Function at 0x140061610
Capabilities:
Contain obfuscated stackstrings
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x338]
sub rsp, 0x420
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
movaps xmmword [rax - 0x48], xmm8
mov rax, qword [0x140324680]
xor rax, rsp
mov qword [rbp + 0x2e0], rax
xor r12d, r12d
lea rcx, [rbp + 0x10]
call fcn.1400606a0
nop
mov rdx, rax
lea rcx, [rbp - 0x10]
call fcn.14005fe50
mov rdx, rax
lea rcx, [0x14032e968]
call fcn.14006c970
mov rdx, qword [rbp + 8]
cmp rdx, 0xf
jbe 0x1400616b7
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400616b2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062765
call fcn.1402187c0
movdqa xmm6, xmmword [0x1402fb580]
movdqu xmmword [rbp], xmm6
mov byte [rbp - 0x10], 0
mov rdx, qword [rbp + 0x28]
cmp rdx, 0xf
jbe 0x140061703
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400616fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006276b
call fcn.1402187c0
cmp qword [0x14032e890], 0xa
jne 0x1400626fd
cmp qword [0x14032e8b0], 0x40
jne 0x1400626fd
mov dword [rsp + 0x46], 0x3d7669
mov dword [rsp + 0x40], 0x696e6926
mov word [rsp + 0x44], 0x5f74
mov byte [rsp + 0x4a], 0
lea rdx, [0x14032e880]
lea rcx, [rbp + 0x10]
call fcn.140060280
mov r15, rax
mov dword [rbp - 0x6a], 0x3d6469
mov dword [rbp - 0x70], 0x6e776f26
mov word [rbp - 0x6c], 0x7265
mov byte [rbp - 0x66], 0
lea rdx, [0x14032e860]
lea rcx, [rbp + 0x1b0]
call fcn.140060280
mov r14, rax
mov word [rsp + 0x35], 0x3d
mov dword [rsp + 0x30], 0x6d616e26
mov byte [rsp + 0x34], 0x65
mov byte [rsp + 0x37], 0
lea rax, [rbp + 0x210]
mov qword [rsp + 0x70], rax
lea rdx, [0x14032e810]
lea rcx, [rbp + 0x210]
call fcn.14006ca40
mov rdi, rax
lea rax, [rbp + 0x230]
mov qword [rsp + 0x38], rax
lea rdx, [0x14032e8a0]
lea rcx, [rbp + 0x230]
call fcn.14006ca40
mov rbx, rax
lea rdx, [0x14032e968]
lea rcx, [rbp + 0x250]
call fcn.14006ca40
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x190]
call fcn.1400607d0
mov rsi, rax
mov word [rbp - 0x79], 0x3d
mov dword [rbp - 0x80], 0x636e6526
mov word [rbp - 0x7c], 0x656b
mov byte [rbp - 0x7a], 0x79
mov byte [rbp - 0x77], 0
lea rax, [rbp + 0x1d0]
mov qword [rsp + 0x78], rax
lea rdx, [0x14032e810]
lea rcx, [rbp + 0x1d0]
call fcn.14006ca40
mov rdi, rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x70], rax
lea rdx, [0x14032e8a0]
lea rcx, [rbp - 0x60]
call fcn.14006ca40
mov rbx, rax
lea rdx, [0x14032e8c0]
lea rcx, [rbp + 0x2a0]
call fcn.14006ca40
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x170]
call fcn.1400607d0
mov rdi, rax
mov dword [rsp + 0x72], 0x3d7265
mov word [rsp + 0x70], 0x7626
mov byte [rsp + 0x76], 0
mov word [rsp + 0x3b], reloc.WS2_32.dll_WSACleanup
mov word [rsp + 0x38], 0x6e69
mov byte [rsp + 0x3a], 0x69
mov byte [rsp + 0x3d], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x80], xmm1
lea rax, [rsp + 0x38]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400618e0
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x70]
call fcn.14006fca0
nop
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x150]
call fcn.140060280
nop
mov dword [rsp + 0x3a], 0x3d6570
mov word [rsp + 0x38], 0x7974
mov byte [rsp + 0x3e], 0
lea rcx, [rsp + 0x38]
mov r9, rbx
inc r9
cmp byte [rcx + r9], 0
jne 0x140061926
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call fcn.140071360
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x60], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rax, [rsp + 0x70]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x140061974
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x50]
call fcn.14006c880
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x130], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x140], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, rdi
lea r8, [rbp + 0x130]
lea rcx, [rbp - 0x10]
call fcn.140071460
nop
lea rax, [rbp - 0x80]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400619d0
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x10]
call fcn.14006c880
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x110], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x120], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, rsi
lea r8, [rbp + 0x110]
lea rcx, [rbp + 0xd0]
call fcn.140071460
nop
lea rax, [rsp + 0x30]
mov r8, rbx
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140061a30
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0xd0]
call fcn.14006c880
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xf0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x100], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, r14
lea r8, [rbp + 0xf0]
lea rcx, [rbp + 0xb0]
call fcn.140071460
nop
lea rax, [rbp - 0x70]
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140061a90
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0xb0]
call fcn.14006c880
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, r15
lea r8, [rsp + 0x50]
lea rcx, [rbp + 0x90]
call fcn.140071460
nop
lea rax, [rsp + 0x40]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140061ae4
mov r8, rbx
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x90]
call fcn.14006c880
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x40], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rdx, [0x14032e810]
cmp qword [0x14032e828], 0xf
cmova rdx, qword [0x14032e810]
mov r8, qword [0x14032e820]
lea rcx, [rbp + 0x30]
call fcn.14006c880
movups xmm8, xmmword [rax]
movups xmmword [rbp + 0x2c0], xmm8
movups xmm7, xmmword [rax + 0x10]
movups xmmword [rbp + 0x2d0], xmm7
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rbp + 0x48]
cmp rdx, 0xf
jbe 0x140061bb6
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061bb1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062771
call fcn.1402187c0
movdqu xmmword [rbp + 0x40], xmm6
mov byte [rbp + 0x30], 0
mov rdx, qword [rbp + 0xa8]
cmp rdx, 0xf
jbe 0x140061c00
inc rdx
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061bfb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062777
call fcn.1402187c0
movdqu xmmword [rbp + 0xa0], xmm6
mov byte [rbp + 0x90], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140061c4d
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061c47
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006277d
call fcn.1402187c0
nop
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0xf
jbe 0x140061c8e
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061c89
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062783
call fcn.1402187c0
movdqu xmmword [rbp + 0xc0], xmm6
mov byte [rbp + 0xb0], 0
mov rdx, qword [rbp + 0x108]
cmp rdx, 0xf
jbe 0x140061cdf
inc rdx
mov rcx, qword [rbp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061cd9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062789
call fcn.1402187c0
nop
mov rdx, qword [rbp + 0xe8]
cmp rdx, 0xf
jbe 0x140061d20
inc rdx
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061d1b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006278f
call fcn.1402187c0
movdqu xmmword [rbp + 0xe0], xmm6
mov byte [rbp + 0xd0], 0
mov rdx, qword [rbp + 0x128]
cmp rdx, 0xf
jbe 0x140061d71
inc rdx
mov rcx, qword [rbp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061d6b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062795
call fcn.1402187c0
nop
mov rdx, qword [rbp + 8]
cmp rdx, 0xf
jbe 0x140061dac
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061da7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006279b
call fcn.1402187c0
movdqu xmmword [rbp], xmm6
mov byte [rbp - 0x10], 0
mov rdx, qword [rbp + 0x148]
cmp rdx, 0xf
jbe 0x140061df7
inc rdx
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061df1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400627a1
call fcn.1402187c0
nop
mov rdx, qword [rbp + 0x68]
cmp rdx, 0xf
jbe 0x140061e32
inc rdx
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061e2d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400627a7
call fcn.1402187c0
movdqu xmmword [rbp + 0x60], xmm6
mov byte [rbp + 0x50], 0
mov rdx, qword [rbp + 0x168]
cmp rdx, 0xf
jbe 0x140061e7c
inc rdx
mov rcx, qword [rbp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061e77
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400627ad
call fcn.1402187c0
movdqu xmmword [rbp + 0x160], xmm6
mov byte [rbp + 0x150], 0
mov rdx, qword [rbp + 0x88]
cmp rdx, 0xf
jbe 0x140061ec9
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061ec4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400627b3
call fcn.1402187c0
movdqu xmmword [rbp + 0x80], xmm6
mov byte [rbp + 0x70], 0
mov rdx, qword [rbp + 0x188]
cmp rdx, 0xf
jbe 0x140061f16
inc rdx
mov rcx, qword [rbp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061f11
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400627b9
call fcn.1402187c0
movdqu xmmword [rbp + 0x180], xmm6
mov byte [rbp + 0x170], 0
mov rdx, qword [rbp + 0x1a8]
cmp rdx, 0xf
jbe 0x140061f66
inc rdx
mov rcx, qword [rbp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061f61
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400627bf
call fcn.1402187c0
movdqu xmmword [rbp + 0x1a0], xmm6
mov byte [rbp + 0x190], 0
mov rdx, qword [rbp + 0x1c8]
cmp rdx, 0xf
jbe 0x140061fb6
inc rdx
mov rcx, qword [rbp + 0x1b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061fb1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400627c5
call fcn.1402187c0
movdqu xmmword [rbp + 0x1c0], xmm6
mov byte [rbp + 0x1b0], 0
mov rdx, qword [rbp + 0x28]
cmp rdx, 0xf
jbe 0x140062000
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061ffb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400627cb
call fcn.1402187c0
movdqu xmmword [rbp + 0x20], xmm6
mov byte [rbp + 0x10], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r12
lea r14, [rbp + 0x2c0]
movq rsi, xmm8
movdqa xmm0, xmm7
psrldq xmm0, 8
movq r15, xmm0
cmp r15, 0xf
cmova r14, rsi
movabs rbx, 0x7fffffffffffffff
movq rdi, xmm7
cmp rdi, rbx
ja 0x1400627d1
cmp rdi, 0xf
ja 0x140062077
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
movups xmm0, xmmword [r14]
movups xmmword [rsp + 0x50], xmm0
jmp 0x14006210b
mov rax, rdi
or rax, 0xf
cmp rax, rbx
jbe 0x1400620b3
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1402188bc
mov rcx, rax
test rax, rax
je 0x1400627d7
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400620ed
mov rbx, rax
mov ecx, reloc.WS2_32.dll_shutdown
cmp rax, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x1400620d0
mov rax, r12
jmp 0x1400620ed
cmp rcx, 0x1000
jb 0x1400620e8
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14006269f
jmp 0x140062091
call fcn.1402188bc
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rbx
lea r8, [rdi + 1]
mov rdx, r14
mov rcx, rax
call fcn.140256ba0
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x280]
call fcn.140065120
nop
lea rax, [rbp + 0x2a0]
mov qword [rsp + 0x78], rax
lea rdx, [0x14032e810]
lea rcx, [rbp + 0x2a0]
call fcn.14006ca40
mov rdi, rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x30], rax
lea rdx, [0x14032e8a0]
lea rcx, [rbp - 0x60]
call fcn.14006ca40
mov rbx, rax
lea rdx, [rbp + 0x280]
lea rcx, [rbp + 0x1d0]
call fcn.14006ca40
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.140060ae0
mov rbx, rax
lea rax, [rbp + 0x280]
cmp rax, rbx
je 0x140062204
mov rdx, qword [rbp + 0x298]
cmp rdx, 0xf
jbe 0x1400621d1
inc rdx
mov rcx, qword [rbp + 0x280]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400621cc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400627dd
call fcn.1402187c0
movdqu xmmword [rbp + 0x290], xmm6
mov byte [rbp + 0x280], 0
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x280], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x290], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rbp + 0x28]
cmp rdx, 0xf
jbe 0x14006223f
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006223a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400627dd
call fcn.1402187c0
mov qword [rbp + 0x208], r12
lea r8, [rbp + 0x1d0]
lea rdx, [rbp + 0x280]
lea rcx, [rbp + 0x270]
call fcn.14006efa0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r12
mov r8d, 7
lea rdx, str.success
lea rcx, [rsp + 0x50]
call fcn.14006fca0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x78], rax
movzx ecx, byte [rbp + 0x270]
test cl, cl
jne 0x1400622bb
mov byte [rbp + 0x270], 1
call fcn.140070090
mov qword [rbp + 0x278], rax
movzx ecx, byte [rbp + 0x270]
jmp 0x1400622c2
mov rax, qword [rbp + 0x278]
cmp cl, 1
jne 0x14006265a
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.140078ce0
mov rbx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14006231f
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006231a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400627e3
call fcn.1402187c0
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x50], 0
cmp byte [rbx + 0x40], 4
jne 0x1400627e9
xorps xmm0, xmm0
lea rcx, [rsp + 0x50]
cmp byte [rbx + 0x48], 0
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r12
movups xmmword [rsp + 0x50], xmm0
je 0x14006251d
mov r8d, 9
lea rdx, str.sessionid
call fcn.14006fca0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x78], rax
movzx ecx, byte [rbp + 0x270]
test cl, cl
jne 0x1400623a0
mov byte [rbp + 0x270], 1
call fcn.140070090
mov qword [rbp + 0x278], rax
movzx ecx, byte [rbp + 0x270]
jmp 0x1400623a7
mov rax, qword [rbp + 0x278]
cmp cl, 1
jne 0x140062875
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.140078ce0
mov rbx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140062404
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400623ff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062826
call fcn.1402187c0
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x50], 0
cmp byte [rbx + 0x40], 3
jne 0x14006282c
mov r8, qword [rbx + 0x48]
mov rdx, r8
cmp qword [r8 + 0x18], 0xf
jbe 0x140062432
mov rdx, qword [r8]
mov r8, qword [r8 + 0x10]
lea rcx, [0x14032e948]
call fcn.14006db70
nop
movzx edx, byte [rbp + 0x270]
lea rcx, [rbp + 0x278]
call fcn.14006dd10
nop
mov rdx, qword [rbp + 0x298]
cmp rdx, 0xf
jbe 0x140062498
inc rdx
mov rcx, qword [rbp + 0x280]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062493
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062869
call fcn.1402187c0
movdqu xmmword [rbp + 0x290], xmm6
mov byte [rbp + 0x280], 0
cmp r15, 0xf
jbe 0x1400624de
lea rdx, [r15 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400624d6
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006286f
mov rcx, rsi
call fcn.1402187c0
mov rcx, qword [rbp + 0x2e0]
xor rcx, rsp
call fcn.1402187a0
lea r11, [rsp + 0x420]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov r8d, 7
lea rdx, str.message
call fcn.14006fca0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x78], rax
movzx ecx, byte [rbp + 0x270]
test cl, cl
jne 0x140062560
mov byte [rbp + 0x270], 1
call fcn.140070090
mov qword [rbp + 0x278], rax
movzx ecx, byte [rbp + 0x270]
jmp 0x140062567
mov rax, qword [rbp + 0x278]
cmp cl, 1
jne 0x140062917
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.140078ce0
mov rdi, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x1400625c4
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400625bf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400628ba
call fcn.1402187c0
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x50], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xor eax, eax
mov qword [rsp + 0x48], rax
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.14006dd10
mov byte [rsp + 0x40], 3
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1402188bc
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], r12
mov r8d, 0xa
lea rdx, str.invalidver
mov rcx, rax
call fcn.14006fca0
mov qword [rsp + 0x48], rbx
lea rdx, [rsp + 0x40]
lea rcx, [rdi + 0x40]
call fcn.140070ee0
movzx ebx, al
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.14006dd10
nop
test bl, bl
je 0x1400628c0
jmp 0x1400626a5
lea rcx, [rbp + 0x270]
call fcn.14006d860
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x30]
lea rcx, [rbp + 0x2a0]
call fcn.1400778e0
nop
mov r8, rax
mov edx, 0x131
lea rcx, [rbp - 0x60]
call fcn.14006f790
lea rdx, [0x14031d1d0]
lea rcx, [rbp - 0x60]
call fcn.14021acc4
nop
call fcn.14005ba00
nop
lea rdx, str.download
lea rcx, [rbp + 0x270]
call fcn.14006f0c0
lea rdx, [rbp + 0x2a0]
mov rcx, rax
call fcn.14006f1e0
lea rcx, [rbp + 0x2a0]
call fcn.14006c870
mov r8, rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor ecx, ecx
call fcn.1402274ec
nop
movdqa xmm0, xmmword [0x1402fb6a0]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm1, xmmword [0x1402fb6f0]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm0, xmmword [0x1402fb6e0]
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [0x1402fb6d0]
movdqa xmmword [rbp - 0x30], xmm1
mov dword [rbp - 0x20], 0xdbd0fd8f
mov dword [rbp - 0x1c], 0xc6d69add
mov word [rbp - 0x18], Ordinal_200
mov byte [rbp - 0x16], 1
lea rdx, [rbp - 0x60]
call fcn.140062960
mov ecx, 0x1194
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call fcn.1402274ec
nop
call fcn.14022ca90
nop
call fcn.14022ca90
nop
call fcn.14022ca90
nop
call fcn.14022ca90
nop
call fcn.14022ca90
nop
call fcn.14022ca90
nop
call fcn.14022ca90
nop
call fcn.14022ca90
nop
call fcn.14022ca90
nop
call fcn.14022ca90
nop
call fcn.14022ca90
nop
call fcn.14022ca90
nop
call fcn.14022ca90
nop
call fcn.14022ca90
nop
call fcn.14022ca90
nop
call fcn.14022ca90
nop
call fcn.14022ca90
nop
call fcn.14022ca90
int3
call fcn.14005baa0
int3
call fcn.14022ca90
nop
call fcn.14022ca90
nop
call fcn.14022ca90
int3
lea rcx, [rbx + 0x40]
call fcn.14006d860
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x30]
lea rcx, [rbp + 0x2a0]
call fcn.14007d340
nop
mov r8, rax
lea rcx, [rbp - 0x60]
call fcn.14007d100
lea rdx, [0x14031d1d0]
lea rcx, [rbp - 0x60]
call fcn.14021acc4
nop
call fcn.14022ca90
int3
lea rcx, [rbx + 0x40]
call fcn.14006d860
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x30]
lea rcx, [rbp + 0x2a0]
call fcn.14007d050
nop
mov r8, rax
lea rcx, [rbp - 0x60]
call fcn.14007d100
lea rdx, [0x14031d1d0]
lea rcx, [rbp - 0x60]
call fcn.14021acc4
nop
call fcn.14022ca90
nop
call fcn.14022ca90
nop
lea rcx, [rbp + 0x270]
call fcn.14006d860
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x30]
lea rcx, [rbp + 0x2a0]
call fcn.1400778e0
nop
mov r8, rax
mov edx, 0x131
lea rcx, [rbp - 0x60]
call fcn.14006f790
lea rdx, [0x14031d1d0]
lea rcx, [rbp - 0x60]
call fcn.14021acc4
nop
call fcn.14022ca90
int3
lea rdx, [0x1402f90c4]
call fcn.14006ecc0
lea rdx, str.message
lea rcx, [rbp + 0x270]
call fcn.14006f0c0
mov rdx, rax
lea rcx, [rbp + 0x2a0]
call fcn.14006f280
nop
mov rdx, rax
call fcn.14006f310
nop
lea rcx, [rbp + 0x2a0]
call fcn.14006c910
mov ecx, 0x1194
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call fcn.1402274ec
nop
lea rcx, [rbp + 0x270]
call fcn.14006d860
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x30]
lea rcx, [rbp + 0x2a0]
call fcn.1400778e0
nop
mov r8, rax
mov edx, 0x131
lea rcx, [rbp - 0x60]
call fcn.14006f790
lea rdx, [0x14031d1d0]
lea rcx, [rbp - 0x60]
call fcn.14021acc4
int3