Function at 0x1400451f0
Capabilities:
Copy file
Delete file
Encode data using xor
Enumerate processes
Get common file path
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x360]
sub rsp, 0x460
mov rax, qword [0x14010b0c0]
xor rax, rsp
mov qword [rbp + 0x350], rax
xor esi, esi
lea ecx, [rsi + 0xa]
call fcn.1400bcb18
mov dword [rax], 0x61657473
mov dword [rax + 4], 0x78652e6d
mov word [rax + 8], 0x65
xorps xmm0, xmm0
movups xmmword [rbp + 0x1e0], xmm0
mov qword [rbp + 0x1f0], rsi
mov qword [rbp + 0x1f8], rsi
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], sil
jne 0x140045264
mov rdx, rax
lea rcx, [rbp + 0x1e0]
call fcn.14004f120
nop
mov ecx, reloc.WLDAP32.dll_Ordinal_26
call fcn.1400bcb18
mov dword [rax], 0x656d6147
mov dword [rax + 4], 0x7265764f
mov dword [rax + 8], 0x5279616c
mov dword [rax + 0xc], 0x65646e65
mov dword [rax + 0x10], 0x36726572
mov dword [rax + 0x14], 0x6c642e34
mov word [rax + 0x18], WSASetLastError
xorps xmm0, xmm0
movups xmmword [rbp + 0x1c0], xmm0
mov qword [rbp + 0x1d0], rsi
mov qword [rbp + 0x1d8], rsi
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x1400452d5
mov rdx, rax
lea rcx, [rbp + 0x1c0]
call fcn.14004f120
nop
xor dil, dil
mov dword [rbp + 0x220], 0x130
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
lea rdx, [rbp + 0x220]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140045361
nop
lea rdx, [rbp + 0x1e0]
cmp qword [rbp + 0x1f8], 0xf
cmova rdx, qword [rbp + 0x1e0]
lea rcx, [rbp + 0x24c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x14004535e
lea rdx, [rbp + 0x220]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140045320
jmp 0x140045361
mov dil, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test dil, dil
je 0x140046954
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0x188]
call fcn.140044bf0
nop
movabs rbx, 0x7fffffffffffffff
mov rax, rbx
mov rcx, qword [rbp + 0x198]
sub rax, rcx
cmp rax, 1
jb 0x140046a27
lea r9, [rbp + 0x188]
cmp qword [rbp + 0x1a0], 0xf
cmova r9, qword [rbp + 0x188]
mov qword [rsp + 0x30], 1
lea rax, [0x1400f85c8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r8, [rbp + 0x188]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0xb0]
call fcn.14004f7c0
nop
lea rdx, [rbp + 0x1c0]
cmp qword [rbp + 0x1d8], 0xf
cmova rdx, qword [rbp + 0x1c0]
mov r8, qword [rbp + 0x1d0]
lea rcx, [rbp + 0xb0]
call fcn.14004cfa0
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
mov qword [rbp + 0xa0], rsi
mov qword [rbp + 0xa8], rsi
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x90], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xa0], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0xf
jbe 0x14004549c
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140045497
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140045497
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bc740
mov qword [rbp + 0xc0], rsi
mov qword [rbp + 0xc8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xb0], 0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x1a8], xmm0
mov qword [rbp + 0x1b8], rax
lea ecx, [rax + 7]
call fcn.1400bcb18
mov dword [rax], 0x35313037
mov word [rax + 4], 0x3134
mov byte [rax + 6], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
mov qword [rbp + 0x110], rsi
mov qword [rbp + 0x118], rsi
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140045500
mov rdx, rax
lea rcx, [rbp + 0x100]
call fcn.14004f120
lea r8, [rbp + 0x100]
lea rdx, [rbp + 0x1a8]
lea rcx, [0x14010c630]
call fcn.1400603a0
nop
cmp byte [0x14010c860], 0
jne 0x140045581
lea rdx, str._n_n_Status:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14004e990
lea rdx, [0x14010c868]
cmp qword [0x14010c880], 0xf
cmova rdx, qword [0x14010c868]
mov r8, qword [0x14010c878]
mov rcx, rax
call fcn.14004fb20
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [rbp + 0x198]
sub rbx, rax
cmp rbx, 6
jb 0x140046a21
lea r9, [rbp + 0x188]
cmp qword [rbp + 0x1a0], 0xf
cmova r9, qword [rbp + 0x188]
mov qword [rsp + 0x30], 6
lea rcx, str._temp_
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x188]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0xb0]
call fcn.14004f7c0
nop
lea rdx, [rbp + 0x1c0]
cmp qword [rbp + 0x1d8], 0xf
cmova rdx, qword [rbp + 0x1c0]
mov r8, qword [rbp + 0x1d0]
lea rcx, [rbp + 0xb0]
call fcn.14004cfa0
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
mov qword [rbp + 0x80], rsi
mov qword [rbp + 0x88], rsi
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x80], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0xf
jbe 0x140045683
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004567e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004567e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bc740
mov qword [rbp + 0xc0], rsi
mov qword [rbp + 0xc8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xb0], 0
xor edx, edx
mov r8d, 0x108
lea rcx, [rsp + 0x60]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0x70]
cmp qword [rbp + 0x88], 0xf
cmova rdx, qword [rbp + 0x70]
mov r8d, Ordinal_35
lea rcx, [rsp + 0x60]
call fcn.14004db00
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 4]
lea rdi, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x60], rdi
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x5c], edx
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x60]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator__void_const___ptr64]
test al, al
je 0x140045757
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 4]
mov qword [rsp + rcx + 0x60], rdi
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x5c], edx
lea rcx, [rsp + 0x68]
call fcn.14004c9f0
lea rcx, [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
jmp 0x140045816
mov r8, qword [rbp + 0x1b0]
mov rdx, qword [rbp + 0x1a8]
sub r8, rdx
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rbp + 0x70]
cmp qword [rbp + 0x88], 0xf
cmova rcx, qword [rbp + 0x70]
mov edx, 6
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x1400457a3
lea rdx, str.___temp_dll_is_now_hidden._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
jmp 0x1400457b1
lea rdx, str.____temp_failed_to_hide_dll._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14004e990
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x60]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::good_void_const___ptr64]
movzx ebx, al
mov rcx, qword [rsp + 0x60]
movsxd rdx, dword [rcx + 4]
mov qword [rsp + rdx + 0x60], rdi
mov rcx, qword [rsp + 0x60]
movsxd rdx, dword [rcx + 4]
lea r8d, [rdx - 0xa8]
mov dword [rsp + rdx + 0x5c], r8d
lea rcx, [rsp + 0x68]
call fcn.14004c9f0
lea rcx, [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
test bl, bl
jne 0x14004582e
lea rdx, str.Failed_to_save_the_downloaded_DLL_to_disk._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14004e990
jmp 0x14004658f
lea rdx, str.Old_DLL_Path:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14004e990
lea rdx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0xf
cmova rdx, qword [rbp + 0x90]
mov r8, qword [rbp + 0xa0]
mov rcx, rax
call fcn.14004fb20
lea rdx, [0x14004eb60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Cheat_DLL_Path:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14004e990
lea rdx, [rbp + 0x70]
cmp qword [rbp + 0x88], 0xf
cmova rdx, qword [rbp + 0x70]
mov r8, qword [rbp + 0x80]
mov rcx, rax
call fcn.14004fb20
lea rdx, [0x14004eb60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0xf
cmova rcx, qword [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x1400467a3
lea rdx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0xf
cmova rdx, qword [rbp + 0x90]
lea rcx, [rbp + 0x70]
cmp qword [rbp + 0x88], 0xf
cmova rcx, qword [rbp + 0x70]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x14004679a
lea rdx, str.DLL_successfully_replaced._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14004e990
lea rcx, [rbp + 0x70]
cmp qword [rbp + 0x88], 0xf
cmova rcx, qword [rbp + 0x70]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0xf
cmova rcx, qword [rbp + 0x90]
mov edx, 6
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x140046785
lea rdx, str.dll_is_now_hidden._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14004e990
mov dword [rbp + 0x100], 0x32009b
movdqa xmm0, xmmword [0x1400f8d30]
movdqu xmmword [rbp + 0x104], xmm0
movdqa xmm1, xmmword [0x1400f8d90]
movdqu xmmword [rbp + 0x114], xmm1
mov word [rbp + 0x124], 0xf5
lea rcx, [rbp + 0x100]
call fcn.14004bc80
xorps xmm0, xmm0
movups xmmword [rbp + 0x200], xmm0
mov qword [rbp + 0x210], rsi
mov qword [rbp + 0x218], rsi
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400459e0
mov rdx, rax
lea rcx, [rbp + 0x200]
call fcn.14004f120
nop
mov dword [rbp + 0xb0], 0x32009b
lea rcx, [rbp + 0xb0]
call fcn.14004d850
lea rcx, [rbp + 0xb0]
call fcn.14004bac0
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
mov qword [rbp + 0x110], rsi
mov qword [rbp + 0x118], rsi
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140045a40
mov rdx, rax
lea rcx, [rbp + 0x100]
call fcn.14004f120
nop
lea rdx, [rbp + 0x200]
lea rcx, [rbp + 0x168]
call fcn.14004d1e0
mov r9, rsi
mov r14, qword [rbp + 0x200]
mov r15, qword [rbp + 0x100]
mov r10, qword [rbp + 0x210]
test r10, r10
je 0x140045b05
cmp qword [rbp + 0x218], 0xf
seta r11b
cmp qword [rbp + 0x118], 0xf
seta bl
mov rdi, qword [rbp + 0x110]
nop dword [rax + rax]
lea r8, [rbp + 0x200]
test r11b, r11b
cmovne r8, r14
lea rcx, [rbp + 0x100]
test bl, bl
cmovne rcx, r15
xor edx, edx
mov rax, r9
div rdi
movzx ecx, byte [rdx + rcx]
xor cl, byte [r8 + r9]
lea rax, [rbp + 0x168]
cmp qword [rbp + 0x180], 0xf
cmova rax, qword [rbp + 0x168]
mov byte [rax + r9], cl
inc r9
cmp r9, r10
jb 0x140045ab0
lea rdi, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
lea rdx, [rsp + 0x60]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
mov ecx, reloc.WS2_32.dll_listen
call fcn.1400bcb18
mov rbx, rax
mov dword [rax], 0x7439336b
mov dword [rax + 4], 0x6e656b6f
mov dword [rax + 8], 0x7461642e
mov byte [rax + 0xc], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x128], xmm0
mov qword [rbp + 0x138], rsi
mov qword [rbp + 0x140], rsi
lea rax, [rsp + 0x60]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140045b60
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x128]
call fcn.14004f120
nop
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rbx + r8], 0
jne 0x140045b83
mov rdx, rbx
lea rcx, [rbp + 0x128]
call fcn.14004cfa0
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
mov qword [rbp + 0xf0], rsi
mov qword [rbp + 0xf8], rsi
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xe0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xf0], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rbp + 0x140]
cmp rdx, 0xf
jbe 0x140045c1c
inc rdx
mov rcx, qword [rbp + 0x128]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140045c17
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140045c17
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bc740
mov qword [rbp + 0x138], rsi
mov qword [rbp + 0x140], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x128], 0
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x220]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 0xf
cmova rdx, qword [rbp + 0xe0]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
lea rcx, [rbp + 0x220]
call fcn.14004db00
mov rax, qword [rbp + 0x220]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x220], rdi
mov rax, qword [rbp + 0x220]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x21c], edx
cmp qword [rbp + 0x2a8], 0
je 0x140046468
lea rdx, [rbp + 0x168]
cmp qword [rbp + 0x180], 0xf
cmova rdx, qword [rbp + 0x168]
mov r8, qword [rbp + 0x178]
lea rcx, [rbp + 0x220]
call fcn.14004fb20
lea rcx, [rbp + 0x228]
call fcn.14004da40
test rax, rax
jne 0x140045d08
mov rax, qword [rbp + 0x220]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x220]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
lea rdx, str._OK___1__Token_has_been_encrypted_and_saved_to
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14004e990
lea rdx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 0xf
cmova rdx, qword [rbp + 0xe0]
mov r8, qword [rbp + 0xf0]
mov rcx, rax
call fcn.14004fb20
lea rdx, [0x14004eb60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp + 0xb0], 0x32009b
movdqa xmm0, xmmword [0x1400f8d40]
movdqu xmmword [rbp + 0xb4], xmm0
movdqa xmm1, xmmword [0x1400f8d60]
movdqu xmmword [rbp + 0xc4], xmm1
mov dword [rbp + 0xd4], 0x88ccbeea
mov word [rbp + 0xd8], 0xda
lea rcx, [rbp + 0xb0]
call fcn.14004b870
xorps xmm0, xmm0
movups xmmword [rbp + 0x128], xmm0
mov qword [rbp + 0x138], rsi
mov qword [rbp + 0x140], rsi
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140045dc0
mov rdx, rax
lea rcx, [rbp + 0x128]
call fcn.14004f120
nop
mov ecx, reloc.WLDAP32.dll_Ordinal_27
call fcn.1400bcb18
mov dword [rax], 0x6838754a
mov dword [rax + 4], 0xe3d4ee4e
mov dword [rax + 8], 0x4b6e3832
mov dword [rax + 0xc], 0xe6d83031
mov dword [rax + 0x10], 0xc9a8f2d1
mov dword [rax + 0x14], 0x444d4e39
mov word [rax + 0x18], 0x5644
mov byte [rax + 0x1a], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0xc0], rsi
mov qword [rbp + 0xc8], rsi
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140045e36
mov rdx, rax
lea rcx, [rbp + 0xb0]
call fcn.14004f120
nop
lea rdx, [rbp + 0x128]
lea rcx, [rbp + 0x148]
call fcn.14004d1e0
mov r9, rsi
mov r12, qword [rbp + 0x140]
mov rsi, qword [rbp + 0x128]
mov r13, qword [rbp + 0xc8]
mov rdi, qword [rbp + 0xb0]
mov r10, qword [rbp + 0x138]
test r10, r10
je 0x140045ef4
cmp r12, 0xf
seta r11b
cmp r13, 0xf
seta bl
nop dword [rax]
lea r8, [rbp + 0x128]
test r11b, r11b
cmovne r8, rsi
lea rcx, [rbp + 0xb0]
test bl, bl
cmovne rcx, rdi
xor edx, edx
mov rax, r9
div qword [rbp + 0xc0]
add rdx, rcx
movzx ecx, byte [r8 + r9]
xor cl, byte [rdx]
lea rax, [rbp + 0x148]
cmp qword [rbp + 0x160], 0xf
cmova rax, qword [rbp + 0x148]
mov byte [rax + r9], cl
inc r9
cmp r9, r10
jb 0x140045ea0
mov rbx, qword [rbp + 0x158]
inc rbx
mov qword [rsp + 0x48], rbx
mov ecx, reloc.WS2_32.dll_send
call fcn.1400bcb18
mov dword [rax], 0x61636f4c
mov dword [rax + 4], 0x794d5c6c
mov dword [rax + 8], 0x7a6e6b54
mov dword [rax + 0xc], 0x6f6d654d
mov word [rax + 0x10], 0x7972
mov byte [rax + 0x12], 0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor edx, edx
lea rcx, [rdx - 1]
lea r8d, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
jne 0x140045f96
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdx, str.Cannot_create_file_mapping._Error:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14004e990
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x14004eb60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140046023
lea rdx, str.Shared_memory_was_created_successfully.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14004e990
lea rdx, [0x14004eb60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf001f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
jne 0x140046197
lea rdx, str.Could_not_map_view_of_file:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14004e990
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x14004eb60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp + 0x160]
cmp rdx, 0xf
jbe 0x140046064
inc rdx
mov rcx, qword [rbp + 0x148]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004605f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140046233
call fcn.1400bc740
mov qword [rbp + 0x158], 0
mov qword [rbp + 0x160], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x148], 0
cmp r13, 0xf
jbe 0x1400460b9
lea rdx, [r13 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400460b0
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140046287
mov rcx, rdi
call fcn.1400bc740
nop
cmp r12, 0xf
jbe 0x1400460f1
lea rdx, [r12 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400460e9
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400462c3
mov rcx, rsi
call fcn.1400bc740
lea rdi, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
xor esi, esi
mov rax, qword [rbp + 0x220]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x220], rdi
mov rax, qword [rbp + 0x220]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x21c], edx
lea rcx, [rbp + 0x228]
call fcn.14004c9f0
lea rcx, [rbp + 0x230]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x2c8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0xf
jbe 0x140046495
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140046490
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140046490
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rdx, [rbp + 0x148]
cmp qword [rbp + 0x160], 0xf
cmova rdx, qword [rbp + 0x148]
mov r8, qword [rsp + 0x48]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rdx, str._OK___2__Encrypted_data_written_to_shared_memory.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14004e990
lea rdx, [0x14004eb60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r9d, 0x40
lea r8, str.Waiting_for_the_game...
lea rdx, str.Please_start_the_game._And_after_a_successful_injection__close_the_Loader_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
nop
mov rdx, qword [rbp + 0x160]
cmp rdx, 0xf
jbe 0x14004623f
inc rdx
mov rcx, qword [rbp + 0x148]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004623a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004623a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bc740
mov qword [rbp + 0x158], 0
mov qword [rbp + 0x160], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x148], 0
cmp r13, 0xf
jbe 0x140046297
lea rdx, [r13 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14004628e
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004628e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.1400bc740
nop
cmp r12, 0xf
jbe 0x1400462d3
lea rdx, [r12 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400462ca
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400462ca
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.1400bc740
nop
mov rax, qword [rbp + 0x220]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x220], rax
mov rax, qword [rbp + 0x220]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x21c], edx
lea rcx, [rbp + 0x228]
call fcn.14004c9f0
lea rcx, [rbp + 0x230]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x2c8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0xf
jbe 0x14004636d
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140046368
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140046190
call fcn.1400bc740
xor esi, esi
mov qword [rbp + 0xf0], rsi
mov qword [rbp + reloc.WS2_32.dll_ntohs8], 0xf
mov byte [rbp + 0xe0], sil
mov rdx, qword [rbp + 0x180]
cmp rdx, 0xf
jbe 0x1400463c9
inc rdx
mov rcx, qword [rbp + 0x168]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400463c4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400464e6
call fcn.1400bc740
mov qword [rbp + 0x178], rsi
mov qword [rbp + 0x180], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x168], 0
mov rax, qword [rbp + 0x118]
cmp rax, 0xf
jbe 0x140046421
lea rdx, [rax + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x140046418
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004653d
mov rcx, r15
call fcn.1400bc740
nop
mov rax, qword [rbp + 0x218]
cmp rax, 0xf
jbe 0x140046805
lea rdx, [rax + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x14004645b
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004657f
mov rcx, r14
call fcn.1400bc740
jmp 0x140046805
lea rdx, str.Failed_to_open_the_file_for_writing.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14004e990
lea rdx, [0x14004eb60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400460fa
call fcn.1400bc740
mov qword [rbp + 0xf0], rsi
mov qword [rbp + reloc.WS2_32.dll_ntohs8], 0xf
mov byte [rbp + 0xe0], 0
mov rdx, qword [rbp + 0x180]
cmp rdx, 0xf
jbe 0x1400464f2
inc rdx
mov rcx, qword [rbp + 0x168]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400464ed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400464ed
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bc740
mov qword [rbp + 0x178], rsi
mov qword [rbp + 0x180], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x168], 0
mov rax, qword [rbp + 0x118]
cmp rax, 0xf
jbe 0x14004654d
lea rdx, [rax + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x140046544
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140046544
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r15
call fcn.1400bc740
nop
mov rax, qword [rbp + 0x218]
cmp rax, 0xf
jbe 0x14004658f
lea rdx, [rax + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x140046586
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140046586
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.1400bc740
nop
mov rdx, qword [rbp + 0x88]
cmp rdx, 0xf
jbe 0x1400465d0
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400465cb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400465cb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bc740
mov qword [rbp + 0x80], rsi
mov qword [rbp + 0x88], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x70], 0
mov rcx, qword [rbp + 0x1a8]
test rcx, rcx
je 0x14004663b
mov rdx, qword [rbp + 0x1b8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140046624
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140046624
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bc740
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x1a8], xmm0
mov qword [rbp + 0x1b8], rsi
mov rdx, qword [rbp + 0xa8]
cmp rdx, 0xf
jbe 0x14004667f
inc rdx
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004667a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004667a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bc740
mov qword [rbp + 0xa0], rsi
mov qword [rbp + 0xa8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x90], 0
mov rdx, qword [rbp + 0x1a0]
cmp rdx, 0xf
jbe 0x1400466dc
inc rdx
mov rcx, qword [rbp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400466d7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400466d7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bc740
mov qword [rbp + 0x198], rsi
mov qword [rbp + 0x1a0], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x188], 0
mov rdx, qword [rbp + 0x1d8]
cmp rdx, 0xf
jbe 0x14004673a
inc rdx
mov rcx, qword [rbp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140046734
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140046734
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bc740
nop
mov rdx, qword [rbp + 0x1f8]
cmp rdx, 0xf
jbe 0x1400469f1
inc rdx
mov rcx, qword [rbp + 0x1e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400469ec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400469ec
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rdx, str.failed_to_hide_dll._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14004e990
jmp 0x140046805
lea rdx, str.CopyFileA_failed_with_error
jmp 0x1400467aa
lea rdx, str.DeleteFileA_failed_with_error
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14004e990
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x14004eb60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Failed_to_replace_DLL._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14004e990
lea rcx, [rbp + 0x70]
cmp qword [rbp + 0x88], 0xf
cmova rcx, qword [rbp + 0x70]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
nop
mov rdx, qword [rbp + 0x88]
cmp rdx, 0xf
jbe 0x140046846
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140046841
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140046841
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bc740
mov qword [rbp + 0x80], rsi
mov qword [rbp + 0x88], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x70], 0
mov rcx, qword [rbp + 0x1a8]
test rcx, rcx
je 0x1400468b1
mov rdx, qword [rbp + 0x1b8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004689a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004689a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bc740
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x1a8], xmm0
mov qword [rbp + 0x1b8], rsi
mov rdx, qword [rbp + 0xa8]
cmp rdx, 0xf
jbe 0x1400468f5
inc rdx
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400468f0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400468f0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bc740
mov qword [rbp + 0xa0], rsi
mov qword [rbp + 0xa8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x90], 0
mov rdx, qword [rbp + 0x1a0]
cmp rdx, 0xf
jbe 0x140046968
inc rdx
mov rcx, qword [rbp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004694d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004694d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bc740
jmp 0x140046968
lea rdx, str.Process_is_not_running._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14004e990
nop
mov rdx, qword [rbp + 0x1d8]
cmp rdx, 0xf
jbe 0x1400469ad
inc rdx
mov rcx, qword [rbp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400469a7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400469a7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bc740
nop
mov rdx, qword [rbp + 0x1f8]
cmp rdx, 0xf
jbe 0x1400469f1
inc rdx
mov rcx, qword [rbp + 0x1e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400469ec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400469ec
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bc740
mov rcx, qword [rbp + 0x350]
xor rcx, rsp
call fcn.1400bc650
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400438b0
nop
call fcn.1400438b0
int3