Function at 0x1400618b0
Capabilities:
Create process on windows
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x300]
sub rsp, 0x400
mov rax, qword [0x14036d5a8]
xor rax, rsp
mov qword [rbp + 0x2f0], rax
xor r12d, r12d
lea rcx, [rbp + 0x10]
call fcn.1400607c0
nop
mov rdx, rax
lea rcx, [rbp - 0x50]
call fcn.1400600e0
mov rbx, rax
lea rsi, [0x140377578]
cmp rsi, rax
je 0x14006198e
mov rdx, qword [0x140377590]
cmp rdx, 0x10
jb 0x140061951
mov rcx, qword [0x140377578]
inc rdx
cmp rdx, 0x1000
jb 0x14006194c
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400629e9
mov rcx, r8
call fcn.1402571e4
mov qword [0x140377588], r12
mov qword [0x140377590], 0xf
mov byte [0x140377578], 0
movups xmm0, xmmword [rbx]
movups xmmword [0x140377578], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [0x140377588], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x1400619c9
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400619c4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400629e9
call fcn.1402571e4
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x50], 0
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x140061a14
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061a0f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400629ef
call fcn.1402571e4
cmp qword [0x1403774a0], 0xa
jne 0x140062981
cmp qword [0x1403774c0], 0x40
jne 0x140062981
mov dword [rsp + 0x68], 0x998187cb
mov dword [rsp + 0x6c], 0x829aad85
mov word [rsp + 0x70], reloc.WLDAP32.dll_Ordinal_200
mov byte [rsp + 0x72], 1
mov rcx, r12
nop
lea eax, [rcx - 0x13]
xor byte [rsp + rcx + 0x68], al
inc rcx
cmp rcx, 9
jb 0x140061a50
mov byte [rsp + 0x72], 0
lea rdx, [0x140377490]
lea rcx, [rbp + 0x160]
call fcn.140060510
mov r15, rax
mov dword [rsp + 0x58], 0x9e9881cb
mov dword [rsp + 0x5c], 0x909a8094
mov word [rsp + 0x60], reloc.WLDAP32.dll_Ordinal_200
mov byte [rsp + 0x62], 1
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx - 0x13]
xor byte [rsp + rcx + 0x58], al
inc rcx
cmp rcx, 9
jb 0x140061aa0
mov byte [rsp + 0x62], 0
lea rdx, [0x140377470]
lea rcx, [rbp + 0x140]
call fcn.140060510
mov r14, rax
mov dword [rsp + 0x40], 0x9d8e80cb
mov dword [rsp + 0x44], 0x100cf94
mov rcx, r12
nop
lea eax, [rcx - 0x13]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 6
jb 0x140061ae0
mov byte [rsp + 0x47], 0
lea rax, [rbp + 0x240]
mov qword [rsp + 0x38], rax
lea rdx, [0x140377430]
lea rcx, [rbp + 0x240]
call fcn.140068360
mov rdi, rax
lea rax, [rbp + 0x260]
mov qword [rsp + 0x30], rax
lea rdx, [0x1403774b0]
lea rcx, [rbp + 0x260]
call fcn.140068360
mov rbx, rax
mov rdx, rsi
lea rcx, [rbp + 0x200]
call fcn.140068360
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x120]
call fcn.140060910
mov rsi, rax
mov dword [rsp + 0x48], 0x93818bcb
mov dword [rsp + 0x4c], 0xc98a979a
mov word [rsp + 0x50], 0x100
mov rcx, r12
nop dword [rax + rax]
lea eax, [rcx - 0x13]
xor byte [rsp + rcx + 0x48], al
inc rcx
cmp rcx, 8
jb 0x140061b80
mov byte [rsp + 0x51], 0
lea rax, [rbp + 0x30]
mov qword [rbp - 0x78], rax
lea rdx, [0x140377430]
lea rcx, [rbp + 0x30]
call fcn.140068360
mov rdi, rax
lea rax, [rbp + 0x180]
mov qword [rsp + 0x38], rax
lea rdx, [0x1403774b0]
lea rcx, [rbp + 0x180]
call fcn.140068360
mov rbx, rax
lea rdx, [0x1403774d0]
lea rcx, [rbp + 0x2b0]
call fcn.140068360
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x100]
call fcn.140060910
mov rdi, rax
mov dword [rsp + 0x38], 0x828a98cb
mov word [rsp + 0x3c], 0xcc
mov byte [rsp + 0x3e], 1
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx - 0x13]
xor byte [rsp + rcx + 0x38], al
inc rcx
cmp rcx, 5
jb 0x140061c20
mov byte [rsp + 0x3e], 0
mov dword [rsp + 0x30], 0x84868084
mov word [rsp + 0x34], 0x100
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx - 0x13]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 4
jb 0x140061c50
mov byte [rsp + 0x35], 0
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x58], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x70], 0
lea rax, [rsp + 0x30]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140061c90
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x70]
call fcn.140069b20
nop
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0xe0]
call fcn.140060510
mov r10, rax
mov dword [rsp + 0x30], 0x959f9799
mov word [rsp + 0x34], 0xcc
mov byte [rsp + 0x36], 1
mov rcx, r12
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x13]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 5
jb 0x140061ce0
mov byte [rsp + 0x36], 0
lea rax, [rsp + 0x30]
mov r9, rbx
nop dword [rax]
inc r9
cmp byte [rax + r9], 0
jne 0x140061d00
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, r10
call fcn.14006c6b0
mov qword [rbp - 0x10], r12
mov qword [rbp], r12
mov qword [rbp + 8], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rax, [rsp + 0x38]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140061d50
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x10]
call fcn.140068230
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x20], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, rdi
lea r8, [rbp + 0x10]
lea rcx, [rbp - 0x50]
call fcn.14006c7c0
nop
lea rax, [rsp + 0x48]
mov r8, rbx
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140061da0
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x50]
call fcn.140068230
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1e0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1f0], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, rsi
lea r8, [rbp + 0x1e0]
lea rcx, [rbp + 0xc0]
call fcn.14006c7c0
nop
lea rax, [rsp + 0x40]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140061e00
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0xc0]
call fcn.140068230
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1c0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1d0], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, r14
lea r8, [rbp + 0x1c0]
lea rcx, [rbp + 0xa0]
call fcn.14006c7c0
nop
lea rax, [rsp + 0x58]
mov r8, rbx
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140061e60
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0xa0]
call fcn.140068230
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1a0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1b0], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, r15
lea r8, [rbp + 0x1a0]
lea rcx, [rbp + 0x80]
call fcn.14006c7c0
nop
lea rax, [rsp + 0x68]
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140061ec0
mov r8, rbx
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x80]
call fcn.140068230
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x18], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x20], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rdx, [0x140377430]
cmp qword [0x140377448], 0x10
cmovae rdx, qword [0x140377430]
mov r8, qword [0x140377440]
lea rcx, [rbp - 0x30]
call fcn.140068230
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x2d0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x2e0], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x140061f8d
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061f88
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400629f5
call fcn.1402571e4
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x30], 0
mov rdx, qword [rbp + 0x98]
cmp rdx, 0x10
jb 0x140061fde
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061fd9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400629fb
call fcn.1402571e4
mov qword [rbp + 0x90], r12
mov qword [rbp + 0x98], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x80], 0
mov rdx, qword [rbp + 0x1b8]
cmp rdx, 0x10
jb 0x140062039
inc rdx
mov rcx, qword [rbp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062033
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062a01
call fcn.1402571e4
nop
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0x10
jb 0x14006207a
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062075
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062a07
call fcn.1402571e4
mov qword [rbp + 0xb0], r12
mov qword [rbp + 0xb8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xa0], 0
mov rdx, qword [rbp + 0x1d8]
cmp rdx, 0x10
jb 0x1400620d5
inc rdx
mov rcx, qword [rbp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400620cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062a0d
call fcn.1402571e4
nop
mov rdx, qword [rbp + 0xd8]
cmp rdx, 0x10
jb 0x140062116
inc rdx
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062111
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062a13
call fcn.1402571e4
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xc0], 0
mov rdx, qword [rbp + 0x1f8]
cmp rdx, 0x10
jb 0x140062171
inc rdx
mov rcx, qword [rbp + 0x1e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006216b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062a19
call fcn.1402571e4
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x1400621ac
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400621a7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062a1f
call fcn.1402571e4
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x50], 0
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x1400621f8
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400621f2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062a25
call fcn.1402571e4
nop
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x140062233
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006222e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062a2b
call fcn.1402571e4
mov qword [rbp], r12
mov qword [rbp + 8], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x10], 0
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0x10
jb 0x140062284
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006227f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062a31
call fcn.1402571e4
mov qword [rbp + 0xf0], r12
mov qword [rbp + reloc.WS2_32.dll_ntohs8], 0xf
mov byte [rbp + 0xe0], 0
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x1400622d8
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400622d3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062a37
call fcn.1402571e4
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x58], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x70], 0
mov rdx, qword [rbp + 0x118]
cmp rdx, 0x10
jb 0x140062329
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062324
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062a3d
call fcn.1402571e4
mov qword [rbp + 0x110], r12
mov qword [rbp + 0x118], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x100], 0
mov rdx, qword [rbp + 0x138]
cmp rdx, 0x10
jb 0x140062383
inc rdx
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006237e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062a43
call fcn.1402571e4
mov qword [rbp + 0x130], r12
mov qword [rbp + 0x138], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x120], 0
mov rdx, qword [rbp + 0x158]
cmp rdx, 0x10
jb 0x1400623dd
inc rdx
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400623d8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062a49
call fcn.1402571e4
mov qword [rbp + 0x150], r12
mov qword [rbp + 0x158], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x140], 0
mov rdx, qword [rbp + 0x178]
cmp rdx, 0x10
jb 0x140062437
inc rdx
mov rcx, qword [rbp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062432
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062a4f
call fcn.1402571e4
mov qword [rbp + 0x170], r12
mov qword [rbp + 0x178], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x160], 0
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x80], r12
lea rsi, [rbp + 0x2d0]
mov rdi, qword [rbp + 0x2d0]
mov r15, qword [rbp + 0x2e8]
cmp r15, 0x10
cmovae rsi, rdi
movabs rax, 0x7fffffffffffffff
mov r14, qword [rbp + 0x2e0]
cmp r14, 0x10
jae 0x1400624a1
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x68], xmm0
mov ebx, reloc.WS2_32.dll_ntohs
jmp 0x14006250e
mov rbx, r14
or rbx, 0xf
cmp rbx, rax
cmova rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400624eb
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140062a55
mov rcx, rax
call fcn.140256f58
mov rcx, rax
test rax, rax
je 0x140062a5b
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400624fa
test rcx, rcx
je 0x1400624f7
call fcn.140256f58
jmp 0x1400624fa
mov rax, r12
mov qword [rsp + 0x68], rax
lea r8, [r14 + 1]
mov rdx, rsi
mov rcx, rax
call fcn.1402594d0
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x80], rbx
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x280]
call fcn.1400640b0
nop
lea rax, [rbp + 0x2b0]
mov qword [rbp - 0x78], rax
lea rdx, [0x140377430]
lea rcx, [rbp + 0x2b0]
call fcn.140068360
mov r12, rax
lea rax, [rbp + 0x180]
mov qword [rsp + 0x40], rax
lea rdx, [0x1403774b0]
lea rcx, [rbp + 0x180]
call fcn.140068360
mov r13, rax
xor eax, eax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov rsi, qword [rbp + 0x290]
lea r14, [rbp + 0x280]
cmp qword [rbp + 0x298], 0x10
cmovae r14, qword [rbp + 0x280]
cmp rsi, 0x10
jae 0x1400625ab
movups xmm0, xmmword [r14]
movups xmmword [rbp - 0x70], xmm0
lea ebx, [rax + 0xf]
jmp 0x14006261c
mov rbx, rsi
or rbx, 0xf
movabs rcx, 0x7fffffffffffffff
cmp rbx, rcx
cmova rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400625ff
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140062a61
mov rcx, rax
call fcn.140256f58
mov rcx, rax
test rax, rax
je 0x140062a67
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140062609
test rcx, rcx
je 0x140062609
call fcn.140256f58
mov qword [rbp - 0x70], rax
lea r8, [rsi + 1]
mov rdx, r14
mov rcx, rax
call fcn.1402594d0
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x58], rbx
mov r9, r12
mov r8, r13
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x10]
call fcn.140060cb0
mov rbx, rax
lea rax, [rbp + 0x280]
cmp rax, rbx
je 0x1400626cc
mov rdx, qword [rbp + 0x298]
cmp rdx, 0x10
jb 0x14006268b
inc rdx
mov rcx, qword [rbp + 0x280]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062686
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062a67
call fcn.1402571e4
xor esi, esi
mov qword [rbp + 0x290], rsi
mov qword [rbp + 0x298], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x280], sil
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x280], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x290], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
jmp 0x1400626ce
xor esi, esi
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x140062709
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062704
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062a67
call fcn.1402571e4
mov qword [rbp + 0x238], rsi
lea r8, [rbp + 0x200]
lea rdx, [rbp + 0x280]
lea rcx, [rbp + 0x2a0]
call fcn.14006abe0
nop
lea rdx, str.success
lea rcx, [rbp + 0x2a0]
call fcn.14006ad10
cmp byte [rax], 4
jne 0x140062a6d
lea rcx, [rbp + 0x2a0]
cmp byte [rax + 8], 0
je 0x140062864
lea rdx, str.sessionid
call fcn.14006ad10
cmp byte [rax], 3
jne 0x140062abe
mov r8, qword [rax + 8]
mov rdx, r8
cmp qword [r8 + 0x18], 0x10
jb 0x14006277e
mov rdx, qword [r8]
mov r8, qword [r8 + 0x10]
lea rcx, [0x140377558]
call fcn.140069b20
nop
movzx edx, byte [rbp + 0x2a0]
lea rcx, [rbp + 0x2a8]
call fcn.140069430
nop
mov rdx, qword [rbp + 0x298]
cmp rdx, 0x10
jb 0x1400627e4
inc rdx
mov rcx, qword [rbp + 0x280]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400627df
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062b0f
call fcn.1402571e4
mov qword [rbp + 0x290], rsi
mov qword [rbp + 0x298], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x280], 0
cmp r15, 0x10
jb 0x140062834
lea rdx, [r15 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14006282c
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062b15
mov rcx, rdi
call fcn.1402571e4
mov rcx, qword [rbp + 0x2f0]
xor rcx, rsp
call fcn.140256cc0
lea r11, [rsp + 0x400]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea rdx, str.message
call fcn.14006ad10
mov rdi, rax
mov byte [rsp + 0x68], 3
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.140256f58
mov rbx, rax
mov qword [rax], rsi
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov r8d, 0xa
lea rdx, str.invalidver
mov rcx, rax
call fcn.140069b20
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov rcx, rdi
call fcn.14006c2e0
movzx ebx, al
movzx edx, byte [rsp + 0x68]
lea rcx, [rsp + 0x70]
call fcn.140069430
nop
test bl, bl
jne 0x140062929
lea rdx, [0x1403383e4]
call fcn.14006a940
lea rdx, str.message
lea rcx, [rbp + 0x2a0]
call fcn.14006ad10
mov rdx, rax
lea rcx, [rbp + 0x2b0]
call fcn.14006afc0
nop
mov rdx, rax
call fcn.14006b060
nop
lea rcx, [rbp + 0x2b0]
call fcn.1400682c0
mov ecx, 0x1194
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call fcn.140266130
int3
lea rdx, str.download
lea rcx, [rbp + 0x2a0]
call fcn.14006ad10
lea rdx, [rbp + 0x2b0]
mov rcx, rax
call fcn.14006af00
lea rcx, [rbp + 0x2b0]
call fcn.140068220
mov r8, rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor ecx, ecx
call fcn.140266130
nop
movdqa xmm0, xmmword [0x14033f8c0]
movdqa xmmword [rbp + 0x30], xmm0
movdqa xmm1, xmmword [0x14033f870]
movdqa xmmword [rbp + 0x40], xmm1
movdqa xmm0, xmmword [0x14033f860]
movdqa xmmword [rbp + 0x50], xmm0
movdqa xmm1, xmmword [0x14033f830]
movdqa xmmword [rbp + 0x60], xmm1
mov dword [rbp + 0x70], 0x594e630d
mov dword [rbp + 0x74], 0x44501c5f
mov word [rbp + 0x78], 0x45
mov byte [rbp + 0x7a], 1
lea rdx, [rbp + 0x30]
call fcn.140062b20
mov ecx, 0x1194
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call fcn.140266130
nop
call fcn.14026ebf0
nop
call fcn.14026ebf0
nop
call fcn.14026ebf0
nop
call fcn.14026ebf0
nop
call fcn.14026ebf0
nop
call fcn.14026ebf0
nop
call fcn.14026ebf0
nop
call fcn.14026ebf0
nop
call fcn.14026ebf0
nop
call fcn.14026ebf0
nop
call fcn.14026ebf0
nop
call fcn.14026ebf0
nop
call fcn.14026ebf0
nop
call fcn.14026ebf0
nop
call fcn.14026ebf0
nop
call fcn.14026ebf0
nop
call fcn.14026ebf0
nop
call fcn.14026ebf0
int3
call fcn.14005b700
int3
call fcn.14026ebf0
nop
call fcn.14005b700
int3
call fcn.14026ebf0
nop
mov rcx, rax
call fcn.140069920
mov rdx, rax
lea rcx, [rbp + 0x2b0]
call fcn.140068320
nop
mov r8, rax
lea rdx, str.type_must_be_boolean__but_is
lea rcx, [rbp + 0x180]
call fcn.14006a520
nop
mov r8, rax
mov edx, 0x12e
lea rcx, [rbp + 0x30]
call fcn.14005f290
lea rdx, [0x140365970]
lea rcx, [rbp + 0x30]
call fcn.1402593fc
nop
mov rcx, rax
call fcn.140069920
mov rdx, rax
lea rcx, [rbp + 0x2b0]
call fcn.140068320
nop
mov r8, rax
lea rdx, str.type_must_be_string__but_is
lea rcx, [rbp + 0x180]
call fcn.14006a520
nop
mov r8, rax
mov edx, 0x12e
lea rcx, [rbp + 0x30]
call fcn.14005f290
lea rdx, [0x140365970]
lea rcx, [rbp + 0x30]
call fcn.1402593fc
nop
call fcn.14026ebf0
nop
call fcn.14026ebf0
int3