Function at 0x140006910
Capabilities:
Create process on windows
Create process suspended
Execute command
Resume thread
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x628]
sub rsp, 0x710
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
mov rax, qword [0x140099718]
xor rax, rsp
mov qword [rbp + 0x5e0], rax
xor r12d, r12d
mov dword [rsp + 0x50], r12d
lea rcx, [rbp + 0x3e8]
call fcn.140004a40
nop
movzx eax, byte [rbp + 0x408]
test al, al
jne 0x140006977
mov ebx, r12d
jmp 0x140007dca
call fcn.1400769bc
lea rcx, str.bocchisr.dll
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], sendto
lea r8, [rsp + 0x60]
mov edx, eax
lea rcx, [rbp - 0x60]
call fcn.140001be0
nop
cmp byte [rbp + 0x408], 0
je 0x140007e59
lea r8, [rbp - 0x60]
lea rdx, [rbp + 0x3e8]
lea rcx, [rbp + 0x360]
call fcn.140002110
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x140006a0a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006a05
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006a05
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140077380
movdqa xmm0, xmmword [0x14008c7f0]
movdqu xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x60], r12w
lea rax, [rbp + 0x360]
cmp qword [rbp + 0x378], 8
cmovae rax, qword [rbp + 0x360]
mov qword [rsp + 0x60], rax
mov rax, qword [rbp + 0x370]
mov qword [rsp + 0x68], rax
call fcn.1400769bc
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
lea r8, [rsp + 0x60]
mov edx, eax
lea rcx, [rbp - 0x80]
call fcn.140014c70
mov dword [rsp + 0x50], 0x3b0
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x3a0]
call fcn.140004cb0
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x140006abb
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006ab6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006ab6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140077380
movdqa xmm0, xmmword [0x14008c800]
movdqu xmmword [rbp - 0x70], xmm0
mov byte [rbp - 0x80], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x490], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x4a0], xmm1
mov r8d, Ordinal_41
lea rdx, str.SELECT_ProcessorId_FROM_Win32_Processor
lea rcx, [rbp + 0x490]
call fcn.14000b560
nop
lea rax, [rbp - 0x80]
mov qword [rbp - 0x20], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], r12
mov r8d, recv
lea rdx, str.ProcessorId
lea rcx, [rbp - 0x80]
call fcn.14000b560
nop
lea rdx, [rbp + 0x490]
lea rcx, [rbp - 0x40]
call fcn.140009450
nop
lea r8, [rbp - 0x80]
mov rdx, rax
lea rcx, [rbp + 0x5a0]
call fcn.140003000
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x470], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x480], xmm1
mov r8d, Ordinal_45
lea rdx, str.SELECT_SerialNumber_FROM_Win32_PhysicalMedia
lea rcx, [rbp + 0x470]
call fcn.14000b560
nop
lea rax, [rbp - 0x80]
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], r12
mov r8d, recv
lea rdx, str.SerialNumber
lea rcx, [rbp - 0x80]
call fcn.14000b560
nop
lea rdx, [rbp + 0x470]
lea rcx, [rbp - 0x40]
call fcn.140009450
nop
lea r8, [rbp - 0x80]
mov rdx, rax
lea rcx, [rbp + 0x560]
call fcn.140003000
nop
mov rdx, qword [rbp + 0x5a0]
cmp rdx, qword [rbp + 0x5a8]
jne 0x140006c0e
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x50], xmm1
xor r8d, r8d
lea rdx, [0x14008a1dc]
lea rcx, [rbp - 0x60]
call fcn.14000b560
lea rax, [rbp - 0x60]
mov ebx, 0x3b1
jmp 0x140006c1d
lea rcx, [rsp + 0x60]
call fcn.140009450
mov ebx, 0x3b2
mov dword [rsp + 0x50], ebx
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x450], xmm0
movups xmm7, xmmword [rax + 0x10]
movups xmmword [rbp + 0x460], xmm7
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
test bl, 2
je 0x140006cab
and ebx, 0xfffffffd
mov dword [rsp + 0x50], ebx
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140006c97
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006c92
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006c92
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140077380
movdqa xmm0, xmmword [0x14008c7f0]
movdqu xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x60], r12w
test bl, 1
je 0x140006cfa
and ebx, 0xfffffffe
mov dword [rsp + 0x50], ebx
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x140006cfa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006cf5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006cf5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140077380
mov rdx, qword [rbp + 0x560]
cmp rdx, qword [rbp + 0x568]
jne 0x140006d35
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x70], xmm1
xor r8d, r8d
lea rdx, [0x14008a1dc]
lea rcx, [rbp - 0x80]
call fcn.14000b560
lea rax, [rbp - 0x80]
or ebx, 4
jmp 0x140006d41
lea rcx, [rbp - 0x40]
call fcn.140009450
or ebx, 8
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x430], xmm0
movups xmm6, xmmword [rax + 0x10]
movups xmmword [rbp + 0x440], xmm6
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
test bl, 8
je 0x140006dc3
and ebx, 0xfffffff7
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x140006db1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006dac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006dac
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140077380
movdqa xmm0, xmmword [0x14008c7f0]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x40], r12w
test bl, 4
je 0x140006e0e
and ebx, 0xfffffffb
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x140006e0e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006e09
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006e09
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140077380
movabs rax, 0x7ffffffffffffffe
movq rcx, xmm7
sub rax, rcx
movq rdx, xmm6
cmp rax, rdx
jb 0x140007e5f
lea r9, [rbp + 0x450]
cmp qword [rbp + 0x468], 8
cmovae r9, qword [rbp + 0x450]
lea rax, [rbp + 0x430]
cmp qword [rbp + 0x448], 8
cmovae rax, qword [rbp + 0x430]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0x4b0]
call fcn.14000cda0
bts ebx, 0xa
lea rdx, [rbp + 0x4b0]
lea rcx, [rbp + 0x380]
call fcn.140005d50
nop
lea rdx, [rbp + 0x380]
cmp qword [rbp + 0x398], 8
cmovae rdx, qword [rbp + 0x380]
mov rax, qword [rbp + 0x390]
lea r15, [rdx + rax*2]
lea rsi, [rbp + 0x380]
cmovae rsi, qword [rbp + 0x380]
xorps xmm0, xmm0
movups xmmword [rbp + 0x320], xmm0
mov r14, 0xffffffffffffffff
cmp rsi, r15
jne 0x140006ef4
mov qword [rbp + 0x330], r12
mov qword [rbp + 0x338], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x320], 0
jmp 0x140007017
mov rax, r15
sub rax, rsi
sar rax, 1
mov rdx, r12
mov qword [rbp + 0x330], rdx
mov edi, reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x338], rdi
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
ja 0x140007e65
cmp rax, 0x10
jb 0x140006fc0
mov rdi, rax
or rdi, 0xf
cmp rdi, rcx
jbe 0x140006f41
mov rdi, rcx
jmp 0x140006f4d
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmp rdi, rax
cmovb rdi, rax
mov rcx, rdi
add rcx, 1
cmovb rcx, r14
cmp rcx, 0x1000
jb 0x140006f97
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140007e6b
mov rcx, rax
call fcn.140077624
mov rcx, rax
test rax, rax
je 0x140007aec
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
mov rdx, qword [rbp + 0x330]
jmp 0x140006fad
test rcx, rcx
je 0x140006faa
call fcn.140077624
mov rdx, qword [rbp + 0x330]
jmp 0x140006fad
mov rax, r12
mov qword [rbp + 0x320], rax
mov qword [rbp + 0x338], rdi
nop dword [rax + rax]
lea rcx, [rbp + 0x320]
cmp rdi, 0x10
cmovae rcx, qword [rbp + 0x320]
movzx eax, byte [rsi]
mov byte [rdx + rcx], al
mov rdx, qword [rbp + 0x330]
inc rdx
mov qword [rbp + 0x330], rdx
add rsi, 2
cmp rsi, r15
je 0x140006ffc
mov rdi, qword [rbp + 0x338]
jmp 0x140006fc0
lea rax, [rbp + 0x320]
cmp qword [rbp + 0x338], 0x10
cmovae rax, qword [rbp + 0x320]
mov byte [rdx + rax], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x4d0], xmm0
movdqa xmm1, xmmword [0x14008c800]
movdqu xmmword [rbp + 0x4e0], xmm1
mov byte [rbp + 0x4d0], 0
lea rcx, [rbp + 0x320]
call fcn.140005180
test al, al
jne 0x140007103
lea rdx, str.Hwid_Is_Not_Registered_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000aaf0
lea rdx, [0x14000acc0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.to_add_your_hwid_join_bocchi_discord_server_and_add_your_hwid_to_bot
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000aaf0
lea rdx, [0x14000acc0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Your_Hwid:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000aaf0
lea rdx, [rbp + 0x320]
cmp qword [rbp + 0x338], 0x10
cmovae rdx, qword [rbp + 0x320]
mov r8, qword [rbp + 0x330]
mov rcx, rax
call fcn.140010500
lea rdx, [0x14000acc0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.please_copy_hwid_and_paste_inside_the_bot_register_form___bot_name_xxXBocchiXxx6024___only_can_use_inside_bocchi_discord
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000aaf0
lea rdx, [0x14000acc0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140007aa4
mov r8, qword [rbp + 0x3b0]
test r8, r8
je 0x140007a1b
lea rcx, [rbp + 0x3a0]
cmp qword [rbp + 0x3b8], 0x10
cmovae rcx, qword [rbp + 0x3a0]
cmp r8, 0x20
jne 0x140007a1b
lea rdx, str.a9b2a0fffc5a0aaaa31191d233d055ce
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140007a1b
lea rdx, str.Valid_BocchiSR
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000aaf0
lea rdx, [0x14000acc0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp + 0x360]
call fcn.1400029c0
test al, al
jne 0x140007187
lea rdx, str.DLL_not_found
jmp 0x1400070e2
xorps xmm0, xmm0
movups xmmword [rbp + 0x340], xmm0
mov qword [rbp + 0x350], r12
mov qword [rbp + 0x358], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x340], 0
call fcn.1400769bc
lea rcx, str.config.txt
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], 0xa
lea r8, [rsp + 0x60]
mov edx, eax
lea rcx, [rbp - 0x60]
call fcn.140001be0
or ebx, 0x3000
cmp byte [rbp + 0x408], 0
je 0x140007e53
lea r8, [rbp - 0x60]
lea rdx, [rbp + 0x3e8]
lea rcx, [rbp + 0x410]
call fcn.140002110
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x140007242
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000723d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000723d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140077380
movdqa xmm0, xmmword [0x14008c7f0]
movdqu xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x60], r12w
lea rcx, [rbp + 0x410]
call fcn.1400029c0
test al, al
jne 0x140007362
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x100]
call sub.VCRUNTIME140.dll_memset
mov r8d, 8
lea rcx, [rbp + 0x100]
call fcn.140007f40
nop
mov rax, qword [rbp + 0x100]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x100]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator__void_const___ptr64]
test al, al
je 0x1400072e8
lea rdx, str.Error:_Unable_to_create_settings_file.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000aaf0
lea rdx, [0x14000acc0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rcx, [rbp + 0x100]
call fcn.140007e80
mov ebx, 1
jmp 0x14000795b
lea rdx, [rbp + 0x340]
cmp qword [rbp + 0x358], 0x10
cmovae rdx, qword [rbp + 0x340]
mov r8, qword [rbp + 0x350]
lea rcx, [rbp + 0x100]
call fcn.140010500
lea rdx, [0x14000acc0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp + 0x108]
call fcn.140009b40
test rax, rax
jne 0x140007356
mov rax, qword [rbp + 0x100]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x100]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
lea rcx, [rbp + 0x100]
call fcn.140007e80
lea rdx, [rbp + 0x410]
lea rcx, [rbp + 0x3c0]
call fcn.1400045c0
nop
cmp byte [rbp + 0x3e0], 0
jne 0x1400073b4
lea rdx, str.Failed_reading_config.txt
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000aaf0
lea rdx, [0x14000acc0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
jmp 0x1400078f4
lea rax, [0x14008c7a0]
mov qword [rbp], rax
lea rax, [0x14008c5f8]
mov qword [rbp + 0x10], rax
lea rcx, [rbp + 0x98]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
bts ebx, 0xe
mov dword [rsp + 0x50], ebx
xor r8d, r8d
lea rdx, [rbp + 0x18]
lea rcx, [rbp]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_iostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64____ptr64]
nop
mov rax, qword [rbp]
movsxd rcx, dword [rax + 4]
lea rbx, vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx], rbx
mov rax, qword [rbp]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx - 4], edx
lea rax, [rbp + 0x18]
mov qword [rsp + 0x60], rax
lea rcx, [rbp + 0x18]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
lea rax, vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + 0x18], rax
lea rdx, [rbp + 0x3c0]
cmp qword [rbp + 0x3d8], 0x10
cmovae rdx, qword [rbp + 0x3c0]
xor r9d, r9d
mov r8, qword [rbp + 0x3d0]
lea rcx, [rbp + 0x18]
call fcn.14000a2f0
nop
mov rax, qword [rbp]
movsxd rcx, dword [rax + 4]
lea rax, [rbp]
add rcx, rax
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
movzx r8d, al
lea rdx, [rbp + 0x340]
lea rcx, [rbp]
call fcn.140010870
nop
mov rax, qword [rbp]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx], rbx
mov rax, qword [rbp]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx - 4], edx
lea rcx, [rbp + 0x18]
call fcn.140009310
lea rcx, [rbp + 0x20]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_iostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x98]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
mov rdi, qword [rbp + 0x350]
lea rbx, [rbp + 0x340]
cmp qword [rbp + 0x358], 0x10
cmovae rbx, qword [rbp + 0x340]
call fcn.1400769bc
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rdi
lea r8, [rsp + 0x60]
mov edx, eax
lea rcx, [rbp - 0x40]
call fcn.140001be0
nop
lea rcx, [rbp - 0x40]
call fcn.1400029c0
movzx ebx, al
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x14000755a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007555
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007555
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140077380
test bl, bl
jne 0x14000777f
lea rdx, str.File_path_in_config.txt_invalid
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000aaf0
lea rdx, [0x14000acc0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Please_select_your_Game_Executable
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000aaf0
lea rdx, [0x14000acc0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor edx, edx
mov r8d, 0x103
lea rcx, [rbp + 0x101]
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
movups xmmword [rbp + 0x50], xmm0
movups xmmword [rbp + 0x60], xmm0
movups xmmword [rbp + 0x70], xmm0
movups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], rax
mov dword [rbp], 0x98
lea rax, [rbp + 0x100]
mov qword [rbp + 0x30], rax
mov byte [rbp + 0x100], bl
mov qword [rbp + 8], r12
mov dword [rbp + 0x38], 0x104
lea rax, str.Executable_Files__.exe_
mov qword [rbp + 0x18], rax
mov ebx, 1
mov dword [rbp + 0x2c], ebx
lea rax, str.Select_Executable_File
mov qword [rbp + 0x58], rax
mov dword [rbp + 0x60], 0x1808
lea rcx, [rbp]
call qword [sym.imp.COMDLG32.dll_GetOpenFileNameA]
test eax, eax
jne 0x14000766d
lea rdx, str.Error:_Unable_to_open_file_dialog.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000aaf0
lea rdx, [0x14000acc0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400078f7
mov rdx, qword [rbp + 0x30]
inc r14
cmp byte [rdx + r14], 0
jne 0x140007671
mov r8, r14
lea rcx, [rbp + 0x340]
call fcn.14000a450
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x210]
call sub.VCRUNTIME140.dll_memset
mov r8d, 2
lea rcx, [rbp + 0x210]
call fcn.140007f40
nop
mov rax, qword [rbp + 0x210]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x210]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator__void_const___ptr64]
test al, al
je 0x140007705
lea rdx, str.Error:_Unable_to_open_settings_file.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000aaf0
lea rdx, [0x14000acc0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rcx, [rbp + 0x210]
call fcn.140007e80
jmp 0x1400078f7
lea rdx, [rbp + 0x340]
cmp qword [rbp + 0x358], 0x10
cmovae rdx, qword [rbp + 0x340]
mov r8, qword [rbp + 0x350]
lea rcx, [rbp + 0x210]
call fcn.140010500
lea rdx, [0x14000acc0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp + 0x218]
call fcn.140009b40
test rax, rax
jne 0x140007773
mov rax, qword [rbp + 0x210]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x210]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
lea rcx, [rbp + 0x210]
call fcn.140007e80
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], rax
xorps xmm1, xmm1
movups xmmword [rbp + 0x4f0], xmm1
movups xmmword [rbp + 0x500], xmm1
movups xmmword [rbp + 0x510], xmm1
movups xmmword [rbp + 0x520], xmm1
movups xmmword [rbp + 0x530], xmm1
movups xmmword [rbp + 0x540], xmm1
mov qword [rbp + 0x550], rax
lea rcx, [rbp + 0x340]
cmp qword [rbp + 0x358], 0x10
cmovae rcx, qword [rbp + 0x340]
lea rax, [rbp - 0x18]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x4f0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
lea rax, [rbp + 0x360]
cmp qword [rbp + 0x378], 8
cmovae rax, qword [rbp + 0x360]
mov qword [rsp + 0x60], rax
mov rax, qword [rbp + 0x370]
mov qword [rsp + 0x68], rax
call fcn.1400769bc
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
lea r8, [rsp + 0x60]
mov edx, eax
lea rcx, [rbp - 0x40]
call fcn.140014c70
nop
lea rdx, [rbp - 0x40]
mov rcx, qword [rbp - 0x18]
call fcn.140004390
movzx ebx, al
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x1400078a8
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400078a3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400078a3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140077380
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test bl, bl
lea rdx, str.LoadLibrary_Success_
jne 0x1400078c1
lea rdx, str.LoadLibrary_Failed_
call fcn.14000aaf0
lea rdx, [0x14000acc0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, r12d
cmp byte [rbp + 0x3e0], 0
je 0x14000795b
mov rdx, qword [rbp + 0x3d8]
cmp rdx, 0x10
jb 0x140007944
inc rdx
mov rcx, qword [rbp + 0x3c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000793f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000793f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140077380
movdqa xmm0, xmmword [0x14008c800]
movdqu xmmword [rbp + 0x3d0], xmm0
mov byte [rbp + 0x3c0], 0
mov rdx, qword [rbp + 0x428]
cmp rdx, 8
jb 0x1400079a4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x410]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000799f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000799f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140077380
movdqa xmm0, xmmword [0x14008c7f0]
movdqu xmmword [rbp + 0x420], xmm0
mov word [rbp + 0x410], r12w
mov rdx, qword [rbp + 0x358]
cmp rdx, 0x10
jb 0x1400079fd
inc rdx
mov rcx, qword [rbp + 0x340]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400079f8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007af3
call fcn.140077380
mov qword [rbp + 0x350], r12
mov qword [rbp + 0x358], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x340], 0
jmp 0x140007ab4
lea rdx, str.This_Is_Not_BocchiSR_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000aaf0
lea rdx, [0x14000acc0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Opening_Virus_Link____
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000aaf0
lea rdx, [0x14000acc0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call fcn.140005f60
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x140007aa4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
cmp rdx, 0x1000
jb 0x140007a9f
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140007af3
mov rcx, r8
call fcn.140077380
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ebx, r12d
mov rdx, qword [rbp + 0x338]
cmp rdx, 0x10
jb 0x140007aff
inc rdx
mov rcx, qword [rbp + 0x320]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007afa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007afa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140077380
mov qword [rbp + 0x330], r12
mov qword [rbp + 0x338], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x320], 0
mov rdx, qword [rbp + 0x398]
cmp rdx, 8
jb 0x140007b61
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x380]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007b5c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007b5c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140077380
movdqa xmm0, xmmword [0x14008c7f0]
movdqu xmmword [rbp + 0x390], xmm0
mov word [rbp + 0x380], r12w
mov rdx, qword [rbp + 0x4c8]
cmp rdx, 8
jb 0x140007bc3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x4b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007bbd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007bbd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140077380
nop
mov rdx, qword [rbp + 0x448]
cmp rdx, 8
jb 0x140007c0d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x430]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007c07
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007c07
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140077380
nop
mov rdx, qword [rbp + 0x468]
cmp rdx, 8
jb 0x140007c57
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x450]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007c51
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007c51
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140077380
nop
lea rcx, [rbp + 0x560]
call fcn.1400042d0
nop
mov rdx, qword [rbp + 0x488]
cmp rdx, 8
jb 0x140007cae
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x470]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007ca8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007ca8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140077380
nop
lea rcx, [rbp + 0x5a0]
call fcn.1400042d0
nop
mov rdx, qword [rbp + 0x4a8]
cmp rdx, 8
jb 0x140007d05
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x490]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007cff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007cff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140077380
nop
mov rdx, qword [rbp + 0x3b8]
cmp rdx, 0x10
jb 0x140007d49
inc rdx
mov rcx, qword [rbp + 0x3a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007d44
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007d44
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140077380
mov qword [rbp + 0x3b0], r12
mov qword [rbp + 0x3b8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x3a0], 0
mov rdx, qword [rbp + 0x378]
cmp rdx, 8
jb 0x140007dab
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x360]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007da6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007da6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140077380
movdqa xmm0, xmmword [0x14008c7f0]
movdqu xmmword [rbp + 0x370], xmm0
mov word [rbp + 0x360], r12w
movzx eax, byte [rbp + 0x408]
test al, al
je 0x140007e17
mov rdx, qword [rbp + 0x400]
cmp rdx, 8
jb 0x140007e17
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x3e8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007e12
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007e12
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140077380
mov eax, ebx
mov rcx, qword [rbp + 0x5e0]
xor rcx, rsp
call fcn.140077360
lea r11, [rsp + 0x710]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.140001a90
nop
call fcn.140001a90
nop
call fcn.140001300
nop
call fcn.140001300
int3
call fcn.140001260
int3