Function at 0x14003e490
Capabilities:
Create thread
Execute command

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xf0
mov rax, qword [0x1400da040]
xor rax, rsp
mov qword [rbp + 0x37], rax
xor edi, edi
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
lea rdx, [rbp - 0x59]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov edx, dword [rbp - 0x59]
and edx, 0x80
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
mov dword [rbp - 0x29], 0x60
lea rdx, [rbp - 0x29]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfoEx]
mov dword [rbp - 0x25], 0x140064
mov dword [rbp - 0x1b], edi
mov dword [rbp - 0x17], 0x140064
mov dword [rbp - 0x13], 0x140064
lea rdx, [rbp - 0x29]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferInfoEx]
lea rdx, [rbp - 0x69]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov edx, dword [rbp - 0x69]
and edx, 0xfffffffd
mov dword [rbp - 0x69], edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rbx, rax
lea edx, [rdi - 0x10]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0xfffaffff
mov r8d, eax
lea edx, [rdi - 0x10]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowLongW]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rbx, rax
lea rdx, [rbp - 0x39]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0x190
mov r9d, 0x320
mov r8d, dword [rbp - 0x35]
mov edx, dword [rbp - 0x39]
mov rcx, rbx
call qword [sym.imp.USER32.dll_MoveWindow]
lea rcx, [0x1400ca044]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x140639790], eax
lea ecx, [rdi + 1]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x14063978c], eax
lea ecx, [rdi + 8]
call fcn.1400a51c0
lea rcx, [0x14003df30]
mov qword [rax], rcx
mov qword [rbp - 0x49], rax
lea rcx, [rbp - 0x61]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x14003efb0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x69], rax
test rax, rax
je 0x14003e8fb
cmp dword [rbp - 0x61], edi
je 0x14003e8ef
movaps xmm0, xmmword [rbp - 0x69]
movdqa xmmword [rbp - 0x49], xmm0
lea rcx, [rbp - 0x49]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14003e8ef
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x69], xmm0
lea ecx, [rdi + 8]
call fcn.1400a51c0
lea rcx, [0x14003d5d0]
mov qword [rax], rcx
mov qword [rbp - 0x49], rax
lea rcx, [rbp - 0x61]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x14003efb0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x69], rax
test rax, rax
je 0x14003e8e0
cmp dword [rbp - 0x61], edi
je 0x14003e8d4
movaps xmm0, xmmword [rbp - 0x69]
movdqa xmmword [rbp - 0x49], xmm0
lea rcx, [rbp - 0x49]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14003e8d4
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x69], xmm0
lea ecx, [rdi + 8]
call fcn.1400a51c0
lea rcx, [0x14003cf70]
mov qword [rax], rcx
mov qword [rbp - 0x49], rax
lea rcx, [rbp - 0x61]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x14003efb0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x69], rax
test rax, rax
je 0x14003e8c5
cmp dword [rbp - 0x61], edi
je 0x14003e8b9
movaps xmm0, xmmword [rbp - 0x69]
movdqa xmmword [rbp - 0x49], xmm0
lea rcx, [rbp - 0x49]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14003e8b9
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x69], xmm0
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [rdi + 3]
lea rcx, str..Oykyo
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x14061b4b8], rax
test rax, rax
je 0x14003e77f
cmp rax, 0xffffffffffffffff
jne 0x14003e7c2
mov edx, 0x12c
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
call fcn.140007b30
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r9 + 3]
lea rcx, str..Oykyo
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x14061b4b8], rax
cmp byte [0x14061b4d4], 0
je 0x14003e88b
movabs rdi, 0x4e94914f0000
movabs rsi, 0x431bde82d7b634db
movabs r15, 0x7ffffffffff0bdbf
movabs r14, 0x7fffffffffffffff
lea rcx, [rbp - 0x49]
call fcn.14003ce70
mov rbx, qword [rbp - 0x49]
cmp rbx, r15
jge 0x14003e812
add rbx, 0xf4240
jmp 0x14003e815
mov rbx, r14
lea rcx, [rbp - 0x69]
call fcn.14003ce70
mov rax, qword [rbp - 0x69]
cmp rax, rbx
jge 0x14003e87e
nop word [rax + rax]
mov rcx, rbx
sub rcx, rax
cmp rcx, rdi
jl 0x14003e842
mov ecx, 0x5265c00
jmp 0x14003e867
mov rax, rsi
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x14003e865
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
lea rcx, [rbp - 0x69]
call fcn.14003ce70
mov rax, qword [rbp - 0x69]
cmp rax, rbx
jl 0x14003e830
cmp byte [0x14061b4d4], 0
jne 0x14003e7f7
mov eax, 1
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1400a5080
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x61], edi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x61], edi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x61], edi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3