Function at 0x140061960
Capabilities:
Create process on windows
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x338]
sub rsp, 0x420
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
mov rax, qword [0x14037c600]
xor rax, rsp
mov qword [rbp + 0x2f0], rax
xor r12d, r12d
lea rcx, [rbp]
call fcn.140060790
nop
mov rdx, rax
lea rcx, [rbp + 0x280]
call fcn.1400600b0
mov rbx, rax
lea rsi, [0x140386458]
cmp rsi, rax
je 0x140061a48
mov rdx, qword [0x140386470]
cmp rdx, 0xf
jbe 0x140061a0b
mov rcx, qword [0x140386458]
inc rdx
cmp rdx, 0x1000
jb 0x140061a06
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140062ae3
mov rcx, r8
call fcn.1402619ec
mov qword [0x140386468], r12
mov qword [0x140386470], 0xf
mov byte [0x140386458], 0
movups xmm0, xmmword [rbx]
movups xmmword [0x140386458], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [0x140386468], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rbp + 0x298]
cmp rdx, 0xf
jbe 0x140061a89
inc rdx
mov rcx, qword [rbp + 0x280]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061a84
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062ae3
call fcn.1402619ec
movdqa xmm0, xmmword [0x14034d170]
movdqu xmmword [rbp + 0x290], xmm0
mov byte [rbp + 0x280], 0
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x140061adb
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061ad6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062ae9
call fcn.1402619ec
cmp qword [0x140386380], 0xa
jne 0x140061af3
cmp qword [0x1403863a0], 0x40
je 0x140061b78
movdqa xmm0, xmmword [0x14034d360]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [0x14034d300]
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmm0, xmmword [0x14034d2b0]
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmm1, xmmword [0x14034d2d0]
movdqa xmmword [rbp - 0x20], xmm1
mov dword [rbp - 0x10], 0xbfb499f3
mov dword [rbp - 0xc], 0xaabaf6b9
mov word [rbp - 8], 0xab
mov byte [rbp - 6], 1
mov rcx, r12
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x6d]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0x49
jb 0x140061b50
mov byte [rbp - 6], 0
lea rdx, [rbp - 0x50]
call fcn.140076320
mov ecx, 0x1194
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0x68], 0xfffbfdb5
mov dword [rsp + 0x6c], 0xecf0c7e3
mov word [rsp + 0x70], 0xa6
mov byte [rsp + 0x72], 1
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx - 0x6d]
xor byte [rsp + rcx + 0x68], al
inc rcx
cmp rcx, 9
jb 0x140061ba0
mov byte [rsp + 0x72], 0
lea rdx, [0x140386370]
lea rcx, [rbp]
call fcn.1400604e0
mov r15, rax
mov dword [rsp + 0x58], 0xf8e2fbb5
mov dword [rsp + 0x5c], 0xfef0eaf2
mov word [rsp + 0x60], 0xa6
mov byte [rsp + 0x62], 1
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx - 0x6d]
xor byte [rsp + rcx + 0x58], al
inc rcx
cmp rcx, 9
jb 0x140061bf0
mov byte [rsp + 0x62], 0
lea rdx, [0x140386350]
lea rcx, [rbp + 0x1e0]
call fcn.1400604e0
mov r14, rax
mov dword [rsp + 0x40], 0xfbf4fab5
mov dword [rsp + 0x44], 0x100a5f2
mov rcx, r12
nop
lea eax, [rcx - 0x6d]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 6
jb 0x140061c30
mov byte [rsp + 0x47], 0
lea rax, [rbp + 0x240]
mov qword [rsp + 0x38], rax
lea rdx, [0x140386308]
lea rcx, [rbp + 0x240]
call fcn.140073f70
mov rdi, rax
lea rax, [rbp + 0x260]
mov qword [rsp + 0x30], rax
lea rdx, [0x140386390]
lea rcx, [rbp + 0x260]
call fcn.140073f70
mov rbx, rax
mov rdx, rsi
lea rcx, [rbp + 0x200]
call fcn.140073f70
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x1c0]
call fcn.140060910
mov rsi, rax
mov dword [rsp + 0x48], 0xf5fbf1b5
mov dword [rsp + 0x4c], 0xa7e0fdfc
mov word [rsp + 0x50], 0x100
mov rcx, r12
nop dword [rax + rax]
lea eax, [rcx - 0x6d]
xor byte [rsp + rcx + 0x48], al
inc rcx
cmp rcx, 8
jb 0x140061cd0
mov byte [rsp + 0x51], 0
lea rax, [rbp - 0x50]
mov qword [rbp - 0x78], rax
lea rdx, [0x140386308]
lea rcx, [rbp - 0x50]
call fcn.140073f70
mov rdi, rax
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x38], rax
lea rdx, [0x140386390]
lea rcx, [rbp + 0xc0]
call fcn.140073f70
mov rbx, rax
lea rdx, [0x1403863b0]
lea rcx, [rbp + 0xe0]
call fcn.140073f70
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x1a0]
call fcn.140060910
mov rdi, rax
mov dword [rsp + 0x38], 0xe4f0e2b5
mov word [rsp + 0x3c], 0xaa
mov byte [rsp + 0x3e], 1
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx - 0x6d]
xor byte [rsp + rcx + 0x38], al
inc rcx
cmp rcx, 5
jb 0x140061d70
mov byte [rsp + 0x3e], 0
mov dword [rsp + 0x30], 0xe2fcfafa
mov word [rsp + 0x34], 0x100
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx - 0x6d]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 4
jb 0x140061da0
mov byte [rsp + 0x35], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x50], xmm1
lea rax, [rsp + 0x30]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x140061dd3
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x40]
call fcn.140076fe0
nop
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x180]
call fcn.1400604e0
mov r10, rax
mov dword [rsp + 0x30], 0xf3e5ede7
mov word [rsp + 0x34], 0xaa
mov byte [rsp + 0x36], 1
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx - 0x6d]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 5
jb 0x140061e20
mov byte [rsp + 0x36], 0
lea rax, [rsp + 0x30]
mov r9, rbx
nop dword [rax]
inc r9
cmp byte [rax + r9], 0
jne 0x140061e40
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, r10
call fcn.140078350
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x60], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rax, [rsp + 0x38]
mov r8, rbx
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140061e90
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x70]
call fcn.140073e40
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x160], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x170], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, rdi
lea r8, [rbp + 0x160]
lea rcx, [rbp + 0x280]
call fcn.140078450
nop
lea rax, [rsp + 0x48]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140061ef0
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x280]
call fcn.140073e40
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x140], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x150], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, rsi
lea r8, [rbp + 0x140]
lea rcx, [rbp + 0xa0]
call fcn.140078450
nop
lea rax, [rsp + 0x40]
mov r8, rbx
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140061f50
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0xa0]
call fcn.140073e40
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x120], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x130], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, r14
lea r8, [rbp + 0x120]
lea rcx, [rbp + 0x80]
call fcn.140078450
nop
lea rax, [rsp + 0x58]
mov r8, rbx
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140061fb0
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x80]
call fcn.140073e40
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x100], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x110], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, r15
lea r8, [rbp + 0x100]
lea rcx, [rbp + 0x60]
call fcn.140078450
nop
lea rax, [rsp + 0x68]
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140062010
mov r8, rbx
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x60]
call fcn.140073e40
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x30], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x30], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rdx, [0x140386308]
cmp qword [0x140386320], 0xf
cmova rdx, qword [0x140386308]
mov r8, qword [0x140386318]
lea rcx, [rbp + 0x20]
call fcn.140073e40
movups xmm7, xmmword [rax]
movups xmmword [rbp + 0x2d0], xmm7
movups xmm6, xmmword [rax + 0x10]
movups xmmword [rbp + 0x2e0], xmm6
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x1400620dd
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400620d8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062aef
call fcn.1402619ec
movdqa xmm0, xmmword [0x14034d170]
movdqu xmmword [rbp + 0x30], xmm0
mov byte [rbp + 0x20], 0
mov rdx, qword [rbp + 0x78]
cmp rdx, 0xf
jbe 0x140062129
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062124
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062af5
call fcn.1402619ec
movdqa xmm0, xmmword [0x14034d170]
movdqu xmmword [rbp + 0x70], xmm0
mov byte [rbp + 0x60], 0
mov rdx, qword [rbp + 0x118]
cmp rdx, 0xf
jbe 0x14006217c
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062176
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062afb
call fcn.1402619ec
nop
mov rdx, qword [rbp + 0x98]
cmp rdx, 0xf
jbe 0x1400621bd
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400621b8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062b01
call fcn.1402619ec
movdqa xmm0, xmmword [0x14034d170]
movdqu xmmword [rbp + 0x90], xmm0
mov byte [rbp + 0x80], 0
mov rdx, qword [rbp + 0x138]
cmp rdx, 0xf
jbe 0x140062216
inc rdx
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062210
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062b07
call fcn.1402619ec
nop
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0xf
jbe 0x140062257
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062252
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062b0d
call fcn.1402619ec
movdqa xmm0, xmmword [0x14034d170]
movdqu xmmword [rbp + 0xb0], xmm0
mov byte [rbp + 0xa0], 0
mov rdx, qword [rbp + 0x158]
cmp rdx, 0xf
jbe 0x1400622b0
inc rdx
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400622aa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062b13
call fcn.1402619ec
nop
mov rdx, qword [rbp + 0x298]
cmp rdx, 0xf
jbe 0x1400622f1
inc rdx
mov rcx, qword [rbp + 0x280]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400622ec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062b19
call fcn.1402619ec
movdqa xmm0, xmmword [0x14034d170]
movdqu xmmword [rbp + 0x290], xmm0
mov byte [rbp + 0x280], 0
mov rdx, qword [rbp + 0x178]
cmp rdx, 0xf
jbe 0x14006234a
inc rdx
mov rcx, qword [rbp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062344
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062b1f
call fcn.1402619ec
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x140062385
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062380
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062b25
call fcn.1402619ec
movdqa xmm0, xmmword [0x14034d170]
movdqu xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x70], 0
mov rdx, qword [rbp + 0x198]
cmp rdx, 0xf
jbe 0x1400623d7
inc rdx
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400623d2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062b2b
call fcn.1402619ec
movdqa xmm0, xmmword [0x14034d170]
movdqu xmmword [rbp + 0x190], xmm0
mov byte [rbp + 0x180], 0
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x140062429
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062424
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062b31
call fcn.1402619ec
movdqa xmm0, xmmword [0x14034d170]
movdqu xmmword [rbp + 0x50], xmm0
mov byte [rbp + 0x40], 0
mov rdx, qword [rbp + 0x1b8]
cmp rdx, 0xf
jbe 0x14006247b
inc rdx
mov rcx, qword [rbp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062476
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062b37
call fcn.1402619ec
movdqa xmm0, xmmword [0x14034d170]
movdqu xmmword [rbp + 0x1b0], xmm0
mov byte [rbp + 0x1a0], 0
mov rdx, qword [rbp + 0x1d8]
cmp rdx, 0xf
jbe 0x1400624d3
inc rdx
mov rcx, qword [rbp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400624ce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062b3d
call fcn.1402619ec
movdqa xmm0, xmmword [0x14034d170]
movdqu xmmword [rbp + 0x1d0], xmm0
mov byte [rbp + 0x1c0], 0
mov rdx, qword [rbp + 0x1f8]
cmp rdx, 0xf
jbe 0x14006252b
inc rdx
mov rcx, qword [rbp + 0x1e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062526
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062b43
call fcn.1402619ec
movdqa xmm0, xmmword [0x14034d170]
movdqu xmmword [rbp + 0x1f0], xmm0
mov byte [rbp + 0x1e0], 0
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x14006257d
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062578
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062b49
call fcn.1402619ec
movdqa xmm0, xmmword [0x14034d170]
movdqu xmmword [rbp + 0x10], xmm0
mov byte [rbp], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x80], r12
lea r14, [rbp + 0x2d0]
movq rsi, xmm7
movdqa xmm0, xmm6
psrldq xmm0, 8
movq r15, xmm0
cmp r15, 0xf
cmova r14, rsi
movabs rbx, 0x7fffffffffffffff
movq rdi, xmm6
cmp rdi, rbx
ja 0x140062b4f
mov qword [rbp - 0x80], reloc.WS2_32.dll_ntohs
cmp rdi, 0xf
ja 0x1400625fa
mov qword [rsp + 0x78], rdi
movups xmm0, xmmword [r14]
movups xmmword [rsp + 0x68], xmm0
jmp 0x14006268d
mov rax, rdi
or rax, 0xf
cmp rax, rbx
jbe 0x140062636
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1402615c4
mov rcx, rax
test rax, rax
je 0x140062b55
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140062670
mov rbx, rax
mov ecx, reloc.WS2_32.dll_shutdown
cmp rax, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140062661
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140062add
jmp 0x140062614
test rcx, rcx
je 0x14006266d
call fcn.1402615c4
jmp 0x140062670
mov rax, r12
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x80], rbx
lea r8, [rdi + 1]
mov rdx, r14
mov rcx, rax
call fcn.1402a2820
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x2b0]
call fcn.140063fc0
nop
lea rax, [rbp + 0xe0]
mov qword [rbp - 0x78], rax
lea rdx, [0x140386308]
lea rcx, [rbp + 0xe0]
call fcn.140073f70
mov rdi, rax
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x40], rax
lea rdx, [0x140386390]
lea rcx, [rbp + 0xc0]
call fcn.140073f70
mov rbx, rax
lea rdx, [rbp + 0x2b0]
lea rcx, [rbp - 0x50]
call fcn.140073f70
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp]
call fcn.140060cc0
mov rbx, rax
lea rax, [rbp + 0x2b0]
cmp rax, rbx
je 0x140062790
mov rdx, qword [rbp + 0x2c8]
cmp rdx, 0xf
jbe 0x140062755
inc rdx
mov rcx, qword [rbp + 0x2b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062750
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062b5b
call fcn.1402619ec
movdqa xmm0, xmmword [0x14034d170]
movdqu xmmword [rbp + 0x2c0], xmm0
mov byte [rbp + 0x2b0], 0
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x2b0], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x2c0], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x1400627cb
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400627c6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062b5b
call fcn.1402619ec
mov qword [rbp + 0x238], r12
lea r8, [rbp + 0x200]
lea rdx, [rbp + 0x2b0]
lea rcx, [rbp + 0x2a0]
call fcn.140076600
nop
lea rdx, str.success
lea rcx, [rbp + 0x2a0]
call fcn.140076720
cmp byte [rax], 4
jne 0x140062b61
lea rcx, [rbp + 0x2a0]
cmp byte [rax + 8], 0
je 0x140062836
lea rdx, str.sessionid
call fcn.140076720
mov rdx, rax
lea rcx, [0x140386438]
call fcn.140076960
jmp 0x1400629fe
lea rdx, str.message
call fcn.140076720
mov rdi, rax
mov byte [rsp + 0x68], 3
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1402615c4
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], r12
mov r8d, 0xa
lea rdx, str.invalidver
mov rcx, rax
call fcn.140076fe0
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov rcx, rdi
call fcn.140077f80
movzx ebx, al
movzx edx, byte [rsp + 0x68]
lea rcx, [rsp + 0x70]
call fcn.140075060
nop
test bl, bl
je 0x140062949
lea rdx, str.download
lea rcx, [rbp + 0x2a0]
call fcn.140076720
lea rdx, [rbp + 0x280]
mov rcx, rax
call fcn.140076a30
lea r8, [rbp + 0x280]
cmp qword [rbp + 0x298], 0xf
cmova r8, qword [rbp + 0x280]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rdx, qword [rbp + 0x298]
cmp rdx, 0xf
jbe 0x1400629fe
inc rdx
mov rcx, qword [rbp + 0x280]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006293f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062bb2
call fcn.1402619ec
jmp 0x1400629fe
lea rdx, [0x1403450c4]
call fcn.140076320
lea rdx, str.message
lea rcx, [rbp + 0x2a0]
call fcn.140076720
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x60], xmm1
cmp byte [rax], 3
jne 0x140062bb8
mov r8, qword [rax + 8]
mov rdx, r8
cmp qword [r8 + 0x18], 0xf
jbe 0x140062991
mov rdx, qword [r8]
mov r8, qword [r8 + 0x10]
lea rcx, [rbp - 0x70]
call fcn.140076fe0
nop
lea rdx, [rbp - 0x70]
cmp qword [rbp - 0x58], 0xf
cmova rdx, qword [rbp - 0x70]
mov r8, qword [rbp - 0x60]
call fcn.14007b580
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x1400629f2
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400629ed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062c09
call fcn.1402619ec
mov ecx, 0x1194
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
movzx edx, byte [rbp + 0x2a0]
lea rcx, [rbp + 0x2a8]
call fcn.140075060
nop
mov rdx, qword [rbp + 0x2c8]
cmp rdx, 0xf
jbe 0x140062a53
inc rdx
mov rcx, qword [rbp + 0x2b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062a4e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062c0f
call fcn.1402619ec
movdqa xmm0, xmmword [0x14034d170]
movdqu xmmword [rbp + 0x2c0], xmm0
mov byte [rbp + 0x2b0], 0
cmp r15, 0xf
jbe 0x140062a9d
lea rdx, [r15 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140062a95
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062ad7
mov rcx, rsi
call fcn.1402619ec
mov rcx, qword [rbp + 0x2f0]
xor rcx, rsp
call fcn.1402614b0
lea r11, [rsp + 0x420]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.1402769e0
nop
call fcn.14005b4c0
nop
call fcn.1402769e0
nop
call fcn.1402769e0
nop
call fcn.1402769e0
nop
call fcn.1402769e0
nop
call fcn.1402769e0
nop
call fcn.1402769e0
nop
call fcn.1402769e0
nop
call fcn.1402769e0
nop
call fcn.1402769e0
nop
call fcn.1402769e0
nop
call fcn.1402769e0
nop
call fcn.1402769e0
nop
call fcn.1402769e0
nop
call fcn.1402769e0
nop
call fcn.1402769e0
nop
call fcn.1402769e0
nop
call fcn.1402769e0
nop
call fcn.1402769e0
int3
call fcn.14005b560
int3
call fcn.1402769e0
nop
call fcn.1402769e0
nop
mov rcx, rax
call fcn.140075560
mov rdx, rax
lea rcx, [rbp + 0xe0]
call fcn.140073f30
nop
mov r8, rax
lea rdx, str.type_must_be_boolean__but_is
lea rcx, [rbp + 0xc0]
call fcn.140075f00
nop
mov r8, rax
mov edx, 0x12e
lea rcx, [rbp - 0x50]
call fcn.14005f170
lea rdx, [0x140374e98]
lea rcx, [rbp - 0x50]
call fcn.140263bc0
nop
call fcn.1402769e0
int3
mov rcx, rax
call fcn.140075560
mov rdx, rax
lea rcx, [rbp + 0xe0]
call fcn.140073f30
nop
mov r8, rax
lea rdx, str.type_must_be_string__but_is
lea rcx, [rbp + 0xc0]
call fcn.140075f00
nop
mov r8, rax
mov edx, 0x12e
lea rcx, [rbp - 0x50]
call fcn.14005f170
lea rdx, [0x140374e98]
lea rcx, [rbp - 0x50]
call fcn.140263bc0
nop
call fcn.1402769e0
nop
call fcn.1402769e0
int3