Function at 0x1400a9dc0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
mov eax, 0x1358
call fcn.1402c8ef0
sub rsp, rax
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x37a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1378]
mov rax, qword [0x140401d40]
xor rax, rbp
mov qword [rbp + 0x1318], rax
lea rcx, [0x140436177]
call fcn.1402c8d18
lea rcx, [rbp + 0x638]
call fcn.1400ab590
mov qword [rbp + 0x1108], rax
mov rax, qword [rbp + 0x1108]
mov qword [rbp + 0x1110], rax
mov rdx, qword [rbp + 0x1110]
lea rcx, [rbp + 0x678]
call fcn.1400b1770
mov qword [rbp + 0x1118], rax
mov rax, qword [rbp + 0x1340]
add rax, 0x108
mov rdx, qword [rbp + 0x1118]
mov rcx, rax
call fcn.140092690
lea rcx, [rbp + 0x678]
call fcn.140090a60
nop
lea rcx, [rbp + 0x638]
call fcn.140090a60
mov rax, qword [rbp + 0x1340]
add rax, 0x20
mov rcx, rax
call fcn.1400ab9a0
cmp rax, 0xa
jne 0x1400a9eb1
mov rax, qword [rbp + 0x1340]
add rax, 0x40
mov rcx, rax
call fcn.1400ab9a0
cmp rax, 0x40
je 0x1400a9ee5
lea rdx, str._n_n_Application_Not_Setup_Correctly._Please_Watch_Video_Linked_in_Main.cpp
lea rcx, [rbp + 0x6c0]
call fcn.140074e80
mov rdx, rax
lea rcx, [0x140411250]
call fcn.140072400
mov ecx, 0x1194
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call fcn.1402d98e4
lea rdx, str.init_iv
lea rcx, [rbp + 0x728]
call fcn.140074b60
mov rcx, rax
call fcn.1400a33b0
mov qword [rbp + 0x1108], rax
mov rax, qword [rbp + 0x1340]
add rax, 0x20
mov rdx, rax
lea rcx, [rbp + 0x758]
call fcn.1400a7220
mov qword [rbp + 0x1110], rax
mov rax, qword [rbp + 0x1110]
mov qword [rbp + 0x1118], rax
mov rax, qword [rbp + 0x1118]
mov qword [rbp + 0x1120], rax
lea rdx, str.ownerid
lea rcx, [rbp + 0x798]
call fcn.140074b60
mov rcx, rax
call fcn.1400a33b0
mov qword [rbp + 0x1128], rax
mov rax, qword [rbp + 0x1340]
mov rdx, rax
lea rcx, [rbp + 0x7c8]
call fcn.1400a7220
mov qword [rbp + 0x1130], rax
mov rax, qword [rbp + 0x1130]
mov qword [rbp + 0x1138], rax
mov rax, qword [rbp + 0x1138]
mov qword [rbp + 0x1140], rax
lea rdx, [0x14031cc5c]
lea rcx, [rbp + 0x808]
call fcn.140074ac0
mov rcx, rax
call fcn.1400a3330
mov qword [rbp + 0x1148], rax
lea rax, [rbp + 0x828]
mov qword [rbp + 0x868], rax
lea rdx, [0x140405718]
mov rcx, qword [rbp + 0x868]
call fcn.14008a3a0
mov qword [rbp + 0x1150], rax
mov rax, qword [rbp + 0x1150]
mov qword [rbp + 0x1158], rax
mov rax, qword [rbp + 0x1158]
mov qword [rbp + 0x1160], rax
lea rax, [rbp + 0x888]
mov qword [rbp + 0x8c8], rax
mov rax, qword [rbp + 0x1340]
add rax, 0x40
mov rdx, rax
mov rcx, qword [rbp + 0x8c8]
call fcn.14008a3a0
mov qword [rbp + 0x1168], rax
mov rax, qword [rbp + 0x1168]
mov qword [rbp + 0x1170], rax
mov rax, qword [rbp + 0x1170]
mov qword [rbp + 0x1178], rax
lea rax, [rbp + 0x8e8]
mov qword [rbp + 0x928], rax
mov rax, qword [rbp + 0x1340]
add rax, 0x108
mov rdx, rax
mov rcx, qword [rbp + 0x928]
call fcn.14008a3a0
mov qword [rbp + 0x1180], rax
mov rax, qword [rbp + 0x1180]
mov qword [rbp + 0x1188], rax
mov r9, qword [rbp + 0x1160]
mov r8, qword [rbp + 0x1178]
mov rdx, qword [rbp + 0x1188]
lea rcx, [rbp + 0x948]
call fcn.1400a74d0
mov qword [rbp + 0x1190], rax
mov rax, qword [rbp + 0x1190]
mov qword [rbp + 0x1198], rax
mov rax, qword [rbp + 0x1198]
mov qword [rbp + 0x11a0], rax
lea rdx, str.enckey
lea rcx, [rbp + 0x988]
call fcn.140074b10
mov rcx, rax
call fcn.1400a3370
mov qword [rbp + 0x11a8], rax
lea rax, [rbp + 0x9b8]
mov qword [rbp + 0x9f8], rax
lea rdx, [0x140405718]
mov rcx, qword [rbp + 0x9f8]
call fcn.14008a3a0
mov qword [rbp + 0x11b0], rax
mov rax, qword [rbp + 0x11b0]
mov qword [rbp + 0x11b8], rax
mov rax, qword [rbp + 0x11b8]
mov qword [rbp + 0x11c0], rax
lea rax, [rbp + 0xa18]
mov qword [rbp + 0xa58], rax
mov rax, qword [rbp + 0x1340]
add rax, 0x40
mov rdx, rax
mov rcx, qword [rbp + 0xa58]
call fcn.14008a3a0
mov qword [rbp + 0x11c8], rax
mov rax, qword [rbp + 0x11c8]
mov qword [rbp + 0x11d0], rax
mov rax, qword [rbp + 0x11d0]
mov qword [rbp + 0x11d8], rax
lea rax, [rbp + 0xa78]
mov qword [rbp + 0xab8], rax
mov rax, qword [rbp + 0x1340]
add rax, 0x60
mov rdx, rax
mov rcx, qword [rbp + 0xab8]
call fcn.14008a3a0
mov qword [rbp + 0x11e0], rax
mov rax, qword [rbp + 0x11e0]
mov qword [rbp + 0x11e8], rax
mov r9, qword [rbp + 0x11c0]
mov r8, qword [rbp + 0x11d8]
mov rdx, qword [rbp + 0x11e8]
lea rcx, [rbp + 0xad8]
call fcn.1400a74d0
mov qword [rbp + 0x11f0], rax
mov rax, qword [rbp + 0x11f0]
mov qword [rbp + 0x11f8], rax
mov rax, qword [rbp + 0x11f8]
mov qword [rbp + 0x1200], rax
lea rdx, str.ver
lea rcx, [rbp + 0xb14]
call fcn.140074a70
mov rcx, rax
call fcn.1400a32f0
mov qword [rbp + 0x1208], rax
lea rdx, str.init
lea rcx, [rbp + 0xb74]
call fcn.140074a20
mov rcx, rax
call fcn.1400a32b0
mov rdx, rax
lea rcx, [rbp + 0xb38]
call fcn.14008a560
nop
lea rdx, [rbp + 0xb38]
lea rcx, [rbp + 0xb98]
call fcn.1400a7220
mov qword [rbp + 0x1210], rax
mov rax, qword [rbp + 0x1210]
mov qword [rbp + 0x1218], rax
mov rax, qword [rbp + 0x1218]
mov qword [rbp + 0x1220], rax
lea rdx, [0x14031cc84]
lea rcx, [rbp + 0xbd4]
call fcn.140074a70
mov rcx, rax
call fcn.1400a32f0
mov qword [rbp + 0x1228], rax
mov r8, qword [rbp + 0x1220]
mov rdx, qword [rbp + 0x1228]
lea rcx, [rbp + 0xbf8]
call fcn.140072c80
mov qword [rbp + 0x1230], rax
mov rax, qword [rbp + 0x1230]
mov qword [rbp + 0x1238], rax
mov rax, qword [rbp + 0x1238]
mov qword [rbp + 0x1240], rax
mov r8, qword [rbp + 0x1208]
mov rdx, qword [rbp + 0x1240]
lea rcx, [rbp + 0xc38]
call fcn.140072c00
mov qword [rbp + 0x1248], rax
mov rax, qword [rbp + 0x1248]
mov qword [rbp + 0x1250], rax
mov rax, qword [rbp + 0x1250]
mov qword [rbp + 0x1258], rax
mov r8, qword [rbp + 0x1200]
mov rdx, qword [rbp + 0x1258]
lea rcx, [rbp + 0xc78]
call fcn.140072b00
mov qword [rbp + 0x1260], rax
mov rax, qword [rbp + 0x1260]
mov qword [rbp + 0x1268], rax
mov rax, qword [rbp + 0x1268]
mov qword [rbp + 0x1270], rax
mov r8, qword [rbp + 0x11a8]
mov rdx, qword [rbp + 0x1270]
lea rcx, [rbp + 0xcb8]
call fcn.140072c00
mov qword [rbp + 0x1278], rax
mov rax, qword [rbp + 0x1278]
mov qword [rbp + 0x1280], rax
mov rax, qword [rbp + 0x1280]
mov qword [rbp + 0x1288], rax
mov r8, qword [rbp + 0x11a0]
mov rdx, qword [rbp + 0x1288]
lea rcx, [rbp + 0xcf8]
call fcn.140072b00
mov qword [rbp + 0x1290], rax
mov rax, qword [rbp + 0x1290]
mov qword [rbp + 0x1298], rax
mov rax, qword [rbp + 0x1298]
mov qword [rbp + 0x12a0], rax
mov r8, qword [rbp + 0x1148]
mov rdx, qword [rbp + 0x12a0]
lea rcx, [rbp + 0xd38]
call fcn.140072c00
mov qword [rbp + 0x12a8], rax
mov rax, qword [rbp + 0x12a8]
mov qword [rbp + 0x12b0], rax
mov rax, qword [rbp + 0x12b0]
mov qword [rbp + 0x12b8], rax
mov r8, qword [rbp + 0x1140]
mov rdx, qword [rbp + 0x12b8]
lea rcx, [rbp + 0xd78]
call fcn.140072b00
mov qword [rbp + 0x12c0], rax
mov rax, qword [rbp + 0x12c0]
mov qword [rbp + 0x12c8], rax
mov rax, qword [rbp + 0x12c8]
mov qword [rbp + 0x12d0], rax
mov r8, qword [rbp + 0x1128]
mov rdx, qword [rbp + 0x12d0]
lea rcx, [rbp + 0xdb8]
call fcn.140072c00
mov qword [rbp + 0x12d8], rax
mov rax, qword [rbp + 0x12d8]
mov qword [rbp + 0x12e0], rax
mov rax, qword [rbp + 0x12e0]
mov qword [rbp + 0x12e8], rax
mov r8, qword [rbp + 0x1120]
mov rdx, qword [rbp + 0x12e8]
lea rcx, [rbp + 0xdf8]
call fcn.140072b00
mov qword [rbp + 0x12f0], rax
mov rax, qword [rbp + 0x12f0]
mov qword [rbp + 0x12f8], rax
mov rax, qword [rbp + 0x12f8]
mov qword [rbp + 0x1300], rax
mov r8, qword [rbp + 0x1108]
mov rdx, qword [rbp + 0x1300]
lea rcx, [rbp + 0xe38]
call fcn.140072c00
mov qword [rbp + 0x1308], rax
mov rax, qword [rbp + 0x1308]
mov qword [rbp + 0x1310], rax
lea r8, [0x140405718]
mov rdx, qword [rbp + 0x1310]
lea rcx, [rbp + 8]
call fcn.140072b80
nop
lea rcx, [rbp + 0xe38]
call fcn.140090a60
nop
lea rcx, [rbp + 0xdf8]
call fcn.140090a60
nop
lea rcx, [rbp + 0xdb8]
call fcn.140090a60
nop
lea rcx, [rbp + 0xd78]
call fcn.140090a60
nop
lea rcx, [rbp + 0xd38]
call fcn.140090a60
nop
lea rcx, [rbp + 0xcf8]
call fcn.140090a60
nop
lea rcx, [rbp + 0xcb8]
call fcn.140090a60
nop
lea rcx, [rbp + 0xc78]
call fcn.140090a60
nop
lea rcx, [rbp + 0xc38]
call fcn.140090a60
nop
lea rcx, [rbp + 0xbf8]
call fcn.140090a60
nop
lea rcx, [rbp + 0xb98]
call fcn.140090a60
nop
lea rcx, [rbp + 0xb38]
call fcn.140090a60
nop
lea rcx, [rbp + 0xad8]
call fcn.140090a60
nop
lea rcx, [rbp + 0x948]
call fcn.140090a60
nop
lea rcx, [rbp + 0x7c8]
call fcn.140090a60
nop
lea rcx, [rbp + 0x758]
call fcn.140090a60
lea rax, [rbp + 0xe78]
mov qword [rbp + 0xeb8], rax
lea rdx, [rbp + 8]
mov rcx, qword [rbp + 0xeb8]
call fcn.14008a3a0
mov qword [rbp + 0x1108], rax
mov rdx, qword [rbp + 0x1108]
lea rcx, [rbp + 0x48]
call fcn.1400aec20
nop
lea rax, [rbp + 0xed8]
mov qword [rbp + 0xf18], rax
lea rdx, [0x140405718]
mov rcx, qword [rbp + 0xf18]
call fcn.14008a3a0
mov qword [rbp + 0x1108], rax
mov rax, qword [rbp + 0x1108]
mov qword [rbp + 0x1110], rax
mov rax, qword [rbp + 0x1110]
mov qword [rbp + 0x1118], rax
lea rax, [rbp + 0xf38]
mov qword [rbp + 0xf78], rax
mov rax, qword [rbp + 0x1340]
add rax, 0x40
mov rdx, rax
mov rcx, qword [rbp + 0xf78]
call fcn.14008a3a0
mov qword [rbp + 0x1120], rax
mov rax, qword [rbp + 0x1120]
mov qword [rbp + 0x1128], rax
mov rax, qword [rbp + 0x1128]
mov qword [rbp + 0x1130], rax
lea rax, [rbp + 0xf98]
mov qword [rbp + 0xfd8], rax
lea rdx, [rbp + 0x48]
mov rcx, qword [rbp + 0xfd8]
call fcn.14008a3a0
mov qword [rbp + 0x1138], rax
mov rax, qword [rbp + 0x1138]
mov qword [rbp + 0x1140], rax
mov r9, qword [rbp + 0x1118]
mov r8, qword [rbp + 0x1130]
mov rdx, qword [rbp + 0x1140]
lea rcx, [rbp + 0xff8]
call fcn.1400a6050
mov qword [rbp + 0x1148], rax
mov rdx, qword [rbp + 0x1148]
lea rcx, [rbp + 0x48]
call fcn.140092690
lea rcx, [rbp + 0xff8]
call fcn.140090a60
lea rax, [rbp + 0x1038]
mov qword [rbp + 0x1098], rax
xor edx, edx
mov rcx, qword [rbp + 0x1098]
call fcn.14008b190
mov qword [rbp + 0x1108], rax
mov byte [rsp + 0x20], 0
mov r9b, 1
mov r8, qword [rbp + 0x1108]
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0x88]
call fcn.140083740
nop
lea rdx, str.success
lea rcx, [rbp + 0x88]
call fcn.140072870
mov rcx, rax
call fcn.140072ac0
movzx eax, al
test eax, eax
je 0x1400aa7b4
lea rdx, [0x14031cc98]
lea rcx, [rbp + 0x88]
call fcn.140072870
mov rcx, qword [rbp + 0x1340]
add rcx, 0xe8
mov rdx, rax
call fcn.140071ee0
jmp 0x1400aa8f7
lea rdx, str.message
lea rcx, [rbp + 0x88]
call fcn.140072870
lea rdx, str.invalidver
mov rcx, rax
call fcn.140072630
movzx eax, al
test eax, eax
je 0x1400aa855
lea rdx, str.download
lea rcx, [rbp + 0x88]
call fcn.140072870
mov qword [rbp + 0x1108], rax
lea rdx, [rbp + 0xb8]
mov rcx, qword [rbp + 0x1108]
call fcn.140072a00
lea rcx, [rbp + 0xb8]
call fcn.1400a39a0
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor ecx, ecx
call fcn.1402d98e4
nop
lea rcx, [rbp + 0xb8]
call fcn.140090a60
jmp 0x1400aa8f7
lea rdx, [0x14031ccd4]
lea rcx, [0x140411250]
call fcn.140071fa0
lea rcx, [rbp + 0x10f4]
call fcn.140076470
mov qword [rbp + 0x1108], rax
lea rdx, str.message
lea rcx, [rbp + 0x88]
call fcn.140072870
mov qword [rbp + 0x1110], rax
mov r8, qword [rbp + 0x1108]
mov rdx, qword [rbp + 0x1110]
lea rcx, [rbp + 0x10b8]
call fcn.140071b20
mov qword [rbp + 0x1118], rax
mov rax, qword [rbp + 0x1118]
mov qword [rbp + 0x1120], rax
mov rdx, qword [rbp + 0x1120]
lea rcx, [0x140411250]
call fcn.140071f30
nop
lea rcx, [rbp + 0x10b8]
call fcn.140090a60
mov ecx, 0x1194
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call fcn.1402d98e4
nop
lea rcx, [rbp + 0x88]
call fcn.140090900
nop
lea rcx, [rbp + 0x48]
call fcn.140090a60
nop
lea rcx, [rbp + 8]
call fcn.140090a60
lea rcx, [rbp - 0x30]
lea rdx, reloc.WS2_32.dll_connect
call fcn.1402c8bbc
mov rcx, qword [rbp + 0x1318]
xor rcx, rbp
call fcn.1402c8f50
lea rsp, [rbp + 0x1328]
pop rdi
pop rbp
ret