Function at 0x1400abfb0
Capabilities:
Create process on windows
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x2f8]
sub rsp, 0x3d0
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [0x1403ce5a0]
xor rax, rsp
mov qword [rbp + 0x2a8], rax
mov r13, rcx
xor r12d, r12d
lea rcx, [rsp + 0x68]
call fcn.1400aae30
nop
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.1400aa760
mov rbx, rax
lea r14, [r13 + 0x108]
cmp r14, rax
je 0x1400ac084
mov rdx, qword [r14 + 0x18]
cmp rdx, 0x10
jb 0x1400ac055
mov rcx, qword [r14]
inc rdx
cmp rdx, 0x1000
jb 0x1400ac050
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400ad124
mov rcx, r8
call fcn.1402615d0
mov qword [r14 + 0x10], r12
mov qword [r14 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r14], 0
movups xmm0, xmmword [rbx]
movups xmmword [r14], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [r14 + 0x10], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x1400ac0bf
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ac0ba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ad124
call fcn.1402615d0
movdqa xmm0, xmmword [0x14039fb00]
movdqu xmmword [rbp - 0x68], xmm0
mov byte [rbp - 0x78], 0
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x1400ac10c
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ac107
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ad12a
call fcn.1402615d0
cmp qword [r13 + 0x30], 0xa
jne 0x1400ad103
cmp qword [r13 + 0x50], 0x40
jne 0x1400ad103
lea rax, [rbp + 0x1f8]
mov qword [rbp + 0x178], rax
lea rax, [rbp + 0x218]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x180]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x158]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0xeff3f7f1
mov word [rsp + 0x34], 0x100
mov rcx, r12
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx - 0x68]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 4
jb 0x1400ac170
mov byte [rsp + 0x35], 0
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 8], xmm1
lea rax, [rsp + 0x30]
mov rsi, 0xffffffffffffffff
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x1400ac1a3
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 8]
call fcn.1400b90d0
nop
lea rdx, [r13 + 0x20]
lea rcx, [rsp + 0x68]
call fcn.1400aab90
mov r12, rax
mov rdx, r13
lea rcx, [rbp + 0x138]
call fcn.1400aab90
mov r15, rax
lea rdx, [0x1403d8598]
lea rcx, [rbp + 0x1f8]
call fcn.1400b6390
mov rdi, rax
lea rdx, [r13 + 0x40]
lea rcx, [rbp + 0x218]
call fcn.1400b6390
mov rbx, rax
mov rdx, r14
lea rcx, [rbp + 0x1b8]
call fcn.1400b6390
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x118]
call fcn.1400aafb0
mov r14, rax
lea rdx, [0x1403d8598]
lea rcx, [rbp + 0x180]
call fcn.1400b6390
mov rdi, rax
lea rdx, [r13 + 0x40]
lea rcx, [rbp + 0x158]
call fcn.1400b6390
mov rbx, rax
lea rdx, [r13 + 0x60]
lea rcx, [rbp + 0x268]
call fcn.1400b6390
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0xf8]
call fcn.1400aafb0
mov rbx, rax
lea rdx, [rbp - 8]
lea rcx, [rbp + 0xd8]
call fcn.1400aab90
mov r10, rax
mov dword [rsp + 0x30], 0xfeeae0ec
mov word [rsp + 0x34], 0xa1
mov byte [rsp + 0x36], 1
xor edi, edi
mov ecx, edi
nop dword [rax]
lea eax, [rcx - 0x68]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 5
jb 0x1400ac2b0
mov byte [rsp + 0x36], dil
lea rax, [rsp + 0x30]
mov r9, rsi
nop dword [rax]
inc r9
cmp byte [rax + r9], dil
jne 0x1400ac2d0
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, r10
call fcn.1400b7ae0
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x28], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x28], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], dil
mov dword [rsp + 0x30], 0xe9ffefbe
mov word [rsp + 0x34], 0xa1
mov byte [rsp + 0x36], 1
mov rcx, rdi
nop dword [rax]
lea eax, [rcx - 0x68]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 5
jb 0x1400ac330
mov byte [rsp + 0x36], 0
lea rax, [rsp + 0x30]
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400ac350
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x38]
call fcn.1400b6260
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xb8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xc8], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, rbx
lea r8, [rbp + 0xb8]
lea rcx, [rbp - 0x78]
call fcn.1400ba5a0
nop
mov dword [rsp + 0x38], 0xf8f4fcbe
mov dword [rsp + 0x3c], 0xa2e7f8f7
mov word [rsp + 0x40], 0x100
mov rcx, rdi
nop word [rax + rax]
lea eax, [rcx - 0x68]
xor byte [rsp + rcx + 0x38], al
inc rcx
cmp rcx, 8
jb 0x1400ac3c0
mov byte [rsp + 0x41], 0
lea rax, [rsp + 0x38]
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400ac3e0
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x78]
call fcn.1400b6260
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x98], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xa8], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, r14
lea r8, [rbp + 0x98]
lea rcx, [rbp + 0x58]
call fcn.1400ba5a0
nop
mov dword [rsp + 0x30], 0xf6fbf7be
mov dword [rsp + 0x34], 0x100a0f9
mov rcx, rdi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x68]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 6
jb 0x1400ac450
mov byte [rsp + 0x37], 0
lea rax, [rsp + 0x30]
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400ac470
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x58]
call fcn.1400b6260
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x88], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, r15
lea r8, [rbp + 0x78]
lea rcx, [rbp + 0x38]
call fcn.1400ba5a0
nop
mov dword [rsp + 0x38], 0xf5edf6be
mov dword [rsp + 0x3c], 0xfbf7eff9
mov word [rsp + 0x40], 0x9d
mov byte [rsp + 0x42], 1
mov rcx, rdi
nop dword [rax]
lea eax, [rcx - 0x68]
xor byte [rsp + rcx + 0x38], al
inc rcx
cmp rcx, 9
jb 0x1400ac4e0
mov byte [rsp + 0x42], 0
lea rax, [rsp + 0x38]
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400ac500
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x38]
call fcn.1400b6260
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, r12
lea r8, [rsp + 0x48]
lea rcx, [rbp + 0x18]
call fcn.1400ba5a0
nop
mov dword [rsp + 0x38], 0xf2f4f0be
mov dword [rsp + 0x3c], 0xe9f7c2e8
mov word [rsp + 0x40], 0x9d
mov byte [rsp + 0x42], 1
mov rcx, rdi
nop dword [rax]
lea eax, [rcx - 0x68]
xor byte [rsp + rcx + 0x38], al
inc rcx
cmp rcx, 9
jb 0x1400ac570
mov byte [rsp + 0x42], 0
lea rax, [rsp + 0x38]
nop word [rax + rax]
inc rsi
cmp byte [rax + rsi], 0
jne 0x1400ac590
mov r8, rsi
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x18]
call fcn.1400b6260
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x48], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x48], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rdx, [0x1403d8598]
cmp qword [0x1403d85b0], 0x10
cmovae rdx, qword [0x1403d8598]
mov r8, qword [0x1403d85a8]
lea rcx, [rbp - 0x58]
call fcn.1400b6260
movups xmm7, xmmword [rax]
movups xmmword [rbp + 0x288], xmm7
movups xmm6, xmmword [rax + 0x10]
movups xmmword [rbp + 0x298], xmm6
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x1400ac65d
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ac658
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ad130
call fcn.1402615d0
movdqa xmm0, xmmword [0x14039fb00]
movdqu xmmword [rbp - 0x48], xmm0
mov byte [rbp - 0x58], 0
mov rdx, qword [rbp + 0x30]
cmp rdx, 0x10
jb 0x1400ac6a9
inc rdx
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ac6a4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ad136
call fcn.1402615d0
movdqa xmm0, xmmword [0x14039fb00]
movdqu xmmword [rbp + 0x28], xmm0
mov byte [rbp + 0x18], 0
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x1400ac6f8
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ac6f2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ad13c
call fcn.1402615d0
nop
mov rdx, qword [rbp + 0x50]
cmp rdx, 0x10
jb 0x1400ac733
inc rdx
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ac72e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ad142
call fcn.1402615d0
movdqa xmm0, xmmword [0x14039fb00]
movdqu xmmword [rbp + 0x48], xmm0
mov byte [rbp + 0x38], 0
mov rdx, qword [rbp + 0x90]
cmp rdx, 0x10
jb 0x1400ac783
inc rdx
mov rcx, qword [rbp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ac77d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ad148
call fcn.1402615d0
nop
mov rdx, qword [rbp + 0x70]
cmp rdx, 0x10
jb 0x1400ac7be
inc rdx
mov rcx, qword [rbp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ac7b9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ad14e
call fcn.1402615d0
movdqa xmm0, xmmword [0x14039fb00]
movdqu xmmword [rbp + 0x68], xmm0
mov byte [rbp + 0x58], 0
mov rdx, qword [rbp + 0xb0]
cmp rdx, 0x10
jb 0x1400ac811
inc rdx
mov rcx, qword [rbp + 0x98]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ac80b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ad154
call fcn.1402615d0
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x1400ac84c
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ac847
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ad15a
call fcn.1402615d0
movdqa xmm0, xmmword [0x14039fb00]
movdqu xmmword [rbp - 0x68], xmm0
mov byte [rbp - 0x78], 0
mov rdx, qword [rbp + 0xd0]
cmp rdx, 0x10
jb 0x1400ac89f
inc rdx
mov rcx, qword [rbp + 0xb8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ac899
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ad160
call fcn.1402615d0
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x1400ac8da
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ac8d5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ad166
call fcn.1402615d0
movdqa xmm0, xmmword [0x14039fb00]
movdqu xmmword [rbp - 0x28], xmm0
mov byte [rbp - 0x38], 0
mov rdx, qword [rbp + 0xf0]
cmp rdx, 0x10
jb 0x1400ac92c
inc rdx
mov rcx, qword [rbp + 0xd8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ac927
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ad16c
call fcn.1402615d0
movdqa xmm0, xmmword [0x14039fb00]
movdqu xmmword [rbp + 0xe8], xmm0
mov byte [rbp + 0xd8], 0
mov rdx, qword [rbp + 0x110]
cmp rdx, 0x10
jb 0x1400ac984
inc rdx
mov rcx, qword [rbp + 0xf8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ac97f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ad172
call fcn.1402615d0
movdqa xmm0, xmmword [0x14039fb00]
movdqu xmmword [rbp + 0x108], xmm0
mov byte [rbp + 0xf8], 0
mov rdx, qword [rbp + 0x130]
cmp rdx, 0x10
jb 0x1400ac9dc
inc rdx
mov rcx, qword [rbp + 0x118]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ac9d7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ad178
call fcn.1402615d0
movdqa xmm0, xmmword [0x14039fb00]
movdqu xmmword [rbp + 0x128], xmm0
mov byte [rbp + 0x118], 0
mov rdx, qword [rbp + 0x150]
cmp rdx, 0x10
jb 0x1400aca34
inc rdx
mov rcx, qword [rbp + 0x138]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400aca2f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ad17e
call fcn.1402615d0
movdqa xmm0, xmmword [0x14039fb00]
movdqu xmmword [rbp + 0x148], xmm0
mov byte [rbp + 0x138], 0
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x1400aca87
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400aca82
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ad184
call fcn.1402615d0
movdqa xmm0, xmmword [0x14039fb00]
movdqu xmmword [rsp + 0x78], xmm0
mov byte [rsp + 0x68], 0
mov rdx, qword [rbp + 0x10]
cmp rdx, 0x10
jb 0x1400acad5
inc rdx
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400acad0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ad18a
call fcn.1402615d0
movdqa xmm0, xmmword [0x14039fb00]
movdqu xmmword [rbp + 8], xmm0
mov byte [rbp - 8], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdi
lea r14, [rbp + 0x288]
movq rsi, xmm7
movdqa xmm0, xmm6
psrldq xmm0, 8
movq r15, xmm0
cmp r15, 0x10
cmovae r14, rsi
movabs rbx, 0x7fffffffffffffff
movq rdi, xmm6
cmp rdi, rbx
ja 0x1400ad190
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
cmp rdi, 0x10
jae 0x1400acb57
mov qword [rsp + 0x58], rdi
movups xmm0, xmmword [r14]
movups xmmword [rsp + 0x48], xmm0
xor r12d, r12d
jmp 0x1400acbf4
mov rax, rdi
or rax, 0xf
cmp rax, rbx
jbe 0x1400acb96
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140261c28
mov rcx, rax
test rax, rax
je 0x1400ad196
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
xor r12d, r12d
jmp 0x1400acbd6
mov rbx, rax
mov ecx, reloc.WS2_32.dll_shutdown
cmp rax, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400acbc1
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400ad0ac
jmp 0x1400acb71
test rcx, rcx
je 0x1400acbd0
call fcn.140261c28
xor r12d, r12d
jmp 0x1400acbd6
xor r12d, r12d
mov eax, r12d
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rbx
lea r8, [rdi + 1]
mov rdx, r14
mov rcx, rax
call fcn.140264d60
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x248]
call fcn.1400b01c0
nop
lea rax, [rbp + 0x268]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x158]
mov qword [rbp - 0x10], rax
lea rdx, [0x1403d8598]
lea rcx, [rbp + 0x268]
call fcn.1400b6390
mov rdi, rax
lea rdx, [r13 + 0x40]
lea rcx, [rbp + 0x158]
call fcn.1400b6390
mov rbx, rax
lea rdx, [rbp + 0x248]
lea rcx, [rbp + 0x180]
call fcn.1400b6390
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.1400ab360
mov rbx, rax
lea rax, [rbp + 0x248]
cmp rax, rbx
je 0x1400accf8
mov rdx, qword [rbp + 0x260]
cmp rdx, 0x10
jb 0x1400accbd
inc rdx
mov rcx, qword [rbp + 0x248]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400accb8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ad19c
call fcn.1402615d0
movdqa xmm0, xmmword [0x14039fb00]
movdqu xmmword [rbp + 0x258], xmm0
mov byte [rbp + 0x248], 0
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x248], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x258], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x1400acd34
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400acd2f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ad19c
call fcn.1402615d0
mov qword [rbp + 0x1f0], r12
lea r8, [rbp + 0x1b8]
lea rdx, [rbp + 0x248]
lea rcx, [rbp + 0x238]
call fcn.1400b8940
nop
lea rdx, str.success
lea rcx, [rbp + 0x238]
call fcn.1400b8a60
cmp byte [rax], 4
jne 0x1400ad1a2
lea rcx, [rbp + 0x238]
cmp byte [rax + 8], 0
je 0x1400acf37
lea rdx, str.sessionid
call fcn.1400b8a60
mov rcx, rax
lea rdx, [rsp + 0x68]
call fcn.1400b8d20
mov rdi, rax
lea rbx, [r13 + 0xe8]
cmp rbx, rax
je 0x1400ace11
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1400acde5
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x1400acde0
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400ad1f9
mov rcx, r8
call fcn.1402615d0
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
movups xmm0, xmmword [rdi]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rdi + 0x10], r12
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x1400ace4e
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ace48
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ad1f9
call fcn.1402615d0
nop
lea rcx, [rbp + 0x238]
call fcn.1400b7950
movzx edx, byte [rbp + 0x238]
lea rcx, [rbp + 0x240]
call fcn.1400b73f0
nop
mov rdx, qword [rbp + 0x260]
cmp rdx, 0x10
jb 0x1400aceaf
inc rdx
mov rcx, qword [rbp + 0x248]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400aceaa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ad1ff
call fcn.1402615d0
movdqa xmm0, xmmword [0x14039fb00]
movdqu xmmword [rbp + 0x258], xmm0
mov byte [rbp + 0x248], 0
cmp r15, 0x10
jb 0x1400acefd
lea rdx, [r15 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400acef5
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ad205
mov rcx, rsi
call fcn.1402615d0
mov rcx, qword [rbp + 0x2a8]
xor rcx, rsp
call fcn.1402614e0
lea r11, [rsp + 0x3d0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea rdx, str.message
call fcn.1400b8a60
mov rdi, rax
mov byte [rsp + 0x38], 3
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.140261c28
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], r12
mov r8d, 0xa
lea rdx, str.invalidver
mov rcx, rax
call fcn.1400b90d0
mov qword [rsp + 0x40], rbx
test rbx, rbx
jne 0x1400acfb7
mov r8d, 0x4ca
lea rdx, str.C:Users_adminDocuments_inister_spoofer_mainlibsjsoninclude_nlohmannjson.hpp
lea rcx, str.m_type___value_t::string__m_value.string___nullptr
call fcn.14027fd58
mov r8d, 0x4ca
lea rdx, str.C:Users_adminDocuments_inister_spoofer_mainlibsjsoninclude_nlohmannjson.hpp
lea rcx, str.m_type___value_t::string__m_value.string___nullptr
call fcn.14027fd58
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.1400ba1d0
movzx edi, al
movzx ebx, byte [rsp + 0x38]
cmp bl, 1
jne 0x1400acfe8
cmp qword [rsp + 0x40], 0
jne 0x1400ad046
mov r8d, 0x4c8
lea rcx, str.m_type___value_t::object__m_value.object___nullptr
jmp 0x1400ad03a
cmp bl, 2
jne 0x1400ad004
cmp qword [rsp + 0x40], 0
jne 0x1400ad046
mov r8d, 0x4c9
lea rcx, str.m_type___value_t::array__m_value.array___nullptr
jmp 0x1400ad03a
cmp bl, 3
jne 0x1400ad020
cmp qword [rsp + 0x40], 0
jne 0x1400ad046
mov r8d, 0x4ca
lea rcx, str.m_type___value_t::string__m_value.string___nullptr
jmp 0x1400ad03a
cmp bl, 8
jne 0x1400ad046
cmp qword [rsp + 0x40], 0
jne 0x1400ad046
mov r8d, 0x4cb
lea rcx, str.m_type___value_t::binary__m_value.binary___nullptr
lea rdx, str.C:Users_adminDocuments_inister_spoofer_mainlibsjsoninclude_nlohmannjson.hpp
call fcn.14027fd58
movzx edx, bl
lea rcx, [rsp + 0x40]
call fcn.1400b73f0
nop
lea rcx, [rbp + 0x238]
test dil, dil
jne 0x1400ad0b2
lea rdx, str.message
call fcn.1400b8a60
mov rcx, rax
lea rdx, [rbp + 0x268]
call fcn.1400b8d20
mov rcx, rax
call fcn.1400b6250
mov rdx, rax
xor r9d, r9d
lea r8, str.Failure
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rcx, [rbp + 0x268]
call fcn.1400b62f0
xor ecx, ecx
call fcn.140280bb8
nop
call fcn.1400a5c20
nop
lea rdx, str.download
call fcn.1400b8a60
mov rcx, rax
lea rdx, [rbp + 0x268]
call fcn.1400b8d20
lea rcx, [rbp + 0x268]
call fcn.1400b6250
mov r8, rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor ecx, ecx
call fcn.140280bb8
nop
xor r9d, r9d
lea r8, str.Failure
lea rdx, str.Application_Not_Setup_Correctly._Please_Watch_Video_Linked_in_Main.cpp
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call fcn.140280bb8
nop
call fcn.14028270c
nop
call fcn.14028270c
nop
call fcn.14028270c
nop
call fcn.14028270c
nop
call fcn.14028270c
nop
call fcn.14028270c
nop
call fcn.14028270c
nop
call fcn.14028270c
nop
call fcn.14028270c
nop
call fcn.14028270c
nop
call fcn.14028270c
nop
call fcn.14028270c
nop
call fcn.14028270c
nop
call fcn.14028270c
nop
call fcn.14028270c
nop
call fcn.14028270c
nop
call fcn.14028270c
nop
call fcn.14028270c
int3
call fcn.1400a5cc0
int3
call fcn.14028270c
nop
call fcn.14028270c
nop
mov rcx, rax
call fcn.1400b78c0
mov rdx, rax
lea rcx, [rbp + 0x268]
call fcn.1400b6350
nop
mov r8, rax
lea rdx, str.type_must_be_boolean__but_is
lea rcx, [rbp + 0x158]
call fcn.1400b8520
nop
mov r8, rax
mov edx, 0x12e
lea rcx, [rbp + 0x180]
call fcn.1400a9860
lea rdx, [0x1403c6c28]
lea rcx, [rbp + 0x180]
call fcn.140264c7c
nop
call fcn.14028270c
nop
call fcn.14028270c
nop
call fcn.14028270c
int3