Function at 0x140006b60
Capabilities:
Execute command
Schedule task via at
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov rax, qword [0x1400cd740]
xor rax, rsp
mov qword [rbp + 0x10], rax
xor r12d, r12d
lea rcx, str._n_n_n_n_n
call fcn.140001f50
call fcn.1400068d0
test al, al
jne 0x140006bcd
lea rcx, str.counter_strike_is_not_open__closing..._n
call fcn.140001f50
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, str.Enter_your_key:
call fcn.140001f50
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, rax
mov edx, 0x80
lea rcx, [rbp - 0x70]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgets]
test rax, rax
jne 0x140006c4f
lea ecx, [rax + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Error_reading_key_input_n
call fcn.140001090
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov eax, 1
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.1400a6800
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
lea rdx, [0x1400bd5cc]
lea rcx, [rbp - 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcspn]
cmp rax, 0x80
jae 0x1400070d8
mov byte [rbp + rax - 0x70], r12b
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov ecx, Ordinal_27
call fcn.1400a6820
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x80], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x68], r12b
call fcn.140045a10
mov rbx, rax
test rax, rax
jne 0x140006d17
mov byte [rsp + 0x61], 1
mov rax, qword [rbp - 0x80]
cmp rax, 0x13
jb 0x140006cfc
lea rbx, [rsp + 0x68]
cmp rax, 0x10
cmovae rbx, qword [rsp + 0x68]
mov qword [rsp + 0x78], reloc.WS2_32.dll_send
mov r8d, reloc.WS2_32.dll_send
lea rdx, str.unable_to_init_curl
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x13], 0
jmp 0x140006e09
lea r9, str.unable_to_init_curl
mov edx, reloc.WS2_32.dll_send
lea rcx, [rsp + 0x68]
call fcn.140001d60
jmp 0x140006e09
lea r8, str.http:__3.85.89.169:80_check
mov edx, 0x2712
mov rcx, rbx
call fcn.140048ab0
mov edx, Ordinal_50
lea r8d, [rdx - 0x2e]
mov rcx, rbx
call fcn.140048ab0
call fcn.1400a2e50
mov rdi, rax
lea rcx, [rbp - 0x70]
call fcn.1400a3110
mov r8, rax
lea rdx, [0x1400b87b4]
mov rcx, rdi
call fcn.1400a2f70
xor edx, edx
mov rcx, rdi
call fcn.1400a3ee0
mov rsi, rax
mov r8, rax
mov edx, 0x271f
mov rcx, rbx
call fcn.140048ab0
lea rdx, str.Content_Type:_application_json
xor ecx, ecx
call fcn.140045d30
mov r14, rax
mov r8, rax
mov edx, 0x2727
mov rcx, rbx
call fcn.140048ab0
test rdi, rdi
je 0x140006dc2
mov rcx, qword [rdi + 8]
cmp rcx, 0xffffffffffffffff
je 0x140006dc2
mov rcx, qword [rdi + 8]
sub rcx, 1
mov qword [rdi + 8], rcx
jne 0x140006dc2
mov rcx, rdi
call fcn.1400a2d20
lea r8, [0x140001360]
mov edx, 0x4e2b
mov rcx, rbx
call fcn.140048ab0
lea r8, [rsp + 0x50]
mov edx, 0x2711
mov rcx, rbx
call fcn.140048ab0
mov rcx, rbx
call fcn.140045a80
mov rcx, rbx
call fcn.1400459e0
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, r14
call fcn.140045dd0
cmp byte [rsp + 0x61], 0
je 0x14000702b
mov rsi, qword [rsp + 0x78]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, rsi
cmp rax, 7
jb 0x1400070aa
lea r15, [rsp + 0x68]
cmp qword [rbp - 0x80], 0x10
cmovae r15, qword [rsp + 0x68]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
lea r14, [rsi + 7]
mov ebx, reloc.WS2_32.dll_ntohs
lea rdi, [rsp + 0x20]
cmp r14, rbx
jbe 0x140006ee2
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x140006ea3
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400a6820
test rax, rax
je 0x140006f84
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140006edd
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140006ecb
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400070b0
jmp 0x140006e84
test rcx, rcx
je 0x140006eda
call fcn.1400a6820
mov rdi, rax
jmp 0x140006edd
mov rdi, r12
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], rbx
mov eax, dword [str.error:]
mov dword [rdi], eax
movzx eax, word [0x1400bd5d4]
mov word [rdi + 4], ax
movzx eax, byte [reloc.WLDAP32.dll_Ordinal_32]
mov byte [rdi + 6], al
lea rcx, [rdi + 7]
mov r8, rsi
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0
lea rdx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0x10
cmovae rdx, qword [rsp + 0x20]
mov r8, qword [rsp + 0x30]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140007dd0
mov rcx, rax
lea rdx, [0x1400079f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140006f91
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006f8b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006f8b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a685c
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x140006fd0
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006fcb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006fcb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a685c
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x80], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x68], 0
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx + 8]
mov qword [rax], r12
mov rcx, qword [rcx]
test rcx, rcx
je 0x140007015
nop word [rax + rax]
mov rbx, qword [rcx]
mov edx, Ordinal_27
call fcn.1400a685c
mov rcx, rbx
test rbx, rbx
jne 0x140007000
mov edx, Ordinal_27
mov rcx, qword [rsp + 0x50]
call fcn.1400a685c
xor eax, eax
jmp 0x140006c22
lea rcx, [rsp + 0x40]
call fcn.140007190
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.1400071e0
lea rcx, [rsp + 0x48]
call fcn.140007190
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x50]
call fcn.1400071d0
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x40]
call fcn.1400071c0
test al, al
je 0x1400070b6
lea rcx, [rsp + 0x40]
call fcn.1400071b0
mov rax, qword [rax]
mov rdx, rax
shr rdx, 0x20
mov ecx, eax
call fcn.140006880
lea rcx, [rsp + 0x40]
call fcn.1400071a0
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x40]
call fcn.1400071c0
test al, al
je 0x1400070b6
jmp 0x140007070
call fcn.140001280
int3
call fcn.1400011e0
int3
lea rcx, [rsp + 0x20]
call fcn.140003fe0
movups xmm0, xmmword [rax]
movups xmmword [0x1400ce028], xmm0
movq qword [0x1400ce020], xmm0
call fcn.1400057a0
nop
call fcn.1400a6998
int3