Function at 0x14005e530
Capabilities:
Check mutex on windows
Create process on windows
Execute command
Get token membership

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5d8]
sub rsp, 0x6a0
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
movaps xmmword [rax - 0x68], xmm8
movaps xmmword [rax - 0x78], xmm9
movaps xmmword [rax - 0x88], xmm10
movaps xmmword [rax - 0x98], xmm11
movaps xmmword [rax - 0xa8], xmm12
movaps xmmword [rax - 0xb8], xmm13
movaps xmmword [rax - 0xc8], xmm14
movaps xmmword [rax - 0xd8], xmm15
mov rax, qword [0x140162900]
xor rax, rsp
mov qword [rbp + 0x4f0], rax
mov dword [rbp - 0x78], r9d
mov r13, r8
mov rsi, rcx
call fcn.14005b440
call fcn.14005d460
xor r12d, r12d
mov dword [rsp + 0x78], r12d
mov qword [rsp + 0x70], r12
mov dword [rbp + 0x3c0], r12d
mov word [rbp + 0x3c4], 0x500
lea rax, [rsp + 0x70]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x40], r12d
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
mov r9d, 0x220
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov dl, 2
lea rcx, [rbp + 0x3c0]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x14005e638
lea r8, [rsp + 0x78]
mov rdx, qword [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [rsp + 0x78], 1
je 0x14005e77a
mov r8d, 0x104
lea rdx, [rbp + 0x190]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [rbp + 0x120], reloc.WS2_32.dll_WSASetLastError
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x124], xmm0
movups xmmword [rbp + 0x134], xmm0
movups xmmword [rbp + 0x144], xmm0
movups xmmword [rbp + 0x154], xmm0
movups xmmword [rbp + 0x164], xmm0
movups xmmword [rbp + 0x174], xmm0
mov qword [rbp + 0x184], rax
mov dword [rbp + 0x18c], eax
lea rax, str.runas
mov qword [rbp + 0x130], rax
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rcx + r13], r12b
jne 0x14005e6b3
mov rax, qword [rbp + 0x140]
test rcx, rcx
cmovne rax, r13
mov qword [rbp + 0x140], rax
lea rax, [rbp + 0x190]
mov qword [rbp + 0x138], rax
mov dword [rbp + 0x150], 1
lea rcx, [rbp + 0x120]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x14005e716
mov r9d, reloc.WS2_32.dll_recv
lea r8, [0x140148504]
lea rdx, [0x140148510]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov rcx, qword [rbp + 0x4f0]
xor rcx, rsp
call fcn.1400e10a0
lea r11, [rsp + 0x6a0]
mov rbx, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm12, xmmword [r11 - 0x70]
movaps xmm13, xmmword [r11 - 0x80]
movaps xmm14, xmmword [r11 - 0x90]
movaps xmm15, xmmword [r11 - 0xa0]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, str.Globalmisterfish
mov edx, 0x80
lea rcx, [rbp + 0x470]
call fcn.1400443c0
lea r8, [rbp + 0x470]
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rbx, rax
mov qword [rbp + 0x50], rax
test rax, rax
je 0x14005e7c3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1400617b8
cmp byte [0x140167bf1], r12b
je 0x14005e881
mov eax, dword [0x140167c24]
cmp eax, 1
jne 0x14005e7ea
call fcn.14005b830
test al, al
je 0x14005e7ff
mov eax, dword [0x140167c24]
test eax, eax
jne 0x14005e881
call fcn.14005b0b0
test al, al
jne 0x14005e881
mov byte [0x140167bf1], r12b
lea rdx, [0x140167bf1]
lea rcx, [rbp + 0x410]
call fcn.14006a350
mov rbx, rax
lea rdx, str.win_start
lea rcx, [0x140167c60]
call fcn.14006a300
mov rcx, rax
mov rdx, rbx
call fcn.140062ef0
mov byte [0x140167bf3], r12b
lea rdx, [0x140167bf3]
lea rcx, [rbp + 0x410]
call fcn.14006a350
mov rbx, rax
lea rdx, str.tray_start
lea rcx, [0x140167c60]
call fcn.14006a300
mov rcx, rax
mov rdx, rbx
call fcn.140062ef0
lea rcx, [0x140167c60]
call fcn.14005b900
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
lea rdx, [rbp + 0x450]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rbp + 0x458]
cdq
sub eax, edx
sar eax, 1
lea edi, [rax - 0x177]
mov eax, dword [rbp + 0x45c]
cdq
sub eax, edx
sar eax, 1
lea ebx, [rax - 0xfa]
mov dword [rbp + 0x70], 0x50
mov dword [rbp + 0x74], 0x40
lea rax, [0x140056780]
mov qword [rbp + 0x78], rax
mov qword [rbp + 0x80], r12
mov qword [rbp + 0x88], rsi
mov edx, 0x67
mov rcx, rsi
call qword [sym.imp.USER32.dll_LoadIconA]
mov qword [rbp + 0x90], rax
mov qword [rbp + 0x98], r12
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xa0], xmm0
lea rax, str.MisterFish
mov qword [rbp + 0xb0], rax
mov qword [rbp + 0xb8], r12
lea rcx, [rbp + 0x70]
call qword [sym.imp.USER32.dll_RegisterClassExA]
mov qword [rsp + 0x58], r12
mov rax, qword [rbp + 0x88]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], 0x1f4
mov dword [rsp + 0x30], 0x2ee
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], edi
mov r9d, 0x800a0000
lea r8, str.MisterFish_DPI
mov rdx, qword [rbp + 0xb0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [0x140167cc8], rax
lea rdx, [rbp + 0x460]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov qword [rbp + 0x134], r12
mov qword [rbp + 0x148], 2
mov qword [rbp + 0x160], 2
mov qword [rbp + 0x120], r12
mov dword [rbp + 0x130], Ordinal_32
mov dword [rbp + 0x128], reloc.WLDAP32.dll_Ordinal_60
mov dword [rbp + 0x12c], 1
mov dword [rbp + 0x144], reloc.WLDAP32.dll_Ordinal_32
mov rax, qword [0x140167cc8]
mov qword [rbp + 0x150], rax
mov qword [rbp + 0x13c], 1
mov qword [rbp + 0x158], 1
mov dword [rbp + 0x3c0], 0xb000
mov dword [rbp + 0x3c4], 0xa000
lea rbx, [0x140167cd0]
mov qword [rsp + 0x58], rbx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rax
lea rdi, [0x140167ca8]
mov qword [rsp + 0x48], rdi
lea rsi, [0x140167ca0]
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 0x120]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], 2
lea rax, [rbp + 0x3c0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call qword [sym.imp.d3d11.dll_D3D11CreateDeviceAndSwapChain]
cmp eax, 0x887a0004
jne 0x14005ead4
mov qword [rsp + 0x58], rbx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 0x120]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], 2
lea rax, [rbp + 0x3c0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 5
xor ecx, ecx
call qword [sym.imp.d3d11.dll_D3D11CreateDeviceAndSwapChain]
test eax, eax
je 0x14005eafb
call fcn.1400565c0
mov rdx, qword [rbp + 0x88]
mov rcx, qword [rbp + 0xb0]
call qword [sym.imp.USER32.dll_UnregisterClassA]
mov eax, 1
jmp 0x14005e718
mov rcx, qword [0x140167ca0]
mov rax, qword [rcx]
lea r9, [rsp + 0x70]
lea r8, [0x14014a3a8]
xor edx, edx
call qword [rax + 0x48]
mov rcx, qword [0x140167ca8]
mov rax, qword [rcx]
lea r9, [0x140167c98]
xor r8d, r8d
mov rdx, qword [rsp + 0x70]
call qword [rax + 0x48]
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov dword [rbp - 0x68], 2
mov r9d, 4
lea r8, [rbp - 0x68]
mov edx, reloc.WLDAP32.dll_Ordinal_33
mov rcx, qword [0x140167cc8]
call qword [sym.imp.dwmapi.dll_DwmSetWindowAttribute]
mov rsi, qword [0x140167bf8]
mov rdx, qword [0x140167be8]
mov ecx, 0x5618
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov r11, rax
mov r8, qword [0x140167bf8]
test r8, r8
je 0x14005ebe8
mov r9d, dword [r8 + 0x3fe8]
movsx r10, word [r8 + 0x5488]
lea rdx, [r8 + 0x548c]
lea rdx, [rdx + r10*8]
cmp dword [rdx], r9d
je 0x14005ebdd
lea ecx, [r10 + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x5488], cx
movsx rax, cx
lea rdx, [r8 + 0x548c]
lea rdx, [rdx + rax*8]
mov dword [rdx], r9d
mov dword [rdx + 4], r12d
inc word [rdx + 4]
inc dword [r8 + 0x5480]
test r11, r11
je 0x14005ebf9
xor edx, edx
mov rcx, r11
call fcn.140006c50
jmp 0x14005ebfc
mov rax, r12
mov qword [0x140167bf8], rax
call fcn.140007cf0
test rsi, rsi
je 0x14005ec16
mov qword [0x140167bf8], rsi
jmp 0x14005ec1d
mov rsi, qword [0x140167bf8]
mov qword [rsi + 0x20], r12
lea r15, [0x140146928]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r12
movss xmm3, dword [0x14014d8f8]
lea rdx, [0x14011a7c0]
mov rcx, qword [rsi + 0x38]
call fcn.14002d730
mov ebx, 1
nop
movd xmm3, ebx
cvtdq2ps xmm3, xmm3
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r12
lea rdx, [0x14011a7c0]
mov rcx, qword [rsi + 0x38]
call fcn.14002d730
mov r14, rax
mov rdi, qword [0x140167c50]
mov rcx, qword [rdi + 8]
mov qword [rbp + 0x100], rcx
mov dword [rbp + 0x108], r12d
mov rax, rdi
cmp byte [rcx + 0x19], r12b
jne 0x14005eccf
nop word [rax + rax]
mov qword [rbp + 0x100], rcx
cmp dword [rcx + 0x20], ebx
jge 0x14005ecb9
mov dword [rbp + 0x108], r12d
mov rcx, qword [rcx + 0x10]
jmp 0x14005ecc9
mov dword [rbp + 0x108], 1
mov rax, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], r12b
je 0x14005eca0
cmp byte [rax + 0x19], r12b
jne 0x14005ecda
cmp ebx, dword [rax + 0x20]
jge 0x14005ed36
movabs rax, 0x555555555555555
cmp qword [0x140167c58], rax
je 0x1400617d6
mov ecx, Ordinal_50
call fcn.1400e1678
mov dword [rax + 0x20], ebx
mov qword [rax + 0x28], r12
mov qword [rax], rdi
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
mov word [rax + 0x18], r12w
movups xmm0, xmmword [rbp + 0x100]
movaps xmmword [rbp + 0x3d0], xmm0
mov r8, rax
lea rdx, [rbp + 0x3d0]
lea rcx, [0x140167c50]
call fcn.14006edd0
mov qword [rax + 0x28], r14
inc ebx
cmp ebx, 0x1e
jle 0x14005ec50
mov rax, qword [0x140167bf8]
mov qword [rbp], rax
mov dword [rax + 0x396c], 0x40a00000
mov dword [rax + 0x395c], 0x40a00000
mov qword [rax + 0x3954], 0x40a00000
mov dword [rax + 0x393c], r12d
movss xmm0, dword [rax + 0x3934]
movss dword [0x140167c14], xmm0
movss xmm1, dword [rax + 0x3930]
movss dword [0x140167c10], xmm1
movdqa xmm0, xmmword [0x14014ddb0]
movups xmmword [rax + 0x3a38], xmm0
movdqa xmm1, xmmword [0x14014de00]
movups xmmword [rax + 0x3a88], xmm1
movups xmmword [rax + 0x3ab8], xmm1
movups xmmword [rax + 0x3ac8], xmm1
movups xmmword [rax + 0x3b68], xmm1
movdqa xmm0, xmmword [0x14014de20]
movups xmmword [rax + 0x3b78], xmm0
movdqa xmm1, xmmword [0x14014de30]
movups xmmword [rax + 0x3b88], xmm1
xor ecx, ecx
call fcn.1400291c0
mov rcx, qword [0x140167cc8]
call fcn.1400334c0
call fcn.140033310
mov dword [rbp - 0x70], r12d
mov dword [rsp + 0x78], r12d
mov qword [rbp - 0x58], r12
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x70]
lea r8, [rbp - 0x58]
mov edx, 0xc73
lea rcx, [0x140165080]
call fcn.1400563c0
test al, al
jne 0x14005ee5a
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140148568]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, qword [0x140167cc8]
call qword [sym.imp.USER32.dll_DestroyWindow]
jmp 0x14005e716
mov dword [rsp + 0x60], r12d
mov dword [rbp - 0x80], r12d
mov qword [rbp - 0x50], r12
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
lea r8, [rbp - 0x50]
mov edx, 0x26ab
lea rcx, [0x1401629d0]
call fcn.1400563c0
test al, al
je 0x14005ee33
mov dword [rbp + 0x3c0], r12d
mov dword [rsp + 0x70], r12d
mov qword [rbp - 0x48], r12
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x3c0]
lea r8, [rbp - 0x48]
mov edx, 0xde8
lea rcx, [0x140165d00]
call fcn.1400563c0
test al, al
je 0x14005ee33
mov ecx, 0x60
call fcn.1400e1678
mov r14, rax
mov rsi, qword [rbp - 0x58]
lea rdx, str.services
lea rcx, [0x140167c60]
call fcn.14006a300
lea rdx, str.youtube
mov rcx, rax
call fcn.14006a300
mov rcx, rax
call fcn.140069cf0
movzx edi, al
lea rdx, str.youtube
lea rcx, [rbp + 0x3a0]
call fcn.14005d310
mov rbx, rax
lea rdx, str.Youtube
lea rcx, [rbp + 0x3f0]
call fcn.14005d310
mov qword [rsp + 0x30], rsi
mov byte [rsp + 0x28], dil
mov qword [rsp + 0x20], rbx
mov r9, rax
mov r8d, dword [rsp + 0x78]
mov edx, dword [rbp - 0x70]
mov rcx, r14
call fcn.14005cf90
mov qword [rbp + 0x100], rax
mov ecx, 0x60
call fcn.1400e1678
mov r14, rax
mov rsi, qword [rbp - 0x50]
lea rdx, str.services
lea rcx, [0x140167c60]
call fcn.14006a300
lea rdx, str.discord
mov rcx, rax
call fcn.14006a300
mov rcx, rax
call fcn.140069cf0
movzx edi, al
lea rdx, str.discord
lea rcx, [rbp + 0x3d0]
call fcn.14005d310
mov rbx, rax
lea rdx, str.Discord
lea rcx, [rbp + 0xe0]
call fcn.14005d310
mov qword [rsp + 0x30], rsi
mov byte [rsp + 0x28], dil
mov qword [rsp + 0x20], rbx
mov r9, rax
mov r8d, dword [rbp - 0x80]
mov edx, dword [rsp + 0x60]
mov rcx, r14
call fcn.14005cf90
mov qword [rbp + 0x108], rax
mov ecx, 0x60
call fcn.1400e1678
mov r14, rax
mov rsi, qword [rbp - 0x48]
lea rdx, str.services
lea rcx, [0x140167c60]
call fcn.14006a300
lea rdx, [0x140147e30]
mov rcx, rax
call fcn.14006a300
mov rcx, rax
call fcn.140069cf0
movzx edi, al
lea rdx, [0x140147e30]
lea rcx, [rbp + 0x120]
call fcn.14005d310
mov rbx, rax
lea rdx, [0x140147e30]
lea rcx, [rbp + 0xc0]
call fcn.14005d310
mov qword [rsp + 0x30], rsi
mov byte [rsp + 0x28], dil
mov qword [rsp + 0x20], rbx
mov r9, rax
mov r8d, dword [rbp - 0x80]
mov edx, dword [rsp + 0x60]
mov rcx, r14
call fcn.14005cf90
mov qword [rbp + 0x110], rax
lea rdx, [rbp + 0x100]
mov r8d, 3
call fcn.14006a3f0
cmp byte [0x140167bf2], r12b
je 0x14005f122
lea rcx, [rbp + 0x410]
call fcn.1400638a0
lea rdx, str.https:__elllkere.top_misterfish_version.txt
lea rcx, [rbp + 0x430]
call fcn.14005d310
lea rdx, [rbp + 0x410]
lea rcx, [rbp + 0x430]
call fcn.14005a390
movzx ebx, al
lea rcx, [rbp + 0x430]
call fcn.140063690
test bl, bl
je 0x14005f165
cmp qword [rbp + 0x420], r12
je 0x14005f165
lea rcx, [rbp + 0x410]
call fcn.14006a3a0
test al, al
jne 0x14005f116
xor r9d, r9d
lea r8, str.MisterFish_DPI
lea rdx, [0x1401485c8]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rcx, [rbp + 0x410]
call fcn.140063690
lea rdx, str._autostart
mov rcx, r13
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x14005f140
cmp byte [0x140167bf3], r12b
je 0x14005f1a4
lea rdx, str._autostart
mov rcx, r13
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x14005f1a4
cmp byte [0x140167bf3], 1
jne 0x14005f1a4
call fcn.1400566c0
jmp 0x14005f1b4
lea rcx, [rbp + 0x410]
call fcn.140063690
mov edx, dword [rbp - 0x78]
mov rcx, qword [0x140167cc8]
call qword [sym.imp.USER32.dll_ShowWindow]
xor r9d, r9d
lea r13, str.MisterFish_DPI
mov r8, r13
lea rdx, [0x1401485f8]
mov rcx, qword [0x140167cc8]
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x14005f1bb
mov edx, dword [rbp - 0x78]
mov rcx, qword [0x140167cc8]
call qword [sym.imp.USER32.dll_ShowWindow]
lea r13, str.MisterFish_DPI
mov rcx, qword [0x140167cc8]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rdi, qword [0x140167cb8]
mov rbx, qword [0x140167cb0]
cmp rbx, rdi
je 0x14005f233
nop dword [rax + rax]
mov rax, qword [rbx]
cmp byte [rax + 0x48], r12b
je 0x14005f22a
mov rcx, qword [rax + 0x58]
test rcx, rcx
je 0x14005f222
mov rcx, qword [rcx]
cmp rcx, 0xffffffffffffffff
je 0x14005f222
test rcx, rcx
je 0x14005f222
lea rdx, [rbp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x14005f222
cmp dword [rbp + 0x3c0], 0x103
sete al
test al, al
jne 0x14005f22a
mov rcx, qword [rbx]
call fcn.14005d6a0
add rbx, 8
cmp rbx, rdi
jne 0x14005f1e0
xor r14b, r14b
movdqa xmm10, xmmword [0x14014ddf0]
movdqa xmm15, xmmword [0x14014dde0]
movss xmm9, dword [0x14014d968]
movss xmm13, dword [0x14014d958]
movss xmm14, dword [0x14014d890]
movss xmm12, dword [0x14014d860]
movss xmm11, dword [0x14014d8ec]
mov r12d, 1
xor r15d, r15d
nop
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x120]
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x14005f2f0
nop
lea rcx, [rbp + 0x120]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x120]
call qword [sym.imp.USER32.dll_DispatchMessageA]
movzx r14d, r14b
cmp dword [rbp + 0x128], 0x12
cmove r14d, r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x120]
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x14005f2a0
test r14b, r14b
jne 0x140061473
cmp byte [0x140167c2c], 0
je 0x14005f322
mov rcx, qword [0x140167ca0]
mov rax, qword [rcx]
mov r8d, r12d
xor edx, edx
call qword [rax + 0x40]
cmp eax, 0x87a0001
jne 0x14005f322
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14005f280
mov byte [0x140167c2c], 0
mov r8d, dword [0x140167c90]
test r8d, r8d
je 0x14005f3d6
mov r9d, dword [0x140167c94]
test r9d, r9d
je 0x14005f3d6
mov rcx, qword [0x140167c98]
test rcx, rcx
je 0x14005f370
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [0x140167c98], r15
mov r8d, dword [0x140167c90]
mov r9d, dword [0x140167c94]
mov rcx, qword [0x140167ca0]
mov rax, qword [rcx]
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
xor edx, edx
call qword [rax + 0x68]
mov dword [0x140167c94], r15d
mov dword [0x140167c90], r15d
mov rcx, qword [0x140167ca0]
mov rax, qword [rcx]
lea r9, [rbp - 0x40]
lea r8, [0x14014a3a8]
xor edx, edx
call qword [rax + 0x48]
mov rcx, qword [0x140167ca8]
mov rax, qword [rcx]
lea r9, [0x140167c98]
xor r8d, r8d
mov rdx, qword [rbp - 0x40]
call qword [rax + 0x48]
mov rcx, qword [rbp - 0x40]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rax, qword [0x140167bf8]
test rax, rax
je 0x14005f3eb
mov rcx, qword [rax + 0xa0]
jmp 0x14005f3ee
mov rcx, r15
cmp qword [rcx + 0x48], 0
jne 0x14005f3fa
call fcn.140032cb0
call fcn.140033ed0
call fcn.14000a9d0
mov rax, qword [0x140167bf8]
mov dword [rax + 0x4ae0], 0x443b8000
mov dword [rax + 0x4ae4], 0x43fa0000
mov dword [rax + 0x4ac8], r12d
or dword [rax + 0x4ac0], 3
mov qword [rax + 0x4ad0], 0
mov qword [rax + 0x4ad8], 0
mov dword [rax + 0x4ac4], r12d
xor edx, edx
mov r8d, 0x107
lea rcx, str.begin
call fcn.140010420
test al, al
je 0x1400617c6
mov rbx, qword [0x140167bf8]
mov dword [rbp + 0x3a0], 3
movups xmm0, xmmword [rbx + 0x3a48]
movups xmmword [rbp + 0x3a4], xmm0
lea rcx, [rbx + 0x4b38]
lea rdx, [rbp + 0x3a0]
call fcn.140020550
movdqa xmm6, xmmword [0x14014dda0]
cmp dword [rbx + 0x4b34], 3
je 0x14005f4b0
movups xmmword [rbx + 0x3a48], xmm6
mov rbx, qword [0x140167bf8]
lea rcx, [rbx + 0x4b48]
movss xmm0, dword [rbx + 0x3954]
mov dword [rbp + 0x58], 7
movss dword [rbp + 0x5c], xmm0
lea rdx, [rbp + 0x58]
call fcn.140020410
mov dword [rbx + 0x3954], 0x40a00000
mov rbx, qword [0x140167bf8]
mov rax, qword [rbx + 0x40a0]
cmp qword [rax + 0x1c0], 0
jne 0x14005f50e
cmp qword [rbx + 0x4ec0], 0
lea rcx, [rax + 0x268]
je 0x14005f515
lea rcx, [rax + 0x238]
movss xmm0, dword [rcx]
subss xmm0, dword [rax + 0x118]
movss dword [rbp - 0x38], xmm0
mov dword [rbp - 0x34], 0x41d80000
mov byte [rax + 0xcc], 1
mov rbx, qword [rbx + 0x40a0]
movsxd r8, dword [rbx + 0x108]
mov rax, qword [rbx + 0x110]
mov r8d, dword [rax + r8*4 - 4]
xor edx, edx
lea rcx, str.header
call fcn.1400030c0
mov edi, eax
mov rcx, qword [rbx]
cmp dword [rcx + 0x40f8], eax
jne 0x14005f57c
lea r8, str.header
mov edx, listen
mov ecx, eax
call fcn.14001f710
lea r8, [rbp - 0x38]
mov edx, edi
lea rcx, str.header
call fcn.14000d130
mov rdi, qword [0x140167c50]
mov rax, qword [rdi + 8]
mov qword [rbp + 0x3a0], rax
mov dword [rbp + 0x3a8], r15d
mov rbx, rdi
cmp byte [rax + 0x19], 0
jne 0x14005f5dd
mov qword [rbp + 0x3a0], rax
cmp dword [rax + 0x20], 0x12
jge 0x14005f5ca
mov dword [rbp + 0x3a8], r15d
mov rax, qword [rax + 0x10]
jmp 0x14005f5d7
mov dword [rbp + 0x3a8], r12d
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x14005f5b0
cmp byte [rbx + 0x19], 0
jne 0x14005f5e9
cmp dword [rbx + 0x20], 0x12
jle 0x14005f64d
movabs rax, 0x555555555555555
cmp qword [0x140167c58], rax
je 0x1400617d0
mov ecx, Ordinal_50
call fcn.1400e1678
mov dword [rax + 0x20], reloc.WS2_32.dll_select
mov qword [rax + 0x28], r15
mov qword [rax], rdi
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
mov word [rax + 0x18], 0
movups xmm0, xmmword [rbp + 0x3a0]
movaps xmmword [rbp + 0x3d0], xmm0
mov r8, rax
lea rdx, [rbp + 0x3d0]
lea rcx, [0x140167c50]
call fcn.14006edd0
mov rbx, rax
mov rbx, qword [rbx + 0x28]
mov qword [rsp + 0x60], rbx
mov rdi, qword [0x140167bf8]
mov rsi, rbx
test rbx, rbx
jne 0x14005f681
mov rbx, qword [rdi + 0x48]
test rbx, rbx
jne 0x14005f679
mov rax, qword [rdi + 0x38]
mov rcx, qword [rax + 0x60]
mov rbx, qword [rcx]
mov qword [rsp + 0x60], rbx
mov rsi, rbx
lea rcx, [rdi + 0x4b58]
lea rdx, [rsp + 0x60]
call fcn.1400208a0
mov rcx, rbx
call fcn.1400132d0
mov rcx, qword [rdi + 0x40a0]
mov rcx, qword [rcx + 0x2b0]
mov rax, qword [rsi + 0x40]
mov rdx, qword [rax + 8]
cmp qword [rcx + 0x70], rdx
je 0x14005f6bf
mov qword [rcx + 0x70], rdx
call fcn.140029b60
mov rbx, qword [0x140167bf8]
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r13
movss dword [rsp + 0x20], xmm9
movaps xmm3, xmm13
movss xmm2, dword [rbx + 0x3db8]
lea rdx, [rbp - 0x70]
mov rcx, qword [rbx + 0x3db0]
call fcn.1400305b0
movss xmm0, dword [rbp - 0x70]
addss xmm0, xmm14
cvttss2si eax, xmm0
movd xmm2, eax
cvtdq2ps xmm2, xmm2
movss dword [rbp - 0x70], xmm2
mov rax, qword [rbx + 0x40a0]
movss xmm0, dword [rax + 0x118]
subss xmm0, dword [rax + 0x28]
addss xmm0, dword [rax + 0x98]
cmp qword [rax + 0x1c0], 0
jne 0x14005f749
cmp qword [rbx + 0x4ec0], 0
lea rcx, [rax + 0x268]
je 0x14005f750
lea rcx, [rax + 0x238]
movss xmm1, dword [rcx]
subss xmm1, dword [rax + 0x118]
mulss xmm1, xmm12
addss xmm1, xmm0
mulss xmm2, xmm12
subss xmm1, xmm2
mov byte [rax + 0xcc], 1
mov rax, qword [rbx + 0x40a0]
movss xmm0, dword [rax + 0x28]
subss xmm0, dword [rax + 0x98]
addss xmm0, xmm1
movss dword [rax + 0x118], xmm0
mov byte [rax + 0x159], 1
mov rax, qword [rbx + 0x40a0]
movss xmm0, dword [rax + 0x11c]
subss xmm0, dword [rax + 0x2c]
addss xmm0, dword [rax + 0x9c]
cmp qword [rax + 0x1c0], 0
jne 0x14005f7d3
cmp qword [rbx + 0x4ec0], 0
lea rcx, [rax + 0x26c]
je 0x14005f7da
lea rcx, [rax + 0x23c]
movss xmm1, dword [rcx]
subss xmm1, dword [rax + 0x11c]
mulss xmm1, xmm12
addss xmm1, xmm0
movss xmm0, dword [rbp - 0x6c]
mulss xmm0, xmm12
subss xmm1, xmm0
mov byte [rax + 0xcc], 1
mov rax, qword [rbx + 0x40a0]
movss xmm0, dword [rax + 0x2c]
subss xmm0, dword [rax + 0x9c]
addss xmm0, xmm1
movss dword [rax + 0x11c], xmm0
mov byte [rax + 0x159], 1
mov rcx, r13
call fcn.14003b6c0
mov rbx, qword [0x140167bf8]
mov rax, qword [rbx + 0x40a0]
movss xmm0, dword [rax + 0x118]
subss xmm0, dword [rax + 0x28]
addss xmm0, dword [rax + 0x98]
cmp qword [rax + 0x1c0], 0
jne 0x14005f871
cmp qword [rbx + 0x4ec0], 0
lea rcx, [rax + 0x268]
je 0x14005f878
lea rcx, [rax + 0x238]
movss xmm1, dword [rcx]
subss xmm1, dword [rax + 0x118]
addss xmm1, xmm0
subss xmm1, dword [0x14014d90c]
mov byte [rax + 0xcc], 1
mov rax, qword [rbx + 0x40a0]
movss xmm0, dword [rax + 0x28]
subss xmm0, dword [rax + 0x98]
addss xmm0, xmm1
movss dword [rax + 0x118], xmm0
mov byte [rax + 0x159], 1
mov rax, qword [rbx + 0x40a0]
movss xmm0, dword [rax + 0x11c]
subss xmm0, dword [rax + 0x2c]
addss xmm0, dword [rax + 0x9c]
cmp qword [rax + 0x1c0], 0
jne 0x14005f8f5
cmp qword [rbx + 0x4ec0], 0
lea rcx, [rax + 0x26c]
je 0x14005f8fc
lea rcx, [rax + 0x23c]
movss xmm1, dword [rcx]
subss xmm1, dword [rax + 0x11c]
addss xmm1, xmm0
subss xmm1, dword [0x14014d900]
mov byte [rax + 0xcc], 1
mov rax, qword [rbx + 0x40a0]
movss xmm0, dword [rax + 0x2c]
subss xmm0, dword [rax + 0x9c]
addss xmm0, xmm1
movss dword [rax + 0x11c], xmm0
mov byte [rax + 0x159], 1
mov dword [rbp + 0x3a0], reloc.WS2_32.dll_setsockopt
movups xmm0, xmmword [rbx + 0x3b68]
movups xmmword [rbp + 0x3a4], xmm0
lea rcx, [rbx + 0x4b38]
lea rdx, [rbp + 0x3a0]
call fcn.140020550
cmp dword [rbx + 0x4b34], 0x15
je 0x14005f97d
movups xmmword [rbx + 0x3b68], xmm6
mov rbx, qword [0x140167bf8]
mov dword [rbp + 0x3a0], reloc.WLDAP32.dll_Ordinal_22
movups xmm0, xmmword [rbx + 0x3b78]
movups xmmword [rbp + 0x3a4], xmm0
lea rcx, [rbx + 0x4b38]
lea rdx, [rbp + 0x3a0]
call fcn.140020550
movdqa xmm6, xmmword [0x14014ddc0]
cmp dword [rbx + 0x4b34], 0x16
je 0x14005f9c7
movups xmmword [rbx + 0x3b78], xmm6
mov rbx, qword [0x140167bf8]
mov dword [rbp + 0x3a0], reloc.WS2_32.dll_socket
movups xmm0, xmmword [rbx + 0x3b88]
movups xmmword [rbp + 0x3a4], xmm0
lea rcx, [rbx + 0x4b38]
lea rdx, [rbp + 0x3a0]
call fcn.140020550
cmp dword [rbx + 0x4b34], 0x17
je 0x14005fa09
movups xmmword [rbx + 0x3b88], xmm6
mov qword [rbp - 0x30], 0
lea rdx, [rbp - 0x30]
mov ecx, select
call fcn.140004ae0
mov dword [rbp - 0x28], 0x41a00000
mov dword [rbp - 0x24], 0x41d80000
xor r8d, r8d
lea rdx, [rbp - 0x28]
lea rcx, [0x14014862c]
call fcn.14003c350
test al, al
je 0x14005fa58
xor edx, edx
mov rcx, qword [0x140167cc8]
call qword [sym.imp.USER32.dll_ShowWindow]
call fcn.1400566c0
movaps xmm1, xmm9
xorps xmm0, xmm0
call fcn.140017bc0
mov dword [rbp - 0x20], 0x41a00000
mov dword [rbp - 0x1c], 0x41d80000
xor r8d, r8d
lea rdx, [rbp - 0x20]
lea rcx, [0x140114918]
call fcn.14003c350
movzx r14d, r14b
test al, al
cmovne r14d, r12d
mov dword [rsp + 0x60], r14d
mov r8d, 3
mov rbx, qword [0x140167bf8]
mov eax, dword [rbx + 0x4b38]
cmp eax, r8d
jge 0x14005fad0
lea rcx, str.Calling_PopStyleColor___too_many_times_
call fcn.140017060
mov r8d, dword [rbx + 0x4b38]
mov eax, r8d
test r8d, r8d
jle 0x14005fb06
nop word [rax + rax]
cdqe
lea rdx, [rax + rax*4]
mov rcx, qword [rbx + 0x4b40]
movsxd rax, dword [rcx + rdx*4 - 0x14]
add rax, rax
movups xmm0, xmmword [rcx + rdx*4 - 0x10]
movups xmmword [rbx + rax*8 + 0x3a18], xmm0
dec dword [rbx + 0x4b38]
mov eax, dword [rbx + 0x4b38]
dec r8d
test r8d, r8d
jg 0x14005fad0
mov ecx, r12d
call fcn.140004b90
call fcn.140013390
call fcn.14000d360
mov r8d, r12d
mov rbx, qword [0x140167bf8]
mov eax, dword [rbx + 0x4b38]
cmp eax, r12d
jge 0x14005fb50
lea rcx, str.Calling_PopStyleColor___too_many_times_
call fcn.140017060
mov r8d, dword [rbx + 0x4b38]
mov eax, r8d
test r8d, r8d
jle 0x14005fb86
nop dword [rax + rax]
cdqe
lea rdx, [rax + rax*4]
mov rcx, qword [rbx + 0x4b40]
movsxd rax, dword [rcx + rdx*4 - 0x14]
add rax, rax
movups xmm0, xmmword [rcx + rdx*4 - 0x10]
movups xmmword [rbx + rax*8 + 0x3a18], xmm0
dec dword [rbx + 0x4b38]
mov eax, dword [rbx + 0x4b38]
dec r8d
test r8d, r8d
jg 0x14005fb50
mov ecx, r12d
call fcn.140004b90
mov rbx, qword [0x140167bf8]
mov dword [rbp + 0x3a0], 3
movups xmm0, xmmword [rbx + 0x3a48]
movups xmmword [rbp + 0x3a4], xmm0
lea rcx, [rbx + 0x4b38]
lea rdx, [rbp + 0x3a0]
call fcn.140020550
cmp dword [rbx + 0x4b34], 3
je 0x14005fbd1
movups xmmword [rbx + 0x3a48], xmm15
mov rbx, qword [0x140167bf8]
mov dword [rbp + 0x3a0], reloc.WS2_32.dll_setsockopt
movups xmm0, xmmword [rbx + 0x3b68]
movups xmmword [rbp + 0x3a4], xmm0
lea rcx, [rbx + 0x4b38]
lea rdx, [rbp + 0x3a0]
call fcn.140020550
cmp dword [rbx + 0x4b34], 0x15
je 0x14005fc14
movups xmmword [rbx + 0x3b68], xmm15
mov rbx, qword [0x140167bf8]
mov dword [rbp + 0x3a0], reloc.WLDAP32.dll_Ordinal_22
movups xmm0, xmmword [rbx + 0x3b78]
movups xmmword [rbp + 0x3a4], xmm0
lea rcx, [rbx + 0x4b38]
lea rdx, [rbp + 0x3a0]
call fcn.140020550
cmp dword [rbx + 0x4b34], 0x16
je 0x14005fc57
movups xmmword [rbx + 0x3b78], xmm10
mov rbx, qword [0x140167bf8]
mov dword [rbp + 0x3a0], reloc.WS2_32.dll_socket
movups xmm0, xmmword [rbx + 0x3b88]
movups xmmword [rbp + 0x3a4], xmm0
lea rcx, [rbx + 0x4b38]
lea rdx, [rbp + 0x3a0]
call fcn.140020550
cmp dword [rbx + 0x4b34], 0x17
je 0x14005fc9a
movups xmmword [rbx + 0x3b88], xmm10
mov qword [rbp - 0x18], 0x43160000
mov rcx, qword [0x140167bf8]
mov rax, qword [rcx + 0x40a0]
mov byte [rax + 0xcc], 1
mov rbx, qword [rcx + 0x40a0]
movsxd r8, dword [rbx + 0x108]
mov rax, qword [rbx + 0x110]
mov r8d, dword [rax + r8*4 - 4]
xor edx, edx
lea rcx, str.left
call fcn.1400030c0
mov edi, eax
mov rcx, qword [rbx]
cmp dword [rcx + 0x40f8], eax
jne 0x14005fcff
lea r8, str.left
mov edx, listen
mov ecx, eax
call fcn.14001f710
lea r8, [rbp - 0x18]
mov edx, edi
lea rcx, str.left
call fcn.14000d130
mov rcx, qword [0x140167bf8]
mov rax, qword [rcx + 0x40a0]
cmp qword [rax + 0x1c0], 0
jne 0x14005fd3a
cmp qword [rcx + 0x4ec0], 0
lea rcx, [rax + 0x268]
je 0x14005fd41
lea rcx, [rax + 0x238]
movss xmm0, dword [rcx]
subss xmm0, dword [rax + 0x118]
movss dword [rbp - 0x10], xmm0
mov dword [rbp - 0xc], 0x41f00000
xor r8d, r8d
lea rdx, [rbp - 0x10]
lea rcx, [0x140148630]
call fcn.14003c350
test al, al
je 0x14005fd77
mov dword [0x140167c18], r15d
mov rcx, qword [0x140167bf8]
mov rax, qword [rcx + 0x40a0]
cmp qword [rax + 0x1c0], 0
jne 0x14005fda0
cmp qword [rcx + 0x4ec0], 0
lea rcx, [rax + 0x268]
je 0x14005fda7
lea rcx, [rax + 0x238]
movss xmm0, dword [rcx]
subss xmm0, dword [rax + 0x118]
movss dword [rbp - 8], xmm0
mov dword [rbp - 4], 0x41f00000
xor r8d, r8d
lea rdx, [rbp - 8]
lea rcx, [0x140148640]
call fcn.14003c350
test al, al
je 0x14005fddd
mov dword [0x140167c18], r12d
mov rbx, qword [0x140167bf8]
mov rax, qword [rbx + 0x40a0]
movss xmm6, dword [rax + 0x11c]
subss xmm6, dword [rax + 0x2c]
movss xmm7, dword [rax + 0x118]
subss xmm7, dword [rax + 0x28]
addss xmm6, dword [rax + 0x9c]
addss xmm7, dword [rax + 0x98]
lea rsi, str.v1.3.4
mov rax, rsi
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
cmova rax, qword [str.v1.3.4]
movss xmm2, dword [rbx + 0x3db8]
test rax, rax
jne 0x14005fe41
xorps xmm0, xmm0
jmp 0x14005fe8e
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], rax
movss dword [rsp + 0x20], xmm9
movaps xmm3, xmm13
lea rdx, [rsp + 0x78]
mov rcx, qword [rbx + 0x3db0]
call fcn.1400305b0
movss xmm0, dword [rsp + 0x78]
addss xmm0, xmm14
cvttss2si eax, xmm0
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rsp + 0x78], xmm0
movss xmm2, dword [rsp + 0x7c]
mov rax, qword [rbx + 0x40a0]
cmp qword [rax + 0x1c0], 0
jne 0x14005feb0
cmp qword [rbx + 0x4ec0], 0
lea rcx, [rax + 0x268]
je 0x14005feb7
lea rcx, [rax + 0x238]
movss xmm1, dword [rcx]
subss xmm1, dword [rax + 0x118]
mulss xmm1, xmm12
addss xmm1, xmm7
mulss xmm0, xmm12
subss xmm1, xmm0
mov byte [rax + 0xcc], 1
mov rax, qword [rbx + 0x40a0]
movss xmm0, dword [rax + 0x28]
subss xmm0, dword [rax + 0x98]
addss xmm0, xmm1
movss dword [rax + 0x118], xmm0
mov byte [rax + 0x159], 1
mov rax, qword [rbx + 0x40a0]
cmp qword [rax + 0x1c0], 0
jne 0x14005ff25
cmp qword [rbx + 0x4ec0], 0
lea rcx, [rax + 0x26c]
je 0x14005ff2c
lea rcx, [rax + 0x23c]
movss xmm0, dword [rcx]
subss xmm0, dword [rax + 0x11c]
addss xmm6, xmm0
subss xmm6, xmm2
subss xmm6, dword [0x140167c14]
mov byte [rax + 0xcc], 1
mov rax, qword [rbx + 0x40a0]
movss xmm0, dword [rax + 0x2c]
subss xmm0, dword [rax + 0x9c]
addss xmm0, xmm6
movss dword [rax + 0x11c], xmm0
mov byte [rax + 0x159], 1
mov rcx, rsi
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
cmova rcx, qword [str.v1.3.4]
call fcn.14003b6c0
call fcn.14000d360
mov r8d, 4
mov rbx, qword [0x140167bf8]
mov eax, dword [rbx + 0x4b38]
cmp eax, r8d
jge 0x14005ffd0
lea rcx, str.Calling_PopStyleColor___too_many_times_
call fcn.140017060
mov r8d, dword [rbx + 0x4b38]
mov eax, r8d
test r8d, r8d
jle 0x140060006
nop word [rax + rax]
cdqe
lea rdx, [rax + rax*4]
mov rcx, qword [rbx + 0x4b40]
movsxd rax, dword [rcx + rdx*4 - 0x14]
add rax, rax
movups xmm0, xmmword [rcx + rdx*4 - 0x10]
movups xmmword [rbx + rax*8 + 0x3a18], xmm0
dec dword [rbx + 0x4b38]
mov eax, dword [rbx + 0x4b38]
dec r8d
test r8d, r8d
jg 0x14005ffd0
movaps xmm1, xmm9
xorps xmm0, xmm0
call fcn.140017bc0
mov rbx, qword [0x140167bf8]
mov dword [rbp + 0x3a0], reloc.WS2_32.dll_setsockopt
movups xmm0, xmmword [rbx + 0x3b68]
movups xmmword [rbp + 0x3a4], xmm0
lea rcx, [rbx + 0x4b38]
lea rdx, [rbp + 0x3a0]
call fcn.140020550
mov r13, qword [rbp]
cmp dword [rbx + 0x4b34], 0x15
je 0x140060060
movups xmm0, xmmword [r13 + 0x3a48]
movups xmmword [rbx + 0x3b68], xmm0
mov rbx, qword [0x140167bf8]
mov dword [rbp + 0x3a0], reloc.WLDAP32.dll_Ordinal_22
movups xmm0, xmmword [rbx + 0x3b78]
movups xmmword [rbp + 0x3a4], xmm0
lea rcx, [rbx + 0x4b38]
lea rdx, [rbp + 0x3a0]
call fcn.140020550
cmp dword [rbx + 0x4b34], 0x16
je 0x1400600aa
movups xmm0, xmmword [r13 + 0x3a48]
movups xmmword [rbx + 0x3b78], xmm0
mov rbx, qword [0x140167bf8]
mov dword [rbp + 0x3a0], reloc.WS2_32.dll_socket
movups xmm0, xmmword [rbx + 0x3b88]
movups xmmword [rbp + 0x3a4], xmm0
lea rcx, [rbx + 0x4b38]
lea rdx, [rbp + 0x3a0]
call fcn.140020550
cmp dword [rbx + 0x4b34], 0x17
je 0x1400600f4
movups xmm0, xmmword [r13 + 0x3a48]
movups xmmword [rbx + 0x3b88], xmm0
mov qword [rbp + 8], 0
mov rcx, qword [0x140167bf8]
mov rax, qword [rcx + 0x40a0]
mov byte [rax + 0xcc], 1
mov rbx, qword [rcx + 0x40a0]
movsxd r8, dword [rbx + 0x108]
mov rax, qword [rbx + 0x110]
mov r8d, dword [rax + r8*4 - 4]
xor edx, edx
lea rcx, str.right
call fcn.1400030c0
mov edi, eax
mov rcx, qword [rbx]
cmp dword [rcx + 0x40f8], eax
jne 0x140060159
lea r8, str.right
mov edx, listen
mov ecx, eax
call fcn.14001f710
lea r8, [rbp + 8]
mov edx, edi
lea rcx, str.right
call fcn.14000d130
mov ecx, dword [0x140167c18]
test ecx, ecx
je 0x140060e3b
cmp ecx, 1
jne 0x140061348
mov rbx, qword [0x140167bf8]
mov dword [rbp + 0x3a0], 7
movups xmm0, xmmword [rbx + 0x3a88]
movups xmmword [rbp + 0x3a4], xmm0
lea rcx, [rbx + 0x4b38]
lea rdx, [rbp + 0x3a0]
call fcn.140020550
cmp dword [rbx + 0x4b34], 7
je 0x1400601c5
movups xmmword [rbx + 0x3a88], xmm15
mov rbx, qword [0x140167bf8]
mov dword [rbp + 0x3a0], 8
movups xmm0, xmmword [rbx + 0x3a98]
movups xmmword [rbp + 0x3a4], xmm0
lea rcx, [rbx + 0x4b38]
lea rdx, [rbp + 0x3a0]
call fcn.140020550
cmp dword [rbx + 0x4b34], 8
je 0x140060208
movups xmmword [rbx + 0x3a98], xmm10
mov rbx, qword [0x140167bf8]
mov dword [rbp + 0x3a0], 9
movups xmm0, xmmword [rbx + 0x3aa8]
movups xmmword [rbp + 0x3a4], xmm0
lea rcx, [rbx + 0x4b38]
lea rdx, [rbp + 0x3a0]
call fcn.140020550
cmp dword [rbx + 0x4b34], 9
je 0x14006024b
movups xmmword [rbx + 0x3aa8], xmm10
mov rbx, qword [0x140167bf8]
mov dword [rbp + 0x3a0], reloc.WS2_32.dll_select
movups xmm0, xmmword [rbx + 0x3b38]
movups xmmword [rbp + 0x3a4], xmm0
lea rcx, [rbx + 0x4b38]
lea rdx, [rbp + 0x3a0]
call fcn.140020550
cmp dword [rbx + 0x4b34], 0x12
je 0x140060295
movdqa xmm0, xmmword [0x14014dd80]
movups xmmword [rbx + 0x3b38], xmm0
lea rdx, [0x140167bf2]
lea rcx, [0x140148688]
call fcn.14003d990
test al, al
je 0x14006037f
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xor eax, eax
mov qword [rsp + 0x68], rax
movzx ebx, byte [0x140167bf2]
movzx edx, byte [rsp + 0x60]
lea rcx, [rsp + 0x68]
call fcn.140066070
mov byte [rbp + 0x30], bl
xorps xmm0, xmm0
movups xmmword [rbp + 0x3a0], xmm0
mov qword [rbp + 0x3b0], r15
mov qword [rbp + 0x3b8], r15
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1400e1678
mov qword [rbp + 0x3a0], rax
mov qword [rbp + 0x3b0], reloc.WS2_32.dll_send
mov qword [rbp + 0x3b8], Ordinal_41
movups xmm0, xmmword [str.start_version_check]
movups xmmword [rax], xmm0
movzx ecx, word [0x140147de8]
mov word [rax + 0x10], cx
movzx ecx, byte [0x140147dea]
mov byte [rax + 0x12], cl
mov byte [rax + 0x13], 0
lea rdx, [rbp + 0x3a0]
lea rcx, [0x140167c60]
call fcn.140062cb0
movzx edx, byte [rax]
mov byte [rax], 4
mov byte [rsp + 0x60], dl
mov rcx, qword [rax + 8]
mov r8, qword [rbp + 0x30]
mov qword [rax + 8], r8
mov qword [rsp + 0x68], rcx
lea rcx, [rsp + 0x68]
call fcn.140066070
nop
lea rcx, [0x140167c60]
call fcn.14005b900
lea rdx, [0x140167bf1]
lea rcx, str.__windows
call fcn.14003d990
test al, al
je 0x14006053f
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xor eax, eax
mov qword [rsp + 0x68], rax
movzx ebx, byte [0x140167bf1]
movzx edx, byte [rsp + 0x60]
lea rcx, [rsp + 0x68]
call fcn.140066070
mov byte [rbp + 0x38], bl
xorps xmm0, xmm0
movups xmmword [rbp + 0x3a0], xmm0
mov qword [rbp + 0x3b0], 9
mov qword [rbp + 0x3b8], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [str.win_start]
movsd qword [rbp + 0x3a0], xmm0
movzx eax, byte [reloc.WS2_32.dll_WSACleanup]
mov byte [rbp + 0x3a8], al
mov byte [rbp + 0x3a9], 0
lea rdx, [rbp + 0x3a0]
lea rcx, [0x140167c60]
call fcn.140062cb0
movzx edx, byte [rax]
mov byte [rax], 4
mov byte [rsp + 0x60], dl
mov rcx, qword [rax + 8]
mov r8, qword [rbp + 0x38]
mov qword [rax + 8], r8
mov qword [rsp + 0x68], rcx
lea rcx, [rsp + 0x68]
call fcn.140066070
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xor eax, eax
mov qword [rsp + 0x68], rax
movzx edx, byte [rsp + 0x60]
lea rcx, [rsp + 0x68]
call fcn.140066070
mov byte [rbp + 0x40], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x3a0], xmm0
mov qword [rbp + 0x3b0], 0xa
mov qword [rbp + 0x3b8], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [str.tray_start]
movsd qword [rbp + 0x3a0], xmm0
movzx eax, word [0x140147dd0]
mov word [rbp + 0x3a8], ax
mov byte [rbp + 0x3aa], 0
lea rdx, [rbp + 0x3a0]
lea rcx, [0x140167c60]
call fcn.140062cb0
movzx edx, byte [rax]
mov byte [rax], 4
mov byte [rsp + 0x60], dl
mov rcx, qword [rax + 8]
mov r8, qword [rbp + 0x40]
mov qword [rax + 8], r8
mov qword [rsp + 0x68], rcx
lea rcx, [rsp + 0x68]
call fcn.140066070
nop
mov byte [0x140167bf3], 0
lea rcx, [0x140167c60]
call fcn.14005b900
mov ecx, dword [0x140167c24]
test ecx, ecx
je 0x140060521
cmp ecx, 1
jne 0x14006053f
cmp byte [0x140167bf1], 0
je 0x140060511
call fcn.14005b640
jmp 0x14006053f
call fcn.14005b830
test al, al
je 0x14006053f
call fcn.14005b7d0
jmp 0x14006053f
cmp byte [0x140167bf1], 0
je 0x140060531
call fcn.14005a430
jmp 0x14006053f
call fcn.14005b0b0
test al, al
je 0x14006053f
call fcn.14005ad60
lea rdx, [0x140167bf3]
lea rcx, [0x1401486e0]
call fcn.14003d990
test al, al
je 0x1400605a8
cmp byte [0x140167bf1], 0
jne 0x140060568
mov byte [0x140167bf3], 0
jmp 0x14006059c
lea rdx, [0x140167bf3]
lea rcx, [rbp + 0x100]
call fcn.14006a350
mov rbx, rax
lea rdx, str.tray_start
lea rcx, [0x140167c60]
call fcn.14006a300
mov rcx, rax
mov rdx, rbx
call fcn.140062ef0
lea rcx, [0x140167c60]
call fcn.14005b900
mov edi, dword [0x140167c48]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x3a0], xmm0
mov rsi, r15
mov qword [rbp + 0x3b0], r15
mov rbx, qword [0x140167c40]
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
jne 0x14006067a
mov rdx, qword [rbp + 0x3a8]
nop
lea rax, [rbx + 0x28]
cmp qword [rax + 0x18], 0xf
jbe 0x1400605ee
mov rax, qword [rax]
mov qword [rsp + 0x60], rax
cmp rdx, rsi
je 0x140060608
mov qword [rdx], rax
add rdx, 8
mov qword [rbp + 0x3a8], rdx
jmp 0x140060627
lea r8, [rsp + 0x60]
lea rcx, [rbp + 0x3a0]
call fcn.140070850
mov rsi, qword [rbp + 0x3b0]
mov rdx, qword [rbp + 0x3a8]
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x140060658
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x140060653
nop dword [rax + rax]
cmp rbx, qword [rax + 0x10]
jne 0x140060653
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x140060640
mov rbx, rax
jmp 0x140060670
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x140060670
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x140060664
cmp byte [rbx + 0x19], 0
je 0x1400605e0
mov dword [rsp + 0x20], edi
mov rbx, qword [rbp + 0x3a0]
mov r9, rbx
lea rdx, [0x140167c20]
lea rcx, str.
call fcn.14003fb40
movzx edi, al
test rbx, rbx
je 0x1400606df
sub rsi, rbx
sar rsi, 3
lea rdx, [rsi*8]
mov rax, rbx
cmp rdx, 0x1000
jb 0x1400606d7
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006146c
mov rcx, rbx
call fcn.1400e1360
test dil, dil
je 0x1400607b6
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xor eax, eax
mov qword [rsp + 0x68], rax
movsxd rbx, dword [0x140167c20]
movzx edx, byte [rsp + 0x60]
lea rcx, [rsp + 0x68]
call fcn.140066070
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x3a0], xmm0
mov qword [rbp + 0x3b0], 8
mov qword [rbp + 0x3b8], reloc.WS2_32.dll_ntohs
mov rax, qword [str.provider]
mov qword [rbp + 0x3a0], rax
mov byte [rbp + 0x3a8], 0
lea rdx, [rbp + 0x3a0]
lea rcx, [0x140167c60]
call fcn.140062cb0
movzx edx, byte [rax]
mov byte [rax], 5
mov byte [rsp + 0x60], dl
mov rcx, qword [rax + 8]
mov qword [rax + 8], rbx
mov qword [rsp + 0x68], rcx
lea rcx, [rsp + 0x68]
call fcn.140066070
nop
lea rcx, [0x140167c60]
call fcn.14005b900
mov rdi, qword [0x140167cb8]
mov rbx, qword [0x140167cb0]
cmp rbx, rdi
je 0x1400607b6
mov rcx, qword [rbx]
cmp byte [rcx + 0x48], 0
je 0x1400607ad
call fcn.14005d120
mov rcx, qword [rbx]
call fcn.14005d6a0
add rbx, 8
cmp rbx, rdi
jne 0x140060797
mov edi, dword [0x140167c38]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x3a0], xmm0
mov rsi, r15
mov qword [rbp + 0x3b0], r15
mov rbx, qword [0x140167c30]
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
jne 0x14006088a
mov rdx, qword [rbp + 0x3a8]
nop dword [rax]
lea rax, [rbx + 0x28]
cmp qword [rax + 0x18], 0xf
jbe 0x1400607fe
mov rax, qword [rax]
mov qword [rsp + 0x60], rax
cmp rdx, rsi
je 0x140060818
mov qword [rdx], rax
add rdx, 8
mov qword [rbp + 0x3a8], rdx
jmp 0x140060837
lea r8, [rsp + 0x60]
lea rcx, [rbp + 0x3a0]
call fcn.140070850
mov rsi, qword [rbp + 0x3b0]
mov rdx, qword [rbp + 0x3a8]
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x140060868
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x140060863
nop dword [rax + rax]
cmp rbx, qword [rax + 0x10]
jne 0x140060863
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x140060850
mov rbx, rax
jmp 0x140060880
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x140060880
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x140060874
cmp byte [rbx + 0x19], 0
je 0x1400607f0
mov dword [rsp + 0x20], edi
mov rbx, qword [rbp + 0x3a0]
mov r9, rbx
lea rdx, [0x140167c24]
lea rcx, [0x140148738]
call fcn.14003fb40
movzx edi, al
test rbx, rbx
je 0x1400608ef
sub rsi, rbx
sar rsi, 3
lea rdx, [rsi*8]
mov rax, rbx
cmp rdx, 0x1000
jb 0x1400608e7
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006146c
mov rcx, rbx
call fcn.1400e1360
test dil, dil
je 0x1400609f6
cmp byte [0x140167bf1], 0
je 0x14006094a
mov ecx, dword [0x140167c24]
test ecx, ecx
je 0x14006092e
cmp ecx, 1
jne 0x14006094a
call fcn.14005b830
test al, al
jne 0x14006091e
call fcn.14005b640
call fcn.14005b0b0
test al, al
je 0x14006094a
call fcn.14005ad60
jmp 0x14006094a
call fcn.14005b0b0
test al, al
jne 0x14006093c
call fcn.14005a430
call fcn.14005b830
test al, al
je 0x14006094a
call fcn.14005b7d0
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xor eax, eax
mov qword [rsp + 0x68], rax
movsxd rbx, dword [0x140167c24]
movzx edx, byte [rsp + 0x60]
lea rcx, [rsp + 0x68]
call fcn.140066070
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x3a0], xmm0
mov qword [rbp + 0x3b0], 0xa
mov qword [rbp + 0x3b8], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [str.auto_start]
movsd qword [rbp + 0x3a0], xmm0
movzx eax, word [0x140147e08]
mov word [rbp + 0x3a8], ax
mov byte [rbp + 0x3aa], 0
lea rdx, [rbp + 0x3a0]
lea rcx, [0x140167c60]
call fcn.140062cb0
movzx edx, byte [rax]
mov byte [rax], 5
mov byte [rsp + 0x60], dl
mov rcx, qword [rax + 8]
mov qword [rax + 8], rbx
mov qword [rsp + 0x68], rcx
lea rcx, [rsp + 0x68]
call fcn.140066070
nop
lea rcx, [0x140167c60]
call fcn.14005b900
xor ecx, ecx
call fcn.140009630
test al, al
je 0x140060a0d
lea rcx, str.UAC_____________
call fcn.140018ab0
mov rbx, qword [0x140167bf8]
mov dword [rbp + 0x3a0], reloc.WS2_32.dll_setsockopt
movups xmm0, xmmword [rbx + 0x3b68]
movups xmmword [rbp + 0x3a4], xmm0
lea rcx, [rbx + 0x4b38]
lea rdx, [rbp + 0x3a0]
call fcn.140020550
cmp dword [rbx + 0x4b34], 0x15
je 0x140060a50
movups xmmword [rbx + 0x3b68], xmm15
mov rbx, qword [0x140167bf8]
mov dword [rbp + 0x3a0], reloc.WLDAP32.dll_Ordinal_22
movups xmm0, xmmword [rbx + 0x3b78]
movups xmmword [rbp + 0x3a4], xmm0
lea rcx, [rbx + 0x4b38]
lea rdx, [rbp + 0x3a0]
call fcn.140020550
cmp dword [rbx + 0x4b34], 0x16
je 0x140060a93
movups xmmword [rbx + 0x3b78], xmm10
mov rbx, qword [0x140167bf8]
mov dword [rbp + 0x3a0], reloc.WS2_32.dll_socket
movups xmm0, xmmword [rbx + 0x3b88]
movups xmmword [rbp + 0x3a4], xmm0
lea rcx, [rbx + 0x4b38]
lea rdx, [rbp + 0x3a0]
call fcn.140020550
cmp dword [rbx + 0x4b34], 0x17
je 0x140060ad6
movups xmmword [rbx + 0x3b88], xmm10
mov dword [rbp + 0x10], 0x43480000
mov dword [rbp + 0x14], 0x41f00000
xor r8d, r8d
lea rdx, [rbp + 0x10]
lea rcx, str._
call fcn.14003c350
test al, al
je 0x140060d25
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d0], xmm0
mov qword [rbp + 0x3e0], r15
mov qword [rbp + 0x3e8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x3d0], 0
movups xmmword [rbp + 0x3a0], xmm0
mov qword [rbp + 0x3b0], r15
mov qword [rbp + 0x3b8], r15
mov ecx, Ordinal_50
call fcn.1400e1678
mov rcx, rax
mov qword [rbp + 0x3a0], rax
mov qword [rbp + 0x3b0], Ordinal_46
mov qword [rbp + 0x3b8], gethostname
movups xmm0, xmmword [str.https:__elllkere.top_misterfish_version.txt]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1401485a8]
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [0x1401485b8]
movsd qword [rax + 0x20], xmm0
movzx eax, word [0x1401485c0]
mov word [rcx + 0x28], ax
movzx eax, byte [reloc.WS2_32.dll_WSACleanup]
mov byte [rcx + 0x2a], al
mov byte [rcx + 0x2b], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x3f0], xmm0
mov qword [rbp + 0x400], r15
mov qword [rbp + 0x408], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x3f0], 0
lea r8, [rbp + 0x3d0]
lea rdx, [rbp + 0x3f0]
lea rcx, [rbp + 0x3a0]
call fcn.14005a120
movzx ebx, al
mov rdx, qword [rbp + 0x408]
cmp rdx, 0xf
jbe 0x140060c1d
inc rdx
mov rcx, qword [rbp + 0x3f0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140060c18
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006145e
call fcn.1400e1360
mov qword [rbp + 0x400], r15
mov qword [rbp + 0x408], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x3f0], 0
mov rdx, qword [rbp + 0x3b8]
cmp rdx, 0xf
jbe 0x140060c77
inc rdx
mov rcx, qword [rbp + 0x3a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140060c72
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140061465
call fcn.1400e1360
mov qword [rbp + 0x3b0], r15
mov qword [rbp + 0x3b8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x3a0], 0
test bl, bl
je 0x140060cc6
cmp qword [rbp + 0x3e0], 0
je 0x140060cc6
lea rcx, [rbp + 0x3d0]
call fcn.14006a3a0
test al, al
je 0x140060cb7
lea rdx, [0x140148810]
jmp 0x140060ccd
lea rcx, str.start_https:__github.com_Elllkere_misterfishdpi_releases_latest
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
jmp 0x140060ce4
lea rdx, [0x1401485f8]
xor r9d, r9d
lea r8, str.MisterFish_DPI
mov rcx, qword [0x140167cc8]
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rdx, qword [rbp + 0x3e8]
cmp rdx, 0xf
jbe 0x140060d25
inc rdx
mov rcx, qword [rbp + 0x3d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140060d20
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006146c
call fcn.1400e1360
mov dword [rbp + 0x18], 0x43480000
mov dword [rbp + 0x1c], 0x41f00000
xor r8d, r8d
lea rdx, [rbp + 0x18]
lea rcx, str.GitHub
call fcn.14003c350
test al, al
je 0x140060d57
lea rcx, str.start_https:__github.com_Elllkere_misterfishdpi_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r8d, 3
mov rbx, qword [0x140167bf8]
mov eax, dword [rbx + 0x4b38]
cmp eax, r8d
jge 0x140060d90
lea rcx, str.Calling_PopStyleColor___too_many_times_
call fcn.140017060
mov r8d, dword [rbx + 0x4b38]
mov eax, r8d
test r8d, r8d
jle 0x140060dc6
nop word [rax + rax]
cdqe
lea rdx, [rax + rax*4]
mov rcx, qword [rbx + 0x4b40]
movsxd rax, dword [rcx + rdx*4 - 0x14]
add rax, rax
movups xmm0, xmmword [rcx + rdx*4 - 0x10]
movups xmmword [rbx + rax*8 + 0x3a18], xmm0
dec dword [rbx + 0x4b38]
mov eax, dword [rbx + 0x4b38]
dec r8d
test r8d, r8d
jg 0x140060d90
mov r8d, 4
mov rbx, qword [0x140167bf8]
mov eax, dword [rbx + 0x4b38]
cmp eax, r8d
jge 0x140060e00
lea rcx, str.Calling_PopStyleColor___too_many_times_
call fcn.140017060
mov r8d, dword [rbx + 0x4b38]
mov eax, r8d
test r8d, r8d
jle 0x140061348
nop dword [rax]
cdqe
lea rdx, [rax + rax*4]
mov rcx, qword [rbx + 0x4b40]
movsxd rax, dword [rcx + rdx*4 - 0x14]
add rax, rax
movups xmm0, xmmword [rcx + rdx*4 - 0x10]
movups xmmword [rbx + rax*8 + 0x3a18], xmm0
dec dword [rbx + 0x4b38]
mov eax, dword [rbx + 0x4b38]
dec r8d
test r8d, r8d
jg 0x140060e00
jmp 0x140061348
mov rax, qword [0x140167bf8]
mov rcx, qword [rax + 0x40a0]
movss xmm7, dword [rcx + 0x11c]
subss xmm7, dword [rcx + 0x2c]
movss xmm8, dword [rcx + 0x118]
subss xmm8, dword [rcx + 0x28]
addss xmm7, dword [rcx + 0x9c]
addss xmm8, dword [rcx + 0x98]
mov esi, r15d
mov r14d, r15d
mov rax, qword [0x140167cb8]
mov rdx, qword [0x140167cb0]
sub rax, rdx
sar rax, 3
test rax, rax
je 0x140061343
movdqa xmm0, xmmword [0x14014df20]
movups xmmword [rbp + 0x3f0], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x3a0], xmm0
mov dword [rbp + 0x20], 0x3f800000
mov dword [rbp + 0x24], 0x3f800000
mov qword [rbp + 0x28], 0
nop dword [rax]
mov rdi, qword [r15 + rdx]
lea rax, [rdi + 8]
cmp qword [rax + 0x18], 0xf
jbe 0x140060ee2
mov rax, qword [rax]
mov rbx, qword [0x140167bf8]
movss xmm1, dword [rbx + 0x3db8]
test rax, rax
jne 0x140060efb
xorps xmm6, xmm6
jmp 0x140060f49
xor ecx, ecx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
movss dword [rsp + 0x20], xmm9
movaps xmm3, xmm13
movaps xmm2, xmm1
lea rdx, [rbp - 0x78]
mov rcx, qword [rbx + 0x3db0]
call fcn.1400305b0
movss xmm0, dword [rbp - 0x78]
addss xmm0, xmm14
cvttss2si eax, xmm0
movd xmm6, eax
cvtdq2ps xmm6, xmm6
movss dword [rbp - 0x78], xmm6
movss xmm1, dword [rbp - 0x74]
test esi, esi
jle 0x140060fe7
mov eax, 0x66666667
imul esi
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*4]
cmp esi, ecx
jne 0x140060f8c
movd xmm0, dword [rdi + 4]
cvtdq2ps xmm0, xmm0
addss xmm0, xmm1
addss xmm0, dword [r13 + 0x3968]
addss xmm0, dword [0x14014d8f8]
addss xmm7, xmm0
xor r14d, r14d
movd xmm1, dword [rdi]
cvtdq2ps xmm1, xmm1
addss xmm1, dword [r13 + 0x3964]
addss xmm1, xmm11
movd xmm0, r14d
cvtdq2ps xmm0, xmm0
mulss xmm1, xmm0
addss xmm1, xmm8
mov rax, qword [rbx + 0x40a0]
mov byte [rax + 0xcc], 1
mov rax, qword [rbx + 0x40a0]
movss xmm0, dword [rax + 0x28]
subss xmm0, dword [rax + 0x98]
addss xmm0, xmm1
movss dword [rax + 0x118], xmm0
mov byte [rax + 0x159], 1
mov rax, qword [rbx + 0x40a0]
mov byte [rax + 0xcc], 1
mov rax, qword [rbx + 0x40a0]
movss xmm0, dword [rax + 0x2c]
subss xmm0, dword [rax + 0x9c]
addss xmm0, xmm7
movss dword [rax + 0x11c], xmm0
mov byte [rax + 0x159], 1
movd xmm0, dword [rdi]
cvtdq2ps xmm0, xmm0
movss dword [rbp - 0x64], xmm0
movd xmm1, dword [rdi + 4]
cvtdq2ps xmm1, xmm1
movss dword [rbp - 0x60], xmm1
lea rcx, [rdi + 8]
cmp qword [rcx + 0x18], 0xf
jbe 0x140061043
mov rcx, qword [rcx]
lea rax, [rbp + 0x3f0]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x3a0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x28]
lea r8, [rbp - 0x64]
mov rdx, qword [rdi + 0x50]
call fcn.14003d8c0
test al, al
je 0x140061163
movzx ebx, byte [rdi + 0x48]
xor bl, 1
mov byte [rdi + 0x48], bl
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d0], xmm0
xor eax, eax
mov qword [rbp + 0x3d8], rax
movzx edx, byte [rbp + 0x3d0]
lea rcx, [rbp + 0x3d8]
call fcn.140066070
mov byte [rbp + 0x48], bl
xorps xmm0, xmm0
movups xmmword [rbp + 0x430], xmm0
mov qword [rbp + 0x440], 8
mov qword [rbp + 0x448], reloc.WS2_32.dll_ntohs
mov rax, qword [str.services]
mov qword [rbp + 0x430], rax
mov byte [rbp + 0x438], 0
lea rdx, [rbp + 0x430]
lea rcx, [0x140167c60]
call fcn.140062cb0
mov rbx, rax
lea rdx, [rdi + 0x28]
lea rcx, [rbp + 0xc0]
call fcn.140063780
mov rdx, rax
mov rcx, rbx
call fcn.140062cb0
movzx edx, byte [rax]
mov byte [rax], 4
mov byte [rbp + 0x3d0], dl
mov rcx, qword [rax + 8]
mov r8, qword [rbp + 0x48]
mov qword [rax + 8], r8
mov qword [rbp + 0x3d8], rcx
lea rcx, [rbp + 0x3d8]
call fcn.140066070
nop
lea rcx, [0x140167c60]
call fcn.14005b900
mov rcx, rdi
cmp byte [rdi + 0x48], 0
je 0x14006115e
call fcn.14005d6a0
jmp 0x140061163
call fcn.14005d120
xor ecx, ecx
call fcn.140009630
test al, al
je 0x1400611cd
mov rax, qword [0x140167bf8]
mov dword [rax + 0x5040], 7
mov rcx, qword [rdi + 0x58]
test rcx, rcx
je 0x1400611b2
mov rcx, qword [rcx]
cmp rcx, 0xffffffffffffffff
je 0x1400611b2
test rcx, rcx
je 0x1400611b2
lea rdx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x1400611b2
cmp dword [rsp + 0x70], 0x103
sete al
jmp 0x1400611b4
xor al, al
lea rcx, [0x140148670]
test al, al
lea rax, [0x140148658]
cmovne rcx, rax
call fcn.140018ab0
mov eax, dword [rdi]
movss xmm1, dword [r13 + 0x3964]
movd xmm2, eax
cvtdq2ps xmm2, xmm2
addss xmm2, xmm8
addss xmm2, xmm1
addss xmm2, xmm11
movd xmm0, r14d
cvtdq2ps xmm0, xmm0
mulss xmm2, xmm0
addss xmm2, xmm8
addss xmm2, xmm1
cdq
sub eax, edx
sar eax, 1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
addss xmm2, xmm0
mulss xmm6, xmm12
subss xmm2, xmm6
mov rcx, qword [0x140167bf8]
mov rax, qword [rcx + 0x40a0]
mov byte [rax + 0xcc], 1
mov rax, qword [rcx + 0x40a0]
movss xmm0, dword [rax + 0x28]
subss xmm0, dword [rax + 0x98]
addss xmm0, xmm2
movss dword [rax + 0x118], xmm0
mov byte [rax + 0x159], 1
mov rcx, qword [rdi + 0x58]
test rcx, rcx
je 0x14006128f
mov rcx, qword [rcx]
cmp rcx, 0xffffffffffffffff
je 0x14006128f
test rcx, rcx
je 0x14006128f
lea rdx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x14006128f
cmp dword [rbp - 0x80], 0x103
sete al
test al, al
mov edx, 0xff64ff64
jne 0x140061294
mov edx, 0xff787878
call fcn.140004900
lea rcx, [rdi + 8]
cmp qword [rcx + 0x18], 0xf
jbe 0x1400612a7
mov rcx, qword [rcx]
call fcn.14003b6c0
mov r8d, r12d
mov rbx, qword [0x140167bf8]
mov eax, dword [rbx + 0x4b38]
cmp eax, r12d
jge 0x1400612e0
lea rcx, str.Calling_PopStyleColor___too_many_times_
call fcn.140017060
mov r8d, dword [rbx + 0x4b38]
mov eax, r8d
test r8d, r8d
jle 0x140061316
nop dword [rax]
cdqe
lea rdx, [rax + rax*4]
mov rcx, qword [rbx + 0x4b40]
movsxd rax, dword [rcx + rdx*4 - 0x14]
add rax, rax
movups xmm0, xmmword [rcx + rdx*4 - 0x10]
movups xmmword [rbx + rax*8 + 0x3a18], xmm0
dec dword [rbx + 0x4b38]
mov eax, dword [rbx + 0x4b38]
dec r8d
test r8d, r8d
jg 0x1400612e0
inc esi
add r15, 8
inc r14d
mov rcx, qword [0x140167cb8]
mov rdx, qword [0x140167cb0]
sub rcx, rdx
sar rcx, 3
movsxd rax, esi
cmp rax, rcx
jb 0x140060ed0
xor r15d, r15d
mov r14d, dword [rsp + 0x60]
call fcn.14000d360
mov r8d, 3
mov rbx, qword [0x140167bf8]
mov eax, dword [rbx + 0x4b38]
cmp eax, r8d
jge 0x140061380
lea rcx, str.Calling_PopStyleColor___too_many_times_
call fcn.140017060
mov r8d, dword [rbx + 0x4b38]
mov eax, r8d
test r8d, r8d
jle 0x1400613b6
cdqe
lea rdx, [rax + rax*4]
mov rcx, qword [rbx + 0x4b40]
movsxd rax, dword [rcx + rdx*4 - 0x14]
add rax, rax
movups xmm0, xmmword [rcx + rdx*4 - 0x10]
movups xmmword [rbx + rax*8 + 0x3a18], xmm0
dec dword [rbx + 0x4b38]
mov eax, dword [rbx + 0x4b38]
dec r8d
test r8d, r8d
jg 0x140061380
call fcn.140012ad0
call fcn.14000ca50
movdqa xmm0, xmmword [0x14014dec0]
movups xmmword [rbp + 0x410], xmm0
mov rcx, qword [0x140167cd0]
mov rax, qword [rcx]
xor r9d, r9d
lea r8, [0x140167c98]
mov edx, r12d
call qword [rax + 0x108]
mov rcx, qword [0x140167cd0]
mov rax, qword [rcx]
lea r8, [rbp + 0x410]
mov rdx, qword [0x140167c98]
call qword [rax + 0x190]
mov rax, qword [0x140167bf8]
mov rcx, qword [rax + 0x4bd0]
mov rax, qword [rcx]
add rax, 0x50
mov rcx, r15
cmp byte [rax], 0
cmovne rcx, rax
call fcn.140032240
mov rcx, qword [0x140167ca0]
mov rax, qword [rcx]
xor r8d, r8d
mov edx, r12d
call qword [rax + 0x40]
cmp eax, 0x87a0001
sete byte [0x140167c2c]
test r14b, r14b
jne 0x140061473
lea r13, str.MisterFish_DPI
jmp 0x14005f280
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdi, qword [0x140167cb8]
mov rbx, qword [0x140167cb0]
cmp rbx, rdi
je 0x140061497
mov rcx, qword [rbx]
call fcn.14005d120
add rbx, 8
cmp rbx, rdi
jne 0x140061486
mov rbx, qword [0x140167bf8]
test rbx, rbx
je 0x1400614ac
mov rdi, qword [rbx + 0xa0]
jmp 0x1400614af
mov rdi, r15
call fcn.1400331f0
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x1400614c3
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400614d1
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1400614e0
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [rbx + 0x90], r15
mov qword [rbx + 0xa0], r15
and dword [rbx + 0xc], 0xfffffff7
mov r8, qword [0x140167bf8]
test r8, r8
je 0x140061561
mov r9d, dword [r8 + 0x3fe8]
movsx rdx, word [r8 + 0x5488]
lea rcx, [r8 + 0x548c]
lea rcx, [rcx + rdx*8]
cmp dword [rcx], r9d
je 0x140061556
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x5488], cx
movsx rax, cx
lea rcx, [r8 + 0x548c]
lea rcx, [rcx + rax*8]
mov dword [rcx], r9d
mov dword [rcx + 4], 0
inc word [rcx + 6]
inc dword [r8 + 0x5484]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r8, qword [0x140167bf8]
test r8, r8
je 0x14006157f
mov rdi, qword [r8 + 0x98]
jmp 0x140061582
mov rdi, r15
lea rbx, [r8 + 8]
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x14006159c
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov r8, qword [0x140167bf8]
mov qword [rbx + 0x80], r15
mov qword [rbx + 0x90], r15
and dword [rbx + 4], 0xfffffff8
test r8, r8
je 0x140061616
mov r9d, dword [r8 + 0x3fe8]
movsx rdx, word [r8 + 0x5488]
lea rcx, [rdx*8 + 0x548c]
add rcx, r8
cmp dword [rcx], r9d
je 0x14006160b
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x5488], cx
movsx rax, cx
lea rcx, [rax*8 + 0x548c]
add rcx, r8
mov dword [rcx], r9d
mov dword [rcx + 4], 0
inc word [rcx + 6]
inc dword [r8 + 0x5484]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [0x140167bf8]
mov qword [0x140167bf8], rbx
call fcn.1400081f0
mov qword [0x140167bf8], r15
test rbx, rbx
je 0x1400616c3
mov rcx, rbx
call fcn.1400215c0
mov r8, qword [0x140167bf8]
test r8, r8
je 0x1400616ba
mov r9d, dword [r8 + 0x3fe8]
movsx r10, word [r8 + 0x5488]
lea rdx, [r8 + 0x548c]
lea rdx, [rdx + r10*8]
cmp dword [rdx], r9d
je 0x1400616af
lea ecx, [r10 + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x5488], cx
movsx rax, cx
lea rdx, [r8 + 0x548c]
lea rdx, [rdx + rax*8]
mov dword [rdx], r9d
mov dword [rdx + 4], 0
inc word [rdx + 6]
inc dword [r8 + 0x5484]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [0x140167c98]
test rcx, rcx
je 0x1400616dc
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [0x140167c98], r15
mov rcx, qword [0x140167ca0]
test rcx, rcx
je 0x1400616f5
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [0x140167ca0], r15
mov rcx, qword [0x140167cd0]
test rcx, rcx
je 0x14006170e
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [0x140167cd0], r15
mov rcx, qword [0x140167ca8]
test rcx, rcx
je 0x140061727
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [0x140167ca8], r15
mov rcx, qword [0x140167cc8]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rdx, qword [rbp + 0x88]
mov rcx, qword [rbp + 0xb0]
call qword [sym.imp.USER32.dll_UnregisterClassA]
xor eax, eax
mov dword [rbp + 0x194], eax
xor edx, edx
mov r8d, 0x1fc
lea rcx, [rbp + 0x1a4]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0x190], 0x210
mov rax, qword [0x140167cc8]
mov qword [rbp + 0x198], rax
mov dword [rbp + 0x1a0], r12d
lea rdx, [rbp + 0x190]
mov ecx, 2
call qword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
lea rcx, str.sc_stop_WinDivert
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rbx, qword [rbp + 0x50]
test rbx, rbx
je 0x14005e716
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14005e716
call fcn.140012ad0
jmp 0x14005e716
call fcn.140044da0
int3
call fcn.140044da0
int3