Function at 0x140002ce0
Capabilities:
Check for debugger via api
Check for time delay via gettickcount
Check for time delay via queryperformancecounter
Check mutex and terminate process on windows
Check mutex on windows
Create process on windows
Enumerate processes
Hide thread from debugger
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xae0
mov rax, qword [0x140080178]
xor rax, rsp
mov qword [rsp + 0xad8], rax
mov rsi, rdx
xor r15d, r15d
call fcn.140001880
cmp al, 1
je 0x140004d16
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140002d41
lea rdx, str.debug_by_IsDebuggerPresent_
call fcn.1400013f0
mov ecx, 0x1002
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.14000f3f0
test eax, eax
je 0x140002d62
lea rdx, str.debug_by_BeingDebugged_PEB_check_
call fcn.1400013f0
mov ecx, 0x1000
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.14000f407
test eax, eax
je 0x140002d83
lea rdx, str.debug_by_NtGlobalFlag_PEB_check_
call fcn.1400013f0
mov ecx, 0x1003
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov dword [rsp + 0x118], r15d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x118]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [rsp + 0x118], r15d
je 0x140002dc4
lea rdx, str.debug_by_CheckRemoteDebuggerPresent_
call fcn.1400013f0
mov ecx, 0x1001
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xorps xmm0, xmm0
movups xmmword [rsp + 0x150], xmm0
movups xmmword [rsp + 0x160], xmm0
movups xmmword [rsp + 0x170], xmm0
mov dword [rsp + 0x118], r15d
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140002e6d
lea rdx, str.NtQueryInformationProcess
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140002e6d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rcx, [rsp + 0x118]
mov qword [rsp + 0x20], rcx
mov r9d, 0x30
lea r8, [rsp + 0x150]
xor edx, edx
mov rcx, rax
call rbx
test eax, eax
js 0x140002e6d
mov rax, qword [rsp + 0x158]
test rax, rax
je 0x140002e6d
cmp byte [rax + 2], r15b
je 0x140002e6d
lea rdx, str.debug_by_NtQueryInformationProcess__ProcessDebugPort__
call fcn.1400013f0
mov ecx, 0x1004
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor edx, edx
lea rcx, str.OLLYDBG
call qword [sym.imp.USER32.dll_FindWindowW]
mov rbx, rax
xor edx, edx
lea rcx, [0x14006c458]
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x140004cfe
test rbx, rbx
jne 0x140004cfe
lea rdx, str.OllyDbg____CPU_
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
mov rbx, rax
lea rdx, str.Immunity_Debugger____CPU_
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x140004ce6
test rbx, rbx
jne 0x140004ce6
lea rax, str.cheatengine_x86_64.exe
mov qword [rsp + 0x760], rax
lea rax, str.ollydbg.exe
mov qword [rsp + 0x768], rax
lea rax, str.ida.exe
mov qword [rsp + 0x770], rax
lea rax, str.ida64.exe
mov qword [rsp + 0x778], rax
lea rax, str.radare2.exe
mov qword [rsp + 0x780], rax
lea rax, str.x64dbg.exe
mov qword [rsp + 0x788], rax
xor edx, edx
mov r8d, 0x234
lea rcx, [rsp + 0x294]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea ecx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
mov dword [rsp + 0x790], 0x238
xor edx, edx
mov r8d, 0x234
lea rcx, [rsp + 0x794]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x290]
lea rax, [rsp + 0x790]
lea edx, [rbx + 4]
nop dword [rax]
nop word [rax + rax]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x140002f90
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
mov rax, qword [rax + 0x30]
mov qword [rcx + 0x30], rax
lea rdx, [rsp + 0x290]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x140003030
lea rcx, str._Warning__It_is_impossible_to_check_process_list.
call fcn.140001330
jmp 0x14000307f
lea rbx, [rsp + 0x760]
nop dword [rax + rax]
lea rdx, [rsp + 0x2bc]
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140004cce
add rbx, 8
lea rax, [rsp + 0x790]
cmp rbx, rax
jne 0x140003040
lea rdx, [rsp + 0x290]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140003030
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x1400030cc
lea rdx, str.NtSetInformationThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x1400030cc
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x11]
call rbx
mov rbx, qword [rsi + 8]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x154], xmm0
movups xmmword [rsp + 0x164], xmm0
movups xmmword [rsp + 0x174], xmm0
movups xmmword [rsp + 0x184], xmm0
movups xmmword [rsp + 0x194], xmm0
movups xmmword [rsp + 0x1a4], xmm0
mov dword [rsp + 0x1b4], eax
movups xmmword [rsp + 0xf8], xmm0
mov qword [rsp + 0x108], rax
mov dword [rsp + 0x150], WSAGetLastError
mov dword [rsp + 0x118], r15d
lea r8, str.antidbg
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14000316f
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_DebugActiveProcess]
test eax, eax
jne 0x140003274
mov ecx, 0x22b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
mov r8d, 0x104
lea rdx, [rsp + 0x290]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [rsp + 0x20], ebx
lea r9, [rsp + 0x290]
lea r8, str._ws__d
mov edx, 0x109
lea rcx, [rsp + 0x790]
call fcn.140001390
lea rax, [rsp + 0xf8]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x150]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x790]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edx, 0xffffffff
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0x118]
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0xf8]
cmp dword [rsp + 0x118], 0x22b
jne 0x140003260
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.debug_by_DebugActiveProcess_
call fcn.1400013f0
mov ecx, 0x1008
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov r8d, 0x4d0
lea rcx, [rsp + 0x290]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov dword [rsp + 0x2c0], 0x100010
lea rdx, [rsp + 0x290]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x140003303
cmp qword [rsp + 0x2d8], r15
jne 0x1400032eb
cmp qword [rsp + 0x2e0], r15
jne 0x1400032eb
cmp qword [rsp + 0x2e8], r15
jne 0x1400032eb
cmp qword [rsp + 0x2f0], r15
jne 0x1400032eb
cmp qword [rsp + 0x2f8], r15
jne 0x1400032eb
cmp qword [rsp + 0x300], r15
je 0x140003303
lea rdx, str.debug_by_a_Hardware_Debug_Register_Check_
call fcn.1400013f0
mov ecx, 0x2000
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xorps xmm0, xmm0
movups xmmword [rsp + 0x120], xmm0
movups xmmword [rsp + 0x130], xmm0
lea rcx, [rsp + 0x120]
call fcn.14000f43d
mov rcx, qword [rsp + 0x120]
shl rcx, 0x20
or rcx, qword [rsp + 0x128]
mov rax, qword [rsp + 0x130]
shl rax, 0x20
or rax, qword [rsp + 0x138]
sub rax, rcx
cmp rax, 0x100000
jbe 0x14000336e
lea rdx, str.debug_by_RDTSC_
call fcn.1400013f0
mov ecx, 0x3000
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, [rsp + 0x200]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call fcn.14000f41f
lea rcx, [rsp + 0x208]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x208]
sub rax, qword [rsp + 0x200]
cmp rax, 0x1e
jle 0x1400033bd
lea rdx, str.debug_by_QueryPerformanceCounter_
call fcn.1400013f0
mov ecx, 0x3001
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
call fcn.14000f42e
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, 0x1e
jbe 0x1400033ef
lea rdx, str.debug_by_GetTickCount_
call fcn.1400013f0
mov ecx, 0x3002
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.140001410
call fcn.140001450
call fcn.140001490
call fcn.1400014f0
call fcn.1400014d0
call fcn.140001530
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
mov ecx, 0x2c0
mov eax, dword [rcx + rdi]
mov ebx, 0x330
add rbx, rdi
test al, 1
jne 0x140003454
or eax, 1
mov dword [rcx + rdi], eax
mov dword [rbx + 8], 0x1efa5d1
mov dword [rbx], 0x9f8eeabd
mov dword [rbx + 4], 0xe7836b0c
lea rcx, [0x140061ca0]
call fcn.14005e050
nop
cmp byte [rbx + 0xb], 0
je 0x140003489
xor byte [rbx], 0xf1
xor byte [rbx + 1], 0x85
xor byte [rbx + 2], 0xef
xor byte [rbx + 3], 0xfb
xor byte [rbx + 4], 0x69
xor byte [rbx + 5], 0x19
xor byte [rbx + 6], 0xa3
xor byte [rbx + 7], 0xdd
xor byte [rbx + 8], 0xf1
xor byte [rbx + 9], 0x85
xor byte [rbx + 0xa], 0xef
mov byte [rbx + 0xb], 0
mov rdx, rbx
lea rcx, [rsp + 0x150]
call fcn.14000db40
mov rsi, rax
lea r9, [0x1400801b8]
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae r9, qword [0x1400801b8]
mov r14, qword [0x1400801c8]
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rax, rdx
sub rax, rcx
cmp r14, rax
ja 0x1400034fa
lea rax, [rcx + r14]
mov qword [rsi + 0x10], rax
mov rax, rsi
cmp rdx, 0x10
jb 0x1400034e1
mov rax, qword [rsi]
lea rbx, [rax + rcx]
mov r8, r14
mov rdx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [r14 + rbx], 0
jmp 0x140003510
mov qword [rsp + 0x20], r14
xor r8d, r8d
mov rdx, r14
mov rcx, rsi
call fcn.14000eb70
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x88], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x98], xmm1
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x88], xmm0
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [rsp + 0x98], xmm1
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], 0
mov rcx, qword [rsp + 0x98]
mov rdx, qword [rsp + 0xa0]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x14000359a
lea rax, [rcx + 1]
mov qword [rsp + 0x98], rax
lea rax, [rsp + 0x88]
cmp rdx, 0x10
cmovae rax, qword [rsp + 0x88]
mov word [rax + rcx], 0x20
lea rax, [rsp + 0x88]
jmp 0x1400035be
mov qword [rsp + 0x20], 1
lea r9, [0x14006c900]
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rsp + 0x88]
call fcn.14000eb70
xorps xmm0, xmm0
movups xmmword [rsp + 0xf8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x108], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0xf8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x108], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r12, str.01:44:29
mov r9, r12
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae r9, qword [str.01:44:29]
mov rsi, qword [0x1400801e8]
mov rcx, qword [rsp + 0x108]
mov rdx, qword [rsp + 0x110]
mov rax, rdx
sub rax, rcx
cmp rsi, rax
ja 0x140003677
lea rax, [rsi + rcx]
mov qword [rsp + 0x108], rax
lea rbx, [rsp + 0xf8]
cmp rdx, 0x10
cmovae rbx, qword [rsp + 0xf8]
add rbx, rcx
mov r8, rsi
mov rdx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rsi + rbx], 0
lea rax, [rsp + 0xf8]
jmp 0x14000368f
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov rdx, rsi
lea rcx, [rsp + 0xf8]
call fcn.14000eb70
xorps xmm0, xmm0
movups xmmword [rsp + 0x248], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x258], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x248], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x258], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x110]
cmp rdx, 0x10
jb 0x140003712
inc rdx
mov rcx, qword [rsp + 0xf8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000370d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000370d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005df74
movdqa xmm0, xmmword [0x14006ccc0]
movdqu xmmword [rsp + 0x108], xmm0
mov byte [rsp + 0xf8], 0
mov rdx, qword [rsp + 0xa0]
cmp rdx, 0x10
jb 0x140003771
inc rdx
mov rcx, qword [rsp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000376c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000376c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005df74
movdqa xmm0, xmmword [0x14006ccc0]
movdqu xmmword [rsp + 0x98], xmm0
mov byte [rsp + 0x88], 0
mov rdx, qword [rsp + 0x168]
cmp rdx, 0x10
jb 0x1400037d0
inc rdx
mov rcx, qword [rsp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400037cb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400037cb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005df74
movdqa xmm0, xmmword [0x14006ccc0]
movdqu xmmword [rsp + 0x160], xmm0
mov byte [rsp + 0x150], 0
lea rcx, [rsp + 0x248]
cmp qword [rsp + 0x260], 0x10
cmovae rcx, qword [rsp + 0x248]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
movdqa xmm0, xmmword [0x14006cda0]
mov dword [rsp + 0x1f0], 0x3c7bc96d
mov dword [rsp + 0x1f4], 0x2090c603
mov word [rsp + 0x1f8], 0xde6f
mov ecx, 0x2dc
mov eax, dword [rcx + rdi]
mov edx, 0x140
test al, 1
jne 0x1400038c1
or eax, 1
mov dword [rcx + rdi], eax
lea rbx, [rdx + rdi]
mov byte [rbx + 0x1b], 1
lea rax, [rbx + 0x1a]
lea rcx, [rsp + 0x1fa]
cmp rbx, rcx
ja 0x140003891
lea rcx, [rsp + 0x1e0]
cmp rax, rcx
jb 0x140003891
movups xmmword [rbx], xmm0
movsd xmm0, qword [rsp + 0x1f0]
movsd qword [rbx + 0x10], xmm0
movzx eax, word [rsp + 0x1f8]
mov word [rbx + 0x18], ax
mov byte [rbx + 0x1a], 0x37
jmp 0x1400038b2
movups xmmword [rbx], xmm0
movsd xmm0, qword [rsp + 0x1f0]
movsd qword [rbx + 0x10], xmm0
movzx eax, word [rsp + 0x1f8]
mov word [rbx + 0x18], ax
mov byte [rbx + 0x1a], 0x37
lea rcx, [0x140061c70]
call fcn.14005e050
nop
jmp 0x1400038c5
lea rbx, [rdi + rdx]
cmp byte [rbx + 0x1b], 0
je 0x14000393a
xor byte [rbx], 0x5d
xor byte [rbx + 1], 0xe9
xor byte [rbx + 2], 0x37
xor byte [rbx + 3], 0x75
xor byte [rbx + 4], 0x4d
xor byte [rbx + 5], 0x83
xor byte [rbx + 6], 0xc3
xor byte [rbx + 7], 0x1d
xor byte [rbx + 8], 0x5d
xor byte [rbx + 9], 0xe9
xor byte [rbx + 0xa], 0x37
xor byte [rbx + 0xb], 0x75
xor byte [rbx + 0xc], 0x4d
xor byte [rbx + 0xd], 0x83
xor byte [rbx + 0xe], 0xc3
xor byte [rbx + 0xf], 0x1d
xor byte [rbx + 0x10], 0x5d
xor byte [rbx + 0x11], 0xe9
xor byte [rbx + 0x12], 0x37
xor byte [rbx + 0x13], 0x75
xor byte [rbx + 0x14], 0x4d
xor byte [rbx + 0x15], 0x83
xor byte [rbx + 0x16], 0xc3
xor byte [rbx + 0x17], 0x1d
xor byte [rbx + 0x18], 0x5d
xor byte [rbx + 0x19], 0xe9
xor byte [rbx + 0x1a], 0x37
mov byte [rbx + 0x1b], 0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov ecx, 0x1e0
mov eax, dword [rcx + rdi]
mov edx, 0x33c
test al, 1
jne 0x14000398d
or eax, 1
mov dword [rcx + rdi], eax
lea rbx, [rdx + rdi]
mov word [rbx + 3], 0x14d
mov word [rbx], 0xbbb8
mov byte [rbx + 2], reloc.WS2_32.dll_select
lea rcx, [0x140061c50]
call fcn.14005e050
nop
jmp 0x140003991
lea rbx, [rdi + rdx]
cmp byte [rbx + 4], 0
je 0x1400039aa
xor byte [rbx], 0xdb
xor byte [rbx + 1], 0xd7
xor byte [rbx + 2], 0x61
xor byte [rbx + 3], 0x4d
mov byte [rbx + 4], 0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.140004d40
mov rbx, rax
mov rcx, rax
call fcn.14000dcc0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x134
mov eax, dword [rcx + rdi]
mov edx, 0x274
test al, 1
jne 0x140003a05
or eax, 1
mov dword [rcx + rdi], eax
lea rbx, [rdx + rdi]
mov word [rbx + 3], 0x1f5
mov word [rbx], 0x85e6
mov byte [rbx + 2], 0x86
lea rcx, [0x140061bf0]
call fcn.14005e050
nop
jmp 0x140003a09
lea rbx, [rdx + rdi]
cmp byte [rbx + 4], 0
je 0x140003a22
xor byte [rbx], 0x85
xor byte [rbx + 1], 0xe9
xor byte [rbx + 2], 0xf5
xor byte [rbx + 3], 0xf5
mov byte [rbx + 4], 0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x14006cdb0]
mov dword [rsp + 0x220], 0xad864cd9
mov dword [rsp + 0x224], 0x3d5cb572
mov ecx, 0x27c
mov eax, dword [rcx + rdi]
mov edx, 0x298
test al, 1
jne 0x140003ab9
or eax, 1
mov dword [rcx + rdi], eax
lea rbx, [rdx + rdi]
mov byte [rbx + 0x18], 1
lea rax, [rbx + 0x17]
lea rcx, [rsp + 0x227]
cmp rbx, rcx
ja 0x140003a99
lea rcx, [rsp + 0x210]
cmp rax, rcx
jb 0x140003a99
movups xmmword [rbx], xmm0
movsd xmm0, qword [rsp + 0x220]
movsd qword [rbx + 0x10], xmm0
jmp 0x140003aaa
movups xmmword [rbx], xmm0
movsd xmm0, qword [rsp + 0x220]
movsd qword [rbx + 0x10], xmm0
lea rcx, [0x140061bd0]
call fcn.14005e050
nop
jmp 0x140003abd
lea rbx, [rdx + rdi]
cmp byte [rbx + 0x18], 0
je 0x140003b26
xor byte [rbx], 0x85
xor byte [rbx + 1], 0x7d
xor byte [rbx + 2], 0xf5
xor byte [rbx + 3], 0x83
xor byte [rbx + 4], 0x17
xor byte [rbx + 5], 0xcd
xor byte [rbx + 6], 0x39
xor byte [rbx + 7], 0x3d
xor byte [rbx + 8], 0x85
xor byte [rbx + 9], 0x7d
xor byte [rbx + 0xa], 0xf5
xor byte [rbx + 0xb], 0x83
xor byte [rbx + 0xc], 0x17
xor byte [rbx + 0xd], 0xcd
xor byte [rbx + 0xe], 0x39
xor byte [rbx + 0xf], 0x3d
xor byte [rbx + 0x10], 0x85
xor byte [rbx + 0x11], 0x7d
xor byte [rbx + 0x12], 0xf5
xor byte [rbx + 0x13], 0x83
xor byte [rbx + 0x14], 0x17
xor byte [rbx + 0x15], 0xcd
xor byte [rbx + 0x16], 0x39
xor byte [rbx + 0x17], 0x3d
mov byte [rbx + 0x18], 0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x138
mov eax, dword [rcx + rdi]
mov edx, 0x280
test al, 1
jne 0x140003b68
or eax, 1
mov dword [rcx + rdi], eax
lea rbx, [rdx + rdi]
mov word [rbx + 3], 0x16f
mov word [rbx], 0x31b2
mov byte [rbx + 2], 6
lea rcx, [0x140061bb0]
call fcn.14005e050
nop
jmp 0x140003b6c
lea rbx, [rdi + rdx]
cmp byte [rbx + 4], 0
je 0x140003b85
xor byte [rbx], 0xd1
xor byte [rbx + 1], 0x5d
xor byte [rbx + 2], 0x75
xor byte [rbx + 3], 0x6f
mov byte [rbx + 4], 0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
xorps xmm0, xmm0
movups xmmword [rsp + 0x120], xmm0
mov qword [rsp + 0x130], r15
mov qword [rsp + 0x138], reloc.WS2_32.dll_ntohs
mov ecx, 0x20
call fcn.14005dce8
mov qword [rsp + 0x120], rax
mov qword [rsp + 0x130], 0x19
mov qword [rsp + 0x138], 0x1f
movups xmm0, xmmword [str.cln8tn073001znx01aolqb5ob]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x14006c918]
movsd qword [rax + 0x10], xmm0
movzx ecx, byte [0x14006c920]
mov byte [rax + 0x18], cl
mov byte [rax + 0x19], 0
lea rcx, [rsp + 0x120]
call fcn.140039b8c
nop
mov rdx, qword [rsp + 0x138]
cmp rdx, 0x10
jb 0x140003c6f
inc rdx
mov rcx, qword [rsp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003c6a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003c6a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005df74
lea rcx, [rsp + 0x268]
call fcn.1400020c0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x228], xmm0
mov qword [rsp + 0x238], r15
mov qword [rsp + 0x240], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x228], 0
mov dword [rsp + 0x140], 0x100
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x9d0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea rax, [rsp + 0x9d0]
mov rsi, 0xffffffffffffffff
inc rsi
cmp byte [rax + rsi], 0
jne 0x140003cd4
mov rax, qword [rsp + 0x240]
cmp rsi, rax
ja 0x140003d20
lea rbx, [rsp + 0x228]
cmp rax, 0x10
cmovae rbx, qword [rsp + 0x228]
mov qword [rsp + 0x238], rsi
mov r8, rsi
lea rdx, [rsp + 0x9d0]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rsi], 0
jmp 0x140003d3b
lea r9, [rsp + 0x9d0]
xor r8d, r8d
mov rdx, rsi
lea rcx, [rsp + 0x228]
call fcn.14000ef60
call qword [sym.imp.libcurl.dll_curl_easy_init]
mov rsi, rax
test rax, rax
je 0x140004343
xorps xmm0, xmm0
movups xmmword [rsp + 0x120], xmm0
movdqa xmm1, xmmword [0x14006ccc0]
movdqu xmmword [rsp + 0x130], xmm1
mov byte [rsp + 0x120], 0
xor eax, eax
movups xmmword [rsp + 0x150], xmm0
mov dword [rsp + 0x160], eax
mov word [rsp + 0x164], ax
mov byte [rsp + 0x166], al
mov dword [rsp + 0x168], reloc.WS2_32.dll_setsockopt
mov dword [rsp + 0x16c], 0x49
movdqa xmm0, xmmword [0x14006cd20]
movdqa xmmword [rsp + 0x170], xmm0
movdqa xmm1, xmmword [0x14006cd30]
movdqa xmmword [rsp + 0x180], xmm1
movdqa xmm0, xmmword [0x14006cd10]
movdqa xmmword [rsp + 0x190], xmm0
movdqa xmm1, xmmword [0x14006ccf0]
movdqa xmmword [rsp + 0x1a0], xmm1
movdqa xmm0, xmmword [0x14006cd50]
movdqa xmmword [rsp + 0x1b0], xmm0
lea rcx, [rsp + 0x150]
call fcn.14000d430
mov r8, rax
mov edx, 0x2712
mov rcx, rsi
call qword [sym.imp.libcurl.dll_curl_easy_setopt]
lea r8, [0x140001fa0]
mov edx, 0x4e2b
mov rcx, rsi
call qword [sym.imp.libcurl.dll_curl_easy_setopt]
lea r8, [rsp + 0x120]
mov edx, 0x2711
mov rcx, rsi
call qword [sym.imp.libcurl.dll_curl_easy_setopt]
mov rcx, rsi
call qword [sym.imp.libcurl.dll_curl_easy_perform]
test eax, eax
jne 0x14000455e
mov dword [rsp + 0x118], r15d
lea r8, [rsp + 0x118]
mov edx, 0x200002
mov rcx, rsi
call qword [sym.imp.libcurl.dll_curl_easy_getinfo]
mov edx, 0x1f4
lea ecx, [rdx + 0x17]
cmp dword [rsp + 0x118], 0xc8
jne 0x1400043c2
call qword [sym.imp.KERNEL32.dll_Beep]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x150], xmm0
mov qword [rsp + 0x160], rax
mov dword [rsp + 0x168], eax
mov byte [rsp + 0x16c], al
movdqa xmm0, xmmword [0x14006cd70]
movdqa xmmword [rsp + 0x170], xmm0
movdqa xmm1, xmmword [0x14006cd60]
movdqa xmmword [rsp + 0x180], xmm1
movdqa xmm0, xmmword [0x14006cce0]
movdqa xmmword [rsp + 0x190], xmm0
movdqa xmm1, xmmword [0x14006ccd0]
movdqa xmmword [rsp + 0x1a0], xmm1
movdqa xmm0, xmmword [0x14006cd90]
movdqa xmmword [rsp + 0x1b0], xmm0
movdqa xmm1, xmmword [0x14006cd40]
movdqa xmmword [rsp + 0x1c0], xmm1
movdqa xmm0, xmmword [0x14006cd80]
movdqa xmmword [rsp + 0x1d0], xmm0
lea rcx, [rsp + 0x150]
call fcn.14000cce0
mov rdx, rax
lea rcx, [rsp + 0xa8]
call fcn.14000db40
nop
lea rbx, [rsp + 0xa8]
mov r14, qword [rsp + 0xa8]
mov r13, qword [rsp + 0xc0]
cmp r13, 0x10
cmovae rbx, r14
lea r15, [rsp + 0xa8]
cmovae r15, r14
add r15, qword [rsp + 0xb8]
cmp rbx, r15
je 0x140003fbf
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [rbx]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000e2f0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::flush_void____ptr64]
mov ecx, 0x1e
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
cmp rbx, r15
jne 0x140003f90
cmp r13, 0x10
jb 0x140003ff9
lea rdx, [r13 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x140003ff1
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003ff1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.14005df74
movdqa xmm0, xmmword [0x14006cd00]
movdqu xmmword [rsp + 0x100], xmm0
mov dword [rsp + 0xf8], 0x6d305b1b
mov byte [rsp + 0xfc], 0
lea rdx, [rsp + 0xf8]
lea rcx, [rsp + 0xc8]
call fcn.14000db40
nop
lea rbx, [rsp + 0xc8]
mov r14, qword [rsp + 0xc8]
mov r13, qword [rsp + 0xe0]
cmp r13, 0x10
cmovae rbx, r14
lea r15, [rsp + 0xc8]
cmovae r15, r14
add r15, qword [rsp + 0xd8]
cmp rbx, r15
je 0x14000409f
nop dword [rax]
movzx edx, byte [rbx]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000e2f0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::flush_void____ptr64]
mov ecx, 0x1e
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
cmp rbx, r15
jne 0x140004070
cmp r13, 0x10
jb 0x1400040d9
lea rdx, [r13 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x1400040d1
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400040d1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.14005df74
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0x51], 0x3000323
mov dl, 3
mov byte [rsp + 0x50], 0x58
mov dword [rsp + 0x80], 0x12001257
mov cl, reloc.WS2_32.dll_select
mov dword [rsp + 0x7c], 0x5c5b5e5c
mov dword [rsp + 0x78], 0x5d32415b
mov dword [rsp + 0x74], 0x325f5340
mov dword [rsp + 0x70], 0x555d4042
lea rax, [rsp + 0x70]
nop word [rax + rax]
xor byte [rax], cl
inc rax
lea rcx, [rsp + 0x82]
cmp rax, rcx
je 0x14000414c
movzx ecx, byte [rsp + 0x83]
jmp 0x140004130
mov byte [rsp + 0x82], 1
mov dword [rsp + 0x5a], 0x4000424
mov cl, 4
mov word [rsp + 0x58], 0x5924
lea rax, [rsp + 0x58]
nop word [rax + rax]
xor byte [rax], cl
inc rax
lea rcx, [rsp + 0x5c]
cmp rax, rcx
je 0x140004186
movzx ecx, byte [rsp + 0x5d]
jmp 0x140004170
mov byte [rsp + 0x5c], 1
mov dword [rsp + 0x6a], 0xc000c2c
mov cl, 0xc
mov dword [rsp + 0x66], 0x362c4941
mov dword [rsp + 0x62], 0x4558404d
mov word [rsp + 0x60], 0x495e
lea rax, [rsp + 0x60]
xor byte [rax], cl
inc rax
lea rcx, [rsp + 0x6c]
cmp rax, rcx
je 0x1400041c7
movzx ecx, byte [rsp + 0x6d]
jmp 0x1400041b1
mov byte [rsp + 0x6c], 1
lea rax, [rsp + 0x50]
xor byte [rax], dl
inc rax
lea rcx, [rsp + 0x53]
cmp rax, rcx
je 0x1400041e7
movzx edx, byte [rsp + 0x54]
jmp 0x1400041d1
mov byte [rsp + 0x53], 1
lea rdx, [rsp + 0x50]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000e680
mov rcx, rax
lea rdx, [0x140001e50]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [rsp + 0x70]
call fcn.14000e680
mov rcx, rax
lea rdx, [0x140001ec0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [rsp + 0x58]
call fcn.14000e680
mov rcx, rax
lea rdx, [rsp + 0x60]
call fcn.14000e680
mov rcx, rax
lea rdx, [0x140001f30]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae r12, qword [str.01:44:29]
mov r8, qword [0x1400801e8]
mov rdx, r12
mov rcx, rax
call fcn.14000f0f0
mov rcx, rax
lea rdx, [0x14000e870]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x290
mov eax, dword [rcx + rdi]
mov edx, 0x2b4
test al, 1
jne 0x1400042ca
or eax, 1
mov dword [rcx + rdi], eax
lea rbx, [rdx + rdi]
mov word [rbx + 3], 0x159
mov word [rbx], 0xfd5c
mov byte [rbx + 2], 0x90
lea rcx, [0x140061b90]
call fcn.14005e050
nop
jmp 0x1400042ce
lea rbx, [rdi + rdx]
cmp byte [rbx + 4], 0
je 0x1400042e7
xor byte [rbx], 0x3f
xor byte [rbx + 1], 0x91
xor byte [rbx + 2], 0xe3
xor byte [rbx + 3], 0x59
mov byte [rbx + 4], 0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, rsi
call qword [sym.imp.libcurl.dll_curl_easy_cleanup]
nop
mov rdx, qword [rsp + 0x138]
cmp rdx, 0x10
jb 0x140004340
inc rdx
mov rcx, qword [rsp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000433b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000433b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005df74
xor r15d, r15d
cmp qword [rsp + 0x278], 0
je 0x1400047fa
lea rcx, [rsp + 0x268]
call fcn.140002520
test al, al
je 0x1400047fa
lea rcx, [0x14006c934]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov rdx, qword [rsp + 0x240]
cmp rdx, 0x10
jb 0x140004707
inc rdx
mov rcx, qword [rsp + 0x228]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004702
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004702
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, [rsp + 0x790]
call fcn.14000cb70
mov rcx, rax
call fcn.14000c420
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.14000db40
nop
lea rcx, [rsp + 0x150]
call fcn.1400027f0
nop
lea rcx, [rsp + 0x150]
call fcn.14000dae0
lea rcx, [rsp + 0xf8]
call fcn.14000c3f0
mov rcx, rax
call fcn.14000c2d0
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.14000db40
nop
lea rcx, [rsp + 0x150]
call fcn.1400027f0
nop
lea rcx, [rsp + 0x150]
call fcn.14000dae0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.REALTIME_:
lea rcx, [rsp + 0xe8]
call fcn.1400024a0
mov rcx, rax
call fcn.14000da10
mov rsi, rax
lea rcx, [rsp + 0x208]
call fcn.140004ea0
mov rcx, rax
call fcn.14000cc60
mov rdi, rax
lea rcx, [rsp + 0xf8]
call fcn.140004eb0
mov rcx, rax
call fcn.14000c290
mov rbx, rax
lea rcx, [rsp + 0x200]
call fcn.140004e90
mov rcx, rax
call fcn.14000cca0
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000e680
mov rcx, rax
lea rdx, [0x140001de0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
mov rdx, rbx
call fcn.14000e680
mov rcx, rax
lea rdx, [0x140001ec0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
mov rdx, rdi
call fcn.14000e680
mov rcx, rax
mov rdx, rsi
call fcn.14000e680
mov rcx, rax
lea rdx, [0x140001f30]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
mov rdx, r12
call fcn.14000e850
mov rcx, rax
lea rdx, [0x14000e870]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140004ee0
mov rcx, rax
call fcn.14000c270
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov edx, 0x1f4
lea ecx, [rdx + 0x17]
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, [rsp + 0x790]
call fcn.14000c180
mov rcx, rax
call fcn.14000b9e0
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.14000db40
nop
lea rcx, [rsp + 0x150]
call fcn.1400027f0
nop
lea rcx, [rsp + 0x150]
call fcn.14000dae0
lea rcx, [rsp + 0xf8]
call fcn.14000b9b0
mov rcx, rax
call fcn.14000b880
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.14000db40
nop
lea rcx, [rsp + 0x150]
call fcn.1400027f0
nop
lea rcx, [rsp + 0x150]
call fcn.14000dae0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.REALTIME_:
lea rcx, [rsp + 0xe8]
call fcn.1400024a0
mov rcx, rax
call fcn.14000da10
mov rsi, rax
lea rcx, [rsp + 0x208]
call fcn.140004ea0
mov rcx, rax
call fcn.14000cc60
mov rdi, rax
lea rcx, [rsp + 0xf8]
call fcn.140004eb0
mov rcx, rax
call fcn.14000c290
mov rbx, rax
lea rcx, [rsp + 0x200]
call fcn.140004e90
mov rcx, rax
call fcn.14000cca0
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000e680
mov rcx, rax
lea rdx, [0x140001de0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
mov rdx, rbx
call fcn.14000e680
mov rcx, rax
lea rdx, [0x140001ec0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
mov rdx, rdi
call fcn.14000e680
mov rcx, rax
mov rdx, rsi
call fcn.14000e680
mov rcx, rax
lea rdx, [0x140001f30]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
mov rdx, r12
call fcn.14000e850
mov rcx, rax
lea rdx, [0x14000e870]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140004f40
mov rcx, rax
call fcn.14000b860
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
call fcn.14005df74
mov qword [rsp + 0x238], r15
mov qword [rsp + 0x240], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x228], 0
mov rdx, qword [rsp + 0x280]
cmp rdx, 0x10
jb 0x140004769
inc rdx
mov rcx, qword [rsp + 0x268]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004764
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004764
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005df74
mov qword [rsp + 0x278], r15
mov qword [rsp + 0x280], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x268], 0
mov rdx, qword [rsp + 0x260]
cmp rdx, 0x10
jb 0x1400047cb
inc rdx
mov rcx, qword [rsp + 0x248]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400047c6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400047c6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005df74
xor eax, eax
mov rcx, qword [rsp + 0xad8]
xor rcx, rsp
call fcn.14005dc60
lea r11, [rsp + 0xae0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rcx, [rsp + 0xf8]
call fcn.14000b830
mov rcx, rax
call fcn.14000b6c0
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.14000db40
nop
lea rcx, [rsp + 0x150]
call fcn.1400027f0
nop
lea rcx, [rsp + 0x150]
call fcn.14000dae0
lea rdx, str.e_36m______________________________________________________________________________n
lea rcx, [rsp + 0x150]
call fcn.140004fa0
mov rcx, rax
call fcn.14000b2c0
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000e680
lea rdx, str.e_34mdb_______.d88b.___.o88b._db___dD_______.d8b.__db____db_d888888b_db___db__n
lea rcx, [rsp + 0x150]
call fcn.140004fc0
mov rcx, rax
call fcn.14000aef0
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000e680
lea rdx, str.e_36m88______.8P__Y8._d8P__Y8_88__8P______d8__8b_88____88__88_88___88__n
lea rcx, [rsp + 0x150]
call fcn.140004fc0
mov rcx, rax
call fcn.14000aef0
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000e680
lea rdx, str.e_34m88______88____88_8P______88_8P________88ooo88_88____88____88____88ooo88__n
lea rcx, [rsp + 0x150]
call fcn.140004fc0
mov rcx, rax
call fcn.14000aef0
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000e680
lea rdx, str.e_36m88______88____88_8b______88_8b________8888_88____88____88____8888__n
lea rcx, [rsp + 0x150]
call fcn.140004fc0
mov rcx, rax
call fcn.14000aef0
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000e680
lea rdx, str.e_34m88booo.__8b__d8_Y8b__d8_88__88.______88___88_88b__d88____88____88___88__n
lea rcx, [rsp + 0x150]
call fcn.140004fc0
mov rcx, rax
call fcn.14000aef0
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000e680
lea rdx, str.e_36mY88888P___Y88P____Y88P_YP___YD______YP___YP_Y8888P____YP____YP___YP__n
lea rcx, [rsp + 0x150]
call fcn.140004fc0
mov rcx, rax
call fcn.14000aef0
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000e680
lea rdx, str.e_34m______________________________________________________________________________n
lea rcx, [rsp + 0x150]
call fcn.140004fa0
mov rcx, rax
call fcn.14000b2c0
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000e680
lea rcx, [rsp + 0xf8]
call fcn.14000aec0
mov rcx, rax
call fcn.14000ad60
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.14000db40
nop
lea rcx, [rsp + 0x150]
call fcn.1400027f0
nop
lea rcx, [rsp + 0x150]
call fcn.14000dae0
lea rdx, str.e_0m_e_36m___e_0m__Authentication_By_blue_nocap_e_0m__e_32m_discord.gg_bEyMzxRAx3_e_0m__n
lea rcx, [rsp + 0x790]
call fcn.14000a530
mov rcx, rax
call fcn.140009750
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.14000db40
nop
lea rcx, [rsp + 0x150]
call fcn.1400027f0
nop
lea rcx, [rsp + 0x150]
call fcn.14000dae0
lea rdx, str.e_0m_e_36m___e_0m__Thank_for_buy_If_you_encounter_a_problem_e_0m__e_32mcontact_blue_e_0m___n
lea rcx, [rsp + 0x790]
call fcn.1400094c0
mov rcx, rax
call fcn.1400090b0
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.14000db40
nop
lea rcx, [rsp + 0x150]
call fcn.1400027f0
nop
lea rcx, [rsp + 0x150]
call fcn.14000dae0
lea rcx, [rsp + 0xf8]
call fcn.140009080
mov rcx, rax
call fcn.140008f60
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.14000db40
nop
lea rcx, [rsp + 0x150]
call fcn.1400027f0
nop
lea rcx, [rsp + 0x150]
call fcn.14000dae0
lea rcx, [rsp + 0x790]
call fcn.140008d90
mov rcx, rax
call fcn.1400080a0
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.14000db40
nop
lea rcx, [rsp + 0x150]
call fcn.1400027f0
nop
lea rcx, [rsp + 0x150]
call fcn.14000dae0
lea rcx, [rsp + 0x790]
call fcn.140007fa0
mov rcx, rax
call fcn.1400077d0
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.14000db40
nop
lea rcx, [rsp + 0x150]
call fcn.1400027f0
nop
lea rcx, [rsp + 0x150]
call fcn.14000dae0
call fcn.140004fe0
mov rcx, rax
call fcn.1400077b0
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000e680
mov rcx, rax
lea rdx, [rsp + 0x228]
call fcn.14000e850
mov rcx, rax
lea rdx, [rsp + 0x268]
call fcn.14000e850
mov rcx, rax
lea rdx, [0x14006cc9c]
call fcn.14000e680
lea rcx, [rsp + 0x120]
call fcn.14000dc60
nop
lea rcx, [rsp + 0x790]
call fcn.140007650
mov rcx, rax
call fcn.140006ba0
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.14000db40
nop
lea rcx, [rsp + 0x150]
call fcn.1400027f0
nop
lea rcx, [rsp + 0x150]
call fcn.14000dae0
lea rdx, [rsp + 0x120]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.14000e8b0
nop
lea rcx, [rsp + 0x150]
call fcn.140002020
nop
mov rdx, rax
lea rcx, [rsp + 0x120]
call fcn.14002e8d4
nop
lea rcx, [rsp + 0x150]
call fcn.14000dae0
lea rcx, [rsp + 0x790]
call fcn.1400069f0
mov rcx, rax
call fcn.140005dd0
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.14000db40
nop
lea rcx, [rsp + 0x150]
call fcn.1400027f0
nop
lea rcx, [rsp + 0x150]
call fcn.14000dae0
call fcn.140002860
call fcn.140005040
mov rcx, rax
call fcn.140005db0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
lea rdx, str.secret
lea rcx, [rsp + 0x150]
call fcn.14000db40
nop
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x88]
call fcn.140017e68
nop
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000e850
mov rcx, rax
lea rdx, [0x14000e870]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rcx, [rsp + 0x88]
call fcn.14000dae0
nop
lea rcx, [rsp + 0x150]
call fcn.14000dae0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
lea rdx, str.debug_by_ProcessFileName_
call fcn.1400013f0
mov ecx, 0x1009
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, str.debug_by_FindWindow__WindowName__
call fcn.1400013f0
mov ecx, 0x1005
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, str.debug_by_FindWindow__ClassName__
call fcn.1400013f0
mov ecx, 0x1005
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor r9d, r9d
lea r8, [0x14006c8e4]
lea rdx, [0x14006c8f0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3