Function at 0x1400de340
Capabilities:
Allocate or change rwx memory
Authenticate hmac
Create process on windows
Create thread
Download url
Encode data using xor
Execute shellcode via indirect call
Inject thread
Receive data
Resolve function by parsing pe exports
Spawn thread to rwx shellcode

Disassembly:
push rbp
push rdi
push r13
lea rbp, [rsp - 0x740]
sub rsp, 0x840
mov rax, qword [0x1403a1b88]
xor rax, rsp
mov qword [rbp + 0x680], rax
mov rax, qword [str.Key.ini]
xor edi, edi
mov rcx, qword [0x1403daff8]
mov r13d, reloc.WS2_32.dll_ntohs
mov dword [rbp + 0x1d0], eax
movzx eax, word [0x1402d212c]
mov word [rbp + 0x1d4], ax
movzx eax, byte [0x1402d212e]
mov byte [rbp + 0x1d6], al
mov qword [rbp + 0x1d8], rdi
mov qword [rbp + 0x1e0], 7
mov qword [rbp + 0x1e8], r13
mov byte [rbp + 0x1d7], dil
call fcn.140062990
mov rcx, qword [0x1403daff8]
call fcn.1400629e0
movdqa xmm0, xmmword [reloc.WS2_32.dll_getsockopt]
lea rcx, [rbp + 0x1b0]
movdqu xmmword [rbp + 0x1c0], xmm0
movups xmm0, xmmword [rbp + 0x1d0]
movups xmmword [rbp + 0x1b0], xmm0
call fcn.1400bd720
lea rcx, [0x1403db1e0]
call fcn.1400d55a0
mov rcx, qword [0x1403db1f0]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, 4
jb 0x1400e081c
cmp qword [0x1403db1f8], 0x10
lea rax, str.Ver
movzx edx, byte [rbp - 0x80]
lea r9, [0x1403db1e0]
cmovae r9, qword [0x1403db1e0]
lea r8, [0x1403db1e0]
mov qword [rsp + 0x30], 4
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0x1b0]
call fcn.1400b62e0
cmp qword [0x1403db258], 0x10
lea rdx, [0x1403db240]
mov r8, qword [0x1403db250]
lea rcx, [rbp + 0x1b0]
cmovae rdx, qword [0x1403db240]
call fcn.1400c3cc0
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rbp + 0x1f0], xmm0
movdqu xmmword [rbp + 0x200], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1f0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x200], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r13
mov byte [rax], dil
mov rdx, qword [rbp + 0x1c8]
cmp rdx, 0x10
jb 0x1400de509
mov rcx, qword [rbp + 0x1b0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400de504
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400e0822
call fcn.140279bcc
cmp qword [rbp + 0x208], 0x10
lea rax, [0x1400c1c20]
mov qword [rsp + 0x860], rbx
lea rbx, [rbp + 0x1f0]
cmovae rbx, qword [rbp + 0x1f0]
xor ecx, ecx
mov qword [rsp + 0x868], rsi
mov qword [rsp + 0x870], r12
mov qword [rsp + 0x838], r14
mov qword [rsp + 0x830], r15
movaps xmmword [rsp + 0x820], xmm6
movaps xmmword [rsp + 0x810], xmm7
movaps xmmword [rsp + 0x800], xmm8
movaps xmmword [rsp + 0x7f0], xmm9
movaps xmmword [rsp + 0x7e0], xmm10
movaps xmmword [rsp + 0x7d0], xmm11
movaps xmmword [rsp + 0x7c0], xmm12
movaps xmmword [rsp + 0x7b0], xmm13
movaps xmmword [rsp + 0x7a0], xmm14
movaps xmmword [rsp + 0x790], xmm15
mov qword [rbp + 0xb0], rbx
mov dword [rbp + 0xd0], 0x50
mov dword [rbp + 0xd4], 0x40
mov qword [rbp + 0xd8], rax
mov qword [rbp + 0xe0], rdi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xorps xmm0, xmm0
mov qword [rbp + 0x110], rbx
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xf0], xmm0
lea rcx, [rbp + 0xd0]
movdqa xmmword [rbp + 0x100], xmm1
mov qword [rbp + 0xe8], rax
mov qword [rbp + 0x118], rdi
call qword [sym.imp.USER32.dll_RegisterClassExA]
mov rax, qword [rbp + 0xe8]
mov r9d, 0x80000000
mov rdx, qword [rbp + 0x110]
mov r8, rbx
mov qword [rsp + 0x58], rdi
xor ecx, ecx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x38], 5
mov dword [rsp + 0x30], 5
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov ecx, reloc.WLDAP32.dll_Ordinal_32
mov qword [0x1403dafa0], rax
mov rbx, rax
call sub.d3d9.dll_Direct3DCreate9
mov qword [0x1403daff0], rax
mov rcx, rax
test rax, rax
je 0x1400e06c8
lea rdx, [0x1403dafa8]
mov qword [0x1403dafb0], rdi
mov qword [rsp + 0x30], rdx
lea r14, [0x1403dafb0]
xor edx, edx
mov qword [0x1403dafbc], rdi
mov dword [0x1403dafc4], edi
mov r9, rbx
mov qword [0x1403dafcc], rdi
mov dword [0x1403dafd4], edi
mov qword [0x1403dafe4], rdi
lea r8d, [rdx + 1]
mov dword [0x1403dafd8], 1
mov dword [0x1403dafc8], 1
mov dword [0x1403dafb8], edi
mov dword [0x1403dafdc], 1
mov dword [0x1403dafe0], 0x50
mov dword [0x1403dafec], 1
mov rax, qword [rax]
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], 0x40
call qword [rax + 0x80]
test eax, eax
js 0x1400e06c8
mov rcx, qword [0x1403dafa0]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1403dafa0]
call qword [sym.imp.USER32.dll_UpdateWindow]
xor ecx, ecx
call fcn.14006af30
call fcn.1400758c0
mov rsi, rax
mov qword [rbp - 0x28], rax
or dword [rax], 0x400
mov qword [rax + 0x18], rdi
call fcn.140075ee0
mov rbx, rax
mov dword [rax + 0xe8], edi
mov dword [rax], 0x3f800000
mov dword [rax + 4], 0x41000000
mov dword [rax + 8], 0x41000000
mov dword [rax + 0x10], edi
mov dword [rax + 0x14], 0x42000000
mov qword [rax + 0x18], 0x42000000
mov qword [rax + 0x20], 0x3f000000
mov dword [rax + 0x28], 0x40800000
mov dword [rax + 0x2c], 0x3f800000
mov dword [rax + 0x30], 0x40800000
mov dword [rax + 0x34], 0x3f800000
mov dword [rax + 0x38], 0x40466666
mov dword [rax + 0x3c], 0x40400000
mov qword [rax + 0x40], 0x40800000
mov dword [rax + 0x48], 0x41000000
mov dword [rax + 0x4c], 0x40800000
mov dword [rax + 0x50], 0x40800000
mov dword [rax + 0x54], 0x40800000
mov dword [rax + 0x60], 0x41a80000
mov dword [rax + 0x64], 0x40c00000
mov dword [rax + 0x68], 0x41600000
mov dword [rax + 0x6c], 0x4039999a
mov dword [rax + 0x70], 0x41200000
mov dword [rax + 0x74], 0x40800000
mov qword [rax + 0x7c], 0x40800000
mov dword [rax + 0x84], edi
mov dword [rax + 0x88], 1
mov dword [rax + 0x8c], 0x3f000000
mov dword [rax + 0x90], 0x3f000000
call fcn.140075ee0
mov dword [rax + 0x40], 0x40800000
call fcn.140075ee0
mov dword [rax + 0x74], 0x40800000
mov dword [rbx + 0xc], 0x40c00000
test dword [rsi], 0x400
je 0x1400de866
mov dword [rbx + 0xe8], 0x3f800000
mov rcx, qword [0x1403dafa0]
call fcn.140099570
mov rcx, qword [0x1403dafa8]
call fcn.140098000
xorps xmm0, xmm0
lea rdx, str.C:WindowsNewbie.ttf
xorps xmm1, xmm1
lea rcx, [rsp + 0x60]
mov r8d, reloc.WS2_32.dll_setsockopt
movups xmmword [rsp + 0x60], xmm0
movdqu xmmword [rsp + 0x70], xmm1
call fcn.1400aeee0
cmp qword [rsp + 0x78], 0x10
lea rcx, [rsp + 0x60]
lea rdx, [0x1402c9084]
cmovae rcx, qword [rsp + 0x60]
call fcn.1402909f0
test rax, rax
je 0x1400de8d4
mov rcx, rax
call fcn.140290b78
xor bl, bl
jmp 0x1400de8d6
mov bl, 1
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x1400de913
mov rcx, qword [rsp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400de90e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400e0828
call fcn.140279bcc
test bl, bl
je 0x1400de934
xor r9d, r9d
mov qword [rsp + 0x20], rdi
lea r8, str.C:WindowsNewbie.ttf
xor ecx, ecx
lea rdx, str.https:__cdn.discordapp.com_attachments_989662788878229515_990200874112536586_Newbie.ttf
call sub.urlmon.dll_URLDownloadToFileA
mov rbx, qword [rsi + 0xa0]
mov rcx, rbx
call fcn.14008a3d0
movss xmm2, dword [0x1402d3d04]
lea rdx, str.C:WindowsNewbie.ttf
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov rcx, rbx
call fcn.1400879a0
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
lea rdx, [rbp + 0x238]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rbp + 0x240]
xorps xmm0, xmm0
movss xmm9, dword [0x1402c2d18]
add eax, 0xfffffda2
movss xmm15, dword [0x1402c2ec0]
movss xmm7, dword [0x1402c2d90]
movss xmm12, dword [0x1402d3d0c]
movss xmm14, dword [0x1402d3d08]
movss xmm8, dword [0x1402d3d00]
movss xmm13, dword [0x1402c2eb8]
movd xmm10, eax
mov eax, dword [rbp + 0x244]
add eax, 0xfffffe0c
mov dword [rbp - 0x38], edi
cvtdq2ps xmm10, xmm10
movd xmm11, eax
mulss xmm10, dword [0x1402c2ce8]
cvtdq2ps xmm11, xmm11
movups xmmword [rbp + 0x248], xmm0
mulss xmm11, dword [0x1402c2ce8]
movups xmmword [rbp + 0x258], xmm0
movups xmmword [rbp + 0x268], xmm0
nop dword [rax + rax]
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [rbp + 0x248]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x1400dea50
lea rcx, [rbp + 0x248]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x248]
call qword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x1400e066f
call fcn.1400981d0
call fcn.140099890
call fcn.14007bad0
movaps xmm0, xmmword [0x1402c6a40]
lea rdx, [rbp + 0x278]
xor ecx, ecx
movups xmmword [rbp + 0x278], xmm0
call fcn.14007d4c0
mov eax, dword [0x1403db044]
test eax, eax
jne 0x1400dea90
call fcn.1400d4c40
mov eax, dword [0x1403db044]
cmp eax, 1
jne 0x1400deaa0
call fcn.1400bfa30
mov eax, dword [0x1403db044]
cmp eax, 2
jne 0x1400deab2
xor ecx, ecx
call fcn.14008ff00
mov eax, dword [0x1403db044]
cmp eax, 3
jne 0x1400deac2
call fcn.1400bf100
mov eax, dword [0x1403db044]
cmp eax, 4
jne 0x1400dead2
call fcn.1400bf5e0
mov eax, dword [0x1403db044]
cmp eax, 5
jne 0x1400deae2
call fcn.1400c0940
mov eax, dword [0x1403db044]
cmp eax, 6
jne 0x1400deaf2
call fcn.1400be9c0
mov eax, dword [0x1403db044]
cmp eax, 7
jne 0x1400deb02
call fcn.1400d4400
mov eax, dword [0x1403db044]
cmp eax, 8
jne 0x1400deb0e
xor ecx, ecx
call fcn.14008f020
lea r8, [rbp - 0x18]
movss dword [rbp - 0x10], xmm10
mov edx, 2
movss dword [rbp - 0xc], xmm11
lea rcx, [rbp - 0x10]
mov qword [rbp - 0x18], rdi
call fcn.140081090
xor edx, edx
mov dword [rbp - 8], 0x44178000
lea rcx, [rbp - 8]
mov dword [rbp - 4], 0x43fa0000
call fcn.1400810e0
movaps xmm0, xmm9
call fcn.140081070
lea r8, [rbp]
movss dword [rbp - 0x20], xmm10
mov edx, 2
movss dword [rbp - 0x1c], xmm11
lea rcx, [rbp - 0x20]
mov qword [rbp], rdi
call fcn.140081090
xor edx, edx
cmp byte [0x1403db016], dil
jne 0x1400deb93
mov dword [rbp + 8], 0x44174000
lea rcx, [rbp + 8]
mov dword [rbp + 0xc], 0x43b40000
jmp 0x1400deba5
mov dword [rbp + 0x10], 0x44308000
lea rcx, [rbp + 0x10]
mov dword [rbp + 0x14], 0x43fa0000
call fcn.1400810e0
movaps xmm0, xmm9
call fcn.140081070
cmp byte [reloc.WS2_32.dll_accept], dil
je 0x1400e0591
mov r15, qword [0x1403db1f0]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r15
cmp rax, 0xb
jb 0x1400e085e
cmp qword [0x1403db1f8], 0x10
lea r12, [0x1403db1e0]
lea r14, [r15 + 0xb]
mov qword [rbp - 0x48], rdi
cmovae r12, qword [0x1403db1e0]
lea rsi, [rbp - 0x58]
mov qword [rbp - 0x40], rdi
xorps xmm0, xmm0
mov rbx, r13
movups xmmword [rbp - 0x58], xmm0
cmp r14, 0xf
jbe 0x1400dec93
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x1400dec37
movabs rax, 0x8000000000000000
mov rbx, rcx
add rax, 0x27
jmp 0x1400dec5e
cmp rbx, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400dec7d
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400e082e
mov rcx, rax
call fcn.140279b90
test rax, rax
je 0x1400e0834
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x1400dec8f
test rcx, rcx
je 0x1400dec8c
call fcn.140279b90
mov rsi, rax
jmp 0x1400dec8f
mov rsi, rdi
mov qword [rbp - 0x58], rsi
movsd xmm0, qword [str.Welcome_to]
lea rcx, [rsi + 0xb]
mov qword [rbp - 0x48], r14
mov r8, r15
mov qword [rbp - 0x40], rbx
mov rdx, r12
movsd qword [rsi], xmm0
movzx eax, word [0x1402d21b0]
mov word [rsi + 8], ax
movzx eax, byte [reloc.WLDAP32.dll_Ordinal_32]
mov byte [rsi + 0xa], al
call fcn.14027d780
mov byte [rsi + r14], dil
mov rdx, qword [rbp - 0x40]
mov rcx, qword [rbp - 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x1400ded04
lea rax, [rcx + 1]
cmp rdx, 0x10
mov qword [rbp - 0x48], rax
lea rax, [rbp - 0x58]
cmovae rax, qword [rbp - 0x58]
mov word [rax + rcx], reloc.WLDAP32.dll_Ordinal_32
lea rax, [rbp - 0x58]
jmp 0x1400ded24
xor r8d, r8d
mov qword [rsp + 0x20], 1
lea r9, [0x1402c2e98]
lea rcx, [rbp - 0x58]
lea edx, [r8 + 1]
call fcn.1400b09f0
mov qword [rsp + 0x70], rdi
lea rdx, [0x1403db240]
mov qword [rsp + 0x78], rdi
lea rcx, [rsp + 0x60]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r13
mov byte [rax], dil
cmp qword [0x1403db258], 0x10
mov r8, qword [0x1403db250]
cmovae rdx, qword [0x1403db240]
call fcn.1400c3cc0
mov qword [rbp + 0x1a0], rdi
xorps xmm0, xmm0
movups xmmword [rbp + 0x190], xmm0
mov qword [rbp + 0x1a8], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x190], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1a0], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r13
mov byte [rax], dil
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x1400dedef
mov rcx, qword [rsp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400dedea
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400e0834
call fcn.140279bcc
mov rdx, qword [rbp - 0x40]
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], r13
mov byte [rsp + 0x60], dil
cmp rdx, 0x10
jb 0x1400dee39
mov rcx, qword [rbp - 0x58]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400dee34
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400e0834
call fcn.140279bcc
mov dword [rbp - 0x68], 0xefbaae83
mov rcx, rdi
mov dword [rbp - 0x64], 0xe1f2e2e1
mov dword [rbp - 0x60], 0xe5e7e4
mov byte [rbp - 0x5c], 1
nop word [rax + rax]
lea eax, [rcx - 0x34]
xor byte [rbp + rcx - 0x68], al
inc rcx
cmp rcx, 0xb
jb 0x1400dee60
lea r9, [rbp - 0x80]
mov byte [rbp - 0x5c], dil
lea r8, [rbp - 0x5d]
lea rdx, [rbp - 0x68]
lea rcx, [rbp + 0x1b0]
call fcn.1400ae0c0
mov rcx, rdi
mov dword [rbp - 0x78], 0xfff4f5fd
mov dword [rbp - 0x74], 0xebe2ebe7
mov word [rbp - 0x70], 0x100
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x34]
xor byte [rbp + rcx - 0x78], al
inc rcx
cmp rcx, 8
jb 0x1400deeb0
lea r9, [rbp - 0x80]
mov byte [rbp - 0x6f], dil
lea r8, [rbp - 0x70]
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0x218]
call fcn.1400ae0c0
mov r15, qword [rbp + 0x1c0]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r15
cmp rax, 0xb
jb 0x1400e0858
cmp qword [rbp + 0x1c8], 0x10
lea r12, [rbp + 0x1b0]
mov rax, qword [rbp + 0x1b0]
lea r14, [r15 + 0xb]
cmovae r12, rax
mov qword [rbp + 0xb8], rax
mov qword [rbp - 0x48], rdi
xorps xmm0, xmm0
mov qword [rbp - 0x40], rdi
mov rbx, r13
lea rsi, [rbp - 0x58]
movups xmmword [rbp - 0x58], xmm0
cmp r14, 0xf
jbe 0x1400defb9
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x1400def5d
movabs rax, 0x8000000000000000
mov rbx, rcx
add rax, 0x27
jmp 0x1400def84
cmp rbx, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400defa3
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400e083a
mov rcx, rax
call fcn.140279b90
test rax, rax
je 0x1400e0840
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x1400defb5
test rcx, rcx
je 0x1400defb2
call fcn.140279b90
mov rsi, rax
jmp 0x1400defb5
mov rsi, rdi
mov qword [rbp - 0x58], rsi
movsd xmm0, qword [str.Built_at_:]
lea rcx, [rsi + 0xb]
mov qword [rbp - 0x48], r14
mov r8, r15
mov qword [rbp - 0x40], rbx
mov rdx, r12
movsd qword [rsi], xmm0
movzx eax, word [0x1402d21c0]
mov word [rsi + 8], ax
movzx eax, byte [reloc.WLDAP32.dll_Ordinal_32]
mov byte [rsi + 0xa], al
call fcn.14027d780
mov byte [rsi + r14], dil
mov rdx, qword [rbp - 0x40]
mov rcx, qword [rbp - 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x1400df02a
lea rax, [rcx + 1]
cmp rdx, 0x10
mov qword [rbp - 0x48], rax
lea rax, [rbp - 0x58]
cmovae rax, qword [rbp - 0x58]
mov word [rax + rcx], reloc.WLDAP32.dll_Ordinal_32
lea rax, [rbp - 0x58]
jmp 0x1400df04a
xor r8d, r8d
mov qword [rsp + 0x20], 1
lea r9, [0x1402c2e98]
lea rcx, [rbp - 0x58]
lea edx, [r8 + 1]
call fcn.1400b09f0
cmp qword [rbp + 0x230], 0x10
lea rdx, [rbp + 0x218]
mov r8, qword [rbp + 0x228]
lea rcx, [rsp + 0x60]
cmovae rdx, qword [rbp + 0x218]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], rdi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r13
mov byte [rax], dil
call fcn.1400c3cc0
mov qword [rbp + 0x160], rdi
xorps xmm0, xmm0
movups xmmword [rbp + 0x150], xmm0
mov qword [rbp + 0x168], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x150], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x160], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r13
mov byte [rax], dil
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x1400df115
mov rcx, qword [rsp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400df110
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400e0840
call fcn.140279bcc
mov rdx, qword [rbp - 0x40]
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], r13
mov byte [rsp + 0x60], dil
cmp rdx, 0x10
jb 0x1400df15f
mov rcx, qword [rbp - 0x58]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400df15a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400e0840
call fcn.140279bcc
mov r15, qword [0x1403db250]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r15
cmp rax, 8
jb 0x1400e0852
cmp qword [0x1403db258], 0x10
lea r12, [0x1403db240]
lea r14, [r15 + 8]
mov qword [rbp + 0x138], rdi
cmovae r12, qword [0x1403db240]
lea rsi, [rbp + 0x128]
mov qword [rbp + 0x140], rdi
xorps xmm0, xmm0
mov rbx, r13
movups xmmword [rbp + 0x128], xmm0
cmp r14, 0xf
jbe 0x1400df241
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x1400df1e2
movabs rax, 0x8000000000000000
mov rbx, rcx
add rax, 0x27
jmp 0x1400df209
cmp rbx, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400df228
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400e0846
mov rcx, rax
call fcn.140279b90
test rax, rax
je 0x1400e084c
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x1400df23a
test rcx, rcx
je 0x1400df237
call fcn.140279b90
mov rsi, rax
jmp 0x1400df23a
mov rsi, rdi
mov qword [rbp + 0x128], rsi
movabs rax, 0x206e6f6973726556
mov qword [rbp + 0x138], r14
mov qword [rbp + 0x140], rbx
lea rcx, [rsi + 8]
mov r8, r15
mov qword [rsi], rax
mov rdx, r12
call fcn.14027d780
movabs rcx, 0x7fffffffffffffff
mov byte [rsi + r14], dil
mov r13, qword [0x1403db2b0]
mov rax, rcx
sub rax, r13
cmp rax, 5
jb 0x1400e0852
cmp qword [0x1403db2b8], 0x10
lea r15, [0x1403db2a0]
mov r12d, reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x180], rdi
cmovae r15, qword [0x1403db2a0]
lea r14, [r13 + 5]
mov qword [rbp + 0x188], rdi
xorps xmm0, xmm0
lea rsi, [rbp + 0x170]
mov ebx, r12d
movups xmmword [rbp + 0x170], xmm0
cmp r14, r12
jbe 0x1400df355
mov rbx, r14
or rbx, r12
cmp rbx, rcx
jbe 0x1400df2f6
movabs rax, 0x8000000000000000
mov rbx, rcx
add rax, 0x27
jmp 0x1400df31d
cmp rbx, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400df33c
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400e0846
mov rcx, rax
call fcn.140279b90
test rax, rax
je 0x1400e084c
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x1400df34e
test rcx, rcx
je 0x1400df34b
call fcn.140279b90
mov rsi, rax
jmp 0x1400df34e
mov rsi, rdi
mov qword [rbp + 0x170], rsi
mov eax, dword [str.HWID]
lea rcx, [rsi + 5]
mov qword [rbp + 0x180], r14
mov r8, r13
mov qword [rbp + 0x188], rbx
mov rdx, r15
mov dword [rsi], eax
movzx eax, byte [reloc.WLDAP32.dll_Ordinal_32]
mov byte [rsi + 4], al
call fcn.14027d780
mov rcx, qword [rbp + 0xb0]
lea rdx, [0x14039c5d1]
mov r8d, Ordinal_301
mov byte [rsi + r14], dil
call fcn.140065b00
movups xmm0, xmmword [str.https:__vipghax.com]
mov eax, dword [0x1402d21e0]
lea rcx, [rbp + 0x2a4]
xor edx, edx
mov dword [rbp + 0x2a0], eax
mov r8d, 0x3d4
movaps xmmword [rbp + 0x290], xmm0
call fcn.14027de20
mov ecx, dword [0x1403db420]
test ecx, ecx
je 0x1400e0021
cmp ecx, 1
jne 0x1400e03bd
xor edx, edx
lea rcx, str.Auth
call fcn.1400a0e20
test al, al
je 0x1400e0017
xor r8d, r8d
lea rcx, str.Main_Page
xor edx, edx
call fcn.1400a12c0
test al, al
je 0x1400dfc84
lea rcx, [rbp + 0x18]
mov dword [rbp + 0x18], 0x43610000
mov dword [rbp + 0x1c], 0x42700000
call fcn.140080c00
cmp qword [rbp + 0x1a8], 0x10
lea rcx, [rbp + 0x190]
cmovae rcx, qword [rbp + 0x190]
call fcn.1400ab7a0
call fcn.1400a8950
call fcn.1400a8950
lea rcx, [0x1402d2280]
call fcn.1400a1360
movaps xmm1, xmm7
xorps xmm0, xmm0
call fcn.140080470
cmp qword [0x1403db1d8], 0x10
lea rsi, [0x1403db1c0]
mov rcx, rsi
cmovae rcx, qword [0x1403db1c0]
call fcn.1400ab7a0
lea rcx, str.PID_:_Game_not_runing
call fcn.1400a1360
movaps xmm1, xmm7
xorps xmm0, xmm0
call fcn.140080470
cmp qword [0x1403db080], 0x10
lea rcx, [0x1403db068]
cmovae rcx, qword [0x1403db068]
call fcn.1400ab7a0
movaps xmm1, xmm7
xorps xmm0, xmm0
call fcn.140080470
call fcn.1400a8950
call fcn.1400a8950
mov r9d, 0xffffffff
lea r8, [0x1402d22a8]
lea rdx, [0x1403db004]
lea rcx, str._Select_Emulator
call fcn.1400a2760
call fcn.1400a8950
call fcn.1400a8950
mov r9d, 0xffffffff
lea r8, str.GLOBAL
lea rdx, [0x1403db008]
lea rcx, str._Select_Game
call fcn.1400a2760
call fcn.1400a8950
call fcn.1400a8950
lea rdx, [rbp + 0x20]
mov dword [rbp + 0x20], 0x43590000
lea rcx, str.START_EMULATOR
mov dword [rbp + 0x24], 0x41e00000
call fcn.1400a1590
test al, al
je 0x1400df559
mov byte [reloc.WS2_32.dll_accept], dil
mov byte [0x1403db000], 1
call fcn.1400c11b0
call fcn.1400a8950
call fcn.1400a8950
lea rdx, [rbp + 0x28]
mov dword [rbp + 0x28], 0x43590000
lea rcx, str.START_GAME
mov dword [rbp + 0x2c], 0x41e00000
call fcn.1400a1590
test al, al
je 0x1400df5ab
mov qword [rsp + 0x28], rdi
lea r8, [0x1400dc0b0]
xor r9d, r9d
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movaps xmm1, xmm7
xorps xmm0, xmm0
call fcn.140080470
lea rdx, [0x1403db00c]
lea rcx, str.Check_Visble_VNHAX
call fcn.1400a1dd0
call fcn.1400a8950
call fcn.1400a8950
lea rdx, [rbp + 0x30]
mov dword [rbp + 0x30], 0x43590000
lea rcx, str.SAFE_EXIT
mov dword [rbp + 0x34], 0x41e00000
call fcn.1400a1590
test al, al
je 0x1400df61b
mov qword [rsp + 0x28], rdi
lea r8, [0x1400d1330]
xor r9d, r9d
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.1400a8950
call fcn.1400a8950
lea rdx, [rbp + 0x38]
mov qword [rbp + 0x38], rdi
lea rcx, str.___Change_ID_Emulator__Reset_Guest
call fcn.1400a1590
test al, al
je 0x1400df6bb
mov qword [rsp + 0x28], rdi
lea r8, [0x1400c74f0]
xor r9d, r9d
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x1403db1d8]
cmp rax, 0x13
jb 0x1400df6a5
cmp rax, 0x10
mov qword [0x1403db1d0], 0x13
mov rbx, rsi
lea rdx, str.RESET_GUEST_SUCCESS
cmovae rbx, qword [0x1403db1c0]
mov r8d, reloc.WS2_32.dll_send
mov rcx, rbx
call fcn.14027d780
mov byte [rbx + 0x13], dil
jmp 0x1400df6bb
xor r8d, r8d
lea r9, str.RESET_GUEST_SUCCESS
mov rcx, rsi
lea edx, [r8 + 0x13]
call fcn.1400b08b0
movaps xmm1, xmm7
xorps xmm0, xmm0
call fcn.140080470
movaps xmm1, xmm7
xorps xmm0, xmm0
call fcn.140080470
lea rdx, [0x1403db47d]
lea rcx, str.Flush_DNS_200s
call fcn.1400a1dd0
test al, al
je 0x1400df7e9
cmp byte [0x1403db47d], 1
jne 0x1400df720
mov qword [rsp + 0x28], rdi
lea r8, [0x1400ce660]
xor r9d, r9d
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400df7e9
xorps xmm0, xmm0
mov qword [rsp + 0x70], rdi
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov qword [rsp + 0x78], rdi
lea rdx, str.taskkill__F__IM_RESET_10_min.bat
lea rcx, [rsp + 0x60]
movups xmmword [rsp + 0x60], xmm0
call fcn.1400aeee0
lea rcx, [rsp + 0x60]
call fcn.1400dd630
xorps xmm0, xmm0
mov qword [rsp + 0x70], rdi
mov r8d, reloc.WS2_32.dll_socket
mov qword [rsp + 0x78], rdi
lea rdx, str.taskkill__F__IM_cmd.exe
lea rcx, [rsp + 0x60]
movups xmmword [rsp + 0x60], xmm0
call fcn.1400aeee0
lea rcx, [rsp + 0x60]
call fcn.1400dd630
xorps xmm0, xmm0
mov qword [rsp + 0x70], rdi
mov r8d, reloc.WLDAP32.dll_Ordinal_27
mov qword [rsp + 0x78], rdi
lea rdx, str.taskkill__F__IM_timeout.exe
lea rcx, [rsp + 0x60]
movups xmmword [rsp + 0x60], xmm0
call fcn.1400aeee0
lea rcx, [rsp + 0x60]
call fcn.1400dd630
lea rcx, str.C:WindowsRESET_10_min.bat
call fcn.14029f4b8
lea rcx, str.RESET_10_min.bat
call fcn.1400d68c0
lea rcx, [0x1402c9090]
call fcn.1400d68c0
lea rcx, str.timeout.exe
call fcn.1400d68c0
movaps xmm1, xmm7
xorps xmm0, xmm0
call fcn.140080470
lea rdx, [0x1403db47f]
lea rcx, str.BLOCK
call fcn.1400a1dd0
test al, al
je 0x1400dfc69
cmp byte [0x1403db47f], 1
mov ecx, 0xe0c0928
jne 0x1400dfa06
call fcn.1400aee90
xorps xmm0, xmm0
mov qword [rsp + 0x70], rdi
mov r8d, Ordinal_200
mov qword [rsp + 0x78], rdi
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_blockUDP__protocolUDP_dirout_remoteport17500_18000_30000_35000_8000_8099_18018_18081_3013_1112_11443_81_8011_111_11038_8011_20001_actionblock_enableyes
mov ebx, eax
lea rcx, [rsp + 0x60]
movups xmmword [rsp + 0x60], xmm0
call fcn.1400aeee0
lea rcx, [rsp + 0x60]
call fcn.1400dd630
xorps xmm0, xmm0
mov qword [rsp + 0x70], rdi
mov r8d, Ordinal_200
mov qword [rsp + 0x78], rdi
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_blockUDP2__protocolUDP_dirin_remoteport17500_18000_30000_35000_8000_8099_18018_18081_3013_1112_11443_81_8011_111_11038_8011_20001_actionblock_enableyes
lea rcx, [rsp + 0x60]
movups xmmword [rsp + 0x60], xmm0
call fcn.1400aeee0
lea rcx, [rsp + 0x60]
call fcn.1400dd630
xorps xmm0, xmm0
mov qword [rsp + 0x70], rdi
mov r8d, Ordinal_200
mov qword [rsp + 0x78], rdi
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_blockTCP__protocolTCP_dirout_remoteport17500_18000_30000_35000_8000_8099_18018_18081_3013_1112_11443_81_8011_111_11038_8011_20001_actionblock_enableyes
lea rcx, [rsp + 0x60]
movups xmmword [rsp + 0x60], xmm0
call fcn.1400aeee0
lea rcx, [rsp + 0x60]
call fcn.1400dd630
xorps xmm0, xmm0
mov qword [rsp + 0x70], rdi
mov r8d, Ordinal_200
mov qword [rsp + 0x78], rdi
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_blockTCP2__protocolTCP_dirin_remoteport17500_18000_30000_35000_8000_8099_18018_18081_3013_1112_11443_81_8011_111_11038_8011_20001_actionblock_enableyes
lea rcx, [rsp + 0x60]
movups xmmword [rsp + 0x60], xmm0
call fcn.1400aeee0
lea rcx, [rsp + 0x60]
call fcn.1400dd630
xorps xmm0, xmm0
mov qword [rsp + 0x70], rdi
mov r8d, 0x5a
mov qword [rsp + 0x78], rdi
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_block__dirin_actionblock_remoteip5.9.19.59728
lea rcx, [rsp + 0x60]
movups xmmword [rsp + 0x60], xmm0
call fcn.1400aeee0
lea rcx, [rsp + 0x60]
call fcn.1400dd630
xorps xmm0, xmm0
mov qword [rsp + 0x70], rdi
mov r8d, 0x5c
mov qword [rsp + 0x78], rdi
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_block__dirin_actionblock_remoteip61.151.168.203
lea rcx, [rsp + 0x60]
movups xmmword [rsp + 0x60], xmm0
call fcn.1400aeee0
lea rcx, [rsp + 0x60]
call fcn.1400dd630
xorps xmm0, xmm0
mov qword [rsp + 0x70], rdi
mov r8d, 0x5b
mov qword [rsp + 0x78], rdi
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_block__dirout_actionblock_remoteip5.9.19.59728
lea rcx, [rsp + 0x60]
movups xmmword [rsp + 0x60], xmm0
call fcn.1400aeee0
lea rcx, [rsp + 0x60]
call fcn.1400dd630
xorps xmm0, xmm0
mov qword [rsp + 0x70], rdi
mov r8d, 0x5d
mov qword [rsp + 0x78], rdi
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_block__dirout_actionblock_remoteip61.151.168.203
lea rcx, [rsp + 0x60]
movups xmmword [rsp + 0x60], xmm0
call fcn.1400aeee0
lea rcx, [rsp + 0x60]
call fcn.1400dd630
xor edx, edx
mov dword [rsp + 0x20], 0x47
lea ecx, [rbx + 0x60bf0]
lea r9d, [rdx + 0x70]
lea r8d, [rdx + 0x20]
call fcn.1400b5810
mov r9d, ebx
mov dword [rbp + 0x120], 0x47702000
mov r8d, 4
lea rdx, [rbp + 0x120]
mov ecx, 0x60bf0
call fcn.1400d8190
jmp 0x1400dfc69
call fcn.1400aee90
xorps xmm0, xmm0
mov qword [rsp + 0x70], rdi
mov r8d, gethostname
mov qword [rsp + 0x78], rdi
lea rdx, str.netsh_advfirewall_firewall_delete_rule_name__blockUDP
mov ebx, eax
lea rcx, [rsp + 0x60]
movups xmmword [rsp + 0x60], xmm0
call fcn.1400aeee0
lea rcx, [rsp + 0x60]
call fcn.1400dd630
xorps xmm0, xmm0
mov qword [rsp + 0x70], rdi
mov r8d, gethostname
mov qword [rsp + 0x78], rdi
lea rdx, str.netsh_advfirewall_firewall_delete_rule_name__blockTCP
lea rcx, [rsp + 0x60]
movups xmmword [rsp + 0x60], xmm0
call fcn.1400aeee0
lea rcx, [rsp + 0x60]
call fcn.1400dd630
xorps xmm0, xmm0
mov qword [rsp + 0x70], rdi
mov r8d, gethostname
mov qword [rsp + 0x78], rdi
lea rdx, str.netsh_advfirewall_firewall_delete_rule_name__blockUDP2
lea rcx, [rsp + 0x60]
movups xmmword [rsp + 0x60], xmm0
call fcn.1400aeee0
lea rcx, [rsp + 0x60]
call fcn.1400dd630
xorps xmm0, xmm0
mov qword [rsp + 0x70], rdi
mov r8d, gethostname
mov qword [rsp + 0x78], rdi
lea rdx, str.netsh_advfirewall_firewall_delete_rule_name__blockTCP2
lea rcx, [rsp + 0x60]
movups xmmword [rsp + 0x60], xmm0
call fcn.1400aeee0
lea rcx, [rsp + 0x60]
call fcn.1400dd630
xorps xmm0, xmm0
mov qword [rsp + 0x70], rdi
mov r8d, 0x33
mov qword [rsp + 0x78], rdi
lea rdx, str.netsh_advfirewall_firewall_delete_rule_name__block
lea rcx, [rsp + 0x60]
movups xmmword [rsp + 0x60], xmm0
call fcn.1400aeee0
lea rcx, [rsp + 0x60]
call fcn.1400dd630
xorps xmm0, xmm0
mov qword [rsp + 0x70], rdi
mov r8d, gethostname
mov qword [rsp + 0x78], rdi
lea rdx, str.netsh_advfirewall_firewall_delete_rule_name__Gameloop
lea rcx, [rsp + 0x60]
movups xmmword [rsp + 0x60], xmm0
call fcn.1400aeee0
lea rcx, [rsp + 0x60]
call fcn.1400dd630
xorps xmm0, xmm0
mov qword [rsp + 0x70], rdi
mov r8d, reloc.WLDAP32.dll_Ordinal_26
mov qword [rsp + 0x78], rdi
lea rdx, str.netsh_interface_ipv4_reset
lea rcx, [rsp + 0x60]
movups xmmword [rsp + 0x60], xmm0
call fcn.1400aeee0
lea rcx, [rsp + 0x60]
call fcn.1400dd630
xorps xmm0, xmm0
mov qword [rsp + 0x70], rdi
mov r8d, reloc.WLDAP32.dll_Ordinal_26
mov qword [rsp + 0x78], rdi
lea rdx, str.netsh_interface_ipv6_reset
lea rcx, [rsp + 0x60]
movups xmmword [rsp + 0x60], xmm0
call fcn.1400aeee0
lea rcx, [rsp + 0x60]
call fcn.1400dd630
mov edx, 0xf0
mov dword [rsp + 0x20], reloc.WLDAP32.dll_Ordinal_30
lea ecx, [rbx + 0x60bf0]
mov r9d, 0x56
lea r8d, [rdx - 0x3b]
call fcn.1400b5810
mov r9d, ebx
mov dword [rbp + 0x124], 0x1e56b5f0
mov r8d, 4
lea rdx, [rbp + 0x124]
mov ecx, 0x60bf0
call fcn.1400d8190
xorps xmm0, xmm0
mov qword [rsp + 0x70], rdi
mov r8d, reloc.WS2_32.dll_socket
mov qword [rsp + 0x78], rdi
lea rdx, str.taskkill__F__IM_cmd.exe
lea rcx, [rsp + 0x60]
movups xmmword [rsp + 0x60], xmm0
call fcn.1400aeee0
lea rcx, [rsp + 0x60]
call fcn.1400dd630
xorps xmm0, xmm0
mov qword [rsp + 0x70], rdi
mov r8d, reloc.WLDAP32.dll_Ordinal_27
mov qword [rsp + 0x78], rdi
lea rdx, str.taskkill__F__IM_timeout.exe
lea rcx, [rsp + 0x60]
movups xmmword [rsp + 0x60], xmm0
call fcn.1400aeee0
lea rcx, [rsp + 0x60]
call fcn.1400dd630
lea rcx, [0x1402c9090]
call fcn.1400d68c0
lea rcx, str.timeout.exe
call fcn.1400d68c0
call fcn.1400a8950
call fcn.1400a8950
call fcn.1400a8950
call fcn.1400a8950
call fcn.1400a36c0
jmp 0x1400dfc8b
lea rsi, [0x1403db1c0]
xor r8d, r8d
lea rcx, str.Memory
xor edx, edx
call fcn.1400a12c0
test al, al
je 0x1400dff3c
lea rcx, str.Status_:
call fcn.1400a1360
movaps xmm1, xmm7
xorps xmm0, xmm0
call fcn.140080470
cmp qword [0x1403db1d8], 0x10
mov rcx, rsi
cmovae rcx, qword [0x1403db1c0]
call fcn.1400ab7a0
call fcn.1400a8950
call fcn.1400a8950
xor edx, edx
lea rcx, str.Function
call fcn.1400a26f0
test al, al
je 0x1400dff37
call fcn.1400a8950
call fcn.1400a8950
call fcn.1400a8950
call fcn.1400a8950
call fcn.1400a8950
call fcn.1400a8950
lea rcx, [rbp + 0xc0]
call fcn.1400754b0
call fcn.140076240
xor r8d, r8d
mov dword [rbp + 0x40], 0x42080000
lea rdx, [rbp + 0x40]
mov dword [rbp + 0x44], 0x41880000
lea rcx, str.1
mov rbx, rax
call fcn.1400a6380
test al, al
je 0x1400dfd58
cmp byte [0x1403db47e], dil
sete byte [0x1403db47e]
xor ecx, ecx
call fcn.1400772f0
test al, al
je 0x1400dfd6b
mov r9d, 0xe14d4dc1
jmp 0x1400dfd81
cmp byte [0x1403db47e], dil
mov r9d, 0x4dffffff
mov eax, 0x4dffff00
cmovne r9d, eax
movss xmm0, dword [rbp + 0xc0]
lea r8, [rbp + 0x48]
movss xmm1, dword [rbp + 0xc4]
addss xmm0, xmm12
addss xmm1, xmm14
mov dword [rsp + 0x28], r12d
lea rdx, [rbp + 0xc0]
movss dword [rsp + 0x20], xmm8
mov rcx, rbx
movss dword [rbp + 0x48], xmm0
movss dword [rbp + 0x4c], xmm1
call fcn.1400895e0
cmp byte [0x1403db47e], dil
movss xmm1, dword [rbp + 0xc4]
movss xmm0, dword [rbp + 0xc0]
addss xmm1, xmm8
je 0x1400dfdee
addss xmm0, xmm12
subss xmm0, xmm8
jmp 0x1400dfdf3
addss xmm0, xmm8
mov r9d, 0xffffffff
movss dword [rbp + 0x50], xmm0
movaps xmm2, xmm13
movss dword [rbp + 0x54], xmm1
lea rdx, [rbp + 0x50]
mov dword [rsp + 0x20], edi
mov rcx, rbx
call fcn.140086c00
movaps xmm1, xmm7
xorps xmm0, xmm0
call fcn.140080470
lea rcx, str.Field_Of_View
call fcn.1400ab7a0
cmp byte [0x1403db47e], 1
jne 0x1400dfe40
mov byte [0x1403db00e], 1
jmp 0x1400dfe4d
cmp byte [0x1403db00e], 1
jne 0x1400dff37
lea rcx, [rbp + 0x58]
mov dword [rbp + 0x58], edi
mov dword [rbp + 0x5c], 0x3f800000
call fcn.1400a3030
cmp byte [0x1403db47e], 1
jne 0x1400dff37
mov rcx, qword [0x1403db018]
lea r8, [rbp + 0x214]
mov r9d, 4
mov qword [rsp + 0x20], rdi
mov edx, 0xe0c36e8
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea rcx, str.FOV_:
call fcn.1400a1360
movss xmm2, dword [0x1402d3d10]
lea rax, str._.3f
mov dword [rsp + 0x28], edi
lea rdx, [0x14039c5d4]
movaps xmm3, xmm15
mov qword [rsp + 0x20], rax
lea rcx, str.6
call fcn.1400a8420
movss xmm0, dword [0x14039c5d4]
movss dword [rbp + 0x148], xmm0
call fcn.1400e1490
mov ecx, 0xe0c36e8
call fcn.1400aee90
mov rcx, qword [0x1403db018]
mov r9d, 0x40
lea ebx, [rax + 0x3fdbeb4]
lea rax, [rbp + 0x210]
mov edx, ebx
lea r8d, [r9 - 0x3c]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rcx, qword [0x1403db018]
lea r8, [rbp + 0x148]
mov r9d, 4
mov qword [rsp + 0x20], rdi
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call fcn.1400a36c0
xor r8d, r8d
lea rcx, str.Info
xor edx, edx
call fcn.1400a12c0
test al, al
je 0x1400e0017
call fcn.1400a8950
call fcn.1400a8950
cmp qword [rbp + 0x168], 0x10
lea rcx, [rbp + 0x150]
cmovae rcx, qword [rbp + 0x150]
call fcn.1400a1360
call fcn.1400a8950
call fcn.1400a8950
cmp qword [rbp + 0x140], 0x10
lea rcx, [rbp + 0x128]
cmovae rcx, qword [rbp + 0x128]
call fcn.1400a1360
call fcn.1400a8950
call fcn.1400a8950
cmp qword [rbp + 0x188], 0x10
lea rcx, [rbp + 0x170]
cmovae rcx, qword [rbp + 0x170]
call fcn.1400a1360
call fcn.1400a8950
call fcn.1400a8950
call fcn.1400758c0
movss xmm6, dword [rax + 0x394]
cvtps2pd xmm6, xmm6
call fcn.1400758c0
lea rcx, str.FPS:__.3f_ms_frame___.1f_FPS_
movss xmm0, dword [0x1402c2d88]
movaps xmm2, xmm6
divss xmm0, dword [rax + 0x394]
movq r8, xmm6
cvtps2pd xmm1, xmm0
movq rdx, xmm1
call fcn.1400a1360
call fcn.1400a36c0
call fcn.1400a36c0
jmp 0x1400e03bd
movaps xmm1, xmm7
xorps xmm0, xmm0
call fcn.140080470
lea rcx, [rbp + 0x60]
mov dword [rbp + 0x60], 0x436b0000
mov dword [rbp + 0x64], 0x42200000
call fcn.140080c00
cmp qword [rbp + 0x1a8], 0x10
lea rcx, [rbp + 0x190]
cmovae rcx, qword [rbp + 0x190]
call fcn.1400ab7a0
lea rcx, [rbp + 0x68]
mov dword [rbp + 0x68], 0x42a00000
mov dword [rbp + 0x6c], 0x42c80000
call fcn.140080c00
lea rcx, str.Key_:
call fcn.1400ab7a0
movaps xmm1, xmm7
xorps xmm0, xmm0
call fcn.140080470
mov qword [rsp + 0x30], rdi
lea rbx, [0x14039c5b0]
mov r8, rbx
mov qword [rsp + 0x28], rdi
mov r9d, reloc.WLDAP32.dll_Ordinal_33
mov dword [rsp + 0x20], edi
lea rdx, [0x1402d21ec]
lea rcx, [0x1402d21f0]
call fcn.1400a6330
call fcn.1400a8950
call fcn.1400a8950
lea rcx, [rbp + 0x70]
mov dword [rbp + 0x70], 0x42f00000
mov dword [rbp + 0x74], 0x42fa0000
call fcn.140080c00
lea rdx, [rbp + 0x78]
mov dword [rbp + 0x78], 0x43480000
lea rcx, str.Login
mov dword [rbp + 0x7c], 0x41e00000
call fcn.1400a1590
test al, al
je 0x1400e0147
xorps xmm0, xmm0
mov qword [rsp + 0x70], rdi
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x78], rdi
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rbx + r8], dil
jne 0x1400e0120
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.1400aeee0
lea rdx, [rsp + 0x60]
lea rcx, [0x1403db1e0]
call fcn.1400d69b0
movaps xmm1, xmm7
xorps xmm0, xmm0
call fcn.140080470
lea rdx, [rbp + 0x80]
mov dword [rbp + 0x80], 0x43480000
lea rcx, str.Buy_Key_On_Website
mov dword [rbp + 0x84], 0x41e00000
call fcn.1400a1590
test al, al
je 0x1400e019e
mov dword [rsp + 0x28], 1
lea r8, [rbp + 0x290]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
call fcn.1400a8950
mov r8d, 0xa
lea rdx, [0x14039c5d1]
lea rcx, [0x1402c2e68]
call fcn.140069540
test al, al
je 0x1400e021e
lea rcx, str.Login_Done__Key_ok
call fcn.1400ab7a0
lea rcx, [rbp + 0x88]
mov dword [rbp + 0x88], edi
mov dword [rbp + 0x8c], 0x3f800000
call fcn.1400a3030
lea rdx, [rbp + 0x90]
mov qword [rbp + 0x90], 0x42f00000
lea rcx, [0x1402c2e68]
call fcn.1400a1590
test al, al
je 0x1400e0219
mov dword [0x1403db420], 1
call fcn.14006abb0
call fcn.140073ec0
xor r8d, r8d
lea rcx, str.Fall
xor edx, edx
call fcn.140069540
test al, al
je 0x1400e0290
lea rcx, str.Key_Error_Please_Concact_Admin
call fcn.1400ab7a0
lea rcx, [rbp + 0x98]
mov dword [rbp + 0x98], edi
mov dword [rbp + 0x9c], 0x3f800000
call fcn.1400a3030
lea rdx, [rbp + 0xa0]
mov qword [rbp + 0xa0], 0x42f00000
lea rcx, [0x1402c2e68]
call fcn.1400a1590
test al, al
je 0x1400e028b
mov dword [0x1403db420], edi
call fcn.14006abb0
inc dword [rbp - 0x38]
call fcn.140073ec0
cmp dword [rbp - 0x38], 5
jle 0x1400e02a2
lea rcx, [0x1403db1e0]
call fcn.1400c3e40
lea rcx, [rbp + 0xa8]
mov dword [rbp + 0xa8], 0x43898000
mov dword [rbp + 0xac], 0x43250000
call fcn.140080c00
lea rdx, [0x14039c5d9]
lea rcx, str.Save_Key
call fcn.1400a1dd0
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rbx + r8], dil
jne 0x1400e02e0
cmp byte [reloc.WS2_32.dll_accept], dil
lea rcx, [rsp + 0x60]
xorps xmm0, xmm0
mov qword [rsp + 0x70], rdi
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x78], rdi
mov rdx, rbx
je 0x1400e0326
call fcn.1400aeee0
lea rdx, [rbp + 0x1d0]
lea rcx, [rbp - 0x58]
call fcn.1400b6030
mov r8b, 1
jmp 0x1400e033e
call fcn.1400aeee0
lea rdx, [rbp + 0x1d0]
lea rcx, [rbp - 0x58]
call fcn.1400b6030
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.1400c1cf0
call fcn.1400a8950
lea rcx, [rbp - 0x34]
mov dword [rbp - 0x34], 0x43570000
mov dword [rbp - 0x30], 0x43430000
call fcn.140080c00
call fcn.1400a8950
call fcn.1400a8950
cmp qword [rbp + 0x168], 0x10
lea rcx, [rbp + 0x150]
cmovae rcx, qword [rbp + 0x150]
call fcn.1400a1360
call fcn.1400a8950
call fcn.1400a8950
call fcn.1400a8950
cmp qword [rbp + 0x140], 0x10
lea rcx, [rbp + 0x128]
cmovae rcx, qword [rbp + 0x128]
call fcn.1400a1360
call fcn.1400a8950
mov rdx, qword [rbp + 0x188]
cmp rdx, 0x10
jb 0x1400e03fe
mov rcx, qword [rbp + 0x170]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400e03f9
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400e084c
call fcn.140279bcc
mov rdx, qword [rbp + 0x140]
mov r13, r12
mov qword [rbp + 0x180], rdi
mov qword [rbp + 0x188], r12
mov byte [rbp + 0x170], dil
cmp rdx, 0x10
jb 0x1400e0457
mov rcx, qword [rbp + 0x128]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400e0452
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400e084c
call fcn.140279bcc
mov rdx, qword [rbp + 0x168]
mov qword [rbp + 0x138], rdi
mov qword [rbp + 0x140], r12
mov byte [rbp + 0x128], dil
cmp rdx, 0x10
jb 0x1400e04ad
mov rcx, qword [rbp + 0x150]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400e04a8
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400e084c
call fcn.140279bcc
mov rdx, qword [rbp + 0x230]
mov qword [rbp + 0x160], rdi
mov qword [rbp + 0x168], r12
mov byte [rbp + 0x150], dil
cmp rdx, 0x10
jb 0x1400e0503
mov rcx, qword [rbp + 0x218]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400e04fe
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400e084c
call fcn.140279bcc
mov rax, qword [rbp + 0x1c8]
cmp rax, 0x10
jb 0x1400e0545
mov rcx, qword [rbp + 0xb8]
lea rdx, [rax + 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400e0540
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400e084c
call fcn.140279bcc
mov rdx, qword [rbp + 0x1a8]
cmp rdx, 0x10
jb 0x1400e0586
mov rcx, qword [rbp + 0x190]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400e0581
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400e084c
call fcn.140279bcc
mov rsi, qword [rbp - 0x28]
lea r14, [0x1403dafb0]
call fcn.140072c20
call fcn.1400731e0
mov rcx, qword [0x1403dafa8]
mov r9d, 3
mov dword [rsp + 0x30], edi
xor r8d, r8d
movss dword [rsp + 0x28], xmm9
xor edx, edx
mov dword [rsp + 0x20], edi
mov rax, qword [rcx]
call qword [rax + 0x158]
mov rcx, qword [0x1403dafa8]
mov rax, qword [rcx]
call qword [rax + 0x148]
test eax, eax
js 0x1400e05fb
call fcn.14007d630
call fcn.1400754d0
mov rcx, rax
call fcn.1400983b0
mov rcx, qword [0x1403dafa8]
mov rax, qword [rcx]
call qword [rax + 0x150]
test dword [rsi], 0x400
je 0x1400e0611
call fcn.140083350
xor edx, edx
xor ecx, ecx
call fcn.14007e260
mov rcx, qword [0x1403dafa8]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x88]
cmp eax, 0x88760868
jne 0x1400e0666
mov rcx, qword [0x1403dafa8]
mov rax, qword [rcx]
call qword [rax + Ordinal_26]
cmp eax, 0x88760869
jne 0x1400e0666
call fcn.1400980a0
mov rcx, qword [0x1403dafa8]
mov rdx, r14
mov rax, qword [rcx]
call qword [rax + 0x80]
call fcn.140097d10
cmp byte [reloc.WS2_32.dll_accept], dil
je 0x1400e067e
cmp dword [rbp + 0x250], 0x12
jne 0x1400dea10
jmp 0x1400e0688
mov dword [rbp + 0x250], reloc.WS2_32.dll_select
call fcn.140098f00
call fcn.140099ea0
xor ecx, ecx
call fcn.14006b3d0
call fcn.1400bc280
mov rcx, qword [0x1403dafa0]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rdx, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0x110]
call qword [sym.imp.USER32.dll_UnregisterClassA]
mov r13, qword [rbp + 0x1e8]
jmp 0x1400e06e6
call fcn.1400bc280
mov rdx, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0x110]
call qword [sym.imp.USER32.dll_UnregisterClassA]
mov edi, 1
mov rdx, qword [rbp + 0x208]
cmp rdx, 0x10
jb 0x1400e0727
mov rcx, qword [rbp + 0x1f0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400e0722
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400e0816
call fcn.140279bcc
movdqa xmm0, xmmword [0x1402d3d30]
mov byte [rbp + 0x1f0], 0
movdqu xmmword [rbp + 0x200], xmm0
cmp r13, 0x10
jb 0x1400e0779
mov rcx, qword [rbp + 0x1d0]
lea rdx, [r13 + 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400e0774
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400e0816
call fcn.140279bcc
movaps xmm14, xmmword [rsp + 0x7a0]
mov eax, edi
movaps xmm13, xmmword [rsp + 0x7b0]
movaps xmm12, xmmword [rsp + 0x7c0]
movaps xmm11, xmmword [rsp + 0x7d0]
movaps xmm10, xmmword [rsp + 0x7e0]
movaps xmm9, xmmword [rsp + 0x7f0]
movaps xmm8, xmmword [rsp + 0x800]
movaps xmm7, xmmword [rsp + 0x810]
movaps xmm6, xmmword [rsp + 0x820]
mov r15, qword [rsp + 0x830]
mov r14, qword [rsp + 0x838]
mov r12, qword [rsp + 0x870]
mov rsi, qword [rsp + 0x868]
mov rbx, qword [rsp + 0x860]
movaps xmm15, xmmword [rsp + 0x790]
mov rcx, qword [rbp + 0x680]
xor rcx, rsp
call fcn.140279b70
add rsp, 0x840
pop r13
pop rdi
pop rbp
ret
call fcn.14029cb2c
int3
call fcn.1400c37e0
int3
call fcn.14029cb2c
int3
call fcn.14029cb2c
int3
call fcn.1400c36b0
int3
call fcn.14029cb2c
int3
call fcn.1400c36b0
int3
call fcn.14029cb2c
int3
call fcn.1400c36b0
int3
call fcn.14029cb2c
int3
call fcn.1400c37e0
int3
call fcn.1400c37e0
int3
call fcn.1400c37e0
int3