Function at 0x1400d4070
Capabilities:
Create process on windows
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2e0]
sub rsp, 0x3e0
mov rax, qword [0x140418ca8]
xor rax, rsp
mov qword [rbp + 0x2d0], rax
mov r14, rcx
lea rcx, [rbp + 0x290]
call fcn.1400d5400
nop
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.1400db750
mov rdx, rax
lea rcx, [r14 + 0x108]
call fcn.1400c33c0
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x1400d410e
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d4109
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400d4f08
call fcn.14027a27c
mov qword [rbp - 0x68], 0
mov qword [rbp - 0x60], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x78], 0
mov rdx, qword [rbp + 0x2a8]
cmp rdx, 0x10
jb 0x1400d4163
inc rdx
mov rcx, qword [rbp + 0x290]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d415e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400d4f0e
call fcn.14027a27c
cmp qword [r14 + 0x30], 0xa
jne 0x1400d4e99
cmp qword [r14 + 0x50], 0x40
jne 0x1400d4e99
mov dword [rsp + 0x50], 0x969094da
mov dword [rsp + 0x54], 0x756b5e74
mov word [rsp + 0x58], reloc.WS2_32.dll_gethostname
mov byte [rsp + 0x5a], 1
xor ecx, ecx
nop word [rax + rax]
lea eax, [rcx - 4]
xor byte [rsp + rcx + 0x50], al
inc rcx
cmp rcx, 9
jb 0x1400d41a0
mov byte [rsp + 0x5a], 0
lea rdx, [r14 + 0x20]
lea rcx, [rbp + 0x140]
call fcn.1400d0eb0
mov r12, rax
mov dword [rsp + 0x70], 0x918992da
mov dword [rsp + 0x74], 0x676b7365
mov word [rsp + 0x78], reloc.WS2_32.dll_gethostname
mov byte [rsp + 0x7a], 1
xor ecx, ecx
nop word [rax + rax]
lea eax, [rcx - 4]
xor byte [rsp + rcx + 0x70], al
inc rcx
cmp rcx, 9
jb 0x1400d41f0
mov byte [rsp + 0x7a], 0
mov rdx, r14
lea rcx, [rbp + 0x120]
call fcn.1400d0eb0
mov r15, rax
mov dword [rsp + 0x48], 0x929f93da
mov dword [rsp + 0x4c], 0x1003c65
xor ecx, ecx
nop dword [rax]
lea eax, [rcx - 4]
xor byte [rsp + rcx + 0x48], al
inc rcx
cmp rcx, 6
jb 0x1400d4230
mov byte [rsp + 0x4f], 0
lea rax, [rbp + 0x200]
mov qword [rsp + 0x40], rax
lea rdx, [0x14041eca0]
lea rcx, [rbp + 0x200]
call fcn.14005dfe0
mov rdi, rax
lea rax, [rbp + 0x220]
mov qword [rsp + 0x38], rax
lea rdx, [r14 + 0x40]
lea rcx, [rbp + 0x220]
call fcn.14005dfe0
mov rbx, rax
lea rdx, [r14 + 0x108]
lea rcx, [rbp + 0x240]
call fcn.14005dfe0
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x100]
call fcn.1400d1190
mov rsi, rax
mov dword [rsp + 0x60], 0x9c9098da
mov dword [rsp + 0x64], 0x3e7b646b
mov word [rsp + 0x68], 0x100
xor ecx, ecx
nop dword [rax + rax]
lea eax, [rcx - 4]
xor byte [rsp + rcx + 0x60], al
inc rcx
cmp rcx, 8
jb 0x1400d42d0
mov byte [rsp + 0x69], 0
lea rax, [rbp + 0x1e0]
mov qword [rbp - 0x80], rax
lea rdx, [0x14041eca0]
lea rcx, [rbp + 0x1e0]
call fcn.14005dfe0
mov rdi, rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x40], rax
lea rdx, [r14 + 0x40]
lea rcx, [rbp + 0x10]
call fcn.14005dfe0
mov rbx, rax
lea rdx, [r14 + 0x60]
lea rcx, [rbp + 0x270]
call fcn.14005dfe0
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x180]
call fcn.1400d1190
mov rdi, rax
mov dword [rsp + 0x40], 0x8d9b8bda
mov word [rsp + 0x44], 0x3d
mov byte [rsp + 0x46], 1
xor edx, edx
mov ecx, edx
lea eax, [rcx - 4]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 5
jb 0x1400d4360
mov byte [rsp + 0x46], dl
mov dword [rsp + 0x38], 0x8b979395
mov word [rsp + 0x3c], 0x100
mov rcx, rdx
nop word [rax + rax]
lea eax, [rcx - 4]
xor byte [rsp + rcx + 0x38], al
inc rcx
cmp rcx, 4
jb 0x1400d4390
mov byte [rsp + 0x3d], dl
mov qword [rbp - 0x18], rdx
mov qword [rbp - 8], rdx
mov qword [rbp], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x18], dl
lea rax, [rsp + 0x38]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], dl
jne 0x1400d43c6
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x18]
call fcn.140060350
nop
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0x160]
call fcn.1400d0eb0
mov r10, rax
mov dword [rsp + 0x38], 0x9a8e8488
mov word [rsp + 0x3c], 0x3d
mov byte [rsp + 0x3e], 1
xor ecx, ecx
nop word [rax + rax]
lea eax, [rcx - 4]
xor byte [rsp + rcx + 0x38], al
inc rcx
cmp rcx, 5
jb 0x1400d4410
mov byte [rsp + 0x3e], 0
lea rax, [rsp + 0x38]
mov r9, rbx
nop dword [rax]
inc r9
cmp byte [rax + r9], 0
jne 0x1400d4430
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, r10
call fcn.1400d4f80
xor ecx, ecx
mov qword [rbp - 0x38], rcx
mov qword [rbp - 0x28], rcx
mov qword [rbp - 0x20], rcx
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x28], xmm1
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], cl
lea rax, [rsp + 0x40]
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400d4480
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x38]
call fcn.1400602c0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x70], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, rdi
lea r8, [rbp + 0x60]
movzx edx, byte [rsp + 0x30]
lea rcx, [rbp - 0x78]
call fcn.1400bfd90
nop
lea rax, [rsp + 0x60]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400d44e0
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x78]
call fcn.1400602c0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x90], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, rsi
lea r8, [rbp + 0x80]
movzx edx, byte [rsp + 0x30]
lea rcx, [rbp + 0xe0]
call fcn.1400bfd90
nop
lea rax, [rsp + 0x48]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x1400d4544
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0xe0]
call fcn.1400602c0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1c0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1d0], xmm1
xor esi, esi
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], sil
mov r9, r15
lea r8, [rbp + 0x1c0]
movzx edx, byte [rsp + 0x30]
lea rcx, [rbp + 0xc0]
call fcn.1400bfd90
nop
lea rax, [rsp + 0x70]
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400d45b0
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0xc0]
call fcn.1400602c0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1a0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1b0], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, r12
lea r8, [rbp + 0x1a0]
movzx edx, byte [rsp + 0x30]
lea rcx, [rbp + 0xa0]
call fcn.1400bfd90
nop
lea rax, [rsp + 0x50]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400d4610
mov r8, rbx
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0xa0]
call fcn.1400602c0
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x48], rsi
mov qword [rbp - 0x40], rsi
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x48], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rdx, [0x14041eca0]
cmp qword [0x14041ecb8], 0x10
cmovae rdx, qword [0x14041eca0]
mov r8, qword [0x14041ecb0]
lea rcx, [rbp - 0x58]
call fcn.1400602c0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x290], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x2a0], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x1400d46dd
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d46d8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400d4f14
call fcn.14027a27c
mov qword [rbp - 0x48], rsi
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x58], 0
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0x10
jb 0x1400d472e
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d4729
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400d4f1a
call fcn.14027a27c
mov qword [rbp + 0xb0], rsi
mov qword [rbp + 0xb8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xa0], 0
mov rdx, qword [rbp + 0x1b8]
cmp rdx, 0x10
jb 0x1400d4789
inc rdx
mov rcx, qword [rbp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d4783
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400d4f20
call fcn.14027a27c
nop
mov rdx, qword [rbp + 0xd8]
cmp rdx, 0x10
jb 0x1400d47ca
inc rdx
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d47c5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400d4f26
call fcn.14027a27c
mov qword [rbp + 0xd0], rsi
mov qword [rbp + 0xd8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xc0], 0
mov rdx, qword [rbp + 0x1d8]
cmp rdx, 0x10
jb 0x1400d4825
inc rdx
mov rcx, qword [rbp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d481f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400d4f2c
call fcn.14027a27c
nop
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0x10
jb 0x1400d4866
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d4861
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400d4f32
call fcn.14027a27c
mov qword [rbp + 0xf0], rsi
mov qword [rbp + reloc.WS2_32.dll_ntohs8], 0xf
mov byte [rbp + 0xe0], 0
mov rdx, qword [rbp + 0x98]
cmp rdx, 0x10
jb 0x1400d48c1
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d48bb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400d4f38
call fcn.14027a27c
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x1400d48fc
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d48f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400d4f3e
call fcn.14027a27c
mov qword [rbp - 0x68], rsi
mov qword [rbp - 0x60], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x78], 0
mov rdx, qword [rbp + 0x78]
cmp rdx, 0x10
jb 0x1400d4948
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d4942
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400d4f44
call fcn.14027a27c
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x1400d4983
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d497e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400d4f4a
call fcn.14027a27c
mov qword [rbp - 0x28], rsi
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x38], 0
mov rdx, qword [rbp + 0x178]
cmp rdx, 0x10
jb 0x1400d49d4
inc rdx
mov rcx, qword [rbp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d49cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400d4f50
call fcn.14027a27c
mov qword [rbp + 0x170], rsi
mov qword [rbp + 0x178], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x160], 0
mov rdx, qword [rbp]
cmp rdx, 0x10
jb 0x1400d4a28
inc rdx
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d4a23
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400d4f56
call fcn.14027a27c
mov qword [rbp - 8], rsi
mov qword [rbp], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x18], 0
mov rdx, qword [rbp + 0x198]
cmp rdx, 0x10
jb 0x1400d4a79
inc rdx
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d4a74
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400d4f5c
call fcn.14027a27c
mov qword [rbp + 0x190], rsi
mov qword [rbp + 0x198], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x180], 0
mov rdx, qword [rbp + 0x118]
cmp rdx, 0x10
jb 0x1400d4ad3
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d4ace
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400d4f62
call fcn.14027a27c
mov qword [rbp + 0x110], rsi
mov qword [rbp + 0x118], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x100], 0
mov rdx, qword [rbp + 0x138]
cmp rdx, 0x10
jb 0x1400d4b2d
inc rdx
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d4b28
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400d4f68
call fcn.14027a27c
mov qword [rbp + 0x130], rsi
mov qword [rbp + 0x138], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x120], 0
mov rdx, qword [rbp + 0x158]
cmp rdx, 0x10
jb 0x1400d4b87
inc rdx
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d4b82
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400d4f6e
call fcn.14027a27c
mov qword [rbp + 0x150], rsi
mov qword [rbp + 0x158], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x140], 0
lea rdx, [rbp + 0x290]
lea rcx, [rbp + 0x80]
call fcn.14005dfe0
mov rdx, rax
lea rcx, [rbp + 0x2b0]
call fcn.1400d93f0
nop
lea rax, [rbp + 0x270]
mov qword [rbp - 0x80], rax
lea rdx, [0x14041eca0]
lea rcx, [rbp + 0x270]
call fcn.14005dfe0
mov rdi, rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x48], rax
lea rdx, [r14 + 0x40]
lea rcx, [rbp + 0x10]
call fcn.14005dfe0
mov rbx, rax
lea rdx, [rbp + 0x2b0]
lea rcx, [rbp + 0x1e0]
call fcn.14005dfe0
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x60]
call fcn.1400ce780
mov rdx, rax
lea rcx, [rbp + 0x2b0]
call fcn.1400c33c0
mov rdx, qword [rbp + 0x78]
cmp rdx, 0x10
jb 0x1400d4c6d
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d4c68
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400d4f74
call fcn.14027a27c
mov qword [rbp + 0x48], rsi
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x10]
lea rdx, [rbp + 0x2b0]
lea rcx, [rbp + 0x260]
call fcn.1400bcba0
nop
lea rdx, str.success
lea rcx, [rbp + 0x260]
call fcn.1400b6ab0
mov rcx, rax
call fcn.1400b9d80
lea rcx, [rbp + 0x260]
test al, al
je 0x1400d4d40
lea rdx, str.sessionid
call fcn.1400b6ab0
lea rcx, [r14 + 0xe8]
mov rdx, rax
call fcn.1400b98e0
nop
lea rcx, [rbp + 0x260]
call fcn.1400cc6f0
movzx edx, byte [rbp + 0x260]
lea rcx, [rbp + 0x268]
call fcn.1400ceec0
nop
lea rcx, [rbp + 0x2b0]
call fcn.14005e750
nop
lea rcx, [rbp + 0x290]
call fcn.14005e750
mov rcx, qword [rbp + 0x2d0]
xor rcx, rsp
call fcn.14027a5e0
lea r11, [rsp + 0x3e0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea rdx, str.message
call fcn.1400b6ab0
mov rdi, rax
mov byte [rsp + 0x50], 3
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.14027a240
mov rbx, rax
mov qword [rax], rsi
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov r8d, 0xa
lea rdx, str.invalidver
mov rcx, rax
call fcn.140060350
mov qword [rsp + 0x58], rbx
lea rcx, [rsp + 0x50]
call fcn.1400cc6f0
lea rcx, [rsp + 0x50]
call fcn.1400cc6f0
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.1400c3800
movzx ebx, al
lea rcx, [rsp + 0x50]
call fcn.1400cc6f0
movzx edx, byte [rsp + 0x50]
lea rcx, [rsp + 0x58]
call fcn.1400ceec0
nop
test bl, bl
jne 0x1400d4e41
lea rdx, [0x1402d110c]
lea rcx, [0x140423950]
call fcn.14005d3f0
lea rcx, [rsp + 0x30]
call fcn.140061d40
mov rbx, rax
lea rdx, str.message
lea rcx, [rbp + 0x260]
call fcn.1400b6ab0
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x270]
call fcn.1400b69c0
nop
mov rdx, rax
lea rcx, [0x140423950]
call fcn.1400b69f0
nop
lea rcx, [rbp + 0x270]
call fcn.14005e750
mov ecx, 0x1194
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call fcn.14029b0c4
int3
lea rdx, str.download
lea rcx, [rbp + 0x260]
call fcn.1400b6ab0
lea rdx, [rbp + 0x270]
mov rcx, rax
call fcn.1400b6d80
lea rcx, [rbp + 0x270]
call fcn.1400cc850
mov r8, rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor ecx, ecx
call fcn.14029b0c4
nop
movdqa xmm0, xmmword [0x1402d43b0]
movdqa xmmword [rbp + 0x10], xmm0
movdqa xmm1, xmmword [0x1402d4410]
movdqa xmmword [rbp + 0x20], xmm1
movdqa xmm0, xmmword [0x1402d43a0]
movdqa xmmword [rbp + 0x30], xmm0
movdqa xmm1, xmmword [0x1402d43c0]
movdqa xmmword [rbp + 0x40], xmm1
mov dword [rbp + 0x50], 0x565f701c
mov dword [rbp + 0x54], 0x33216f2e
mov word [rbp + 0x58], gethostname
mov byte [rbp + 0x5a], 1
lea rdx, [rbp + 0x10]
lea rcx, [0x140423950]
call fcn.1400b6a10
mov ecx, 0x1194
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call fcn.14029b0c4
nop
call fcn.14028955c
nop
call fcn.14028955c
nop
call fcn.14028955c
nop
call fcn.14028955c
nop
call fcn.14028955c
nop
call fcn.14028955c
nop
call fcn.14028955c
nop
call fcn.14028955c
nop
call fcn.14028955c
nop
call fcn.14028955c
nop
call fcn.14028955c
nop
call fcn.14028955c
nop
call fcn.14028955c
nop
call fcn.14028955c
nop
call fcn.14028955c
nop
call fcn.14028955c
nop
call fcn.14028955c
nop
call fcn.14028955c
nop
call fcn.14028955c
int3