Function at 0x140020bd0
Capabilities:
Access peb ldr_data
Create thread
Enumerate gui resources
Get ntdll base address
Query environment variable

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x400]
sub rsp, 0x500
movaps xmmword [rsp + 0x4f0], xmm6
mov rax, qword [0x1400b48c0]
xor rax, rsp
mov qword [rbp + 0x3e0], rax
mov rax, r8
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rdx
mov r13, rcx
mov qword [rsp + 0x38], rcx
mov qword [rbp - 0x60], rcx
mov qword [rbp - 0x70], rdx
mov qword [rbp - 0x68], rax
xor ebx, ebx
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x10]
mov eax, dword [rdx + 0x30]
add eax, 0x100000
mov dword [rdx + 0x40], eax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x140021ec3
call fcn.140012960
call fcn.1400128b0
call fcn.140012610
call fcn.140012810
call fcn.1400198c0
call fcn.140012a00
call fcn.140018040
call fcn.140018250
call fcn.1400180b0
call fcn.140018230
call fcn.1400123e0
call fcn.1400173f0
xor edx, edx
lea rcx, [0x140012a20]
call qword [sym.imp.USER32.dll_EnumWindows]
mov ecx, 8
call fcn.140027e60
test rax, rax
je 0x140020cbb
lea rcx, [0x140018de0]
mov qword [rax], rcx
jmp 0x140020cbe
mov rax, rbx
mov qword [rbp - 0x60], rax
lea rcx, [rbp - 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x14000a210]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x40], rax
test rax, rax
je 0x140021eb5
cmp dword [rbp - 0x38], 0
je 0x140021dc4
movaps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x60], xmm0
lea rcx, [rbp - 0x60]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x140021dc4
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x40], xmm0
lea rcx, str.SystemRoot
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xorps xmm0, xmm0
movups xmmword [rbp + 0x48], xmm0
mov qword [rbp + 0x58], rbx
mov qword [rbp + 0x60], rbx
mov r12, 0xffffffffffffffff
mov r8, r12
inc r8
cmp byte [rax + r8], 0
jne 0x140020d42
mov rdx, rax
lea rcx, [rbp + 0x48]
call fcn.1400067f0
nop
mov rsi, qword [rbp + 0x58]
lea rcx, [rbp + 0x2d0]
test rsi, rsi
je 0x14002209c
xor edx, edx
mov r8d, pe_nt_image_headers64
call sub.VCRUNTIME140.dll_memset
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, rsi
cmp rax, 0x1b
jb 0x140021edc
lea r15, [rbp + 0x48]
cmp qword [rbp + 0x60], 0xf
cmova r15, qword [rbp + 0x48]
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x30], xmm1
lea r14, [rsi + 0x1b]
mov ebx, reloc.WS2_32.dll_ntohs
lea rdi, [rbp - 0x40]
movabs rax, 0x8000000000000000
mov edx, reloc.WLDAP32.dll_Ordinal_22
cmp r14, rbx
jbe 0x140020e3f
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x140020e00
mov rbx, rcx
add rax, 0x27
mov rcx, rax
call fcn.140027e60
test rax, rax
je 0x140020e2c
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140020e3b
cmp rbx, rdx
cmovb rbx, rdx
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x140020e14
xor edi, edi
jmp 0x140020e3b
cmp rcx, 0x1000
jb 0x140020e33
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140021dcf
jmp 0x140020de5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140027e60
mov rdi, rax
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], rbx
mov r8, rsi
mov rdx, r15
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
movups xmm0, xmmword [str.System32driversetchosts]
movups xmmword [rdi + rsi], xmm0
movsd xmm0, qword [0x140091b60]
movsd qword [rdi + rsi + 0x10], xmm0
movzx eax, word [0x140091b68]
mov word [rdi + rsi + 0x18], ax
movzx eax, byte [reloc.WS2_32.dll_WSAStartup]
mov byte [rdi + rsi + 0x1a], al
mov byte [rdi + r14], 0
lea rdx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0xf
cmova rdx, qword [rbp - 0x40]
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 1
lea rcx, [rbp + 0x2d0]
call fcn.140010030
mov rax, qword [rbp + 0x2d0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x2d0], rax
mov rax, qword [rbp + 0x2d0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x2cc], edx
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x140020f28
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140020f23
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140020f23
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140027ea4
movdqa xmm6, xmmword [0x1400a49d0]
movdqu xmmword [rbp - 0x30], xmm6
mov byte [rbp - 0x40], 0
cmp qword [rbp + 0x360], 0
je 0x140022059
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
xor r14d, r14d
mov qword [rbp + 0x38], r14
mov qword [rbp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x28], r14b
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x40], r14b
mov rax, qword [rbp + 0x2d0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x2d0]
add rcx, rax
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
movzx r8d, al
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x2d0]
call fcn.14000bd40
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
test al, al
je 0x140021195
mov rsi, qword [rbp - 0x30]
movabs rax, 0x7fffffffffffffff
cmp rsi, rax
je 0x140021ee8
lea r15, [rbp - 0x40]
cmp qword [rbp - 0x28], 0xf
cmova r15, qword [rbp - 0x40]
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x48], r14
lea r14, [rsi + 1]
mov ebx, reloc.WS2_32.dll_ntohs
lea rdi, [rbp - 0x60]
cmp r14, rbx
jbe 0x14002107e
mov rbx, r14
or rbx, 0xf
cmp rbx, rax
jbe 0x140021023
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x140021053
cmp rbx, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x14002103d
xor edi, edi
jmp 0x14002107a
cmp rcx, 0x1000
jb 0x140021072
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140021ee2
mov rcx, rax
call fcn.140027e60
test rax, rax
je 0x14002118e
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14002107a
call fcn.140027e60
mov rdi, rax
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x48], rbx
mov r8, rsi
mov rdx, r15
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], 0xa
mov byte [rdi + r14], 0
lea r9, [rbp - 0x60]
mov rdi, qword [rbp - 0x60]
mov r14, qword [rbp - 0x48]
cmp r14, 0xf
cmova r9, rdi
mov r15, qword [rbp + 0x38]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
sub rax, r15
mov rsi, qword [rbp - 0x50]
cmp rsi, rax
ja 0x1400210f6
lea rax, [rsi + r15]
mov qword [rbp + 0x38], rax
lea rbx, [rbp + 0x28]
cmp rcx, 0xf
cmova rbx, qword [rbp + 0x28]
lea rcx, [rbx + r15]
mov r8, rsi
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
lea rax, [rbx + r15]
mov byte [rax + rsi], 0
jmp 0x140021112
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov rdx, rsi
lea rcx, [rbp + 0x28]
call fcn.140006b50
mov r14, qword [rbp - 0x48]
mov rdi, qword [rbp - 0x60]
cmp r14, 0xf
jbe 0x140021145
lea rdx, [r14 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14002113d
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002118e
mov rcx, rdi
call fcn.140027ea4
mov rax, qword [rbp + 0x2d0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x2d0]
add rcx, rax
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
movzx r8d, al
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x2d0]
call fcn.14000bd40
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
xor r14d, r14d
jmp 0x140020fb6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rcx, [rbp + 0x2e0]
call fcn.140005b10
test rax, rax
jne 0x1400211c9
mov rax, qword [rbp + 0x2d0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x2d0]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
lea rbx, [rbp + 0x28]
cmp qword [rbp + 0x40], 0xf
cmova rbx, qword [rbp + 0x28]
mov rax, qword [rbp + 0x38]
cmp rax, 0xd
jb 0x14002123c
lea rdi, [rbx + rax]
lea r8, [rdi - 0xc]
sub r8, rbx
mov edx, reloc.WS2_32.dll_WSAStartup
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x14002123c
movabs rsi, 0x656a6f7270796b73
cmp qword [rax], rsi
jne 0x140021220
cmp dword [rax + 8], 0x632e7463
jne 0x140021220
cmp byte [rax + 0xc], 0x63
je 0x14002135f
inc rax
lea r8, [rdi - 0xc]
sub r8, rax
mov edx, reloc.WS2_32.dll_WSAStartup
mov rcx, rax
call sub.VCRUNTIME140.dll_memchr
test rax, rax
jne 0x140021208
lea rcx, [rbp - 0x40]
call fcn.140005670
nop
lea rcx, [rbp + 0x28]
call fcn.140005670
nop
lea rcx, [rbp + 0x2d0]
call fcn.1400120c0
lea rdx, [0x1401dc678]
lea rcx, [0x140025a00]
call fcn.140019050
mov qword [rsp + 0x78], rax
lea rdx, [0x1401dc680]
lea rcx, [0x14001e7f0]
call fcn.140019050
mov qword [rbp - 0x40], rax
lea rdx, [0x1401dc688]
lea rcx, [0x14001e790]
call fcn.140019050
mov qword [rbp - 0x60], rax
lea rdx, [0x140025a00]
lea rcx, [rsp + 0x78]
call fcn.140022250
lea rdx, [0x14001e7f0]
lea rcx, [rbp - 0x40]
call fcn.140022250
lea rdx, [0x14001e790]
lea rcx, [rbp - 0x60]
call fcn.140022250
mov ecx, 3
call fcn.1400297f0
call fcn.1400295e0
mov rdi, rax
test rax, rax
jne 0x140021371
mov dword [rsp + 0x30], 0xc332b33
mov word [rsp + 0x34], 0x100
mov rdx, r13
lea rcx, [rsp + 0x30]
call fcn.140011bf0
nop
lea rcx, [rbp + 0x48]
call fcn.140005670
nop
mov rcx, qword [rsp + 0x70]
call fcn.140005670
nop
mov rcx, qword [rsp + 0x68]
call fcn.140005670
mov rax, r13
mov rcx, qword [rbp + 0x3e0]
xor rcx, rsp
call fcn.140027e40
mov rbx, qword [rsp + 0x558]
movaps xmm6, xmmword [rsp + 0x4f0]
add rsp, 0x500
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
sub rax, rbx
cmp rax, 0xffffffffffffffff
jne 0x140021dd5
jmp 0x14002123c
xorps xmm0, xmm0
movups xmmword [rbp + 8], xmm0
mov qword [rbp + 0x18], r14
mov qword [rbp + 0x20], reloc.WS2_32.dll_ntohs
mov byte [rbp + 8], 0
movups xmmword [rbp + 0xa8], xmm0
movdqu xmmword [rbp + 0xb8], xmm6
mov byte [rbp + 0xa8], 0
movups xmmword [rbp + 0x148], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x158], xmm1
mov r8d, 0x40
lea rdx, str.NWM6MTc6Mzg6YzQ6ZGE6MjI6OTM6N2I6MGU6ZjE6YzI6ODE6YTM6Y2Y6YzQ6NmM6
lea rcx, [rbp + 0x148]
call fcn.1400067f0
nop
lea rdx, [rbp + 0x148]
lea rcx, [rbp + 0x108]
call fcn.140025a50
nop
lea rsi, [rbp + 0x108]
cmp qword [rbp + 0x120], 0xf
cmova rsi, qword [rbp + 0x108]
xorps xmm0, xmm0
movups xmmword [rbp + 0x188], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x198], xmm1
mov r8d, reloc.WS2_32.dll_sendto
lea rdx, str.U2VyaWFsIE51bWJlcjo
lea rcx, [rbp + 0x188]
call fcn.1400067f0
nop
lea rdx, [rbp + 0x188]
lea rcx, [rbp + 0xe8]
call fcn.140025a50
nop
lea r14, [rbp + 0xe8]
cmp qword [rbp + 0x100], 0xf
cmova r14, qword [rbp + 0xe8]
xorps xmm0, xmm0
movups xmmword [rbp + 0x168], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x178], xmm1
mov r8d, Ordinal_33
lea rdx, str.R29vZ2xlIFRydXN0IFNlcnZpY2Vz
lea rcx, [rbp + 0x168]
call fcn.1400067f0
nop
lea rdx, [rbp + 0x168]
lea rcx, [rbp + 0xc8]
call fcn.140025a50
nop
lea r15, [rbp + 0xc8]
cmp qword [rbp + 0xe0], 0xf
cmova r15, qword [rbp + 0xc8]
xorps xmm0, xmm0
movups xmmword [rbp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x78], xmm1
mov r8d, ntohs
lea rdx, str.dG9rZW5meA
lea rcx, [rbp + 0x68]
call fcn.1400067f0
nop
lea rdx, [rbp + 0x68]
lea rcx, [rbp + 0x268]
call fcn.140025a50
nop
lea rbx, [rbp + 0x268]
cmp qword [rbp + 0x280], 0xf
cmova rbx, qword [rbp + 0x268]
xorps xmm0, xmm0
movups xmmword [rbp + 0x248], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x258], xmm1
mov r8d, 8
lea rdx, str.VEgzS0VO
lea rcx, [rbp + 0x248]
call fcn.1400067f0
nop
lea rdx, [rbp + 0x248]
lea rcx, [rbp + 0x228]
call fcn.140025a50
nop
lea r13, [rbp + 0x228]
cmp qword [rbp + 0x240], 0xf
cmova r13, qword [rbp + 0x228]
xorps xmm0, xmm0
movups xmmword [rbp + 0x208], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x218], xmm1
mov r8d, reloc.WS2_32.dll_sendto
lea rdx, str.c2t5cHJvamVjdC5jYw
lea rcx, [rbp + 0x208]
call fcn.1400067f0
nop
lea rdx, [rbp + 0x208]
lea rcx, [rbp + 0x1e8]
call fcn.140025a50
nop
lea rax, [rbp + 0x1e8]
cmp qword [rbp + 0x200], 0xf
cmova rax, qword [rbp + 0x1e8]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x68]
mov r8, rax
cmp qword [rax + 0x18], 0xf
jbe 0x1400215c2
mov r8, qword [rax]
mov edx, 0x2712
mov rcx, rdi
call fcn.14002c7a0
mov edx, reloc.WLDAP32.dll_Ordinal_32
mov r8d, 6
mov rcx, rdi
call fcn.14002c7a0
mov edx, 0x51
mov r8d, 2
mov rcx, rdi
call fcn.14002c7a0
mov edx, 0x40
mov r8d, 1
mov rcx, rdi
call fcn.14002c7a0
mov r8, qword [rsp + 0x30]
mov edx, 0x27c1
mov rcx, rdi
call fcn.14002c7a0
mov r8, r13
mov edx, 0x2722
mov rcx, rdi
call fcn.14002c7a0
mov edx, 0xac
mov r8d, 1
mov rcx, rdi
call fcn.14002c7a0
mov edx, reloc.WS2_32.dll_listen
mov r8d, reloc.WS2_32.dll_sendto
mov rcx, rdi
call fcn.14002c7a0
mov rax, qword [rsp + 0x70]
mov r8, rax
cmp qword [rax + 0x18], 0xf
jbe 0x140021662
mov r8, qword [rax]
mov edx, 0x271f
mov rcx, rdi
call fcn.14002c7a0
lea r8, [0x1400259d0]
mov edx, 0x4e2b
mov rcx, rdi
call fcn.14002c7a0
lea r8, [rbp + 8]
mov edx, 0x2711
mov rcx, rdi
call fcn.14002c7a0
lea r8, [0x14001ab00]
mov edx, 0x4e6f
mov rcx, rdi
call fcn.14002c7a0
lea r8, [rbp + 0xa8]
mov edx, 0x272d
mov rcx, rdi
call fcn.14002c7a0
lea rdx, str.Cache_Control:_no_cache
xor ecx, ecx
call fcn.140029950
mov r13, rax
mov qword [rsp + 0x30], rax
mov r8, rax
mov edx, 0x2727
mov rcx, rdi
call fcn.14002c7a0
mov rcx, rdi
call fcn.140029650
test eax, eax
jne 0x140021eee
cmp dword [0x1401dc690], eax
jne 0x140021764
xorps xmm0, xmm0
movups xmmword [rbp + 0x88], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x98], xmm1
mov r8, r12
inc r8
cmp byte [rbx + r8], 0
jne 0x140021712
mov rdx, rbx
lea rcx, [rbp + 0x88]
call fcn.1400067f0
nop
lea r8, [rbp + 0x88]
lea rdx, [rbp + 0xa8]
lea rcx, [rbp - 0x20]
call fcn.1400248d0
nop
lea rcx, [rbp + 0x88]
call fcn.140005670
cmp qword [rbp - 0x10], 0x24
jne 0x140021f8e
lea rcx, [rbp - 0x20]
call fcn.140005670
lea r8, [rbp - 0x78]
mov edx, 0x400022
mov rcx, rdi
call fcn.1400295b0
test eax, eax
jne 0x140021f3e
xor r13d, r13d
mov rax, qword [rbp - 0x78]
cmp dword [rax], r13d
jle 0x140021e15
xor r12d, r12d
mov rbx, qword [rax + 8]
mov rbx, qword [r12 + rbx]
test rbx, rbx
je 0x1400217cd
nop dword [rax]
mov rdx, r14
mov rcx, qword [rbx]
call sub.VCRUNTIME140.dll_strstr
test rax, rax
je 0x1400217c0
mov rdx, rsi
mov rcx, qword [rbx]
call sub.VCRUNTIME140.dll_strstr
test rax, rax
jne 0x1400217df
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x1400217a0
mov rax, qword [rbp - 0x78]
inc r13d
add r12, 8
cmp r13d, dword [rax]
jge 0x140021e15
jmp 0x140021790
xor r14d, r14d
mov rcx, qword [rbp - 0x78]
cmp dword [rcx], r14d
jle 0x140021e65
xor esi, esi
mov rax, qword [rcx + 8]
mov rbx, qword [rsi + rax]
test rbx, rbx
je 0x14002181d
nop
mov rdx, r15
mov rcx, qword [rbx]
call sub.VCRUNTIME140.dll_strstr
test rax, rax
jne 0x14002182f
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x140021800
mov rcx, qword [rbp - 0x78]
inc r14d
add rsi, 8
cmp r14d, dword [rcx]
jge 0x140021e65
jmp 0x1400217f1
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14002183f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x14002184e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x14002185d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x30], xmm1
mov r8d, Ordinal_26
lea rdx, str.SW52YWxpZCB1c2VybmFtZQ
lea rcx, [rbp - 0x40]
call fcn.1400067f0
nop
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x1c8]
call fcn.140025a50
nop
lea rbx, [rbp + 0x1c8]
cmp qword [rbp + 0x1e0], 0xf
cmova rbx, qword [rbp + 0x1c8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
mov r8d, Ordinal_33
lea rdx, str.SW52YWxpZCBsaWNlbnNlIGtleQ
lea rcx, [rbp - 0x20]
call fcn.1400067f0
nop
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x2a8]
call fcn.140025a50
nop
lea rsi, [rbp + 0x2a8]
cmp qword [rbp + 0x2c0], 0xf
cmova rsi, qword [rbp + 0x2a8]
xorps xmm0, xmm0
movups xmmword [rbp + 0x128], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x138], xmm1
mov r8d, reloc.WLDAP32.dll_Ordinal_32
lea rdx, str.RXJyb3IgOiBJbnZhbGlkIHVzZXJuYW1l
lea rcx, [rbp + 0x128]
call fcn.1400067f0
nop
lea rdx, [rbp + 0x128]
lea rcx, [rbp + 0x1a8]
call fcn.140025a50
nop
lea r13, [rbp + 0x1a8]
cmp qword [rbp + 0x1c0], 0xf
cmova r13, qword [rbp + 0x1a8]
xorps xmm0, xmm0
movups xmmword [rbp + 0x88], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x98], xmm1
mov r8d, Ordinal_41
lea rdx, str.RXJyb3IgOiBJbnZhbGlkIGxpY2Vuc2Uga2V5
lea rcx, [rbp + 0x88]
call fcn.1400067f0
nop
lea rdx, [rbp + 0x88]
lea rcx, [rbp + 0x288]
call fcn.140025a50
nop
lea rax, [rbp + 0x288]
cmp qword [rbp + 0x2a0], 0xf
cmova rax, qword [rbp + 0x288]
mov qword [rbp - 0x60], rax
mov r14, 0xffffffffffffffff
mov rax, r14
nop dword [rax + rax]
inc rax
cmp byte [rbx + rax], 0
jne 0x1400219c0
lea rcx, [rbp + 8]
mov r15, qword [rbp + 8]
mov r12, qword [rbp + 0x20]
cmp r12, 0xf
cmova rcx, r15
mov qword [rsp + 0x20], rax
mov r9, rbx
xor r8d, r8d
mov rbx, qword [rbp + 0x18]
mov rdx, rbx
call fcn.14000a760
cmp rax, r14
jne 0x140021fe1
nop dword [rax]
inc r14
cmp byte [rsi + r14], 0
jne 0x140021a00
lea rcx, [rbp + 8]
cmp r12, 0xf
cmova rcx, r15
mov qword [rsp + 0x20], r14
mov r9, rsi
xor r8d, r8d
mov rdx, rbx
call fcn.14000a760
cmp rax, 0xffffffffffffffff
jne 0x14002201c
mov rcx, rdi
call fcn.140029580
mov rcx, qword [rsp + 0x30]
call fcn.140029a10
mov rbx, qword [rsp + 0x38]
xor edi, edi
movups xmm0, xmmword [rbp + 8]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp + 0x18]
movups xmmword [rbx + 0x10], xmm1
mov qword [rbp + 0x18], rdi
mov qword [rbp + 0x20], reloc.WS2_32.dll_ntohs
mov byte [rbp + 8], dil
lea rcx, [rbp + 0x288]
call fcn.140005670
nop
lea rcx, [rbp + 0x88]
call fcn.140005670
nop
lea rcx, [rbp + 0x1a8]
call fcn.140005670
nop
lea rcx, [rbp + 0x128]
call fcn.140005670
nop
lea rcx, [rbp + 0x2a8]
call fcn.140005670
nop
lea rcx, [rbp - 0x20]
call fcn.140005670
nop
lea rcx, [rbp + 0x1c8]
call fcn.140005670
nop
mov r8, qword [rbp - 0x28]
cmp r8, 0xf
jbe 0x140021adb
mov rdx, qword [rbp - 0x40]
lea rcx, [rbp - 0x40]
call fcn.140005ee0
nop
lea rcx, [rbp + 0x1e8]
call fcn.140005670
nop
lea rcx, [rbp + 0x208]
call fcn.140005670
nop
lea rcx, [rbp + 0x228]
call fcn.140005670
nop
lea rcx, [rbp + 0x248]
call fcn.140005670
nop
lea rcx, [rbp + 0x268]
call fcn.140005670
nop
lea rcx, [rbp + 0x68]
call fcn.140005670
nop
mov rdx, qword [rbp + 0xe0]
cmp rdx, 0xf
jbe 0x140021b6a
inc rdx
mov rcx, qword [rbp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140021b65
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140021b65
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140027ea4
movdqu xmmword [rbp + 0xd8], xmm6
mov byte [rbp + 0xc8], 0
mov rdx, qword [rbp + 0x180]
cmp rdx, 0xf
jbe 0x140021bbe
inc rdx
mov rcx, qword [rbp + 0x168]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140021bb8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140021bb8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140027ea4
nop
mov rdx, qword [rbp + 0x100]
cmp rdx, 0xf
jbe 0x140021c02
inc rdx
mov rcx, qword [rbp + 0xe8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140021bfd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140021bfd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140027ea4
movdqu xmmword [rbp + 0xf8], xmm6
mov byte [rbp + 0xe8], 0
mov rdx, qword [rbp + 0x1a0]
cmp rdx, 0xf
jbe 0x140021c56
inc rdx
mov rcx, qword [rbp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140021c50
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140021c50
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140027ea4
nop
mov rdx, qword [rbp + 0x120]
cmp rdx, 0xf
jbe 0x140021c9a
inc rdx
mov rcx, qword [rbp + 0x108]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140021c95
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140021c95
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140027ea4
movdqu xmmword [rbp + 0x118], xmm6
mov byte [rbp + 0x108], 0
mov rdx, qword [rbp + 0x160]
cmp rdx, 0xf
jbe 0x140021cee
inc rdx
mov rcx, qword [rbp + 0x148]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140021ce8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140021ce8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140027ea4
nop
mov rdx, qword [rbp + 0xc0]
cmp rdx, 0xf
jbe 0x140021d32
inc rdx
mov rcx, qword [rbp + 0xa8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140021d2d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140021d2d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140027ea4
movdqu xmmword [rbp + 0xb8], xmm6
mov byte [rbp + 0xa8], 0
mov rdx, qword [rbp + 0x20]
cmp rdx, 0xf
jbe 0x140021d7f
inc rdx
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140021d7a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140021d7a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140027ea4
mov qword [rbp + 0x18], rdi
mov qword [rbp + 0x20], reloc.WS2_32.dll_ntohs
mov byte [rbp + 8], 0
mov r8, qword [rbp + 0x60]
cmp r8, 0xf
jbe 0x140021da7
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x48]
call fcn.140005ee0
nop
mov rcx, qword [rsp + 0x70]
call fcn.140005670
nop
mov rcx, qword [rsp + 0x68]
call fcn.140005670
mov rax, rbx
jmp 0x14002132d
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
call fcn.1400012c0
nop
movdqa xmm0, xmmword [str.e_6_f]
movdqu xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x140092ff0]
movdqu xmmword [rsp + 0x50], xmm1
mov dword [rsp + 0x60], 0x101813
mov byte [rsp + 0x64], 1
lea rdx, [rbp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.140011e30
mov rcx, rax
call fcn.140019fd0
nop
mov rcx, rdi
call fcn.140029580
mov rcx, qword [rsp + 0x30]
call fcn.140029a10
movdqa xmm0, xmmword [0x140093040]
movdqu xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x140092fe0]
movdqu xmmword [rbp - 0x10], xmm1
mov dword [rbp], 0xe41a171b
mov word [rbp + 4], 0x100
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x20]
call fcn.140011ef0
mov rcx, rax
call fcn.140019fd0
int3
mov rcx, rdi
call fcn.140029580
mov rcx, qword [rsp + 0x30]
call fcn.140029a10
movdqa xmm0, xmmword [0x140093040]
movdqu xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x140092fe0]
movdqu xmmword [rbp - 0x10], xmm1
mov dword [rbp], 0xe41a171b
mov word [rbp + 4], 0x100
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x20]
call fcn.140011ef0
mov rcx, rax
call fcn.140019fd0
nop
mov dword [rbp - 0x38], ebx
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
lea rdx, str.Debugger_Detected.
lea rcx, [rbp + 0x68]
call fcn.1400056d0
mov rcx, rax
call fcn.140019fd0
nop
call fcn.140001360
nop
call fcn.1400012c0
int3
call fcn.140001360
nop
mov rcx, rdi
call fcn.140029580
mov rcx, r13
call fcn.140029a10
movdqa xmm0, xmmword [str.e_6_f]
movdqu xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x140092ff0]
movdqu xmmword [rsp + 0x50], xmm1
mov dword [rsp + 0x60], 0x101813
mov byte [rsp + 0x64], 1
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x40]
call fcn.140011e30
mov rcx, rax
call fcn.140019fd0
int3
mov rcx, rdi
call fcn.140029580
mov rcx, r13
call fcn.140029a10
movdqa xmm0, xmmword [str.e_6_f]
movdqu xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x140092ff0]
movdqu xmmword [rsp + 0x50], xmm1
mov dword [rsp + 0x60], 0x101813
mov byte [rsp + 0x64], 1
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x40]
call fcn.140011e30
mov rcx, rax
call fcn.140019fd0
nop
mov rcx, rdi
call fcn.140029580
mov rcx, r13
call fcn.140029a10
movdqa xmm0, xmmword [str.e_6_f]
movdqu xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x140092ff0]
movdqu xmmword [rsp + 0x50], xmm1
mov dword [rsp + 0x60], 0x101813
mov byte [rsp + 0x64], 1
lea rdx, [rbp + 0x128]
lea rcx, [rsp + 0x40]
call fcn.140011e30
mov rcx, rax
call fcn.140019fd0
nop
mov rcx, qword [rsp + 0x68]
call fcn.140005650
mov rbx, rax
xor edx, edx
mov rcx, qword [rsp + 0x68]
call fcn.140011af0
mov rcx, rax
mov r8, rbx
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rdx, r13
lea rcx, [rbp - 0x60]
call fcn.1400056d0
mov rcx, rax
call fcn.140019fd0
int3
mov rcx, qword [rsp + 0x68]
call fcn.140005650
mov rbx, rax
xor edx, edx
mov rcx, qword [rsp + 0x68]
call fcn.140011af0
mov rcx, rax
mov r8, rbx
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rdx, qword [rbp - 0x60]
lea rcx, [rsp + 0x40]
call fcn.1400056d0
mov rcx, rax
call fcn.140019fd0
nop
movdqa xmm0, xmmword [0x140093050]
movdqu xmmword [rbp - 0x60], xmm0
mov dword [rbp - 0x50], 0x1503072b
mov dword [rbp - 0x4c], 0x1a163651
mov dword [rbp - 0x48], 0x5813131c
mov word [rbp - 0x44], 0x58
mov byte [rbp - 0x42], 1
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x60]
call fcn.140011d80
mov rcx, rax
call fcn.140019fd0
nop
mov edx, pe_nt_image_headers64
call fcn.140018030
lea r8, str.System32driversetchosts
lea rdx, [rbp + 0x48]
lea rcx, [rsp + 0x40]
call fcn.1400077d0
nop
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 1
mov rdx, rax
lea rcx, [rbp + 0x2d0]
call fcn.14000ffe0
nop
lea rcx, [rsp + 0x40]
call fcn.140005670
lea rcx, [rbp + 0x2d0]
call fcn.140018da0
movdqa xmm0, xmmword [0x140092f90]
movdqu xmmword [rbp - 0x60], xmm0
mov dword [rbp - 0x50], 0x40e0d04
mov dword [rbp - 0x4c], 0x551d1d18
mov word [rbp - 0x48], 0x100
lea rdx, [rbp + 0x68]
lea rcx, [rbp - 0x60]
call fcn.140011cf0
mov rcx, rax
call fcn.140019fd0
int3