Function at 0x14002f900
Capabilities:
Access peb ldr_data
Authenticate hmac
Check for time delay via queryperformancecounter
Encode data using xor
Get number of processors
Hash data using fnv
Log keystrokes via polling
Move file
Resolve function by parsing pe exports
Resume thread
Set console window title
Terminate process

Disassembly:
push rbp
push r13
lea rbp, [rsp - 0x438]
sub rsp, 0x538
mov rax, qword [0x1400c1080]
xor rax, rsp
mov qword [rbp + 0x3e0], rax
mov r13, rcx
mov qword [rbp], rcx
lea rcx, [0x1400c5d60]
call fcn.140044380
call fcn.14002ddd0
test al, al
je 0x1400301d7
xorps xmm0, xmm0
mov qword [rsp + 0x568], rdi
xor eax, eax
mov qword [0x1400c5d28], 0
mov r8d, 0x104
mov byte [0x1400c6030], al
lea rdx, [rbp + 0x2d0]
mov dword [0x1400c5d08], eax
xor ecx, ecx
mov qword [0x1400c5d48], rax
movdqu xmmword [0x1400c5fd8], xmm0
mov dword [0x1400c5d50], eax
movups xmmword [0x1400c5ff0], xmm0
mov byte [0x1400c5d54], al
movups xmmword [0x1400c6000], xmm0
mov word [0x1400c5d30], 0
movups xmmword [0x1400c6010], xmm0
mov byte [0x1400c5d32], 0
movups xmmword [0x1400c6020], xmm0
movups xmmword [0x1400c5d38], xmm0
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rax, [rbp + 0x2d0]
mov rdi, 0xffffffffffffffff
nop dword [rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x14002f9e0
call fcn.14009be10
lea rcx, [rbp + 0x2d0]
mov qword [rbp + 0x108], rdi
mov qword [rbp + 0x100], rcx
lea r8, [rbp + 0x100]
lea rcx, [rbp - 0x28]
mov edx, eax
call fcn.140022720
mov rax, qword [rbp - 0x18]
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 7
cmova rcx, qword [rbp - 0x28]
lea r10, [rcx + rax*2]
mov rdx, r10
mov rdi, r10
call fcn.140022890
cmp rax, r10
je 0x14002fa5c
nop dword [rax + rax]
movzx edx, word [rdi - 2]
lea rcx, [rdi - 2]
cmp dx, 0x5c
je 0x14002fa5c
cmp dx, 0x2f
je 0x14002fa5c
mov rdi, rcx
cmp rax, rcx
jne 0x14002fa40
sub r10, rdi
lea rcx, [rbp + 0x1c0]
sar r10, 1
xorps xmm0, xmm0
xorps xmm1, xmm1
mov r8, r10
mov rdx, rdi
movups xmmword [rbp + 0x1c0], xmm0
movdqu xmmword [rbp + 0x1d0], xmm1
call fcn.1400344d0
mov rdx, qword [rbp - 0x10]
cmp rdx, 7
jbe 0x14002facc
mov rcx, qword [rbp - 0x28]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002fac7
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002fac7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009afc0
movdqa xmm0, xmmword [0x1400b1a00]
lea rdx, [rbp + 0x1a0]
mov rcx, qword [0x1400c2500]
mov qword [rsp + 0x558], rbx
mov qword [rsp + 0x520], r15
xor r15d, r15d
mov word [rbp - 0x28], r15w
movdqu xmmword [rbp - 0x18], xmm0
call fcn.140023cd0
mov cl, 0x25
mov byte [rbp + 0xf0], 0x40
mov al, WSAGetLastError
movzx edi, cl
xor al, 0x40
xor cl, 0x40
xor r8d, r8d
mov byte [rbp + 0xf1], al
mov dl, gethostname
mov byte [rbp + 0xf2], cl
xor dl, 0x40
mov byte [rbp + 0xf5], r8b
xor dil, 0x40
mov byte [rbp + 0xf3], dl
mov byte [rbp + 0xf4], dil
lea rax, [rbp + 0xf1]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], r8b
jne 0x14002fb51
mov rdx, qword [rbp + 0x1b8]
mov rcx, qword [rbp + 0x1b0]
mov rax, rdx
sub rax, rcx
cmp rbx, rax
ja 0x14002fbac
cmp rdx, 0xf
lea rax, [rbx + rcx]
lea rdi, [rbp + 0x1a0]
mov qword [rbp + 0x1b0], rax
cmova rdi, qword [rbp + 0x1a0]
lea rdx, [rbp + 0xf1]
add rdi, rcx
mov r8, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rdi], r15b
jmp 0x14002fbc7
lea r9, [rbp + 0xf1]
mov qword [rsp + 0x20], rbx
mov rdx, rbx
lea rcx, [rbp + 0x1a0]
call fcn.140034990
cmp qword [rbp + 0x1b8], 0xf
lea rdi, [rbp + 0x1a0]
lea rax, [rbp + 0x1c0]
cmova rdi, qword [rbp + 0x1a0]
cmp qword [rbp + 0x1d8], 7
cmova rax, qword [rbp + 0x1c0]
mov qword [rbp + 0x100], rax
mov rax, qword [rbp + 0x1d0]
mov qword [rbp + 0x108], rax
call fcn.14009be10
movaps xmm0, xmmword [rbp + 0x100]
lea r8, [rbp + 0x100]
mov edx, eax
movdqa xmmword [rbp + 0x100], xmm0
lea rcx, [rbp + 0x180]
call fcn.1400341f0
cmp qword [rbp + 0x198], 0xf
lea rcx, [rbp + 0x180]
mov rdx, rdi
cmova rcx, qword [rbp + 0x180]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_rename]
mov rdx, qword [rbp + 0x198]
cmp rdx, 0xf
jbe 0x14002fc97
mov rcx, qword [rbp + 0x180]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002fc92
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002fc92
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009afc0
mov qword [rsp + 0x560], rsi
lea rax, [0x140032890]
mov qword [rsp + 0x530], r12
lea rdi, str.b3824d3d3fddf0da
mov qword [rsp + 0x528], r14
mov edx, 0x7f00
movaps xmmword [rsp + 0x510], xmm6
xor ecx, ecx
movaps xmmword [rsp + 0x500], xmm7
movaps xmmword [rsp + 0x4f0], xmm8
mov qword [rbp + 0x120], 3
mov qword [rbp + 0x130], r15
mov qword [rbp + 0x158], r15
mov qword [rbp + 0x128], rax
mov qword [rbp + 0x138], r13
mov qword [rbp + 0x160], rdi
call qword [sym.imp.USER32.dll_LoadCursorA]
mov edx, 0x65
mov qword [rbp + 0x150], recv
mov rcx, r13
mov qword [rbp + 0x148], rax
call qword [sym.imp.USER32.dll_LoadIconA]
lea rcx, [rbp + 0x120]
mov qword [rbp + 0x140], rax
call qword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
jne 0x14002fdf8
mov rdx, qword [rbp + 0x1b8]
cmp rdx, 0xf
jbe 0x14002fd8f
mov rcx, qword [rbp + 0x1a0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002fd8a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032872
call fcn.14009afc0
mov rdx, qword [rbp + 0x1d8]
mov qword [rbp + 0x1b0], r15
mov qword [rbp + 0x1b8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x1a0], r15b
cmp rdx, 7
jbe 0x14002fdee
mov rcx, qword [rbp + 0x1c0]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002fde9
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032872
call fcn.14009afc0
mov eax, 1
jmp 0x14003018e
xorps xmm0, xmm0
lea rdx, str.SHK_
xorps xmm1, xmm1
lea rcx, [rbp + 0x120]
mov r8d, 4
movups xmmword [rbp + 0x120], xmm0
movdqu xmmword [rbp + 0x130], xmm1
call fcn.140034b20
lea r8, [rbp + 0x120]
lea rdx, [rbp + 0x200]
call fcn.1400241c0
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
lea rdx, [rbp + 0x268]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rbp + 0x270]
mov r9d, 0x80000000
cdq
mov qword [rsp + 0x58], r15
sub eax, edx
mov qword [rsp + 0x50], r13
sar eax, 1
mov r8, rdi
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x38], 0x190
lea ecx, [rax - 0x96]
mov dword [rsp + 0x30], 0x258
mov eax, dword [rbp + 0x274]
cdq
sub eax, edx
mov rdx, rdi
sar eax, 1
sub eax, 0x4b
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rsi, rax
test rax, rax
jne 0x14002ffbc
mov rdx, qword [rbp + 0x218]
cmp rdx, 0xf
jbe 0x14002fefb
mov rcx, qword [rbp + 0x200]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002fef6
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032872
call fcn.14009afc0
mov rdx, qword [rbp + 0x1b8]
movdqa xmm0, xmmword [0x1400b1a10]
mov byte [rbp + 0x200], r15b
movdqu xmmword [rbp + 0x210], xmm0
cmp rdx, 0xf
jbe 0x14002ff53
mov rcx, qword [rbp + 0x1a0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002ff4e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032872
call fcn.14009afc0
mov rdx, qword [rbp + 0x1d8]
mov qword [rbp + 0x1b0], r15
mov qword [rbp + 0x1b8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x1a0], r15b
cmp rdx, 7
jbe 0x14002ffb2
mov rcx, qword [rbp + 0x1c0]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002ffad
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032872
call fcn.14009afc0
mov eax, 2
jmp 0x14003018e
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call qword [sym.imp.d3d9.dll_Direct3DCreate9]
mov qword [rbp - 8], rax
mov r14, rax
test rax, rax
jne 0x14002ffdf
mov rdx, r13
mov rcx, rdi
call qword [sym.imp.USER32.dll_UnregisterClassA]
lea rcx, [0x1400c60e8]
mov qword [0x1400c60f0], r15
mov qword [rsp + 0x30], rcx
xor edx, edx
mov qword [0x1400c60fc], r15
lea rcx, [0x1400c60f0]
mov qword [rsp + 0x28], rcx
mov r9, rsi
mov dword [0x1400c6104], r15d
mov rcx, r14
mov qword [0x1400c610c], r15
lea r8d, [rdx + 1]
mov dword [0x1400c6114], r15d
mov qword [0x1400c6124], r15
mov dword [0x1400c6118], 1
mov dword [0x1400c6108], 1
mov dword [0x1400c60f8], r15d
mov dword [0x1400c611c], 1
mov dword [0x1400c6120], 0x50
mov dword [0x1400c612c], 1
mov rax, qword [r14]
mov dword [rsp + 0x20], 0x40
call qword [rax + 0x80]
test eax, eax
jns 0x1400301f1
mov rax, qword [r14]
mov rcx, r14
call qword [rax + reloc.WS2_32.dll_recv]
mov rdx, r13
mov rcx, rdi
call qword [sym.imp.USER32.dll_UnregisterClassA]
mov rdx, qword [rbp + 0x218]
cmp rdx, 0xf
jbe 0x1400300d5
mov rcx, qword [rbp + 0x200]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400300d0
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032872
call fcn.14009afc0
mov rdx, qword [rbp + 0x1b8]
movdqa xmm0, xmmword [0x1400b1a10]
mov byte [rbp + 0x200], r15b
movdqu xmmword [rbp + 0x210], xmm0
cmp rdx, 0xf
jbe 0x14003012d
mov rcx, qword [rbp + 0x1a0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140030128
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032872
call fcn.14009afc0
mov rdx, qword [rbp + 0x1d8]
mov qword [rbp + 0x1b0], r15
mov qword [rbp + 0x1b8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x1a0], r15b
cmp rdx, 7
jbe 0x14003018c
mov rcx, qword [rbp + 0x1c0]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140030187
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032872
call fcn.14009afc0
xor eax, eax
movaps xmm7, xmmword [rsp + 0x500]
movaps xmm6, xmmword [rsp + 0x510]
mov rsi, qword [rsp + 0x560]
mov r14, qword [rsp + 0x528]
mov r12, qword [rsp + 0x530]
movaps xmm8, xmmword [rsp + 0x4f0]
mov rbx, qword [rsp + 0x558]
mov r15, qword [rsp + 0x520]
mov rdi, qword [rsp + 0x568]
mov rcx, qword [rbp + 0x3e0]
xor rcx, rsp
call fcn.14009ab70
add rsp, 0x538
pop r13
pop rbp
ret
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov ebx, dword [rcx + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140030284
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140030284
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
mov edi, 0x811c9dc5
lea rcx, [r11 + r8*4]
mov edx, dword [rcx + r9]
add rdx, r9
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14003027f
nop dword [rax]
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, edi
imul edi, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x140030260
cmp edi, 0x60ac7e39
je 0x140030289
test r8d, r8d
jne 0x140030240
mov rax, qword [rax]
jmp 0x140030210
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
lea r8, [0x14002f800]
mov ecx, dword [rbx + 0x1c]
xor ebx, ebx
add rcx, r9
mov eax, dword [rcx + rdx*4]
lea rcx, [0x1400c2610]
mov qword [rsp + 0x28], rcx
add rax, r9
xor ecx, ecx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor edx, edx
call rax
mov rdx, qword [0x1400c5d18]
cmp rdx, qword [0x1400c5d20]
mov qword [rbp + 0x110], rax
je 0x1400302e6
mov qword [rdx], rax
add qword [0x1400c5d18], 8
jmp 0x1400302f2
lea r8, [rbp + 0x110]
call fcn.1400355a0
mov rax, qword [0x1400c60e8]
lea rcx, [0x1400c60e0]
mov qword [0x1400c60c0], rax
mov qword [0x1400c60d0], rsi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x1400303db
lea rcx, [0x1400c60d8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x1400303db
mov rdi, qword [str.__f_]
lea rax, [0x140020790]
mov qword [rdi + 0xc8], rax
mov rax, qword [0x1400c60d0]
mov qword [rdi + 0x100], rax
mov dword [rdi + 0x34], 9
mov dword [rdi + 0x38], Ordinal_41
mov dword [rdi + 0x3c], Ordinal_45
mov dword [rdi + 0x40], Ordinal_41
mov dword [rdi + 0x44], Ordinal_46
mov dword [rdi + 0x48], reloc.WLDAP32.dll_Ordinal_33
mov dword [rdi + 0x4c], Ordinal_35
mov dword [rdi + 0x50], Ordinal_41
mov dword [rdi + 0x54], reloc.WLDAP32.dll_Ordinal_35
mov dword [rdi + 0x58], reloc.WLDAP32.dll_Ordinal_46
mov dword [rdi + 0x5c], 8
mov dword [rdi + 0x60], reloc.WS2_32.dll_listen
mov dword [rdi + 0x64], reloc.WLDAP32.dll_Ordinal_27
mov dword [rdi + 0x68], 0x41
mov dword [rdi + 0x6c], 0x43
mov dword [rdi + 0x70], 0x56
mov dword [rdi + 0x74], 0x58
mov dword [rdi + 0x78], 0x59
mov dword [rdi + 0x7c], 0x5a
jmp 0x1400303e2
mov rdi, qword [str.__f_]
mov qword [rdi + 0x18], rbx
mov dword [rdi + 0x1480], 0x3f800000
mov dword [rdi + 0x1484], 0x3f800000
mov dword [rdi + 0x1488], 0x3f800000
mov dword [rdi + 0x148c], 0x3f800000
mov dword [rdi + 0x1490], 0x3f000000
mov dword [rdi + 0x1494], 0x3f000000
mov dword [rdi + 0x1498], 0x3f000000
mov dword [rdi + 0x149c], 0x3f800000
mov dword [rdi + 0x14a0], 0x3dcccccd
mov dword [rdi + 0x14a4], 0x3dcccccd
mov dword [rdi + 0x14a8], 0x3dcccccd
mov dword [rdi + 0x14ac], 0x3f800000
mov dword [rdi + 0x14c0], 0x3e428f5c
mov dword [rdi + 0x14c4], 0x3e428f5c
mov dword [rdi + 0x14c8], 0x3e428f5c
mov dword [rdi + 0x14cc], 0x3f6b851f
mov dword [rdi + 0x14d0], 0x3e428f5c
mov dword [rdi + 0x14d4], 0x3e428f5c
mov dword [rdi + 0x14d8], 0x3e428f5c
mov qword [rdi + 0x14dc], 0x3e947ae1
mov qword [rdi + 0x14e4], rbx
mov dword [rdi + 0x14ec], 0x3e75c28f
mov dword [rdi + 0x14f0], 0x3d4ccccd
mov dword [rdi + 0x14f4], 0x3d4ccccd
mov dword [rdi + 0x14f8], 0x3d4ccccd
mov dword [rdi + 0x14fc], 0x3f0a3d71
mov dword [rdi + 0x1500], 0x3e428f5c
mov dword [rdi + 0x1504], 0x3e428f5c
mov dword [rdi + 0x1508], 0x3e428f5c
mov dword [rdi + 0x150c], 0x3f0a3d71
mov dword [rdi + 0x1510], 0x3e4ccccd
mov dword [rdi + 0x1514], 0x3e6147ae
mov dword [rdi + 0x1518], 0x3e6b851f
mov qword [rdi + 0x151c], 0x3f800000
mov qword [rdi + 0x1524], rbx
mov qword [rdi + 0x152c], 0x3f800000
mov dword [rdi + 0x1540], 0x3d75c28f
mov dword [rdi + 0x1544], 0x3d75c28f
mov dword [rdi + 0x1548], 0x3d75c28f
mov dword [rdi + 0x154c], 0x3f800000
mov qword [rdi + 0x1534], rbx
mov dword [rdi + 0x153c], 0x3f800000
mov dword [rdi + 0x1550], 0x3e0f5c29
mov dword [rdi + 0x1554], 0x3e0f5c29
mov dword [rdi + 0x1558], 0x3e0f5c29
mov dword [rdi + 0x155c], 0x3f800000
mov dword [rdi + 0x1560], 0x3d4ccccd
mov dword [rdi + 0x1564], 0x3d4ccccd
mov dword [rdi + 0x1568], 0x3d4ccccd
mov dword [rdi + 0x156c], 0x3f0a3d71
mov dword [rdi + 0x1570], 0x3eae147b
mov dword [rdi + 0x1574], 0x3eae147b
mov dword [rdi + 0x1578], 0x3eae147b
mov dword [rdi + 0x157c], 0x3f0a3d71
mov dword [rdi + 0x1580], 0x3ecccccd
mov dword [rdi + 0x1584], 0x3ecccccd
mov dword [rdi + 0x1588], 0x3ecccccd
mov dword [rdi + 0x158c], 0x3f0a3d71
mov dword [rdi + 0x1590], 0x3f0f5c29
mov dword [rdi + 0x1594], 0x3f0f5c29
mov dword [rdi + 0x1598], 0x3f0f5c29
mov dword [rdi + 0x159c], 0x3f0a3d71
mov dword [rdi + 0x15b0], 0x3ea8f5c3
mov dword [rdi + 0x15b4], 0x3f2b851f
mov dword [rdi + 0x15b8], 0x3f5c28f6
mov dword [rdi + 0x15bc], 0x3f800000
mov dword [rdi + 0x15c0], 0x3eae147b
mov dword [rdi + 0x15c4], 0x3eae147b
mov dword [rdi + 0x15c8], 0x3eae147b
mov dword [rdi + 0x15cc], 0x3f0a3d71
mov dword [rdi + 0x15d0], 0x3f0f5c29
mov dword [rdi + 0x15d4], 0x3f0f5c29
mov dword [rdi + 0x15d8], 0x3f0f5c29
mov dword [rdi + 0x15dc], 0x3f0a3d71
mov dword [rdi + 0x15e0], 0x3d4ccccd
mov dword [rdi + 0x15e4], 0x3d4ccccd
mov dword [rdi + 0x15e8], 0x3d4ccccd
mov dword [rdi + 0x15ec], 0x3f0a3d71
mov dword [rdi + 0x15f0], 0x3e428f5c
mov dword [rdi + 0x15f4], 0x3e428f5c
mov dword [rdi + 0x15f8], 0x3e428f5c
mov dword [rdi + 0x15fc], 0x3f0a3d71
mov dword [rdi + 0x1600], 0x3e4ccccd
mov dword [rdi + 0x1604], 0x3e6147ae
mov dword [rdi + 0x1608], 0x3e6b851f
mov qword [rdi + 0x160c], 0x3f800000
mov qword [rdi + 0x1614], rbx
mov qword [rdi + 0x161c], 0x3f051eb8
mov qword [rdi + 0x1624], rbx
mov dword [rdi + 0x162c], 0x3eb851ec
mov dword [rdi + 0x1630], 0x3e4ccccd
mov dword [rdi + 0x1634], 0x3e6147ae
mov dword [rdi + 0x1638], 0x3e6b851f
mov dword [rdi + 0x163c], 0x3ea8f5c3
mov dword [rdi + 0x1670], 0x3e8f5c29
mov dword [rdi + 0x1674], 0x3e8f5c29
mov dword [rdi + 0x1678], 0x3e8f5c29
mov dword [rdi + 0x167c], 0x3e947ae1
mov dword [rdi + 0x1680], 0x3ee147ae
mov dword [rdi + 0x1684], 0x3ee147ae
mov dword [rdi + 0x1688], 0x3ee147ae
mov dword [rdi + 0x168c], 0x3e947ae1
mov dword [rdi + 0x1690], 0x3ecccccd
mov dword [rdi + 0x1694], 0x3ee147ae
mov dword [rdi + 0x1698], 0x3ef0a3d7
mov dword [rdi + 0x169c], 0x3f800000
mov qword [rdi + 0x16d0], 0x3f800000
mov dword [rdi + 0x16d8], ebx
mov dword [rdi + 0x16dc], 0x3f800000
mov qword [rdi + 0x16e0], 0x3f800000
mov dword [rdi + 0x16e8], ebx
mov dword [rdi + 0x16ec], 0x3f800000
mov qword [rdi + 0x16f0], 0x3f800000
mov dword [rdi + 0x16f8], ebx
mov dword [rdi + 0x16fc], 0x3f800000
mov qword [rdi + 0x1700], 0x3f800000
mov dword [rdi + 0x1708], ebx
mov dword [rdi + 0x170c], 0x3f800000
mov dword [rdi + 0x1710], 0x3e4ccccd
mov dword [rdi + 0x1714], 0x3e6147ae
mov dword [rdi + 0x1718], 0x3e6b851f
mov dword [rdi + 0x171c], 0x3f800000
mov dword [rdi + 0x1414], ebx
mov dword [rdi + 0x142c], 0x40c00000
call qword [sym.imp.KERNEL32.dll_AllocConsole]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9, rax
lea r8, [0x1400b13fc]
lea rdx, str.CONOUT_
lea rcx, [rbp + 0x170]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_freopen_s]
mov eax, dword [str.VVV_Q7]
xorps xmm0, xmm0
mov dword [rbp + 0xf0], eax
xorps xmm1, xmm1
movzx eax, word [0x1400b1670]
mov r8, 0xffffffffffffffff
xor byte [rbp + 0xf1], 0x33
xor byte [rbp + 0xf2], 0x34
xor byte [rbp + 0xf3], 0x35
mov word [rbp + 0xf4], ax
xor al, 0x36
xor byte [rbp + 0xf5], 0x37
mov byte [rbp + 0xf4], al
lea rax, [rbp + 0xf0]
mov byte [rbp + 0xf0], 0x64
movups xmmword [rbp + 0x248], xmm0
movdqu xmmword [rbp + 0x258], xmm1
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], bl
jne 0x140030940
lea rdx, [rbp + 0xf0]
lea rcx, [rbp + 0x248]
call fcn.140034b20
cmp qword [rbp + 0x260], 0xf
lea rcx, [rbp + 0x248]
cmova rcx, qword [rbp + 0x248]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
movups xmm0, xmmword [str.q_thb_YVMH_nQY461_]
movzx eax, word [0x1400b1668]
mov r8d, ebx
movups xmm1, xmmword [0x1400b1648]
mov r12d, dword [reloc.WS2_32.dll_accept]
mov word [rbp + 0x150], ax
movups xmmword [rbp + 0x120], xmm0
movups xmm0, xmmword [0x1400b1658]
movups xmmword [rbp + 0x130], xmm1
movups xmmword [rbp + 0x140], xmm0
cmp r12d, 2
jl 0x140030b07
movdqa xmm0, xmmword [0x1400b1bf0]
lea rcx, [rbp + 0x124]
movdqa xmm5, xmmword [0x1400b1a50]
movdqa xmm4, xmmword [0x1400b1c80]
movdqa xmm6, xmmword [0x1400b1a70]
movdqa xmmword [rbp + 0xf0], xmm0
mov edx, dword [rbp + 0xf0]
nop word [rax + rax]
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add r8d, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1400b1b30]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rcx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, edx
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400b1b30]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 8]
xorps xmm2, xmm0
movd dword [rcx - 8], xmm2
cmp r8d, 0x30
jl 0x140030a00
cmp r8d, 0x32
jge 0x140030b51
movsxd rax, r8d
lea r9, [rbp + 0x120]
add r9, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x5397829d
lea r9, [r9 + 1]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x31
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9 - 1], al
cmp r8d, 0x32
jl 0x140030b20
movsd xmm0, qword [str.TZA]
lea rdx, [rbp + 0x30]
movzx eax, byte [0x1400b1758]
lea rdx, [rdx + 0x80]
movsd qword [rsp + 0x60], xmm0
lea rcx, [0x140000000]
movups xmm0, xmmword [rcx + 0xb1540]
xor byte [rsp + 0x61], 0x33
lea rcx, [rcx + 0xb1540]
movups xmm1, xmmword [rcx + 0x10]
xor byte [rsp + 0x62], 0x34
xor al, 0x3a
xor byte [rsp + 0x63], 0x35
mov r8d, ebx
xor byte [rsp + 0x64], 0x36
xor byte [rsp + 0x65], 0x37
xor byte [rsp + 0x66], 0x38
xor byte [rsp + 0x67], 0x39
mov byte [rsp + 0x68], al
mov rax, qword [rcx + 0xb0]
mov byte [rsp + 0x60], 0x66
movups xmmword [rdx - 0x80], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx - 0x70], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx - 0x60], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx - 0x50], xmm1
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx - 0x40], xmm0
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx - 0x30], xmm1
movups xmm1, xmmword [rcx + 0x80]
movups xmmword [rdx - 0x20], xmm0
movups xmm0, xmmword [rcx + 0x70]
movups xmmword [rdx - 0x10], xmm0
movups xmm0, xmmword [rcx + 0x90]
movups xmmword [rdx], xmm1
movups xmm1, xmmword [rcx + 0xa0]
movups xmmword [rdx + 0x10], xmm0
movups xmmword [rdx + 0x20], xmm1
mov qword [rdx + 0x30], rax
movzx eax, byte [rcx + 0xb8]
mov byte [rdx + 0x38], al
cmp r12d, 2
jl 0x140030d7d
movdqa xmm0, xmmword [0x1400b1bf0]
lea rcx, [rbp + 0x34]
movdqa xmm5, xmmword [0x1400b1a50]
movdqa xmm4, xmmword [0x1400b1c80]
movdqa xmm6, xmmword [0x1400b1a70]
movdqa xmmword [rbp + 0xf0], xmm0
mov edx, dword [rbp + 0xf0]
nop dword [rax]
nop dword [rax + rax]
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add r8d, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1400b1b30]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rcx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, edx
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400b1b30]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 8]
xorps xmm2, xmm0
movd dword [rcx - 8], xmm2
cmp r8d, 0xb8
jl 0x140030c70
cmp r8d, 0xb9
jge 0x140030dc4
movsxd rax, r8d
lea r9, [rbp + 0x30]
add r9, rax
nop word [rax + rax]
mov eax, 0x5397829d
lea r9, [r9 + 1]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x31
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9 - 1], al
cmp r8d, 0xb9
jl 0x140030d90
lea r8, [rbp + 0x120]
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x30]
call fcn.1400246e0
movups xmm0, xmmword [0x1400b1498]
movups xmmword [rsp + 0x60], xmm0
psrldq xmm0, 0xf
movd eax, xmm0
test al, al
je 0x140030f81
cmp r12d, 2
jl 0x140030f41
movdqa xmm0, xmmword [0x1400b1bf0]
lea rcx, [rsp + 0x64]
movdqa xmm5, xmmword [0x1400b1a50]
mov edx, ebx
movdqa xmm4, xmmword [0x1400b1c80]
movdqa xmm6, xmmword [0x1400b1a70]
movdqa xmmword [rbp + 0xf0], xmm0
mov r8d, dword [rbp + 0xf0]
nop word [rax + rax]
movd xmm2, edx
lea eax, [rdx + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add edx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1400b1b30]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rcx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rcx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400b1b30]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 8]
xorps xmm2, xmm0
movd dword [rcx - 8], xmm2
cmp edx, 0x10
jl 0x140030e40
jmp 0x140030f81
lea r9, [rsp + 0x60]
mov r8d, ebx
nop dword [rax]
mov eax, 0x5397829d
lea r9, [r9 + 1]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x31
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9 - 1], al
cmp r8d, 0x10
jl 0x140030f50
lea rcx, [rsp + 0x60]
call fcn.140021dd0
movzx eax, word [0x1400b1668]
mov ecx, ebx
mov r8, qword [rdi + 0x90]
mov word [rbp + 0x150], ax
movups xmm0, xmmword [str.q_thb_YVMH_nQY461_]
movups xmm1, xmmword [0x1400b1648]
movups xmmword [rbp + 0x120], xmm0
movups xmm0, xmmword [0x1400b1658]
movups xmmword [rbp + 0x130], xmm1
movups xmmword [rbp + 0x140], xmm0
cmp r12d, 2
jl 0x140031112
movdqa xmm0, xmmword [0x1400b1bf0]
lea rdx, [rbp + 0x124]
movdqa xmm5, xmmword [0x1400b1a50]
movdqa xmm4, xmmword [0x1400b1c80]
movdqa xmm6, xmmword [0x1400b1a70]
movdqa xmmword [rbp + 0xf0], xmm0
mov edi, dword [rbp + 0xf0]
nop dword [rax + rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1400b1b30]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, edi
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, edi
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400b1b30]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x30
jl 0x140031010
cmp ecx, 0x32
jge 0x14003114c
movsxd rax, ecx
lea rdi, [rbp + 0x120]
add rdi, rax
nop
mov eax, 0x5397829d
lea rdi, [rdi + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x31
movzx eax, cl
inc ecx
sub al, dl
add al, 0x32
xor byte [rdi - 1], al
cmp ecx, 0x32
jl 0x140031120
movss xmm2, dword [0x1400b197c]
lea rdx, [rbp + 0x120]
mov rcx, r8
call fcn.14001d140
mov ecx, 0x3e8
mov qword [rbp + 0x110], rax
mov r15, rax
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x1400b182b], bl
movups xmm0, xmmword [str.89CPZTWT_eHR]
mov ecx, dword [0x1400b1828]
mov dword [rsp + 0x70], ecx
movups xmmword [rsp + 0x60], xmm0
je 0x14003131e
mov edi, ebx
cmp r12d, 2
jl 0x1400312e2
movdqa xmm0, xmmword [0x1400b1bf0]
lea rcx, [rsp + 0x64]
movdqa xmm5, xmmword [0x1400b1a50]
movdqa xmm4, xmmword [0x1400b1c80]
movdqa xmm6, xmmword [0x1400b1a70]
movdqa xmmword [rbp + 0xf0], xmm0
mov edx, dword [rbp + 0xf0]
nop dword [rax]
movd xmm2, edi
lea eax, [rdi + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add edi, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1400b1b30]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rcx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, edx
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400b1b30]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 8]
xorps xmm2, xmm0
movd dword [rcx - 8], xmm2
cmp edi, 0x10
jl 0x1400311e0
cmp edi, 0x14
jge 0x14003131e
movsxd rax, edi
lea r8, [rsp + 0x60]
add r8, rax
nop dword [rax]
mov eax, 0x5397829d
lea r8, [r8 + 1]
imul edi
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x31
movzx eax, dil
inc edi
sub al, cl
add al, 0x32
xor byte [r8 - 1], al
cmp edi, 0x14
jl 0x1400312f0
lea rcx, [rsp + 0x60]
call fcn.140021dd0
xorps xmm0, xmm0
mov edx, 0xa
mov rcx, rsi
movups xmmword [rbp + 0x298], xmm0
movups xmmword [rbp + 0x2a8], xmm0
movups xmmword [rbp + 0x2b8], xmm0
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, rsi
call qword [sym.imp.USER32.dll_UpdateWindow]
cmp dword [rbp + 0x2a0], 0x12
je 0x1400326ab
movss xmm7, dword [0x1400b19c0]
movss xmm8, dword [0x1400b19ac]
nop word [rax + rax]
mov rdi, qword [0x1400c5d10]
mov rsi, qword [0x1400c5d18]
cmp rdi, rsi
je 0x1400314fb
nop word [rax + rax]
mov rbx, qword [rdi]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetThreadId]
test eax, eax
je 0x1400313c9
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
add rdi, 8
cmp rdi, rsi
jne 0x1400313a0
xor ebx, ebx
jmp 0x1400314fb
lea rdx, [0x1400c5ee0]
lea rcx, [rbp + 8]
call fcn.140033a20
mov rdx, rax
lea rcx, [0x1400c5d60]
call fcn.140047110
movdqa xmm1, xmmword [0x1400b1c00]
mov dil, 0x34
movd ecx, xmm1
mov bl, Ordinal_50
movdqu xmmword [rsp + 0x60], xmm1
mov r8b, 4
mov byte [rsp + 0x78], 0
xor byte [rsp + 0x62], cl
xor r8b, cl
xor byte [rsp + 0x63], cl
movzx esi, dil
xor byte [rsp + 0x64], cl
xor bl, cl
xor byte [rsp + 0x65], cl
xor dil, cl
xor byte [rsp + 0x66], cl
xor sil, cl
xor byte [rsp + 0x67], cl
movdqa xmm0, xmm1
xor byte [rsp + 0x68], cl
mov dl, 0x3e
xor byte [rsp + 0x69], cl
xor dl, cl
xor byte [rsp + 0x6a], cl
mov r9b, gethostname
xor byte [rsp + 0x6b], cl
xor r9b, cl
xor byte [rsp + 0x6c], cl
mov r10b, Ordinal_35
xor byte [rsp + 0x6d], cl
xor r10b, cl
xor byte [rsp + 0x6e], cl
mov r11b, 0x35
xor byte [rsp + 0x6f], cl
xor r11b, cl
psrldq xmm0, 1
movd eax, xmm0
xorps xmm0, xmm0
mov byte [rsp + 0x76], bl
mov byte [rsp + 0x72], r8b
mov r8, 0xffffffffffffffff
xor al, cl
mov byte [rsp + 0x70], dl
xor ebx, ebx
mov byte [rsp + 0x61], al
mov qword [rbp + 0x190], rbx
lea rax, [rsp + 0x61]
mov qword [rbp + 0x198], rbx
mov byte [rsp + 0x71], dil
mov byte [rsp + 0x73], r9b
mov byte [rsp + 0x74], r10b
mov byte [rsp + 0x75], r11b
mov byte [rsp + 0x77], sil
movups xmmword [rbp + 0x180], xmm0
inc r8
cmp byte [rax + r8], bl
jne 0x1400314c3
lea rdx, [rsp + 0x61]
lea rcx, [rbp + 0x180]
call fcn.140034b20
lea rdx, [rbp + 0x180]
lea rcx, [0x1400c5d60]
call fcn.14003e460
mov ecx, ntohl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_raise]
call fcn.1400245e0
test al, al
je 0x14003169b
lea rdx, [0x1400c5ee0]
lea rcx, [rbp + 0x180]
call fcn.140033a20
mov rdx, rax
lea rcx, [0x1400c5d60]
call fcn.140047110
movdqa xmm1, xmmword [0x1400b1c30]
mov cl, 0x2a
movd r10d, xmm1
movzx ebx, cl
movdqu xmmword [rsp + 0x60], xmm1
mov dl, reloc.WS2_32.dll_gethostname
mov byte [rsp + 0x7e], 0
xor byte [rsp + 0x62], r10b
mov dil, reloc.WLDAP32.dll_Ordinal_46
xor byte [rsp + 0x63], r10b
mov r8b, 9
xor byte [rsp + 0x64], r10b
xor r8b, r10b
xor byte [rsp + 0x65], r10b
movzx r9d, dl
xor byte [rsp + 0x66], r10b
movzx r11d, dil
xor byte [rsp + 0x67], r10b
xor bl, r10b
xor byte [rsp + 0x68], r10b
xor cl, r10b
xor byte [rsp + 0x69], r10b
xor dl, r10b
xor byte [rsp + 0x6a], r10b
xor dil, r10b
xor byte [rsp + 0x6b], r10b
xor r9b, r10b
xor byte [rsp + 0x6c], r10b
xor r11b, r10b
xor byte [rsp + 0x6d], r10b
movdqa xmm0, xmm1
xor byte [rsp + 0x6e], r10b
mov sil, reloc.WLDAP32.dll_Ordinal_32
xor byte [rsp + 0x6f], r10b
xor sil, r10b
psrldq xmm0, 1
mov r14b, Ordinal_60
movd eax, xmm0
xor r14b, r10b
mov r15b, 0x24
mov byte [rsp + 0x76], bl
xor r15b, r10b
mov byte [rsp + 0x73], r8b
xor al, r10b
mov byte [rsp + 0x70], cl
mov byte [rsp + 0x61], al
mov r12b, Ordinal_35
mov al, 0x3f
mov byte [rsp + 0x71], dl
xor al, r10b
mov byte [rsp + 0x72], dil
mov byte [rsp + 0x7c], al
xor r12b, r10b
mov al, gethostname
mov byte [rsp + 0x74], r9b
xor al, r10b
mov byte [rsp + 0x75], r11b
mov r13b, 0x25
mov byte [rsp + 0x7d], al
xor r13b, r10b
mov byte [rsp + 0x77], sil
xor ebx, ebx
mov byte [rsp + 0x78], r14b
xorps xmm0, xmm0
mov qword [rbp + 0x190], rbx
mov qword [rbp + 0x198], rbx
lea rax, [rsp + 0x61]
mov byte [rsp + 0x79], r15b
mov r8, 0xffffffffffffffff
mov byte [rsp + 0x7a], r12b
mov byte [rsp + 0x7b], r13b
movups xmmword [rbp + 0x180], xmm0
inc r8
cmp byte [rax + r8], bl
jne 0x140031655
lea rdx, [rsp + 0x61]
lea rcx, [rbp + 0x180]
call fcn.140034b20
lea rdx, [rbp + 0x180]
lea rcx, [0x1400c5d60]
call fcn.14003e460
mov ecx, ntohl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_raise]
mov r15, qword [rbp + 0x110]
mov r12d, dword [reloc.WS2_32.dll_accept]
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [rbp + 0x298]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x1400316db
lea rcx, [rbp + 0x298]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x298]
call qword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x140032696
cmp qword [0x1400c60b0], 0
jne 0x1400316f4
cmp qword [0x1400c60c0], 0
je 0x1400316f4
call fcn.140021200
mov rcx, qword [0x1400c60d0]
lea rdx, [rbp + 0x100]
mov rdi, qword [str.__f_]
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rbp + 0x108]
lea rcx, [rbp + 0x220]
sub eax, dword [rbp + 0x100]
movd xmm1, eax
mov eax, dword [rbp + 0x10c]
sub eax, dword [rbp + 0x104]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rdi + 8], xmm1
movss dword [rdi + 0xc], xmm0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbp + 0x220]
xorps xmm1, xmm1
sub rax, qword [0x1400c60d8]
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [0x1400c60e0]
mov ecx, reloc.WS2_32.dll_recvfrom
cvtsi2ss xmm1, rax
divss xmm1, xmm0
movss dword [rdi + 0x10], xmm1
mov rax, qword [rbp + 0x220]
mov qword [0x1400c60d8], rax
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, reloc.WS2_32.dll_recv
and al, 1
mov byte [rdi + 0x11d], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, reloc.WS2_32.dll_select
and al, 1
mov byte [rdi + 0x11e], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
mov byte [rdi + 0x120], 0
cmp byte [rdi + 0x11c], 0
mov byte [rdi + 0x11f], al
je 0x1400317df
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetCursor]
call fcn.140004120
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x140032887
xorps xmm0, xmm0
mov word [rbp - 0x80], reloc.WS2_32.dll_WSAStartup
movups xmmword [rbp + 0x1e0], xmm0
mov byte [rbp - 0x7f], 0
lea rax, [rbp - 0x7f]
mov qword [rbp + 0x1f0], rbx
mov r8, 0xffffffffffffffff
mov qword [rbp + 0x1f8], rbx
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140031820
lea rdx, [rbp - 0x7f]
lea rcx, [rbp + 0x1e0]
call fcn.140034b20
mov al, 0x25
mov byte [rbp - 0x7c], reloc.WS2_32.dll_sendto
xor al, 0x14
mov qword [rbp + 0x130], rbx
xor edi, edi
mov byte [rbp - 0x7b], al
mov cl, 0x3a
mov byte [rbp - 0x78], dil
xor cl, 0x14
mov qword [rbp + 0x138], rbx
mov dl, 0x24
mov byte [rbp - 0x7a], cl
xor dl, 0x14
lea rax, [rbp - 0x7b]
xorps xmm0, xmm0
mov byte [rbp - 0x79], dl
movups xmmword [rbp + 0x120], xmm0
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], dil
jne 0x140031880
lea rdx, [rbp - 0x7b]
lea rcx, [rbp + 0x120]
call fcn.140034b20
mov dl, 0x4a
mov byte [rbp - 0x68], Ordinal_50
mov r8b, 0x5b
movzx edi, dl
movzx esi, r8b
mov al, 0x4c
xor al, 0x2f
mov bl, 0x58
xor bl, 0x2f
mov byte [rbp - 0x67], al
xor dil, 0x2f
mov byte [rbp - 0x5f], bl
xor sil, 0x2f
mov byte [rbp - 0x64], dil
xor r13d, r13d
mov byte [rbp - 0x5e], sil
xor dl, 0x2f
mov byte [rbp - 0x5c], r13b
xor r8b, 0x2f
mov byte [rbp - 0x65], dl
mov cl, 0x47
mov byte [rbp - 0x63], r8b
xor cl, 0x2f
lea rax, [rbp - 0x67]
mov r9b, 0x40
mov byte [rbp - 0x66], cl
xor r9b, 0x2f
mov r10b, 0x5c
xor r10b, 0x2f
mov byte [rbp - 0x62], r9b
mov r11b, 1
mov byte [rbp - 0x61], r10b
xor r11b, 0x2f
mov r14b, 0x49
xor r14b, 0x2f
mov byte [rbp - 0x60], r11b
mov byte [rbp - 0x5d], r14b
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rax + rbx], r13b
jne 0x140031920
mov rax, qword [rbp + 0x1f8]
cmp rbx, rax
ja 0x140031964
cmp rax, 0xf
mov qword [rbp + 0x1f0], rbx
lea rdi, [rbp + 0x1e0]
mov r8, rbx
cmova rdi, qword [rbp + 0x1e0]
lea rdx, [rbp - 0x67]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rdi], r13b
jmp 0x140031977
lea r9, [rbp - 0x67]
mov rdx, rbx
lea rcx, [rbp + 0x1e0]
call fcn.140035070
movdqa xmm1, xmmword [0x1400b1d10]
mov r8, 0xffffffffffffffff
movd ecx, xmm1
movdqa xmm0, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov byte [rsp + 0x70], r13b
xor byte [rsp + 0x62], cl
xor byte [rsp + 0x63], cl
xor byte [rsp + 0x64], cl
xor byte [rsp + 0x65], cl
xor byte [rsp + 0x66], cl
xor byte [rsp + 0x67], cl
xor byte [rsp + 0x68], cl
xor byte [rsp + 0x69], cl
xor byte [rsp + 0x6a], cl
xor byte [rsp + 0x6b], cl
xor byte [rsp + 0x6c], cl
xor byte [rsp + 0x6d], cl
xor byte [rsp + 0x6e], cl
xor byte [rsp + 0x6f], cl
psrldq xmm0, 1
movd eax, xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x278], xmm0
xor al, cl
xor ecx, ecx
mov byte [rsp + 0x61], al
mov qword [rbp + 0x288], rcx
lea rax, [rsp + 0x61]
mov qword [rbp + 0x290], rcx
nop
inc r8
cmp byte [rax + r8], cl
jne 0x140031a00
lea rdx, [rsp + 0x61]
lea rcx, [rbp + 0x278]
call fcn.140034b20
mov rdi, qword [str.__f_]
mov rax, r15
mov qword [rbp + 0xf0], rax
mov rcx, r15
mov rbx, r15
mov rdx, r15
mov dword [rdi + 0x1850], 0x44160000
mov dword [rdi + 0x1854], 0x43c80000
mov dword [rdi + 0x1868], 1
test r15, r15
jne 0x140031a8a
mov rax, qword [rdi + 0xa0]
mov rdx, rax
mov rbx, rax
mov rcx, rax
test rax, rax
jne 0x140031a83
mov rax, qword [rdi + 0x90]
mov rcx, qword [rax + 0x38]
mov rax, qword [rcx]
mov rcx, rax
mov rbx, rax
mov rdx, rax
mov qword [rbp + 0xf0], rax
movss xmm0, dword [rdi + 0x98]
mov qword [rdi + 0x1730], rax
mulss xmm0, dword [rax]
mov rax, qword [rdi + 0x1778]
mulss xmm0, dword [rcx + 4]
movss dword [rdi + 0x173c], xmm0
test rax, rax
je 0x140031ac0
mulss xmm0, dword [rax + 0x288]
jmp 0x140031ac6
xorps xmm0, xmm0
mov rbx, rdx
movss dword [rdi + 0x1738], xmm0
lea rcx, [rdi + 0x1818]
mov rax, qword [rbx + 0x58]
lea rdx, [rbp + 0xf0]
movsd xmm0, qword [rax + 0x24]
movsd qword [rdi + 0x1740], xmm0
call fcn.1400125e0
mov rcx, qword [rdi + 0x1778]
mov rdx, qword [rbx + 0x58]
mov rcx, qword [rcx + 0x290]
call fcn.14001a150
cmp qword [rbp + 0x1f8], 0xf
lea rcx, [rbp + 0x1e0]
movaps xmm3, xmm7
mov qword [rbp - 0x48], r13
cmova rcx, qword [rbp + 0x1e0]
lea r8, [rbp - 0x48]
lea rdx, reloc.WS2_32.dll_accept
mov dword [rsp + 0x20], 0x13e
call fcn.140008330
cmp byte [0x1400c2617], 1
jne 0x1400321bf
movdqa xmm1, xmmword [0x1400b1c10]
mov bl, 0x71
movd ecx, xmm1
mov r8b, Ordinal_46
movdqu xmmword [rsp + 0x60], xmm1
mov byte [rsp + 0x77], r13b
mov dl, 0x75
xor byte [rsp + 0x62], cl
movdqa xmm0, xmm1
xor byte [rsp + 0x63], cl
xor r8b, cl
xor byte [rsp + 0x64], cl
xor bl, cl
xor byte [rsp + 0x65], cl
xor dl, cl
xor byte [rsp + 0x66], cl
mov dil, listen
xor byte [rsp + 0x67], cl
xor dil, cl
xor byte [rsp + 0x68], cl
mov r9b, 0x3d
xor byte [rsp + 0x69], cl
xor r9b, cl
xor byte [rsp + 0x6a], cl
mov r10b, reloc.WS2_32.dll_gethostname
xor byte [rsp + 0x6b], cl
xor r10b, cl
xor byte [rsp + 0x6c], cl
mov r11b, 0x35
xor byte [rsp + 0x6d], cl
xor r11b, cl
xor byte [rsp + 0x6e], cl
xor byte [rsp + 0x6f], cl
psrldq xmm0, 1
movd eax, xmm0
xorps xmm0, xmm0
mov byte [rsp + 0x76], bl
mov byte [rsp + 0x72], r8b
mov r8, 0xffffffffffffffff
xor al, cl
mov byte [rsp + 0x70], dl
xor ebx, ebx
mov byte [rsp + 0x61], al
mov qword [rbp + 0x190], rbx
lea rax, [rsp + 0x61]
mov qword [rbp + 0x198], rbx
mov byte [rsp + 0x71], dil
mov byte [rsp + 0x73], r9b
mov byte [rsp + 0x74], r10b
mov byte [rsp + 0x75], r11b
movups xmmword [rbp + 0x180], xmm0
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], bl
jne 0x140031c20
lea rdx, [rsp + 0x61]
lea rcx, [rbp + 0x180]
call fcn.140034b20
movdqa xmm1, xmmword [0x1400b1cb0]
mov r8, 0xffffffffffffffff
movd ecx, xmm1
movdqa xmm0, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov byte [rsp + 0x70], bl
xor byte [rsp + 0x62], cl
xor byte [rsp + 0x63], cl
xor byte [rsp + 0x64], cl
xor byte [rsp + 0x65], cl
xor byte [rsp + 0x66], cl
xor byte [rsp + 0x67], cl
xor byte [rsp + 0x68], cl
xor byte [rsp + 0x69], cl
xor byte [rsp + 0x6a], cl
xor byte [rsp + 0x6b], cl
xor byte [rsp + 0x6c], cl
xor byte [rsp + 0x6d], cl
xor byte [rsp + 0x6e], cl
psrldq xmm0, 1
movd eax, xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x228], xmm0
mov qword [rbp + 0x238], rbx
xor al, cl
mov qword [rbp + 0x240], rbx
xor byte [rsp + 0x6f], cl
mov byte [rsp + 0x61], al
lea rax, [rsp + 0x61]
nop
inc r8
cmp byte [rax + r8], bl
jne 0x140031cc0
lea rdx, [rsp + 0x61]
lea rcx, [rbp + 0x228]
call fcn.140034b20
cmp qword [rbp + 0x198], 0xf
lea rcx, [rbp + 0x180]
cmova rcx, qword [rbp + 0x180]
call fcn.14000b890
cmp qword [rbp + 0x240], 0xf
lea rcx, [rbp + 0x228]
cmova rcx, qword [rbp + 0x228]
call fcn.14000b890
movaps xmm0, xmm8
call fcn.14000b6d0
call fcn.140010500
mov cl, Ordinal_26
mov qword [rbp - 0x40], rbx
xor cl, 0x76
mov byte [rbp - 0x74], 0x76
mov dl, reloc.WS2_32.dll_socket
mov byte [rbp - 0x72], cl
xor dl, 0x76
mov byte [rbp - 0x6f], bl
mov al, 0x3a
mov byte [rbp - 0x71], dl
xor al, 0x76
lea rdx, [rbp - 0x40]
mov dil, reloc.WS2_32.dll_select
mov byte [rbp - 0x73], al
xor dil, 0x76
lea rcx, [rbp - 0x73]
mov byte [rbp - 0x70], dil
call fcn.14000c480
test al, al
je 0x14003211b
movsxd rcx, dword [0x1400c5d0c]
lea r14, [0x140000000]
mov rcx, qword [r14 + rcx*8 + 0xc1118]
call qword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
movsxd rcx, dword [0x1400c5d0c]
lea rdx, str.cheetos__Release_
cmp qword [r14 + rcx*8 + 0xc1118], rdx
jne 0x14003202a
mov eax, dword [0x1400b1730]
mov edi, ebx
mov dword [rsp + 0x70], eax
movzx eax, word [0x1400b1734]
mov word [rsp + 0x74], ax
movzx eax, byte [0x1400b1736]
mov byte [rsp + 0x76], al
mov byte [0x1400c2616], 1
movups xmm0, xmmword [str.89__BYUSAUSY]
movups xmmword [rsp + 0x60], xmm0
cmp r12d, 2
jl 0x140031f12
movdqa xmm0, xmmword [0x1400b1bf0]
lea rcx, [rsp + 0x64]
movdqa xmm5, xmmword [0x1400b1a50]
movdqa xmm4, xmmword [0x1400b1c80]
movdqa xmm6, xmmword [0x1400b1a70]
movdqa xmmword [rbp + 0xf0], xmm0
mov edx, dword [rbp + 0xf0]
nop dword [rax]
movd xmm2, edi
lea eax, [rdi + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add edi, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1400b1b30]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rcx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, edx
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400b1b30]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 8]
xorps xmm2, xmm0
movd dword [rcx - 8], xmm2
cmp edi, 0x10
jl 0x140031e10
cmp edi, 0x17
jge 0x140031f4e
movsxd rax, edi
lea r8, [rsp + 0x60]
add r8, rax
nop dword [rax]
mov eax, 0x5397829d
lea r8, [r8 + 1]
imul edi
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x31
movzx eax, dil
inc edi
sub al, cl
add al, 0x32
xor byte [r8 - 1], al
cmp edi, 0x17
jl 0x140031f20
lea rcx, [rsp + 0x60]
call fcn.140021dd0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov ebx, dword [rcx + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140031fe4
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140031fe4
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
mov edi, 0x811c9dc5
lea rcx, [r11 + r8*4]
mov edx, dword [rcx + r9]
add rdx, r9
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140031fdf
nop dword [rax]
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, edi
imul edi, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x140031fc0
cmp edi, 0x60ac7e39
je 0x140031fe9
test r8d, r8d
jne 0x140031fa0
mov rax, qword [rax]
jmp 0x140031f70
mov ecx, dword [rbx + 0x24]
lea rsi, [0x1400c2610]
add rcx, r9
mov qword [rsp + 0x28], rsi
movzx edx, word [rcx + r8*2]
lea r8, [0x14002dbe0]
mov ecx, dword [rbx + 0x1c]
xor ebx, ebx
add rcx, r9
mov dword [rsp + 0x20], ebx
mov eax, dword [rcx + rdx*4]
xor edx, edx
add rax, r9
xor ecx, ecx
xor r9d, r9d
call rax
mov ecx, dword [0x1400c5d0c]
jmp 0x140032031
lea rsi, [0x1400c2610]
movsxd rax, ecx
lea rcx, str.cheetos__Beta_
cmp qword [r14 + rax*8 + 0xc1118], rcx
jne 0x14003211b
mov rax, qword gs:[0x60]
mov byte [0x1400c2616], 1
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov ebx, dword [rcx + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x1400320e4
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x1400320e4
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
mov edi, 0x811c9dc5
lea rcx, [r9 + r8*4]
mov edx, dword [rcx + r11]
add rdx, r9
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400320df
nop dword [rax]
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, edi
imul edi, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x1400320c0
cmp edi, 0x60ac7e39
je 0x1400320e9
test r8d, r8d
jne 0x1400320a0
mov rax, qword [rax]
jmp 0x140032070
mov ecx, dword [rbx + 0x24]
add rcx, r9
mov qword [rsp + 0x28], rsi
movzx edx, word [rcx + r8*2]
lea r8, [0x14002dbe0]
mov ecx, dword [rbx + 0x1c]
xor ebx, ebx
add rcx, r9
mov dword [rsp + 0x20], ebx
mov eax, dword [rcx + rdx*4]
xor edx, edx
add rax, r9
xor ecx, ecx
xor r9d, r9d
call rax
mov rdx, qword [rbp + 0x240]
cmp rdx, 0xf
jbe 0x14003215c
mov rcx, qword [rbp + 0x228]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032157
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032879
call fcn.14009afc0
mov rdx, qword [rbp + 0x198]
mov qword [rbp + 0x238], rbx
mov qword [rbp + 0x240], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x228], r13b
cmp rdx, 0xf
jbe 0x140032542
mov rcx, qword [rbp + 0x180]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400321b5
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032879
call fcn.14009afc0
jmp 0x140032542
mov cl, 0x49
mov byte [rbp - 0x58], Ordinal_46
xor cl, 0x2c
mov al, 0x67
mov dl, 0x55
mov byte [rbp - 0x56], cl
mov r8b, ntohl
lea rcx, [rbp - 0x57]
xor r9d, r9d
xor al, 0x2c
xor dl, 0x2c
mov byte [rbp - 0x57], al
xor r8b, 0x2c
mov byte [rbp - 0x55], dl
mov dil, reloc.WLDAP32.dll_Ordinal_22
mov byte [rbp - 0x53], r8b
xor dil, 0x2c
mov byte [rbp - 0x52], r9b
mov byte [rbp - 0x54], dil
call fcn.14000b890
xor ebx, ebx
mov word [rbp + 0x178], 4
mov qword [rsp + 0x30], rbx
lea rsi, [0x1400c2510]
mov qword [rsp + 0x28], rbx
lea r9, [rbp - 0x38]
mov r8d, 0xff
mov dword [rsp + 0x20], ebx
mov rdx, rsi
mov byte [rbp + 0x179], r13b
lea rcx, [rbp + 0x179]
mov qword [rbp - 0x38], r13
call fcn.14000e9a0
mov cl, 0x77
mov qword [rbp - 0x30], rbx
xor cl, 0x18
mov byte [rbp - 0x50], Ordinal_26
mov dl, 0x7f
mov byte [rbp - 0x4e], cl
xor dl, 0x18
mov byte [rbp - 0x4a], bl
mov al, 0x54
mov byte [rbp - 0x4d], dl
mov r8b, 0x76
lea rdx, [rbp - 0x30]
xor al, 0x18
lea rcx, [rbp - 0x4f]
xor r8b, 0x18
mov byte [rbp - 0x4f], al
mov dil, WSAStartup
mov byte [rbp - 0x4b], r8b
xor dil, 0x18
mov byte [rbp - 0x4c], dil
call fcn.14000c480
test al, al
je 0x140032542
xorps xmm0, xmm0
mov qword [rbp + 0x190], rbx
movups xmmword [rbp + 0x180], xmm0
mov qword [rbp + 0x198], rbx
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rsi + r8], bl
jne 0x1400322b0
mov rdx, rsi
lea rcx, [rbp + 0x180]
call fcn.140034b20
lea rdx, [rbp + 0x180]
lea rcx, [0x1400c5d60]
call fcn.140045bc0
lea rcx, [0x1400c5d60]
call fcn.14003fee0
test al, al
je 0x140032396
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov ebx, dword [rcx + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140032374
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140032374
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
mov edi, 0x811c9dc5
lea rcx, [r9 + r8*4]
mov edx, dword [rcx + r11]
add rdx, r9
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14003236f
nop dword [rax]
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, edi
imul edi, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x140032350
cmp edi, 0xcded1a85
je 0x140032379
test r8d, r8d
jne 0x140032330
mov rax, qword [rax]
jmp 0x140032300
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r9
call rax
xor ebx, ebx
cmp byte [0x1400c5f70], r13b
je 0x140032542
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov ebx, dword [rcx + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140032434
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140032434
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
mov edi, 0x811c9dc5
lea rcx, [r11 + r8*4]
mov edx, dword [rcx + r9]
add rdx, r9
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14003242f
nop dword [rax]
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, edi
imul edi, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x140032410
cmp edi, 0x60ac7e39
je 0x140032439
test r8d, r8d
jne 0x1400323f0
mov rax, qword [rax]
jmp 0x1400323c0
mov ecx, dword [rbx + 0x24]
lea rsi, [0x1400c2610]
add rcx, r9
mov qword [rsp + 0x28], rsi
movzx edx, word [rcx + r8*2]
lea r8, [0x140025b90]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r9
mov dword [rsp + 0x20], ecx
xor r9d, r9d
xor edx, edx
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov ebx, dword [rcx + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140032504
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140032504
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
mov edi, 0x811c9dc5
lea rcx, [r11 + r8*4]
mov edx, dword [rcx + r9]
add rdx, r9
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400324ff
nop dword [rax]
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, edi
imul edi, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x1400324e0
cmp edi, 0x60ac7e39
je 0x140032509
test r8d, r8d
jne 0x1400324c0
mov rax, qword [rax]
jmp 0x140032490
mov ecx, dword [rbx + 0x24]
add rcx, r9
mov qword [rsp + 0x28], rsi
movzx edx, word [rcx + r8*2]
lea r8, [0x14002c170]
mov ecx, dword [rbx + 0x1c]
xor ebx, ebx
add rcx, r9
mov dword [rsp + 0x20], ebx
mov eax, dword [rcx + rdx*4]
xor edx, edx
add rax, r9
xor ecx, ecx
xor r9d, r9d
call rax
mov byte [0x1400c2617], 1
call fcn.14000acf0
mov rcx, qword [0x1400c60e8]
xor r8d, r8d
mov rax, qword [rcx]
lea edx, [r8 + 7]
call qword [rax + 0x1c8]
mov rcx, qword [0x1400c60e8]
xor r8d, r8d
mov rax, qword [rcx]
lea edx, [r8 + 0x1b]
call qword [rax + 0x1c8]
mov rcx, qword [0x1400c60e8]
xor r8d, r8d
mov edx, 0xae
mov rax, qword [rcx]
call qword [rax + 0x1c8]
mov rcx, qword [0x1400c60e8]
mov rax, qword [rcx]
call qword [rax + 0x148]
test eax, eax
js 0x1400325b6
call fcn.140006310
mov rcx, qword [0x1400c60e8]
mov rax, qword [rcx]
call qword [rax + 0x150]
mov rcx, qword [0x1400c60e8]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x88]
mov rdx, qword [rbp + 0x290]
cmp rdx, 0xf
jbe 0x140032614
mov rcx, qword [rbp + 0x278]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003260f
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032880
call fcn.14009afc0
mov rdx, qword [rbp + 0x138]
cmp rdx, 0xf
jbe 0x140032655
mov rcx, qword [rbp + 0x120]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032650
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032880
call fcn.14009afc0
mov rdx, qword [rbp + 0x1f8]
cmp rdx, 0xf
jbe 0x140032696
mov rcx, qword [rbp + 0x1e0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032691
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032880
call fcn.14009afc0
cmp dword [rbp + 0x2a0], 0x12
jne 0x140031380
mov r14, qword [rbp - 8]
mov r13, qword [rbp]
call fcn.1400213b0
call fcn.1400050e0
mov rcx, qword [0x1400c60e8]
mov qword [0x1400c60c0], rbx
mov qword [0x1400c60d0], rbx
test rcx, rcx
je 0x1400326d5
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rax, qword [r14]
mov rcx, r14
call qword [rax + reloc.WS2_32.dll_recv]
xor ecx, ecx
mov dword [rbp + 0x178], ebx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea r9, [rbp + 0x178]
mov edx, 0x1000
mov rcx, rax
mov r8d, 4
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor eax, eax
mov ecx, 0x1000
rep stosb byte [rdi], al
lea rcx, str.b3824d3d3fddf0da
mov rdx, r13
call qword [sym.imp.USER32.dll_UnregisterClassA]
mov rdx, qword [rbp + 0x260]
cmp rdx, 0xf
jbe 0x140032764
mov rcx, qword [rbp + 0x248]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003275f
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032872
call fcn.14009afc0
mov rdx, qword [rbp + 0x218]
movdqa xmm0, xmmword [0x1400b1a10]
mov byte [rbp + 0x248], 0
movdqu xmmword [rbp + 0x258], xmm0
cmp rdx, 0xf
jbe 0x1400327bc
mov rcx, qword [rbp + 0x200]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400327b7
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032872
call fcn.14009afc0
mov rdx, qword [rbp + 0x1b8]
movdqa xmm0, xmmword [0x1400b1a10]
mov byte [rbp + 0x200], 0
movdqu xmmword [rbp + 0x210], xmm0
cmp rdx, 0xf
jbe 0x140032810
mov rcx, qword [rbp + 0x1a0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003280b
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032872
call fcn.14009afc0
mov rdx, qword [rbp + 0x1d8]
mov qword [rbp + 0x1b0], rbx
mov qword [rbp + 0x1b8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x1a0], 0
cmp rdx, 7
jbe 0x14003018c
mov rcx, qword [rbp + 0x1c0]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140030187
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140030187
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]