Function at 0x140061df0
Capabilities:
Access peb ldr_data
Create process on windows
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x4c0]
sub rsp, 0x5c0
mov rax, qword [0x14031f5d0]
xor rax, rsp
mov qword [rbp + 0x4b0], rax
xor r12d, r12d
lea rcx, [rbp + 0x490]
call fcn.140061170
nop
mov rdx, rax
lea rcx, [rbp - 0x68]
call fcn.140060910
mov rdx, rax
lea rcx, [0x1403295a8]
call fcn.1400693a0
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x140061e8f
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061e8a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400631d6
call fcn.140213990
movdqa xmm0, xmmword [0x1402f77e0]
movdqu xmmword [rbp - 0x58], xmm0
mov byte [rbp - 0x68], 0
mov rdx, qword [rbp + 0x4a8]
cmp rdx, 0x10
jb 0x140061ee1
inc rdx
mov rcx, qword [rbp + 0x490]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061edc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400631dc
call fcn.140213990
cmp qword [0x1403294d0], 0xa
jne 0x140061ef9
cmp qword [0x1403294f0], 0x40
je 0x1400620c6
movdqa xmm0, xmmword [0x1402f78b0]
movdqa xmmword [rbp], xmm0
movdqa xmm1, xmmword [0x1402f7890]
movdqa xmmword [rbp + 0x10], xmm1
movdqa xmm0, xmmword [0x1402f78f0]
movdqa xmmword [rbp + 0x20], xmm0
movdqa xmm1, xmmword [0x1402f7900]
movdqa xmmword [rbp + 0x30], xmm1
mov dword [rbp + 0x40], 0xf5fad7b9
mov dword [rbp + 0x44], 0xd0fcb0f3
mov word [rbp + 0x48], Ordinal_211
mov byte [rbp + 0x4a], 1
mov rcx, r12
nop dword [rax + rax]
lea eax, [rcx + 0x59]
xor byte [rbp + rcx], al
inc rcx
cmp rcx, 0x49
jb 0x140061f50
mov byte [rbp + 0x4a], 0
lea rdx, [rbp]
call fcn.14006b160
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140061ff6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140061ff6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x6e42dc0d
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140061ff1
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140061fd0
cmp r8d, 0xf51105b0
je 0x140061ffb
test r9d, r9d
jne 0x140061fb0
mov rax, qword [rax]
jmp 0x140061f80
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov ecx, 0x1194
call rdx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400620a6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400620a6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0xed36d807
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400620a1
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140062080
cmp r8d, 0xc4642747
je 0x1400620ab
test r9d, r9d
jne 0x140062060
mov rax, qword [rax]
jmp 0x140062030
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
xor ecx, ecx
call rdx
mov dword [rsp + 0x70], 0x3535337f
mov dword [rsp + 0x74], 0x16360129
mov word [rsp + 0x78], 0x5c
mov byte [rsp + 0x7a], 1
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx + 0x59]
xor byte [rsp + rcx + 0x70], al
inc rcx
cmp rcx, 9
jb 0x1400620f0
mov byte [rsp + 0x7a], 0
lea rdx, [0x1403294c0]
lea rcx, [rbp + 0x110]
call fcn.140060d40
mov r15, rax
mov dword [rsp + 0x60], 0x322c357f
mov dword [rsp + 0x64], 0x4362c38
mov word [rsp + 0x68], 0x5c
mov byte [rsp + 0x6a], 1
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx + 0x59]
xor byte [rsp + rcx + 0x60], al
inc rcx
cmp rcx, 9
jb 0x140062140
mov byte [rsp + 0x6a], 0
lea rdx, [0x1403294a0]
lea rcx, [rbp + 0xf0]
call fcn.140060d40
mov r14, rax
mov dword [rsp + 0x48], 0x313a347f
mov dword [rsp + 0x4c], 0x1006338
mov rcx, r12
nop
lea eax, [rcx + 0x59]
xor byte [rsp + rcx + 0x48], al
inc rcx
cmp rcx, 6
jb 0x140062180
mov byte [rsp + 0x4f], 0
lea rax, [rbp + 0x268]
mov qword [rbp - 0x78], rax
lea rdx, [0x140329460]
lea rcx, [rbp + 0x268]
call fcn.140069470
mov rdi, rax
lea rax, [rbp + 0x288]
mov qword [rbp - 0x70], rax
lea rdx, [0x1403294e0]
lea rcx, [rbp + 0x288]
call fcn.140069470
mov rbx, rax
lea rdx, [0x1403295a8]
lea rcx, [rbp + 0x2a8]
call fcn.140069470
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x1f0]
call fcn.1400612f0
mov rsi, rax
mov dword [rsp + 0x50], 0x3f353f7f
mov dword [rsp + 0x54], 0x5d263b36
mov word [rsp + 0x58], 0x100
mov rcx, r12
nop dword [rax]
lea eax, [rcx + 0x59]
xor byte [rsp + rcx + 0x50], al
inc rcx
cmp rcx, 8
jb 0x140062220
mov byte [rsp + 0x59], 0
lea rax, [rbp + 0x2c8]
mov qword [rbp - 0x80], rax
lea rdx, [0x140329460]
lea rcx, [rbp + 0x2c8]
call fcn.140069470
mov rdi, rax
lea rax, [rbp + 0x368]
mov qword [rbp - 0x70], rax
lea rdx, [0x1403294e0]
lea rcx, [rbp + 0x368]
call fcn.140069470
mov rbx, rax
lea rdx, [0x140329500]
lea rcx, [rbp + 0x2e8]
call fcn.140069470
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x1d0]
call fcn.1400612f0
mov rdi, rax
mov dword [rsp + 0x40], 0x2e3e2c7f
mov word [rsp + 0x44], 0x60
mov byte [rsp + 0x46], 1
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx + 0x59]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 5
jb 0x1400622c0
mov byte [rsp + 0x46], 0
mov dword [rsp + 0x30], 0x28323430
mov word [rsp + 0x34], 0x100
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx + 0x59]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 4
jb 0x1400622f0
mov byte [rsp + 0x35], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x80], xmm1
lea rax, [rsp + 0x30]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x140062326
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x70]
call fcn.14006bd20
nop
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x1b0]
call fcn.140060d40
mov r10, rax
mov dword [rsp + 0x38], 0x392b232d
mov word [rsp + 0x3c], 0x60
mov byte [rsp + 0x3e], 1
mov rcx, r12
nop dword [rax]
lea eax, [rcx + 0x59]
xor byte [rsp + rcx + 0x38], al
inc rcx
cmp rcx, 5
jb 0x140062370
mov byte [rsp + 0x3e], 0
lea rax, [rsp + 0x38]
mov r9, rbx
nop dword [rax]
inc r9
cmp byte [rax + r9], 0
jne 0x140062390
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, r10
call fcn.14006d100
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x18], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x28], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x18], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rax, [rsp + 0x40]
mov r8, rbx
nop
inc r8
cmp byte [rax + r8], 0
jne 0x1400623e0
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x28]
call fcn.1400692b0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x190], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1a0], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, rdi
lea r8, [rbp + 0x190]
lea rcx, [rbp - 0x68]
call fcn.14006d200
nop
lea rax, [rsp + 0x50]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140062440
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x68]
call fcn.1400692b0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x170], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x180], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, rsi
lea r8, [rbp + 0x170]
lea rcx, [rbp + 0x90]
call fcn.14006d200
nop
lea rax, [rsp + 0x48]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400624a0
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x90]
call fcn.1400692b0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x150], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x160], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, r14
lea r8, [rbp + 0x150]
lea rcx, [rbp + 0xd0]
call fcn.14006d200
nop
lea rax, [rsp + 0x60]
mov r8, rbx
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140062500
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0xd0]
call fcn.1400692b0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x130], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x140], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, r15
lea r8, [rbp + 0x130]
lea rcx, [rbp + 0xb0]
call fcn.14006d200
nop
lea rax, [rsp + 0x70]
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140062560
mov r8, rbx
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0xb0]
call fcn.1400692b0
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x38], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x38], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rdx, [0x140329460]
cmp qword [0x140329478], 0x10
cmovae rdx, qword [0x140329460]
mov r8, qword [0x140329470]
lea rcx, [rbp - 0x48]
call fcn.1400692b0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x490], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x4a0], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x140062630
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006262b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400631e2
call fcn.140213990
movdqa xmm0, xmmword [0x1402f77e0]
movdqu xmmword [rbp - 0x38], xmm0
mov byte [rbp - 0x48], 0
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0x10
jb 0x140062682
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006267d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400631e8
call fcn.140213990
movdqa xmm0, xmmword [0x1402f77e0]
movdqu xmmword [rbp + 0xc0], xmm0
mov byte [rbp + 0xb0], 0
mov rdx, qword [rbp + 0x148]
cmp rdx, 0x10
jb 0x1400626db
inc rdx
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400626d5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400631ee
call fcn.140213990
nop
mov rdx, qword [rbp + 0xe8]
cmp rdx, 0x10
jb 0x14006271c
inc rdx
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062717
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400631f4
call fcn.140213990
movdqa xmm0, xmmword [0x1402f77e0]
movdqu xmmword [rbp + 0xe0], xmm0
mov byte [rbp + 0xd0], 0
mov rdx, qword [rbp + 0x168]
cmp rdx, 0x10
jb 0x140062775
inc rdx
mov rcx, qword [rbp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006276f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400631fa
call fcn.140213990
nop
mov rdx, qword [rbp + 0xa8]
cmp rdx, 0x10
jb 0x1400627b6
inc rdx
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400627b1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140063200
call fcn.140213990
movdqa xmm0, xmmword [0x1402f77e0]
movdqu xmmword [rbp + 0xa0], xmm0
mov byte [rbp + 0x90], 0
mov rdx, qword [rbp + 0x188]
cmp rdx, 0x10
jb 0x14006280f
inc rdx
mov rcx, qword [rbp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062809
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140063206
call fcn.140213990
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x14006284a
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062845
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006320c
call fcn.140213990
movdqa xmm0, xmmword [0x1402f77e0]
movdqu xmmword [rbp - 0x58], xmm0
mov byte [rbp - 0x68], 0
mov rdx, qword [rbp + 0x1a8]
cmp rdx, 0x10
jb 0x14006289d
inc rdx
mov rcx, qword [rbp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062897
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140063212
call fcn.140213990
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x1400628d8
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400628d3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140063218
call fcn.140213990
movdqa xmm0, xmmword [0x1402f77e0]
movdqu xmmword [rbp - 0x18], xmm0
mov byte [rbp - 0x28], 0
mov rdx, qword [rbp + 0x1c8]
cmp rdx, 0x10
jb 0x14006292a
inc rdx
mov rcx, qword [rbp + 0x1b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062925
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006321e
call fcn.140213990
movdqa xmm0, xmmword [0x1402f77e0]
movdqu xmmword [rbp + 0x1c0], xmm0
mov byte [rbp + 0x1b0], 0
mov rdx, qword [rbp + 0x88]
cmp rdx, 0x10
jb 0x14006297f
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006297a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140063224
call fcn.140213990
movdqa xmm0, xmmword [0x1402f77e0]
movdqu xmmword [rbp + 0x80], xmm0
mov byte [rbp + 0x70], 0
mov rdx, qword [rbp + 0x1e8]
cmp rdx, 0x10
jb 0x1400629d4
inc rdx
mov rcx, qword [rbp + 0x1d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400629cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006322a
call fcn.140213990
movdqa xmm0, xmmword [0x1402f77e0]
movdqu xmmword [rbp + 0x1e0], xmm0
mov byte [rbp + 0x1d0], 0
mov rdx, qword [rbp + 0x208]
cmp rdx, 0x10
jb 0x140062a2c
inc rdx
mov rcx, qword [rbp + 0x1f0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062a27
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140063230
call fcn.140213990
movdqa xmm0, xmmword [0x1402f77e0]
movdqu xmmword [rbp + 0x200], xmm0
mov byte [rbp + 0x1f0], 0
mov rdx, qword [rbp + 0x108]
cmp rdx, 0x10
jb 0x140062a84
inc rdx
mov rcx, qword [rbp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062a7f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140063236
call fcn.140213990
movdqa xmm0, xmmword [0x1402f77e0]
movdqu xmmword [rbp + 0x100], xmm0
mov byte [rbp + 0xf0], 0
mov rdx, qword [rbp + 0x128]
cmp rdx, 0x10
jb 0x140062adc
inc rdx
mov rcx, qword [rbp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062ad7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006323c
call fcn.140213990
movdqa xmm0, xmmword [0x1402f77e0]
movdqu xmmword [rbp + 0x120], xmm0
mov byte [rbp + 0x110], 0
lea rdx, [rbp + 0x490]
lea rcx, [rbp + 0x308]
call fcn.140069470
mov rdx, rax
lea rcx, [rbp + 0x470]
call fcn.140065350
nop
lea rax, [rbp + 0x328]
mov qword [rbp - 0x80], rax
lea rdx, [0x140329460]
lea rcx, [rbp + 0x328]
call fcn.140069470
mov rdi, rax
lea rax, [rbp + 0x348]
mov qword [rbp - 0x70], rax
lea rdx, [0x1403294e0]
lea rcx, [rbp + 0x348]
call fcn.140069470
mov rbx, rax
lea rdx, [rbp + 0x470]
lea rcx, [rbp + 0x388]
call fcn.140069470
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x210]
call fcn.140061600
mov rbx, rax
lea rax, [rbp + 0x470]
cmp rax, rbx
je 0x140062c0c
mov rdx, qword [rbp + 0x488]
cmp rdx, 0x10
jb 0x140062bd1
inc rdx
mov rcx, qword [rbp + 0x470]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062bcc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140063242
call fcn.140213990
movdqa xmm0, xmmword [0x1402f77e0]
movdqu xmmword [rbp + 0x480], xmm0
mov byte [rbp + 0x470], 0
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x470], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x480], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rbp + 0x228]
cmp rdx, 0x10
jb 0x140062c4d
inc rdx
mov rcx, qword [rbp + 0x210]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062c48
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140063242
call fcn.140213990
mov qword [rbp + 0x3e0], r12
lea r8, [rbp + 0x3a8]
lea rdx, [rbp + 0x470]
lea rcx, [rbp + 0x460]
call fcn.14006b440
nop
lea rdx, str.success
lea rcx, [rbp + 0x460]
call fcn.14006b560
cmp byte [rax], 4
jne 0x140063248
lea rcx, [rbp + 0x460]
cmp byte [rax + 8], 0
je 0x140062d13
lea rdx, str.sessionid
call fcn.14006b560
cmp byte [rax], 3
jne 0x14006329c
mov rdi, qword [rax + 8]
mov r9, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x140062cbe
mov r9, qword [rdi]
mov rdi, qword [rdi + 0x10]
mov rax, qword [0x1403295a0]
cmp rdi, rax
ja 0x140062cff
lea rbx, [0x140329588]
cmp rax, 0x10
cmovae rbx, qword [0x140329588]
mov qword [0x140329598], rdi
mov r8, rdi
mov rdx, r9
mov rcx, rbx
call fcn.140215c80
mov byte [rdi + rbx], 0
jmp 0x1400630f7
mov rdx, rdi
lea rcx, [0x140329588]
call fcn.14006c150
jmp 0x1400630f7
lea rdx, str.message
call fcn.14006b560
mov rdi, rax
mov byte [rbp + 0x50], 3
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.140213c10
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], r12
mov r8d, 0xa
lea rdx, str.invalidver
mov rcx, rax
call fcn.14006bd20
mov qword [rbp + 0x58], rbx
lea rdx, [rbp + 0x50]
mov rcx, rdi
call fcn.14006cc90
movzx ebx, al
movzx edx, byte [rbp + 0x50]
lea rcx, [rbp + 0x58]
call fcn.14006a000
nop
test bl, bl
je 0x140062ed1
lea rdx, str.download
lea rcx, [rbp + 0x460]
call fcn.14006b560
lea rdx, [rbp + 0x440]
mov rcx, rax
call fcn.14006b6a0
nop
lea r8, [rbp + 0x440]
cmp qword [rbp + 0x458], 0x10
cmovae r8, qword [rbp + 0x440]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140062e66
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140062e66
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0xce72b5b3
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140062e61
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140062e40
cmp r8d, 0x8144b9e3
je 0x140062e6b
test r9d, r9d
jne 0x140062e20
mov rax, qword [rax]
jmp 0x140062df0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
xor ecx, ecx
call rdx
nop
mov rdx, qword [rbp + 0x458]
cmp rdx, 0x10
jb 0x1400630f7
inc rdx
mov rcx, qword [rbp + 0x440]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062ec7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400632f0
call fcn.140213990
jmp 0x1400630f7
lea rdx, [0x1402f5b54]
call fcn.14006b160
lea rdx, str.message
lea rcx, [rbp + 0x460]
call fcn.14006b560
xorps xmm0, xmm0
movups xmmword [rbp + 0x440], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x450], xmm1
cmp byte [rax], 3
jne 0x1400632f6
mov r8, qword [rax + 8]
mov rdx, r8
cmp qword [r8 + 0x18], 0x10
jb 0x140062f1f
mov rdx, qword [r8]
mov r8, qword [r8 + 0x10]
lea rcx, [rbp + 0x440]
call fcn.14006bd20
nop
lea rdx, [rbp + 0x440]
cmp qword [rbp + 0x458], 0x10
cmovae rdx, qword [rbp + 0x440]
mov r8, qword [rbp + 0x450]
call fcn.140071040
nop
mov rdx, qword [rbp + 0x458]
cmp rdx, 0x10
jb 0x140062f95
inc rdx
mov rcx, qword [rbp + 0x440]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062f90
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006334d
call fcn.140213990
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140063026
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140063026
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x70fe15bd
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140063021
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140063000
cmp r8d, 0xd91653c0
je 0x14006302b
test r9d, r9d
jne 0x140062fe0
mov rax, qword [rax]
jmp 0x140062fb0
mov edx, dword [rdi + 0x1c]
add rdx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rdx + rax*4]
add rdx, r10
mov ecx, 0x1194
call rdx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400630d6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400630d6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov ecx, dword [rcx + rbx]
add rcx, r10
mov r8d, 0x68004629
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1400630d1
nop dword [rax]
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x1400630b0
cmp r8d, 0x92a04209
je 0x1400630db
test r9d, r9d
jne 0x140063090
mov rax, qword [rax]
jmp 0x140063060
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
xor ecx, ecx
call rdx
nop
movzx edx, byte [rbp + 0x460]
lea rcx, [rbp + 0x468]
call fcn.14006a000
nop
mov rdx, qword [rbp + 0x488]
cmp rdx, 0x10
jb 0x14006314c
inc rdx
mov rcx, qword [rbp + 0x470]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140063147
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140063353
call fcn.140213990
movdqa xmm0, xmmword [0x1402f77e0]
movdqu xmmword [rbp + 0x480], xmm0
mov byte [rbp + 0x470], 0
mov rdx, qword [rbp + 0x4a8]
cmp rdx, 0x10
jb 0x1400631a0
inc rdx
mov rcx, qword [rbp + 0x490]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006319b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400631d0
call fcn.140213990
mov rcx, qword [rbp + 0x4b0]
xor rcx, rsp
call fcn.140213970
lea r11, [rsp + 0x5c0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.140227e64
nop
call fcn.140227e64
nop
call fcn.140227e64
nop
call fcn.140227e64
nop
call fcn.140227e64
nop
call fcn.140227e64
nop
call fcn.140227e64
nop
call fcn.140227e64
nop
call fcn.140227e64
nop
call fcn.140227e64
nop
call fcn.140227e64
nop
call fcn.140227e64
nop
call fcn.140227e64
nop
call fcn.140227e64
nop
call fcn.140227e64
nop
call fcn.140227e64
nop
call fcn.140227e64
nop
call fcn.140227e64
nop
call fcn.140227e64
nop
call fcn.140227e64
nop
mov rcx, rax
call fcn.14006a4f0
mov rdx, rax
lea rcx, [rbp + 0x440]
call fcn.140069430
nop
mov r8, rax
lea rdx, str.type_must_be_boolean__but_is
lea rcx, [rbp + 0x50]
call fcn.14006af20
nop
mov r8, rax
mov edx, 0x12e
lea rcx, [rbp + 0x230]
call fcn.14005fa30
lea rdx, [0x140318808]
lea rcx, [rbp + 0x230]
call fcn.140215bb0
nop
mov rcx, rax
call fcn.14006a4f0
mov rdx, rax
lea rcx, [rbp + 0x440]
call fcn.140069430
nop
mov r8, rax
lea rdx, str.type_must_be_string__but_is
lea rcx, [rbp + 0x50]
call fcn.14006af20
nop
mov r8, rax
mov edx, 0x12e
lea rcx, [rbp + 0x230]
call fcn.14005fa30
lea rdx, [0x140318808]
lea rcx, [rbp + 0x230]
call fcn.140215bb0
nop
call fcn.140227e64
int3
mov rcx, rax
call fcn.14006a4f0
mov rdx, rax
lea rcx, [rbp + 0x420]
call fcn.140069430
nop
mov r8, rax
lea rdx, str.type_must_be_string__but_is
lea rcx, [rbp + 0x230]
call fcn.14006af20
nop
mov r8, rax
mov edx, 0x12e
lea rcx, [rbp + 0x3e8]
call fcn.14005fa30
lea rdx, [0x140318808]
lea rcx, [rbp + 0x3e8]
call fcn.140215bb0
nop
call fcn.140227e64
nop
call fcn.140227e64
int3