Function at 0x140065330
Capabilities:
Check if file exists
Download url
Encode data using xor
Enumerate processes
Move file
Receive data
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x500]
sub rsp, 0x600
mov rax, qword [0x1403d15a0]
xor rax, rsp
mov qword [rbp + 0x4f0], rax
mov r13, rcx
mov qword [rbp + 0x20], rcx
xor edi, edi
mov dword [rsp + 0x30], edi
lea rcx, [rbp]
call fcn.140064220
nop
mov rdx, rax
lea rcx, [rbp - 0x60]
call fcn.1400639c0
mov rbx, rax
lea rsi, [r13 + 0x190]
cmp rsi, rax
je 0x140065400
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x1400653d4
mov rcx, qword [rsi]
inc rdx
cmp rdx, 0x1000
jb 0x1400653cf
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400665b9
mov rcx, r8
call fcn.14029a1a0
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], 0
movups xmm0, xmmword [rbx]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsi + 0x10], xmm1
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x14006543b
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140065436
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400665b9
call fcn.14029a1a0
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x48], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x60], 0
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x10
jb 0x140065486
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140065481
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400665bf
call fcn.14029a1a0
cmp qword [r13 + 0x30], 0xa
jne 0x1400665b1
cmp qword [r13 + 0x50], 0x40
jne 0x1400665b1
mov dword [rbp + 0x240], 0x8a8c88c6
mov dword [rbp + 0x244], 0x918fba90
mov word [rbp + 0x248], 0xd5
mov byte [rbp + 0x24a], 1
mov rcx, rdi
lea eax, [rcx - 0x20]
xor byte [rbp + rcx + 0x240], al
inc rcx
cmp rcx, 9
jb 0x1400654c3
mov byte [rbp + 0x24a], 0
lea rdx, [r13 + 0x20]
lea rcx, [rbp + 0x270]
call fcn.140063df0
mov r15, rax
mov dword [rsp + 0x58], 0x8d958ec6
mov dword [rsp + 0x5c], 0x838f9781
mov word [rsp + 0x60], 0xd5
mov byte [rsp + 0x62], 1
mov rcx, rdi
nop
lea eax, [rcx - 0x20]
xor byte [rsp + rcx + 0x58], al
inc rcx
cmp rcx, 9
jb 0x140065510
mov byte [rsp + 0x62], 0
mov rdx, r13
lea rcx, [rbp + 0xe8]
call fcn.140063df0
mov r14, rax
mov dword [rsp + 0x40], 0x8e838fc6
mov dword [rsp + 0x44], 0x100d881
mov rcx, rdi
nop word [rax + rax]
lea eax, [rcx - 0x20]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 6
jb 0x140065550
mov byte [rsp + 0x47], 0
lea rax, [rbp + 0x200]
mov qword [rsp + 0x38], rax
lea rdx, [0x140406f58]
lea rcx, [rbp + 0x200]
call fcn.14005da10
mov rdi, rax
lea rax, [rbp + 0x220]
mov qword [rsp + 0x30], rax
lea r12, [r13 + 0x40]
mov rdx, r12
lea rcx, [rbp + 0x220]
call fcn.14005da10
mov rbx, rax
mov rdx, rsi
lea rcx, [rbp + 0x1c0]
call fcn.14005da10
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0xc8]
call fcn.140064370
mov rsi, rax
mov dword [rsp + 0x48], 0xe4e8e0a2
mov dword [rsp + 0x4c], 0xb6f3ece3
mov word [rsp + 0x50], 0x100
xor eax, eax
mov ecx, eax
nop dword [rax]
lea eax, [rcx - 0x7c]
xor byte [rsp + rcx + 0x48], al
inc rcx
cmp rcx, 8
jb 0x1400655f0
mov byte [rsp + 0x51], 0
lea rax, [rbp + 0x188]
mov qword [rbp - 0x68], rax
lea rdx, [0x140406f58]
lea rcx, [rbp + 0x188]
call fcn.14005da10
mov rdi, rax
lea rax, [rbp + 0x108]
mov qword [rsp + 0x38], rax
mov rdx, r12
lea rcx, [rbp + 0x108]
call fcn.14005da10
mov rbx, rax
lea rdx, [r13 + 0x60]
lea rcx, [rbp + 0x128]
call fcn.14005da10
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0xa8]
call fcn.140064370
mov rdi, rax
mov dword [rsp + 0x38], 0xf5e3f3a2
mov word [rsp + 0x3c], 0xb5
mov byte [rsp + 0x3e], 1
xor r13d, r13d
mov ecx, r13d
nop word [rax + rax]
lea eax, [rcx - 0x7c]
xor byte [rsp + rcx + 0x38], al
inc rcx
cmp rcx, 5
jb 0x140065690
mov byte [rsp + 0x3e], r13b
mov dword [rsp + 0x30], 0xf3efebed
mov word [rsp + 0x34], 0x100
mov rcx, r13
nop word [rax + rax]
lea eax, [rcx - 0x7c]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 4
jb 0x1400656c0
mov byte [rsp + 0x35], r13b
mov qword [rsp + 0x78], r13
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x70], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x78], r13b
lea rax, [rsp + 0x30]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop word [rax + rax]
inc r8
cmp byte [rax + r8], r13b
jne 0x140065700
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x78]
call fcn.14005dd20
nop
lea rdx, [rsp + 0x78]
lea rcx, [rbp + 0x88]
call fcn.140063df0
mov r10, rax
mov dword [rsp + 0x30], 0xe2f6fcf0
mov word [rsp + 0x34], 0xb5
mov byte [rsp + 0x36], 1
mov rcx, r13
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx - 0x7c]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 5
jb 0x140065750
mov byte [rsp + 0x36], 0
lea rax, [rsp + 0x30]
mov r9, rbx
nop dword [rax]
inc r9
cmp byte [rax + r9], 0
jne 0x140065770
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, r10
call fcn.1400b0c70
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x10], r13
mov qword [rbp - 8], r13
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x10], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rax, [rsp + 0x38]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400657c0
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x20]
call fcn.14005de80
movups xmm0, xmmword [rax]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x10], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, rdi
lea r8, [rbp]
lea rcx, [rbp - 0x60]
call fcn.1400b0d80
nop
lea rax, [rsp + 0x48]
mov r8, rbx
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140065810
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x60]
call fcn.14005de80
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x168], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x178], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, rsi
lea r8, [rbp + 0x168]
lea rcx, [rbp + 0x68]
call fcn.1400b0d80
nop
lea rax, [rsp + 0x40]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140065870
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x68]
call fcn.14005de80
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x148], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x158], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, r14
lea r8, [rbp + 0x148]
lea rcx, [rbp + 0x48]
call fcn.1400b0d80
nop
lea rax, [rsp + 0x58]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400658d0
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x48]
call fcn.14005de80
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x68], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, r15
lea r8, [rsp + 0x58]
lea rcx, [rbp + 0x28]
call fcn.1400b0d80
nop
lea rax, [rbp + 0x240]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140065921
mov r8, rbx
lea rdx, [rbp + 0x240]
lea rcx, [rbp + 0x28]
call fcn.14005de80
xor r15d, r15d
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x28], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x30], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], r15b
lea rdx, [0x140406f58]
cmp qword [0x140406f70], 0x10
cmovae rdx, qword [0x140406f58]
mov r8, qword [0x140406f68]
lea rcx, [rbp - 0x40]
call fcn.14005de80
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x290], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x2a0], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], r15b
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x1400659f0
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400659eb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400665c5
call fcn.14029a1a0
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x28], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x40], 0
mov rdx, qword [rbp + 0x40]
cmp rdx, 0x10
jb 0x140065a3b
inc rdx
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140065a36
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400665cb
call fcn.14029a1a0
mov qword [rbp + 0x38], r15
mov qword [rbp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x28], 0
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x140065a89
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140065a83
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400665d1
call fcn.14029a1a0
nop
mov rdx, qword [rbp + 0x60]
cmp rdx, 0x10
jb 0x140065ac4
inc rdx
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140065abf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400665d7
call fcn.14029a1a0
mov qword [rbp + 0x58], r15
mov qword [rbp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x48], 0
mov rdx, qword [rbp + 0x160]
cmp rdx, 0x10
jb 0x140065b16
inc rdx
mov rcx, qword [rbp + 0x148]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140065b10
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400665dd
call fcn.14029a1a0
nop
mov rdx, qword [rbp + 0x80]
cmp rdx, 0x10
jb 0x140065b54
inc rdx
mov rcx, qword [rbp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140065b4f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400665e3
call fcn.14029a1a0
mov qword [rbp + 0x78], r15
mov qword [rbp + 0x80], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x68], 0
mov rdx, qword [rbp + 0x180]
cmp rdx, 0x10
jb 0x140065ba9
inc rdx
mov rcx, qword [rbp + 0x168]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140065ba3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400665e9
call fcn.14029a1a0
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x140065be4
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140065bdf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400665ef
call fcn.14029a1a0
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x60], 0
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x10
jb 0x140065c30
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140065c2a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400665f5
call fcn.14029a1a0
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x140065c6b
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140065c66
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400665fb
call fcn.14029a1a0
mov qword [rbp - 0x10], r15
mov qword [rbp - 8], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x20], 0
mov rdx, qword [rbp + 0xa0]
cmp rdx, 0x10
jb 0x140065cbc
inc rdx
mov rcx, qword [rbp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140065cb7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140066601
call fcn.14029a1a0
mov qword [rbp + 0x98], r15
mov qword [rbp + 0xa0], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x88], 0
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
jb 0x140065d11
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140065d0c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140066607
call fcn.14029a1a0
mov qword [rbp - 0x78], r15
mov qword [rbp - 0x70], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x78], 0
mov rdx, qword [rbp + 0xc0]
cmp rdx, 0x10
jb 0x140065d63
inc rdx
mov rcx, qword [rbp + 0xa8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140065d5e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006660d
call fcn.14029a1a0
mov qword [rbp + 0xb8], r15
mov qword [rbp + 0xc0], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xa8], 0
mov rdx, qword [rbp + 0xe0]
cmp rdx, 0x10
jb 0x140065dbd
inc rdx
mov rcx, qword [rbp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140065db8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140066613
call fcn.14029a1a0
mov qword [rbp + 0xd8], r15
mov qword [rbp + 0xe0], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xc8], 0
mov rdx, qword [rbp + 0x100]
cmp rdx, 0x10
jb 0x140065e17
inc rdx
mov rcx, qword [rbp + 0xe8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140065e12
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140066619
call fcn.14029a1a0
mov qword [rbp + 0xf8], r15
mov qword [rbp + 0x100], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xe8], 0
mov rdx, qword [rbp + 0x288]
cmp rdx, 0x10
jb 0x140065e71
inc rdx
mov rcx, qword [rbp + 0x270]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140065e6c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006661f
call fcn.14029a1a0
mov qword [rbp + 0x280], r15
mov qword [rbp + 0x288], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x270], 0
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], r15
lea rdi, [rbp + 0x290]
mov r14, qword [rbp + 0x290]
mov r13, qword [rbp + 0x2a8]
cmp r13, 0x10
cmovae rdi, r14
movabs rax, 0x7fffffffffffffff
mov rsi, qword [rbp + 0x2a0]
cmp rsi, 0x10
jae 0x140065edc
movups xmm0, xmmword [rdi]
movups xmmword [rsp + 0x58], xmm0
mov ebx, reloc.WS2_32.dll_ntohs
jmp 0x140065f49
mov rbx, rsi
or rbx, 0xf
cmp rbx, rax
cmova rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140065f26
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140066625
mov rcx, rax
call fcn.14029a1a8
mov rcx, rax
test rax, rax
je 0x14006662b
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140065f35
test rcx, rcx
je 0x140065f32
call fcn.14029a1a8
jmp 0x140065f35
mov rax, r15
mov qword [rsp + 0x58], rax
lea r8, [rsi + 1]
mov rdx, rdi
mov rcx, rax
call fcn.1402a0960
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x250]
call fcn.14006a9e0
nop
cmp byte [0x140406e90], 0
jne 0x1400664d1
lea rax, [rbp + 0x128]
mov qword [rbp - 0x68], rax
lea rdx, [0x140406f58]
lea rcx, [rbp + 0x128]
call fcn.14005da10
mov r15, rax
lea rax, [rbp + 0x108]
mov qword [rsp + 0x40], rax
mov rdx, r12
lea rcx, [rbp + 0x108]
call fcn.14005da10
mov r12, rax
xor eax, eax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov rdi, qword [rbp + 0x260]
lea rsi, [rbp + 0x250]
cmp qword [rbp + 0x268], 0x10
cmovae rsi, qword [rbp + 0x250]
cmp rdi, 0x10
jae 0x140065ff1
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x78], xmm0
lea ebx, [rax + 0xf]
jmp 0x140066063
mov rbx, rdi
or rbx, 0xf
movabs rcx, 0x7fffffffffffffff
cmp rbx, rcx
cmova rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140066045
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140066631
mov rcx, rax
call fcn.14029a1a8
mov rcx, rax
test rax, rax
je 0x140066637
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14006604f
test rcx, rcx
je 0x14006604f
call fcn.14029a1a8
mov qword [rsp + 0x78], rax
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call fcn.1402a0960
mov qword [rbp - 0x78], rdi
mov qword [rbp - 0x70], rbx
mov r9, r15
mov r8, r12
lea rdx, [rsp + 0x78]
lea rcx, [rbp]
call fcn.140064710
mov rbx, rax
lea rax, [rbp + 0x250]
cmp rax, rbx
je 0x140066115
mov rdx, qword [rbp + 0x268]
cmp rdx, 0x10
jb 0x1400660d3
inc rdx
mov rcx, qword [rbp + 0x250]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400660ce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140066637
call fcn.14029a1a0
xor r15d, r15d
mov qword [rbp + 0x260], r15
mov qword [rbp + 0x268], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x250], r15b
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x250], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x260], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r15b
jmp 0x140066118
xor r15d, r15d
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x10
jb 0x140066153
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006614e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140066637
call fcn.14029a1a0
mov qword [rbp + 0x1f8], r15
lea r8, [rbp + 0x1c0]
lea rdx, [rbp + 0x250]
lea rcx, [rbp + 0x240]
call fcn.1400af330
nop
lea rdx, [0x140390da0]
lea rcx, [rbp + 0x240]
call fcn.1400af460
cmp byte [rax], 4
jne 0x14006663d
lea rcx, [rbp + 0x240]
cmp byte [rax + 8], 0
je 0x140066312
lea rdx, str.sessionid
call fcn.1400af460
mov rcx, qword [rbp + 0x20]
add rcx, 0x170
mov rdx, rax
call fcn.1400b3d80
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x78], r15
mov qword [rbp - 0x70], 7
mov r8d, reloc.WS2_32.dll_listen
lea rdx, [0x140390db8]
lea rcx, [rsp + 0x78]
call fcn.1400ae1d0
mov edi, r15d
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140066262
mov dword [rbp + 0x2b0], 0x238
lea rdx, [rbp + 0x2b0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140066262
lea rcx, [rsp + 0x78]
call fcn.14005d8b0
lea r8, [rbp + 0x2dc]
sub r8, rax
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140066246
add rax, 2
test ecx, ecx
jne 0x140066232
test edx, edx
je 0x14006625c
lea rdx, [rbp + 0x2b0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
jmp 0x14006621a
mov edi, dword [rbp + 0x2b8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbp - 0x70]
cmp rdx, 8
jb 0x1400662ac
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400662a7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140066694
call fcn.14029a1a0
mov r8d, edi
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1400662d6
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.OldLoader.exe
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x1400664bd
nop dword [rax + rax]
lea rcx, str.OldLoader.exe
call fcn.1402b632c
lea rcx, str.OldLoader.exe
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x1400662f0
jmp 0x1400664bd
lea rdx, str.message
call fcn.1400af460
mov rdi, rax
mov byte [rsp + 0x58], 3
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.14029a1a8
mov rbx, rax
mov qword [rax], r15
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov r8d, 0xa
lea rdx, str.invalidver
mov rcx, rax
call fcn.14005dd20
mov qword [rsp + 0x60], rbx
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.1400b0750
movzx ebx, al
movzx edx, byte [rsp + 0x58]
lea rcx, [rsp + 0x60]
call fcn.1400adbd0
nop
lea rcx, [rbp + 0x240]
test bl, bl
je 0x140066425
lea rdx, str.download
call fcn.1400af460
nop
mov qword [rbp + 0x270], r15
movdqa xmm0, xmmword [0x14039cf60]
movdqu xmmword [rbp + 0x280], xmm0
mov byte [rbp + 0x270], 0
mov dword [rsp + 0x30], 0x17ff
cmp byte [rax], 3
jne 0x14006669a
mov rdx, qword [rax + 8]
lea rax, [rbp + 0x270]
cmp rax, rdx
je 0x1400663f2
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x1400663e5
mov rdx, qword [rdx]
lea rcx, [rbp + 0x270]
call fcn.14005dd20
nop
mov r9d, 0x41
lea r8, str.Update
lea rdx, str.New_Update_Available_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
sub eax, 1
je 0x1400666f9
cmp eax, 1
jne 0x140066594
jmp 0x1400666f1
mov byte [0x140406e90], 1
lea rdx, str.message
call fcn.1400af460
mov qword [rbp + 0x270], r15
mov qword [rbp + 0x280], r15
mov qword [rbp + 0x288], reloc.WS2_32.dll_ntohs
mov rdx, rax
lea rcx, [rbp + 0x270]
call fcn.1400b3d80
mov rdx, qword [reloc.WS2_32.dll_ntohs]
cmp rdx, 0x10
jb 0x1400664a1
mov rcx, qword [0x1403fd488]
inc rdx
cmp rdx, 0x1000
jb 0x14006649c
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140066761
mov rcx, r8
call fcn.14029a1a0
movups xmm0, xmmword [rbp + 0x270]
movups xmmword [0x1403fd488], xmm0
movups xmm1, xmmword [rbp + 0x280]
movups xmmword [0x1403fd498], xmm1
movzx edx, byte [rbp + 0x240]
lea rcx, [rbp + 0x248]
call fcn.1400adbd0
nop
mov rdx, qword [rbp + 0x268]
cmp rdx, 0x10
jb 0x140066512
inc rdx
mov rcx, qword [rbp + 0x250]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006650d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006675b
call fcn.14029a1a0
mov qword [rbp + 0x260], r15
mov qword [rbp + 0x268], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x250], 0
cmp r13, 0x10
jb 0x14006655e
lea rdx, [r13 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x140066556
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006658e
mov rcx, r14
call fcn.14029a1a0
mov rcx, qword [rbp + 0x4f0]
xor rcx, rsp
call fcn.14029a180
lea r11, [rsp + 0x600]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1402b22f4
nop
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Failed_to_Update_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call fcn.1402ad474
nop
xor ecx, ecx
call fcn.1402ad474
nop
call fcn.1402b22f4
nop
call fcn.1402b22f4
nop
call fcn.1402b22f4
nop
call fcn.1402b22f4
nop
call fcn.1402b22f4
nop
call fcn.1402b22f4
nop
call fcn.1402b22f4
nop
call fcn.1402b22f4
nop
call fcn.1402b22f4
nop
call fcn.1402b22f4
nop
call fcn.1402b22f4
nop
call fcn.1402b22f4
nop
call fcn.1402b22f4
nop
call fcn.1402b22f4
nop
call fcn.1402b22f4
nop
call fcn.1402b22f4
nop
call fcn.1402b22f4
nop
call fcn.1402b22f4
int3
call fcn.14005c9e0
int3
call fcn.1402b22f4
nop
call fcn.14005c9e0
int3
call fcn.1402b22f4
nop
mov rcx, rax
call fcn.1400ae0d0
mov rdx, rax
lea rcx, [rbp + 0x128]
call fcn.14005d9d0
nop
mov r8, rax
lea rdx, str.type_must_be_boolean__but_is
lea rcx, [rbp + 0x108]
call fcn.1400aecd0
nop
mov r8, rax
mov edx, 0x12e
lea rcx, [rbp + 0x188]
call fcn.140062360
lea rdx, [0x1403c91d0]
lea rcx, [rbp + 0x188]
call fcn.1402a0890
nop
call fcn.1402b22f4
nop
mov rcx, rax
call fcn.1400ae0d0
mov rdx, rax
lea rcx, [rbp + 0x128]
call fcn.14005d9d0
nop
mov r8, rax
lea rdx, str.type_must_be_string__but_is
lea rcx, [rbp + 0x108]
call fcn.1400aecd0
nop
mov r8, rax
mov edx, 0x12e
lea rcx, [rbp + 0x188]
call fcn.140062360
lea rdx, [0x1403c91d0]
lea rcx, [rbp + 0x188]
call fcn.1402a0890
nop
xor ecx, ecx
call fcn.1402ad474
int3
lea rcx, [rbp + 0x270]
call fcn.14005d8d0
mov rdx, rax
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea r8, str.Updated_Loader.exe
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov r8d, 0x104
lea rdx, [rbp + 0x2b0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, str.OldLoader.exe
lea rcx, [rbp + 0x2b0]
call fcn.1402b6cd8
lea rcx, str.start_Updated_Loader.exe
call fcn.1402b6aa8
xor ecx, ecx
call fcn.1402ad474
nop
call fcn.1402b22f4
nop
call fcn.1402b22f4
int3