Function at 0x140001d70
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x2550
call fcn.1400105a0
sub rsp, rax
mov rax, qword [0x140017040]
xor rax, rsp
mov qword [rsp + 0x2540], rax
mov r15, rcx
mov qword [rsp + 0x1c0], rcx
xor r14d, r14d
mov r12d, r14d
mov dword [rsp + 0x410], r14d
mov byte [rcx + 0x881], 1
lea rbx, [rcx + 0x880]
lea r13, [r14 - 1]
nop dword [rax]
mov qword [rsp + 0xb0], rbx
cmp byte [r15 + 0x881], 0
je 0x14000315f
lea rcx, [r15 + 8]
call fcn.14000aab0
test al, al
jne 0x140001e53
mov byte [rbx], al
movsxd rax, dword [r15 + 0x878]
cmp eax, 0xffffffff
je 0x140001e0a
mov rcx, rax
call qword [sym.imp.WS2_32.dll_closesocket]
mov byte [r15 + 0x87e], 0
mov dword [r15 + 0x878], r13d
xor edi, edi
mov word [r15 + 0x10], di
lea rcx, [r15 + 0x18]
lea r8, [0x140011748]
mov edx, 0x800
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
mov byte [r15 + 0x87e], dil
mov ecx, 0x3a98
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [r15]
mov rcx, r15
call qword [rax + reloc.WS2_32.dll_recv]
jmp 0x140001e55
xor edi, edi
cmp byte [rbx], 0
jne 0x140001e9e
call fcn.1400066c0
mov rbx, rax
call fcn.1400066c0
mov r9, rbx
mov r8, rax
lea rdx, str.USER__s__0_0_:_s_r_n
mov rcx, r15
call fcn.140003240
call fcn.1400066c0
mov r8, rax
lea rdx, str.NICK_:_s_r_n
mov rcx, r15
call fcn.140003240
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov r8d, 0x1ffe
lea rcx, [rsp + 0x541]
call sub.VCRUNTIME140.dll_memset
mov byte [rsp + 0x540], 0
mov sil, 1
lea rbx, [rsp + 0x540]
nop word [rax + rax]
movsxd rax, edi
lea rdx, [rsp + 0x540]
add rdx, rax
je 0x140001f24
test sil, sil
je 0x140001f24
lea rcx, [r15 + 8]
call fcn.14000adf0
test al, al
je 0x140003147
mov byte [rbx + 1], 0
movzx eax, byte [rbx]
cmp al, 0xa
je 0x140001f05
test al, al
jne 0x140001f17
cmp byte [rbx - 1], 0xd
jne 0x140001f11
mov byte [rbx - 1], 0
jmp 0x140001f14
mov byte [rbx], 0
xor sil, sil
inc edi
inc rbx
cmp edi, 0x1ffe
jl 0x140001ed0
mov byte [rsp + 0x253e], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x420], xmm0
movups xmmword [rsp + 0x430], xmm0
movups xmmword [rsp + 0x440], xmm0
movups xmmword [rsp + 0x450], xmm0
movups xmmword [rsp + 0x460], xmm0
movups xmmword [rsp + 0x470], xmm0
movups xmmword [rsp + 0x480], xmm0
movups xmmword [rsp + 0x490], xmm0
lea rdx, [rsp + 0x540]
lea rcx, [rsp + 0x420]
call fcn.14000b450
nop
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov dword [0x140017d20], eax
cmp byte [r15 + 0x880], 0
jne 0x14000209f
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.1400066c0
mov rbx, rax
call fcn.14000d640
mov r9, rax
mov rcx, qword [0x140029c30]
add rcx, 0x1868
mov r8, rbx
lea rdx, str.USER__s_0__:_s_n
call fcn.140003240
call fcn.1400066c0
mov rcx, qword [0x140029c30]
add rcx, 0x1868
mov r8, rax
lea rdx, str.NICK_:_s_n
call fcn.140003240
mov byte [r15 + 0x880], 1
movups xmm0, xmmword [str.Ping_Timeout_Thread]
movups xmmword [rsp + 0x520], xmm0
mov eax, dword [0x140011898]
mov dword [rsp + 0x530], eax
mov rcx, qword [0x140029c30]
add rcx, 0xc40
lea r9, str.AstroPingTimeOutThread
lea r8, [rsp + 0x520]
mov edx, 5
call fcn.14000d280
mov dword [rsp + 0x3d4], eax
lea rax, [rsp + 0x410]
mov qword [rsp + 0x28], rax
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea r9, [rsp + 0x2d0]
lea r8, [0x140001c00]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
movsxd rcx, dword [rsp + 0x3d4]
imul rdx, rcx, 0xe8
lea rcx, [0x140019de8]
mov qword [rdx + rcx], rax
lea ecx, [r14 + 0x32]
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400020a2
xor r14d, r14d
lea r9, [0x1400118b8]
xor r8d, r8d
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x420]
call fcn.14000ba30
or r12d, 1
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x1400020f8
mov rcx, r14
lea r8, str.PING
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x1400022e0
cmp rcx, 5
jne 0x1400020e0
mov ebx, r14d
lea rsi, vtable.cString.0
mov qword [rsp + 0x30], rsi
test rdx, rdx
je 0x140002119
mov rcx, rdx
call fcn.14000f76c
mov qword [rsp + 0x38], r14
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14000212d
call fcn.14000f76c
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x48], r14d
lea rcx, [rsp + 0x50]
call fcn.140001560
test ebx, ebx
jne 0x1400021e3
lea r9, [0x1400118b8]
lea r8d, [rbx + 1]
lea rdx, [rsp + 0x4a0]
lea rcx, [rsp + 0x420]
call fcn.14000ba30
or r12d, 0x10
mov rcx, qword [0x140029c30]
add rcx, 0x1868
mov r8, qword [rsp + 0x4a8]
lea rdx, str.PONG__s_r_n
call fcn.140003240
mov qword [rsp + 0x4a0], rsi
mov rcx, qword [rsp + 0x4a8]
test rcx, rcx
je 0x1400021ac
call fcn.14000f76c
mov qword [rsp + 0x4a8], r14
mov rcx, qword [rsp + 0x4b0]
test rcx, rcx
je 0x1400021c6
call fcn.14000f76c
mov qword [rsp + 0x4b0], r14
mov dword [rsp + 0x4b8], r14d
lea rcx, [rsp + 0x4c0]
call fcn.140001560
mov byte [r15 + 0x880], 1
lea r9, [0x1400118b8]
xor r8d, r8d
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x420]
call fcn.14000ba30
or r12d, 2
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x140002238
mov rcx, r14
lea r8, str.ERROR
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x1400022ea
cmp rcx, 6
jne 0x140002220
mov ebx, r14d
mov qword [rsp + 0x30], rsi
test rdx, rdx
je 0x140002252
mov rcx, rdx
call fcn.14000f76c
mov qword [rsp + 0x38], r14
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140002266
call fcn.14000f76c
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x48], r14d
lea rcx, [rsp + 0x50]
call fcn.140001560
test ebx, ebx
jne 0x1400022f4
mov byte [r15 + 0x880], bl
movsxd rax, dword [r15 + 0x878]
cmp eax, 0xffffffff
je 0x140002295
mov rcx, rax
call qword [sym.imp.WS2_32.dll_closesocket]
mov byte [r15 + 0x87e], 0
mov dword [r15 + 0x878], r13d
mov word [r15 + 0x10], r14w
lea rcx, [r15 + 0x18]
lea r8, [0x140011748]
mov edx, 0x800
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
mov byte [r15 + 0x87e], 0
mov ecx, 0x3a98
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [r15]
mov rcx, r15
call qword [rax + reloc.WS2_32.dll_recv]
jmp 0x14000244c
sbb ebx, ebx
or ebx, 1
jmp 0x1400020fb
sbb ebx, ebx
or ebx, 1
jmp 0x14000223b
lea r9, [0x1400118b8]
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x420]
call fcn.14000ba30
or r12d, 8
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x140002344
mov rcx, r14
lea r8, [0x1400118dc]
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x140002394
cmp rcx, 4
jne 0x140002330
mov ebx, r14d
mov qword [rsp + 0x30], rsi
test rdx, rdx
je 0x14000235e
mov rcx, rdx
call fcn.14000f76c
mov qword [rsp + 0x38], r14
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140002372
call fcn.14000f76c
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x48], r14d
lea rcx, [rsp + 0x50]
call fcn.140001560
test ebx, ebx
jne 0x14000239b
lea rdx, str.JOIN_:_s_r_n
mov rcx, r15
jmp 0x140002440
sbb ebx, ebx
or ebx, 1
jmp 0x140002347
lea r9, [0x1400118b8]
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x420]
call fcn.14000ba30
or r12d, 0x20
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x1400023ea
mov rcx, r14
lea r8, [0x1400118ec]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x140002498
cmp rcx, 4
jne 0x1400023d2
mov ebx, r14d
mov qword [rsp + 0x30], rsi
test rdx, rdx
je 0x140002404
mov rcx, rdx
call fcn.14000f76c
mov qword [rsp + 0x38], r14
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140002418
call fcn.14000f76c
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x48], r14d
lea rcx, [rsp + 0x50]
call fcn.140001560
test ebx, ebx
jne 0x14000244c
mov rcx, qword [0x140029c30]
add rcx, 0x1868
lea rdx, str.JOIN__s_r_n
lea r8, str.vorteckz
call fcn.140003240
lea r9, [0x1400118b8]
mov r8d, 1
lea rdx, [rsp + 0x4a0]
lea rcx, [rsp + 0x420]
call fcn.14000ba30
or r12d, 4
mov rcx, qword [rsp + 0x4a8]
test rcx, rcx
je 0x1400024a2
lea rdx, str.PRIVMSG
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
mov ebx, eax
mov rcx, qword [rsp + 0x4a8]
jmp 0x1400024a5
sbb ebx, ebx
or ebx, 1
jmp 0x1400023ed
mov ebx, r14d
mov qword [rsp + 0x4a0], rsi
test rcx, rcx
je 0x1400024bf
call fcn.14000f76c
mov qword [rsp + 0x4a8], r14
mov rcx, qword [rsp + 0x4b0]
test rcx, rcx
je 0x1400024d9
call fcn.14000f76c
mov qword [rsp + 0x4b0], r14
mov dword [rsp + 0x4b8], r14d
lea rcx, [rsp + 0x4c0]
call fcn.140001560
test ebx, ebx
jne 0x1400030f6
mov ecx, 0x300
call fcn.14000f4f0
mov rbx, rax
mov qword [rsp + 0xb0], rax
xor edx, edx
mov r8d, 0x300
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
call fcn.14000afd0
lea rcx, [rbx + 0x80]
call fcn.14000afd0
lea rcx, [rbx + 0x100]
call fcn.14000afd0
lea rcx, [rbx + 0x180]
call fcn.14000afd0
lea rcx, [rbx + 0x200]
call fcn.14000afd0
lea rcx, [rbx + 0x280]
call fcn.14000afd0
lea r9, [0x140011908]
xor r8d, r8d
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x420]
call fcn.14000ba30
nop
lea r9, [0x1400118b8]
xor r8d, r8d
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0xc0]
call fcn.14000ba30
nop
lea r9, [0x14001190c]
xor r8d, r8d
lea rdx, [rsp + 0x1d0]
lea rcx, [rsp + 0x140]
call fcn.14000ba30
nop
mov rdi, qword [rsp + 0x1d8]
test rdi, rdi
je 0x140002633
mov rsi, r13
nop
inc rsi
cmp byte [rdi + rsi], 0
jne 0x1400025d0
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400025eb
call fcn.14000f76c
mov qword [rbx + 8], r14
lea eax, [rsi + 2]
movsxd r14, eax
mov rcx, r14
call fcn.14000fb0c
mov qword [rbx + 8], rax
mov dword [rbx + 0x18], esi
mov r8, r14
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
movsxd r9, dword [rbx + 0x18]
mov r8, rdi
mov rdx, r14
mov rcx, qword [rbx + 8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
mov rdi, qword [rsp + 0x1d8]
xor r14d, r14d
lea rsi, vtable.cString.0
mov qword [rsp + 0x1d0], rsi
test rdi, rdi
je 0x140002650
mov rcx, rdi
call fcn.14000f76c
mov qword [rsp + 0x1d8], r14
mov rcx, qword [rsp + 0x1e0]
test rcx, rcx
je 0x14000266a
call fcn.14000f76c
mov qword [rsp + 0x1e0], r14
mov dword [rsp + 0x1e8], r14d
lea rcx, [rsp + 0x1f0]
call fcn.140001560
nop
mov qword [rsp + 0x140], rsi
mov rcx, qword [rsp + 0x148]
test rcx, rcx
je 0x1400026a2
call fcn.14000f76c
mov qword [rsp + 0x148], r14
mov rcx, qword [rsp + 0x150]
test rcx, rcx
je 0x1400026bc
call fcn.14000f76c
mov qword [rsp + 0x150], r14
mov dword [rsp + 0x158], r14d
lea rcx, [rsp + 0x160]
call fcn.140001560
nop
mov qword [rsp + 0xc0], rsi
mov rcx, qword [rsp + 0xc8]
test rcx, rcx
je 0x1400026f4
call fcn.14000f76c
mov qword [rsp + 0xc8], r14
mov rcx, qword [rsp + 0xd0]
test rcx, rcx
je 0x14000270e
call fcn.14000f76c
mov qword [rsp + 0xd0], r14
mov dword [rsp + 0xd8], r14d
lea rcx, [rsp + 0xe0]
call fcn.140001560
lea r9, [0x14001190c]
mov r8d, 1
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x420]
call fcn.14000ba30
nop
lea r9, [0x140011910]
xor r8d, r8d
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x140]
call fcn.14000ba30
nop
mov rdi, qword [rsp + 0xc8]
test rdi, rdi
je 0x1400027eb
mov rsi, r13
inc rsi
cmp byte [rdi + rsi], 0
jne 0x140002776
mov rcx, qword [rbx + 0x88]
test rcx, rcx
je 0x140002797
call fcn.14000f76c
mov qword [rbx + 0x88], r14
lea eax, [rsi + 2]
movsxd r14, eax
mov rcx, r14
call fcn.14000fb0c
mov qword [rbx + 0x88], rax
mov dword [rbx + 0x98], esi
mov r8, r14
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
movsxd r9, dword [rbx + 0x98]
mov r8, rdi
mov rdx, r14
mov rcx, qword [rbx + 0x88]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
mov rdi, qword [rsp + 0xc8]
xor r14d, r14d
lea rsi, vtable.cString.0
mov qword [rsp + 0xc0], rsi
test rdi, rdi
je 0x140002808
mov rcx, rdi
call fcn.14000f76c
mov qword [rsp + 0xc8], r14
mov rcx, qword [rsp + 0xd0]
test rcx, rcx
je 0x140002822
call fcn.14000f76c
mov qword [rsp + 0xd0], r14
mov dword [rsp + 0xd8], r14d
lea rcx, [rsp + 0xe0]
call fcn.140001560
nop
mov qword [rsp + 0x140], rsi
mov rcx, qword [rsp + 0x148]
test rcx, rcx
je 0x14000285a
call fcn.14000f76c
mov qword [rsp + 0x148], r14
mov rcx, qword [rsp + 0x150]
test rcx, rcx
je 0x140002874
call fcn.14000f76c
mov qword [rsp + 0x150], r14
mov dword [rsp + 0x158], r14d
lea rcx, [rsp + 0x160]
call fcn.140001560
lea r9, [0x140011910]
mov r8d, 1
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x420]
call fcn.14000ba30
nop
lea r9, [0x1400118b8]
xor r8d, r8d
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x140]
call fcn.14000ba30
nop
mov rdi, qword [rsp + 0xc8]
test rdi, rdi
je 0x140002955
mov rsi, r13
nop dword [rax]
inc rsi
cmp byte [rdi + rsi], 0
jne 0x1400028e0
mov rcx, qword [rbx + 0x108]
test rcx, rcx
je 0x140002901
call fcn.14000f76c
mov qword [rbx + 0x108], r14
lea eax, [rsi + 2]
movsxd r14, eax
mov rcx, r14
call fcn.14000fb0c
mov qword [rbx + 0x108], rax
mov dword [rbx + 0x118], esi
mov r8, r14
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
movsxd r9, dword [rbx + 0x118]
mov r8, rdi
mov rdx, r14
mov rcx, qword [rbx + 0x108]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
mov rdi, qword [rsp + 0xc8]
xor r14d, r14d
lea rsi, vtable.cString.0
mov qword [rsp + 0xc0], rsi
test rdi, rdi
je 0x140002972
mov rcx, rdi
call fcn.14000f76c
mov qword [rsp + 0xc8], r14
mov rcx, qword [rsp + 0xd0]
test rcx, rcx
je 0x14000298c
call fcn.14000f76c
mov qword [rsp + 0xd0], r14
mov dword [rsp + 0xd8], r14d
lea rcx, [rsp + 0xe0]
call fcn.140001560
nop
mov qword [rsp + 0x140], rsi
mov rcx, qword [rsp + 0x148]
test rcx, rcx
je 0x1400029c4
call fcn.14000f76c
mov qword [rsp + 0x148], r14
mov rcx, qword [rsp + 0x150]
test rcx, rcx
je 0x1400029de
call fcn.14000f76c
mov qword [rsp + 0x150], r14
mov dword [rsp + 0x158], r14d
lea rcx, [rsp + 0x160]
call fcn.140001560
lea r9, [0x1400118b8]
mov r8d, 2
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x420]
call fcn.14000ba30
nop
mov rdi, qword [rsp + 0xc8]
test rdi, rdi
je 0x140002a9b
mov rsi, r13
inc rsi
cmp byte [rdi + rsi], 0
jne 0x140002a26
mov rcx, qword [rbx + 0x188]
test rcx, rcx
je 0x140002a47
call fcn.14000f76c
mov qword [rbx + 0x188], r14
lea eax, [rsi + 2]
movsxd r14, eax
mov rcx, r14
call fcn.14000fb0c
mov qword [rbx + 0x188], rax
mov dword [rbx + 0x198], esi
mov r8, r14
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
movsxd r9, dword [rbx + 0x198]
mov r8, rdi
mov rdx, r14
mov rcx, qword [rbx + 0x188]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
mov rdi, qword [rsp + 0xc8]
xor r14d, r14d
lea rsi, vtable.cString.0
mov qword [rsp + 0xc0], rsi
test rdi, rdi
je 0x140002ab8
mov rcx, rdi
call fcn.14000f76c
mov qword [rsp + 0xc8], r14
mov rcx, qword [rsp + 0xd0]
test rcx, rcx
je 0x140002ad2
call fcn.14000f76c
mov qword [rsp + 0xd0], r14
mov dword [rsp + 0xd8], r14d
lea rcx, [rsp + 0xe0]
call fcn.140001560
xorps xmm0, xmm0
movups xmmword [rsp + 0x4a0], xmm0
movups xmmword [rsp + 0x4b0], xmm0
movups xmmword [rsp + 0x4c0], xmm0
movups xmmword [rsp + 0x4d0], xmm0
movups xmmword [rsp + 0x4e0], xmm0
movups xmmword [rsp + 0x4f0], xmm0
movups xmmword [rsp + 0x500], xmm0
movups xmmword [rsp + 0x510], xmm0
lea r9, [0x140011908]
mov r8d, 1
lea rdx, [rsp + 0x1d0]
lea rcx, [rsp + 0x420]
call fcn.14000ba30
nop
lea r9, [0x1400118b8]
xor r8d, r8d
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x1d0]
call fcn.14000ba30
nop
lea r9, [0x1400118b8]
xor r8d, r8d
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x140]
call fcn.14000ba30
nop
mov rdx, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0x428]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
mov rdx, rax
lea rcx, [rsp + 0x4a0]
call fcn.14000b450
nop
mov qword [rsp + 0xc0], rsi
mov rcx, qword [rsp + 0xc8]
test rcx, rcx
je 0x140002bd6
call fcn.14000f76c
mov qword [rsp + 0xc8], r14
mov rcx, qword [rsp + 0xd0]
test rcx, rcx
je 0x140002bf0
call fcn.14000f76c
mov qword [rsp + 0xd0], r14
mov dword [rsp + 0xd8], r14d
lea rcx, [rsp + 0xe0]
call fcn.140001560
nop
mov qword [rsp + 0x140], rsi
mov rcx, qword [rsp + 0x148]
test rcx, rcx
je 0x140002c28
call fcn.14000f76c
mov qword [rsp + 0x148], r14
mov rcx, qword [rsp + 0x150]
test rcx, rcx
je 0x140002c42
call fcn.14000f76c
mov qword [rsp + 0x150], r14
mov dword [rsp + 0x158], r14d
lea rcx, [rsp + 0x160]
call fcn.140001560
nop
mov qword [rsp + 0x1d0], rsi
mov rcx, qword [rsp + 0x1d8]
test rcx, rcx
je 0x140002c7a
call fcn.14000f76c
mov qword [rsp + 0x1d8], r14
mov rcx, qword [rsp + 0x1e0]
test rcx, rcx
je 0x140002c94
call fcn.14000f76c
mov qword [rsp + 0x1e0], r14
mov dword [rsp + 0x1e8], r14d
lea rcx, [rsp + 0x1f0]
call fcn.140001560
lea r9, [0x140011908]
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x420]
call fcn.14000ba30
nop
lea r9, [0x1400118b8]
xor r8d, r8d
lea rdx, [rsp + 0x250]
lea rcx, [rsp + 0x30]
call fcn.14000ba30
nop
mov rdi, qword [rsp + 0x258]
test rdi, rdi
je 0x140002d6b
mov rsi, r13
inc rsi
cmp byte [rdi + rsi], 0
jne 0x140002cf6
mov rcx, qword [rbx + 0x208]
test rcx, rcx
je 0x140002d17
call fcn.14000f76c
mov qword [rbx + 0x208], r14
lea eax, [rsi + 2]
movsxd r14, eax
mov rcx, r14
call fcn.14000fb0c
mov qword [rbx + 0x208], rax
mov dword [rbx + 0x218], esi
mov r8, r14
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
movsxd r9, dword [rbx + 0x218]
mov r8, rdi
mov rdx, r14
mov rcx, qword [rbx + 0x208]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
mov rdi, qword [rsp + 0x258]
xor r14d, r14d
lea rsi, vtable.cString.0
mov qword [rsp + 0x250], rsi
test rdi, rdi
je 0x140002d88
mov rcx, rdi
call fcn.14000f76c
mov qword [rsp + 0x258], r14
mov rcx, qword [rsp + 0x260]
test rcx, rcx
je 0x140002da2
call fcn.14000f76c
mov qword [rsp + 0x260], r14
mov dword [rsp + 0x268], r14d
lea rcx, [rsp + 0x270]
call fcn.140001560
nop
mov qword [rsp + 0x30], rsi
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140002dd1
call fcn.14000f76c
mov qword [rsp + 0x38], r14
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140002de5
call fcn.14000f76c
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x48], r14d
lea rcx, [rsp + 0x50]
call fcn.140001560
lea r9, [0x1400118b8]
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x4a0]
call fcn.14000ba30
nop
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x4a8]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
mov rdi, rax
test rax, rax
je 0x140002e9d
nop
inc r13
cmp byte [rax + r13], 0
jne 0x140002e30
mov rcx, qword [rbx + 0x288]
test rcx, rcx
je 0x140002e52
call fcn.14000f76c
mov qword [rbx + 0x288], r14
lea eax, [r13 + 2]
movsxd rsi, eax
mov rcx, rsi
call fcn.14000fb0c
mov qword [rbx + 0x288], rax
mov dword [rbx + 0x298], r13d
mov r8, rsi
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
movsxd r9, dword [rbx + 0x298]
mov r8, rdi
mov rdx, rsi
mov rcx, qword [rbx + 0x288]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
lea rsi, vtable.cString.0
mov qword [rsp + 0x30], rsi
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140002eb6
call fcn.14000f76c
mov qword [rsp + 0x38], r14
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140002eca
call fcn.14000f76c
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x48], r14d
lea rcx, [rsp + 0x50]
call fcn.140001560
mov rcx, qword [rbx + 0x208]
test rcx, rcx
je 0x140002f1d
mov rax, qword [rbx + 0x288]
test rax, rax
je 0x140002f1d
sub rcx, rax
movzx edx, byte [rax]
cmp dl, byte [rax + rcx]
jne 0x140002f08
inc rax
test dl, dl
jne 0x140002ef4
mov eax, r14d
jmp 0x140002f0d
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140002f67
lea rdi, [rbx + 0x288]
mov rcx, qword [rdi]
jmp 0x140002f2c
lea rdi, [rbx + 0x288]
mov rcx, qword [rdi]
test rcx, rcx
je 0x140002f31
call fcn.14000f76c
mov qword [rdi], r14
mov ecx, 2
call fcn.14000fb0c
mov qword [rdi], rax
mov dword [rbx + 0x298], r14d
xor ecx, ecx
mov word [rax], cx
movsxd r9, dword [rbx + 0x298]
lea r8, [0x140011748]
lea edx, [rcx + 2]
mov rcx, qword [rdi]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
mov rcx, qword [0x140029c30]
add rcx, 0x8e8
mov rdx, qword [rbx + 0x208]
call fcn.140004820
test rax, rax
je 0x14000304f
mov rcx, qword [rax + 0x40]
mov rax, qword [rcx]
mov r8, qword [rbx + 0x288]
mov rdx, qword [rbx + 0x208]
call qword [rax]
movzx ebx, al
mov qword [rsp + 0x4a0], rsi
mov rcx, qword [rsp + 0x4a8]
test rcx, rcx
je 0x140002fc6
call fcn.14000f76c
mov qword [rsp + 0x4a8], r14
mov rcx, qword [rsp + 0x4b0]
test rcx, rcx
je 0x140002fe0
call fcn.14000f76c
mov qword [rsp + 0x4b0], r14
mov dword [rsp + 0x4b8], r14d
lea rcx, [rsp + 0x4c0]
call fcn.140001560
nop
mov qword [rsp + 0x420], rsi
mov rcx, qword [rsp + 0x428]
test rcx, rcx
je 0x140003018
call fcn.14000f76c
mov qword [rsp + 0x428], r14
mov rcx, qword [rsp + 0x430]
test rcx, rcx
je 0x140003032
call fcn.14000f76c
mov qword [rsp + 0x430], r14
mov dword [rsp + 0x438], r14d
lea rcx, [rsp + 0x440]
call fcn.140001560
movzx eax, bl
jmp 0x14000316d
mov qword [rsp + 0x4a0], rsi
mov rcx, qword [rsp + 0x4a8]
test rcx, rcx
je 0x140003071
call fcn.14000f76c
mov qword [rsp + 0x4a8], r14
mov rcx, qword [rsp + 0x4b0]
test rcx, rcx
je 0x14000308b
call fcn.14000f76c
mov qword [rsp + 0x4b0], r14
mov dword [rsp + 0x4b8], r14d
lea rcx, [rsp + 0x4c0]
call fcn.140001560
nop
mov qword [rsp + 0x420], rsi
mov rcx, qword [rsp + 0x428]
test rcx, rcx
je 0x1400030c3
call fcn.14000f76c
mov qword [rsp + 0x428], r14
mov rcx, qword [rsp + 0x430]
test rcx, rcx
je 0x1400030dd
call fcn.14000f76c
mov qword [rsp + 0x430], r14
mov dword [rsp + 0x438], r14d
lea rcx, [rsp + 0x440]
call fcn.140001560
xor al, al
jmp 0x14000316d
mov qword [rsp + 0x420], rsi
mov rcx, qword [rsp + 0x428]
test rcx, rcx
je 0x140003118
call fcn.14000f76c
mov qword [rsp + 0x428], r14
mov rcx, qword [rsp + 0x430]
test rcx, rcx
je 0x140003132
call fcn.14000f76c
mov qword [rsp + 0x430], r14
mov dword [rsp + 0x438], r14d
lea rcx, [rsp + 0x440]
call fcn.140001560
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rbx, qword [rsp + 0xb0]
jmp 0x140001dd0
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
xor al, al
mov rcx, qword [rsp + 0x2540]
xor rcx, rsp
call fcn.14000f4d0
lea r11, [rsp + 0x2550]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret