Function at 0x140036794
Capabilities:
Create process on windows
Initialize winsock library

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x3e8]
sub rsp, 0x4c0
mov rax, qword [0x1400a5080]
xor rax, rsp
mov qword [rbp + 0x3b0], rax
xor r13d, r13d
lea rcx, [rbp + 0x170]
call fcn.14002e148
nop
lea rcx, [rbp + 0x30]
call fcn.14002c644
nop
lea rcx, [rbp + 0x150]
call fcn.14002cd70
nop
lea rcx, [rbp - 0x50]
call fcn.14002ba1c
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
mov qword [rbp + 0x80], r13
mov qword [rbp + 0x88], r13
lea r8d, [r13 + 0x20]
lea rdx, str.https:__apientitydev.duckdns.org
lea rcx, [rbp + 0x70]
call fcn.1400011ec
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x130], xmm0
movdqa xmm1, xmmword [0x140070e70]
movdqu xmmword [rbp + 0x140], xmm1
mov word [rbp + 0x130], 0x31
movups xmmword [rbp + 0x110], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x120], xmm1
lea rdx, [rbp - 0x50]
lea edi, [r13 + 0xf]
cmp qword [rbp - 0x38], rdi
cmova rdx, qword [rbp - 0x50]
mov r8, qword [rbp - 0x40]
lea rcx, [rbp + 0x110]
call fcn.1400046a8
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xf0], xmm0
movdqa xmm1, xmmword [0x140070e80]
movdqu xmmword [rbp + 0x100], xmm1
mov eax, dword [str.Radar]
mov dword [rbp + 0xf0], eax
mov al, byte [0x140070458]
mov byte [rbp + 0xf4], al
mov byte [rbp + 0xf5], r13b
movabs rbx, 0x7fffffffffffffff
mov rax, rbx
mov rcx, qword [rbp - 0x40]
sub rax, rcx
cmp rax, 6
jb 0x140037644
lea rax, [rbp - 0x50]
cmp qword [rbp - 0x38], rdi
cmova rax, qword [rbp - 0x50]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 6
lea r9, str.UUID:
lea r8, [rbp - 0x50]
mov dl, byte [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.14001ab14
nop
lea r8d, [r13 + 0x16]
lea rdx, str.__Motherboard_Serial:
lea rcx, [rsp + 0x48]
call fcn.140028278
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x60], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], rdi
mov byte [rax], r13b
lea rdx, [rbp + 0x170]
cmp qword [rbp + 0x188], rdi
cmova rdx, qword [rbp + 0x170]
mov r8, qword [rbp + 0x180]
lea rcx, [rbp - 0x70]
call fcn.140028278
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x20], xmm1
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], r13
mov byte [rax], r13b
lea r8d, [r13 + 0xa]
lea rdx, str.__CPU_ID:
lea rcx, [rbp - 0x30]
call fcn.140028278
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], rdi
mov byte [rax], r13b
lea rdx, [rbp + 0x30]
cmp qword [rbp + 0x48], rdi
cmova rdx, qword [rbp + 0x30]
mov r8, qword [rbp + 0x40]
lea rcx, [rbp - 0x10]
call fcn.140028278
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x20], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x20], xmm1
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], r13
mov byte [rax], r13b
lea r8d, [r13 + 0x15]
lea rdx, str.__Hard_Drive_Serial:
lea rcx, [rbp + 0x10]
call fcn.140028278
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x80], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], rdi
mov byte [rax], r13b
lea rdx, [rbp + 0x150]
cmp qword [rbp + 0x168], rdi
cmova rdx, qword [rbp + 0x150]
mov r8, qword [rbp + 0x160]
lea rcx, [rsp + 0x70]
call fcn.140028278
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x60], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], rdi
mov byte [rax], r13b
mov esi, 0x1000
mov rdx, qword [rbp - 0x78]
cmp rdx, rdi
jbe 0x140036ae6
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, rsi
jb 0x140036ae1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003764a
call fcn.14003a728
movdqa xmm0, xmmword [0x1400689c0]
movdqu xmmword [rbp - 0x80], xmm0
mov byte [rsp + 0x70], r13b
mov rdx, qword [rbp + 0x28]
cmp rdx, rdi
jbe 0x140036b2e
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, rsi
jb 0x140036b29
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140037650
call fcn.14003a728
movdqa xmm0, xmmword [0x1400689c0]
movdqu xmmword [rbp + 0x20], xmm0
mov byte [rbp + 0x10], r13b
mov rdx, qword [rbp + 8]
cmp rdx, rdi
jbe 0x140036b75
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, rsi
jb 0x140036b70
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140037656
call fcn.14003a728
movdqa xmm0, xmmword [0x1400689c0]
movdqu xmmword [rbp], xmm0
mov byte [rbp - 0x10], r13b
mov rdx, qword [rbp - 0x18]
cmp rdx, rdi
jbe 0x140036bbc
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, rsi
jb 0x140036bb7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003765c
call fcn.14003a728
movdqa xmm0, xmmword [0x1400689c0]
movdqu xmmword [rbp - 0x20], xmm0
mov byte [rbp - 0x30], r13b
mov rdx, qword [rbp - 0x58]
cmp rdx, rdi
jbe 0x140036c03
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, rsi
jb 0x140036bfe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140037662
call fcn.14003a728
movdqa xmm0, xmmword [0x1400689c0]
movdqu xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x70], r13b
mov rdx, qword [rsp + 0x60]
cmp rdx, rdi
jbe 0x140036c4c
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, rsi
jb 0x140036c47
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140037668
call fcn.14003a728
movdqa xmm0, xmmword [0x1400689c0]
movdqu xmmword [rsp + 0x58], xmm0
mov byte [rsp + 0x48], r13b
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
mov qword [rbp + 0xe0], r13
mov qword [rbp + 0xe8], r13
mov r8d, 0x1c2
lea rdx, str._____BEGIN_PUBLIC_KEY______nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAo1jJsCeMJ_2Pin6WPpS_nbC_4XM5eOL1JEbXGETW2KxYx7maNZ00J5we4VyGXBtIMUYPks4Fxs2aaIPr9af_nBZIU6bN611tEXsP8gktwmgieUA62nKdWXw8gTlegcyCfYOY79glMUus831Tmttu_nAOb2K7ratCW94VB5URwgBdW9XEJzgS1zXnQnwtfSBkVYmOptG9Ho7t3WuLHR6ck_n6MvxqMUWTnFezGk7ocMeHu87wJthKVFrgMQhMFK29XLlaKivGlaVXt5V9QgSh5V_nxpeqkheeFu9YcQte7k35CCDRMuoRZmFLk5JWXkinpeYW9SRn_eOAcjK1ESyLz6Y_nYwIDAQAB_n_____END_PUBLIC_KEY_____
lea rcx, [rbp + 0xd0]
call fcn.1400011ec
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xa0], xmm1
lea r15, [rbp + 0x70]
mov r12, qword [rbp + 0x70]
cmp qword [rbp + 0x88], rdi
cmova r15, r12
mov rsi, qword [rbp + 0x80]
cmp rsi, rbx
ja 0x14003766e
movabs r14, 0x8000000000000000
cmp rsi, rdi
ja 0x140036cf4
mov qword [rbp + 0xa0], rsi
mov qword [rbp + 0xa8], rdi
movups xmm0, xmmword [r15]
movdqu xmmword [rbp + 0x90], xmm0
jmp 0x140036d60
mov rdi, rsi
or rdi, 0xf
cmp rdi, rbx
jbe 0x140036d08
mov rdi, rbx
mov rcx, r14
jmp 0x140036d21
mov eax, socket
cmp rdi, rax
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140036d28
call fcn.1400011b0
jmp 0x140036d37
test rcx, rcx
je 0x140036d34
call fcn.14003a6ec
jmp 0x140036d37
mov rax, r13
mov qword [rbp + 0x90], rax
mov qword [rbp + 0xa0], rsi
mov qword [rbp + 0xa8], rdi
lea r8, [rsi + 1]
mov rdx, r15
mov rcx, rax
call fcn.140065560
mov edi, recv
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xc0], xmm1
lea rsi, [rbp + 0xd0]
mov r15, qword [rbp + 0xd0]
mov r13, qword [rbp + 0xe8]
cmp r13, rdi
cmova rsi, r15
mov rdi, qword [rbp + 0xe0]
cmp rdi, rbx
ja 0x140037674
cmp rdi, 0xf
ja 0x140036dc7
mov qword [rbp + 0xc0], rdi
mov edi, recv
mov qword [rbp + 0xc8], rdi
movups xmm0, xmmword [rsi]
movdqu xmmword [rbp + 0xb0], xmm0
jmp 0x140036e33
mov rax, rdi
or rax, 0xf
cmp rax, rbx
ja 0x140036def
mov rbx, rax
mov ecx, socket
cmp rax, rcx
cmovb rbx, rcx
lea r14, [rbx + 1]
cmp r14, 0x1000
jb 0x140036df9
mov rcx, r14
call fcn.1400011b0
jmp 0x140036e0a
test r14, r14
je 0x140036e08
mov rcx, r14
call fcn.14003a6ec
jmp 0x140036e0a
xor eax, eax
mov qword [rbp + 0xb0], rax
mov qword [rbp + 0xc0], rdi
mov qword [rbp + 0xc8], rbx
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call fcn.140065560
mov edi, recv
lea rax, [rbp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xf0]
lea r8, [rbp + 0x110]
lea rdx, [rbp + 0x130]
lea rcx, [rbp + 0x90]
call fcn.1400355f4
xor r14d, r14d
test al, al
jne 0x140036e6c
mov bl, r14b
jmp 0x140037249
mov r8b, r14b
lea rbx, str.D:_ambackup
mov rdx, rbx
lea rcx, [rbp - 0x70]
call fcn.140004da4
nop
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x70]
call fcn.14002b53c
nop
lea rdx, [rsp + 0x48]
mov rcx, rax
call fcn.1400352fc
nop
lea rcx, [rbp - 0x30]
call fcn.140026a00
nop
lea rcx, [rbp - 0x70]
call fcn.140026a00
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], rdi
cmova rdx, qword [rsp + 0x48]
lea rcx, str.__s___dllmain.cpp__RST_started__n_n
call fcn.1400376b0
lea rcx, [rsp + 0x48]
call fcn.140001b4c
call fcn.1400338d8
test al, al
jne 0x140036f2f
mov r8b, r14b
mov rdx, rbx
lea rcx, [rbp - 0x70]
call fcn.140004da4
nop
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x70]
call fcn.14002b53c
nop
lea rdx, [rsp + 0x48]
mov rcx, rax
call fcn.1400352fc
nop
lea rcx, [rbp - 0x30]
call fcn.140026a00
nop
lea rcx, [rbp - 0x70]
call fcn.140026a00
mov r8d, 0x145
lea rcx, str.__s:_d__failed_to_setup_cs2_n
jmp 0x140036fa8
xor edx, edx
mov r8d, 0x198
lea rcx, [rbp + 0x210]
call fcn.140065c00
mov ecx, 0x202
lea rdx, [rbp + 0x210]
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x140036fe4
mov r8b, r14b
mov rdx, rbx
lea rcx, [rbp - 0x70]
call fcn.140004da4
nop
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x70]
call fcn.14002b53c
nop
lea rdx, [rsp + 0x48]
mov rcx, rax
call fcn.1400352fc
nop
lea rcx, [rbp - 0x30]
call fcn.140026a00
nop
lea rcx, [rbp - 0x70]
call fcn.140026a00
mov r8d, 0x14e
lea rcx, str.__s:_d__failed_to_initialize_winsock_n
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], rdi
cmova rdx, qword [rsp + 0x48]
call fcn.1400376b0
lea rcx, [rsp + 0x48]
call fcn.140001b4c
mov qword [rsp + 0x70], 5
lea rcx, [rsp + 0x70]
call fcn.140019834
mov ebx, 1
jmp 0x140037249
lea rcx, [rbp - 0x30]
call fcn.14002d114
nop
cmp qword [rbp - 0x20], r14
jne 0x140037011
mov qword [rsp + 0x70], 5
lea rcx, [rsp + 0x70]
call fcn.140019834
mov ebx, 1
jmp 0x14003723f
lea rax, str.ws:__rstapimapcs2.duckdns.org:22006_register_
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 0x2f
lea r8, [rbp - 0x50]
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x1f0]
call fcn.140015278
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
movdqa xmm1, xmmword [0x1400689c0]
movdqu xmmword [rsp + 0x58], xmm1
mov byte [rsp + 0x48], r14b
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x1f0]
call fcn.140002ce4
mov rbx, rax
lea rcx, [rsp + 0x48]
call fcn.140001b4c
test rbx, rbx
jne 0x140037097
mov qword [rsp + 0x70], 5
lea rcx, [rsp + 0x70]
call fcn.140019834
mov ebx, 1
jmp 0x140037232
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x30]
lea rax, str.ws:__rstapimapcs2.duckdns.org:22006_keepalive_
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 0x30
lea r8, [rbp - 0x50]
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x1d0]
call fcn.140015278
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
movdqa xmm1, xmmword [0x1400689c0]
movdqu xmmword [rsp + 0x58], xmm1
mov byte [rsp + 0x48], r14b
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x1d0]
call fcn.140002ce4
mov rbx, rax
mov rdx, qword [rsp + 0x60]
cmp rdx, rdi
jbe 0x140037136
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140037131
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003767a
call fcn.14003a728
test rbx, rbx
jne 0x140037158
mov qword [rsp + 0x70], 5
lea rcx, [rsp + 0x70]
call fcn.140019834
mov ebx, 1
jmp 0x140037225
lea rax, str.ws:__rstapimapcs2.duckdns.org:22006_rst_
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 0x2a
lea r8, [rbp - 0x50]
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x190]
call fcn.140015278
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [0x1400689c0]
movdqu xmmword [rbp - 0x60], xmm1
mov byte [rbp - 0x70], r14b
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x190]
call fcn.140002ce4
mov rsi, rax
mov rdx, qword [rbp - 0x58]
cmp rdx, rdi
jbe 0x1400371e8
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400371e3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140037680
call fcn.14003a728
movdqa xmm0, xmmword [0x1400689c0]
movdqu xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x70], r14b
test rsi, rsi
jne 0x1400374ac
mov qword [rsp + 0x70], 5
lea rcx, [rsp + 0x70]
call fcn.140019834
lea ebx, [rsi + 1]
lea rcx, [rbp + 0x190]
call fcn.140001b4c
nop
lea rcx, [rbp + 0x1d0]
call fcn.140001b4c
nop
lea rcx, [rbp + 0x1f0]
call fcn.140001b4c
nop
lea rcx, [rbp - 0x30]
call fcn.140001b4c
nop
lea rcx, [rbp + 0x90]
call fcn.14001c8b8
nop
mov esi, 0x1000
cmp r13, rdi
jbe 0x14003728e
lea rdx, [r13 + 1]
mov rax, r15
cmp rdx, rsi
jb 0x140037285
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140037686
mov rcx, r15
call fcn.14003a728
nop
mov rdx, qword [rbp + 0x68]
cmp rdx, rdi
jbe 0x1400372c4
inc rdx
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, rsi
jb 0x1400372bf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003768c
call fcn.14003a728
movdqa xmm0, xmmword [0x1400689c0]
movdqu xmmword [rbp + 0x60], xmm0
mov byte [rbp + 0x50], r14b
mov rdx, qword [rbp + 0x108]
cmp rdx, rdi
jbe 0x140037312
inc rdx
mov rcx, qword [rbp + 0xf0]
mov rax, rcx
cmp rdx, rsi
jb 0x14003730c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140037692
call fcn.14003a728
nop
mov rdx, qword [rbp + 0x128]
cmp rdx, rdi
jbe 0x14003734e
inc rdx
mov rcx, qword [rbp + 0x110]
mov rax, rcx
cmp rdx, rsi
jb 0x140037349
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140037698
call fcn.14003a728
movdqa xmm0, xmmword [0x1400689c0]
movdqu xmmword [rbp + 0x120], xmm0
mov byte [rbp + 0x110], r14b
mov rdx, qword [rbp + 0x148]
cmp rdx, rdi
jbe 0x1400373a2
inc rdx
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, rsi
jb 0x14003739c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003769e
call fcn.14003a728
nop
mov rax, qword [rbp + 0x88]
cmp rax, rdi
jbe 0x1400373dd
lea rdx, [rax + 1]
mov rax, r12
cmp rdx, rsi
jb 0x1400373d4
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400376a4
mov rcx, r12
call fcn.14003a728
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, rdi
jbe 0x140037413
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, rsi
jb 0x14003740e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400376aa
call fcn.14003a728
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x38], rdi
mov byte [rbp - 0x50], r14b
lea rcx, [rbp + 0x150]
call fcn.140001b4c
nop
mov rdx, qword [rbp + 0x48]
cmp rdx, rdi
jbe 0x140037462
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, rsi
jb 0x14003745d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003763e
call fcn.14003a728
mov qword [rbp + 0x40], r14
mov qword [rbp + 0x48], rdi
mov byte [rbp + 0x30], r14b
lea rcx, [rbp + 0x170]
call fcn.140001b4c
mov al, bl
mov rcx, qword [rbp + 0x3b0]
xor rcx, rsp
call fcn.14003aae0
lea r11, [rsp + 0x4c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov r8b, r14b
lea rdx, str.D:_ambackup
lea rcx, [rbp - 0x10]
call fcn.140004da4
nop
lea rdx, [rbp + 0x10]
lea rcx, [rbp - 0x10]
call fcn.14002b53c
nop
lea rdx, [rsp + 0x48]
mov rcx, rax
call fcn.1400352fc
nop
lea rcx, [rbp + 0x10]
call fcn.140026a00
nop
lea rcx, [rbp - 0x10]
call fcn.140026a00
lea r8, [rbp + 0x190]
cmp qword [rbp + 0x1a8], rdi
cmova r8, qword [rbp + 0x190]
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], rdi
cmova rdx, qword [rsp + 0x48]
lea rcx, str.__s__Successful_connection_to_the_socket_n
call fcn.1400376b0
lea rcx, [rsp + 0x48]
call fcn.140001b4c
lea r8, [rbp - 0x50]
lea rdx, str.https:__rstmapcs2.duckdns.org_map_
lea rcx, [rbp + 0x1b0]
call fcn.140003d38
nop
lea rdx, str.Link:
lea rcx, [0x1400a7650]
call fcn.1400039f0
mov rcx, rax
lea rdx, [rbp + 0x1b0]
call fcn.1400039dc
mov rcx, rax
call fcn.140014f10
lea r8, [rbp + 0x1b0]
cmp qword [rbp + 0x1c8], rdi
cmova r8, qword [rbp + 0x1b0]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
call fcn.140037f78
mov rbx, rax
mov r15d, 0xf4240
call fcn.140037f78
mov rcx, rax
sub rcx, rbx
cmp rcx, r15
je 0x1400375c2
jl 0x14003762e
mov rbx, rax
lea rcx, [0x1400a73a8]
call fcn.14003206c
mov rax, qword [rsi]
mov rdi, qword [rax + 0x10]
lea rdx, [0x1400a73a8]
lea rcx, [rsp + 0x70]
call fcn.14001a734
nop
mov dword [rsp + 0x28], r14d
mov byte [rsp + 0x20], r14b
mov r9b, 0x20
or r8d, 0xffffffff
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x70]
call fcn.140029b08
nop
mov rdx, rax
mov rcx, rsi
call rdi
nop
lea rcx, [rsp + 0x48]
call fcn.140001b4c
nop
mov dl, byte [rsp + 0x70]
lea rcx, [rsp + 0x78]
call fcn.140028984
nop
mov rax, qword [rsi]
xor edx, edx
mov rcx, rsi
call qword [rax + ioctlsocket]
jmp 0x1400375b0
call fcn.14004147c
nop
call fcn.140001fe0
nop
call fcn.14004147c
nop
call fcn.14004147c
nop
call fcn.14004147c
nop
call fcn.14004147c
nop
call fcn.14004147c
nop
call fcn.14004147c
nop
call fcn.140001fe0
nop
call fcn.140001fe0
nop
call fcn.14004147c
nop
call fcn.14004147c
nop
call fcn.14004147c
nop
call fcn.14004147c
nop
call fcn.14004147c
nop
call fcn.14004147c
nop
call fcn.14004147c
nop
call fcn.14004147c
nop
call fcn.14004147c
int3