Function at 0x14000d5d0
Capabilities:
Create http request
Create thread
Execute command
Get disk information
Read data from internet
Receive data
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x920
mov rax, qword [0x140077010]
xor rax, rsp
mov qword [rsp + 0x910], rax
mov rbx, rcx
movdqa xmm0, xmmword [0x14006bd30]
movdqu xmmword [rsp + 0x230], xmm0
mov byte [rsp + 0x240], 1
lea rcx, [rsp + 0x230]
call fcn.140009670
xor r15d, r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x230]
call qword [sym.imp.WININET.dll_InternetOpenA]
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov rbx, rax
mov dword [rsp + 0x894], 0xf
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r9, [rsp + 0x894]
lea r8d, [r15 + 0xf]
lea rdx, [rsp + 0x8b8]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
mov eax, dword [rsp + 0x894]
cmp rax, 0x10
jae 0x14000ecb0
mov byte [rsp + rax + 0x8b8], r15b
call fcn.14000c230
mov dword [rsp + 0x100], 0xbdb2b5a5
mov dword [rsp + 0x104], 0x8f80b1be
mov dword [rsp + 0x108], 0xc1c38d9d
mov word [rsp + 0x10c], 0xc1
mov byte [rsp + 0x10e], 1
lea rcx, [rsp + 0x100]
call fcn.14000f260
lea rax, [rsp + 0x100]
lea r9, [rsp + 0x8b8]
sub r9, rax
nop word [rax + rax]
movzx r8d, byte [rax]
movzx edx, byte [rax + r9]
sub r8d, edx
jne 0x14000d725
inc rax
test edx, edx
jne 0x14000d710
test r8d, r8d
jne 0x14000eb22
lea ecx, [r8 + 0xf]
call fcn.14000c1c0
movdqa xmm0, xmmword [0x14006cb60]
movdqu xmmword [rsp + 0x178], xmm0
mov dword [rsp + 0x188], 0x879cc0
mov byte [rsp + 0x18c], 1
lea rcx, [rsp + 0x178]
call fcn.140009c40
lea rcx, [rsp + 0x178]
call fcn.14000b480
lea rdx, [0x14008d950]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.14000fdd0
call fcn.14000c230
call fcn.14000bc50
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movdqa xmm0, xmmword [0x14006cc40]
movdqu xmmword [rsp + 0x160], xmm0
mov dword [rsp + 0x170], 0x879cc1
mov byte [rsp + 0x174], 1
lea rcx, [rsp + 0x160]
call fcn.140009c40
lea rdx, [rsp + 0x160]
mov rcx, rbx
call fcn.14000f670
mov esi, r15d
lea r14, [0x14008f060]
call qword [sym.imp.api_ms_win_crt_conio_l1_1_0.dll__getch]
mov edi, eax
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x14000d804
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x14000d804
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x14000d837
movsxd rax, esi
mov byte [rax + r14], dil
inc esi
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov word [rsp + 0x40], 0xb0
mov byte [rsp + 0x42], 1
lea rcx, [rsp + 0x40]
call fcn.14000f1c0
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.14000f670
cmp dil, 8
jne 0x14000d859
cmp esi, 1
jl 0x14000d7e4
lea rdx, [0x140069a84]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000f670
dec esi
jmp 0x14000d7e4
cmp dil, 0xd
jne 0x14000d7e4
movsxd rax, esi
cmp rax, 0x20
jae 0x14000ecb0
mov byte [rax + r14], r15b
mov word [rsp + 0x44], 0x90
mov byte [rsp + 0x46], 1
lea rcx, [rsp + 0x44]
call fcn.14000f1c0
lea rcx, [rsp + 0x44]
call fcn.14000b480
cmp esi, 1
jg 0x14000d967
mov ecx, reloc.WS2_32.dll_inet_ntoa
call fcn.14000c1c0
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movdqa xmm0, xmmword [0x14006ccb0]
movdqu xmmword [rsp + 0x138], xmm0
mov dword [rsp + 0x148], 0xdfd4d5c4
mov dword [rsp + 0x14c], 0x8ccfd8c6
mov dword [rsp + 0x150], 0xdcc3dbe3
mov word [rsp + 0x154], 0x100
lea rcx, [rsp + 0x138]
call fcn.140009760
lea rdx, [rsp + 0x138]
mov rcx, rbx
call fcn.14000f670
lea rdx, [0x14000f840]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x70], 0xebe2f7e5
mov word [rsp + 0x74], 0xfc
mov byte [rsp + 0x76], 1
lea rcx, [rsp + 0x70]
call fcn.140009b50
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor eax, eax
mov rcx, qword [rsp + 0x910]
xor rcx, rsp
call fcn.14005e640
lea r11, [rsp + 0x920]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
call fcn.14000c230
call fcn.14000bc50
mov dword [rsp + 0x880], r15d
mov dword [rsp + 0x68], 0xb7b8acd6
mov word [rsp + 0x6c], 0x100
lea rcx, [rsp + 0x68]
call fcn.140009b20
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x880]
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x14000da4b
lea rcx, [0x14008dcf0]
call fcn.140009fa0
mov rbx, rax
movdqa xmm0, xmmword [0x14006c870]
movdqa xmmword [rsp + 0x6e0], xmm0
movdqa xmm1, xmmword [0x14006bef0]
movdqa xmmword [rsp + 0x6f0], xmm1
movdqa xmm0, xmmword [0x14006cab0]
movdqa xmmword [rsp + 0x700], xmm0
movdqa xmm1, xmmword [0x14006bd00]
movdqa xmmword [rsp + 0x710], xmm1
mov byte [rsp + 0x720], 1
lea rcx, [rsp + 0x6e0]
call fcn.14000ecc0
mov r9d, 0x40010
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rcx, [0x14008dbd0]
call fcn.140009fa0
mov rdx, rax
lea rcx, [rsp + 0x7a0]
call fcn.14000bd30
lea rcx, [0x14008da10]
cmp rcx, rax
je 0x14000da7e
xor r8d, r8d
mov rdx, rax
call fcn.140009fb0
lea rcx, [rsp + 0x7a0]
call fcn.140003890
mov edx, dword [rsp + 0x880]
lea rcx, [rsp + 0x6b8]
call fcn.14000f5d0
nop
lea rcx, [rsp + 0x6b8]
call fcn.140009fa0
mov rdx, rax
lea rcx, [rsp + 0x7c0]
call fcn.14000bd30
lea rdi, [0x14008dd10]
cmp rdi, rax
je 0x14000dad7
xor r8d, r8d
mov rdx, rax
mov rcx, rdi
call fcn.140009fb0
lea rcx, [rsp + 0x7c0]
call fcn.140003890
nop
lea rcx, [rsp + 0x6b8]
call fcn.140003890
movzx edx, byte [rsp + 0x110]
lea rcx, [rsp + 0x898]
call fcn.140004130
lea rcx, [rsp + 0x898]
call fcn.140003b30
nop
movdqa xmm0, xmmword [0x14006caf0]
movdqu xmmword [rsp + 0x1c0], xmm0
movdqa xmm1, xmmword [0x14006cbb0]
movdqu xmmword [rsp + 0x1d0], xmm1
mov dword [rsp + 0x1e0], 0xc8dfc69b
mov dword [rsp + 0x1e4], 0x86cf86
mov byte [rsp + 0x1e8], 1
lea rcx, [rsp + 0x1c0]
call fcn.140009940
lea rax, [rsp + 0x1c0]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x14000db74
lea rdx, [rsp + 0x1c0]
lea rcx, [0x14008dc70]
call fcn.14000f450
lea rcx, [0x14008d950]
call fcn.140009fa0
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x14000dba1
mov rdx, rax
lea rcx, [0x14008dc70]
call fcn.14000f450
mov dword [rsp + 0x50], 0xaae6b3
mov byte [rsp + 0x54], 1
lea rcx, [rsp + 0x50]
call fcn.140009b80
lea rax, [rsp + 0x50]
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14000dbe0
lea rdx, [rsp + 0x50]
lea rcx, [0x14008dc70]
call fcn.14000f450
mov r8, rbx
nop
inc r8
cmp byte [r14 + r8], 0
jne 0x14000dc00
mov rdx, r14
lea rcx, [0x14008dc70]
call fcn.14000f450
mov dword [rsp + 0x48], 0xaafeb3
mov byte [rsp + 0x4c], 1
lea rcx, [rsp + 0x48]
call fcn.140009b80
lea rax, [rsp + 0x48]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14000dc40
lea rdx, [rsp + 0x48]
lea rcx, [0x14008dc70]
call fcn.14000f450
mov rcx, rdi
call fcn.140009fa0
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x14000dc66
mov rdx, rax
lea rcx, [0x14008dc70]
call fcn.14000f450
mov dword [rsp + 0x58], 0xaaf1b3
mov byte [rsp + 0x5c], 1
lea rcx, [rsp + 0x58]
call fcn.140009b80
lea rax, [rsp + 0x58]
mov r8, rbx
nop
inc r8
cmp byte [rax + r8], 0
jne 0x14000dca0
lea rdx, [rsp + 0x58]
lea rcx, [0x14008dc70]
call fcn.14000f450
mov dword [rsp + 0x60], 0xf7f0e5f6
mov word [rsp + 0x64], 0x100
lea rcx, [rsp + 0x60]
call fcn.140009b20
lea rax, [rsp + 0x60]
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14000dce0
mov r8, rbx
lea rdx, [rsp + 0x60]
lea rcx, [0x14008dc70]
call fcn.14000f450
mov dword [rsp + 0x890], 0x20
movdqa xmm0, xmmword [0x14006bd30]
movdqu xmmword [rsp + 0x248], xmm0
mov byte [rsp + 0x258], 1
lea rcx, [rsp + 0x248]
call fcn.140009670
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x248]
call qword [sym.imp.WININET.dll_InternetOpenA]
mov rbx, rax
lea rcx, [0x14008dc70]
call fcn.140009fa0
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov rbx, rax
mov ecx, 0x19
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r9, [rsp + 0x890]
mov r8d, 0x40
lea rdx, [rsp + 0x8d0]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
mov ecx, 0x19
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0x890]
cmp rax, 0x40
jae 0x14000ecb6
mov byte [rsp + rax + 0x8d0], 0
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14000c230
mov dword [rsp + 0x90], 0xc7c2b8be
mov dword [rsp + 0x94], 0x85bbb8
mov byte [rsp + 0x98], 1
lea rcx, [rsp + 0x90]
call fcn.14000f190
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x8d0]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x14000dedb
lea rcx, [0x14008dcf0]
call fcn.140009fa0
mov rbx, rax
movdqa xmm0, xmmword [0x14006c9d0]
movdqa xmmword [rsp + 0x300], xmm0
movdqa xmm1, xmmword [0x14006cca0]
movdqa xmmword [rsp + 0x310], xmm1
movdqa xmm0, xmmword [0x14006bf80]
movdqa xmmword [rsp + 0x320], xmm0
movdqa xmm1, xmmword [0x14006bff0]
movdqa xmmword [rsp + 0x330], xmm1
movdqa xmm0, xmmword [0x14006c9e0]
movdqa xmmword [rsp + 0x340], xmm0
mov dword [rsp + 0x350], 0x9e99cb9e
mov dword [rsp + 0x354], 0x909e9d8b
mov dword [rsp + 0x358], 0xd5da969f
mov word [rsp + 0x35c], 0x100
lea rcx, [rsp + 0x300]
call fcn.14000ecf0
mov r9d, 0x10
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov dword [rsp + 0x88], 0xc3bfbfc4
mov dword [rsp + 0x8c], 0x100bcbb
lea rcx, [rsp + 0x88]
call fcn.14000f160
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x8d0]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x14000dfc9
lea rcx, [0x14008dcf0]
call fcn.140009fa0
mov rbx, rax
movdqa xmm0, xmmword [0x14006c9d0]
movdqa xmmword [rsp + 0x440], xmm0
movdqa xmm1, xmmword [0x14006cca0]
movdqa xmmword [rsp + 0x450], xmm1
movdqa xmm0, xmmword [0x14006bd50]
movdqa xmmword [rsp + 0x460], xmm0
movdqa xmm1, xmmword [0x14006cc30]
movdqa xmmword [rsp + 0x470], xmm1
movdqa xmm0, xmmword [0x14006c9b0]
movdqa xmmword [rsp + 0x480], xmm0
mov dword [rsp + 0x490], 0x829b9899
mov dword [rsp + 0x494], 0xde8b9c
mov byte [rsp + 0x498], 1
lea rcx, [rsp + 0x440]
call fcn.14000ed20
mov r9d, 0x10
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov dword [rsp + 0x78], 0xbdd7b5cb
mov word [rsp + 0x7c], 0xc7
mov byte [rsp + 0x7e], 1
lea rcx, [rsp + 0x78]
call fcn.140009b50
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x8d0]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x14000e112
lea rcx, [0x14008dcf0]
call fcn.140009fa0
mov rbx, rax
movdqa xmm0, xmmword [0x14006c9d0]
movdqa xmmword [rsp + 0x4a0], xmm0
movdqa xmm1, xmmword [0x14006cca0]
movdqa xmmword [rsp + 0x4b0], xmm1
movdqa xmm0, xmmword [0x14006bf60]
movdqa xmmword [rsp + 0x4c0], xmm0
movdqa xmm1, xmmword [str._tx__t_f_5]
movdqa xmmword [rsp + 0x4d0], xmm1
movdqa xmm0, xmmword [0x14006c7f0]
movdqa xmmword [rsp + 0x4e0], xmm0
movdqa xmm1, xmmword [0x14006c9c0]
movdqa xmmword [rsp + 0x4f0], xmm1
movdqa xmm0, xmmword [0x14006c020]
movdqa xmmword [rsp + 0x500], xmm0
movdqa xmm1, xmmword [0x14006c910]
movdqa xmmword [rsp + 0x510], xmm1
movdqa xmm0, xmmword [0x14006bda0]
movdqa xmmword [rsp + 0x520], xmm0
movdqa xmm1, xmmword [0x14006c730]
movdqa xmmword [rsp + 0x530], xmm1
mov dword [rsp + 0x540], 0x485b0415
mov dword [rsp + 0x544], 0x7c2f4d4e
mov dword [rsp + 0x548], 0x322c2630
mov dword [rsp + 0x54c], 0x100232f
lea rcx, [rsp + 0x4a0]
call fcn.14000ed50
mov r9d, 0x10
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov dword [rsp + 0x80], 0xbdc9b5b1
mov word [rsp + 0x84], 0xbd
mov byte [rsp + 0x86], 1
lea rcx, [rsp + 0x80]
call fcn.140009b50
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x8d0]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x14000e26a
lea rcx, [0x14008dcf0]
call fcn.140009fa0
mov rbx, rax
movdqa xmm0, xmmword [0x14006c9d0]
movdqa xmmword [rsp + 0x550], xmm0
movdqa xmm1, xmmword [0x14006cca0]
movdqa xmmword [rsp + 0x560], xmm1
movdqa xmm0, xmmword [0x14006bf60]
movdqa xmmword [rsp + 0x570], xmm0
movdqa xmm1, xmmword [str._tx__t_f_5]
movdqa xmmword [rsp + 0x580], xmm1
movdqa xmm0, xmmword [0x14006c7f0]
movdqa xmmword [rsp + 0x590], xmm0
movdqa xmm1, xmmword [0x14006c9c0]
movdqa xmmword [rsp + 0x5a0], xmm1
movdqa xmm0, xmmword [0x14006c020]
movdqa xmmword [rsp + 0x5b0], xmm0
movdqa xmm1, xmmword [0x14006c910]
movdqa xmmword [rsp + 0x5c0], xmm1
movdqa xmm0, xmmword [0x14006bda0]
movdqa xmmword [rsp + 0x5d0], xmm0
movdqa xmm1, xmmword [0x14006c730]
movdqa xmmword [rsp + 0x5e0], xmm1
mov dword [rsp + 0x5f0], 0x485b0415
mov dword [rsp + 0x5f4], 0x7c2f4d4e
mov dword [rsp + 0x5f8], 0x322c2630
mov dword [rsp + 0x5fc], 0x100232f
lea rcx, [rsp + 0x550]
call fcn.14000ed50
mov r9d, 0x10
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov dword [rsp + 0xa0], 0xb8bfbfbc
mov dword [rsp + 0xa4], 0x85bcc0
mov byte [rsp + 0xa8], 1
lea rcx, [rsp + 0xa0]
call fcn.14000f190
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x8d0]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x14000e381
lea rcx, [0x14008dcf0]
call fcn.140009fa0
mov rbx, rax
movdqa xmm0, xmmword [0x14006c9d0]
movdqa xmmword [rsp + 0x600], xmm0
movdqa xmm1, xmmword [0x14006cca0]
movdqa xmmword [rsp + 0x610], xmm1
movdqa xmm0, xmmword [0x14006bf80]
movdqa xmmword [rsp + 0x620], xmm0
movdqa xmm1, xmmword [0x14006bf10]
movdqa xmmword [rsp + 0x630], xmm1
movdqa xmm0, xmmword [0x14006cb70]
movdqa xmmword [rsp + 0x640], xmm0
movdqa xmm1, xmmword [0x14006cc80]
movdqa xmmword [rsp + 0x650], xmm1
movdqa xmm0, xmmword [0x14006c920]
movdqa xmmword [rsp + 0x660], xmm0
mov dword [rsp + 0x670], 0x697e647d
mov word [rsp + 0x674], 0x20
mov byte [rsp + 0x676], 1
lea rcx, [rsp + 0x600]
call fcn.14000ed80
mov r9d, 0x10
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov dword [rsp + 0xb0], 0xbbb3b3b0
mov dword [rsp + 0xb4], 0xbfc5b9bc
mov word [rsp + 0xb8], 0x100
lea rcx, [rsp + 0xb0]
call fcn.1400096a0
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x8d0]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x14000e474
lea rcx, [0x14008dcf0]
call fcn.140009fa0
mov rbx, rax
movdqa xmm0, xmmword [0x14006c9d0]
movdqa xmmword [rsp + 0x730], xmm0
movdqa xmm1, xmmword [0x14006cca0]
movdqa xmmword [rsp + 0x740], xmm1
movdqa xmm0, xmmword [0x14006bf00]
movdqa xmmword [rsp + 0x750], xmm0
movdqa xmm1, xmmword [0x14006bfe0]
movdqa xmmword [rsp + 0x760], xmm1
movdqa xmm0, xmmword [0x14006c9a0]
movdqa xmmword [rsp + 0x770], xmm0
movdqa xmm1, xmmword [0x14006bd20]
movdqa xmmword [rsp + 0x780], xmm1
mov byte [rsp + 0x790], 1
lea rcx, [rsp + 0x730]
call fcn.14000edb0
mov r9d, 0x10
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov dword [rsp + 0xd0], 0xb9b9c5b9
mov dword [rsp + 0xd4], 0x8483babd
mov dword [rsp + 0xd8], 0x10085fc
lea rcx, [rsp + 0xd0]
call fcn.14000f130
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x8d0]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x14000e994
call fcn.14000c230
call fcn.14000c950
test al, al
jne 0x14000e4d8
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.14000bc50
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8, [0x14000c650]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x14008f090], rax
mov ecx, 2
call fcn.14000c1c0
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movdqa xmm0, xmmword [0x14006cb00]
movdqu xmmword [rsp + 0x118], xmm0
mov dword [rsp + 0x128], 0xdcf48bd7
mov dword [rsp + 0x12c], 0xc9c0c3db
mov dword [rsp + 0x130], 0x9e819c8d
mov word [rsp + 0x134], 0x100
lea rcx, [rsp + 0x118]
call fcn.140009760
lea rdx, [rsp + 0x118]
mov rcx, rbx
call fcn.14000f670
lea rdx, [0x14000f840]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
cmp dword [0x14008e340], 0
jne 0x14000e5cd
nop word [rax + rax]
lea rdx, str.cs2.exe
lea rcx, [rsp + 0x7e0]
call fcn.1400038f0
mov rdx, rax
lea rcx, [0x14008e330]
call fcn.14000b750
mov dword [0x14008e340], eax
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x14008e340], 0
je 0x14000e590
lea rdx, str.cs2.exe
lea rcx, [rsp + 0x698]
call fcn.1400038f0
mov rdx, rax
lea rcx, [0x14008e330]
call fcn.14000b5a0
test eax, eax
je 0x14000e626
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.cs2.exe
lea rcx, [rsp + 0x698]
call fcn.1400038f0
mov rdx, rax
lea rcx, [0x14008e330]
call fcn.14000b5a0
test eax, eax
jne 0x14000e5f4
call fcn.1400102f0
test al, al
jne 0x14000e802
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov dword [rsp + 0xc0], 0xb8cabdce
mov dword [rsp + 0xc4], 0xe8f2fbce
mov word [rsp + 0xc8], 0xb3
mov byte [rsp + 0xca], 1
lea rcx, [rsp + 0xc0]
call fcn.140009bb0
lea rdx, [rsp + 0xc0]
mov rcx, rbx
call fcn.14000f670
lea rdx, [0x14000f840]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.1400102f0
test al, al
jne 0x14000e802
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov dword [rsp + 0xe0], 0xbdc1b0c1
mov dword [rsp + 0xe4], 0xd5c9fec9
mov dword [rsp + 0xe8], 0x1008d8c
lea rcx, [rsp + 0xe0]
call fcn.14000f130
lea rdx, [rsp + 0xe0]
mov rcx, rbx
call fcn.14000f670
lea rdx, [0x14000f840]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x1770
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.1400102f0
test al, al
jne 0x14000e802
mov ecx, 0x4268
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov dword [rsp + 0xf0], 0xbdc1b0c1
mov dword [rsp + 0xf4], 0xd5c9fec9
mov dword [rsp + 0xf8], 0x8a8d8c
mov byte [rsp + 0xfc], 1
lea rcx, [rsp + 0xf0]
call fcn.14000f1d0
lea rdx, [rsp + 0xf0]
mov rcx, rbx
call fcn.14000f670
lea rdx, [0x14000f840]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call fcn.1400102f0
test al, al
jne 0x14000e802
lea rcx, [0x14008dcf0]
call fcn.140009fa0
mov rbx, rax
movdqa xmm0, xmmword [0x14006bd80]
movdqu xmmword [rsp + 0x190], xmm0
movdqa xmm1, xmmword [0x14006c7d0]
movdqu xmmword [rsp + 0x1a0], xmm1
mov dword [rsp + 0x1b0], 0x590e5512
mov dword [rsp + 0x1b4], 0x7f1f0478
mov dword [rsp + 0x1b8], 0x100046c
lea rcx, [rsp + 0x190]
call fcn.1400099a0
mov r9d, 0x10
mov r8, rbx
lea rdx, [rsp + 0x190]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x14000e974
lea rcx, [0x14008f2a0]
call fcn.14000b330
test al, al
jne 0x14000e883
lea rcx, [0x14008dcf0]
call fcn.140009fa0
mov rbx, rax
movdqa xmm0, xmmword [0x14006c4b0]
movdqu xmmword [rsp + 0x208], xmm0
movdqa xmm1, xmmword [0x14006c7c0]
movdqu xmmword [rsp + 0x218], xmm1
mov dword [rsp + 0x228], 0x506e7478
mov word [rsp + 0x22c], 0x100
lea rcx, [rsp + 0x208]
call fcn.1400098b0
mov r9d, 0x10
mov r8, rbx
lea rdx, [rsp + 0x208]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x14000e974
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movdqa xmm0, xmmword [0x14006cbe0]
movdqu xmmword [rsp + 0x1f0], xmm0
mov word [rsp + 0x200], 0x100
lea rcx, [rsp + 0x1f0]
call fcn.14000f100
lea rdx, [rsp + 0x1f0]
mov rcx, rbx
call fcn.14000f670
lea rdx, [0x14000f840]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, 0x3e8
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
nop
lea rax, [rsp + 0x840]
mov qword [rsp + 0x158], rax
lea rax, [0x1400077b0]
mov qword [rsp + 0x888], rax
mov qword [rsp + 0x878], r15
lea rdx, [rsp + 0x888]
lea rcx, [rsp + 0x840]
call fcn.14000ffe0
nop
lea rax, [rsp + 0x800]
mov qword [rsp + 0x690], rax
lea rdx, [0x1400697f0]
lea rcx, [rsp + 0x800]
call fcn.1400038f0
mov rbx, rax
lea rdx, str.Counter_Strike_2
lea rcx, [rsp + 0x820]
call fcn.1400038f0
nop
lea r9, [rsp + 0x840]
mov r8, rbx
mov rdx, rax
mov rcx, qword [0x14008f328]
call fcn.14005b7f0
nop
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
lea rcx, [rsp + 0x898]
call fcn.140003890
jmp 0x14000d93c
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8, [0x14000bd10]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, reloc.WS2_32.dll_inet_ntoa
call fcn.14000c1c0
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movdqa xmm0, xmmword [0x14006cbc0]
movdqa xmmword [rsp + 0x260], xmm0
movdqa xmm1, xmmword [0x14006ca30]
movdqa xmmword [rsp + 0x270], xmm1
movdqa xmm0, xmmword [0x14006ca70]
movdqa xmmword [rsp + 0x280], xmm0
movdqa xmm1, xmmword [0x14006ca80]
movdqa xmmword [rsp + 0x290], xmm1
mov dword [rsp + 0x2a0], 0xb5a8b4a8
mov dword [rsp + 0x2a4], 0x9585b1f0
mov word [rsp + 0x2a8], 0xbf
mov byte [rsp + 0x2aa], 1
lea rcx, [rsp + 0x260]
call fcn.14000ede0
mov rdx, rax
mov rcx, rbx
call fcn.14000f670
lea rdx, [0x14000f840]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [0x14008dcf0]
call fcn.140009fa0
mov rbx, rax
movdqa xmm0, xmmword [0x14006c840]
movdqa xmmword [rsp + 0x360], xmm0
movdqa xmm1, xmmword [0x14006c880]
movdqa xmmword [rsp + 0x370], xmm1
movdqa xmm0, xmmword [0x14006c8d0]
movdqa xmmword [rsp + 0x380], xmm0
movdqa xmm1, xmmword [0x14006bf70]
movdqa xmmword [rsp + 0x390], xmm1
movdqa xmm0, xmmword [0x14006bfc0]
movdqa xmmword [rsp + 0x3a0], xmm0
movdqa xmm1, xmmword [0x14006ca50]
movdqa xmmword [rsp + 0x3b0], xmm1
mov dword [rsp + 0x3c0], 0xd29b9cd4
mov dword [rsp + 0x3c4], 0x53679e96
mov dword [rsp + 0x3c8], 0x41614760
mov dword [rsp + 0x3cc], 0x1004d51
lea rcx, [rsp + 0x360]
call fcn.14000ee10
mov r9d, 0x10
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8, [0x14000bd10]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, reloc.WS2_32.dll_inet_ntoa
call fcn.14000c1c0
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movdqa xmm0, xmmword [0x14006cbc0]
movdqa xmmword [rsp + 0x2b0], xmm0
movdqa xmm1, xmmword [0x14006ca30]
movdqa xmmword [rsp + 0x2c0], xmm1
movdqa xmm0, xmmword [0x14006ca70]
movdqa xmmword [rsp + 0x2d0], xmm0
movdqa xmm1, xmmword [0x14006ca80]
movdqa xmmword [rsp + 0x2e0], xmm1
mov dword [rsp + 0x2f0], 0xb5a8b4a8
mov dword [rsp + 0x2f4], 0x9585b1f0
mov word [rsp + 0x2f8], 0xbf
mov byte [rsp + 0x2fa], 1
lea rcx, [rsp + 0x2b0]
call fcn.14000ede0
mov rdx, rax
mov rcx, rbx
call fcn.14000f670
lea rdx, [0x14000f840]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [0x14008dcf0]
call fcn.140009fa0
mov rbx, rax
movdqa xmm0, xmmword [0x14006c850]
movdqa xmmword [rsp + 0x3d0], xmm0
movdqa xmm1, xmmword [0x14006c880]
movdqa xmmword [rsp + 0x3e0], xmm1
movdqa xmm0, xmmword [0x14006c8d0]
movdqa xmmword [rsp + 0x3f0], xmm0
movdqa xmm1, xmmword [0x14006bf70]
movdqa xmmword [rsp + 0x400], xmm1
movdqa xmm0, xmmword [0x14006bfc0]
movdqa xmmword [rsp + 0x410], xmm0
movdqa xmm1, xmmword [0x14006ca50]
movdqa xmmword [rsp + 0x420], xmm1
mov dword [rsp + 0x430], 0xd29b9cd4
mov dword [rsp + 0x434], 0x53679e96
mov dword [rsp + 0x438], 0x41614760
mov dword [rsp + 0x43c], 0x1004d51
lea rcx, [rsp + 0x3d0]
call fcn.14000ee10
mov r9d, 0x10
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.14005ed98
nop
call fcn.14005ed98
int3