Function at 0x140004d00
Capabilities:
Create process on windows
Execute command
Get token membership
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
sub rsp, 0x5c0
lea rbp, [rsp + 0x80]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x14008d080]
xor rax, rsp
mov qword [rbp + 0x530], rax
xor ebx, ebx
mov dword [rbp], ebx
mov dword [rbp + 0xc0], ebx
mov qword [rbp + 0x80], rbx
mov dword [rbp + 0x90], ebx
mov word [rbp + 0x94], 0x500
lea rax, [rbp + 0x80]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
mov r9d, 0x220
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov dl, 2
lea rcx, [rbp + 0x90]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x140004dc4
lea r8, [rbp + 0xc0]
mov rdx, qword [rbp + 0x80]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov rcx, qword [rbp + 0x80]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
xor ecx, ecx
cmp dword [rbp + 0xc0], 1
je 0x140004e78
mov r9d, Ordinal_50
lea r8, str.Administrator_Required
lea rdx, str.This_application_needs_administrative_privileges_to_run._It_will_now_restart_with_elevated_permissions.
call qword [sym.imp.USER32.dll_MessageBoxA]
mov r8d, 0x104
lea rdx, [rbp + 0x420]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x140004e92
mov dword [rbp + 0x10], reloc.WS2_32.dll_WSASetLastError
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x14], xmm0
movups xmmword [rbp + 0x24], xmm0
movups xmmword [rbp + 0x34], xmm0
movups xmmword [rbp + 0x44], xmm0
movups xmmword [rbp + 0x54], xmm0
movups xmmword [rbp + 0x64], xmm0
mov qword [rbp + 0x74], rax
mov dword [rbp + 0x7c], eax
lea rax, str.runas
mov qword [rbp + 0x20], rax
lea rax, [rbp + 0x420]
mov qword [rbp + 0x28], rax
mov dword [rbp + 0x40], 1
lea rcx, [rbp + 0x10]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x140004e92
mov r9d, reloc.WS2_32.dll_recv
lea r8, str.Error
lea rdx, str.Failed_to_restart_application_with_administrative_privileges.
xor ecx, ecx
jmp 0x140004e8c
mov r9d, 0x40
lea r8, str.Info
lea rdx, str.Running_with_administrative_privileges_
call qword [sym.imp.USER32.dll_MessageBoxA]
call fcn.14000afd0
lea rcx, [0x14008e0a0]
call fcn.140018df0
movabs r14, 0xae173187945787bd
movabs rsi, 0x10f69d6a3630cf86
cmp byte [0x14008e2b8], bl
jmp 0x140004f78
movabs rax, 0xef5279c4b90fc8fb
mov qword [rbp + 0x80], rax
mov rax, qword [rbp + 0x80]
mov qword [rbp + 0xa0], rax
movabs rax, 0x51a3da247766e2d2
mov qword [rbp + 0x80], rax
mov rax, qword [rbp + 0x80]
mov qword [rbp + 0xa8], rax
movabs rax, 0xe0e1043412db93bd
mov qword [rbp + 0x80], rax
mov rax, qword [rbp + 0x80]
mov qword [rbp + 0xb0], rax
movabs rax, 0x728d333844a690da
mov qword [rbp + 0x80], rax
mov rax, qword [rbp + 0x80]
mov qword [rbp + 0xb8], rax
mov qword [rbp + 0x80], r14
mov rax, qword [rbp + 0x80]
mov qword [rbp + 0x340], rax
mov qword [rbp + 0x80], rsi
mov rax, qword [rbp + 0x80]
mov qword [rbp + 0x348], rax
movabs r15, 0xa5ad487d59f6d7ef
mov qword [rbp + 0x80], r15
mov rax, qword [rbp + 0x80]
mov qword [rbp + 0x350], rax
movabs rdi, 0x728d333844a69088
mov qword [rbp + 0x80], rdi
mov rax, qword [rbp + 0x80]
mov qword [rbp + 0x358], rax
vmovdqu ymm0, ymmword [rbp + 0xa0]
vpxor ymm1, ymm0, ymmword [rbp + 0x340]
vmovdqa ymmword [rbp + 0xa0], ymm1
lea rcx, [rbp + 0xa0]
vzeroupper
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movabs rax, 0xa61f398f9c5f8fb5
mov qword [rbp + 0x80], rax
mov rax, qword [rbp + 0x80]
mov qword [rbp + 0xa0], rax
movabs rax, 0x7e9ff90b597cc78e
mov qword [rbp + 0x80], rax
mov rax, qword [rbp + 0x80]
mov qword [rbp + 0xa8], rax
movabs rax, 0xa5ad487d79d6f788
mov qword [rbp + 0x80], rax
mov rax, qword [rbp + 0x80]
mov qword [rbp + 0xb0], rax
mov qword [rbp + 0x80], rdi
mov rax, qword [rbp + 0x80]
mov qword [rbp + 0xb8], rax
mov qword [rbp + 0x80], r14
mov rax, qword [rbp + 0x80]
mov qword [rbp + 0x340], rax
mov qword [rbp + 0x80], rsi
mov rax, qword [rbp + 0x80]
mov qword [rbp + 0x348], rax
mov qword [rbp + 0x80], r15
mov rax, qword [rbp + 0x80]
mov qword [rbp + 0x350], rax
mov qword [rbp + 0x80], rdi
mov rax, qword [rbp + 0x80]
mov qword [rbp + 0x358], rax
vmovdqu ymm0, ymmword [rbp + 0xa0]
vpxor ymm1, ymm0, ymmword [rbp + 0x340]
vmovdqa ymmword [rbp + 0xa0], ymm1
lea rdx, [rbp + 0xa0]
vzeroupper
call fcn.140007ea0
lea rdx, [0x140008470]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
movabs rax, 0x822704a7f133e8d0
mov qword [rbp + 0x80], rax
mov rax, qword [rbp + 0x80]
mov qword [rbp + 0x90], rax
movabs rax, 0x10f69d6a3630fab7
mov qword [rbp + 0x80], rax
mov rax, qword [rbp + 0x80]
mov qword [rbp + 0x98], rax
mov qword [rbp + 0x80], r14
mov rax, qword [rbp + 0x80]
mov qword [rbp + 0x360], rax
mov qword [rbp + 0x80], rsi
mov rax, qword [rbp + 0x80]
mov qword [rbp + 0x368], rax
movdqa xmm0, xmmword [rbp + 0x90]
xorps xmm0, xmmword [rbp + 0x360]
movdqa xmmword [rbp + 0x90], xmm0
lea rcx, [rbp + 0x90]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movabs rax, 0xae1731879424ebde
mov qword [rbp + 0x80], rax
mov rax, qword [rbp + 0x80]
mov qword [rbp + 0x90], rax
mov qword [rbp + 0x80], rsi
mov rax, qword [rbp + 0x80]
mov qword [rbp + 0x98], rax
mov qword [rbp + 0x80], r14
mov rax, qword [rbp + 0x80]
mov qword [rbp + 0x360], rax
mov qword [rbp + 0x80], rsi
mov rax, qword [rbp + 0x80]
mov qword [rbp + 0x368], rax
movdqa xmm0, xmmword [rbp + 0x90]
xorps xmm0, xmmword [rbp + 0x360]
movdqa xmmword [rbp + 0x90], xmm0
lea rcx, [rbp + 0x90]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Color_0B
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rbp + 0xc8], xmm0
mov qword [rbp + 0xd8], 0xa
mov qword [rbp + 0xe0], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [str.C:Key.ini]
movsd qword [rbp + 0xc8], xmm0
movzx eax, word [0x140081680]
mov word [rbp + 0xd0], ax
mov byte [rbp + 0xd2], bl
lea rcx, [0x14008e0a0]
call fcn.140018df0
movabs r15, 0xdd6245e6e004a7b7
movabs r12, 0x10f69d6a3630efbc
xorps xmm0, xmm0
movups xmmword [rbp + 0xe8], xmm0
mov qword [rbp + 0xf8], rbx
mov qword [rbp + 0x100], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xe8], 0
lea rcx, [rbp + 0xc8]
cmp qword [rbp + 0xe0], 0xf
cmova rcx, qword [rbp + 0xc8]
lea rdx, [0x140081684]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rdi, rax
test rax, rax
je 0x14000581d
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp + 0x230]
call sub.VCRUNTIME140.dll_memset
lea rbx, [rbp + 0xc8]
cmp qword [rbp + 0xe0], 0xf
cmova rbx, qword [rbp + 0xc8]
lea rax, [0x140000000]
lea rax, [rax + 0x8195c]
mov qword [rbp + 0x230], rax
lea rcx, [rbp + 0x2e0]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
or dword [rbp], 2
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x240]
lea rcx, [rbp + 0x230]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rbp + 0x230]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x230], rax
mov rax, qword [rbp + 0x230]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x22c], edx
lea rcx, [rbp + 0x240]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rbp + 0x240], rax
mov byte [rbp + 0x2bc], 0
mov byte [rbp + 0x2b1], 0
lea rcx, [rbp + 0x240]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
xor ecx, ecx
mov qword [rbp + 0x2c0], rcx
mov rax, qword [0x14008e030]
mov qword [rbp + 0x2b4], rax
mov qword [rbp + 0x2a8], rcx
mov r8d, 1
mov rdx, rbx
lea rcx, [rbp + 0x240]
call fcn.140007a10
test rax, rax
jne 0x140005496
mov rax, qword [rbp + 0x230]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x230]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
xor ebx, ebx
mov qword [rbp + 0xb0], rbx
mov qword [rbp + 0xb8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xa0], bl
mov rax, qword [rbp + 0x230]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x230]
add rcx, rax
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
movzx r8d, al
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x230]
call fcn.140008fd0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movabs rax, 0xd87e45e4d5778db7
mov qword [rbp + 0x80], rax
mov rax, qword [rbp + 0x80]
mov qword [rbp + 0x3a0], rax
movabs rax, 0x7f8fbd0d5859bbe7
mov qword [rbp + 0x80], rax
mov rax, qword [rbp + 0x80]
mov qword [rbp + 0x3a8], rax
movabs rax, 0xc98d2c1136d6a59a
mov qword [rbp + 0x80], rax
mov rax, qword [rbp + 0x80]
mov qword [rbp + 0x3b0], rax
movabs rax, 0x19ad564b2ac3f3e1
mov qword [rbp + 0x80], rax
mov rax, qword [rbp + 0x80]
mov qword [rbp + 0x3b8], rax
movabs rax, 0xbe284433ac761844
mov qword [rbp + 0x80], rax
mov rax, qword [rbp + 0x80]
mov qword [rbp + 0x3c0], rax
movabs rdx, 0x6a158ea606b9978a
mov qword [rbp + 0x80], rdx
mov rax, qword [rbp + 0x80]
mov qword [rbp + 0x3c8], rax
mov qword [rbp + 0x80], r14
mov rax, qword [rbp + 0x80]
mov qword [rbp + 0x3e0], rax
mov qword [rbp + 0x80], rsi
mov rax, qword [rbp + 0x80]
mov qword [rbp + 0x3e8], rax
movabs rax, 0xa5ad487d59f6d7ef
mov qword [rbp + 0x80], rax
mov rax, qword [rbp + 0x80]
mov qword [rbp + 0x3f0], rax
movabs rax, 0x728d333844a69088
mov qword [rbp + 0x80], rax
mov rax, qword [rbp + 0x80]
mov qword [rbp + 0x3f8], rax
movabs rax, 0xbe2844338c4c6121
mov qword [rbp + 0x80], rax
mov rax, qword [rbp + 0x80]
mov qword [rbp + 0x400], rax
mov qword [rbp + 0x80], rdx
mov rax, qword [rbp + 0x80]
mov qword [rbp + 0x408], rax
vmovdqu ymm0, ymmword [rbp + 0x3a0]
vpxor ymm1, ymm0, ymmword [rbp + 0x3e0]
vmovdqa ymmword [rbp + 0x3a0], ymm1
vmovdqa xmm0, xmmword [rbp + 0x3c0]
vxorps xmm0, xmm0, xmmword [rbp + 0x400]
vmovdqa xmmword [rbp + 0x3c0], xmm0
lea rdx, [rbp + 0x3a0]
vzeroupper
call fcn.140007ea0
lea rcx, [rbp + 0x240]
call fcn.140007950
test rax, rax
jne 0x1400056be
mov rax, qword [rbp + 0x230]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x230]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea rdx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 0xf
cmova rdx, qword [rbp + 0xa0]
mov r8, qword [rbp + 0xb0]
lea rcx, [rbp + 0xe8]
call fcn.140007b50
lea rcx, [0x14008e0a0]
call fcn.140014c20
nop
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0xf
jbe 0x14000573f
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000573a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005d21
call fcn.14006e9cc
mov qword [rbp + 0xb0], rbx
mov qword [rbp + 0xb8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xa0], 0
mov rax, qword [rbp + 0x230]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x230], rax
mov rax, qword [rbp + 0x230]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x22c], edx
lea rdi, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rbp + 0x240], rdi
cmp qword [rbp + 0x2c0], 0
je 0x1400057db
lea rcx, [rbp + 0x2b0]
mov rax, qword [rbp + 0x258]
cmp qword [rax], rcx
jne 0x1400057db
mov rdx, qword [rbp + 0x2d0]
mov rcx, qword [rbp + 0x2c8]
mov qword [rax], rcx
mov rax, qword [rbp + 0x278]
mov qword [rax], rcx
sub edx, ecx
mov rax, qword [rbp + 0x290]
mov dword [rax], edx
cmp byte [rbp + 0x2bc], 0
je 0x1400057f0
lea rcx, [rbp + 0x240]
call fcn.140007950
lea rcx, [rbp + 0x240]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x248]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x2e0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
jmp 0x140005996
lea rcx, reloc.WLDAP32.dll_Ordinal_32
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
lea rcx, [0x1400812fc]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [0x140081564]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140007ea0
mov rcx, rax
lea rdx, str._n__________n
call fcn.140007ea0
mov rcx, rax
call fcn.140008080
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movabs rax, 0xc07252eef8778db7
mov qword [rbp + 0x80], rax
mov rax, qword [rbp + 0x80]
mov qword [rbp + 0xa0], rax
movabs rax, 0x30cce40f5d10aaf5
mov qword [rbp + 0x80], rax
mov rax, qword [rbp + 0x80]
mov qword [rbp + 0xa8], rax
movabs r8, 0xa5ad487d59f6d7ef
mov qword [rbp + 0x80], r8
mov rax, qword [rbp + 0x80]
mov qword [rbp + 0xb0], rax
movabs rdx, 0x728d333844a69088
mov qword [rbp + 0x80], rdx
mov rax, qword [rbp + 0x80]
mov qword [rbp + 0xb8], rax
mov qword [rbp + 0x80], r14
mov rax, qword [rbp + 0x80]
mov qword [rbp + 0x3a0], rax
mov qword [rbp + 0x80], rsi
mov rax, qword [rbp + 0x80]
mov qword [rbp + 0x3a8], rax
mov qword [rbp + 0x80], r8
mov rax, qword [rbp + 0x80]
mov qword [rbp + 0x3b0], rax
mov qword [rbp + 0x80], rdx
mov rax, qword [rbp + 0x80]
mov qword [rbp + 0x3b8], rax
vmovdqu ymm0, ymmword [rbp + 0xa0]
vpxor ymm1, ymm0, ymmword [rbp + 0x3a0]
vmovdqa ymmword [rbp + 0xa0], ymm1
lea rdx, [rbp + 0xa0]
vzeroupper
call fcn.140007ea0
lea rcx, [0x14008e0a0]
call fcn.140014c20
lea rdx, [rbp + 0xe8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.1400084f0
lea rcx, [0x14008e0a0]
call fcn.140014c20
call fcn.14000afd0
lea rdi, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x120]
call sub.VCRUNTIME140.dll_memset
lea rax, [0x140000000]
lea rax, [rax + 0x81930]
mov qword [rbp + 0x120], rax
lea rcx, [rbp + 0x1c8]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
or dword [rbp], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x128]
lea rcx, [rbp + 0x120]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rbp + 0x120]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x120], rax
mov rax, qword [rbp + 0x120]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x11c], edx
lea rcx, [rbp + 0x128]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
mov qword [rbp + 0x128], rdi
mov byte [rbp + 0x1a4], 0
mov byte [rbp + 0x199], 0
lea rcx, [rbp + 0x128]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov qword [rbp + 0x1a8], rbx
mov rax, qword [0x14008e030]
mov qword [rbp + 0x19c], rax
mov qword [rbp + 0x190], rbx
lea rdx, [rbp + 0xc8]
cmp qword [rbp + 0xe0], 0xf
cmova rdx, qword [rbp + 0xc8]
mov r8d, 2
lea rcx, [rbp + 0x128]
call fcn.140007a10
xor r8d, r8d
test rax, rax
mov rax, qword [rbp + 0x120]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x120]
je 0x140005ab9
add rcx, rax
xor edx, edx
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::clear_int__bool____ptr64]
jmp 0x140005ac7
add rcx, rax
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
lea rdx, [rbp + 0xe8]
cmp qword [rbp + 0x100], 0xf
cmova rdx, qword [rbp + 0xe8]
mov r8, qword [rbp + 0xf8]
lea rcx, [rbp + 0x120]
call fcn.140008e10
lea rcx, [rbp + 0x128]
call fcn.140007950
test rax, rax
jne 0x140005b25
mov rax, qword [rbp + 0x120]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x120]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
lea rdx, [rbp + 0xe8]
lea rcx, [rbp + 0x3a0]
call fcn.1400075f0
mov rdx, rax
lea rcx, [0x14008e0a0]
call fcn.14001a3e0
cmp byte [0x14008e2b8], 0
jmp 0x140005d2f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rcx, [0x14008e0a0]
call fcn.140014c20
call fcn.14000afd0
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140081564]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140007ea0
mov rcx, rax
lea rdx, str._n_________n
call fcn.140007ea0
mov rcx, rax
call fcn.140008080
lea rdx, [0x14008e298]
lea rcx, [rbp + 0x3a0]
call fcn.1400075f0
mov rbx, rax
mov rcx, rax
cmp qword [rax + 0x18], 0xf
jbe 0x140005d98
mov rcx, qword [rax]
xor edx, edx
mov r8d, 0xa
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtol]
movsxd rdi, eax
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x140005de3
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140005dde
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000604d
mov rcx, r8
call fcn.14006e9cc
xor esi, esi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
mov qword [rbp + 0x80], rdi
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x3e0]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64_s]
movups xmm0, xmmword [rbp + 0x3e0]
movaps xmmword [rbp + 0x360], xmm0
movups xmm1, xmmword [rbp + 0x3f0]
movaps xmmword [rbp + 0x370], xmm1
mov eax, dword [rbp + 0x400]
mov dword [rbp + 0x380], eax
lea r9, [rbp + 0x360]
lea r8, str.__m__d__y
mov edx, 0x50
lea rcx, [rbp + 0x10]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_strftime]
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xb0], xmm1
lea rax, [rbp + 0x10]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], sil
jne 0x140005e74
movabs r14, 0x7fffffffffffffff
cmp rbx, r14
ja 0x1400064e1
cmp rbx, 0xf
ja 0x140005ec8
mov qword [rbp + 0xb0], rbx
mov qword [rbp + 0xb8], reloc.WS2_32.dll_ntohs
mov r8, rbx
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0xa0]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rbx + 0xa0], sil
jmp 0x140005f66
mov rdi, rbx
or rdi, 0xf
cmp rdi, r14
jbe 0x140005f00
mov rdi, r14
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14006e750
test rax, rax
je 0x140005f2d
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140005f3c
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmp rdi, rax
cmovb rdi, rax
lea rcx, [rdi + 1]
test rcx, rcx
je 0x140005f3c
cmp rcx, 0x1000
jb 0x140005f34
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400064db
jmp 0x140005ee5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006e750
mov rsi, rax
mov qword [rbp + 0xa0], rsi
mov qword [rbp + 0xb0], rbx
mov qword [rbp + 0xb8], rdi
mov r8, rbx
lea rdx, [rbp + 0x10]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rbx], 0
xor esi, esi
movsd xmm0, qword [str._pngqk]
movsd qword [rbp + 0x90], xmm0
movzx ecx, word [0x140081838]
mov word [rbp + 0x98], cx
movzx eax, byte [0x14008183a]
mov byte [rbp + 0x90], 0xa
xor byte [rbp + 0x91], 0x35
xor byte [rbp + 0x92], 0x36
xor byte [rbp + 0x93], 0x37
xor byte [rbp + 0x94], 0x38
xor byte [rbp + 0x95], 0x39
xor byte [rbp + 0x96], 0x3a
xor byte [rbp + 0x97], 0x3b
xor cl, 0x3c
mov byte [rbp + 0x98], cl
xor byte [rbp + 0x99], 0x3d
xor al, 0x3e
mov byte [rbp + 0x9a], al
lea rdx, [rbp + 0x90]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140007ea0
lea rdx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 0xf
cmova rdx, qword [rbp + 0xa0]
mov r8, qword [rbp + 0xb0]
mov rcx, rax
call fcn.140008e10
nop
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0xf
jbe 0x140006059
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006054
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006054
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006e9cc
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x340], xmm0
mov qword [rbp + 0x350], rax
mov eax, dword [0x140081854]
mov dword [rbp + 0x90], eax
movzx ecx, word [0x140081858]
mov word [rbp + 0x94], cx
movzx eax, byte [0x14008185a]
mov byte [rbp + 0x90], Ordinal_50
xor byte [rbp + 0x91], 0x35
xor byte [rbp + 0x92], 0x36
xor byte [rbp + 0x93], 0x37
xor cl, 0x38
mov byte [rbp + 0x94], cl
xor byte [rbp + 0x95], 0x39
xor al, 0x3a
mov byte [rbp + 0x96], al
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x3a0]
call fcn.1400074d0
mov r8, rax
lea rdx, [rbp + 0x340]
lea rcx, [0x14008e0a0]
call fcn.140016860
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x108], xmm0
mov qword [rbp + 0x118], rax
mov eax, dword [0x1400819b4]
mov dword [rbp + 0x90], eax
movzx ecx, word [0x1400819b8]
mov word [rbp + 0x94], cx
movzx eax, byte [0x1400819ba]
mov byte [rbp + 0x90], gethostname
xor byte [rbp + 0x91], 0x35
xor byte [rbp + 0x92], 0x36
xor byte [rbp + 0x93], 0x37
xor cl, 0x38
mov byte [rbp + 0x94], cl
xor byte [rbp + 0x95], 0x39
xor al, 0x3a
mov byte [rbp + 0x96], al
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x3e0]
call fcn.1400074d0
mov r8, rax
lea rdx, [rbp + 0x108]
lea rcx, [0x14008e0a0]
call fcn.140016860
nop
lea rax, [rbp + 0x360]
mov qword [rbp + 0x80], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x360], xmm0
mov qword [rbp + 0x370], rsi
mov rdx, qword [rbp + 0x110]
sub rdx, qword [rbp + 0x108]
je 0x1400061fb
cmp rdx, r14
ja 0x1400064e7
lea rcx, [rbp + 0x360]
call fcn.140008cf0
mov rdi, qword [rbp + 0x360]
mov rbx, qword [rbp + 0x110]
mov rdx, qword [rbp + 0x108]
sub rbx, rdx
mov r8, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
lea rax, [rdi + rbx]
mov qword [rbp + 0x368], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0xb0], rsi
mov rdx, qword [rbp + 0x348]
sub rdx, qword [rbp + 0x340]
je 0x140006260
cmp rdx, r14
ja 0x1400064d5
lea rcx, [rbp + 0xa0]
call fcn.140008cf0
mov rdi, qword [rbp + 0xa0]
mov rbx, qword [rbp + 0x348]
mov rdx, qword [rbp + 0x340]
sub rbx, rdx
mov r8, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
lea rax, [rdi + rbx]
mov qword [rbp + 0xa8], rax
lea rdx, [rbp + 0x360]
lea rcx, [rbp + 0xa0]
call fcn.140002580
lea rcx, [0x14008e0a0]
call fcn.140014c20
call fcn.14000afd0
call fcn.140002fd0
lea rcx, [0x1400817f0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov rcx, qword [rbp + 0x108]
test rcx, rcx
je 0x1400062ec
mov rdx, qword [rbp + 0x118]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400062d5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400062d5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006e9cc
mov qword [rbp + 0x108], rsi
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x110], xmm0
mov rcx, qword [rbp + 0x340]
test rcx, rcx
je 0x140006341
mov rdx, qword [rbp + 0x350]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000632a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000632a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006e9cc
mov qword [rbp + 0x340], rsi
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x348], xmm0
mov rax, qword [rbp + 0x120]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x120], rax
mov rax, qword [rbp + 0x120]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x11c], edx
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rbp + 0x128], rax
cmp qword [rbp + 0x1a8], 0
je 0x1400063c4
lea rcx, [rbp + 0x198]
mov rax, qword [rbp + 0x140]
cmp qword [rax], rcx
jne 0x1400063c4
mov rdx, qword [rbp + 0x1b8]
mov rcx, qword [rbp + 0x1b0]
mov qword [rax], rcx
mov rax, qword [rbp + 0x160]
mov qword [rax], rcx
sub edx, ecx
mov rax, qword [rbp + 0x178]
mov dword [rax], edx
cmp byte [rbp + 0x1a4], 0
je 0x1400063d9
lea rcx, [rbp + 0x128]
call fcn.140007950
lea rcx, [rbp + 0x128]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x130]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x1c8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rdx, qword [rbp + 0x100]
cmp rdx, 0xf
jbe 0x140006446
inc rdx
mov rcx, qword [rbp + 0xe8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006441
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006441
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006e9cc
mov qword [rbp + 0xf8], rsi
mov qword [rbp + 0x100], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xe8], 0
mov rdx, qword [rbp + 0xe0]
cmp rdx, 0xf
jbe 0x1400064a3
inc rdx
mov rcx, qword [rbp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000649e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000649e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006e9cc
xor eax, eax
mov rcx, qword [rbp + 0x530]
xor rcx, rsp
call fcn.14006e730
lea r11, [rsp + 0x5c0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.140008cd0
nop
call fcn.140001890
int3
call fcn.140001930
nop
call fcn.140008cd0
int3