mov byte [rbp + 0xc8], 0
xor eax, eax
mov qword [rbp + 0x68], rax
mov dword [rbp + 0x68], r14d
mov dword [rbp + 0x6c], 0x400
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbp + 0x60], rax
mov r15d, r14d
mov dword [rsp + 0x50], r14d
nop dword [rax + rax]
mov rax, qword [rbp + 0x40]
mov rsi, qword [rax + 8]
mov rdi, rsi
cmp byte [rsi + 0x19], 0
jne 0x180021348
mov rdx, qword [rdi + 0x10]
lea rcx, [rbp + 0x40]
call fcn.18000ee60
mov rdi, qword [rdi]
lea rcx, [rsi + 0x40]
call fcn.180001e50
lea rcx, [rsi + 0x20]
call fcn.180001e50
mov rcx, rsi
call fcn.180033ed0
mov rsi, rdi
cmp byte [rdi + 0x19], 0
je 0x180021311
mov rax, qword [rbp + 0x40]
mov qword [rax + 8], rax
mov rax, qword [rbp + 0x40]
mov qword [rax], rax
mov rax, qword [rbp + 0x40]
mov qword [rax + 0x10], rax
mov qword [rbp + 0x48], r14
mov qword [rbp + 0xd8], r14
lea rax, [rbp + 0xc8]
cmp qword [rbp + 0xe0], 0x10
cmovae rax, qword [rbp + 0xc8]
mov byte [rax], 0
mov dword [rsp + 0x54], r14d
mov dword [rbp + 0x68], r14d
mov r13d, r15d
shl r13, 0x15
mov dword [rbp + 0x80], r14d
movsd xmm0, qword [0x180059288]
movsd qword [rbp + 0x140], xmm0
mov eax, dword [0x180059290]
mov dword [rbp + 0x148], eax
movzx eax, word [0x180059294]
mov word [rbp + 0x14c], ax
lea r8, [rbp + 0x14b]
mov r9d, 2
nop
movzx ecx, byte [r8]
xor byte [r8 + 1], cl
movzx eax, byte [r8 - 1]
xor al, cl
mov byte [r8], al
movzx eax, byte [r8 - 2]
xor byte [r8 - 1], al
movzx eax, byte [r8 - 3]
xor byte [r8 - 2], al
movzx eax, byte [r8 - 4]
xor byte [r8 - 3], al
movzx eax, byte [r8 - 5]
xor byte [r8 - 4], al
lea r8, [r8 - 6]
sub r9, 1
jne 0x1800213d0
xor byte [rbp + 0x140], 0xc4
mov qword [rbp - 0x68], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x70], r14
mov byte [rbp - 0x80], r9b
lea r8d, [r9 + 3]
lea rdx, [0x180058ba4]
lea rcx, [rbp - 0x80]
call fcn.1800020b0
nop
lea rdx, [rbp + 0xa8]
cmp qword [rbp + 0xc0], 0x10
cmovae rdx, qword [rbp + 0xa8]
mov qword [rsp + 0x70], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x68], r14
mov byte [rsp + 0x58], 0
cmp byte [rdx], 0
jne 0x180021470
mov r8, r14
jmp 0x18002147e
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x180021474
lea rcx, [rsp + 0x58]
call fcn.1800020b0
nop
lea rax, [rbp + 0x60]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x58]
mov rsi, qword [rbp - 0x28]
mov rcx, rsi
call fcn.18001f590
mov edi, eax
mov rax, qword [rsp + 0x70]
cmp rax, 0x10
jb 0x180021520
inc rax
mov rcx, qword [rsp + 0x58]
cmp rax, 0x1000
jb 0x18002151b
test cl, 0x1f
jne 0x1800221b7
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x1800221b1
sub rcx, rax
cmp rcx, 8
jb 0x1800221ab
cmp rcx, 0x27
ja 0x1800221a5
mov rcx, rax
call fcn.180033ed0
mov qword [rsp + 0x70], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x68], r14
mov byte [rsp + 0x58], 0
mov rax, qword [rbp - 0x68]
cmp rax, 0x10
jb 0x180021581
inc rax
mov rcx, qword [rbp - 0x80]
cmp rax, 0x1000
jb 0x18002157c
test cl, 0x1f
jne 0x1800221cf
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x1800221c9
sub rcx, rax
cmp rcx, 8
jb 0x1800221c3
cmp rcx, 0x27
ja 0x1800221bd
mov rcx, rax
call fcn.180033ed0
mov ebx, r14d
test edi, edi
je 0x180021721
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rbp - 0x68], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x70], r14
mov byte [rbp - 0x80], 0
mov r8d, 3
lea rdx, [0x180058ba4]
lea rcx, [rbp - 0x80]
call fcn.1800020b0
nop
lea rdx, [rbp + 0xa8]
cmp qword [rbp + 0xc0], 0x10
cmovae rdx, qword [rbp + 0xa8]
mov qword [rsp + 0x70], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x68], r14
mov byte [rsp + 0x58], 0
cmp byte [rdx], 0
jne 0x1800215f2
mov r8, r14
jmp 0x180021600
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x1800215f6
lea rcx, [rsp + 0x58]
call fcn.1800020b0
nop
lea rax, [rbp + 0x60]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x58]
mov rcx, rsi
call fcn.18001f590
mov edi, eax
mov rax, qword [rsp + 0x70]
cmp rax, 0x10
jb 0x18002169e
inc rax
mov rcx, qword [rsp + 0x58]
cmp rax, 0x1000
jb 0x180021699
test cl, 0x1f
jne 0x1800221e7
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x1800221e1
sub rcx, rax
cmp rcx, 8
jb 0x1800221db
cmp rcx, 0x27
ja 0x1800221d5
mov rcx, rax
call fcn.180033ed0
mov qword [rsp + 0x70], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x68], r14
mov byte [rsp + 0x58], 0
mov rax, qword [rbp - 0x68]
cmp rax, 0x10
jb 0x1800216ff
inc rax
mov rcx, qword [rbp - 0x80]
cmp rax, 0x1000
jb 0x1800216fa
test cl, 0x1f
jne 0x1800221ff
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x1800221f9
sub rcx, rax
cmp rcx, 8
jb 0x1800221f3
cmp rcx, 0x27
ja 0x1800221ed
mov rcx, rax
call fcn.180033ed0
inc ebx
cmp ebx, 3
jl 0x180021584
test edi, edi
je 0x180021721
lea eax, [rdi - 2]
test eax, 0xfffffffd
jne 0x180022205
jmp 0x180022175
mov eax, 0x51eb851f
mul dword [rsp + 0x54]
shr edx, 5
cmp edx, 3
jne 0x180021932
mov qword [rsp + 0x70], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x68], r14
mov byte [rsp + 0x58], 0
lea r8d, [rdx + 5]
lea rdx, str.location
lea rcx, [rsp + 0x58]
call fcn.1800020b0
mov rsi, qword [rbp + 0x40]
mov rdi, qword [rsi + 8]
mov rbx, rsi
cmp byte [rdi + 0x19], 0
jne 0x1800217ab
nop
lea rdx, [rdi + 0x20]
lea r8, [rsp + 0x58]
call fcn.18000c790
test al, al
je 0x180021788
mov rdi, qword [rdi + 0x10]
jmp 0x18002178e
mov rbx, rdi
mov rdi, qword [rdi]
cmp byte [rdi + 0x19], 0
je 0x180021770
cmp rbx, rsi
je 0x1800217ab
lea r8, [rbx + 0x20]
lea rdx, [rsp + 0x58]
call fcn.18000c790
test al, al
je 0x1800217ae
mov rbx, rsi
mov rax, qword [rsp + 0x70]
cmp rax, 0x10
jb 0x180021802
inc rax
mov rcx, qword [rsp + 0x58]
cmp rax, 0x1000
jb 0x1800217f9
test cl, 0x1f
jne 0x180022231
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x18002222b
sub rcx, rax
cmp rcx, 8
jb 0x180022225
cmp rcx, 0x27
ja 0x18002221f
mov rcx, rax
call fcn.180033ed0
mov rsi, qword [rbp + 0x40]
cmp rsi, rbx
je 0x180021932
mov qword [rsp + 0x70], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x68], r14
mov byte [rsp + 0x58], 0
mov r8d, 8
lea rdx, str.location
lea rcx, [rsp + 0x58]
call fcn.1800020b0
nop
mov rsi, qword [rbp + 0x40]
mov rdi, qword [rsi + 8]
mov rbx, rsi
cmp byte [rdi + 0x19], 0
jne 0x18002188b
nop word [rax + rax]
lea rdx, [rdi + 0x20]
lea r8, [rsp + 0x58]
call fcn.18000c790
test al, al
je 0x180021868
mov rdi, qword [rdi + 0x10]
jmp 0x18002186e
mov rbx, rdi
mov rdi, qword [rdi]
cmp byte [rdi + 0x19], 0
je 0x180021850
cmp rbx, rsi
je 0x18002188b
lea r8, [rbx + 0x20]
lea rdx, [rsp + 0x58]
call fcn.18000c790
test al, al
je 0x1800218be
lea rax, [rsp + 0x58]
mov qword [rbp - 0x60], rax
lea r8, [rbp - 0x60]
lea rcx, [rbp + 0x40]
call fcn.1800156a0
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x40]
call fcn.180015710
mov rbx, qword [rbp - 0x20]
lea rdx, [rbx + 0x40]
lea rax, [rbp + 0xc8]
cmp rax, rdx
je 0x1800218e2
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [rbp + 0xc8]
call fcn.1800021e0
nop
mov rax, qword [rsp + 0x70]
cmp rax, 0x10
jb 0x180021932
inc rax
mov rcx, qword [rsp + 0x58]
cmp rax, 0x1000
jb 0x18002192d
test cl, 0x1f
jne 0x180022249
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x180022243
sub rcx, rax
cmp rcx, 8
jb 0x18002223d
cmp rcx, 0x27
ja 0x180022237
mov rcx, rax
call fcn.180033ed0
cmp qword [rbp + 0xd8], 0
je 0x180022175
mov rax, qword [rbp + 0x50]
mov rsi, qword [rax + 8]
mov rdi, rsi
cmp byte [rsi + 0x19], 0
jne 0x180021988
mov rdx, qword [rdi + 0x10]
lea rcx, [rbp + 0x50]
call fcn.18000ee60
mov rdi, qword [rdi]
lea rcx, [rsi + 0x40]
call fcn.180001e50
lea rcx, [rsi + 0x20]
call fcn.180001e50
mov rcx, rsi
call fcn.180033ed0
mov rsi, rdi
cmp byte [rdi + 0x19], 0
je 0x180021951
mov rax, qword [rbp + 0x50]
mov qword [rax + 8], rax
mov rax, qword [rbp + 0x50]
mov qword [rax], rax
mov rax, qword [rbp + 0x50]
mov qword [rax + 0x10], rax
mov qword [rbp + 0x58], r14
mov eax, dword [0x1800592a4]
mov dword [rbp + 0xf8], eax
movzx eax, word [0x1800592a8]
mov word [rbp + 0xfc], ax
movzx eax, byte [rbp + 0xfb]
xor byte [rbp + 0xfc], al
movzx ecx, byte [rbp + 0xfa]
xor al, cl
mov byte [rbp + 0xfb], al
movzx eax, byte [rbp + 0xf9]
xor cl, al
mov byte [rbp + 0xfa], cl
movzx edx, byte [rbp + 0xf8]
xor al, dl
mov byte [rbp + 0xf9], al
xor dl, 0xa8
mov byte [rbp + 0xf8], dl
mov eax, dword [str.V___Mp]
mov dword [rbp + 0xe8], eax
movzx eax, word [0x1800592b0]
mov word [rbp + 0xec], ax
movzx eax, byte [0x1800592b2]
mov byte [rbp + 0xee], al
movzx eax, byte [rbp + 0xec]
xor byte [rbp + 0xed], al
movzx ecx, byte [rbp + 0xeb]
xor al, cl
mov byte [rbp + 0xec], al
movzx eax, byte [rbp + 0xea]
xor cl, al
mov byte [rbp + 0xeb], cl
movzx ecx, byte [rbp + 0xe9]
xor al, cl
mov byte [rbp + 0xea], al
movzx eax, byte [rbp + 0xe8]
xor cl, al
mov byte [rbp + 0xe9], cl
xor al, 0x34
mov byte [rbp + 0xe8], al
mov qword [rbp - 0x68], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x70], r14
mov byte [rbp - 0x80], 0
test dl, dl
jne 0x180021a8d
mov r8, r14
jmp 0x180021aaa
lea rax, [rbp + 0xf8]
or r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180021aa0
lea rdx, [rbp + 0xf8]
lea rcx, [rbp - 0x80]
call fcn.1800020b0
nop
lea rdx, [r13 + 0x1fffff]
lea rcx, [rbp + 0x108]
call fcn.180015ca0
mov rbx, rax
mov rdx, r13
lea rcx, [rbp - 0x58]
call fcn.180015ca0
nop
mov r8, rax
lea rdx, [rbp + 0xe8]
lea rcx, [rbp + 0x10]
call fcn.180006900
nop
lea r8, [0x180058d90]
mov rdx, rax
lea rcx, [rbp - 0x10]
call fcn.180006ce0
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.180006ad0
mov r15, rax
mov rsi, qword [rbp + 0x50]
mov rdi, qword [rsi + 8]
mov rbx, rsi
cmp byte [rdi + 0x19], 0
jne 0x180021b69
nop word [rax + rax]
lea rdx, [rdi + 0x20]
lea r8, [rbp - 0x80]
call fcn.18000c790
test al, al
je 0x180021b47
mov rdi, qword [rdi + 0x10]
jmp 0x180021b4d
mov rbx, rdi
mov rdi, qword [rdi]
cmp byte [rdi + 0x19], 0
je 0x180021b30
cmp rbx, rsi
je 0x180021b69
lea r8, [rbx + 0x20]
lea rdx, [rbp - 0x80]
call fcn.18000c790
test al, al
je 0x180021b9b
lea rax, [rbp - 0x80]
mov qword [rbp - 0x60], rax
lea r8, [rbp - 0x60]
lea rcx, [rbp + 0x50]
call fcn.1800156a0
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0x50]
call fcn.180015710
mov rbx, qword [rbp - 0x18]
lea rcx, [rbx + 0x40]
mov rdx, r15
call fcn.1800091e0
nop
mov rax, qword [rsp + 0x70]
cmp rax, 0x10
jb 0x180021bf8
inc rax
mov rcx, qword [rsp + 0x58]
cmp rax, 0x1000
jb 0x180021bf3
test cl, 0x1f
jne 0x180022261
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x18002225b
sub rcx, rax
cmp rcx, 8
jb 0x180022255
cmp rcx, 0x27
ja 0x18002224f
mov rcx, rax
call fcn.180033ed0
mov qword [rsp + 0x70], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x68], r14
mov byte [rsp + 0x58], 0
mov rax, qword [rbp + 8]
cmp rax, 0x10
jb 0x180021c59
inc rax
mov rcx, qword [rbp - 0x10]
cmp rax, 0x1000
jb 0x180021c54
test cl, 0x1f
jne 0x180022279
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x180022273
sub rcx, rax
cmp rcx, 8
jb 0x18002226d
cmp rcx, 0x27
ja 0x180022267
mov rcx, rax
call fcn.180033ed0
mov qword [rbp + 8], reloc.WS2_32.dll_ntohs
mov qword [rbp], r14
mov byte [rbp - 0x10], 0
mov rax, qword [rbp + 0x28]
cmp rax, 0x10
jb 0x180021cb7
inc rax
mov rcx, qword [rbp + 0x10]
cmp rax, 0x1000
jb 0x180021cb2
test cl, 0x1f
jne 0x180022291
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x18002228b
sub rcx, rax
cmp rcx, 8
jb 0x180022285
cmp rcx, 0x27
ja 0x18002227f
mov rcx, rax
call fcn.180033ed0
mov qword [rbp + 0x28], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x20], r14
mov byte [rbp + 0x10], 0
mov rax, qword [rbp - 0x40]
cmp rax, 0x10
jb 0x180021d15
inc rax
mov rcx, qword [rbp - 0x58]
cmp rax, 0x1000
jb 0x180021d10
test cl, 0x1f
jne 0x1800222a9
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x1800222a3
sub rcx, rax
cmp rcx, 8
jb 0x18002229d
cmp rcx, 0x27
ja 0x180022297
mov rcx, rax
call fcn.180033ed0
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x48], r14
mov byte [rbp - 0x58], 0
mov rax, qword [rbp + 0x120]
cmp rax, 0x10
jb 0x180021d79
inc rax
mov rcx, qword [rbp + 0x108]
cmp rax, 0x1000
jb 0x180021d74
test cl, 0x1f
jne 0x1800222c1
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x1800222bb
sub rcx, rax
cmp rcx, 8
jb 0x1800222b5
cmp rcx, 0x27
ja 0x1800222af
mov rcx, rax
call fcn.180033ed0
mov qword [rbp + 0x120], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x118], r14
mov byte [rbp + 0x108], 0
lea rcx, [rbp - 0x80]
call fcn.180001e50
lea rdx, [0x180058ba4]
lea rcx, [rbp - 0x58]
call fcn.180005fb0
nop
lea rcx, [rbp + 0xc8]
call fcn.180001ff0
mov rdx, rax
lea rcx, [rbp + 0x108]
call fcn.180005fb0
nop
lea rax, [rbp + 0x60]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x58]
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x108]
call fcn.180027a30
mov ebx, eax
lea rcx, [rbp + 0x108]
call fcn.180001e50
nop
lea rcx, [rbp - 0x58]
call fcn.180001e50
mov edi, r14d
nop dword [rax]
test ebx, ebx
jne 0x180021ec5
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x180058ba4]
lea rcx, [rbp - 0x58]
call fcn.180005fb0
nop
lea rcx, [rbp + 0xc8]
call fcn.180001ff0
mov rdx, rax
lea rcx, [rbp + 0x108]
call fcn.180005fb0
nop
lea rax, [rbp + 0x60]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x58]
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x108]
call fcn.180027a30
mov ebx, eax
lea rcx, [rbp + 0x108]
call fcn.180001e50
nop
lea rcx, [rbp - 0x58]
call fcn.180001e50
inc edi
cmp edi, 3
jl 0x180021e20
test ebx, ebx
je 0x180022170
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x108]
call fcn.180005fb0
lea r8, [rbp + 0x108]
lea rdx, [rbp + 0x38]
lea rcx, [rbp + 0x40]
call fcn.18000db30
mov rbx, qword [rax]
lea rcx, [rbp + 0x108]
call fcn.180001e50
cmp rbx, qword [rbp + 0x40]
je 0x180021f41
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x108]
call fcn.180005fb0
nop
lea rdx, [rbp + 0x108]
lea rcx, [rbp + 0x40]
call fcn.1800148d0
mov rdx, rax
lea rcx, [rbp + 0x88]
call fcn.180001e20
nop
lea rcx, [rbp + 0x108]
call fcn.180001e50
xor r8d, r8d
lea rdx, str.bytes
lea rcx, [rbp + 0x88]
call fcn.18000dcd0
mov r8, rax
mov eax, dword [rsp + 0x54]
add eax, 0xffffff38
cmp eax, 0x63
ja 0x180022170
cmp r8, 0xffffffffffffffff
je 0x180022170
add r8, 6
or r9, 0xffffffffffffffff
lea rdx, [rbp + 0x108]
lea rcx, [rbp + 0x88]
call fcn.18000be20
mov rdx, rax
lea rcx, [rbp + 0x88]
call fcn.1800091e0
lea rcx, [rbp + 0x108]
call fcn.180001e50
xor r8d, r8d
mov dl, 0x2f
lea rcx, [rbp + 0x88]
call fcn.18001b5c0
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180022006
lea r8, [rax + 1]
or r9, 0xffffffffffffffff
lea rdx, [rbp + 0x108]
lea rcx, [rbp + 0x88]
call fcn.18000be20
mov rcx, rax
call fcn.180001ff0
mov rcx, rax
call fcn.18003b8f8
mov rsi, rax
mov qword [rbp - 0x38], rax
lea rcx, [rbp + 0x108]
call fcn.180001e50
jmp 0x18002200a
mov rsi, qword [rbp - 0x38]
cmp r12, 0xffffffffffffffff
jne 0x180022052
mov rdi, qword [rbp - 0x30]
mov rcx, rdi
call fcn.18000bd40
mov rcx, rax
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x1800222c7
mov r9, rbx
xor r8d, r8d
lea rdx, [rbp + 0x108]
lea rcx, [rbp + 0x88]
call fcn.18000be20
mov rdx, rax
lea rcx, [rbp + 0x88]
call fcn.1800091e0
lea rcx, [rbp + 0x108]
call fcn.180001e50
xor r8d, r8d
lea rdx, [0x180058d90]
lea rcx, [rbp + 0x88]
call fcn.18000dcd0
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180022170
mov r9, rax
xor r8d, r8d
lea rdx, [rbp + 0x108]
lea rcx, [rbp + 0x88]
call fcn.18000be20
mov rcx, rax
call fcn.180001ff0
mov rcx, rax
call fcn.18003b8f8
mov rdi, rax
lea rcx, [rbp + 0x108]
call fcn.180001e50
cmp r13, rdi
jne 0x180022170
lea r8, [rbx + 1]
or r9, 0xffffffffffffffff
lea rdx, [rbp + 0x108]
lea rcx, [rbp + 0x88]
call fcn.18000be20
mov rcx, rax
call fcn.180001ff0
mov rcx, rax
call fcn.18003b8f8
mov rbx, rax
lea rcx, [rbp + 0x108]
call fcn.180001e50
mov rcx, rbx
sub rcx, rdi
inc rcx
mov r8d, dword [rbp + 0x68]
cmp rcx, r8
jne 0x180022170
lea rax, [rsi - 1]
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x80]
mov rdx, qword [rbp + 0x60]
mov rcx, r12
cmp rax, rbx
je 0x1800222d6
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [rsp + 0x78], r14d
mov r15d, dword [rsp + 0x50]
inc r15d
mov dword [rsp + 0x50], r15d
jmp 0x180022193
mov r15d, dword [rsp + 0x50]
mov ebx, dword [rsp + 0x78]
inc ebx
mov dword [rsp + 0x78], ebx
cmp ebx, 0xa
ja 0x1800222ea
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp r15d, 0x400000
jae 0x180022325
jmp 0x180021300
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
nop
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
nop
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
nop
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
lea eax, [rdi - 1]
test eax, 0xfffffffd
mov ecx, 4
mov eax, 1
cmovne eax, ecx
jmp 0x180022322
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
nop
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
nop
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
nop
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
nop
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
nop
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
nop
mov rcx, rdi
call fcn.18001b5a0
mov eax, 7
jmp 0x180022322
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r14d
jmp 0x180022322
mov rbx, qword [rbp - 0x30]
cmp qword [rbx + 0x10], 0
je 0x18002231d
cmp r12, 0xffffffffffffffff
jne 0x180022315
or rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call fcn.18000bd40
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, rbx
call fcn.18001b5a0
mov eax, 3
mov r14d, eax
lea rcx, [rbp + 0x60]
call fcn.18000a630
nop
lea rcx, [rbp + 0xc8]
call fcn.180001e50
nop
lea rcx, [rbp + 0x88]
call fcn.180001e50
nop
lea rcx, [rbp + 0x40]
call fcn.18000d2d0
nop
lea rcx, [rbp + 0x50]
call fcn.18000d2d0
nop
lea rcx, [rbp + 0xa8]
call fcn.180001e50
mov eax, r14d
jmp 0x180022373
mov eax, 6
mov rcx, qword [rbp + 0x570]
xor rcx, rsp
call fcn.180033e70
add rsp, 0x688
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret