Function at 0x1401dca20
Capabilities:
Create thread
Encode data using xor
Execute command
Get session user name
Set console window title
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x420
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
movaps xmmword [rax - 0x48], xmm8
mov rax, qword [0x140542918]
xor rax, rsp
mov qword [rsp + 0x3e0], rax
xor ebx, ebx
movsd xmm0, qword [0x14043a708]
movsd qword [rsp + 0x70], xmm0
mov eax, dword [0x14043a710]
mov dword [rsp + 0x78], eax
movzx eax, byte [0x14043a714]
mov byte [rsp + 0x7c], al
mov r8d, ebx
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x1401dcba2
movdqa xmm4, xmmword [0x140444190]
mov edx, 4
movd xmm6, edx
mov ecx, Ordinal_32
movd xmm5, ecx
movdqa xmm2, xmmword [0x1404440f0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x140444110]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x140444170]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.2222222222222222]
movd xmm0, dword [0x14043a708]
pxor xmm2, xmm0
movd dword [rsp + 0x70], xmm2
movdqa xmm3, xmmword [0x140444100]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x140444110]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x140444170]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.2222222222222222]
movd xmm0, dword [rsp + 0x74]
pxor xmm2, xmm0
movd dword [rsp + 0x74], xmm2
mov r8d, 8
movsxd rax, r8d
lea r9, [rsp + 0x70]
add r9, rax
nop dword [rax]
mov eax, 0x4d4873ed
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x35
movzx eax, r8b
sub al, cl
add al, 0x32
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0xd
jl 0x1401dcbb0
xorps xmm0, xmm0
movups xmmword [rsp + 0xc0], xmm0
mov qword [rsp + 0xd0], rbx
mov qword [rsp + 0xd8], rbx
lea rax, [rsp + 0x70]
mov r12, 0xffffffffffffffff
mov r8, r12
nop word [rax + rax]
inc r8
cmp byte [rax + r8], bl
jne 0x1401dcc10
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0xc0]
call fcn.14013c770
mov r8d, 0x68d
lea rdx, [rsp + 0xc0]
lea rcx, [0x140538960]
call fcn.140131530
xorps xmm0, xmm0
movups xmmword [rsp + 0xc0], xmm0
movups xmmword [rsp + 0xd0], xmm0
movups xmmword [rsp + 0xe0], xmm0
xor r9d, r9d
lea r8d, [r9 + 1]
lea rdx, [rsp + 0xc0]
lea rcx, str.1114547025002893312
call fcn.1403aa7d0
mov edx, 1
lea rcx, [0x14015a4c0]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
lea rcx, str.Tayfa_Proxy_v1.5_Powered_by_Tayfa
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
nop
lea r8, str.LOCALAPPDATA
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__dupenv_s]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov rdx, qword [rsp + 0x70]
mov r8, r12
nop
inc r8
cmp byte [rdx + r8], 0
jne 0x1401dccd0
lea rcx, [rsp + 0x40]
call fcn.14013c770
nop
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov rax, rdx
sub rax, rcx
cmp rax, 0x1a
jb 0x1401dcd36
lea rax, [rcx + 0x1a]
mov qword [rsp + 0x50], rax
lea rdi, [rsp + 0x40]
cmp rdx, 0x10
cmovae rdi, qword [rsp + 0x40]
add rdi, rcx
mov r8d, reloc.WLDAP32.dll_Ordinal_26
lea rdx, str.Growtopiacacheitems.dat
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + 0x1a], 0
lea rax, [rsp + 0x40]
jmp 0x1401dcd57
mov qword [rsp + 0x20], reloc.WLDAP32.dll_Ordinal_26
lea r9, str.Growtopiacacheitems.dat
xor r8d, r8d
lea edx, [r8 + 0x1a]
lea rcx, [rsp + 0x40]
call fcn.140131860
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0xc0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0xd0], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x1401dcdbd
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401dcdb8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401dcdb8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14040fbd0
movdqa xmm0, xmmword [0x140436f80]
movdqu xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x40], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x88], xmm0
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa0], rbx
lea rax, [rsp + 0xc0]
mov r14, qword [rsp + 0xc0]
mov rdi, qword [rsp + 0xd8]
cmp rdi, 0x10
cmovae rax, r14
mov qword [rsp + 0x60], rax
movabs r15, 0x7fffffffffffffff
mov rsi, qword [rsp + 0xd0]
cmp rsi, r15
ja 0x1401de12a
mov qword [rsp + 0xa0], reloc.WS2_32.dll_ntohs
mov r13d, reloc.WS2_32.dll_shutdown
cmp rsi, 0x10
jae 0x1401dce58
mov qword [rsp + 0x98], rsi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x88], xmm0
jmp 0x1401dceb9
mov rdi, rsi
or rdi, 0xf
cmp rdi, r15
jbe 0x1401dce69
mov rdi, r15
jmp 0x1401dce70
cmp rdi, r13
cmovb rdi, r13
mov rdx, rdi
add rdx, 1
cmovb rdx, r12
lea rcx, [rsp + 0x88]
call fcn.14012eef0
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x98], rsi
mov qword [rsp + 0xa0], rdi
lea r8, [rsi + 1]
mov rdx, qword [rsp + 0x60]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rdi, qword [rsp + 0xd8]
mov rcx, qword [0x140546c20]
add rcx, 0x5ef0
lea rdx, [rsp + 0x88]
call fcn.14015b3c0
nop
cmp rdi, 0x10
jb 0x1401dcf10
lea rdx, [rdi + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x1401dcf07
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401dcf07
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.14040fbd0
nop
jmp 0x1401dcf26
mov edi, dword [reloc.WS2_32.dll_accept]
mov r14d, 4
lea esi, [r14 + 0x1b]
lea rcx, str.Color_0A
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movups xmm0, xmmword [0x14043a718]
movups xmmword [rsp + 0x40], xmm0
psrldq xmm0, 0xf
movd eax, xmm0
test al, al
je 0x1401dd0f0
cmp edi, 2
jl 0x1401dd0b1
movdqa xmm5, xmmword [0x1404440f0]
mov edx, ebx
movdqa xmm4, xmmword [0x140444190]
movd xmm6, r14d
movdqa xmm7, xmmword [0x140444110]
movd xmm8, esi
movdqa xmm0, xmmword [str.2222222222222222]
movdqa xmmword [rsp + 0x70], xmm0
lea rcx, [rsp + 0x44]
mov r8d, dword [rsp + 0x70]
nop word [rax + rax]
movd xmm2, edx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x140444170]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
pxor xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [rdx + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x140444170]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rcx]
pxor xmm2, xmm0
movd dword [rcx], xmm2
add edx, 8
lea rcx, [rcx + 8]
cmp edx, 0x10
jl 0x1401dcfb0
jmp 0x1401dd0f0
lea r9, [rsp + 0x40]
mov r8d, ebx
nop dword [rax]
mov eax, 0x4d4873ed
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x35
movzx eax, r8b
sub al, cl
add al, 0x32
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x10
jl 0x1401dd0c0
lea rdx, [rsp + 0x40]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14012d790
lea rcx, [0x140546f20]
call fcn.1403bab50
cmp byte [0x140547138], 0
jne 0x1401dd18c
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call fcn.140156d20
movzx ecx, byte [rax + 0xa]
test cl, cl
je 0x1401dd15a
xor byte [rax], 0x32
xor byte [rax + 1], 0x33
xor byte [rax + 2], 0x34
xor byte [rax + 3], 0x35
xor byte [rax + 4], 0x36
xor byte [rax + 5], 0x37
xor byte [rax + 6], 0x38
xor byte [rax + 7], 0x39
xor byte [rax + 8], 0x3a
xor byte [rax + 9], 0x3b
xor cl, 0x3c
mov byte [rax + 0xa], cl
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14012d790
mov rcx, rax
lea rdx, [0x140547140]
call fcn.14013b400
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, [0x14043a7d4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Color_0A
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rsp + 0x158], xmm0
mov qword [rsp + 0x168], rbx
mov qword [rsp + 0x170], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x158], 0
movups xmm0, xmmword [0x14043a738]
movups xmmword [rsp + 0x40], xmm0
movzx eax, word [0x14043a748]
mov word [rsp + 0x50], ax
movzx eax, byte [0x14043a74a]
mov byte [rsp + 0x52], al
mov r8d, ebx
cmp edi, 2
jl 0x1401dd347
movdqa xmm5, xmmword [0x1404440f0]
movdqa xmm4, xmmword [0x140444190]
movd xmm6, r14d
movdqa xmm7, xmmword [0x140444110]
movd xmm8, esi
movdqa xmm0, xmmword [str.2222222222222222]
movdqa xmmword [rsp + 0x70], xmm0
lea rcx, [rsp + 0x44]
mov edx, dword [rsp + 0x70]
nop word [rax + rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x140444170]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
pxor xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [r8 + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x140444170]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
pxor xmm2, xmm0
movd dword [rcx], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x10
jl 0x1401dd240
cmp r8d, 0x13
jge 0x1401dd390
movsxd rax, r8d
lea r9, [rsp + 0x40]
add r9, rax
nop dword [rax]
nop word [rax + rax]
mov eax, 0x4d4873ed
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x35
movzx eax, r8b
sub al, cl
add al, 0x32
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x13
jl 0x1401dd360
lea rdx, [rsp + 0x40]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14012d790
lea rdx, [rsp + 0x158]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.14013b1b0
xorps xmm0, xmm0
movups xmmword [rsp + 0x88], xmm0
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa0], rbx
lea r14, [rsp + 0x158]
cmp qword [rsp + 0x170], 0x10
cmovae r14, qword [rsp + 0x158]
mov rsi, qword [rsp + 0x168]
cmp rsi, r15
ja 0x1401de130
mov qword [rsp + 0xa0], reloc.WS2_32.dll_ntohs
cmp rsi, 0x10
jae 0x1401dd423
mov qword [rsp + 0x98], rsi
movups xmm0, xmmword [r14]
movups xmmword [rsp + 0x88], xmm0
jmp 0x1401dd481
mov rdi, rsi
or rdi, 0xf
cmp rdi, r15
jbe 0x1401dd434
mov rdi, r15
jmp 0x1401dd43c
cmp rdi, 0x16
cmovb rdi, r13
mov rdx, rdi
add rdx, 1
cmovb rdx, r12
lea rcx, [rsp + 0x88]
call fcn.14012eef0
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x98], rsi
mov qword [rsp + 0xa0], rdi
lea r8, [rsi + 1]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edi, dword [reloc.WS2_32.dll_accept]
lea rdx, [rsp + 0x88]
lea rcx, [0x140546f20]
call fcn.1403bc140
cmp byte [0x140547138], 0
jne 0x1401dd514
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call fcn.140158880
movzx ecx, byte [rax + 0xa]
test cl, cl
je 0x1401dd4e2
xor byte [rax], 0x32
xor byte [rax + 1], 0x33
xor byte [rax + 2], 0x34
xor byte [rax + 3], 0x35
xor byte [rax + 4], 0x36
xor byte [rax + 5], 0x37
xor byte [rax + 6], 0x38
xor byte [rax + 7], 0x39
xor byte [rax + 8], 0x3a
xor byte [rax + 9], 0x3b
xor cl, 0x3c
mov byte [rax + 0xa], cl
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14012d790
mov rcx, rax
lea rdx, [0x140547140]
call fcn.14013b400
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x120], xmm0
mov qword [rsp + 0x130], rax
movups xmmword [rsp + 0xc0], xmm0
mov qword [rsp + 0xd0], rbx
mov qword [rsp + 0xd8], rbx
lea r8d, [rax + 6]
lea rdx, str.710937
lea rcx, [rsp + 0xc0]
call fcn.14013c770
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x120]
lea rcx, [0x140546f20]
call fcn.1403b88a0
nop
cmp byte [0x140547138], 0
jne 0x1401dd71e
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call fcn.140158ba0
mov r9, rax
cmp byte [rax + 0xb], 0
je 0x1401dd6ec
cmp edi, 2
jl 0x1401dd6b7
movdqa xmm4, xmmword [0x140444190]
mov edx, 4
movd xmm5, edx
mov eax, Ordinal_32
movd xmm6, eax
movdqa xmm2, xmmword [0x1404440f0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm5
movdqa xmm0, xmm1
psrld xmm0, xmm6
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x140444110]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x140444170]
packuswb xmm2, xmm2
mov eax, dword [str.2222222222222222]
movd xmm0, eax
paddb xmm2, xmm0
movd xmm0, dword [r9]
pxor xmm2, xmm0
movd dword [r9], xmm2
movdqa xmm3, xmmword [0x140444100]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm5
movdqa xmm0, xmm1
psrld xmm0, xmm6
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x140444110]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x140444170]
packuswb xmm2, xmm2
movd xmm0, eax
paddb xmm2, xmm0
movd xmm0, dword [r9 + 4]
pxor xmm2, xmm0
movd dword [r9 + 4], xmm2
mov ebx, 8
movsxd r8, ebx
add r8, r9
nop dword [rax]
mov eax, 0x4d4873ed
imul ebx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x35
movzx eax, bl
sub al, cl
add al, 0x32
xor byte [r8], al
inc ebx
lea r8, [r8 + 1]
cmp ebx, 0xc
jl 0x1401dd6c0
mov rdx, r9
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14012d790
mov rcx, rax
lea rdx, [0x140547140]
call fcn.14013b400
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov dword [rsp + 0xb0], 0x101
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x2d0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x100], xmm0
mov qword [rsp + 0x110], rbx
mov qword [rsp + 0x118], rbx
lea rax, [rsp + 0x2d0]
mov rdi, r12
inc rdi
cmp byte [rax + rdi], 0
jne 0x1401dd765
cmp rdi, r15
ja 0x1401de136
cmp rdi, 0x10
jae 0x1401dd7cd
mov qword [rsp + 0x110], rdi
mov qword [rsp + 0x118], reloc.WS2_32.dll_ntohs
mov r8, rdi
lea rdx, [rsp + 0x2d0]
lea rcx, [rsp + 0x100]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rdi + 0x100], 0
mov rax, qword [rsp + 0x118]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x60], rax
jmp 0x1401dd840
mov rsi, rdi
or rsi, 0xf
cmp rsi, r15
jbe 0x1401dd7e3
mov rsi, r15
mov qword [rsp + 0x70], r15
jmp 0x1401dd7f0
cmp rsi, 0x16
cmovb rsi, r13
mov qword [rsp + 0x70], rsi
mov rdx, rsi
add rdx, 1
cmovb rdx, r12
lea rcx, [rsp + 0x100]
call fcn.14012eef0
mov r14, rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x110], rdi
mov qword [rsp + 0x118], rsi
mov r8, rdi
lea rdx, [rsp + 0x2d0]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + rdi], 0
lea r8, str.LOCALAPPDATA
lea rdx, [rsp + 0x198]
lea rcx, [rsp + 0x80]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__dupenv_s]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov rdx, qword [rsp + 0x80]
mov r8, r12
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x1401dd880
lea rcx, [rsp + 0x40]
call fcn.14013c770
nop
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov rax, rdx
sub rax, rcx
cmp rax, 0x26
jb 0x1401dd8e6
lea rax, [rcx + 0x26]
mov qword [rsp + 0x50], rax
lea rdi, [rsp + 0x40]
cmp rdx, 0x10
cmovae rdi, qword [rsp + 0x40]
add rdi, rcx
mov r8d, Ordinal_41
lea rdx, str.Growtopiainterfacelarge_tayfa.rttex
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + 0x26], 0
lea rax, [rsp + 0x40]
jmp 0x1401dd907
mov qword [rsp + 0x20], Ordinal_45
lea r9, str.Growtopiainterfacelarge_tayfa.rttex
xor r8d, r8d
lea edx, [r8 + 0x26]
lea rcx, [rsp + 0x40]
call fcn.140131860
xorps xmm0, xmm0
movups xmmword [rsp + 0x138], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x148], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x138], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x148], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x1401dd984
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401dd97f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401dd97f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14040fbd0
movdqa xmm0, xmmword [0x140436f80]
movdqu xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x40], 0
xor edx, edx
mov r8d, 0x108
lea rcx, [rsp + 0x1c0]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x138]
cmp qword [rsp + 0x150], 0x10
cmovae rdx, qword [rsp + 0x138]
mov dword [rsp + 0x20], 1
mov r9d, 0x40
lea r8d, [r9 - 0x1e]
lea rcx, [rsp + 0x1c0]
call fcn.14014c270
mov rax, qword [rsp + 0x1c0]
movsxd rcx, dword [rax + 4]
lea rdi, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x1c0], rdi
mov rax, qword [rsp + 0x1c0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x1bc], edx
mov r8, qword [rsp + 0x128]
mov rdx, qword [rsp + 0x120]
sub r8, rdx
lea rcx, [rsp + 0x1c0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rsp + 0x1c8]
call fcn.14016a180
test rax, rax
jne 0x1401dda70
mov rax, qword [rsp + 0x1c0]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x1c0]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
lea rcx, [0x14043a7d4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rsp + 0x178], xmm0
mov qword [rsp + 0x188], rbx
mov qword [rsp + 0x190], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x178], 0
mov r14, qword [0x140547100]
mov rax, qword [0x140547108]
mov qword [rsp + 0xb0], rax
cmp r14, rax
je 0x1401ddc08
xorps xmm0, xmm0
movups xmmword [rsp + 0x88], xmm0
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa0], rbx
mov r13, r14
cmp qword [r14 + 0x18], 0x10
jb 0x1401ddaeb
mov r13, qword [r14]
mov rsi, qword [r14 + 0x10]
cmp rsi, r15
ja 0x1401de13c
cmp rsi, 0x10
jae 0x1401ddb27
mov qword [rsp + 0x98], rsi
mov edi, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0xa0], rdi
movups xmm0, xmmword [r13]
movups xmmword [rsp + 0x88], xmm0
movq r12, xmm0
jmp 0x1401ddb88
mov rdi, rsi
or rdi, 0xf
cmp rdi, r15
jbe 0x1401ddb38
mov rdi, r15
jmp 0x1401ddb45
cmp rdi, 0x16
mov eax, reloc.WS2_32.dll_shutdown
cmovb rdi, rax
mov rdx, rdi
add rdx, 1
cmovb rdx, r12
lea rcx, [rsp + 0x88]
call fcn.14012eef0
mov r12, rax
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x98], rsi
mov qword [rsp + 0xa0], rdi
lea r8, [rsi + 1]
mov rdx, r13
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
nop
lea rdx, [rsp + 0x88]
cmp rdi, 0x10
cmovae rdx, r12
mov r8, rsi
lea rcx, [rsp + 0x178]
call fcn.14012ef50
nop
mov rdx, qword [rsp + 0xa0]
cmp rdx, 0x10
jb 0x1401ddbe8
inc rdx
mov rcx, qword [rsp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401ddbe3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401ddc4f
call fcn.14040fbd0
add r14, 0x20
mov r12, 0xffffffffffffffff
cmp r14, qword [rsp + 0xb0]
jne 0x1401ddac3
lea rdi, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov byte [0x140546492], 1
lea rcx, str.Color_0A
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.Tayfa_Proxy_by_Kayip_and_Throxy_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14012d790
call fcn.1401c8090
mov ecx, 8
call fcn.14040fb94
test rax, rax
je 0x1401ddc56
lea rcx, [0x1401c9770]
mov qword [rax], rcx
jmp 0x1401ddc59
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, rbx
mov qword [rsp + 0xb0], rax
lea rcx, [rsp + 0xf8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x140140970]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0xf0], rax
test rax, rax
je 0x1401de118
mov ecx, 8
call fcn.14040fb94
test rax, rax
je 0x1401ddcb2
lea rcx, [0x140166fd0]
mov qword [rax], rcx
jmp 0x1401ddcb5
mov rax, rbx
mov qword [rsp + 0xb0], rax
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x140140970]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1401de18a
cmp dword [rsp + 0x48], 0
je 0x1401de142
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0xb0], xmm0
lea rcx, [rsp + 0xb0]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x1401de14d
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x178]
lea rcx, [rsp + 0xc0]
call fcn.14012dd60
mov rcx, rax
call fcn.14015db20
mov ecx, 8
call fcn.14040fb94
test rax, rax
je 0x1401ddd5c
lea rcx, [0x1401b7660]
mov qword [rax], rcx
jmp 0x1401ddd5f
mov rax, rbx
mov qword [rsp + 0xb0], rax
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x140140970]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1401de17b
cmp dword [rsp + 0x48], 0
je 0x1401de155
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0xb0], xmm0
lea rcx, [rsp + 0xb0]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x1401de160
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x40], xmm0
cmp byte [0x140546370], 0
jne 0x1401dddfd
mov edx, 4
lea rcx, str.Failed_to_edit_Hosts_File_n
call fcn.1401dff40
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, r12d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, str.Successfully_edited_Hosts_file_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14012d790
cmp dword [rsp + 0xf8], 0
je 0x1401de168
movaps xmm0, xmmword [rsp + 0xf0]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x1401de173
xorps xmm0, xmm0
movdqa xmmword [rsp + 0xf0], xmm0
call fcn.14013a900
mov rcx, qword [0x140546c20]
call fcn.1401eb5f0
test al, al
je 0x1401ddec9
lea rdx, str.Server__client_proxy_is_running._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14012d790
lea rdx, str.You_can_now_connect_to_Growtopia_n_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14012d790
lea rdx, str.If_Proxy_doesnt_connect_restart_Growtopia._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14012d790
lea rdx, str.Best_Team:_TAYFACE20__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14012d790
nop dword [rax + rax]
mov rcx, qword [0x140546c20]
call fcn.1401ea690
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1401ddeb0
mov edx, 4
lea rcx, str.Failed_to_start_server_or_proxy._n
call fcn.1401dff40
nop
cmp dword [rsp + 0xf8], 0
je 0x1401ddeec
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
nop
mov rdx, qword [rsp + 0x190]
cmp rdx, 0x10
jb 0x1401ddf33
inc rdx
mov rcx, qword [rsp + 0x178]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401ddf2d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401ddf2d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14040fbd0
nop
mov rax, qword [rsp + 0x1c0]
movsxd rcx, dword [rax + 4]
mov qword [rsp + rcx + 0x1c0], rdi
mov rax, qword [rsp + 0x1c0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x1bc], edx
lea rcx, [rsp + 0x1c8]
call fcn.140151b10
lea rcx, [rsp + 0x1d0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rsp + 0x268]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rdx, qword [rsp + 0x150]
cmp rdx, 0x10
jb 0x1401ddfd0
inc rdx
mov rcx, qword [rsp + 0x138]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401ddfcb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401ddfcb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14040fbd0
movdqa xmm0, xmmword [0x140436f80]
movdqu xmmword [rsp + 0x148], xmm0
mov byte [rsp + 0x138], 0
mov rax, qword [rsp + 0x70]
cmp rax, 0x10
jb 0x1401de02e
lea rdx, [rax + 1]
mov rcx, qword [rsp + 0x60]
mov r8, rcx
cmp rdx, 0x1000
jb 0x1401de028
add rdx, 0x27
mov rax, qword [rcx - 8]
mov qword [rsp + 0x60], rax
sub r8, rax
lea rax, [r8 - 8]
cmp rax, 0x1f
ja 0x1401de06e
mov rcx, qword [rsp + 0x60]
call fcn.14040fbd0
nop
mov rcx, qword [rsp + 0x120]
test rcx, rcx
je 0x1401de08e
mov rdx, qword [rsp + 0x130]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401de075
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401de075
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.14040fbd0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x120], xmm0
mov qword [rsp + 0x130], rbx
mov rax, qword [rsp + 0x170]
cmp rax, 0x10
jb 0x1401de0d5
lea rdx, [rax + 1]
mov rcx, qword [rsp + 0x158]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401de0d0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401de0d0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14040fbd0
xor eax, eax
mov rcx, qword [rsp + 0x3e0]
xor rcx, rsp
call fcn.14040ff40
lea r11, [rsp + 0x420]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
mov rsp, r11
pop r15
pop r14
pop r13
ret
mov dword [rsp + 0xf8], ebx
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
call fcn.14012eed0
nop
call fcn.14012eed0
nop
call fcn.14012eed0
nop
call fcn.14012eed0
nop
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
mov ecx, eax
call sub.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_
nop
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
mov ecx, eax
call sub.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_
nop
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
mov ecx, eax
call sub.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_
nop
mov dword [rsp + 0x48], ebx
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov dword [rsp + 0x48], ebx
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3