Function at 0x1400657b0
Capabilities:
Create process on windows
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2e0]
sub rsp, 0x3e0
mov rax, qword [0x14037f670]
xor rax, rsp
mov qword [rbp + 0x2d8], rax
lea rcx, [rbp - 0x30]
call fcn.140064620
nop
mov rdx, rax
lea rcx, [rbp - 0x50]
call fcn.140063f60
mov rbx, rax
lea rsi, [0x140389d28]
xor r12d, r12d
cmp rsi, rax
je 0x14006588e
mov rdx, qword [0x140389d40]
cmp rdx, 0x10
jb 0x140065851
mov rcx, qword [0x140389d28]
inc rdx
cmp rdx, 0x1000
jb 0x14006584c
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140066849
mov rcx, r8
call fcn.140261c34
mov qword [0x140389d38], r12
mov qword [0x140389d40], 0xf
mov byte [0x140389d28], r12b
movups xmm0, xmmword [rbx]
movups xmmword [0x140389d28], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [0x140389d38], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r12b
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x1400658c9
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400658c4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140066849
call fcn.140261c34
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x50], r12b
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x140065914
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006590f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006684f
call fcn.140261c34
cmp qword [0x140389c50], 0xa
jne 0x140066836
cmp qword [0x140389c70], 0x40
jne 0x140066836
mov dword [rsp + 0x68], 0x998187cb
mov dword [rsp + 0x6c], 0x829aad85
mov word [rsp + 0x70], reloc.WLDAP32.dll_Ordinal_200
mov byte [rsp + 0x72], 1
mov rcx, r12
nop
lea eax, [rcx - 0x13]
xor byte [rsp + rcx + 0x68], al
inc rcx
cmp rcx, 9
jb 0x140065950
mov byte [rsp + 0x72], 0
lea rdx, [0x140389c40]
lea rcx, [rbp + 0x110]
call fcn.140064380
mov r15, rax
mov dword [rsp + 0x58], 0x9e9881cb
mov dword [rsp + 0x5c], 0x909a8094
mov word [rsp + 0x60], reloc.WLDAP32.dll_Ordinal_200
mov byte [rsp + 0x62], 1
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx - 0x13]
xor byte [rsp + rcx + 0x58], al
inc rcx
cmp rcx, 9
jb 0x1400659a0
mov byte [rsp + 0x62], 0
lea rdx, [0x140389c20]
lea rcx, [rbp + 0xf0]
call fcn.140064380
mov r14, rax
mov dword [rsp + 0x40], 0x9d8e80cb
mov dword [rsp + 0x44], 0x100cf94
mov rcx, r12
nop
lea eax, [rcx - 0x13]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 6
jb 0x1400659e0
mov byte [rsp + 0x47], 0
lea rax, [rbp + 0x228]
mov qword [rsp + 0x38], rax
lea rdx, [0x140389be0]
lea rcx, [rbp + 0x228]
call fcn.14007afa0
mov rdi, rax
lea rax, [rbp + 0x248]
mov qword [rsp + 0x30], rax
lea rdx, [0x140389c60]
lea rcx, [rbp + 0x248]
call fcn.14007afa0
mov rbx, rax
mov rdx, rsi
lea rcx, [rbp + 0x1e8]
call fcn.14007afa0
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0xd0]
call fcn.140064760
mov rsi, rax
mov dword [rsp + 0x48], 0x93818bcb
mov dword [rsp + 0x4c], 0xc98a979a
mov word [rsp + 0x50], 0x100
mov rcx, r12
nop dword [rax + rax]
lea eax, [rcx - 0x13]
xor byte [rsp + rcx + 0x48], al
inc rcx
cmp rcx, 8
jb 0x140065a80
mov byte [rsp + 0x51], 0
lea rax, [rbp + 0x1b0]
mov qword [rbp - 0x78], rax
lea rdx, [0x140389be0]
lea rcx, [rbp + 0x1b0]
call fcn.14007afa0
mov rdi, rax
lea rax, [rbp + 0x130]
mov qword [rsp + 0x38], rax
lea rdx, [0x140389c60]
lea rcx, [rbp + 0x130]
call fcn.14007afa0
mov rbx, rax
lea rdx, [0x140389c80]
lea rcx, [rbp + 0x298]
call fcn.14007afa0
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0xb0]
call fcn.140064760
mov rdi, rax
mov dword [rsp + 0x38], 0x828a98cb
mov word [rsp + 0x3c], 0xcc
mov byte [rsp + 0x3e], 1
mov rcx, r12
nop dword [rax + rax]
lea eax, [rcx - 0x13]
xor byte [rsp + rcx + 0x38], al
inc rcx
cmp rcx, 5
jb 0x140065b20
mov byte [rsp + 0x3e], 0
mov dword [rsp + 0x30], 0x84868084
mov word [rsp + 0x34], 0x100
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx - 0x13]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 4
jb 0x140065b50
mov byte [rsp + 0x35], 0
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x58], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x70], 0
lea rax, [rsp + 0x30]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x140065b84
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x70]
call fcn.14007c9b0
nop
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x90]
call fcn.140064380
mov r10, rax
mov dword [rsp + 0x30], 0x959f9799
mov word [rsp + 0x34], 0xcc
mov byte [rsp + 0x36], 1
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx - 0x13]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 5
jb 0x140065bd0
mov byte [rsp + 0x36], 0
lea rax, [rsp + 0x30]
mov r9, rbx
nop dword [rax]
inc r9
cmp byte [rax + r9], 0
jne 0x140065bf0
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, r10
call fcn.14007fcc0
mov qword [rbp + 0x20], r12
mov qword [rbp + 0x28], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x20], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rax, [rsp + 0x38]
mov r8, rbx
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140065c40
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x10]
call fcn.14007ae70
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x20], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, rdi
lea r8, [rbp - 0x30]
lea rcx, [rbp - 0x50]
call fcn.14007fdd0
nop
lea rax, [rsp + 0x48]
mov r8, rbx
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140065c90
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x50]
call fcn.14007ae70
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x190], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1a0], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, rsi
lea r8, [rbp + 0x190]
lea rcx, [rbp + 0x70]
call fcn.14007fdd0
nop
lea rax, [rsp + 0x40]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140065cf0
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x70]
call fcn.14007ae70
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x170], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x180], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, r14
lea r8, [rbp + 0x170]
lea rcx, [rbp + 0x50]
call fcn.14007fdd0
nop
lea rax, [rsp + 0x58]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140065d50
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x50]
call fcn.14007ae70
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x150], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x160], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, r15
lea r8, [rbp + 0x150]
lea rcx, [rbp + 0x30]
call fcn.14007fdd0
nop
lea rax, [rsp + 0x68]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140065da5
mov r8, rbx
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x30]
call fcn.14007ae70
mov qword [rbp], r12
mov qword [rbp + 8], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rdx, [0x140389be0]
cmp qword [0x140389bf8], 0x10
cmovae rdx, qword [0x140389be0]
mov r8, qword [0x140389bf0]
lea rcx, [rbp - 0x10]
call fcn.14007ae70
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x2b8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x2c8], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x140065e6b
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140065e66
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140066855
call fcn.140261c34
mov qword [rbp], r12
mov qword [rbp + 8], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x10], 0
mov rdx, qword [rbp + 0x48]
cmp rdx, 0x10
jb 0x140065eb6
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140065eb1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006685b
call fcn.140261c34
mov qword [rbp + 0x40], r12
mov qword [rbp + 0x48], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x30], 0
mov rdx, qword [rbp + 0x168]
cmp rdx, 0x10
jb 0x140065f08
inc rdx
mov rcx, qword [rbp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140065f02
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140066861
call fcn.140261c34
nop
mov rdx, qword [rbp + 0x68]
cmp rdx, 0x10
jb 0x140065f43
inc rdx
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140065f3e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140066867
call fcn.140261c34
mov qword [rbp + 0x60], r12
mov qword [rbp + 0x68], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x50], 0
mov rdx, qword [rbp + 0x188]
cmp rdx, 0x10
jb 0x140065f95
inc rdx
mov rcx, qword [rbp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140065f8f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006686d
call fcn.140261c34
nop
mov rdx, qword [rbp + 0x88]
cmp rdx, 0x10
jb 0x140065fd3
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140065fce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140066873
call fcn.140261c34
mov qword [rbp + 0x80], r12
mov qword [rbp + 0x88], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x70], 0
mov rdx, qword [rbp + 0x1a8]
cmp rdx, 0x10
jb 0x14006602b
inc rdx
mov rcx, qword [rbp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140066025
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140066879
call fcn.140261c34
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140066066
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140066061
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006687f
call fcn.140261c34
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x50], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400660b2
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400660ac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140066885
call fcn.140261c34
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x1400660ed
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400660e8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006688b
call fcn.140261c34
mov qword [rbp + 0x20], r12
mov qword [rbp + 0x28], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x10], 0
mov rdx, qword [rbp + 0xa8]
cmp rdx, 0x10
jb 0x14006613e
inc rdx
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140066139
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140066891
call fcn.140261c34
mov qword [rbp + 0xa0], r12
mov qword [rbp + 0xa8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x90], 0
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x140066192
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006618d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140066897
call fcn.140261c34
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x58], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x70], 0
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0x10
jb 0x1400661e3
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400661de
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006689d
call fcn.140261c34
mov qword [rbp + 0xc0], r12
mov qword [rbp + 0xc8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xb0], 0
mov rdx, qword [rbp + 0xe8]
cmp rdx, 0x10
jb 0x14006623d
inc rdx
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140066238
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400668a3
call fcn.140261c34
mov qword [rbp + 0xe0], r12
mov qword [rbp + 0xe8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xd0], 0
mov rdx, qword [rbp + 0x108]
cmp rdx, 0x10
jb 0x140066297
inc rdx
mov rcx, qword [rbp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140066292
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400668a9
call fcn.140261c34
mov qword [rbp + 0x100], r12
mov qword [rbp + 0x108], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xf0], 0
mov rdx, qword [rbp + 0x128]
cmp rdx, 0x10
jb 0x1400662f1
inc rdx
mov rcx, qword [rbp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400662ec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400668af
call fcn.140261c34
mov qword [rbp + 0x120], r12
mov qword [rbp + 0x128], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x110], 0
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x80], r12
lea rsi, [rbp + 0x2b8]
mov rdi, qword [rbp + 0x2b8]
mov r15, qword [rbp + 0x2d0]
cmp r15, 0x10
cmovae rsi, rdi
movabs rax, 0x7fffffffffffffff
mov r14, qword [rbp + 0x2c8]
cmp r14, 0x10
jae 0x140066356
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x68], xmm0
mov ebx, reloc.WS2_32.dll_ntohs
jmp 0x1400663c3
mov rbx, r14
or rbx, 0xf
cmp rbx, rax
cmova rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400663a0
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400668b5
mov rcx, rax
call fcn.140261ee4
mov rcx, rax
test rax, rax
je 0x1400668bb
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400663af
test rcx, rcx
je 0x1400663ac
call fcn.140261ee4
jmp 0x1400663af
mov rax, r12
mov qword [rsp + 0x68], rax
lea r8, [r14 + 1]
mov rdx, rsi
mov rcx, rax
call fcn.1402645e0
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x80], rbx
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x268]
call fcn.14006aa00
nop
lea rax, [rbp + 0x298]
mov qword [rbp - 0x78], rax
lea rdx, [0x140389be0]
lea rcx, [rbp + 0x298]
call fcn.14007afa0
mov r12, rax
lea rax, [rbp + 0x130]
mov qword [rsp + 0x40], rax
lea rdx, [0x140389c60]
lea rcx, [rbp + 0x130]
call fcn.14007afa0
mov r13, rax
xor eax, eax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov rsi, qword [rbp + 0x278]
lea r14, [rbp + 0x268]
cmp qword [rbp + 0x280], 0x10
cmovae r14, qword [rbp + 0x268]
cmp rsi, 0x10
jae 0x14006645c
movups xmm0, xmmword [r14]
movups xmmword [rbp - 0x70], xmm0
lea ebx, [rax + 0xf]
jmp 0x1400664cd
mov rbx, rsi
or rbx, 0xf
movabs rcx, 0x7fffffffffffffff
cmp rbx, rcx
cmova rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400664b0
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400668c1
mov rcx, rax
call fcn.140261ee4
mov rcx, rax
test rax, rax
je 0x1400668c7
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400664ba
test rcx, rcx
je 0x1400664ba
call fcn.140261ee4
mov qword [rbp - 0x70], rax
lea r8, [rsi + 1]
mov rdx, r14
mov rcx, rax
call fcn.1402645e0
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x58], rbx
mov r9, r12
mov r8, r13
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x30]
call fcn.140064b00
mov rbx, rax
lea rax, [rbp + 0x268]
cmp rax, rbx
je 0x14006657d
mov rdx, qword [rbp + 0x280]
cmp rdx, 0x10
jb 0x14006653c
inc rdx
mov rcx, qword [rbp + 0x268]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140066537
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400668c7
call fcn.140261c34
xor esi, esi
mov qword [rbp + 0x278], rsi
mov qword [rbp + 0x280], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x268], sil
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x268], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x278], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
jmp 0x14006657f
xor esi, esi
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400665ba
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400665b5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400668c7
call fcn.140261c34
mov qword [rbp + 0x220], rsi
lea r8, [rbp + 0x1e8]
lea rdx, [rbp + 0x268]
lea rcx, [rbp + 0x288]
call fcn.14007dfb0
nop
lea rdx, str.success
lea rcx, [rbp + 0x288]
call fcn.14007e0f0
cmp byte [rax], 4
jne 0x1400668cd
lea rcx, [rbp + 0x288]
cmp byte [rax + 8], 0
je 0x140066712
lea rdx, [0x14034ccd0]
call fcn.14007e0f0
cmp byte [rax], 3
jne 0x140066924
mov rdx, qword [rax + 8]
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x140066630
mov rdx, qword [rdx]
lea rcx, [0x140389d08]
call fcn.14007c9b0
nop
movzx edx, byte [rbp + 0x288]
lea rcx, [rbp + 0x290]
call fcn.14007c3e0
nop
mov rdx, qword [rbp + 0x280]
cmp rdx, 0x10
jb 0x140066692
inc rdx
mov rcx, qword [rbp + 0x268]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006668d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006697b
call fcn.140261c34
mov qword [rbp + 0x278], rsi
mov qword [rbp + 0x280], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x268], 0
cmp r15, 0x10
jb 0x1400666e2
lea rdx, [r15 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400666da
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140066981
mov rcx, rdi
call fcn.140261c34
mov rcx, qword [rbp + 0x2d8]
xor rcx, rsp
call fcn.140261c10
lea r11, [rsp + 0x3e0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea rdx, str.message
call fcn.14007e0f0
mov rdi, rax
mov byte [rsp + 0x68], 3
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.140261ee4
mov rbx, rax
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r8d, 0xa
lea rdx, str.invalidver
mov rcx, rax
call fcn.14007c9b0
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov rcx, rdi
call fcn.14007f8f0
movzx ebx, al
movzx edx, byte [rsp + 0x68]
lea rcx, [rsp + 0x70]
call fcn.14007c3e0
nop
test bl, bl
jne 0x1400667de
lea rdx, [0x14034cd0c]
lea rcx, [0x14037f5a0]
call fcn.14007dd30
lea rdx, str.message
lea rcx, [rbp + 0x288]
call fcn.14007e0f0
mov rdx, rax
lea rcx, [rbp + 0x298]
call fcn.14007e390
nop
mov rdx, rax
call fcn.14007e430
nop
lea rcx, [rbp + 0x298]
call fcn.14007af00
mov ecx, 0x1194
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call fcn.1402709a0
int3
lea rdx, str.download
lea rcx, [rbp + 0x288]
call fcn.14007e0f0
lea rdx, [rbp + 0x298]
mov rcx, rax
call fcn.14007e2e0
lea rcx, [rbp + 0x298]
call fcn.14007ae60
mov r8, rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor ecx, ecx
call fcn.1402709a0
nop
mov ecx, 0x1194
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call fcn.1402709a0
nop
call fcn.140276034
nop
call fcn.140276034
nop
call fcn.140276034
nop
call fcn.140276034
nop
call fcn.140276034
nop
call fcn.140276034
nop
call fcn.140276034
nop
call fcn.140276034
nop
call fcn.140276034
nop
call fcn.140276034
nop
call fcn.140276034
nop
call fcn.140276034
nop
call fcn.140276034
nop
call fcn.140276034
nop
call fcn.140276034
nop
call fcn.140276034
nop
call fcn.140276034
nop
call fcn.140276034
int3
call fcn.14005e230
int3
call fcn.140276034
nop
call fcn.14005e230
int3
call fcn.140276034
nop
mov rcx, rax
call fcn.14007c8e0
mov rdx, rax
lea rcx, [rbp + 0x298]
call fcn.14007af60
nop
mov r8, rax
lea rdx, str.type_must_be_boolean__but_is
lea rcx, [rbp + 0x130]
call fcn.14007d920
nop
mov r8, rax
mov edx, 0x12e
lea rcx, [rbp + 0x1b0]
call fcn.1400630f0
lea rdx, [0x140377310]
lea rcx, [rbp + 0x1b0]
call fcn.14026450c
nop
mov rcx, rax
call fcn.14007c8e0
mov rdx, rax
lea rcx, [rbp + 0x298]
call fcn.14007af60
nop
mov r8, rax
lea rdx, str.type_must_be_string__but_is
lea rcx, [rbp + 0x130]
call fcn.14007d920
nop
mov r8, rax
mov edx, 0x12e
lea rcx, [rbp + 0x1b0]
call fcn.1400630f0
lea rdx, [0x140377310]
lea rcx, [rbp + 0x1b0]
call fcn.14026450c
nop
call fcn.140276034
nop
call fcn.140276034
int3