Function at 0x1400051c0
Capabilities:
Contain obfuscated stackstrings
Delete file
Enumerate gui resources
Execute command
Get common file path
Set console window title
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x3c0]
sub rsp, 0x4c0
mov rax, qword [0x140116080]
xor rax, rsp
mov qword [rbp + 0x3b0], rax
xor r15d, r15d
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
mov word [rbp + 8], 0x2066
mov byte [rbp + 0xa], r15b
xorps xmm0, xmm0
movups xmmword [rbp + 0x120], xmm0
mov qword [rbp + 0x130], r15
mov qword [rbp + 0x138], r15
lea rax, [rbp + 9]
mov rsi, 0xffffffffffffffff
mov r8, rsi
inc r8
cmp byte [rax + r8], r15b
jne 0x140005277
lea rdx, [rbp + 9]
lea rcx, [rbp + 0x120]
call fcn.14000bb30
nop
lea rcx, [rbp + 0x120]
cmp qword [rbp + 0x138], 0xf
cmova rcx, qword [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
lea rcx, [0x1403f5010]
call fcn.140085520
xor edx, edx
lea rcx, [0x140004890]
cmp byte [0x1403f5220], dl
jne 0x1400053d8
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
lea rcx, [0x1400eebb8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rsp + 0x40]
call fcn.140006e50
lea rdx, [rax + 1]
movzx r8d, byte [rax]
xor byte [rdx], r8b
xor byte [rax + 2], r8b
xor byte [rax + 3], r8b
xor byte [rax + 4], r8b
xor byte [rax + 5], r8b
xor byte [rax + 6], r8b
xor byte [rax + 7], r8b
xor byte [rax + 8], r8b
xor byte [rax + 9], r8b
xor byte [rdx + 9], r8b
mov byte [rdx + 0xa], 0
call fcn.14000acb0
mov rcx, rax
lea rdx, [0x1403f5228]
call fcn.14000ae80
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
mov dword [rbp + 0x140], 0x54
lea r8, [rbp + 0x140]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentConsoleFontEx]
mov dword [rbp + 0x148], 0xd000d
lea r8, [rbp + 0x140]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetCurrentConsoleFontEx]
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x1a]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xorps xmm0, xmm0
test eax, eax
js 0x140005517
movups xmmword [rbp + 0x100], xmm0
mov qword [rbp + 0x110], r15
mov qword [rbp + 0x118], r15
lea rax, [rbp + 0x1a0]
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400054b0
lea rdx, [rbp + 0x1a0]
lea rcx, [rbp + 0x100]
call fcn.14000b660
nop
lea rcx, [rbp + 0x100]
mov rax, qword [rbp + 0x110]
cmp qword [rbp + 0x118], 7
jbe 0x1400054f4
mov rdx, qword [rbp + 0x100]
lea r8, [rdx + rax*2]
jmp 0x1400054ff
lea r8, [rcx + rax*2]
lea rdx, [rbp + 0x100]
lea rcx, [rbp + 0x10]
call fcn.14000a7a0
nop
lea rcx, [rbp + 0x100]
call fcn.140009cf0
jmp 0x140005537
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], r15
mov qword [rbp + 0x28], r15
xor r8d, r8d
lea rdx, [0x1400eeb08]
lea rcx, [rbp + 0x10]
call fcn.14000bb30
nop
movdqa xmm0, xmmword [0x140100940]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0x736a2e64
mov word [rsp + 0x54], 0x6e6f
mov byte [rsp + 0x56], 0
lea rax, [rsp + 0x41]
mov rcx, rsi
inc rcx
cmp byte [rax + rcx], 0
jne 0x140005561
movabs r14, 0x7fffffffffffffff
mov rax, r14
mov rdx, qword [rbp + 0x20]
sub rax, rdx
cmp rax, rcx
jb 0x140006df3
lea r9, [rbp + 0x10]
cmp qword [rbp + 0x28], 0xf
cmova r9, qword [rbp + 0x10]
mov qword [rsp + 0x30], rcx
lea rax, [rsp + 0x41]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea rcx, [rbp + 0x30]
call fcn.14000d310
nop
lea rax, [rbp + 0x30]
cmp qword [rbp + 0x48], 0xf
cmova rax, qword [rbp + 0x30]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp + 0x40]
mov qword [rsp + 0x48], rax
call fcn.1400d9b4c
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea r8, [rsp + 0x40]
mov edx, eax
lea rcx, [rbp - 0x70]
call fcn.140002740
nop
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0xa0]
call fcn.140002e70
movsd xmm0, qword [rax]
movsd qword [rsp + 0x40], xmm0
mov ecx, dword [rax + 8]
mov dword [rbp + 0xa0], ecx
lea r12, [0x140116108]
mov qword [rbp + 0xa8], r12
movaps xmm0, xmmword [rbp + 0xa0]
movdqa xmmword [rbp + 0xa0], xmm0
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x1400059bf
cmp eax, 1
setne bl
lea rcx, [rbp - 0x70]
call fcn.140009cf0
nop
lea rcx, [rbp + 0x30]
call fcn.140009d60
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
test bl, bl
je 0x140005e98
lea rax, [rbp + 0x30]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x40], 0x6573753a
mov dword [rsp + 0x44], 0x6d616e72
mov word [rsp + 0x48], 0x65
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], r15
mov qword [rbp + 0x48], r15
lea rax, [rsp + 0x41]
mov r8, rsi
nop
inc r8
cmp byte [rax + r8], 0
jne 0x1400056e0
lea rdx, [rsp + 0x41]
lea rcx, [rbp + 0x30]
call fcn.14000bb30
nop
movdqa xmm0, xmmword [0x1401008e0]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0x736a2e64
mov word [rsp + 0x54], 0x6e6f
mov byte [rsp + 0x56], 0
lea rax, [rsp + 0x41]
mov rcx, rsi
inc rcx
cmp byte [rax + rcx], 0
jne 0x140005723
mov rax, r14
mov rdx, qword [rbp + 0x20]
sub rax, rdx
cmp rax, rcx
jb 0x140006df9
lea r9, [rbp + 0x10]
cmp qword [rbp + 0x28], 0xf
cmova r9, qword [rbp + 0x10]
mov qword [rsp + 0x30], rcx
lea rax, [rsp + 0x41]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea rcx, [rbp - 0x70]
call fcn.14000d310
nop
lea rdx, [rbp + 0x30]
lea rcx, [rbp - 0x70]
call fcn.140003d20
xor edx, edx
lea rcx, [0x140004890]
test al, al
jne 0x140005a50
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
lea rax, [rbp + 0x30]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x40], 0x63696c40
mov dword [rsp + 0x44], 0x65736e65
mov byte [rsp + 0x48], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], r15
mov qword [rbp + 0x48], r15
lea rax, [rsp + 0x41]
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x140005800
lea rdx, [rsp + 0x41]
lea rcx, [rbp + 0x30]
call fcn.14000bb30
nop
movdqa xmm0, xmmword [0x140100910]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0x736a2e64
mov word [rsp + 0x54], 0x6e6f
mov byte [rsp + 0x56], 0
lea rax, [rsp + 0x41]
mov rcx, rsi
inc rcx
cmp byte [rax + rcx], 0
jne 0x140005843
mov rax, r14
mov rdx, qword [rbp + 0x20]
sub rax, rdx
cmp rax, rcx
jb 0x140006dff
lea r9, [rbp + 0x10]
cmp qword [rbp + 0x28], 0xf
cmova r9, qword [rbp + 0x10]
mov qword [rsp + 0x30], rcx
lea rax, [rsp + 0x41]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea rcx, [rbp - 0x70]
call fcn.14000d310
nop
lea r8, [rbp + 0x30]
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x60]
call fcn.140003890
nop
lea rdx, [rbp + 0x60]
lea rcx, [rbp - 0x50]
call fcn.1400085c0
mov rdx, rax
lea rcx, [0x1403f5010]
call fcn.140086c10
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
cmp byte [0x1403f5220], 0
jne 0x1400059ce
lea rcx, [0x1400eebb8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [rsp + 0x40]
call fcn.140006e70
lea rcx, [rax + 1]
movzx edx, byte [rax]
xor byte [rcx], dl
xor byte [rax + 2], dl
xor byte [rax + 3], dl
xor byte [rax + 4], dl
xor byte [rax + 5], dl
xor byte [rax + 6], dl
xor byte [rax + 7], dl
xor byte [rax + 8], dl
xor byte [rax + 9], dl
xor byte [rax + 0xa], dl
xor byte [rax + 0xb], dl
xor byte [rcx + 0xb], dl
mov byte [rcx + 0xc], 0
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rsp + 0x40]
call fcn.140006e90
lea rdx, [rax + 1]
movzx r8d, byte [rax]
xor byte [rdx], r8b
xor byte [rax + 2], r8b
xor byte [rax + 3], r8b
xor byte [rax + 4], r8b
xor byte [rax + 5], r8b
xor byte [rax + 6], r8b
xor byte [rdx + 6], r8b
mov byte [rdx + 7], 0
call fcn.14000acb0
mov rcx, rax
lea rdx, [0x1403f5228]
call fcn.14000ae80
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
xor bl, bl
test ecx, ecx
jne 0x140006dc6
jmp 0x140005642
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
movdqa xmm0, xmmword [0x1401009d0]
movdqu xmmword [rsp + 0x70], xmm0
mov dword [rbp - 0x80], 0x20646567
mov dword [rbp - 0x7c], 0xa6e69
lea rdx, [rsp + 0x71]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000acb0
nop
lea rcx, [rbp + 0x60]
jmp 0x140006916
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
lea rax, [rbp + 0x30]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x40], 0x6573756a
mov dword [rsp + 0x44], 0x6d616e72
mov word [rsp + 0x48], 0x65
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], r15
mov qword [rbp + 0x48], r15
lea rax, [rsp + 0x41]
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140005ad0
lea rdx, [rsp + 0x41]
lea rcx, [rbp + 0x30]
call fcn.14000bb30
nop
movdqa xmm0, xmmword [0x1401008f0]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0x736a2e64
mov word [rsp + 0x54], 0x6e6f
mov byte [rsp + 0x56], 0
lea rax, [rsp + 0x41]
mov rcx, rsi
inc rcx
cmp byte [rax + rcx], 0
jne 0x140005b13
mov rax, r14
mov rdx, qword [rbp + 0x20]
sub rax, rdx
cmp rax, rcx
jb 0x140006e05
lea r9, [rbp + 0x10]
cmp qword [rbp + 0x28], 0xf
cmova r9, qword [rbp + 0x10]
mov qword [rsp + 0x30], rcx
lea rax, [rsp + 0x41]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea rcx, [rbp - 0x70]
call fcn.14000d310
nop
lea r8, [rbp + 0x30]
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0xa0]
call fcn.140003890
nop
lea rax, [rbp + 0x80]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x40], 0x7361706c
mov dword [rsp + 0x44], 0x726f7773
mov word [rsp + 0x48], 0x64
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], r15
mov qword [rbp + 0x98], r15
lea rax, [rsp + 0x41]
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x140005bb3
lea rdx, [rsp + 0x41]
lea rcx, [rbp + 0x80]
call fcn.14000bb30
nop
movdqa xmm0, xmmword [0x140100930]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0x736a2e64
mov word [rsp + 0x54], 0x6e6f
mov byte [rsp + 0x56], 0
lea rax, [rsp + 0x41]
mov rcx, rsi
nop dword [rax]
inc rcx
cmp byte [rax + rcx], 0
jne 0x140005c00
mov rax, r14
mov rdx, qword [rbp + 0x20]
sub rax, rdx
cmp rax, rcx
jb 0x140006e0b
lea r9, [rbp + 0x10]
cmp qword [rbp + 0x28], 0xf
cmova r9, qword [rbp + 0x10]
mov qword [rsp + 0x30], rcx
lea rax, [rsp + 0x41]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea rcx, [rbp + 0x60]
call fcn.14000d310
nop
lea r8, [rbp + 0x80]
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0xe0]
call fcn.140003890
nop
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
lea rax, [rbp - 0x50]
mov qword [rsp + 0x60], rax
lea rdx, [rbp + 0xe0]
lea rcx, [rbp - 0x50]
call fcn.1400085c0
mov rbx, rax
lea rdx, [rbp + 0xa0]
lea rcx, [rbp - 0x70]
call fcn.1400085c0
nop
mov r8, rbx
mov rdx, rax
lea rcx, [0x1403f5010]
call fcn.140088160
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
cmp byte [0x1403f5220], 0
jne 0x140005dfc
lea rcx, [0x1400eebb8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [rsp + 0x40]
call fcn.140006eb0
lea rcx, [rax + 1]
movzx edx, byte [rax]
xor byte [rcx], dl
xor byte [rax + 2], dl
xor byte [rax + 3], dl
xor byte [rax + 4], dl
xor byte [rax + 5], dl
xor byte [rax + 6], dl
xor byte [rax + 7], dl
xor byte [rax + 8], dl
xor byte [rax + 9], dl
xor byte [rax + 0xa], dl
xor byte [rax + 0xb], dl
xor byte [rcx + 0xb], dl
mov byte [rcx + 0xc], 0
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rsp + 0x40]
call fcn.140006ed0
lea rdx, [rax + 1]
movzx r8d, byte [rax]
xor byte [rdx], r8b
xor byte [rax + 2], r8b
xor byte [rax + 3], r8b
xor byte [rax + 4], r8b
xor byte [rax + 5], r8b
xor byte [rax + 6], r8b
xor byte [rax + 7], r8b
xor byte [rax + 8], r8b
xor byte [rax + 9], r8b
xor byte [rdx + 9], r8b
mov byte [rdx + 0xa], 0
call fcn.14000acb0
mov rcx, rax
lea rdx, [0x1403f5228]
call fcn.14000ae80
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
movdqa xmm0, xmmword [0x140100320]
movdqu xmmword [rsp + 0x70], xmm0
mov dword [rbp - 0x80], 0x67676f6c
mov dword [rbp - 0x7c], 0x69206465
mov word [rbp - 0x78], 0xa6e
mov byte [rbp - 0x76], 0
lea rdx, [rsp + 0x71]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000acb0
nop
lea rcx, [rbp + 0xe0]
call fcn.140009d60
nop
lea rcx, [rbp + 0xa0]
jmp 0x140006916
movdqa xmm0, xmmword [0x140100ab0]
movdqu xmmword [rbp - 0x28], xmm0
movdqa xmm1, xmmword [0x140100300]
movdqu xmmword [rbp - 0x18], xmm1
mov dword [rbp - 8], 0x6974706f
mov dword [rbp - 4], 0x203a6e6f
mov byte [rbp], 0
lea rdx, [rbp - 0x27]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000acb0
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], r15
mov qword [rbp + 0x98], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x80], 0
movups xmmword [rbp + 0xc0], xmm0
mov qword [rbp + 0xd0], r15
mov qword [rbp + 0xd8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xc0], 0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], r15
mov qword [rbp + 0x48], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x30], 0
lea rdx, [rbp + 8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
mov ecx, dword [rbp + 8]
sub ecx, 1
je 0x14000620d
cmp ecx, 1
lea rcx, [0x1400eebb8]
je 0x140006049
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rsp + 0x70]
call fcn.140006ef0
lea rdx, [rax + 1]
movzx r8d, byte [rax]
xor byte [rdx], r8b
xor byte [rax + 2], r8b
xor byte [rax + 3], r8b
xor byte [rax + 4], r8b
xor byte [rax + 5], r8b
xor byte [rax + 6], r8b
xor byte [rax + 7], r8b
xor byte [rax + 8], r8b
xor byte [rax + 9], r8b
xor byte [rax + 0xa], r8b
xor byte [rax + 0xb], r8b
xor byte [rax + 0xc], r8b
xor byte [rax + 0xd], r8b
xor byte [rax + 0xe], r8b
xor byte [rax + 0xf], r8b
xor byte [rax + 0x10], r8b
xor byte [rax + 0x11], r8b
xor byte [rax + 0x12], r8b
xor byte [rax + 0x13], r8b
xor byte [rax + 0x14], r8b
xor byte [rax + 0x15], r8b
xor byte [rax + 0x16], r8b
xor byte [rax + 0x17], r8b
xor byte [rax + 0x18], r8b
xor byte [rax + 0x19], r8b
xor byte [rdx + 0x19], r8b
mov byte [rdx + 0x1a], 0
call fcn.14000acb0
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
mov dword [rsp + 0x40], 0x65737544
mov dword [rsp + 0x44], 0x6d616e72
mov dword [rsp + 0x48], 0x203a65
lea rdx, [rsp + 0x41]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000acb0
lea rdx, [rbp + 0x80]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.14000b0a0
mov dword [rsp + 0x40], 0x7361705c
mov dword [rsp + 0x44], 0x726f7773
mov dword [rsp + 0x48], 0x203a64
lea rdx, [rsp + 0x41]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000acb0
lea rcx, [rbp - 0x50]
call fcn.1400045f0
lea rcx, [rbp + 0xc0]
cmp rcx, rax
je 0x140006138
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xc0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xd0], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rbp - 0x50]
call fcn.140009d60
mov dword [rsp + 0x60], 0x79656b14
mov word [rsp + 0x64], 0x203a
mov byte [rsp + 0x66], 0
lea rdx, [rsp + 0x61]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000acb0
lea rdx, [rbp + 0x30]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.14000b0a0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], r15
xor r8d, r8d
lea rdx, [0x1400eeb08]
lea rcx, [rsp + 0x70]
call fcn.14000bb30
nop
lea rax, [rbp - 0x50]
mov qword [rbp - 0x30], rax
lea rdx, [rbp + 0x30]
lea rcx, [rbp - 0x50]
call fcn.1400085c0
mov rdi, rax
lea rax, [rbp - 0x70]
mov qword [rbp + 0x50], rax
lea rdx, [rbp + 0xc0]
lea rcx, [rbp - 0x70]
call fcn.1400085c0
mov rbx, rax
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x60]
call fcn.1400085c0
nop
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x20], rcx
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [0x1403f5010]
call fcn.140089360
jmp 0x14000634d
lea rcx, [0x1400eebb8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
mov dword [rsp + 0x40], 0x65737545
mov dword [rsp + 0x44], 0x6d616e72
mov dword [rsp + 0x48], 0x203a65
lea rdx, [rsp + 0x41]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000acb0
lea rdx, [rbp + 0x80]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.14000b0a0
mov dword [rsp + 0x40], 0x73617006
mov dword [rsp + 0x44], 0x726f7773
mov dword [rsp + 0x48], 0x203a64
lea rdx, [rsp + 0x41]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000acb0
lea rcx, [rbp - 0x50]
call fcn.1400045f0
lea rcx, [rbp + 0xc0]
cmp rcx, rax
je 0x140006303
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xc0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xd0], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rbp - 0x50]
call fcn.140009d60
lea rax, [rbp - 0x50]
mov qword [rbp + 0xa0], rax
lea rdx, [rbp + 0xc0]
lea rcx, [rbp - 0x50]
call fcn.1400085c0
mov rbx, rax
lea rdx, [rbp + 0x80]
lea rcx, [rbp - 0x70]
call fcn.1400085c0
nop
mov r8, rbx
mov rdx, rax
lea rcx, [0x1403f5010]
call fcn.140088160
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
cmp byte [0x1403f5220], 0
jne 0x1400064aa
lea rcx, [0x1400eebb8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
lea rdx, [rsp + 0x40]
call fcn.140006f30
lea rcx, [rax + 1]
movzx edx, byte [rax]
xor byte [rcx], dl
xor byte [rax + 2], dl
xor byte [rax + 3], dl
xor byte [rax + 4], dl
xor byte [rax + 5], dl
xor byte [rax + 6], dl
xor byte [rax + 7], dl
xor byte [rax + 8], dl
xor byte [rax + 9], dl
xor byte [rax + 0xa], dl
xor byte [rax + 0xb], dl
xor byte [rcx + 0xb], dl
mov byte [rcx + 0xc], 0
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rsp + 0x40]
call fcn.140006f50
lea rdx, [rax + 1]
movzx r8d, byte [rax]
xor byte [rdx], r8b
xor byte [rax + 2], r8b
xor byte [rax + 3], r8b
xor byte [rax + 4], r8b
xor byte [rax + 5], r8b
xor byte [rax + 6], r8b
xor byte [rax + 7], r8b
xor byte [rax + 8], r8b
xor byte [rax + 9], r8b
xor byte [rdx + 9], r8b
mov byte [rdx + 0xa], 0
call fcn.14000acb0
mov rcx, rax
lea rdx, [0x1403f5228]
call fcn.14000ae80
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
cmp qword [rbp + 0x90], 0
je 0x140006700
cmp qword [rbp + 0xd0], 0
je 0x140006700
lea rcx, [0x1400eebb8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
lea rax, [rbp - 0x50]
mov qword [rbp + 0xa0], rax
lea rdx, [rbp + 0xc0]
lea rcx, [rbp - 0x50]
call fcn.1400085c0
mov rdi, rax
lea rax, [rsp + 0x70]
mov qword [rbp + 0x50], rax
mov dword [rsp + 0x40], 0x7361704c
mov dword [rsp + 0x44], 0x726f7773
mov word [rsp + 0x48], 0x64
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], r15
lea rax, [rsp + 0x41]
mov r8, rsi
nop
inc r8
cmp byte [rax + r8], 0
jne 0x1400065c0
lea rdx, [rsp + 0x41]
lea rcx, [rsp + 0x70]
call fcn.14000bb30
nop
lea rax, [rbp + 0x60]
mov qword [rbp - 0x30], rax
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x60]
call fcn.1400085c0
mov rbx, rax
lea rax, [rbp + 0xe0]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x40], 0x6573753a
mov dword [rsp + 0x44], 0x6d616e72
mov word [rsp + 0x48], 0x65
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
mov qword [rbp + 0xf0], r15
mov qword [rbp + 0xf8], r15
lea rax, [rsp + 0x41]
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140006640
lea rdx, [rsp + 0x41]
lea rcx, [rbp + 0xe0]
call fcn.14000bb30
nop
movdqa xmm0, xmmword [0x140100920]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0x736a2e64
mov word [rsp + 0x54], 0x6e6f
mov byte [rsp + 0x56], 0
lea rax, [rsp + 0x41]
mov rcx, rsi
inc rcx
cmp byte [rax + rcx], 0
jne 0x140006686
mov rax, r14
mov rdx, qword [rbp + 0x20]
sub rax, rdx
cmp rax, rcx
jb 0x140006e11
lea r9, [rbp + 0x10]
cmp qword [rbp + 0x28], 0xf
cmova r9, qword [rbp + 0x10]
mov qword [rsp + 0x30], rcx
lea rax, [rsp + 0x41]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea rcx, [rbp - 0x70]
call fcn.14000d310
nop
mov qword [rsp + 0x28], rdi
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9b, 1
mov r8, rbx
lea rdx, [rbp + 0xe0]
lea rcx, [rbp - 0x70]
call fcn.140003fa0
movdqa xmm0, xmmword [0x140100330]
jmp 0x1400068c8
lea rcx, [0x1400eebb8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
lea rax, [rbp + 0xe0]
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
mov qword [rbp + 0xf0], r15
mov qword [rbp + 0xf8], r15
xor r8d, r8d
lea rdx, [0x1400eeb08]
lea rcx, [rbp + 0xe0]
call fcn.14000bb30
nop
lea rax, [rbp + 0x60]
mov qword [rbp + 0xa0], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
mov qword [rbp + 0x70], r15
mov qword [rbp + 0x78], r15
xor r8d, r8d
lea rdx, [0x1400eeb08]
lea rcx, [rbp + 0x60]
call fcn.14000bb30
nop
lea rax, [rbp - 0x28]
mov qword [rbp + 0x50], rax
lea rdx, [rbp + 0x30]
lea rcx, [rbp - 0x28]
call fcn.1400085c0
mov rbx, rax
lea rax, [rbp - 0x70]
mov qword [rbp - 0x30], rax
mov dword [rsp + 0x60], 0x63696c17
mov dword [rsp + 0x64], 0x65736e65
mov byte [rsp + 0x68], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x58], r15
lea rax, [rsp + 0x61]
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140006810
lea rdx, [rsp + 0x61]
lea rcx, [rbp - 0x70]
call fcn.14000bb30
nop
movdqa xmm0, xmmword [0x140100900]
movdqu xmmword [rsp + 0x70], xmm0
mov dword [rbp - 0x80], 0x736a2e64
mov word [rbp - 0x7c], 0x6e6f
mov byte [rbp - 0x7a], 0
lea rax, [rsp + 0x71]
mov rcx, rsi
inc rcx
cmp byte [rax + rcx], 0
jne 0x140006850
mov rax, r14
mov rdx, qword [rbp + 0x20]
sub rax, rdx
cmp rax, rcx
jb 0x140006e17
lea r9, [rbp + 0x10]
cmp qword [rbp + 0x28], 0xf
cmova r9, qword [rbp + 0x10]
mov qword [rsp + 0x30], rcx
lea rax, [rsp + 0x71]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea rcx, [rbp - 0x50]
call fcn.14000d310
nop
lea rax, [rbp + 0xe0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, rbx
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x50]
call fcn.140003fa0
movdqa xmm0, xmmword [0x140100310]
movdqu xmmword [rsp + 0x70], xmm0
mov dword [rbp - 0x80], 0x67676f6c
mov dword [rbp - 0x7c], 0x69206465
mov word [rbp - 0x78], 0xa6e
mov byte [rbp - 0x76], 0
lea rdx, [rsp + 0x71]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000acb0
nop
lea rcx, [rbp + 0x30]
call fcn.140009d60
nop
lea rcx, [rbp + 0xc0]
call fcn.140009d60
nop
lea rcx, [rbp + 0x80]
call fcn.140009d60
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
mov dword [rsp + 0x40], 0x76455c7c
mov dword [rsp + 0x44], 0x65746369
mov word [rsp + 0x48], 0x64
lea rax, [rsp + 0x41]
mov rcx, rsi
inc rcx
cmp byte [rax + rcx], 0
jne 0x140006985
mov rax, r14
mov rdx, qword [rbp + 0x20]
sub rax, rdx
cmp rax, rcx
jb 0x140006e1d
lea r9, [rbp + 0x10]
cmp qword [rbp + 0x28], 0xf
cmova r9, qword [rbp + 0x10]
mov qword [rsp + 0x30], rcx
lea rax, [rsp + 0x41]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea rcx, [rbp - 0x70]
call fcn.14000d310
nop
lea rax, [rbp - 0x70]
cmp qword [rbp - 0x58], 0xf
cmova rax, qword [rbp - 0x70]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp - 0x60]
mov qword [rsp + 0x48], rax
call fcn.1400d9b4c
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea r8, [rsp + 0x40]
mov edx, eax
lea rcx, [rbp + 0x60]
call fcn.140002740
nop
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0xa0]
call fcn.140002e70
movsd xmm0, qword [rax]
movsd qword [rsp + 0x40], xmm0
mov ecx, dword [rax + 8]
mov dword [rbp + 0x50], ecx
mov qword [rbp + 0x58], r12
movaps xmm0, xmmword [rbp + 0x50]
movdqa xmmword [rbp + 0x50], xmm0
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x140006d9d
cmp eax, 1
sete bl
lea rcx, [rbp + 0x60]
call fcn.140009cf0
nop
lea rcx, [rbp - 0x70]
call fcn.140009d60
test bl, bl
je 0x140006b3a
mov dword [rsp + 0x40], 0x76455c26
mov dword [rsp + 0x44], 0x65746369
mov word [rsp + 0x48], 0x64
lea rax, [rsp + 0x41]
mov rcx, rsi
inc rcx
cmp byte [rax + rcx], 0
jne 0x140006a83
mov rax, r14
mov rdx, qword [rbp + 0x20]
sub rax, rdx
cmp rax, rcx
jb 0x140006e23
lea r9, [rbp + 0x10]
cmp qword [rbp + 0x28], 0xf
cmova r9, qword [rbp + 0x10]
mov qword [rsp + 0x30], rcx
lea rax, [rsp + 0x41]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea rcx, [rbp - 0x70]
call fcn.14000d310
nop
lea rax, [rbp - 0x70]
cmp qword [rbp - 0x58], 0xf
cmova rax, qword [rbp - 0x70]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp - 0x60]
mov qword [rsp + 0x48], rax
call fcn.1400d9b4c
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea r8, [rsp + 0x40]
mov edx, eax
lea rcx, [rbp + 0x30]
call fcn.140002740
nop
lea rcx, [rbp + 0x30]
cmp qword [rbp + 0x48], 7
cmova rcx, qword [rbp + 0x30]
call fcn.1400d9dac
shr rax, 0x20
test eax, eax
jne 0x140006e29
lea rcx, [rbp + 0x30]
call fcn.140009cf0
nop
lea rcx, [rbp - 0x70]
call fcn.140009d60
movdqa xmm0, xmmword [0x1401009c0]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x50], reloc.WS2_32.dll_WSAStartup
lea rax, [rsp + 0x41]
mov rcx, rsi
inc rcx
cmp byte [rax + rcx], 0
jne 0x140006b57
mov rax, r14
mov rdx, qword [rbp + 0x20]
sub rax, rdx
cmp rax, rcx
jb 0x140006e3c
lea r9, [rbp + 0x10]
cmp qword [rbp + 0x28], 0xf
cmova r9, qword [rbp + 0x10]
mov qword [rsp + 0x30], rcx
lea rax, [rsp + 0x41]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea rcx, [rbp - 0x70]
call fcn.14000d310
nop
lea rax, [rbp - 0x70]
cmp qword [rbp - 0x58], 0xf
cmova rax, qword [rbp - 0x70]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp - 0x60]
mov qword [rsp + 0x48], rax
call fcn.1400d9b4c
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea r8, [rsp + 0x40]
mov edx, eax
lea rcx, [rbp + 0x60]
call fcn.140002740
nop
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0xa0]
call fcn.140002e70
movsd xmm0, qword [rax]
movsd qword [rsp + 0x40], xmm0
mov ecx, dword [rax + 8]
mov dword [rbp + 0x50], ecx
mov qword [rbp + 0x58], r12
movaps xmm0, xmmword [rbp + 0x50]
movdqa xmmword [rbp + 0x50], xmm0
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x140006da8
cmp eax, 1
sete bl
lea rcx, [rbp + 0x60]
call fcn.140009cf0
nop
lea rcx, [rbp - 0x70]
call fcn.140009d60
test bl, bl
je 0x140006d04
movdqa xmm0, xmmword [0x1401009a0]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x50], reloc.WS2_32.dll_WSAStartup
lea rax, [rsp + 0x41]
inc rsi
cmp byte [rax + rsi], 0
jne 0x140006c50
mov rax, qword [rbp + 0x20]
sub r14, rax
cmp r14, rsi
jb 0x140006e42
lea r9, [rbp + 0x10]
cmp qword [rbp + 0x28], 0xf
cmova r9, qword [rbp + 0x10]
mov qword [rsp + 0x30], rsi
lea rcx, [rsp + 0x41]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea rcx, [rbp - 0x70]
call fcn.14000d310
nop
lea rax, [rbp - 0x70]
cmp qword [rbp - 0x58], 0xf
cmova rax, qword [rbp - 0x70]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp - 0x60]
mov qword [rsp + 0x48], rax
call fcn.1400d9b4c
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea r8, [rsp + 0x40]
mov edx, eax
lea rcx, [rbp + 0x30]
call fcn.140002740
nop
lea rcx, [rbp + 0x30]
cmp qword [rbp + 0x48], 7
cmova rcx, qword [rbp + 0x30]
call fcn.1400d9dac
shr rax, 0x20
test eax, eax
jne 0x140006db3
lea rcx, [rbp + 0x30]
call fcn.140009cf0
nop
lea rcx, [rbp - 0x70]
call fcn.140009d60
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x140004890]
call qword [sym.imp.USER32.dll_EnumWindows]
call fcn.14006f690
nop
lea rcx, [rbp + 0x10]
call fcn.140009d60
nop
lea rcx, [rbp + 0x120]
call fcn.140009d60
xor eax, eax
mov rcx, qword [rbp + 0x3b0]
xor rcx, rsp
call fcn.1400da3c0
lea r11, [rsp + 0x4c0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov bl, 1
test ecx, ecx
jne 0x140006dd7
jmp 0x140006a49
mov bl, 1
test ecx, ecx
jne 0x140006de5
jmp 0x140006c1b
lea r8, [rbp + 0x30]
mov edx, eax
lea rcx, str.create_directory
call fcn.140002da0
nop
lea r8, [rbp - 0x70]
lea rdx, [rbp + 0xa0]
call fcn.140002e10
nop
lea r8, [rbp + 0x60]
lea rdx, [rbp + 0x50]
call fcn.140002e10
nop
lea r8, [rbp + 0x60]
lea rdx, [rbp + 0x50]
call fcn.140002e10
nop
call fcn.140001d50
nop
call fcn.140001d50
nop
call fcn.140001d50
nop
call fcn.140001d50
nop
call fcn.140001d50
nop
call fcn.140001d50
nop
call fcn.140001d50
nop
call fcn.140001d50
int3
call fcn.140001d50
nop
lea r8, [rbp + 0x30]
mov edx, eax
lea rcx, str.create_directory
call fcn.140002da0
nop
call fcn.140001d50
int3
call fcn.140001d50
int3