Function at 0x140002740
Capabilities:
Delete file
Encode data using xor
Execute command
Set console window title

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xd0
lea rcx, str.taskkill__IM_EasyAntiCheat.exe__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Sc_stop_EasyAntiCheat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Sc_stop_EasyAntiCheatEOS
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1400792bc]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1400792c0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
movdqa xmm1, xmmword [0x1400795a0]
movdqu xmmword [rbp - 0x49], xmm1
movdqa xmm2, xmmword [0x140079500]
movdqu xmmword [rbp - 0x39], xmm2
mov dl, 0x3d
movzx r8d, dl
movzx r9d, dl
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rbp - 0x48], al
xor byte [rbp - 0x47], cl
xor byte [rbp - 0x46], cl
xor byte [rbp - 0x45], cl
xor byte [rbp - 0x44], cl
xor byte [rbp - 0x43], cl
xor byte [rbp - 0x42], cl
xor byte [rbp - 0x41], cl
xor byte [rbp - 0x40], cl
xor byte [rbp - 0x3f], cl
xor byte [rbp - 0x3e], cl
xor byte [rbp - 0x3d], cl
xor byte [rbp - 0x3c], cl
xor byte [rbp - 0x3b], cl
xor byte [rbp - 0x3a], cl
movd eax, xmm2
xor al, cl
mov byte [rbp - 0x39], al
xor byte [rbp - 0x38], cl
xor byte [rbp - 0x37], cl
xor byte [rbp - 0x36], cl
xor byte [rbp - 0x35], cl
xor byte [rbp - 0x34], cl
xor byte [rbp - 0x33], cl
xor byte [rbp - 0x32], cl
xor byte [rbp - 0x31], cl
xor byte [rbp - 0x30], cl
xor byte [rbp - 0x2f], cl
xor byte [rbp - 0x2e], cl
xor byte [rbp - 0x2d], cl
xor byte [rbp - 0x2c], cl
xor byte [rbp - 0x2b], cl
xor byte [rbp - 0x2a], cl
xor dl, cl
mov byte [rbp - 0x29], dl
xor r8b, cl
mov byte [rbp - 0x28], r8b
xor r9b, cl
mov byte [rbp - 0x27], r9b
mov byte [rbp - 0x26], 0
lea rcx, [rbp - 0x48]
call fcn.140005bf0
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400792bc]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm1, xmmword [0x140079490]
movdqu xmmword [rbp - 0x69], xmm1
mov cl, reloc.WLDAP32.dll_Ordinal_33
mov r8b, reloc.WS2_32.dll_ntohl
mov r9b, 0x26
mov r10b, gethostname
movzx r11d, cl
movzx ebx, r9b
mov dil, 0x7c
movzx esi, cl
mov r14b, Ordinal_45
movzx r15d, cl
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd edx, xmm1
xor al, dl
mov byte [rbp - 0x68], al
xor byte [rbp - 0x67], dl
xor byte [rbp - 0x66], dl
xor byte [rbp - 0x65], dl
xor byte [rbp - 0x64], dl
xor byte [rbp - 0x63], dl
xor byte [rbp - 0x62], dl
xor byte [rbp - 0x61], dl
xor byte [rbp - 0x60], dl
xor byte [rbp - 0x5f], dl
xor byte [rbp - 0x5e], dl
xor byte [rbp - 0x5d], dl
xor byte [rbp - 0x5c], dl
xor byte [rbp - 0x5b], dl
xor byte [rbp - 0x5a], dl
xor cl, dl
mov byte [rbp - 0x59], cl
xor r8b, dl
mov byte [rbp - 0x58], r8b
xor r9b, dl
mov byte [rbp - 0x57], r9b
xor r10b, dl
mov byte [rbp - 0x56], r10b
xor r11b, dl
mov byte [rbp - 0x55], r11b
xor bl, dl
mov byte [rbp - 0x54], bl
xor dil, dl
mov byte [rbp - 0x53], dil
xor sil, dl
mov byte [rbp - 0x52], sil
xor r14b, dl
mov byte [rbp - 0x51], r14b
xor r15b, dl
mov byte [rbp - 0x50], r15b
mov byte [rbp - 0x4f], 0
movdqa xmm1, xmmword [0x140079520]
movdqu xmmword [rbp + 7], xmm1
movdqa xmm2, xmmword [str.UzRUMNIURCT_bCC]
movdqu xmmword [rbp + 0x17], xmm2
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rbp + 8], al
xor byte [rbp + 9], cl
xor byte [rbp + 0xa], cl
xor byte [rbp + 0xb], cl
xor byte [rbp + 0xc], cl
xor byte [rbp + 0xd], cl
xor byte [rbp + 0xe], cl
xor byte [rbp + 0xf], cl
xor byte [rbp + 0x10], cl
xor byte [rbp + 0x11], cl
xor byte [rbp + 0x12], cl
xor byte [rbp + 0x13], cl
xor byte [rbp + 0x14], cl
xor byte [rbp + 0x15], cl
xor byte [rbp + 0x16], cl
movd eax, xmm2
xor al, cl
mov byte [rbp + 0x17], al
xor byte [rbp + 0x18], cl
xor byte [rbp + 0x19], cl
xor byte [rbp + 0x1a], cl
xor byte [rbp + 0x1b], cl
xor byte [rbp + 0x1c], cl
xor byte [rbp + 0x1d], cl
xor byte [rbp + 0x1e], cl
xor byte [rbp + 0x1f], cl
xor byte [rbp + 0x20], cl
xor byte [rbp + 0x21], cl
xor byte [rbp + 0x22], cl
xor byte [rbp + 0x23], cl
xor byte [rbp + 0x24], cl
xor byte [rbp + 0x25], cl
mov byte [rbp + 0x26], 0
lea rdx, [rbp - 0x68]
lea rcx, [rbp - 0x49]
call fcn.140001e80
nop
mov r8d, 0x3200
lea rdx, [0x140088ec0]
lea rcx, [rbp - 0x49]
call fcn.140002300
nop
mov rdx, qword [rbp - 0x31]
cmp rdx, 0x10
jb 0x140002a1a
inc rdx
mov rcx, qword [rbp - 0x49]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002a15
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002a15
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140067034
lea rdx, [rbp + 8]
lea rcx, [rbp - 0x49]
call fcn.140001e80
nop
mov r8d, 0x21a00
lea rdx, [0x1400dd4c0]
lea rcx, [rbp - 0x49]
call fcn.140002300
nop
mov rdx, qword [rbp - 0x31]
cmp rdx, 0x10
jb 0x140002a7d
inc rdx
mov rcx, qword [rbp - 0x49]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002a78
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002a78
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140067034
movdqa xmm0, xmmword [0x140079440]
movdqu xmmword [rbp + 7], xmm0
movdqa xmm1, xmmword [0x1400794e0]
movdqu xmmword [rbp + 0x17], xmm1
movdqa xmm0, xmmword [str.___0]
movdqu xmmword [rbp + 0x27], xmm0
mov dword [rbp + 0x37], 0x1402133b
mov dword [rbp + 0x3b], 0x1e144913
mov word [rbp + 0x3f], reloc.WS2_32.dll_sendto
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [rbp + 7]
xor byte [rbp + rcx + 8], al
movzx eax, byte [rbp + 7]
xor byte [rbp + rcx + 9], al
movzx eax, byte [rbp + 7]
xor byte [rbp + rcx + 0xa], al
movzx eax, byte [rbp + 7]
xor byte [rbp + rcx + 0xb], al
movzx eax, byte [rbp + 7]
xor byte [rbp + rcx + 0xc], al
movzx eax, byte [rbp + 7]
xor byte [rbp + rcx + 0xd], al
movzx eax, byte [rbp + 7]
xor byte [rbp + rcx + 0xe], al
movzx eax, byte [rbp + 7]
xor byte [rbp + rcx + 0xf], al
movzx eax, byte [rbp + 7]
xor byte [rbp + rcx + 0x10], al
movzx eax, byte [rbp + 7]
xor byte [rbp + rcx + 0x11], al
movzx eax, byte [rbp + 7]
xor byte [rbp + rcx + 0x12], al
movzx eax, byte [rbp + 7]
xor byte [rbp + rcx + 0x13], al
movzx eax, byte [rbp + 7]
xor byte [rbp + rcx + 0x14], al
movzx eax, byte [rbp + 7]
xor byte [rbp + rcx + 0x15], al
movzx eax, byte [rbp + 7]
xor byte [rbp + rcx + 0x16], al
movzx eax, byte [rbp + 7]
xor byte [rbp + rcx + 0x17], al
movzx eax, byte [rbp + 7]
xor byte [rbp + rcx + 0x18], al
movzx eax, byte [rbp + 7]
xor byte [rbp + rcx + 0x19], al
movzx eax, byte [rbp + 7]
xor byte [rbp + rcx + 0x1a], al
movzx eax, byte [rbp + 7]
xor byte [rbp + rcx + 0x1b], al
movzx eax, byte [rbp + 7]
xor byte [rbp + rcx + 0x1c], al
movzx eax, byte [rbp + 7]
xor byte [rbp + rcx + 0x1d], al
movzx eax, byte [rbp + 7]
xor byte [rbp + rcx + 0x1e], al
movzx eax, byte [rbp + 7]
xor byte [rbp + rcx + 0x1f], al
movzx eax, byte [rbp + 7]
xor byte [rbp + rcx + 0x20], al
movzx eax, byte [rbp + 7]
xor byte [rbp + rcx + 0x21], al
movzx eax, byte [rbp + 7]
xor byte [rbp + rcx + 0x22], al
movzx eax, byte [rbp + 7]
xor byte [rbp + rcx + 0x23], al
add rcx, 0x1c
cmp rcx, 0x38
jb 0x140002ac0
mov byte [rbp + 0x40], 0
lea rdx, [rbp + 8]
lea rcx, [rbp - 0x49]
call fcn.140001e80
mov rcx, rax
call fcn.1400024c0
movdqa xmm1, xmmword [0x140079570]
movdqu xmmword [rbp - 0x69], xmm1
mov cl, reloc.WS2_32.dll_WSAGetLastError
mov r8b, 0x40
mov r9b, 0x68
mov r10b, 0x79
movzx r11d, cl
movzx ebx, r9b
mov dil, reloc.WLDAP32.dll_Ordinal_50
movzx esi, cl
mov r14b, 0x65
movzx r15d, cl
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd edx, xmm1
xor al, dl
mov byte [rbp - 0x68], al
xor byte [rbp - 0x67], dl
xor byte [rbp - 0x66], dl
xor byte [rbp - 0x65], dl
xor byte [rbp - 0x64], dl
xor byte [rbp - 0x63], dl
xor byte [rbp - 0x62], dl
xor byte [rbp - 0x61], dl
xor byte [rbp - 0x60], dl
xor byte [rbp - 0x5f], dl
xor byte [rbp - 0x5e], dl
xor byte [rbp - 0x5d], dl
xor byte [rbp - 0x5c], dl
xor byte [rbp - 0x5b], dl
xor byte [rbp - 0x5a], dl
xor cl, dl
mov byte [rbp - 0x59], cl
xor r8b, dl
mov byte [rbp - 0x58], r8b
xor r9b, dl
mov byte [rbp - 0x57], r9b
xor r10b, dl
mov byte [rbp - 0x56], r10b
xor r11b, dl
mov byte [rbp - 0x55], r11b
xor bl, dl
mov byte [rbp - 0x54], bl
xor dil, dl
mov byte [rbp - 0x53], dil
xor sil, dl
mov byte [rbp - 0x52], sil
xor r14b, dl
mov byte [rbp - 0x51], r14b
xor r15b, dl
mov byte [rbp - 0x50], r15b
mov byte [rbp - 0x4f], 0
lea rcx, [rbp - 0x68]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
movdqa xmm1, xmmword [str.s0I__]
movdqu xmmword [rbp + 7], xmm1
movdqa xmm2, xmmword [0x1400793d0]
movdqu xmmword [rbp + 0x17], xmm2
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rbp + 8], al
xor byte [rbp + 9], cl
xor byte [rbp + 0xa], cl
xor byte [rbp + 0xb], cl
xor byte [rbp + 0xc], cl
xor byte [rbp + 0xd], cl
xor byte [rbp + 0xe], cl
xor byte [rbp + 0xf], cl
xor byte [rbp + 0x10], cl
xor byte [rbp + 0x11], cl
xor byte [rbp + 0x12], cl
xor byte [rbp + 0x13], cl
xor byte [rbp + 0x14], cl
xor byte [rbp + 0x15], cl
xor byte [rbp + 0x16], cl
movd eax, xmm2
xor al, cl
mov byte [rbp + 0x17], al
xor byte [rbp + 0x18], cl
xor byte [rbp + 0x19], cl
xor byte [rbp + 0x1a], cl
xor byte [rbp + 0x1b], cl
xor byte [rbp + 0x1c], cl
xor byte [rbp + 0x1d], cl
xor byte [rbp + 0x1e], cl
xor byte [rbp + 0x1f], cl
xor byte [rbp + 0x20], cl
xor byte [rbp + 0x21], cl
xor byte [rbp + 0x22], cl
xor byte [rbp + 0x23], cl
xor byte [rbp + 0x24], cl
xor byte [rbp + 0x25], cl
mov byte [rbp + 0x26], 0
lea rcx, [rbp + 8]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
movdqa xmm1, xmmword [0x140079460]
movdqu xmmword [rbp - 0x69], xmm1
mov dl, 0x5e
mov r8b, 0x43
movzx r9d, dl
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rbp - 0x68], al
xor byte [rbp - 0x67], cl
xor byte [rbp - 0x66], cl
xor byte [rbp - 0x65], cl
xor byte [rbp - 0x64], cl
xor byte [rbp - 0x63], cl
xor byte [rbp - 0x62], cl
xor byte [rbp - 0x61], cl
xor byte [rbp - 0x60], cl
xor byte [rbp - 0x5f], cl
xor byte [rbp - 0x5e], cl
xor byte [rbp - 0x5d], cl
xor byte [rbp - 0x5c], cl
xor byte [rbp - 0x5b], cl
xor byte [rbp - 0x5a], cl
xor dl, cl
mov byte [rbp - 0x59], dl
xor r8b, cl
mov byte [rbp - 0x58], r8b
xor r9b, cl
mov byte [rbp - 0x57], r9b
mov byte [rbp - 0x56], 0
lea rdx, [rbp - 0x68]
lea rcx, [rbp - 0x49]
call fcn.140001e80
nop
mov r8d, 0x4e00
lea rdx, [0x1400840c0]
lea rcx, [rbp - 0x49]
call fcn.140002300
nop
mov rdx, qword [rbp - 0x31]
cmp rdx, 0x10
jb 0x140002def
inc rdx
mov rcx, qword [rbp - 0x49]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002dea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002dea
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140067034
movdqa xmm1, xmmword [0x1400795b0]
movdqu xmmword [rbp - 0x69], xmm1
mov dl, 0x34
mov r8b, 0x7e
mov r9b, 0x76
movzx r10d, r9b
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rbp - 0x68], al
xor byte [rbp - 0x67], cl
xor byte [rbp - 0x66], cl
xor byte [rbp - 0x65], cl
xor byte [rbp - 0x64], cl
xor byte [rbp - 0x63], cl
xor byte [rbp - 0x62], cl
xor byte [rbp - 0x61], cl
xor byte [rbp - 0x60], cl
xor byte [rbp - 0x5f], cl
xor byte [rbp - 0x5e], cl
xor byte [rbp - 0x5d], cl
xor byte [rbp - 0x5c], cl
xor byte [rbp - 0x5b], cl
xor byte [rbp - 0x5a], cl
xor dl, cl
mov byte [rbp - 0x59], dl
xor r8b, cl
mov byte [rbp - 0x58], r8b
xor r9b, cl
mov byte [rbp - 0x57], r9b
xor r10b, cl
mov byte [rbp - 0x56], r10b
mov byte [rbp - 0x55], 0
lea rdx, [rbp - 0x68]
lea rcx, [rbp - 0x49]
call fcn.140001e80
nop
mov r8d, 0x51400
lea rdx, [0x14008c0c0]
lea rcx, [rbp - 0x49]
call fcn.140002300
nop
mov rdx, qword [rbp - 0x31]
cmp rdx, 0x10
jb 0x140002ec9
inc rdx
mov rcx, qword [rbp - 0x49]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002ec4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002ec4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140067034
movdqa xmm1, xmmword [str.xrrXXX__n]
movdqa xmmword [rbp - 0x49], xmm1
movdqa xmm2, xmmword [0x140079530]
movdqa xmmword [rbp - 0x39], xmm2
movdqa xmm3, xmmword [0x140079540]
movdqa xmmword [rbp - 0x29], xmm3
movdqa xmm4, xmmword [0x140079480]
movdqa xmmword [rbp - 0x19], xmm4
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rbp - 0x48], al
xor byte [rbp - 0x47], cl
xor byte [rbp - 0x46], cl
xor byte [rbp - 0x45], cl
xor byte [rbp - 0x44], cl
xor byte [rbp - 0x43], cl
xor byte [rbp - 0x42], cl
xor byte [rbp - 0x41], cl
xor byte [rbp - 0x40], cl
xor byte [rbp - 0x3f], cl
xor byte [rbp - 0x3e], cl
xor byte [rbp - 0x3d], cl
xor byte [rbp - 0x3c], cl
xor byte [rbp - 0x3b], cl
xor byte [rbp - 0x3a], cl
movd eax, xmm2
xor al, cl
mov byte [rbp - 0x39], al
xor byte [rbp - 0x38], cl
xor byte [rbp - 0x37], cl
xor byte [rbp - 0x36], cl
xor byte [rbp - 0x35], cl
xor byte [rbp - 0x34], cl
xor byte [rbp - 0x33], cl
xor byte [rbp - 0x32], cl
xor byte [rbp - 0x31], cl
xor byte [rbp - 0x30], cl
xor byte [rbp - 0x2f], cl
xor byte [rbp - 0x2e], cl
xor byte [rbp - 0x2d], cl
xor byte [rbp - 0x2c], cl
xor byte [rbp - 0x2b], cl
xor byte [rbp - 0x2a], cl
movd eax, xmm3
xor al, cl
mov byte [rbp - 0x29], al
xor byte [rbp - 0x28], cl
xor byte [rbp - 0x27], cl
xor byte [rbp - 0x26], cl
xor byte [rbp - 0x25], cl
xor byte [rbp - 0x24], cl
xor byte [rbp - 0x23], cl
xor byte [rbp - 0x22], cl
xor byte [rbp - 0x21], cl
xor byte [rbp - 0x20], cl
xor byte [rbp - 0x1f], cl
xor byte [rbp - 0x1e], cl
xor byte [rbp - 0x1d], cl
xor byte [rbp - 0x1c], cl
xor byte [rbp - 0x1b], cl
xor byte [rbp - 0x1a], cl
movd eax, xmm4
xor al, cl
mov byte [rbp - 0x19], al
xor byte [rbp - 0x18], cl
xor byte [rbp - 0x17], cl
xor byte [rbp - 0x16], cl
xor byte [rbp - 0x15], cl
xor byte [rbp - 0x14], cl
xor byte [rbp - 0x13], cl
xor byte [rbp - 0x12], cl
xor byte [rbp - 0x11], cl
xor byte [rbp - 0x10], cl
xor byte [rbp - 0xf], cl
xor byte [rbp - 0xe], cl
xor byte [rbp - 0xd], cl
xor byte [rbp - 0xc], cl
xor byte [rbp - 0xb], cl
xor byte [rbp - 0xa], cl
mov byte [rbp - 9], 0
lea rcx, [rbp - 0x48]
call fcn.140005bf0
lea rcx, [0x1400792d4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm1, xmmword [0x1400794b0]
movdqu xmmword [rbp - 0x69], xmm1
mov dl, 0x78
mov r8b, 0x65
movzx r9d, dl
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rbp - 0x68], al
xor byte [rbp - 0x67], cl
xor byte [rbp - 0x66], cl
xor byte [rbp - 0x65], cl
xor byte [rbp - 0x64], cl
xor byte [rbp - 0x63], cl
xor byte [rbp - 0x62], cl
xor byte [rbp - 0x61], cl
xor byte [rbp - 0x60], cl
xor byte [rbp - 0x5f], cl
xor byte [rbp - 0x5e], cl
xor byte [rbp - 0x5d], cl
xor byte [rbp - 0x5c], cl
xor byte [rbp - 0x5b], cl
xor byte [rbp - 0x5a], cl
xor dl, cl
mov byte [rbp - 0x59], dl
xor r8b, cl
mov byte [rbp - 0x58], r8b
xor r9b, cl
mov byte [rbp - 0x57], r9b
mov byte [rbp - 0x56], 0
lea rcx, [rbp - 0x68]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1400792bc]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm1, xmmword [0x140079550]
movdqu xmmword [rbp - 0x69], xmm1
mov dl, reloc.WS2_32.dll_sendto
mov r8b, 9
movzx r9d, dl
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rbp - 0x68], al
xor byte [rbp - 0x67], cl
xor byte [rbp - 0x66], cl
xor byte [rbp - 0x65], cl
xor byte [rbp - 0x64], cl
xor byte [rbp - 0x63], cl
xor byte [rbp - 0x62], cl
xor byte [rbp - 0x61], cl
xor byte [rbp - 0x60], cl
xor byte [rbp - 0x5f], cl
xor byte [rbp - 0x5e], cl
xor byte [rbp - 0x5d], cl
xor byte [rbp - 0x5c], cl
xor byte [rbp - 0x5b], cl
xor byte [rbp - 0x5a], cl
xor dl, cl
mov byte [rbp - 0x59], dl
xor r8b, cl
mov byte [rbp - 0x58], r8b
xor r9b, cl
mov byte [rbp - 0x57], r9b
mov byte [rbp - 0x56], 0
lea rcx, [rbp - 0x68]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
movdqa xmm1, xmmword [0x140079510]
movdqu xmmword [rbp - 0x49], xmm1
movdqa xmm2, xmmword [0x140079410]
movdqu xmmword [rbp - 0x39], xmm2
mov cl, reloc.WS2_32.dll_socket
mov r8b, Ordinal_79
mov r9b, 0x43
movzx r10d, r8b
mov r11b, 0x26
mov bl, reloc.WLDAP32.dll_Ordinal_33
mov dil, reloc.WLDAP32.dll_Ordinal_35
mov sil, Ordinal_45
mov r14b, 0x47
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd edx, xmm1
xor al, dl
mov byte [rbp - 0x48], al
xor byte [rbp - 0x47], dl
xor byte [rbp - 0x46], dl
xor byte [rbp - 0x45], dl
xor byte [rbp - 0x44], dl
xor byte [rbp - 0x43], dl
xor byte [rbp - 0x42], dl
xor byte [rbp - 0x41], dl
xor byte [rbp - 0x40], dl
xor byte [rbp - 0x3f], dl
xor byte [rbp - 0x3e], dl
xor byte [rbp - 0x3d], dl
xor byte [rbp - 0x3c], dl
xor byte [rbp - 0x3b], dl
xor byte [rbp - 0x3a], dl
movd eax, xmm2
xor al, dl
mov byte [rbp - 0x39], al
xor byte [rbp - 0x38], dl
xor byte [rbp - 0x37], dl
xor byte [rbp - 0x36], dl
xor byte [rbp - 0x35], dl
xor byte [rbp - 0x34], dl
xor byte [rbp - 0x33], dl
xor byte [rbp - 0x32], dl
xor byte [rbp - 0x31], dl
xor byte [rbp - 0x30], dl
xor byte [rbp - 0x2f], dl
xor byte [rbp - 0x2e], dl
xor byte [rbp - 0x2d], dl
xor byte [rbp - 0x2c], dl
xor byte [rbp - 0x2b], dl
xor byte [rbp - 0x2a], dl
xor cl, dl
mov byte [rbp - 0x29], cl
xor r8b, dl
mov byte [rbp - 0x28], r8b
xor r9b, dl
mov byte [rbp - 0x27], r9b
xor r10b, dl
mov byte [rbp - 0x26], r10b
xor r11b, dl
mov byte [rbp - 0x25], r11b
xor bl, dl
mov byte [rbp - 0x24], bl
xor dil, dl
mov byte [rbp - 0x23], dil
xor sil, dl
mov byte [rbp - 0x22], sil
xor r14b, dl
mov byte [rbp - 0x21], r14b
mov byte [rbp - 0x20], 0
lea rcx, [rbp - 0x48]
call fcn.140005bf0
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400792bc]
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
jmp qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]