Function at 0x14007f820
Capabilities:
Access peb ldr_data
Create directory
Create thread
Encode data using xor
Hash data using fnv
Log keystrokes via polling
Resolve function by parsing pe exports
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x210]
sub rsp, 0x310
mov rax, qword [0x1401d12b0]
xor rax, rsp
mov qword [rbp + 0x200], rax
call fcn.14007f2d0
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
movups xmmword [rbp + 0x50], xmm0
lea rdx, [rbp + 0x30]
call fcn.140015c70
mov edx, 8
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x140218774], eax
jle 0x14007f8e0
lea rcx, [0x140218774]
call fcn.14012e718
cmp dword [0x140218774], 0xffffffff
jne 0x14007f8e0
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
mov r8, rax
movabs rax, 0xd6bf94d5e57a42bd
imul r8
add rdx, r8
sar rdx, 0x17
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [0x140218778], rdx
lea rcx, [0x140218774]
call fcn.14012e6b8
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
lea rax, str.Farlight_84
mov qword [rbp - 0x70], rax
lea rax, str.Safe_For_Main_Account
mov qword [rbp - 0x68], rax
mov rax, qword [0x140218778]
mov qword [rbp - 0x60], rax
xor esi, esi
mov qword [rbp - 0x58], rsi
lea rax, str.https:__media4.giphy.com_media_v1.Y2lkPTc5MGI3NjExMzg2YTgxMTU3MGNmNWNiMmFiOGQ0YTIyZDc0NTY0NDY2ZTJmNDZmNiZlcD12MV9pbnRlcm5hbF9naWZzX2dpZklkJmN0PWc_ualJPmE6ZkThAvgCvJ_giphy.gif
mov qword [rbp - 0x50], rax
lea rcx, [0x140178c70]
mov qword [rbp - 0x48], rcx
lea rax, str.https:__c.tenor.com_WQ67K3ynhV0AAAAd_verified.gif
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rcx
lea rax, str.Join_Discord
mov qword [rbp + 8], rax
lea rax, str.https:__discord.gg_pRQVjEmFhM
mov qword [rbp + 0x10], rax
lea rax, str.Join_Telegram
mov qword [rbp + 0x18], rax
lea rax, str.https:__t.me_NimrodCheat
mov qword [rbp + 0x20], rax
mov byte [rbp], 1
lea rcx, [0x1401e3b90]
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x14007f99d
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
int3
mov r8d, dword [reloc.WS2_32.dll_accept]
lea eax, [r8 + 1]
mov dword [reloc.WS2_32.dll_accept], eax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
lea rcx, [0x1402041d8]
call fcn.140019380
mov qword [0x1402041d0], rax
mov eax, 1
xchg byte [0x1401e3b8e], al
lea rcx, [0x1401e3b90]
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rcx, qword [0x140204090]
test rcx, rcx
je 0x14007f9f8
add rcx, 0x58
call qword [sym.imp.MSVCP140.dll__Cnd_broadcast]
call fcn.140076560
mov ecx, 8
call fcn.14012e828
lea rcx, [0x1400767d0]
mov qword [rax], rcx
mov qword [rbp + 0x1f0], rax
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x1400870b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140080bec
cmp dword [rsp + 0x48], 0
jne 0x14007fa5b
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rbp + 0x1f0], xmm0
lea rcx, [rbp + 0x1f0]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
je 0x14007fa82
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
nop
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x1401e29c0], rax
call fcn.140073d60
test eax, eax
jne 0x14007fb08
lea rdx, str.GttqtaEqppgevkqpaUgtxgt
lea rcx, [rsp + 0x70]
call fcn.140008190
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140073b70
nop
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140084220
lea rdx, [0x1400841e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rcx, [rsp + 0x50]
call fcn.1400080a0
mov ecx, 0x1f40
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.14007dc30
test al, al
jne 0x14007fb71
lea rdx, str.EcpvaRtgrctcvkqpaEjgcv
lea rcx, [rsp + 0x70]
call fcn.140008190
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140073b70
nop
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140084220
lea rdx, [0x1400841e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rcx, [rsp + 0x50]
call fcn.1400080a0
mov ecx, 0x1f40
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.14007e660
test al, al
jne 0x14007fbda
lea rdx, str.EcpvaNqcfaEjgcv
lea rcx, [rsp + 0x70]
call fcn.140008190
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140073b70
nop
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140084220
lea rdx, [0x1400841e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rcx, [rsp + 0x50]
call fcn.1400080a0
mov ecx, 0x1f40
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
mov dword [rbp + 0x1e0], eax
mov dword [rbp + 0x1f0], esi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 3]
lea rcx, str..d905b673
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14007fc72
mov qword [rsp + 0x38], rsi
lea rax, [rbp + 0x1f0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 8
lea rax, [rbp + 0x1e0]
mov qword [rsp + 0x20], rax
mov r9d, 8
lea r8, [rbp + 0x1e0]
mov edx, 0x222420
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rbp + 0x1e4], 0
jne 0x14007fc91
call fcn.140073d00
call fcn.140073c00
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.14007c1a0
test al, al
je 0x140080b66
mov ecx, edi
call fcn.140073ab0
lea rdx, str.YcvkpiaIcogaQrgpgf
lea rcx, [rbp + 0x60]
call fcn.140008190
mov rdx, rax
lea rcx, [rbp + 0x80]
call fcn.140073b70
nop
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140084220
lea rdx, [0x1400841e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rcx, [rbp + 0x80]
call fcn.1400080a0
lea rdx, str.WptgcnYkpfqy
lea rcx, [rsp + 0x50]
call fcn.140008190
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.140073b70
mov rcx, rax
call fcn.140008770
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowA]
mov rbx, rax
lea rcx, [rsp + 0x70]
call fcn.1400080a0
test rbx, rbx
jne 0x14007fd82
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.WptgcnYkpfqy
lea rcx, [rsp + 0x50]
call fcn.140008190
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.140073b70
mov rcx, rax
call fcn.140008770
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowA]
mov rbx, rax
lea rcx, [rsp + 0x70]
call fcn.1400080a0
test rbx, rbx
je 0x14007fd34
mov ecx, 0x1f40
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.UqnctncpfEnkgpv_Ykp86_Ujkrrkpi0gzg
lea rcx, [rbp + 0xa0]
call fcn.140008190
mov rdx, rax
lea rcx, [rbp + 0xc0]
call fcn.140073b70
nop
mov rcx, rax
call fcn.14008fa80
mov ebx, eax
lea rcx, [rbp + 0xc0]
call fcn.1400080a0
test ebx, ebx
je 0x140080b66
movabs rdi, 0x7ffffffdfffe
nop dword [rax + rax]
mov ecx, Ordinal_26
call fcn.14012e828
mov rcx, rax
mov qword [rbp + 0x1e0], rax
call fcn.14007ea60
mov r8d, 2
mov edx, ebx
call fcn.14012dc10
nop
mov qword [0x1401e29f0], rax
mov rcx, rax
call fcn.14012dc40
lea rcx, [rax - 0x10000]
cmp rcx, rdi
ja 0x14007fde0
mov qword [0x1401e2a00], rax
lea rdx, str.01Eqphki1
lea rcx, [rbp + 0xe0]
call fcn.140008190
mov rdx, rax
lea rcx, [rbp + 0x100]
call fcn.140073b70
mov rcx, rax
call fcn.140008770
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea rcx, [rbp + 0x100]
call fcn.1400080a0
lea rdx, str.01Eqphki1iwk0kpk
lea rcx, [rbp + 0x120]
call fcn.140008190
mov rdx, rax
lea rcx, [rbp + 0x140]
call fcn.140073b70
mov rdx, rax
lea rcx, [0x1401d8b98]
call fcn.140008100
lea rcx, [rbp + 0x140]
call fcn.1400080a0
lea rdx, str.0TguEqphki_0kpk
lea rcx, [rbp + 0x160]
call fcn.140008190
mov rdx, rax
lea rcx, [rbp + 0x1a0]
call fcn.140073b70
nop
mov rcx, rax
call fcn.140008770
mov rdx, rax
lea rcx, [rbp + 0x180]
call fcn.140008190
mov rcx, rax
call fcn.140094310
nop
lea rcx, [rbp + 0x1a0]
call fcn.1400080a0
call fcn.140032d30
mov r10, qword [0x1402186b0]
test r10, r10
jne 0x1400800e2
mov edi, esi
mov ebx, 0xabd20a2b
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r15, qword [rax]
mov qword [rbp + 0x1e0], r15
nop dword [rax]
movups xmm0, xmmword [r15 + 0x58]
movups xmmword [rsp + 0x40], xmm0
movd eax, xmm0
sub ax, 8
test edi, edi
je 0x14007ff8e
mov r8, qword [rsp + 0x48]
movzx eax, ax
shr rax, 1
lea r10, [r8 + rax*2]
mov r9d, 0x48ac4193
cmp r8, r10
je 0x14007ff85
movsx eax, byte [r8]
mov ecx, eax
sub al, 0x41
mov edx, ecx
or edx, 0x20
cmp al, 0x19
cmova edx, ecx
xor edx, r9d
imul r9d, edx, 0x1000193
add r8, 2
cmp r8, r10
jne 0x14007ff60
cmp r9d, edi
jne 0x1400800bf
mov r11, qword [r15 + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov r13, qword [rax + r11 + 0x88]
mov r14d, r13d
add r14, r11
shr r13, 0x20
cmp r14, r11
je 0x1400800bf
mov r10d, dword [r14 + 0x18]
test r10d, r10d
je 0x1400800bf
mov r12d, dword [r14 + 0x20]
dec r10d
lea rax, [r11 + r10*4]
mov r8d, dword [rax + r12]
add r8, r11
mov r9d, 0x48ac4193
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x140080008
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
movzx edx, byte [r8]
lea r8, [r8 + 1]
test dl, dl
jne 0x14007ffe1
cmp r9d, ebx
je 0x140080017
test r10d, r10d
jne 0x14007ffc2
jmp 0x1400800bf
mov ecx, dword [r14 + 0x1c]
add rcx, r11
mov eax, dword [r14 + 0x24]
add rax, r11
movzx eax, word [rax + r10*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
cmp r10, r14
jbe 0x140080227
lea rax, [r14 + r13]
cmp r10, rax
jae 0x140080227
mov edi, 0x48ac4193
mov ebx, edi
movzx edx, byte [r10]
cmp dl, 0x2e
je 0x140080085
nop word [rax + rax]
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, edi
imul edi, ecx, 0x1000193
inc r10
movzx edx, byte [r10]
cmp dl, 0x2e
jne 0x140080060
inc r10
movzx edx, byte [r10]
test dl, dl
je 0x1400800b5
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, ebx
imul ebx, ecx, 0x1000193
lea r10, [r10 + 1]
movzx edx, byte [r10]
test dl, dl
jne 0x140080090
mov r15, qword [rbp + 0x1e0]
mov r15, qword [r15]
mov r15, qword [r15]
cmp r15, qword [rbp + 0x1e0]
je 0x1400800d6
cmp qword [r15 + 0x30], 0
jne 0x14007ff30
xor esi, esi
mov r10d, esi
mov qword [0x1402186b0], r10
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, [0x140077730]
xor edx, edx
xor ecx, ecx
call r10
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r10, qword [0x1402186a0]
test r10, r10
jne 0x1400802f2
mov edi, esi
mov ebx, 0x722254a3
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r15, qword [rax]
mov qword [rbp + 0x1e0], r15
nop word [rax + rax]
movups xmm0, xmmword [r15 + 0x58]
movups xmmword [rsp + 0x40], xmm0
movd eax, xmm0
sub ax, 8
test edi, edi
je 0x14008019e
mov r8, qword [rsp + 0x48]
movzx eax, ax
shr rax, 1
lea r10, [r8 + rax*2]
mov r9d, 0x2e2d9fdb
cmp r8, r10
je 0x140080195
movsx eax, byte [r8]
mov ecx, eax
sub al, 0x41
mov edx, ecx
or edx, 0x20
cmp al, 0x19
cmova edx, ecx
xor edx, r9d
imul r9d, edx, 0x1000193
add r8, 2
cmp r8, r10
jne 0x140080170
cmp r9d, edi
jne 0x1400802cf
mov r11, qword [r15 + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov r13, qword [rax + r11 + 0x88]
mov r14d, r13d
add r14, r11
shr r13, 0x20
cmp r14, r11
je 0x1400802cf
mov r10d, dword [r14 + 0x18]
test r10d, r10d
je 0x1400802cf
mov r12d, dword [r14 + 0x20]
dec r10d
lea rax, [r11 + r10*4]
mov r8d, dword [rax + r12]
add r8, r11
mov r9d, 0x2e2d9fdb
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x140080218
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
movzx edx, byte [r8]
lea r8, [r8 + 1]
test dl, dl
jne 0x1400801f1
cmp r9d, ebx
je 0x14008022e
test r10d, r10d
jne 0x1400801d2
jmp 0x1400802cf
xor esi, esi
jmp 0x1400800db
mov ecx, dword [r14 + 0x1c]
add rcx, r11
mov eax, dword [r14 + 0x24]
add rax, r11
movzx eax, word [rax + r10*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
cmp r10, r14
jbe 0x140080437
lea rax, [r14 + r13]
cmp r10, rax
jae 0x140080437
mov edi, 0x2e2d9fdb
mov ebx, edi
movzx edx, byte [r10]
cmp dl, 0x2e
je 0x140080295
nop
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, edi
imul edi, ecx, 0x1000193
inc r10
movzx edx, byte [r10]
cmp dl, 0x2e
jne 0x140080270
inc r10
movzx edx, byte [r10]
test dl, dl
je 0x1400802c5
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, ebx
imul ebx, ecx, 0x1000193
lea r10, [r10 + 1]
movzx edx, byte [r10]
test dl, dl
jne 0x1400802a0
mov r15, qword [rbp + 0x1e0]
mov r15, qword [r15]
mov r15, qword [r15]
cmp r15, qword [rbp + 0x1e0]
je 0x1400802e6
cmp qword [r15 + 0x30], 0
jne 0x140080140
xor esi, esi
mov r10d, esi
mov qword [0x1402186a0], r10
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, [0x140078330]
xor edx, edx
xor ecx, ecx
call r10
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r10, qword [0x140218710]
test r10, r10
jne 0x140080502
mov edi, esi
mov ebx, 0x3b4fc7e9
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r15, qword [rax]
mov qword [rbp + 0x1e0], r15
nop word [rax + rax]
movups xmm0, xmmword [r15 + 0x58]
movups xmmword [rsp + 0x40], xmm0
movd eax, xmm0
sub ax, 8
test edi, edi
je 0x1400803ae
mov r8, qword [rsp + 0x48]
movzx eax, ax
shr rax, 1
lea r10, [r8 + rax*2]
mov r9d, 0x5006935
cmp r8, r10
je 0x1400803a5
movsx eax, byte [r8]
mov ecx, eax
sub al, 0x41
mov edx, ecx
or edx, 0x20
cmp al, 0x19
cmova edx, ecx
xor edx, r9d
imul r9d, edx, 0x1000193
add r8, 2
cmp r8, r10
jne 0x140080380
cmp r9d, edi
jne 0x1400804df
mov r11, qword [r15 + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov r13, qword [rax + r11 + 0x88]
mov r14d, r13d
add r14, r11
shr r13, 0x20
cmp r14, r11
je 0x1400804df
mov r10d, dword [r14 + 0x18]
test r10d, r10d
je 0x1400804df
mov r12d, dword [r14 + 0x20]
dec r10d
lea rax, [r12 + r10*4]
mov r8d, dword [rax + r11]
add r8, r11
mov r9d, 0x5006935
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x140080428
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
movzx edx, byte [r8]
lea r8, [r8 + 1]
test dl, dl
jne 0x140080401
cmp r9d, ebx
je 0x14008043e
test r10d, r10d
jne 0x1400803e2
jmp 0x1400804df
xor esi, esi
jmp 0x1400802eb
mov ecx, dword [r14 + 0x1c]
add rcx, r11
mov eax, dword [r14 + 0x24]
add rax, r11
movzx eax, word [rax + r10*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
cmp r10, r14
jbe 0x140080647
lea rax, [r14 + r13]
cmp r10, rax
jae 0x140080647
mov edi, 0x5006935
mov ebx, edi
movzx edx, byte [r10]
cmp dl, 0x2e
je 0x1400804a5
nop
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, edi
imul edi, ecx, 0x1000193
inc r10
movzx edx, byte [r10]
cmp dl, 0x2e
jne 0x140080480
inc r10
movzx edx, byte [r10]
test dl, dl
je 0x1400804d5
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, ebx
imul ebx, ecx, 0x1000193
lea r10, [r10 + 1]
movzx edx, byte [r10]
test dl, dl
jne 0x1400804b0
mov r15, qword [rbp + 0x1e0]
mov r15, qword [r15]
mov r15, qword [r15]
cmp r15, qword [rbp + 0x1e0]
je 0x1400804f6
cmp qword [r15 + 0x30], 0
jne 0x140080350
xor esi, esi
mov r10d, esi
mov qword [0x140218710], r10
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, [0x140077500]
xor edx, edx
xor ecx, ecx
call r10
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r10, qword [0x1402186a8]
test r10, r10
jne 0x140080712
mov edi, esi
mov ebx, 0x714350cf
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r15, qword [rax]
mov qword [rbp + 0x1e0], r15
nop word [rax + rax]
movups xmm0, xmmword [r15 + 0x58]
movups xmmword [rsp + 0x40], xmm0
movd eax, xmm0
sub ax, 8
test edi, edi
je 0x1400805be
mov r8, qword [rsp + 0x48]
movzx eax, ax
shr rax, 1
lea r10, [r8 + rax*2]
mov r9d, 0x55c1dad7
cmp r8, r10
je 0x1400805b5
movsx eax, byte [r8]
mov ecx, eax
sub al, 0x41
mov edx, ecx
or edx, 0x20
cmp al, 0x19
cmova edx, ecx
xor edx, r9d
imul r9d, edx, 0x1000193
add r8, 2
cmp r8, r10
jne 0x140080590
cmp r9d, edi
jne 0x1400806ef
mov r11, qword [r15 + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov r13, qword [rax + r11 + 0x88]
mov r14d, r13d
add r14, r11
shr r13, 0x20
cmp r14, r11
je 0x1400806ef
mov r10d, dword [r14 + 0x18]
test r10d, r10d
je 0x1400806ef
mov r12d, dword [r14 + 0x20]
dec r10d
lea rax, [r12 + r10*4]
mov r8d, dword [rax + r11]
add r8, r11
mov r9d, 0x55c1dad7
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x140080638
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
movzx edx, byte [r8]
lea r8, [r8 + 1]
test dl, dl
jne 0x140080611
cmp r9d, ebx
je 0x14008064e
test r10d, r10d
jne 0x1400805f2
jmp 0x1400806ef
xor esi, esi
jmp 0x1400804fb
mov ecx, dword [r14 + 0x1c]
add rcx, r11
mov eax, dword [r14 + 0x24]
add rax, r11
movzx eax, word [rax + r10*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
cmp r10, r14
jbe 0x140080857
lea rax, [r14 + r13]
cmp r10, rax
jae 0x140080857
mov edi, 0x55c1dad7
mov ebx, edi
movzx edx, byte [r10]
cmp dl, 0x2e
je 0x1400806b5
nop
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, edi
imul edi, ecx, 0x1000193
inc r10
movzx edx, byte [r10]
cmp dl, 0x2e
jne 0x140080690
inc r10
movzx edx, byte [r10]
test dl, dl
je 0x1400806e5
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, ebx
imul ebx, ecx, 0x1000193
lea r10, [r10 + 1]
movzx edx, byte [r10]
test dl, dl
jne 0x1400806c0
mov r15, qword [rbp + 0x1e0]
mov r15, qword [r15]
mov r15, qword [r15]
cmp r15, qword [rbp + 0x1e0]
je 0x140080706
cmp qword [r15 + 0x30], 0
jne 0x140080560
xor esi, esi
mov r10d, esi
mov qword [0x1402186a8], r10
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, [0x14008fa70]
xor edx, edx
xor ecx, ecx
call r10
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r10, qword [0x140218700]
test r10, r10
jne 0x140080922
mov edi, esi
mov ebx, 0x2f93c148
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r15, qword [rax]
mov qword [rbp + 0x1e0], r15
nop word [rax + rax]
movups xmm0, xmmword [r15 + 0x58]
movups xmmword [rsp + 0x40], xmm0
movd eax, xmm0
sub ax, 8
test edi, edi
je 0x1400807ce
mov r8, qword [rsp + 0x48]
movzx eax, ax
shr rax, 1
lea r10, [r8 + rax*2]
mov r9d, 0xff52cabc
cmp r8, r10
je 0x1400807c5
movsx eax, byte [r8]
mov ecx, eax
sub al, 0x41
mov edx, ecx
or edx, 0x20
cmp al, 0x19
cmova edx, ecx
xor edx, r9d
imul r9d, edx, 0x1000193
add r8, 2
cmp r8, r10
jne 0x1400807a0
cmp r9d, edi
jne 0x1400808ff
mov r11, qword [r15 + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov r13, qword [rax + r11 + 0x88]
mov r14d, r13d
add r14, r11
shr r13, 0x20
cmp r14, r11
je 0x1400808ff
mov r10d, dword [r14 + 0x18]
test r10d, r10d
je 0x1400808ff
mov r12d, dword [r14 + 0x20]
dec r10d
lea rax, [r12 + r10*4]
mov r8d, dword [rax + r11]
add r8, r11
mov r9d, 0xff52cabc
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x140080848
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
movzx edx, byte [r8]
lea r8, [r8 + 1]
test dl, dl
jne 0x140080821
cmp r9d, ebx
je 0x14008085e
test r10d, r10d
jne 0x140080802
jmp 0x1400808ff
xor esi, esi
jmp 0x14008070b
mov ecx, dword [r14 + 0x1c]
add rcx, r11
mov eax, dword [r14 + 0x24]
add rax, r11
movzx eax, word [rax + r10*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
cmp r10, r14
jbe 0x140080a65
lea rax, [r14 + r13]
cmp r10, rax
jae 0x140080a65
mov edi, 0xff52cabc
mov ebx, edi
movzx edx, byte [r10]
cmp dl, 0x2e
je 0x1400808c5
nop
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, edi
imul edi, ecx, 0x1000193
inc r10
movzx edx, byte [r10]
cmp dl, 0x2e
jne 0x1400808a0
inc r10
movzx edx, byte [r10]
test dl, dl
je 0x1400808f5
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, ebx
imul ebx, ecx, 0x1000193
lea r10, [r10 + 1]
movzx edx, byte [r10]
test dl, dl
jne 0x1400808d0
mov r15, qword [rbp + 0x1e0]
mov r15, qword [r15]
mov r15, qword [r15]
cmp r15, qword [rbp + 0x1e0]
je 0x140080916
cmp qword [r15 + 0x30], 0
jne 0x140080770
xor esi, esi
mov r10d, esi
mov qword [0x140218700], r10
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, [0x140007dd0]
xor edx, edx
xor ecx, ecx
call r10
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r10, qword [0x1402186e8]
test r10, r10
jne 0x140080b32
mov edi, esi
mov ebx, 0xaf1a2960
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r15, qword [rax]
mov qword [rbp + 0x1e0], r15
nop word [rax + rax]
movups xmm0, xmmword [r15 + 0x58]
movups xmmword [rsp + 0x40], xmm0
movd eax, xmm0
sub ax, 8
test edi, edi
je 0x1400809de
mov r8, qword [rsp + 0x48]
movzx eax, ax
shr rax, 1
lea r10, [r8 + rax*2]
mov r9d, 0x7074a564
cmp r8, r10
je 0x1400809d5
movsx eax, byte [r8]
mov ecx, eax
sub al, 0x41
mov edx, ecx
or edx, 0x20
cmp al, 0x19
cmova edx, ecx
xor edx, r9d
imul r9d, edx, 0x1000193
add r8, 2
cmp r8, r10
jne 0x1400809b0
cmp r9d, edi
jne 0x140080b0f
mov r11, qword [r15 + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov r13, qword [rax + r11 + 0x88]
mov r14d, r13d
add r14, r11
shr r13, 0x20
cmp r14, r11
je 0x140080b0f
mov r10d, dword [r14 + 0x18]
test r10d, r10d
je 0x140080b0f
mov r12d, dword [r14 + 0x20]
dec r10d
lea rax, [r12 + r10*4]
mov r8d, dword [rax + r11]
add r8, r11
mov r9d, 0x7074a564
movzx eax, byte [r8]
inc r8
test al, al
je 0x140080a56
movsx ecx, al
sub al, 0x41
mov edx, ecx
or edx, 0x20
cmp al, 0x19
cmova edx, ecx
xor edx, r9d
imul r9d, edx, 0x1000193
movzx eax, byte [r8]
lea r8, [r8 + 1]
test al, al
jne 0x140080a31
cmp r9d, ebx
je 0x140080a6c
test r10d, r10d
jne 0x140080a12
jmp 0x140080b0f
xor esi, esi
jmp 0x14008091b
mov ecx, dword [r14 + 0x1c]
add rcx, r11
mov eax, dword [r14 + 0x24]
add rax, r11
movzx eax, word [rax + r10*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
cmp r10, r14
jbe 0x140080be5
lea rax, [r14 + r13]
cmp r10, rax
jae 0x140080be5
mov edi, 0x7074a564
mov ebx, edi
movzx edx, byte [r10]
cmp dl, 0x2e
je 0x140080ad5
nop dword [rax]
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, edi
imul edi, ecx, 0x1000193
inc r10
movzx edx, byte [r10]
cmp dl, 0x2e
jne 0x140080ab0
inc r10
movzx edx, byte [r10]
test dl, dl
je 0x140080b05
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, ebx
imul ebx, ecx, 0x1000193
lea r10, [r10 + 1]
movzx edx, byte [r10]
test dl, dl
jne 0x140080ae0
mov r15, qword [rbp + 0x1e0]
mov r15, qword [r15]
mov r15, qword [r15]
cmp r15, qword [rbp + 0x1e0]
je 0x140080b26
cmp qword [r15 + 0x30], 0
jne 0x140080980
xor esi, esi
mov r10d, esi
mov qword [0x1402186e8], r10
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, [0x14007bf60]
xor edx, edx
xor ecx, ecx
call r10
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov ecx, reloc.WLDAP32.dll_Ordinal_35
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x140080b9b
nop word [rax + rax]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, reloc.WLDAP32.dll_Ordinal_35
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140080b80
mov byte [0x1401e2961], 0
lea rdx, str.01Eqphki1iwk0kpk
lea rcx, [rbp + 0x1c0]
call fcn.140008190
mov rdx, rax
lea rcx, [rbp + 0x30]
call fcn.140073b70
nop
mov rcx, rax
call fcn.140008770
mov rcx, rax
call fcn.140046510
nop
lea rcx, [rbp + 0x30]
call fcn.1400080a0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
xor esi, esi
jmp 0x140080b2b
mov dword [rsp + 0x48], esi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3