Function at 0x1400d5800
Capabilities:
Access peb ldr_data
Create thread
Enumerate gui resources
Get ntdll base address
Query environment variable

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x400]
sub rsp, 0x500
movaps xmmword [rsp + 0x4f0], xmm6
mov rax, qword [0x1401a9040]
xor rax, rsp
mov qword [rbp + 0x3e0], rax
mov rax, r8
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rdx
mov r13, rcx
mov qword [rsp + 0x38], rcx
mov qword [rbp - 0x60], rcx
mov qword [rbp - 0x70], rdx
mov qword [rbp - 0x68], rax
xor ebx, ebx
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x10]
mov eax, dword [rdx + 0x30]
add eax, 0x100000
mov dword [rdx + 0x40], eax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x1400d6af3
call fcn.1400c8a40
call fcn.1400c8990
call fcn.1400c86f0
call fcn.1400c88f0
call fcn.1400cfc90
call fcn.1400c8ae0
call fcn.1400cde20
call fcn.1400ce030
call fcn.1400cde90
call fcn.1400ce010
call fcn.1400c84c0
call fcn.1400cd4d0
xor edx, edx
lea rcx, [0x1400c8b00]
call qword [sym.imp.USER32.dll_EnumWindows]
mov ecx, 8
call fcn.1400bd288
test rax, rax
je 0x1400d58eb
lea rcx, [0x1400cf200]
mov qword [rax], rcx
jmp 0x1400d58ee
mov rax, rbx
mov qword [rbp - 0x60], rax
lea rcx, [rbp - 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x1400c0930]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x40], rax
test rax, rax
je 0x1400d6ae5
cmp dword [rbp - 0x38], 0
je 0x1400d69f4
movaps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x60], xmm0
lea rcx, [rbp - 0x60]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x1400d69f4
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x40], xmm0
lea rcx, str.SystemRoot
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xorps xmm0, xmm0
movups xmmword [rbp + 0x48], xmm0
mov qword [rbp + 0x58], rbx
mov qword [rbp + 0x60], rbx
mov r12, 0xffffffffffffffff
mov r8, r12
inc r8
cmp byte [rax + r8], 0
jne 0x1400d5972
mov rdx, rax
lea rcx, [rbp + 0x48]
call fcn.140027910
nop
mov rsi, qword [rbp + 0x58]
lea rcx, [rbp + 0x2d0]
test rsi, rsi
je 0x1400d6ccc
xor edx, edx
mov r8d, 0x110
call sub.VCRUNTIME140.dll_memset
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, rsi
cmp rax, 0x1b
jb 0x1400d6b0c
lea r15, [rbp + 0x48]
cmp qword [rbp + 0x60], 0xf
cmova r15, qword [rbp + 0x48]
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x30], xmm1
lea r14, [rsi + 0x1b]
mov ebx, reloc.WS2_32.dll_ntohs
lea rdi, [rbp - 0x40]
movabs rax, 0x8000000000000000
mov edx, reloc.WLDAP32.dll_Ordinal_22
cmp r14, rbx
jbe 0x1400d5a6f
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x1400d5a30
mov rbx, rcx
add rax, 0x27
mov rcx, rax
call fcn.1400bd288
test rax, rax
je 0x1400d5a5c
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400d5a6b
cmp rbx, rdx
cmovb rbx, rdx
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x1400d5a44
xor edi, edi
jmp 0x1400d5a6b
cmp rcx, 0x1000
jb 0x1400d5a63
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400d69ff
jmp 0x1400d5a15
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bd288
mov rdi, rax
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], rbx
mov r8, rsi
mov rdx, r15
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
movups xmm0, xmmword [str.System32driversetchosts]
movups xmmword [rdi + rsi], xmm0
movsd xmm0, qword [0x140161f78]
movsd qword [rdi + rsi + 0x10], xmm0
movzx eax, word [0x140161f80]
mov word [rdi + rsi + 0x18], ax
movzx eax, byte [reloc.WS2_32.dll_WSAStartup]
mov byte [rdi + rsi + 0x1a], al
mov byte [rdi + r14], 0
lea rdx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0xf
cmova rdx, qword [rbp - 0x40]
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 1
lea rcx, [rbp + 0x2d0]
call fcn.1400511a0
mov rax, qword [rbp + 0x2d0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x2d0], rax
mov rax, qword [rbp + 0x2d0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x2cc], edx
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x1400d5b58
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d5b53
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400d5b53
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bd504
movdqa xmm6, xmmword [0x14018ca60]
movdqu xmmword [rbp - 0x30], xmm6
mov byte [rbp - 0x40], 0
cmp qword [rbp + 0x360], 0
je 0x1400d6c89
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
xor r14d, r14d
mov qword [rbp + 0x38], r14
mov qword [rbp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x28], r14b
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x40], r14b
mov rax, qword [rbp + 0x2d0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x2d0]
add rcx, rax
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
movzx r8d, al
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x2d0]
call fcn.1400c2460
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
test al, al
je 0x1400d5dc5
mov rsi, qword [rbp - 0x30]
movabs rax, 0x7fffffffffffffff
cmp rsi, rax
je 0x1400d6b18
lea r15, [rbp - 0x40]
cmp qword [rbp - 0x28], 0xf
cmova r15, qword [rbp - 0x40]
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x48], r14
lea r14, [rsi + 1]
mov ebx, reloc.WS2_32.dll_ntohs
lea rdi, [rbp - 0x60]
cmp r14, rbx
jbe 0x1400d5cae
mov rbx, r14
or rbx, 0xf
cmp rbx, rax
jbe 0x1400d5c53
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x1400d5c83
cmp rbx, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x1400d5c6d
xor edi, edi
jmp 0x1400d5caa
cmp rcx, 0x1000
jb 0x1400d5ca2
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400d6b12
mov rcx, rax
call fcn.1400bd288
test rax, rax
je 0x1400d5dbe
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400d5caa
call fcn.1400bd288
mov rdi, rax
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x48], rbx
mov r8, rsi
mov rdx, r15
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], 0xa
mov byte [rdi + r14], 0
lea r9, [rbp - 0x60]
mov rdi, qword [rbp - 0x60]
mov r14, qword [rbp - 0x48]
cmp r14, 0xf
cmova r9, rdi
mov r15, qword [rbp + 0x38]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
sub rax, r15
mov rsi, qword [rbp - 0x50]
cmp rsi, rax
ja 0x1400d5d26
lea rax, [rsi + r15]
mov qword [rbp + 0x38], rax
lea rbx, [rbp + 0x28]
cmp rcx, 0xf
cmova rbx, qword [rbp + 0x28]
lea rcx, [rbx + r15]
mov r8, rsi
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
lea rax, [rbx + r15]
mov byte [rax + rsi], 0
jmp 0x1400d5d42
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov rdx, rsi
lea rcx, [rbp + 0x28]
call fcn.1400c09d0
mov r14, qword [rbp - 0x48]
mov rdi, qword [rbp - 0x60]
cmp r14, 0xf
jbe 0x1400d5d75
lea rdx, [r14 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400d5d6d
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400d5dbe
mov rcx, rdi
call fcn.1400bd504
mov rax, qword [rbp + 0x2d0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x2d0]
add rcx, rax
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
movzx r8d, al
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x2d0]
call fcn.1400c2460
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
xor r14d, r14d
jmp 0x1400d5be6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rcx, [rbp + 0x2e0]
call fcn.140026210
test rax, rax
jne 0x1400d5df9
mov rax, qword [rbp + 0x2d0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x2d0]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
lea rbx, [rbp + 0x28]
cmp qword [rbp + 0x40], 0xf
cmova rbx, qword [rbp + 0x28]
mov rax, qword [rbp + 0x38]
cmp rax, 0xd
jb 0x1400d5e6c
lea rdi, [rbx + rax]
lea r8, [rdi - 0xc]
sub r8, rbx
mov edx, reloc.WS2_32.dll_WSAStartup
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x1400d5e6c
movabs rsi, 0x656a6f7270796b73
cmp qword [rax], rsi
jne 0x1400d5e50
cmp dword [rax + 8], 0x632e7463
jne 0x1400d5e50
cmp byte [rax + 0xc], 0x63
je 0x1400d5f8f
inc rax
lea r8, [rdi - 0xc]
sub r8, rax
mov edx, reloc.WS2_32.dll_WSAStartup
mov rcx, rax
call sub.VCRUNTIME140.dll_memchr
test rax, rax
jne 0x1400d5e38
lea rcx, [rbp - 0x40]
call fcn.140025f20
nop
lea rcx, [rbp + 0x28]
call fcn.140025f20
nop
lea rcx, [rbp + 0x2d0]
call fcn.14002af00
lea rdx, [0x14030f538]
lea rcx, [0x1400d98d0]
call fcn.1400cf470
mov qword [rsp + 0x78], rax
lea rdx, [0x14030f540]
lea rcx, [0x1400d44d0]
call fcn.1400cf470
mov qword [rbp - 0x40], rax
lea rdx, [0x14030f548]
lea rcx, [0x1400d4470]
call fcn.1400cf470
mov qword [rbp - 0x60], rax
lea rdx, [0x1400d98d0]
lea rcx, [rsp + 0x78]
call fcn.1400d6dd0
lea rdx, [0x1400d44d0]
lea rcx, [rbp - 0x40]
call fcn.1400d6dd0
lea rdx, [0x1400d4470]
lea rcx, [rbp - 0x60]
call fcn.1400d6dd0
mov ecx, 3
call fcn.1400dc160
call fcn.1400dbf50
mov rdi, rax
test rax, rax
jne 0x1400d5fa1
mov dword [rsp + 0x30], 0xc332b33
mov word [rsp + 0x34], 0x100
mov rdx, r13
lea rcx, [rsp + 0x30]
call fcn.1400c7e50
nop
lea rcx, [rbp + 0x48]
call fcn.140025f20
nop
mov rcx, qword [rsp + 0x70]
call fcn.140025f20
nop
mov rcx, qword [rsp + 0x68]
call fcn.140025f20
mov rax, r13
mov rcx, qword [rbp + 0x3e0]
xor rcx, rsp
call fcn.1400bdae0
mov rbx, qword [rsp + 0x558]
movaps xmm6, xmmword [rsp + 0x4f0]
add rsp, 0x500
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
sub rax, rbx
cmp rax, 0xffffffffffffffff
jne 0x1400d6a05
jmp 0x1400d5e6c
xorps xmm0, xmm0
movups xmmword [rbp + 8], xmm0
mov qword [rbp + 0x18], r14
mov qword [rbp + 0x20], reloc.WS2_32.dll_ntohs
mov byte [rbp + 8], 0
movups xmmword [rbp + 0xa8], xmm0
movdqu xmmword [rbp + 0xb8], xmm6
mov byte [rbp + 0xa8], 0
movups xmmword [rbp + 0x148], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x158], xmm1
mov r8d, 0x40
lea rdx, str.NWM6MTc6Mzg6YzQ6ZGE6MjI6OTM6N2I6MGU6ZjE6YzI6ODE6YTM6Y2Y6YzQ6NmM6
lea rcx, [rbp + 0x148]
call fcn.140027910
nop
lea rdx, [rbp + 0x148]
lea rcx, [rbp + 0x108]
call fcn.1400d9920
nop
lea rsi, [rbp + 0x108]
cmp qword [rbp + 0x120], 0xf
cmova rsi, qword [rbp + 0x108]
xorps xmm0, xmm0
movups xmmword [rbp + 0x188], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x198], xmm1
mov r8d, reloc.WS2_32.dll_sendto
lea rdx, str.U2VyaWFsIE51bWJlcjo
lea rcx, [rbp + 0x188]
call fcn.140027910
nop
lea rdx, [rbp + 0x188]
lea rcx, [rbp + 0xe8]
call fcn.1400d9920
nop
lea r14, [rbp + 0xe8]
cmp qword [rbp + 0x100], 0xf
cmova r14, qword [rbp + 0xe8]
xorps xmm0, xmm0
movups xmmword [rbp + 0x168], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x178], xmm1
mov r8d, Ordinal_30
lea rdx, str.R29vZ2xlIFRydXN0IFNlcnZpY2Vz
lea rcx, [rbp + 0x168]
call fcn.140027910
nop
lea rdx, [rbp + 0x168]
lea rcx, [rbp + 0xc8]
call fcn.1400d9920
nop
lea r15, [rbp + 0xc8]
cmp qword [rbp + 0xe0], 0xf
cmova r15, qword [rbp + 0xc8]
xorps xmm0, xmm0
movups xmmword [rbp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x78], xmm1
mov r8d, recvfrom
lea rdx, str.dG9rZW5meA
lea rcx, [rbp + 0x68]
call fcn.140027910
nop
lea rdx, [rbp + 0x68]
lea rcx, [rbp + 0x268]
call fcn.1400d9920
nop
lea rbx, [rbp + 0x268]
cmp qword [rbp + 0x280], 0xf
cmova rbx, qword [rbp + 0x268]
xorps xmm0, xmm0
movups xmmword [rbp + 0x248], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x258], xmm1
mov r8d, 8
lea rdx, str.VEgzS0VO
lea rcx, [rbp + 0x248]
call fcn.140027910
nop
lea rdx, [rbp + 0x248]
lea rcx, [rbp + 0x228]
call fcn.1400d9920
nop
lea r13, [rbp + 0x228]
cmp qword [rbp + 0x240], 0xf
cmova r13, qword [rbp + 0x228]
xorps xmm0, xmm0
movups xmmword [rbp + 0x208], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x218], xmm1
mov r8d, reloc.WS2_32.dll_sendto
lea rdx, str.c2t5cHJvamVjdC5jYw
lea rcx, [rbp + 0x208]
call fcn.140027910
nop
lea rdx, [rbp + 0x208]
lea rcx, [rbp + 0x1e8]
call fcn.1400d9920
nop
lea rax, [rbp + 0x1e8]
cmp qword [rbp + 0x200], 0xf
cmova rax, qword [rbp + 0x1e8]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x68]
mov r8, rax
cmp qword [rax + 0x18], 0xf
jbe 0x1400d61f2
mov r8, qword [rax]
mov edx, 0x2712
mov rcx, rdi
call fcn.1400df110
mov edx, reloc.WLDAP32.dll_Ordinal_32
mov r8d, 6
mov rcx, rdi
call fcn.1400df110
mov edx, 0x51
mov r8d, 2
mov rcx, rdi
call fcn.1400df110
mov edx, 0x40
mov r8d, 1
mov rcx, rdi
call fcn.1400df110
mov r8, qword [rsp + 0x30]
mov edx, 0x27c1
mov rcx, rdi
call fcn.1400df110
mov r8, r13
mov edx, 0x2722
mov rcx, rdi
call fcn.1400df110
mov edx, 0xac
mov r8d, 1
mov rcx, rdi
call fcn.1400df110
mov edx, reloc.WS2_32.dll_listen
mov r8d, reloc.WS2_32.dll_sendto
mov rcx, rdi
call fcn.1400df110
mov rax, qword [rsp + 0x70]
mov r8, rax
cmp qword [rax + 0x18], 0xf
jbe 0x1400d6292
mov r8, qword [rax]
mov edx, 0x271f
mov rcx, rdi
call fcn.1400df110
lea r8, [0x1400d98a0]
mov edx, 0x4e2b
mov rcx, rdi
call fcn.1400df110
lea r8, [rbp + 8]
mov edx, 0x2711
mov rcx, rdi
call fcn.1400df110
lea r8, [0x1400d0cf0]
mov edx, 0x4e6f
mov rcx, rdi
call fcn.1400df110
lea r8, [rbp + 0xa8]
mov edx, 0x272d
mov rcx, rdi
call fcn.1400df110
lea rdx, str.Cache_Control:_no_cache
xor ecx, ecx
call fcn.1400dc2c0
mov r13, rax
mov qword [rsp + 0x30], rax
mov r8, rax
mov edx, 0x2727
mov rcx, rdi
call fcn.1400df110
mov rcx, rdi
call fcn.1400dbfc0
test eax, eax
jne 0x1400d6b1e
cmp dword [0x14030f550], eax
jne 0x1400d6394
xorps xmm0, xmm0
movups xmmword [rbp + 0x88], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x98], xmm1
mov r8, r12
inc r8
cmp byte [rbx + r8], 0
jne 0x1400d6342
mov rdx, rbx
lea rcx, [rbp + 0x88]
call fcn.140027910
nop
lea r8, [rbp + 0x88]
lea rdx, [rbp + 0xa8]
lea rcx, [rbp - 0x20]
call fcn.1400d9450
nop
lea rcx, [rbp + 0x88]
call fcn.140025f20
cmp qword [rbp - 0x10], 0x24
jne 0x1400d6bbe
lea rcx, [rbp - 0x20]
call fcn.140025f20
lea r8, [rbp - 0x78]
mov edx, 0x400022
mov rcx, rdi
call fcn.1400dbf20
test eax, eax
jne 0x1400d6b6e
xor r13d, r13d
mov rax, qword [rbp - 0x78]
cmp dword [rax], r13d
jle 0x1400d6a45
xor r12d, r12d
mov rbx, qword [rax + 8]
mov rbx, qword [r12 + rbx]
test rbx, rbx
je 0x1400d63fd
nop dword [rax]
mov rdx, r14
mov rcx, qword [rbx]
call sub.VCRUNTIME140.dll_strstr
test rax, rax
je 0x1400d63f0
mov rdx, rsi
mov rcx, qword [rbx]
call sub.VCRUNTIME140.dll_strstr
test rax, rax
jne 0x1400d640f
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x1400d63d0
mov rax, qword [rbp - 0x78]
inc r13d
add r12, 8
cmp r13d, dword [rax]
jge 0x1400d6a45
jmp 0x1400d63c0
xor r14d, r14d
mov rcx, qword [rbp - 0x78]
cmp dword [rcx], r14d
jle 0x1400d6a95
xor esi, esi
mov rax, qword [rcx + 8]
mov rbx, qword [rsi + rax]
test rbx, rbx
je 0x1400d644d
nop
mov rdx, r15
mov rcx, qword [rbx]
call sub.VCRUNTIME140.dll_strstr
test rax, rax
jne 0x1400d645f
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x1400d6430
mov rcx, qword [rbp - 0x78]
inc r14d
add rsi, 8
cmp r14d, dword [rcx]
jge 0x1400d6a95
jmp 0x1400d6421
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1400d646f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x1400d647e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x1400d648d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x30], xmm1
mov r8d, Ordinal_26
lea rdx, str.SW52YWxpZCB1c2VybmFtZQ
lea rcx, [rbp - 0x40]
call fcn.140027910
nop
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x1c8]
call fcn.1400d9920
nop
lea rbx, [rbp + 0x1c8]
cmp qword [rbp + 0x1e0], 0xf
cmova rbx, qword [rbp + 0x1c8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
mov r8d, Ordinal_30
lea rdx, str.SW52YWxpZCBsaWNlbnNlIGtleQ
lea rcx, [rbp - 0x20]
call fcn.140027910
nop
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x2a8]
call fcn.1400d9920
nop
lea rsi, [rbp + 0x2a8]
cmp qword [rbp + 0x2c0], 0xf
cmova rsi, qword [rbp + 0x2a8]
xorps xmm0, xmm0
movups xmmword [rbp + 0x128], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x138], xmm1
mov r8d, reloc.WLDAP32.dll_Ordinal_32
lea rdx, str.RXJyb3IgOiBJbnZhbGlkIHVzZXJuYW1l
lea rcx, [rbp + 0x128]
call fcn.140027910
nop
lea rdx, [rbp + 0x128]
lea rcx, [rbp + 0x1a8]
call fcn.1400d9920
nop
lea r13, [rbp + 0x1a8]
cmp qword [rbp + 0x1c0], 0xf
cmova r13, qword [rbp + 0x1a8]
xorps xmm0, xmm0
movups xmmword [rbp + 0x88], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x98], xmm1
mov r8d, Ordinal_41
lea rdx, str.RXJyb3IgOiBJbnZhbGlkIGxpY2Vuc2Uga2V5
lea rcx, [rbp + 0x88]
call fcn.140027910
nop
lea rdx, [rbp + 0x88]
lea rcx, [rbp + 0x288]
call fcn.1400d9920
nop
lea rax, [rbp + 0x288]
cmp qword [rbp + 0x2a0], 0xf
cmova rax, qword [rbp + 0x288]
mov qword [rbp - 0x60], rax
mov r14, 0xffffffffffffffff
mov rax, r14
nop dword [rax + rax]
inc rax
cmp byte [rbx + rax], 0
jne 0x1400d65f0
lea rcx, [rbp + 8]
mov r15, qword [rbp + 8]
mov r12, qword [rbp + 0x20]
cmp r12, 0xf
cmova rcx, r15
mov qword [rsp + 0x20], rax
mov r9, rbx
xor r8d, r8d
mov rbx, qword [rbp + 0x18]
mov rdx, rbx
call fcn.1400c0e80
cmp rax, r14
jne 0x1400d6c11
nop dword [rax]
inc r14
cmp byte [rsi + r14], 0
jne 0x1400d6630
lea rcx, [rbp + 8]
cmp r12, 0xf
cmova rcx, r15
mov qword [rsp + 0x20], r14
mov r9, rsi
xor r8d, r8d
mov rdx, rbx
call fcn.1400c0e80
cmp rax, 0xffffffffffffffff
jne 0x1400d6c4c
mov rcx, rdi
call fcn.1400dbef0
mov rcx, qword [rsp + 0x30]
call fcn.1400dc380
mov rbx, qword [rsp + 0x38]
xor edi, edi
movups xmm0, xmmword [rbp + 8]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp + 0x18]
movups xmmword [rbx + 0x10], xmm1
mov qword [rbp + 0x18], rdi
mov qword [rbp + 0x20], reloc.WS2_32.dll_ntohs
mov byte [rbp + 8], dil
lea rcx, [rbp + 0x288]
call fcn.140025f20
nop
lea rcx, [rbp + 0x88]
call fcn.140025f20
nop
lea rcx, [rbp + 0x1a8]
call fcn.140025f20
nop
lea rcx, [rbp + 0x128]
call fcn.140025f20
nop
lea rcx, [rbp + 0x2a8]
call fcn.140025f20
nop
lea rcx, [rbp - 0x20]
call fcn.140025f20
nop
lea rcx, [rbp + 0x1c8]
call fcn.140025f20
nop
mov r8, qword [rbp - 0x28]
cmp r8, 0xf
jbe 0x1400d670b
mov rdx, qword [rbp - 0x40]
lea rcx, [rbp - 0x40]
call fcn.140026450
nop
lea rcx, [rbp + 0x1e8]
call fcn.140025f20
nop
lea rcx, [rbp + 0x208]
call fcn.140025f20
nop
lea rcx, [rbp + 0x228]
call fcn.140025f20
nop
lea rcx, [rbp + 0x248]
call fcn.140025f20
nop
lea rcx, [rbp + 0x268]
call fcn.140025f20
nop
lea rcx, [rbp + 0x68]
call fcn.140025f20
nop
mov rdx, qword [rbp + 0xe0]
cmp rdx, 0xf
jbe 0x1400d679a
inc rdx
mov rcx, qword [rbp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d6795
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400d6795
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bd504
movdqu xmmword [rbp + 0xd8], xmm6
mov byte [rbp + 0xc8], 0
mov rdx, qword [rbp + 0x180]
cmp rdx, 0xf
jbe 0x1400d67ee
inc rdx
mov rcx, qword [rbp + 0x168]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d67e8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400d67e8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bd504
nop
mov rdx, qword [rbp + 0x100]
cmp rdx, 0xf
jbe 0x1400d6832
inc rdx
mov rcx, qword [rbp + 0xe8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d682d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400d682d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bd504
movdqu xmmword [rbp + 0xf8], xmm6
mov byte [rbp + 0xe8], 0
mov rdx, qword [rbp + 0x1a0]
cmp rdx, 0xf
jbe 0x1400d6886
inc rdx
mov rcx, qword [rbp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d6880
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400d6880
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bd504
nop
mov rdx, qword [rbp + 0x120]
cmp rdx, 0xf
jbe 0x1400d68ca
inc rdx
mov rcx, qword [rbp + 0x108]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d68c5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400d68c5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bd504
movdqu xmmword [rbp + 0x118], xmm6
mov byte [rbp + 0x108], 0
mov rdx, qword [rbp + 0x160]
cmp rdx, 0xf
jbe 0x1400d691e
inc rdx
mov rcx, qword [rbp + 0x148]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d6918
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400d6918
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bd504
nop
mov rdx, qword [rbp + 0xc0]
cmp rdx, 0xf
jbe 0x1400d6962
inc rdx
mov rcx, qword [rbp + 0xa8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d695d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400d695d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bd504
movdqu xmmword [rbp + 0xb8], xmm6
mov byte [rbp + 0xa8], 0
mov rdx, qword [rbp + 0x20]
cmp rdx, 0xf
jbe 0x1400d69af
inc rdx
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d69aa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400d69aa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bd504
mov qword [rbp + 0x18], rdi
mov qword [rbp + 0x20], reloc.WS2_32.dll_ntohs
mov byte [rbp + 8], 0
mov r8, qword [rbp + 0x60]
cmp r8, 0xf
jbe 0x1400d69d7
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x48]
call fcn.140026450
nop
mov rcx, qword [rsp + 0x70]
call fcn.140025f20
nop
mov rcx, qword [rsp + 0x68]
call fcn.140025f20
mov rax, rbx
jmp 0x1400d5f5d
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
call fcn.140002b40
nop
movdqa xmm0, xmmword [str.e_6_f]
movdqu xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x1401623c0]
movdqu xmmword [rsp + 0x50], xmm1
mov dword [rsp + 0x60], 0x101813
mov byte [rsp + 0x64], 1
lea rdx, [rbp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.1400c8090
mov rcx, rax
call fcn.1400d01c0
nop
mov rcx, rdi
call fcn.1400dbef0
mov rcx, qword [rsp + 0x30]
call fcn.1400dc380
movdqa xmm0, xmmword [0x140162410]
movdqu xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x1401623b0]
movdqu xmmword [rbp - 0x10], xmm1
mov dword [rbp], 0xe41a171b
mov word [rbp + 4], 0x100
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x20]
call fcn.1400c8150
mov rcx, rax
call fcn.1400d01c0
int3
mov rcx, rdi
call fcn.1400dbef0
mov rcx, qword [rsp + 0x30]
call fcn.1400dc380
movdqa xmm0, xmmword [0x140162410]
movdqu xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x1401623b0]
movdqu xmmword [rbp - 0x10], xmm1
mov dword [rbp], 0xe41a171b
mov word [rbp + 4], 0x100
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x20]
call fcn.1400c8150
mov rcx, rax
call fcn.1400d01c0
nop
mov dword [rbp - 0x38], ebx
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
lea rdx, str.Debugger_Detected.
lea rcx, [rbp + 0x68]
call fcn.140025f80
mov rcx, rax
call fcn.1400d01c0
nop
call fcn.140020da0
nop
call fcn.140002b40
int3
call fcn.140020da0
nop
mov rcx, rdi
call fcn.1400dbef0
mov rcx, r13
call fcn.1400dc380
movdqa xmm0, xmmword [str.e_6_f]
movdqu xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x1401623c0]
movdqu xmmword [rsp + 0x50], xmm1
mov dword [rsp + 0x60], 0x101813
mov byte [rsp + 0x64], 1
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x40]
call fcn.1400c8090
mov rcx, rax
call fcn.1400d01c0
int3
mov rcx, rdi
call fcn.1400dbef0
mov rcx, r13
call fcn.1400dc380
movdqa xmm0, xmmword [str.e_6_f]
movdqu xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x1401623c0]
movdqu xmmword [rsp + 0x50], xmm1
mov dword [rsp + 0x60], 0x101813
mov byte [rsp + 0x64], 1
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x40]
call fcn.1400c8090
mov rcx, rax
call fcn.1400d01c0
nop
mov rcx, rdi
call fcn.1400dbef0
mov rcx, r13
call fcn.1400dc380
movdqa xmm0, xmmword [str.e_6_f]
movdqu xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x1401623c0]
movdqu xmmword [rsp + 0x50], xmm1
mov dword [rsp + 0x60], 0x101813
mov byte [rsp + 0x64], 1
lea rdx, [rbp + 0x128]
lea rcx, [rsp + 0x40]
call fcn.1400c8090
mov rcx, rax
call fcn.1400d01c0
nop
mov rcx, qword [rsp + 0x68]
call fcn.140026410
mov rbx, rax
xor edx, edx
mov rcx, qword [rsp + 0x68]
call fcn.140051180
mov rcx, rax
mov r8, rbx
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rdx, r13
lea rcx, [rbp - 0x60]
call fcn.140025f80
mov rcx, rax
call fcn.1400d01c0
int3
mov rcx, qword [rsp + 0x68]
call fcn.140026410
mov rbx, rax
xor edx, edx
mov rcx, qword [rsp + 0x68]
call fcn.140051180
mov rcx, rax
mov r8, rbx
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rdx, qword [rbp - 0x60]
lea rcx, [rsp + 0x40]
call fcn.140025f80
mov rcx, rax
call fcn.1400d01c0
nop
movdqa xmm0, xmmword [0x140162420]
movdqu xmmword [rbp - 0x60], xmm0
mov dword [rbp - 0x50], 0x1503072b
mov dword [rbp - 0x4c], 0x1a163651
mov dword [rbp - 0x48], 0x5813131c
mov word [rbp - 0x44], 0x58
mov byte [rbp - 0x42], 1
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x60]
call fcn.1400c7fe0
mov rcx, rax
call fcn.1400d01c0
nop
mov edx, 0x110
call fcn.1400cde10
lea r8, str.System32driversetchosts
lea rdx, [rbp + 0x48]
lea rcx, [rsp + 0x40]
call fcn.1400be890
nop
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 1
mov rdx, rax
lea rcx, [rbp + 0x2d0]
call fcn.140050de0
nop
lea rcx, [rsp + 0x40]
call fcn.140025f20
lea rcx, [rbp + 0x2d0]
call fcn.14002b1d0
movdqa xmm0, xmmword [0x140162360]
movdqu xmmword [rbp - 0x60], xmm0
mov dword [rbp - 0x50], 0x40e0d04
mov dword [rbp - 0x4c], 0x551d1d18
mov word [rbp - 0x48], 0x100
lea rdx, [rbp + 0x68]
lea rcx, [rbp - 0x60]
call fcn.1400c7f50
mov rcx, rax
call fcn.1400d01c0
int3