Function at 0x140122410
Capabilities:
Delete file
Query environment variable

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x520
mov rax, qword [0x140b29680]
xor rax, rsp
mov qword [rsp + 0x510], rax
mov qword [rsp + 0x70], r9
mov rax, r8
mov qword [rsp + 0x370], rax
mov dword [rsp + 0x68], edx
mov qword [rsp + 0x368], rcx
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x580]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x588]
mov qword [rsp + 0x348], rax
mov qword [rsp + 0x88], rax
xor esi, esi
mov dword [rsp + 0x6c], esi
mov byte [rsp + 0x31], sil
mov ecx, edx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
xorps xmm0, xmm0
movups xmmword [rsp + 0x3d8], xmm0
lea ecx, [rsi + 0x40]
call fcn.140148f4c
mov r15, rax
mov qword [rsp + 0x3d8], rax
mov qword [rsp + 0x3e8], 0x3e
mov qword [rsp + 0x3f0], 0x3f
movups xmm0, xmmword [str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1401f0730]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x1401f0740]
movups xmmword [rax + 0x20], xmm0
movsd xmm0, qword [0x1401f0750]
movsd qword [rax + 0x30], xmm0
mov eax, dword [0x1401f0758]
mov dword [r15 + 0x38], eax
movzx eax, word [0x1401f075c]
mov word [r15 + 0x3c], ax
mov byte [r15 + 0x3e], sil
xorps xmm0, xmm0
movups xmmword [rsp + 0x2d0], xmm0
mov edi, esi
mov qword [rsp + 0x2e0], rsi
mov r14d, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x2e8], r14
mov byte [rsp + 0x2d0], dil
mov dword [rsp + 0x6c], 2
lea r13d, [rsi + 0xa]
movzx ebx, byte [rsp + 0x30]
movabs r12, 0x842108421084211
nop dword [rax]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
movsxd rcx, eax
mov rax, r12
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
imul rax, rax, 0x3e
sub rcx, rax
movsxd rax, ecx
movzx r9d, byte [rax + r15]
cmp rdi, r14
jae 0x1401225bf
lea rax, [rdi + 1]
mov qword [rsp + 0x2e0], rax
lea rax, [rsp + 0x2d0]
cmp r14, 0xf
cmova rax, qword [rsp + 0x2d0]
mov byte [rax + rdi], r9b
mov byte [rax + rdi + 1], 0
jmp 0x1401225d5
movzx r8d, bl
mov edx, 1
lea rcx, [rsp + 0x2d0]
call fcn.140024040
sub r13, 1
je 0x1401225f0
mov r14, qword [rsp + 0x2e8]
mov rdi, qword [rsp + 0x2e0]
jmp 0x140122560
mov edx, 0x40
mov rcx, r15
call fcn.140148f88
mov byte [rsp + 0x2c0], Ordinal_79
mov al, Ordinal_26
mov cl, 8
xor dl, dl
mov r8b, Ordinal_30
xor r9d, r9d
xor al, 0x4d
mov byte [rsp + 0x2c1], al
xor cl, 0x4d
mov byte [rsp + 0x2c2], cl
xor dl, 0x4d
mov byte [rsp + 0x2c3], dl
xor r8b, 0x4d
mov byte [rsp + 0x2c4], r8b
mov byte [rsp + 0x2c5], r9b
lea rcx, [rsp + 0x2c1]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xorps xmm0, xmm0
movups xmmword [rsp + 0x318], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x328], xmm1
mov rbx, 0xffffffffffffffff
mov r8, rbx
mov r12, qword [rsp + 0x368]
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140122680
mov rdx, rax
lea rcx, [rsp + 0x318]
call fcn.140024450
nop
mov rcx, qword [rsp + 0x328]
mov rdx, qword [rsp + 0x330]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x1401226e8
lea rax, [rcx + 1]
mov qword [rsp + 0x328], rax
lea rax, [rsp + 0x318]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x318]
mov word [rax + rcx], 0x5c
lea rax, [rsp + 0x318]
jmp 0x140122710
mov qword [rsp + 0x20], 1
lea r9, [0x1401f0760]
movzx r8d, byte [rsp + 0x30]
mov edx, 1
lea rcx, [rsp + 0x318]
call fcn.1400241c0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x398], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x3a8], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov eax, 2
or eax, 4
mov dword [rsp + 0x6c], eax
lea r9, [rsp + 0x2d0]
lea r8, [rsp + 0x398]
movzx edx, byte [rsp + 0x30]
lea rcx, [rsp + 0x428]
call fcn.140109550
nop
mov rdx, qword [rsp + 0x3b0]
cmp rdx, 0xf
jbe 0x1401227ac
inc rdx
mov rcx, qword [rsp + 0x398]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401227a6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401227a6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140148f88
nop
mov rdx, qword [rsp + 0x330]
cmp rdx, 0xf
jbe 0x1401227f2
inc rdx
mov rcx, qword [rsp + 0x318]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401227ed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401227ed
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140148f88
movdqa xmm0, xmmword [0x140225020]
movdqu xmmword [rsp + 0x328], xmm0
mov byte [rsp + 0x318], 0
mov rdx, qword [rsp + 0x2e8]
cmp rdx, 0xf
jbe 0x140122851
inc rdx
mov rcx, qword [rsp + 0x2d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14012284c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14012284c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140148f88
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov r15, rsi
mov qword [rsp + 0x60], rsi
lea rdx, [rsp + 0x428]
lea rcx, [rsp + 0x318]
call fcn.14001ac80
mov r8, rax
lea rdx, [rsp + 0x408]
mov rcx, qword [rsp + 0x70]
call fcn.140120480
nop
cmp qword [rsp + 0x418], 0
jbe 0x140122952
lea rdx, [rsp + 0x408]
lea rcx, [rsp + 0x398]
call fcn.14001ac80
mov r8, rax
lea rdx, [rsp + 0x2d0]
lea rcx, [0x140b32ad2]
call fcn.14010b8d0
lea rcx, [rsp + 0x50]
cmp rcx, rax
je 0x1401228f9
mov r14, qword [rax]
mov qword [rsp + 0x50], r14
mov r13, qword [rax + 8]
mov qword [rsp + 0x58], r13
mov r15, qword [rax + 0x10]
mov qword [rsp + 0x60], r15
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
jmp 0x140122903
mov r13, qword [rsp + 0x58]
mov r14, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x2d0]
test rcx, rcx
je 0x140122948
mov rdx, qword [rsp + 0x2e0]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140122943
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140122943
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140148f88
mov byte [rsp + 0x31], 1
jmp 0x1401229ef
mov r9b, 1
mov r8d, dword [rsp + 0x68]
lea rdx, [rsp + 0x2d0]
mov rcx, qword [rsp + 0x348]
call fcn.140013250
lea rcx, [rsp + 0x50]
cmp rcx, rax
je 0x1401229a0
mov r14, qword [rax]
mov qword [rsp + 0x50], r14
mov r13, qword [rax + 8]
mov qword [rsp + 0x58], r13
mov r15, qword [rax + 0x10]
mov qword [rsp + 0x60], r15
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
jmp 0x1401229aa
mov r13, qword [rsp + 0x58]
mov r14, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x2d0]
test rcx, rcx
je 0x1401229ef
mov rdx, qword [rsp + 0x2e0]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401229ea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401229ea
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140148f88
xorps xmm0, xmm0
movups xmmword [rsp + 0x378], xmm0
cmp r14, r13
jne 0x140122a20
mov qword [rsp + 0x388], rsi
mov qword [rsp + 0x390], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x378], 0
jmp 0x140122b68
mov rax, r13
sub rax, r14
mov r12, r14
mov rdx, rsi
mov qword [rsp + 0x388], rdx
mov edi, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x390], rdi
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
ja 0x140123d47
cmp rax, rdi
jbe 0x140122b00
mov rdi, rax
or rdi, 0xf
cmp rdi, rcx
jbe 0x140122aa0
mov rdi, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140148f4c
mov rcx, rax
test rax, rax
je 0x140122ac8
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
mov rdx, qword [rsp + 0x388]
jmp 0x140122ae6
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmp rdi, rax
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140122acf
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140123d4d
jmp 0x140122a7a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140122ae3
call fcn.140148f4c
mov rdx, qword [rsp + 0x388]
jmp 0x140122ae6
mov rax, rsi
mov qword [rsp + 0x378], rax
mov qword [rsp + 0x390], rdi
nop word [rax + rax]
lea rcx, [rsp + 0x378]
cmp rdi, 0xf
cmova rcx, qword [rsp + 0x378]
movzx eax, byte [r12]
mov byte [rdx + rcx], al
mov rdx, qword [rsp + 0x388]
inc rdx
mov qword [rsp + 0x388], rdx
inc r12
cmp r12, r13
je 0x140122b42
mov rdi, qword [rsp + 0x390]
jmp 0x140122b00
lea rax, [rsp + 0x378]
cmp qword [rsp + 0x390], 0xf
cmova rax, qword [rsp + 0x378]
mov byte [rdx + rax], 0
mov r12, qword [rsp + 0x368]
mov qword [rsp + 0x198], rsi
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rsp + 0x160]
lea rdx, [rsp + 0x378]
lea rcx, [rsp + 0x338]
call fcn.140022760
nop
mov byte [rsp + 0x2c0], 0x76
mov al, 5
mov cl, 3
mov dl, reloc.WS2_32.dll_setsockopt
movzx r8d, dl
mov r9b, reloc.WS2_32.dll_send
movzx r10d, al
movzx r11d, al
xor edi, edi
xor al, 0x76
mov byte [rsp + 0x2c1], al
xor cl, 0x76
mov byte [rsp + 0x2c2], cl
xor dl, 0x76
mov byte [rsp + 0x2c3], dl
xor r8b, 0x76
mov byte [rsp + 0x2c4], r8b
xor r9b, 0x76
mov byte [rsp + 0x2c5], r9b
xor r10b, 0x76
mov byte [rsp + 0x2c6], r10b
xor r11b, 0x76
mov byte [rsp + 0x2c7], r11b
mov byte [rsp + 0x2c8], dil
lea rax, [rsp + 0x2c1]
mov qword [rsp + 0x348], rax
lea rdx, [rsp + 0x348]
lea rcx, [rsp + 0x338]
call fcn.140105e90
mov rcx, rax
call fcn.140022900
test al, al
je 0x14012394c
mov byte [rsp + 0x2c0], 0x62
mov al, 1
mov cl, reloc.WS2_32.dll_listen
mov dl, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov r8b, reloc.WLDAP32.dll_Ordinal_22
mov r9b, 7
movzx r10d, dl
movzx r11d, r8b
xor al, 0x62
mov byte [rsp + 0x2c1], al
xor cl, 0x62
mov byte [rsp + 0x2c2], cl
xor dl, 0x62
mov byte [rsp + 0x2c3], dl
xor r8b, 0x62
mov byte [rsp + 0x2c4], r8b
xor r9b, 0x62
mov byte [rsp + 0x2c5], r9b
xor r10b, 0x62
mov byte [rsp + 0x2c6], r10b
xor r11b, 0x62
mov byte [rsp + 0x2c7], r11b
mov byte [rsp + 0x2c8], dil
lea rax, [rsp + 0x2c1]
mov qword [rsp + 0x348], rax
lea rdx, [rsp + 0x348]
lea rcx, [rsp + 0x338]
call fcn.140105e90
lea rdx, [rsp + 0x318]
mov rcx, rax
call fcn.140022970
nop
lea rdx, [rsp + 0x318]
lea rcx, [rsp + 0x398]
call fcn.140121e10
mov r8, rax
lea rdx, [rsp + 0x2d0]
lea rcx, [0x140b32ad2]
call fcn.14010b8d0
mov rdi, rax
lea rax, [rsp + 0x50]
cmp rax, rdi
je 0x140122d78
test r14, r14
je 0x140122d53
sub r15, r14
mov rax, r14
cmp r15, 0x1000
jb 0x140122d48
add r15, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140122db1
mov rdx, r15
mov rcx, r14
call fcn.140148f88
mov r14, qword [rdi]
mov qword [rsp + 0x50], r14
mov rax, qword [rdi + 8]
mov qword [rsp + 0x58], rax
mov r15, qword [rdi + 0x10]
mov qword [rsp + 0x60], r15
mov qword [rdi], rsi
mov qword [rdi + 8], rsi
mov qword [rdi + 0x10], rsi
mov rcx, qword [rsp + 0x2d0]
test rcx, rcx
je 0x140122dd1
mov rdx, qword [rsp + 0x2e0]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140122db8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140122db8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140148f88
mov qword [rsp + 0x2d0], rsi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x2d8], xmm0
mov rdx, qword [rsp + 0x330]
cmp rdx, 0xf
jbe 0x140122e17
inc rdx
mov rcx, qword [rsp + 0x318]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140122e12
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140122e12
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140148f88
mov byte [rsp + 0x2c0], 0x43
mov al, 0x35
mov cl, 0x26
mov dl, Ordinal_50
mov r8b, Ordinal_50
mov r9b, 0x2a
mov r10b, Ordinal_45
mov r11b, reloc.WLDAP32.dll_Ordinal_45
xor edi, edi
xor al, 0x43
mov byte [rsp + 0x2c1], al
xor cl, 0x43
mov byte [rsp + 0x2c2], cl
xor dl, 0x43
mov byte [rsp + 0x2c3], dl
xor r8b, 0x43
mov byte [rsp + 0x2c4], r8b
xor r9b, 0x43
mov byte [rsp + 0x2c5], r9b
xor r10b, 0x43
mov byte [rsp + 0x2c6], r10b
xor r11b, 0x43
mov byte [rsp + 0x2c7], r11b
mov byte [rsp + 0x2c8], dil
xorps xmm0, xmm0
movups xmmword [rsp + 0x318], xmm0
mov qword [rsp + 0x328], rsi
mov qword [rsp + 0x330], rsi
lea rax, [rsp + 0x2c1]
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], dil
jne 0x140122eb0
mov r8, rbx
lea rdx, [rsp + 0x2c1]
lea rcx, [rsp + 0x318]
call fcn.140024450
lea rdx, [rsp + 0x318]
mov r13, qword [rsp + 0x370]
mov rcx, r13
call fcn.1400272a0
mov rdi, rax
mov qword [rsp + 0x2c0], rax
mov byte [rsp + 0x358], Ordinal_79
mov al, Ordinal_60
mov cl, Ordinal_41
mov dl, 0x3f
mov r8b, 0x3e
mov r9b, 0x24
mov r10b, Ordinal_35
mov r11b, reloc.WLDAP32.dll_Ordinal_35
xor ebx, ebx
xor al, 0x4d
mov byte [rsp + 0x359], al
xor cl, 0x4d
mov byte [rsp + 0x35a], cl
xor dl, 0x4d
mov byte [rsp + 0x35b], dl
xor r8b, 0x4d
mov byte [rsp + 0x35c], r8b
xor r9b, 0x4d
mov byte [rsp + 0x35d], r9b
xor r10b, 0x4d
mov byte [rsp + 0x35e], r10b
xor r11b, 0x4d
mov byte [rsp + 0x35f], r11b
mov byte [rsp + 0x360], bl
lea rax, [rsp + 0x359]
mov qword [rsp + 0x348], rax
lea rdx, [rsp + 0x348]
lea rcx, [rsp + 0x338]
call fcn.140105e90
mov rbx, rax
movzx eax, byte [rdi]
mov byte [rsp + 0x30], al
cmp al, 7
jne 0x140122fb9
movsd xmm0, qword [rdi + 8]
call sub.api_ms_win_crt_math_l1_1_0.dll__dclass
cmp ax, 2
jne 0x140122fb9
movzx eax, byte [rbx]
sub al, 5
cmp al, 2
jbe 0x1401232db
movzx edi, byte [rbx]
jmp 0x140122ff2
movzx edi, byte [rbx]
cmp dil, 7
jne 0x140122fe4
movsd xmm0, qword [rbx + 8]
call sub.api_ms_win_crt_math_l1_1_0.dll__dclass
movzx ecx, byte [rsp + 0x30]
cmp ax, 2
jne 0x140122fe9
lea eax, [rcx - 5]
cmp al, 2
jbe 0x1401232db
jmp 0x140122fe9
movzx ecx, byte [rsp + 0x30]
cmp cl, 9
je 0x1401232db
cmp dil, 9
je 0x1401232db
mov rdx, rbx
mov rcx, qword [rsp + 0x2c0]
call fcn.14010b370
test al, al
jne 0x1401232db
cmp byte [rsp + 0x31], al
je 0x14012303a
lea rcx, [rsp + 0x428]
cmp qword [rsp + 0x440], 0xf
cmova rcx, qword [rsp + 0x428]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov byte [r12], 0
movdqa xmm1, xmmword [0x1401f1f30]
movdqu xmmword [rsp + 0x2d0], xmm1
mov dl, reloc.WS2_32.dll_gethostname
mov r8b, reloc.WLDAP32.dll_Ordinal_46
mov r9b, 0x2f
mov r10b, 0x35
mov r11b, 0x33
mov bl, reloc.WLDAP32.dll_Ordinal_50
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x2d1], al
xor byte [rsp + 0x2d2], cl
xor byte [rsp + 0x2d3], cl
xor byte [rsp + 0x2d4], cl
xor byte [rsp + 0x2d5], cl
xor byte [rsp + 0x2d6], cl
xor byte [rsp + 0x2d7], cl
xor byte [rsp + 0x2d8], cl
xor byte [rsp + 0x2d9], cl
xor byte [rsp + 0x2da], cl
xor byte [rsp + 0x2db], cl
xor byte [rsp + 0x2dc], cl
xor byte [rsp + 0x2dd], cl
xor byte [rsp + 0x2de], cl
xor byte [rsp + 0x2df], cl
xor dl, cl
mov byte [rsp + 0x2e0], dl
xor r8b, cl
mov byte [rsp + 0x2e1], r8b
xor r9b, cl
mov byte [rsp + 0x2e2], r9b
xor r10b, cl
mov byte [rsp + 0x2e3], r10b
xor r11b, cl
mov byte [rsp + 0x2e4], r11b
xor bl, cl
mov byte [rsp + 0x2e5], bl
mov byte [rsp + 0x2e6], 0
lea rdx, [rsp + 0x2d1]
lea rcx, [r12 + 8]
call fcn.14001ac40
nop
xor edx, edx
lea rcx, [rsp + 0x338]
call fcn.14001d060
movzx edx, byte [rsp + 0x338]
lea rcx, [rsp + 0x340]
call fcn.14001c200
nop
mov rdx, qword [rsp + 0x390]
cmp rdx, 0xf
jbe 0x14012319d
inc rdx
mov rcx, qword [rsp + 0x378]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140123198
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140123ade
call fcn.140148f88
mov qword [rsp + 0x388], rsi
mov qword [rsp + 0x390], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x378], 0
mov rdx, qword [rsp + 0x420]
cmp rdx, 0xf
jbe 0x1401231fc
inc rdx
mov rcx, qword [rsp + 0x408]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401231f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140123869
call fcn.140148f88
mov qword [rsp + 0x418], rsi
mov qword [rsp + 0x420], 0xf
mov byte [rsp + 0x408], 0
test r14, r14
je 0x14012325e
sub r15, r14
mov rax, r14
cmp r15, 0x1000
jb 0x140123245
add r15, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140123b6e
mov rdx, r15
mov rcx, r14
call fcn.140148f88
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rsi
mov rdx, qword [rsp + 0x440]
cmp rdx, 0xf
jbe 0x1401232a1
inc rdx
mov rcx, qword [rsp + 0x428]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14012329c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140123bc8
call fcn.140148f88
movdqa xmm0, xmmword [0x140225020]
movdqu xmmword [rsp + 0x438], xmm0
mov byte [rsp + 0x428], 0
xor edx, edx
mov rcx, r13
call fcn.14001d060
lea rcx, [r13 + 8]
movzx edx, byte [r13]
call fcn.14001c200
nop
mov rax, r12
jmp 0x140123d24
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
call fcn.14010af20
cmp byte [rsp + 0x31], 0
jne 0x140123629
lea rax, [rsp + 0x318]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x378]
lea rcx, [rsp + 0x318]
call fcn.14001ac80
mov rbx, rax
lea rdx, [rsp + 0x428]
lea rcx, [rsp + 0x2d0]
call fcn.14001ac80
nop
mov r8, rbx
mov rdx, rax
mov rcx, qword [rsp + 0x70]
call fcn.140120b90
mov byte [r12], 1
lea rcx, [r12 + 8]
movdqa xmm1, xmmword [0x1401f1d30]
movdqu xmmword [rsp + 0x2f0], xmm1
movdqa xmm2, xmmword [str._b_r_f_rI]
movdqu xmmword [rsp + 0x300], xmm2
mov r8b, 8
mov r9b, reloc.WS2_32.dll_listen
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd edx, xmm1
xor al, dl
mov byte [rsp + 0x2f1], al
xor byte [rsp + 0x2f2], dl
xor byte [rsp + 0x2f3], dl
xor byte [rsp + 0x2f4], dl
xor byte [rsp + 0x2f5], dl
xor byte [rsp + 0x2f6], dl
xor byte [rsp + 0x2f7], dl
xor byte [rsp + 0x2f8], dl
xor byte [rsp + 0x2f9], dl
xor byte [rsp + 0x2fa], dl
xor byte [rsp + 0x2fb], dl
xor byte [rsp + 0x2fc], dl
xor byte [rsp + 0x2fd], dl
xor byte [rsp + 0x2fe], dl
xor byte [rsp + 0x2ff], dl
movd eax, xmm2
xor al, dl
mov byte [rsp + 0x300], al
xor byte [rsp + 0x301], dl
xor byte [rsp + 0x302], dl
xor byte [rsp + 0x303], dl
xor byte [rsp + 0x304], dl
xor byte [rsp + 0x305], dl
xor byte [rsp + 0x306], dl
xor byte [rsp + 0x307], dl
xor byte [rsp + 0x308], dl
xor byte [rsp + 0x309], dl
xor byte [rsp + 0x30a], dl
xor byte [rsp + 0x30b], dl
xor byte [rsp + 0x30c], dl
xor byte [rsp + 0x30d], dl
xor byte [rsp + 0x30e], dl
xor byte [rsp + 0x30f], dl
xor r8b, dl
mov byte [rsp + 0x310], r8b
xor r9b, dl
mov byte [rsp + 0x311], r9b
mov byte [rsp + 0x312], 0
lea rdx, [rsp + 0x2f1]
call fcn.14001ac40
nop
xor edx, edx
lea rcx, [rsp + 0x338]
call fcn.14001d060
movzx edx, byte [rsp + 0x338]
lea rcx, [rsp + 0x340]
call fcn.14001c200
nop
mov rdx, qword [rsp + 0x390]
cmp rdx, 0xf
jbe 0x1401234f8
inc rdx
mov rcx, qword [rsp + 0x378]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401234f3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140123ade
call fcn.140148f88
mov qword [rsp + 0x388], rsi
mov qword [rsp + 0x390], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x378], 0
mov rdx, qword [rsp + 0x420]
cmp rdx, 0xf
jbe 0x140123557
inc rdx
mov rcx, qword [rsp + 0x408]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140123552
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140123869
call fcn.140148f88
mov qword [rsp + 0x418], rsi
mov qword [rsp + 0x420], 0xf
mov byte [rsp + 0x408], 0
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1401235bd
mov rdx, qword [rsp + 0x60]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401235aa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140123b6e
call fcn.140148f88
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rsi
mov rdx, qword [rsp + 0x440]
cmp rdx, 0xf
jbe 0x140123600
inc rdx
mov rcx, qword [rsp + 0x428]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401235fb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140123bc8
call fcn.140148f88
movdqa xmm0, xmmword [0x140225020]
movdqu xmmword [rsp + 0x438], xmm0
mov byte [rsp + 0x428], 0
mov rcx, r13
call fcn.140019210
mov rax, r12
jmp 0x140123d24
mov byte [r12], 1
movdqa xmm1, xmmword [0x1401f2630]
movdqu xmmword [rsp + 0x318], xmm1
mov cl, 0x76
mov dl, reloc.WS2_32.dll_WSAStartup
mov r8b, WSACleanup
movzx r9d, dl
mov r10b, gethostname
mov bl, 0x71
mov dil, 0x65
mov sil, 0x78
mov r14b, 0x7a
movzx r15d, r10b
movzx r12d, bl
mov r13b, 0x7e
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd r11d, xmm1
xor al, r11b
mov byte [rsp + 0x319], al
xor byte [rsp + 0x31a], r11b
xor byte [rsp + 0x31b], r11b
xor byte [rsp + 0x31c], r11b
xor byte [rsp + 0x31d], r11b
xor byte [rsp + 0x31e], r11b
xor byte [rsp + 0x31f], r11b
xor byte [rsp + 0x320], r11b
xor byte [rsp + 0x321], r11b
xor byte [rsp + 0x322], r11b
xor byte [rsp + 0x323], r11b
xor byte [rsp + 0x324], r11b
xor byte [rsp + 0x325], r11b
xor byte [rsp + 0x326], r11b
xor byte [rsp + 0x327], r11b
xor cl, r11b
mov byte [rsp + 0x328], cl
xor dl, r11b
mov byte [rsp + 0x329], dl
xor r8b, r11b
mov byte [rsp + 0x32a], r8b
xor r9b, r11b
mov byte [rsp + 0x32b], r9b
xor r10b, r11b
mov byte [rsp + 0x32c], r10b
xor bl, r11b
mov byte [rsp + 0x32d], bl
xor dil, r11b
mov byte [rsp + 0x32e], dil
xor sil, r11b
mov byte [rsp + 0x32f], sil
xor r14b, r11b
mov byte [rsp + 0x330], r14b
xor r15b, r11b
mov byte [rsp + 0x331], r15b
xor r12b, r11b
mov byte [rsp + 0x332], r12b
xor r13b, r11b
mov byte [rsp + 0x333], r13b
mov al, 0x7b
xor al, r11b
mov byte [rsp + 0x334], al
mov al, WSAStartup
xor al, r11b
mov byte [rsp + 0x335], al
mov byte [rsp + 0x336], 0
lea rdx, [rsp + 0x319]
mov rdi, qword [rsp + 0x368]
lea rcx, [rdi + 8]
call fcn.14001ac40
nop
xor edx, edx
lea rcx, [rsp + 0x338]
call fcn.14001d060
movzx edx, byte [rsp + 0x338]
lea rcx, [rsp + 0x340]
call fcn.14001c200
nop
mov rdx, qword [rsp + 0x390]
cmp rdx, 0xf
jbe 0x140123812
inc rdx
mov rcx, qword [rsp + 0x378]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14012380d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140123ade
call fcn.140148f88
xor ebx, ebx
mov qword [rsp + 0x388], rbx
mov qword [rsp + 0x390], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x378], bl
mov rdx, qword [rsp + 0x420]
cmp rdx, 0xf
jbe 0x140123875
inc rdx
mov rcx, qword [rsp + 0x408]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140123870
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140123870
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140148f88
mov qword [rsp + 0x418], rbx
mov qword [rsp + 0x420], 0xf
mov byte [rsp + 0x408], 0
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1401238db
mov rdx, qword [rsp + 0x60]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401238c8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140123b6e
call fcn.140148f88
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rbx
mov rdx, qword [rsp + 0x440]
cmp rdx, 0xf
jbe 0x14012391e
inc rdx
mov rcx, qword [rsp + 0x428]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140123919
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140123bc8
call fcn.140148f88
movdqa xmm0, xmmword [0x140225020]
movdqu xmmword [rsp + 0x438], xmm0
mov byte [rsp + 0x428], 0
mov rcx, qword [rsp + 0x370]
call fcn.140019210
mov rax, rdi
jmp 0x140123d24
cmp byte [rsp + 0x31], dil
je 0x140123973
lea rcx, [rsp + 0x428]
cmp qword [rsp + 0x440], 0xf
cmova rcx, qword [rsp + 0x428]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov byte [r12], dil
movdqa xmm1, xmmword [0x1401f2250]
movdqu xmmword [rsp + 0x2d0], xmm1
xor dl, dl
mov r8b, reloc.WS2_32.dll_ntohs
mov r9b, 0xa
mov r10b, 3
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x2d1], al
xor byte [rsp + 0x2d2], cl
xor byte [rsp + 0x2d3], cl
xor byte [rsp + 0x2d4], cl
xor byte [rsp + 0x2d5], cl
xor byte [rsp + 0x2d6], cl
xor byte [rsp + 0x2d7], cl
xor byte [rsp + 0x2d8], cl
xor byte [rsp + 0x2d9], cl
xor byte [rsp + 0x2da], cl
xor byte [rsp + 0x2db], cl
xor byte [rsp + 0x2dc], cl
xor byte [rsp + 0x2dd], cl
xor byte [rsp + 0x2de], cl
xor byte [rsp + 0x2df], cl
xor dl, cl
mov byte [rsp + 0x2e0], dl
xor r8b, cl
mov byte [rsp + 0x2e1], r8b
xor r9b, cl
mov byte [rsp + 0x2e2], r9b
xor r10b, cl
mov byte [rsp + 0x2e3], r10b
mov byte [rsp + 0x2e4], dil
xorps xmm0, xmm0
movups xmmword [r12 + 8], xmm0
mov qword [r12 + 0x18], rsi
mov qword [r12 + 0x20], rsi
lea rax, [rsp + 0x2d1]
nop dword [rax]
inc rbx
cmp byte [rax + rbx], dil
jne 0x140123a60
mov r8, rbx
lea rdx, [rsp + 0x2d1]
lea rcx, [r12 + 8]
call fcn.140024450
nop
xor edx, edx
lea rcx, [rsp + 0x338]
call fcn.14001d060
movzx edx, byte [rsp + 0x338]
lea rcx, [rsp + 0x340]
call fcn.14001c200
nop
mov rdx, qword [rsp + 0x390]
cmp rdx, 0xf
jbe 0x140123aea
inc rdx
mov rcx, qword [rsp + 0x378]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140123ae5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140123ae5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140148f88
mov qword [rsp + 0x388], rsi
mov qword [rsp + 0x390], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x378], 0
mov r8, qword [rsp + 0x420]
cmp r8, 0xf
jbe 0x140123b29
mov rdx, qword [rsp + 0x408]
lea rcx, [rsp + 0x408]
call fcn.14001ef20
mov qword [rsp + 0x418], rsi
mov qword [rsp + 0x420], 0xf
mov byte [rsp + 0x408], 0
test r14, r14
je 0x140123b8e
sub r15, r14
mov rax, r14
cmp r15, 0x1000
jb 0x140123b75
add r15, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140123b75
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, r15
mov rcx, r14
call fcn.140148f88
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rsi
mov rdx, qword [rsp + 0x440]
cmp rdx, 0xf
jbe 0x140123bd4
inc rdx
mov rcx, qword [rsp + 0x428]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140123bcf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140123bcf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140148f88
movdqa xmm0, xmmword [0x140225020]
movdqu xmmword [rsp + 0x438], xmm0
mov byte [rsp + 0x428], 0
xor edx, edx
mov rbx, qword [rsp + 0x370]
mov rcx, rbx
call fcn.14001d060
lea rcx, [rbx + 8]
movzx edx, byte [rbx]
call fcn.14001c200
nop
mov rax, r12
jmp 0x140123d24
mov rcx, qword [rsp + 0x510]
xor rcx, rsp
call fcn.140148c30
add rsp, 0x520
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
call fcn.1400039d0
nop
call fcn.140003830
int3