Function at 0x1401247d0
Capabilities:
Contain obfuscated stackstrings
Create thread
Encode data using xor
Execute command
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x140146040]
xor rax, rsp
mov qword [rbp + 0x70], rax
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov word [rsp + 0x3b], 0x79
mov dword [rsp + 0x30], 0x6164654d
mov dword [rsp + 0x34], 0x65764f6c
mov word [rsp + 0x38], 0x6c72
mov byte [rsp + 0x3a], 0x61
mov byte [rsp + 0x3d], bl
mov word [rbp - 0x50], 0x73
movdqa xmm0, xmmword [0x14013c340]
movdqu xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x4e], bl
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x60]
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x1401248b5
movdqa xmm0, xmmword [str.e____5qe_7_4y]
movdqu xmmword [rsp + 0x58], xmm0
mov dword [rsp + 0x68], 0x323c383e
mov dword [rsp + 0x6c], 0x68171471
mov word [rsp + 0x70], 0x100
lea rcx, [rsp + 0x58]
call fcn.140124760
mov rcx, rax
call fcn.14012d590
mov dword [rsp + 0x50], 0x3e8
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x60]
call fcn.140126e20
mov rcx, rax
call fcn.140126e30
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov word [rsp + 0x71], 0x2e
movdqa xmm0, xmmword [0x14013c260]
movdqu xmmword [rsp + 0x58], xmm0
mov dword [rsp + 0x68], 0x5220726f
mov dword [rsp + 0x6c], 0x2e747375
mov byte [rsp + 0x70], 0x2e
mov byte [rsp + 0x73], bl
lea rdx, [rsp + 0x58]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1401270f0
cmp dword [0x140147b48], ebx
jne 0x140124997
mov qword [rbp + 0x60], 0xa
nop dword [rax + rax]
mov word [rsp + 0x53], 0x74
mov word [rsp + 0x50], 0x7552
mov byte [rsp + 0x52], 0x73
mov byte [rsp + 0x55], bl
mov dword [rsp + 0x3a], 0x737361
mov dword [rsp + 0x30], 0x74696e55
mov dword [rsp + 0x34], 0x646e5779
mov word [rsp + 0x38], 0x6c43
mov byte [rsp + 0x3e], bl
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_FindWindowA]
mov rcx, rax
lea rdx, [0x140147b48]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea rax, [rsp + 0x30]
mov qword [0x140147b50], rax
lea rax, [rsp + 0x50]
mov qword [0x140147b58], rax
lea rcx, [rbp + 0x60]
call fcn.140126e30
cmp dword [0x140147b48], ebx
je 0x140124910
mov eax, dword [0x14013b760]
mov dword [rsp + 0x38], eax
movzx eax, word [0x14013b764]
mov word [rsp + 0x3c], ax
movzx eax, byte [0x14013b766]
movsd xmm0, qword [str._FGAu_QTO]
mov byte [rsp + 0x3e], al
movsd qword [rsp + 0x30], xmm0
mov r8d, ebx
cmp dword [0x140146090], 2
jl 0x140124abc
movdqa xmm4, xmmword [0x14013c280]
movdqa xmm2, xmmword [0x14013bc10]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x14013bc30]
psubd xmm2, xmm0
andps xmm2, xmmword [0x14013bc40]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x14013bd90]
movd xmm0, dword [str._FGAu_QTO]
xorps xmm2, xmm0
movd dword [rsp + 0x30], xmm2
movdqa xmm2, xmmword [0x14013bc20]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x14013bc30]
psubd xmm2, xmm0
andps xmm2, xmmword [0x14013bc40]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x14013bd90]
movd xmm0, dword [rsp + 0x34]
xorps xmm2, xmm0
movd dword [rsp + 0x34], xmm2
mov r8d, 8
movsxd rax, r8d
lea r9, [rsp + 0x30]
add r9, rax
nop word [rax + rax]
mov eax, 0x4ec4ec4f
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x34
movzx eax, r8b
sub al, cl
add al, 0x32
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0xf
jl 0x140124ad0
lea rdx, [rsp + 0x30]
call fcn.140111fa0
mov dword [rsp + 0x50], 0x736c63
mov byte [rsp + 0x54], bl
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov word [rsp + 0x40], bx
movdqa xmm0, xmmword [0x14013c320]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rbp + 0x1c], 0x10000
mov eax, dword [0x140147b68]
mov dword [rbp + 0x18], eax
lea rax, [rsp + 0x30]
mov qword [rbp + 0x50], rax
mov byte [rbp + 0x20], bl
lea rcx, [rbp]
call qword [0x140147b60]
mov rax, qword [rbp + 0x58]
mov qword [0x140263aa0], rax
mov dword [rsp + 0x3c], 0x6c6c64
mov dword [rsp + 0x30], 0x74696e55
mov dword [rsp + 0x34], 0x616c5079
mov dword [rsp + 0x38], 0x2e726579
mov byte [rsp + 0x40], bl
mov dword [rbp + 0x1c], 0x10000
mov eax, dword [0x140147b68]
mov dword [rbp + 0x18], eax
lea rax, [rsp + 0x30]
mov qword [rbp + 0x50], rax
mov byte [rbp + 0x20], bl
lea rcx, [rbp]
call qword [0x140147b60]
mov rax, qword [rbp + 0x58]
mov qword [0x140263aa8], rax
mov edx, 0x12c
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 1
call fcn.1401331dc
mov qword [rbp + 0x60], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x14012cc60]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140125823
cmp dword [rsp + 0x38], 0
je 0x140125817
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp + 0x60], xmm0
lea rcx, [rbp + 0x60]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140125817
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
mov ecx, 1
call fcn.1401331dc
mov qword [rbp + 0x60], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x14012cc90]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140125807
cmp dword [rsp + 0x38], 0
je 0x1401257fb
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp + 0x60], xmm0
lea rcx, [rbp + 0x60]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x1401257fb
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
mov ecx, 1
call fcn.1401331dc
mov qword [rbp + 0x60], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x14012ccc0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1401257eb
cmp dword [rsp + 0x38], 0
je 0x1401257df
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp + 0x60], xmm0
lea rcx, [rbp + 0x60]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x1401257df
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
mov ecx, 1
call fcn.1401331dc
mov qword [rbp + 0x60], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x14012ccf0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1401257cf
cmp dword [rsp + 0x38], 0
je 0x1401257c3
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp + 0x60], xmm0
lea rcx, [rbp + 0x60]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x1401257c3
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
mov ecx, 1
call fcn.1401331dc
mov qword [rbp + 0x60], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x14012cd20]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1401257b3
cmp dword [rsp + 0x38], 0
je 0x1401257a7
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp + 0x60], xmm0
lea rcx, [rbp + 0x60]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x1401257a7
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
mov ecx, 1
call fcn.1401331dc
mov qword [rbp + 0x60], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x14012cd50]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140125797
cmp dword [rsp + 0x38], 0
je 0x14012578b
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp + 0x60], xmm0
lea rcx, [rbp + 0x60]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14012578b
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
mov ecx, 1
call fcn.1401331dc
mov qword [rbp + 0x60], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x14012cd90]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14012577b
cmp dword [rsp + 0x38], 0
je 0x14012576f
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp + 0x60], xmm0
lea rcx, [rbp + 0x60]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14012576f
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
mov ecx, 1
call fcn.1401331dc
mov qword [rbp + 0x60], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x14012cdc0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14012575f
cmp dword [rsp + 0x38], 0
je 0x140125753
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp + 0x60], xmm0
lea rcx, [rbp + 0x60]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140125753
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
mov ecx, 1
call fcn.1401331dc
mov qword [rbp + 0x60], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x14012cdf0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140125743
cmp dword [rsp + 0x38], 0
je 0x140125737
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp + 0x60], xmm0
lea rcx, [rbp + 0x60]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140125737
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
mov ecx, 1
call fcn.1401331dc
mov qword [rbp + 0x60], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x14012ce20]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140125727
cmp dword [rsp + 0x38], 0
je 0x14012571b
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp + 0x60], xmm0
lea rcx, [rbp + 0x60]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14012571b
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
mov ecx, 1
call fcn.1401331dc
mov qword [rbp + 0x60], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x14012ce50]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14012570b
cmp dword [rsp + 0x38], 0
je 0x1401256ff
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp + 0x60], xmm0
lea rcx, [rbp + 0x60]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x1401256ff
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
mov ecx, 1
call fcn.1401331dc
mov qword [rbp + 0x60], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x14012ce80]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1401256ef
cmp dword [rsp + 0x38], 0
je 0x1401256e3
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp + 0x60], xmm0
lea rcx, [rbp + 0x60]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x1401256e3
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
mov ecx, 1
call fcn.1401331dc
mov qword [rbp + 0x60], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x14012ceb0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1401256d3
cmp dword [rsp + 0x38], 0
je 0x1401256c7
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp + 0x60], xmm0
lea rcx, [rbp + 0x60]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x1401256c7
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
mov ecx, 1
call fcn.1401331dc
mov qword [rbp + 0x60], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x14012cee0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1401256b7
cmp dword [rsp + 0x38], 0
je 0x1401256ab
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp + 0x60], xmm0
lea rcx, [rbp + 0x60]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x1401256ab
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
mov ecx, 1
call fcn.1401331dc
mov qword [rbp + 0x60], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x14012cf10]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14012569b
cmp dword [rsp + 0x38], 0
je 0x14012568f
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp + 0x60], xmm0
lea rcx, [rbp + 0x60]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14012568f
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
mov ecx, 1
call fcn.1401331dc
mov qword [rbp + 0x60], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x14012cf40]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14012567f
cmp dword [rsp + 0x38], 0
je 0x140125673
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp + 0x60], xmm0
lea rcx, [rbp + 0x60]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140125673
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
mov ecx, 1
call fcn.1401331dc
mov qword [rbp + 0x60], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x14012cf70]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140125663
cmp dword [rsp + 0x38], 0
je 0x140125657
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp + 0x60], xmm0
lea rcx, [rbp + 0x60]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140125657
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
mov ecx, 1
call fcn.1401331dc
mov qword [rbp + 0x60], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x14012cfa0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140125647
cmp dword [rsp + 0x38], 0
je 0x14012563b
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp + 0x60], xmm0
lea rcx, [rbp + 0x60]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14012563b
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
mov ecx, 1
call fcn.1401331dc
mov qword [rbp + 0x60], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x14012cfd0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14012562b
cmp dword [rsp + 0x38], 0
je 0x14012561f
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp + 0x60], xmm0
lea rcx, [rbp + 0x60]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14012561f
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
mov ecx, 1
call fcn.1401331dc
mov qword [rbp + 0x60], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x14012d000]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14012560f
cmp dword [rsp + 0x38], 0
je 0x140125603
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp + 0x60], xmm0
lea rcx, [rbp + 0x60]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140125603
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
lea rax, [rbp - 0x48]
mov qword [rbp + 0x60], rax
lea rcx, vtable.std::_Func_impl_no_alloc_void____cdecl___void___void___.0
mov qword [rbp - 0x48], rcx
lea rax, [0x1401203f0]
mov qword [rbp - 0x40], rax
lea rax, [rbp - 0x48]
mov qword [rbp - 0x10], rax
lea rax, [rbp]
mov qword [rsp + 0x50], rax
mov qword [rbp], rcx
lea rax, [0x140122680]
mov qword [rbp + 8], rax
lea rax, [rbp]
mov qword [rbp + 0x38], rax
lea rax, str.Main
mov qword [rsp + 0x78], rax
lea rax, str.Visuals
mov qword [rbp - 0x80], rax
lea rax, str.Misc
mov qword [rbp - 0x78], rax
lea rax, str.Config
mov qword [rbp - 0x70], rax
movdqu xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], rbx
mov edx, 4
lea rcx, [rsp + 0x58]
call fcn.14012a020
mov rbx, qword [rsp + 0x58]
mov r8d, 0x20
lea rdx, [rsp + 0x78]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
lea rax, [rbx + 0x20]
mov qword [rsp + 0x60], rax
mov word [rsp + 0x3b], 0x79
mov dword [rsp + 0x30], 0x6164654d
mov dword [rsp + 0x34], 0x65764f6c
mov word [rsp + 0x38], 0x6c72
mov byte [rsp + 0x3a], 0x61
mov byte [rsp + 0x3d], 0
mov word [rbp - 0x50], 0x73
movdqa xmm0, xmmword [0x14013c340]
movdqu xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x4e], 0
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x60]
call qword [sym.imp.USER32.dll_FindWindowA]
nop
lea rcx, [rbp - 0x48]
mov qword [rsp + 0x20], rcx
lea r9, [rbp]
lea r8, [rsp + 0x58]
mov rdx, rax
lea rcx, [0x140263a40]
call fcn.14012d840
test al, al
jne 0x1401255e6
mov dword [rsp + 0x3a], 0x216e6f
mov dword [rsp + 0x30], 0x69746f4e
mov dword [rsp + 0x34], 0x61636966
mov word [rsp + 0x38], 0x6974
mov byte [rsp + 0x3e], al
mov dword [rbp - 0x6c], 0x79616c
movdqa xmm0, xmmword [0x14013c270]
movdqu xmmword [rsp + 0x78], xmm0
mov dword [rbp - 0x78], 0x6c616465
mov dword [rbp - 0x74], 0x2076742e
mov dword [rbp - 0x70], 0x7265764f
mov byte [rbp - 0x68], al
xor r9d, r9d
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x78]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.140132f90
mov rbx, qword [rsp + 0x190]
add rsp, 0x180
pop rbp
ret
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x38], ebx
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x38], ebx
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x38], ebx
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x38], ebx
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x38], ebx
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x38], ebx
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x38], ebx
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x38], ebx
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x38], ebx
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x38], ebx
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x38], ebx
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x38], ebx
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x38], ebx
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x38], ebx
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x38], ebx
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x38], ebx
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x38], ebx
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x38], ebx
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x38], ebx
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x38], ebx
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3