Function at 0x1800621f0
Capabilities:
Allocate or change rwx memory
Create thread
Encode data using xor
Enumerate threads
Execute shellcode via indirect call
Spawn thread to rwx shellcode
Terminate process
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov rax, qword [0x180109070]
xor rax, rsp
mov qword [rbp + 0x60], rax
cmp edx, 1
jne 0x180063470
lea rcx, [rbp - 8]
call fcn.180045c40
mov rbx, rax
lea r12, [0x180150998]
xor r14d, r14d
cmp r12, rax
je 0x1800622c0
mov rdx, qword [reloc.WS2_32.dll_ntohs]
cmp rdx, 0x10
jb 0x180062284
mov rcx, qword [0x180150998]
inc rdx
cmp rdx, 0x1000
jb 0x18006227f
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800622f2
mov rcx, r8
call fcn.1800d0a1c
movdqa xmm0, xmmword [0x1800f5180]
movdqu xmmword [0x1801509a8], xmm0
mov byte [0x180150998], r14b
movups xmm0, xmmword [rbx]
movups xmmword [0x180150998], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [0x1801509a8], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
nop
mov rdx, qword [rbp + 0x10]
cmp rdx, 0x10
jb 0x1800622fe
inc rdx
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800622f9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800622f9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800d0a1c
lea rcx, [rbp - 8]
call fcn.180045f00
mov rbx, rax
lea r15, [0x1801509d8]
cmp r15, rax
je 0x180062390
mov rdx, qword [reloc.WS2_32.dll_ntohs]
cmp rdx, 0x10
jb 0x180062353
mov rcx, qword [0x1801509d8]
inc rdx
cmp rdx, 0x1000
jb 0x18006234e
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800623c2
mov rcx, r8
call fcn.1800d0a1c
movdqa xmm0, xmmword [0x1800f5180]
movdqu xmmword [0x1801509e8], xmm0
mov byte [0x1801509d8], 0
movups xmm0, xmmword [rbx]
movups xmmword [0x1801509d8], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [0x1801509e8], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
nop
mov rdx, qword [rbp + 0x10]
cmp rdx, 0x10
jb 0x1800623ce
inc rdx
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800623c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800623c9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800d0a1c
lea rcx, [rbp - 8]
call fcn.1800469d0
mov rbx, rax
lea rsi, [0x1801509b8]
cmp rsi, rax
je 0x180062460
mov rdx, qword [reloc.WS2_32.dll_ntohs]
cmp rdx, 0x10
jb 0x180062423
mov rcx, qword [0x1801509b8]
inc rdx
cmp rdx, 0x1000
jb 0x18006241e
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180062492
mov rcx, r8
call fcn.1800d0a1c
movdqa xmm0, xmmword [0x1800f5180]
movdqu xmmword [0x1801509c8], xmm0
mov byte [0x1801509b8], 0
movups xmm0, xmmword [rbx]
movups xmmword [0x1801509b8], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [0x1801509c8], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
nop
mov rdx, qword [rbp + 0x10]
cmp rdx, 0x10
jb 0x18006249e
inc rdx
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180062499
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180062499
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800d0a1c
movdqa xmm0, xmmword [0x1800f5430]
movdqu xmmword [rbp - 8], xmm0
mov byte [rbp + 8], 1
mov rcx, r14
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x19]
xor byte [rbp + rcx - 8], al
inc rcx
cmp rcx, 0xf
jb 0x1800624c0
mov byte [rbp + 8], 0
lea rax, [rbp - 8]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x1800624e2
lea rdx, [rbp - 8]
lea rcx, [0x180150a18]
call fcn.180047060
nop
mov byte [rbp + 0x20], 0
xor edx, edx
lea rcx, [rbp + 0x28]
call fcn.1800684c0
lea rcx, [rbp + 0x20]
call fcn.180067770
lea rcx, [rbp + 0x20]
call fcn.180067770
nop
lea rax, [rbp - 0x30]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x40], 0x8d878194
mov dword [rsp + 0x44], 0x1008282
mov rcx, r14
nop dword [rax + rax]
lea eax, [rcx - 0x19]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 6
jb 0x180062540
mov byte [rsp + 0x47], 0
mov byte [rbp - 0x30], 0
xor eax, eax
mov qword [rbp - 0x28], rax
xor edx, edx
lea rcx, [rbp - 0x28]
call fcn.180067230
mov byte [rbp - 0x30], 3
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1800d0e9c
mov rdi, rax
lea rax, [rbp - 0x10]
mov qword [rbp - 8], rax
mov qword [rbp], rdi
mov qword [rdi], r14
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
lea rax, [rsp + 0x40]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1800625a2
mov r8, rbx
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.180047060
nop
mov qword [rbp - 0x28], rdi
lea rcx, [rbp - 0x30]
call fcn.180067770
lea rcx, [rbp - 0x30]
call fcn.180067770
nop
mov dword [rsp + 0x70], 0x829d8d8a
mov dword [rsp + 0x74], 0x1008884
lea rcx, [rsp + 0x70]
call fcn.18004fd30
mov rdx, rax
lea rcx, [rbp + 0x20]
call fcn.180069f90
mov rcx, rax
lea rdx, [rbp - 0x30]
call fcn.180064fb0
lea rax, [rbp - 8]
mov qword [rsp + 0x50], rax
lea rdx, [0x180150a18]
lea rcx, [rbp - 8]
call fcn.18006a0e0
mov rbx, rax
mov dword [rbp - 0x10], 0x8f848989
mov word [rbp - 0xc], 0x100
lea rcx, [rbp - 0x10]
call fcn.180045ab0
mov rdx, rax
lea rcx, [rbp + 0x20]
call fcn.180069f90
mov rcx, rax
mov rdx, rbx
call fcn.180064fb0
lea rax, [rbp - 8]
mov qword [rsp + 0x50], rax
mov rdx, r12
lea rcx, [rbp - 8]
call fcn.18006a0e0
mov rbx, rax
mov dword [rbp - 0x10], 0x858f868e
mov word [rbp - 0xc], 0x100
lea rcx, [rbp - 0x10]
call fcn.180045ab0
mov rdx, rax
lea rcx, [rbp + 0x20]
call fcn.180069f90
mov r8, rax
mov dword [rsp + 0x40], 0x8e809d92
mov word [rsp + 0x44], 0x100
lea rcx, [rsp + 0x40]
call fcn.180045ab0
mov rdx, rax
mov rcx, r8
call fcn.180069f90
mov rcx, rax
mov rdx, rbx
call fcn.180064fb0
lea rax, [rbp - 8]
mov qword [rsp + 0x50], rax
mov rdx, r15
lea rcx, [rbp - 8]
call fcn.18006a0e0
mov rbx, rax
mov dword [rsp + 0x40], 0x858f868e
mov word [rsp + 0x44], 0x100
lea rcx, [rsp + 0x40]
call fcn.180045ab0
mov rdx, rax
lea rcx, [rbp + 0x20]
call fcn.180069f90
mov r8, rax
mov dword [rbp - 0x10], 0xdc8c8a
mov byte [rbp - 0xc], 1
lea rcx, [rbp - 0x10]
call fcn.1800479a0
mov rdx, rax
mov rcx, r8
call fcn.180069f90
mov rcx, rax
mov rdx, rbx
call fcn.180064fb0
lea rax, [rbp - 8]
mov qword [rsp + 0x50], rax
mov rdx, rsi
lea rcx, [rbp - 8]
call fcn.18006a0e0
mov rbx, rax
mov dword [rsp + 0x40], 0x858f868e
mov word [rsp + 0x44], 0x100
lea rcx, [rsp + 0x40]
call fcn.180045ab0
mov rdx, rax
lea rcx, [rbp + 0x20]
call fcn.180069f90
mov r8, rax
mov dword [rbp - 0x10], 0x8f8d8991
mov word [rbp - 0xc], 0x100
lea rcx, [rbp - 0x10]
call fcn.180045ab0
mov rdx, rax
mov rcx, r8
call fcn.180069f90
mov rcx, rax
mov rdx, rbx
call fcn.180064fb0
lea rdx, [rbp + 0x20]
lea rcx, [rbp - 8]
call fcn.180065020
mov r8, rax
movdqa xmm0, xmmword [0x1800f5ca0]
movdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], 0xd69791
mov byte [rbp - 0x1c], 1
lea rcx, [rbp - 0x30]
call fcn.180046fa0
mov rdx, rax
lea rcx, [rbp + 0x40]
call fcn.1800458b0
nop
lea rdx, [rbp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.180065b80
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.180045570
mov rdx, rax
lea rcx, [rbp + 0x40]
call fcn.180065ab0
lea rcx, [rsp + 0x70]
call fcn.180044b10
mov qword [rbp - 0x38], r14
lea rcx, [rbp + 0x40]
call fcn.1800659f0
mov qword [rsp + 0x70], rax
lea r8, [rbp - 0x70]
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x30]
call fcn.18006a1a0
nop
mov dword [rsp + 0x50], 0xbea8bcb4
mov dword [rsp + 0x54], 0xbdb2bfbe
mov dword [rsp + 0x58], 0xb7b2b3ba
mov dword [rsp + 0x5c], 0x100a7a0
lea rcx, [rsp + 0x50]
call fcn.180046fd0
mov rbx, rax
mov dword [rsp + 0x40], 0x8f8d8784
mov word [rsp + 0x44], 0x100
lea rcx, [rsp + 0x40]
call fcn.180045ab0
mov rdx, rax
lea rcx, [rbp + 0x30]
call fcn.180069f90
mov rdx, rbx
mov rcx, rax
call fcn.18006a2d0
test al, al
je 0x180063453
mov dword [rsp + 0x40], 0x858f868e
mov word [rsp + 0x44], 0x100
lea rcx, [rsp + 0x40]
call fcn.180045ab0
mov rdx, rax
lea rcx, [rbp + 0x30]
call fcn.180069f90
mov r8, rax
movdqa xmm0, xmmword [0x1800f5d50]
movdqu xmmword [rbp - 8], xmm0
mov dword [rbp + 8], 0x1008a92
lea rcx, [rbp - 8]
call fcn.180046ee0
mov rdx, rax
mov rcx, r8
call fcn.180069f90
mov rdx, rax
lea rcx, [0x180150938]
call fcn.18006a3a0
mov dword [rsp + 0x40], 0x858f868e
mov word [rsp + 0x44], 0x100
lea rcx, [rsp + 0x40]
call fcn.180045ab0
mov rdx, rax
lea rcx, [rbp + 0x30]
call fcn.180069f90
mov r8, rax
movdqa xmm0, xmmword [0x1800f5d50]
movdqu xmmword [rbp - 8], xmm0
mov dword [rbp + 8], 0x8ea68a92
mov dword [rbp + 0xc], 0x989192
mov byte [rbp + 0x10], 1
lea rcx, [rbp - 8]
call fcn.18004ff10
mov rdx, rax
mov rcx, r8
call fcn.180069f90
mov rdx, rax
lea rcx, [0x180150958]
call fcn.18006a3a0
mov dword [rsp + 0x40], 0x858f868e
mov word [rsp + 0x44], 0x100
lea rcx, [rsp + 0x40]
call fcn.180045ab0
mov rdx, rax
lea rcx, [rbp + 0x30]
call fcn.180069f90
mov r8, rax
movdqa xmm0, xmmword [0x1800f5d50]
movdqu xmmword [rbp - 8], xmm0
mov dword [rbp + 8], 0x89a68a92
mov dword [rbp + 0xc], 0x8b899d8f
mov word [rbp + 0x10], Ordinal_143
mov byte [rbp + 0x12], 1
lea rcx, [rbp - 8]
call fcn.18004fe50
mov rdx, rax
mov rcx, r8
call fcn.180069f90
mov rdx, rax
lea rcx, [0x180150a38]
call fcn.18006a3a0
mov dword [rbp - 0x10], 0x100959c
lea rcx, [rbp - 0x10]
call fcn.180046f10
mov rdx, rax
lea rcx, [0x180150938]
call fcn.1800694d0
test al, al
jne 0x180063453
movzx eax, byte [0x1800e6a50]
xor al, 0xe7
mov byte [rbp - 0x10], al
mov word [rbp - 0xf], 0x100
lea rcx, [rbp - 0x10]
call fcn.1800472d0
mov rdx, rax
lea rcx, [0x180150a38]
call fcn.1800694d0
test al, al
jne 0x180062a49
movzx eax, byte [0x1800e6a58]
xor al, 0xe7
mov byte [rbp - 0x10], al
mov word [rbp - 0xf], 0x100
lea rcx, [rbp - 0x10]
call fcn.1800472d0
mov rdx, rax
lea rcx, [0x180150a38]
call fcn.1800694d0
test al, al
je 0x180063453
xor edx, edx
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x180062a81
lea rcx, [rbp + 0x30]
call fcn.180064f80
nop
lea rcx, [rbp + 0x40]
call fcn.180044b10
nop
lea rcx, [rbp + 0x20]
call fcn.180064f80
xor eax, eax
jmp 0x180063475
mov dword [rbp - 0x30], Ordinal_30
lea rdx, [rbp - 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x180062b5f
mov dword [rsp + 0x50], 0xc4829b88
mov dword [rsp + 0x54], 0x88948e
mov byte [rsp + 0x58], 1
lea rcx, [rsp + 0x50]
call fcn.18004ff40
mov rcx, rax
call fcn.180045100
mov rdi, rax
mov eax, dword [rbp - 0x24]
cmp rax, rdi
jne 0x180062b4a
mov r8d, dword [rbp - 0x28]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbx, rax
mov rcx, rax
call fcn.1800620e0
mov r8d, eax
mov edx, edi
lea rcx, [rbp - 8]
call fcn.180061ff0
mov dword [rsp + 0x50], 0x998b8993
mov dword [rsp + 0x54], 0x8ac38e80
mov dword [rsp + 0x58], 0x1009c83
lea rcx, [rsp + 0x50]
call fcn.18004ffa0
mov rdx, rax
lea rcx, [rbp - 8]
call fcn.180065910
cmp rax, 0xffffffffffffffff
je 0x180062b38
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp - 8]
call fcn.180044b10
lea rdx, [rbp - 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x180062ac7
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
lea rcx, str..METABL
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x180151c90], rax
call fcn.180051a40
test al, al
jne 0x180062bf2
mov word [rbp - 0x10], 0x100
lea rcx, [rbp - 0x10]
call fcn.180055720
mov r8, rax
movdqa xmm0, xmmword [0x1800f5f00]
movdqu xmmword [rbp - 8], xmm0
mov dword [rbp + 8], 0x9e9897bb
mov dword [rbp + 0xc], 0x1008e9e
lea rcx, [rbp - 8]
call fcn.18004fdf0
xor r9d, r9d
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x180151ff8], eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x180151f38], eax
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8, [0x180061a80]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x180151c88], rax
movdqa xmm0, xmmword [0x1800f5b90]
movdqu xmmword [rbp - 8], xmm0
mov dword [rbp + 8], 0xd7d6d9
mov byte [rbp + 0xc], 1
lea rcx, [rbp - 8]
call fcn.180046fa0
mov rdx, rax
lea rcx, [0x180150978]
call fcn.180047040
xor bl, bl
nop dword [rax + rax]
mov dword [rsp + 0x70], 0x9e9d89a5
mov dword [rsp + 0x74], 0x80c38987
mov dword [rsp + 0x78], 0x97df848a
mov dword [rsp + 0x7c], 0x100918b
lea rcx, [rsp + 0x70]
call fcn.180046fd0
mov rcx, rax
call fcn.180045100
test rax, rax
je 0x180062cd8
movdqa xmm0, xmmword [0x1800f5c40]
movdqu xmmword [rbp - 8], xmm0
mov dword [rbp + 8], 0x1009d8f
lea rcx, [rbp - 8]
call fcn.180046ee0
mov rcx, rax
call fcn.180045100
test rax, rax
je 0x180062cd8
mov bl, 1
jmp 0x180062de6
mov dword [rsp + 0x40], 0x9e9d89a5
mov dword [rsp + 0x44], 0x80c38987
mov dword [rsp + 0x48], 0x97df848a
mov dword [rsp + 0x4c], 0x100918b
lea rcx, [rsp + 0x40]
call fcn.180046fd0
mov rcx, rax
call fcn.180045100
test rax, rax
je 0x180062d1b
mov byte [reloc.WS2_32.dll_accept], 1
jmp 0x180062de6
movdqa xmm0, xmmword [0x1800f5c40]
movdqu xmmword [rbp - 8], xmm0
mov dword [rbp + 8], 0x1009d8f
lea rcx, [rbp - 8]
call fcn.180046ee0
mov rcx, rax
call fcn.180045100
test rax, rax
je 0x180062de6
mov byte [reloc.WS2_32.dll_accept], 0
mov dword [0x1801090b8], 0x1485a760
mov dword [0x18013d374], 0x148588a8
mov dword [0x18011b244], 0xdc12b90
mov dword [0x18010e924], 0x150dc800
mov dword [0x1801090b4], 0x140
mov dword [0x1801434ec], 0x114160f0
mov dword [0x1801282f4], 0x14742790
mov dword [0x1801282f8], 0xcb53218
mov dword [0x18011d764], 0x13dc0
mov dword [0x180134538], 0xa00
mov dword [0x1801090b0], 0x6e0
mov dword [0x18011d768], 0x13cc0
mov dword [0x180131c28], 0x135f5
mov dword [0x18011b248], 0x638
mov dword [0x18010e928], 0x3d670
mov dword [rsp + 0x50], 0xc48d8784
mov dword [rsp + 0x54], 0x88948e
mov byte [rsp + 0x58], 1
lea rcx, [rsp + 0x50]
call fcn.18004ff40
mov rcx, rax
call fcn.180045100
test rax, rax
jne 0x180062e22
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x180062c70
mov ecx, 0xfa0
call qword [sym.imp.KERNEL32.dll_Sleep]
test bl, bl
je 0x180062e5d
movdqa xmm0, xmmword [0x1800f5bb0]
movdqu xmmword [rbp - 8], xmm0
movdqa xmm1, xmmword [0x1800f5910]
movdqu xmmword [rbp + 8], xmm1
mov dword [rbp + 0x18], 0x100216a
lea rcx, [rbp - 8]
call fcn.1800634b0
jmp 0x180062e79
movdqa xmm0, xmmword [0x1800f5b20]
movdqu xmmword [rbp - 8], xmm0
mov word [rbp + 8], 0x100
lea rcx, [rbp - 8]
call fcn.18004fd90
mov rdx, rax
lea rcx, [0x180150978]
call fcn.180047040
lea rsi, [0x180069f60]
lea rdi, [0x180000000]
nop word [rax + rax]
mov dword [rbp - 0x10], 0x77
lea rcx, [rbp - 8]
call fcn.180061a00
lea rcx, [rbp - 8]
test bl, bl
je 0x18006322a
lea r15, [rbp + 0x88]
mov rdx, r15
call fcn.180041990
nop
mov ecx, r14d
mov rax, qword [0x180170710]
test rax, rax
je 0x180062f09
mov rdx, r14
nop
cmp rax, rsi
je 0x180062ef8
inc ecx
mov edx, ecx
mov rax, qword [rdi + rcx*8 + 0x170710]
test rax, rax
jne 0x180062ee0
jmp 0x180062f09
mov r8, qword [rdi + rdx*8 + 0x16fda0]
test r8, r8
jne 0x180062fef
mov edx, 0x1f4
xor ecx, ecx
lea r9d, [rcx + 0x40]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, rax
test rax, rax
jne 0x180062f30
mov r8, r14
jmp 0x180062fce
mov rax, rsi
mov rcx, r8
mov edx, 3
nop dword [rax + rax]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x180062f40
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
mov eax, dword [rax + 0x70]
mov dword [rcx + 0x70], eax
mov rax, qword [0x180170a30]
mov qword [rdi + rax*8 + 0x170710], rsi
mov qword [rdi + rax*8 + 0x16fda0], r8
inc rax
mov qword [0x180170a30], rax
lea rdx, [rbp - 0x10]
mov rcx, qword [sym.imp.USER32.dll_GetAsyncKeyState]
call r8
movzx r8d, ax
mov rcx, qword [rbp]
xor rcx, qword [rbp - 8]
mov rax, qword [rbp + 8]
mov qword [rax], rcx
test r8w, r8w
jne 0x180063394
mov dword [rbp - 0x10], 0x78
lea rcx, [rbp - 8]
call fcn.180061a00
mov rdx, r15
lea rcx, [rbp - 8]
call fcn.180041990
nop
mov ecx, r14d
mov rax, qword [0x180170710]
test rax, rax
je 0x180063079
mov rdx, r14
nop dword [rax]
cmp rax, rsi
je 0x180063068
inc ecx
mov edx, ecx
mov rax, qword [rdi + rcx*8 + 0x170710]
test rax, rax
jne 0x180063050
jmp 0x180063079
mov r8, qword [rdi + rdx*8 + 0x16fda0]
test r8, r8
jne 0x18006315f
mov edx, 0x1f4
xor ecx, ecx
lea r9d, [rcx + 0x40]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, rax
test rax, rax
jne 0x1800630a0
mov r8, r14
jmp 0x18006313e
mov rax, rsi
mov rcx, r8
mov edx, 3
nop dword [rax + rax]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x1800630b0
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
mov eax, dword [rax + 0x70]
mov dword [rcx + 0x70], eax
mov rax, qword [0x180170a30]
mov qword [rdi + rax*8 + 0x170710], rsi
mov qword [rdi + rax*8 + 0x16fda0], r8
inc rax
mov qword [0x180170a30], rax
lea rdx, [rbp - 0x10]
mov rcx, qword [sym.imp.USER32.dll_GetAsyncKeyState]
call r8
movzx edx, ax
mov rcx, qword [rbp - 8]
xor rcx, qword [rbp]
mov rax, qword [rbp + 8]
mov qword [rax], rcx
test dx, dx
je 0x180063384
mov byte [reloc.WS2_32.dll_accept], 0
mov dword [0x1801090b8], 0x1485a760
mov dword [0x18013d374], 0x148588a8
mov dword [0x18011b244], 0xdc12b90
mov dword [0x18010e924], 0x150dc800
mov dword [0x1801090b4], 0x140
mov dword [0x1801434ec], 0x114160f0
mov dword [0x1801282f4], 0x14742790
mov dword [0x1801282f8], 0xcb53218
mov dword [0x18011d764], 0x13dc0
mov dword [0x180134538], 0xa00
mov dword [0x1801090b0], 0x6e0
mov dword [0x18011d768], 0x13cc0
mov dword [0x180131c28], 0x135f5
mov dword [0x18011b248], 0x638
mov dword [0x18010e928], 0x3d670
jmp 0x18006339b
lea rdx, [rbp + 0x88]
call fcn.180041990
nop
mov ecx, r14d
mov rax, qword [0x180170710]
test rax, rax
je 0x180063279
mov rdx, r14
nop dword [rax]
cmp rax, rsi
je 0x180063268
inc ecx
mov edx, ecx
mov rax, qword [rdi + rcx*8 + 0x170710]
test rax, rax
jne 0x180063250
jmp 0x180063279
mov r8, qword [rdi + rdx*8 + 0x16fda0]
test r8, r8
jne 0x18006335f
mov edx, 0x1f4
xor ecx, ecx
lea r9d, [rcx + 0x40]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, rax
test rax, rax
jne 0x1800632a0
mov r8, r14
jmp 0x18006333e
mov rcx, rsi
mov edx, 3
nop dword [rax + rax]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rax - 0x10], xmm1
lea rcx, [rcx + 0x80]
sub rdx, 1
jne 0x1800632b0
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
mov ecx, dword [rcx + 0x70]
mov dword [rax + 0x70], ecx
mov rax, qword [0x180170a30]
mov qword [rdi + rax*8 + 0x170710], rsi
mov qword [rdi + rax*8 + 0x16fda0], r8
inc rax
mov qword [0x180170a30], rax
lea rdx, [rbp - 0x10]
mov rcx, qword [sym.imp.USER32.dll_GetAsyncKeyState]
call r8
movzx edx, ax
mov rcx, qword [rbp - 8]
xor rcx, qword [rbp]
mov rax, qword [rbp + 8]
mov qword [rax], rcx
test dx, dx
jne 0x18006339b
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x180062ea0
mov byte [reloc.WS2_32.dll_accept], 1
lea rdx, [0x1800e4e72]
lea rcx, [0x180150978]
call fcn.180047040
mov dword [rsp + 0x50], 0xc48d8784
mov dword [rsp + 0x54], 0x88948e
mov byte [rsp + 0x58], 1
lea rcx, [rsp + 0x50]
call fcn.18004ff40
mov rcx, rax
call fcn.180045100
mov qword [0x180151c68], rax
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.180051ae0
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8, [0x180057eb0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x180151c80], rax
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8, [0x1800586f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x180152010], rax
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov byte [0x180151a7b], 1
lea rcx, [rbp + 0x30]
call fcn.180064f80
nop
lea rcx, [rbp + 0x40]
call fcn.180044b10
nop
lea rcx, [rbp + 0x20]
call fcn.180064f80
mov eax, 1
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.1800d0760
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret