Function at 0x140007af0
Capabilities:
Query environment variable
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x250
mov rax, qword [0x1400300a8]
xor rax, rsp
mov qword [rsp + 0x240], rax
lea rcx, str.username
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xor ebx, ebx
mov qword [rsp + 0x1a0], rbx
mov qword [rsp + 0x1b0], rbx
mov qword [rsp + 0x1b8], rbx
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rax + r8], bl
jne 0x140007b54
mov rdx, rax
lea rcx, [rsp + 0x1a0]
call fcn.1400018e0
nop
lea rcx, [rsp + 0x58]
call fcn.140012020
nop
mov qword [rsp + 0x180], rbx
movdqa xmm0, xmmword [0x140021980]
movdqu xmmword [rsp + 0x190], xmm0
mov byte [rsp + 0x180], 0
mov ecx, 8
call fcn.14001db98
mov qword [rsp + 0x20], rax
test rax, rax
je 0x140007bbb
mov rcx, rax
call fcn.140013bb0
mov r13, rax
jmp 0x140007bbe
mov r13, rbx
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
lea rcx, [rsp + 0xa0]
call fcn.140016100
nop
cmp qword [rax + 0x18], 0x10
jb 0x140007bdb
mov rax, qword [rax]
mov r8, rdi
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140007be0
mov rdx, rax
lea rcx, [0x140030b10]
call fcn.1400037a0
nop
mov rdx, qword [rsp + 0xb8]
cmp rdx, 0x10
jb 0x140007c40
inc rdx
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007c3b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007c3b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001dbd4
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
lea rcx, [rsp + 0xa0]
call fcn.140016100
nop
cmp qword [rax + 0x18], 0x10
jb 0x140007c5d
mov rax, qword [rax]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x140007c60
mov rdx, rax
lea rcx, [0x140030b30]
call fcn.1400037a0
nop
mov rdx, qword [rsp + 0xb8]
cmp rdx, 0x10
jb 0x140007cc0
inc rdx
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007cbb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007cbb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001dbd4
mov r8d, 1
lea rdx, [0x140021a90]
lea rcx, [0x140030af0]
call fcn.1400037a0
lea rdx, str.nullptr
lea rcx, [rsp + 0x58]
call fcn.140012ed0
lea rcx, [rsp + 0x58]
call fcn.140012380
test al, al
jne 0x140007db3
mov rdx, qword [rsp + 0x198]
cmp rdx, 0x10
jb 0x140007d42
inc rdx
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007d3d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007d3d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001dbd4
movdqa xmm0, xmmword [0x140021980]
movdqu xmmword [rsp + 0x190], xmm0
mov byte [rsp + 0x180], 0
lea rcx, [rsp + 0x58]
call fcn.140012050
nop
mov rdx, qword [rsp + 0x1b8]
cmp rdx, 0x10
jb 0x140007dac
inc rdx
mov rcx, qword [rsp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007da7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007da7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001dbd4
xor al, al
jmp 0x140009401
mov qword [rsp + 0x160], rbx
mov qword [rsp + 0x170], rbx
mov qword [rsp + 0x178], SafeArrayPutElement
mov byte [rsp + 0x160], 0
lea rdx, [0x140030c40]
lea rcx, [rsp + 0xa0]
call fcn.140015730
nop
cmp qword [rax + 0x18], 0x10
jb 0x140007df6
mov rax, qword [rax]
mov r8, rax
lea rdx, [0x140021aa8]
lea rcx, [rsp + 0x180]
call fcn.140012060
nop
mov rdx, qword [rsp + 0xb8]
cmp rdx, 0x10
jb 0x140007e54
inc rdx
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007e4f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007e4f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001dbd4
lea rdx, [0x140030b90]
lea rcx, [rsp + 0xc0]
call fcn.140002280
mov rdx, rax
lea rcx, [rsp + 0xa0]
call fcn.140015b70
nop
cmp qword [rax + 0x18], 0x10
jb 0x140007e83
mov rax, qword [rax]
mov r8, rax
lea rdx, [0x140021aac]
lea rcx, [rsp + 0x180]
call fcn.140012060
nop
mov rdx, qword [rsp + 0xb8]
cmp rdx, 0x10
jb 0x140007ee1
inc rdx
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007edc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007edc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001dbd4
mov r8d, 1
lea rdx, [0x140021964]
lea rcx, [0x140030af0]
call fcn.1400037a0
lea rdx, [0x140030c00]
lea rcx, [rsp + 0xc0]
call fcn.140002280
mov rdx, rax
lea rcx, [rsp + 0xa0]
call fcn.140015b70
nop
cmp qword [rax + 0x18], 0x10
jb 0x140007f29
mov rax, qword [rax]
mov r8, rax
lea rdx, [0x140021ab0]
lea rcx, [rsp + 0x180]
call fcn.140012060
nop
mov rdx, qword [rsp + 0xb8]
cmp rdx, 0x10
jb 0x140007f87
inc rdx
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007f82
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007f82
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001dbd4
lea rcx, [rsp + 0xc0]
call fcn.1400119a0
mov r8, rax
lea rdx, [rsp + 0xe0]
mov rcx, r13
call fcn.140013ca0
mov rdx, rax
lea rcx, [rsp + 0xa0]
call fcn.140015b70
nop
cmp qword [rax + 0x18], 0x10
jb 0x140007fc2
mov rax, qword [rax]
mov r8, rax
lea rdx, [0x140021960]
lea rcx, [rsp + 0x180]
call fcn.140012060
nop
mov rdx, qword [rsp + 0xb8]
cmp rdx, 0x10
jb 0x140008020
inc rdx
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000801b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000801b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001dbd4
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbx
lea r14, [rsp + 0x1a0]
cmp qword [rsp + 0x1b8], 0x10
cmovae r14, qword [rsp + 0x1a0]
movabs r15, 0x7fffffffffffffff
mov rsi, qword [rsp + 0x1b0]
cmp rsi, r15
ja 0x140009433
mov qword [rsp + 0x48], SafeArrayGetLBound
cmp rsi, 0x10
jae 0x140008093
mov qword [rsp + 0x40], rsi
mov r8d, reloc.OLEAUT32.dll_SafeArrayGetDim
mov rdx, r14
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memmove
mov r12d, SafeArrayPutElement
jmp 0x1400080df
mov rbx, rsi
or rbx, 0xf
mov r12d, SafeArrayPutElement
cmp rbx, r15
jbe 0x1400080aa
mov rbx, r15
jmp 0x1400080b1
cmp rbx, r12
cmovb rbx, r12
lea rdx, [rbx + 1]
lea rcx, [rsp + 0x30]
call fcn.1400035d0
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rbx
lea r8, [rsi + 1]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
xor ebx, ebx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xa0]
call fcn.140015b70
nop
cmp qword [rax + 0x18], 0x10
jb 0x1400080fc
mov rax, qword [rax]
mov r8, rax
lea rdx, [0x140021ac4]
lea rcx, [rsp + 0x180]
call fcn.140012060
nop
mov rdx, qword [rsp + 0xb8]
cmp rdx, 0x10
jb 0x14000815a
inc rdx
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008155
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008155
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001dbd4
lea rdx, [0x140030b30]
lea rcx, [rsp + 0xa0]
call fcn.140015730
nop
cmp qword [rax + 0x18], 0x10
jb 0x140008179
mov rax, qword [rax]
mov r8, rax
lea rdx, str.ToDo
lea rcx, [rsp + 0x180]
call fcn.140012060
nop
mov rdx, qword [rsp + 0xb8]
cmp rdx, 0x10
jb 0x1400081d7
inc rdx
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400081d2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400081d2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001dbd4
lea rdx, [0x140030b10]
lea rcx, [rsp + 0xa0]
call fcn.140015730
nop
cmp qword [rax + 0x18], 0x10
jb 0x1400081f6
mov rax, qword [rax]
mov r8, rax
lea rdx, str.ToMe
lea rcx, [rsp + 0x180]
call fcn.140012060
nop
mov rdx, qword [rsp + 0xb8]
cmp rdx, 0x10
jb 0x140008254
inc rdx
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000824f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000824f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001dbd4
mov qword [rsp + 0xc0], rbx
mov qword [rsp + 0xd0], rbx
mov qword [rsp + 0xd8], rbx
mov r8d, 0x20
lea rdx, str.https:__swatx.me_api_securez.php
lea rcx, [rsp + 0xc0]
call fcn.1400019a0
lea r9, [rsp + 0x180]
lea r8, [rsp + 0x160]
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x58]
call fcn.140012730
test al, al
jne 0x1400082b8
mov ecx, 0x2b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0xe0], rbx
mov qword [rsp + 0xf0], 6
mov qword [rsp + SafeArrayPutElement8], 0xf
mov eax, dword [str.remove]
mov dword [rsp + 0xe0], eax
movzx eax, word [0x140021a8c]
mov word [rsp + 0xe4], ax
mov byte [rsp + 0xe6], 0
lea rax, [rsp + 0x120]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x120], rbx
mov qword [rsp + 0x130], 2
mov qword [rsp + 0x138], SafeArrayPutElement
mov eax, 0xa0d
mov word [rsp + 0x120], ax
mov byte [rsp + 0x122], 0
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0xc0]
call fcn.140002280
nop
lea r9, [rsp + 0xe0]
lea r8, [rsp + 0x120]
mov rdx, rax
lea rcx, [rsp + 0xa0]
call fcn.14000e3d0
nop
cmp qword [rax + 0x18], 0x10
jb 0x14000838c
mov rax, qword [rax]
mov r8, rdi
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140008390
mov rdx, rax
lea rcx, [rsp + 0x160]
call fcn.1400037a0
nop
mov rdx, qword [rsp + 0xb8]
cmp rdx, 0x10
jb 0x1400083f1
inc rdx
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400083ec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400083ec
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001dbd4
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0xe0], rbx
mov qword [rsp + 0xf0], 6
mov qword [rsp + SafeArrayPutElement8], 0xf
mov eax, dword [str.remove]
mov dword [rsp + 0xe0], eax
movzx eax, word [0x140021a8c]
mov word [rsp + 0xe4], ax
mov byte [rsp + 0xe6], 0
lea rax, [rsp + 0x120]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x120], rbx
mov qword [rsp + 0x130], 2
mov qword [rsp + 0x138], SafeArrayPutElement
mov eax, 0x3d3d
mov word [rsp + 0x120], ax
mov byte [rsp + 0x122], 0
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0xc0]
call fcn.140002280
nop
lea r9, [rsp + 0xe0]
lea r8, [rsp + 0x120]
mov rdx, rax
lea rcx, [rsp + 0xa0]
call fcn.14000e3d0
nop
cmp qword [rax + 0x18], 0x10
jb 0x1400084c5
mov rax, qword [rax]
mov r8, rdi
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400084d0
mov rdx, rax
lea rcx, [rsp + 0x160]
call fcn.1400037a0
nop
mov rdx, qword [rsp + 0xb8]
cmp rdx, 0x10
jb 0x140008531
inc rdx
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000852c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000852c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001dbd4
mov qword [rsp + 0x100], rbx
mov qword [rsp + 0x110], rbx
mov qword [rsp + 0x118], rbx
mov rbx, qword [rsp + 0x170]
lea rsi, [rsp + 0x160]
cmp qword [rsp + 0x178], 0x10
cmovae rsi, qword [rsp + 0x160]
cmp rbx, r15
ja 0x140009438
mov qword [rsp + 0x118], SafeArrayPutElement
cmp rbx, 0x10
jae 0x1400085a6
mov qword [rsp + 0x110], rbx
mov r8d, reloc.OLEAUT32.dll_SafeArrayGetDim
mov rdx, rsi
lea rcx, [rsp + 0x100]
call sub.VCRUNTIME140.dll_memmove
jmp 0x1400085f5
mov rax, rbx
or rax, 0xf
cmp rax, r15
ja 0x1400085bd
mov r15, rax
cmp rax, 0x16
cmovb r15, r12
lea rdx, [r15 + 1]
lea rcx, [rsp + 0x100]
call fcn.1400035d0
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x110], rbx
mov qword [rsp + 0x118], r15
lea r8, [rbx + 1]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0xa0]
call fcn.140014f00
nop
cmp qword [rax + 0x18], 0x10
jb 0x140008615
mov rax, qword [rax]
xor r15d, r15d
mov qword [rsp + 0x140], r15
mov qword [rsp + 0x150], r15
mov qword [rsp + 0x158], r15
mov r8, rdi
inc r8
cmp byte [rax + r8], r15b
jne 0x140008633
mov rdx, rax
lea rcx, [rsp + 0x140]
call fcn.1400018e0
nop
mov rdx, qword [rsp + 0xb8]
cmp rdx, 0x10
jb 0x140008693
inc rdx
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000868e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000868e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001dbd4
movdqa xmm0, xmmword [0x140021980]
movdqu xmmword [rsp + 0xb0], xmm0
mov byte [rsp + 0xa0], 0
lea rdx, str.login_:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400042f0
lea rdx, [rsp + 0x140]
cmp qword [rsp + 0x158], 0x10
cmovae rdx, qword [rsp + 0x140]
mov r8, qword [rsp + 0x150]
mov rcx, rax
call fcn.140004610
lea rdx, str._encode_:
mov rcx, rax
call fcn.1400042f0
lea rdx, [rsp + 0x160]
cmp qword [rsp + 0x178], 0x10
cmovae rdx, qword [rsp + 0x160]
mov r8, qword [rsp + 0x170]
mov rcx, rax
call fcn.140004610
lea rdx, [0x140004a70]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rsp + 0x140]
mov rsi, qword [rsp + 0x140]
mov r14, qword [rsp + 0x158]
cmp r14, 0x10
cmovae rcx, rsi
mov rbx, qword [rsp + 0x150]
cmp rbx, 1
jne 0x140008777
mov r8, rbx
lea rdx, [0x140021960]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140008881
lea rcx, [rsp + 0x140]
cmp r14, 0x10
cmovae rcx, rsi
cmp rbx, 1
jne 0x1400087a4
mov r8, rbx
lea rdx, [0x140021aac]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140008881
lea rcx, [rsp + 0x140]
cmp r14, 0x10
cmovae rcx, rsi
cmp rbx, 1
jne 0x1400087d1
mov r8, rbx
lea rdx, [0x140021c28]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140008881
lea rcx, [rsp + 0x140]
cmp r14, 0x10
cmovae rcx, rsi
cmp rbx, 1
jne 0x1400087fe
mov r8, rbx
lea rdx, [0x140021964]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140008881
lea rcx, [rsp + 0x140]
cmp r14, 0x10
cmovae rcx, rsi
cmp rbx, 1
jne 0x140008827
mov r8, rbx
lea rdx, [0x140021d98]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140008881
lea rcx, [rsp + 0x140]
cmp r14, 0x10
cmovae rcx, rsi
cmp rbx, 1
jne 0x140008850
mov r8, rbx
lea rdx, [0x140021d9c]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140008881
lea rcx, [rsp + 0x140]
cmp r14, 0x10
cmovae rcx, rsi
cmp rbx, 1
jne 0x14000890a
mov r8, rbx
lea rdx, [0x140021a90]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14000890a
lea rax, [rsp + 0x140]
cmp r14, 0x10
cmovae rax, rsi
movsx eax, byte [rax]
add eax, 0xffffff9e
cmp eax, 0x11
ja case.0x1400088b3.99
cdqe
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0x94a4]
add rcx, rdx
jmp rcx
lea rcx, str.ERROR_:_Request_time_out_
call fcn.140013ef0
jmp case.0x1400088b3.99
lea rcx, str.ERROR_:_This_application_is_banned__please_contact_the_developer_
call fcn.140013ef0
jmp case.0x1400088b3.99
lea rcx, str.ERROR_:_The_temp_could_not_be_found_
call fcn.140013ef0
jmp case.0x1400088b3.99
lea rcx, str.ERROR_:_The_application_could_not_be_found_
call fcn.140013ef0
jmp case.0x1400088b3.99
lea rcx, str.ERROR_:_You_must_send_all_parameters_to_the_server__
call fcn.140013ef0
jmp case.0x1400088b3.99
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0xe0], r15
mov qword [rsp + 0xf0], 1
mov qword [rsp + SafeArrayPutElement8], 0xf
mov word [rsp + 0xe0], 0x7c
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x120]
call fcn.140002280
nop
lea r8, [rsp + 0xe0]
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.14000e7b0
nop
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0xc0]
call fcn.140002280
mov rdx, rax
lea rcx, [rsp + 0xa0]
call fcn.1400153c0
nop
cmp qword [rax + 0x18], 0x10
jb 0x14000899a
mov rax, qword [rax]
mov qword [rsp + 0x100], r15
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x110], xmm0
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x1400089b1
mov rdx, rax
lea rcx, [rsp + 0x100]
call fcn.1400018e0
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov r14, rax
lea rbx, [rsp + 0x100]
cmp qword [rsp + 0x118], 0x10
cmovae rbx, qword [rsp + 0x100]
mov dword [rax], r15d
mov r8d, 0xa
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtol]
mov esi, eax
cmp rbx, qword [rsp + 0x20]
je 0x14000946f
cmp dword [r14], 0x22
je 0x14000947b
mov rdx, qword [rsp + 0x118]
cmp rdx, 0x10
jb 0x140008a63
inc rdx
mov rcx, qword [rsp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008a5e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008a5e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001dbd4
movdqa xmm0, xmmword [0x140021980]
movdqu xmmword [rsp + 0x110], xmm0
mov byte [rsp + 0x100], 0
mov rdx, qword [rsp + 0xb8]
cmp rdx, 0x10
jb 0x140008ac2
inc rdx
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008abd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008abd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001dbd4
cmp esi, dword [0x140030bd0]
jne 0x140009310
mov rdx, qword [rsp + 0x30]
add rdx, 0x20
lea rcx, [rsp + 0xa0]
call fcn.140002280
mov rdx, rax
lea rcx, [rsp + 0x1c0]
call fcn.1400153c0
nop
cmp qword [rax + 0x18], 0x10
jb 0x140008aff
mov rax, qword [rax]
mov qword [rsp + 0xe0], r15
mov qword [rsp + 0xf0], r15
mov qword [rsp + 0xf8], r15
mov r8, rdi
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140008b20
mov rdx, rax
lea rcx, [rsp + 0xe0]
call fcn.1400018e0
nop
lea rcx, [rsp + 0x1c0]
call fcn.140002a80
mov rdx, qword [rsp + 0x30]
add rdx, 0x40
lea rcx, [rsp + 0x120]
call fcn.140002280
mov rdx, rax
lea rcx, [rsp + 0xc0]
call fcn.1400153c0
nop
cmp qword [rax + 0x18], 0x10
jb 0x140008b79
mov rax, qword [rax]
mov qword [rsp + 0xa0], r15
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xb0], xmm0
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x140008b90
mov rdx, rax
lea rcx, [rsp + 0xa0]
call fcn.1400018e0
nop
mov rdx, qword [rsp + 0xd8]
cmp rdx, 0x10
jb 0x140008bf1
inc rdx
mov rcx, qword [rsp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008bec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008bec
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001dbd4
movdqa xmm0, xmmword [0x140021980]
movdqu xmmword [rsp + 0xd0], xmm0
mov byte [rsp + 0xc0], 0
mov rdx, qword [rsp + 0x30]
add rdx, 0x60
lea rcx, [rsp + 0x1c0]
call fcn.140002280
mov rdx, rax
lea rcx, [rsp + 0x1e0]
call fcn.1400153c0
nop
cmp qword [rax + 0x18], 0x10
jb 0x140008c3b
mov rax, qword [rax]
mov qword [rsp + 0x120], r15
mov qword [rsp + 0x130], r15
mov qword [rsp + 0x138], r15
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x140008c56
mov rdx, rax
lea rcx, [rsp + 0x120]
call fcn.1400018e0
nop
lea rcx, [rsp + 0x1e0]
call fcn.140002a80
mov rdx, qword [rsp + 0x30]
sub rdx, 0xffffffffffffff80
lea rcx, [rsp + 0x80]
call fcn.140002280
mov rdx, rax
lea rcx, [rsp + 0x220]
call fcn.1400153c0
nop
cmp qword [rax + 0x18], 0x10
jb 0x140008caf
mov rax, qword [rax]
mov qword [rsp + 0x100], r15
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x110], xmm0
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x140008cc6
mov rdx, rax
lea rcx, [rsp + 0x100]
call fcn.1400018e0
nop
lea rcx, [rsp + 0x220]
call fcn.140002a80
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0x200]
call fcn.140015730
mov rbx, rax
lea rdx, [0x140030c00]
lea rcx, [rsp + 0xc0]
call fcn.140015730
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x1e0]
call fcn.140004500
mov r8, rax
lea rdx, [rsp + 0x1c0]
mov rcx, r13
call fcn.140013ca0
mov rdx, qword [rax + 0x10]
cmp qword [rax + 0x18], 0x10
jb 0x140008d4f
mov rax, qword [rax]
lea rcx, [rsp + 0xe0]
mov r15, qword [rsp + 0xe0]
mov r12, qword [rsp + 0xf8]
cmp r12, 0x10
cmovae rcx, r15
mov r8, qword [rsp + 0xf0]
cmp r8, rdx
jne 0x140008d8c
mov rdx, rax
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140008d8c
mov bl, 1
jmp 0x140008d8e
xor bl, bl
lea rcx, [rsp + 0x1c0]
call fcn.140002a80
nop
lea rcx, [rsp + 0xc0]
call fcn.140002a80
nop
lea rcx, [rsp + 0x200]
call fcn.140002a80
test bl, bl
je 0x1400092c2
lea rcx, [rsp + 0x200]
call fcn.1400119a0
mov r8, rax
lea rdx, [rsp + 0xc0]
mov rcx, r13
call fcn.140013ca0
mov rdx, qword [rax + 0x10]
cmp qword [rax + 0x18], 0x10
jb 0x140008ded
mov rax, qword [rax]
lea rcx, [rsp + 0x120]
mov r14, qword [rsp + 0x120]
mov r13, qword [rsp + 0x138]
cmp r13, 0x10
cmovae rcx, r14
mov r8, qword [rsp + 0x130]
cmp r8, rdx
jne 0x1400092b4
mov rdx, rax
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400092b4
lea rcx, [rsp + 0xc0]
call fcn.140002a80
mov rdx, qword [rsp + 0x30]
add rdx, 0xa0
lea rcx, [rsp + 0x200]
call fcn.140002280
mov rdx, rax
lea rcx, [rsp + 0x1e0]
call fcn.1400153c0
nop
cmp qword [rax + 0x18], 0x10
jb 0x140008e6f
mov rax, qword [rax]
mov qword [rsp + 0xc0], 0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xd0], xmm0
mov r8, rdi
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140008e90
mov rdx, rax
lea rcx, [rsp + 0xc0]
call fcn.1400018e0
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rsi, rax
lea rbx, [rsp + 0xc0]
cmp qword [rsp + 0xd8], 0x10
cmovae rbx, qword [rsp + 0xc0]
mov dword [rax], 0
mov r8d, 0xa
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtol]
cmp rbx, qword [rsp + 0x20]
je 0x140009488
cmp dword [rsi], 0x22
je 0x140009494
mov dword [0x140030c80], eax
lea rcx, [rsp + 0xc0]
call fcn.140002a80
nop
lea rcx, [rsp + 0x1e0]
call fcn.140002a80
mov rdx, qword [rsp + 0x30]
add rdx, 0xc0
cmp qword [rdx + 0x18], 0x10
jb 0x140008f33
mov rdx, qword [rdx]
inc rdi
cmp byte [rdx + rdi], 0
jne 0x140008f33
mov r8, rdi
lea rcx, [0x140030c88]
call fcn.1400037a0
lea rcx, [rsp + 0x58]
call fcn.140012070
lea rcx, [0x140030d08]
cmp qword [0x140030d20], 0x10
cmovae rcx, qword [0x140030d08]
mov r8, qword [0x140030d18]
cmp r8, 4
jne 0x14000929e
lea rdx, str.true
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14000929e
cmp dword [0x140030d68], 1
jne 0x140009292
lea r8d, [rax + 4]
lea rdx, str..net
lea rcx, [0x140030d08]
call fcn.1400037a0
mov dword [0x140030d68], 0x369f
mov dword [0x140030d70], 0x2c5aa
mov r8d, 0x74
lea rdx, str.rm__rf__data_media_0_Android_data_com.tencent.ig_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_LightData
lea rcx, [0x140030d80]
call fcn.1400037a0
lea rcx, [rsp + 0x58]
call fcn.140012070
nop
mov rdx, qword [rsp + 0x118]
cmp rdx, 0x10
jb 0x140009033
inc rdx
mov rcx, qword [rsp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000902e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000902e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001dbd4
movdqa xmm0, xmmword [0x140021980]
movdqu xmmword [rsp + 0x110], xmm0
mov byte [rsp + 0x100], 0
cmp r13, 0x10
jb 0x140009087
lea rdx, [r13 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x14000907e
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000907e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.14001dbd4
nop
mov rdx, qword [rsp + 0xb8]
cmp rdx, 0x10
jb 0x1400090ce
inc rdx
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400090c8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400090c8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001dbd4
nop
cmp r12, 0x10
jb 0x14000910a
lea rdx, [r12 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x140009101
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009101
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r15
call fcn.14001dbd4
nop
lea rcx, [rsp + 0x30]
call fcn.140002b10
nop
mov rdx, qword [rsp + 0x158]
cmp rdx, 0x10
jb 0x14000915b
inc rdx
mov rcx, qword [rsp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009156
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009156
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001dbd4
xor ebx, ebx
mov qword [rsp + 0x150], rbx
mov qword [rsp + 0x158], SafeArrayPutElement
mov byte [rsp + 0x140], bl
mov rdx, qword [rsp + 0x178]
cmp rdx, 0x10
jb 0x1400091be
inc rdx
mov rcx, qword [rsp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400091b9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400091b9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001dbd4
mov qword [rsp + 0x170], rbx
mov qword [rsp + 0x178], SafeArrayPutElement
mov byte [rsp + 0x160], 0
mov rdx, qword [rsp + 0x198]
cmp rdx, 0x10
jb 0x140009220
inc rdx
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000921b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000921b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001dbd4
movdqa xmm0, xmmword [0x140021980]
movdqu xmmword [rsp + 0x190], xmm0
mov byte [rsp + 0x180], 0
lea rcx, [rsp + 0x58]
call fcn.140012050
nop
mov rax, qword [rsp + 0x1b8]
cmp rax, 0x10
jb 0x14000928b
lea rdx, [rax + 1]
mov rcx, qword [rsp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009286
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009286
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001dbd4
mov al, 1
jmp 0x140009401
lea rcx, [rsp + 0x58]
call fcn.140012070
jmp 0x1400092a8
lea rcx, [rsp + 0x58]
call fcn.140012070
mov ecx, 0x2b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, [rsp + 0xc0]
call fcn.140002a80
nop
lea rcx, [rsp + 0x100]
call fcn.140002a80
nop
lea rcx, [rsp + 0x120]
call fcn.140002a80
nop
lea rcx, [rsp + 0xa0]
call fcn.140002a80
nop
lea rcx, [rsp + 0xe0]
call fcn.140002a80
nop
lea rcx, [rsp + 0x30]
call fcn.140002b10
mov ecx, 0x2b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
cmp esi, dword [0x140030bd4]
jne 0x1400093dd
mov rdx, qword [rsp + 0x30]
add rdx, 0x20
cmp qword [rdx + 0x18], 0x10
jb 0x14000932f
mov rdx, qword [rdx]
mov qword [rsp + 0xc0], r15
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xd0], xmm0
inc rdi
cmp byte [rdx + rdi], 0
jne 0x140009343
mov r8, rdi
lea rcx, [rsp + 0xc0]
call fcn.1400018e0
nop
lea rax, [rsp + 0xc0]
cmp qword [rsp + 0xd8], 0x10
cmovae rax, qword [rsp + 0xc0]
movsx ecx, byte [rax]
sub ecx, 0x62
je 0x1400093c5
sub ecx, 3
je 0x1400093b7
sub ecx, 3
je 0x1400093a9
cmp ecx, 1
je 0x14000939b
lea rcx, [rsp + 0xc0]
jmp 0x1400092f4
lea rcx, str.INFO_:_Your_credentials_are_invalid_
call fcn.140013ef0
jmp 0x1400093d1
lea rcx, str.INFO_:_Your_HWID_does_not_match_
call fcn.140013ef0
jmp 0x1400093d1
lea rcx, str.INFO_:_Subscription_has_expired_
call fcn.140013ef0
jmp 0x1400093d1
lea rcx, str.INFO_:_Your_account_is_banned_from_this_application_
call fcn.140013ef0
mov ecx, 0x2b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
cmp esi, dword [0x140030bd8]
jne 0x1400092fa
lea rcx, str.ERROR_:_contact_with_dev_and_give_him_this_code_:_IT_error_
call fcn.140013ef0
mov ecx, 0x2b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14001df40
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
call fcn.140003570
call fcn.140003570
nop
lea rdx, str.cheatingNo_Action
lea rcx, [0x140030be0]
call fcn.140005870
call fcn.1400058d0
lea rdx, str.cheatingFound_Confirm
lea rcx, [0x140030be0]
call fcn.140005870
call fcn.1400058d0
nop
lea rcx, str.invalid_stoi_argument
call sub.MSVCP140.dll_void___cdecl_std::_Xinvalid_argument_char_const____ptr64_
lea rcx, str.stoi_argument_out_of_range
call sub.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const____ptr64_
nop
lea rcx, str.invalid_stoi_argument
call sub.MSVCP140.dll_void___cdecl_std::_Xinvalid_argument_char_const____ptr64_
lea rcx, str.stoi_argument_out_of_range
call sub.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const____ptr64_
int3