Function at 0x14012ab10
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Create process on windows
Create thread
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xab8]
sub rsp, 0xb90
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x140714d80]
xor rax, rsp
mov qword [rbp + 0xa70], rax
mov r15, rcx
mov qword [rbp + 0xd0], rcx
xor r12d, r12d
mov dword [rsp + 0x40], r12d
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
xor r9d, r9d
lea r8, [0x1401334e0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [rbp + 0x880]
call fcn.1401298d0
nop
lea rdx, [rbp + 0x880]
cmp qword [rbp + 0x898], 0xf
cmova rdx, qword [rbp + 0x880]
mov r8, qword [rbp + 0x890]
lea rcx, [0x140713e68]
call fcn.14006ece0
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
xor r9d, r9d
lea r8, [0x140131a80]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp qword [r15 + 0x30], 0xa
je 0x14012ad96
movdqa xmm0, xmmword [str.Pbcxuvlpuu_Sqk]
movdqa xmmword [rbp + 0x80], xmm0
movdqa xmm1, xmmword [str.rGWQU]
movdqa xmmword [rbp + 0x90], xmm1
movdqa xmm0, xmmword [0x1403814b0]
movdqa xmmword [rbp + 0xa0], xmm0
movdqa xmm1, xmmword [0x1403814f0]
movdqa xmmword [rbp + 0xb0], xmm1
mov dword [rbp + 0xc0], 0x377d3c38
mov dword [rbp + 0xc4], 0x1002625
mov ecx, r12d
lea eax, [rcx + 0x11]
xor byte [rbp + rcx + 0x80], al
lea eax, [rcx + 0x12]
xor byte [rbp + rcx + 0x81], al
lea eax, [rcx + 0x13]
xor byte [rbp + rcx + 0x82], al
lea eax, [rcx + 0x14]
xor byte [rbp + rcx + 0x83], al
lea eax, [rcx + 0x15]
xor byte [rbp + rcx + 0x84], al
lea eax, [rcx + 0x16]
xor byte [rbp + rcx + 0x85], al
lea eax, [rcx + 0x17]
xor byte [rbp + rcx + 0x86], al
lea eax, [rcx + 0x18]
xor byte [rbp + rcx + 0x87], al
lea eax, [rcx + 0x19]
xor byte [rbp + rcx + 0x88], al
lea eax, [rcx + 0x1a]
xor byte [rbp + rcx + 0x89], al
lea eax, [rcx + 0x1b]
xor byte [rbp + rcx + 0x8a], al
lea eax, [rcx + 0x1c]
xor byte [rbp + rcx + 0x8b], al
lea eax, [rcx + 0x1d]
xor byte [rbp + rcx + 0x8c], al
lea eax, [rcx + 0x1e]
xor byte [rbp + rcx + 0x8d], al
add rcx, 0xe
cmp rcx, 0x46
jb 0x14012ac32
mov byte [rbp + 0xc7], 0
mov r9d, reloc.WS2_32.dll_recv
xor r8d, r8d
lea rdx, [rbp + 0x80]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14012ad76
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14012ad76
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0xaa9d0495
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14012ad71
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14012ad50
cmp r8d, 0xa6d90d15
je 0x14012ad7b
test r9d, r9d
jne 0x14012ad30
mov rax, qword [rax]
jmp 0x14012ad00
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
xor ecx, ecx
call rdx
lea rcx, [rbp + 0x830]
call fcn.140122ed0
nop
call fcn.140136f20
mov qword [rbp + 0xd8], rax
mov dword [rbp + 0x40], 0x7a647d37
mov dword [rbp + 0x44], 0x7c7e6470
mov word [rbp + 0x48], 0x24
mov byte [rbp + 0x4a], 1
mov rdx, r15
cmp qword [r15 + 0x18], 0xf
jbe 0x14012add4
mov rdx, qword [r15]
xor r8d, r8d
mov rcx, rax
call fcn.140135920
mov rbx, rax
mov dword [rbp - 0x60], 0x79727c37
mov dword [rbp - 0x5c], 0x1002b70
mov dword [rbp - 0x68], 0x67727a37
mov dword [rbp - 0x64], 0x1002b7d
mov dword [rbp - 0x70], 0x66766437
mov word [rbp - 0x6c], 0x28
mov byte [rbp - 0x6a], 1
mov dword [rbp + 0x30], 0x71636b65
mov dword [rbp + 0x34], 0x71797f28
mov word [rbp + 0x38], WSAGetLastError
mov byte [rbp + 0x3a], 1
lea r8, [rbp - 0x70]
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x268]
call fcn.140117510
nop
lea rdx, [r15 + 0x40]
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x14012ae4e
mov rdx, qword [rdx]
mov rcx, rax
call fcn.14006ec50
xorps xmm0, xmm0
movups xmmword [rbp + 0x110], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x120], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x110], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x120], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rbp - 0x68]
lea rdx, [rbp + 0x110]
lea rcx, [rbp + 0x248]
call fcn.1401172d0
nop
lea rdx, [rbp + 0x830]
cmp qword [rbp + 0x848], 0xf
cmova rdx, qword [rbp + 0x830]
mov r8, qword [rbp + 0x840]
mov rcx, rax
call fcn.14006ec50
xorps xmm0, xmm0
movups xmmword [rbp + 0x130], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x140], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x130], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x140], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rbp - 0x60]
lea rdx, [rbp + 0x130]
lea rcx, [rbp + 0x2c0]
call fcn.1401172d0
nop
mov r14, 0xffffffffffffffff
mov r8, r14
nop dword [rax + rax]
inc r8
cmp byte [rbx + r8], 0
jne 0x14012af30
mov rdx, rbx
mov rcx, rax
call fcn.14006ec50
xorps xmm0, xmm0
movups xmmword [rbp + 0x150], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x160], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x150], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x160], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rbp + 0x40]
lea rdx, [rbp + 0x150]
lea rcx, [rbp + 0x2e0]
call fcn.1401177b0
nop
lea rdx, [r15 + 0x20]
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x14012afa8
mov rdx, qword [rdx]
mov rcx, rax
call fcn.14006ec50
xorps xmm0, xmm0
movups xmmword [rbp + 0x7c0], xmm0
mov qword [rbp + 0x7d0], r12
mov qword [rbp + 0x7d8], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x7c0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x7d0], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov edi, 0x3c
mov dword [rsp + 0x40], edi
mov rdx, qword [rbp + 0x2f8]
cmp rdx, 0xf
jbe 0x14012b039
inc rdx
mov rcx, qword [rbp + 0x2e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14012b034
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14012b034
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140224898
movdqa xmm6, xmmword [0x14037a260]
movdqu xmmword [rbp + 0x2f0], xmm6
mov byte [rbp + 0x2e0], 0
mov rdx, qword [rbp + 0x168]
cmp rdx, 0xf
jbe 0x14012b094
inc rdx
mov rcx, qword [rbp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14012b08f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14012b08f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140224898
movdqu xmmword [rbp + 0x160], xmm6
mov byte [rbp + 0x150], 0
mov rdx, qword [rbp + 0x2d8]
cmp rdx, 0xf
jbe 0x14012b0e7
inc rdx
mov rcx, qword [rbp + 0x2c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14012b0e2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14012b0e2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140224898
movdqu xmmword [rbp + 0x2d0], xmm6
mov byte [rbp + 0x2c0], 0
mov rdx, qword [rbp + 0x148]
cmp rdx, 0xf
jbe 0x14012b13a
inc rdx
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14012b135
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14012b135
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140224898
movdqu xmmword [rbp + 0x140], xmm6
mov byte [rbp + 0x130], 0
mov rdx, qword [rbp + 0x260]
cmp rdx, 0xf
jbe 0x14012b18d
inc rdx
mov rcx, qword [rbp + 0x248]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14012b188
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14012b188
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140224898
movdqu xmmword [rbp + 0x258], xmm6
mov byte [rbp + 0x248], 0
mov rdx, qword [rbp + 0x128]
cmp rdx, 0xf
jbe 0x14012b1e0
inc rdx
mov rcx, qword [rbp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14012b1db
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14012b1db
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140224898
movdqu xmmword [rbp + 0x120], xmm6
mov byte [rbp + 0x110], 0
mov rdx, qword [rbp + 0x280]
cmp rdx, 0xf
jbe 0x14012b230
inc rdx
mov rcx, qword [rbp + 0x268]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14012b22b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14012cc62
call fcn.140224898
movdqu xmmword [rbp + 0x278], xmm6
mov byte [rbp + 0x268], 0
lea rbx, [r15 + 0x80]
mov rax, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x14012b254
mov rbx, qword [rbx]
cmp rax, 5
jb 0x14012b3da
lea rsi, [rbx + rax]
lea r8, [rsi - 4]
sub r8, rbx
mov edx, 0x68
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x14012b3da
nop
cmp dword [rax], 0x70747468
jne 0x14012b28e
cmp byte [rax + 4], 0x73
je 0x14012b2af
inc rax
lea r8, [rsi - 4]
sub r8, rax
mov edx, 0x68
mov rcx, rax
call sub.VCRUNTIME140.dll_memchr
test rax, rax
jne 0x14012b280
jmp 0x14012b3da
sub rax, rbx
cmp rax, 0xffffffffffffffff
je 0x14012b3da
movdqa xmm0, xmmword [0x140381560]
movdqa xmmword [rbp + 0x360], xmm0
movdqa xmm1, xmmword [0x140381530]
movdqa xmmword [rbp + 0x370], xmm1
movdqa xmm0, xmmword [0x1403814d0]
movdqa xmmword [rbp + 0x380], xmm0
movdqa xmm1, xmmword [str.8b_1._:j___o]
movdqa xmmword [rbp + 0x390], xmm1
mov byte [rbp + 0x3a0], 1
lea rcx, [rbp + 0x360]
call fcn.140126160
mov r9d, reloc.WS2_32.dll_recv
xor r8d, r8d
lea rdx, [rbp + 0x360]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14012b3b6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14012b3b6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0xa4ed6b7d
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14012b3b1
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14012b390
cmp r8d, 0x8ea1c09d
je 0x14012b3bb
test r9d, r9d
jne 0x14012b370
mov rax, qword [rax]
jmp 0x14012b340
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
xor ecx, ecx
call rdx
mov edi, dword [rsp + 0x40]
lea rcx, [r15 + 0x80]
mov r8, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 0xf
jbe 0x14012b3ef
mov rcx, qword [rcx]
test r8, r8
jne 0x14012b412
lea rdx, [0x14036f3ac]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14012b412
cmp qword [r15 + 0x90], 0
je 0x14012bc77
lea rdx, [r15 + 0x80]
xor r8d, r8d
lea rcx, [rbp + 0x590]
call fcn.140116bf0
nop
lea rcx, [rbp + 0x590]
call fcn.1401008f0
movzx ebx, al
lea rcx, [rbp + 0x590]
call fcn.1400ebdc0
test bl, bl
jne 0x14012b564
movdqa xmm0, xmmword [0x140381380]
movdqu xmmword [rbp + 0x288], xmm0
movdqa xmm1, xmmword [0x1403815f0]
movdqu xmmword [rbp + 0x298], xmm1
movdqa xmm0, xmmword [0x140381510]
movdqu xmmword [rbp + 0x2a8], xmm0
mov word [rbp + 0x2b8], reloc.WS2_32.dll_WSAGetLastError
mov byte [rbp + 0x2ba], 1
lea rcx, [rbp + 0x288]
call fcn.140125ea0
mov r9d, reloc.WS2_32.dll_recv
xor r8d, r8d
lea rdx, [rbp + 0x288]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14012b544
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14012b544
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r11 + r9*4]
mov r8d, dword [rdx + r10]
add r8, r10
mov edx, 0x2d675978
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x14012b53f
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x14012b520
cmp edx, 0x2d155bc8
je 0x14012b549
test r9d, r9d
jne 0x14012b500
mov rax, qword [rax]
jmp 0x14012b4d0
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
xor ecx, ecx
call rax
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp + 0x8c0]
call sub.VCRUNTIME140.dll_memset
lea rbx, [r15 + 0x80]
cmp qword [rbx + 0x18], 0xf
jbe 0x14012b589
mov rbx, qword [rbx]
lea rax, [0x14037cab0]
mov qword [rbp + 0x8c0], rax
lea rcx, [rbp + 0x970]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rsp + 0x40], 0x13c
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x8d0]
lea rcx, [rbp + 0x8c0]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rbp + 0x8c0]
movsxd rcx, dword [rax + 4]
lea rdi, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x8c0], rdi
mov rax, qword [rbp + 0x8c0]
movsxd rcx, dword [rax + 4]
lea r8d, [rcx - 0xb0]
mov dword [rbp + rcx + 0x8bc], r8d
lea rcx, [rbp + 0x8d0]
call fcn.14011de00
nop
mov r9d, 0x40
mov r8d, 1
mov rdx, rbx
lea rcx, [rbp + 0x8d0]
call fcn.14010e9b0
test rax, rax
jne 0x14012b64d
mov rax, qword [rbp + 0x8c0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x8c0]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
mov rax, qword [rbp + 0x8c0]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x8c0], rdi
mov rax, qword [rbp + 0x8c0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x8bc], edx
xorps xmm0, xmm0
movups xmmword [rbp + 0x7e0], xmm0
mov qword [rbp + 0x7f0], r12
mov qword [rbp + 0x7f8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x7e0], 0
movups xmmword [rbp + 0x860], xmm0
movdqu xmmword [rbp + 0x870], xmm6
mov byte [rbp + 0x860], 0
mov rax, qword [rbp + 0x8c0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x8c0]
add rcx, rax
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
movzx r8d, al
lea rdx, [rbp + 0x7e0]
lea rcx, [rbp + 0x8c0]
call fcn.1400d9d60
movdqa xmm0, xmmword [str.32P_6k8]
movdqu xmmword [rbp + 0x320], xmm0
movdqa xmm1, xmmword [0x140381440]
movdqu xmmword [rbp + 0x330], xmm1
movdqa xmm0, xmmword [0x140381650]
movdqu xmmword [rbp + 0x340], xmm0
mov word [rbp + 0x350], 0x100
lea r8, [r15 + 0x80]
mov rcx, qword [r8 + 0x10]
movabs r13, 0x7fffffffffffffff
mov rax, r13
sub rax, rcx
cmp rax, 0x14
jb 0x14012ce12
mov rax, r8
cmp qword [r8 + 0x18], 0xf
jbe 0x14012b750
mov rax, qword [r8]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], reloc.WS2_32.dll_sendto
lea r9, str.certutil__hashfile__
movzx edx, byte [rbp + 0x7a8]
lea rcx, [rbp + 0x5b0]
call fcn.1400df560
nop
lea r8, [rbp + 0x320]
lea rdx, [rbp + 0x5b0]
lea rcx, [rbp + 0x708]
call fcn.140117a20
nop
cmp qword [rax + 0x18], 0xf
jbe 0x14012b7a3
mov rax, qword [rax]
xorps xmm0, xmm0
movups xmmword [rbp + 0x210], xmm0
movdqu xmmword [rbp + 0x220], xmm6
mov byte [rbp + 0x210], 0
mov dword [rsp + 0x40], 0x73c
movups xmmword [rbp + 0x820], xmm0
lea rdx, [0x14037bb3c]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__popen]
mov rcx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__pclose]
mov qword [rbp + 0x820], rcx
mov qword [rbp + 0x828], rax
test rax, rax
je 0x14012cdba
mov r8, rax
mov edx, 0x80
lea rcx, [rbp + 0x9f0]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgets]
test rax, rax
je 0x14012b85b
lea rax, [rbp + 0x9f0]
mov r8, r14
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14012b820
lea rdx, [rbp + 0x9f0]
lea rcx, [rbp + 0x210]
call fcn.14006ece0
mov r8, qword [rbp + 0x828]
mov edx, 0x80
lea rcx, [rbp + 0x9f0]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgets]
test rax, rax
jne 0x14012b813
mov rcx, qword [rbp + 0x828]
test rcx, rcx
je 0x14012b86e
call qword [rbp + 0x820]
nop
lea rdx, [rbp + 0x210]
lea rcx, [rbp + 0x860]
call fcn.1400e3600
nop
lea rcx, [rbp + 0x210]
call fcn.14006ead0
nop
lea rcx, [rbp + 0x708]
call fcn.14006ead0
nop
lea rcx, [rbp + 0x5b0]
call fcn.14006ead0
mov dword [rsp + 0x7c], 0x3d6e65
mov dword [rsp + 0x78], 0x6b6f7426
mov byte [rbp - 0x80], 0
lea rax, [rsp + 0x78]
mov rbx, r14
inc rbx
cmp byte [rax + rbx], 0
jne 0x14012b8c4
mov r15, qword [rbp + 0x7f0]
mov rax, r13
sub rax, r15
cmp rax, rbx
jb 0x14012ce12
lea r12, [rbp + 0x7e0]
cmp qword [rbp + 0x7f8], 0xf
cmova r12, qword [rbp + 0x7e0]
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xf0], xmm1
lea r14, [r15 + rbx]
mov edi, reloc.WS2_32.dll_ntohs
lea rsi, [rbp + 0xe0]
cmp r14, rdi
jbe 0x14012b9a0
mov rdi, r14
or rdi, 0xf
cmp rdi, r13
jbe 0x14012b960
mov rdi, r13
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14022485c
test rax, rax
je 0x14012bb99
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x14012b999
mov eax, socket
cmp rdi, rax
cmovb rdi, rax
lea rcx, [rdi + 1]
test rcx, rcx
jne 0x14012b979
xor esi, esi
jmp 0x14012b999
cmp rcx, 0x1000
jb 0x14012b991
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14012ce0c
jmp 0x14012b941
call fcn.14022485c
mov rsi, rax
mov qword [rbp + 0xe0], rsi
mov qword [rbp + 0xf0], r14
mov qword [rbp + 0xf8], rdi
mov r8, rbx
lea rdx, [rsp + 0x78]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rsi + rbx]
mov r8, r15
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + r14], 0
mov rdi, qword [rbp + 0xf0]
lea r9, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 0xf
cmova r9, qword [rbp + 0xe0]
mov rcx, qword [rbp + 0x7d0]
mov rdx, qword [rbp + 0x7d8]
mov rax, rdx
sub rax, rcx
cmp rdi, rax
ja 0x14012ba3e
lea rax, [rcx + rdi]
mov qword [rbp + 0x7d0], rax
lea rbx, [rbp + 0x7c0]
cmp rdx, 0xf
cmova rbx, qword [rbp + 0x7c0]
add rbx, rcx
mov r8, rdi
mov rdx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + rbx], 0
jmp 0x14012ba56
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rdx, rdi
lea rcx, [rbp + 0x7c0]
call fcn.14006dfe0
nop
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0xf
jbe 0x14012ba97
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14012ba92
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14012bb99
call fcn.140224898
movdqu xmmword [rbp + 0xf0], xmm6
mov byte [rbp + 0xe0], 0
mov dword [rsp + 0x5c], 0x3d6873
mov dword [rsp + 0x58], 0x61687426
mov byte [rsp + 0x60], 0
mov r15, qword [rbp + 0xd0]
lea r8, [r15 + 0x80]
lea rcx, [rsp + 0x58]
mov r14, 0xffffffffffffffff
mov rax, r14
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x14012bae0
mov rdx, qword [r8 + 0x10]
sub r13, rdx
cmp r13, rax
jb 0x14012ce12
mov rcx, r8
cmp qword [r8 + 0x18], 0xf
jbe 0x14012bb06
mov rcx, qword [r8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
movzx edx, byte [rbp + 0x7a8]
lea rcx, [rbp + 0x170]
call fcn.1400df560
mov edi, 0x3fc
mov dword [rsp + 0x40], edi
lea rdx, [rbp + 0x170]
cmp qword [rbp + 0x188], 0xf
cmova rdx, qword [rbp + 0x170]
mov r8, qword [rbp + 0x180]
lea rcx, [rbp + 0x7c0]
call fcn.14006ec50
nop
mov rdx, qword [rbp + 0x188]
cmp rdx, 0xf
jbe 0x14012bba5
inc rdx
mov rcx, qword [rbp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14012bba0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14012bba0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140224898
movdqu xmmword [rbp + 0x180], xmm6
mov byte [rbp + 0x170], 0
mov r8, qword [rbp + 0x878]
cmp r8, 0xf
jbe 0x14012bbd4
mov rdx, qword [rbp + 0x860]
lea rcx, [rbp + 0x860]
call fcn.1400ea290
movdqu xmmword [rbp + 0x870], xmm6
mov byte [rbp + 0x860], 0
mov r8, qword [rbp + 0x7f8]
cmp r8, 0xf
jbe 0x14012bc03
mov rdx, qword [rbp + 0x7e0]
lea rcx, [rbp + 0x7e0]
call fcn.1400ea290
xor r12d, r12d
mov qword [rbp + 0x7f0], r12
mov qword [rbp + 0x7f8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x7e0], r12b
mov rax, qword [rbp + 0x8c0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x8c0], rax
mov rax, qword [rbp + 0x8c0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x8bc], edx
lea rcx, [rbp + 0x8d0]
call fcn.1400e1b70
lea rcx, [rbp + 0x8d8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x970]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
mov rcx, qword [rbp + 0xd8]
call fcn.140136ef0
lea rax, [rbp + 0x728]
mov qword [rbp + 0xd8], rax
lea rdx, [r15 + 0x60]
lea rcx, [rbp + 0x728]
call fcn.1400df200
mov rbx, rax
lea rdx, [rbp + 0x7c0]
lea rcx, [rbp + 0x748]
call fcn.1400df200
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x800]
call fcn.140132de0
nop
mov dword [rbp - 0x4c], 0x64696c
mov dword [rbp - 0x58], 0x4179654b
mov dword [rbp - 0x54], 0x5f687475
mov dword [rbp - 0x50], 0x61766e49
mov byte [rbp - 0x48], 0
lea rcx, [rbp - 0x58]
mov rax, r14
inc rax
cmp byte [rcx + rax], 0
jne 0x14012bcf2
lea rcx, [rbp + 0x800]
mov rbx, qword [rbp + 0x800]
mov rsi, qword [rbp + 0x818]
cmp rsi, 0xf
cmova rcx, rbx
mov r8, qword [rbp + 0x810]
cmp r8, rax
jne 0x14012be86
lea rdx, [rbp - 0x58]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14012be86
movdqa xmm0, xmmword [str.Pbcxuvlpuu_sqk]
movdqa xmmword [rbp + 0x1a0], xmm0
movdqa xmm1, xmmword [0x140381620]
movdqa xmmword [rbp + 0x1b0], xmm1
movdqa xmm0, xmmword [0x140381480]
movdqa xmmword [rbp + 0x1c0], xmm0
movdqa xmm1, xmmword [0x1403814e0]
movdqa xmmword [rbp + 0x1d0], xmm1
mov dword [rbp + 0x1e0], 0x7d3623
mov byte [rbp + 0x1e4], 1
mov rcx, r12
nop dword [rax]
lea eax, [rcx + 0x11]
xor byte [rbp + rcx + 0x1a0], al
inc rcx
cmp rcx, 0x43
jb 0x14012bd90
mov byte [rbp + 0x1e4], 0
mov r9d, reloc.WS2_32.dll_recv
xor r8d, r8d
lea rdx, [rbp + 0x1a0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14012be54
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14012be54
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r10 + r9*4]
mov r8d, dword [rdx + r11]
add r8, r10
mov edx, 0x6f614d8d
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x14012be4f
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x14012be30
cmp edx, 0x3c7f95ed
je 0x14012be59
test r9d, r9d
jne 0x14012be10
mov rax, qword [rax]
jmp 0x14012bde0
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
xor ecx, ecx
call rax
mov rsi, qword [rbp + 0x818]
mov rbx, qword [rbp + 0x800]
mov edi, dword [rsp + 0x40]
lea rax, [rbp + 0x1f0]
mov qword [rbp + 0xd8], rax
lea rdx, [rbp + 0x800]
cmp rsi, 0xf
cmova rdx, rbx
xorps xmm0, xmm0
movups xmmword [rbp + 0x1f0], xmm0
mov qword [rbp + 0x200], r12
mov qword [rbp + 0x208], r12
nop dword [rax + rax]
inc r14
cmp byte [rdx + r14], 0
jne 0x14012bec0
mov r8, r14
lea rcx, [rbp + 0x1f0]
call fcn.14006d8c0
nop
lea rax, [rbp + 0x6a8]
mov qword [rbp + 0xd0], rax
lea rdx, [0x140713ea8]
lea rcx, [rbp + 0x6a8]
call fcn.1400df200
mov rbx, rax
lea rdx, [0x140713e88]
lea rcx, [rbp + 0x6c8]
call fcn.1400df200
nop
lea r8, [rbp + 0x1f0]
mov rdx, rbx
mov rcx, rax
call fcn.14011f4e0
xor eax, 0xa5a5
mov edx, eax
shr eax, 8
movzx r8d, al
movzx eax, dl
movabs r14, 0xcbf29ce484222325
xor rax, r14
movabs rsi, 0x100000001b3
imul rax, rsi
xor r8, rax
imul r8, rsi
mov eax, edx
shr eax, 0x10
movzx ecx, al
xor r8, rcx
imul r8, rsi
shr rdx, 0x18
xor r8, rdx
imul r8, rsi
cmp r8w, 0xdf7f
jne 0x14012cb7d
mov qword [rbp + 0x7a0], r12
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x768]
lea rdx, [rbp + 0x800]
lea rcx, [rbp + 0x7b0]
call fcn.14011b810
nop
lea rdx, [r15 + 0x20]
lea rcx, [rbp + 0x190]
call fcn.140116b60
nop
mov dword [rbp - 0x20], 0x717d657e
mov dword [rbp - 0x1c], 0x737f67
mov byte [rbp - 0x18], 1
lea rdx, [rbp + 0x5d0]
lea rcx, [rbp - 0x20]
call fcn.14011f0c0
nop
movzx ecx, byte [rbp + 0x7b0]
test cl, cl
jne 0x14012c002
mov byte [rbp + 0x7b0], 1
call fcn.140119e60
mov qword [rbp + 0x7b8], rax
movzx ecx, byte [rbp + 0x7b0]
jmp 0x14012c009
mov rax, qword [rbp + 0x7b8]
cmp cl, 1
jne 0x14012c01f
lea rdx, [rbp + 0x5d0]
mov rcx, rax
call fcn.14011efd0
jmp 0x14012c024
mov rax, qword [rsp + 0x48]
lea rdx, [rbp + 0x190]
mov rcx, rax
call fcn.14011ec00
movzx ebx, al
lea rcx, [rbp + 0x5d0]
call fcn.14006ead0
nop
movzx edx, byte [rbp + 0x190]
lea rcx, [rbp + 0x198]
call fcn.140126380
test bl, bl
jne 0x14012c10b
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14012c0e4
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14012c0e4
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r11 + r9*4]
mov r8d, dword [rdx + r10]
add r8, r10
mov edx, 0xfbdb41d4
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x14012c0df
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x14012c0c0
cmp edx, 0xe95e85e4
je 0x14012c0e9
test r9d, r9d
jne 0x14012c0a0
mov rax, qword [rax]
jmp 0x14012c070
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
mov ecx, 8
call rax
mov edi, dword [rsp + 0x40]
mov dword [rsp + 0x6c], 0x656761
mov dword [rsp + 0x68], 0x7373656d
mov byte [rsp + 0x70], 0
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x6f]
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x5f0]
call fcn.14006d490
or edi, 0x1800
movzx ecx, byte [rbp + 0x7b0]
test cl, cl
jne 0x14012c168
mov byte [rbp + 0x7b0], 1
call fcn.140119e60
mov qword [rbp + 0x7b8], rax
movzx ecx, byte [rbp + 0x7b0]
jmp 0x14012c16f
mov rax, qword [rbp + 0x7b8]
cmp cl, 1
jne 0x14012c185
lea rdx, [rbp + 0x5f0]
mov rcx, rax
call fcn.14011efd0
jmp 0x14012c18a
mov rax, qword [rsp + 0x48]
lea rdx, [rbp + 0x9d0]
mov rcx, rax
call fcn.140117270
nop
lea rcx, [rbp + 0x5f0]
call fcn.14006ead0
lea rdx, [rbp + 0x7b0]
lea rcx, [rbp + 0x310]
call fcn.14011de50
mov rdx, rax
mov rcx, r15
call fcn.14012ee30
mov word [rsp + 0x53], 0x65
mov word [rsp + 0x50], 0x6f63
mov byte [rsp + 0x52], 0x64
mov byte [rsp + 0x55], 0
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x54]
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x610]
call fcn.14006d490
or edi, 0x6000
movzx ecx, byte [rbp + 0x7b0]
test cl, cl
jne 0x14012c224
mov byte [rbp + 0x7b0], 1
call fcn.140119e60
mov qword [rbp + 0x7b8], rax
movzx ecx, byte [rbp + 0x7b0]
jmp 0x14012c22b
mov rax, qword [rbp + 0x7b8]
cmp cl, 1
jne 0x14012c241
lea rdx, [rbp + 0x610]
mov rcx, rax
call fcn.14011efd0
jmp 0x14012c246
mov rax, qword [rsp + 0x48]
mov rcx, rax
call fcn.140117200
mov edx, eax
shr eax, 8
movzx ebx, al
movzx eax, dl
xor rax, r14
imul rax, rsi
xor rbx, rax
imul rbx, rsi
mov eax, edx
shr eax, 0x10
movzx ecx, al
xor rbx, rcx
imul rbx, rsi
shr rdx, 0x18
xor rbx, rdx
imul rbx, rsi
lea rcx, [rbp + 0x610]
call fcn.14006ead0
mov dword [rbp - 0x10], 0x77706762
mov dword [rbp - 0xc], 0x646570
mov byte [rbp - 8], 1
lea rdx, [rbp + 0x650]
lea rcx, [rbp - 0x10]
call fcn.14011f0c0
nop
or edi, 1
mov dword [rsp + 0x40], edi
movzx ecx, byte [rbp + 0x7b0]
test cl, cl
jne 0x14012c2de
mov byte [rbp + 0x7b0], 1
call fcn.140119e60
mov qword [rbp + 0x7b8], rax
movzx ecx, byte [rbp + 0x7b0]
jmp 0x14012c2e5
mov rax, qword [rbp + 0x7b8]
cmp cl, 1
jne 0x14012c2fe
lea rdx, [rbp + 0x650]
mov rcx, rax
call fcn.14011efd0
mov rcx, rax
jmp 0x14012c303
mov rcx, qword [rsp + 0x48]
lea rax, [rcx + 8]
cmp byte [rcx], 4
cmovne rax, r12
cmp byte [rax], 0
je 0x14012c3af
mov dword [rbp], 0x77706762
mov dword [rbp + 4], 0x646570
mov byte [rbp + 8], 1
lea rdx, [rbp + 0x630]
lea rcx, [rbp]
call fcn.14011f0c0
nop
or edi, 2
mov dword [rsp + 0x40], edi
movzx eax, byte [rbp + 0x7b0]
test al, al
jne 0x14012c36b
mov byte [rbp + 0x7b0], 1
call fcn.140119e60
mov rcx, rax
mov qword [rbp + 0x7b8], rax
movzx eax, byte [rbp + 0x7b0]
jmp 0x14012c372
mov rcx, qword [rbp + 0x7b8]
cmp al, 1
jne 0x14012c387
lea rdx, [rbp + 0x630]
call fcn.14011efd0
mov rcx, rax
jmp 0x14012c38c
mov rcx, qword [rsp + 0x48]
lea rax, [rcx + 8]
cmp byte [rcx], 4
cmovne rax, r12
cmp byte [rax], 0
je 0x14012c3ab
movabs rax, 0xcbe5c873d26645f1
cmp rbx, rax
je 0x14012c3af
xor bl, bl
jmp 0x14012c3b1
mov bl, 1
test dil, 2
je 0x14012c3c7
and edi, 0xfffffffd
lea rcx, [rbp + 0x630]
call fcn.14006ead0
nop
test dil, 1
je 0x14012c3d9
lea rcx, [rbp + 0x650]
call fcn.14006ead0
test bl, bl
je 0x14012caa6
mov dword [rbp + 0x10], 0x77706762
mov dword [rbp + 0x14], 0x646570
mov byte [rbp + 0x18], 1
lea rdx, [rbp + 0x670]
lea rcx, [rbp + 0x10]
call fcn.14011f0c0
nop
movzx eax, byte [rbp + 0x7b0]
test al, al
jne 0x14012c42e
mov byte [rbp + 0x7b0], 1
call fcn.140119e60
mov rcx, rax
mov qword [rbp + 0x7b8], rax
movzx eax, byte [rbp + 0x7b0]
jmp 0x14012c435
mov rcx, qword [rbp + 0x7b8]
cmp al, 1
jne 0x14012c44a
lea rdx, [rbp + 0x670]
call fcn.14011efd0
mov rcx, rax
jmp 0x14012c44f
mov rcx, qword [rsp + 0x48]
lea rax, [rcx + 8]
cmp byte [rcx], 4
cmovne rax, r12
movzx ebx, byte [rax]
lea rcx, [rbp + 0x670]
call fcn.14006ead0
test bl, bl
je 0x14012c637
mov dword [rbp + 0x60], 0x4764777f
mov dword [rbp + 0x64], 0x71646570
mov dword [rbp + 0x68], 0x1007476
lea rdx, [rbp + 0x510]
lea rcx, [rbp + 0x60]
call fcn.14011f1e0
nop
movzx eax, byte [rbp + 0x7b0]
test al, al
jne 0x14012c4c1
mov byte [rbp + 0x7b0], 1
call fcn.140119e60
mov rcx, rax
mov qword [rbp + 0x7b8], rax
movzx eax, byte [rbp + 0x7b0]
jmp 0x14012c4c8
mov rcx, qword [rbp + 0x7b8]
cmp al, 1
jne 0x14012c4dd
lea rdx, [rbp + 0x510]
call fcn.14011efd0
mov rcx, rax
jmp 0x14012c4e2
mov rcx, qword [rsp + 0x48]
lea rax, [rcx + 8]
cmp byte [rcx], 4
cmovne rax, r12
movzx ebx, byte [rax]
lea rcx, [rbp + 0x510]
call fcn.14006ead0
test bl, bl
je 0x14012c50b
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp + 0x50], 0x67607762
mov dword [rbp + 0x54], 0x7179797c
mov word [rbp + 0x58], 0x7d
mov byte [rbp + 0x5a], 1
lea rdx, [rbp + 0x4f0]
lea rcx, [rbp + 0x50]
call fcn.14011f160
nop
movzx eax, byte [rbp + 0x7b0]
test al, al
jne 0x14012c55e
mov byte [rbp + 0x7b0], 1
call fcn.140119e60
mov rcx, rax
mov qword [rbp + 0x7b8], rax
movzx eax, byte [rbp + 0x7b0]
jmp 0x14012c565
mov rcx, qword [rbp + 0x7b8]
cmp al, 1
jne 0x14012c577
lea rdx, [rbp + 0x4f0]
call fcn.14011efd0
jmp 0x14012c57c
mov rax, qword [rsp + 0x48]
lea rcx, [r15 + 0x240]
mov rdx, rax
call fcn.140116ea0
nop
lea rcx, [rbp + 0x4f0]
call fcn.14006ead0
mov byte [0x1408a8818], 1
mov dword [rbp - 0x40], 0x7d636270
mov dword [rbp - 0x3c], 0x78707b
mov byte [rbp - 0x38], 1
lea rdx, [rbp + 0x570]
lea rcx, [rbp - 0x40]
call fcn.14011f0c0
nop
movzx ecx, byte [rbp + 0x7b0]
test cl, cl
jne 0x14012c5e9
mov byte [rbp + 0x7b0], 1
call fcn.140119e60
mov qword [rbp + 0x7b8], rax
movzx ecx, byte [rbp + 0x7b0]
jmp 0x14012c5f0
mov rax, qword [rbp + 0x7b8]
cmp cl, 1
jne 0x14012c606
lea rdx, [rbp + 0x570]
mov rcx, rax
call fcn.14011efd0
jmp 0x14012c60b
mov rax, qword [rsp + 0x48]
mov rdx, rax
lea rcx, [rbp + 0x300]
call fcn.14011de50
mov rdx, rax
mov rcx, r15
call fcn.14012ea10
nop
lea rcx, [rbp + 0x570]
call fcn.14006ead0
jmp 0x14012cb58
mov dword [rbp + 0x70], 0x75657c78
mov dword [rbp + 0x74], 0x6e737f79
mov dword [rbp + 0x78], 0x100687c
xor eax, eax
mov qword [rbp + 0x108], rax
mov byte [rbp + 0x100], 3
xorps xmm0, xmm0
movups xmmword [rbp + 0x850], xmm0
mov edx, 1
lea rcx, [rbp + 0x7a8]
call fcn.1401205d0
lea rcx, [rbp + 0x7a8]
mov qword [rbp + 0x850], rcx
mov qword [rbp + 0x858], rax
mov rdx, rax
lea rcx, [rbp + 0x70]
call fcn.14011f1e0
mov rax, qword [rbp + 0x858]
mov qword [rbp + 0x858], r12
mov qword [rbp + 0x108], rax
mov dword [rbp - 0x30], 0x6760777c
mov dword [rbp - 0x2c], 0x727174
mov byte [rbp - 0x28], 1
lea rdx, [rbp + 0x550]
lea rcx, [rbp - 0x30]
call fcn.14011f0c0
nop
movzx ecx, byte [rbp + 0x7b0]
test cl, cl
jne 0x14012c6f7
mov byte [rbp + 0x7b0], 1
call fcn.140119e60
mov qword [rbp + 0x7b8], rax
movzx ecx, byte [rbp + 0x7b0]
jmp 0x14012c6fe
mov rax, qword [rbp + 0x7b8]
cmp cl, 1
jne 0x14012c714
lea rdx, [rbp + 0x550]
mov rcx, rax
call fcn.14011efd0
jmp 0x14012c719
mov rax, qword [rsp + 0x48]
lea rdx, [rbp + 0x100]
mov rcx, rax
call fcn.14011ec00
movzx ebx, al
lea rcx, [rbp + 0x550]
call fcn.14006ead0
nop
movzx edx, byte [rbp + 0x100]
lea rcx, [rbp + 0x108]
call fcn.140126380
test bl, bl
je 0x14012cb58
mov dword [rbp + 0x20], 0x7a647d75
mov dword [rbp + 0x24], 0x7c767979
mov word [rbp + 0x28], 0x100
lea rdx, [rbp + 0x530]
lea rcx, [rbp + 0x20]
call fcn.14011f110
nop
movzx eax, byte [rbp + 0x7b0]
test al, al
jne 0x14012c7a2
mov byte [rbp + 0x7b0], 1
call fcn.140119e60
mov rcx, rax
mov qword [rbp + 0x7b8], rax
movzx eax, byte [rbp + 0x7b0]
jmp 0x14012c7a9
mov rcx, qword [rbp + 0x7b8]
cmp al, 1
jne 0x14012c7bb
lea rdx, [rbp + 0x530]
call fcn.14011efd0
jmp 0x14012c7c0
mov rax, qword [rsp + 0x48]
lea rdx, [rbp + 0x8a0]
mov rcx, rax
call fcn.140117270
nop
lea rcx, [rbp + 0x530]
call fcn.14006ead0
lea rcx, [rbp + 0x8a0]
mov rbx, qword [rbp + 0x8a0]
mov rdi, qword [rbp + 0x8b8]
cmp rdi, 0xf
cmova rcx, rbx
mov r8, qword [rbp + 0x8b0]
test r8, r8
jne 0x14012c9a7
lea rdx, [0x14036f3ac]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14012c9a7
movdqa xmm0, xmmword [0x140381570]
movdqa xmmword [rbp + 0x3b0], xmm0
movdqa xmm1, xmmword [0x140381600]
movdqa xmmword [rbp + 0x3c0], xmm1
movdqa xmm0, xmmword [0x140381640]
movdqa xmmword [rbp + 0x3d0], xmm0
movdqa xmm1, xmmword [0x140381490]
movdqa xmmword [rbp + 0x3e0], xmm1
movdqa xmm0, xmmword [str.97s0:_946__171_vq]
movdqa xmmword [rbp + 0x3f0], xmm0
movdqa xmm1, xmmword [str.A_r_rD]
movdqa xmmword [rbp + 0x400], xmm1
movdqa xmm0, xmmword [0x1403816e0]
movdqa xmmword [rbp + 0x410], xmm0
movdqa xmm1, xmmword [0x140381730]
movdqa xmmword [rbp + 0x420], xmm1
movdqa xmm0, xmmword [0x140381710]
movdqa xmmword [rbp + 0x430], xmm0
movdqa xmm1, xmmword [0x140381720]
movdqa xmmword [rbp + 0x440], xmm1
movdqa xmm0, xmmword [0x1403816f0]
movdqa xmmword [rbp + 0x450], xmm0
movdqa xmm1, xmmword [0x140381700]
movdqa xmmword [rbp + 0x460], xmm1
movdqa xmm0, xmmword [0x1403816d0]
movdqa xmmword [rbp + 0x470], xmm0
movdqa xmm1, xmmword [0x1403816c0]
movdqa xmmword [rbp + 0x480], xmm1
movdqa xmm0, xmmword [0x140381680]
movdqa xmmword [rbp + 0x490], xmm0
movdqa xmm1, xmmword [0x140381690]
movdqa xmmword [rbp + 0x4a0], xmm1
movdqa xmm0, xmmword [0x1403815b0]
movdqa xmmword [rbp + 0x4b0], xmm0
movdqa xmm1, xmmword [0x1403815c0]
movdqa xmmword [rbp + 0x4c0], xmm1
movdqa xmm0, xmmword [0x1403814a0]
movdqa xmmword [rbp + 0x4d0], xmm0
mov dword [rbp + 0x4e0], 0x3d2f3622
mov word [rbp + 0x4e4], WSAStartup
mov byte [rbp + 0x4e6], 1
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx + 0x11]
xor byte [rbp + rcx + 0x3b0], al
inc rcx
cmp rcx, 0x135
jb 0x14012c970
mov byte [rbp + 0x4e6], 0
mov r9d, reloc.WS2_32.dll_recv
xor r8d, r8d
lea rdx, [rbp + 0x3b0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x14012c9e6
lea r8, [rbp + 0x8a0]
cmp rdi, 0xf
cmova r8, rbx
mov word [rbp - 0x75], WSAStartup
mov word [rbp - 0x78], 0x706f
mov byte [rbp - 0x76], 0x65
mov byte [rbp - 0x73], 0
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea rdx, [rbp - 0x78]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14012ca74
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14012ca74
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r11 + r9*4]
mov r8d, dword [rdx + r10]
add r8, r10
mov edx, 0x16f8fe6b
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x14012ca6f
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x14012ca50
cmp edx, 0x66576e3b
je 0x14012ca79
test r9d, r9d
jne 0x14012ca30
mov rax, qword [rax]
jmp 0x14012ca00
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
xor ecx, ecx
call rax
nop
lea rcx, [rbp + 0x8a0]
call fcn.14006ead0
jmp 0x14012cb58
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14012cb34
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14012cb34
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r11 + r9*4]
mov r8d, dword [rdx + r10]
add r8, r10
mov edx, 0x87ef22f2
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x14012cb2f
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x14012cb10
cmp edx, 0x4659400a
je 0x14012cb39
test r9d, r9d
jne 0x14012caf0
mov rax, qword [rax]
jmp 0x14012cac0
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
mov ecx, 9
call rax
nop
lea rcx, [rbp + 0x9d0]
call fcn.14006ead0
nop
movzx edx, byte [rbp + 0x7b0]
lea rcx, [rbp + 0x7b8]
call fcn.140126380
jmp 0x14012cc2a
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14012cc06
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14012cc06
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r11 + r9*4]
mov ecx, dword [rdx + r10]
add rcx, r10
mov r8d, 0x890d3999
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14012cc01
nop
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x14012cbe0
cmp r8d, 0x1a7c5a79
je 0x14012cc0b
test r9d, r9d
jne 0x14012cbc0
mov rax, qword [rax]
jmp 0x14012cb90
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
mov ecx, 7
call rax
nop
mov rdx, qword [rbp + 0x818]
cmp rdx, 0xf
jbe 0x14012cc6e
inc rdx
mov rcx, qword [rbp + 0x800]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14012cc69
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14012cc69
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140224898
mov qword [rbp + 0x810], r12
mov qword [rbp + 0x818], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x800], 0
mov rdx, qword [rbp + 0x7d8]
cmp rdx, 0xf
jbe 0x14012cccb
inc rdx
mov rcx, qword [rbp + 0x7c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14012ccc6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14012ccc6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140224898
mov qword [rbp + 0x7d0], r12
mov qword [rbp + 0x7d8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x7c0], 0
mov rdx, qword [rbp + 0x848]
cmp rdx, 0xf
jbe 0x14012cd28
inc rdx
mov rcx, qword [rbp + 0x830]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14012cd23
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14012cd23
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140224898
mov qword [rbp + 0x840], r12
mov qword [rbp + 0x848], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x830], 0
mov rdx, qword [rbp + 0x898]
cmp rdx, 0xf
jbe 0x14012cd85
inc rdx
mov rcx, qword [rbp + 0x880]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14012cd80
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14012cd80
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140224898
mov rcx, qword [rbp + 0xa70]
xor rcx, rsp
call fcn.140225440
lea r11, [rsp + 0xb90]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
movdqa xmm0, xmmword [str.acq__8]
movdqu xmmword [rbp + 0x230], xmm0
mov byte [rbp + 0x240], 1
lea rdx, [rbp + 0x6e8]
lea rcx, [rbp + 0x230]
call fcn.14011f1c0
nop
lea rdx, [rbp + 0x6e8]
lea rcx, [rbp + 0x690]
call fcn.14011e510
lea rdx, [0x1406368b8]
lea rcx, [rbp + 0x690]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
call fcn.140048fb0
int3
call fcn.14006ec10
int3