Function at 0x1400b4050
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2f0]
sub rsp, 0x3f0
mov rax, qword [0x1403835b0]
xor rax, rsp
mov qword [rbp + 0x2e0], rax
lea rcx, [rbp]
call fcn.1400b2ff0
nop
mov rdx, rax
lea rcx, [rbp + 0x2a0]
call fcn.1400b2910
mov rdx, rax
lea rcx, [0x14038e7c8]
call fcn.1400bcfc0
mov rdx, qword [rbp + 0x2b8]
cmp rdx, 0x10
jb 0x1400b40f1
inc rdx
mov rcx, qword [rbp + 0x2a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b40ec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400b5058
call fcn.140267028
xor r12d, r12d
mov qword [rbp + 0x2b0], r12
mov qword [rbp + 0x2b8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x2a0], r12b
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x10
jb 0x1400b4148
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b4143
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400b505e
call fcn.140267028
cmp qword [0x14038e6f0], 0xa
jne 0x1400b4ff0
cmp qword [0x14038e710], 0x40
jne 0x1400b4ff0
mov dword [rsp + 0x68], 0x3a3c3876
mov dword [rsp + 0x6c], 0x213f0a20
mov word [rsp + 0x70], 0x65
mov byte [rsp + 0x72], 1
mov rcx, r12
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x50]
xor byte [rsp + rcx + 0x68], al
inc rcx
cmp rcx, 9
jb 0x1400b4190
mov byte [rsp + 0x72], 0
lea rdx, [0x14038e6e0]
lea rcx, [rbp + 0x170]
call fcn.1400b2d40
mov r15, rax
mov dword [rsp + 0x58], 0x3d253e76
mov dword [rsp + 0x5c], 0x333f2731
mov word [rsp + 0x60], 0x65
mov byte [rsp + 0x62], 1
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx + 0x50]
xor byte [rsp + rcx + 0x58], al
inc rcx
cmp rcx, 9
jb 0x1400b41e0
mov byte [rsp + 0x62], 0
lea rdx, [0x14038e6c0]
lea rcx, [rbp + 0x150]
call fcn.1400b2d40
mov r14, rax
mov dword [rsp + 0x40], 0x3e333f76
mov dword [rsp + 0x44], 0x1006831
mov rcx, r12
nop
lea eax, [rcx + 0x50]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 6
jb 0x1400b4220
mov byte [rsp + 0x47], 0
lea rax, [rbp + 0x230]
mov qword [rsp + 0x38], rax
lea rdx, [0x14038e680]
lea rcx, [rbp + 0x230]
call fcn.1400bd060
mov rdi, rax
lea rax, [rbp + 0x250]
mov qword [rsp + 0x30], rax
lea rdx, [0x14038e700]
lea rcx, [rbp + 0x250]
call fcn.1400bd060
mov rbx, rax
lea rdx, [0x14038e7c8]
lea rcx, [rbp + 0x1f0]
call fcn.1400bd060
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x130]
call fcn.1400b3140
mov rsi, rax
mov dword [rsp + 0x48], 0x303c3476
mov dword [rsp + 0x4c], 0x6a2f303f
mov word [rsp + 0x50], 0x100
mov rcx, r12
nop
lea eax, [rcx + 0x50]
xor byte [rsp + rcx + 0x48], al
inc rcx
cmp rcx, 8
jb 0x1400b42c0
mov byte [rsp + 0x51], 0
lea rax, [rbp + 0x20]
mov qword [rsp + 0x78], rax
lea rdx, [0x14038e680]
lea rcx, [rbp + 0x20]
call fcn.1400bd060
mov rdi, rax
lea rax, [rbp + 0x190]
mov qword [rsp + 0x38], rax
lea rdx, [0x14038e700]
lea rcx, [rbp + 0x190]
call fcn.1400bd060
mov rbx, rax
lea rdx, [0x14038e720]
lea rcx, [rbp + 0x2c0]
call fcn.1400bd060
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x110]
call fcn.1400b3140
mov rbx, rax
mov dword [rsp + 0x38], 0x21372776
mov word [rsp + 0x3c], WSAGetLastError
mov byte [rsp + 0x3e], 1
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx + 0x50]
xor byte [rsp + rcx + 0x38], al
inc rcx
cmp rcx, 5
jb 0x1400b4360
mov byte [rsp + 0x3e], 0
mov dword [rsp + 0x30], 0x273b3f39
mov word [rsp + 0x34], 0x100
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx + 0x50]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 4
jb 0x1400b4390
mov byte [rsp + 0x35], 0
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x80], 0
lea rax, [rsp + 0x30]
mov rdi, 0xffffffffffffffff
mov r8, rdi
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400b43d0
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x80]
call fcn.1400a9e70
nop
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0xf0]
call fcn.1400b2d40
mov r10, rax
mov dword [rsp + 0x30], 0x36222824
mov word [rsp + 0x34], WSAGetLastError
mov byte [rsp + 0x36], 1
mov rcx, r12
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x50]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 5
jb 0x1400b4420
mov byte [rsp + 0x36], 0
lea rax, [rsp + 0x30]
mov r9, rdi
nop dword [rax]
inc r9
cmp byte [rax + r9], 0
jne 0x1400b4440
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, r10
call fcn.1400c2230
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x10], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rax, [rsp + 0x38]
mov r8, rdi
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400b4490
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x20]
call fcn.1400bce80
movups xmm0, xmmword [rax]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x10], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, rbx
lea r8, [rbp]
lea rcx, [rbp + 0xd0]
call fcn.1400c2330
nop
lea rax, [rsp + 0x48]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x1400b44e2
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0xd0]
call fcn.1400bce80
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1d0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1e0], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, rsi
lea r8, [rbp + 0x1d0]
lea rcx, [rbp + 0xb0]
call fcn.1400c2330
nop
lea rax, [rsp + 0x40]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x1400b4540
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0xb0]
call fcn.1400bce80
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1b0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1c0], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, r14
lea r8, [rbp + 0x1b0]
lea rcx, [rbp + 0x90]
call fcn.1400c2330
nop
lea rax, [rsp + 0x58]
mov r8, rdi
nop
inc r8
cmp byte [rax + r8], 0
jne 0x1400b45a0
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x90]
call fcn.1400bce80
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x50], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, r15
lea r8, [rbp - 0x60]
lea rcx, [rbp + 0x70]
call fcn.1400c2330
nop
lea rax, [rsp + 0x68]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x1400b45f2
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x70]
call fcn.1400bce80
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x30], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rdx, [0x14038e680]
cmp qword [0x14038e698], 0x10
cmovae rdx, qword [0x14038e680]
mov r8, qword [0x14038e690]
lea rcx, [rbp - 0x40]
call fcn.1400bce80
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x2a0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x2b0], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x1400b46ba
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b46b5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400b5064
call fcn.140267028
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x40], 0
mov rdx, qword [rbp + 0x88]
cmp rdx, 0x10
jb 0x1400b4708
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b4703
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400b506a
call fcn.140267028
mov qword [rbp + 0x80], r12
mov qword [rbp + 0x88], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x70], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x1400b475a
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b4754
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400b5070
call fcn.140267028
nop
mov rdx, qword [rbp + 0xa8]
cmp rdx, 0x10
jb 0x1400b479b
inc rdx
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b4796
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400b5076
call fcn.140267028
mov qword [rbp + 0xa0], r12
mov qword [rbp + 0xa8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x90], 0
mov rdx, qword [rbp + 0x1c8]
cmp rdx, 0x10
jb 0x1400b47f6
inc rdx
mov rcx, qword [rbp + 0x1b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b47f0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400b507c
call fcn.140267028
nop
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0x10
jb 0x1400b4837
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b4832
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400b5082
call fcn.140267028
mov qword [rbp + 0xc0], r12
mov qword [rbp + 0xc8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xb0], 0
mov rdx, qword [rbp + 0x1e8]
cmp rdx, 0x10
jb 0x1400b4892
inc rdx
mov rcx, qword [rbp + 0x1d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b488c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400b5088
call fcn.140267028
nop
mov rdx, qword [rbp + 0xe8]
cmp rdx, 0x10
jb 0x1400b48d3
inc rdx
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b48ce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400b508e
call fcn.140267028
mov qword [rbp + 0xe0], r12
mov qword [rbp + 0xe8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xd0], 0
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x10
jb 0x1400b4928
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b4922
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400b5094
call fcn.140267028
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x1400b4963
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b495e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400b509a
call fcn.140267028
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x20], 0
mov rdx, qword [rbp + 0x108]
cmp rdx, 0x10
jb 0x1400b49b4
inc rdx
mov rcx, qword [rbp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b49af
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400b50a0
call fcn.140267028
mov qword [rbp + 0x100], r12
mov qword [rbp + 0x108], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xf0], 0
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x1400b4a08
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b4a03
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400b50a6
call fcn.140267028
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x80], 0
mov rdx, qword [rbp + 0x128]
cmp rdx, 0x10
jb 0x1400b4a59
inc rdx
mov rcx, qword [rbp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b4a54
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400b50ac
call fcn.140267028
mov qword [rbp + 0x120], r12
mov qword [rbp + 0x128], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x110], 0
mov rdx, qword [rbp + 0x148]
cmp rdx, 0x10
jb 0x1400b4ab3
inc rdx
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b4aae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400b50b2
call fcn.140267028
mov qword [rbp + 0x140], r12
mov qword [rbp + 0x148], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x130], 0
mov rdx, qword [rbp + 0x168]
cmp rdx, 0x10
jb 0x1400b4b0d
inc rdx
mov rcx, qword [rbp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b4b08
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400b50b8
call fcn.140267028
mov qword [rbp + 0x160], r12
mov qword [rbp + 0x168], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x150], 0
mov rdx, qword [rbp + 0x188]
cmp rdx, 0x10
jb 0x1400b4b67
inc rdx
mov rcx, qword [rbp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b4b62
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400b50be
call fcn.140267028
mov qword [rbp + 0x180], r12
mov qword [rbp + 0x188], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x170], 0
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], r12
lea rdi, [rbp + 0x2a0]
cmp qword [rbp + 0x2b8], 0x10
cmovae rdi, qword [rbp + 0x2a0]
movabs r13, 0x7fffffffffffffff
mov rsi, qword [rbp + 0x2b0]
cmp rsi, 0x10
jae 0x1400b4bc8
movups xmm0, xmmword [rdi]
movups xmmword [rbp - 0x60], xmm0
mov ebx, reloc.WS2_32.dll_ntohs
jmp 0x1400b4c42
mov rbx, rsi
or rbx, 0xf
cmp rbx, r13
cmova rbx, r13
mov rcx, rbx
add rcx, 1
mov rax, 0xffffffffffffffff
cmovb rcx, rax
cmp rcx, 0x1000
jb 0x1400b4c20
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400b50c4
mov rcx, rax
call fcn.14026734c
mov rcx, rax
test rax, rax
je 0x1400b50ca
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400b4c2f
test rcx, rcx
je 0x1400b4c2c
call fcn.14026734c
jmp 0x1400b4c2f
mov rax, r12
mov qword [rbp - 0x60], rax
lea r8, [rsi + 1]
mov rdx, rdi
mov rcx, rax
call fcn.140269380
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], rbx
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x280]
call fcn.1400b7520
nop
lea rax, [rbp + 0x2c0]
mov qword [rsp + 0x78], rax
lea rdx, [0x14038e680]
lea rcx, [rbp + 0x2c0]
call fcn.1400bd060
mov r14, rax
lea rax, [rbp + 0x190]
mov qword [rsp + 0x40], rax
lea rdx, [0x14038e700]
lea rcx, [rbp + 0x190]
call fcn.1400bd060
mov r15, rax
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], r12
mov rdi, qword [rbp + 0x290]
lea rsi, [rbp + 0x280]
cmp qword [rbp + 0x298], 0x10
cmovae rsi, qword [rbp + 0x280]
cmp rdi, 0x10
jae 0x1400b4cdd
movups xmm0, xmmword [rsi]
movups xmmword [rbp - 0x80], xmm0
mov ebx, reloc.WS2_32.dll_ntohs
jmp 0x1400b4d57
mov rbx, rdi
or rbx, 0xf
cmp rbx, r13
cmova rbx, r13
mov rcx, rbx
add rcx, 1
mov rax, 0xffffffffffffffff
cmovb rcx, rax
cmp rcx, 0x1000
jb 0x1400b4d35
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400b50d0
mov rcx, rax
call fcn.14026734c
mov rcx, rax
test rax, rax
je 0x1400b50d6
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400b4d44
test rcx, rcx
je 0x1400b4d41
call fcn.14026734c
jmp 0x1400b4d44
mov rax, r12
mov qword [rbp - 0x80], rax
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call fcn.140269380
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], rbx
mov r9, r14
mov r8, r15
lea rdx, [rbp - 0x80]
lea rcx, [rbp]
call fcn.1400b3440
mov rbx, rax
lea rax, [rbp + 0x280]
cmp rax, rbx
je 0x1400b4e00
mov rdx, qword [rbp + 0x298]
cmp rdx, 0x10
jb 0x1400b4dc2
inc rdx
mov rcx, qword [rbp + 0x280]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b4dbd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400b50d6
call fcn.140267028
movdqa xmm0, xmmword [0x140353420]
movdqu xmmword [rbp + 0x290], xmm0
mov byte [rbp + 0x280], 0
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x280], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x290], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
nop dword [rax]
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x10
jb 0x1400b4e3b
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b4e36
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400b50d6
call fcn.140267028
mov qword [rbp + 0x228], r12
lea r8, [rbp + 0x1f0]
lea rdx, [rbp + 0x280]
lea rcx, [rbp + 0x270]
call fcn.1400bfa40
nop
lea rdx, str.success
lea rcx, [rbp + 0x270]
call fcn.1400bfb80
cmp byte [rax], 4
jne 0x1400b50dc
lea rcx, [rbp + 0x270]
cmp byte [rax + 8], 0
je 0x1400b4f1b
lea rdx, str.sessionid
call fcn.1400bfb80
cmp byte [rax], 3
jne 0x1400b512d
mov rdx, qword [rax + 8]
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x1400b4eb1
mov rdx, qword [rdx]
lea rcx, [0x14038e7a8]
call fcn.1400a9e70
nop
movzx edx, byte [rbp + 0x270]
lea rcx, [rbp + 0x278]
call fcn.1400bdc60
nop
lea rcx, [rbp + 0x280]
call fcn.1400bcf60
nop
lea rcx, [rbp + 0x2a0]
call fcn.1400bcf60
mov rcx, qword [rbp + 0x2e0]
xor rcx, rsp
call fcn.140266a80
lea r11, [rsp + 0x3f0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea rdx, str.message
call fcn.1400bfb80
mov rcx, rax
call fcn.1400bfea0
test al, al
jne 0x1400b4f98
lea rdx, [0x140351c6c]
lea rcx, [0x14038cd70]
call fcn.1400bf340
lea rdx, str.message
lea rcx, [rbp + 0x270]
call fcn.1400bfb80
mov rdx, rax
lea rcx, [rbp + 0x2c0]
call fcn.1400bff20
nop
mov rdx, rax
lea rcx, [0x14038cd70]
call fcn.1400bf5b0
nop
lea rcx, [rbp + 0x2c0]
call fcn.1400bcf60
mov ecx, 0x1194
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call fcn.140284988
int3
lea rdx, str.download
lea rcx, [rbp + 0x270]
call fcn.1400bfb80
lea rdx, [rbp + 0x2c0]
mov rcx, rax
call fcn.1400bfde0
lea rcx, [rbp + 0x2c0]
call fcn.1400bce70
mov r8, rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor ecx, ecx
call fcn.140284988
nop
movdqa xmm0, xmmword [0x1403534f0]
movdqa xmmword [rbp + 0x20], xmm0
movdqa xmm1, xmmword [0x140353520]
movdqa xmmword [rbp + 0x30], xmm1
movdqa xmm0, xmmword [0x140353500]
movdqa xmmword [rbp + 0x40], xmm0
movdqa xmm1, xmmword [0x140353a50]
movdqa xmmword [rbp + 0x50], xmm1
mov dword [rbp + 0x60], 0xfaf3dcb0
mov dword [rbp + 0x64], 0xe7f5bbfa
mov word [rbp + 0x68], 0xe8
mov byte [rbp + 0x6a], 1
lea rdx, [rbp + 0x20]
call fcn.1400b5180
mov ecx, 0x1194
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call fcn.140284988
nop
call fcn.140285798
nop
call fcn.140285798
nop
call fcn.140285798
nop
call fcn.140285798
nop
call fcn.140285798
nop
call fcn.140285798
nop
call fcn.140285798
nop
call fcn.140285798
nop
call fcn.140285798
nop
call fcn.140285798
nop
call fcn.140285798
nop
call fcn.140285798
nop
call fcn.140285798
nop
call fcn.140285798
nop
call fcn.140285798
nop
call fcn.140285798
nop
call fcn.140285798
nop
call fcn.140285798
int3
call fcn.1400a7a20
int3
call fcn.140285798
nop
call fcn.1400a7a20
int3
call fcn.140285798
nop
mov rcx, rax
call fcn.1400be160
mov rdx, rax
lea rcx, [rbp + 0x2c0]
call fcn.1400a9e10
nop
mov r8, rax
lea rdx, str.type_must_be_boolean__but_is
lea rcx, [rbp + 0x190]
call fcn.1400bf290
nop
mov r8, rax
mov edx, 0x12e
lea rcx, [rbp + 0x20]
call fcn.1400b1ae0
lea rdx, [0x14037b958]
lea rcx, [rbp + 0x20]
call fcn.1402692a8
nop
mov rcx, rax
call fcn.1400be160
mov rdx, rax
lea rcx, [rbp + 0x2c0]
call fcn.1400a9e10
nop
mov r8, rax
lea rdx, str.type_must_be_string__but_is
lea rcx, [rbp + 0x190]
call fcn.1400bf290
nop
mov r8, rax
mov edx, 0x12e
lea rcx, [rbp + 0x20]
call fcn.1400b1ae0
lea rdx, [0x14037b958]
lea rcx, [rbp + 0x20]
call fcn.1402692a8
int3