Function at 0x140061e10
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x338]
sub rsp, 0x420
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
mov rax, qword [0x14032d5c0]
xor rax, rsp
mov qword [rbp + 0x2f0], rax
xor r12d, r12d
lea rcx, [rbp - 0x50]
call fcn.140060e00
nop
mov rdx, rax
lea rcx, [rbp - 0x70]
call fcn.1400605b0
mov rdx, rax
lea rcx, [0x1403377c8]
call fcn.14006ba10
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x140061eb2
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061ead
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062e47
call fcn.14021d440
movdqa xmm0, xmmword [0x1403033b0]
movdqu xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x70], 0
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x140061efe
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061ef9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062e4d
call fcn.14021d440
cmp qword [0x1403376f0], 0xa
jne 0x140062ddf
cmp qword [0x140337710], 0x40
jne 0x140062ddf
mov dword [rsp + 0x68], 0x3b3f3969
mov dword [rsp + 0x6c], 0x203c0b27
mov word [rsp + 0x70], WSAGetLastError
mov byte [rsp + 0x72], 1
mov rcx, r12
nop dword [rax]
lea eax, [rcx + 0x4f]
xor byte [rsp + rcx + 0x68], al
inc rcx
cmp rcx, 9
jb 0x140061f40
mov byte [rsp + 0x72], 0
lea rdx, [0x1403376e0]
lea rcx, [rbp - 0x50]
call fcn.1400609e0
mov r15, rax
mov dword [rsp + 0x58], 0x3c263f69
mov dword [rsp + 0x5c], 0x323c2636
mov word [rsp + 0x60], WSAGetLastError
mov byte [rsp + 0x62], 1
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx + 0x4f]
xor byte [rsp + rcx + 0x58], al
inc rcx
cmp rcx, 9
jb 0x140061f90
mov byte [rsp + 0x62], 0
lea rdx, [0x1403376c0]
lea rcx, [rbp + 0x1c0]
call fcn.1400609e0
mov rsi, rax
mov dword [rsp + 0x40], 0x3f303e69
mov dword [rsp + 0x44], 0x1006936
mov rcx, r12
nop
lea eax, [rcx + 0x4f]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 6
jb 0x140061fd0
mov byte [rsp + 0x47], 0
lea rax, [rbp + 0x240]
mov qword [rsp + 0x38], rax
lea rdx, [0x140337680]
lea rcx, [rbp + 0x240]
call fcn.14006bbf0
mov rdi, rax
lea rax, [rbp + 0x260]
mov qword [rsp + 0x30], rax
lea rdx, [0x140337700]
lea rcx, [rbp + 0x260]
call fcn.14006bbf0
mov rbx, rax
lea rdx, [0x1403377c8]
lea rcx, [rbp + 0x200]
call fcn.14006bbf0
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x1a0]
call fcn.140060f80
mov r14, rax
mov dword [rsp + 0x48], 0x313f3569
mov dword [rsp + 0x4c], 0x6b2c3138
mov word [rsp + 0x50], 0x100
mov rcx, r12
nop
lea eax, [rcx + 0x4f]
xor byte [rsp + rcx + 0x48], al
inc rcx
cmp rcx, 8
jb 0x140062070
mov byte [rsp + 0x51], 0
lea rax, [rbp - 0x30]
mov qword [rbp - 0x78], rax
lea rdx, [0x140337680]
lea rcx, [rbp - 0x30]
call fcn.14006bbf0
mov rdi, rax
lea rax, [rbp + 0x1e0]
mov qword [rsp + 0x38], rax
lea rdx, [0x140337700]
lea rcx, [rbp + 0x1e0]
call fcn.14006bbf0
mov rbx, rax
lea rdx, [0x140337720]
lea rcx, [rbp + 0x2b0]
call fcn.14006bbf0
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x180]
call fcn.140060f80
mov rdi, rax
mov dword [rsp + 0x38], 0x20342669
mov word [rsp + 0x3c], WSAStartup
mov byte [rsp + 0x3e], 1
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx + 0x4f]
xor byte [rsp + rcx + 0x38], al
inc rcx
cmp rcx, 5
jb 0x140062110
mov byte [rsp + 0x3e], 0
mov dword [rsp + 0x30], 0x26383e26
mov word [rsp + 0x34], 0x100
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx + 0x4f]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 4
jb 0x140062140
mov byte [rsp + 0x35], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x70], xmm1
lea rax, [rsp + 0x30]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x140062173
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x60]
call fcn.14006f780
nop
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x160]
call fcn.1400609e0
mov r10, rax
mov dword [rsp + 0x30], 0x3721293b
mov word [rsp + 0x34], WSAStartup
mov byte [rsp + 0x36], 1
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx + 0x4f]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 5
jb 0x1400621c0
mov byte [rsp + 0x36], 0
lea rax, [rsp + 0x30]
mov r9, rbx
nop dword [rax]
inc r9
cmp byte [rax + r9], 0
jne 0x1400621e0
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, r10
call fcn.140071c10
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x50], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x50], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rax, [rsp + 0x38]
mov r8, rbx
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140062230
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x40]
call fcn.14006b920
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x140], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x150], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, rdi
lea r8, [rbp + 0x140]
lea rcx, [rbp - 0x70]
call fcn.140071d10
nop
lea rax, [rsp + 0x48]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140062290
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x70]
call fcn.14006b920
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x120], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x130], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, r14
lea r8, [rbp + 0x120]
lea rcx, [rbp + 0xc0]
call fcn.140071d10
nop
lea rax, [rsp + 0x40]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400622f0
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0xc0]
call fcn.14006b920
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x100], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x110], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, rsi
lea r8, [rbp + 0x100]
lea rcx, [rbp + 0xa0]
call fcn.140071d10
nop
lea rax, [rsp + 0x58]
mov r8, rbx
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140062350
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0xa0]
call fcn.14006b920
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xe0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xf0], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, r15
lea r8, [rbp + 0xe0]
lea rcx, [rbp + 0x80]
call fcn.140071d10
nop
lea rax, [rsp + 0x68]
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400623b0
mov r8, rbx
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x80]
call fcn.14006b920
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x30], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x30], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rdx, [0x140337680]
cmp qword [0x140337698], 0xf
cmova rdx, qword [0x140337680]
mov r8, qword [0x140337690]
lea rcx, [rbp + 0x20]
call fcn.14006b920
movups xmm7, xmmword [rax]
movups xmmword [rbp + 0x2d0], xmm7
movups xmm6, xmmword [rax + 0x10]
movups xmmword [rbp + 0x2e0], xmm6
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x140062480
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006247b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062e53
call fcn.14021d440
movdqa xmm0, xmmword [0x1403033b0]
movdqu xmmword [rbp + 0x30], xmm0
mov byte [rbp + 0x20], 0
mov rdx, qword [rbp + 0x98]
cmp rdx, 0xf
jbe 0x1400624d2
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400624cd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062e59
call fcn.14021d440
movdqa xmm0, xmmword [0x1403033b0]
movdqu xmmword [rbp + 0x90], xmm0
mov byte [rbp + 0x80], 0
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0xf
jbe 0x14006252b
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062525
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062e5f
call fcn.14021d440
nop
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0xf
jbe 0x14006256c
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062567
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062e65
call fcn.14021d440
movdqa xmm0, xmmword [0x1403033b0]
movdqu xmmword [rbp + 0xb0], xmm0
mov byte [rbp + 0xa0], 0
mov rdx, qword [rbp + 0x118]
cmp rdx, 0xf
jbe 0x1400625c5
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400625bf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062e6b
call fcn.14021d440
nop
mov rdx, qword [rbp + 0xd8]
cmp rdx, 0xf
jbe 0x140062606
inc rdx
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062601
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062e71
call fcn.14021d440
movdqa xmm0, xmmword [0x1403033b0]
movdqu xmmword [rbp + 0xd0], xmm0
mov byte [rbp + 0xc0], 0
mov rdx, qword [rbp + 0x138]
cmp rdx, 0xf
jbe 0x14006265f
inc rdx
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062659
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062e77
call fcn.14021d440
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x14006269a
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062695
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062e7d
call fcn.14021d440
movdqa xmm0, xmmword [0x1403033b0]
movdqu xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x70], 0
mov rdx, qword [rbp + 0x158]
cmp rdx, 0xf
jbe 0x1400626ed
inc rdx
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400626e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062e83
call fcn.14021d440
nop
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x140062728
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062723
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062e89
call fcn.14021d440
movdqa xmm0, xmmword [0x1403033b0]
movdqu xmmword [rbp + 0x50], xmm0
mov byte [rbp + 0x40], 0
mov rdx, qword [rbp + 0x178]
cmp rdx, 0xf
jbe 0x14006277a
inc rdx
mov rcx, qword [rbp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062775
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062e8f
call fcn.14021d440
movdqa xmm0, xmmword [0x1403033b0]
movdqu xmmword [rbp + 0x170], xmm0
mov byte [rbp + 0x160], 0
mov rdx, qword [rbp + 0x78]
cmp rdx, 0xf
jbe 0x1400627cc
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400627c7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062e95
call fcn.14021d440
movdqa xmm0, xmmword [0x1403033b0]
movdqu xmmword [rbp + 0x70], xmm0
mov byte [rbp + 0x60], 0
mov rdx, qword [rbp + 0x198]
cmp rdx, 0xf
jbe 0x14006281e
inc rdx
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062819
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062e9b
call fcn.14021d440
movdqa xmm0, xmmword [0x1403033b0]
movdqu xmmword [rbp + 0x190], xmm0
mov byte [rbp + 0x180], 0
mov rdx, qword [rbp + 0x1b8]
cmp rdx, 0xf
jbe 0x140062876
inc rdx
mov rcx, qword [rbp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062871
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062ea1
call fcn.14021d440
movdqa xmm0, xmmword [0x1403033b0]
movdqu xmmword [rbp + 0x1b0], xmm0
mov byte [rbp + 0x1a0], 0
mov rdx, qword [rbp + 0x1d8]
cmp rdx, 0xf
jbe 0x1400628ce
inc rdx
mov rcx, qword [rbp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400628c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062ea7
call fcn.14021d440
movdqa xmm0, xmmword [0x1403033b0]
movdqu xmmword [rbp + 0x1d0], xmm0
mov byte [rbp + 0x1c0], 0
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x140062920
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006291b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062ead
call fcn.14021d440
movdqa xmm0, xmmword [0x1403033b0]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x80], r12
lea r14, [rbp + 0x2d0]
movq rsi, xmm7
movdqa xmm0, xmm6
psrldq xmm0, 8
movq r15, xmm0
cmp r15, 0xf
cmova r14, rsi
movabs rbx, 0x7fffffffffffffff
movq rdi, xmm6
cmp rdi, rbx
ja 0x140062eb3
mov qword [rbp - 0x80], reloc.WS2_32.dll_ntohs
cmp rdi, 0xf
ja 0x14006299d
mov qword [rsp + 0x78], rdi
movups xmm0, xmmword [r14]
movups xmmword [rsp + 0x68], xmm0
jmp 0x140062a30
mov rax, rdi
or rax, 0xf
cmp rax, rbx
jbe 0x1400629d9
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14021d53c
mov rcx, rax
test rax, rax
je 0x140062eb9
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140062a13
mov rbx, rax
mov ecx, reloc.WS2_32.dll_shutdown
cmp rax, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140062a04
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140062d81
jmp 0x1400629b7
test rcx, rcx
je 0x140062a10
call fcn.14021d53c
jmp 0x140062a13
mov rax, r12
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x80], rbx
lea r8, [rdi + 1]
mov rdx, r14
mov rcx, rax
call fcn.14025d4f0
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x290]
call fcn.140069110
nop
lea rax, [rbp + 0x2b0]
mov qword [rbp - 0x78], rax
lea rdx, [0x140337680]
lea rcx, [rbp + 0x2b0]
call fcn.14006bbf0
mov rdi, rax
lea rax, [rbp + 0x1e0]
mov qword [rsp + 0x40], rax
lea rdx, [0x140337700]
lea rcx, [rbp + 0x1e0]
call fcn.14006bbf0
mov rbx, rax
lea rdx, [rbp + 0x290]
lea rcx, [rbp - 0x30]
call fcn.14006bbf0
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp - 0x50]
call fcn.140061290
mov rbx, rax
lea rax, [rbp + 0x290]
cmp rax, rbx
je 0x140062b33
mov rdx, qword [rbp + 0x2a8]
cmp rdx, 0xf
jbe 0x140062af8
inc rdx
mov rcx, qword [rbp + 0x290]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062af3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062ebf
call fcn.14021d440
movdqa xmm0, xmmword [0x1403033b0]
movdqu xmmword [rbp + 0x2a0], xmm0
mov byte [rbp + 0x290], 0
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x290], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x2a0], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x140062b6e
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062b69
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062ebf
call fcn.14021d440
mov qword [rbp + 0x238], r12
lea r8, [rbp + 0x200]
lea rdx, [rbp + 0x290]
lea rcx, [rbp + 0x280]
call fcn.14006e700
nop
lea rdx, str.success
lea rcx, [rbp + 0x280]
call fcn.14006e820
cmp byte [rax], 4
jne 0x140062ec5
lea rcx, [rbp + 0x280]
cmp byte [rax + 8], 0
je 0x140062cb6
lea rdx, str.sessionid
call fcn.14006e820
mov rdx, rax
lea rcx, [0x1403377a8]
call fcn.14006e960
nop
movzx edx, byte [rbp + 0x280]
lea rcx, [rbp + 0x288]
call fcn.14006cf10
nop
mov rdx, qword [rbp + 0x2a8]
cmp rdx, 0xf
jbe 0x140062c2e
inc rdx
mov rcx, qword [rbp + 0x290]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062c29
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062f16
call fcn.14021d440
movdqa xmm0, xmmword [0x1403033b0]
movdqu xmmword [rbp + 0x2a0], xmm0
mov byte [rbp + 0x290], 0
cmp r15, 0xf
jbe 0x140062c7c
lea rdx, [r15 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140062c74
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062f1c
mov rcx, rsi
call fcn.14021d440
mov rcx, qword [rbp + 0x2f0]
xor rcx, rsp
call fcn.14021d420
lea r11, [rsp + 0x420]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
lea rdx, str.message
call fcn.14006e820
mov rdi, rax
mov byte [rsp + 0x68], 3
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.14021d53c
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], r12
mov r8d, 0xa
lea rdx, str.invalidver
mov rcx, rax
call fcn.14006f780
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov rcx, rdi
call fcn.140071790
movzx ebx, al
movzx edx, byte [rsp + 0x68]
lea rcx, [rsp + 0x70]
call fcn.14006cf10
nop
test bl, bl
jne 0x140062d87
lea rdx, [0x140301394]
lea rcx, [0x140335bb0]
call fcn.14006e450
lea rdx, str.message
lea rcx, [rbp + 0x280]
call fcn.14006e820
mov rdx, rax
lea rcx, [rbp + 0x2b0]
call fcn.14006eb10
nop
mov rdx, rax
call fcn.14006ebb0
nop
lea rcx, [rbp + 0x2b0]
call fcn.14006b9b0
mov ecx, 0x1194
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call fcn.14022cfe4
nop
call fcn.14005b640
nop
lea rdx, str.download
lea rcx, [rbp + 0x280]
call fcn.14006e820
lea rdx, [rbp + 0x2b0]
mov rcx, rax
call fcn.14006ea30
lea rcx, [rbp + 0x2b0]
call fcn.14006b910
mov r8, rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor ecx, ecx
call fcn.14022cfe4
nop
movdqa xmm0, xmmword [0x140303440]
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmm1, xmmword [0x140303460]
movdqa xmmword [rbp - 0x20], xmm1
movdqa xmm0, xmmword [0x140303450]
movdqa xmmword [rbp - 0x10], xmm0
movdqa xmm1, xmmword [0x140303500]
movdqa xmmword [rbp], xmm1
mov dword [rbp + 0x10], 0xfbf0ddaf
mov dword [rbp + 0x14], 0xe6f6bafd
mov word [rbp + 0x18], 0xe7
mov byte [rbp + 0x1a], 1
lea rdx, [rbp - 0x30]
call fcn.140062f30
mov ecx, 0x1194
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call fcn.14022cfe4
nop
call fcn.1402322a0
nop
call fcn.1402322a0
nop
call fcn.1402322a0
nop
call fcn.1402322a0
nop
call fcn.1402322a0
nop
call fcn.1402322a0
nop
call fcn.1402322a0
nop
call fcn.1402322a0
nop
call fcn.1402322a0
nop
call fcn.1402322a0
nop
call fcn.1402322a0
nop
call fcn.1402322a0
nop
call fcn.1402322a0
nop
call fcn.1402322a0
nop
call fcn.1402322a0
nop
call fcn.1402322a0
nop
call fcn.1402322a0
nop
call fcn.1402322a0
int3
call fcn.14005b6e0
int3
call fcn.1402322a0
nop
call fcn.1402322a0
nop
mov rcx, rax
call fcn.14006d410
mov rdx, rax
lea rcx, [rbp + 0x2b0]
call fcn.14006bbb0
nop
mov r8, rax
lea rdx, str.type_must_be_boolean__but_is
lea rcx, [rbp + 0x1e0]
call fcn.14006e030
nop
mov r8, rax
mov edx, 0x12e
lea rcx, [rbp - 0x30]
call fcn.14005f680
lea rdx, [0x140325fb0]
lea rcx, [rbp - 0x30]
call fcn.14021f5ec
nop
call fcn.1402322a0
nop
call fcn.1402322a0
int3