Function at 0x1400b1400
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Create process on windows
Create thread
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xab8]
sub rsp, 0xb90
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x140379f00]
xor rax, rsp
mov qword [rbp + 0xa70], rax
mov r15, rcx
mov qword [rbp + 0xd0], rcx
xor r12d, r12d
mov dword [rsp + 0x40], r12d
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
xor r9d, r9d
lea r8, [0x1400b8130]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [rbp + 0x880]
call fcn.1400b0350
nop
lea rdx, [rbp + 0x880]
cmp qword [rbp + 0x898], 0xf
cmova rdx, qword [rbp + 0x880]
mov r8, qword [rbp + 0x890]
lea rcx, [section..data]
call fcn.14000b350
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
xor r9d, r9d
lea r8, [0x1400b66d0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp qword [r15 + 0x30], 0xa
je 0x1400b1686
movdqa xmm0, xmmword [0x14014b730]
movdqa xmmword [rbp + 0x80], xmm0
movdqa xmm1, xmmword [0x14014b650]
movdqa xmmword [rbp + 0x90], xmm1
movdqa xmm0, xmmword [0x14014b5a0]
movdqa xmmword [rbp + 0xa0], xmm0
movdqa xmm1, xmmword [0x14014b810]
movdqa xmmword [rbp + 0xb0], xmm1
mov dword [rbp + 0xc0], 0xf2bee1e7
mov dword [rbp + 0xc4], 0x100e3e2
mov ecx, r12d
lea eax, [rcx + 0x4e]
xor byte [rbp + rcx + 0x80], al
lea eax, [rcx + 0x4f]
xor byte [rbp + rcx + 0x81], al
lea eax, [rcx + 0x50]
xor byte [rbp + rcx + 0x82], al
lea eax, [rcx + 0x51]
xor byte [rbp + rcx + 0x83], al
lea eax, [rcx + 0x52]
xor byte [rbp + rcx + 0x84], al
lea eax, [rcx + 0x53]
xor byte [rbp + rcx + 0x85], al
lea eax, [rcx + 0x54]
xor byte [rbp + rcx + 0x86], al
lea eax, [rcx + 0x55]
xor byte [rbp + rcx + 0x87], al
lea eax, [rcx + 0x56]
xor byte [rbp + rcx + 0x88], al
lea eax, [rcx + 0x57]
xor byte [rbp + rcx + 0x89], al
lea eax, [rcx + 0x58]
xor byte [rbp + rcx + 0x8a], al
lea eax, [rcx + 0x59]
xor byte [rbp + rcx + 0x8b], al
lea eax, [rcx + 0x5a]
xor byte [rbp + rcx + 0x8c], al
lea eax, [rcx + 0x5b]
xor byte [rbp + rcx + 0x8d], al
add rcx, 0xe
cmp rcx, 0x46
jb 0x1400b1522
mov byte [rbp + 0xc7], 0
mov r9d, reloc.WS2_32.dll_recv
xor r8d, r8d
lea rdx, [rbp + 0x80]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400b1666
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400b1666
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0xb7d2d2e3
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400b1661
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400b1640
cmp r8d, 0xda5b5c13
je 0x1400b166b
test r9d, r9d
jne 0x1400b1620
mov rax, qword [rax]
jmp 0x1400b15f0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
xor ecx, ecx
call rdx
lea rcx, [rbp + 0x830]
call fcn.1400aa3c0
nop
call fcn.1400bbb10
mov qword [rbp + 0xd8], rax
mov dword [rbp + 0x40], 0x3f272068
mov dword [rbp + 0x44], 0x313d2137
mov word [rbp + 0x48], WSASetLastError
mov byte [rbp + 0x4a], 1
mov rdx, r15
cmp qword [r15 + 0x18], 0xf
jbe 0x1400b16c4
mov rdx, qword [r15]
xor r8d, r8d
mov rcx, rax
call fcn.1400ba510
mov rbx, rax
mov dword [rbp - 0x60], 0x3c312168
mov dword [rbp - 0x5c], 0x1006e37
mov dword [rbp - 0x68], 0x22312768
mov dword [rbp - 0x64], 0x1006e3a
mov dword [rbp - 0x70], 0x23353968
mov word [rbp - 0x6c], reloc.WS2_32.dll_WSAGetLastError
mov byte [rbp - 0x6a], 1
mov dword [rbp + 0x30], 0x3420363a
mov dword [rbp + 0x34], 0x3c3a3a6f
mov word [rbp + 0x38], 0x22
mov byte [rbp + 0x3a], 1
lea r8, [rbp - 0x70]
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x268]
call fcn.14009fe70
nop
lea rdx, [r15 + 0x40]
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x1400b173e
mov rdx, qword [rdx]
mov rcx, rax
call fcn.140005640
xorps xmm0, xmm0
movups xmmword [rbp + 0x110], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x120], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x110], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x120], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rbp - 0x68]
lea rdx, [rbp + 0x110]
lea rcx, [rbp + 0x248]
call fcn.14009fd80
nop
lea rdx, [rbp + 0x830]
cmp qword [rbp + 0x848], 0xf
cmova rdx, qword [rbp + 0x830]
mov r8, qword [rbp + 0x840]
mov rcx, rax
call fcn.140005640
xorps xmm0, xmm0
movups xmmword [rbp + 0x130], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x140], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x130], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x140], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rbp - 0x60]
lea rdx, [rbp + 0x130]
lea rcx, [rbp + 0x2c0]
call fcn.14009fd80
nop
mov r14, 0xffffffffffffffff
mov r8, r14
nop dword [rax + rax]
inc r8
cmp byte [rbx + r8], 0
jne 0x1400b1820
mov rdx, rbx
mov rcx, rax
call fcn.140005640
xorps xmm0, xmm0
movups xmmword [rbp + 0x150], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x160], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x150], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x160], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rbp + 0x40]
lea rdx, [rbp + 0x150]
lea rcx, [rbp + 0x2e0]
call fcn.14009ffc0
nop
lea rdx, [r15 + 0x20]
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x1400b1898
mov rdx, qword [rdx]
mov rcx, rax
call fcn.140005640
xorps xmm0, xmm0
movups xmmword [rbp + 0x7c0], xmm0
mov qword [rbp + 0x7d0], r12
mov qword [rbp + 0x7d8], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x7c0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x7d0], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov edi, 0x3c
mov dword [rsp + 0x40], edi
mov rdx, qword [rbp + 0x2f8]
cmp rdx, 0xf
jbe 0x1400b1929
inc rdx
mov rcx, qword [rbp + 0x2e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b1924
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400b1924
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140142874
movdqa xmm6, xmmword [0x14014b4a0]
movdqu xmmword [rbp + 0x2f0], xmm6
mov byte [rbp + 0x2e0], 0
mov rdx, qword [rbp + 0x168]
cmp rdx, 0xf
jbe 0x1400b1984
inc rdx
mov rcx, qword [rbp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b197f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400b197f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140142874
movdqu xmmword [rbp + 0x160], xmm6
mov byte [rbp + 0x150], 0
mov rdx, qword [rbp + 0x2d8]
cmp rdx, 0xf
jbe 0x1400b19d7
inc rdx
mov rcx, qword [rbp + 0x2c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b19d2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400b19d2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140142874
movdqu xmmword [rbp + 0x2d0], xmm6
mov byte [rbp + 0x2c0], 0
mov rdx, qword [rbp + 0x148]
cmp rdx, 0xf
jbe 0x1400b1a2a
inc rdx
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b1a25
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400b1a25
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140142874
movdqu xmmword [rbp + 0x140], xmm6
mov byte [rbp + 0x130], 0
mov rdx, qword [rbp + 0x260]
cmp rdx, 0xf
jbe 0x1400b1a7d
inc rdx
mov rcx, qword [rbp + 0x248]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b1a78
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400b1a78
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140142874
movdqu xmmword [rbp + 0x258], xmm6
mov byte [rbp + 0x248], 0
mov rdx, qword [rbp + 0x128]
cmp rdx, 0xf
jbe 0x1400b1ad0
inc rdx
mov rcx, qword [rbp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b1acb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400b1acb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140142874
movdqu xmmword [rbp + 0x120], xmm6
mov byte [rbp + 0x110], 0
mov rdx, qword [rbp + 0x280]
cmp rdx, 0xf
jbe 0x1400b1b20
inc rdx
mov rcx, qword [rbp + 0x268]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b1b1b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400b3552
call fcn.140142874
movdqu xmmword [rbp + 0x278], xmm6
mov byte [rbp + 0x268], 0
lea rbx, [r15 + 0x80]
mov rax, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x1400b1b44
mov rbx, qword [rbx]
cmp rax, 5
jb 0x1400b1cca
lea rsi, [rbx + rax]
lea r8, [rsi - 4]
sub r8, rbx
mov edx, 0x68
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x1400b1cca
nop
cmp dword [rax], 0x70747468
jne 0x1400b1b7e
cmp byte [rax + 4], 0x73
je 0x1400b1b9f
inc rax
lea r8, [rsi - 4]
sub r8, rax
mov edx, 0x68
mov rcx, rax
call sub.VCRUNTIME140.dll_memchr
test rax, rax
jne 0x1400b1b70
jmp 0x1400b1cca
sub rax, rbx
cmp rax, 0xffffffffffffffff
je 0x1400b1cca
movdqa xmm0, xmmword [0x14014b640]
movdqa xmmword [rbp + 0x360], xmm0
movdqa xmm1, xmmword [0x14014b5e0]
movdqa xmmword [rbp + 0x370], xmm1
movdqa xmm0, xmmword [0x14014b560]
movdqa xmmword [rbp + 0x380], xmm0
movdqa xmm1, xmmword [0x14014b4d0]
movdqa xmmword [rbp + 0x390], xmm1
mov byte [rbp + 0x3a0], 1
lea rcx, [rbp + 0x360]
call fcn.1400ad5d0
mov r9d, reloc.WS2_32.dll_recv
xor r8d, r8d
lea rdx, [rbp + 0x360]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400b1ca6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400b1ca6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x820edb6f
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400b1ca1
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400b1c80
cmp r8d, 0x123723ef
je 0x1400b1cab
test r9d, r9d
jne 0x1400b1c60
mov rax, qword [rax]
jmp 0x1400b1c30
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
xor ecx, ecx
call rdx
mov edi, dword [rsp + 0x40]
lea rcx, [r15 + 0x80]
mov r8, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 0xf
jbe 0x1400b1cdf
mov rcx, qword [rcx]
test r8, r8
jne 0x1400b1d02
lea rdx, [0x140168718]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400b1d02
cmp qword [r15 + 0x90], 0
je 0x1400b2567
lea rdx, [r15 + 0x80]
xor r8d, r8d
lea rcx, [rbp + 0x590]
call fcn.140032010
nop
lea rcx, [rbp + 0x590]
call fcn.1400200d0
movzx ebx, al
lea rcx, [rbp + 0x590]
call fcn.140031cd0
test bl, bl
jne 0x1400b1e54
movdqa xmm0, xmmword [0x14014b770]
movdqu xmmword [rbp + 0x288], xmm0
movdqa xmm1, xmmword [0x14014b510]
movdqu xmmword [rbp + 0x298], xmm1
movdqa xmm0, xmmword [0x14014b580]
movdqu xmmword [rbp + 0x2a8], xmm0
mov word [rbp + 0x2b8], 0x50
mov byte [rbp + 0x2ba], 1
lea rcx, [rbp + 0x288]
call fcn.1400ad310
mov r9d, reloc.WS2_32.dll_recv
xor r8d, r8d
lea rdx, [rbp + 0x288]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400b1e34
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400b1e34
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r11 + r9*4]
mov r8d, dword [rdx + r10]
add r8, r10
mov edx, 0x266ae06a
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x1400b1e2f
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x1400b1e10
cmp edx, 0x5aaf1be2
je 0x1400b1e39
test r9d, r9d
jne 0x1400b1df0
mov rax, qword [rax]
jmp 0x1400b1dc0
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
xor ecx, ecx
call rax
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp + 0x8c0]
call sub.VCRUNTIME140.dll_memset
lea rbx, [r15 + 0x80]
cmp qword [rbx + 0x18], 0xf
jbe 0x1400b1e79
mov rbx, qword [rbx]
lea rax, [0x140169e10]
mov qword [rbp + 0x8c0], rax
lea rcx, [rbp + 0x970]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rsp + 0x40], 0x13c
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x8d0]
lea rcx, [rbp + 0x8c0]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rbp + 0x8c0]
movsxd rcx, dword [rax + 4]
lea rdi, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x8c0], rdi
mov rax, qword [rbp + 0x8c0]
movsxd rcx, dword [rax + 4]
lea r8d, [rcx - 0xb0]
mov dword [rbp + rcx + 0x8bc], r8d
lea rcx, [rbp + 0x8d0]
call fcn.140031ed0
nop
mov r9d, 0x40
mov r8d, 1
mov rdx, rbx
lea rcx, [rbp + 0x8d0]
call fcn.140031d90
test rax, rax
jne 0x1400b1f3d
mov rax, qword [rbp + 0x8c0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x8c0]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
mov rax, qword [rbp + 0x8c0]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x8c0], rdi
mov rax, qword [rbp + 0x8c0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x8bc], edx
xorps xmm0, xmm0
movups xmmword [rbp + 0x7e0], xmm0
mov qword [rbp + 0x7f0], r12
mov qword [rbp + 0x7f8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x7e0], 0
movups xmmword [rbp + 0x860], xmm0
movdqu xmmword [rbp + 0x870], xmm6
mov byte [rbp + 0x860], 0
mov rax, qword [rbp + 0x8c0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x8c0]
add rcx, rax
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
movzx r8d, al
lea rdx, [rbp + 0x7e0]
lea rcx, [rbp + 0x8c0]
call fcn.1400a2c80
movdqa xmm0, xmmword [0x14014b760]
movdqu xmmword [rbp + 0x320], xmm0
movdqa xmm1, xmmword [0x14014b670]
movdqu xmmword [rbp + 0x330], xmm1
movdqa xmm0, xmmword [0x14014b6b0]
movdqu xmmword [rbp + 0x340], xmm0
mov word [rbp + 0x350], 0x100
lea r8, [r15 + 0x80]
mov rcx, qword [r8 + 0x10]
movabs r13, 0x7fffffffffffffff
mov rax, r13
sub rax, rcx
cmp rax, 0x14
jb 0x1400b3702
mov rax, r8
cmp qword [r8 + 0x18], 0xf
jbe 0x1400b2040
mov rax, qword [r8]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], reloc.WS2_32.dll_sendto
lea r9, str.certutil__hashfile__
movzx edx, byte [rbp + 0x7a8]
lea rcx, [rbp + 0x5b0]
call fcn.14003d800
nop
lea r8, [rbp + 0x320]
lea rdx, [rbp + 0x5b0]
lea rcx, [rbp + 0x708]
call fcn.1400a00c0
nop
cmp qword [rax + 0x18], 0xf
jbe 0x1400b2093
mov rax, qword [rax]
xorps xmm0, xmm0
movups xmmword [rbp + 0x210], xmm0
movdqu xmmword [rbp + 0x220], xmm6
mov byte [rbp + 0x210], 0
mov dword [rsp + 0x40], 0x73c
movups xmmword [rbp + 0x820], xmm0
lea rdx, [0x14014ae20]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__popen]
mov rcx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__pclose]
mov qword [rbp + 0x820], rcx
mov qword [rbp + 0x828], rax
test rax, rax
je 0x1400b36aa
mov r8, rax
mov edx, 0x80
lea rcx, [rbp + 0x9f0]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgets]
test rax, rax
je 0x1400b214b
lea rax, [rbp + 0x9f0]
mov r8, r14
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400b2110
lea rdx, [rbp + 0x9f0]
lea rcx, [rbp + 0x210]
call fcn.14000b350
mov r8, qword [rbp + 0x828]
mov edx, 0x80
lea rcx, [rbp + 0x9f0]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgets]
test rax, rax
jne 0x1400b2103
mov rcx, qword [rbp + 0x828]
test rcx, rcx
je 0x1400b215e
call qword [rbp + 0x820]
nop
lea rdx, [rbp + 0x210]
lea rcx, [rbp + 0x860]
call fcn.140031950
nop
lea rcx, [rbp + 0x210]
call fcn.1400053c0
nop
lea rcx, [rbp + 0x708]
call fcn.1400053c0
nop
lea rcx, [rbp + 0x5b0]
call fcn.1400053c0
mov dword [rsp + 0x7c], 0x3d6e65
mov dword [rsp + 0x78], 0x6b6f7426
mov byte [rbp - 0x80], 0
lea rax, [rsp + 0x78]
mov rbx, r14
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400b21b4
mov r15, qword [rbp + 0x7f0]
mov rax, r13
sub rax, r15
cmp rax, rbx
jb 0x1400b3702
lea r12, [rbp + 0x7e0]
cmp qword [rbp + 0x7f8], 0xf
cmova r12, qword [rbp + 0x7e0]
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xf0], xmm1
lea r14, [r15 + rbx]
mov edi, reloc.WS2_32.dll_ntohs
lea rsi, [rbp + 0xe0]
cmp r14, rdi
jbe 0x1400b2290
mov rdi, r14
or rdi, 0xf
cmp rdi, r13
jbe 0x1400b2250
mov rdi, r13
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1401425f0
test rax, rax
je 0x1400b2489
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x1400b2289
mov eax, socket
cmp rdi, rax
cmovb rdi, rax
lea rcx, [rdi + 1]
test rcx, rcx
jne 0x1400b2269
xor esi, esi
jmp 0x1400b2289
cmp rcx, 0x1000
jb 0x1400b2281
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400b36fc
jmp 0x1400b2231
call fcn.1401425f0
mov rsi, rax
mov qword [rbp + 0xe0], rsi
mov qword [rbp + 0xf0], r14
mov qword [rbp + 0xf8], rdi
mov r8, rbx
lea rdx, [rsp + 0x78]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rsi + rbx]
mov r8, r15
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + r14], 0
mov rdi, qword [rbp + 0xf0]
lea r9, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 0xf
cmova r9, qword [rbp + 0xe0]
mov rcx, qword [rbp + 0x7d0]
mov rdx, qword [rbp + 0x7d8]
mov rax, rdx
sub rax, rcx
cmp rdi, rax
ja 0x1400b232e
lea rax, [rcx + rdi]
mov qword [rbp + 0x7d0], rax
lea rbx, [rbp + 0x7c0]
cmp rdx, 0xf
cmova rbx, qword [rbp + 0x7c0]
add rbx, rcx
mov r8, rdi
mov rdx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rdi], 0
jmp 0x1400b2346
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rdx, rdi
lea rcx, [rbp + 0x7c0]
call fcn.1400066d0
nop
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0xf
jbe 0x1400b2387
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b2382
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400b2489
call fcn.140142874
movdqu xmmword [rbp + 0xf0], xmm6
mov byte [rbp + 0xe0], 0
mov dword [rsp + 0x5c], 0x3d6873
mov dword [rsp + 0x58], 0x61687426
mov byte [rsp + 0x60], 0
mov r15, qword [rbp + 0xd0]
lea r8, [r15 + 0x80]
lea rcx, [rsp + 0x58]
mov r14, 0xffffffffffffffff
mov rax, r14
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x1400b23d0
mov rdx, qword [r8 + 0x10]
sub r13, rdx
cmp r13, rax
jb 0x1400b3702
mov rcx, r8
cmp qword [r8 + 0x18], 0xf
jbe 0x1400b23f6
mov rcx, qword [r8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
movzx edx, byte [rbp + 0x7a8]
lea rcx, [rbp + 0x170]
call fcn.14003d800
mov edi, 0x3fc
mov dword [rsp + 0x40], edi
lea rdx, [rbp + 0x170]
cmp qword [rbp + 0x188], 0xf
cmova rdx, qword [rbp + 0x170]
mov r8, qword [rbp + 0x180]
lea rcx, [rbp + 0x7c0]
call fcn.140005640
nop
mov rdx, qword [rbp + 0x188]
cmp rdx, 0xf
jbe 0x1400b2495
inc rdx
mov rcx, qword [rbp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b2490
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400b2490
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140142874
movdqu xmmword [rbp + 0x180], xmm6
mov byte [rbp + 0x170], 0
mov r8, qword [rbp + 0x878]
cmp r8, 0xf
jbe 0x1400b24c4
mov rdx, qword [rbp + 0x860]
lea rcx, [rbp + 0x860]
call fcn.140005e00
movdqu xmmword [rbp + 0x870], xmm6
mov byte [rbp + 0x860], 0
mov r8, qword [rbp + 0x7f8]
cmp r8, 0xf
jbe 0x1400b24f3
mov rdx, qword [rbp + 0x7e0]
lea rcx, [rbp + 0x7e0]
call fcn.140005e00
xor r12d, r12d
mov qword [rbp + 0x7f0], r12
mov qword [rbp + 0x7f8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x7e0], r12b
mov rax, qword [rbp + 0x8c0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x8c0], rax
mov rax, qword [rbp + 0x8c0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x8bc], edx
lea rcx, [rbp + 0x8d0]
call fcn.140031300
lea rcx, [rbp + 0x8d8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x970]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
mov rcx, qword [rbp + 0xd8]
call fcn.1400bbae0
lea rax, [rbp + 0x728]
mov qword [rbp + 0xd8], rax
lea rdx, [r15 + 0x60]
lea rcx, [rbp + 0x728]
call fcn.14000b140
mov rbx, rax
lea rdx, [rbp + 0x7c0]
lea rcx, [rbp + 0x748]
call fcn.14000b140
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x800]
call fcn.1400b7a30
nop
mov dword [rbp - 0x4c], 0x64696c
mov dword [rbp - 0x58], 0x4179654b
mov dword [rbp - 0x54], 0x5f687475
mov dword [rbp - 0x50], 0x61766e49
mov byte [rbp - 0x48], 0
lea rcx, [rbp - 0x58]
mov rax, r14
inc rax
cmp byte [rcx + rax], 0
jne 0x1400b25e2
lea rcx, [rbp + 0x800]
mov rbx, qword [rbp + 0x800]
mov rsi, qword [rbp + 0x818]
cmp rsi, 0xf
cmova rcx, rbx
mov r8, qword [rbp + 0x810]
cmp r8, rax
jne 0x1400b2776
lea rdx, [rbp - 0x58]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400b2776
movdqa xmm0, xmmword [0x14014b740]
movdqa xmmword [rbp + 0x1a0], xmm0
movdqa xmm1, xmmword [0x14014b4e0]
movdqa xmmword [rbp + 0x1b0], xmm1
movdqa xmm0, xmmword [0x14014b5d0]
movdqa xmmword [rbp + 0x1c0], xmm0
movdqa xmm1, xmmword [0x14014b820]
movdqa xmmword [rbp + 0x1d0], xmm1
mov dword [rbp + 0x1e0], 0xbeebfc
mov byte [rbp + 0x1e4], 1
mov rcx, r12
nop dword [rax]
lea eax, [rcx + 0x4e]
xor byte [rbp + rcx + 0x1a0], al
inc rcx
cmp rcx, 0x43
jb 0x1400b2680
mov byte [rbp + 0x1e4], 0
mov r9d, reloc.WS2_32.dll_recv
xor r8d, r8d
lea rdx, [rbp + 0x1a0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400b2744
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400b2744
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r11 + r9*4]
mov r8d, dword [rdx + r10]
add r8, r10
mov edx, 0xb74b477f
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x1400b273f
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x1400b2720
cmp edx, 0xd60f9bff
je 0x1400b2749
test r9d, r9d
jne 0x1400b2700
mov rax, qword [rax]
jmp 0x1400b26d0
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
xor ecx, ecx
call rax
mov rsi, qword [rbp + 0x818]
mov rbx, qword [rbp + 0x800]
mov edi, dword [rsp + 0x40]
lea rax, [rbp + 0x1f0]
mov qword [rbp + 0xd8], rax
lea rdx, [rbp + 0x800]
cmp rsi, 0xf
cmova rdx, rbx
xorps xmm0, xmm0
movups xmmword [rbp + 0x1f0], xmm0
mov qword [rbp + 0x200], r12
mov qword [rbp + 0x208], r12
nop dword [rax + rax]
inc r14
cmp byte [rdx + r14], 0
jne 0x1400b27b0
mov r8, r14
lea rcx, [rbp + 0x1f0]
call fcn.140006390
nop
lea rax, [rbp + 0x6a8]
mov qword [rbp + 0xd0], rax
lea rdx, [0x140379040]
lea rcx, [rbp + 0x6a8]
call fcn.14000b140
mov rbx, rax
lea rdx, [0x140379020]
lea rcx, [rbp + 0x6c8]
call fcn.14000b140
nop
lea r8, [rbp + 0x1f0]
mov rdx, rbx
mov rcx, rax
call fcn.1400a7eb0
xor eax, 0xa5a5
mov edx, eax
shr eax, 8
movzx r8d, al
movzx eax, dl
movabs r14, 0xcbf29ce484222325
xor rax, r14
movabs rsi, 0x100000001b3
imul rax, rsi
xor r8, rax
imul r8, rsi
mov eax, edx
shr eax, 0x10
movzx ecx, al
xor r8, rcx
imul r8, rsi
shr rdx, 0x18
xor r8, rdx
imul r8, rsi
cmp r8w, 0xdf7f
jne 0x1400b346d
mov qword [rbp + 0x7a0], r12
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x768]
lea rdx, [rbp + 0x800]
lea rcx, [rbp + 0x7b0]
call fcn.1400a40c0
nop
lea rdx, [r15 + 0x20]
lea rcx, [rbp + 0x190]
call fcn.14009f710
nop
mov dword [rbp - 0x20], 0x343e3821
mov dword [rbp - 0x1c], 0x303a20
mov byte [rbp - 0x18], 1
lea rdx, [rbp + 0x5d0]
lea rcx, [rbp - 0x20]
call fcn.1400a7980
nop
movzx ecx, byte [rbp + 0x7b0]
test cl, cl
jne 0x1400b28f2
mov byte [rbp + 0x7b0], 1
call fcn.1400a2540
mov qword [rbp + 0x7b8], rax
movzx ecx, byte [rbp + 0x7b0]
jmp 0x1400b28f9
mov rax, qword [rbp + 0x7b8]
cmp cl, 1
jne 0x1400b290f
lea rdx, [rbp + 0x5d0]
mov rcx, rax
call fcn.1400a7890
jmp 0x1400b2914
mov rax, qword [rsp + 0x48]
lea rdx, [rbp + 0x190]
mov rcx, rax
call fcn.1400a74c0
movzx ebx, al
lea rcx, [rbp + 0x5d0]
call fcn.1400053c0
nop
movzx edx, byte [rbp + 0x190]
lea rcx, [rbp + 0x198]
call fcn.1400ad7f0
test bl, bl
jne 0x1400b29fb
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400b29d4
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400b29d4
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r11 + r9*4]
mov r8d, dword [rdx + r10]
add r8, r10
mov edx, 0xd7cf1f1e
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x1400b29cf
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x1400b29b0
cmp edx, 0x5ff277a6
je 0x1400b29d9
test r9d, r9d
jne 0x1400b2990
mov rax, qword [rax]
jmp 0x1400b2960
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
mov ecx, 8
call rax
mov edi, dword [rsp + 0x40]
mov dword [rsp + 0x6c], 0x656761
mov dword [rsp + 0x68], 0x7373656d
mov byte [rsp + 0x70], 0
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x6f]
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x5f0]
call fcn.140006de0
or edi, 0x1800
movzx ecx, byte [rbp + 0x7b0]
test cl, cl
jne 0x1400b2a58
mov byte [rbp + 0x7b0], 1
call fcn.1400a2540
mov qword [rbp + 0x7b8], rax
movzx ecx, byte [rbp + 0x7b0]
jmp 0x1400b2a5f
mov rax, qword [rbp + 0x7b8]
cmp cl, 1
jne 0x1400b2a75
lea rdx, [rbp + 0x5f0]
mov rcx, rax
call fcn.1400a7890
jmp 0x1400b2a7a
mov rax, qword [rsp + 0x48]
lea rdx, [rbp + 0x9d0]
mov rcx, rax
call fcn.14009fd20
nop
lea rcx, [rbp + 0x5f0]
call fcn.1400053c0
lea rdx, [rbp + 0x7b0]
lea rcx, [rbp + 0x310]
call fcn.1400a66b0
mov rdx, rax
mov rcx, r15
call fcn.1400b4160
mov word [rsp + 0x53], 0x65
mov word [rsp + 0x50], 0x6f63
mov byte [rsp + 0x52], 0x64
mov byte [rsp + 0x55], 0
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x54]
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x610]
call fcn.140006de0
or edi, 0x6000
movzx ecx, byte [rbp + 0x7b0]
test cl, cl
jne 0x1400b2b14
mov byte [rbp + 0x7b0], 1
call fcn.1400a2540
mov qword [rbp + 0x7b8], rax
movzx ecx, byte [rbp + 0x7b0]
jmp 0x1400b2b1b
mov rax, qword [rbp + 0x7b8]
cmp cl, 1
jne 0x1400b2b31
lea rdx, [rbp + 0x610]
mov rcx, rax
call fcn.1400a7890
jmp 0x1400b2b36
mov rax, qword [rsp + 0x48]
mov rcx, rax
call fcn.14009fcb0
mov edx, eax
shr eax, 8
movzx ebx, al
movzx eax, dl
xor rax, r14
imul rax, rsi
xor rbx, rax
imul rbx, rsi
mov eax, edx
shr eax, 0x10
movzx ecx, al
xor rbx, rcx
imul rbx, rsi
shr rdx, 0x18
xor rbx, rdx
imul rbx, rsi
lea rcx, [rbp + 0x610]
call fcn.1400053c0
mov dword [rbp - 0x10], 0x32333a3d
mov dword [rbp - 0xc], 0x272037
mov byte [rbp - 8], 1
lea rdx, [rbp + 0x650]
lea rcx, [rbp - 0x10]
call fcn.1400a7980
nop
or edi, 1
mov dword [rsp + 0x40], edi
movzx ecx, byte [rbp + 0x7b0]
test cl, cl
jne 0x1400b2bce
mov byte [rbp + 0x7b0], 1
call fcn.1400a2540
mov qword [rbp + 0x7b8], rax
movzx ecx, byte [rbp + 0x7b0]
jmp 0x1400b2bd5
mov rax, qword [rbp + 0x7b8]
cmp cl, 1
jne 0x1400b2bee
lea rdx, [rbp + 0x650]
mov rcx, rax
call fcn.1400a7890
mov rcx, rax
jmp 0x1400b2bf3
mov rcx, qword [rsp + 0x48]
lea rax, [rcx + 8]
cmp byte [rcx], 4
cmovne rax, r12
cmp byte [rax], 0
je 0x1400b2c9f
mov dword [rbp], 0x32333a3d
mov dword [rbp + 4], 0x272037
mov byte [rbp + 8], 1
lea rdx, [rbp + 0x630]
lea rcx, [rbp]
call fcn.1400a7980
nop
or edi, 2
mov dword [rsp + 0x40], edi
movzx eax, byte [rbp + 0x7b0]
test al, al
jne 0x1400b2c5b
mov byte [rbp + 0x7b0], 1
call fcn.1400a2540
mov rcx, rax
mov qword [rbp + 0x7b8], rax
movzx eax, byte [rbp + 0x7b0]
jmp 0x1400b2c62
mov rcx, qword [rbp + 0x7b8]
cmp al, 1
jne 0x1400b2c77
lea rdx, [rbp + 0x630]
call fcn.1400a7890
mov rcx, rax
jmp 0x1400b2c7c
mov rcx, qword [rsp + 0x48]
lea rax, [rcx + 8]
cmp byte [rcx], 4
cmovne rax, r12
cmp byte [rax], 0
je 0x1400b2c9b
movabs rax, 0xcbe5c873d26645f1
cmp rbx, rax
je 0x1400b2c9f
xor bl, bl
jmp 0x1400b2ca1
mov bl, 1
test dil, 2
je 0x1400b2cb7
and edi, 0xfffffffd
lea rcx, [rbp + 0x630]
call fcn.1400053c0
nop
test dil, 1
je 0x1400b2cc9
lea rcx, [rbp + 0x650]
call fcn.1400053c0
test bl, bl
je 0x1400b3396
mov dword [rbp + 0x10], 0x32333a3d
mov dword [rbp + 0x14], 0x272037
mov byte [rbp + 0x18], 1
lea rdx, [rbp + 0x670]
lea rcx, [rbp + 0x10]
call fcn.1400a7980
nop
movzx eax, byte [rbp + 0x7b0]
test al, al
jne 0x1400b2d1e
mov byte [rbp + 0x7b0], 1
call fcn.1400a2540
mov rcx, rax
mov qword [rbp + 0x7b8], rax
movzx eax, byte [rbp + 0x7b0]
jmp 0x1400b2d25
mov rcx, qword [rbp + 0x7b8]
cmp al, 1
jne 0x1400b2d3a
lea rdx, [rbp + 0x670]
call fcn.1400a7890
mov rcx, rax
jmp 0x1400b2d3f
mov rcx, qword [rsp + 0x48]
lea rax, [rcx + 8]
cmp byte [rcx], 4
cmovne rax, r12
movzx ebx, byte [rax]
lea rcx, [rbp + 0x670]
call fcn.1400053c0
test bl, bl
je 0x1400b2f27
mov dword [rbp + 0x60], 0x2272a20
mov dword [rbp + 0x64], 0x3c272037
mov dword [rbp + 0x68], 0x1003939
lea rdx, [rbp + 0x510]
lea rcx, [rbp + 0x60]
call fcn.1400a7aa0
nop
movzx eax, byte [rbp + 0x7b0]
test al, al
jne 0x1400b2db1
mov byte [rbp + 0x7b0], 1
call fcn.1400a2540
mov rcx, rax
mov qword [rbp + 0x7b8], rax
movzx eax, byte [rbp + 0x7b0]
jmp 0x1400b2db8
mov rcx, qword [rbp + 0x7b8]
cmp al, 1
jne 0x1400b2dcd
lea rdx, [rbp + 0x510]
call fcn.1400a7890
mov rcx, rax
jmp 0x1400b2dd2
mov rcx, qword [rsp + 0x48]
lea rax, [rcx + 8]
cmp byte [rcx], 4
cmovne rax, r12
movzx ebx, byte [rax]
lea rcx, [rbp + 0x510]
call fcn.1400053c0
test bl, bl
je 0x1400b2dfb
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp + 0x50], 0x22232a3d
mov dword [rbp + 0x54], 0x3c3a3c3b
mov word [rbp + 0x58], 0x32
mov byte [rbp + 0x5a], 1
lea rdx, [rbp + 0x4f0]
lea rcx, [rbp + 0x50]
call fcn.1400a7a20
nop
movzx eax, byte [rbp + 0x7b0]
test al, al
jne 0x1400b2e4e
mov byte [rbp + 0x7b0], 1
call fcn.1400a2540
mov rcx, rax
mov qword [rbp + 0x7b8], rax
movzx eax, byte [rbp + 0x7b0]
jmp 0x1400b2e55
mov rcx, qword [rbp + 0x7b8]
cmp al, 1
jne 0x1400b2e67
lea rdx, [rbp + 0x4f0]
call fcn.1400a7890
jmp 0x1400b2e6c
mov rax, qword [rsp + 0x48]
lea rcx, [r15 + 0x240]
mov rdx, rax
call fcn.14009f950
nop
lea rcx, [rbp + 0x4f0]
call fcn.1400053c0
mov byte [0x1403e4428], 1
mov dword [rbp - 0x40], 0x38203f2f
mov dword [rbp - 0x3c], 0x3b353c
mov byte [rbp - 0x38], 1
lea rdx, [rbp + 0x570]
lea rcx, [rbp - 0x40]
call fcn.1400a7980
nop
movzx ecx, byte [rbp + 0x7b0]
test cl, cl
jne 0x1400b2ed9
mov byte [rbp + 0x7b0], 1
call fcn.1400a2540
mov qword [rbp + 0x7b8], rax
movzx ecx, byte [rbp + 0x7b0]
jmp 0x1400b2ee0
mov rax, qword [rbp + 0x7b8]
cmp cl, 1
jne 0x1400b2ef6
lea rdx, [rbp + 0x570]
mov rcx, rax
call fcn.1400a7890
jmp 0x1400b2efb
mov rax, qword [rsp + 0x48]
mov rdx, rax
lea rcx, [rbp + 0x300]
call fcn.1400a66b0
mov rdx, rax
mov rcx, r15
call fcn.1400b3d40
nop
lea rcx, [rbp + 0x570]
call fcn.1400053c0
jmp 0x1400b3448
mov dword [rbp + 0x70], 0x30262127
mov dword [rbp + 0x74], 0x23303a3e
mov dword [rbp + 0x78], 0x1002533
xor eax, eax
mov qword [rbp + 0x108], rax
mov byte [rbp + 0x100], 3
xorps xmm0, xmm0
movups xmmword [rbp + 0x850], xmm0
mov edx, 1
lea rcx, [rbp + 0x7a8]
call fcn.140006cb0
lea rcx, [rbp + 0x7a8]
mov qword [rbp + 0x850], rcx
mov qword [rbp + 0x858], rax
mov rdx, rax
lea rcx, [rbp + 0x70]
call fcn.1400a7aa0
mov rax, qword [rbp + 0x858]
mov qword [rbp + 0x858], r12
mov qword [rbp + 0x108], rax
mov dword [rbp - 0x30], 0x22232a23
mov dword [rbp - 0x2c], 0x313433
mov byte [rbp - 0x28], 1
lea rdx, [rbp + 0x550]
lea rcx, [rbp - 0x30]
call fcn.1400a7980
nop
movzx ecx, byte [rbp + 0x7b0]
test cl, cl
jne 0x1400b2fe7
mov byte [rbp + 0x7b0], 1
call fcn.1400a2540
mov qword [rbp + 0x7b8], rax
movzx ecx, byte [rbp + 0x7b0]
jmp 0x1400b2fee
mov rax, qword [rbp + 0x7b8]
cmp cl, 1
jne 0x1400b3004
lea rdx, [rbp + 0x550]
mov rcx, rax
call fcn.1400a7890
jmp 0x1400b3009
mov rax, qword [rsp + 0x48]
lea rdx, [rbp + 0x100]
mov rcx, rax
call fcn.1400a74c0
movzx ebx, al
lea rcx, [rbp + 0x550]
call fcn.1400053c0
nop
movzx edx, byte [rbp + 0x100]
lea rcx, [rbp + 0x108]
call fcn.1400ad7f0
test bl, bl
je 0x1400b3448
mov dword [rbp + 0x20], 0x3f27202a
mov dword [rbp + 0x24], 0x31353c3e
mov word [rbp + 0x28], 0x100
lea rdx, [rbp + 0x530]
lea rcx, [rbp + 0x20]
call fcn.1400a79d0
nop
movzx eax, byte [rbp + 0x7b0]
test al, al
jne 0x1400b3092
mov byte [rbp + 0x7b0], 1
call fcn.1400a2540
mov rcx, rax
mov qword [rbp + 0x7b8], rax
movzx eax, byte [rbp + 0x7b0]
jmp 0x1400b3099
mov rcx, qword [rbp + 0x7b8]
cmp al, 1
jne 0x1400b30ab
lea rdx, [rbp + 0x530]
call fcn.1400a7890
jmp 0x1400b30b0
mov rax, qword [rsp + 0x48]
lea rdx, [rbp + 0x8a0]
mov rcx, rax
call fcn.14009fd20
nop
lea rcx, [rbp + 0x530]
call fcn.1400053c0
lea rcx, [rbp + 0x8a0]
mov rbx, qword [rbp + 0x8a0]
mov rdi, qword [rbp + 0x8b8]
cmp rdi, 0xf
cmova rcx, rbx
mov r8, qword [rbp + 0x8b0]
test r8, r8
jne 0x1400b3297
lea rdx, [0x140168718]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400b3297
movdqa xmm0, xmmword [0x14014b610]
movdqa xmmword [rbp + 0x3b0], xmm0
movdqa xmm1, xmmword [0x14014b500]
movdqa xmmword [rbp + 0x3c0], xmm1
movdqa xmm0, xmmword [0x14014b6a0]
movdqa xmmword [rbp + 0x3d0], xmm0
movdqa xmm1, xmmword [0x14014b850]
movdqa xmmword [rbp + 0x3e0], xmm1
movdqa xmm0, xmmword [0x14014b840]
movdqa xmmword [rbp + 0x3f0], xmm0
movdqa xmm1, xmmword [0x14014b800]
movdqa xmmword [rbp + 0x400], xmm1
movdqa xmm0, xmmword [0x14014b7c0]
movdqa xmmword [rbp + 0x410], xmm0
movdqa xmm1, xmmword [0x14014b7f0]
movdqa xmmword [rbp + 0x420], xmm1
movdqa xmm0, xmmword [0x14014b7e0]
movdqa xmmword [rbp + 0x430], xmm0
movdqa xmm1, xmmword [0x14014b7a0]
movdqa xmmword [rbp + 0x440], xmm1
movdqa xmm0, xmmword [0x14014b7b0]
movdqa xmmword [rbp + 0x450], xmm0
movdqa xmm1, xmmword [0x14014b6d0]
movdqa xmmword [rbp + 0x460], xmm1
movdqa xmm0, xmmword [0x14014b710]
movdqa xmmword [rbp + 0x470], xmm0
movdqa xmm1, xmmword [0x14014b6c0]
movdqa xmmword [rbp + 0x480], xmm1
movdqa xmm0, xmmword [0x14014b680]
movdqa xmmword [rbp + 0x490], xmm0
movdqa xmm1, xmmword [str.Z4_b7__f___]
movdqa xmmword [rbp + 0x4a0], xmm1
movdqa xmm0, xmmword [0x14014b620]
movdqa xmmword [rbp + 0x4b0], xmm0
movdqa xmm1, xmmword [0x14014b550]
movdqa xmmword [rbp + 0x4c0], xmm1
movdqa xmm0, xmmword [0x14014b5b0]
movdqa xmmword [rbp + 0x4d0], xmm0
mov dword [rbp + 0x4e0], 0xf8ec0b1d
mov word [rbp + 0x4e4], 0xac
mov byte [rbp + 0x4e6], 1
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx + 0x4e]
xor byte [rbp + rcx + 0x3b0], al
inc rcx
cmp rcx, 0x135
jb 0x1400b3260
mov byte [rbp + 0x4e6], 0
mov r9d, reloc.WS2_32.dll_recv
xor r8d, r8d
lea rdx, [rbp + 0x3b0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x1400b32d6
lea r8, [rbp + 0x8a0]
cmp rdi, 0xf
cmova r8, rbx
mov word [rbp - 0x75], WSAStartup
mov word [rbp - 0x78], 0x706f
mov byte [rbp - 0x76], 0x65
mov byte [rbp - 0x73], 0
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea rdx, [rbp - 0x78]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400b3364
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400b3364
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r10 + r9*4]
mov r8d, dword [rdx + r11]
add r8, r10
mov edx, 0x8c55f4cd
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x1400b335f
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x1400b3340
cmp edx, 0x14aaae2d
je 0x1400b3369
test r9d, r9d
jne 0x1400b3320
mov rax, qword [rax]
jmp 0x1400b32f0
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
xor ecx, ecx
call rax
nop
lea rcx, [rbp + 0x8a0]
call fcn.1400053c0
jmp 0x1400b3448
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400b3424
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400b3424
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r10 + r9*4]
mov r8d, dword [rdx + r11]
add r8, r10
mov edx, 0x94c2c38
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x1400b341f
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x1400b3400
cmp edx, 0x71ae1288
je 0x1400b3429
test r9d, r9d
jne 0x1400b33e0
mov rax, qword [rax]
jmp 0x1400b33b0
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
mov ecx, 9
call rax
nop
lea rcx, [rbp + 0x9d0]
call fcn.1400053c0
nop
movzx edx, byte [rbp + 0x7b0]
lea rcx, [rbp + 0x7b8]
call fcn.1400ad7f0
jmp 0x1400b351a
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400b34f6
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400b34f6
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r10 + r9*4]
mov ecx, dword [rdx + r11]
add rcx, r10
mov r8d, 0x7a4250bf
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1400b34f1
nop
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x1400b34d0
cmp r8d, 0x32f9293f
je 0x1400b34fb
test r9d, r9d
jne 0x1400b34b0
mov rax, qword [rax]
jmp 0x1400b3480
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
mov ecx, 7
call rax
nop
mov rdx, qword [rbp + 0x818]
cmp rdx, 0xf
jbe 0x1400b355e
inc rdx
mov rcx, qword [rbp + 0x800]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b3559
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400b3559
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140142874
mov qword [rbp + 0x810], r12
mov qword [rbp + 0x818], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x800], 0
mov rdx, qword [rbp + 0x7d8]
cmp rdx, 0xf
jbe 0x1400b35bb
inc rdx
mov rcx, qword [rbp + 0x7c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b35b6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400b35b6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140142874
mov qword [rbp + 0x7d0], r12
mov qword [rbp + 0x7d8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x7c0], 0
mov rdx, qword [rbp + 0x848]
cmp rdx, 0xf
jbe 0x1400b3618
inc rdx
mov rcx, qword [rbp + 0x830]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b3613
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400b3613
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140142874
mov qword [rbp + 0x840], r12
mov qword [rbp + 0x848], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x830], 0
mov rdx, qword [rbp + 0x898]
cmp rdx, 0xf
jbe 0x1400b3675
inc rdx
mov rcx, qword [rbp + 0x880]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b3670
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400b3670
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140142874
mov rcx, qword [rbp + 0xa70]
xor rcx, rsp
call fcn.1401425d0
lea r11, [rsp + 0xb90]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
movdqa xmm0, xmmword [str.___4_u0615__]
movdqu xmmword [rbp + 0x230], xmm0
mov byte [rbp + 0x240], 1
lea rdx, [rbp + 0x6e8]
lea rcx, [rbp + 0x230]
call fcn.1400a7a80
nop
lea rdx, [rbp + 0x6e8]
lea rcx, [rbp + 0x690]
call fcn.14001f230
lea rdx, [0x140373f00]
lea rcx, [rbp + 0x690]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
call fcn.140002800
int3
call fcn.1400028a0
int3