Function at 0x140061470
Capabilities:
Contain obfuscated stackstrings
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x338]
sub rsp, 0x420
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
movaps xmmword [rax - 0x48], xmm8
mov rax, qword [0x140320680]
xor rax, rsp
mov qword [rbp + 0x2e0], rax
xor r12d, r12d
lea rcx, [rbp + 0x10]
call fcn.140060500
nop
mov rdx, rax
lea rcx, [rbp - 0x10]
call fcn.14005fcb0
mov rdx, rax
lea rcx, [0x14032a968]
call fcn.1400687c0
mov rdx, qword [rbp + 8]
cmp rdx, 0xf
jbe 0x140061517
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061512
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400625c5
call fcn.140214300
movdqa xmm6, xmmword [0x1402f7190]
movdqu xmmword [rbp], xmm6
mov byte [rbp - 0x10], 0
mov rdx, qword [rbp + 0x28]
cmp rdx, 0xf
jbe 0x140061563
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006155e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400625cb
call fcn.140214300
cmp qword [0x14032a890], 0xa
jne 0x14006255d
cmp qword [0x14032a8b0], 0x40
jne 0x14006255d
mov dword [rsp + 0x46], 0x3d7669
mov dword [rsp + 0x40], 0x696e6926
mov word [rsp + 0x44], 0x5f74
mov byte [rsp + 0x4a], 0
lea rdx, [0x14032a880]
lea rcx, [rbp + 0x10]
call fcn.1400600e0
mov r15, rax
mov dword [rbp - 0x6a], 0x3d6469
mov dword [rbp - 0x70], 0x6e776f26
mov word [rbp - 0x6c], 0x7265
mov byte [rbp - 0x66], 0
lea rdx, [0x14032a860]
lea rcx, [rbp + 0x1b0]
call fcn.1400600e0
mov r14, rax
mov word [rsp + 0x35], 0x3d
mov dword [rsp + 0x30], 0x6d616e26
mov byte [rsp + 0x34], 0x65
mov byte [rsp + 0x37], 0
lea rax, [rbp + 0x210]
mov qword [rsp + 0x70], rax
lea rdx, [0x14032a810]
lea rcx, [rbp + 0x210]
call fcn.140068890
mov rdi, rax
lea rax, [rbp + 0x230]
mov qword [rsp + 0x38], rax
lea rdx, [0x14032a8a0]
lea rcx, [rbp + 0x230]
call fcn.140068890
mov rbx, rax
lea rdx, [0x14032a968]
lea rcx, [rbp + 0x250]
call fcn.140068890
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x190]
call fcn.140060630
mov rsi, rax
mov word [rbp - 0x79], 0x3d
mov dword [rbp - 0x80], 0x636e6526
mov word [rbp - 0x7c], 0x656b
mov byte [rbp - 0x7a], 0x79
mov byte [rbp - 0x77], 0
lea rax, [rbp + 0x1d0]
mov qword [rsp + 0x78], rax
lea rdx, [0x14032a810]
lea rcx, [rbp + 0x1d0]
call fcn.140068890
mov rdi, rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x70], rax
lea rdx, [0x14032a8a0]
lea rcx, [rbp - 0x60]
call fcn.140068890
mov rbx, rax
lea rdx, [0x14032a8c0]
lea rcx, [rbp + 0x2a0]
call fcn.140068890
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x170]
call fcn.140060630
mov rdi, rax
mov dword [rsp + 0x72], 0x3d7265
mov word [rsp + 0x70], 0x7626
mov byte [rsp + 0x76], 0
mov word [rsp + 0x3b], reloc.WS2_32.dll_WSACleanup
mov word [rsp + 0x38], 0x6e69
mov byte [rsp + 0x3a], 0x69
mov byte [rsp + 0x3d], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x80], xmm1
lea rax, [rsp + 0x38]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140061740
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x70]
call fcn.14006b9e0
nop
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x150]
call fcn.1400600e0
nop
mov dword [rsp + 0x3a], 0x3d6570
mov word [rsp + 0x38], 0x7974
mov byte [rsp + 0x3e], 0
lea rcx, [rsp + 0x38]
mov r9, rbx
inc r9
cmp byte [rcx + r9], 0
jne 0x140061786
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call fcn.14006d0a0
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x60], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rax, [rsp + 0x70]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x1400617d4
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x50]
call fcn.1400686d0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x130], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x140], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, rdi
lea r8, [rbp + 0x130]
lea rcx, [rbp - 0x10]
call fcn.14006d1a0
nop
lea rax, [rbp - 0x80]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140061830
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x10]
call fcn.1400686d0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x110], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x120], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, rsi
lea r8, [rbp + 0x110]
lea rcx, [rbp + 0xd0]
call fcn.14006d1a0
nop
lea rax, [rsp + 0x30]
mov r8, rbx
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140061890
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0xd0]
call fcn.1400686d0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xf0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x100], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, r14
lea r8, [rbp + 0xf0]
lea rcx, [rbp + 0xb0]
call fcn.14006d1a0
nop
lea rax, [rbp - 0x70]
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400618f0
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0xb0]
call fcn.1400686d0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, r15
lea r8, [rsp + 0x50]
lea rcx, [rbp + 0x90]
call fcn.14006d1a0
nop
lea rax, [rsp + 0x40]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140061944
mov r8, rbx
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x90]
call fcn.1400686d0
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x40], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rdx, [0x14032a810]
cmp qword [0x14032a828], 0xf
cmova rdx, qword [0x14032a810]
mov r8, qword [0x14032a820]
lea rcx, [rbp + 0x30]
call fcn.1400686d0
movups xmm8, xmmword [rax]
movups xmmword [rbp + 0x2c0], xmm8
movups xmm7, xmmword [rax + 0x10]
movups xmmword [rbp + 0x2d0], xmm7
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rbp + 0x48]
cmp rdx, 0xf
jbe 0x140061a16
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061a11
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400625d1
call fcn.140214300
movdqu xmmword [rbp + 0x40], xmm6
mov byte [rbp + 0x30], 0
mov rdx, qword [rbp + 0xa8]
cmp rdx, 0xf
jbe 0x140061a60
inc rdx
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061a5b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400625d7
call fcn.140214300
movdqu xmmword [rbp + 0xa0], xmm6
mov byte [rbp + 0x90], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140061aad
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061aa7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400625dd
call fcn.140214300
nop
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0xf
jbe 0x140061aee
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061ae9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400625e3
call fcn.140214300
movdqu xmmword [rbp + 0xc0], xmm6
mov byte [rbp + 0xb0], 0
mov rdx, qword [rbp + 0x108]
cmp rdx, 0xf
jbe 0x140061b3f
inc rdx
mov rcx, qword [rbp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061b39
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400625e9
call fcn.140214300
nop
mov rdx, qword [rbp + 0xe8]
cmp rdx, 0xf
jbe 0x140061b80
inc rdx
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061b7b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400625ef
call fcn.140214300
movdqu xmmword [rbp + 0xe0], xmm6
mov byte [rbp + 0xd0], 0
mov rdx, qword [rbp + 0x128]
cmp rdx, 0xf
jbe 0x140061bd1
inc rdx
mov rcx, qword [rbp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061bcb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400625f5
call fcn.140214300
nop
mov rdx, qword [rbp + 8]
cmp rdx, 0xf
jbe 0x140061c0c
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061c07
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400625fb
call fcn.140214300
movdqu xmmword [rbp], xmm6
mov byte [rbp - 0x10], 0
mov rdx, qword [rbp + 0x148]
cmp rdx, 0xf
jbe 0x140061c57
inc rdx
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061c51
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062601
call fcn.140214300
nop
mov rdx, qword [rbp + 0x68]
cmp rdx, 0xf
jbe 0x140061c92
inc rdx
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061c8d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062607
call fcn.140214300
movdqu xmmword [rbp + 0x60], xmm6
mov byte [rbp + 0x50], 0
mov rdx, qword [rbp + 0x168]
cmp rdx, 0xf
jbe 0x140061cdc
inc rdx
mov rcx, qword [rbp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061cd7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006260d
call fcn.140214300
movdqu xmmword [rbp + 0x160], xmm6
mov byte [rbp + 0x150], 0
mov rdx, qword [rbp + 0x88]
cmp rdx, 0xf
jbe 0x140061d29
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061d24
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062613
call fcn.140214300
movdqu xmmword [rbp + 0x80], xmm6
mov byte [rbp + 0x70], 0
mov rdx, qword [rbp + 0x188]
cmp rdx, 0xf
jbe 0x140061d76
inc rdx
mov rcx, qword [rbp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061d71
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062619
call fcn.140214300
movdqu xmmword [rbp + 0x180], xmm6
mov byte [rbp + 0x170], 0
mov rdx, qword [rbp + 0x1a8]
cmp rdx, 0xf
jbe 0x140061dc6
inc rdx
mov rcx, qword [rbp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061dc1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006261f
call fcn.140214300
movdqu xmmword [rbp + 0x1a0], xmm6
mov byte [rbp + 0x190], 0
mov rdx, qword [rbp + 0x1c8]
cmp rdx, 0xf
jbe 0x140061e16
inc rdx
mov rcx, qword [rbp + 0x1b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061e11
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062625
call fcn.140214300
movdqu xmmword [rbp + 0x1c0], xmm6
mov byte [rbp + 0x1b0], 0
mov rdx, qword [rbp + 0x28]
cmp rdx, 0xf
jbe 0x140061e60
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061e5b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006262b
call fcn.140214300
movdqu xmmword [rbp + 0x20], xmm6
mov byte [rbp + 0x10], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r12
lea r14, [rbp + 0x2c0]
movq rsi, xmm8
movdqa xmm0, xmm7
psrldq xmm0, 8
movq r15, xmm0
cmp r15, 0xf
cmova r14, rsi
movabs rbx, 0x7fffffffffffffff
movq rdi, xmm7
cmp rdi, rbx
ja 0x140062631
cmp rdi, 0xf
ja 0x140061ed7
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
movups xmm0, xmmword [r14]
movups xmmword [rsp + 0x50], xmm0
jmp 0x140061f6b
mov rax, rdi
or rax, 0xf
cmp rax, rbx
jbe 0x140061f13
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1402143fc
mov rcx, rax
test rax, rax
je 0x140062637
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140061f4d
mov rbx, rax
mov ecx, reloc.WS2_32.dll_shutdown
cmp rax, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x140061f30
mov rax, r12
jmp 0x140061f4d
cmp rcx, 0x1000
jb 0x140061f48
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400624ff
jmp 0x140061ef1
call fcn.1402143fc
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rbx
lea r8, [rdi + 1]
mov rdx, r14
mov rcx, rax
call fcn.1402526d0
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x280]
call fcn.140064fa0
nop
lea rax, [rbp + 0x2a0]
mov qword [rsp + 0x78], rax
lea rdx, [0x14032a810]
lea rcx, [rbp + 0x2a0]
call fcn.140068890
mov rdi, rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x30], rax
lea rdx, [0x14032a8a0]
lea rcx, [rbp - 0x60]
call fcn.140068890
mov rbx, rax
lea rdx, [rbp + 0x280]
lea rcx, [rbp + 0x1d0]
call fcn.140068890
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.140060940
mov rbx, rax
lea rax, [rbp + 0x280]
cmp rax, rbx
je 0x140062064
mov rdx, qword [rbp + 0x298]
cmp rdx, 0xf
jbe 0x140062031
inc rdx
mov rcx, qword [rbp + 0x280]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006202c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006263d
call fcn.140214300
movdqu xmmword [rbp + 0x290], xmm6
mov byte [rbp + 0x280], 0
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x280], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x290], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rbp + 0x28]
cmp rdx, 0xf
jbe 0x14006209f
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006209a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006263d
call fcn.140214300
mov qword [rbp + 0x208], r12
lea r8, [rbp + 0x1d0]
lea rdx, [rbp + 0x280]
lea rcx, [rbp + 0x270]
call fcn.14006adc0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r12
mov r8d, 7
lea rdx, str.success
lea rcx, [rsp + 0x50]
call fcn.14006b9e0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x78], rax
movzx ecx, byte [rbp + 0x270]
test cl, cl
jne 0x14006211b
mov byte [rbp + 0x270], 1
call fcn.14006bdd0
mov qword [rbp + 0x278], rax
movzx ecx, byte [rbp + 0x270]
jmp 0x140062122
mov rax, qword [rbp + 0x278]
cmp cl, 1
jne 0x1400624ba
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.140074890
mov rbx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14006217f
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006217a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062643
call fcn.140214300
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x50], 0
cmp byte [rbx + 0x40], 4
jne 0x140062649
xorps xmm0, xmm0
lea rcx, [rsp + 0x50]
cmp byte [rbx + 0x48], 0
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r12
movups xmmword [rsp + 0x50], xmm0
je 0x14006237d
mov r8d, 9
lea rdx, str.sessionid
call fcn.14006b9e0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x78], rax
movzx ecx, byte [rbp + 0x270]
test cl, cl
jne 0x140062200
mov byte [rbp + 0x270], 1
call fcn.14006bdd0
mov qword [rbp + 0x278], rax
movzx ecx, byte [rbp + 0x270]
jmp 0x140062207
mov rax, qword [rbp + 0x278]
cmp cl, 1
jne 0x1400626d5
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.140074890
mov rbx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140062264
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006225f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062686
call fcn.140214300
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x50], 0
cmp byte [rbx + 0x40], 3
jne 0x14006268c
mov r8, qword [rbx + 0x48]
mov rdx, r8
cmp qword [r8 + 0x18], 0xf
jbe 0x140062292
mov rdx, qword [r8]
mov r8, qword [r8 + 0x10]
lea rcx, [0x14032a948]
call fcn.1400699c0
nop
movzx edx, byte [rbp + 0x270]
lea rcx, [rbp + 0x278]
call fcn.140069b60
nop
mov rdx, qword [rbp + 0x298]
cmp rdx, 0xf
jbe 0x1400622f8
inc rdx
mov rcx, qword [rbp + 0x280]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400622f3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400626c9
call fcn.140214300
movdqu xmmword [rbp + 0x290], xmm6
mov byte [rbp + 0x280], 0
cmp r15, 0xf
jbe 0x14006233e
lea rdx, [r15 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140062336
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400626cf
mov rcx, rsi
call fcn.140214300
mov rcx, qword [rbp + 0x2e0]
xor rcx, rsp
call fcn.1402142e0
lea r11, [rsp + 0x420]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov r8d, 7
lea rdx, str.message
call fcn.14006b9e0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x78], rax
movzx ecx, byte [rbp + 0x270]
test cl, cl
jne 0x1400623c0
mov byte [rbp + 0x270], 1
call fcn.14006bdd0
mov qword [rbp + 0x278], rax
movzx ecx, byte [rbp + 0x270]
jmp 0x1400623c7
mov rax, qword [rbp + 0x278]
cmp cl, 1
jne 0x14006277e
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.140074890
mov rdi, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140062424
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006241f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006271a
call fcn.140214300
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x50], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xor eax, eax
mov qword [rsp + 0x48], rax
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.140069b60
mov byte [rsp + 0x40], 3
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1402143fc
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], r12
mov r8d, 0xa
lea rdx, str.invalidver
mov rcx, rax
call fcn.14006b9e0
mov qword [rsp + 0x48], rbx
lea rdx, [rsp + 0x40]
lea rcx, [rdi + 0x40]
call fcn.14006cc20
movzx ebx, al
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.140069b60
nop
test bl, bl
je 0x140062720
jmp 0x140062505
lea rcx, [rbp + 0x270]
call fcn.1400696b0
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x30]
lea rcx, [rbp + 0x2a0]
call fcn.140073490
nop
mov r8, rax
mov edx, 0x131
lea rcx, [rbp - 0x60]
call fcn.14006b4d0
lea rdx, [0x140318be0]
lea rcx, [rbp - 0x60]
call fcn.1402165f8
nop
call fcn.14005b940
nop
lea rdx, str.download
lea rcx, [rbp + 0x270]
call fcn.14006aee0
lea rdx, [rbp + 0x2a0]
mov rcx, rax
call fcn.14006b000
lea rcx, [rbp + 0x2a0]
call fcn.1400686c0
mov r8, rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor ecx, ecx
call fcn.14022301c
nop
movdqa xmm0, xmmword [0x1402f7270]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm1, xmmword [0x1402f72b0]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm0, xmmword [0x1402f72a0]
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [0x1402f7290]
movdqa xmmword [rbp - 0x30], xmm1
mov dword [rbp - 0x20], 0xd8d1e28e
mov dword [rbp - 0x1c], 0xc5d79ddc
mov word [rbp - 0x18], Ordinal_200
mov byte [rbp - 0x16], 1
lea rdx, [rbp - 0x60]
call fcn.1400627d0
mov ecx, 0x1194
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call fcn.14022301c
nop
call fcn.1402285c0
nop
call fcn.1402285c0
nop
call fcn.1402285c0
nop
call fcn.1402285c0
nop
call fcn.1402285c0
nop
call fcn.1402285c0
nop
call fcn.1402285c0
nop
call fcn.1402285c0
nop
call fcn.1402285c0
nop
call fcn.1402285c0
nop
call fcn.1402285c0
nop
call fcn.1402285c0
nop
call fcn.1402285c0
nop
call fcn.1402285c0
nop
call fcn.1402285c0
nop
call fcn.1402285c0
nop
call fcn.1402285c0
nop
call fcn.1402285c0
int3
call fcn.14005b9e0
int3
call fcn.1402285c0
nop
call fcn.1402285c0
nop
call fcn.1402285c0
int3
lea rcx, [rbx + 0x40]
call fcn.1400696b0
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x30]
lea rcx, [rbp + 0x2a0]
call fcn.140078ef0
nop
mov r8, rax
lea rcx, [rbp - 0x60]
call fcn.140078cb0
lea rdx, [0x140318be0]
lea rcx, [rbp - 0x60]
call fcn.1402165f8
nop
call fcn.1402285c0
int3
lea rcx, [rbx + 0x40]
call fcn.1400696b0
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x30]
lea rcx, [rbp + 0x2a0]
call fcn.140078c00
nop
mov r8, rax
lea rcx, [rbp - 0x60]
call fcn.140078cb0
lea rdx, [0x140318be0]
lea rcx, [rbp - 0x60]
call fcn.1402165f8
nop
call fcn.1402285c0
nop
call fcn.1402285c0
nop
lea rcx, [rbp + 0x270]
call fcn.1400696b0
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x30]
lea rcx, [rbp + 0x2a0]
call fcn.140073490
nop
mov r8, rax
mov edx, 0x131
lea rcx, [rbp - 0x60]
call fcn.14006b4d0
lea rdx, [0x140318be0]
lea rcx, [rbp - 0x60]
call fcn.1402165f8
nop
call fcn.1402285c0
int3
lea rdx, [0x1402f5084]
lea rcx, [0x140328b30]
call fcn.14006ab10
lea rdx, str.message
lea rcx, [rbp + 0x270]
call fcn.14006aee0
mov rdx, rax
lea rcx, [rbp + 0x2a0]
call fcn.14006b0a0
nop
mov rdx, rax
call fcn.14006b130
nop
lea rcx, [rbp + 0x2a0]
call fcn.140068760
mov ecx, 0x1194
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call fcn.14022301c
nop
lea rcx, [rbp + 0x270]
call fcn.1400696b0
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x30]
lea rcx, [rbp + 0x2a0]
call fcn.140073490
nop
mov r8, rax
mov edx, 0x131
lea rcx, [rbp - 0x60]
call fcn.14006b4d0
lea rdx, [0x140318be0]
lea rcx, [rbp - 0x60]
call fcn.1402165f8
int3