Function at 0x14007f250
Capabilities:
Check if file exists
Download url
Encode data using xor
Enumerate processes
Receive data
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x500]
sub rsp, 0x600
mov rax, qword [0x1403b75a0]
xor rax, rsp
mov qword [rbp + 0x4f0], rax
mov r13, rcx
mov qword [rbp + 0x20], rcx
xor edi, edi
mov dword [rsp + 0x30], edi
lea rcx, [rbp]
call fcn.14007e140
nop
mov rdx, rax
lea rcx, [rbp - 0x60]
call fcn.14007d8e0
mov rbx, rax
lea rsi, [r13 + 0x190]
cmp rsi, rax
je 0x14007f320
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x14007f2f4
mov rcx, qword [rsi]
inc rdx
cmp rdx, 0x1000
jb 0x14007f2ef
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400804d9
mov rcx, r8
call fcn.14027f220
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], 0
movups xmm0, xmmword [rbx]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsi + 0x10], xmm1
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x14007f35b
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007f356
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400804d9
call fcn.14027f220
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x48], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x60], 0
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x10
jb 0x14007f3a6
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007f3a1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400804df
call fcn.14027f220
cmp qword [r13 + 0x30], 0xa
jne 0x1400804d1
cmp qword [r13 + 0x50], 0x40
jne 0x1400804d1
mov dword [rbp + 0x240], 0xc2c4c08e
mov dword [rbp + 0x244], 0xd9c7f2d8
mov word [rbp + 0x248], Ordinal_143
mov byte [rbp + 0x24a], 1
mov rcx, rdi
lea eax, [rcx - 0x58]
xor byte [rbp + rcx + 0x240], al
inc rcx
cmp rcx, 9
jb 0x14007f3e3
mov byte [rbp + 0x24a], 0
lea rdx, [r13 + 0x20]
lea rcx, [rbp + 0x270]
call fcn.14007dd10
mov r15, rax
mov dword [rsp + 0x58], 0xc5ddc68e
mov dword [rsp + 0x5c], 0xcbc7dfc9
mov word [rsp + 0x60], Ordinal_143
mov byte [rsp + 0x62], 1
mov rcx, rdi
nop
lea eax, [rcx - 0x58]
xor byte [rsp + rcx + 0x58], al
inc rcx
cmp rcx, 9
jb 0x14007f430
mov byte [rsp + 0x62], 0
mov rdx, r13
lea rcx, [rbp + 0xe8]
call fcn.14007dd10
mov r14, rax
mov dword [rsp + 0x40], 0xc6cbc78e
mov dword [rsp + 0x44], 0x10090c9
mov rcx, rdi
nop word [rax + rax]
lea eax, [rcx - 0x58]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 6
jb 0x14007f470
mov byte [rsp + 0x47], 0
lea rax, [rbp + 0x200]
mov qword [rsp + 0x38], rax
lea rdx, [0x1403ece48]
lea rcx, [rbp + 0x200]
call fcn.1400778d0
mov rdi, rax
lea rax, [rbp + 0x220]
mov qword [rsp + 0x30], rax
lea r12, [r13 + 0x40]
mov rdx, r12
lea rcx, [rbp + 0x220]
call fcn.1400778d0
mov rbx, rax
mov rdx, rsi
lea rcx, [rbp + 0x1c0]
call fcn.1400778d0
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0xc8]
call fcn.14007e290
mov rsi, rax
mov dword [rsp + 0x48], 0xcec2ce8c
mov dword [rsp + 0x4c], 0x8cc9cac5
mov word [rsp + 0x50], 0x100
xor eax, eax
mov ecx, eax
nop dword [rax]
lea eax, [rcx - 0x56]
xor byte [rsp + rcx + 0x48], al
inc rcx
cmp rcx, 8
jb 0x14007f510
mov byte [rsp + 0x51], 0
lea rax, [rbp + 0x188]
mov qword [rbp - 0x68], rax
lea rdx, [0x1403ece48]
lea rcx, [rbp + 0x188]
call fcn.1400778d0
mov rdi, rax
lea rax, [rbp + 0x108]
mov qword [rsp + 0x38], rax
mov rdx, r12
lea rcx, [rbp + 0x108]
call fcn.1400778d0
mov rbx, rax
lea rdx, [r13 + 0x60]
lea rcx, [rbp + 0x128]
call fcn.1400778d0
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0xa8]
call fcn.14007e290
mov rdi, rax
mov dword [rsp + 0x38], 0xdfc9dd8c
mov word [rsp + 0x3c], __WSAFDIsSet
mov byte [rsp + 0x3e], 1
xor r13d, r13d
mov ecx, r13d
nop word [rax + rax]
lea eax, [rcx - 0x56]
xor byte [rsp + rcx + 0x38], al
inc rcx
cmp rcx, 5
jb 0x14007f5b0
mov byte [rsp + 0x3e], r13b
mov dword [rsp + 0x30], 0xd9c5c5c3
mov word [rsp + 0x34], 0x100
mov rcx, r13
nop word [rax + rax]
lea eax, [rcx - 0x56]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 4
jb 0x14007f5e0
mov byte [rsp + 0x35], r13b
mov qword [rsp + 0x78], r13
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x70], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x78], r13b
lea rax, [rsp + 0x30]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop word [rax + rax]
inc r8
cmp byte [rax + r8], r13b
jne 0x14007f620
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x78]
call fcn.140077c30
nop
lea rdx, [rsp + 0x78]
lea rcx, [rbp + 0x88]
call fcn.14007dd10
mov r10, rax
mov dword [rsp + 0x30], 0xc8dcd2de
mov word [rsp + 0x34], __WSAFDIsSet
mov byte [rsp + 0x36], 1
mov rcx, r13
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx - 0x56]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 5
jb 0x14007f670
mov byte [rsp + 0x36], 0
lea rax, [rsp + 0x30]
mov r9, rbx
nop dword [rax]
inc r9
cmp byte [rax + r9], 0
jne 0x14007f690
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, r10
call fcn.140095ee0
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x10], r13
mov qword [rbp - 8], r13
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x10], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rax, [rsp + 0x38]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14007f6e0
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x20]
call fcn.140077d90
movups xmm0, xmmword [rax]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x10], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, rdi
lea r8, [rbp]
lea rcx, [rbp - 0x60]
call fcn.140095ff0
nop
lea rax, [rsp + 0x48]
mov r8, rbx
nop
inc r8
cmp byte [rax + r8], 0
jne 0x14007f730
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x60]
call fcn.140077d90
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x168], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x178], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, rsi
lea r8, [rbp + 0x168]
lea rcx, [rbp + 0x68]
call fcn.140095ff0
nop
lea rax, [rsp + 0x40]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14007f790
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x68]
call fcn.140077d90
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x148], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x158], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, r14
lea r8, [rbp + 0x148]
lea rcx, [rbp + 0x48]
call fcn.140095ff0
nop
lea rax, [rsp + 0x58]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14007f7f0
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x48]
call fcn.140077d90
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x68], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, r15
lea r8, [rsp + 0x58]
lea rcx, [rbp + 0x28]
call fcn.140095ff0
nop
lea rax, [rbp + 0x240]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14007f841
mov r8, rbx
lea rdx, [rbp + 0x240]
lea rcx, [rbp + 0x28]
call fcn.140077d90
xor r15d, r15d
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x28], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x30], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], r15b
lea rdx, [0x1403ece48]
cmp qword [0x1403ece60], 0x10
cmovae rdx, qword [0x1403ece48]
mov r8, qword [0x1403ece58]
lea rcx, [rbp - 0x40]
call fcn.140077d90
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x290], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x2a0], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], r15b
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x14007f910
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007f90b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400804e5
call fcn.14027f220
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x28], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x40], 0
mov rdx, qword [rbp + 0x40]
cmp rdx, 0x10
jb 0x14007f95b
inc rdx
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007f956
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400804eb
call fcn.14027f220
mov qword [rbp + 0x38], r15
mov qword [rbp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x28], 0
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x14007f9a9
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007f9a3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400804f1
call fcn.14027f220
nop
mov rdx, qword [rbp + 0x60]
cmp rdx, 0x10
jb 0x14007f9e4
inc rdx
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007f9df
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400804f7
call fcn.14027f220
mov qword [rbp + 0x58], r15
mov qword [rbp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x48], 0
mov rdx, qword [rbp + 0x160]
cmp rdx, 0x10
jb 0x14007fa36
inc rdx
mov rcx, qword [rbp + 0x148]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007fa30
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400804fd
call fcn.14027f220
nop
mov rdx, qword [rbp + 0x80]
cmp rdx, 0x10
jb 0x14007fa74
inc rdx
mov rcx, qword [rbp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007fa6f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140080503
call fcn.14027f220
mov qword [rbp + 0x78], r15
mov qword [rbp + 0x80], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x68], 0
mov rdx, qword [rbp + 0x180]
cmp rdx, 0x10
jb 0x14007fac9
inc rdx
mov rcx, qword [rbp + 0x168]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007fac3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140080509
call fcn.14027f220
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x14007fb04
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007faff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008050f
call fcn.14027f220
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x60], 0
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x10
jb 0x14007fb50
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007fb4a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140080515
call fcn.14027f220
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x14007fb8b
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007fb86
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008051b
call fcn.14027f220
mov qword [rbp - 0x10], r15
mov qword [rbp - 8], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x20], 0
mov rdx, qword [rbp + 0xa0]
cmp rdx, 0x10
jb 0x14007fbdc
inc rdx
mov rcx, qword [rbp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007fbd7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140080521
call fcn.14027f220
mov qword [rbp + 0x98], r15
mov qword [rbp + 0xa0], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x88], 0
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
jb 0x14007fc31
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007fc2c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140080527
call fcn.14027f220
mov qword [rbp - 0x78], r15
mov qword [rbp - 0x70], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x78], 0
mov rdx, qword [rbp + 0xc0]
cmp rdx, 0x10
jb 0x14007fc83
inc rdx
mov rcx, qword [rbp + 0xa8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007fc7e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008052d
call fcn.14027f220
mov qword [rbp + 0xb8], r15
mov qword [rbp + 0xc0], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xa8], 0
mov rdx, qword [rbp + 0xe0]
cmp rdx, 0x10
jb 0x14007fcdd
inc rdx
mov rcx, qword [rbp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007fcd8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140080533
call fcn.14027f220
mov qword [rbp + 0xd8], r15
mov qword [rbp + 0xe0], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xc8], 0
mov rdx, qword [rbp + 0x100]
cmp rdx, 0x10
jb 0x14007fd37
inc rdx
mov rcx, qword [rbp + 0xe8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007fd32
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140080539
call fcn.14027f220
mov qword [rbp + 0xf8], r15
mov qword [rbp + 0x100], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xe8], 0
mov rdx, qword [rbp + 0x288]
cmp rdx, 0x10
jb 0x14007fd91
inc rdx
mov rcx, qword [rbp + 0x270]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007fd8c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008053f
call fcn.14027f220
mov qword [rbp + 0x280], r15
mov qword [rbp + 0x288], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x270], 0
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], r15
lea rdi, [rbp + 0x290]
mov r14, qword [rbp + 0x290]
mov r13, qword [rbp + 0x2a8]
cmp r13, 0x10
cmovae rdi, r14
movabs rax, 0x7fffffffffffffff
mov rsi, qword [rbp + 0x2a0]
cmp rsi, 0x10
jae 0x14007fdfc
movups xmm0, xmmword [rdi]
movups xmmword [rsp + 0x58], xmm0
mov ebx, reloc.WS2_32.dll_ntohs
jmp 0x14007fe69
mov rbx, rsi
or rbx, 0xf
cmp rbx, rax
cmova rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14007fe46
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140080545
mov rcx, rax
call fcn.14027f228
mov rcx, rax
test rax, rax
je 0x14008054b
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14007fe55
test rcx, rcx
je 0x14007fe52
call fcn.14027f228
jmp 0x14007fe55
mov rax, r15
mov qword [rsp + 0x58], rax
lea r8, [rsi + 1]
mov rdx, rdi
mov rcx, rax
call fcn.140285c90
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x250]
call fcn.1400848c0
nop
cmp byte [0x1403ecbb8], 0
jne 0x1400803f1
lea rax, [rbp + 0x128]
mov qword [rbp - 0x68], rax
lea rdx, [0x1403ece48]
lea rcx, [rbp + 0x128]
call fcn.1400778d0
mov r15, rax
lea rax, [rbp + 0x108]
mov qword [rsp + 0x40], rax
mov rdx, r12
lea rcx, [rbp + 0x108]
call fcn.1400778d0
mov r12, rax
xor eax, eax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov rdi, qword [rbp + 0x260]
lea rsi, [rbp + 0x250]
cmp qword [rbp + 0x268], 0x10
cmovae rsi, qword [rbp + 0x250]
cmp rdi, 0x10
jae 0x14007ff11
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x78], xmm0
lea ebx, [rax + 0xf]
jmp 0x14007ff83
mov rbx, rdi
or rbx, 0xf
movabs rcx, 0x7fffffffffffffff
cmp rbx, rcx
cmova rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14007ff65
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140080551
mov rcx, rax
call fcn.14027f228
mov rcx, rax
test rax, rax
je 0x140080557
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14007ff6f
test rcx, rcx
je 0x14007ff6f
call fcn.14027f228
mov qword [rsp + 0x78], rax
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call fcn.140285c90
mov qword [rbp - 0x78], rdi
mov qword [rbp - 0x70], rbx
mov r9, r15
mov r8, r12
lea rdx, [rsp + 0x78]
lea rcx, [rbp]
call fcn.14007e630
mov rbx, rax
lea rax, [rbp + 0x250]
cmp rax, rbx
je 0x140080035
mov rdx, qword [rbp + 0x268]
cmp rdx, 0x10
jb 0x14007fff3
inc rdx
mov rcx, qword [rbp + 0x250]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007ffee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140080557
call fcn.14027f220
xor r15d, r15d
mov qword [rbp + 0x260], r15
mov qword [rbp + 0x268], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x250], r15b
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x250], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x260], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r15b
jmp 0x140080038
xor r15d, r15d
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x10
jb 0x140080073
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008006e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140080557
call fcn.14027f220
mov qword [rbp + 0x1f8], r15
lea r8, [rbp + 0x1c0]
lea rdx, [rbp + 0x250]
lea rcx, [rbp + 0x240]
call fcn.140092b00
nop
lea rdx, [0x14036d210]
lea rcx, [rbp + 0x240]
call fcn.140092c30
cmp byte [rax], 4
jne 0x14008055d
lea rcx, [rbp + 0x240]
cmp byte [rax + 8], 0
je 0x140080232
lea rdx, str.sessionid
call fcn.140092c30
mov rcx, qword [rbp + 0x20]
add rcx, 0x170
mov rdx, rax
call fcn.140098ff0
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x78], r15
mov qword [rbp - 0x70], 7
mov r8d, reloc.WS2_32.dll_listen
lea rdx, [0x14036d228]
lea rcx, [rsp + 0x78]
call fcn.140091980
mov edi, r15d
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140080182
mov dword [rbp + 0x2b0], 0x238
lea rdx, [rbp + 0x2b0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140080182
lea rcx, [rsp + 0x78]
call fcn.140077700
lea r8, [rbp + 0x2dc]
sub r8, rax
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140080166
add rax, 2
test ecx, ecx
jne 0x140080152
test edx, edx
je 0x14008017c
lea rdx, [rbp + 0x2b0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
jmp 0x14008013a
mov edi, dword [rbp + 0x2b8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbp - 0x70]
cmp rdx, 8
jb 0x1400801cc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400801c7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400805b4
call fcn.14027f220
mov r8d, edi
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1400801f6
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.OldLoader.exe
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x1400803dd
nop dword [rax + rax]
lea rcx, str.OldLoader.exe
call fcn.14029da10
lea rcx, str.OldLoader.exe
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x140080210
jmp 0x1400803dd
lea rdx, str.message
call fcn.140092c30
mov rdi, rax
mov byte [rsp + 0x58], 3
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.14027f228
mov rbx, rax
mov qword [rax], r15
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov r8d, 0xa
lea rdx, str.invalidver
mov rcx, rax
call fcn.140077c30
mov qword [rsp + 0x60], rbx
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.140095af0
movzx ebx, al
movzx edx, byte [rsp + 0x58]
lea rcx, [rsp + 0x60]
call fcn.140091360
nop
lea rcx, [rbp + 0x240]
test bl, bl
je 0x140080345
lea rdx, str.download
call fcn.140092c30
nop
mov qword [rbp + 0x270], r15
movdqa xmm0, xmmword [0x140384af0]
movdqu xmmword [rbp + 0x280], xmm0
mov byte [rbp + 0x270], 0
mov dword [rsp + 0x30], 0x17ff
cmp byte [rax], 3
jne 0x1400805ba
mov rdx, qword [rax + 8]
lea rax, [rbp + 0x270]
cmp rax, rdx
je 0x140080312
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x140080305
mov rdx, qword [rdx]
lea rcx, [rbp + 0x270]
call fcn.140077c30
nop
mov r9d, 0x41
lea r8, str.Update
lea rdx, str.New_Update_Available_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
sub eax, 1
je 0x140080619
cmp eax, 1
jne 0x1400804b4
jmp 0x140080611
mov byte [0x1403ecbb8], 1
lea rdx, str.message
call fcn.140092c30
mov qword [rbp + 0x270], r15
mov qword [rbp + 0x280], r15
mov qword [rbp + 0x288], reloc.WS2_32.dll_ntohs
mov rdx, rax
lea rcx, [rbp + 0x270]
call fcn.140098ff0
mov rdx, qword [reloc.WS2_32.dll_ntohs]
cmp rdx, 0x10
jb 0x1400803c1
mov rcx, qword [0x1403e3418]
inc rdx
cmp rdx, 0x1000
jb 0x1400803bc
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140080681
mov rcx, r8
call fcn.14027f220
movups xmm0, xmmword [rbp + 0x270]
movups xmmword [0x1403e3418], xmm0
movups xmm1, xmmword [rbp + 0x280]
movups xmmword [0x1403e3428], xmm1
movzx edx, byte [rbp + 0x240]
lea rcx, [rbp + 0x248]
call fcn.140091360
nop
mov rdx, qword [rbp + 0x268]
cmp rdx, 0x10
jb 0x140080432
inc rdx
mov rcx, qword [rbp + 0x250]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008042d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008067b
call fcn.14027f220
mov qword [rbp + 0x260], r15
mov qword [rbp + 0x268], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x250], 0
cmp r13, 0x10
jb 0x14008047e
lea rdx, [r13 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x140080476
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400804ae
mov rcx, r14
call fcn.14027f220
mov rcx, qword [rbp + 0x4f0]
xor rcx, rsp
call fcn.14027f200
lea r11, [rsp + 0x600]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140299858
nop
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Failed_to_Update_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call fcn.1402927d0
nop
xor ecx, ecx
call fcn.1402927d0
nop
call fcn.140299858
nop
call fcn.140299858
nop
call fcn.140299858
nop
call fcn.140299858
nop
call fcn.140299858
nop
call fcn.140299858
nop
call fcn.140299858
nop
call fcn.140299858
nop
call fcn.140299858
nop
call fcn.140299858
nop
call fcn.140299858
nop
call fcn.140299858
nop
call fcn.140299858
nop
call fcn.140299858
nop
call fcn.140299858
nop
call fcn.140299858
nop
call fcn.140299858
nop
call fcn.140299858
int3
call fcn.140076860
int3
call fcn.140299858
nop
call fcn.140076860
int3
call fcn.140299858
nop
mov rcx, rax
call fcn.140091860
mov rdx, rax
lea rcx, [rbp + 0x128]
call fcn.140077890
nop
mov r8, rax
lea rdx, str.type_must_be_boolean__but_is
lea rcx, [rbp + 0x108]
call fcn.140092480
nop
mov r8, rax
mov edx, 0x12e
lea rcx, [rbp + 0x188]
call fcn.14007c280
lea rdx, [0x1403af270]
lea rcx, [rbp + 0x188]
call fcn.140285bb4
nop
call fcn.140299858
nop
mov rcx, rax
call fcn.140091860
mov rdx, rax
lea rcx, [rbp + 0x128]
call fcn.140077890
nop
mov r8, rax
lea rdx, str.type_must_be_string__but_is
lea rcx, [rbp + 0x108]
call fcn.140092480
nop
mov r8, rax
mov edx, 0x12e
lea rcx, [rbp + 0x188]
call fcn.14007c280
lea rdx, [0x1403af270]
lea rcx, [rbp + 0x188]
call fcn.140285bb4
nop
xor ecx, ecx
call fcn.1402927d0
int3
lea rcx, [rbp + 0x270]
call fcn.140077790
mov rdx, rax
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea r8, str.Updated_Loader.exe
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov r8d, 0x104
lea rdx, [rbp + 0x2b0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, str.OldLoader.exe
lea rcx, [rbp + 0x2b0]
call fcn.14029e6ac
lea rcx, str.start_Updated_Loader.exe
call fcn.14029e458
xor ecx, ecx
call fcn.1402927d0
nop
call fcn.140299858
nop
call fcn.140299858
int3