Function at 0x140047ff0
Capabilities:
Create process on windows
Create thread
Inject dll
Inject thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xd98]
sub rsp, 0xe70
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x14009c030]
xor rax, rsp
mov qword [rbp + 0xd50], rax
mov qword [rsp + 0x58], rdx
mov dword [rbp - 0x80], ecx
xor ebx, ebx
mov dword [rsp + 0x50], ebx
xor ecx, ecx
call qword [sym.imp.MSVCP140.dll_public:_static_bool___cdecl_std::ios_base::sync_with_stdio_bool_]
mov r14d, 1
mov dword [rbp + 0x780], r14d
mov byte [rbp + 0x784], r14b
xorps xmm0, xmm0
movups xmmword [rbp + 0x788], xmm0
mov qword [rbp + 0x798], rbx
mov qword [rbp + 0x7a0], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x788], bl
movups xmmword [rbp + 0x7a8], xmm0
mov qword [rbp + 0x7b8], rbx
mov qword [rbp + 0x7c0], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x7a8], bl
movups xmmword [rbp + 0x7c8], xmm0
mov qword [rbp + 0x7d8], rbx
mov qword [rbp + 0x7e0], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x7c8], bl
movups xmmword [rbp + 0x7e8], xmm0
mov qword [rbp + 0x7f8], rbx
mov qword [rbp + 0x800], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x7e8], bl
movups xmmword [rbp + 0x808], xmm0
mov qword [rbp + 0x818], rbx
mov qword [rbp + 0x820], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x808], bl
movups xmmword [rbp + 0x828], xmm0
mov qword [rbp + 0x838], rbx
mov qword [rbp + 0x840], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x828], bl
movups xmmword [rbp + 0x848], xmm0
mov qword [rbp + 0x858], rbx
mov qword [rbp + 0x860], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x848], bl
call fcn.14005d740
lea rcx, str.branch_params.json
mov qword [rbp], rcx
mov qword [rbp + 8], reloc.WS2_32.dll_select
lea r8, [rbp]
mov edx, eax
lea rcx, [rbp + 0x740]
call fcn.140003920
nop
call fcn.14005d740
lea rcx, [0x14008b9ac]
mov qword [rbp + 0x10], rcx
mov r12d, 3
mov qword [rbp + 0x18], r12
lea r8, [rbp + 0x10]
mov edx, eax
lea rcx, [rbp + 0x700]
call fcn.140003920
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x5a0], xmm0
movdqa xmm1, xmmword [0x14008be30]
movdqu xmmword [rbp + 0x5b0], xmm1
mov word [rbp + 0x5a0], bx
mov dword [rsp + 0x50], 0x1f
lea rcx, [rbp + 0x5a0]
call fcn.1400471b0
test eax, eax
jne 0x140049f67
lea r10, [rbp + 0x5a0]
cmp qword [rbp + 0x5b8], 8
cmovae r10, qword [rbp + 0x5a0]
mov rax, qword [rbp + 0x5b0]
lea rdx, [r10 + rax*2]
mov rcx, r10
call fcn.140003a80
cmp rax, rdx
je 0x14004825c
movzx ecx, word [rax]
cmp cx, 0x5c
je 0x140048204
cmp cx, 0x2f
jne 0x14004820d
add rax, 2
cmp rax, rdx
jne 0x1400481f5
cmp rax, rdx
je 0x14004825c
lea r8, [rdx - 2]
movzx ecx, word [r8]
cmp cx, 0x5c
je 0x140048230
cmp cx, 0x2f
je 0x140048230
mov rdx, r8
cmp rax, r8
jne 0x140048212
jmp 0x14004825c
cmp rax, rdx
je 0x14004825c
nop word [rax + rax]
lea r8, [rdx - 2]
movzx ecx, word [r8]
cmp cx, 0x5c
je 0x140048254
cmp cx, 0x2f
jne 0x14004825c
mov rdx, r8
cmp rax, r8
jne 0x140048240
sub rdx, r10
sar rdx, 1
xorps xmm0, xmm0
movups xmmword [rbp + 0x660], xmm0
mov qword [rbp + 0x670], rbx
mov qword [rbp + 0x678], rbx
mov r8, rdx
mov rdx, r10
lea rcx, [rbp + 0x660]
call fcn.140024fc0
mov dword [rsp + 0x50], 0xff
lea rdx, [rbp + 0x660]
lea rcx, [rbp + 0x720]
call fcn.14001bc90
mov dword [rsp + 0x50], 0x1ff
lea rdx, [rbp + 0x700]
lea rcx, [rbp + 0x720]
call fcn.140003b70
nop
lea rdx, [rbp + 0x720]
lea rcx, [rbp + 0x6e0]
call fcn.14001bc90
mov dword [rsp + 0x50], 0x3ff
lea rdx, [rbp + 0x740]
lea rcx, [rbp + 0x6e0]
call fcn.140003b70
mov r8d, r14d
lea rdx, [rbp + 0x6e0]
lea rcx, [rbp + 0x3c0]
call fcn.1400235f0
nop
mov rdx, qword [rbp + 0x6f8]
cmp rdx, 8
jb 0x140048351
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x6e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004834c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004834c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005e390
movdqa xmm0, xmmword [0x14008be30]
movdqu xmmword [rbp + 0x6f0], xmm0
mov word [rbp + 0x6e0], bx
mov rdx, qword [rbp + 0x738]
cmp rdx, 8
jb 0x1400483b1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x720]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400483ac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400483ac
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005e390
movdqa xmm0, xmmword [0x14008be30]
movdqu xmmword [rbp + 0x730], xmm0
mov word [rbp + 0x720], bx
mov rdx, qword [rbp + 0x678]
cmp rdx, 8
jb 0x140048411
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x660]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004840c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004840c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005e390
movdqa xmm0, xmmword [0x14008be30]
movdqu xmmword [rbp + 0x670], xmm0
mov word [rbp + 0x660], bx
mov dword [rsp + 0x50], 0xef
mov rdx, qword [rbp + 0x5b8]
cmp rdx, 8
jb 0x140048479
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x5a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140048474
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140048474
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005e390
movdqa xmm0, xmmword [0x14008be30]
movdqu xmmword [rbp + 0x5b0], xmm0
mov word [rbp + 0x5a0], bx
mov rdx, qword [rbp + 0x718]
cmp rdx, 8
jb 0x1400484d9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x700]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400484d4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400484d4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005e390
movdqa xmm0, xmmword [0x14008be30]
movdqu xmmword [rbp + 0x710], xmm0
mov word [rbp + 0x700], bx
mov rdx, qword [rbp + 0x758]
cmp rdx, 8
jb 0x140048539
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x740]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140048534
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140048534
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005e390
movdqa xmm0, xmmword [0x14008be30]
movdqu xmmword [rbp + 0x750], xmm0
mov word [rbp + 0x740], bx
movabs rdi, 0x3b7076c3eeb5f549
movabs rsi, 0xf5f5d70625172ec6
mov r13, 0xffffffffffffffff
cmp qword [rbp + 0x450], 0
je 0x14004869c
mov qword [rbp + 0x2c8], rbx
lea rax, [rbp + 0x290]
mov qword [rsp + 0x60], rax
xor edx, edx
lea rcx, [rbp - 0x60]
call fcn.14001d6a0
nop
mov dword [rsp + 0x50], 0x40ef
lea rax, [rbp + 0x310]
mov qword [rsp + 0x78], rax
mov qword [rbp + 0x348], rbx
mov rcx, qword [rbp + 0x2c8]
test rcx, rcx
je 0x1400485d2
mov rax, qword [rcx]
lea rdx, [rbp + 0x310]
call qword [rax]
mov qword [rbp + 0x348], rax
lea rax, [rbp + 0x3c0]
mov qword [rbp - 0x40], rax
mov rax, qword [rbp + 0x3c0]
movsxd rcx, dword [rax + 4]
mov rax, qword [rbp + rcx + 0x408]
mov qword [rbp - 0x38], rax
lea r8, [rbp + 0x310]
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0xc40]
call fcn.14004d200
nop
lea r8, [rbp - 0x60]
mov rcx, rax
call fcn.14004b2c0
nop
lea rcx, [rbp + 0xc88]
call fcn.14004b1b0
mov rcx, qword [rbp + 0xc78]
test rcx, rcx
je 0x14004864b
mov rax, qword [rcx]
lea rdx, [rbp + 0xc40]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov qword [rbp + 0xc78], rbx
mov rcx, qword [rbp + 0x2c8]
test rcx, rcx
je 0x140048671
mov rax, qword [rcx]
lea rdx, [rbp + 0x290]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov qword [rbp + 0x2c8], rbx
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x780]
call fcn.140019500
mov dword [rsp + 0x50], 0xef
movzx edx, byte [rbp - 0x60]
lea rcx, [rbp - 0x58]
call fcn.14001d170
nop
jmp 0x14004872d
movabs rax, 0x5e1c13b1b1d88324
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rbp + 0x630], rax
movabs rax, 0xf5f5d70625725da7
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rbp + 0x638], rax
mov qword [rsp + 0x60], rdi
mov rax, qword [rsp + 0x60]
mov qword [rbp + 0x20], rax
mov qword [rsp + 0x60], rsi
mov rax, qword [rsp + 0x60]
mov qword [rbp + 0x28], rax
movdqa xmm0, xmmword [rbp + 0x20]
xorps xmm0, xmmword [rbp + 0x630]
movdqa xmmword [rbp + 0x630], xmm0
lea rax, [rbp + 0x630]
mov r8, r13
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140048710
lea rdx, [rbp + 0x630]
lea rcx, [rbp + 0x788]
call fcn.14001bf80
movabs rax, 0x480313af86c69421
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rbp + 0x620], rax
movabs rax, 0xf596be6a47625e99
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rbp + 0x628], rax
mov qword [rsp + 0x60], rdi
mov rax, qword [rsp + 0x60]
mov qword [rbp + 0x30], rax
mov qword [rsp + 0x60], rsi
mov rax, qword [rsp + 0x60]
mov qword [rbp + 0x38], rax
movdqa xmm0, xmmword [rbp + 0x620]
xorps xmm0, xmmword [rbp + 0x30]
movdqa xmmword [rbp + 0x620], xmm0
lea rax, [rbp + 0x620]
mov r8, r13
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400487a0
lea rdx, [rbp + 0x620]
lea rcx, [rbp + 0x7a8]
call fcn.14001bf80
movabs rax, 0x5e1c58a29cd39b20
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rbp + 0x590], rax
movabs rax, 0xf5f5d76357395aa3
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rbp + 0x598], rax
mov qword [rsp + 0x60], rdi
mov rax, qword [rsp + 0x60]
mov qword [rbp + 0x40], rax
mov qword [rsp + 0x60], rsi
mov rax, qword [rsp + 0x60]
mov qword [rbp + 0x48], rax
movdqa xmm0, xmmword [rbp + 0x590]
xorps xmm0, xmmword [rbp + 0x40]
movdqa xmmword [rbp + 0x590], xmm0
lea rax, [rbp + 0x590]
mov r8, r13
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140048830
lea rdx, [rbp + 0x590]
lea rcx, [rbp + 0x848]
call fcn.14001bf80
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x50], xmm0
lea r8, [rbp + 0x50]
lea rdx, [rbp + 0x780]
lea rcx, [rbp + 0x8b0]
call fcn.1400479a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x5c0], xmm0
movdqa xmm1, xmmword [0x14008be30]
movdqu xmmword [rbp + 0x5d0], xmm1
mov word [rbp + 0x5c0], bx
mov dword [rsp + 0x50], 0x4ef
lea rcx, [rbp + 0x5c0]
call fcn.1400471b0
test eax, eax
jne 0x140049f6f
lea r10, [rbp + 0x5c0]
cmp qword [rbp + 0x5d8], 8
cmovae r10, qword [rbp + 0x5c0]
mov rax, qword [rbp + 0x5d0]
lea rdx, [r10 + rax*2]
mov rcx, r10
call fcn.140003a80
cmp rax, rdx
je 0x14004894c
nop dword [rax]
movzx ecx, word [rax]
cmp cx, 0x5c
je 0x1400488ef
cmp cx, 0x2f
jne 0x1400488f8
add rax, 2
cmp rax, rdx
jne 0x1400488e0
cmp rax, rdx
je 0x14004894c
nop dword [rax]
lea r8, [rdx - 2]
movzx ecx, word [r8]
cmp cx, 0x5c
je 0x14004891e
cmp cx, 0x2f
je 0x14004891e
mov rdx, r8
cmp rax, r8
jne 0x140048900
jmp 0x14004894c
cmp rax, rdx
je 0x14004894c
nop dword [rax]
nop word [rax + rax]
lea r8, [rdx - 2]
movzx ecx, word [r8]
cmp cx, 0x5c
je 0x140048944
cmp cx, 0x2f
jne 0x14004894c
mov rdx, r8
cmp rax, r8
jne 0x140048930
sub rdx, r10
sar rdx, 1
xorps xmm0, xmm0
movups xmmword [rbp + 0x570], xmm0
mov qword [rbp + 0x580], rbx
mov qword [rbp + 0x588], rbx
mov r8, rdx
mov rdx, r10
lea rcx, [rbp + 0x570]
call fcn.140024fc0
mov dword [rsp + 0x50], 0x3cef
lea r9, [rbp + 0x570]
mov rsi, qword [rbp + 0x570]
mov r15, qword [rbp + 0x588]
cmp r15, 8
cmovae r9, rsi
mov rdx, qword [rbp + 0x580]
mov rax, qword [rbp + 0x8d8]
cmp rdx, rax
ja 0x1400489ea
lea rdi, [rbp + 0x8c0]
cmp rax, 8
cmovae rdi, qword [rbp + 0x8c0]
mov qword [rbp + 0x8d0], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, r9
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
xor eax, eax
mov word [rdi + rbx], ax
xor ebx, ebx
jmp 0x140048a04
lea rcx, [rbp + 0x8c0]
call fcn.140025770
mov r15, qword [rbp + 0x588]
mov rsi, qword [rbp + 0x570]
cmp r15, 8
jb 0x140048a42
lea rdx, [r15*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140048a3a
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140048a3a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.14005e390
movdqa xmm0, xmmword [0x14008be30]
movdqu xmmword [rbp + 0x580], xmm0
mov word [rbp + 0x570], bx
mov rdx, qword [rbp + 0x5d8]
cmp rdx, 8
jb 0x140048aa2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x5c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140048a9d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140048a9d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005e390
movdqa xmm0, xmmword [0x14008be30]
movdqu xmmword [rbp + 0x5d0], xmm0
mov word [rbp + 0x5c0], bx
lea rcx, [rbp + 0x8b0]
call fcn.140014a70
test al, al
je 0x140049d48
lea rcx, [rbp + 0x8b0]
call fcn.140017850
test al, al
je 0x140049d48
cmp byte [rbp + 0x90c], 0
jne 0x140048d15
lea r8, [rbp + 0x9b0]
cmp qword [rbp + 0x9c8], 0x10
cmovae r8, qword [rbp + 0x9b0]
xor r12d, r12d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9d, dword [rbp + 0x9c0]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
xorps xmm0, xmm0
movups xmmword [rbp + 0x5e0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x5f0], xmm1
mov r8, rbx
lea rcx, [rbp + 0x5e0]
call fcn.140046d40
lea rdx, [rbp + 0x5e0]
cmp qword [rbp + 0x5f8], 8
cmovae rdx, qword [rbp + 0x5e0]
lea r8, [rbp + 0x9b0]
cmp qword [rbp + 0x9c8], 0x10
cmovae r8, qword [rbp + 0x9b0]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdx
mov r9d, dword [rbp + 0x9c0]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
nop
lea rax, [rbp + 0x5e0]
cmp qword [rbp + 0x5f8], 8
cmovae rax, qword [rbp + 0x5e0]
mov qword [rbp + 0x60], rax
mov rax, qword [rbp + 0x5f0]
mov qword [rbp + 0x68], rax
movups xmm0, xmmword [rbp + 0x60]
movups xmmword [rbp + 0x878], xmm0
movabs rax, 0xc000000000000000
mov qword [rbp + 0x870], rax
mov qword [rbp + 0x70], r14
lea rax, [rbp + 0x870]
mov qword [rbp + 0x78], rax
lea rax, str.MVM_is_currently_unavailable._Reason:_
mov qword [rbp + 0x80], rax
mov qword [rbp + 0x88], 0x28
movaps xmm0, xmmword [rbp + 0x70]
movdqa xmmword [rbp + 0x260], xmm0
movaps xmm1, xmmword [rbp + 0x80]
movdqa xmmword [rbp + 0x270], xmm1
lea r8, [rbp + 0x260]
lea rdx, [rbp + 0x270]
lea rcx, [rbp + 0x6a0]
call fcn.14004d3d0
lea rdx, [rbp + 0x6a0]
cmp qword [rbp + 0x6b8], 8
cmovae rdx, qword [rbp + 0x6a0]
xor r9d, r9d
lea r8, [0x14008b9b0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rdx, qword [rbp + 0x6b8]
cmp rdx, 8
jb 0x140048caa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x6a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140048ca5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140048ca5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005e390
movdqa xmm0, xmmword [0x14008be30]
movdqu xmmword [rbp + 0x6b0], xmm0
mov word [rbp + 0x6a0], r12w
mov rdx, qword [rbp + 0x5f8]
cmp rdx, 8
jb 0x140048d0b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x5e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140048d06
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140048d06
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005e390
mov eax, 6
jmp 0x140049d69
mov r15d, 2
mov edx, r15d
lea rcx, [rbp + 0x4d0]
call qword [sym.imp.MSVCP140.dll__Mtx_init_in_situ]
nop
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], rbx
mov dword [rsp + 0x50], 0x8038ef
mov dword [rsp + 0x78], r14d
mov rcx, qword [rbp + 0x9f8]
sub rcx, qword [rbp + 0x9f0]
movabs rax, 0x8888888888888889
imul rcx
add rdx, rcx
sar rdx, 6
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, r14
cmp rdx, 0x32
jbe 0x140048d93
mov dword [rsp + 0x78], r15d
mov eax, r15d
cmp byte [0x1400a1cfc], 0
je 0x140048d93
mov dword [rsp + 0x78], r12d
mov rax, r12
lea rcx, [rbp + 0x8b0]
mov qword [rbp + 0x108], rcx
lea rcx, [rsp + 0x78]
mov qword [rbp + 0x110], rcx
lea rcx, [rbp + 0x4d0]
mov qword [rbp + 0x118], rcx
lea rcx, [rbp - 0x78]
mov qword [rbp + 0x120], rcx
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x108]
mov qword [rsp + 0x20], rax
mov r9, rdx
lea rdx, [rbp + 0xf0]
mov rcx, qword [rbp + 0x8b0]
call fcn.140023220
nop
xor r12d, r12d
mov edi, r12d
mov rsi, qword [rbp + 0xf8]
mov rbx, qword [rbp + 0xf0]
sub rsi, rbx
sar rsi, 4
test rsi, rsi
je 0x140048e41
nop
mov rcx, qword [rbx]
test rcx, rcx
je 0x140049f77
cmp byte [rbx + 8], r12b
je 0x140048e2f
cmp byte [rcx + 0xb8], r12b
jne 0x140049f77
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
inc rdi
add rbx, 0x10
cmp rdi, rsi
jb 0x140048e10
lea rcx, [rbp + 0xf0]
call fcn.14001ca80
nop
lea rcx, [rbp + 0x4d0]
call qword [sym.imp.MSVCP140.dll__Mtx_destroy_in_situ]
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0x8b0]
call fcn.140016f70
nop
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x140048ec1
mov rax, qword [rbp - 0x68]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140048eb0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140048eb0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005e390
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], r12
cmp byte [rbp + 0x900], 0
je 0x140049001
call fcn.1400175e0
mov rbx, qword [rbp + 0x9f0]
mov rax, qword [rbp + 0x9f8]
cmp rbx, rax
je 0x140048ef5
test byte [rbx + 0x50], 8
jne 0x140048efd
add rbx, 0x78
cmp rbx, rax
jne 0x140048ee6
mov eax, r13d
jmp 0x140049d69
test rbx, rbx
je 0x140048ef5
lea rdx, [rbx + 0x10]
lea rcx, [rbp + 0x888]
call fcn.14001bc90
nop
lea rdx, [rbx + 0x10]
lea rcx, [rbp + 0x760]
call fcn.14001bc90
lea r8, [rbp + 0x760]
cmp qword [rbp + 0x778], 8
cmovae r8, qword [rbp + 0x760]
mov dword [rsp + 0x28], 9
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rbx, rax
mov rdx, qword [rbp + 0x778]
cmp rdx, 8
jb 0x140048fa6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x760]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140048fa0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140048fa0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005e390
nop
neg rbx
sbb edi, edi
neg edi
dec edi
mov rdx, qword [rbp + 0x8a0]
cmp rdx, 8
jb 0x140049d6b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x888]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140048ff7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140048ff7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005e390
jmp 0x140049d6b
call fcn.14005d740
lea rcx, str.update.tag
mov qword [rbp + 0x90], rcx
mov qword [rbp + 0x98], 0xa
lea r8, [rbp + 0x90]
mov edx, eax
lea rcx, [rbp + 0x6c0]
call fcn.140003920
nop
lea rdx, [rbp + 0x6c0]
lea rcx, [rbp + 0x2f0]
call fcn.140004c20
movsd xmm0, qword [rax]
movsd qword [rsp + 0x60], xmm0
mov ecx, dword [rax + 8]
mov dword [rbp + 0xa0], ecx
lea rsi, [0x14009c0a8]
mov qword [rbp + 0xa8], rsi
movaps xmm0, xmmword [rbp + 0xa0]
movdqa xmmword [rbp - 0x30], xmm0
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x1400490cf
mov dword [rbp - 0x30], r12d
mov qword [rbp - 0x28], rsi
cmp eax, 1
setne bl
mov rdx, qword [rbp + 0x6d8]
cmp rdx, 8
jb 0x1400490e0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x6c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400490db
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400490db
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
xor bl, bl
test ecx, ecx
jne 0x140049f37
jmp 0x14004908b
call fcn.14005e390
movdqa xmm0, xmmword [0x14008be30]
movdqu xmmword [rbp + 0x6d0], xmm0
mov word [rbp + 0x6c0], r12w
test bl, bl
je 0x140049276
call fcn.1400175e0
mov rdi, qword [rbp + 0x9f8]
mov rbx, qword [rbp + 0x9f0]
cmp rbx, rdi
je 0x140049276
lea rax, str.___old__
mov qword [rbp + 0xb0], rax
mov qword [rbp + 0xb8], 8
add rbx, 0x50
movaps xmm6, xmmword [rbp + 0xb0]
lea rdx, [rbx - 0x40]
lea rcx, [rbp + 0x2d0]
call fcn.14001bc90
movdqa xmmword [rbp + 0x280], xmm6
lea r8, [rbp + 0x280]
lea rdx, [rbp + 0x2d0]
lea rcx, [rbp + 0x600]
call fcn.140019040
nop
test byte [rbx], 2
je 0x140049205
lea rdx, [rbp + 0x600]
lea rcx, [rbp + 0x300]
call fcn.140004c20
movsd xmm0, qword [rax]
movsd qword [rbp + 0xe0], xmm0
mov ecx, dword [rax + 8]
mov dword [rbp + 0xc0], ecx
mov qword [rbp + 0xc8], rsi
movaps xmm0, xmmword [rbp + 0xc0]
movdqa xmmword [rbp - 0x50], xmm0
mov eax, dword [rbp + 0xe0]
test eax, eax
je 0x1400491fd
mov dword [rbp - 0x50], r12d
mov qword [rbp - 0x48], rsi
cmp eax, 1
je 0x140049205
lea rcx, [rbp + 0x600]
cmp qword [rbp + 0x618], 8
cmovae rcx, qword [rbp + 0x600]
call fcn.14005ddd4
mov qword [rsp + 0x60], rax
shr rax, 0x20
test eax, eax
jne 0x140049f4f
jmp 0x140049205
test ecx, ecx
jne 0x140049f1f
mov rdx, qword [rbp + 0x618]
cmp rdx, 8
jb 0x14004924b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x600]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049246
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400493ba
call fcn.14005e390
mov qword [rbp + 0x610], r12
mov qword [rbp + 0x618], 7
mov word [rbp + 0x600], r12w
add rbx, 0x78
lea rax, [rbx - 0x50]
cmp rax, rdi
jne 0x140049140
lea rax, [0x14008b7d8]
mov qword [rbp + 0x130], rax
lea rax, [0x140086da8]
mov qword [rbp + 0x140], rax
lea rcx, [rbp + 0x1c8]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::constructor_void____ptr64]
nop
mov dword [rsp + 0x50], 0x70038ef
xor r8d, r8d
lea rdx, [rbp + 0x148]
lea rcx, [rbp + 0x130]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_iostream_wchar_t__struct_std::char_traits_wchar_t__::constructor_class_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t______ptr64____ptr64]
nop
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rbp + rcx + 0x130], rax
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx + 0x12c], edx
lea rcx, [rbp + 0x148]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__::constructor_void____ptr64]
lea rax, vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rbp + 0x148], rax
mov r8, r12
mov qword [rbp + 0x1b0], r12
mov ecx, r12d
mov dword [rbp + 0x1b8], ecx
movsxd rbx, dword [rbp - 0x80]
cmp rbx, 1
jle 0x140049364
mov rdi, qword [rsp + 0x58]
nop
mov rdx, qword [rdi + r14*8]
lea rcx, [rbp + 0x140]
call fcn.14004ad40
mov rcx, rax
lea rdx, [0x14008bad4]
call fcn.14004ad40
inc r14
cmp r14, rbx
jl 0x140049330
mov ecx, dword [rbp + 0x1b8]
mov r8, qword [rbp + 0x1b0]
xorps xmm0, xmm0
movups xmmword [rbp + 0x550], xmm0
mov qword [rbp + 0x560], r12
mov qword [rbp + 0x568], 7
mov word [rbp + 0x550], r12w
mov dword [rsp + 0x50], 0x70238ef
mov eax, ecx
and al, 0x22
cmp al, 2
je 0x1400493c1
mov rax, qword [rbp + 0x188]
mov rdx, qword [rax]
test rdx, rdx
je 0x1400493c1
mov rax, qword [rbp + 0x168]
mov r9, qword [rax]
cmp rdx, r8
cmovb rdx, r8
jmp 0x1400493ed
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
test cl, 4
jne 0x14004942c
mov rax, qword [rbp + 0x180]
mov rdx, qword [rax]
test rdx, rdx
je 0x14004942c
mov rax, qword [rbp + 0x160]
mov r9, qword [rax]
mov rax, qword [rbp + 0x198]
movsxd rcx, dword [rax]
lea rdx, [rdx + rcx*2]
sub rdx, r9
sar rdx, 1
test r9, r9
je 0x14004942c
lea rcx, [rbp + 0x550]
cmp rdx, 7
ja 0x140049426
mov qword [rbp + 0x560], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
mov word [rbp + rbx + 0x550], r12w
jmp 0x14004942c
call fcn.140025770
nop
mov ebx, 0x70138ef
mov r8d, 0x61
lea rdx, str._devmode__onlineserver_127.0.0.1__bootstrap_russia__disablebootstrapmode__language_Russian__steam
lea rcx, [rbp + 0x550]
call fcn.14001bc10
xorps xmm0, xmm0
movups xmmword [rbp + 0x520], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x530], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x520], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x530], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
bts ebx, 0xf
mov dword [rsp + 0x50], ebx
mov rdx, qword [rbp + 0x568]
cmp rdx, 8
jb 0x1400494d5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x550]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400494d0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400494d0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005e390
mov qword [rbp + 0x560], r12
mov qword [rbp + 0x568], 7
mov word [rbp + 0x550], r12w
mov dword [rbp + 0x350], WSAGetLastError
xorps xmm0, xmm0
movups xmmword [rbp + 0x358], xmm0
movups xmmword [rbp + 0x368], xmm0
movups xmmword [rbp + 0x378], xmm0
movups xmmword [rbp + 0x388], xmm0
movups xmmword [rbp + 0x398], xmm0
movups xmmword [rbp + 0x3a8], xmm0
lea rdx, [rbp + 0x520]
cmp qword [rbp + 0x538], 8
cmovae rdx, qword [rbp + 0x520]
lea rax, [rbp + 0x240]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x350]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rcx, str.Game.exe
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14004959e
xor r9d, r9d
lea r8, str.Start_Game.exe_fail
lea rdx, str.Failed_to_start_Game.exe._Copy_files_from_Bin64Release_to_Bin64Editing.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x1400497f3
movabs rax, 0x521433f7d8db9c0b
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rbp + 0x680], rax
movabs rax, 0xb8a39a5a427947b2
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rbp + 0x688], rax
movabs rax, 0xb90797dba81ea05
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rbp + 0x690], rax
movabs rcx, 0x9647da305ff4ca28
mov qword [rsp + 0x58], rcx
mov rax, qword [rsp + 0x58]
mov qword [rbp + 0x698], rax
movabs rax, 0x3b7076c3eeb5f549
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rbp + 0xd30], rax
movabs rax, 0xf5f5d70625172ec6
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rbp + 0xd38], rax
movabs rax, 0xb90797dd6ed8e2b
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rbp + 0xd40], rax
mov qword [rsp + 0x58], rcx
mov rax, qword [rsp + 0x58]
mov qword [rbp + 0xd48], rax
movdqa xmm0, xmmword [rbp + 0xd30]
xorps xmm0, xmmword [rbp + 0x680]
movdqa xmmword [rbp + 0x680], xmm0
movdqa xmm1, xmmword [rbp + 0x690]
xorps xmm1, xmmword [rbp + 0xd40]
movdqa xmmword [rbp + 0x690], xmm1
lea rax, [rbp + 0x680]
mov r15, r13
inc r15
cmp byte [rax + r15], 0
jne 0x1400496a4
mov rdi, qword [rbp + 0x9f0]
mov rax, qword [rbp + 0x9f8]
mov qword [rsp + 0x58], rax
cmp rdi, rax
je 0x1400497ed
mov esi, dword [rsp + 0x50]
nop
test byte [rdi + 0x50], 1
je 0x140049764
call fcn.14005d740
lea rcx, [rbp + 0x680]
mov qword [rbp + 0xd0], rcx
mov qword [rbp + 0xd8], r15
lea r8, [rbp + 0xd0]
mov edx, eax
lea rcx, [rbp + 0x640]
call fcn.140003920
or esi, 0x1c0000
mov dword [rsp + 0x50], esi
lea rax, [rbp + 0x640]
mov rbx, qword [rbp + 0x640]
mov r14, qword [rbp + 0x658]
cmp r14, 8
cmovae rax, rbx
mov qword [rbp - 0x20], rax
mov rax, qword [rbp + 0x650]
mov qword [rbp - 0x18], rax
movaps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp + 0x230], xmm0
lea rcx, [rdi + 0x10]
lea rdx, [rbp + 0x230]
call fcn.140003f00
test eax, eax
jne 0x140049772
mov r12b, 1
jmp 0x140049775
mov r14, qword [rbp + 0x658]
mov rbx, qword [rbp + 0x640]
xor r12b, r12b
bt esi, 0x12
jae 0x1400497d9
btr esi, 0x12
mov dword [rsp + 0x50], esi
cmp r14, 8
jb 0x1400497be
lea rdx, [r14*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x1400497b6
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140049849
mov rcx, rbx
call fcn.14005e390
xor eax, eax
mov qword [rbp + 0x650], rax
mov qword [rbp + 0x658], 7
mov word [rbp + 0x640], ax
test r12b, r12b
jne 0x140049850
add rdi, 0x78
cmp rdi, qword [rsp + 0x58]
jne 0x1400496d0
mov r15d, 4
mov edi, r15d
xor r12d, r12d
mov rdx, qword [rbp + 0x538]
cmp rdx, 8
jb 0x140049cd6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x520]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049cd1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140049cd1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rdi, rdi
je 0x1400497ed
mov rax, qword [rdi + 0x48]
add rdi, 0x58
cmp qword [rdi + 0x18], 0x10
jb 0x140049867
mov rdi, qword [rdi]
mov qword [rbp - 0x80], rax
mov rcx, qword [rbp + 0x240]
test rcx, rcx
je 0x140049cc7
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8, qword [rbp - 0x80]
movabs rdx, 0x340000000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
xor r12d, r12d
test rax, rax
je 0x1400498d9
mov qword [rsp + 0x20], r12
mov r9, qword [rbp - 0x80]
mov r8, rdi
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [rsp + 0x20], 4
movabs rdx, 0x350000000
mov r9d, 0x3000
mov r8d, 8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
test rax, rax
je 0x140049cc7
mov qword [rsp + 0x20], r12
mov r9d, 8
lea r8, [rbp - 0x80]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movabs rax, 0x4b1104b4b1d88324
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rbp + 0x540], rax
movabs rax, 0xf599bb620b654bb6
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rbp + 0x548], rax
movabs rax, 0x3b7076c3eeb5f549
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rbp - 0x10], rax
movabs rax, 0xf5f5d70625172ec6
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rbp - 8], rax
movdqa xmm0, xmmword [rbp + 0x540]
xorps xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rbp + 0x540], xmm0
mov rcx, qword [rbp + 0x240]
test rcx, rcx
je 0x140049cbd
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.LoadLibraryA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
je 0x140049cbd
lea rax, [rbp + 0x540]
mov r8, r13
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140049a00
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbx, rax
test rax, rax
je 0x140049cbd
lea rax, [rbp + 0x540]
mov r9, r13
nop dword [rax]
inc r9
cmp byte [rax + r9], 0
jne 0x140049a40
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0x540]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rbx
mov r9, rsi
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
nop
mov rdx, qword [rbp + 0x538]
cmp rdx, 8
jb 0x140049ac9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x520]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049ac4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140049842
call fcn.14005e390
movdqa xmm0, xmmword [0x14008be30]
movdqu xmmword [rbp + 0x530], xmm0
mov word [rbp + 0x520], r12w
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rbp + rcx + 0x130], rax
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx + 0x12c], edx
lea rcx, [rbp + 0x148]
call fcn.14004a740
lea rcx, [rbp + 0x150]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_iostream_wchar_t__struct_std::char_traits_wchar_t__::destructor_void____ptr64]
lea rcx, [rbp + 0x1c8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void____ptr64]
nop
lea rcx, [rbp + 0xa08]
call fcn.14004a810
lea rcx, [rbp + 0x9f0]
call fcn.14004a8e0
lea rcx, [rbp + 0x908]
call fcn.140047c60
mov rdx, qword [rbp + 0x8f8]
cmp rdx, 8
jb 0x140049ba4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x8e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049b9f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140049e26
call fcn.14005e390
movdqa xmm0, xmmword [0x14008be30]
movdqu xmmword [rbp + 0x8f0], xmm0
mov word [rbp + 0x8e0], r12w
mov rdx, qword [rbp + 0x8d8]
cmp rdx, 8
jb 0x140049c02
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x8c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049bfd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140049e26
call fcn.14005e390
movdqa xmm0, xmmword [0x14008be30]
movdqu xmmword [rbp + 0x8d0], xmm0
mov word [rbp + 0x8c0], r12w
mov rbx, qword [rbp + 0x8b8]
test rbx, rbx
je 0x140049c51
mov eax, r13d
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140049c51
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], r13d
cmp r13d, 1
jne 0x140049c51
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + ioctlsocket]
nop
mov rax, qword [rbp + 0x3c0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x3c0], rax
mov rax, qword [rbp + 0x3c0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x3bc], edx
lea rcx, [rbp + 0x3d0]
call fcn.14001a5b0
lea rcx, [rbp + 0x3d8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x470]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x780]
call fcn.140047c60
xor eax, eax
jmp 0x140049eea
mov edi, 3
jmp 0x1400497f9
mov edi, 3
jmp 0x1400497f6
call fcn.14005e390
movdqa xmm0, xmmword [0x14008be30]
movdqu xmmword [rbp + 0x530], xmm0
mov word [rbp + 0x520], r12w
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rbp + rcx + 0x130], rax
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx + 0x12c], edx
lea rcx, [rbp + 0x148]
call fcn.14004a740
lea rcx, [rbp + 0x150]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_iostream_wchar_t__struct_std::char_traits_wchar_t__::destructor_void____ptr64]
lea rcx, [rbp + 0x1c8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void____ptr64]
jmp 0x140049d6b
xor r9d, r9d
lea r8, [0x14008b9b0]
lea rdx, str.Failed_to_initialize_MVM._Check_your_internet_connection_or_contact_devs.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 5
xor r12d, r12d
mov edi, eax
lea rcx, [rbp + 0xa08]
call fcn.14004a810
lea rcx, [rbp + 0x9f0]
call fcn.14004a8e0
lea rcx, [rbp + 0x908]
call fcn.140047c60
mov rdx, qword [rbp + 0x8f8]
cmp rdx, 8
jb 0x140049dd1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x8e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049dcc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140049e26
call fcn.14005e390
movdqa xmm0, xmmword [0x14008be30]
movdqu xmmword [rbp + 0x8f0], xmm0
mov word [rbp + 0x8e0], r12w
mov rdx, qword [rbp + 0x8d8]
cmp rdx, 8
jb 0x140049e32
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x8c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049e2d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140049e2d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005e390
movdqa xmm0, xmmword [0x14008be30]
movdqu xmmword [rbp + 0x8d0], xmm0
mov word [rbp + 0x8c0], r12w
mov rbx, qword [rbp + 0x8b8]
test rbx, rbx
je 0x140049e81
mov eax, r13d
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140049e81
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], r13d
cmp r13d, 1
jne 0x140049e81
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + ioctlsocket]
nop
mov rax, qword [rbp + 0x3c0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x3c0], rax
mov rcx, qword [rbp + 0x3c0]
movsxd rdx, dword [rcx + 4]
lea r8d, [rdx - 0xb0]
mov dword [rbp + rdx + 0x3bc], r8d
lea rcx, [rbp + 0x3d0]
call fcn.14001a5b0
lea rcx, [rbp + 0x3d8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x470]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x780]
call fcn.140047c60
mov eax, edi
mov rcx, qword [rbp + 0xd50]
xor rcx, rsp
call fcn.14005e370
lea r11, [rsp + 0xe70]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea r8, [rbp + 0x600]
lea rdx, [rbp - 0x50]
lea rcx, str.exists
call fcn.140004bc0
nop
lea r8, [rbp + 0x6c0]
lea rdx, [rbp - 0x30]
lea rcx, str.exists
call fcn.140004bc0
nop
lea r8, [rbp + 0x600]
mov edx, dword [rsp + 0x64]
lea rcx, str.remove
call fcn.140004ad0
nop
mov edx, eax
call fcn.140046ce0
nop
mov edx, eax
call fcn.140046ce0
nop
mov ecx, 4
call fcn.140005060
int3