Function at 0x140060fc0
Capabilities:
Create process on windows
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x358]
sub rsp, 0x440
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
mov rax, qword [0x140320600]
xor rax, rsp
mov qword [rbp + 0x310], rax
xor r12d, r12d
lea rcx, [rbp - 0x40]
call fcn.14005ffc0
nop
mov rdx, rax
lea rcx, [rbp - 0x60]
call fcn.14005f770
mov rdx, rax
lea rcx, [0x14032a8c8]
call fcn.140067830
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x140061062
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006105d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062222
call fcn.140213320
movdqa xmm0, xmmword [0x1402f6ee0]
movdqu xmmword [rbp - 0x50], xmm0
mov byte [rbp - 0x60], 0
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x1400610ae
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400610a9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062228
call fcn.140213320
cmp qword [0x14032a7f0], 0xa
jne 0x1400621ba
cmp qword [0x14032a810], 0x40
jne 0x1400621ba
mov dword [rsp + 0x40], 0x929490de
mov dword [rsp + 0x44], 0x8997a288
mov word [rsp + 0x48], 0x3d
mov byte [rsp + 0x4a], 1
mov rcx, r12
nop dword [rax]
lea eax, [rcx - 8]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 9
jb 0x1400610f0
mov byte [rsp + 0x4a], 0
lea rdx, [0x14032a7e0]
lea rcx, [rbp - 0x40]
call fcn.14005fba0
mov r15, rax
mov dword [rbp - 0x78], 0x958d96de
mov dword [rbp - 0x74], 0x9b978f99
mov word [rbp - 0x70], 0x3d
mov byte [rbp - 0x6e], 1
mov rcx, r12
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 8]
xor byte [rbp + rcx - 0x78], al
inc rcx
cmp rcx, 9
jb 0x140061140
mov byte [rbp - 0x6e], 0
lea rdx, [0x14032a7c0]
lea rcx, [rbp + 0x1b0]
call fcn.14005fba0
mov rsi, rax
mov dword [rsp + 0x38], 0x969b97de
mov dword [rsp + 0x3c], 0x100c099
mov rcx, r12
nop dword [rax]
lea eax, [rcx - 8]
xor byte [rsp + rcx + 0x38], al
inc rcx
cmp rcx, 6
jb 0x140061180
mov byte [rsp + 0x3f], 0
lea rax, [rbp + 0x280]
mov qword [rsp + 0x50], rax
lea rdx, [0x14032a780]
lea rcx, [rbp + 0x280]
call fcn.140067900
mov rdi, rax
lea rax, [rbp + 0x208]
mov qword [rsp + 0x30], rax
lea rdx, [0x14032a800]
lea rcx, [rbp + 0x208]
call fcn.140067900
mov rbx, rax
lea rdx, [0x14032a8c8]
lea rcx, [rbp + 0x248]
call fcn.140067900
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x190]
call fcn.140060140
mov r14, rax
mov dword [rsp + 0x78], 0x98949cde
mov dword [rsp + 0x7c], 0xc2879897
mov word [rbp - 0x80], 0x100
mov rcx, r12
nop
lea eax, [rcx - 8]
xor byte [rsp + rcx + 0x78], al
inc rcx
cmp rcx, 8
jb 0x140061220
mov byte [rbp - 0x7f], 0
lea rax, [rbp + 0x1d0]
mov qword [rbp - 0x68], rax
lea rdx, [0x14032a780]
lea rcx, [rbp + 0x1d0]
call fcn.140067900
mov rdi, rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x50], rax
lea rdx, [0x14032a800]
lea rcx, [rbp - 0x20]
call fcn.140067900
mov rbx, rax
lea rdx, [0x14032a820]
lea rcx, [rbp + 0x2d0]
call fcn.140067900
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x170]
call fcn.140060140
mov rdi, rax
mov dword [rsp + 0x50], 0x899f8fde
mov word [rsp + 0x54], 0xc1
mov byte [rsp + 0x56], 1
mov rcx, r12
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx - 8]
xor byte [rsp + rcx + 0x50], al
inc rcx
cmp rcx, 5
jb 0x1400612c0
mov byte [rsp + 0x56], 0
mov dword [rsp + 0x30], 0x8f939791
mov word [rsp + 0x34], 0x100
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx - 8]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 4
jb 0x1400612f0
mov byte [rsp + 0x35], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x80], xmm1
lea rax, [rsp + 0x30]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x140061326
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x70]
call fcn.14006ab80
nop
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x150]
call fcn.14005fba0
mov r10, rax
mov dword [rsp + 0x30], 0x9e8a808c
mov word [rsp + 0x34], 0xc1
mov byte [rsp + 0x36], 1
mov rcx, r12
nop dword [rax]
lea eax, [rcx - 8]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 5
jb 0x140061370
mov byte [rsp + 0x36], 0
lea rax, [rsp + 0x30]
mov r9, rbx
nop dword [rax]
inc r9
cmp byte [rax + r9], 0
jne 0x140061390
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, r10
call fcn.14006c370
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x60], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rax, [rsp + 0x50]
mov r8, rbx
nop
inc r8
cmp byte [rax + r8], 0
jne 0x1400613e0
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x50]
call fcn.140067740
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x130], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x140], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, rdi
lea r8, [rbp + 0x130]
lea rcx, [rbp - 0x60]
call fcn.14006c470
nop
lea rax, [rsp + 0x78]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140061440
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x60]
call fcn.140067740
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x110], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x120], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, r14
lea r8, [rbp + 0x110]
lea rcx, [rbp + 0xd0]
call fcn.14006c470
nop
lea rax, [rsp + 0x38]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400614a0
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0xd0]
call fcn.140067740
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xf0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x100], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, rsi
lea r8, [rbp + 0xf0]
lea rcx, [rbp + 0xb0]
call fcn.14006c470
nop
lea rax, [rbp - 0x78]
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140061500
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0xb0]
call fcn.140067740
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x68], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, r15
lea r8, [rsp + 0x58]
lea rcx, [rbp + 0x90]
call fcn.14006c470
nop
lea rax, [rsp + 0x40]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140061554
mov r8, rbx
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x90]
call fcn.140067740
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x40], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rdx, [0x14032a780]
cmp qword [0x14032a798], 0xf
cmova rdx, qword [0x14032a780]
mov r8, qword [0x14032a790]
lea rcx, [rbp + 0x30]
call fcn.140067740
movups xmm7, xmmword [rax]
movups xmmword [rbp + 0x2f0], xmm7
movups xmm6, xmmword [rax + 0x10]
movups xmmword [rbp + 0x300], xmm6
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rbp + 0x48]
cmp rdx, 0xf
jbe 0x140061624
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006161f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006222e
call fcn.140213320
movdqa xmm0, xmmword [0x1402f6ee0]
movdqu xmmword [rbp + 0x40], xmm0
mov byte [rbp + 0x30], 0
mov rdx, qword [rbp + 0xa8]
cmp rdx, 0xf
jbe 0x140061676
inc rdx
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061671
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062234
call fcn.140213320
movdqa xmm0, xmmword [0x1402f6ee0]
movdqu xmmword [rbp + 0xa0], xmm0
mov byte [rbp + 0x90], 0
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x1400616cb
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400616c5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006223a
call fcn.140213320
nop
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0xf
jbe 0x14006170c
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061707
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062240
call fcn.140213320
movdqa xmm0, xmmword [0x1402f6ee0]
movdqu xmmword [rbp + 0xc0], xmm0
mov byte [rbp + 0xb0], 0
mov rdx, qword [rbp + 0x108]
cmp rdx, 0xf
jbe 0x140061765
inc rdx
mov rcx, qword [rbp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006175f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062246
call fcn.140213320
nop
mov rdx, qword [rbp + 0xe8]
cmp rdx, 0xf
jbe 0x1400617a6
inc rdx
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400617a1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006224c
call fcn.140213320
movdqa xmm0, xmmword [0x1402f6ee0]
movdqu xmmword [rbp + 0xe0], xmm0
mov byte [rbp + 0xd0], 0
mov rdx, qword [rbp + 0x128]
cmp rdx, 0xf
jbe 0x1400617ff
inc rdx
mov rcx, qword [rbp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400617f9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062252
call fcn.140213320
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x14006183a
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061835
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062258
call fcn.140213320
movdqa xmm0, xmmword [0x1402f6ee0]
movdqu xmmword [rbp - 0x50], xmm0
mov byte [rbp - 0x60], 0
mov rdx, qword [rbp + 0x148]
cmp rdx, 0xf
jbe 0x14006188d
inc rdx
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061887
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006225e
call fcn.140213320
nop
mov rdx, qword [rbp + 0x68]
cmp rdx, 0xf
jbe 0x1400618c8
inc rdx
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400618c3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062264
call fcn.140213320
movdqa xmm0, xmmword [0x1402f6ee0]
movdqu xmmword [rbp + 0x60], xmm0
mov byte [rbp + 0x50], 0
mov rdx, qword [rbp + 0x168]
cmp rdx, 0xf
jbe 0x14006191a
inc rdx
mov rcx, qword [rbp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061915
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006226a
call fcn.140213320
movdqa xmm0, xmmword [0x1402f6ee0]
movdqu xmmword [rbp + 0x160], xmm0
mov byte [rbp + 0x150], 0
mov rdx, qword [rbp + 0x88]
cmp rdx, 0xf
jbe 0x14006196f
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006196a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062270
call fcn.140213320
movdqa xmm0, xmmword [0x1402f6ee0]
movdqu xmmword [rbp + 0x80], xmm0
mov byte [rbp + 0x70], 0
mov rdx, qword [rbp + 0x188]
cmp rdx, 0xf
jbe 0x1400619c4
inc rdx
mov rcx, qword [rbp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400619bf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062276
call fcn.140213320
movdqa xmm0, xmmword [0x1402f6ee0]
movdqu xmmword [rbp + 0x180], xmm0
mov byte [rbp + 0x170], 0
mov rdx, qword [rbp + 0x1a8]
cmp rdx, 0xf
jbe 0x140061a1c
inc rdx
mov rcx, qword [rbp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061a17
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006227c
call fcn.140213320
movdqa xmm0, xmmword [0x1402f6ee0]
movdqu xmmword [rbp + 0x1a0], xmm0
mov byte [rbp + 0x190], 0
mov rdx, qword [rbp + 0x1c8]
cmp rdx, 0xf
jbe 0x140061a74
inc rdx
mov rcx, qword [rbp + 0x1b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061a6f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062282
call fcn.140213320
movdqa xmm0, xmmword [0x1402f6ee0]
movdqu xmmword [rbp + 0x1c0], xmm0
mov byte [rbp + 0x1b0], 0
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x140061ac6
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061ac1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062288
call fcn.140213320
movdqa xmm0, xmmword [0x1402f6ee0]
movdqu xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x40], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r12
lea r14, [rbp + 0x2f0]
movq rsi, xmm7
movdqa xmm0, xmm6
psrldq xmm0, 8
movq r15, xmm0
cmp r15, 0xf
cmova r14, rsi
movabs rbx, 0x7fffffffffffffff
movq rdi, xmm6
cmp rdi, rbx
ja 0x14006228e
cmp rdi, 0xf
ja 0x140061b45
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], reloc.WS2_32.dll_ntohs
movups xmm0, xmmword [r14]
movups xmmword [rsp + 0x58], xmm0
jmp 0x140061bd9
mov rax, rdi
or rax, 0xf
cmp rax, rbx
jbe 0x140061b81
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14021341c
mov rcx, rax
test rax, rax
je 0x140062294
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140061bbb
mov rbx, rax
mov ecx, reloc.WS2_32.dll_shutdown
cmp rax, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140061bac
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14006215c
jmp 0x140061b5f
test rcx, rcx
je 0x140061bb8
call fcn.14021341c
jmp 0x140061bbb
mov rax, r12
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], rbx
lea r8, [rdi + 1]
mov rdx, r14
mov rcx, rax
call fcn.140252610
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x2b0]
call fcn.140064ee0
nop
lea rax, [rbp + 0x2d0]
mov qword [rbp - 0x68], rax
lea rdx, [0x14032a780]
lea rcx, [rbp + 0x2d0]
call fcn.140067900
mov rdi, rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x38], rax
lea rdx, [0x14032a800]
lea rcx, [rbp - 0x20]
call fcn.140067900
mov rbx, rax
lea rdx, [rbp + 0x2b0]
lea rcx, [rbp + 0x1d0]
call fcn.140067900
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.140060450
mov rbx, rax
lea rax, [rbp + 0x2b0]
cmp rax, rbx
je 0x140061cd9
mov rdx, qword [rbp + 0x2c8]
cmp rdx, 0xf
jbe 0x140061c9e
inc rdx
mov rcx, qword [rbp + 0x2b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061c99
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006229a
call fcn.140213320
movdqa xmm0, xmmword [0x1402f6ee0]
movdqu xmmword [rbp + 0x2c0], xmm0
mov byte [rbp + 0x2b0], 0
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x2b0], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x2c0], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x140061d14
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061d0f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006229a
call fcn.140213320
mov qword [rbp + 0x240], r12
lea r8, [rbp + 0x208]
lea rdx, [rbp + 0x2b0]
lea rcx, [rbp + 0x2a0]
call fcn.140069e70
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r12
mov r8d, 7
lea rdx, str.success
lea rcx, [rsp + 0x58]
call fcn.14006ab80
lea rax, [rsp + 0x58]
mov qword [rbp - 0x68], rax
movzx ecx, byte [rbp + 0x2a0]
test cl, cl
jne 0x140061d8f
mov byte [rbp + 0x2a0], 1
call fcn.14006b0b0
mov qword [rbp + 0x2a8], rax
movzx ecx, byte [rbp + 0x2a0]
jmp 0x140061d96
mov rax, qword [rbp + 0x2a8]
cmp cl, 1
jne 0x140062114
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.140073b20
mov rbx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x140061df3
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061dee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400622a0
call fcn.140213320
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x58], 0
cmp byte [rbx + 0x40], 4
jne 0x1400622a6
xorps xmm0, xmm0
lea rcx, [rsp + 0x58]
cmp byte [rbx + 0x48], 0
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r12
movups xmmword [rsp + 0x58], xmm0
je 0x140061fd8
mov r8d, 9
lea rdx, str.sessionid
call fcn.14006ab80
lea rax, [rsp + 0x58]
mov qword [rbp - 0x68], rax
movzx ecx, byte [rbp + 0x2a0]
test cl, cl
jne 0x140061e73
mov byte [rbp + 0x2a0], 1
call fcn.14006b0b0
mov qword [rbp + 0x2a8], rax
movzx ecx, byte [rbp + 0x2a0]
jmp 0x140061e7a
mov rax, qword [rbp + 0x2a8]
cmp cl, 1
jne 0x1400622fb
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.140073b20
mov rbx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x140061ed7
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061ed2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400622e9
call fcn.140213320
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x58], 0
lea rdx, [rbx + 0x40]
lea rcx, [0x14032a8a8]
call fcn.14006a0b0
nop
movzx edx, byte [rbp + 0x2a0]
lea rcx, [rbp + 0x2a8]
call fcn.140068ad0
nop
mov rdx, qword [rbp + 0x2c8]
cmp rdx, 0xf
jbe 0x140061f50
inc rdx
mov rcx, qword [rbp + 0x2b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061f4b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400622ef
call fcn.140213320
movdqa xmm0, xmmword [0x1402f6ee0]
movdqu xmmword [rbp + 0x2c0], xmm0
mov byte [rbp + 0x2b0], 0
cmp r15, 0xf
jbe 0x140061f9e
lea rdx, [r15 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140061f96
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400622f5
mov rcx, rsi
call fcn.140213320
mov rcx, qword [rbp + 0x310]
xor rcx, rsp
call fcn.140213300
lea r11, [rsp + 0x440]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov r8d, 7
lea rdx, str.message
call fcn.14006ab80
lea rax, [rsp + 0x58]
mov qword [rbp - 0x68], rax
movzx ecx, byte [rbp + 0x2a0]
test cl, cl
jne 0x14006201a
mov byte [rbp + 0x2a0], 1
call fcn.14006b0b0
mov qword [rbp + 0x2a8], rax
movzx ecx, byte [rbp + 0x2a0]
jmp 0x140062021
mov rax, qword [rbp + 0x2a8]
cmp cl, 1
jne 0x1400623ab
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.140073b20
mov rdi, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x14006207e
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062079
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062340
call fcn.140213320
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x58], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xor eax, eax
mov qword [rsp + 0x48], rax
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.140068ad0
mov byte [rsp + 0x40], 3
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.14021341c
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], r12
mov r8d, 0xa
lea rdx, str.invalidver
mov rcx, rax
call fcn.14006ab80
mov qword [rsp + 0x48], rbx
lea rdx, [rsp + 0x40]
lea rcx, [rdi + 0x40]
call fcn.14006bef0
movzx ebx, al
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.140068ad0
nop
test bl, bl
je 0x140062346
jmp 0x140062162
lea rcx, [rbp + 0x2a0]
call fcn.140068710
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x38]
lea rcx, [rbp - 0x20]
call fcn.140072720
nop
mov r8, rax
mov edx, 0x131
lea rcx, [rbp + 0x248]
call fcn.14006a670
lea rdx, [0x140318b68]
lea rcx, [rbp + 0x248]
call fcn.1402154f4
nop
call fcn.14005b570
nop
lea rdx, str.download
lea rcx, [rbp + 0x2a0]
call fcn.140069f90
lea rdx, [rbp + 0x2d0]
mov rcx, rax
call fcn.14006a170
lea rcx, [rbp + 0x2d0]
call fcn.140067730
mov r8, rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor ecx, ecx
call fcn.140222ee4
nop
movdqa xmm0, xmmword [0x1402f6fb0]
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x1402f6fe0]
movdqa xmmword [rbp - 0x10], xmm1
movdqa xmm0, xmmword [0x1402f6fc0]
movdqa xmmword [rbp], xmm0
movdqa xmm1, xmmword [0x1402f6fd0]
movdqa xmmword [rbp + 0x10], xmm1
mov dword [rbp + 0x20], 0x525b7418
mov dword [rbp + 0x24], 0x4f5d1352
mov word [rbp + 0x28], Ordinal_50
mov byte [rbp + 0x2a], 1
lea rdx, [rbp - 0x20]
call fcn.1400623f0
mov ecx, 0x1194
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call fcn.140222ee4
nop
call fcn.1402282d0
nop
call fcn.1402282d0
nop
call fcn.1402282d0
nop
call fcn.1402282d0
nop
call fcn.1402282d0
nop
call fcn.1402282d0
nop
call fcn.1402282d0
nop
call fcn.1402282d0
nop
call fcn.1402282d0
nop
call fcn.1402282d0
nop
call fcn.1402282d0
nop
call fcn.1402282d0
nop
call fcn.1402282d0
nop
call fcn.1402282d0
nop
call fcn.1402282d0
nop
call fcn.1402282d0
nop
call fcn.1402282d0
nop
call fcn.1402282d0
int3
call fcn.14005b610
int3
call fcn.1402282d0
nop
call fcn.1402282d0
nop
call fcn.1402282d0
int3
lea rcx, [rbx + 0x40]
call fcn.140068710
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x38]
lea rcx, [rbp + 0x2d0]
call fcn.140078140
nop
mov r8, rax
lea rcx, [rbp + 0x1d0]
call fcn.140077f00
lea rdx, [0x140318b68]
lea rcx, [rbp + 0x1d0]
call fcn.1402154f4
nop
call fcn.1402282d0
nop
call fcn.1402282d0
nop
call fcn.1402282d0
nop
lea rcx, [rbp + 0x2a0]
call fcn.140068710
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x38]
lea rcx, [rbp + 0x2d0]
call fcn.140072720
nop
mov r8, rax
mov edx, 0x131
lea rcx, [rbp - 0x20]
call fcn.14006a670
lea rdx, [0x140318b68]
lea rcx, [rbp - 0x20]
call fcn.1402154f4
nop
call fcn.1402282d0
int3
lea rdx, [0x1402f5094]
lea rcx, [0x140328ab0]
call fcn.140069bc0
lea rdx, str.message
lea rcx, [rbp + 0x2a0]
call fcn.140069f90
mov rdx, rax
lea rcx, [rbp + 0x2d0]
call fcn.14006a240
nop
mov rdx, rax
lea rcx, [0x140328ab0]
call fcn.14006a2d0
nop
lea rcx, [rbp + 0x2d0]
call fcn.1400677d0
mov ecx, 0x1194
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call fcn.140222ee4
nop
lea rcx, [rbp + 0x2a0]
call fcn.140068710
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x38]
lea rcx, [rbp + 0x2d0]
call fcn.140072720
nop
mov r8, rax
mov edx, 0x131
lea rcx, [rbp - 0x20]
call fcn.14006a670
lea rdx, [0x140318b68]
lea rcx, [rbp - 0x20]
call fcn.1402154f4
int3