Function at 0x14000abc0
Capabilities:
Contain obfuscated stackstrings
Encode data using base64
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x988
movaps xmmword [rsp + 0x970], xmm6
mov rax, qword [0x1400503c8]
xor rax, rsp
mov qword [rsp + 0x968], rax
xor esi, esi
xor ecx, ecx
xor edx, edx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x14000c1a6
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0
xor ecx, ecx
mov edx, 0xffffffff
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
js 0x14000c19e
mov qword [rsp + 0xb8], 0
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x20], rax
lea rcx, [0x1400449c8]
lea r9, [0x1400449e8]
xor edx, edx
mov r8d, 1
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov qword [rsp + 0xb0], 0
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.DLL_GetNativeSystemInfo]
cmp word [rsp + 0x80], 9
jne 0x14000af4e
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
lea rcx, [0x1400449d8]
lea r9, [0x1400449f8]
xor edx, edx
mov r8d, 1
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x14000c19e
mov byte [rsp + 0x160], 0
lea rcx, [rsp + 0x161]
mov byte [rsp + 0x161], WSAGetLastError
mov byte [rsp + 0x162], 0x63
mov byte [rsp + 0x163], WSAGetLastError
mov byte [rsp + 0x164], 0x63
mov byte [rsp + 0x165], 0x54
mov byte [rsp + 0x166], 0x63
mov byte [rsp + 0x167], 0x1e
mov byte [rsp + 0x168], 0x63
mov byte [rsp + 0x169], 0x66
mov byte [rsp + 0x16a], 0x63
mov byte [rsp + 0x16b], 0x3d
mov byte [rsp + 0x16c], 0x63
mov byte [rsp + 0x16d], 0x77
mov byte [rsp + 0x16e], 0x63
mov byte [rsp + 0x16f], WSACleanup
mov byte [rsp + 0x170], 0x63
mov byte [rsp + 0x171], 0x58
mov byte [rsp + 0x172], 0x63
mov byte [rsp + 0x173], 0x1e
mov byte [rsp + 0x174], 0x63
mov byte [rsp + 0x175], 0x3f
mov byte [rsp + 0x176], 0x63
mov byte [rsp + 0x177], 0x1e
mov byte [rsp + 0x178], 0x63
mov byte [rsp + 0x179], 9
mov byte [rsp + 0x17a], 0x63
mov byte [rsp + 0x17b], shutdown
mov byte [rsp + 0x17c], 0x63
mov byte [rsp + 0x17d], 0x77
mov byte [rsp + 0x17e], 0x63
mov byte [rsp + 0x17f], WSACleanup
mov byte [rsp + 0x180], 0x63
mov byte [rsp + 0x181], 0x58
mov byte [rsp + 0x182], 0x63
mov byte [rsp + 0x183], 9
mov byte [rsp + 0x184], 0x63
mov byte [rsp + 0x185], WSACleanup
mov byte [rsp + 0x186], 0x63
mov byte [rsp + 0x187], 0x55
mov byte [rsp + 0x188], 0x63
mov byte [rsp + 0x189], 0x1e
mov byte [rsp + 0x18a], 0x63
mov byte [rsp + 0x18b], 0x58
mov byte [rsp + 0x18c], 0x63
mov byte [rsp + 0x18d], 0x63
mov byte [rsp + 0x18e], 0x63
mov al, byte [rsp + 0x160]
test al, 1
jne 0x14000aef5
mov eax, 1
nop dword [rax]
movzx edx, byte [rsp + rax + 0x160]
movzx edx, dl
lea ebp, [rdx + rdx*8]
lea ebx, [rdx + rbp*4]
lea edx, [rdx + rbp*4]
add edx, 0xfffff1b1
movsx edx, dx
imul edx, edx, 0xffff8103
shr edx, 0x10
add edx, ebx
add edx, 0xfffff1b1
movzx edx, dx
mov ebp, edx
shr ebp, 0xf
shr edx, 6
add edx, ebp
mov ebp, edx
shl ebp, 7
sub edx, ebp
add edx, ebx
add edx, 0xfffff1b1
add dl, 0x7f
movzx edx, dl
lea ebp, [rdx + rdx*2]
shr ebp, 8
mov ebx, edx
sub bl, bpl
shr bl, 1
add bl, bpl
shr bl, 6
movzx ebx, bl
mov ebp, ebx
shl ebp, 7
sub ebp, ebx
sub dl, bpl
mov byte [rsp + rax + 0x160], dl
add rax, 1
cmp rax, 0x2f
jne 0x14000ae70
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rsi, rax
lea rdi, [rsp + 0x160]
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov word [rsp + 0x160], 3
mov dword [rsp + 0x168], 0x40
mov rcx, qword [rsp + 0xb0]
mov rax, qword [rcx]
mov rdx, rsi
xor r8d, r8d
mov r9, rdi
call qword [rax + 0x40]
mov esi, eax
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
test esi, esi
js 0x14000c19e
mov qword [rsp + 0x78], 0
mov byte [rsp + 0x160], 0
lea rcx, [rsp + 0x161]
mov byte [rsp + 0x161], 0x61
mov byte [rsp + 0x162], 0x26
mov byte [rsp + 0x163], 0x54
mov byte [rsp + 0x164], 0x26
mov byte [rsp + 0x165], 0x54
mov byte [rsp + 0x166], 0x26
mov byte [rsp + 0x167], reloc.WS2_32.dll_setsockopt
mov byte [rsp + 0x168], 0x26
mov byte [rsp + 0x169], 0x62
mov byte [rsp + 0x16a], 0x26
mov byte [rsp + 0x16b], 0x20
mov byte [rsp + 0x16c], 0x26
mov byte [rsp + 0x16d], 0x3a
mov byte [rsp + 0x16e], 0x26
mov byte [rsp + 0x16f], 0x21
mov byte [rsp + 0x170], 0x26
mov byte [rsp + 0x171], 0x48
mov byte [rsp + 0x172], 0x26
mov byte [rsp + 0x173], 0x2b
mov byte [rsp + 0x174], 0x26
mov byte [rsp + 0x175], 0x26
mov byte [rsp + 0x176], 0x26
mov al, byte [rsp + 0x160]
test al, 1
jne 0x14000b0ac
mov eax, 1
nop dword [rax + rax]
movzx edx, byte [rsp + rax + 0x160]
movzx edx, dl
lea edx, [rdx + rdx*4]
lea ebp, [rdx + rdx]
add ebp, 0xfffffe84
movsx ebp, bp
imul ebp, ebp, 0xffff8103
shr ebp, 0x10
lea ebp, [rbp + rdx*2 - 0x17c]
movzx ebp, bp
mov ebx, ebp
shr ebx, 0xf
shr ebp, 6
add ebp, ebx
mov ebx, ebp
shl ebx, 7
sub ebp, ebx
lea edx, [rbp + rdx*2 - 0x17c]
add dl, 0x7f
movzx edx, dl
lea ebp, [rdx + rdx*2]
shr ebp, 8
mov ebx, edx
sub bl, bpl
shr bl, 1
add bl, bpl
shr bl, 6
movzx ebx, bl
mov ebp, ebx
shl ebp, 7
sub ebp, ebx
sub dl, bpl
mov byte [rsp + rax + 0x160], dl
add rax, 1
cmp rax, 0x17
jne 0x14000b030
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rcx, qword [rsp + 0xb8]
mov rdx, qword [rsp + 0xb0]
mov rbp, qword [rcx]
lea rbx, [rsp + 0x78]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rdx, rax
xor r8d, r8d
xor r9d, r9d
call qword [rbp + 0x18]
test eax, eax
js 0x14000c190
mov rcx, qword [rsp + 0x78]
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
mov edx, 0xa
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x14000c185
mov byte [rsp + 0x160], 0
lea rcx, [rsp + 0x161]
mov byte [rsp + 0x161], 0x64
mov byte [rsp + 0x162], 0x59
mov byte [rsp + 0x163], WSAGetLastError
mov byte [rsp + 0x164], 0x59
mov byte [rsp + 0x165], 0x1e
mov byte [rsp + 0x166], 0x59
mov byte [rsp + 0x167], 0x59
mov byte [rsp + 0x168], 0x59
mov al, byte [rsp + 0x160]
test al, 1
jne 0x14000b508
mov al, byte [rsp + 0x161]
movzx eax, al
mov edx, eax
shl edx, 5
sub edx, eax
mov eax, edx
add eax, 0xfffff539
cwde
imul eax, eax, 0xffff8103
shr eax, 0x10
add eax, edx
add eax, 0xfffff539
movzx eax, ax
mov ebp, eax
shr ebp, 0xf
shr eax, 6
add eax, ebp
mov ebp, eax
shl ebp, 7
sub eax, ebp
add eax, edx
add eax, 0xfffff539
add al, 0x7f
movzx eax, al
lea edx, [rax + rax*2]
shr edx, 8
mov ebx, eax
sub bl, dl
shr bl, 1
add bl, dl
shr bl, 6
movzx ebp, bl
mov edx, ebp
shl edx, 7
sub edx, ebp
sub al, dl
mov byte [rsp + 0x161], al
mov al, byte [rsp + 0x162]
movzx eax, al
mov edx, eax
shl edx, 5
sub edx, eax
mov eax, edx
add eax, 0xfffff539
cwde
imul eax, eax, 0xffff8103
shr eax, 0x10
add eax, edx
add eax, 0xfffff539
movzx eax, ax
mov ebp, eax
shr ebp, 0xf
shr eax, 6
add eax, ebp
mov ebp, eax
shl ebp, 7
sub eax, ebp
add eax, edx
add eax, 0xfffff539
add al, 0x7f
movzx eax, al
lea edx, [rax + rax*2]
shr edx, 8
mov ebx, eax
sub bl, dl
shr bl, 1
add bl, dl
shr bl, 6
movzx ebp, bl
mov edx, ebp
shl edx, 7
sub edx, ebp
sub al, dl
mov byte [rsp + 0x162], al
mov al, byte [rsp + 0x163]
movzx eax, al
mov edx, eax
shl edx, 5
sub edx, eax
mov eax, edx
add eax, 0xfffff539
cwde
imul eax, eax, 0xffff8103
shr eax, 0x10
add eax, edx
add eax, 0xfffff539
movzx eax, ax
mov ebp, eax
shr ebp, 0xf
shr eax, 6
add eax, ebp
mov ebp, eax
shl ebp, 7
sub eax, ebp
add eax, edx
add eax, 0xfffff539
add al, 0x7f
movzx eax, al
lea edx, [rax + rax*2]
shr edx, 8
mov ebx, eax
sub bl, dl
shr bl, 1
add bl, dl
shr bl, 6
movzx ebp, bl
mov edx, ebp
shl edx, 7
sub edx, ebp
sub al, dl
mov byte [rsp + 0x163], al
mov al, byte [rsp + 0x164]
movzx eax, al
mov edx, eax
shl edx, 5
sub edx, eax
mov eax, edx
add eax, 0xfffff539
cwde
imul eax, eax, 0xffff8103
shr eax, 0x10
add eax, edx
add eax, 0xfffff539
movzx eax, ax
mov ebp, eax
shr ebp, 0xf
shr eax, 6
add eax, ebp
mov ebp, eax
shl ebp, 7
sub eax, ebp
add eax, edx
add eax, 0xfffff539
add al, 0x7f
movzx eax, al
lea edx, [rax + rax*2]
shr edx, 8
mov ebx, eax
sub bl, dl
shr bl, 1
add bl, dl
shr bl, 6
movzx ebp, bl
mov edx, ebp
shl edx, 7
sub edx, ebp
sub al, dl
mov byte [rsp + 0x164], al
mov al, byte [rsp + 0x165]
movzx eax, al
mov edx, eax
shl edx, 5
sub edx, eax
mov eax, edx
add eax, 0xfffff539
cwde
imul eax, eax, 0xffff8103
shr eax, 0x10
add eax, edx
add eax, 0xfffff539
movzx eax, ax
mov ebp, eax
shr ebp, 0xf
shr eax, 6
add eax, ebp
mov ebp, eax
shl ebp, 7
sub eax, ebp
add eax, edx
add eax, 0xfffff539
add al, 0x7f
movzx eax, al
lea edx, [rax + rax*2]
shr edx, 8
mov ebx, eax
sub bl, dl
shr bl, 1
add bl, dl
shr bl, 6
movzx ebp, bl
mov edx, ebp
shl edx, 7
sub edx, ebp
sub al, dl
mov byte [rsp + 0x165], al
mov al, byte [rsp + 0x166]
movzx eax, al
mov edx, eax
shl edx, 5
sub edx, eax
mov eax, edx
add eax, 0xfffff539
cwde
imul eax, eax, 0xffff8103
shr eax, 0x10
add eax, edx
add eax, 0xfffff539
movzx eax, ax
mov ebp, eax
shr ebp, 0xf
shr eax, 6
add eax, ebp
mov ebp, eax
shl ebp, 7
sub eax, ebp
add eax, edx
add eax, 0xfffff539
add al, 0x7f
movzx eax, al
lea edx, [rax + rax*2]
shr edx, 8
mov ebx, eax
sub bl, dl
shr bl, 1
add bl, dl
shr bl, 6
movzx ebp, bl
mov edx, ebp
shl edx, 7
sub edx, ebp
sub al, dl
mov byte [rsp + 0x166], al
mov al, byte [rsp + 0x167]
movzx eax, al
mov edx, eax
shl edx, 5
sub edx, eax
mov eax, edx
add eax, 0xfffff539
cwde
imul eax, eax, 0xffff8103
shr eax, 0x10
add eax, edx
add eax, 0xfffff539
movzx eax, ax
mov ebp, eax
shr ebp, 0xf
shr eax, 6
add eax, ebp
mov ebp, eax
shl ebp, 7
sub eax, ebp
add eax, edx
add eax, 0xfffff539
add al, 0x7f
movzx eax, al
lea edx, [rax + rax*2]
shr edx, 8
mov ebx, eax
sub bl, dl
shr bl, 1
add bl, dl
shr bl, 6
movzx ebp, bl
mov edx, ebp
shl edx, 7
sub edx, ebp
sub al, dl
mov byte [rsp + 0x167], al
mov al, byte [rsp + 0x168]
movzx eax, al
mov edx, eax
shl edx, 5
sub edx, eax
mov eax, edx
add eax, 0xfffff539
cwde
imul eax, eax, 0xffff8103
shr eax, 0x10
add eax, edx
add eax, 0xfffff539
movzx eax, ax
mov ebp, eax
shr ebp, 0xf
shr eax, 6
add eax, ebp
mov ebp, eax
shl ebp, 7
sub eax, ebp
add eax, edx
add eax, 0xfffff539
add al, 0x7f
movzx eax, al
lea edx, [rax + rax*2]
shr edx, 8
mov ebx, eax
sub bl, dl
shr bl, 1
add bl, dl
shr bl, 6
movzx ebp, bl
mov edx, ebp
shl edx, 7
sub edx, ebp
sub al, dl
mov byte [rsp + 0x168], al
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rsi, rax
mov byte [rsp + 0x160], 0
lea rcx, [rsp + 0x161]
mov byte [rsp + 0x161], reloc.WS2_32.dll_socket
mov byte [rsp + 0x162], 0x2a
mov byte [rsp + 0x163], 0x5c
mov byte [rsp + 0x164], 0x2a
mov byte [rsp + 0x165], 0x79
mov byte [rsp + 0x166], 0x2a
mov byte [rsp + 0x167], 0x5c
mov byte [rsp + 0x168], 0x2a
mov byte [rsp + 0x169], pe_nt_image_headers64
mov byte [rsp + 0x16a], 0x2a
mov byte [rsp + 0x16b], 9
mov byte [rsp + 0x16c], 0x2a
mov byte [rsp + 0x16d], 0x66
mov byte [rsp + 0x16e], 0x2a
mov byte [rsp + 0x16f], 0x59
mov byte [rsp + 0x170], 0x2a
mov byte [rsp + 0x171], 0x66
mov byte [rsp + 0x172], 0x2a
mov byte [rsp + 0x173], 0x4e
mov byte [rsp + 0x174], 0x2a
mov byte [rsp + 0x175], 0x25
mov byte [rsp + 0x176], 0x2a
mov byte [rsp + 0x177], 0x4f
mov byte [rsp + 0x178], 0x2a
mov byte [rsp + 0x179], WSAGetLastError
mov byte [rsp + 0x17a], 0x2a
mov byte [rsp + 0x17b], 0x66
mov byte [rsp + 0x17c], 0x2a
mov byte [rsp + 0x17d], 0x5e
mov byte [rsp + 0x17e], 0x2a
mov byte [rsp + 0x17f], 0x60
mov byte [rsp + 0x180], 0x2a
mov byte [rsp + 0x181], 0x1a
mov byte [rsp + 0x182], 0x2a
mov byte [rsp + 0x183], 0x5a
mov byte [rsp + 0x184], 0x2a
mov byte [rsp + 0x185], WSAGetLastError
mov byte [rsp + 0x186], 0x2a
mov byte [rsp + 0x187], WSACleanup
mov byte [rsp + 0x188], 0x2a
mov byte [rsp + 0x189], reloc.WS2_32.dll_socket
mov byte [rsp + 0x18a], 0x2a
mov byte [rsp + 0x18b], WSACleanup
mov byte [rsp + 0x18c], 0x2a
mov byte [rsp + 0x18d], 0x51
mov byte [rsp + 0x18e], 0x2a
mov byte [rsp + 0x18f], 0x27
mov byte [rsp + 0x190], 0x2a
mov byte [rsp + 0x191], reloc.WS2_32.dll_inet_ntoa
mov byte [rsp + 0x192], 0x2a
mov byte [rsp + 0x193], 0x1b
mov byte [rsp + 0x194], 0x2a
mov byte [rsp + 0x195], pe_nt_image_headers64
mov byte [rsp + 0x196], 0x2a
mov byte [rsp + 0x197], reloc.WS2_32.dll_inet_ntoa
mov byte [rsp + 0x198], 0x2a
mov byte [rsp + 0x199], 0x7d
mov byte [rsp + 0x19a], 0x2a
mov byte [rsp + 0x19b], 0x7e
mov byte [rsp + 0x19c], 0x2a
mov byte [rsp + 0x19d], 0x2a
mov byte [rsp + 0x19e], 0x2a
mov al, byte [rsp + 0x160]
test al, 1
jne 0x14000b7ae
mov eax, 1
nop word cs:[rax + rax]
nop
movzx edx, byte [rsp + rax + 0x160]
movzx edx, dl
lea ebp, [rdx + rdx*8]
lea edx, [rdx + rdx*8]
add edx, 0xfffffe86
movsx edx, dx
imul edx, edx, 0xffff8103
shr edx, 0x10
add edx, ebp
add edx, 0xfffffe86
movzx edx, dx
mov ebx, edx
shr ebx, 0xf
shr edx, 6
add edx, ebx
mov ebx, edx
shl ebx, 7
sub edx, ebx
add edx, ebp
add edx, 0xfffffe86
add dl, 0x7f
movzx edx, dl
lea ebp, [rdx + rdx*2]
shr ebp, 8
mov ebx, edx
sub bl, bpl
shr bl, 1
add bl, bpl
shr bl, 6
movzx ebx, bl
mov ebp, ebx
shl ebp, 7
sub ebp, ebx
sub dl, bpl
mov byte [rsp + rax + 0x160], dl
add rax, 1
cmp rax, 0x3f
jne 0x14000b730
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rsp + 0x70], 0
mov rcx, qword [rsp + 0x78]
mov rbp, qword [rcx]
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], 0
mov rdx, rsi
mov r8, rax
mov r9d, gethostbyname
call qword [rbp + 0xa0]
test eax, eax
js 0x14000c1d4
mov qword [rsp + 0x68], 0
mov dword [rsp + 0x64], 0
cmp qword [rsp + 0x70], 0
je 0x14000c152
mov rcx, qword [rsp + 0x70]
lea r13, [rsp + 0x64]
lea r15, [rsp + 0x68]
xorps xmm6, xmm6
lea rsi, [rsp + 0x48]
lea rdi, [rsp + 0x160]
lea r12, [rsp + 0xc0]
mov r14, qword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x14000b88f
mov rcx, rdi
lea rdx, [rsp + 0xc1]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, r12
call qword [sym.imp.KERNEL32.DLL_Wow64DisableWow64FsRedirection]
mov rcx, rdi
call fcn.14000aa80
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.KERNEL32.DLL_Wow64RevertWow64FsRedirection]
mov rcx, rsi
call r14
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14000c152
mov rax, qword [rcx]
mov qword [rsp + 0x20], r13
mov edx, 0xffffffff
mov r8d, 1
mov r9, r15
call qword [rax + 0x20]
cmp dword [rsp + 0x64], 0
je 0x14000c152
mov rcx, qword [rsp + 0x68]
mov byte [rsp + 0x160], 0
mov byte [rsp + 0x161], 0x5d
mov byte [rsp + 0x162], 0x41
mov byte [rsp + 0x163], WSAGetLastError
mov byte [rsp + 0x164], 0x41
mov byte [rsp + 0x165], 0x41
mov byte [rsp + 0x166], 0x41
mov al, byte [rsp + 0x160]
test al, 1
jne 0x14000bb8d
mov al, byte [rsp + 0x161]
movzx eax, al
imul eax, eax, 0xfffffff5
mov edx, eax
add edx, 0x2cb
movsx edx, dx
imul edx, edx, 0xffff8103
shr edx, 0x10
add edx, eax
add edx, 0x2cb
movzx edx, dx
mov ebp, edx
shr ebp, 0xf
shr edx, 6
add edx, ebp
mov ebp, edx
shl ebp, 7
sub edx, ebp
add eax, edx
add eax, 0x2cb
add al, 0x7f
movzx eax, al
lea edx, [rax + rax*2]
shr edx, 8
mov ebx, eax
sub bl, dl
shr bl, 1
add bl, dl
shr bl, 6
movzx ebp, bl
mov edx, ebp
shl edx, 7
sub edx, ebp
sub al, dl
mov byte [rsp + 0x161], al
mov al, byte [rsp + 0x162]
movzx eax, al
imul eax, eax, 0xfffffff5
mov edx, eax
add edx, 0x2cb
movsx edx, dx
imul edx, edx, 0xffff8103
shr edx, 0x10
add edx, eax
add edx, 0x2cb
movzx edx, dx
mov ebp, edx
shr ebp, 0xf
shr edx, 6
add edx, ebp
mov ebp, edx
shl ebp, 7
sub edx, ebp
add eax, edx
add eax, 0x2cb
add al, 0x7f
movzx eax, al
lea edx, [rax + rax*2]
shr edx, 8
mov ebx, eax
sub bl, dl
shr bl, 1
add bl, dl
shr bl, 6
movzx ebp, bl
mov edx, ebp
shl edx, 7
sub edx, ebp
sub al, dl
mov byte [rsp + 0x162], al
mov al, byte [rsp + 0x163]
movzx eax, al
imul eax, eax, 0xfffffff5
mov edx, eax
add edx, 0x2cb
movsx edx, dx
imul edx, edx, 0xffff8103
shr edx, 0x10
add edx, eax
add edx, 0x2cb
movzx edx, dx
mov ebp, edx
shr ebp, 0xf
shr edx, 6
add edx, ebp
mov ebp, edx
shl ebp, 7
sub edx, ebp
add eax, edx
add eax, 0x2cb
add al, 0x7f
movzx eax, al
lea edx, [rax + rax*2]
shr edx, 8
mov ebx, eax
sub bl, dl
shr bl, 1
add bl, dl
shr bl, 6
movzx ebp, bl
mov edx, ebp
shl edx, 7
sub edx, ebp
sub al, dl
mov byte [rsp + 0x163], al
mov al, byte [rsp + 0x164]
movzx eax, al
imul eax, eax, 0xfffffff5
mov edx, eax
add edx, 0x2cb
movsx edx, dx
imul edx, edx, 0xffff8103
shr edx, 0x10
add edx, eax
add edx, 0x2cb
movzx edx, dx
mov ebp, edx
shr ebp, 0xf
shr edx, 6
add edx, ebp
mov ebp, edx
shl ebp, 7
sub edx, ebp
add eax, edx
add eax, 0x2cb
add al, 0x7f
movzx eax, al
lea edx, [rax + rax*2]
shr edx, 8
mov ebx, eax
sub bl, dl
shr bl, 1
add bl, dl
shr bl, 6
movzx ebp, bl
mov edx, ebp
shl edx, 7
sub edx, ebp
sub al, dl
mov byte [rsp + 0x164], al
mov al, byte [rsp + 0x165]
movzx eax, al
imul eax, eax, 0xfffffff5
mov edx, eax
add edx, 0x2cb
movsx edx, dx
imul edx, edx, 0xffff8103
shr edx, 0x10
add edx, eax
add edx, 0x2cb
movzx edx, dx
mov ebp, edx
shr ebp, 0xf
shr edx, 6
add edx, ebp
mov ebp, edx
shl ebp, 7
sub edx, ebp
add eax, edx
add eax, 0x2cb
add al, 0x7f
movzx eax, al
lea edx, [rax + rax*2]
shr edx, 8
mov ebx, eax
sub bl, dl
shr bl, 1
add bl, dl
shr bl, 6
movzx ebp, bl
mov edx, ebp
shl edx, 7
sub edx, ebp
sub al, dl
mov byte [rsp + 0x165], al
mov al, byte [rsp + 0x166]
movzx eax, al
imul eax, eax, 0xfffffff5
mov edx, eax
add edx, 0x2cb
movsx edx, dx
imul edx, edx, 0xffff8103
shr edx, 0x10
add edx, eax
add edx, 0x2cb
movzx edx, dx
mov ebp, edx
shr ebp, 0xf
shr edx, 6
add edx, ebp
mov ebp, edx
shl ebp, 7
sub edx, ebp
add eax, edx
add eax, 0x2cb
add al, 0x7f
movzx eax, al
lea edx, [rax + rax*2]
shr edx, 8
mov ebx, eax
sub bl, dl
shr bl, 1
add bl, dl
shr bl, 6
movzx ebp, bl
mov edx, ebp
shl edx, 7
sub edx, ebp
sub al, dl
mov byte [rsp + 0x166], al
mov rax, qword [rcx]
movups xmmword [rsp + 0x20], xmm6
lea rdx, [rsp + 0x161]
xor r8d, r8d
mov r9, rsi
call qword [rax + 0x20]
mov r8d, 0x800
mov rcx, rdi
xor edx, edx
call fcn.140033e10
mov r8, qword [rsp + 0x50]
mov byte [rsp + 0xc0], 0
mov byte [rsp + 0xc1], WSACleanup
mov byte [rsp + 0xc2], 0x4a
mov byte [rsp + 0xc3], 9
mov byte [rsp + 0xc4], 0x4a
mov byte [rsp + 0xc5], 0x28
mov byte [rsp + 0xc6], 0x4a
mov byte [rsp + 0xc7], 0x63
mov byte [rsp + 0xc8], 0x4a
mov byte [rsp + 0xc9], 0x5d
mov byte [rsp + 0xca], 0x4a
mov byte [rsp + 0xcb], 0x54
mov byte [rsp + 0xcc], 0x4a
mov byte [rsp + 0xcd], 0x5d
mov byte [rsp + 0xce], 0x4a
mov byte [rsp + 0xcf], 0x77
mov byte [rsp + 0xd0], 0x4a
mov byte [rsp + 0xd1], 0x19
mov byte [rsp + 0xd2], 0x4a
mov byte [rsp + 0xd3], WSACleanup
mov byte [rsp + 0xd4], 0x4a
mov byte [rsp + 0xd5], 0x77
mov byte [rsp + 0xd6], 0x4a
mov byte [rsp + 0xd7], 0x45
mov byte [rsp + 0xd8], 0x4a
mov byte [rsp + 0xd9], 0x64
mov byte [rsp + 0xda], 0x4a
mov byte [rsp + 0xdb], 0x7c
mov byte [rsp + 0xdc], 0x4a
mov byte [rsp + 0xdd], WSACleanup
mov byte [rsp + 0xde], 0x4a
mov byte [rsp + 0xdf], gethostbyname
mov byte [rsp + 0xe0], 0x4a
mov byte [rsp + 0xe1], 0x3e
mov byte [rsp + 0xe2], 0x4a
mov byte [rsp + 0xe3], 0x28
mov byte [rsp + 0xe4], 0x4a
mov byte [rsp + 0xe5], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0xe6], 0x4a
mov byte [rsp + 0xe7], 0x1f
mov byte [rsp + 0xe8], 0x4a
mov byte [rsp + 0xe9], 0x49
mov byte [rsp + 0xea], 0x4a
mov byte [rsp + 0xeb], 0x7c
mov byte [rsp + 0xec], 0x4a
mov byte [rsp + 0xed], 0x1c
mov byte [rsp + 0xee], 0x4a
mov byte [rsp + 0xef], 0xa
mov byte [rsp + 0xf0], 0x4a
mov byte [rsp + 0xf1], 0x49
mov byte [rsp + 0xf2], 0x4a
mov byte [rsp + 0xf3], 0x7e
mov byte [rsp + 0xf4], 0x4a
mov byte [rsp + 0xf5], 0x5d
mov byte [rsp + 0xf6], 0x4a
mov byte [rsp + 0xf7], 9
mov byte [rsp + 0xf8], 0x4a
mov byte [rsp + 0xf9], WSACleanup
mov byte [rsp + 0xfa], 0x4a
mov byte [rsp + 0xfb], reloc.WS2_32.dll_gethostname
mov byte [rsp + 0xfc], 0x4a
mov byte [rsp + 0xfd], 0x7c
mov byte [rsp + 0xfe], 0x4a
mov byte [rsp + 0xff], 0x1f
mov byte [rsp + 0x100], 0x4a
mov byte [rsp + 0x101], 0x3d
mov byte [rsp + 0x102], 0x4a
mov byte [rsp + 0x103], 0x5d
mov byte [rsp + 0x104], 0x4a
mov byte [rsp + 0x105], 9
mov byte [rsp + 0x106], 0x4a
mov byte [rsp + 0x107], 0x7c
mov byte [rsp + 0x108], 0x4a
mov byte [rsp + 0x109], WSACleanup
mov byte [rsp + 0x10a], 0x4a
mov byte [rsp + 0x10b], 0x5b
mov byte [rsp + 0x10c], 0x4a
mov byte [rsp + 0x10d], 6
mov byte [rsp + 0x10e], 0x4a
mov byte [rsp + 0x10f], 0x45
mov byte [rsp + 0x110], 0x4a
mov byte [rsp + 0x111], 0x63
mov byte [rsp + 0x112], 0x4a
mov byte [rsp + 0x113], 0x5d
mov byte [rsp + 0x114], 0x4a
mov byte [rsp + 0x115], 0x54
mov byte [rsp + 0x116], 0x4a
mov byte [rsp + 0x117], 0x5d
mov byte [rsp + 0x118], 0x4a
mov byte [rsp + 0x119], 0x77
mov byte [rsp + 0x11a], 0x4a
mov byte [rsp + 0x11b], 0x49
mov byte [rsp + 0x11c], 0x4a
mov byte [rsp + 0x11d], 0x7d
mov byte [rsp + 0x11e], 0x4a
mov byte [rsp + 0x11f], 8
mov byte [rsp + 0x120], 0x4a
mov byte [rsp + 0x121], 0x28
mov byte [rsp + 0x122], 0x4a
mov byte [rsp + 0x123], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0x124], 0x4a
mov byte [rsp + 0x125], 0x1f
mov byte [rsp + 0x126], 0x4a
mov byte [rsp + 0x127], WSACleanup
mov byte [rsp + 0x128], 0x4a
mov byte [rsp + 0x129], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0x12a], 0x4a
mov byte [rsp + 0x12b], 0x29
mov byte [rsp + 0x12c], 0x4a
mov byte [rsp + 0x12d], 0xa
mov byte [rsp + 0x12e], 0x4a
mov byte [rsp + 0x12f], 0x77
mov byte [rsp + 0x130], 0x4a
mov byte [rsp + 0x131], 0x1f
mov byte [rsp + 0x132], 0x4a
mov byte [rsp + 0x133], 0x7d
mov byte [rsp + 0x134], 0x4a
mov byte [rsp + 0x135], 0x5d
mov byte [rsp + 0x136], 0x4a
mov byte [rsp + 0x137], shutdown
mov byte [rsp + 0x138], 0x4a
mov byte [rsp + 0x139], 0x5d
mov byte [rsp + 0x13a], 0x4a
mov byte [rsp + 0x13b], 0x77
mov byte [rsp + 0x13c], 0x4a
mov byte [rsp + 0x13d], 0x62
mov byte [rsp + 0x13e], 0x4a
mov byte [rsp + 0x13f], 6
mov byte [rsp + 0x140], 0x4a
mov byte [rsp + 0x141], 0x7a
mov byte [rsp + 0x142], 0x4a
mov byte [rsp + 0x143], 5
mov byte [rsp + 0x144], 0x4a
mov byte [rsp + 0x145], WSACleanup
mov byte [rsp + 0x146], 0x4a
mov byte [rsp + 0x147], 3
mov byte [rsp + 0x148], 0x4a
mov byte [rsp + 0x149], 0x49
mov byte [rsp + 0x14a], 0x4a
mov byte [rsp + 0x14b], WSACleanup
mov byte [rsp + 0x14c], 0x4a
mov byte [rsp + 0x14d], 0x62
mov byte [rsp + 0x14e], 0x4a
mov byte [rsp + 0x14f], 0x77
mov byte [rsp + 0x150], 0x4a
mov byte [rsp + 0x151], 0x28
mov byte [rsp + 0x152], 0x4a
mov byte [rsp + 0x153], 0x5d
mov byte [rsp + 0x154], 0x4a
mov byte [rsp + 0x155], 0x53
mov byte [rsp + 0x156], 0x4a
mov byte [rsp + 0x157], 0x5d
mov byte [rsp + 0x158], 0x4a
mov byte [rsp + 0x159], 0x7e
mov byte [rsp + 0x15a], 0x4a
mov byte [rsp + 0x15b], 0x5d
mov byte [rsp + 0x15c], 0x4a
mov byte [rsp + 0x15d], 0x4a
mov byte [rsp + 0x15e], 0x4a
mov al, byte [rsp + 0xc0]
test al, 1
jne 0x14000b840
mov eax, 1
nop word [rax + rax]
movzx ecx, byte [rsp + rax + 0xc0]
movzx ecx, cl
lea ecx, [rcx + rcx*2]
lea edx, [rcx*4 - 0x378]
movsx edx, dx
imul edx, edx, 0xffff8103
shr edx, 0x10
lea edx, [rdx + rcx*4]
add edx, 0xfffffc88
movzx edx, dx
mov ebp, edx
shr ebp, 0xf
shr edx, 6
add edx, ebp
mov ebp, edx
shl ebp, 7
sub edx, ebp
lea ecx, [rdx + rcx*4]
add ecx, 0xfffffc88
add cl, 0x7f
movzx ecx, cl
lea edx, [rcx + rcx*2]
shr edx, 8
mov ebx, ecx
sub bl, dl
shr bl, 1
add bl, dl
shr bl, 6
movzx ebp, bl
mov edx, ebp
shl edx, 7
sub edx, ebp
sub cl, dl
mov byte [rsp + rax + 0xc0], cl
add rax, 1
cmp rax, 0x9f
jne 0x14000c0d0
jmp 0x14000b840
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
je 0x14000c165
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0xb8]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x70]
jmp 0x14000c1e7
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0xb8]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
xor esi, esi
mov rcx, qword [rsp + 0x968]
xor rcx, rsp
call fcn.140031ee0
mov eax, esi
movaps xmm6, xmmword [rsp + 0x970]
add rsp, 0x988
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0xb8]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov si, 1
jmp 0x14000c1a6