Function at 0x1400032a0
Capabilities:
Contain obfuscated stackstrings
Create thread
Encode data using xor
Execute command
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x178]
sub rsp, 0x250
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
mov rax, qword [0x1400d6060]
xor rax, rsp
mov qword [rbp + 0x118], rax
mov rdi, rcx
xor ebx, ebx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
lea r8, [0x140005420]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.140005170
cmp qword [rdi + 0x30], 0xa
jne 0x140003e70
cmp qword [rdi + 0x50], 0x40
jne 0x140003e70
mov dword [rsp + 0x40], 0x6d756e26
mov dword [rsp + 0x44], 0x636f7761
mov word [rsp + 0x48], gethostname
mov byte [rsp + 0x4a], 1
mov dword [rbp + 0xa0], 0x6e636f26
mov dword [rbp + 0xa4], 0x1003861
mov dword [rsp + 0x30], 0x71677726
mov word [rsp + 0x34], reloc.WS2_32.dll_gethostname
mov byte [rsp + 0x36], 1
mov dword [rsp + 0x50], 0x66727874
mov dword [rsp + 0x54], 0x6e686c39
mov word [rsp + 0x58], 0x7c
mov byte [rsp + 0x5a], 1
mov eax, ebx
xor byte [rsp + rax + 0x30], al
inc rax
cmp rax, 5
jb 0x140003383
mov byte [rsp + 0x36], bl
lea r8, [rsp + 0x35]
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0xb8]
call fcn.140006c60
nop
cmp byte [rsp + 0x5a], 0
je 0x1400033d2
mov rax, rbx
nop word [rax + rax]
xor byte [rsp + rax + 0x50], al
inc rax
cmp rax, 9
jb 0x1400033c0
mov byte [rsp + 0x5a], 0
lea r8, [rsp + 0x59]
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x30]
call fcn.140006c60
nop
lea r9, [rbp + 0xb8]
lea r8, [rbp + 0x30]
lea rcx, [rbp + 0x10]
call fcn.140008120
nop
mov rdx, qword [rbp + 0x48]
cmp rdx, 0x10
jb 0x14000343a
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003434
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003434
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400af208
nop
mov rdx, qword [rbp + 0xd0]
cmp rdx, 0x10
jb 0x14000347f
inc rdx
mov rcx, qword [rbp + 0xb8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003479
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003479
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400af208
nop
lea rdx, [rdi + 0x60]
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x140003491
mov rdx, qword [rdx]
lea rcx, [rbp + 0x10]
call fcn.1400057c0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x50], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rbp + 0xa0]
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x70]
call fcn.140003f20
nop
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x1400034da
mov rdx, qword [rdi]
mov r8, qword [rdi + 0x10]
mov rcx, rax
call fcn.1400057c0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x50]
call fcn.140004000
nop
lea rdx, [rdi + 0x20]
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x14000352c
mov rdx, qword [rdx]
mov rcx, rax
call fcn.1400057c0
movups xmm7, xmmword [rax]
movups xmmword [rbp + 0xf8], xmm7
movups xmm6, xmmword [rax + 0x10]
movups xmmword [rbp + 0x108], xmm6
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rbp + 0x68]
cmp rdx, 0x10
jb 0x140003596
inc rdx
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003591
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003591
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400af208
movdqa xmm0, xmmword [0x1400c79b0]
movdqu xmmword [rbp + 0x60], xmm0
mov byte [rbp + 0x50], 0
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x1400035e8
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400035e2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400035e2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400af208
nop
mov rdx, qword [rbp + 0x88]
cmp rdx, 0x10
jb 0x140003629
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003624
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003624
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400af208
movdqa xmm0, xmmword [0x1400c79b0]
movdqu xmmword [rbp + 0x80], xmm0
mov byte [rbp + 0x70], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x14000367c
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003676
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003676
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400af208
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x1400036ba
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400036b5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400036b5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400af208
movdqa xmm0, xmmword [0x1400c79b0]
movdqu xmmword [rbp + 0x20], xmm0
mov byte [rbp + 0x10], 0
lea rax, [rbp + 0xb8]
mov qword [rbp + 0x90], rax
lea rdx, [rdi + 0xa0]
lea rcx, [rbp + 0xb8]
call fcn.1400058e0
mov qword [rbp - 0x70], rax
lea rax, [rbp + 0x30]
mov qword [rbp + 0x98], rax
lea rdx, [rdi + 0x80]
lea rcx, [rbp + 0x30]
call fcn.1400058e0
mov qword [rbp - 0x78], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbx
lea r12, [rbp + 0xf8]
movq r15, xmm7
movdqa xmm0, xmm6
psrldq xmm0, 8
movq r13, xmm0
cmp r13, 0x10
cmovae r12, r15
movabs rsi, 0x7fffffffffffffff
movq r14, xmm6
cmp r14, rsi
ja 0x140003ed8
mov qword [rsp + 0x78], reloc.WS2_32.dll_ntohs
cmp r14, 0x10
jae 0x14000377e
mov qword [rsp + 0x70], r14
movups xmm0, xmmword [r12]
movups xmmword [rsp + 0x60], xmm0
jmp 0x140003819
mov rax, r14
or rax, 0xf
cmp rax, rsi
jbe 0x1400037b6
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400af2f4
mov rcx, rax
test rax, rax
je 0x1400037e1
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400037f7
mov rsi, rax
mov ecx, reloc.WLDAP32.dll_Ordinal_22
cmp rax, rcx
cmovb rsi, rcx
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x1400037e8
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003ede
jmp 0x140003798
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x1400037f4
call fcn.1400af2f4
jmp 0x1400037f7
mov rax, rbx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], rsi
lea r8, [r14 + 1]
mov rdx, r12
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rbp - 0x78]
mov r9, qword [rbp - 0x70]
mov r8, rax
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0xd8]
call fcn.140004de0
nop
call fcn.140005170
mov qword [rbp - 0x28], rbx
lea r8, [rbp - 0x60]
lea rdx, [rbp + 0xd8]
lea rcx, [rbp + 0xa8]
call fcn.140006d90
nop
lea rdx, [rbp + 0xa8]
lea rcx, [rsp + 0x40]
call fcn.140005520
mov rdx, rax
mov rcx, rdi
call fcn.140002b00
lea rdx, str.success
lea rcx, [rbp + 0xa8]
call fcn.1400069f0
lea rcx, [rax + 8]
cmp byte [rax], 4
cmovne rcx, rbx
cmp byte [rcx], 0
lea rcx, [rbp + 0xa8]
je 0x14000398a
lea rdx, str.sessionid
call fcn.1400069f0
lea rcx, [rdi + 0x260]
cmp byte [rax], 3
jne 0x1400038b9
mov rbx, qword [rax + 8]
mov r9, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x1400038c6
mov r9, qword [rbx]
mov rbx, qword [rbx + 0x10]
mov rax, qword [rcx + 0x18]
cmp rbx, rax
ja 0x1400038f7
mov rsi, rcx
cmp rax, 0x10
jb 0x1400038df
mov rsi, qword [rcx]
mov qword [rcx + 0x10], rbx
mov r8, rbx
mov rdx, r9
mov rcx, rsi
call sub.VCRUNTIME140.dll_memmove
mov byte [rsi + rbx], 0
jmp 0x1400038ff
mov rdx, rbx
call fcn.140007530
lea rdx, str.appinfo
lea rcx, [rbp + 0xa8]
call fcn.1400069f0
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140005520
mov rdx, rax
mov rcx, rdi
call fcn.140002890
nop
movzx edx, byte [rbp + 0xa8]
lea rcx, [rbp + 0xb0]
call fcn.140005f50
nop
mov rdx, qword [rbp + 0xf0]
cmp rdx, 0x10
jb 0x140003de0
inc rdx
mov rcx, qword [rbp + 0xd8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003ddb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003ddb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rdx, str.message
call fcn.1400069f0
mov rsi, rax
mov byte [rsp + 0x40], 3
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1400af2f4
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbx
mov r8d, 0xa
lea rdx, str.invalidver
mov rcx, rax
call fcn.1400071a0
mov qword [rsp + 0x48], rdi
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.140007d50
movzx edi, al
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.140005f50
nop
test dil, dil
je 0x14000392b
lea rdx, str.download
lea rcx, [rbp + 0xa8]
call fcn.1400069f0
lea rdx, [rbp + 0xb8]
mov rcx, rax
call fcn.140006bd0
nop
lea rdx, [0x1400bfbae]
lea rcx, [rbp + 0xb8]
call fcn.1400069a0
test al, al
je 0x140003bea
lea rdx, [rbp - 0x60]
call fcn.1400040e0
mov r9, rax
cmp byte [rax + 0x54], 0
je 0x140003bdc
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x140003ba0
movdqa xmm5, xmmword [0x1400c7a00]
movdqa xmm4, xmmword [0x1400c7ed0]
mov eax, 4
movd xmm6, eax
movdqa xmm7, xmmword [str.1111]
mov eax, Ordinal_32
movd xmm8, eax
movdqa xmm0, xmmword [0x1400c7bf0]
movdqa xmmword [rsp + 0x40], xmm0
mov rcx, r9
mov edx, dword [rsp + 0x40]
nop dword [rax]
movd xmm2, ebx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400c7b70]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
lea eax, [rbx + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400c7b70]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx + 4]
xorps xmm2, xmm0
movd dword [rcx + 4], xmm2
add ebx, 8
mov eax, ebx
lea rcx, [rcx + 8]
cmp ebx, 0x50
jl 0x140003aa0
cmp eax, 0x55
jge 0x140003bdc
movsxd r8, ebx
add r8, r9
nop word [rax + rax]
mov eax, 0x5397829d
imul ebx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x31
movzx eax, bl
sub al, cl
add al, 0x32
xor byte [r8], al
inc ebx
lea r8, [r8 + 1]
cmp ebx, 0x55
jl 0x140003bb0
mov rcx, r9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
jmp 0x140003dd2
lea rcx, [rbp + 0xa0]
call fcn.1400041c0
lea rcx, [rbp + 0xa0]
call fcn.140004190
nop
lea rcx, [rbp + 0xb8]
call fcn.1400057b0
mov rdx, rax
lea rcx, [rbp + 0xa0]
call fcn.140003280
lea rdx, [rbp - 0x60]
call fcn.140004130
mov r9, rax
cmp byte [rax + 0x64], 0
je 0x140003dbc
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x140003d81
movdqa xmm5, xmmword [0x1400c7a00]
movdqa xmm4, xmmword [0x1400c7ed0]
mov eax, 4
movd xmm6, eax
movdqa xmm7, xmmword [str.1111]
mov eax, Ordinal_32
movd xmm8, eax
movdqa xmm0, xmmword [0x1400c7bf0]
movdqa xmmword [rsp + 0x40], xmm0
mov rcx, r9
mov edx, dword [rsp + 0x40]
movd xmm2, ebx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400c7b70]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
lea eax, [rbx + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400c7b70]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx + 4]
xorps xmm2, xmm0
movd dword [rcx + 4], xmm2
add ebx, 8
mov eax, ebx
lea rcx, [rcx + 8]
cmp ebx, 0x60
jl 0x140003c81
cmp eax, 0x65
jge 0x140003dbc
movsxd r8, ebx
add r8, r9
nop word [rax + rax]
mov eax, 0x5397829d
imul ebx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x31
movzx eax, bl
sub al, cl
add al, 0x32
xor byte [r8], al
inc ebx
lea r8, [r8 + 1]
cmp ebx, 0x65
jl 0x140003d90
mov rcx, r9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
lea rcx, [rbp + 0xa0]
call fcn.140003260
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
call fcn.1400af208
movdqa xmm0, xmmword [0x1400c79b0]
movdqu xmmword [rbp + 0xe8], xmm0
mov byte [rbp + 0xd8], 0
cmp r13, 0x10
jb 0x140003e31
lea rdx, [r13 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x140003e29
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003e29
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r15
call fcn.1400af208
mov rcx, qword [rbp + 0x118]
xor rcx, rsp
call fcn.1400af1e0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
movdqa xmm0, xmmword [0x1400c7bd0]
movdqu xmmword [rbp - 0x60], xmm0
movdqa xmm1, xmmword [0x1400c7be0]
movdqu xmmword [rbp - 0x50], xmm1
movdqa xmm0, xmmword [0x1400c7e80]
movdqu xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [0x1400c7f10]
movdqu xmmword [rbp - 0x30], xmm1
mov dword [rbp - 0x20], 0x206c2f29
mov dword [rbp - 0x1c], 0x1003534
lea rcx, [rbp - 0x60]
call fcn.140003ef0
mov rdx, rax
mov r9d, reloc.WS2_32.dll_recv
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
call fcn.1400014a0
nop
call fcn.140001400
int3