Function at 0x140010680
Capabilities:
Delete file
Get disk information
Hide graphical window

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x980
lea rbp, [rsp + 0x50]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x140201788]
xor rax, rsp
mov qword [rbp + 0x920], rax
xor esi, esi
mov dword [rbp], esi
xor edx, edx
lea rcx, str.ConsoleWindowClass
call qword [sym.imp.USER32.dll_FindWindowA]
mov r15, rax
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
call fcn.14000c790
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp + 0x120]
call fcn.140061600
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp + 0x520]
call fcn.140061600
mov r8d, 0x400
lea rdx, [rbp + 0x120]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov r8d, 0x400
lea rdx, [rbp + 0x520]
lea rcx, [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_GetVolumePathNameA]
lea rcx, [rbp + 0x520]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
movabs rdi, 0x4873bb20b4c5481
movabs rbx, 0x2bcefbcf560ccdaa
movabs r12, 0x88bc2ded88c44b88
movabs r13, 0x164fdf30a5a7d0c7
movabs r14, 0xf1edf30b9f97618e
movabs rcx, 0x49ced4bce3b2e55b
movabs rdx, 0x239e9a89dec1befc
movabs r8, 0x4ef375ceb9044f65
cmp eax, 2
je 0x1400108c5
movabs rax, 0x164fdf42cad5a282
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], r12
mov qword [rbp + 0x20], r13
mov qword [rbp + 0x28], r12
movdqa xmm0, xmmword [rbp + 0x10]
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp + 0x10], xmm0
movabs rax, 0x7b20bc55f787b590
mov qword [rbp + 0xc0], rax
movabs rax, 0xfdd374cdecaa2ee5
mov qword [rbp + 0xc8], rax
movabs rax, 0x61ef6f926e3f01a1
mov qword [rbp + 0xd0], rax
movabs rax, 0x5fabb6ef347f988a
mov qword [rbp + 0xd8], rax
movabs rax, 0x6eebaf5c3d68a33
mov qword [rbp + 0xe0], rax
movabs rax, 0x46e8e8ec8de1cc89
mov qword [rbp + 0xe8], rax
movabs rax, 0x4ef375ceb9044f17
mov qword [rbp + 0xf0], rax
mov qword [rbp + 0xf8], r14
mov qword [rbp + 0x40], r13
mov qword [rbp + 0x48], r12
mov qword [rbp + 0x50], rdi
mov qword [rbp + 0x58], rbx
mov qword [rbp + 0x60], rcx
mov qword [rbp + 0x68], rdx
mov qword [rbp + 0x70], r8
mov qword [rbp + 0x78], r14
vmovdqu ymm0, ymmword [rbp + 0xc0]
vpxor ymm1, ymm0, ymmword [rbp + 0x40]
vmovdqa ymmword [rbp + 0xc0], ymm1
vmovdqu ymm0, ymmword [rbp + 0xe0]
vpxor ymm1, ymm0, ymmword [rbp + 0x60]
vmovdqa ymmword [rbp + 0xe0], ymm1
lea r9d, [rsi + 0x10]
lea r8, [rbp + 0x10]
lea rdx, [rbp + 0xc0]
xor ecx, ecx
vzeroupper
call qword [sym.imp.USER32.dll_MessageBoxA]
movabs rcx, 0x49ced4bce3b2e55b
movabs rdx, 0x239e9a89dec1befc
movabs r8, 0x4ef375ceb9044f65
movabs rax, 0x792bb159f2fbea84
mov qword [rbp + 0x40], rax
movabs rax, 0xedc85e94db9838ff
mov qword [rbp + 0x48], rax
movabs rax, 0x62e954d1577e67ec
mov qword [rbp + 0x50], rax
movabs rax, 0x4a8c9caa0450aac3
mov qword [rbp + 0x58], rax
movabs rax, 0xd8ded8a98ee8e38
mov qword [rbp + 0x60], rax
movabs rax, 0x15d8dea49af3f8cd
mov qword [rbp + 0x68], rax
movabs rax, 0x77de46fcfc30625d
mov qword [rbp + 0x70], rax
movabs rax, 0xc1dab13ab2af51bf
mov qword [rbp + 0x78], rax
movabs rax, 0x3224689af4684e58
mov qword [rbp + 0x80], rax
movabs rax, 0x7415476533d080ed
mov qword [rbp + 0x88], rax
mov qword [rbp + 0xc0], r13
mov qword [rbp + 0xc8], r12
mov qword [rbp + 0xd0], rdi
mov qword [rbp + 0xd8], rbx
mov qword [rbp + 0xe0], rcx
mov qword [rbp + 0xe8], rdx
mov qword [rbp + 0xf0], r8
mov qword [rbp + 0xf8], r14
movabs rax, 0xb1150a8b25b766f
mov qword [rbp + 0x100], rax
movabs rax, 0x7415476533d08090
mov qword [rbp + 0x108], rax
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0xc0]
vmovdqa ymmword [rbp + 0x40], ymm1
vmovdqu ymm0, ymmword [rbp + 0x60]
vpxor ymm1, ymm0, ymmword [rbp + 0xe0]
vmovdqa ymmword [rbp + 0x60], ymm1
vmovdqa xmm0, xmmword [rbp + 0x80]
vxorps xmm0, xmm0, xmmword [rbp + 0x100]
vmovdqa xmmword [rbp + 0x80], xmm0
lea rax, [rbp + 0x20]
mov qword [rbp + 0x10], rax
lea rax, [rbp + 0x40]
mov rdi, 0xffffffffffffffff
mov rbx, rdi
vzeroupper
inc rbx
cmp byte [rax + rbx], sil
jne 0x140010a06
call fcn.1400128d0
mov r14d, eax
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], rsi
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], si
mov dword [rbp], 4
test rbx, rbx
je 0x140010aac
cmp rbx, 0x7fffffff
ja 0x14001167d
mov dword [rsp + 0x20], esi
xor r9d, r9d
mov r8d, ebx
lea rdx, [rbp + 0x40]
mov ecx, eax
call fcn.1400128f8
mov rsi, rax
shr rax, 0x20
test eax, eax
jne 0x140011688
xor r8d, r8d
movsxd rdx, esi
lea rcx, [rbp + 0x20]
call fcn.14000f3a0
lea r9, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae r9, qword [rbp + 0x20]
mov dword [rsp + 0x20], esi
mov r8d, ebx
lea rdx, [rbp + 0x40]
mov ecx, r14d
call fcn.1400128f8
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x140011694
xor esi, esi
lea rcx, [rbp + 0x20]
call fcn.14000f0b0
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 8
jb 0x140010af6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010af1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001169e
call fcn.14001360c
movabs rax, 0x792bb159f2fbea84
mov qword [rbp + 0x40], rax
movabs rax, 0xedc85e94db9838ff
mov qword [rbp + 0x48], rax
movabs rax, 0x62e954d1577e67ec
mov qword [rbp + 0x50], rax
movabs rax, 0x4a8c9caa0450aac3
mov qword [rbp + 0x58], rax
movabs rax, 0xd8ded8a98ee8e38
mov qword [rbp + 0x60], rax
movabs rax, 0x15d8dea49af3f8cd
mov qword [rbp + 0x68], rax
movabs rax, 0x77de46fcfc30625d
mov qword [rbp + 0x70], rax
movabs rax, 0xc1dab13ab2af51bf
mov qword [rbp + 0x78], rax
movabs rax, 0x3227689af4684e58
mov qword [rbp + 0x80], rax
movabs rax, 0x7415476533d080ed
mov qword [rbp + 0x88], rax
mov qword [rbp + 0xc0], r13
mov qword [rbp + 0xc8], r12
movabs rax, 0x4873bb20b4c5481
mov qword [rbp + 0xd0], rax
movabs rax, 0x2bcefbcf560ccdaa
mov qword [rbp + 0xd8], rax
movabs rax, 0x49ced4bce3b2e55b
mov qword [rbp + 0xe0], rax
movabs rax, 0x239e9a89dec1befc
mov qword [rbp + 0xe8], rax
movabs rax, 0x4ef375ceb9044f65
mov qword [rbp + 0xf0], rax
movabs rax, 0xf1edf30b9f97618e
mov qword [rbp + 0xf8], rax
movabs rax, 0xb1150a8b25b766f
mov qword [rbp + 0x100], rax
movabs rax, 0x7415476533d08090
mov qword [rbp + 0x108], rax
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0xc0]
vmovdqa ymmword [rbp + 0x40], ymm1
vmovdqu ymm0, ymmword [rbp + 0x60]
vpxor ymm1, ymm0, ymmword [rbp + 0xe0]
vmovdqa ymmword [rbp + 0x60], ymm1
vmovdqa xmm0, xmmword [rbp + 0x80]
vxorps xmm0, xmm0, xmmword [rbp + 0x100]
vmovdqa xmmword [rbp + 0x80], xmm0
lea rax, [rbp + 0x20]
mov qword [rbp + 0x10], rax
lea rax, [rbp + 0x40]
mov rbx, rdi
vzeroupper
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140010c70
call fcn.1400128d0
mov r14d, eax
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], rsi
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], si
mov dword [rbp], reloc.WLDAP32.dll_Ordinal_35
test rbx, rbx
je 0x140010d14
cmp rbx, 0x7fffffff
ja 0x1400116a4
mov dword [rsp + 0x20], esi
xor r9d, r9d
mov r8d, ebx
lea rdx, [rbp + 0x40]
mov ecx, eax
call fcn.1400128f8
mov rsi, rax
shr rax, 0x20
test eax, eax
jne 0x1400116af
xor r8d, r8d
movsxd rdx, esi
lea rcx, [rbp + 0x20]
call fcn.14000f3a0
lea r9, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae r9, qword [rbp + 0x20]
mov dword [rsp + 0x20], esi
mov r8d, ebx
lea rdx, [rbp + 0x40]
mov ecx, r14d
call fcn.1400128f8
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x1400116bb
lea rcx, [rbp + 0x20]
call fcn.14000f0b0
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 8
jb 0x140010d5e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010d59
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400116c5
call fcn.14001360c
movabs r14, 0x7a23b65bced4b1b3
mov qword [rbp + 0x40], r14
movabs rsi, 0xa8d144c2a8a264a8
mov qword [rbp + 0x48], rsi
movabs rax, 0x7ce215c6652933e0
mov qword [rbp + 0x50], rax
movabs rbx, 0x2bcefbcf560ccdcf
mov qword [rbp + 0x58], rbx
mov qword [rbp + 0xa0], r13
mov qword [rbp + 0xa8], r12
movabs rax, 0x4873bb20b4c5481
mov qword [rbp + 0xb0], rax
movabs rax, 0x2bcefbcf560ccdaa
mov qword [rbp + 0xb8], rax
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0xa0]
vmovdqa ymmword [rbp + 0x40], ymm1
lea rcx, [rbp + 0x40]
vzeroupper
call fcn.140065f38
mov qword [rbp + 0x40], r14
mov qword [rbp + 0x48], rsi
movabs rax, 0x7ce215df6a2920d2
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], rbx
mov qword [rbp + 0xa0], r13
mov qword [rbp + 0xa8], r12
movabs rax, 0x4873bb20b4c5481
mov qword [rbp + 0xb0], rax
movabs rax, 0x2bcefbcf560ccdaa
mov qword [rbp + 0xb8], rax
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0xa0]
vmovdqa ymmword [rbp + 0x40], ymm1
lea rcx, [rbp + 0x40]
vzeroupper
call fcn.140065f38
mov qword [rbp + 0x40], r14
mov qword [rbp + 0x48], rsi
movabs rax, 0x7ce215df6a2920f2
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], rbx
mov qword [rbp + 0xa0], r13
mov qword [rbp + 0xa8], r12
movabs rax, 0x4873bb20b4c5481
mov qword [rbp + 0xb0], rax
movabs rax, 0x2bcefbcf560ccdaa
mov qword [rbp + 0xb8], rax
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0xa0]
vmovdqa ymmword [rbp + 0x40], ymm1
lea rcx, [rbp + 0x40]
vzeroupper
call fcn.140065f38
mov qword [rbp + 0x40], r14
mov qword [rbp + 0x48], rsi
movabs rax, 0x6aa95ede7f3835c3
mov qword [rbp + 0x50], rax
movabs rax, 0x2bce9eb73322b9cf
mov qword [rbp + 0x58], rax
mov qword [rbp + 0xa0], r13
mov qword [rbp + 0xa8], r12
movabs r14, 0x4873bb20b4c5481
mov qword [rbp + 0xb0], r14
movabs rsi, 0x2bcefbcf560ccdaa
mov qword [rbp + 0xb8], rsi
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0xa0]
vmovdqa ymmword [rbp + 0x40], ymm1
lea rcx, [rbp + 0x40]
vzeroupper
call fcn.140065f38
movabs rax, 0x363fb044d687b3b4
mov qword [rbp + 0x10], rax
movabs rax, 0x88bc5f88fcbe3ffb
mov qword [rbp + 0x18], rax
mov qword [rbp + 0x20], r13
mov qword [rbp + 0x28], r12
movdqa xmm0, xmmword [rbp + 0x10]
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp + 0x10], xmm0
lea rcx, [rbp + 0x10]
call fcn.140065f38
movabs rax, 0x622ab355c187b3b4
mov qword [rbp + 0x40], rax
movabs rax, 0xfad95997fcb76bed
mov qword [rbp + 0x48], rax
mov qword [rbp + 0x50], r14
mov qword [rbp + 0x58], rsi
mov qword [rbp + 0xa0], r13
mov qword [rbp + 0xa8], r12
mov qword [rbp + 0xb0], r14
mov qword [rbp + 0xb8], rsi
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0xa0]
vmovdqa ymmword [rbp + 0x40], ymm1
lea rcx, [rbp + 0x40]
vzeroupper
call fcn.140065f38
movabs rax, 0x653dba43f0fbea84
mov qword [rbp + 0x40], rax
movabs rax, 0xd4df4481eab11bd4
mov qword [rbp + 0x48], rax
movabs rax, 0x2ae50f846f223dd6
mov qword [rbp + 0x50], rax
movabs rax, 0x2bcefbcf567fb4d9
mov qword [rbp + 0x58], rax
mov qword [rbp + 0xa0], r13
mov qword [rbp + 0xa8], r12
mov qword [rbp + 0xb0], r14
mov qword [rbp + 0xb8], rsi
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0xa0]
vmovdqa ymmword [rbp + 0x40], ymm1
lea rcx, [rbp + 0x40]
vzeroupper
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
movabs rax, 0x164fdf30a5d4bca4
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], r12
mov qword [rbp + 0x20], r13
mov qword [rbp + 0x28], r12
movdqa xmm0, xmmword [rbp + 0x10]
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp + 0x10], xmm0
lea rcx, [rbp + 0x10]
call fcn.140065f38
mov edx, 1
mov rcx, r15
call qword [sym.imp.USER32.dll_ShowWindow]
call fcn.14000b3b0
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], 9
mov qword [rbp + 0x38], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [str.._Key.ini]
movsd qword [rbp + 0x20], xmm0
movzx eax, byte [0x14008eed0]
mov byte [rbp + 0x28], al
mov byte [rbp + 0x29], 0
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0x20]
call fcn.14006a9d0
mov ebx, eax
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x1400110f5
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400110f0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400116cb
call fcn.14001360c
call fcn.14000dad0
test ebx, ebx
jne 0x14001129a
lea rax, [rbp + 0xa0]
mov qword [rbp + 0x10], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0xb0], 3
mov qword [rbp + 0xb8], reloc.WS2_32.dll_ntohs
mov eax, dword [0x14008eeb8]
mov word [rbp + 0xa0], ax
movzx eax, byte [0x14008eeba]
mov byte [rbp + 0xa2], al
mov byte [rbp + 0xa3], bl
lea rax, [rbp + 0x20]
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x30], 7
mov qword [rbp + 0x38], reloc.WS2_32.dll_ntohs
mov rax, qword [str.License]
mov dword [rbp + 0x20], eax
movzx eax, word [0x14008eec4]
mov word [rbp + 0x24], ax
movzx eax, byte [0x14008eec6]
mov byte [rbp + 0x26], al
mov byte [rbp + 0x27], bl
movups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], 9
mov qword [rbp + 0x58], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [str.._Key.ini]
movsd qword [rbp + 0x40], xmm0
movzx eax, byte [0x14008eed0]
mov byte [rbp + 0x48], al
mov byte [rbp + 0x49], bl
lea r9, [rbp + 0xa0]
lea r8, [rbp + 0x20]
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0xc0]
call fcn.1400068f0
mov rdx, rax
lea rbx, [0x1402016b8]
mov rcx, rbx
call fcn.140004990
mov rdx, qword [rbp + 0xd8]
cmp rdx, 0x10
jb 0x14001122b
inc rdx
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011226
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400114cf
call fcn.14001360c
movabs rax, 0x163dba5bc6c8bc85
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], r12
mov qword [rbp + 0x20], r13
mov qword [rbp + 0x28], r12
movdqa xmm0, xmmword [rbp + 0x10]
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp + 0x10], xmm0
lea rax, [rbp + 0x10]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140011257
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae rbx, qword [0x1402016b8]
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x10]
xor r8d, r8d
mov rdx, qword [0x1402016c8]
mov rcx, rbx
call fcn.1400032a0
cmp rax, 0xffffffffffffffff
je 0x1400114d5
jmp 0x14001148e
lea rdx, [0x14008e948]
lea rcx, [0x140202fd0]
call fcn.1400026d0
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.140010020
movzx edx, al
mov rcx, rbx
call fcn.14000e300
mov rcx, rbx
call fcn.14000a0a0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movabs rax, 0x372ab25fc6cbb590
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], r12
mov qword [rbp + 0x20], r13
mov qword [rbp + 0x28], r12
movdqa xmm0, xmmword [rbp + 0x10]
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp + 0x10], xmm0
lea rdx, [rbp + 0x10]
lea rcx, [0x140202fd0]
call fcn.1400026d0
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.140010020
movzx edx, al
mov rcx, rbx
call fcn.14000e300
mov rcx, rbx
call fcn.14000a0a0
lea rdx, [0x14008e948]
lea rcx, [0x140202fd0]
call fcn.1400026d0
mov rbx, rax
mov rdx, qword [rax]
movsxd rcx, dword [rdx + 4]
add rcx, rax
mov dl, 0xa
call fcn.140010020
movzx edx, al
mov rcx, rbx
call fcn.14000e300
mov rcx, rbx
call fcn.14000a0a0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movabs rax, 0x733bb17585fafd9c
mov qword [rbp + 0x40], rax
movabs rax, 0xfbd2488ee1a86bfa
mov qword [rbp + 0x48], rax
movabs rax, 0x4873bb20b6c6ee4
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], rsi
mov qword [rbp + 0xa0], r13
mov qword [rbp + 0xa8], r12
mov qword [rbp + 0xb0], r14
mov qword [rbp + 0xb8], rsi
vmovdqu ymm0, ymmword [rbp + 0xa0]
vpxor ymm1, ymm0, ymmword [rbp + 0x40]
vmovdqa ymmword [rbp + 0x40], ymm1
lea rdx, [rbp + 0x40]
lea rcx, [0x140202fd0]
vzeroupper
call fcn.1400026d0
lea rbx, [0x1402016b8]
mov rdx, rbx
lea rcx, [0x140202f40]
call fcn.140002450
movabs rax, 0x163dba5bc6c8bc85
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], r12
mov qword [rbp + 0x20], r13
mov qword [rbp + 0x28], r12
movdqa xmm0, xmmword [rbp + 0x10]
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp + 0x10], xmm0
lea rax, [rbp + 0x10]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140011450
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae rbx, qword [0x1402016b8]
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x10]
xor r8d, r8d
mov rdx, qword [0x1402016c8]
mov rcx, rbx
call fcn.1400032a0
cmp rax, 0xffffffffffffffff
je 0x1400115a9
call fcn.140005330
call fcn.140007b00
call fcn.140006ac0
xor eax, eax
mov rcx, qword [rbp + 0x920]
xor rcx, rsp
call fcn.1400136b0
lea r11, [rsp + 0x980]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140065b54
int3
call fcn.14000dad0
movabs rax, 0x164fdf30a5d4bca4
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], r12
mov qword [rbp + 0x20], r13
mov qword [rbp + 0x28], r12
movdqa xmm0, xmmword [rbp + 0x10]
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp + 0x10], xmm0
lea rcx, [rbp + 0x10]
call fcn.140065f38
call fcn.14000b3b0
lea rdx, [0x14000f080]
lea rcx, [0x140202fd0]
call fcn.140004a20
movabs rcx, 0x362bb65cc4d1be8e
mov qword [rbp + 0x40], rcx
movabs rcx, 0xa9d95e83eda722e4
mov qword [rbp + 0x48], rcx
mov qword [rbp + 0x50], r14
mov qword [rbp + 0x58], rsi
mov qword [rbp + 0xa0], r13
mov qword [rbp + 0xa8], r12
mov qword [rbp + 0xb0], r14
mov qword [rbp + 0xb8], rsi
vmovdqu ymm0, ymmword [rbp + 0xa0]
vpxor ymm1, ymm0, ymmword [rbp + 0x40]
vmovdqa ymmword [rbp + 0x40], ymm1
lea rdx, [rbp + 0x40]
mov rcx, rax
vzeroupper
call fcn.1400026d0
lea rdx, [0x140003370]
mov rcx, rax
call fcn.140004a20
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 3
call fcn.140065ee8
int3
call fcn.14000dad0
movabs rax, 0x164fdf30a5d4bca4
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], r12
mov qword [rbp + 0x20], r13
mov qword [rbp + 0x28], r12
movdqa xmm0, xmmword [rbp + 0x10]
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp + 0x10], xmm0
lea rcx, [rbp + 0x10]
call fcn.140065f38
call fcn.14000b3b0
lea rdx, [0x14000f080]
lea rcx, [0x140202fd0]
call fcn.140004a20
movabs rcx, 0x362bb65cc4d1be8e
mov qword [rbp + 0x40], rcx
movabs rcx, 0xa9d95e83eda722e4
mov qword [rbp + 0x48], rcx
mov qword [rbp + 0x50], r14
mov qword [rbp + 0x58], rsi
mov qword [rbp + 0xa0], r13
mov qword [rbp + 0xa8], r12
mov qword [rbp + 0xb0], r14
mov qword [rbp + 0xb8], rsi
vmovdqu ymm0, ymmword [rbp + 0xa0]
vpxor ymm1, ymm0, ymmword [rbp + 0x40]
vmovdqa ymmword [rbp + 0x40], ymm1
lea rdx, [rbp + 0x40]
mov rcx, rax
vzeroupper
call fcn.1400026d0
lea rdx, [0x140003370]
mov rcx, rax
call fcn.140004a20
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 3
call fcn.140065ee8
nop
mov ecx, reloc.WLDAP32.dll_Ordinal_22
call fcn.1400096c0
int3
shr rsi, 0x20
mov ecx, esi
call fcn.140009700
int3
shr rcx, 0x20
call fcn.140009700
nop
call fcn.140065b54
nop
mov ecx, reloc.WLDAP32.dll_Ordinal_22
call fcn.1400096c0
int3
shr rsi, 0x20
mov ecx, esi
call fcn.140009700
int3
shr rcx, 0x20
call fcn.140009700
nop
call fcn.140065b54
int3
call fcn.140065b54
int3