Function at 0x14006b400
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x60
xor esi, esi
mov rdi, rcx
cmp byte [rcx + 0x17], sil
je 0x1400699d6
mov rdx, qword [0x14054cac8]
lea r9d, [rsi + 1]
mov rcx, qword [0x14054d0d0]
lea r8, [rbp + 0x20]
add rdx, 0x189
mov byte [rbp + 0x20], 1
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp byte [rdi + 1], sil
je 0x140069ab1
call fcn.1400695d0
mov rcx, qword [0x14054d0d0]
lea r8, [rbp - 0x30]
mov r9d, reloc.WS2_32.dll_inet_ntoa
mov qword [rsp + 0x20], rsi
lea rdx, [rax + 0x90]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x14054cbc0]
lea r8, [rbp + 0x20]
add rdx, qword [0x14054cac8]
mov r9d, 8
mov rcx, qword [0x14054d0d0]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x20]
lea r8, [rbp + 0x28]
mov rcx, qword [0x14054d0d0]
add rdx, 0x78
mov r9d, 8
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x14054cad8]
lea r8, [rbp + 0x20]
add rdx, qword [rbp + 0x28]
mov r9d, 8
mov rcx, qword [0x14054d0d0]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x20]
lea r8, [rbp - 0x20]
movsd xmm0, qword [rbp - 0x30]
add rdx, 0x20
mov eax, dword [rbp - 0x28]
mov r9d, reloc.WS2_32.dll_inet_ntoa
mov rcx, qword [0x14054d0d0]
movsd qword [rbp - 0x20], xmm0
mov dword [rbp - 0x18], eax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [0x14054cb70]
lea r8, [rbp + 0x28]
add rdx, qword [0x14054cac8]
mov r9d, 8
mov rcx, qword [0x14054d0d0]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rbx, qword [rbp + 0x28]
cmp byte [rdi + 0x50], sil
jne 0x140069afb
cmp byte [rdi + 0x51], sil
jne 0x140069afb
cmp byte [rdi + 0x52], sil
jne 0x140069afb
cmp byte [rdi + 0x53], sil
je 0x140069b88
mov rdx, qword [0x14054cae8]
lea r8, [rbp + 0x20]
mov rcx, qword [0x14054d0d0]
add rdx, rbx
mov r9d, 4
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movzx eax, byte [rdi + 0x53]
lea r8, [rbp + 0x20]
neg al
mov qword [rsp + 0x20], rsi
movzx eax, byte [rdi + 0x51]
mov r9d, 4
sbb edx, edx
and edx, 0x4000
neg al
movzx eax, byte [rdi + 0x52]
sbb ecx, ecx
and ecx, 0x2000
or edx, ecx
neg al
movzx eax, byte [rdi + 0x50]
sbb ecx, ecx
and ecx, 0x1000
or edx, ecx
neg al
sbb ecx, ecx
and ecx, 0x800
or edx, ecx
mov rcx, qword [0x14054d0d0]
or dword [rbp + 0x20], edx
mov rdx, qword [0x14054cae8]
add rdx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp byte [rdi + 6], sil
je 0x140069c2c
cmp byte [0x14054c490], sil
jne 0x140069c22
mov rdx, qword [0x14054cb28]
lea r8, [rbp + 0x20]
add rdx, qword [0x14054d0e0]
mov r9d, 8
mov rcx, qword [0x14054d0d0]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x20]
lea r8, [rbp + 0x28]
mov rcx, qword [0x14054d0d0]
add rdx, 0x30
mov r9d, 8
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x28]
lea r8, [rbp + 0x20]
mov rcx, qword [0x14054d0d0]
add rdx, 0x364
mov r9d, 4
mov dword [rbp + 0x20], reloc.WS2_32.dll_inet_ntoa
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [0x14054c490], 1
cmp byte [rdi + 6], sil
jne 0x140069ccb
cmp byte [0x14054c4ad], sil
jne 0x140069cbc
mov rdx, qword [0x14054cb28]
lea r8, [rbp + 0x20]
add rdx, qword [0x14054d0e0]
mov r9d, 8
mov rcx, qword [0x14054d0d0]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x20]
lea r8, [rbp + 0x28]
mov rcx, qword [0x14054d0d0]
add rdx, 0x30
mov r9d, 8
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x28]
lea r8, [rbp + 0x20]
mov rcx, qword [0x14054d0d0]
add rdx, 0x364
mov r9d, 4
mov dword [rbp + 0x20], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [0x14054c4ad], 1
cmp byte [rdi + 6], sil
jne 0x140069ccb
mov byte [0x14054c490], sil
jmp 0x140069cd2
mov byte [0x14054c4ad], sil
cmp byte [rdi + 2], sil
je 0x140069d76
cmp byte [0x14054c49f], sil
jne 0x140069d6c
mov rdx, qword [0x14054caf0]
lea r8, [rbp + 0x20]
add rdx, qword [0x14054d0e0]
mov r9d, 8
mov rcx, qword [0x14054d0d0]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x20]
lea r8, [rbp + 0x28]
mov rcx, qword [0x14054d0d0]
add rdx, 0x50
mov r9d, 8
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x28]
lea r8, [rbp + 0x20]
mov rcx, qword [0x14054d0d0]
add rdx, 0xe8
mov r9d, 4
mov dword [rbp + 0x20], 0x10281
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [0x14054c49f], 1
cmp byte [rdi + 2], sil
jne 0x140069e15
cmp byte [0x14054c4a9], sil
jne 0x140069e06
mov rdx, qword [0x14054caf0]
lea r8, [rbp + 0x20]
add rdx, qword [0x14054d0e0]
mov r9d, 8
mov rcx, qword [0x14054d0d0]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x20]
lea r8, [rbp + 0x28]
mov rcx, qword [0x14054d0d0]
add rdx, 0x50
mov r9d, 8
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x28]
lea r8, [rbp + 0x20]
mov rcx, qword [0x14054d0d0]
add rdx, 0xe8
mov r9d, 4
mov dword [rbp + 0x20], 0xb008
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [0x14054c4a9], 1
cmp byte [rdi + 2], sil
jne 0x140069e15
mov byte [0x14054c49f], sil
jmp 0x140069e1c
mov byte [0x14054c4a9], sil
cmp byte [rdi], sil
je 0x14006a0c4
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
setne byte [0x14054c380]
test ax, ax
je 0x140069e49
movss xmm0, dword [0x1403c6350]
jmp 0x140069e51
movss xmm0, dword [0x1403c62d4]
mov rdx, qword [0x14054cbb8]
lea r8, [rbp + 0x20]
mov rcx, qword [0x14054d0d0]
mov r9d, 8
movss dword [0x140545610], xmm0
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x14054cac8]
lea r8, [rbp - 0x30]
mov rcx, qword [0x14054d0d0]
add rdx, 0x90
mov r9d, reloc.WS2_32.dll_inet_ntoa
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x20]
lea r8, [rbp - 0x10]
mov rcx, qword [0x14054d0d0]
add rdx, 0x3d0
mov r9d, reloc.WS2_32.dll_inet_ntoa
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x14054cac8]
lea r8, [rbp + 0x28]
mov rcx, qword [0x14054d0d0]
add rdx, 0x20
mov r9d, 8
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ecx, 0x57
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140069f16
movss xmm0, dword [rbp - 0x2c]
addss xmm0, dword [0x140545610]
movss dword [rbp - 0x2c], xmm0
mov ecx, 0x53
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140069f38
movss xmm0, dword [rbp - 0x2c]
subss xmm0, dword [0x140545610]
movss dword [rbp - 0x2c], xmm0
mov ecx, 0x51
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140069f5a
movss xmm0, dword [rbp - 0x28]
addss xmm0, dword [0x140545610]
movss dword [rbp - 0x28], xmm0
mov ecx, 0x45
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140069f7c
movss xmm0, dword [rbp - 0x28]
subss xmm0, dword [0x140545610]
movss dword [rbp - 0x28], xmm0
mov ecx, 0x41
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140069f9e
movss xmm0, dword [rbp - 0x30]
subss xmm0, dword [0x140545610]
movss dword [rbp - 0x30], xmm0
mov ecx, 0x44
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140069fc0
movss xmm0, dword [rbp - 0x30]
addss xmm0, dword [0x140545610]
movss dword [rbp - 0x30], xmm0
mov ecx, 0xa5
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140069fd3
mov byte [rdi], sil
mov rdx, qword [0x14054cac8]
lea r8, [rbp - 0x20]
movsd xmm0, qword [rbp - 0x30]
add rdx, 0x90
mov eax, dword [rbp - 0x28]
mov r9d, reloc.WS2_32.dll_inet_ntoa
mov rcx, qword [0x14054d0d0]
movsd qword [rbp - 0x20], xmm0
mov dword [rbp - 0x18], eax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [rbp + 0x28]
lea r8, [rbp + 0x20]
mov rcx, qword [0x14054d0d0]
add rdx, 0x2e
mov r9d, 4
mov dword [rbp + 0x20], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [0x14054cac8]
lea r8, [rbp + 0x20]
mov rcx, qword [0x14054d0d0]
add rdx, 0x30
mov r9d, 8
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rbx, qword [rbp + 0x20]
lea r8, [rbp - 0x20]
movsd xmm0, qword [rbp - 0x30]
mov r9d, reloc.WS2_32.dll_inet_ntoa
mov eax, dword [rbp - 0x28]
mov rcx, qword [0x14054d0d0]
lea rdx, [rbx + 0x30]
movsd qword [rbp - 0x20], xmm0
mov dword [rbp - 0x18], eax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movsd xmm0, qword [rbp - 0x30]
lea rdx, [rbx + 0x50]
mov eax, dword [rbp - 0x28]
lea r8, [rbp - 0x20]
mov rcx, qword [0x14054d0d0]
mov r9d, reloc.WS2_32.dll_inet_ntoa
movsd qword [rbp - 0x20], xmm0
mov dword [rbp - 0x18], eax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp byte [rdi], sil
jne 0x14006a116
mov rdx, qword [0x14054cac8]
lea r8, [rbp + 0x28]
mov rcx, qword [0x14054d0d0]
add rdx, 0x20
mov r9d, 8
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x28]
lea r8, [rbp + 0x20]
mov rcx, qword [0x14054d0d0]
add rdx, 0x2e
mov r9d, 4
mov dword [rbp + 0x20], 0x9573f9a
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp byte [rdi + 0x20], sil
je 0x14006a174
mov rdx, qword [0x14054cac8]
lea r8, [rbp + 0x28]
mov rcx, qword [0x14054d0d0]
add rdx, 0x10c8
mov r9d, 8
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x28]
lea r8, [rbp + 0x20]
mov rcx, qword [0x14054d0d0]
add rdx, 0xcf4
mov r9d, 4
mov dword [rbp + 0x20], 0x42c80000
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp byte [rdi + 7], sil
je 0x14006a272
cmp byte [0x14054c493], sil
jne 0x14006a268
mov rdx, qword [0x14054cb00]
lea r8, [rbp + 0x20]
add rdx, qword [0x14054d0e0]
mov r9d, 8
mov rcx, qword [0x14054d0d0]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x20]
lea r8, [rbp + 0x28]
add rdx, qword [0x14054cb08]
mov r9d, 8
mov rcx, qword [0x14054d0d0]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x28]
lea r8, [rbp + 0x30]
add rdx, qword [0x14054cb10]
mov r9d, 8
mov rcx, qword [0x14054d0d0]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x14054cb18]
lea r8, [rbp + 0x20]
mov rbx, qword [rbp + 0x30]
mov r9d, 4
mov rcx, qword [0x14054d0d0]
add rdx, rbx
mov dword [rbp + 0x20], 0x3f19999a
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [0x14054cb20]
lea r8, [rbp + 0x20]
mov rcx, qword [0x14054d0d0]
add rdx, rbx
mov r9d, 4
mov dword [rbp + 0x20], 0x3f19999a
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [0x14054c493], 1
cmp byte [rdi + 7], sil
jne 0x14006a36b
cmp byte [0x14054c4a7], sil
jne 0x14006a35c
mov rdx, qword [0x14054cb00]
lea r8, [rbp + 0x20]
add rdx, qword [0x14054d0e0]
mov r9d, 8
mov rcx, qword [0x14054d0d0]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x20]
lea r8, [rbp + 0x28]
add rdx, qword [0x14054cb08]
mov r9d, 8
mov rcx, qword [0x14054d0d0]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x28]
lea r8, [rbp + 0x30]
add rdx, qword [0x14054cb10]
mov r9d, 8
mov rcx, qword [0x14054d0d0]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x14054cb18]
lea r8, [rbp + 0x20]
mov rbx, qword [rbp + 0x30]
mov r9d, 4
mov rcx, qword [0x14054d0d0]
add rdx, rbx
mov dword [rbp + 0x20], 0x3e4ccccd
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [0x14054cb20]
lea r8, [rbp + 0x20]
mov rcx, qword [0x14054d0d0]
add rdx, rbx
mov r9d, 4
mov dword [rbp + 0x20], 0x3e4ccccd
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [0x14054c4a7], 1
cmp byte [rdi + 7], sil
jne 0x14006a36b
mov byte [0x14054c493], sil
jmp 0x14006a372
mov byte [0x14054c4a7], sil
cmp byte [rdi + 0xf], sil
je 0x14006a440
cmp byte [0x14054c4a8], sil
jne 0x14006a436
mov rdx, qword [0x14054cb28]
lea r8, [rbp + 0x20]
add rdx, qword [0x14054d0e0]
mov r9d, 8
mov rcx, qword [0x14054d0d0]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x20]
lea r8, [rbp + 0x28]
mov rcx, qword [0x14054d0d0]
add rdx, 0x40
mov r9d, 8
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rbx, qword [rbp + 0x28]
lea r8, [rbp + 0x20]
mov rcx, qword [0x14054d0d0]
mov r9d, 4
mov dword [rbp + 0x20], 0x408ccccd
mov qword [rsp + 0x20], rsi
lea rdx, [rbx + 0x324]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x14054d0d0]
lea rdx, [rbx + 0x330]
mov r9d, 4
mov dword [rbp + 0x20], 0x41c80000
lea r8, [rbp + 0x20]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [0x14054c4a8], 1
cmp byte [rdi + 0xf], sil
jne 0x14006a505
cmp byte [0x14054c499], sil
jne 0x14006a4f6
mov rdx, qword [0x14054cb28]
lea r8, [rbp + 0x20]
add rdx, qword [0x14054d0e0]
mov r9d, 8
mov rcx, qword [0x14054d0d0]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x20]
lea r8, [rbp + 0x28]
mov rcx, qword [0x14054d0d0]
add rdx, 0x40
mov r9d, 8
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rbx, qword [rbp + 0x28]
lea r8, [rbp + 0x20]
mov rcx, qword [0x14054d0d0]
mov r9d, 4
mov dword [rbp + 0x20], 0x409ccccd
mov qword [rsp + 0x20], rsi
lea rdx, [rbx + 0x324]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x14054d0d0]
lea rdx, [rbx + 0x330]
mov r9d, 4
mov dword [rbp + 0x20], esi
lea r8, [rbp + 0x20]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [0x14054c499], 1
cmp byte [rdi + 0xf], sil
jne 0x14006a505
mov byte [0x14054c4a8], sil
jmp 0x14006a50c
mov byte [0x14054c499], sil
cmp byte [rdi + 0x10], sil
je 0x14006a5da
cmp byte [0x14054c4ab], sil
jne 0x14006a5d0
mov rdx, qword [0x14054cb28]
lea r8, [rbp + 0x20]
add rdx, qword [0x14054d0e0]
mov r9d, 8
mov rcx, qword [0x14054d0d0]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x20]
lea r8, [rbp + 0x28]
mov rcx, qword [0x14054d0d0]
add rdx, 0x50
mov r9d, 8
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rbx, qword [rbp + 0x28]
lea r8, [rbp + 0x20]
mov rcx, qword [0x14054d0d0]
mov r9d, 4
mov dword [rbp + 0x20], 0x461c3c00
mov qword [rsp + 0x20], rsi
lea rdx, [rbx + 0x1a0]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x14054d0d0]
lea rdx, [rbx + 0x1a4]
mov r9d, 4
mov dword [rbp + 0x20], 0x461c3c00
lea r8, [rbp + 0x20]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [0x14054c4ab], 1
cmp byte [rdi + 0x10], sil
jne 0x14006a6a3
cmp byte [0x14054c491], sil
jne 0x14006a694
mov rdx, qword [0x14054cb28]
lea r8, [rbp + 0x20]
add rdx, qword [0x14054d0e0]
mov r9d, 8
mov rcx, qword [0x14054d0d0]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x20]
lea r8, [rbp + 0x28]
mov rcx, qword [0x14054d0d0]
add rdx, 0x50
mov r9d, 8
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rbx, qword [rbp + 0x28]
lea r8, [rbp + 0x20]
mov rcx, qword [0x14054d0d0]
mov r9d, 4
mov dword [rbp + 0x20], 0x42960000
mov qword [rsp + 0x20], rsi
lea rdx, [rbx + 0x1a0]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x14054d0d0]
lea rdx, [rbx + 0x1a4]
mov r9d, 4
mov dword [rbp + 0x20], 0x42960000
lea r8, [rbp + 0x20]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [0x14054c491], 1
cmp byte [rdi + 0x10], sil
jne 0x14006a6a3
mov byte [0x14054c4ab], sil
jmp 0x14006a6aa
mov byte [0x14054c491], sil
cmp byte [rdi + 8], sil
je 0x14006a74e
cmp byte [0x14054c496], sil
jne 0x14006a744
mov rdx, qword [0x14054cb38]
lea r8, [rbp + 0x20]
add rdx, qword [0x14054d0e0]
mov r9d, 8
mov rcx, qword [0x14054d0d0]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x20]
lea r8, [rbp + 0x28]
mov rcx, qword [0x14054d0d0]
sub rdx, 0xffffffffffffff80
mov r9d, 8
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x28]
lea r8, [rbp + 0x20]
mov rcx, qword [0x14054d0d0]
add rdx, 0xe70
mov r9d, 4
mov dword [rbp + 0x20], 0x14746105
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [0x14054c496], 1
cmp byte [rdi + 8], sil
jne 0x14006a7ed
cmp byte [0x14054c49b], sil
jne 0x14006a7de
mov rdx, qword [0x14054cb38]
lea r8, [rbp + 0x20]
add rdx, qword [0x14054d0e0]
mov r9d, 8
mov rcx, qword [0x14054d0d0]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x20]
lea r8, [rbp + 0x28]
mov rcx, qword [0x14054d0d0]
sub rdx, 0xffffffffffffff80
mov r9d, 8
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x28]
lea r8, [rbp + 0x20]
mov rcx, qword [0x14054d0d0]
add rdx, 0xe70
mov r9d, 4
mov dword [rbp + 0x20], 0x1474607a
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [0x14054c49b], 1
cmp byte [rdi + 8], sil
jne 0x14006a7ed
mov byte [0x14054c496], sil
jmp 0x14006a7f4
mov byte [0x14054c49b], sil
cmp byte [rdi + 9], sil
je 0x14006a8c2
cmp byte [0x14054c4a1], sil
jne 0x14006a8b8
mov rdx, qword [0x14054cb28]
lea r8, [rbp + 0x20]
add rdx, qword [0x14054d0e0]
mov r9d, 8
mov rcx, qword [0x14054d0d0]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x20]
lea r8, [rbp + 0x28]
mov rcx, qword [0x14054d0d0]
add rdx, 0x50
mov r9d, 8
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rbx, qword [rbp + 0x28]
lea r8, [rbp + 0x20]
mov rcx, qword [0x14054d0d0]
mov r9d, 4
mov dword [rbp + 0x20], 0x461c3c00
mov qword [rsp + 0x20], rsi
lea rdx, [rbx + 0x178]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x14054d0d0]
lea rdx, [rbx + 0x17c]
mov r9d, 4
mov dword [rbp + 0x20], 0x461c3c00
lea r8, [rbp + 0x20]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [0x14054c4a1], 1
cmp byte [rdi + 9], sil
jne 0x14006a98b
cmp byte [0x14054c492], sil
jne 0x14006a97c
mov rdx, qword [0x14054cb28]
lea r8, [rbp + 0x20]
add rdx, qword [0x14054d0e0]
mov r9d, 8
mov rcx, qword [0x14054d0d0]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x20]
lea r8, [rbp + 0x28]
mov rcx, qword [0x14054d0d0]
add rdx, 0x50
mov r9d, 8
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rbx, qword [rbp + 0x28]
lea r8, [rbp + 0x20]
mov rcx, qword [0x14054d0d0]
mov r9d, 4
mov dword [rbp + 0x20], 0x42960000
mov qword [rsp + 0x20], rsi
lea rdx, [rbx + 0x178]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x14054d0d0]
lea rdx, [rbx + 0x17c]
mov r9d, 4
mov dword [rbp + 0x20], 0x42960000
lea r8, [rbp + 0x20]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [0x14054c492], 1
cmp byte [rdi + 9], sil
jne 0x14006a98b
mov byte [0x14054c4a1], sil
jmp 0x14006a992
mov byte [0x14054c492], sil
cmp byte [rdi + 0xa], sil
je 0x14006aa60
cmp byte [0x14054c4a5], sil
jne 0x14006aa56
mov rdx, qword [0x14054cb28]
lea r8, [rbp + 0x20]
add rdx, qword [0x14054d0e0]
mov r9d, 8
mov rcx, qword [0x14054d0d0]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x20]
lea r8, [rbp + 0x28]
mov rcx, qword [0x14054d0d0]
add rdx, 0x30
mov r9d, 8
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rbx, qword [rbp + 0x28]
lea r8, [rbp + 0x20]
mov rcx, qword [0x14054d0d0]
mov r9d, 4
mov dword [rbp + 0x20], 0x447a0000
mov qword [rsp + 0x20], rsi
lea rdx, [rbx + 0x354]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x14054d0d0]
lea rdx, [rbx + 0x66c]
mov r9d, 4
mov dword [rbp + 0x20], 0x447a0000
lea r8, [rbp + 0x20]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [0x14054c4a5], 1
cmp byte [rdi + 0xa], sil
jne 0x14006ab29
cmp byte [0x14054c4a0], sil
jne 0x14006ab1a
mov rdx, qword [0x14054cb28]
lea r8, [rbp + 0x20]
add rdx, qword [0x14054d0e0]
mov r9d, 8
mov rcx, qword [0x14054d0d0]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x20]
lea r8, [rbp + 0x28]
mov rcx, qword [0x14054d0d0]
add rdx, 0x30
mov r9d, 8
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rbx, qword [rbp + 0x28]
lea r8, [rbp + 0x20]
mov rcx, qword [0x14054d0d0]
mov r9d, 4
mov dword [rbp + 0x20], 0x40200000
mov qword [rsp + 0x20], rsi
lea rdx, [rbx + 0x354]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x14054d0d0]
lea rdx, [rbx + 0x66c]
mov r9d, 4
mov dword [rbp + 0x20], 0x40200000
lea r8, [rbp + 0x20]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [0x14054c4a0], 1
cmp byte [rdi + 0xa], sil
jne 0x14006ab29
mov byte [0x14054c4a5], sil
jmp 0x14006ab30
mov byte [0x14054c4a0], sil
cmp byte [rdi + 0xb], sil
je 0x14006abd4
cmp byte [0x14054c498], sil
jne 0x14006abca
mov rdx, qword [0x14054cb28]
lea r8, [rbp + 0x20]
add rdx, qword [0x14054d0e0]
mov r9d, 8
mov rcx, qword [0x14054d0d0]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x20]
lea r8, [rbp + 0x28]
mov rcx, qword [0x14054d0d0]
add rdx, 0x50
mov r9d, 8
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x28]
lea r8, [rbp + 0x20]
mov rcx, qword [0x14054d0d0]
add rdx, 0x188
mov r9d, 4
mov dword [rbp + 0x20], reloc.WS2_32.dll_inet_addr
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [0x14054c498], 1
cmp byte [rdi + 0xb], sil
jne 0x14006ac73
cmp byte [0x14054c494], sil
jne 0x14006ac64
mov rdx, qword [0x14054cb28]
lea r8, [rbp + 0x20]
add rdx, qword [0x14054d0e0]
mov r9d, 8
mov rcx, qword [0x14054d0d0]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x20]
lea r8, [rbp + 0x28]
mov rcx, qword [0x14054d0d0]
add rdx, 0x50
mov r9d, 8
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x28]
lea r8, [rbp + 0x20]
mov rcx, qword [0x14054d0d0]
add rdx, 0x188
mov r9d, 4
mov dword [rbp + 0x20], 0x9008
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [0x14054c494], 1
cmp byte [rdi + 0xb], sil
jne 0x14006ac73
mov byte [0x14054c498], sil
jmp 0x14006ac7a
mov byte [0x14054c494], sil
cmp byte [rdi + 0x12], sil
je 0x14006ad1e
cmp byte [0x14054c495], sil
jne 0x14006ad14
mov rdx, qword [0x14054cb38]
lea r8, [rbp + 0x20]
add rdx, qword [0x14054d0e0]
mov r9d, 8
mov rcx, qword [0x14054d0d0]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x20]
lea r8, [rbp + 0x28]
mov rcx, qword [0x14054d0d0]
sub rdx, 0xffffffffffffff80
mov r9d, 8
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x28]
lea r8, [rbp + 0x20]
mov rcx, qword [0x14054d0d0]
add rdx, 0x588
mov r9d, 4
mov dword [rbp + 0x20], 0xaf034605
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [0x14054c495], 1
cmp byte [rdi + 0x12], sil
jne 0x14006adbd
cmp byte [0x14054c4aa], sil
jne 0x14006adae
mov rdx, qword [0x14054cb38]
lea r8, [rbp + 0x20]
add rdx, qword [0x14054d0e0]
mov r9d, 8
mov rcx, qword [0x14054d0d0]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x20]
lea r8, [rbp + 0x28]
mov rcx, qword [0x14054d0d0]
sub rdx, 0xffffffffffffff80
mov r9d, 8
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x28]
lea r8, [rbp + 0x20]
mov rcx, qword [0x14054d0d0]
add rdx, 0x588
mov r9d, 4
mov dword [rbp + 0x20], 0xaf03459a
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [0x14054c4aa], 1
cmp byte [rdi + 0x12], sil
jne 0x14006adbd
mov byte [0x14054c495], sil
jmp 0x14006adc4
mov byte [0x14054c4aa], sil
cmp byte [rdi + 3], sil
je 0x14006ae68
cmp byte [0x14054c497], sil
jne 0x14006ae5e
mov rdx, qword [0x14054cb28]
lea r8, [rbp + 0x20]
add rdx, qword [0x14054d0e0]
mov r9d, 8
mov rcx, qword [0x14054d0d0]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x20]
lea r8, [rbp + 0x28]
mov rcx, qword [0x14054d0d0]
add rdx, 0x30
mov r9d, 8
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x28]
lea r8, [rbp + 0x20]
mov rcx, qword [0x14054d0d0]
add rdx, 0x2b4
mov r9d, 4
mov dword [rbp + 0x20], reloc.WS2_32.dll_select
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [0x14054c497], 1
cmp byte [rdi + 3], sil
jne 0x14006af07
cmp byte [0x14054c4a3], sil
jne 0x14006aef8
mov rdx, qword [0x14054cb28]
lea r8, [rbp + 0x20]
add rdx, qword [0x14054d0e0]
mov r9d, 8
mov rcx, qword [0x14054d0d0]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x20]
lea r8, [rbp + 0x28]
mov rcx, qword [0x14054d0d0]
add rdx, 0x30
mov r9d, 8
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x28]
lea r8, [rbp + 0x20]
mov rcx, qword [0x14054d0d0]
add rdx, 0x2b4
mov r9d, 4
mov dword [rbp + 0x20], ntohs
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [0x14054c4a3], 1
cmp byte [rdi + 3], sil
jne 0x14006af07
mov byte [0x14054c497], sil
jmp 0x14006af0e
mov byte [0x14054c4a3], sil
cmp byte [rdi + 0x1e], sil
je 0x14006af5b
cmp byte [0x14054c49a], sil
jne 0x14006af55
mov rdx, qword [0x14054d0e0]
lea r8, [rbp + 0x20]
mov rcx, qword [0x14054d0d0]
add rdx, 0x100c5e2
mov r9d, 4
mov dword [rbp + 0x20], 0x441f0f66
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [0x14054c49a], 1
cmp byte [rdi + 0x1e], sil
jne 0x14006afab
cmp byte [0x14054c4a2], sil
jne 0x14006af9c
mov rdx, qword [0x14054d0e0]
lea r8, [rbp + 0x20]
mov rcx, qword [0x14054d0d0]
add rdx, 0x100c5e2
mov r9d, 4
mov dword [rbp + 0x20], 0x19b850f
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [0x14054c4a2], 1
cmp byte [rdi + 0x1e], sil
jne 0x14006afab
mov byte [0x14054c49a], sil
jmp 0x14006afb2
mov byte [0x14054c4a2], sil
cmp byte [rdi + 4], sil
je 0x14006b080
cmp byte [0x14054c49e], sil
jne 0x14006b076
mov rdx, qword [0x14054cb28]
lea r8, [rbp + 0x20]
add rdx, qword [0x14054d0e0]
mov r9d, 8
mov rcx, qword [0x14054d0d0]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x20]
lea r8, [rbp + 0x28]
mov rcx, qword [0x14054d0d0]
add rdx, 0x50
mov r9d, 8
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rbx, qword [rbp + 0x28]
lea r8, [rbp + 0x20]
mov rcx, qword [0x14054d0d0]
mov r9d, 4
mov dword [rbp + 0x20], 0x461c3c00
mov qword [rsp + 0x20], rsi
lea rdx, [rbx + 0xd8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x14054d0d0]
lea rdx, [rbx + 0xd6c]
mov r9d, 4
mov dword [rbp + 0x20], 0x461c3c00
lea r8, [rbp + 0x20]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [0x14054c49e], 1
cmp byte [rdi + 4], sil
jne 0x14006b149
cmp byte [0x14054c4a4], sil
jne 0x14006b13a
mov rdx, qword [0x14054cb28]
lea r8, [rbp + 0x20]
add rdx, qword [0x14054d0e0]
mov r9d, 8
mov rcx, qword [0x14054d0d0]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x20]
lea r8, [rbp + 0x28]
mov rcx, qword [0x14054d0d0]
add rdx, 0x50
mov r9d, 8
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rbx, qword [rbp + 0x28]
lea r8, [rbp + 0x20]
mov rcx, qword [0x14054d0d0]
mov r9d, 4
mov dword [rbp + 0x20], 0x41a00000
mov qword [rsp + 0x20], rsi
lea rdx, [rbx + 0xd8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x14054d0d0]
lea rdx, [rbx + 0xdc]
mov r9d, 4
mov dword [rbp + 0x20], 0x41a00000
lea r8, [rbp + 0x20]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [0x14054c4a4], 1
cmp byte [rdi + 4], sil
jne 0x14006b149
mov byte [0x14054c49e], sil
jmp 0x14006b150
mov byte [0x14054c4a4], sil
cmp byte [rdi + 0x1b], sil
je 0x14006b1c1
cmp byte [0x14054c4ac], sil
jne 0x14006b1bb
mov rdx, qword [0x14054cb50]
lea r8, [rbp + 0x28]
add rdx, qword [0x14054cac8]
mov r9d, 8
mov rcx, qword [0x14054d0d0]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x28]
lea r8, [rbp + 0x20]
mov rcx, qword [0x14054d0d0]
add rdx, 0x189
mov r9d, 1
mov byte [rbp + 0x20], 9
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [0x14054c4ac], 1
cmp byte [rdi + 0x1b], sil
jne 0x14006b235
cmp byte [0x14054c49c], sil
jne 0x14006b226
mov rdx, qword [0x14054cb50]
lea r8, [rbp + 0x28]
add rdx, qword [0x14054cac8]
mov r9d, 8
mov rcx, qword [0x14054d0d0]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x28]
lea r8, [rbp + 0x20]
mov rcx, qword [0x14054d0d0]
add rdx, 0x189
mov r9d, 1
mov byte [rbp + 0x20], sil
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [0x14054c49c], 1
cmp byte [rdi + 0x1b], sil
jne 0x14006b235
mov byte [0x14054c4ac], sil
jmp 0x14006b23c
mov byte [0x14054c49c], sil
cmp byte [rdi + 0x13], sil
je 0x14006b30a
cmp byte [0x14054c49d], sil
jne 0x14006b300
mov rdx, qword [0x14054cab8]
lea r8, [rbp + 0x20]
mov rcx, qword [0x14054d0d0]
add rdx, 0x48
mov r9d, 8
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x20]
lea r8, [rbp + 0x28]
mov rcx, qword [0x14054d0d0]
add rdx, 0xc8
mov r9d, 8
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rbx, qword [rbp + 0x28]
lea r8, [rbp + 0x20]
mov rcx, qword [0x14054d0d0]
mov r9d, 4
mov dword [rbp + 0x20], 0x3e851eb8
mov qword [rsp + 0x20], rsi
lea rdx, [rbx + 0xb14]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x14054d0d0]
lea rdx, [rbx + 0xb2c]
mov r9d, 4
mov dword [rbp + 0x20], 0x3e851eb8
lea r8, [rbp + 0x20]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [0x14054c49d], 1
cmp byte [rdi + 0x13], sil
jne 0x14006b3e1
cmp byte [0x14054c4a6], sil
jne 0x14006b3c4
mov rdx, qword [0x14054cab8]
lea r8, [rbp + 0x20]
mov rcx, qword [0x14054d0d0]
add rdx, 0x48
mov r9d, 8
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x20]
lea r8, [rbp + 0x28]
mov rcx, qword [0x14054d0d0]
add rdx, 0xc8
mov r9d, 8
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rbx, qword [rbp + 0x28]
lea r8, [rbp + 0x20]
mov rcx, qword [0x14054d0d0]
mov r9d, 4
mov dword [rbp + 0x20], 0x3e09a3d3
mov qword [rsp + 0x20], rsi
lea rdx, [rbx + 0xb14]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x14054d0d0]
lea rdx, [rbx + 0xb24]
mov r9d, 4
mov dword [rbp + 0x20], 0x3dd0b84a
lea r8, [rbp + 0x20]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [0x14054c4a6], 1
cmp byte [rdi + 0x13], sil
jne 0x14006b3e1
mov byte [0x14054c49d], sil
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
mov rbx, qword [rsp + 0x98]
mov byte [0x14054c4a6], sil
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
cmp qword [0x14054cac8], 0
jne 0x140069990
ret