Function at 0x140079be0
Capabilities:
Create thread
Encode data using xor
Execute command
Set console window title
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x48]
sub rsp, 0x120
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
mov rax, qword [0x14012da38]
xor rax, rsp
mov qword [rbp - 0x20], rax
xor r12d, r12d
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
xor r9d, r9d
lea r8d, [r12 + 1]
lea rdx, [rsp + 0x50]
lea rcx, str.1155178542221500476
call fcn.14007cb90
lea edx, [r12 + 1]
lea rcx, [0x14006ccb0]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
lea rcx, str.Color_5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Space_Proxy
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
movups xmm0, xmmword [0x1401005e0]
movups xmmword [rsp + 0x50], xmm0
lea esi, [r12 + 4]
lea r14d, [r12 + 0x1f]
mov ebx, dword [reloc.WS2_32.dll_accept]
psrldq xmm0, 0xf
movd eax, xmm0
test al, al
je 0x140079e30
cmp ebx, 2
jl 0x140079ded
movdqa xmm5, xmmword [0x140100e00]
mov edx, r12d
movdqa xmm4, xmmword [0x140100e40]
movd xmm6, esi
movdqa xmm7, xmmword [str.5555]
movd xmm8, r14d
movdqa xmm0, xmmword [str.1111111111111111]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x54]
mov r8d, dword [rsp + 0x40]
nop word [rax + rax]
movd xmm2, edx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140100e20]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [rdx + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140100e20]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add edx, 8
lea rcx, [rcx + 8]
cmp edx, 0x10
jl 0x140079cf0
jmp 0x140079e30
lea r9, [rsp + 0x50]
mov r8d, r12d
nop word [rax + rax]
mov eax, 0x4d4873ed
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x35
movzx eax, r8b
sub al, cl
add al, 0x31
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x10
jl 0x140079e00
lea rdx, [rsp + 0x50]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000e610
lea rcx, [0x1401332c0]
call fcn.14008cb20
cmp byte [0x1401334d8], r12b
jne 0x140079ecc
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.14006c0e0
movzx ecx, byte [rax + 0xa]
test cl, cl
je 0x140079e9a
xor byte [rax], 0x31
xor byte [rax + 1], 0x32
xor byte [rax + 2], 0x33
xor byte [rax + 3], 0x34
xor byte [rax + 4], 0x35
xor byte [rax + 5], 0x36
xor byte [rax + 6], 0x37
xor byte [rax + 7], 0x38
xor byte [rax + 8], 0x39
xor byte [rax + 9], 0x3a
xor cl, 0x3b
mov byte [rax + 0xa], cl
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000e610
mov rcx, rax
lea rdx, [0x1401334e0]
call fcn.14000e3b0
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, [0x1401332c0]
call fcn.140089f10
test al, al
je 0x140079ee3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
lea rcx, [0x14010063c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], r12
mov edi, reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x58], rdi
mov byte [rbp - 0x70], r12b
movups xmm0, xmmword [0x140100600]
movups xmmword [rsp + 0x50], xmm0
movzx eax, word [0x140100610]
mov word [rsp + 0x60], ax
movzx eax, byte [0x140100612]
mov byte [rsp + 0x62], al
mov r8d, r12d
cmp ebx, 2
jl 0x14007a073
movdqa xmm5, xmmword [0x140100e00]
movdqa xmm4, xmmword [0x140100e40]
movd xmm6, esi
movdqa xmm7, xmmword [str.5555]
movd xmm8, r14d
movdqa xmm0, xmmword [str.1111111111111111]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x54]
mov edx, dword [rsp + 0x40]
nop
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140100e20]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [r8 + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140100e20]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x10
jl 0x140079f70
cmp r8d, 0x13
jge 0x14007a0b0
movsxd rax, r8d
lea r9, [rsp + 0x50]
add r9, rax
nop
mov eax, 0x4d4873ed
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x35
movzx eax, r8b
sub al, cl
add al, 0x31
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x13
jl 0x14007a080
lea rdx, [rsp + 0x50]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000e610
lea rdx, [rbp - 0x70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140065670
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r12
lea r15, [rbp - 0x70]
mov r14, qword [rbp - 0x70]
mov r13, qword [rbp - 0x58]
cmp r13, 0x10
cmovae r15, r14
movabs rbx, 0x7fffffffffffffff
mov rsi, qword [rbp - 0x60]
cmp rsi, rbx
ja 0x14007a72f
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x68], rdi
cmp rsi, 0x10
jae 0x14007a130
mov qword [rsp + 0x60], rsi
movups xmm0, xmmword [r15]
movups xmmword [rsp + 0x50], xmm0
jmp 0x14007a17e
mov rax, rsi
or rax, 0xf
cmp rax, rbx
ja 0x14007a14b
mov rbx, rax
mov ecx, reloc.WS2_32.dll_shutdown
cmp rax, rcx
cmovb rbx, rcx
mov rdx, rbx
add rdx, 1
cmovb rdx, r8
lea rcx, [rsp + 0x50]
call fcn.1400072e0
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rbx
lea r8, [rsi + 1]
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rdx, [rsp + 0x50]
lea rcx, [0x1401332c0]
call fcn.14008e110
cmp byte [0x1401334d8], 0
jne 0x14007a20e
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.14006c5d0
movzx ecx, byte [rax + 0xa]
test cl, cl
je 0x14007a1dc
xor byte [rax], 0x31
xor byte [rax + 1], 0x32
xor byte [rax + 2], 0x33
xor byte [rax + 3], 0x34
xor byte [rax + 4], 0x35
xor byte [rax + 5], 0x36
xor byte [rax + 6], 0x37
xor byte [rax + 7], 0x38
xor byte [rax + 8], 0x39
xor byte [rax + 9], 0x3a
xor cl, 0x3b
mov byte [rax + 0xa], cl
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000e610
mov rcx, rax
lea rdx, [0x1401334e0]
call fcn.14000e3b0
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, [0x14010063c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov r8, r12
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], rdi
mov byte [rbp - 0x50], r8b
mov rbx, qword [0x1401334a0]
mov rsi, qword [0x1401334a8]
cmp rbx, rsi
je 0x14007a2c8
nop dword [rax + rax]
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.14001b3f0
nop
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
lea rcx, [rbp - 0x50]
call fcn.14002d9b0
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x14007a2b7
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007a2b2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007a316
call fcn.1400e16b0
add rbx, 0x20
cmp rbx, rsi
jne 0x14007a250
mov rdi, qword [rbp - 0x38]
mov r8, qword [rbp - 0x40]
lea rcx, [rbp - 0x50]
mov rbx, qword [rbp - 0x50]
cmp rdi, 0x10
cmovae rcx, rbx
cmp r8, 4
jne 0x14007a387
lea rdx, [0x140100640]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14007a387
mov byte [0x140130cd8], 1
lea ecx, [rax + 8]
call fcn.1400e1674
test rax, rax
je 0x14007a31d
lea rcx, [fcn.140046e30]
mov qword [rax], rcx
jmp 0x14007a320
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, r12
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x1400667c0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14007a740
cmp dword [rsp + 0x58], 0
je 0x14007a735
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x14007a735
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x50], xmm0
mov edx, 5
lea rcx, str.Space_Proxy_By_Anowez_n
call fcn.140065640
call fcn.140076bf0
mov ecx, 8
call fcn.1400e1674
test rax, rax
je 0x14007a3b8
lea rcx, [0x140077ad0]
mov qword [rax], rcx
jmp 0x14007a3bb
mov rax, r12
mov qword [rsp + 0x40], rax
lea rcx, [rbp - 0x78]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x1400667c0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x80], rax
test rax, rax
je 0x14007a720
mov ecx, 8
call fcn.1400e1674
test rax, rax
je 0x14007a40a
lea rcx, [0x14006cb60]
mov qword [rax], rcx
jmp 0x14007a40d
mov rax, r12
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x1400667c0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14007a710
cmp dword [rsp + 0x58], 0
je 0x14007a76a
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x14007a76a
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x50], xmm0
lea ecx, [rax + 8]
call fcn.1400e1674
test rax, rax
je 0x14007a48d
lea rcx, [0x1400704b0]
mov qword [rax], rcx
jmp 0x14007a490
mov rax, r12
mov qword [rsp + 0x40], rax
lea rcx, [rbp - 0x28]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x1400667c0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x30], rax
test rax, rax
je 0x14007a75b
call fcn.140071050
cmp byte [0x140132dce], 0
jne 0x14007a4fa
mov edx, 4
lea rcx, str.Failed_to_edit_Hosts_File_n
call fcn.140065640
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov edx, 0xa
lea rcx, str.Successfully_edited_Hosts_file_n
call fcn.140065640
lea rcx, str.Color_5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, ntohl
lea rcx, str._Space_Proxy_
call fcn.140065640
mov edx, 0xa
lea rcx, str.If_Proxy_doesnt_connect_restart_Growtopia_n
call fcn.140065640
mov edx, ntohl
lea rcx, str._Space_Proxy_
call fcn.140065640
mov edx, 0xa
lea rcx, str.Connected__Proxy_Server_n
call fcn.140065640
mov edx, ntohl
lea rcx, str._Space_Proxy_
call fcn.140065640
mov edx, 0xa
lea rcx, str.Server__client_proxy_is_running._n
call fcn.140065640
mov edx, ntohl
lea rcx, str._Space_Proxy_
call fcn.140065640
mov edx, 0xa
lea rcx, str.You_can_now_login_Growtopia_n
call fcn.140065640
mov edx, 7
lea rcx, str._______________________________________________n
call fcn.140065640
mov rcx, qword [0x1401330d0]
call fcn.140065370
test al, al
je 0x14007a631
cmp dword [rbp - 0x78], 0
je 0x14007a750
movaps xmm0, xmmword [rbp - 0x80]
movdqa xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x50]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x14007a750
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x80], xmm0
call fcn.14000dbd0
mov rcx, qword [0x1401330d0]
call fcn.140065490
call fcn.140030e50
mov ecx, 5
call fcn.1400655d0
nop
mov rcx, qword [0x1401330d0]
call fcn.140064530
mov qword [rsp + 0x40], 5
lea rcx, [rsp + 0x40]
call fcn.140019ef0
jmp 0x14007a610
mov edx, 4
lea rcx, str.Failed_to_start_server_or_proxy._n
call fcn.140065640
nop
cmp dword [rbp - 0x28], 0
je 0x14007a650
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
nop
cmp dword [rbp - 0x78], 0
je 0x14007a65d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
nop
cmp rdi, 0x10
jb 0x14007a698
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14007a68f
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007a68f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.1400e16b0
nop
cmp r13, 0x10
jb 0x14007a6d2
lea rdx, [r13 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x14007a6ca
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007a6ca
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.1400e16b0
xor eax, eax
mov rcx, qword [rbp - 0x20]
xor rcx, rsp
call fcn.1400e17d0
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov dword [rsp + 0x58], r12d
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov dword [rbp - 0x78], r12d
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
call fcn.1400053e0
nop
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov dword [rsp + 0x58], r12d
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov dword [rbp - 0x28], r12d
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3