Function at 0x14009cad0
Capabilities:
Hide graphical window

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x9c0
lea rbp, [rsp + 0x60]
lea rdi, [rsp + 0x60]
mov ecx, 0x198
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x9e8]
mov rax, qword [0x140401d40]
xor rax, rbp
mov qword [rbp + 0x950], rax
lea rcx, [0x14043618a]
call fcn.1402c8d18
mov dword [rbp + 0x10], 0x50
mov dword [rbp + 0x14], 0x40
lea rax, [0x14009d500]
mov qword [rbp + 0x18], rax
mov dword [rbp + 0x20], 0
mov dword [rbp + 0x24], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rbp + 0x28], rax
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x48], 0
lea rax, str.Loaders
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], 0
lea rcx, [rbp + 0x10]
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov qword [rsp + 0x58], 0
mov rax, qword [rbp + 0x28]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 5
mov dword [rsp + 0x30], 5
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0x80000000
lea r8, str.Loaders
mov rdx, qword [rbp + 0x50]
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov qword [0x140405680], rax
mov rcx, qword [0x140405680]
call fcn.140098440
movzx eax, al
test eax, eax
jne 0x14009cc2d
call fcn.140097de0
mov rdx, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.USER32.dll_UnregisterClassW]
mov eax, 1
jmp 0x14009d4cd
xor edx, edx
mov rcx, qword [0x140405680]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x140405680]
call qword [sym.imp.USER32.dll_UpdateWindow]
xor ecx, ecx
call fcn.1400c42f0
call fcn.1400d5f40
mov qword [rbp + 0x78], rax
mov rax, qword [rbp + 0x78]
mov qword [rax + 0x18], 0
mov rax, qword [rbp + 0x78]
mov eax, dword [rax]
bts eax, 0xa
mov rcx, qword [rbp + 0x78]
mov dword [rcx], eax
lea rax, [rbp + 0x94]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
call fcn.1400d6dd0
mov qword [rbp + 0xb8], rax
mov rax, qword [rbp + 0xb8]
add rax, 0xc4
mov qword [rbp + 0xd8], rax
movss xmm0, dword [0x14031ed18]
movss dword [rsp + 0x20], xmm0
movss xmm3, dword [0x14031ed18]
movss xmm2, dword [0x14031ed18]
movss xmm1, dword [0x14031ed18]
lea rcx, [rbp + 0x534]
call fcn.14008d360
mov ecx, reloc.WS2_32.dll_recv
imul rcx, rcx, 0
mov rdx, qword [rbp + 0xd8]
lea rdi, [rdx + rcx]
mov rsi, rax
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
movss xmm0, dword [0x14031ed18]
movss dword [rsp + 0x20], xmm0
movss xmm3, dword [0x14031ed14]
movss xmm2, dword [0x14031ed14]
movss xmm1, dword [0x14031ed14]
lea rcx, [rbp + 0x564]
call fcn.14008d360
mov ecx, reloc.WS2_32.dll_recv
imul rcx, rcx, 1
mov rdx, qword [rbp + 0xd8]
lea rdi, [rdx + rcx]
mov rsi, rax
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x20], 0xff
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x594]
call fcn.14008d230
mov qword [rbp + 0x928], rax
lea rdx, [rbp + 0x5c4]
mov rcx, qword [rbp + 0x928]
call fcn.140093ea0
mov ecx, reloc.WS2_32.dll_recv
imul rcx, rcx, 2
mov rdx, qword [rbp + 0xd8]
lea rdi, [rdx + rcx]
mov rsi, rax
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x20], 0xff
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x5f4]
call fcn.14008d230
mov qword [rbp + 0x928], rax
lea rdx, [rbp + 0x624]
mov rcx, qword [rbp + 0x928]
call fcn.140093ea0
mov ecx, reloc.WS2_32.dll_recv
imul rcx, rcx, 0xa
mov rdx, qword [rbp + 0xd8]
lea rdi, [rdx + rcx]
mov rsi, rax
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x20], 0xff
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x654]
call fcn.14008d230
mov qword [rbp + 0x928], rax
lea rdx, [rbp + 0x684]
mov rcx, qword [rbp + 0x928]
call fcn.140093ea0
mov ecx, reloc.WS2_32.dll_recv
imul rcx, rcx, 0xb
mov rdx, qword [rbp + 0xd8]
lea rdi, [rdx + rcx]
mov rsi, rax
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x20], 0xff
mov r9d, reloc.WLDAP32.dll_Ordinal_33
mov r8d, reloc.WLDAP32.dll_Ordinal_33
mov edx, reloc.WLDAP32.dll_Ordinal_33
lea rcx, [rbp + 0x6b4]
call fcn.14008d230
mov qword [rbp + 0x928], rax
lea rdx, [rbp + 0x6e4]
mov rcx, qword [rbp + 0x928]
call fcn.140093ea0
mov ecx, reloc.WS2_32.dll_recv
imul rcx, rcx, 0x15
mov rdx, qword [rbp + 0xd8]
lea rdi, [rdx + rcx]
mov rsi, rax
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x20], 0xff
mov r9d, reloc.WLDAP32.dll_Ordinal_33
mov r8d, reloc.WLDAP32.dll_Ordinal_33
mov edx, reloc.WLDAP32.dll_Ordinal_33
lea rcx, [rbp + 0x714]
call fcn.14008d230
mov qword [rbp + 0x928], rax
lea rdx, [rbp + 0x744]
mov rcx, qword [rbp + 0x928]
call fcn.140093ea0
mov ecx, reloc.WS2_32.dll_recv
imul rcx, rcx, 0x17
mov rdx, qword [rbp + 0xd8]
lea rdi, [rdx + rcx]
mov rsi, rax
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x20], 0xff
mov r9d, reloc.WLDAP32.dll_Ordinal_41
mov r8d, gethostname
mov edx, 0xb8
lea rcx, [rbp + 0x774]
call fcn.14008d230
mov qword [rbp + 0x928], rax
lea rdx, [rbp + 0x7a4]
mov rcx, qword [rbp + 0x928]
call fcn.140093ea0
mov ecx, reloc.WS2_32.dll_recv
imul rcx, rcx, 0x16
mov rdx, qword [rbp + 0xd8]
lea rdi, [rdx + rcx]
mov rsi, rax
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rbp + 0xb8]
xorps xmm0, xmm0
movss dword [rax + 0xc], xmm0
mov rax, qword [rbp + 0xb8]
xorps xmm0, xmm0
movss dword [rax + 0x28], xmm0
mov rax, qword [rbp + 0xb8]
movss xmm0, dword [0x14031ed1c]
movss dword [rax + 0x40], xmm0
mov rax, qword [rbp + 0xb8]
xorps xmm0, xmm0
movss dword [rax + 0x7c], xmm0
mov rax, qword [rbp + 0xb8]
xorps xmm0, xmm0
movss dword [rax + 0x30], xmm0
mov rax, qword [rbp + 0xb8]
xorps xmm0, xmm0
movss dword [rax + 0x74], xmm0
mov rax, qword [rbp + 0xb8]
xorps xmm0, xmm0
movss dword [rax + 0x84], xmm0
mov rax, qword [rbp + 0xb8]
movss xmm0, dword [0x14031ed20]
movss dword [rax + 0x3c], xmm0
movss xmm2, dword [0x14031ed14]
movss xmm1, dword [0x14031ed14]
lea rcx, [rbp + 0x7d4]
call fcn.14008d2f0
mov rax, qword [rax]
mov rcx, qword [rbp + 0xb8]
mov qword [rcx + 0x94], rax
mov rcx, qword [0x140405680]
call fcn.140114b20
mov rcx, qword [0x140405688]
call fcn.140112440
mov dword [rbp + 0xf4], 0x16a
call qword [sym.imp.USER32.dll_GetDesktopWindow]
lea rdx, [rbp + 0x118]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [0x1403f8018]
mov ecx, dword [rbp + 0x120]
sub ecx, eax
mov eax, ecx
cvtsi2ss xmm0, eax
divss xmm0, dword [0x14031ed1c]
movss dword [rbp + 0x144], xmm0
mov eax, dword [reloc.WLDAP32.dll_Ordinal_200]
mov ecx, dword [rbp + 0x124]
sub ecx, eax
mov eax, ecx
cvtsi2ss xmm0, eax
divss xmm0, dword [0x14031ed1c]
movss dword [rbp + 0x164], xmm0
mov byte [rbp + 0x184], 0
mov byte [rbp + 0x1a4], 1
lea rcx, [0x140405760]
call fcn.1400a9dc0
lea rax, [rbp + 0x1c8]
mov rdi, rax
xor eax, eax
mov ecx, Ordinal_50
rep stosb byte [rdi], al
cmp dword [rbp + 0x1d0], 0x12
je 0x14009d4a9
movzx eax, byte [0x1404055fc]
test eax, eax
jne 0x14009d4a9
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x1c8]
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x14009d113
lea rcx, [rbp + 0x1c8]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x1c8]
call qword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x14009d0ba
call fcn.140112700
call fcn.1401151a0
call fcn.1400e1b60
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rbp + 0x7f4]
call fcn.14008d2f0
mov qword [rbp + 0x928], rax
movss xmm2, dword [rbp + 0x164]
movss xmm1, dword [rbp + 0x144]
lea rcx, [rbp + 0x814]
call fcn.14008d2f0
mov qword [rbp + 0x930], rax
mov r8, qword [rbp + 0x928]
mov edx, 2
mov rcx, qword [rbp + 0x930]
call fcn.1400e8e90
movss xmm2, dword [0x14031ed40]
movss xmm1, dword [0x14031ed3c]
lea rcx, [rbp + 0x834]
call fcn.14008d2f0
xor edx, edx
lea rcx, [rbp + 0x834]
call fcn.1400e8f50
movss xmm0, dword [0x14031ed18]
call fcn.1400e8d30
mov r8d, dword [rbp + 0xf4]
lea rdx, section..data
lea rcx, str.HWID_UNFLAG
call fcn.1400bb860
lea rcx, str.Please_Login
call fcn.14012a4e0
call fcn.140125880
lea rcx, str.Username:
call fcn.14012a4e0
call fcn.140125880
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, reloc.WS2_32.dll_sendto
lea rdx, [0x140405638]
lea rcx, [0x14031da64]
call fcn.14011e740
call fcn.140125880
lea rcx, str.Password:
call fcn.14012a4e0
call fcn.140125880
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0x8000
mov r8d, reloc.WS2_32.dll_sendto
lea rdx, [0x1404055e8]
lea rcx, [0x14031aa48]
call fcn.14011e740
call fcn.140125880
call fcn.140125880
movss xmm2, dword [0x14031ed30]
movss xmm1, dword [0x14031ed34]
lea rcx, [rbp + 0x854]
call fcn.14008d2f0
mov rdx, rax
lea rcx, str.LoginLog
call fcn.14011bff0
movzx eax, al
test eax, eax
je 0x14009d352
lea rax, [rbp + 0x878]
mov qword [rbp + 0x8b8], rax
lea rdx, [0x1404055e8]
mov rcx, qword [rbp + 0x8b8]
call fcn.14008a560
mov qword [rbp + 0x928], rax
mov rax, qword [rbp + 0x928]
mov qword [rbp + 0x930], rax
mov rax, qword [rbp + 0x930]
mov qword [rbp + 0x938], rax
lea rax, [rbp + 0x8d8]
mov qword [rbp + 0x918], rax
lea rdx, [0x140405638]
mov rcx, qword [rbp + 0x918]
call fcn.14008a560
mov qword [rbp + 0x940], rax
mov rax, qword [rbp + 0x940]
mov qword [rbp + 0x948], rax
mov r8, qword [rbp + 0x938]
mov rdx, qword [rbp + 0x948]
lea rcx, [0x140405760]
call fcn.1400abb60
xor r9d, r9d
lea r8, str.Login
lea rdx, str.Login_successful_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov byte [rbp + 0x184], 1
lea rcx, str.Dev:_potatos_._
call fcn.14012a4e0
call fcn.1400d1180
movzx eax, byte [rbp + 0x184]
test eax, eax
je 0x14009d373
call fcn.1400993c0
call fcn.1400d1780
mov rax, qword [0x140405688]
mov rax, qword [rax]
mov rax, qword [rax + 0x158]
mov qword [rbp + 0x928], rax
mov dword [rsp + 0x30], 0
movss xmm0, dword [0x14031ed18]
movss dword [rsp + 0x28], xmm0
mov dword [rsp + 0x20], 0
mov r9d, 3
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x140405688]
call qword [rbp + 0x928]
mov rax, qword [0x140405688]
mov rax, qword [rax]
mov rcx, qword [0x140405688]
call qword [rax + 0x148]
test eax, eax
jl 0x14009d40a
call fcn.1400e3b90
call fcn.1400d5840
mov rcx, rax
call fcn.140112740
mov rax, qword [0x140405688]
mov rax, qword [rax]
mov rcx, qword [0x140405688]
call qword [rax + 0x150]
mov rax, qword [rbp + 0x78]
mov eax, dword [rax]
and eax, 0x400
test eax, eax
je 0x14009d427
call fcn.1400ec890
xor edx, edx
xor ecx, ecx
call fcn.1400e4990
mov rax, qword [0x140405688]
mov rax, qword [rax]
mov rax, qword [rax + 0x88]
mov qword [rbp + 0x928], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x140405688]
call qword [rbp + 0x928]
mov dword [rbp + 0x214], eax
cmp dword [rbp + 0x214], 0x88760868
jne 0x14009d48f
mov rax, qword [0x140405688]
mov rax, qword [rax]
mov rcx, qword [0x140405688]
call qword [rax + Ordinal_26]
cmp eax, 0x88760869
jne 0x14009d48f
call fcn.14009bac0
movzx eax, byte [section..data]
test eax, eax
jne 0x14009d4a4
mov dword [rbp + 0x1d0], reloc.WS2_32.dll_select
jmp 0x14009d0ba
call fcn.140113e90
call fcn.1401159f0
xor ecx, ecx
call fcn.1400c4900
call fcn.140097de0
mov rdx, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.USER32.dll_UnregisterClassW]
mov rdi, rax
lea rcx, [rbp - 0x60]
lea rdx, reloc.WS2_32.dll_connect
call fcn.1402c8bbc
mov rax, rdi
mov rcx, qword [rbp + 0x950]
xor rcx, rbp
call fcn.1402c8f50
lea rsp, [rbp + 0x960]
pop rdi
pop rsi
pop rbp
ret