Function at 0x140044298
Capabilities:
Access peb ldr_data
Check http status code
Check os version
Create thread
Encode data using xor
Encrypt data using speck
Execute command
Get kernel32 base address
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x4e0
movaps xmmword [rax - 0x28], xmm6
mov rax, qword [0x14031f010]
xor rax, rsp
mov qword [rsp + 0x4c0], rax
movups xmm0, xmmword [0x14030bbe8]
movups xmmword [rsp + 0x90], xmm0
movsd xmm1, qword [0x14030bbf8]
movsd qword [rsp + 0xa0], xmm1
xor ebx, ebx
mov esi, 0x24924925
mov r14b, reloc.WS2_32.dll_gethostname
lea edi, [rbx + 1]
cmp byte [0x14030bbff], bl
je 0x14004433c
mov r8d, ebx
lea r9, [rsp + 0x90]
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x38
mov al, r8b
sub al, cl
add al, r14b
xor byte [r9], al
add r8d, edi
add r9, rdi
cmp r8d, 0x18
jl 0x14004430e
lea rcx, [rsp + 0x90]
call fcn.1401522e0
movups xmm0, xmmword [0x14030c788]
movups xmmword [rsp + 0x90], xmm0
movsd xmm1, qword [0x14030c798]
movsd qword [rsp + 0xa0], xmm1
cmp byte [0x14030c79f], bl
je 0x1400443aa
mov r8d, ebx
lea r9, [rsp + 0x90]
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x38
mov al, r8b
sub al, cl
add al, r14b
xor byte [r9], al
add r8d, edi
add r9, rdi
cmp r8d, 0x18
jl 0x14004437c
lea rcx, [rsp + 0x90]
call fcn.1401522e0
movups xmm0, xmmword [0x14030aca8]
movups xmmword [rsp + 0x90], xmm0
mov eax, dword [0x14030acb8]
mov dword [rsp + 0xa0], eax
movzx eax, word [0x14030acbc]
mov word [rsp + 0xa4], ax
cmp byte [0x14030acbd], bl
je 0x140044423
mov r8d, ebx
lea r9, [rsp + 0x90]
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x38
mov al, r8b
sub al, cl
add al, r14b
xor byte [r9], al
add r8d, edi
add r9, rdi
cmp r8d, 0x16
jl 0x1400443f5
lea rcx, [rsp + 0x90]
call fcn.1401522e0
movups xmm0, xmmword [0x14030bdd0]
movups xmmword [rsp + 0x90], xmm0
mov eax, dword [0x14030bde0]
mov dword [rsp + 0xa0], eax
movzx eax, word [0x14030bde4]
mov word [rsp + 0xa4], ax
mov al, byte [reloc.WLDAP32.dll_Ordinal_79]
mov byte [rsp + 0xa6], al
mov r8d, ebx
lea r9, [rsp + 0x90]
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x38
mov al, r8b
sub al, cl
add al, r14b
xor byte [r9], al
add r8d, edi
add r9, rdi
cmp r8d, 0x17
jl 0x140044473
lea rcx, [rsp + 0x90]
call fcn.1401522e0
movups xmm0, xmmword [0x14030a678]
movups xmmword [rsp + 0x90], xmm0
movsd xmm1, qword [0x14030a688]
movsd qword [rsp + 0xa0], xmm1
cmp byte [0x14030a68f], bl
je 0x14004450f
mov r8d, ebx
lea r9, [rsp + 0x90]
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x38
mov al, r8b
sub al, cl
add al, r14b
xor byte [r9], al
add r8d, edi
add r9, rdi
cmp r8d, 0x18
jl 0x1400444e1
lea rcx, [rsp + 0x90]
call fcn.1401522e0
movups xmm0, xmmword [0x14030afb0]
movups xmmword [rsp + 0x90], xmm0
mov eax, dword [0x14030afc0]
mov dword [rsp + 0xa0], eax
movzx eax, word [0x14030afc4]
mov word [rsp + 0xa4], ax
mov al, byte [reloc.WLDAP32.dll_Ordinal_79]
mov byte [rsp + 0xa6], al
mov r8d, ebx
lea r9, [rsp + 0x90]
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x38
mov al, r8b
sub al, cl
add al, r14b
xor byte [r9], al
add r8d, edi
add r9, rdi
cmp r8d, 0x17
jl 0x14004455f
lea rcx, [rsp + 0x90]
call fcn.1401522e0
movups xmm0, xmmword [0x14030ca80]
movups xmmword [rsp + 0xd0], xmm0
movsd xmm1, qword [0x14030ca90]
movsd qword [rsp + 0xe0], xmm1
movzx eax, word [0x14030ca98]
mov word [rsp + 0xe8], ax
cmp byte [0x14030ca99], bl
je 0x14004460a
mov r8d, ebx
lea r9, [rsp + 0xd0]
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x38
mov al, r8b
sub al, cl
add al, r14b
xor byte [r9], al
add r8d, edi
add r9, rdi
cmp r8d, 0x1a
jl 0x1400445dc
lea rcx, [rsp + 0xd0]
call fcn.1401522e0
movups xmm0, xmmword [0x14030a8a8]
movups xmmword [rsp + 0x90], xmm0
mov eax, dword [0x14030a8b8]
mov dword [rsp + 0xa0], eax
movzx eax, word [0x14030a8bc]
mov word [rsp + 0xa4], ax
cmp byte [0x14030a8bd], bl
je 0x140044683
mov r8d, ebx
lea r9, [rsp + 0x90]
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x38
mov al, r8b
sub al, cl
add al, r14b
xor byte [r9], al
add r8d, edi
add r9, rdi
cmp r8d, 0x16
jl 0x140044655
lea rcx, [rsp + 0x90]
call fcn.1401522e0
movups xmm0, xmmword [0x14030ca30]
movups xmmword [rsp + 0xd0], xmm0
movsd xmm1, qword [0x14030ca40]
movsd qword [rsp + 0xe0], xmm1
mov al, byte [0x14030ca48]
mov byte [rsp + 0xe8], al
mov r8d, ebx
lea r9, [rsp + 0xd0]
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x38
mov al, r8b
sub al, cl
add al, r14b
xor byte [r9], al
add r8d, edi
add r9, rdi
cmp r8d, 0x19
jl 0x1400446c8
lea rcx, [rsp + 0xd0]
call fcn.1401522e0
movups xmm0, xmmword [0x14030aa50]
movups xmmword [rsp + 0xd0], xmm0
movsd xmm1, qword [0x14030aa60]
movsd qword [rsp + 0xe0], xmm1
movzx eax, word [0x14030aa68]
mov word [rsp + 0xe8], ax
mov al, byte [0x14030aa6a]
mov byte [rsp + 0xea], al
mov r8d, ebx
lea r9, [rsp + 0xd0]
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x38
mov al, r8b
sub al, cl
add al, r14b
xor byte [r9], al
add r8d, edi
add r9, rdi
cmp r8d, 0x1b
jl 0x14004474a
lea rcx, [rsp + 0xd0]
call fcn.1401522e0
movups xmm0, xmmword [0x14030a850]
movups xmmword [rsp + 0xd0], xmm0
movsd xmm1, qword [0x14030a860]
movsd qword [rsp + 0xe0], xmm1
movzx eax, word [0x14030a868]
mov word [rsp + 0xe8], ax
mov al, byte [0x14030a86a]
mov byte [rsp + 0xea], al
mov r8d, ebx
lea r9, [rsp + 0xd0]
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x38
mov al, r8b
sub al, cl
add al, r14b
xor byte [r9], al
add r8d, edi
add r9, rdi
cmp r8d, 0x1b
jl 0x1400447cc
lea rcx, [rsp + 0xd0]
call fcn.1401522e0
movups xmm0, xmmword [0x14030afc8]
movups xmmword [rsp + 0xd0], xmm0
movsd xmm1, qword [0x14030afd8]
movsd qword [rsp + 0xe0], xmm1
movzx eax, word [0x14030afe0]
mov word [rsp + 0xe8], ax
mov al, byte [0x14030afe2]
mov byte [rsp + 0xea], al
mov r8d, ebx
lea r9, [rsp + 0xd0]
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x38
mov al, r8b
sub al, cl
add al, r14b
xor byte [r9], al
add r8d, edi
add r9, rdi
cmp r8d, 0x1b
jl 0x14004484e
lea rcx, [rsp + 0xd0]
call fcn.1401522e0
movups xmm0, xmmword [0x14030a530]
movups xmmword [rsp + 0x90], xmm0
mov eax, dword [0x14030a540]
mov dword [rsp + 0xa0], eax
movzx eax, word [0x14030a544]
mov word [rsp + 0xa4], ax
mov al, byte [reloc.WLDAP32.dll_Ordinal_79]
mov byte [rsp + 0xa6], al
mov r8d, ebx
lea r9, [rsp + 0x90]
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x38
mov al, r8b
sub al, cl
add al, r14b
xor byte [r9], al
add r8d, edi
add r9, rdi
cmp r8d, 0x17
jl 0x1400448cc
lea rcx, [rsp + 0x90]
call fcn.1401522e0
movups xmm0, xmmword [0x14030a530]
movups xmmword [rsp + 0x90], xmm0
mov eax, dword [0x14030a540]
mov dword [rsp + 0xa0], eax
movzx eax, word [0x14030a544]
mov word [rsp + 0xa4], ax
mov al, byte [reloc.WLDAP32.dll_Ordinal_79]
mov byte [rsp + 0xa6], al
mov r8d, ebx
lea r9, [rsp + 0x90]
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x38
mov al, r8b
sub al, cl
add al, r14b
xor byte [r9], al
add r8d, edi
add r9, rdi
cmp r8d, 0x17
jl 0x14004494a
lea rcx, [rsp + 0x90]
call fcn.1401522e0
movups xmm0, xmmword [0x14030a2e0]
movups xmmword [rsp + 0x90], xmm0
mov eax, dword [0x14030a2f0]
mov dword [rsp + 0xa0], eax
movzx eax, word [0x14030a2f4]
mov word [rsp + 0xa4], ax
mov al, byte [reloc.WLDAP32.dll_Ordinal_79]
mov byte [rsp + 0xa6], al
mov r8d, ebx
lea r9, [rsp + 0x90]
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x38
mov al, r8b
sub al, cl
add al, r14b
xor byte [r9], al
add r8d, edi
add r9, rdi
cmp r8d, 0x17
jl 0x1400449c8
lea rcx, [rsp + 0x90]
call fcn.1401522e0
movups xmm0, xmmword [0x14030ca68]
movups xmmword [rsp + 0x90], xmm0
movsd xmm1, qword [0x14030ca78]
movsd qword [rsp + 0xa0], xmm1
cmp byte [0x14030ca7f], bl
je 0x140044a64
mov r8d, ebx
lea r9, [rsp + 0x90]
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x38
mov al, r8b
sub al, cl
add al, r14b
xor byte [r9], al
add r8d, edi
add r9, rdi
cmp r8d, 0x18
jl 0x140044a36
lea rcx, [rsp + 0x90]
call fcn.1401522e0
movups xmm0, xmmword [0x140309f98]
movups xmmword [rsp + 0xd0], xmm0
movsd xmm1, qword [0x140309fa8]
movsd qword [rsp + 0xe0], xmm1
movzx eax, word [0x140309fb0]
mov word [rsp + 0xe8], ax
cmp byte [0x140309fb1], bl
je 0x140044ae1
mov r8d, ebx
lea r9, [rsp + 0xd0]
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x38
mov al, r8b
sub al, cl
add al, r14b
xor byte [r9], al
add r8d, edi
add r9, rdi
cmp r8d, 0x1a
jl 0x140044ab3
lea rcx, [rsp + 0xd0]
call fcn.1401522e0
call qword [sym.imp.KERNEL32.dll_AllocConsole]
movzx eax, word [0x14030a37c]
mov word [rsp + 0x410], ax
cmp byte [0x14030a37d], bl
je 0x140044b44
mov r8d, ebx
lea r9, [rsp + 0x410]
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x38
mov al, r8b
sub al, cl
add al, r14b
xor byte [r9], al
add r8d, edi
add r9, rdi
cmp r8d, 2
jl 0x140044b16
mov eax, dword [str.ZUUUS]
mov dword [rsp + 0x80], eax
movzx eax, word [0x14030af14]
mov word [rsp + 0x84], ax
mov al, byte [0x14030af16]
mov byte [rsp + 0x86], al
mov r8d, ebx
lea r9, [rsp + 0x80]
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x38
mov al, r8b
sub al, cl
add al, r14b
xor byte [r9], al
add r8d, edi
add r9, rdi
cmp r8d, 7
jl 0x140044b78
xor ecx, ecx
call fcn.140136300
mov r8, rax
lea rdx, [rsp + 0x410]
lea rcx, [rsp + 0x80]
call fcn.140151610
movzx eax, word [0x14030aa6c]
mov word [rsp + 0x410], ax
cmp byte [0x14030aa6d], bl
je 0x140044c15
mov r8d, ebx
lea r9, [rsp + 0x410]
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x38
mov al, r8b
sub al, cl
add al, r14b
xor byte [r9], al
add r8d, edi
add r9, rdi
cmp r8d, 2
jl 0x140044be7
mov rax, qword [str.ZUUSHJe_QNOLN]
mov qword [rsp + 0x80], rax
mov r13d, 8
cmp byte [0x14030a32f], bl
je 0x140044c6a
mov r8d, ebx
lea r9, [rsp + 0x80]
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x38
mov al, r8b
sub al, cl
add al, r14b
xor byte [r9], al
add r8d, edi
add r9, rdi
cmp r8d, r13d
jl 0x140044c3d
mov ecx, edi
call fcn.140136300
mov r8, rax
lea rdx, [rsp + 0x410]
lea rcx, [rsp + 0x80]
call fcn.140151610
movzx eax, word [0x14030aa6c]
mov word [rsp + 0x410], ax
cmp byte [0x14030aa6d], bl
je 0x140044cd9
mov r8d, ebx
lea r9, [rsp + 0x410]
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x38
mov al, r8b
sub al, cl
add al, r14b
xor byte [r9], al
add r8d, edi
add r9, rdi
cmp r8d, 2
jl 0x140044cab
mov rax, qword [str.ZUUSHJe_QNOLN]
mov qword [rsp + 0x80], rax
cmp byte [0x14030a32f], bl
je 0x140044d28
mov r8d, ebx
lea r9, [rsp + 0x80]
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x38
mov al, r8b
sub al, cl
add al, r14b
xor byte [r9], al
add r8d, edi
add r9, rdi
cmp r8d, r13d
jl 0x140044cfb
mov ecx, 2
call fcn.140136300
mov r8, rax
lea rdx, [rsp + 0x410]
lea rcx, [rsp + 0x80]
call fcn.140151610
mov eax, dword [str.ZVH_QNOLN]
mov dword [rsp + 0x430], eax
cmp byte [reloc.WLDAP32.dll_Ordinal_60], bl
je 0x140044d98
mov r8d, ebx
lea r9, [rsp + 0x430]
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x38
mov al, r8b
sub al, cl
add al, r14b
xor byte [r9], al
add r8d, edi
add r9, rdi
cmp r8d, 4
jl 0x140044d6a
lea rcx, [rsp + 0x430]
call fcn.14015a258
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x10]
mov eax, dword [rdx + 0x30]
add eax, 0x100000
mov dword [rdx + 0x40], eax
mov rcx, r13
call fcn.14005f040
lea rcx, [0x140043fb0]
mov qword [rax], rcx
mov qword [rsp + 0x430], rax
lea rcx, [rsp + 0x98]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x14005ab7c]
xor edx, edx
xor ecx, ecx
call fcn.140152730
mov qword [rsp + 0x90], rax
test rax, rax
je 0x14004686f
cmp dword [rsp + 0x98], ebx
je 0x140046881
movaps xmm0, xmmword [rsp + 0x90]
movdqa xmmword [rsp + 0x430], xmm0
lea rcx, [rsp + 0x430]
call fcn.140062740
test eax, eax
jne 0x140046889
mov rcx, r13
call fcn.14005f040
lea rcx, [0x140043fd4]
mov qword [rax], rcx
mov qword [rsp + 0x430], rax
lea rcx, [rsp + 0x168]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x14005ab7c]
xor edx, edx
xor ecx, ecx
call fcn.140152730
mov qword [rsp + 0x160], rax
test rax, rax
je 0x140046990
cmp dword [rsp + 0x168], ebx
je 0x140046891
movaps xmm0, xmmword [rsp + 0x160]
movdqa xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x90]
call fcn.140062740
test eax, eax
jne 0x140046899
call fcn.140039c30
movsd xmm0, qword [str.owso]
movsd qword [rsp + 0x110], xmm0
movzx eax, word [0x14030a150]
mov word [rsp + 0x118], ax
mov al, byte [0x14030a152]
mov byte [rsp + 0x11a], al
mov r8d, ebx
lea r9, [rsp + 0x110]
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x38
mov al, r8b
sub al, cl
add al, r14b
xor byte [r9], al
add r8d, edi
add r9, rdi
cmp r8d, 0xb
jl 0x140044f02
lea rdx, [rsp + 0x110]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140044fa5
mov edx, 7
lea rcx, [rsp + 0x190]
call fcn.14003a8d0
mov r9, rax
lea rdx, [rsp + 0x1f8]
call fcn.1400469a4
mov r15, rax
cmp byte [rax + 0x31], bl
je 0x1400468a1
mov r8, rax
mov eax, esi
mul ebx
mov ecx, ebx
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 5
movsx eax, cl
imul ecx, eax, 0x38
mov al, bl
sub al, cl
add al, r14b
xor byte [r8], al
add ebx, edi
add r8, rdi
cmp ebx, 0x32
jge 0x1400468a1
jmp 0x140044f76
movups xmm0, xmmword [str.JNZNI]
movups xmmword [rsp + 0x230], xmm0
movups xmm1, xmmword [0x14030b890]
movups xmmword [rsp + 0x240], xmm1
mov eax, dword [0x14030b8a0]
mov dword [rsp + 0x250], eax
mov r8d, ebx
lea r9, [rsp + 0x230]
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x38
mov al, r8b
sub al, cl
add al, r14b
xor byte [r9], al
add r8d, edi
add r9, rdi
cmp r8d, 0x24
jl 0x140044fdb
lea rcx, [rsp + 0x230]
call fcn.14015a258
lea rcx, [rsp + 0x468]
call fcn.14003b144
nop
lea rdx, [0x140332738]
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae rdx, qword [0x140332738]
lea rcx, [rsp + 0x468]
cmp qword [rsp + 0x480], 0x10
cmovae rcx, qword [rsp + 0x468]
mov r8, qword [rsp + 0x478]
cmp r8, qword [0x140332748]
jne 0x14004672e
call fcn.14012e520
test eax, eax
jne 0x14004672e
movups xmm0, xmmword [0x14030a468]
movups xmmword [rsp + 0xd0], xmm0
movsd xmm1, qword [0x14030a478]
movsd qword [rsp + 0xe0], xmm1
cmp byte [0x14030a47f], bl
je 0x1400450d8
mov r8d, ebx
lea r9, [rsp + 0xd0]
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x38
mov al, r8b
sub al, cl
add al, r14b
xor byte [r9], al
add r8d, edi
add r9, rdi
cmp r8d, 0x18
jl 0x1400450aa
lea rcx, [rsp + 0xd0]
call fcn.1401522e0
movups xmm0, xmmword [0x14030ba68]
movups xmmword [rsp + 0x1b0], xmm0
movups xmm1, xmmword [0x14030ba78]
movups xmmword [rsp + 0x1c0], xmm1
movzx eax, word [0x14030ba88]
mov word [rsp + 0x1d0], ax
mov r8d, ebx
lea r9, [rsp + 0x1b0]
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x38
mov al, r8b
sub al, cl
add al, r14b
xor byte [r9], al
add r8d, edi
add r9, rdi
cmp r8d, 0x22
jl 0x14004511d
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xc0], rbx
mov qword [rsp + 0xc8], reloc.WS2_32.dll_ntohs
lea rax, [rsp + 0x1b0]
or r15, 0xffffffffffffffff
inc r15
cmp byte [rax + r15], bl
jne 0x140045173
lea rcx, [rsp + 0xb0]
cmp r15, 0xf
ja 0x1400451ac
mov qword [rsp + 0xc0], r15
mov r8, r15
lea rdx, [rsp + 0x1b0]
call fcn.14012dc80
mov byte [rsp + r15 + 0xb0], bl
jmp 0x1400451bc
lea r9, [rsp + 0x1b0]
mov rdx, r15
call fcn.14004cc58
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0xf0]
call fcn.140039764
mov r10, rax
mov ecx, dword [0x14030af60]
mov dword [rsp + 0x80], ecx
movzx ecx, word [0x14030af64]
mov word [rsp + 0x84], cx
mov r8d, ebx
lea r9, [rsp + 0x80]
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x38
mov al, r8b
sub al, cl
add al, r14b
xor byte [r9], al
add r8d, edi
add r9, rdi
cmp r8d, 6
jl 0x1400451fb
lea rdx, [rsp + 0x80]
mov rcx, r10
call fcn.14004c2e0
mov r12b, al
mov rdx, qword [rsp + 0x108]
mov r15d, 0x1000
cmp rdx, 0x10
jb 0x140045281
inc rdx
mov rcx, qword [rsp + 0xf0]
mov rax, rcx
cmp rdx, r15
jb 0x14004527c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400468d2
call fcn.14005e360
test r12b, r12b
jne 0x1400468d8
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
lea r8, [0x140043ec4]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
lea r8, [0x14003f510]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
lea r8, [0x14003f528]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.14003aea0
nop
movups xmm0, xmmword [0x14030a658]
movups xmmword [rsp + 0x170], xmm0
movsd xmm1, qword [0x14030a668]
movsd qword [rsp + 0x180], xmm1
mov eax, dword [0x14030a670]
mov dword [rsp + 0x188], eax
movzx eax, word [0x14030a674]
mov word [rsp + 0x18c], ax
cmp byte [0x14030a675], bl
je 0x140045375
mov r8d, ebx
lea r9, [rsp + 0x170]
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x38
mov al, r8b
sub al, cl
add al, r14b
xor byte [r9], al
add r8d, edi
add r9, rdi
cmp r8d, 0x1e
jl 0x140045347
mov qword [rsp + 0x140], rbx
mov qword [rsp + 0x150], rbx
mov qword [rsp + 0x158], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x140], bl
lea rax, [rsp + 0x170]
or r12, 0xffffffffffffffff
inc r12
cmp byte [rax + r12], bl
jne 0x1400453a4
lea rcx, [rsp + 0x140]
cmp r12, 0xf
ja 0x1400453dd
mov qword [rsp + 0x150], r12
mov r8, r12
lea rdx, [rsp + 0x170]
call fcn.14012dc80
mov byte [rsp + r12 + 0x140], bl
jmp 0x1400453ee
lea r9, [rsp + 0x170]
mov rdx, r12
call fcn.14004cc58
nop
movups xmm0, xmmword [0x14030ac78]
movups xmmword [rsp + 0x1f8], xmm0
movups xmm1, xmmword [0x14030ac88]
movups xmmword [rsp + 0x208], xmm1
movsd xmm0, qword [0x14030ac98]
movsd qword [rsp + 0x218], xmm0
mov al, byte [0x14030aca0]
mov byte [rsp + 0x220], al
mov r8d, ebx
lea r9, [rsp + 0x1f8]
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x38
mov al, r8b
sub al, cl
add al, r14b
xor byte [r9], al
add r8d, edi
add r9, rdi
cmp r8d, 0x29
jl 0x140045435
mov qword [rsp + 0x120], rbx
mov qword [rsp + 0x130], rbx
mov r12d, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x138], r12
mov byte [rsp + 0x120], bl
lea rax, [rsp + 0x1f8]
or rsi, 0xffffffffffffffff
inc rsi
cmp byte [rax + rsi], bl
jne 0x140045494
lea rcx, [rsp + 0x120]
cmp rsi, r12
ja 0x1400454ca
mov qword [rsp + 0x130], rsi
mov r8, rsi
lea rdx, [rsp + 0x1f8]
call fcn.14012dc80
mov byte [rsp + rsi + 0x120], bl
jmp 0x1400454db
lea r9, [rsp + 0x1f8]
mov rdx, rsi
call fcn.14004cc58
nop
lea r8, [rsp + 0x140]
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0x418]
call fcn.14003ef78
nop
mov rdx, qword [rsp + 0x138]
cmp rdx, 0x10
jb 0x140045538
inc rdx
mov rcx, qword [rsp + 0x120]
mov rax, rcx
cmp rdx, r15
jb 0x140045533
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140046920
call fcn.14005e360
mov qword [rsp + 0x130], rbx
mov qword [rsp + 0x138], r12
mov byte [rsp + 0x120], bl
mov rdx, qword [rsp + 0x158]
cmp rdx, 0x10
jb 0x14004558e
inc rdx
mov rcx, qword [rsp + 0x140]
mov rax, rcx
cmp rdx, r15
jb 0x140045589
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140046926
call fcn.14005e360
mov qword [rsp + 0x150], rbx
mov qword [rsp + 0x158], r12
mov byte [rsp + 0x140], bl
movzx r8d, byte [rsp + 0x418]
mov ecx, r8d
cmp r8d, 4
ja 0x1400455ee
test r8b, r8b
je 0x1400455e9
sub ecx, 1
je 0x1400455db
sub ecx, 1
jne 0x1400455ee
mov rdx, qword [rsp + 0x420]
mov rax, qword [rdx + 8]
sub rax, qword [rdx]
sar rax, 4
jmp 0x1400455f9
mov rdx, qword [rsp + 0x420]
mov rax, qword [rdx + 8]
jmp 0x1400455f9
mov rax, rbx
jmp 0x1400455f1
mov rax, rdi
mov rdx, qword [rsp + 0x420]
mov dword [0x14033643c], eax
mov rsi, rbx
movzx ecx, r8b
cmp ecx, 4
ja 0x140045632
test r8b, r8b
je 0x14004562d
sub ecx, 1
je 0x140045627
sub ecx, 1
jne 0x140045632
mov rax, qword [rdx + 8]
sub rax, qword [rdx]
sar rax, 4
jmp 0x140045635
mov rax, qword [rdx + 8]
jmp 0x140045635
mov rax, rbx
jmp 0x140045635
mov rax, rdi
cmp rsi, rax
jae 0x140045b07
mov rdx, rsi
lea rcx, [rsp + 0x418]
call fcn.140047e38
mov rcx, rax
mov qword [rsp + 0xc8], r12
mov qword [rsp + 0xc0], r13
mov rax, qword [str.Programe]
mov qword [rsp + 0xb0], rax
mov byte [rsp + 0xb8], bl
lea rdx, [rsp + 0xb0]
call fcn.140047bd4
lea rdx, [rsp + 0xf0]
mov rcx, rax
call fcn.14004bfa8
mov r14, rsi
shl r14, 5
lea rcx, [0x140000000]
lea rcx, [rcx + 0x338b00]
add rcx, r14
cmp rcx, rax
je 0x1400456bc
mov r8b, bl
mov rdx, rax
call fcn.14004a5a4
mov rdx, qword [rsp + 0x108]
cmp rdx, 0x10
jb 0x1400456fb
inc rdx
mov rcx, qword [rsp + 0xf0]
mov rax, rcx
cmp rdx, r15
jb 0x1400456f6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004692c
call fcn.14005e360
mov rdx, rsi
lea rcx, [rsp + 0x418]
call fcn.140047e38
mov rcx, rax
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xc8], r12
mov qword [rsp + 0xc0], 6
mov eax, dword [str.Status]
mov dword [rsp + 0xb0], eax
movzx eax, word [0x14030b6b0]
mov word [rsp + 0xb4], ax
mov byte [rsp + 0xb6], bl
lea rdx, [rsp + 0xb0]
call fcn.140047bd4
lea rdx, [rsp + 0xf0]
mov rcx, rax
call fcn.14004bfa8
lea rcx, [0x140000000]
lea rcx, [rcx + 0x3371d0]
add rcx, r14
cmp rcx, rax
je 0x14004578b
mov r8b, bl
mov rdx, rax
call fcn.14004a5a4
mov rdx, qword [rsp + 0x108]
cmp rdx, 0x10
jb 0x1400457ca
inc rdx
mov rcx, qword [rsp + 0xf0]
mov rax, rcx
cmp rdx, r15
jb 0x1400457c5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140046932
call fcn.14005e360
mov rdx, rsi
lea rcx, [rsp + 0x418]
call fcn.140047e38
mov rcx, rax
mov qword [rsp + 0xc8], r12
mov qword [rsp + 0xc0], select
movsd xmm0, qword [str.updateddate]
movsd qword [rsp + 0xb0], xmm0
movzx eax, word [0x14030b6c0]
mov word [rsp + 0xb8], ax
mov al, byte [0x14030b6c2]
mov byte [rsp + 0xba], al
mov byte [rsp + 0xbb], bl
lea rdx, [rsp + 0xb0]
call fcn.140047bd4
lea rdx, [rsp + 0xf0]
mov rcx, rax
call fcn.14004bfa8
lea rcx, [0x140000000]
lea rcx, [rcx + 0x337810]
add rcx, r14
cmp rcx, rax
je 0x140045863
mov r8b, bl
mov rdx, rax
call fcn.14004a5a4
mov rdx, qword [rsp + 0x108]
cmp rdx, 0x10
jb 0x1400458a2
inc rdx
mov rcx, qword [rsp + 0xf0]
mov rax, rcx
cmp rdx, r15
jb 0x14004589d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140046938
call fcn.14005e360
mov rdx, rsi
lea rcx, [rsp + 0x418]
call fcn.140047e38
mov rcx, rax
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xc8], r12
mov qword [rsp + 0xc0], 4
mov eax, dword [str.Name]
mov dword [rsp + 0xb0], eax
mov byte [rsp + 0xb4], bl
lea rdx, [rsp + 0xb0]
call fcn.140047bd4
lea rdx, [rsp + 0xf0]
mov rcx, rax
call fcn.14004bfa8
lea rcx, [0x140000000]
lea rcx, [rcx + 0x338490]
add rcx, r14
cmp rcx, rax
je 0x140045923
mov r8b, bl
mov rdx, rax
call fcn.14004a5a4
mov rdx, qword [rsp + 0x108]
cmp rdx, 0x10
jb 0x140045962
inc rdx
mov rcx, qword [rsp + 0xf0]
mov rax, rcx
cmp rdx, r15
jb 0x14004595d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004693e
call fcn.14005e360
mov rdx, rsi
lea rcx, [rsp + 0x418]
call fcn.140047e38
mov rcx, rax
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xc8], r12
mov qword [rsp + 0xc0], 5
mov eax, dword [str.image]
mov dword [rsp + 0xb0], eax
mov al, byte [0x14030b6c8]
mov byte [rsp + 0xb4], al
mov byte [rsp + 0xb5], bl
lea rdx, [rsp + 0xb0]
call fcn.140047bd4
lea rdx, [rsp + 0xf0]
mov rcx, rax
call fcn.14004bfa8
lea rcx, [0x140000000]
lea rcx, [rcx + 0x339170]
add rcx, r14
cmp rcx, rax
je 0x1400459f0
mov r8b, bl
mov rdx, rax
call fcn.14004a5a4
mov rdx, qword [rsp + 0x108]
cmp rdx, 0x10
jb 0x140045a2f
inc rdx
mov rcx, qword [rsp + 0xf0]
mov rax, rcx
cmp rdx, r15
jb 0x140045a2a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140046944
call fcn.14005e360
mov rdx, rsi
lea rcx, [rsp + 0x418]
call fcn.140047e38
mov rcx, rax
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xc8], r12
mov qword [rsp + 0xc0], 4
mov eax, dword [str.link]
mov dword [rsp + 0xb0], eax
mov byte [rsp + 0xb4], bl
lea rdx, [rsp + 0xb0]
call fcn.140047bd4
lea rdx, [rsp + 0xf0]
mov rcx, rax
call fcn.14004bfa8
lea rcx, [0x140000000]
lea rcx, [rcx + 0x336b90]
add rcx, r14
cmp rcx, rax
je 0x140045ab0
mov r8b, bl
mov rdx, rax
call fcn.14004a5a4
mov rdx, qword [rsp + 0x108]
cmp rdx, 0x10
jb 0x140045aef
inc rdx
mov rcx, qword [rsp + 0xf0]
mov rax, rcx
cmp rdx, r15
jb 0x140045aea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004694a
call fcn.14005e360
add rsi, rdi
mov rdx, qword [rsp + 0x420]
mov r8b, byte [rsp + 0x418]
jmp 0x140045602
mov dl, r8b
lea rcx, [rsp + 0x420]
call fcn.140049858
nop
call fcn.14003aea0
lea rcx, [rsp + 0x190]
call fcn.14003b9b0
lea rcx, [0x140332758]
cmp rcx, rax
je 0x140045b41
mov r8b, bl
mov rdx, rax
call fcn.14004a5a4
mov rdx, qword [rsp + 0x1a8]
cmp rdx, 0x10
jb 0x140045b80
inc rdx
mov rcx, qword [rsp + 0x190]
mov rax, rcx
cmp rdx, r15
jb 0x140045b7b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140046950
call fcn.14005e360
call fcn.14003aea0
mov edx, Ordinal_26
lea rcx, [rsp + 0x448]
call fcn.14003a8d0
nop
mov dword [rsp + 0x3c0], 0x50
mov dword [rsp + 0x3c4], 0x40
lea rax, [0x140046aa0]
mov qword [rsp + 0x3c8], rax
mov qword [rsp + 0x3d0], rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x3d8], rax
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x3e0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x3f0], xmm1
lea rcx, [rsp + 0x448]
call fcn.140039ec8
mov qword [rsp + 0x400], rax
mov qword [rsp + 0x408], rbx
lea rcx, [rsp + 0x3c0]
call qword [sym.imp.USER32.dll_RegisterClassExA]
lea rcx, [rsp + 0x448]
call fcn.140039ec8
mov r8, rax
mov qword [rsp + 0x58], rbx
mov rax, qword [rsp + 0x3d8]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x38], 5
mov dword [rsp + 0x30], 5
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
mov r9d, 0x80000000
mov rdx, qword [rsp + 0x400]
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [0x140336410], rax
call fcn.1400395b4
test al, al
jne 0x140045d6d
mov rcx, qword [0x140336448]
test rcx, rcx
je 0x140045c9f
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [0x140336448], rbx
mov rcx, qword [0x140336418]
test rcx, rcx
je 0x140045cb8
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [0x140336418], rbx
mov rdx, qword [rsp + 0x3d8]
mov rcx, qword [rsp + 0x400]
call qword [sym.imp.USER32.dll_UnregisterClassA]
nop
mov rdx, qword [rsp + 0x460]
cmp rdx, 0x10
jb 0x140045d0e
inc rdx
mov rcx, qword [rsp + 0x448]
mov rax, rcx
cmp rdx, r15
jb 0x140045d09
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004695c
call fcn.14005e360
mov qword [rsp + 0x458], rbx
mov qword [rsp + 0x460], r12
mov byte [rsp + 0x448], bl
mov rdx, qword [rsp + 0x480]
cmp rdx, 0x10
jb 0x140046727
inc rdx
mov rcx, qword [rsp + 0x468]
mov rax, rcx
cmp rdx, r15
jb 0x140045d63
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140046962
call fcn.14005e360
jmp 0x140046727
xor edx, edx
mov rcx, qword [0x140336410]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x140336410]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rax, qword [0x140336400]
test rax, rax
je 0x140045d9b
add dword [rax + 0x3b0], edi
mov ecx, 0x3e48
call fcn.14014f710
mov qword [rsp + 0x80], rax
lea rcx, [rsp + 0x410]
mov qword [rsp + 0x430], rcx
mov qword [rsp + 0x110], rax
test rax, rax
je 0x140045dd9
xor edx, edx
mov rcx, rax
call fcn.14000198c
mov rcx, rax
jmp 0x140045ddc
mov rcx, rbx
mov rax, qword [0x140336400]
test rax, rax
cmove rax, rcx
mov qword [0x140336400], rax
call fcn.140007280
mov rsi, qword [0x140336400]
mov qword [rsp + 0x430], rsi
bts dword [rsi + 8], 0xa
lea rcx, [rsp + 0x260]
call fcn.140025ea8
mov qword [rsi + 0x20], rbx
mov qword [rsi + 0x28], rbx
mov byte [rsp + 0x2a8], dil
mov byte [rsp + 0x280], dil
mov eax, 3
mov dword [rsp + 0x278], eax
mov dword [rsp + 0x27c], eax
lea rcx, [rsp + 0x2f0]
call fcn.140025ea8
mov byte [rsp + 0x2fc], bl
mov qword [rsp + 0x28], rbx
lea rax, [rsp + 0x2f0]
mov qword [rsp + 0x20], rax
movss xmm6, dword [0x14030cbac]
movaps xmm3, xmm6
mov r8d, 0x225bc
lea rdx, [0x1402e7790]
mov rcx, qword [rsi + 0xa8]
call fcn.140026628
lea rax, [0x14030b568]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x260]
mov qword [rsp + 0x20], rax
movss xmm3, dword [0x14030cbb4]
lea rdx, [0x1402c90f0]
mov rcx, qword [rsi + 0xa8]
call fcn.140026744
mov qword [0x140336440], rax
mov rcx, qword [rsi + 0xa8]
call fcn.1400263e0
lea rax, [0x140309e18]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2f0]
mov qword [rsp + 0x20], rax
movaps xmm3, xmm6
mov r12d, 0xe5510
mov r8d, r12d
lea r14, [0x1401e3be0]
mov rdx, r14
mov rcx, qword [rsi + 0xa8]
call fcn.140026628
mov qword [0x140336420], rax
lea rax, [0x140309e18]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2f0]
mov qword [rsp + 0x20], rax
movss xmm3, dword [0x14030cbe0]
mov r8d, r12d
mov rdx, r14
mov rcx, qword [rsi + 0xa8]
call fcn.140026628
mov qword [0x140336408], rax
lea rax, [0x140309e18]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2f0]
mov qword [rsp + 0x20], rax
movss xmm3, dword [0x14030cbdc]
mov r8d, r12d
mov rdx, r14
mov rcx, qword [rsi + 0xa8]
call fcn.140026628
mov qword [0x140336430], rax
lea rax, [0x140336428]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x60], rbx
mov dword [rsp + 0x58], ebx
or eax, 0xffffffff
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], reloc.WLDAP32.dll_Ordinal_50
mov r9d, 0x190
mov r8d, 0x435b
lea rdx, [0x14032e1e0]
mov rcx, qword [0x140336448]
call qword [sym.imp.d3dx9_43.dll_D3DXCreateTextureFromFileInMemoryEx]
mov rax, qword [0x140336400]
test dword [rsi + 8], 0x400
je 0x140046006
mov dword [rax + 0x164c], ebx
mov dword [rax + 0x1728], 0x3f800000
mov r12, qword [0x140336410]
lea rcx, [0x140339808]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x140046123
lea rcx, [0x140339800]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x140046123
mov r14, qword [0x140336400]
lea rsi, [r14 + 8]
or dword [rsi + 4], 0xc06
lea rax, str.imgui_impl_win32
mov qword [rsi + 0xd8], rax
mov qword [0x1403397f8], r12
mov rax, qword [r14 + 0x1d40]
mov rcx, qword [rax]
mov qword [rcx + 0x58], r12
mov qword [rcx + 0x50], r12
test dword [rsi], 0x400
je 0x140046084
call fcn.14002d110
mov r14, qword [0x140336400]
mov dword [rsi + 0x34], 9
mov dword [rsi + 0x38], Ordinal_41
mov dword [rsi + 0x3c], Ordinal_41
mov dword [rsi + 0x40], Ordinal_41
mov dword [rsi + 0x44], Ordinal_41
mov dword [rsi + 0x48], reloc.WLDAP32.dll_Ordinal_33
mov dword [rsi + 0x4c], Ordinal_35
mov dword [rsi + 0x50], Ordinal_41
mov dword [rsi + 0x54], reloc.WLDAP32.dll_Ordinal_35
mov dword [rsi + 0x58], reloc.WLDAP32.dll_Ordinal_45
mov dword [rsi + 0x5c], reloc.WLDAP32.dll_Ordinal_46
mov dword [rsi + 0x60], r13d
mov dword [rsi + 0x64], reloc.WLDAP32.dll_Ordinal_32
mov eax, reloc.WS2_32.dll_listen
mov dword [rsi + 0x68], eax
mov dword [rsi + 0x6c], reloc.WLDAP32.dll_Ordinal_27
mov dword [rsi + 0x70], eax
mov dword [rsi + 0x74], 0x41
mov dword [rsi + 0x78], 0x43
mov dword [rsi + 0x7c], 0x56
mov dword [rsi + 0x80], 0x58
mov dword [rsi + 0x84], 0x59
mov dword [rsi + 0x88], 0x5a
jmp 0x14004612a
mov r14, qword [0x140336400]
mov rcx, qword [0x140336448]
lea rax, str.imgui_impl_dx9
mov qword [r14 + 0xe8], rax
or dword [r14 + 0xc], 0x1008
mov qword [0x1403397e0], rcx
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
test dword [r14 + 8], 0x400
je 0x1400461ab
mov rax, qword [0x140336400]
lea rcx, [fcn.14002b804]
mov qword [rax + 0x15f0], rcx
lea rcx, [fcn.14002b8dc]
mov qword [rax + 0x15f8], rcx
lea rcx, [0x14002b940]
mov qword [rax + 0x1600], rcx
lea rcx, [0x14002b990]
mov qword [rax + 0x1608], rcx
lea rcx, [0x14002bad0]
mov qword [rax + 0x1610], rcx
mov edx, recv
lea rcx, [rsp + 0x1d8]
call fcn.14003a8d0
nop
mov rcx, rax
call fcn.140039ec8
mov rsi, rax
mov qword [rsp + 0x80], rax
mov rdx, qword [rsp + 0x1f0]
cmp rdx, 0x10
jb 0x140046210
inc rdx
mov rcx, qword [rsp + 0x1d8]
mov rax, rcx
cmp rdx, r15
jb 0x14004620b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140046956
call fcn.14005e360
mov qword [rsp + 0x1e8], rbx
mov qword [rsp + 0x1f0], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x1d8], bl
xorps xmm0, xmm0
movups xmmword [rsp + 0x488], xmm0
movups xmmword [rsp + 0x498], xmm0
movups xmmword [rsp + 0x4a8], xmm0
movss xmm6, dword [0x14030cb28]
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x488]
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x14004628d
lea rcx, [rsp + 0x488]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x488]
call qword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x14004651a
cmp qword [0x1403397d0], rbx
jne 0x14004629b
call fcn.14002b6c4
call fcn.14002c0c8
call fcn.140006410
call fcn.140042eb4
mov cl, byte [0x1403363f9]
mov rax, qword [0x140336400]
test cl, cl
jne 0x1400462dc
or dword [rax + 0x1c40], 2
mov dword [rax + 0x1c64], 0x440a4000
mov dword [rax + 0x1c68], 0x43bb0000
mov dword [rax + 0x1c48], edi
cmp cl, dil
jne 0x140046302
or dword [rax + 0x1c40], 2
mov dword [rax + 0x1c64], 0x443c0000
mov dword [rax + 0x1c68], 0x440b4000
mov dword [rax + 0x1c48], edi
mov dword [rsp + 0x440], 0x3f000000
mov dword [rsp + 0x444], 0x3f000000
lea rdx, [rsp + 0x440]
mov ecx, 5
call fcn.1400035a8
xor edx, edx
mov r8d, Ordinal_301
mov rcx, rsi
call fcn.14000beac
call fcn.14003f54c
call fcn.14000e3b8
mov ecx, edi
call fcn.140003634
cmp byte [0x1403363fb], dil
jne 0x140046359
call fcn.14003a270
cmp byte [0x1403363fa], dil
jne 0x140046367
call fcn.14003a654
call fcn.14000826c
mov rcx, qword [0x140336448]
mov rax, qword [rcx]
mov dword [rsp + 0x30], ebx
movss dword [rsp + 0x28], xmm6
mov dword [rsp + 0x20], ebx
mov r9d, 3
xor r8d, r8d
xor edx, edx
call qword [rax + 0x158]
mov rcx, qword [0x140336448]
mov rax, qword [rcx]
call qword [rax + 0x148]
test eax, eax
js 0x1400463e5
call fcn.1400086a4
mov rax, qword [0x140336400]
mov rcx, qword [rax + 0x1d40]
mov rdx, qword [rcx]
add rdx, 0xb0
mov al, byte [rdx]
neg al
sbb rcx, rcx
and rcx, rdx
call fcn.14002af98
mov rcx, qword [0x140336448]
mov rax, qword [rcx]
call qword [rax + 0x150]
mov rax, qword [rsp + 0x430]
test dword [rax + 8], 0x400
je 0x1400464c1
call fcn.140015a0c
mov rsi, qword [0x140336400]
mov r13d, edi
mov eax, dword [rsi + 0x1630]
cmp eax, edi
jle 0x140046463
mov r12d, 8
mov rax, qword [rsi + 0x1638]
mov r14, qword [r12 + rax]
test byte [r14 + 4], 0x80
jne 0x140046451
mov rax, qword [rsi + 0x15c0]
test rax, rax
je 0x14004643e
xor edx, edx
mov rcx, r14
call rax
mov rax, qword [rsi + 0x1608]
test rax, rax
je 0x140046451
xor edx, edx
mov rcx, r14
call rax
add r13d, edi
add r12, 8
mov eax, dword [rsi + 0x1630]
cmp r13d, eax
jl 0x140046419
mov r13d, edi
cmp eax, edi
jle 0x1400464b9
mov r14d, 8
mov rax, qword [rsi + 0x1638]
mov r12, qword [r14 + rax]
test byte [r12 + 4], 0x80
jne 0x1400464a9
mov rax, qword [rsi + 0x15c8]
test rax, rax
je 0x140046496
xor edx, edx
mov rcx, r12
call rax
mov rax, qword [rsi + 0x1610]
test rax, rax
je 0x1400464a9
xor edx, edx
mov rcx, r12
call rax
add r13d, edi
add r14, 8
cmp r13d, dword [rsi + 0x1630]
jl 0x140046470
mov rsi, qword [rsp + 0x80]
mov rcx, qword [0x140336448]
mov rax, qword [rcx]
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [rax + 0x88]
cmp eax, 0x88760868
jne 0x14004651a
mov rcx, qword [0x140336448]
mov rax, qword [rcx]
call qword [rax + Ordinal_26]
cmp eax, 0x88760869
jne 0x14004651a
call fcn.14002b738
mov rcx, qword [0x140336448]
mov rax, qword [rcx]
lea rdx, [0x140336450]
call qword [rax + 0x80]
call fcn.14002b6c4
cmp dword [rsp + 0x490], 0x12
jne 0x14004624e
call fcn.140015fa4
call fcn.14002b738
mov rcx, qword [0x1403397e0]
test rcx, rcx
je 0x14004654b
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [0x1403397e0], rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, rax
lea rcx, str.ImGui_Platform
call qword [sym.imp.USER32.dll_UnregisterClassA]
mov qword [0x1403397f8], rbx
mov rdi, qword [0x140336400]
mov rcx, rdi
call fcn.140007470
mov rax, qword [0x140336400]
cmp rax, rdi
cmove rax, rbx
mov qword [0x140336400], rax
test rdi, rdi
je 0x1400465b5
mov rcx, rdi
call fcn.14001d240
mov rax, qword [0x140336400]
test rax, rax
je 0x1400465ad
dec dword [rax + 0x3b0]
mov rcx, rdi
call fcn.140145870
mov rcx, qword [0x140336448]
test rcx, rcx
je 0x1400465ce
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [0x140336448], rbx
mov rcx, qword [0x140336418]
test rcx, rcx
je 0x1400465e7
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [0x140336418], rbx
mov rcx, qword [0x140336410]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rdx, qword [rsp + 0x3d8]
mov rcx, qword [rsp + 0x400]
call qword [sym.imp.USER32.dll_UnregisterClassA]
nop
mov rdx, qword [rsp + 0x460]
cmp rdx, 0x10
jb 0x14004664a
inc rdx
mov rcx, qword [rsp + 0x448]
mov rax, rcx
cmp rdx, r15
jb 0x140046645
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004695c
call fcn.14005e360
mov qword [rsp + 0x458], rbx
mov qword [rsp + 0x460], 0xf
mov byte [rsp + 0x448], bl
mov rdx, qword [rsp + 0x480]
cmp rdx, 0x10
jb 0x1400466a4
inc rdx
mov rcx, qword [rsp + 0x468]
mov rax, rcx
cmp rdx, r15
jb 0x14004669f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140046962
call fcn.14005e360
xor eax, eax
mov rcx, qword [rsp + 0x4c0]
xor rcx, rsp
call fcn.14005e190
lea r11, [rsp + 0x4e0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
ret
mov eax, edi
jmp 0x1400466a6
mov edx, 0xa
lea rcx, [rsp + 0x190]
call fcn.14003a8d0
mov rdx, rax
lea rcx, [0x140332890]
call fcn.1400484dc
lea rcx, [rsp + 0x190]
call fcn.140048480
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
mov r9d, 0x1194
lea r8, [0x140044258]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rdx, [rsp + 0xd0]
call fcn.1400469d4
mov r10, rax
cmp byte [rax + 0x19], bl
je 0x1400467c5
mov r8d, ebx
mov r9, rax
mov eax, esi
mul r8d
mov ecx, r8d
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 5
movsx eax, cl
imul ecx, eax, 0x38
mov al, r8b
sub al, cl
add al, r14b
xor byte [r9], al
add r8d, edi
add r9, rdi
cmp r8d, 0x1a
jl 0x140046797
mov rcx, r10
call fcn.1401522e0
lea rdx, [rsp + 0x1b0]
call fcn.1400469fc
mov r10, rax
cmp byte [rax + 0x27], bl
je 0x140046816
mov r8d, ebx
mov r9, rax
mov eax, esi
mul r8d
mov ecx, r8d
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 5
movsx eax, cl
imul ecx, eax, 0x38
mov al, r8b
sub al, cl
add al, r14b
xor byte [r9], al
add r8d, edi
add r9, rdi
cmp r8d, 0x28
jl 0x1400467e8
mov rcx, r10
call fcn.14015a258
lea rdx, [rsp + 0x2f0]
call fcn.140046a24
mov r15, rax
cmp byte [rax + 0xc7], bl
je 0x140046968
mov r8, rax
mov eax, esi
mul ebx
mov ecx, ebx
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 5
movsx eax, cl
imul edx, eax, 0x38
mov al, bl
sub al, dl
add al, r14b
xor byte [r8], al
add ebx, edi
add r8, rdi
cmp ebx, 0xc8
jge 0x140046968
jmp 0x14004683d
mov dword [rsp + 0x98], ebx
mov ecx, 6
call fcn.1400609b8
nop
mov ecx, edi
call fcn.1400609b8
int3
mov ecx, eax
call fcn.14006097c
nop
mov ecx, edi
call fcn.1400609b8
int3
mov ecx, eax
call fcn.14006097c
nop
mov rcx, r9
call fcn.14004832c
mov r8, rax
mov r9d, 0x40010
mov rdx, r15
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rcx, [rsp + 0x190]
call fcn.140048480
mov ecx, edi
call fcn.140151260
nop
call fcn.14015e7b0
int3
lea r9, [rsp + 0x410]
xor r8d, r8d
mov dl, dil
lea ecx, [r8 + 0x13]
call qword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
lea rax, [rsp + 0x440]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc0000420
call qword [sym.imp.ntdll.dll_NtRaiseHardError]
xor ecx, ecx
call fcn.140151260
nop
call fcn.14015e7b0
nop
call fcn.14015e7b0
int3
call fcn.14015e7b0
int3
call fcn.14015e7b0
int3
call fcn.14015e7b0
int3
call fcn.14015e7b0
int3
call fcn.14015e7b0
int3
call fcn.14015e7b0
nop
call fcn.14015e7b0
nop
call fcn.14015e7b0
nop
call fcn.14015e7b0
nop
call fcn.14015e7b0
nop
lea rcx, [0x140332890]
call fcn.14003ada8
mov r8, rax
mov r9d, 0x40010
mov rdx, r15
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, edi
call fcn.140151260
nop
mov dword [rsp + 0x168], ebx
mov ecx, 6
call fcn.1400609b8
int3