Function at 0x14003a434
Capabilities:
Create process on windows
Encode data using xor
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x278]
sub rsp, 0x350
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm10
movaps xmmword [rax - 0x78], xmm11
movaps xmmword [rax - 0x88], xmm12
mov rax, qword [0x140116080]
xor rax, rsp
mov qword [rbp + 0x1e8], rax
xor r14d, r14d
lea rax, [0x140164128]
mov qword [0x140164138], r14
mov rbx, rcx
lea rcx, [0x140163e90]
lea edi, [r14 + 0xf]
cmp qword [0x140164140], rdi
cmova rax, qword [0x140164128]
mov byte [rax], r14b
lea rax, [0x140163e28]
cmp qword [0x140163e40], rdi
mov qword [0x140163e38], r14
cmova rax, qword [0x140163e28]
mov byte [rax], r14b
lea rax, [0x140164148]
cmp qword [0x140164160], rdi
mov qword [0x140164158], r14
cmova rax, qword [0x140164148]
mov byte [rax], r14b
lea rax, [0x140163de8]
cmp qword [0x140163e00], rdi
mov qword [0x140163df8], r14
cmova rax, qword [0x140163de8]
mov byte [rax], r14b
lea rax, [0x140163e68]
cmp qword [0x140163e80], rdi
mov qword [0x140163e78], r14
cmova rax, qword [0x140163e68]
mov byte [rax], r14b
call fcn.140050d50
cmp byte [reloc.WLDAP32.dll_Ordinal_50], r14b
lea r15d, [r14 + 1]
movzx eax, word [0x140106c48]
mov esi, 0x51eb851f
mov word [rbp + 0x170], ax
je 0x14003a58e
mov r8d, r14d
lea r9, [rbp + 0x170]
mov eax, esi
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
add r8d, r15d
sub al, cl
add al, 0x31
xor byte [r9], al
add r9, r15
cmp r8d, 2
jl 0x14003a56a
xorps xmm0, xmm0
mov qword [rbp + 0x188], r14
or r12, 0xffffffffffffffff
mov qword [rbp + 0x190], r14
movups xmmword [rbp + 0x178], xmm0
mov r8, r12
lea rax, [rbp + 0x170]
inc r8
cmp byte [rax + r8], r14b
jne 0x14003a5b4
lea rdx, [rbp + 0x170]
lea rcx, [rbp + 0x178]
call fcn.14003e40c
cmp byte [0x140106b7d], r14b
mov eax, dword [0x140106b78]
movsd xmm0, qword [str._RPPDa_KIRSS_]
mov dword [rsp + 0x70], eax
movzx eax, word [0x140106b7c]
mov word [rsp + 0x74], ax
movsd qword [rsp + 0x68], xmm0
je 0x14003a629
mov r8d, r14d
lea r9, [rsp + 0x68]
mov eax, esi
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
add r8d, r15d
sub al, cl
add al, 0x31
xor byte [r9], al
add r9, r15
cmp r8d, 0xe
jl 0x14003a605
xorps xmm0, xmm0
lea rax, [rsp + 0x68]
xorps xmm1, xmm1
mov r8, r12
movups xmmword [rbp + 0x60], xmm0
movdqu xmmword [rbp + 0x70], xmm1
inc r8
cmp byte [rax + r8], r14b
jne 0x14003a640
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x60]
call fcn.14003e40c
lea r8, [rbp + 0x60]
lea rdx, [rbp + 0x198]
lea rcx, [0x140163e90]
call fcn.140058020
cmp qword [rbp + 0x1b0], rdi
lea rdx, [rbp + 0x198]
mov r13, qword [rbp + 0x190]
lea rcx, [rbp + 0x178]
cmova rdx, qword [rbp + 0x198]
cmp r13, rdi
mov r12, qword [rbp + 0x178]
mov r8, qword [rbp + 0x188]
cmova rcx, r12
cmp r8, qword [rbp + 0x1a8]
jne 0x14003bc56
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14003bc56
call fcn.14003a0bc
call fcn.1400395d4
lea rax, [0x14003bc5c]
mov dword [rbp + 0x120], 0x50
xor ecx, ecx
mov qword [rbp + 0x128], rax
mov dword [rbp + 0x124], 0x40
mov qword [rbp + 0x130], r14
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edx, 0x65
mov rcx, rbx
mov qword [rbp + 0x138], rax
call qword [sym.imp.USER32.dll_LoadIconW]
movups xmm1, xmmword [str.y_AQQ]
mov qword [rbp + 0x140], rax
lea r9, [rbp + 0x178]
mov eax, dword [0x140106c80]
xorps xmm0, xmm0
mov dword [rbp + 0x190], eax
mov r8d, r14d
movzx eax, word [0x140106c84]
movdqa xmmword [rbp + 0x150], xmm0
movsd xmm0, qword [0x140106c78]
mov word [rbp + 0x194], ax
mov qword [rbp + 0x148], r14
movups xmmword [rbp + 0x178], xmm1
movsd qword [rbp + 0x188], xmm0
mov eax, esi
mul r8d
shr edx, 4
movzx eax, dx
imul ecx, eax, 0x32
movzx eax, r8w
add r8d, r15d
sub ax, cx
add ax, 0x31
xor word [r9], ax
lea r9, [r9 + 2]
cmp r8d, edi
jl 0x14003a76c
lea rax, [rbp + 0x178]
mov qword [rbp + 0x168], r14
lea rcx, [rbp + 0x120]
mov qword [rbp + 0x160], rax
call qword [sym.imp.USER32.dll_RegisterClassExW]
movups xmm1, xmmword [0x140106d78]
movups xmm0, xmmword [str.uWGQVBR_]
pextrw eax, xmm1, 7
movups xmmword [rbp + 0x60], xmm0
movups xmmword [rbp + 0x70], xmm1
test ax, ax
je 0x14003a808
mov r8d, r14d
lea r9, [rbp + 0x60]
mov eax, esi
mul r8d
shr edx, 4
movzx eax, dx
imul ecx, eax, 0x32
movzx eax, r8w
add r8d, r15d
sub ax, cx
add ax, 0x31
xor word [r9], ax
lea r9, [r9 + 2]
cmp r8d, 0x10
jl 0x14003a7de
mov rax, qword [rbp + 0x138]
lea r8, [rbp + 0x60]
mov rdx, qword [rbp + 0x160]
mov r9d, 0x80000000
mov qword [rsp + 0x58], r14
xor ecx, ecx
mov qword [rsp + 0x50], rax
mov eax, 5
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov qword [0x140163da8], rax
call fcn.140037d48
test al, al
jne 0x14003a987
mov rcx, qword [0x140163d80]
test rcx, rcx
je 0x14003a880
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [0x140163d80], r14
mov rcx, qword [0x140163db0]
test rcx, rcx
je 0x14003a899
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [0x140163db0], r14
mov rdx, qword [rbp + 0x138]
mov rcx, qword [rbp + 0x160]
call qword [sym.imp.USER32.dll_UnregisterClassW]
mov rdx, qword [rbp + 0x1b0]
mov ebx, 0x1000
cmp rdx, rdi
jbe 0x14003a8ee
mov rcx, qword [rbp + 0x198]
inc rdx
mov rax, rcx
cmp rdx, rbx
jb 0x14003a8e9
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003bc36
call fcn.1400a8b90
mov qword [rbp + 0x1a8], r14
mov qword [rbp + 0x1b0], rdi
mov byte [rbp + 0x198], r14b
cmp r13, rdi
jbe 0x14003a936
lea rdx, [r13 + 1]
mov rcx, r12
cmp rdx, rbx
jb 0x14003a92e
mov r12, qword [r12 - 8]
add rdx, 0x27
sub rcx, r12
add rcx, 0xfffffffffffffff8
cmp rcx, 0x1f
ja 0x14003bc36
mov rcx, r12
call fcn.1400a8b90
mov eax, r15d
mov rcx, qword [rbp + 0x1e8]
xor rcx, rsp
call fcn.1400a8aa0
lea r11, [rsp + 0x350]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm10, xmmword [r11 - 0x40]
movaps xmm11, xmmword [r11 - 0x50]
movaps xmm12, xmmword [r11 - 0x60]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rcx, qword [0x140163da8]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x140163da8]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rax, qword [0x140163d30]
test rax, rax
je 0x14003a9b6
add dword [rax + 0x3b0], r15d
mov ecx, 0x3e48
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
test rax, rax
je 0x14003a9d2
xor edx, edx
mov rcx, rax
call fcn.140001b98
jmp 0x14003a9d5
mov rax, r14
cmp qword [0x140163d30], r14
jne 0x14003a9e5
mov qword [0x140163d30], rax
mov rcx, rax
call fcn.14000752c
mov rdi, qword [0x140163d30]
lea rbx, [0x1400e3160]
movss xmm3, dword [0x140106e7c]
xorps xmm0, xmm0
and dword [rbp + 0x94], r14d
mov eax, 0xffff
and dword [rbp + 0xa4], r14d
mov esi, 0x225bc
mov rcx, qword [rdi + 0xa8]
mov r8d, esi
bts dword [rdi + 8], 0xa
mov rdx, rbx
and dword [rbp + 0xa8], r14d
xorps xmm10, xmm10
and dword [rbp + 0xac], r14d
and dword [rbp + 0xb0], r14d
and dword [rbp + 0xc0], r14d
movss xmm12, dword [0x140106e24]
mov word [rbp + 0xd4], ax
xor eax, eax
mov qword [rbp + 0xf6], rax
lea rax, [rbp + 0x80]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
mov qword [rbp - 0x80], rdi
mov qword [rdi + 0x20], r14
mov qword [rdi + 0x28], r14
mov qword [rbp + 0x80], r14
mov dword [rbp + 0x88], r14d
mov dword [rbp + 0x90], r14d
mov dword [rbp + 0x98], 3
mov dword [rbp + 0x9c], r15d
mov byte [rbp + 0xa0], r14b
mov qword [rbp + 0xb8], r14
mov dword [rbp + 0xc4], 0x7f7fffff
mov byte [rbp + 0xc8], r14b
mov dword [rbp + 0xcc], r14d
mov dword [rbp + 0xd0], 0x3f800000
movups xmmword [rbp + 0xd6], xmm0
mov qword [rbp + 0x100], r14
movups xmmword [rbp + 0xe6], xmm0
mov byte [rbp + 0x8c], r14b
call fcn.140026a04
movss xmm3, dword [0x140106e84]
lea rax, [rbp + 0x80]
mov rcx, qword [rdi + 0xa8]
mov r8d, esi
mov qword [rsp + 0x28], r14
mov rdx, rbx
mov qword [rsp + 0x20], rax
call fcn.140026a04
movss xmm3, dword [0x140106e8c]
lea rax, [rbp + 0x80]
mov rcx, qword [rdi + 0xa8]
mov r8d, esi
mov qword [rsp + 0x28], r14
mov rdx, rbx
mov qword [rsp + 0x20], rax
call fcn.140026a04
movss xmm3, dword [0x140106ea8]
lea rdx, [0x1400c0ba0]
mov rcx, qword [rdi + 0xa8]
mov r8d, esi
mov qword [0x140163d38], rax
lea rax, [rbp + 0x80]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
call fcn.140026a04
movss xmm3, dword [0x140106e98]
lea rax, [rbp + 0x80]
mov rcx, qword [rdi + 0xa8]
lea rdx, [0x1400c0ba0]
mov qword [rsp + 0x28], r14
mov r8d, esi
mov qword [rsp + 0x20], rax
call fcn.140026a04
lea rbx, [0x140105828]
mov qword [0x140163db8], rax
mov qword [rsp + 0x20], rbx
movss xmm2, dword [0x140106e90]
mov rcx, qword [rdi + 0xa8]
call fcn.14002683c
movss xmm2, dword [0x140106e9c]
mov rcx, qword [rdi + 0xa8]
mov qword [rsp + 0x20], rbx
call fcn.14002683c
mov rcx, qword [rdi + 0xa8]
call fcn.140026578
call fcn.14002b94c
mov rcx, qword [0x140163d80]
lea rax, str.imgui_impl_dx9
mov rbx, qword [0x140163d30]
mov qword [0x140164198], rcx
or dword [rbx + 0xc], 0x1008
mov qword [rbx + 0xe8], rax
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
test dword [rbx + 8], 0x400
je 0x14003ac8f
mov rax, qword [0x140163d30]
lea rcx, [fcn.14002b658]
mov qword [rax + 0x15f0], rcx
lea rcx, [fcn.14002b72c]
mov qword [rax + 0x15f8], rcx
lea rcx, [0x14002b790]
mov qword [rax + 0x1600], rcx
lea rcx, [0x14002b7e0]
mov qword [rax + 0x1608], rcx
lea rcx, [0x14002b920]
mov qword [rax + 0x1610], rcx
movss xmm11, dword [0x140106ee8]
xorps xmm0, xmm0
movups xmmword [rbp + 0x1b8], xmm0
movups xmmword [rbp + 0x1c8], xmm0
movups xmmword [rbp + 0x1d8], xmm0
xor r9d, r9d
mov dword [rsp + 0x20], r15d
xor r8d, r8d
lea rcx, [rbp + 0x1b8]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x14003aced
lea rcx, [rbp + 0x1b8]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x1b8]
call qword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x14003bace
cmp qword [0x140164188], r14
jne 0x14003acfb
call fcn.14002b518
call fcn.14002bff8
call fcn.140006660
mov eax, dword [reloc.WS2_32.dll_accept]
cmp eax, r15d
jne 0x14003b526
mov rax, qword [0x140163d30]
movaps xmm0, xmmword [0x140106fd0]
movaps xmm1, xmmword [0x140106fb0]
and qword [rax + 0x1668], 0
cmp byte [0x140106aad], r14b
mov dword [rax + 0x1654], 0x43b40000
mov dword [rax + 0x1658], 0x43340000
mov dword [rax + 0x1650], 0x3f800000
mov dword [rax + 0x1684], 0x3f800000
mov dword [rax + 0x1680], 0x40a00000
mov dword [rax + 0x16ac], r14d
mov dword [rax + 0x16b4], r14d
mov dword [rax + 0x1670], r14d
mov dword [rax + 0x164c], 0x42480000
movdqu xmmword [rax + 0x171c], xmm0
movaps xmm0, xmmword [0x140106fc0]
movdqu xmmword [rax + 0x178c], xmm0
movdqu xmmword [rax + 0x177c], xmm0
movdqu xmmword [rax + 0x176c], xmm1
movaps xmm1, xmm0
movaps xmm0, xmmword [0x140106ff0]
movaps xmm1, xmmword [0x140107010]
movdqu xmmword [rax + 0x184c], xmm0
movaps xmm0, xmmword [0x140107030]
movdqu xmmword [rax + 0x185c], xmm0
movaps xmm0, xmmword [0x140107020]
movdqu xmmword [rax + 0x186c], xmm1
movaps xmm1, xmmword [0x140106f90]
movdqu xmmword [rax + 0x18ac], xmm0
movdqu xmmword [rax + 0x174c], xmm1
movaps xmm1, xmmword [0x140107000]
movdqu xmmword [rax + 0x18dc], xmm1
movdqu xmmword [rax + 0x18fc], xmm1
movdqu xmmword [rax + 0x18ec], xmm1
movaps xmm0, xmm1
movaps xmm1, xmmword [0x140106fe0]
movaps xmm0, xmmword [0x140106f80]
movdqu xmmword [rax + 0x172c], xmm0
movdqu xmmword [rax + 0x17dc], xmm1
movdqu xmmword [rax + 0x17ec], xmm1
movdqu xmmword [rax + 0x180c], xmm1
movaps xmm0, xmm1
movaps xmm0, xmmword [0x140106fc0]
movdqu xmmword [rax + 0x187c], xmm0
movdqu xmmword [rax + 0x189c], xmm0
movdqu xmmword [rax + 0x188c], xmm0
movaps xmm1, xmm0
movsd xmm0, qword [str.pGGZDBXNRSS_]
movaps xmm1, xmmword [0x140107040]
movdqu xmmword [rax + 0x181c], xmm1
mov eax, dword [0x140106aa8]
mov dword [rbp + 0x38], eax
movzx eax, word [0x140106aac]
mov word [rbp + 0x3c], ax
movsd qword [rbp + 0x30], xmm0
je 0x14003aed3
mov r8d, r14d
lea r9, [rbp + 0x30]
mov eax, 0x51eb851f
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
add r8d, r15d
sub al, cl
add al, 0x31
xor byte [r9], al
add r9, r15
cmp r8d, 0xe
jl 0x14003aeac
xor edx, edx
lea rcx, [rbp + 0x30]
lea r8d, [rdx + 3]
call fcn.14000bd70
lea rcx, [rbp - 0x60]
mov dword [rbp - 0x60], 0x42b40000
mov dword [rbp - 0x5c], 0x41200000
call fcn.14000ee8c
or edx, 0xffffffff
call fcn.140003704
mov rcx, qword [0x140163db8]
call fcn.14000e710
mov rcx, qword [0x140163d30]
lea rdi, str.AUTHORIZATION
movaps xmm7, xmm10
mov ebx, r14d
mov rax, qword [rcx + 0x1b90]
mov byte [rax + 0xc1], r15b
mov rax, qword [rcx + 0x1b90]
movsd xmm6, qword [rcx + 0x1b10]
cvtpd2ps xmm6, xmm6
mov rsi, qword [rax + 0x318]
movss xmm0, dword [rax + 0x11c]
movss xmm8, dword [rax + 0x118]
mov al, 0x41
mulss xmm6, dword [0x140106e60]
movss dword [rbp - 0x54], xmm0
movaps xmm0, xmm8
mov byte [rbp + 0x170], al
addss xmm0, xmm7
mov byte [rbp + 0x171], r14b
movss dword [rbp - 0x58], xmm0
movd xmm0, ebx
cvtdq2ps xmm0, xmm0
addss xmm0, xmm6
mulss xmm0, dword [0x140106de4]
call sub.api_ms_win_crt_math_l1_1_0.dll_sinf
mulss xmm0, dword [0x140106de4]
lea r9, [rbp - 0x58]
mov qword [rsp + 0x40], r14
mov ecx, 0x69
movss dword [rsp + 0x38], xmm10
movaps xmm2, xmm10
mov qword [rsp + 0x30], r14
xor edx, edx
addss xmm0, dword [0x140106de4]
mulss xmm0, dword [0x140106ef4]
cvttss2si eax, xmm0
sub ecx, eax
lea rax, [rbp + 0x170]
or ecx, 0xff000000
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
mov rcx, rsi
call fcn.140025884
xor r9d, r9d
movss dword [rsp + 0x20], xmm11
xor r8d, r8d
lea rdx, [rbp + 0x170]
lea rcx, [rbp + 0x110]
call fcn.140008f00
add rdi, r15
add ebx, r15d
addss xmm7, dword [rax]
mov al, byte [rdi]
test al, al
jne 0x14003af6a
call fcn.14000e7a8
mov ecx, r15d
call fcn.140003810
lea rcx, [rbp - 0x50]
mov dword [rbp - 0x50], 0x43160000
mov dword [rbp - 0x4c], 0x42700000
call fcn.14000ee8c
mov edi, 0xfff0f0f0
mov edx, edi
call fcn.140003704
mov rcx, qword [0x140163d38]
call fcn.14000e710
cmp byte [0x140106b1d], r14b
mov ebx, 0x51eb851f
mov eax, dword [0x140106b18]
mov si, Ordinal_50
movsd xmm0, qword [str._PQ_ER]
mov dword [rbp + 0x48], eax
movzx eax, word [0x140106b1c]
mov word [rbp + 0x4c], ax
movsd qword [rbp + 0x40], xmm0
je 0x14003b0c7
mov r8d, r14d
lea r9, [rbp + 0x40]
mov eax, ebx
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
add r8d, r15d
sub al, cl
add al, sil
xor byte [r9], al
add r9, r15
cmp r8d, 0xe
jl 0x14003b0a2
lea rcx, [rbp + 0x40]
call fcn.14002d918
mov ecx, r15d
call fcn.140003810
call fcn.14000e7a8
lea rcx, [rbp - 0x48]
mov dword [rbp - 0x48], 0x42aa0000
mov dword [rbp - 0x44], 0x42a00000
call fcn.14000ee8c
mov edx, edi
call fcn.140003704
mov qword [rsp + 0x38], r14
lea rax, [rbp - 0x40]
mov qword [rsp + 0x30], r14
lea r8, [0x140163d88]
mov dword [rsp + 0x28], r14d
lea rcx, str.RenderUsername
mov r9d, Ordinal_32
mov qword [rsp + 0x20], rax
xor edx, edx
mov dword [rbp - 0x40], 0x435c0000
mov dword [rbp - 0x3c], 0x41b80000
call fcn.1400313e8
mov ecx, r15d
call fcn.140003810
lea rcx, [rbp - 0x38]
mov dword [rbp - 0x38], 0x431b0000
mov dword [rbp - 0x34], 0x42dc0000
call fcn.14000ee8c
mov rcx, qword [0x140163d38]
call fcn.14000e710
mov eax, dword [0x140106d88]
lea r9, [rsp + 0x78]
mov dword [rsp + 0x78], eax
mov r8d, r14d
movzx eax, word [0x140106d8c]
mov word [rsp + 0x7c], ax
mov dword [rbp - 0x30], 0x42a00000
mov dword [rbp - 0x2c], 0x420c0000
mov eax, ebx
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
add r8d, r15d
sub al, cl
add al, sil
xor byte [r9], al
add r9, r15
cmp r8d, 6
jl 0x14003b193
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x78]
call fcn.14002df9c
test al, al
je 0x14003b342
or rdi, 0xffffffffffffffff
lea rcx, [0x140163d88]
inc rdi
cmp byte [rcx + rdi], r14b
jne 0x14003b1d9
mov rax, qword [0x140163de0]
cmp rdi, rax
ja 0x14003b221
cmp rax, 0xf
mov qword [0x140163dd8], rdi
mov rdx, rcx
lea rbx, [0x140163dc8]
cmova rbx, qword [0x140163dc8]
mov r8, rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rdi], r14b
mov ebx, 0x51eb851f
jmp 0x14003b236
mov r9, rcx
mov r8b, r14b
lea rcx, [0x140163dc8]
mov rdx, rdi
call fcn.14003ea5c
lea rdx, [0x140163dc8]
lea rcx, [rbp + 0x60]
call fcn.14003cedc
mov rdx, rax
lea rcx, [0x140163e90]
call fcn.140052cb0
cmp byte [0x1401640c0], r14b
je 0x14003b329
cmp qword [0x140163e20], 0xf
lea rdx, [0x140163e08]
mov r9d, 0x40
lea rcx, [0x1401628e8]
cmova rdx, qword [0x140163e08]
lea r8d, [r9 - 0x3e]
call fcn.14003d350
xor r8d, r8d
lea rdi, [0x1401628e0]
test rax, rax
mov rax, qword [0x1401628e0]
movsxd rcx, dword [rax + 4]
je 0x14003b2b6
add rcx, rdi
xor edx, edx
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::clear_int__bool____ptr64]
jmp 0x14003b2c4
add rcx, rdi
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
cmp qword [0x140163de0], 0xf
lea rdx, [0x140163dc8]
mov r8, qword [0x140163dd8]
mov rcx, rdi
cmova rdx, qword [0x140163dc8]
call fcn.14003f124
lea rcx, [0x1401628e8]
call fcn.14003d2a0
test rax, rax
jne 0x14003b316
mov rax, qword [0x1401628e0]
xor r8d, r8d
movsxd rcx, dword [rax + 4]
lea edx, [r8 + 2]
add rcx, rdi
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov dword [reloc.WS2_32.dll_accept], 2
mov byte [0x140163d29], r15b
jmp 0x14003b342
xor eax, eax
xorps xmm0, xmm0
movups xmmword [0x140163d88], xmm0
mov qword [0x140163d98], rax
mov dword [0x140163da0], eax
call fcn.14000e7a8
lea rcx, [rbp - 0x28]
mov dword [rbp - 0x28], 0x43b18000
mov dword [rbp - 0x24], 0x40a00000
call fcn.14000ee8c
mov rcx, qword [0x140163dc0]
call fcn.14000e710
cmp byte [reloc.WLDAP32.dll_Ordinal_50], r14b
movzx eax, word [0x140106a98]
mov word [rsp + 0x60], ax
mov dword [rbp - 0x20], 0x41f00000
mov dword [rbp - 0x1c], 0x41f00000
je 0x14003b3ba
mov r8d, r14d
lea r9, [rsp + 0x60]
mov eax, ebx
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
add r8d, r15d
sub al, cl
add al, sil
xor byte [r9], al
add r9, r15
cmp r8d, 2
jl 0x14003b395
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x60]
call fcn.14002df9c
test al, al
jne 0x14003bc3d
lea rcx, [rbp - 0x18]
mov dword [rbp - 0x18], 0x43a78000
mov dword [rbp - 0x14], 0x40a00000
call fcn.14000ee8c
cmp byte [reloc.WLDAP32.dll_Ordinal_50], r14b
movzx eax, word [0x140106a70]
mov word [rsp + 0x60], ax
mov dword [rbp - 0x10], 0x41f00000
mov dword [rbp - 0xc], 0x41f00000
je 0x14003b437
mov r8d, r14d
lea r9, [rsp + 0x60]
mov eax, ebx
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
add r8d, r15d
sub al, cl
add al, sil
xor byte [r9], al
add r9, r15
cmp r8d, 2
jl 0x14003b412
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x60]
call fcn.14002df9c
test al, al
je 0x14003b45b
mov rcx, qword [0x140163da8]
mov edx, 6
call qword [sym.imp.USER32.dll_ShowWindow]
call fcn.14000e7a8
mov rcx, qword [0x140163dc0]
call fcn.14000e710
and dword [rbp - 8], 0
lea rcx, [rbp - 8]
mov dword [rbp - 4], 0x43160000
call fcn.14000ee8c
mov eax, dword [0x140106b68]
lea r9, [rsp + 0x68]
movsd xmm0, qword [0x140106b60]
mov r8d, r14d
mov dword [rsp + 0x70], eax
mov al, byte [0x140106b6c]
mov byte [rsp + 0x74], al
mov dword [rbp], 0x42c80000
mov dword [rbp + 4], 0x41f00000
movsd qword [rsp + 0x68], xmm0
mov eax, ebx
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
add r8d, r15d
sub al, cl
add al, sil
xor byte [r9], al
add r9, r15
cmp r8d, 0xd
jl 0x14003b4b8
lea rdx, [rbp]
lea rcx, [rsp + 0x68]
call fcn.14002df9c
test al, al
je 0x14003b510
mov dword [rsp + 0x28], 5
lea r8, [0x140105ad0]
xor r9d, r9d
mov qword [rsp + 0x20], r14
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
call fcn.14000e7a8
call fcn.14000e25c
mov eax, dword [reloc.WS2_32.dll_accept]
mov rdi, qword [rbp - 0x80]
jmp 0x14003b52f
mov ebx, 0x51eb851f
mov si, Ordinal_50
cmp byte [0x140163d29], r14b
je 0x14003b91d
cmp eax, 2
jne 0x14003b91d
cmp byte [0x1401640c0], r14b
je 0x14003b91d
mov rax, qword [0x140163d30]
movaps xmm0, xmmword [0x140106fd0]
movaps xmm1, xmmword [0x140106fb0]
and qword [rax + 0x1668], 0
cmp byte [0x140106b35], r14b
mov dword [rax + 0x1654], 0x435c0000
mov dword [rax + 0x1658], 0x42c80000
mov dword [rax + 0x164c], 0x42480000
mov dword [rax + 0x1680], r14d
mov dword [rax + 0x16ac], r14d
mov dword [rax + 0x16b4], r14d
mov dword [rax + 0x1650], 0x40000000
mov dword [rax + 0x1684], 0x3f800000
movdqu xmmword [rax + 0x171c], xmm0
movaps xmm0, xmmword [0x140106fc0]
movdqu xmmword [rax + 0x176c], xmm1
movdqu xmmword [rax + 0x178c], xmm0
movdqu xmmword [rax + 0x177c], xmm0
movaps xmm1, xmm0
movaps xmm0, xmmword [0x140106ff0]
movaps xmm1, xmmword [0x140107010]
movdqu xmmword [rax + 0x184c], xmm0
movaps xmm0, xmmword [0x140107020]
movdqu xmmword [rax + 0x186c], xmm1
movaps xmm1, xmmword [0x140106f90]
movdqu xmmword [rax + 0x185c], xmm0
movdqu xmmword [rax + 0x18ac], xmm0
movdqu xmmword [rax + 0x174c], xmm1
movaps xmm1, xmmword [0x140107000]
movdqu xmmword [rax + 0x18dc], xmm1
movdqu xmmword [rax + 0x18fc], xmm1
movdqu xmmword [rax + 0x18ec], xmm1
movaps xmm0, xmm1
movaps xmm1, xmmword [0x140106fe0]
movaps xmm0, xmmword [0x140106f80]
movdqu xmmword [rax + 0x172c], xmm0
movdqu xmmword [rax + 0x17dc], xmm1
movdqu xmmword [rax + 0x17ec], xmm1
movdqu xmmword [rax + 0x180c], xmm1
movdqu xmmword [rax + 0x17fc], xmm1
movaps xmm0, xmm1
movaps xmm1, xmmword [0x140106fc0]
movdqu xmmword [rax + 0x187c], xmm1
movdqu xmmword [rax + 0x189c], xmm1
movdqu xmmword [rax + 0x188c], xmm1
movaps xmm0, xmm1
movaps xmm0, xmmword [0x140107040]
movups xmm1, xmmword [0x140106b20]
movdqu xmmword [rax + 0x181c], xmm0
mov eax, dword [0x140106b30]
mov dword [rbp + 0x188], eax
movzx eax, word [0x140106b34]
mov word [rbp + 0x18c], ax
movups xmmword [rbp + 0x178], xmm1
je 0x14003b710
mov r8d, r14d
lea r9, [rbp + 0x178]
mov eax, ebx
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
add r8d, r15d
sub al, cl
add al, sil
xor byte [r9], al
add r9, r15
cmp r8d, 0x16
jl 0x14003b6eb
xor edx, edx
lea rcx, [rbp + 0x178]
lea r8d, [rdx + 3]
call fcn.14000bd70
lea rcx, [rbp - 0x68]
mov dword [rbp - 0x68], 0x42200000
mov dword [rbp - 0x64], 0x42000000
call fcn.14000ee8c
mov rcx, qword [0x140163db8]
call fcn.14000e710
cmp byte [reloc.WLDAP32.dll_Ordinal_60], r14b
movsd xmm0, qword [str.xyqvb]
mov eax, dword [0x140106c58]
movsd qword [rbp + 0x50], xmm0
mov dword [rbp + 8], 0x43340000
mov dword [rbp + 0xc], 0x42040000
mov dword [rbp + 0x58], eax
je 0x14003b79e
mov r8d, r14d
lea r9, [rbp + 0x50]
mov eax, ebx
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
add r8d, r15d
sub al, cl
add al, sil
xor byte [r9], al
add r9, r15
cmp r8d, 0xc
jl 0x14003b779
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x50]
call fcn.14002df9c
test al, al
je 0x14003b7fa
movsd xmm0, qword [str.Y_CGeSO_9]
lea r9, [rbp - 0x78]
mov al, byte [reloc.WS2_32.dll_gethostname]
mov r8d, r14d
movsd qword [rbp - 0x78], xmm0
mov byte [rbp - 0x70], al
mov eax, ebx
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
add r8d, r15d
sub al, cl
add al, sil
xor byte [r9], al
add r9, r15
cmp r8d, 9
jl 0x14003b7cc
lea rcx, [rbp - 0x78]
call fcn.1400397b8
call fcn.14000e7a8
lea rcx, [rbp + 0x10]
mov dword [rbp + 0x10], 0x435c0000
mov dword [rbp + 0x14], 0x40a00000
call fcn.14000ee8c
mov rcx, qword [0x140163dc0]
call fcn.14000e710
cmp byte [reloc.WLDAP32.dll_Ordinal_50], r14b
movzx eax, word [0x140106a98]
mov word [rsp + 0x60], ax
mov dword [rbp + 0x18], 0x41f00000
mov dword [rbp + 0x1c], 0x41f00000
je 0x14003b872
mov r8d, r14d
lea r9, [rsp + 0x60]
mov eax, ebx
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
add r8d, r15d
sub al, cl
add al, sil
xor byte [r9], al
add r9, r15
cmp r8d, 2
jl 0x14003b84d
lea rdx, [rbp + 0x18]
lea rcx, [rsp + 0x60]
call fcn.14002df9c
test al, al
jne 0x14003bc3d
lea rcx, [rbp + 0x20]
mov dword [rbp + 0x20], 0x43480000
mov dword [rbp + 0x24], 0x40a00000
call fcn.14000ee8c
cmp byte [reloc.WLDAP32.dll_Ordinal_50], r14b
movzx eax, word [0x140106a70]
mov word [rsp + 0x60], ax
mov dword [rbp + 0x28], 0x41f00000
mov dword [rbp + 0x2c], 0x41f00000
je 0x14003b8ef
mov r8d, r14d
lea r9, [rsp + 0x60]
mov eax, ebx
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
add r8d, r15d
sub al, cl
add al, sil
xor byte [r9], al
add r9, r15
cmp r8d, 2
jl 0x14003b8ca
lea rdx, [rbp + 0x28]
lea rcx, [rsp + 0x60]
call fcn.14002df9c
test al, al
je 0x14003b913
mov rcx, qword [0x140163da8]
mov edx, 6
call qword [sym.imp.USER32.dll_ShowWindow]
call fcn.14000e7a8
call fcn.14000e25c
call fcn.140008598
mov rcx, qword [0x140163d80]
mov r9d, 3
mov dword [rsp + 0x30], r14d
xor r8d, r8d
movss dword [rsp + 0x28], xmm12
xor edx, edx
mov dword [rsp + 0x20], r14d
mov rax, qword [rcx]
call qword [rax + 0x158]
mov rcx, qword [0x140163d80]
mov rax, qword [rcx]
call qword [rax + 0x148]
test eax, eax
js 0x14003b99e
call fcn.1400089f8
mov rax, qword [0x140163d30]
mov rcx, qword [rax + 0x1d40]
mov rdx, qword [rcx]
add rdx, 0xb0
mov al, byte [rdx]
neg al
sbb rcx, rcx
and rcx, rdx
call fcn.14002adec
mov rcx, qword [0x140163d80]
mov rax, qword [rcx]
call qword [rax + 0x150]
test dword [rdi + 8], 0x400
je 0x14003ba71
call fcn.1400152f8
mov rbx, qword [0x140163d30]
mov r14d, r15d
mov eax, dword [rbx + 0x1630]
lea r15, [rbx + 0x1638]
cmp eax, 1
jle 0x14003ba16
mov esi, 8
mov rax, qword [r15]
mov rdi, qword [rsi + rax]
test byte [rdi + 4], 0x80
jne 0x14003ba04
mov rax, qword [rbx + 0x15c0]
test rax, rax
je 0x14003b9f1
xor edx, edx
mov rcx, rdi
call rax
mov rax, qword [rbx + 0x1608]
test rax, rax
je 0x14003ba04
xor edx, edx
mov rcx, rdi
call rax
mov eax, dword [rbx + 0x1630]
inc r14d
add rsi, 8
cmp r14d, eax
jl 0x14003b9d1
mov r14d, 1
cmp eax, r14d
jle 0x14003ba68
lea esi, [r14 + 7]
mov rax, qword [r15]
mov rdi, qword [rsi + rax]
test byte [rdi + 4], 0x80
jne 0x14003ba58
mov rax, qword [rbx + 0x15c8]
test rax, rax
je 0x14003ba45
xor edx, edx
mov rcx, rdi
call rax
mov rax, qword [rbx + 0x1610]
test rax, rax
je 0x14003ba58
xor edx, edx
mov rcx, rdi
call rax
inc r14d
add rsi, 8
cmp r14d, dword [rbx + 0x1630]
jl 0x14003ba25
mov r15d, 1
xor r14d, r14d
mov rcx, qword [0x140163d80]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r14
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x88]
cmp eax, 0x88760868
jne 0x14003baca
mov rcx, qword [0x140163d80]
mov rax, qword [rcx]
call qword [rax + Ordinal_26]
cmp eax, 0x88760869
jne 0x14003baca
call fcn.14002b58c
mov rcx, qword [0x140163d80]
lea rdx, [0x140163d40]
mov rax, qword [rcx]
call qword [rax + 0x80]
call fcn.14002b518
mov rdi, qword [rbp - 0x80]
cmp dword [rbp + 0x1c0], 0x12
jne 0x14003acb0
call fcn.14001588c
call fcn.14002b58c
mov rcx, qword [0x140164198]
test rcx, rcx
je 0x14003bafe
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [0x140164198], r14
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdx, rax
lea rcx, str.ImGui_Platform
call qword [sym.imp.USER32.dll_UnregisterClassW]
mov rbx, qword [0x140163d30]
mov rcx, rbx
mov qword [0x1401641a8], r14
call fcn.1400076d8
cmp qword [0x140163d30], rbx
jne 0x14003bb3c
mov qword [0x140163d30], r14
test rbx, rbx
je 0x14003bb64
mov rcx, rbx
call fcn.14001ce80
mov rax, qword [0x140163d30]
test rax, rax
je 0x14003bb5b
dec dword [rax + 0x3b0]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [0x140163d80]
test rcx, rcx
je 0x14003bb7d
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [0x140163d80], r14
mov rcx, qword [0x140163db0]
test rcx, rcx
je 0x14003bb96
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [0x140163db0], r14
mov rcx, qword [0x140163da8]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rdx, qword [rbp + 0x138]
mov rcx, qword [rbp + 0x160]
call qword [sym.imp.USER32.dll_UnregisterClassW]
mov rdx, qword [rbp + 0x1b0]
mov ebx, 0x1000
cmp rdx, 0xf
jbe 0x14003bbf5
mov rcx, qword [rbp + 0x198]
inc rdx
mov rax, rcx
cmp rdx, rbx
jb 0x14003bbf0
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003bc36
call fcn.1400a8b90
mov qword [rbp + 0x1a8], r14
mov qword [rbp + 0x1b0], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x198], r14b
cmp r13, 0xf
jbe 0x14003bc4f
lea rdx, [r13 + 1]
mov rax, r12
cmp rdx, rbx
jb 0x14003bc47
mov r12, qword [r12 - 8]
add rdx, 0x27
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003bc47
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
or ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, r12
call fcn.1400a8b90
xor eax, eax
jmp 0x14003a939
call fcn.140039cc0
int3