Function at 0x14000fae0
Capabilities:
Access peb ldr_data
Check for debugger via api
Contain obfuscated stackstrings
Create process on windows
Create thread
Delete file
Encode data using xor
Get common file path
Hash data using fnv
Resolve function by parsing pe exports
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x338]
sub rsp, 0x410
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [0x1401c3080]
xor rax, rsp
mov qword [rbp + 0x2e0], rax
xor r13d, r13d
call fcn.140081df8
call fcn.140081da0
call fcn.140081e0e
call fcn.140081da0
call fcn.140081dcc
call fcn.140081db6
call fcn.140081dcc
call fcn.140081db6
call fcn.140081de2
lea rcx, str.main
call qword [sym.imp.VMProtectSDK64.dll_VMProtectBeginUltra]
call fcn.140025d90
call fcn.14000f6c0
lea rcx, [0x140220220]
call fcn.1400f9430
mov rcx, qword [0x14021ff40]
test rcx, rcx
jne 0x14000fd34
mov r9d, r13d
mov edi, 0x9bc5a608
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r12, qword [rax]
mov rsi, r12
movups xmm0, xmmword [rsi + 0x58]
movd eax, xmm0
sub ax, 8
test r9d, r9d
je 0x14000fbed
psrldq xmm0, 8
movq rcx, xmm0
movzx eax, ax
shr rax, 1
lea r8, [rcx + rax*2]
mov edx, 0x811c9dc5
cmp rcx, r8
je 0x14000fbe4
movsx eax, byte [rcx]
xor eax, edx
imul edx, eax, 0x1000193
add rcx, 2
cmp rcx, r8
jne 0x14000fbd0
cmp edx, r9d
jne 0x14000fd15
mov r10, qword [rsi + 0x30]
movsxd rax, dword [r10 + 0x3c]
mov rcx, qword [rax + r10 + 0x88]
mov r15, rcx
shr r15, 0x20
mov ebx, ecx
add rbx, r10
cmp rbx, r10
je 0x14000fd15
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x14000fd15
mov r14d, dword [rbx + 0x20]
nop dword [rax]
nop word [rax + rax]
dec r8d
lea rax, [r14 + r8*4]
mov ecx, dword [rax + r10]
add rcx, r10
mov edx, 0x811c9dc5
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x14000fc66
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x14000fc50
cmp edx, edi
je 0x14000fc74
test r8d, r8d
jne 0x14000fc30
jmp 0x14000fd15
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rbx + 0x24]
add rax, r10
movzx eax, word [rax + r8*2]
mov ecx, dword [rcx + rax*4]
add rcx, r10
cmp rcx, rbx
jbe 0x14000fd2d
lea rax, [rbx + r15]
cmp rcx, rax
jae 0x14000fd2d
mov r9d, 0x811c9dc5
mov dword [rbp - 0x78], r9d
mov edx, r9d
mov dword [rbp - 0x74], edx
movzx eax, byte [rcx]
cmp al, 0x2e
je 0x14000fcdb
nop dword [rax + rax]
movsx eax, al
xor eax, r9d
imul r9d, eax, 0x1000193
inc rcx
movzx eax, byte [rcx]
cmp al, 0x2e
jne 0x14000fcc0
mov dword [rbp - 0x78], r9d
inc rcx
movzx eax, byte [rcx]
test al, al
je 0x14000fd09
nop word [rax + rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
lea rcx, [rcx + 1]
movzx eax, byte [rcx]
test al, al
jne 0x14000fcf0
mov dword [rbp - 0x74], edx
mov rsi, qword [r12]
mov rdi, qword [rbp - 0x78]
shr rdi, 0x20
mov rax, qword [rsi]
mov rsi, rax
cmp rax, r12
je 0x14000fd2a
cmp qword [rax + 0x30], r13
jne 0x14000fba1
mov rcx, r13
mov qword [0x14021ff40], rcx
call rcx
mov rcx, rax
call fcn.140006b70
call fcn.14000a2f0
call fcn.140007190
call fcn.140006900
call fcn.140004340
call fcn.140002d30
call fcn.140009770
call fcn.140007c60
call fcn.14000ae70
call fcn.14000a930
call fcn.140006740
call fcn.140004db0
call fcn.140004b00
call fcn.140008770
test al, al
je 0x14000fdbc
mov dword [rbp - 0x66], 0x3f203f
mov dword [rbp - 0x70], 0x63616c62
mov dword [rbp - 0x6c], 0x73696c6b
mov word [rbp - 0x68], 0x2074
mov byte [rbp - 0x62], r13b
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140003f80
call fcn.140009140
test al, al
je 0x14000fdfe
mov dword [rbp - 0x66], 0x3f203f
mov dword [rbp - 0x70], 0x63616c62
mov dword [rbp - 0x6c], 0x73696c6b
mov word [rbp - 0x68], 0x2074
mov byte [rbp - 0x62], r13b
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140003f80
call fcn.140007f80
test eax, eax
je 0x14000fe40
mov dword [rbp - 0x66], 0x3f203f
mov dword [rbp - 0x70], 0x63616c62
mov dword [rbp - 0x6c], 0x73696c6b
mov word [rbp - 0x68], 0x2074
mov byte [rbp - 0x62], r13b
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140003f80
call fcn.14000a0a0
test al, al
je 0x14000fe82
mov dword [rbp - 0x66], 0x3f203f
mov dword [rbp - 0x70], 0x63616c62
mov dword [rbp - 0x6c], 0x73696c6b
mov word [rbp - 0x68], 0x2074
mov byte [rbp - 0x62], r13b
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140003f80
call fcn.1400077a0
test eax, eax
je 0x14000fec4
mov dword [rbp - 0x66], 0x3f203f
mov dword [rbp - 0x70], 0x63616c62
mov dword [rbp - 0x6c], 0x73696c6b
mov word [rbp - 0x68], 0x2074
mov byte [rbp - 0x62], r13b
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140003f80
call fcn.14000adf0
test al, al
je 0x14000ff06
mov dword [rbp - 0x66], 0x3f203f
mov dword [rbp - 0x70], 0x63616c62
mov dword [rbp - 0x6c], 0x73696c6b
mov word [rbp - 0x68], 0x2074
mov byte [rbp - 0x62], r13b
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140003f80
call fcn.140008360
test eax, eax
je 0x14000ff48
mov dword [rbp - 0x66], 0x3f203f
mov dword [rbp - 0x70], 0x63616c62
mov dword [rbp - 0x6c], 0x73696c6b
mov word [rbp - 0x68], 0x2074
mov byte [rbp - 0x62], r13b
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140003f80
call fcn.14000bd30
test al, al
je 0x14000ff7d
lea rdx, str.Hyper_hide_check_failed
lea rcx, [rsp + 0x38]
call fcn.140002bf0
mov rdx, rax
lea rcx, [0x140220220]
call fcn.1400f7af0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.14000c680
test al, al
je 0x14000ffb2
lea rdx, str.Hyper_hide_binary_check_failed
lea rcx, [rsp + 0x38]
call fcn.140002bf0
mov rdx, rax
lea rcx, [0x140220220]
call fcn.1400f7af0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.14000c940
test al, al
je 0x14000ffe7
lea rdx, str.Air_HVHbinary_check_failed
lea rcx, [rsp + 0x38]
call fcn.140002bf0
mov rdx, rax
lea rcx, [0x140220220]
call fcn.1400f7af0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.14000bfa0
test al, al
je 0x14001001c
lea rdx, str.Titen_Hide_check_failed
lea rcx, [rsp + 0x38]
call fcn.140002bf0
dec dword [rax - 0x75]
ror byte [rax - 0x73], 1
or eax, 0x210215
call fcn.1400f7af0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.14000cbf0
test al, al
je 0x140010051
lea rdx, str.TitanHideBinaryCheckfailed
lea rcx, [rsp + 0x38]
call fcn.140002bf0
mov rdx, rax
lea rcx, [0x140220220]
call fcn.1400f7af0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.14000c1b0
test al, al
je 0x140010086
lea rdx, str.ProcessHackerCheck
lea rcx, [rsp + 0x38]
call fcn.140002bf0
mov rdx, rax
lea rcx, [0x140220220]
call fcn.1400f7af0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.14000c480
test al, al
je 0x1400100bb
lea rdx, str.KsDumperCheck
lea rcx, [rsp + 0x38]
call fcn.140002bf0
mov rdx, rax
lea rcx, [0x140220220]
call fcn.1400f7af0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [rbp - 0x78], r13d
je case.0x14010acce.34
lea rdx, str.CheckRemoteDebuggerPresentAPI
lea rcx, [rsp + 0x38]
call fcn.140002bf0
mov rdx, rax
lea rcx, [0x140220220]
call fcn.1400f7af0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.14000b330
test eax, eax
je 0x140010135
lea rdx, str.NtQueryInformationProcess_ProcessDbgPort
lea rcx, [rsp + 0x38]
call fcn.140002bf0
mov rdx, rax
lea rcx, [0x140220220]
call fcn.1400f7af0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14001016b
lea rdx, str.IsDebuggerPresentAPI
lea rcx, [rsp + 0x38]
call fcn.140002bf0
mov rdx, rax
lea rcx, [0x140220220]
call fcn.1400f7af0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [rbp - 0x78], r13
lea rcx, [0x140185eb8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.NtQueryInformationProcess
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp - 0x78]
mov edx, reloc.WLDAP32.dll_Ordinal_30
call rbx
test eax, eax
mov eax, r13d
jne 0x1400101bc
cmp qword [rbp - 0x78], rax
setne al
test eax, eax
je 0x1400101ec
lea rdx, str.NtQueryInformationProcess_ProcessDebugObject
lea rcx, [rsp + 0x38]
call fcn.140002bf0
mov rdx, rax
lea rcx, [0x140220220]
call fcn.1400f7af0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.14000b6c0
test eax, eax
je 0x140010221
lea rdx, str.NtQueryInformationProcess_SystemKernelDebuggerInformation
lea rcx, [rsp + 0x38]
call fcn.140002bf0
mov rdx, rax
lea rcx, [0x140220220]
call fcn.1400f7af0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.14000ba20
test eax, eax
je 0x140010256
lea rdx, str.NtSetInformationThread_ThreadHideFromDebugger
lea rcx, [rsp + 0x38]
call fcn.140002bf0
mov rdx, rax
lea rcx, [0x140220220]
call fcn.1400f7af0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.14000bd10
test eax, eax
je 0x14001028b
lea rdx, str.CloseHandleAPI
lea rcx, [rsp + 0x38]
call fcn.140002bf0
mov rdx, rax
lea rcx, [0x140220220]
call fcn.1400f7af0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, str.CheckForTimingAnomalies
call qword [sym.imp.VMProtectSDK64.dll_VMProtectBegin]
lea rcx, [rsp + 0x30]
call fcn.1400020f0
mov dword [rbp - 0x78], r13d
mov edx, r13d
nop dword [rax]
mov ecx, edx
imul ecx, edx
mov eax, dword [rbp - 0x78]
add ecx, eax
mov dword [rbp - 0x78], ecx
inc edx
cmp edx, 0x3e8
jl 0x1400102b0
lea rcx, [rbp - 0x78]
call fcn.1400020f0
mov rax, qword [rbp - 0x78]
sub rax, qword [rsp + 0x30]
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
divsd xmm0, qword [0x1401a5988]
comisd xmm0, xmmword [0x1401a5908]
ja 0x140011980
call qword [sym.imp.VMProtectSDK64.dll_VMProtectEnd]
mov edx, 4
mov rcx, qword [sym.imp.KERNEL32.dll_GetStdHandle]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._n__________________________________________________________n______________________________________________________n______________________________________________________n___________________________________________________n____________________________________________________n__________________________________________________n__________________________________________________n_____________________________________________________n__________________________________________________________n__________________________________________________________n__________________________________________________________n__________________________________________________________n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140015750
lea rdx, [0x140015920]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
movabs r15, 0xff00ff00ff00ff00
mov qword [rbp + 0x78], r15
lea rcx, [rbp + 0x338]
mov qword [rbp + 0x80], rcx
mov rax, qword [rcx]
xor rax, r15
mov qword [rbp + 0x70], rax
mov qword [rcx], r13
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, [0x14000f550]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x38], r13
mov r8d, reloc.WS2_32.dll_ntohl
lea rdx, str.Loader_openned
lea rcx, [rbp - 0x50]
call fcn.140002c30
lea rdx, [rbp - 0x50]
lea rcx, [0x140220220]
call fcn.1400f7af0
cmp byte [0x140220430], 0
jne 0x1400104cf
lea rcx, [rbp - 0x10]
call fcn.140011a50
lea rdx, [rbp + 0x338]
lea rcx, [rbp - 0x10]
call fcn.14000d690
nop
lea rcx, [0x140220220]
call fcn.140103fe0
lea rdx, str.Failed
lea rcx, [rsp + 0x38]
call fcn.140002bf0
mov rdx, rax
lea rcx, [0x140220220]
call fcn.1400f7af0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rbp - 0x70]
call fcn.1400119d0
movzx edx, byte [rax + 0xa]
test dl, dl
je 0x14001044d
xor byte [rax], 0x34
xor byte [rax + 1], 0x35
xor byte [rax + 2], 0x36
xor byte [rax + 3], 0x37
xor byte [rax + 4], 0x38
xor byte [rax + 5], 0x39
xor byte [rax + 6], 0x3a
xor byte [rax + 7], 0x3b
xor byte [rax + 8], 0x3c
xor byte [rax + 9], 0x3d
xor dl, 0x3e
mov byte [rax + 0xa], dl
mov rdx, rax
call fcn.140015750
mov rcx, rax
lea rdx, [0x140220438]
call fcn.140015af0
lea rdx, [rbp - 0x78]
call fcn.140011a00
mov r8, rax
movzx eax, byte [rax + 6]
test al, al
je 0x14001049b
xor byte [r8], 0x34
xor byte [r8 + 1], 0x35
xor byte [r8 + 2], 0x36
xor byte [r8 + 3], 0x37
xor byte [r8 + 4], 0x38
xor byte [r8 + 5], 0x39
xor al, 0x3a
mov byte [r8 + 6], al
lea rcx, [0x140220438]
call fcn.140012f70
mov r9d, reloc.WS2_32.dll_recv
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
lea r12, str.stellar.json
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], select
call fcn.140155ca0
movaps xmm0, xmmword [rbp - 0x70]
movdqa xmmword [rbp - 0x70], xmm0
lea r8, [rbp - 0x70]
mov edx, eax
lea rcx, [rbp - 0x50]
call fcn.140002e50
nop
mov qword [rbp - 0x70], r13
lea rax, [0x1401c3118]
mov qword [rbp - 0x68], rax
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x50]
call fcn.140003a70
movzx ebx, al
cmp dword [rbp - 0x70], 0
je 0x14001053a
lea r8, [rbp - 0x50]
lea rdx, [rbp - 0x70]
lea rcx, str.exists
call fcn.140003a10
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 7
jbe 0x14001057d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010578
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140010578
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140154c94
xorps xmm0, xmm0
test bl, bl
je 0x140010bc9
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x18], r15
lea rsi, [rbp + 0x338]
mov qword [rbp + 0x20], rsi
mov rdi, qword [rsi]
xor rdi, r15
mov qword [rbp + 0x10], rdi
mov qword [rsi], r13
lea rax, [rbp - 0x50]
mov qword [rsp + 0x30], rax
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x38], r13
mov r8d, 8
lea rdx, str.username
lea rcx, [rbp - 0x50]
call fcn.140002c30
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], r13
mov r8d, ntohl
mov rdx, r12
lea rcx, [rsp + 0x58]
call fcn.140002c30
nop
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x58]
call fcn.14000e930
xorps xmm0, xmm0
test al, al
jne 0x140010958
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp - 8], r15
lea r14, [rbp + 0x338]
mov qword [rbp], r14
mov rbx, qword [r14]
xor rbx, r15
mov qword [rbp - 0x10], rbx
mov qword [r14], r13
lea rax, [rbp - 0x50]
mov qword [rsp + 0x30], rax
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x38], r13
mov r8d, 7
lea rdx, str.license
lea rcx, [rbp - 0x50]
call fcn.140002c30
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], r13
mov r8d, ntohl
mov rdx, r12
lea rcx, [rsp + 0x58]
call fcn.140002c30
nop
lea r8, [rbp - 0x50]
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x30]
call fcn.14000e340
nop
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x38]
call fcn.1400130f0
mov rdx, rax
lea rcx, [0x140220220]
call fcn.1400febe0
cmp byte [0x140220430], 0
jne 0x14001075e
lea rdx, str.Failed
lea rcx, [rsp + 0x38]
call fcn.140002bf0
mov rdx, rax
lea rcx, [0x140220220]
call fcn.1400f7af0
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rbp - 0x70]
call fcn.1400119d0
movzx edx, byte [rax + 0xa]
test dl, dl
je 0x140010730
xor byte [rax], 0x34
xor byte [rax + 1], 0x35
xor byte [rax + 2], 0x36
xor byte [rax + 3], 0x37
xor byte [rax + 4], 0x38
xor byte [rax + 5], 0x39
xor byte [rax + 6], 0x3a
xor byte [rax + 7], 0x3b
xor byte [rax + 8], 0x3c
xor byte [rax + 9], 0x3d
xor dl, 0x3e
mov byte [rax + 0xa], dl
mov rdx, rax
call fcn.140015750
mov rcx, rax
lea rdx, [0x140220438]
call fcn.140015af0
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
movsd xmm0, qword [str.u_B_]
movsd qword [rbp - 0x70], xmm0
mov eax, dword [0x14019b070]
mov dword [rbp - 0x68], eax
cmp byte [0x14019b073], 0
je 0x1400108fd
mov ecx, r13d
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x1400108cc
movdqa xmm5, xmmword [0x1401a61d0]
movdqa xmm6, xmmword [0x1401a5ca0]
movdqa xmm7, xmmword [0x1401a5db0]
movdqa xmm2, xmmword [0x1401a5c10]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm5
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
movdqa xmm4, xmmword [0x1401a5d20]
andps xmm2, xmm4
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm7
movd xmm0, dword [str.u_B_]
xorps xmm2, xmm0
movd dword [rbp - 0x70], xmm2
movdqa xmm2, xmmword [0x1401a5c30]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm5
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
andps xmm2, xmm4
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm7
movd xmm0, dword [rbp - 0x6c]
xorps xmm2, xmm0
movd dword [rbp - 0x6c], xmm2
movdqa xmm3, xmmword [0x1401a5c40]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm5
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
paddb xmm3, xmm7
movd xmm0, eax
xorps xmm3, xmm0
movd dword [rbp - 0x68], xmm3
jmp 0x1400108fd
lea r8, [rbp - 0x70]
mov eax, 0x3521cfb3
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul edx, eax, 0x35
movzx eax, cl
sub al, dl
add al, 0x34
xor byte [r8], al
inc ecx
lea r8, [r8 + 1]
cmp ecx, 0xc
jl 0x1400108d0
lea rdx, [rbp - 0x70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140015750
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x14001094d
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010947
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140010947
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140154c94
nop
xor rbx, r15
mov qword [r14], rbx
jmp 0x140010bbe
lea rax, [rbp - 0x50]
mov qword [rsp + 0x30], rax
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x38], r13
mov r8d, 8
lea rdx, str.username
lea rcx, [rbp - 0x50]
call fcn.140002c30
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], r13
mov r8d, ntohl
mov rdx, r12
lea rcx, [rsp + 0x58]
call fcn.140002c30
nop
lea r8, [rbp - 0x50]
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x30]
call fcn.14000e340
nop
lea rax, [rbp + 0x30]
mov qword [rsp + 0x30], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], r13
mov qword [rbp + 0x48], r13
mov r8d, 8
lea rdx, str.password
lea rcx, [rbp + 0x30]
call fcn.140002c30
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp], r13
mov qword [rbp + 8], r13
mov r8d, ntohl
mov rdx, r12
lea rcx, [rbp - 0x10]
call fcn.140002c30
nop
lea r8, [rbp + 0x30]
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x50]
call fcn.14000e340
nop
lea rax, [rsp + 0x38]
mov qword [rsp + 0x30], rax
lea rdx, [rbp + 0x50]
lea rcx, [rsp + 0x38]
call fcn.1400130f0
mov rbx, rax
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x50]
call fcn.1400130f0
nop
mov r8, rbx
mov rdx, rax
lea rcx, [0x140220220]
call fcn.1400fd570
cmp byte [0x140220430], 0
jne 0x140010b30
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rdx, [rbp - 0x78]
call fcn.140011a00
mov r8, rax
movzx eax, byte [rax + 6]
test al, al
je 0x140010aa8
xor byte [r8], 0x34
xor byte [r8 + 1], 0x35
xor byte [r8 + 2], 0x36
xor byte [r8 + 3], 0x37
xor byte [r8 + 4], 0x38
xor byte [r8 + 5], 0x39
xor al, 0x3a
mov byte [r8 + 6], al
lea rcx, [0x140220438]
call fcn.140012f70
mov r9d, reloc.WS2_32.dll_recv
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rbp - 0x70]
call fcn.140011a30
movzx edx, byte [rax + 8]
test dl, dl
je 0x140010b02
xor byte [rax], 0x34
xor byte [rax + 1], 0x35
xor byte [rax + 2], 0x36
xor byte [rax + 3], 0x37
xor byte [rax + 4], 0x38
xor byte [rax + 5], 0x39
xor byte [rax + 6], 0x3a
xor byte [rax + 7], 0x3b
xor dl, 0x3c
mov byte [rax + 8], dl
mov rdx, rax
call fcn.140015750
mov rcx, rax
lea rdx, [0x140220438]
call fcn.140015af0
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov rdx, qword [rbp + 0x68]
cmp rdx, 0xf
jbe 0x140010b6e
inc rdx
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010b69
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140010b69
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140154c94
movdqa xmm0, xmmword [0x1401a5bb0]
movdqu xmmword [rbp + 0x60], xmm0
mov byte [rbp + 0x50], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140010bbe
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010bb8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140010bb8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140154c94
nop
xor rdi, r15
mov qword [rsi], rdi
jmp 0x140011300
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp - 8], r15
lea rax, [rbp + 0x338]
mov qword [rbp], rax
mov rsi, qword [rax]
xor rsi, r15
mov qword [rbp - 0x10], rsi
mov qword [rax], r13
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], r13
mov qword [rbp + 0x48], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x30], 0
movups xmm7, xmmword [str.q_BRJ]
movups xmmword [rbp - 0x70], xmm7
mov edx, dword [0x14019b2f0]
mov dword [rbp - 0x60], edx
cmp byte [0x14019b2f3], 0
je 0x140010e6d
mov ecx, r13d
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x140010e35
movdqa xmm5, xmmword [0x1401a61d0]
movdqa xmm6, xmmword [0x1401a5ca0]
movdqa xmm3, xmmword [0x1401a5c10]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm5
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
movdqa xmm4, xmmword [0x1401a5d20]
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
mov ecx, dword [0x1401a5db0]
movd xmm0, ecx
paddb xmm3, xmm0
movd eax, xmm7
movd xmm0, eax
xorps xmm3, xmm0
movd dword [rbp - 0x70], xmm3
movdqa xmm2, xmmword [0x1401a5c30]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm5
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
andps xmm2, xmm4
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, ecx
paddb xmm2, xmm0
movd xmm1, dword [rbp - 0x6c]
xorps xmm2, xmm1
movd dword [rbp - 0x6c], xmm2
movdqa xmm3, xmmword [0x1401a5c40]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm5
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd xmm0, ecx
paddb xmm3, xmm0
movd xmm1, dword [rbp - 0x68]
xorps xmm3, xmm1
movd dword [rbp - 0x68], xmm3
movdqa xmm2, xmmword [0x1401a5c50]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm5
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
andps xmm2, xmm4
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, ecx
paddb xmm2, xmm0
movd xmm1, dword [rbp - 0x64]
xorps xmm2, xmm1
movd dword [rbp - 0x64], xmm2
movdqa xmm3, xmmword [0x1401a5c60]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm5
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd xmm0, ecx
paddb xmm3, xmm0
movd xmm1, edx
xorps xmm3, xmm1
movd dword [rbp - 0x60], xmm3
jmp 0x140010e6d
lea r8, [rbp - 0x70]
nop dword [rax]
mov eax, 0x3521cfb3
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul edx, eax, 0x35
movzx eax, cl
sub al, dl
add al, 0x34
xor byte [r8], al
inc ecx
lea r8, [r8 + 1]
cmp ecx, 0x14
jl 0x140010e40
lea rdx, [rbp - 0x70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140015750
lea rdx, [rbp + 0x30]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140015b10
lea rdx, [rbp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.1400130f0
mov rdx, rax
lea rcx, [0x140220220]
call fcn.1400febe0
cmp byte [0x140220430], 0
jne 0x140010f68
lea rcx, [rbp + 0x10]
call fcn.140011a50
lea rdx, [rbp + 0x338]
lea rcx, [rbp + 0x10]
call fcn.14000d690
nop
lea rcx, [0x140220220]
call fcn.140103fe0
lea rdx, str.Failed
lea rcx, [rsp + 0x38]
call fcn.140002bf0
mov rdx, rax
lea rcx, [0x140220220]
call fcn.1400f7af0
lea rdx, [rbp - 0x78]
call fcn.140011a00
mov r8, rax
movzx eax, byte [rax + 6]
test al, al
je 0x140010f34
xor byte [r8], 0x34
xor byte [r8 + 1], 0x35
xor byte [r8 + 2], 0x36
xor byte [r8 + 3], 0x37
xor byte [r8 + 4], 0x38
xor byte [r8 + 5], 0x39
xor al, 0x3a
mov byte [r8 + 6], al
lea rcx, [0x140220438]
call fcn.140012f70
mov r9d, reloc.WS2_32.dll_recv
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
xorps xmm0, xmm0
lea r14, [rbp + 0x338]
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], r14
mov rdi, qword [r14]
mov qword [rbp + 0x18], r15
mov rax, rdi
mov qword [r14], r13
xor rax, r15
mov qword [rbp + 0x10], rax
cmp qword [rbp + 0x40], 0
jne 0x140011128
lea rcx, [0x140220220]
call fcn.140103fe0
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], r13
mov qword [rbp + 0x68], r13
mov r8d, 7
lea rdx, str.Success
lea rcx, [rbp + 0x50]
call fcn.140002c30
lea rdx, [rbp + 0x50]
lea rcx, [0x140220220]
call fcn.1400f7af0
lea rax, [rbp + 0x50]
mov qword [rsp + 0x30], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], r13
mov qword [rbp + 0x68], r13
xor r8d, r8d
lea rdx, [0x140185e4d]
lea rcx, [rbp + 0x50]
call fcn.140002c30
nop
lea rax, [rbp - 0x50]
mov qword [rbp - 0x78], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x38], r13
xor r8d, r8d
lea rdx, [0x140185e4d]
lea rcx, [rbp - 0x50]
call fcn.140002c30
nop
lea rax, [rsp + 0x38]
mov qword [rsp + 0x78], rax
lea rdx, [rbp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.1400130f0
mov rbx, rax
lea rax, [rsp + 0x58]
mov qword [rbp - 0x80], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], r13
mov r8d, 7
lea rdx, str.license
lea rcx, [rsp + 0x58]
call fcn.140002c30
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x18], r13
mov r8d, ntohl
mov rdx, r12
lea rcx, [rbp - 0x30]
call fcn.140002c30
nop
lea rax, [rbp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x30]
call fcn.14000ecd0
movsd xmm0, qword [0x14019ae90]
movsd qword [rbp - 0x70], xmm0
movzx edx, word [0x14019ae98]
mov word [rbp - 0x68], dx
movzx eax, byte [0x14019ae9a]
mov byte [rbp - 0x70], 0x41
xor byte [rbp - 0x6f], 0x35
xor byte [rbp - 0x6e], 0x36
xor byte [rbp - 0x6d], 0x37
xor byte [rbp - 0x6c], 0x38
xor byte [rbp - 0x6b], 0x39
xor byte [rbp - 0x6a], 0x3a
xor byte [rbp - 0x69], 0x3b
xor dl, 0x3c
mov byte [rbp - 0x68], dl
xor byte [rbp - 0x67], 0x3d
xor al, 0x3e
mov byte [rbp - 0x66], al
lea rdx, [rbp - 0x70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140015750
nop
jmp 0x1400112b1
lea rcx, [0x140220220]
call fcn.140103fe0
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x18], r13
mov r8d, 7
lea rdx, str.Success
lea rcx, [rbp - 0x30]
call fcn.140002c30
lea rdx, [rbp - 0x30]
lea rcx, [0x140220220]
call fcn.1400f7af0
lea rax, [rbp - 0x30]
mov qword [rbp - 0x70], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x18], r13
xor r8d, r8d
lea rdx, [0x140185e4d]
lea rcx, [rbp - 0x30]
call fcn.140002c30
nop
lea rax, [rbp + 0x50]
mov qword [rbp - 0x80], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], r13
mov qword [rbp + 0x68], r13
xor r8d, r8d
lea rdx, [0x140185e4d]
lea rcx, [rbp + 0x50]
call fcn.140002c30
nop
lea rax, [rsp + 0x38]
mov qword [rsp + 0x78], rax
lea rdx, [rbp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.1400130f0
mov rbx, rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x30], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x38], r13
mov r8d, 7
lea rdx, str.license
lea rcx, [rbp - 0x50]
call fcn.140002c30
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], r13
mov r8d, ntohl
mov rdx, r12
lea rcx, [rsp + 0x58]
call fcn.140002c30
nop
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x58]
call fcn.14000ecd0
movsd xmm0, qword [0x14019ae90]
movsd qword [rbp - 0x70], xmm0
movzx edx, word [0x14019ae98]
mov word [rbp - 0x68], dx
movzx eax, byte [0x14019ae9a]
mov byte [rbp - 0x70], 0x41
xor byte [rbp - 0x6f], 0x35
xor byte [rbp - 0x6e], 0x36
xor byte [rbp - 0x6d], 0x37
xor byte [rbp - 0x6c], 0x38
xor byte [rbp - 0x6b], 0x39
xor byte [rbp - 0x6a], 0x3a
xor byte [rbp - 0x69], 0x3b
xor dl, 0x3c
mov byte [rbp - 0x68], dl
xor byte [rbp - 0x67], 0x3d
xor al, 0x3e
mov byte [rbp - 0x66], al
lea rdx, [rbp - 0x70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140015750
nop
mov qword [r14], rdi
mov rdx, qword [rbp + 0x48]
cmp rdx, 0xf
jbe 0x1400112f3
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400112ed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400112ed
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140154c94
nop
xor rsi, r15
lea rax, [rbp + 0x338]
mov qword [rax], rsi
lea rax, [rbp + 0xd0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, Ordinal_32
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rbp - 0x50], xmm0
movdqu xmmword [rbp - 0x40], xmm1
test eax, eax
js 0x140011354
lea rax, [rbp + 0xd0]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140011340
lea rdx, [rbp + 0xd0]
jmp 0x14001135e
xor r8d, r8d
lea rdx, [0x140185fd0]
lea rcx, [rbp - 0x50]
call fcn.140016320
nop
lea r8, str._stellar
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.140015d20
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x40], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov qword [rbp - 0x70], r13
lea rdi, [0x1401c3118]
mov qword [rbp - 0x68], rdi
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x30]
call fcn.140003a70
movzx ebx, al
cmp dword [rbp - 0x70], 0
je 0x1400113e5
lea r8, [rbp + 0x30]
lea rdx, [rbp - 0x70]
lea rcx, str.exists
call fcn.140003a10
nop
mov rdx, qword [rbp + 0x48]
cmp rdx, 7
jbe 0x140011428
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011423
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140011423
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140154c94
movdqa xmm0, xmmword [0x1401a5b80]
movdqu xmmword [rbp + 0x40], xmm0
mov word [rbp + 0x30], r13w
mov rdx, qword [rbp - 0x18]
cmp rdx, 7
jbe 0x14001147d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011478
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140011478
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140154c94
test bl, bl
jne 0x140011593
lea r8, str._stellar
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x50]
call fcn.140015d20
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 7
cmova rcx, qword [rbp - 0x10]
call fcn.140155f00
mov rdx, rax
shr rax, 0x20
test eax, eax
je 0x1400114fb
shr rdx, 0x20
lea r8, [rbp - 0x10]
lea rcx, str.create_directory
call fcn.140003920
nop
mov rdx, qword [rbp + 8]
cmp rdx, 7
jbe 0x14001153e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011539
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140011539
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140154c94
movdqa xmm0, xmmword [0x1401a5b80]
movdqu xmmword [rbp], xmm0
mov word [rbp - 0x10], r13w
mov rdx, qword [rbp + 0x68]
cmp rdx, 7
jbe 0x140011593
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001158e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001158e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140154c94
lea r8, str._stellarconfigs
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x38]
call fcn.140015d20
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x68], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x68], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], rdi
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x58]
call fcn.140003a70
movzx ebx, al
cmp dword [rbp - 0x70], 0
je 0x140011610
lea r8, [rsp + 0x58]
lea rdx, [rbp - 0x70]
lea rcx, str.exists
call fcn.140003a10
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 7
jbe 0x140011655
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011650
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140011650
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140154c94
movdqa xmm0, xmmword [0x1401a5b80]
movdqu xmmword [rsp + 0x68], xmm0
mov word [rsp + 0x58], r13w
mov rdx, qword [rsp + 0x50]
cmp rdx, 7
jbe 0x1400116ae
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400116a9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400116a9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140154c94
test bl, bl
jne 0x1400117c4
lea r8, str._stellarconfigs
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x70]
call fcn.140015d20
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x20], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x20], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
lea rcx, [rbp + 0x10]
cmp qword [rbp + 0x28], 7
cmova rcx, qword [rbp + 0x10]
call fcn.140155f00
mov rdx, rax
shr rax, 0x20
test eax, eax
je 0x14001172c
shr rdx, 0x20
lea r8, [rbp + 0x10]
lea rcx, str.create_directory
call fcn.140003920
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 7
jbe 0x14001176f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001176a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001176a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140154c94
movdqa xmm0, xmmword [0x1401a5b80]
movdqu xmmword [rbp + 0x20], xmm0
mov word [rbp + 0x10], r13w
mov rdx, qword [rbp - 0x58]
cmp rdx, 7
jbe 0x1400117c4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400117bf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400117bf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140154c94
xor r14b, r14b
mov rdi, qword [0x140220400]
mov r15, qword [0x140220408]
cmp rdi, r15
je 0x140011908
nop
mov rdx, rdi
lea rcx, [rbp + 0x90]
call fcn.1400130f0
nop
lea rdx, [rdi + 0x20]
lea rcx, [rbp + 0xb0]
call fcn.1400130f0
nop
lea rax, [rbp + 0x90]
mov rbx, qword [rbp + 0x90]
mov rsi, qword [rbp + 0xa8]
cmp rsi, 0xf
cmova rax, rbx
cmp qword [rbp + 0xa0], 7
jne 0x14001191a
cmp dword [rax], 0x61666564
jne 0x14001191a
cmp word [rax + 4], 0x6c75
jne 0x14001191a
cmp byte [rax + 6], 0x74
jne 0x14001191a
test r14b, r14b
jne 0x14001188b
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x18], r13
mov r8d, reloc.WS2_32.dll_setsockopt
lea rdx, str.Success_AUTH_CHECK_OP
lea rcx, [rbp - 0x30]
call fcn.140002c30
lea rdx, [rbp - 0x30]
lea rcx, [0x140220220]
call fcn.1400f7af0
mov r14b, 1
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0xf
jbe 0x1400118c8
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400118c3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011913
call fcn.140154c94
cmp rsi, 0xf
jbe 0x1400118fb
lea rdx, [rsi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x1400118f3
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011913
mov rcx, rbx
call fcn.140154c94
add rdi, 0x40
cmp rdi, r15
jne 0x1400117e0
call fcn.14007dc30
call fcn.14007f230
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov r9d, Ordinal_50
lea r8, str.ERROR
lea rdx, str.Real
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, str.https:__www.youtube.com_watch_vdQw4w9WgXcQ
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rdx, str.Failed_to_pass_auth_check
lea rcx, [rsp + 0x38]
call fcn.140002bf0
mov rdx, rax
lea rcx, [0x140220220]
call fcn.1400f7af0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov r9d, Ordinal_50
lea r8, str.ERROR
lea rdx, str.Real
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, str.https:__www.youtube.com_watch_vdQw4w9WgXcQ
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3