Function at 0x14000f930
Capabilities:
Create thread
Encode data using xor
Execute command
Log keystrokes via polling
Set console window title

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x2c8]
sub rsp, 0x390
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
xor r13d, r13d
mov dword [rbp + 0x2d0], r13d
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
lea edx, [r13 + 5]
call qword [sym.imp.USER32.dll_ShowWindow]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
lea edx, [r13 + 3]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rax, qword [str.UXTVHeBVKRQRPQ]
mov qword [rbp + 0x2d8], rax
mov r12d, dword [reloc.WS2_32.dll_accept]
cmp byte [0x1400656cf], r13b
je 0x14000faef
cmp r12d, 2
jl 0x14000fab2
movdqa xmm4, xmmword [0x1400658e0]
movdqa xmm2, xmmword [0x140065890]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400658b0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400658d0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400658f0]
movd xmm0, dword [rbp + 0x2d8]
xorps xmm2, xmm0
movd dword [rbp + 0x2d8], xmm2
movdqa xmm3, xmmword [0x1400658a0]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400658b0]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400658d0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400658f0]
movd xmm0, dword [rbp + 0x2dc]
xorps xmm2, xmm0
movd dword [rbp + 0x2dc], xmm2
jmp 0x14000faef
lea r9, [rbp + 0x2d8]
mov r8d, r13d
nop dword [rax]
mov eax, 0x94f2095
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x37
movzx eax, r8b
sub al, cl
add al, 0x36
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 8
jl 0x14000fac0
lea rcx, [rbp + 0x2d8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movups xmm0, xmmword [0x140064cd0]
movups xmmword [rbp + 0x200], xmm0
movups xmm1, xmmword [0x140064ce0]
movups xmmword [rbp + 0x210], xmm1
movups xmm0, xmmword [0x140064cf0]
movups xmmword [rbp + 0x220], xmm0
movups xmm1, xmmword [0x140064d00]
movups xmmword [rbp + 0x230], xmm1
movups xmm0, xmmword [0x140064d10]
movups xmmword [rbp + 0x240], xmm0
movups xmm1, xmmword [0x140064d20]
movups xmmword [rbp + 0x250], xmm1
movups xmm0, xmmword [0x140064d30]
movups xmmword [rbp + 0x260], xmm0
cmp r12d, 2
jl 0x14000fc79
movdqa xmm5, xmmword [0x140065890]
mov edx, r13d
movdqa xmm4, xmmword [0x1400658e0]
movdqa xmm6, xmmword [0x1400658b0]
movdqa xmm7, xmmword [0x1400658c0]
lea rcx, [rbp + 0x200]
movd xmm2, edx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm7
paddw xmm3, xmm2
movq xmm0, qword [rcx]
xorps xmm3, xmm0
movq qword [rcx], xmm3
lea eax, [rdx + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm7
paddw xmm3, xmm2
movq xmm0, qword [rcx + 8]
xorps xmm3, xmm0
movq qword [rcx + 8], xmm3
add edx, 8
lea rcx, [rcx + 0x10]
cmp edx, 0x38
jl 0x14000fb92
jmp 0x14000fcc3
lea r9, [rbp + 0x200]
mov r8d, r13d
nop dword [rax]
nop word [rax + rax]
mov eax, 0x94f2095
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x37
movzx eax, r8w
sub ax, cx
add ax, 0x36
xor word [r9], ax
inc r8d
lea r9, [r9 + 2]
cmp r8d, 0x38
jl 0x14000fc90
lea rcx, [rbp + 0x200]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
mov eax, dword [str.U_K9BVKRQRPQ]
mov dword [rbp + 0x2d8], eax
cmp byte [reloc.WS2_32.dll_gethostname], r13b
je 0x14000fdaf
cmp r12d, 2
jl 0x14000fd73
movdqa xmm3, xmmword [0x140065890]
movdqa xmm2, xmm3
punpckldq xmm2, xmm3
pmuldq xmm2, xmmword [0x1400658e0]
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmmword [0x1400658e0]
shufps xmm2, xmm0, 0xdd
psrad xmm2, 1
movdqa xmm0, xmm2
psrld xmm0, 0x1f
paddd xmm0, xmm2
pmulld xmm0, xmmword [0x1400658b0]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400658d0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400658f0]
movd xmm0, eax
xorps xmm2, xmm0
movd dword [rbp + 0x2d8], xmm2
jmp 0x14000fdaf
lea r9, [rbp + 0x2d8]
mov r8d, r13d
nop dword [rax]
mov eax, 0x94f2095
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x37
movzx eax, r8b
sub al, cl
add al, 0x36
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 4
jl 0x14000fd80
lea rcx, [rbp + 0x2d8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov ecx, Ordinal_50
call fcn.140055210
mov rdi, rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], Ordinal_46
mov qword [rsp + 0x48], Ordinal_50
movups xmm0, xmmword [str._n_n_n_Welcome_To_KFC_Wares_Perm_Spoofer]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140064940]
movups xmmword [rax + 0x10], xmm1
mov ecx, dword [0x140064950]
mov dword [rax + 0x20], ecx
movzx eax, word [0x140064954]
mov word [rdi + 0x24], ax
lea rsi, [rdi + 0x26]
mov byte [rsi], r13b
mov dword [rsp + 0x50], reloc.WLDAP32.dll_Ordinal_50
mov r14, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov rbx, rdi
cmp rdi, rsi
je 0x14000fe6f
mov qword [rbp + 0x2d8], reloc.WLDAP32.dll_Ordinal_50
nop word [rax + rax]
movzx edx, byte [rbx]
mov rcx, r14
call fcn.1400115c0
mov rcx, rax
lea rdx, [0x140011790]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp + 0x2d8]
call fcn.1400117b0
inc rbx
cmp rbx, rsi
jne 0x14000fe40
mov edx, Ordinal_50
mov rcx, rdi
call fcn.14005555c
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov ecx, Ordinal_50
call fcn.140055210
mov rdi, rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], Ordinal_46
mov qword [rsp + 0x48], Ordinal_50
movups xmm0, xmmword [str._n_n_Checking_For_Blacklisted_Programs...]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140064968]
movups xmmword [rax + 0x10], xmm1
mov ecx, dword [0x140064978]
mov dword [rax + 0x20], ecx
movzx ecx, word [0x14006497c]
mov word [rax + 0x24], cx
movzx eax, byte [reloc.WLDAP32.dll_Ordinal_46]
mov byte [rdi + 0x26], al
lea rsi, [rdi + 0x27]
mov byte [rsi], 0
mov dword [rsp + 0x50], reloc.WLDAP32.dll_Ordinal_50
mov r14, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov rbx, rdi
cmp rdi, rsi
je 0x14000ff33
mov qword [rbp + 0x2d8], reloc.WLDAP32.dll_Ordinal_50
movzx edx, byte [rbx]
mov rcx, r14
call fcn.1400115c0
mov rcx, rax
lea rdx, [0x140011790]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp + 0x2d8]
call fcn.1400117b0
inc rbx
cmp rbx, rsi
jne 0x14000ff04
mov edx, Ordinal_50
mov rcx, rdi
call fcn.14005555c
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, [0x14000ed40]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, [0x14000ed60]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], ntohs
mov qword [rbp - 8], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [str....___Done_]
movsd qword [rbp - 0x20], xmm0
movzx eax, word [0x140064928]
mov word [rbp - 0x18], ax
movzx eax, byte [reloc.WLDAP32.dll_Ordinal_33]
mov byte [rbp - 0x16], al
mov byte [rbp - 0x15], 0
mov dword [rbp], reloc.WLDAP32.dll_Ordinal_50
mov rdi, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rbx, [rbp - 0x20]
lea rsi, [rbp - 0x15]
mov qword [rbp + 0x2d8], reloc.WLDAP32.dll_Ordinal_50
movzx edx, byte [rbx]
mov rcx, rdi
call fcn.1400115c0
mov rcx, rax
lea rdx, [0x140011790]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp + 0x2d8]
call fcn.1400117b0
inc rbx
cmp rbx, rsi
jne 0x14000ffe5
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.140055210
mov rdi, rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], reloc.WLDAP32.dll_Ordinal_27
mov qword [rsp + 0x48], Ordinal_35
movups xmm0, xmmword [str._n_n_Closing_Epic_Games_Tasks]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x140064990]
movsd qword [rax + 0x10], xmm0
movzx ecx, word [0x140064998]
mov word [rax + 0x18], cx
movzx ecx, byte [reloc.WS2_32.dll_WSAStartup]
mov byte [rax + 0x1a], cl
lea rsi, [rax + 0x1b]
mov byte [rsi], 0
mov dword [rsp + 0x50], reloc.WLDAP32.dll_Ordinal_50
mov r14, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov rbx, rax
cmp rax, rsi
je 0x1400100c4
mov qword [rbp + 0x2d8], reloc.WLDAP32.dll_Ordinal_50
movzx edx, byte [rbx]
mov rcx, r14
call fcn.1400115c0
mov rcx, rax
lea rdx, [0x140011790]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp + 0x2d8]
call fcn.1400117b0
inc rbx
cmp rbx, rsi
jne 0x140010095
mov edx, reloc.WLDAP32.dll_Ordinal_32
mov rcx, rdi
call fcn.14005555c
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, [0x14000f810]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
invalid
add al, 0
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov edx, 3
call qword [sym.imp.USER32.dll_ShowWindow]
call fcn.14000f830
nop
lea rax, [rbp - 0x80]
mov qword [rbp + 0x2d8], rax
lea rdx, [0x14006474c]
lea rcx, [rbp - 0x80]
call fcn.140011360
mov rbx, rax
lea rdx, [0x14006499c]
lea rcx, [rsp + 0x58]
call fcn.140011360
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140011e60
nop
lea rax, [rsp + 0x30]
mov qword [rbp - 0x60], rax
lea rax, [rsp + 0x58]
mov qword [rbp - 0x58], rax
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x50]
call fcn.140011cc0
mov dword [rbp + 0x2d0], 0x40
lea r9, [0x1400020c0]
mov edx, Ordinal_41
lea r8d, [rdx - 0x27]
lea rcx, [rsp + 0x30]
call fcn.14005524c
lea rdx, [rbp - 0x50]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011b50
mov dword [rbp + 0x2d0], r13d
lea rcx, [rbp - 0x50]
call fcn.140010ff0
nop
lea rax, [rsp + 0x58]
mov qword [rbp + 0x2d8], rax
lea rdx, [0x140064778]
lea rcx, [rsp + 0x58]
call fcn.140011360
mov rbx, rax
lea rdx, [0x140064728]
lea rcx, [rbp - 0x80]
call fcn.140011360
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140011e60
nop
lea rax, [rsp + 0x30]
mov qword [rbp - 0x40], rax
lea rax, [rsp + 0x58]
mov qword [rbp - 0x38], rax
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x30]
call fcn.140011cc0
mov dword [rbp + 0x2d0], 0x80
lea r9, [0x1400020c0]
mov edx, Ordinal_41
lea r8d, [rdx - 0x27]
lea rcx, [rsp + 0x30]
call fcn.14005524c
lea rdx, [rbp - 0x30]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011b50
mov edi, r13d
mov dword [rbp + 0x2d0], r13d
lea rcx, [rbp - 0x30]
call fcn.140010ff0
mov r15d, 2
xorps xmm0, xmm0
mov eax, 0x3146
movups xmmword [rbp + 0x58], xmm0
nop dword [rax]
mov qword [rbp + 0x68], r15
mov qword [rbp + 0x70], reloc.WS2_32.dll_ntohs
mov word [rbp + 0x58], ax
mov byte [rbp + 0x5a], 0
mov dword [rbp + 0x78], reloc.WLDAP32.dll_Ordinal_50
mov r14, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rbx, [rbp + 0x58]
lea rsi, [rbp + 0x58]
add rsi, r15
cmp rbx, rsi
je 0x1400102ef
mov qword [rbp + 0x2d8], reloc.WLDAP32.dll_Ordinal_50
nop dword [rax]
movzx edx, byte [rbx]
mov rcx, r14
call fcn.1400115c0
mov rcx, rax
lea rdx, [0x140011790]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp + 0x2d8]
call fcn.1400117b0
inc rbx
cmp rbx, rsi
jne 0x1400102c0
lea rax, [rsp + 0x58]
mov qword [rbp + 0x2d8], rax
lea rdx, [0x14006474c]
lea rcx, [rsp + 0x58]
call fcn.140011360
mov rbx, rax
lea rdx, [0x1400649a4]
lea rcx, [rbp - 0x80]
call fcn.140011360
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140011e60
nop
lea rax, [rsp + 0x30]
mov qword [rbp + 0x100], rax
lea rax, [rsp + 0x58]
mov qword [rbp + 0x108], rax
lea rdx, [rbp + 0x100]
lea rcx, [rbp + 0x110]
call fcn.140011cc0
bts edi, 8
mov dword [rbp + 0x2d0], edi
lea r9, [0x1400020c0]
mov edx, Ordinal_41
lea r8d, [rdx - 0x27]
lea rcx, [rsp + 0x30]
call fcn.14005524c
lea rdx, [rbp + 0x110]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011b50
btr edi, 8
mov dword [rbp + 0x2d0], edi
lea rcx, [rbp + 0x110]
call fcn.140010ff0
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], 4
mov qword [rbp + 0x98], reloc.WS2_32.dll_ntohs
mov dword [rbp + 0x80], 0x203e2d20
mov byte [rbp + 0x84], 0
mov dword [rbp + 0xa0], reloc.WLDAP32.dll_Ordinal_50
mov r14, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rbx, [rbp + 0x80]
lea rsi, [rbp + 0x80]
add rsi, 4
cmp rbx, rsi
je 0x14001043f
mov qword [rbp + 0x2d8], reloc.WLDAP32.dll_Ordinal_50
nop dword [rax]
movzx edx, byte [rbx]
mov rcx, r14
call fcn.1400115c0
mov rcx, rax
lea rdx, [0x140011790]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp + 0x2d8]
call fcn.1400117b0
inc rbx
cmp rbx, rsi
jne 0x140010410
lea rax, [rsp + 0x58]
mov qword [rbp + 0x2d8], rax
lea rdx, [0x14006474c]
lea rcx, [rsp + 0x58]
call fcn.140011360
mov rbx, rax
lea rdx, [0x1400649b0]
lea rcx, [rbp - 0x80]
call fcn.140011360
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140011e60
nop
lea rax, [rsp + 0x30]
mov qword [rbp + 0x120], rax
lea rax, [rsp + 0x58]
mov qword [rbp + 0x128], rax
lea rdx, [rbp + 0x120]
lea rcx, [rbp + 0x130]
call fcn.140011cc0
bts edi, 9
mov dword [rbp + 0x2d0], edi
lea r9, [0x1400020c0]
mov edx, Ordinal_41
lea r8d, [rdx - 0x27]
lea rcx, [rsp + 0x30]
call fcn.14005524c
lea rdx, [rbp + 0x130]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011b50
btr edi, 9
mov dword [rbp + 0x2d0], edi
lea rcx, [rbp + 0x130]
call fcn.140010ff0
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], 0xa
mov qword [rbp + 0x48], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [str.PERM_UNBAN]
movsd qword [rbp + 0x30], xmm0
movzx eax, word [0x1400649c0]
mov word [rbp + 0x38], ax
mov byte [rbp + 0x3a], 0
mov dword [rbp + 0x50], reloc.WLDAP32.dll_Ordinal_50
mov r14, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rbx, [rbp + 0x30]
lea rsi, [rbp + 0x30]
add rsi, 0xa
cmp rbx, rsi
je 0x14001058f
mov qword [rbp + 0x2d8], reloc.WLDAP32.dll_Ordinal_50
nop word [rax + rax]
movzx edx, byte [rbx]
mov rcx, r14
call fcn.1400115c0
mov rcx, rax
lea rdx, [0x140011790]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp + 0x2d8]
call fcn.1400117b0
inc rbx
cmp rbx, rsi
jne 0x140010560
lea rax, [rsp + 0x58]
mov qword [rbp + 0x2d8], rax
lea rdx, [0x14006474c]
lea rcx, [rsp + 0x58]
call fcn.140011360
mov rbx, rax
lea rdx, [0x1400649a4]
lea rcx, [rbp - 0x80]
call fcn.140011360
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140011e60
nop
lea rax, [rsp + 0x30]
mov qword [rbp + 0x140], rax
lea rax, [rsp + 0x58]
mov qword [rbp + 0x148], rax
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x150]
call fcn.140011cc0
or edi, 1
mov dword [rbp + 0x2d0], edi
lea r9, [0x1400020c0]
mov edx, Ordinal_41
lea r8d, [rdx - 0x27]
lea rcx, [rsp + 0x30]
call fcn.14005524c
lea rdx, [rbp + 0x150]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011b50
and edi, 0xfffffffe
mov dword [rbp + 0x2d0], edi
lea rcx, [rbp + 0x150]
call fcn.140010ff0
nop
lea rax, [rsp + 0x58]
mov qword [rbp + 0x2d8], rax
lea rdx, [0x14006474c]
lea rcx, [rsp + 0x58]
call fcn.140011360
mov rbx, rax
lea rdx, [0x14006499c]
lea rcx, [rbp - 0x80]
call fcn.140011360
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140011e60
nop
lea rax, [rsp + 0x30]
mov qword [rbp + 0x160], rax
lea rax, [rsp + 0x58]
mov qword [rbp + 0x168], rax
lea rdx, [rbp + 0x160]
lea rcx, [rbp + 0x170]
call fcn.140011cc0
or edi, 2
mov dword [rbp + 0x2d0], edi
lea r9, [0x1400020c0]
mov edx, Ordinal_41
lea r8d, [rdx - 0x27]
lea rcx, [rsp + 0x30]
call fcn.14005524c
lea rdx, [rbp + 0x170]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011b50
and edi, 0xfffffffd
mov dword [rbp + 0x2d0], edi
lea rcx, [rbp + 0x170]
call fcn.140010ff0
nop
lea rax, [rsp + 0x58]
mov qword [rbp + 0x2d8], rax
lea rdx, [0x140064778]
lea rcx, [rsp + 0x58]
call fcn.140011360
mov rbx, rax
lea rdx, [0x140064728]
lea rcx, [rbp - 0x80]
call fcn.140011360
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140011e60
nop
lea rax, [rsp + 0x30]
mov qword [rbp + 0x180], rax
lea rax, [rsp + 0x58]
mov qword [rbp + 0x188], rax
lea rdx, [rbp + 0x180]
lea rcx, [rbp + 0x190]
call fcn.140011cc0
or edi, 4
mov dword [rbp + 0x2d0], edi
lea r9, [0x1400020c0]
mov edx, Ordinal_41
lea r8d, [rdx - 0x27]
lea rcx, [rsp + 0x30]
call fcn.14005524c
lea rdx, [rbp + 0x190]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011b50
and edi, 0xfffffffb
mov dword [rbp + 0x2d0], edi
lea rcx, [rbp + 0x190]
call fcn.140010ff0
xorps xmm0, xmm0
movups xmmword [rbp + 0xa8], xmm0
mov qword [rbp + 0xb8], r15
mov qword [rbp + 0xc0], reloc.WS2_32.dll_ntohs
mov eax, 0x3246
mov word [rbp + 0xa8], ax
mov byte [rbp + 0xaa], 0
mov dword [rbp + 0xc8], reloc.WLDAP32.dll_Ordinal_50
mov r14, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rbx, [rbp + 0xa8]
lea rsi, [rbp + 0xa8]
add rsi, 2
cmp rbx, rsi
je 0x14001084f
mov qword [rbp + 0x2d8], reloc.WLDAP32.dll_Ordinal_50
nop dword [rax + rax]
movzx edx, byte [rbx]
mov rcx, r14
call fcn.1400115c0
mov rcx, rax
lea rdx, [0x140011790]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp + 0x2d8]
call fcn.1400117b0
inc rbx
cmp rbx, rsi
jne 0x140010820
lea rax, [rsp + 0x58]
mov qword [rbp + 0x2d8], rax
lea rdx, [0x14006474c]
lea rcx, [rsp + 0x58]
call fcn.140011360
mov rbx, rax
lea rdx, [0x1400649a4]
lea rcx, [rbp - 0x80]
call fcn.140011360
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140011e60
nop
lea rax, [rsp + 0x30]
mov qword [rbp + 0x1a0], rax
lea rax, [rsp + 0x58]
mov qword [rbp + 0x1a8], rax
lea rdx, [rbp + 0x1a0]
lea rcx, [rbp + 0x1b0]
call fcn.140011cc0
or edi, 8
mov dword [rbp + 0x2d0], edi
lea r9, [0x1400020c0]
mov edx, Ordinal_41
lea r8d, [rdx - 0x27]
lea rcx, [rsp + 0x30]
call fcn.14005524c
lea rdx, [rbp + 0x1b0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011b50
and edi, 0xfffffff7
mov dword [rbp + 0x2d0], edi
lea rcx, [rbp + 0x1b0]
call fcn.140010ff0
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
mov qword [rbp + 0xe0], 4
mov qword [rbp + 0xe8], reloc.WS2_32.dll_ntohs
mov dword [rbp + 0xd0], 0x203e2d20
mov byte [rbp + 0xd4], 0
mov dword [rbp + 0xf0], reloc.WLDAP32.dll_Ordinal_50
mov r14, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rbx, [rbp + 0xd0]
lea rsi, [rbp + 0xd0]
add rsi, 4
cmp rbx, rsi
je 0x14001099f
mov qword [rbp + 0x2d8], reloc.WLDAP32.dll_Ordinal_50
nop dword [rax + rax]
movzx edx, byte [rbx]
mov rcx, r14
call fcn.1400115c0
mov rcx, rax
lea rdx, [0x140011790]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp + 0x2d8]
call fcn.1400117b0
inc rbx
cmp rbx, rsi
jne 0x140010970
lea rax, [rsp + 0x58]
mov qword [rbp + 0x2d8], rax
lea rdx, [0x14006474c]
lea rcx, [rsp + 0x58]
call fcn.140011360
mov rbx, rax
lea rdx, [0x1400649b0]
lea rcx, [rbp - 0x80]
call fcn.140011360
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140011e60
nop
lea rax, [rsp + 0x30]
mov qword [rbp + 0x1c0], rax
lea rax, [rsp + 0x58]
mov qword [rbp + 0x1c8], rax
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0x1d0]
call fcn.140011cc0
or edi, 0x10
mov dword [rbp + 0x2d0], edi
lea r9, [0x1400020c0]
mov edx, Ordinal_41
lea r8d, [rdx - 0x27]
lea rcx, [rsp + 0x30]
call fcn.14005524c
lea rdx, [rbp + 0x1d0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011b50
and edi, 0xffffffef
mov dword [rbp + 0x2d0], edi
lea rcx, [rbp + 0x1d0]
call fcn.140010ff0
xorps xmm0, xmm0
movups xmmword [rbp + 8], xmm0
mov qword [rbp + 0x18], reloc.WS2_32.dll_listen
mov qword [rbp + 0x20], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [str.CHECK_SERIALS]
movsd qword [rbp + 8], xmm0
mov eax, dword [0x1400649d0]
mov dword [rbp + 0x10], eax
movzx eax, byte [0x1400649d4]
mov byte [rbp + 0x14], al
mov byte [rbp + 0x15], 0
mov dword [rbp + 0x28], reloc.WLDAP32.dll_Ordinal_50
mov r14, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rbx, [rbp + 8]
lea rsi, [rbp + 8]
add rsi, 0xd
cmp rbx, rsi
je 0x140010aef
mov qword [rbp + 0x2d8], reloc.WLDAP32.dll_Ordinal_50
nop dword [rax]
movzx edx, byte [rbx]
mov rcx, r14
call fcn.1400115c0
mov rcx, rax
lea rdx, [0x140011790]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp + 0x2d8]
call fcn.1400117b0
inc rbx
cmp rbx, rsi
jne 0x140010ac0
lea rax, [rsp + 0x58]
mov qword [rbp + 0x2d8], rax
lea rdx, [0x14006474c]
lea rcx, [rsp + 0x58]
call fcn.140011360
mov rbx, rax
lea rdx, [0x1400649a4]
lea rcx, [rbp - 0x80]
call fcn.140011360
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140011e60
nop
lea rax, [rsp + 0x30]
mov qword [rbp + 0x1e0], rax
lea rax, [rsp + 0x58]
mov qword [rbp + 0x1e8], rax
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0x1f0]
call fcn.140011cc0
or edi, 0x20
mov dword [rbp + 0x2d0], edi
lea r9, [0x1400020c0]
mov edx, Ordinal_41
lea r8d, [rdx - 0x27]
lea rcx, [rsp + 0x30]
call fcn.14005524c
lea rdx, [rbp + 0x1f0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011b50
and edi, 0xffffffdf
mov dword [rbp + 0x2d0], edi
lea rcx, [rbp + 0x1f0]
call fcn.140010ff0
mov ecx, reloc.WS2_32.dll_WSASetLastError
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
jne 0x140010be2
nop word [rax + rax]
mov ecx, WSAStartup
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
jne 0x140010fd3
mov ecx, reloc.WS2_32.dll_WSASetLastError
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140010bc0
mov edx, 0x1f4
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
call fcn.140002460
movups xmm0, xmmword [str.ECYKNeTIJO3ml__5__.ea_vh]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [0x140065178]
movups xmmword [rsp + 0x68], xmm1
mov eax, dword [0x140065188]
mov dword [rsp + 0x78], eax
mov ecx, r13d
cmp r12d, 2
jl 0x140010d53
movdqa xmm5, xmmword [0x140065890]
movdqa xmm4, xmmword [0x1400658e0]
movdqa xmm6, xmmword [0x1400658b0]
movdqa xmm0, xmmword [0x1400658f0]
movdqa xmmword [rbp - 0x80], xmm0
lea rdx, [rsp + 0x5c]
mov r8d, dword [rbp - 0x80]
movd xmm2, ecx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400658d0]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 4]
xorps xmm2, xmm0
movd dword [rdx - 4], xmm2
lea eax, [rcx + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400658d0]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx]
xorps xmm2, xmm0
movd dword [rdx], xmm2
add ecx, 8
lea rdx, [rdx + 8]
cmp ecx, 0x20
jl 0x140010c51
cmp ecx, 0x24
jge 0x140010d8b
movsxd rax, ecx
lea r8, [rsp + 0x58]
add r8, rax
nop
mov eax, 0x94f2095
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x37
movzx eax, cl
sub al, dl
add al, 0x36
xor byte [r8], al
inc ecx
lea r8, [r8 + 1]
cmp ecx, 0x24
jl 0x140010d60
lea rcx, [rsp + 0x58]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov ecx, Ordinal_50
call fcn.140055210
mov rsi, rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], Ordinal_41
mov qword [rsp + 0x48], Ordinal_50
movups xmm0, xmmword [str._n_n_n____________Done_Perm_Spoofing_n_n_n]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1400649e8]
movups xmmword [rax + 0x10], xmm1
mov ecx, dword [0x1400649f8]
mov dword [rax + 0x20], ecx
lea r14, [rax + 0x24]
mov byte [r14], 0
mov dword [rsp + 0x50], reloc.WLDAP32.dll_Ordinal_50
mov r15, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov rbx, rax
cmp rax, r14
je 0x140010e3f
mov qword [rbp + 0x2d8], reloc.WLDAP32.dll_Ordinal_50
nop word [rax + rax]
movzx edx, byte [rbx]
mov rcx, r15
call fcn.1400115c0
mov rcx, rax
lea rdx, [0x140011790]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp + 0x2d8]
call fcn.1400117b0
inc rbx
cmp rbx, r14
jne 0x140010e10
mov edx, Ordinal_50
mov rcx, rsi
call fcn.14005555c
mov r15d, 2
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov edx, 3
call qword [sym.imp.USER32.dll_ShowWindow]
call fcn.14000f830
nop
lea rax, [rbp - 0x80]
mov qword [rbp + 0x2d8], rax
lea rdx, [0x14006474c]
lea rcx, [rbp - 0x80]
call fcn.140011360
mov rbx, rax
lea rdx, [0x14006499c]
lea rcx, [rsp + 0x58]
call fcn.140011360
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140011e60
nop
lea rax, [rsp + 0x30]
mov qword [rbp - 0x60], rax
lea rax, [rsp + 0x58]
mov qword [rbp - 0x58], rax
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x50]
call fcn.140011cc0
or edi, 0x40
mov dword [rbp + 0x2d0], edi
lea r9, [0x1400020c0]
mov edx, Ordinal_41
lea r8d, [rdx - 0x27]
lea rcx, [rsp + 0x30]
call fcn.14005524c
lea rdx, [rbp - 0x50]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011b50
and edi, 0xffffffbf
mov dword [rbp + 0x2d0], edi
lea rcx, [rbp - 0x50]
call fcn.140010ff0
nop
lea rax, [rsp + 0x58]
mov qword [rbp + 0x2d8], rax
lea rdx, [0x140064778]
lea rcx, [rsp + 0x58]
call fcn.140011360
mov rbx, rax
lea rdx, [0x140064728]
lea rcx, [rbp - 0x80]
call fcn.140011360
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140011e60
nop
lea rax, [rsp + 0x30]
mov qword [rbp - 0x40], rax
lea rax, [rsp + 0x58]
mov qword [rbp - 0x38], rax
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x30]
call fcn.140011cc0
bts edi, 7
mov dword [rbp + 0x2d0], edi
lea r9, [0x1400020c0]
mov edx, Ordinal_41
lea r8d, [rdx - 0x27]
lea rcx, [rsp + 0x30]
call fcn.14005524c
lea rdx, [rbp - 0x30]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011b50
btr edi, 7
mov dword [rbp + 0x2d0], edi
lea rcx, [rbp - 0x30]
call fcn.140010ff0
jmp 0x140010270
call fcn.140004420
jmp 0x140010e52