Function at 0x1400505a0
Capabilities:
Access peb ldr_data
Check if file exists
Create thread
Encode data using xor
Hash data using fnv
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x298]
sub rsp, 0x370
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
movaps xmmword [rax - 0x78], xmm10
movaps xmmword [rax - 0x88], xmm11
movaps xmmword [rax - 0x98], xmm12
mov rax, qword [0x140187080]
xor rax, rsp
mov qword [rbp + 0x1f8], rax
xor r15d, r15d
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8, [0x14004fa30]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8, [0x14004f560]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
movups xmm0, xmmword [str.X_n_t]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [0x14016baf0]
movups xmmword [rbp - 0x70], xmm1
movups xmm0, xmmword [0x14016bb00]
movups xmmword [rbp - 0x60], xmm0
movups xmm1, xmmword [0x14016bb10]
movups xmmword [rbp - 0x50], xmm1
movzx eax, byte [0x14016bb20]
mov byte [rbp - 0x40], al
mov r8d, r15d
movdqa xmm9, xmmword [0x14016c7e0]
movdqa xmm11, xmmword [str.8888888888888888]
movdqa xmm10, xmmword [0x14016c780]
movdqa xmm7, xmmword [0x14016cac0]
movdqa xmm8, xmmword [0x14016c750]
mov r14d, dword [reloc.WS2_32.dll_accept]
cmp r14d, 2
jl 0x1400507bd
movdqa xmmword [rsp + 0x60], xmm11
lea rcx, [rbp - 0x7c]
mov edx, dword [rsp + 0x60]
nop dword [rax]
nop word [rax + rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm8
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm7
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm10
psubd xmm2, xmm0
andps xmm2, xmm9
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm8
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm7
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm10
psubd xmm2, xmm0
andps xmm2, xmm9
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x40
jl 0x1400506d0
cmp r8d, 0x41
jge 0x140050800
movsxd rax, r8d
lea r9, [rbp - 0x80]
add r9, rax
nop word [rax + rax]
mov eax, 0x4d4873ed
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x35
movzx eax, r8b
sub al, cl
add al, 0x38
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x41
jl 0x1400507d0
xorps xmm0, xmm0
movups xmmword [rbp + 0x48], xmm0
mov qword [rbp + 0x58], r15
mov qword [rbp + 0x60], r15
lea rax, [rbp - 0x80]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], r15b
jne 0x140050820
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x48]
call fcn.140056d10
nop
movsd xmm0, qword [0x14016b200]
movsd qword [rsp + 0x60], xmm0
mov eax, dword [str.__.ChVVROU_]
mov dword [rsp + 0x68], eax
cmp byte [0x14016b20b], 0
je 0x140050980
mov r8d, r15d
cmp r14d, 2
jl 0x140050941
movdqa xmm1, xmm8
punpckldq xmm1, xmm8
pmuldq xmm1, xmm7
movdqa xmm0, xmm8
punpckhdq xmm0, xmm8
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm10
movdqa xmm1, xmm8
psubd xmm1, xmm0
andps xmm1, xmm9
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd eax, xmm11
movd xmm0, eax
paddb xmm1, xmm0
movd xmm0, dword [0x14016b200]
xorps xmm1, xmm0
movd dword [rsp + 0x60], xmm1
movdqa xmm2, xmmword [0x14016c770]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm7
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm10
psubd xmm2, xmm0
andps xmm2, xmm9
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, eax
paddb xmm2, xmm0
movd xmm1, dword [rsp + 0x64]
xorps xmm2, xmm1
movd dword [rsp + 0x64], xmm2
mov r8d, 8
movsxd rax, r8d
lea r9, [rsp + 0x60]
add r9, rax
nop dword [rax]
mov eax, 0x4d4873ed
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x35
movzx eax, r8b
sub al, cl
add al, 0x38
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0xc
jl 0x140050950
xorps xmm0, xmm0
movups xmmword [rbp + 0x68], xmm0
mov qword [rbp + 0x78], r15
mov qword [rbp + 0x80], r15
lea rax, [rsp + 0x60]
mov r8, rbx
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400509a0
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x68]
call fcn.140056d10
nop
mov eax, dword [0x14016bad0]
mov dword [rbp + 0x30], eax
cmp byte [0x14016bad3], 0
je 0x140050a70
cmp r14d, 2
jl 0x140050a37
movdqa xmm1, xmm8
punpckldq xmm1, xmm8
pmuldq xmm1, xmm7
movdqa xmm0, xmm8
punpckhdq xmm0, xmm8
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm10
movdqa xmm1, xmm8
psubd xmm1, xmm0
andps xmm1, xmm9
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm11
movd xmm0, eax
xorps xmm1, xmm0
movd dword [rbp + 0x30], xmm1
jmp 0x140050a70
lea r9, [rbp + 0x30]
mov r8d, r15d
nop
mov eax, 0x4d4873ed
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x35
movzx eax, r8b
sub al, cl
add al, 0x38
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 4
jl 0x140050a40
xorps xmm0, xmm0
movups xmmword [rbp + 0x88], xmm0
mov qword [rbp + 0x98], r15
mov qword [rbp + 0xa0], r15
lea rax, [rbp + 0x30]
mov r8, rbx
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140050a90
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x88]
call fcn.140056d10
nop
movsd xmm0, qword [0x14016be58]
movsd qword [rsp + 0x60], xmm0
movzx ecx, word [0x14016be60]
mov word [rsp + 0x68], cx
movzx eax, byte [0x14016be62]
mov byte [rsp + 0x60], gethostname
xor byte [rsp + 0x61], 0x39
xor byte [rsp + 0x62], 0x3a
xor byte [rsp + 0x63], 0x3b
xor byte [rsp + 0x64], 0x3c
xor byte [rsp + 0x65], 0x3d
xor byte [rsp + 0x66], 0x3e
xor byte [rsp + 0x67], 0x3f
xor cl, 0x40
mov byte [rsp + 0x68], cl
xor byte [rsp + 0x69], 0x41
xor al, 0x42
mov byte [rsp + 0x6a], al
xorps xmm0, xmm0
movups xmmword [rbp + 0xa8], xmm0
mov qword [rbp + 0xb8], r15
mov qword [rbp + 0xc0], r15
lea rax, [rsp + 0x60]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140050b23
mov r8, rbx
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0xa8]
call fcn.140056d10
nop
lea rdx, [rbp + 0x48]
cmp qword [rbp + 0x60], 0xf
cmova rdx, qword [rbp + 0x48]
lea rcx, [0x1405c9e48]
cmp qword [0x1405c9e60], 0xf
cmova rcx, qword [0x1405c9e48]
mov r8, qword [0x1405c9e58]
cmp r8, qword [rbp + 0x58]
jne 0x140050c5c
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140050c5c
lea rdx, [rbp + 0x68]
cmp qword [rbp + 0x80], 0xf
cmova rdx, qword [rbp + 0x68]
lea rcx, [0x1405c9e28]
cmp qword [0x1405c9e40], 0xf
cmova rcx, qword [0x1405c9e28]
mov r8, qword [0x1405c9e38]
cmp r8, qword [rbp + 0x78]
jne 0x140050c5c
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140050c5c
lea rdx, [rbp + 0x88]
cmp qword [rbp + 0xa0], 0xf
cmova rdx, qword [rbp + 0x88]
lea rcx, [0x1405c9b30]
cmp qword [0x1405c9b48], 0xf
cmova rcx, qword [0x1405c9b30]
mov r8, qword [0x1405c9b40]
cmp r8, qword [rbp + 0x98]
jne 0x140050c5c
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140050c5c
lea rdx, [rbp + 0xa8]
cmp qword [rbp + 0xc0], 0xf
cmova rdx, qword [rbp + 0xa8]
lea rcx, [0x1405c9de8]
cmp qword [0x1405c9e00], 0xf
cmova rcx, qword [0x1405c9de8]
mov r8, qword [0x1405c9df8]
cmp r8, qword [rbp + 0xb8]
jne 0x140050c5c
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140050d06
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140050ce6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140050ce6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140050ce1
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140050cc0
cmp r8d, 0xe80fd3a
je 0x140050ceb
test r9d, r9d
jne 0x140050ca0
mov rax, qword [rax]
jmp 0x140050c70
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
xor ecx, ecx
call rdx
mov r12d, 1
lea r13, [0x1405c9f18]
movss xmm12, dword [0x14016c5ac]
movss xmm6, dword [0x14016c6e0]
lea rbx, [0x14004f4b0]
nop dword [rax + rax]
lea rcx, [0x1405c9b50]
call fcn.140072430
mov dword [rbp - 0x20], 0x50
mov dword [rbp - 0x1c], 0x40
mov qword [rbp - 0x18], rbx
mov qword [rbp - 0x10], r15
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rbp - 8], rax
xorps xmm0, xmm0
movdqu xmmword [rbp], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x10], xmm1
lea rcx, [rbp + 0x38]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], r15
test rax, rax
jne 0x140050f49
mov eax, dword [str.KHTN]
mov dword [rsp + 0x70], eax
movzx eax, word [0x14016b1e0]
mov word [rsp + 0x74], ax
mov byte [rsp + 0x70], 0x45
xor byte [rsp + 0x71], 0x39
xor byte [rsp + 0x72], 0x3a
xor byte [rsp + 0x73], 0x3b
xor al, 0x3c
mov byte [rsp + 0x74], al
xor byte [rsp + 0x75], 0x3d
movups xmm0, xmmword [0x14016ba20]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [0x14016ba30]
movups xmmword [rbp - 0x70], xmm1
movzx eax, word [0x14016ba40]
mov word [rbp - 0x60], ax
movzx eax, byte [0x14016ba42]
mov byte [rbp - 0x5e], al
mov r8d, r15d
cmp r14d, 2
jl 0x140050eed
movdqa xmmword [rsp + 0x60], xmm11
lea rcx, [rbp - 0x7c]
mov edx, dword [rsp + 0x60]
nop
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm8
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm7
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm10
psubd xmm2, xmm0
andps xmm2, xmm9
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm8
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm7
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm10
psubd xmm2, xmm0
andps xmm2, xmm9
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x20
jl 0x140050e00
cmp r8d, 0x23
jge 0x140050f30
movsxd rax, r8d
lea r9, [rbp - 0x80]
add r9, rax
nop word [rax + rax]
mov eax, 0x4d4873ed
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x35
movzx eax, r8b
sub al, cl
add al, 0x38
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x23
jl 0x140050f00
xor r9d, r9d
lea r8, [rsp + 0x70]
lea rdx, [rbp - 0x80]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x140050d30
lea rcx, [rbp - 0x20]
call qword [sym.imp.USER32.dll_RegisterClassExW]
test ax, ax
jne 0x1400512ab
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r10d, eax
movups xmm0, xmmword [str.XSWYY]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [0x14016bbe0]
movups xmmword [rbp - 0x70], xmm1
movups xmm0, xmmword [0x14016bbf0]
movups xmmword [rbp - 0x60], xmm0
movsd xmm0, qword [0x14016bc00]
movsd qword [rbp - 0x50], xmm0
mov ecx, dword [0x14016bc08]
mov dword [rbp - 0x48], ecx
movzx eax, byte [0x14016bc0c]
mov byte [rbp - 0x44], al
mov r8d, r15d
cmp r14d, 2
jl 0x1400510bd
movdqa xmmword [rsp + 0x60], xmm11
lea rcx, [rbp - 0x7c]
mov edx, dword [rsp + 0x60]
nop dword [rax]
nop word [rax + rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm8
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm7
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm10
psubd xmm2, xmm0
andps xmm2, xmm9
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm8
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm7
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm10
psubd xmm2, xmm0
andps xmm2, xmm9
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x38
jl 0x140050fd0
cmp r8d, 0x3d
jge 0x140051100
movsxd rax, r8d
lea r9, [rbp - 0x80]
add r9, rax
nop word [rax + rax]
mov eax, 0x4d4873ed
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x35
movzx eax, r8b
sub al, cl
add al, 0x38
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x3d
jl 0x1400510d0
mov r9d, r10d
lea r8, [rbp - 0x80]
mov edx, 0x100
lea rcx, [rbp + 0xf0]
call fcn.140034820
movups xmm0, xmmword [0x14016c458]
movups xmmword [rbp - 0x80], xmm0
movzx eax, word [0x14016c468]
mov word [rbp - 0x70], ax
cmp byte [0x14016c469], 0
je 0x140051290
mov r8d, r15d
cmp r14d, 2
jl 0x14005124d
movdqa xmmword [rsp + 0x60], xmm11
lea rcx, [rbp - 0x7c]
mov edx, dword [rsp + 0x60]
nop word [rax + rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm8
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm7
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm10
psubd xmm2, xmm0
andps xmm2, xmm9
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm8
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm7
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm10
psubd xmm2, xmm0
andps xmm2, xmm9
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x10
jl 0x140051160
cmp r8d, 0x12
jge 0x140051290
movsxd rax, r8d
lea r9, [rbp - 0x80]
add r9, rax
nop word [rax + rax]
mov eax, 0x4d4873ed
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x35
movzx eax, r8b
sub al, cl
add al, 0x38
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x12
jl 0x140051260
xor r9d, r9d
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0xf0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x140050d30
cvttss2si ebx, dword [0x14055e62c]
cvttss2si edi, dword [0x14055e628]
mov ecx, r12d
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cdq
sub eax, edx
sar eax, 1
movd xmm1, eax
cvtdq2ps xmm1, xmm1
movss xmm0, dword [0x14055e62c]
mulss xmm0, xmm12
subss xmm1, xmm0
cvttss2si esi, xmm1
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cdq
sub eax, edx
sar eax, 1
movd xmm1, eax
cvtdq2ps xmm1, xmm1
movss xmm0, dword [0x14055e628]
mulss xmm0, xmm12
subss xmm1, xmm0
cvttss2si ecx, xmm1
movups xmm0, xmmword [str.mWZTPZ_A]
movups xmmword [rbp - 0x80], xmm0
mov eax, dword [0x14016b288]
mov dword [rbp - 0x70], eax
cmp word [0x14016b28a], 0
je 0x140051362
mov eax, 0x55
mov word [rbp - 0x80], ax
xor word [rbp - 0x7e], 0x39
xor word [rbp - 0x7c], 0x3a
xor word [rbp - 0x7a], 0x3b
xor word [rbp - 0x78], 0x3c
xor word [rbp - 0x76], 0x3d
xor word [rbp - 0x74], 0x3e
xor word [rbp - 0x72], 0x3f
xor word [rbp - 0x70], 0x40
xor word [rbp - 0x6e], 0x41
mov qword [rsp + 0x58], r15
mov rax, qword [rbp - 8]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], ecx
mov r9d, 0x80000000
lea r8, [rbp - 0x80]
mov rdx, qword [rbp + 0x20]
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov qword [0x1405c9ac0], rax
test rax, rax
jne 0x1400516eb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r10d, eax
movups xmm0, xmmword [0x14016bb80]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [0x14016bb90]
movups xmmword [rbp - 0x70], xmm1
movups xmm0, xmmword [0x14016bba0]
movups xmmword [rbp - 0x60], xmm0
mov ecx, dword [0x14016bbb0]
mov dword [rbp - 0x50], ecx
movzx ecx, byte [0x14016bbb4]
mov byte [rbp - 0x4c], cl
mov r8d, r15d
cmp r14d, 2
jl 0x1400514fd
movdqa xmmword [rsp + 0x60], xmm11
lea rcx, [rbp - 0x7c]
mov edx, dword [rsp + 0x60]
nop dword [rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm8
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm7
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm10
psubd xmm2, xmm0
andps xmm2, xmm9
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm8
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm7
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm10
psubd xmm2, xmm0
andps xmm2, xmm9
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x30
jl 0x140051410
cmp r8d, 0x35
jge 0x140051540
movsxd rax, r8d
lea r9, [rbp - 0x80]
add r9, rax
nop word [rax + rax]
mov eax, 0x4d4873ed
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x35
movzx eax, r8b
sub al, cl
add al, 0x38
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x35
jl 0x140051510
mov r9d, r10d
lea r8, [rbp - 0x80]
mov edx, 0x100
lea rcx, [rbp + 0xf0]
call fcn.140034820
movups xmm0, xmmword [0x14016c458]
movups xmmword [rbp - 0x80], xmm0
movzx eax, word [0x14016c468]
mov word [rbp - 0x70], ax
cmp byte [0x14016c469], 0
je 0x1400516d0
mov r8d, r15d
cmp r14d, 2
jl 0x14005168d
movdqa xmmword [rsp + 0x60], xmm11
lea rcx, [rbp - 0x7c]
mov edx, dword [rsp + 0x60]
nop word [rax + rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm8
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm7
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm10
psubd xmm2, xmm0
andps xmm2, xmm9
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm8
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm7
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm10
psubd xmm2, xmm0
andps xmm2, xmm9
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x10
jl 0x1400515a0
cmp r8d, 0x12
jge 0x1400516d0
movsxd rax, r8d
lea r9, [rbp - 0x80]
add r9, rax
nop word [rax + rax]
mov eax, 0x4d4873ed
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x35
movzx eax, r8b
sub al, cl
add al, 0x38
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x12
jl 0x1400516a0
xor r9d, r9d
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0xf0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x140050d24
mov qword [rbp - 0x6c], r15
mov qword [rbp - 0x58], 2
mov qword [rbp - 0x40], 2
mov qword [rbp - 0x80], r15
mov dword [rbp - 0x70], Ordinal_30
mov dword [rbp - 0x78], reloc.WLDAP32.dll_Ordinal_60
mov dword [rbp - 0x74], r12d
mov dword [rbp - 0x5c], reloc.WLDAP32.dll_Ordinal_32
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x64], 1
mov qword [rbp - 0x48], 1
mov dword [rbp + 0xd8], 0xb000
mov dword [rbp + 0xdc], 0xa000
mov qword [rsp + 0x58], r13
lea rax, [rbp + 0x30]
mov qword [rsp + 0x50], rax
lea rsi, [0x1405c9f10]
mov qword [rsp + 0x48], rsi
lea rbx, [0x1405c9f00]
mov qword [rsp + 0x40], rbx
lea rax, [rbp - 0x80]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], 2
lea rax, [rbp + 0xd8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, r12d
xor ecx, ecx
call qword [sym.imp.d3d11.dll_D3D11CreateDeviceAndSwapChain]
cmp eax, 0x887a0004
jne 0x1400517f7
mov qword [rsp + 0x58], r13
lea rax, [rbp + 0x30]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rbx
lea rax, [rbp - 0x80]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], 2
lea rax, [rbp + 0xd8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 5
xor ecx, ecx
call qword [sym.imp.d3d11.dll_D3D11CreateDeviceAndSwapChain]
test eax, eax
jne 0x140051800
call fcn.14004f440
mov rdi, qword [0x1405c9ac0]
mov rbx, qword [0x1405c99b0]
mov ecx, 0x6190
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r9, rax
mov r8, qword [0x1405c99b0]
test r8, r8
je 0x140051888
mov r10d, dword [r8 + 0x3f70]
movsx rax, word [r8 + 0x6040]
lea rdx, [r8 + 0x6044]
lea rdx, [rdx + rax*8]
cmp dword [rdx], r10d
je 0x14005187d
lea ecx, [rax + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x6040], cx
movsx rax, cx
lea rdx, [r8 + 0x6044]
lea rdx, [rdx + rax*8]
mov dword [rdx], r10d
mov dword [rdx + 4], r15d
inc word [rdx + 4]
inc dword [r8 + 0x6038]
mov qword [rbp - 0x30], r9
lea rax, [rsp + 0x78]
mov qword [rbp + 0x38], rax
mov qword [rsp + 0x60], r9
test r9, r9
je 0x1400518ab
xor edx, edx
mov rcx, r9
call fcn.1400056e0
jmp 0x1400518ae
mov rax, r15
mov qword [0x1405c99b0], rax
call fcn.140009900
test rbx, rbx
je 0x1400518c6
mov qword [0x1405c99b0], rbx
mov rcx, rdi
call fcn.1400032c0
call fcn.1400030f0
nop
mov rax, qword [0x1405c99b0]
cvttss2si ecx, dword [rax + 0x3900]
cvttss2si r9d, dword [0x14055e62c]
cvttss2si r8d, dword [0x14055e628]
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], ecx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRoundRectRgn]
mov r8d, r12d
mov rdx, rax
mov rcx, qword [0x1405c9ac0]
call qword [sym.imp.USER32.dll_SetWindowRgn]
mov rdx, qword [0x1405c99b0]
add rdx, 8
mov qword [rdx + 0x18], r15
call fcn.14004d280
mov edx, 0xa
mov rcx, qword [0x1405c9ac0]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1405c9ac0]
call qword [sym.imp.USER32.dll_UpdateWindow]
xor bl, bl
nop
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x80]
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x1400519b2
nop dword [rax + rax]
lea rcx, [rbp - 0x80]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp - 0x80]
call qword [sym.imp.USER32.dll_DispatchMessageA]
movzx ebx, bl
cmp dword [rbp - 0x78], 0x12
cmove ebx, r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x80]
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x140051970
test bl, bl
jne 0x140051d4c
mov ecx, reloc.WS2_32.dll_WSASetLastError
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400519d3
mov edx, reloc.WS2_32.dll_recvfrom
mov rcx, qword [0x1405c9ac0]
call qword [sym.imp.USER32.dll_SetWindowDisplayAffinity]
mov r8d, dword [0x1405c9ef4]
test r8d, r8d
je 0x140051a3e
mov r9d, dword [0x1405c9f08]
test r9d, r9d
je 0x140051a3e
mov rcx, qword [0x1405c9ef8]
test rcx, rcx
je 0x140051a12
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [0x1405c9ef8], r15
mov r8d, dword [0x1405c9ef4]
mov r9d, dword [0x1405c9f08]
mov rcx, qword [0x1405c9f00]
mov rax, qword [rcx]
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
xor edx, edx
call qword [rax + 0x68]
mov dword [0x1405c9f08], r15d
mov dword [0x1405c9ef4], r15d
call fcn.14004f440
mov rax, qword [0x1405c99b0]
test rax, rax
je 0x140051a53
mov rcx, qword [rax + 0x98]
jmp 0x140051a56
mov rcx, r15
cmp qword [rcx + 0x48], 0
jne 0x140051a62
call fcn.140002bd0
call fcn.140003cd0
call fcn.14000bd20
nop
mov rdx, qword [0x14055e618]
call fcn.140063e70
lea rdx, [rbp + 0xc8]
mov rcx, qword [0x1405c9ac0]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov rax, qword [0x1405c99b0]
cmp qword [rax + 0x4030], 0
je 0x140051c09
cvttss2si r9d, dword [0x14055e62c]
cvttss2si r11d, dword [0x14055e628]
movss xmm1, dword [rax + 0x6c]
movzx r8d, byte [rax + 0xe50]
test r8b, r8b
jne 0x140051acf
cmp byte [rax + 0x3886], r8b
je 0x140051b3e
mulss xmm1, xmm1
movss xmm0, dword [rax + 0x38c0]
comiss xmm0, xmm1
jb 0x140051b3e
lea rcx, [rax + 0xe48]
test rcx, rcx
jne 0x140051af3
lea rcx, [rax + 0xe48]
movss xmm0, dword [rcx]
movss xmm1, dword [rcx + 4]
comiss xmm0, xmm6
jb 0x140051b3e
comiss xmm1, xmm6
jb 0x140051b3e
lea rdx, [rax + 0x3818]
test rdx, rdx
mov rcx, rdx
jne 0x140051b1c
lea rcx, [rax + 0xe48]
movss xmm0, dword [rcx]
movss xmm1, dword [rcx + 4]
comiss xmm0, xmm6
jb 0x140051b3e
comiss xmm1, xmm6
jb 0x140051b3e
movss xmm1, dword [rax + 0xe4c]
subss xmm1, dword [rdx + 4]
jmp 0x140051b41
xorps xmm1, xmm1
movd xmm0, dword [rbp + 0xcc]
cvtdq2ps xmm0, xmm0
addss xmm0, xmm1
cvttss2si r10d, xmm0
movss xmm1, dword [rax + 0x6c]
test r8b, r8b
jne 0x140051b68
cmp byte [rax + 0x3886], r8b
je 0x140051bd6
mulss xmm1, xmm1
movss xmm0, dword [rax + 0x38c0]
comiss xmm0, xmm1
jb 0x140051bd6
lea rcx, [rax + 0xe48]
test rcx, rcx
jne 0x140051b8c
lea rcx, [rax + 0xe48]
movss xmm0, dword [rcx]
movss xmm1, dword [rcx + 4]
comiss xmm0, xmm6
jb 0x140051bd6
comiss xmm1, xmm6
jb 0x140051bd6
lea rdx, [rax + 0x3818]
test rdx, rdx
mov rcx, rdx
jne 0x140051bb5
lea rcx, [rax + 0xe48]
movss xmm0, dword [rcx]
movss xmm1, dword [rcx + 4]
comiss xmm0, xmm6
jb 0x140051bd6
comiss xmm1, xmm6
jb 0x140051bd6
movss xmm1, dword [rax + 0xe48]
subss xmm1, dword [rdx]
jmp 0x140051bd9
xorps xmm1, xmm1
movd xmm0, dword [rbp + 0xc8]
cvtdq2ps xmm0, xmm0
addss xmm0, xmm1
cvttss2si edx, xmm0
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r9d
mov r9d, r11d
mov r8d, r10d
mov rcx, qword [0x1405c9ac0]
call qword [sym.imp.USER32.dll_MoveWindow]
xor dil, dil
mov qword [rbp - 0x30], r15
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp - 0x30]
mov edx, 8
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140051dda
mov dword [rbp + 0x38], 4
lea rax, [rbp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp + 0x40]
mov edx, reloc.WS2_32.dll_sendto
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x140051c65
cmp dword [rbp + 0x40], 0
setne dil
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test dil, dil
je 0x140051dda
lea rcx, [0x1405c99a9]
call fcn.14004d840
nop
call fcn.14000dd20
mov rax, qword [0x1405c99b0]
movss xmm0, dword [rax + 0x3a04]
movss dword [rbp + 0xe0], xmm0
movss xmm1, dword [rax + 0x3a08]
movss dword [rbp + 0xe4], xmm1
movss xmm0, dword [rax + 0x3a0c]
movss dword [rbp + 0xe8], xmm0
movss xmm1, dword [rax + 0x3a10]
movss dword [rbp + 0xec], xmm1
mov rcx, qword [0x1405c9f18]
mov rax, qword [rcx]
xor r9d, r9d
lea r8, [0x1405c9ef8]
mov edx, r12d
call qword [rax + 0x108]
mov rcx, qword [0x1405c9f18]
mov rax, qword [rcx]
lea r8, [rbp + 0xe0]
mov rdx, qword [0x1405c9ef8]
call qword [rax + 0x190]
mov rax, qword [0x1405c99b0]
mov rax, qword [rax + 0x4ae0]
mov rcx, qword [rax]
add rcx, 0x48
mov rax, r15
cmp byte [rcx], r15b
cmovne rax, rcx
mov rcx, rax
call fcn.140001e10
mov rcx, qword [0x1405c9f00]
mov rax, qword [rcx]
xor r8d, r8d
mov edx, r12d
call qword [rax + 0x40]
nop
jmp 0x140051950
lea rcx, [rsp + 0x79]
call fcn.14004f200
mov rcx, qword [0x1405c9ef8]
test rcx, rcx
je 0x140051d6f
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [0x1405c9ef8], r15
mov rcx, qword [0x1405c9f00]
test rcx, rcx
je 0x140051d88
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [0x1405c9f00], r15
mov rcx, qword [0x1405c9f18]
test rcx, rcx
je 0x140051da1
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [0x1405c9f18], r15
mov rcx, qword [0x1405c9f10]
test rcx, rcx
je 0x140051dba
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [0x1405c9f10], r15
mov rcx, qword [0x1405c9ac0]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rdx, qword [rbp - 8]
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.USER32.dll_UnregisterClassW]
jmp 0x140050d24
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3