Function at 0x140061ca0
Capabilities:
Enumerate process modules
Get disk information
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
lea rbp, [rsp - 0xa00]
sub rsp, 0xb00
movaps xmmword [rsp + 0xaf0], xmm6
mov rax, qword [0x1401cc760]
xor rax, rsp
mov qword [rbp + 0x9e0], rax
mov r12d, r9d
mov r13, rcx
call qword [sym.imp.KERNEL32.dll_AllocConsole]
mov ecx, 1
call fcn.14013c600
mov rbx, rax
mov ecx, 1
call fcn.14013c600
mov r9, rbx
lea r8, [0x1401ac5f8]
lea rdx, str.CONOUT_
mov rcx, rax
call fcn.140147a2c
xor ebx, ebx
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x10]
xor r8d, r8d
xor edx, edx
lea rcx, [0x1401ac608]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x140061d5e
lea r9d, [rbx + 0x10]
lea r8, str.byteguardian.cc
lea rdx, str.Failed_to_get_user_HWID.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x140062022
lea r10, [rbp + 0x15]
mov r8d, dword [rbp - 0x10]
nop word [rax + rax]
dec r10
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r10], r8b
mov r8d, edx
test edx, edx
jne 0x140061d70
lea r9, [rsp + 0x60]
lea r8, [rbp + 0x15]
mov rdx, r10
lea rcx, [rbp + 0x70]
call fcn.14005f970
xor edx, edx
mov r8d, 0x138
lea rcx, [rbp + 0x90]
call fcn.140137db0
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rbx
mov qword [rbp - 0x78], rbx
mov r8d, 0x19
lea rdx, str.http:__130.61.90.23:3000_
lea rcx, [rsp + 0x70]
call fcn.14005a0c0
lea rdx, [rbp + 0x70]
lea rcx, [rbp - 0x70]
call fcn.14005f1a0
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], rbx
mov r8d, 1
lea rdx, [0x1401ac65c]
lea rcx, [rbp - 0x50]
call fcn.14005a0c0
lea rdx, str.2.5.0
lea rcx, [rbp - 0x30]
call fcn.14005f1a0
lea rax, [rsp + 0x70]
mov qword [rbp + 0x30], rax
lea rax, [rbp - 0x10]
mov qword [rbp + 0x38], rax
movaps xmm0, xmmword [rbp + 0x30]
movdqa xmmword [rbp + 0x30], xmm0
lea rdx, [rbp + 0x30]
lea rcx, [rbp]
call fcn.140063240
lea rax, vtable.cpr::Url.0
mov qword [rbp], rax
xor edx, edx
mov r8d, 0x2c0
lea rcx, [rbp + 0x1e0]
call fcn.140137db0
lea rcx, [rbp + 0x1e0]
call fcn.1400cfef0
lea rdx, [rbp]
lea rcx, [rbp + 0x1e0]
call fcn.1400d0dc0
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x1e0]
call fcn.1400d0830
lea rcx, [rbp + 0x1e0]
call fcn.140064180
mov rdx, qword [rbp + 0x20]
cmp rdx, 0x10
jb 0x140061ee8
inc rdx
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061ee3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062d6d
call fcn.140133220
mov qword [rbp + 0x18], rbx
mov qword [rbp + 0x20], reloc.WS2_32.dll_ntohs
mov byte [rbp + 8], bl
lea r9, [fcn.140059e10]
mov edx, 0x20
lea r8d, [rdx - 0x1c]
lea rcx, [rsp + 0x70]
call fcn.140132f00
mov rax, qword [rbp + 0xb8]
test rax, rax
jne 0x140061f29
lea rdx, str.Failed_to_get_response_from_server._Most_likely_offline.
jmp 0x140061fc3
lea rdi, [rbp + 0xa8]
cmp qword [rbp + 0xc0], 0x10
cmovae rdi, qword [rbp + 0xa8]
cmp rax, 7
jb 0x140061fac
lea rsi, [rax + rdi]
lea r8, [rsi - 6]
sub r8, rdi
mov edx, 0x57
mov rcx, rdi
call fcn.140138150
mov rbx, rax
test rax, rax
je 0x140061fac
nop word [rax + rax]
mov r8d, 7
lea rdx, str.Welcome
mov rcx, rbx
call fcn.1401381f0
test eax, eax
je 0x140062052
inc rbx
lea r8, [rsi - 6]
sub r8, rbx
mov edx, 0x57
mov rcx, rbx
call fcn.140138150
mov rbx, rax
test rax, rax
jne 0x140061f70
lea rdx, [rbp + 0xa8]
cmp qword [rbp + 0xc0], 0x10
cmovae rdx, qword [rbp + 0xa8]
mov r9d, reloc.WS2_32.dll_recv
lea r8, str.byteguardian.cc
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rcx, [rbp + 0x90]
call fcn.140062de0
mov rdx, qword [rbp + 0x88]
cmp rdx, 0x10
jb 0x140062022
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006201d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062d73
call fcn.140133220
xor eax, eax
mov rcx, qword [rbp + 0x9e0]
xor rcx, rsp
call fcn.140132b60
mov rbx, qword [rsp + 0xb38]
movaps xmm6, xmmword [rsp + 0xaf0]
add rsp, 0xb00
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
sub rbx, rdi
cmp rbx, 0xffffffffffffffff
je 0x140061fac
lea rdx, str.Waiting_for_CS2_Process...
lea rcx, [0x140251100]
call fcn.140063df0
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.140063a40
movzx edx, al
mov rcx, rbx
call fcn.140064880
mov rcx, rbx
call fcn.140063820
movabs rdi, 0x7fffffffc46535fe
movabs rsi, 0x7fffffffffffffff
nop dword [rax]
mov rbx, qword [0x140252900]
call fcn.140065180
mov dword [rbx], eax
test eax, eax
jne 0x140062134
call fcn.140133cbc
mov rbx, rax
call fcn.140133ca0
cmp rbx, 0x989680
jne 0x1400620de
imul rax, rax, 0x64
jmp 0x1400620fc
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
imul rcx, rcx, 0x3b9aca00
add rax, rcx
cmp rax, rdi
jg 0x14006211c
add rax, 0x3b9aca00
mov qword [rbp + 0x1d0], rax
lea rcx, [rbp + 0x1d0]
call fcn.14005a670
jmp 0x1400620b0
mov qword [rbp + 0x1d0], rsi
lea rcx, [rbp + 0x1d0]
call fcn.14005a670
jmp 0x1400620b0
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbx + 8], rax
mov dword [rsp + 0x20], 2
lea r9, [rbp + 0x1d0]
mov r8d, 0x7f8
lea rdx, [rbp + 0x1e0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModulesEx]
mov rdx, qword [rbp + 0x1e0]
mov qword [rbx + 0x18], rdx
mov r9d, 0x18
lea r8, [rbp]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
mov eax, dword [rbp + 8]
mov qword [rbx + 0x20], rax
mov edx, dword [rbx]
call fcn.1400653b0
mov qword [rbx + 0x10], rax
lea rdx, str.Waiting_for_client.dll...
lea rcx, [0x140251100]
call fcn.140063df0
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.140063a40
movzx edx, al
mov rcx, rbx
call fcn.140064880
mov rcx, rbx
call fcn.140063820
movabs rdi, 0x7fffffffc46535ff
nop dword [rax]
nop word [rax + rax]
lea rdx, [rbp]
mov rcx, qword [0x140252900]
call fcn.140065470
movups xmm0, xmmword [rax]
movups xmmword [0x1402528a8], xmm0
call fcn.140133cbc
mov rbx, rax
call fcn.140133ca0
cmp rbx, 0x989680
jne 0x140062226
imul rax, rax, 0x64
jmp 0x140062241
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, rdi
jge 0x140062255
add rax, 0x3b9aca00
mov qword [rbp + 0x1d0], rax
jmp 0x14006225c
mov qword [rbp + 0x1d0], rsi
lea rcx, [rbp + 0x1d0]
call fcn.14005a670
cmp qword [0x1402528a8], 0
je 0x1400621f0
lea rdx, str.Found_client.dll.
lea rcx, [0x140251100]
call fcn.140063df0
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.140063a40
movzx edx, al
mov rcx, rbx
call fcn.140064880
mov rcx, rbx
call fcn.140063820
mov rdi, qword [0x140252900]
movups xmm6, xmmword [0x1402528a8]
mov dword [rbp + 0x1d0], 0xd8b48
mov dword [rbp + 0x1d4], 0x48000000
mov dword [rbp + 0x1d8], 0x247c89
mov dword [rbp + 0x1dc], 0xebc1fa8b
mov ecx, reloc.WS2_32.dll_recv
call fcn.140133298
mov qword [rbp], rax
lea rbx, [rax + 0x10]
mov qword [rbp + 0x10], rbx
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rbp + 0x1d0]
mov rcx, rax
call fcn.140137710
mov qword [rbp + 8], rbx
movaps xmmword [rbp + 0x30], xmm6
lea r8, [rbp + 0x30]
lea rdx, [rbp]
mov rcx, rdi
call fcn.140061930
sub rax, qword [0x1402528a8]
mov qword [0x1402528b8], rax
mov rdi, qword [0x140252900]
movups xmm6, xmmword [0x1402528a8]
mov dword [rbp + 0x1d0], 0xd8948
mov dword [rbp + 0x1d4], 0x48000000
mov word [rbp + 0x1d8], 0x4189
mov ecx, 0xa
call fcn.140133298
mov rbx, rax
mov qword [rbp], rax
lea rdx, [rax + 0xa]
mov qword [rbp + 0x10], rdx
mov r8d, 0xa
lea rdx, [rbp + 0x1d0]
mov rcx, rax
call fcn.140137710
lea rax, [rbx + 0xa]
mov qword [rbp + 8], rax
movaps xmmword [rbp + 0x30], xmm6
lea r8, [rbp + 0x30]
lea rdx, [rbp]
mov rcx, rdi
call fcn.140061930
sub rax, qword [0x1402528a8]
mov qword [0x1402528c8], rax
mov rdi, qword [0x140252900]
movups xmm6, xmmword [0x1402528a8]
mov dword [rbp + 0x1d0], 0xd8d48
mov dword [rbp + 0x1d4], 0x48000000
mov word [rbp + 0x1d8], 0xe0c1
mov byte [rbp + 0x1da], 6
mov ecx, ntohs
call fcn.140133298
mov qword [rbp], rax
lea rbx, [rax + 0xb]
mov qword [rbp + 0x10], rbx
mov r8d, ntohs
lea rdx, [rbp + 0x1d0]
mov rcx, rax
call fcn.140137710
mov qword [rbp + 8], rbx
movaps xmmword [rbp + 0x30], xmm6
lea r8, [rbp + 0x30]
lea rdx, [rbp]
mov rcx, rdi
call fcn.140061930
sub rax, qword [0x1402528a8]
mov qword [0x1402528d0], rax
mov rdi, qword [0x140252900]
movups xmm6, xmmword [0x1402528a8]
mov dword [rbp + 0x40], 0x58948
mov dword [rbp + 0x44], 0x8b000000
mov dword [rbp + 0x48], 5
mov dword [rbp + 0x4c], 0xa900
mov dword [rbp + 0x50], 0x740000
mov dword [rbp + 0x54], 0x25
mov dword [rbp + 0x58], 0x58900
mov dword [rbp + 0x5c], 0x8b000000
mov byte [rbp + 0x60], reloc.WS2_32.dll_listen
mov ecx, 0x21
call fcn.140133298
mov qword [rbp], rax
lea rbx, [rax + 0x21]
mov qword [rbp + 0x10], rbx
mov r8d, 0x21
lea rdx, [rbp + 0x40]
mov rcx, rax
call fcn.140137710
mov qword [rbp + 8], rbx
movaps xmmword [rbp + 0x30], xmm6
lea r8, [rbp + 0x30]
lea rdx, [rbp]
mov rcx, rdi
call fcn.140061930
sub rax, qword [0x1402528a8]
mov qword [0x1402528c0], rax
mov rdi, qword [0x140252900]
movups xmm6, xmmword [0x1402528a8]
mov dword [rbp], 0x58d48
mov dword [rbp + 4], 0xc3000000
mov dword [rbp + 8], 0xcccccccc
mov dword [rbp + 0xc], 0xcccccccc
mov dword [rbp + 0x10], 0xec8348
mov word [rbp + 0x14], 0xd8b
mov ecx, socket
call fcn.140133298
mov qword [rbp + 0x40], rax
lea rbx, [rax + 0x16]
mov qword [rbp + 0x50], rbx
mov r8d, socket
lea rdx, [rbp]
mov rcx, rax
call fcn.140137710
mov qword [rbp + 0x48], rbx
movaps xmmword [rbp + 0x30], xmm6
lea r8, [rbp + 0x30]
lea rdx, [rbp + 0x40]
mov rcx, rdi
call fcn.140061930
sub rax, qword [0x1402528a8]
add rax, 0x118
mov qword [0x1402528a0], rax
call fcn.1400585b0
test eax, eax
jne 0x14006262d
lea rdx, str.Failed_to_start_Logitech_driver.
lea rcx, [0x140251100]
call fcn.140063df0
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.140063a40
movzx edx, al
mov rcx, rbx
call fcn.140064880
mov rcx, rbx
call fcn.140063820
call fcn.140133cbc
mov rbx, rax
call fcn.140133ca0
cmp rbx, 0x989680
jne 0x1400625c3
imul rax, rax, 0x64
jmp 0x1400625e1
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
imul rcx, rcx, 0x3b9aca00
add rax, rcx
movabs rcx, 0x7ffffffed5fa0dfe
cmp rax, rcx
jg 0x140062615
movabs rcx, 0x12a05f200
add rcx, rax
mov qword [rbp + 0x1d0], rcx
lea rcx, [rbp + 0x1d0]
call fcn.14005a670
jmp 0x140061fd8
mov qword [rbp + 0x1d0], rsi
lea rcx, [rbp + 0x1d0]
call fcn.14005a670
jmp 0x140061fd8
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_FreeConsole]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x12]
mov rcx, rbx
call qword [sym.imp.USER32.dll_PostMessageW]
call qword [sym.imp.USER32.dll_GetDesktopWindow]
lea rdx, [rbp + 0x30]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rbp + 0x38]
mov dword [0x140252870], eax
mov eax, dword [rbp + 0x3c]
mov dword [0x140252858], eax
mov dword [0x140252800], 0x50
mov dword [0x140252804], 3
lea rax, [0x1400587d0]
mov qword [0x140252808], rax
mov qword [0x140252818], r13
lea rbx, [0x1401ac028]
mov qword [0x140252840], rbx
lea rcx, [0x140252800]
call qword [sym.imp.USER32.dll_RegisterClassExW]
xor edi, edi
mov qword [rsp + 0x58], rdi
mov rax, qword [0x140252818]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov eax, dword [0x140252858]
mov dword [rsp + 0x38], eax
mov eax, dword [0x140252870]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
mov r9d, 0x80000000
mov r8, rbx
mov rdx, qword [0x140252840]
mov ecx, 0x80028
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov qword [0x1402527e8], rax
lea r9d, [rdi + 2]
mov r8b, 0xff
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
lea rdx, [rbp + 0x30]
mov rcx, qword [0x1402527e8]
call qword [sym.imp.USER32.dll_GetClientRect]
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
lea rdx, [rbp]
mov rcx, qword [0x1402527e8]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov qword [rbp + 0x1d0], rdi
lea rdx, [rbp + 0x1d0]
mov rcx, qword [0x1402527e8]
call qword [sym.imp.USER32.dll_ClientToScreen]
mov eax, dword [rbp + 0x1d0]
mov dword [rbp + 0x40], eax
mov eax, dword [rbp + 0x1d4]
mov dword [rbp + 0x44], eax
mov eax, dword [rbp + 0x38]
mov dword [rbp + 0x48], eax
mov eax, dword [rbp + 0x3c]
mov dword [rbp + 0x4c], eax
lea rdx, [rbp + 0x40]
mov rcx, qword [0x1402527e8]
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
nop
mov dword [0x1402527a0], 0x1c
mov dword [0x1402527ac], 1
mov dword [0x1402527b4], 0x20
mov dword [0x1402527b8], 1
mov rax, qword [0x1402527e8]
mov qword [0x1402527c0], rax
mov qword [0x1402527c8], 1
mov dword [0x1402527d0], 2
mov dword [rbp + 0x1d0], 0xb000
mov dword [rbp + 0x1d4], 0xa000
lea rax, [0x1402527f0]
mov qword [rsp + 0x58], rax
lea rax, [0x1402527e0]
mov qword [rsp + 0x50], rax
lea rax, [0x1402527f8]
mov qword [rsp + 0x48], rax
lea rax, [0x1402527d8]
mov qword [rsp + 0x40], rax
lea rax, [0x140252790]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], 1
lea rax, [rbp + 0x1d0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi + 1]
xor ecx, ecx
call qword [sym.imp.d3d11.dll_D3D11CreateDeviceAndSwapChain]
mov rcx, qword [0x1402527d8]
mov rax, qword [rcx]
lea r9, [0x140252850]
lea r8, [0x1401ab7b8]
xor edx, edx
call qword [rax + 0x48]
mov rdx, qword [0x140252850]
test rdx, rdx
je 0x1400628d3
mov rcx, qword [0x1402527f8]
mov rax, qword [rcx]
lea r9, [0x140252788]
xor r8d, r8d
call qword [rax + 0x48]
mov rcx, qword [0x140252850]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov edx, r12d
mov rcx, qword [0x1402527e8]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1402527e8]
call qword [sym.imp.USER32.dll_UpdateWindow]
nop
call fcn.140058830
mov ecx, 8
call fcn.140133298
lea rcx, [0x14005a420]
mov qword [rax], rcx
lea rcx, [rbp + 0x1d8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x140064ec0]
xor edx, edx
xor ecx, ecx
call fcn.140147820
mov qword [rbp + 0x1d0], rax
test rax, rax
je 0x140062d5c
cmp dword [rbp + 0x1d8], 0
je 0x140062dcd
movaps xmm0, xmmword [rbp + 0x1d0]
movdqa xmmword [rbp], xmm0
lea rcx, [rbp]
call fcn.140133fb8
test eax, eax
jne 0x140062dcd
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x1d0], xmm0
lea ecx, [rax + 8]
call fcn.140133298
lea rcx, [0x140060aa0]
mov qword [rax], rcx
lea rcx, [rbp + 0x1d8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x140064ec0]
xor edx, edx
xor ecx, ecx
call fcn.140147820
mov qword [rbp + 0x1d0], rax
test rax, rax
je 0x140062dbc
cmp dword [rbp + 0x1d8], 0
je 0x140062db1
movaps xmm0, xmmword [rbp + 0x1d0]
movdqa xmmword [rbp], xmm0
lea rcx, [rbp]
call fcn.140133fb8
test eax, eax
jne 0x140062db1
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x1d0], xmm0
lea ecx, [rax + 8]
call fcn.140133298
lea rcx, [0x140060600]
mov qword [rax], rcx
lea rcx, [rbp + 0x1d8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x140064ec0]
xor edx, edx
xor ecx, ecx
call fcn.140147820
mov qword [rbp + 0x1d0], rax
test rax, rax
je 0x140062da0
cmp dword [rbp + 0x1d8], 0
je 0x140062d95
movaps xmm0, xmmword [rbp + 0x1d0]
movdqa xmmword [rbp], xmm0
lea rcx, [rbp]
call fcn.140133fb8
test eax, eax
jne 0x140062d95
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x1d0], xmm0
lea ecx, [rax + 8]
call fcn.140133298
lea rcx, [0x140060970]
mov qword [rax], rcx
lea rcx, [rbp + 0x1d8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x140064ec0]
xor edx, edx
xor ecx, ecx
call fcn.140147820
mov qword [rbp + 0x1d0], rax
test rax, rax
je 0x140062d84
cmp dword [rbp + 0x1d8], 0
je 0x140062d79
movaps xmm0, xmmword [rbp + 0x1d0]
movdqa xmmword [rbp], xmm0
lea rcx, [rbp]
call fcn.140133fb8
test eax, eax
jne 0x140062d79
cmp byte [reloc.WS2_32.dll_accept], al
je 0x140062d35
nop dword [rax]
nop word [rax + rax]
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x40]
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x140062b6b
nop
lea rcx, [rbp + 0x40]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x40]
call qword [sym.imp.USER32.dll_DispatchMessageW]
mov edx, 3
mov rcx, qword [0x140252900]
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.USER32.dll_GetWindow]
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, qword [0x1402527e8]
call qword [sym.imp.USER32.dll_SetWindowPos]
cmp dword [rbp + 0x48], 0x12
jne 0x140062b4d
mov byte [reloc.WS2_32.dll_accept], 0
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x40]
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x140062af0
mov ecx, 0x2d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x140062b8f
mov ecx, 0x2e
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140062c60
cmp byte [0x140252898], 0
jne 0x140062bf1
mov edx, 0xffffffec
mov rcx, qword [0x1402527e8]
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov ebx, eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [0x140252890], rax
cmp ebx, 0x80008
je 0x140062bd9
mov edx, 0xffffffec
mov r8d, 0x80008
mov rcx, qword [0x1402527e8]
call qword [sym.imp.USER32.dll_SetWindowLongW]
mov rcx, qword [0x1402527e8]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
movzx eax, byte [0x140252898]
test al, al
je 0x140062c38
mov edx, 0xffffffec
mov rcx, qword [0x1402527e8]
call qword [sym.imp.USER32.dll_GetWindowLongW]
cmp eax, 0x80028
je 0x140062c22
mov edx, 0xffffffec
mov r8d, 0x80028
mov rcx, qword [0x1402527e8]
call qword [sym.imp.USER32.dll_SetWindowLongW]
mov rcx, qword [0x140252890]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
movzx eax, byte [0x140252898]
test al, al
sete byte [0x140252898]
nop
mov ecx, 0x2d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x140062c40
mov ecx, 0x2e
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x140062c40
mov rax, qword [0x140252710]
test rax, rax
je 0x140062c75
mov rcx, qword [rax + 0xa0]
jmp 0x140062c78
mov rcx, rdi
cmp qword [rcx + 0x48], 0
jne 0x140062c84
call fcn.140039ea0
call fcn.14003b910
call fcn.14000a3f0
mov rcx, qword [0x140252860]
call fcn.140013cc0
nop
call fcn.140059370
nop
call fcn.140013d60
call fcn.14000ca60
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov rcx, qword [0x1402527f0]
mov rax, qword [rcx]
xor r9d, r9d
lea r8, [0x140252788]
lea edx, [r9 + 1]
call qword [rax + 0x108]
mov rcx, qword [0x1402527f0]
mov rax, qword [rcx]
lea r8, [rbp]
mov rdx, qword [0x140252788]
call qword [rax + 0x190]
mov rax, qword [0x140252710]
mov rax, qword [rax + 0x4a38]
mov rcx, qword [rax]
add rcx, 0xa8
mov rax, rdi
cmp byte [rcx], dil
cmovne rax, rcx
mov rcx, rax
call fcn.140039270
mov rcx, qword [0x1402527d8]
mov rax, qword [rcx]
xor r8d, r8d
xor edx, edx
call qword [rax + 0x40]
nop
cmp byte [reloc.WS2_32.dll_accept], 0
jne 0x140062ad0
call fcn.140059a60
mov rcx, qword [0x140252758]
test rcx, rcx
je 0x140061fd8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140252758], rdi
jmp 0x140061fd8
mov dword [rbp + 0x1d8], edi
mov ecx, 6
call fcn.140134278
int3
call fcn.140147670
int3
call fcn.140147670
int3
mov ecx, 1
call fcn.140134278
int3
mov dword [rbp + 0x1d8], edi
mov ecx, 6
call fcn.140134278
int3
mov ecx, 1
call fcn.140134278
int3
mov dword [rbp + 0x1d8], edi
mov ecx, 6
call fcn.140134278
int3
mov ecx, 1
call fcn.140134278
int3
mov dword [rbp + 0x1d8], edi
mov ecx, 6
call fcn.140134278
int3
mov ecx, 1
call fcn.140134278
int3