Function at 0x140061490
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x358]
sub rsp, 0x440
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
mov rax, qword [0x140320600]
xor rax, rsp
mov qword [rbp + 0x310], rax
xor r12d, r12d
lea rcx, [rbp - 0x40]
call fcn.140060490
nop
mov rdx, rax
lea rcx, [rbp - 0x60]
call fcn.14005fc40
mov rdx, rax
lea rcx, [0x14032a8c8]
call fcn.140067e40
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x140061532
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006152d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400626f2
call fcn.140213970
movdqa xmm0, xmmword [0x1402f6ed0]
movdqu xmmword [rbp - 0x50], xmm0
mov byte [rbp - 0x60], 0
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x14006157e
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061579
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400626f8
call fcn.140213970
cmp qword [0x14032a7f0], 0xa
jne 0x14006268a
cmp qword [0x14032a810], 0x40
jne 0x14006268a
mov dword [rsp + 0x40], 0xa4a2a2ec
mov dword [rsp + 0x44], 0xa7b990ba
mov word [rsp + 0x48], 0xef
mov byte [rsp + 0x4a], 1
mov rcx, r12
nop dword [rax]
lea eax, [rcx - 0x36]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 9
jb 0x1400615c0
mov byte [rsp + 0x4a], 0
lea rdx, [0x14032a7e0]
lea rcx, [rbp - 0x40]
call fcn.140060070
mov r15, rax
mov dword [rbp - 0x78], 0xa3bba4ec
mov dword [rbp - 0x74], 0xb5b9bdab
mov word [rbp - 0x70], 0xef
mov byte [rbp - 0x6e], 1
mov rcx, r12
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x36]
xor byte [rbp + rcx - 0x78], al
inc rcx
cmp rcx, 9
jb 0x140061610
mov byte [rbp - 0x6e], 0
lea rdx, [0x14032a7c0]
lea rcx, [rbp + 0x1b0]
call fcn.140060070
mov rsi, rax
mov dword [rsp + 0x38], 0xa0ada5ec
mov dword [rsp + 0x3c], 0x100f2ab
mov rcx, r12
nop dword [rax]
lea eax, [rcx - 0x36]
xor byte [rsp + rcx + 0x38], al
inc rcx
cmp rcx, 6
jb 0x140061650
mov byte [rsp + 0x3f], 0
lea rax, [rbp + 0x280]
mov qword [rsp + 0x50], rax
lea rdx, [0x14032a780]
lea rcx, [rbp + 0x280]
call fcn.140067f10
mov rdi, rax
lea rax, [rbp + 0x208]
mov qword [rsp + 0x30], rax
lea rdx, [0x14032a800]
lea rcx, [rbp + 0x208]
call fcn.140067f10
mov rbx, rax
lea rdx, [0x14032a8c8]
lea rcx, [rbp + 0x248]
call fcn.140067f10
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x190]
call fcn.140060610
mov r14, rax
mov dword [rsp + 0x78], 0xaea2aeec
mov dword [rsp + 0x7c], 0xeca9aaa5
mov word [rbp - 0x80], 0x100
mov rcx, r12
nop
lea eax, [rcx - 0x36]
xor byte [rsp + rcx + 0x78], al
inc rcx
cmp rcx, 8
jb 0x1400616f0
mov byte [rbp - 0x7f], 0
lea rax, [rbp + 0x1d0]
mov qword [rbp - 0x68], rax
lea rdx, [0x14032a780]
lea rcx, [rbp + 0x1d0]
call fcn.140067f10
mov rdi, rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x50], rax
lea rdx, [0x14032a800]
lea rcx, [rbp - 0x20]
call fcn.140067f10
mov rbx, rax
lea rdx, [0x14032a820]
lea rcx, [rbp + 0x2d0]
call fcn.140067f10
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x170]
call fcn.140060610
mov rdi, rax
mov dword [rsp + 0x50], 0xbfa9bdec
mov word [rsp + 0x54], 0xf3
mov byte [rsp + 0x56], 1
mov rcx, r12
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx - 0x36]
xor byte [rsp + rcx + 0x50], al
inc rcx
cmp rcx, 5
jb 0x140061790
mov byte [rsp + 0x56], 0
mov dword [rsp + 0x30], 0xb9a5a5a3
mov word [rsp + 0x34], 0x100
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx - 0x36]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 4
jb 0x1400617c0
mov byte [rsp + 0x35], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x80], xmm1
lea rax, [rsp + 0x30]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x1400617f6
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x70]
call fcn.14006b190
nop
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x150]
call fcn.140060070
mov r10, rax
mov dword [rsp + 0x30], 0xa8bcb2be
mov word [rsp + 0x34], 0xf3
mov byte [rsp + 0x36], 1
mov rcx, r12
nop dword [rax]
lea eax, [rcx - 0x36]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 5
jb 0x140061840
mov byte [rsp + 0x36], 0
lea rax, [rsp + 0x30]
mov r9, rbx
nop dword [rax]
inc r9
cmp byte [rax + r9], 0
jne 0x140061860
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, r10
call fcn.14006c980
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x60], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rax, [rsp + 0x50]
mov r8, rbx
nop
inc r8
cmp byte [rax + r8], 0
jne 0x1400618b0
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x50]
call fcn.140067d50
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x130], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x140], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, rdi
lea r8, [rbp + 0x130]
lea rcx, [rbp - 0x60]
call fcn.14006ca80
nop
lea rax, [rsp + 0x78]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140061910
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x60]
call fcn.140067d50
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x110], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x120], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, r14
lea r8, [rbp + 0x110]
lea rcx, [rbp + 0xd0]
call fcn.14006ca80
nop
lea rax, [rsp + 0x38]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140061970
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0xd0]
call fcn.140067d50
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xf0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x100], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, rsi
lea r8, [rbp + 0xf0]
lea rcx, [rbp + 0xb0]
call fcn.14006ca80
nop
lea rax, [rbp - 0x78]
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400619d0
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0xb0]
call fcn.140067d50
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x68], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, r15
lea r8, [rsp + 0x58]
lea rcx, [rbp + 0x90]
call fcn.14006ca80
nop
lea rax, [rsp + 0x40]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140061a24
mov r8, rbx
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x90]
call fcn.140067d50
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x40], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rdx, [0x14032a780]
cmp qword [0x14032a798], 0xf
cmova rdx, qword [0x14032a780]
mov r8, qword [0x14032a790]
lea rcx, [rbp + 0x30]
call fcn.140067d50
movups xmm7, xmmword [rax]
movups xmmword [rbp + 0x2f0], xmm7
movups xmm6, xmmword [rax + 0x10]
movups xmmword [rbp + 0x300], xmm6
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rbp + 0x48]
cmp rdx, 0xf
jbe 0x140061af4
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061aef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400626fe
call fcn.140213970
movdqa xmm0, xmmword [0x1402f6ed0]
movdqu xmmword [rbp + 0x40], xmm0
mov byte [rbp + 0x30], 0
mov rdx, qword [rbp + 0xa8]
cmp rdx, 0xf
jbe 0x140061b46
inc rdx
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061b41
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062704
call fcn.140213970
movdqa xmm0, xmmword [0x1402f6ed0]
movdqu xmmword [rbp + 0xa0], xmm0
mov byte [rbp + 0x90], 0
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x140061b9b
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061b95
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006270a
call fcn.140213970
nop
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0xf
jbe 0x140061bdc
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061bd7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062710
call fcn.140213970
movdqa xmm0, xmmword [0x1402f6ed0]
movdqu xmmword [rbp + 0xc0], xmm0
mov byte [rbp + 0xb0], 0
mov rdx, qword [rbp + 0x108]
cmp rdx, 0xf
jbe 0x140061c35
inc rdx
mov rcx, qword [rbp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061c2f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062716
call fcn.140213970
nop
mov rdx, qword [rbp + 0xe8]
cmp rdx, 0xf
jbe 0x140061c76
inc rdx
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061c71
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006271c
call fcn.140213970
movdqa xmm0, xmmword [0x1402f6ed0]
movdqu xmmword [rbp + 0xe0], xmm0
mov byte [rbp + 0xd0], 0
mov rdx, qword [rbp + 0x128]
cmp rdx, 0xf
jbe 0x140061ccf
inc rdx
mov rcx, qword [rbp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061cc9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062722
call fcn.140213970
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x140061d0a
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061d05
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062728
call fcn.140213970
movdqa xmm0, xmmword [0x1402f6ed0]
movdqu xmmword [rbp - 0x50], xmm0
mov byte [rbp - 0x60], 0
mov rdx, qword [rbp + 0x148]
cmp rdx, 0xf
jbe 0x140061d5d
inc rdx
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061d57
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006272e
call fcn.140213970
nop
mov rdx, qword [rbp + 0x68]
cmp rdx, 0xf
jbe 0x140061d98
inc rdx
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061d93
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062734
call fcn.140213970
movdqa xmm0, xmmword [0x1402f6ed0]
movdqu xmmword [rbp + 0x60], xmm0
mov byte [rbp + 0x50], 0
mov rdx, qword [rbp + 0x168]
cmp rdx, 0xf
jbe 0x140061dea
inc rdx
mov rcx, qword [rbp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061de5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006273a
call fcn.140213970
movdqa xmm0, xmmword [0x1402f6ed0]
movdqu xmmword [rbp + 0x160], xmm0
mov byte [rbp + 0x150], 0
mov rdx, qword [rbp + 0x88]
cmp rdx, 0xf
jbe 0x140061e3f
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061e3a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062740
call fcn.140213970
movdqa xmm0, xmmword [0x1402f6ed0]
movdqu xmmword [rbp + 0x80], xmm0
mov byte [rbp + 0x70], 0
mov rdx, qword [rbp + 0x188]
cmp rdx, 0xf
jbe 0x140061e94
inc rdx
mov rcx, qword [rbp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061e8f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062746
call fcn.140213970
movdqa xmm0, xmmword [0x1402f6ed0]
movdqu xmmword [rbp + 0x180], xmm0
mov byte [rbp + 0x170], 0
mov rdx, qword [rbp + 0x1a8]
cmp rdx, 0xf
jbe 0x140061eec
inc rdx
mov rcx, qword [rbp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061ee7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006274c
call fcn.140213970
movdqa xmm0, xmmword [0x1402f6ed0]
movdqu xmmword [rbp + 0x1a0], xmm0
mov byte [rbp + 0x190], 0
mov rdx, qword [rbp + 0x1c8]
cmp rdx, 0xf
jbe 0x140061f44
inc rdx
mov rcx, qword [rbp + 0x1b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061f3f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062752
call fcn.140213970
movdqa xmm0, xmmword [0x1402f6ed0]
movdqu xmmword [rbp + 0x1c0], xmm0
mov byte [rbp + 0x1b0], 0
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x140061f96
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061f91
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062758
call fcn.140213970
movdqa xmm0, xmmword [0x1402f6ed0]
movdqu xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x40], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r12
lea r14, [rbp + 0x2f0]
movq rsi, xmm7
movdqa xmm0, xmm6
psrldq xmm0, 8
movq r15, xmm0
cmp r15, 0xf
cmova r14, rsi
movabs rbx, 0x7fffffffffffffff
movq rdi, xmm6
cmp rdi, rbx
ja 0x14006275e
cmp rdi, 0xf
ja 0x140062015
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], reloc.WS2_32.dll_ntohs
movups xmm0, xmmword [r14]
movups xmmword [rsp + 0x58], xmm0
jmp 0x1400620a9
mov rax, rdi
or rax, 0xf
cmp rax, rbx
jbe 0x140062051
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140213a6c
mov rcx, rax
test rax, rax
je 0x140062764
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14006208b
mov rbx, rax
mov ecx, reloc.WS2_32.dll_shutdown
cmp rax, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14006207c
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14006262c
jmp 0x14006202f
test rcx, rcx
je 0x140062088
call fcn.140213a6c
jmp 0x14006208b
mov rax, r12
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], rbx
lea r8, [rdi + 1]
mov rdx, r14
mov rcx, rax
call fcn.140252c60
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x2b0]
call fcn.1400653b0
nop
lea rax, [rbp + 0x2d0]
mov qword [rbp - 0x68], rax
lea rdx, [0x14032a780]
lea rcx, [rbp + 0x2d0]
call fcn.140067f10
mov rdi, rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x38], rax
lea rdx, [0x14032a800]
lea rcx, [rbp - 0x20]
call fcn.140067f10
mov rbx, rax
lea rdx, [rbp + 0x2b0]
lea rcx, [rbp + 0x1d0]
call fcn.140067f10
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.140060920
mov rbx, rax
lea rax, [rbp + 0x2b0]
cmp rax, rbx
je 0x1400621a9
mov rdx, qword [rbp + 0x2c8]
cmp rdx, 0xf
jbe 0x14006216e
inc rdx
mov rcx, qword [rbp + 0x2b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062169
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006276a
call fcn.140213970
movdqa xmm0, xmmword [0x1402f6ed0]
movdqu xmmword [rbp + 0x2c0], xmm0
mov byte [rbp + 0x2b0], 0
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x2b0], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x2c0], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x1400621e4
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400621df
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006276a
call fcn.140213970
mov qword [rbp + 0x240], r12
lea r8, [rbp + 0x208]
lea rdx, [rbp + 0x2b0]
lea rcx, [rbp + 0x2a0]
call fcn.14006a480
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r12
mov r8d, 7
lea rdx, str.success
lea rcx, [rsp + 0x58]
call fcn.14006b190
lea rax, [rsp + 0x58]
mov qword [rbp - 0x68], rax
movzx ecx, byte [rbp + 0x2a0]
test cl, cl
jne 0x14006225f
mov byte [rbp + 0x2a0], 1
call fcn.14006b6c0
mov qword [rbp + 0x2a8], rax
movzx ecx, byte [rbp + 0x2a0]
jmp 0x140062266
mov rax, qword [rbp + 0x2a8]
cmp cl, 1
jne 0x1400625e4
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.140074170
mov rbx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x1400622c3
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400622be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062770
call fcn.140213970
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x58], 0
cmp byte [rbx + 0x40], 4
jne 0x140062776
xorps xmm0, xmm0
lea rcx, [rsp + 0x58]
cmp byte [rbx + 0x48], 0
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r12
movups xmmword [rsp + 0x58], xmm0
je 0x1400624a8
mov r8d, 9
lea rdx, str.sessionid
call fcn.14006b190
lea rax, [rsp + 0x58]
mov qword [rbp - 0x68], rax
movzx ecx, byte [rbp + 0x2a0]
test cl, cl
jne 0x140062343
mov byte [rbp + 0x2a0], 1
call fcn.14006b6c0
mov qword [rbp + 0x2a8], rax
movzx ecx, byte [rbp + 0x2a0]
jmp 0x14006234a
mov rax, qword [rbp + 0x2a8]
cmp cl, 1
jne 0x1400627cb
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.140074170
mov rbx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x1400623a7
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400623a2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400627b9
call fcn.140213970
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x58], 0
lea rdx, [rbx + 0x40]
lea rcx, [0x14032a8a8]
call fcn.14006a6c0
nop
movzx edx, byte [rbp + 0x2a0]
lea rcx, [rbp + 0x2a8]
call fcn.1400690e0
nop
mov rdx, qword [rbp + 0x2c8]
cmp rdx, 0xf
jbe 0x140062420
inc rdx
mov rcx, qword [rbp + 0x2b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006241b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400627bf
call fcn.140213970
movdqa xmm0, xmmword [0x1402f6ed0]
movdqu xmmword [rbp + 0x2c0], xmm0
mov byte [rbp + 0x2b0], 0
cmp r15, 0xf
jbe 0x14006246e
lea rdx, [r15 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140062466
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400627c5
mov rcx, rsi
call fcn.140213970
mov rcx, qword [rbp + 0x310]
xor rcx, rsp
call fcn.140213950
lea r11, [rsp + 0x440]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov r8d, 7
lea rdx, str.message
call fcn.14006b190
lea rax, [rsp + 0x58]
mov qword [rbp - 0x68], rax
movzx ecx, byte [rbp + 0x2a0]
test cl, cl
jne 0x1400624ea
mov byte [rbp + 0x2a0], 1
call fcn.14006b6c0
mov qword [rbp + 0x2a8], rax
movzx ecx, byte [rbp + 0x2a0]
jmp 0x1400624f1
mov rax, qword [rbp + 0x2a8]
cmp cl, 1
jne 0x140062874
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.140074170
mov rdi, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x14006254e
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062549
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062810
call fcn.140213970
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x58], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xor eax, eax
mov qword [rsp + 0x48], rax
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.1400690e0
mov byte [rsp + 0x40], 3
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.140213a6c
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], r12
mov r8d, 0xa
lea rdx, str.invalidver
mov rcx, rax
call fcn.14006b190
mov qword [rsp + 0x48], rbx
lea rdx, [rsp + 0x40]
lea rcx, [rdi + 0x40]
call fcn.14006c500
movzx ebx, al
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.1400690e0
nop
test bl, bl
je 0x140062816
jmp 0x140062632
lea rcx, [rbp + 0x2a0]
call fcn.140068d20
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x38]
lea rcx, [rbp - 0x20]
call fcn.140072d70
nop
mov r8, rax
mov edx, 0x131
lea rcx, [rbp + 0x248]
call fcn.14006ac80
lea rdx, [0x140318b98]
lea rcx, [rbp + 0x248]
call fcn.140215b44
nop
call fcn.14005ba40
nop
lea rdx, str.download
lea rcx, [rbp + 0x2a0]
call fcn.14006a5a0
lea rdx, [rbp + 0x2d0]
mov rcx, rax
call fcn.14006a780
lea rcx, [rbp + 0x2d0]
call fcn.140067d40
mov r8, rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor ecx, ecx
call fcn.140223534
nop
movdqa xmm0, xmmword [0x1402f6fc0]
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x1402f6fd0]
movdqa xmmword [rbp - 0x10], xmm1
movdqa xmm0, xmmword [0x1402f6fb0]
movdqa xmmword [rbp], xmm0
movdqa xmm1, xmmword [0x1402f6f90]
movdqa xmmword [rbp + 0x10], xmm1
mov dword [rbp + 0x20], 0x646d462a
mov dword [rbp + 0x24], 0x61732160
mov word [rbp + 0x28], 0x62
mov byte [rbp + 0x2a], 1
lea rdx, [rbp - 0x20]
call fcn.1400628c0
mov ecx, 0x1194
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call fcn.140223534
nop
call fcn.140228920
nop
call fcn.140228920
nop
call fcn.140228920
nop
call fcn.140228920
nop
call fcn.140228920
nop
call fcn.140228920
nop
call fcn.140228920
nop
call fcn.140228920
nop
call fcn.140228920
nop
call fcn.140228920
nop
call fcn.140228920
nop
call fcn.140228920
nop
call fcn.140228920
nop
call fcn.140228920
nop
call fcn.140228920
nop
call fcn.140228920
nop
call fcn.140228920
nop
call fcn.140228920
int3
call fcn.14005bae0
int3
call fcn.140228920
nop
call fcn.140228920
nop
call fcn.140228920
int3
lea rcx, [rbx + 0x40]
call fcn.140068d20
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x38]
lea rcx, [rbp + 0x2d0]
call fcn.140078790
nop
mov r8, rax
lea rcx, [rbp + 0x1d0]
call fcn.140078550
lea rdx, [0x140318b98]
lea rcx, [rbp + 0x1d0]
call fcn.140215b44
nop
call fcn.140228920
nop
call fcn.140228920
nop
call fcn.140228920
nop
lea rcx, [rbp + 0x2a0]
call fcn.140068d20
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x38]
lea rcx, [rbp + 0x2d0]
call fcn.140072d70
nop
mov r8, rax
mov edx, 0x131
lea rcx, [rbp - 0x20]
call fcn.14006ac80
lea rdx, [0x140318b98]
lea rcx, [rbp - 0x20]
call fcn.140215b44
nop
call fcn.140228920
int3
lea rdx, [0x1402f5094]
lea rcx, [0x140328ab0]
call fcn.14006a1d0
lea rdx, str.message
lea rcx, [rbp + 0x2a0]
call fcn.14006a5a0
mov rdx, rax
lea rcx, [rbp + 0x2d0]
call fcn.14006a850
nop
mov rdx, rax
call fcn.14006a8e0
nop
lea rcx, [rbp + 0x2d0]
call fcn.140067de0
mov ecx, 0x1194
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call fcn.140223534
nop
lea rcx, [rbp + 0x2a0]
call fcn.140068d20
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x38]
lea rcx, [rbp + 0x2d0]
call fcn.140072d70
nop
mov r8, rax
mov edx, 0x131
lea rcx, [rbp - 0x20]
call fcn.14006ac80
lea rdx, [0x140318b98]
lea rcx, [rbp - 0x20]
call fcn.140215b44
int3