Function at 0x180010690
Capabilities:
Create process on windows
Encode data using xor
Terminate process

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1888]
mov eax, 0x1988
call fcn.18007c000
sub rsp, rax
mov rax, qword [0x18036d060]
xor rax, rsp
mov qword [rbp + 0x1870], rax
mov r14, r9
mov qword [rbp + 0x860], r9
mov rax, r8
mov qword [rsp + 0x50], rax
mov qword [rbp - 0x10], rdx
mov r13, rcx
mov qword [rbp - 0x80], rcx
mov qword [rbp + 0x18], rcx
mov qword [rbp + 0x20], rdx
mov qword [rbp + 0x28], rax
mov qword [rbp + 0x30], r9
xor eax, eax
mov dword [rbp + 0x38], eax
mov r8d, 0x104
lea rdx, [0x18038b700]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rsi, qword [r13 + 0x10]
mov rbx, r13
mov r12, qword [r13 + 0x18]
cmp r12, 8
jb 0x18001071f
mov rbx, qword [r13]
mov rdi, 0xffffffffffffffff
mov r9d, 0x100
test rsi, rsi
je 0x180010810
mov r8d, r9d
xor edx, edx
lea rcx, [rbp + 0x870]
call fcn.180211600
lea rcx, [0x180312250]
lea rdx, [0x180312254]
mov r9d, 0x100
nop word [rax + rax]
movzx eax, word [rcx]
cmp ax, r9w
jae 0x1800107af
movzx eax, al
mov byte [rbp + rax + 0x870], 1
add rcx, 2
cmp rcx, rdx
jne 0x180010760
lea rcx, [rsi - 1]
mov rax, rdi
cmp rcx, rdi
cmovb rax, rcx
lea r8, [rbx + rax*2]
nop
movzx eax, word [r8]
cmp ax, r9w
jae 0x1800107a4
cmp byte [rbp + rax + 0x870], 0
jne 0x180010808
cmp r8, rbx
je 0x180010810
sub r8, 2
jmp 0x180010790
lea rcx, [rsi - 1]
mov rax, rdi
cmp rcx, rdi
cmovb rax, rcx
lea r8, [rbx + rax*2]
mov r9d, 0x5c
nop word [rax + rax]
mov ecx, 2
movzx edx, word [r8]
lea rax, [0x180312250]
cmp r9w, dx
je 0x180010808
cmp rcx, 1
je 0x1800107fd
dec rcx
add rax, 2
cmp word [rax], dx
jne 0x1800107e6
test rax, rax
jne 0x180010808
cmp r8, rbx
je 0x180010810
sub r8, 2
jmp 0x1800107d0
sub r8, rbx
sar r8, 1
jmp 0x180010813
mov r8, rdi
xor eax, eax
mov qword [rbp + 0x68], rax
mov qword [rbp + 0x70], 7
mov word [rbp + 0x58], ax
cmp rsi, r8
cmovb r8, rsi
mov rdx, r13
cmp r12, 8
jb 0x180010839
mov rdx, qword [r13]
lea rcx, [rbp + 0x58]
call fcn.18000dc00
mov dword [rbp + 0x38], reloc.WS2_32.dll_recv
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0xf0], xmm0
movups xmmword [rbp + 0x100], xmm0
movups xmmword [rbp + 0x110], xmm0
movups xmmword [rbp + 0x120], xmm0
movups xmmword [rbp + 0x130], xmm0
movups xmmword [rbp + 0x140], xmm0
mov qword [rbp + 0x150], rax
movups xmmword [rbp + 0xb8], xmm0
mov qword [rbp + 0xc8], rax
xor edx, edx
mov r8d, 0x378
lea rcx, [rbp + 0x4e0]
call fcn.180211600
lea rcx, [rbp + 0x4e0]
call fcn.180048cf0
nop
mov rsi, qword [r14 + 0x10]
mov rax, r14
mov rcx, qword [r14 + 0x18]
cmp rcx, 0x10
jb 0x1800108c2
mov rax, qword [r14]
movabs rdx, 0x7fffffffffffffff
cmp rsi, 3
jne 0x180010928
cmp byte [rax], 0x35
jne 0x1800108eb
cmp byte [rax + 1], 0x37
jne 0x1800108eb
cmp byte [rax + 2], 0x30
jne 0x1800108eb
xor r12d, r12d
mov eax, r12d
jmp 0x1800108f3
sbb eax, eax
or eax, 1
xor r12d, r12d
test eax, eax
jne 0x180010928
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x60], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x78], al
lea r8d, [rax + 9]
lea rdx, str.dota2.exe
lea rcx, [rbp - 0x78]
call fcn.1800052d0
lea rbx, [rbp - 0x78]
mov esi, setsockopt
jmp 0x1800109d3
mov r12, r14
cmp rcx, 0x10
jb 0x180010934
mov r12, qword [r14]
cmp rsi, 0x10
jae 0x18001094f
movups xmm0, xmmword [r12]
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x78], reloc.WS2_32.dll_ntohs
jmp 0x1800109c1
mov rbx, rsi
or rbx, 0xf
cmp rbx, rdx
cmova rbx, rdx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x180010999
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1800117e4
mov rcx, rax
call fcn.18007b16c
mov rcx, rax
test rax, rax
je 0x1800117f0
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1800109a8
test rcx, rcx
je 0x1800109a5
call fcn.18007b16c
jmp 0x1800109a8
mov rax, rcx
mov qword [rsp + 0x60], rax
lea r8, [rsi + 1]
mov rdx, r12
mov rcx, rax
call fcn.180210e90
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x70], rsi
lea rbx, [rsp + 0x60]
mov esi, reloc.WS2_32.dll_select
xor r12d, r12d
mov dword [rbp + 0x38], esi
cmp r14, rbx
je 0x180010a02
mov rcx, r14
call fcn.180005250
movups xmm0, xmmword [rbx]
movups xmmword [r14], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [r14 + 0x10], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
test sil, 2
je 0x180010a19
and esi, 0xfffffffd
mov dword [rbp + 0x38], esi
lea rcx, [rsp + 0x60]
call fcn.180005250
nop
test sil, 1
je 0x180010a2e
and esi, 0xfffffffe
mov dword [rbp + 0x38], esi
lea rcx, [rbp - 0x78]
call fcn.180005250
mov r13, qword [r14 + 0x10]
mov rax, r14
mov rcx, qword [r14 + 0x18]
cmp rcx, 0x10
jb 0x180010a42
mov rax, qword [r14]
cmp r13, 3
jne 0x180010a96
cmp byte [rax], 0x37
jne 0x180010a5e
cmp byte [rax + 1], 0x33
jne 0x180010a5e
cmp byte [rax + 2], 0x30
jne 0x180010a5e
mov eax, r12d
jmp 0x180010a63
sbb eax, eax
or eax, 1
test eax, eax
jne 0x180010a96
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x60], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x78], al
lea r8d, [rax + 8]
lea rdx, str.csgo.exe
lea rcx, [rbp - 0x78]
call fcn.1800052d0
lea rbx, [rbp - 0x78]
or esi, 4
jmp 0x180010b49
mov r12, r14
cmp rcx, 0x10
jb 0x180010aa2
mov r12, qword [r14]
cmp r13, 0x10
jae 0x180010abd
movups xmm0, xmmword [r12]
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x78], reloc.WS2_32.dll_ntohs
jmp 0x180010b39
mov rbx, r13
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
cmova rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x180010b11
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1800117ea
mov rcx, rax
call fcn.18007b16c
mov rcx, rax
test rax, rax
je 0x1800117f0
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x180010b20
test rcx, rcx
je 0x180010b1d
call fcn.18007b16c
jmp 0x180010b20
mov rax, rcx
mov qword [rsp + 0x60], rax
lea r8, [r13 + 1]
mov rdx, r12
mov rcx, rax
call fcn.180210e90
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x70], r13
lea rbx, [rsp + 0x60]
or esi, 8
xor r12d, r12d
cmp r14, rbx
je 0x180010b75
mov rcx, r14
call fcn.180005250
movups xmm0, xmmword [rbx]
movups xmmword [r14], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [r14 + 0x10], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
test sil, 8
je 0x180010b89
and esi, 0xfffffff7
lea rcx, [rsp + 0x60]
call fcn.180005250
nop
test sil, 4
je 0x180010b9b
and esi, 0xfffffffb
lea rcx, [rbp - 0x78]
call fcn.180005250
mov rcx, r14
cmp qword [r14 + 0x18], 0x10
jb 0x180010ba8
mov rcx, qword [r14]
call fcn.180010280
mov r13, qword [rbp - 0x80]
mov r8, r13
lea rdx, [0x180312284]
lea rcx, [rsp + 0x60]
call fcn.1800169a0
nop
mov r8d, 2
lea rdx, [0x18031227c]
mov rcx, rax
call fcn.1800166c0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x40], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x40], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
or esi, 0x20
mov rax, qword [rbp - 0x10]
mov rdx, rax
cmp qword [rax + 0x18], 8
jb 0x180010c16
mov rdx, qword [rax]
mov r8, qword [rax + 0x10]
lea rcx, [rbp - 0x50]
call fcn.1800166c0
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x88], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x88], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
or esi, 0x40
lea rcx, [rbp - 0x50]
call fcn.18000db90
nop
lea rcx, [rsp + 0x60]
call fcn.18000db90
mov rcx, r14
cmp qword [r14 + 0x18], 0x10
jb 0x180010c74
mov rcx, qword [r14]
mov r12d, 4
cmp qword [r14 + 0x10], 9
jne 0x180010dba
lea r8d, [r12 + 5]
lea rdx, str.dota2.exe
call fcn.1802117a0
test eax, eax
jne 0x180010dba
lea rbx, [rbp + 0x58]
cmp qword [rbp + 0x70], 8
cmovae rbx, qword [rbp + 0x58]
mov r8, r13
lea rdx, [0x180312284]
lea rcx, [rbp + 0xd0]
call fcn.1800169a0
nop
lea r8d, [r12 - 2]
lea rdx, [0x18031227c]
mov rcx, rax
call fcn.1800166c0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x20], xmm1
xor ecx, ecx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], 7
mov word [rax], cx
bts esi, 7
mov rax, qword [rbp - 0x10]
mov rdx, rax
cmp qword [rax + 0x18], 8
jb 0x180010d14
mov rdx, qword [rax]
mov r8, qword [rax + 0x10]
lea rcx, [rbp - 0x30]
call fcn.1800166c0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x68], xmm1
xor r8d, r8d
mov qword [rax + 0x10], r8
mov qword [rax + 0x18], 7
mov word [rax], r8w
bts esi, 8
lea rdx, [rbp - 0x78]
cmp qword [rbp - 0x60], 8
cmovae rdx, qword [rbp - 0x78]
mov rcx, r13
cmp qword [r13 + 0x18], 8
jb 0x180010d63
mov rcx, qword [r13]
lea rax, [rbp + 0xb8]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], r8
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
lea rcx, [rbp - 0x78]
call fcn.18000db90
nop
lea rcx, [rbp - 0x30]
call fcn.18000db90
nop
lea rcx, [rbp + 0xd0]
call fcn.18000db90
jmp 0x180010dd0
lea rcx, [rbp + 0x78]
cmp qword [rbp + 0x90], 8
cmovae rcx, qword [rbp + 0x78]
call fcn.180222f0c
xor edx, edx
mov r8d, 0x378
lea rcx, [rbp + 0x160]
call fcn.180211600
lea rcx, [rbp + 0x160]
call fcn.180048cf0
nop
xor r13d, r13d
movabs r12, 0x7fffffffffffffff
nop
mov rdx, r14
cmp qword [r14 + 0x18], 0x10
jb 0x180010e0d
mov rdx, qword [r14]
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x60], 0
mov r8, rdi
inc r8
cmp byte [rdx + r8], 0
jne 0x180010e23
lea rcx, [rsp + 0x60]
call fcn.1800052d0
nop
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp + 0x870]
call fcn.180211600
lea r8, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae r8, qword [rsp + 0x60]
mov dword [rsp + 0x28], 0x800
lea rax, [rbp + 0x870]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x70]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov qword [rbp - 0x68], r13
mov qword [rbp - 0x60], 7
mov word [rbp - 0x78], r13w
lea rax, [rbp + 0x870]
mov r8, rdi
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x180010ea0
lea rdx, [rbp + 0x870]
lea rcx, [rbp - 0x78]
call fcn.18000dc00
bts esi, 9
lea rdx, [rbp - 0x78]
cmp qword [rbp - 0x60], 8
cmovae rdx, qword [rbp - 0x78]
lea rcx, [rbp + 0x160]
call fcn.1800491e0
mov ebx, eax
lea rcx, [rbp - 0x78]
call fcn.18000db90
nop
lea rcx, [rsp + 0x60]
call fcn.180005250
call fcn.1800783d4
cmp ebx, 0xc0000225
mov rbx, rax
jne 0x180010f5b
call fcn.1800783b8
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
imul rcx, rcx, 0x3b9aca00
add rax, rcx
movabs rcx, 0x7ffffffffa0a1eff
cmp rax, rcx
jge 0x180010f49
add rax, 0x5f5e100
mov qword [rbp + 0x38], rax
lea rcx, [rbp + 0x38]
call fcn.180017080
jmp 0x180010e00
mov qword [rbp + 0x38], r12
lea rcx, [rbp + 0x38]
call fcn.180017080
jmp 0x180010e00
call fcn.1800783b8
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
movabs rcx, 0x7fffffffc46535ff
movabs r15, 0x7fffffffffffffff
cmp rax, rcx
jge 0x180010fa0
add rax, 0x3b9aca00
mov qword [rbp + 0x38], rax
jmp 0x180010fa4
mov qword [rbp + 0x38], r15
lea rcx, [rbp + 0x38]
call fcn.180017080
mov r12d, 4
mov r13, qword [rbp - 0x80]
xor esi, esi
movabs r14, 0x7ffffffffa0a1eff
nop dword [rax]
nop word [rax + rax]
mov dword [rbp + 0x38], esi
mov rcx, qword [rbp + 0x160]
test rcx, rcx
je 0x180010ffb
lea rdx, [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x180010ffb
cmp dword [rbp + 0x38], 0x103
sete al
test al, al
jne 0x18001104f
call fcn.1800783d4
mov rbx, rax
call fcn.1800783b8
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
imul rcx, rcx, 0x3b9aca00
add rax, rcx
cmp rax, r14
jge 0x180011040
add rax, 0x5f5e100
mov qword [rbp - 0x80], rax
lea rcx, [rbp - 0x80]
call fcn.180017080
jmp 0x180010fd0
mov qword [rbp - 0x80], r15
lea rcx, [rbp - 0x80]
call fcn.180017080
jmp 0x180010fd0
call fcn.1800783d4
mov rbx, rax
call fcn.1800783b8
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
movabs rcx, 0x7fffffffc46535ff
cmp rax, rcx
jge 0x18001108e
add rax, 0x3b9aca00
jmp 0x180011098
movabs rax, 0x7fffffffffffffff
mov qword [rbp - 0x80], rax
lea rcx, [rbp - 0x80]
call fcn.180017080
movdqa xmm0, xmmword [0x1803172f0]
movdqu xmmword [rsp + 0x60], xmm0
xor eax, eax
mov byte [rsp + 0x70], al
mov rcx, rsi
mov r14, qword [rbp + 0x860]
lea r15, [0x18038b700]
nop word [rax + rax]
movzx eax, byte [rsp + 0x60]
xor byte [rsp + rcx + 0x61], al
inc rcx
cmp rcx, 0xf
jb 0x1800110d0
mov byte [rsp + 0x70], sil
mov qword [rbp - 0x68], rsi
mov qword [rbp - 0x60], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x78], sil
lea rax, [rsp + 0x61]
mov r8, rdi
nop
inc r8
cmp byte [rax + r8], sil
jne 0x180011100
lea rdx, [rsp + 0x61]
lea rcx, [rbp - 0x78]
call fcn.1800052d0
lea rcx, [rbp - 0x78]
call fcn.180037aa0
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x878]
call fcn.180211600
mov dword [rbp + 0xa80], edi
xorps xmm0, xmm0
movups xmmword [rbp + 0xa84], xmm0
movups xmmword [rbp + 0xa94], xmm0
movups xmmword [rbp + 0xaa4], xmm0
movups xmmword [rbp + 0xab4], xmm0
mov qword [rbp + 0x870], 0x1ce8a
lea rdx, [0x1803121c0]
lea r10, [0x18037c680]
mov rcx, r10
call fcn.180016ab0
test al, al
jne 0x180011201
cmp qword [reloc.WS2_32.dll_getsockopt], 8
cmovae r10, qword [0x18037c680]
lea rcx, [rbp + 0x878]
mov eax, 2
nop
movups xmm0, xmmword [r10]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [r10 + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [r10 + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [r10 + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [r10 + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [r10 + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [r10 + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [r10 + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea r10, [r10 + 0x80]
sub rax, 1
jne 0x1800111a0
mov eax, dword [r10]
mov dword [rcx], eax
jmp 0x180011270
lea rcx, [rbp + 0x878]
mov rax, r12
nop dword [rax + rax]
movups xmm0, xmmword [r15]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [r15 + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [r15 + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [r15 + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [r15 + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [r15 + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [r15 + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [r15 + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea r15, [r15 + 0x80]
sub rax, 1
jne 0x180011210
mov rax, qword [r15]
mov qword [rcx], rax
lea rcx, [rbp + 0x98]
call fcn.18000ad20
nop
lea rdx, [rbp + 0x98]
cmp qword [rbp + 0xb0], 0x10
cmovae rdx, qword [rbp + 0x98]
mov r8, qword [rbp + 0xa8]
lea rcx, [rbp + 0xa84]
call fcn.180210e90
mov edx, 0x258
lea rcx, [rbp + 0x870]
call fcn.180007a90
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x40], xmm1
mov qword [rbp + 0x50], rsi
mov rcx, r14
cmp qword [r14 + 0x18], 0x10
jb 0x1800112d1
mov rcx, qword [r14]
cmp qword [r14 + 0x10], 9
jne 0x180011390
mov r8d, 9
lea rdx, str.dota2.exe
call fcn.1802117a0
test eax, eax
jne 0x180011390
mov edx, 0x258
lea rcx, [rbp + 0x40]
call fcn.1800171e0
mov rcx, qword [rbp + 0x40]
lea rax, [rbp + 0x870]
nop
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub r12, 1
jne 0x180011310
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
mov rax, qword [rax + 0x50]
mov qword [rcx + 0x50], rax
mov r15, qword [rsp + 0x50]
mov rcx, r15
call fcn.1800b5fb0
mov rbx, rax
mov rcx, r15
call fcn.1800b60a0
mov esi, eax
mov r8, rbx
lea rdx, str.MemoryImage_0x_p
lea rcx, [rbp + 0x870]
call qword [sym.imp.USER32.dll_wsprintfW]
xor r12d, r12d
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x60], 7
mov word [rbp - 0x78], r12w
lea rax, [rbp + 0x870]
mov r8, rdi
nop
inc r8
cmp word [rax + r8*2], r12w
jne 0x1800113e0
lea rdx, [rbp + 0x870]
lea rcx, [rbp - 0x78]
call fcn.18000dc00
nop
lea rax, [rbp + 0x40]
mov qword [rsp + 0x48], rax
lea rax, [0x180011800]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x8004
mov qword [rsp + 0x20], rsi
mov r9, rbx
lea r8, [rbp - 0x78]
lea rdx, [rbp - 8]
lea rcx, [rbp + 0x420]
call fcn.180040c80
nop
lea rcx, [rbp - 0x78]
call fcn.18000db90
nop
mov edx, dword [rbp - 8]
test edx, edx
jns 0x180011658
mov esi, r12d
lea rcx, [rbp + 0xd0]
call fcn.18004a5a0
nop
mov dword [0x18037c330], edi
mov r8d, dword [rbp - 8]
lea rdx, [0x180312288]
lea rcx, [rbp + 0x860]
call fcn.180016b20
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x50], 0
lea rax, [rbp + 0x860]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x180011491
lea rdx, [rbp + 0x860]
lea rcx, [rbp - 0x50]
call fcn.1800052d0
nop
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x30], 0
mov r8d, 2
lea rdx, [0x18031228c]
lea rcx, [rbp - 0x30]
call fcn.1800052d0
nop
lea r9, [rbp - 0x50]
lea r8, [rbp - 0x30]
movzx edx, byte [rbp - 0x58]
lea rcx, [rsp + 0x60]
call fcn.180016e20
lea rcx, [0x18037c5e0]
call fcn.180005250
movups xmm0, xmmword [rsp + 0x60]
movups xmmword [0x18037c5e0], xmm0
movups xmm1, xmmword [rsp + 0x70]
movups xmmword [0x18037c5f0], xmm1
movdqa xmm0, xmmword [0x180316dd0]
movdqu xmmword [rsp + 0x70], xmm0
mov byte [rsp + 0x60], 0
lea rcx, [rsp + 0x60]
call fcn.180005250
nop
lea rcx, [rbp - 0x30]
call fcn.180005250
nop
lea rcx, [rbp - 0x50]
call fcn.180005250
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x30], 0
lea rax, [rbp + 0x860]
mov r8, rdi
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180011560
lea rdx, [rbp + 0x860]
lea rcx, [rbp - 0x30]
call fcn.1800052d0
nop
mov byte [rsp + 0x50], 0x35
mov al, 0x70
mov cl, 0x47
movzx edx, cl
mov r8b, 0x5a
movzx r9d, cl
mov r10b, reloc.WS2_32.dll_setsockopt
mov r11b, 5
mov bl, 0x4d
xor r12d, r12d
xor al, 0x35
mov byte [rsp + 0x51], al
xor cl, 0x35
mov byte [rsp + 0x52], cl
xor dl, 0x35
mov byte [rsp + 0x53], dl
xor r8b, 0x35
mov byte [rsp + 0x54], r8b
xor r9b, 0x35
mov byte [rsp + 0x55], r9b
xor r10b, 0x35
mov byte [rsp + 0x56], r10b
xor r11b, 0x35
mov byte [rsp + 0x57], r11b
xor bl, 0x35
mov byte [rsp + 0x58], bl
mov byte [rsp + 0x59], r12b
lea rax, [rsp + 0x51]
inc rdi
cmp byte [rax + rdi], r12b
jne 0x1800115e2
mov r9, rdi
lea r8, [rsp + 0x51]
xor edx, edx
lea rcx, [rbp - 0x30]
call fcn.18000a090
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x40], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], r12b
lea rcx, [rbp - 0x50]
call fcn.180037aa0
nop
lea rcx, [rbp - 0x30]
call fcn.180005250
xor edx, edx
mov rcx, qword [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
lea rcx, [rbp + 0xd0]
call fcn.18000db90
jmp 0x1800116f7
mov dword [0x18037c330], 3
mov byte [rsp + 0x50], 0x79
mov al, 0x2a
mov cl, reloc.WS2_32.dll_inet_ntoa
mov dl, 0x1a
movzx r8d, dl
mov r9b, 0x1c
mov r10b, 0xa
movzx r11d, r10b
xor ebx, ebx
xor al, 0x79
mov byte [rsp + 0x51], al
xor cl, 0x79
mov byte [rsp + 0x52], cl
xor dl, 0x79
mov byte [rsp + 0x53], dl
xor r8b, 0x79
mov byte [rsp + 0x54], r8b
xor r9b, 0x79
mov byte [rsp + 0x55], r9b
xor r10b, 0x79
mov byte [rsp + 0x56], r10b
xor r11b, 0x79
mov byte [rsp + 0x57], r11b
mov byte [rsp + 0x58], bl
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x50], bl
lea rax, [rsp + 0x51]
nop dword [rax]
inc rdi
cmp byte [rax + rdi], bl
jne 0x1800116d0
mov r8, rdi
lea rdx, [rsp + 0x51]
lea rcx, [rbp - 0x50]
call fcn.1800052d0
lea rcx, [rbp - 0x50]
call fcn.180037aa0
mov esi, 1
lea rcx, [rbp + 0x160]
call fcn.1800495d0
nop
cmp byte [rbp + 0x10], 0
je 0x180011714
lea rcx, [rbp]
call fcn.180016d70
nop
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x18001175a
mov rdx, qword [rbp + 0x50]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180011749
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800117de
call fcn.18007b164
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], r12
lea rcx, [rbp + 0x98]
call fcn.180005250
nop
lea rcx, [rbp + 0x160]
call fcn.180048fd0
nop
lea rcx, [rbp + 0x78]
call fcn.18000db90
nop
lea rcx, [rbp + 0x4e0]
call fcn.180048fd0
nop
lea rcx, [rbp + 0x58]
call fcn.18000db90
nop
mov rcx, r13
call fcn.18000db90
nop
mov rcx, qword [rbp - 0x10]
call fcn.18000db90
nop
mov rcx, r15
call fcn.1800b5e30
nop
mov rcx, r14
call fcn.180005250
mov eax, esi
mov rcx, qword [rbp + 0x1870]
xor rcx, rsp
call fcn.18007b140
add rsp, 0x1988
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.18021e9c0
nop
call fcn.180002140
int3
call fcn.180002140
int3
call fcn.18021e9c0
int3