Function at 0x14001a090
Capabilities:
Create thread
Encode data using xor
Execute command
Log keystrokes via polling
Set console window title

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xb8]
sub rsp, 0x190
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [0x1400ff0c0]
xor rax, rsp
mov qword [rbp + 0x60], rax
xor esi, esi
mov ecx, 8
call fcn.140093d78
lea rcx, [0x140019e40]
mov qword [rax], rcx
mov qword [rsp + 0x68], rax
lea rcx, [rbp - 0x10]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x140027d70]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x18], rax
test rax, rax
je 0x14001b15c
movups xmm3, xmmword [0x1400f0878]
movups xmmword [rsp + 0x38], xmm3
movsd xmm0, qword [0x1400f0888]
movsd qword [rsp + 0x48], xmm0
movzx eax, word [0x1400f0890]
mov word [rsp + 0x50], ax
mov r8d, esi
movdqa xmm7, xmmword [0x1400f0ae0]
mov edi, dword [reloc.WS2_32.dll_accept]
cmp edi, 2
jl 0x14001a3af
movdqa xmm4, xmmword [0x1400f0b20]
movdqa xmm5, xmmword [str.6666]
movdqa xmm6, xmmword [0x1400f0b00]
movdqa xmm2, xmmword [0x1400f0a20]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm6
movd eax, xmm3
movd xmm0, eax
xorps xmm2, xmm0
movd dword [rsp + 0x38], xmm2
movdqa xmm2, xmmword [0x1400f0a30]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm6
movd xmm0, dword [rsp + 0x3c]
xorps xmm2, xmm0
movd dword [rsp + 0x3c], xmm2
movdqa xmm3, xmmword [0x1400f0a40]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm3, xmm0
andps xmm3, xmm7
packuswb xmm3, xmm3
packuswb xmm3, xmm3
paddb xmm3, xmm6
movd xmm0, dword [rsp + 0x40]
xorps xmm3, xmm0
movd dword [rsp + 0x40], xmm3
movdqa xmm2, xmmword [0x1400f0a50]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm6
movd xmm0, dword [rsp + 0x44]
xorps xmm2, xmm0
movd dword [rsp + 0x44], xmm2
movdqa xmm3, xmmword [0x1400f0a60]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm3, xmm0
andps xmm3, xmm7
packuswb xmm3, xmm3
packuswb xmm3, xmm3
paddb xmm3, xmm6
movd xmm0, dword [rsp + 0x48]
xorps xmm3, xmm0
movd dword [rsp + 0x48], xmm3
movdqa xmm2, xmmword [0x1400f0a70]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm6
movd xmm0, dword [rsp + 0x4c]
xorps xmm2, xmm0
movd dword [rsp + 0x4c], xmm2
mov r8d, Ordinal_27
mov eax, r8d
lea r9, [rsp + 0x38]
add r9, rax
nop word [rax + rax]
mov eax, 0x4bda12f7
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x36
movzx eax, r8b
sub al, cl
add al, 0x33
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x1a
jl 0x14001a3c0
lea rcx, [rsp + 0x38]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
mov dword [rbp], 0x54
lea r8, [rbp]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentConsoleFontEx]
lea r8, str.Consolas
mov edx, reloc.WLDAP32.dll_Ordinal_32
lea rcx, [rbp + 0x14]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
mov eax, reloc.WS2_32.dll_ntohl
mov word [rbp + 0xa], ax
lea r8, [rbp]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetCurrentConsoleFontEx]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rbx, rax
mov r9d, 3
mov r8b, 0xe1
mov edx, 0xd9d3f3
mov rcx, rax
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
lea r8, [0x140019e00]
mov edx, 0xfffffffc
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
mov edx, 0xfffffff0
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowLongW]
btr eax, 0x13
mov r8d, eax
mov edx, 0xfffffff0
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowLongW]
movups xmm6, xmmword [0x1400eff50]
movups xmmword [rsp + 0x68], xmm6
movzx eax, word [0x1400eff60]
mov word [rsp + 0x78], ax
mov r8d, esi
cmp edi, 2
jl 0x14001a673
movdqa xmm4, xmmword [0x1400f0b20]
movdqa xmm5, xmmword [str.6666]
movdqa xmm3, xmmword [0x1400f0a20]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm3, xmm0
andps xmm3, xmm7
packuswb xmm3, xmm3
packuswb xmm3, xmm3
mov ecx, dword [0x1400f0b00]
movd xmm0, ecx
paddb xmm3, xmm0
movd eax, xmm6
movd xmm0, eax
xorps xmm3, xmm0
movd dword [rsp + 0x68], xmm3
movdqa xmm2, xmmword [0x1400f0a30]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, ecx
paddb xmm2, xmm0
movd xmm1, dword [rsp + 0x6c]
xorps xmm2, xmm1
movd dword [rsp + 0x6c], xmm2
movdqa xmm3, xmmword [0x1400f0a40]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm3, xmm0
andps xmm3, xmm7
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd xmm0, ecx
paddb xmm3, xmm0
movd xmm1, dword [rsp + 0x70]
xorps xmm3, xmm1
movd dword [rsp + 0x70], xmm3
movdqa xmm2, xmmword [0x1400f0a50]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, ecx
paddb xmm2, xmm0
movd xmm1, dword [rsp + 0x74]
xorps xmm2, xmm1
movd dword [rsp + 0x74], xmm2
mov r8d, reloc.WS2_32.dll_recv
mov eax, r8d
lea r9, [rsp + 0x68]
add r9, rax
nop
mov eax, 0x4bda12f7
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x36
movzx eax, r8b
sub al, cl
add al, 0x33
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x12
jl 0x14001a680
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], rsi
mov qword [rbp - 0x20], rsi
lea rax, [rsp + 0x68]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14001a6d0
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x38]
call fcn.140018af0
nop
lea rcx, [rbp - 0x38]
cmp qword [rbp - 0x20], 0xf
jbe 0x14001a6f8
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
movups xmm0, xmmword [0x1400f09c0]
movups xmmword [rsp + 0x68], xmm0
mov r10, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov r8d, esi
cmp edi, 2
jl 0x14001a8c3
movdqa xmm4, xmmword [0x1400f0b20]
movdqa xmm5, xmmword [str.6666]
movdqa xmm3, xmmword [0x1400f0a20]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm3, xmm0
andps xmm3, xmm7
packuswb xmm3, xmm3
packuswb xmm3, xmm3
mov eax, dword [0x1400f0b00]
movd xmm0, eax
paddb xmm3, xmm0
movd xmm0, dword [0x1400f09c0]
xorps xmm3, xmm0
movd dword [rsp + 0x68], xmm3
movdqa xmm2, xmmword [0x1400f0a30]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, eax
paddb xmm2, xmm0
movd xmm1, dword [rsp + 0x6c]
xorps xmm2, xmm1
movd dword [rsp + 0x6c], xmm2
movdqa xmm3, xmmword [0x1400f0a40]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm3, xmm0
andps xmm3, xmm7
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd xmm0, eax
paddb xmm3, xmm0
movd xmm1, dword [rsp + 0x70]
xorps xmm3, xmm1
movd dword [rsp + 0x70], xmm3
movdqa xmm2, xmmword [0x1400f0a50]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, eax
paddb xmm2, xmm0
movd xmm1, dword [rsp + 0x74]
xorps xmm2, xmm1
movd dword [rsp + 0x74], xmm2
jmp 0x14001a902
lea r9, [rsp + 0x68]
nop dword [rax + rax]
mov eax, 0x2f684bdb
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
movzx eax, r8b
sub al, cl
add al, 0x33
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x10
jl 0x14001a8d0
lea rdx, [rsp + 0x68]
mov rcx, r10
call fcn.14001f120
lea rcx, [0x140111ee0]
call fcn.14003c760
mov eax, dword [str.PXF6]
mov dword [rsp + 0x30], eax
mov r8d, esi
cmp edi, 2
jl 0x14001a99c
movdqa xmm3, xmmword [0x1400f0a20]
movdqa xmm2, xmm3
punpckldq xmm2, xmm3
pmuldq xmm2, xmmword [0x1400f0b20]
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmmword [0x1400f0b20]
shufps xmm2, xmm0, 0xdd
psrad xmm2, 4
movdqa xmm0, xmm2
psrld xmm0, 0x1f
paddd xmm0, xmm2
pmulld xmm0, xmmword [str.6666]
psubd xmm3, xmm0
andps xmm3, xmm7
packuswb xmm3, xmm3
packuswb xmm3, xmm3
paddb xmm3, xmmword [0x1400f0b00]
movd xmm0, eax
xorps xmm3, xmm0
movd dword [rsp + 0x30], xmm3
jmp 0x14001a9d3
lea r9, [rsp + 0x30]
mov eax, 0x2f684bdb
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
movzx eax, r8b
sub al, cl
add al, 0x33
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 4
jl 0x14001a9a1
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.140018ec0
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x50], xmm1
mov rax, rsi
mov qword [rsp + 0x60], rax
mov qword [rbp - 0x40], rax
movdqu xmmword [rbp - 0x68], xmm1
mov qword [rbp - 0x58], rsi
movdqu xmmword [rbp - 0x80], xmm1
mov qword [rbp - 0x70], rsi
mov edi, esi
mov dword [rsp + 0x30], esi
mov rsi, qword [rbp - 0x48]
mov rbx, qword [rbp - 0x50]
mov qword [rsp + 0x58], rbx
mov r14, qword [rbp - 0x60]
mov r12, qword [rbp - 0x68]
mov r15, qword [rbp - 0x78]
mov r13, qword [rbp - 0x80]
nop dword [rax]
call fcn.140019b00
test eax, eax
je 0x14001aa40
cmp eax, edi
je 0x14001aa72
mov dword [rsp + 0x30], eax
cmp rbx, rsi
cmovne rsi, rbx
mov qword [rbp - 0x48], rsi
cmp r12, r14
cmovne r14, r12
mov qword [rbp - 0x60], r14
cmp r13, r15
cmovne r15, r13
mov qword [rbp - 0x78], r15
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x14001af8c
cmp rbx, rsi
je 0x14001aaa1
cmp r12, r14
je 0x14001aaa1
cmp r13, r15
jne 0x14001ad47
mov r9d, 6
lea r8, [0x1400efee0]
mov rdx, rdi
lea rcx, [rsp + 0x38]
call fcn.140019c40
mov qword [rsp + 0x68], rax
lea rcx, [rbp - 0x50]
cmp rcx, rax
je 0x14001ab42
test rbx, rbx
je 0x14001ab14
mov rax, qword [rsp + 0x60]
sub rax, rbx
sar rax, 3
lea rdx, [rax*8]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14001ab07
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001afb8
mov rcx, rbx
call fcn.140093d70
mov rax, qword [rsp + 0x68]
mov rbx, qword [rax]
mov qword [rsp + 0x58], rbx
mov qword [rbp - 0x50], rbx
mov rsi, qword [rax + 8]
mov qword [rbp - 0x48], rsi
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x60], rcx
mov qword [rbp - 0x40], rcx
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14001ab8a
mov rax, qword [rsp + 0x48]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ab85
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001afb8
call fcn.140093d70
mov r9d, 0xa
lea r8, [0x1400eff10]
mov rdx, rdi
lea rcx, [rsp + 0x38]
call fcn.140019c40
mov qword [rsp + 0x68], rax
lea rcx, [rbp - 0x68]
cmp rcx, rax
je 0x14001ac21
test r12, r12
je 0x14001abfd
mov rax, qword [rbp - 0x58]
sub rax, r12
sar rax, 3
lea rdx, [rax*8]
mov rax, r12
cmp rdx, 0x1000
jb 0x14001abf0
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001afbf
mov rcx, r12
call fcn.140093d70
mov rax, qword [rsp + 0x68]
mov r12, qword [rax]
mov qword [rbp - 0x68], r12
mov r14, qword [rax + 8]
mov qword [rbp - 0x60], r14
mov rcx, qword [rax + 0x10]
mov qword [rbp - 0x58], rcx
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14001ac69
mov rax, qword [rsp + 0x48]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ac64
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001afbf
call fcn.140093d70
mov r9d, 6
lea r8, [0x1400efed0]
mov rdx, rdi
lea rcx, [rsp + 0x38]
call fcn.140019c40
mov qword [rsp + 0x68], rax
lea rcx, [rbp - 0x80]
cmp rcx, rax
je 0x14001acff
test r13, r13
je 0x14001acdb
mov rax, qword [rbp - 0x70]
sub rax, r13
sar rax, 3
lea rdx, [rax*8]
mov rax, r13
cmp rdx, 0x1000
jb 0x14001acce
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001afc6
mov rcx, r13
call fcn.140093d70
mov rax, qword [rsp + 0x68]
mov r13, qword [rax]
mov qword [rbp - 0x80], r13
mov r15, qword [rax + 8]
mov qword [rbp - 0x78], r15
mov rcx, qword [rax + 0x10]
mov qword [rbp - 0x70], rcx
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14001ad47
mov rax, qword [rsp + 0x48]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ad42
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001afc6
call fcn.140093d70
cmp rbx, rsi
je 0x14001af7a
cmp r12, r14
je 0x14001af7a
cmp r13, r15
je 0x14001af7a
mov edx, 0x320
mov ecx, 0x140
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x24
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x14001afcd
call fcn.140019b00
test eax, eax
je 0x14001af65
mov ecx, 0x47
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14001ae46
cmp byte [0x140108bb0], 0
jne 0x14001ae4d
cmp byte [0x140108bb1], 0
sete al
mov byte [0x140108bb1], al
mov byte [0x140108bb0], 1
test al, al
je 0x14001ae00
nop
mov qword [rsp + 0x20], 0
mov r9d, 6
lea r8, [0x1400efee8]
mov rdx, qword [rbx]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
add rbx, 8
cmp rbx, rsi
jne 0x14001add0
jmp 0x14001ae2b
mov qword [rsp + 0x20], 0
mov r9d, 6
lea r8, [0x1400efed8]
mov rdx, qword [rbx]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
add rbx, 8
cmp rbx, rsi
jne 0x14001ae00
cmp byte [0x140108bb1], 0
jne 0x14001ae4d
mov edx, Ordinal_301
mov ecx, reloc.WLDAP32.dll_Ordinal_50
call qword [sym.imp.KERNEL32.dll_Beep]
jmp 0x14001ae4d
mov byte [0x140108bb0], 0
mov ecx, 0x55
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14001ae8b
mov rbx, r12
mov qword [rsp + 0x20], 0
mov r9d, 0xa
lea r8, [0x1400eff00]
mov rdx, qword [rbx]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
add rbx, 8
cmp rbx, r14
jne 0x14001ae60
mov ecx, 0x49
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14001aecb
mov rbx, r13
nop
mov qword [rsp + 0x20], 0
mov r9d, 6
lea r8, [0x1400efec0]
mov rdx, qword [rbx]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
add rbx, 8
cmp rbx, r15
jne 0x14001aea0
mov ecx, 0x50
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
mov rbx, qword [rsp + 0x58]
jns 0x14001ad72
mov rbx, r12
nop word [rax + rax]
mov qword [rsp + 0x20], 0
mov r9d, 0xa
lea r8, [0x1400eff40]
mov rdx, qword [rbx]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
add rbx, 8
cmp rbx, r14
jne 0x14001aef0
mov rbx, r13
nop
mov qword [rsp + 0x20], 0
mov r9d, 6
lea r8, [0x1400efef0]
mov rdx, qword [rbx]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
add rbx, 8
cmp rbx, r15
jne 0x14001af20
mov edx, Ordinal_301
mov ecx, reloc.WLDAP32.dll_Ordinal_50
call qword [sym.imp.KERNEL32.dll_Beep]
mov rbx, qword [rsp + 0x58]
jmp 0x14001ad72
mov rsi, rbx
mov qword [rbp - 0x48], rbx
mov r14, r12
mov qword [rbp - 0x60], r12
mov r15, r13
mov qword [rbp - 0x78], r13
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [rsp + 0x30]
jmp 0x14001aa40
lea rdx, str.Failed_to_open_process.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14001f120
lea rdx, [0x14001f520]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edi, dword [rsp + 0x30]
jmp 0x14001aa40
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, Ordinal_301
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Beep]
nop
test r13, r13
je 0x14001b030
mov rax, qword [rbp - 0x70]
sub rax, r13
sar rax, 3
lea rdx, [rax*8]
mov rax, r13
cmp rdx, 0x1000
jb 0x14001b027
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001b027
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r13
call fcn.140093d70
nop
test r12, r12
je 0x14001b07a
mov rax, qword [rbp - 0x58]
sub rax, r12
sar rax, 3
lea rdx, [rax*8]
mov rax, r12
cmp rdx, 0x1000
jb 0x14001b071
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001b071
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r12
call fcn.140093d70
nop
test rbx, rbx
je 0x14001b0c4
mov rax, qword [rsp + 0x60]
sub rax, rbx
sar rax, 3
lea rdx, [rax*8]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14001b0bb
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001b0bb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.140093d70
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0xf
jbe 0x14001b102
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b0fd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001b0fd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140093d70
mov qword [rbp - 0x28], 0
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x38], 0
cmp dword [rbp - 0x10], 0
je 0x14001b123
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
xor eax, eax
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.140093d50
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov dword [rbp - 0x10], esi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3