Function at 0x140061640
Capabilities:
Contain obfuscated stackstrings
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x338]
sub rsp, 0x420
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
movaps xmmword [rax - 0x48], xmm8
mov rax, qword [0x140324680]
xor rax, rsp
mov qword [rbp + 0x2e0], rax
xor r12d, r12d
lea rcx, [rbp + 0x10]
call fcn.1400606d0
nop
mov rdx, rax
lea rcx, [rbp - 0x10]
call fcn.14005fe80
mov rdx, rax
lea rcx, [0x14032e968]
call fcn.14006bad0
mov rdx, qword [rbp + 8]
cmp rdx, 0xf
jbe 0x1400616e7
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400616e2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062795
call fcn.140217920
movdqa xmm6, xmmword [0x1402fb570]
movdqu xmmword [rbp], xmm6
mov byte [rbp - 0x10], 0
mov rdx, qword [rbp + 0x28]
cmp rdx, 0xf
jbe 0x140061733
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006172e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006279b
call fcn.140217920
cmp qword [0x14032e890], 0xa
jne 0x14006272d
cmp qword [0x14032e8b0], 0x40
jne 0x14006272d
mov dword [rsp + 0x46], 0x3d7669
mov dword [rsp + 0x40], 0x696e6926
mov word [rsp + 0x44], 0x5f74
mov byte [rsp + 0x4a], 0
lea rdx, [0x14032e880]
lea rcx, [rbp + 0x10]
call fcn.1400602b0
mov r15, rax
mov dword [rbp - 0x6a], 0x3d6469
mov dword [rbp - 0x70], 0x6e776f26
mov word [rbp - 0x6c], 0x7265
mov byte [rbp - 0x66], 0
lea rdx, [0x14032e860]
lea rcx, [rbp + 0x1b0]
call fcn.1400602b0
mov r14, rax
mov word [rsp + 0x35], 0x3d
mov dword [rsp + 0x30], 0x6d616e26
mov byte [rsp + 0x34], 0x65
mov byte [rsp + 0x37], 0
lea rax, [rbp + 0x210]
mov qword [rsp + 0x70], rax
lea rdx, [0x14032e810]
lea rcx, [rbp + 0x210]
call fcn.14006bba0
mov rdi, rax
lea rax, [rbp + 0x230]
mov qword [rsp + 0x38], rax
lea rdx, [0x14032e8a0]
lea rcx, [rbp + 0x230]
call fcn.14006bba0
mov rbx, rax
lea rdx, [0x14032e968]
lea rcx, [rbp + 0x250]
call fcn.14006bba0
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x190]
call fcn.140060800
mov rsi, rax
mov word [rbp - 0x79], 0x3d
mov dword [rbp - 0x80], 0x636e6526
mov word [rbp - 0x7c], 0x656b
mov byte [rbp - 0x7a], 0x79
mov byte [rbp - 0x77], 0
lea rax, [rbp + 0x1d0]
mov qword [rsp + 0x78], rax
lea rdx, [0x14032e810]
lea rcx, [rbp + 0x1d0]
call fcn.14006bba0
mov rdi, rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x70], rax
lea rdx, [0x14032e8a0]
lea rcx, [rbp - 0x60]
call fcn.14006bba0
mov rbx, rax
lea rdx, [0x14032e8c0]
lea rcx, [rbp + 0x2a0]
call fcn.14006bba0
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x170]
call fcn.140060800
mov rdi, rax
mov dword [rsp + 0x72], 0x3d7265
mov word [rsp + 0x70], 0x7626
mov byte [rsp + 0x76], 0
mov word [rsp + 0x3b], reloc.WS2_32.dll_WSACleanup
mov word [rsp + 0x38], 0x6e69
mov byte [rsp + 0x3a], 0x69
mov byte [rsp + 0x3d], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x80], xmm1
lea rax, [rsp + 0x38]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140061910
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x70]
call fcn.14006ee00
nop
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x150]
call fcn.1400602b0
nop
mov dword [rsp + 0x3a], 0x3d6570
mov word [rsp + 0x38], 0x7974
mov byte [rsp + 0x3e], 0
lea rcx, [rsp + 0x38]
mov r9, rbx
inc r9
cmp byte [rcx + r9], 0
jne 0x140061956
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call fcn.1400704c0
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x60], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rax, [rsp + 0x70]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x1400619a4
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x50]
call fcn.14006b9e0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x130], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x140], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, rdi
lea r8, [rbp + 0x130]
lea rcx, [rbp - 0x10]
call fcn.1400705c0
nop
lea rax, [rbp - 0x80]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140061a00
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x10]
call fcn.14006b9e0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x110], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x120], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, rsi
lea r8, [rbp + 0x110]
lea rcx, [rbp + 0xd0]
call fcn.1400705c0
nop
lea rax, [rsp + 0x30]
mov r8, rbx
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140061a60
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0xd0]
call fcn.14006b9e0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xf0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x100], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, r14
lea r8, [rbp + 0xf0]
lea rcx, [rbp + 0xb0]
call fcn.1400705c0
nop
lea rax, [rbp - 0x70]
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140061ac0
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0xb0]
call fcn.14006b9e0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, r15
lea r8, [rsp + 0x50]
lea rcx, [rbp + 0x90]
call fcn.1400705c0
nop
lea rax, [rsp + 0x40]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140061b14
mov r8, rbx
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x90]
call fcn.14006b9e0
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x40], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rdx, [0x14032e810]
cmp qword [0x14032e828], 0xf
cmova rdx, qword [0x14032e810]
mov r8, qword [0x14032e820]
lea rcx, [rbp + 0x30]
call fcn.14006b9e0
movups xmm8, xmmword [rax]
movups xmmword [rbp + 0x2c0], xmm8
movups xmm7, xmmword [rax + 0x10]
movups xmmword [rbp + 0x2d0], xmm7
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rbp + 0x48]
cmp rdx, 0xf
jbe 0x140061be6
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061be1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400627a1
call fcn.140217920
movdqu xmmword [rbp + 0x40], xmm6
mov byte [rbp + 0x30], 0
mov rdx, qword [rbp + 0xa8]
cmp rdx, 0xf
jbe 0x140061c30
inc rdx
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061c2b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400627a7
call fcn.140217920
movdqu xmmword [rbp + 0xa0], xmm6
mov byte [rbp + 0x90], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140061c7d
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061c77
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400627ad
call fcn.140217920
nop
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0xf
jbe 0x140061cbe
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061cb9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400627b3
call fcn.140217920
movdqu xmmword [rbp + 0xc0], xmm6
mov byte [rbp + 0xb0], 0
mov rdx, qword [rbp + 0x108]
cmp rdx, 0xf
jbe 0x140061d0f
inc rdx
mov rcx, qword [rbp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061d09
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400627b9
call fcn.140217920
nop
mov rdx, qword [rbp + 0xe8]
cmp rdx, 0xf
jbe 0x140061d50
inc rdx
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061d4b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400627bf
call fcn.140217920
movdqu xmmword [rbp + 0xe0], xmm6
mov byte [rbp + 0xd0], 0
mov rdx, qword [rbp + 0x128]
cmp rdx, 0xf
jbe 0x140061da1
inc rdx
mov rcx, qword [rbp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061d9b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400627c5
call fcn.140217920
nop
mov rdx, qword [rbp + 8]
cmp rdx, 0xf
jbe 0x140061ddc
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061dd7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400627cb
call fcn.140217920
movdqu xmmword [rbp], xmm6
mov byte [rbp - 0x10], 0
mov rdx, qword [rbp + 0x148]
cmp rdx, 0xf
jbe 0x140061e27
inc rdx
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061e21
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400627d1
call fcn.140217920
nop
mov rdx, qword [rbp + 0x68]
cmp rdx, 0xf
jbe 0x140061e62
inc rdx
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061e5d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400627d7
call fcn.140217920
movdqu xmmword [rbp + 0x60], xmm6
mov byte [rbp + 0x50], 0
mov rdx, qword [rbp + 0x168]
cmp rdx, 0xf
jbe 0x140061eac
inc rdx
mov rcx, qword [rbp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061ea7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400627dd
call fcn.140217920
movdqu xmmword [rbp + 0x160], xmm6
mov byte [rbp + 0x150], 0
mov rdx, qword [rbp + 0x88]
cmp rdx, 0xf
jbe 0x140061ef9
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061ef4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400627e3
call fcn.140217920
movdqu xmmword [rbp + 0x80], xmm6
mov byte [rbp + 0x70], 0
mov rdx, qword [rbp + 0x188]
cmp rdx, 0xf
jbe 0x140061f46
inc rdx
mov rcx, qword [rbp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061f41
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400627e9
call fcn.140217920
movdqu xmmword [rbp + 0x180], xmm6
mov byte [rbp + 0x170], 0
mov rdx, qword [rbp + 0x1a8]
cmp rdx, 0xf
jbe 0x140061f96
inc rdx
mov rcx, qword [rbp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061f91
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400627ef
call fcn.140217920
movdqu xmmword [rbp + 0x1a0], xmm6
mov byte [rbp + 0x190], 0
mov rdx, qword [rbp + 0x1c8]
cmp rdx, 0xf
jbe 0x140061fe6
inc rdx
mov rcx, qword [rbp + 0x1b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061fe1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400627f5
call fcn.140217920
movdqu xmmword [rbp + 0x1c0], xmm6
mov byte [rbp + 0x1b0], 0
mov rdx, qword [rbp + 0x28]
cmp rdx, 0xf
jbe 0x140062030
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006202b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400627fb
call fcn.140217920
movdqu xmmword [rbp + 0x20], xmm6
mov byte [rbp + 0x10], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r12
lea r14, [rbp + 0x2c0]
movq rsi, xmm8
movdqa xmm0, xmm7
psrldq xmm0, 8
movq r15, xmm0
cmp r15, 0xf
cmova r14, rsi
movabs rbx, 0x7fffffffffffffff
movq rdi, xmm7
cmp rdi, rbx
ja 0x140062801
cmp rdi, 0xf
ja 0x1400620a7
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
movups xmm0, xmmword [r14]
movups xmmword [rsp + 0x50], xmm0
jmp 0x14006213b
mov rax, rdi
or rax, 0xf
cmp rax, rbx
jbe 0x1400620e3
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140217a1c
mov rcx, rax
test rax, rax
je 0x140062807
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14006211d
mov rbx, rax
mov ecx, reloc.WS2_32.dll_shutdown
cmp rax, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x140062100
mov rax, r12
jmp 0x14006211d
cmp rcx, 0x1000
jb 0x140062118
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400626cf
jmp 0x1400620c1
call fcn.140217a1c
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rbx
lea r8, [rdi + 1]
mov rdx, r14
mov rcx, rax
call fcn.140255d00
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x280]
call fcn.140065150
nop
lea rax, [rbp + 0x2a0]
mov qword [rsp + 0x78], rax
lea rdx, [0x14032e810]
lea rcx, [rbp + 0x2a0]
call fcn.14006bba0
mov rdi, rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x30], rax
lea rdx, [0x14032e8a0]
lea rcx, [rbp - 0x60]
call fcn.14006bba0
mov rbx, rax
lea rdx, [rbp + 0x280]
lea rcx, [rbp + 0x1d0]
call fcn.14006bba0
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.140060b10
mov rbx, rax
lea rax, [rbp + 0x280]
cmp rax, rbx
je 0x140062234
mov rdx, qword [rbp + 0x298]
cmp rdx, 0xf
jbe 0x140062201
inc rdx
mov rcx, qword [rbp + 0x280]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400621fc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006280d
call fcn.140217920
movdqu xmmword [rbp + 0x290], xmm6
mov byte [rbp + 0x280], 0
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x280], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x290], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rbp + 0x28]
cmp rdx, 0xf
jbe 0x14006226f
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006226a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006280d
call fcn.140217920
mov qword [rbp + 0x208], r12
lea r8, [rbp + 0x1d0]
lea rdx, [rbp + 0x280]
lea rcx, [rbp + 0x270]
call fcn.14006e100
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r12
mov r8d, 7
lea rdx, str.success
lea rcx, [rsp + 0x50]
call fcn.14006ee00
lea rax, [rsp + 0x50]
mov qword [rsp + 0x78], rax
movzx ecx, byte [rbp + 0x270]
test cl, cl
jne 0x1400622eb
mov byte [rbp + 0x270], 1
call fcn.14006f1f0
mov qword [rbp + 0x278], rax
movzx ecx, byte [rbp + 0x270]
jmp 0x1400622f2
mov rax, qword [rbp + 0x278]
cmp cl, 1
jne 0x14006268a
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.140077e40
mov rbx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14006234f
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006234a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062813
call fcn.140217920
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x50], 0
cmp byte [rbx + 0x40], 4
jne 0x140062819
xorps xmm0, xmm0
lea rcx, [rsp + 0x50]
cmp byte [rbx + 0x48], 0
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r12
movups xmmword [rsp + 0x50], xmm0
je 0x14006254d
mov r8d, 9
lea rdx, str.sessionid
call fcn.14006ee00
lea rax, [rsp + 0x50]
mov qword [rsp + 0x78], rax
movzx ecx, byte [rbp + 0x270]
test cl, cl
jne 0x1400623d0
mov byte [rbp + 0x270], 1
call fcn.14006f1f0
mov qword [rbp + 0x278], rax
movzx ecx, byte [rbp + 0x270]
jmp 0x1400623d7
mov rax, qword [rbp + 0x278]
cmp cl, 1
jne 0x1400628a5
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.140077e40
mov rbx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140062434
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006242f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062856
call fcn.140217920
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x50], 0
cmp byte [rbx + 0x40], 3
jne 0x14006285c
mov r8, qword [rbx + 0x48]
mov rdx, r8
cmp qword [r8 + 0x18], 0xf
jbe 0x140062462
mov rdx, qword [r8]
mov r8, qword [r8 + 0x10]
lea rcx, [0x14032e948]
call fcn.14006ccd0
nop
movzx edx, byte [rbp + 0x270]
lea rcx, [rbp + 0x278]
call fcn.14006ce70
nop
mov rdx, qword [rbp + 0x298]
cmp rdx, 0xf
jbe 0x1400624c8
inc rdx
mov rcx, qword [rbp + 0x280]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400624c3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062899
call fcn.140217920
movdqu xmmword [rbp + 0x290], xmm6
mov byte [rbp + 0x280], 0
cmp r15, 0xf
jbe 0x14006250e
lea rdx, [r15 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140062506
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006289f
mov rcx, rsi
call fcn.140217920
mov rcx, qword [rbp + 0x2e0]
xor rcx, rsp
call fcn.140217900
lea r11, [rsp + 0x420]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov r8d, 7
lea rdx, str.message
call fcn.14006ee00
lea rax, [rsp + 0x50]
mov qword [rsp + 0x78], rax
movzx ecx, byte [rbp + 0x270]
test cl, cl
jne 0x140062590
mov byte [rbp + 0x270], 1
call fcn.14006f1f0
mov qword [rbp + 0x278], rax
movzx ecx, byte [rbp + 0x270]
jmp 0x140062597
mov rax, qword [rbp + 0x278]
cmp cl, 1
jne 0x140062947
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.140077e40
mov rdi, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x1400625f4
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400625ef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400628ea
call fcn.140217920
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x50], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xor eax, eax
mov qword [rsp + 0x48], rax
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.14006ce70
mov byte [rsp + 0x40], 3
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.140217a1c
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], r12
mov r8d, 0xa
lea rdx, str.invalidver
mov rcx, rax
call fcn.14006ee00
mov qword [rsp + 0x48], rbx
lea rdx, [rsp + 0x40]
lea rcx, [rdi + 0x40]
call fcn.140070040
movzx ebx, al
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.14006ce70
nop
test bl, bl
je 0x1400628f0
jmp 0x1400626d5
lea rcx, [rbp + 0x270]
call fcn.14006c9c0
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x30]
lea rcx, [rbp + 0x2a0]
call fcn.140076a40
nop
mov r8, rax
mov edx, 0x131
lea rcx, [rbp - 0x60]
call fcn.14006e8f0
lea rdx, [0x14031d1c0]
lea rcx, [rbp - 0x60]
call fcn.140219e24
nop
call fcn.14005ba30
nop
lea rdx, str.download
lea rcx, [rbp + 0x270]
call fcn.14006e220
lea rdx, [rbp + 0x2a0]
mov rcx, rax
call fcn.14006e340
lea rcx, [rbp + 0x2a0]
call fcn.14006b9d0
mov r8, rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor ecx, ecx
call fcn.14022664c
nop
movdqa xmm0, xmmword [0x1402fb630]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm1, xmmword [0x1402fb650]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm0, xmmword [0x1402fb640]
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [0x1402fb6a0]
movdqa xmmword [rbp - 0x30], xmm1
mov dword [rbp - 0x20], 0xfbf0ddaf
mov dword [rbp - 0x1c], 0xe6f6bafd
mov word [rbp - 0x18], 0xe7
mov byte [rbp - 0x16], 1
lea rdx, [rbp - 0x60]
call fcn.140062990
mov ecx, 0x1194
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call fcn.14022664c
nop
call fcn.14022bbf0
nop
call fcn.14022bbf0
nop
call fcn.14022bbf0
nop
call fcn.14022bbf0
nop
call fcn.14022bbf0
nop
call fcn.14022bbf0
nop
call fcn.14022bbf0
nop
call fcn.14022bbf0
nop
call fcn.14022bbf0
nop
call fcn.14022bbf0
nop
call fcn.14022bbf0
nop
call fcn.14022bbf0
nop
call fcn.14022bbf0
nop
call fcn.14022bbf0
nop
call fcn.14022bbf0
nop
call fcn.14022bbf0
nop
call fcn.14022bbf0
nop
call fcn.14022bbf0
int3
call fcn.14005bad0
int3
call fcn.14022bbf0
nop
call fcn.14022bbf0
nop
call fcn.14022bbf0
int3
lea rcx, [rbx + 0x40]
call fcn.14006c9c0
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x30]
lea rcx, [rbp + 0x2a0]
call fcn.14007c4a0
nop
mov r8, rax
lea rcx, [rbp - 0x60]
call fcn.14007c260
lea rdx, [0x14031d1c0]
lea rcx, [rbp - 0x60]
call fcn.140219e24
nop
call fcn.14022bbf0
int3
lea rcx, [rbx + 0x40]
call fcn.14006c9c0
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x30]
lea rcx, [rbp + 0x2a0]
call fcn.14007c1b0
nop
mov r8, rax
lea rcx, [rbp - 0x60]
call fcn.14007c260
lea rdx, [0x14031d1c0]
lea rcx, [rbp - 0x60]
call fcn.140219e24
nop
call fcn.14022bbf0
nop
call fcn.14022bbf0
nop
lea rcx, [rbp + 0x270]
call fcn.14006c9c0
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x30]
lea rcx, [rbp + 0x2a0]
call fcn.140076a40
nop
mov r8, rax
mov edx, 0x131
lea rcx, [rbp - 0x60]
call fcn.14006e8f0
lea rdx, [0x14031d1c0]
lea rcx, [rbp - 0x60]
call fcn.140219e24
nop
call fcn.14022bbf0
int3
lea rdx, [0x1402f90c4]
call fcn.14006de20
lea rdx, str.message
lea rcx, [rbp + 0x270]
call fcn.14006e220
mov rdx, rax
lea rcx, [rbp + 0x2a0]
call fcn.14006e3e0
nop
mov rdx, rax
call fcn.14006e470
nop
lea rcx, [rbp + 0x2a0]
call fcn.14006ba70
mov ecx, 0x1194
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call fcn.14022664c
nop
lea rcx, [rbp + 0x270]
call fcn.14006c9c0
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x30]
lea rcx, [rbp + 0x2a0]
call fcn.140076a40
nop
mov r8, rax
mov edx, 0x131
lea rcx, [rbp - 0x60]
call fcn.14006e8f0
lea rdx, [0x14031d1c0]
lea rcx, [rbp - 0x60]
call fcn.140219e24
int3