Function at 0x180062790
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create thread
Encode data using xor
Enumerate threads
Execute shellcode via indirect call
Spawn thread to rwx shellcode
Terminate process
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov rax, qword [0x180109070]
xor rax, rsp
mov qword [rbp + 0x60], rax
cmp edx, 1
jne 0x180063a02
lea rcx, [rbp - 8]
call fcn.180045c40
mov rbx, rax
lea r12, [0x180150998]
xor r14d, r14d
cmp r12, rax
je 0x180062860
mov rdx, qword [reloc.WS2_32.dll_ntohs]
cmp rdx, 0x10
jb 0x180062824
mov rcx, qword [0x180150998]
inc rdx
cmp rdx, 0x1000
jb 0x18006281f
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180062892
mov rcx, r8
call fcn.1800d0fac
movdqa xmm0, xmmword [0x1800f5180]
movdqu xmmword [0x1801509a8], xmm0
mov byte [0x180150998], r14b
movups xmm0, xmmword [rbx]
movups xmmword [0x180150998], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [0x1801509a8], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
nop
mov rdx, qword [rbp + 0x10]
cmp rdx, 0x10
jb 0x18006289e
inc rdx
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180062899
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180062899
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800d0fac
lea rcx, [rbp - 8]
call fcn.180045f00
mov rbx, rax
lea r15, [0x1801509d8]
cmp r15, rax
je 0x180062930
mov rdx, qword [reloc.WS2_32.dll_ntohs]
cmp rdx, 0x10
jb 0x1800628f3
mov rcx, qword [0x1801509d8]
inc rdx
cmp rdx, 0x1000
jb 0x1800628ee
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180062962
mov rcx, r8
call fcn.1800d0fac
movdqa xmm0, xmmword [0x1800f5180]
movdqu xmmword [0x1801509e8], xmm0
mov byte [0x1801509d8], 0
movups xmm0, xmmword [rbx]
movups xmmword [0x1801509d8], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [0x1801509e8], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
nop
mov rdx, qword [rbp + 0x10]
cmp rdx, 0x10
jb 0x18006296e
inc rdx
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180062969
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180062969
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800d0fac
lea rcx, [rbp - 8]
call fcn.1800469d0
mov rbx, rax
lea rsi, [0x1801509b8]
cmp rsi, rax
je 0x180062a00
mov rdx, qword [reloc.WS2_32.dll_ntohs]
cmp rdx, 0x10
jb 0x1800629c3
mov rcx, qword [0x1801509b8]
inc rdx
cmp rdx, 0x1000
jb 0x1800629be
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180062a32
mov rcx, r8
call fcn.1800d0fac
movdqa xmm0, xmmword [0x1800f5180]
movdqu xmmword [0x1801509c8], xmm0
mov byte [0x1801509b8], 0
movups xmm0, xmmword [rbx]
movups xmmword [0x1801509b8], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [0x1801509c8], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
nop
mov rdx, qword [rbp + 0x10]
cmp rdx, 0x10
jb 0x180062a3e
inc rdx
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180062a39
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180062a39
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800d0fac
movdqa xmm0, xmmword [str.say]
movdqu xmmword [rbp - 8], xmm0
mov byte [rbp + 8], 1
mov rcx, r14
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x34]
xor byte [rbp + rcx - 8], al
inc rcx
cmp rcx, 0xf
jb 0x180062a60
mov byte [rbp + 8], 0
lea rax, [rbp - 8]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x180062a82
lea rdx, [rbp - 8]
lea rcx, [0x180150a18]
call fcn.180047060
nop
mov byte [rbp + 0x20], 0
xor edx, edx
lea rcx, [rbp + 0x28]
call fcn.180068a50
lea rcx, [rbp + 0x20]
call fcn.180067d00
lea rcx, [rbp + 0x20]
call fcn.180067d00
nop
lea rax, [rbp - 0x30]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x40], 0x50585c47
mov dword [rsp + 0x44], 0x1005751
mov rcx, r14
nop dword [rax + rax]
lea eax, [rcx + 0x34]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 6
jb 0x180062ae0
mov byte [rsp + 0x47], 0
mov byte [rbp - 0x30], 0
xor eax, eax
mov qword [rbp - 0x28], rax
xor edx, edx
lea rcx, [rbp - 0x28]
call fcn.1800677c0
mov byte [rbp - 0x30], 3
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1800d142c
mov rdi, rax
lea rax, [rbp - 0x10]
mov qword [rbp - 8], rax
mov qword [rbp], rdi
mov qword [rdi], r14
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
lea rax, [rsp + 0x40]
inc rbx
cmp byte [rax + rbx], 0
jne 0x180062b42
mov r8, rbx
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.180047060
nop
mov qword [rbp - 0x28], rdi
lea rcx, [rbp - 0x30]
call fcn.180067d00
lea rcx, [rbp - 0x30]
call fcn.180067d00
nop
mov dword [rsp + 0x70], 0x5f425059
mov dword [rsp + 0x74], 0x1005d57
lea rcx, [rsp + 0x70]
call fcn.18004fd30
mov rdx, rax
lea rcx, [rbp + 0x20]
call fcn.18006a520
mov rcx, rax
lea rdx, [rbp - 0x30]
call fcn.180065540
lea rax, [rbp - 8]
mov qword [rsp + 0x50], rax
lea rdx, [0x180150a18]
lea rcx, [rbp - 8]
call fcn.18006a670
mov rbx, rax
mov dword [rbp - 0x10], 0x525b545a
mov word [rbp - 0xc], 0x100
lea rcx, [rbp - 0x10]
call fcn.180045ab0
mov rdx, rax
lea rcx, [rbp + 0x20]
call fcn.18006a520
mov rcx, rax
mov rdx, rbx
call fcn.180065540
lea rax, [rbp - 8]
mov qword [rsp + 0x50], rax
mov rdx, r12
lea rcx, [rbp - 8]
call fcn.18006a670
mov rbx, rax
mov dword [rbp - 0x10], 0x58505b5d
mov word [rbp - 0xc], 0x100
lea rcx, [rbp - 0x10]
call fcn.180045ab0
mov rdx, rax
lea rcx, [rbp + 0x20]
call fcn.18006a520
mov r8, rax
mov dword [rsp + 0x40], 0x535f4041
mov word [rsp + 0x44], 0x100
lea rcx, [rsp + 0x40]
call fcn.180045ab0
mov rdx, rax
mov rcx, r8
call fcn.18006a520
mov rcx, rax
mov rdx, rbx
call fcn.180065540
lea rax, [rbp - 8]
mov qword [rsp + 0x50], rax
mov rdx, r15
lea rcx, [rbp - 8]
call fcn.18006a670
mov rbx, rax
mov dword [rsp + 0x40], 0x58505b5d
mov word [rsp + 0x44], 0x100
lea rcx, [rsp + 0x40]
call fcn.180045ab0
mov rdx, rax
lea rcx, [rbp + 0x20]
call fcn.18006a520
mov r8, rax
mov dword [rbp - 0x10], 0x35159
mov byte [rbp - 0xc], 1
lea rcx, [rbp - 0x10]
call fcn.1800479a0
mov rdx, rax
mov rcx, r8
call fcn.18006a520
mov rcx, rax
mov rdx, rbx
call fcn.180065540
lea rax, [rbp - 8]
mov qword [rsp + 0x50], rax
mov rdx, rsi
lea rcx, [rbp - 8]
call fcn.18006a670
mov rbx, rax
mov dword [rsp + 0x40], 0x58505b5d
mov word [rsp + 0x44], 0x100
lea rcx, [rsp + 0x40]
call fcn.180045ab0
mov rdx, rax
lea rcx, [rbp + 0x20]
call fcn.18006a520
mov r8, rax
mov dword [rbp - 0x10], 0x52525442
mov word [rbp - 0xc], 0x100
lea rcx, [rbp - 0x10]
call fcn.180045ab0
mov rdx, rax
mov rcx, r8
call fcn.18006a520
mov rcx, rax
mov rdx, rbx
call fcn.180065540
lea rdx, [rbp + 0x20]
lea rcx, [rbp - 8]
call fcn.1800655b0
mov r8, rax
movdqa xmm0, xmmword [0x1800f57b0]
movdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], 0x692a22
mov byte [rbp - 0x1c], 1
lea rcx, [rbp - 0x30]
call fcn.180046fa0
mov rdx, rax
lea rcx, [rbp + 0x40]
call fcn.1800458b0
nop
lea rdx, [rbp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.180066110
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.180045570
mov rdx, rax
lea rcx, [rbp + 0x40]
call fcn.180066040
lea rcx, [rsp + 0x70]
call fcn.180044b10
mov qword [rbp - 0x38], r14
lea rcx, [rbp + 0x40]
call fcn.180065f80
mov qword [rsp + 0x70], rax
lea r8, [rbp - 0x70]
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x30]
call fcn.18006a730
nop
mov dword [rsp + 0x50], 0x63776167
mov dword [rsp + 0x54], 0x68656a6d
mov dword [rsp + 0x58], 0x7a7d7e69
mov dword [rsp + 0x5c], 0x1001213
lea rcx, [rsp + 0x50]
call fcn.180046fd0
mov rbx, rax
mov dword [rsp + 0x40], 0x52525a57
mov word [rsp + 0x44], 0x100
lea rcx, [rsp + 0x40]
call fcn.180045ab0
mov rdx, rax
lea rcx, [rbp + 0x30]
call fcn.18006a520
mov rdx, rbx
mov rcx, rax
call fcn.18006a860
test al, al
je 0x1800639e5
mov dword [rsp + 0x40], 0x58505b5d
mov word [rsp + 0x44], 0x100
lea rcx, [rsp + 0x40]
call fcn.180045ab0
mov rdx, rax
lea rcx, [rbp + 0x30]
call fcn.18006a520
mov r8, rax
movdqa xmm0, xmmword [0x1800f5720]
movdqu xmmword [rbp - 8], xmm0
mov dword [rbp + 8], 0x1003721
lea rcx, [rbp - 8]
call fcn.180046ee0
mov rdx, rax
mov rcx, r8
call fcn.18006a520
mov rdx, rax
lea rcx, [0x180150938]
call fcn.18006a930
mov dword [rsp + 0x40], 0x58505b5d
mov word [rsp + 0x44], 0x100
lea rcx, [rsp + 0x40]
call fcn.180045ab0
mov rdx, rax
lea rcx, [rbp + 0x30]
call fcn.18006a520
mov r8, rax
movdqa xmm0, xmmword [0x1800f5720]
movdqu xmmword [rbp - 8], xmm0
mov dword [rbp + 8], 0x33193721
mov dword [rbp + 0xc], 0x2f2421
mov byte [rbp + 0x10], 1
lea rcx, [rbp - 8]
call fcn.18004ff10
mov rdx, rax
mov rcx, r8
call fcn.18006a520
mov rdx, rax
lea rcx, [0x180150958]
call fcn.18006a930
mov dword [rsp + 0x40], 0x58505b5d
mov word [rsp + 0x44], 0x100
lea rcx, [rsp + 0x40]
call fcn.180045ab0
mov rdx, rax
lea rcx, [rbp + 0x30]
call fcn.18006a520
mov r8, rax
movdqa xmm0, xmmword [0x1800f5720]
movdqu xmmword [rbp - 8], xmm0
mov dword [rbp + 8], 0x34193721
mov dword [rbp + 0xc], 0x3e3e283c
mov word [rbp + 0x10], 0x3f
mov byte [rbp + 0x12], 1
lea rcx, [rbp - 8]
call fcn.18004fe50
mov rdx, rax
mov rcx, r8
call fcn.18006a520
mov rdx, rax
lea rcx, [0x180150a38]
call fcn.18006a930
mov dword [rbp - 0x10], 0x100484f
lea rcx, [rbp - 0x10]
call fcn.180046f10
mov rdx, rax
lea rcx, [0x180150938]
call fcn.180069a60
test al, al
jne 0x1800639e5
movzx eax, byte [0x1800e6a50]
xor al, 0x34
mov byte [rbp - 0x10], al
mov word [rbp - 0xf], 0x100
lea rcx, [rbp - 0x10]
call fcn.1800472d0
mov rdx, rax
lea rcx, [0x180150a38]
call fcn.180069a60
test al, al
jne 0x180062fe9
movzx eax, byte [0x1800e6a58]
xor al, 0x34
mov byte [rbp - 0x10], al
mov word [rbp - 0xf], 0x100
lea rcx, [rbp - 0x10]
call fcn.1800472d0
mov rdx, rax
lea rcx, [0x180150a38]
call fcn.180069a60
test al, al
je 0x1800639e5
xor edx, edx
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x180063021
lea rcx, [rbp + 0x30]
call fcn.180065510
nop
lea rcx, [rbp + 0x40]
call fcn.180044b10
nop
lea rcx, [rbp + 0x20]
call fcn.180065510
xor eax, eax
jmp 0x180063a07
mov dword [rbp - 0x30], Ordinal_30
lea rdx, [rbp - 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x1800630ff
mov dword [rsp + 0x50], 0x195d465b
mov dword [rsp + 0x54], 0x5f415d
mov byte [rsp + 0x58], 1
lea rcx, [rsp + 0x50]
call fcn.18004ff40
mov rcx, rax
call fcn.180045100
mov rdi, rax
mov eax, dword [rbp - 0x24]
cmp rax, rdi
jne 0x1800630ea
mov r8d, dword [rbp - 0x28]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbx, rax
mov rcx, rax
call fcn.180062680
mov r8d, eax
mov edx, edi
lea rcx, [rbp - 8]
call fcn.180062590
mov dword [rsp + 0x50], 0x44545440
mov dword [rsp + 0x54], 0x5f145b53
mov dword [rsp + 0x58], 0x1005150
lea rcx, [rsp + 0x50]
call fcn.18004ffa0
mov rdx, rax
lea rcx, [rbp - 8]
call fcn.180065ea0
cmp rax, 0xffffffffffffffff
je 0x1800630d8
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp - 8]
call fcn.180044b10
lea rdx, [rbp - 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x180063067
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
lea rcx, str..METABL
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x180151c80], rax
call fcn.180051a40
test al, al
jne 0x180063192
mov word [rbp - 0x10], 0x100
lea rcx, [rbp - 0x10]
call fcn.180055ba0
mov r8, rax
movdqa xmm0, xmmword [0x1800f5e50]
movdqu xmmword [rbp - 8], xmm0
mov dword [rbp + 8], 0x23272a08
mov dword [rbp + 0xc], 0x1003b2d
lea rcx, [rbp - 8]
call fcn.18004fdf0
xor r9d, r9d
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x180151fe8], eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x180151f28], eax
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8, [0x180062050]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
movdqa xmm0, xmmword [0x1800f56a0]
movdqu xmmword [rbp - 8], xmm0
mov dword [rbp + 8], 0x686b6a
mov byte [rbp + 0xc], 1
lea rcx, [rbp - 8]
call fcn.180046fa0
mov rdx, rax
lea rcx, [0x180150978]
call fcn.180047040
xor bl, bl
nop dword [rax]
nop word [rax + rax]
mov dword [rsp + 0x70], 0x43425476
mov dword [rsp + 0x74], 0x55145c54
mov dword [rsp + 0x78], 0x5a104959
mov dword [rsp + 0x7c], 0x1002438
lea rcx, [rsp + 0x70]
call fcn.180046fd0
mov rcx, rax
call fcn.180045100
test rax, rax
je 0x180063278
movdqa xmm0, xmmword [0x1800f5700]
movdqu xmmword [rbp - 8], xmm0
mov dword [rbp + 8], 0x100203c
lea rcx, [rbp - 8]
call fcn.180046ee0
mov rcx, rax
call fcn.180045100
test rax, rax
je 0x180063278
mov bl, 1
jmp 0x180063386
mov dword [rsp + 0x40], 0x43425476
mov dword [rsp + 0x44], 0x55145c54
mov dword [rsp + 0x48], 0x5a104959
mov dword [rsp + 0x4c], 0x1002438
lea rcx, [rsp + 0x40]
call fcn.180046fd0
mov rcx, rax
call fcn.180045100
test rax, rax
je 0x1800632bb
mov byte [reloc.WS2_32.dll_accept], 1
jmp 0x180063386
movdqa xmm0, xmmword [0x1800f5700]
movdqu xmmword [rbp - 8], xmm0
mov dword [rbp + 8], 0x100203c
lea rcx, [rbp - 8]
call fcn.180046ee0
mov rcx, rax
call fcn.180045100
test rax, rax
je 0x180063386
mov byte [reloc.WS2_32.dll_accept], 0
mov dword [0x1801090b8], 0x14596ef8
mov dword [0x18013d374], 0x145966e8
mov dword [0x18011b244], 0xd957ef0
mov dword [0x18010e924], 0x14e1a110
mov dword [0x1801090b4], 0x15f878
mov dword [0x1801434ec], 0x11152a20
mov dword [0x1801282f4], 0x144805e0
mov dword [0x1801282f8], 0xc897048
mov dword [0x18011d764], 0x13df8
mov dword [0x180134538], 0x131
mov dword [0x1801090b0], 0x680
mov dword [0x18011d768], 0xab
mov dword [0x180131c28], 0x13141
mov dword [0x18011b248], 0x4f4
mov dword [0x18010e928], 0x157650
mov dword [rsp + 0x50], 0x19525a57
mov dword [rsp + 0x54], 0x5f415d
mov byte [rsp + 0x58], 1
lea rcx, [rsp + 0x50]
call fcn.18004ff40
mov rcx, rax
call fcn.180045100
test rax, rax
jne 0x1800633c2
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x180063210
mov ecx, 0xfa0
call qword [sym.imp.KERNEL32.dll_Sleep]
test bl, bl
je 0x1800633fd
movdqa xmm0, xmmword [0x1800f5690]
movdqu xmmword [rbp - 8], xmm0
movdqa xmm1, xmmword [0x1800f58f0]
movdqu xmmword [rbp + 8], xmm1
mov dword [rbp + 0x18], 0x1007c39
lea rcx, [rbp - 8]
call fcn.180063a40
jmp 0x180063419
movdqa xmm0, xmmword [0x1800f5710]
movdqu xmmword [rbp - 8], xmm0
mov word [rbp + 8], 0x100
lea rcx, [rbp - 8]
call fcn.18004fd90
mov rdx, rax
lea rcx, [0x180150978]
call fcn.180047040
lea rsi, [0x18006a4f0]
lea rdi, [0x180000000]
nop word [rax + rax]
mov dword [rbp - 0x10], 0x77
lea rcx, [rbp - 8]
call fcn.180061fd0
lea rcx, [rbp - 8]
test bl, bl
je 0x1800637ca
lea r15, [rbp + 0x88]
mov rdx, r15
call fcn.180041990
nop
mov ecx, r14d
mov rax, qword [0x1801706f0]
test rax, rax
je 0x1800634a9
mov rdx, r14
nop
cmp rax, rsi
je 0x180063498
inc ecx
mov edx, ecx
mov rax, qword [rdi + rcx*8 + 0x1706f0]
test rax, rax
jne 0x180063480
jmp 0x1800634a9
mov r8, qword [rdi + rdx*8 + 0x16fd80]
test r8, r8
jne 0x18006358f
mov edx, 0x1f4
xor ecx, ecx
lea r9d, [rcx + 0x40]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, rax
test rax, rax
jne 0x1800634d0
mov r8, r14
jmp 0x18006356e
mov rax, rsi
mov rcx, r8
mov edx, 3
nop dword [rax + rax]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x1800634e0
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
mov eax, dword [rax + 0x70]
mov dword [rcx + 0x70], eax
mov rax, qword [0x180170a10]
mov qword [rdi + rax*8 + 0x1706f0], rsi
mov qword [rdi + rax*8 + 0x16fd80], r8
inc rax
mov qword [0x180170a10], rax
lea rdx, [rbp - 0x10]
mov rcx, qword [sym.imp.USER32.dll_GetAsyncKeyState]
call r8
movzx r8d, ax
mov rcx, qword [rbp]
xor rcx, qword [rbp - 8]
mov rax, qword [rbp + 8]
mov qword [rax], rcx
test r8w, r8w
jne 0x180063934
mov dword [rbp - 0x10], 0x78
lea rcx, [rbp - 8]
call fcn.180061fd0
mov rdx, r15
lea rcx, [rbp - 8]
call fcn.180041990
nop
mov ecx, r14d
mov rax, qword [0x1801706f0]
test rax, rax
je 0x180063619
mov rdx, r14
nop dword [rax]
cmp rax, rsi
je 0x180063608
inc ecx
mov edx, ecx
mov rax, qword [rdi + rcx*8 + 0x1706f0]
test rax, rax
jne 0x1800635f0
jmp 0x180063619
mov r8, qword [rdi + rdx*8 + 0x16fd80]
test r8, r8
jne 0x1800636ff
mov edx, 0x1f4
xor ecx, ecx
lea r9d, [rcx + 0x40]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, rax
test rax, rax
jne 0x180063640
mov r8, r14
jmp 0x1800636de
mov rax, rsi
mov rcx, r8
mov edx, 3
nop dword [rax + rax]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x180063650
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
mov eax, dword [rax + 0x70]
mov dword [rcx + 0x70], eax
mov rax, qword [0x180170a10]
mov qword [rdi + rax*8 + 0x1706f0], rsi
mov qword [rdi + rax*8 + 0x16fd80], r8
inc rax
mov qword [0x180170a10], rax
lea rdx, [rbp - 0x10]
mov rcx, qword [sym.imp.USER32.dll_GetAsyncKeyState]
call r8
movzx edx, ax
mov rcx, qword [rbp - 8]
xor rcx, qword [rbp]
mov rax, qword [rbp + 8]
mov qword [rax], rcx
test dx, dx
je 0x180063924
mov byte [reloc.WS2_32.dll_accept], 0
mov dword [0x1801090b8], 0x14596ef8
mov dword [0x18013d374], 0x145966e8
mov dword [0x18011b244], 0xd957ef0
mov dword [0x18010e924], 0x14e1a110
mov dword [0x1801090b4], 0x15f878
mov dword [0x1801434ec], 0x11152a20
mov dword [0x1801282f4], 0x144805e0
mov dword [0x1801282f8], 0xc897048
mov dword [0x18011d764], 0x13df8
mov dword [0x180134538], 0x131
mov dword [0x1801090b0], 0x680
mov dword [0x18011d768], 0xab
mov dword [0x180131c28], 0x13141
mov dword [0x18011b248], 0x4f4
mov dword [0x18010e928], 0x157650
jmp 0x18006393b
lea rdx, [rbp + 0x88]
call fcn.180041990
nop
mov ecx, r14d
mov rax, qword [0x1801706f0]
test rax, rax
je 0x180063819
mov rdx, r14
nop dword [rax]
cmp rax, rsi
je 0x180063808
inc ecx
mov edx, ecx
mov rax, qword [rdi + rcx*8 + 0x1706f0]
test rax, rax
jne 0x1800637f0
jmp 0x180063819
mov r8, qword [rdi + rdx*8 + 0x16fd80]
test r8, r8
jne 0x1800638ff
mov edx, 0x1f4
xor ecx, ecx
lea r9d, [rcx + 0x40]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, rax
test rax, rax
jne 0x180063840
mov r8, r14
jmp 0x1800638de
mov rcx, rsi
mov edx, 3
nop dword [rax + rax]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rax - 0x10], xmm1
lea rcx, [rcx + 0x80]
sub rdx, 1
jne 0x180063850
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
mov ecx, dword [rcx + 0x70]
mov dword [rax + 0x70], ecx
mov rax, qword [0x180170a10]
mov qword [rdi + rax*8 + 0x1706f0], rsi
mov qword [rdi + rax*8 + 0x16fd80], r8
inc rax
mov qword [0x180170a10], rax
lea rdx, [rbp - 0x10]
mov rcx, qword [sym.imp.USER32.dll_GetAsyncKeyState]
call r8
movzx edx, ax
mov rcx, qword [rbp - 8]
xor rcx, qword [rbp]
mov rax, qword [rbp + 8]
mov qword [rax], rcx
test dx, dx
jne 0x18006393b
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x180063440
mov byte [reloc.WS2_32.dll_accept], 1
lea rdx, [0x1800e4e72]
lea rcx, [0x180150978]
call fcn.180047040
mov dword [rsp + 0x50], 0x19525a57
mov dword [rsp + 0x54], 0x5f415d
mov byte [rsp + 0x58], 1
lea rcx, [rsp + 0x50]
call fcn.18004ff40
mov rcx, rax
call fcn.180045100
mov qword [0x180151c68], rax
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.180051ae0
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8, [0x180058330]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8, [0x180058b70]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov byte [0x180151a7b], 1
lea rcx, [rbp + 0x30]
call fcn.180065510
nop
lea rcx, [rbp + 0x40]
call fcn.180044b10
nop
lea rcx, [rbp + 0x20]
call fcn.180065510
mov eax, 1
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.1800d0cf0
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret