Function at 0x180062d60
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create thread
Encode data using xor
Enumerate threads
Execute shellcode via indirect call
Spawn thread to rwx shellcode
Terminate process
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov rax, qword [0x180109070]
xor rax, rsp
mov qword [rbp + 0x60], rax
cmp edx, 1
jne 0x180063ff2
lea rcx, [rbp - 0x50]
call fcn.180045c20
mov rbx, rax
lea r12, [0x18015e990]
xor r14d, r14d
cmp r12, rax
je 0x180062e30
mov rdx, qword [reloc.WS2_32.dll_ntohs]
cmp rdx, 0x10
jb 0x180062df4
mov rcx, qword [0x18015e990]
inc rdx
cmp rdx, 0x1000
jb 0x180062def
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180062e62
mov rcx, r8
call fcn.1800d155c
movdqa xmm0, xmmword [0x1800f5020]
movdqu xmmword [0x18015e9a0], xmm0
mov byte [0x18015e990], r14b
movups xmm0, xmmword [rbx]
movups xmmword [0x18015e990], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [0x18015e9a0], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x180062e6e
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180062e69
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180062e69
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800d155c
lea rcx, [rbp - 0x50]
call fcn.180045ee0
mov rbx, rax
lea r15, [0x18015e9d0]
cmp r15, rax
je 0x180062f00
mov rdx, qword [reloc.WS2_32.dll_ntohs]
cmp rdx, 0x10
jb 0x180062ec3
mov rcx, qword [0x18015e9d0]
inc rdx
cmp rdx, 0x1000
jb 0x180062ebe
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180062f32
mov rcx, r8
call fcn.1800d155c
movdqa xmm0, xmmword [0x1800f5020]
movdqu xmmword [0x18015e9e0], xmm0
mov byte [0x18015e9d0], 0
movups xmm0, xmmword [rbx]
movups xmmword [0x18015e9d0], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [0x18015e9e0], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x180062f3e
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180062f39
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180062f39
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800d155c
lea rcx, [rbp - 0x50]
call fcn.1800469b0
mov rbx, rax
lea rsi, [0x18015e9b0]
cmp rsi, rax
je 0x180062fd0
mov rdx, qword [reloc.WS2_32.dll_ntohs]
cmp rdx, 0x10
jb 0x180062f93
mov rcx, qword [0x18015e9b0]
inc rdx
cmp rdx, 0x1000
jb 0x180062f8e
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180063002
mov rcx, r8
call fcn.1800d155c
movdqa xmm0, xmmword [0x1800f5020]
movdqu xmmword [0x18015e9c0], xmm0
mov byte [0x18015e9b0], 0
movups xmm0, xmmword [rbx]
movups xmmword [0x18015e9b0], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [0x18015e9c0], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x18006300e
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180063009
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180063009
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800d155c
mov dword [rsp + 0x40], 0x3e382a2a
mov dword [rsp + 0x44], 0x21552c32
mov dword [rsp + 0x48], 0x35232a36
mov dword [rsp + 0x4c], 0x1003935
mov rcx, r14
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x6f]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 0xe
jb 0x180063040
mov byte [rsp + 0x4f], 0
lea rax, [rsp + 0x40]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x180063064
lea rdx, [rsp + 0x40]
lea rcx, [0x18015ea10]
call fcn.180047040
nop
mov byte [rbp + 0x18], 0
xor edx, edx
lea rcx, [rbp + 0x20]
call fcn.180069280
lea rcx, [rbp + 0x18]
call fcn.1800684c0
lea rcx, [rbp + 0x18]
call fcn.1800684c0
nop
lea rax, [rbp - 0x28]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x30], 0x151f191c
mov dword [rsp + 0x34], 0x1001a1a
mov rcx, r14
nop
lea eax, [rcx + 0x6f]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 6
jb 0x1800630c0
mov byte [rsp + 0x37], 0
mov byte [rbp - 0x28], 0
xor eax, eax
mov qword [rbp - 0x20], rax
xor edx, edx
lea rcx, [rbp - 0x20]
call fcn.180067f80
mov byte [rbp - 0x28], 3
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1800d19dc
mov rdi, rax
lea rax, [rbp - 0x30]
mov qword [rbp], rax
mov qword [rbp + 8], rdi
mov qword [rdi], r14
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
lea rax, [rsp + 0x30]
inc rbx
cmp byte [rax + rbx], 0
jne 0x180063122
mov r8, rbx
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.180047040
nop
mov qword [rbp - 0x20], rdi
lea rcx, [rbp - 0x28]
call fcn.1800684c0
lea rcx, [rbp - 0x28]
call fcn.1800684c0
nop
mov dword [rsp + 0x60], 0x1a051502
mov dword [rsp + 0x64], 0x100101c
lea rcx, [rsp + 0x60]
call fcn.18004fd10
mov rdx, rax
lea rcx, [rbp + 0x18]
call fcn.18006aaf0
mov rcx, rax
lea rdx, [rbp - 0x28]
call fcn.180065b30
lea rax, [rbp - 0x28]
mov qword [rsp + 0x40], rax
lea rdx, [0x18015ea10]
lea rcx, [rbp - 0x28]
call fcn.18006ac40
mov rbx, rax
mov dword [rbp - 0x30], 0x171c1101
mov word [rbp - 0x2c], 0x100
lea rcx, [rbp - 0x30]
call fcn.180045a90
mov rdx, rax
lea rcx, [rbp + 0x18]
call fcn.18006aaf0
mov rcx, rax
mov rdx, rbx
call fcn.180065b30
lea rax, [rbp - 0x28]
mov qword [rsp + 0x40], rax
mov rdx, r12
lea rcx, [rbp - 0x28]
call fcn.18006ac40
mov rbx, rax
mov dword [rbp - 0x30], 0x1d171e06
mov word [rbp - 0x2c], 0x100
lea rcx, [rbp - 0x30]
call fcn.180045a90
mov rdx, rax
lea rcx, [rbp + 0x18]
call fcn.18006aaf0
mov r8, rax
mov dword [rsp + 0x30], 0x1618051a
mov word [rsp + 0x34], 0x100
lea rcx, [rsp + 0x30]
call fcn.180045a90
mov rdx, rax
mov rcx, r8
call fcn.18006aaf0
mov rcx, rax
mov rdx, rbx
call fcn.180065b30
lea rax, [rbp - 0x28]
mov qword [rsp + 0x40], rax
mov rdx, r15
lea rcx, [rbp - 0x28]
call fcn.18006ac40
mov rbx, rax
mov dword [rsp + 0x30], 0x1d171e06
mov word [rsp + 0x34], 0x100
lea rcx, [rsp + 0x30]
call fcn.180045a90
mov rdx, rax
lea rcx, [rbp + 0x18]
call fcn.18006aaf0
mov r8, rax
mov dword [rbp - 0x30], 0x441402
mov byte [rbp - 0x2c], 1
lea rcx, [rbp - 0x30]
call fcn.180047980
mov rdx, rax
mov rcx, r8
call fcn.18006aaf0
mov rcx, rax
mov rdx, rbx
call fcn.180065b30
lea rax, [rbp - 0x28]
mov qword [rsp + 0x40], rax
mov rdx, rsi
lea rcx, [rbp - 0x28]
call fcn.18006ac40
mov rbx, rax
mov dword [rsp + 0x30], 0x1d171e06
mov word [rsp + 0x34], 0x100
lea rcx, [rsp + 0x30]
call fcn.180045a90
mov rdx, rax
lea rcx, [rbp + 0x18]
call fcn.18006aaf0
mov r8, rax
mov dword [rbp - 0x30], 0x17151119
mov word [rbp - 0x2c], 0x100
lea rcx, [rbp - 0x30]
call fcn.180045a90
mov rdx, rax
mov rcx, r8
call fcn.18006aaf0
mov rcx, rax
mov rdx, rbx
call fcn.180065b30
lea rdx, [rbp + 0x18]
lea rcx, [rbp - 0x28]
call fcn.180065ba0
mov r8, rax
movdqa xmm0, xmmword [0x1800f54d0]
movdqu xmmword [rbp], xmm0
mov dword [rbp + 0x10], 0xaeef19
mov byte [rbp + 0x14], 1
lea rcx, [rbp]
call fcn.180046f80
mov rdx, rax
lea rcx, [rbp + 0x40]
call fcn.180045890
nop
lea rdx, [rbp + 0x40]
lea rcx, [rbp - 0x50]
call fcn.180066700
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.180045550
mov rdx, rax
lea rcx, [rbp + 0x40]
call fcn.180066630
lea rcx, [rsp + 0x40]
call fcn.180044b70
mov qword [rbp - 0x58], r14
lea rcx, [rbp + 0x40]
call fcn.180066570
mov qword [rsp + 0x60], rax
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x30]
call fcn.18006ad00
nop
mov dword [rsp + 0x40], 0x2630243c
mov dword [rsp + 0x44], 0x252a2726
mov dword [rsp + 0x48], 0x3f3a3b22
mov dword [rsp + 0x4c], 0x1002f28
lea rcx, [rsp + 0x40]
call fcn.180046fb0
mov rbx, rax
mov dword [rsp + 0x30], 0x17151f0c
mov word [rsp + 0x34], 0x100
lea rcx, [rsp + 0x30]
call fcn.180045a90
mov rdx, rax
lea rcx, [rbp + 0x30]
call fcn.18006aaf0
mov rdx, rbx
mov rcx, rax
call fcn.18006ae30
test al, al
je 0x180063fd5
mov dword [rsp + 0x30], 0x1d171e06
mov word [rsp + 0x34], 0x100
lea rcx, [rsp + 0x30]
call fcn.180045a90
mov rdx, rax
lea rcx, [rbp + 0x30]
call fcn.18006aaf0
mov r8, rax
movdqa xmm0, xmmword [0x1800f5580]
movdqu xmmword [rbp - 0x28], xmm0
mov dword [rbp - 0x18], 0x100f21a
lea rcx, [rbp - 0x28]
call fcn.180046ec0
mov rdx, rax
mov rcx, r8
call fcn.18006aaf0
mov rdx, rax
lea rcx, [0x18015e930]
call fcn.18006af00
mov dword [rsp + 0x30], 0x1d171e06
mov word [rsp + 0x34], 0x100
lea rcx, [rsp + 0x30]
call fcn.180045a90
mov rdx, rax
lea rcx, [rbp + 0x30]
call fcn.18006aaf0
mov r8, rax
movdqa xmm0, xmmword [0x1800f5580]
movdqu xmmword [rbp - 0x28], xmm0
mov dword [rbp - 0x18], 0xf6def21a
mov dword [rbp - 0x14], 0xe0e9ea
mov byte [rbp - 0x10], 1
lea rcx, [rbp - 0x28]
call fcn.18004fef0
mov rdx, rax
mov rcx, r8
call fcn.18006aaf0
mov rdx, rax
lea rcx, [0x18015e950]
call fcn.18006af00
mov dword [rsp + 0x30], 0x1d171e06
mov word [rsp + 0x34], 0x100
lea rcx, [rsp + 0x30]
call fcn.180045a90
mov rdx, rax
lea rcx, [rbp + 0x30]
call fcn.18006aaf0
mov r8, rax
movdqa xmm0, xmmword [0x1800f5580]
movdqu xmmword [rbp - 0x28], xmm0
mov dword [rbp - 0x18], 0xf1def21a
mov dword [rbp - 0x14], 0xf3f1e5f7
mov word [rbp - 0x10], 0xf4
mov byte [rbp - 0xe], 1
lea rcx, [rbp - 0x28]
call fcn.18004fe30
mov rdx, rax
mov rcx, r8
call fcn.18006aaf0
mov rdx, rax
lea rcx, [0x18015ea30]
call fcn.18006af00
mov dword [rbp - 0x30], 0x1000d14
lea rcx, [rbp - 0x30]
call fcn.180046ef0
mov rdx, rax
lea rcx, [0x18015e930]
call fcn.18006a290
test al, al
jne 0x180063fd5
movzx eax, byte [0x1800e6a10]
xor al, 0x6f
mov byte [rbp - 0x30], al
mov word [rbp - 0x2f], 0x100
lea rcx, [rbp - 0x30]
call fcn.1800472b0
mov rdx, rax
lea rcx, [0x18015ea30]
call fcn.18006a290
test al, al
jne 0x1800635c9
movzx eax, byte [0x1800e6a18]
xor al, 0x6f
mov byte [rbp - 0x30], al
mov word [rbp - 0x2f], 0x100
lea rcx, [rbp - 0x30]
call fcn.1800472b0
mov rdx, rax
lea rcx, [0x18015ea30]
call fcn.18006a290
test al, al
je 0x180063fd5
xor edx, edx
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x180063601
lea rcx, [rbp + 0x30]
call fcn.180065b00
nop
lea rcx, [rbp + 0x40]
call fcn.180044b70
nop
lea rcx, [rbp + 0x18]
call fcn.180065b00
xor eax, eax
jmp 0x180063ff7
mov dword [rbp - 0x50], Ordinal_32
lea rdx, [rbp - 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x1800636df
mov dword [rsp + 0x40], 0x5c1a0300
mov dword [rsp + 0x44], 0x100c16
mov byte [rsp + 0x48], 1
lea rcx, [rsp + 0x40]
call fcn.18004ff20
mov rcx, rax
call fcn.180045160
mov rdi, rax
mov eax, dword [rbp - 0x44]
cmp rax, rdi
jne 0x1800636ca
mov r8d, dword [rbp - 0x48]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbx, rax
mov rcx, rax
call fcn.180062c50
mov r8d, eax
mov edx, edi
lea rcx, [rbp - 0x28]
call fcn.180062b60
mov dword [rsp + 0x40], 0x113111b
mov dword [rsp + 0x44], 0x125b1618
mov dword [rsp + 0x48], 0x100141b
lea rcx, [rsp + 0x40]
call fcn.18004ff80
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.180066490
cmp rax, 0xffffffffffffffff
je 0x1800636b8
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp - 0x28]
call fcn.180044b70
lea rdx, [rbp - 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x180063647
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.1800517b0
test eax, eax
jne 0x180063734
mov word [rbp - 0x30], 0x100
lea rcx, [rbp - 0x30]
call fcn.180055580
mov r8, rax
movdqa xmm0, xmmword [0x1800f5190]
movdqu xmmword [rbp + 0x18], xmm0
mov byte [rbp + 0x28], 1
lea rcx, [rbp + 0x18]
call fcn.180045bf0
xor r9d, r9d
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.180051910
test al, al
jne 0x180063790
mov word [rbp - 0x30], 0x100
lea rcx, [rbp - 0x30]
call fcn.180055580
mov r8, rax
mov dword [rsp + 0x40], 0x1e181129
mov dword [rsp + 0x44], 0x22551016
mov dword [rsp + 0x48], 0x13295818
mov dword [rsp + 0x4c], 0x1001b15
lea rcx, [rsp + 0x40]
call fcn.180046fb0
xor r9d, r9d
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x18015ffe8], eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x18015ff28], eax
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8, [0x1800624e0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
movdqa xmm0, xmmword [0x1800f5640]
movdqu xmmword [rbp - 0x28], xmm0
mov dword [rbp - 0x18], 0xafae51
mov byte [rbp - 0x14], 1
lea rcx, [rbp - 0x28]
call fcn.180046f80
mov rdx, rax
lea rcx, [0x18015e970]
call fcn.180047020
xor bl, bl
nop
mov dword [rbp], 0x605112d
mov dword [rbp + 4], 0x185b111f
mov dword [rbp + 8], 0x1f570c12
mov dword [rbp + 0xc], 0x1001903
lea rcx, [rbp]
call fcn.180046fb0
mov rcx, rax
call fcn.180045160
test rax, rax
je 0x18006386c
mov dword [rsp + 0x60], 0x1314041c
mov dword [rsp + 0x64], 0xe105a1e
mov word [rsp + 0x68], reloc.WS2_32.dll_select
mov byte [rsp + 0x6a], 1
lea rcx, [rsp + 0x60]
call fcn.18004fd40
mov rcx, rax
call fcn.180045160
test rax, rax
je 0x18006386c
mov bl, 1
jmp 0x18006397e
mov dword [rbp - 0x28], 0x605112d
mov dword [rbp - 0x24], 0x185b111f
mov dword [rbp - 0x20], 0x1f570c12
mov dword [rbp - 0x1c], 0x1001903
lea rcx, [rbp - 0x28]
call fcn.180046fb0
mov rcx, rax
call fcn.180045160
test rax, rax
je 0x1800638aa
mov byte [reloc.WS2_32.dll_accept], 1
jmp 0x18006397e
mov dword [rsp + 0x30], 0x1314041c
mov dword [rsp + 0x34], 0xe105a1e
mov word [rsp + 0x38], reloc.WS2_32.dll_select
mov byte [rsp + 0x3a], 1
lea rcx, [rsp + 0x30]
call fcn.18004fd40
mov rcx, rax
call fcn.180045160
test rax, rax
je 0x18006397e
mov byte [reloc.WS2_32.dll_accept], 0
mov dword [0x1801090b8], 0x146ba340
mov dword [0x18014b368], 0x146b8478
mov dword [0x18011b244], 0xda97070
mov dword [0x18010e924], 0x14f3b8f0
mov dword [0x1801090b4], 0x6d578
mov dword [0x1801514e0], 0x112723d0
mov dword [0x1801362e8], 0x145a0b80
mov dword [0x18013fc18], 0xc9d45b0
mov dword [0x18011d764], 0x13de0
mov dword [0x18014b364], 0x13daa
mov dword [0x1801090b0], 0x12b60
mov dword [0x18011d768], 0x350
mov dword [0x180142528], 0x134d1
mov dword [0x18011b248], 0x71c
mov dword [0x18010e928], 0x53cf8
mov dword [rsp + 0x40], 0x5c151f0c
mov dword [rsp + 0x44], 0x100c16
mov byte [rsp + 0x48], 1
lea rcx, [rsp + 0x40]
call fcn.18004ff20
mov rcx, rax
call fcn.180045160
test rax, rax
jne 0x1800639ba
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x180063800
mov ecx, 0xfa0
call qword [sym.imp.KERNEL32.dll_Sleep]
test bl, bl
je 0x1800639f5
movdqa xmm0, xmmword [0x1800f5650]
movdqu xmmword [rbp - 0x28], xmm0
movdqa xmm1, xmmword [0x1800f5dc0]
movdqu xmmword [rbp - 0x18], xmm1
mov dword [rbp - 8], 0x100b9e2
lea rcx, [rbp - 0x28]
call fcn.180064030
jmp 0x180063a11
movdqa xmm0, xmmword [0x1800f55e0]
movdqu xmmword [rbp - 0x28], xmm0
mov word [rbp - 0x18], 0x100
lea rcx, [rbp - 0x28]
call fcn.18004fd70
mov rdx, rax
lea rcx, [0x18015e970]
call fcn.180047020
lea rsi, [0x18006aac0]
lea rdi, [0x180000000]
nop
mov dword [rbp - 0x30], 0x77
lea rcx, [rbp - 0x28]
call fcn.1800624d0
lea rcx, [rbp - 0x28]
test bl, bl
je 0x180063dba
lea r15, [rbp + 0x88]
mov rdx, r15
call fcn.1800419f0
nop
mov ecx, r14d
mov rax, qword [0x18019bbb0]
test rax, rax
je 0x180063a99
mov rdx, r14
nop
cmp rax, rsi
je 0x180063a88
inc ecx
mov edx, ecx
mov rax, qword [rdi + rcx*8 + 0x19bbb0]
test rax, rax
jne 0x180063a70
jmp 0x180063a99
mov r8, qword [rdi + rdx*8 + 0x19b240]
test r8, r8
jne 0x180063b7f
mov edx, 0x1f4
xor ecx, ecx
lea r9d, [rcx + 0x40]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, rax
test rax, rax
jne 0x180063ac0
mov r8, r14
jmp 0x180063b5e
mov rax, rsi
mov rcx, r8
mov edx, 3
nop dword [rax + rax]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x180063ad0
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
mov eax, dword [rax + 0x70]
mov dword [rcx + 0x70], eax
mov rax, qword [0x18019bed0]
mov qword [rdi + rax*8 + 0x19bbb0], rsi
mov qword [rdi + rax*8 + 0x19b240], r8
inc rax
mov qword [0x18019bed0], rax
lea rdx, [rbp - 0x30]
mov rcx, qword [sym.imp.USER32.dll_GetAsyncKeyState]
call r8
movzx r8d, ax
mov rcx, qword [rbp - 0x28]
xor rcx, qword [rbp - 0x20]
mov rax, qword [rbp - 0x18]
mov qword [rax], rcx
test r8w, r8w
jne 0x180063f24
mov dword [rbp - 0x30], 0x78
lea rcx, [rbp - 0x28]
call fcn.1800624d0
mov rdx, r15
lea rcx, [rbp - 0x28]
call fcn.1800419f0
nop
mov ecx, r14d
mov rax, qword [0x18019bbb0]
test rax, rax
je 0x180063c09
mov rdx, r14
nop dword [rax]
cmp rax, rsi
je 0x180063bf8
inc ecx
mov edx, ecx
mov rax, qword [rdi + rcx*8 + 0x19bbb0]
test rax, rax
jne 0x180063be0
jmp 0x180063c09
mov r8, qword [rdi + rdx*8 + 0x19b240]
test r8, r8
jne 0x180063cef
mov edx, 0x1f4
xor ecx, ecx
lea r9d, [rcx + 0x40]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, rax
test rax, rax
jne 0x180063c30
mov r8, r14
jmp 0x180063cce
mov rax, rsi
mov rcx, r8
mov edx, 3
nop dword [rax + rax]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x180063c40
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
mov eax, dword [rax + 0x70]
mov dword [rcx + 0x70], eax
mov rax, qword [0x18019bed0]
mov qword [rdi + rax*8 + 0x19bbb0], rsi
mov qword [rdi + rax*8 + 0x19b240], r8
inc rax
mov qword [0x18019bed0], rax
lea rdx, [rbp - 0x30]
mov rcx, qword [sym.imp.USER32.dll_GetAsyncKeyState]
call r8
movzx edx, ax
mov rcx, qword [rbp - 0x20]
xor rcx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x18]
mov qword [rax], rcx
test dx, dx
je 0x180063f14
mov byte [reloc.WS2_32.dll_accept], 0
mov dword [0x1801090b8], 0x146ba340
mov dword [0x18014b368], 0x146b8478
mov dword [0x18011b244], 0xda97070
mov dword [0x18010e924], 0x14f3b8f0
mov dword [0x1801090b4], 0x6d578
mov dword [0x1801514e0], 0x112723d0
mov dword [0x1801362e8], 0x145a0b80
mov dword [0x18013fc18], 0xc9d45b0
mov dword [0x18011d764], 0x13de0
mov dword [0x18014b364], 0x13daa
mov dword [0x1801090b0], 0x12b60
mov dword [0x18011d768], 0x350
mov dword [0x180142528], 0x134d1
mov dword [0x18011b248], 0x71c
mov dword [0x18010e928], 0x53cf8
jmp 0x180063f2b
lea rdx, [rbp + 0x88]
call fcn.1800419f0
nop
mov ecx, r14d
mov rax, qword [0x18019bbb0]
test rax, rax
je 0x180063e09
mov rdx, r14
nop dword [rax]
cmp rax, rsi
je 0x180063df8
inc ecx
mov edx, ecx
mov rax, qword [rdi + rcx*8 + 0x19bbb0]
test rax, rax
jne 0x180063de0
jmp 0x180063e09
mov r8, qword [rdi + rdx*8 + 0x19b240]
test r8, r8
jne 0x180063eef
mov edx, 0x1f4
xor ecx, ecx
lea r9d, [rcx + 0x40]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, rax
test rax, rax
jne 0x180063e30
mov r8, r14
jmp 0x180063ece
mov rcx, rsi
mov edx, 3
nop dword [rax + rax]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rax - 0x10], xmm1
lea rcx, [rcx + 0x80]
sub rdx, 1
jne 0x180063e40
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
mov ecx, dword [rcx + 0x70]
mov dword [rax + 0x70], ecx
mov rax, qword [0x18019bed0]
mov qword [rdi + rax*8 + 0x19bbb0], rsi
mov qword [rdi + rax*8 + 0x19b240], r8
inc rax
mov qword [0x18019bed0], rax
lea rdx, [rbp - 0x30]
mov rcx, qword [sym.imp.USER32.dll_GetAsyncKeyState]
call r8
movzx edx, ax
mov rcx, qword [rbp - 0x20]
xor rcx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x18]
mov qword [rax], rcx
test dx, dx
jne 0x180063f2b
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x180063a30
mov byte [reloc.WS2_32.dll_accept], 1
lea rdx, [0x1800e4e32]
lea rcx, [0x18015e970]
call fcn.180047020
mov dword [rsp + 0x40], 0x5c151f0c
mov dword [rsp + 0x44], 0x100c16
mov byte [rsp + 0x48], 1
lea rcx, [rsp + 0x40]
call fcn.18004ff20
mov rcx, rax
call fcn.180045160
mov qword [0x18015fc68], rax
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.1800519d0
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8, [0x180057d60]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8, [0x180058840]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov byte [0x18015fa7a], 1
lea rcx, [rbp + 0x30]
call fcn.180065b00
nop
lea rcx, [rbp + 0x40]
call fcn.180044b70
nop
lea rcx, [rbp + 0x18]
call fcn.180065b00
mov eax, 1
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.1800d12a0
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret