Function at 0x14002e0d0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Execute command
Get common file path
Get startup folder
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x420
mov rax, qword [0x1401793c0]
xor rax, rsp
mov qword [rsp + 0x418], rax
xor r12d, r12d
lea rdx, str.Initialize_fail
lea rcx, [rsp + 0x90]
call fcn.140007960
mov rcx, rax
call fcn.14002e050
call fcn.14002bd50
test al, al
je 0x14002e142
lea rcx, [0x14021f6b8]
call fcn.14002b2f0
call fcn.14002bdf0
mov dword [reloc.WLDAP32.dll_Ordinal_60], eax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r13, rax
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
call fcn.14002dee0
mov edx, 3
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Ninjasolutions.info_n_t
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140023b80
lea rdx, [0x140023df0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, 7
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov byte [rsp + 0xd0], 0x64
mov al, 7
mov cl, reloc.WS2_32.dll_socket
mov dl, 0x56
mov r8b, 0x4a
mov r9b, 1
mov r10b, Ordinal_30
movzx r11d, r9b
xor ebx, ebx
xor al, 0x64
mov byte [rsp + 0xd1], al
xor cl, 0x64
mov byte [rsp + 0xd2], cl
xor dl, 0x64
mov byte [rsp + 0xd3], dl
xor r8b, 0x64
mov byte [rsp + 0xd4], r8b
xor r9b, 0x64
mov byte [rsp + 0xd5], r9b
xor r10b, 0x64
mov byte [rsp + 0xd6], r10b
xor r11b, 0x64
mov byte [rsp + 0xd7], r11b
mov byte [rsp + 0xd8], bl
lea rdx, [rsp + 0xd1]
lea rcx, [rsp + 0x90]
call fcn.140007960
mov rdx, rax
lea rcx, [0x1402224d0]
call fcn.14002aed0
mov edi, eax
lea rax, [rsp + 0x300]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 5
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
je 0x14002e3d3
vmovdqu ymm0, ymmword [0x1401596c0]
vmovdqu ymmword [rsp + 0x30], ymm0
vmovdqu xmm1, xmmword [0x140158d50]
vmovdqu xmmword [rsp + 0x50], xmm1
mov cl, 0x44
mov r8b, reloc.WLDAP32.dll_Ordinal_22
mov r9b, 0x46
mov r10b, 0x57
mov r11b, 0x42
mov bl, 0x5e
mov dil, Ordinal_26
vpextrb eax, xmm0, 1
vmovd edx, xmm0
xor al, dl
mov byte [rsp + 0x31], al
xor byte [rsp + 0x32], dl
xor byte [rsp + 0x33], dl
xor byte [rsp + 0x34], dl
xor byte [rsp + 0x35], dl
xor byte [rsp + 0x36], dl
xor byte [rsp + 0x37], dl
xor byte [rsp + 0x38], dl
xor byte [rsp + 0x39], dl
xor byte [rsp + 0x3a], dl
xor byte [rsp + 0x3b], dl
xor byte [rsp + 0x3c], dl
xor byte [rsp + 0x3d], dl
xor byte [rsp + 0x3e], dl
xor byte [rsp + 0x3f], dl
xor byte [rsp + 0x40], dl
xor byte [rsp + 0x41], dl
xor byte [rsp + 0x42], dl
xor byte [rsp + 0x43], dl
xor byte [rsp + 0x44], dl
xor byte [rsp + 0x45], dl
xor byte [rsp + 0x46], dl
xor byte [rsp + 0x47], dl
xor byte [rsp + 0x48], dl
xor byte [rsp + 0x49], dl
xor byte [rsp + 0x4a], dl
xor byte [rsp + 0x4b], dl
xor byte [rsp + 0x4c], dl
xor byte [rsp + 0x4d], dl
xor byte [rsp + 0x4e], dl
xor byte [rsp + 0x4f], dl
vmovd eax, xmm1
xor al, dl
mov byte [rsp + 0x50], al
xor byte [rsp + 0x51], dl
xor byte [rsp + 0x52], dl
xor byte [rsp + 0x53], dl
xor byte [rsp + 0x54], dl
xor byte [rsp + 0x55], dl
xor byte [rsp + 0x56], dl
xor byte [rsp + 0x57], dl
xor byte [rsp + 0x58], dl
xor byte [rsp + 0x59], dl
xor byte [rsp + 0x5a], dl
xor byte [rsp + 0x5b], dl
xor byte [rsp + 0x5c], dl
xor byte [rsp + 0x5d], dl
xor byte [rsp + 0x5e], dl
xor byte [rsp + 0x5f], dl
xor cl, dl
mov byte [rsp + 0x60], cl
xor r8b, dl
mov byte [rsp + 0x61], r8b
xor r9b, dl
mov byte [rsp + 0x62], r9b
xor r10b, dl
mov byte [rsp + 0x63], r10b
xor r11b, dl
mov byte [rsp + 0x64], r11b
xor bl, dl
mov byte [rsp + 0x65], bl
xor dil, dl
mov byte [rsp + 0x66], dil
mov byte [rsp + 0x67], r12b
lea rdx, [rsp + 0x31]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
vzeroupper
call fcn.140023b80
lea rdx, [0x140023df0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, [rsp + 0x300]
lea rcx, [0x14021f698]
call fcn.1400224a0
vmovdqu xmm0, xmmword [str.7kyY_VdX_BCXY]
vmovdqu xmmword [rsp + 0x70], xmm0
vpextrb eax, xmm0, 1
vmovd ecx, xmm0
xor al, cl
mov byte [rsp + 0x71], al
xor byte [rsp + 0x72], cl
xor byte [rsp + 0x73], cl
xor byte [rsp + 0x74], cl
xor byte [rsp + 0x75], cl
xor byte [rsp + 0x76], cl
xor byte [rsp + 0x77], cl
xor byte [rsp + 0x78], cl
xor byte [rsp + 0x79], cl
xor byte [rsp + 0x7a], cl
xor byte [rsp + 0x7b], cl
xor byte [rsp + 0x7c], cl
xor byte [rsp + 0x7d], cl
xor byte [rsp + 0x7e], cl
mov byte [rsp + 0x7f], bl
lea rax, [rsp + 0x71]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], bl
jne 0x14002e450
lea rdx, [rsp + 0x71]
lea rcx, [0x14021f698]
call fcn.140030e20
lea rcx, [rsp + 0x90]
call fcn.14002be30
mov rdx, rax
lea rcx, [0x14021f5c8]
call fcn.140023110
lea rcx, [rsp + 0x90]
call fcn.140006ec0
mov r8, qword [0x14021f5d8]
add r8, 0xfffffffffffffff0
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x20], rax
mov r9, 0xffffffffffffffff
lea rdx, [0x14021f5c8]
lea rcx, [rsp + 0x90]
call fcn.14002a0f0
lea rcx, [rsp + 0x90]
call fcn.140009200
mov rdx, rax
lea rcx, [0x1401536a0]
call fcn.14002a830
lea rcx, [rsp + 0x90]
call fcn.140006ec0
mov r8, qword [0x14021f5d8]
add r8, 0xfffffffffffffff0
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x20], rax
mov r9, 0xffffffffffffffff
lea rdx, [0x14021f5c8]
lea rcx, [rsp + 0x70]
call fcn.14002a0f0
nop
lea rcx, [rsp + 0x70]
call fcn.140009200
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.140007960
nop
lea rcx, [rsp + 0x90]
call fcn.14002d450
movzx ebx, al
lea rcx, [rsp + 0x90]
call fcn.140006ec0
nop
lea rcx, [rsp + 0x70]
call fcn.140006ec0
test bl, bl
je 0x14002e56e
mov byte [0x14022209c], 1
sub edi, 1
je 0x14002f492
sub edi, 1
je 0x14002f3ad
cmp edi, 1
je 0x14002f249
call fcn.140033450
test al, al
jne 0x14002e6cd
mov edx, 4
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
vmovdqu ymm0, ymmword [0x140159700]
vmovdqu ymmword [rsp + 0x30], ymm0
vmovdqu xmm1, xmmword [0x140158990]
vmovdqu xmmword [rsp + 0x50], xmm1
vpextrb eax, xmm0, 1
vmovd edx, xmm0
xor al, dl
mov byte [rsp + 0x31], al
xor byte [rsp + 0x32], dl
xor byte [rsp + 0x33], dl
xor byte [rsp + 0x34], dl
xor byte [rsp + 0x35], dl
xor byte [rsp + 0x36], dl
xor byte [rsp + 0x37], dl
xor byte [rsp + 0x38], dl
xor byte [rsp + 0x39], dl
xor byte [rsp + 0x3a], dl
xor byte [rsp + 0x3b], dl
xor byte [rsp + 0x3c], dl
xor byte [rsp + 0x3d], dl
xor byte [rsp + 0x3e], dl
xor byte [rsp + 0x3f], dl
xor byte [rsp + 0x40], dl
xor byte [rsp + 0x41], dl
xor byte [rsp + 0x42], dl
xor byte [rsp + 0x43], dl
xor byte [rsp + 0x44], dl
xor byte [rsp + 0x45], dl
xor byte [rsp + 0x46], dl
xor byte [rsp + 0x47], dl
xor byte [rsp + 0x48], dl
xor byte [rsp + 0x49], dl
xor byte [rsp + 0x4a], dl
xor byte [rsp + 0x4b], dl
xor byte [rsp + 0x4c], dl
xor byte [rsp + 0x4d], dl
xor byte [rsp + 0x4e], dl
xor byte [rsp + 0x4f], dl
vmovd eax, xmm1
xor al, dl
mov byte [rsp + 0x50], al
xor byte [rsp + 0x51], dl
xor byte [rsp + 0x52], dl
xor byte [rsp + 0x53], dl
xor byte [rsp + 0x54], dl
xor byte [rsp + 0x55], dl
xor byte [rsp + 0x56], dl
xor byte [rsp + 0x57], dl
xor byte [rsp + 0x58], dl
xor byte [rsp + 0x59], dl
xor byte [rsp + 0x5a], dl
xor byte [rsp + 0x5b], dl
xor byte [rsp + 0x5c], dl
xor byte [rsp + 0x5d], dl
xor byte [rsp + 0x5e], dl
xor byte [rsp + 0x5f], dl
mov byte [rsp + 0x60], 0
lea rdx, [rsp + 0x31]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
vzeroupper
call fcn.140023b80
lea rdx, [0x140023df0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, [0x140222510]
call fcn.14002a6d0
test al, al
jne 0x14002e7df
mov edx, 4
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
vmovaps ymm0, ymmword [0x140159740]
vmovups ymmword [rsp + 0x100], ymm0
vmovaps ymm0, ymmword [0x1401590c0]
vmovups ymmword [rsp + 0x120], ymm0
vmovaps ymm0, ymmword [0x1401590a0]
vmovups ymmword [rsp + 0x140], ymm0
vmovdqu xmm0, xmmword [0x140158da0]
vmovdqu xmmword [rsp + 0x160], xmm0
mov dword [rsp + 0x170], 0x743d6f78
mov dword [rsp + 0x174], 0x7c703d6e
mov dword [rsp + 0x178], 0x79786d6d
xor eax, eax
mov byte [rsp + 0x17c], al
nop dword [rax]
movzx eax, byte [rsp + 0x100]
xor byte [rsp + r12 + 0x101], al
movzx eax, byte [rsp + 0x100]
xor byte [rsp + r12 + 0x102], al
movzx eax, byte [rsp + 0x100]
xor byte [rsp + r12 + 0x103], al
add r12, 3
cmp r12, 0x7b
jb 0x14002e760
mov byte [rsp + 0x17c], 0
lea rdx, [rsp + 0x101]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
vzeroupper
call fcn.140023b80
lea rdx, [0x140023df0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
vmovdqu xmm0, xmmword [0x140158ac0]
vmovdqu xmmword [rsp + 0x70], xmm0
mov r8b, 0x56
mov r9b, 0x5b
mov r10b, 0x25
mov r11b, 0x3f
vpextrb eax, xmm0, 1
vmovd edx, xmm0
xor al, dl
mov byte [rsp + 0x71], al
xor byte [rsp + 0x72], dl
xor byte [rsp + 0x73], dl
xor byte [rsp + 0x74], dl
xor byte [rsp + 0x75], dl
xor byte [rsp + 0x76], dl
xor byte [rsp + 0x77], dl
xor byte [rsp + 0x78], dl
xor byte [rsp + 0x79], dl
xor byte [rsp + 0x7a], dl
xor byte [rsp + 0x7b], dl
xor byte [rsp + 0x7c], dl
xor byte [rsp + 0x7d], dl
xor byte [rsp + 0x7e], dl
xor byte [rsp + 0x7f], dl
xor r8b, dl
mov byte [rsp + 0x80], r8b
xor r9b, dl
mov byte [rsp + 0x81], r9b
xor r10b, dl
mov byte [rsp + 0x82], r10b
xor r11b, dl
mov byte [rsp + 0x83], r11b
mov byte [rsp + 0x84], 0
lea rdx, [rsp + 0x71]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140023b80
mov edx, dword [0x1402224e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140023df0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
vmovdqu xmm0, xmmword [0x140158d70]
vmovdqu xmmword [rsp + 0x70], xmm0
mov cl, 0x4d
movzx r8d, cl
mov r9b, 0x5b
mov r10b, 0x4c
mov r11b, 0x5a
movzx ebx, r11b
mov dil, reloc.WS2_32.dll_send
mov sil, 9
vpextrb eax, xmm0, 1
vmovd edx, xmm0
xor al, dl
mov byte [rsp + 0x71], al
xor byte [rsp + 0x72], dl
xor byte [rsp + 0x73], dl
xor byte [rsp + 0x74], dl
xor byte [rsp + 0x75], dl
xor byte [rsp + 0x76], dl
xor byte [rsp + 0x77], dl
xor byte [rsp + 0x78], dl
xor byte [rsp + 0x79], dl
xor byte [rsp + 0x7a], dl
xor byte [rsp + 0x7b], dl
xor byte [rsp + 0x7c], dl
xor byte [rsp + 0x7d], dl
xor byte [rsp + 0x7e], dl
xor byte [rsp + 0x7f], dl
xor cl, dl
mov byte [rsp + 0x80], cl
xor r8b, dl
mov byte [rsp + 0x81], r8b
xor r9b, dl
mov byte [rsp + 0x82], r9b
xor r10b, dl
mov byte [rsp + 0x83], r10b
xor r11b, dl
mov byte [rsp + 0x84], r11b
xor bl, dl
mov byte [rsp + 0x85], bl
xor dil, dl
mov byte [rsp + 0x86], dil
xor sil, dl
mov byte [rsp + 0x87], sil
mov byte [rsp + 0x88], 0
lea rdx, [rsp + 0x71]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140023b80
mov rdx, qword [0x140222540]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
lea rdx, [0x140023df0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor r8d, r8d
lea rdx, [0x14021f698]
lea rcx, [rsp + 0x90]
call fcn.140031250
nop
lea rcx, [rsp + 0x90]
call fcn.14002cde0
movzx ebx, al
lea rcx, [rsp + 0x90]
call fcn.140006e50
test bl, bl
je 0x14002eaac
vmovdqu ymm0, ymmword [str._iNFO]
vmovdqu ymmword [rsp + 0x30], ymm0
xor r8b, r8b
vpextrb eax, xmm0, 1
vmovd edx, xmm0
xor al, dl
mov byte [rsp + 0x31], al
xor byte [rsp + 0x32], dl
xor byte [rsp + 0x33], dl
xor byte [rsp + 0x34], dl
xor byte [rsp + 0x35], dl
xor byte [rsp + 0x36], dl
xor byte [rsp + 0x37], dl
xor byte [rsp + 0x38], dl
xor byte [rsp + 0x39], dl
xor byte [rsp + 0x3a], dl
xor byte [rsp + 0x3b], dl
xor byte [rsp + 0x3c], dl
xor byte [rsp + 0x3d], dl
xor byte [rsp + 0x3e], dl
xor byte [rsp + 0x3f], dl
xor byte [rsp + 0x40], dl
xor byte [rsp + 0x41], dl
xor byte [rsp + 0x42], dl
xor byte [rsp + 0x43], dl
xor byte [rsp + 0x44], dl
xor byte [rsp + 0x45], dl
xor byte [rsp + 0x46], dl
xor byte [rsp + 0x47], dl
xor byte [rsp + 0x48], dl
xor byte [rsp + 0x49], dl
xor byte [rsp + 0x4a], dl
xor byte [rsp + 0x4b], dl
xor byte [rsp + 0x4c], dl
xor byte [rsp + 0x4d], dl
xor byte [rsp + 0x4e], dl
xor byte [rsp + 0x4f], dl
xor r8b, dl
mov byte [rsp + 0x50], r8b
mov byte [rsp + 0x51], 0
lea rdx, [rsp + 0x31]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
vzeroupper
call fcn.140023b80
mov rcx, rax
lea rdx, [0x14021f698]
call fcn.140023d60
jmp 0x14002ec1b
xor r8d, r8d
lea rdx, [0x14021f698]
lea rcx, [rsp + 0x90]
call fcn.140031250
nop
lea rcx, [rsp + 0x90]
call fcn.14002d080
movzx ebx, al
lea rcx, [rsp + 0x90]
call fcn.140006e50
test bl, bl
je 0x14002f0ec
vmovdqu ymm0, ymmword [str.nIAHz_adHIAN__aAHKCBU_aDUBFSBC]
vmovdqu ymmword [rsp + 0x90], ymm0
vpextrb eax, xmm0, 1
vmovd edx, xmm0
xor al, dl
mov byte [rsp + 0x91], al
xor byte [rsp + 0x92], dl
xor byte [rsp + 0x93], dl
xor byte [rsp + 0x94], dl
xor byte [rsp + 0x95], dl
xor byte [rsp + 0x96], dl
xor byte [rsp + 0x97], dl
xor byte [rsp + 0x98], dl
xor byte [rsp + 0x99], dl
xor byte [rsp + 0x9a], dl
xor byte [rsp + 0x9b], dl
xor byte [rsp + 0x9c], dl
xor byte [rsp + 0x9d], dl
xor byte [rsp + 0x9e], dl
xor byte [rsp + 0x9f], dl
xor byte [rsp + 0xa0], dl
xor byte [rsp + 0xa1], dl
xor byte [rsp + 0xa2], dl
xor byte [rsp + 0xa3], dl
xor byte [rsp + 0xa4], dl
xor byte [rsp + 0xa5], dl
xor byte [rsp + 0xa6], dl
xor byte [rsp + 0xa7], dl
xor byte [rsp + 0xa8], dl
xor byte [rsp + 0xa9], dl
xor byte [rsp + 0xaa], dl
xor byte [rsp + 0xab], dl
xor byte [rsp + 0xac], dl
xor byte [rsp + 0xad], dl
xor byte [rsp + 0xae], dl
mov byte [rsp + 0xaf], 0
lea rdx, [rsp + 0x91]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
vzeroupper
call fcn.140023b80
mov rdi, rax
mov rbx, qword [0x14021f6a8]
lea rcx, [0x14021f698]
call fcn.140009200
mov r8, rbx
mov rdx, rax
mov rcx, rdi
call fcn.1400259f0
lea rdx, [0x140023df0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor edx, edx
mov r8d, 0x110
lea rcx, [rsp + 0x1f0]
call sub.VCRUNTIME140.dll_memset
mov byte [rsp + 0x70], 0x42
mov al, reloc.WLDAP32.dll_Ordinal_30
mov cl, 0x26
mov dl, 0x27
mov r8b, 0x24
mov r9b, reloc.WLDAP32.dll_Ordinal_35
mov r10b, gethostname
mov r11b, reloc.WLDAP32.dll_Ordinal_46
mov bl, 0x36
mov dil, 0x6c
mov sil, Ordinal_60
mov r14b, 0x2f
movzx r15d, r11b
xor r12d, r12d
xor al, 0x42
mov byte [rsp + 0x71], al
xor cl, 0x42
mov byte [rsp + 0x72], cl
xor dl, 0x42
mov byte [rsp + 0x73], dl
xor r8b, 0x42
mov byte [rsp + 0x74], r8b
xor r9b, 0x42
mov byte [rsp + 0x75], r9b
xor r10b, 0x42
mov byte [rsp + 0x76], r10b
xor r11b, 0x42
mov byte [rsp + 0x77], r11b
xor bl, 0x42
mov byte [rsp + 0x78], bl
xor dil, 0x42
mov byte [rsp + 0x79], dil
xor sil, 0x42
mov byte [rsp + 0x7a], sil
xor r14b, 0x42
mov byte [rsp + 0x7b], r14b
xor r15b, 0x42
mov byte [rsp + 0x7c], r15b
mov byte [rsp + 0x7d], r12b
lea r8, [rsp + 0x71]
lea rdx, [0x14021f698]
lea rcx, [rsp + 0x1c8]
call fcn.140023360
nop
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 1
mov rdx, rax
lea rcx, [rsp + 0x1f0]
call fcn.140021780
nop
lea rcx, [rsp + 0x1c8]
call fcn.140006ec0
cmp qword [rsp + 0x280], r12
je 0x14002ed3b
mov byte [0x1402220b4], 1
lea rcx, [rsp + 0x1f0]
call fcn.1400216e0
call fcn.14002dbf0
lea rdx, [0x140023df0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, 2
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [0x1401536a4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 3
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Ninjasolutions.info_n_t
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140023b80
lea rdx, [0x140023df0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, 2
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
vmovdqu xmm0, xmmword [0x140158960]
vmovdqu xmmword [rsp + 0xb0], xmm0
mov cl, 0x5a
mov dl, 8
mov r9b, reloc.WS2_32.dll_ntohs
mov r10b, reloc.WS2_32.dll_sendto
movzx r11d, r10b
mov bl, reloc.WS2_32.dll_send
movzx edi, r10b
mov sil, Ordinal_30
mov r14b, 0x5b
vpextrb eax, xmm0, 1
vmovd r8d, xmm0
xor al, r8b
mov byte [rsp + 0xb1], al
xor byte [rsp + 0xb2], r8b
xor byte [rsp + 0xb3], r8b
xor byte [rsp + 0xb4], r8b
xor byte [rsp + 0xb5], r8b
xor byte [rsp + 0xb6], r8b
xor byte [rsp + 0xb7], r8b
xor byte [rsp + 0xb8], r8b
xor byte [rsp + 0xb9], r8b
xor byte [rsp + 0xba], r8b
xor byte [rsp + 0xbb], r8b
xor byte [rsp + 0xbc], r8b
xor byte [rsp + 0xbd], r8b
xor byte [rsp + 0xbe], r8b
xor byte [rsp + 0xbf], r8b
xor cl, r8b
mov byte [rsp + 0xc0], cl
xor dl, r8b
mov byte [rsp + 0xc1], dl
xor r9b, r8b
mov byte [rsp + 0xc2], r9b
xor r10b, r8b
mov byte [rsp + 0xc3], r10b
xor r11b, r8b
mov byte [rsp + 0xc4], r11b
xor bl, r8b
mov byte [rsp + 0xc5], bl
xor dil, r8b
mov byte [rsp + 0xc6], dil
xor sil, r8b
mov byte [rsp + 0xc7], sil
xor r14b, r8b
mov byte [rsp + 0xc8], r14b
mov byte [rsp + 0xc9], r12b
lea rdx, [rsp + 0xb1]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140023b80
lea rdx, [0x140023df0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, 2
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [0x140023df0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, 7
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
nop
lea rax, [rsp + 0x30]
mov qword [rsp + 0xe8], rax
mov qword [rsp + 0x68], r12
lea rdx, [0x14001b4f0]
lea rcx, [rsp + 0x30]
call fcn.140032640
nop
lea rax, [rsp + 0x90]
mov qword [rsp + 0xf0], rax
mov byte [rsp + 0xd0], Ordinal_26
mov al, 0x4a
mov cl, 0x5d
mov dl, 0x55
mov r8b, 0x46
mov r9b, 0x78
mov r10b, 0x69
movzx r11d, r10b
xor ebx, ebx
xor al, 0x19
mov byte [rsp + 0xd1], al
xor cl, 0x19
mov byte [rsp + 0xd2], cl
xor dl, 0x19
mov byte [rsp + 0xd3], dl
xor r8b, 0x19
mov byte [rsp + 0xd4], r8b
xor r9b, 0x19
mov byte [rsp + 0xd5], r9b
xor r10b, 0x19
mov byte [rsp + 0xd6], r10b
xor r11b, 0x19
mov byte [rsp + 0xd7], r11b
mov byte [rsp + 0xd8], bl
lea rdx, [rsp + 0xd1]
lea rcx, [rsp + 0x90]
call fcn.140007960
mov rbx, rax
vmovdqu xmm0, xmmword [0x1401589e0]
vmovdqu xmmword [rsp + 0xb0], xmm0
mov dl, reloc.WLDAP32.dll_Ordinal_46
vpextrb eax, xmm0, 1
vmovd ecx, xmm0
xor al, cl
mov byte [rsp + 0xb1], al
xor byte [rsp + 0xb2], cl
xor byte [rsp + 0xb3], cl
xor byte [rsp + 0xb4], cl
xor byte [rsp + 0xb5], cl
xor byte [rsp + 0xb6], cl
xor byte [rsp + 0xb7], cl
xor byte [rsp + 0xb8], cl
xor byte [rsp + 0xb9], cl
xor byte [rsp + 0xba], cl
xor byte [rsp + 0xbb], cl
xor byte [rsp + 0xbc], cl
xor byte [rsp + 0xbd], cl
xor byte [rsp + 0xbe], cl
xor byte [rsp + 0xbf], cl
xor dl, cl
mov byte [rsp + 0xc0], dl
mov byte [rsp + 0xc1], 0
lea rdx, [rsp + 0xb1]
lea rcx, [rsp + 0x1a8]
call fcn.140007960
nop
lea r9, [rsp + 0x30]
mov r8, rbx
mov rdx, rax
mov rcx, qword [0x1402225c8]
call fcn.14009a1d0
nop
lea rcx, [rsp + 0x2a0]
call fcn.140021720
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
mov rcx, qword [rsp + 0x418]
xor rcx, rsp
call fcn.14012e650
lea r11, [rsp + 0x420]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
vmovdqu ymm0, ymmword [str._vPBemdVNyydy1Mjbgno]
vmovdqu ymmword [rsp + 0x30], ymm0
vmovdqu xmm1, xmmword [0x140158d80]
vmovdqu xmmword [rsp + 0x50], xmm1
mov r8b, 0x7f
mov r9b, 0x64
mov r10b, 0x79
mov r11b, WSAStartup
mov bl, 0x25
vpextrb eax, xmm0, 1
vmovd edx, xmm0
xor al, dl
mov byte [rsp + 0x31], al
xor byte [rsp + 0x32], dl
xor byte [rsp + 0x33], dl
xor byte [rsp + 0x34], dl
xor byte [rsp + 0x35], dl
xor byte [rsp + 0x36], dl
xor byte [rsp + 0x37], dl
xor byte [rsp + 0x38], dl
xor byte [rsp + 0x39], dl
xor byte [rsp + 0x3a], dl
xor byte [rsp + 0x3b], dl
xor byte [rsp + 0x3c], dl
xor byte [rsp + 0x3d], dl
xor byte [rsp + 0x3e], dl
xor byte [rsp + 0x3f], dl
xor byte [rsp + 0x40], dl
xor byte [rsp + 0x41], dl
xor byte [rsp + 0x42], dl
xor byte [rsp + 0x43], dl
xor byte [rsp + 0x44], dl
xor byte [rsp + 0x45], dl
xor byte [rsp + 0x46], dl
xor byte [rsp + 0x47], dl
xor byte [rsp + 0x48], dl
xor byte [rsp + 0x49], dl
xor byte [rsp + 0x4a], dl
xor byte [rsp + 0x4b], dl
xor byte [rsp + 0x4c], dl
xor byte [rsp + 0x4d], dl
xor byte [rsp + 0x4e], dl
xor byte [rsp + 0x4f], dl
vmovd eax, xmm1
xor al, dl
mov byte [rsp + 0x50], al
xor byte [rsp + 0x51], dl
xor byte [rsp + 0x52], dl
xor byte [rsp + 0x53], dl
xor byte [rsp + 0x54], dl
xor byte [rsp + 0x55], dl
xor byte [rsp + 0x56], dl
xor byte [rsp + 0x57], dl
xor byte [rsp + 0x58], dl
xor byte [rsp + 0x59], dl
xor byte [rsp + 0x5a], dl
xor byte [rsp + 0x5b], dl
xor byte [rsp + 0x5c], dl
xor byte [rsp + 0x5d], dl
xor byte [rsp + 0x5e], dl
xor byte [rsp + 0x5f], dl
xor r8b, dl
mov byte [rsp + 0x60], r8b
xor r9b, dl
mov byte [rsp + 0x61], r9b
xor r10b, dl
mov byte [rsp + 0x62], r10b
xor r11b, dl
mov byte [rsp + 0x63], r11b
xor bl, dl
mov byte [rsp + 0x64], bl
mov byte [rsp + 0x65], 0
lea rdx, [rsp + 0x31]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
vzeroupper
call fcn.140023b80
lea rdx, [0x140023df0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov edx, 4
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
vmovdqu ymm0, ymmword [0x1401596a0]
vmovdqu ymmword [rsp + 0x30], ymm0
vmovdqu xmm1, xmmword [0x140158d30]
vmovdqu xmmword [rsp + 0x50], xmm1
mov r8b, 0x5a
mov r9b, 0x4c
movzx r10d, r9b
mov r11b, reloc.WS2_32.dll_recvfrom
vpextrb eax, xmm0, 1
vmovd edx, xmm0
xor al, dl
mov byte [rsp + 0x31], al
xor byte [rsp + 0x32], dl
xor byte [rsp + 0x33], dl
xor byte [rsp + 0x34], dl
xor byte [rsp + 0x35], dl
xor byte [rsp + 0x36], dl
xor byte [rsp + 0x37], dl
xor byte [rsp + 0x38], dl
xor byte [rsp + 0x39], dl
xor byte [rsp + 0x3a], dl
xor byte [rsp + 0x3b], dl
xor byte [rsp + 0x3c], dl
xor byte [rsp + 0x3d], dl
xor byte [rsp + 0x3e], dl
xor byte [rsp + 0x3f], dl
xor byte [rsp + 0x40], dl
xor byte [rsp + 0x41], dl
xor byte [rsp + 0x42], dl
xor byte [rsp + 0x43], dl
xor byte [rsp + 0x44], dl
xor byte [rsp + 0x45], dl
xor byte [rsp + 0x46], dl
xor byte [rsp + 0x47], dl
xor byte [rsp + 0x48], dl
xor byte [rsp + 0x49], dl
xor byte [rsp + 0x4a], dl
xor byte [rsp + 0x4b], dl
xor byte [rsp + 0x4c], dl
xor byte [rsp + 0x4d], dl
xor byte [rsp + 0x4e], dl
xor byte [rsp + 0x4f], dl
vmovd eax, xmm1
xor al, dl
mov byte [rsp + 0x50], al
xor byte [rsp + 0x51], dl
xor byte [rsp + 0x52], dl
xor byte [rsp + 0x53], dl
xor byte [rsp + 0x54], dl
xor byte [rsp + 0x55], dl
xor byte [rsp + 0x56], dl
xor byte [rsp + 0x57], dl
xor byte [rsp + 0x58], dl
xor byte [rsp + 0x59], dl
xor byte [rsp + 0x5a], dl
xor byte [rsp + 0x5b], dl
xor byte [rsp + 0x5c], dl
xor byte [rsp + 0x5d], dl
xor byte [rsp + 0x5e], dl
xor byte [rsp + 0x5f], dl
xor r8b, dl
mov byte [rsp + 0x60], r8b
xor r9b, dl
mov byte [rsp + 0x61], r9b
xor r10b, dl
mov byte [rsp + 0x62], r10b
xor r11b, dl
mov byte [rsp + 0x63], r11b
mov byte [rsp + 0x64], 0
lea rdx, [rsp + 0x31]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
vzeroupper
call fcn.140023b80
lea rdx, [0x140023df0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov edx, 4
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
vmovaps ymm0, ymmword [0x1401597c0]
vmovups ymmword [rsp + 0x100], ymm0
vmovaps ymm0, ymmword [0x1401597e0]
vmovups ymmword [rsp + 0x120], ymm0
vmovaps ymm0, ymmword [0x140159760]
vmovups ymmword [rsp + 0x140], ymm0
vmovaps ymm0, ymmword [0x1401596e0]
vmovups ymmword [rsp + 0x160], ymm0
mov dword [rsp + 0x180], 0x79627764
mov dword [rsp + 0x184], 0x383f64
nop word [rax + rax]
movzx eax, byte [rsp + 0x100]
xor byte [rsp + r12 + 0x101], al
movzx eax, byte [rsp + 0x100]
xor byte [rsp + r12 + 0x102], al
add r12, 2
cmp r12, 0x86
jb 0x14002f420
mov byte [rsp + 0x187], 0
lea rdx, [rsp + 0x101]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
vzeroupper
call fcn.140023b80
lea rdx, [0x140023df0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov edx, 4
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
vmovdqu ymm0, ymmword [0x1401597a0]
vmovdqu ymmword [rsp + 0x30], ymm0
mov cl, 0x2a
mov dl, 0x6d
mov r8b, 0x6b
mov r10b, 0x67
mov r11b, reloc.WS2_32.dll_WSAGetLastError
movzx ebx, cl
mov dil, 0x6c
mov sil, 0x63
mov r14b, 0x78
mov r15b, 0x79
mov r12b, 0x7e
mov r13b, 0x24
vpextrb eax, xmm0, 1
vmovd r9d, xmm0
xor al, r9b
mov byte [rsp + 0x31], al
xor byte [rsp + 0x32], r9b
xor byte [rsp + 0x33], r9b
xor byte [rsp + 0x34], r9b
xor byte [rsp + 0x35], r9b
xor byte [rsp + 0x36], r9b
xor byte [rsp + 0x37], r9b
xor byte [rsp + 0x38], r9b
xor byte [rsp + 0x39], r9b
xor byte [rsp + 0x3a], r9b
xor byte [rsp + 0x3b], r9b
xor byte [rsp + 0x3c], r9b
xor byte [rsp + 0x3d], r9b
xor byte [rsp + 0x3e], r9b
xor byte [rsp + 0x3f], r9b
xor byte [rsp + 0x40], r9b
xor byte [rsp + 0x41], r9b
xor byte [rsp + 0x42], r9b
xor byte [rsp + 0x43], r9b
xor byte [rsp + 0x44], r9b
xor byte [rsp + 0x45], r9b
xor byte [rsp + 0x46], r9b
xor byte [rsp + 0x47], r9b
xor byte [rsp + 0x48], r9b
xor byte [rsp + 0x49], r9b
xor byte [rsp + 0x4a], r9b
xor byte [rsp + 0x4b], r9b
xor byte [rsp + 0x4c], r9b
xor byte [rsp + 0x4d], r9b
xor byte [rsp + 0x4e], r9b
xor byte [rsp + 0x4f], r9b
xor cl, r9b
mov byte [rsp + 0x50], cl
xor dl, r9b
mov byte [rsp + 0x51], dl
xor r8b, r9b
mov byte [rsp + 0x52], r8b
xor r10b, r9b
mov byte [rsp + 0x53], r10b
xor r11b, r9b
mov byte [rsp + 0x54], r11b
xor bl, r9b
mov byte [rsp + 0x55], bl
xor dil, r9b
mov byte [rsp + 0x56], dil
xor sil, r9b
mov byte [rsp + 0x57], sil
xor r14b, r9b
mov byte [rsp + 0x58], r14b
xor r15b, r9b
mov byte [rsp + 0x59], r15b
xor r12b, r9b
mov byte [rsp + 0x5a], r12b
xor r13b, r9b
mov byte [rsp + 0x5b], r13b
mov byte [rsp + 0x5c], 0
lea rdx, [rsp + 0x31]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
vzeroupper
call fcn.140023b80
lea rdx, [0x140023df0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3