Function at 0x180064b30
Capabilities:
Contain obfuscated stackstrings
Create process on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x2c0]
sub rsp, 0x3c0
xor r12d, r12d
lea rcx, [rbp + 0xf8]
call fcn.1800640d0
nop
mov rdx, rax
lea rcx, [rbp + 0x118]
call fcn.180063b80
mov rdx, rax
lea rcx, [0x1804f1e58]
call fcn.180077e60
lea rcx, [rbp + 0x118]
call fcn.18004b360
nop
lea rcx, [rbp + 0xf8]
call fcn.18004b360
cmp qword [0x1804f1d80], 0xa
jne 0x1800656c6
cmp qword [0x1804f1da0], 0x40
jne 0x1800656c6
mov dword [rsp + 0x36], 0x3d7669
mov dword [rsp + 0x30], 0x696e6926
mov word [rsp + 0x34], 0x5f74
mov byte [rsp + 0x3a], r12b
lea rdx, [0x1804f1d70]
lea rcx, [rbp + 0x18]
call fcn.180063ee0
mov r15, rax
mov dword [rsp + 0x50], 0x3d6469
mov dword [rsp + 0x4a], 0x6e776f26
mov word [rsp + 0x4e], 0x7265
mov byte [rsp + 0x54], r12b
lea rdx, [0x1804f1d50]
lea rcx, [rbp - 0x38]
call fcn.180063ee0
mov r14, rax
mov word [rbp + 0x315], 0x3d
mov dword [rbp + 0x310], 0x6d616e26
mov byte [rbp + 0x314], 0x65
mov byte [rbp + 0x317], r12b
lea rax, [rbp + 0x1d8]
mov qword [rbp + 0x300], rax
lea rdx, [0x1804f1c28]
lea rcx, [rbp + 0x1d8]
call fcn.180078020
mov rdi, rax
lea rax, [rbp + 0x1f8]
mov qword [rbp + 0x308], rax
lea rdx, [0x1804f1d90]
lea rcx, [rbp + 0x1f8]
call fcn.180078020
mov rbx, rax
lea rdx, [0x1804f1e58]
lea rcx, [rbp + 0x218]
call fcn.180078020
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x158]
call fcn.1800641e0
mov rsi, rax
mov word [rsp + 0x47], 0x3d
mov dword [rsp + 0x40], 0x636e6526
mov word [rsp + 0x44], 0x656b
mov byte [rsp + 0x46], 0x79
mov byte [rsp + 0x49], r12b
lea rax, [rbp + 0x238]
mov qword [rbp + 0x300], rax
lea rdx, [0x1804f1c28]
lea rcx, [rbp + 0x238]
call fcn.180078020
mov rdi, rax
lea rax, [rbp + 0x258]
mov qword [rbp + 0x308], rax
lea rdx, [0x1804f1d90]
lea rcx, [rbp + 0x258]
call fcn.180078020
mov rbx, rax
lea rdx, [0x1804f1db0]
lea rcx, [rbp + 0x278]
call fcn.180078020
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x138]
call fcn.1800641e0
mov rdi, rax
mov dword [rbp + 0x30a], 0x3d7265
mov word [rbp + 0x308], 0x7626
mov byte [rbp + 0x30e], r12b
mov word [rbp + 0x303], 0x74
mov word [rbp + 0x300], 0x6e69
mov byte [rbp + 0x302], 0x69
mov byte [rbp + 0x305], r12b
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x68], xmm1
lea rax, [rbp + 0x300]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x180064d92
lea rdx, [rbp + 0x300]
lea rcx, [rbp - 0x78]
call fcn.18004e2d0
nop
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0x298]
call fcn.180063ee0
nop
mov dword [rbp + 0x302], 0x3d6570
mov word [rbp + 0x300], 0x7974
mov byte [rbp + 0x306], 0
lea rcx, [rbp + 0x300]
mov r9, rbx
inc r9
cmp byte [rcx + r9], 0
jne 0x180064de2
lea r8, [rbp + 0x300]
xor edx, edx
mov rcx, rax
call fcn.18004e570
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x68], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x68], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rax, [rbp + 0x308]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180064e40
lea rdx, [rbp + 0x308]
lea rcx, [rsp + 0x58]
call fcn.18004b530
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x68], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r9, rdi
lea r8, [rbp + 0x58]
lea rcx, [rbp + 0x118]
call fcn.1800802b0
nop
lea rax, [rsp + 0x40]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x180064e95
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x118]
call fcn.18004b530
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xb8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xc8], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r9, rsi
lea r8, [rbp + 0xb8]
lea rcx, [rbp + 0xf8]
call fcn.1800802b0
nop
lea rax, [rbp + 0x310]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x180064ef5
lea rdx, [rbp + 0x310]
lea rcx, [rbp + 0xf8]
call fcn.18004b530
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x98], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xa8], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r9, r14
lea r8, [rbp + 0x98]
lea rcx, [rbp + 0x1b8]
call fcn.1800802b0
nop
lea rax, [rsp + 0x4a]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x180064f55
lea rdx, [rsp + 0x4a]
lea rcx, [rbp + 0x1b8]
call fcn.18004b530
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x88], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r9, r15
lea r8, [rbp + 0x78]
lea rcx, [rbp + 0x198]
call fcn.1800802b0
nop
lea rax, [rsp + 0x30]
nop word [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x180064fb0
mov r8, rbx
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x198]
call fcn.18004b530
xorps xmm0, xmm0
movups xmmword [rbp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x48], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x48], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [0x1804f1c28]
cmp qword [0x1804f1c40], 0xf
cmova rdx, qword [0x1804f1c28]
mov r8, qword [0x1804f1c38]
lea rcx, [rbp + 0x38]
call fcn.18004b530
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xd8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xe8], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp + 0x50]
cmp rdx, 0xf
jbe 0x180065080
inc rdx
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18006507b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006572e
call fcn.1801170ac
movdqa xmm0, xmmword [0x1801a1bf0]
movdqu xmmword [rbp + 0x48], xmm0
mov byte [rbp + 0x38], 0
lea rcx, [rbp + 0x198]
call fcn.18004b360
nop
mov rdx, qword [rbp + 0x90]
cmp rdx, 0xf
jbe 0x1800650dd
inc rdx
mov rcx, qword [rbp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800650d7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180065734
call fcn.1801170ac
nop
lea rcx, [rbp + 0x1b8]
call fcn.18004b360
nop
mov rdx, qword [rbp + 0xb0]
cmp rdx, 0xf
jbe 0x18006512c
inc rdx
mov rcx, qword [rbp + 0x98]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180065126
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006573a
call fcn.1801170ac
nop
lea rcx, [rbp + 0xf8]
call fcn.18004b360
nop
mov rdx, qword [rbp + 0xd0]
cmp rdx, 0xf
jbe 0x18006517b
inc rdx
mov rcx, qword [rbp + 0xb8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180065175
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180065740
call fcn.1801170ac
nop
lea rcx, [rbp + 0x118]
call fcn.18004b360
nop
mov rdx, qword [rbp + 0x70]
cmp rdx, 0xf
jbe 0x1800651c4
inc rdx
mov rcx, qword [rbp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800651be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180065746
call fcn.1801170ac
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x180065201
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800651fc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006574c
call fcn.1801170ac
movdqa xmm0, xmmword [0x1801a1bf0]
movdqu xmmword [rsp + 0x68], xmm0
mov byte [rsp + 0x58], 0
lea rcx, [rbp + 0x298]
call fcn.18004b360
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 0xf
jbe 0x18006525c
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180065257
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180065752
call fcn.1801170ac
movdqa xmm0, xmmword [0x1801a1bf0]
movdqu xmmword [rbp - 0x68], xmm0
mov byte [rbp - 0x78], 0
lea rcx, [rbp + 0x138]
call fcn.18004b360
nop
lea rcx, [rbp + 0x158]
call fcn.18004b360
nop
lea rcx, [rbp - 0x38]
call fcn.18004b360
nop
lea rcx, [rbp + 0x18]
call fcn.18004b360
lea rdx, [rbp + 0xd8]
lea rcx, [rbp + 0x58]
call fcn.180078020
mov rdx, rax
lea rcx, [rbp - 0x58]
call fcn.180067330
nop
lea rax, [rbp + 0x18]
mov qword [rbp + 0x300], rax
lea rdx, [0x1804f1c28]
lea rcx, [rbp + 0x18]
call fcn.180078020
mov rdi, rax
lea rax, [rbp - 0x38]
mov qword [rbp + 0x308], rax
lea rdx, [0x1804f1d90]
lea rcx, [rbp - 0x38]
call fcn.180078020
mov rbx, rax
lea rdx, [rbp - 0x58]
lea rcx, [rbp + 0x158]
call fcn.180078020
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x138]
call fcn.180064380
mov rbx, rax
lea rax, [rbp - 0x58]
cmp rax, rbx
je 0x18006538f
mov rdx, qword [rbp - 0x40]
cmp rdx, 0xf
jbe 0x180065360
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18006535b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180065758
call fcn.1801170ac
movdqa xmm0, xmmword [0x1801a1bf0]
movdqu xmmword [rbp - 0x48], xmm0
mov byte [rbp - 0x58], 0
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 0x58], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp - 0x48], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
lea rcx, [rbp + 0x138]
call fcn.18004b360
mov qword [rbp + 0x190], r12
lea r8, [rbp + 0x158]
lea rdx, [rbp - 0x58]
lea rcx, [rsp + 0x78]
call fcn.18007d0d0
nop
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x70], 0xf
mov rax, qword [str.success]
mov dword [rsp + 0x58], eax
movzx eax, word [0x18019d1ac]
mov word [rsp + 0x5c], ax
movzx eax, byte [0x18019d1ae]
mov byte [rsp + 0x5e], al
mov byte [rsp + 0x5f], 0
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x78]
call fcn.18007ff20
cmp byte [rax], 4
jne 0x18006575e
lea rcx, [rsp + 0x78]
cmp byte [rax + 8], 0
je 0x1800654fa
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], 9
mov qword [rbp - 0x60], 0xf
movsd xmm0, qword [str.sessionid]
movsd qword [rbp - 0x78], xmm0
movzx eax, byte [0x18019d1b8]
mov byte [rbp - 0x70], al
mov byte [rbp - 0x6f], 0
lea rdx, [rbp - 0x78]
call fcn.18007ff20
cmp byte [rax], 3
jne 0x18006579b
mov r8, qword [rax + 8]
mov rdx, r8
cmp qword [r8 + 0x18], 0xf
jbe 0x180065472
mov rdx, qword [r8]
mov r8, qword [r8 + 0x10]
lea rcx, [0x1804f1e38]
call fcn.18004b3c0
nop
lea rcx, [rsp + 0x78]
call fcn.18007a030
nop
movzx edx, byte [rsp + 0x78]
lea rcx, [rbp - 0x80]
call fcn.18007b7a0
nop
lea rcx, [rbp - 0x58]
call fcn.18004b360
nop
mov rdx, qword [rbp + 0xf0]
cmp rdx, 0xf
jbe 0x1800654e8
inc rdx
mov rcx, qword [rbp + 0xd8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800654e3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800657d8
call fcn.1801170ac
add rsp, 0x3c0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x70], 0xf
mov rax, qword [str.message]
mov dword [rsp + 0x58], eax
movzx eax, word [0x18019a32c]
mov word [rsp + 0x5c], ax
movzx eax, byte [0x18019a32e]
mov byte [rsp + 0x5e], al
mov byte [rsp + 0x5f], 0
lea rdx, [rsp + 0x58]
call fcn.18007ff20
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xor eax, eax
mov qword [rsp + 0x38], rax
movzx edx, byte [rsp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.18007b7a0
mov byte [rsp + 0x30], 3
mov ecx, 0x20
call fcn.180116c30
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], r12
mov r8d, 0xa
lea rdx, str.invalidver
mov rcx, rax
call fcn.18004e2d0
mov qword [rsp + 0x38], rbx
test rbx, rbx
jne 0x1800655ff
mov r8d, 0x2ae
lea rdx, str.C:_vcpkginstalledx64_windowsinclude_nlohmannjson.hpp
lea rcx, str.m_data.m_type___value_t::string__m_data.m_value.string___nullptr
call fcn.180133758
mov r8d, 0x2ae
lea rdx, str.C:_vcpkginstalledx64_windowsinclude_nlohmannjson.hpp
lea rcx, str.m_data.m_type___value_t::string__m_data.m_value.string___nullptr
call fcn.180133758
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.18007fac0
movzx ebx, al
mov r8d, 0x2ae
lea rdx, str.C:_vcpkginstalledx64_windowsinclude_nlohmannjson.hpp
lea rcx, str.m_data.m_type___value_t::string__m_data.m_value.string___nullptr
call fcn.180133758
jmp 0x18006560f
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.18007fac0
movzx ebx, al
mov dl, 3
lea rcx, [rsp + 0x38]
call fcn.18007b7a0
nop
test bl, bl
jne 0x180065676
lea rdx, [0x18019d1dc]
lea rcx, [0x1804cee20]
call fcn.18007c830
lea rdx, str.message
lea rcx, [rsp + 0x78]
call fcn.18007d200
mov rdx, rax
lea rcx, [rbp + 0x18]
call fcn.18007d300
nop
mov rdx, rax
call fcn.18007d390
nop
lea rcx, [rbp + 0x18]
call fcn.18004b310
mov ecx, 0x1194
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call fcn.180134fb8
int3
lea rdx, str.download
lea rcx, [rsp + 0x78]
call fcn.18007d200
lea rdx, [rbp + 0x18]
mov rcx, rax
call fcn.18007d250
lea rcx, [rbp + 0x18]
call fcn.18004b300
mov r8, rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor ecx, ecx
call fcn.180134fb8
nop
movdqa xmm0, xmmword [0x1801a1f30]
movdqu xmmword [rbp - 0x38], xmm0
movdqa xmm1, xmmword [0x1801a1f20]
movdqu xmmword [rbp - 0x28], xmm1
movdqa xmm0, xmmword [0x1801a1f40]
movdqu xmmword [rbp - 0x18], xmm0
movdqa xmm1, xmmword [0x1801a1da0]
movdqu xmmword [rbp - 8], xmm1
mov dword [rbp + 8], 0x21260b65
mov dword [rbp + 0xc], 0x3c286427
mov word [rbp + 0x10], 0x3d
mov byte [rbp + 0x12], 1
lea rdx, [rbp - 0x38]
call fcn.1800657e0
mov ecx, 0x1194
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call fcn.180134fb8
nop
call fcn.180133c08
nop
call fcn.180133c08
nop
call fcn.180133c08
nop
call fcn.180133c08
nop
call fcn.180133c08
nop
call fcn.180133c08
nop
call fcn.180133c08
nop
call fcn.180133c08
nop
mov rcx, rax
call fcn.180079fa0
mov qword [rbp + 0x300], rax
lea r8, [rbp + 0x300]
lea rcx, [rbp + 0x18]
call fcn.18008f440
nop
mov r8, rax
lea rcx, [rbp - 0x38]
call fcn.18008f2a0
lea rdx, [0x1801c1220]
lea rcx, [rbp - 0x38]
call fcn.1801193d4
nop
mov rcx, rax
call fcn.180079fa0
mov qword [rbp + 0x300], rax
lea r8, [rbp + 0x300]
lea rcx, [rbp + 0x18]
call fcn.18008f1f0
nop
mov r8, rax
lea rcx, [rbp - 0x38]
call fcn.18008f2a0
lea rdx, [0x1801c1220]
lea rcx, [rbp - 0x38]
call fcn.1801193d4
nop
call fcn.180133c08
int3