Function at 0x140058540
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Create thread
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x4b0]
sub rsp, 0x5b0
mov rax, qword [0x14023b780]
xor rax, rsp
mov qword [rbp + 0x4a0], rax
mov rsi, rcx
xor r13d, r13d
mov dword [rsp + 0x40], r13d
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, [0x14005b4e0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp qword [rsi + 0x30], 0xa
jne 0x1400596c3
cmp qword [rsi + 0x50], 0x40
jne 0x1400596c3
xorps xmm0, xmm0
movups xmmword [rbp + 0x348], xmm0
xorps xmm1, xmm1
movups xmmword [rbp + 0x308], xmm1
mov ebx, r13d
mov qword [rbp + 0x318], rbx
mov edi, reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x320], rdi
mov byte [rbp + 0x308], bl
lea rcx, [rbp + 0x348]
call qword [sym.imp.RPCRT4.dll_UuidCreate]
mov qword [rbp + 0x260], r13
lea rdx, [rbp + 0x260]
lea rcx, [rbp + 0x348]
call qword [sym.imp.RPCRT4.dll_UuidToStringA]
test eax, eax
jne 0x140058652
mov rdx, qword [rbp + 0x260]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x140058621
lea rcx, [rbp + 0x308]
call fcn.14003c720
lea rcx, [rbp + 0x260]
call qword [sym.imp.RPCRT4.dll_RpcStringFreeA]
mov rdi, qword [rbp + 0x320]
mov rbx, qword [rbp + 0x318]
xorps xmm0, xmm0
movups xmmword [rbp + 0x2e8], xmm0
mov qword [rbp + 0x2f8], r13
mov qword [rbp + 0x300], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x2e8], 0
movups xmmword [rbp], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x10], xmm1
mov r8d, reloc.WS2_32.dll_recv
cmp rbx, r8
cmovb r8, rbx
lea rdx, [rbp + 0x308]
cmp rdi, 0x10
cmovae rdx, qword [rbp + 0x308]
lea rcx, [rbp]
call fcn.140047410
lea rdx, [rbp]
lea rcx, [rbp + 0x2e8]
call fcn.140039e90
lea rcx, [rbp]
call fcn.140047330
mov word [rsp + 0x40], 0x2d
mov byte [rsp + 0x42], 0
lea r9, [rbp + 0x268]
lea r8, [rsp + 0x41]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.1400403f0
nop
lea r8, [rbp + 0x2e8]
cmp qword [rbp + 0x300], 0x10
cmovae r8, qword [rbp + 0x2e8]
mov r9, qword [rbp + 0x2f8]
xor edx, edx
lea rcx, [rsp + 0x48]
call fcn.140059a10
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x80], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r8, qword [rsp + 0x60]
cmp r8, 0x10
jb 0x140058761
inc r8
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x48]
call fcn.1400472f0
movdqa xmm0, xmmword [0x14021c240]
movdqu xmmword [rsp + 0x58], xmm0
mov byte [rsp + 0x48], 0
lea r15, [rsi + 0x40]
mov r8, r15
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x290]
call fcn.14004a0a0
lea rcx, [rsi + 0x258]
mov rdx, rax
call fcn.140039e90
lea rcx, [rbp + 0x290]
call fcn.140047330
nop
lea rcx, [rsp + 0x70]
call fcn.140047330
lea rcx, [rbp + 0x328]
call fcn.140055260
nop
call fcn.1400cc6f0
mov rbx, rax
mov dword [rsp + 0x48], 0x78627b35
mov dword [rsp + 0x4c], 0x7e706a72
mov word [rsp + 0x50], 0x26
mov byte [rsp + 0x52], 1
mov rdx, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x1400587f0
mov rdx, qword [rsi]
xor r8d, r8d
mov rcx, rbx
call fcn.1400cb170
mov rdi, rax
mov dword [rbp - 0x60], 0x7b747a35
mov dword [rbp - 0x5c], 0x1002572
mov dword [rbp + 0x270], 0x757b7135
mov dword [rbp + 0x274], 0x27607d7c
mov word [rbp + 0x278], 0x100
mov dword [rbp - 0x58], 0x65747c35
mov dword [rbp - 0x54], 0x100257f
mov dword [rsp + 0x40], 0x64706235
mov word [rsp + 0x44], 0x2a
mov byte [rsp + 0x46], 1
mov dword [rsp + 0x70], 0x73656d67
mov dword [rsp + 0x74], 0x7377712a
mov word [rsp + 0x78], reloc.WS2_32.dll_WSAGetLastError
mov byte [rsp + 0x7a], 1
mov rcx, r13
nop word [rax + rax]
lea eax, [rcx + 0x13]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 5
jb 0x140058870
mov byte [rsp + 0x46], 0
lea r9, [rbp + 0x268]
lea r8, [rsp + 0x45]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x290]
call fcn.1400403f0
nop
cmp byte [rsp + 0x7a], 0
je 0x1400588c5
mov rcx, r13
nop dword [rax]
lea eax, [rcx + 0x13]
xor byte [rsp + rcx + 0x70], al
inc rcx
cmp rcx, 9
jb 0x1400588b0
mov byte [rsp + 0x7a], 0
lea r9, [rbp + 0x268]
lea r8, [rsp + 0x79]
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x20]
call fcn.1400403f0
nop
lea r9, [rbp + 0x290]
lea r8, [rbp + 0x20]
movzx edx, byte [rbp + 0x268]
lea rcx, [rbp]
call fcn.140052b20
nop
lea rcx, [rbp + 0x20]
call fcn.140047330
nop
lea rcx, [rbp + 0x290]
call fcn.140047330
nop
lea r8, [rsi + 0x60]
lea rdx, [rbp]
lea rcx, [rbp - 0x50]
call fcn.14004a0a0
nop
lea r8, [rbp - 0x58]
mov rdx, rax
lea rcx, [rbp + 0x100]
call fcn.14004ba60
nop
lea rdx, [rbp + 0x328]
cmp qword [rbp + 0x340], 0x10
cmovae rdx, qword [rbp + 0x328]
mov r8, qword [rbp + 0x338]
mov rcx, rax
call fcn.1400438c0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x70], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rbp + 0x270]
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x80]
call fcn.14004bb40
nop
lea rdx, [rbp + 0x2e8]
cmp qword [rbp + 0x300], 0x10
cmovae rdx, qword [rbp + 0x2e8]
mov r8, qword [rbp + 0x2f8]
mov rcx, rax
call fcn.1400438c0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xa0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xb0], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r14d, 0x3ff0000
lea r8, [rbp - 0x60]
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0xc0]
call fcn.14004ba60
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rbp + 0xe0]
call fcn.14004a2e0
nop
lea r8, [rsp + 0x48]
mov rdx, rax
lea rcx, [rbp + 0x40]
call fcn.14004bc20
nop
lea r8, [rsi + 0x20]
mov rdx, rax
lea rcx, [rbp + 0x378]
call fcn.14004a0a0
nop
lea rcx, [rbp + 0x40]
call fcn.140047330
nop
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0x10
jb 0x140058a81
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140058a7c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005972a
call fcn.14013ea10
movdqa xmm0, xmmword [0x14021c240]
movdqu xmmword [rbp + 0xf0], xmm0
mov byte [rbp + 0xe0], 0
mov rdx, qword [rbp + 0xd8]
cmp rdx, 0x10
jb 0x140058ad9
inc rdx
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140058ad4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140059730
call fcn.14013ea10
movdqa xmm0, xmmword [0x14021c240]
movdqu xmmword [rbp + 0xd0], xmm0
mov byte [rbp + 0xc0], 0
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0x10
jb 0x140058b32
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140058b2c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140059736
call fcn.14013ea10
nop
mov rdx, qword [rbp + 0x98]
cmp rdx, 0x10
jb 0x140058b73
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140058b6e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005973c
call fcn.14013ea10
movdqa xmm0, xmmword [0x14021c240]
movdqu xmmword [rbp + 0x90], xmm0
mov byte [rbp + 0x80], 0
mov rdx, qword [rbp + 0x78]
cmp rdx, 0x10
jb 0x140058bc6
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140058bc0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140059742
call fcn.14013ea10
nop
mov rdx, qword [rbp + 0x118]
cmp rdx, 0x10
jb 0x140058c07
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140058c02
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140059748
call fcn.14013ea10
movdqa xmm0, xmmword [0x14021c240]
movdqu xmmword [rbp + 0x110], xmm0
mov byte [rbp + 0x100], 0
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140058c59
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140058c54
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005974e
call fcn.14013ea10
movdqa xmm0, xmmword [0x14021c240]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x10
jb 0x140058ca5
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140058ca0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140059754
call fcn.14013ea10
movdqa xmm0, xmmword [0x14021c240]
movdqu xmmword [rbp + 0x10], xmm0
mov byte [rbp], 0
mov rcx, rbx
call fcn.1400cc6c0
lea rax, [rbp + 0x290]
mov qword [rbp - 0x70], rax
lea rdx, [rsi + 0x80]
lea rcx, [rbp + 0x290]
call fcn.1400458a0
mov rbx, rax
lea rdx, [rbp + 0x378]
lea rcx, [rbp + 0x20]
call fcn.1400458a0
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x2c8]
call fcn.14005c6b0
nop
movdqa xmm0, xmmword [str.XqlWblqERrk]
movdqu xmmword [rsp + 0x48], xmm0
mov byte [rsp + 0x58], 1
cmp qword [rbp + 0x2d8], 0x10
jne 0x140058dae
mov rcx, r13
nop word [rax + rax]
lea eax, [rcx + 0x13]
xor byte [rsp + rcx + 0x48], al
inc rcx
cmp rcx, 0xf
jb 0x140058d30
mov byte [rsp + 0x58], 0
lea r9, [rbp + 0x268]
lea r8, [rsp + 0x57]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x70]
call fcn.1400403f0
mov r14d, 0x3ffc000
lea rdx, [rsp + 0x70]
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rbp - 0x78]
cmp rdi, 0x10
cmovae rdx, rbx
lea rcx, [rbp + 0x2c8]
cmp qword [rbp + 0x2e0], 0x10
cmovae rcx, qword [rbp + 0x2c8]
mov r8, qword [rbp + 0x2d8]
cmp r8, qword [rbp - 0x80]
jne 0x140058db7
call fcn.1401802d0
test eax, eax
jne 0x140058db7
mov r12b, 1
jmp 0x140058dba
mov rdi, qword [rbp - 0x78]
mov rbx, qword [rsp + 0x70]
xor r12b, r12b
bt r14d, 0xe
jae 0x140058dfd
btr r14d, 0xe
cmp rdi, 0x10
jb 0x140058dfd
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140058df5
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005975a
mov rcx, rbx
call fcn.14013ea10
test r12b, r12b
jne 0x140059760
mov qword [rbp - 0x18], r13
mov byte [rsp + 0x20], r12b
mov r9b, 1
lea r8, [rbp - 0x50]
lea rdx, [rbp + 0x2c8]
lea rcx, [rbp + 0x280]
call fcn.1400504d0
nop
mov dword [rsp + 0x30], 0x6566717e
mov dword [rsp + 0x34], 0x7c7f76
mov byte [rsp + 0x38], 1
lea rdx, [rbp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.140053d50
mov rdx, rax
lea rcx, [rbp + 0x280]
call fcn.140053ac0
lea rdx, [rbp + 0x358]
mov rcx, rax
call fcn.14004b930
nop
xor edx, edx
mov r8d, 0xf8
lea rcx, [rbp + 0x3a0]
call fcn.140180a70
mov edx, 1
lea rcx, [rbp + 0x3a0]
call fcn.140052cd0
nop
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x2b0], xmm1
mov qword [rbp + 0x2c0], r13
mov ecx, 0x20
call fcn.14013f014
mov qword [rbp + 0x2b0], rax
lea rcx, [rax + 0x20]
mov qword [rbp + 0x2c0], rcx
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
mov qword [rbp + 0x2b8], rcx
mov qword [rbp - 0x60], r13
lea rcx, [rbp - 0x60]
call fcn.140053130
nop
mov rax, qword [rbp + 0x2b8]
mov rcx, qword [rbp + 0x2b0]
sub rax, rcx
lea r8, [rbp + 0x2c8]
cmp qword [rbp + 0x2e0], 0x10
cmovae r8, qword [rbp + 0x2c8]
cmp qword [r15 + 0x18], 0x10
jb 0x140058f11
mov r15, qword [r15]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov r9, qword [rbp + 0x2d8]
mov rdx, qword [rsi + 0x50]
mov rcx, r15
call fcn.14005fac0
mov r15, qword [rbp + 0x2b8]
mov rdi, qword [rbp + 0x2b0]
cmp rdi, r15
je 0x140058fcc
nop word [rax + rax]
movzx ebx, byte [rdi]
mov rax, qword [rbp + 0x3b0]
movsxd rcx, dword [rax + 4]
mov eax, dword [rbp + rcx + 0x3c8]
and eax, 0xfffff9ff
bts eax, 0xb
mov dword [rbp + rcx + 0x3c8], eax
mov rax, qword [rbp + 0x3b0]
movsxd rcx, dword [rax + 4]
mov byte [rbp + rcx + 0x408], 0x30
mov edx, 2
lea rcx, [rsp + 0x48]
call fcn.14013d3dc
mov r8, qword [rax]
mov rcx, qword [rbp + 0x3b0]
movsxd rdx, dword [rcx + 4]
lea rcx, [rbp + 0x3b0]
add rcx, rdx
mov rdx, qword [rax + 8]
call r8
mov edx, ebx
lea rcx, [rbp + 0x3b0]
call fcn.140039b50
inc rdi
cmp rdi, r15
jne 0x140058f50
lea r15, [section..data]
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae r15, qword [section..data]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x14021c240]
movdqu xmmword [rbp - 0x80], xmm1
mov byte [rsp + 0x70], 0
or r14d, 2
mov dword [rsp + 0x40], r14d
xor eax, eax
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rax
mov rcx, qword [rbp + 0x428]
mov eax, ecx
and al, 0x22
cmp al, 2
je 0x14005904e
mov rax, qword [rbp + 0x3f8]
mov r8, qword [rax]
test r8, r8
je 0x14005904e
mov rax, qword [rbp + 0x3d8]
mov rdx, qword [rax]
cmp r8, qword [rbp + 0x420]
cmovb r8, qword [rbp + 0x420]
sub r8, rdx
jmp 0x140059088
test cl, 4
jne 0x14005907e
mov rax, qword [rbp + 0x3f0]
mov rcx, qword [rax]
test rcx, rcx
je 0x14005907e
mov rax, qword [rbp + 0x3d0]
mov rdx, qword [rax]
mov rax, qword [rbp + 0x408]
movsxd r8, dword [rax]
add r8, rcx
sub r8, rdx
jmp 0x140059088
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x140059098
lea rcx, [rsp + 0x70]
call fcn.14003c720
nop
lea rcx, [rsp + 0x70]
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rbp - 0x78]
cmp rdi, 0x10
cmovae rcx, rbx
mov r8d, 8
mov rdx, r15
call fcn.1400556c0
movzx r14d, al
cmp rdi, 0x10
jb 0x1400590f7
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x1400590ef
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400597c4
mov rcx, rbx
call fcn.14013ea10
test r14b, r14b
jne 0x14005911b
lea r8, [rbp + 0x358]
lea rdx, str.Signature_checksum_failed._Request_was_tampered_with_or_session_ended_most_likely.__echo:__echo_Message:
lea rcx, [rbp + 0x40]
call fcn.14004a110
mov rcx, rax
call fcn.140057210
lea rdx, [rbp + 0x280]
lea rcx, [rsp + 0x48]
call fcn.140052680
mov rdx, rax
mov rcx, rsi
call fcn.140059e20
mov dword [rsp + 0x30], 0x75766160
mov dword [rsp + 0x34], 0x6a6b72
mov byte [rsp + 0x38], 1
mov rcx, r13
nop
lea eax, [rcx + 0x13]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 7
jb 0x140059150
mov byte [rsp + 0x38], 0
lea r9, [rbp + 0x268]
lea r8, [rsp + 0x37]
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x290]
call fcn.1400403f0
lea rdx, [rbp + 0x290]
lea rcx, [rbp + 0x280]
call fcn.140053ac0
mov rcx, rax
call fcn.14004b9f0
test al, al
je 0x140059592
mov dword [rsp + 0x48], 0x4562717d
mov dword [rsp + 0x4c], 0x736a6b72
mov dword [rsp + 0x50], 0x1007274
mov rcx, r13
lea eax, [rcx + 0x13]
xor byte [rsp + rcx + 0x48], al
inc rcx
cmp rcx, 0xa
jb 0x1400591c0
mov byte [rsp + 0x53], 0
lea r9, [rbp + 0x268]
lea r8, [rsp + 0x52]
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x20]
call fcn.1400403f0
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x280]
call fcn.140053ac0
mov rcx, rax
call fcn.14004b9f0
test al, al
je 0x140059216
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0x70], 0x65667160
mov dword [rsp + 0x74], 0x7377777e
mov word [rsp + 0x78], 0x7f
mov byte [rsp + 0x7a], 1
mov rcx, r13
nop word [rax + rax]
lea eax, [rcx + 0x13]
xor byte [rsp + rcx + 0x70], al
inc rcx
cmp rcx, 9
jb 0x140059240
mov byte [rsp + 0x7a], 0
lea r9, [rbp + 0x268]
lea r8, [rsp + 0x79]
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x290]
call fcn.1400403f0
lea rdx, [rbp + 0x290]
lea rcx, [rbp + 0x280]
call fcn.140053ac0
mov rdx, rax
lea rcx, [rsi + 0x238]
call fcn.14004b7d0
mov byte [0x14023df38], 1
mov dword [rsp + 0x30], 0x7f656472
mov dword [rsp + 0x34], 0x767e79
mov byte [rsp + 0x38], 1
mov rcx, r13
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x13]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 7
jb 0x1400592c0
mov byte [rsp + 0x38], 0
lea r9, [rbp + 0x268]
lea r8, [rsp + 0x37]
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x290]
call fcn.1400403f0
lea rdx, [rbp + 0x290]
lea rcx, [rbp + 0x280]
call fcn.140053ac0
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140052680
mov rdx, rax
mov rcx, rsi
call fcn.140059c90
nop
mov rcx, qword [rbp + 0x2b0]
test rcx, rcx
je 0x140059370
mov rdx, qword [rbp + 0x2c0]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140059359
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400597ca
call fcn.14013ea10
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x2b0], xmm0
mov qword [rbp + 0x2c0], r13
lea rcx, [rbp + 0x3a0]
call fcn.140053f40
nop
mov rdx, qword [rbp + 0x370]
cmp rdx, 0x10
jb 0x1400593be
inc rdx
mov rcx, qword [rbp + 0x358]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400593b9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400599f0
call fcn.14013ea10
movdqa xmm0, xmmword [0x14021c240]
movdqu xmmword [rbp + 0x368], xmm0
mov byte [rbp + 0x358], 0
movzx edx, byte [rbp + 0x280]
lea rcx, [rbp + 0x288]
call fcn.1400558a0
nop
mov rdx, qword [rbp + 0x2e0]
cmp rdx, 0x10
jb 0x14005942a
inc rdx
mov rcx, qword [rbp + 0x2c8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140059425
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400599f6
call fcn.14013ea10
mov qword [rbp + 0x2d8], r13
mov qword [rbp + 0x2e0], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x2c8], 0
mov rdx, qword [rbp + 0x390]
cmp rdx, 0x10
jb 0x140059485
inc rdx
mov rcx, qword [rbp + 0x378]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005947f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400599fc
call fcn.14013ea10
nop
mov rdx, qword [rbp + 0x340]
cmp rdx, 0x10
jb 0x1400594c6
inc rdx
mov rcx, qword [rbp + 0x328]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400594c1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140059a02
call fcn.14013ea10
mov qword [rbp + 0x338], r13
mov qword [rbp + 0x340], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x328], 0
mov rdx, qword [rbp + 0x300]
cmp rdx, 0x10
jb 0x140059521
inc rdx
mov rcx, qword [rbp + 0x2e8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005951b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140059a08
call fcn.14013ea10
nop
mov rdx, qword [rbp + 0x320]
cmp rdx, 0x10
jb 0x140059562
inc rdx
mov rcx, qword [rbp + 0x308]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005955d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400596bd
call fcn.14013ea10
mov rcx, qword [rbp + 0x4a0]
xor rcx, rsp
call fcn.14013e9f0
lea r11, [rsp + 0x5b0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov dword [rsp + 0x48], 0x77637a7a
mov dword [rsp + 0x4c], 0x6c7d717b
mov dword [rsp + 0x50], 0x1006e7e
mov byte [rsp + 0x70], 0
xor eax, eax
mov qword [rsp + 0x78], rax
xor edx, edx
lea rcx, [rsp + 0x78]
call fcn.1400558a0
mov byte [rsp + 0x70], 3
xorps xmm0, xmm0
movups xmmword [rbp + 0x270], xmm0
mov ecx, 0x20
call fcn.14013f014
mov rbx, rax
lea rax, [rbp + 0x268]
mov qword [rbp + 0x270], rax
mov qword [rbp + 0x278], rbx
cmp byte [rsp + 0x53], 0
je 0x140059615
mov rdx, r13
nop dword [rax]
lea ecx, [rdx + 0x13]
xor byte [rsp + rdx + 0x48], cl
inc rdx
cmp rdx, 0xa
jb 0x140059600
mov byte [rsp + 0x53], 0
lea r9, [rsp + 0x68]
lea r8, [rsp + 0x52]
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.1400403f0
nop
mov qword [rsp + 0x78], rbx
mov dword [rbp - 0x70], 0x6566717e
mov dword [rbp - 0x6c], 0x7c7f76
mov byte [rbp - 0x68], 1
mov rcx, r13
nop word [rax + rax]
lea eax, [rcx + 0x13]
xor byte [rbp + rcx - 0x70], al
inc rcx
cmp rcx, 7
jb 0x140059650
mov byte [rbp - 0x68], 0
lea r9, [rsp + 0x68]
lea r8, [rbp - 0x69]
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x290]
call fcn.1400403f0
lea rdx, [rbp + 0x290]
lea rcx, [rbp + 0x280]
call fcn.140053ac0
mov rcx, rax
lea rdx, [rsp + 0x70]
call fcn.1400536f0
movzx ebx, al
movzx edx, byte [rsp + 0x70]
lea rcx, [rsp + 0x78]
call fcn.1400558a0
nop
test bl, bl
jne 0x1400597d0
jmp 0x14005931e
call fcn.1401507a4
int3
movdqa xmm0, xmmword [str.Rdezxnrss_QOU]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [str.pAQSW_bjEYHM_H]
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmm0, xmmword [0x140186350]
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmm1, xmmword [0x140186360]
movdqa xmmword [rbp - 0x20], xmm1
mov dword [rbp - 0x10], 0x357b3a3a
mov dword [rbp - 0xc], 0x1002827
lea rcx, [rbp - 0x50]
call fcn.140054f80
mov rdx, rax
mov r9d, reloc.WS2_32.dll_recv
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call fcn.140151534
nop
call fcn.1401507a4
nop
call fcn.1401507a4
nop
call fcn.1401507a4
nop
call fcn.1401507a4
nop
call fcn.1401507a4
nop
call fcn.1401507a4
nop
call fcn.1401507a4
nop
call fcn.1401507a4
nop
call fcn.1401507a4
int3
movdqa xmm0, xmmword [str.Rdezxnrss_qOU]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [0x1401863d0]
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmm0, xmmword [0x140186320]
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmm1, xmmword [0x140186370]
movdqa xmmword [rbp - 0x20], xmm1
mov dword [rbp - 0x10], 0x7b3021
mov byte [rbp - 0xc], 1
lea rcx, [rbp - 0x50]
call fcn.140054f50
mov rdx, rax
mov r9d, reloc.WS2_32.dll_recv
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call fcn.140151534
nop
call fcn.1401507a4
nop
call fcn.1401507a4
nop
mov dword [rbp + 0x270], 0x78627b77
mov dword [rbp + 0x274], 0x7e78777b
mov word [rbp + 0x278], 0x100
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x270]
call fcn.140053d90
mov rdx, rax
lea rcx, [rbp + 0x280]
call fcn.140053ac0
lea rdx, [rbp + 0x290]
mov rcx, rax
call fcn.14004b930
lea rdx, [0x14021ae1c]
lea rcx, [rbp + 0x290]
call fcn.1400453b0
test al, al
je 0x1400599a2
movdqa xmm0, xmmword [0x140186390]
movdqa xmmword [rbp + 0x120], xmm0
movdqa xmm1, xmmword [0x1401863b0]
movdqa xmmword [rbp + 0x130], xmm1
movdqa xmm0, xmmword [0x1401863f0]
movdqa xmmword [rbp + 0x140], xmm0
movdqa xmm1, xmmword [0x140186330]
movdqa xmmword [rbp + 0x150], xmm1
movdqa xmm0, xmmword [str._1u28_76493_t]
movdqa xmmword [rbp + 0x160], xmm0
movdqa xmm1, xmmword [str.C_v_vF]
movdqa xmmword [rbp + 0x170], xmm1
movdqa xmm0, xmmword [0x140186440]
movdqa xmmword [rbp + 0x180], xmm0
movdqa xmm1, xmmword [0x140186490]
movdqa xmmword [rbp + 0x190], xmm1
movdqa xmm0, xmmword [0x140186470]
movdqa xmmword [rbp + 0x1a0], xmm0
movdqa xmm1, xmmword [0x140186480]
movdqa xmmword [rbp + 0x1b0], xmm1
movdqa xmm0, xmmword [0x140186450]
movdqa xmmword [rbp + 0x1c0], xmm0
movdqa xmm1, xmmword [0x140186460]
movdqa xmmword [rbp + 0x1d0], xmm1
movdqa xmm0, xmmword [0x140186430]
movdqa xmmword [rbp + 0x1e0], xmm0
movdqa xmm1, xmmword [0x140186420]
movdqa xmmword [rbp + 0x1f0], xmm1
movdqa xmm0, xmmword [0x140186400]
movdqa xmmword [rbp + 0x200], xmm0
movdqa xmm1, xmmword [0x140186410]
movdqa xmmword [rbp + 0x210], xmm1
movdqa xmm0, xmmword [0x140186380]
movdqa xmmword [rbp + 0x220], xmm0
movdqa xmm1, xmmword [0x1401863a0]
movdqa xmmword [rbp + 0x230], xmm1
movdqa xmm0, xmmword [0x140186340]
movdqa xmmword [rbp + 0x240], xmm0
mov dword [rbp + 0x250], 0x3f293020
mov word [rbp + 0x254], WSASetLastError
mov byte [rbp + 0x256], 1
lea rcx, [rbp + 0x120]
call fcn.140054f20
mov rdx, rax
mov r9d, reloc.WS2_32.dll_recv
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x1400599e8
lea rcx, [rbp + 0x290]
call fcn.1400445a0
mov rbx, rax
mov dword [rsp + 0x40], 0x7870647c
mov word [rsp + 0x44], 0x100
lea rcx, [rsp + 0x40]
call fcn.140054ef0
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor ecx, ecx
call fcn.140151534
nop
call fcn.1401507a4
nop
call fcn.1401507a4
nop
call fcn.1401507a4
nop
call fcn.1401507a4
nop
call fcn.1401507a4
int3