Function at 0x14000eb50
Capabilities:
Delete file
Encode data using xor
Execute command
Hash data using fnv
Schedule task via at

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
mov qword [r11 + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x190
mov rax, qword [0x1400b57c0]
xor rax, rsp
mov qword [rsp + 0x180], rax
xor r15d, r15d
xorps xmm0, xmm0
movups xmmword [rsp + 0x120], xmm0
xorps xmm1, xmm1
movdqu xmmword [r11 - 0x78], xmm1
lea r8d, [r15 + 3]
lea rdx, [0x1400a6c14]
lea rcx, [r11 - 0x88]
call fcn.1400157f0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0xc0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0xd0], xmm1
lea r8d, [r15 + 0xa]
lea rdx, str.src.xbuild
lea rcx, [rsp + 0xc0]
call fcn.1400157f0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
lea r8d, [r15 + 4]
lea rbx, str.libs
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.1400157f0
nop
lea rcx, [rsp + 0x68]
call fcn.14000e980
nop
mov rdx, qword [rsp + 0x80]
cmp rdx, 0xf
jbe 0x14000ec59
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ec54
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000ec54
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008c44c
call fcn.14008ba30
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], 4
lea r8, [rsp + 0x30]
mov edx, eax
lea rcx, [rsp + 0x68]
call fcn.140006af0
nop
lea rcx, [rsp + 0x68]
call fcn.140009e30
movzx ebx, al
mov rdx, qword [rsp + 0x80]
cmp rdx, 7
jbe 0x14000ecd3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ecce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000ecce
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008c44c
test bl, bl
je 0x14000eddf
lea rdx, str.libs_folder_is_in_use_by_another_process_please_close_it.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014200
lea rdx, [0x140014550]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov rdx, qword [rsp + 0xd8]
cmp rdx, 0xf
jbe 0x14000ed4f
inc rdx
mov rcx, qword [rsp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ed4a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fab1
call fcn.14008c44c
movdqa xmm0, xmmword [0x1400a7980]
movdqu xmmword [rsp + 0xd0], xmm0
mov byte [rsp + 0xc0], 0
mov rdx, qword [rsp + 0x138]
cmp rdx, 0xf
jbe 0x14000edab
inc rdx
mov rcx, qword [rsp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000eda6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fb1c
call fcn.14008c44c
xor eax, eax
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.14008c3f0
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
lea rcx, str.src.xbuild
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
mov r8d, 9
lea rdx, str.hash.json
lea rcx, [rsp + 0x68]
call fcn.1400157f0
nop
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x120]
call fcn.14000bca0
movzx ebx, al
mov rdx, qword [rsp + 0x80]
cmp rdx, 0xf
jbe 0x14000ee75
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ee70
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000ee70
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008c44c
test bl, bl
je 0x14000fa46
mov byte [rsp + 0x20], 0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x88]
call fcn.14000dd20
nop
lea rdx, str.Project_ID_:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014200
lea rdx, [rsp + 0x88]
cmp qword [rsp + 0xa0], 0xf
cmova rdx, qword [rsp + 0x88]
mov r8, qword [rsp + 0x98]
mov rcx, rax
call fcn.1400178c0
lea rdx, [0x140014550]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rdx, qword [rsp + 0x98]
mov qword [rsp + 0x30], rdx
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, rdx
cmp rax, 0x22
jb 0x14000fb23
lea r13, [rsp + 0x88]
cmp qword [rsp + 0xa0], 0xf
cmova r13, qword [rsp + 0x88]
xorps xmm0, xmm0
movups xmmword [rsp + 0xe0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0xf0], xmm1
lea r12, [rdx + 0x22]
mov ebx, reloc.WS2_32.dll_ntohs
lea rdi, [rsp + 0xe0]
lea r14d, [rbx + 7]
cmp r12, rbx
jbe 0x14000f00b
mov rbx, r12
or rbx, 0xf
cmp rbx, rcx
jbe 0x14000ef77
mov rbx, rcx
movabs rsi, 0x8000000000000000
lea rax, [rsi + 0x27]
jmp 0x14000efa2
cmp rbx, r14
cmovb rbx, r14
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14000efce
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000fb29
movabs rsi, 0x8000000000000000
mov rcx, rax
call fcn.14008c410
test rax, rax
je 0x14000f910
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
mov rdx, qword [rsp + 0x30]
mov qword [rsp + 0xe0], rdi
jmp 0x14000f015
test rcx, rcx
je 0x14000eff4
call fcn.14008c410
mov rdi, rax
mov rdx, qword [rsp + 0x30]
movabs rsi, 0x8000000000000000
mov qword [rsp + 0xe0], rax
jmp 0x14000f015
mov rdi, r15
movabs rsi, 0x8000000000000000
mov qword [rsp + 0xe0], r15
jmp 0x14000f015
movabs rsi, 0x8000000000000000
mov qword [rsp + 0xf0], r12
mov qword [rsp + 0xf8], rbx
movups xmm0, xmmword [str.http:__194.238.19.234:3000_upload_]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [0x1400a6c98]
movups xmmword [rdi + 0x10], xmm1
movzx eax, word [0x1400a6ca8]
mov word [rdi + 0x20], ax
lea rcx, [rdi + 0x22]
mov r8, rdx
mov rdx, r13
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r12], 0
lea rdx, [0x140014550]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
mov r8d, 0xa
lea rdx, str.src.xbuild
lea rcx, [rsp + 0x68]
call fcn.1400157f0
nop
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0xe0]
call fcn.14000cc60
movzx ebx, al
mov rdx, qword [rsp + 0x80]
cmp rdx, 0xf
jbe 0x14000f0ee
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f0e9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000f0e9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008c44c
test bl, bl
je 0x14000f8a5
lea rdx, [0x140014550]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.src.xbuild
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rdx, [0x140014550]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r13, qword [rsp + 0x98]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r13
cmp rax, 0x24
jb 0x14000fb2f
lea rdx, [rsp + 0x88]
cmp qword [rsp + 0xa0], 0xf
cmova rdx, qword [rsp + 0x88]
mov qword [rsp + 0x30], rdx
xorps xmm0, xmm0
movups xmmword [rsp + 0x100], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x110], xmm1
lea r12, [r13 + 0x24]
mov ebx, reloc.WS2_32.dll_ntohs
lea rdi, [rsp + 0x100]
cmp r12, rbx
jbe 0x14000f213
mov rbx, r12
or rbx, 0xf
cmp rbx, rcx
jbe 0x14000f1d0
mov rbx, rcx
add rsi, 0x27
mov rcx, rsi
call fcn.14008c410
test rax, rax
je 0x14000f5f0
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
mov rdx, qword [rsp + 0x30]
jmp 0x14000f20b
cmp rbx, 0x16
cmovb rbx, r14
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14000f1f4
lea rsi, [rcx + 0x27]
cmp rsi, rcx
jbe 0x14000fb35
jmp 0x14000f1ac
test rcx, rcx
je 0x14000f208
call fcn.14008c410
mov rdi, rax
mov rdx, qword [rsp + 0x30]
jmp 0x14000f20b
mov rdi, r15
mov qword [rsp + 0x100], rdi
mov qword [rsp + 0x110], r12
mov qword [rsp + 0x118], rbx
movups xmm0, xmmword [str.http:__194.238.19.234:3000_download_]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [0x1400a6ce0]
movups xmmword [rdi + 0x10], xmm1
mov eax, dword [0x1400a6cf0]
mov dword [rdi + 0x20], eax
lea rcx, [rdi + 0x24]
mov r8, r13
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r12], 0
xorps xmm0, xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0xa8], xmm1
mov qword [rsp + 0xb8], r15
movups xmmword [rsp + 0x140], xmm0
movups xmmword [rsp + 0x150], xmm0
movups xmmword [rsp + 0x160], xmm0
movups xmmword [rsp + 0x170], xmm0
mov dword [rsp + 0x140], 0
mov qword [rsp + 0x148], r15
mov qword [rsp + 0x150], r15
mov ecx, Ordinal_50
call fcn.14008c410
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rsp + 0x148], rax
mov qword [rsp + 0x158], r15
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x160], xmm0
mov qword [rsp + 0x170], 7
mov qword [rsp + 0x178], 8
mov dword [rsp + 0x140], 0x3f800000
mov r8, rax
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x158]
call fcn.1400130e0
nop
movabs r12, 0x100000001b3
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
mov r8d, 8
lea rdx, str.libs.zip
lea rcx, [rsp + 0x40]
call fcn.1400157f0
nop
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0x68]
call fcn.14000d070
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x14000f3a2
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f39d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000f39d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008c44c
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x40], 0
lea rcx, [rsp + 0x68]
mov rdi, qword [rsp + 0x80]
cmp rdi, 0xf
seta r14b
mov rbx, qword [rsp + 0x68]
cmova rcx, rbx
mov rsi, qword [rsp + 0x78]
cmp rsi, 2
jne 0x14000f6bd
mov r8, rsi
lea rdx, [0x1400a6bb8]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14000f6bd
test r14b, r14b
je 0x14000f430
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14000f427
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f88b
mov rcx, rbx
call fcn.14008c44c
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8d, 2
lea rdx, [0x1400a6d14]
lea rcx, [rsp + 0x40]
call fcn.1400157f0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
mov r8d, 8
lea rdx, str.libs.zip
lea rcx, [rsp + 0x68]
call fcn.1400157f0
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x68]
call fcn.14000c110
nop
mov rdx, qword [rsp + 0x80]
cmp rdx, 0xf
jbe 0x14000f4d5
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f4d0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000f4d0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008c44c
movdqa xmm0, xmmword [0x1400a7980]
movdqu xmmword [rsp + 0x78], xmm0
mov byte [rsp + 0x68], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x14000f528
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f523
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000f523
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008c44c
lea rcx, str.libs.zip
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
nop
lea rcx, [rsp + 0x140]
call fcn.14000fb50
nop
mov rcx, qword [rsp + 0xa8]
test rcx, rcx
je 0x14000f5b6
mov rdx, qword [rsp + 0xb0]
call fcn.1400149e0
mov rdx, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0xa8]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f59d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000f59d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008c44c
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xa8], xmm0
mov qword [rsp + 0xb8], r15
mov rdx, qword [rsp + 0x118]
cmp rdx, 0xf
jbe 0x14000f5fc
inc rdx
mov rcx, qword [rsp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f5f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000f5f7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008c44c
movdqa xmm0, xmmword [0x1400a7980]
movdqu xmmword [rsp + 0x110], xmm0
mov byte [rsp + 0x100], 0
mov rdx, qword [rsp + 0xf8]
cmp rdx, 0xf
jbe 0x14000f658
inc rdx
mov rcx, qword [rsp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f653
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f910
call fcn.14008c44c
movdqa xmm0, xmmword [0x1400a7980]
movdqu xmmword [rsp + 0xf0], xmm0
mov byte [rsp + 0xe0], 0
mov rdx, qword [rsp + 0xa0]
cmp rdx, 0xf
jbe 0x14000fa69
inc rdx
mov rcx, qword [rsp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f6b3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f96f
call fcn.14008c44c
jmp 0x14000fa69
test rsi, rsi
jne 0x14000f714
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov rdx, qword [rsp + 0x80]
cmp rdx, 0xf
jbe 0x14000f70f
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f709
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f88b
call fcn.14008c44c
nop
jmp 0x14000f314
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x68]
call fcn.14000e5d0
mov rbx, qword [rsp + 0xa8]
mov r13, qword [rsp + 0xb0]
mov rsi, qword [rsp + 0x148]
nop
cmp rbx, r13
je 0x14000f854
mov r9, qword [rbx + 0x10]
mov r8, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x14000f75a
mov r8, qword [rbx]
movabs rcx, 0xcbf29ce484222325
mov rdx, r15
test r9, r9
je 0x14000f784
nop dword [rax]
movzx eax, byte [rdx + r8]
xor rcx, rax
imul rcx, r12
inc rdx
cmp rdx, r9
jb 0x14000f770
and rcx, qword [rsp + 0x170]
add rcx, rcx
mov rax, qword [rsp + 0x158]
mov rdi, qword [rax + rcx*8 + 8]
cmp rdi, rsi
je 0x14000f7e6
mov r14, qword [rax + rcx*8]
nop word [rax + rax]
lea rdx, [rdi + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x14000f7c2
mov rdx, qword [rdx]
mov r8, qword [rbx + 0x10]
mov rcx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x14000f7d3
mov rcx, qword [rbx]
cmp r8, rax
jne 0x14000f7e1
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14000f7e9
cmp rdi, r14
jne 0x14000f84b
mov rdi, r15
mov rax, rsi
test rdi, rdi
cmovne rax, rdi
cmp rax, rsi
jne 0x14000f842
mov rdx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x14000f805
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400178c0
lea rdx, [0x140014550]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r8, rbx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x140]
call fcn.140014590
mov rsi, qword [rsp + 0x148]
add rbx, 0x20
jmp 0x14000f740
mov rdi, qword [rdi + 8]
jmp 0x14000f7b0
mov rdx, qword [rsp + 0x80]
cmp rdx, 0xf
jbe 0x14000f898
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f892
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000f892
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008c44c
nop
jmp 0x14000f314
lea rcx, str.src.xbuild
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rdx, str.A_fatal_error_has_occurred.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140014200
lea rdx, [0x140014550]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rsp + 0xf8]
cmp rdx, 0xf
jbe 0x14000f91c
inc rdx
mov rcx, qword [rsp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f917
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000f917
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008c44c
movdqa xmm0, xmmword [0x1400a7980]
movdqu xmmword [rsp + 0xf0], xmm0
mov byte [rsp + 0xe0], 0
mov rdx, qword [rsp + 0xa0]
cmp rdx, 0xf
jbe 0x14000f97b
inc rdx
mov rcx, qword [rsp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f976
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000f976
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008c44c
mov qword [rsp + 0x98], r15
mov qword [rsp + 0xa0], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x88], 0
mov rdx, qword [rsp + 0xd8]
cmp rdx, 0xf
jbe 0x14000f9dd
inc rdx
mov rcx, qword [rsp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f9d8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000f9d8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008c44c
movdqa xmm0, xmmword [0x1400a7980]
movdqu xmmword [rsp + 0xd0], xmm0
mov byte [rsp + 0xc0], 0
mov rdx, qword [rsp + 0x138]
cmp rdx, 0xf
jbe 0x14000fa3c
inc rdx
mov rcx, qword [rsp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000fa37
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000fa37
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008c44c
mov eax, 0xffffffff
jmp 0x14000edad
lea rdx, str.Failed_to_create_ZIP_file
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140014200
lea rdx, [0x140014550]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov rdx, qword [rsp + 0xd8]
cmp rdx, 0xf
jbe 0x14000fabd
inc rdx
mov rcx, qword [rsp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000fab8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000fab8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008c44c
movdqa xmm0, xmmword [0x1400a7980]
movdqu xmmword [rsp + 0xd0], xmm0
mov byte [rsp + 0xc0], 0
mov rdx, qword [rsp + 0x138]
cmp rdx, 0xf
jbe 0x14000edab
inc rdx
mov rcx, qword [rsp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000eda6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000eda6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.1400061f0
int3
call fcn.140006150
nop
call fcn.1400061f0
int3
call fcn.140006150
int3