Function at 0x140050870
Capabilities:
Create thread
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x478]
sub rsp, 0x550
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
movaps xmmword [rax - 0x78], xmm10
movaps xmmword [rax - 0x88], xmm11
movaps xmmword [rax - 0x98], xmm12
movaps xmmword [rax - 0xa8], xmm13
movaps xmmword [rax - 0xb8], xmm14
movaps xmmword [rax - 0xc8], xmm15
mov rax, qword [0x140399540]
xor rax, rsp
mov qword [rbp + 0x3a0], rax
xor r14d, r14d
mov dword [rbp - 0x80], r14d
mov dword [rbp + 0x140], 0x50
mov dword [rbp + 0x144], 0x40
lea rax, [0x14004e2c0]
mov qword [rbp + 0x148], rax
mov qword [rbp + 0x150], r14
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rbp + 0x158], rax
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x160], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x170], xmm1
lea rbx, str.Loaders
mov qword [rbp + 0x180], rbx
mov qword [rbp + 0x188], r14
lea rcx, [rbp + 0x140]
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov qword [rsp + 0x58], r14
mov rax, qword [rbp + 0x158]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x38], 5
mov dword [rsp + 0x30], 5
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
mov r9d, 0x80000000
mov r8, rbx
mov rdx, qword [rbp + 0x180]
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rbx, rax
mov qword [0x140399ee8], rax
lea ecx, [r14 + 0x20]
call sub.d3d9.dll_Direct3DCreate9
mov rcx, rax
mov qword [0x140399ef8], rax
test rax, rax
je 0x14004e1df
mov qword [0x140399f00], r14
mov qword [0x140399f0c], r14
mov dword [0x140399f14], r14d
mov qword [0x140399f1c], r14
mov dword [0x140399f24], r14d
mov qword [0x140399f34], r14
mov dword [0x140399f28], 1
mov dword [0x140399f18], 1
mov dword [0x140399f08], r14d
mov dword [0x140399f2c], 1
mov dword [0x140399f30], 0x50
mov dword [0x140399f3c], 1
mov rax, qword [rax]
lea rdx, [0x140399ef0]
mov qword [rsp + 0x30], rdx
lea r13, [0x140399f00]
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], 0x40
mov r9, rbx
xor edx, edx
lea r8d, [r14 + 1]
call qword [rax + 0x80]
test eax, eax
js 0x14004e1d8
xor edx, edx
mov rcx, qword [0x140399ee8]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x140399ee8]
call qword [sym.imp.USER32.dll_UpdateWindow]
call qword [sym.imp.KERNEL32.dll_AllocConsole]
xor edx, edx
lea rcx, str.ConsoleWindowClass
call qword [sym.imp.USER32.dll_FindWindowA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
xor ecx, ecx
call fcn.14000b140
call fcn.140015e70
mov rsi, rax
mov qword [rax + 0x18], r14
or dword [rax], 0x400
lea rcx, [rbp + 0x310]
call fcn.140027880
mov byte [rbp + 0x358], 1
mov byte [rbp + 0x330], 1
mov dword [rbp + 0x328], 3
mov dword [rbp + 0x32c], 3
lea rax, [rbp + 0x198]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x60], r14
mov dword [rsp + 0x58], r14d
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0xffffffff
mov dword [rsp + 0x40], r14d
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], 0xffffffff
mov dword [rsp + 0x20], 0x2710
mov r9d, 0x2710
mov r8d, 0x31a56
lea rdx, [0x140131270]
mov rcx, qword [0x140399ef0]
call sub.d3dx9_43.dll_D3DXCreateTextureFromFileInMemoryEx
lea rax, [rbp + 0x190]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x60], r14
mov dword [rsp + 0x58], r14d
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0xffffffff
mov dword [rsp + 0x40], r14d
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], 0xffffffff
mov dword [rsp + 0x20], 0x2710
mov r9d, 0x2710
mov r8d, 0x8cf24
lea rdx, [0x140162cd0]
mov rcx, qword [0x140399ef0]
call sub.d3dx9_43.dll_D3DXCreateTextureFromFileInMemoryEx
lea rax, [rbp + 0x138]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x60], r14
mov dword [rsp + 0x58], r14d
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0xffffffff
mov dword [rsp + 0x40], r14d
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], 0xffffffff
mov dword [rsp + 0x20], 0x2710
mov r9d, 0x2710
mov r8d, 0xb72fe
lea rdx, [0x1401efc00]
mov rcx, qword [0x140399ef0]
call sub.d3dx9_43.dll_D3DXCreateTextureFromFileInMemoryEx
lea rax, [rbp + 0x130]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x60], r14
mov dword [rsp + 0x58], r14d
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0xffffffff
mov dword [rsp + 0x40], r14d
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], 0xffffffff
mov dword [rsp + 0x20], 0x2710
mov r9d, 0x2710
mov r8d, 0x53b0c
lea rdx, [0x1402a6f00]
mov rcx, qword [0x140399ef0]
call sub.d3dx9_43.dll_D3DXCreateTextureFromFileInMemoryEx
mov rbx, qword [rsi + 0xa0]
mov rcx, rbx
call fcn.14002b070
mov qword [rsp + 0x20], rax
xor r9d, r9d
movss xmm6, dword [0x1400eafdc]
movaps xmm2, xmm6
lea rdx, str.C:WindowsFonts_tahomabd.ttf
mov rcx, rbx
call fcn.1400286e0
test rax, rax
jne 0x14004d263
mov rbx, qword [rsi + 0xa0]
mov rcx, rbx
call fcn.14002b070
mov qword [rsp + 0x20], rax
xor r9d, r9d
movaps xmm2, xmm6
lea rdx, str.C:WindowsFonts_tahomabd.ttf
mov rcx, rbx
call fcn.1400286e0
lea rbx, [0x14010d9a0]
mov qword [rsp + 0x28], rbx
lea rax, [rbp + 0x310]
mov qword [rsp + 0x20], rax
movss xmm6, dword [0x14010dbb0]
movaps xmm3, xmm6
mov r8d, 0x1e695
lea rdx, [0x1400ef170]
mov rcx, qword [rsi + 0xa0]
call fcn.1400289c0
mov qword [rsp + 0x28], rbx
lea rax, [rbp + 0x310]
mov qword [rsp + 0x20], rax
movaps xmm3, xmm6
mov r8d, 0x1e695
lea rdx, [0x1400ef170]
mov rcx, qword [rsi + 0xa0]
call fcn.1400289c0
call fcn.140016420
mov dword [rax + 0xc], 0x41700000
mov dword [rax + 0x38], 0x40a00000
mov dword [rax + 0x3c], 0x40a00000
mov dword [rax + 0x40], 0x40800000
mov dword [rax + 0x48], 0x41400000
mov dword [rax + 0x4c], 0x41000000
mov dword [rax + 0x50], 0x41000000
mov dword [rax + 0x54], 0x40c00000
mov dword [rax + 0x68], 0x41c80000
mov dword [rax + 0x70], 0x41700000
mov dword [rax + 0x74], 0x41100000
mov dword [rax + 0x78], 0x40a00000
mov dword [rax + 0x7c], 0x40400000
mov dword [rax + 0x28], 0x40a00000
mov dword [rax + 0x2c], 0x3f800000
mov dword [rax + 0xf4], 0x3ed2d2d3
mov dword [rax + 0xf8], 0x3ed2d2d3
mov dword [rax + 0xfc], 0x3ed2d2d3
mov dword [rax + 0x100], 0x3e48c8c9
mov dword [rax + 0xc4], 0x3f4ccccd
mov dword [rax + 0xc8], 0x3f4ccccd
mov dword [rax + 0xcc], 0x3f547ae1
mov dword [rax + 0xd0], 0x3f800000
mov dword [rax + 0xd4], 0x3e75c28f
mov dword [rax + 0xd8], 0x3e6b851f
mov dword [rax + 0xdc], 0x3e947ae1
mov dword [rax + 0xe0], 0x3f800000
mov dword [rax + 0xe4], 0x3d75c28f
mov dword [rax + 0xe8], 0x3d4ccccd
mov dword [rax + 0xec], 0x3d8f5c29
mov dword [rax + 0xf0], 0x3f800000
mov dword [rax + 0x104], 0x3d8f5c29
mov dword [rax + 0x108], 0x3d8f5c29
mov dword [rax + 0x10c], 0x3db851ec
mov dword [rax + 0x110], 0x3f800000
mov dword [rax + 0x124], 0x3f6b851f
mov dword [rax + 0x128], 0x3f68f5c3
mov qword [rax + 0x12c], 0x3f6147ae
mov dword [rax + 0x134], 0x3e34b4b5
mov dword [rax + 0x138], 0x3d989899
mov dword [rax + 0x13c], 0x3ea4a4a5
mov dword [rax + 0x140], 0x3efafafb
mov dword [rax + 0x144], 0x3e34b4b5
mov dword [rax + 0x148], 0x3d989899
mov dword [rax + 0x14c], 0x3ea4a4a5
mov dword [rax + 0x150], 0x3f61e1e2
mov dword [rax + 0x154], 0x3e34b4b5
mov dword [rax + 0x158], 0x3d989899
mov dword [rax + 0x15c], 0x3ea4a4a5
mov dword [rax + 0x160], 0x3f61e1e2
mov dword [rax + 0x164], 0x3dcccccd
mov dword [rax + 0x168], 0x3db851ec
mov dword [rax + 0x16c], 0x3df5c28f
mov dword [rax + 0x170], 0x3f800000
mov dword [rax + 0x184], 0x3f800000
mov dword [rax + 0x188], 0x3f7ae148
mov dword [rax + 0x18c], 0x3f733333
mov dword [rax + 0x190], 0x3f400000
mov dword [rax + 0x174], 0x3d8f5c29
mov dword [rax + 0x178], 0x3d8f5c29
mov dword [rax + 0x17c], 0x3db851ec
mov dword [rax + 0x180], 0x3f800000
mov dword [rax + 0x194], 0x3dcccccd
mov dword [rax + 0x198], 0x3db851ec
mov dword [rax + 0x19c], 0x3df5c28f
mov dword [rax + 0x1a0], 0x3f800000
mov dword [rax + 0x1a4], 0x3dcccccd
mov dword [rax + 0x1a8], 0x3db851ec
mov dword [rax + 0x1ac], 0x3df5c28f
mov dword [rax + 0x1b0], 0x3f800000
mov dword [rax + 0x1b4], 0x3f4ccccd
mov dword [rax + 0x1b8], 0x3f4ccccd
mov dword [rax + 0x1bc], 0x3f547ae1
mov dword [rax + 0x1c0], 0x3e9eb852
mov dword [rax + 0x1c4], 0x3f0f5c29
mov dword [rax + 0x1c8], 0x3f0f5c29
mov dword [rax + 0x1cc], 0x3f147ae1
mov dword [rax + 0x1d0], 0x3f800000
mov dword [rax + 0x1d4], 0x3d75c28f
mov dword [rax + 0x1d8], 0x3d4ccccd
mov dword [rax + 0x1dc], 0x3d8f5c29
mov dword [rax + 0x1e0], 0x3f800000
mov dword [rax + 0x1e4], 0x3f4ccccd
mov dword [rax + 0x1e8], 0x3f4ccccd
mov dword [rax + 0x1ec], 0x3f547ae1
mov dword [rax + 0x1f0], 0x3e9eb852
mov dword [rax + 0x1f4], 0x3f4ccccd
mov dword [rax + 0x1f8], 0x3f4ccccd
mov dword [rax + 0x1fc], 0x3f547ae1
mov dword [rax + 0x200], 0x3e9eb852
mov dword [rax + 0x204], 0x3d75c28f
mov dword [rax + 0x208], 0x3d4ccccd
mov dword [rax + 0x20c], 0x3d8f5c29
mov dword [rax + 0x210], 0x3f800000
mov dword [rax + 0x244], 0x3dcccccd
mov dword [rax + 0x248], 0x3db851ec
mov dword [rax + 0x24c], 0x3df5c28f
mov dword [rax + 0x250], 0x3f800000
mov dword [rax + 0x254], 0x3f0f5c29
mov dword [rax + 0x258], 0x3f0f5c29
mov dword [rax + 0x25c], 0x3f147ae1
mov dword [rax + 0x260], 0x3f800000
mov dword [rax + 0x264], 0x3d75c28f
mov dword [rax + 0x268], 0x3d4ccccd
mov dword [rax + 0x26c], 0x3d8f5c29
mov dword [rax + 0x270], 0x3f800000
mov qword [rax + 0x2a4], r14
mov qword [rax + 0x2ac], r14
mov dword [rax + 0x2b4], 0x3f0f5c29
mov dword [rax + 0x2b8], 0x3f0f5c29
mov dword [rax + 0x2bc], 0x3f147ae1
mov dword [rax + 0x2c0], 0x3f800000
mov dword [rax + 0x2c4], 0x3d75c28f
mov dword [rax + 0x2c8], 0x3d4ccccd
mov dword [rax + 0x2cc], 0x3d8f5c29
mov dword [rax + 0x2d0], 0x3f800000
mov dword [rax + 0x344], 0x3ecccccd
mov dword [rax + 0x348], 0x3ec7ae14
mov dword [rax + 0x34c], 0x3ec28f5c
mov dword [rax + 0x350], 0x3f2147ae
mov dword [rax + 0x354], 0x3e800000
mov qword [rax + 0x358], 0x3f800000
mov dword [rax + 0x360], 0x3f800000
mov dword [rax + 0x364], 0x3ecccccd
mov dword [rax + 0x368], 0x3ec7ae14
mov dword [rax + 0x36c], 0x3ec28f5c
mov dword [rax + 0x370], 0x3f2147ae
mov dword [rax + 0x374], 0x3e800000
mov qword [rax + 0x378], 0x3f800000
mov dword [rax + 0x380], 0x3f800000
mov dword [rax + 0x3d4], 0x3e800000
mov qword [rax + 0x3d8], 0x3f800000
mov dword [rax + 0x3e0], 0x3edc28f6
call fcn.140016420
mov dword [rax + 0xc], 0x40800000
mov rcx, qword [0x140399ee8]
call fcn.14003a130
mov rcx, qword [0x140399ef0]
call fcn.140038c00
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
lea rdx, [rbp + 0x1a0]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rbp + 0x1a8]
sub eax, dword [0x140381350]
movd xmm1, eax
cvtdq2ps xmm1, xmm1
mulss xmm1, dword [0x1400eae44]
movss dword [rbp - 0x7c], xmm1
mov eax, dword [rbp + 0x1ac]
sub eax, dword [0x140381354]
movd xmm1, eax
cvtdq2ps xmm1, xmm1
mulss xmm1, dword [0x1400eae44]
movss dword [rbp - 0x78], xmm1
mov edi, r14d
xorps xmm0, xmm0
movups xmmword [rbp + 0x1b0], xmm0
movups xmmword [rbp + 0x1c0], xmm0
movups xmmword [rbp + 0x1d0], xmm0
lea rcx, [0x140399fb0]
call fcn.14007c590
lea rcx, [0x140399fb0]
call fcn.140073560
test al, al
je 0x14004d88e
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
cmp dword [rbp + 0x1b8], 0x12
je 0x14004e168
lea r15, [0x140399df8]
lea r12, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
movss xmm6, dword [0x1400eae74]
movss xmm8, dword [0x14010dba0]
movss xmm11, dword [0x1400eafe8]
movss xmm7, dword [0x1400eae1c]
movss xmm12, dword [0x14010dbac]
movss xmm13, dword [0x1400eaeb8]
movss xmm14, dword [0x1400eafe4]
movss xmm15, dword [0x14010dbb4]
movss xmm9, dword [0x14010dbb8]
movss xmm10, dword [0x14010dbbc]
nop dword [rax]
nop word [rax + rax]
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x14004d950
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x14004e15b
call fcn.140038dd0
call fcn.14003a4f0
call fcn.14001c1a0
movaps xmm1, xmm6
mov ecx, reloc.WLDAP32.dll_Ordinal_22
call fcn.140015920
mov ebx, eax
mov qword [rbp - 0x74], 0
movss xmm0, dword [rbp - 0x7c]
movss dword [rbp - 0x6c], xmm0
movss xmm0, dword [rbp - 0x78]
movss dword [rbp - 0x68], xmm0
lea r8, [rbp - 0x74]
mov edx, 2
lea rcx, [rbp - 0x6c]
call fcn.140021f40
movd xmm1, dword [0x140381354]
cvtdq2ps xmm1, xmm1
movd xmm0, dword [0x140381350]
cvtdq2ps xmm0, xmm0
movss dword [rbp - 0x64], xmm0
movss dword [rbp - 0x60], xmm1
xor edx, edx
lea rcx, [rbp - 0x64]
call fcn.140021f90
movaps xmm0, xmm6
call fcn.140021f20
movaps xmm1, xmm6
xor ecx, ecx
call fcn.14001dfd0
mov r8d, 0x179
lea rdx, [0x140131268]
lea rcx, [0x1400eafcc]
call fcn.140005a10
cmp byte [0x140399dba], 0
je 0x14004da00
call fcn.14004ca20
call fcn.140015a70
lea rcx, [rbp + 0x1f0]
call fcn.140016810
lea rcx, [rbp + 0x1e0]
call fcn.140016830
test edi, edi
jne 0x14004db23
mov byte [0x140399db8], 1
call fcn.140015e70
movss xmm0, dword [0x140381368]
mulss xmm0, xmm8
mulss xmm0, dword [rax + 0x10]
movss xmm1, dword [0x14039ac30]
addss xmm1, xmm0
movss dword [0x14039ac30], xmm1
cmp byte [0x140399db8], dil
je 0x14004db0c
movaps xmm0, xmm11
call fcn.140021f00
mov dword [rbp - 0x5c], 0x43e10000
mov dword [rbp - 0x58], 0x437a0000
lea rcx, [rbp - 0x5c]
call fcn.140021ba0
movzx eax, bl
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
mulss xmm0, xmm7
movss dword [rbp + 0x50], xmm0
mov eax, ebx
shr eax, 8
movzx eax, al
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
mulss xmm0, xmm7
movss dword [rbp + 0x54], xmm0
mov eax, ebx
shr eax, 0x10
movzx eax, al
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
mulss xmm0, xmm7
movss dword [rbp + 0x58], xmm0
shr ebx, 0x18
mov eax, ebx
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
mulss xmm0, xmm7
movss dword [rbp + 0x5c], xmm0
mov byte [rsp + 0x28], 1
movss dword [rsp + 0x20], xmm12
lea r9, [rbp + 0x50]
movaps xmm2, xmm13
movaps xmm1, xmm14
lea rcx, str.spinner
call fcn.14004b980
movss xmm1, dword [0x14039ac30]
comiss xmm1, xmm6
jb 0x14004de2f
mov byte [0x140399dba], 1
mov edi, 1
jmp 0x14004db2c
cmp edi, 1
jne 0x14004de2f
mov dword [rbp - 0x54], 0x43aa0000
mov dword [rbp - 0x50], 0x42480000
lea rcx, [rbp - 0x54]
call fcn.140021ba0
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
movaps xmm1, xmmword [0x1400eb000]
movups xmmword [rbp + 0xb0], xmm1
mov dword [rbp - 0x4c], 0x3f800000
mov dword [rbp - 0x48], 0x3f800000
mov qword [rbp - 0x44], 0
mov dword [rbp - 0x3c], 0x43d20000
mov dword [rbp - 0x38], 0x439b0000
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x4c]
lea r8, [rbp - 0x44]
lea rdx, [rbp - 0x3c]
mov rcx, qword [rbp + 0x130]
call fcn.14003f070
mov dword [rbp - 0x34], 0x43ca8000
mov dword [rbp - 0x30], 0x43a00000
lea rcx, [rbp - 0x34]
call fcn.140021ba0
movaps xmm0, xmm15
call fcn.140021f00
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea r8d, [r9 + 0x32]
mov rdx, r15
lea rcx, str.KeyKeylogin
call fcn.14003f300
mov dword [rbp - 0x2c], 0x43ed8000
mov dword [rbp - 0x28], 0x43b90000
lea rcx, [rbp - 0x2c]
call fcn.140021ba0
mov dword [rbp - 0x24], 0x43020000
mov dword [rbp - 0x20], 0x42200000
lea rdx, [rbp - 0x24]
lea rcx, [0x14010daa8]
call fcn.14003dfc0
test al, al
je 0x14004ddbe
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x200]
call sub.VCRUNTIME140.dll_memset
lea rax, [0x14010da38]
mov qword [rbp + 0x200], rax
lea rcx, [rbp + 0x2a8]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
or dword [rbp - 0x80], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x208]
lea rcx, [rbp + 0x200]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rbp + 0x200]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x200], r12
mov rax, qword [rbp + 0x200]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x1fc], edx
lea rcx, [rbp + 0x208]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rbp + 0x208], rax
mov byte [rbp + 0x284], 0
mov byte [rbp + 0x279], 0
lea rcx, [rbp + 0x208]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov qword [rbp + 0x288], r14
mov rax, qword [0x14039ac38]
mov qword [rbp + 0x27c], rax
mov qword [rbp + 0x270], r14
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
mov qword [rbp + 0x70], r14
mov qword [rbp + 0x78], r14
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [r15 + r8], 0
jne 0x14004dd10
mov rdx, r15
lea rcx, [rbp + 0x60]
call fcn.140048b80
lea rdx, [rbp + 0x60]
lea rcx, [0x140399fb0]
call fcn.140086170
cmp byte [0x14039a1c0], 0
jl 0x14004e197
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8, [fcn.140005010]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov byte [0x140399dba], 0
mov edi, 2
mov rax, qword [rbp + 0x200]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x200], r12
mov rax, qword [rbp + 0x200]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x1fc], edx
lea rcx, [rbp + 0x208]
call fcn.140049770
lea rcx, [rbp + 0x210]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x2a8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], r14
mov qword [rbp + 0x98], r14
mov r8d, 5
lea rdx, str.Login
lea rcx, [rbp + 0x80]
call fcn.140048b80
movaps xmm0, xmmword [0x14010dc30]
movaps xmmword [rbp + 0x30], xmm0
movaps xmm1, xmmword [0x14010dc40]
movaps xmmword [rbp + 0xc0], xmm1
mov byte [rsp + 0x28], 1
movss dword [rsp + 0x20], xmm9
movaps xmm3, xmm10
lea r8, [rbp + 0x30]
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0x80]
call fcn.14004c6a0
movzx eax, byte [0x140399df3]
nop
test al, al
jne 0x14004e1b3
cmp edi, 2
jne 0x14004e07c
mov dword [rbp - 0x1c], 0x43be0000
mov dword [rbp - 0x18], 0x44098000
lea rcx, [rbp - 0x1c]
call fcn.140021ba0
xor ecx, ecx
call fcn.140017860
test al, al
je 0x14004de72
lea ecx, [rdi + 5]
call fcn.140021ea0
mov dword [rbp - 0x14], 0x43b28000
mov dword [rbp - 0x10], 0x42fa0000
lea rdx, [rbp - 0x14]
lea rcx, str.RUN
call fcn.14003dfc0
test al, al
je 0x14004dfa3
movzx eax, byte [0x140399dbf]
nop
test al, al
je 0x14004defe
mov eax, r14d
xchg byte [0x140399dbf], al
cmp dword [0x140399f68], 0
je 0x14004dfa3
call sub.MSVCP140.dll__Thrd_id
cmp dword [0x140399f68], eax
je 0x14004e2af
movups xmm0, xmmword [0x140399f60]
movaps xmmword [rbp + 0xd0], xmm0
xor edx, edx
lea rcx, [rbp + 0xd0]
call sub.MSVCP140.dll__Thrd_join
test eax, eax
jne 0x14004e2a4
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
jmp 0x14004df9c
mov eax, 1
xchg byte [0x140399dbf], al
mov ecx, 1
xchg byte [0x140399df2], cl
mov eax, r14d
xchg byte [0x140399df3], al
mov ecx, 8
call fcn.1400e2f8c
test rax, rax
je 0x14004df38
lea rcx, [0x14004e7c0]
mov qword [rax], rcx
jmp 0x14004df3b
mov rax, r14
mov qword [rbp + 0x1e8], rax
or dword [rbp - 0x80], 2
lea rcx, [rbp + 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r14d
mov r9, rax
lea r8, [0x140048fb0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x40], rax
test rax, rax
je 0x14004e295
cmp dword [0x140399f68], 0
jne 0x14004e1a0
xorps xmm1, xmm1
movaps xmmword [rbp + 0x110], xmm1
movaps xmm0, xmmword [rbp + 0x40]
movaps xmmword [rbp + 0x120], xmm0
movdqa xmmword [rbp + 0x40], xmm1
movups xmmword [0x140399f60], xmm0
mov dword [rbp - 0xc], 0x43e38000
mov dword [rbp - 8], 0x442f0000
lea rcx, [rbp - 0xc]
call fcn.140021ba0
xor ecx, ecx
call fcn.140017860
test al, al
je 0x14004dfcf
mov ecx, 7
call fcn.140021ea0
mov dword [rbp - 4], 0x43400000
mov dword [rbp], 0x42840000
lea rdx, [rbp - 4]
lea rcx, str.EXIT
call fcn.14003dfc0
mov qword [rbp + 4], 0
lea rcx, [rbp + 4]
call fcn.140021ba0
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
movaps xmm1, xmmword [0x1400eb000]
movups xmmword [rbp + 0xf0], xmm1
mov dword [rbp + 0xc], 0x3f800000
mov dword [rbp + 0x10], 0x3f800000
mov qword [rbp + 0x14], 0
movd xmm0, dword [0x140381350]
cvtdq2ps xmm0, xmm0
movss dword [rbp + 0x1c], xmm0
movd xmm1, dword [0x140381354]
cvtdq2ps xmm1, xmm1
movss dword [rbp + 0x20], xmm1
lea rax, [rbp + 0xe0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xc]
lea r8, [rbp + 0x14]
lea rdx, [rbp + 0x1c]
mov rcx, qword [rbp + 0x138]
call fcn.14003f070
call fcn.140013270
call fcn.1400137f0
mov rcx, qword [0x140399ef0]
mov rax, qword [rcx]
mov dword [rsp + 0x30], r14d
movss dword [rsp + 0x28], xmm6
mov dword [rsp + 0x20], r14d
mov r9d, 3
xor r8d, r8d
xor edx, edx
call qword [rax + 0x158]
mov rcx, qword [0x140399ef0]
mov rax, qword [rcx]
call qword [rax + 0x148]
test eax, eax
js 0x14004e0e7
call fcn.14001e0f0
call fcn.1400159e0
mov rcx, rax
call fcn.140038e60
mov rcx, qword [0x140399ef0]
mov rax, qword [rcx]
call qword [rax + 0x150]
test dword [rsi], 0x400
je 0x14004e0fd
call fcn.140023f10
xor edx, edx
xor ecx, ecx
call fcn.14001ed10
mov rcx, qword [0x140399ef0]
mov rax, qword [rcx]
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [rax + 0x88]
cmp eax, 0x88760868
jne 0x14004e152
mov rcx, qword [0x140399ef0]
mov rax, qword [rcx]
call qword [rax + Ordinal_26]
cmp eax, 0x88760869
jne 0x14004e152
call fcn.140038ca0
mov rcx, qword [0x140399ef0]
mov rax, qword [rcx]
mov rdx, r13
call qword [rax + 0x80]
call fcn.140038860
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x14004e1a7
cmp dword [rbp + 0x1b8], 0x12
jne 0x14004d910
call fcn.140039ab0
call fcn.14003aaf0
xor ecx, ecx
call fcn.14000b600
call fcn.14004a3c0
mov rdx, qword [rbp + 0x158]
mov rcx, qword [rbp + 0x180]
call qword [sym.imp.USER32.dll_UnregisterClassW]
jmp 0x14004e22d
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
mov dword [rbp + 0x1b8], reloc.WS2_32.dll_select
jmp 0x14004e168
mov r9d, 0x40
lea r8, str.12BITSTORE
lea rdx, str.RUN_CMD__PREMIUM_INTERNET_SUCCESSFULLY_THANKS_FOR_USED_MY_CMD__SETTING.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [0x140399ef8]
mov rdx, qword [0x140399ef0]
test rdx, rdx
je 0x14004e202
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [0x140399ef0], r14
mov rcx, qword [0x140399ef8]
test rcx, rcx
je 0x14004e214
mov rdx, qword [rcx]
call qword [rdx + reloc.WS2_32.dll_recv]
mov qword [0x140399ef8], r14
mov rdx, qword [rbp + 0x158]
mov rcx, qword [rbp + 0x180]
call qword [sym.imp.USER32.dll_UnregisterClassW]
mov eax, 1
mov rcx, qword [rbp + 0x3a0]
xor rcx, rsp
call fcn.1400e2d60
lea r11, [rsp + 0x550]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm12, xmmword [r11 - 0x70]
movaps xmm13, xmmword [r11 - 0x80]
movaps xmm14, xmmword [r11 - 0x90]
movaps xmm15, xmmword [r11 - 0xa0]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov dword [rbp + 0x48], r14d
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov ecx, 2
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
mov ecx, 5
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
jmp 0x14004cde0