Function at 0x140007914
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Execute command
Log keystrokes via polling
Set console window title
Terminate process

Disassembly:
mov rax, rsp
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x238]
sub rsp, 0x2f8
lea rcx, [0x140072190]
movaps xmmword [rax - 0x58], xmm6
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
movdqa xmm0, xmmword [0x140072540]
xor r12d, r12d
movdqa xmm1, xmmword [0x140072560]
mov edx, r12d
movdqu xmmword [rbp - 0x80], xmm0
mov r14b, Ordinal_46
mov dword [rbp - 0x50], 0x372e732f
movdqa xmm0, xmmword [0x1400724e0]
movdqu xmmword [rbp - 0x60], xmm0
mov word [rbp - 0x4c], reloc.WS2_32.dll_recv
movdqu xmmword [rbp - 0x70], xmm1
movsxd rcx, edx
lea eax, [r14 + rdx]
inc edx
xor byte [rbp + rcx - 0x80], al
cmp edx, 0x35
jb 0x14000797f
lea rdx, [rbp - 0x80]
mov byte [rbp - 0x4b], r12b
lea rcx, [rbp + 0x1c0]
call fcn.14000983c
movdqa xmm0, xmmword [0x140072540]
xor eax, eax
movdqa xmm1, xmmword [0x140072560]
mov r15d, 8
movdqu xmmword [rbp - 0x80], xmm0
mov edx, r12d
mov dword [rbp - 0x50], 0x2f702e33
movdqa xmm0, xmmword [0x1400724b0]
movdqu xmmword [rbp - 0x60], xmm0
mov word [rbp - 0x4c], 0x1108
movdqu xmmword [rbp - 0x70], xmm1
mov byte [rbp - 0x4a], al
movsxd rcx, edx
lea eax, [r14 + rdx]
inc edx
xor byte [rbp + rcx - 0x80], al
cmp edx, 0x36
jb 0x1400079e7
lea rdx, [rbp - 0x80]
mov byte [rbp - 0x4a], r12b
lea rcx, [rbp + 0x1a0]
call fcn.14000983c
movdqa xmm0, xmmword [0x140072540]
mov edx, r12d
movdqa xmm1, xmmword [0x140072560]
movdqu xmmword [rbp - 0x80], xmm0
mov dword [rbp - 0x50], 0x3a3d3430
movdqa xmm0, xmmword [str.___:5__r_523x9_]
movdqu xmmword [rbp - 0x60], xmm0
mov dword [rbp - 0x4c], 0x4d07120e
movdqu xmmword [rbp - 0x70], xmm1
mov dword [rbp - 0x48], 0x160d14
movsxd rcx, edx
lea eax, [r14 + rdx]
inc edx
xor byte [rbp + rcx - 0x80], al
cmp edx, 0x3b
jb 0x140007a4c
lea rdx, [rbp - 0x80]
mov byte [rbp - 0x45], r12b
lea rcx, [rbp + 0x180]
call fcn.14000983c
movdqa xmm0, xmmword [0x140072540]
mov edx, r12d
movdqa xmm1, xmmword [0x140072560]
movdqu xmmword [rbp - 0x80], xmm0
mov dword [rbp - 0x50], 0x3a280237
movdqa xmm0, xmmword [0x1400724d0]
movdqu xmmword [rbp - 0x60], xmm0
mov dword [rbp - 0x4c], 0xc0b1212
movdqu xmmword [rbp - 0x70], xmm1
mov dword [rbp - 0x48], 0xf164b0a
mov word [rbp - 0x44], Ordinal_26
movsxd rcx, edx
lea eax, [r14 + rdx]
inc edx
xor byte [rbp + rcx - 0x80], al
cmp edx, 0x3d
jb 0x140007ab7
lea rdx, [rbp - 0x80]
mov byte [rbp - 0x43], r12b
lea rcx, [rbp + 0x160]
call fcn.14000983c
mov edx, r12d
mov word [rbp + 0x240], reloc.WLDAP32.dll_Ordinal_26
movsxd rcx, edx
lea eax, [r14 + rdx]
inc edx
xor byte [rbp + rcx + 0x240], al
cmp edx, 1
jb 0x140007ae9
lea rdx, [rbp + 0x240]
mov byte [rbp + 0x241], r12b
lea rcx, [rbp + 0x100]
call fcn.14000983c
mov edx, r12d
mov dword [rbp + 0x240], 0x5f5d585f
mov dword [rbp + 0x244], 0x565f55
movsxd rcx, edx
lea eax, [r14 + rdx]
inc edx
xor byte [rbp + rcx + 0x240], al
cmp edx, 7
jb 0x140007b2f
lea rdx, [rbp + 0x240]
mov byte [rbp + 0x247], r12b
lea rcx, [rbp + 0x140]
call fcn.14000983c
mov edx, r12d
mov dword [rbp + 0x240], 0x5d587e
mov ebx, 3
movsxd rcx, edx
lea eax, [r14 + rdx]
inc edx
xor byte [rbp + rcx + 0x240], al
cmp edx, ebx
jb 0x140007b70
lea rdx, [rbp + 0x240]
mov byte [rbp + 0x243], r12b
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_setlocale]
xor r9d, r9d
mov qword [rsp + 0x28], r12
lea r8, [0x140007894]
mov dword [rsp + 0x20], r12d
xor edx, edx
xor ecx, ecx
nop
nop
nop
nop
nop
nop
mov edx, r12d
mov dword [rbp + 0x240], 0x5d414f
movsxd rcx, edx
lea eax, [r14 + rdx]
inc edx
xor byte [rbp + rcx + 0x240], al
cmp edx, ebx
jb 0x140007bc5
lea rcx, [rbp + 0x240]
mov byte [rbp + 0x243], r12b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp + 0xa0]
call fcn.140003f58
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rbp + 0xa0]
call fcn.14000a374
mov rcx, rax
lea rdx, [0x14000a33c]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, r12d
mov dword [rbp + 0x240], 0x4b475a44
mov word [rbp + 0x244], reloc.WS2_32.dll_listen
movsxd rcx, edx
lea eax, [r14 + rdx]
inc edx
xor byte [rbp + rcx + 0x240], al
cmp edx, 5
jb 0x140007c32
lea rdx, [rbp + 0x240]
mov byte [rbp + 0x245], r12b
lea rcx, [rbp - 0x30]
call fcn.14000983c
lea rdx, [rbp + 0xa0]
lea rcx, [rbp - 0x30]
call fcn.140009798
lea rbx, [0x1400720e8]
mov sil, r12b
mov rdx, rbx
lea rcx, [rbp + 0x80]
call fcn.14000983c
mov rdx, rbx
lea rcx, [rbp + 0xe0]
call fcn.14000983c
mov rdx, rbx
lea rcx, [rbp + 0xc0]
call fcn.14000983c
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x10]
call fcn.140009874
lea rdx, [rbp + 0x1c0]
mov rbx, rax
lea rcx, [rbp + 0x120]
call fcn.140009874
mov rdx, rax
lea rcx, [rsp + 0x50]
mov r8, rbx
call fcn.1400047dc
mov rcx, rax
call fcn.140009f88
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.14000983c
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x10]
call fcn.1400042f8
lea rcx, [rsp + 0x30]
call fcn.140009c2c
lea rcx, [rsp + 0x50]
call fcn.140009c2c
mov edi, r12d
cmp qword [rbp], r12
jbe 0x140007d61
mov rbx, r12
lea rcx, [rbp - 0x10]
call fcn.140009f88
cmp byte [rax + rbx], 0x5f
jne 0x140007d2f
mov sil, 1
jmp 0x140007d53
lea rcx, [rbp - 0x10]
call fcn.140009f88
lea rcx, [rbp + 0xe0]
mov dl, byte [rax + rbx]
test sil, sil
je 0x140007d4e
lea rcx, [rbp + 0xc0]
call fcn.140009c9c
inc edi
inc rbx
movsxd rax, edi
cmp rax, qword [rbp]
jb 0x140007d1b
lea rcx, [rbp + 0xe0]
call fcn.140009f88
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
jmp 0x140007d97
xor edx, edx
lea rcx, [rbp - 0x30]
call fcn.140009c88
xor eax, eax
mov dword [rsp + 0x70], 0x5c5c485a
mov byte [rsp + 0x78], al
mov edx, r12d
mov dword [rsp + 0x74], 0xe5c5e59
movsxd rcx, edx
lea eax, [r14 + rdx]
inc edx
xor byte [rsp + rcx + 0x70], al
cmp edx, r15d
jb 0x140007dbb
or rdi, 0xffffffffffffffff
mov byte [rsp + 0x78], r12b
mov r8, rdi
lea rax, [rsp + 0x70]
inc r8
cmp byte [rax + r8], r12b
jne 0x140007dde
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x30]
call fcn.140009e28
lea rdx, [rbp + 0x100]
lea rcx, [rbp - 0x30]
call fcn.140009798
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x120]
call fcn.140009874
lea rdx, [rbp + 0x160]
mov rbx, rax
lea rcx, [rbp - 0x80]
call fcn.140009874
mov rdx, rax
lea rcx, [rbp + 0x10]
mov r8, rbx
call fcn.1400047dc
mov rcx, rax
call fcn.140009f88
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.14000983c
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.1400042f8
mov rdx, rax
lea rcx, [rbp - 0x10]
call fcn.1400097b4
lea rcx, [rsp + 0x50]
call fcn.140009c2c
lea rcx, [rsp + 0x30]
call fcn.140009c2c
lea rcx, [rbp + 0x10]
call fcn.140009c2c
lea rcx, [rbp + 0x140]
call fcn.140009f88
lea rcx, [rbp - 0x10]
mov rbx, rax
call fcn.140009f88
sub rbx, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + rbx]
sub edx, ecx
jne 0x140007eb1
inc rax
test ecx, ecx
jne 0x140007e9f
nop
nop
jmp 0x140007f08
lea rcx, [rbp + 0x100]
call fcn.140009f88
lea rcx, [rbp - 0x10]
mov rbx, rax
call fcn.140009f88
sub rbx, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + rbx]
sub edx, ecx
jne 0x140007f35
inc rax
test ecx, ecx
jne 0x140007f23
nop
nop
jmp 0x140007f96
lea rcx, [rbp + 0xc0]
call fcn.140009f88
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov ecx, eax
cmp eax, 0x15180
jg 0x140007fbb
mov ebx, 1
jmp 0x140007fd0
mov eax, 0xc22e4507
imul ecx
add edx, ecx
sar edx, 0x10
mov ebx, edx
shr ebx, 0x1f
inc ebx
add ebx, edx
lea rcx, [rbp - 0x10]
call fcn.140009f88
movdqa xmm0, xmmword [0x140072420]
mov r8, rax
xor eax, eax
mov dword [rsp + 0x40], 0x354d181c
mov byte [rsp + 0x44], al
mov edx, r12d
movdqu xmmword [rsp + 0x30], xmm0
movsxd rcx, edx
lea eax, [r14 + rdx]
inc edx
xor byte [rsp + rcx + 0x30], al
cmp edx, 0x14
jb 0x140007ffb
mov rdx, r8
mov byte [rsp + 0x44], r12b
lea rcx, [rsp + 0x30]
call fcn.140002928
movdqa xmm0, xmmword [0x140072410]
mov edx, r12d
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0x3557181c
mov dword [rsp + 0x44], 0x49484b4a
mov word [rsp + 0x48], Ordinal_79
movsxd rcx, edx
lea eax, [r14 + rdx]
inc edx
xor byte [rsp + rcx + 0x30], al
cmp edx, 0x19
jb 0x140008047
mov edx, ebx
mov byte [rsp + 0x49], r12b
lea rcx, [rsp + 0x30]
call fcn.140002928
call fcn.14000768c
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x14000a33c]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
movdqa xmm0, xmmword [0x140072400]
mov edx, r12d
movdqu xmmword [rbp + 0x10], xmm0
movsxd rcx, edx
lea eax, [r14 + rdx]
inc edx
xor byte [rbp + rcx + 0x10], al
cmp edx, 0xf
jb 0x140008093
lea rcx, [rbp + 0x10]
mov byte [rbp + 0x1f], r12b
call fcn.140002928
mov r13d, 0x5b6f
jmp 0x1400080c5
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x5b5f5b6f
mov dword [rsp + 0x54], 0x5b6a5b57
mov dword [rsp + 0x58], 0x5b765b7e
mov dword [rsp + 0x5c], 0x5b7d5b7b
mov dword [rsp + 0x60], 0x5b71
call fcn.140009450
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x1400080ba
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x14000a33c]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x5b5f5b6f
mov dword [rsp + 0x54], 0x5b6a5b57
mov dword [rsp + 0x58], 0x5b765b7e
mov dword [rsp + 0x5c], 0x5b7d5b7b
mov dword [rsp + 0x60], 0x5b71
call fcn.140009450
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x5b4c5b6b
mov qword [0x1405bdc60], rax
xor eax, eax
mov word [rsp + 0x4c], ax
mov dword [rsp + 0x34], 0x5b4a5b43
mov dword [rsp + 0x38], 0x5b545b73
mov dword [rsp + 0x3c], 0x5b475b5c
mov dword [rsp + 0x40], 0x5b475b51
mov dword [rsp + 0x44], 0x5b525b18
mov dword [rsp + 0x48], 0x5b5c5b40
call fcn.140008ce4
mov rcx, rax
call fcn.140002edc
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x14000a33c]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
cmp qword [0x1405bdc60], r12
je 0x140008c22
xor eax, eax
mov dword [rsp + 0x50], 0x5b4c5b6b
mov word [rsp + 0x60], ax
mov dword [rsp + 0x54], 0x5b4a5b43
mov dword [rsp + 0x58], 0x5b545b1e
mov dword [rsp + 0x5c], 0x5b565b4a
call fcn.140003810
lea rcx, [rsp + 0x50]
mov rbx, rax
call fcn.140009428
mov rcx, rax
call fcn.140002f88
mov dword [rbx], eax
mov edx, 9
mov rbx, qword [0x1405bdc60]
mov rcx, rbx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetForegroundWindow]
lea rcx, [rbp - 0x80]
call fcn.140005448
lea r8, [0x1405bdc60]
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x240]
call fcn.14000a674
mov rdx, rax
lea rcx, [0x1405bdce0]
call fcn.14000a6b4
lea rcx, [rbp + 0x240]
call fcn.140008d0c
mov ebx, 0x5b5f
lea edi, [rbx - 8]
lea esi, [rbx + 0xb]
lea r14d, [rbx + 0x1f]
lea r15d, [rbx + 0x17]
jmp 0x1400086cf
mov rcx, qword [0x1405bdce0]
call fcn.140005ee4
mov ecx, reloc.WS2_32.dll_WSASetLastError
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400082b3
cmp dword [0x1405bdc70], r12d
mov eax, r12d
sete al
mov dword [0x1405bdc70], eax
call fcn.1400067dc
movss xmm6, dword [0x1400723c8]
lea rcx, [0x1405bdc78]
and dword [rbp + 0x240], 0
xorps xmm0, xmm0
and dword [rbp - 0x40], 0
and dword [rbp - 0x3c], 0
and dword [rbp - 0x38], 0
movups xmmword [rsp + 0x30], xmm0
call fcn.140008d38
call fcn.140005438
mov qword [rbp + 0x48], rax
test rax, rax
je 0x140008689
call fcn.1400053e4
mov rdi, rax
test rax, rax
je 0x140008684
call fcn.140005318
mov rsi, rax
test rax, rax
je 0x14000867f
call fcn.140004de0
mov r15, rax
test rax, rax
je 0x140008679
call fcn.140003810
mov rcx, rax
lea r8, [rbp + 0x38]
mov r9d, 8
lea rdx, [rdi + 0x4e0]
call fcn.140003728
mov r13, qword [rbp + 0x38]
test r13, r13
je 0x14000866f
mov rcx, rdi
call fcn.1400053f4
test eax, eax
je 0x14000866f
mov edx, eax
mov rcx, r13
call fcn.140005130
mov r14, rax
test rax, rax
je 0x140008669
mov rcx, rax
call fcn.1400050e0
test al, al
je 0x140008669
mov rcx, r14
call fcn.1400050c0
test eax, eax
je 0x140008669
mov edx, eax
mov rcx, rsi
call fcn.140005328
test rax, rax
je 0x140008669
lea r12, [rax + 0x28]
xor esi, esi
test r12, r12
je 0x140008666
cmp dword [0x1405bdc70], esi
je 0x1400083cf
mov rcx, r12
call fcn.140006a50
lea rdx, [0x1405bdc78]
mov rcx, r13
call fcn.1400051e8
mov rax, qword [0x1405bdc80]
mov rdi, qword [0x1405bdc78]
mov qword [rsp + 0x70], rax
cmp rdi, rax
je 0x14000865a
mov edx, dword [rdi + 8]
mov rcx, r13
call fcn.140005130
mov rbx, rax
test rax, rax
je 0x14000864b
cmp rax, r14
je 0x14000864b
mov rdx, r14
mov rcx, rax
call fcn.140007468
test eax, eax
je 0x14000864b
mov rcx, rbx
call fcn.1400050e0
test al, al
je 0x14000864b
call fcn.140003810
mov rcx, rax
lea r8, [rbp + 0x40]
mov r9d, 8
lea rdx, [rbx + 0x10]
call fcn.140003728
mov rsi, qword [rbp + 0x40]
xor ebx, ebx
test rsi, rsi
je 0x140008649
lea ecx, [rbx + 0x73]
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
je 0x140008494
movaps xmm0, xmmword [0x140072510]
lea r8, [rsp + 0x50]
xorps xmm3, xmm3
movaps xmmword [rsp + 0x50], xmm0
mov rdx, r15
mov rcx, rsi
call fcn.140006dd4
mov ecx, WSAStartup
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
je 0x1400084c8
lea rdx, [rbp + 0x10]
mov rcx, rsi
call fcn.140005060
lea rcx, [rbp + 0x50]
movsd xmm0, qword [rax]
mov eax, dword [rax + 8]
movsd qword [rbp + 0x50], xmm0
mov dword [rbp + 0x58], eax
call fcn.14000731c
mov ecx, WSAStartup
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
je 0x1400084f4
movaps xmm0, xmmword [0x140072520]
lea r8, [rsp + 0x50]
mov rdx, r15
movaps xmmword [rsp + 0x50], xmm0
mov rcx, rsi
call fcn.1400070c8
cmp dword [0x1405bdc70], ebx
je 0x140008649
mov rbx, qword [rbp + 0x48]
add rbx, 0x6c0
call fcn.140003810
mov rcx, rax
lea r8, [rbp + 0x248]
mov r9d, 4
mov rdx, rbx
call fcn.140003728
cmp dword [rbp + 0x248], 3
mov eax, 0x24
lea ecx, [rax - 0x19]
cmove eax, ecx
mov dword [rsp + 0x30], eax
call fcn.140003810
mov rcx, rax
lea r8, [rbp + 0x250]
mov r9d, 4
mov rdx, rbx
call fcn.140003728
cmp dword [rbp + 0x250], 3
mov eax, Ordinal_33
lea ecx, [rax - 0x15]
cmove eax, ecx
mov dword [rsp + 0x34], eax
call fcn.140003810
mov rcx, rax
lea r8, [rbp + 0x258]
mov r9d, 4
mov rdx, rbx
call fcn.140003728
mov eax, Ordinal_26
lea ecx, [rax - 0x16]
cmp dword [rbp + 0x258], ecx
cmove eax, ecx
mov dword [rsp + 0x38], eax
call fcn.140003810
mov rcx, rax
lea r8, [rbp + 0x30]
mov r9d, 4
mov rdx, rbx
call fcn.140003728
lea rax, [rbp + 0x240]
mov dword [rsp + 0x3c], 1
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x30]
lea rax, [rbp - 0x40]
mov dword [rsp + 0x40], reloc.WS2_32.dll_recvfrom
mov r9d, listen
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov rcx, r15
call fcn.1400074ac
test al, al
je 0x140008649
movsd xmm0, qword [rbp - 0x40]
lea rdx, [rbp + 0x60]
mov eax, dword [rbp - 0x38]
mov rcx, r15
movsd qword [rbp + 0x60], xmm0
mov dword [rbp + 0x68], eax
call fcn.140006b10
test al, al
je 0x140008649
comiss xmm6, dword [rbp + 0x240]
jbe 0x140008649
movsd xmm0, qword [rbp - 0x40]
lea rdx, [rbp + 0x70]
mov eax, dword [rbp - 0x38]
mov rcx, r12
movsd qword [rbp + 0x70], xmm0
mov dword [rbp + 0x78], eax
call fcn.140006aa8
movss xmm6, dword [rbp + 0x240]
xor esi, esi
add rdi, 0x10
cmp rdi, qword [rsp + 0x70]
jne 0x1400083fa
lea rcx, [0x1405bdc78]
call fcn.140008d38
xor r12d, r12d
mov r14d, 0x5b7e
mov r13d, 0x5b6f
lea ebx, [r13 - 0x10]
mov r15d, 0x5b76
mov esi, 0x5b6a
mov edi, 0x5b57
mov rcx, qword [0x1405bdce0]
call fcn.140005f10
mov ecx, reloc.WLDAP32.dll_Ordinal_35
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x1400086c4
mov rcx, qword [0x1405bdce0]
call fcn.1400065cc
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x5b5f5b6f
mov dword [rsp + 0x54], 0x5b6a5b57
mov dword [rsp + 0x58], 0x5b765b7e
mov dword [rsp + 0x5c], 0x5b7d5b7b
mov dword [rsp + 0x60], 0x5b71
call fcn.140009450
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x140008285
lea rcx, [rbp - 0x80]
call fcn.14000569c
jmp 0x140008c22
mov rcx, qword [0x1405bdce0]
call fcn.1400065cc
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x10]
call fcn.140009c2c
lea rcx, [rbp + 0xc0]
call fcn.140009c2c
lea rcx, [rbp + 0xe0]
call fcn.140009c2c
lea rcx, [rbp + 0x80]
call fcn.140009c2c
lea rcx, [rbp - 0x30]
call fcn.140009c2c
lea rcx, [rbp + 0xa0]
call fcn.140009c2c
lea rcx, [rbp + 0x140]
call fcn.140009c2c
lea rcx, [rbp + 0x100]
call fcn.140009c2c
lea rcx, [rbp + 0x160]
call fcn.140009c2c
lea rcx, [rbp + 0x180]
call fcn.140009c2c
lea rcx, [rbp + 0x1a0]
call fcn.140009c2c
lea rcx, [rbp + 0x1c0]
call fcn.140009c2c
movaps xmm6, xmmword [rsp + 0x2e0]
xor eax, eax
add rsp, 0x2f8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret