Function at 0x140061570
Capabilities:
Contain obfuscated stackstrings
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x338]
sub rsp, 0x420
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
movaps xmmword [rax - 0x48], xmm8
mov rax, qword [0x140325680]
xor rax, rsp
mov qword [rbp + 0x2e0], rax
xor r12d, r12d
lea rcx, [rbp + 0x10]
call fcn.140060600
nop
mov rdx, rax
lea rcx, [rbp - 0x10]
call fcn.14005fdb0
mov rdx, rax
lea rcx, [0x14032f968]
call fcn.14006cbb0
mov rdx, qword [rbp + 8]
cmp rdx, 0xf
jbe 0x140061617
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061612
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400626c5
call fcn.140218a00
movdqa xmm6, xmmword [0x1402fc580]
movdqu xmmword [rbp], xmm6
mov byte [rbp - 0x10], 0
mov rdx, qword [rbp + 0x28]
cmp rdx, 0xf
jbe 0x140061663
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006165e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400626cb
call fcn.140218a00
cmp qword [0x14032f890], 0xa
jne 0x14006265d
cmp qword [0x14032f8b0], 0x40
jne 0x14006265d
mov dword [rsp + 0x46], 0x3d7669
mov dword [rsp + 0x40], 0x696e6926
mov word [rsp + 0x44], 0x5f74
mov byte [rsp + 0x4a], 0
lea rdx, [0x14032f880]
lea rcx, [rbp + 0x10]
call fcn.1400601e0
mov r15, rax
mov dword [rbp - 0x6a], 0x3d6469
mov dword [rbp - 0x70], 0x6e776f26
mov word [rbp - 0x6c], 0x7265
mov byte [rbp - 0x66], 0
lea rdx, [0x14032f860]
lea rcx, [rbp + 0x1b0]
call fcn.1400601e0
mov r14, rax
mov word [rsp + 0x35], 0x3d
mov dword [rsp + 0x30], 0x6d616e26
mov byte [rsp + 0x34], 0x65
mov byte [rsp + 0x37], 0
lea rax, [rbp + 0x210]
mov qword [rsp + 0x70], rax
lea rdx, [0x14032f810]
lea rcx, [rbp + 0x210]
call fcn.14006cc80
mov rdi, rax
lea rax, [rbp + 0x230]
mov qword [rsp + 0x38], rax
lea rdx, [0x14032f8a0]
lea rcx, [rbp + 0x230]
call fcn.14006cc80
mov rbx, rax
lea rdx, [0x14032f968]
lea rcx, [rbp + 0x250]
call fcn.14006cc80
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x190]
call fcn.140060730
mov rsi, rax
mov word [rbp - 0x79], 0x3d
mov dword [rbp - 0x80], 0x636e6526
mov word [rbp - 0x7c], 0x656b
mov byte [rbp - 0x7a], 0x79
mov byte [rbp - 0x77], 0
lea rax, [rbp + 0x1d0]
mov qword [rsp + 0x78], rax
lea rdx, [0x14032f810]
lea rcx, [rbp + 0x1d0]
call fcn.14006cc80
mov rdi, rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x70], rax
lea rdx, [0x14032f8a0]
lea rcx, [rbp - 0x60]
call fcn.14006cc80
mov rbx, rax
lea rdx, [0x14032f8c0]
lea rcx, [rbp + 0x2a0]
call fcn.14006cc80
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x170]
call fcn.140060730
mov rdi, rax
mov dword [rsp + 0x72], 0x3d7265
mov word [rsp + 0x70], 0x7626
mov byte [rsp + 0x76], 0
mov word [rsp + 0x3b], reloc.WS2_32.dll_WSACleanup
mov word [rsp + 0x38], 0x6e69
mov byte [rsp + 0x3a], 0x69
mov byte [rsp + 0x3d], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x80], xmm1
lea rax, [rsp + 0x38]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140061840
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x70]
call fcn.14006fee0
nop
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x150]
call fcn.1400601e0
nop
mov dword [rsp + 0x3a], 0x3d6570
mov word [rsp + 0x38], 0x7974
mov byte [rsp + 0x3e], 0
lea rcx, [rsp + 0x38]
mov r9, rbx
inc r9
cmp byte [rcx + r9], 0
jne 0x140061886
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call fcn.1400715a0
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x60], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rax, [rsp + 0x70]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x1400618d4
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x50]
call fcn.14006cac0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x130], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x140], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, rdi
lea r8, [rbp + 0x130]
lea rcx, [rbp - 0x10]
call fcn.1400716a0
nop
lea rax, [rbp - 0x80]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140061930
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x10]
call fcn.14006cac0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x110], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x120], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, rsi
lea r8, [rbp + 0x110]
lea rcx, [rbp + 0xd0]
call fcn.1400716a0
nop
lea rax, [rsp + 0x30]
mov r8, rbx
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140061990
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0xd0]
call fcn.14006cac0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xf0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x100], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, r14
lea r8, [rbp + 0xf0]
lea rcx, [rbp + 0xb0]
call fcn.1400716a0
nop
lea rax, [rbp - 0x70]
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400619f0
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0xb0]
call fcn.14006cac0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, r15
lea r8, [rsp + 0x50]
lea rcx, [rbp + 0x90]
call fcn.1400716a0
nop
lea rax, [rsp + 0x40]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140061a44
mov r8, rbx
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x90]
call fcn.14006cac0
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x40], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rdx, [0x14032f810]
cmp qword [0x14032f828], 0xf
cmova rdx, qword [0x14032f810]
mov r8, qword [0x14032f820]
lea rcx, [rbp + 0x30]
call fcn.14006cac0
movups xmm8, xmmword [rax]
movups xmmword [rbp + 0x2c0], xmm8
movups xmm7, xmmword [rax + 0x10]
movups xmmword [rbp + 0x2d0], xmm7
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rbp + 0x48]
cmp rdx, 0xf
jbe 0x140061b16
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061b11
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400626d1
call fcn.140218a00
movdqu xmmword [rbp + 0x40], xmm6
mov byte [rbp + 0x30], 0
mov rdx, qword [rbp + 0xa8]
cmp rdx, 0xf
jbe 0x140061b60
inc rdx
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061b5b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400626d7
call fcn.140218a00
movdqu xmmword [rbp + 0xa0], xmm6
mov byte [rbp + 0x90], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140061bad
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061ba7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400626dd
call fcn.140218a00
nop
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0xf
jbe 0x140061bee
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061be9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400626e3
call fcn.140218a00
movdqu xmmword [rbp + 0xc0], xmm6
mov byte [rbp + 0xb0], 0
mov rdx, qword [rbp + 0x108]
cmp rdx, 0xf
jbe 0x140061c3f
inc rdx
mov rcx, qword [rbp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061c39
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400626e9
call fcn.140218a00
nop
mov rdx, qword [rbp + 0xe8]
cmp rdx, 0xf
jbe 0x140061c80
inc rdx
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061c7b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400626ef
call fcn.140218a00
movdqu xmmword [rbp + 0xe0], xmm6
mov byte [rbp + 0xd0], 0
mov rdx, qword [rbp + 0x128]
cmp rdx, 0xf
jbe 0x140061cd1
inc rdx
mov rcx, qword [rbp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061ccb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400626f5
call fcn.140218a00
nop
mov rdx, qword [rbp + 8]
cmp rdx, 0xf
jbe 0x140061d0c
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061d07
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400626fb
call fcn.140218a00
movdqu xmmword [rbp], xmm6
mov byte [rbp - 0x10], 0
mov rdx, qword [rbp + 0x148]
cmp rdx, 0xf
jbe 0x140061d57
inc rdx
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061d51
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062701
call fcn.140218a00
nop
mov rdx, qword [rbp + 0x68]
cmp rdx, 0xf
jbe 0x140061d92
inc rdx
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061d8d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062707
call fcn.140218a00
movdqu xmmword [rbp + 0x60], xmm6
mov byte [rbp + 0x50], 0
mov rdx, qword [rbp + 0x168]
cmp rdx, 0xf
jbe 0x140061ddc
inc rdx
mov rcx, qword [rbp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061dd7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006270d
call fcn.140218a00
movdqu xmmword [rbp + 0x160], xmm6
mov byte [rbp + 0x150], 0
mov rdx, qword [rbp + 0x88]
cmp rdx, 0xf
jbe 0x140061e29
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061e24
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062713
call fcn.140218a00
movdqu xmmword [rbp + 0x80], xmm6
mov byte [rbp + 0x70], 0
mov rdx, qword [rbp + 0x188]
cmp rdx, 0xf
jbe 0x140061e76
inc rdx
mov rcx, qword [rbp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061e71
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062719
call fcn.140218a00
movdqu xmmword [rbp + 0x180], xmm6
mov byte [rbp + 0x170], 0
mov rdx, qword [rbp + 0x1a8]
cmp rdx, 0xf
jbe 0x140061ec6
inc rdx
mov rcx, qword [rbp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061ec1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006271f
call fcn.140218a00
movdqu xmmword [rbp + 0x1a0], xmm6
mov byte [rbp + 0x190], 0
mov rdx, qword [rbp + 0x1c8]
cmp rdx, 0xf
jbe 0x140061f16
inc rdx
mov rcx, qword [rbp + 0x1b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061f11
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062725
call fcn.140218a00
movdqu xmmword [rbp + 0x1c0], xmm6
mov byte [rbp + 0x1b0], 0
mov rdx, qword [rbp + 0x28]
cmp rdx, 0xf
jbe 0x140061f60
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061f5b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006272b
call fcn.140218a00
movdqu xmmword [rbp + 0x20], xmm6
mov byte [rbp + 0x10], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r12
lea r14, [rbp + 0x2c0]
movq rsi, xmm8
movdqa xmm0, xmm7
psrldq xmm0, 8
movq r15, xmm0
cmp r15, 0xf
cmova r14, rsi
movabs rbx, 0x7fffffffffffffff
movq rdi, xmm7
cmp rdi, rbx
ja 0x140062731
cmp rdi, 0xf
ja 0x140061fd7
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
movups xmm0, xmmword [r14]
movups xmmword [rsp + 0x50], xmm0
jmp 0x14006206b
mov rax, rdi
or rax, 0xf
cmp rax, rbx
jbe 0x140062013
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140218afc
mov rcx, rax
test rax, rax
je 0x140062737
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14006204d
mov rbx, rax
mov ecx, reloc.WS2_32.dll_shutdown
cmp rax, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x140062030
mov rax, r12
jmp 0x14006204d
cmp rcx, 0x1000
jb 0x140062048
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400625ff
jmp 0x140061ff1
call fcn.140218afc
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rbx
lea r8, [rdi + 1]
mov rdx, r14
mov rcx, rax
call fcn.140256de0
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x280]
call fcn.140065080
nop
lea rax, [rbp + 0x2a0]
mov qword [rsp + 0x78], rax
lea rdx, [0x14032f810]
lea rcx, [rbp + 0x2a0]
call fcn.14006cc80
mov rdi, rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x30], rax
lea rdx, [0x14032f8a0]
lea rcx, [rbp - 0x60]
call fcn.14006cc80
mov rbx, rax
lea rdx, [rbp + 0x280]
lea rcx, [rbp + 0x1d0]
call fcn.14006cc80
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.140060a40
mov rbx, rax
lea rax, [rbp + 0x280]
cmp rax, rbx
je 0x140062164
mov rdx, qword [rbp + 0x298]
cmp rdx, 0xf
jbe 0x140062131
inc rdx
mov rcx, qword [rbp + 0x280]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006212c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006273d
call fcn.140218a00
movdqu xmmword [rbp + 0x290], xmm6
mov byte [rbp + 0x280], 0
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x280], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x290], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rbp + 0x28]
cmp rdx, 0xf
jbe 0x14006219f
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006219a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006273d
call fcn.140218a00
mov qword [rbp + 0x208], r12
lea r8, [rbp + 0x1d0]
lea rdx, [rbp + 0x280]
lea rcx, [rbp + 0x270]
call fcn.14006f1e0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r12
mov r8d, 7
lea rdx, str.success
lea rcx, [rsp + 0x50]
call fcn.14006fee0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x78], rax
movzx ecx, byte [rbp + 0x270]
test cl, cl
jne 0x14006221b
mov byte [rbp + 0x270], 1
call fcn.1400702d0
mov qword [rbp + 0x278], rax
movzx ecx, byte [rbp + 0x270]
jmp 0x140062222
mov rax, qword [rbp + 0x278]
cmp cl, 1
jne 0x1400625ba
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.140078f20
mov rbx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14006227f
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006227a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062743
call fcn.140218a00
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x50], 0
cmp byte [rbx + 0x40], 4
jne 0x140062749
xorps xmm0, xmm0
lea rcx, [rsp + 0x50]
cmp byte [rbx + 0x48], 0
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r12
movups xmmword [rsp + 0x50], xmm0
je 0x14006247d
mov r8d, 9
lea rdx, str.sessionid
call fcn.14006fee0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x78], rax
movzx ecx, byte [rbp + 0x270]
test cl, cl
jne 0x140062300
mov byte [rbp + 0x270], 1
call fcn.1400702d0
mov qword [rbp + 0x278], rax
movzx ecx, byte [rbp + 0x270]
jmp 0x140062307
mov rax, qword [rbp + 0x278]
cmp cl, 1
jne 0x1400627d5
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.140078f20
mov rbx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140062364
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006235f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062786
call fcn.140218a00
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x50], 0
cmp byte [rbx + 0x40], 3
jne 0x14006278c
mov r8, qword [rbx + 0x48]
mov rdx, r8
cmp qword [r8 + 0x18], 0xf
jbe 0x140062392
mov rdx, qword [r8]
mov r8, qword [r8 + 0x10]
lea rcx, [0x14032f948]
call fcn.14006ddb0
nop
movzx edx, byte [rbp + 0x270]
lea rcx, [rbp + 0x278]
call fcn.14006df50
nop
mov rdx, qword [rbp + 0x298]
cmp rdx, 0xf
jbe 0x1400623f8
inc rdx
mov rcx, qword [rbp + 0x280]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400623f3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400627c9
call fcn.140218a00
movdqu xmmword [rbp + 0x290], xmm6
mov byte [rbp + 0x280], 0
cmp r15, 0xf
jbe 0x14006243e
lea rdx, [r15 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140062436
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400627cf
mov rcx, rsi
call fcn.140218a00
mov rcx, qword [rbp + 0x2e0]
xor rcx, rsp
call fcn.1402189e0
lea r11, [rsp + 0x420]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov r8d, 7
lea rdx, str.message
call fcn.14006fee0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x78], rax
movzx ecx, byte [rbp + 0x270]
test cl, cl
jne 0x1400624c0
mov byte [rbp + 0x270], 1
call fcn.1400702d0
mov qword [rbp + 0x278], rax
movzx ecx, byte [rbp + 0x270]
jmp 0x1400624c7
mov rax, qword [rbp + 0x278]
cmp cl, 1
jne 0x140062877
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.140078f20
mov rdi, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140062524
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006251f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006281a
call fcn.140218a00
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x50], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xor eax, eax
mov qword [rsp + 0x48], rax
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.14006df50
mov byte [rsp + 0x40], 3
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.140218afc
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], r12
mov r8d, 0xa
lea rdx, str.invalidver
mov rcx, rax
call fcn.14006fee0
mov qword [rsp + 0x48], rbx
lea rdx, [rsp + 0x40]
lea rcx, [rdi + 0x40]
call fcn.140071120
movzx ebx, al
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.14006df50
nop
test bl, bl
je 0x140062820
jmp 0x140062605
lea rcx, [rbp + 0x270]
call fcn.14006daa0
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x30]
lea rcx, [rbp + 0x2a0]
call fcn.140077b20
nop
mov r8, rax
mov edx, 0x131
lea rcx, [rbp - 0x60]
call fcn.14006f9d0
lea rdx, [0x14031e1d8]
lea rcx, [rbp - 0x60]
call fcn.14021af04
nop
call fcn.14005b960
nop
lea rdx, str.download
lea rcx, [rbp + 0x270]
call fcn.14006f300
lea rdx, [rbp + 0x2a0]
mov rcx, rax
call fcn.14006f420
lea rcx, [rbp + 0x2a0]
call fcn.14006cab0
mov r8, rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor ecx, ecx
call fcn.14022772c
nop
movdqa xmm0, xmmword [0x1402fc6b0]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm1, xmmword [0x1402fc6d0]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm0, xmmword [0x1402fc6c0]
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [0x1402fc680]
movdqa xmmword [rbp - 0x30], xmm1
mov dword [rbp - 0x20], 0x392e036d
mov dword [rbp - 0x1c], 0x24307c3f
mov word [rbp - 0x18], Ordinal_41
mov byte [rbp - 0x16], 1
lea rdx, [rbp - 0x60]
call fcn.1400628c0
mov ecx, 0x1194
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call fcn.14022772c
nop
call fcn.14022ccd0
nop
call fcn.14022ccd0
nop
call fcn.14022ccd0
nop
call fcn.14022ccd0
nop
call fcn.14022ccd0
nop
call fcn.14022ccd0
nop
call fcn.14022ccd0
nop
call fcn.14022ccd0
nop
call fcn.14022ccd0
nop
call fcn.14022ccd0
nop
call fcn.14022ccd0
nop
call fcn.14022ccd0
nop
call fcn.14022ccd0
nop
call fcn.14022ccd0
nop
call fcn.14022ccd0
nop
call fcn.14022ccd0
nop
call fcn.14022ccd0
nop
call fcn.14022ccd0
int3
call fcn.14005ba00
int3
call fcn.14022ccd0
nop
call fcn.14022ccd0
nop
call fcn.14022ccd0
int3
lea rcx, [rbx + 0x40]
call fcn.14006daa0
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x30]
lea rcx, [rbp + 0x2a0]
call fcn.14007d580
nop
mov r8, rax
lea rcx, [rbp - 0x60]
call fcn.14007d340
lea rdx, [0x14031e1d8]
lea rcx, [rbp - 0x60]
call fcn.14021af04
nop
call fcn.14022ccd0
int3
lea rcx, [rbx + 0x40]
call fcn.14006daa0
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x30]
lea rcx, [rbp + 0x2a0]
call fcn.14007d290
nop
mov r8, rax
lea rcx, [rbp - 0x60]
call fcn.14007d340
lea rdx, [0x14031e1d8]
lea rcx, [rbp - 0x60]
call fcn.14021af04
nop
call fcn.14022ccd0
nop
call fcn.14022ccd0
nop
lea rcx, [rbp + 0x270]
call fcn.14006daa0
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x30]
lea rcx, [rbp + 0x2a0]
call fcn.140077b20
nop
mov r8, rax
mov edx, 0x131
lea rcx, [rbp - 0x60]
call fcn.14006f9d0
lea rdx, [0x14031e1d8]
lea rcx, [rbp - 0x60]
call fcn.14021af04
nop
call fcn.14022ccd0
int3
lea rdx, [0x1402fa0c4]
call fcn.14006ef00
lea rdx, str.message
lea rcx, [rbp + 0x270]
call fcn.14006f300
mov rdx, rax
lea rcx, [rbp + 0x2a0]
call fcn.14006f4c0
nop
mov rdx, rax
call fcn.14006f550
nop
lea rcx, [rbp + 0x2a0]
call fcn.14006cb50
mov ecx, 0x1194
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call fcn.14022772c
nop
lea rcx, [rbp + 0x270]
call fcn.14006daa0
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x30]
lea rcx, [rbp + 0x2a0]
call fcn.140077b20
nop
mov r8, rax
mov edx, 0x131
lea rcx, [rbp - 0x60]
call fcn.14006f9d0
lea rdx, [0x14031e1d8]
lea rcx, [rbp - 0x60]
call fcn.14021af04
int3