Function at 0x14001b1f0
Capabilities:
Contain obfuscated stackstrings
Create thread
Delete file
Encode data using xor
Execute command
Get common file path
Hide graphical window
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x4a8]
sub rsp, 0x580
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
movaps xmmword [rax - 0x78], xmm10
movaps xmmword [rax - 0x88], xmm11
movaps xmmword [rax - 0x98], xmm12
movaps xmmword [rax - 0xa8], xmm13
movaps xmmword [rax - 0xb8], xmm14
movaps xmmword [rax - 0xc8], xmm15
mov rax, qword [0x1401b0080]
xor rax, rsp
mov qword [rbp + 0x3d0], rax
xor edi, edi
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rbx, rax
mov edx, 0xffffffec
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowLongA]
bts eax, 0x13
mov r8d, eax
mov edx, 0xffffffec
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowLongA]
mov r9d, 2
mov r8b, 0xbf
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], Ordinal_301
mov r9d, 0x1f4
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_MoveWindow]
mov ecx, 1
call fcn.1401505a0
mov qword [rbp + 0xe0], rax
lea rcx, [rbp - 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x140026130]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x50], rax
test rax, rax
je 0x14001c882
cmp dword [rbp - 0x48], edi
je 0x14001c876
movaps xmm0, xmmword [rbp - 0x50]
movdqa xmmword [rbp + 0x130], xmm0
lea rcx, [rbp + 0x130]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14001c876
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x50], xmm0
lea rax, [rbp + 0x1c0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WLDAP32.dll_Ordinal_26
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xorps xmm0, xmm0
test eax, eax
js 0x14001b40b
movups xmmword [rbp + 0xe8], xmm0
mov qword [rbp + 0xf8], rdi
mov qword [rbp + 0x100], rdi
lea rax, [rbp + 0x1c0]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x14001b3a0
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0xe8]
call fcn.1400111f0
nop
lea rdx, [rbp + 0xe8]
cmp qword [rbp + 0x100], 7
cmova rdx, qword [rbp + 0xe8]
mov rax, qword [rbp + 0xf8]
lea r8, [rdx + rax*2]
lea rdx, [rbp + 0xe8]
cmova rdx, qword [rbp + 0xe8]
lea rcx, [rbp + 0x160]
call fcn.14001ed30
nop
lea rcx, [rbp + 0xe8]
call fcn.140010580
jmp 0x14001b437
movups xmmword [rbp + 0x160], xmm0
mov qword [rbp + 0x170], rdi
mov qword [rbp + 0x178], rdi
xor r8d, r8d
lea rdx, [0x14018d218]
lea rcx, [rbp + 0x160]
call fcn.140004fc0
nop
movabs r15, 0x7fffffffffffffff
mov rax, r15
mov rcx, qword [rbp + 0x170]
sub rax, rcx
cmp rax, 0xa
jae 0x14001b45a
call fcn.1400029c0
int3
lea r9, [rbp + 0x160]
cmp qword [rbp + 0x178], 0xf
cmova r9, qword [rbp + 0x160]
mov qword [rsp + 0x30], 0xa
lea rsi, [0x14018d2b0]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0xe8]
call fcn.140020500
nop
lea rax, [rbp + 0xe8]
cmp qword [rbp + 0x100], 0xf
cmova rax, qword [rbp + 0xe8]
mov qword [rbp - 0x50], rax
mov rax, qword [rbp + 0xf8]
mov qword [rbp - 0x48], rax
call fcn.14014f9e0
movaps xmm0, xmmword [rbp - 0x50]
movdqa xmmword [rbp + 0x130], xmm0
lea r8, [rbp + 0x130]
mov edx, eax
lea rcx, [rbp + 0x10]
call fcn.140009f30
nop
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0xb0]
call fcn.1400199f0
movsd xmm0, qword [rax]
movsd qword [rbp - 0x40], xmm0
mov ecx, dword [rax + 8]
mov dword [rbp - 0x50], ecx
lea r12, [0x1402722e0]
mov qword [rbp - 0x48], r12
movaps xmm0, xmmword [rbp - 0x50]
movdqa xmmword [rbp + 0x130], xmm0
mov eax, dword [rbp - 0x40]
test eax, eax
je 0x14001b55c
cmp eax, 1
sete bl
lea rcx, [rbp + 0x10]
call fcn.140010580
nop
lea rcx, [rbp + 0xe8]
call fcn.140004bf0
test bl, bl
je 0x14001b645
mov rax, r15
mov rcx, qword [rbp + 0x170]
sub rax, rcx
cmp rax, 0xa
jae 0x14001b57a
call fcn.1400029c0
nop
mov bl, 1
test ecx, ecx
je 0x14001b525
lea r8, [rbp + 0x10]
lea rdx, [rbp + 0x130]
lea rcx, str.exists
call fcn.14000a710
nop
lea r9, [rbp + 0x160]
cmp qword [rbp + 0x178], 0xf
cmova r9, qword [rbp + 0x160]
mov qword [rsp + 0x30], 0xa
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0x70]
call fcn.140020500
nop
lea rax, [rbp + 0x70]
cmp qword [rbp + 0x88], 0xf
cmova rax, qword [rbp + 0x70]
mov qword [rbp - 0x50], rax
mov rax, qword [rbp + 0x80]
mov qword [rbp - 0x48], rax
call fcn.14014f9e0
movaps xmm0, xmmword [rbp - 0x50]
movdqa xmmword [rbp + 0x130], xmm0
lea r8, [rbp + 0x130]
mov edx, eax
lea rcx, [rbp + 0xe8]
call fcn.140009f30
nop
lea rcx, [rbp + 0xe8]
cmp qword [rbp + 0x100], 7
cmova rcx, qword [rbp + 0xe8]
call fcn.14014fc40
shr rax, 0x20
test eax, eax
je 0x14001b62f
lea r8, [rbp + 0xe8]
mov edx, eax
lea rcx, str.create_directory
call fcn.14000a6a0
nop
lea rcx, [rbp + 0xe8]
call fcn.140010580
nop
lea rcx, [rbp + 0x70]
call fcn.140004bf0
mov rax, r15
mov rcx, qword [rbp + 0x170]
sub rax, rcx
cmp rax, 0x12
jae 0x14001b65e
call fcn.1400029c0
int3
lea r9, [rbp + 0x160]
cmp qword [rbp + 0x178], 0xf
cmova r9, qword [rbp + 0x160]
mov qword [rsp + 0x30], reloc.WS2_32.dll_select
lea rsi, str.elitewareconfigs
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0xe8]
call fcn.140020500
nop
lea rax, [rbp + 0xe8]
cmp qword [rbp + 0x100], 0xf
cmova rax, qword [rbp + 0xe8]
mov qword [rbp - 0x50], rax
mov rax, qword [rbp + 0xf8]
mov qword [rbp - 0x48], rax
call fcn.14014f9e0
movaps xmm0, xmmword [rbp - 0x50]
movdqa xmmword [rbp + 0x130], xmm0
lea r8, [rbp + 0x130]
mov edx, eax
lea rcx, [rbp + 0x10]
call fcn.140009f30
nop
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0xb0]
call fcn.1400199f0
movsd xmm0, qword [rax]
movsd qword [rbp - 0x40], xmm0
mov ecx, dword [rax + 8]
mov dword [rbp - 0x50], ecx
mov qword [rbp - 0x48], r12
movaps xmm0, xmmword [rbp - 0x50]
movdqa xmmword [rbp + 0x130], xmm0
mov eax, dword [rbp - 0x40]
test eax, eax
je 0x14001b759
cmp eax, 1
sete bl
lea rcx, [rbp + 0x10]
call fcn.140010580
nop
lea rcx, [rbp + 0xe8]
call fcn.140004bf0
test bl, bl
je 0x14001b842
mov rax, r15
mov rcx, qword [rbp + 0x170]
sub rax, rcx
cmp rax, 0x12
jae 0x14001b777
call fcn.1400029c0
nop
mov bl, 1
test ecx, ecx
je 0x14001b722
lea r8, [rbp + 0x10]
lea rdx, [rbp + 0x130]
lea rcx, str.exists
call fcn.14000a710
nop
lea r9, [rbp + 0x160]
cmp qword [rbp + 0x178], 0xf
cmova r9, qword [rbp + 0x160]
mov qword [rsp + 0x30], reloc.WS2_32.dll_select
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0x70]
call fcn.140020500
nop
lea rax, [rbp + 0x70]
cmp qword [rbp + 0x88], 0xf
cmova rax, qword [rbp + 0x70]
mov qword [rbp - 0x50], rax
mov rax, qword [rbp + 0x80]
mov qword [rbp - 0x48], rax
call fcn.14014f9e0
movaps xmm0, xmmword [rbp - 0x50]
movdqa xmmword [rbp + 0x130], xmm0
lea r8, [rbp + 0x130]
mov edx, eax
lea rcx, [rbp + 0xe8]
call fcn.140009f30
nop
lea rcx, [rbp + 0xe8]
cmp qword [rbp + 0x100], 7
cmova rcx, qword [rbp + 0xe8]
call fcn.14014fc40
shr rax, 0x20
test eax, eax
je 0x14001b82c
lea r8, [rbp + 0xe8]
mov edx, eax
lea rcx, str.create_directory
call fcn.14000a6a0
nop
lea rcx, [rbp + 0xe8]
call fcn.140010580
nop
lea rcx, [rbp + 0x70]
call fcn.140004bf0
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov qword [0x140273f38], rdi
lea rax, [0x140273f28]
cmp qword [0x140273f40], 0xf
cmova rax, qword [0x140273f28]
mov byte [rax], 0
mov qword [0x140273c78], rdi
lea rax, [0x140273c68]
cmp qword [0x140273c80], 0xf
cmova rax, qword [0x140273c68]
mov byte [rax], 0
mov qword [0x140273f58], rdi
lea rax, [0x140273f48]
cmp qword [0x140273f60], 0xf
cmova rax, qword [0x140273f48]
mov byte [rax], 0
mov qword [0x140273c58], rdi
lea rax, [0x140273c48]
cmp qword [0x140273c60], 0xf
cmova rax, qword [0x140273c48]
mov byte [rax], 0
mov qword [0x140273c98], rdi
lea rax, [0x140273c88]
cmp qword [0x140273ca0], 0xf
cmova rax, qword [0x140273c88]
mov byte [rax], 0
lea rcx, [0x140273cb0]
call fcn.1400fd310
cmp byte [0x140273ec0], 0
jne 0x14001bbae
lea rcx, [0x14018d2d4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r10, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rbp + 0x130]
call fcn.14001ca10
mov r9, rax
cmp byte [rax + 0x14], 0
je 0x14001bb7d
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x14001bb42
movdqa xmm5, xmmword [0x1401927c0]
movdqa xmm6, xmmword [str.2222]
movdqa xmm7, xmmword [0x1401925d0]
movdqa xmm2, xmmword [0x1401923d0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm5
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
movdqa xmm4, xmmword [0x1401924d0]
andps xmm2, xmm4
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm7
movd xmm0, dword [rax]
xorps xmm2, xmm0
movd dword [rax], xmm2
movdqa xmm3, xmmword [0x140192430]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm5
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
paddb xmm3, xmm7
movd xmm0, dword [rax + 4]
xorps xmm3, xmm0
movd dword [rax + 4], xmm3
movdqa xmm2, xmmword [0x140192440]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm5
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
andps xmm2, xmm4
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm7
movd xmm0, dword [rax + 8]
xorps xmm2, xmm0
movd dword [rax + 8], xmm2
movdqa xmm3, xmmword [0x140192450]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm5
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
paddb xmm3, xmm7
movd xmm0, dword [rax + 0xc]
xorps xmm3, xmm0
movd dword [rax + 0xc], xmm3
movdqa xmm2, xmmword [0x140192460]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm5
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
andps xmm2, xmm4
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm7
movd xmm0, dword [rax + 0x10]
xorps xmm2, xmm0
movd dword [rax + 0x10], xmm2
mov edi, reloc.WS2_32.dll_sendto
mov r8d, edi
add r8, r9
nop dword [rax + rax]
mov eax, 0x51eb851f
imul edi
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x32
movzx eax, dil
sub al, cl
add al, 0x30
xor byte [r8], al
inc edi
lea r8, [r8 + 1]
cmp edi, 0x15
jl 0x14001bb50
mov rdx, r9
mov rcx, r10
call fcn.140010d80
mov rcx, rax
lea rdx, [0x140273ec8]
call fcn.14001ee60
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
movabs r13, 0x8000000000000000
movdqa xmm6, xmmword [0x140192590]
movdqa xmm7, xmmword [0x140192520]
movdqa xmm8, xmmword [0x140192550]
movdqa xmm9, xmmword [0x140192560]
movdqa xmm10, xmmword [0x140192530]
movdqa xmm11, xmmword [0x140192790]
movdqa xmm12, xmmword [0x140192750]
movdqa xmm13, xmmword [0x140192820]
movdqa xmm14, xmmword [0x1401927a0]
movdqa xmm15, xmmword [0x140192890]
mov ecx, 1
call fcn.1401505a0
mov qword [rbp + 0x158], rax
lea rcx, [rbp - 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x140026160]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x50], rax
test rax, rax
je 0x14001c867
cmp dword [rbp - 0x48], 0
je 0x14001c85b
movaps xmm0, xmmword [rbp - 0x50]
movdqa xmmword [rbp + 0x110], xmm0
lea rcx, [rbp + 0x110]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14001c85b
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x6c], reloc.WLDAP32.dll_Ordinal_41
lea rax, [rbp - 0x6b]
mov qword [rbp + 0x70], rax
lea rcx, [rbp - 0x6b]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x14001bca0
mov qword [rbp + 0x78], rax
call fcn.14014f9e0
movaps xmm0, xmmword [rbp + 0x70]
movdqa xmmword [rbp + 0x110], xmm0
lea r8, [rbp + 0x110]
mov edx, eax
lea rcx, [rbp + 0x180]
call fcn.140009f30
nop
lea rdx, [rbp + 0x180]
lea rcx, [rbp + 0xd0]
call fcn.1400199f0
movsd xmm0, qword [rax]
movsd qword [rbp + 0xb0], xmm0
mov ecx, dword [rax + 8]
mov dword [rbp + 0x130], ecx
mov qword [rbp + 0x138], r12
movaps xmm0, xmmword [rbp + 0x130]
movdqa xmmword [rbp + 0x110], xmm0
mov eax, dword [rbp + 0xb0]
test eax, eax
je 0x14001bd24
cmp eax, 1
setne bl
jmp 0x14001bd2e
xor bl, bl
test ecx, ecx
jne 0x14001c840
lea rcx, [rbp + 0x180]
call fcn.140010580
test bl, bl
je 0x14001bf9c
lea rax, [rbp + 0xe8]
mov qword [rbp + 0x158], rax
mov dword [rbp - 0x40], 0x65737577
mov dword [rbp - 0x3c], 0x6d616e72
mov word [rbp - 0x38], 0x65
xorps xmm0, xmm0
movups xmmword [rbp + 0xe8], xmm0
mov qword [rbp + 0xf8], rdi
mov qword [rbp + 0x100], rdi
lea rax, [rbp - 0x3f]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14001bd90
lea rdx, [rbp - 0x3f]
lea rcx, [rbp + 0xe8]
call fcn.140004fc0
nop
mov word [rbp - 0x68], 3
xorps xmm0, xmm0
movups xmmword [rbp + 0x110], xmm0
mov qword [rbp + 0x120], rdi
mov qword [rbp + 0x128], rdi
lea rax, [rbp - 0x67]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x14001bdd4
lea rdx, [rbp - 0x67]
lea rcx, [rbp + 0x110]
call fcn.140004fc0
nop
lea rdx, [rbp + 0xe8]
lea rcx, [rbp + 0x110]
call fcn.14001a820
test al, al
jne 0x14001bc10
lea rax, [rbp + 0x30]
mov qword [rbp + 8], rax
mov dword [rbp - 0x30], 0x63696c46
mov dword [rbp - 0x2c], 0x65736e65
mov byte [rbp - 0x28], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], rdi
mov qword [rbp + 0x48], rdi
lea rax, [rbp - 0x2f]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x14001be40
lea rdx, [rbp - 0x2f]
lea rcx, [rbp + 0x30]
call fcn.140004fc0
nop
mov word [rbp - 0x64], Ordinal_41
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], rdi
mov qword [rbp + 0x68], rdi
lea rax, [rbp - 0x63]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14001be80
lea rdx, [rbp - 0x63]
lea rcx, [rbp + 0x50]
call fcn.140004fc0
nop
lea r8, [rbp + 0x30]
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x180]
call fcn.14001a3c0
nop
lea rdx, [rbp + 0x180]
lea rcx, [rbp + 0x1a0]
call fcn.140004ad0
mov rdx, rax
lea rcx, [0x140273cb0]
call fcn.1400fea00
cmp byte [0x140273ec0], 0
je 0x14001c75a
movdqa xmm0, xmmword [0x140192870]
movdqu xmmword [rsp + 0x40], xmm0
movdqa xmm0, xmmword [0x1401925a0]
movdqu xmmword [rsp + 0x50], xmm0
movdqu xmmword [rsp + 0x60], xmm15
mov dword [rsp + 0x70], 0xf256b
mov rdx, rdi
nop word [rax + rax]
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rdx + 0x41], al
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rdx + 0x42], al
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rdx + 0x43], al
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rdx + 0x44], al
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rdx + 0x45], al
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rdx + 0x46], al
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rdx + 0x47], al
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rdx + 0x48], al
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rdx + 0x49], al
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rdx + 0x4a], al
add rdx, 0xa
cmp rdx, 0x32
jb 0x14001bf10
mov byte [rsp + 0x73], 0
lea rdx, [rsp + 0x41]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140010d80
nop
lea rcx, [rbp + 0x180]
call fcn.140004bf0
jmp 0x14001bc10
movdqa xmm0, xmmword [0x1401928e0]
movdqu xmmword [rbp + 0x110], xmm0
mov dword [rbp + 0x120], 0x6f206573
mov dword [rbp + 0x124], 0x6f697470
mov dword [rbp + 0x128], 0x203a6e
lea rdx, [rbp + 0x111]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140010d80
xorps xmm0, xmm0
movups xmmword [rbp + 0x180], xmm0
mov qword [rbp + 0x190], rdi
mov qword [rbp + 0x198], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x180], 0
movups xmmword [rbp + 0x1a0], xmm0
mov qword [rbp + 0x1b0], rdi
mov qword [rbp + 0x1b8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x1a0], 0
movups xmmword [rbp + 0xe8], xmm0
mov qword [rbp + 0xf8], rdi
mov qword [rbp + 0x100], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xe8], 0
lea rdx, [rbp + 0x150]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
cmp dword [rbp + 0x150], 1
jne 0x14001c829
lea rcx, [0x14018d2d4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [str.Henter_license:]
movdqu xmmword [rbp + 0x110], xmm0
mov byte [rbp + 0x120], 0
lea rdx, [rbp + 0x111]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140010d80
lea rdx, [rbp + 0xe8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.14001ee80
xorps xmm0, xmm0
movups xmmword [rbp + 0x110], xmm0
mov qword [rbp + 0x120], rdi
mov qword [rbp + 0x128], rdi
lea r14, [rbp + 0xe8]
cmp qword [rbp + 0x100], 0xf
cmova r14, qword [rbp + 0xe8]
mov rsi, qword [rbp + 0xf8]
cmp rsi, r15
ja 0x14001c823
cmp rsi, 0xf
ja 0x14001c112
mov qword [rbp + 0x120], rsi
mov qword [rbp + 0x128], reloc.WS2_32.dll_ntohs
movups xmm0, xmmword [r14]
movups xmmword [rbp + 0x110], xmm0
jmp 0x14001c1a3
mov rbx, rsi
or rbx, 0xf
cmp rbx, r15
jbe 0x14001c127
mov rbx, r15
lea rax, [r13 + 0x27]
jmp 0x14001c158
cmp rbx, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x14001c142
mov rax, rdi
jmp 0x14001c17f
cmp rcx, 0x1000
jb 0x14001c17a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14001c81d
mov rcx, rax
call fcn.1401505a0
mov rcx, rax
test rax, rax
je 0x14001c816
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14001c17f
call fcn.1401505a0
mov qword [rbp + 0x110], rax
mov qword [rbp + 0x120], rsi
mov qword [rbp + 0x128], rbx
lea r8, [rsi + 1]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rdx, [rbp + 0x110]
lea rcx, [0x140273cb0]
call fcn.1400fea00
cmp byte [0x140273ec0], 0
jne 0x14001c47b
mov dword [rbp], 0x626f5227
mov dword [rbp + 4], 0x786f6c
lea rdx, [rbp + 1]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x14001c2de
movdqu xmmword [rsp + 0x40], xmm14
movdqu xmmword [rsp + 0x50], xmm13
movdqu xmmword [rsp + 0x60], xmm12
movdqu xmmword [rsp + 0x70], xmm11
mov dword [rbp - 0x80], 0x5b4e4a47
mov word [rbp - 0x7c], 1
mov rdx, rdi
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rdx + 0x41], al
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rdx + 0x42], al
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rdx + 0x43], al
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rdx + 0x44], al
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rdx + 0x45], al
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rdx + 0x46], al
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rdx + 0x47], al
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rdx + 0x48], al
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rdx + 0x49], al
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rdx + 0x4a], al
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rdx + 0x4b], al
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rdx + 0x4c], al
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rdx + 0x4d], al
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rdx + 0x4e], al
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rdx + 0x4f], al
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rdx + 0x50], al
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rdx + 0x51], al
add rdx, 0x11
cmp rdx, 0x44
jb 0x14001c212
mov byte [rbp - 0x7b], 0
lea rdx, [rsp + 0x41]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140010d80
lea rdx, [0x140010f60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rax, [rbp + 0x50]
mov qword [rbp + 8], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], rdi
mov qword [rbp + 0x68], rdi
xor r8d, r8d
lea rdx, [0x14018d218]
lea rcx, [rbp + 0x50]
call fcn.140004fc0
nop
lea rax, [rbp + 0x30]
mov qword [rbp + 0x158], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], rdi
mov qword [rbp + 0x48], rdi
xor r8d, r8d
lea rdx, [0x14018d218]
lea rcx, [rbp + 0x30]
call fcn.140004fc0
nop
lea rax, [rsp + 0x40]
mov qword [rbp + 0xc0], rax
lea rdx, [rbp + 0xe8]
lea rcx, [rsp + 0x40]
call fcn.140004ad0
mov rbx, rax
lea rax, [rbp + 0x90]
mov qword [rbp + 0xc8], rax
mov dword [rbp - 0x20], 0x63696c16
mov dword [rbp - 0x1c], 0x65736e65
mov byte [rbp - 0x18], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
mov qword [rbp + 0xa0], rdi
mov qword [rbp + 0xa8], rdi
lea rax, [rbp - 0x1f]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14001c3a0
lea rdx, [rbp - 0x1f]
lea rcx, [rbp + 0x90]
call fcn.140004fc0
nop
mov word [rbp - 0x60], 0x5c
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], rdi
mov qword [rbp + 0x28], rdi
lea rax, [rbp - 0x5f]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14001c3e0
lea rdx, [rbp - 0x5f]
lea rcx, [rbp + 0x10]
call fcn.140004fc0
nop
lea rax, [rbp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, rbx
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x10]
call fcn.14001aa50
movdqa xmm0, xmmword [0x140192840]
movdqu xmmword [rsp + 0x40], xmm0
movdqu xmmword [rsp + 0x50], xmm6
mov dword [rsp + 0x60], 0x656c6966
mov word [rsp + 0x64], reloc.WLDAP32.dll_Ordinal_46
lea rdx, [rsp + 0x41]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140010d80
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x14018d2d4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.14000c190
cmp byte [0x140273ec0], 0
je 0x14001c72f
mov dword [rbp + 0xe0], 0x626f5204
mov dword [rbp + 0xe4], 0x786f6c
lea rdx, [rbp + 0xe1]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x14001c59e
movdqu xmmword [rsp + 0x40], xmm10
movdqu xmmword [rsp + 0x50], xmm9
movdqu xmmword [rsp + 0x60], xmm8
movdqu xmmword [rsp + 0x70], xmm7
mov dword [rbp - 0x80], 0x1306020f
mov word [rbp - 0x7c], 0x49
mov rax, rdi
movzx ecx, byte [rsp + 0x40]
xor byte [rsp + rax + 0x41], cl
movzx ecx, byte [rsp + 0x40]
xor byte [rsp + rax + 0x42], cl
movzx ecx, byte [rsp + 0x40]
xor byte [rsp + rax + 0x43], cl
movzx ecx, byte [rsp + 0x40]
xor byte [rsp + rax + 0x44], cl
movzx ecx, byte [rsp + 0x40]
xor byte [rsp + rax + 0x45], cl
movzx ecx, byte [rsp + 0x40]
xor byte [rsp + rax + 0x46], cl
movzx ecx, byte [rsp + 0x40]
xor byte [rsp + rax + 0x47], cl
movzx ecx, byte [rsp + 0x40]
xor byte [rsp + rax + 0x48], cl
movzx ecx, byte [rsp + 0x40]
xor byte [rsp + rax + 0x49], cl
movzx ecx, byte [rsp + 0x40]
xor byte [rsp + rax + 0x4a], cl
movzx ecx, byte [rsp + 0x40]
xor byte [rsp + rax + 0x4b], cl
movzx ecx, byte [rsp + 0x40]
xor byte [rsp + rax + 0x4c], cl
movzx ecx, byte [rsp + 0x40]
xor byte [rsp + rax + 0x4d], cl
movzx ecx, byte [rsp + 0x40]
xor byte [rsp + rax + 0x4e], cl
movzx edx, byte [rsp + 0x40]
xor byte [rsp + rax + 0x4f], dl
movzx edx, byte [rsp + 0x40]
xor byte [rsp + rax + 0x50], dl
movzx edx, byte [rsp + 0x40]
xor byte [rsp + rax + 0x51], dl
add rax, 0x11
cmp rax, 0x44
jb 0x14001c4d2
mov byte [rbp - 0x7b], 0
lea rdx, [rsp + 0x41]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140010d80
lea rdx, [0x140010f60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rax, [rbp + 0x10]
mov qword [rbp + 0x110], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], rdi
mov qword [rbp + 0x28], rdi
xor r8d, r8d
lea rdx, [0x14018d218]
lea rcx, [rbp + 0x10]
call fcn.140004fc0
nop
lea rax, [rbp + 0x90]
mov qword [rbp + 0xc8], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
mov qword [rbp + 0xa0], rdi
mov qword [rbp + 0xa8], rdi
xor r8d, r8d
lea rdx, [0x14018d218]
lea rcx, [rbp + 0x90]
call fcn.140004fc0
nop
lea rax, [rsp + 0x40]
mov qword [rbp + 0xc0], rax
lea rdx, [rbp + 0xe8]
lea rcx, [rsp + 0x40]
call fcn.140004ad0
mov rbx, rax
lea rax, [rbp + 0x50]
mov qword [rbp + 8], rax
mov dword [rbp - 0x10], 0x63696c49
mov dword [rbp - 0xc], 0x65736e65
mov byte [rbp - 8], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], rdi
mov qword [rbp + 0x68], rdi
lea rax, [rbp - 0xf]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14001c660
lea rdx, [rbp - 0xf]
lea rcx, [rbp + 0x50]
call fcn.140004fc0
nop
mov word [rbp - 0x70], 0x76
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], rdi
mov qword [rbp + 0x48], rdi
lea rax, [rbp - 0x6f]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14001c6a0
lea rdx, [rbp - 0x6f]
lea rcx, [rbp + 0x30]
call fcn.140004fc0
nop
lea rax, [rbp + 0x10]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x90]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, rbx
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x30]
call fcn.14001aa50
movdqa xmm0, xmmword [0x140192850]
movdqu xmmword [rsp + 0x40], xmm0
movdqu xmmword [rsp + 0x50], xmm6
mov dword [rsp + 0x60], 0x656c6966
mov word [rsp + 0x64], reloc.WLDAP32.dll_Ordinal_46
lea rdx, [rsp + 0x41]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140010d80
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x14018d2d4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.14000c190
nop
lea rcx, [rbp + 0xe8]
call fcn.140004bf0
nop
lea rcx, [rbp + 0x1a0]
call fcn.140004bf0
nop
lea rcx, [rbp + 0x180]
call fcn.140004bf0
jmp 0x14001bc10
lea rcx, [0x14018d2d4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [rbp - 0x70]
call fcn.14001cae0
lea rcx, [rax + 1]
mov byte [rcx], 0
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rbp + 0x130]
call fcn.14001caf0
lea rdx, [rax + 1]
movzx r8d, byte [rax]
xor byte [rdx], r8b
xor byte [rax + 2], r8b
xor byte [rax + 3], r8b
xor byte [rax + 4], r8b
xor byte [rax + 5], r8b
xor byte [rax + 6], r8b
xor byte [rax + 7], r8b
xor byte [rax + 8], r8b
xor byte [rax + 9], r8b
xor byte [rax + 0xa], r8b
xor byte [rax + 0xb], r8b
xor byte [rax + 0xc], r8b
xor byte [rax + 0xd], r8b
xor byte [rax + 0xe], r8b
xor byte [rax + 0xf], r8b
xor byte [rax + 0x10], r8b
xor byte [rax + 0x11], r8b
xor byte [rax + 0x12], r8b
xor byte [rax + 0x13], r8b
xor byte [rdx + 0x13], r8b
mov byte [rdx + 0x14], 0
call fcn.140010d80
mov rcx, rax
lea rdx, [0x140273ec8]
call fcn.14001ee60
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002920
int3
call fcn.1400029c0
int3
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
lea r8, [rbp + 0x180]
lea rdx, [rbp + 0x110]
lea rcx, str.exists
call fcn.14000a710
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x48], edi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x48], edi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3