Function at 0x140001870
Capabilities:
Create thread
Execute command
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0xe0]
sub rsp, 0x1e0
mov rax, qword [0x140008040]
xor rax, rsp
mov qword [rbp + 0xd0], rax
xor r14d, r14d
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
lea rcx, [rbp - 0x80]
call fcn.1400013f0
mov rcx, rax
mov rdx, qword [rax + 0x10]
mov r9, qword [rax + 0x18]
mov rax, r9
sub rax, rdx
cmp rax, 4
jb 0x1400018ff
lea rax, [rdx + 4]
mov qword [rcx + 0x10], rax
mov r8, rcx
cmp r9, 0xf
jbe 0x1400018ed
mov r8, qword [rcx]
mov eax, dword [str..exe]
mov dword [r8 + rdx], eax
mov byte [r8 + rdx + 4], 0
jmp 0x140001915
mov qword [rsp + 0x20], 4
mov edx, 4
call fcn.140002570
mov rcx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r14
movups xmm0, xmmword [rcx]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rcx + 0x10], r14
mov qword [rcx + 0x18], 0xf
mov byte [rcx], 0
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x140001985
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001980
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001980
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002c9c
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], 0
mov r8d, 0x104
lea rdx, [rbp - 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
lea rax, [rbp - 0x40]
mov rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400019c0
movabs rsi, 0x7fffffffffffffff
cmp rbx, rsi
ja 0x140001ebc
cmp rbx, 0xf
ja 0x140001a0b
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], 0xf
mov r8, rbx
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x30], 0
jmp 0x140001aa6
mov rax, rbx
or rax, 0xf
cmp rax, rsi
jbe 0x140001a40
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140002a20
test rax, rax
je 0x140001a75
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140001a84
mov ecx, 0x16
cmp rax, rcx
cmovb rax, rcx
mov rsi, rax
lea rcx, [rax + 1]
test rcx, rcx
jne 0x140001a5d
mov rdi, r14
jmp 0x140001a84
cmp rcx, 0x1000
jb 0x140001a7c
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001ec2
jmp 0x140001a25
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002a20
mov rdi, rax
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
mov r8, rbx
lea rdx, [rbp - 0x40]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rbx], 0
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_rename]
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140001b0e
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001b09
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001b09
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002c9c
mov ecx, 8
call fcn.140002a20
lea rcx, [0x1400015e0]
mov qword [rax], rcx
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r14d
mov r9, rax
lea r8, [0x1400027e0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140001eab
lea rdx, str.___Loader_V1_____n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002040
lea rdx, str.Username:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002040
lea rdi, [0x1400080c0]
mov rdx, rdi
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140002220
lea rdx, str.Password:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002040
lea rbx, [0x140008100]
mov rdx, rbx
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140002220
lea rdx, str._______________________n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002040
lea rdx, str.test
cmp qword [0x140008138], 0xf
cmova rdx, qword [str.test]
cmp qword [0x1400080d8], 0xf
cmova rdi, qword [0x1400080c0]
mov r8, qword [0x1400080d0]
cmp r8, qword [0x140008130]
jne 0x140001e1b
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140001e1b
lea rdx, [0x1400080e0]
cmp qword [0x1400080f8], 0xf
cmova rdx, qword [0x1400080e0]
cmp qword [0x140008118], 0xf
cmova rbx, qword [0x140008100]
mov r8, qword [0x140008110]
cmp r8, qword [0x1400080f0]
jne 0x140001e1b
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140001e1b
lea rdx, str.Login_Details_Correct
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002040
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], 0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x48], 0xf
mov byte [rbp - 0x60], 0
lea rcx, [0x140004578]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
cmp byte [0x1400080b8], 1
jne 0x140001ddd
nop word [rax + rax]
lea rdx, str.1___CSGO__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002040
lea rdx, str.2___TF2__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002040
lea rdx, str.3___GTAV__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002040
lea rdx, str.4___Exit__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002040
lea rdx, str.Enter_your_choice_and_press_return:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002040
lea rdx, [0x140008810]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
mov ecx, dword [0x140008810]
sub ecx, 1
je 0x140001da8
sub ecx, 1
je 0x140001d9f
sub ecx, 1
je 0x140001d96
cmp ecx, 1
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
je 0x140001dca
lea rdx, str.Not_a_valid_choice__try_again.__n
call fcn.140002040
lea rdx, [0x140008810]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
jmp 0x140001dbb
lea rdx, str.GTAV__n
jmp 0x140001daf
lea rdx, str.TF2__n
jmp 0x140001daf
lea rdx, str.CSGO__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002040
cmp byte [0x1400080b8], 1
je 0x140001ce0
jmp 0x140001ddd
lea rdx, str.Exiting_application_...__n
call fcn.140002040
mov byte [0x1400080b8], 0
call qword [sym.imp.KERNEL32.dll_FreeConsole]
cmp dword [rsp + 0x58], 0
je 0x140001e0f
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140001e0f
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x50], xmm0
jmp 0x140001e2f
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
lea rdx, str.Login_Details_False
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002040
nop
cmp dword [rsp + 0x58], 0
je 0x140001e3d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x140001e7d
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001e78
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001e78
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002c9c
xor eax, eax
mov rcx, qword [rbp + 0xd0]
xor rcx, rsp
call fcn.140002a00
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov dword [rsp + 0x58], r14d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
call fcn.140001210
int3
call fcn.140001170
int3