Function at 0x140010e30
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Delete file
Get common file path
Move file

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xdf0]
sub rsp, 0xef0
mov rax, qword [0x14008c070]
xor rax, rsp
mov qword [rbp + 0xde0], rax
mov r13d, edx
mov dword [rsp + 0x50], ecx
xor r15d, r15d
mov dword [rsp + 0x58], r15d
lea r12, [0x1400803e8]
mov qword [rbp + 0x190], r12
lea rbx, [0x1400803e0]
mov qword [rbp + 0x1a0], rbx
lea rcx, [rbp + 0x228]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rsp + 0x58], 1
xor r8d, r8d
lea rdx, [rbp + 0x1a8]
lea rcx, [rbp + 0x190]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_iostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64____ptr64]
nop
mov rax, qword [rbp + 0x190]
movsxd rcx, dword [rax + 4]
lea rsi, vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx + 0x190], rsi
mov rax, qword [rbp + 0x190]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx + 0x18c], edx
lea rcx, [rbp + 0x1a8]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rdi, vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + 0x1a8], rdi
mov qword [rbp + 0x210], r15
mov dword [rbp + 0x218], r15d
mov edx, r13d
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov qword [rbp + 0x2d0], r12
mov qword [rbp + 0x2e0], rbx
lea rcx, [rbp + 0x368]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rsp + 0x58], 3
xor r8d, r8d
lea rdx, [rbp + 0x2e8]
lea rcx, [rbp + 0x2d0]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_iostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64____ptr64]
nop
mov rax, qword [rbp + 0x2d0]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x2d0], rsi
mov rax, qword [rbp + 0x2d0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx + 0x2cc], edx
lea rcx, [rbp + 0x2e8]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
mov qword [rbp + 0x2e8], rdi
mov qword [rbp + 0x350], r15
mov dword [rbp + 0x358], r15d
mov edx, dword [rsp + 0x50]
lea rcx, [rbp + 0x2e0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
lea rax, [rbp + 0x550]
mov qword [rsp + 0x70], rax
lea rax, [rbp + 0x5f0]
mov qword [rsp + 0x58], rax
lea rdx, [0x14008c1b8]
lea rcx, [rbp + 0x550]
call fcn.1400065f0
mov rbx, rax
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x40], r15
mov edi, reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x38], rdi
lea r8d, [r15 + 9]
lea rdx, [0x140080ab0]
lea rcx, [rbp - 0x50]
call fcn.1400067c0
nop
mov r9, rbx
lea r8d, [r15 + 9]
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0xa70]
call fcn.140010cb0
mov rsi, rax
lea rdx, [0x14008c1b8]
lea rcx, [rbp + 0x5f0]
call fcn.1400065f0
mov rbx, rax
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], rdi
lea r8d, [r15 + 7]
lea rdx, [0x140080ac0]
lea rcx, [rbp - 0x30]
call fcn.1400067c0
nop
mov r9, rbx
lea r8d, [r15 + 7]
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0xa90]
call fcn.140010cb0
mov rbx, rax
lea r8d, [r15 + 6]
lea rdx, str.b3Blbg
lea rcx, [rbp + 0x9f0]
call fcn.140014130
cmp qword [rsi + 0x18], 0x10
jb 0x14001109e
mov rsi, qword [rsi]
cmp qword [rbx + 0x18], 0x10
jb 0x1400110a8
mov rbx, qword [rbx]
cmp qword [rax + 0x18], 0x10
jb 0x1400110b2
mov rax, qword [rax]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
mov r9, rsi
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rdx, qword [rbp + 0xa08]
cmp rdx, 0x10
jb 0x140011111
inc rdx
mov rcx, qword [rbp + 0x9f0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001110c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001110c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006cd20
mov qword [rbp + 0xa00], r15
mov qword [rbp + 0xa08], rdi
mov byte [rbp + 0x9f0], 0
mov rdx, qword [rbp + 0xaa8]
cmp rdx, 0x10
jb 0x14001116a
inc rdx
mov rcx, qword [rbp + 0xa90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011165
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140011165
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006cd20
mov qword [rbp + 0xaa0], r15
mov qword [rbp + 0xaa8], rdi
mov byte [rbp + 0xa90], 0
mov rdx, qword [rbp + 0xa88]
cmp rdx, 0x10
jb 0x1400111c3
inc rdx
mov rcx, qword [rbp + 0xa70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400111be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400111be
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006cd20
mov qword [rbp + 0xa80], r15
mov qword [rbp + 0xa88], rdi
mov byte [rbp + 0xa70], 0
lea rax, [rbp + 0x610]
mov qword [rsp + 0x60], rax
lea rdx, [0x14008c1b8]
lea rcx, [rbp + 0x610]
call fcn.1400065f0
mov rbx, rax
lea rdx, [0x14008c2f8]
lea rcx, [rbp + 0x170]
call fcn.1400065f0
nop
mov r9, rbx
mov r8d, 9
mov rdx, rax
lea rcx, [rbp + 0x810]
call fcn.140010cb0
cmp qword [rax + 0x18], 0x10
jb 0x140011230
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rdx, qword [rbp + 0x828]
cmp rdx, 0x10
jb 0x14001127d
inc rdx
mov rcx, qword [rbp + 0x810]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011278
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140011278
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006cd20
mov qword [rbp + 0x820], r15
mov qword [rbp + 0x828], rdi
mov byte [rbp + 0x810], 0
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, 0x104
lea rdx, [rbp + 0xcd0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov qword [rbp + 0x8d0], r15
movdqa xmm0, xmmword [0x140080e90]
movdqu xmmword [rbp + 0x8e0], xmm0
mov byte [rbp + 0x8d0], 0
lea rax, [rbp + 0xcd0]
mov r14, 0xffffffffffffffff
mov r8, r14
inc r8
cmp byte [rax + r8], 0
jne 0x1400112e1
lea rdx, [rbp + 0xcd0]
lea rcx, [rbp + 0x8d0]
call fcn.1400067c0
nop
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov ebx, eax
mov eax, 0x14f8b589
imul ebx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x186a0
sub ebx, eax
mov qword [rbp + 0x70], r12
lea rax, [0x1400803e0]
mov qword [rbp + 0x80], rax
lea rcx, [rbp + 0x108]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rsp + 0x58], edi
xor r8d, r8d
lea rdx, [rbp + 0x88]
lea rcx, [rbp + 0x70]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_iostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64____ptr64]
nop
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx + 0x70], rax
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
lea r8d, [rcx - 0x98]
mov dword [rbp + rcx + 0x6c], r8d
lea rcx, [rbp + 0x88]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rax, vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + 0x88], rax
mov qword [rbp + 0xf0], r15
mov dword [rbp + 0xf8], r15d
mov edx, ebx
lea rcx, [rbp + 0x80]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
lea rax, [rbp + 0x630]
mov qword [rsp + 0x60], rax
lea rdx, [rbp + 0x8d0]
cmp qword [rbp + 0x8e8], 0x10
cmovae rdx, qword [rbp + 0x8d0]
mov r8d, dword [rbp + 0x8e0]
lea rcx, [rbp + 0x9d0]
call fcn.140013e30
mov r12, rax
mov qword [rbp + 0x870], r15
mov qword [rbp + 0x880], r15
mov qword [rbp + 0x888], rdi
mov byte [rbp + 0x870], 0
mov dword [rsp + 0x58], Ordinal_50
mov edx, dword [rbp + 0xf8]
mov ecx, edx
and cl, 0x22
cmp cl, 2
je 0x140011458
mov rax, qword [rbp + 0xc8]
mov r8, qword [rax]
test r8, r8
je 0x140011458
mov rax, qword [rbp + 0xa8]
mov rdx, qword [rax]
mov qword [rsp + 0x70], r8
cmp r8, qword [rbp + 0xf0]
cmovb r8, qword [rbp + 0xf0]
sub r8, rdx
jmp 0x140011486
test dl, 4
jne 0x140011498
mov rax, qword [rbp + 0xc0]
mov rcx, qword [rax]
test rcx, rcx
je 0x140011498
mov rax, qword [rbp + 0xa0]
mov rdx, qword [rax]
mov rax, qword [rbp + 0xd8]
movsxd r8, dword [rax]
sub r8, rdx
add r8, rcx
test rdx, rdx
je 0x140011498
lea rcx, [rbp + 0x870]
call fcn.1400067c0
nop
mov qword [rbp + 0x850], r15
mov qword [rbp + 0x860], r15
mov qword [rbp + 0x868], rdi
mov byte [rbp + 0x850], 0
mov dword [rsp + 0x58], 0x9f
mov ecx, dword [rbp + 0x358]
mov eax, ecx
and al, 0x22
cmp al, 2
je 0x1400114fb
mov rax, qword [rbp + 0x328]
mov r8, qword [rax]
test r8, r8
je 0x1400114fb
mov rax, qword [rbp + 0x308]
mov rdx, qword [rax]
mov qword [rbp - 0x78], r8
cmp r8, qword [rbp + 0x350]
cmovb r8, qword [rbp + 0x350]
sub r8, rdx
jmp 0x140011529
test cl, 4
jne 0x14001153b
mov rax, qword [rbp + 0x320]
mov rcx, qword [rax]
test rcx, rcx
je 0x14001153b
mov rax, qword [rbp + 0x300]
mov rdx, qword [rax]
mov rax, qword [rbp + 0x338]
movsxd r8, dword [rax]
sub r8, rdx
add r8, rcx
test rdx, rdx
je 0x14001153b
lea rcx, [rbp + 0x850]
call fcn.1400067c0
nop
mov qword [rbp + 0x830], r15
mov qword [rbp + 0x840], r15
mov qword [rbp + 0x848], rdi
mov byte [rbp + 0x830], 0
mov dword [rsp + 0x58], 0x25f
mov ecx, dword [rbp + 0x218]
mov eax, ecx
and al, 0x22
cmp al, 2
je 0x14001159f
mov rax, qword [rbp + 0x1e8]
mov r8, qword [rax]
test r8, r8
je 0x14001159f
mov rax, qword [rbp + 0x1c8]
mov rdx, qword [rax]
mov qword [rsp + 0x78], r8
cmp r8, qword [rbp + 0x210]
cmovb r8, qword [rbp + 0x210]
sub r8, rdx
jmp 0x1400115cd
test cl, 4
jne 0x1400115df
mov rax, qword [rbp + 0x1e0]
mov rcx, qword [rax]
test rcx, rcx
je 0x1400115df
mov rax, qword [rbp + 0x1c0]
mov rdx, qword [rax]
mov rax, qword [rbp + 0x1f8]
movsxd r8, dword [rax]
sub r8, rdx
add r8, rcx
test rdx, rdx
je 0x1400115df
lea rcx, [rbp + 0x830]
call fcn.1400067c0
nop
lea rdx, [0x14008c1b8]
lea rcx, [rbp + 0x630]
call fcn.1400065f0
mov rbx, rax
mov qword [rbp + 0x10], r15
mov qword [rbp + 0x20], r15
mov qword [rbp + 0x28], rdi
mov r8d, 9
lea rdx, str.PUR_nC_
lea rcx, [rbp + 0x10]
call fcn.1400067c0
nop
mov r9, rbx
mov r8d, 9
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x9b0]
call fcn.140010cb0
mov rsi, rax
lea r9, [0x14008c178]
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae r9, qword [0x14008c178]
mov r15, qword [0x14008c188]
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rax, rdx
sub rax, rcx
cmp r15, rax
ja 0x140011692
lea rax, [rcx + r15]
mov qword [rsi + 0x10], rax
mov rax, rsi
cmp rdx, 0x10
jb 0x140011679
mov rax, qword [rsi]
lea rbx, [rax + rcx]
mov r8, r15
mov rdx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + r15], 0
jmp 0x1400116a5
mov qword [rsp + 0x20], r15
mov rdx, r15
mov rcx, rsi
call fcn.140006460
mov rsi, rax
xor r15d, r15d
mov qword [rbp + 0x750], r15
mov qword [rbp + 0x760], r15
mov qword [rbp + 0x768], r15
movups xmm0, xmmword [rsi]
movups xmmword [rbp + 0x750], xmm0
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [rbp + 0x760], xmm1
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], rdi
mov byte [rsi], r15b
mov rcx, qword [rbp + 0x760]
mov rdx, qword [rbp + 0x768]
mov rax, rdx
sub rax, rcx
cmp rax, 3
jb 0x140011738
lea rax, [rcx + 3]
mov qword [rbp + 0x760], rax
lea rbx, [rbp + 0x750]
cmp rdx, 0x10
cmovae rbx, qword [rbp + 0x750]
add rbx, rcx
lea r8d, [r15 + 3]
lea rdx, [0x140080a1c]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 3], r15b
lea rax, [rbp + 0x750]
jmp 0x140011759
mov qword [rsp + 0x20], 3
lea r9, [0x140080a1c]
mov edx, 3
lea rcx, [rbp + 0x750]
call fcn.140006460
mov qword [rbp + 0x730], r15
mov qword [rbp + 0x740], r15
mov qword [rbp + 0x748], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x730], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x740], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], rdi
mov byte [rax], 0
lea r9, [0x14008c158]
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae r9, qword [0x14008c158]
mov rsi, qword [0x14008c168]
mov rcx, qword [rbp + 0x740]
mov rdx, qword [rbp + 0x748]
mov rax, rdx
sub rax, rcx
cmp rsi, rax
ja 0x140011801
lea rax, [rcx + rsi]
mov qword [rbp + 0x740], rax
lea rbx, [rbp + 0x730]
cmp rdx, 0x10
cmovae rbx, qword [rbp + 0x730]
add rbx, rcx
mov r8, rsi
mov rdx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rsi], 0
lea rax, [rbp + 0x730]
jmp 0x140011815
mov qword [rsp + 0x20], rsi
mov rdx, rsi
lea rcx, [rbp + 0x730]
call fcn.140006460
mov qword [rbp + 0x710], r15
mov qword [rbp + 0x720], r15
mov qword [rbp + 0x728], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x710], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x720], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], rdi
mov byte [rax], 0
mov rcx, qword [rbp + 0x720]
mov rdx, qword [rbp + 0x728]
mov rax, rdx
sub rax, rcx
cmp rax, 3
jb 0x1400118a7
lea rax, [rcx + 3]
mov qword [rbp + 0x720], rax
lea rbx, [rbp + 0x710]
cmp rdx, 0x10
cmovae rbx, qword [rbp + 0x710]
add rbx, rcx
mov r8d, 3
lea rdx, [0x140080bd4]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 3], 0
lea rax, [rbp + 0x710]
jmp 0x1400118c8
mov qword [rsp + 0x20], 3
lea r9, [0x140080bd4]
mov edx, 3
lea rcx, [rbp + 0x710]
call fcn.140006460
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x770], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x780], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], rdi
mov byte [rax], 0
lea r9, [rbp + 0x830]
lea r8, [rbp + 0x770]
lea rcx, [rbp + 0x7f0]
call fcn.14000b4c0
nop
mov rcx, qword [rbp + 0x800]
mov rdx, qword [rbp + 0x808]
mov rax, rdx
sub rax, rcx
cmp rax, 3
jb 0x140011960
lea rax, [rcx + 3]
mov qword [rbp + 0x800], rax
lea rbx, [rbp + 0x7f0]
cmp rdx, 0x10
cmovae rbx, qword [rbp + 0x7f0]
add rbx, rcx
mov r8d, 3
lea rdx, [0x140080bd0]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 3], 0
lea rax, [rbp + 0x7f0]
jmp 0x140011981
mov qword [rsp + 0x20], 3
lea r9, [0x140080bd0]
mov edx, 3
lea rcx, [rbp + 0x7f0]
call fcn.140006460
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x910], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x920], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], rdi
mov byte [rax], 0
lea r9, [rbp + 0x850]
lea r8, [rbp + 0x910]
lea rcx, [rbp + 0x7d0]
call fcn.14000b4c0
nop
mov rcx, qword [rbp + 0x7e0]
mov rdx, qword [rbp + 0x7e8]
mov rax, rdx
sub rax, rcx
cmp rax, 4
jb 0x140011a09
lea rax, [rcx + 4]
mov qword [rbp + 0x7e0], rax
lea rax, [rbp + 0x7d0]
cmp rdx, 0x10
cmovae rax, qword [rbp + 0x7d0]
mov dword [rax + rcx], 0x3d696e26
mov byte [rax + rcx + 4], 0
lea rax, [rbp + 0x7d0]
jmp 0x140011a2a
mov qword [rsp + 0x20], 4
lea r9, str.ni
mov edx, 4
lea rcx, [rbp + 0x7d0]
call fcn.140006460
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x950], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x960], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], rdi
mov byte [rax], 0
lea r9, [rbp + 0x870]
lea r8, [rbp + 0x950]
lea rcx, [rbp + 0x7b0]
call fcn.14000b4c0
nop
mov rcx, qword [rbp + 0x7c0]
mov rdx, qword [rbp + 0x7c8]
mov rax, rdx
sub rax, rcx
cmp rax, 3
jb 0x140011ac2
lea rax, [rcx + 3]
mov qword [rbp + 0x7c0], rax
lea rbx, [rbp + 0x7b0]
cmp rdx, 0x10
cmovae rbx, qword [rbp + 0x7b0]
add rbx, rcx
mov r8d, 3
lea rdx, [0x140080bc4]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 3], 0
lea rax, [rbp + 0x7b0]
jmp 0x140011ae3
mov qword [rsp + 0x20], 3
lea r9, [0x140080bc4]
mov edx, 3
lea rcx, [rbp + 0x7b0]
call fcn.140006460
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x970], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x980], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], rdi
mov byte [rax], 0
mov r9, r12
lea r8, [rbp + 0x970]
lea rcx, [rbp + 0x2b0]
call fcn.14000b4c0
mov esi, 0x1ffd5f
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x2b0]
lea rcx, [rbp + 0x790]
call fcn.140014ae0
nop
mov rdx, qword [rbp + 0x988]
cmp rdx, 0x10
jb 0x140011b7c
inc rdx
mov rcx, qword [rbp + 0x970]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011b77
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140011b77
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006cd20
mov qword [rbp + 0x980], r15
mov qword [rbp + 0x988], rdi
mov byte [rbp + 0x970], 0
mov rdx, qword [rbp + 0x7c8]
cmp rdx, 0x10
jb 0x140011bd5
inc rdx
mov rcx, qword [rbp + 0x7b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011bd0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140011bd0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006cd20
mov qword [rbp + 0x7c0], r15
mov qword [rbp + 0x7c8], rdi
mov byte [rbp + 0x7b0], 0
mov rdx, qword [rbp + 0x968]
cmp rdx, 0x10
jb 0x140011c2e
inc rdx
mov rcx, qword [rbp + 0x950]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011c29
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140011c29
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006cd20
mov qword [rbp + 0x960], r15
mov qword [rbp + 0x968], rdi
mov byte [rbp + 0x950], 0
mov rdx, qword [rbp + 0x7e8]
cmp rdx, 0x10
jb 0x140011c87
inc rdx
mov rcx, qword [rbp + 0x7d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011c82
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140011c82
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006cd20
mov qword [rbp + 0x7e0], r15
mov qword [rbp + 0x7e8], rdi
mov byte [rbp + 0x7d0], 0
mov rdx, qword [rbp + 0x928]
cmp rdx, 0x10
jb 0x140011ce0
inc rdx
mov rcx, qword [rbp + 0x910]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011cdb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140011cdb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006cd20
mov qword [rbp + 0x920], r15
mov qword [rbp + 0x928], rdi
mov byte [rbp + 0x910], 0
mov rdx, qword [rbp + 0x808]
cmp rdx, 0x10
jb 0x140011d39
inc rdx
mov rcx, qword [rbp + 0x7f0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011d34
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140011d34
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006cd20
mov qword [rbp + 0x800], r15
mov qword [rbp + 0x808], rdi
mov byte [rbp + 0x7f0], 0
mov rdx, qword [rbp + 0x788]
cmp rdx, 0x10
jb 0x140011d92
inc rdx
mov rcx, qword [rbp + 0x770]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011d8d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140011d8d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006cd20
mov qword [rbp + 0x780], r15
mov qword [rbp + 0x788], rdi
mov byte [rbp + 0x770], 0
mov rdx, qword [rbp + 0x728]
cmp rdx, 0x10
jb 0x140011deb
inc rdx
mov rcx, qword [rbp + 0x710]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011de6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140011de6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006cd20
mov qword [rbp + 0x720], r15
mov qword [rbp + 0x728], rdi
mov byte [rbp + 0x710], 0
mov rdx, qword [rbp + 0x748]
cmp rdx, 0x10
jb 0x140011e44
inc rdx
mov rcx, qword [rbp + 0x730]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011e3f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140011e3f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006cd20
mov qword [rbp + 0x740], r15
mov qword [rbp + 0x748], rdi
mov byte [rbp + 0x730], 0
mov rdx, qword [rbp + 0x768]
cmp rdx, 0x10
jb 0x140011e9d
inc rdx
mov rcx, qword [rbp + 0x750]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011e98
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140011e98
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006cd20
mov qword [rbp + 0x760], r15
mov qword [rbp + 0x768], rdi
mov byte [rbp + 0x750], 0
mov rdx, qword [rbp + 0x9c8]
cmp rdx, 0x10
jb 0x140011ef6
inc rdx
mov rcx, qword [rbp + 0x9b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011ef1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140011ef1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006cd20
mov qword [rbp + 0x9c0], r15
mov qword [rbp + 0x9c8], rdi
mov byte [rbp + 0x9b0], 0
mov rdx, qword [rbp + 0x848]
cmp rdx, 0x10
jb 0x140011f4f
inc rdx
mov rcx, qword [rbp + 0x830]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011f4a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140011f4a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006cd20
mov qword [rbp + 0x840], r15
mov qword [rbp + 0x848], rdi
mov byte [rbp + 0x830], 0
mov rdx, qword [rbp + 0x868]
cmp rdx, 0x10
jb 0x140011fa8
inc rdx
mov rcx, qword [rbp + 0x850]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011fa3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140011fa3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006cd20
mov qword [rbp + 0x860], r15
mov qword [rbp + 0x868], rdi
mov byte [rbp + 0x850], 0
mov rdx, qword [rbp + 0x888]
cmp rdx, 0x10
jb 0x140012001
inc rdx
mov rcx, qword [rbp + 0x870]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011ffc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140011ffc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006cd20
mov qword [rbp + 0x880], r15
mov qword [rbp + 0x888], rdi
mov byte [rbp + 0x870], 0
mov rdx, qword [rbp + 0x9e8]
cmp rdx, 0x10
jb 0x14001205a
inc rdx
mov rcx, qword [rbp + 0x9d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140012055
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140012055
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006cd20
mov qword [rbp + 0x9e0], r15
mov qword [rbp + 0x9e8], rdi
mov byte [rbp + 0x9d0], 0
cmp qword [rbp + 0x7a0], 0
ja 0x14001210e
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x14008d2d0], eax
jle 0x1400120f4
lea rcx, [0x14008d2d0]
call fcn.14006d168
cmp dword [0x14008d2d0], 0xffffffff
jne 0x1400120f4
xorps xmm0, xmm0
movdqu xmmword [0x14008d2d8], xmm0
mov ecx, 0x80
call fcn.14006cd54
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [0x14008d2d8], rax
lea rcx, [0x1400703d0]
call fcn.14006cfc8
nop
lea rcx, [0x14008d2d0]
call fcn.14006d108
lea rdx, [rsp + 0x50]
lea rcx, [0x14008d2d8]
call fcn.1400105c0
mov dword [rax + 0x50], r15d
jmp 0x14001302c
lea rcx, [rbp + 0x790]
cmp qword [rbp + 0x7a8], 0x10
cmovae rcx, qword [rbp + 0x790]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
cmp eax, r13d
jne 0x140012425
lea rax, [rbp + 0x170]
mov qword [rsp + 0x78], rax
lea rdx, [0x14008c1b8]
lea rcx, [rbp + 0x170]
call fcn.1400065f0
mov rbx, rax
mov qword [rbp + 0x810], r15
mov qword [rbp + 0x820], r15
mov qword [rbp + 0x828], rdi
mov r8d, recv
lea rdx, str.zVRSCVP
lea rcx, [rbp + 0x810]
call fcn.1400067c0
nop
mov r9, rbx
mov r8d, recv
lea rdx, [rbp + 0x810]
lea rcx, [rbp + 0x8f0]
call fcn.140010cb0
mov rsi, rax
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x14008d2d0], eax
jle 0x14001221b
lea rcx, [0x14008d2d0]
call fcn.14006d168
cmp dword [0x14008d2d0], 0xffffffff
jne 0x14001221b
xorps xmm0, xmm0
movdqu xmmword [0x14008d2d8], xmm0
mov ecx, 0x80
call fcn.14006cd54
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [0x14008d2d8], rax
lea rcx, [0x1400703d0]
call fcn.14006cfc8
nop
lea rcx, [0x14008d2d0]
call fcn.14006d108
lea rdx, [rsp + 0x50]
lea rcx, [0x14008d2d8]
call fcn.1400105c0
lea r9, [rax + 0x20]
cmp qword [rax + 0x38], 0x10
jb 0x14001223b
mov r9, qword [rax + 0x20]
mov r14, qword [rax + 0x30]
mov rcx, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x18]
mov rax, rdx
sub rax, rcx
cmp r14, rax
ja 0x14001227f
lea rax, [rcx + r14]
mov qword [rsi + 0x10], rax
mov rax, rsi
cmp rdx, 0x10
jb 0x140012266
mov rax, qword [rsi]
lea rbx, [rax + rcx]
mov r8, r14
mov rdx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [r14 + rbx], 0
jmp 0x140012292
mov qword [rsp + 0x20], r14
mov rdx, r14
mov rcx, rsi
call fcn.140006460
mov rsi, rax
mov qword [rbp + 0x6d0], r15
mov qword [rbp + 0x6e0], r15
mov qword [rbp + 0x6e8], r15
movups xmm0, xmmword [rsi]
movups xmmword [rbp + 0x6d0], xmm0
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [rbp + 0x6e0], xmm1
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], rdi
mov byte [rsi], 0
mov rcx, qword [rbp + 0x6e0]
mov rdx, qword [rbp + 0x6e8]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x14001230e
lea rax, [rcx + 1]
mov qword [rbp + 0x6e0], rax
lea rax, [rbp + 0x6d0]
cmp rdx, 0x10
cmovae rax, qword [rbp + 0x6d0]
mov word [rax + rcx], 0xa
lea rax, [rbp + 0x6d0]
jmp 0x14001232f
mov qword [rsp + 0x20], 1
lea r9, [0x140080594]
mov edx, 1
lea rcx, [rbp + 0x6d0]
call fcn.140006460
mov qword [rbp + 0x770], r15
mov qword [rbp + 0x780], r15
mov qword [rbp + 0x788], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x770], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x780], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], rdi
mov byte [rax], 0
mov edx, 0xa
lea rcx, [rbp + 0x770]
call fcn.1400017b0
nop
mov rdx, qword [rbp + 0x6e8]
cmp rdx, 0x10
jb 0x1400123ba
inc rdx
mov rcx, qword [rbp + 0x6d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400123b5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400123b5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006cd20
mov qword [rbp + 0x6e0], r15
mov qword [rbp + 0x6e8], rdi
mov byte [rbp + 0x6d0], 0
mov rdx, qword [rbp + 0x908]
cmp rdx, 0x10
jb 0x140012413
inc rdx
mov rcx, qword [rbp + 0x8f0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001240e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001240e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006cd20
inc dword [0x14008d1dc]
mov dword [0x14008d1e0], r15d
jmp 0x14001302c
lea rcx, [rbp + 0x790]
cmp qword [rbp + 0x7a8], 0x10
cmovae rcx, qword [rbp + 0x790]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
cmp eax, 1
jg 0x140012606
mov rsi, qword [rbp + 0x7a0]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, rsi
cmp rax, 1
jb 0x140013236
lea r15, [rbp + 0x790]
cmp qword [rbp + 0x7a8], 0x10
cmovae r15, qword [rbp + 0x790]
xor r12d, r12d
mov qword [rbp + 0x6f0], r12
mov qword [rbp + 0x700], r12
mov qword [rbp + 0x708], r12
lea r14, [rsi + 1]
lea rbx, [rbp + 0x6f0]
cmp r14, 0xf
jbe 0x140012528
mov rdi, r14
or rdi, 0xf
cmp rdi, rcx
jbe 0x1400124e0
mov rdi, rcx
movabs rax, 0x8000000000000027
mov rcx, rax
call fcn.14006cd54
test rax, rax
je 0x140012508
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140012521
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmp rdi, rax
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x14001250f
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14001323c
jmp 0x1400124c5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14001251e
call fcn.14006cd54
mov rbx, rax
jmp 0x140012521
mov rbx, r12
mov qword [rbp + 0x6f0], rbx
mov qword [rbp + 0x700], r14
mov qword [rbp + 0x708], rdi
mov r8, rsi
mov rdx, r15
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rsi], 0xa
mov byte [rbx + r14], r12b
mov edx, recv
lea rcx, [rbp + 0x6f0]
call fcn.1400017b0
inc dword [0x14008d1dc]
mov dword [0x14008d1e0], r12d
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x14008d2d0], eax
jle 0x1400125e1
lea rcx, [0x14008d2d0]
call fcn.14006d168
cmp dword [0x14008d2d0], 0xffffffff
jne 0x1400125e1
xorps xmm0, xmm0
movdqu xmmword [0x14008d2d8], xmm0
mov ecx, 0x80
call fcn.14006cd54
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [0x14008d2d8], rax
lea rcx, [0x1400703d0]
call fcn.14006cfc8
nop
lea rcx, [0x14008d2d0]
call fcn.14006d108
lea rdx, [rsp + 0x50]
lea rcx, [0x14008d2d8]
call fcn.1400105c0
mov dword [rax + 0x50], r12d
mov ecx, reloc.WLDAP32.dll_Ordinal_200
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14001302c
lea rax, [rbp + 0x650]
mov qword [rsp + 0x60], rax
lea rdx, [0x14008c1b8]
lea rcx, [rbp + 0x650]
call fcn.1400065f0
mov rbx, rax
lea rdx, [0x14008c2f8]
lea rcx, [rbp + 0x670]
call fcn.1400065f0
nop
mov r9, rbx
mov r8d, 9
mov rdx, rax
lea rcx, [rbp + 0xab0]
call fcn.140010cb0
nop
cmp qword [rax + 0x18], 0x10
jb 0x14001265f
mov rax, qword [rax]
mov rcx, rax
call fcn.140010bd0
test al, al
sete bl
mov rdx, qword [rbp + 0xac8]
cmp rdx, 0x10
jb 0x1400126b0
inc rdx
mov rcx, qword [rbp + 0xab0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400126ab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400126ab
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006cd20
mov qword [rbp + 0xac0], r15
mov qword [rbp + 0xac8], rdi
mov byte [rbp + 0xab0], 0
test bl, bl
je 0x140012cb2
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x58], rdi
mov r8d, 8
lea rdx, str.Status:
lea rcx, [rbp - 0x70]
call fcn.1400067c0
mov edx, recv
lea rcx, [rbp - 0x70]
call fcn.1400017b0
mov qword [rbp + 0x30], r15
mov qword [rbp + 0x40], r15
mov qword [rbp + 0x48], rdi
mov r8d, reloc.WS2_32.dll_setsockopt
lea rdx, str.Checking_computer..._n
lea rcx, [rbp + 0x30]
call fcn.1400067c0
mov edx, 0xa
lea rcx, [rbp + 0x30]
call fcn.1400017b0
inc dword [0x14008d1dc]
mov dword [0x14008d1e0], r15d
mov qword [rbp + 0x8b0], r15
mov qword [rbp + 0x8c0], r15
mov qword [rbp + 0x8c8], rdi
mov byte [rbp + 0x8b0], 0
mov dword [rsp + 0x58], 0x21ffd5f
mov rsi, r15
mov rbx, r15
mov ecx, dword [rbp + 0xf8]
mov eax, ecx
and al, 0x22
cmp al, 2
je 0x1400127d0
lea rcx, [rbp + 0x88]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
test rax, rax
je 0x1400127ca
lea rcx, [rbp + 0x88]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbase_void_const___ptr64]
mov rsi, rax
lea rcx, [rbp + 0x88]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov rbx, rax
mov qword [rsp + 0x60], rax
cmp rax, qword [rbp + 0xf0]
cmovb rbx, qword [rbp + 0xf0]
sub rbx, rsi
lea rcx, [rbp + 0x88]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::epptr_void_const___ptr64]
jmp 0x14001280a
mov ecx, dword [rbp + 0xf8]
test cl, 4
jne 0x14001280a
lea rcx, [rbp + 0x88]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
test rax, rax
je 0x14001280a
lea rcx, [rbp + 0x88]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::eback_void_const___ptr64]
mov rsi, rax
lea rcx, [rbp + 0x88]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::egptr_void_const___ptr64]
mov rbx, rax
sub rbx, rsi
test rsi, rsi
je 0x140012822
mov r8, rbx
mov rdx, rsi
lea rcx, [rbp + 0x8b0]
call fcn.1400067c0
nop
lea r8, [0x14008c1b8]
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae r8, qword [0x14008c1b8]
lea rcx, str.PUR_nXGQER_
call fcn.140014310
mov qword [rbp + 0x890], r15
mov qword [rbp + 0x8a0], r15
mov qword [rbp + 0x8a8], rdi
mov byte [rbp + 0x890], 0
mov r8, r14
inc r8
cmp byte [rax + r8], 0
jne 0x140012864
mov rdx, rax
lea rcx, [rbp + 0x890]
call fcn.1400067c0
nop
lea r9, [rbp + 0x8b0]
lea r8, [rbp + 0x890]
lea rcx, [rbp + 0x290]
call fcn.14000b4c0
mov esi, 0xd1ffd5f
xor r9d, r9d
lea r8d, [r9 + 2]
lea rdx, [rbp + 0x290]
lea rcx, [rbp + 0x6f0]
call fcn.140014ae0
nop
mov rdx, qword [rbp + 0x8a8]
cmp rdx, 0x10
jb 0x1400128fc
inc rdx
mov rcx, qword [rbp + 0x890]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400128f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400128f7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006cd20
mov qword [rbp + 0x8a0], r15
mov qword [rbp + 0x8a8], rdi
mov byte [rbp + 0x890], 0
mov rdx, qword [rbp + 0x8c8]
cmp rdx, 0x10
jb 0x140012955
inc rdx
mov rcx, qword [rbp + 0x8b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140012950
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140012950
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006cd20
mov qword [rbp + 0x8c0], r15
mov qword [rbp + 0x8c8], rdi
mov byte [rbp + 0x8b0], 0
lea rdx, str.gaben.txt
lea rcx, [rbp + 0x440]
call fcn.140010770
nop
lea rdx, [rbp + 0x6f0]
cmp qword [rbp + 0x708], 0x10
cmovae rdx, qword [rbp + 0x6f0]
mov r8, qword [rbp + 0x700]
lea rcx, [rbp + 0x440]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rbp + 0x448]
call fcn.140006360
test rax, rax
jne 0x1400129dc
mov rax, qword [rbp + 0x440]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x440]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
lea rax, [rbp + 0x690]
mov qword [rsp + 0x58], rax
lea rdx, [0x14008c1b8]
lea rcx, [rbp + 0x690]
call fcn.1400065f0
mov rbx, rax
lea rdx, [0x14008c2f8]
lea rcx, [rbp + 0x6b0]
call fcn.1400065f0
nop
mov r9, rbx
mov r8d, 9
mov rdx, rax
lea rcx, [rbp + 0xa10]
call fcn.140010cb0
cmp qword [rax + 0x18], 0x10
jb 0x140012a34
mov rax, qword [rax]
mov rdx, rax
lea rcx, str.gaben.txt
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_rename]
mov rdx, qword [rbp + 0xa28]
cmp rdx, 0x10
jb 0x140012a88
inc rdx
mov rcx, qword [rbp + 0xa10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140012a83
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140012a83
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006cd20
mov qword [rbp + 0xa20], r15
mov qword [rbp + 0xa28], rdi
mov byte [rbp + 0xa10], 0
lea rax, [rbp + 0x570]
mov qword [rsp + 0x68], rax
lea rdx, [0x14008c1b8]
lea rcx, [rbp + 0x570]
call fcn.1400065f0
mov rbx, rax
lea rdx, [0x14008c2f8]
lea rcx, [rbp + 0x590]
call fcn.1400065f0
nop
mov r9, rbx
mov r8d, 9
mov rdx, rax
lea rcx, [rbp + 0xa50]
call fcn.140010cb0
nop
cmp qword [rax + 0x18], 0x10
jb 0x140012af6
mov rax, qword [rax]
mov rcx, rax
call fcn.140010bd0
test al, al
sete bl
mov rdx, qword [rbp + 0xa68]
cmp rdx, 0x10
jb 0x140012b47
inc rdx
mov rcx, qword [rbp + 0xa50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140012b42
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140012b42
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006cd20
mov qword [rbp + 0xa60], r15
mov qword [rbp + 0xa68], rdi
mov byte [rbp + 0xa50], 0
test bl, bl
je 0x140012b9a
mov qword [rbp - 0x10], r15
mov qword [rbp], r15
mov qword [rbp + 8], rdi
mov r8d, reloc.WS2_32.dll_recvfrom
lea rdx, str.Unable_to_inject_n
lea rcx, [rbp - 0x10]
call fcn.1400067c0
mov edx, edi
lea rcx, [rbp - 0x10]
call fcn.1400017b0
inc dword [0x14008d1dc]
mov dword [0x14008d1e0], r15d
mov rax, qword [rbp + 0x440]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x440], rax
mov rax, qword [rbp + 0x440]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x43c], edx
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rbp + 0x448], rax
cmp qword [rbp + 0x4c8], 0
je 0x140012c1b
lea rcx, [rbp + 0x448]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::eback_void_const___ptr64]
lea rcx, [rbp + 0x4b8]
cmp rax, rcx
jne 0x140012c1b
mov r9, qword [rbp + 0x4d8]
mov rdx, qword [rbp + 0x4d0]
mov r8, rdx
lea rcx, [rbp + 0x448]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::setg_char____ptr64__char____ptr64__char____ptr64____ptr64]
cmp byte [rbp + 0x4c4], 0
je 0x140012c30
lea rcx, [rbp + 0x448]
call fcn.140006360
lea rcx, [rbp + 0x448]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x450]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x4e8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rdx, qword [rbp + 0x708]
cmp rdx, 0x10
jb 0x140012c9d
inc rdx
mov rcx, qword [rbp + 0x6f0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140012c98
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140012c98
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006cd20
mov qword [rbp + 0x700], r15
mov qword [rbp + 0x708], rdi
mov byte [rbp + 0x6f0], 0
lea rdx, [rbp + 0xbd0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov qword [rbp + 0x990], r15
movdqa xmm0, xmmword [0x140080e90]
movdqu xmmword [rbp + 0x9a0], xmm0
mov byte [rbp + 0x990], 0
lea rax, [rbp + 0xbd0]
nop dword [rax]
inc r14
cmp byte [rax + r14], 0
jne 0x140012cf0
mov r8, r14
lea rdx, [rbp + 0xbd0]
lea rcx, [rbp + 0x990]
call fcn.1400067c0
bts esi, 0x1c
lea rax, [rbp + 0x5d0]
mov qword [rsp + 0x68], rax
mov qword [rbp + 0x8f0], r15
movdqa xmm0, xmmword [0x140080e90]
movdqu xmmword [rbp + 0x900], xmm0
mov byte [rbp + 0x8f0], 0
bts esi, 0x1e
mov dword [rsp + 0x58], esi
lea rdx, [rbp + 0x6d0]
lea rcx, [rbp + 0x1a8]
call fcn.1400044e0
mov rdx, qword [rbp + 0x6d0]
test rdx, rdx
je 0x140012d78
mov r8, qword [rbp + 0x6d8]
lea rcx, [rbp + 0x8f0]
call fcn.1400067c0
btr esi, 0x1e
bts esi, 0x1d
mov dword [rsp + 0x58], esi
lea rdx, [0x14008c1b8]
lea rcx, [rbp + 0x5d0]
call fcn.1400065f0
mov rbx, rax
lea rdx, [0x14008c2f8]
lea rcx, [rbp + 0x5b0]
call fcn.1400065f0
nop
mov r9, rbx
mov r8d, 9
mov rdx, rax
lea rcx, [rbp + 0x930]
call fcn.140010cb0
nop
mov r8, rax
lea rdx, [0x140080c64]
lea rcx, [rbp + 0xa30]
call fcn.140004640
nop
lea r8, str.__k
mov rdx, rax
lea rcx, [rbp + 0xb10]
call fcn.140004570
nop
lea r8, [0x14008c158]
mov rdx, rax
lea rcx, [rbp + 0xad0]
call fcn.140008d80
nop
lea r8, str.__i
mov rdx, rax
lea rcx, [rbp + 0xaf0]
call fcn.140004570
nop
lea r8, [0x14008c178]
mov rdx, rax
lea rcx, [rbp + 0xb90]
call fcn.140008d80
nop
lea r8, str.__s
mov rdx, rax
lea rcx, [rbp + 0xb70]
call fcn.140004570
nop
lea r8, [rbp + 0x790]
mov rdx, rax
lea rcx, [rbp + 0xb50]
call fcn.140008d80
nop
lea r8, str.__p
mov rdx, rax
lea rcx, [rbp + 0xb30]
call fcn.140004570
nop
lea r8, [rbp + 0x8f0]
mov rdx, rax
lea rcx, [rbp + 0xbb0]
call fcn.14000b4a0
nop
mov rdx, rax
lea rcx, [rbp + 0x990]
call fcn.140009580
nop
lea rcx, [rbp + 0xbb0]
call fcn.140006c90
nop
lea rcx, [rbp + 0xb30]
call fcn.140006c90
nop
lea rcx, [rbp + 0xb50]
call fcn.140006c90
nop
lea rcx, [rbp + 0xb70]
call fcn.140006c90
nop
lea rcx, [rbp + 0xb90]
call fcn.140006c90
nop
lea rcx, [rbp + 0xaf0]
call fcn.140006c90
nop
lea rcx, [rbp + 0xad0]
call fcn.140006c90
nop
lea rcx, [rbp + 0xb10]
call fcn.140006c90
nop
lea rcx, [rbp + 0xa30]
call fcn.140006c90
nop
lea rcx, [rbp + 0x930]
call fcn.140006c90
nop
lea rcx, [rbp + 0x8f0]
call fcn.140006c90
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x3d4], xmm0
movups xmmword [rbp + 0x3e4], xmm0
movups xmmword [rbp + 0x3f4], xmm0
movups xmmword [rbp + 0x404], xmm0
movups xmmword [rbp + 0x414], xmm0
movups xmmword [rbp + 0x424], xmm0
mov dword [rbp + 0x434], eax
mov dword [rbp + 0x3d0], WSAGetLastError
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], rax
lea rcx, [rbp + 0x990]
call fcn.140006450
mov rdx, rax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x3d0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rbx, qword [rbp + 0x50]
mov eax, dword [rsp + 0x50]
mov dword [0x14008d200], eax
cmp byte [0x14008d1cc], 0
je 0x140013018
nop
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [rbp - 0x80]
cmp eax, 3
je 0x140013123
cmp eax, 0x103
jne 0x140013095
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x14008d1cc], 0
jne 0x140012fe0
mov byte [0x14008d1f6], 0
lea rcx, [rbp + 0x990]
call fcn.140006c90
nop
lea rcx, [rbp + 0x790]
call fcn.140006c90
nop
lea rcx, [rbp + 0x70]
call fcn.140002160
nop
lea rcx, [rbp + 0x8d0]
call fcn.140006c90
nop
lea rcx, [rbp + 0x2d0]
call fcn.140002160
nop
lea rcx, [rbp + 0x190]
call fcn.140002160
xor eax, eax
mov rcx, qword [rbp + 0xde0]
xor rcx, rsp
call fcn.14006cd00
mov rbx, qword [rsp + 0xf40]
add rsp, 0xef0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
cmp byte [0x14008d1cc], 0
je 0x140013018
call fcn.14000fac0
mov rcx, rax
lea rdx, [rsp + 0x50]
call fcn.1400105c0
mov dword [rax + 0x50], r15d
lea rdx, str.Status:
lea rcx, [rbp + 0x930]
call fcn.140006920
mov edx, recv
mov rcx, rax
call fcn.1400017b0
lea rdx, str.Loading..._n
lea rcx, [rbp + 0xa30]
call fcn.140006920
mov edx, 0xa
mov rcx, rax
call fcn.1400017b0
inc dword [0x14008d1dc]
mov dword [0x14008d1e0], r15d
mov dword [0x14008d200], r15d
mov byte [0x14008d1f4], 0
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14001301f
cmp byte [0x14008d1cc], 0
je 0x140013018
call fcn.14000fac0
mov rcx, rax
lea rdx, [rsp + 0x50]
call fcn.1400105c0
mov dword [rax + 0x50], 3
lea rdx, str.Status:
lea rcx, [rbp + 0x930]
call fcn.140006920
mov edx, recv
mov rcx, rax
call fcn.1400017b0
lea rax, [rbp + 0xa30]
mov qword [rsp + 0x68], rax
lea rdx, [0x14008c1b8]
lea rcx, [rbp + 0xa30]
call fcn.1400065f0
mov rbx, rax
lea rdx, str.zVRSCVP
lea rcx, [rbp + 0x930]
call fcn.140006920
nop
mov r9, rbx
mov r8d, recv
mov rdx, rax
lea rcx, [rbp + 0xaf0]
call fcn.140010cb0
mov rbx, rax
call fcn.14000fac0
mov rcx, rax
lea rdx, [rsp + 0x50]
call fcn.1400105c0
lea r8, [rax + 0x20]
mov rdx, rbx
lea rcx, [rbp + 0xad0]
call fcn.140008d80
nop
lea r8, [0x140080594]
mov rdx, rax
lea rcx, [rbp + 0xb10]
call fcn.140004570
mov edx, 0xa
mov rcx, rax
call fcn.1400017b0
nop
lea rcx, [rbp + 0xad0]
call fcn.140006c90
nop
lea rcx, [rbp + 0xaf0]
call fcn.140006c90
inc dword [0x14008d1dc]
mov dword [0x14008d1e0], r15d
mov byte [0x14008d1f4], 1
jmp 0x14001301f
call fcn.1400066d0
int3
call fcn.1400067a0
int3