Function at 0x14002ddd0
Capabilities:
Access peb ldr_data
Check for debugger via api
Check systemkerneldebuggerinformation
Encode data using xor
Enumerate gui resources
Get system information on windows
Hash data using fnv
Resolve function by parsing pe exports
Resume thread
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x120]
sub rsp, 0x220
mov rax, qword [0x1400c1080]
xor rax, rsp
mov qword [rbp + 0x110], rax
call fcn.140027f20
call fcn.14002a490
test al, al
jne 0x14002f7f4
call fcn.14002ac90
test al, al
jne 0x14002f7f4
call fcn.14002b170
test eax, eax
jne 0x14002f7f4
call fcn.14002b490
test al, al
jne 0x14002f7f4
call fcn.14002b6b0
test eax, eax
jne 0x14002f7f4
call fcn.14002baa0
test eax, eax
jne 0x14002f7f4
call fcn.14002bde0
test eax, eax
jne 0x14002f7f4
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov edi, dword [rcx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x14002def6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14002def6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r11 + r9*4]
mov ecx, dword [rcx + rbx]
add rcx, r11
mov r8d, 0x811c9dc5
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14002def1
nop dword [rax]
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x14002ded0
cmp r8d, 0x60ac7e39
je 0x14002defb
test r9d, r9d
jne 0x14002deb0
mov rax, qword [rax]
jmp 0x14002de80
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
lea r14, [0x1400c2610]
mov qword [rsp + 0x28], r14
xor esi, esi
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, [0x140028680]
xor edx, edx
xor ecx, ecx
call r10
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov edi, dword [rcx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x14002dfc6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14002dfc6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r11 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r11
mov r8d, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14002dfc1
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14002dfa0
cmp r8d, 0x60ac7e39
je 0x14002dfcb
test r9d, r9d
jne 0x14002df80
mov rax, qword [rax]
jmp 0x14002df50
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, [0x1400291f0]
xor edx, edx
xor ecx, ecx
call r10
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov edi, dword [rcx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x14002e086
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14002e086
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r11 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r11
mov r8d, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14002e081
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14002e060
cmp r8d, 0x60ac7e39
je 0x14002e08b
test r9d, r9d
jne 0x14002e040
mov rax, qword [rax]
jmp 0x14002e010
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, [0x1400294f0]
xor edx, edx
xor ecx, ecx
call r10
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov edi, dword [rcx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x14002e146
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14002e146
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r11 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r11
mov r8d, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14002e141
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14002e120
cmp r8d, 0x60ac7e39
je 0x14002e14b
test r9d, r9d
jne 0x14002e100
mov rax, qword [rax]
jmp 0x14002e0d0
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, [0x1400298c0]
xor edx, edx
xor ecx, ecx
call r10
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov edi, dword [rcx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x14002e206
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14002e206
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r11 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r11
mov r8d, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14002e201
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14002e1e0
cmp r8d, 0x60ac7e39
je 0x14002e20b
test r9d, r9d
jne 0x14002e1c0
mov rax, qword [rax]
jmp 0x14002e190
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, [0x140029c90]
xor edx, edx
xor ecx, ecx
call r10
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14002e250
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp eax, 1
jne 0x14002e279
cmp dword [rbp + 0x20], eax
jne 0x14002e279
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov byte [rsp + 0x50], 0x76
mov al, 0x3e
mov cl, Ordinal_35
movzx edx, cl
mov r8b, 0x26
mov r9b, 0x56
mov r10b, reloc.WLDAP32.dll_Ordinal_50
mov r11b, reloc.WS2_32.dll_send
mov bl, reloc.WS2_32.dll_sendto
mov dil, 3
mov sil, reloc.WS2_32.dll_recvfrom
movzx r14d, sil
movzx r15d, r11b
mov r12b, 4
xor r13d, r13d
xor al, 0x76
mov byte [rsp + 0x51], al
xor cl, 0x76
mov byte [rsp + 0x52], cl
xor dl, 0x76
mov byte [rsp + 0x53], dl
xor r8b, 0x76
mov byte [rsp + 0x54], r8b
xor r9b, 0x76
mov byte [rsp + 0x55], r9b
xor r10b, 0x76
mov byte [rsp + 0x56], r10b
xor r11b, 0x76
mov byte [rsp + 0x57], r11b
xor bl, 0x76
mov byte [rsp + 0x58], bl
xor dil, 0x76
mov byte [rsp + 0x59], dil
xor sil, 0x76
mov byte [rsp + 0x5a], sil
xor r14b, 0x76
mov byte [rsp + 0x5b], r14b
xor r15b, 0x76
mov byte [rsp + 0x5c], r15b
xor r12b, 0x76
mov byte [rsp + 0x5d], r12b
mov byte [rsp + 0x5e], r13b
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x40], xmm1
lea rax, [rsp + 0x51]
mov r13, 0xffffffffffffffff
mov r8, r13
inc r8
cmp byte [rax + r8], 0
jne 0x14002e336
lea rdx, [rsp + 0x51]
lea rcx, [rbp + 0x30]
call fcn.140034b20
nop
movdqa xmm1, xmmword [str.w_36MW]
movdqu xmmword [rsp + 0x50], xmm1
mov dl, 3
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x51], al
xor byte [rsp + 0x52], cl
xor byte [rsp + 0x53], cl
xor byte [rsp + 0x54], cl
xor byte [rsp + 0x55], cl
xor byte [rsp + 0x56], cl
xor byte [rsp + 0x57], cl
xor byte [rsp + 0x58], cl
xor byte [rsp + 0x59], cl
xor byte [rsp + 0x5a], cl
xor byte [rsp + 0x5b], cl
xor byte [rsp + 0x5c], cl
xor byte [rsp + 0x5d], cl
xor byte [rsp + 0x5e], cl
xor byte [rsp + 0x5f], cl
xor dl, cl
mov byte [rsp + 0x60], dl
mov byte [rsp + 0x61], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x60], xmm1
lea rax, [rsp + 0x51]
mov r8, r13
inc r8
cmp byte [rax + r8], 0
jne 0x14002e3d0
lea rdx, [rsp + 0x51]
lea rcx, [rbp + 0x50]
call fcn.140034b20
nop
movdqa xmm1, xmmword [str.8k_ATTY]
movdqu xmmword [rsp + 0x50], xmm1
mov dl, reloc.WLDAP32.dll_Ordinal_22
xor r8b, r8b
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x51], al
xor byte [rsp + 0x52], cl
xor byte [rsp + 0x53], cl
xor byte [rsp + 0x54], cl
xor byte [rsp + 0x55], cl
xor byte [rsp + 0x56], cl
xor byte [rsp + 0x57], cl
xor byte [rsp + 0x58], cl
xor byte [rsp + 0x59], cl
xor byte [rsp + 0x5a], cl
xor byte [rsp + 0x5b], cl
xor byte [rsp + 0x5c], cl
xor byte [rsp + 0x5d], cl
xor byte [rsp + 0x5e], cl
xor byte [rsp + 0x5f], cl
xor dl, cl
mov byte [rsp + 0x60], dl
xor r8b, cl
mov byte [rsp + 0x61], r8b
mov byte [rsp + 0x62], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x80], xmm1
lea rax, [rsp + 0x51]
mov r8, r13
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14002e480
lea rdx, [rsp + 0x51]
lea rcx, [rbp + 0x70]
call fcn.140034b20
nop
mov byte [rbp - 0x48], reloc.WLDAP32.dll_Ordinal_46
mov al, 0x7e
mov cl, 0x5c
mov dl, 0x41
mov r8b, Ordinal_79
mov r9b, 0x4b
mov r10b, 0x5d
movzx r11d, r10b
mov bl, 0x66
mov dil, reloc.WLDAP32.dll_Ordinal_79
movzx esi, r8b
mov r14b, 0x45
movzx r15d, r9b
movzx r12d, cl
xor r13d, r13d
xor al, 0x2e
mov byte [rbp - 0x47], al
xor cl, 0x2e
mov byte [rbp - 0x46], cl
xor dl, 0x2e
mov byte [rbp - 0x45], dl
xor r8b, 0x2e
mov byte [rbp - 0x44], r8b
xor r9b, 0x2e
mov byte [rbp - 0x43], r9b
xor r10b, 0x2e
mov byte [rbp - 0x42], r10b
xor r11b, 0x2e
mov byte [rbp - 0x41], r11b
xor bl, 0x2e
mov byte [rbp - 0x40], bl
xor dil, 0x2e
mov byte [rbp - 0x3f], dil
xor sil, 0x2e
mov byte [rbp - 0x3e], sil
xor r14b, 0x2e
mov byte [rbp - 0x3d], r14b
xor r15b, 0x2e
mov byte [rbp - 0x3c], r15b
xor r12b, 0x2e
mov byte [rbp - 0x3b], r12b
mov byte [rbp - 0x3a], r13b
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xa0], xmm1
lea rax, [rbp - 0x47]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], r13b
jne 0x14002e550
lea rdx, [rbp - 0x47]
lea rcx, [rbp + 0x90]
call fcn.140034b20
nop
mov byte [rsp + 0x30], reloc.WLDAP32.dll_Ordinal_60
mov al, 0x4b
mov cl, 0x55
mov dl, 0x52
mov r8b, 0x58
mov r9b, 0x53
movzx r10d, al
mov r11b, Ordinal_79
mov bl, 0x59
movzx edi, dl
mov sil, 0x5d
mov r14b, 0x51
movzx r15d, bl
movzx r12d, r11b
xor r13d, r13d
xor al, 0x3c
mov byte [rsp + 0x31], al
xor cl, 0x3c
mov byte [rsp + 0x32], cl
xor dl, 0x3c
mov byte [rsp + 0x33], dl
xor r8b, 0x3c
mov byte [rsp + 0x34], r8b
xor r9b, 0x3c
mov byte [rsp + 0x35], r9b
xor r10b, 0x3c
mov byte [rsp + 0x36], r10b
xor r11b, 0x3c
mov byte [rsp + 0x37], r11b
xor bl, 0x3c
mov byte [rsp + 0x38], bl
xor dil, 0x3c
mov byte [rsp + 0x39], dil
xor sil, 0x3c
mov byte [rsp + 0x3a], sil
xor r14b, 0x3c
mov byte [rsp + 0x3b], r14b
xor r15b, 0x3c
mov byte [rsp + 0x3c], r15b
xor r12b, 0x3c
mov byte [rsp + 0x3d], r12b
mov byte [rsp + 0x3e], r13b
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xc0], xmm1
lea rax, [rsp + 0x31]
mov r13, 0xffffffffffffffff
mov r8, r13
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14002e630
lea rdx, [rsp + 0x31]
lea rcx, [rbp + 0xb0]
call fcn.140034b20
nop
movdqa xmm1, xmmword [0x1400b1ad0]
movdqu xmmword [rsp + 0x30], xmm1
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x31], al
xor byte [rsp + 0x32], cl
xor byte [rsp + 0x33], cl
xor byte [rsp + 0x34], cl
xor byte [rsp + 0x35], cl
xor byte [rsp + 0x36], cl
xor byte [rsp + 0x37], cl
xor byte [rsp + 0x38], cl
xor byte [rsp + 0x39], cl
xor byte [rsp + 0x3a], cl
xor byte [rsp + 0x3b], cl
xor byte [rsp + 0x3c], cl
xor byte [rsp + 0x3d], cl
xor byte [rsp + 0x3e], cl
mov byte [rsp + 0x3f], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xe0], xmm1
lea rax, [rsp + 0x31]
mov r8, r13
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14002e6d0
lea rdx, [rsp + 0x31]
lea rcx, [rbp + 0xd0]
call fcn.140034b20
nop
mov byte [rsp + 0x70], reloc.WLDAP32.dll_Ordinal_50
mov al, 0x71
mov cl, 0x5a
mov dl, 0x57
mov r8b, 0x53
mov r9b, 0x46
mov r10b, reloc.WS2_32.dll_select
mov r11b, 0x77
mov bl, 0x5c
mov dil, 0x55
mov sil, 0x5b
movzx r14d, bl
movzx r15d, dl
xor r12d, r12d
xor al, 0x32
mov byte [rsp + 0x71], al
xor cl, 0x32
mov byte [rsp + 0x72], cl
xor dl, 0x32
mov byte [rsp + 0x73], dl
xor r8b, 0x32
mov byte [rsp + 0x74], r8b
xor r9b, 0x32
mov byte [rsp + 0x75], r9b
xor r10b, 0x32
mov byte [rsp + 0x76], r10b
xor r11b, 0x32
mov byte [rsp + 0x77], r11b
xor bl, 0x32
mov byte [rsp + 0x78], bl
xor dil, 0x32
mov byte [rsp + 0x79], dil
xor sil, 0x32
mov byte [rsp + 0x7a], sil
xor r14b, 0x32
mov byte [rsp + 0x7b], r14b
xor r15b, 0x32
mov byte [rsp + 0x7c], r15b
mov byte [rsp + 0x7d], r12b
xorps xmm0, xmm0
movups xmmword [rbp + 0xf0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x100], xmm1
lea rax, [rsp + 0x71]
mov r8, r13
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], r12b
jne 0x14002e7a0
lea rdx, [rsp + 0x71]
lea rcx, [rbp + 0xf0]
call fcn.140034b20
nop
lea rsi, [rbp + 0x30]
mov r14d, 4
mov rdx, rsi
cmp qword [rsi + 0x18], 0xf
jbe 0x14002e7d2
mov rdx, qword [rsi]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x14002e7fd
mov rcx, rsi
cmp qword [rsi + 0x18], 0xf
jbe 0x14002e7ec
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x14002e91a
lea rdx, [0x1400c5ee0]
lea rcx, [rsp + 0x30]
call fcn.140033a20
mov rdx, rax
lea rcx, [0x1400c5d60]
call fcn.140047110
movdqa xmm1, xmmword [0x1400b1d00]
movdqu xmmword [rsp + 0x30], xmm1
mov dl, 0x7e
mov r8b, 0x69
mov r9b, 0x7b
movzx r10d, r9b
mov r11b, 0x79
mov bl, WSAGetLastError
mov dil, reloc.WS2_32.dll_WSAGetLastError
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x31], al
xor byte [rsp + 0x32], cl
xor byte [rsp + 0x33], cl
xor byte [rsp + 0x34], cl
xor byte [rsp + 0x35], cl
xor byte [rsp + 0x36], cl
xor byte [rsp + 0x37], cl
xor byte [rsp + 0x38], cl
xor byte [rsp + 0x39], cl
xor byte [rsp + 0x3a], cl
xor byte [rsp + 0x3b], cl
xor byte [rsp + 0x3c], cl
xor byte [rsp + 0x3d], cl
xor byte [rsp + 0x3e], cl
xor byte [rsp + 0x3f], cl
xor dl, cl
mov byte [rsp + 0x40], dl
xor r8b, cl
mov byte [rsp + 0x41], r8b
xor r9b, cl
mov byte [rsp + 0x42], r9b
xor r10b, cl
mov byte [rsp + 0x43], r10b
xor r11b, cl
mov byte [rsp + 0x44], r11b
xor bl, cl
mov byte [rsp + 0x45], bl
xor dil, cl
mov byte [rsp + 0x46], dil
mov byte [rsp + 0x47], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xor r15d, r15d
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
lea rax, [rsp + 0x31]
mov r8, r13
inc r8
cmp byte [rax + r8], r15b
jne 0x14002e8e4
lea rdx, [rsp + 0x31]
lea rcx, [rsp + 0x50]
call fcn.140034b20
lea rdx, [rsp + 0x50]
lea rcx, [0x1400c5d60]
call fcn.14003e460
mov ecx, ntohl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_raise]
jmp 0x14002e91d
xor r15d, r15d
add rsi, 0x20
sub r14, 1
jne 0x14002e7c5
call fcn.1400245e0
test al, al
je 0x14002eab5
lea rdx, [0x1400c5ee0]
lea rcx, [rsp + 0x30]
call fcn.140033a20
mov rdx, rax
lea rcx, [0x1400c5d60]
call fcn.140047110
movdqa xmm1, xmmword [0x1400b1cd0]
movdqu xmmword [rsp + 0x30], xmm1
mov cl, 0x79
mov dl, 0x6a
mov r8b, 0x7d
mov r9b, 0x5a
movzx r10d, dl
movzx ebx, r8b
movzx edi, cl
mov sil, reloc.WS2_32.dll_WSAStartup
mov r14b, 0x68
mov r15b, 0x77
mov r12b, WSAStartup
mov r13b, 0x76
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd r11d, xmm1
xor al, r11b
mov byte [rsp + 0x31], al
xor byte [rsp + 0x32], r11b
xor byte [rsp + 0x33], r11b
xor byte [rsp + 0x34], r11b
xor byte [rsp + 0x35], r11b
xor byte [rsp + 0x36], r11b
xor byte [rsp + 0x37], r11b
xor byte [rsp + 0x38], r11b
xor byte [rsp + 0x39], r11b
xor byte [rsp + 0x3a], r11b
xor byte [rsp + 0x3b], r11b
xor byte [rsp + 0x3c], r11b
xor byte [rsp + 0x3d], r11b
xor byte [rsp + 0x3e], r11b
xor byte [rsp + 0x3f], r11b
xor cl, r11b
mov byte [rsp + 0x40], cl
xor dl, r11b
mov byte [rsp + 0x41], dl
xor r8b, r11b
mov byte [rsp + 0x42], r8b
xor r9b, r11b
mov byte [rsp + 0x43], r9b
xor r10b, r11b
mov byte [rsp + 0x44], r10b
xor bl, r11b
mov byte [rsp + 0x45], bl
xor dil, r11b
mov byte [rsp + 0x46], dil
xor sil, r11b
mov byte [rsp + 0x47], sil
xor r14b, r11b
mov byte [rsp + 0x48], r14b
xor r15b, r11b
mov byte [rsp + 0x49], r15b
xor r12b, r11b
mov byte [rsp + 0x4a], r12b
xor r13b, r11b
mov byte [rsp + 0x4b], r13b
mov al, 0x6c
xor al, r11b
mov byte [rsp + 0x4c], al
mov al, 0x6b
xor al, r11b
mov byte [rsp + 0x4d], al
mov byte [rsp + 0x4e], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xor r15d, r15d
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
lea rax, [rsp + 0x31]
mov r13, 0xffffffffffffffff
mov r8, r13
inc r8
cmp byte [rax + r8], r15b
jne 0x14002ea81
lea rdx, [rsp + 0x31]
lea rcx, [rsp + 0x50]
call fcn.140034b20
lea rdx, [rsp + 0x50]
lea rcx, [0x1400c5d60]
call fcn.14003e460
mov ecx, ntohl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_raise]
mov ecx, 0x1000
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jne 0x14002eacd
call fcn.140024ac0
test al, al
je 0x14002eacf
mov al, 1
test al, al
je 0x14002ebca
lea rdx, [0x1400c5ee0]
lea rcx, [rsp + 0x30]
call fcn.140033a20
mov rdx, rax
lea rcx, [0x1400c5d60]
call fcn.140047110
mov byte [rbp - 0x58], 0x75
mov al, reloc.WLDAP32.dll_Ordinal_60
mov cl, 6
mov dl, reloc.WLDAP32.dll_Ordinal_32
movzx r8d, cl
mov r9b, reloc.WS2_32.dll_recv
mov r10b, 7
mov r11b, Ordinal_50
mov bl, reloc.WS2_32.dll_socket
mov dil, reloc.WS2_32.dll_sendto
mov sil, reloc.WLDAP32.dll_Ordinal_27
movzx r14d, dil
mov r15b, 1
xor r12d, r12d
xor al, 0x75
mov byte [rbp - 0x57], al
xor cl, 0x75
mov byte [rbp - 0x56], cl
xor dl, 0x75
mov byte [rbp - 0x55], dl
xor r8b, 0x75
mov byte [rbp - 0x54], r8b
xor r9b, 0x75
mov byte [rbp - 0x53], r9b
xor r10b, 0x75
mov byte [rbp - 0x52], r10b
xor r11b, 0x75
mov byte [rbp - 0x51], r11b
xor bl, 0x75
mov byte [rbp - 0x50], bl
xor dil, 0x75
mov byte [rbp - 0x4f], dil
xor sil, 0x75
mov byte [rbp - 0x4e], sil
xor r14b, 0x75
mov byte [rbp - 0x4d], r14b
xor r15b, 0x75
mov byte [rbp - 0x4c], r15b
mov byte [rbp - 0x4b], r12b
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xor r15d, r15d
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], r15
lea rax, [rbp - 0x57]
mov r8, r13
inc r8
cmp byte [rax + r8], r12b
jne 0x14002eb97
lea rdx, [rbp - 0x57]
lea rcx, [rsp + 0x30]
call fcn.140034b20
lea rdx, [rsp + 0x30]
lea rcx, [0x1400c5d60]
call fcn.14003e460
mov ecx, ntohl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_raise]
call fcn.140024690
test al, al
je 0x14002ece5
lea rdx, [0x1400c5ee0]
lea rcx, [rsp + 0x30]
call fcn.140033a20
mov rdx, rax
lea rcx, [0x1400c5d60]
call fcn.140047110
movdqa xmm1, xmmword [0x1400b1bc0]
movdqu xmmword [rsp + 0x30], xmm1
mov dl, 8
mov r8b, reloc.WLDAP32.dll_Ordinal_33
mov r9b, reloc.WLDAP32.dll_Ordinal_46
mov r10b, 0x24
mov r11b, Ordinal_46
mov bl, 0x25
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x31], al
xor byte [rsp + 0x32], cl
xor byte [rsp + 0x33], cl
xor byte [rsp + 0x34], cl
xor byte [rsp + 0x35], cl
xor byte [rsp + 0x36], cl
xor byte [rsp + 0x37], cl
xor byte [rsp + 0x38], cl
xor byte [rsp + 0x39], cl
xor byte [rsp + 0x3a], cl
xor byte [rsp + 0x3b], cl
xor byte [rsp + 0x3c], cl
xor byte [rsp + 0x3d], cl
xor byte [rsp + 0x3e], cl
xor byte [rsp + 0x3f], cl
xor dl, cl
mov byte [rsp + 0x40], dl
xor r8b, cl
mov byte [rsp + 0x41], r8b
xor r9b, cl
mov byte [rsp + 0x42], r9b
xor r10b, cl
mov byte [rsp + 0x43], r10b
xor r11b, cl
mov byte [rsp + 0x44], r11b
xor bl, cl
mov byte [rsp + 0x45], bl
mov byte [rsp + 0x46], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
lea rax, [rsp + 0x31]
mov r8, r13
nop
inc r8
cmp byte [rax + r8], 0
jne 0x14002ecb0
lea rdx, [rsp + 0x31]
lea rcx, [rsp + 0x50]
call fcn.140034b20
lea rdx, [rsp + 0x50]
lea rcx, [0x1400c5d60]
call fcn.14003e460
mov ecx, ntohl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_raise]
call fcn.1400246b0
test al, al
je 0x14002ee25
lea rdx, [0x1400c5ee0]
lea rcx, [rsp + 0x30]
call fcn.140033a20
mov rdx, rax
lea rcx, [0x1400c5d60]
call fcn.140047110
movdqa xmm1, xmmword [0x1400b1bb0]
movdqu xmmword [rsp + 0x30], xmm1
mov dl, 5
mov r8b, gethostname
mov r9b, reloc.WLDAP32.dll_Ordinal_35
mov r10b, 0x25
mov r11b, Ordinal_50
mov bl, 0x34
mov dil, reloc.WLDAP32.dll_Ordinal_41
mov sil, 0x2f
mov r14b, reloc.WLDAP32.dll_Ordinal_46
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x31], al
xor byte [rsp + 0x32], cl
xor byte [rsp + 0x33], cl
xor byte [rsp + 0x34], cl
xor byte [rsp + 0x35], cl
xor byte [rsp + 0x36], cl
xor byte [rsp + 0x37], cl
xor byte [rsp + 0x38], cl
xor byte [rsp + 0x39], cl
xor byte [rsp + 0x3a], cl
xor byte [rsp + 0x3b], cl
xor byte [rsp + 0x3c], cl
xor byte [rsp + 0x3d], cl
xor byte [rsp + 0x3e], cl
xor byte [rsp + 0x3f], cl
xor dl, cl
mov byte [rsp + 0x40], dl
xor r8b, cl
mov byte [rsp + 0x41], r8b
xor r9b, cl
mov byte [rsp + 0x42], r9b
xor r10b, cl
mov byte [rsp + 0x43], r10b
xor r11b, cl
mov byte [rsp + 0x44], r11b
xor bl, cl
mov byte [rsp + 0x45], bl
xor dil, cl
mov byte [rsp + 0x46], dil
xor sil, cl
mov byte [rsp + 0x47], sil
xor r14b, cl
mov byte [rsp + 0x48], r14b
mov byte [rsp + 0x49], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
lea rax, [rsp + 0x31]
mov r8, r13
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14002edf0
lea rdx, [rsp + 0x31]
lea rcx, [rsp + 0x50]
call fcn.140034b20
lea rdx, [rsp + 0x50]
lea rcx, [0x1400c5d60]
call fcn.14003e460
mov ecx, ntohl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_raise]
mov rbx, qword [0x1400c5d10]
mov rsi, qword [0x1400c5d18]
cmp rbx, rsi
je 0x14002ef8a
nop dword [rax]
mov rdi, qword [rbx]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetThreadId]
test eax, eax
je 0x14002ee67
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
add rbx, 8
cmp rbx, rsi
jne 0x14002ee40
jmp 0x14002ef8a
lea rdx, [0x1400c5ee0]
lea rcx, [rbp - 0x38]
call fcn.140033a20
mov rdx, rax
lea rcx, [0x1400c5d60]
call fcn.140047110
movdqa xmm1, xmmword [0x1400b1cc0]
movdqu xmmword [rsp + 0x30], xmm1
mov dl, 0x63
mov r8b, 0x69
mov r9b, 0x59
mov r10b, 0x65
mov r11b, 0x7f
mov bl, 0x68
mov dil, 0x6c
movzx esi, r8b
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x31], al
xor byte [rsp + 0x32], cl
xor byte [rsp + 0x33], cl
xor byte [rsp + 0x34], cl
xor byte [rsp + 0x35], cl
xor byte [rsp + 0x36], cl
xor byte [rsp + 0x37], cl
xor byte [rsp + 0x38], cl
xor byte [rsp + 0x39], cl
xor byte [rsp + 0x3a], cl
xor byte [rsp + 0x3b], cl
xor byte [rsp + 0x3c], cl
xor byte [rsp + 0x3d], cl
xor byte [rsp + 0x3e], cl
xor byte [rsp + 0x3f], cl
xor dl, cl
mov byte [rsp + 0x40], dl
xor r8b, cl
mov byte [rsp + 0x41], r8b
xor r9b, cl
mov byte [rsp + 0x42], r9b
xor r10b, cl
mov byte [rsp + 0x43], r10b
xor r11b, cl
mov byte [rsp + 0x44], r11b
xor bl, cl
mov byte [rsp + 0x45], bl
xor dil, cl
mov byte [rsp + 0x46], dil
xor sil, cl
mov byte [rsp + 0x47], sil
mov byte [rsp + 0x48], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
lea rax, [rsp + 0x31]
mov r8, r13
inc r8
cmp byte [rax + r8], 0
jne 0x14002ef55
lea rdx, [rsp + 0x31]
lea rcx, [rsp + 0x50]
call fcn.140034b20
lea rdx, [rsp + 0x50]
lea rcx, [0x1400c5d60]
call fcn.14003e460
mov ecx, ntohl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_raise]
xor r9d, r9d
lea r8d, [r9 + 2]
lea rdx, [rbp + 0x18]
lea ecx, [r9 + 0x23]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x14002efb4
cmp byte [rbp + 0x18], 0
je 0x14002efb4
cmp byte [rbp + 0x19], 0
mov eax, 1
je 0x14002efb7
mov eax, r15d
test al, al
je 0x14002f063
lea rdx, [0x1400c5ee0]
lea rcx, [rbp - 0x38]
call fcn.140033a20
mov rdx, rax
lea rcx, [0x1400c5d60]
call fcn.140047110
mov byte [rbp - 0x80], WSASetLastError
mov al, reloc.WLDAP32.dll_Ordinal_46
mov cl, 5
mov dl, 8
mov r8b, reloc.WS2_32.dll_ntohl
mov r9b, 6
xor r10d, r10d
xor al, 0x6d
mov byte [rbp - 0x7f], al
xor cl, 0x6d
mov byte [rbp - 0x7e], cl
xor dl, 0x6d
mov byte [rbp - 0x7d], dl
xor r8b, 0x6d
mov byte [rbp - 0x7c], r8b
xor r9b, 0x6d
mov byte [rbp - 0x7b], r9b
mov byte [rbp - 0x7a], r10b
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], r15
lea rax, [rbp - 0x7f]
mov r8, r13
nop
inc r8
cmp byte [rax + r8], r10b
jne 0x14002f030
lea rdx, [rbp - 0x7f]
lea rcx, [rsp + 0x30]
call fcn.140034b20
lea rdx, [rsp + 0x30]
lea rcx, [0x1400c5d60]
call fcn.14003e460
mov ecx, ntohl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_raise]
xor edx, edx
lea rcx, [0x140026450]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14002f104
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14002f104
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r10 + r9*4]
mov r8d, dword [rdx + r11]
add r8, r10
mov edx, 0x811c9dc5
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x14002f0ff
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x14002f0e0
cmp edx, 0x60ac7e39
je 0x14002f109
test r9d, r9d
jne 0x14002f0c0
mov rax, qword [rax]
jmp 0x14002f090
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
lea rdi, [0x1400c2610]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8, [0x140026250]
xor edx, edx
xor ecx, ecx
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14002f1d4
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14002f1d4
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r10 + r9*4]
mov r8d, dword [rdx + r11]
add r8, r10
mov edx, 0x811c9dc5
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x14002f1cf
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x14002f1b0
cmp edx, 0x60ac7e39
je 0x14002f1d9
test r9d, r9d
jne 0x14002f190
mov rax, qword [rax]
jmp 0x14002f160
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8, [0x140025de0]
xor edx, edx
xor ecx, ecx
call rax
call fcn.140027070
test al, al
je 0x14002f2d7
lea rdx, [0x1400c5ee0]
lea rcx, [rbp - 0x38]
call fcn.140033a20
mov rdx, rax
lea rcx, [0x1400c5d60]
call fcn.140047110
mov byte [rbp - 0x78], Ordinal_79
mov al, Ordinal_26
mov cl, Ordinal_41
mov dl, 0x3e
mov r8b, reloc.WS2_32.dll_gethostname
mov r9b, reloc.WLDAP32.dll_Ordinal_30
mov r10b, 0x24
mov r11b, 0x2a
mov bl, reloc.WLDAP32.dll_Ordinal_35
xor edi, edi
xor al, 0x4d
mov byte [rbp - 0x77], al
xor cl, 0x4d
mov byte [rbp - 0x76], cl
xor dl, 0x4d
mov byte [rbp - 0x75], dl
xor r8b, 0x4d
mov byte [rbp - 0x74], r8b
xor r9b, 0x4d
mov byte [rbp - 0x73], r9b
xor r10b, 0x4d
mov byte [rbp - 0x72], r10b
xor r11b, 0x4d
mov byte [rbp - 0x71], r11b
xor bl, 0x4d
mov byte [rbp - 0x70], bl
mov byte [rbp - 0x6f], dil
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], r15
lea rax, [rbp - 0x77]
mov r8, r13
inc r8
cmp byte [rax + r8], dil
jne 0x14002f2a4
lea rdx, [rbp - 0x77]
lea rcx, [rsp + 0x30]
call fcn.140034b20
lea rdx, [rsp + 0x30]
lea rcx, [0x1400c5d60]
call fcn.14003e460
mov ecx, ntohl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_raise]
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14002f3c8
lea rdx, [0x1400c5ee0]
lea rcx, [rbp - 0x38]
call fcn.140033a20
mov rdx, rax
lea rcx, [0x1400c5d60]
call fcn.140047110
movdqa xmm1, xmmword [0x1400b1be0]
movdqu xmmword [rsp + 0x30], xmm1
mov dl, 0x27
mov r8b, 0x3d
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x31], al
xor byte [rsp + 0x32], cl
xor byte [rsp + 0x33], cl
xor byte [rsp + 0x34], cl
xor byte [rsp + 0x35], cl
xor byte [rsp + 0x36], cl
xor byte [rsp + 0x37], cl
xor byte [rsp + 0x38], cl
xor byte [rsp + 0x39], cl
xor byte [rsp + 0x3a], cl
xor byte [rsp + 0x3b], cl
xor byte [rsp + 0x3c], cl
xor byte [rsp + 0x3d], cl
xor byte [rsp + 0x3e], cl
xor byte [rsp + 0x3f], cl
xor dl, cl
mov byte [rsp + 0x40], dl
xor r8b, cl
mov byte [rsp + 0x41], r8b
mov byte [rsp + 0x42], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
lea rax, [rsp + 0x31]
mov r8, r13
inc r8
cmp byte [rax + r8], 0
jne 0x14002f393
lea rdx, [rsp + 0x31]
lea rcx, [rsp + 0x50]
call fcn.140034b20
lea rdx, [rsp + 0x50]
lea rcx, [0x1400c5d60]
call fcn.14003e460
mov ecx, ntohl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_raise]
mov dword [rbp + 0x1c], r15d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
lea rdx, [rbp + 0x1c]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [rbp + 0x1c], 0
je 0x14002f4b8
lea rdx, [0x1400c5ee0]
lea rcx, [rbp - 0x38]
call fcn.140033a20
mov rdx, rax
lea rcx, [0x1400c5d60]
call fcn.140047110
movdqa xmm1, xmmword [str.f__Q_.__PS_5__]
movdqu xmmword [rsp + 0x30], xmm1
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x31], al
xor byte [rsp + 0x32], cl
xor byte [rsp + 0x33], cl
xor byte [rsp + 0x34], cl
xor byte [rsp + 0x35], cl
xor byte [rsp + 0x36], cl
xor byte [rsp + 0x37], cl
xor byte [rsp + 0x38], cl
xor byte [rsp + 0x39], cl
xor byte [rsp + 0x3a], cl
xor byte [rsp + 0x3b], cl
xor byte [rsp + 0x3c], cl
xor byte [rsp + 0x3d], cl
xor byte [rsp + 0x3e], cl
mov byte [rsp + 0x3f], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
lea rax, [rsp + 0x31]
mov r8, r13
inc r8
cmp byte [rax + r8], 0
jne 0x14002f483
lea rdx, [rsp + 0x31]
lea rcx, [rsp + 0x50]
call fcn.140034b20
lea rdx, [rsp + 0x50]
lea rcx, [0x1400c5d60]
call fcn.14003e460
mov ecx, ntohl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_raise]
lea rax, [rbp + 0x24]
mov qword [rsp + 0x20], rax
mov r9d, Ordinal_50
lea r8, [rbp - 0x18]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x14002f5b8
mov rax, qword [rbp - 0x10]
cmp byte [rax + 2], 0
je 0x14002f5b8
lea rdx, [0x1400c5ee0]
lea rcx, [rbp - 0x38]
call fcn.140033a20
mov rdx, rax
lea rcx, [0x1400c5d60]
call fcn.140047110
movdqa xmm1, xmmword [str.x5__O_0__NM___]
movdqu xmmword [rsp + 0x30], xmm1
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x31], al
xor byte [rsp + 0x32], cl
xor byte [rsp + 0x33], cl
xor byte [rsp + 0x34], cl
xor byte [rsp + 0x35], cl
xor byte [rsp + 0x36], cl
xor byte [rsp + 0x37], cl
xor byte [rsp + 0x38], cl
xor byte [rsp + 0x39], cl
xor byte [rsp + 0x3a], cl
xor byte [rsp + 0x3b], cl
xor byte [rsp + 0x3c], cl
xor byte [rsp + 0x3d], cl
xor byte [rsp + 0x3e], cl
mov byte [rsp + 0x3f], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
lea rax, [rsp + 0x31]
mov r8, r13
inc r8
cmp byte [rax + r8], 0
jne 0x14002f583
lea rdx, [rsp + 0x31]
lea rcx, [rsp + 0x50]
call fcn.140034b20
lea rdx, [rsp + 0x50]
lea rcx, [0x1400c5d60]
call fcn.14003e460
mov ecx, ntohl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_raise]
call fcn.1400271a0
test al, al
je 0x14002f6a3
lea rdx, [0x1400c5ee0]
lea rcx, [rbp - 0x38]
call fcn.140033a20
mov rdx, rax
lea rcx, [0x1400c5d60]
call fcn.140047110
mov byte [rbp - 0x68], 0x52
mov al, reloc.WS2_32.dll_recvfrom
mov cl, Ordinal_32
mov dl, 1
mov r8b, reloc.WLDAP32.dll_Ordinal_22
movzx r9d, al
mov r10b, Ordinal_30
mov r11b, reloc.WS2_32.dll_recv
movzx ebx, r8b
mov dil, 6
mov sil, reloc.WS2_32.dll_send
xor r14d, r14d
xor al, 0x52
mov byte [rbp - 0x67], al
xor cl, 0x52
mov byte [rbp - 0x66], cl
xor dl, 0x52
mov byte [rbp - 0x65], dl
xor r8b, 0x52
mov byte [rbp - 0x64], r8b
xor r9b, 0x52
mov byte [rbp - 0x63], r9b
xor r10b, 0x52
mov byte [rbp - 0x62], r10b
xor r11b, 0x52
mov byte [rbp - 0x61], r11b
xor bl, 0x52
mov byte [rbp - 0x60], bl
xor dil, 0x52
mov byte [rbp - 0x5f], dil
xor sil, 0x52
mov byte [rbp - 0x5e], sil
mov byte [rbp - 0x5d], r14b
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], r15
lea rax, [rbp - 0x67]
mov r8, r13
nop dword [rax]
inc r8
cmp byte [rax + r8], r14b
jne 0x14002f670
lea rdx, [rbp - 0x67]
lea rcx, [rsp + 0x30]
call fcn.140034b20
lea rdx, [rsp + 0x30]
lea rcx, [0x1400c5d60]
call fcn.14003e460
mov ecx, ntohl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_raise]
mov ecx, 0x1000
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x14002f7a9
lea rdx, [0x1400c5ee0]
lea rcx, [rbp - 0x38]
call fcn.140033a20
mov rdx, rax
lea rcx, [0x1400c5d60]
call fcn.140047110
movdqa xmm1, xmmword [0x1400b1cf0]
movdqu xmmword [rsp + 0x30], xmm1
mov dl, 0x78
mov r8b, 0x7d
movzx r9d, dl
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x31], al
xor byte [rsp + 0x32], cl
xor byte [rsp + 0x33], cl
xor byte [rsp + 0x34], cl
xor byte [rsp + 0x35], cl
xor byte [rsp + 0x36], cl
xor byte [rsp + 0x37], cl
xor byte [rsp + 0x38], cl
xor byte [rsp + 0x39], cl
xor byte [rsp + 0x3a], cl
xor byte [rsp + 0x3b], cl
xor byte [rsp + 0x3c], cl
xor byte [rsp + 0x3d], cl
xor byte [rsp + 0x3e], cl
xor byte [rsp + 0x3f], cl
xor dl, cl
mov byte [rsp + 0x40], dl
xor r8b, cl
mov byte [rsp + 0x41], r8b
xor r9b, cl
mov byte [rsp + 0x42], r9b
mov byte [rsp + 0x43], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
lea rax, [rsp + 0x31]
nop dword [rax]
inc r13
cmp byte [rax + r13], 0
jne 0x14002f770
mov r8, r13
lea rdx, [rsp + 0x31]
lea rcx, [rsp + 0x50]
call fcn.140034b20
lea rdx, [rsp + 0x50]
lea rcx, [0x1400c5d60]
call fcn.14003e460
mov ecx, ntohl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_raise]
nop
lea r9, [fcn.1400338f0]
mov edx, reloc.WLDAP32.dll_Ordinal_32
lea r8d, [rdx - 0x19]
lea rcx, [rbp + 0x30]
call fcn.14009acb0
mov al, 1
mov rcx, qword [rbp + 0x110]
xor rcx, rsp
call fcn.14009ab70
lea r11, [rsp + 0x220]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3