Function at 0x1400eee70
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Create process on windows
Create thread
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xab8]
sub rsp, 0xb90
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x1401e6f00]
xor rax, rsp
mov qword [rbp + 0xa70], rax
mov r15, rcx
mov qword [rbp + 0xd0], rcx
xor r12d, r12d
mov dword [rsp + 0x40], r12d
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
xor r9d, r9d
lea r8, [0x1400f4860]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [rbp + 0x880]
call fcn.1400ee550
nop
lea rdx, [rbp + 0x880]
cmp qword [rbp + 0x898], 0xf
cmova rdx, qword [rbp + 0x880]
mov r8, qword [rbp + 0x890]
lea rcx, [section..data]
call fcn.140008164
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
xor r9d, r9d
lea r8, [0x1400f3dc0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp qword [r15 + 0x30], 0xa
je 0x1400ef0f6
movdqa xmm0, xmmword [0x14019e860]
movdqa xmmword [rbp + 0x80], xmm0
movdqa xmm1, xmmword [0x14019ea30]
movdqa xmmword [rbp + 0x90], xmm1
movdqa xmm0, xmmword [0x14019e970]
movdqa xmmword [rbp + 0xa0], xmm0
movdqa xmm1, xmmword [0x14019e7f0]
movdqa xmmword [rbp + 0xb0], xmm1
mov dword [rbp + 0xc0], 0x8fc58480
mov dword [rbp + 0xc4], 0x1009e9d
mov ecx, r12d
lea eax, [rcx - 0x57]
xor byte [rbp + rcx + 0x80], al
lea eax, [rcx - 0x56]
xor byte [rbp + rcx + 0x81], al
lea eax, [rcx - 0x55]
xor byte [rbp + rcx + 0x82], al
lea eax, [rcx - 0x54]
xor byte [rbp + rcx + 0x83], al
lea eax, [rcx - 0x53]
xor byte [rbp + rcx + 0x84], al
lea eax, [rcx - 0x52]
xor byte [rbp + rcx + 0x85], al
lea eax, [rcx - 0x51]
xor byte [rbp + rcx + 0x86], al
lea eax, [rcx - 0x50]
xor byte [rbp + rcx + 0x87], al
lea eax, [rcx - 0x4f]
xor byte [rbp + rcx + 0x88], al
lea eax, [rcx - 0x4e]
xor byte [rbp + rcx + 0x89], al
lea eax, [rcx - 0x4d]
xor byte [rbp + rcx + 0x8a], al
lea eax, [rcx - 0x4c]
xor byte [rbp + rcx + 0x8b], al
lea eax, [rcx - 0x4b]
xor byte [rbp + rcx + 0x8c], al
lea eax, [rcx - 0x4a]
xor byte [rbp + rcx + 0x8d], al
add rcx, 0xe
cmp rcx, 0x46
jb 0x1400eef92
mov byte [rbp + 0xc7], 0
mov r9d, reloc.WS2_32.dll_recv
xor r8d, r8d
lea rdx, [rbp + 0x80]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400ef0d6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400ef0d6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0xf3460d85
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400ef0d1
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400ef0b0
cmp r8d, 0xd4e4f245
je 0x1400ef0db
test r9d, r9d
jne 0x1400ef090
mov rax, qword [rax]
jmp 0x1400ef060
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
xor ecx, ecx
call rdx
lea rcx, [rbp + 0x830]
call fcn.1400eb370
nop
call fcn.1400f6150
mov qword [rbp + 0xd8], rax
mov dword [rbp + 0x40], 0xc2dcc58f
mov dword [rbp + 0x44], 0xd4c6dcc8
mov word [rbp + 0x48], 0x8c
mov byte [rbp + 0x4a], 1
mov rdx, r15
cmp qword [r15 + 0x18], 0xf
jbe 0x1400ef134
mov rdx, qword [r15]
xor r8d, r8d
mov rcx, rax
call fcn.1400f4b50
mov rbx, rax
mov dword [rbp - 0x60], 0xc1cac48f
mov dword [rbp - 0x5c], 0x10093c8
mov dword [rbp - 0x68], 0xdfcac28f
mov dword [rbp - 0x64], 0x10093c5
mov dword [rbp - 0x70], 0xdecedc8f
mov word [rbp - 0x6c], 0x90
mov byte [rbp - 0x6a], 1
mov dword [rbp + 0x30], 0xc9dbd3dd
mov dword [rbp + 0x34], 0xd9c1c790
mov word [rbp + 0x38], 0xc5
mov byte [rbp + 0x3a], 1
lea r8, [rbp - 0x70]
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x268]
call fcn.1400e88a0
nop
lea rdx, [r15 + 0x40]
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x1400ef1ae
mov rdx, qword [rdx]
mov rcx, rax
call fcn.1400056e0
xorps xmm0, xmm0
movups xmmword [rbp + 0x110], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x120], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x110], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x120], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rbp - 0x68]
lea rdx, [rbp + 0x110]
lea rcx, [rbp + 0x248]
call fcn.1400e87b0
nop
lea rdx, [rbp + 0x830]
cmp qword [rbp + 0x848], 0xf
cmova rdx, qword [rbp + 0x830]
mov r8, qword [rbp + 0x840]
mov rcx, rax
call fcn.1400056e0
xorps xmm0, xmm0
movups xmmword [rbp + 0x130], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x140], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x130], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x140], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rbp - 0x60]
lea rdx, [rbp + 0x130]
lea rcx, [rbp + 0x2c0]
call fcn.1400e87b0
nop
mov r14, 0xffffffffffffffff
mov r8, r14
nop dword [rax + rax]
inc r8
cmp byte [rbx + r8], 0
jne 0x1400ef290
mov rdx, rbx
mov rcx, rax
call fcn.1400056e0
xorps xmm0, xmm0
movups xmmword [rbp + 0x150], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x160], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x150], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x160], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rbp + 0x40]
lea rdx, [rbp + 0x150]
lea rcx, [rbp + 0x2e0]
call fcn.1400e89f0
nop
lea rdx, [r15 + 0x20]
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x1400ef308
mov rdx, qword [rdx]
mov rcx, rax
call fcn.1400056e0
xorps xmm0, xmm0
movups xmmword [rbp + 0x7c0], xmm0
mov qword [rbp + 0x7d0], r12
mov qword [rbp + 0x7d8], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x7c0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x7d0], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov edi, 0x3c
mov dword [rsp + 0x40], edi
mov rdx, qword [rbp + 0x2f8]
cmp rdx, 0xf
jbe 0x1400ef399
inc rdx
mov rcx, qword [rbp + 0x2e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ef394
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400ef394
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140179794
movdqa xmm6, xmmword [0x1401c8e40]
movdqu xmmword [rbp + 0x2f0], xmm6
mov byte [rbp + 0x2e0], 0
mov rdx, qword [rbp + 0x168]
cmp rdx, 0xf
jbe 0x1400ef3f4
inc rdx
mov rcx, qword [rbp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ef3ef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400ef3ef
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140179794
movdqu xmmword [rbp + 0x160], xmm6
mov byte [rbp + 0x150], 0
mov rdx, qword [rbp + 0x2d8]
cmp rdx, 0xf
jbe 0x1400ef447
inc rdx
mov rcx, qword [rbp + 0x2c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ef442
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400ef442
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140179794
movdqu xmmword [rbp + 0x2d0], xmm6
mov byte [rbp + 0x2c0], 0
mov rdx, qword [rbp + 0x148]
cmp rdx, 0xf
jbe 0x1400ef49a
inc rdx
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ef495
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400ef495
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140179794
movdqu xmmword [rbp + 0x140], xmm6
mov byte [rbp + 0x130], 0
mov rdx, qword [rbp + 0x260]
cmp rdx, 0xf
jbe 0x1400ef4ed
inc rdx
mov rcx, qword [rbp + 0x248]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ef4e8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400ef4e8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140179794
movdqu xmmword [rbp + 0x258], xmm6
mov byte [rbp + 0x248], 0
mov rdx, qword [rbp + 0x128]
cmp rdx, 0xf
jbe 0x1400ef540
inc rdx
mov rcx, qword [rbp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ef53b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400ef53b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140179794
movdqu xmmword [rbp + 0x120], xmm6
mov byte [rbp + 0x110], 0
mov rdx, qword [rbp + 0x280]
cmp rdx, 0xf
jbe 0x1400ef590
inc rdx
mov rcx, qword [rbp + 0x268]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ef58b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400f0fc2
call fcn.140179794
movdqu xmmword [rbp + 0x278], xmm6
mov byte [rbp + 0x268], 0
lea rbx, [r15 + 0x80]
mov rax, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x1400ef5b4
mov rbx, qword [rbx]
cmp rax, 5
jb 0x1400ef73a
lea rsi, [rbx + rax]
lea r8, [rsi - 4]
sub r8, rbx
mov edx, 0x68
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x1400ef73a
nop
cmp dword [rax], 0x70747468
jne 0x1400ef5ee
cmp byte [rax + 4], 0x73
je 0x1400ef60f
inc rax
lea r8, [rsi - 4]
sub r8, rax
mov edx, 0x68
mov rcx, rax
call sub.VCRUNTIME140.dll_memchr
test rax, rax
jne 0x1400ef5e0
jmp 0x1400ef73a
sub rax, rbx
cmp rax, 0xffffffffffffffff
je 0x1400ef73a
movdqa xmm0, xmmword [0x14019ea20]
movdqa xmmword [rbp + 0x360], xmm0
movdqa xmm1, xmmword [0x14019e980]
movdqa xmmword [rbp + 0x370], xmm1
movdqa xmm0, xmmword [0x14019e8e0]
movdqa xmmword [rbp + 0x380], xmm0
movdqa xmm1, xmmword [0x14019e700]
movdqa xmmword [rbp + 0x390], xmm1
mov byte [rbp + 0x3a0], 1
lea rcx, [rbp + 0x360]
call fcn.1400ede80
mov r9d, reloc.WS2_32.dll_recv
xor r8d, r8d
lea rdx, [rbp + 0x360]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400ef716
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400ef716
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x8b9d89ad
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400ef711
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400ef6f0
cmp r8d, 0xbf6fde0d
je 0x1400ef71b
test r9d, r9d
jne 0x1400ef6d0
mov rax, qword [rax]
jmp 0x1400ef6a0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
xor ecx, ecx
call rdx
mov edi, dword [rsp + 0x40]
lea rcx, [r15 + 0x80]
mov r8, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 0xf
jbe 0x1400ef74f
mov rcx, qword [rcx]
test r8, r8
jne 0x1400ef772
lea rdx, [0x1401b8318]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400ef772
cmp qword [r15 + 0x90], 0
je 0x1400effd7
lea rdx, [r15 + 0x80]
xor r8d, r8d
lea rcx, [rbp + 0x590]
call fcn.140005e28
nop
lea rcx, [rbp + 0x590]
call fcn.140002d24
movzx ebx, al
lea rcx, [rbp + 0x590]
call fcn.1400055fc
test bl, bl
jne 0x1400ef8c4
movdqa xmm0, xmmword [0x14019e830]
movdqu xmmword [rbp + 0x288], xmm0
movdqa xmm1, xmmword [0x14019e950]
movdqu xmmword [rbp + 0x298], xmm1
movdqa xmm0, xmmword [0x14019e930]
movdqu xmmword [rbp + 0x2a8], xmm0
mov word [rbp + 0x2b8], 0xf7
mov byte [rbp + 0x2ba], 1
lea rcx, [rbp + 0x288]
call fcn.1400edbc0
mov r9d, reloc.WS2_32.dll_recv
xor r8d, r8d
lea rdx, [rbp + 0x288]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400ef8a4
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400ef8a4
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r11 + r9*4]
mov r8d, dword [rdx + r10]
add r8, r10
mov edx, 0x12da4328
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x1400ef89f
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x1400ef880
cmp edx, 0x33854d78
je 0x1400ef8a9
test r9d, r9d
jne 0x1400ef860
mov rax, qword [rax]
jmp 0x1400ef830
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
xor ecx, ecx
call rax
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp + 0x8c0]
call sub.VCRUNTIME140.dll_memset
lea rbx, [r15 + 0x80]
cmp qword [rbx + 0x18], 0xf
jbe 0x1400ef8e9
mov rbx, qword [rbx]
lea rax, [0x1401b95a8]
mov qword [rbp + 0x8c0], rax
lea rcx, [rbp + 0x970]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rsp + 0x40], 0x13c
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x8d0]
lea rcx, [rbp + 0x8c0]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rbp + 0x8c0]
movsxd rcx, dword [rax + 4]
lea rdi, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x8c0], rdi
mov rax, qword [rbp + 0x8c0]
movsxd rcx, dword [rax + 4]
lea r8d, [rcx - 0xb0]
mov dword [rbp + rcx + 0x8bc], r8d
lea rcx, [rbp + 0x8d0]
call fcn.140005810
nop
mov r9d, 0x40
mov r8d, 1
mov rdx, rbx
lea rcx, [rbp + 0x8d0]
call fcn.140005758
test rax, rax
jne 0x1400ef9ad
mov rax, qword [rbp + 0x8c0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x8c0]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
mov rax, qword [rbp + 0x8c0]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x8c0], rdi
mov rax, qword [rbp + 0x8c0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x8bc], edx
xorps xmm0, xmm0
movups xmmword [rbp + 0x7e0], xmm0
mov qword [rbp + 0x7f0], r12
mov qword [rbp + 0x7f8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x7e0], 0
movups xmmword [rbp + 0x860], xmm0
movdqu xmmword [rbp + 0x870], xmm6
mov byte [rbp + 0x860], 0
mov rax, qword [rbp + 0x8c0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x8c0]
add rcx, rax
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
movzx r8d, al
lea rdx, [rbp + 0x7e0]
lea rcx, [rbp + 0x8c0]
call fcn.140012fd8
movdqa xmm0, xmmword [0x14019e880]
movdqu xmmword [rbp + 0x320], xmm0
movdqa xmm1, xmmword [0x14019ea40]
movdqu xmmword [rbp + 0x330], xmm1
movdqa xmm0, xmmword [0x14019ea80]
movdqu xmmword [rbp + 0x340], xmm0
mov word [rbp + 0x350], 0x100
lea r8, [r15 + 0x80]
mov rcx, qword [r8 + 0x10]
movabs r13, 0x7fffffffffffffff
mov rax, r13
sub rax, rcx
cmp rax, 0x14
jb 0x1400f1172
mov rax, r8
cmp qword [r8 + 0x18], 0xf
jbe 0x1400efab0
mov rax, qword [r8]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], reloc.WS2_32.dll_sendto
lea r9, str.certutil__hashfile__
movzx edx, byte [rbp + 0x7a8]
lea rcx, [rbp + 0x5b0]
call fcn.140006bb0
nop
lea r8, [rbp + 0x320]
lea rdx, [rbp + 0x5b0]
lea rcx, [rbp + 0x708]
call fcn.1400e8af0
nop
cmp qword [rax + 0x18], 0xf
jbe 0x1400efb03
mov rax, qword [rax]
xorps xmm0, xmm0
movups xmmword [rbp + 0x210], xmm0
movdqu xmmword [rbp + 0x220], xmm6
mov byte [rbp + 0x210], 0
mov dword [rsp + 0x40], 0x73c
movups xmmword [rbp + 0x820], xmm0
lea rdx, [0x14019e4a0]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__popen]
mov rcx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__pclose]
mov qword [rbp + 0x820], rcx
mov qword [rbp + 0x828], rax
test rax, rax
je 0x1400f111a
mov r8, rax
mov edx, 0x80
lea rcx, [rbp + 0x9f0]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgets]
test rax, rax
je 0x1400efbbb
lea rax, [rbp + 0x9f0]
mov r8, r14
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400efb80
lea rdx, [rbp + 0x9f0]
lea rcx, [rbp + 0x210]
call fcn.140008164
mov r8, qword [rbp + 0x828]
mov edx, 0x80
lea rcx, [rbp + 0x9f0]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgets]
test rax, rax
jne 0x1400efb73
mov rcx, qword [rbp + 0x828]
test rcx, rcx
je 0x1400efbce
call qword [rbp + 0x820]
nop
lea rdx, [rbp + 0x210]
lea rcx, [rbp + 0x860]
call fcn.140011f48
nop
lea rcx, [rbp + 0x210]
call fcn.140004f48
nop
lea rcx, [rbp + 0x708]
call fcn.140004f48
nop
lea rcx, [rbp + 0x5b0]
call fcn.140004f48
mov dword [rsp + 0x7c], 0x3d6e65
mov dword [rsp + 0x78], 0x6b6f7426
mov byte [rbp - 0x80], 0
lea rax, [rsp + 0x78]
mov rbx, r14
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400efc24
mov r15, qword [rbp + 0x7f0]
mov rax, r13
sub rax, r15
cmp rax, rbx
jb 0x1400f1172
lea r12, [rbp + 0x7e0]
cmp qword [rbp + 0x7f8], 0xf
cmova r12, qword [rbp + 0x7e0]
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xf0], xmm1
lea r14, [r15 + rbx]
mov edi, reloc.WS2_32.dll_ntohs
lea rsi, [rbp + 0xe0]
cmp r14, rdi
jbe 0x1400efd00
mov rdi, r14
or rdi, 0xf
cmp rdi, r13
jbe 0x1400efcc0
mov rdi, r13
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140179510
test rax, rax
je 0x1400efef9
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x1400efcf9
mov eax, socket
cmp rdi, rax
cmovb rdi, rax
lea rcx, [rdi + 1]
test rcx, rcx
jne 0x1400efcd9
xor esi, esi
jmp 0x1400efcf9
cmp rcx, 0x1000
jb 0x1400efcf1
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400f116c
jmp 0x1400efca1
call fcn.140179510
mov rsi, rax
mov qword [rbp + 0xe0], rsi
mov qword [rbp + 0xf0], r14
mov qword [rbp + 0xf8], rdi
mov r8, rbx
lea rdx, [rsp + 0x78]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rsi + rbx]
mov r8, r15
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + r14], 0
mov rdi, qword [rbp + 0xf0]
lea r9, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 0xf
cmova r9, qword [rbp + 0xe0]
mov rcx, qword [rbp + 0x7d0]
mov rdx, qword [rbp + 0x7d8]
mov rax, rdx
sub rax, rcx
cmp rdi, rax
ja 0x1400efd9e
lea rax, [rcx + rdi]
mov qword [rbp + 0x7d0], rax
lea rbx, [rbp + 0x7c0]
cmp rdx, 0xf
cmova rbx, qword [rbp + 0x7c0]
add rbx, rcx
mov r8, rdi
mov rdx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + rbx], 0
jmp 0x1400efdb6
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rdx, rdi
lea rcx, [rbp + 0x7c0]
call fcn.1400069f8
nop
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0xf
jbe 0x1400efdf7
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400efdf2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400efef9
call fcn.140179794
movdqu xmmword [rbp + 0xf0], xmm6
mov byte [rbp + 0xe0], 0
mov dword [rsp + 0x5c], 0x3d6873
mov dword [rsp + 0x58], 0x61687426
mov byte [rsp + 0x60], 0
mov r15, qword [rbp + 0xd0]
lea r8, [r15 + 0x80]
lea rcx, [rsp + 0x58]
mov r14, 0xffffffffffffffff
mov rax, r14
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x1400efe40
mov rdx, qword [r8 + 0x10]
sub r13, rdx
cmp r13, rax
jb 0x1400f1172
mov rcx, r8
cmp qword [r8 + 0x18], 0xf
jbe 0x1400efe66
mov rcx, qword [r8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
movzx edx, byte [rbp + 0x7a8]
lea rcx, [rbp + 0x170]
call fcn.140006bb0
mov edi, 0x3fc
mov dword [rsp + 0x40], edi
lea rdx, [rbp + 0x170]
cmp qword [rbp + 0x188], 0xf
cmova rdx, qword [rbp + 0x170]
mov r8, qword [rbp + 0x180]
lea rcx, [rbp + 0x7c0]
call fcn.1400056e0
nop
mov rdx, qword [rbp + 0x188]
cmp rdx, 0xf
jbe 0x1400eff05
inc rdx
mov rcx, qword [rbp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400eff00
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400eff00
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140179794
movdqu xmmword [rbp + 0x180], xmm6
mov byte [rbp + 0x170], 0
mov r8, qword [rbp + 0x878]
cmp r8, 0xf
jbe 0x1400eff34
mov rdx, qword [rbp + 0x860]
lea rcx, [rbp + 0x860]
call fcn.140005914
movdqu xmmword [rbp + 0x870], xmm6
mov byte [rbp + 0x860], 0
mov r8, qword [rbp + 0x7f8]
cmp r8, 0xf
jbe 0x1400eff63
mov rdx, qword [rbp + 0x7e0]
lea rcx, [rbp + 0x7e0]
call fcn.140005914
xor r12d, r12d
mov qword [rbp + 0x7f0], r12
mov qword [rbp + 0x7f8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x7e0], r12b
mov rax, qword [rbp + 0x8c0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x8c0], rax
mov rax, qword [rbp + 0x8c0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x8bc], edx
lea rcx, [rbp + 0x8d0]
call fcn.140004bf8
lea rcx, [rbp + 0x8d8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x970]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
mov rcx, qword [rbp + 0xd8]
call fcn.1400f6120
lea rax, [rbp + 0x728]
mov qword [rbp + 0xd8], rax
lea rdx, [r15 + 0x60]
lea rcx, [rbp + 0x728]
call fcn.140005100
mov rbx, rax
lea rdx, [rbp + 0x7c0]
lea rcx, [rbp + 0x748]
call fcn.140005100
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x800]
call fcn.1400f41d0
nop
mov dword [rbp - 0x4c], 0x64696c
mov dword [rbp - 0x58], 0x4179654b
mov dword [rbp - 0x54], 0x5f687475
mov dword [rbp - 0x50], 0x61766e49
mov byte [rbp - 0x48], 0
lea rcx, [rbp - 0x58]
mov rax, r14
inc rax
cmp byte [rcx + rax], 0
jne 0x1400f0052
lea rcx, [rbp + 0x800]
mov rbx, qword [rbp + 0x800]
mov rsi, qword [rbp + 0x818]
cmp rsi, 0xf
cmova rcx, rbx
mov r8, qword [rbp + 0x810]
cmp r8, rax
jne 0x1400f01e6
lea rdx, [rbp - 0x58]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400f01e6
movdqa xmm0, xmmword [0x14019e850]
movdqa xmmword [rbp + 0x1a0], xmm0
movdqa xmm1, xmmword [0x14019e8d0]
movdqa xmmword [rbp + 0x1b0], xmm1
movdqa xmm0, xmmword [0x14019e990]
movdqa xmmword [rbp + 0x1c0], xmm0
movdqa xmm1, xmmword [0x14019e7e0]
movdqa xmmword [rbp + 0x1d0], xmm1
mov dword [rbp + 0x1e0], 0xc58e9b
mov byte [rbp + 0x1e4], 1
mov rcx, r12
nop dword [rax]
lea eax, [rcx - 0x57]
xor byte [rbp + rcx + 0x1a0], al
inc rcx
cmp rcx, 0x43
jb 0x1400f00f0
mov byte [rbp + 0x1e4], 0
mov r9d, reloc.WS2_32.dll_recv
xor r8d, r8d
lea rdx, [rbp + 0x1a0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400f01b4
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400f01b4
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r10 + r9*4]
mov r8d, dword [rdx + r11]
add r8, r10
mov edx, 0x56116bbd
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x1400f01af
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x1400f0190
cmp edx, 0x415247dd
je 0x1400f01b9
test r9d, r9d
jne 0x1400f0170
mov rax, qword [rax]
jmp 0x1400f0140
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
xor ecx, ecx
call rax
mov rsi, qword [rbp + 0x818]
mov rbx, qword [rbp + 0x800]
mov edi, dword [rsp + 0x40]
lea rax, [rbp + 0x1f0]
mov qword [rbp + 0xd8], rax
lea rdx, [rbp + 0x800]
cmp rsi, 0xf
cmova rdx, rbx
xorps xmm0, xmm0
movups xmmword [rbp + 0x1f0], xmm0
mov qword [rbp + 0x200], r12
mov qword [rbp + 0x208], r12
nop dword [rax + rax]
inc r14
cmp byte [rdx + r14], 0
jne 0x1400f0220
mov r8, r14
lea rcx, [rbp + 0x1f0]
call fcn.140006600
nop
lea rax, [rbp + 0x6a8]
mov qword [rbp + 0xd0], rax
lea rdx, [0x1401e6040]
lea rcx, [rbp + 0x6a8]
call fcn.140005100
mov rbx, rax
lea rdx, [0x1401e6020]
lea rcx, [rbp + 0x6c8]
call fcn.140005100
nop
lea r8, [rbp + 0x1f0]
mov rdx, rbx
mov rcx, rax
call fcn.1400e9d70
xor eax, 0xa5a5
mov edx, eax
shr eax, 8
movzx r8d, al
movzx eax, dl
movabs r14, 0xcbf29ce484222325
xor rax, r14
movabs rsi, 0x100000001b3
imul rax, rsi
xor r8, rax
imul r8, rsi
mov eax, edx
shr eax, 0x10
movzx ecx, al
xor r8, rcx
imul r8, rsi
shr rdx, 0x18
xor r8, rdx
imul r8, rsi
cmp r8w, 0xdf7f
jne 0x1400f0edd
mov qword [rbp + 0x7a0], r12
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x768]
lea rdx, [rbp + 0x800]
lea rcx, [rbp + 0x7b0]
call fcn.140023cec
nop
lea rdx, [r15 + 0x20]
lea rcx, [rbp + 0x190]
call fcn.14002bbcc
nop
mov dword [rbp - 0x20], 0xc9c5ddc6
mov dword [rbp - 0x1c], 0xcbc7df
mov byte [rbp - 0x18], 1
lea rdx, [rbp + 0x5d0]
lea rcx, [rbp - 0x20]
call fcn.1400e97d0
nop
movzx ecx, byte [rbp + 0x7b0]
test cl, cl
jne 0x1400f0362
mov byte [rbp + 0x7b0], 1
call fcn.140024954
mov qword [rbp + 0x7b8], rax
movzx ecx, byte [rbp + 0x7b0]
jmp 0x1400f0369
mov rax, qword [rbp + 0x7b8]
cmp cl, 1
jne 0x1400f037f
lea rdx, [rbp + 0x5d0]
mov rcx, rax
call fcn.14002b278
jmp 0x1400f0384
mov rax, qword [rsp + 0x48]
lea rdx, [rbp + 0x190]
mov rcx, rax
call fcn.1400e9400
movzx ebx, al
lea rcx, [rbp + 0x5d0]
call fcn.140004f48
nop
movzx edx, byte [rbp + 0x190]
lea rcx, [rbp + 0x198]
call fcn.140022b7c
test bl, bl
jne 0x1400f046b
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400f0444
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400f0444
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r11 + r9*4]
mov r8d, dword [rdx + r10]
add r8, r10
mov edx, 0xe14e2b84
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x1400f043f
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x1400f0420
cmp edx, 0xf248e094
je 0x1400f0449
test r9d, r9d
jne 0x1400f0400
mov rax, qword [rax]
jmp 0x1400f03d0
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
mov ecx, 8
call rax
mov edi, dword [rsp + 0x40]
mov dword [rsp + 0x6c], 0x656761
mov dword [rsp + 0x68], 0x7373656d
mov byte [rsp + 0x70], 0
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x6f]
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x5f0]
call fcn.140007118
or edi, 0x1800
movzx ecx, byte [rbp + 0x7b0]
test cl, cl
jne 0x1400f04c8
mov byte [rbp + 0x7b0], 1
call fcn.140024954
mov qword [rbp + 0x7b8], rax
movzx ecx, byte [rbp + 0x7b0]
jmp 0x1400f04cf
mov rax, qword [rbp + 0x7b8]
cmp cl, 1
jne 0x1400f04e5
lea rdx, [rbp + 0x5f0]
mov rcx, rax
call fcn.14002b278
jmp 0x1400f04ea
mov rax, qword [rsp + 0x48]
lea rdx, [rbp + 0x9d0]
mov rcx, rax
call fcn.1400e8750
nop
lea rcx, [rbp + 0x5f0]
call fcn.140004f48
lea rdx, [rbp + 0x7b0]
lea rcx, [rbp + 0x310]
call fcn.1400236fc
mov rdx, rax
mov rcx, r15
call fcn.1400f2f20
mov word [rsp + 0x53], 0x65
mov word [rsp + 0x50], 0x6f63
mov byte [rsp + 0x52], 0x64
mov byte [rsp + 0x55], 0
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x54]
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x610]
call fcn.140007118
or edi, 0x6000
movzx ecx, byte [rbp + 0x7b0]
test cl, cl
jne 0x1400f0584
mov byte [rbp + 0x7b0], 1
call fcn.140024954
mov qword [rbp + 0x7b8], rax
movzx ecx, byte [rbp + 0x7b0]
jmp 0x1400f058b
mov rax, qword [rbp + 0x7b8]
cmp cl, 1
jne 0x1400f05a1
lea rdx, [rbp + 0x610]
mov rcx, rax
call fcn.14002b278
jmp 0x1400f05a6
mov rax, qword [rsp + 0x48]
mov rcx, rax
call fcn.140027a74
mov edx, eax
shr eax, 8
movzx ebx, al
movzx eax, dl
xor rax, r14
imul rax, rsi
xor rbx, rax
imul rbx, rsi
mov eax, edx
shr eax, 0x10
movzx ecx, al
xor rbx, rcx
imul rbx, rsi
shr rdx, 0x18
xor rbx, rdx
imul rbx, rsi
lea rcx, [rbp + 0x610]
call fcn.140004f48
mov dword [rbp - 0x10], 0xcfc8dfda
mov dword [rbp - 0xc], 0xdcddc8
mov byte [rbp - 8], 1
lea rdx, [rbp + 0x650]
lea rcx, [rbp - 0x10]
call fcn.1400e97d0
nop
or edi, 1
mov dword [rsp + 0x40], edi
movzx ecx, byte [rbp + 0x7b0]
test cl, cl
jne 0x1400f063e
mov byte [rbp + 0x7b0], 1
call fcn.140024954
mov qword [rbp + 0x7b8], rax
movzx ecx, byte [rbp + 0x7b0]
jmp 0x1400f0645
mov rax, qword [rbp + 0x7b8]
cmp cl, 1
jne 0x1400f065e
lea rdx, [rbp + 0x650]
mov rcx, rax
call fcn.14002b278
mov rcx, rax
jmp 0x1400f0663
mov rcx, qword [rsp + 0x48]
lea rax, [rcx + 8]
cmp byte [rcx], 4
cmovne rax, r12
cmp byte [rax], 0
je 0x1400f070f
mov dword [rbp], 0xcfc8dfda
mov dword [rbp + 4], 0xdcddc8
mov byte [rbp + 8], 1
lea rdx, [rbp + 0x630]
lea rcx, [rbp]
call fcn.1400e97d0
nop
or edi, 2
mov dword [rsp + 0x40], edi
movzx eax, byte [rbp + 0x7b0]
test al, al
jne 0x1400f06cb
mov byte [rbp + 0x7b0], 1
call fcn.140024954
mov rcx, rax
mov qword [rbp + 0x7b8], rax
movzx eax, byte [rbp + 0x7b0]
jmp 0x1400f06d2
mov rcx, qword [rbp + 0x7b8]
cmp al, 1
jne 0x1400f06e7
lea rdx, [rbp + 0x630]
call fcn.14002b278
mov rcx, rax
jmp 0x1400f06ec
mov rcx, qword [rsp + 0x48]
lea rax, [rcx + 8]
cmp byte [rcx], 4
cmovne rax, r12
cmp byte [rax], 0
je 0x1400f070b
movabs rax, 0xcbe5c873d26645f1
cmp rbx, rax
je 0x1400f070f
xor bl, bl
jmp 0x1400f0711
mov bl, 1
test dil, 2
je 0x1400f0727
and edi, 0xfffffffd
lea rcx, [rbp + 0x630]
call fcn.140004f48
nop
test dil, 1
je 0x1400f0739
lea rcx, [rbp + 0x650]
call fcn.140004f48
test bl, bl
je 0x1400f0e06
mov dword [rbp + 0x10], 0xcfc8dfda
mov dword [rbp + 0x14], 0xdcddc8
mov byte [rbp + 0x18], 1
lea rdx, [rbp + 0x670]
lea rcx, [rbp + 0x10]
call fcn.1400e97d0
nop
movzx eax, byte [rbp + 0x7b0]
test al, al
jne 0x1400f078e
mov byte [rbp + 0x7b0], 1
call fcn.140024954
mov rcx, rax
mov qword [rbp + 0x7b8], rax
movzx eax, byte [rbp + 0x7b0]
jmp 0x1400f0795
mov rcx, qword [rbp + 0x7b8]
cmp al, 1
jne 0x1400f07aa
lea rdx, [rbp + 0x670]
call fcn.14002b278
mov rcx, rax
jmp 0x1400f07af
mov rcx, qword [rsp + 0x48]
lea rax, [rcx + 8]
cmp byte [rcx], 4
cmovne rax, r12
movzx ebx, byte [rax]
lea rcx, [rbp + 0x670]
call fcn.140004f48
test bl, bl
je 0x1400f0997
mov dword [rbp + 0x60], 0xffdccfc7
mov dword [rbp + 0x64], 0xd9dcddc8
mov dword [rbp + 0x68], 0x100dcde
lea rdx, [rbp + 0x510]
lea rcx, [rbp + 0x60]
call fcn.1400e98f0
nop
movzx eax, byte [rbp + 0x7b0]
test al, al
jne 0x1400f0821
mov byte [rbp + 0x7b0], 1
call fcn.140024954
mov rcx, rax
mov qword [rbp + 0x7b8], rax
movzx eax, byte [rbp + 0x7b0]
jmp 0x1400f0828
mov rcx, qword [rbp + 0x7b8]
cmp al, 1
jne 0x1400f083d
lea rdx, [rbp + 0x510]
call fcn.14002b278
mov rcx, rax
jmp 0x1400f0842
mov rcx, qword [rsp + 0x48]
lea rax, [rcx + 8]
cmp byte [rcx], 4
cmovne rax, r12
movzx ebx, byte [rax]
lea rcx, [rbp + 0x510]
call fcn.140004f48
test bl, bl
je 0x1400f086b
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp + 0x50], 0xdfd8cfda
mov dword [rbp + 0x54], 0xd9c1c1c4
mov word [rbp + 0x58], 0xd5
mov byte [rbp + 0x5a], 1
lea rdx, [rbp + 0x4f0]
lea rcx, [rbp + 0x50]
call fcn.1400e9870
nop
movzx eax, byte [rbp + 0x7b0]
test al, al
jne 0x1400f08be
mov byte [rbp + 0x7b0], 1
call fcn.140024954
mov rcx, rax
mov qword [rbp + 0x7b8], rax
movzx eax, byte [rbp + 0x7b0]
jmp 0x1400f08c5
mov rcx, qword [rbp + 0x7b8]
cmp al, 1
jne 0x1400f08d7
lea rdx, [rbp + 0x4f0]
call fcn.14002b278
jmp 0x1400f08dc
mov rax, qword [rsp + 0x48]
lea rcx, [r15 + 0x240]
mov rdx, rax
call fcn.1400e8630
nop
lea rcx, [rbp + 0x4f0]
call fcn.140004f48
mov byte [0x1402e4e68], 1
mov dword [rbp - 0x40], 0xc5dbdac8
mov dword [rbp - 0x3c], 0xc0c8c3
mov byte [rbp - 0x38], 1
lea rdx, [rbp + 0x570]
lea rcx, [rbp - 0x40]
call fcn.1400e97d0
nop
movzx ecx, byte [rbp + 0x7b0]
test cl, cl
jne 0x1400f0949
mov byte [rbp + 0x7b0], 1
call fcn.140024954
mov qword [rbp + 0x7b8], rax
movzx ecx, byte [rbp + 0x7b0]
jmp 0x1400f0950
mov rax, qword [rbp + 0x7b8]
cmp cl, 1
jne 0x1400f0966
lea rdx, [rbp + 0x570]
mov rcx, rax
call fcn.14002b278
jmp 0x1400f096b
mov rax, qword [rsp + 0x48]
mov rdx, rax
lea rcx, [rbp + 0x300]
call fcn.1400236fc
mov rdx, rax
mov rcx, r15
call fcn.1400f2b00
nop
lea rcx, [rbp + 0x570]
call fcn.140004f48
jmp 0x1400f0eb8
mov dword [rbp + 0x70], 0xcdddc4c0
mov dword [rbp + 0x74], 0xc6cbc7c1
mov dword [rbp + 0x78], 0x100c0d4
xor eax, eax
mov qword [rbp + 0x108], rax
mov byte [rbp + 0x100], 3
xorps xmm0, xmm0
movups xmmword [rbp + 0x850], xmm0
mov edx, 1
lea rcx, [rbp + 0x7a8]
call fcn.140006b6c
lea rcx, [rbp + 0x7a8]
mov qword [rbp + 0x850], rcx
mov qword [rbp + 0x858], rax
mov rdx, rax
lea rcx, [rbp + 0x70]
call fcn.1400e98f0
mov rax, qword [rbp + 0x858]
mov qword [rbp + 0x858], r12
mov qword [rbp + 0x108], rax
mov dword [rbp - 0x30], 0xdfd8cfc4
mov dword [rbp - 0x2c], 0xcac9cc
mov byte [rbp - 0x28], 1
lea rdx, [rbp + 0x550]
lea rcx, [rbp - 0x30]
call fcn.1400e97d0
nop
movzx ecx, byte [rbp + 0x7b0]
test cl, cl
jne 0x1400f0a57
mov byte [rbp + 0x7b0], 1
call fcn.140024954
mov qword [rbp + 0x7b8], rax
movzx ecx, byte [rbp + 0x7b0]
jmp 0x1400f0a5e
mov rax, qword [rbp + 0x7b8]
cmp cl, 1
jne 0x1400f0a74
lea rdx, [rbp + 0x550]
mov rcx, rax
call fcn.14002b278
jmp 0x1400f0a79
mov rax, qword [rsp + 0x48]
lea rdx, [rbp + 0x100]
mov rcx, rax
call fcn.1400e9400
movzx ebx, al
lea rcx, [rbp + 0x550]
call fcn.140004f48
nop
movzx edx, byte [rbp + 0x100]
lea rcx, [rbp + 0x108]
call fcn.140022b7c
test bl, bl
je 0x1400f0eb8
mov dword [rbp + 0x20], 0xc2dcc5cd
mov dword [rbp + 0x24], 0xd4cec1c1
mov word [rbp + 0x28], 0x100
lea rdx, [rbp + 0x530]
lea rcx, [rbp + 0x20]
call fcn.1400e9820
nop
movzx eax, byte [rbp + 0x7b0]
test al, al
jne 0x1400f0b02
mov byte [rbp + 0x7b0], 1
call fcn.140024954
mov rcx, rax
mov qword [rbp + 0x7b8], rax
movzx eax, byte [rbp + 0x7b0]
jmp 0x1400f0b09
mov rcx, qword [rbp + 0x7b8]
cmp al, 1
jne 0x1400f0b1b
lea rdx, [rbp + 0x530]
call fcn.14002b278
jmp 0x1400f0b20
mov rax, qword [rsp + 0x48]
lea rdx, [rbp + 0x8a0]
mov rcx, rax
call fcn.1400e8750
nop
lea rcx, [rbp + 0x530]
call fcn.140004f48
lea rcx, [rbp + 0x8a0]
mov rbx, qword [rbp + 0x8a0]
mov rdi, qword [rbp + 0x8b8]
cmp rdi, 0xf
cmova rcx, rbx
mov r8, qword [rbp + 0x8b0]
test r8, r8
jne 0x1400f0d07
lea rdx, [0x1401b8318]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400f0d07
movdqa xmm0, xmmword [0x14019e9e0]
movdqa xmmword [rbp + 0x3b0], xmm0
movdqa xmm1, xmmword [0x14019e8b0]
movdqa xmmword [rbp + 0x3c0], xmm1
movdqa xmm0, xmmword [0x14019ea60]
movdqa xmmword [rbp + 0x3d0], xmm0
movdqa xmm1, xmmword [0x14019e8a0]
movdqa xmmword [rbp + 0x3e0], xmm1
movdqa xmm0, xmmword [0x14019e810]
movdqa xmmword [rbp + 0x3f0], xmm0
movdqa xmm1, xmmword [0x14019e7d0]
movdqa xmmword [rbp + 0x400], xmm1
movdqa xmm0, xmmword [0x14019e760]
movdqa xmmword [rbp + 0x410], xmm0
movdqa xmm1, xmmword [0x14019e780]
movdqa xmmword [rbp + 0x420], xmm1
movdqa xmm0, xmmword [0x14019e790]
movdqa xmmword [rbp + 0x430], xmm0
movdqa xmm1, xmmword [0x14019e750]
movdqa xmmword [rbp + 0x440], xmm1
movdqa xmm0, xmmword [str._9_n__q_1u26M]
movdqa xmmword [rbp + 0x450], xmm0
movdqa xmm1, xmmword [str.184_:q_.]
movdqa xmmword [rbp + 0x460], xmm1
movdqa xmm0, xmmword [0x14019e730]
movdqa xmmword [rbp + 0x470], xmm0
movdqa xmm1, xmmword [0x14019ea90]
movdqa xmmword [rbp + 0x480], xmm1
movdqa xmm0, xmmword [0x14019ea50]
movdqa xmmword [rbp + 0x490], xmm0
movdqa xmm1, xmmword [0x14019e9d0]
movdqa xmmword [rbp + 0x4a0], xmm1
movdqa xmm0, xmmword [0x14019ea10]
movdqa xmmword [rbp + 0x4b0], xmm0
movdqa xmm1, xmmword [0x14019e910]
movdqa xmmword [rbp + 0x4c0], xmm1
movdqa xmm0, xmmword [0x14019e9b0]
movdqa xmmword [rbp + 0x4d0], xmm0
mov dword [rbp + 0x4e0], 0xa5b7aeba
mov word [rbp + 0x4e4], 0xf3
mov byte [rbp + 0x4e6], 1
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx - 0x57]
xor byte [rbp + rcx + 0x3b0], al
inc rcx
cmp rcx, 0x135
jb 0x1400f0cd0
mov byte [rbp + 0x4e6], 0
mov r9d, reloc.WS2_32.dll_recv
xor r8d, r8d
lea rdx, [rbp + 0x3b0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x1400f0d46
lea r8, [rbp + 0x8a0]
cmp rdi, 0xf
cmova r8, rbx
mov word [rbp - 0x75], WSASetLastError
mov word [rbp - 0x78], 0x706f
mov byte [rbp - 0x76], 0x65
mov byte [rbp - 0x73], 0
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea rdx, [rbp - 0x78]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400f0dd4
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400f0dd4
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r11 + r9*4]
mov r8d, dword [rdx + r10]
add r8, r10
mov edx, 0xfda91c9b
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x1400f0dcf
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x1400f0db0
cmp edx, 0xb2927e6b
je 0x1400f0dd9
test r9d, r9d
jne 0x1400f0d90
mov rax, qword [rax]
jmp 0x1400f0d60
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
xor ecx, ecx
call rax
nop
lea rcx, [rbp + 0x8a0]
call fcn.140004f48
jmp 0x1400f0eb8
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400f0e94
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400f0e94
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r11 + r9*4]
mov r8d, dword [rdx + r10]
add r8, r10
mov edx, 0x6e9f4122
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x1400f0e8f
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x1400f0e70
cmp edx, 0x79a1c67a
je 0x1400f0e99
test r9d, r9d
jne 0x1400f0e50
mov rax, qword [rax]
jmp 0x1400f0e20
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
mov ecx, 9
call rax
nop
lea rcx, [rbp + 0x9d0]
call fcn.140004f48
nop
movzx edx, byte [rbp + 0x7b0]
lea rcx, [rbp + 0x7b8]
call fcn.140022b7c
jmp 0x1400f0f8a
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400f0f66
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400f0f66
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r11 + r9*4]
mov ecx, dword [rdx + r10]
add rcx, r10
mov r8d, 0x6fbd57c9
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1400f0f61
nop
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x1400f0f40
cmp r8d, 0x1fa937a9
je 0x1400f0f6b
test r9d, r9d
jne 0x1400f0f20
mov rax, qword [rax]
jmp 0x1400f0ef0
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
mov ecx, 7
call rax
nop
mov rdx, qword [rbp + 0x818]
cmp rdx, 0xf
jbe 0x1400f0fce
inc rdx
mov rcx, qword [rbp + 0x800]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400f0fc9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400f0fc9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140179794
mov qword [rbp + 0x810], r12
mov qword [rbp + 0x818], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x800], 0
mov rdx, qword [rbp + 0x7d8]
cmp rdx, 0xf
jbe 0x1400f102b
inc rdx
mov rcx, qword [rbp + 0x7c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400f1026
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400f1026
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140179794
mov qword [rbp + 0x7d0], r12
mov qword [rbp + 0x7d8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x7c0], 0
mov rdx, qword [rbp + 0x848]
cmp rdx, 0xf
jbe 0x1400f1088
inc rdx
mov rcx, qword [rbp + 0x830]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400f1083
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400f1083
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140179794
mov qword [rbp + 0x840], r12
mov qword [rbp + 0x848], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x830], 0
mov rdx, qword [rbp + 0x898]
cmp rdx, 0xf
jbe 0x1400f10e5
inc rdx
mov rcx, qword [rbp + 0x880]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400f10e0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400f10e0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140179794
mov rcx, qword [rbp + 0xa70]
xor rcx, rsp
call fcn.1401794f0
lea r11, [rsp + 0xb90]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
movdqa xmm0, xmmword [0x14019e6f0]
movdqu xmmword [rbp + 0x230], xmm0
mov byte [rbp + 0x240], 1
lea rdx, [rbp + 0x6e8]
lea rcx, [rbp + 0x230]
call fcn.1400e98d0
nop
lea rdx, [rbp + 0x6e8]
lea rcx, [rbp + 0x690]
call fcn.140001f3c
lea rdx, [0x1401e0cf8]
lea rcx, [rbp + 0x690]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
call fcn.140001e58
int3
call fcn.140001ef8
int3