Function at 0x1400ee490
Capabilities:
Contain obfuscated stackstrings
Create thread
Delete file
Encode data using xor
Execute command
Log keystrokes via polling
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x110]
sub rsp, 0x210
mov rax, qword [0x140215080]
xor rax, rsp
mov qword [rbp + 0x100], rax
xor esi, esi
call fcn.1400ed260
mov dword [rbp - 0x50], esi
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [rbp - 0x4c], 0x1a0054
lea r8, [rbp - 0x50]
lea edx, [rsi + 1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleWindowInfo]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
lea rdx, [rbp - 0x28]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ecx, word [rbp - 0x1a]
sub cx, word [rbp - 0x1e]
inc cx
mov word [rbp - 0x78], cx
movzx ecx, word [rbp - 0x18]
sub cx, word [rbp - 0x1c]
inc cx
mov word [rbp - 0x76], cx
mov edx, dword [rbp - 0x78]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
lea rcx, [0x140297120]
call fcn.1401084a0
cmp byte [0x140297330], sil
jne 0x1400ee562
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.1400ed260
mov dword [rbp - 0x78], 0x7a6464
mov byte [rbp - 0x74], 1
mov rcx, rsi
nop word [rax + rax]
lea eax, [rcx + 7]
xor byte [rbp + rcx - 0x78], al
inc rcx
cmp rcx, 3
jb 0x1400ee580
mov byte [rbp - 0x74], sil
lea rcx, [rbp - 0x78]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x140297120]
call fcn.140105090
mov r14, qword [0x140297cd0]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r14
cmp rax, 0xf
jb 0x1400ef718
lea r13, [0x140297cc0]
mov r12, r13
cmp qword [0x140297cd8], 0xf
cmova r12, qword [0x140297cc0]
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
lea r15, [r14 + 0xf]
mov ebx, reloc.WS2_32.dll_ntohs
lea rdi, [rsp + 0x68]
movabs rax, 0x8000000000000000
lea edx, [rbx + 7]
cmp r15, rbx
jbe 0x1400ee682
mov rbx, r15
or rbx, 0xf
cmp rbx, rcx
jbe 0x1400ee648
mov rbx, rcx
add rax, 0x27
mov rcx, rax
call fcn.14015e810
test rax, rax
je 0x1400ee793
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400ee67d
cmp rbx, rdx
cmovb rbx, rdx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400ee66b
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400ef6fa
jmp 0x1400ee629
test rcx, rcx
je 0x1400ee67a
call fcn.14015e810
mov rdi, rax
jmp 0x1400ee67d
mov rdi, rsi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x80], rbx
movsd xmm0, qword [str.C:ProgramData_]
movsd qword [rdi], xmm0
mov eax, dword [0x1401e3378]
mov dword [rdi + 8], eax
movzx eax, word [0x1401e337c]
mov word [rdi + 0xc], ax
movzx eax, byte [0x1401e337e]
mov byte [rdi + 0xe], al
lea rcx, [rdi + 0xf]
mov r8, r14
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r15], sil
mov rdi, qword [rsp + 0x78]
lea rbx, [rsp + 0x68]
cmp qword [rbp - 0x80], 0xf
cmova rbx, qword [rsp + 0x68]
call fcn.14015e100
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x68], rdi
lea r8, [rbp - 0x70]
mov edx, eax
lea rcx, [rsp + 0x38]
call fcn.1400ec170
nop
lea rcx, [rsp + 0x38]
call fcn.1400ecac0
movzx ebx, al
mov rdx, qword [rsp + 0x50]
cmp rdx, 7
jbe 0x1400ee74d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ee748
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400ee748
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14015ea8c
movdqa xmm0, xmmword [0x1401e4970]
movdqu xmmword [rsp + 0x48], xmm0
mov word [rsp + 0x38], si
mov rdx, qword [rbp - 0x80]
cmp rdx, 0xf
jbe 0x1400ee79f
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ee79a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400ee79a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14015ea8c
test bl, bl
je 0x1400ee826
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov word [rsp + 0x30], 0xa
mov byte [rsp + 0x32], 0
lea rdx, [rsp + 0x30]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400f20b0
movdqa xmm0, xmmword [0x1401e5500]
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x1401e5320]
movdqu xmmword [rsp + 0x48], xmm1
mov dword [rsp + 0x58], 0x4075c4e
mov dword [rsp + 0x5c], 0x1002605
mov rcx, rsi
nop
lea eax, [rcx + 7]
xor byte [rsp + rcx + 0x38], al
inc rcx
cmp rcx, 0x26
jb 0x1400ee800
mov byte [rsp + 0x5f], 0
lea rcx, [rsp + 0x38]
call fcn.1400e0750
mov ecx, 0x3e8
jmp 0x1400ee837
lea rcx, [0x140297120]
call fcn.140105090
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], rsi
mov qword [rbp - 0x30], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x48], 0
mov r14, qword [0x140297cd0]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r14
cmp rax, 0xf
jb 0x1400ef71e
mov r12, r13
cmp qword [0x140297cd8], 0xf
cmova r12, qword [0x140297cc0]
movups xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
lea r15, [r14 + 0xf]
mov ebx, reloc.WS2_32.dll_ntohs
lea rdi, [rsp + 0x68]
cmp r15, rbx
jbe 0x1400ee925
mov rbx, r15
or rbx, 0xf
cmp rbx, rcx
jbe 0x1400ee8e5
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14015e810
test rax, rax
je 0x1400eea37
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400ee920
cmp rbx, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400ee90e
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400ef700
jmp 0x1400ee8c6
test rcx, rcx
je 0x1400ee91d
call fcn.14015e810
mov rdi, rax
jmp 0x1400ee920
mov rdi, rsi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x80], rbx
movsd xmm0, qword [str.C:ProgramData_]
movsd qword [rdi], xmm0
mov eax, dword [0x1401e3378]
mov dword [rdi + 8], eax
movzx eax, word [0x1401e337c]
mov word [rdi + 0xc], ax
movzx eax, byte [0x1401e337e]
mov byte [rdi + 0xe], al
lea rcx, [rdi + 0xf]
mov r8, r14
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r15], 0
mov rdi, qword [rsp + 0x78]
lea rbx, [rsp + 0x68]
cmp qword [rbp - 0x80], 0xf
cmova rbx, qword [rsp + 0x68]
call fcn.14015e100
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x68], rdi
lea r8, [rbp - 0x70]
mov edx, eax
lea rcx, [rsp + 0x38]
call fcn.1400ec170
nop
lea rcx, [rsp + 0x38]
call fcn.1400ecac0
movzx ebx, al
mov rdx, qword [rsp + 0x50]
cmp rdx, 7
jbe 0x1400ee9f1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ee9ec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400ee9ec
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14015ea8c
movdqa xmm0, xmmword [0x1401e4970]
movdqu xmmword [rsp + 0x48], xmm0
mov word [rsp + 0x38], si
mov rdx, qword [rbp - 0x80]
cmp rdx, 0xf
jbe 0x1400eea43
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400eea3e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400eea3e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14015ea8c
test bl, bl
je 0x1400eedb0
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp - 0x10]
call sub.VCRUNTIME140.dll_memset
mov r15, qword [0x140297cd0]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r15
cmp rax, 0xf
jb 0x1400ef724
mov r12, r13
cmp qword [0x140297cd8], 0xf
cmova r12, qword [0x140297cc0]
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
lea r14, [r15 + 0xf]
mov ebx, reloc.WS2_32.dll_ntohs
lea rdi, [rsp + 0x68]
cmp r14, rbx
jbe 0x1400eeb33
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x1400eeaec
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14015e810
test rax, rax
je 0x1400eeb15
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400eeb2e
cmp rbx, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400eeb1c
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400ef706
jmp 0x1400eead1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x1400eeb2b
call fcn.14015e810
mov rdi, rax
jmp 0x1400eeb2e
mov rdi, rsi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x80], rbx
movsd xmm0, qword [str.C:ProgramData_]
movsd qword [rdi], xmm0
mov eax, dword [0x1401e3378]
mov dword [rdi + 8], eax
movzx eax, word [0x1401e337c]
mov word [rdi + 0xc], ax
movzx eax, byte [0x1401e337e]
mov byte [rdi + 0xe], al
lea rcx, [rdi + 0xf]
mov r8, r15
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x10]
call fcn.1400f04d0
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 0xf
jbe 0x1400eebc8
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400eebc3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400eebc3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14015ea8c
movdqa xmm0, xmmword [0x1401e4990]
movdqu xmmword [rsp + 0x78], xmm0
mov byte [rsp + 0x68], 0
mov rax, qword [rbp - 0x10]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x10]
add rcx, rax
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
movzx r8d, al
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x10]
call fcn.1400f5010
lea rdx, [rbp - 0x48]
lea rcx, [rsp + 0x38]
call fcn.14009c8f0
mov rdx, rax
lea rcx, [0x140297120]
call fcn.140109ce0
cmp byte [0x140297330], 0
jne 0x1400eef4e
mov r15, qword [0x140297cd0]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r15
cmp rax, 0xf
jb 0x1400ef72a
mov r12, r13
cmp qword [0x140297cd8], 0xf
cmova r12, qword [0x140297cc0]
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x60], xmm1
lea r14, [r15 + 0xf]
mov ebx, reloc.WS2_32.dll_ntohs
lea rdi, [rbp - 0x70]
cmp r14, rbx
jbe 0x1400eecfd
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x1400eecbe
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14015e810
test rax, rax
je 0x1400eed89
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400eecf9
cmp rbx, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400eece7
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400ef70c
jmp 0x1400eec9f
test rcx, rcx
je 0x1400eecf6
call fcn.14015e810
mov rdi, rax
jmp 0x1400eecf9
mov rdi, rsi
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x58], rbx
movsd xmm0, qword [str.C:ProgramData_]
movsd qword [rdi], xmm0
mov eax, dword [0x1401e3378]
mov dword [rdi + 8], eax
movzx eax, word [0x1401e337c]
mov word [rdi + 0xc], ax
movzx eax, byte [0x1401e337e]
mov byte [rdi + 0xe], al
lea rcx, [rdi + 0xf]
mov r8, r15
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 0xf
cmova rcx, qword [rbp - 0x70]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x1400eed95
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400eed90
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400eed90
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14015ea8c
movdqa xmm0, xmmword [0x1401e4990]
movdqu xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x70], 0
lea rcx, [rbp - 0x10]
call fcn.1400ecbc0
nop
mov word [rsp + 0x30], 0xa
mov byte [rsp + 0x32], 0
lea rdx, [rsp + 0x30]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400f20b0
movdqa xmm0, xmmword [0x1401e5210]
movdqu xmmword [rbp - 0x70], xmm0
mov dword [rbp - 0x60], 0x1001239
mov rcx, rsi
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx + 7]
xor byte [rbp + rcx - 0x70], al
inc rcx
cmp rcx, 0x12
jb 0x1400eedf0
mov byte [rbp - 0x5d], 0
mov edx, 6
mov rcx, qword [0x1402935a0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dword [rbp - 0x50], 0x293639
mov byte [rbp - 0x4c], 1
mov rdx, rsi
nop dword [rax]
nop dword [rax + rax]
lea eax, [rdx + 7]
xor byte [rbp + rdx - 0x50], al
inc rdx
cmp rdx, 3
jb 0x1400eee30
mov byte [rbp - 0x4c], 0
lea rdx, [rbp - 0x50]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400f20b0
mov edx, 7
mov rcx, qword [0x1402935a0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [rbp - 0x70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400f20b0
lea rdx, [rbp - 0x48]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.1400f2810
lea rdx, [rbp - 0x48]
lea rcx, [rsp + 0x38]
call fcn.14009c8f0
mov rdx, rax
lea rcx, [0x140297120]
call fcn.140109ce0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
cmp byte [0x140297330], 0
jne 0x1400eef5c
mov word [rsp + 0x60], 0xa
mov byte [rsp + 0x62], 0
lea rdx, [rsp + 0x60]
call fcn.1400f20b0
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
movdqa xmm0, xmmword [0x1401e51f0]
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x1401e5330]
movdqu xmmword [rsp + 0x48], xmm1
mov dword [rsp + 0x58], 0xb4d414b
mov word [rsp + 0x5c], reloc.WLDAP32.dll_Ordinal_33
mov byte [rsp + 0x5e], 1
mov rcx, rsi
nop dword [rax + rax]
lea eax, [rcx + 7]
xor byte [rsp + rcx + 0x38], al
inc rcx
cmp rcx, 0x25
jb 0x1400eef10
mov byte [rsp + 0x5e], 0
lea rcx, [rsp + 0x38]
call fcn.1400e0750
mov word [rbp - 0x78], 0xa
mov byte [rbp - 0x76], 0
lea rdx, [rbp - 0x78]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400f20b0
jmp 0x1400eedb0
lea rcx, [rbp - 0x10]
call fcn.1400ecbc0
jmp 0x1400ef1e8
mov word [rbp - 0x78], 0xa
mov byte [rbp - 0x76], 0
lea rdx, [rbp - 0x78]
call fcn.1400f20b0
movdqa xmm0, xmmword [0x1401e54f0]
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x1401e5310]
movdqu xmmword [rsp + 0x48], xmm1
mov dword [rsp + 0x58], 0x4075c4e
mov dword [rsp + 0x5c], 0x1002605
mov rcx, rsi
nop
lea eax, [rcx + 7]
xor byte [rsp + rcx + 0x38], al
inc rcx
cmp rcx, 0x26
jb 0x1400eefa0
mov byte [rsp + 0x5f], 0
lea rcx, [rsp + 0x38]
call fcn.1400e0750
mov word [rbp - 0x78], 0xa
mov byte [rbp - 0x76], 0
lea rdx, [rbp - 0x78]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400f20b0
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp - 0x10]
call sub.VCRUNTIME140.dll_memset
mov r15, qword [0x140297cd0]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r15
cmp rax, 0xf
jb 0x1400ef712
cmp qword [0x140297cd8], 0xf
cmova r13, qword [0x140297cc0]
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x58], rsi
lea r14, [r15 + 0xf]
mov ebx, reloc.WS2_32.dll_ntohs
lea rdi, [rbp - 0x70]
cmp r14, rbx
jbe 0x1400ef0ba
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x1400ef05b
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x1400ef082
cmp rbx, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400ef0a4
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400ef6f4
mov rcx, rax
call fcn.14015e810
test rax, rax
je 0x1400ef09d
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400ef0b6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x1400ef0b3
call fcn.14015e810
mov rdi, rax
jmp 0x1400ef0b6
mov rdi, rsi
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x58], rbx
movsd xmm0, qword [str.C:ProgramData_]
movsd qword [rdi], xmm0
mov eax, dword [0x1401e3378]
mov dword [rdi + 8], eax
movzx eax, word [0x1401e337c]
mov word [rdi + 0xc], ax
movzx eax, byte [0x1401e337e]
mov byte [rdi + 0xe], al
lea rcx, [rdi + 0xf]
mov r8, r15
mov rdx, r13
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x10]
call fcn.1400ef730
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x1400ef14c
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ef147
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400ef147
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14015ea8c
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x58], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x70], 0
lea rdx, [rbp - 0x48]
cmp qword [rbp - 0x30], 0xf
cmova rdx, qword [rbp - 0x48]
mov r8, qword [rbp - 0x38]
lea rcx, [rbp - 0x10]
call fcn.1400f51c0
lea rcx, [rbp - 8]
call fcn.1400f1790
test rax, rax
jne 0x1400ef1a2
mov rax, qword [rbp - 0x10]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x10]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
mov rax, qword [rbp - 0x10]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x10], rax
mov rax, qword [rbp - 0x10]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx - 0x14], edx
lea rcx, [rbp - 8]
call fcn.1400f0460
lea rcx, [rbp]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x98]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
cmp byte [0x140297330], 0
jne 0x1400ef205
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.1400edaa0
movdqa xmm0, xmmword [0x1401e5970]
movdqu xmmword [rbp - 0x70], xmm0
mov dword [rbp - 0x60], 0x627d7d73
mov word [rbp - 0x5c], 0x100
mov rcx, rsi
nop word [rax + rax]
lea eax, [rcx + 7]
xor byte [rbp + rcx - 0x70], al
inc rcx
cmp rcx, 0x14
jb 0x1400ef230
mov byte [rbp - 0x5b], 0
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
test ax, ax
jne 0x1400ef29e
call fcn.1400ed6c0
movdqa xmm0, xmmword [0x1401e5970]
movdqu xmmword [rbp - 0x70], xmm0
mov dword [rbp - 0x60], 0x627d7d73
mov word [rbp - 0x5c], 0x100
mov rcx, rsi
nop word [rax + rax]
lea eax, [rcx + 7]
xor byte [rbp + rcx - 0x70], al
inc rcx
cmp rcx, 0x14
jb 0x1400ef280
mov byte [rbp - 0x5b], 0
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
mov word [rbp - 0x78], 0xa
mov byte [rbp - 0x76], 0
lea rdx, [rbp - 0x78]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400f20b0
movdqa xmm0, xmmword [0x1401e59e0]
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [str.b8xh_tp_lN_A__]
movdqu xmmword [rsp + 0x48], xmm1
mov byte [rsp + 0x58], 1
mov rcx, rsi
nop dword [rax]
lea eax, [rcx + 7]
xor byte [rsp + rcx + 0x38], al
inc rcx
cmp rcx, 0x1f
jb 0x1400ef2e0
mov byte [rsp + 0x58], 0
lea rcx, [rsp + 0x38]
call fcn.1400e0750
mov word [rbp - 0x78], 0xa
mov byte [rbp - 0x76], 0
lea rdx, [rbp - 0x78]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400f20b0
movdqa xmm0, xmmword [0x1401e4a70]
movdqu xmmword [rbp - 0x70], xmm0
mov byte [rbp - 0x60], 1
mov rdx, rsi
nop dword [rax]
lea eax, [rdx + 7]
xor byte [rbp + rdx - 0x70], al
inc rdx
cmp rdx, 0xf
jb 0x1400ef330
mov byte [rbp - 0x60], 0
lea rcx, [rbp - 0x70]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, Ordinal_301
lea ecx, [rdx + 0x19]
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [0x1402934b8], 0
jne 0x1400ef3d0
movdqa xmm0, xmmword [0x1401e53c0]
movdqu xmmword [rbp - 0x70], xmm0
mov word [rbp - 0x60], 0x100
mov rcx, rsi
nop word [rax + rax]
lea eax, [rcx + 7]
xor byte [rbp + rcx - 0x70], al
inc rcx
cmp rcx, 0x10
jb 0x1400ef390
mov byte [rbp - 0x5f], 0
lea rdx, [rbp - 0x70]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x1402934b8], rax
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [0x1402934b8], 0
je 0x1400ef371
nop dword [rax]
mov ecx, reloc.WS2_32.dll_WSASetLastError
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1400ef3d0
call fcn.14009aaa0
call fcn.1400e31b0
lea rcx, [0x140298300]
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x1400ef407
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [0x14029834c], 0x7fffffff
jne 0x1400ef429
mov dword [0x14029834c], 0x7ffffffe
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov dword [rbp - 0x78], esi
mov rax, qword [0x1402933d8]
mov byte [rax + 2], 1
lea rcx, [rbp - 0x78]
mov rax, qword [0x1402933d8]
mov qword [rax + 0x18], rcx
lea rcx, str.EscapeFromTarkov.exe
mov rax, qword [0x1402933d8]
mov qword [rax + 0x28], rcx
call fcn.14009ad40
lea rcx, [0x140298300]
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov eax, dword [rbp - 0x78]
mov dword [0x140293428], eax
movdqa xmm0, xmmword [0x1401e5a70]
movdqu xmmword [rbp - 0x70], xmm0
mov dword [rbp - 0x60], 0x392273
mov byte [rbp - 0x5c], 1
mov rdx, rsi
nop
lea eax, [rdx + 7]
xor byte [rbp + rdx - 0x70], al
inc rdx
cmp rdx, 0x13
jb 0x1400ef490
mov byte [rbp - 0x5c], 0
lea rdx, [rbp - 0x70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400f20b0
mov edx, dword [0x140293428]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
lea rdx, [0x1400f2280]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ebx, dword [0x140293428]
mov dword [0x1402933e0], ebx
mov dword [rsp + 0x38], 0x38663852
mov dword [rsp + 0x3c], 0x387e3860
mov dword [rsp + 0x40], 0x387c3872
mov dword [rsp + 0x44], 0x386f3861
mov dword [rsp + 0x48], 0x38753876
mov dword [rsp + 0x4c], 0x383c3863
mov dword [rsp + 0x50], 0x38783877
mov dword [rsp + 0x54], 0x3879
mov byte [rsp + 0x58], 1
mov rcx, rsi
mov edx, 0x3807
nop dword [rax]
lea eax, [rdx + rcx]
xor word [rsp + rcx*2 + 0x38], ax
inc rcx
cmp rcx, 0xf
jb 0x1400ef530
mov byte [rsp + 0x58], 0
lea rcx, [0x140298300]
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x1400ef563
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [0x14029834c], 0x7fffffff
jne 0x1400ef585
mov dword [0x14029834c], 0x7ffffffe
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov qword [rbp - 0x50], rsi
mov rax, qword [0x1402933d8]
mov byte [rax + 2], 2
mov rax, qword [0x1402933d8]
mov qword [rax + 8], rbx
lea rdx, [rbp - 0x50]
mov rax, qword [0x1402933d8]
mov qword [rax + 0x18], rdx
lea rdx, [rsp + 0x38]
mov rax, qword [0x1402933d8]
mov qword [rax + 0x28], rdx
call fcn.14009ad40
lea rcx, [0x140298300]
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rax, qword [rbp - 0x50]
mov qword [0x140293498], rax
movdqa xmm0, xmmword [0x1401e5930]
movdqu xmmword [rbp - 0x70], xmm0
mov dword [rbp - 0x60], 0x3a237d64
mov word [rbp - 0x5c], 0x100
nop word [rax + rax]
lea eax, [rsi + 7]
xor byte [rbp + rsi - 0x70], al
inc rsi
cmp rsi, 0x14
jb 0x1400ef600
mov byte [rbp - 0x5b], 0
lea rdx, [rbp - 0x70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400f20b0
mov rdx, qword [0x140293498]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_long___int64_____ptr64]
lea rdx, [0x1400f2280]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call fcn.1400e8c60
cmp eax, 3
je 0x1400ef65a
lea rcx, str.__render_____failed_to_setup_render._n
call fcn.1400e0750
xor r8d, r8d
xor edx, edx
lea rcx, [0x1400e58e0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthread]
xor r8d, r8d
xor edx, edx
lea rcx, [0x1400e5960]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthread]
call fcn.1400eb720
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 0xf
jbe 0x1400ef6c2
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ef6bd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400ef6bd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14015ea8c
xor eax, eax
mov rcx, qword [rbp + 0x100]
xor rcx, rsp
call fcn.14015e7f0
lea r11, [rsp + 0x210]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14009ae70
nop
call fcn.14009ae70
nop
call fcn.14009ae70
int3
call fcn.14009ae70
nop
call fcn.14009ae70
nop
call fcn.14009af10
nop
call fcn.14009af10
nop
call fcn.14009af10
int3
call fcn.14009af10
nop
call fcn.14009af10
int3