Function at 0x14000f4b0
Capabilities:
Access peb ldr_data
Check for debugger via api
Contain obfuscated stackstrings
Create process on windows
Create thread
Delete file
Encode data using xor
Get common file path
Hash data using fnv
Resolve function by parsing pe exports
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x328]
sub rsp, 0x400
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x1401c0080]
xor rax, rsp
mov qword [rbp + 0x2e0], rax
xor r13d, r13d
call fcn.140081568
call fcn.140081510
call fcn.14008157e
call fcn.140081510
call fcn.14008153c
call fcn.140081526
call fcn.14008153c
call fcn.140081526
call fcn.140081552
lea rcx, str.main
call qword [sym.imp.VMProtectSDK64.dll_VMProtectBeginUltra]
call fcn.140025500
call fcn.14000f090
lea rcx, [0x14021d220]
call fcn.1400f8ba0
mov rcx, qword [0x14021cf40]
test rcx, rcx
jne 0x14000f704
mov r9d, r13d
mov edi, 0x9bc5a608
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r12, qword [rax]
mov rsi, r12
nop dword [rax]
movups xmm0, xmmword [rsi + 0x58]
movd eax, xmm0
sub ax, 8
test r9d, r9d
je 0x14000f5bd
psrldq xmm0, 8
movq rcx, xmm0
movzx eax, ax
shr rax, 1
lea r8, [rcx + rax*2]
mov edx, 0x811c9dc5
cmp rcx, r8
je 0x14000f5b4
nop
movsx eax, byte [rcx]
xor eax, edx
imul edx, eax, 0x1000193
add rcx, 2
cmp rcx, r8
jne 0x14000f5a0
cmp edx, r9d
jne 0x14000f6e5
mov r10, qword [rsi + 0x30]
movsxd rax, dword [r10 + 0x3c]
mov rcx, qword [rax + r10 + 0x88]
mov r15, rcx
shr r15, 0x20
mov ebx, ecx
add rbx, r10
cmp rbx, r10
je 0x14000f6e5
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x14000f6e5
mov r14d, dword [rbx + 0x20]
nop dword [rax]
nop word [rax + rax]
dec r8d
lea rax, [r10 + r8*4]
mov ecx, dword [rax + r14]
add rcx, r10
mov edx, 0x811c9dc5
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x14000f636
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x14000f620
cmp edx, edi
je 0x14000f644
test r8d, r8d
jne 0x14000f600
jmp 0x14000f6e5
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rbx + 0x24]
add rax, r10
movzx eax, word [rax + r8*2]
mov ecx, dword [rcx + rax*4]
add rcx, r10
cmp rcx, rbx
jbe 0x14000f6fd
lea rax, [r15 + rbx]
cmp rcx, rax
jae 0x14000f6fd
mov r9d, 0x811c9dc5
mov dword [rbp - 0x58], r9d
mov edx, r9d
mov dword [rbp - 0x54], edx
movzx eax, byte [rcx]
cmp al, 0x2e
je 0x14000f6ab
nop dword [rax + rax]
movsx eax, al
xor eax, r9d
imul r9d, eax, 0x1000193
inc rcx
movzx eax, byte [rcx]
cmp al, 0x2e
jne 0x14000f690
mov dword [rbp - 0x58], r9d
inc rcx
movzx eax, byte [rcx]
test al, al
je 0x14000f6d9
nop word [rax + rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
lea rcx, [rcx + 1]
movzx eax, byte [rcx]
test al, al
jne 0x14000f6c0
mov dword [rbp - 0x54], edx
mov rsi, qword [r12]
mov rdi, qword [rbp - 0x58]
shr rdi, 0x20
mov rax, qword [rsi]
mov rsi, rax
cmp rax, r12
je 0x14000f6fa
cmp qword [rax + 0x30], r13
jne 0x14000f570
mov rcx, r13
mov qword [0x14021cf40], rcx
call rcx
mov rcx, rax
call fcn.140006ae0
call fcn.14000a260
call fcn.140007100
call fcn.140006870
call fcn.1400042b0
call fcn.140002d30
call fcn.1400096e0
call fcn.140007bd0
call fcn.14000ade0
call fcn.14000a8a0
call fcn.1400066b0
call fcn.140004d20
call fcn.140004a70
call fcn.1400086e0
test al, al
je 0x14000f78c
mov dword [rbp - 0x46], 0x3f203f
mov dword [rbp - 0x50], 0x63616c62
mov dword [rbp - 0x4c], 0x73696c6b
mov word [rbp - 0x48], 0x2074
mov byte [rbp - 0x42], r13b
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140003f60
call fcn.1400090b0
test al, al
je 0x14000f7ce
mov dword [rbp - 0x46], 0x3f203f
mov dword [rbp - 0x50], 0x63616c62
mov dword [rbp - 0x4c], 0x73696c6b
mov word [rbp - 0x48], 0x2074
mov byte [rbp - 0x42], r13b
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140003f60
call fcn.140007ef0
test eax, eax
je 0x14000f810
mov dword [rbp - 0x46], 0x3f203f
mov dword [rbp - 0x50], 0x63616c62
mov dword [rbp - 0x4c], 0x73696c6b
mov word [rbp - 0x48], 0x2074
mov byte [rbp - 0x42], r13b
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140003f60
call fcn.14000a010
test al, al
je 0x14000f852
mov dword [rbp - 0x46], 0x3f203f
mov dword [rbp - 0x50], 0x63616c62
mov dword [rbp - 0x4c], 0x73696c6b
mov word [rbp - 0x48], 0x2074
mov byte [rbp - 0x42], r13b
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140003f60
call fcn.140007710
test eax, eax
je 0x14000f894
mov dword [rbp - 0x46], 0x3f203f
mov dword [rbp - 0x50], 0x63616c62
mov dword [rbp - 0x4c], 0x73696c6b
mov word [rbp - 0x48], 0x2074
mov byte [rbp - 0x42], r13b
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140003f60
call fcn.14000ad60
test al, al
je 0x14000f8d6
mov dword [rbp - 0x46], 0x3f203f
mov dword [rbp - 0x50], 0x63616c62
mov dword [rbp - 0x4c], 0x73696c6b
mov word [rbp - 0x48], 0x2074
mov byte [rbp - 0x42], r13b
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140003f60
call fcn.1400082d0
test eax, eax
je 0x14000f918
mov dword [rbp - 0x46], 0x3f203f
mov dword [rbp - 0x50], 0x63616c62
mov dword [rbp - 0x4c], 0x73696c6b
mov word [rbp - 0x48], 0x2074
mov byte [rbp - 0x42], r13b
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140003f60
call fcn.14000b940
test al, al
je 0x14000f94d
lea rdx, str.Hyper_hide_check_failed
lea rcx, [rsp + 0x58]
call fcn.140002bf0
mov rdx, rax
lea rcx, [0x14021d220]
call fcn.1400f7260
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.14000c070
test al, al
je 0x14000f982
lea rdx, str.Hyper_hide_binary_check_failed
lea rcx, [rsp + 0x58]
call fcn.140002bf0
mov rdx, rax
lea rcx, [0x14021d220]
call fcn.1400f7260
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.14000c340
test al, al
je 0x14000f9b7
lea rdx, str.Air_HVHbinary_check_failed
lea rcx, [rsp + 0x58]
call fcn.140002bf0
mov rdx, rax
lea rcx, [0x14021d220]
call fcn.1400f7260
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.14000bb20
test al, al
je 0x14000f9ec
lea rdx, str.Titen_Hide_check_failed
lea rcx, [rsp + 0x58]
call fcn.140002bf0
mov rdx, rax
lea rcx, [0x14021d220]
call fcn.1400f7260
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.14000c600
test al, al
je 0x14000fa21
lea rdx, str.TitanHideBinaryCheckfailed
lea rcx, [rsp + 0x58]
call fcn.140002bf0
mov rdx, rax
lea rcx, [0x14021d220]
call fcn.1400f7260
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.14000bcd0
test al, al
je 0x14000fa56
lea rdx, str.ProcessHackerCheck
lea rcx, [rsp + 0x58]
call fcn.140002bf0
mov rdx, rax
lea rcx, [0x14021d220]
call fcn.1400f7260
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.14000bec0
test al, al
je 0x14000fa8b
lea rdx, str.KsDumperCheck
lea rcx, [rsp + 0x58]
call fcn.140002bf0
mov rdx, rax
lea rcx, [0x14021d220]
call fcn.1400f7260
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [rbp - 0x58], r13d
je 0x14000fad0
lea rdx, str.CheckRemoteDebuggerPresentAPI
lea rcx, [rsp + 0x58]
call fcn.140002bf0
mov rdx, rax
lea rcx, [0x14021d220]
call fcn.1400f7260
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.14000b2a0
test eax, eax
je 0x14000fb05
lea rdx, str.NtQueryInformationProcess_ProcessDbgPort
lea rcx, [rsp + 0x58]
call fcn.140002bf0
mov rdx, rax
lea rcx, [0x14021d220]
call fcn.1400f7260
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14000fb3b
lea rdx, str.IsDebuggerPresentAPI
lea rcx, [rsp + 0x58]
call fcn.140002bf0
mov rdx, rax
lea rcx, [0x14021d220]
call fcn.1400f7260
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [rbp - 0x58], r13
lea rcx, [0x140184e48]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.NtQueryInformationProcess
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp - 0x58]
mov edx, reloc.WLDAP32.dll_Ordinal_30
call rbx
test eax, eax
mov eax, r13d
jne 0x14000fb8c
cmp qword [rbp - 0x58], rax
setne al
test eax, eax
je 0x14000fbbc
lea rdx, str.NtQueryInformationProcess_ProcessDebugObject
lea rcx, [rsp + 0x58]
call fcn.140002bf0
mov rdx, rax
lea rcx, [0x14021d220]
call fcn.1400f7260
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.14000b4f0
test eax, eax
je 0x14000fbf1
lea rdx, str.NtQueryInformationProcess_SystemKernelDebuggerInformation
lea rcx, [rsp + 0x58]
call fcn.140002bf0
mov rdx, rax
lea rcx, [0x14021d220]
call fcn.1400f7260
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.14000b710
test eax, eax
je 0x14000fc26
lea rdx, str.NtSetInformationThread_ThreadHideFromDebugger
lea rcx, [rsp + 0x58]
call fcn.140002bf0
mov rdx, rax
lea rcx, [0x14021d220]
call fcn.1400f7260
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.14000b920
test eax, eax
je 0x14000fc5b
lea rdx, str.CloseHandleAPI
lea rcx, [rsp + 0x58]
call fcn.140002bf0
mov rdx, rax
lea rcx, [0x14021d220]
call fcn.1400f7260
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, str.CheckForTimingAnomalies
call qword [sym.imp.VMProtectSDK64.dll_VMProtectBegin]
lea rcx, [rsp + 0x30]
call fcn.1400020f0
mov dword [rbp - 0x58], r13d
mov edx, r13d
nop dword [rax]
mov ecx, edx
imul ecx, edx
mov eax, dword [rbp - 0x58]
add ecx, eax
mov dword [rbp - 0x58], ecx
inc edx
cmp edx, 0x3e8
jl 0x14000fc80
lea rcx, [rbp - 0x58]
call fcn.1400020f0
mov rax, qword [rbp - 0x58]
sub rax, qword [rsp + 0x30]
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
divsd xmm0, qword [0x1401a2520]
comisd xmm0, xmmword [0x1401a24a0]
ja 0x140011120
call qword [sym.imp.VMProtectSDK64.dll_VMProtectEnd]
mov edx, 4
mov rcx, qword [sym.imp.KERNEL32.dll_GetStdHandle]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._n__________________________________________________________n______________________________________________________n______________________________________________________n___________________________________________________n____________________________________________________n__________________________________________________n__________________________________________________n_____________________________________________________n__________________________________________________________n__________________________________________________________n__________________________________________________________n__________________________________________________________n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014ef0
lea rdx, [0x1400150c0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
movabs r15, 0xff00ff00ff00ff00
mov qword [rbp + 0x78], r15
lea rcx, [rbp + 0x328]
mov qword [rbp + 0x80], rcx
mov rax, qword [rcx]
xor rax, r15
mov qword [rbp + 0x70], rax
mov qword [rcx], r13
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, [0x14000ef20]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.14007d3a0
lea r12, str.stellar.json
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], send
call fcn.140155410
movaps xmm0, xmmword [rbp - 0x50]
movdqa xmmword [rbp - 0x50], xmm0
lea r8, [rbp - 0x50]
mov edx, eax
lea rcx, [rsp + 0x38]
call fcn.140002e50
nop
mov qword [rbp - 0x50], r13
lea rax, [0x1401c0118]
mov qword [rbp - 0x48], rax
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x38]
call fcn.140003a50
movzx ebx, al
cmp dword [rbp - 0x50], 0
je 0x14000fdc3
lea r8, [rsp + 0x38]
lea rdx, [rbp - 0x50]
lea rcx, str.exists
call fcn.1400039f0
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 7
jbe 0x14000fe08
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000fe03
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000fe03
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140154404
xorps xmm0, xmm0
test bl, bl
je 0x14001041f
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp - 8], r15
lea rsi, [rbp + 0x328]
mov qword [rbp], rsi
mov rdi, qword [rsi]
xor rdi, r15
mov qword [rbp - 0x10], rdi
mov qword [rsi], r13
lea rax, [rsp + 0x38]
mov qword [rsp + 0x30], rax
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], r13
mov r8d, 8
lea rdx, str.username
lea rcx, [rsp + 0x38]
call fcn.140002c30
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x70], r13
mov r8d, ntohl
mov rdx, r12
lea rcx, [rsp + 0x78]
call fcn.140002c30
nop
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x78]
call fcn.14000e300
xorps xmm0, xmm0
test al, al
jne 0x1400101a9
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x18], r15
lea r14, [rbp + 0x328]
mov qword [rbp + 0x20], r14
mov rbx, qword [r14]
xor rbx, r15
mov qword [rbp + 0x10], rbx
mov qword [r14], r13
lea rax, [rsp + 0x38]
mov qword [rsp + 0x30], rax
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], r13
mov r8d, 7
lea rdx, str.license
lea rcx, [rsp + 0x38]
call fcn.140002c30
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x70], r13
mov r8d, ntohl
mov rdx, r12
lea rcx, [rsp + 0x78]
call fcn.140002c30
nop
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x30]
call fcn.14000dd60
nop
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x58]
call fcn.140012890
mov rdx, rax
lea rcx, [0x14021d220]
call fcn.1400fe350
cmp byte [0x14021d430], 0
jne 0x14000fff1
lea rdx, str.Failed
lea rcx, [rsp + 0x58]
call fcn.140002bf0
mov rdx, rax
lea rcx, [0x14021d220]
call fcn.1400f7260
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rbp - 0x50]
call fcn.140011170
movzx edx, byte [rax + 0xa]
test dl, dl
je 0x14000ffc3
xor byte [rax], 0x36
xor byte [rax + 1], 0x37
xor byte [rax + 2], 0x38
xor byte [rax + 3], 0x39
xor byte [rax + 4], 0x3a
xor byte [rax + 5], 0x3b
xor byte [rax + 6], 0x3c
xor byte [rax + 7], 0x3d
xor byte [rax + 8], 0x3e
xor byte [rax + 9], 0x3f
xor dl, 0x40
mov byte [rax + 0xa], dl
mov rdx, rax
call fcn.140014ef0
mov rcx, rax
lea rdx, [0x14021d438]
call fcn.140015290
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
movsd xmm0, qword [str.wBLQ]
movsd qword [rbp - 0x50], xmm0
mov eax, dword [0x14019a068]
movabs al, byte fs:[0x5d3d80b845890018]
movabs al, byte [0x13a840f000018]
invalid
mov ecx, r13d
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x14001010e
movdqa xmm4, xmmword [0x1401a2fb0]
movdqa xmm2, xmmword [0x1401a27c0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1401a2810]
psubd xmm2, xmm0
andps xmm2, xmmword [0x1401a2880]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1401a2980]
movd xmm0, dword [str.wBLQ]
xorps xmm2, xmm0
movd dword [rbp - 0x50], xmm2
movdqa xmm2, xmmword [0x1401a27f0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1401a2810]
psubd xmm2, xmm0
andps xmm2, xmmword [0x1401a2880]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1401a2980]
movd xmm0, dword [rbp - 0x4c]
mov ah, reloc.WS2_32.dll_ntohs
push rdi
shl byte [rsi + 0xf], 1
jle 0x14001015d
mov ah, 0xb9
or byte [rax], al
add byte [rax], al
movsxd rax, ecx
lea r8, [rbp - 0x50]
add r8, rax
nop dword [rax + rax]
mov eax, 0xa0a0a0a1
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x33
movzx eax, cl
sub al, dl
add al, 0x36
xor byte [r8], al
inc ecx
lea r8, [r8 + 1]
cmp ecx, 0xc
jl 0x140010120
lea rdx, [rbp - 0x50]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014ef0
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x14001019e
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010198
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140010198
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140154404
nop
xor rbx, r15
mov qword [r14], rbx
jmp 0x140010414
lea rax, [rsp + 0x38]
mov qword [rsp + 0x30], rax
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], r13
mov r8d, 8
lea rdx, str.username
lea rcx, [rsp + 0x38]
call fcn.140002c30
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x70], r13
mov r8d, ntohl
mov rdx, r12
lea rcx, [rsp + 0x78]
call fcn.140002c30
nop
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x30]
call fcn.14000dd60
nop
lea rax, [rbp + 0x30]
mov qword [rsp + 0x30], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], r13
mov qword [rbp + 0x48], r13
mov r8d, 8
lea rdx, str.password
lea rcx, [rbp + 0x30]
call fcn.140002c30
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], r13
mov qword [rbp + 0x28], r13
mov r8d, ntohl
mov rdx, r12
lea rcx, [rbp + 0x10]
call fcn.140002c30
nop
lea r8, [rbp + 0x30]
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x50]
call fcn.14000dd60
nop
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea rdx, [rbp + 0x50]
lea rcx, [rsp + 0x58]
call fcn.140012890
mov rbx, rax
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x38]
call fcn.140012890
nop
mov r8, rbx
mov rdx, rax
lea rcx, [0x14021d220]
call fcn.1400fcce0
cmp byte [0x14021d430], 0
jne 0x140010386
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rdx, [rbp - 0x58]
call fcn.1400111a0
mov r8, rax
movzx eax, byte [rax + 6]
test al, al
je 0x1400102fe
xor byte [r8], 0x36
xor byte [r8 + 1], 0x37
xor byte [r8 + 2], 0x38
xor byte [r8 + 3], 0x39
xor byte [r8 + 4], 0x3a
xor byte [r8 + 5], 0x3b
xor al, 0x3c
mov byte [r8 + 6], al
lea rcx, [0x14021d438]
call fcn.140012710
mov r9d, reloc.WS2_32.dll_recv
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rbp - 0x50]
call fcn.1400111d0
movzx edx, byte [rax + 8]
test dl, dl
je 0x140010358
xor byte [rax], 0x36
xor byte [rax + 1], 0x37
xor byte [rax + 2], 0x38
xor byte [rax + 3], 0x39
xor byte [rax + 4], 0x3a
xor byte [rax + 5], 0x3b
xor byte [rax + 6], 0x3c
xor byte [rax + 7], 0x3d
xor dl, 0x3e
mov byte [rax + 8], dl
mov rdx, rax
call fcn.140014ef0
mov rcx, rax
lea rdx, [0x14021d438]
call fcn.140015290
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov rdx, qword [rbp + 0x68]
cmp rdx, 0xf
jbe 0x1400103c4
inc rdx
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400103bf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400103bf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140154404
movdqa xmm0, xmmword [0x1401a2750]
movdqu xmmword [rbp + 0x60], xmm0
mov byte [rbp + 0x50], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140010414
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001040e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001040e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140154404
nop
xor rdi, r15
mov qword [rsi], rdi
jmp 0x140010a87
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x18], r15
lea rax, [rbp + 0x328]
mov qword [rbp + 0x20], rax
mov rdi, qword [rax]
xor rdi, r15
mov qword [rbp + 0x10], rdi
mov qword [rax], r13
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], r13
mov qword [rbp + 0x48], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x30], 0
movups xmm0, xmmword [str.sYLHePT_Z.2c___hI]
movups xmmword [rbp - 0x10], xmm0
mov eax, dword [0x140199758]
mov dword [rbp], eax
cmp byte [0x14019975b], 0
je 0x1400105ee
mov ecx, r13d
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x1400105ac
movdqa xmm4, xmmword [0x1401a27c0]
movdqa xmm3, xmmword [0x1401a2fb0]
movdqa xmm5, xmmword [0x1401a2810]
movdqa xmm0, xmmword [0x1401a2980]
movdqa xmmword [rbp - 0x50], xmm0
lea rdx, [rbp - 0xc]
movdqa xmm6, xmmword [0x1401a2880]
mov r8d, dword [rbp - 0x50]
nop dword [rax]
movd xmm2, ecx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 4]
xorps xmm2, xmm0
movd dword [rdx - 4], xmm2
lea eax, [rcx + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx]
xorps xmm2, xmm0
movd dword [rdx], xmm2
add ecx, 8
lea rdx, [rdx + 8]
cmp ecx, 0x10
jl 0x1400104c0
cmp ecx, 0x14
jge 0x1400105ee
movsxd rax, ecx
lea r8, [rbp - 0x10]
add r8, rax
nop word [rax + rax]
mov eax, 0xa0a0a0a1
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x33
movzx eax, cl
sub al, dl
add al, 0x36
xor byte [r8], al
inc ecx
lea r8, [r8 + 1]
cmp ecx, 0x14
jl 0x1400105c0
lea rdx, [rbp - 0x10]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014ef0
lea rdx, [rbp + 0x30]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.1400152b0
lea rdx, [rbp + 0x30]
lea rcx, [rsp + 0x58]
call fcn.140012890
mov rdx, rax
lea rcx, [0x14021d220]
call fcn.1400fe350
cmp byte [0x14021d430], 0
jne 0x1400106e9
lea rcx, [rbp - 0x10]
call fcn.1400111f0
lea rdx, [rbp + 0x328]
lea rcx, [rbp - 0x10]
call fcn.14000d0b0
nop
lea rcx, [0x14021d220]
call fcn.140103750
lea rdx, str.Failed
lea rcx, [rsp + 0x58]
call fcn.140002bf0
mov rdx, rax
lea rcx, [0x14021d220]
call fcn.1400f7260
lea rdx, [rbp - 0x58]
call fcn.1400111a0
mov r8, rax
movzx eax, byte [rax + 6]
test al, al
je 0x1400106b5
xor byte [r8], 0x36
xor byte [r8 + 1], 0x37
xor byte [r8 + 2], 0x38
xor byte [r8 + 3], 0x39
xor byte [r8 + 4], 0x3a
xor byte [r8 + 5], 0x3b
xor al, 0x3c
mov byte [r8 + 6], al
lea rcx, [0x14021d438]
call fcn.140012710
mov r9d, reloc.WS2_32.dll_recv
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
xorps xmm0, xmm0
lea rsi, [rbp + 0x328]
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp], rsi
mov r14, qword [rsi]
mov qword [rbp - 8], r15
mov rax, r14
mov qword [rsi], r13
xor rax, r15
mov qword [rbp - 0x10], rax
cmp qword [rbp + 0x40], 0
jne 0x1400108ac
lea rcx, [0x14021d220]
call fcn.140103750
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], r13
mov qword [rbp + 0x68], r13
mov r8d, 7
lea rdx, str.Success
lea rcx, [rbp + 0x50]
call fcn.140002c30
lea rdx, [rbp + 0x50]
lea rcx, [0x14021d220]
call fcn.1400f7260
lea rax, [rbp + 0x50]
mov qword [rsp + 0x30], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], r13
mov qword [rbp + 0x68], r13
xor r8d, r8d
lea rdx, [0x140184ddd]
lea rcx, [rbp + 0x50]
call fcn.140002c30
nop
lea rax, [rsp + 0x38]
mov qword [rbp - 0x58], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], r13
xor r8d, r8d
lea rdx, [0x140184ddd]
lea rcx, [rsp + 0x38]
call fcn.140002c30
nop
lea rax, [rsp + 0x58]
mov qword [rbp - 0x68], rax
lea rdx, [rbp + 0x30]
lea rcx, [rsp + 0x58]
call fcn.140012890
mov rbx, rax
lea rax, [rsp + 0x78]
mov qword [rbp - 0x60], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x70], r13
mov r8d, 7
lea rdx, str.license
lea rcx, [rsp + 0x78]
call fcn.140002c30
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x18], r13
mov r8d, ntohl
mov rdx, r12
lea rcx, [rbp - 0x30]
call fcn.140002c30
nop
lea rax, [rbp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x30]
call fcn.14000e6a0
movsd xmm0, qword [0x140199720]
movsd qword [rbp - 0x50], xmm0
movzx edx, word [0x140199728]
mov word [rbp - 0x48], dx
movzx eax, byte [0x14019972a]
mov byte [rbp - 0x50], 0x41
xor byte [rbp - 0x4f], 0x37
xor byte [rbp - 0x4e], 0x38
xor byte [rbp - 0x4d], 0x39
xor byte [rbp - 0x4c], 0x3a
xor byte [rbp - 0x4b], 0x3b
xor byte [rbp - 0x4a], 0x3c
xor byte [rbp - 0x49], 0x3d
xor dl, 0x3e
mov byte [rbp - 0x48], dl
xor byte [rbp - 0x47], 0x3f
xor al, 0x40
mov byte [rbp - 0x46], al
lea rdx, [rbp - 0x50]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014ef0
nop
jmp 0x140010a38
lea rcx, [0x14021d220]
call fcn.140103750
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x18], r13
mov r8d, 7
lea rdx, str.Success
lea rcx, [rbp - 0x30]
call fcn.140002c30
lea rdx, [rbp - 0x30]
lea rcx, [0x14021d220]
call fcn.1400f7260
lea rax, [rbp - 0x30]
mov qword [rbp - 0x50], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x18], r13
xor r8d, r8d
lea rdx, [0x140184ddd]
lea rcx, [rbp - 0x30]
call fcn.140002c30
nop
lea rax, [rbp + 0x50]
mov qword [rbp - 0x60], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], r13
mov qword [rbp + 0x68], r13
xor r8d, r8d
lea rdx, [0x140184ddd]
lea rcx, [rbp + 0x50]
call fcn.140002c30
nop
lea rax, [rsp + 0x58]
mov qword [rbp - 0x68], rax
lea rdx, [rbp + 0x30]
lea rcx, [rsp + 0x58]
call fcn.140012890
mov rbx, rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x30], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], r13
mov r8d, 7
lea rdx, str.license
lea rcx, [rsp + 0x38]
call fcn.140002c30
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x70], r13
mov r8d, ntohl
mov rdx, r12
lea rcx, [rsp + 0x78]
call fcn.140002c30
nop
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x78]
call fcn.14000e6a0
movsd xmm0, qword [0x140199720]
movsd qword [rbp - 0x50], xmm0
movzx edx, word [0x140199728]
mov word [rbp - 0x48], dx
movzx eax, byte [0x14019972a]
mov byte [rbp - 0x50], 0x41
xor byte [rbp - 0x4f], 0x37
xor byte [rbp - 0x4e], 0x38
xor byte [rbp - 0x4d], 0x39
xor byte [rbp - 0x4c], 0x3a
xor byte [rbp - 0x4b], 0x3b
xor byte [rbp - 0x4a], 0x3c
xor byte [rbp - 0x49], 0x3d
xor dl, 0x3e
mov byte [rbp - 0x48], dl
xor byte [rbp - 0x47], 0x3f
xor al, 0x40
mov byte [rbp - 0x46], al
lea rdx, [rbp - 0x50]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014ef0
nop
mov qword [rsi], r14
mov rdx, qword [rbp + 0x48]
cmp rdx, 0xf
jbe 0x140010a7a
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010a74
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140010a74
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140154404
nop
xor rdi, r15
lea rax, [rbp + 0x328]
mov qword [rax], rdi
lea rax, [rbp + 0xd0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, Ordinal_32
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rbp + 0x30], xmm0
movdqu xmmword [rbp + 0x40], xmm1
test eax, eax
js 0x140010ae4
lea rax, [rbp + 0xd0]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140010ad0
lea rdx, [rbp + 0xd0]
jmp 0x140010aee
xor r8d, r8d
lea rdx, [0x140184f60]
lea rcx, [rbp + 0x30]
call fcn.140015ac0
nop
lea r8, str._stellar
lea rdx, [rbp + 0x30]
lea rcx, [rbp - 0x30]
call fcn.1400154c0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x78], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov qword [rbp - 0x50], r13
lea rdi, [0x1401c0118]
mov qword [rbp - 0x48], rdi
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x78]
call fcn.140003a50
movzx ebx, al
cmp dword [rbp - 0x50], 0
je 0x140010b79
lea r8, [rsp + 0x78]
lea rdx, [rbp - 0x50]
lea rcx, str.exists
call fcn.1400039f0
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 7
jbe 0x140010bbd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010bb8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140010bb8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140154404
movdqa xmm0, xmmword [0x1401a2720]
movdqu xmmword [rbp - 0x78], xmm0
mov word [rsp + 0x78], r13w
mov rdx, qword [rbp - 0x18]
cmp rdx, 7
jbe 0x140010c13
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010c0e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140010c0e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140154404
test bl, bl
jne 0x140010d29
lea r8, str._stellar
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x50]
call fcn.1400154c0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x20], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x20], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
lea rcx, [rbp + 0x10]
cmp qword [rbp + 0x28], 7
cmova rcx, qword [rbp + 0x10]
call fcn.140155670
mov rdx, rax
shr rax, 0x20
test eax, eax
je 0x140010c91
shr rdx, 0x20
lea r8, [rbp + 0x10]
lea rcx, str.create_directory
call fcn.140003900
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 7
jbe 0x140010cd4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010ccf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140010ccf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140154404
movdqa xmm0, xmmword [0x1401a2720]
movdqu xmmword [rbp + 0x20], xmm0
mov word [rbp + 0x10], r13w
mov rdx, qword [rbp + 0x68]
cmp rdx, 7
jbe 0x140010d29
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010d24
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140010d24
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140154404
lea r8, str._stellarconfigs
lea rdx, [rbp + 0x30]
lea rcx, [rsp + 0x58]
call fcn.1400154c0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x48], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], rdi
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x38]
call fcn.140003a50
movzx ebx, al
cmp dword [rbp - 0x50], 0
je 0x140010da6
lea r8, [rsp + 0x38]
lea rdx, [rbp - 0x50]
lea rcx, str.exists
call fcn.1400039f0
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 7
jbe 0x140010deb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010de6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140010de6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140154404
movdqa xmm0, xmmword [0x1401a2720]
movdqu xmmword [rsp + 0x48], xmm0
mov word [rsp + 0x38], r13w
mov rdx, qword [rsp + 0x70]
cmp rdx, 7
jbe 0x140010e44
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010e3f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140010e3f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140154404
test bl, bl
jne 0x140010f5a
lea r8, str._stellarconfigs
lea rdx, [rbp + 0x30]
lea rcx, [rbp - 0x50]
call fcn.1400154c0
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 7
cmova rcx, qword [rbp - 0x10]
call fcn.140155670
mov rdx, rax
shr rax, 0x20
test eax, eax
je 0x140010ec2
shr rdx, 0x20
lea r8, [rbp - 0x10]
lea rcx, str.create_directory
call fcn.140003900
nop
mov rdx, qword [rbp + 8]
cmp rdx, 7
jbe 0x140010f05
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010f00
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140010f00
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140154404
movdqa xmm0, xmmword [0x1401a2720]
movdqu xmmword [rbp], xmm0
mov word [rbp - 0x10], r13w
mov rdx, qword [rbp - 0x38]
cmp rdx, 7
jbe 0x140010f5a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010f55
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140010f55
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140154404
xor r14b, r14b
mov rdi, qword [0x14021d400]
mov r15, qword [0x14021d408]
cmp rdi, r15
je 0x1400110a8
nop dword [rax]
nop dword [rax + rax]
mov rdx, rdi
lea rcx, [rbp + 0x90]
call fcn.140012890
nop
lea rdx, [rdi + 0x20]
lea rcx, [rbp + 0xb0]
call fcn.140012890
nop
lea rax, [rbp + 0x90]
mov rbx, qword [rbp + 0x90]
mov rsi, qword [rbp + 0xa8]
cmp rsi, 0xf
cmova rax, rbx
cmp qword [rbp + 0xa0], 7
jne 0x1400110ba
cmp dword [rax], 0x61666564
jne 0x1400110ba
cmp word [rax + 4], 0x6c75
jne 0x1400110ba
cmp byte [rax + 6], 0x74
jne 0x1400110ba
test r14b, r14b
jne 0x14001102b
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x18], r13
mov r8d, reloc.WS2_32.dll_setsockopt
lea rdx, str.Success_AUTH_CHECK_OP
lea rcx, [rbp - 0x30]
call fcn.140002c30
lea rdx, [rbp - 0x30]
lea rcx, [0x14021d220]
call fcn.1400f7260
mov r14b, 1
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0xf
jbe 0x140011068
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011063
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400110b3
call fcn.140154404
cmp rsi, 0xf
jbe 0x14001109b
lea rdx, [rsi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140011093
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400110b3
mov rcx, rbx
call fcn.140154404
add rdi, 0x40
cmp rdi, r15
jne 0x140010f80
call fcn.14007d3a0
call fcn.14007e9a0
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov r9d, Ordinal_50
lea r8, str.ERROR
lea rdx, str.Real
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, str.https:__www.youtube.com_watch_vdQw4w9WgXcQ
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rdx, str.Failed_to_pass_auth_check
lea rcx, [rsp + 0x58]
call fcn.140002bf0
mov rdx, rax
lea rcx, [0x14021d220]
call fcn.1400f7260
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov r9d, Ordinal_50
lea r8, str.ERROR
lea rdx, str.Real
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, str.https:__www.youtube.com_watch_vdQw4w9WgXcQ
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3