Function at 0x14017af60
Capabilities:
Create process on windows
Create process suspended
Create thread
Delete file
Execute command
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0xe8]
sub rsp, 0x1e0
movaps xmmword [rax - 0x18], xmm6
mov rax, qword [0x1401e1010]
xor rax, rsp
mov qword [rbp + 0xc0], rax
xor esi, esi
mov dword [rsp + 0x50], esi
mov rdi, qword [0x1401e49b0]
lea r14, [0x1401e49a0]
mov rbx, r14
cmp qword [0x1401e49b8], 0x10
cmovae rbx, qword [0x1401e49a0]
call fcn.1401c9230
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rdi
lea r8, [rsp + 0x60]
mov edx, eax
lea rcx, [rsp + 0x70]
call fcn.1401766c0
nop
mov ebx, 0xd
mov dword [rsp + 0x50], ebx
lea rcx, [rsp + 0x70]
call fcn.140177cd0
test al, al
je 0x14017b04b
mov rdi, qword [0x1401e49b0]
mov rbx, r14
cmp qword [0x1401e49b8], 0x10
cmovae rbx, qword [0x1401e49a0]
call fcn.1401c9230
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rdi
lea r8, [rsp + 0x60]
mov edx, eax
lea rcx, [rbp - 0x70]
call fcn.1401766c0
nop
mov ebx, 0x3f
mov dword [rsp + 0x50], ebx
lea rcx, [rbp - 0x70]
call fcn.140177de0
test al, al
je 0x14017b04b
xor dil, dil
jmp 0x14017b04e
mov dil, 1
test bl, 2
je 0x14017b0aa
and ebx, 0xfffffffd
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x14017b099
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14017b094
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14017b094
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401c9cec
movdqa xmm0, xmmword [0x1401d62e0]
movdqu xmmword [rbp - 0x60], xmm0
mov word [rbp - 0x70], si
test bl, 1
je 0x14017b105
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x14017b0f3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14017b0ee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14017b0ee
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401c9cec
movdqa xmm0, xmmword [0x1401d62e0]
movdqu xmmword [rbp - 0x80], xmm0
mov word [rsp + 0x70], si
test dil, dil
je 0x14017b12c
xor r9d, r9d
lea r8, [0x1401cf360]
lea rdx, [0x1401cf368]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
cmp byte [0x1401e1050], 1
jne 0x14017c015
mov rbx, qword [0x1401e2038]
mov eax, dword [rbx + 0x40f0]
or eax, 2
mov dword [rbx + 0x40f0], eax
movsd xmm0, qword [0x1401e1460]
movsd qword [rbx + 0x4114], xmm0
mov dword [rbx + 0x40f8], 1
or eax, 0x40
mov dword [rbx + 0x40f0], eax
mov dword [rbx + 0x4150], 0x3f800000
mov dword [rbx + 0x391c], esi
movaps xmm0, xmmword [0x1401d6380]
movups xmmword [rbx + 0x3b20], xmm0
movaps xmm1, xmmword [0x1401d63a0]
movups xmmword [rbx + 0x3b30], xmm1
movups xmmword [rbx + 0x3b40], xmm0
movaps xmm1, xmmword [0x1401d63b0]
movups xmmword [rbx + 0x39d0], xmm1
movups xmmword [rbx + 0x3a40], xmm0
movaps xmm1, xmm0
movups xmmword [rbx + 0x3b50], xmm0
movaps xmm0, xmmword [0x1401d6390]
movups xmmword [rbx + 0x3b60], xmm0
movups xmmword [rbx + 0x3b70], xmm1
mov dword [rbx + 0x394c], 0x3f800000
mov r8d, 0x2b
lea rdx, [0x1401e1050]
lea rcx, str.RELAX
call fcn.14018d080
mov rcx, qword [0x1401e2038]
mov rax, qword [rcx + 0x3fe0]
mov byte [rax + 0xcd], 1
mov rax, qword [rcx + 0x3fe0]
movss xmm0, dword [rax + 0x4c]
subss xmm0, dword [rax + 0x9c]
addss xmm0, dword [0x1401d6228]
movss xmm2, dword [rax + 0x48]
subss xmm2, dword [rax + 0x98]
addss xmm2, dword [0x1401d625c]
movss dword [rax + 0x118], xmm2
movss dword [rax + 0x11c], xmm0
movss xmm1, dword [rax + 0x134]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm0
movss dword [rax + 0x134], xmm1
cmp dword [0x1401e2228], 0
sete dl
lea rcx, [0x1401cf384]
call fcn.14017f130
test al, al
je 0x14017b29e
mov edx, esi
mov dword [0x1401e2228], edx
jmp 0x14017b2a4
mov edx, dword [0x1401e2228]
movss xmm1, dword [0x1401d62a4]
xorps xmm0, xmm0
call fcn.1401915b0
cmp edx, 1
sete dl
lea rcx, [0x1401cf390]
call fcn.14017f130
test al, al
je 0x14017b2d4
mov dword [0x1401e2228], 1
mov rcx, qword [0x1401e2020]
call fcn.140190400
mov rcx, qword [0x1401e2038]
mov rax, qword [rcx + 0x3fe0]
mov byte [rax + 0xcd], 1
mov rax, qword [rcx + 0x3fe0]
movss xmm0, dword [rax + 0x4c]
subss xmm0, dword [rax + 0x9c]
addss xmm0, dword [0x1401d621c]
movss xmm2, dword [rax + 0x48]
subss xmm2, dword [rax + 0x98]
addss xmm2, dword [0x1401d6280]
movss dword [rax + 0x118], xmm2
movss dword [rax + 0x11c], xmm0
movss xmm1, dword [rax + 0x134]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm0
movss dword [rax + 0x134], xmm1
mov qword [rsp + 0x50], 0
lea rdx, [rsp + 0x50]
lea rcx, [0x1401cf39c]
call fcn.1401bc730
test al, al
je 0x14017b42a
lea rcx, [rsp + 0x60]
call fcn.14017c050
lea rcx, [rsp + 0x60]
call fcn.140178420
nop
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x60]
call fcn.140178480
nop
lea rdx, [rbp + 0xa0]
lea rcx, [rsp + 0x60]
call fcn.1401785a0
nop
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x60]
call fcn.1401786c0
nop
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x60]
call fcn.140178800
nop
lea rax, [rbp - 0x10]
mov qword [rsp + 0x58], rax
lea rdx, [0x1401cf3a8]
lea rcx, [rbp - 0x10]
call fcn.14017cfb0
mov rbx, rax
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x50]
call fcn.14017cff0
nop
mov rdx, rbx
mov rcx, rax
call fcn.140178010
lea rcx, [0x1401e2140]
call fcn.14017d120
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov ecx, dword [0x1401e2228]
test ecx, ecx
je 0x14017b7d8
cmp ecx, 1
jne 0x14017c00b
mov rcx, qword [0x1401e2038]
mov rax, qword [rcx + 0x3fe0]
mov byte [rax + 0xcd], 1
mov rax, qword [rcx + 0x3fe0]
movss xmm0, dword [rax + 0x48]
subss xmm0, dword [rax + 0x98]
movss xmm6, dword [0x1401d6238]
addss xmm0, xmm6
movss xmm2, dword [rax + 0x4c]
subss xmm2, dword [rax + 0x9c]
addss xmm2, dword [0x1401d6244]
movss dword [rax + 0x118], xmm0
movss dword [rax + 0x11c], xmm2
movss xmm1, dword [rax + 0x130]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x134]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm1
movss dword [rax + 0x134], xmm0
mov rcx, qword [0x1401e2028]
call fcn.140190400
lea rcx, [0x1401cf600]
call fcn.1401bbe90
movaps xmm0, xmmword [0x1401d63d0]
movups xmmword [rbx + 0x39d0], xmm0
call fcn.14017aa70
movaps xmm0, xmmword [0x1401d63b0]
movups xmmword [rbx + 0x39d0], xmm0
mov rcx, qword [0x1401e2038]
mov rax, qword [rcx + 0x3fe0]
mov byte [rax + 0xcd], 1
mov rax, qword [rcx + 0x3fe0]
movss xmm0, dword [rax + 0x48]
subss xmm0, dword [rax + 0x98]
addss xmm0, xmm6
movss xmm2, dword [rax + 0x4c]
subss xmm2, dword [rax + 0x9c]
addss xmm2, dword [0x1401d6258]
movss dword [rax + 0x118], xmm0
movss dword [rax + 0x11c], xmm2
movss xmm1, dword [rax + 0x130]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x134]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm1
movss dword [rax + 0x134], xmm0
mov qword [rsp + 0x50], 0
lea rdx, [rsp + 0x50]
lea rcx, str.
call fcn.1401bc730
test al, al
je 0x14017b60c
lea r8, [0x1401e4980]
lea rcx, [rsp + 0x70]
call fcn.14017dd30
lea rcx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0x10
cmovae rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x14017b5fa
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14017b5f5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14017b5f5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401c9cec
movdqa xmm0, xmmword [0x1401d6300]
movdqu xmmword [rbp - 0x80], xmm0
mov byte [rsp + 0x70], 0
mov rcx, qword [0x1401e2038]
mov rax, qword [rcx + 0x3fe0]
mov byte [rax + 0xcd], 1
mov rax, qword [rcx + 0x3fe0]
movss xmm0, dword [rax + 0x48]
subss xmm0, dword [rax + 0x98]
addss xmm0, xmm6
movss xmm2, dword [rax + 0x4c]
subss xmm2, dword [rax + 0x9c]
addss xmm2, dword [0x1401d6260]
movss dword [rax + 0x118], xmm0
movss dword [rax + 0x11c], xmm2
movss xmm1, dword [rax + 0x130]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x134]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm1
movss dword [rax + 0x134], xmm0
mov qword [rsp + 0x50], 0
lea rdx, [rsp + 0x50]
lea rcx, str..minecraft
call fcn.1401bc730
test al, al
je 0x14017b718
mov r8, r14
lea rcx, [rsp + 0x70]
call fcn.14017dd30
lea rcx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0x10
cmovae rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x14017b706
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14017b701
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14017b701
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401c9cec
movdqa xmm0, xmmword [0x1401d6300]
movdqu xmmword [rbp - 0x80], xmm0
mov byte [rsp + 0x70], 0
mov rcx, qword [0x1401e2038]
mov rax, qword [rcx + 0x3fe0]
mov byte [rax + 0xcd], 1
mov rax, qword [rcx + 0x3fe0]
movss xmm0, dword [rax + 0x48]
subss xmm0, dword [rax + 0x98]
addss xmm0, xmm6
movss xmm2, dword [rax + 0x4c]
subss xmm2, dword [rax + 0x9c]
addss xmm2, dword [0x1401d6264]
movss dword [rax + 0x118], xmm0
movss dword [rax + 0x11c], xmm2
movss xmm1, dword [rax + 0x130]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x134]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm1
movss dword [rax + 0x134], xmm0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x400
lea r8, str.java
xor edx, edx
lea rcx, [0x1401cf650]
call fcn.1401c1200
call fcn.1401904a0
jmp 0x14017c00b
mov rbx, qword [0x1401e2038]
mov rax, qword [rbx + 0x3fe0]
mov byte [rax + 0xcd], 1
mov rax, qword [rbx + 0x3fe0]
movss xmm0, dword [rax + 0x4c]
subss xmm0, dword [rax + 0x9c]
addss xmm0, dword [0x1401d6244]
movss xmm2, dword [rax + 0x48]
subss xmm2, dword [rax + 0x98]
addss xmm2, dword [0x1401d6238]
movss dword [rax + 0x118], xmm2
movss dword [rax + 0x11c], xmm0
movss xmm1, dword [rax + 0x134]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm0
movss dword [rax + 0x134], xmm1
mov dword [rsp + 0x50], 0x445e8000
mov dword [rsp + 0x54], 0x43d20000
mov rax, qword [rbx + 0x3fe0]
mov byte [rax + 0xcd], 1
mov rax, qword [rbx + 0x3fe0]
movsxd r8, dword [rax + 0x108]
mov rax, qword [rax + 0x110]
mov r8d, dword [rax + r8*4 - 4]
xor edx, edx
lea rcx, str.console
call fcn.1401814e0
mov edi, eax
cmp dword [rbx + 0x401c], eax
jne 0x14017b8b9
lea r8, str.console
mov edx, 0xb
mov ecx, eax
call fcn.1401a3970
mov dword [rsp + 0x20], esi
lea r8, [rsp + 0x50]
mov edx, edi
lea rcx, str.console
call fcn.140189da0
mov rcx, qword [0x1401e2028]
call fcn.140190400
lea rcx, str.Titan_2023.11_NEW_n
call fcn.1401bbe90
call fcn.1401904a0
mov rcx, qword [0x1401e2020]
call fcn.140190400
lea rcx, str.____titan_team____________________n____titan_team____________________n____titan_team____________________n____titan_team____________________nTitan924316603_n
call fcn.1401bbe90
call fcn.1401904a0
call fcn.140189fb0
mov rcx, qword [0x1401e2038]
mov rax, qword [rcx + 0x3fe0]
mov byte [rax + 0xcd], 1
mov rax, qword [rcx + 0x3fe0]
movss xmm0, dword [rax + 0x4c]
subss xmm0, dword [rax + 0x9c]
addss xmm0, dword [0x1401d6268]
movss xmm2, dword [rax + 0x48]
subss xmm2, dword [rax + 0x98]
movss xmm6, dword [0x1401d626c]
addss xmm2, xmm6
movss dword [rax + 0x118], xmm2
movss dword [rax + 0x11c], xmm0
movss xmm1, dword [rax + 0x134]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm0
movss dword [rax + 0x134], xmm1
movzx edx, byte [0x1401e1051]
lea rcx, str.4399
call fcn.1401bdd50
test al, al
je 0x14017b9b9
mov byte [0x1401e1051], 1
xor dl, dl
mov byte [0x1401e2030], dl
jmp 0x14017b9c0
movzx edx, byte [0x1401e2030]
mov rcx, qword [0x1401e2038]
mov rax, qword [rcx + 0x3fe0]
mov byte [rax + 0xcd], 1
mov rax, qword [rcx + 0x3fe0]
movss xmm0, dword [rax + 0x4c]
subss xmm0, dword [rax + 0x9c]
addss xmm0, dword [0x1401d6270]
movss xmm2, dword [rax + 0x48]
subss xmm2, dword [rax + 0x98]
addss xmm2, xmm6
movss dword [rax + 0x118], xmm2
movss dword [rax + 0x11c], xmm0
movss xmm1, dword [rax + 0x134]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm0
movss dword [rax + 0x134], xmm1
lea rcx, [0x1401cf5d4]
call fcn.1401bdd50
test al, al
je 0x14017ba58
mov byte [0x1401e1051], 0
mov byte [0x1401e2030], 1
call fcn.1401904a0
mov rcx, qword [0x1401e2028]
call fcn.140190400
mov rcx, qword [0x1401e2038]
mov rax, qword [rcx + 0x3fe0]
mov byte [rax + 0xcd], 1
mov rax, qword [rcx + 0x3fe0]
movss xmm0, dword [rax + 0x4c]
subss xmm0, dword [rax + 0x9c]
addss xmm0, dword [0x1401d6268]
movss xmm2, dword [rax + 0x48]
subss xmm2, dword [rax + 0x98]
addss xmm2, dword [0x1401d6274]
movss dword [rax + 0x118], xmm2
movss dword [rax + 0x11c], xmm0
movss xmm1, dword [rax + 0x134]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm0
movss dword [rax + 0x134], xmm1
mov dword [rsp + 0x50], 0x43160000
mov dword [rsp + 0x54], 0x42700000
lea rdi, [0x1401e2120]
mov rcx, rdi
cmp qword [0x1401e2138], 0x10
cmovae rcx, qword [0x1401e2120]
lea rdx, [rsp + 0x50]
call fcn.1401bc730
mov rbx, 0xffffffffffffffff
test al, al
je 0x14017be59
cmp byte [0x1401e1051], 0
setne al
mov byte [0x1401e1488], al
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x60], al
mov qword [rsp + 0x68], rsi
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
test al, al
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWARENeteasePC4399_MCLauncher
jne 0x14017bb77
lea rdx, str.SOFTWARENeteaseMCLauncher
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x60]
call fcn.140178480
nop
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x60]
call fcn.1401785a0
nop
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x60]
call fcn.1401786c0
nop
lea rax, str.PC4399_WPFLauncher
lea rdx, str.WPFLauncher
cmp byte [rsp + 0x60], 0
cmovne rdx, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x40], xmm1
mov r8, rbx
inc r8
cmp word [rdx + r8*2], 0
jne 0x14017bbd4
lea rcx, [rbp - 0x50]
call fcn.14017e300
nop
lea rax, [rsp + 0x70]
mov qword [rsp + 0x58], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x78], rsi
mov r8d, 4
lea rdx, [0x1401cf3a8]
lea rcx, [rsp + 0x70]
call fcn.14017e300
nop
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x10]
call fcn.14017cff0
nop
lea rdx, [rsp + 0x70]
mov rcx, rax
call fcn.140178010
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x34], xmm0
movups xmmword [rbp + 0x44], xmm0
movups xmmword [rbp + 0x54], xmm0
movups xmmword [rbp + 0x64], xmm0
movups xmmword [rbp + 0x74], xmm0
movups xmmword [rbp + 0x84], xmm0
mov dword [rbp + 0x94], eax
mov dword [rbp + 0x30], 0x68
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rax
lea rdx, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae rdx, qword [rbp - 0x70]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14017bd09
mov rax, qword [0x1401e2138]
cmp rax, 0xc
jb 0x14017bcf4
cmp rax, 0x10
cmovae rdi, qword [0x1401e2120]
mov qword [0x1401e2130], 0xc
mov r8d, 0xc
lea rdx, [0x1401cf5e0]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + 0xc], 0
jmp 0x14017bd09
lea r9, [0x1401cf5e0]
mov edx, 0xc
mov rcx, rdi
call fcn.14017ee50
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x14017bd4d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14017bd47
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14017bd47
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401c9cec
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x14017bd90
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14017bd8b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14017bd8b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401c9cec
movdqa xmm0, xmmword [0x1401d62e0]
movdqu xmmword [rbp - 0x60], xmm0
mov word [rbp - 0x70], si
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x14017bde4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14017bddf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14017bddf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401c9cec
movdqa xmm0, xmmword [0x1401d62e0]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x30], si
mov rdx, qword [rbp + 8]
cmp rdx, 8
jb 0x14017be38
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14017be33
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14017be33
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401c9cec
movdqa xmm2, xmmword [0x1401d62e0]
movdqu xmmword [rbp], xmm2
mov word [rbp - 0x10], si
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14017be59
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movss xmm1, dword [0x1401d62a4]
xorps xmm0, xmm0
call fcn.1401915b0
mov rdx, qword [0x1401e2038]
mov dword [rdx + 0x4114], 0x44548000
mov dword [rdx + 0x4118], 0x432f0000
mov dword [rdx + 0x40f8], 1
mov dword [rdx + 0x4104], 0x43fa0000
mov qword [rdx + 0x4108], 0x43fa0000
mov dword [rdx + 0x4110], esi
mov dword [rdx + 0x40f4], 1
mov byte [rdx + 0x412c], 1
or dword [rdx + 0x40f0], 0x43
mov dword [rdx + 0x4150], 0x3f800000
mov dword [rdx + 0x391c], 0x3f800000
cmp byte [0x1401e2031], 0
je 0x14017bfdf
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, str.GL_DrawBox
call fcn.14018d080
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x100
lea r14, [0x1401e1f20]
mov r8, r14
xor edx, edx
lea rcx, [0x1401cf320]
call fcn.1401c1200
lea rcx, [0x1401cf340]
call fcn.1401bbe90
mov qword [rsp + 0x50], 0
lea rdx, [rsp + 0x50]
lea rcx, [0x1401cf350]
call fcn.1401bc730
test al, al
je 0x14017bfda
nop dword [rax]
inc rbx
cmp byte [r14 + rbx], 0
jne 0x14017bf60
mov rax, qword [0x1401e2088]
cmp rbx, rax
ja 0x14017bfa4
lea rdi, [0x1401e2070]
cmp rax, 0x10
cmovae rdi, qword [0x1401e2070]
mov qword [0x1401e2080], rbx
mov r8, rbx
mov rdx, r14
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + rbx], 0
jmp 0x14017bfb6
mov r9, r14
mov rdx, rbx
lea rcx, [0x1401e2070]
call fcn.14017ee50
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, [0x1401790e0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov byte [0x1401e2031], 0
call fcn.14018fde0
mov dword [rsp + 0x50], 0x432a0000
mov dword [rsp + 0x54], 0x42700000
lea rdx, [rsp + 0x50]
lea rcx, [0x1401cf5f0]
call fcn.1401bc730
test al, al
je 0x14017c00b
mov byte [0x1401e2031], 1
call fcn.1401904a0
call fcn.14018fde0
mov rcx, qword [rbp + 0xc0]
xor rcx, rsp
call fcn.1401c9a40
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop rbp
ret