Function at 0x14009b670
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Create process on windows
Create thread
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xab8]
sub rsp, 0xb90
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x140365f00]
xor rax, rsp
mov qword [rbp + 0xa70], rax
mov r15, rcx
mov qword [rbp + 0xd0], rcx
xor r12d, r12d
mov dword [rsp + 0x40], r12d
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
xor r9d, r9d
lea r8, [0x1400a50f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [rbp + 0x880]
call fcn.14009a5c0
nop
lea rdx, [rbp + 0x880]
cmp qword [rbp + 0x898], 0xf
cmova rdx, qword [rbp + 0x880]
mov r8, qword [rbp + 0x890]
lea rcx, [section..data]
call fcn.14000dae0
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
xor r9d, r9d
lea r8, [0x1400a1f00]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp qword [r15 + 0x30], 0xa
je 0x14009b8f6
movdqa xmm0, xmmword [0x1401390f0]
movdqa xmmword [rbp + 0x80], xmm0
movdqa xmm1, xmmword [0x140139010]
movdqa xmmword [rbp + 0x90], xmm1
movdqa xmm0, xmmword [0x140138f60]
movdqa xmmword [rbp + 0xa0], xmm0
movdqa xmm1, xmmword [0x1401391c0]
movdqa xmmword [rbp + 0xb0], xmm1
mov dword [rbp + 0xc0], 0xf2bee1e7
mov dword [rbp + 0xc4], 0x100e3e2
mov ecx, r12d
lea eax, [rcx + 0x4e]
xor byte [rbp + rcx + 0x80], al
lea eax, [rcx + 0x4f]
xor byte [rbp + rcx + 0x81], al
lea eax, [rcx + 0x50]
xor byte [rbp + rcx + 0x82], al
lea eax, [rcx + 0x51]
xor byte [rbp + rcx + 0x83], al
lea eax, [rcx + 0x52]
xor byte [rbp + rcx + 0x84], al
lea eax, [rcx + 0x53]
xor byte [rbp + rcx + 0x85], al
lea eax, [rcx + 0x54]
xor byte [rbp + rcx + 0x86], al
lea eax, [rcx + 0x55]
xor byte [rbp + rcx + 0x87], al
lea eax, [rcx + 0x56]
xor byte [rbp + rcx + 0x88], al
lea eax, [rcx + 0x57]
xor byte [rbp + rcx + 0x89], al
lea eax, [rcx + 0x58]
xor byte [rbp + rcx + 0x8a], al
lea eax, [rcx + 0x59]
xor byte [rbp + rcx + 0x8b], al
lea eax, [rcx + 0x5a]
xor byte [rbp + rcx + 0x8c], al
lea eax, [rcx + 0x5b]
xor byte [rbp + rcx + 0x8d], al
add rcx, 0xe
cmp rcx, 0x46
jb 0x14009b792
mov byte [rbp + 0xc7], 0
mov r9d, reloc.WS2_32.dll_recv
xor r8d, r8d
lea rdx, [rbp + 0x80]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14009b8d6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14009b8d6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0xb7d2d2e3
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14009b8d1
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14009b8b0
cmp r8d, 0xda5b5c13
je 0x14009b8db
test r9d, r9d
jne 0x14009b890
mov rax, qword [rax]
jmp 0x14009b860
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
xor ecx, ecx
call rdx
lea rcx, [rbp + 0x830]
call fcn.140094630
nop
call fcn.1400a9a10
mov qword [rbp + 0xd8], rax
mov dword [rbp + 0x40], 0x3f272068
mov dword [rbp + 0x44], 0x313d2137
mov word [rbp + 0x48], WSAGetLastError
mov byte [rbp + 0x4a], 1
mov rdx, r15
cmp qword [r15 + 0x18], 0xf
jbe 0x14009b934
mov rdx, qword [r15]
xor r8d, r8d
mov rcx, rax
call fcn.1400a8410
mov rbx, rax
mov dword [rbp - 0x60], 0x3c312168
mov dword [rbp - 0x5c], 0x1006e37
mov dword [rbp - 0x68], 0x22312768
mov dword [rbp - 0x64], 0x1006e3a
mov dword [rbp - 0x70], 0x23353968
mov word [rbp - 0x6c], reloc.WS2_32.dll_WSAGetLastError
mov byte [rbp - 0x6a], 1
mov dword [rbp + 0x30], 0x3420363a
mov dword [rbp + 0x34], 0x3c3a3a6f
mov word [rbp + 0x38], 0x22
mov byte [rbp + 0x3a], 1
lea r8, [rbp - 0x70]
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x268]
call fcn.140089240
nop
lea rdx, [r15 + 0x40]
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x14009b9ae
mov rdx, qword [rdx]
mov rcx, rax
call fcn.140003620
xorps xmm0, xmm0
movups xmmword [rbp + 0x110], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x120], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x110], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x120], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rbp - 0x68]
lea rdx, [rbp + 0x110]
lea rcx, [rbp + 0x248]
call fcn.140089060
nop
lea rdx, [rbp + 0x830]
cmp qword [rbp + 0x848], 0xf
cmova rdx, qword [rbp + 0x830]
mov r8, qword [rbp + 0x840]
mov rcx, rax
call fcn.140003620
xorps xmm0, xmm0
movups xmmword [rbp + 0x130], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x140], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x130], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x140], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rbp - 0x60]
lea rdx, [rbp + 0x130]
lea rcx, [rbp + 0x2c0]
call fcn.140089060
nop
mov r14, 0xffffffffffffffff
mov r8, r14
nop dword [rax + rax]
inc r8
cmp byte [rbx + r8], 0
jne 0x14009ba90
mov rdx, rbx
mov rcx, rax
call fcn.140003620
xorps xmm0, xmm0
movups xmmword [rbp + 0x150], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x160], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x150], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x160], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rbp + 0x40]
lea rdx, [rbp + 0x150]
lea rcx, [rbp + 0x2e0]
call fcn.140089390
nop
lea rdx, [r15 + 0x20]
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x14009bb08
mov rdx, qword [rdx]
mov rcx, rax
call fcn.140003620
xorps xmm0, xmm0
movups xmmword [rbp + 0x7c0], xmm0
mov qword [rbp + 0x7d0], r12
mov qword [rbp + 0x7d8], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x7c0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x7d0], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov edi, 0x3c
mov dword [rsp + 0x40], edi
mov rdx, qword [rbp + 0x2f8]
cmp rdx, 0xf
jbe 0x14009bb99
inc rdx
mov rcx, qword [rbp + 0x2e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009bb94
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14009bb94
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140130784
movdqa xmm6, xmmword [0x14034bf10]
movdqu xmmword [rbp + 0x2f0], xmm6
mov byte [rbp + 0x2e0], 0
mov rdx, qword [rbp + 0x168]
cmp rdx, 0xf
jbe 0x14009bbf4
inc rdx
mov rcx, qword [rbp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009bbef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14009bbef
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140130784
movdqu xmmword [rbp + 0x160], xmm6
mov byte [rbp + 0x150], 0
mov rdx, qword [rbp + 0x2d8]
cmp rdx, 0xf
jbe 0x14009bc47
inc rdx
mov rcx, qword [rbp + 0x2c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009bc42
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14009bc42
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140130784
movdqu xmmword [rbp + 0x2d0], xmm6
mov byte [rbp + 0x2c0], 0
mov rdx, qword [rbp + 0x148]
cmp rdx, 0xf
jbe 0x14009bc9a
inc rdx
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009bc95
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14009bc95
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140130784
movdqu xmmword [rbp + 0x140], xmm6
mov byte [rbp + 0x130], 0
mov rdx, qword [rbp + 0x260]
cmp rdx, 0xf
jbe 0x14009bced
inc rdx
mov rcx, qword [rbp + 0x248]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009bce8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14009bce8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140130784
movdqu xmmword [rbp + 0x258], xmm6
mov byte [rbp + 0x248], 0
mov rdx, qword [rbp + 0x128]
cmp rdx, 0xf
jbe 0x14009bd40
inc rdx
mov rcx, qword [rbp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009bd3b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14009bd3b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140130784
movdqu xmmword [rbp + 0x120], xmm6
mov byte [rbp + 0x110], 0
mov rdx, qword [rbp + 0x280]
cmp rdx, 0xf
jbe 0x14009bd90
inc rdx
mov rcx, qword [rbp + 0x268]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009bd8b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009d7c2
call fcn.140130784
movdqu xmmword [rbp + 0x278], xmm6
mov byte [rbp + 0x268], 0
lea rbx, [r15 + 0x80]
mov rax, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x14009bdb4
mov rbx, qword [rbx]
cmp rax, 5
jb 0x14009bf3a
lea rsi, [rbx + rax]
lea r8, [rsi - 4]
sub r8, rbx
mov edx, 0x68
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x14009bf3a
nop
cmp dword [rax], 0x70747468
jne 0x14009bdee
cmp byte [rax + 4], 0x73
je 0x14009be0f
inc rax
lea r8, [rsi - 4]
sub r8, rax
mov edx, 0x68
mov rcx, rax
call sub.VCRUNTIME140.dll_memchr
test rax, rax
jne 0x14009bde0
jmp 0x14009bf3a
sub rax, rbx
cmp rax, 0xffffffffffffffff
je 0x14009bf3a
movdqa xmm0, xmmword [0x140139000]
movdqa xmmword [rbp + 0x360], xmm0
movdqa xmm1, xmmword [0x140138fa0]
movdqa xmmword [rbp + 0x370], xmm1
movdqa xmm0, xmmword [0x140138f20]
movdqa xmmword [rbp + 0x380], xmm0
movdqa xmm1, xmmword [0x140138e90]
movdqa xmmword [rbp + 0x390], xmm1
mov byte [rbp + 0x3a0], 1
lea rcx, [rbp + 0x360]
call fcn.140097840
mov r9d, reloc.WS2_32.dll_recv
xor r8d, r8d
lea rdx, [rbp + 0x360]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14009bf16
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14009bf16
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x820edb6f
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14009bf11
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14009bef0
cmp r8d, 0x123723ef
je 0x14009bf1b
test r9d, r9d
jne 0x14009bed0
mov rax, qword [rax]
jmp 0x14009bea0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
xor ecx, ecx
call rdx
mov edi, dword [rsp + 0x40]
lea rcx, [r15 + 0x80]
mov r8, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 0xf
jbe 0x14009bf4f
mov rcx, qword [rcx]
test r8, r8
jne 0x14009bf72
lea rdx, [0x140156098]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14009bf72
cmp qword [r15 + 0x90], 0
je 0x14009c7d7
lea rdx, [r15 + 0x80]
xor r8d, r8d
lea rcx, [rbp + 0x590]
call fcn.14002ca90
nop
lea rcx, [rbp + 0x590]
call fcn.140021640
movzx ebx, al
lea rcx, [rbp + 0x590]
call fcn.140020d10
test bl, bl
jne 0x14009c0c4
movdqa xmm0, xmmword [0x140139130]
movdqu xmmword [rbp + 0x288], xmm0
movdqa xmm1, xmmword [0x140138ed0]
movdqu xmmword [rbp + 0x298], xmm1
movdqa xmm0, xmmword [0x140138f40]
movdqu xmmword [rbp + 0x2a8], xmm0
mov word [rbp + 0x2b8], 0x50
mov byte [rbp + 0x2ba], 1
lea rcx, [rbp + 0x288]
call fcn.140097580
mov r9d, reloc.WS2_32.dll_recv
xor r8d, r8d
lea rdx, [rbp + 0x288]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14009c0a4
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14009c0a4
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r11 + r9*4]
mov r8d, dword [rdx + r10]
add r8, r10
mov edx, 0x266ae06a
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x14009c09f
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x14009c080
cmp edx, 0x5aaf1be2
je 0x14009c0a9
test r9d, r9d
jne 0x14009c060
mov rax, qword [rax]
jmp 0x14009c030
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
xor ecx, ecx
call rax
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp + 0x8c0]
call sub.VCRUNTIME140.dll_memset
lea rbx, [r15 + 0x80]
cmp qword [rbx + 0x18], 0xf
jbe 0x14009c0e9
mov rbx, qword [rbx]
lea rax, [0x140157da0]
mov qword [rbp + 0x8c0], rax
lea rcx, [rbp + 0x970]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rsp + 0x40], 0x13c
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x8d0]
lea rcx, [rbp + 0x8c0]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rbp + 0x8c0]
movsxd rcx, dword [rax + 4]
lea rdi, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x8c0], rdi
mov rax, qword [rbp + 0x8c0]
movsxd rcx, dword [rax + 4]
lea r8d, [rcx - 0xb0]
mov dword [rbp + rcx + 0x8bc], r8d
lea rcx, [rbp + 0x8d0]
call fcn.14002c950
nop
mov r9d, 0x40
mov r8d, 1
mov rdx, rbx
lea rcx, [rbp + 0x8d0]
call fcn.14002c810
test rax, rax
jne 0x14009c1ad
mov rax, qword [rbp + 0x8c0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x8c0]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
mov rax, qword [rbp + 0x8c0]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x8c0], rdi
mov rax, qword [rbp + 0x8c0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x8bc], edx
xorps xmm0, xmm0
movups xmmword [rbp + 0x7e0], xmm0
mov qword [rbp + 0x7f0], r12
mov qword [rbp + 0x7f8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x7e0], 0
movups xmmword [rbp + 0x860], xmm0
movdqu xmmword [rbp + 0x870], xmm6
mov byte [rbp + 0x860], 0
mov rax, qword [rbp + 0x8c0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x8c0]
add rcx, rax
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
movzx r8d, al
lea rdx, [rbp + 0x7e0]
lea rcx, [rbp + 0x8c0]
call fcn.14008c510
movdqa xmm0, xmmword [0x140139120]
movdqu xmmword [rbp + 0x320], xmm0
movdqa xmm1, xmmword [0x140139030]
movdqu xmmword [rbp + 0x330], xmm1
movdqa xmm0, xmmword [0x140139070]
movdqu xmmword [rbp + 0x340], xmm0
mov word [rbp + 0x350], 0x100
lea r8, [r15 + 0x80]
mov rcx, qword [r8 + 0x10]
movabs r13, 0x7fffffffffffffff
mov rax, r13
sub rax, rcx
cmp rax, 0x14
jb 0x14009d972
mov rax, r8
cmp qword [r8 + 0x18], 0xf
jbe 0x14009c2b0
mov rax, qword [r8]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], reloc.WS2_32.dll_sendto
lea r9, str.certutil__hashfile__
movzx edx, byte [rbp + 0x7a8]
lea rcx, [rbp + 0x5b0]
call fcn.140084f40
nop
lea r8, [rbp + 0x320]
lea rdx, [rbp + 0x5b0]
lea rcx, [rbp + 0x708]
call fcn.140089490
nop
cmp qword [rax + 0x18], 0xf
jbe 0x14009c303
mov rax, qword [rax]
xorps xmm0, xmm0
movups xmmword [rbp + 0x210], xmm0
movdqu xmmword [rbp + 0x220], xmm6
mov byte [rbp + 0x210], 0
mov dword [rsp + 0x40], 0x73c
movups xmmword [rbp + 0x820], xmm0
lea rdx, [0x1401387f0]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__popen]
mov rcx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__pclose]
mov qword [rbp + 0x820], rcx
mov qword [rbp + 0x828], rax
test rax, rax
je 0x14009d91a
mov r8, rax
mov edx, 0x80
lea rcx, [rbp + 0x9f0]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgets]
test rax, rax
je 0x14009c3bb
lea rax, [rbp + 0x9f0]
mov r8, r14
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14009c380
lea rdx, [rbp + 0x9f0]
lea rcx, [rbp + 0x210]
call fcn.14000dae0
mov r8, qword [rbp + 0x828]
mov edx, 0x80
lea rcx, [rbp + 0x9f0]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgets]
test rax, rax
jne 0x14009c373
mov rcx, qword [rbp + 0x828]
test rcx, rcx
je 0x14009c3ce
call qword [rbp + 0x820]
nop
lea rdx, [rbp + 0x210]
lea rcx, [rbp + 0x860]
call fcn.14002c4a0
nop
lea rcx, [rbp + 0x210]
call fcn.140003410
nop
lea rcx, [rbp + 0x708]
call fcn.140003410
nop
lea rcx, [rbp + 0x5b0]
call fcn.140003410
mov dword [rsp + 0x7c], 0x3d6e65
mov dword [rsp + 0x78], 0x6b6f7426
mov byte [rbp - 0x80], 0
lea rax, [rsp + 0x78]
mov rbx, r14
inc rbx
cmp byte [rax + rbx], 0
jne 0x14009c424
mov r15, qword [rbp + 0x7f0]
mov rax, r13
sub rax, r15
cmp rax, rbx
jb 0x14009d972
lea r12, [rbp + 0x7e0]
cmp qword [rbp + 0x7f8], 0xf
cmova r12, qword [rbp + 0x7e0]
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xf0], xmm1
lea r14, [r15 + rbx]
mov edi, reloc.WS2_32.dll_ntohs
lea rsi, [rbp + 0xe0]
cmp r14, rdi
jbe 0x14009c500
mov rdi, r14
or rdi, 0xf
cmp rdi, r13
jbe 0x14009c4c0
mov rdi, r13
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140130500
test rax, rax
je 0x14009c6f9
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x14009c4f9
mov eax, socket
cmp rdi, rax
cmovb rdi, rax
lea rcx, [rdi + 1]
test rcx, rcx
jne 0x14009c4d9
xor esi, esi
jmp 0x14009c4f9
cmp rcx, 0x1000
jb 0x14009c4f1
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14009d96c
jmp 0x14009c4a1
call fcn.140130500
mov rsi, rax
mov qword [rbp + 0xe0], rsi
mov qword [rbp + 0xf0], r14
mov qword [rbp + 0xf8], rdi
mov r8, rbx
lea rdx, [rsp + 0x78]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rsi + rbx]
mov r8, r15
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + r14], 0
mov rdi, qword [rbp + 0xf0]
lea r9, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 0xf
cmova r9, qword [rbp + 0xe0]
mov rcx, qword [rbp + 0x7d0]
mov rdx, qword [rbp + 0x7d8]
mov rax, rdx
sub rax, rcx
cmp rdi, rax
ja 0x14009c59e
lea rax, [rcx + rdi]
mov qword [rbp + 0x7d0], rax
lea rbx, [rbp + 0x7c0]
cmp rdx, 0xf
cmova rbx, qword [rbp + 0x7c0]
add rbx, rcx
mov r8, rdi
mov rdx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rdi], 0
jmp 0x14009c5b6
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rdx, rdi
lea rcx, [rbp + 0x7c0]
call fcn.140004690
nop
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0xf
jbe 0x14009c5f7
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009c5f2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009c6f9
call fcn.140130784
movdqu xmmword [rbp + 0xf0], xmm6
mov byte [rbp + 0xe0], 0
mov dword [rsp + 0x5c], 0x3d6873
mov dword [rsp + 0x58], 0x61687426
mov byte [rsp + 0x60], 0
mov r15, qword [rbp + 0xd0]
lea r8, [r15 + 0x80]
lea rcx, [rsp + 0x58]
mov r14, 0xffffffffffffffff
mov rax, r14
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x14009c640
mov rdx, qword [r8 + 0x10]
sub r13, rdx
cmp r13, rax
jb 0x14009d972
mov rcx, r8
cmp qword [r8 + 0x18], 0xf
jbe 0x14009c666
mov rcx, qword [r8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
movzx edx, byte [rbp + 0x7a8]
lea rcx, [rbp + 0x170]
call fcn.140084f40
mov edi, 0x3fc
mov dword [rsp + 0x40], edi
lea rdx, [rbp + 0x170]
cmp qword [rbp + 0x188], 0xf
cmova rdx, qword [rbp + 0x170]
mov r8, qword [rbp + 0x180]
lea rcx, [rbp + 0x7c0]
call fcn.140003620
nop
mov rdx, qword [rbp + 0x188]
cmp rdx, 0xf
jbe 0x14009c705
inc rdx
mov rcx, qword [rbp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009c700
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14009c700
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140130784
movdqu xmmword [rbp + 0x180], xmm6
mov byte [rbp + 0x170], 0
mov r8, qword [rbp + 0x878]
cmp r8, 0xf
jbe 0x14009c734
mov rdx, qword [rbp + 0x860]
lea rcx, [rbp + 0x860]
call fcn.140003e40
movdqu xmmword [rbp + 0x870], xmm6
mov byte [rbp + 0x860], 0
mov r8, qword [rbp + 0x7f8]
cmp r8, 0xf
jbe 0x14009c763
mov rdx, qword [rbp + 0x7e0]
lea rcx, [rbp + 0x7e0]
call fcn.140003e40
xor r12d, r12d
mov qword [rbp + 0x7f0], r12
mov qword [rbp + 0x7f8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x7e0], r12b
mov rax, qword [rbp + 0x8c0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x8c0], rax
mov rax, qword [rbp + 0x8c0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x8bc], edx
lea rcx, [rbp + 0x8d0]
call fcn.14002c120
lea rcx, [rbp + 0x8d8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x970]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
mov rcx, qword [rbp + 0xd8]
call fcn.1400a99e0
lea rax, [rbp + 0x728]
mov qword [rbp + 0xd8], rax
lea rdx, [r15 + 0x60]
lea rcx, [rbp + 0x728]
call fcn.14000cc10
mov rbx, rax
lea rdx, [rbp + 0x7c0]
lea rcx, [rbp + 0x748]
call fcn.14000cc10
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x800]
call fcn.1400a49f0
nop
mov dword [rbp - 0x4c], 0x64696c
mov dword [rbp - 0x58], 0x4179654b
mov dword [rbp - 0x54], 0x5f687475
mov dword [rbp - 0x50], 0x61766e49
mov byte [rbp - 0x48], 0
lea rcx, [rbp - 0x58]
mov rax, r14
inc rax
cmp byte [rcx + rax], 0
jne 0x14009c852
lea rcx, [rbp + 0x800]
mov rbx, qword [rbp + 0x800]
mov rsi, qword [rbp + 0x818]
cmp rsi, 0xf
cmova rcx, rbx
mov r8, qword [rbp + 0x810]
cmp r8, rax
jne 0x14009c9e6
lea rdx, [rbp - 0x58]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14009c9e6
movdqa xmm0, xmmword [0x140139100]
movdqa xmmword [rbp + 0x1a0], xmm0
movdqa xmm1, xmmword [0x140138ea0]
movdqa xmmword [rbp + 0x1b0], xmm1
movdqa xmm0, xmmword [0x140138f90]
movdqa xmmword [rbp + 0x1c0], xmm0
movdqa xmm1, xmmword [0x1401391d0]
movdqa xmmword [rbp + 0x1d0], xmm1
mov dword [rbp + 0x1e0], 0xbeebfc
mov byte [rbp + 0x1e4], 1
mov rcx, r12
nop dword [rax]
lea eax, [rcx + 0x4e]
xor byte [rbp + rcx + 0x1a0], al
inc rcx
cmp rcx, 0x43
jb 0x14009c8f0
mov byte [rbp + 0x1e4], 0
mov r9d, reloc.WS2_32.dll_recv
xor r8d, r8d
lea rdx, [rbp + 0x1a0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14009c9b4
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14009c9b4
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r11 + r9*4]
mov r8d, dword [rdx + r10]
add r8, r10
mov edx, 0xb74b477f
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x14009c9af
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x14009c990
cmp edx, 0xd60f9bff
je 0x14009c9b9
test r9d, r9d
jne 0x14009c970
mov rax, qword [rax]
jmp 0x14009c940
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
xor ecx, ecx
call rax
mov rsi, qword [rbp + 0x818]
mov rbx, qword [rbp + 0x800]
mov edi, dword [rsp + 0x40]
lea rax, [rbp + 0x1f0]
mov qword [rbp + 0xd8], rax
lea rdx, [rbp + 0x800]
cmp rsi, 0xf
cmova rdx, rbx
xorps xmm0, xmm0
movups xmmword [rbp + 0x1f0], xmm0
mov qword [rbp + 0x200], r12
mov qword [rbp + 0x208], r12
nop dword [rax + rax]
inc r14
cmp byte [rdx + r14], 0
jne 0x14009ca20
mov r8, r14
lea rcx, [rbp + 0x1f0]
call fcn.1400042a0
nop
lea rax, [rbp + 0x6a8]
mov qword [rbp + 0xd0], rax
lea rdx, [0x140365040]
lea rcx, [rbp + 0x6a8]
call fcn.14000cc10
mov rbx, rax
lea rdx, [0x140365020]
lea rcx, [rbp + 0x6c8]
call fcn.14000cc10
nop
lea r8, [rbp + 0x1f0]
mov rdx, rbx
mov rcx, rax
call fcn.140091920
xor eax, 0xa5a5
mov edx, eax
shr eax, 8
movzx r8d, al
movzx eax, dl
movabs r14, 0xcbf29ce484222325
xor rax, r14
movabs rsi, 0x100000001b3
imul rax, rsi
xor r8, rax
imul r8, rsi
mov eax, edx
shr eax, 0x10
movzx ecx, al
xor r8, rcx
imul r8, rsi
shr rdx, 0x18
xor r8, rdx
imul r8, rsi
cmp r8w, 0xdf7f
jne 0x14009d6dd
mov qword [rbp + 0x7a0], r12
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x768]
lea rdx, [rbp + 0x800]
lea rcx, [rbp + 0x7b0]
call fcn.14008d950
nop
lea rdx, [r15 + 0x20]
lea rcx, [rbp + 0x190]
call fcn.140088820
nop
mov dword [rbp - 0x20], 0x343e3821
mov dword [rbp - 0x1c], 0x303a20
mov byte [rbp - 0x18], 1
lea rdx, [rbp + 0x5d0]
lea rcx, [rbp - 0x20]
call fcn.140091260
nop
movzx ecx, byte [rbp + 0x7b0]
test cl, cl
jne 0x14009cb62
mov byte [rbp + 0x7b0], 1
call fcn.14008bdd0
mov qword [rbp + 0x7b8], rax
movzx ecx, byte [rbp + 0x7b0]
jmp 0x14009cb69
mov rax, qword [rbp + 0x7b8]
cmp cl, 1
jne 0x14009cb7f
lea rdx, [rbp + 0x5d0]
mov rcx, rax
call fcn.140091170
jmp 0x14009cb84
mov rax, qword [rsp + 0x48]
lea rdx, [rbp + 0x190]
mov rcx, rax
call fcn.140090da0
movzx ebx, al
lea rcx, [rbp + 0x5d0]
call fcn.140003410
nop
movzx edx, byte [rbp + 0x190]
lea rcx, [rbp + 0x198]
call fcn.140097a60
test bl, bl
jne 0x14009cc6b
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14009cc44
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14009cc44
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r11 + r9*4]
mov r8d, dword [rdx + r10]
add r8, r10
mov edx, 0xd7cf1f1e
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x14009cc3f
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x14009cc20
cmp edx, 0x5ff277a6
je 0x14009cc49
test r9d, r9d
jne 0x14009cc00
mov rax, qword [rax]
jmp 0x14009cbd0
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
mov ecx, 8
call rax
mov edi, dword [rsp + 0x40]
mov dword [rsp + 0x6c], 0x656761
mov dword [rsp + 0x68], 0x7373656d
mov byte [rsp + 0x70], 0
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x6f]
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x5f0]
call fcn.140004e40
or edi, 0x1800
movzx ecx, byte [rbp + 0x7b0]
test cl, cl
jne 0x14009ccc8
mov byte [rbp + 0x7b0], 1
call fcn.14008bdd0
mov qword [rbp + 0x7b8], rax
movzx ecx, byte [rbp + 0x7b0]
jmp 0x14009cccf
mov rax, qword [rbp + 0x7b8]
cmp cl, 1
jne 0x14009cce5
lea rdx, [rbp + 0x5f0]
mov rcx, rax
call fcn.140091170
jmp 0x14009ccea
mov rax, qword [rsp + 0x48]
lea rdx, [rbp + 0x9d0]
mov rcx, rax
call fcn.140088e30
nop
lea rcx, [rbp + 0x5f0]
call fcn.140003410
lea rdx, [rbp + 0x7b0]
lea rcx, [rbp + 0x310]
call fcn.14008ff40
mov rdx, rax
mov rcx, r15
call fcn.14009f990
mov word [rsp + 0x53], 0x65
mov word [rsp + 0x50], 0x6f63
mov byte [rsp + 0x52], 0x64
mov byte [rsp + 0x55], 0
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x54]
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x610]
call fcn.140004e40
or edi, 0x6000
movzx ecx, byte [rbp + 0x7b0]
test cl, cl
jne 0x14009cd84
mov byte [rbp + 0x7b0], 1
call fcn.14008bdd0
mov qword [rbp + 0x7b8], rax
movzx ecx, byte [rbp + 0x7b0]
jmp 0x14009cd8b
mov rax, qword [rbp + 0x7b8]
cmp cl, 1
jne 0x14009cda1
lea rdx, [rbp + 0x610]
mov rcx, rax
call fcn.140091170
jmp 0x14009cda6
mov rax, qword [rsp + 0x48]
mov rcx, rax
call fcn.140088dc0
mov edx, eax
shr eax, 8
movzx ebx, al
movzx eax, dl
xor rax, r14
imul rax, rsi
xor rbx, rax
imul rbx, rsi
mov eax, edx
shr eax, 0x10
movzx ecx, al
xor rbx, rcx
imul rbx, rsi
shr rdx, 0x18
xor rbx, rdx
imul rbx, rsi
lea rcx, [rbp + 0x610]
call fcn.140003410
mov dword [rbp - 0x10], 0x32333a3d
mov dword [rbp - 0xc], 0x272037
mov byte [rbp - 8], 1
lea rdx, [rbp + 0x650]
lea rcx, [rbp - 0x10]
call fcn.140091260
nop
or edi, 1
mov dword [rsp + 0x40], edi
movzx ecx, byte [rbp + 0x7b0]
test cl, cl
jne 0x14009ce3e
mov byte [rbp + 0x7b0], 1
call fcn.14008bdd0
mov qword [rbp + 0x7b8], rax
movzx ecx, byte [rbp + 0x7b0]
jmp 0x14009ce45
mov rax, qword [rbp + 0x7b8]
cmp cl, 1
jne 0x14009ce5e
lea rdx, [rbp + 0x650]
mov rcx, rax
call fcn.140091170
mov rcx, rax
jmp 0x14009ce63
mov rcx, qword [rsp + 0x48]
lea rax, [rcx + 8]
cmp byte [rcx], 4
cmovne rax, r12
cmp byte [rax], 0
je 0x14009cf0f
mov dword [rbp], 0x32333a3d
mov dword [rbp + 4], 0x272037
mov byte [rbp + 8], 1
lea rdx, [rbp + 0x630]
lea rcx, [rbp]
call fcn.140091260
nop
or edi, 2
mov dword [rsp + 0x40], edi
movzx eax, byte [rbp + 0x7b0]
test al, al
jne 0x14009cecb
mov byte [rbp + 0x7b0], 1
call fcn.14008bdd0
mov rcx, rax
mov qword [rbp + 0x7b8], rax
movzx eax, byte [rbp + 0x7b0]
jmp 0x14009ced2
mov rcx, qword [rbp + 0x7b8]
cmp al, 1
jne 0x14009cee7
lea rdx, [rbp + 0x630]
call fcn.140091170
mov rcx, rax
jmp 0x14009ceec
mov rcx, qword [rsp + 0x48]
lea rax, [rcx + 8]
cmp byte [rcx], 4
cmovne rax, r12
cmp byte [rax], 0
je 0x14009cf0b
movabs rax, 0xcbe5c873d26645f1
cmp rbx, rax
je 0x14009cf0f
xor bl, bl
jmp 0x14009cf11
mov bl, 1
test dil, 2
je 0x14009cf27
and edi, 0xfffffffd
lea rcx, [rbp + 0x630]
call fcn.140003410
nop
test dil, 1
je 0x14009cf39
lea rcx, [rbp + 0x650]
call fcn.140003410
test bl, bl
je 0x14009d606
mov dword [rbp + 0x10], 0x32333a3d
mov dword [rbp + 0x14], 0x272037
mov byte [rbp + 0x18], 1
lea rdx, [rbp + 0x670]
lea rcx, [rbp + 0x10]
call fcn.140091260
nop
movzx eax, byte [rbp + 0x7b0]
test al, al
jne 0x14009cf8e
mov byte [rbp + 0x7b0], 1
call fcn.14008bdd0
mov rcx, rax
mov qword [rbp + 0x7b8], rax
movzx eax, byte [rbp + 0x7b0]
jmp 0x14009cf95
mov rcx, qword [rbp + 0x7b8]
cmp al, 1
jne 0x14009cfaa
lea rdx, [rbp + 0x670]
call fcn.140091170
mov rcx, rax
jmp 0x14009cfaf
mov rcx, qword [rsp + 0x48]
lea rax, [rcx + 8]
cmp byte [rcx], 4
cmovne rax, r12
movzx ebx, byte [rax]
lea rcx, [rbp + 0x670]
call fcn.140003410
test bl, bl
je 0x14009d197
mov dword [rbp + 0x60], 0x2272a20
mov dword [rbp + 0x64], 0x3c272037
mov dword [rbp + 0x68], 0x1003939
lea rdx, [rbp + 0x510]
lea rcx, [rbp + 0x60]
call fcn.140091380
nop
movzx eax, byte [rbp + 0x7b0]
test al, al
jne 0x14009d021
mov byte [rbp + 0x7b0], 1
call fcn.14008bdd0
mov rcx, rax
mov qword [rbp + 0x7b8], rax
movzx eax, byte [rbp + 0x7b0]
jmp 0x14009d028
mov rcx, qword [rbp + 0x7b8]
cmp al, 1
jne 0x14009d03d
lea rdx, [rbp + 0x510]
call fcn.140091170
mov rcx, rax
jmp 0x14009d042
mov rcx, qword [rsp + 0x48]
lea rax, [rcx + 8]
cmp byte [rcx], 4
cmovne rax, r12
movzx ebx, byte [rax]
lea rcx, [rbp + 0x510]
call fcn.140003410
test bl, bl
je 0x14009d06b
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp + 0x50], 0x22232a3d
mov dword [rbp + 0x54], 0x3c3a3c3b
mov word [rbp + 0x58], 0x32
mov byte [rbp + 0x5a], 1
lea rdx, [rbp + 0x4f0]
lea rcx, [rbp + 0x50]
call fcn.140091300
nop
movzx eax, byte [rbp + 0x7b0]
test al, al
jne 0x14009d0be
mov byte [rbp + 0x7b0], 1
call fcn.14008bdd0
mov rcx, rax
mov qword [rbp + 0x7b8], rax
movzx eax, byte [rbp + 0x7b0]
jmp 0x14009d0c5
mov rcx, qword [rbp + 0x7b8]
cmp al, 1
jne 0x14009d0d7
lea rdx, [rbp + 0x4f0]
call fcn.140091170
jmp 0x14009d0dc
mov rax, qword [rsp + 0x48]
lea rcx, [r15 + 0x240]
mov rdx, rax
call fcn.140088a60
nop
lea rcx, [rbp + 0x4f0]
call fcn.140003410
mov byte [0x140375f48], 1
mov dword [rbp - 0x40], 0x38203f2f
mov dword [rbp - 0x3c], 0x3b353c
mov byte [rbp - 0x38], 1
lea rdx, [rbp + 0x570]
lea rcx, [rbp - 0x40]
call fcn.140091260
nop
movzx ecx, byte [rbp + 0x7b0]
test cl, cl
jne 0x14009d149
mov byte [rbp + 0x7b0], 1
call fcn.14008bdd0
mov qword [rbp + 0x7b8], rax
movzx ecx, byte [rbp + 0x7b0]
jmp 0x14009d150
mov rax, qword [rbp + 0x7b8]
cmp cl, 1
jne 0x14009d166
lea rdx, [rbp + 0x570]
mov rcx, rax
call fcn.140091170
jmp 0x14009d16b
mov rax, qword [rsp + 0x48]
mov rdx, rax
lea rcx, [rbp + 0x300]
call fcn.14008ff40
mov rdx, rax
mov rcx, r15
call fcn.14009f570
nop
lea rcx, [rbp + 0x570]
call fcn.140003410
jmp 0x14009d6b8
mov dword [rbp + 0x70], 0x30262127
mov dword [rbp + 0x74], 0x23303a3e
mov dword [rbp + 0x78], 0x1002533
xor eax, eax
mov qword [rbp + 0x108], rax
mov byte [rbp + 0x100], 3
xorps xmm0, xmm0
movups xmmword [rbp + 0x850], xmm0
mov edx, 1
lea rcx, [rbp + 0x7a8]
call fcn.140004d10
lea rcx, [rbp + 0x7a8]
mov qword [rbp + 0x850], rcx
mov qword [rbp + 0x858], rax
mov rdx, rax
lea rcx, [rbp + 0x70]
call fcn.140091380
mov rax, qword [rbp + 0x858]
mov qword [rbp + 0x858], r12
mov qword [rbp + 0x108], rax
mov dword [rbp - 0x30], 0x22232a23
mov dword [rbp - 0x2c], 0x313433
mov byte [rbp - 0x28], 1
lea rdx, [rbp + 0x550]
lea rcx, [rbp - 0x30]
call fcn.140091260
nop
movzx ecx, byte [rbp + 0x7b0]
test cl, cl
jne 0x14009d257
mov byte [rbp + 0x7b0], 1
call fcn.14008bdd0
mov qword [rbp + 0x7b8], rax
movzx ecx, byte [rbp + 0x7b0]
jmp 0x14009d25e
mov rax, qword [rbp + 0x7b8]
cmp cl, 1
jne 0x14009d274
lea rdx, [rbp + 0x550]
mov rcx, rax
call fcn.140091170
jmp 0x14009d279
mov rax, qword [rsp + 0x48]
lea rdx, [rbp + 0x100]
mov rcx, rax
call fcn.140090da0
movzx ebx, al
lea rcx, [rbp + 0x550]
call fcn.140003410
nop
movzx edx, byte [rbp + 0x100]
lea rcx, [rbp + 0x108]
call fcn.140097a60
test bl, bl
je 0x14009d6b8
mov dword [rbp + 0x20], 0x3f27202a
mov dword [rbp + 0x24], 0x31353c3e
mov word [rbp + 0x28], 0x100
lea rdx, [rbp + 0x530]
lea rcx, [rbp + 0x20]
call fcn.1400912b0
nop
movzx eax, byte [rbp + 0x7b0]
test al, al
jne 0x14009d302
mov byte [rbp + 0x7b0], 1
call fcn.14008bdd0
mov rcx, rax
mov qword [rbp + 0x7b8], rax
movzx eax, byte [rbp + 0x7b0]
jmp 0x14009d309
mov rcx, qword [rbp + 0x7b8]
cmp al, 1
jne 0x14009d31b
lea rdx, [rbp + 0x530]
call fcn.140091170
jmp 0x14009d320
mov rax, qword [rsp + 0x48]
lea rdx, [rbp + 0x8a0]
mov rcx, rax
call fcn.140088e30
nop
lea rcx, [rbp + 0x530]
call fcn.140003410
lea rcx, [rbp + 0x8a0]
mov rbx, qword [rbp + 0x8a0]
mov rdi, qword [rbp + 0x8b8]
cmp rdi, 0xf
cmova rcx, rbx
mov r8, qword [rbp + 0x8b0]
test r8, r8
jne 0x14009d507
lea rdx, [0x140156098]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14009d507
movdqa xmm0, xmmword [0x140138fd0]
movdqa xmmword [rbp + 0x3b0], xmm0
movdqa xmm1, xmmword [0x140138ec0]
movdqa xmmword [rbp + 0x3c0], xmm1
movdqa xmm0, xmmword [0x140139060]
movdqa xmmword [rbp + 0x3d0], xmm0
movdqa xmm1, xmmword [0x140139200]
movdqa xmmword [rbp + 0x3e0], xmm1
movdqa xmm0, xmmword [0x1401391f0]
movdqa xmmword [rbp + 0x3f0], xmm0
movdqa xmm1, xmmword [0x1401391b0]
movdqa xmmword [rbp + 0x400], xmm1
movdqa xmm0, xmmword [0x140139170]
movdqa xmmword [rbp + 0x410], xmm0
movdqa xmm1, xmmword [0x1401391a0]
movdqa xmmword [rbp + 0x420], xmm1
movdqa xmm0, xmmword [0x140139190]
movdqa xmmword [rbp + 0x430], xmm0
movdqa xmm1, xmmword [0x140139150]
movdqa xmmword [rbp + 0x440], xmm1
movdqa xmm0, xmmword [0x140139160]
movdqa xmmword [rbp + 0x450], xmm0
movdqa xmm1, xmmword [0x140139090]
movdqa xmmword [rbp + 0x460], xmm1
movdqa xmm0, xmmword [0x1401390d0]
movdqa xmmword [rbp + 0x470], xmm0
movdqa xmm1, xmmword [0x140139080]
movdqa xmmword [rbp + 0x480], xmm1
movdqa xmm0, xmmword [0x140139040]
movdqa xmmword [rbp + 0x490], xmm0
movdqa xmm1, xmmword [str.Z4_b7__f___]
movdqa xmmword [rbp + 0x4a0], xmm1
movdqa xmm0, xmmword [0x140138fe0]
movdqa xmmword [rbp + 0x4b0], xmm0
movdqa xmm1, xmmword [0x140138f10]
movdqa xmmword [rbp + 0x4c0], xmm1
movdqa xmm0, xmmword [0x140138f70]
movdqa xmmword [rbp + 0x4d0], xmm0
mov dword [rbp + 0x4e0], 0xf8ec0b1d
mov word [rbp + 0x4e4], 0xac
mov byte [rbp + 0x4e6], 1
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx + 0x4e]
xor byte [rbp + rcx + 0x3b0], al
inc rcx
cmp rcx, 0x135
jb 0x14009d4d0
mov byte [rbp + 0x4e6], 0
mov r9d, reloc.WS2_32.dll_recv
xor r8d, r8d
lea rdx, [rbp + 0x3b0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x14009d546
lea r8, [rbp + 0x8a0]
cmp rdi, 0xf
cmova r8, rbx
mov word [rbp - 0x75], WSAStartup
mov word [rbp - 0x78], 0x706f
mov byte [rbp - 0x76], 0x65
mov byte [rbp - 0x73], 0
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea rdx, [rbp - 0x78]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14009d5d4
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14009d5d4
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r10 + r9*4]
mov r8d, dword [rdx + r11]
add r8, r10
mov edx, 0x8c55f4cd
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x14009d5cf
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x14009d5b0
cmp edx, 0x14aaae2d
je 0x14009d5d9
test r9d, r9d
jne 0x14009d590
mov rax, qword [rax]
jmp 0x14009d560
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
xor ecx, ecx
call rax
nop
lea rcx, [rbp + 0x8a0]
call fcn.140003410
jmp 0x14009d6b8
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14009d694
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14009d694
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r10 + r9*4]
mov r8d, dword [rdx + r11]
add r8, r10
mov edx, 0x94c2c38
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x14009d68f
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x14009d670
cmp edx, 0x71ae1288
je 0x14009d699
test r9d, r9d
jne 0x14009d650
mov rax, qword [rax]
jmp 0x14009d620
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
mov ecx, 9
call rax
nop
lea rcx, [rbp + 0x9d0]
call fcn.140003410
nop
movzx edx, byte [rbp + 0x7b0]
lea rcx, [rbp + 0x7b8]
call fcn.140097a60
jmp 0x14009d78a
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14009d766
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14009d766
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r10 + r9*4]
mov ecx, dword [rdx + r11]
add rcx, r10
mov r8d, 0x7a4250bf
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14009d761
nop
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x14009d740
cmp r8d, 0x32f9293f
je 0x14009d76b
test r9d, r9d
jne 0x14009d720
mov rax, qword [rax]
jmp 0x14009d6f0
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
mov ecx, 7
call rax
nop
mov rdx, qword [rbp + 0x818]
cmp rdx, 0xf
jbe 0x14009d7ce
inc rdx
mov rcx, qword [rbp + 0x800]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009d7c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14009d7c9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140130784
mov qword [rbp + 0x810], r12
mov qword [rbp + 0x818], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x800], 0
mov rdx, qword [rbp + 0x7d8]
cmp rdx, 0xf
jbe 0x14009d82b
inc rdx
mov rcx, qword [rbp + 0x7c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009d826
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14009d826
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140130784
mov qword [rbp + 0x7d0], r12
mov qword [rbp + 0x7d8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x7c0], 0
mov rdx, qword [rbp + 0x848]
cmp rdx, 0xf
jbe 0x14009d888
inc rdx
mov rcx, qword [rbp + 0x830]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009d883
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14009d883
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140130784
mov qword [rbp + 0x840], r12
mov qword [rbp + 0x848], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x830], 0
mov rdx, qword [rbp + 0x898]
cmp rdx, 0xf
jbe 0x14009d8e5
inc rdx
mov rcx, qword [rbp + 0x880]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009d8e0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14009d8e0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140130784
mov rcx, qword [rbp + 0xa70]
xor rcx, rsp
call fcn.1401304e0
lea r11, [rsp + 0xb90]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
movdqa xmm0, xmmword [str.___4_u0615__]
movdqu xmmword [rbp + 0x230], xmm0
mov byte [rbp + 0x240], 1
lea rdx, [rbp + 0x6e8]
lea rcx, [rbp + 0x230]
call fcn.140091360
nop
lea rdx, [rbp + 0x6e8]
lea rcx, [rbp + 0x690]
call fcn.140020400
lea rdx, [0x140360b40]
lea rcx, [rbp + 0x690]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
call fcn.140001c00
int3
call fcn.140001ca0
int3